@testchimp/cli 0.1.83 → 0.1.85

package/dist/core/tools.js

@@ -1,9 +1,13 @@
 import { normalizeScope } from "./normalize.js";
+import { postIngress, TestChimpHttpError } from "./client.js";
 import { runProvisionEphemeralEnvironmentAndWait } from "./ephemeralWait.js";
 import * as S from "./schemas.js";
 import { resolveGitHeadSha } from "./gitSha.js";
 import { parseDateBoundToMillis } from "./dates.js";
 import { buildAgentTraceabilityPayload, resolveToolchainVersions } from "./agentTraceability.js";
+export const BOT_ACK_PATH = "/bot/events/ack";
+export const BOT_ACK_UNSUPPORTED_MESSAGE = "This TestChimp deployment does not support bot acks yet (ingress returned 404 for /bot/events/ack). " +
+    "Upgrade the TestChimp platform, or ask your admin to enable QA bots.";
 function platformToProtoEnum(platform) {
     switch (platform) {
         case "ios":
@@ -1519,13 +1523,13 @@ export const TOOL_DEFINITIONS = [
     },
     {
         kebab: "get-git-folder-mapping",
-        description: "Return git provider, repository, and mapped plans/tests folder paths for the project.",
+        description: "Return git provider, repository, mapped plans/tests folder paths, and plans branch (empty = repository default) for the project.",
         inputSchema: S.emptyInput,
         execute: async (_args, { postMcp }) => postMcp("/api/mcp/get_git_folder_mapping", {}),
     },
     {
         kebab: "update-git-folder-mapping",
-        description: "Update mapped plans/tests folder paths (and optional repository) on the platform. Agent scaffolds folders in a PR; this records platform mapping.",
+        description: "Update mapped plans/tests folder paths (and optional repository / plans branch) on the platform. Agent scaffolds folders in a PR; this records platform mapping.",
         inputSchema: S.updateGitFolderMappingInput,
         execute: async (args, { postMcp }) => {
             const a = args;
@@ -1539,6 +1543,8 @@ export const TOOL_DEFINITIONS = [
                 body.plans_folder_path = plans;
             if (repo)
                 body.repository_full_name = repo;
+            if (a.plansBranch !== undefined)
+                body.plansBranch = a.plansBranch.trim();
             return postMcp("/api/mcp/update_git_folder_mapping", body);
         },
     },
@@ -1616,6 +1622,112 @@ export const TOOL_DEFINITIONS = [
             });
         },
     },
+    {
+        kebab: "get-my-tasks",
+        description: "List a team member's open QA work in this project: manual test scenarios assigned to them in test runs " +
+            "(with testRunUrl), issues assigned to them (status, severity, due date, issueUrl), and SmartTests they " +
+            "authored that still await verification. With an OAuth token the user is the token's user; with an API key " +
+            "pass userId. Use for daily reminders and 'what should I work on' questions.",
+        inputSchema: S.getMyTasksInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            return postMcp("/api/mcp/get_my_tasks", a.userId ? { userId: a.userId.trim() } : {});
+        },
+    },
+    {
+        kebab: "list-tests-awaiting-verification",
+        description: "List SmartTests whose latest executions still need human verification before they earn a verified badge " +
+            "(testId, testName, filePath, scenarioId / scenarioOrdinalId / scenarioTitle, verificationStatus NOT_VERIFIED " +
+            "or VERIFIED_STALE, reportedAtMillis, workflowExecutionId). " +
+            "Optional userId narrows to tests authored for that user (defaults to the OAuth token's user); optional limit. " +
+            "Use after writing E2E tests to prompt the user to verify the executions.",
+        inputSchema: S.listTestsAwaitingVerificationInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const body = {};
+            if (a.userId)
+                body.userId = a.userId.trim();
+            if (a.limit != null)
+                body.limit = a.limit;
+            return postMcp("/api/mcp/list_tests_awaiting_verification", body);
+        },
+    },
+    {
+        kebab: "get-qa-posture",
+        description: "Project-wide QA posture snapshot: releases (version, lifecycleStatus, due date, passed / failed / blocked / " +
+            "not-attempted counts), issues (active, inProgress, blocked, openBySeverity), activeTestRuns with result " +
