@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/tools/conftest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/conftest/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/conftest/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC"}

package/dist/tools/conftest/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA0B9C,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA0D5E"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA4B9C,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuE5E"}

package/dist/tools/conftest/pull.js

@@ -17,6 +17,8 @@
  *   0     -- pull succeeded
  *   non-0 -- network / auth error
  */
+import { mkdir } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
 import { z } from 'zod';
 import { ConftestCli } from '../../lib/conftest-cli.js';
 import { err, ok } from '../../lib/errors.js';
@@ -35,8 +37,12 @@ const ConftestPullInput = {
         .optional()
         .describe('Local directory where the pulled policies will be written. ' +
         'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). ' +
-        "Defaults to `./policy` (conftest's convention)."),
+        'Omitted, it falls back to `policy` in the working directory of the server process, the conftest convention, which must itself sit inside an allowed root. ' +
+        'The directory is emptied before the pull, so do not point it at one holding anything ' +
+        'you want to keep.'),
 };
+/** Where conftest looks when `--policy` is not given, as an absolute path. */
+const DEFAULT_POLICY_DIR = resolve('policy');
 export function registerConftestPull(server, config) {
     const conftest = new ConftestCli(config);
     server.registerTool('conftest_pull', {
@@ -59,24 +65,32 @@ export function registerConftestPull(server, config) {
     }, async (input, { signal }) => {
         return withToolEnvelope(config, async () => {
             // ── Path validation ──────────────────────────────────────────────
-            // The policy directory does not have to exist yet -- conftest will
-            // create it. Validate only that the parent is within allowed roots
-            // by validating the path itself (without mustExist).
-            if (input.policy !== undefined) {
-                const v = validatePaths([input.policy], config);
-                if (!v.ok)
+            // The directory does not have to exist yet; conftest creates it. An
+            // omitted path means conftest's own default, which it resolves against
+            // the working directory. This tool writes files, so that default is
+            // checked against the allow-list too rather than escaping it by being
+            // implicit.
+            const v = validatePaths([input.policy ?? DEFAULT_POLICY_DIR], config);
+            if (!v.ok) {
+                if (input.policy !== undefined)
                     return v.error;
-                input = { ...input, policy: v.resolved[0] };
+                return err('PATH_NOT_ALLOWED', 'The conftest default policy directory is outside the allowed roots.', {
+                    hint: 'Pass `policy` with a directory inside OPA_MCP_ALLOWED_PATHS.',
+                    details: { defaultPolicyDir: DEFAULT_POLICY_DIR },
+                });
             }
+            const policyDir = v.resolved[0];
+            // conftest runs from the parent, so the parent has to exist.
+            await mkdir(dirname(policyDir), { recursive: true });
             // ── Run conftest pull ────────────────────────────────────────────
-            const result = await conftest.pull({ url: input.url, policy: input.policy }, signal);
+            const result = await conftest.pull({ url: input.url, policy: policyDir }, signal);
             const subprocessFailure = mapSubprocessFailure(result, 'conftest');
             if (subprocessFailure)
                 return subprocessFailure;
             if (result.exitCode === 0) {
                 return ok({
                     url: input.url,
-                    policyDir: input.policy ?? 'policy',
+                    policyDir,
                 });
             }
             const detail = result.stderr.trim() || result.stdout.trim();

package/dist/tools/conftest/pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yCAAyC;QACvC,4CAA4C;QAC5C,qDAAqD;QACrD,uDAAuD;QACvD,gEAAgE,CACnE;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6DAA6D;QAC3D,0DAA0D;QAC1D,iDAAiD,CACpD;CACJ,CAAC;AASF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,wFAAwF;YACxF,yEAAyE;YACzE,+DAA+D;YAC/D,+EAA+E;YAC/E,mFAAmF;YACnF,mFAAmF;YACnF,uEAAuE;QACzE,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YAErF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yCAAyC;QACvC,4CAA4C;QAC5C,qDAAqD;QACrD,uDAAuD;QACvD,gEAAgE,CACnE;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6DAA6D;QAC3D,0DAA0D;QAC1D,4JAA4J;QAC5J,uFAAuF;QACvF,mBAAmB,CACtB;CACJ,CAAC;AASF,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,wFAAwF;YACxF,yEAAyE;YACzE,+DAA+D;YAC/D,+EAA+E;YAC/E,mFAAmF;YACnF,mFAAmF;YACnF,uEAAuE;QACzE,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,oEAAoE;YACpE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,YAAY;YACZ,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC/C,OAAO,GAAG,CACR,kBAAkB,EAClB,qEAAqE,EACrE;oBACE,IAAI,EAAE,8DAA8D;oBACpE,OAAO,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,EAAE;iBAClD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAEjC,6DAA6D;YAC7D,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAErD,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YAElF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAyB9C,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuD5E"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAyB9C,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAkE5E"}

