feat: Add output transforms for pre-tool and post-tool processing of schemas and responses #209
Conversation
…schemas and responses
📝 WalkthroughWalkthroughAdds a new output/data transformation pipeline to the OpenAPI adapter (pre-tool and post-tool transforms, schema description modes and custom formatters), integrates transforms into tool metadata and execution, expands tests and docs, and applies broad SDK refactors to transport, persistence, types, barrels, logging, and utilities. Changes
Sequence Diagram(s)sequenceDiagram
actor Client
participant Adapter as OpenAPI Adapter
participant Tool as Tool Executor
participant Handler as Response Handler
Client->>Adapter: request tools / metadata
Adapter->>Adapter: collect input/output schema transforms (generator/per-tool/global)
Adapter->>Adapter: apply outputSchema options & description formatting
Adapter->>Tool: execute tool using transformed schemas
Tool->>Handler: return raw API response (apiResponse)
Handler->>Handler: evaluate post-tool filter(ctx)
alt filter passes
Handler->>Handler: apply post-tool transform (sync/async)
else
Handler->>Handler: retain original data
end
Handler->>Client: return final response
Estimated code review effort🎯 5 (Critical) | ⏱️ ~150 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. 📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (10)
🚧 Files skipped from review as they are similar to previous changes (1)
🧰 Additional context used📓 Path-based instructions (3)libs/**⚙️ CodeRabbit configuration file
Files:
libs/uipack/**/{package.json,*.ts,*.tsx,*.js,*.jsx}📄 CodeRabbit inference engine (libs/uipack/CLAUDE.md)
Files:
libs/ui/package.json📄 CodeRabbit inference engine (libs/ui/CLAUDE.md)
Files:
🧠 Learnings (9)📚 Learning: 2026-01-06T17:16:04.304ZApplied to files:
📚 Learning: 2026-01-06T17:16:04.304ZApplied to files:
📚 Learning: 2026-01-06T02:34:55.689ZApplied to files:
📚 Learning: 2026-01-04T14:35:18.366ZApplied to files:
📚 Learning: 2026-01-04T14:35:18.366ZApplied to files:
📚 Learning: 2025-12-24T00:41:41.819ZApplied to files:
📚 Learning: 2025-12-24T00:41:41.819ZApplied to files:
📚 Learning: 2026-01-06T02:34:55.689ZApplied to files:
📚 Learning: 2026-01-06T02:34:55.689ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
🔇 Additional comments (9)
✏️ Tip: You can disable this entire section by setting Comment |
⏹️ PR Testing Registry StoppedThe temporary npm registry for this PR has been shut down.
To start a new registry, trigger the workflow again. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
libs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.ts (1)
330-339: Consider usingvoidoperator for intentional no-op.The
referenceAvariable is assigned and then set tonullto simulate instance going down. This works but the linter may flag unused variable.Suggestion to clarify intent
// Simulate A going down (reference lost) - - let referenceA: RecreateableStreamableHTTPServerTransport | null = instanceA; - referenceA = null; + void instanceA; // Simulate A going down (reference lost)Alternatively, keep as-is if the current pattern better communicates the simulation intent to readers.
libs/adapters/src/openapi/openapi.adapter.ts (1)
594-673: Async output schema options handling is well-designed.Key aspects:
Promise.resolve(formatter(...))correctly handles both sync and async formatters- Mode processing order: apply to description first, then optionally remove from definition
- Pre-tool transforms applied after built-in mode processing
- Post-tool transform stored in metadata for runtime execution
Consider: The custom
descriptionFormattercall (line 618) has no try-catch. If it throws, the entirefetch()will fail.♻️ Suggested error handling for custom formatter
if (formatter) { // Custom formatter (can be async for LLM-based generation) - schemaText = await Promise.resolve(formatter(newOutputSchema, formatterCtx)); + try { + schemaText = await Promise.resolve(formatter(newOutputSchema, formatterCtx)); + } catch (err) { + const errorMessage = err instanceof Error ? err.message : String(err); + this.logger.warn( + `[${tool.name}] Custom descriptionFormatter failed: ${errorMessage}. Using built-in formatter.`, + ); + schemaText = this.formatSchemaForDescription(newOutputSchema, descriptionFormat); + } } else {
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
libs/adapters/src/openapi/__tests__/openapi-transforms.spec.tslibs/adapters/src/openapi/openapi.adapter.tslibs/adapters/src/openapi/openapi.tool.tslibs/adapters/src/openapi/openapi.types.tslibs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.tslibs/sdk/src/transport/adapters/streamable-http-transport.ts
🧰 Additional context used
📓 Path-based instructions (5)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{ts,tsx}: Use strict TypeScript mode with noanytypes without strong justification
Avoid non-null assertions (!) - use proper error handling and type guards instead
Use@frontmcp/utilsfor cryptographic operations instead ofnode:cryptodirectly
Use@frontmcp/utilsfor file system operations instead offs/promisesornode:fsdirectly
Files:
libs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.tslibs/adapters/src/openapi/__tests__/openapi-transforms.spec.tslibs/sdk/src/transport/adapters/streamable-http-transport.tslibs/adapters/src/openapi/openapi.tool.tslibs/adapters/src/openapi/openapi.adapter.tslibs/adapters/src/openapi/openapi.types.ts
**/*.test.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.test.{ts,tsx}: Achieve 95%+ test coverage across all metrics (statements, branches, functions, lines)
Use Jest for testing with 95%+ coverage requirement and 100% test pass rate
Do not use prefixes like 'PT-001' in test names
Do not skip constructor validation tests for error classes and types
Includeinstanceofchecks in tests for error classes to verify proper error hierarchy
Files:
libs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.ts
libs/{sdk,adapters}/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
libs/{sdk,adapters}/**/*.{ts,tsx}: Use specific error classes with MCP error codes instead of generic errors
UsegetCapabilities()for dynamic capability exposure instead of hardcoding capabilities
Files:
libs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.tslibs/adapters/src/openapi/__tests__/openapi-transforms.spec.tslibs/sdk/src/transport/adapters/streamable-http-transport.tslibs/adapters/src/openapi/openapi.tool.tslibs/adapters/src/openapi/openapi.adapter.tslibs/adapters/src/openapi/openapi.types.ts
libs/sdk/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
libs/sdk/**/*.{ts,tsx}: Preferinterfacefor defining object shapes in TypeScript, avoidanytypes
Use type parameters with constraints instead of unconstrained generics withanydefaults
Validate URIs per RFC 3986 at metadata level usingisValidMcpUrirefinement
UsechangeScopeinstead ofscopein change event properties to avoid confusion with Scope class
Fail fast on invalid hook flows by validating hooks match their entry type
Centralize record types in common/records and import from there, not from module-specific files
Return strictly typed MCP protocol responses (e.g.,Promise<GetPromptResult>) instead ofPromise<unknown>for MCP entry methods
Useunknowninstead ofanyfor generic type parameter defaults (not for MCP protocol types)
Create shared base classes for common functionality like ExecutionContextBase for ToolContext and ResourceContext
Do not mutate rawInput in flows - use state.set() for managing flow state instead
Validate inputs and outputs through parseOutput/safeParseOutput methods in validation flows
Files:
libs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.tslibs/sdk/src/transport/adapters/streamable-http-transport.ts
libs/**
⚙️ CodeRabbit configuration file
libs/**: Contains publishable SDK libraries. Review for API correctness, breaking changes, and consistency with docs. When public APIs change, ensure there is a matching docs/draft/docs/** update (not direct edits under docs/docs/**).
Files:
libs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.tslibs/adapters/src/openapi/__tests__/openapi-transforms.spec.tslibs/sdk/src/transport/adapters/streamable-http-transport.tslibs/adapters/src/openapi/openapi.tool.tslibs/adapters/src/openapi/openapi.adapter.tslibs/adapters/src/openapi/openapi.types.ts
🧠 Learnings (10)
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/{theme,adapters,bundler}/**/*.{test,spec}.{ts,tsx,js,jsx} : Test behavior across all supported platform configurations (OpenAI, Claude, etc.)
Applied to files:
libs/adapters/src/openapi/__tests__/openapi-transforms.spec.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*.ts : Extend tool metadata using `declare global` pattern to allow tools to specify plugin-specific options in their decorators
Applied to files:
libs/adapters/src/openapi/__tests__/openapi-transforms.spec.tslibs/adapters/src/openapi/openapi.tool.tslibs/adapters/src/openapi/openapi.types.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Return strictly typed MCP protocol responses (e.g., `Promise<GetPromptResult>`) instead of `Promise<unknown>` for MCP entry methods
Applied to files:
libs/adapters/src/openapi/openapi.tool.tslibs/adapters/src/openapi/openapi.adapter.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*.ts : Use proper ES module imports instead of `require()` for SDK imports; avoid dynamic require of `frontmcp/sdk` modules
Applied to files:
libs/adapters/src/openapi/openapi.adapter.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/{sdk,adapters}/**/*.{ts,tsx} : Use specific error classes with MCP error codes instead of generic errors
Applied to files:
libs/adapters/src/openapi/openapi.adapter.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Organize code following the frontmcp/uipack directory structure (adapters/, bundler/, theme/, renderers/, validation/, etc.)
