@zereight/mcp-gitlab 2.1.46 → 2.1.47

package/build/stateless/consumed-proxy-code-cache.js

@@ -0,0 +1,82 @@
+/**
+ * Per-pod replay-prevention cache for sealed proxy authorization codes.
+ *
+ * Unlike an LRU map, entries are retained until their TTL expires — never
+ * evicted early. Inserts fail closed when the cache is full of still-valid
+ * entries, so a burst of traffic cannot reopen a capture-replay window by
+ * pushing a consumed hash out before `storedTtlSeconds` elapses.
+ */
+import { randomBytes } from "node:crypto";
+export const PROXY_CODE_CACHE_FULL = "PROXY_CODE_CACHE_FULL";
+/** Largest TTL (seconds) that keeps `now + ttl * 1000` finite. */
+const MAX_TTL_SECONDS = Math.floor(Number.MAX_SAFE_INTEGER / 1000);
+function ttlToExpiryMs(now, ttlSeconds) {
+    // Non-finite / non-positive TTLs must still create a usable expiry so a
+    // reservation blocks concurrent replay instead of leaving expiresAt as NaN.
+    let safeSeconds = Number.isFinite(ttlSeconds) && ttlSeconds > 0 ? ttlSeconds : 1;
+    if (safeSeconds > MAX_TTL_SECONDS) {
+        safeSeconds = MAX_TTL_SECONDS;
+    }
+    const expiresAt = now + safeSeconds * 1000;
+    return Number.isFinite(expiresAt) ? expiresAt : Number.MAX_SAFE_INTEGER;
+}
+export class ConsumedProxyCodeCache {
+    _map = new Map();
+    _maxSize;
+    _now;
+    constructor(maxSize, now = Date.now) {
+        this._maxSize = maxSize;
+        this._now = now;
+    }
+    purgeExpired(now) {
+        for (const [key, entry] of this._map) {
+            if (entry.expiresAt <= now)
+                this._map.delete(key);
+        }
+    }
+    /**
+     * Atomically reserve a code hash for an in-flight exchange.
+     * @returns `{ ok: true }` if reserved, or `{ ok: false, reason }` when an
+     *   in-TTL pending/consumed entry already exists.
+     * @throws Error with message {@link PROXY_CODE_CACHE_FULL} when the cache
+     *   is full of non-expired entries (fail closed).
+     */
+    tryReserve(key, ttlSeconds) {
+        const now = this._now();
+        this.purgeExpired(now);
+        const existing = this._map.get(key);
+        if (existing && existing.expiresAt > now) {
+            return { ok: false, reason: existing.state };
+        }
+        if (this._map.size >= this._maxSize) {
+            throw new Error(PROXY_CODE_CACHE_FULL);
+        }
+        this._map.set(key, {
+            expiresAt: ttlToExpiryMs(now, ttlSeconds),
+            state: "pending",
+            reservationId: randomBytes(16).toString("hex"),
+        });
+        const entry = this._map.get(key);
+        return { ok: true, reservationId: entry.reservationId };
+    }
+    /** Mark a reserved code as fully consumed (replay rejected until TTL). */
+    commit(key, reservationId) {
+        const entry = this._map.get(key);
+        if (entry && entry.reservationId === reservationId) {
+            entry.state = "consumed";
+        }
+    }
+    /** Drop an in-flight reservation so a later legitimate exchange can proceed. */
+    release(key, reservationId) {
+        const entry = this._map.get(key);
+        if (entry?.state === "pending" && entry.reservationId === reservationId) {
+            this._map.delete(key);
+        }
+    }
+    get size() {
+        return this._map.size;
+    }
+    get maxSize() {
+        return this._maxSize;
+    }
+}

