@orygn/opa-mcp 0.4.0 → 0.5.0

package/dist/tools/bundles/verify.js

@@ -1,10 +1,19 @@
 /**
- * `opa_bundle_verify` -- verify the cryptographic signature of a signed
- * OPA bundle via `opa eval --bundle --verification-key`.
+ * `opa_bundle_verify` -- verify the signature of a signed OPA bundle.
+ *
+ * OPA has no standalone verify command. The check runs as
+ * `opa build --verification-key` into a temp file that is discarded; see
+ * `OpaCli.bundleVerify`. A directory is verified by name from its parent, the
+ * same way `opa_bundle_sign` signs it. OPA reports the first failure it hits,
+ * and the reason is classified into `details.reason` so a caller can tell a
+ * wrong key from a tampered file.
  */
+import { realpath, stat } from 'node:fs/promises';
+import { basename, dirname } from 'node:path';
 import { z } from 'zod';
-import { OpaCli } from '../../lib/opa-cli.js';
+import { classifyVerificationFailure } from '../../lib/bundle-signatures.js';
 import { err, ok } from '../../lib/errors.js';
+import { OpaCli } from '../../lib/opa-cli.js';
 import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
 const OpaBundleVerifyInput = {
     bundle: z
@@ -14,11 +23,11 @@ const OpaBundleVerifyInput = {
     verificationKey: z
         .string()
         .min(1)
-        .describe('Path to the PEM file containing the RSA or ECDSA public key, or the path to the HMAC secret file. Must be inside an allowed root.'),
+        .describe('Path to the PEM file containing the RSA or ECDSA public key, or for HMAC algorithms a file holding the secret. Must be inside an allowed root.'),
     verificationKeyId: z
         .string()
         .optional()
-        .describe('Key ID that must match the `keyid` field in the bundle signature. Required when the bundle was signed with `--public-key-id`.'),
+        .describe('Name the key is registered under for OPA (`--verification-key-id`, default `default`). With a single key OPA verifies against it regardless of the signature keyid claim, so this rarely needs setting.'),
     signingAlg: z
         .string()
         .optional()
@@ -26,13 +35,24 @@ const OpaBundleVerifyInput = {
     scope: z
         .string()
         .optional()
-        .describe('Expected `scope` value in the bundle signature. Required when the bundle was signed with `--scope`.'),
+        .describe('Expected `scope` claim in the signature. Pass exactly the value the bundle was signed with, and nothing if it was signed without one; the failure reason is scope_mismatch otherwise.'),
+    v0Compatible: z
+        .boolean()
+        .optional()
+        .describe('Load the bundle as Rego v0 (`--v0-compatible`). A policy written before Rego v1 otherwise fails to load, after the signature and digests have already been checked.'),
 };
 export function registerOpaBundleVerify(server, config) {
     const opa = new OpaCli(config);
     server.registerTool('opa_bundle_verify', {
         title: 'Verify OPA bundle signature',
-        description: 'Verify the cryptographic signature of a signed OPA bundle using `opa eval --bundle --verification-key`. The bundle must have been signed with `opa sign` (or `opa_bundle_sign`). OPA checks the `.signatures.json` manifest inside the bundle against the provided public key before loading any policy -- a tampered or unsigned bundle will fail with `INVALID_BUNDLE`. Returns `{ bundle, verified: true }` on success.',
+        description: 'Verify the signature of a signed bundle directory or `.tar.gz` archive with the public key. ' +
+            'OPA has no standalone verify command, so this runs `opa build --verification-key` into a private temp file that is discarded. ' +
+            'A directory is verified by name from its parent, matching how `opa_bundle_sign` signs it. ' +
