@bridge_gpt/mcp-server 0.2.51 → 0.2.52

package/build/drive-epic.js

@@ -51,8 +51,13 @@
  * ratcheted down, and a tool would be useless in a bare-chat session anyway,
  * where the model has no tool call to make.
  */
+import { readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { resolveConductorBridgeApiAccess, fetchConductorReadiness, safeDiagnosticMessage, } from "./conductor/bridge-api-client.js";
 import { runSetupEpicCli } from "./setup-epic.js";
+import { formatPlaneDiagnostic, runDefaultPlanePreflight, runPlaneCli, } from "./plane/cli.js";
+import { PLANE_SERVER_PORT_ENV_VAR } from "./plane/types.js";
+import { validateBranchName } from "./base-ref.js";
 // BAPI-806: mcp-identity.ts is the SOLE source of the package-name literal, so
 // the printed invocation interpolates it rather than repeating it.
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
@@ -106,6 +111,37 @@ export const V2_READINESS_REQUIREMENTS = [
         satisfied: (r) => r.executor.liveness_readable && r.executor.ready === true,
     },
 ];
+/**
+ * The readiness facts a `plane up` can actually repair (BAPI-1054).
+ *
+ * Both are liveness of a process this machine starts. The other three —
+ * `supervisor_setup`, `supervisor_config`, `github_credentials` — are stored
+ * server-side state or credentials, and no amount of starting processes creates
+ * them. Naming the repairable set here, once, is what keeps the composition
+ * from ever attempting a bring-up that could not have helped.
+ */
+export const V2_RUNTIME_READINESS_IDS = ["reconciler_live", "executor_live"];
+/**
+ * Classify the SERVER's readiness report into the composition's three cases.
+ *
+ * Pure, and it re-derives no fact: it filters {@link V2_READINESS_REQUIREMENTS}
+ * with the same predicates {@link selectConductor} uses, so the router and the
+ * composition can never disagree about whether v2 can run.
+ *
+ * `operator_blocked` names the FIRST unmet non-runtime requirement in the stable
+ * declaration order. One deterministic reason, not a list: an operator handed
+ * three competing actions has to work out which to do first, and the order here
+ * already encodes that (setup, then config, then credentials).
+ */
+export function classifyV2Readiness(readiness) {
+    const unmet = V2_READINESS_REQUIREMENTS.filter((req) => !req.satisfied(readiness));
+    if (unmet.length === 0)
+        return { kind: "green" };
+    const blocker = unmet.find((req) => !V2_RUNTIME_READINESS_IDS.includes(req.id));
+    if (blocker)
+        return { kind: "operator_blocked", id: blocker.id, describe: blocker.describe };
+    return { kind: "runtime_only", unmetIds: unmet.map((req) => req.id) };
+}
 export function getDriveEpicUsage() {
     return [
         "Usage: mcp-server drive-epic [options] <EPIC>",
@@ -117,11 +153,44 @@ export function getDriveEpicUsage() {
         "Arguments:",
         "  <EPIC>                 Jira epic key, matches [A-Z]+-[0-9]+ (e.g. BAPI-885)",
         "",
+        "Branch strategy (v2): a plan with two or more nodes defaults to a dedicated",
+        "epic/<KEY> branch — child PRs target it, one draft integration PR targets the",
+        "repository base branch. Both flags below only override that default; the",
+        "strategy itself is decided by the bootstrap this command delegates to, never",
+        "here.",
+        "",
+        "One command (BAPI-1054): with --plan-file, drive-epic starts the conductor",
+        "runtime for you when readiness is missing ONLY the reconciler/executor facts,",
+        "then creates and approves the run — one invocation, no manual `plane up` first.",
+        "A report missing supervisor setup, supervisor configuration, or GitHub App",
+        "credentials is NOT started: those are operator-owned, and drive-epic exits with",
+        "that one named reason instead.",
+        "",
+        "Preconditions are validated, never repaired: the current directory must be a Git",
+        "work tree, and the local server port must be free. No worktree is created for",
+        "you and no replacement port is chosen for you — each failure names the fix (for",
+        `the port, set ${PLANE_SERVER_PORT_ENV_VAR} to a free one). Fix it and rerun.`,
+        "",
+        "Manual fallback (still supported): run `plane up` yourself, then rerun this",
+        "command with the same --plan-file against the now-live plane.",
+        "",
         "Options:",
         "  --plan-file <path>     Plan DAG sidecar. When supplied and the v2 path is",
         "                         selected, drive-epic runs that bootstrap directly",
         "                         instead of printing the command to run.",
         "  --repo <name>          Repo name (default: BAPI_REPO_NAME or .bridge/config)",
+        "  --feature-branch <name>  Override the derived epic/<KEY> name. Forwarded",
