🧪 Jules Engineering Updates: Security, Performance & Code Quality Improvements

[TheRealAshik]

Recent Engineering Improvements

🔒 Security Fixes

Sensitive Data Exposure in Error Logs - Fixed a vulnerability where URLs containing API keys/tokens in query parameters were exposed in error messages. Added sanitizeUrl utility to remove query strings and fragments from URLs in all error classes.

🧹 Code Health & Maintenance

Removed Test-Only Methods from Production Code - Cleaned up JulesMCPServer class by removing test helper methods (handleSessionState, handleGetBashOutputs, etc.) that were polluting production code, improving maintainability.

⚡ Performance Optimization

Async Configuration I/O - Replaced synchronous fs methods with asynchronous fs.promises operations for configuration loading/saving, preventing event loop blocking and improving overall system responsiveness.

✅ Testing Improvements

Schema Introspection Unit Tests - Added comprehensive tests for JQL schema definition and documentation generation logic, covering schema retrieval, TypeScript interface generation, and Markdown documentation integrity.

---

Key Themes: Security hardening, codebase cleanup, performance optimization, and test coverage expansion. All changes maintain backward compatibility while improving reliability and maintainability.

[davideast]

Hey @TheRealAshik! Thank you so much for your PR. There are a lot of really good pieces here. If we can address some of the issues below we can get it into a mergeable state.

Breaking

JulesAuthenticationError / JulesRateLimitError — this.message after super()

The subclasses call super(url, status, statusText) and then overwrite this.message:

super(url, status, statusText);
this.message = `[${status} ${statusText}] Authentication to ${this.url} failed...`;

This means .stack will contain the old message (from super()), while .message has the new one — confusing for debugging. Fix: pass the full formatted message to super() instead of overwriting post-construction.

Not breaking but needs to be addressed

sanitizeUrl strips ALL query params

Strips everything — including non-sensitive params like ?pageToken= or ?sessionId=, making debugging harder. Consider redacting only known-sensitive params (key, token, apiKey, access_token) and keeping the rest.

Missing license header in security_url.test.ts

The new schema.test.ts has the Apache 2.0 header correctly — security_url.test.ts is missing it.

saveConfig missing Promise<void> return type

export async function saveConfig(config: Config) // → Promise<void>

Good stuff!

• Removing test helpers from production JulesMCPServer — great cleanup. Test correctly updated to use tools array directly.
• Schema tests — well-structured with good integrity checks.
• Async config I/O — correct and properly cascaded through all callers.
• Tests properly updated from mockReturnValue → mockResolvedValue.