vibecheck-mcp-server 3.5.0 → 3.5.1

package/dist/__tests__/ids.test.js

@@ -0,0 +1,262 @@
+/**
+ * Deterministic ID Generation Tests
+ *
+ * Ensures IDs are:
+ * - Deterministic (same inputs = same outputs)
+ * - Stable (consistent across runs)
+ * - Unique (different inputs = different outputs)
+ */
+import { describe, it, expect } from 'vitest';
+import { generateFindingId, generateCacheKey, generateRequestId, generateRunId, generateProjectFingerprint, isValidFindingId, parseFindingId, compareFindingsForSort, sortFindings, SEVERITY_ORDER, } from '../lib/ids.js';
+describe('Finding ID Generation', () => {
+    describe('generateFindingId()', () => {
+        it('should generate deterministic IDs', () => {
+            const evidence = { path: 'src/api.ts', lineStart: 42, message: 'test message' };
+            const id1 = generateFindingId('auth_gap', evidence);
+            const id2 = generateFindingId('auth_gap', evidence);
+            expect(id1).toBe(id2);
+        });
+        it('should match format category-8hexchars', () => {
+            const id = generateFindingId('auth_gap', { path: 'test.ts', lineStart: 1 });
+            expect(id).toMatch(/^auth_gap-[a-f0-9]{8}$/);
+        });
+        it('should produce different IDs for different paths', () => {
+            const id1 = generateFindingId('auth_gap', { path: 'a.ts', lineStart: 1 });
+            const id2 = generateFindingId('auth_gap', { path: 'b.ts', lineStart: 1 });
+            expect(id1).not.toBe(id2);
+        });
+        it('should produce different IDs for different lines', () => {
+            const id1 = generateFindingId('auth_gap', { path: 'test.ts', lineStart: 1 });
+            const id2 = generateFindingId('auth_gap', { path: 'test.ts', lineStart: 2 });
+            expect(id1).not.toBe(id2);
+        });
+        it('should produce different IDs for different categories', () => {
+            const evidence = { path: 'test.ts', lineStart: 1 };
+            const id1 = generateFindingId('auth_gap', evidence);
+            const id2 = generateFindingId('secrets', evidence);
+            expect(id1).not.toBe(id2);
+        });
+        it('should produce different IDs for different messages', () => {
+            const id1 = generateFindingId('auth_gap', { path: 'test.ts', lineStart: 1, message: 'msg1' });
+            const id2 = generateFindingId('auth_gap', { path: 'test.ts', lineStart: 1, message: 'msg2' });
+            expect(id1).not.toBe(id2);
+        });
+        it('should handle missing optional fields', () => {
+            const id1 = generateFindingId('auth_gap', {});
+            const id2 = generateFindingId('auth_gap', { path: undefined, lineStart: undefined });
+            expect(id1).toBe(id2);
+            expect(id1).toMatch(/^auth_gap-[a-f0-9]{8}$/);
+        });
+        it('should normalize category to lowercase snake_case', () => {
+            const id = generateFindingId('AUTH.GAP', { path: 'test.ts' });
+            expect(id).toMatch(/^auth_gap-[a-f0-9]{8}$/);
+        });
+    });
+    describe('isValidFindingId()', () => {
+        it('should validate correct IDs', () => {
+            expect(isValidFindingId('auth_gap-a1b2c3d4')).toBe(true);
+            expect(isValidFindingId('secrets-12345678')).toBe(true);
+            expect(isValidFindingId('dead_ui-abcdef12')).toBe(true);
+        });
+        it('should reject invalid IDs', () => {
+            expect(isValidFindingId('invalid')).toBe(false);
+            expect(isValidFindingId('AUTH_GAP-123')).toBe(false);
+            expect(isValidFindingId('auth_gap_123')).toBe(false);
+            expect(isValidFindingId('auth-gap-12345678')).toBe(false);
+            expect(isValidFindingId('auth_gap-1234567')).toBe(false); // Too short
+            expect(isValidFindingId('auth_gap-123456789')).toBe(false); // Too long
+        });
+    });
+    describe('parseFindingId()', () => {
+        it('should parse valid IDs', () => {
+            const result = parseFindingId('auth_gap-a1b2c3d4');
+            expect(result).toEqual({ category: 'auth_gap', hash: 'a1b2c3d4' });
+        });
+        it('should return null for invalid IDs', () => {
+            expect(parseFindingId('invalid')).toBeNull();
+            expect(parseFindingId('AUTH_GAP-123')).toBeNull();
+        });
+    });
+});
+describe('Cache Key Generation', () => {
+    describe('generateCacheKey()', () => {
+        it('should generate deterministic keys', () => {
