Files
rea/tests/acceptance/browser/webMcpReceiverCli.test.ts
T
morluto 38f92d108e fix(browser): match exact WebMCP receiver segments
Inspect AST property segments instead of flattened suffixes. Reject dotted-key and suffix collisions while retaining page-declared trust and source evidence through the CLI.

Refs: #4205, #4279

Co-authored-by: Geekwolf <geekwolf@163.com>
2026-10-16 08:14:51 +08:00

81 lines
2.3 KiB
TypeScript

import { expect } from "vitest";
import { startFakeCdpBrowser } from "../../fixtures/fakeCdpBrowser.js";
import { cliTest } from "../../support/cli/cliFixture.js";
cliTest(
"keeps WebMCP receiver segments exact through the public CLI",
async ({ cli }) => {
const source = `
navigator.modelContext.registerTool({ name: "navigator" });
const app = { analyticsmodelContext: { registerTool() {} } };
app.analyticsmodelContext.registerTool({ name: "nested suffix" });
window["modelContext.registerTool"]({ name: "dotted property" });
`;
const browser = await startFakeCdpBrowser({
commandResult: ({ method }) =>
method === "Debugger.getScriptSource"
? { scriptSource: source }
: undefined,
});
try {
const result = await cli.run({
arguments: [
"analyze-web-bundle",
browser.endpoint,
"allowed-page",
"--allowed-origins",
browser.allowedOrigin,
"--observation-ms",
"0",
"--json",
],
});
expect(result.exitCode, result.stdout).toBe(0);
expect(result.json).toMatchObject({
normalized_result: {
observations: {
webmcp_declarations: [
expect.objectContaining({
name: "navigator",
trust: "page-declared-untrusted",
}),
],
},
},
});
const inspected = await cli.run({
arguments: [
"inspect-web-page",
browser.endpoint,
"allowed-page",
"--allowed-origins",
browser.allowedOrigin,
"--observation-ms",
"0",
"--include-script-sources",
"--json",
],
});
expect(inspected.exitCode, inspected.stdout).toBe(0);
expect(inspected.json).toMatchObject({
normalized_result: {
scripts: {
items: expect.arrayContaining([
expect.objectContaining({
source: expect.objectContaining({
artifact: expect.objectContaining({ text: source }),
}),
}),
]),
},
},
});
expect(browser.activeConnectionCount()).toBe(0);
} finally {
await browser.close();
}
},
);