Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

CLI tests write the developer's real ~/.mcp-inspector OAuth state file (oauth-runner, programmatic-ergonomics)

Abierto
  • ¿Algo no está bien?
#2,719 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
62/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
nodejs, typescript
Área
testing-qa

Línea de trabajo

Start with clients/cli/__tests__/oauth-runner.test.ts and programmatic-ergonomics.test.ts, then read core/auth/node/storage-node.ts to see how it resolves the state path from homedir() and MCP_INSPECTOR_OAUTH_STATE_PATH. Follow the #2677 approach for the web integration project to add a CLI setup file that points those variables at a per-file temp dir, plus a guard that fails if the path is outside tmpdir. Done when the repro loop in the issue leaves no oauth.json* files under the scratch HOME.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug v2

Problem

Two clients/cli test files write the developer's real ~/.mcp-inspector/storage/oauth.json (and oauth.json.namespaces.json): __tests__/oauth-runner.test.ts and __tests__/programmatic-ergonomics.test.ts. This is the same bug #2670 / PR #2677 fixed for the web integration project, now in the CLI suite, which has no equivalent isolation.

It was found during the v2.11.0 milestone smoke (#2718). The real store's mtime moved to 23:11:58 while coverage:cli was running (23:11:51–23:12:02) inside npm run local:gate.

It predates 2.10.1: both files are unchanged in the relevant respect since that tag. It is test-only and does not ship in the package, so it does not block 2.11.0.

Reproduce

Run each CLI test file with HOME pointed at an empty scratch dir. core/auth/node/storage-node.ts falls back to homedir() when MCP_INSPECTOR_OAUTH_STATE_PATH is unset:

cd clients/cli
for f in oauth-runner programmatic-ergonomics stored-auth e2e; do
  H=$(mktemp -d); HOME=$H npx vitest run __tests__/$f.test.ts >/dev/null 2>&1
  echo "$f: $(find $H -name 'oauth.json*' | sed "s#$H#~#" | tr '\n' ' ')"
done

Observed on the v2.11.0 tree:

  • oauth-runner and programmatic-ergonomics both create ~/.mcp-inspector/storage/oauth.json and oauth.json.namespaces.json.
  • The other ten OAuth-touching CLI test files are clean.

Expected

No CLI test reads or writes the developer's real OAuth state.

The fix is the #2677 shape: a CLI setup file that points MCP_INSPECTOR_OAUTH_STATE_PATH (and whatever else storage-node.ts resolves from home) at a per-file temp dir, plus a guard that fails if the resolved path is outside tmpdir. That also stops concurrent worktree gates racing on one shared file.

Lenguaje dominante
TypeScript
Estrellas
11.1k
Forks
1.5k
Merge medio
4 h 28 min
PR fusionados (30 d)
151

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/inspector

Todos los issues de modelcontextprotocol/inspector

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.