+            'OPA reads the key, checks the JWT in `.signatures.json`, compares the scope claim, then checks every file: Rego files by digest before parsing, data files and `.manifest` by parsed value, so an unparseable data file fails before its digest is compared. ' +
+            'Failures return `INVALID_BUNDLE` with `details.reason` set to one of signature_invalid, scope_mismatch, file_modified, file_added, file_missing, file_unparseable, unsigned, signatures_malformed, not_a_bundle, bundle_load_error, or unknown when the message is not recognised; the raw output is in `details`. ' +
+            'A key or algorithm OPA cannot use returns `INVALID_INPUT`. ' +
+            'Pass `scope` exactly as the bundle was signed with. With a single key OPA does not check `verificationKeyId` against the signature keyid claim. ' +
+            '`verified: true` is returned only when OPA loaded the bundle with its signature intact.',
         inputSchema: OpaBundleVerifyInput,
         annotations: {
             readOnlyHint: true,
@@ -48,23 +68,42 @@ export function registerOpaBundleVerify(server, config) {
             if (!validation.ok)
                 return validation.error;
             const [resolvedBundle, resolvedKey] = validation.resolved;
-            const result = await opa.bundleVerify({
-                bundle: resolvedBundle,
+            // Same resolution as the sign tool: OPA does not descend a symlink or
+            // junction root, and a directory's signature names files under the
+            // directory name, so a directory is loaded by name from its parent.
+            const realBundle = await realpath(resolvedBundle);
+            const isDirectory = (await stat(realBundle)).isDirectory();
+            const verifyInput = {
+                bundle: isDirectory ? basename(realBundle) : realBundle,
                 verificationKey: resolvedKey,
-                verificationKeyId: input.verificationKeyId,
-                signingAlg: input.signingAlg,
-                scope: input.scope,
-            }, signal);
+            };
+            if (isDirectory)
+                verifyInput.cwd = dirname(realBundle);
+            if (input.verificationKeyId !== undefined) {
+                verifyInput.verificationKeyId = input.verificationKeyId;
+            }
+            if (input.signingAlg !== undefined)
+                verifyInput.signingAlg = input.signingAlg;
+            if (input.scope !== undefined)
+                verifyInput.scope = input.scope;
+            if (input.v0Compatible)
+                verifyInput.v0Compatible = true;
+            const result = await opa.bundleVerify(verifyInput, signal);
             const subprocessFailure = mapSubprocessFailure(result, 'opa');
             if (subprocessFailure)
                 return subprocessFailure;
             if (result.exitCode !== 0) {
-                return err('INVALID_BUNDLE', 'Bundle signature verification failed.', {
-                    details: {
-                        stderr: result.stderr.trim(),
-                        stdout: result.stdout.trim(),
-                    },
-                });
+                // opa build prints the reason on stdout, not stderr.
+                const failure = classifyVerificationFailure(`${result.stdout}\n${result.stderr}`);
+                const details = {
+                    reason: failure.reason,
+                    stdout: result.stdout.trim(),
+                    stderr: result.stderr.trim(),
+                };
+                if (failure.reason === 'key_invalid') {
+                    return err('INVALID_INPUT', `The verification key or algorithm could not be used: ${failure.summary}.`, { hint: failure.hint, details });
+                }
+                return err('INVALID_BUNDLE', `Bundle signature verification failed: ${failure.summary}.`, { hint: failure.hint, details });
             }
             return ok({ bundle: input.bundle, verified: true });
         });

package/dist/tools/bundles/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/tools/bundles/verify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,oBAAoB,GAAG;IAC3B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,2FAA2F,CAC5F;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,mIAAmI,CACpI;IACH,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,+HAA+H,CAChI;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,mHAAmH,CACpH;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qGAAqG,CACtG;CACJ,CAAC;AAOF,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,4ZAA4Z;QAC9Z,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAwB,MAAM,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE;gBAC9E,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;YAE1D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CACnC;gBACE,MAAM,EAAE,cAAe;gBACvB,eAAe,EAAE,WAAY;gBAC7B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,EACD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,gBAAgB,EAAE,uCAAuC,EAAE;oBACpE,OAAO,EAAE;wBACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;wBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;qBAC7B;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAwB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/tools/bundles/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAA0B,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,oBAAoB,GAAG;IAC3B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,2FAA2F,CAC5F;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,gJAAgJ,CACjJ;IACH,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yMAAyM,CAC1M;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,mHAAmH,CACpH;IACH,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uLAAuL,CACxL;IACH,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,qKAAqK,CACtK;CACJ,CAAC;AAOF,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,8FAA8F;YAC9F,gIAAgI;YAChI,4FAA4F;YAC5F,+PAA+P;YAC/P,qTAAqT;YACrT,6DAA6D;YAC7D,kJAAkJ;YAClJ,yFAAyF;QAC3F,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAwB,MAAM,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE;gBAC9E,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAC5C,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;YAE1D,sEAAsE;YACtE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,cAAe,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAE3D,MAAM,WAAW,GAAsB;gBACrC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU;gBACvD,eAAe,EAAE,WAAY;aAC9B,CAAC;YACF,IAAI,WAAW;gBAAE,WAAW,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC1C,WAAW,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC;YAC1D,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,WAAW,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,WAAW,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC/D,IAAI,KAAK,CAAC,YAAY;gBAAE,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC;YAExD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAE3D,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,qDAAqD;gBACrD,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClF,MAAM,OAAO,GAAG;oBACd,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;oBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;iBAC7B,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;oBACrC,OAAO,GAAG,CACR,eAAe,EACf,wDAAwD,OAAO,CAAC,OAAO,GAAG,EAC1E,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAChC,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,CACR,gBAAgB,EAChB,yCAAyC,OAAO,CAAC,OAAO,GAAG,EAC3D,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAChC,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAwB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA0B9C,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA0D5E"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA4B9C,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuE5E"}

