aaronsb_obsidian-mcp-plugin/scripts/coverage-map.mjs
Aaron Bockelie 8bb580cc56 fix: .mcpignore semantics, TLS 1.3 startup, rename extension (#250, #252, #253)
Bundles the three reported bugs plus an unreported under-blocking bug found
while writing the tests for #250, and adds the coverage tooling that would
have caught all four.

#250 — .mcpignore negation was inverted
The parser stripped the leading '!' before Minimatch saw it, so .negate was
always false and the branch reading it was dead code. '!folder/*' compiled
into a positive exclusion: negation did not merely fail, it inverted.

Under-blocking (found while testing the above, not reported)
Patterns were handed to Minimatch raw, so two gitignore rules were never
implemented: a slash-less pattern matches at any depth ('*.secret' must hide
'a/b/creds.secret'), and a directory match covers its contents ('private/'
must hide 'private/notes.md'). No consumer of isExcluded() checks ancestors —
every caller passes a full file path — so nothing compensated downstream. The
plugin's own shipped .mcpignore template promises both behaviours, so a user
following it believed private files were hidden while they were being served
to the model. Patterns are now translated into the globs that implement
gitignore semantics, and negation is interpreted here rather than by Minimatch.

#252 — min TLS 1.3 crashed the server
secureProtocol mapped 1.3 to 'TLSv1_3_method', which OpenSSL never shipped, so
context creation threw "Unknown method: TLSv1_3_method". Switched to minVersion,
which also fixes a second latent bug: secureProtocol PINS one version, so
"minimum TLS 1.2" was silently refusing TLS 1.3 clients. The setting now
behaves as the floor it is labelled.

#253 — rename dropped the extension
'newName' was concatenated onto the source directory verbatim, so renaming
'note.md' to 'renamed' produced an extension-less file that drops out of
markdown views. The source extension is now carried over when newName omits
one, before the overwrite guard so it checks the right path.

Coverage + test contract
All four bugs shipped through code paths with zero coverage. Adds `make
coverage` / `coverage-map` / `coverage-gate`, a ratcheting coverageThreshold
(security boundary held to a far higher floor than global, since a hole there
leaks vault content), and tests/test-contract.test.ts enforcing that a green
run means something: no .only, no .skip, every file asserts, no tautologies.
The contract immediately caught an `expect(true).toBe(true)` placeholder in the
path-validator suite, now replaced with real assertions.

BREAKING (.mcpignore, both intended):
- The double-'!' workaround for #250 now correctly parses as a double negation
  (net exclude) and will stop working.
- A bare '*' now excludes at every depth, per gitignore, rather than top-level
  only. This is what makes the '*' + '!keep/**' whitelist idiom work.
2026-07-13 17:46:50 -05:00

95 lines
3.2 KiB
JavaScript

#!/usr/bin/env node
/**
* Coverage map — turns coverage/coverage-summary.json into something actionable.
*
* A single global percentage tells you nothing about *where* to spend the next test.
* This ranks files two ways:
* 1. Risk tier — security/boundary code first, because a coverage hole there leaks
* vault content rather than merely breaking a call.
* 2. Absolute gap — uncovered statements, so effort goes where it moves the number.
*
* Run `make coverage` first (this reads the summary it writes).
* `--json` emits one machine-readable line for diffing across releases.
*/
import { readFileSync } from 'fs';
import { resolve } from 'path';
const SUMMARY = resolve('coverage/coverage-summary.json');
// Tiers are ordered: the first matching pattern wins.
const TIERS = [
{ name: 'security boundary', re: /^src\/(security|validation)\// },
{ name: 'core api + routing', re: /^src\/(semantic|utils\/obsidian-api|tools|mcp-server)/ },
{ name: 'supporting', re: /.*/ }
];
let summary;
try {
summary = JSON.parse(readFileSync(SUMMARY, 'utf8'));
} catch {
console.error(`No coverage summary at ${SUMMARY}.\nRun \`make coverage\` first.`);
process.exit(2);
}
const cwd = process.cwd() + '/';
const files = Object.entries(summary)
.filter(([f]) => f !== 'total')
.map(([f, m]) => {
const file = f.replace(cwd, '');
return {
file,
tier: TIERS.find(t => t.re.test(file)).name,
pct: m.statements.pct,
covered: m.statements.covered,
total: m.statements.total,
gap: m.statements.total - m.statements.covered
};
});
const total = summary.total;
if (process.argv.includes('--json')) {
console.log(JSON.stringify({
total: {
statements: total.statements.pct,
branches: total.branches.pct,
functions: total.functions.pct,
lines: total.lines.pct
},
files: files.map(({ file, tier, pct, gap }) => ({ file, tier, pct, gap }))
}));
process.exit(0);
}
const bar = pct => {
const filled = Math.round(pct / 5);
return '█'.repeat(filled) + '·'.repeat(20 - filled);
};
console.log('\nCOVERAGE MAP\n');
console.log(
` overall statements ${total.statements.pct}% branches ${total.branches.pct}% ` +
`functions ${total.functions.pct}% lines ${total.lines.pct}%\n`
);
for (const { name } of TIERS) {
const tierFiles = files.filter(f => f.tier === name).sort((a, b) => a.pct - b.pct);
if (!tierFiles.length) continue;
const covered = tierFiles.reduce((n, f) => n + f.covered, 0);
const stmts = tierFiles.reduce((n, f) => n + f.total, 0);
const tierPct = stmts ? (100 * covered / stmts).toFixed(1) : '100.0';
console.log(` ${name.toUpperCase()}${tierPct}% of ${stmts} statements`);
for (const f of tierFiles) {
const pct = String(f.pct.toFixed(1)).padStart(5);
console.log(` ${bar(f.pct)} ${pct}% ${String(f.gap).padStart(4)} uncov ${f.file}`);
}
console.log();
}
console.log(' BIGGEST GAPS (uncovered statements)');
for (const f of [...files].sort((a, b) => b.gap - a.gap).slice(0, 10)) {
console.log(` ${String(f.gap).padStart(4)} ${String(f.pct.toFixed(1)).padStart(5)}% ${f.file}`);
}
console.log('\n Floors live in jest.config.js (coverageThreshold). `make coverage-gate` enforces them.\n');