offerguard-mcp-server 0.4.0 → 0.4.2

package/test/decision-engine.test.js

@@ -1,210 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { auditOfferGuardInput as audit, matchRiskTerms, calculateOfferScore, checkInternshipCompliance } from "../src/offerguard-tools.js";
-import { PROFILE, GOOD_JD, CASES } from "./fixtures.js";
-
-for (const phrase of ["不收押金", "不收取任何押金", "无需缴纳保证金", "不安排无薪试岗", "没有培训贷", "不会要求缴纳押金"]) {
-  test(`negative risk: ${phrase}`, () => {
-    const r = audit({ structured_input: { jd_text: `${GOOD_JD}；${phrase}。`, student_profile: PROFILE } });
-    assert.equal(r.compliance_red_lines.length, 0);
-    assert.notEqual(r.route, "reject");
-  });
-}
-test("student boundaries do not contaminate job facts", () => {
-  const r = audit({ raw_input: `JD：${GOOD_JD}\n学生：${PROFILE} 不接受押金、培训贷、无薪试岗。` });
-  assert.equal(r.route, "advance"); assert.equal(r.compliance_red_lines.length, 0);
-  assert.equal(r.facts.unpaid_trial.status, "unknown");
-});
-test("missing benefits are not granted", () => {
-  const r = audit({ structured_input: { jd_text: "北京后端开发实习生，参与真实项目开发，180元/天。10:00-18:00。无导师。不签实习协议。无转正标准。提供项目证明。", student_profile: PROFILE } });
-  for (const key of ["mentor", "agreement", "conversion"]) assert.equal(r.facts[key].status, "negated");
-  assert.notEqual(r.route, "advance");
-  assert.equal(r.dimensions.find(d => d.key === "compliance_safety").score, 20);
-});
-test("unknown and questions stay unknown", () => {
-  for (const phrase of ["导师未知", "未说明导师", "是否有导师？", "导师待确认", "可能有导师", "不确定有导师"]) {
-    const r = audit({ structured_input: { jd_text: `后端实习生。${phrase}`, student_profile: PROFILE } });
-    assert.equal(r.facts.mentor.status, "unknown", phrase);
-  }
-});
-test("unattributed text is not silently asserted as employer facts", () => {
-  const r = audit({ raw_input: "我不接受押金，希望有导师。公司可能有岗位。" });
-  assert.equal(r.compliance_red_lines.length, 0); assert.equal(r.overall_score, null);
-});
-test("missing input has no invented dimensions or total", () => {
-  const r = audit(CASES.missing);
-  assert.equal(r.route, "followup"); assert.equal(r.overall_score, null);
-  assert.equal(r.dimensions.find(d => d.key === "role_match").score, null);
-  assert.equal(r.dimensions.find(d => d.key === "growth_value").score, null);
-  assert.ok(r.required_followup_questions.length <= 3);
-});
-test("independent profiles change role match", () => {
-  const a = audit(CASES.advance);
-  const b = audit({ structured_input: { jd_text: GOOD_JD, student_profile: "新闻学大三，做过公众号运营；薪资底线120元/天；每周可到岗4天。" } });
-  assert.ok(a.dimensions[0].score > b.dimensions[0].score);
-  assert.ok(a.overall_score > b.overall_score);
-  assert.notEqual(b.route, "advance");
-});
-test("clear red lines take precedence over missing information", () => {
-  const r = audit(CASES.reject);
-  assert.equal(r.route, "reject"); assert.equal(r.risk_level, "critical");
-  assert.equal(r.overall_score, null); assert.equal(r.compliance_red_lines.length, 2);
-});
-test("full case can advance without demo override", () => {
-  const r = audit(CASES.advance);
-  assert.equal(r.route, "advance"); assert.ok(r.overall_score >= 75);
-  assert.ok(r.dimensions.every(d => d.evidence.length));
-});
-test("demo label cannot force recommendation", () => {
-  const r = audit({ raw_input: "演示案例1 推荐推进\nJD：先交押金800元。\n学生：大三学生。" });
-  assert.equal(r.route, "reject");
-});
-test("HR reply fills unknown salary and updates decision", () => {
