brain_read returns a note verbatim; brain_edit is str_replace with an exactly-once match. Both operate on INGEST_BRAIN_DIR, which is the pod's mount of /var/lib/supervisor/brain — the tree brain-sync commits from, so an edit reaches gitea on the next cycle rather than landing somewhere the sync cannot see it (brain#2). An adversarial design review before implementation changed three things, each of which would otherwise have shipped: 1. Governance files are NOT in the model-facing tool. The original plan allowed root *.md so CLAUDE.md had an MCP path at all — the absence of one is what pushed a session to edit via the gitea REST API on 2026-06-16 and wedge the sync. But brain content is ingested from the outside world, reaches a model's context via brain_query, and that model would hold the editor: one poisoned page could rewrite the CLAUDE.md a .dispatch-allow agent later loads as instructions. Worse, brain-sync merges with --strategy-option=ours, so the live tree wins against a human's corrective push on exactly the conflicting lines. CLAUDE.md now goes through brain_edit_root: de-surfaced from tools/list (the brain_index precedent, ADR-0012 rule 4) and gated on the local static principal, so a claude.ai-origin session is refused. The two scopes are disjoint — the privileged door has the smaller reach. 2. Reads needed the same allowlist, and brain_get already lacked it. api.ReadNote resolves any brain-relative path and parseFrontmatter returns the whole file when there is no fence, so brain_get reads verbatim session transcripts under archive/ (up to 500 KB, never BM25-indexed, so nobody thinks of them as reachable). A test proves the exposure was live; the same Resolve now gates brain_get. 3. Canonicalise before allowlisting. A prefix check on the raw argument accepts knowledge/../.git/hooks/post-commit, which Clean collapses to a git hook that brain-sync executes inside a pod holding the Gitea push credentials. Traversal, symlink escape, dotfiles, .git/, archive/, sessions/ and raw/ are refused by a static backstop that does not depend on the allowlist being right. There were no traversal tests in this repo before. Also from the review: overlapping match counting (bytes.Count says "aa" occurs once in "aaa", so a Count-based uniqueness check accepts an ambiguous edit); UTF-8 validation on both sides, because encoding/json substitutes U+FFFD and would hand back bytes the file does not contain, making every derived old_str unmatchable; refusal while .git/MERGE_HEAD or index.lock exists, since an edit racing brain-sync's merge is either hard-reset away or committed as a wrongly resolved conflict; flock plus a per-path mutex with the read taken inside the lock, because two pods share the hostPath during a RollingUpdate and uniqueness evaluated against a stale read loses an update while reporting success; same-dir *.tmp + rename + chmod 0644 + fsync of file and parent; and reindex only when the edit touches frontmatter, since BM25 walks live and embeddings are mtime-driven. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
205 lines
6.7 KiB
Go
205 lines
6.7 KiB
Go
package mcp_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// callResult parses the JSON text payload of a successful tool call.
|
|
func callResult(t *testing.T, resp map[string]any) map[string]any {
|
|
t.Helper()
|
|
require.Nil(t, resp["error"], "tool returned error: %v", resp["error"])
|
|
text := resp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
|
|
var out map[string]any
|
|
require.NoError(t, json.Unmarshal([]byte(text), &out))
|
|
return out
|
|
}
|
|
|
|
func TestBrainUpdateSupersedesExisting(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
|
|
|
// Seed via brain_write so the note carries real frontmatter.
|
|
callResult(t, toolCall(t, srv, "brain_write", map[string]any{
|
|
"content": "# Old\n\nold body\n", "filename": "val-vol",
|
|
"wing": "jepa-fx", "hall": "facts",
|
|
}))
|
|
|
|
out := callResult(t, toolCall(t, srv, "brain_update", map[string]any{
|
|
"wing": "jepa-fx", "hall": "facts", "slug": "val-vol",
|
|
"content": "# New\n\nnew body\n", "reason": "facts changed",
|
|
}))
|
|
assert.Equal(t, "wiki/jepa-fx/facts/val-vol.md", out["path"])
|
|
assert.Equal(t, out["path"], out["id"])
|
|
assert.NotEmpty(t, out["content_hash"])
|
|
assert.Equal(t, true, out["superseded"])
|
|
|
|
got, err := os.ReadFile(filepath.Join(brainDir, "wiki/jepa-fx/facts/val-vol.md"))
|
|
require.NoError(t, err)
|
|
s := string(got)
|
|
assert.Contains(t, s, "# New")
|
|
assert.NotContains(t, s, "old body")
|
|
assert.Contains(t, s, "wing: jepa-fx")
|
|
assert.Contains(t, s, "supersede_reason: facts changed")
|
|
assert.Contains(t, s, "supersedes:")
|
|
}
|
|
|
|
func TestBrainUpdateMissingTargetErrorsNoCreate(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
|
|
|
resp := toolCall(t, srv, "brain_update", map[string]any{
|
|
"wing": "jepa-fx", "hall": "facts", "slug": "ghost",
|
|
"content": "x\n",
|
|
})
|
|
require.NotNil(t, resp["error"])
