@creeperhost/modlens-mcp 1.6.19 → 1.6.21

package/scripts/test-package.mjs

@@ -30,9 +30,9 @@ Object.assign(env, {
     MODLENS_CACHE_ROOT: join(root, "modlens-cache"),
 });
 
-function start(args, home) {
+function start(args, home, extraEnv = {}) {
     const child = spawn(process.execPath, [npm, ...args], {
-        cwd: consumer, env: { ...env, MODLENS_HOME: home }, stdio: ["pipe", "pipe", "pipe"],
+        cwd: consumer, env: { ...env, MODLENS_HOME: home, ...extraEnv }, stdio: ["pipe", "pipe", "pipe"],
         detached: process.platform !== "win32",
     });
     let output = "";
@@ -113,6 +113,36 @@ try {
     assert.equal(initScript, join(installed, "scripts/gradle/modlens.init.gradle"));
     assert.ok(statSync(initScript).size > 0, "Gradle exporter must ship in the npm package");
     assert.ok(statSync(join(installed, "scripts/project-upload.mjs")).size > 0, "Remote uploader must ship in the npm package");
+    assert.ok(statSync(join(installed, "dist/runtime/modlens-agent.jar")).size > 0, "Optional runtime agent must ship prebuilt");
+    assert.ok(statSync(join(installed, "scripts/gradle/modlens-runtime.init.gradle")).size > 0, "Runtime launch integration must ship");
+    assert.ok(statSync(join(installed, "RUNTIME.md")).size > 0, "Runtime instructions must ship");
+    assert.ok(statSync(join(installed, "dist/license-templates.js")).size > 0, "License reference data must ship");
+    const localModRequest = join(root, "local-mod-request.json");
+    writeFileSync(localModRequest, JSON.stringify({ localJarPath: join(root, "not-opened.jar"), sha256: "a".repeat(64), className: "example.Fixture", acceptedLocalDecompilation: false }));
+    assert.throws(() => execFileSync(process.execPath, [join(installed, "dist/launcher.js"), "--local-mod", "--request-file", localModRequest], {
+        env: { ...env, MODLENS_HOME: join(root, "local-mod-home"), MCP_PORT: "9999" }, encoding: "utf8", stdio: "pipe", timeout: 30000,
+    }), error => error.status === 1 && String(error.stderr).includes("User acceptance required"));
+    assert.ok(!existsSync(join(root, "local-mod-home", "data")), "Local helper must not bootstrap a hosted database");
+    console.log("PASS: installed local decompilation helper refuses execution without user acceptance");
+    const runtimeHome=join(root,"runtime-only-home");
+    const runtimeEnv={...env,MODLENS_HOME:runtimeHome,MODLENS_CACHE_ROOT:join(root,"runtime-only-cache"),MCP_PORT:"9999"};
+    const runtime=(...arguments_)=>JSON.parse(execFileSync(process.execPath,[join(installed,"dist/launcher.js"),"--runtime",...arguments_],{env:runtimeEnv,encoding:"utf8",timeout:30000}));
+    const runtimeProject=join(root,"runtime project");
+    mkdirSync(join(runtimeProject,"gradle/wrapper"),{recursive:true});
+    writeFileSync(join(runtimeProject,"gradle/wrapper/gradle-wrapper.jar"),"fixture");
+    const runtimeRequest=join(root,"runtime-request.json");
+    writeFileSync(runtimeRequest,JSON.stringify({action:"setup",projectDir:runtimeProject,mode:"hidden"}));
+    try {
+        assert.ok(runtime("help").execution.includes("Remote MCP"));
+        const configuredRuntime = runtime("--request-file",runtimeRequest);
+        assert.equal(configuredRuntime.state,"configured");
+        assert.deepEqual(configuredRuntime.vmOptions,[configuredRuntime.vmOption,"-XX:StackShadowPages=32"]);
+        assert.equal(runtime("status").projects.length,1);
+        assert.deepEqual(runtime("sessions"),[]);
+        assert.ok(!existsSync(join(runtimeHome,"data")),"Runtime helper must not create a source database");
+        assert.ok(!existsSync(join(runtimeHome,".env")),"Runtime helper must not create MCP configuration");
+    } finally {runtime("stop");}
+    console.log("PASS: installed runtime helper setup, persistence and stop without local MCP/database setup");
     const keyFile = join(root, "project-key.txt");
     writeFileSync(keyFile, "a".repeat(64));
     assert.deepEqual(JSON.parse(execFileSync(process.execPath, [join(installed, "dist/launcher.js"), "--project", "list", `--key-file=${keyFile}`], { env, encoding: "utf8" })), []);
@@ -122,8 +152,28 @@ try {
     assert.match(require("better-sqlite3/package.json").version, /^12\./);
 
     const dataHome = join(root, "server-home");
+    // Deterministic upstream responses still exercise the installed Markdown dependencies,
+    // MCP argument schema, error flag, database writes, and reads after restart.
