assay-cli 3.35.0

Policy-as-code gate for MCP agent tool calls, with verifiable evidence and Linux kernel enforcement.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107

#![allow(deprecated)]

use assert_cmd::Command;
use predicates::str::contains;
use serde_json::Value;
use std::path::PathBuf;
use tempfile::tempdir;

fn read_json(path: &std::path::Path) -> Value {
    let content = std::fs::read_to_string(path).expect("coverage report should exist");
    serde_json::from_str(&content).expect("coverage report must be valid JSON")
}

fn fixture_path(name: &str) -> PathBuf {
    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
        .join("../../scripts/ci/fixtures/coverage")
        .join(name)
}

#[test]
fn coverage_contract_generates_valid_report_from_basic_jsonl() {
    let dir = tempdir().unwrap();
    let out = dir.path().join("coverage.json");

    Command::cargo_bin("assay")
        .unwrap()
        .args(["coverage", "--input"])
        .arg(fixture_path("input_basic.jsonl"))
        .args(["--out"])
        .arg(&out)
        .args([
            "--declared-tool",
            "read_document",
            "--declared-tool",
            "web_search",
            "--declared-tool",
            "web_search_alt",
        ])
        .assert()
        .success();

    let report = read_json(&out);
    assert_eq!(report["schema_version"], "coverage_report_v1");
    assert_eq!(
        report["tools"]["tools_unknown"],
        serde_json::json!(["unknown_tool_x"])
    );
    assert_eq!(
        report["taxonomy"]["tool_classes_missing"],
        serde_json::json!(["unknown_tool_x"])
    );
    assert_eq!(
        report["routes"]["routes_seen"],
        serde_json::json!([
            {"count": 1, "from": "read_document", "to": "web_search_alt"},
            {"count": 1, "from": "web_search", "to": "unknown_tool_x"},
            {"count": 1, "from": "web_search_alt", "to": "web_search"}
        ])
    );
}

#[test]
fn coverage_contract_accepts_tool_name_fallback_jsonl() {
    let dir = tempdir().unwrap();
    let out = dir.path().join("coverage.json");

    Command::cargo_bin("assay")
        .unwrap()
        .args(["coverage", "--input"])
        .arg(fixture_path("input_tool_name_fallback.jsonl"))
        .args(["--out"])
        .arg(&out)
        .args([
            "--declared-tool",
            "read_document",
            "--declared-tool",
            "web_search",
            "--declared-tool",
            "web_search_alt",
        ])
        .assert()
        .success();

    let report = read_json(&out);
    assert_eq!(report["schema_version"], "coverage_report_v1");
    assert_eq!(
        report["tools"]["tools_seen"],
        serde_json::json!(["read_document", "web_search", "web_search_alt"])
    );
}

#[test]
fn coverage_contract_fails_when_tool_fields_missing() {
    let dir = tempdir().unwrap();
    let out = dir.path().join("coverage.json");

    Command::cargo_bin("assay")
        .unwrap()
        .args(["coverage", "--input"])
        .arg(fixture_path("input_missing_tool_fields.jsonl"))
        .args(["--out"])
        .arg(&out)
        .assert()
        .failure()
        .code(2)
        .stderr(contains("missing required field: 'tool' or 'tool_name'"));
}