|
|
assert.Contains(t, resp["error"].(map[string]any)["message"].(string), "does not exist")
|
|
_, statErr := os.Stat(filepath.Join(brainDir, "wiki/jepa-fx/facts/ghost.md"))
|
|
assert.True(t, os.IsNotExist(statErr))
|
|
}
|
|
|
|
func TestBrainUpdateByFullPath(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
|
callResult(t, toolCall(t, srv, "brain_write", map[string]any{
|
|
"content": "old\n", "filename": "n", "wing": "a", "hall": "facts",
|
|
}))
|
|
|
|
out := callResult(t, toolCall(t, srv, "brain_update", map[string]any{
|
|
"slug": "wiki/a/facts/n.md", "content": "fresh\n",
|
|
}))
|
|
assert.Equal(t, "wiki/a/facts/n.md", out["path"])
|
|
}
|
|
|
|
func TestBrainGetByIDAndPath(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
|
w := callResult(t, toolCall(t, srv, "brain_write", map[string]any{
|
|
"content": "# Body\n\ntext\n", "filename": "n", "wing": "a", "hall": "facts",
|
|
}))
|
|
id := w["id"].(string)
|
|
hash := w["content_hash"].(string)
|
|
require.NotEmpty(t, id)
|
|
require.NotEmpty(t, hash)
|
|
|
|
// by id
|
|
g1 := callResult(t, toolCall(t, srv, "brain_get", map[string]any{"id": id}))
|
|
assert.Equal(t, id, g1["path"])
|
|
assert.Equal(t, hash, g1["content_hash"], "content_hash must round-trip write→get")
|
|
assert.Contains(t, g1["body"].(string), "# Body")
|
|
fm := g1["frontmatter"].(map[string]any)
|
|
assert.Equal(t, "a", fm["wing"])
|
|
|
|
// by path
|
|
g2 := callResult(t, toolCall(t, srv, "brain_get", map[string]any{"path": id}))
|
|
assert.Equal(t, hash, g2["content_hash"])
|
|
}
|
|
|
|
func TestBrainGetMissingArgsErrors(t *testing.T) {
|
|
srv := mcp.NewServer(t.TempDir(), nil, nil, nil)
|
|
resp := toolCall(t, srv, "brain_get", map[string]any{})
|
|
require.NotNil(t, resp["error"])
|
|
}
|
|
|
|
func TestBrainWriteReturnsHandle(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
|
out := callResult(t, toolCall(t, srv, "brain_write", map[string]any{
|
|
"content": "# X\n\nbody\n", "filename": "x", "wing": "a", "hall": "facts",
|
|
}))
|
|
assert.Equal(t, "wiki/a/facts/x.md", out["path"])
|
|
assert.Equal(t, out["path"], out["id"])
|
|
assert.NotEmpty(t, out["content_hash"])
|
|
}
|
|
|
|
// --- retrieval-reflects-new-content: exercises the real mtime-driven Sync ---
|
|
|
|
type fakeVecStore struct {
|
|
chunks map[string][]float32
|
|
deleted []string
|
|
}
|
|
|
|
func (f *fakeVecStore) KnownPathsWithTime(_ context.Context) (map[string]time.Time, error) {
|
|
m := make(map[string]time.Time, len(f.chunks))
|
|
for p := range f.chunks {
|
|
m[p] = time.Unix(0, 0) // always stale → mtime(now) is always newer
|
|
}
|
|
return m, nil
|
|
}
|
|
|
|
func (f *fakeVecStore) Upsert(_ context.Context, path string, vec []float32) error {
|
|
f.chunks[path] = vec
|
|
return nil
|
|
}
|
|
|
|
func (f *fakeVecStore) Delete(_ context.Context, path string) error {
|
|
delete(f.chunks, path)
|
|
f.deleted = append(f.deleted, path)
|
|
return nil
|
|
}
|
|
|
|
type fakeEmbedder struct{ seen []string }
|
|
|
|
func (e *fakeEmbedder) Embed(_ context.Context, text string) ([]float32, error) {
|
|
e.seen = append(e.seen, text)
|
|
return []float32{1, 0, 0}, nil
|
|
}
|
|
|
|
// TestBrainUpdateReembedsNewContent proves the supersede contract end to
|
|
// end against the actual embedding mechanism: brain_update rewrites the
|
|
// file, advancing its mtime, and the next vectorstore.Sync pass re-embeds
|
|
// the NEW body and drops the stale chunk. No stub of the re-index path.
|
|
func TestBrainUpdateReembedsNewContent(t *testing.T) {
|
|
brainDir := t.TempDir()
|
|
srv := mcp.NewServer(brainDir, nil, nil, nil)
|
|
ctx := context.Background()
|
|
|
|
callResult(t, toolCall(t, srv, "brain_write", map[string]any{
|
|
"content": "# Note\n\nthe OLD distinctive payload\n",
|
|
"filename": "n", "wing": "a", "hall": "facts",
|
|
}))
|
|
|
|
store := &fakeVecStore{chunks: map[string][]float32{}}
|
|
emb := &fakeEmbedder{}
|
|
|
|
// First sync embeds the original content.
|
|
_, err := vectorstore.Sync(ctx, brainDir, store, emb)
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, store.chunks)
|
|
require.True(t, anyContains(emb.seen, "OLD distinctive payload"))
|
|
|
|
callResult(t, toolCall(t, srv, "brain_update", map[string]any{
|
|
"wing": "a", "hall": "facts", "slug": "n",
|
|
"content": "# Note\n\nthe NEW distinctive payload\n",
|
|
}))
|
|
|
|
emb.seen = nil // only watch what the second pass embeds
|
|
_, err = vectorstore.Sync(ctx, brainDir, store, emb)
|
|
require.NoError(t, err)
|
|
|
|
assert.True(t, anyContains(emb.seen, "NEW distinctive payload"),
|
|
"Sync must re-embed the superseded body; saw %v", emb.seen)
|
|
assert.False(t, anyContains(emb.seen, "OLD distinctive payload"),
|
|
"the old body must not be re-embedded")
|
|
assert.NotEmpty(t, store.deleted, "stale chunks must be deleted before re-embed")
|
|
}
|
|
|
|
func anyContains(ss []string, sub string) bool {
|
|
for _, s := range ss {
|
|
if strings.Contains(s, sub) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|