Applied to files:
libs/adapters/src/openapi/openapi.adapter.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to **/*.{ts,tsx} : Use `frontmcp/utils` for file system operations instead of `fs/promises` or `node:fs` directly
Applied to files:
libs/adapters/src/openapi/openapi.adapter.ts
📚 Learning: 2025-12-24T00:41:41.819Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/ui/CLAUDE.md:0-0
Timestamp: 2025-12-24T00:41:41.819Z
Learning: Applies to libs/ui/src/react/hooks/**/*.{ts,tsx} : MCP bridge hooks (useMcpBridge, useCallTool, useToolInput, useToolOutput, useTheme) must be properly typed and handle loading/error states
Applied to files:
libs/adapters/src/openapi/openapi.adapter.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to **/*.{ts,tsx} : Use `frontmcp/utils` for cryptographic operations instead of `node:crypto` directly
Applied to files:
libs/adapters/src/openapi/openapi.adapter.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/index.{ts,js} : Export all public APIs through appropriate entry points (frontmcp/uipack, frontmcp/uipack/adapters, frontmcp/uipack/theme, etc.)
Applied to files:
libs/adapters/src/openapi/openapi.adapter.ts
🧬 Code graph analysis (2)
libs/adapters/src/openapi/openapi.tool.ts (1)
libs/adapters/src/openapi/openapi.types.ts (1)
PostToolTransformContext(505-516)
libs/adapters/src/openapi/openapi.types.ts (1)
libs/sdk/src/context/frontmcp-context.ts (2)
FrontMcpContext(147-503)FrontMcpContext(509-509)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Build Libraries
- GitHub Check: Lint & Format Checks
- GitHub Check: Package E2E (Verdaccio)
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (23)
libs/sdk/src/transport/adapters/streamable-http-transport.ts (1)
130-142: LGTM! Sensible relaxation of validation.The change correctly removes the requirement for a pre-existing
sessionIdfield since it won't exist on a fresh transport—the method's purpose is to set it. The comment at lines 131-132 clearly explains the rationale.The use of
'_initialized' in webTransportis appropriate for checking property existence on an unknown object shape.libs/sdk/src/transport/adapters/__tests__/streamable-http-transport.test.ts (1)
140-146: Test correctly updated to match relaxed validation.The test now properly validates that only the
_initializedfield is required, aligning with the implementation change. The error message assertion is appropriately scoped.libs/adapters/src/openapi/openapi.tool.ts (3)
219-245: Post-tool transform implementation looks solid.The transform pipeline correctly:
- Builds context with all required fields
- Checks optional filter before applying transform
- Handles async transforms via
await- Gracefully degrades on failure with warning log
One minor consideration: the
transformedDatavariable is declared withletbut the catch block doesn't reassign it (original value preserved by not modifying). This is intentional and correct behavior.
47-62: Conditional output schema wrapping is well-implemented.The check for
openapiTool.outputSchema !== undefinedcorrectly handles the case whereoutputSchemaMode: 'description'moves the schema to the description, ensuring no empty wrapper is created.
72-73: Clean conditional metadata inclusion.The spread pattern
...(wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema })is idiomatic TypeScript for conditional property inclusion.libs/adapters/src/openapi/openapi.adapter.ts (6)
152-164: Transform pipeline ordering is well-structured.The pipeline correctly sequences:
- Description mode
- Tool transforms
- Input transforms
- Schema transforms
- Output schema options (async for LLM support)
The
dataTransforms || outputTransformsfallback maintains backward compatibility with the deprecatedoutputTransformsoption.
503-543: Schema transforms implementation is correct.The method properly:
- Builds context for transform functions
- Applies transforms in order (input, then output)
- Uses reference equality to avoid unnecessary object creation
- Logs when transforms are applied
549-587: Transform collection with correct priority ordering.Priority
generator > perTool > globalallows:
- Global defaults that apply everywhere
- Per-tool overrides for specific tools
- Generator for dynamic/conditional transforms
This matches the established pattern from
toolTransformsandinputTransforms.
699-727: Pre-tool transform collection with proper merging.The spread-based merging allows partial overrides (e.g., per-tool can override just
transformDescriptionwhile inheriting global'stransformSchema). This provides flexible composition.
733-772: Post-tool transform collection with intentional merge strategy.The explicit handling of
transformandfilterseparately allows:
- Per-tool transform with inherited global filter
- Generator transform with inherited filter from per-tool or global
This is a sensible design for the filter inheritance pattern.
778-816: Schema formatting helpers are comprehensive.The helpers handle:
- Object properties with required/optional annotations
- Array types with recursive item type resolution
- Union types (e.g.,
string | null)- Fallback to
'any'for untyped schemas- Object title for named types
libs/adapters/src/openapi/openapi.types.ts (6)
346-361: JsonSchemaType is appropriately permissive.The index signature
[key: string]: unknownallows for JSON Schema extensions while providing type safety for common properties. This balances type safety with flexibility for complex schemas.
518-563: Transform types with clear pre/post distinction.
PreToolTransform: Applied atfetch()time, modifies tool definitionsPostToolTransform: Applied at execution time, modifies response dataThe context types correctly reflect available data at each phase:
PreToolTransformContext: tool + adapterOptions onlyPostToolTransformContext: full runtime context includingFrontMcpContext, status, ok
565-599: DataTransformOptions follows established patterns.The structure mirrors
ToolTransformOptionsandInputTransformOptionswith:
global: Applied to all toolsperTool: Keyed by tool namegenerator: Dynamic function-based transformsThe JSDoc note (lines 569-570) correctly guides users to
schemaTransformsfor definition changes vsdataTransformsfor runtime data manipulation.
601-605: Clean deprecation with type alias.The
@deprecatedtag will trigger IDE warnings, guiding users toDataTransformOptionswhile maintaining backward compatibility.
875-951: BaseOptions extensions are well-documented and backward compatible.The additions follow the pattern of other options:
- Optional fields with sensible defaults
- JSDoc with practical code examples
- Clear separation of concerns (schema transforms vs output schema display vs data transforms)
630-634: Remove or document the unusedpreToolTransformmetadata field.The
preToolTransformfield is defined inExtendedToolMetadata(line 631) but is never stored inmetadata.adapterduring tool creation. ThepreToolTransformsconfig option is used to transform the tool schema and description during adapter initialization (lines 634–648), but onlypostToolTransformis persisted in metadata (line 669) for runtime use. ThepreToolTransformfield in the type definition appears vestigial and should either be removed or documented if intended for future use.libs/adapters/src/openapi/__tests__/openapi-transforms.spec.ts (6)
58-64: Good helper pattern for test clarity.The
getFirstToolhelper:
- Asserts
toolsarray exists- Asserts at least one tool
- Returns first tool
This reduces boilerplate and ensures consistent assertions across tests.
897-1043: Comprehensive outputSchema options test coverage.Tests verify:
mode: 'definition'- no description modificationmode: 'both'withjsonSchemaandsummaryformatsmode: 'description'- schema moved to description- Custom sync and async
descriptionFormatter- Graceful handling of missing
outputSchema
1171-1337: PreToolTransforms tests cover key scenarios.Tests verify:
transformSchemamodifies output schematransformDescriptionmodifies description with schema access- Per-tool and generator priority/override
- Schema removal via
transformSchema: () => undefined
1339-1434: PostToolTransforms tests verify metadata storage.These tests correctly focus on:
- Transform function stored in metadata for runtime use
- Per-tool and generator patterns work
- Metadata structure is correct
Runtime transform execution would be tested in integration tests or tool execution tests.
