mcp-memory-keeper 0.12.1 → 0.13.0

package/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-06-05
+
+### Fixed
+
+- Server-reported version is now read from `package.json` at runtime instead of a hardcoded string, which had drifted to `0.10.0`. Added an E2E test asserting the reported version matches `package.json` so it can't fall out of sync again.
+
+### Security
+
+- **Arbitrary local file read via unvalidated `context_import` filePath** (#35)
+  - `context_import` passed the caller-supplied `filePath` straight to `fs.readFileSync`, with no path confinement. A malicious MCP client — or a prompt-injected agent — could point it at any file the server process could read: full contents for any JSON file (imported into the session, then retrievable via `context_get`/`context_export`), and the leading bytes of any other file (echoed back inside the `JSON.parse` error message)
+  - Imports are now confined to a server-owned exports directory (`<DATA_DIR>/exports`, overridable via `MEMORY_KEEPER_EXPORT_DIR`). Relative paths resolve against that directory; absolute paths are accepted only if they resolve — after following symlinks via `realpath` — to a location inside it. Traversal (`../`) and absolute paths outside the directory are rejected
+  - `context_export` now writes to that same exports directory (previously the OS temp dir), so the export → import round trip stays within the confined location
+  - Import failures no longer echo raw exception messages — at every stage (read, JSON parse, and the database write) a generic message is returned and the detail is logged server-side, so no file bytes or inserted values can leak back to the caller
+  - Import is hardened further: the resolved path must be a regular file (directories are rejected), capped at 50 MB and 100k entries to avoid memory/CPU exhaustion, and the whole import runs in a single transaction so a malformed row can never leave an orphaned or partially-populated session. Per-item and session-name shape are validated; `merge` only merges when a current session actually exists (and the result is reported honestly)
+  - The "not found" and "outside the exports directory" cases now return an identical generic message, removing a file-existence oracle, and the resolved absolute path is never echoed back to the caller
+  - `context_export`'s tool description and the import path resolution now guard the exports-directory startup (graceful FATAL on an unreadable directory)
+  - **Round-trip fidelity fixes** surfaced by review of the above: imported items now restore their `channel`, `is_private`, and `metadata` columns (previously dropped); file-cache rows with `NULL` content are preserved (previously dropped); a stored `size` of `0` is no longer wrongly recomputed; skipped-malformed counts and "checkpoints present but not imported" are reported instead of being silently lost; and `context_export` warns when a produced file is too large to be re-imported. The new current session is published only after the import transaction commits, so a failed import can no longer leave `currentSessionId` pointing at a rolled-back session
+  - Added an E2E security regression test suite that reproduces the issue #35 PoC (arbitrary JSON read, `/etc/passwd` byte leak, `..` traversal) and covers symlink escape, the `exports-dir`-prefix sibling boundary, the no-existence-oracle guarantee, empty/non-string paths, directory paths, valid-JSON-but-not-an-export, malformed-item skipping, and a data-preserving round trip
+  - Reported by Zhihao Zhang (@mcfly-zzh)
+
+## [0.12.2] - 2026-04-07
+
+### Fixed
+
+- **`full` tool profile breaks OpenAI-compatible providers** (#33)
+  - `context_delegate.input.insights` array property was missing required `items` declaration
+  - Stricter providers rejected the schema with `invalid_function_parameters`
+  - Added `items: { type: 'object', properties: {...} }` to the `insights` property with proper `patterns`, `relationships`, `trends`, and `themes` fields
+  - Added `properties: {}` to `context_link.metadata` bare object schema for strict validator compatibility
+  - Added regression test that validates all array properties across all tool schemas have `items` declared
+  - Added comprehensive E2E test suite that spawns the actual MCP server and validates tool schemas, tool calls, and error handling over stdio
+
 ## [0.12.1] - 2026-03-24
 
 ### Fixed
@@ -507,7 +539,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Security**: Security updates
 - **Technical**: Internal improvements
 
-[Unreleased]: https://github.com/mkreyman/mcp-memory-keeper/compare/v0.12.1...HEAD
+[Unreleased]: https://github.com/mkreyman/mcp-memory-keeper/compare/v0.12.2...HEAD
+[0.12.2]: https://github.com/mkreyman/mcp-memory-keeper/compare/v0.12.1...v0.12.2
 [0.12.1]: https://github.com/mkreyman/mcp-memory-keeper/compare/v0.12.0...v0.12.1
 [0.12.0]: https://github.com/mkreyman/mcp-memory-keeper/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/mkreyman/mcp-memory-keeper/compare/v0.10.2...v0.11.0

package/README.md

@@ -814,7 +814,8 @@ mcp_context_search({
 Share context or backup your work:
 
 ```javascript
-// Export current session
+// Export current session — writes into the exports directory
+// (<DATA_DIR>/exports/, overridable via MEMORY_KEEPER_EXPORT_DIR)
 mcp_context_export(); // Creates memory-keeper-export-xxx.json
 
 // Export specific session
@@ -823,7 +824,9 @@ mcp_context_export({
   format: 'json',
 });
 
-// Import from file
+// Import from a file inside the exports directory.