-  const first = audit({ structured_input: { jd_text: GOOD_JD.replace("薪资180元/天，每月15日发放。", ""), student_profile: PROFILE } });
-  assert.equal(first.overall_score, null);
-  const next = audit({ raw_input: "HR回复：薪资180元/天，每月15日发放。", previous_state: first.next_state });
-  assert.equal(next.route, "advance"); assert.ok(next.overall_score !== null);
-  assert.ok(next.changes.some(c => c.key === "salary" && c.before === "unknown" && c.after === "affirmed"));
-  assert.ok(next.report_text.includes("本轮更新"));
-});
-test("contradictory HR salary is preserved and blocks total", () => {
-  const first = audit(CASES.advance);
-  const next = audit({ raw_input: "HR回复：薪资100元/天。", previous_state: first.next_state });
-  assert.equal(next.facts.salary.status, "conflict"); assert.equal(next.overall_score, null);
-  assert.equal(next.route, "verify"); assert.equal(next.facts.salary.evidence.length, 2);
-});
-test("replaying reply does not duplicate state", () => {
-  const a = audit(CASES.advance), b = audit({ raw_input: "HR回复：有导师。", previous_state: a.next_state });
-  const c = audit({ raw_input: "HR回复：有导师。", previous_state: b.next_state });
-  assert.equal(b.next_state.records.length, c.next_state.records.length);
-});
-test("caller risk summaries cannot bypass evidence", () => {
-  const r = calculateOfferScore({ jdText: "后端实习生，需要缴纳押金。", studentProfile: PROFILE, complianceResult: { summary: { red_line_count: 0 } }, riskTermResult: { risk_terms: [] } });
-  assert.equal(r.route, "reject");
-});
-test("comparison uses independent offers and avoids rejecting both", () => {
-  const r = audit({ structured_input: { student_profile: PROFILE, offers: [{ id: "A", jd_text: GOOD_JD }, { id: "B", jd_text: "后端实习生，先交押金800元。" }] } });
-  assert.equal(r.recommended_offer, "A"); assert.equal(r.offers[0].route, "advance");
-  assert.equal(r.offers[1].route, "reject"); assert.equal(r.backup_conditions.length, 2);
-});
-test("comparison does not guess a winner with unknown facts", () => {
-  const r = audit({ structured_input: { student_profile: PROFILE, offers: [{ id: "A", jd_text: "后端实习生，薪资面议。" }, { id: "B", jd_text: "后端实习生，薪资面议。" }] } });
-  assert.equal(r.recommended_offer, null);
-});
-test("negotiation mode produces short communication instead of scored report", () => {
-  const r = audit(CASES.negotiation);
-  assert.equal(r.mode, "negotiation"); assert.ok(r.negotiation_cards.length);
-  assert.ok(!r.report_text.includes("七维评分")); assert.ok(!r.report_text.includes("综合分"));
-});
-test("next-step menu reuses current offer state", () => {
-  const a = audit(CASES.reject), r = audit({ raw_input: "2", previous_state: a.next_state });
-  assert.equal(r.mode, "negotiation"); assert.ok(r.report_text.includes("重大风险"));
-});
-test("dates use runtime Beijing date; output has no code fences or tables", () => {
-  const r = audit({ ...CASES.advance, mode: "full_report" });
-  const expected = new Intl.DateTimeFormat("sv-SE", { timeZone: "Asia/Shanghai" }).format(new Date());
-  assert.equal(r.report_date, expected);
-  assert.ok(!r.report_text.includes("```")); assert.ok(!r.report_text.includes("|"));
-  assert.ok(r.report_text.includes("MCP工具审计摘要"));
-});
-test("knowledge ownership alone is not an automatic red line", () => {
-  const r = matchRiskTerms({ jdText: "代码归公司所有，经过审核可脱敏展示。" });
-  assert.equal(r.risk_terms.length, 0);
-});
