@besales/mcp 0.48.0 → 1.0.0-beta.2

package/scripts/verify-followup-adapters.mjs

@@ -0,0 +1,235 @@
+import assert from 'node:assert/strict';
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+
+// Проверяем будущую сборку на одноразовой копии. Каталог рабочего дерева выпускает интегратор.
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const copy = mkdtempSync(join(tmpdir(), 'swa1-mcp-'));
+cpSync(root, copy, {
+  recursive: true,
+  filter: (file) => {
+    const first = file.slice(root.length + 1).split('/')[0];
+    return !['node_modules', '.git', 'dist'].includes(first) && !first.startsWith('.codex');
+  },
+});
+symlinkSync(join(root, 'node_modules'), join(copy, 'node_modules'), 'dir');
+const catalogFile = join(copy, 'src/schemas/mcp-tools.json');
+const catalog = JSON.parse(readFileSync(catalogFile, 'utf8'));
+const uuid = { type: 'string', format: 'uuid' };
+const plan = catalog.tools.find((tool) => tool.name === 'besales_followup_funnel_test_plan');
+assert.ok(plan);
+plan.inputSchema.properties.funnel_id = uuid;
+for (const action of ['get', 'update']) {
+  const write = action === 'update';
+  const name = 'besales_dialogue_followup_state_' + action;
+  const tool = {
+    name,
+    description: write
+      ? 'Изменить паузу дожимов выбранного диалога по прочитанной версии. Scope: mcp:platform-setup. Действие и последствия сначала подтверждает человек; после 409/428 перечитать состояние и получить новое решение.'
+      : 'Прочитать состояние дожимов выбранного диалога, версию и последствия. Scope: mcp:*.',
+    inputSchema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        conversation_id: uuid,
+        ...(write
+          ? {
+              action: {
+                type: 'string',
+                enum: ['ENABLE', 'MUTE_FOREVER', 'MUTE_TEMPORARY'],
+              },
+              expected_version: {
+                type: 'string',
+                minLength: 1,
+                maxLength: 1024,
+              },
+              mute_expires_at: {
+                type: 'string',
+                format: 'date-time',
+                maxLength: 64,
+              },
+            }
+          : {}),
+      },
+      required: ['conversation_id', ...(write ? ['action', 'expected_version'] : [])],
+    },
+  };
+  const index = catalog.tools.findIndex((entry) => entry.name === name);
+  if (index < 0) catalog.tools.push(tool);
+  else catalog.tools[index] = tool;
+}
+writeFileSync(catalogFile, JSON.stringify(catalog, null, 2) + '\n');
+const output = join(root, '.codex-artifacts-swa1');
+mkdirSync(output, { recursive: true });
+const controls = 'src/tools/definitions/bridge-controls.spec.ts';
+const funnel = 'src/tools/definitions/follow-up-funnel-test.spec.ts';
+function run(name, suites) {
+  const jsonFile = join(output, name + '.json');
+  rmSync(jsonFile, { force: true });
+  const result = spawnSync(
+    process.execPath,
+    [
+      join(root, 'node_modules/vitest/vitest.mjs'),
+      'run',
+      ...suites,
+      '--maxWorkers=2',
+      '--reporter=json',
+      '--outputFile',
+      jsonFile,
+    ],
+    {
+      cwd: copy,
+      encoding: 'utf8',
+      timeout: 120000,
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  );
+  writeFileSync(join(output, name + '.log'), (result.stdout ?? '') + (result.stderr ?? ''));
+  const json = existsSync(jsonFile) ? JSON.parse(readFileSync(jsonFile, 'utf8')) : null;
+  return { result, json };
+}
+const baseline = run('baseline', [
+  controls,
+  funnel,
+  'src/tools/result.spec.ts',