+// A bare filename resolves against that directory; the absolute path
+// returned by context_export also works.
 mcp_context_import({
   filePath: 'memory-keeper-export-xxx.json',
 });
@@ -835,6 +838,17 @@ mcp_context_import({
 });
 ```
 
+> **Security note:** For safety, `context_import` only reads files inside the
+> server-owned exports directory (`<DATA_DIR>/exports/`, or
+> `MEMORY_KEEPER_EXPORT_DIR` if set). Absolute paths outside that directory and
+> `../` traversal are rejected, so the tool cannot be steered at arbitrary
+> files on disk. Drop any file you want to import into that directory first.
+> Point `MEMORY_KEEPER_EXPORT_DIR` at a dedicated directory — not at a home
+> folder or a tree containing secrets — since any JSON file inside it becomes
+> importable. (Prior to this change, exports were written to the OS temp
+> directory; existing exports there must be moved into the exports directory to
+> be re-imported.)
+
 ### Knowledge Graph (Phase 4)
 
 Automatically extract entities and relationships from your context:

package/dist/__tests__/e2e/import-path-confinement.test.js

@@ -0,0 +1,329 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const globals_1 = require("@jest/globals");
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+/**
+ * Security regression tests for GitHub issue #35:
+ * "Arbitrary Local File Read via Unvalidated context_import.filePath".
+ *
+ * Before the fix, context_import passed the caller-supplied filePath straight
+ * to fs.readFileSync, so an MCP client (or a prompt-injected agent) could read
+ * any file the server process could read — full contents for any JSON file, and
+ * the leading bytes of any other file (echoed back inside the JSON.parse error).
+ *
+ * These tests spawn the real server over stdio and assert that:
+ *   1. Absolute paths outside the exports directory are rejected.
+ *   2. `..` traversal is rejected.
+ *   3. Non-JSON system files (e.g. /etc/passwd) are rejected without leaking
+ *      any of their bytes in the error message.
+ *   4. The secret in a rejected JSON file never becomes retrievable.
+ *   5. The legitimate export -> import round trip (inside the exports dir)
+ *      still works.