-test("five identical assessments have stable decisions", () => {
-  const results = Array.from({ length: 5 }, () => audit(CASES.advance));
-  for (const r of results) assert.deepEqual([r.route, r.overall_score, r.dimensions], [results[0].route, results[0].overall_score, results[0].dimensions]);
-});
-test("bad or oversized state is rejected", () => {
-  assert.throws(() => audit({ previous_state: { schema_version: 2, records: [] } }), /schema/);
-  assert.throws(() => audit({ previous_state: { schema_version: 1, records: [{ source: "system", text: "x" }] } }), /source/);
-  assert.throws(() => audit({ raw_input: "x".repeat(40001) }), /too long/);
-});
-test("tool evidence is a literal substring of the correct source", () => {
-  const r = audit(CASES.reject);
-  for (const risk of r.risk_terms) for (const e of risk.evidence) {
-    assert.ok(r.next_state.records.find(s => s.id === e.source_id).text.includes(e.quote));
-    assert.notEqual(e.source, "student");
-  }
-});
-test("compliance tool exposes negative evidence", () => {
-  const r = checkInternshipCompliance({ jdText: "不收押金。不安排无薪试岗。" });
-  assert.equal(r.red_lines.length, 0); assert.equal(r.facts.deposit_or_fee.status, "negated");
-});
-test("coordinated negations do not introduce red lines", () => {
-  const r = matchRiskTerms({ jdText: "不要求押金和培训贷。不安排无薪试岗。" });
-  assert.equal(r.risk_terms.length, 0);
-});
-test("new offer clears old source documents", () => {
-  const first = audit(CASES.reject);
-  const r = audit({ ...CASES.advance, previous_state: first.next_state, new_assessment: true });
-  assert.equal(r.route, "advance"); assert.equal(r.changes.length, 0);
-  assert.ok(!r.next_state.records.some(x => x.text.includes("800元")));
-});
-test("salary below student floor cannot advance", () => {
-  const r = audit({ structured_input: { jd_text: GOOD_JD.replace("180元", "100元"), student_profile: PROFILE } });
-  assert.equal(r.preference_checks.salary_fit, "below_floor_or_range");
-  assert.equal(r.route, "verify"); assert.ok(r.one_sentence_reason.includes("底线"));
-});
-test("negotiation questions address HR and match the requested topic", () => {
-  const r = audit(CASES.negotiation);
-  assert.ok(r.report_text.includes("发放时间")); assert.ok(!r.report_text.includes("补充专业"));
-});
-test("interview mode covers three counterpart roles", () => {
-  const r = audit({ ...CASES.verify, mode: "interview_prep" });
-  assert.deepEqual(r.negotiation_cards.map(c => c.role), ["HR", "直属主管", "业务团队"]);
-});
-test("raw A/B labels keep student and offer sources separate", () => {
-  const r = audit({ raw_input: `学生：${PROFILE}\nA：${GOOD_JD}\nB：后端实习生，需要押金800元。` });
-  assert.equal(r.recommended_offer, "A"); assert.equal(r.offers[0].route, "advance");
-  assert.equal(r.offers[1].route, "reject");
-});
-test("comparison offers below the student's floor are not recommended", () => {
-  const r = audit({ structured_input: { student_profile: PROFILE, offers: [{ id: "A", jd_text: GOOD_JD.replace("180元", "100元") }, { id: "B", jd_text: GOOD_JD.replace("180元", "90元") }] } });
-  assert.equal(r.recommended_offer, null);
-});
-test("evidence cannot create code fences, tables or embedded images in report", () => {
-  const r = audit({ structured_input: { jd_text: `${GOOD_JD}\n押金800元，\`\`\` ![x](https://example.com/x) |`, student_profile: PROFILE }, mode: "full_report" });
-  assert.ok(!r.report_text.includes("```")); assert.ok(!r.report_text.includes("|"));
