inspector/clients/cli/__tests__/methods.test.ts
Bob Dickinson 33e88eac9f
CLI: catalog listing, auth flags, and OAuth browser UX (#1782)
* feat(cli): catalog listing, auth flags, and OAuth browser UX

Add servers/list and servers/show, --relogin / --stored-auth-only, browser
OAuth navigation with OSC 8 links, and extract method handlers under
clients/cli/src/handlers. Tracks #1781.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): address #1782 review — relogin clear, stored-auth-only, docs

Clear both raw and normalized OAuth keys on --relogin; check the shared
store before bailing under --stored-auth-only mid-session; restore the
tests README link target; document servers/show redaction limits; keep
mcpi groundwork with TODO(#1432) markers.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): gate OAuth browser open and harden #1782 review follow-ups

Arm auto-open only for CLI-owned interactive OAuth, honor MCP_AUTO_OPEN_ENABLED,
move --relogin clear after validation, skip keychain on servers/list, and cover
secret redaction after rehydrate.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): silence disarmed OAuth URLs and round-3 review nits

Suppress authorize URL print when navigation is disarmed or
--stored-auth-only; document MCP_AUTO_OPEN_ENABLED; redact Cookie/auth
headers; keep servers/show unit tests off the OS keychain.

Co-authored-by: Cursor <cursoragent@cursor.com>

* test(cli): cover withArmedAutoOpen for the ≥90 branch gate

CI failed on cliOAuth.ts branch coverage after the auto-open arming
helper landed; exercise the armed path through runCliInteractiveOAuth.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): mid-RPC unauthorized recovery and clear round-4 nits

Mirror connect's UnauthorizedError path in withCliAuthRecoveryRetry, let
MCP_AUTO_OPEN_ENABLED=true force open off-TTY, mock open-url in the
in-process runner, reject --relogin on catalog methods, restore the
__tests__ README inventory, and narrow OAuth helpers to structural client types.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): reconnect after mid-RPC OAuth and finish round-5 nits

Reconnect before retrying after unauthorized recovery, guard non-OAuth
configs, decouple forceAutoOpen, move open-url mock to vitest setupFiles,
and reject --relogin with stored-auth short-circuits.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): fail fast on non-TTY interactive OAuth and round-6 nits

Skip interactive OAuth without a TTY unless MCP_AUTO_OPEN_ENABLED=true;
document --stored-auth-only for CI; redact settings.metadata; reject
--relogin for stdio; clarify AuthRecoveryRequired reconnect comments.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): admit interactive OAuth when stdin is a TTY (round-7)

Gate on stdin||stderr so `2>&1 | tee` still works; fold confirm/auto-open/
TTY into CliOAuthConnectOptions; rename authRequiredFailure; document
MCP_AUTO_OPEN_ENABLED=true as non-TTY admit.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): fail fast on step-up without stdin (round-8)

Decline [y/N] on readline EOF/close, require a stdin TTY for the default
step-up confirmer (force-open admit is not enough), document stderr-only
browser auto-open vs stdin||stderr flow admit, and drop the alias wrapper.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): allow piped step-up answers; bound silent pipes (round-9)

Drop the hard stdin-TTY gate that broke `echo y | …`. Keep EOF decline and
add a short non-TTY timeout so an open pipe that never writes cannot hang.
Clarify isTTY as admit-only; extract the readline mock factory.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): keep partial piped step-up answers (round-10)

Capture readline `line` before close so `printf y` without a newline is
not treated as decline; timeout is auth_required with a distinct message;
document the 5s bound and post-confirm callback wait; pin the TTY no-timeout arm.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(cli): tighten step-up timeout messaging and TTY test (round-11)

Make the TTY no-timeout assertion use a settled flag (the Promise.race
check was vacuous), say "timed out" instead of "declined" on the pipe
bound, and document that piped answers need a newline or stdin close.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-26 16:55:25 -04:00

125 lines
3.7 KiB
TypeScript

import { describe, it, expect } from "vitest";
import { getTestMcpServerCommand } from "@modelcontextprotocol/inspector-test-server";
import { runCli } from "./helpers/cli-runner.js";
import {
expectCliSuccess,
expectCliFailure,
expectJsonStructure,
expectOutputContains,
} from "./helpers/assertions.js";
/**
* Covers the CLI method and option-validation branches that the broader
* integration suites don't reach, keeping `src/cli.ts` above the per-file
* coverage gate (#1484). All connect to the bundled stdio test server, whose
* default config advertises resource templates, prompts, and logging.
*/
describe("CLI method coverage", () => {
const { command, args } = getTestMcpServerCommand();
it("lists resource templates", async () => {
const result = await runCli([
command,
...args,
"--cli",
"--method",
"resources/templates/list",
]);
expectCliSuccess(result);
const json = expectJsonStructure(result, ["resourceTemplates"]);
expect(Array.isArray(json.resourceTemplates)).toBe(true);
expect(json.resourceTemplates.length).toBeGreaterThan(0);
});
it("rejects logging/setLevel without a --log-level", async () => {
const result = await runCli([
command,
...args,
"--cli",
"--method",
"logging/setLevel",
]);
expectCliFailure(result);
expectOutputContains(result, "Log level is required");
});
it("treats args before a `--` separator as the server target", async () => {
const result = await runCli([
command,
...args,
"--",
"--method",
"tools/list",
]);
expectCliSuccess(result);
const json = expectJsonStructure(result, ["tools"]);
expect(Array.isArray(json.tools)).toBe(true);
});
it("rejects unsupported and stream methods before connecting", async () => {
const unknown = await runCli([
command,
...args,
"--cli",
"--method",
"definitely/not-a-real-method",
]);
expectCliFailure(unknown);
expectOutputContains(unknown, "Unsupported method");
expectOutputContains(unknown, "definitely/not-a-real-method");
// Long-lived / stream methods are rejected by the CLI method allowlist.
const tail = await runCli([
command,
...args,
"--cli",
"--method",
"logging/tail",
]);
expectCliFailure(tail);
expectOutputContains(tail, "Unsupported method");
expectOutputContains(tail, "logging/tail");
});
it("rejects bad methods before --use-stored-auth network work", async () => {
// No oauth.json / refresh — must fail on allowlist, not no_stored_token.
const result = await runCli([
"--method",
"logging/tail",
"--use-stored-auth",
"--server-url",
"https://example.com/mcp",
]);
expectCliFailure(result);
expectOutputContains(result, "Unsupported method");
expect(result.stderr).not.toMatch(/No stored OAuth token/);
});
it("rejects an invalid --transport value before connecting", async () => {
const result = await runCli([
command,
...args,
"--cli",
"--method",
"tools/list",
"--transport",
"carrier-pigeon",
]);
expectCliFailure(result);
expectOutputContains(result, "Invalid transport type");
});
it("surfaces a commander usage error (missing option argument) as a failure", async () => {
// `--method` with no value makes commander call its own error-exit path;
// exitOverride re-throws it (exitCode !== 0) so the in-process runner can
// catch it instead of the worker being torn down.
const result = await runCli([command, ...args, "--method"]);
expectCliFailure(result);
expectOutputContains(result, "argument missing");
});
});