package/dist/tools/conftest/pull.js

@@ -17,6 +17,8 @@
  *   0     -- pull succeeded
  *   non-0 -- network / auth error
  */
+import { mkdir } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
 import { z } from 'zod';
 import { ConftestCli } from '../../lib/conftest-cli.js';
 import { err, ok } from '../../lib/errors.js';
@@ -35,8 +37,12 @@ const ConftestPullInput = {
         .optional()
         .describe('Local directory where the pulled policies will be written. ' +
         'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). ' +
-        "Defaults to `./policy` (conftest's convention)."),
+        'Omitted, it falls back to `policy` in the working directory of the server process, the conftest convention, which must itself sit inside an allowed root. ' +
+        'The directory is emptied before the pull, so do not point it at one holding anything ' +
+        'you want to keep.'),
 };
+/** Where conftest looks when `--policy` is not given, as an absolute path. */
+const DEFAULT_POLICY_DIR = resolve('policy');
 export function registerConftestPull(server, config) {
     const conftest = new ConftestCli(config);
     server.registerTool('conftest_pull', {
@@ -59,24 +65,32 @@ export function registerConftestPull(server, config) {
     }, async (input, { signal }) => {
         return withToolEnvelope(config, async () => {
             // ── Path validation ──────────────────────────────────────────────
-            // The policy directory does not have to exist yet -- conftest will
-            // create it. Validate only that the parent is within allowed roots
-            // by validating the path itself (without mustExist).
-            if (input.policy !== undefined) {
-                const v = validatePaths([input.policy], config);
-                if (!v.ok)
+            // The directory does not have to exist yet; conftest creates it. An
+            // omitted path means conftest's own default, which it resolves against
+            // the working directory. This tool writes files, so that default is
+            // checked against the allow-list too rather than escaping it by being
+            // implicit.
+            const v = validatePaths([input.policy ?? DEFAULT_POLICY_DIR], config);
+            if (!v.ok) {
+                if (input.policy !== undefined)
                     return v.error;
-                input = { ...input, policy: v.resolved[0] };
+                return err('PATH_NOT_ALLOWED', 'The conftest default policy directory is outside the allowed roots.', {
+                    hint: 'Pass `policy` with a directory inside OPA_MCP_ALLOWED_PATHS.',
+                    details: { defaultPolicyDir: DEFAULT_POLICY_DIR },
+                });
             }
+            const policyDir = v.resolved[0];
+            // conftest runs from the parent, so the parent has to exist.
+            await mkdir(dirname(policyDir), { recursive: true });
             // ── Run conftest pull ────────────────────────────────────────────
-            const result = await conftest.pull({ url: input.url, policy: input.policy }, signal);
+            const result = await conftest.pull({ url: input.url, policy: policyDir }, signal);
             const subprocessFailure = mapSubprocessFailure(result, 'conftest');
             if (subprocessFailure)
                 return subprocessFailure;
             if (result.exitCode === 0) {
                 return ok({
                     url: input.url,
-                    policyDir: input.policy ?? 'policy',
+                    policyDir,
                 });
             }
             const detail = result.stderr.trim() || result.stdout.trim();

