mcpgawk 0.1.64__tar.gz → 0.1.65__tar.gz

{mcpgawk-0.1.64 → mcpgawk-0.1.65}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpgawk
-Version: 0.1.64
+Version: 0.1.65
 Summary: One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine.
 Project-URL: Homepage, https://mcp.gawk.dev
 Project-URL: Documentation, https://mcp.gawk.dev/docs

{mcpgawk-0.1.64 → mcpgawk-0.1.65}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcpgawk"
-version = "0.1.64"
+version = "0.1.65"
 description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
 readme = "README.md"
 requires-python = ">=3.10"

{mcpgawk-0.1.64 → mcpgawk-0.1.65}/src/mcpgawk/cli.py

@@ -2344,6 +2344,7 @@ def _dispatch(argv: list[str] | None = None) -> int:
                                          for r in refreshed.values())
             any_error = any_error or any(s.reidentified_from or (s.report and s.report.any)
                                          for s in late.values())
+        _protection_nudge(bool(rows))
         _behavioural_capability_note()
         return 1 if (any_error or failed) else 0
 
@@ -2435,13 +2436,23 @@ def _dispatch(argv: list[str] | None = None) -> int:
         print("\n" + render_summary(labels, local_servers=local_servers) + "\n")
     else:
         print()
-    # Scanning is not protection. A report with no next step is how the author finished a scan on
-    # his own machine and stayed unprotected — the hook existed, worked, and was never installed
-    # because nothing ever mentioned it. Only shown when it is actually actionable.
     # Only with servers to check: with none, "these servers" named nothing and "`mcpgawk` turns
     # that on" told a user who had just run `mcpgawk` to run it again (new-developer walk,
     # 2026-09-26). The empty case already printed how to check a server before adding it.
-    _installed = _guard_is_installed() if (labels or unlabelled or skipped) else True
+    _protection_nudge(bool(labels or unlabelled or skipped))
+    _behavioural_capability_note()
+    return 1 if (any_error or failed) else 0
+
+
+def _protection_nudge(has_servers: bool) -> None:
+    """Scanning is not protection. A report with no next step is how the author finished a scan on
+    his own machine and stayed unprotected — the hook existed, worked, and was never installed
+    because nothing ever mentioned it. Only shown when it is actually actionable.
+
+    ONE helper for both report paths: the fleet-table path returned without it (found 2026-09-26
+    when the journey test first ran on a seeded fleet), so every machine that got the table — any
+    fleet with an unreachable server — was never told how to turn checking on."""
+    _installed = _guard_is_installed() if has_servers else True
     if _installed is None:
         print("  Whether your agents are checking these servers could not be determined — the "
               "guard probe failed. Run `mcpgawk guard status`.\n")
@@ -2450,8 +2461,6 @@ def _dispatch(argv: list[str] | None = None) -> int:
         # 2026-09-26). Bare `mcpgawk` is still the command: it enables every agent with a hook.
         print("  Your agents are not checking these servers yet. To turn that on, run `mcpgawk` "
               "with no arguments.\n")
-    _behavioural_capability_note()
-    return 1 if (any_error or failed) else 0
 
 
 def _print_accept(key: str | None) -> None:

{mcpgawk-0.1.64 → mcpgawk-0.1.65}/src/mcpgawk/measure.py

@@ -47,14 +47,16 @@ _WRITE_VERBS = (
     "login", "authenticate",
     # D1 (2026-09-26): "trigger" and "replay" were considered and REJECTED. "trigger" is a noun in
     # every automation server's reads ("Get a trigger by id"); "replay" would block session-replay
-    # reads in TS safe mode. So resend's replay-webhook-event, which matched only via "does not
-    # schedule" before the negation rule below, is now MISSED — like duplicate-template.
+    # reads in TS safe mode. resend's replay-webhook-event, which matched only via "does not
+    # schedule" before the negation rule below, is caught instead by "Queue" leading a sentence
+    # (_WRITE_SENTENCE, [FOUNDER 2026-09-26]).
     # 2026-09-24: "launch", "translate" and "duplicate" were considered (three misses in the Laya
     # evaluation's hand labels) and REJECTED — none is unambiguous in isolation ("launch date",
     # "find duplicate contacts", a translate_text tool that only returns text), and classify.ts
     # must carry every verb here as a NAME token, where each would make a read uncallable in safe
     # mode. Three of the four tools they would catch declare readOnlyHint: false, which
-    # `_is_write` now reads; resend's duplicate-template stays missed.
+    # `_is_write` now reads; resend's duplicate-template is caught by its second sentence
+    # ("Creates a new draft copy", _WRITE_SENTENCE).
 )
 
