@glubean/mcp 0.8.1 → 0.9.0

package/dist/index.js

@@ -4,7 +4,8 @@
  * Purpose:
  * - Let AI agents (Cursor, etc.) run verification-as-code locally
  * - Fetch structured failures (assertions/logs/traces) for automatic fixing
- * - Optionally trigger/tail remote runs via Glubean Open Platform APIs
+ * - Optionally report runs to Glubean Cloud via the `/v1/*` ingest contract
+ *   (the same contract `glubean run --upload` uses — see ./cloud.ts)
  *
  * IMPORTANT (stdio transport):
  * - Never write to stdout. Use stderr for logs.
@@ -15,7 +16,7 @@ import { z } from "zod";
 import { basename, dirname, resolve } from "node:path";
 import { readFile, stat } from "node:fs/promises";
 import { parse as parseYaml } from "yaml";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { pathToFileURL } from "node:url";
 import { applyEnvTemplating, bootstrap, loadProjectEnv, LOCAL_RUN_DEFAULTS, ProjectRunner, TestExecutor } from "@glubean/runner";
 import { renderArtifact, openapiArtifact } from "@glubean/sdk";
@@ -24,6 +25,7 @@ import { extractContractCases } from "@glubean/scanner/static";
 import { extractContractFromFile as sharedExtractFromFile, extractContractsFromProject as sharedExtractFromProject, } from "@glubean/scanner";
 import { MCP_PACKAGE_VERSION, DEFAULT_GENERATED_BY } from "./version.js";
 import { checkSdkCompat } from "./version-compat.js";
+import { buildRunIngestBody, cloudFetchJson, envLabelFromEnvFile, loadUploadRedaction, MISSING_AUTH_MESSAGES, resolveCloudAuth, resolveDefaultTargetId, runIngestUrl, runTestEventsUrl, runTestResultsUrl, runUrl, } from "./cloud.js";
 const METADATA_SCHEMA_VERSION = "1";
 function toLegacyHttpContract(c) {
     // Support BOTH shapes during transitional P4:
@@ -189,15 +191,51 @@ async function readActiveEnv(projectRoot) {
         return undefined;
     }
 }
+// GLU-88: mirrors packages/cli/src/lib/active_env.ts's SENSITIVE_ENV_NAMES
+// guard. `.glubean/active-env` is a persistent, un-TTL'd, un-warned sticky
+// file — an agent (or a human) that once ran `glubean env use prod` here
+// leaves every subsequent MCP tool call silently pointed at prod until
+// someone runs `glubean env reset`. Kept as a small local duplicate (not a
+// cross-package import) because @glubean/mcp does not depend on
+// @glubean/cli and shouldn't gain that dependency just for this helper.
+const SENSITIVE_ENV_NAMES = new Set(["prod", "production"]);
+function isSensitiveEnvName(name) {
+    return SENSITIVE_ENV_NAMES.has(name.trim().toLowerCase());
+}
+/**
+ * Thrown by `resolveEnvPath` when the active env resolves to a sensitive
+ * (prod-like) name and no explicit `envFile` was given. Callers should let
+ * this propagate — the MCP SDK surfaces thrown errors as a tool error
+ * response, which is exactly the "loud failure instead of silent prod
+ * upload" behavior GLU-88 requires.
+ */
+export class SensitiveActiveEnvError extends Error {
+    envName;
+    constructor(envName) {
+        super(`Active environment is "${envName}" (set via \`glubean env use ${envName}\`, ` +
+            `recorded in .glubean/active-env), which looks like a production ` +
+            `environment. Refusing to load it implicitly — pass an explicit envFile ` +
+            `(.env.${envName}) to use it, or run \`glubean env reset\` to clear the ` +
+            `active environment and fall back to .env.`);
+        this.envName = envName;
+        this.name = "SensitiveActiveEnvError";
+    }
+}
 /**
  * Resolve the env file path, checking `.glubean/active-env` when no explicit envFile is given.
+ * Throws `SensitiveActiveEnvError` instead of silently resolving a prod-like
+ * active-env (GLU-88) — explicit `envFile` always bypasses this check.
  */
-async function resolveEnvPath(projectRoot, envFile) {
+export async function resolveEnvPath(projectRoot, envFile) {
     if (envFile)
         return resolve(envFile);
     const activeEnv = await readActiveEnv(projectRoot);
-    if (activeEnv)
+    if (activeEnv) {
+        if (isSensitiveEnvName(activeEnv)) {
+            throw new SensitiveActiveEnvError(activeEnv);
+        }
         return resolve(projectRoot, `.env.${activeEnv}`);
+    }
     return resolve(projectRoot, ".env");
 }
 function normalizeFilePath(path) {
@@ -603,6 +641,7 @@ export async function runLocalTestsFromFile(args) {
             secrets,
             results: [],
             summary: { total: 0, passed: 0, failed: 0, skipped: 0 },
+            envPath,
             error: tests.length === 0
                 ? "No tests discovered in file. Check that exports use test() or contract.http.with() from @glubean/sdk."
                 : `No tests matched filter "${args.filter}". Available: ${tests.map((t) => t.id).join(", ")}`,
@@ -662,6 +701,7 @@ export async function runLocalTestsFromFile(args) {
                 secrets,
                 results: [],
                 summary: { total: 0, passed: 0, failed: 0, skipped: 0 },
+                envPath,
                 error: "inputJson and bootstrapInput are mutually exclusive. " +
                     "Per attachment-model §5.1: explicit input bypasses the overlay, so bootstrap params would be ignored. Pick one channel per run.",
                 versionInfo,
@@ -675,6 +715,7 @@ export async function runLocalTestsFromFile(args) {
                 secrets,
                 results: [],
                 summary: { total: 0, passed: 0, failed: 0, skipped: 0 },
+                envPath,
                 error: `inputJson / bootstrapInput / forceStandalone require \`filter\` ` +
                     `to match exactly one testId. Matched ${selected.length} tests` +
                     (selected.length > 1
@@ -899,31 +940,12 @@ export async function runLocalTestsFromFile(args) {
         secrets,
         results,
         summary: { total: results.length, passed, failed, skipped: skippedCount },
+        envPath,
         ...(orchestrationError !== undefined && { error: orchestrationError }),
         ...(warningsArr.length > 0 && { warnings: warningsArr }),
         versionInfo,
     };
 }
-function bearerHeaders(token) {
-    if (!token)
-        return {};
-    return { Authorization: `Bearer ${token}` };
-}
-async function fetchJson(url, init) {
-    const res = await fetch(url, init);
-    const text = await res.text();
-    if (!res.ok) {
-        throw new Error(`HTTP ${res.status} ${res.statusText}: ${text.slice(0, 2000)}`);
-    }
-    if (!text)
-        return null;
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return text;
-    }
-}
 const server = new McpServer({
     name: "glubean",
     version: MCP_PACKAGE_VERSION,
@@ -939,7 +961,7 @@ export const MCP_TOOL_NAMES = {
     openapi: "glubean_openapi",
     diagnoseConfig: "glubean_diagnose_config",
     getMetadata: "glubean_get_metadata",
-    openTriggerRun: "glubean_open_trigger_run",
+    openUploadRun: "glubean_open_upload_run",
     openGetRun: "glubean_open_get_run",
     openGetRunEvents: "glubean_open_get_run_events",
 };
@@ -1010,6 +1032,9 @@ server.registerTool(MCP_TOOL_NAMES.runLocalFile, {
             .describe("DEBUG: bypass `runnability.requireAttachment` for the filtered case. Author-debug only; runtime emits a warning."),
     },
 }, async (input) => {
+    // Recorded BEFORE execution — the snapshot's honest startedAt for Cloud
+    // upload (createdAt below is the run's END; codex GLU-77 R1 P2).
+    const runStartedAt = new Date().toISOString();
     const result = await runLocalTestsFromFile({
         filePath: input.filePath,
         filter: input.filter,
@@ -1047,6 +1072,8 @@ server.registerTool(MCP_TOOL_NAMES.runLocalFile, {
     }
     lastLocalRunSnapshot = {
         createdAt: new Date().toISOString(),
+        startedAt: runStartedAt,
+        clientRunId: randomUUID(),
         fileUrl: result.fileUrl,
         projectRoot: result.projectRoot,
         summary: result.summary,
@@ -1054,6 +1081,13 @@ server.registerTool(MCP_TOOL_NAMES.runLocalFile, {
         includeLogs: input.includeLogs ?? true,
         includeTraces: input.includeTraces ?? false,
         filter: input.filter,
+        // The RESOLVED env path the run used (handles .glubean/active-env) —
+        // NOT the raw input, so a later upload can't re-resolve to a DIFFERENT
+        // active env than the run's (codex GLU-77 R3 P2). Falls back to the raw
+        // input only on the version-skew early return (no run happened).
