@indigoai-us/hq-cli 5.50.0 → 5.50.2

package/test/e2e/smoke-install-mcp.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# ---------------------------------------------------------------------------
+# smoke-install-mcp.sh — TRUE end-to-end smoke test of `hq install` for
+# MCP-bearing packs, in a fully isolated sandbox.
+#
+# Unlike the vitest suite (which unit-tests mcp-registration.ts against an
+# injected $HOME), this drives the REAL built `hq` CLI through a REAL
+# `hq install` against REAL packs, so it catches WIRING gaps unit tests miss —
+# e.g. "registerMcpServers is implemented + tested but installPack never calls
+# it" (the exact bug this harness first caught).
+#
+# It NEVER touches the developer's real ~/.claude.json, ~/.mcp.json, or
+# ~/.codex/config.toml — everything lives under a mktemp sandbox HOME, and the
+# install targets a sandbox HQ root.
+#
+# Two packs, two paths:
+#   A) hq-pack-smoke-mcp  (no-secret fixture) → MUST register into both configs
+#   B) vyg-shopify-hq-pack (needs ${secret:VYG_API_KEY}) → MUST defer gracefully
+#      (install succeeds, server NOT registered, "connect first" warning shown)
+#
+# Usage:   bash test/e2e/smoke-install-mcp.sh [--keep]
+# Exit 0 = all checks pass.   Exit 1 = at least one failed.
+# ---------------------------------------------------------------------------
+set -uo pipefail
+
+CLI_REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HQ_ROOT_REAL="$(cd "$CLI_REPO/../../.." && pwd)"             # …/HQ
+CLI="$CLI_REPO/dist/index.js"
+FIXTURE="$CLI_REPO/test/fixtures/hq-pack-smoke-mcp"          # no-secret pack
+VYG="$HQ_ROOT_REAL/repos/private/vyg-shopify-hq-pack"        # secret-bearing pack
+KEEP=0; [ "${1:-}" = "--keep" ] && KEEP=1
+
+pass=0; fail=0
+ok()  { echo "  ✓ $1"; pass=$((pass+1)); }
+bad() { echo "  ✗ $1"; fail=$((fail+1)); }
+
+[ -f "$CLI" ]     || { echo "FATAL: build first (npm run build) — missing $CLI"; exit 2; }
+[ -d "$FIXTURE" ] || { echo "FATAL: fixture pack missing at $FIXTURE"; exit 2; }
+command -v node >/dev/null || { echo "FATAL: node not on PATH"; exit 2; }
+
+SBX="$(mktemp -d -t hq-smoke-mcp.XXXXXX)"
+SBX_HOME="$SBX/home"; SBX_HQ="$SBX/hq"
+cleanup() { [ "$KEEP" = 1 ] && { echo "sandbox kept: $SBX"; return; }; rm -rf "$SBX"; }
+trap cleanup EXIT
+
+mkdir -p "$SBX_HOME/.codex" "$SBX_HQ/core/packages" "$SBX_HQ/core/workers/public" \
+         "$SBX_HQ/core/knowledge/public/hq-core" "$SBX_HQ/core/policies" \
+         "$SBX_HQ/core/hooks" "$SBX_HQ/.claude/skills" "$SBX_HQ/.claude/commands" \
+         "$SBX_HQ/companies"
+cp -R "$HQ_ROOT_REAL/core/scripts" "$SBX_HQ/core/scripts"
+# Pin the sandbox host version at the M1 floor (>=15.1.0). Copying the live
+# core.yaml is unreliable — hq-sync can reset it below the floor (e.g. 15.0.24),
+# which makes the floor check CORRECTLY refuse the test packs (they require
+# >=15.1.0). This harness exercises the install path; floor-refusal has its own
+# unit test. Pin a satisfying version so the install path is what's under test.
+printf 'hqVersion: "15.1.0"\n' > "$SBX_HQ/core/core.yaml"
+cp "$HQ_ROOT_REAL/core/knowledge/public/hq-core/mcp-manifest.schema.json" \
+   "$SBX_HQ/core/knowledge/public/hq-core/mcp-manifest.schema.json"
+printf 'companies: {}\n' > "$SBX_HQ/companies/manifest.yaml"
+
+# pre-existing non-HQ servers that MUST survive every install/uninstall
+echo '{ "mcpServers": { "figma": { "type": "http", "url": "https://figma.example.test/mcp" } } }' > "$SBX_HOME/.claude.json"
+printf '# user existing codex config\n[mcp_servers.node_repl]\ncommand = "node"\nargs = ["--repl"]\n' > "$SBX_HOME/.codex/config.toml"
+
+# Always run from inside the sandbox HQ root. The CLI resolves the HQ root by
+# walking up from cwd (utils/manifest.js findHqRoot), NOT from $HQ_ROOT — so the
+# cwd is what actually scopes install/uninstall. (We still export HQ_ROOT for the
