svn-agent-mcp 1.0.0

package/src/tools/selfcheck.ts

@@ -0,0 +1,97 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { createEnvelope } from "../envelope.js";
+import { startupProbe } from "../runner.js";
+import type { ToolEnvelope } from "../types.js";
+
+export async function svnSelfCheck(input: { cwd?: string }): Promise<ToolEnvelope> {
+  const root = await projectRoot();
+  const packageJson = JSON.parse(await fs.readFile(path.join(root, "package.json"), "utf8")) as {
+    version: string;
+    scripts?: Record<string, string>;
+  };
+  const currentPath = path.join(root, "current");
+  const currentTarget = await readLinkTarget(currentPath);
+  const currentRelease = currentTarget ? path.basename(currentTarget) : null;
+  const releaseRoot = path.join(root, "releases", `v${packageJson.version}`);
+  const probe = await startupProbe(input.cwd ?? root);
+
+  const binFileCount = await countFiles(path.join(releaseRoot, "bin"));
+  const distFileCount = await countFiles(path.join(releaseRoot, "dist"));
+  const releasePrepare = packageJson.scripts?.["release:prepare"] ?? "";
+  const clean = packageJson.scripts?.clean ?? "";
+  const currentMatchesPackage = currentRelease === `v${packageJson.version}`;
+  const toolchainOk = probe.svn.ok && probe.dos2unix.ok && probe.unix2dos.ok;
+  const notes = [
+    currentMatchesPackage ? "" : "current release pointer does not match package version",
+    toolchainOk ? "" : "bundled SVN/EOL toolchain probe failed"
+  ].filter(Boolean);
+
+  return {
+    ...createEnvelope({
+      ok: currentMatchesPackage && binFileCount > 0 && distFileCount > 0 && toolchainOk,
+      command: "svn_self_check",
+      cwd: root,
+      note: notes.join("; ")
+    }),
+    server_version: packageJson.version,
+    package_version: packageJson.version,
+    current_path: currentPath,
+    current_target: currentTarget,
+    current_release: currentRelease,
+    current_matches_package: currentMatchesPackage,
+    release_root: releaseRoot,
+    bin_file_count: binFileCount,
+    dist_file_count: distFileCount,
+    release_prepare_available: releasePrepare.includes("scripts/prepare-release.mjs"),
+    clean_uses_node: clean.startsWith("node "),
+    toolchain_ok: toolchainOk,
+    startup_probe: probe
+  };
+}
+
+async function projectRoot(): Promise<string> {
+  let current = path.resolve(path.dirname(fileURLToPath(import.meta.url)));
+
+  while (true) {
+    const candidate = path.join(current, "package.json");
+    try {
+      await fs.access(candidate);
+      return current;
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) {
+        throw new Error("could not locate package.json");
+      }
+      current = parent;
+    }
+  }
+}
+
+async function readLinkTarget(value: string): Promise<string | null> {
+  try {
+    const target = await fs.readlink(value);
+    return path.resolve(path.dirname(value), target);
+  } catch {
+    return null;
+  }
+}
+
+async function countFiles(directory: string): Promise<number> {
+  try {
+    const entries = await fs.readdir(directory, { withFileTypes: true });
+    let count = 0;
+    for (const entry of entries) {
+      const child = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        count += await countFiles(child);
+      } else if (entry.isFile()) {
+        count += 1;
+      }
+    }
+    return count;
+  } catch {
+    return 0;
+  }
+}

