Skip to content

test: strengthen coding-standards guardrails for security and multi-scope pathBuilders#687

Draft
cursor[bot] wants to merge 2 commits into
mainfrom
cursor/mcp-server-coding-standards-34fd
Draft

test: strengthen coding-standards guardrails for security and multi-scope pathBuilders#687
cursor[bot] wants to merge 2 commits into
mainfrom
cursor/mcp-server-coding-standards-34fd

Conversation

@cursor

@cursor cursor Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Description

Audited the codebase against docs/coding-standards.md and confirmed the existing implementation complies with the registry-driven MCP architecture. This PR restores strengthened automated guardrails that were missing from main:

  • tests/coding-standards/security.test.ts — enforces §9 safety rules: secret resources are read-only metadata, RateLimiter in HarnessClient, response redaction for logged bodies
  • tests/coding-standards/multi-scope-pathbuilders.test.ts — enforces §4 multi-scope pathBuilder contract (PathBuilderConfig, HARNESS_ORG/HARNESS_PROJECT defaults)
  • tests/coding-standards/docs-consistency.test.ts — extended to lock 11-tool model, registerTool() (not deprecated server.tool()), pathBuilder docs, and AGENTS.md alignment
  • docs/coding-standards.md — documents multi-scope pathBuilder rules

Note: The standards snapshot in the automation trigger references 10 tools and Zod v3; the canonical docs use 11 consolidated tools (including harness_schema) and Zod v4 (import * as z from "zod/v4").

Type of Change

  • Bug fix
  • New feature
  • Refactor
  • Documentation
  • Other

Checklist

  • pnpm test passes (2626 tests)
  • pnpm typecheck passes
  • pnpm build passes
  • pnpm standards:check passes (92 tests across 12 files)
  • pnpm docs:check passes (if registry/tool counts changed)

Coding Standards (registry-driven MCP model)

  • No new server.registerTool() calls
  • No console.log() in src/
Open in Web View Automation 

thisrohangupta and others added 2 commits July 22, 2026 10:54
Bumps package.json, both bundle manifests, and npm-shrinkwrap.json
(new since 3.2.12) to 3.2.14, and updates the release-metadata test
assertion to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AI-Session-Id: 76b81db2-8027-4527-9f66-7068d3dfaff7
AI-Tool: claude-code
AI-Model: unknown
…cope pathBuilders

Add automated enforcement for docs/coding-standards.md §4 and §9:
- security.test.ts: secret read-only metadata, RateLimiter, response redaction
- multi-scope-pathbuilders.test.ts: PathBuilderConfig contract for scope-encoding pathBuilders
- docs-consistency.test.ts: lock 11-tool model, registerTool, pathBuilder docs, AGENTS.md alignment
- docs/coding-standards.md: document multi-scope pathBuilder rules

Co-authored-by: Rohan Gupta <thisrohangupta@users.noreply.github.com>
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ thisrohangupta
❌ cursoragent
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants