Judge r1 (grade D) blockers, each fixed and tested:
1. TRANSPORT: custom POST-only JSON-RPC → MCP 2025-03-10 Streamable HTTP
(spec-canonical; replaced HTTP+SSE). POST answers application/json for
requests; valid notifications -> 202 empty; malformed notifications ->
no reply (204); batching removed in this revision -> arrays rejected
-32600. GET (server->client stream) and DELETE (session termination)
answer 405 + Allow: POST — the spec's explicit allowance for stateless
request/response servers; documented in /info + modal + OpenAPI.
Origin header validated when present (DNS-rebinding MUST); Accept
negotiation (json required, else 406); MCP-Protocol-Version header
checked when sent. Clients needing server-initiated streams use the
stdio bridge (unchanged, shares mcp-core).
2. CREDENTIAL TYPE PRESERVATION: routes/mcp.js now forwards the SAME
scheme the caller authenticated with (req.auth.type from
middleware.js:549-586): apikey -> x-api-key, jwt -> Authorization
Bearer (NOT dk_-coerced-x-api-key as r1 did). mcp-core createToolHandler
accepts explicit headers. Tests assert BOTH shapes downstream
(apikey carries x-api-key & no Authorization; jwt carries Bearer & no
x-api-key; zero downstream calls for session denial).
3. JSON-RPC VALIDATION: validateJsonRpc — jsonrpc:'2.0', non-empty string
method, params object-or-omitted, id string|number|null. Invalid
Request -32600 (empty body, empty array, batch); tools/call without
string params.name -> -32602; unknown method -> -32601; error envelopes
carry id null when unpairable. Transport primitives rejected by the
app-wide strict JSON parser (400; asserted).
4. REPRODUCIBILITY: status/dist/features.js + sw.js regenerated and
committed IN THE PATCH (repo convention: DC-130/131 committed bundle
rebuilds). Verifier greps the built bundle for aiconn- (23),
mcp/connections (1), httpConfig (2) so a clean `git am` checkout serves
the real frontend.
Judge r1 polish, all applied:
- verifier accepts 0_PATCH.diff / PATCH.diff naming (indexed artifact);
- connections list filtered server-side to "AI connection (...)" keys
(new GET /mcp/connections, session-only; modal switched to it);
- URL-encoded tool path params (serviceId, containerId, action,
templateId, category, zone) in mcp-core.
Config shape: POST /mcp/config (session-only; apikey 403) returns the
standard Streamable-HTTP card {url, transport: streamable-http, headers:
{x-api-key}, mcpProtocolVersion} + per-client note (ChatGPT note states
the public-https requirement honestly; no fabricated connector claims).
Tests: 57 green (34 route incl. auth matrix/type-preservation/transport
rules/JSON-RPC errors + 23 core). Composition-root e2e (8) boots the real
createApp with the mount. eslint 0 errors. Full suite: only the
pre-existing pdf-parse billing family red (unchanged since base 470dfaa).
