callman-mcp 0.1.0 → 0.2.0

package/dist-cjs/tools/run.js

@@ -37,7 +37,7 @@ exports.registerRunTools = void 0;
 const zod_1 = require("zod");
 const errors_js_1 = require("../client/errors.js");
 const resolve_js_1 = require("../domain/resolve.js");
-const mask_js_1 = require("../lib/mask.js");
+const redact_js_1 = require("../lib/redact.js");
 const truncate_js_1 = require("../lib/truncate.js");
 const executeCollection_js_1 = require("../run/executeCollection.js");
 const loadBundle_js_1 = require("../run/loadBundle.js");
@@ -47,8 +47,35 @@ const shared_js_1 = require("./shared.js");
 // Local execution — the same path as callme-cli: the pipeline bundle
 // (collection + environment values + connection configs) is fetched with the
 // token, requests run HERE through callman-core, and only the results go back
-// to the model. Variable values are never in the output. One run at a time.
+// to the model. Variable values are never in the output (they come back as
+// {{key}}). One run at a time.
+// What a local run does NOT do, stated up front so a model does not read a
+// missing check as a pass.
+const LOCAL_RUN_LIMITS = "Local-run limits: Kafka steps are skipped; DB assertions (dbAssertions) are evaluated only by the desktop app; no cookie jar between requests; no client certificates (mTLS); each request times out after 30 s. Database and Redis steps run when the collection's runnerSettings allow them and the connection is usable from this machine.";
 const maxBodyArg = zod_1.z.number().int().min(256).max(truncate_js_1.LIMITS.RUN_BODY_MAX).optional().describe("Response body preview cap in bytes (default 16 KB)");
+// apiKey auth names its own header / query parameter — mask those too, and
+// note the steps a local run skips.
+const inspectBundle = (rawCollection) => {
+    const secretHeaders = new Set();
+    const secretQuery = new Set();
+    const skipped = new Map();
+    const requests = rawCollection?.requests;
+    for (const raw of Array.isArray(requests) ? requests : []) {
+        const request = raw;
+        const auth = request.auth;
+        if (auth && (auth.type === "apikey" || auth.type === "apiKey") && typeof auth.apiKeyKey === "string" && auth.apiKeyKey.trim()) {
+            (auth.apiKeyLocation === "query" ? secretQuery : secretHeaders).add(auth.apiKeyKey.trim());
+        }
+        const notes = [];
+        if (Array.isArray(request.dbAssertions) && request.dbAssertions.length > 0)
+            notes.push("DB assertions (desktop only)");
+        if (request.kafka && (request.kafka.enabled || request.kafka.prePublish?.enabled || request.kafka.postPublish?.enabled))
+            notes.push("Kafka steps");
+        if (typeof request.id === "string" && notes.length > 0)
+            skipped.set(request.id, notes);
+    }
+    return { redaction: { secretHeaders, secretQuery }, skipped };
+};
 const prepareRun = async (ctx, ws, collectionId, environmentRef) => {
     const environment = environmentRef ? (await (0, lookups_js_1.resolveEnvironment)(ctx, ws, environmentRef)).item : null;
     const bundle = await ctx.api.pipelineBundle(ws, collectionId, environment?.id ?? null);
@@ -73,76 +100,97 @@ const prepareRun = async (ctx, ws, collectionId, environmentRef) => {
     const { map, skipped } = (0, loadBundle_js_1.buildConnectionRuntimeMap)(bundle.connections);
     if (skipped.length > 0)
         warnings.push(`Connections not usable in a local run: ${skipped.join(", ")}`);
-    if (collection.runnerSettings?.kafka)
-        warnings.push("Kafka steps never run from an AI tool.");
+    const { redaction, skipped: skippedSteps } = inspectBundle(bundle.collection);
     return {
         collection,
-        env: { ...globals, ...(bundle.environment?.variables ?? {}) },
+        env: { ...(bundle.environment?.variables ?? {}) },
+        globals,
         connections: map,
         environment: bundle.environment ? { id: bundle.environment.id, name: bundle.environment.name } : null,
         warnings,
+        redaction,
+        skipped: skippedSteps,
     };
 };
+// Warnings for the requests actually run.
