tina4-nodejs 3.12.10 → 3.13.1

package/packages/core/src/graphql.ts

@@ -403,8 +403,106 @@ export class GraphQL {
   private types: Map<string, Record<string, GraphQLField>> = new Map();
   private queries: Map<string, QueryConfig> = new Map();
   private mutations: Map<string, QueryConfig> = new Map();
+  /** Object-type field resolvers indexed by `[typeName][fieldName]`. */
+  private fieldResolvers: Map<string, Map<string, ResolverFn>> = new Map();
+
+  // ── Class-level resolver registry — 3.13.1 ──────────────────────────
+  //
+  // Resolvers registered via `GraphQL.resolve("Type", "field", fn)`
+  // accumulate here BEFORE any GraphQL instance exists. When `new GraphQL()`
+  // runs, the instance drains the registry into its schema. Cross-framework
+  // parity with Python @GraphQL.resolve, PHP GraphQL::resolve, Ruby
+  // Tina4::GraphQL.resolve.
+  private static classResolvers = new Map<string, Map<string, ResolverFn>>();
+  private static defaultInstance: GraphQL | null = null;
 
-  constructor() {}
+  /**
+   * Decorator-style resolver registration.
+   *
+   *     GraphQL.resolve("Query", "products", async (root, args) =>
+   *       db.fetchAll("SELECT * FROM products"));
+   *
+   *     GraphQL.resolve("Mutation", "createProduct", async (root, args) => {
+   *       const p = new Product(args.input);
+   *       await p.save();
+   *       return p.toDict();
+   *     });
+   *
+   *     GraphQL.resolve("Product", "reviews", async (product, args) =>
+   *       db.fetchAll("SELECT * FROM reviews WHERE product_id = ?", [product.id]));
+   *
+   * Resolvers registered before any GraphQL instance exists accumulate
+   * in the class-level registry. `new GraphQL()` drains them into its
+   * schema. Resolvers registered after `setDefault(gql)` wire into the
+   * live schema immediately.
+   */
+  static resolve(typeName: string, fieldName: string, resolver: ResolverFn): void {
+    let typeMap = GraphQL.classResolvers.get(typeName);
+    if (!typeMap) {
+      typeMap = new Map();
+      GraphQL.classResolvers.set(typeName, typeMap);
+    }
+    typeMap.set(fieldName, resolver);
+
+    if (GraphQL.defaultInstance) {
+      GraphQL.defaultInstance.attachResolver(typeName, fieldName, resolver);
+    }
+  }
+
+  /**
+   * Designate `instance` as the default singleton. Post-startup
+   * `GraphQL.resolve()` calls wire into this instance's live schema.
+   */
+  static setDefault(instance: GraphQL): void {
+    GraphQL.defaultInstance = instance;
+  }
+
+  /** Test-only — clear the class-level registry. */
+  static _clearClassResolvers(): void {
+    GraphQL.classResolvers.clear();
+    GraphQL.defaultInstance = null;
+  }
+
+  constructor() {
+    // Drain any resolvers registered via the class-level GraphQL.resolve()
+    // BEFORE this instance was constructed.
+    for (const [typeName, fields] of GraphQL.classResolvers.entries()) {
+      for (const [fieldName, resolver] of fields.entries()) {
+        this.attachResolver(typeName, fieldName, resolver);
+      }
+    }
+  }
+
+  /** Wire a single resolver into the live schema. */
+  private attachResolver(typeName: string, fieldName: string, resolver: ResolverFn): void {
+    if (typeName === "Query") {
+      const existing = this.queries.get(fieldName) ?? { args: {}, returnType: "String", resolver };
+      existing.resolver = resolver;
+      this.queries.set(fieldName, existing);
+      return;
+    }
+    if (typeName === "Mutation") {
+      const existing = this.mutations.get(fieldName) ?? { args: {}, returnType: "String", resolver };
+      existing.resolver = resolver;
+      this.mutations.set(fieldName, existing);
+      return;
+    }
+    // Object-type field resolver
+    let typeMap = this.fieldResolvers.get(typeName);
+    if (!typeMap) {
+      typeMap = new Map();
+      this.fieldResolvers.set(typeName, typeMap);
+    }
+    typeMap.set(fieldName, resolver);
+  }
+
+  /**
+   * Get the field resolver registered for an object type, if any.
+   * Used by the executor during nested field resolution.
+   */
+  getFieldResolver(typeName: string, fieldName: string): ResolverFn | undefined {
+    return this.fieldResolvers.get(typeName)?.get(fieldName);
+  }
 