+ *
+ * @see https://github.com/mkreyman/mcp-memory-keeper/issues/35
+ */
+let serverProcess = null;
+let serverInfo;
+let tempDir;
+let exportsDir;
+let victimPath;
+let msgId = 0;
+let outputBuffer = '';
+const SECRET = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY';
+const SECRET_KEY = 'AWS_SECRET_ACCESS_KEY';
+function sendRequest(method, params = {}, timeoutMs = 5000) {
+    return new Promise((resolve, reject) => {
+        const id = ++msgId;
+        const timeout = setTimeout(() => {
+            reject(new Error(`Timeout waiting for response to ${method} (id=${id})`));
+        }, timeoutMs);
+        const onData = (data) => {
+            outputBuffer += data.toString();
+            const lines = outputBuffer.split('\n');
+            outputBuffer = lines.pop() || '';
+            for (const line of lines) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const msg = JSON.parse(line);
+                    if (msg.id === id) {
+                        clearTimeout(timeout);
+                        serverProcess?.stdout?.removeListener('data', onData);
+                        resolve(msg);
+                    }
+                }
+                catch {
+                    // Not JSON, skip
+                }
+            }
+        };
+        serverProcess?.stdout?.on('data', onData);
+        serverProcess?.stdin?.write(JSON.stringify({ jsonrpc: '2.0', method, params, id }) + '\n');
+    });
+}
+function callTool(name, args) {
+    return sendRequest('tools/call', { name, arguments: args }).then(res => res.result?.content?.[0]?.text ?? JSON.stringify(res));
+}
+(0, globals_1.describe)('Security: context_import path confinement (issue #35)', () => {
+    (0, globals_1.beforeAll)(async () => {
+        tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mcp-import-sec-'));
+        // Default exports dir is <DATA_DIR>/exports.
+        exportsDir = path.join(tempDir, 'exports');
+        // A "victim" JSON file OUTSIDE the exports directory (but inside the data
+        // dir) — proves confinement is to the exports dir, not just the data dir.
+        victimPath = path.join(tempDir, 'victim_export.json');
+        fs.writeFileSync(victimPath, JSON.stringify({
+            session: { name: 'victims-private-session', branch: 'main' },
+            contextItems: [
+                {
+                    key: SECRET_KEY,
+                    value: SECRET,
+                    category: 'secret',
+                    priority: 'high',
+                    created_at: new Date(0).toISOString(),
+                },
+            ],
+            fileCache: [],
+        }));
+        serverProcess = (0, child_process_1.spawn)('node', [path.join(__dirname, '../../../dist/index.js')], {
+            env: { ...process.env, DATA_DIR: tempDir },
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        if (global.testProcesses) {
+            global.testProcesses.push(serverProcess);
+        }
+        const initResponse = await sendRequest('initialize', {
+            protocolVersion: '2024-11-05',
+            capabilities: {},
+            clientInfo: { name: 'import-sec-test', version: '1.0.0' },
+        });
+        (0, globals_1.expect)(initResponse.result).toHaveProperty('protocolVersion');
+        serverInfo = initResponse.result.serverInfo;
+        serverProcess?.stdin?.write(JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }) + '\n');
+        await new Promise(resolve => setTimeout(resolve, 200));
+    }, 10000);
+    (0, globals_1.afterAll)(async () => {
+        if (serverProcess && !serverProcess.killed) {
+            serverProcess.kill('SIGTERM');
+            await new Promise(resolve => {
+                const timeout = setTimeout(() => {
+                    serverProcess?.kill('SIGKILL');
+                    resolve();
+                }, 3000);
+                serverProcess?.on('exit', () => {
+                    clearTimeout(timeout);
+                    resolve();
+                });
+            });
+            serverProcess?.removeAllListeners();
+        }
+        serverProcess = null;
+        try {
+            fs.rmSync(tempDir, { recursive: true, force: true });
+        }
+        catch {
+            // ignore cleanup errors
+        }
+    });
+    (0, globals_1.it)('reports its version from package.json (no drift)', () => {
+        // The server version is read from package.json at runtime; this guards
+        // against the hardcoded value silently falling out of sync on a release.
+        const pkgVersion = require('../../../package.json').version;
+        (0, globals_1.expect)(serverInfo?.name).toBe('memory-keeper');
+        (0, globals_1.expect)(serverInfo?.version).toBe(pkgVersion);
+    });
+    (0, globals_1.it)('rejects an absolute path to a JSON file outside the exports directory', async () => {
+        const text = await callTool('context_import', { filePath: victimPath });
+        (0, globals_1.expect)(text).toMatch(/Import failed/i);
+        (0, globals_1.expect)(text).toMatch(/not found in the exports directory/i);
+        // The secret must never appear in the response.
