test(mcp): gate CONNECT_AGENT_PAGE on canonical expression envelopes (#12345)

packages/mcp is the third package shipping a raw-literal Page that reaches the
kernel through its own manifest bundle, and the only one without the
canonical-expression-envelope gate the other two carry. CONNECT_AGENT_PAGE
authors zero expression keys today, which is the argument for the gate rather
than against it: the hazard is the NEXT predicate added to it, which would ship
bare with every authoring-time signal green.

Thin gate copying the cloud-connection shape: the shared detector from
@objectstack/lint, the @objectstack/lint devDependency, and an anchored vitest
source alias appended to this package's existing alias array so the gate judges
lint's SOURCE rather than a possibly-stale dist. Population is discovered by
export shape over src/ through the shared maskComments, never by a hard-coded
name, with a floor so a scan that reads nothing cannot pass as a clean page, and
a phantom-comment pin so comment-shaped text cannot delete a page from it.

Door 3 has one recorded exemption: mcp:connect-agent is a console-registered
widget with no ComponentPropsMap row, the same standing-exemption shape
cloud-connection's two widgets were in before #11575 gave them rows. The
exemption is asserted exactly, its bag is pinned empty, and a non-vacuity pin
reds if the type ever stops appearing on the page.

The cross-package maskComments import is declared in
scripts/cross-package-test-inputs.mjs and hashed by a matching
@objectstack/mcp#test entry in turbo.json.


Claude-Session: https://claude.ai/code/session_01UjM2ia8Av1v5NqfqQEQmC6

Co-authored-by: Claude <noreply@anthropic.com>

Author: yinlianghui

packages/mcp/package.json

@@ -27,6 +27,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@objectstack/lint": "workspace:*",
     "@objectstack/metadata-core": "workspace:*",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3",

packages/mcp/src/canonical-expression-envelopes.test.ts

@@ -33,8 +33,21 @@ export default defineConfig({
     // any subpath and resolve it to `…/src/index.ts/<subpath>` (ENOTDIR) — a
     // config that looks right and fails at run time. Same shape as
     // `plugin-sharing`'s.
+    //
+    // The second entry is for `canonical-expression-envelopes.test.ts` (#12269)
+    // — the only suite here that imports `@objectstack/lint` as a VALUE. It
+    // runs the shared canonical-envelope detector
+    // (`auditPageExpressionEnvelopes`) over this package's own `Page` export.
+    // Unaliased, that specifier resolves through `exports` to `lint/dist`, and
+    // the failure mode is the same silent one the note above describes: a dist
+    // merely BEHIND lets this gate run GREEN against the detector's old
+    // behaviour, while the gate's whole purpose is to run the CURRENT detector
+    // over the CURRENT page. Anchored for a second reason here — `@objectstack/lint`
+    // exports a `./runtime` subpath, and the object form would swallow it and
+    // resolve it to `…/lint/src/index.ts/runtime` (ENOTDIR) at run time.
     alias: [
       { find: /^@objectstack\/metadata-core$/, replacement: path.resolve(__dirname, '../metadata-core/src/index.ts') },
+      { find: /^@objectstack\/lint$/, replacement: path.resolve(__dirname, '../lint/src/index.ts') },
     ],
   },
 });

packages/mcp/vitest.config.ts

@@ -444,6 +444,21 @@ export const CROSS_PACKAGE_TEST_INPUTS = {
       'packages/cloud-connection/src/cloud-connection-ui.ts',
     ],
   },
+  '@objectstack/mcp': {
+    // src/canonical-expression-envelopes.test.ts (#12269) imports `maskComments`
+    // from `js-comment-mask.mjs` to decide which text in this package's `src/` is
+    // a comment and which is a `Page` declaration — the third package to carry
+    // this gate, and declared for the same two reasons the two entries above
+    // record. The import is a real coupling: that gate's POPULATION is a
+    // function of the module's masking behaviour, so a change to it has to
+    // re-run this package's suite. The `.d.mts` sibling is what gives
+    // `maskComments` its type, so this package's typecheck verdict is a
+    // function of it too.
+    globs: [
+      'scripts/js-comment-mask.mjs',
+      'scripts/js-comment-mask.d.mts',
+    ],
+  },
   '@objectstack/plugin-auth': {
     // src/managed-extension-fields.test.ts walks every `*.object.ts`, and pins
     // core's api-key source alongside it.

pnpm-lock.yaml

@@ -156,6 +156,18 @@
       "$TURBO_ROOT$/packages/cloud-connection/src/cloud-connection-ui.ts"
       ]
     },
+    "@objectstack/mcp#test": {
+      "dependsOn": ["^build"],
+      "outputs": [],
+      "inputs": [
+        "$TURBO_DEFAULT$",
+        "!dist/**",
+        "!coverage/**",
+        "!.turbo/**",
+        "$TURBO_ROOT$/scripts/js-comment-mask.mjs",
+        "$TURBO_ROOT$/scripts/js-comment-mask.d.mts"
+      ]
+    },
     "@objectstack/plugin-auth#test": {
       "dependsOn": ["^build"],
       "outputs": [],