From 5576d4e8b3002c8049d7ee4a466749c025db3302 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Mon, 14 Sep 2026 01:53:22 -0400 Subject: [PATCH] test(web): add a purpose header to the public-address suite (#1862) Addresses Copilot review round 4: every file carries a header explaining its purpose, and this new suite had none. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01HzuzRPJv7M8wGe3wyw5sSg Signed-off-by: cliffhall --- .../test/integration/server/public-address.test.ts | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/clients/web/src/test/integration/server/public-address.test.ts b/clients/web/src/test/integration/server/public-address.test.ts index efb88e6a..95f49087 100644 --- a/clients/web/src/test/integration/server/public-address.test.ts +++ b/clients/web/src/test/integration/server/public-address.test.ts @@ -1,3 +1,16 @@ +/** + * Public addresses for the MCP Apps listeners (#1862): `MCP_SANDBOX_FULL_ADDRESS` + * and `MCP_APP_ORIGIN_FULL_ADDRESS`, as parsed by `server/public-address.ts`. + * + * Pinned here: what each accepts and how it is normalized (`/sandbox` appended + * to a bare origin, the app origin kept origin-only), every refusal reason, the + * same-origin refusals that keep the sandbox and a dedicated app origin off the + * Inspector's own origin, the mixed-content warning, and that a refused value + * never leaks a secret (credentials, query, fragment, path) into the log. The + * listener-side rules — fixed port only, no trusted-ancestor collision — are in + * the sandbox and app-origin controller suites, where the bound port is known. + */ + import { describe, it, expect, beforeEach, afterEach, vi } from "vitest"; import { resolveAppOriginPublicOrigin,