+  'src/tools/definitions/v2-route-map.spec.ts',
+]);
+assert.equal(baseline.result.status, 0, 'Baseline failed: ' + join(output, 'baseline.log'));
+assert.ok(baseline.json.numPassedTests > 0);
+const mutants = [
+  [
+    'plan-drops-funnel',
+    'src/tools/definitions/follow-up-funnel-test.ts',
+    '{ body: { funnelId: input.funnel_id } }',
+    '{}',
+    funnel,
+    'персональная воронка',
+  ],
+  [
+    'writer-screen-route',
+    'src/tools/definitions/dialogue-followup-state.ts',
+    '/followup-state/bridge`',
+    '/followup-state`',
+    controls,
+    'передаёт прочитанную версию',
+  ],
+  [
+    'writer-drops-version',
+    'src/tools/definitions/dialogue-followup-state.ts',
+    'expectedVersion: input.expected_version,',
+    '',
+    controls,
+    'передаёт прочитанную версию',
+  ],
+  [
+    'writer-drops-expiry',
+    'src/tools/definitions/dialogue-followup-state.ts',
+    'muteExpiresAt: input.mute_expires_at,',
+    '',
+    controls,
+    'MUTE_TEMPORARY передаёт',
+  ],
+  [
+    'writer-version-optional',
+    'src/tools/definitions/dialogue-followup-state.ts',
+    'expected_version: z.string().min(1).max(1024)',
+    'expected_version: z.string().min(1).max(1024).optional()',
+    controls,
+    'отвергает небезопасный ввод',
+  ],
+  [
+    'writer-loses-state',
+    'src/tools/definitions/dialogue-followup-state.ts',
+    "withInstructions(response, [\n        'Покажи outcome",
+    "withInstructions({}, [\n        'Покажи outcome",
+    controls,
+    'сохраняет весь ответ',
+  ],
+  [
+    'conflict-auto-repeat-hint',
+    'src/tools/result.ts',
+    "context.verifyWithToolName === 'besales_dialogue_followup_state_get'",
+    'false',
+    controls,
+    'сохраняет язык отказа',
+  ],
+  [
+    'start-without-confirmation',
+    'src/tools/definitions/follow-up-funnel-test.ts',
+    'explicit_confirmation: z.literal(true)',
+    'explicit_confirmation: z.literal(true).optional()',
+    funnel,
+    'старт требует литерал',
+  ],
+];
+const results = [];
+for (const [name, file, from, to, suite, test] of mutants) {
+  const target = join(copy, file);
+  const original = readFileSync(target, 'utf8');
+  assert.equal(original.split(from).length, 2, name + ': exact seed');
+  try {
+    writeFileSync(
+      target,
+      original.replace(from, () => to),
+    );
+    const { result, json } = run(name, [suite]);
+    const killed =
+      result.status === 1 &&
+      !result.signal &&
+      !result.error &&
+      json?.testResults?.some(
+        (row) =>
+          row.name.endsWith(suite) &&
+          row.assertionResults?.some(
+            (item) =>
+              item.status === 'failed' &&
+              item.fullName.includes(test) &&
+              item.failureMessages?.some((message) =>
+                /(?:AssertionError|expect\(|__VITEST_REJECTS__)/u.test(message),
+              ),
+          ),
+      );
+    results.push({
+      name,
+      killed: Boolean(killed),
+      status: result.status,
+      suite,
+      test,
+    });
+    console.log(`${name}: ${killed ? 'KILLED' : 'NOT PROVEN'}`);
+  } finally {
+    writeFileSync(target, original);
+  }
+}
+writeFileSync(
+  join(output, 'summary.json'),
+  JSON.stringify(
+    {
+      copy,
+      baseline: {
+        passed: baseline.json.numPassedTests,
+        suites: baseline.json.numPassedTestSuites,
+      },
+      mutants: results,
+    },
+    null,
+    2,
+  ) + '\n',
+);
+assert.ok(
+  results.every((result) => result.killed),
+  'Mutants not proven; inspect ' + output,
+);
+console.log('Artifacts: ' + output);