+        ...(result.envPath ?? input.envFile
+            ? { envFile: result.envPath ?? input.envFile }
+            : {}),
     };
     return {
         content: [{ type: "text", text: JSON.stringify(safe) }],
@@ -1309,83 +1343,225 @@ server.registerTool(MCP_TOOL_NAMES.getMetadata, {
         ],
     };
 });
-server.registerTool(MCP_TOOL_NAMES.openTriggerRun, {
-    description: "Trigger a remote run via Glubean Open Platform API (POST /open/v1/runs).",
+// =============================================================================
+// Cloud open* tools — /v1 ingest contract (GLU-77)
+//
+// The legacy Open Platform (`/open/v1/*` — server-side bundle execution) was
+// retired with the old stack. These tools speak the new platform API: runs
+// execute LOCALLY (glubean_run_local_file), then results are reported via
+// `POST /v1/projects/{projectId}/targets/{targetId}/runs` — the same ingest
+// contract and credential conventions as `glubean run --upload`.
+// =============================================================================
+const OPEN_AUTH_INPUT_SCHEMA = {
+    apiUrl: z
+        .string()
+        .optional()
+        .describe("Platform API base URL (default: GLUBEAN_API_URL, or https://api.glubean.com)"),
+    token: z
+        .string()
+        .optional()
+        .describe("API token (default: GLUBEAN_TOKEN from process env or .env.secrets, else ~/.glubean/credentials.json)"),
+    projectId: z
+        .string()
+        .optional()
+        .describe("Project id (default: GLUBEAN_PROJECT_ID from process env or .env, else ~/.glubean/credentials.json)"),
+    targetId: z
+        .string()
+        .optional()
+        .describe("Target id within the project (default: GLUBEAN_TARGET_ID, else the project's default target)"),
+    dir: z
+        .string()
+        .optional()
+        .describe("Project root for .env/.env.secrets credential resolution (default: the last run snapshot's project root, else cwd)"),
+    envFile: z
+        .string()
+        .optional()
+        .describe("Path to .env file (default: <projectRoot>/.env)"),
+};
+/**
+ * Resolve Cloud credentials for the open* tools with the CLI's precedence
+ * (explicit arg > process env > project .env/.env.secrets >
+ * ~/.glubean/credentials.json), then require the full token/project/target
+ * set — resolving the project's DEFAULT target when none is configured.
+ * Returns a human-actionable error message when a piece is missing.
+ */
+async function requireOpenToolAuth(input, fallbackRoot) {
+    const projectRoot = input.dir ? resolve(input.dir) : (fallbackRoot ?? process.cwd());
+    const envPath = await resolveEnvPath(projectRoot, input.envFile);
+    const { vars, secrets } = await loadProjectEnv(projectRoot, basename(envPath));
+    const auth = await resolveCloudAuth(input, {
+        envFileVars: { ...vars, ...secrets },
+    });
+    if (!auth.token)
+        return { ok: false, error: MISSING_AUTH_MESSAGES.token };
+    if (!auth.projectId)
+        return { ok: false, error: MISSING_AUTH_MESSAGES.projectId };
+    const targetId = auth.targetId ??
