@testchimp/cli 0.1.79 → 0.1.80

package/dist/core/client.js

@@ -1,10 +1,27 @@
 /** HTTP client for TestChimp MCP proxy APIs. */
 export const DEFAULT_BACKEND = "https://featureservice.testchimp.io";
+function isTestChimpSaasFeatureservice(hostname) {
+    return hostname === "featureservice.testchimp.io"
+        || /^featureservice-[a-z0-9-]+\.testchimp\.io$/i.test(hostname);
+}
 export function getBackendUrl() {
     const raw = process.env.TESTCHIMP_BACKEND_URL?.trim();
     if (!raw)
         return DEFAULT_BACKEND;
-    return raw.replace(/\/$/, "");
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`TESTCHIMP_BACKEND_URL must be an absolute http(s) URL; received ${JSON.stringify(raw)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`TESTCHIMP_BACKEND_URL must use http or https; received ${parsed.protocol}`);
+    }
+    if (parsed.protocol === "http:" && isTestChimpSaasFeatureservice(parsed.hostname)) {
+        throw new Error(`TESTCHIMP_BACKEND_URL must use https for TestChimp SaaS; change it to https://${parsed.host}`);
+    }
+    return raw.replace(/\/+$/, "");
 }
 export function requireApiKey() {
     const k = process.env.TESTCHIMP_API_KEY?.trim();
@@ -18,12 +35,18 @@ export async function postMcp(path, body) {
     const url = `${getBackendUrl()}${path}`;
     const res = await fetch(url, {
         method: "POST",
+        redirect: "manual",
         headers: {
             "Content-Type": "application/json",
             "TestChimp-Api-Key": apiKey,
         },
         body: JSON.stringify(body ?? {}),
     });
+    if (res.status >= 300 && res.status < 400) {
+        const location = res.headers.get("location");
+        const destination = location ? ` to ${location}` : "";
+        throw new Error(`TestChimp API redirected ${res.status}${destination}. Refusing to follow because an HTTP redirect may rewrite POST to GET; set TESTCHIMP_BACKEND_URL to the final HTTPS featureservice URL.`);
+    }
     const text = await res.text();
     if (!res.ok) {
         throw new Error(`TestChimp API ${res.status} ${res.statusText}: ${text}`);

package/dist/core/client.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/client.test.js

@@ -0,0 +1,54 @@
+import assert from "node:assert/strict";
+import { afterEach, describe, it } from "node:test";
+import { getBackendUrl, postMcp } from "./client.js";
+const originalBackendUrl = process.env.TESTCHIMP_BACKEND_URL;
+const originalApiKey = process.env.TESTCHIMP_API_KEY;
+const originalFetch = globalThis.fetch;
+afterEach(() => {
+    if (originalBackendUrl == null)
+        delete process.env.TESTCHIMP_BACKEND_URL;
+    else
+        process.env.TESTCHIMP_BACKEND_URL = originalBackendUrl;
+    if (originalApiKey == null)
+        delete process.env.TESTCHIMP_API_KEY;
+    else
+        process.env.TESTCHIMP_API_KEY = originalApiKey;
+    globalThis.fetch = originalFetch;
+});
+describe("getBackendUrl", () => {
+    it("rejects insecure TestChimp SaaS URLs", () => {
+        process.env.TESTCHIMP_BACKEND_URL = "http://featureservice.testchimp.io";
+        assert.throws(() => getBackendUrl(), /must use https for TestChimp SaaS/);
+        process.env.TESTCHIMP_BACKEND_URL = "http://featureservice-staging.testchimp.io/";
+        assert.throws(() => getBackendUrl(), /must use https for TestChimp SaaS/);
+    });
+    it("allows HTTP for local and self-hosted development", () => {
+        process.env.TESTCHIMP_BACKEND_URL = "http://localhost:4301/";
+        assert.equal(getBackendUrl(), "http://localhost:4301");
+        process.env.TESTCHIMP_BACKEND_URL = "http://featureservice.internal/";
+        assert.equal(getBackendUrl(), "http://featureservice.internal");
+    });
+    it("rejects invalid and unsupported URLs", () => {
+        process.env.TESTCHIMP_BACKEND_URL = "featureservice.testchimp.io";
+        assert.throws(() => getBackendUrl(), /absolute http\(s\) URL/);
+        process.env.TESTCHIMP_BACKEND_URL = "ftp://featureservice.internal";
+        assert.throws(() => getBackendUrl(), /must use http or https/);
+    });
+});
+describe("postMcp", () => {
+    it("does not follow redirects that could change POST to GET", async () => {
+        process.env.TESTCHIMP_BACKEND_URL = "https://featureservice.example.com";
+        process.env.TESTCHIMP_API_KEY = "test-key";
+        let requestInit;
+        globalThis.fetch = (async (_input, init) => {
+            requestInit = init;
+            return new Response(null, {
+                status: 301,
+                headers: { location: "https://featureservice.testchimp.io/api/mcp/example" },
+            });
+        });
+        await assert.rejects(postMcp("/api/mcp/example", {}), /Refusing to follow because an HTTP redirect may rewrite POST to GET/);
+        assert.equal(requestInit?.method, "POST");
+        assert.equal(requestInit?.redirect, "manual");
+    });
+});

