Set expectations for the first-run 401, and drop the docs tests - #3
Merged
Conversation
Clean-room testing showed that an unauthenticated first session reports an HTTP 401 once. The adapter's metadata bootstrap is unconditional and exposes no setting to suppress it, so this is inherent rather than a defect: Pi starts, all 21 skills load, and `settings.autoAuth` stays false so nothing opens a browser. Say so in README.md. A first-run 401 with no explanation reads as a broken install, which is the difference between users authenticating and users uninstalling. Record the same in SPEC.md §5 alongside the bootstrap it follows from. Remove tests/package/docs.test.ts. Asserting on prose with regexes couples the suite to wording rather than behavior, so it breaks on harmless rewrites while proving little. Documentation-claim consistency moves to the manual T-0 review. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to clean-room Pass 1.
First-run 401
An unauthenticated first session reports an HTTP 401 once. The adapter's metadata bootstrap is unconditional and exposes no setting to suppress it, so this is inherent behavior rather than a defect: Pi starts, all 21 skills load, and
settings.autoAuthstays at its defaultfalseso nothing opens a browser unprompted.README.mdnow says so, anddocs/SPEC.md§5 records it alongside the bootstrap it follows from. Without that, a first-run 401 reads as a broken install — which is the difference between a user authenticating and a user uninstalling.Note this is the post-fix message. Before PR #2 the same startup path failed with
does not support dynamic client registration ... this URL does not appear to speak MCP, which was both misleading and unactionable. A 401 pointing at authentication is the intended end state.Removing the docs tests
tests/package/docs.test.tsis deleted. Asserting on prose with regexes couples the suite to wording rather than behavior, so it breaks on harmless rewrites while proving little about the package.Trade-off worth stating explicitly: the release-gate item "README, spec, release notes, and guide use the same URL and behavior claims" no longer has an automated check, so it becomes a manual review at T-0. That gate previously had teeth here, and it is worth remembering that the false OAuth claim reached the README precisely because no test pinned behavior — but a prose regex would not have caught that either, since the claim was internally consistent and simply untrue.
Verification
npm run verifypasses with 63 tests across 9 files, down from 68 across 10 with the docs suite removed.