119 lines
3.5 KiB
JavaScript
119 lines
3.5 KiB
JavaScript
const CACHE = 'dashcaddy-shell-37f9769c30';
|
|
const PRECACHE = [
|
|
'/',
|
|
'/index.html',
|
|
'/css/themes.css',
|
|
'/css/dashboard.css',
|
|
'/css/driver.min.css',
|
|
'/css/onboarding.css',
|
|
'/dist/core.js',
|
|
'/dist/features.js',
|
|
'/dist/init.js',
|
|
'/dist/onboarding.js',
|
|
'/assets/fonts.css',
|
|
'/assets/site.webmanifest',
|
|
'/assets/favicon.svg',
|
|
'/assets/dashcaddy-favicon.ico',
|
|
'/assets/icon-192.png',
|
|
'/assets/icon-512.png',
|
|
'/assets/apple-touch-icon.png',
|
|
'/assets/dashcaddy-logo-dark.png',
|
|
'/assets/dashcaddy-logo-light.png',
|
|
'/assets/sami7777-logo.png',
|
|
'/assets/fonts/sami-grotesk/SamiGrotesk-Regular.woff2',
|
|
'/assets/fonts/sami-grotesk/SamiGrotesk-Medium.woff2',
|
|
'/assets/fonts/sami-grotesk/SamiGrotesk-Bold.woff2',
|
|
'/assets/fonts/DSEG7Classic-Bold.woff2',
|
|
'/assets/weather/clear-day.svg',
|
|
'/assets/weather/clear-night.svg',
|
|
'/assets/weather/partly-cloudy-day.svg',
|
|
'/assets/weather/partly-cloudy-night.svg',
|
|
'/assets/weather/cloudy.svg',
|
|
'/assets/weather/fog.svg',
|
|
'/assets/weather/drizzle.svg',
|
|
'/assets/weather/rain.svg',
|
|
'/assets/weather/sleet.svg',
|
|
'/assets/weather/snow.svg',
|
|
'/assets/weather/thunderstorm.svg',
|
|
'/assets/weather/wind.svg'
|
|
];
|
|
|
|
function isNavigationRequest(request) {
|
|
return request.mode === 'navigate';
|
|
}
|
|
|
|
function isStaticAsset(pathname) {
|
|
return pathname.startsWith('/assets/')
|
|
|| pathname.startsWith('/css/')
|
|
|| pathname.startsWith('/dist/');
|
|
}
|
|
|
|
async function networkFirst(request, preloadResponsePromise) {
|
|
const cache = await caches.open(CACHE);
|
|
try {
|
|
const preloadResponse = preloadResponsePromise ? await preloadResponsePromise : null;
|
|
if (preloadResponse) {
|
|
cache.put(request, preloadResponse.clone()).catch(() => {});
|
|
return preloadResponse;
|
|
}
|
|
const response = await fetch(request);
|
|
cache.put(request, response.clone()).catch(() => {});
|
|
return response;
|
|
} catch (_) {
|
|
return caches.match(request) || caches.match('/index.html');
|
|
}
|
|
}
|
|
|
|
async function staleWhileRevalidate(request) {
|
|
const cache = await caches.open(CACHE);
|
|
const cached = await cache.match(request);
|
|
|
|
const networkPromise = fetch(request)
|
|
.then((response) => {
|
|
cache.put(request, response.clone()).catch(() => {});
|
|
return response;
|
|
})
|
|
.catch(() => null);
|
|
|
|
if (cached) return cached;
|
|
return networkPromise.then((response) => response || Response.error());
|
|
}
|
|
|
|
self.addEventListener('install', (event) => {
|
|
self.skipWaiting();
|
|
event.waitUntil(
|
|
caches.open(CACHE).then((cache) =>
|
|
cache.addAll(PRECACHE.map((url) => new Request(url, { cache: 'reload' })))
|
|
)
|
|
);
|
|
});
|
|
|
|
self.addEventListener('activate', (event) => {
|
|
event.waitUntil((async () => {
|
|
const keys = await caches.keys();
|
|
await Promise.all(keys.filter((key) => key !== CACHE).map((key) => caches.delete(key)));
|
|
if ('navigationPreload' in self.registration) {
|
|
await self.registration.navigationPreload.enable();
|
|
}
|
|
await self.clients.claim();
|
|
})());
|
|
});
|
|
|
|
self.addEventListener('fetch', (event) => {
|
|
const { request } = event;
|
|
if (request.method !== 'GET') return;
|
|
|
|
const url = new URL(request.url);
|
|
if (url.origin !== self.location.origin) return;
|
|
if (url.pathname.startsWith('/api/v1/') || url.pathname.startsWith('/probe/')) return;
|
|
|
|
if (isNavigationRequest(request) || url.pathname === '/' || url.pathname.endsWith('/index.html')) {
|
|
event.respondWith(networkFirst(request, event.preloadResponse));
|
|
return;
|
|
}
|
|
|
|
if (isStaticAsset(url.pathname)) {
|
|
event.respondWith(staleWhileRevalidate(request));
|
|
}
|
|
});
|