+            const key1 = generateCacheKey('scan', 'fingerprint123', { profile: 'quick' });
+            const key2 = generateCacheKey('scan', 'fingerprint123', { profile: 'quick' });
+            expect(key1).toBe(key2);
+        });
+        it('should produce different keys for different tools', () => {
+            const key1 = generateCacheKey('scan', 'fingerprint123', {});
+            const key2 = generateCacheKey('ship', 'fingerprint123', {});
+            expect(key1).not.toBe(key2);
+        });
+        it('should produce different keys for different fingerprints', () => {
+            const key1 = generateCacheKey('scan', 'fingerprint123', {});
+            const key2 = generateCacheKey('scan', 'fingerprint456', {});
+            expect(key1).not.toBe(key2);
+        });
+        it('should produce different keys for different options', () => {
+            const key1 = generateCacheKey('scan', 'fingerprint123', { profile: 'quick' });
+            const key2 = generateCacheKey('scan', 'fingerprint123', { profile: 'full' });
+            expect(key1).not.toBe(key2);
+        });
+        it('should sort options for determinism', () => {
+            const key1 = generateCacheKey('scan', 'fp', { a: 1, b: 2 });
+            const key2 = generateCacheKey('scan', 'fp', { b: 2, a: 1 });
+            expect(key1).toBe(key2);
+        });
+        it('should include schema version', () => {
+            const key1 = generateCacheKey('scan', 'fp', {}, '1.0.0');
+            const key2 = generateCacheKey('scan', 'fp', {}, '2.0.0');
+            expect(key1).not.toBe(key2);
+        });
+    });
+});
+describe('Request ID Generation', () => {
+    describe('generateRequestId()', () => {
+        it('should generate unique IDs', () => {
+            const ids = new Set();
+            for (let i = 0; i < 100; i++) {
+                ids.add(generateRequestId());
+            }
+            expect(ids.size).toBe(100);
+        });
+        it('should use default prefix', () => {
+            const id = generateRequestId();
+            expect(id).toMatch(/^req_/);
+        });
+        it('should use custom prefix', () => {
+            const id = generateRequestId('tool');
+            expect(id).toMatch(/^tool_/);
+        });
+        it('should include timestamp component', () => {
+            const id = generateRequestId();
+            // ID format: prefix_timestamp_random
+            const parts = id.split('_');
+            expect(parts.length).toBe(3);
+        });
+    });
+    describe('generateRunId()', () => {
+        it('should generate unique run IDs', () => {
+            const ids = new Set();
+            for (let i = 0; i < 100; i++) {
+                ids.add(generateRunId());
+            }
+            expect(ids.size).toBe(100);
+        });
+        it('should match format', () => {
+            const id = generateRunId();
+            expect(id).toMatch(/^run_\d{14}_[a-f0-9]{8}$/);
+        });
+    });
+});
+describe('Project Fingerprinting', () => {
+    describe('generateProjectFingerprint()', () => {
+        it('should generate deterministic fingerprints', () => {
+            const files = [
+                { path: 'package.json', content: '{"name":"test"}' },
+                { path: 'package-lock.json', content: '{}' },
+            ];
+            const fp1 = generateProjectFingerprint(files);
+            const fp2 = generateProjectFingerprint(files);
+            expect(fp1).toBe(fp2);
+        });
+        it('should produce different fingerprints for different content', () => {
+            const files1 = [{ path: 'package.json', content: '{"name":"test1"}' }];
+            const files2 = [{ path: 'package.json', content: '{"name":"test2"}' }];
+            const fp1 = generateProjectFingerprint(files1);
+            const fp2 = generateProjectFingerprint(files2);
+            expect(fp1).not.toBe(fp2);
+        });
+        it('should be order-independent (sorted)', () => {
+            const files1 = [
+                { path: 'a.json', content: '1' },
+                { path: 'b.json', content: '2' },
+            ];
+            const files2 = [
+                { path: 'b.json', content: '2' },
+                { path: 'a.json', content: '1' },
+            ];
+            const fp1 = generateProjectFingerprint(files1);
+            const fp2 = generateProjectFingerprint(files2);
+            expect(fp1).toBe(fp2);
+        });
+        it('should produce 16-char hex fingerprint', () => {