+    const primerFetchFixture = join(root, "primer-fetch-fixture.mjs");
+    writeFileSync(primerFetchFixture, `
+        const originalFetch = globalThis.fetch;
+        globalThis.fetch = async (input, init) => {
+            const url = String(input);
+            if (url === 'https://docs.neoforged.net/package-primer-missing') return new Response('missing', { status: 404 });
+            if (url === 'https://docs.neoforged.net/package-primer') return new Response(
+                '<article><h1>Package migration guide</h1><pre class="language-java"><code>' +
+                '<div class="token-line"><span>update();</span><br></div><div class="token-line"><span>finish();</span><br></div></code></pre>' +
+                '<p>Detailed instructions for migration and keeping code examples readable.</p><h2>Final section</h2></article>',
+                { headers: { 'content-type': 'text/html' } });
+            if (url.includes('misode/mcmeta/summary/versions/data.json')) return Response.json([
+                { id: '1.21.1', data_version: 3955 }, { id: '1.21.5', data_version: 4325 }
+            ]);
+            if (url.endsWith('/api/tags')) return new Response(null, { status: 503 });
+            return originalFetch(input, init);
+        };
+    `);
     async function checkServer() {
-        const run = start(args, dataHome);
+        const run = start(args, dataHome, { NODE_OPTIONS: `--import=${pathToFileURL(primerFetchFixture).href}` });
         const pending = new Map();
         let buffer = "";
         let id = 0;
@@ -161,11 +211,94 @@ try {
             assert.ok(initialized.serverInfo);
             send({ method: "notifications/initialized" });
             const list = await request("tools/list", {});
+            assert.ok(list.tools.some(tool => tool.name === "runtime" && tool.description.includes("setup")), "AI must discover runtime setup through MCP");
+            assert.match(initialized.instructions, /runtime/);
+            assert.ok(list.tools.some(tool => tool.name === "report_issue"), "AI must discover GitHub issue reporting");
+            const issueDraft = await request("tools/call", { name: "report_issue", arguments: {
+                action: "prepare", title: "Package test fixture", summary: "A synthetic report; do not publish.",
+            } });
+            assert.ok(!issueDraft.isError);
+            const issuePlan = JSON.parse(issueDraft.content[0].text);
+            assert.equal(issuePlan.executed, false);
+            assert.equal(issuePlan.state, "draft_prepared");
+            assert.equal(issuePlan.repository.repo, "modlens-mcp");
+            const runtimeHelp = await request("tools/call", { name: "runtime", arguments: { action: "help" } });
+            assert.ok(!runtimeHelp.isError);
+            assert.match(runtimeHelp.content[0].text, /26\.3/);
             assert.ok(list.tools.some(tool => tool.name === "mod"));
             assert.ok(list.tools.some(tool => tool.name === "project"));
             const stats = await request("tools/call", { name: "mod", arguments: { action: "stats" } });
             assert.ok(!stats.isError, JSON.stringify(stats));
             assert.equal(JSON.parse(stats.content.find(item => item.type === "text").text).total, 0);
+            const primerTool = list.tools.find(tool => tool.name === "primers");
+            assert.ok(primerTool.inputSchema.properties.refresh, "Packaged primer tool must expose cache refresh");
+            for (const field of ["includeContent", "maxChars", "cursor"]) {
+                assert.ok(primerTool.inputSchema.properties[field], `Packaged primer tool must expose ${field}`);
+            }
+            const decode = response => JSON.parse(response.content.find(item => item.type === "text").text);
+            const primerCall = arguments_ => request("tools/call", { name: "primers", arguments: arguments_ });
+            const saved = await primerCall({ action: "ingest", entries: [{
+                fromVersion: "1.21.1", toVersion: "1.21.5", title: "Package primer", url: "https://docs.neoforged.net/package-primer",
+            }] });
+            assert.ok(!saved.isError, JSON.stringify(saved));
+            const primerId = decode(saved).primers[0].id;
+            const page = await primerCall({ action: "get", id: primerId, maxLines: 3 });
+            assert.ok(!page.isError, JSON.stringify(page));
+            assert.equal(decode(page).contentStatus, "ready");
+            assert.match(decode(page).content, /# Package migration guide/);
+            assert.equal(decode(page).nextStartLine, 4);
+            const tail = decode(await primerCall({ action: "get", id: primerId, startLine: 4 }));
+            assert.match(tail.content, /update\(\);\nfinish\(\);/);
+            assert.match(tail.content, /## Final section/);
+            assert.equal(tail.nextStartLine, null);
+            const longContent = "# Long migration guide\n\n" + "x".repeat(2500) + "😀\nEnd.";
+            const added = decode(await primerCall({ action: "ingest", entries: [{
+                fromVersion: "1.21.5", toVersion: "26.1", title: "Long package primer",
