Repair MCP diagnostics and gateway lifecycle

tests/test_gateway_worker_repair.py

@@ -0,0 +1,61 @@
+import importlib.util
+import pathlib
+
+
+def load_module():
+    script_path = pathlib.Path(__file__).resolve().parents[1] / "resources" / "scripts" / "napseer_mcp_server.py"
+    spec = importlib.util.spec_from_file_location("napseer_mcp_server_worker_repair_test", script_path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_gateway_worker_repair_separates_credentials_and_returns_no_tokens():
+    mod = load_module()
+    mod.AUTH = {
+        "account_mode": "operator_project",
+        "project_slug": "demo",
+        "project_name": "Demo",
+    }
+    mod.DEFAULT_PROJECT_ID = "project-1"
+    mod.BASE_URL = "https://api.example.test"
+    mod.GATEWAY_AUTH_PATH = pathlib.Path("/definitely/missing/gateway-auth.json")
+    mod.ensure_container_uuid = lambda: "container-1"
+    mod.normalize_gateway_command = lambda value=None: value or "bash -l"
+    written = []
+    mod.write_gateway_worker_auth = lambda payload: written.append(dict(payload))
+
+    def request(method, path, payload=None, token_required=True, **kwargs):
+        if path == "/v1/service-bootstrap-tokens":
+            return {"bootstrap_token": "bootstrap-secret"}
+        if path == "/v1/service-registrations":
+            assert token_required is False
+            return {
+                "registration": {"id": "registration-1"},
+                "activation_token": "activation-secret",
+            }
+        if path.endswith("/accept"):
+            return {"worker": {"id": "worker-1", "agent_id": "agent-1", "project_id": "project-1"}}
+        if path.endswith("/activate"):
+            assert token_required is False
+            return {
+                "worker": {"id": "worker-1", "agent_id": "agent-1", "project_id": "project-1"},
+                "token": {
+                    "access_token": "worker-access-secret",
+                    "refresh_token": "worker-refresh-secret",
+                    "expires_at": "later",
+                    "refresh_expires_at": "much-later",
+                },
+            }
+        raise AssertionError(path)
+
+    mod.request_json = request
+    result = mod.gateway_worker_repair({"display_name": "demo-local-gateway"})
+
+    assert written[0]["account_mode"] == "gateway_worker"
+    assert written[0]["token"] == "worker-access-secret"
+    assert written[0]["refresh_token"] == "worker-refresh-secret"
+    assert "token" not in result
+    assert "refresh_token" not in result
+    assert result["status"] == "repaired"