fix(TASK-046): honor the --mcp-list inspection contract without a vault
Pure --mcp-list never reads secrets (only --mcp-add does), yet the mcp action path always ran strict Vault::init, so a virgin environment with no password file exited 1 instead of printing the empty listing. Route the mcp_inspect path through the established Vault::init_lenient constructor; get/remove/add stay on the strict init. Make tests/inspection_flags.rs hermetic against host state: every spawned binary gets a fresh fake HOME (and USERPROFILE) so a real ~/.coyote_password can't mask virgin-environment regressions, scrubs IS_SANDBOX/COYOTE_PROVIDER/COYOTE_PLATFORM outside the sandbox-mode tests, and pins CWD so workspace mcp.json discovery can't leak in. New tests pin both sides of the boundary: the lenient list path (empty and configured, never bootstrapping a password file) and the strict vault gate for get/remove/add.
This commit is contained in:
2 files changed
+195
-2
No files matched your search
+9
-1
@@ -259,7 +259,15 @@ async fn main() -> Result<()> {
|
||||
} else {
|
||||
AppConfig::from_config(cfg)?
|
||||
};
|
||||
let vault = Vault::init(&app_config)?;
|
||||
// Listing servers reads no secrets, so an unconfigured vault (no
|
||||
// Listing servers reads no secrets, so an unconfigured vault (no
|
||||
// password file) must not block the readout; every other MCP flag
|
||||
// (get/remove/add) stays on the strict init.
|
||||
let vault = if mcp_inspect {
|
||||
Vault::init_lenient(&app_config)
|
||||
} else {
|
||||
Vault::init(&app_config)?
|
||||
};
|
||||
|
||||
mcp::manage::handle(&cli, &vault)?;
|
||||
|
||||
|
||||
+186
-1
@@ -9,6 +9,11 @@
|
||||
//! agent_info_on_empty_config_dir_bootstraps_builtins. Flags that write,
|
||||
//! like --sync-models, are NOT inspection flags and must stay on the
|
||||
//! bootstrap path — see sync_models_stays_on_bootstrap_path.
|
||||
//!
|
||||
//! Every test runs against a fresh fake HOME and (unless sandbox mode is the
|
||||
//! subject under test) a scrubbed IS_SANDBOX/provider env, so host state —
|
||||
//! a real ~/.coyote_password or a sandbox shell — cannot mask
|
||||
//! virgin-environment regressions.
|
||||
|
||||
use std::env;
|
||||
use std::fs;
|
||||
@@ -27,11 +32,27 @@ fn fresh_config_dir(label: &str) -> PathBuf {
|
||||
}
|
||||
|
||||
fn probe_inspection_flag(flag: &str, require_stdout: bool) {
|
||||
let tmp_dir = fresh_config_dir(flag.trim_start_matches("--"));
|
||||
let label = flag.trim_start_matches("--");
|
||||
let tmp_dir = fresh_config_dir(label);
|
||||
let home_dir = fresh_config_dir(&format!("{label}-home"));
|
||||
|
||||
let output = Command::new(env!("CARGO_BIN_EXE_coyote"))
|
||||
.arg(flag)
|
||||
.env("COYOTE_CONFIG_DIR", &tmp_dir)
|
||||
// A fresh fake HOME hides any real ~/.coyote_password on the host;
|
||||
// USERPROFILE is the best-effort Windows equivalent (dirs resolves
|
||||
// home via the Known Folder API there). HOME is set, never removed:
|
||||
// dirs::home_dir() panics inside gman when home can't be determined.
|
||||
.env("HOME", &home_dir)
|
||||
.env("USERPROFILE", &home_dir)
|
||||
// A leaked sandbox/provider env would reroute the vault and config
|
||||
// paths under test.
|
||||
.env_remove("IS_SANDBOX")
|
||||
.env_remove("COYOTE_PROVIDER")
|
||||
.env_remove("COYOTE_PLATFORM")
|
||||
// Workspace mcp.json discovery resolves from the CWD, so pin it to
|
||||
// the isolated fake HOME to keep host state out of the probe.