package/dist/tools/conftest/pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yCAAyC;QACvC,4CAA4C;QAC5C,qDAAqD;QACrD,uDAAuD;QACvD,gEAAgE,CACnE;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6DAA6D;QAC3D,0DAA0D;QAC1D,iDAAiD,CACpD;CACJ,CAAC;AASF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,wFAAwF;YACxF,yEAAyE;YACzE,+DAA+D;YAC/D,+EAA+E;YAC/E,mFAAmF;YACnF,mFAAmF;YACnF,uEAAuE;QACzE,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YAErF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yCAAyC;QACvC,4CAA4C;QAC5C,qDAAqD;QACrD,uDAAuD;QACvD,gEAAgE,CACnE;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6DAA6D;QAC3D,0DAA0D;QAC1D,4JAA4J;QAC5J,uFAAuF;QACvF,mBAAmB,CACtB;CACJ,CAAC;AASF,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,wFAAwF;YACxF,yEAAyE;YACzE,+DAA+D;YAC/D,+EAA+E;YAC/E,mFAAmF;YACnF,mFAAmF;YACnF,uEAAuE;QACzE,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,oEAAoE;YACpE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC/C,OAAO,GAAG,CACR,kBAAkB,EAClB,qEAAqE,EACrE;oBACE,IAAI,EAAE,8DAA8D;oBACpE,OAAO,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,EAAE;iBAClD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAEjC,6DAA6D;YAC7D,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAErD,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YAElF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAyB9C,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuD5E"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAyB9C,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAkE5E"}

package/dist/tools/conftest/push.js

@@ -14,6 +14,7 @@
  *   non-0 -- push error (auth failure, network error, etc.)
  */
 import { z } from 'zod';
+import { resolve } from 'node:path';
 import { ConftestCli } from '../../lib/conftest-cli.js';
 import { err, ok } from '../../lib/errors.js';
 import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
@@ -30,8 +31,10 @@ const ConftestPushInput = {
         .optional()
         .describe('Path to the local directory containing Rego policies to push. ' +
         'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS) and must exist. ' +
-        "Defaults to `./policy` (conftest's convention)."),
+        'Omitted, it falls back to `policy` in the working directory of the server process, the conftest convention, which must itself sit inside an allowed root.'),
 };
+/** Where conftest looks when `--policy` is not given, as an absolute path. */
+const DEFAULT_POLICY_DIR = resolve('policy');
 export function registerConftestPush(server, config) {
     const conftest = new ConftestCli(config);
     server.registerTool('conftest_push', {
@@ -51,21 +54,28 @@ export function registerConftestPush(server, config) {
     }, async (input, { signal }) => {
         return withToolEnvelope(config, async () => {
             // ── Path validation ──────────────────────────────────────────────
-            if (input.policy !== undefined) {
-                const v = validatePaths([input.policy], config, { mustExist: true });
-                if (!v.ok)
+            // An omitted path means the conftest default, resolved against the
+            // working directory. This publishes whatever it finds there, so the
+            // default is checked against the allow-list like an explicit one.
+            const v = validatePaths([input.policy ?? DEFAULT_POLICY_DIR], config, { mustExist: true });
+            if (!v.ok) {
+                if (input.policy !== undefined)
                     return v.error;
-                input = { ...input, policy: v.resolved[0] };
+                return err('PATH_NOT_ALLOWED', 'The conftest default policy directory is outside the allowed roots.', {
+                    hint: 'Pass `policy` with a directory inside OPA_MCP_ALLOWED_PATHS.',
+                    details: { defaultPolicyDir: DEFAULT_POLICY_DIR },
+                });
             }
+            const policyDir = v.resolved[0];
             // ── Run conftest push ────────────────────────────────────────────
-            const result = await conftest.push({ repository: input.repository, policy: input.policy }, signal);
+            const result = await conftest.push({ repository: input.repository, policy: policyDir }, signal);
             const subprocessFailure = mapSubprocessFailure(result, 'conftest');
             if (subprocessFailure)
                 return subprocessFailure;
             if (result.exitCode === 0) {
                 return ok({
                     repository: input.repository,
-                    policyDir: input.policy ?? 'policy',
+                    policyDir,
                 });
             }
             const detail = result.stderr.trim() || result.stdout.trim();

