Wave 1 rollup: integrated 1579-wave-1 branch + integration verification #1600

Activity

1. cliffhall

   self-assigned this

   on Jul 2, 2026
2. cliffhall

   added

   v2Issues and PRs for v2Issues and PRs for v2

   on Jul 2, 2026
3. cliffhall commented on Jul 2, 2026

   

   cliffhall

   on Jul 2, 2026

   MemberAuthor

   More actions

   Integration verification — 1579-wave-1

   Final finalization of the Wave-1 rollup: the last two PRs are merged into 1579-wave-1, the integrated branch was re-validated, and every individual Wave-1 issue's smoke test was replayed against the merged checkout. v2/main was not touched.

   Merge confirmation

   Both remaining PRs merged cleanly (--no-ff, disjoint file sets, zero conflicts, no conflict markers):

   • feat(core): redact sensitive fields in fetch-log bodies + URL query strings #1598 — redact sensitive request/response bodies + URL query in the fetch log (issue core: redact sensitive fields in fetch-log request/response bodies + URL query strings #1593) — merge: #1598 redact bodies+URL query (#1593)
   • test(web): gate src/lib/** under the vitest coverage include globs #1599 — gate src/lib/** under the coverage include globs (issue test-infra: gate clients/web/src/lib/** under the vitest coverage include globs #1594) — merge: #1599 gate src/lib coverage (#1594)

   Pushed to origin/1579-wave-1. origin/v2/main verified unchanged at 066676a2 before and after.

   $ git log --oneline -5
   e19d1107 merge: #1599 gate src/lib coverage (#1594)
   4b180d91 merge: #1598 redact bodies+URL query (#1593)
   775b98a0 docs(core): clarify redaction scope + add nested request-body test
   1fd1313c test(web): gate src/lib/** under the coverage include globs (closes #1594)
   524bf2d5 feat(core): redact sensitive body + URL-query fields in fetch log (closes #1593)
   

   git diff origin/v2/main HEAD --stat → 66 files changed, 4370 insertions(+), 451 deletions(-)

   validate / e2e / coverage on the integrated branch

   Check	Command	Result
   validate (all clients)	npm run validate (root)	✅ PASS — CLI 129, TUI 237, launcher 5, web unit all green; format + lint + build clean across every client
   e2e integration	clients/web npm run test:integration	✅ PASS — 39 files / 809 tests passed
   coverage gate (≥90 per-file)	clients/web npm run test:coverage	✅ PASS — exit 0, 236 files / 3386 tests passed, no threshold failures with #1598's fetchTracking.ts changes and #1599's broadened src/lib/** include

   Per-issue smoke-replay

   Every Wave-1 issue's custom smoke script was extracted from its audit comment's <details> block and re-run against this integrated checkout (imports adapted to resolve; test-servers + CLI built where required).

   Issue	Feature	Replay result
   #1556	extractAppInfo() — MCP-App tool/resource _meta merge + URI normalization + throw on non-ui://	✅ PASS (tsx, all 5 cases)
   #1557	stdio test-server mcp_app_demo preset — real MCP client over stdio, _meta on tools/list + resources/read + tools/call	✅ PASS (built stdio server)
   #1558	sandbox-csp — CSP source allow-list, policy build, HTML wrap, attr escaping, breakout rejection	✅ PASS (tsx)
   #1559	hostContext — host-context snapshot (DOM path) + SSR/non-DOM guard	✅ PASS (vitest unit, 2 tests)
   #1560	downloadFile — fileNameFromUri / isHttpUrl pure helpers	✅ PASS (node)
   #1561	redactSensitiveHeaders + fetch-tracker entry path (#1585)	✅ PASS (tsx, all checks)
   #1562	OAuth generateOAuthState / parseOAuthState hardening	✅ PASS (node, 10/10) — real core/auth/utils.ts source confirmed still matching
   #1563	transport.ts — readProxyEnv precedence + withProxyDispatcher lazy singleton injection	✅ PASS (tsx, EnvHttpProxyAgent)
   #1564	CLI exit-code map + JSON error envelopes	✅ PASS (built CLI; exit 0/1/4/3, structured envelopes)
   #1548	RemoteOAuthStorage round-trip + pre-hydration-clear no-clobber guard	✅ PASS (vitest integration, 2 tests)
   #1593	redact bodies + URL query in fetch log (form/JSON/nested/URL/live)	✅ PASS (tsx, all 28 checks)
   #1594	coverage gate enforces src/lib	✅ COVERED by Step-2 test:coverage (broadened include, gate green)
   #1596	test-stability (N× green suite runs)	✅ COVERED by Step-2 green validate + coverage runs
   #1595	docs-only	N/A

   No scripts were skipped. All 11 runnable smoke scripts were extracted and executed green; the three special cases are covered/N-A as noted.