+        (0, globals_1.expect)(text).not.toContain(SECRET);
+    });
+    (0, globals_1.it)('returns the same message for a missing path and an existing outside path (no existence oracle)', async () => {
+        // A file that exists outside the exports dir and a path that does not exist
+        // at all must be indistinguishable, so the error cannot be used to probe
+        // for the existence of arbitrary files on the host.
+        const missing = await callTool('context_import', { filePath: '/no/such/file/anywhere.json' });
+        const existsOutside = await callTool('context_import', { filePath: victimPath });
+        const strip = (t) => t.replace(/^Import failed:\s*/i, '').trim();
+        (0, globals_1.expect)(strip(existsOutside)).toBe(strip(missing));
+        // And neither echoes the resolved exports-directory absolute path.
+        (0, globals_1.expect)(existsOutside).not.toContain(exportsDir);
+    });
+    (0, globals_1.it)('does not make the rejected file’s secret retrievable via context_get', async () => {
+        const text = await callTool('context_get', { key: SECRET_KEY });
+        (0, globals_1.expect)(text).not.toContain(SECRET);
+    });
+    // Use an explicit conditional skip (not a bare `return`) so the platform gap
+    // is visible in the test report on systems without /etc/passwd.
+    const hasEtcPasswd = fs.existsSync('/etc/passwd');
+    (hasEtcPasswd ? globals_1.it : globals_1.it.skip)('rejects a non-JSON system file without leaking its bytes', async () => {
+        const text = await callTool('context_import', { filePath: '/etc/passwd' });
+        (0, globals_1.expect)(text).toMatch(/Import failed/i);
+        // The classic leak was "Unexpected token 'r', "root:x:0:0"...". Ensure no
+        // file bytes are reflected back.
+        (0, globals_1.expect)(text).not.toMatch(/root:/);
+        (0, globals_1.expect)(text).not.toMatch(/Unexpected token/);
+    });
+    (0, globals_1.it)('rejects `..` traversal out of the exports directory', async () => {
+        const text = await callTool('context_import', {
+            filePath: '../../../../../../etc/hostname',
+        });
+        (0, globals_1.expect)(text).toMatch(/Import failed/i);
+        (0, globals_1.expect)(text).not.toMatch(/Unexpected token/);
+    });
+    (0, globals_1.it)('rejects a symlink inside the exports dir that points outside it', async () => {
+        // realpathSync must resolve the symlink to its target before the
+        // confinement check, so an inside-the-dir symlink cannot escape.
+        const linkPath = path.join(exportsDir, 'escape.json');
+        try {
+            fs.symlinkSync(victimPath, linkPath);
+        }
+        catch (e) {
+            // Only treat a genuine platform restriction as "skip"; surface anything else.
+            const code = e.code;
+            if (code === 'EPERM' || code === 'ENOSYS' || code === 'EACCES') {
+                return;
+            }
+            throw e;
+        }
+        try {
+            const text = await callTool('context_import', { filePath: 'escape.json' });
+            (0, globals_1.expect)(text).toMatch(/Import failed/i);
+            (0, globals_1.expect)(text).toMatch(/not found in the exports directory/i);
+            (0, globals_1.expect)(text).not.toContain(SECRET);
+        }
+        finally {
+            fs.unlinkSync(linkPath);
+        }
+    });
+    (0, globals_1.it)('rejects a sibling directory whose name shares the exports-dir prefix', async () => {
+        // Guards the `startsWith(exportsDirReal + path.sep)` boundary: a sibling
+        // like "<exportsDir>-evil" must NOT be treated as inside the exports dir.
