biaws 0.5.3 → 0.6.0

package/README.md

@@ -3,6 +3,10 @@
 CLI do Bondia Workspaces para administrar instalações, configurar o acesso
 global e operar os recursos do workspace associado à pasta atual.
 
+Setup/update aceitam MCP HTTP/OAuth opcional. Veja
+[configuração ChatGPT](docs/chatgpt.md) e o
+[runbook de operação](../docs/chatgpt-operations.md).
+
 ## Instalação
 
 ```bash

package/docs/chatgpt.md

@@ -0,0 +1,19 @@
+# Conexão direta ao ChatGPT
+
+Habilite com `biaws admin instance setup --mcp-http` ou
+`biaws admin instance update NOME --mcp-http`. URL pública exige HTTPS; loopback
+HTTP é apenas para desenvolvimento. Atualizar uma instância continua sujeito ao
+fluxo de backup do comando update. O CLI gera segredo aleatório dedicado em
+arquivo 0600 por instância e preserva-o em reconfigurações.
+
+`update NOME --no-mcp-http` desabilita a entrada, preservando replica set,
+configuração e dados OAuth. `status NOME --diagnose-mcp --json` verifica discovery,
+issuer/resource, PKCE, API e challenge sem solicitar senha. Os resultados refletem
+o acesso desta máquina; não comprovam acesso pela infraestrutura do ChatGPT.
+
+`biaws workspace agent configure chatgpt --url https://instancia.example --json`
+mostra a URL /mcp e os passos de login/consentimento no navegador. Acrescente
+`--diagnose` para verificações de rede. Esse comando não exige API key nem
+escreve credenciais no projeto. Codex/Claude continuam com stdio.
+A URL pública e o workspace autorizado são escolhas diferentes: cada conexão
+OAuth é vinculada no servidor ao workspace selecionado no consentimento.

package/docs/instance-lifecycle.md

@@ -137,3 +137,17 @@ O restore valida checksum, descriptografia, versão e entradas do tar antes de
 substituir dados. Portas, URLs e caminhos de storage do destino são
 preservados. Em falhas após a pausa, o mecanismo tenta recompor os serviços e
 mantém o erro original como evidência.
+
+O schema 2 inclui a versão MCP implantável e aceita a leitura dos snapshots de
+schema 1. Use CLI >=0.6.0; uma mudança isolada de MCP passa a exigir update.
+Start/stop/status/update conservam o overlay e o perfil persistidos por instância.
+Ao desabilitar, o update para o container MCP e mantém o replica set e suas chaves.
+Os scripts gerados e os comandos de backup/restore usam o mesmo seletor de Compose.
+
+Backup criptografado inclui o segredo dedicado e todo o banco, incluindo chaves
+de assinatura, concessões e tokens. Restore mantém URL, flags e paths do destino
+e restaura o segredo em arquivo privado. Se a origem pública mudou, remove os
+dados OAuth e as chaves de assinatura restaurados antes de reiniciar: cada usuário
+deve autorizar uma nova conexão. O snapshot de release continua invalidado até
+um update bem-sucedido. Restore não habilita MCP automaticamente em um destino
+que não estava configurado para ele.

package/docs/releasing.md

@@ -48,6 +48,14 @@ global. Depois da publicação, confirme também `npx biaws@<versão> --help`.
 
 ## Compatibilidade e migração
 
+A série `0.6.0` suporta os manifests de plataforma schema 1 e 2 e fixa
+`biaws-mcp@0.15.0`. Publique esse MCP antes de `biaws@0.6.0`; o CLI antigo
+não deve aplicar o manifesto schema 2. Atualizar somente o CLI não atualiza
+instâncias. Para MCP HTTP, use setup/update com `--mcp-http` e os requisitos
+HTTPS/replica set de [operação ChatGPT](../../docs/chatgpt-operations.md).
+`workspace agent configure chatgpt --url https://<host> --json` fornece
+instruções sem API key ou senha; a conta é autenticada no consentimento OAuth.
+
 O shebang canônico está em `biaws-cli/bin/biaws.js`. O pacote npm cria o comando
 `biaws`; no checkout, `npm --prefix biaws-cli link` oferece a mesma experiência.