package/dist/tools/conftest/push.js

@@ -14,6 +14,7 @@
  *   non-0 -- push error (auth failure, network error, etc.)
  */
 import { z } from 'zod';
+import { resolve } from 'node:path';
 import { ConftestCli } from '../../lib/conftest-cli.js';
 import { err, ok } from '../../lib/errors.js';
 import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
@@ -30,8 +31,10 @@ const ConftestPushInput = {
         .optional()
         .describe('Path to the local directory containing Rego policies to push. ' +
         'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS) and must exist. ' +
-        "Defaults to `./policy` (conftest's convention)."),
+        'Omitted, it falls back to `policy` in the working directory of the server process, the conftest convention, which must itself sit inside an allowed root.'),
 };
+/** Where conftest looks when `--policy` is not given, as an absolute path. */
+const DEFAULT_POLICY_DIR = resolve('policy');
 export function registerConftestPush(server, config) {
     const conftest = new ConftestCli(config);
     server.registerTool('conftest_push', {
@@ -51,21 +54,28 @@ export function registerConftestPush(server, config) {
     }, async (input, { signal }) => {
         return withToolEnvelope(config, async () => {
             // ── Path validation ──────────────────────────────────────────────
-            if (input.policy !== undefined) {
-                const v = validatePaths([input.policy], config, { mustExist: true });
-                if (!v.ok)
+            // An omitted path means the conftest default, resolved against the
+            // working directory. This publishes whatever it finds there, so the
+            // default is checked against the allow-list like an explicit one.
+            const v = validatePaths([input.policy ?? DEFAULT_POLICY_DIR], config, { mustExist: true });
+            if (!v.ok) {
+                if (input.policy !== undefined)
                     return v.error;
-                input = { ...input, policy: v.resolved[0] };
+                return err('PATH_NOT_ALLOWED', 'The conftest default policy directory is outside the allowed roots.', {
+                    hint: 'Pass `policy` with a directory inside OPA_MCP_ALLOWED_PATHS.',
+                    details: { defaultPolicyDir: DEFAULT_POLICY_DIR },
+                });
             }
+            const policyDir = v.resolved[0];
             // ── Run conftest push ────────────────────────────────────────────
-            const result = await conftest.push({ repository: input.repository, policy: input.policy }, signal);
+            const result = await conftest.push({ repository: input.repository, policy: policyDir }, signal);
             const subprocessFailure = mapSubprocessFailure(result, 'conftest');
             if (subprocessFailure)
                 return subprocessFailure;
             if (result.exitCode === 0) {
                 return ok({
                     repository: input.repository,
-                    policyDir: input.policy ?? 'policy',
+                    policyDir,
                 });
             }
             const detail = result.stderr.trim() || result.stdout.trim();

package/dist/tools/conftest/push.js.map

@@ -1 +1 @@
-{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,kFAAkF;QAChF,0EAA0E;QAC1E,8DAA8D;QAC9D,0DAA0D,CAC7D;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,yEAAyE;QACzE,iDAAiD,CACpD;CACJ,CAAC;AASF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,iFAAiF;YACjF,0FAA0F;YAC1F,+DAA+D;YAC/D,uDAAuD;QACzD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EACtD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../src/tools/conftest/push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,iBAAiB,GAAG;IACxB,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,kFAAkF;QAChF,0EAA0E;QAC1E,8DAA8D;QAC9D,0DAA0D,CAC7D;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,gEAAgE;QAC9D,yEAAyE;QACzE,2JAA2J,CAC9J;CACJ,CAAC;AASF,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,uFAAuF;YACvF,iFAAiF;YACjF,0FAA0F;YAC1F,+DAA+D;YAC/D,uDAAuD;QACzD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC/C,OAAO,GAAG,CACR,kBAAkB,EAClB,qEAAqE,EACrE;oBACE,IAAI,EAAE,8DAA8D;oBACpE,OAAO,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,EAAE;iBAClD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;YAEjC,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EACnD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAqB;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/test.d.ts

@@ -2,19 +2,23 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Config } from '../../config.js';
 import { type ConftestFileResult } from '../../lib/conftest-cli.js';
 export interface ConftestTestOutput {
-    /** `true` when no failures (and no warnings if `failOnWarn` was set). */
+    /** `true` when conftest exited 0: no failures, and no warnings if `failOnWarn` was set. */
     passed: boolean;
-    /** Per-file, per-namespace evaluation results. */
+    /** One entry per (file, namespace) pair conftest evaluated, arrays always present. */
     results: ConftestFileResult[];
     summary: {
-        /** Number of files with zero failures and zero warnings. */
+        /** Distinct files with no failure in any namespace. */
         passed: number;
-        /** Number of files with at least one failure. */
+        /** Distinct files with at least one failure in any namespace. */
         failed: number;
-        /** Total number of warning messages across all files. */
+        /** Warning messages across all entries. */
         warnings: number;
-        /** Total number of skipped rules across all files. */
+        /** Skipped-rule messages across all entries. */
         skipped: number;
+        /** Rule evaluations that passed across all entries (conftest's `successes`). */
+        successes: number;
+        /** Failure messages across all entries. */
+        failures: number;
     };
 }
 export declare function registerConftestTest(server: McpServer, config: Config): void;

package/dist/tools/conftest/test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA4FjF,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,4DAA4D;QAC5D,MAAM,EAAE,MAAM,CAAC;QACf,iDAAiD;QACjD,MAAM,EAAE,MAAM,CAAC;QACf,yDAAyD;QACzD,QAAQ,EAAE,MAAM,CAAC;QACjB,sDAAsD;QACtD,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAgH5E"}
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAuFnC,MAAM,WAAW,kBAAkB;IACjC,2FAA2F;IAC3F,MAAM,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,uDAAuD;QACvD,MAAM,EAAE,MAAM,CAAC;QACf,iEAAiE;QACjE,MAAM,EAAE,MAAM,CAAC;QACf,2CAA2C;QAC3C,QAAQ,EAAE,MAAM,CAAC;QACjB,gDAAgD;QAChD,OAAO,EAAE,MAAM,CAAC;QAChB,gFAAgF;QAChF,SAAS,EAAE,MAAM,CAAC;QAClB,2CAA2C;QAC3C,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAyH5E"}

