stacklok / toolhive / 30250838615

70%

Build Type

push

github

Committed by web-flow

Commit Message

Add live e2e tests for dual-era stateless proxy behavior (#5981)

* Add raw MCP HTTP client for e2e proxy tests

The dual-era stateless proxy e2e tests must emit traffic a conforming
MCP client never would: spoofed Mcp-Session-Id, colliding JSON-RPC ids,
malformed _meta, and oversized/truncated/batch bodies. A hand-rolled,
stdlib-only client gives the byte-level control those tests need without
importing go-sdk v1.7 into the module (which would force an MVS bump).

Adds a raw client that builds Modern (2026-07-28) and Legacy requests,
allows arbitrary header/id/session/_meta overrides and raw bodies, and
reuses one concurrency-safe http.Client for the crown-jewel fan-out.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add golden Modern-request oracle for raw client

The raw client's Modern _meta encoding was written and asserted by the
same author, a self-review blind spot: a wrong reserved key, wrong
nesting, or wrong value type could pass its own tests. This adds an
independent oracle — a 2026-07-28 tools/list request emitted by a real
go-sdk v1.7.0-pre.3 client — and asserts NewModernRequest reproduces its
_meta reserved-key set, nesting, and value kinds. A typo'd key or a
non-object clientCapabilities now fails the test.

The fixture is a committed static artifact; it is regenerated by pointing
a go-sdk v1.7 client at yardstick-server --stateless (>= v1.2.0).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add dual-era cross-delivery e2e test

The streamable proxy's Modern (2026-07-28) routing must give every
request a fresh routing token and never fall through to a client-supplied
Mcp-Session-Id -- otherwise, when concurrent requests share the same
(session, id) pair, one client's response can be delivered to another: a
confidentiality bug. Unit tests can't observe this; it only surfaces when
real traffic races through a running proxy.

Drives yardstick-server v1.2.0 in barrier mode (buffers N requests, then
releases toge... (continued)

Coverage Stats

9 of 9 new or added lines in 1 file covered. (100.0%)

13 existing lines in 5 files now uncovered.

79876 of 114964 relevant lines covered (69.48%)

81.47 hits per line