+        const evilDir = `${exportsDir}-evil`;
+        fs.mkdirSync(evilDir, { recursive: true });
+        const evilFile = path.join(evilDir, 'data.json');
+        fs.writeFileSync(evilFile, JSON.stringify({ session: { name: 'x' }, contextItems: [] }));
+        try {
+            const text = await callTool('context_import', { filePath: evilFile });
+            (0, globals_1.expect)(text).toMatch(/Import failed/i);
+            (0, globals_1.expect)(text).toMatch(/not found in the exports directory/i);
+        }
+        finally {
+            fs.rmSync(evilDir, { recursive: true, force: true });
+        }
+    });
+    (0, globals_1.it)('rejects an empty filePath', async () => {
+        const text = await callTool('context_import', { filePath: '' });
+        (0, globals_1.expect)(text).toMatch(/Import failed/i);
+        (0, globals_1.expect)(text).toMatch(/non-empty string/i);
+    });
+    (0, globals_1.it)('rejects a non-string filePath', async () => {
+        const text = await callTool('context_import', { filePath: 12345 });
+        (0, globals_1.expect)(text).toMatch(/Import failed/i);
+        (0, globals_1.expect)(text).toMatch(/non-empty string/i);
+    });
+    (0, globals_1.it)('rejects the exports directory itself (not a regular file)', async () => {
+        const text = await callTool('context_import', { filePath: exportsDir });
+        (0, globals_1.expect)(text).toMatch(/Import failed/i);
+        (0, globals_1.expect)(text).toMatch(/regular file/i);
+    });
+    (0, globals_1.it)('rejects a confined file that is valid JSON but not an export', async () => {
+        const notExport = path.join(exportsDir, 'not-an-export.json');
+        fs.writeFileSync(notExport, JSON.stringify({ hello: 'world' }));
+        try {
+            const text = await callTool('context_import', { filePath: 'not-an-export.json' });
+            (0, globals_1.expect)(text).toMatch(/Import failed/i);
+            (0, globals_1.expect)(text).toMatch(/not a valid memory-keeper export/i);
+        }
+        finally {
+            fs.rmSync(notExport, { force: true });
+        }
+    });
+    (0, globals_1.it)('still supports the legitimate export -> import round trip and preserves data', async () => {
+        // Seed a context item, export it (lands inside the exports dir), then
+        // import the produced file back.
+        await callTool('context_save', {
+            key: 'roundtrip_key',
+            value: 'roundtrip_value',
+            category: 'note',
+        });
+        const exportText = await callTool('context_export', { confirmEmpty: true });
+        // `.+?\.json` (with `.` not matching newlines) tolerates spaces in the
+        // path, unlike `\S+`.
+        const match = exportText.match(/to:\s*(.+?\.json)/);
+        (0, globals_1.expect)(match).toBeTruthy();
+        const exportPath = match[1];
+        // Export must write inside the exports directory.
+        (0, globals_1.expect)(exportPath.startsWith(exportsDir)).toBe(true);
+        const importText = await callTool('context_import', { filePath: exportPath });
+        (0, globals_1.expect)(importText).toMatch(/Import successful/i);
+        // A regression that silently dropped every item would still say "successful";
+        // assert at least one item was imported AND that the value is retrievable.
+        (0, globals_1.expect)(importText).toMatch(/Context items:\s*[1-9]/);
+        const getResult = await callTool('context_get', { key: 'roundtrip_key' });
+        (0, globals_1.expect)(getResult).toContain('roundtrip_value');
+    });
+    (0, globals_1.it)('skips malformed items but imports the valid ones and reports the skip count', async () => {
+        // A confined, well-formed export envelope with one good item and several
+        // malformed ones: the good item imports, the bad ones are skipped (not
+        // silently — the count is surfaced), and nothing aborts the transaction.
+        const mixed = path.join(exportsDir, 'mixed.json');
+        fs.writeFileSync(mixed, JSON.stringify({
+            session: { name: 'mixed', branch: 'main' },
+            contextItems: [
+                { key: 'good_key', value: 'good_value', category: 'note', priority: 'high' },
+                { key: 'no_value' }, // missing value -> skipped
+                { value: 'no_key' }, // missing key -> skipped
+                'not-an-object', // not an object -> skipped
+            ],
+            fileCache: [],
+        }));
+        try {
+            const text = await callTool('context_import', { filePath: 'mixed.json' });
+            (0, globals_1.expect)(text).toMatch(/Import successful/i);
+            (0, globals_1.expect)(text).toMatch(/Context items:\s*1\s*\(skipped 3 malformed\)/);
+            const getResult = await callTool('context_get', { key: 'good_key' });
+            (0, globals_1.expect)(getResult).toContain('good_value');
+        }
+        finally {
+            fs.rmSync(mixed, { force: true });
+        }
+    });
+});

package/dist/__tests__/e2e/issue33-reproduce.test.js

@@ -0,0 +1,234 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const globals_1 = require("@jest/globals");
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+/**
+ * Issue #33 reproduction test.