+        "                         verbatim, never interpreted here.",
+        "  --into-base            OPT OUT of the epic-branch default: children target the",
+        "                         repository base branch (the pre-BAPI-1009 behavior).",
+        "                         Contradictory with --feature-branch; passing both is a",
+        "                         parse error.",
+        "",
+        "Policy (forwarded verbatim; drive-epic interprets none of it):",
+        "  --policy-file <path>   JSON file holding the COMPLETE run policy.",
+        "  --review-policy <src>  PER-RUN review policy source.",
+        "  --replace-policy       Authorize replacing a LIVE run's stored policy.",
+        "",
         "  -h, --help             Show this help",
     ].join("\n");
 }
@@ -136,28 +205,88 @@ export function parseDriveEpicArgs(argv) {
     const positionals = [];
     let planFile;
     let repo;
+    let featureBranch;
+    // Tracked separately from the value so a blank `--feature-branch=` still
+    // registers as a stated branch-strategy intent for the contradiction guard.
+    let featureBranchSupplied = false;
+    let intoBase = false;
+    // BAPI-1054 policy pass-throughs. Captured, never interpreted: `--review-policy`
+    // is NOT validated against the vocabulary here, because setup-epic already
+    // refuses an unknown value before any I/O and a second copy of that list is
+    // exactly the drift the single-entry-point rule exists to prevent.
+    let policyFile;
+    let reviewPolicy;
+    let replacePolicy = false;
+    // BAPI-1009: validated with the SHARED validator setup-epic uses, so a name
+    // drive-epic accepts is exactly a name setup-epic accepts. A second rule here
+    // would let a name pass the router and fail the delegate.
+    const takeFeatureBranch = (raw) => {
+        featureBranchSupplied = true;
+        const trimmed = raw.trim();
+        if (trimmed === "")
+            return null;
+        if (validateBranchName(trimmed) !== null)
+            return null;
+        featureBranch = trimmed;
+        return trimmed;
+    };
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
-        if (arg === "--plan-file" || arg === "--repo") {
+        if (arg === "--into-base") {
+            intoBase = true;
+            continue;
+        }
+        if (arg === "--replace-policy") {
+            replacePolicy = true;
+            continue;
+        }
+        if (arg === "--plan-file" ||
+            arg === "--repo" ||
+            arg === "--feature-branch" ||
+            arg === "--policy-file" ||
+            arg === "--review-policy") {
             const value = argv[i + 1];
             if (value === undefined || value.startsWith("-")) {
                 return { status: "error", message: `${arg} requires a value.` };
             }
             if (arg === "--plan-file")
                 planFile = value;
-            else
+            else if (arg === "--repo")
                 repo = value;
+            else if (arg === "--policy-file")
+                policyFile = value;
+            else if (arg === "--review-policy")
+                reviewPolicy = value;
+            else if (takeFeatureBranch(value) === null) {
+                return {
+                    status: "error",
+                    message: `--feature-branch requires a valid, nonblank branch name, got '${value}'.`,
+                };
+            }
             i++;
             continue;
         }
-        const eq = arg.match(/^(--plan-file|--repo)=(.*)$/);
+        const eq = arg.match(/^(--plan-file|--repo|--feature-branch|--policy-file|--review-policy)=(.*)$/);
         if (eq) {
             const value = eq[2];
+            if (eq[1] === "--feature-branch") {
+                if (takeFeatureBranch(value) === null) {
+                    return {
+                        status: "error",
+                        message: `--feature-branch requires a valid, nonblank branch name, got '${value}'.`,
+                    };
+                }
+                continue;
+            }
             if (value.trim().length === 0) {
                 return { status: "error", message: `${eq[1]} requires a value.` };
             }
             if (eq[1] === "--plan-file")
                 planFile = value;
+            else if (eq[1] === "--policy-file")
+                policyFile = value;
+            else if (eq[1] === "--review-policy")
+                reviewPolicy = value;
             else
                 repo = value;
             continue;
@@ -167,6 +296,18 @@ export function parseDriveEpicArgs(argv) {
         }
         positionals.push(arg);
     }
+    // BAPI-1009: refused HERE — before access resolution, before the readiness
+    // request, and before any delegation — with the same corrective wording
+    // setup-epic uses, so the two entry points explain one mistake one way.