 O antigo `node biaws-cli/src/index.js ...` continua funcional durante a série

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "biaws",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "CLI do Bondia Workspaces para administração, configuração e operação de workspaces",
   "license": "Apache-2.0",
   "repository": {

package/src/cli/workspace/agent/configure/chatgpt.js

@@ -0,0 +1 @@
+export { default } from "../../../../commands/configure/chatgpt.js";

package/src/commands/agent.js

@@ -11,7 +11,7 @@ import { runSkillsCommand } from "./skills.js";
 const CODEX_BEGIN = "# BEGIN BIAWS MANAGED MCP";
 const CODEX_END = "# END BIAWS MANAGED MCP";
 export const MCP_PACKAGE_NAME = "biaws-mcp";
-export const MCP_PACKAGE_VERSION = "0.14.1";
+export const MCP_PACKAGE_VERSION = "0.15.0";
 export const MCP_PACKAGE_SPEC = `${MCP_PACKAGE_NAME}@${MCP_PACKAGE_VERSION}`;
 const MCP_COMMAND = "npx";
 const MCP_ARGS = ["--yes", MCP_PACKAGE_SPEC];

package/src/commands/configure/chatgpt.js

@@ -0,0 +1,17 @@
+import { Flags } from "@oclif/core";
+import { BaseCommand } from "../../baseCommands.js";
+import { chatgptConnectionInstructions, diagnoseMcp } from "../../instance/mcp.js";
+
+export default class ConfigureChatgpt extends BaseCommand {
+  static description = "orienta conexão direta ao ChatGPT usando OAuth, sem capturar senha ou chave";
+  static flags = {
+    url: Flags.string({ description: "origem pública HTTPS da instância", required: true }),
+    diagnose: Flags.boolean({ description: "verifica discovery, saúde e challenge a partir desta máquina" }),
+    json: Flags.boolean({ description: "emite JSON" }),
+  };
+  async run() {
+    const { flags } = await this.parse(ConfigureChatgpt);
+    const result = flags.diagnose ? await diagnoseMcp(flags.url) : chatgptConnectionInstructions(flags.url);
+    this.output({ json: flags.json }).result(flags.json ? result : JSON.stringify(result, null, 2));
+  }
+}

package/src/commands/instance/setup.js

@@ -14,6 +14,7 @@ import {
 const setupFlags = {
   ...contextFlags,
   ...wizardFlags,
+  "mcp-http": Flags.boolean({ allowNo: true, description: "habilita MCP HTTP/OAuth (HTTPS público ou loopback)" }),
   name: Flags.string({ char: "n", description: "nome da instância" }),
   "admin-email": Flags.string({
     description: "e-mail do administrador inicial",
@@ -287,7 +288,10 @@ export default class InstanceSetup extends LocalInstanceCommand {
       terminal: this.adapters.terminal,
     });
     const configuration = await buildSetupConfiguration(
-      Object.fromEntries(definition.questions.map((question) => [question.name, plan.get(question.name)])),
+      {
+        ...Object.fromEntries(definition.questions.map((question) => [question.name, plan.get(question.name)])),
+        mcpHttp: flags["mcp-http"],
+      },
       context,
       this.adapters.filesystem,
     );

package/src/commands/instance/status.js

@@ -3,12 +3,14 @@ import { Flags } from "@oclif/core";
 import { LocalInstanceCommand } from "../../baseCommands.js";
 import { contextFlags, contextInput, instanceArgument, writeResult } from "../../instance/command.js";
 import { getInstance, operateInstance } from "../../instance/service.js";
+import { diagnoseMcp, mcpInstanceSummary } from "../../instance/mcp.js";
 
 export default class InstanceStatus extends LocalInstanceCommand {
   static description = "consulta o estado dos containers de uma instância";
   static args = { instance: instanceArgument };
   static flags = {
     ...contextFlags,
+    "diagnose-mcp": Flags.boolean({ description: "valida discovery e saúde da integração OAuth/MCP" }),
     json: Flags.boolean({ description: "emite JSON" }),
   };
 
@@ -17,6 +19,14 @@ export default class InstanceStatus extends LocalInstanceCommand {
     const context = await this.localContext(contextInput(flags, args.instance));
     const instance = await getInstance(context, this.adapters.filesystem, args.instance);
     const result = await operateInstance(instance, context, this.adapters.processRunner, "status");
-    writeResult(this, result, (value) => value.output || `Nenhum container ativo para ${value.instance}.`, flags.json);