+            "counts, and testsAwaitingVerificationCount. Use for weekly " +
+            "QA digests and release-health questions; summarise for the reader's role rather than dumping raw JSON.",
+        inputSchema: S.emptyInput,
+        execute: async (_args, { postMcp }) => postMcp("/api/mcp/get_qa_posture", {}),
+    },
+    {
+        kebab: "get-bot-compat",
+        description: "Return the minimum testchimp skill version, minimum @testchimp/cli version, and the bot event schema " +
+            "version this TestChimp deployment requires from QA bots. Call on bot startup / daily; if the local skill or " +
+            "CLI is older, ask the user to approve an upgrade.",
+        inputSchema: S.emptyInput,
+        execute: async (_args, { postMcp }) => postMcp("/api/mcp/get_bot_compat", {}),
+    },
+    {
+        kebab: "get-bot-profile",
+        description: "Fetch this QA bot's registration: botId, project, the team member it represents (userId), platform, status, " +
+            "role, responsibilities, capabilities, event subscriptions, paused flag, and webhook health. botId defaults to " +
+            "the bot-id header (TESTCHIMP_BOT_ID) or the OAuth token's bot. Use to confirm identity before onboarding and " +
+            "to check paused / capabilities before running routines.",
+        inputSchema: S.getBotProfileInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            return postMcp("/api/mcp/get_bot_profile", a.botId ? { botId: a.botId } : {});
+        },
+    },
+    {
+        kebab: "register-bot-profile",
+        description: "Register or replace this QA bot's profile and event subscriptions atomically (mutating — confirm with the user " +
+            "first). role: QA_LEAD | PM | QA_ENGINEER | DEVELOPER. responsibilities: the user's own words. capabilities: " +
+            "REQUIREMENTS_UPDATE, E2E_AUTHORING, ISSUE_FIX, MANUAL_TEST_COORDINATION, TEST_BATCH_FIX, QA_POSTURE. " +
+            "subscriptions: [{eventType, filters:[{field, op:'eq', value}]}] where value may be 'me' (e.g. git-push " +
+            "author=me, issue-assigned assignee=me, e2e-batch-completed). Derive subscriptions from capabilities per the " +
+            "testchimp skill's bot onboarding guide. botId defaults to the bot-id header / OAuth token.",
+        inputSchema: S.registerBotProfileInput,
+        execute: async (args, { postMcp }) => {
+            const a = args;
+            const body = {
+                role: a.role,
+                responsibilities: a.responsibilities?.trim() ?? "",
+                capabilities: a.capabilities,
+                subscriptions: a.subscriptions.map((s) => ({
+                    eventType: s.eventType.trim(),
+                    filters: (s.filters ?? []).map((f) => ({ field: f.field.trim(), op: f.op, value: f.value.trim() })),
+                })),
+            };
+            if (a.botId)
+                body.botId = a.botId;
+            return postMcp("/bots/register_profile", body);
+        },
+    },
+    {
+        kebab: "ack-bot-events",
+        description: "Acknowledge QA-bot webhook events by eventId (1-100 per call) so TestChimp stops redelivering them. Ack every " +
+            "event you handled or decided to ignore (including expired / irrelevant ones); re-acking is safe. Pass the " +
+            "delivery's ackUrl when present (defaults to the ingress /bot/events/ack). Returns per-id status: " +
+            "BOT_ACK_ACCEPTED / BOT_ACK_ACKED / BOT_ACK_ALREADY_ACKED / BOT_ACK_EXPIRED_RECORDED are fine; " +
+            "BOT_ACK_UNKNOWN_EVENT / BOT_ACK_NOT_A_TARGET / BOT_ACK_MISSING_BOT_ID indicate a wrong id or bot identity.",
+        inputSchema: S.ackBotEventsInput,
+        execute: async (args, ctx) => {
+            const a = args;
+            const post = ctx.postIngress ?? postIngress;
+            const eventIds = Array.from(new Set(a.eventIds));
+            try {
+                return await post(a.ackUrl?.trim() || BOT_ACK_PATH, { eventIds });
+            }
+            catch (e) {
+                if (e instanceof TestChimpHttpError && e.status === 404)
+                    throw new Error(BOT_ACK_UNSUPPORTED_MESSAGE);
+                throw e;
+            }
+        },
+    },
 ];
 const TOOL_BY_KEBAB = new Map(TOOL_DEFINITIONS.map((t) => [t.kebab, t]));
 export function getToolDefinition(kebab) {

