palaryn 0.1.0

package/dist/tests/unit/mcp-bridge.test.js

@@ -0,0 +1,1136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const stream_1 = require("stream");
+const bridge_1 = require("../../src/mcp/bridge");
+// ---------------------------------------------------------------------------
+// Mock Gateway
+// ---------------------------------------------------------------------------
+function createMockGateway() {
+    return {
+        execute: jest.fn(),
+        shutdown: jest.fn(),
+        registerExecutor: jest.fn(),
+    };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Build a minimal ToolResult for testing formatResult. */
+function buildToolResult(overrides) {
+    return {
+        tool_call_id: 'tc-001',
+        task_id: 'task-001',
+        status: 'ok',
+        policy: {
+            decision: 'allow',
+            rule_id: 'rule-1',
+            reasons: ['Allowed by default policy'],
+        },
+        dlp: {
+            detected: [],
+            redactions: [],
+            severity: 'low',
+        },
+        budget: {
+            estimated_cost_usd: 0.001,
+            spent_cost_usd_task: 0.005,
+            remaining_cost_usd_task: 1.995,
+        },
+        output: {
+            http_status: 200,
+            body: { data: 'test response' },
+        },
+        timing: {
+            started_at: new Date().toISOString(),
+            duration_ms: 42,
+        },
+        ...overrides,
+    };
+}
+/**
+ * Create a pair of streams for testing the stdio transport.
+ * Returns an input Readable that we can push data into and an output
+ * Writable that captures what the bridge writes.
+ */
+function createTestStreams() {
+    const input = new stream_1.Readable({ read() { } });
+    const outputChunks = [];
+    const output = new stream_1.Writable({
+        write(chunk, _encoding, callback) {
+            outputChunks.push(chunk.toString());
+            callback();
+        },
+    });
+    return { input, output, outputChunks };
+}
+/** Send a JSON-RPC message through the input stream and wait briefly for processing. */
+async function sendMessage(input, message) {
+    input.push(JSON.stringify(message) + '\n');
+    // Allow the event loop to process the message
+    await new Promise((resolve) => setTimeout(resolve, 20));
+}
+/** Parse the last JSON-RPC response from the output chunks. */
+function getLastResponse(outputChunks) {
+    const allOutput = outputChunks.join('');
+    const lines = allOutput.split('\n').filter((l) => l.trim());
+    const lastLine = lines[lines.length - 1];
+    return JSON.parse(lastLine);
+}
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+describe('MCPBridge', () => {
+    // -------------------------------------------------------------------------
+    // Constructor & public methods
+    // -------------------------------------------------------------------------
+    describe('constructor', () => {
+        it('creates an MCPBridge with default bridge config', () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            expect(bridge).toBeDefined();
+            expect(bridge.getGateway()).toBe(mockGateway);
+            expect(bridge.isInitialized()).toBe(false);
+        });
+        it('merges custom bridge config over defaults', () => {
+            const mockGateway = createMockGateway();
+            const customConfig = {
+                workspace_id: 'ws_custom',
+                actor: { type: 'user', id: 'custom-user', display: 'Custom User' },
+                source: { platform: 'custom-platform' },
+                task_id: 'task-fixed-id',
+            };
+            const bridge = new bridge_1.MCPBridge(mockGateway, customConfig);
+            const bridgeConfig = bridge.bridgeConfig;
+            expect(bridgeConfig.workspace_id).toBe('ws_custom');
+            expect(bridgeConfig.actor).toEqual({ type: 'user', id: 'custom-user', display: 'Custom User' });
+            expect(bridgeConfig.source).toEqual({ platform: 'custom-platform' });
+            expect(bridgeConfig.task_id).toBe('task-fixed-id');
+        });
+        it('uses default values when no custom config provided', () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const bridgeConfig = bridge.bridgeConfig;
+            expect(bridgeConfig.workspace_id).toBe('ws_mcp_default');
+            expect(bridgeConfig.actor).toEqual({ type: 'agent', id: 'mcp-agent', display: 'MCP Agent' });
+            expect(bridgeConfig.source).toEqual({ platform: 'mcp' });
+            expect(bridgeConfig.task_id).toBe('');
+        });
+        it('partially overrides bridge config while keeping defaults for missing fields', () => {
+            const mockGateway = createMockGateway();
+            const partialConfig = {
+                workspace_id: 'ws_partial',
+            };
+            const bridge = new bridge_1.MCPBridge(mockGateway, partialConfig);
+            const bridgeConfig = bridge.bridgeConfig;
+            expect(bridgeConfig.workspace_id).toBe('ws_partial');
+            expect(bridgeConfig.actor).toEqual({ type: 'agent', id: 'mcp-agent', display: 'MCP Agent' });
+            expect(bridgeConfig.source).toEqual({ platform: 'mcp' });
+            expect(bridgeConfig.task_id).toBe('');
+        });
+    });
+    describe('isInitialized()', () => {
+        it('returns false before the initialize handshake', () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            expect(bridge.isInitialized()).toBe(false);
+        });
+        it('returns true after the initialize handshake', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    capabilities: {},
+                    clientInfo: { name: 'test', version: '1.0' },
+                },
+            });