+    result.mcp = mcpInstanceSummary(instance);
+    if (flags["diagnose-mcp"]) result.mcp.diagnostics = await diagnoseMcp(instance.publicUrl);
+    writeResult(
+      this,
+      result,
+      (value) =>
+        (value.output || `Nenhum container ativo para ${value.instance}.`) + "\n" + JSON.stringify(value.mcp, null, 2),
+      flags.json,
+    );
   }
 }

package/src/commands/instance/update.js

@@ -2,6 +2,7 @@ import { Flags } from "@oclif/core";
 
 import { LocalInstanceCommand } from "../../baseCommands.js";
 import { contextFlags, contextInput, instanceArgument } from "../../instance/command.js";
+import { configureMcpInstance } from "../../instance/mcp.js";
 import {
   backupArguments,
   executeInstanceScript,
@@ -85,6 +86,11 @@ export default class InstanceUpdate extends LocalInstanceCommand {
   static args = { instance: instanceArgument };
   static flags = {
     ...contextFlags,
+    "mcp-http": Flags.boolean({
+      allowNo: true,
+      description: "habilita/desabilita MCP HTTP, preservando configuração",
+      exclusive: ["check"],
+    }),
     "backup-output": Flags.string({
       description: "arquivo de destino do backup anterior à atualização",
     }),
@@ -109,19 +115,24 @@ export default class InstanceUpdate extends LocalInstanceCommand {
   async run() {
     const { args, flags } = await this.parse(InstanceUpdate);
     const context = await this.localContext(contextInput(flags, args.instance));
-    const instance = await getInstance(context, this.adapters.filesystem, args.instance);
+    let instance = await getInstance(context, this.adapters.filesystem, args.instance);
     const versionStatus = await getInstanceUpdateStatus(instance, context, this.adapters.filesystem);
     if (flags.check) {
       this.output({ json: flags.json }).result(versionCheckResult(instance, versionStatus, flags.json));
       return;
     }
-    if (!versionStatus.updateRequired && !flags.force) {
+    if (!versionStatus.updateRequired && !flags.force && flags["mcp-http"] === undefined) {
       this.output({ json: flags.json }).result(unchangedResult(instance, versionStatus, flags.json));
       return;
     }
 
     await validateInstanceUpdate(instance, context, this.adapters.processRunner);
     const backupOutput = await createUpdateBackup(this, instance, context, flags);
+    if (flags["mcp-http"] !== undefined) {
+      await configureMcpInstance(instance.envFile, flags["mcp-http"], this.adapters.filesystem);
+      instance = await getInstance(context, this.adapters.filesystem, args.instance);
+      await validateInstanceUpdate(instance, context, this.adapters.processRunner);
+    }
 
     await updateInstance(
       instance,

package/src/instance/command.js

@@ -32,5 +32,6 @@ export function instanceSummary(instance) {
     `API: http://127.0.0.1:${instance.apiPort}`,
     `UI: ${instance.publicUrl}`,
     `Storage: ${instance.storage}`,
+    `MCP HTTP: ${instance.mcp?.enabled ? instance.mcp.resource : "desabilitado"}`,
   ].join("\n");
 }

package/src/instance/mcp.js

@@ -0,0 +1,169 @@
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { CliError } from "../core/errors.js";
+import { parseEnv } from "../core/context.js";
+import { atomicWrite } from "./release.js";
+
+export function mcpPublicConfiguration(publicUrl) {
+  let url;
+  try {
+    url = new URL(publicUrl);
+  } catch {
+    throw new CliError("Informe uma origem pública HTTPS válida.", { code: "INVALID_MCP_PUBLIC_URL" });
+  }
+  if (
+    url.username ||
+    url.password ||
+    url.pathname !== "/" ||
+    url.search ||
+    url.hash ||
+    (url.protocol !== "https:" &&
+      !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+  ) {
+    throw new CliError("MCP exige HTTPS público; HTTP é permitido somente em loopback para desenvolvimento.", {
+      code: "INVALID_MCP_PUBLIC_URL",
+    });
+  }
+  return {
+    publicUrl: url.origin,
+    resource: url.origin + "/mcp",
+    issuer: url.origin + "/api/auth",
+    scheme: url.protocol.slice(0, -1),
+  };
+}
+export function mcpInstanceSummary(instance) {
+  return {
+    configured: instance.env.BIAWS_MCP_CONFIGURED === "true",
