test(integration): harden docker compose webhook e2e

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: tae2089

scripts/integration-test-helpers_test.sh

@@ -107,6 +107,21 @@ test_assert_mcp_ok_rejects_jsonrpc_error() {
     assert_fails "JSON-RPC error response" assert_mcp_ok "bad_tool" "$resp"
 }
 
+test_assert_mcp_ok_reports_jsonrpc_error_without_python_nameerror() {
+    local resp output
+    resp='{"error":{"code":-32603,"message":"boom"}}'
+    output=$(assert_mcp_ok "bad_tool" "$resp" 2>&1 || true)
+
+    [[ "$output" == *"JSON-RPC error:"* ]] || {
+        echo "expected JSON-RPC error output, got: $output" >&2
+        exit 1
+    }
+    [[ "$output" != *"NameError"* ]] || {
+        echo "did not expect Python NameError in output: $output" >&2
+        exit 1
+    }
+}
+
 test_assert_mcp_ok_rejects_result_is_error() {
     local resp
     resp='{"result":{"isError":true,"content":[{"type":"text","text":"boom"}]}}'
@@ -125,6 +140,14 @@ test_mcp_init_failure_requires_explicit_debug_override() {
     mcp_session_required ""
 }
 
+test_mcp_log_fallback_allowed_defaults_false() {
+    assert_fails "log fallback should be disabled by default" mcp_log_fallback_allowed
+    CCG_E2E_ALLOW_MCP_LOG_FALLBACK=0
+    assert_fails "log fallback should reject zero value" mcp_log_fallback_allowed
+    CCG_E2E_ALLOW_MCP_LOG_FALLBACK=1
+    mcp_log_fallback_allowed
+}
+
 test_extract_mcp_session_id_reads_header_case_insensitively() {
     local session
     session=$(extract_mcp_session_id $'HTTP/1.1 200 OK\r\nMcp-Session-Id: abc-123\r\n\r\n{}')
@@ -152,6 +175,40 @@ test_log_fallback_detects_webhook_failure() {
     webhook_logs_failed "$logs" "sample-go"
 }
 
+test_wait_for_webhook_sync_requires_mcp_nodes_when_fallback_disabled() {
+    graph_nodes_for_workspace() { return 1; }
+    compose() { printf '%s\n' 'time=... webhook sync completed workspace=sample-go nodes=4'; }
+    webhook_logs_completed() { return 0; }
+    webhook_logs_failed() { return 1; }
+    sleep() { SECONDS=$((SECONDS + 2)); }
+
+    assert_fails "log-only webhook sync should fail without explicit fallback" wait_for_webhook_sync "sample-go" 1 "sample-go"
+}
+
+test_wait_for_webhook_sync_allows_log_success_when_fallback_enabled() {
+    graph_nodes_for_workspace() { return 1; }
+    compose() { printf '%s\n' 'time=... webhook sync completed workspace=sample-go nodes=4'; }
+    webhook_logs_completed() { return 0; }
+    webhook_logs_failed() { return 1; }
+    sleep() { SECONDS=$((SECONDS + 2)); }
+    CCG_E2E_ALLOW_MCP_LOG_FALLBACK=1
+
+    wait_for_webhook_sync "sample-go" 1 "sample-go"
+}
+
+test_start_integration_stack_runs_migrate_before_starting_ccg() {
+    local -a compose_calls=() wait_calls=()
+    info() { :; }
+    compose() { compose_calls+=("$*"); }
+    wait_for_postgres() { wait_calls+=("postgres:$1:$2"); }
+    wait_for_health() { wait_calls+=("health:$1:$2:$3"); }
+
+    start_integration_stack
+
+    assert_equals $'up -d postgres gitea\nbuild ccg\nrun --rm --no-deps ccg migrate\nup -d ccg' "$(printf '%s\n' "${compose_calls[@]}")"
+    assert_equals $'postgres:30:PostgreSQL\nhealth:http://localhost:3000/api/v1/version:30:Gitea\nhealth:http://localhost:18080/ready:30:ccg' "$(printf '%s\n' "${wait_calls[@]}")"
+}
+
 test_helper_env_isolation_mutates_globals() {
     KEEP_CONTAINERS=1
     COMPOSE_CMD="false"
@@ -178,13 +235,18 @@ run_test test_compose_does_not_eval_command_string
 run_test test_mcp_text_extracts_content
 run_test test_assert_mcp_ok_rejects_malformed_json
 run_test test_assert_mcp_ok_rejects_jsonrpc_error
+run_test test_assert_mcp_ok_reports_jsonrpc_error_without_python_nameerror
 run_test test_assert_mcp_ok_rejects_result_is_error
 run_test test_assert_mcp_contains_rejects_missing_content_text
 run_test test_mcp_init_failure_requires_explicit_debug_override
+run_test test_mcp_log_fallback_allowed_defaults_false
 run_test test_extract_mcp_session_id_reads_header_case_insensitively
 run_test test_log_fallback_detects_webhook_completion
 run_test test_log_fallback_matches_without_pipefail_sigpipe_risk
 run_test test_log_fallback_detects_webhook_failure
+run_test test_wait_for_webhook_sync_requires_mcp_nodes_when_fallback_disabled
+run_test test_wait_for_webhook_sync_allows_log_success_when_fallback_enabled
+run_test test_start_integration_stack_runs_migrate_before_starting_ccg
 run_test test_helper_env_isolation_mutates_globals
 run_test test_helper_env_isolation_observes_defaults
 

scripts/integration-test.sh

@@ -90,6 +90,42 @@ wait_for_health() {
     fail "$label did not become healthy after $((max * 2))s"
 }
 