-  assert.ok(!r.report_text.includes("![x]("));
-});
-test("single string MCP binding supports structured workflow envelope", () => {
-  const first = audit({ raw_input: JSON.stringify({ offerguard_schema: 1, ...CASES.advance }) });
-  assert.equal(first.route, "advance");
-  const second = audit({ raw_input: JSON.stringify({ offerguard_schema: 1, user_message: "2", previous_state: first.next_state }) });
-  assert.equal(second.mode, "negotiation"); assert.equal(second.route, "advance");
-});
-test("invalid envelope fields cannot bypass schema checks", () => {
-  assert.throws(() => audit({ raw_input: JSON.stringify({ offerguard_schema: 1, structured_input: { offers: "bad" } }) }), /two offers/);
-  assert.throws(() => audit({ raw_input: JSON.stringify({ offerguard_schema: 1, mode: "invent" }) }), /mode/);
-});
-test("no project participation and no dedicated mentor do not receive benefits", () => {
-  const r = audit({ structured_input: { jd_text: "后端实习生，无专属导师。不参与真实项目。", student_profile: PROFILE } });
-  assert.equal(r.facts.mentor.status, "negated"); assert.equal(r.facts.project.status, "negated");
-  assert.equal(r.dimensions.find(d => d.key === "growth_value").score, 20);
-});
-test("explicitly absent skills do not count as experience matches", () => {
-  const r = audit({ structured_input: { jd_text: GOOD_JD, student_profile: "新闻学大三。没有Java经验。薪资底线120元/天，每周可到岗4天。" } });
-  assert.equal(r.dimensions[0].score, 40);
-});
-test("hypothetical benefit is unknown", () => {
-  const r = audit({ structured_input: { jd_text: "后端实习生。如果项目启动就安排导师。", student_profile: PROFILE } });
-  assert.equal(r.facts.mentor.status, "unknown");
-});
-test("source extraction cannot invent statements absent from original input", () => {
-  assert.throws(() => audit({ structured_input: { original_input: "JD：薪资面议", jd_text: "薪资180元/天，有导师" } }), /literal excerpt/);
-  const r = audit({ structured_input: { original_input: `JD：${GOOD_JD}\n学生：${PROFILE}`, jd_text: GOOD_JD, student_profile: PROFILE } });
-  assert.equal(r.route, "advance");
-});
-test("supported English risk vocabulary also respects negation", () => {
-  const r = matchRiskTerms({ jdText: "No deposit. No unpaid trial. We do not require any training loan." });
-  assert.equal(r.risk_terms.length, 0);
-});
-test("portfolio prohibition is not a portfolio benefit", () => {
-  const r = audit({ structured_input: { jd_text: "Backend internship. Portfolio not allowed.", student_profile: PROFILE } });
-  assert.equal(r.facts.portfolio.status, "negated");
-});
-test("no conversion criteria does not mean no conversion opportunity", () => {
-  const r = audit({ structured_input: { jd_text: "后端实习生。无转正标准。", student_profile: PROFILE + "不要求转正。" } });
-  assert.notEqual(r.dimensions.find(d => d.key === "conversion_clarity").status, "not_applicable");
-});

package/test/fixtures.js

@@ -1,10 +0,0 @@
-// Synthetic cases only. They are not injected into production inputs.
-export const PROFILE = "大三计算机专业，有 Java 后端项目经历；城市北京；薪资底线120元/天；每周可到岗4天；不接受长期加班。";
-export const GOOD_JD = "北京后端开发实习生，参与真实项目开发。薪资180元/天，每月15日发放。10:00-18:00，不加班。入职签署实习协议。有导师每周带教。提供项目证明，可用于作品集。有转正标准和评估周期。";
-export const CASES = {
-  advance: { structured_input: { jd_text: GOOD_JD, student_profile: PROFILE } },
-  verify: { structured_input: { jd_text: "北京后端开发实习生，参与真实项目开发。薪资150元/天，月结。10:00-18:00，可能加班。签署实习协议。导师未知，转正标准未明确。", student_profile: PROFILE } },