+const skippedWarnings = (prepared, ids) => {
+    const out = [];
+    const names = new Map(prepared.collection.requests.map((request) => [request.id, request.name]));
+    for (const id of ids) {
+        const notes = prepared.skipped.get(id);
+        if (notes)
+            out.push(`${names.get(id) ?? id}: not run locally — ${notes.join(", ")}.`);
+    }
+    return out;
+};
 const registerRunTools = (server, ctx) => {
     server.registerTool("run_request", {
         title: "Run a request locally",
-        description: "Execute one saved request from this machine with an environment's variables (like the desktop's Send / callme run): returns status, timing, response headers and a bounded body preview, plus test and contract results and the NAMES of variables the scripts changed (never values). dryRun: true shows the resolved request without sending it. Needs requests:run.",
+        description: `Execute one saved request from this machine with an environment's variables (like the desktop's Send / callme run) — also when it is switched off for the collection runner. Returns status, timing, the request as sent (url, query, headers, body), response headers and a bounded body, test and contract results, unresolved {{variables}}, script logs and the NAMES of variables the scripts changed. Variable values never appear: they are shown as {{key}}. dryRun: true shows the request without sending it. ${LOCAL_RUN_LIMITS} Needs requests:run.`,
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             request: (0, shared_js_1.refArg)("Request", "(name, \"METHOD url\" or id)"),
             collection: zod_1.z.string().max(200).optional().describe("Narrow a name lookup to one collection"),
-            environment: zod_1.z.string().max(200).optional().describe("Environment name or id; omit to run without one"),
+            environment: zod_1.z.string().max(200).optional().describe("Environment name or id from the request's own workspace; omit to run without one"),
             dryRun: zod_1.z.boolean().optional(),
             maxBodyBytes: maxBodyArg,
         },
         annotations: shared_js_1.RUN,
     }, (0, shared_js_1.guarded)(async ({ workspace, request, collection, environment, dryRun, maxBodyBytes }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const { request: found, annotation } = await (0, lookups_js_1.resolveRequest)(ctx, ws.id, request, collection);
+        // The request decides the workspace; the environment must be one of its.
+        const { ws, value, note } = await (0, lookups_js_1.findRequest)(ctx, workspace, request, collection);
+        const { request: found } = value;
+        const annotation = [value.annotation, note].filter(Boolean).join("; ") || undefined;
         const prepared = await prepareRun(ctx, ws.id, found.collectionId, environment);
         const runnable = prepared.collection.requests.find((entry) => entry.id === found.id);
         if (!runnable)
             throw new errors_js_1.ToolInputError("REQUEST_NOT_IN_BUNDLE", "The request is not part of the collection bundle (was it just deleted?).");
         if (dryRun) {
             const { resolveTemplate } = await Promise.resolve().then(() => __importStar(require("../run/resolveTemplate.js")));
-            const env = prepared.env;
+            const env = { ...prepared.globals, ...prepared.env };
+            const redactor = (0, redact_js_1.createRedactor)(Object.entries(env).filter((entry) => typeof entry[1] === "string"), prepared.redaction);
+            const resolve = (value) => redactor.text(resolveTemplate(value, env));
             return (0, shared_js_1.ok)({
                 dryRun: true,
                 request: {
                     id: runnable.id,
                     name: runnable.name,
                     method: runnable.method,
-                    url: resolveTemplate(runnable.url, env),
-                    headers: (0, mask_js_1.maskHeaderRecord)(Object.fromEntries(Object.entries(runnable.headers ?? {}).map(([key, value]) => [key, resolveTemplate(value, env)]))),
-                    query: Object.fromEntries(Object.entries(runnable.query ?? {}).map(([key, value]) => [key, resolveTemplate(value, env)])),
-                    body: runnable.body ?? null,
+                    url: resolve(runnable.url),
+                    headers: redactor.headers(Object.fromEntries(Object.entries(runnable.headers ?? {}).map(([key, value]) => [key, resolveTemplate(value, env)]))),
+                    query: redactor.query(Object.fromEntries(Object.entries(runnable.query ?? {}).map(([key, value]) => [key, resolveTemplate(value, env)]))),
+                    body: redactor.value(runnable.body ?? null),
                     hasPreRequestScript: Boolean(runnable.preRequestScript),
                     hasTests: Boolean(runnable.tests),
                 },
                 environment: prepared.environment,
                 availableVariableKeys: Object.keys(env),
-                unresolvedVariables: unresolved([runnable.url, ...Object.values(runnable.headers ?? {}), ...Object.values(runnable.query ?? {})], env),
-                warnings: prepared.warnings,