package/src/types.ts

@@ -0,0 +1,76 @@
+export type SvnStatusCode = "M" | "A" | "D" | "R" | "C" | "?" | "!" | "~" | "G" | "U" | "E";
+
+export interface ChangedPath {
+  status: string;
+  path: string;
+}
+
+export interface Conflict {
+  path: string;
+  type: "text" | "tree" | "prop";
+}
+
+export interface Envelope {
+  [key: string]: unknown;
+  ok: boolean;
+  command: string;
+  cwd: string;
+  revision: number | null;
+  changed_paths: ChangedPath[];
+  conflicts: Conflict[];
+  stdout_summary: string;
+  stderr_summary: string;
+  truncated: boolean;
+  note: string;
+}
+
+export type ToolEnvelope = Envelope;
+
+export interface WcInfo {
+  url: string | null;
+  repo_root: string | null;
+  wc_root: string | null;
+  revision: number | null;
+}
+
+export interface RunResult {
+  command: string;
+  cwd: string;
+  executable: string;
+  args: string[];
+  exitCode: number | null;
+  signal: NodeJS.Signals | null;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+  errorCode?: string | undefined;
+  truncated?: boolean | undefined;
+}
+
+export interface DiffFileSummary {
+  path: string;
+  added: number;
+  removed: number;
+  binary: boolean;
+}
+
+export interface DiffSummary {
+  per_file: DiffFileSummary[];
+  diff_excerpt: string;
+  truncated: boolean;
+}
+
+export type EolKind = "crlf" | "lf" | "mixed" | "none" | "binary" | "skipped-too-large" | "not-a-file";
+
+export interface EolSniff {
+  path: string;
+  kind: EolKind;
+  has_bom: boolean;
+  size: number;
+  sniff: "ok" | "skipped-too-large" | "not-a-file";
+}
+
+export interface EolCheckResult extends EolSniff {
+  eol_style: string | null;
+  mismatch: boolean;
+}

package/tests/README.md

@@ -0,0 +1,9 @@
+# Tests
+
+Use unit tests for guards, parsers, envelopes, and startup probe behavior.
+
+Use throwaway temp SVN repositories for integration tests that mutate SVN state. Never point mutating tests at a real project working copy.
+
+Diagnostic coverage should prove both sides of `svn_diagnose`: healthy temp working copies and
+structured failure envelopes for non-working-copy paths or classified SVN errors. Runtime smoke
+checks against this MCP working copy must stay read-only.

