5e089b415c
Tasks 2 and 3 verified their work with throwaway scripts against a real spawned server that were never committed, so npm test protected none of it - index.ts's auth gate had zero automated coverage, and the @ts-nocheck agent-network.ts/self-improvement.ts rate-limit wiring had none beyond listTools(). Adds two hermetic integration suites (real spawned server, localhost only, no wallet/chain calls): - auth-gating.test.ts: both HTTP routes' 401/403 gating, the auth-before- session-lookup ordering, cross-identity rejection, token-leak scanning, and that the server survives all of it (the reviewer's severe finding - a missing early `return` after a 401 falls through into a second writeHead() and crashes the whole process via an unhandled rejection). - rate-limit-gating.test.ts: per-identity isolation and that exhaustion on a vector.ts tool also rate-limits agent-network.ts and self-improvement.ts tools for that identity, through the real registered tools rather than limiterFor() in isolation. Extends test/setup.ts additively (spawnServer/stopRawServer/RawServerHandle) so these tests can set MCP_AUTH_TOKENS and drive per-request Authorization headers by hand; startServer()/stopServer()/callTool() are unchanged and the existing run.test.ts still fails for exactly its pre-existing reason. Wires a new test:integration:auth script into CI's build-and-test job. All five mutations from the review were applied to a working-tree copy, built, and reverted per-mutation to prove the new tests actually fail: - removing either route's early `return` after a 401: caught (cascading ECONNREFUSED once the process crashes; a dedicated liveness test targets this directly) - the cross-identity check's undefined-lookup branch: not independently catchable - transports/sessionIdentities are always populated and cleared together, synchronously, so that state is unreachable via HTTP; documented in the report, verified a same-region operator-flip mutation IS caught cleanly - module-scope `identity` reference in self-improvement.ts: crashes the server at startup (ReferenceError at import time), caught via the before() hook - checkRateLimit restored to module scope in agent-network.ts: caught cleanly, isError:true / "rateLimiter is not defined" instead of the well-formed rate-limit text No file under any src/ changed. test:unit 67/67, test:smoke 26/26 (23 tools, 0 drift), typecheck clean, new suite 12/12. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
1.5 KiB
JSON
38 lines
1.5 KiB
JSON
{
|
|
"name": "@apexfusion/mcp-server-monorepo",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"workspaces": ["packages/*"],
|
|
"scripts": {
|
|
"postinstall": "ln -sf ../../../libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs node_modules/libsodium-wrappers-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs 2>/dev/null || true",
|
|
"clean": "rm -rf packages/*/build",
|
|
"build": "npm run build --workspace=@apexfusion/vector-mcp-builder",
|
|
"typecheck": "tsc --noEmit -p packages/shared && tsc --noEmit -p packages/builder",
|
|
"start": "node packages/builder/build/index.js",
|
|
"test": "npm run test:unit",
|
|
"test:unit": "node --import tsx --test packages/*/test/*.test.ts",
|
|
"test:smoke": "npm run build && node --import tsx --test packages/builder/test/smoke/*.test.ts",
|
|
"test:integration": "npm run build && node --import tsx --test packages/builder/test/integration/*.test.ts",
|
|
"test:integration:auth": "npm run build && node --import tsx --test packages/builder/test/integration/auth-gating.test.ts packages/builder/test/integration/rate-limit-gating.test.ts"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.13.1",
|
|
"tsup": "^8.5.1",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^5.7.3"
|
|
},
|
|
"engines": {
|
|
"node": ">=22.0.0"
|
|
},
|
|
"license": "ISC",
|
|
"author": "Apex Fusion",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/Apex-Fusion/mcp-server.git"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/Apex-Fusion/mcp-server/issues"
|
|
}
|
|
}
|