stacklok / toolhive / 27966214826

67%

Build Type

push

github

Committed by web-flow

Commit Message

Forward passthrough headers on the Serve path (#5561)

* Restore session-stable passthrough-header forwarding on the Serve path

On the Serve path (core.New + Serve), tool/resource calls route through
the shared backend client (pkg/vmcp/client) rather than through
per-session backend connections. The shared client was not reading the
passthrough headers captured by headerforward.CaptureMiddleware, and
even if it had, it would read them per-request rather than using the
session-creation-time snapshot — a behavioral and security regression vs.
the legacy per-session-connection path (#5560).

- Export MergeForwardedHeaders from pkg/vmcp/headerforward so both the
  session connector (legacy path) and the shared backend client (Serve
  path) share the same restricted-header and collision-detection rules.
- Teach httpBackendClient.defaultClientFactory to merge
  ForwardedHeadersFromContext(ctx) with target.HeaderForward, enabling
  the Serve path to forward captured headers to backends.
- Add capturedPassthroughHeaders sync.Map on Server (node-local, never
  persisted to Redis per security.md) to hold the session-creation-time
  header snapshot for each active session.
- Capture the snapshot in handleSessionRegistrationImpl once per session
  when s.core != nil, and re-inject it via injectCapturedHeaders in
  coreToolHandler and coreResourceHandler before each backend call so
  mid-session header changes on the client side never reach the backend.
- Register an AddOnUnregisterSession hook to clean up captured headers
  when the SDK unregisters a session.
- Switch the integration test helper (NewVMCPServer) from server.New to
  core.New + Serve so tests exercise the production Serve path.
- Wire workflow telemetry into core.New via a telemetryComposer wrapper
  (same metric names as the session-factory path) so existing telemetry
  tests continue to pass on the Serve path.
- Re-enable TestVMCPServer_PassthroughHeaders on the Serve path; it now
  passes inclu... (continued)

Coverage Stats

148 of 159 new or added lines in 6 files covered. (93.08%)

126 existing lines in 10 files now uncovered.

69646 of 103756 relevant lines covered (67.12%)

63.42 hits per line