Updates session-management-api.test.ts to align with the relaxed
session ID validation policy introduced for MCP proxy compatibility.
Changes:
- Remove short session IDs from invalid test cases (they're now valid)
- Add new test "should accept short session IDs (relaxed for MCP proxy compatibility)"
- Keep testing truly invalid IDs: empty strings, too long (101+), invalid chars
- Add more comprehensive invalid character tests (spaces, special chars)
Valid short session IDs now accepted:
- 'short' (5 chars)
- 'a' (1 char)
- 'only-nineteen-chars' (19 chars)
- '12345' (5 digits)
Invalid session IDs still rejected:
- Empty strings
- Over 100 characters
- Contains invalid characters (spaces, special chars, quotes, slashes)
This maintains security (character whitelist, max length) while
improving MCP proxy compatibility.
Resolves the last failing CI test in PR #312🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Phase 1 - Lazy Session Restoration (REQ-1, REQ-2, REQ-8):
- Add onSessionNotFound hook for restoring sessions from external storage
- Implement idempotent session creation to prevent race conditions
- Add session ID validation for security (prevent injection attacks)
- Comprehensive error handling (400/408/500 status codes)
- 13 integration tests covering all scenarios
Phase 2 - Session Management API (REQ-5):
- getActiveSessions(): Get all active session IDs
- getSessionState(sessionId): Get session state for persistence
- getAllSessionStates(): Bulk session state retrieval
- restoreSession(sessionId, context): Manual session restoration
- deleteSession(sessionId): Manual session termination
- 21 unit tests covering all API methods
Benefits:
- Sessions survive container restarts
- Horizontal scaling support (no session stickiness needed)
- Zero-downtime deployments
- 100% backwards compatible
Implementation Details:
- Backend methods in http-server-single-session.ts
- Public API methods in mcp-engine.ts
- SessionState type exported from index.ts
- Synchronous session creation and deletion for reliable testing
- Version updated from 2.18.10 to 2.19.0
Tests: 34 passing (13 integration + 21 unit)
Coverage: Full API coverage with edge cases
Security: Session ID validation prevents SQL/NoSQL injection and path traversal
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