+    if (featureBranchSupplied && intoBase) {
+        return {
+            status: "error",
+            message: "--feature-branch and --into-base select contradictory branch strategies: " +
+                "--feature-branch runs the epic on a named epic branch, --into-base runs " +
+                "children directly into the repository base branch. Only one branch strategy " +
+                "may be selected — remove whichever one you did not mean.",
+        };
+    }
     if (positionals.length === 0) {
         return { status: "error", message: "Missing required epic key." };
     }
@@ -183,7 +324,16 @@ export function parseDriveEpicArgs(argv) {
     if (!EPIC_KEY_PATTERN.test(epicKey)) {
         return { status: "error", message: `Malformed epic key '${epicKey}'. Expected e.g. BAPI-885.` };
     }
-    const options = { epicKey, ...(planFile ? { planFile } : {}), ...(repo ? { repo } : {}) };
+    const options = {
+        epicKey,
+        ...(planFile ? { planFile } : {}),
+        ...(repo ? { repo } : {}),
+        ...(featureBranch ? { featureBranch } : {}),
+        ...(intoBase ? { intoBase: true } : {}),
+        ...(policyFile ? { policyFile } : {}),
+        ...(reviewPolicy ? { reviewPolicy } : {}),
+        ...(replacePolicy ? { replacePolicy: true } : {}),
+    };
     return { status: "ok", options };
 }
 /**
@@ -209,6 +359,32 @@ export function selectConductor(readiness) {
         reason: `the engine path still needs ${missing.map((m) => m.describe).join("; ")}`,
     };
 }
+/**
+ * Build the exact `setup-epic` argument array (BAPI-1054).
+ *
+ * Extracted so every delegation path — green, and composed-after-bring-up —
+ * forwards byte-identical argv. Two inline copies of this array is how one path
+ * silently stops forwarding a flag the other does.
+ *
+ * Every optional flag is APPENDED only when supplied, so the no-flag array stays
+ * byte-identical to the pre-BAPI-1009 one and setup-epic applies its own
+ * node-count-aware default. An exact argument array: no shell, no interpolation,
+ * no quoting to get wrong.
+ */
+export function buildSetupEpicArgv(options) {
+    const { epicKey, planFile, repo, featureBranch, intoBase, policyFile, reviewPolicy, replacePolicy } = options;
+    return [
+        "--epic-key",
+        epicKey,
+        ...(planFile ? ["--plan-file", planFile] : []),
+        ...(repo ? ["--repo", repo] : []),
+        ...(featureBranch ? ["--feature-branch", featureBranch] : []),
+        ...(intoBase ? ["--into-base"] : []),
+        ...(policyFile ? ["--policy-file", policyFile] : []),
+        ...(reviewPolicy ? ["--review-policy", reviewPolicy] : []),
+        ...(replacePolicy ? ["--replace-policy"] : []),
+    ];
+}
 /**
  * Render the selected path and only the selected path.
  *
@@ -281,6 +457,138 @@ export function assertSingleConductorInvocation(text) {
             "Exactly one path may ever be presented.");
     }
 }
+/**
+ * Conservative bound on any single advisory field. Exists so malformed or
+ * adversarial artifact content cannot turn into multiline or oversized
+ * terminal output — the advisory is meant to be a few compact scan lines.
+ */
+const MAX_CONTAINMENT_ADVISORY_FIELD_LENGTH = 300;
+function isCompactSingleLineString(value) {
+    return (typeof value === "string" &&
+        value.trim().length > 0 &&
+        value.length <= MAX_CONTAINMENT_ADVISORY_FIELD_LENGTH &&
+        !value.includes("\n") &&
+        !value.includes("\r"));
+}
+function isCompactHazardEvidenceArray(value) {
+    return Array.isArray(value) && value.length > 0 && value.every(isCompactSingleLineString);
+}
+/**
+ * Parse unknown JSON into a compact internal containment advisory.