   /**
    * Return schema metadata for debugging.

package/packages/core/src/index.ts

@@ -64,14 +64,25 @@ export {
   CLOSE_NORMAL, CLOSE_PROTOCOL_ERROR,
 } from "./websocket.js";
 export type { WebSocketClient } from "./websocket.js";
-export { ServiceRunner, matchCronField, matchesCron } from "./service.js";
+export { ServiceRunner, Tina4Service, matchCronField, matchesCron } from "./service.js";
 export type { ServiceOptions, ServiceContext, ServiceHandler, ServiceInfo } from "./service.js";
 export { responseCache, clearCache, cacheStats, cacheGet, cacheSet, cacheDelete, cacheClear, cacheBackendStats, _resetBackend } from "./cache.js";
 export type { ResponseCacheConfig } from "./cache.js";
 export { Api } from "./api.js";
 export type { ApiResult } from "./api.js";
 export { Events } from "./events.js";
-export { DevAdmin, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker } from "./devAdmin.js";
+export { DevAdmin, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker, supervisorBaseUrl } from "./devAdmin.js";
+export {
+  feedbackEnabled,
+  feedbackWhitelist,
+  feedbackIdentifyUser,
+  feedbackIsWhitelisted,
+  feedbackRateLimitOk,
+  injectFeedbackWidget,
+  handleFeedbackTurn,
+  handleFeedbackWidgetJs,
+  registerFeedbackRoutes,
+} from "./feedback.js";
 export { Messenger } from "./messenger.js";
 export type { SendResult, EmailMessage } from "./messenger.js";
 export { DevMailbox, createMessenger } from "./devMailbox.js";
@@ -99,6 +110,8 @@ export { RedisNpmSessionHandler } from "./sessionHandlers/redisHandler.js";
 export type { RedisNpmSessionConfig } from "./sessionHandlers/redisHandler.js";
 export { tests, assertEqual, assertRaises, assertTrue, assertFalse, runAll, reset } from "./testing.js";
 export { TestClient, TestResponse } from "./testClient.js";
+export { Tina4Test, AssertionError as Tina4AssertionError } from "./test.js";
+export type { TestRunResults } from "./test.js";
 export { Container, container } from "./container.js";
 export { Validator } from "./validator.js";
 export type { ValidationError } from "./validator.js";

package/packages/core/src/mcp.test.ts

@@ -390,6 +390,307 @@ console.log("\nInstance Registry");
   assert("instances — cleared", McpServer._instances.length === 0);
 }
 