+    enabled: instance.env.BIAWS_MCP_HTTP_ENABLED === "true",
+    resource: instance.env.BIAWS_MCP_PUBLIC_URL || "",
+    issuer: instance.env.BIAWS_PUBLIC_URL ? instance.env.BIAWS_PUBLIC_URL + "/api/auth" : "",
+  };
+}
+function replaceEnvironment(contents, values) {
+  let next = contents;
+  for (const [key, value] of Object.entries(values)) {
+    const line = key + "=" + value;
+    const pattern = new RegExp("^" + key + "=.*$", "gmu");
+    next = pattern.test(next) ? next.replace(pattern, () => line) : next.replace(/\s*$/u, "") + "\n" + line + "\n";
+  }
+  return next;
+}
+export async function configureMcpInstance(
+  envFile,
+  enabled,
+  filesystem,
+  { uid = process.getuid?.() ?? 1000, gid = process.getgid?.() ?? 1000 } = {},
+) {
+  const contents = await filesystem.readFile(envFile, "utf8");
+  const env = parseEnv(contents);
+  const configured = enabled || env.BIAWS_MCP_CONFIGURED === "true";
+  const values = { BIAWS_MCP_HTTP_ENABLED: String(enabled) };
+  if (configured) {
+    const config = mcpPublicConfiguration(env.BIAWS_PUBLIC_URL);
+    const secretPath = env.BIAWS_MCP_SERVICE_SECRET_PATH || path.join(path.dirname(envFile), ".mcp-service-secret");
+    if (/[\r\n$#"'\\]/u.test(secretPath))
+      throw new CliError("Caminho de segredo incompatível com Compose.", { code: "INVALID_MCP_SECRET_PATH" });
+    let secret;
+    try {
+      secret = await filesystem.readFile(secretPath, "utf8");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      secret = randomBytes(32).toString("hex");
+      await filesystem.writeFile(secretPath, secret, { mode: 0o600, flag: "wx" });
+    }
+    if (secret.trim().length < 32 || secret.length > 4096)
+      throw new CliError("Segredo MCP inválido; use um arquivo dedicado de 32 a 4096 caracteres.", {
+        code: "INVALID_MCP_SERVICE_SECRET",
+      });
+    await filesystem.chmod(secretPath, 0o600);
+    Object.assign(values, {
+      BIAWS_MCP_CONFIGURED: "true",
+      BIAWS_MCP_PUBLIC_URL: config.resource,
+      BIAWS_PUBLIC_SCHEME: config.scheme,
+      BIAWS_MCP_SERVICE_SECRET_PATH: secretPath,
+      BIAWS_MCP_UID: env.BIAWS_MCP_UID || uid,
+      BIAWS_MCP_GID: env.BIAWS_MCP_GID || gid,
+    });
+  }
+  await atomicWrite(envFile, replaceEnvironment(contents, values), filesystem);
+  return { configured, enabled, ...(configured ? mcpPublicConfiguration(env.BIAWS_PUBLIC_URL) : {}) };
+}
+export async function diagnoseMcp(publicUrl, { fetchImpl = fetch } = {}) {
+  const config = mcpPublicConfiguration(publicUrl);
+  const checks = [];
+  const get = async (name, url) => {
+    try {
+      const response = await fetchImpl(url, { redirect: "error", signal: AbortSignal.timeout(5000) });
+      if (!response.ok) throw new Error("HTTP " + response.status);
+      const result = await response.json();
+      checks.push({ name, ok: true });
+      return result;
+    } catch {
+      checks.push({ name, ok: false, message: "Não foi possível ler " + url + ". Verifique TLS, proxy e serviço." });
+      return null;
+    }
+  };
+  const protectedResource = await get(
+    "resource-discovery",
+    config.publicUrl + "/.well-known/oauth-protected-resource/mcp",
+  );
+  const authorization = await get(
+    "authorization-discovery",
+    config.publicUrl + "/.well-known/oauth-authorization-server/api/auth",
+  );
+  if (protectedResource)
+    checks.push({
+      name: "resource-binding",
+      ok:
+        protectedResource.resource === config.resource &&
+        protectedResource.authorization_servers?.includes(config.issuer),
+    });
+  if (authorization)
+    checks.push({
+      name: "issuer-and-pkce",
+      ok: authorization.issuer === config.issuer && authorization.code_challenge_methods_supported?.includes("S256"),
+    });
+  await get("api-health", config.publicUrl + "/api/health");
+  try {
+    const response = await fetchImpl(config.resource, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(5000),
+      headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: { protocolVersion: "2025-11-25", capabilities: {}, clientInfo: { name: "biaws-doctor", version: "1" } },
+      }),
+    });
+    checks.push({
+      name: "mcp-oauth-challenge",