+ *
+ * Requires `status: "assessed"`, a positive integer `containmentChildren`,
+ * and every `affectedChildren` entry with `requiresContainmentReview: true`
+ * to carry valid compact `id`/`title`/`matchedHazards` fields. The number of
+ * such flagged records must agree with `containmentChildren` exactly —
+ * disagreement, an invalid evidence array, or an incomplete flagged-child
+ * record is treated as malformed and yields no advisory (`null`), never a
+ * partial or best-effort one. Never reimplements the Python hazard allowlist
+ * — this function only validates shape, not hazard content.
+ */
+export function parseContainmentEligibilityArtifact(raw) {
+    if (raw === null || typeof raw !== "object")
+        return null;
+    const artifact = raw;
+    if (artifact.status !== "assessed")
+        return null;
+    const containmentChildren = artifact.containmentChildren;
+    if (!Number.isInteger(containmentChildren) || containmentChildren <= 0) {
+        return null;
+    }
+    if (!Array.isArray(artifact.affectedChildren))
+        return null;
+    const flagged = [];
+    for (const entry of artifact.affectedChildren) {
+        if (entry === null || typeof entry !== "object")
+            return null;
+        const child = entry;
+        if (child.requiresContainmentReview !== true)
+            continue;
+        if (!isCompactSingleLineString(child.id) || !isCompactSingleLineString(child.title))
+            return null;
+        if (!isCompactHazardEvidenceArray(child.matchedHazards))
+            return null;
+        flagged.push({ id: child.id, title: child.title, matchedHazards: [...child.matchedHazards] });
+    }
+    if (flagged.length !== containmentChildren)
+        return null;
+    if (flagged.length === 0)
+        return null;
+    return { containmentChildren: containmentChildren, flagged };
+}
+/**
+ * Locate and read the containment-eligibility sidecar for a supplied plan
+ * file, then parse it. `conductor-eligibility.json` is always a sibling of
+ * the plan file — `dirname(planFile)/conductor-eligibility.json` — the same
+ * directory `assess-conductor-eligibility` writes it to. Fails open on every
+ * boundary: a resolution failure, a rejected read (missing file, permission
+ * error), invalid JSON, or a malformed/inconsistent artifact all resolve to
+ * `null`, never a thrown error.
+ */
+export async function readContainmentEligibilityAdvisory(planFile, readEligibilityArtifact) {
+    try {
+        const artifactPath = join(dirname(planFile), "conductor-eligibility.json");
+        const raw = await readEligibilityArtifact(artifactPath);
+        const parsed = JSON.parse(raw);
+        return parseContainmentEligibilityArtifact(parsed);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Render a validated advisory as compact, factual, advisory-only text.
+ *
+ * Contains no remediation instructions and no conductor-invocation wording —
+ * guarded against both the module's own static heading text and any
+ * artifact-supplied title/evidence value that would introduce a
+ * {@link CONDUCTOR_INVOCATION_TOKENS} value. When safe rendering cannot be
+ * proved, this suppresses the advisory (`null`) rather than throwing or
+ * emitting unsafe text; the caller must never let this fail the CLI.
+ */
+export function renderContainmentEligibilityAdvisory(advisory) {
+    const lines = [
+        "Review containment hazard before dispatch:",
+        ...advisory.flagged.map((child) => `  - ${child.id}: ${child.title} (${child.matchedHazards.join(", ")})`),
+    ];
+    const text = lines.join("\n");
+    const named = CONDUCTOR_INVOCATION_TOKENS.filter((token) => text.includes(token));
+    if (named.length > 0)
+        return null;
+    return text;
+}
+/**
+ * The blocking checks the COMPOSITION owns, in refusal order (BAPI-1054).
+ *
+ * `plane up`'s own preflight deliberately aggregates every blocking diagnostic —
+ * build freshness, credentials, Alembic head, an existing plane — and reports
+ * them together, because five separate one-minute retries is the failure mode
+ * that convention exists to prevent. That aggregate stays exactly as it is.