+            const fp = generateProjectFingerprint([{ path: 'test', content: 'test' }]);
+            expect(fp).toMatch(/^[a-f0-9]{16}$/);
+        });
+    });
+});
+describe('Finding Sorting', () => {
+    describe('SEVERITY_ORDER', () => {
+        it('should have correct priority order', () => {
+            expect(SEVERITY_ORDER.BLOCK).toBeLessThan(SEVERITY_ORDER.WARN);
+            expect(SEVERITY_ORDER.WARN).toBeLessThan(SEVERITY_ORDER.INFO);
+            expect(SEVERITY_ORDER.CRITICAL).toBe(SEVERITY_ORDER.BLOCK);
+            expect(SEVERITY_ORDER.HIGH).toBeLessThan(SEVERITY_ORDER.MEDIUM);
+            expect(SEVERITY_ORDER.MEDIUM).toBeLessThan(SEVERITY_ORDER.LOW);
+        });
+    });
+    describe('compareFindingsForSort()', () => {
+        it('should sort by severity first (BLOCK before WARN)', () => {
+            const a = { severity: 'BLOCK', rule_id: 'a', evidence: [{ file: 'a.ts', line: 1 }] };
+            const b = { severity: 'WARN', rule_id: 'a', evidence: [{ file: 'a.ts', line: 1 }] };
+            expect(compareFindingsForSort(a, b)).toBeLessThan(0);
+            expect(compareFindingsForSort(b, a)).toBeGreaterThan(0);
+        });
+        it('should sort by rule_id when severity is same', () => {
+            const a = { severity: 'WARN', rule_id: 'aaa', evidence: [{ file: 'a.ts', line: 1 }] };
+            const b = { severity: 'WARN', rule_id: 'bbb', evidence: [{ file: 'a.ts', line: 1 }] };
+            expect(compareFindingsForSort(a, b)).toBeLessThan(0);
+            expect(compareFindingsForSort(b, a)).toBeGreaterThan(0);
+        });
+        it('should sort by path when severity and rule_id are same', () => {
+            const a = { severity: 'WARN', rule_id: 'test', evidence: [{ file: 'a.ts', line: 1 }] };
+            const b = { severity: 'WARN', rule_id: 'test', evidence: [{ file: 'b.ts', line: 1 }] };
+            expect(compareFindingsForSort(a, b)).toBeLessThan(0);
+        });
+        it('should sort by line when path is same', () => {
+            const a = { severity: 'WARN', rule_id: 'test', evidence: [{ file: 'test.ts', line: 1 }] };
+            const b = { severity: 'WARN', rule_id: 'test', evidence: [{ file: 'test.ts', line: 2 }] };
+            expect(compareFindingsForSort(a, b)).toBeLessThan(0);
+        });
+        it('should handle missing fields', () => {
+            const a = { severity: 'WARN' };
+            const b = { severity: 'WARN' };
+            expect(compareFindingsForSort(a, b)).toBe(0);
+        });
+    });
+    describe('sortFindings()', () => {
+        it('should sort findings deterministically', () => {
+            const findings = [
+                { severity: 'INFO', rule_id: 'c', evidence: [{ file: 'c.ts', line: 1 }] },
+                { severity: 'BLOCK', rule_id: 'a', evidence: [{ file: 'a.ts', line: 1 }] },
+                { severity: 'WARN', rule_id: 'b', evidence: [{ file: 'b.ts', line: 1 }] },
+            ];
+            const sorted = sortFindings(findings);
+            expect(sorted[0].severity).toBe('BLOCK');
+            expect(sorted[1].severity).toBe('WARN');
+            expect(sorted[2].severity).toBe('INFO');
+        });
+        it('should not mutate original array', () => {
+            const findings = [
+                { severity: 'INFO', rule_id: 'a' },
+                { severity: 'BLOCK', rule_id: 'b' },
+            ];
+            const sorted = sortFindings(findings);
+            expect(findings[0].severity).toBe('INFO');
+            expect(sorted[0].severity).toBe('BLOCK');
+        });
+        it('should produce same order on multiple runs', () => {
+            const findings = [
+                { severity: 'WARN', rule_id: 'z', evidence: [{ file: 'z.ts', line: 3 }] },
+                { severity: 'WARN', rule_id: 'a', evidence: [{ file: 'a.ts', line: 1 }] },
+                { severity: 'WARN', rule_id: 'm', evidence: [{ file: 'm.ts', line: 2 }] },
+            ];
+            const sorted1 = sortFindings([...findings]);
+            const sorted2 = sortFindings([...findings].reverse());
+            expect(sorted1.map((f) => f.rule_id).join(',')).toBe(sorted2.map((f) => f.rule_id).join(','));
+        });
+    });
+});
+//# sourceMappingURL=ids.test.js.map