package/build/stateless/index.js

@@ -11,4 +11,5 @@ export { open, seal, sign, verify, } from "./codec.js";
 export { looksLikeStatelessClientId, mintClientId, openClientId, } from "./client-id.js";
 export { looksLikeStatelessState, mintPendingAuthState, openPendingAuthState, } from "./pending-auth.js";
 export { looksLikeStatelessStoredTokensCode, mintStoredTokensCode, openStoredTokensCode, } from "./stored-tokens.js";
+export { ConsumedProxyCodeCache, PROXY_CODE_CACHE_FULL, } from "./consumed-proxy-code-cache.js";
 export { looksLikeStatelessSessionId, mintSessionId, openSessionId, } from "./session-id.js";

package/build/stateless/stored-tokens.js

@@ -15,9 +15,11 @@
  * Uses AEAD (AES-256-GCM) because the payload contains the GitLab access
  * token and refresh token.
  *
- * Replay: proxyCode replay is defeated by two mitigations:
- *   - short TTL (OAUTH_STATELESS_STORED_TTL_SECONDS, default 600s)
+ * Replay: proxyCode replay is defeated by three mitigations:
+ *   - short TTL (OAUTH_STATELESS_STORED_TTL_SECONDS, default 120s)
  *   - PKCE binding (the client must still present a matching code_verifier)
+ *   - per-pod TTL-bound replay cache (pending reservation → commit on success;
+ *     failed binding/PKCE releases the reservation; never LRU-evicts early)
  */
 import { open, seal } from "./codec.js";
 import { StatelessCodecError } from "./errors.js";

package/build/test/mcp-oauth-tests.js

@@ -400,6 +400,102 @@ describe("MCP OAuth — createGitLabOAuthProvider", () => {
             stub.close();
         }
     });
+    test("verifyAccessToken falls back to access_token query param when Bearer gets 401", async () => {
+        // Simulates a GitLab behind an edge cache that strips the Authorization
+        // header on /oauth/* (e.g. git.drupalcode.org behind Varnish): the
+        // Bearer-header request 401s, the RFC 6750 query-param retry succeeds.
+        const TOKEN = "tok+en/with?special=chars&more"; // exercises URL encoding
+        const requests = [];
+        const { createServer } = await import("node:http");
+        const stub = createServer((req, res) => {
+            requests.push({ url: req.url, authHeader: req.headers["authorization"] });
+            const url = new URL(req.url, "http://localhost");
+            if (url.searchParams.get("access_token") === TOKEN) {
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({
+                    resource_owner_id: 7,
+                    scopes: ["api"],
+                    expires_in_seconds: 3600,
+                    application: { uid: "app-uid-abc" },
+                    created_at: Math.floor(Date.now() / 1000),
+                }));
+            }
+            else {
+                // Header-stripping edge: reject anything not using the query param
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "invalid_token" }));
+            }
+        });
+        await new Promise(resolve => stub.listen(0, "127.0.0.1", resolve));
+        const addr = stub.address();
+        const baseUrl = `http://127.0.0.1:${addr.port}`;
+        try {
+            const { createGitLabOAuthProvider } = await import("../oauth-proxy.js");
+            const provider = createGitLabOAuthProvider(baseUrl, "test-app-id");
+            const authInfo = await provider.verifyAccessToken(TOKEN);
+            assert.strictEqual(requests.length, 2, "exactly one retry after the 401");
+            assert.strictEqual(requests[0].authHeader, `Bearer ${TOKEN}`, "first attempt sends the token as a Bearer Authorization header");
+            assert.ok(!requests[0].url.includes("access_token="), "first attempt does not use the query param");
+            assert.strictEqual(requests[1].authHeader, undefined, "retry omits the Authorization header");
+            assert.ok(requests[1].url.includes(`access_token=${encodeURIComponent(TOKEN)}`), "retry carries the URL-encoded access_token query param");
+            assert.strictEqual(authInfo.token, TOKEN, "token preserved through the fallback path");
+            assert.strictEqual(authInfo.clientId, "app-uid-abc", "AuthInfo built from retry response");
+            console.log("  ✓ verifyAccessToken falls back to query param after Bearer 401");
+        }
+        finally {
+            stub.close();
+        }
+    });
+    test("verifyAccessToken does not retry when the Bearer request succeeds", async () => {
+        let requestCount = 0;
+        const { createServer } = await import("node:http");
+        const stub = createServer((_req, res) => {
+            requestCount++;
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({
+                resource_owner_id: 7,
+                scopes: ["api"],
+                expires_in_seconds: 3600,
+                application: { uid: "app-uid-abc" },
+                created_at: Math.floor(Date.now() / 1000),
+            }));
+        });
+        await new Promise(resolve => stub.listen(0, "127.0.0.1", resolve));
+        const addr = stub.address();
+        const baseUrl = `http://127.0.0.1:${addr.port}`;
+        try {
+            const { createGitLabOAuthProvider } = await import("../oauth-proxy.js");
+            const provider = createGitLabOAuthProvider(baseUrl, "test-app-id");
+            await provider.verifyAccessToken("good-token");
+            assert.strictEqual(requestCount, 1, "no retry on a 200 response");
+            console.log("  ✓ verifyAccessToken makes a single request on success");
+        }
+        finally {
+            stub.close();
+        }
+    });
+    test("verifyAccessToken does not retry on non-401 errors", async () => {
+        let requestCount = 0;
+        const { createServer } = await import("node:http");
+        const stub = createServer((_req, res) => {
+            requestCount++;
+            res.writeHead(503, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "service_unavailable" }));
+        });
+        await new Promise(resolve => stub.listen(0, "127.0.0.1", resolve));
+        const addr = stub.address();
+        const baseUrl = `http://127.0.0.1:${addr.port}`;
+        try {
+            const { createGitLabOAuthProvider } = await import("../oauth-proxy.js");
+            const provider = createGitLabOAuthProvider(baseUrl, "test-app-id");
+            await assert.rejects(() => provider.verifyAccessToken("tok"), /invalid or expired/i, "non-401 errors still reject");
+            assert.strictEqual(requestCount, 1, "the query-param fallback is 401-only");
+            console.log("  ✓ verifyAccessToken does not retry on non-401 errors");
+        }
+        finally {
+            stub.close();
+        }
+    });
     test("verifyAccessToken maps GitLab token info to AuthInfo", async () => {
         const createdAt = Math.floor(Date.now() / 1000);
         const { createServer } = await import("node:http");