+        (await resolveDefaultTargetId(auth.apiUrl, auth.projectId, auth.token));
+    if (!targetId)
+        return { ok: false, error: MISSING_AUTH_MESSAGES.targetId };
+    return {
+        ok: true,
+        auth: { apiUrl: auth.apiUrl, token: auth.token, projectId: auth.projectId, targetId },
+    };
+}
+function errorContent(error, extra) {
+    return {
+        content: [
+            { type: "text", text: JSON.stringify({ error, ...extra }) },
+        ],
+    };
+}
+server.registerTool(MCP_TOOL_NAMES.openUploadRun, {
+    description: "Upload the most recent glubean_run_local_file results to Glubean Cloud " +
+        "(POST /v1/projects/{projectId}/targets/{targetId}/runs — the same ingest contract as `glubean run --upload`). " +
+        "Replaces the retired glubean_open_trigger_run (/open/v1): the platform ingests locally-executed runs; there is no remote trigger. " +
+        "Credentials resolve like the CLI: explicit args > GLUBEAN_TOKEN / GLUBEAN_PROJECT_ID / GLUBEAN_TARGET_ID / GLUBEAN_API_URL " +
+        "(process env or project .env/.env.secrets) > ~/.glubean/credentials.json.",
     inputSchema: {
-        apiUrl: z.string().describe("Base API URL, e.g. https://api.glubean.com"),
-        token: z.string().describe("Project token with runs:write scope"),
-        projectId: z.string().describe("Project ID (short id)"),
-        bundleId: z.string().describe("Bundle ID (short id)"),
-        jobId: z.string().optional().describe("Optional job ID"),
+        ...OPEN_AUTH_INPUT_SCHEMA,
+        environment: z
+            .string()
+            .optional()
+            .describe("Environment label recorded on the run (default: GLUBEAN_ENV, else 'default')"),
     },
 }, async (input) => {
-    const { apiUrl, token, projectId, bundleId, jobId } = input;
-    const url = `${apiUrl.replace(/\/$/, "")}/open/v1/runs`;
-    const body = { projectId, bundleId, jobId };
-    const json = await fetchJson(url, {
+    if (!lastLocalRunSnapshot) {
+        return errorContent("No local run snapshot to upload. Run glubean_run_local_file first, then call this tool.");
+    }
+    if (lastLocalRunSnapshot.results.length === 0) {
+        return errorContent("The last local run produced no results — nothing to upload.");
+    }
+    // Credential resolution AND the environment label default to the env file
+    // the RUN was executed with — sourcing upload credentials from a different
+    // env than the run (e.g. run with `.env.staging`, upload with `.env`)
+    // could misroute the upload (codex GLU-77 R2 P2). An explicit `envFile`
+    // argument overrides BOTH consistently.
+    const effectiveEnvFile = input.envFile ?? lastLocalRunSnapshot.envFile;
+    const check = await requireOpenToolAuth({ ...input, envFile: effectiveEnvFile }, lastLocalRunSnapshot.projectRoot);
+    if (!check.ok)
+        return errorContent(check.error);
+    const { apiUrl, token, projectId, targetId } = check.auth;
+    // Environment label — same chain as the CLI's resolveUploadEnvironment:
+    // explicit arg > GLUBEAN_ENV > derived from the env file the RUN used
+    // (`.env.staging` → "staging"; resolveEnvPath honors .glubean/active-env).
+    const snapshotRoot = lastLocalRunSnapshot.projectRoot;
+    const runEnvPath = await resolveEnvPath(snapshotRoot, effectiveEnvFile);
+    const environment = input.environment ||
+        process.env.GLUBEAN_ENV?.trim() ||
+        envLabelFromEnvFile(runEnvPath);
+    // Project redaction rules (glubean.yaml defaults.redaction) — additive on
+    // the built-in baseline, matching the CLI's upload-path scrub.
+    const redaction = await loadUploadRedaction(snapshotRoot);
+    const body = buildRunIngestBody(lastLocalRunSnapshot, { environment, redaction });
+    const json = (await cloudFetchJson(runIngestUrl(apiUrl, projectId, targetId), {
         method: "POST",
-        headers: { "Content-Type": "application/json", ...bearerHeaders(token) },
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify(body),
-    });
-    return { content: [{ type: "text", text: JSON.stringify(json) }] };
+        token,
+    }));
+    const runId = typeof json?.id === "string" ? json.id : undefined;
+    if (!runId) {
+        return errorContent("Cloud accepted the upload but the response was missing the run id.", { response: json });
+    }
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    runId,
+                    url: runUrl(apiUrl, projectId, targetId, runId),
+                    projectId,
+                    targetId,
+                    environment,
+                    summary: lastLocalRunSnapshot.summary,
+                }),
+            },
+        ],
+    };
 });
 server.registerTool(MCP_TOOL_NAMES.openGetRun, {
-    description: "Get run status via Glubean Open Platform API (GET /open/v1/runs/:runId).",
+    description: "Get a run's status + metadata from Glubean Cloud " +
+        "(GET /v1/projects/{projectId}/targets/{targetId}/runs/{runId}).",
     inputSchema: {
-        apiUrl: z.string().describe("Base API URL, e.g. https://api.glubean.com"),
