Files
roboco/tests/unit/runtime/test_mcp_playwright_gating.py
T

51 lines
1.8 KiB
Python
Raw Normal View History

"""The `playwright` MCP server (CEO round-3 note on the Playwright QA-image
work) is role-gated to fe-qa/ux-qa only — it must never appear for be-qa
(same role, different team) or ux-dev (same image as ux-qa, different role),
since the binary + wrapper entrypoint are only baked into agent-qa-fe /
agent-ux via docker/agent-qa-fe.Dockerfile / docker/agent-ux.Dockerfile.
"""
from __future__ import annotations
import json
from pathlib import Path
from roboco.runtime.orchestrator import AgentOrchestrator
_ENTRYPOINT = "/app/scripts/playwright-mcp-entrypoint.sh"
async def _servers_for(agent_slug: str) -> dict[str, dict]:
orch = AgentOrchestrator.__new__(AgentOrchestrator)
config_path = await orch._generate_mcp_config(agent_slug)
config = json.loads(Path(config_path).read_text())
servers: dict[str, dict] = config["mcpServers"]
return servers
async def test_fe_qa_gets_playwright_mcp() -> None:
servers = await _servers_for("fe-qa")
assert "playwright" in servers
assert servers["playwright"]["command"] == _ENTRYPOINT
async def test_ux_qa_gets_playwright_mcp() -> None:
servers = await _servers_for("ux-qa")
assert "playwright" in servers
assert servers["playwright"]["command"] == _ENTRYPOINT
async def test_be_qa_does_not_get_playwright_mcp() -> None:
"""Same `qa` role as fe-qa/ux-qa, but backend team — no chromium baked
into be-qa's image, so it must not get the MCP registration."""
servers = await _servers_for("be-qa")
assert "playwright" not in servers
async def test_ux_dev_does_not_get_playwright_mcp() -> None:
"""Shares agent-ux's image with ux-qa (same Dockerfile, same baked
browser) but is a `developer`, not `qa` — the gating is role-based, not
image-based, so ux-dev must not see the tool."""
servers = await _servers_for("ux-dev-1")
assert "playwright" not in servers