mcpose 2.1.1 → 3.0.0

package/src/__tests__/proxyContext.test.ts

@@ -0,0 +1,140 @@
+import { describe, expect, it } from 'vitest';
+import type { Identity } from '../identity.js';
+import {
+  createProxyContext,
+  outboundDelegationChain,
+} from '../proxyContext.js';
+
+describe('createProxyContext()', () => {
+  it('defaults to stdio transport with a generated request ID', () => {
+    const context = createProxyContext();
+
+    expect(context.transport).toBe('stdio');
+    expect(context.requestId).toEqual(expect.any(String));
+    expect(context.requestId.length).toBeGreaterThan(0);
+    expect(context.sessionId).toBeUndefined();
+    expect(context.headers).toBeUndefined();
+  });
+
+  it('preserves supplied context fields', () => {
+    const headers = { authorization: 'Bearer token' };
+    const context = createProxyContext({
+      requestId: 'req-123',
+      transport: 'http',
+      sessionId: 'session-1',
+      headers,
+    });
+
+    expect(context).toEqual({
+      requestId: 'req-123',
+      transport: 'http',
+      sessionId: 'session-1',
+      headers,
+    });
+  });
+
+  it('carries a stamped policy decision through', () => {
+    const policy = { decision: 'allow', ruleId: 'r1' } as const;
+    expect(createProxyContext({ policy }).policy).toEqual(policy);
+  });
+
+  it('omits sessionId/headers/signal keys when they are not provided', () => {
+    const ctx = createProxyContext({ transport: 'http' });
+
+    expect('sessionId' in ctx).toBe(false);
+    expect('headers' in ctx).toBe(false);
+    expect('signal' in ctx).toBe(false);
+  });
+
+  it('omits signal key when explicitly passed as undefined', () => {
+    const ctx = createProxyContext({ signal: undefined });
+
+    expect('signal' in ctx).toBe(false);
+  });
+
+  it('preserves an AbortSignal reference', () => {
+    const controller = new AbortController();
+    const ctx = createProxyContext({ signal: controller.signal });
+
+    expect(ctx.signal).toBe(controller.signal);
+  });
+
+  it('keeps the original headers reference (Readonly is shallow)', () => {
+    const headers = { 'x-trace': 'abc' };
+    const ctx = createProxyContext({ headers });
+
+    expect(ctx.headers).toBe(headers);
+  });
+
+  it('regenerates a UUID when requestId is provided as an empty string', () => {
+    const ctx = createProxyContext({ requestId: '' });
+
+    expect(ctx.requestId).not.toBe('');
+    expect(ctx.requestId.length).toBeGreaterThan(0);
+  });
+
+  it('generates distinct requestIds across calls', () => {
+    const a = createProxyContext();
+    const b = createProxyContext();
+
+    expect(a.requestId).not.toEqual(b.requestId);
+  });
+
+  it('preserves the proxy identity reference and omits the key when absent', () => {
+    const proxy = { name: 'payments-proxy', version: '1.2.3' };
+
+    expect(createProxyContext({ proxy }).proxy).toBe(proxy);
+    expect('proxy' in createProxyContext()).toBe(false);
+    expect('proxy' in createProxyContext({ proxy: undefined })).toBe(false);
+  });
+});
+
+describe('outboundDelegationChain()', () => {
+  const identity = (sub: string): Identity => ({
+    sub,
+    type: 'agent',
+    roles: [],
+    claims: {},
+    resolvedAt: '2026-01-01T00:00:00Z',
+    source: 'custom',
+  });
+
+  it('appends identity after the existing delegatedFrom chain oldest-first', () => {
+    const root = identity('root');
+    const mid = identity('mid');
+    const caller = identity('caller');
+    const ctx = createProxyContext({
+      identity: caller,
+      delegatedFrom: [root, mid],
+    });
+
+    expect(outboundDelegationChain(ctx)).toEqual([root, mid, caller]);
+  });
+
+  it('returns an empty array when neither identity nor delegatedFrom is set', () => {
+    expect(outboundDelegationChain(createProxyContext())).toEqual([]);
+  });
+
+  it('returns only the identity when delegatedFrom is absent', () => {
+    const caller = identity('caller');
+    const ctx = createProxyContext({ identity: caller });
+
+    expect(outboundDelegationChain(ctx)).toEqual([caller]);
+  });
+
+  it('returns a fresh array and does not mutate or alias ctx.delegatedFrom', () => {
+    const root = identity('root');
+    const delegatedFrom = [root];
+    const ctx = createProxyContext({
+      identity: identity('caller'),
+      delegatedFrom,
+    });
+
+    const chain = outboundDelegationChain(ctx);
+
+    expect(chain).not.toBe(delegatedFrom);
+    expect(ctx.delegatedFrom).toBe(delegatedFrom);
+    expect(ctx.delegatedFrom).toEqual([root]);
+    expect(outboundDelegationChain(ctx)).not.toBe(chain);
+  });
+});

package/src/__tests__/sanitizeCatalog.test.ts

@@ -0,0 +1,359 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeToolDescriptions } from '../sanitizeCatalog.js';
+import { runListToolsMiddleware } from '../testing.js';
+import type {
+  ListToolsRequest,
+  ListToolsResult,
+} from '@modelcontextprotocol/sdk/types.js';
+