package/dist/core/schemas.d.ts

@@ -23,8 +23,8 @@ export declare const listCoverageInput: z.ZodObject<{
         android: "android";
     }>>;
     recordTypes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        smart_test: "smart_test";
         manual: "manual";
+        smart_test: "smart_test";
         perf_test: "perf_test";
         SMART_TEST: "SMART_TEST";
         MANUAL: "MANUAL";

package/dist/core/tools.js

@@ -1276,8 +1276,11 @@ export const TOOL_DEFINITIONS = [
     },
     {
         kebab: "list-api-operations",
-        description: "List API operations for a service resource with covering-test previews and coverageSummary scores " +
-            "(same payload as the Operations list UI). Prefer --root-file-path (repo-relative OpenAPI root).",
+        description: "List API operations for a service resource with covering-test previews, coverageSummary scores, " +
+            "observability mapping state, and runtimeObservation from the latest finalized production daily summary " +
+            "(with latest-hour fallback). runtimeObservation may include window bounds, requestCount/rpm, errorCount/errorRate, " +
+            "p50/p95/p99LatencyMs, status-class counts, and syncStatus. Missing observability is unknown/not configured, not zero. " +
+            "Use these signals to prioritize uncovered high-volume/high-error operations; prefer --root-file-path.",
         inputSchema: S.listApiOperationsInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -1296,7 +1299,9 @@ export const TOOL_DEFINITIONS = [
     {
         kebab: "get-api-operation-detail",
         description: "Fetch detailed API operation coverage (request/query/response fields, response codes, covering tests) — " +
-            "same payload as the Operation detail UI. Prefer TestChimp operation id (--id ULID); " +
+            "the operation also carries obsMappingState and the latest runtimeObservation daily summary when available. " +
+            "Use request volume/error rate to rank coverage risk and p95/p99 latency to prioritize performance-test work; " +
+            "do not treat absent observations as zero or production latency as a test threshold. Prefer TestChimp operation id (--id ULID); " +
             "or rootFilePath + oasOperationId; or rootFilePath + httpMethod + pathTemplate.",
         inputSchema: S.getApiOperationDetailInput,
         execute: async (args, { postMcp }) => {

package/dist/core/tools.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/tools.test.js

@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { getToolDefinition, runTool } from "./tools.js";
+const runtimeObservation = {
+    windowStartMillis: "1789497600000",
+    windowEndMillis: "1789584000000",
+    requestCount: "125000",
+    rpm: 86.8,
+    errorCount: "2500",
+    errorRate: 0.02,
+    p50LatencyMs: 42,
+    p95LatencyMs: 180,
+    p99LatencyMs: 420,
+    status2xxCount: "122000",
+    status4xxCount: "1000",
+    status5xxCount: "2000",
+    syncStatus: "OBSERVABILITY_SYNC_SUCCESS",
+};
+describe("API operation observability", () => {
+    it("preserves daily observability summaries when listing operations", async () => {
+        const response = JSON.stringify({
+            operations: [{
+                    id: "01OBSERVABILITYOPERATION",
+                    coverageSummary: { coverageScore: 25 },
+                    obsMappingState: "API_OBS_MAPPED",
+                    runtimeObservation,
+                }],
+        });
+        let request;
+        const result = await runTool("list-api-operations", { rootFilePath: "openapi/service.json" }, {
+            postMcp: async (path, body) => {
+                request = { path, body };
+                return response;
+            },
+        });
+        assert.deepEqual(request, {
+            path: "/api/mcp/list_api_operations",
+            body: { rootFilePath: "openapi/service.json" },
+        });
+        assert.deepEqual(JSON.parse(result), JSON.parse(response));
+    });
+    it("preserves observability on operation schema coverage detail", async () => {
+        const response = JSON.stringify({
+            operation: {
+                id: "01OBSERVABILITYOPERATION",
+                obsMappingState: "API_OBS_MAPPED",
+                runtimeObservation,
+            },
+            requestFields: [{ jsonPointer: "/customerId", coveringTests: [] }],
+            responseCodes: [{ responseCode: "500", coveringTests: [] }],
+        });
+        const result = await runTool("get-api-operation-detail", { id: "01OBSERVABILITYOPERATION" }, { postMcp: async () => response });
+        assert.deepEqual(JSON.parse(result), JSON.parse(response));
+        assert.match(getToolDefinition("get-api-operation-detail")?.description ?? "", /p95\/p99 latency/);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@testchimp/cli",
-  "version": "0.1.79",
+  "version": "0.1.80",
   "description": "TestChimp CLI and MCP server — coverage, plans, EaaS, TrueCoverage, API operations (calls /api/mcp/*)",
   "type": "module",
   "main": "dist/bin/testchimp.js",
@@ -13,7 +13,7 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "npm run build && node --test dist/chimphands/llmRetryProxy.test.js dist/chimphands/midTurnSteering.test.js dist/chimphands/steeringSidecar.test.js dist/chimphands/agentBranch.test.js dist/chimphands/worktreeCommitPaths.test.js",
+    "test": "npm run build && node --test dist/core/client.test.js dist/core/tools.test.js dist/chimphands/llmRetryProxy.test.js dist/chimphands/midTurnSteering.test.js dist/chimphands/steeringSidecar.test.js dist/chimphands/agentBranch.test.js dist/chimphands/worktreeCommitPaths.test.js",
     "watch": "tsc --watch",
     "start": "node dist/bin/testchimp.js",
     "prepublishOnly": "npm run build"