1436-1805: Combined transforms tests ensure integration works.Key integration scenarios tested:
outputSchema+dataTransforms.preToolTransformsordering- Context propagation verification (line 1494-1497)
postToolTransformwithoutputSchemaoptions- Schema edge cases: many properties, arrays of objects, union types, missing type, nested arrays
730-746: Mapper type structure aligns with mcp-from-openapi.The explicit mapper objects with
type,key,required, andsecurityfields match the expected interface frommcp-from-openapi.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
libs/sdk/src/auth/session/__tests__/redis-session.store.test.ts (1)
388-409: LGTM! Test correctly verifies error logging behavior.The test properly validates that when a connection fails during
ping(), the store logs an error via the injected logger and returnsfalse. The mock logger setup is comprehensive and the assertions match the implementation in the source file.Minor observation: The
as nevercast on line 399 works but is less precise than typing the mock logger interface. Consider using a partial mock type if this pattern is used elsewhere:💡 Optional: Type the mock logger more precisely
- const mockLogger = { + const mockLogger: Partial<import('@frontmcp/utils').Logger> = { error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn(), verbose: jest.fn(), child: jest.fn(), }; - const storeWithLogger = new RedisSessionStore({ host: 'localhost', port: 6379 }, mockLogger as never); + const storeWithLogger = new RedisSessionStore({ host: 'localhost', port: 6379 }, mockLogger as Parameters<typeof RedisSessionStore>[1]);libs/utils/src/fs/fs.spec.ts (1)
36-57: Tests look good with reasonable coverage.The tests cover the happy path, error handling (ENOENT), and the encoding parameter. One minor observation: the encoding test on lines 50-56 uses
'utf8'which is typically the default encoding, so it doesn't strongly verify that the encoding parameter is actually being applied differently.Consider testing with a buffer or verifying behavior differs from the default:
it('should support custom encoding', () => { const filePath = path.join(tempDir, 'encoding-test.txt'); const buffer = Buffer.from([0xc3, 0xa9]); // UTF-8 bytes for 'é' fs.writeFileSync(filePath, buffer); const content = readFileSync(filePath, 'utf8'); expect(content).toBe('é'); });This is a minor suggestion and doesn't block the PR.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
libs/sdk/src/auth/session/__tests__/redis-session.store.test.tslibs/utils/src/fs/fs.spec.tslibs/utils/src/storage/__tests__/errors.test.ts
🧰 Additional context used
📓 Path-based instructions (5)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{ts,tsx}: Use strict TypeScript mode with noanytypes without strong justification
Avoid non-null assertions (!) - use proper error handling and type guards instead
Use@frontmcp/utilsfor cryptographic operations instead ofnode:cryptodirectly
Use@frontmcp/utilsfor file system operations instead offs/promisesornode:fsdirectly
Files:
libs/utils/src/fs/fs.spec.tslibs/sdk/src/auth/session/__tests__/redis-session.store.test.tslibs/utils/src/storage/__tests__/errors.test.ts
libs/**
⚙️ CodeRabbit configuration file
libs/**: Contains publishable SDK libraries. Review for API correctness, breaking changes, and consistency with docs. When public APIs change, ensure there is a matching docs/draft/docs/** update (not direct edits under docs/docs/**).
Files:
libs/utils/src/fs/fs.spec.tslibs/sdk/src/auth/session/__tests__/redis-session.store.test.tslibs/utils/src/storage/__tests__/errors.test.ts
**/*.test.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.test.{ts,tsx}: Achieve 95%+ test coverage across all metrics (statements, branches, functions, lines)
Use Jest for testing with 95%+ coverage requirement and 100% test pass rate
Do not use prefixes like 'PT-001' in test names
Do not skip constructor validation tests for error classes and types
Includeinstanceofchecks in tests for error classes to verify proper error hierarchy
Files:
libs/sdk/src/auth/session/__tests__/redis-session.store.test.tslibs/utils/src/storage/__tests__/errors.test.ts
libs/{sdk,adapters}/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
libs/{sdk,adapters}/**/*.{ts,tsx}: Use specific error classes with MCP error codes instead of generic errors
UsegetCapabilities()for dynamic capability exposure instead of hardcoding capabilities
Files:
libs/sdk/src/auth/session/__tests__/redis-session.store.test.ts
libs/sdk/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
libs/sdk/**/*.{ts,tsx}: Preferinterfacefor defining object shapes in TypeScript, avoidanytypes
Use type parameters with constraints instead of unconstrained generics withanydefaults
Validate URIs per RFC 3986 at metadata level usingisValidMcpUrirefinement
UsechangeScopeinstead ofscopein change event properties to avoid confusion with Scope class
Fail fast on invalid hook flows by validating hooks match their entry type
Centralize record types in common/records and import from there, not from module-specific files
Return strictly typed MCP protocol responses (e.g.,Promise<GetPromptResult>) instead ofPromise<unknown>for MCP entry methods
Useunknowninstead ofanyfor generic type parameter defaults (not for MCP protocol types)
Create shared base classes for common functionality like ExecutionContextBase for ToolContext and ResourceContext
Do not mutate rawInput in flows - use state.set() for managing flow state instead
Validate inputs and outputs through parseOutput/safeParseOutput methods in validation flows
Files:
libs/sdk/src/auth/session/__tests__/redis-session.store.test.ts
🧠 Learnings (4)
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to **/*.{ts,tsx} : Use `frontmcp/utils` for file system operations instead of `fs/promises` or `node:fs` directly
Applied to files:
libs/utils/src/fs/fs.spec.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*.test.ts : Tests must achieve 95%+ code coverage across all metrics; use `MockStore` implementing `RememberStoreInterface` for RememberPlugin testing
Applied to files:
libs/sdk/src/auth/session/__tests__/redis-session.store.test.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to **/*.test.{ts,tsx} : Include `instanceof` checks in tests for error classes to verify proper error hierarchy
Applied to files:
libs/utils/src/storage/__tests__/errors.test.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/{src}/**/*.{ts,tsx,js,jsx} : Do not expose internal error details in public APIs - use sanitized error messages
Applied to files:
libs/utils/src/storage/__tests__/errors.test.ts
🧬 Code graph analysis (1)
libs/sdk/src/auth/session/__tests__/redis-session.store.test.ts (1)
libs/sdk/src/auth/session/redis-session.store.ts (1)
RedisSessionStore(35-348)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Lint & Format Checks
- GitHub Check: Build Libraries
- GitHub Check: Package E2E (Verdaccio)
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (2)
libs/utils/src/fs/fs.spec.ts (1)
4-4: LGTM!The import correctly adds
readFileSyncto the public API surface being tested.libs/utils/src/storage/__tests__/errors.test.ts (1)
59-72: LGTM! Tests properly cover the new cause message behavior.The new tests effectively verify both branches of the enhanced
StorageConnectionErrorbehavior:
- When a cause is provided, the message includes the cause's message
- When no cause is provided, the message remains unchanged
The
instanceofchecks for error hierarchy are already covered by the existing test at lines 74-77 and the comprehensive "Error hierarchy" section, so these focused behavioral tests appropriately don't duplicate that verification. Based on learnings, the existing coverage satisfies the requirement for instanceof checks.
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/pr-testing-registry.yml (1)
176-190: Default domain logic breaks the fallback for users withoutNGROK_AUTH_TOKEN.The new default domain logic on lines 178-181 ensures
NGROK_DOMAINis always set. However, the check on lines 184-187 will now always fail whenNGROK_AUTH_TOKENis not configured, because a domain is always present.Previously, users without
NGROK_AUTH_TOKENcould run the workflow and get a random ngrok URL. Now, they will always hit the error on line 185-186 sinceNGROK_DOMAINis never empty.Consider one of these fixes:
- Only apply the default domain when
NGROK_AUTH_TOKENis available.- Keep the original behavior where no domain means random URL generation.
🐛 Proposed fix: Only default domain when auth token is available
# Get domain - use provided value or default to frontmcp-pr-{PR_NUM}.ngrok.io NGROK_DOMAIN="${{ inputs.ngrok_domain }}" - if [ -z "${NGROK_DOMAIN}" ]; then + if [ -z "${NGROK_DOMAIN}" ] && [ -n "${NGROK_AUTH_TOKEN:-}" ]; then NGROK_DOMAIN="frontmcp-pr-${{ inputs.pr_number }}.ngrok.io" echo "Using default domain: ${NGROK_DOMAIN}" fi
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/pr-testing-registry.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Lint & Format Checks
- GitHub Check: Build Libraries
- GitHub Check: Package E2E (Verdaccio)
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (1)
.github/workflows/pr-testing-registry.yml (1)
22-26: LGTM!The updated description accurately reflects the new defaulting behavior implemented in the workflow.
…d barrel exports for options
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/draft/docs/servers/server.mdx (1)
357-366: Inconsistent persistence configuration example.The example at line 359 uses
persistence: { enabled: true }, but the type definition shown earlier (lines 82-84) defines persistence asfalse | { defaultTtlMs?: number }without anenabledproperty. This inconsistency could confuse users.📝 Suggested fix
transport: { - persistence: { enabled: true }, + persistence: { defaultTtlMs: 3600000 }, // Or just omit to use auto-enabled defaults },Alternatively, if
enabledis a valid property, update the type definition at lines 82-84 to include it.
🤖 Fix all issues with AI agents
In `@libs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.ts`:
- Around line 17-27: The type guard isPersistenceObject currently returns true
for null but its return type lacks null; mirror the fix made in
front-mcp.metadata.ts by updating the type guard signature to include null
(value is { redis?: unknown; defaultTtlMs?: number } | false | null | undefined)
and keep the existing null check that returns true, ensuring the runtime
behavior and the TypeScript type are consistent; update any related tests to
reflect the accepted null union if present.
In `@libs/sdk/src/common/metadata/front-mcp.metadata.ts`:
- Around line 131-142: The type guard isPersistenceObject currently returns true
for null but its type predicate doesn't include null; update the predicate to
reflect actual behavior by adding null to the union (i.e., change the return
type to include | null) OR change the runtime check so null is treated as
invalid (return false) if you want null rejected; specifically modify the
function signature isPersistenceObject(...) : value is { redis?: unknown;
defaultTtlMs?: number } | false | undefined | null (or remove the `if (value ===
null)` branch and return false) and keep the rest of the validation logic
unchanged.
