Wave 1 rollup: integrated 1579-wave-1 branch + integration verification

[cliffhall]

Wave 1 rollup — integration branch 1579-wave-1

This issue is the rollup / integration point for Wave 1 of the #1579 decomposition. Rather than merging each Wave-1 PR individually into v2/main, they are integrated onto a single branch 1579-wave-1 (base: v2/main), verified together, and reviewed as a unit. v2/main is NOT touched until the rollup is approved.

What's on 1579-wave-1

Original Wave 1 (10):

• core: add AppInfo + extractAppInfo() to core/mcp/apps.ts #1556 core AppInfo/extractAppInfo (PR feat(core): add AppInfo + extractAppInfo() to core/mcp/apps.ts #1584)
• test-servers: mcp_app_demo preset + _meta support on tool/resource definitions #1557 test-servers mcp_app_demo + _meta (PR feat(test-servers): mcp_app_demo preset + _meta on tool/resource defs #1587)
• web: sandbox CSP builder library (lib/sandbox-csp.ts) #1558 web sandbox CSP builder (PR feat(web): add sandbox CSP builder library (closes #1558) #1588)
• web: extract hostContext utilities for the Apps host (AppRenderer/hostContext.ts) #1559 web hostContext utilities (PR feat(web): extract hostContext utilities for the Apps host #1591)
• web: downloadFile.ts enhancements (downloadBlob, fileNameFromUri, isHttpUrl) #1560 web downloadFile enhancements (PR feat(web): downloadFile.ts enhancements (downloadBlob, fileNameFromUri, isHttpUrl) #1586)
• core: redact sensitive headers in the fetch log #1561 core redact fetch-log headers (PR feat(core): redact sensitive headers in the fetch log #1585)
• auth hardening: generateOAuthState requires WebCrypto; OAuth callback rejects unparseable state #1562 auth generateOAuthState + callback state reject (PR auth hardening: generateOAuthState requires WebCrypto; OAuth callback rejects unparseable state #1589)
• core: honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY in the Node transport #1563 core HTTPS_PROXY/HTTP_PROXY/NO_PROXY (PR feat(core): honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY in the Node transport #1590)
• cli: exit-code map + structured JSON error envelopes #1564 cli exit-code map + JSON error envelopes (PR feat(cli): exit-code map + structured JSON error envelopes #1583)
• Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1548 web RemoteOAuthStorage parity + async hydration (PR Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1592)

Wave 1 follow-ups (surfaced during review/smoke):

• test-stability: eliminate timeout flakiness in the web test suite (zero-flake requirement) #1596 test-stability: eliminate web-suite timeout flakiness (PR test(web): eliminate timeout flakiness in the web test suite #1597)
• core: redact sensitive fields in fetch-log request/response bodies + URL query strings #1593 core: redact fetch-log bodies + URL query strings (PR feat(core): redact sensitive fields in fetch-log bodies + URL query strings #1598)
• test-infra: gate clients/web/src/lib/** under the vitest coverage include globs #1594 test-infra: gate clients/web/src/lib/** under coverage (PR test(web): gate src/lib/** under the vitest coverage include globs #1599)

Verification posted here

Each PR above already went through: exhaustive @claude review to clean + an individual smoke-test/AGENTS.md audit on its own issue. This rollup issue additionally receives the integrated verification run against 1579-wave-1:

1. root validate (all clients) + web test:integration (e2e) on the merged branch;
2. every individual issue's smoke test replayed against 1579-wave-1, proving the features work together.

Refs: tracking #1579.

[cliffhall]

Integration verification — 1579-wave-1

Final finalization of the Wave-1 rollup: the last two PRs are merged into 1579-wave-1, the integrated branch was re-validated, and every individual Wave-1 issue's smoke test was replayed against the merged checkout. v2/main was not touched.

Merge confirmation

Both remaining PRs merged cleanly (--no-ff, disjoint file sets, zero conflicts, no conflict markers):

• feat(core): redact sensitive fields in fetch-log bodies + URL query strings #1598 — redact sensitive request/response bodies + URL query in the fetch log (issue core: redact sensitive fields in fetch-log request/response bodies + URL query strings #1593) — merge: #1598 redact bodies+URL query (#1593)
• test(web): gate src/lib/** under the vitest coverage include globs #1599 — gate src/lib/** under the coverage include globs (issue test-infra: gate clients/web/src/lib/** under the vitest coverage include globs #1594) — merge: #1599 gate src/lib coverage (#1594)

Pushed to origin/1579-wave-1. origin/v2/main verified unchanged at 066676a2 before and after.