 
@@ -96,19 +98,66 @@ _WRITE_LEADING = re.compile(
 # "cannot delete"), and a verb that starts a hyphen compound ("write-ups"). A verb that ENDS one
 # still counts: "soft-delete", "hard-delete", "bulk-update" and "auto-create" are writes. The NAME
 # keeps the bare pattern: hyphens separate words in names (`create-webhook`), so the compound rule
-# would blind every kebab-case tool. Participles and nouns ("a record set on a name", hood;
-# "pre-trade" and "before entering a trade", agentberg) are NOT handled — telling them from a verb
-# needs grammar this regex does not have.
+# would blind every kebab-case tool.
 _NEGATED = re.compile(r"(?:\bnot|n't|\bnever|\bcannot|\bno\s+longer)\s+(?:\w+ly\s+)?$", re.I)
 
+# [FOUNDER 2026-09-26] Two words in the list are also a participle and a noun, and each shape is
+# dropped in the DESCRIPTION only (names keep "set_x" and "trade"; classify.ts, which reads only
+# names, is untouched). "set" followed by on/by/in/to/of is a participle: hood's resolve_text reads
+# "a text record ... set on a .hood name". "trade" after a/the/each, or ending "pre-", is a noun:
+# agentberg's query_network_brief reads "pre-trade consensus ... before entering a trade". Each
+# rests on ONE live description. MEASURED over 465 corpus + fixture tools: each flips exactly that
+# tool, and no write is lost. "Set the flag to true" still counts ("set" is followed by "the").
+_SET_PARTICIPLE = re.compile(r"^\s+(?:on|by|in|to|of)\b", re.I)
+_TRADE_NOUN = re.compile(r"(?:\b(?:a|the|each)\s+|pre-)$", re.I)
+
+# [FOUNDER 2026-09-26] _WRITE_LEADING looks only at the first word of the description, so a write
+# stated in a LATER sentence was missed: resend's duplicate-template ("Duplicate an existing email
+# template. Creates a new draft copy ...") and browserstack's addPercySnapshotCommands. The same
+# grammar argument holds per sentence — a third-person verb LEADS a sentence — so the -s form also
+# counts after ".", "!", "?", ":" (closing markdown/quote/bracket allowed: "**Purpose:** Queue") or
+# a newline. "Queue"/"Queues" counts ONLY in that position:
+# resend's replay-webhook-event reads "**Purpose:** Queue one more delivery"; bare "queue" is
+# a noun everywhere else ("items in the queue", `get_queue`), which is why it is NOT in
+# _WRITE_VERBS (that would put it in the bare prose pattern and, by the parity test, in
+# classify.ts as a name token). "runs" is left out here only because of revolut's grid_optimize
+# ("... no live orders. Runs a backtest ..."), a simulation — a one-example carve; at position 0
+# _WRITE_LEADING still accepts it. MEASURED over 465 tools through `_is_write`: 2 reads -> write
+# (duplicate-template, replay-webhook-event), 0 false. browserstack's addPercySnapshotCommands
+# also leads "Adds" but declares readOnlyHint: true, and a declared read wins — unchanged.
+# Accepted risk: a colon before a plural noun ("Returns: Updates since ...") would flag; 0 in corpus.
+_SENTENCE_START = r"(?:^|[.!?:][*_)\]\"']*\s+|\n\s*)\W*(?:it\s+|this\s+tool\s+)?"
+_WRITE_SENTENCE = re.compile(
+    _SENTENCE_START + r"(" + "|".join(_third_person(v) for v in _WRITE_VERBS if v != "run")
+    + r"|queues?)\b", re.I)
+
+
+# NAMES ARE TOKENISED, the way classify.ts reads them. `_WRITE` uses \b, and "_" is a word
+# character, so the name arm matched only kebab-case: `create_file`, `place_order` and
+# `placeOrder` with no description all read as reads (found 2026-09-26; the comment here claimed
+# "create_file" matched). Split on non-alphanumerics and lower->Upper boundaries, then look each
+# token up. "issue" is left out of NAME tokens for the reason classify.ts records: in a name it is
+# overwhelmingly the noun (`get_issue`, `list_issues`). MEASURED over 465 tools: see the commit.
+_NAME_SPLIT = re.compile(r"[^A-Za-z0-9]+|(?<=[a-z0-9])(?=[A-Z])")
+_NAME_WRITE_VERBS = frozenset(v for v in _WRITE_VERBS if v != "issue")
+
+
+def _name_is_write(name: str) -> bool:
+    return any(t.lower() in _NAME_WRITE_VERBS for t in _NAME_SPLIT.split(name) if t)
+
 
 def _describes_write(description: str) -> bool:
     for mt in _WRITE.finditer(description):
         before, after = description[:mt.start()], description[mt.end():]
         if _NEGATED.search(before) or re.match(r"-[A-Za-z]", after):
             continue
+        word = mt.group(1).lower()
+        if word == "set" and _SET_PARTICIPLE.match(after):
+            continue
+        if word == "trade" and _TRADE_NOUN.search(before):
+            continue
         return True
-    return False
+    return bool(_WRITE_SENTENCE.search(description))
 