package/scripts/verify-secret-read-import.mjs

@@ -0,0 +1,84 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { spawnSync, execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+const [apiRoot, logFile] = process.argv.slice(2);
+assert(apiRoot && logFile, 'Usage: node scripts/verify-secret-read-import.mjs API_ROOT VREQ_LOG');
+const wire = fs.readFileSync(logFile, 'utf8').match(/PRSM_BRIDGE_CONTRACT=([A-Za-z0-9+/=]+)/u);
+assert(wire);
+const source = JSON.parse(Buffer.from(wire[1], 'base64').toString('utf8'));
+const destination = 'src/tools/__fixtures__/secret-read-contract.json';
+const digest = () => createHash('sha256').update(fs.readFileSync(destination)).digest('hex');
+const original = digest();
+const candidates = execFileSync(
+  'git',
+  ['-C', apiRoot, 'rev-list', '--max-count=20', source.apiRevision],
+  { encoding: 'utf8' },
+)
+  .trim()
+  .split('\n');
+const older = candidates.find((revision) =>
+  execFileSync(
+    'git',
+    ['-C', apiRoot, 'diff', '--name-only', revision, 'HEAD', '--', 'src', 'scripts/migration'],
+    { encoding: 'utf8' },
+  )
+    .trim()
+    .split('\n')
+    .some((path) => path && !path.endsWith('.spec.ts') && !Object.hasOwn(source.sources, path)),
+);
+assert(older, 'Expected a real older ancestor with unverified runtime changes');
+const cases = [
+  [
+    'revision',
+    (contract) => {
+      contract.apiRevision = 'f'.repeat(40);
+    },
+  ],
+  [
+    'unverified-ancestor-runtime',
+    (contract) => {
+      contract.apiRevision = older;
+    },
+  ],
+  [
+    'source-hash',
+    (contract) => {
+      contract.sources['src/shared/security/data-source-metadata.ts'] = '0'.repeat(64);
+    },
+  ],
+  [
+    'unsafe-body',
+    (contract) => {
+      contract.samples[0].response = { password: contract.forbidden[0] };
+    },
+  ],
+  [
+    'source-path',
+    (contract) => {
+      delete contract.sources['test/bridge-secret-read-contract.ts'];
+      contract.sources['../forbidden-source'] = '0'.repeat(64);
+    },
+  ],
+];
+for (const [name, mutate] of cases) {
+  const contract = structuredClone(source);
+  mutate(contract);
+  const temporary = fs.mkdtempSync(join(tmpdir(), 'prSM-invalid-import-'));
+  const log = join(temporary, name + '.log');
+  fs.writeFileSync(
+    log,
+    'PRSM_BRIDGE_CONTRACT=' + Buffer.from(JSON.stringify(contract)).toString('base64') + '\n',
+  );
+  const result = spawnSync(
+    process.execPath,
+    ['scripts/import-secret-read-contract.mjs', apiRoot, log],
+    { encoding: 'utf8' },
+  );
+  assert.notEqual(result.status, 0, name + ' accepted');
+  assert.equal(digest(), original, name + ' changed capture');
+  fs.rmSync(temporary, { recursive: true, force: true });
+  console.log(name + ': REJECTED, capture unchanged');
+}