package/tests/diff-redaction.test.ts

@@ -0,0 +1,146 @@
+import { describe, expect, it } from "@jest/globals";
+import { createEnvelope, noteFromRun, redactArgv, redactText } from "../src/envelope.js";
+import { createDiffAccumulator, parseDiffText } from "../src/parse/diffText.js";
+import type { RunResult } from "../src/types.js";
+
+describe("diff parsing and command redaction", () => {
+  it("keeps complete per-file counts even when the excerpt is truncated", () => {
+    const diff = parseDiffText([
+      "Index: big.txt",
+      "===================================================================",
+      "--- big.txt",
+      "+++ big.txt",
+      "+one",
+      "+two",
+      "-old",
+      " context",
+      "+three"
+    ].join("\n"), 4);
+
+    expect(diff.truncated).toBe(true);
+    expect(diff.diff_excerpt.split("\n")).toHaveLength(4);
+    expect(diff.per_file).toEqual([{ path: "big.txt", added: 3, removed: 1, binary: false }]);
+  });
+
+  it("counts streamed diff lines after the excerpt cap", () => {
+    const diff = createDiffAccumulator(2);
+    for (const line of ["Index: streamed.txt", "+one", "+two", "-old", "+three"]) {
+      diff.pushLine(line);
+    }
+
+    expect(diff.summary()).toEqual({
+      per_file: [{ path: "streamed.txt", added: 3, removed: 1, binary: false }],
+      diff_excerpt: "Index: streamed.txt\n+one",
+      truncated: true
+    });
+  });
+
+  it("redacts URL userinfo and sensitive query parameters", () => {
+    const command = redactArgv("svn", [
+      "import",
+      "src",
+      "https://user:secret@example.com/repo?token=abc123&apikey=def456&x=ok"
+    ]);
+
+    expect(command).toContain("https://***:***@example.com/repo?token=***&apikey=***&x=ok");
+    expect(command).not.toContain("secret");
+    expect(command).not.toContain("abc123");
+    expect(command).not.toContain("def456");
+  });
+
+  it("redacts inline credential flags and malformed URL userinfo fragments", () => {
+    const command = redactArgv("svn", [
+      "--password=secret",
+      "--username=bob",
+      "info",
+      "https://user:p@ss@example.com/repo?token=abc123"
+    ]);
+
+    expect(command).toContain("--password=***");
+    expect(command).toContain("--username=***");
+    expect(command).toContain("https://***:***@example.com/repo?token=***");
+    expect(command).not.toContain("secret");
+    expect(command).not.toContain("bob");
+    expect(command).not.toContain("p@ss");
+    expect(command).not.toContain("abc123");
+  });
+
+  it("redacts URL secrets from stdout and stderr summaries", () => {
+    const envelope = createEnvelope({
+      ok: false,
+      command: "svn info",
+      cwd: process.cwd(),
+      stdout: "checking https://user:secret@example.com/repo?token=abc123",
+      stderr: "failed https://user:secret@example.com/repo?apikey=def456"
+    });
+
+    expect(envelope.stdout_summary).toContain("https://***:***@example.com/repo?token=***");
+    expect(envelope.stderr_summary).toContain("https://***:***@example.com/repo?apikey=***");
+    expect(envelope.stdout_summary).not.toContain("secret");
+    expect(envelope.stdout_summary).not.toContain("abc123");
+    expect(envelope.stderr_summary).not.toContain("secret");
+    expect(envelope.stderr_summary).not.toContain("def456");
+  });
+
+  it("redacts reusable text fields such as diff excerpts", () => {
+    const redacted = redactText("+https://user:secret@example.com/repo?token=abc123&apikey=def456\n");
+
+    expect(redacted).toContain("https://***:***@example.com/repo?token=***&apikey=***");
+    expect(redacted).not.toContain("secret");
+    expect(redacted).not.toContain("abc123");
+    expect(redacted).not.toContain("def456");
+  });
+
+  it("does not treat user source lines containing binary words as SVN binary markers", () => {
+    const diff = parseDiffText([
+      "Index: src/a.ts",
+      "===================================================================",
+      "--- src/a.ts",
+      "+++ src/a.ts",
+      "@@ -1 +1,2 @@",
+      "+const isBinary = true;",
+      "+console.log(\"Cannot display in UI\");"
+    ].join("\n"), 100);
+
+    expect(diff.per_file).toEqual([{ path: "src/a.ts", added: 2, removed: 0, binary: false }]);
+  });
+
+  it("marks exact SVN binary diff messages as binary", () => {
+    const diff = parseDiffText([
+      "Index: image.bin",
+      "===================================================================",
+      "Cannot display: file marked as a binary type."
+    ].join("\n"), 100);
+
+    expect(diff.per_file).toEqual([{ path: "image.bin", added: 0, removed: 0, binary: true }]);
+  });
+
+  it("categorizes common SVN auth, network, lock, and database failures", () => {
+    expect(noteFromRun(fakeRun("svn: E215004: No more credentials or we tried too many times"))).toContain("authentication failed");
+    expect(noteFromRun(fakeRun("svn: E175002: Unable to connect to a repository"))).toContain("network");
+    expect(noteFromRun(fakeRun("svn: E155036: working copy locked"))).toContain("svn_cleanup");
+    expect(noteFromRun(fakeRun("svn: E200030: sqlite[S5]: database is locked"))).toContain("database problem");
+  });
+
+  it("points agents at the CLI failsafe when the svn executable cannot launch", () => {
+    const note = noteFromRun({ ...fakeRun(""), errorCode: "ENOENT" });
+    expect(note).toContain("MCP svn runtime unavailable");
+    expect(note).toContain("failsafe");
+    expect(note).toContain("must never be bypassed");
+    expect(noteFromRun(fakeRun("svn: E170001: authorization failed"))).not.toContain("failsafe");
+  });
+});
+
+function fakeRun(stderr: string): RunResult {
+  return {
+    command: "svn",
+    cwd: process.cwd(),
+    executable: "svn",
+    args: [],
+    exitCode: 1,
+    signal: null,
+    stdout: "",
+    stderr,
+    timedOut: false
+  };
+}

package/tests/entrypoint.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from "@jest/globals";
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const distIndex = path.resolve("dist", "index.js");
+
+describe("server entrypoint launch detection", () => {
+  it("starts the server when launched through a directory junction", async () => {
+    if (!fs.existsSync(distIndex)) {
+      // dist/ is produced by `npm run build`; without it there is nothing to launch.
+      return;
+    }
+
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "svn-agent-entry-"));
+    const junction = path.join(tmp, "current");
+    try {
+      fs.symlinkSync(path.resolve("dist"), junction, "junction");
+      const banner = await startupBanner(path.join(junction, "index.js"));
+      expect(banner).toContain("running on stdio");
+    } finally {
+      fs.rmSync(tmp, { recursive: true, force: true });
+    }
+  }, 20000);
+});
+
+function startupBanner(entry: string): Promise<string> {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [entry], { stdio: ["pipe", "pipe", "pipe"] });
+    let stderr = "";
+    const finish = () => {
+      child.kill();
+      resolve(stderr);
+    };
+    const timer = setTimeout(finish, 15000);
+    child.stderr.on("data", (chunk: Buffer) => {
+      stderr += chunk.toString();
+      if (stderr.includes("running on stdio")) {
+        clearTimeout(timer);
+        finish();
+      }
+    });
+    child.on("exit", () => {
+      clearTimeout(timer);
+      resolve(stderr);
+    });
+  });
+}