package/build/test/nullable-gitlab-response-fields.test.js

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
-import { GitLabCompareResultSchema, GitLabProtectedBranchAccessLevelSchema, } from "../schemas.js";
+import { GitLabCiLintResultSchema, GitLabCompareResultSchema, GitLabProtectedBranchAccessLevelSchema, } from "../schemas.js";
 test("role-based protected-branch access levels accept null user_id/group_id", () => {
     // #575: GitLab returns null for role-based levels, not omitted fields
     const parsed = GitLabProtectedBranchAccessLevelSchema.parse({
@@ -20,3 +20,18 @@ test("branch compare accepts null commit", () => {
     });
     assert.equal(parsed.commit, null);
 });
+test("ci lint result accepts null merged_yaml/includes on an invalid config", () => {
+    // #638: GitLab nulls both fields whenever the config is invalid — i.e. in
+    // exactly the case validate_ci_lint exists to report on.
+    const parsed = GitLabCiLintResultSchema.parse({
+        valid: false,
+        errors: ["image is defined in top-level and `default:` entry"],
+        warnings: [],
+        merged_yaml: null,
+        includes: null,
+    });
+    assert.equal(parsed.valid, false);
+    assert.equal(parsed.merged_yaml, null);
+    assert.equal(parsed.includes, null);
+    assert.deepEqual(parsed.errors, ["image is defined in top-level and `default:` entry"]);
+});

