From 6601e0cb7e57fe94cf0ae65bf0d04de25a3a7b49 Mon Sep 17 00:00:00 2001
From: N0zoM1z0 <1705004398@qq.com>
Date: Tue, 14 Jul 2026 21:35:10 +0000
Subject: [PATCH] test(application): verify packaged MCP replay

---
 scripts/verify-package-investigation.mjs | 14 +++++++++++++
 scripts/verify-package.mjs               | 26 ++++++++++++++++++++++--
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/scripts/verify-package-investigation.mjs b/scripts/verify-package-investigation.mjs
index 13c9e2c0e..442ae10fc 100644
--- a/scripts/verify-package-investigation.mjs
+++ b/scripts/verify-package-investigation.mjs
@@ -50,6 +50,20 @@ export async function verifyPackagedInvestigation(input) {
     persisted.runs?.[0]?.status !== "complete"
   )
     throw new Error("packaged persistent investigation CLI failed");
+  return {
+    arguments: {
+      approved: true,
+      workspace_path: workspacePath,
+      workspace_name: "package-versions",
+      expected_workspace_revision: persisted.revision,
+      replay_run_id: runId,
+      left_path: input.artifactArchive,
+      right_path: artifactArchiveV2,
+    },
+    evidenceId: investigated.evidence_id,
+    workspacePath,
+    revision: persisted.revision,
+  };
 }
 
 async function runJson(command, args, environment) {
diff --git a/scripts/verify-package.mjs b/scripts/verify-package.mjs
index 4603ea416..c168ef0cf 100644
--- a/scripts/verify-package.mjs
+++ b/scripts/verify-package.mjs
@@ -169,7 +169,7 @@ try {
   )
     throw new Error("packaged artifact inventory CLI failed");
   // prettier-ignore
-  await verifyPackagedInvestigation({ cli, workspace, evidenceRoot, artifactArchive, environment });
+  const investigationReplay = await verifyPackagedInvestigation({ cli, workspace, evidenceRoot, artifactArchive, environment });
   const overview = json(
     await run(cli, ["analyze", process.execPath, "--json"], environment),
   );
@@ -448,7 +448,10 @@ try {
   const transport = new StdioClientTransport({
     command: cli,
     args: ["mcp"],
-    env: environment,
+    env: {
+      ...environment,
+      REA_INVESTIGATION_INPUT_ROOTS_JSON: JSON.stringify([]),
+    },
     stderr: "pipe",
   });
   let mcpStderr = "";
@@ -466,6 +469,25 @@ try {
       throw new Error("packaged MCP tool inventory diverged from contracts");
     await prompts.verifyPromptCatalog(client, mcpOptions, prompts.names);
     await prompts.verifyPromptCompletion(client, mcpOptions, false);
+    const replay = await client.callTool(
+      {
+        name: "find_changed_behavior",
+        arguments: { investigation_run: investigationReplay.arguments },
+      },
+      mcpOptions,
+    );
+    const replayEvidence = json(prompts.mcpText(replay));
+    const replayWorkspace = json(
+      await readFile(investigationReplay.workspacePath, "utf8"),
+    );
+    if (
+      replay.isError === true ||
+      replayEvidence.evidence_id !== investigationReplay.evidenceId ||
+      replayWorkspace.revision !== investigationReplay.revision
+    )
+      throw new Error(
+        "packaged MCP did not replay with workspace-only authority",
+      );
     const result = await client.callTool(
       { name: "current_document", arguments: {} },
       mcpOptions,