feat: align mutation guard with runtime_context workspace resolution (Closes #460)

Share canonical workspace/repo-root resolution between gitea_get_runtime_context and verify_preflight_purity so valid branches/ worktrees are not rejected when the MCP process root differs from the stable control checkout. Fix relative git-common-dir resolution and add regression tests. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-07 16:11:23 -04:00
parent ee8e9a0247
commit b33844d74a
4 changed files with 348 additions and 62 deletions
@@ -106,20 +106,32 @@ class TestCreateIssueWorkspaceGuard(unittest.TestCase):
    @patch("gitea_mcp_server.issue_lock_worktree.read_worktree_git_state", return_value={"current_branch": "feat/issue-1"})
    @patch("os.path.exists", return_value=True)
    @patch("os.path.isdir", return_value=True)
+    @patch("author_mutation_worktree.subprocess.run")
    @patch("subprocess.run")
-    def test_create_issue_wrong_repo_fails_closed(self, mock_run, mock_isdir, mock_exists, _git, _get_all, mock_api, _role, _ns, _prof, _auth):
-        # Mock subprocess.run for git --git-common-dir to return a different path
-        mock_res = MagicMock()
-        mock_res.stdout = "/Users/jasonwalker/Development/some-other-repo/.git\n"
-        mock_run.return_value = mock_res
-
+    def test_create_issue_wrong_repo_fails_closed(self, mock_run, mock_amw_run, mock_isdir, mock_exists, _git, _get_all, mock_api, _role, _ns, _prof, _auth):
        wrong_repo_path = os.path.join(CONTROL_CHECKOUT_ROOT, "branches", "feat-issue-1")

+        def _subprocess_side_effect(cmd, *args, **kwargs):
+            mock_res = MagicMock(returncode=0)
+            if "--git-common-dir" in cmd:
+                cwd = cmd[cmd.index("-C") + 1] if "-C" in cmd else ""
+                if cwd == wrong_repo_path:
+                    mock_res.stdout = "/Users/jasonwalker/Development/some-other-repo/.git\n"
+                else:
+                    mock_res.stdout = f"{CONTROL_CHECKOUT_ROOT}/.git\n"
+            else:
+                mock_res.stdout = ""
+            return mock_res
+
+        mock_run.side_effect = _subprocess_side_effect
+        mock_amw_run.side_effect = _subprocess_side_effect
+
        with patch.object(srv, "PROJECT_ROOT", CONTROL_CHECKOUT_ROOT):
-            with self.assertRaises(RuntimeError) as ctx:
-                srv.gitea_create_issue(
-                    title="Test issue", body="body", worktree_path=wrong_repo_path
-                )
+            with patch("gitea_mcp_server._get_workspace_porcelain", return_value=""):
+                with self.assertRaises(RuntimeError) as ctx:
+                    srv.gitea_create_issue(
+                        title="Test issue", body="body", worktree_path=wrong_repo_path
+                    )
        self.assertIn("does not belong to the target repository", str(ctx.exception))