+const listReq: ListToolsRequest = { method: 'tools/list', params: {} };
+
+interface NestedSchema {
+  type: string;
+  properties: Record<
+    string,
+    {
+      type?: string;
+      description?: string;
+      items?: { properties: Record<string, { description?: string }> };
+    }
+  >;
+}
+
+function makeResult(): ListToolsResult {
+  return {
+    tools: [
+      {
+        name: 'search_issues',
+        title: 'Search issues',
+        description: 'Search issues. Docs: https://internal.acme-corp.dev/api',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            query: {
+              type: 'string',
+              description: 'Query, see https://acme-corp.dev/syntax',
+            },
+            filters: {
+              type: 'array',
+              items: {
+                type: 'object',
+                properties: {
+                  field: { type: 'string', description: 'acme-corp field id' },
+                },
+              },
+            },
+          },
+        },
+        outputSchema: {
+          type: 'object',
+          properties: {
+            url: { type: 'string', description: 'Link into acme-corp' },
+          },
+        },
+      },
+    ],
+  };
+}
+
+async function run(
+  mw = sanitizeToolDescriptions(),
+  result: ListToolsResult = makeResult(),
+) {
+  return runListToolsMiddleware(mw, listReq, async () => result);
+}
+
+describe('sanitizeToolDescriptions()', () => {
+  it('strips http(s) URLs from tool descriptions by default', async () => {
+    const result = await run();
+    expect(result.tools[0]?.description).toBe('Search issues. Docs: ');
+  });
+
+  it('applies string patterns to every occurrence', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'acme-corp does acme-corp things',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(
+      sanitizeToolDescriptions({ patterns: ['acme-corp'] }),
+      upstream,
+    );
+    expect(result.tools[0]?.description).toBe(' does  things');
+  });
+
+  it('normalizes a non-global regex so every occurrence is replaced', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'host db-1 and host db-2',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(
+      sanitizeToolDescriptions({ patterns: [/db-\d/] }),
+      upstream,
+    );
+    expect(result.tools[0]?.description).toBe('host  and host ');
+  });
+
+  it('drops a sticky flag so a sticky pattern still replaces every occurrence', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'a db-1 b db-2',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(
+      sanitizeToolDescriptions({ patterns: [/db-\d/y] }),
+      upstream,
+    );
+    expect(result.tools[0]?.description).toBe('a  b ');
+  });
+
+  it('sanitizes description fields nested in inputSchema and outputSchema', async () => {
+    const result = await run(
+      sanitizeToolDescriptions({ patterns: ['acme-corp'] }),
+    );
+    const input = result.tools[0]?.inputSchema as unknown as NestedSchema;
+    expect(input.properties.query?.description).toBe('Query, see ');
+    expect(input.properties.filters?.items?.properties.field?.description).toBe(
+      ' field id',
+    );
+    const output = result.tools[0]?.outputSchema as unknown as NestedSchema;
+    expect(output.properties.url?.description).toBe('Link into ');
+  });
+
+  it('strips plain http URLs too', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'see http://internal.host/a for details',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(sanitizeToolDescriptions(), upstream);
+    expect(result.tools[0]?.description).toBe('see  for details');
+  });
+
+  it('accepts a pattern that already carries the global flag', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'a db-1 b db-2',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(
+      sanitizeToolDescriptions({ patterns: [/db-\d/g] }),
+      upstream,
+    );
+    expect(result.tools[0]?.description).toBe('a  b ');
+  });
+
+  it('sanitizes descriptions inside schema arrays, keeping untouched siblings by reference', async () => {
+    const clean = { type: 'string' };
+    const untouchedEnum = ['x', 'y'];
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          inputSchema: {
+            type: 'object',
+            anyOf: [{ description: 'acme-corp branch' }, clean],
+            allOf: [
+              { description: 'acme-corp a' },
+              { description: 'acme-corp b' },
+            ],
+            enum: untouchedEnum,
+          },
+        },
+      ],
+    };
+    const result = await run(
+      sanitizeToolDescriptions({ patterns: ['acme-corp'] }),
+      upstream,
+    );
+    const schema = result.tools[0]?.inputSchema as unknown as {
+      anyOf: [{ description: string }, typeof clean];
+      allOf: [{ description: string }, { description: string }];
+      enum: string[];
+    };
+    expect(Array.isArray(schema.anyOf)).toBe(true);
+    expect(schema.anyOf[0].description).toBe(' branch');
