@orboto/mcp 0.224.0 → 0.225.0

package/dist/required-rules-wrapper.test.js

@@ -5,6 +5,7 @@ import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { hermeticHome, hermeticSpawnEnv } from './test/hermetic-cli-env.js';
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
 const cleanup = [];
 afterEach(async () => { for (const fn of cleanup.splice(0).reverse())
@@ -43,7 +44,7 @@ async function fixture() {
     await writeFile(guard, `const original = globalThis.fetch; globalThis.fetch = (input, init) => { if (new URL(input).origin !== ${JSON.stringify(origin)}) throw new Error('Fixture refused a nonlocal request'); return original(input, init); };`);
     const run = (args = ['session-start', '--force-rules']) => new Promise((ok, no) => {
         const child = spawn(process.execPath, ['--import', guard, join(dir, 'skills/orboto/scripts/orboto.mjs'), ...args], {
-            cwd: dir, env: { ...process.env, ORBOTO_PROFILE: '', ORBOTO_BASE_URL: `http://127.0.0.1:${address.port}`, ORBOTO_TOKEN: 'orb_fixture', ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' },
+            cwd: dir, env: hermeticSpawnEnv({ home: hermeticHome('mcp-wrapper'), baseUrl: `http://127.0.0.1:${address.port}`, token: 'orb_fixture', env: { ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' } }),
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         let out = '', err = '';

package/dist/test/child-window-test-timeout.test.js

@@ -0,0 +1,20 @@
+import { expect, it } from 'vitest';
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const src = join(process.cwd(), 'src');
+function* testFiles(dir) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory())
+            yield* testFiles(full);
+        else if (entry.name.endsWith('.test.ts') && entry.name !== 'child-window-test-timeout.test.ts')
+            yield full;
+    }
+}
+it('every mcp test using childWindow() sets its own ciWindow test timeout above it', () => {
+    const offenders = [...testFiles(src)].filter((file) => {
+        const text = readFileSync(file, 'utf8');
+        return text.includes('childWindow()') && !/\}, ciWindow\(\d[\d_]*\)\);/.test(text);
+    });
+    expect(offenders).toEqual([]);
+});

package/dist/test/ci-window.js

@@ -0,0 +1,8 @@
+/** ORB-2231 - a wait window that grows fivefold on the loaded shared CI runner; mirrors apps/api/src/test/ci-window.ts and imports no vitest on purpose. */
+export function ciWindow(ms) {
+    return process.env.CI ? ms * 5 : ms;
+}
+/** ORB-2587 - the hang guard of one child process: 30 s, 5x on CI; the mcp runner timeout is 30 s unscaled, so a test using it sets its own ciWindow(...) test timeout. */
+export function childWindow() {
+    return ciWindow(30_000);
+}

package/dist/test/hermetic-cli-env.js

@@ -0,0 +1,42 @@
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/** ORB-2590 - the environment of every test that spawns the Go CLI or the skill wrapper: an allowlist, never process.env, so a developer's ~/.orboto bindings, ORBOTO_* and the parent harness's CLAUDE* markers cannot reach the child. */
+/** Runtime essentials and settings that do not identify the developer: the CLI reads CI (browser timeouts), a child may need the proxy, certificate and locale variables to reach the network. */
+export const INHERITED_NAMES = [
+    'PATH', 'SystemRoot', 'SYSTEMROOT', 'WINDIR', 'ComSpec', 'PATHEXT', 'CI',
+    'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy',
+    'NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE', 'SSL_CERT_DIR', 'LANG', 'LC_ALL', 'TZ',
+];
+const homes = new Set();
+/** A fresh empty HOME for one test; removed when the test process exits. */
+export function hermeticHome(label = 'spawn') {
+    const dir = mkdtempSync(join(tmpdir(), `orboto-hermetic-${label}-`));
+    homes.add(dir);
+    return dir;
+}
+process.once('exit', () => { for (const dir of homes) {
+    try {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    catch { /* best effort */ }
+} });
+/** HOME, USERPROFILE, XDG and temp dirs all inside `home`, the runtime essentials, an explicit instance, and only the `env` entries the test names. */
+export function hermeticSpawnEnv({ home, baseUrl, token, profile, env = {} }, inherited = process.env) {
+    const out = {
+        HOME: home, USERPROFILE: home, TMPDIR: home, TMP: home, TEMP: home,
+        XDG_CONFIG_HOME: join(home, '.config'), XDG_STATE_HOME: join(home, '.local', 'state'), XDG_CACHE_HOME: join(home, '.cache'),
+    };
+    for (const name of INHERITED_NAMES) {
+        const value = inherited[name];
+        if (value)
+            out[name] = value;
+    }
+    if (baseUrl !== undefined)
+        out.ORBOTO_BASE_URL = baseUrl;
+    if (token !== undefined)
+        out.ORBOTO_TOKEN = token;
+    if (profile !== undefined)
+        out.ORBOTO_PROFILE = profile;
+    return { ...out, ...env };
+}