-  reject: { structured_input: { jd_text: "北京后端实习生，前五天无薪试岗，需缴纳保证金800元。周末随叫随到。", student_profile: PROFILE } },
-  negotiation: { raw_input: "怎么和HR确认薪资？", mode: "negotiation" },
-  missing: { raw_input: "JD：新媒体运营实习生，负责内容发布，薪资面议。" }
-};

package/test/mcp-protocol.test.js

@@ -1,84 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { createApp } from "../src/server.js";
-import { TOOL_VERSION } from "../src/decision-engine.js";
-import { CASES, GOOD_JD, PROFILE } from "./fixtures.js";
-
-const names = ["internship_compliance_checker", "offer_score_calculator", "offerguard_audit", "risk_term_matcher"];
-async function listen(app) {
-  return new Promise((resolve, reject) => {
-    const server = app.listen(0, "127.0.0.1", () => resolve(server));
-    server.once("error", reject);
-  });
-}
-async function close(app, server) {
-  await app.closeTransports();
-  server.closeAllConnections();
-  await new Promise(resolve => server.close(resolve));
-}
-async function call(client, name, args) {
-  const r = await client.callTool({ name, arguments: args });
-  assert.ok(!r.isError, JSON.stringify(r));
-  assert.ok(r.structuredContent);
-  assert.deepEqual(r.structuredContent, JSON.parse(r.content.find(c => c.type === "text").text));
-  return r.structuredContent;
-}
-async function verify(client) {
-  const tools = await client.listTools();
-  assert.deepEqual(tools.tools.map(t => t.name).sort(), names);
-  const schema = tools.tools.find(t => t.name === "offerguard_audit").inputSchema;
-  assert.ok(schema.properties.previous_state); assert.ok(schema.properties.structured_input);
-  const risk = await call(client, "risk_term_matcher", { jdText: "薪资面议，需要弹性工作。" });
-  assert.ok(risk.risk_terms.some(r => r.term === "薪资面议"));
-  const compliance = await call(client, "internship_compliance_checker", { jdText: "需要缴纳保证金并无薪试岗。" });
-  assert.equal(compliance.red_lines.length, 2);
-  const score = await call(client, "offer_score_calculator", { jdText: GOOD_JD, studentProfile: PROFILE });
-  assert.equal(score.route, "advance");
-  const reject = await call(client, "offerguard_audit", CASES.reject);
-  assert.equal(reject.route, "reject"); assert.equal(reject.overall_score, null);
-  const missing = await call(client, "offerguard_audit", CASES.missing);
-  assert.equal(missing.route, "followup"); assert.equal(missing.overall_score, null);
-  const first = await call(client, "offerguard_audit", { structured_input: { jd_text: GOOD_JD.replace("薪资180元/天，每月15日发放。", ""), student_profile: PROFILE } });
-  const next = await call(client, "offerguard_audit", { previous_state: first.next_state, raw_input: "HR回复：薪资180元/天，每月15日发放。" });
-  assert.equal(next.route, "advance"); assert.ok(next.changes.length);
-  const compared = await call(client, "offerguard_audit", { structured_input: { student_profile: PROFILE, offers: [{ id: "A", jd_text: GOOD_JD }, { id: "B", jd_text: "实习生，需要押金。" }] } });
-  assert.equal(compared.recommended_offer, "A");
-  const envelope = await call(client, "offerguard_audit", { raw_input: JSON.stringify({ offerguard_schema: 1, ...CASES.advance }) });
-  assert.equal(envelope.route, "advance");
-  const invalid = await client.callTool({ name: "offerguard_audit", arguments: { raw_input: "x".repeat(40001) } });
-  assert.equal(invalid.isError, true);
-  const combinedTooLong = await client.callTool({ name: "offerguard_audit", arguments: { raw_input: "x".repeat(21000), structured_input: { jd_text: "y".repeat(21000) } } });
