mcp: Add unit tests with node:test runner

[AlexNajem]

Summary

• Adds unit tests using Node's built-in node:test runner (no new dev dependencies) covering PexClient and tools/utils.
• PexClient tests cover constructor env validation, auth header, query-param serialization (incl. array join), JSON vs text response handling, error message mapping (401/403/404/429/500), retry behavior on 502/503, and no-retry on 4xx.
• tools/utils tests cover paginateArray (clamping, edge cases), paginateNestedArray, and the toolResponse/toolError helpers.
• Wires npm test into the CI pipeline and enables PR validation against main (was pr: none).
• Makes PexClient retry baseDelay injectable so retry tests pass 0 and the suite stays fast (~145ms total instead of ~3s of real backoff).

---

Generated with Claude Code - claude-opus-4-7

[devin-ai-integration]

Code review

LGTM overall — tests are well-organized, fast (~345ms locally, 28/28 pass), the build & typecheck pass, the PexClient constructor change is backward compatible, and nothing in the diff is out of scope for "add unit tests". Coverage hits the meaningful seams: env validation, base-URL normalization, auth header, query-string serialization (incl. array join), JSON vs text body handling, status → message mapping, retry-on-5xx, no-retry-on-4xx, pagination clamping, and tool response/error helpers.

Notes & suggestions

1. The failing pex-mcp-server (optional) check is preexisting, not caused by this PR.
The failure is npm audit --audit-level=high exiting 1. I ran the same audit against origin/main and the exact same advisories are present there — a high in fast-uri plus moderates in hono, @hono/node-server, and ip-address (transitive via @modelcontextprotocol/sdk). It only surfaces here because this PR is what flips pr: none → pr: { branches: { include: main } }, so this is the first PR run to actually evaluate it.

Recommend addressing in a separate follow-up PR (e.g. npm audit fix or bump @modelcontextprotocol/sdk) rather than rolling into this one.

2. AGENTS.md is now stale. It still says:

There are no tests yet. Do not add a npm test step to scripts without being asked.

Worth updating in this PR so future agents have correct guidance — describe the npm test command, mention the node:test + tsx --test setup, and the src/**/*.test.ts convention.

3. Optional follow-up coverage (non-blocking):

• 504 retry — isRetryableStatus covers 502/503/504 but only 502 and 503 are tested.
• Network-error retry path (isNetworkError) in fetchWithRetry.
• Timeout → PexClientError("Request timed out after 30s", 0) mapping in get().
• paginateArray with page past totalPages (should return empty data, hasMore: false).

4. Tiny nit on stubFetch typing in src/pex-client.test.ts:

function stubFetch(handler: FetchHandler): void {
  globalThis.fetch = ((url: string, init: RequestInit) =>
    handler(url, init)) as typeof fetch;
}

The real fetch is (input: RequestInfo | URL, init?: RequestInit). The as typeof fetch cast is fine in practice because PexClient always calls fetch(string, RequestInit), but widening the handler signature to (input: RequestInfo | URL, init?: RequestInit) would be more honest if anyone later stubs from outside PexClient. Not a blocker.

Security / backward compat / performance:

• No new credentials, endpoints, or runtime deps. Test stubs globalThis.fetch and restores it in afterEach correctly.
• Constructor remains zero-arg compatible (new PexClient() still works); existing src/index.ts callsite unaffected.
• Default retryBaseDelayMs is 500 (unchanged behavior); tests pass 0 for speed.

Devin session: https://app.devin.ai/sessions/743e380c4b1544619fe242606d32a40f

[devin-ai-integration]

Re-review of 445661d

Looks good. The new commit bumps @modelcontextprotocol/sdk from ^1.12.1 to ^1.29.0 and runs npm audit fix, which is what addressed point #1 from my prior review.

Verification:

• npm audit --audit-level=high now reports 0 vulnerabilities locally (was 1 high + 4 moderate).
• npm ci && npm run build && npm test → 28/28 tests pass, typecheck clean.
• CI is green: pex-mcp-server ✅ (job 75447432992).
• SDK 1.12.1 → 1.29.0 is a minor bump within 1.x and the 1.29.0 release notes explicitly state "Breaking Changes: None". All SDK imports in this repo (server/mcp.js, server/stdio.js, types.js) are stable across that range, and the build confirms it.
• No new dependencies; this is purely a version bump on existing deps.

Scope: package.json + package-lock.json only — appropriately tight for an audit-fix commit. No unrelated changes.

Still open from prior review (all non-blocking, your call whether to roll into this PR):

• AGENTS.md update — the "There are no tests yet. Do not add a npm test step to scripts without being asked." note is now incorrect. Most valuable of the three.
• Optional additional test coverage (504 retry, network-error retry, timeout, paginateArray past last page).
• Minor stubFetch typing widen.

LGTM as-is. Ready to come out of draft / merge whenever.

Devin session: https://app.devin.ai/sessions/743e380c4b1544619fe242606d32a40f

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.