package/tests/guards-eol.test.ts

@@ -0,0 +1,170 @@
+import { describe, expect, it } from "@jest/globals";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { messageFormatWarning, neverCommitHit, readonlyMode, resolveTargetsInsideWc, riskySignals } from "../src/guards.js";
+import { sniffEol } from "../src/eol.js";
+
+describe("guards and EOL sniffing", () => {
+  it("detects never-commit paths and risky slices", () => {
+    const root = path.resolve("C:/repo");
+    expect(neverCommitHit(path.join(root, "bin", "app.dll"), root)).toBe("**/bin/**");
+    expect(neverCommitHit(path.join(root, "src", "App", "bin", "Debug", "app.dll"), root)).toBe("**/bin/**");
+    expect(neverCommitHit(path.join(root, "src", "App", "obj", "Debug", "app.dll"), root)).toBe("**/obj/**");
+    expect(neverCommitHit(path.join(root, "dist", "index.js"), root)).toBe("**/dist/**");
+    expect(neverCommitHit(path.join(root, "src", "dist", "bundle.js"), root)).toBe("**/dist/**");
+    expect(neverCommitHit(path.join(root, "node_modules", "pkg", "index.js"), root)).toBe("**/node_modules/**");
+    expect(neverCommitHit(path.join(root, "coverage", "lcov.info"), root)).toBe("**/coverage/**");
+    expect(neverCommitHit(path.join(root, "scratch", "notes.txt"), root)).toBe("scratch/**");
+    expect(neverCommitHit(path.join(root, "tsconfig.tsbuildinfo"), root)).toBe("**/*.tsbuildinfo");
+    expect(neverCommitHit(path.join(root, "binary.txt"), root)).toBeNull();
+    expect(neverCommitHit(path.join(root, "distillery", "notes.txt"), root)).toBeNull();
+    expect(neverCommitHit(path.join(root, "src", "app.ts"), root)).toBeNull();
+
+    const paths = Array.from({ length: 9 }, (_, index) => path.join(root, "src", `f${index}.ts`));
+    expect(riskySignals(paths, root)).toContain("more than 8 paths");
+    expect(riskySignals([path.join(root, "app.csproj")], root)).toContain("build-system file touched");
+  });
+
+  it("allows repository-local never-commit exceptions without weakening nested defaults", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "svn-agent-policy-"));
+    try {
+      fs.writeFileSync(
+        path.join(root, ".svn-mcp-policy.json"),
+        JSON.stringify({
+          neverCommit: {
+            allow: ["bin/**", "releases/v*/bin/**", "releases/v*/dist/**"]
+          }
+        }),
+        "utf8"
+      );
+
+      expect(neverCommitHit(path.join(root, "bin", "svn.exe"), root)).toBeNull();
+      expect(neverCommitHit(path.join(root, "releases", "v1.2.3", "dist", "index.js"), root)).toBeNull();
+      expect(neverCommitHit(path.join(root, "src", "App", "bin", "Debug", "app.dll"), root)).toBe("**/bin/**");
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps repository-local deny rules stronger than broad allow exceptions", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "svn-agent-policy-deny-"));
+    try {
+      fs.writeFileSync(
+        path.join(root, ".svn-mcp-policy.json"),
+        JSON.stringify({
+          neverCommit: {
+            allow: ["releases/**"],
+            deny: ["releases/**/secrets/**"]
+          }
+        }),
+        "utf8"
+      );
+
+      expect(neverCommitHit(path.join(root, "releases", "v1.2.3", "dist", "index.js"), root)).toBeNull();
+      expect(neverCommitHit(path.join(root, "releases", "v1.2.3", "dist", "secrets", "key.pem"), root)).toBe("releases/**/secrets/**");
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it("reports invalid and unsafe repository-local policies as policy errors", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "svn-agent-policy-invalid-"));
+    try {
+      fs.writeFileSync(path.join(root, ".svn-mcp-policy.json"), "{not json", "utf8");