 #: Parameter-name words that mean "the CALLER chooses a destination". This is the STRUCTURAL half
 #: of exfil detection and the stronger half: whoever controls that argument controls where data
@@ -406,10 +455,10 @@ def _is_write(tool: dict[str, Any], ann: dict[str, Any], demote: bool | None = N
     if "readOnlyHint" not in ann and ("destructiveHint" in ann or "idempotentHint" in ann):
         return True
     description = (tool.get("description") or "").strip()
-    # Bare verb in the name ("create_file") or in the prose ("will delete the row", minus the
-    # negated and compound uses — see _describes_write), OR a third-person verb leading the
-    # description ("Creates a file") — see _WRITE_LEADING for why the second one is anchored.
-    return (bool(_WRITE.search(tool.get("name", ""))) or _describes_write(description)
+    # A verb token in the name ("create_file", "placeOrder", "create-webhook") or in the prose
+    # ("will delete the row", minus the negated and compound uses — see _describes_write), OR a
+    # third-person verb leading the description ("Creates a file") — see _WRITE_LEADING.
+    return (_name_is_write(tool.get("name", "")) or _describes_write(description)
             or bool(_WRITE_LEADING.match(description)))
 
 

{mcpgawk-0.1.64 → mcpgawk-0.1.65}/tests/conftest.py

@@ -26,8 +26,12 @@ the gate. Any test asserting the REFUSAL clears this with monkeypatch first, and
 """
 from __future__ import annotations
 
+import dataclasses
+import json
 import os
 import stat
+import sys
+from pathlib import Path
 
 import pytest
 
@@ -113,3 +117,97 @@ def _no_real_signin_child(monkeypatch):
                              f"patch panel._run_signin_cli with a fake")
 
     monkeypatch.setattr(panel, "_run_signin_cli", _refuse)
+
+
+@pytest.fixture(autouse=True)
+def _never_the_real_agent_configs(request, tmp_path_factory):
+    """No test reads the developer's real agent configs unless it says so (`@pytest.mark.real_home`).
+
+    THE CLASS (2026-09-26o): the store redirects above cover mcpgawk's OWN files, not discovery.
+    41 `panel.collect()` calls in 11 test files swept the real ~/.claude.json, Cursor, VS Code, Zed
+    and Claude Desktop configs, so a test passed or failed by what the machine had installed — one
+    read "no server named 'Revolut X'" from a queued action run against the real fleet.
+
+    Two reach points, because HOME alone does not move all of them:
+      * HOME (and USERPROFILE): every `Path.home()` / `expanduser` resolved at CALL time —
+        discover_report, detect_unscannable, skills, ambient, wrap, the panel's config globs.
+      * import-time constants: `agents.ADAPTERS[*].config` and `guard.CLAUDE_USER_SETTINGS` were
+        fixed to the real home when the module loaded, and `collect()` reads the hook configs.
+
+    NOT the working directory. discover_report also sweeps project-scope files (.mcp.json,
+    .vscode/mcp.json, ...) under `Path.cwd()`, but moving the cwd of 4300 tests is a wider change
+    than this class needs, and the repo root holds none today. Instead,
+    test_a_test_never_reads_the_real_agent_configs fails if the working dir ever holds one.
+
+    Function-scoped on purpose: the session tripwire snapshots the REAL ~/.gawk and ~/.mcpgawk
+    before any of this applies, and a test that sets HOME itself still overrides it.
+
+    Its OWN MonkeyPatch, not the test's `monkeypatch`: a test that calls `monkeypatch.undo()`
+    mid-way (test_platform_credential_writers_are_owner_safe does) would otherwise put the real
+    home back for the rest of that test.
+
+    Yields the temp home (None when opted out) so the platform conftest can re-seed its
+    home-bound licence cache there."""
+    if request.node.get_closest_marker("real_home"):
+        yield None
+        return
+    home = tmp_path_factory.mktemp("home")
+    with pytest.MonkeyPatch.context() as mp:
+        mp.setenv("HOME", str(home))
+        mp.setenv("USERPROFILE", str(home))
+        _repoint_import_time_paths(mp, home)
+        yield home
+
+
+def _repoint_import_time_paths(mp: pytest.MonkeyPatch, home: Path) -> None:
+    try:
+        from mcpgawk import agents, guard
+    except Exception:                              # noqa: BLE001 — a partial checkout may lack them
+        return
+    for key, adapter in agents.ADAPTERS.items():
+        rel = _relative_to_real_home(adapter.config)
+        if rel is not None:
+            mp.setitem(agents.ADAPTERS, key, dataclasses.replace(adapter, config=home / rel))
+    rel = _relative_to_real_home(guard.CLAUDE_USER_SETTINGS)
+    if rel is not None:
+        mp.setattr(guard, "CLAUDE_USER_SETTINGS", home / rel)
+
+
+#: The home the suite started under, read at import — before any test redirects HOME.
+_REAL_HOME = Path.home()
+
+
+def _relative_to_real_home(path: Path) -> Path | None:
+    try:
+        return path.relative_to(_REAL_HOME)
+    except ValueError:                             # already somewhere else (a test's own patch)
+        return None
+
+
+#: Where the fixture fleet lives, relative to the (temp) home — a Cursor config, the plainest shape.
+SEEDED_FLEET_CONFIG = Path(".cursor") / "mcp.json"
+
+
+@pytest.fixture
+def seeded_fleet(request):
+    """A small fleet in the temp home, for tests that used to read whatever THIS machine had.
+
+    Before the redirect, test_panel_state_payload and two user-journey cases ran against the
+    developer's real agent configs, and a real `mcpgawk scan` launched real servers; on an empty
+    home they now skipped every time. Three entries cover the states they need: one launchable
+    stdio server (our own fixture), one whose binary does not exist, one whose host cannot resolve.
+    Returns the server names."""
+    home = request.getfixturevalue("_never_the_real_agent_configs")
+    assert home is not None, "seeded_fleet needs the temp home; do not combine it with real_home"
+    assert not home.resolve().is_relative_to(_REAL_HOME.resolve()), "refusing to write the real home"
+    here = Path(__file__).resolve().parent
+    fleet = {
+        "fleet-fixture": {"command": sys.executable,
+                          "args": [str(here / "fixtures" / "annotated_mcp_server.py")]},
+        "fleet-not-launched": {"command": "/nonexistent/fleet-binary", "args": []},
+        "fleet-unresolvable": {"url": "https://mcp.example.invalid/mcp"},
+    }
+    cfg = home / SEEDED_FLEET_CONFIG
+    cfg.parent.mkdir(parents=True, exist_ok=True)
+    cfg.write_text(json.dumps({"mcpServers": fleet}))
+    return sorted(fleet)