package/dist/tools/conftest/test.js

@@ -11,13 +11,18 @@
  * Exit code mapping:
  *   null  -- conftest binary not found → CONFTEST_NOT_FOUND
  *   0     -- all tests pass (ok: true, passed: true)
- *   1     -- one or more failures (ok: true, passed: false)
- *   2+    -- command error (bad args, policy not found, etc.)
+ *   1     -- one or more failures, or a command error (bad args, policy not
+ *            found): the two are told apart by whether stdout holds results
+ *   2     -- failures together with warnings under --fail-on-warn
+ * Measured with conftest 0.69.0: a denial alone exits 1, a denial with
+ * --fail-on-warn exits 2, and both print the full result JSON. Any exit code
+ * with parseable results is an outcome, not a malfunction.
  */
 import { z } from 'zod';
-import { ConftestCli } from '../../lib/conftest-cli.js';
+import { CONFTEST_PARSERS, ConftestCli, isConftestParser, parseConftestResults, } from '../../lib/conftest-cli.js';
 import { err, ok } from '../../lib/errors.js';
-import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const PARSER_LIST = CONFTEST_PARSERS.join(', ');
 const ConftestTestInput = {
     files: z
         .array(z.string())
@@ -31,19 +36,17 @@ const ConftestTestInput = {
         .describe('Inline configuration content to evaluate (e.g. a Kubernetes manifest as a YAML string). ' +
         'Mutually exclusive with `files`. Defaults to YAML format; set `inlineConfigParser` to override.'),
     inlineConfigParser: z
-        .string()
+        .enum(CONFTEST_PARSERS)
         .optional()
-        .describe('Parser to use for `inlineConfig`. Valid values: yaml (default), json, toml, hcl1, hcl2, ' +
-        'ini, xml, dotenv, cue, jsonnet, properties, edn, hocon, dockerfile. ' +
+        .describe(`Parser to use for \`inlineConfig\`. One of: ${PARSER_LIST}. Defaults to yaml. ` +
         "Ignored when `files` is used (conftest infers the parser from each file's extension, " +
         'unless `parser` is set).'),
     parser: z
-        .string()
+        .enum(CONFTEST_PARSERS)
         .optional()
         .describe("Force a specific parser for all input `files` via conftest's global `--parser` flag, " +
         'overriding extension-based detection. Useful for files whose extension does not match ' +
-        'their format (e.g. parse a `.tfstate` file as `json`). Valid values: yaml, json, toml, ' +
-        'hcl1, hcl2, ini, xml, dotenv, cue, jsonnet, properties, edn, hocon, dockerfile. ' +
+        `their format (e.g. parse a \`.tfstate\` file as \`json\`). One of: ${PARSER_LIST}. ` +
         'For `inlineConfig`, prefer `inlineConfigParser`.'),
     policy: z
         .string()
@@ -93,13 +96,13 @@ export function registerConftestTest(server, config) {
             'CONFTEST_NOT_FOUND otherwise. ' +
             'Provide config via `files` (disk paths) or `inlineConfig` (inline string). ' +
             'Provide policy via `policy` (disk path) or `inlinePolicy` (inline Rego source). ' +
-            "Omit `policy` and `inlinePolicy` to use conftest's default `./policy` directory.",
+            "Omit `policy` and `inlinePolicy` to use conftest's default `./policy` directory. " +
+            'Policies are executed by conftest and can call OPA built-ins such as http.send.',
         inputSchema: ConftestTestInput,
         annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            idempotentHint: true,
-            openWorldHint: false,
+            // Runs Rego supplied by the caller; a policy can reach, and write to, a remote system through http.send.
+            readOnlyHint: false,
+            openWorldHint: true,
         },
     }, async (input, { signal }) => {
         return withToolEnvelope(config, async () => {
@@ -113,6 +116,20 @@ export function registerConftestTest(server, config) {
             if (input.policy !== undefined && input.inlinePolicy !== undefined) {
                 return err('INVALID_INPUT', '`policy` and `inlinePolicy` are mutually exclusive.');
             }
+            // The schema restricts parser names to the closed set, and the
+            // check is repeated here because the name becomes part of a temp