+wait_for_postgres() {
+    local max="$1" label="${2:-PostgreSQL}"
+    for i in $(seq 1 "$max"); do
+        if compose exec -T postgres pg_isready -U ccg -d ccg_integration >/dev/null 2>&1; then
+            info "$label is healthy"
+            return 0
+        fi
+        echo -n "."
+        sleep 2
+    done
+    fail "$label did not become healthy after $((max * 2))s"
+}
+
+start_integration_stack() {
+    info "Starting base services..."
+    compose up -d postgres gitea
+
+    info "Building ccg image..."
+    compose build ccg
+
+    info "Waiting for PostgreSQL..."
+    wait_for_postgres 30 "PostgreSQL"
+
+    info "Waiting for Gitea..."
+    wait_for_health "$GITEA_URL/api/v1/version" 30 "Gitea"
+
+    info "Running ccg migrations..."
+    compose run --rm --no-deps ccg migrate
+
+    info "Starting ccg..."
+    compose up -d ccg
+
+    info "Waiting for ccg..."
+    wait_for_health "$CCG_URL/ready" 30 "ccg"
+}
+
 api() {
     local method="$1" path="$2"; shift 2
     curl -fsS -X "$method" "${GITEA_URL}${path}" \
@@ -147,7 +183,7 @@ if not isinstance(r, dict):
     print("response is not a JSON object", file=sys.stderr)
     sys.exit(2)
 if r.get("error") is not None:
-    print(f"JSON-RPC error: {r.get('error')}", file=sys.stderr)
+    print("JSON-RPC error:", r.get("error"), file=sys.stderr)
     sys.exit(3)
 result = r.get("result")
 if not isinstance(result, dict):
@@ -225,6 +261,10 @@ mcp_session_required() {
     [ -n "$session" ] || [ "${CCG_E2E_ALLOW_MCP_LOG_FALLBACK:-0}" = "1" ]
 }
 
+mcp_log_fallback_allowed() {
+    [ "${CCG_E2E_ALLOW_MCP_LOG_FALLBACK:-0}" = "1" ]
+}
+
 extract_last_webhook_node_count() {
     local logs="$1"
     printf '%s' "$logs" | python3 -c '
@@ -267,7 +307,7 @@ wait_for_webhook_sync() {
         if webhook_logs_failed "$logs" "$workspace"; then
             fail "ccg build failed for ${label}. See ${ARTIFACT_DIR}/ccg.log after cleanup. Recent logs:\n$(printf '%s\n' "$logs" | tail -20)"
         fi
-        if webhook_logs_completed "$logs" "$workspace"; then
+        if mcp_log_fallback_allowed && webhook_logs_completed "$logs" "$workspace"; then
             info "${label} webhook sync observed via logs"
             return 0
         fi
@@ -279,14 +319,8 @@ wait_for_webhook_sync() {
 run_integration_test() {
 
 # ── Phase 1: Start containers ──
-info "Starting containers..."
-compose up -d --build
-
-info "Waiting for Gitea..."
-wait_for_health "$GITEA_URL/api/v1/version" 30 "Gitea"
-
-info "Waiting for ccg..."
-wait_for_health "$CCG_URL/ready" 30 "ccg"
+ info "Starting containers..."
+ start_integration_stack
 
 # ── Phase 2: Create Gitea admin user ──
 info "Creating Gitea admin user..."
@@ -398,7 +432,7 @@ else
         -H "Content-Type: application/json" \
         -H "Authorization: Bearer ${MCP_BEARER_TOKEN}" \
         -H "Mcp-Session-Id: ${MCP_SESSION}" \
-        -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_graph_stats","arguments":{}}}' 2>/dev/null) || STATS_RESP=""
+        -d "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"list_graph_stats\",\"arguments\":{\"workspace\":\"${REPO_NAME}\"}}}" 2>/dev/null) || STATS_RESP=""
 
     if [ -z "$STATS_RESP" ]; then
         fail "MCP tools/call returned empty response"
@@ -817,16 +851,17 @@ fi
 
 # ── Summary ──
 TOOLS_TESTED=0
+TOTAL_MCP_TOOLS=33
 if [ -n "$MCP_SESSION" ]; then
-    TOOLS_TESTED=29
+    TOOLS_TESTED=27
 fi
 
 echo ""
 echo -e "${GREEN}════════════════════════════════════════════════════════${NC}"
 if [ -n "$MCP_SESSION" ]; then
-    echo -e "${GREEN}  Integration test PASSED — ${TOOLS_TESTED}/29 MCP tools verified${NC}"
+    echo -e "${GREEN}  Integration test PASSED — ${TOOLS_TESTED}/${TOTAL_MCP_TOOLS} MCP tools verified${NC}"
 else
-    echo -e "${YELLOW}  Integration webhook smoke completed — 0/29 MCP tools verified (local debug override)${NC}"
+    echo -e "${YELLOW}  Integration webhook smoke completed — 0/${TOTAL_MCP_TOOLS} MCP tools verified (local debug override)${NC}"
 fi
 echo -e "${GREEN}════════════════════════════════════════════════════════${NC}"
 echo ""