@danielblomma/cortex-mcp 2.0.7 → 2.0.9

package/scaffold/mcp/tests/workflow-synced-capabilities.test.mjs

@@ -0,0 +1,226 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  loadSyncedCapabilities,
+  syncedCapabilitiesCachePath,
+} from "../dist/core/workflow/synced-capability-registry.js";
+import { evaluateToolCall } from "../dist/core/workflow/enforcement.js";
+import { createRun } from "../dist/core/workflow/run-lifecycle.js";
+
+function makeWorkspace() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), "cortex-synced-caps-"));
+}
+
+const FRONTEND_BUILDER = {
+  name: "frontend-builder",
+  description: "Frontend-only profile",
+  read_globs: ["**"],
+  write_globs: ["src/components/**"],
+  tools_allowed: [],
+};
+
+const WORKFLOW = {
+  id: "fe",
+  description: "Frontend-only build",
+  version: 1,
+  stages: [
+    {
+      name: "build",
+      artifact: "changes.md",
+      reads: [],
+      required_fields: [],
+      validators: [],
+      capability: "frontend-builder",
+      description: "Build the frontend",
+    },
+  ],
+};
+
+function writeCache(dir, payload) {
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(
+    syncedCapabilitiesCachePath(dir),
+    JSON.stringify(payload, null, 2),
+    "utf8",
+  );
+}
+
+test("syncedCapabilitiesCachePath: defaults to ~/.cortex/capabilities.local.json", () => {
+  const expected = path.join(os.homedir(), ".cortex", "capabilities.local.json");
+  assert.equal(syncedCapabilitiesCachePath(), expected);
+});
+
+test("loadSyncedCapabilities: returns {} when cache is missing", () => {
+  const dir = makeWorkspace();
+  assert.deepEqual(loadSyncedCapabilities(dir), {});
+});
+
+test("loadSyncedCapabilities: returns {} when cache is unreadable JSON", () => {
+  const dir = makeWorkspace();
+  fs.writeFileSync(syncedCapabilitiesCachePath(dir), "not json", "utf8");
+  assert.deepEqual(loadSyncedCapabilities(dir), {});
+});
+
+test("loadSyncedCapabilities: returns {} when 'capabilities' key is missing", () => {
+  const dir = makeWorkspace();
+  writeCache(dir, { last_synced_at: "x" });
+  assert.deepEqual(loadSyncedCapabilities(dir), {});
+});
+
+test("loadSyncedCapabilities: drops entries whose definition fails schema", () => {
+  const dir = makeWorkspace();
+  writeCache(dir, {
+    capabilities: {
+      "valid-one": {
+        capability_name: "valid-one",
+        updated_at: "2026-05-07T12:00:00.000Z",
+        definition: FRONTEND_BUILDER,
+      },
+      "broken-one": {
+        capability_name: "broken-one",
+        updated_at: "2026-05-07T12:00:00.000Z",
+        definition: { name: "broken-one" /* missing description */ },
+      },
+    },
+  });
+  const loaded = loadSyncedCapabilities(dir);
+  assert.deepEqual(Object.keys(loaded).sort(), ["valid-one"]);
+});
+
+test("loadSyncedCapabilities: returns valid capability definitions", () => {
+  const dir = makeWorkspace();
+  writeCache(dir, {
+    capabilities: {
+      "frontend-builder": {
+        capability_name: "frontend-builder",
+        updated_at: "2026-05-07T12:00:00.000Z",
+        definition: FRONTEND_BUILDER,
+      },
+    },
+  });
+  const loaded = loadSyncedCapabilities(dir);
+  assert.equal(loaded["frontend-builder"].name, "frontend-builder");
+  assert.deepEqual(loaded["frontend-builder"].write_globs, ["src/components/**"]);
+});
+
+test("evaluateToolCall integration: synced capability is consulted via merged registry", () => {
+  const cwd = makeWorkspace();
+  // Sandbox the home-dir-based loader.
+  const fakeHome = makeWorkspace();
+  process.env.HOME = fakeHome;
+  try {
+    fs.mkdirSync(path.join(fakeHome, ".cortex"), { recursive: true });
+    fs.writeFileSync(
+      path.join(fakeHome, ".cortex", "capabilities.local.json"),
+      JSON.stringify({
+        capabilities: {
+          "frontend-builder": {
+            capability_name: "frontend-builder",
+            updated_at: "2026-05-07T12:00:00.000Z",
+            definition: FRONTEND_BUILDER,
+          },
+        },
+      }),
+      "utf8",
+    );
+
+    createRun({
+      cwd,
+      taskId: "task-1",
+      workflow: WORKFLOW,
+      taskDescription: "Build frontend",
+    });
+
+    // Allowed: src/components/**
+    const allowed = evaluateToolCall({
+      cwd,
+      taskId: "task-1",
+      call: { toolName: "Edit", toolInput: { file_path: "src/components/Foo.tsx" } },
+      workflows: { fe: WORKFLOW },
+    });
+    assert.equal(allowed.allowed, true);
+
+    // Blocked: outside write_globs
+    const blocked = evaluateToolCall({
+      cwd,
+      taskId: "task-1",
+      call: { toolName: "Edit", toolInput: { file_path: "src/server/api.ts" } },
+      workflows: { fe: WORKFLOW },
+    });
+    assert.equal(blocked.allowed, false);
+    assert.match(blocked.reason, /frontend-builder/);
+  } finally {
+    delete process.env.HOME;
+  }
+});
+
+test("evaluateToolCall integration: synced capability with same name as bundled overrides bundled", () => {
+  const cwd = makeWorkspace();
+  const fakeHome = makeWorkspace();
+  process.env.HOME = fakeHome;
+  try {
+    // Override the bundled "builder" capability with a much stricter version
+    // — only test files writable.
