Skip to content

feat: aggregate multi-upstream resources and prompts - #48

Merged
mohanagy merged 4 commits into
developmentfrom
feat/issue-9-resource-prompt-aggregation
Jul 11, 2026
Merged

feat: aggregate multi-upstream resources and prompts#48
mohanagy merged 4 commits into
developmentfrom
feat/issue-9-resource-prompt-aggregation

Conversation

@mohanagy

@mohanagy mohanagy commented Jul 11, 2026

Copy link
Copy Markdown
Owner

Summary

  • Aggregate multi-upstream resources and prompts with exact per-profile Miftah routes, namespaced identifiers, opaque bounded cursors, and list-change notifications.
  • Preserve raw identifiers and native cursors for standard and sole named upstreams.
  • Fail closed on collisions, invalidated discovery, and unavailable aggregate discovery; profile switches/restarts invalidate routes and cursors.
  • Redact URI userinfo, fragments, and query values across resource/prompt metadata; route prompt links and read-result subresources safely.

Validation

  • npm test (169 passing)
  • npm run typecheck
  • npm run lint
  • npm run build
  • node dist/cli/main.js schema
  • npm run check:pack
  • git diff --check

Closes #9

Summary by CodeRabbit

  • New Features
    • Added multi-upstream aggregation for resources and prompts using namespaced identifiers, with fail-closed discovery and per-profile opaque bounded pagination cursors.
    • Introduced resource/prompt registry-backed routing and emitted resource/prompt list-changed notifications after profile changes/restarts.
    • Added URI sanitization via redactUri for safer aggregated discovery and returned content metadata.
  • Bug Fixes
    • Improved collision, not-found, cursor invalidation, and discovery invalidation handling with expanded stable error codes.
  • Documentation
    • Updated README plus architecture/config docs to reflect namespacing, refresh requirements, redaction rules, and fail-closed behavior.
  • Tests
    • Expanded multi-upstream and registry test coverage, including redaction, notifications, pagination, and invalidation scenarios.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@coderabbitai

coderabbitai Bot commented Jul 11, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 97f4e6f0-c1df-4c08-9be6-36a2ed040f80

📥 Commits

Reviewing files that changed from the base of the PR and between 10855fe and 5edfad7.

📒 Files selected for processing (1)
  • tests/package-contract.test.ts

📝 Walkthrough

Walkthrough

The PR adds multi-upstream aggregation for MCP resources and prompts, including namespacing, routing, redaction, opaque cursors, invalidation, notifications, compatibility behavior, and expanded integration coverage.

Changes

Multi-upstream resource and prompt aggregation

Layer / File(s) Summary
Contracts and URI redaction
src/secrets/redact.ts, src/upstream/upstream-session.ts, src/utils/errors.ts, tests/secrets.test.ts
Adds URI sanitization, parameterized upstream listing calls, stable aggregation error codes, and redaction tests.
Registry aggregation and cursor state
src/mcp/server/resource-prompt-registry.ts, tests/resource-prompt-registry.test.ts
Aggregates and namespaces discoveries, tracks routes and epochs, manages bounded cursors, detects collisions, and rewrites linked results.
Server routing and profile invalidation
src/mcp/server/miftah-server.ts
Wires aggregated handlers, preserves single-upstream proxying, invalidates profile state, and emits resource/prompt change notifications.
Fixture, integration coverage, and documentation
tests/fixtures/fake-upstream.mjs, tests/multi-upstream.test.ts, tests/mcp-wrapper.test.ts, tests/helpers/notifications.ts, README.md, docs/*.md, tests/package-contract.test.ts
Covers aggregation, pagination, collisions, routing, redaction, restarts, notifications, documented capability behavior, and bounded package-test execution.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPClient
  participant MiftahServer
  participant ResourcePromptRegistry
  participant UpstreamSession
  MCPClient->>MiftahServer: list/read resource or list/get prompt
  MiftahServer->>ResourcePromptRegistry: aggregate or resolve route
  ResourcePromptRegistry->>UpstreamSession: discover or forward remapped request
  UpstreamSession-->>ResourcePromptRegistry: capability or content result
  ResourcePromptRegistry-->>MiftahServer: namespaced and redacted result
  MiftahServer-->>MCPClient: MCP response
Loading

Possibly related PRs

  • mohanagy/miftah#44: Both changes modify multi-upstream resource/prompt routing and capability gating.

Poem

A rabbit hops through namespaced trails,
Redacting secrets from URI sails.
Cursors turn, and profiles renew,
Notifications tell clients what to do.
Resources and prompts now safely unite—
Across upstreams, routed just right.


Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

❌ Failed checks (2 errors)

Check name Status Explanation Resolution
Out of Scope Changes check ❌ Error tests/package-contract.test.ts adds timeout/error-handling changes unrelated to multi-upstream resource and prompt aggregation. Move the package-contract timeout tweaks to a separate PR unless they are required for this feature, and keep this PR focused on multi-upstream resources and prompts.
Docstring Coverage ❌ Error Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: aggregating multi-upstream resources and prompts.
Linked Issues check ✅ Passed The changes satisfy #9 with aggregated discovery, reversible namespacing, exact upstream routing, collision handling, and integration tests.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/issue-9-resource-prompt-aggregation

Comment @coderabbitai help to get the list of available commands.

@mohanagy

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 11, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/mcp/server/resource-prompt-registry.ts`:
- Around line 70-76: Update the fan-out logic in the resource and prompt listing
methods, including the Promise.all calls invoking discoverResources() and
discoverPrompts(), to handle each upstream result independently (for example,
with settled results or per-source try/catch). Preserve successful results,
record or otherwise handle individual upstream errors, and allow
listResources()/listPrompts() to return partial results instead of rejecting
when one upstream fails.

In `@src/secrets/redact.ts`:
- Around line 76-89: redactUri() collapses all URL-parse failures to
"[REDACTED]", causing distinct malformed or relative URIs to collide. Replace
the catch fallback with a stable redaction derived from the original uri,
preserving uniqueness without exposing secrets, while retaining the existing
handling for valid urn: and data: URIs.

In `@tests/multi-upstream.test.ts`:
- Around line 374-375: Hoist the inline /RESOURCE_CURSOR_INVALID/ and
/PROMPT_CURSOR_INVALID/ regexes, plus the corresponding regex literals at the
additional call sites, into module-scope constants alongside
resourceCollisionPattern and promptCollisionPattern; update all affected
expect(...).rejects.toThrow calls to use those constants.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fb77be41-53a0-4b39-80ad-285ff06fc0f7

📥 Commits

Reviewing files that changed from the base of the PR and between a713ce9 and ce364e4.

📒 Files selected for processing (14)
  • README.md
  • docs/architecture.md
  • docs/config.md
  • src/mcp/server/miftah-server.ts
  • src/mcp/server/resource-prompt-registry.ts
  • src/secrets/redact.ts
  • src/upstream/upstream-session.ts
  • src/utils/errors.ts
  • tests/fixtures/fake-upstream.mjs
  • tests/helpers/notifications.ts
  • tests/mcp-wrapper.test.ts
  • tests/multi-upstream.test.ts
  • tests/resource-prompt-registry.test.ts
  • tests/secrets.test.ts

Comment thread src/mcp/server/resource-prompt-registry.ts
Comment thread src/secrets/redact.ts
Comment thread tests/multi-upstream.test.ts Outdated
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@mohanagy

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 11, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/package-contract.test.ts`:
- Around line 53-60: Update the runNpm helper used by package-contract tests to
pass a timeout and kill signal to spawnSync for every npm command, and handle
the returned build.error before checking status. Ensure beforeAll’s build
failure path reports execution errors clearly while preserving existing
stdout/stderr diagnostics.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 206f9c27-3086-4c48-9fde-1b438ed94346

📥 Commits

Reviewing files that changed from the base of the PR and between ce364e4 and 8554ac4.

📒 Files selected for processing (4)
  • src/secrets/redact.ts
  • tests/multi-upstream.test.ts
  • tests/package-contract.test.ts
  • tests/secrets.test.ts

Comment thread tests/package-contract.test.ts
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@mohanagy

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 11, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/package-contract.test.ts`:
- Around line 42-48: Replace the synchronous process execution in the
package-check helper with asynchronous handling that enforces a hard timeout and
cleans up the entire child process tree, including descendants. Update the
helper around spawnSync to use process-group or equivalent tree termination, and
ensure timeout/termination failures resolve or reject promptly without waiting
for inherited children.
- Around line 49-50: The error handling in the spawnSync result incorrectly
labels every result.error as a timeout. In the test command execution logic,
branch on the timeout-specific error code before using the timeout message, and
preserve the original error message for launch failures such as ENOENT or
non-executable npm.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e126bd7d-b483-455e-9fd4-9af750c0fcfd

📥 Commits

Reviewing files that changed from the base of the PR and between 8554ac4 and 10855fe.

📒 Files selected for processing (1)
  • tests/package-contract.test.ts

Comment thread tests/package-contract.test.ts
Comment thread tests/package-contract.test.ts Outdated
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@mohanagy

Copy link
Copy Markdown
Owner Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 11, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@mohanagy
mohanagy merged commit f4ffa73 into development Jul 11, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant