@orboto/mcp 0.184.1 → 0.185.0

package/dist/tools/review-policy-wrapper.test.js

@@ -0,0 +1,62 @@
+import { expect, it } from 'vitest';
+import { cp, mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+it('real wrapper preserves piped diff text and version-prefixed check/record values', async () => {
+    const dir = await mkdtemp(join(tmpdir(), 'orboto-1964-verify-temp-'));
+    const fingerprint = 'sha256-diff-v2:' + 'a'.repeat(64);
+    const calls = [];
+    const server = createServer(async (req, res) => {
+        let raw = '';
+        for await (const chunk of req)
+            raw += chunk.toString();
+        const url = req.url ?? '';
+        if (req.method === 'POST')
+            calls.push({ url, body: JSON.parse(raw) });
+        res.setHeader('Content-Type', 'application/json');
+        if (url === '/projects')
+            res.end(JSON.stringify([{ id: 'p', key: 'ORB' }]));
+        else if (url.includes('/tickets/by-key/'))
+            res.end(JSON.stringify({ id: 't', projectId: 'p', ticketKey: 'ORB-1964' }));
+        else
+            res.end(JSON.stringify({ fingerprint, algo: 'sha256-diff-v2' }));
+    });
+    try {
+        await mkdir(join(dir, 'skills/orboto'), { recursive: true });
+        await cp(new URL('../../../../skills/orboto/scripts', import.meta.url), join(dir, 'skills/orboto/scripts'), { recursive: true });
+        await new Promise((ok) => server.listen(0, '127.0.0.1', ok));
+        const address = server.address();
+        if (!address || typeof address === 'string')
+            throw new Error('Fixture address missing');
+        const origin = `http://127.0.0.1:${address.port}`;
+        const guard = join(dir, 'network.mjs');
+        await writeFile(guard, `const original = globalThis.fetch; globalThis.fetch = (input, init) => { if (new URL(input).origin !== ${JSON.stringify(origin)}) throw new Error('Fixture refused nonlocal request'); return original(input, init); };`);
+        const run = (args, stdin = '') => new Promise((ok, no) => {
+            const child = spawn(process.execPath, ['--import', guard, join(dir, 'skills/orboto/scripts/orboto.mjs'), ...args], {
+                cwd: dir, env: { ...process.env, ORBOTO_PROFILE: '', ORBOTO_BASE_URL: origin, ORBOTO_TOKEN: 'orb_fixture', ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' },
+                timeout: 20_000,
+            });
+            let out = '', err = '';
+            child.stdout.on('data', (chunk) => { out += chunk.toString(); });
+            child.stderr.on('data', (chunk) => { err += chunk.toString(); });
+            child.on('error', no);
+            child.on('close', (code) => code === 0 ? ok(out) : no(new Error(`Wrapper exit ${code}: ${err}`)));
+            child.stdin.end(stdin);
+        });
+        const diff = 'diff --git a/a b/a\r\n-old\r\n+  new  \r\n+\r\n';
+        expect(await run(['review-fingerprint'], diff)).toContain(fingerprint);
+        expect(calls[0]).toEqual({ url: '/review-policy/fingerprint', body: { diff } });
+        expect(await run(['review-check', 'ORB-1964', '--fingerprint', fingerprint])).toContain(fingerprint);
+        expect(await run(['review-approve', 'ORB-1964', '--fingerprint', fingerprint])).toContain(fingerprint);
+        expect(calls.slice(1).map((call) => call.body.fingerprint)).toEqual([fingerprint, fingerprint]);
+        expect(calls[2].body.decision).toBe('approved');
+    }
+    finally {
+        server.closeAllConnections();
+        if (server.listening)
+            await new Promise((ok, no) => server.close((err) => err ? no(err) : ok()));
+        await rm(dir, { recursive: true, force: true });
+    }
+}, 60_000);

package/dist/tools/review-policy.js

@@ -1,7 +1,7 @@
 /**
  * ORB-1615 - structural review policy tools.
  *
- *   - orboto_review_fingerprint     - normalize + hash raw diff text into a
+ *   - orboto_review_fingerprint     - hash exact raw diff text into a
  *                                     canonical fingerprint (+ real size
  *                                     metrics), server-side (one algorithm,
  *                                     not one per client).
@@ -23,7 +23,7 @@ import { resolveTicketByKey } from './shared.js';
 // ---------------------------------------------------------------------------
 export const reviewFingerprintToolConfig = {
     title: 'Compute a canonical diff fingerprint',
-    description: 'Normalize + hash raw diff text (e.g. `git diff` output) into a canonical fingerprint, server-side - so every agent hashes the same way instead of each fudging its own. Whitespace-only / blank-line-only edits and file ORDER are invisible to the hash (an approval survives a reflow); any real content change, a permission/mode change, or an added/removed/renamed file is NOT (an approval never survives those). Also returns real size metrics (filesChanged/linesAdded/linesRemoved/paths) derived from the same diff. Use the returned `fingerprint` with `orboto_review_policy_check` and `orboto_review_approval_record`.',
+    description: 'Hash the exact submitted diff text server-side with sha256-diff-v2. Every text change, including indentation, blank lines, binary blob identities, mode/rename metadata and file order, changes the fingerprint. This is submitted-text identity, NOT independent repository attestation. Returns size/path metrics too. Preserve the complete opaque version-prefixed `fingerprint` for `orboto_review_policy_check` and `orboto_review_approval_record`; legacy v1 approvals remain history only and must be reviewed again.',
     inputSchema: z.object({
         diff: z.string().min(1).describe('Raw unified diff text, e.g. the output of `git diff` / `git diff --no-color`.'),
     }).shape,
@@ -76,7 +76,7 @@ export function makeReviewPolicyCheckHandler(client) {
 // ---------------------------------------------------------------------------
 export const reviewApprovalRecordToolConfig = {
     title: 'Record a review decision against a diff fingerprint',
-    description: 'Record your review verdict (approve/reject) against a ticket\'s diff fingerprint (from orboto_review_fingerprint). A recorded APPROVAL is reusable: orboto_review_policy_check reports it as valid for the SAME fingerprint, letting a later finish/close skip re-review - until the diff changes, which produces a different fingerprint and naturally stops matching. Requires ticket:record_review_approval.',
+    description: 'Record your review verdict (approve/reject) against the complete version-prefixed fingerprint from orboto_review_fingerprint. A current-algorithm approval is reusable only for identical submitted diff text; even whitespace or file-order changes require a fresh review. Legacy/unversioned records remain history only. This advisory review ledger does not itself enforce ticket closure. Requires ticket:record_review_approval.',
     inputSchema: z.object({
         ticketKey: z.string().min(3).describe('Ticket key, e.g. ORB-42.'),
         fingerprint: z.string().min(8).describe('From orboto_review_fingerprint.'),

package/dist/tools/review-policy.test.js

@@ -21,14 +21,17 @@ function stub(responses) {
 const client = new OrbotoClient({ baseUrl: 'https://orboto.example.com', apiKey: 'orb_x' });
 const PROJ = { id: 'p1', key: 'ACME', name: 'Acme', description: null, status: 'active' };
 const TICKET = { id: 't1', projectId: 'p1', ticketKey: 'ACME-1', ticketNumber: 1, title: 'Bug', description: null, status: 'IN_PROGRESS', statusName: 'In Progress', statusCategory: 'in_progress', type: 'bug', priority: 'normal', estimatedTimeMinutes: 0, dueDate: null, isPrivate: false };
+const FINGERPRINT = 'sha256-diff-v2:' + 'a'.repeat(64);
 describe('orboto_review_fingerprint', () => {
     it('computes a fingerprint + size metrics from raw diff text', async () => {
-        const calls = stub([{ json: { fingerprint: 'abc123', algo: 'sha256-diff-v1', filesChanged: 1, linesAdded: 1, linesRemoved: 1, paths: ['src/foo.ts'] } }]);
-        const res = await makeReviewFingerprintHandler(client)({ diff: 'diff --git a/src/foo.ts b/src/foo.ts\n-a\n+b\n' });
+        const calls = stub([{ json: { fingerprint: FINGERPRINT, algo: 'sha256-diff-v2', filesChanged: 1, linesAdded: 1, linesRemoved: 1, paths: ['src/foo.ts'] } }]);
+        const diff = 'diff --git a/src/foo.ts b/src/foo.ts\r\n-a\r\n+  b  \r\n+\r\n';
+        const res = await makeReviewFingerprintHandler(client)({ diff });
         expect(calls[0].url).toContain('/review-policy/fingerprint');
         expect(calls[0].method).toBe('POST');
-        expect(res.structuredContent?.fingerprint).toBe('abc123');
-        expect(res.content[0].text).toContain('abc123');
+        expect(calls[0].body).toEqual({ diff });
+        expect(res.structuredContent).toMatchObject({ fingerprint: FINGERPRINT, algo: 'sha256-diff-v2' });
+        expect(res.content[0].text).toContain(FINGERPRINT);
     });
 });
 describe('orboto_review_policy_check', () => {
@@ -38,10 +41,10 @@ describe('orboto_review_policy_check', () => {
             fingerprintChecked: true, hasValidApproval: false, latestApproval: null,
         };
         const calls = stub([{ json: PROJ }, { json: TICKET }, { json: decision }]);
-        const res = await makeReviewPolicyCheckHandler(client)({ ticketKey: 'ACME-1', fingerprint: 'abc123' });
+        const res = await makeReviewPolicyCheckHandler(client)({ ticketKey: 'ACME-1', fingerprint: FINGERPRINT });
         const check = calls.find((c) => c.method === 'POST');
         expect(check?.url).toContain('/projects/p1/tickets/t1/review-policy/check');
-        expect(check?.body).toMatchObject({ fingerprint: 'abc123' });
+        expect(check?.body).toMatchObject({ fingerprint: FINGERPRINT });
         expect(res.structuredContent).toMatchObject({ riskLevel: 'required', hasValidApproval: false });
         expect(res.content[0].text).toContain('required');
         expect(res.content[0].text).toContain('No valid approval');
@@ -58,11 +61,11 @@ describe('orboto_review_policy_check', () => {
 });
 describe('orboto_review_approval_record', () => {
     it('records an approval against a fingerprint', async () => {
-        const approval = { id: 'ra1', ticketId: 't1', fingerprint: 'abc123', decision: 'approved', reviewerLabel: 'reviewer@orboto.test', note: null, revokedAt: null, createdAt: '2026-01-01T00:00:00Z' };
+        const approval = { id: 'ra1', ticketId: 't1', fingerprint: FINGERPRINT, decision: 'approved', reviewerLabel: 'reviewer@orboto.test', note: null, revokedAt: null, createdAt: '2026-01-01T00:00:00Z' };
         const calls = stub([{ json: PROJ }, { json: TICKET }, { json: approval }]);
-        const res = await makeReviewApprovalRecordHandler(client)({ ticketKey: 'ACME-1', fingerprint: 'abc123', decision: 'approved', note: 'looks good' });
+        const res = await makeReviewApprovalRecordHandler(client)({ ticketKey: 'ACME-1', fingerprint: FINGERPRINT, decision: 'approved', note: 'looks good' });
         const record = calls.find((c) => c.method === 'POST' && c.url.includes('review-approvals'));
-        expect(record?.body).toMatchObject({ fingerprint: 'abc123', decision: 'approved', note: 'looks good' });
+        expect(record?.body).toMatchObject({ fingerprint: FINGERPRINT, decision: 'approved', note: 'looks good' });
         // ticketKey must NOT leak into the request body sent to the API - the
         // route resolves the ticket from the URL, not the payload.
         expect(record?.body).not.toHaveProperty('ticketKey');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orboto/mcp",
-  "version": "0.184.1",
+  "version": "0.185.0",
   "description": "Model Context Protocol server for orboto - exposes tickets, projects, milestones, time, docs, primer-facts, alerts and absences as MCP tools for Claude Desktop / Cursor / Copilot Chat / any MCP-aware AI client.",
   "license": "MIT",
   "type": "module",
@@ -37,7 +37,7 @@
     "vitest": "^1.6.1"
   },
   "engines": {
-    "node": ">=20"
+    "node": "^22.20.0 || ^24.0.0"
   },
   "keywords": [
     "orboto",