+            expect(bridge.isInitialized()).toBe(true);
+            await bridge.close();
+        });
+    });
+    describe('getGateway()', () => {
+        it('returns the gateway instance passed to the constructor', () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            expect(bridge.getGateway()).toBe(mockGateway);
+        });
+    });
+    describe('close()', () => {
+        it('calls gateway.shutdown()', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            await bridge.close();
+            expect(mockGateway.shutdown).toHaveBeenCalledTimes(1);
+        });
+        it('cleans up the transport', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            expect(bridge.transport).not.toBeNull();
+            await bridge.close();
+            expect(bridge.transport).toBeNull();
+        });
+        it('is safe to call close when no transport is connected', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            await bridge.close();
+            expect(mockGateway.shutdown).toHaveBeenCalledTimes(1);
+        });
+    });
+    // -------------------------------------------------------------------------
+    // Tool registration (static schemas)
+    // -------------------------------------------------------------------------
+    describe('registered tools', () => {
+        it('lists exactly 3 tools: http_request, http_get, http_post via tools/list', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'tools/list',
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.result.tools).toHaveLength(3);
+            const toolNames = response.result.tools.map((t) => t.name);
+            expect(toolNames).toContain('http_request');
+            expect(toolNames).toContain('http_get');
+            expect(toolNames).toContain('http_post');
+            await bridge.close();
+        });
+        it('each tool has an inputSchema with required url field', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'tools/list',
+            });
+            const response = getLastResponse(outputChunks);
+            for (const tool of response.result.tools) {
+                expect(tool.inputSchema.type).toBe('object');
+                expect(tool.inputSchema.required).toContain('url');
+                expect(tool.inputSchema.properties.url).toBeDefined();
+            }
+            await bridge.close();
+        });
+    });
+    // -------------------------------------------------------------------------
+    // buildToolCall (private, tested via reflection)
+    // -------------------------------------------------------------------------
+    describe('buildToolCall', () => {
+        let bridge;
+        let buildToolCall;
+        beforeEach(() => {
+            const mockGateway = createMockGateway();
+            bridge = new bridge_1.MCPBridge(mockGateway);
+            buildToolCall = bridge.buildToolCall.bind(bridge);
+        });
+        it('creates a valid ToolCall with required fields', () => {
+            const result = buildToolCall({
+                toolName: 'http.request',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+            });
+            expect(result.tool_call_id).toBeDefined();
+            expect(typeof result.tool_call_id).toBe('string');
+            expect(result.tool_call_id.length).toBeGreaterThan(0);
+            expect(result.task_id).toBeDefined();
+            expect(typeof result.task_id).toBe('string');
+            expect(result.workspace_id).toBe('ws_mcp_default');
+            expect(result.actor).toEqual({ type: 'agent', id: 'mcp-agent', display: 'MCP Agent' });
+            expect(result.source).toEqual({ platform: 'mcp' });
+            expect(result.tool).toEqual({
+                name: 'http.request',
+                version: '1.0.0',
+                capability: 'read',
+            });
+            expect(result.args).toEqual({ method: 'GET', url: 'https://example.com' });
+            expect(result.timestamp).toBeDefined();
+        });
+        it('generates unique tool_call_id for each call', () => {
+            const r1 = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://a.com' },
+            });
+            const r2 = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://b.com' },
+            });
+            expect(r1.tool_call_id).not.toBe(r2.tool_call_id);
+        });
+        it('generates a new task_id when bridgeConfig.task_id is empty', () => {
+            const result = buildToolCall({
+                toolName: 'http.request',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+            });
+            expect(result.task_id).toBeDefined();
+            expect(result.task_id.length).toBeGreaterThan(0);
+            expect(result.task_id).not.toBe('');
+        });
+        it('uses the configured task_id when one is set', () => {
+            const mockGateway = createMockGateway();
+            const customBridge = new bridge_1.MCPBridge(mockGateway, { task_id: 'fixed-task-123' });
+            const customBuildToolCall = customBridge.buildToolCall.bind(customBridge);
+            const result = customBuildToolCall({
+                toolName: 'http.request',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+            });
+            expect(result.task_id).toBe('fixed-task-123');
+        });
+        it('applies constraints when provided', () => {
+            const result = buildToolCall({
+                toolName: 'http.request',
+                capability: 'write',
+                args: { method: 'POST', url: 'https://example.com/api' },
+                constraints: { timeout_ms: 5000, max_cost_usd: 0.50 },
+            });
+            expect(result.constraints).toBeDefined();
