Fixes and integration tests for MCP-provided prompts and VSIX bundle by data-douser · Pull Request #71 · advanced-security/codeql-development-mcp-server

data-douser · 2026-02-23T02:09:43Z

Summary of Changes

This pull request (PR):

fixes a 🐛 bug 🐞 in the packaged VSIX bundle where some of the NodeJS package dependencies of the MCP server had been excluded by config;
introduces comprehensive improvements to the testing infrastructure and documentation for the CodeQL Development MCP Server, with a particular focus on adding and integrating Extension Host integration tests for the VS Code extension. It also includes several related updates to build scripts, documentation, and configuration to ensure a robust and maintainable CI/CD workflow.

Outline of Changes

Testing infrastructure and documentation:

Added a fourth layer of testing—Extension Host integration tests—using @vscode/test-cli and Mocha, with configuration in the new .vscode-test.mjs file, and updated documentation in docs/testing.md to describe all four layers and their commands. [1] [2] [3] [4]
Updated .gitignore and .vscodeignore to exclude @vscode/test-cli runtime data and configuration files from the extension package. [1] [2]

Build and CI workflow improvements:

Renamed and expanded the GitHub Actions workflow to build-and-test-extension.yml, adding steps to run extension integration tests in CI, and updated summary output to reflect new test layers. [1] [2]

Extension package and scripts:

Updated package.json scripts to support separate packaging of the VSIX, cleaning of test databases, and running the new integration tests; updated dependencies to include @vscode/test-cli and related tools. [1] [2] [3] [4]
Improved the extension's package description and configuration schema formatting. [1] [2] [3]

Documentation and usability fixes:

Updated documentation and CLI instructions to use the correct packaging command (npm run package:vsix), and clarified test commands for each layer. [1] [2]

Extension robustness:

Wrapped MCP server definition provider registration in a try-catch to prevent activation failures on older VS Code versions.

Build tooling:

Adjusted server/esbuild.config.js to embed .prompt.md files as string literals and improved compatibility for bundled CJS dependencies.

Prompt documentation:

Fixed a documentation reference in document-codeql-query.prompt.md to use the correct tool name.

- Inline .prompt.md files at build time via esbuild text loader so prompts resolve correctly in npm-installed and VSIX-installed layouts (fixes ENOENT) - Rewrite prompt-loader.ts to use static imports instead of filesystem reads - Add Vitest plugin to transform .prompt.md imports during test runs - Add TypeScript declarations for .prompt.md module imports - Wire up @vscode/test-cli with three profiles (noWorkspace, singleFolder, multiRoot) for Extension Host integration tests - Add try/catch around registerMcpServerDefinitionProvider for resilience on older VS Code versions - Rename build-extension.yml → build-and-test-extension.yml and add integration test step with xvfb-run - Update docs/testing.md to document all four test layers - Add .vscode-test/ to extensions/vscode/.gitignore

This commit: - updates MCP-hosted prompts to remove references to the deprecated 'profile_codeql_query' tool in favor of the new 'profile_codeql_query_from_logs' tool; - fixes the "npm run package:vsix" script to ensure that the server dist is built before packaging it in VSIX.

package-lock.json

github-license-compliance · 2026-02-23T02:14:35Z

package-lock.json

@data-douser has requested to close this alert

package-lock.json

github-license-compliance · 2026-02-23T02:13:19Z

extensions/vscode/package.json

@data-douser has requested to close this alert

github-actions · 2026-02-23T02:09:59Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.
⚠️ 5 packages with OpenSSF Scorecard issues.

View full job summary

Copilot

Pull request overview

This pull request addresses a critical packaging bug in the VSIX bundle and comprehensively enhances the testing infrastructure for the CodeQL Development MCP Server. The key fix ensures that all NodeJS package dependencies of the MCP server are properly bundled into the VSIX extension by removing an overly restrictive external configuration from esbuild. The PR also introduces Extension Host integration tests as a fourth testing layer, updates prompt documentation to use consistent tool reference formatting, and refactors the prompt loading mechanism to use static imports with embedded file contents.

Changes:

Fixed VSIX packaging bug by removing external dependencies from server esbuild config, ensuring dependencies like express, cors, and zod are bundled rather than excluded
Added Extension Host integration tests (Layer 2b) using @vscode/test-cli and Mocha, providing comprehensive end-to-end validation of extension behavior inside VS Code
Refactored prompt loading from runtime filesystem reads to build-time static imports, making prompts available in all deployment scenarios (monorepo, npm, VSIX)
Updated all prompt files to use #tool_name format for tool references instead of backticks, improving consistency

Reviewed changes

Copilot reviewed 21 out of 25 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
server/esbuild.config.js	Removed `external` dependencies array to fix VSIX bundling bug; added `.md` loader and createRequire shim
server/vitest.config.ts	Added plugin to transform `.prompt.md` imports into string literals for test compatibility
server/src/types/markdown.d.ts	New TypeScript declaration for `.prompt.md` module imports
server/src/prompts/prompt-loader.ts	Refactored from runtime fs.readFileSync to static imports with embedded template map
server/test/src/prompts/prompt-loader.test.ts	Enhanced test to validate all 9 prompt files are properly embedded
server/src/prompts/*.prompt.md	Updated tool references from backticks to `#` format for consistency
extensions/vscode/src/extension.ts	Wrapped MCP server registration in try-catch for backward compatibility with older VS Code
extensions/vscode/package.json	Updated description, added test dependencies, improved scripts
extensions/vscode/.vscode-test.mjs	New configuration defining three test profiles (noWorkspace, singleFolder, multiRoot)
extensions/vscode/.gitignore	Added `.vscode-test/` directory exclusion
extensions/vscode/.vscodeignore	Added `.vscode-test.mjs` exclusion from VSIX
.github/workflows/build-and-test-extension.yml	Renamed and expanded workflow to include Extension Host integration tests
docs/testing.md	Updated to document all four testing layers including new Extension Host tests
docs/getting-started.md	Fixed command from `package:vscode` to `package:vsix`
docs/vscode/extension.md	Fixed command from `package:vscode` to `package:vsix`
package.json	Added `clean:test-dbs` script and updated `package:vsix` script
package-lock.json	Added `@vscode/test-cli`, `@vscode/test-electron`, and transitive dependencies

Copilot

Pull request overview

Copilot reviewed 21 out of 25 changed files in this pull request and generated no new comments.

…est parent-dir assertions, query.log fixture (#72)

…scode-codeql storage subdir (#73)

Copilot

Pull request overview

Copilot reviewed 22 out of 28 changed files in this pull request and generated no new comments.

data-douser added 4 commits February 22, 2026 17:32

Add clean:test-dbs npm script

58b98ea

Use hashtag tool refs in MCP server prompts

b058878

data-douser self-assigned this Feb 23, 2026

Copilot AI review requested due to automatic review settings February 23, 2026 02:09

data-douser added bug Something isn't working enhancement New feature or request javascript Pull requests that update javascript code server labels Feb 23, 2026

github-license-compliance bot found potential problems Feb 23, 2026

View reviewed changes

Copilot started reviewing on behalf of data-douser February 23, 2026 02:10 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

data-douser requested a review from Copilot February 23, 2026 02:19

Copilot started reviewing on behalf of data-douser February 23, 2026 02:20 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

Copilot AI added 2 commits February 22, 2026 19:59

Fix: Build and Test Extension workflow — CodeQL CLI missing, bridge t…

fbd9ad7

…est parent-dir assertions, query.log fixture (#72)

Fix bridge integration tests: assert globalStorage root exists, not v…

b93b7fe

…scode-codeql storage subdir (#73)

Copilot AI review requested due to automatic review settings February 23, 2026 03:46

Copilot started reviewing on behalf of data-douser February 23, 2026 03:46 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

data-douser marked this pull request as ready for review February 23, 2026 10:43

data-douser requested review from a team and enyil as code owners February 23, 2026 10:43

data-douser merged commit cad63bd into main Feb 23, 2026
19 checks passed

data-douser deleted the dd/vsix-fixes/1 branch February 23, 2026 10:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes and integration tests for MCP-provided prompts and VSIX bundle#71

Fixes and integration tests for MCP-provided prompts and VSIX bundle#71
data-douser merged 6 commits intomainfrom
dd/vsix-fixes/1

data-douser commented Feb 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-license-compliance bot Feb 23, 2026

Uh oh!

Uh oh!

Uh oh!

github-license-compliance bot Feb 23, 2026

Uh oh!

github-actions bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

data-douser commented Feb 23, 2026

Summary of Changes

Outline of Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-license-compliance bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-license-compliance bot Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Feb 23, 2026 •

edited

Loading