+ *
+ * Reproduces the exact scenario reported: spawn the MCP server with each
+ * tool profile (minimal, standard, full), call tools/list, and validate
+ * that every returned tool schema passes strict JSON Schema validation
+ * that OpenAI-compatible providers enforce.
+ *
+ * The reporter found:
+ *   - minimal: works
+ *   - standard: works
+ *   - full: fails (context_delegate.input.insights missing items)
+ *
+ * After the fix, all three profiles must pass.
+ *
+ * @see https://github.com/mkreyman/mcp-memory-keeper/issues/33
+ */
+/**
+ * Strict schema validation matching what OpenAI-compatible providers enforce.
+ * Returns violation strings. Empty array = valid.
+ */
+function strictValidateSchema(prop, path, toolName) {
+    const violations = [];
+    if (!prop.type) {
+        violations.push(`${toolName}: ${path} — missing 'type'`);
+        return violations;
+    }
+    // Arrays MUST have items (the exact bug from issue #33)
+    if (prop.type === 'array' && !prop.items) {
+        violations.push(`${toolName}: ${path} — array missing 'items' (issue #33)`);
+    }
+    // Enum values must match declared type
+    if (prop.enum && prop.type === 'string') {
+        for (const val of prop.enum) {
+            if (typeof val !== 'string') {
+                violations.push(`${toolName}: ${path} — enum value '${val}' is not a string`);
+            }
+        }
+    }
+    // Required fields must exist in properties
+    if (prop.type === 'object' && prop.required && prop.properties) {
+        for (const req of prop.required) {
+            if (!(req in prop.properties)) {
+                violations.push(`${toolName}: ${path} — required '${req}' not in properties`);
+            }
+        }
+    }
+    // Recurse into object properties
+    if (prop.type === 'object' && prop.properties) {
+        for (const [key, value] of Object.entries(prop.properties)) {
+            violations.push(...strictValidateSchema(value, `${path}.${key}`, toolName));
+        }
+    }
+    // Recurse into array items
+    if (prop.type === 'array' && prop.items && typeof prop.items === 'object') {
+        violations.push(...strictValidateSchema(prop.items, `${path}.items`, toolName));
+    }
+    return violations;
+}
+/**
+ * Spawn a server with a given TOOL_PROFILE, call tools/list, return the tools.