+      ok:
+        response.status === 401 &&
+        (response.headers.get("www-authenticate") || "").includes("oauth-protected-resource"),
+    });
+    await response.body?.cancel();
+  } catch {
+    checks.push({ name: "mcp-oauth-challenge", ok: false });
+  }
+  return {
+    ...config,
+    ok: checks.every((check) => check.ok),
+    checks,
+    observation: "Verificações realizadas a partir desta máquina. Acessibilidade pelo ChatGPT ainda não comprovada.",
+  };
+}
+export function chatgptConnectionInstructions(publicUrl) {
+  const config = mcpPublicConfiguration(publicUrl);
+  return {
+    ...config,
+    authentication: "OAuth",
+    steps: [
+      "No ChatGPT, crie uma conexão MCP personalizada com a URL do recurso e autenticação OAuth.",
+      "Autentique no navegador com sua conta BIAWS, escolha o workspace e consinta os acessos.",
+      "Para outro workspace, crie outra autorização. Revogue conexões em Minha conta no BIAWS.",
+    ],
+    catalog: "O plugin distribuível não implica elegibilidade ou publicação no catálogo.",
+  };
+}

package/src/instance/release.js

@@ -2,7 +2,8 @@ import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { CliError } from "../core/errors.js";
 
-const COMPONENTS = ["biaws-api", "biaws-ui", "biaws-monitor-executor"];
+const LEGACY_COMPONENTS = ["biaws-api", "biaws-ui", "biaws-monitor-executor"];
+const COMPONENTS = [...LEGACY_COMPONENTS, "biaws-mcp"];
 const VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 
 function invalid(message) {
@@ -11,22 +12,23 @@ function invalid(message) {
 
 export function validateRelease(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) invalid("Manifesto de release inválido.");
-  if (value.schemaVersion !== 1) invalid("schemaVersion do manifesto não suportada; atualize o CLI.");
+  if (![1, 2].includes(value.schemaVersion)) invalid("schemaVersion do manifesto não suportada; atualize o CLI.");
+  const expected = value.schemaVersion === 1 ? LEGACY_COMPONENTS : COMPONENTS;
   if (typeof value.version !== "string" || !VERSION.test(value.version)) invalid("Versão da release inválida.");
   if (!Number.isSafeInteger(value.deploymentRevision) || value.deploymentRevision < 1) {
     invalid("deploymentRevision deve ser um inteiro positivo.");
   }
-  if (!value.components || Object.keys(value.components).sort().join() !== [...COMPONENTS].sort().join()) {
-    invalid("O manifesto deve conter as versões de biaws-api, biaws-ui e biaws-monitor-executor.");
+  if (!value.components || Object.keys(value.components).sort().join() !== [...expected].sort().join()) {
+    invalid("O manifesto deve conter exatamente os componentes do schema declarado.");
   }
   const components = {};
-  for (const component of COMPONENTS) {
+  for (const component of expected) {
     const version = value.components[component];
     if (typeof version !== "string" || !VERSION.test(version)) invalid(`Versão inválida: ${component}.`);
     components[component] = version;
   }
   return Object.freeze({
-    schemaVersion: 1,
+    schemaVersion: value.schemaVersion,
     version: value.version,
     deploymentRevision: value.deploymentRevision,
     components: Object.freeze(components),
@@ -55,7 +57,7 @@ export async function readRelease(file, filesystem, { optional = false } = {}) {
 
 export async function readAvailableRelease(root, filesystem) {
   const release = await readRelease(path.join(root, "release.json"), filesystem);
-  for (const component of COMPONENTS) {
+  for (const component of Object.keys(release.components)) {
     const manifest = JSON.parse(await filesystem.readFile(path.join(root, component, "package.json"), "utf8"));
     if (manifest.version !== release.components[component]) {
       invalid(`release.json diverge de ${component}/package.json; atualize o manifesto antes de implantar.`);
@@ -66,7 +68,7 @@ export async function readAvailableRelease(root, filesystem) {
 
 export function releaseDifferences(current, available) {
   const differences = [];
-  for (const field of ["version", "deploymentRevision", ...COMPONENTS]) {
+  for (const field of ["schemaVersion", "version", "deploymentRevision", ...COMPONENTS]) {