+            // file path: this handler must never see free text there, whatever
+            // path it was reached by.
+            for (const [field, value] of [
+                ['inlineConfigParser', input.inlineConfigParser],
+                ['parser', input.parser],
+            ]) {
+                if (value !== undefined && !isConftestParser(value)) {
+                    return err('INVALID_INPUT', `\`${field}\` must be one of: ${PARSER_LIST}.`, {
+                        details: { [field]: value },
+                    });
+                }
+            }
             // ── Path validation ──────────────────────────────────────────────
             if (input.files?.length) {
                 const v = validatePaths(input.files, config, { mustExist: true });
@@ -150,47 +167,52 @@ export function registerConftestTest(server, config) {
             const subprocessFailure = mapSubprocessFailure(result, 'conftest');
             if (subprocessFailure)
                 return subprocessFailure;
-            // ── Exit code 0 / 1: parse JSON results ─────────────────────────
-            // Exit 0 = all pass, exit 1 = failures present.
-            // Both produce valid JSON on stdout.
-            if (result.exitCode === 0 || result.exitCode === 1) {
-                const parsed = tryParseJson(result.stdout);
-                if (!parsed || !Array.isArray(parsed)) {
-                    return err('UNKNOWN_ERROR', 'conftest test produced no parseable JSON output.', {
-                        details: { stderr: result.stderr.trim(), exitCode: result.exitCode },
-                    });
-                }
-                const summary = buildSummary(parsed);
+            // ── Results on stdout: an outcome, whatever the exit code ────────
+            // Exit 0 is a pass; 1 and 2 carry failures (2 when --fail-on-warn
+            // adds warnings to them). Routing 2 to the error branch reported a
+            // real denial as a broken tool.
+            const results = parseConftestResults(result.stdout);
+            if (results !== null) {
                 return ok({
                     passed: result.exitCode === 0,
-                    results: parsed,
-                    summary,
+                    results,
+                    summary: buildSummary(results),
                 });
             }
-            // ── Exit code 2+: command-level error ────────────────────────────
+            // ── No results: a command-level error ────────────────────────────
             // Examples: policy directory not found, malformed Rego syntax,
             // unknown --parser value, etc.
             const detail = result.stderr.trim() || result.stdout.trim();
-            return err('UNKNOWN_ERROR', `conftest test failed with exit code ${result.exitCode}: ${detail}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
+            return err('UNKNOWN_ERROR', `conftest test failed with exit code ${result.exitCode}: ${detail || 'no output'}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
         });
     });
 }
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 function buildSummary(results) {
-    let passed = 0;
-    let failed = 0;
+    // conftest emits one entry per (file, namespace); with --all-namespaces a
+    // file appears once per namespace, so files are counted by name.
+    const failedFiles = new Set();
+    const allFiles = new Set();
     let warnings = 0;
     let skipped = 0;
+    let successes = 0;
+    let failures = 0;
     for (const r of results) {
-        if (r.failures.length > 0) {
-            failed++;
-        }
-        else {
-            passed++;
-        }
+        allFiles.add(r.filename);
+        if (r.failures.length > 0)
+            failedFiles.add(r.filename);
         warnings += r.warnings.length;
         skipped += r.skipped.length;
+        successes += r.successes;
+        failures += r.failures.length;
     }
-    return { passed, failed, warnings, skipped };
+    return {
+        passed: allFiles.size - failedFiles.size,
+        failed: failedFiles.size,
+        warnings,
+        skipped,
+        successes,
+        failures,
+    };
 }
 //# sourceMappingURL=test.js.map

