stacklok / toolhive / 30114257978
69%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 836
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 69.373% (-0.002%) from 69.375%
30114257978

push

github

web-flow 
Add vMCP per-session security regression tests (#5974)

The mcp-go -> go-sdk migration (toolhive-core v0.0.32) fixed several
security-relevant behaviors under issue #156, but the acceptance gate
for #5742 requires ToolHive-side tests that pin them so any future
regression fails loudly in this repo (today they are verified only in
toolhive-core). Three high-value gaps are closed:

- Per-session tool projection divergence by principal: two clients
  authenticated as different principals against the same server get
  divergent tools/list projections and tools/call outcomes (Cedar
  permits echo->alice, ping->bob). Proves per-principal admission is
  not collapsed onto a shared/fixed identity. Bidirectional, and gated
  on each principal positively seeing its own tool so it cannot pass
  while a session's async registration is merely pending.

- Concurrent same-session identity isolation (item U3): two concurrent
  tools/call POSTs on one session with distinct principals each reach
  core.CallTool with their own identity. Correlates a body-supplied
  caller argument to the context-bridged identity via independent
  sources, so a symmetric identity swap is detected, not just a
  collapse. Pins the shim's per-POST nonce keying.

- Origin-pod validation against shared store (item U5): a session
  terminated out-of-band in shared storage by a second pod is rejected
  (404) on the origin pod's next request. Exercises the real
  local-session-terminated-in-store branch, distinct from the DELETE
  path that the existing tests cover.


Claude-Session: https://claude.ai/code/session_016WG3mSjVGWNc8nfgbkdd79

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

79248 of 114235 relevant lines covered (69.37%)

80.56 hits per line

Coverage Regressions

Lines Coverage ∆ File
6
76.15
 -5.5% pkg/secrets/keyring/keyctl_linux.go
3
80.56
 -0.7% pkg/transport/proxy/httpsse/http_proxy.go
2
82.29
 -0.21% pkg/vmcp/composer/workflow_engine.go
1
61.6
 0.09% pkg/workloads/manager.go
Jobs
ID Job ID Ran Files Coverage
1 30114257978.1 836
69.37
 GitHub Action Run
Source Files on build 30114257978