    @patch("gitea_mcp_server._auth", return_value=FAKE_AUTH)
@@ -0,0 +1,153 @@
+"""Tests for runtime_context / mutation-guard workspace alignment (#460)."""
+
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+from unittest.mock import MagicMock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+import author_mutation_worktree as amw  # noqa: E402
+import gitea_mcp_server as srv  # noqa: E402
+
+CONTROL_ROOT = str(Path(__file__).resolve().parents[3])
+BRANCHES_WORKTREE = str(Path(__file__).resolve().parents[1])
+MCP_PROCESS_ROOT = BRANCHES_WORKTREE
+
+
+class TestCanonicalRepoRoot(unittest.TestCase):
+    @mock.patch("subprocess.run")
+    def test_resolves_main_repo_from_branches_worktree(self, mock_run):
+        mock_run.return_value = MagicMock(
+            returncode=0,
+            stdout=f"{CONTROL_ROOT}/.git\n",
+        )
+        root = amw.resolve_canonical_repo_root(BRANCHES_WORKTREE, MCP_PROCESS_ROOT)
+        self.assertEqual(root, CONTROL_ROOT)
+
+    def test_falls_back_when_git_unavailable(self):
+        root = amw.resolve_canonical_repo_root("/missing/path", MCP_PROCESS_ROOT)
+        self.assertEqual(root, os.path.realpath(MCP_PROCESS_ROOT))
+
+
+class TestWorkspaceRepoMembership(unittest.TestCase):
+    @mock.patch("os.path.isdir", return_value=True)
+    @mock.patch("os.path.exists", return_value=True)
+    @mock.patch("subprocess.run")
+    def test_valid_branches_worktree_accepted(self, mock_run, *_exists):
+        mock_run.return_value = MagicMock(
+            returncode=0,
+            stdout=f"{CONTROL_ROOT}/.git\n",
+        )
+        result = amw.assess_workspace_repo_membership(
+            workspace_path=BRANCHES_WORKTREE,
+            canonical_repo_root=CONTROL_ROOT,
+        )
+        self.assertTrue(result["proven"])
+        self.assertFalse(result["block"])
+
+    @mock.patch("os.path.isdir", return_value=True)
+    @mock.patch("os.path.exists", return_value=True)
+    @mock.patch("subprocess.run")
+    def test_wrong_repo_rejected(self, mock_run, *_exists):
+        mock_run.return_value = MagicMock(
+            returncode=0,
+            stdout="/other/repo/.git\n",
+        )
+        result = amw.assess_workspace_repo_membership(
+            workspace_path=BRANCHES_WORKTREE,
+            canonical_repo_root=CONTROL_ROOT,
+        )
+        self.assertTrue(result["block"])
+        self.assertIn("does not belong", result["reasons"][0])
+
+    @mock.patch("os.path.exists", return_value=False)
+    def test_missing_worktree_rejected(self, *_exists):
+        result = amw.assess_workspace_repo_membership(
+            workspace_path=f"{CONTROL_ROOT}/branches/missing-worktree",
+            canonical_repo_root=CONTROL_ROOT,
+        )
+        self.assertTrue(result["block"])
+        self.assertIn("does not exist", result["reasons"][0])
+
+
+class TestRuntimeContextGuardAlignment(unittest.TestCase):
+    def setUp(self):
+        srv._preflight_whoami_called = True
+        srv._preflight_capability_called = True
+        srv._preflight_resolved_role = "author"
+        self._orig_in_test = srv._preflight_in_test_mode
+        srv._preflight_in_test_mode = lambda: False
+        self._env_patch = mock.patch.dict(
+            os.environ,
+            {},
+            clear=False,
+        )
+        self._env_patch.start()
+        os.environ.pop("GITEA_ACTIVE_WORKTREE", None)
+        os.environ.pop("GITEA_AUTHOR_WORKTREE", None)
+
+    def tearDown(self):
+        srv._preflight_in_test_mode = self._orig_in_test
+        self._env_patch.stop()
+
+    def test_runtime_context_and_guard_share_resolved_workspace(self):
+        with mock.patch.object(srv, "PROJECT_ROOT", MCP_PROCESS_ROOT):
+            ctx = srv._resolve_author_mutation_context(BRANCHES_WORKTREE)
+            status = srv.assess_preflight_status(worktree_path=BRANCHES_WORKTREE)
+        self.assertEqual(ctx["workspace_path"], os.path.realpath(BRANCHES_WORKTREE))
+        self.assertEqual(ctx["canonical_repo_root"], CONTROL_ROOT)
+        self.assertFalse(ctx["roots_aligned"])
+        self.assertEqual(
+            status["preflight_workspace"]["active_task_workspace_root"],
+            os.path.realpath(BRANCHES_WORKTREE),
+        )
+        self.assertEqual(
+            status["preflight_workspace"]["canonical_repository_root"],
+            CONTROL_ROOT,
+        )
+        self.assertIn("workspace_root_mismatch", status["preflight_workspace"])
+
+    @mock.patch("subprocess.run")
+    @mock.patch("os.path.isdir", return_value=True)
+    @mock.patch("os.path.exists", return_value=True)
+    def test_declared_branches_worktree_passes_when_mcp_root_differs(
+        self, _exists, _isdir, mock_run
+    ):
+        mock_run.return_value = MagicMock(
+            returncode=0,
+            stdout=f"{CONTROL_ROOT}/.git\n",
+        )
+        with mock.patch.object(srv, "PROJECT_ROOT", MCP_PROCESS_ROOT):
+            with mock.patch.dict("os.environ", {"GITEA_TEST_PORCELAIN": ""}, clear=False):
+                srv.verify_preflight_purity(worktree_path=BRANCHES_WORKTREE)
+
+    def test_stable_checkout_still_rejected(self):
+        with mock.patch.object(srv, "PROJECT_ROOT", CONTROL_ROOT):
+            with mock.patch.dict("os.environ", {"GITEA_TEST_PORCELAIN": ""}, clear=False):
+                with self.assertRaises(RuntimeError) as ctx:
+                    srv.verify_preflight_purity()
+        self.assertIn("stable control checkout", str(ctx.exception))
+
+    @mock.patch("os.path.isdir", return_value=True)
+    @mock.patch("os.path.exists", return_value=True)
+    @mock.patch("subprocess.run")
+    def test_non_branches_worktree_rejected(self, mock_run, *_exists):
+        outside = "/tmp/outside-repo-checkout"
+        mock_run.return_value = MagicMock(
+            returncode=0,
+            stdout=f"{CONTROL_ROOT}/.git\n",
+        )
+        with mock.patch.object(srv, "PROJECT_ROOT", CONTROL_ROOT):
+            with mock.patch.dict("os.environ", {"GITEA_TEST_PORCELAIN": ""}, clear=False):
+                with self.assertRaises(RuntimeError) as ctx:
+                    srv.verify_preflight_purity(worktree_path=outside)
+        self.assertIn("not under", str(ctx.exception))
+
+
+if __name__ == "__main__":
+    unittest.main()