fix(codegen): sanitize progressive JSDoc metadata#100
Merged
bug-ops merged 2 commits intoJun 7, 2026
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## master #100 +/- ##
==========================================
+ Coverage 89.83% 89.93% +0.10%
==========================================
Files 33 33
Lines 7830 7891 +61
==========================================
+ Hits 7034 7097 +63
+ Misses 796 794 -2
Flags with carried forward coverage won't be shown. Click here to find out more.
... and 1 file with indirect coverage changes 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the progressive TypeScript code generator against JSDoc comment injection by sanitizing server-controlled schema descriptions and categorization metadata before they’re interpolated into generated /** ... */ blocks.
Changes:
- Sanitize
input_schemadescription fields (via recursive traversal) before rendering JSDoc in progressive tool templates. - Sanitize tool categorization metadata (
category,keywords,short_description) in both per-tool and index contexts. - Add a regression test to ensure raw
*/and newline injection content does not appear in generated output.
bug-ops
force-pushed
the
fix/progressive-jsdoc-sanitization
branch
from
June 4, 2026 19:14
11f9c14 to
e49ce37
Compare
github-actions
Bot
added
area: codegen
bug-ops
force-pushed
the
fix/progressive-jsdoc-sanitization
branch
from
June 4, 2026 19:19
e49ce37 to
2e51e28
Compare
Owner
|
Thank you! |
bug-ops
added a commit
that referenced
this pull request
Jun 7, 2026
* release: prepare v0.7.1 Bump workspace version from 0.7.0 to 0.7.1 and finalize CHANGELOG.md release section with all fixes accumulated since v0.7.0. * docs(changelog): add missing entries for 0.7.1 from git history Add #100 (codegen: extended JSDoc sanitization to input_schema and categorization fields), #98 (cli: corrected binary name in help text), and all dependabot dependency bumps (#95–#101) to the [0.7.1] section. * docs: update all README files for v0.7.1 - Root README: update test count to 657 - mcp-cli: add --name and --dry-run flags to generate command docs - mcp-codegen: add Security section documenting JSDoc sanitization scope - mcp-server: fix config path (~/.config/claude/ -> ~/.claude/)
5 tasks
bug-ops
added a commit
that referenced
this pull request
Jul 9, 2026
#122) create_tool_context() now falls back short_description to the tool's own description when no LLM categorization is available, so the generated header JSDoc always includes @description. Previously this tag was omitted on the plain generate CLI path, causing the skill command to fall back to uninformative "{tool_name} tool" placeholders in SKILL.md. Also documents that ToolContext.input_schema always holds the JSDoc-sanitized schema (already the case since PR #100) and adds a regression test locking in that invariant. Closes #94, closes #102
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
*/and newline injection from schema/category metadataTest Plan
cargo test -p mcp-execution-codegen progressive::generator --quietcargo fmt --checkcargo test -p mcp-execution-codegen --quietcargo clippy -p mcp-execution-codegen --all-targets --all-features -- -D warnings