|
||||
.current_dir(&home_dir)
|
||||
.stdin(Stdio::null())
|
||||
.output()
|
||||
.unwrap();
|
||||
@@ -40,7 +61,12 @@ fn probe_inspection_flag(flag: &str, require_stdout: bool) {
|
||||
.unwrap()
|
||||
.map(|entry| entry.unwrap().file_name())
|
||||
.collect();
|
||||
assert!(
|
||||
!home_dir.join(".coyote_password").exists(),
|
||||
"{flag}: the lenient inspection path must never bootstrap a password file"
|
||||
);
|
||||
let _ = fs::remove_dir_all(&tmp_dir);
|
||||
let _ = fs::remove_dir_all(&home_dir);
|
||||
|
||||
assert!(
|
||||
output.status.success(),
|
||||
@@ -90,10 +116,17 @@ fn mcp_list_on_empty_config_dir_writes_nothing() {
|
||||
#[test]
|
||||
fn agent_info_on_empty_config_dir_bootstraps_builtins() {
|
||||
let tmp_dir = fresh_config_dir("agent-info");
|
||||
let home_dir = fresh_config_dir("agent-info-home");
|
||||
|
||||
let output = Command::new(env!("CARGO_BIN_EXE_coyote"))
|
||||
.args(["--agent", "adversary", "--info"])
|
||||
.env("COYOTE_CONFIG_DIR", &tmp_dir)
|
||||
.env("HOME", &home_dir)
|
||||
.env("USERPROFILE", &home_dir)
|
||||
.env_remove("IS_SANDBOX")
|
||||
.env_remove("COYOTE_PROVIDER")
|
||||
.env_remove("COYOTE_PLATFORM")
|
||||
.current_dir(&home_dir)
|
||||
.stdin(Stdio::null())
|
||||
.output()
|
||||
.unwrap();
|
||||
@@ -102,6 +135,7 @@ fn agent_info_on_empty_config_dir_bootstraps_builtins() {
|
||||
let builtins_installed =
|
||||
agents_dir.is_dir() && fs::read_dir(&agents_dir).unwrap().next().is_some();
|
||||
let _ = fs::remove_dir_all(&tmp_dir);
|
||||
let _ = fs::remove_dir_all(&home_dir);
|
||||
|
||||
assert!(
|
||||
output.status.success(),
|
||||
@@ -131,11 +165,15 @@ fn agent_info_on_empty_config_dir_bootstraps_builtins() {
|
||||
#[test]
|
||||
fn sandbox_list_secrets_prints_informational_message_and_writes_nothing() {
|
||||
let tmp_dir = fresh_config_dir("sandbox-list-secrets");
|
||||
let home_dir = fresh_config_dir("sandbox-list-secrets-home");
|
||||
|
||||
let output = Command::new(env!("CARGO_BIN_EXE_coyote"))
|
||||
.arg("--list-secrets")
|
||||
.env("COYOTE_CONFIG_DIR", &tmp_dir)
|
||||
.env("IS_SANDBOX", "1")
|
||||
.env("HOME", &home_dir)
|
||||
.env("USERPROFILE", &home_dir)
|
||||
.current_dir(&home_dir)
|
||||
.stdin(Stdio::null())
|
||||
.output()
|
||||
.unwrap();
|
||||
@@ -145,6 +183,7 @@ fn sandbox_list_secrets_prints_informational_message_and_writes_nothing() {
|
||||
.map(|entry| entry.unwrap().file_name())
|
||||
.collect();
|
||||
let _ = fs::remove_dir_all(&tmp_dir);
|
||||
let _ = fs::remove_dir_all(&home_dir);
|
||||
|
||||
assert!(
|
||||
output.status.success(),
|
||||
@@ -175,6 +214,7 @@ fn sandbox_list_secrets_prints_informational_message_and_writes_nothing() {
|
||||
#[test]
|
||||
fn sandbox_mutating_vault_flag_stays_strict() {
|
||||
let tmp_dir = fresh_config_dir("sandbox-delete-secret");
|
||||
let home_dir = fresh_config_dir("sandbox-delete-secret-home");
|
||||
fs::write(
|
||||
tmp_dir.join("config.yaml"),
|
||||
"model: dryrun:dry-model\n\
|
||||
@@ -196,10 +236,14 @@ fn sandbox_mutating_vault_flag_stays_strict() {
|
||||
.args(["--delete-secret", "probe"])
|
||||
.env("COYOTE_CONFIG_DIR", &tmp_dir)
|
||||
.env("IS_SANDBOX", "1")
|
||||
.env("HOME", &home_dir)
|
||||
.env("USERPROFILE", &home_dir)
|
||||
.current_dir(&home_dir)
|
||||
.stdin(Stdio::null())
|
||||
.output()
|
||||
.unwrap();
|
||||
let _ = fs::remove_dir_all(&tmp_dir);
|
||||
let _ = fs::remove_dir_all(&home_dir);
|
||||
|
||||
assert!(
|
||||
!output.status.success(),
|
||||
@@ -218,6 +262,142 @@ fn sandbox_mutating_vault_flag_stays_strict() {
|
||||
);
|
||||
}
|
||||
|
||||
// The --mcp-list leniency must not leak into the mutating MCP flags on the
|
||||
// host path: with no password file (fresh fake HOME) and no sandbox env,
|
||||
// --mcp-get/--mcp-remove/--mcp-add have to fail on the strict vault
|
||||
// requirement rather than operate with an unconfigured vault.