-        token: z.string().describe("Project token with runs:read scope"),
         runId: z.string().describe("Run ID"),
+        ...OPEN_AUTH_INPUT_SCHEMA,
     },
 }, async (input) => {
-    const { apiUrl, token, runId } = input;
-    const url = `${apiUrl.replace(/\/$/, "")}/open/v1/runs/${encodeURIComponent(runId)}`;
-    const json = await fetchJson(url, {
-        method: "GET",
-        headers: bearerHeaders(token),
-    });
+    const check = await requireOpenToolAuth(input, lastLocalRunSnapshot?.projectRoot);
+    if (!check.ok)
+        return errorContent(check.error);
+    const { apiUrl, token, projectId, targetId } = check.auth;
+    const json = await cloudFetchJson(runUrl(apiUrl, projectId, targetId, input.runId), { method: "GET", token });
     return { content: [{ type: "text", text: JSON.stringify(json) }] };
 });
 server.registerTool(MCP_TOOL_NAMES.openGetRunEvents, {
-    description: "Fetch a page of run events via Glubean Open Platform API (GET /open/v1/runs/:runId/events).",
+    description: "Fetch a test's events for a Cloud run " +
+        "(GET /v1/projects/{projectId}/targets/{targetId}/runs/{runId}/tests/{testId}/events). " +
+        "The /v1 contract stores events per test — omit testId to list the run's tests (with their testIds) instead.",
     inputSchema: {
-        apiUrl: z.string().describe("Base API URL, e.g. https://api.glubean.com"),
-        token: z.string().describe("Project token with runs:read scope"),
         runId: z.string().describe("Run ID"),
-        afterSeq: z
-            .number()
-            .int()
-            .min(0)
+        testId: z
+            .string()
             .optional()
-            .describe("Cursor: return events after this seq"),
+            .describe("Test ID within the run. Omit to list the run's tests instead."),
+        type: z
+            .string()
+            .optional()
+            .describe("Filter by event type (assertion/log/error/status) — applied client-side"),
         limit: z
             .number()
             .int()
             .min(1)
-            .max(1000)
-            .optional()
-            .describe("Max events (default server: 100)"),
-        type: z
-            .string()
+            .max(2000)
             .optional()
-            .describe("Filter by event type (log/assert/trace/result)"),
+            .describe("Max events returned (default: 200)"),
+        ...OPEN_AUTH_INPUT_SCHEMA,
     },
 }, async (input) => {
-    const { apiUrl, token, runId, afterSeq, limit, type } = input;
-    const base = `${apiUrl.replace(/\/$/, "")}/open/v1/runs/${encodeURIComponent(runId)}/events`;
-    const params = new URLSearchParams();
-    if (afterSeq !== undefined)
-        params.set("afterSeq", String(afterSeq));
-    if (limit !== undefined)
-        params.set("limit", String(limit));
-    if (type)
-        params.set("type", type);
-    const qs = params.toString();
-    const url = qs ? `${base}?${qs}` : base;
-    const json = await fetchJson(url, {
-        method: "GET",
-        headers: bearerHeaders(token),
-    });
-    return { content: [{ type: "text", text: JSON.stringify(json) }] };
+    const check = await requireOpenToolAuth(input, lastLocalRunSnapshot?.projectRoot);
+    if (!check.ok)
+        return errorContent(check.error);
+    const { apiUrl, token, projectId, targetId } = check.auth;
+    if (!input.testId) {
+        const rows = await cloudFetchJson(runTestResultsUrl(apiUrl, projectId, targetId, input.runId), { method: "GET", token });
+        const empty = Array.isArray(rows) && rows.length === 0;
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({
+                        message: empty
+                            ? "No per-test rows yet — the run may still be deriving " +
+                                "(check the run's `derivation` field via glubean_open_get_run and retry in a few seconds)."
+                            : "The /v1 contract stores run events per test — pass one of these testIds to fetch its events.",
+                        runId: input.runId,
+                        tests: rows,
+                    }),
+                },
+            ],
+        };
+    }
+    const events = await cloudFetchJson(runTestEventsUrl(apiUrl, projectId, targetId, input.runId, input.testId), { method: "GET", token });
+    const all = Array.isArray(events) ? events : [];
+    const filtered = input.type
+        ? all.filter((e) => e?.type === input.type)
+        : all;
+    const limit = Math.max(1, Math.min(input.limit ?? 200, 2000));
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    runId: input.runId,
+                    testId: input.testId,
+                    availableTotal: all.length,
+                    returned: Math.min(filtered.length, limit),
+                    events: filtered.slice(0, limit),
+                }),
+            },
+        ],
+    };
 });
 // =============================================================================
 // Runtime contract extraction — delegated to @glubean/scanner