test: behavioral regression test that MCP tool calls enforce the permission check

Open
#997 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
typescript
Domain
security, testing

Research direction

Start with session/prompt.ts and the existing v140-merge-adversarial.test.ts coverage. Trace an MCP tool call end to end, then add a behavioral test that observes whether PermissionNext.ask is invoked and the call is gated. Done means the test fails if the permission check is silently skipped and passes when it is enforced.

Written by the indexing model from the issue text.

Description

Found during v0.9.1 release review (CTO + Tech-Lead). The security fix e7ec6a9b29 (MCP tools ran with NO permission check — an Effect awaited but never run) has only grep-for-string coverage (v140-merge-adversarial.test.ts), which would pass even with the bug present. Add a test that drives an MCP tool call end-to-end through session/prompt.ts and asserts PermissionNext.ask is actually invoked / the call is gated. Prevents silent reintroduction on refactor.

Dominant language
TypeScript
Stars
813
Forks
134
Avg merge
2d 5h
Merged PRs (30d)
62

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from AltimateAI/altimate-code

All issues in AltimateAI/altimate-code

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.