+    expect(schema.anyOf[1]).toBe(clean);
+    expect(schema.allOf[0].description).toBe(' a');
+    expect(schema.allOf[1].description).toBe(' b');
+    expect(schema.enum).toBe(untouchedEnum);
+  });
+
+  it('sanitizes a tool whose only match is in outputSchema', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'clean',
+          inputSchema: { type: 'object' },
+          outputSchema: {
+            type: 'object',
+            properties: {
+              url: { type: 'string', description: 'https://internal.host/x' },
+            },
+          },
+        },
+      ],
+    };
+    const result = await run(sanitizeToolDescriptions(), upstream);
+    const output = result.tools[0]?.outputSchema as unknown as NestedSchema;
+    expect(output.properties.url?.description).toBe('');
+  });
+
+  it('ignores string values outside description keys, non-string descriptions, and null nodes', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'acme-corp tool',
+          inputSchema: {
+            type: 'object',
+            properties: {
+              host: {
+                type: 'string',
+                pattern: 'acme-corp',
+                default: null,
+                description: { note: 'acme-corp' },
+              },
+            },
+          } as unknown as ListToolsResult['tools'][number]['inputSchema'],
+        },
+      ],
+    };
+    const result = await run(
+      sanitizeToolDescriptions({ patterns: ['acme-corp'] }),
+      upstream,
+    );
+    expect(result.tools[0]?.description).toBe(' tool');
+    const input = result.tools[0]?.inputSchema as unknown as {
+      properties: {
+        host: {
+          pattern: string;
+          default: null;
+          description: { note: string };
+        };
+      };
+    };
+    expect(input.properties.host.pattern).toBe('acme-corp');
+    expect(input.properties.host.default).toBeNull();
+    expect(input.properties.host.description).toEqual({ note: 'acme-corp' });
+  });
+
+  it('applies no hidden default patterns beyond the URL strip', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          description: 'Stryker was here and stays',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(sanitizeToolDescriptions(), upstream);
+    expect(result).toBe(upstream);
+  });
+
+  it('does not inject absent description or outputSchema keys when rebuilding', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 't',
+          inputSchema: {
+            type: 'object',
+            description: 'see https://internal.host/x',
+          },
+        },
+      ],
+    };
+    const result = await run(sanitizeToolDescriptions(), upstream);
+    const tool = result.tools[0] as object;
+    expect(
+      (result.tools[0]?.inputSchema as { description?: string }).description,
+    ).toBe('see ');
+    expect('description' in tool).toBe(false);
+    expect('outputSchema' in tool).toBe(false);
+  });
+
+  it('rebuilds only the changed tool in a mixed catalog', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 'clean',
+          description: 'nothing here',
+          inputSchema: { type: 'object' },
+        },
+        {
+          name: 'dirty',
+          description: 'see https://internal.host/x',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(sanitizeToolDescriptions(), upstream);
+    expect(result).not.toBe(upstream);
+    expect(result.tools[0]).toBe(upstream.tools[0]);
+    expect(result.tools[1]?.description).toBe('see ');
+  });
+
+  it('leaves names, titles, and schema structure intact', async () => {
+    const result = await run();
+    expect(result.tools[0]?.name).toBe('search_issues');
+    expect(result.tools[0]?.title).toBe('Search issues');
+    const input = result.tools[0]?.inputSchema as unknown as NestedSchema;
+    expect(input.type).toBe('object');
+    expect(Object.keys(input.properties)).toEqual(['query', 'filters']);
+    expect(input.properties.query?.type).toBe('string');
+  });
+
+  it('uses the configured replacement text', async () => {
+    const result = await run(
+      sanitizeToolDescriptions({ replacement: '[redacted]' }),
+    );
+    expect(result.tools[0]?.description).toBe(
+      'Search issues. Docs: [redacted]',
+    );
+  });
+
+  it('does not mutate the upstream result', async () => {
+    const upstream = makeResult();
+    const snapshot = structuredClone(upstream);
+    await run(sanitizeToolDescriptions({ patterns: ['acme-corp'] }), upstream);
+    expect(upstream).toEqual(snapshot);
+  });
+
+  it('returns the original result object when nothing matches', async () => {
+    const upstream: ListToolsResult = {
+      tools: [
+        {
+          name: 'clean',
+          description: 'nothing to strip here',
+          inputSchema: { type: 'object' },
+        },
+      ],
+    };
+    const result = await run(sanitizeToolDescriptions(), upstream);
+    expect(result).toBe(upstream);
+    expect(result.tools[0]).toBe(upstream.tools[0]);
+  });
+});