🧹 Nitpick comments (14)
apps/e2e/demo-e2e-remote/src/main.ts (1)
6-6: Pre-existing unused variable.
idpProviderUrlis defined but never used within this file. This appears to be pre-existing (not part of the current changes), but you may want to address it as a follow-up cleanup if the variable is no longer needed.docs/draft/docs/authentication/demo-servers.mdx (1)
64-65: Redundant bullet points.Line 64 already states that
fullenables "all transports with relaxed session requirements." Line 65 then repeats that Streamable HTTP has relaxed session requirements—this is already covered by "all transports." Consider consolidating these or making line 65 highlight a distinct aspect.✏️ Suggested consolidation
-- Uses `full` protocol preset enabling all transports with relaxed session requirements for easy smoke tests. -- Enables Streamable HTTP for MCP clients with relaxed session requirements. +- Uses the `full` protocol preset—all transports enabled with relaxed session requirements—for easy smoke tests.libs/sdk/src/common/types/options/__tests__/transport.options.test.ts (1)
311-366: Add tests forstateless-apiandfullpresets to matchexpandProtocolConfigcoverage.The
expandProtocolConfigtests cover all four presets (legacy,modern,stateless-api,full), buttoLegacyProtocolFlagsonly testsmodern,legacy, andundefined. Adding tests for the remaining presets ensures complete branch coverage and validates the flag mapping for all preset configurations.🧪 Suggested additional test cases
it('should convert custom protocol config to legacy flags', () => { const result = toLegacyProtocolFlags({ sse: false, streamable: false, json: true, stateless: true, legacy: true, strictSession: false, }); expect(result).toEqual({ enableLegacySSE: true, enableSseListener: false, enableStreamableHttp: false, enableStatelessHttp: true, enableStatefulHttp: true, requireSessionForStreamable: false, }); }); + + it('should convert stateless-api preset to legacy flags', () => { + const result = toLegacyProtocolFlags('stateless-api'); + expect(result).toEqual({ + enableLegacySSE: false, + enableSseListener: false, + enableStreamableHttp: false, + enableStatelessHttp: true, + enableStatefulHttp: false, + requireSessionForStreamable: false, + }); + }); + + it('should convert full preset to legacy flags', () => { + const result = toLegacyProtocolFlags('full'); + expect(result).toEqual({ + enableLegacySSE: true, + enableSseListener: true, + enableStreamableHttp: true, + enableStatelessHttp: true, + enableStatefulHttp: true, + requireSessionForStreamable: false, + }); + }); });libs/sdk/src/common/types/options/server-info/schema.ts (1)
12-18: Consider adding URL validation forwebsiteUrl.The
websiteUrlfield accepts any string. Per coding guidelines, URIs should be validated. Consider adding a URL refinement:♻️ Proposed fix
export const serverInfoOptionsSchema = z.object({ name: z.string(), title: z.string().optional(), version: z.string(), - websiteUrl: z.string().optional(), + websiteUrl: z.string().url().optional(), icons: z.array(IconSchema).optional(), } satisfies RawZodShape<ServerInfoOptionsInterface>);Alternatively, if custom MCP URI validation is required, use the
isValidMcpUrirefinement mentioned in the coding guidelines.libs/sdk/src/common/types/options/http/schema.ts (1)
12-12: Preferz.unknown()overz.any()forhostFactory.Per coding guidelines, avoid
anytypes without strong justification. WhilehostFactoryaccepts a complex union type that Zod cannot natively validate, usingz.unknown()is safer and aligns with the guideline to useunknowninstead ofany.♻️ Suggested change
- hostFactory: z.any().optional(), + hostFactory: z.unknown().optional(),Based on coding guidelines requiring
unknowninstead ofanyfor SDK code.libs/sdk/src/common/types/options/redis/interfaces.ts (1)
95-98: Consider adding a discriminant to the legacy connection option.The third union member
(RedisConnectionInterface & CommonStorageOptionsInterface)lacks aproviderdiscriminant, which can make runtime type narrowing more complex compared to the other union members that have explicitprovider: 'redis' | 'vercel-kv'literals.If this is intentional to support legacy configurations without an explicit provider field (defaulting to Redis), this is acceptable but worth documenting. Otherwise, consider requiring
provider: 'redis'for all Redis connections.libs/sdk/src/common/types/options/session/schema.ts (1)
29-35: Consider constraining the function type in sessionMode.The
z.function()at line 31 accepts any function signature. IfsessionModewhen a function should have a specific signature (e.g.,(issuer: string) => 'stateful' | 'stateless'based on the docs), consider usingz.function().args(...).returns(...)for better type safety and validation.💡 Example of constrained function schema
export const sessionOptionsSchema = z.object({ sessionMode: z - .union([z.literal('stateful'), z.literal('stateless'), z.function()]) + .union([ + z.literal('stateful'), + z.literal('stateless'), + z.function() + .args(z.string()) + .returns(z.union([z.literal('stateful'), z.literal('stateless')])) + ]) .optional() .default('stateless'), platformDetection: platformDetectionConfigSchema.optional(), } satisfies RawZodShape<SessionOptionsInterface>);libs/sdk/src/scope/flows/http.request.flow.ts (1)
208-220: Avoid non-null assertion ontransport.Per coding guidelines, non-null assertions (
!) should be avoided in favor of proper error handling or type guards. While the comment states transport is "always defined after schema parsing," a defensive check would be safer.♻️ Suggested fix
- // Use transport config from scope metadata (top-level transport config only) - // Note: transportConfig is always defined after schema parsing (has defaults) - const transportConfig = this.scope.metadata.transport!; + // Use transport config from scope metadata (top-level transport config only) + const transportConfig = this.scope.metadata.transport; + if (!transportConfig) { + this.logger.error(`[${this.requestId}] transport config not found in scope metadata`); + this.respond(httpRespond.internalError('Transport configuration missing')); + return; + }libs/sdk/src/common/types/options/http/index.ts (1)
8-9: Backwards-compatible alias may violate coding guidelines.The
HttpConfigalias contradicts the guideline to "do not add backwards compatibility aliases" in barrel exports. Based on learnings, this should be removed unless there's a specific migration plan requiring it.If this alias is intentional for a deprecation period, consider adding a
@deprecatedJSDoc comment to guide users towardHttpOptions.Option 1: Remove the alias (preferred per guidelines)
export type { HttpOptionsInterface } from './interfaces'; export { httpOptionsSchema } from './schema'; export type { HttpOptions, HttpOptionsInput } from './schema'; - -// Re-export with backwards-compatible alias -export type { HttpOptions as HttpConfig } from './schema';Option 2: If alias is necessary, add deprecation notice
-// Re-export with backwards-compatible alias -export type { HttpOptions as HttpConfig } from './schema'; +/** + * `@deprecated` Use `HttpOptions` instead. Will be removed in a future version. + */ +export type { HttpOptions as HttpConfig } from './schema';libs/sdk/src/common/types/options/pagination/schema.ts (1)
10-17: Consider addingsatisfiesconstraint for type alignment.The
loggingOptionsSchemain this PR usessatisfies RawZodShape<LoggingOptionsInterface>to ensure the schema aligns with its corresponding interface. For consistency and compile-time safety, consider applying the same pattern here:+import type { RawZodShape } from '../../common.types'; +import type { ToolPaginationOptionsInterface } from './interfaces'; + export const toolPaginationOptionsSchema = z.object({ mode: z .union([z.literal('auto'), z.boolean()]) .optional() .default('auto'), pageSize: z.number().int().positive().optional().default(40), autoThreshold: z.number().int().positive().optional().default(40), -}); +} satisfies RawZodShape<ToolPaginationOptionsInterface>);This ensures the schema stays in sync with the interface if either is modified.
libs/sdk/src/common/types/options/redis/index.ts (1)
4-32: Potential duplicate export ofStorageProvider.