+                url: "https://docs.neoforged.net/package-primer-long", content: longContent,
+            }] }));
+            const rangeArgs = { action: "by_version", fromVersion: "1.21.1", toVersion: "26.1", modloader: "neoforge" };
+            const metadata = decode(await primerCall(rangeArgs));
+            assert.equal(metadata.count, 2);
+            assert.ok(metadata.primers.every(primer => !("content" in primer)));
+            const chunks = new Map();
+            let cursor;
+            let pages = 0;
+            do {
+                const response = await primerCall({ ...rangeArgs, includeContent: true, maxChars: 1000, ...(cursor ? { cursor } : {}) });
+                assert.ok(!response.isError, JSON.stringify(response));
+                const bundle = decode(response);
+                assert.equal(bundle.count, 2);
+                assert.ok(bundle.contentChars <= 1000);
+                for (const primer of bundle.primers) chunks.set(primer.id, (chunks.get(primer.id) ?? "") + primer.content);
+                cursor = bundle.nextCursor;
+                assert.ok(++pages < 10);
+            } while (cursor);
+            assert.equal(chunks.get(added.primers[0].id), longContent);
+            assert.match(chunks.get(primerId), /update\(\);\nfinish\(\);/);
+            const cliRange = JSON.parse(execFileSync(process.execPath, [join(installed, "dist/cli.js"),
+                "primers", "by-version", "1.21.1", "26.1", "--modloader=neoforge", "--include-content", "--fetch-content=false"], {
+                env: { ...env, DATABASE_URL: `file:${join(dataHome, "data/modlens.db")}` }, encoding: "utf8", timeout: 30_000,
+            }));
+            assert.equal(cliRange.count, 2);
+            assert.equal(cliRange.nextCursor, null);
+            assert.equal(cliRange.primers.find(primer => primer.id === added.primers[0].id).content, longContent);
+            assert.equal((await primerCall({ ...rangeArgs, includeContent: true, cursor: "invalid" })).isError, true);
+            const failed = await primerCall({ action: "ingest", entries: [{
+                fromVersion: "1.21.1", toVersion: "1.21.5", title: "Missing primer",
+                url: "https://docs.neoforged.net/package-primer-missing", fetchContent: true,
+            }] });
+            assert.equal(failed.isError, true, "Requested content fetch failures must be MCP errors");
+            assert.equal(decode(failed).failed, 1);
+            const missing = decode(await primerCall({ action: "ingest", entries: [{
+                fromVersion: "1.21.1", toVersion: "1.21.5", title: "Missing bundled primer",
+                url: "https://docs.neoforged.net/package-primer-missing",
+            }] }));
+            const partial = await primerCall({ ...rangeArgs, includeContent: true });
+            assert.equal(partial.isError, true, "Bundle fetch failures must be MCP errors with successful content retained");
+            assert.equal(decode(partial).failed, 1);
+            assert.equal(decode(partial).primers.filter(primer => primer.contentStatus === "ready").length, 2);
+            await primerCall({ action: "delete", id: added.primers[0].id });
+            await primerCall({ action: "delete", id: missing.primers[0].id });
             return run.output();
         } finally { await stop(run); }
     }
@@ -174,7 +307,7 @@ try {
     assert.match(first, /First run/);
     const database = join(dataHome, "data/modlens.db");
     assert.ok(statSync(database).size > 0);
-    console.log("PASS: first-run SQLite bootstrap, MCP handshake, tools/list, database stats");
+    console.log("PASS: first-run SQLite bootstrap, MCP handshake, primer bundles/pagination/errors, CLI ranges, database stats");
 
     // Check the actual installed client/adapter with dates, BLOBs, and transactions.
     // Use a child so Windows releases the native .node file before cleanup.
@@ -212,6 +345,9 @@ try {
     console.log("PASS: second npx run preserves existing database contents");
     passed = true;
 } finally {
-    if (passed) rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 300 });
+    if (passed) {
+        assert.equal(dirname(resolve(root)), resolve(tmpdir()), "Cleanup must stay within the test temp directory");
+        rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 300 });
+    }
     else console.error(`Package test artifacts retained at ${root}`);
 }

package/scripts/test-primers-live.mjs

@@ -0,0 +1,93 @@
+// Live upstream check, isolated from the user's database/cache. Run after npm run build.
+import assert from "node:assert/strict";
+import { copyFile, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repository = dirname(dirname(fileURLToPath(import.meta.url)));
+const root = await mkdtemp(join(tmpdir(), "modlens-primers-live-"));
+await copyFile(join(repository, "prisma/backends/template.db"), join(root, "test.db"));
+process.env.DATABASE_URL = "file:" + join(root, "test.db");
+process.env.MODLENS_CACHE_ROOT = join(root, "cache");
+process.env.OLLAMA_URL = "http://127.0.0.1:1"; // Embeddings are independent of this check.
+const { getDb, disconnect } = await import("../dist/db.js");
+const { seedDefaultPrimers, getPrimer, getPrimersByVersionRange } = await import("../dist/tools/primers.js");
+const { SEED_PRIMERS } = await import("../dist/primer-catalog.js");
+const db = await getDb();
+let passed = false;
+try {
+    await db.primer.create({ data: {
+        id: 3, fromVersion: "1.21.1", toVersion: "1.21.5", modloader: "neoforge",
+        title: "NeoForge Migration Guide - 1.21.1 to 1.21.5 (content)",
+        url: "https://docs.neoforged.net/docs/1.21.5/migrationguide/", source: "seed",
+    } });
+    console.log("Fetching the official primer catalogue into a disposable SQLite database...");
+    const seeded = await seedDefaultPrimers();
+    console.log(JSON.stringify({ guides: seeded.ingested, ready: seeded.ready, failed: seeded.failed,
+        errors: seeded.primers.filter(p => p.error) }, null, 2));
+    assert.equal(seeded.ready, SEED_PRIMERS.length);
+    assert.equal(seeded.failed, 0);
+    const range = await getPrimersByVersionRange("1.21.1", "1.21.5", "neoforge");
+    assert.equal(range.count, 6);
+    const fullRange = await getPrimersByVersionRange("1.21.1", "26.1", "neoforge");
+    assert.equal(fullRange.count, 17);
+    const bundledContent = new Map();
+    let cursor;
+    let bundlePages = 0;
+    do {
+        const bundle = await getPrimersByVersionRange("1.21.1", "26.1", "neoforge", { includeContent: true, maxChars: 60_000, cursor });
+        assert.equal(bundle.failed, 0);
+        assert.equal(bundle.missing, 0);
+        assert.equal(bundle.count, 17);
+        assert.ok(bundle.contentChars <= 60_000);
+        for (const primer of bundle.primers) {
+            const previous = bundledContent.get(primer.id) ?? "";
+            assert.equal(primer.startOffset, previous.length);
+            bundledContent.set(primer.id, previous + primer.content);
+        }
+        cursor = bundle.nextCursor ?? undefined;
+        assert.ok(++bundlePages < 100, "Bundle pagination must terminate");
+    } while (cursor);
+    for (const primer of fullRange.primers) {
+        const stored = await db.primer.findUniqueOrThrow({ where: { id: primer.id } });
+        assert.equal(bundledContent.get(primer.id), stored.content, `Bundle must retain all content for ${primer.title}`);
+    }
+    const reported = await getPrimer(3);
+    assert.equal(reported.url, "https://docs.neoforged.net/primer/docs/1.21.5/");
+    assert.equal(reported.contentStatus, "ready");
+    const saved = await db.primer.findUniqueOrThrow({ where: { id: 3 } });
+    assert.ok(saved.content.length > 50_000, "The guide must survive the old 50K truncation limit");
+    assert.ok(saved.content.includes(String.fromCharCode(96).repeat(3)), "Code fences must survive extraction");