{mcpgawk-0.1.64 → mcpgawk-0.1.65}/tests/test_panel_state_payload.py

@@ -6,8 +6,10 @@ an agent configured — which is every machine this payload exists for. Nothing
 user hit it; it is shipped public code with a crash waiting on its first caller, and a type checker
 saw it the moment the file was checked.
 
-The test drives the real function against the real machine state rather than a hand-built dict:
+The test drives the real function against real discovered state rather than a hand-built dict:
 the bug was in the JOIN between two real shapes, and a fixture that invents both cannot see it.
+Since 2026-09-26 that state is a seeded config in the suite's temp home, read by the real
+discovery code — not this machine's own agents.
 """
 from __future__ import annotations
 
@@ -23,23 +25,21 @@ def test_the_payload_builds():
     assert isinstance(panel.state(), dict)
 
 
-def test_every_agent_row_carries_what_an_action_needs():
+def test_every_agent_row_carries_what_an_action_needs(seeded_fleet):
+    # The suite runs on a temp home (public_conftest); seeded_fleet gives it an agent with servers,
+    # so the join is exercised on every machine instead of skipping on an empty one.
     rows = panel.state()["agents"]
-    if not rows:                        # a machine with no agent configured is a valid state
-        import pytest
-        pytest.skip("no agents on this machine — the join under test cannot be exercised")
+    assert rows, "the seeded fleet produced no agent row"
     for row in rows:
         assert set(row) == AGENT_KEYS, f"agent row shape drifted: {sorted(row)}"
 
 
-def test_the_row_shape_matches_what_agent_rows_actually_yields():
+def test_the_row_shape_matches_what_agent_rows_actually_yields(seeded_fleet):
     """Pins the JOIN, not either side. Both shapes were individually fine; the payload disagreed
     with the producer about how many values it hands back, and only checking them together sees it."""
     from mcpgawk.panel import _agent_rows, collect
 
     produced = _agent_rows(collect())
-    if not produced:
-        import pytest
-        pytest.skip("no agents on this machine")
+    assert produced, "the seeded fleet produced no agent row"
     assert len(produced[0]) == len(AGENT_KEYS), (
         "the producer's tuple width and the payload's field count must move together")