+// ── Defensive Write Helpers (Tier 1 parity port from Python) ─
+
+console.log("\nDefensive Write Helpers");
+
+/**
+ * Invoke an MCP tool and unwrap the JSON-RPC + tools/call envelope.
+ * The MCP `tools/call` response shape is:
+ *   { jsonrpc, id, result: { content: [{ type: "text", text: "<json>" }] } }
+ * For string returns the inner text is the raw string; for object returns
+ * it is JSON-encoded — try to parse it back, fall through to the raw text.
+ */
+function callTool(server: McpServer, name: string, args: Record<string, unknown>): {
+  rpc: { jsonrpc?: string; id?: unknown; result?: unknown; error?: { code: number; message: string } };
+  result: Record<string, unknown> | string | null;
+} {
+  const rpc = JSON.parse(server.handleMessage({
+    jsonrpc: "2.0", id: 1, method: "tools/call",
+    params: { name, arguments: args },
+  }));
+  let result: Record<string, unknown> | string | null = null;
+  const content = (rpc.result as { content?: Array<{ text?: string }> } | undefined)?.content;
+  if (content && content.length > 0 && typeof content[0].text === "string") {
+    const raw = content[0].text;
+    try {
+      result = JSON.parse(raw);
+    } catch {
+      result = raw;
+    }
+  }
+  return { rpc, result };
+}
+
+// refuses prose paths in file_write
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-prose", "Prose Test");
+    registerDevTools(server);
+    const { result } = callTool(server, "file_write", {
+      path: "The plan requires implementing a new feature for users.ts",
+      content: "x",
+    });
+    assert(
+      "refuses prose paths in file_write",
+      typeof result === "object" && result !== null && typeof (result as Record<string, unknown>).error === "string",
+      `Got: ${JSON.stringify(result)}`,
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// normalizes bare routes/ to src/routes/
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-normalize", "Normalize Test");
+    registerDevTools(server);
+    const { result } = callTool(server, "file_write", {
+      path: "routes/foo.ts",
+      content: "export default async function (req, res) {}\n",
+    });
+    const landedAt = path.join(tmpDir, "src", "routes", "foo.ts");
+    const written = (result as { written?: string } | null)?.written;
+    assert(
+      "normalizes bare routes/ to src/routes/ — file lands at src/routes/foo.ts",
+      fs.existsSync(landedAt) && (written ?? "").replace(/\\/g, "/") === "src/routes/foo.ts",
+      `Got: ${JSON.stringify(result)}; exists=${fs.existsSync(landedAt)}`,
+    );
+    const logPath = path.join(tmpDir, ".tina4", "agent.log");
+    const logContent = fs.existsSync(logPath) ? fs.readFileSync(logPath, "utf-8") : "";
+    assert(
+      "normalizes bare routes/ to src/routes/ — agent.log has path_normalized entry",
+      logContent.includes("write.path_normalized") && logContent.includes("routes/foo.ts"),
+      `Log content: ${logContent.slice(0, 300)}`,
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// backs up existing file before overwrite
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-backup", "Backup Test");
+    registerDevTools(server);
+    const target = path.join(tmpDir, "src", "routes", "foo.ts");
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, "original content\n", "utf-8");
+
+    const { result } = callTool(server, "file_write", {
+      path: "src/routes/foo.ts",
+      content: "new content that is reasonably similar in length to the old one\n",
+    });
+    const backup = (result as { backup?: string } | null)?.backup ?? "";
+    const backupDir = path.join(tmpDir, ".tina4", "backups");
+    const backups = fs.existsSync(backupDir) ? fs.readdirSync(backupDir) : [];
+    assert(
+      "backs up existing file before overwrite — backup in .tina4/backups/",
+      backups.length === 1 && backup.startsWith(".tina4/backups/"),
+      `Got: ${JSON.stringify(result)}; backups=${JSON.stringify(backups)}`,
+    );
+    assert(
+      "backs up existing file before overwrite — backup contains original",
+      backups.length === 1 &&
+        fs.readFileSync(path.join(backupDir, backups[0]), "utf-8") === "original content\n",
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// refuses suspicious truncation
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-truncation", "Truncation Test");
+    registerDevTools(server);
+    const target = path.join(tmpDir, "src", "routes", "big.ts");
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    // 500-byte original
+    const original = "x".repeat(500);
+    fs.writeFileSync(target, original, "utf-8");
+
+    // Overwrite with 50 bytes — should be REFUSED (50/500 = 10% < 30%)
+    const { result } = callTool(server, "file_write", {
+      path: "src/routes/big.ts",
+      content: "y".repeat(50),
+    });
+    const r = result as { error?: string; refused?: boolean } | null;
+    assert(
+      "refuses suspicious truncation — returns error with refused flag",
+      r !== null && r.refused === true && typeof r.error === "string" && r.error.includes("REFUSED"),
+      `Got: ${JSON.stringify(result)}`,
+    );
+    const stillThere = fs.readFileSync(target, "utf-8");