+            expect(result.constraints.timeout_ms).toBe(5000);
+            expect(result.constraints.max_cost_usd).toBe(0.50);
+        });
+        it('does not add constraints when none are specified', () => {
+            const result = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+            });
+            expect(result.constraints).toBeUndefined();
+        });
+        it('does not add constraints when both values are undefined', () => {
+            const result = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+                constraints: { timeout_ms: undefined, max_cost_usd: undefined },
+            });
+            expect(result.constraints).toBeUndefined();
+        });
+        it('handles zero-value constraints correctly (0 is not null)', () => {
+            const result = buildToolCall({
+                toolName: 'http.request',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+                constraints: { timeout_ms: 0, max_cost_usd: 0 },
+            });
+            expect(result.constraints).toBeDefined();
+            expect(result.constraints.timeout_ms).toBe(0);
+            expect(result.constraints.max_cost_usd).toBe(0);
+        });
+        it('adds only the timeout_ms constraint when max_cost_usd is omitted', () => {
+            const result = buildToolCall({
+                toolName: 'http.request',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+                constraints: { timeout_ms: 3000 },
+            });
+            expect(result.constraints).toBeDefined();
+            expect(result.constraints.timeout_ms).toBe(3000);
+            expect(result.constraints.max_cost_usd).toBeUndefined();
+        });
+        it('adds only the max_cost_usd constraint when timeout_ms is omitted', () => {
+            const result = buildToolCall({
+                toolName: 'http.request',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+                constraints: { max_cost_usd: 1.0 },
+            });
+            expect(result.constraints).toBeDefined();
+            expect(result.constraints.max_cost_usd).toBe(1.0);
+            expect(result.constraints.timeout_ms).toBeUndefined();
+        });
+        it('applies context with purpose and labels when provided', () => {
+            const result = buildToolCall({
+                toolName: 'http.post',
+                capability: 'write',
+                args: { method: 'POST', url: 'https://example.com/api', body: '{}' },
+                context: { purpose: 'Fetch user data', labels: ['user-data', 'pii'] },
+            });
+            expect(result.context).toBeDefined();
+            expect(result.context.purpose).toBe('Fetch user data');
+            expect(result.context.labels).toEqual(['user-data', 'pii']);
+        });
+        it('does not add context when none is specified', () => {
+            const result = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+            });
+            expect(result.context).toBeUndefined();
+        });
+        it('does not add context when both purpose and labels are undefined', () => {
+            const result = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+                context: { purpose: undefined, labels: undefined },
+            });
+            expect(result.context).toBeUndefined();
+        });
+        it('adds only purpose when labels are omitted', () => {
+            const result = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+                context: { purpose: 'Health check' },
+            });
+            expect(result.context).toBeDefined();
+            expect(result.context.purpose).toBe('Health check');
+            expect(result.context.labels).toBeUndefined();
+        });
+        it('adds only labels when purpose is omitted', () => {
+            const result = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+                context: { labels: ['internal'] },
+            });
+            expect(result.context).toBeDefined();
+            expect(result.context.labels).toEqual(['internal']);
+            expect(result.context.purpose).toBeUndefined();
+        });
+        it('sets the correct capability for different tool types', () => {
+            const readResult = buildToolCall({
+                toolName: 'http.get',
+                capability: 'read',
+                args: { method: 'GET', url: 'https://example.com' },
+            });
+            expect(readResult.tool.capability).toBe('read');
+            const writeResult = buildToolCall({
+                toolName: 'http.post',
+                capability: 'write',
+                args: { method: 'POST', url: 'https://example.com' },
+            });
+            expect(writeResult.tool.capability).toBe('write');
+            const deleteResult = buildToolCall({
+                toolName: 'http.request',
+                capability: 'delete',
+                args: { method: 'DELETE', url: 'https://example.com/resource/1' },
+            });
+            expect(deleteResult.tool.capability).toBe('delete');
+        });
+    });
+    // -------------------------------------------------------------------------
+    // formatResult (private, tested via reflection)
+    // -------------------------------------------------------------------------
+    describe('formatResult', () => {
+        let bridge;
+        let formatResult;
+        beforeEach(() => {
+            const mockGateway = createMockGateway();
+            bridge = new bridge_1.MCPBridge(mockGateway);
+            formatResult = bridge.formatResult.bind(bridge);
+        });
+        it('converts an ok ToolResult to MCPCallToolResult with isError=false', () => {
+            const toolResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 200, body: { success: true } },
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.isError).toBe(false);
+            expect(mcpResult.content).toHaveLength(2);
+            expect(mcpResult.content[0].type).toBe('text');
+        });
+        it('converts a blocked ToolResult to MCPCallToolResult with isError=true', () => {
+            const toolResult = buildToolResult({
+                status: 'blocked',
+                error: 'Blocked by policy: domain not in allowlist',
+                output: undefined,
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.isError).toBe(true);
+            expect(mcpResult.content[0].text).toBe('Blocked by policy: domain not in allowlist');
+        });
+        it('converts an error ToolResult to MCPCallToolResult with isError=true', () => {
+            const toolResult = buildToolResult({
+                status: 'error',
+                error: 'Connection timeout after 15000ms',
+                output: undefined,
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.isError).toBe(true);
+            expect(mcpResult.content[0].text).toBe('Connection timeout after 15000ms');
+        });
+        it('uses the output body as primary text when no error is present', () => {
+            const toolResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 200, body: { items: [1, 2, 3] } },
+                error: undefined,
+            });
+            const mcpResult = formatResult(toolResult);
+            const parsed = JSON.parse(mcpResult.content[0].text);
+            expect(parsed).toEqual({ items: [1, 2, 3] });
+        });
+        it('uses string body directly without double-encoding', () => {
+            const toolResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 200, body: 'plain text response' },
+                error: undefined,
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.content[0].text).toBe('plain text response');
+        });
+        it('shows fallback text when no output body and no error', () => {
+            const toolResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 204 },
+                error: undefined,
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.content[0].text).toBe('Request completed with status: ok');
+        });
+        it('shows fallback text when output is undefined', () => {
+            const toolResult = buildToolResult({
+                status: 'ok',
+                output: undefined,
+                error: undefined,
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.content[0].text).toBe('Request completed with status: ok');
+        });
+        it('includes gateway metadata as the second content block', () => {
+            const toolResult = buildToolResult({
+                tool_call_id: 'tc-meta-001',
+                task_id: 'task-meta-001',
+                status: 'ok',
+                output: { http_status: 200, body: 'ok' },
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.content).toHaveLength(2);
+            expect(mcpResult.content[1].type).toBe('text');
+            expect(mcpResult.content[1].text).toContain('--- Gateway Metadata ---');
+            const metadataJson = mcpResult.content[1].text.replace('--- Gateway Metadata ---\n', '');
+            const metadata = JSON.parse(metadataJson);
+            expect(metadata.tool_call_id).toBe('tc-meta-001');
+            expect(metadata.task_id).toBe('task-meta-001');
+            expect(metadata.status).toBe('ok');
+            expect(metadata.http_status).toBe(200);
+            expect(metadata.policy).toBeDefined();
+            expect(metadata.dlp).toBeDefined();
+            expect(metadata.budget).toBeDefined();
+            expect(metadata.timing).toBeDefined();
+        });
+        it('includes DLP summary in metadata (detected count and severity)', () => {
+            const toolResult = buildToolResult({
+                dlp: {
+                    detected: ['aws_key', 'email'],
+                    redactions: [
+                        { path: 'body.api_key', method: 'mask' },
+                        { path: 'body.email', method: 'mask' },
+                    ],
+                    severity: 'high',
+                },
+            });
+            const mcpResult = formatResult(toolResult);
+            const metadataJson = mcpResult.content[1].text.replace('--- Gateway Metadata ---\n', '');
+            const metadata = JSON.parse(metadataJson);
+            expect(metadata.dlp.detected).toEqual(['aws_key', 'email']);
+            expect(metadata.dlp.severity).toBe('high');
+            expect(metadata.dlp.redaction_count).toBe(2);
+        });
+        it('prefers error over output body for primary text', () => {
+            const toolResult = buildToolResult({
+                status: 'error',
+                error: 'Something went wrong',
+                output: { http_status: 500, body: 'Internal Server Error' },
+            });
+            const mcpResult = formatResult(toolResult);
+            expect(mcpResult.content[0].text).toBe('Something went wrong');
+        });
+    });
+    // -------------------------------------------------------------------------
+    // executeAndFormat (private, tested via reflection)
+    // -------------------------------------------------------------------------
+    describe('executeAndFormat', () => {
+        it('calls gateway.execute and formats the result', async () => {
+            const mockGateway = createMockGateway();
+            const successResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 200, body: { message: 'success' } },
+            });
+            mockGateway.execute.mockResolvedValue(successResult);