+ *
+ * These two are different: they are the ticket's named composition
+ * PRECONDITIONS, checked before anything is started, and each carries a single
+ * concrete remediation the operator performs by hand. "Exactly one named reason"
+ * is therefore a property of this narrow set, never of `plane up`'s refusal.
+ */
+export const DRIVE_EPIC_PRECONDITION_CHECKS = [
+    "worktree-presence",
+    "server-port",
+];
+/**
+ * The first composition-owned blocking diagnostic, or `null`.
+ *
+ * Order comes from {@link DRIVE_EPIC_PRECONDITION_CHECKS}, not from the order
+ * preflight happened to append them, so the reason an operator sees for a given
+ * pair of failures is stable.
+ */
+export function firstPreconditionRefusal(preflight) {
+    for (const check of DRIVE_EPIC_PRECONDITION_CHECKS) {
+        const found = preflight.diagnostics.find((d) => d.check === check && d.severity === "blocking");
+        if (found)
+            return found;
+    }
+    return null;
+}
 export function createDefaultDriveEpicDeps() {
     return {
         resolveAccess: async (repo) => {
@@ -289,6 +597,10 @@ export function createDefaultDriveEpicDeps() {
         },
         readReadiness: (access) => fetchConductorReadiness(access, globalThis.fetch),
         runSetupEpic: (argv) => runSetupEpicCli(argv),
+        readEligibilityArtifact: (path) => readFile(path, "utf8"),
+        runPlanePreflight: (repoRoot) => runDefaultPlanePreflight(repoRoot),
+        runPlane: (argv, overrides) => runPlaneCli(argv, overrides ?? {}),
+        cwd: () => process.cwd(),
         // stdout is safe here: `drive-epic` is dispatched BEFORE MCP server
         // construction, so nothing has claimed stdout for the protocol transport.
         log: (message) => console.log(message),
@@ -314,7 +626,7 @@ export async function runDriveEpicCli(argv, overrides = {}) {
         deps.errorLog(getDriveEpicUsage());
         return 1;
     }
-    const { epicKey, planFile, repo } = parsed.options;
+    const { epicKey, planFile, repo, featureBranch, intoBase } = parsed.options;
     try {
         // --- Resolve access. A missing credential is UNKNOWN, not not-ready. -----
         const accessResult = await deps.resolveAccess(repo);
@@ -331,15 +643,115 @@ export async function runDriveEpicCli(argv, overrides = {}) {
         }
         // --- Route. Exactly one path from here on. -------------------------------
         const selection = selectConductor(readiness);
+        // BAPI-1022: surface any containment-hazard advisory before dispatch or
+        // handoff. Read only when a plan file was supplied (the sidecar has no
+        // other resolvable location). Fail-open: any failure here — missing
+        // artifact, bad JSON, malformed/inconsistent shape, an unsafe rendered
+        // value — silently yields no advisory and never affects routing, the
+        // delegated argv, or the exit code.
+        if (planFile) {
+            try {
+                const advisory = await readContainmentEligibilityAdvisory(planFile, deps.readEligibilityArtifact);
+                if (advisory) {
+                    const rendered = renderContainmentEligibilityAdvisory(advisory);
+                    if (rendered)
+                        deps.log(rendered);
+                }
+            }
+            catch {
+                // Fail open — a containment advisory is never allowed to block dispatch.
+            }
+        }
         // Decide delegation BEFORE rendering. The v2 branch's text is specifically
         // about a missing plan file, and rendering it on the path that has one
         // would produce a message contradicting what is about to happen.
-        if (selection.conductor === "v2" && planFile) {
-            // Delegate. `setup-epic` owns branch, run-row, plan, and approval
-            // behavior; drive-epic reimplements none of it and prints nothing of its
-            // own alongside it, so its output remains the only conductor output.
-            const setupArgv = ["--epic-key", epicKey, "--plan-file", planFile, ...(repo ? ["--repo", repo] : [])];
-            return await deps.runSetupEpic(setupArgv);
+        //
+        // BAPI-1054: a supplied plan file is what makes this a BRING-UP decision
+        // rather than a routing one. Everything below runs before `selectConductor`'s
+        // pilot fallback can be rendered, because a report that is non-green only on
+        // the runtime facts is not a "use the other conductor" situation — it is a
+        // plane that has not been started yet.