+ */
+async function getToolsForProfile(profile) {
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), `mcp-issue33-${profile}-`));
+    const proc = (0, child_process_1.spawn)('node', [path.join(__dirname, '../../../dist/index.js')], {
+        env: { ...process.env, DATA_DIR: tempDir, TOOL_PROFILE: profile },
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    if (global.testProcesses) {
+        global.testProcesses.push(proc);
+    }
+    let msgId = 0;
+    let outputBuffer = '';
+    const sendRequest = (method, params = {}) => {
+        return new Promise((resolve, reject) => {
+            const id = ++msgId;
+            const timeout = setTimeout(() => reject(new Error(`Timeout: ${method} on ${profile}`)), 10000);
+            const onData = (data) => {
+                outputBuffer += data.toString();
+                const lines = outputBuffer.split('\n');
+                outputBuffer = lines.pop() || '';
+                for (const line of lines) {
+                    if (!line.trim())
+                        continue;
+                    try {
+                        const msg = JSON.parse(line);
+                        if (msg.id === id) {
+                            clearTimeout(timeout);
+                            proc.stdout?.removeListener('data', onData);
+                            resolve(msg);
+                        }
+                    }
+                    catch {
+                        // skip
+                    }
+                }
+            };
+            proc.stdout?.on('data', onData);
+            proc.stdin?.write(JSON.stringify({ jsonrpc: '2.0', method, params, id }) + '\n');
+        });
+    };
+    // Initialize
+    await sendRequest('initialize', {
+        protocolVersion: '2024-11-05',
+        capabilities: {},
+        clientInfo: { name: 'issue33-repro', version: '1.0.0' },
+    });
+    proc.stdin?.write(JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }) + '\n');
+    await new Promise(resolve => setTimeout(resolve, 200));
+    // Get tools
+    const response = await sendRequest('tools/list');
+    return { tools: response.result.tools, process: proc, tempDir };
+}
+const profiles = ['minimal', 'standard', 'full'];
+const servers = [];
+(0, globals_1.describe)('Issue #33 reproduction: all profiles must pass strict schema validation', () => {
+    (0, globals_1.afterAll)(async () => {
+        for (const server of servers) {
+            if (server.process && !server.process.killed) {
+                server.process.kill('SIGTERM');
+                await new Promise(resolve => {
+                    const timeout = setTimeout(() => {
+                        server.process?.kill('SIGKILL');
+                        resolve();
+                    }, 3000);
+                    server.process?.on('exit', () => {
+                        clearTimeout(timeout);
+                        resolve();
+                    });
+                });
+                server.process?.removeAllListeners();
+            }
+            try {
+                fs.rmSync(server.tempDir, { recursive: true, force: true });
+            }
+            catch {
+                // ignore
+            }
+        }
+    });
+    for (const profile of profiles) {
+        (0, globals_1.describe)(`TOOL_PROFILE=${profile}`, () => {
+            let tools;
+            beforeAll(async () => {
+                const result = await getToolsForProfile(profile);
+                tools = result.tools;
+                servers.push({ process: result.process, tempDir: result.tempDir });
+            }, 15000);
+            (0, globals_1.it)('should return tools', () => {
+                (0, globals_1.expect)(tools.length).toBeGreaterThan(0);
+            });
+            (0, globals_1.it)('all tool schemas should pass strict validation', () => {
+                const allViolations = [];
+                for (const tool of tools) {
+                    allViolations.push(...strictValidateSchema(tool.inputSchema, 'inputSchema', tool.name));
+                }
+                if (allViolations.length > 0) {
+                    throw new Error(`Profile "${profile}" has ${allViolations.length} schema violation(s):\n` +
+                        allViolations.map(v => `  ${v}`).join('\n'));
+                }
+            });
+            (0, globals_1.it)('specifically: no array property should be missing items', () => {
+                const arrayViolations = [];
+                for (const tool of tools) {
+                    arrayViolations.push(...strictValidateSchema(tool.inputSchema, 'inputSchema', tool.name).filter(v => v.includes('missing')));
+                }
+                (0, globals_1.expect)(arrayViolations).toHaveLength(0);
+            });
+        });
+    }
+    // The reporter specifically bisected these tools
+    (0, globals_1.describe)('reporter-flagged tools', () => {
+        let fullTools;
+        beforeAll(async () => {
+            const result = await getToolsForProfile('full');
+            fullTools = result.tools;
+            servers.push({ process: result.process, tempDir: result.tempDir });
+        }, 15000);
+        const flaggedTools = [
+            'context_delegate',
+            'context_find_related',
+            'context_visualize',
+            'context_branch_session',
+        ];
+        for (const toolName of flaggedTools) {
+            (0, globals_1.it)(`${toolName} should pass strict schema validation`, () => {
+                const tool = fullTools.find((t) => t.name === toolName);
+                (0, globals_1.expect)(tool).toBeDefined();
+                const violations = strictValidateSchema(tool.inputSchema, 'inputSchema', toolName);
+                (0, globals_1.expect)(violations).toHaveLength(0);
+            });
+        }
+    });
+});