+    const stricterBuilder = {
+      name: "builder",
+      description: "Org-overridden strict builder",
+      read_globs: ["**"],
+      write_globs: ["tests/**"],
+      tools_allowed: [],
+    };
+    fs.mkdirSync(path.join(fakeHome, ".cortex"), { recursive: true });
+    fs.writeFileSync(
+      path.join(fakeHome, ".cortex", "capabilities.local.json"),
+      JSON.stringify({
+        capabilities: {
+          builder: {
+            capability_name: "builder",
+            updated_at: "2026-05-07T12:00:00.000Z",
+            definition: stricterBuilder,
+          },
+        },
+      }),
+      "utf8",
+    );
+
+    const builderWorkflow = {
+      id: "build-only",
+      description: "Build-only workflow using bundled name",
+      version: 1,
+      stages: [
+        {
+          name: "build",
+          artifact: "changes.md",
+          reads: [],
+          required_fields: [],
+          validators: [],
+          capability: "builder",
+          description: "Build",
+        },
+      ],
+    };
+    createRun({
+      cwd,
+      taskId: "task-2",
+      workflow: builderWorkflow,
+      taskDescription: "Build",
+    });
+
+    // Bundled builder allows src/** + tests/**, but the org override only
+    // allows tests/**. src/** must be blocked under the override.
+    const result = evaluateToolCall({
+      cwd,
+      taskId: "task-2",
+      call: { toolName: "Edit", toolInput: { file_path: "src/main.ts" } },
+      workflows: { "build-only": builderWorkflow },
+    });
+    assert.equal(result.allowed, false);
+    assert.match(result.reason, /Org-overridden|tests/i);
+  } finally {
+    delete process.env.HOME;
+  }
+});

package/scaffold/mcp/tests/workflow-validators-override.test.mjs

@@ -0,0 +1,272 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  createRun,
+  advanceStage,
+} from "../dist/core/workflow/run-lifecycle.js";
+import { composeStageEnvelope } from "../dist/core/workflow/envelope.js";
+import {
+  runWorkflowAdvance,
+  runWorkflowStart,
+} from "../dist/core/workflow/mcp-tools.js";
+
+function makeWorkspace() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), "cortex-validators-"));
+}
+
+const WORKFLOW = {
+  id: "validated",
+  description: "One stage that requires two validators",
+  version: 1,
+  stages: [
+    {
+      name: "build",
+      artifact: "changes.md",
+      reads: [],
+      required_fields: [],
+      validators: [
+        { id: "tests-pass", description: "Test suite must pass" },
+        { id: "build-passes", description: "Build must succeed" },
+      ],
+      capability: "builder",
+      description: "Implement the change.",
+    },
+  ],
+};
+
+const REGISTRY = { validated: WORKFLOW };
+
+test("advanceStage: blocks when validators_passed misses required ids", () => {
+  const cwd = makeWorkspace();
+  createRun({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    taskDescription: "Test",
+  });
+
+  assert.throws(
+    () =>
+      advanceStage({
+        cwd,
+        taskId: "task-1",
+        workflow: WORKFLOW,
+        stageName: "build",
+        artifactName: "changes.md",
+        frontmatter: { stage: "build", status: "complete", references: [] },
+        body: "# Changes",
+        validatorsPassed: ["tests-pass"], // missing build-passes
+      }),
+    /Missing: build-passes/,
+  );
+});
+
+test("advanceStage: allows when validators_passed covers required ids", () => {
+  const cwd = makeWorkspace();
+  createRun({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    taskDescription: "Test",
+  });
+
+  const next = advanceStage({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    stageName: "build",
+    artifactName: "changes.md",
+    frontmatter: { stage: "build", status: "complete", references: [] },
+    body: "# Changes",
+    validatorsPassed: ["tests-pass", "build-passes"],
+  });
+  assert.equal(next.outcome, "complete");
+  assert.deepEqual(next.stages[0].validators_passed, ["tests-pass", "build-passes"]);
+});
+
+test("advanceStage: override.skipped_validators bypasses missing-validator block", () => {
+  const cwd = makeWorkspace();
+  createRun({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    taskDescription: "Test",
+  });
+
+  const next = advanceStage({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    stageName: "build",
+    artifactName: "changes.md",
+    frontmatter: { stage: "build", status: "complete", references: [] },
+    body: "# Changes",
+    validatorsPassed: ["tests-pass"],