|
||||
fn probe_strict_mcp_flag(label: &str, args: &[&str]) {
|
||||
let tmp_dir = fresh_config_dir(&format!("{label}-no-vault"));
|
||||
let home_dir = fresh_config_dir(&format!("{label}-no-vault-home"));
|
||||
fs::write(
|
||||
tmp_dir.join("config.yaml"),
|
||||
"model: dryrun:dry-model\n\
|
||||
dry_run: true\n\
|
||||
clients:\n\
|
||||
\x20 - type: openai\n\
|
||||
\x20 name: dryrun\n\
|
||||
\x20 auth: none\n\
|
||||
\x20 api_key: unused\n\
|
||||
\x20 models:\n\
|
||||
\x20 - name: dry-model\n\
|
||||
\x20 max_input_tokens: 100000\n\
|
||||
\x20 supports_function_calling: true\n\
|
||||
save: false\n",
|
||||
)
|
||||
.unwrap();
|
||||
fs::write(
|
||||
tmp_dir.join("mcp.json"),
|
||||
r#"{"mcpServers":{"probe-server":{"type":"stdio","command":"echo","args":["hi"]}}}"#,
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
let output = Command::new(env!("CARGO_BIN_EXE_coyote"))
|
||||
.args(args)
|
||||
.env("COYOTE_CONFIG_DIR", &tmp_dir)
|
||||
.env("HOME", &home_dir)
|
||||
.env("USERPROFILE", &home_dir)
|
||||
.env_remove("IS_SANDBOX")
|
||||
.env_remove("COYOTE_PROVIDER")
|
||||
.env_remove("COYOTE_PLATFORM")
|
||||
.current_dir(&home_dir)
|
||||
.stdin(Stdio::null())
|
||||
.output()
|
||||
.unwrap();
|
||||
// The strict path must not touch the server registry either.
|
||||
let mcp_json_after = fs::read_to_string(tmp_dir.join("mcp.json")).unwrap();
|
||||
let _ = fs::remove_dir_all(&tmp_dir);
|
||||
let _ = fs::remove_dir_all(&home_dir);
|
||||
|
||||
assert!(
|
||||
!output.status.success(),
|
||||
"{label} without a vault: expected a non-zero exit, got {:?}\nstdout: {}",
|
||||
output.status,
|
||||
String::from_utf8_lossy(&output.stdout)
|
||||
);
|
||||
let combined = format!(
|
||||
"{}{}",
|
||||
String::from_utf8_lossy(&output.stdout),
|
||||
String::from_utf8_lossy(&output.stderr)
|
||||
);
|
||||
assert!(
|
||||
combined.contains("A password file is required"),
|
||||
"{label} without a vault: expected the strict vault error, got: {combined}"
|
||||
);
|
||||
assert!(
|
||||
mcp_json_after.contains("probe-server"),
|
||||
"{label} without a vault: mcp.json must be left untouched, got: {mcp_json_after}"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mcp_mutating_flag_stays_strict_without_vault() {
|
||||
probe_strict_mcp_flag("mcp-remove", &["--mcp-remove", "probe-server"]);
|
||||
}
|
||||
|
||||
// --mcp-get is read-only but consumes resolved server config (which may
|
||||
// embed secrets), so it stays on the strict vault path by design.