+    assert(
+      "refuses suspicious truncation — original file intact",
+      stillThere === original,
+      `Original was modified: length=${stillThere.length}`,
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// lets canonical src/ paths pass through (no rewrite)
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-passthrough", "Passthrough Test");
+    registerDevTools(server);
+    const { result } = callTool(server, "file_write", {
+      path: "src/routes/foo.ts",
+      content: "export default async function (req, res) {}\n",
+    });
+    const landedAt = path.join(tmpDir, "src", "routes", "foo.ts");
+    const written = (result as { written?: string } | null)?.written;
+    assert(
+      "lets canonical src/ paths pass through — file lands at src/routes/foo.ts",
+      fs.existsSync(landedAt) && (written ?? "").replace(/\\/g, "/") === "src/routes/foo.ts",
+      `Got: ${JSON.stringify(result)}`,
+    );
+    // Path should NOT have been double-prefixed to src/src/routes/foo.ts
+    const doublyPrefixed = path.join(tmpDir, "src", "src", "routes", "foo.ts");
+    assert(
+      "lets canonical src/ paths pass through — no double-prefix",
+      !fs.existsSync(doublyPrefixed),
+    );
+    // agent.log should NOT contain a path_normalized entry for this write
+    const logPath = path.join(tmpDir, ".tina4", "agent.log");
+    const logContent = fs.existsSync(logPath) ? fs.readFileSync(logPath, "utf-8") : "";
+    assert(
+      "lets canonical src/ paths pass through — no path_normalized log entry",
+      !logContent.includes("write.path_normalized"),
+      `Log content: ${logContent.slice(0, 300)}`,
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// catches JS syntax errors via node --check
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-verify-js", "Verify JS");
+    registerDevTools(server);
+    const { result } = callTool(server, "file_write", {
+      path: "src/routes/broken.js",
+      content: "const x = ;\n",
+    });
+    const r = result as { written?: string; import_error?: string } | null;
+    assert(
+      "catches JS syntax errors via node --check — result has import_error",
+      r !== null && typeof r.import_error === "string" && r.import_error.length > 0,
+      `Got: ${JSON.stringify(result)}`,
+    );
+    const logPath = path.join(tmpDir, ".tina4", "agent.log");
+    const logContent = fs.existsSync(logPath) ? fs.readFileSync(logPath, "utf-8") : "";
+    assert(
+      "catches JS syntax errors via node --check — agent.log has write.import_failed",
+      logContent.includes("write.import_failed") && logContent.includes("src/routes/broken.js"),
+      `Log content: ${logContent.slice(0, 400)}`,
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// skips non-code files (no syntax check attempted)
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-verify-skip-ext", "Verify Skip Ext");
+    registerDevTools(server);
+    // .twig content that would obviously fail any JS parser
+    const { result } = callTool(server, "file_write", {
+      path: "src/templates/page.twig",
+      content: "{% if not valid js %}<h1>Hi</h1>{% endif %}\n",
+    });
+    const r = result as { written?: string; import_error?: string } | null;
+    assert(
+      "skips non-code files — no import_error attached",
+      r !== null && r.import_error === undefined && typeof r.written === "string",
+      `Got: ${JSON.stringify(result)}`,
+    );
+    const logPath = path.join(tmpDir, ".tina4", "agent.log");
+    const logContent = fs.existsSync(logPath) ? fs.readFileSync(logPath, "utf-8") : "";
+    assert(
+      "skips non-code files — no write.import_failed in agent.log",
+      !logContent.includes("write.import_failed"),
+      `Log content: ${logContent.slice(0, 400)}`,
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+// skips files outside src/
+{
+  McpServer._instances = [];
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "tina4-mcp-test-"));
+  const oldCwd = process.cwd();
+  process.chdir(tmpDir);
+  try {
+    const server = new McpServer("/test-verify-skip-outside", "Verify Skip Outside");
+    registerDevTools(server);
+    // Broken JS placed under tests/ — must NOT be checked
+    const { result } = callTool(server, "file_write", {
+      path: "tests/foo.js",
+      content: "const x = ;\n",
+    });
+    const r = result as { written?: string; import_error?: string } | null;
+    assert(
+      "skips files outside src/ — no import_error attached",
+      r !== null && r.import_error === undefined && typeof r.written === "string",
+      `Got: ${JSON.stringify(result)}`,
+    );
+    const logPath = path.join(tmpDir, ".tina4", "agent.log");
+    const logContent = fs.existsSync(logPath) ? fs.readFileSync(logPath, "utf-8") : "";
+    assert(
+      "skips files outside src/ — no write.import_failed in agent.log",
+      !logContent.includes("write.import_failed"),
+      `Log content: ${logContent.slice(0, 400)}`,
+    );
+  } finally {
+    process.chdir(oldCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
 // ── Summary ──────────────────────────────────────────────────
 
 console.log(`\nMCP Tests: ${pass} passed, ${fail} failed`);