package/dist/tools/conftest/push.js.map

@@ -1 +1 @@
-{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,kFAAkF;QAChF,0EAA0E;QAC1E,8DAA8D;QAC9D,0DAA0D,CAC7D;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,yEAAyE;QACzE,iDAAiD,CACpD;CACJ,CAAC;AASF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,iFAAiF;YACjF,0FAA0F;YAC1F,+DAA+D;YAC/D,uDAAuD;QACzD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EACtD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,kFAAkF;QAChF,0EAA0E;QAC1E,8DAA8D;QAC9D,0DAA0D,CAC7D;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,yEAAyE;QACzE,2JAA2J,CAC9J;CACJ,CAAC;AASF,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,iFAAiF;YACjF,0FAA0F;YAC1F,+DAA+D;YAC/D,uDAAuD;QACzD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC/C,OAAO,GAAG,CACR,kBAAkB,EAClB,qEAAqE,EACrE;oBACE,IAAI,EAAE,8DAA8D;oBACpE,OAAO,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,EAAE;iBAClD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAEjC,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EACnD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/test.d.ts

@@ -2,19 +2,23 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Config } from '../../config.js';
 import { type ConftestFileResult } from '../../lib/conftest-cli.js';
 export interface ConftestTestOutput {
-    /** `true` when no failures (and no warnings if `failOnWarn` was set). */
+    /** `true` when conftest exited 0: no failures, and no warnings if `failOnWarn` was set. */
     passed: boolean;
-    /** Per-file, per-namespace evaluation results. */
+    /** One entry per (file, namespace) pair conftest evaluated, arrays always present. */
     results: ConftestFileResult[];
     summary: {
-        /** Number of files with zero failures and zero warnings. */
+        /** Distinct files with no failure in any namespace. */
         passed: number;
-        /** Number of files with at least one failure. */
+        /** Distinct files with at least one failure in any namespace. */
         failed: number;
-        /** Total number of warning messages across all files. */
+        /** Warning messages across all entries. */
         warnings: number;
-        /** Total number of skipped rules across all files. */
+        /** Skipped-rule messages across all entries. */
         skipped: number;
+        /** Rule evaluations that passed across all entries (conftest's `successes`). */
+        successes: number;
+        /** Failure messages across all entries. */
+        failures: number;
     };
 }
 export declare function registerConftestTest(server: McpServer, config: Config): void;

package/dist/tools/conftest/test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA4FjF,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,4DAA4D;QAC5D,MAAM,EAAE,MAAM,CAAC;QACf,iDAAiD;QACjD,MAAM,EAAE,MAAM,CAAC;QACf,yDAAyD;QACzD,QAAQ,EAAE,MAAM,CAAC;QACjB,sDAAsD;QACtD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAgH5E"}
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAuFnC,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,MAAM,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,uDAAuD;QACvD,MAAM,EAAE,MAAM,CAAC;QACf,iEAAiE;QACjE,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,QAAQ,EAAE,MAAM,CAAC;QACjB,gDAAgD;QAChD,OAAO,EAAE,MAAM,CAAC;QAChB,gFAAgF;QAChF,SAAS,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA+H5E"}

