fix: align cold PostHog policy previews

[mohanagy]

Closes #166

Cold previews for a single named official PostHog upstream now evaluate the canonical exec policy name, matching execution after discovery.

The regression deliberately avoids listTools() and proves both toolRiskOverrides.exec and deny: ["exec"] produce the same blocked decision in preview and execution.

Validation:

• npx vitest run tests/mcp-wrapper.test.ts -t "uses the canonical exec policy name for cold named PostHog previews" --reporter=dot
• npx vitest run tests/mcp-wrapper.test.ts --reporter=dot
• npm run lint
• npm run typecheck
• npm test (85 passed, 1 skipped; 1,072 passed, 23 skipped)

Summary by CodeRabbit

• Bug Fixes

  • Improved policy naming for PostHog adapter tools during route previews.
  • Ensured blocked PostHog exec calls consistently return a POLICY_BLOCKED error.

• Tests

  • Added coverage for read-only policy enforcement during previews and cold calls.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2c2d4cfa-b947-49d6-b923-32ffc02dc863

📥 Commits

Reviewing files that changed from the base of the PR and between 8e779a8 and a5bda43.

📒 Files selected for processing (2)

• src/mcp/server/miftah-server.ts
• tests/mcp-wrapper.test.ts

---

📝 Walkthrough

Walkthrough

Cold named-PostHog route previews now resolve posthog__exec to the canonical exec policy name when no source tool is available. A regression test verifies that preview and subsequent execution both return POLICY_BLOCKED.

Changes

PostHog policy parity

Layer / File(s)	Summary
Canonical policy resolution and regression coverage src/mcp/server/miftah-server.ts, tests/mcp-wrapper.test.ts	Route previews prefer sourceTool.originalName and map the exposed PostHog exec tool to exec; integration coverage verifies matching preview and cold-call blocking.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mohanagy/miftah#41: Defines policy evaluation behavior for explicitly named policies.
• mohanagy/miftah#47: Introduces and propagates RegisteredTool.originalName metadata.
• mohanagy/miftah#109: Updates route-preview enforcement and PostHog exec classification.

Poem

A bunny saw exec hop back in line,
With preview and runtime agreeing just fine.
posthog__exec shed its namespaced disguise,
While blocked policies closed both of their eyes.
“No mismatch today!” the rabbit cheered bright.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers summary and validation, but it omits the required Security impact section from the template.	Add a Security impact section and ensure the template's required validation and checklist items are addressed.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the main change to cold PostHog policy preview naming.
Linked Issues check	✅ Passed	The code and test changes satisfy #166 by using the canonical exec name in cold preview and proving preview/execution match for toolRiskOverrides.exec.
Out of Scope Changes check	✅ Passed	The edits stay focused on PostHog preview policy naming and its regression test, with no unrelated changes apparent.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-166-canonical-posthog-preview

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.