package/dist/__tests__/ids.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.test.js","sourceRoot":"","sources":["../../__tests__/ids.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAEhF,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAEpD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,EAAE,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAE5E,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAE1E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;YAE7E,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YAEnD,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAEnD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9F,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAE9F,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YAErF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,EAAE,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAE9D,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1D,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;YACtE,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;QACzE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,MAAM,GAAG,cAAc,CAAC,mBAAmB,CAAC,CAAC;YAEnD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7C,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAE9E,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAE5D,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YAE5D,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAE7E,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAE5D,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YAEzD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;YAC/B,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;YAC/B,qCAAqC;YACrC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC7B,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;YAC3B,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;QAC5C,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,KAAK,GAAG;gBACZ,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE;gBACpD,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE;aAC7C,CAAC;YAEF,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAE9C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAEvE,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAE/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG;gBACb,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;gBAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;aACjC,CAAC;YACF,MAAM,MAAM,GAAG;gBACb,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;gBAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;aACjC,CAAC;YAEF,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAE/C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,EAAE,GAAG,0BAA0B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAE3E,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC/D,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAChE,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YACrF,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAEpF,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAEtF,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YACvF,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAEvF,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;YAE1F,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAE/B,MAAM,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,QAAQ,GAAG;gBACf,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;gBACzE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;gBAC1E,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;aAC1E,CAAC;YAEF,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEtC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,QAAQ,GAAG;gBACf,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;gBAClC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE;aACpC,CAAC;YAEF,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEtC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,QAAQ,GAAG;gBACf,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;gBACzE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;gBACzE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE;aAC1E,CAAC;YAEF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAEtD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1I,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/integration/tools.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Integration Tests for MCP Tools
+ *
+ * Tests tools against real fixtures, including:
+ * - venv/node_modules exclusion
+ * - Path sandboxing
+ * - Error handling
+ */
+export {};
+//# sourceMappingURL=tools.test.d.ts.map