package/dist/tools/conftest/test.js

@@ -15,9 +15,10 @@
  *   2+    -- command error (bad args, policy not found, etc.)
  */
 import { z } from 'zod';
-import { ConftestCli } from '../../lib/conftest-cli.js';
+import { CONFTEST_PARSERS, ConftestCli, isConftestParser, parseConftestResults, } from '../../lib/conftest-cli.js';
 import { err, ok } from '../../lib/errors.js';
-import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const PARSER_LIST = CONFTEST_PARSERS.join(', ');
 const ConftestTestInput = {
     files: z
         .array(z.string())
@@ -31,19 +32,17 @@ const ConftestTestInput = {
         .describe('Inline configuration content to evaluate (e.g. a Kubernetes manifest as a YAML string). ' +
         'Mutually exclusive with `files`. Defaults to YAML format; set `inlineConfigParser` to override.'),
     inlineConfigParser: z
-        .string()
+        .enum(CONFTEST_PARSERS)
         .optional()
-        .describe('Parser to use for `inlineConfig`. Valid values: yaml (default), json, toml, hcl1, hcl2, ' +
-        'ini, xml, dotenv, cue, jsonnet, properties, edn, hocon, dockerfile. ' +
+        .describe(`Parser to use for \`inlineConfig\`. One of: ${PARSER_LIST}. Defaults to yaml. ` +
         "Ignored when `files` is used (conftest infers the parser from each file's extension, " +
         'unless `parser` is set).'),
     parser: z
-        .string()
+        .enum(CONFTEST_PARSERS)
         .optional()
         .describe("Force a specific parser for all input `files` via conftest's global `--parser` flag, " +
         'overriding extension-based detection. Useful for files whose extension does not match ' +
-        'their format (e.g. parse a `.tfstate` file as `json`). Valid values: yaml, json, toml, ' +
-        'hcl1, hcl2, ini, xml, dotenv, cue, jsonnet, properties, edn, hocon, dockerfile. ' +
+        `their format (e.g. parse a \`.tfstate\` file as \`json\`). One of: ${PARSER_LIST}. ` +
         'For `inlineConfig`, prefer `inlineConfigParser`.'),
     policy: z
         .string()
@@ -93,13 +92,14 @@ export function registerConftestTest(server, config) {
             'CONFTEST_NOT_FOUND otherwise. ' +
             'Provide config via `files` (disk paths) or `inlineConfig` (inline string). ' +
             'Provide policy via `policy` (disk path) or `inlinePolicy` (inline Rego source). ' +
-            "Omit `policy` and `inlinePolicy` to use conftest's default `./policy` directory.",
+            "Omit `policy` and `inlinePolicy` to use conftest's default `./policy` directory. " +
+            'Policies are executed by conftest and can call OPA built-ins such as http.send.',
         inputSchema: ConftestTestInput,
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
             idempotentHint: true,
-            openWorldHint: false,
+            openWorldHint: true,
         },
     }, async (input, { signal }) => {
         return withToolEnvelope(config, async () => {
@@ -113,6 +113,20 @@ export function registerConftestTest(server, config) {
             if (input.policy !== undefined && input.inlinePolicy !== undefined) {
                 return err('INVALID_INPUT', '`policy` and `inlinePolicy` are mutually exclusive.');
             }
+            // The schema restricts parser names to the closed set, and the
+            // check is repeated here because the name becomes part of a temp
+            // file path: this handler must never see free text there, whatever
+            // path it was reached by.
+            for (const [field, value] of [
+                ['inlineConfigParser', input.inlineConfigParser],
+                ['parser', input.parser],
+            ]) {
+                if (value !== undefined && !isConftestParser(value)) {
+                    return err('INVALID_INPUT', `\`${field}\` must be one of: ${PARSER_LIST}.`, {
+                        details: { [field]: value },
+                    });
+                }
+            }
             // ── Path validation ──────────────────────────────────────────────
             if (input.files?.length) {
                 const v = validatePaths(input.files, config, { mustExist: true });
@@ -154,17 +168,16 @@ export function registerConftestTest(server, config) {
             // Exit 0 = all pass, exit 1 = failures present.
             // Both produce valid JSON on stdout.
             if (result.exitCode === 0 || result.exitCode === 1) {
-                const parsed = tryParseJson(result.stdout);
-                if (!parsed || !Array.isArray(parsed)) {
+                const results = parseConftestResults(result.stdout);
+                if (results === null) {
                     return err('UNKNOWN_ERROR', 'conftest test produced no parseable JSON output.', {
                         details: { stderr: result.stderr.trim(), exitCode: result.exitCode },
                     });
                 }
-                const summary = buildSummary(parsed);
                 return ok({
                     passed: result.exitCode === 0,
-                    results: parsed,
-                    summary,
+                    results,
+                    summary: buildSummary(results),
                 });
             }
             // ── Exit code 2+: command-level error ────────────────────────────
@@ -177,20 +190,30 @@ export function registerConftestTest(server, config) {
 }
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 function buildSummary(results) {
-    let passed = 0;
-    let failed = 0;
+    // conftest emits one entry per (file, namespace); with --all-namespaces a
+    // file appears once per namespace, so files are counted by name.
+    const failedFiles = new Set();
+    const allFiles = new Set();
     let warnings = 0;
     let skipped = 0;
+    let successes = 0;
+    let failures = 0;
     for (const r of results) {
-        if (r.failures.length > 0) {
-            failed++;
-        }
-        else {
-            passed++;
-        }
+        allFiles.add(r.filename);
+        if (r.failures.length > 0)
+            failedFiles.add(r.filename);
         warnings += r.warnings.length;
         skipped += r.skipped.length;
+        successes += r.successes;
+        failures += r.failures.length;
     }
-    return { passed, failed, warnings, skipped };
+    return {
+        passed: allFiles.size - failedFiles.size,
+        failed: failedFiles.size,
+        warnings,
+        skipped,
+        successes,
+        failures,
+    };
 }
 //# sourceMappingURL=test.js.map