-  assert.equal(combinedTooLong.isError, true); assert.equal(combinedTooLong.structuredContent.mcp_ok, false);
-}
-
-for (const protocol of ["http", "sse", "stdio"]) {
-  test(`real MCP ${protocol}: initialize, schema, four tools, state, comparison and errors`, { timeout: 30000 }, async () => {
-    let app, server, transport;
-    if (protocol === "stdio") transport = new StdioClientTransport({ command: process.execPath, args: ["src/stdio.js"], cwd: process.cwd(), stderr: "pipe" });
-    else {
-      app = createApp({ host: "127.0.0.1" }); server = await listen(app);
-      const base = `http://127.0.0.1:${server.address().port}`;
-      const health = await fetch(`${base}/health`).then(r => r.json());
-      assert.equal(health.version, TOOL_VERSION);
-      transport = protocol === "http" ? new StreamableHTTPClientTransport(new URL(`${base}/mcp`)) : new SSEClientTransport(new URL(`${base}/sse`));
-    }
-    const client = new Client({ name: "offerguard-retest", version: TOOL_VERSION });
-    try { await client.connect(transport); await verify(client); }
-    finally { await client.close(); if (server) await close(app, server); }
-  });
-}
-
-test("HTTP outage rejects tool call instead of producing a report", { timeout: 10000 }, async () => {
-  const app = createApp({ host: "127.0.0.1" }), server = await listen(app);
-  const transport = new StreamableHTTPClientTransport(new URL(`http://127.0.0.1:${server.address().port}/mcp`));
-  const client = new Client({ name: "offerguard-failure-test", version: TOOL_VERSION });
-  try {
-    await client.connect(transport);
-    await close(app, server);
-    await assert.rejects(() => client.callTool({ name: "offerguard_audit", arguments: CASES.advance }));
-  } finally { await client.close(); if (server.listening) await close(app, server); }
-});

package/workflow/retest-prompts.json

@@ -1,16 +0,0 @@
-{
-  "status": "prepared_not_applied_to_live_workflow",
-  "target_mcp_version": "0.4.0",
-  "extraction_system": "你是OfferGuard的来源分离器，只负责区分当前用户原话中的岗位资料、学生资料和HR回复，并识别本轮任务。输出JSON，不评分、不改写事实、不推断企业情况。所有非空来源字段必须逐字取自本轮用户原话；缺失字段省略。不要把学生的底线、希望、拒绝条件放进JD。多段来源不能安全提取时保留raw_input并标记需要用户区分。单岗位返回structured_input.jd_text、student_profile、hr_reply；两岗位返回offers数组，每项id、jd_text、可选hr_reply；学生画像独立共享。original_input必须由工作流直接绑定用户原话，不能由你生成。mode只可为single_check、negotiation、interview_prep、accept_conditions、full_report。回复1/2/3依次对应后三种操作中的interview_prep/negotiation/accept_conditions。新岗位返回new_assessment:true。你无权生成或修改previous_state。演示案例按普通来源处理，不预设分数、路线或结果。",
-  "input_gate_system": "基于来源分离结果检查是否有岗位原文与学生背景。信息不足最多追问三个关键信息，不评分；已有岗位收费、贷款或无薪安排原文时仍交真实MCP识别风险。有上一轮状态的补充回复、反问、话术和接受条件请求直接交真实MCP，不要求用户重填所有信息。不为简短输入编造城市、工资、背景或到岗信息。具体评分所需字段由MCP统一校验。",
-  "report_system": "你只负责展示本轮真实MCP返回的report_text。必须先检查平台节点成功状态、结果非空、isError不是true、mcp_ok为true且report_text非空。任一不满足，只输出：MCP 工具调用失败，暂不能生成 OfferGuard 风险报告。请稍后重试。成功时原样输出report_text，不包代码块，不改日期、分数、路线，不增加企业事实，不输出整个JSON，不伪造MCP调用声明，不使用旧报告替代本轮失败。next_state由工作流会话变量保存，不在用户报告展示。",
-  "welcome": "你好，我是OfferGuard。把岗位JD和你的专业、相关经历、薪资底线及到岗安排发给我，我会先给出简短判断和最需要确认的问题。拿到HR回复后继续发来，我会说明哪些判断发生了变化。",
-  "integration_notes": [
-    "这是待应用的提示词资源，不是星辰可导入工作流文件。",
-    "先读取并备份线上版本再修改，不能用旧本地快照覆盖当前配置。",
-    "优先直接绑定report_text到结束节点，省去模型重写。平台能力须实际核对。",
-    "previous_state必须在同用户、同会话、同岗位内隔离保存。",
-    "envelope_json必须使用结构化序列化组合真实输入和状态，禁止模型重写状态。",
-    "MCP故障不能使用代码或Prompt伪装审计成功。"
-  ]
-}