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const executeAndFormat = bridge.executeAndFormat.bind(bridge);
+            const toolCall = {
+                tool_call_id: 'tc-exec-001',
+                task_id: 'task-exec-001',
+                workspace_id: 'ws_mcp_default',
+                actor: { type: 'agent', id: 'mcp-agent' },
+                source: { platform: 'mcp' },
+                tool: { name: 'http.request', version: '1.0.0', capability: 'read' },
+                args: { method: 'GET', url: 'https://api.example.com/data' },
+                timestamp: new Date().toISOString(),
+            };
+            const mcpResult = await executeAndFormat(toolCall);
+            expect(mockGateway.execute).toHaveBeenCalledTimes(1);
+            expect(mockGateway.execute).toHaveBeenCalledWith(toolCall);
+            expect(mcpResult.isError).toBe(false);
+            expect(mcpResult.content).toHaveLength(2);
+            const parsed = JSON.parse(mcpResult.content[0].text);
+            expect(parsed).toEqual({ message: 'success' });
+        });
+        it('returns isError=true when gateway throws an Error', async () => {
+            const mockGateway = createMockGateway();
+            mockGateway.execute.mockRejectedValue(new Error('Gateway internal failure'));
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const executeAndFormat = bridge.executeAndFormat.bind(bridge);
+            const toolCall = {
+                tool_call_id: 'tc-err-001',
+                task_id: 'task-err-001',
+                workspace_id: 'ws_mcp_default',
+                actor: { type: 'agent', id: 'mcp-agent' },
+                source: { platform: 'mcp' },
+                tool: { name: 'http.request', version: '1.0.0', capability: 'write' },
+                args: { method: 'POST', url: 'https://api.example.com/submit' },
+                timestamp: new Date().toISOString(),
+            };
+            const mcpResult = await executeAndFormat(toolCall);
+            expect(mcpResult.isError).toBe(true);
+            expect(mcpResult.content).toHaveLength(1);
+            const parsed = JSON.parse(mcpResult.content[0].text);
+            expect(parsed.error).toBe('Gateway internal failure');
+            expect(parsed.tool_call_id).toBe('tc-err-001');
+            expect(parsed.status).toBe('error');
+        });
+        it('returns isError=true when gateway throws a non-Error value', async () => {
+            const mockGateway = createMockGateway();
+            mockGateway.execute.mockRejectedValue('string error');
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const executeAndFormat = bridge.executeAndFormat.bind(bridge);
+            const toolCall = {
+                tool_call_id: 'tc-strerr-001',
+                task_id: 'task-strerr-001',
+                workspace_id: 'ws_mcp_default',
+                actor: { type: 'agent', id: 'mcp-agent' },
+                source: { platform: 'mcp' },
+                tool: { name: 'http.get', version: '1.0.0', capability: 'read' },
+                args: { method: 'GET', url: 'https://example.com' },
+                timestamp: new Date().toISOString(),
+            };
+            const mcpResult = await executeAndFormat(toolCall);
+            expect(mcpResult.isError).toBe(true);
+            const parsed = JSON.parse(mcpResult.content[0].text);
+            expect(parsed.error).toBe('string error');
+        });
+        it('formats a blocked ToolResult from gateway correctly', async () => {
+            const mockGateway = createMockGateway();
+            const blockedResult = buildToolResult({
+                status: 'blocked',
+                error: 'Blocked by policy: DELETE not allowed',
+                output: undefined,
+                policy: {
+                    decision: 'deny',
+                    rule_id: 'deny-delete',
+                    reasons: ['DELETE not allowed'],
+                },
+            });
+            mockGateway.execute.mockResolvedValue(blockedResult);
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const executeAndFormat = bridge.executeAndFormat.bind(bridge);
+            const toolCall = {
+                tool_call_id: 'tc-block-001',
+                task_id: 'task-block-001',
+                workspace_id: 'ws_mcp_default',
+                actor: { type: 'agent', id: 'mcp-agent' },
+                source: { platform: 'mcp' },
+                tool: { name: 'http.request', version: '1.0.0', capability: 'delete' },
+                args: { method: 'DELETE', url: 'https://api.example.com/resource/1' },
+                timestamp: new Date().toISOString(),
+            };
+            const mcpResult = await executeAndFormat(toolCall);
+            expect(mcpResult.isError).toBe(true);
+            expect(mcpResult.content[0].text).toBe('Blocked by policy: DELETE not allowed');
+        });
+    });
+    // -------------------------------------------------------------------------
+    // methodToCapability (private, tested via reflection)
+    // -------------------------------------------------------------------------
+    describe('methodToCapability', () => {
+        let methodToCapability;
+        beforeEach(() => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            methodToCapability = bridge.methodToCapability.bind(bridge);
+        });
+        it('maps GET to read', () => {
+            expect(methodToCapability('GET')).toBe('read');
+        });
+        it('maps HEAD to read', () => {
+            expect(methodToCapability('HEAD')).toBe('read');
+        });
+        it('maps OPTIONS to read', () => {
+            expect(methodToCapability('OPTIONS')).toBe('read');
+        });