+    assert.match(saved.content, /var blocker = new BlocksAttacks\(\n\s+\/\//, "Highlighted code must preserve line breaks before comments");
+    let page = reported;
+    const parts = [];
+    while (true) {
+        parts.push(page.content);
+        if (page.nextStartLine === null) break;
+        page = await getPrimer(3, { startLine: page.nextStartLine });
+    }
+    assert.equal(parts.join("\n"), saved.content);
+    const neo = range.primers.find(p => p.toVersion === "1.21.5" && p.modloader === "neoforge");
+    const loader = await db.primer.findUniqueOrThrow({ where: { id: neo.id } });
+    assert.match(loader.content, /Embedded source: https:\/\/neoforged.net\/news\/21.5release\//);
+    // A restarted, disconnected client should still be able to read the cached body.
+    const originalFetch = globalThis.fetch;
+    try {
+        globalThis.fetch = async () => { throw new Error("Offline check"); };
+        await disconnect();
+        assert.equal((await getPrimer(3)).content, reported.content);
+        const offlineBundle = await getPrimersByVersionRange("1.21.1", "26.1", "neoforge", { includeContent: true });
+        assert.equal(offlineBundle.failed, 0);
+        assert.ok(offlineBundle.contentChars > 0);
+    } finally { globalThis.fetch = originalFetch; }
+    console.log("PASS: legacy ID repaired, live guide extraction, 17-guide range bundling, lossless pagination, and offline cached reads");
+    console.log(JSON.stringify({ reportGuideCharacters: saved.content.length, reportGuideLines: reported.totalLines, pages: parts.length, bundleGuides: bundledContent.size, bundlePages }));
+    passed = true;
+} finally {
+    await disconnect();
+    if (passed) {
+        assert.equal(dirname(resolve(root)), resolve(tmpdir()), "Cleanup must stay within the test temp directory");
+        await rm(root, { recursive: true, force: true, maxRetries: 5 });
+    } else console.error("Live primer test artifacts retained at " + root);
+}

package/scripts/test-project-http.mjs

@@ -11,6 +11,8 @@ import { once } from 'node:events';
 import AdmZip from 'adm-zip';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { licenseTemplates } from '../dist/license-templates.js';
+import { ElicitRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 
 const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const root = await mkdtemp(join(tmpdir(), 'modlens-http-smoke-'));
@@ -28,14 +30,22 @@ if (!process.argv[2]) {
     const jar = new AdmZip();
     jar.addFile('example/Target.class', Buffer.from('test class entry'));
     jar.addFile('example/Target.java', Buffer.from('package example; public class Target { public int counter; }'));
+    jar.addFile('LICENSE', Buffer.from(licenseTemplates['0BSD'].text));
     // An incompressible payload exercises multiple full upload chunks.
     jar.addFile('payload.bin', randomBytes(2 * 1024 * 1024));
     const bytes = jar.toBuffer();
     const bundle = new AdmZip();
     bundle.addFile('artifacts/0.jar', bytes);
+    const restricted = new AdmZip();
+    restricted.addFile('LICENSE', Buffer.from('All Rights Reserved'));
+    restricted.addFile('example/Restricted.class', Buffer.from('restricted class fixture'));
+    restricted.addFile('example/Restricted.java', Buffer.from('RESTRICTED_SOURCE_MUST_STAY_LOCAL'));
+    const restrictedBytes = restricted.toBuffer();
+    bundle.addFile('artifacts/1.jar', restrictedBytes);
     bundle.addFile('manifest.json', Buffer.from(JSON.stringify({ format: 'modlens-project-v1', project: 'http-smoke:', sourceSet: 'main',
         toolchain: 'gradle-compile-classpath', minecraftVersion: '', loaderVersion: '', mappings: 'compile-classpath', javaVersion: 21, transformations: [],
-        artifacts: [{ path: 'artifacts/0.jar', name: 'prepared.jar', size: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex'), kind: 'classpath' }] })));
+        artifacts: [{ path: 'artifacts/0.jar', name: 'prepared.jar', size: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex'), kind: 'classpath' },
+            { path: 'artifacts/1.jar', name: 'restricted.jar', size: restrictedBytes.length, sha256: createHash('sha256').update(restrictedBytes).digest('hex'), kind: 'classpath' }] })));
     await writeFile(bundlePath, bundle.toBuffer());
 }
 const env = { ...process.env, MCP_PORT: String(port), MCP_HOST: '127.0.0.1', MODLENS_AUTO_EMBED: '0',
@@ -44,7 +54,9 @@ const server = spawn(process.execPath, [join(repo, 'dist/server.js')], { cwd: ro
 let logs = '';
 server.stderr.on('data', b => { logs += b; });
 const stopped = once(server, 'exit');
-const client = new Client({ name: 'project-http-test', version: '1.0.0' });
+const client = new Client({ name: 'project-http-test', version: '1.0.0' }, { capabilities: { elicitation: { form: {} } } });
+let acceptLocal = true;
+client.setRequestHandler(ElicitRequestSchema, async () => acceptLocal ? { action: 'accept', content: { acceptLocal: true } } : { action: 'decline' });
 let passed = false;
 try {
     await new Promise((resolveReady, reject) => {
@@ -69,6 +81,37 @@ try {
     const source = await call('source', { className: target });
     assert.ok(!source.isError, JSON.stringify(source));
     assert.ok(JSON.parse(source.content[0].text).source.length > 0);
+    const complianceBlock = source.content.find(c => c.type === 'text' && c.text.includes('licenseCompliance'));
+    assert.ok(complianceBlock, 'required license notices must accompany source');
+    assert.ok(JSON.parse(source.content[0].text).source.split(/\r?\n/).length <= 200);
+    if (process.env.MODLENS_TEST_EXPECTED_LICENSE) {
+        const compliance = JSON.parse(complianceBlock.text).licenseCompliance[0];
+        assert.equal(compliance.license, process.env.MODLENS_TEST_EXPECTED_LICENSE);
+        assert.equal(compliance.conditions.outputLicense, compliance.license);
+        assert.ok(compliance.notices.every(n => n.licenseText.length > 0));
+        assert.ok(compliance.modifiedAt);
+        if (compliance.license === 'LGPL-3.0-only') assert.ok(compliance.conditions.sourceArchive);
+        if (compliance.license === 'CC-BY-NC-SA-4.0') assert.equal(compliance.conditions.noncommercialOnly, true);
+    }
+    if (!process.argv[2]) {
+        assert.ok(source.content.some(c => c.type === 'text' && c.text.includes('licenseCompliance')), 'required license notices must accompany source');
+        const restricted = await call('source', { className: 'example.Restricted' });
+        const fallback = JSON.parse(restricted.content[0].text);
+        assert.equal(fallback.licenseReview.disposition, 'local_only');
+        assert.equal(fallback.local.requiresUserConsent, true);
+        assert.ok(!JSON.stringify(restricted).includes('RESTRICTED_SOURCE_MUST_STAY_LOCAL'));
+        const searched = await call('search', { query: 'RESTRICTED_SOURCE' });
+        assert.deepEqual(JSON.parse(searched.content[0].text).results, []);
+        const consent = () => client.callTool({ name: 'mod_license', arguments: {
+            action: 'local_plan', projectKey: key, environmentId: imported.environmentId, className: 'example.Restricted',
+        } });
+        const accepted = JSON.parse((await consent()).content[0].text).local;
+        assert.equal(accepted.executed, false);
+        assert.equal(accepted.request.acceptedLocalDecompilation, true);
+        assert.equal(accepted.requiresUserConsent, false);
+        acceptLocal = false;
+        assert.equal(JSON.parse((await consent()).content[0].text).declined, true);
+    }
     if (process.argv[5]) {
         const members = await call('members', { className: target });
         assert.ok(!members.isError, JSON.stringify(members));
@@ -88,7 +131,7 @@ try {
     assert.equal(large.status, 413);
     assert.ok(!logs.includes(key), 'server logs must redact project key');
     assert.ok(!logs.includes('SENSITIVE_PAYLOAD'), 'server logs must redact upload bytes');
-    console.log(`PASS: HTTP upload, ${imported.classCount} classes, source query, project isolation, host-path rejection, body limits and log redaction`);
+    console.log(`PASS: HTTP upload, ${imported.classCount} classes, source query and complete notices, project isolation, host-path rejection, body limits and log redaction${process.argv[2] ? '' : ', restricted-source gating and local consent'}`);
     passed = true;
 } finally {
     await client.close();

package/scripts/test-runtime-gradle.mjs

@@ -0,0 +1,107 @@
+// Validates the same wrapper/init-script path used by MCP and IntelliJ.
+// Requires JAVA_HOME (25+) and MODLENS_TEST_GRADLE_HOME (a Gradle 9.6 distribution).