package/dist/tools/conftest/test.js.map

@@ -1 +1 @@
-{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAA2B,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F;QACzF,oEAAoE;QACpE,yCAAyC,CAC5C;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,iGAAiG,CACpG;IACH,kBAAkB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,sEAAsE;QACtE,uFAAuF;QACvF,0BAA0B,CAC7B;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uFAAuF;QACrF,wFAAwF;QACxF,yFAAyF;QACzF,kFAAkF;QAClF,kDAAkD,CACrD;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wDAAwD;QACtD,0DAA0D;QAC1D,0CAA0C;QAC1C,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,iFAAiF;QACjF,mCAAmC,CACtC;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,sEAAsE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,2CAA2C,CAC9C;IACH,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF;QAChF,2EAA2E,CAC9E;IACH,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC;AAmBF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,yFAAyF;YACzF,sFAAsF;YACtF,2FAA2F;YAC3F,oFAAoF;YACpF,gCAAgC;YAChC,6EAA6E;YAC7E,kFAAkF;YAClF,kFAAkF;QACpF,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7D,OAAO,GAAG,CACR,eAAe,EACf,+FAA+F,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACnE,OAAO,GAAG,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;YACrF,CAAC;YAED,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,EACD,MAAM,CACP,CAAC;YAEF,oEAAoE;YACpE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,mEAAmE;YACnE,gDAAgD;YAChD,qCAAqC;YACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAuB,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,OAAO,GAAG,CAAC,eAAe,EAAE,kDAAkD,EAAE;wBAC9E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAqB;oBAC5B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO,EAAE,MAAM;oBACf,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,+DAA+D;YAC/D,+BAA+B;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACnE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,OAA6B;IACjD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC;QACX,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/tools/conftest/test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,GAErB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhD,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F;QACzF,oEAAoE;QACpE,yCAAyC,CAC5C;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0FAA0F;QACxF,iGAAiG,CACpG;IACH,kBAAkB,EAAE,CAAC;SAClB,IAAI,CAAC,gBAAgB,CAAC;SACtB,QAAQ,EAAE;SACV,QAAQ,CACP,+CAA+C,WAAW,sBAAsB;QAC9E,uFAAuF;QACvF,0BAA0B,CAC7B;IACH,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,gBAAgB,CAAC;SACtB,QAAQ,EAAE;SACV,QAAQ,CACP,uFAAuF;QACrF,wFAAwF;QACxF,sEAAsE,WAAW,IAAI;QACrF,kDAAkD,CACrD;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wDAAwD;QACtD,0DAA0D;QAC1D,0CAA0C;QAC1C,4DAA4D,CAC/D;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,iFAAiF;QACjF,mCAAmC,CACtC;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,sEAAsE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,wFAAwF;QACtF,2CAA2C,CAC9C;IACH,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,kFAAkF;QAChF,2EAA2E,CAC9E;IACH,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC;AAuBF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,yFAAyF;YACzF,sFAAsF;YACtF,2FAA2F;YAC3F,oFAAoF;YACpF,gCAAgC;YAChC,6EAA6E;YAC7E,kFAAkF;YAClF,mFAAmF;YACnF,iFAAiF;QACnF,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,yGAAyG;YACzG,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7D,OAAO,GAAG,CACR,eAAe,EACf,+FAA+F,CAChG,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACnE,OAAO,GAAG,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;YACrF,CAAC;YAED,+DAA+D;YAC/D,iEAAiE;YACjE,mEAAmE;YACnE,0BAA0B;YAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;gBAC3B,CAAC,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,CAAC;gBAChD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;aAChB,EAAE,CAAC;gBACX,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpD,OAAO,GAAG,CAAC,eAAe,EAAE,KAAK,KAAK,sBAAsB,WAAW,GAAG,EAAE;wBAC1E,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,IAAI,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1C,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAChC;gBACE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,EACD,MAAM,CACP,CAAC;YAEF,oEAAoE;YACpE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,gCAAgC;YAChC,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,CAAqB;oBAC5B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO;oBACP,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;YAED,oEAAoE;YACpE,+DAA+D;YAC/D,+BAA+B;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,uCAAuC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,WAAW,EAAE,EAClF,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY,CAAC,OAA6B;IACjD,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvD,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;QACzB,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI;QACxC,MAAM,EAAE,WAAW,CAAC,IAAI;QACxB,QAAQ;QACR,OAAO;QACP,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/tools/conftest/verify.d.ts

@@ -2,18 +2,22 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Config } from '../../config.js';
 import { type ConftestFileResult } from '../../lib/conftest-cli.js';
 export interface ConftestVerifyOutput {
-    /** `true` when all `test_*` rules in all test files pass. */
+    /** `true` when every `test_*` rule passed. */
     passed: boolean;
-    /** Per-test-file results. */
+    /**
+     * One entry per test outcome as conftest reports them: a test file
+     * produces one entry per passing rule (`successes: 1`) and one per
+     * failing rule (`failures: [{msg}]`), with `namespace` empty.
+     */
     results: ConftestFileResult[];
     summary: {
-        /** Number of test files with zero failures. */
+        /** Distinct test files with no failing rule. */
         passed: number;
-        /** Number of test files with at least one failure. */
+        /** Distinct test files with at least one failing rule. */
         failed: number;
-        /** Total test cases that passed (sum of `successes` across all files). */
+        /** Test rules that passed, across all files. */
         totalPassed: number;
-        /** Total test cases that failed (sum of `failures` across all files). */
+        /** Test rules that failed, across all files. */
         totalFailed: number;
     };
 }

package/dist/tools/conftest/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA8BjF,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAC;IAChB,6BAA6B;IAC7B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,+CAA+C;QAC/C,MAAM,EAAE,MAAM,CAAC;QACf,sDAAsD;QACtD,MAAM,EAAE,MAAM,CAAC;QACf,0EAA0E;QAC1E,WAAW,EAAE,MAAM,CAAC;QACpB,yEAAyE;QACzE,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAyE9E"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AAsBnC,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE;QACP,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAC;QACf,0DAA0D;QAC1D,MAAM,EAAE,MAAM,CAAC;QACf,gDAAgD;QAChD,WAAW,EAAE,MAAM,CAAC;QACpB,gDAAgD;QAChD,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAgF9E"}