+        it('maps POST to write', () => {
+            expect(methodToCapability('POST')).toBe('write');
+        });
+        it('maps PUT to write', () => {
+            expect(methodToCapability('PUT')).toBe('write');
+        });
+        it('maps PATCH to write', () => {
+            expect(methodToCapability('PATCH')).toBe('write');
+        });
+        it('maps DELETE to delete', () => {
+            expect(methodToCapability('DELETE')).toBe('delete');
+        });
+        it('maps unknown methods to write as default', () => {
+            expect(methodToCapability('CUSTOM')).toBe('write');
+        });
+        it('is case-insensitive', () => {
+            expect(methodToCapability('get')).toBe('read');
+            expect(methodToCapability('post')).toBe('write');
+            expect(methodToCapability('delete')).toBe('delete');
+        });
+    });
+    // -------------------------------------------------------------------------
+    // parseBody (private, tested via reflection)
+    // -------------------------------------------------------------------------
+    describe('parseBody', () => {
+        let parseBody;
+        beforeEach(() => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            parseBody = bridge.parseBody.bind(bridge);
+        });
+        it('parses valid JSON strings into objects', () => {
+            const result = parseBody('{"key":"value"}');
+            expect(result).toEqual({ key: 'value' });
+        });
+        it('parses JSON arrays', () => {
+            const result = parseBody('[1, 2, 3]');
+            expect(result).toEqual([1, 2, 3]);
+        });
+        it('returns the raw string for invalid JSON', () => {
+            const result = parseBody('not json');
+            expect(result).toBe('not json');
+        });
+        it('parses JSON primitive strings', () => {
+            const result = parseBody('"hello"');
+            expect(result).toBe('hello');
+        });
+        it('parses JSON numbers', () => {
+            const result = parseBody('42');
+            expect(result).toBe(42);
+        });
+    });
+    // -------------------------------------------------------------------------
+    // JSON-RPC protocol handling via stdio transport
+    // -------------------------------------------------------------------------
+    describe('JSON-RPC protocol', () => {
+        it('responds to initialize with server info and capabilities', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    capabilities: {},
+                    clientInfo: { name: 'test', version: '1.0' },
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.jsonrpc).toBe('2.0');
+            expect(response.id).toBe(1);
+            expect(response.result.protocolVersion).toBe('2025-03-26');
+            expect(response.result.serverInfo.name).toBe('palaryn-mcp-bridge');
+            expect(response.result.serverInfo.version).toBe('1.0.0');
+            expect(response.result.capabilities.tools).toBeDefined();
+            await bridge.close();
+        });
+        it('responds to ping with empty result', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, { jsonrpc: '2.0', id: 42, method: 'ping' });
+            const response = getLastResponse(outputChunks);
+            expect(response.id).toBe(42);
+            expect(response.result).toEqual({});
+            await bridge.close();
+        });
+        it('returns method not found for unknown methods', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, { jsonrpc: '2.0', id: 5, method: 'unknown/method' });
+            const response = getLastResponse(outputChunks);
+            expect(response.id).toBe(5);
+            expect(response.error).toBeDefined();
+            expect(response.error.code).toBe(-32601);
+            expect(response.error.message).toContain('Method not found');
+            await bridge.close();
+        });
+        it('handles notifications/initialized silently (no response)', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                method: 'notifications/initialized',
+            });
+            const allOutput = outputChunks.join('');
+            expect(allOutput.trim()).toBe('');
+            await bridge.close();
+        });
+        it('returns parse error and clears buffer when data exceeds 10MB without newline', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            const largeChunk = 'x'.repeat(11 * 1024 * 1024);
+            const consoleSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+            input.push(largeChunk);
+            await new Promise((resolve) => setTimeout(resolve, 50));
+            const response = getLastResponse(outputChunks);
+            expect(response.error).toBeDefined();
+            expect(response.error.code).toBe(-32700);
+            expect(response.error.message).toContain('Message too large');
+            expect(response.error.message).toContain('10MB');
+            expect(response.id).toBeNull();
+            consoleSpy.mockRestore();
+            await bridge.close();
+        });
+        it('processes messages normally after buffer overflow reset', async () => {
+            const mockGateway = createMockGateway();
+            mockGateway.execute.mockResolvedValue(buildToolResult());
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            const largeChunk = 'x'.repeat(11 * 1024 * 1024);
+            const consoleSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+            input.push(largeChunk);
+            await new Promise((resolve) => setTimeout(resolve, 50));
+            consoleSpy.mockRestore();
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 99,
+                method: 'ping',
+            });