package/dist/__tests__/integration/tools.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.test.d.ts","sourceRoot":"","sources":["../../../__tests__/integration/tools.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/__tests__/integration/tools.test.js

@@ -0,0 +1,343 @@
+/**
+ * Integration Tests for MCP Tools
+ *
+ * Tests tools against real fixtures, including:
+ * - venv/node_modules exclusion
+ * - Path sandboxing
+ * - Error handling
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdirSync, writeFileSync, rmSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { handleTool } from '../../handlers/tool-handler.js';
+describe('Tool Integration Tests', () => {
+    let testDir;
+    let projectPath;
+    beforeAll(() => {
+        // Create test fixture directory
+        testDir = join(tmpdir(), `vibecheck-test-${Date.now()}`);
+        projectPath = join(testDir, 'test-project');
+        mkdirSync(projectPath, { recursive: true });
+        // Create basic project structure
+        writeFileSync(join(projectPath, 'package.json'), JSON.stringify({
+            name: 'test-project',
+            version: '1.0.0',
+            dependencies: {},
+        }));
+        // Create source files
+        mkdirSync(join(projectPath, 'src'));
+        writeFileSync(join(projectPath, 'src', 'index.ts'), `
+      export function hello() {
+        return 'Hello, World!';
+      }
+    `);
+        // Create node_modules (should be excluded)
+        mkdirSync(join(projectPath, 'node_modules', 'fake-pkg'), { recursive: true });
+        writeFileSync(join(projectPath, 'node_modules', 'fake-pkg', 'index.js'), 'const secret = "sk-fake-key-in-node_modules";');
+        // Create venv (should be excluded)
+        mkdirSync(join(projectPath, 'venv', 'lib'), { recursive: true });
+        writeFileSync(join(projectPath, 'venv', 'lib', 'config.py'), 'API_KEY = "sk-fake-key-in-venv"');
+        // Create .vibecheck directory
+        mkdirSync(join(projectPath, '.vibecheck'), { recursive: true });
+    });
+    afterAll(() => {
+        // Clean up test directory
+        if (existsSync(testDir)) {
+            rmSync(testDir, { recursive: true, force: true });
+        }
+    });
+    describe('Path Sandboxing', () => {
+        it('should reject paths outside workspace', async () => {
+            const request = {
+                tool: 'vibecheck.scan',
+                projectPath: '/etc/passwd',
+            };
+            const result = await handleTool(request);
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.error.code).toBe('PATH_OUTSIDE_SANDBOX');
+            }
+        });
+        it('should reject path traversal attempts', async () => {
+            const request = {
+                tool: 'vibecheck.scan',
+                projectPath: join(projectPath, '..', '..', 'etc'),
+            };
+            const result = await handleTool(request);
+            expect(result.ok).toBe(false);
+        });
+        it('should accept valid project paths', async () => {
+            const request = {
+                tool: 'vibecheck.status',
+                projectPath: projectPath,
+            };
+            // This may fail if CLI is not available, but should not fail due to path validation
+            const result = await handleTool(request);
+            if (!result.ok) {
+                expect(result.error.code).not.toBe('PATH_OUTSIDE_SANDBOX');
+            }
+        });
+    });
+    describe('Input Validation', () => {
+        it('should reject unknown tools', async () => {
+            const request = {
+                tool: 'vibecheck.nonexistent',
+                projectPath: projectPath,
+            };
+            const result = await handleTool(request);
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.error.code).toBe('INVALID_INPUT');
+            }
+        });
+        it('should reject invalid options', async () => {
+            const request = {
+                tool: 'vibecheck.scan',
+                projectPath: projectPath,
+                options: {
+                    profile: 'invalid_profile_name',
+                },
+            };
+            const result = await handleTool(request);
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.error.code).toBe('INVALID_INPUT');
+            }
+        });
+        it('should accept valid options', async () => {
+            const request = {
+                tool: 'vibecheck.scan',
+                projectPath: projectPath,
+                options: {
+                    profile: 'quick',
