@indigoai-us/hq-cli 5.77.14 → 5.79.0

package/src/commands/mcp-status.test.ts

@@ -1,483 +0,0 @@
-/**
- * Unit tests for `hq mcp status` + the append-only audit log (US-011).
- *
- * TEST SAFETY (hard requirement): EVERY test injects `env: { home }` = a fresh
- * tmpdir (realpathSync'd so macOS /tmp -> /private/tmp does not break path
- * equality) and cleans it in afterEach. NOTHING here reads or writes the
- * developer's real ~/.claude.json, ~/.mcp.json, ~/.codex, or ~/.hq. Mirrors the
- * `mkFakeHome` sandbox in mcp-registration.test.ts.
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-
-import {
-  computeMcpStatus,
-  renderMcpStatus,
-  computeMcpCapabilities,
-  renderMcpCapabilities,
-  type McpStatusReport,
-} from './mcp-status.js';
-import {
-  registerServer,
-  unregisterServer,
-  mcpRegistryLogPath,
-  appendAuditLog,
-  hashFileContents,
-  manifestTarget,
-  codexHome,
-  codexConfigPath,
-  claudeConfigPath,
-  SECRET_REDACTION,
-  type McpManifest,
-  type SafeWriteEnv,
-  type AuditLogEntry,
-} from './mcp-registration.js';
-
-// ---------------------------------------------------------------------------
-// Isolated-home sandbox.
-// ---------------------------------------------------------------------------
-
-let home: string;
-let env: SafeWriteEnv;
-
-function mkFakeHome(): string {
-  // realpathSync so macOS /tmp -> /private/tmp doesn't break path equality.
-  return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'hq-mcp-status-test-')));
-}
-
-beforeEach(() => {
-  home = mkFakeHome();
-  env = { home };
-});
-
-afterEach(() => {
-  fs.rmSync(home, { recursive: true, force: true });
-});
-
-/** The sentinel secret a resolver expands to — it must NEVER appear in output/log. */
-const SENTINEL_SECRET = 'FAKE-RESOLVED-SECRET-MUST-NEVER-LEAK';
-
-const HTTP_MANIFEST: McpManifest = {
-  type: 'http',
-  url: 'https://mcp.vyg.app',
-  headers: { Authorization: 'Bearer ${secret:VYG_API_KEY}' },
-};
-
-const STDIO_MANIFEST: McpManifest = {
-  type: 'stdio',
-  command: 'node',
-  args: ['server.js', '--port', '8080'],
-};
-
-/** Read every JSONL line from the audit log (or [] when absent). */
-function readAuditLines(): AuditLogEntry[] {
-  const p = mcpRegistryLogPath(env);
-  if (!fs.existsSync(p)) return [];
-  return fs
-    .readFileSync(p, 'utf-8')
-    .split('\n')
-    .filter((l) => l.trim().length > 0)
-    .map((l) => JSON.parse(l) as AuditLogEntry);
-}
-
-/** The raw audit-log text (for sentinel grepping). */
-function rawAuditText(): string {
-  const p = mcpRegistryLogPath(env);
-  return fs.existsSync(p) ? fs.readFileSync(p, 'utf-8') : '';
-}
-
-// ===========================================================================
-// computeMcpStatus / renderMcpStatus
-// ===========================================================================
-
-describe('US-011: computeMcpStatus — Claude-only server is PARTIAL (Codex named)', () => {
-  it('reports a Claude-only HQ server as PARTIAL with the missing Codex runtime named', () => {
-    // Register against Claude only (no ~/.codex => Codex is a first-class skip).
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-
-    const report = computeMcpStatus(env);
-    expect(report.servers).toHaveLength(1);
-    const s = report.servers[0]!;
-    expect(s.server).toBe('vyg');
-    expect(s.pack).toBe('hq-pack-vyg');
-    expect(s.transport).toBe('http');
-    expect(s.target).toBe('https://mcp.vyg.app');
-    expect(s.claude.presence).toBe('present');
-    expect(s.codex.presence).toBe('not-installed');
-    expect(s.partial).toBe(true);
-    expect(s.partialReason).toMatch(/Codex/);
-    expect(s.partialReason).toMatch(/not installed/i);
-    expect(s.drifted).toBe(false);
-
-    // Runtime flags.
-    expect(report.runtimes.claude.installed).toBe(true);
-    expect(report.runtimes.claude.parses).toBe(true);
-    expect(report.runtimes.codex.installed).toBe(false);
-  });
-
-  it('renders PARTIAL loudly with the missing runtime named, and never prints a header VALUE', () => {
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-    const text = renderMcpStatus(computeMcpStatus(env));
-    expect(text).toMatch(/PARTIAL/);
-    expect(text).toMatch(/Codex/);
-    // Header key is shown but the resolved secret value is NEVER in the clear.
-    expect(text).toContain('Authorization');
-    expect(text).not.toContain(SENTINEL_SECRET);
-    expect(text).toContain(SECRET_REDACTION);
-  });
-});
-
-describe('US-011: computeMcpStatus — both runtimes present => not partial; drift detection', () => {
-  it('a server registered in BOTH Claude and Codex is present in both and not partial', () => {
-    fs.mkdirSync(codexHome(env), { recursive: true });
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-    const report = computeMcpStatus(env);
-    const s = report.servers[0]!;
-    expect(s.claude.presence).toBe('present');
-    expect(s.codex.presence).toBe('present');
-    expect(s.partial).toBe(false);
-    expect(s.drifted).toBe(false);
-  });
-
-  it('flags DRIFT when the two runtimes carry different targets for the same server', () => {
-    // Claude gets the http manifest; hand-write a Codex def with a different url
-    // but the SAME provenance so both are HQ-owned and comparable.
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-    fs.mkdirSync(codexHome(env), { recursive: true });
-    fs.writeFileSync(
-      codexConfigPath(env),
-      [
-        '[mcp_servers.vyg]',
-        'type = "http"',
-        'url = "https://DIFFERENT.example.com"',
-        '_hqPack = "hq-pack-vyg"',
-        '',
-      ].join('\n'),
-    );
-    const report = computeMcpStatus(env);
-    const s = report.servers[0]!;
-    expect(s.claude.presence).toBe('present');
-    expect(s.codex.presence).toBe('present');
-    expect(s.partial).toBe(false);
-    expect(s.drifted).toBe(true);
-  });
-});
-
-describe('US-011: computeMcpStatus — robustness', () => {
-  it('reports an empty server list and ok runtimes on a fresh home (no crash)', () => {
-    const report = computeMcpStatus(env);
-    expect(report.servers).toEqual([]);
-    expect(report.runtimes.claude.parses).toBe(true);
-    expect(report.runtimes.codex.installed).toBe(false);
-    expect(report.backups.recent).toEqual([]);
-  });
-
-  it('marks a malformed ~/.claude.json as UNPARSEABLE instead of throwing', () => {
-    fs.writeFileSync(claudeConfigPath(env), '{ this is not json');
-    const report = computeMcpStatus(env);
-    expect(report.runtimes.claude.parses).toBe(false);
-    expect(report.servers).toEqual([]);
-    // Render does not crash and surfaces the unparseable state.
-    expect(renderMcpStatus(report)).toMatch(/UNPARSEABLE/);
-  });
-
-  it('does NOT report non-HQ (unstamped) servers — only _hqPack-owned ones', () => {
-    fs.writeFileSync(
-      claudeConfigPath(env),
-      JSON.stringify({
-        mcpServers: {
-          // A user-created server with NO _hqPack provenance — must be ignored.
-          figma: { type: 'http', url: 'https://figma.example' },
-        },
-      }),
-    );
-    const report = computeMcpStatus(env);
-    expect(report.servers).toEqual([]);
-  });
-
-  it('surfaces the backup root and the most-recent backup dirs (restore targets)', () => {
-    // registerServer takes a backup under ~/.hq/backups/mcp/<iso>-<pack>/ before writing.
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-      stamp: '2026-01-01T00-00-00Z',
-    });
-    const report = computeMcpStatus(env);
-    expect(report.backups.root).toBe(path.join(home, '.hq', 'backups', 'mcp'));
-    expect(report.backups.recent.length).toBeGreaterThanOrEqual(1);
-    expect(report.backups.recent[0]).toContain('hq-pack-vyg');
-  });
-});
-
-// ===========================================================================
-// Audit log
-// ===========================================================================
-
-describe('US-011: audit log — register appends a line with hashes and NO secret value', () => {
-  it('appends exactly one Claude line on a Claude-only register, with prev/new hashes and the URL (no secret)', () => {
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-
-    const lines = readAuditLines();
-    // Claude line + Codex skip line (PARTIAL must be reconstructable from the log).
-    expect(lines.length).toBe(2);
-
-    const claudeLine = lines.find((l) => l.file === claudeConfigPath(env) || l.file.endsWith('.claude.json'))!;
-    expect(claudeLine.action).toBe('register');
-    expect(claudeLine.pack).toBe('hq-pack-vyg');
-    expect(claudeLine.server).toBe('vyg');
-    expect(claudeLine.transport).toBe('http');
-    expect(claudeLine.target).toBe('https://mcp.vyg.app');
-    expect(claudeLine.result).toBe('registered');
-    // prevHash is '' (file did not exist before), newHash is a real sha256.
-    expect(claudeLine.prevHash).toBe('');
-    expect(claudeLine.newHash).toMatch(/^[0-9a-f]{64}$/);
-    // The Codex surface logs a 'skipped' line so PARTIAL is auditable.
-    const codexLine = lines.find((l) => l.result === 'skipped')!;
-    expect(codexLine).toBeDefined();
-    expect(codexLine.action).toBe('register');
-
-    // HARD: the resolved secret VALUE never appears anywhere in the log text.
-    expect(rawAuditText()).not.toContain(SENTINEL_SECRET);
-  });
-
-  it('records a stdio target as command+args (never a secret)', () => {
-    registerServer({
-      name: 'local',
-      manifest: STDIO_MANIFEST,
-      pack: 'hq-pack-local',
-      env,
-    });
-    const claudeLine = readAuditLines().find((l) => l.server === 'local' && l.result === 'registered')!;
-    expect(claudeLine.transport).toBe('stdio');
-    expect(claudeLine.target).toBe('node server.js --port 8080');
-  });
-
-  it('logs both surfaces (Claude registered + Codex registered) when ~/.codex exists', () => {
-    fs.mkdirSync(codexHome(env), { recursive: true });
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-    const lines = readAuditLines();
-    expect(lines.filter((l) => l.action === 'register' && l.result === 'registered').length).toBe(2);
-    expect(rawAuditText()).not.toContain(SENTINEL_SECRET);
-  });
-});
-
-describe('US-011: audit log — unregister appends a line with hashes and NO secret value', () => {
-  it('appends an unregister line with prev/new hashes when a server is removed', () => {
-    // First register (Claude-only), then unregister.
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-    // Clear the register lines so we assert only on the unregister.
-    fs.rmSync(mcpRegistryLogPath(env), { force: true });
-
-    unregisterServer({ name: 'vyg', pack: 'hq-pack-vyg', env });
-
-    const lines = readAuditLines();
-    expect(lines.length).toBeGreaterThanOrEqual(1);
-    const claudeLine = lines.find((l) => l.action === 'unregister' && l.result === 'unregistered')!;
-    expect(claudeLine).toBeDefined();
-    expect(claudeLine.pack).toBe('hq-pack-vyg');
-    expect(claudeLine.server).toBe('vyg');
-    // transport/target derived from the on-disk def before removal.
-    expect(claudeLine.transport).toBe('http');
-    expect(claudeLine.target).toBe('https://mcp.vyg.app');
-    // prevHash (file present) is a real sha256; newHash differs (entry removed).
-    expect(claudeLine.prevHash).toMatch(/^[0-9a-f]{64}$/);
-    expect(claudeLine.prevHash).not.toBe(claudeLine.newHash);
-
-    // HARD: no secret value in the log.
-    expect(rawAuditText()).not.toContain(SENTINEL_SECRET);
-  });
-
-  it('logs a noop unregister (server already absent) without throwing', () => {
-    unregisterServer({ name: 'ghost', pack: 'hq-pack-ghost', env });
-    const lines = readAuditLines();
-    const claudeLine = lines.find((l) => l.action === 'unregister')!;
-    expect(claudeLine.result).toBe('noop');
-    expect(claudeLine.prevHash).toBe(claudeLine.newHash); // no-op: hashes equal.
-  });
-});
-
-describe('US-011: audit-log helpers', () => {
-  it('mcpRegistryLogPath is ~/.hq/logs/mcp-registry.log', () => {
-    expect(mcpRegistryLogPath(env)).toBe(path.join(home, '.hq', 'logs', 'mcp-registry.log'));
-  });
-
-  it('appendAuditLog creates ~/.hq/logs and appends one JSON line', () => {
-    const entry: AuditLogEntry = {
-      ts: '2026-01-01T00:00:00.000Z',
-      action: 'register',
-      pack: 'p',
-      server: 's',
-      transport: 'http',
-      target: 'https://x.example',
-      file: '/tmp/x',
-      prevHash: '',
-      newHash: 'abc',
-      result: 'registered',
-    };
-    appendAuditLog(env, entry);
-    appendAuditLog(env, entry);
-    const lines = readAuditLines();
-    expect(lines.length).toBe(2);
-    expect(lines[0]).toEqual(entry);
-  });
-
-  it('appendAuditLog defensively redacts a secret that lands in the target field', () => {
-    appendAuditLog(
-      env,
-      {
-        ts: '2026-01-01T00:00:00.000Z',
-        action: 'register',
-        pack: 'p',
-        server: 's',
-        transport: 'http',
-        target: `Bearer ${SENTINEL_SECRET}`,
-        file: '/tmp/x',
-        prevHash: '',
-        newHash: 'abc',
-        result: 'registered',
-      },
-      [SENTINEL_SECRET],
-    );
-    const raw = rawAuditText();
-    expect(raw).not.toContain(SENTINEL_SECRET);
-    expect(raw).toContain(SECRET_REDACTION);
-  });
-
-  it('appendAuditLog is best-effort: it never throws even if the log dir cannot be created', () => {
-    // Point home at a path whose parent is a FILE so mkdir would fail; append must swallow.