+import { mkdtemp, mkdir, writeFile, readdir, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import assert from "node:assert/strict";
+import { RuntimeHub } from "../dist/runtime/hub.js";
+import { runtimeTestClient } from "./runtime-test-client.mjs";
+
+const gradleHome = process.env.MODLENS_TEST_GRADLE_HOME;
+const javaHome = process.env.JAVA_HOME;
+if (!gradleHome || !javaHome) throw new Error("Set JAVA_HOME and MODLENS_TEST_GRADLE_HOME");
+const root = await mkdtemp(join(tmpdir(), "modlens-runtime-gradle-"));
+const project = join(root, "project with spaces");
+await mkdir(join(project, "src/main/java"), { recursive: true });
+await writeFile(join(project, "settings.gradle"), "rootProject.name = 'runtime-smoke'\n");
+await writeFile(join(project, "gradle.properties"), "org.gradle.daemon=false\n");
+await writeFile(
+    join(project, "build.gradle"),
+    `
+plugins { id 'java' }
+tasks.register('runClient', JavaExec) {
+    classpath = sourceSets.main.runtimeClasspath
+    mainClass = 'Fixture'
+    args 'agent'
+}
+tasks.register('plainRun', JavaExec) {
+    classpath = sourceSets.main.runtimeClasspath
+    mainClass = 'Fixture'
+    args 'plain'
+}
+`,
+);
+await writeFile(
+    join(project, "src/main/java/Fixture.java"),
+    `
+public class Fixture {
+    public static void main(String[] args) throws Exception {
+        long count = java.lang.management.ManagementFactory.getRuntimeMXBean().getInputArguments()
+            .stream().filter(s -> s.startsWith("-javaagent:") && s.contains(".modlens")).count();
+        if (count != (args[0].equals("agent") ? 1 : 0)) throw new AssertionError("agent count " + count);
+        System.out.println("AGENT_COUNT=" + count);
+        var vmArgs = java.lang.management.ManagementFactory.getRuntimeMXBean().getInputArguments();
+        boolean hasShadowOption = vmArgs.stream().anyMatch(s -> s.startsWith("-XX:StackShadowPages="));
+        if (hasShadowOption != args[0].equals("agent")) throw new AssertionError("Stack setting leaked or missing: " + vmArgs);
+        if (count == 1) {
+            String shadowPages = java.lang.management.ManagementFactory.getPlatformMXBean(
+                com.sun.management.HotSpotDiagnosticMXBean.class).getVMOption("StackShadowPages").getValue();
+            if (!shadowPages.equals("32")) throw new AssertionError("Effective StackShadowPages=" + shadowPages);
+            System.out.println("STACK_SHADOW_PAGES=" + shadowPages);
+        }
+        if (count == 1) Thread.sleep(4000);
+    }
+}
+`,
+);
+const launcher = (await readdir(join(gradleHome, "lib"))).find((n) =>
+    /^gradle-gradle-cli-main-.*\.jar$/.test(n),
+);
+if (!launcher) throw new Error("Expected a Gradle 9.6 distribution");
+const java = join(javaHome, "bin", process.platform === "win32" ? "java.exe" : "java");
+execFileSync(java, ["-jar", join(gradleHome, "lib", launcher), "--no-daemon", "--offline", "wrapper"], {
+    cwd: project,
+    stdio: "inherit",
+    timeout: 120000,
+});
+const hub = process.argv.includes("--helper")
+    ? runtimeTestClient(root)
+    : new RuntimeHub(join(root, "bridge"));
+try {
+    const setup = await hub.setup(project, "hidden");
+    const init = join(project, ".modlens/runtime/init.gradle");
+    const plain = execFileSync(
+        java,
+        [
+            "-jar",
+            join(gradleHome, "lib", launcher),
+            "--no-daemon",
+            "--offline",
+            "--no-configuration-cache",
+            "-I",
+            init,
+            "plainRun",
+        ],
+        { cwd: project, encoding: "utf8", timeout: 120000 },
+    );
+    assert.match(plain, /AGENT_COUNT=0/);
+    await hub.launch(setup.projectId, javaHome);
+    const deadline = Date.now() + 120000;
+    let done;
+    while (Date.now() < deadline) {
+        const events = (await hub.events()).events;
+        done = events.find((e) => e.type === "launch_log");
+        if (done) break;
+        await new Promise((r) => setTimeout(r, 250));
+    }
+    assert.ok(done, "Gradle launch did not finish");
+    assert.match(done.data.text, /AGENT_COUNT=1/);
+    assert.match(done.data.text, /STACK_SHADOW_PAGES=32/);
+    assert.match(done.data.text, /BUILD SUCCESSFUL/);
+    assert.equal((await hub.list()).length, 1, "Only the game task should register");
+    assert.match(await readFile(setup.runConfiguration, "utf8"), /--init-script/);
+    console.log("Gradle optional agent launch passed. Evidence: " + root);
+} finally {
+    await hub.close();
+}