package/build/test/server/request-helpers.test.js

@@ -0,0 +1,33 @@
+import { describe, test } from "node:test";
+import assert from "node:assert";
+import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readMcpSessionIdHeader, redactSessionIdForLog, } from "../../server/request-helpers.js";
+describe("streamable request helpers", () => {
+    test("redacts stateless session ids and truncates legacy ids", () => {
+        assert.strictEqual(redactSessionIdForLog(undefined), "<none>");
+        assert.strictEqual(redactSessionIdForLog("v1.sid.secret-payload"), "v1.sid.<redacted>");
+        assert.strictEqual(redactSessionIdForLog("123456789abcdef"), "12345678…");
+        assert.strictEqual(redactSessionIdForLog("short"), "short");
+    });
+    test("detects initialize requests in single and batch bodies", () => {
+        assert.strictEqual(isInitializationRequestBody({ method: "initialize" }), true);
+        assert.strictEqual(isInitializationRequestBody([{ method: "tools/list" }, { method: "initialize" }]), true);
+        assert.strictEqual(isInitializationRequestBody({ method: "tools/list" }), false);
+        assert.strictEqual(isInitializationRequestBody(null), false);
+    });
+    test("allows only discovery methods in unauthenticated discovery bodies", () => {
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody({ method: "tools/list" }), true);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([
+            { method: "initialize" },
+            { method: "notifications/initialized" },
+            { method: "tools/list" },
+        ]), true);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody([{ method: "tools/list" }, { method: "call_tool" }]), false);
+        assert.strictEqual(isUnauthenticatedDiscoveryRequestBody(undefined), false);
+    });
+    test("normalizes Mcp-Session-Id headers", () => {
+        assert.strictEqual(readMcpSessionIdHeader({ headers: { "mcp-session-id": "sid-1" } }), "sid-1");
+        assert.strictEqual(readMcpSessionIdHeader({ headers: { "mcp-session-id": "" } }), undefined);
+        assert.strictEqual(readMcpSessionIdHeader({ headers: { "mcp-session-id": ["sid-1", "sid-2"] } }), undefined);
+        assert.strictEqual(readMcpSessionIdHeader({ headers: {} }), undefined);
+    });
+});