   Verdict

   ✅ PASS — validate, e2e integration, and the ≥90 per-file coverage gate are all green on the integrated 1579-wave-1, and every replayed per-issue smoke test passed. Notably #1561 (headers), #1593 (bodies + URL query), and #1548 (remote OAuth storage) — the changes most likely to interact — all pass together, and the coverage gate holds with both #1598's fetchTracking.ts growth and #1599's broadened src/lib include.

   Replay harness notes

   • Scripts fetched via gh api repos/modelcontextprotocol/inspector/issues/<N>/comments filtering on the Smoke test & AGENTS.md audit comment, then the fenced block inside each <details> was extracted.
   • tsx binary: clients/tui/node_modules/.bin/tsx. Node runtime: v25.9.0 (native TS type-stripping).
   • Import adaptation for resolution:
     • Repo-root-relative bare specifiers (core/..., clients/web/src/lib/...) rewritten to ./-prefixed paths and run from repo root.
     • ../../core/... scripts (core: add AppInfo + extractAppInfo() to core/mcp/apps.ts #1556, core: redact sensitive headers in the fetch log #1561) placed in clients/web/ and run with tsx so ../../ reaches repo core/ and the SDK resolves from clients/web/node_modules.
     • <repo> placeholder in core: honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY in the Node transport #1563 substituted with the absolute repo path.
     • process.argv[2] = repo root for test-servers: mcp_app_demo preset + _meta support on tool/resource definitions #1557 and cli: exit-code map + structured JSON error envelopes #1564.
   • Builds performed first: test-servers/build (stdio server for test-servers: mcp_app_demo preset + _meta support on tool/resource definitions #1557/Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1548/cli: exit-code map + structured JSON error envelopes #1564) and clients/cli/build (for cli: exit-code map + structured JSON error envelopes #1564).
   • vitest-based smokes (web: extract hostContext utilities for the Apps host (AppRenderer/hostContext.ts) #1559 unit, Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1548 integration) placed under their matching source/integration folders and run with npx vitest run --project <unit|integration> <path>; both removed afterward.
   • All temporary smoke files were deleted after the run — the branch working tree is clean.
4. cliffhall

   linked a pull request that will close this issuefeat(test-servers): mcp_app_demo preset + _meta on tool/resource defs #1587on Jul 2, 2026
5. cliffhall

   linked a pull request that will close this issuefeat(core): add AppInfo + extractAppInfo() to core/mcp/apps.ts #1584on Jul 2, 2026
6. cliffhall

   removed a link to a pull requestfeat(test-servers): mcp_app_demo preset + _meta on tool/resource defs #1587on Jul 2, 2026
7. cliffhall

   removed a link to a pull requestfeat(core): add AppInfo + extractAppInfo() to core/mcp/apps.ts #1584on Jul 2, 2026
8. cliffhall

   linked a pull request that will close this issueWave 1 rollup: integrated 1579-wave-1 (#1600) #1601on Jul 2, 2026
9. cliffhall commented on Jul 2, 2026

   

   cliffhall

   on Jul 2, 2026

   MemberAuthor

   More actions

   ➕ Folded into the rollup after the fact: #1550 (PR #1603) — ci: enforce the ≥90% per-file coverage gate in CI. Now merged into 1579-wave-1. Reviewed to clean (@claude LGTM) + smoke-audited (gate proven load-bearing: an injected coverage drop makes npm run coverage exit 1; verified green CI run). This adds the .github/workflows/main.yml coverage step + AGENTS.md flips to the rollup — so when this rollup lands in v2/main, CI will fail any PR that drops a file below 90 on any of the four dimensions. (No runtime code; the #1600 integration verification is unaffected.)
10. cliffhall commented on Jul 2, 2026

    

    cliffhall

    on Jul 2, 2026

    MemberAuthor

    More actions

    ✂️ Update — CONTRIBUTORS docs pulled out of this rollup. #1517/#1537 (and its follow-up #1595) are unrelated to the #1510 Wave-1 decomposition, so they were removed from 1579-wave-1 and now land on their own standalone PR #1604 → v2/main (clean history). The rollup diff is now 64 files, +4263/−465 (down from 66; only CONTRIBUTORS.md + .github/pull_request_template.md left, and the AGENTS.md ## Contributing section removed — coverage-gate edits retained). Integration verification is unaffected (docs-only removal). New rollup tip 859911d5.
11. cliffhall

    added a commit that references this issue on Jul 9, 2026

    Merge pull request #1601 from modelcontextprotocol/1579-wave-1

    ...

    822ac25
12. cliffhall commented on Jul 9, 2026

    

    cliffhall

    on Jul 9, 2026

    MemberAuthor

    More actions

    Closed via merge of #1601 into v2/main (auto-close doesn't fire on non-default base).
13. cliffhall

    closed this as completedon Jul 9, 2026
14. cliffhall

    added this to the v2.0.0 milestone on Jul 28, 2026