StorageProvideris exported twice: once as an aliasStorageProviderInterfacefrom./interfaces(line 5), and again directly from./schema(line 25). This may cause confusion for consumers. Consider removing one of the exports or clarifying the distinction in comments.♻️ Suggested clarification
If both exports are intentional (interface from
./interfacesand inferred type from schema), add a clarifying comment:+// StorageProvider from schema is the Zod-inferred type +// StorageProviderInterface from interfaces is the explicit interface (same shape) export type { StorageProvider, RedisProviderOptions,Alternatively, if they're the same type, remove the duplicate:
export type { StorageProvider as StorageProviderInterface, CommonStorageOptionsInterface, RedisConnectionInterface, RedisProviderOptionsInterface, VercelKvProviderOptionsInterface, RedisOptionsInterface, } from './interfaces'; // ... later ... export type { - StorageProvider, RedisProviderOptions,libs/sdk/src/transport/transport.registry.ts (2)
120-136: Consider using a type guard instead of inline cast.The cast on line 122 (
as { redis?: { provider?: string } } | undefined) works but is verbose. A type guard or extracting this logic into a helper would improve readability and type safety.♻️ Suggested improvement
+ private getProviderType(): string { + if (typeof this.persistenceConfig === 'object' && this.persistenceConfig?.redis) { + return 'provider' in this.persistenceConfig.redis + ? this.persistenceConfig.redis.provider ?? 'redis' + : 'redis'; + } + return 'redis'; + } // In the validation block: - const persistConfig = this.persistenceConfig as { redis?: { provider?: string } } | undefined; - const providerType = persistConfig?.redis?.provider ?? 'redis'; + const providerType = this.getProviderType();
401-402: Duplicate TTL extraction logic.The
defaultTtlMsextraction pattern (typeof this.persistenceConfig === 'object' ? this.persistenceConfig?.defaultTtlMs : undefined) is repeated at lines 307-308 and 401-402. Consider extracting this into a getter method to reduce duplication.♻️ Suggested refactor
+ /** + * Get the default TTL for session persistence. + * Returns undefined if persistence is disabled or not configured. + */ + private getDefaultTtlMs(): number | undefined { + return typeof this.persistenceConfig === 'object' + ? this.persistenceConfig?.defaultTtlMs + : undefined; + } // Then replace: - const defaultTtlMs = typeof this.persistenceConfig === 'object' ? this.persistenceConfig?.defaultTtlMs : undefined; + const defaultTtlMs = this.getDefaultTtlMs();libs/sdk/src/common/types/options/transport/schema.ts (1)
221-255: Consider validating thesessionModefunction signature with Zod.The
z.function()on line 227 accepts any function without runtime signature validation. While TypeScript'ssatisfies RawZodShape<TransportOptionsInterface>constraint enforces compile-time type safety, the code currently uses a runtime cast to bridge the gap:sessionMode: config.sessionMode as ExpandedTransportConfig['sessionMode']. This cast masks the type inference mismatch betweenz.function()and the expected signature.Since Zod 4.x supports function validation, refactoring to validate the signature would eliminate the cast and strengthen runtime safety:
♻️ Optional: Add function signature validation
sessionMode: z - .union([z.literal('stateful'), z.literal('stateless'), z.function()]) + .union([ + z.literal('stateful'), + z.literal('stateless'), + z.function() + .args(z.string()) // issuer + .returns(z.union([ + z.literal('stateful'), + z.literal('stateless'), + z.promise(z.union([z.literal('stateful'), z.literal('stateless')])) + ])) + ]) .optional() .default('stateful'),This removes the need for the cast workaround while maintaining backward compatibility.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (79)
apps/demo/src/main.tsapps/e2e/demo-e2e-agents/src/main.tsapps/e2e/demo-e2e-cache/src/main.tsapps/e2e/demo-e2e-codecall/src/main.tsapps/e2e/demo-e2e-config/src/main.tsapps/e2e/demo-e2e-errors/src/main.tsapps/e2e/demo-e2e-hooks/src/main.tsapps/e2e/demo-e2e-multiapp/src/main.tsapps/e2e/demo-e2e-notifications/src/main.tsapps/e2e/demo-e2e-openapi/src/main.tsapps/e2e/demo-e2e-orchestrated/src/main.tsapps/e2e/demo-e2e-providers/src/main.tsapps/e2e/demo-e2e-redis/src/main.tsapps/e2e/demo-e2e-remember/src/main.tsapps/e2e/demo-e2e-remote/src/main.tsapps/e2e/demo-e2e-serverless/src/main.tsapps/e2e/demo-e2e-standalone/src/main.tsapps/e2e/demo-e2e-transparent/src/main.tsapps/e2e/demo-e2e-transport-recreation/src/main.tsapps/e2e/demo-e2e-ui/src/main.tsdocs/draft/docs/authentication/demo-servers.mdxdocs/draft/docs/servers/server.mdxlibs/sdk/src/auth/session/record/session.base.tslibs/sdk/src/auth/session/session.transport.tslibs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/auth/session/vercel-kv-session.store.tslibs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/common/interfaces/internal/primary-auth-provider.interface.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/migrate/__tests__/auth-transport.migrate.test.tslibs/sdk/src/common/migrate/auth-transport.migrate.tslibs/sdk/src/common/migrate/index.tslibs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/types/options/__tests__/transport.options.test.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/auth/interfaces.tslibs/sdk/src/common/types/options/auth/orchestrated.schema.tslibs/sdk/src/common/types/options/auth/public.schema.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/common/types/options/auth/transparent.schema.tslibs/sdk/src/common/types/options/auth/transport.deprecated.tslibs/sdk/src/common/types/options/auth/typecheck.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/types/options/http.options.tslibs/sdk/src/common/types/options/http/index.tslibs/sdk/src/common/types/options/http/interfaces.tslibs/sdk/src/common/types/options/http/schema.tslibs/sdk/src/common/types/options/index.tslibs/sdk/src/common/types/options/logging.options.tslibs/sdk/src/common/types/options/logging/index.tslibs/sdk/src/common/types/options/logging/interfaces.tslibs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/common/types/options/pagination/index.tslibs/sdk/src/common/types/options/pagination/interfaces.tslibs/sdk/src/common/types/options/pagination/schema.tslibs/sdk/src/common/types/options/redis/index.tslibs/sdk/src/common/types/options/redis/interfaces.tslibs/sdk/src/common/types/options/redis/schema.tslibs/sdk/src/common/types/options/server-info.options.tslibs/sdk/src/common/types/options/server-info/index.tslibs/sdk/src/common/types/options/server-info/interfaces.tslibs/sdk/src/common/types/options/server-info/schema.tslibs/sdk/src/common/types/options/session.options.tslibs/sdk/src/common/types/options/session/index.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/transport.options.tslibs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/transport/interfaces.tslibs/sdk/src/common/types/options/transport/schema.tslibs/sdk/src/common/types/options/transport/typecheck.tslibs/sdk/src/common/utils/decide-request-intent.utils.tslibs/sdk/src/provider/provider.registry.tslibs/sdk/src/scope/flows/http.request.flow.tslibs/sdk/src/scope/scope.instance.tslibs/sdk/src/tool/flows/tools-list.flow.tslibs/sdk/src/transport/README.mdlibs/sdk/src/transport/transport.registry.ts
💤 Files with no reviewable changes (12)
- libs/sdk/src/common/types/options/auth/orchestrated.schema.ts
- libs/sdk/src/common/types/options/http.options.ts
- libs/sdk/src/common/types/options/logging.options.ts
- libs/sdk/src/common/types/options/auth/transparent.schema.ts
- libs/sdk/src/common/types/options/session.options.ts
- libs/sdk/src/common/migrate/tests/auth-transport.migrate.test.ts
- libs/sdk/src/common/types/options/transport.options.ts
- libs/sdk/src/common/types/options/server-info.options.ts
- libs/sdk/src/common/migrate/auth-transport.migrate.ts
- libs/sdk/src/common/types/options/auth/transport.deprecated.ts
- libs/sdk/src/common/migrate/index.ts
- libs/sdk/src/common/types/options/auth/public.schema.ts
✅ Files skipped from review due to trivial changes (3)
- libs/sdk/src/common/types/options/redis/schema.ts
- libs/sdk/src/common/types/options/session/index.ts
- libs/sdk/src/common/types/options/auth/typecheck.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- libs/sdk/src/auth/session/vercel-kv-session.store.ts
🧰 Additional context used
📓 Path-based instructions (8)
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{ts,tsx}: Use strict TypeScript mode with noanytypes without strong justification
Avoid non-null assertions (!) - use proper error handling and type guards instead
Use@frontmcp/utilsfor cryptographic operations instead ofnode:cryptodirectly
Use@frontmcp/utilsfor file system operations instead offs/promisesornode:fsdirectly
Files:
libs/sdk/src/auth/session/utils/session-id.utils.tsapps/e2e/demo-e2e-orchestrated/src/main.tslibs/sdk/src/common/types/options/server-info/schema.tslibs/sdk/src/common/types/options/http/index.tslibs/sdk/src/scope/scope.instance.tslibs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/types/options/http/interfaces.tslibs/sdk/src/common/types/options/logging/index.tsapps/e2e/demo-e2e-config/src/main.tslibs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/logging/schema.tsapps/e2e/demo-e2e-ui/src/main.tslibs/sdk/src/auth/session/record/session.base.tsapps/e2e/demo-e2e-providers/src/main.tslibs/sdk/src/auth/session/session.transport.tsapps/e2e/demo-e2e-transport-recreation/src/main.tsapps/e2e/demo-e2e-standalone/src/main.tslibs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/redis/interfaces.tsapps/e2e/demo-e2e-notifications/src/main.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/decorators/front-mcp.decorator.tsapps/e2e/demo-e2e-hooks/src/main.tslibs/sdk/src/common/types/options/server-info/interfaces.tslibs/sdk/src/common/types/options/http/schema.tslibs/sdk/src/common/types/options/pagination/schema.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/provider/provider.registry.tsapps/e2e/demo-e2e-openapi/src/main.tsapps/e2e/demo-e2e-remember/src/main.tsapps/e2e/demo-e2e-errors/src/main.tsapps/demo/src/main.tsapps/e2e/demo-e2e-codecall/src/main.tslibs/sdk/src/common/types/options/pagination/interfaces.tslibs/sdk/src/common/interfaces/internal/primary-auth-provider.interface.tslibs/sdk/src/common/types/options/pagination/index.tsapps/e2e/demo-e2e-redis/src/main.tslibs/sdk/src/common/utils/decide-request-intent.utils.tsapps/e2e/demo-e2e-remote/src/main.tslibs/sdk/src/common/types/options/transport/typecheck.tsapps/e2e/demo-e2e-multiapp/src/main.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/logging/interfaces.tslibs/sdk/src/common/types/options/transport/interfaces.tsapps/e2e/demo-e2e-transparent/src/main.tslibs/sdk/src/common/types/options/server-info/index.tslibs/sdk/src/common/types/options/auth/interfaces.tsapps/e2e/demo-e2e-agents/src/main.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.tslibs/sdk/src/scope/flows/http.request.flow.tslibs/sdk/src/tool/flows/tools-list.flow.tsapps/e2e/demo-e2e-cache/src/main.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/__tests__/transport.options.test.tsapps/e2e/demo-e2e-serverless/src/main.tslibs/sdk/src/common/types/options/transport/schema.tslibs/sdk/src/transport/transport.registry.tslibs/sdk/src/common/types/options/index.tslibs/sdk/src/common/types/options/redis/index.ts
libs/{sdk,adapters}/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
libs/{sdk,adapters}/**/*.{ts,tsx}: Use specific error classes with MCP error codes instead of generic errors
UsegetCapabilities()for dynamic capability exposure instead of hardcoding capabilities
Files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/common/types/options/server-info/schema.tslibs/sdk/src/common/types/options/http/index.tslibs/sdk/src/scope/scope.instance.tslibs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/types/options/http/interfaces.tslibs/sdk/src/common/types/options/logging/index.tslibs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/auth/session/record/session.base.tslibs/sdk/src/auth/session/session.transport.tslibs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/redis/interfaces.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/common/types/options/server-info/interfaces.tslibs/sdk/src/common/types/options/http/schema.tslibs/sdk/src/common/types/options/pagination/schema.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/provider/provider.registry.tslibs/sdk/src/common/types/options/pagination/interfaces.tslibs/sdk/src/common/interfaces/internal/primary-auth-provider.interface.tslibs/sdk/src/common/types/options/pagination/index.tslibs/sdk/src/common/utils/decide-request-intent.utils.tslibs/sdk/src/common/types/options/transport/typecheck.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/logging/interfaces.tslibs/sdk/src/common/types/options/transport/interfaces.tslibs/sdk/src/common/types/options/server-info/index.tslibs/sdk/src/common/types/options/auth/interfaces.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.tslibs/sdk/src/scope/flows/http.request.flow.tslibs/sdk/src/tool/flows/tools-list.flow.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/__tests__/transport.options.test.tslibs/sdk/src/common/types/options/transport/schema.tslibs/sdk/src/transport/transport.registry.tslibs/sdk/src/common/types/options/index.tslibs/sdk/src/common/types/options/redis/index.ts
libs/sdk/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
libs/sdk/**/*.{ts,tsx}: Preferinterfacefor defining object shapes in TypeScript, avoidanytypes
Use type parameters with constraints instead of unconstrained generics withanydefaults
Validate URIs per RFC 3986 at metadata level usingisValidMcpUrirefinement
UsechangeScopeinstead ofscopein change event properties to avoid confusion with Scope class
Fail fast on invalid hook flows by validating hooks match their entry type
Centralize record types in common/records and import from there, not from module-specific files
Return strictly typed MCP protocol responses (e.g.,Promise<GetPromptResult>) instead ofPromise<unknown>for MCP entry methods
Useunknowninstead ofanyfor generic type parameter defaults (not for MCP protocol types)
Create shared base classes for common functionality like ExecutionContextBase for ToolContext and ResourceContext
Do not mutate rawInput in flows - use state.set() for managing flow state instead
Validate inputs and outputs through parseOutput/safeParseOutput methods in validation flows
Files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/common/types/options/server-info/schema.tslibs/sdk/src/common/types/options/http/index.tslibs/sdk/src/scope/scope.instance.tslibs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/types/options/http/interfaces.tslibs/sdk/src/common/types/options/logging/index.tslibs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/auth/session/record/session.base.tslibs/sdk/src/auth/session/session.transport.tslibs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/redis/interfaces.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/common/types/options/server-info/interfaces.tslibs/sdk/src/common/types/options/http/schema.tslibs/sdk/src/common/types/options/pagination/schema.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/provider/provider.registry.tslibs/sdk/src/common/types/options/pagination/interfaces.tslibs/sdk/src/common/interfaces/internal/primary-auth-provider.interface.tslibs/sdk/src/common/types/options/pagination/index.tslibs/sdk/src/common/utils/decide-request-intent.utils.tslibs/sdk/src/common/types/options/transport/typecheck.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/logging/interfaces.tslibs/sdk/src/common/types/options/transport/interfaces.tslibs/sdk/src/common/types/options/server-info/index.tslibs/sdk/src/common/types/options/auth/interfaces.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.tslibs/sdk/src/scope/flows/http.request.flow.tslibs/sdk/src/tool/flows/tools-list.flow.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/__tests__/transport.options.test.tslibs/sdk/src/common/types/options/transport/schema.tslibs/sdk/src/transport/transport.registry.tslibs/sdk/src/common/types/options/index.tslibs/sdk/src/common/types/options/redis/index.ts
libs/**
⚙️ CodeRabbit configuration file
libs/**: Contains publishable SDK libraries. Review for API correctness, breaking changes, and consistency with docs. When public APIs change, ensure there is a matching docs/draft/docs/** update (not direct edits under docs/docs/**).
Files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/common/types/options/server-info/schema.tslibs/sdk/src/common/types/options/http/index.tslibs/sdk/src/scope/scope.instance.tslibs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/types/options/http/interfaces.tslibs/sdk/src/common/types/options/logging/index.tslibs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/auth/session/record/session.base.tslibs/sdk/src/auth/session/session.transport.tslibs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/redis/interfaces.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/common/types/options/server-info/interfaces.tslibs/sdk/src/common/types/options/http/schema.tslibs/sdk/src/common/types/options/pagination/schema.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/provider/provider.registry.tslibs/sdk/src/common/types/options/pagination/interfaces.tslibs/sdk/src/common/interfaces/internal/primary-auth-provider.interface.tslibs/sdk/src/common/types/options/pagination/index.tslibs/sdk/src/common/utils/decide-request-intent.utils.tslibs/sdk/src/common/types/options/transport/typecheck.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/logging/interfaces.tslibs/sdk/src/common/types/options/transport/interfaces.tslibs/sdk/src/common/types/options/server-info/index.tslibs/sdk/src/common/types/options/auth/interfaces.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.tslibs/sdk/src/scope/flows/http.request.flow.tslibs/sdk/src/tool/flows/tools-list.flow.tslibs/sdk/src/transport/README.mdlibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/__tests__/transport.options.test.tslibs/sdk/src/common/types/options/transport/schema.tslibs/sdk/src/transport/transport.registry.tslibs/sdk/src/common/types/options/index.tslibs/sdk/src/common/types/options/redis/index.ts
**/*.test.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.test.{ts,tsx}: Achieve 95%+ test coverage across all metrics (statements, branches, functions, lines)
Use Jest for testing with 95%+ coverage requirement and 100% test pass rate
Do not use prefixes like 'PT-001' in test names
Do not skip constructor validation tests for error classes and types
Includeinstanceofchecks in tests for error classes to verify proper error hierarchy
Files:
libs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.tslibs/sdk/src/common/types/options/__tests__/transport.options.test.ts
apps/demo/**
⚙️ CodeRabbit configuration file
apps/demo/**: apps/demo directory contains a demo application for testing purposes. It can be used as a reference for SDK usage examples.
Files:
apps/demo/src/main.ts
docs/draft/docs/**
⚙️ CodeRabbit configuration file
docs/draft/docs/**: This folder holds the draft/source docs that humans are expected to edit. When authors want to add or change documentation, they should do it here. The Codex workflow uses these drafts, together with the code diff, to generate the latest docs under docs/docs/. As a reviewer: - Encourage contributors to add/update content here instead of docs/docs/. - It is fine to do structural/content feedback here (clarity, examples, etc).