package/dist/core/tools.test.js

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
+import { TestChimpHttpError } from "./client.js";
 import { getToolDefinition, runTool } from "./tools.js";
 const runtimeObservation = {
     windowStartMillis: "1789497600000",
@@ -163,3 +164,96 @@ describe("list-meeting-filter-options", () => {
         assert.deepEqual(request, { path: "/api/mcp/list_meeting_filter_options", body: {} });
     });
 });
+describe("ack-bot-events", () => {
+    it("posts deduped eventIds to the delivery ackUrl", async () => {
+        let request;
+        const response = JSON.stringify({ results: [{ eventId: "e1", status: "BOT_ACK_ACKED" }] });
+        const result = await runTool("ack-bot-events", { eventIds: ["e1", "e1", "e2"], ackUrl: "https://ingress.testchimp.io/bot/events/ack" }, {
+            postMcp: async () => assert.fail("ack must not go to featureservice"),
+            postIngress: async (pathOrUrl, body) => {
+                request = { pathOrUrl, body };
+                return response;
+            },
+        });
+        assert.deepEqual(request, {
+            pathOrUrl: "https://ingress.testchimp.io/bot/events/ack",
+            body: { eventIds: ["e1", "e2"] },
+        });
+        assert.equal(result, response);
+    });
+    it("defaults to the ingress ack path", async () => {
+        let target;
+        await runTool("ack-bot-events", { eventIds: ["e1"] }, {
+            postMcp: async () => "{}",
+            postIngress: async (pathOrUrl) => {
+                target = pathOrUrl;
+                return "{}";
+            },
+        });
+        assert.equal(target, "/bot/events/ack");
+    });
+    it("explains a 404 from an older backend", async () => {
+        await assert.rejects(runTool("ack-bot-events", { eventIds: ["e1"] }, {
+            postMcp: async () => "{}",
+            postIngress: async () => {
+                throw new TestChimpHttpError(404, "Not Found", "");
+            },
+        }), /does not support bot acks yet/);
+    });
+    it("validates eventIds count and characters", async () => {
+        const ctx = { postMcp: async () => "{}", postIngress: async () => "{}" };
+        await assert.rejects(runTool("ack-bot-events", { eventIds: [] }, ctx), /Invalid input/);
+        const tooMany = Array.from({ length: 101 }, (_, i) => `e${i}`);
+        await assert.rejects(runTool("ack-bot-events", { eventIds: tooMany }, ctx), /Invalid input/);
+        await assert.rejects(runTool("ack-bot-events", { eventIds: ["é"] }, ctx), /Invalid input/);
+    });
+});
+describe("bot tools", () => {
+    async function capture(kebab, args) {
+        let request;
+        await runTool(kebab, args, {
+            postMcp: async (path, body) => {
+                request = { path, body };
+                return "{}";
+            },
+        });
+        return request;
+    }
+    it("maps read tools to their endpoints", async () => {
+        assert.deepEqual(await capture("get-my-tasks", { userId: "u1" }), {
+            path: "/api/mcp/get_my_tasks",
+            body: { userId: "u1" },
+        });
+        assert.deepEqual(await capture("get-my-tasks", {}), { path: "/api/mcp/get_my_tasks", body: {} });
+        assert.deepEqual(await capture("list-tests-awaiting-verification", { limit: 5 }), {
+            path: "/api/mcp/list_tests_awaiting_verification",
+            body: { limit: 5 },
+        });
+        assert.deepEqual(await capture("get-qa-posture", {}), { path: "/api/mcp/get_qa_posture", body: {} });
+        assert.deepEqual(await capture("get-bot-compat", {}), { path: "/api/mcp/get_bot_compat", body: {} });
+        assert.deepEqual(await capture("get-bot-profile", {}), { path: "/api/mcp/get_bot_profile", body: {} });
+    });
+    it("registers a bot profile with default filter op", async () => {
+        assert.deepEqual(await capture("register-bot-profile", {
+            role: "QA_ENGINEER",
+            responsibilities: " checkout flows ",
+            capabilities: ["E2E_AUTHORING", "TEST_BATCH_FIX"],
+            subscriptions: [
+                { eventType: "git-push", filters: [{ field: "author", value: "me" }] },
+                { eventType: "e2e-batch-completed" },
+            ],
+        }), {
+            path: "/bots/register_profile",
+            body: {
+                role: "QA_ENGINEER",
+                responsibilities: "checkout flows",
+                capabilities: ["E2E_AUTHORING", "TEST_BATCH_FIX"],
+                subscriptions: [
+                    { eventType: "git-push", filters: [{ field: "author", op: "eq", value: "me" }] },
+                    { eventType: "e2e-batch-completed", filters: [] },
+                ],
+            },
+        });
+        await assert.rejects(capture("register-bot-profile", { role: "CEO" }), /Invalid input/);
+    });
+});

