Generate config-relative Gate policy paths

[haasonsaas]

Summary

• generate policies/mcp_tool_allowlist.rego references relative to gate/connector.yaml
• update the generated Gate README to clarify the config stays portable across working directories
• lock the CLI scaffold test to the new connector path shape

Testing

• npm run check
• npm test
• git diff --check

Pairs with evalops/gate path-resolution fixes so generated Gate configs work cleanly from a Gate checkout.

[cursor]

PR Summary

Low Risk
Low risk: changes only the generated Gate scaffold output (policy path string) and tightens a CLI scaffold test, with no runtime request-handling logic impacted.

Overview
Generated Gate connector configs now reference the allowlist policy via a config-relative path (policies/mcp_tool_allowlist.rego) instead of gate/policies/..., making gate/connector.yaml portable across working directories.

The generated Gate README is updated to call out this portability, and the CLI generate scaffold test is updated to assert the new policy path shape.

^{Reviewed by Cursor Bugbot for commit cf511fa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit cf511fa. Configure here.}

[cursor]

Recording dir path not updated for config-relative resolution

Medium Severity

The policy path was changed from gate/policies/mcp_tool_allowlist.rego to policies/mcp_tool_allowlist.rego to account for gate-connector resolving paths relative to the config file (gate/connector.yaml). However, the recording.dir value ".data/gate-mcp-recordings" was not similarly adjusted. If gate-connector resolves all relative paths against the config location, this recording dir now resolves to gate/.data/gate-mcp-recordings instead of the project-root .data/gate-mcp-recordings. It likely needs to be "../.data/gate-mcp-recordings" to preserve the original behavior.

Additional Locations (1)

• src/server.ts#L854-L855

 

^{Reviewed by Cursor Bugbot for commit cf511fa. Configure here.}