|
||||
#[test]
|
||||
fn mcp_get_stays_strict_without_vault() {
|
||||
probe_strict_mcp_flag("mcp-get", &["--mcp-get", "probe-server"]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mcp_add_stays_strict_without_vault() {
|
||||
probe_strict_mcp_flag("mcp-add", &["--mcp-add", "newsrv", "--", "echo", "hi"]);
|
||||
}
|
||||
|
||||
// The listing leniency exercised with content: a configured, secret-free
|
||||
// server must be listed even when no vault exists (no password file, no
|
||||
// sandbox env), and the readout must not write anything new into the
|
||||
// config dir.
|
||||
#[test]
|
||||
fn mcp_list_lists_configured_server_without_vault() {
|
||||
let tmp_dir = fresh_config_dir("mcp-list-configured");
|
||||
let home_dir = fresh_config_dir("mcp-list-configured-home");
|
||||
fs::write(
|
||||
tmp_dir.join("mcp.json"),
|
||||
r#"{"mcpServers":{"probe-server":{"type":"stdio","command":"echo","args":["hi"]}}}"#,
|
||||
)
|
||||
.unwrap();
|
||||
|
||||
let output = Command::new(env!("CARGO_BIN_EXE_coyote"))
|
||||
.arg("--mcp-list")
|
||||
.env("COYOTE_CONFIG_DIR", &tmp_dir)
|
||||
.env("HOME", &home_dir)
|
||||
.env("USERPROFILE", &home_dir)
|
||||
.env_remove("IS_SANDBOX")
|
||||
.env_remove("COYOTE_PROVIDER")
|
||||
.env_remove("COYOTE_PLATFORM")
|
||||
.current_dir(&home_dir)
|
||||
.stdin(Stdio::null())
|
||||
.output()
|
||||
.unwrap();
|
||||
|
||||
let leftover: Vec<_> = fs::read_dir(&tmp_dir)
|
||||
.unwrap()
|
||||
.map(|entry| entry.unwrap().file_name())
|
||||
.collect();
|
||||
let _ = fs::remove_dir_all(&tmp_dir);
|
||||
let _ = fs::remove_dir_all(&home_dir);
|
||||
|
||||
assert!(
|
||||
output.status.success(),
|
||||
"--mcp-list with a configured server and no vault: expected exit 0, got {:?}\nstderr: {}",
|
||||
output.status,
|
||||
String::from_utf8_lossy(&output.stderr)
|
||||
);
|
||||
let stdout = String::from_utf8_lossy(&output.stdout);
|
||||
assert!(
|
||||
stdout.contains("probe-server"),
|
||||
"--mcp-list with a configured server: expected 'probe-server' in stdout, got: {stdout}"
|
||||
);
|
||||
assert_eq!(
|
||||
leftover,
|
||||
vec![std::ffi::OsString::from("mcp.json")],
|
||||
"--mcp-list must not write into the config dir beyond the pre-seeded mcp.json"
|
||||
);
|
||||
}
|
||||
|
||||
// --sync-models downloads and writes models-override.yaml, so it is NOT an
|
||||
// inspection flag: on a pristine config dir it must take the bootstrap path
|
||||
// (builtins installed) and, off a terminal, fail on the missing config
|
||||
@@ -227,19 +407,24 @@ fn sandbox_mutating_vault_flag_stays_strict() {
|
||||
#[test]
|
||||
fn sync_models_stays_on_bootstrap_path() {
|
||||
let tmp_dir = fresh_config_dir("sync-models");
|
||||
let home_dir = fresh_config_dir("sync-models-home");
|
||||
|
||||
let output = Command::new(env!("CARGO_BIN_EXE_coyote"))
|
||||
.arg("--sync-models")
|
||||
.env("COYOTE_CONFIG_DIR", &tmp_dir)
|
||||
.env("HOME", &home_dir)
|
||||
.env("USERPROFILE", &home_dir)
|
||||
.env_remove("IS_SANDBOX")
|
||||
.env_remove("COYOTE_PROVIDER")
|
||||
.env_remove("COYOTE_PLATFORM")
|
||||
.current_dir(&home_dir)
|
||||
.stdin(Stdio::null())
|
||||
.output()
|
||||
.unwrap();
|
||||
|
||||
let bootstrapped = fs::read_dir(&tmp_dir).unwrap().next().is_some();
|
||||
let _ = fs::remove_dir_all(&tmp_dir);
|
||||
let _ = fs::remove_dir_all(&home_dir);
|
||||
|
||||
assert!(
|
||||
!output.status.success(),
|
||||
|
||||
Reference in new issue
Block a user