+                unresolvedVariables: unresolved([runnable.url, ...Object.values(runnable.headers ?? {}), ...Object.values(runnable.query ?? {}), (0, truncate_js_1.safeStringify)(runnable.body ?? "")], env),
+                warnings: [...prepared.warnings, ...skippedWarnings(prepared, [runnable.id])],
+                ...(runnable.isEnabledInRunner === false ? { note: "This request is switched off for the collection runner; run_request still runs it." } : {}),
             });
         }
         const outcome = await ctx.withRunLock(() => (0, executeCollection_js_1.executeCollection)({
             collection: prepared.collection,
             env: prepared.env,
+            globals: prepared.globals,
             connections: prepared.connections,
             only: [found.id],
+            includeDisabled: true,
             deadlineMs: ctx.config.runTimeoutMs,
         }));
         const summary = (0, summarize_js_1.summarizeRun)(outcome, maxBodyBytes ?? ctx.config.maxBodyBytes, {
             collection: { id: found.collectionId },
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
             environment: prepared.environment,
-            warnings: prepared.warnings,
+            warnings: [...prepared.warnings, ...skippedWarnings(prepared, [found.id])],
             ...(annotation ? { resolved: [{ input: request, matched: found.name, id: found.id, note: annotation }] } : {}),
-        });
+        }, prepared.redaction);
         return (0, shared_js_1.ok)({ ...summary, result: summary.results[0] ?? null });
     }));
     server.registerTool("run_collection", {
         title: "Run a collection locally",
-        description: "Run a collection (or one folder of it, or specific requests) sequentially from this machine with an environment, sharing variables between requests like the collection runner. Returns per-request results (bounded bodies), a pass/fail summary and the variable names scripts changed. `bail` stops at the first failure. Needs requests:run.",
+        description: `Run a collection (or one folder of it, or specific requests) sequentially from this machine with an environment, sharing variables between requests like the collection runner. Requests switched off for the runner are skipped unless named in \`only\`; data-driven contracts run once per row. Returns per-request results (as in run_request, values shown as {{key}}), a pass/fail summary and the variable names scripts changed. \`bail\` stops at the first failure. ${LOCAL_RUN_LIMITS} Needs requests:run.`,
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             collection: (0, shared_js_1.refArg)("Collection"),
@@ -154,8 +202,7 @@ const registerRunTools = (server, ctx) => {
         },
         annotations: shared_js_1.RUN,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection, folder, only, environment, bail, maxBodyBytes }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const { ws, value: resolved } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
         const prepared = await prepareRun(ctx, ws.id, resolved.item.id, environment);
         let selection = null;
         if (folder) {
@@ -175,28 +222,37 @@ const registerRunTools = (server, ctx) => {
         const outcome = await ctx.withRunLock(() => (0, executeCollection_js_1.executeCollection)({
             collection: prepared.collection,
             env: prepared.env,
+            globals: prepared.globals,
             connections: prepared.connections,
             only: selection,
+            includeDisabled: Boolean(only && only.length > 0),
             bail: bail ?? false,
             deadlineMs: ctx.config.runTimeoutMs,
         }));
         return (0, shared_js_1.ok)((0, summarize_js_1.summarizeRun)(outcome, maxBodyBytes ?? ctx.config.maxBodyBytes, {
             collection: { id: resolved.item.id, name: resolved.item.name },
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
             environment: prepared.environment,
-            warnings: prepared.warnings,
+            warnings: [...prepared.warnings, ...skippedWarnings(prepared, outcome.results.map((result) => result.requestId))],
             resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved)],
-        }));
+        }, prepared.redaction));
     }));
 };
 exports.registerRunTools = registerRunTools;
 const TEMPLATE = /\{\{\s*([^}]+?)\s*\}\}/g;
+// {{env.x}} / {{global.x}} name the same variable as {{x}}; {{$…}} are
+// generators, {{data.…}} data-contract rows, {{response.…}} / {{random.…}}
+// runtime values — none of those can be "missing" before the run.
 const unresolved = (values, env) => {
     const missing = new Set();
     for (const value of values) {
         for (const match of value.matchAll(TEMPLATE)) {
-            const key = match[1].trim();
-            if (!(key in env) && !key.startsWith("$") && !key.startsWith("data."))
-                missing.add(key);
+            const token = match[1].trim();
+            if (token.startsWith("$") || /^(data|response|random)\./.test(token))
+                continue;
+            const key = token.replace(/^(env|global)\./, "");
+            if (!(key in env))
+                missing.add(token);
         }
     }
     return [...missing];