package/build/test/stateless/callback-proxy.test.js

@@ -290,6 +290,83 @@ describe("callback-proxy cross-pod flow (stateless)", () => {
         const wrongVerifier = randomBytes(32).toString("base64url");
         await assert.rejects(() => pod.exchangeAuthorizationCode(registered, proxyCode, wrongVerifier, CLIENT_REDIRECT), /PKCE verification failed/);
     });
+    test("failed PKCE does not burn the code; legitimate exchange still succeeds", async () => {
+        const s = secret();
+        const pod = makeProvider(loadMaterial(s));
+        const registered = await pod.clientsStore.registerClient({
+            redirect_uris: [CLIENT_REDIRECT],
+            token_endpoint_auth_method: "none",
+        });
+        const correctVerifier = randomBytes(32).toString("base64url");
+        const correctChallenge = createHash("sha256")
+            .update(correctVerifier)
+            .digest("base64url");
+        const authorizeRes = makeAuthorizeRes();
+        await pod.authorize(registered, {
+            state: "s",
+            scopes: ["api"],
+            redirectUri: CLIENT_REDIRECT,
+            codeChallenge: correctChallenge,
+        }, authorizeRes);
+        const proxyState = new URL(authorizeRes.redirectedTo).searchParams.get("state");
+        const cbRes = makeFakeRes();
+        await pod.handleCallback(fakeReq({ code: "gitlab-code", state: proxyState }), cbRes);
+        const proxyCode = new URL(cbRes.redirectedTo).searchParams.get("code");
+        const wrongVerifier = randomBytes(32).toString("base64url");
+        await assert.rejects(() => pod.exchangeAuthorizationCode(registered, proxyCode, wrongVerifier, CLIENT_REDIRECT), /PKCE verification failed/);
+        const tokens = await pod.exchangeAuthorizationCode(registered, proxyCode, correctVerifier, CLIENT_REDIRECT);
+        assert.equal(tokens.access_token, "gl-access-123");
+    });
+    test("successful exchange then replay is rejected on the same pod", async () => {
+        const s = secret();
+        const pod = makeProvider(loadMaterial(s));
+        const registered = await pod.clientsStore.registerClient({
+            redirect_uris: [CLIENT_REDIRECT],
+            token_endpoint_auth_method: "none",
+        });
+        const verifier = randomBytes(32).toString("base64url");
+        const challenge = createHash("sha256").update(verifier).digest("base64url");
+        const authorizeRes = makeAuthorizeRes();
+        await pod.authorize(registered, {
+            state: "s",
+            scopes: ["api"],
+            redirectUri: CLIENT_REDIRECT,
+            codeChallenge: challenge,
+        }, authorizeRes);
+        const proxyState = new URL(authorizeRes.redirectedTo).searchParams.get("state");
+        const cbRes = makeFakeRes();
+        await pod.handleCallback(fakeReq({ code: "gitlab-code", state: proxyState }), cbRes);
+        const proxyCode = new URL(cbRes.redirectedTo).searchParams.get("code");
+        const tokens = await pod.exchangeAuthorizationCode(registered, proxyCode, verifier, CLIENT_REDIRECT);
+        assert.equal(tokens.access_token, "gl-access-123");
+        await assert.rejects(() => pod.exchangeAuthorizationCode(registered, proxyCode, verifier, CLIENT_REDIRECT), /Authorization code already used/);
+    });
+    test("exchangeAuthorizationCode reports busy when replay cache is full", async () => {
+        const s = secret();
+        const pod = makeProvider(loadMaterial(s));
+        const registered = await pod.clientsStore.registerClient({
+            redirect_uris: [CLIENT_REDIRECT],
+            token_endpoint_auth_method: "none",
+        });
+        const verifier = randomBytes(32).toString("base64url");
+        const challenge = createHash("sha256").update(verifier).digest("base64url");
+        const authorizeRes = makeAuthorizeRes();
+        await pod.authorize(registered, {
+            state: "s",
+            scopes: ["api"],
+            redirectUri: CLIENT_REDIRECT,
+            codeChallenge: challenge,
+        }, authorizeRes);
+        const proxyState = new URL(authorizeRes.redirectedTo).searchParams.get("state");
+        const cbRes = makeFakeRes();
+        await pod.handleCallback(fakeReq({ code: "gitlab-code", state: proxyState }), cbRes);
+        const proxyCode = new URL(cbRes.redirectedTo).searchParams.get("code");
+        const cache = pod._usedProxyCodes;
+        for (let i = 0; i < cache.maxSize; i++) {
+            cache.tryReserve(`fill-${i}`, 600);
+        }
+        await assert.rejects(() => pod.exchangeAuthorizationCode(registered, proxyCode, verifier, CLIENT_REDIRECT), /Authorization server busy/);
+    });
     test("exchangeAuthorizationCode rejects wrong client_id", async () => {
         const s = secret();
         const pod = makeProvider(loadMaterial(s));
@@ -316,6 +393,9 @@ describe("callback-proxy cross-pod flow (stateless)", () => {
         const proxyCode = new URL(cbRes.redirectedTo).searchParams.get("code");
         // Try to redeem as r2 (different client_id)
         await assert.rejects(() => pod.exchangeAuthorizationCode(r2, proxyCode, verifier, CLIENT_REDIRECT), /Invalid client for authorization code/);
+        // Failed binding must not burn the code for the legitimate client.
+        const tokens = await pod.exchangeAuthorizationCode(r1, proxyCode, verifier, CLIENT_REDIRECT);
+        assert.equal(tokens.access_token, "gl-access-123");
     });
     test("exchangeAuthorizationCode rejects wrong redirect_uri", async () => {
         const s = secret();
@@ -338,6 +418,9 @@ describe("callback-proxy cross-pod flow (stateless)", () => {
         await pod.handleCallback(fakeReq({ code: "g", state: proxyState }), cbRes);
         const proxyCode = new URL(cbRes.redirectedTo).searchParams.get("code");
         await assert.rejects(() => pod.exchangeAuthorizationCode(registered, proxyCode, verifier, "https://attacker.example/cb"), /Invalid redirect_uri for authorization code/);
+        // Failed binding must not burn the code for the legitimate client.
+        const tokens = await pod.exchangeAuthorizationCode(registered, proxyCode, verifier, CLIENT_REDIRECT);
+        assert.equal(tokens.access_token, "gl-access-123");
     });
     test("stale state rejected at /callback", async () => {
         const s = secret();
@@ -373,6 +456,32 @@ describe("callback-proxy cross-pod flow (stateless)", () => {
         const tokens = await pod.exchangeAuthorizationCode(registered, proxyCode, verifier, CLIENT_REDIRECT);
         assert.equal(tokens.access_token, "gl-access-123");
     });
+    test("legacy: failed PKCE does not burn the code; legitimate exchange still succeeds", async () => {
+        const pod = makeProvider(null);
+        const registered = await pod.clientsStore.registerClient({
+            redirect_uris: [CLIENT_REDIRECT],
+            token_endpoint_auth_method: "none",
+        });
+        const correctVerifier = randomBytes(32).toString("base64url");
+        const correctChallenge = createHash("sha256")
+            .update(correctVerifier)
+            .digest("base64url");
+        const aRes = makeAuthorizeRes();
+        await pod.authorize(registered, {
+            state: "s",
+            scopes: ["api"],
+            redirectUri: CLIENT_REDIRECT,
+            codeChallenge: correctChallenge,
+        }, aRes);
+        const legacyState = new URL(aRes.redirectedTo).searchParams.get("state");
+        const cbRes = makeFakeRes();
+        await pod.handleCallback(fakeReq({ code: "g", state: legacyState }), cbRes);
+        const proxyCode = new URL(cbRes.redirectedTo).searchParams.get("code");
+        const wrongVerifier = randomBytes(32).toString("base64url");
+        await assert.rejects(() => pod.exchangeAuthorizationCode(registered, proxyCode, wrongVerifier, CLIENT_REDIRECT), /PKCE verification failed/);
+        const tokens = await pod.exchangeAuthorizationCode(registered, proxyCode, correctVerifier, CLIENT_REDIRECT);
+        assert.equal(tokens.access_token, "gl-access-123");
+    });
     test("different secret on pod B rejects the sealed state", async () => {
         const podA = makeProvider(loadMaterial(secret()));
         const podB = makeProvider(loadMaterial(secret())); // different secret