package/dist/mcp/httpServer.d.ts

@@ -0,0 +1,14 @@
+import { type Server } from "node:http";
+export declare const MAX_MCP_BODY_BYTES: number;
+export interface McpHttpServerOptions {
+    port: number;
+    host: string;
+}
+/**
+ * Unverified peek at a JWT `exp` so expired access tokens get an HTTP 401 (which makes MCP clients
+ * refresh) instead of a tool-level error. Signature verification stays with TestChimp.
+ */
+export declare function isExpiredJwt(token: string, nowSeconds?: number): boolean;
+/** Remote MCP (Streamable HTTP, stateless). Each caller's bearer is forwarded to TestChimp; env credentials are never used. */
+export declare function createMcpHttpServer(): Server;
+export declare function runMcpHttpServer(options: McpHttpServerOptions): Promise<Server>;

package/dist/mcp/httpServer.js

@@ -0,0 +1,169 @@
+import { createServer } from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { getBackendUrl, runWithRequestAuth } from "../core/client.js";
+import { createMcpServer } from "./server.js";
+export const MAX_MCP_BODY_BYTES = 1024 * 1024;
+const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+class BodyTooLargeError extends Error {
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+/** Public origin of this server: TESTCHIMP_MCP_PUBLIC_URL, else derived from the request (Cloud Run sets X-Forwarded-Proto). */
+function publicBaseUrl(req) {
+    const configured = process.env.TESTCHIMP_MCP_PUBLIC_URL?.trim();
+    if (configured)
+        return configured.replace(/\/+$/, "").replace(/\/mcp$/, "");
+    const proto = firstHeader(req.headers["x-forwarded-proto"])?.split(",")[0].trim() === "https" ? "https" : "http";
+    const host = firstHeader(req.headers["x-forwarded-host"])?.split(",")[0].trim() || req.headers.host || "localhost";
+    return `${proto}://${host}`;
+}
+function authorizationServer() {
+    return process.env.TESTCHIMP_OAUTH_ISSUER?.trim().replace(/\/+$/, "") || getBackendUrl();
+}
+function sendJson(res, status, body, headers = {}) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(payload),
+        ...headers,
+    });
+    res.end(payload);
+}
+function jsonRpcError(res, status, message, headers = {}) {
+    sendJson(res, status, { jsonrpc: "2.0", error: { code: -32000, message }, id: null }, headers);
+}
+function bearerToken(req) {
+    const match = /^Bearer\s+(\S+)\s*$/i.exec(firstHeader(req.headers.authorization) ?? "");
+    return match?.[1];
+}
+/**
+ * Unverified peek at a JWT `exp` so expired access tokens get an HTTP 401 (which makes MCP clients
+ * refresh) instead of a tool-level error. Signature verification stays with TestChimp.
+ */
+export function isExpiredJwt(token, nowSeconds = Math.floor(Date.now() / 1000)) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return false;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        return typeof payload.exp === "number" && payload.exp <= nowSeconds;
+    }
+    catch {
+        return false;
+    }
+}
+async function readJsonBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        size += buf.length;
+        if (size > MAX_MCP_BODY_BYTES)
+            throw new BodyTooLargeError();
+        chunks.push(buf);
+    }
+    const text = Buffer.concat(chunks).toString("utf8");
+    return text.trim() === "" ? undefined : JSON.parse(text);
+}
+async function handleMcpPost(req, res) {
+    const token = bearerToken(req);
+    if (!token) {
+        const metadataUrl = `${publicBaseUrl(req)}${PROTECTED_RESOURCE_PATH}`;
+        jsonRpcError(res, 401, "Unauthorized: Authorization: Bearer <token> is required", {
+            "WWW-Authenticate": `Bearer resource_metadata="${metadataUrl}"`,
+        });
+        return;