package/dist/tools/conftest/verify.js

@@ -7,16 +7,19 @@
  * the policy directory. Use this to confirm that the policies themselves
  * are correct before deploying them.
  *
- * Exit code mapping (same as conftest_test):
+ * Exit code mapping:
  *   null  -- binary not found → CONFTEST_NOT_FOUND
  *   0     -- all tests pass
- *   1     -- one or more test failures
- *   2+    -- command error
+ *   1     -- test failures when stdout holds results, a command error when it
+ *            does not
+ * `conftest verify` has no --fail-on-warn, so the exit code 2 that
+ * conftest_test handles does not occur here; the results-on-stdout rule is
+ * shared so a command error reaches the caller with conftest's own message.
  */
 import { z } from 'zod';
-import { ConftestCli } from '../../lib/conftest-cli.js';
+import { ConftestCli, parseConftestResults, } from '../../lib/conftest-cli.js';
 import { err, ok } from '../../lib/errors.js';
-import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
 const ConftestVerifyInput = {
     policy: z
         .string()
@@ -24,10 +27,7 @@ const ConftestVerifyInput = {
         .describe('Path to the directory containing both the Rego policies and the `*_test.rego` test files. ' +
         'Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). ' +
         "Omit to use conftest's default `./policy` directory."),
-    namespace: z
-        .string()
-        .optional()
-        .describe('Namespace to verify. Defaults to `main`. Omit to verify all namespaces.'),
+    namespace: z.string().optional().describe('Namespace to verify. Omit to verify all namespaces.'),
     data: z
         .array(z.string())
         .optional()
@@ -39,14 +39,14 @@ export function registerConftestVerify(server, config) {
         title: 'Conftest verify',
         description: 'Run the `test_*` rules inside `*_test.rego` files within a conftest policy directory, ' +
             'verifying that the policies themselves are correct. Equivalent to `opa test` but using ' +
-            "conftest's policy-loading machinery. Returns per-file pass/fail results. " +
+            "conftest's policy-loading machinery. Returns per-file pass/fail results, and " +
+            'NO_TESTS_FOUND when the directory holds no test rules. ' +
             'Requires `conftest` on PATH or `CONFTEST_BINARY` set; returns CONFTEST_NOT_FOUND otherwise.',
         inputSchema: ConftestVerifyInput,
         annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            idempotentHint: true,
-            openWorldHint: false,
+            // Runs Rego supplied by the caller; a policy can reach, and write to, a remote system through http.send.
+            readOnlyHint: false,
+            openWorldHint: true,
         },
     }, async (input, { signal }) => {
         return withToolEnvelope(config, async () => {
@@ -72,41 +72,49 @@ export function registerConftestVerify(server, config) {
             const subprocessFailure = mapSubprocessFailure(result, 'conftest');
             if (subprocessFailure)
                 return subprocessFailure;
-            if (result.exitCode === 0 || result.exitCode === 1) {
-                const parsed = tryParseJson(result.stdout);
-                if (!parsed || !Array.isArray(parsed)) {
-                    return err('UNKNOWN_ERROR', 'conftest verify produced no parseable JSON output.', {
-                        details: { stderr: result.stderr.trim(), exitCode: result.exitCode },
+            // Results on stdout are an outcome whatever the exit code; see
+            // conftest_test for the measured codes.
+            const results = parseConftestResults(result.stdout);
+            if (results !== null) {
+                // conftest prints `null` and exits 0 when it finds no test rules.
+                // A clean pass over nothing is not a pass.
+                if (results.length === 0) {
+                    return err('NO_TESTS_FOUND', 'conftest verify found no test rules in the policy directory.', {
+                        hint: 'Tests live in *_test.rego files inside the policy directory, with rules named test_*.',
                     });
                 }
-                const summary = buildVerifySummary(parsed);
                 return ok({
                     passed: result.exitCode === 0,
-                    results: parsed,
-                    summary,
+                    results,
+                    summary: buildVerifySummary(results),
                 });
             }
             const detail = result.stderr.trim() || result.stdout.trim();
-            return err('UNKNOWN_ERROR', `conftest verify failed with exit code ${result.exitCode}: ${detail}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
+            return err('UNKNOWN_ERROR', `conftest verify failed with exit code ${result.exitCode}: ${detail || 'no output'}`, { details: { exitCode: result.exitCode, stderr: result.stderr.trim() } });
         });
     });
 }
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 function buildVerifySummary(results) {
-    let passed = 0;
-    let failed = 0;
+    // conftest verify reports one entry per test rule, all carrying the test
+    // file's name, so a file with one pass and one failure arrives as two
+    // entries. Files are counted by name, rules by entry.
+    const allFiles = new Set();
+    const failedFiles = new Set();
     let totalPassed = 0;
     let totalFailed = 0;
     for (const r of results) {
-        if (r.failures.length > 0) {
-            failed++;
-        }
-        else {
-            passed++;
-        }
+        allFiles.add(r.filename);
+        if (r.failures.length > 0)
+            failedFiles.add(r.filename);
         totalPassed += r.successes;
         totalFailed += r.failures.length;
     }
-    return { passed, failed, totalPassed, totalFailed };
+    return {
+        passed: allFiles.size - failedFiles.size,
+        failed: failedFiles.size,
+        totalPassed,
+        totalFailed,
+    };
 }
 //# sourceMappingURL=verify.js.map