$ git log --oneline -5
e19d1107 merge: #1599 gate src/lib coverage (#1594)
4b180d91 merge: #1598 redact bodies+URL query (#1593)
775b98a0 docs(core): clarify redaction scope + add nested request-body test
1fd1313c test(web): gate src/lib/** under the coverage include globs (closes #1594)
524bf2d5 feat(core): redact sensitive body + URL-query fields in fetch log (closes #1593)

git diff origin/v2/main HEAD --stat → 66 files changed, 4370 insertions(+), 451 deletions(-)

validate / e2e / coverage on the integrated branch

Check	Command	Result
validate (all clients)	npm run validate (root)	✅ PASS — CLI 129, TUI 237, launcher 5, web unit all green; format + lint + build clean across every client
e2e integration	clients/web npm run test:integration	✅ PASS — 39 files / 809 tests passed
coverage gate (≥90 per-file)	clients/web npm run test:coverage	✅ PASS — exit 0, 236 files / 3386 tests passed, no threshold failures with #1598's fetchTracking.ts changes and #1599's broadened src/lib/** include

Per-issue smoke-replay

Every Wave-1 issue's custom smoke script was extracted from its audit comment's <details> block and re-run against this integrated checkout (imports adapted to resolve; test-servers + CLI built where required).

Issue	Feature	Replay result
#1556	extractAppInfo() — MCP-App tool/resource _meta merge + URI normalization + throw on non-ui://	✅ PASS (tsx, all 5 cases)
#1557	stdio test-server mcp_app_demo preset — real MCP client over stdio, _meta on tools/list + resources/read + tools/call	✅ PASS (built stdio server)
#1558	sandbox-csp — CSP source allow-list, policy build, HTML wrap, attr escaping, breakout rejection	✅ PASS (tsx)
#1559	hostContext — host-context snapshot (DOM path) + SSR/non-DOM guard	✅ PASS (vitest unit, 2 tests)
#1560	downloadFile — fileNameFromUri / isHttpUrl pure helpers	✅ PASS (node)
#1561	redactSensitiveHeaders + fetch-tracker entry path (#1585)	✅ PASS (tsx, all checks)
#1562	OAuth generateOAuthState / parseOAuthState hardening	✅ PASS (node, 10/10) — real core/auth/utils.ts source confirmed still matching
#1563	transport.ts — readProxyEnv precedence + withProxyDispatcher lazy singleton injection	✅ PASS (tsx, EnvHttpProxyAgent)
#1564	CLI exit-code map + JSON error envelopes	✅ PASS (built CLI; exit 0/1/4/3, structured envelopes)
#1548	RemoteOAuthStorage round-trip + pre-hydration-clear no-clobber guard	✅ PASS (vitest integration, 2 tests)
#1593	redact bodies + URL query in fetch log (form/JSON/nested/URL/live)	✅ PASS (tsx, all 28 checks)
#1594	coverage gate enforces src/lib	✅ COVERED by Step-2 test:coverage (broadened include, gate green)
#1596	test-stability (N× green suite runs)	✅ COVERED by Step-2 green validate + coverage runs
#1595	docs-only	N/A

No scripts were skipped. All 11 runnable smoke scripts were extracted and executed green; the three special cases are covered/N-A as noted.

Verdict

✅ PASS — validate, e2e integration, and the ≥90 per-file coverage gate are all green on the integrated 1579-wave-1, and every replayed per-issue smoke test passed. Notably #1561 (headers), #1593 (bodies + URL query), and #1548 (remote OAuth storage) — the changes most likely to interact — all pass together, and the coverage gate holds with both #1598's fetchTracking.ts growth and #1599's broadened src/lib include.

Replay harness notes

• Scripts fetched via gh api repos/modelcontextprotocol/inspector/issues/<N>/comments filtering on the Smoke test & AGENTS.md audit comment, then the fenced block inside each <details> was extracted.
• tsx binary: clients/tui/node_modules/.bin/tsx. Node runtime: v25.9.0 (native TS type-stripping).
• Import adaptation for resolution:
  • Repo-root-relative bare specifiers (core/..., clients/web/src/lib/...) rewritten to ./-prefixed paths and run from repo root.
  • ../../core/... scripts (core: add AppInfo + extractAppInfo() to core/mcp/apps.ts #1556, core: redact sensitive headers in the fetch log #1561) placed in clients/web/ and run with tsx so ../../ reaches repo core/ and the SDK resolves from clients/web/node_modules.
  • <repo> placeholder in core: honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY in the Node transport #1563 substituted with the absolute repo path.
  • process.argv[2] = repo root for test-servers: mcp_app_demo preset + _meta support on tool/resource definitions #1557 and cli: exit-code map + structured JSON error envelopes #1564.
• Builds performed first: test-servers/build (stdio server for test-servers: mcp_app_demo preset + _meta support on tool/resource definitions #1557/Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1548/cli: exit-code map + structured JSON error envelopes #1564) and clients/cli/build (for cli: exit-code map + structured JSON error envelopes #1564).
• vitest-based smokes (web: extract hostContext utilities for the Apps host (AppRenderer/hostContext.ts) #1559 unit, Web: migrate auth store to shared /store API (RemoteOAuthStorage parity with TUI/CLI) #1548 integration) placed under their matching source/integration folders and run with npx vitest run --project <unit|integration> <path>; both removed afterward.
• All temporary smoke files were deleted after the run — the branch working tree is clean.