+    }
+    if (isExpiredJwt(token)) {
+        const metadataUrl = `${publicBaseUrl(req)}${PROTECTED_RESOURCE_PATH}`;
+        jsonRpcError(res, 401, "Unauthorized: access token expired", {
+            "WWW-Authenticate": `Bearer error="invalid_token", error_description="expired", resource_metadata="${metadataUrl}"`,
+        });
+        return;
+    }
+    const declaredLength = Number(firstHeader(req.headers["content-length"]) ?? 0);
+    if (declaredLength > MAX_MCP_BODY_BYTES) {
+        jsonRpcError(res, 413, "Request body too large");
+        return;
+    }
+    let body;
+    try {
+        body = await readJsonBody(req);
+    }
+    catch (e) {
+        if (e instanceof BodyTooLargeError)
+            jsonRpcError(res, 413, "Request body too large");
+        else
+            jsonRpcError(res, 400, "Parse error: request body must be JSON");
+        return;
+    }
+    const server = createMcpServer();
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+        enableJsonResponse: true,
+    });
+    res.on("close", () => {
+        void transport.close();
+        void server.close();
+    });
+    const botId = firstHeader(req.headers["bot-id"])?.trim() || undefined;
+    await runWithRequestAuth({ bearerToken: token, botId, isolated: true }, async () => {
+        await server.connect(transport);
+        await transport.handleRequest(req, res, body);
+    });
+}
+async function route(req, res) {
+    const path = new URL(req.url ?? "/", "http://localhost").pathname.replace(/\/+$/, "") || "/";
+    if (path === "/healthz") {
+        sendJson(res, 200, { status: "ok" });
+        return;
+    }
+    if (path === PROTECTED_RESOURCE_PATH || path === `${PROTECTED_RESOURCE_PATH}/mcp`) {
+        if (req.method !== "GET" && req.method !== "HEAD") {
+            sendJson(res, 405, { error: "Method not allowed" }, { Allow: "GET" });
+            return;
+        }
+        // RFC 9728 protected-resource metadata keys are spec-mandated snake_case.
+        sendJson(res, 200, {
+            resource: `${publicBaseUrl(req)}/mcp`,
+            authorization_servers: [authorizationServer()],
+            bearer_methods_supported: ["header"],
+            scopes_supported: ["testchimp"],
+        });
+        return;
+    }
+    if (path === "/mcp") {
+        if (req.method === "POST") {
+            await handleMcpPost(req, res);
+            return;
+        }
+        jsonRpcError(res, 405, "Method not allowed (stateless server: use POST)", { Allow: "POST" });
+        return;
+    }
+    sendJson(res, 404, { error: "Not found" });
+}
+/** Remote MCP (Streamable HTTP, stateless). Each caller's bearer is forwarded to TestChimp; env credentials are never used. */
+export function createMcpHttpServer() {
+    return createServer((req, res) => {
+        route(req, res).catch((e) => {
+            console.error(`[testchimp mcp] request failed: ${e instanceof Error ? e.message : String(e)}`);
+            if (!res.headersSent)
+                jsonRpcError(res, 500, "Internal server error");
+            else
+                res.end();
+        });
+    });
+}
+export async function runMcpHttpServer(options) {
+    const server = createMcpHttpServer();
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, options.host, () => resolve());
+    });
+    console.error(`[testchimp mcp] Streamable HTTP listening on http://${options.host}:${options.port}/mcp`);
+    const shutdown = () => server.close(() => process.exit(0));
+    process.once("SIGTERM", shutdown);
+    process.once("SIGINT", shutdown);
+    return server;
+}

package/dist/mcp/httpServer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mcp/httpServer.test.js

@@ -0,0 +1,108 @@
+import assert from "node:assert/strict";
+import { after, afterEach, before, describe, it } from "node:test";
+import { createMcpHttpServer, isExpiredJwt } from "./httpServer.js";
+const originalFetch = globalThis.fetch;
+const originalEnv = { ...process.env };
+let server;
+let baseUrl;
+before(async () => {
+    server = createMcpHttpServer();
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", () => resolve()));
+    baseUrl = `http://127.0.0.1:${server.address().port}`;
+});
+after(async () => {
+    await new Promise((resolve) => server.close(() => resolve()));
+});
+afterEach(() => {
+    globalThis.fetch = originalFetch;
+    process.env = { ...originalEnv };
+});
+describe("isExpiredJwt", () => {
+    const jwt = (payload) => `e30.${Buffer.from(JSON.stringify(payload)).toString("base64url")}.sig`;
+    it("flags expired tokens and passes live or opaque ones", () => {
+        assert.equal(isExpiredJwt(jwt({ exp: 100 }), 200), true);
+        assert.equal(isExpiredJwt(jwt({ exp: 300 }), 200), false);
+        assert.equal(isExpiredJwt(jwt({}), 200), false);
+        assert.equal(isExpiredJwt("opaque-token", 200), false);
+    });
+});
+describe("remote MCP over HTTP", () => {
+    it("serves /healthz", async () => {
+        const res = await originalFetch(`${baseUrl}/healthz`);
+        assert.equal(res.status, 200);
+    });
+    it("rejects /mcp without a bearer and points at the resource metadata", async () => {
+        process.env.TESTCHIMP_MCP_PUBLIC_URL = "https://mcp.example.com";
+        const res = await originalFetch(`${baseUrl}/mcp`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list" }),
+        });
+        assert.equal(res.status, 401);
+        assert.equal(res.headers.get("www-authenticate"), 'Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"');
+    });
+    it("returns 405 for GET /mcp in stateless mode", async () => {
+        const res = await originalFetch(`${baseUrl}/mcp`, { headers: { Authorization: "Bearer t" } });
+        assert.equal(res.status, 405);
+    });
+    it("publishes RFC 9728 protected-resource metadata", async () => {
+        process.env.TESTCHIMP_BACKEND_URL = "https://featureservice-staging.testchimp.io";
+        delete process.env.TESTCHIMP_MCP_PUBLIC_URL;
+        delete process.env.TESTCHIMP_OAUTH_ISSUER;
+        for (const path of ["/.well-known/oauth-protected-resource", "/.well-known/oauth-protected-resource/mcp"]) {
+            const res = await originalFetch(`${baseUrl}${path}`, { headers: { "X-Forwarded-Proto": "https" } });
+            assert.equal(res.status, 200);
+            const host = new URL(baseUrl).host;
+            assert.deepEqual(await res.json(), {
+                resource: `https://${host}/mcp`,
+                authorization_servers: ["https://featureservice-staging.testchimp.io"],
+                bearer_methods_supported: ["header"],
+                scopes_supported: ["testchimp"],
+            });
+        }
+    });
+    it("rejects oversized bodies", async () => {
+        const res = await originalFetch(`${baseUrl}/mcp`, {
+            method: "POST",
+            headers: { Authorization: "Bearer t", "Content-Type": "application/json" },
+            body: JSON.stringify({ pad: "x".repeat(1024 * 1024 + 10) }),
+        });
+        assert.equal(res.status, 413);
+    });
+    it("forwards the caller's bearer (never the server API key) on tool calls", async () => {
+        process.env.TESTCHIMP_BACKEND_URL = "https://featureservice.example.com";
+        process.env.TESTCHIMP_API_KEY = "server-key";
+        process.env.TESTCHIMP_OAUTH_TOKEN = "server-token";
+        const upstream = [];
+        globalThis.fetch = (async (input, init) => {
+            const url = String(input);
+            if (url.startsWith(baseUrl))
+                return originalFetch(input, init);
+            upstream.push({ url, headers: init?.headers });
+            return new Response(JSON.stringify({ minSkillVersion: "1.0.53", minCliVersion: "0.1.85", eventSchemaVersion: 1 }));
+        });
+        const res = await originalFetch(`${baseUrl}/mcp`, {
+            method: "POST",
+            headers: {
+                Authorization: "Bearer caller-jwt",
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                id: 7,
+                method: "tools/call",
+                params: { name: "get-bot-compat", arguments: {} },
+            }),
+        });
+        assert.equal(res.status, 200);
+        const payload = (await res.json());
+        assert.equal(JSON.parse(payload.result?.content?.[0]?.text ?? "{}").minCliVersion, "0.1.85");
+        assert.deepEqual(upstream, [
+            {
+                url: "https://featureservice.example.com/api/mcp/get_bot_compat",
+                headers: { "Content-Type": "application/json", Authorization: "Bearer caller-jwt" },
+            },
+        ]);
+    });
+});