package/dist/tools/conftest/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,WAAW,EAA2B,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,4FAA4F;QAC1F,0DAA0D;QAC1D,sDAAsD,CACzD;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,yEAAyE,CAAC;IACtF,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,yFAAyF,CAC1F;CACJ,CAAC;AAmBF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,wFAAwF;YACxF,yFAAyF;YACzF,2EAA2E;YAC3E,6FAA6F;QAC/F,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAuB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/D,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC;gBACE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,EACD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAuB,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,OAAO,GAAG,CAAC,eAAe,EAAE,oDAAoD,EAAE;wBAChF,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAC3C,OAAO,EAAE,CAAuB;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO,EAAE,MAAM;oBACf,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,yCAAyC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,EACrE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,OAA6B;IACvD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC;QACX,CAAC;QACD,WAAW,IAAI,CAAC,CAAC,SAAS,CAAC;QAC3B,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/tools/conftest/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EACL,WAAW,EACX,oBAAoB,GAErB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,mBAAmB,GAAG;IAC1B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,4FAA4F;QAC1F,0DAA0D;QAC1D,sDAAsD,CACzD;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IAChG,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,yFAAyF,CAC1F;CACJ,CAAC;AAuBF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,wFAAwF;YACxF,yFAAyF;YACzF,+EAA+E;YAC/E,yDAAyD;YACzD,6FAA6F;QAC/F,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE;YACX,yGAAyG;YACzG,YAAY,EAAE,KAAK;YACnB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1B,OAAO,gBAAgB,CAAuB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/D,oEAAoE;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,oEAAoE;YACpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAClC;gBACE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,EACD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,+DAA+D;YAC/D,wCAAwC;YACxC,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,kEAAkE;gBAClE,2CAA2C;gBAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,GAAG,CACR,gBAAgB,EAChB,8DAA8D,EAC9D;wBACE,IAAI,EAAE,uFAAuF;qBAC9F,CACF,CAAC;gBACJ,CAAC;gBAED,OAAO,EAAE,CAAuB;oBAC9B,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAC7B,OAAO;oBACP,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC;iBACrC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CACR,eAAe,EACf,yCAAyC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,WAAW,EAAE,EACpF,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACzE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,OAA6B;IACvD,yEAAyE;IACzE,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvD,WAAW,IAAI,CAAC,CAAC,SAAS,CAAC;QAC3B,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI;QACxC,MAAM,EAAE,WAAW,CAAC,IAAI;QACxB,WAAW;QACX,WAAW;KACZ,CAAC;AACJ,CAAC"}