     const before = COMPONENTS.includes(field) ? current?.components[field] : current?.[field];
     const after = COMPONENTS.includes(field) ? available.components[field] : available[field];
     if (before !== after) differences.push({ field, current: before ?? null, available: after });

package/src/instance/service.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import os from "node:os";
+import { mcpInstanceSummary, mcpPublicConfiguration } from "./mcp.js";
 import {
   appliedReleasePath,
   readAvailableRelease,
@@ -137,6 +138,7 @@ export async function listInstances(context, filesystem) {
       uiPort: Number(env.BIAWS_UI_PORT || 4_400),
       publicUrl: env.BIAWS_PUBLIC_URL || `http://localhost:${env.BIAWS_UI_PORT || 4_400}`,
       storage: Object.values(STORAGE_FIELDS).some((key) => env[key]) ? "directories" : "volumes",
+      mcp: mcpInstanceSummary({ env }),
       env,
     });
   }
@@ -238,11 +240,14 @@ export async function buildSetupConfiguration(values, context, filesystem) {
   const storageChanged = Boolean(
     previousStorage && Object.keys(STORAGE_FIELDS).some((key) => previousStorage[key] !== storage[key]),
   );
+  const publicUrl = validatePublicUrl(values.publicUrl || existing?.publicUrl || `http://localhost:${ports.uiPort}`);
+  if (values.mcpHttp === true || (values.mcpHttp === undefined && existing?.mcp.enabled))
+    mcpPublicConfiguration(publicUrl);
   return Object.freeze({
     name,
     ...ports,
     ...storage,
-    publicUrl: validatePublicUrl(values.publicUrl || `http://localhost:${ports.uiPort}`),
+    publicUrl,
     storage: values.storage,
     storageChanged,
     adminEmail: String(values.adminEmail).trim(),
@@ -257,6 +262,7 @@ export async function buildSetupConfiguration(values, context, filesystem) {
     apiKeyRateLimitMax: integer(values.apiKeyRateLimitMax, "Rate limit da chave de API"),
     apiKeyRateLimitWindow: integer(values.apiKeyRateLimitWindow, "Janela da chave de API"),
     existing: Boolean(existing),
+    mcpHttp: values.mcpHttp,
   });
 }
 
@@ -289,6 +295,7 @@ export function setupArguments(configuration, context) {
     String(configuration.apiKeyRateLimitWindow),
   ];
   if (configuration.disableRateLimit) args.push("--disable-rate-limit");
+  if (configuration.mcpHttp !== undefined) args.push(configuration.mcpHttp ? "--mcp-http" : "--no-mcp-http");
   if (configuration.storage === "volumes") args.push("--use-docker-volumes");
   else {
     for (const [name, flag] of [
@@ -344,6 +351,10 @@ export function composeArguments(instance, context, operation) {
     "--project-name",
     `biaws-${instance.name}`,
   ];
+  if (instance.env?.BIAWS_MCP_CONFIGURED === "true") {
+    base.push("--file", path.join(context.repositoryRoot, "compose.mcp.yaml"));
+    if (instance.env.BIAWS_MCP_HTTP_ENABLED === "true" || operation === "stop") base.push("--profile", "mcp-http");
+  }
   if (operation === "services") return [...base, "ps", "--all", "--services"];
   if (operation === "start") return [...base, "up", "-d", "--wait"];
   if (operation === "update") return [...base, "up", "-d", "--build", "--wait"];
@@ -376,9 +387,11 @@ export async function updateInstance(instance, context, filesystem, processRunne
     throw new CliError("A release mudou após a verificação; execute update novamente.", { code: "RELEASE_CHANGED" });
   }
   const existing = await operateInstance(instance, context, processRunner, "services", { environment });
-  const services = existing.output.split(/\s+/u).includes("monitor-executor")
-    ? ["mongo", "api", "ui", "monitor-executor"]
-    : [];
+  const services = ["mongo", "api", "ui"];
+  if (existing.output.split(/\s+/u).includes("monitor-executor")) services.push("monitor-executor");
+  if (instance.env.BIAWS_MCP_HTTP_ENABLED === "true") services.push("mcp");
+  else if (instance.env.BIAWS_MCP_CONFIGURED === "true")
+    await operateInstance(instance, context, processRunner, "stop", { services: ["mcp"], environment });
   const result = await operateInstance(instance, context, processRunner, "update", {
     environment: { ...environment, BIAWS_VERSION: normalized.version },
     services,