+        if (planFile) {
+            const classification = classifyV2Readiness(readiness);
+            const setupArgv = buildSetupEpicArgv(parsed.options);
+            // Green: delegate exactly as before. No plane invocation, no preflight,
+            // and byte-identical argv for the no-flag case.
+            if (classification.kind === "green") {
+                return await deps.runSetupEpic(setupArgv);
+            }
+            // Operator-blocked: ONE named reason, and nothing is started. `plane up`
+            // cannot create stored supervisor state or resolve GitHub App credentials,
+            // so bringing it up would leave a running plane behind and change nothing.
+            if (classification.kind === "operator_blocked") {
+                const refusal = [
+                    `${epicKey}: the engine path still needs ${classification.describe} ` +
+                        `(${classification.id}).`,
+                    "",
+                    "This is not something starting the runtime can fix, so nothing was started.",
+                    "Resolve it with `install-bridge conductor`, then run drive-epic again.",
+                ].join("\n");
+                // Named as a fixed reason and nothing else: no conductor is offered here,
+                // because handing an operator a second authority is the hazard this
+                // subcommand exists to remove.
+                assertSingleConductorInvocation(refusal);
+                deps.errorLog(refusal);
+                return 1;
+            }
+            // Runtime-only: this invocation composes bring-up with run creation.
+            const repoRoot = deps.cwd();
+            const preflight = await deps.runPlanePreflight(repoRoot);
+            // Composition preconditions FIRST, and only these two. Preflight is
+            // read-only, so a refusal here provably created no manifest, spawned no
+            // process, and issued no run-creating request — AC-1's "no partial run"
+            // holds structurally rather than by cleanup.
+            const precondition = firstPreconditionRefusal(preflight);
+            if (precondition) {
+                const refusal = [
+                    `${epicKey}: cannot start the conductor runtime — ${precondition.check} failed.`,
+                    formatPlaneDiagnostic(precondition),
+                    "",
+                    "Nothing was started. Fix the item above and run drive-epic again.",
+                ].join("\n");
+                assertSingleConductorInvocation(refusal);
+                deps.errorLog(refusal);
+                return 1;
+            }
+            deps.log(`${epicKey}: the conductor runtime is not live; starting it before creating the run.`);
+            // The SAME preflight result is handed to `plane up` through its existing
+            // override seam, so the port that was probed is the port that gets launched
+            // and the two cannot disagree. Every blocking failure `plane up` finds
+            // beyond the two preconditions above is rendered by its own aggregate
+            // refusal, unchanged.
+            const planeExit = await deps.runPlane(["up"], { preflight: async () => preflight });
+            if (planeExit !== 0) {
+                // `plane up` already reported why, in its own words, and it rolls its own
+                // startup back. Nothing to add, and nothing was created here.
+                return 1;
+            }
+            // Delegate immediately. The readiness report is NOT re-read as a gate:
+            // `plane up` completes only after each member's durable heartbeat is fresh,
+            // whereas the readiness report derives reconciler/executor liveness from
+            // `epic_runs.last_tick_at` and `executor_jobs` rows — tables that are empty
+            // on a repository that has never run an epic. Gating on a re-read would
+            // therefore hang the one-command flow permanently on exactly the
+            // first-time-operator case it exists to serve. A successful bring-up IS the
+            // runtime fact here; re-sourcing that predicate belongs to A1b.4.
+            const setupExit = await deps.runSetupEpic(setupArgv);
+            if (setupExit !== 0) {
+                // The plane is deliberately LEFT RUNNING. `plane down` stops the
+                // manifest-bound run before terminating processes, so winding down now
+                // would stop the very run setup-epic may have just created, bound, or
+                // approved. The live plane is reported rather than abandoned — the
+                // operator owns the decision, which is the documented two-step state.
+                deps.errorLog([
+                    "",
+                    `${epicKey}: the conductor runtime was started by this invocation and is STILL RUNNING.`,
+                    "It was not wound down automatically, because doing so would stop a run that may",
+                    "already have been created and approved. Inspect it with `plane status`, and wind it",
+                    "down with `plane down` once you have decided what to do with the run.",
+                ].join("\n"));
+            }
+            return setupExit;
         }
         const handoff = renderConductorHandoff(selection, epicKey);
         const text = handoff.lines.join("\n");