package/dist/tools/doc-replace-wrapper.test.js

@@ -9,6 +9,8 @@ import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { childWindow, ciWindow } from '../test/ci-window.js';
+import { hermeticHome, hermeticSpawnEnv } from '../test/hermetic-cli-env.js';
 const DOC = 'd0c00000-2222-4222-8222-222222222222';
 const REV = 'bbbbbbbb-0000-4000-8000-000000000000';
 it('doc edit appends by default, --replace names the replaced revision, doc restore posts the restore', async () => {
@@ -45,8 +47,8 @@ it('doc edit appends by default, --replace names the replaced revision, doc rest
         await writeFile(guard, `const original = globalThis.fetch; globalThis.fetch = (input, init) => { if (new URL(input).origin !== ${JSON.stringify(origin)}) throw new Error('Fixture refused nonlocal request'); return original(input, init); };`);
         const run = (args) => new Promise((ok, no) => {
             const child = spawn(process.execPath, ['--import', guard, join(dir, 'skills/orboto/scripts/orboto.mjs'), ...args], {
-                cwd: dir, env: { ...process.env, ORBOTO_PROFILE: '', ORBOTO_BASE_URL: origin, ORBOTO_TOKEN: 'orb_fixture', ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' },
-                timeout: 20_000,
+                cwd: dir, env: hermeticSpawnEnv({ home: hermeticHome('mcp-wrapper'), baseUrl: origin, token: 'orb_fixture', env: { ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' } }),
+                timeout: childWindow(),
             });
             let out = '', err = '';
             child.stdout.on('data', (chunk) => { out += chunk.toString(); });
@@ -78,4 +80,4 @@ it('doc edit appends by default, --replace names the replaced revision, doc rest
             await new Promise((ok, no) => server.close((err) => err ? no(err) : ok()));
         await rm(dir, { recursive: true, force: true });
     }
-}, 60_000);
+}, ciWindow(60_000));

package/dist/tools/review-policy-wrapper.test.js

@@ -4,6 +4,8 @@ import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { childWindow, ciWindow } from '../test/ci-window.js';
+import { hermeticHome, hermeticSpawnEnv } from '../test/hermetic-cli-env.js';
 it('real wrapper preserves piped diff text and version-prefixed check/record values', async () => {
     const dir = await mkdtemp(join(tmpdir(), 'orboto-1964-verify-temp-'));
     const fingerprint = 'sha256-diff-v2:' + 'a'.repeat(64);
@@ -35,8 +37,8 @@ it('real wrapper preserves piped diff text and version-prefixed check/record val
         await writeFile(guard, `const original = globalThis.fetch; globalThis.fetch = (input, init) => { if (new URL(input).origin !== ${JSON.stringify(origin)}) throw new Error('Fixture refused nonlocal request'); return original(input, init); };`);
         const run = (args, stdin = '') => new Promise((ok, no) => {
             const child = spawn(process.execPath, ['--import', guard, join(dir, 'skills/orboto/scripts/orboto.mjs'), ...args], {
-                cwd: dir, env: { ...process.env, ORBOTO_PROFILE: '', ORBOTO_BASE_URL: origin, ORBOTO_TOKEN: 'orb_fixture', ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' },
-                timeout: 20_000,
+                cwd: dir, env: hermeticSpawnEnv({ home: hermeticHome('mcp-wrapper'), baseUrl: origin, token: 'orb_fixture', env: { ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' } }),
+                timeout: childWindow(),
             });
             let out = '', err = '';
             child.stdout.on('data', (chunk) => { out += chunk.toString(); });
@@ -59,4 +61,4 @@ it('real wrapper preserves piped diff text and version-prefixed check/record val
             await new Promise((ok, no) => server.close((err) => err ? no(err) : ok()));
         await rm(dir, { recursive: true, force: true });
     }
-}, 60_000);
+}, ciWindow(60_000));

package/dist/tools/semantic-degraded-wrapper.test.js

@@ -8,6 +8,8 @@ import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { childWindow, ciWindow } from '../test/ci-window.js';
+import { hermeticHome, hermeticSpawnEnv } from '../test/hermetic-cli-env.js';
 const LINE = 'semantic search unavailable, showing full-text results';
 it('search, search-docs, ask-docs and check-similar print the degraded line on stderr', async () => {
     const dir = await mkdtemp(join(tmpdir(), 'orboto-2543-wrapper-'));
@@ -45,8 +47,8 @@ it('search, search-docs, ask-docs and check-similar print the degraded line on s
         await writeFile(guard, `const original = globalThis.fetch; globalThis.fetch = (input, init) => { if (new URL(input).origin !== ${JSON.stringify(origin)}) throw new Error('Fixture refused nonlocal request'); return original(input, init); };`);
         const run = (args) => new Promise((ok, no) => {
             const child = spawn(process.execPath, ['--import', guard, join(dir, 'skills/orboto/scripts/orboto.mjs'), ...args], {
-                cwd: dir, env: { ...process.env, ORBOTO_PROFILE: '', ORBOTO_BASE_URL: origin, ORBOTO_TOKEN: 'orb_fixture', ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' },
-                timeout: 20_000,
+                cwd: dir, env: hermeticSpawnEnv({ home: hermeticHome('mcp-wrapper'), baseUrl: origin, token: 'orb_fixture', env: { ORBOTO_DAEMON: '', ORBOTO_AGENT_SESSION: 'fixture' } }),
+                timeout: childWindow(),
             });
             let out = '', err = '';
             child.stdout.on('data', (chunk) => { out += chunk.toString(); });
@@ -67,4 +69,4 @@ it('search, search-docs, ask-docs and check-similar print the degraded line on s
             await new Promise((ok, no) => server.close((err) => err ? no(err) : ok()));
         await rm(dir, { recursive: true, force: true });
     }
-}, 60_000);
+}, ciWindow(60_000));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orboto/mcp",
-  "version": "0.224.0",
+  "version": "0.225.0",
   "description": "Model Context Protocol server for orboto - exposes tickets, projects, milestones, time, docs, primer-facts, alerts and absences as MCP tools for Claude Desktop / Cursor / Copilot Chat / any MCP-aware AI client.",
   "license": "MIT",
   "type": "module",