package/build/test/stateless/consumed-proxy-code-cache.test.js

@@ -0,0 +1,150 @@
+/**
+ * Unit tests for ConsumedProxyCodeCache — TTL-aware replay prevention.
+ *
+ * Expectation (CWE-294): consumed hashes remain rejected until the configured
+ * code TTL expires; the cache never LRU-evicts early; inserts fail closed when
+ * still-valid entries fill capacity.
+ */
+import assert from "node:assert/strict";
+import { describe, test } from "node:test";
+import { ConsumedProxyCodeCache, PROXY_CODE_CACHE_FULL, } from "../../stateless/consumed-proxy-code-cache.js";
+function reserveId(cache, key, ttlSeconds) {
+    const result = cache.tryReserve(key, ttlSeconds);
+    assert.equal(result.ok, true);
+    if (!result.ok) {
+        throw new Error("expected reservation to succeed");
+    }
+    return result.reservationId;
+}
+describe("ConsumedProxyCodeCache", () => {
+    test("rejects replay of a committed hash for the full configured TTL", () => {
+        let now = 1_000_000;
+        const cache = new ConsumedProxyCodeCache(10, () => now);
+        const ttlSeconds = 120;
+        const id = reserveId(cache, "hash-a", ttlSeconds);
+        cache.commit("hash-a", id);
+        // Still within TTL — must reject as consumed.
+        now += (ttlSeconds - 1) * 1000;
+        assert.deepEqual(cache.tryReserve("hash-a", ttlSeconds), {
+            ok: false,
+            reason: "consumed",
+        });
+        // Exactly at expiry boundary — still rejected while expiresAt > now.
+        now += 999;
+        assert.deepEqual(cache.tryReserve("hash-a", ttlSeconds), {
+            ok: false,
+            reason: "consumed",
+        });
+        // After TTL — purged; a new reservation is allowed (sealed code itself
+        // would also be expired by openStoredTokensCode at this point).
+        now += 1;
+        assert.equal(cache.tryReserve("hash-a", ttlSeconds).ok, true);
+    });
+    test("never LRU-evicts a live entry; fails closed when full", () => {
+        const now = 5_000_000;
+        const maxSize = 3;
+        const cache = new ConsumedProxyCodeCache(maxSize, () => now);
+        const ttlSeconds = 600;
+        cache.commit("h1", reserveId(cache, "h1", ttlSeconds));
+        cache.commit("h2", reserveId(cache, "h2", ttlSeconds));
+        cache.commit("h3", reserveId(cache, "h3", ttlSeconds));
+        assert.equal(cache.size, 3);
+        // A fourth insert must fail closed — not silently drop h1.
+        assert.throws(() => cache.tryReserve("h4", ttlSeconds), (err) => {
+            return err.message === PROXY_CODE_CACHE_FULL;
+        });
+        // Original consumed hashes are still covered through the TTL window.
+        assert.deepEqual(cache.tryReserve("h1", ttlSeconds), {
+            ok: false,
+            reason: "consumed",
+        });
+        assert.deepEqual(cache.tryReserve("h2", ttlSeconds), {
+            ok: false,
+            reason: "consumed",
+        });
+        assert.deepEqual(cache.tryReserve("h3", ttlSeconds), {
+            ok: false,
+            reason: "consumed",
+        });
+        assert.equal(cache.size, 3);
+    });
+    test("purge of expired entries frees capacity without reopening live replays", () => {
+        let now = 9_000_000;
+        const cache = new ConsumedProxyCodeCache(2, () => now);
+        cache.commit("old", reserveId(cache, "old", 10));
+        cache.commit("live", reserveId(cache, "live", 600));
+        assert.equal(cache.size, 2);
+        // Expire only "old" so a new insert can reclaim that slot.
+        now += 10_000;
+        cache.commit("fresh", reserveId(cache, "fresh", 600));
+        assert.equal(cache.size, 2);
+        // Still-valid "live" hash must remain rejected through its TTL.
+        assert.deepEqual(cache.tryReserve("live", 600), {
+            ok: false,
+            reason: "consumed",
+        });
+        // Cache is full of non-expired entries — fail closed, do not LRU-evict.
+        assert.throws(() => cache.tryReserve("another", 600), (err) => {
+            return err.message === PROXY_CODE_CACHE_FULL;
+        });
+    });
+    test("release drops pending reservation but not committed entries", () => {
+        const now = 2_000_000;
+        const cache = new ConsumedProxyCodeCache(10, () => now);
+        const pendingId = reserveId(cache, "pending", 60);
+        cache.release("pending", pendingId);
+        assert.equal(cache.size, 0);
+        const retryId = reserveId(cache, "pending", 60);
+        cache.commit("pending", retryId);
+        cache.release("pending", retryId);
+        assert.equal(cache.size, 1);
+        assert.deepEqual(cache.tryReserve("pending", 60), {
+            ok: false,
+            reason: "consumed",
+        });
+    });
+    test("pending reservation also blocks concurrent replay attempts", () => {
+        const cache = new ConsumedProxyCodeCache(10, () => 3_000_000);
+        assert.equal(cache.tryReserve("in-flight", 120).ok, true);
+        assert.deepEqual(cache.tryReserve("in-flight", 120), {
+            ok: false,
+            reason: "pending",
+        });
+    });
+    test("non-finite TTL still blocks a second reservation for the same key", () => {
+        const cache = new ConsumedProxyCodeCache(10, () => 4_000_000);
+        assert.equal(cache.tryReserve("nan-ttl", Number.NaN).ok, true);
+        assert.deepEqual(cache.tryReserve("nan-ttl", Number.NaN), {
+            ok: false,
+            reason: "pending",
+        });
+    });
+    test("extreme finite TTL keeps expiresAt finite and evictable", () => {
+        let now = 1_000_000;
+        const cache = new ConsumedProxyCodeCache(10, () => now);
+        cache.commit("max-ttl", reserveId(cache, "max-ttl", Number.MAX_VALUE));
+        assert.deepEqual(cache.tryReserve("max-ttl", Number.MAX_VALUE), {
+            ok: false,
+            reason: "consumed",
+        });
+        // Advance past the capped expiry so purgeExpired can reclaim the slot.
+        now += Math.floor(Number.MAX_SAFE_INTEGER / 1000) * 1000 + 1;
+        assert.equal(cache.tryReserve("max-ttl", 60).ok, true);
+    });
+    test("stale reservation id cannot release or commit a newer reservation", () => {
+        let now = 1_000_000;
+        const cache = new ConsumedProxyCodeCache(10, () => now);
+        const ttlSeconds = 10;
+        const staleId = reserveId(cache, "key", ttlSeconds);
+        now += 11_000;
+        const liveId = reserveId(cache, "key", ttlSeconds);
+        cache.release("key", staleId);
+        assert.deepEqual(cache.tryReserve("key", ttlSeconds), {
+            ok: false,
+            reason: "pending",
+        });
+        cache.commit("key", staleId);
+        cache.release("key", liveId);
+        assert.equal(cache.tryReserve("key", ttlSeconds).ok, true);
+    });
+});