+                },
+            };
+            // May fail due to CLI not being available, but should pass validation
+            const result = await handleTool(request);
+            if (!result.ok) {
+                expect(['CLI_ERROR', 'INTERNAL_ERROR']).toContain(result.error.code);
+            }
+        });
+        it('should require url for vibecheck.reality', async () => {
+            const request = {
+                tool: 'vibecheck.reality',
+                projectPath: projectPath,
+                options: {}, // Missing required url
+            };
+            const result = await handleTool(request);
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.error.code).toBe('INVALID_INPUT');
+            }
+        });
+    });
+    describe('Tool Aliases', () => {
+        it('should resolve vibecheck.context to vibecheck.ctx', async () => {
+            const request = {
+                tool: 'vibecheck.context', // Alias
+                projectPath: projectPath,
+            };
+            // Should not fail with "unknown tool"
+            const result = await handleTool(request);
+            if (!result.ok) {
+                expect(result.error.code).not.toBe('INVALID_INPUT');
+            }
+        });
+        it('should resolve vibecheck.verify to vibecheck.reality', async () => {
+            const request = {
+                tool: 'vibecheck.verify', // Alias
+                projectPath: projectPath,
+                options: { url: 'http://localhost:3000' },
+            };
+            // Should not fail with "unknown tool"
+            const result = await handleTool(request);
+            if (!result.ok) {
+                expect(result.error.code).not.toBe('INVALID_INPUT');
+            }
+        });
+    });
+    describe('Query Tools', () => {
+        it('vibecheck.get_truthpack should return error if no truthpack exists', async () => {
+            const request = {
+                tool: 'vibecheck.get_truthpack',
+                projectPath: projectPath,
+            };
+            const result = await handleTool(request);
+            // Should either succeed with data or fail gracefully
+            if (!result.ok) {
+                expect(result.error.message).toContain('truthpack');
+            }
+        });
+        it('vibecheck.validate_claim should handle missing truthpack', async () => {
+            const request = {
+                tool: 'vibecheck.validate_claim',
+                projectPath: projectPath,
+                options: {
+                    claim: '/api/test',
+                    type: 'route_exists',
+                },
+            };
+            const result = await handleTool(request);
+            // Should fail gracefully with message about truthpack
+            if (!result.ok) {
+                expect(result.error.message.toLowerCase()).toContain('truthpack');
+            }
+        });
+        it('vibecheck.search_evidence should handle missing truthpack', async () => {
+            const request = {
+                tool: 'vibecheck.search_evidence',
+                projectPath: projectPath,
+                options: {
+                    query: 'test',
+                    type: 'any',
+                },
+            };
+            const result = await handleTool(request);
+            if (!result.ok) {
+                expect(result.error.message.toLowerCase()).toContain('truthpack');
+            }
+        });
+    });
+    describe('Error Envelopes', () => {
+        it('should always return proper error envelope on failure', async () => {
+            const request = {
+                tool: 'vibecheck.unknown',
+                projectPath: '/invalid/path',
+            };
+            const result = await handleTool(request);
+            expect(result.ok).toBe(false);
+            if (!result.ok) {
+                expect(result.error).toBeDefined();
+                expect(result.error.code).toBeDefined();
+                expect(result.error.message).toBeDefined();
+                expect(result.requestId).toBeDefined();
+                expect(result.timestamp).toBeDefined();
+            }
+        });
+        it('should include requestId in all responses', async () => {
+            const request = {
+                tool: 'vibecheck.status',
+                projectPath: projectPath,
+                requestId: 'test_req_123',
+            };
+            const result = await handleTool(request);
+            if (result.ok) {
+                expect(result.meta?.requestId).toBe('test_req_123');
+            }
+            else {
+                expect(result.requestId).toBe('test_req_123');
+            }
+        });
+    });
+    describe('Timeout Handling', () => {
+        it('should respect custom timeout', async () => {
+            const request = {
+                tool: 'vibecheck.scan',
+                projectPath: projectPath,
+                timeout: 1, // 1ms - should timeout
+            };
+            const result = await handleTool(request);
+            // Should either complete very fast or timeout
+            expect(result).toBeDefined();
+        });
+    });
+    describe('Cache Behavior', () => {
+        it('should cache results when cacheMode is auto', async () => {
+            const request = {
+                tool: 'vibecheck.status',
+                projectPath: projectPath,
+                cache: { mode: 'auto' },
+            };
+            // First call
+            const result1 = await handleTool(request);
+            // Second call should be faster (cached)
+            const result2 = await handleTool(request);
+            if (result1.ok && result2.ok) {
+                expect(result2.meta?.cached).toBe(true);
+            }
+        });
+        it('should skip cache when cacheMode is skip', async () => {
+            const request = {
+                tool: 'vibecheck.status',
+                projectPath: projectPath,
+                cache: { mode: 'skip' },
+            };
+            const result = await handleTool(request);
+            if (result.ok) {
+                expect(result.meta?.cached).toBeFalsy();
+            }
+        });
+    });
+});
+describe('Exclusion Patterns', () => {
+    let testDir;
+    let projectPath;
+    beforeAll(() => {
+        testDir = join(tmpdir(), `vibecheck-exclusion-${Date.now()}`);
+        projectPath = join(testDir, 'exclusion-test');
+        mkdirSync(projectPath, { recursive: true });
+        // Create package.json
+        writeFileSync(join(projectPath, 'package.json'), JSON.stringify({
+            name: 'exclusion-test',
+            version: '1.0.0',
+        }));
+        // Source file with no issues
+        mkdirSync(join(projectPath, 'src'));
+        writeFileSync(join(projectPath, 'src', 'app.ts'), `
+      export const app = 'clean';
+    `);
+        // Files that should be excluded
+        const excludedDirs = [
+            'node_modules/pkg',
+            'venv/lib',
+            '.venv/lib',
+            '__pycache__',
+            'dist',
+            'build',
+            '.next',
+        ];
+        for (const dir of excludedDirs) {
+            const fullDir = join(projectPath, dir);
+            mkdirSync(fullDir, { recursive: true });
+            writeFileSync(join(fullDir, 'secret.js'), 'const SECRET = "sk-should-not-be-found";');
+        }
+    });
+    afterAll(() => {
+        if (existsSync(testDir)) {
+            rmSync(testDir, { recursive: true, force: true });
+        }
+    });
+    it('should not report findings from node_modules', async () => {
+        // This test verifies the sandbox exclusion patterns work
+        // In a real integration test, this would run the actual scan
+        const request = {
+            tool: 'vibecheck.scan',
+            projectPath: projectPath,
+            options: { profile: 'security' },
+        };
+        const result = await handleTool(request);
+        // If scan succeeds, verify no node_modules findings
+        if (result.ok) {
+            const data = result.data;
+            const findings = data.findings ?? [];
+            const nodeModulesFindings = findings.filter(f => f.file.includes('node_modules'));
+            expect(nodeModulesFindings.length).toBe(0);
+        }
+    });
+    it('should not report findings from venv', async () => {
+        const request = {
+            tool: 'vibecheck.scan',
+            projectPath: projectPath,
+            options: { profile: 'security' },
+        };
+        const result = await handleTool(request);
+        if (result.ok) {
+            const data = result.data;
+            const findings = data.findings ?? [];
+            const venvFindings = findings.filter(f => f.file.includes('venv') || f.file.includes('.venv'));
+            expect(venvFindings.length).toBe(0);
+        }
+    });
+});
+//# sourceMappingURL=tools.test.js.map