-    const fileAsHome = path.join(home, 'a-file');
-    fs.writeFileSync(fileAsHome, 'x');
-    const badEnv: SafeWriteEnv = { home: path.join(fileAsHome, 'nested') };
-    expect(() =>
-      appendAuditLog(badEnv, {
-        ts: 't',
-        action: 'register',
-        pack: 'p',
-        server: 's',
-        transport: 'http',
-        target: '',
-        file: '',
-        prevHash: '',
-        newHash: '',
-        result: 'registered',
-      }),
-    ).not.toThrow();
-  });
-
-  it('hashFileContents returns a sha256 for a present file and "" for an absent one', () => {
-    const f = path.join(home, 'f.txt');
-    fs.writeFileSync(f, 'hello');
-    expect(hashFileContents(f)).toMatch(/^[0-9a-f]{64}$/);
-    expect(hashFileContents(path.join(home, 'nope.txt'))).toBe('');
-  });
-
-  it('manifestTarget derives url for http/sse and command+args for stdio', () => {
-    expect(manifestTarget(HTTP_MANIFEST)).toBe('https://mcp.vyg.app');
-    expect(manifestTarget(STDIO_MANIFEST)).toBe('node server.js --port 8080');
-    expect(manifestTarget({ type: 'sse', url: 'https://s.example' })).toBe('https://s.example');
-  });
-});
-
-describe('US-011: JSON report shape (for CI / US-013 assertions)', () => {
-  it('computeMcpStatus output round-trips through JSON.stringify with stable keys', () => {
-    registerServer({
-      name: 'vyg',
-      manifest: HTTP_MANIFEST,
-      pack: 'hq-pack-vyg',
-      resolveSecret: () => SENTINEL_SECRET,
-      env,
-    });
-    const report = computeMcpStatus(env);
-    const json = JSON.parse(JSON.stringify(report)) as McpStatusReport;
-    expect(json.servers[0]!.server).toBe('vyg');
-    expect(json.runtimes.claude.installed).toBe(true);
-    expect(json.backups.root).toContain('.hq');
-    // No secret leaked into the serialized report.
-    expect(JSON.stringify(report)).not.toContain(SENTINEL_SECRET);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// US-012: MCP capability advertisement (`hq mcp capabilities`)
-//
-// `hq` advertises that THIS hq-cli supports contributes.mcp (dual-runtime
-// Claude+Codex registration). computeMcpCapabilities is PURE (no IO/env) — the
-// answer is a property of the CLI build — and renderMcpCapabilities formats it.
-// ---------------------------------------------------------------------------
-
-describe('US-012: computeMcpCapabilities — capability advertisement', () => {
-  it('advertises contributes.mcp dual-runtime support with the expected shape', () => {
-    const caps = computeMcpCapabilities();
-    expect(caps.supportsMcp).toBe(true);
-    expect(caps.contributes).toEqual(['mcp']);
-    expect(caps.runtimes).toEqual(['claude', 'codex']);
-    expect(caps.transports).toEqual(['http', 'stdio', 'sse']);
-  });
-
-  it('is pure — repeated calls return an equal object and take no env', () => {
-    expect(computeMcpCapabilities()).toEqual(computeMcpCapabilities());
-  });
-
-  it('round-trips through JSON (the --json surface) without loss', () => {
-    const caps = computeMcpCapabilities();
-    expect(JSON.parse(JSON.stringify(caps))).toEqual(caps);
-  });
-
-  it('renderMcpCapabilities names MCP support + both runtimes + every transport', () => {
-    const text = renderMcpCapabilities(computeMcpCapabilities());
-    expect(text).toMatch(/supports MCP: yes/);
-    expect(text).toMatch(/contributes:.*mcp/);
-    expect(text).toMatch(/claude/);
-    expect(text).toMatch(/codex/);
-    expect(text).toMatch(/http/);
-    expect(text).toMatch(/stdio/);
-    expect(text).toMatch(/sse/);
-  });
-});