+            const allOutput = outputChunks.join('');
+            const lines = allOutput.split('\n').filter((l) => l.trim());
+            const lastLine = lines[lines.length - 1];
+            const response = JSON.parse(lastLine);
+            expect(response.id).toBe(99);
+            expect(response.result).toEqual({});
+            await bridge.close();
+        });
+        it('returns parse error for invalid JSON input', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            input.push('this is not json\n');
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            const response = getLastResponse(outputChunks);
+            expect(response.error).toBeDefined();
+            expect(response.error.code).toBe(-32700);
+            expect(response.id).toBeNull();
+            await bridge.close();
+        });
+        it('returns error for tools/call with unknown tool name', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 10,
+                method: 'tools/call',
+                params: { name: 'nonexistent_tool', arguments: {} },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.id).toBe(10);
+            expect(response.error).toBeDefined();
+            expect(response.error.code).toBe(-32602);
+            expect(response.error.message).toContain('Unknown tool');
+            await bridge.close();
+        });
+        it('returns error for tools/call with missing name parameter', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 11,
+                method: 'tools/call',
+                params: {},
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.id).toBe(11);
+            expect(response.error).toBeDefined();
+            expect(response.error.code).toBe(-32602);
+            expect(response.error.message).toContain('Missing required parameter: name');
+            await bridge.close();
+        });
+    });
+    // -------------------------------------------------------------------------
+    // End-to-end tool execution via JSON-RPC
+    // -------------------------------------------------------------------------
+    describe('tools/call via JSON-RPC', () => {
+        it('executes http_request tool through the gateway', async () => {
+            const mockGateway = createMockGateway();
+            const successResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 200, body: { data: 'hello' } },
+            });
+            mockGateway.execute.mockResolvedValue(successResult);
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 20,
+                method: 'tools/call',
+                params: {
+                    name: 'http_request',
+                    arguments: { url: 'https://api.example.com/data', method: 'GET' },
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.id).toBe(20);
+            expect(response.result).toBeDefined();
+            expect(response.result.isError).toBe(false);
+            expect(response.result.content).toHaveLength(2);
+            expect(mockGateway.execute).toHaveBeenCalledTimes(1);
+            const passedToolCall = mockGateway.execute.mock.calls[0][0];
+            expect(passedToolCall.tool.name).toBe('http.request');
+            expect(passedToolCall.args.method).toBe('GET');
+            expect(passedToolCall.args.url).toBe('https://api.example.com/data');
+            await bridge.close();
+        });
+        it('executes http_get tool through the gateway', async () => {
+            const mockGateway = createMockGateway();
+            const successResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 200, body: 'ok' },
+            });
+            mockGateway.execute.mockResolvedValue(successResult);
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 21,
+                method: 'tools/call',
+                params: {
+                    name: 'http_get',
+                    arguments: { url: 'https://api.example.com/health' },
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.result.isError).toBe(false);
+            const passedToolCall = mockGateway.execute.mock.calls[0][0];
+            expect(passedToolCall.tool.name).toBe('http.get');
+            expect(passedToolCall.tool.capability).toBe('read');
+            expect(passedToolCall.args.method).toBe('GET');
+            await bridge.close();
+        });
+        it('executes http_post tool through the gateway', async () => {
+            const mockGateway = createMockGateway();
+            const successResult = buildToolResult({
+                status: 'ok',
+                output: { http_status: 201, body: { id: 123 } },
+            });
+            mockGateway.execute.mockResolvedValue(successResult);
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 22,
+                method: 'tools/call',
+                params: {
+                    name: 'http_post',
+                    arguments: {
+                        url: 'https://api.example.com/items',
+                        body: '{"name":"test"}',
+                    },
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.result.isError).toBe(false);
+            const passedToolCall = mockGateway.execute.mock.calls[0][0];
+            expect(passedToolCall.tool.name).toBe('http.post');
+            expect(passedToolCall.tool.capability).toBe('write');
+            expect(passedToolCall.args.method).toBe('POST');
+            expect(passedToolCall.args.body).toEqual({ name: 'test' });
+            await bridge.close();
+        });
+        it('returns isError=true when gateway execution fails', async () => {
+            const mockGateway = createMockGateway();
+            mockGateway.execute.mockRejectedValue(new Error('Gateway exploded'));
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 23,