+    override: {
+      reason: "Build infra is down on CI; skipping per ops-incident-2026-05-06",
+      skipped_validators: ["build-passes"],
+    },
+  });
+
+  assert.equal(next.outcome, "complete");
+  assert.equal(next.stages[0].override?.reason.includes("Build infra is down"), true);
+  assert.deepEqual(next.stages[0].override?.skipped_validators, ["build-passes"]);
+});
+
+test("advanceStage: blocked status is exempt from validator coverage check", () => {
+  const cwd = makeWorkspace();
+  createRun({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    taskDescription: "Test",
+  });
+
+  const next = advanceStage({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    stageName: "build",
+    artifactName: "changes.md",
+    frontmatter: { stage: "build", status: "blocked", references: [] },
+    body: "# Plan blocked\n\nMissing context.",
+    status: "blocked",
+    validatorsPassed: [], // exempt
+  });
+  assert.equal(next.outcome, "blocked");
+});
+
+test("advanceStage: override is stamped into the artifact frontmatter", () => {
+  const cwd = makeWorkspace();
+  createRun({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    taskDescription: "Test",
+  });
+
+  advanceStage({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    stageName: "build",
+    artifactName: "changes.md",
+    frontmatter: { stage: "build", status: "complete", references: [] },
+    body: "# Changes",
+    validatorsPassed: ["tests-pass"],
+    override: {
+      reason: "Hot fix, will follow up",
+      skipped_validators: ["build-passes"],
+    },
+  });
+
+  const text = fs.readFileSync(
+    path.join(cwd, ".agents", "task-1", "changes.md"),
+    "utf8",
+  );
+  assert.match(text, /override:/);
+  assert.match(text, /reason: Hot fix/);
+  assert.match(text, /- build-passes/);
+});
+
+test("composeStageEnvelope: renders VALIDATORS section when stage declares them", () => {
+  const cwd = makeWorkspace();
+  createRun({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+    taskDescription: "Test",
+  });
+
+  const env = composeStageEnvelope({
+    cwd,
+    taskId: "task-1",
+    workflow: WORKFLOW,
+  });
+
+  assert.match(env.prompt, /# VALIDATORS/);
+  assert.match(env.prompt, /`tests-pass` — Test suite must pass/);
+  assert.match(env.prompt, /`build-passes` — Build must succeed/);
+  assert.match(env.prompt, /`validators_passed: \[<id1>, <id2>, \.\.\.\]`/);
+  assert.deepEqual(env.validators.map((v) => v.id), ["tests-pass", "build-passes"]);
+});
+
+test("composeStageEnvelope: VALIDATORS section is empty when stage has none", () => {
+  const cwd = makeWorkspace();
+  const noValidators = {
+    ...WORKFLOW,
+    stages: [{ ...WORKFLOW.stages[0], validators: [] }],
+  };
+  createRun({
+    cwd,
+    taskId: "task-1",
+    workflow: noValidators,
+    taskDescription: "Test",
+  });
+
+  const env = composeStageEnvelope({
+    cwd,
+    taskId: "task-1",
+    workflow: noValidators,
+  });
+
+  assert.match(env.prompt, /No validators required for this stage/);
+  assert.equal(env.validators.length, 0);
+});
+
+test("runWorkflowAdvance MCP runner: forwards validators_passed + override", () => {
+  const cwd = makeWorkspace();
+  runWorkflowStart(
+    { task_id: "task-1", task_description: "x", workflow_id: "validated" },
+    { cwd, workflows: REGISTRY },
+  );
+
+  const result = runWorkflowAdvance(
+    {
+      task_id: "task-1",
+      stage: "build",
+      frontmatter: {},
+      body: "# Changes",
+      validators_passed: ["tests-pass"],
+      override: {
+        reason: "CI builder offline; manual verification done",
+        skipped_validators: ["build-passes"],
+        skipped_requirements: [],
+      },
+    },
+    { cwd, workflows: REGISTRY },
+  );
+
+  assert.equal(result.state.outcome, "complete");
+  assert.equal(
+    result.state.stages[0].override?.reason.includes("CI builder offline"),
+    true,
+  );
+});
+
+test("runWorkflowAdvance MCP runner: rejects missing validators without override", () => {
+  const cwd = makeWorkspace();
+  runWorkflowStart(
+    { task_id: "task-1", task_description: "x", workflow_id: "validated" },
+    { cwd, workflows: REGISTRY },
+  );
+
+  assert.throws(
+    () =>
+      runWorkflowAdvance(
+        {
+          task_id: "task-1",
+          stage: "build",
+          frontmatter: {},
+          body: "# Changes",
+          validators_passed: [],
+        },
+        { cwd, workflows: REGISTRY },
+      ),
+    /Missing: tests-pass, build-passes/,
+  );
+});