package/dist/mcp/server.d.ts

@@ -1 +1,4 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** McpServer with every TestChimp tool registered (shared by stdio and HTTP transports). */
+export declare function createMcpServer(): McpServer;
 export declare function runMcpServer(): Promise<void>;

package/dist/mcp/server.js

@@ -1,6 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { postMcp } from "../core/client.js";
+import { postIngress, postMcp } from "../core/client.js";
 import { TOOL_DEFINITIONS, runTool } from "../core/tools.js";
 import { PACKAGE_VERSION } from "../core/version.js";
 function textResult(json) {
@@ -8,7 +8,8 @@ function textResult(json) {
         content: [{ type: "text", text: json }],
     };
 }
-export async function runMcpServer() {
+/** McpServer with every TestChimp tool registered (shared by stdio and HTTP transports). */
+export function createMcpServer() {
     const server = new McpServer({ name: "testchimp", version: PACKAGE_VERSION }, { capabilities: { tools: {}, logging: {} } });
     for (const def of TOOL_DEFINITIONS) {
         server.registerTool(def.kebab, {
@@ -27,11 +28,16 @@ export async function runMcpServer() {
                 : undefined;
             const json = await runTool(def.kebab, args ?? {}, {
                 postMcp,
+                postIngress,
                 onProgress,
             });
             return textResult(json);
         });
     }
+    return server;
+}
+export async function runMcpServer() {
+    const server = createMcpServer();
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/workspace/gitRepo.d.ts

@@ -0,0 +1,18 @@
+/** Local git inspection for `testchimp workspace map` (same rules as TestChimp Studio folder mapping). */
+/** Normalize a git remote URL to `owner/repo` (or GitLab nested path); host is ignored. */
+export declare function normalizeGitRemoteToFullName(remoteUrl: string | undefined | null): string | null;
+/** Case-insensitive compare of repositoryFullName values. */
+export declare function repositoryFullNamesMatch(expected: string | undefined | null, actual: string | undefined | null): boolean;
+export type LocalGitRepoInspection = {
+    selectedPath: string;
+    /** Canonical git toplevel, or null if not a work tree. */
+    toplevelPath: string | null;
+    isRepoRoot: boolean;
+    remoteFullNames: string[];
+};
+export declare function inspectLocalGitRepo(folderPath: string): LocalGitRepoInspection;
+/**
+ * Throw a user-visible error unless `inspection` is a git work tree; when `expectedRepositoryFullName`
+ * is known, also require the repository root and a matching remote.
+ */
+export declare function assertFolderMatchesRepo(inspection: LocalGitRepoInspection, expectedRepositoryFullName: string | null): void;