$ tsc -p tsconfig.json --noEmit && tsx --test test/**/*.test.ts && tsc -p tsconfig.json
✔ safe defaults expose no action capability authority (3.325757ms)
✔ parsed configuration is deeply frozen (2.966427ms)
✔ environment overrides file transport settings (13.866304ms)
✔ normalization lowercases browser schemes (0.884393ms)
✔ malformed configuration fails closed (1.623751ms)
✔ structural adapter errors are recognized without instanceof (0.904633ms)
✔ service allow-list rejects before invoking systemctl (6.37313ms)
✔ unknown named applications are rejected (1.528238ms)
✔ application-specific caller arguments can be disabled (0.869189ms)
✔ application launch returns an explicit handle that app.close accepts (6.510782ms)
✔ browser scheme policy rejects before invoking an opener (1.660266ms)
✔ desktop screen and input operations fail closed while disabled (1.80649ms)
✔ input validates coordinates and text before touching xdotool (0.738431ms)
✔ path inside configured root is authorized (11.638148ms)
✔ root itself is authorized (1.611194ms)
✔ parent traversal and sibling-prefix escape are rejected (1.686151ms)
✔ existing symlink cannot escape an allowed root (1.771437ms)
✔ creation beneath a symlinked ancestor cannot escape root (2.159992ms)
✔ one of multiple configured roots may authorize a path (1.785788ms)
responseMode: 'json' drops mid-call notifications. subscriptions/listen streams are always served over SSE regardless; other notifications emitted before a result are dropped.
responseMode: 'json' drops mid-call notifications. subscriptions/listen streams are always served over SSE regardless; other notifications emitted before a result are dropped.
✔ health endpoint is available without MCP bearer token (38.934197ms)
responseMode: 'json' drops mid-call notifications. subscriptions/listen streams are always served over SSE regardless; other notifications emitted before a result are dropped.
✔ MCP endpoint enforces configured bearer token (28.241718ms)
responseMode: 'json' drops mid-call notifications. subscriptions/listen streams are always served over SSE regardless; other notifications emitted before a result are dropped.
✔ localhost origin validation rejects a foreign browser origin (5.672836ms)
responseMode: 'json' drops mid-call notifications. subscriptions/listen streams are always served over SSE regardless; other notifications emitted before a result are dropped.
✔ unknown routes do not fall through to MCP (5.932492ms)
✔ non-loopback bind requires explicit allowed hosts (0.850138ms)
✔ system info returns host-neutral fields (13.819142ms)
✔ filesystem lifecycle stays inside configured root (22.609301ms)
✔ filesystem read and write limits fail closed (3.570171ms)
✔ disabled filesystem capabilities reject adapter calls (1.036563ms)
✔ shell exec returns stdout and non-zero exits as normal results (80.983648ms)
✔ shell timeout terminates the child and reports timedOut (31.77065ms)
✔ shell output limit terminates execution with OUTPUT_LIMIT (35.770358ms)
✔ caller environment is rejected unless explicitly enabled (1.437099ms)
✔ host display denial strips inherited desktop session environment from shell children (41.266892ms)
✔ shell exec blocks obvious host capture bypasses before process spawn (2.017139ms)
✔ process listing includes the current test process (21.489303ms)
✔ process kill terminates a disposable child (3.65498ms)
responseMode: 'json' drops mid-call notifications. subscriptions/listen streams are always served over SSE regardless; other notifications emitted before a result are dropped.
✔ HTTP handler negotiates MCP 2026-07-28 and uses no session identifier (84.177323ms)
✔ allowed executable passes (1.246169ms)
✔ disabled shell rejects before command inspection (0.482284ms)
✔ unlisted executable rejects (0.216222ms)
✔ paths are not accepted as executable names (0.170184ms)
✔ explicit wildcard allows executable names (0.187006ms)
✔ runtime and output values clamp to configured maxima (0.221302ms)
✔ host display denial blocks obvious direct capture executables (0.355071ms)
✔ host display denial blocks obvious wrapped and multipurpose capture invocations (2.615877ms)
✔ host display denial blocks obvious Python and JavaScript capture one-liners (0.517558ms)
✔ host display guard preserves ordinary shell, Python, Node, and ffmpeg work (0.582992ms)
✔ stdio entrypoint serves the same modern MCP tool surface (568.833456ms)
✔ tool discovery omits disabled capabilities (41.313546ms)
✔ tool discovery exposes only granted capability families (7.036939ms)
✔ host display master gate omits all display-dependent tools (23.248716ms)
✔ tool discovery exposes the complete extended capability surface when granted (7.414247ms)
✔ system.info returns structured capability information (5.004125ms)
✔ adapter errors become visible MCP tool errors (2.583284ms)
✔ shell tool delegates argument-array execution unchanged (3.253673ms)
✔ application launch returns an explicit handle and close consumes that handle (3.547362ms)
✔ screen capture returns MCP image content and compact structured metadata (2.793255ms)
✔ input click schema rejects a lone coordinate before adapter invocation (8.315705ms)
ℹ tests 58
ℹ suites 0
ℹ pass 58
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 1165.416882