package/scripts/verify-secret-read-mutants.mjs

@@ -0,0 +1,143 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+
+const directory = ".codex-artifacts-prSM/bridge-mutants";
+fs.mkdirSync(directory, { recursive: true });
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const mutations = [
+  {
+    name: "skip-column-check",
+    file: "src/utils/secret-read-boundary.ts",
+    change: (source) => {
+      const anchor = "isDataSourceColumnNamePosition(path) &&";
+      assert.equal(source.split(anchor).length, 2);
+      return source.replace(
+        anchor,
+        "false && isDataSourceColumnNamePosition(path) &&",
+      );
+    },
+    spec: "src/utils/secret-read-boundary.spec.ts",
+    assertion: /toEqual|deeply equal|Expected/iu,
+  },
+  {
+    name: "skip-normalized-signatures",
+    file: "src/utils/credential-signatures.ts",
+    change: (source) => {
+      const anchor =
+        'const normalized = value.normalize("NFKC").replace(/\\p{M}/gu, "");';
+      assert.equal(source.split(anchor).length, 2);
+      return source.replace(anchor, "const normalized = value;");
+    },
+    spec: "src/utils/secret-read-boundary.spec.ts",
+    assertion: /not.*contain|not\.toContain|toBe|Expected/iu,
+  },
+  {
+    name: "remove-password-key",
+    file: "src/utils/secret-read-boundary.ts",
+    change: (source) => {
+      const anchor = "|password|";
+      assert.equal(source.split(anchor).length, 2);
+      return source.replace(anchor, "|");
+    },
+    spec: "src/utils/secret-read-boundary.spec.ts",
+    assertion: /not.*contain|not\.toContain/iu,
+  },
+  {
+    name: "bypass-serialization-projection",
+    file: "src/tools/result.ts",
+    change: (source) => {
+      const anchor = "shapeToolResult(projectBridgeSecretRead(value),";
+      assert.equal(source.split(anchor).length, 2);
+      return source.replace(anchor, "shapeToolResult(value,");
+    },
+    spec: "src/utils/secret-read-boundary.spec.ts",
+    assertion: /not.*contain|not\.toContain/iu,
+  },
+  {
+    name: "stop-recursing-arrays",
+    file: "src/utils/secret-read-boundary.ts",
+    change: (source) => {
+      const anchor =
+        /return value\.map\(\(entry, index\) =>\s*projectRead\(entry, carrier, depth \+ 1, budget, \[\.\.\.path, index\]\),?\s*\);/u;
+      assert.match(source, anchor);
+      return source.replace(anchor, "return value;");
+    },
+    spec: "src/utils/secret-read-boundary.spec.ts",
+    assertion: /not.*contain|not\.toContain/iu,
+  },
+  {
+    name: "new-reader-without-inventory",
+    file: "src/schemas/mcp-tools.json",
+    change: (source) => {
+      const schema = JSON.parse(source);
+      schema.tools.push({
+        ...schema.tools[0],
+        name: "besales_new_connection_reader_without_inventory",
+      });
+      return JSON.stringify(schema);
+    },
+    spec: "src/tools/secret-read-inventory.spec.ts",
+    assertion:
+      /deeply equal|toEqual|besales_new_connection_reader_without_inventory/iu,
+  },
+];
+const results = [];
+for (const mutation of mutations) {
+  const original = fs.readFileSync(mutation.file, "utf8");
+  const file = directory + "/" + mutation.name + ".json";
+  fs.rmSync(file, { force: true });
+  let killed = false;
+  let failures = [];
+  try {
+    fs.writeFileSync(mutation.file, mutation.change(original));
+    const run = spawnSync(
+      "yarn",
+      ["test", mutation.spec, "--reporter=json", "--outputFile=" + file],
+      { encoding: "utf8", timeout: 120000, maxBuffer: 32 * 1024 * 1024 },
+    );
+    fs.writeFileSync(
+      directory + "/" + mutation.name + ".log",
+      (run.stdout ?? "") + (run.stderr ?? ""),
+    );
+    const report = fs.existsSync(file)
+      ? JSON.parse(fs.readFileSync(file, "utf8"))
+      : null;
+    failures =
+      report?.testResults.flatMap((suite) =>
+        suite.assertionResults
+          .filter((test) => test.status === "failed")
+          .map((test) => ({
+            name: test.fullName,
+            messages: test.failureMessages,
+          })),
+      ) ?? [];
+    killed =
+      run.status === 1 &&
+      failures.some((test) =>
+        test.messages.some((message) => mutation.assertion.test(message)),
+      );
+  } finally {
+    fs.writeFileSync(mutation.file, original);
+    assert.equal(
+      digest(fs.readFileSync(mutation.file)),
+      digest(original),
+      "Restore mismatch",
+    );
+  }
+  results.push({
+    name: mutation.name,
+    killedByAssertion: killed,
+    failureCount: failures.length,
+    restoredSha256: digest(original),
+  });
+  console.log(
+    mutation.name + ": " + (killed ? "KILLED_BY_ASSERTION" : "NOT_KILLED"),
+  );
+  if (!killed) process.exitCode = 1;
+}
+fs.writeFileSync(
+  directory + "/summary.json",
+  JSON.stringify(results, null, 2) + "\n",
+);

package/dist/tools/definitions/analytics.d.ts

@@ -1,40 +0,0 @@
-export declare const analyticsTools: (import("./shared.js").ToolDefinition<{
-    report: "summary" | "topics" | "speed" | "money" | "cycle" | "quality";
-    mode: "all" | "days" | "range";
-    workspace_id?: string | undefined;
-    platform_id?: string | undefined;
-    channels?: string[] | undefined;
-    days?: number | undefined;
-    from?: string | undefined;
-    to?: string | undefined;
-}> | import("./shared.js").ToolDefinition<{
-    report: "summary" | "meta" | "cohorts";
-    platform_id: string;
-    workspace_id?: string | undefined;
-    from?: string | undefined;
-    to?: string | undefined;
-    view?: "cohort" | "period" | undefined;
-    manager_id?: number | undefined;
-}> | import("./shared.js").ToolDefinition<{
-    report: "summary" | "tasks" | "breakdown";
-    mode: "all" | "days" | "range";
-    scope: "production" | "with_tests";
-    workspace_id?: string | undefined;
-    days?: number | undefined;
-    from?: string | undefined;
-    to?: string | undefined;
-    group_by?: "provider" | "customer" | "platform" | "tag" | "operation" | undefined;
-    page?: number | undefined;
-    limit?: number | undefined;
-}> | import("./shared.js").ToolDefinition<{
-    workspace_id?: string | undefined;
-}> | import("./shared.js").ToolDefinition<{
-    report_id: string;
-    workspace_id?: string | undefined;
-}> | import("./shared.js").ToolDefinition<{
-    report_id: string;
-    from: string;
-    to: string;
-    workspace_id?: string | undefined;
-    granularity?: "day" | "week" | "month" | "total" | undefined;
-}>)[];