+# code paths that DO honor it, e.g. scan-packages.) Without the cd, `packs
+# uninstall` resolves the developer's real HQ root and silently no-ops.
+run_hq() { ( cd "$SBX_HQ" && HOME="$SBX_HOME" HQ_ROOT="$SBX_HQ" node "$CLI" "$@" ); }
+claude_has() { node -e "try{const j=require('$SBX_HOME/.claude.json');process.stdout.write(j.mcpServers&&j.mcpServers['$1']?'1':'0')}catch(e){process.stdout.write('0')}"; }
+codex_has()  { c=$(grep -c "\[mcp_servers.$1\]" "$SBX_HOME/.codex/config.toml" 2>/dev/null); echo "${c:-0}"; }
+
+echo "=== HQ MCP install smoke test ==="
+echo "sandbox: $SBX"; echo
+
+# ---- A) NO-SECRET FIXTURE → must register ---------------------------------
+echo "[A] install no-secret fixture (hq-pack-smoke-mcp) — must REGISTER"
+OUT="$(cd "$SBX_HQ" && run_hq install "$FIXTURE" --allow-mcp --allow-hooks 2>&1)"; rc=$?
+echo "$OUT" | sed 's/^/      /'
+[ $rc -eq 0 ] && ok "install exited 0" || bad "install exited $rc"
+[ "$(claude_has smoke-http)" = "1" ] && ok "smoke-http registered in ~/.claude.json" || bad "smoke-http MISSING from ~/.claude.json"
+[ "$(codex_has smoke-http)" -ge 1 ] && ok "smoke-http registered in ~/.codex/config.toml" || bad "smoke-http MISSING from ~/.codex/config.toml"
+[ "$(claude_has figma)" = "1" ]     && ok "figma preserved" || bad "figma LOST"
+[ "$(codex_has node_repl)" -ge 1 ]  && ok "node_repl table preserved" || bad "node_repl LOST"
+if grep -rqiE 'X-Smoke.*static-not-a-secret' "$SBX_HOME/.claude.json"; then ok "static header written (http client usable)"; else bad "static header missing from registered server"; fi
+
+echo "[A.2] hq mcp status --json reports it"
+ST="$(run_hq mcp status --json 2>&1)"
+echo "$ST" | grep -q 'smoke-http' && ok "mcp status reports smoke-http" || bad "mcp status missing smoke-http"
+
+echo "[A.3] uninstall round-trip"
+run_hq packs uninstall hq-pack-smoke-mcp --yes >/dev/null 2>&1 || run_hq packs uninstall hq-pack-smoke-mcp >/dev/null 2>&1
+[ "$(claude_has smoke-http)" = "0" ] && ok "smoke-http removed on uninstall" || bad "smoke-http still present after uninstall"
+[ "$(claude_has figma)" = "1" ]     && ok "figma still preserved after uninstall" || bad "figma lost during uninstall"
+
+# ---- B) VYG PACK (needs a vault secret) → must DEFER gracefully -----------
+echo
+echo "[B] install vyg pack (needs \${secret:VYG_API_KEY}, not in vault) — must DEFER gracefully"
+if [ -d "$VYG" ]; then
+  OUT="$(cd "$SBX_HQ" && run_hq install "$VYG" --allow-mcp --allow-hooks 2>&1)"; rc=$?
+  echo "$OUT" | sed 's/^/      /'
+  [ $rc -eq 0 ] && ok "install exited 0 (did not abort on the missing secret)" || bad "install aborted (rc=$rc) on missing secret"
+  [ "$(claude_has vyg-shopify)" = "0" ] && ok "vyg-shopify correctly DEFERRED (not registered without its key)" || bad "vyg-shopify registered despite missing secret"
+  echo "$OUT" | grep -qiE "VYG_API_KEY|connect-shopify|needs secret" && ok "clear 'provision the key' guidance shown" || bad "no deferral guidance shown to the user"
+  [ "$(claude_has figma)" = "1" ] && ok "figma still preserved through the deferred install" || bad "figma LOST during deferred install"
+else
+  echo "  · vyg pack not present — skipping deferral checks"
+fi
+
+echo
+echo "=== RESULT: $pass passed · $fail failed ==="
+[ $fail -eq 0 ] && exit 0 || exit 1

package/test/fixtures/hq-pack-smoke-mcp/mcp/smoke-http.json

@@ -0,0 +1 @@
+{ "type": "http", "url": "https://smoke.example.test/mcp", "headers": { "X-Smoke": "static-not-a-secret" } }

package/test/fixtures/hq-pack-smoke-mcp/package.yaml

@@ -0,0 +1,11 @@
+name: hq-pack-smoke-mcp
+version: 0.0.1
+publisher: '@indigoai-us'
+access: public
+description: 'No-secret MCP pack — e2e smoke fixture for install registration.'
+requires:
+  hqCore: '>=15.1.0'
+capabilities: [network]
+contributes:
+  mcp:
+    - smoke-http