wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(mcp): reject catalog beacon versions

Browse Source
This commit is contained in:
ogt
2026-07-15 03:20:59 +08:00
parent ad3eaa6484
commit 5baeca55aa
2 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/api/src/services/mcp_version_lifecycle_service.py
View File

@@ -42,7 +42,7 @@ _SOURCE_HOSTS = {
}
_VERSION_PATTERNS = (
re.compile(
rb"""(?ix)["'](?:version|latestVersion|packageVersion)["']\s*[:=]\s*["']v?"""
rb"""(?ix)["'](?:latestVersion|packageVersion|softwareVersion)["']\s*[:=]\s*["']v?"""
rb"""([0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?)["']"""
),
re.compile(

17
apps/api/tests/test_mcp_version_lifecycle_service.py
View File

@@ -90,7 +90,7 @@ async def test_lifecycle_run_persists_baselines_and_fail_closed_terminals() -> N
status="ok",
source_url=url,
http_status=200,
body=b'{"version":"1.2.3","content":"not persisted"}',
body=b'{"packageVersion":"1.2.3","content":"not persisted"}',
)
result = await run_mcp_version_lifecycle_once(
@@ -127,7 +127,7 @@ async def test_lifecycle_run_persists_baselines_and_fail_closed_terminals() -> N
def test_changed_version_stops_before_replay_without_immutable_receipts() -> None:
old_body = b'{"version":"1.2.3"}'
old_body = b'{"packageVersion":"1.2.3"}'
candidate = _catalog()["capabilities"][0]
observation = build_candidate_observation(
candidate,
@@ -135,7 +135,7 @@ def test_changed_version_stops_before_replay_without_immutable_receipts() -> Non
status="ok",
source_url=candidate["catalog_url"],
http_status=200,
body=b'{"version":"1.3.0"}',
body=b'{"packageVersion":"1.3.0"}',
),
previous={
"observed_version": "1.2.3",
@@ -201,13 +201,20 @@ async def test_source_failure_is_durable_partial_degraded_no_write() -> None:
def test_version_parser_rejects_ambiguous_page_versions() -> None:
assert _extract_unambiguous_version(b'{"version":"1.2.3"}') == "1.2.3"
assert _extract_unambiguous_version(b'{"packageVersion":"1.2.3"}') == "1.2.3"
assert (
_extract_unambiguous_version(b'{"version":"1.2.3","latestVersion":"2.0.0"}')
_extract_unambiguous_version(
b'{"packageVersion":"1.2.3","latestVersion":"2.0.0"}'
)
is None
)
def test_version_parser_ignores_cloudflare_beacon_version() -> None:
body = b"data-cf-beacon='{\"version\":\"2024.11.0\",\"token\":\"public\"}'"
assert _extract_unambiguous_version(body) is None
def test_stable_fingerprint_ignores_randomized_recommendation_sections() -> None:
stable_head = b"""
<html><head><title>Context7 MCP</title>