+                method: 'tools/call',
+                params: {
+                    name: 'http_get',
+                    arguments: { url: 'https://api.example.com/fail' },
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.result).toBeDefined();
+            expect(response.result.isError).toBe(true);
+            const errorContent = JSON.parse(response.result.content[0].text);
+            expect(errorContent.error).toBe('Gateway exploded');
+            await bridge.close();
+        });
+        it('passes constraints and context through to the gateway', async () => {
+            const mockGateway = createMockGateway();
+            mockGateway.execute.mockResolvedValue(buildToolResult());
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 24,
+                method: 'tools/call',
+                params: {
+                    name: 'http_request',
+                    arguments: {
+                        url: 'https://api.example.com/data',
+                        method: 'POST',
+                        timeout_ms: 5000,
+                        max_cost_usd: 0.25,
+                        purpose: 'Test purpose',
+                        labels: ['test', 'ci'],
+                    },
+                },
+            });
+            const passedToolCall = mockGateway.execute.mock.calls[0][0];
+            expect(passedToolCall.constraints).toBeDefined();
+            expect(passedToolCall.constraints.timeout_ms).toBe(5000);
+            expect(passedToolCall.constraints.max_cost_usd).toBe(0.25);
+            expect(passedToolCall.context).toBeDefined();
+            expect(passedToolCall.context.purpose).toBe('Test purpose');
+            expect(passedToolCall.context.labels).toEqual(['test', 'ci']);
+            await bridge.close();
+        });
+        it('returns tool error when http_request is called without url', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 30,
+                method: 'tools/call',
+                params: {
+                    name: 'http_request',
+                    arguments: { method: 'GET' },
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.result).toBeDefined();
+            expect(response.result.isError).toBe(true);
+            expect(response.result.content[0].text).toContain('Missing required argument: url');
+            expect(mockGateway.execute).not.toHaveBeenCalled();
+            await bridge.close();
+        });
+        it('returns tool error when http_get is called without url', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 31,
+                method: 'tools/call',
+                params: {
+                    name: 'http_get',
+                    arguments: {},
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.result.isError).toBe(true);
+            expect(response.result.content[0].text).toContain('Missing required argument: url');
+            await bridge.close();
+        });
+        it('returns tool error when http_post is called without url', async () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 32,
+                method: 'tools/call',
+                params: {
+                    name: 'http_post',
+                    arguments: { body: '{"data":"test"}' },
+                },
+            });
+            const response = getLastResponse(outputChunks);
+            expect(response.result.isError).toBe(true);
+            expect(response.result.content[0].text).toContain('Missing required argument: url');
+            await bridge.close();
+        });
+        it('defaults http_request method to GET when not specified', async () => {
+            const mockGateway = createMockGateway();
+            mockGateway.execute.mockResolvedValue(buildToolResult());
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const { input, output, outputChunks } = createTestStreams();
+            await bridge.connectStdio(input, output);
+            await sendMessage(input, {
+                jsonrpc: '2.0',
+                id: 33,
+                method: 'tools/call',
+                params: {
+                    name: 'http_request',
+                    arguments: { url: 'https://example.com' },
+                },
+            });
+            const passedToolCall = mockGateway.execute.mock.calls[0][0];
+            expect(passedToolCall.args.method).toBe('GET');
+            expect(passedToolCall.tool.capability).toBe('read');
+            await bridge.close();
+        });
+    });
+    // -------------------------------------------------------------------------
+    // toolError (private, tested via reflection)
+    // -------------------------------------------------------------------------
+    describe('toolError', () => {
+        it('creates an error result with isError=true', () => {
+            const mockGateway = createMockGateway();
+            const bridge = new bridge_1.MCPBridge(mockGateway);
+            const toolError = bridge.toolError.bind(bridge);
+            const result = toolError('Something broke');
+            expect(result.isError).toBe(true);
+            expect(result.content).toHaveLength(1);
+            expect(result.content[0].type).toBe('text');
+            expect(result.content[0].text).toBe('Something broke');
+        });
+    });
+    // -------------------------------------------------------------------------
+    // startMCPBridge export
+    // -------------------------------------------------------------------------
+    describe('startMCPBridge', () => {
+        it('is exported as a function', () => {
+            expect(typeof bridge_1.startMCPBridge).toBe('function');
+        });
+    });
+});
+//# sourceMappingURL=mcp-bridge.test.js.map