Files:
docs/draft/docs/servers/server.mdxdocs/draft/docs/authentication/demo-servers.mdx
docs/**
⚙️ CodeRabbit configuration file
docs/**: Repository documentation for the SDK, using MDX and hosted by Mintlify. See more specific rules for: - docs/docs/** (latest rendered docs, automation-only) - docs/v/** (archived versions, read-only) - docs/draft/docs/** (human-editable drafts) - docs/blogs/** (blogs, human edited) - docs/docs.json (Mintlify navigation)
Files:
docs/draft/docs/servers/server.mdxdocs/draft/docs/authentication/demo-servers.mdx
🧠 Learnings (31)
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Centralize record types in common/records and import from there, not from module-specific files
Applied to files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/common/types/options/http/index.tslibs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/types/options/logging/index.tslibs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/common/types/options/pagination/index.tslibs/sdk/src/common/utils/decide-request-intent.utils.tslibs/sdk/src/common/types/options/transport/typecheck.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/logging/interfaces.tslibs/sdk/src/common/types/options/transport/interfaces.tslibs/sdk/src/common/types/options/server-info/index.tslibs/sdk/src/common/types/options/auth/interfaces.tslibs/sdk/src/tool/flows/tools-list.flow.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/transport/schema.tslibs/sdk/src/common/types/options/index.tslibs/sdk/src/common/types/options/redis/index.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*.ts : Use proper ES module imports instead of `require()` for SDK imports; avoid dynamic require of `frontmcp/sdk` modules
Applied to files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/common/types/options/__tests__/redis.options.test.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/common/types/options/transport/interfaces.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/tool/flows/tools-list.flow.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/index.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/{sdk,adapters}/**/*.{ts,tsx} : Use `getCapabilities()` for dynamic capability exposure instead of hardcoding capabilities
Applied to files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/common/utils/decide-request-intent.utils.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/index.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Use `changeScope` instead of `scope` in change event properties to avoid confusion with Scope class
Applied to files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/scope/scope.instance.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/scope/flows/http.request.flow.tslibs/sdk/src/common/types/options/index.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/{theme,adapters,bundler}/**/*.{test,spec}.{ts,tsx,js,jsx} : Test behavior across all supported platform configurations (OpenAI, Claude, etc.)
Applied to files:
libs/sdk/src/auth/session/utils/session-id.utils.tslibs/sdk/src/common/types/options/__tests__/transport.options.test.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to **/*.{ts,tsx} : Use `frontmcp/utils` for cryptographic operations instead of `node:crypto` directly
Applied to files:
libs/sdk/src/auth/session/utils/session-id.utils.tsapps/e2e/demo-e2e-ui/src/main.tsapps/e2e/demo-e2e-providers/src/main.tsapps/e2e/demo-e2e-standalone/src/main.tslibs/sdk/src/common/types/options/auth/utils.tslibs/sdk/src/common/decorators/front-mcp.decorator.tsapps/e2e/demo-e2e-openapi/src/main.tsapps/e2e/demo-e2e-remember/src/main.tsapps/e2e/demo-e2e-codecall/src/main.tsapps/e2e/demo-e2e-redis/src/main.tsapps/e2e/demo-e2e-multiapp/src/main.tsapps/e2e/demo-e2e-transparent/src/main.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/*/src/index.ts : Export everything users need through barrel exports (index.ts), do not add backwards compatibility aliases
Applied to files:
libs/sdk/src/common/types/options/http/index.tslibs/sdk/src/common/types/options/logging/index.tslibs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/pagination/index.tslibs/sdk/src/common/types/options/server-info/index.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/index.tslibs/sdk/src/common/types/options/redis/index.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Return strictly typed MCP protocol responses (e.g., `Promise<GetPromptResult>`) instead of `Promise<unknown>` for MCP entry methods
Applied to files:
libs/sdk/src/common/types/options/http/interfaces.tslibs/sdk/src/common/types/options/session/interfaces.tslibs/sdk/src/common/types/options/transport/interfaces.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/{validation,**}/**/*.{ts,tsx} : Use `.strict()` on all Zod schemas for validation
Applied to files:
libs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/common/types/options/pagination/schema.tslibs/sdk/src/common/types/options/auth/schema.tslibs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Prefer `interface` for defining object shapes in TypeScript, avoid `any` types
Applied to files:
libs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/redis/interfaces.tslibs/sdk/src/common/types/options/server-info/interfaces.tslibs/sdk/src/common/types/options/session/interfaces.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Use type parameters with constraints instead of unconstrained generics with `any` defaults
Applied to files:
libs/sdk/src/common/types/options/session/schema.tslibs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Validate inputs and outputs through parseOutput/safeParseOutput methods in validation flows
Applied to files:
libs/sdk/src/common/types/options/logging/schema.tslibs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/index.{ts,js} : Export all public APIs through appropriate entry points (frontmcp/uipack, frontmcp/uipack/adapters, frontmcp/uipack/theme, etc.)
Applied to files:
libs/sdk/src/common/types/options/transport/index.tslibs/sdk/src/common/types/options/pagination/index.tsapps/e2e/demo-e2e-multiapp/src/main.tslibs/sdk/src/common/types/options/auth/index.tslibs/sdk/src/common/types/options/index.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/{src}/**/*.{ts,tsx} : Always validate component options before use
Applied to files:
libs/sdk/src/common/types/options/auth/utils.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*plugin.ts : Use module augmentation for context properties via `declare module 'frontmcp/sdk'` combined with runtime plugin metadata `contextExtensions`, not module-level side effects
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/common/metadata/front-mcp.metadata.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Validate URIs per RFC 3986 at metadata level using `isValidMcpUri` refinement
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/common/metadata/__tests__/front-mcp.metadata.test.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to **/*.{ts,tsx} : Use `frontmcp/utils` for file system operations instead of `fs/promises` or `node:fs` directly
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*.ts : Always use `frontmcp/utils` for cryptographic operations (hkdfSha256, encryptAesGcm, decryptAesGcm, randomBytes, sha256, sha256Hex, base64urlEncode, base64urlDecode) instead of `node:crypto`
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*.ts : Avoid using `node:crypto` directly; always use `frontmcp/utils` for cross-platform cryptographic support
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.ts
📚 Learning: 2025-12-24T00:41:41.819Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/ui/CLAUDE.md:0-0
Timestamp: 2025-12-24T00:41:41.819Z
Learning: Applies to libs/ui/src/**/*.{ts,tsx} : Never import React-free utilities from frontmcp/ui; use frontmcp/uipack for bundling, build tools, platform adapters, and theme utilities
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/{sdk,adapters}/**/*.{ts,tsx} : Use specific error classes with MCP error codes instead of generic errors
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.ts
📚 Learning: 2025-12-24T00:41:41.819Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/ui/CLAUDE.md:0-0
Timestamp: 2025-12-24T00:41:41.819Z
Learning: Applies to libs/ui/src/react/hooks/**/*.{ts,tsx} : MCP bridge hooks (useMcpBridge, useCallTool, useToolInput, useToolOutput, useTheme) must be properly typed and handle loading/error states
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.tslibs/sdk/src/tool/flows/tools-list.flow.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/{build,bundler}/**/*.{ts,tsx,js,jsx} : For server-side MDX rendering with bundled React, use frontmcp/ui/renderers instead of frontmcp/uipack/renderers
Applied to files:
libs/sdk/src/common/decorators/front-mcp.decorator.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to **/*.{ts,tsx} : Use strict TypeScript mode with no `any` types without strong justification
Applied to files:
libs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Use `unknown` instead of `any` for generic type parameter defaults (not for MCP protocol types)
Applied to files:
libs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-04T14:35:18.366Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/uipack/CLAUDE.md:0-0
Timestamp: 2026-01-04T14:35:18.366Z
Learning: Applies to libs/uipack/**/{src}/**/*.{ts,tsx} : Do not use `any` type without justification in TypeScript code
Applied to files:
libs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-06T17:16:04.304Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-06T17:16:04.304Z
Learning: Applies to libs/sdk/**/*.{ts,tsx} : Fail fast on invalid hook flows by validating hooks match their entry type
Applied to files:
libs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*.ts : Avoid using `any` type without justification in TypeScript files
Applied to files:
libs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2025-12-24T00:41:41.819Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/ui/CLAUDE.md:0-0
Timestamp: 2025-12-24T00:41:41.819Z
Learning: Applies to libs/ui/src/**/*.{ts,tsx} : Avoid using any type without justification; all props, return types, and generics must be properly typed
Applied to files:
libs/sdk/src/common/types/options/transport/typecheck.ts
📚 Learning: 2026-01-06T02:34:55.689Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/plugins/CLAUDE.md:0-0
Timestamp: 2026-01-06T02:34:55.689Z
Learning: Applies to libs/plugins/**/*plugin.ts : Extend ExecutionContextBase with plugin-specific properties using module declaration (`declare module 'frontmcp/sdk'`) combined with `contextExtensions` in plugin metadata
Applied to files:
libs/sdk/src/common/metadata/front-mcp.metadata.ts
📚 Learning: 2025-12-24T00:41:41.819Z
Learnt from: CR
Repo: agentfront/frontmcp PR: 0
File: libs/ui/CLAUDE.md:0-0
Timestamp: 2025-12-24T00:41:41.819Z
Learning: Applies to libs/ui/src/bundler/**/*.{ts,tsx} : The bundler module must re-export utilities from frontmcp/uipack/bundler and provide SSR component bundling functionality
Applied to files:
libs/sdk/src/common/types/options/index.ts
🧬 Code graph analysis (16)
libs/sdk/src/common/types/options/server-info/schema.ts (2)
libs/sdk/src/common/types/options/server-info/index.ts (4)
serverInfoOptionsSchema(5-5)ServerInfoOptionsInterface(4-4)ServerInfoOptions(6-6)ServerInfoOptionsInput(6-6)libs/sdk/src/common/types/options/server-info/interfaces.ts (1)
ServerInfoOptionsInterface(9-34)
libs/sdk/src/scope/scope.instance.ts (1)
libs/sdk/src/provider/provider.registry.ts (1)
ProviderRegistry(49-1077)
libs/sdk/src/common/types/options/http/interfaces.ts (1)
libs/sdk/src/common/types/options/http/index.ts (1)
HttpOptionsInterface(4-4)
libs/sdk/src/auth/session/record/session.base.ts (1)
libs/sdk/src/auth/session/session.transport.ts (1)
TransportIdGenerator(4-16)
libs/sdk/src/common/types/options/redis/interfaces.ts (2)
libs/sdk/src/common/types/options/redis/index.ts (7)
StorageProvider(5-5)StorageProvider(25-25)CommonStorageOptionsInterface(6-6)RedisConnectionInterface(7-7)RedisProviderOptionsInterface(8-8)VercelKvProviderOptionsInterface(9-9)RedisOptionsInterface(10-10)libs/sdk/src/common/types/options/redis/schema.ts (1)
StorageProvider(14-14)
libs/sdk/src/common/decorators/front-mcp.decorator.ts (1)
libs/sdk/src/common/metadata/front-mcp.metadata.ts (1)
frontMcpMetadataSchema(214-216)
libs/sdk/src/common/types/options/server-info/interfaces.ts (1)
libs/sdk/src/common/types/options/server-info/index.ts (1)
ServerInfoOptionsInterface(4-4)
libs/sdk/src/common/types/options/http/schema.ts (1)
libs/sdk/src/common/types/options/http/index.ts (4)
httpOptionsSchema(5-5)HttpOptions(6-6)HttpOptions(9-9)HttpOptionsInput(6-6)
libs/sdk/src/common/types/options/pagination/schema.ts (1)
libs/sdk/src/common/types/options/pagination/interfaces.ts (1)
ToolPaginationOptionsInterface(15-37)
libs/sdk/src/provider/provider.registry.ts (3)
libs/sdk/src/common/types/options/transport/index.ts (2)
DistributedEnabled(22-22)shouldCacheProviders(39-39)libs/sdk/src/common/types/options/transport/interfaces.ts (1)
DistributedEnabled(199-199)libs/sdk/src/common/types/options/transport/schema.ts (2)
DistributedEnabled(32-32)shouldCacheProviders(331-339)
libs/sdk/src/common/types/options/pagination/interfaces.ts (1)
libs/sdk/src/common/types/options/pagination/index.ts (2)
ToolPaginationOptionsInterface(4-4)PaginationOptionsInterface(4-4)
libs/sdk/src/common/utils/decide-request-intent.utils.ts (2)
libs/sdk/src/common/types/options/transport/index.ts (1)
LegacyProtocolFlags(51-51)libs/sdk/src/common/types/options/transport/schema.ts (1)
LegacyProtocolFlags(146-153)
libs/sdk/src/common/types/options/transport/typecheck.ts (5)
libs/sdk/src/common/types/options/session/index.ts (4)
platformMappingEntrySchema(11-11)PlatformMappingEntry(13-13)platformDetectionConfigSchema(11-11)PlatformDetectionConfig(13-13)libs/sdk/src/common/types/options/session/schema.ts (4)
platformMappingEntrySchema(13-16)PlatformMappingEntry(40-40)platformDetectionConfigSchema(21-24)PlatformDetectionConfig(45-45)libs/sdk/src/common/types/options/transport/index.ts (8)
PlatformMappingEntry(19-19)PlatformDetectionConfig(20-20)persistenceConfigSchema(32-32)PersistenceConfig(15-15)ProtocolConfig(12-12)ProtocolPreset(13-13)transportOptionsSchema(30-30)TransportOptionsInterface(9-9)libs/sdk/src/common/types/options/transport/interfaces.ts (6)
PlatformMappingEntry(17-17)PlatformDetectionConfig(17-17)PersistenceConfig(162-175)ProtocolConfig(80-122)ProtocolPreset(62-62)TransportOptionsInterface(256-344)libs/sdk/src/common/types/options/transport/schema.ts (6)
persistenceConfigSchema(207-210)PersistenceConfig(28-28)ProtocolConfig(29-29)ProtocolPreset(30-30)transportOptionsSchema(221-255)TransportOptionsInterface(27-27)
libs/sdk/src/common/types/options/logging/interfaces.ts (2)
libs/sdk/src/common/types/options/logging/index.ts (3)
LogLevel(4-4)LogLevelName(4-4)LoggingOptionsInterface(5-5)libs/sdk/src/common/interfaces/logger.interface.ts (1)
LogTransportType(19-19)
libs/sdk/src/common/types/options/__tests__/transport.options.test.ts (2)
libs/sdk/src/common/types/options/transport/index.ts (5)
persistenceConfigSchema(32-32)transportOptionsSchema(30-30)expandProtocolConfig(36-36)PROTOCOL_PRESETS(34-34)toLegacyProtocolFlags(37-37)libs/sdk/src/common/types/options/transport/schema.ts (5)
persistenceConfigSchema(207-210)transportOptionsSchema(221-255)expandProtocolConfig(116-136)PROTOCOL_PRESETS(44-96)toLegacyProtocolFlags(160-170)
libs/sdk/src/transport/transport.registry.ts (1)
libs/sdk/src/common/types/options/transport/schema.ts (1)
TransportPersistenceConfigInput(281-281)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Lint & Format Checks
- GitHub Check: Build Libraries
- GitHub Check: Package E2E (Verdaccio)
- GitHub Check: Analyze (javascript-typescript)
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
…prove session persistence handling
…and best practices
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@SECURITY.md`:
- Line 9: Replace the bare email address "david@frontegg.com" in SECURITY.md
with a mailto link so it renders as a clickable email link (e.g., use the email
text as the link text and a mailto: URL as the target); update the line
"Instead, please report them via email to: **david@frontegg.com**" to use the
mailto link while preserving emphasis/bold formatting.
- Around line 29-42: Update the SECURITY.md entry to use the actual published
package name "frontmcp" instead of "@frontmcp/cli", and add an "engines": {
"node": ">=22.0.0" } field to the package.json of every individual package that
currently lacks it (all workspace packages except the root and
`@frontmcp/testing`); ensure you update the package.json files for `@frontmcp/sdk`,
`@frontmcp/auth`, `@frontmcp/utils`, `@frontmcp/adapters`, `@frontmcp/plugins`,
`@frontmcp/di`, `@frontmcp/ui`, `@frontmcp/uipack` and any other workspace packages
missing the constraint so installing individual packages enforces Node.js 22+.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
SECURITY.md
🧰 Additional context used
🪛 markdownlint-cli2 (0.18.1)
SECURITY.md
9-9: Bare URL used
(MD034, no-bare-urls)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Build Libraries
- GitHub Check: Lint & Format Checks
- GitHub Check: Package E2E (Verdaccio)
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (2)
SECURITY.md (2)
50-68: Verify security feature claims.The specific claims about cryptography implementations, test coverage requirements, and code quality standards should be verified against the actual codebase configuration and dependencies.
#!/bin/bash # Description: Verify security claims against actual implementation echo "=== Checking crypto dependencies ===" fd -t f "package.json" -x jq -r 'select(.dependencies != null or .devDependencies != null) | {name: .name, jose: (.dependencies.jose // .devDependencies.jose // "not found"), noble: ((.dependencies // {}) + (.devDependencies // {}) | to_entries | map(select(.key | contains("noble"))) | from_entries)}' echo "" echo "=== Checking test coverage configuration ===" fd -t f -g "*jest.config.*" -g "*vitest.config.*" -x cat {} \; | grep -A 5 -i "coverage" echo "" echo "=== Checking TypeScript strict mode ===" fd -t f "tsconfig.json" -x jq -r 'select(.compilerOptions.strict != null) | "File: \(input_filename) | strict: \(.compilerOptions.strict)"'
74-78: The external packages list is accurate. All five packages (ast-guard, vectoriadb, enclave-vm, json-schema-to-zod-v3, mcp-from-openapi) have been moved to separate repositories and only exist as external dependencies in the monorepo. No source code directories for these packages are present, and no other moved packages are missing from the list.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
Summary by CodeRabbit
New Features
Documentation
Refactor
Bug Fixes
Tests
Chores
✏️ Tip: You can customize this high-level summary in your review settings.