package/dist/tools/conftest/test.js.map

@@ -1 +1 @@
-{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAA2B,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F;QACzF,oEAAoE;QACpE,yCAAyC,CAC5C;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,iGAAiG,CACpG;IACH,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,sEAAsE;QACtE,uFAAuF;QACvF,0BAA0B,CAC7B;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uFAAuF;QACrF,wFAAwF;QACxF,yFAAyF;QACzF,kFAAkF;QAClF,kDAAkD,CACrD;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wDAAwD;QACtD,0DAA0D;QAC1D,0CAA0C;QAC1C,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,iFAAiF;QACjF,mCAAmC,CACtC;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,sEAAsE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,2CAA2C,CAC9C;IACH,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF;QAChF,2EAA2E,CAC9E;IACH,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC;AAmBF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,yFAAyF;YACzF,sFAAsF;YACtF,2FAA2F;YAC3F,oFAAoF;YACpF,gCAAgC;YAChC,6EAA6E;YAC7E,kFAAkF;YAClF,kFAAkF;QACpF,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7D,OAAO,GAAG,CACR,eAAe,EACf,+FAA+F,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACnE,OAAO,GAAG,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;YACrF,CAAC;YAED,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,EACD,MAAM,CACP,CAAC;YAEF,oEAAoE;YACpE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,mEAAmE;YACnE,gDAAgD;YAChD,qCAAqC;YACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAuB,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,OAAO,GAAG,CAAC,eAAe,EAAE,kDAAkD,EAAE;wBAC9E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAqB;oBAC5B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO,EAAE,MAAM;oBACf,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,+DAA+D;YAC/D,+BAA+B;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,OAA6B;IACjD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC;QACX,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhD,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F;QACzF,oEAAoE;QACpE,yCAAyC,CAC5C;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,iGAAiG,CACpG;IACH,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,gBAAgB,CAAC;SACtB,QAAQ,EAAE;SACV,QAAQ,CACP,+CAA+C,WAAW,sBAAsB;QAC9E,uFAAuF;QACvF,0BAA0B,CAC7B;IACH,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,gBAAgB,CAAC;SACtB,QAAQ,EAAE;SACV,QAAQ,CACP,uFAAuF;QACrF,wFAAwF;QACxF,sEAAsE,WAAW,IAAI;QACrF,kDAAkD,CACrD;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wDAAwD;QACtD,0DAA0D;QAC1D,0CAA0C;QAC1C,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,iFAAiF;QACjF,mCAAmC,CACtC;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,sEAAsE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,2CAA2C,CAC9C;IACH,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF;QAChF,2EAA2E,CAC9E;IACH,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC;AAuBF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,yFAAyF;YACzF,sFAAsF;YACtF,2FAA2F;YAC3F,oFAAoF;YACpF,gCAAgC;YAChC,6EAA6E;YAC7E,kFAAkF;YAClF,mFAAmF;YACnF,iFAAiF;QACnF,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7D,OAAO,GAAG,CACR,eAAe,EACf,+FAA+F,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACnE,OAAO,GAAG,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;YACrF,CAAC;YAED,+DAA+D;YAC/D,iEAAiE;YACjE,mEAAmE;YACnE,0BAA0B;YAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;gBAC3B,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAC;gBAChD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;aAChB,EAAE,CAAC;gBACX,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpD,OAAO,GAAG,CAAC,eAAe,EAAE,KAAK,KAAK,sBAAsB,WAAW,GAAG,EAAE;wBAC1E,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,EACD,MAAM,CACP,CAAC;YAEF,oEAAoE;YACpE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,mEAAmE;YACnE,gDAAgD;YAChD,qCAAqC;YACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,GAAG,CAAC,eAAe,EAAE,kDAAkD,EAAE;wBAC9E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,EAAE,CAAqB;oBAC5B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO;oBACP,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,+DAA+D;YAC/D,+BAA+B;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,OAA6B;IACjD,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvD,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;QACzB,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI;QACxC,MAAM,EAAE,WAAW,CAAC,IAAI;QACxB,QAAQ;QACR,OAAO;QACP,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/verify.d.ts

@@ -2,18 +2,22 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Config } from '../../config.js';
 import { type ConftestFileResult } from '../../lib/conftest-cli.js';
 export interface ConftestVerifyOutput {
-    /** `true` when all `test_*` rules in all test files pass. */
+    /** `true` when every `test_*` rule passed. */
     passed: boolean;
-    /** Per-test-file results. */
+    /**
+     * One entry per test outcome as conftest reports them: a test file
+     * produces one entry per passing rule (`successes: 1`) and one per
+     * failing rule (`failures: [{msg}]`), with `namespace` empty.
+     */
     results: ConftestFileResult[];
     summary: {
-        /** Number of test files with zero failures. */
+        /** Distinct test files with no failing rule. */
         passed: number;
-        /** Number of test files with at least one failure. */
+        /** Distinct test files with at least one failing rule. */
         failed: number;
-        /** Total test cases that passed (sum of `successes` across all files). */
+        /** Test rules that passed, across all files. */
         totalPassed: number;
-        /** Total test cases that failed (sum of `failures` across all files). */
+        /** Test rules that failed, across all files. */
         totalFailed: number;
     };
 }

package/dist/tools/conftest/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA8BjF,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAC;IAChB,6BAA6B;IAC7B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,+CAA+C;QAC/C,MAAM,EAAE,MAAM,CAAC;QACf,sDAAsD;QACtD,MAAM,EAAE,MAAM,CAAC;QACf,0EAA0E;QAC1E,WAAW,EAAE,MAAM,CAAC;QACpB,yEAAyE;QACzE,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAyE9E"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAyBnC,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAC;QACf,0DAA0D;QAC1D,MAAM,EAAE,MAAM,CAAC;QACf,gDAAgD;QAChD,WAAW,EAAE,MAAM,CAAC;QACpB,gDAAgD;QAChD,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAqF9E"}