package/build/test/test-download-attachment.js

@@ -2,6 +2,7 @@ import { describe, test, before, after } from 'node:test';
 import assert from 'node:assert';
 import { spawn } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
 const MOCK_TOKEN = 'glpat-mock-token-12345';
 const TEST_PROJECT_ID = '123';
@@ -125,6 +126,32 @@ describe('download_attachment', () => {
             raw.result.content.some(c => typeof c.text === 'string' && c.text.toLowerCase().includes('traversal'));
         assert.ok(isRpcError || isContentError, 'Should return an error mentioning directory traversal');
     });
+    test('local_path through a symlink directory is rejected', async () => {
+        const linkDir = `omc-test-symlink-${RUN_ID}`;
+        fs.rmSync(linkDir, { recursive: true, force: true });
+        fs.symlinkSync(os.tmpdir(), linkDir);
+        try {
+            const raw = await callDownloadAttachment({
+                project_id: TEST_PROJECT_ID,
+                secret: TEST_SECRET,
+                filename: 'image.png',
+                local_path: linkDir,
+            }, env);
+            const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
+                (Array.isArray(raw.result?.content)
+                    ? raw.result.content.map(c => c.text || '').join(' ')
+                    : '');
+            const lower = msg.toLowerCase();
+            assert.ok(lower.includes('symbolic') ||
+                lower.includes('symlink') ||
+                lower.includes('escapes') ||
+                lower.includes('traversal') ||
+                lower.includes('invalid'), `Expected symlink rejection, got: ${msg}`);
+        }
+        finally {
+            fs.rmSync(linkDir, { recursive: true, force: true });
+        }
+    });
     test('filename with directory traversal is rejected before writing to disk', async () => {
         const raw = await callDownloadAttachment({ project_id: TEST_PROJECT_ID, secret: TEST_SECRET, filename: 'image.png#../../owned.txt' }, env);
         const isRpcError = typeof raw.error?.message === 'string' &&