+      expect(neverCommitHit(path.join(root, "src", "app.ts"), root)).toBe("policy-error: invalid .svn-mcp-policy.json");
+
+      fs.writeFileSync(
+        path.join(root, ".svn-mcp-policy.json"),
+        JSON.stringify({ neverCommit: { deny: ["**/**/**/**/**/**/**/**/**/**/*.ts"] } }),
+        "utf8"
+      );
+      expect(neverCommitHit(path.join(root, "src", "app.ts"), root)).toContain("policy-error:");
+
+      fs.writeFileSync(
+        path.join(root, ".svn-mcp-policy.json"),
+        JSON.stringify({ neverCommit: { deny: ["*a*a*a*a*a*a*a*a*aZ"] } }),
+        "utf8"
+      );
+      expect(neverCommitHit(path.join(root, "src", "app.ts"), root)).toContain("policy-error:");
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it("warns on non-template commit messages", () => {
+    expect(messageFormatWarning("Short\n\n- verification")).toBeNull();
+    expect(messageFormatWarning("Short only")).toBe("commit message format warning");
+  });
+
+  it("returns realpath-expanded paths for SVN command targets", () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "svn-agent-realpath-"));
+    try {
+      fs.mkdirSync(path.join(root, "nested"));
+      const cwd = process.platform === "win32" ? root.toUpperCase() : root;
+      const resolved = resolveTargetsInsideWc(cwd, cwd, ["nested/new-file.txt"]);
+
+      expect(resolved.ok).toBe(true);
+      if (resolved.ok) {
+        expect(resolved.paths).toEqual([
+          path.join(fs.realpathSync.native(root), "nested", "new-file.txt")
+        ]);
+      }
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it("enables readonly mode from a CLI flag without end-user environment variables", () => {
+    const savedArgv = [...process.argv];
+    const savedReadonly = process.env.SVN_AGENT_READONLY;
+    delete process.env.SVN_AGENT_READONLY;
+
+    try {
+      expect(readonlyMode()).toBe(false);
+      process.argv.push("--readonly");
+      expect(readonlyMode()).toBe(true);
+    } finally {
+      process.argv.splice(0, process.argv.length, ...savedArgv);
+      if (savedReadonly === undefined) {
+        delete process.env.SVN_AGENT_READONLY;
+      } else {
+        process.env.SVN_AGENT_READONLY = savedReadonly;
+      }
+    }
+  });
+
+  it("classifies CRLF, LF, mixed, BOM, and binary files", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "svn-agent-eol-"));
+    try {
+      const crlf = path.join(dir, "crlf.txt");
+      const lf = path.join(dir, "lf.txt");
+      const mixed = path.join(dir, "mixed.txt");
+      const bom = path.join(dir, "bom.txt");
+      const binary = path.join(dir, "binary.bin");
+
+      fs.writeFileSync(crlf, "a\r\nb\r\n", "utf8");
+      fs.writeFileSync(lf, "a\nb\n", "utf8");
+      fs.writeFileSync(mixed, "a\r\nb\n", "utf8");
+      fs.writeFileSync(bom, Buffer.from([0xef, 0xbb, 0xbf, 0x61, 0x0d, 0x0a]));
+      fs.writeFileSync(binary, Buffer.from([0x61, 0x00, 0x62]));
+
+      await expect(sniffEol(crlf)).resolves.toMatchObject({ kind: "crlf" });
+      await expect(sniffEol(lf)).resolves.toMatchObject({ kind: "lf" });
+      await expect(sniffEol(mixed)).resolves.toMatchObject({ kind: "mixed" });
+      await expect(sniffEol(bom)).resolves.toMatchObject({ has_bom: true });
+      await expect(sniffEol(binary)).resolves.toMatchObject({ kind: "binary" });
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("returns a structured not-a-file sniff for directories instead of throwing", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "svn-agent-eol-dir-"));
+    try {
+      await expect(sniffEol(dir)).resolves.toMatchObject({ kind: "not-a-file", sniff: "not-a-file" });
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});