metheus-governance-mcp-cli 0.2.63 → 0.2.64

package/README.md

@@ -215,6 +215,8 @@ metheus-governance-mcp-cli bot show --provider telegram --bot-key main
 metheus-governance-mcp-cli bot add --provider telegram
 metheus-governance-mcp-cli bot edit --provider telegram
 metheus-governance-mcp-cli bot remove --provider telegram
+metheus-governance-mcp-cli bot set-default --provider telegram --bot-key main
+metheus-governance-mcp-cli bot migrate --provider telegram --bot-key main
 metheus-governance-mcp-cli bot global --provider telegram
 metheus-governance-mcp-cli bot verify --provider telegram --bot-key main
 ```
@@ -235,6 +237,8 @@ Behavior:
 - `bot verify` checks the configured local token and prints the current AI binding summary.
 - `bot show` prints one local bot entry in detail.
 - `bot global` edits Telegram-wide local settings such as API base URL, allowed updates, and default bot key.
+- `bot set-default` updates `TELEGRAM_DEFAULT_BOT_KEY`.
+- `bot migrate` moves legacy `TELEGRAM_BOT_TOKEN` into a named Telegram bot entry.
 
 Non-interactive examples:
 
@@ -242,6 +246,8 @@ Non-interactive examples:
 metheus-governance-mcp-cli bot global --provider telegram --non-interactive true --api-base-url http://127.0.0.1:8999/telegram --auto-clear-webhook false --allowed-updates message,edited_message,channel_post
 metheus-governance-mcp-cli bot add --provider telegram --non-interactive true --bot-key main --bot-id <server_bot_uuid> --token <telegram_bot_token> --role-profile monitor --client codex --permission-mode read_only --reasoning-effort low --default true
 metheus-governance-mcp-cli bot edit --provider telegram --bot-key main --non-interactive true --client claude --model claude-3.7-sonnet --permission-mode workspace_write --reasoning-effort medium
+metheus-governance-mcp-cli bot set-default --provider telegram --bot-key main --non-interactive true
+metheus-governance-mcp-cli bot migrate --provider telegram --bot-key main --bot-id <server_bot_uuid> --bot-name <telegram_username> --role-profile monitor --client codex --permission-mode read_only --reasoning-effort low --non-interactive true
 metheus-governance-mcp-cli bot remove --provider telegram --bot-key main --non-interactive true
 metheus-governance-mcp-cli bot verify --provider telegram --bot-key main --json true
 ```
@@ -276,6 +282,9 @@ Checks:
 - role profile -> local CLI availability
 - route dry-run / trigger-policy safety warnings
 - local provider token presence for active project destinations
+- enabled runner route -> local bot env binding resolution
+- enabled runner route -> server bot UUID cross-check
+- legacy `TELEGRAM_BOT_TOKEN` fallback still in use
 - codex/claude/gemini/antigravity/cursor registration state
 - gateway `tools/list` reachability
 - `project.summary` access

package/cli.mjs

@@ -240,6 +240,8 @@ function printUsage() {
       `  ${cmd} bot add [--provider <telegram|slack|kakaotalk>] [--base-url <url>] [--timeout-seconds <n>]`,
       `  ${cmd} bot edit [--provider <telegram|slack|kakaotalk>] [--base-url <url>] [--timeout-seconds <n>]`,
       `  ${cmd} bot remove [--provider <telegram|slack|kakaotalk>]`,
+      `  ${cmd} bot set-default --provider telegram [--bot-key <key>]`,
+      `  ${cmd} bot migrate --provider telegram [--bot-key <key>] [--bot-id <uuid>] [--bot-name <name>]`,
       `  ${cmd} bot verify [--provider <telegram|slack|kakaotalk>] [--bot-key <key>] [--timeout-seconds <n>] [--json <true|false>]`,
       `  ${cmd} bot global --provider telegram [--api-base-url <url>] [--auto-clear-webhook <true|false>] [--allowed-updates <csv>] [--default-bot-key <key>]`,
       `  ${cmd} doctor [--project-id <uuid>] [--ctxpack-key <key>] [--base-url <url>] [--timeout-seconds <n>] [--strict <true|false>]`,
@@ -3527,6 +3529,8 @@ async function runDoctor(flags) {
     includeDrafts: true,
   }, { defaultBaseURL: DEFAULT_BASE_URL });
   const rows = [];
+  let runnerConfig = null;
+  let enabledRoutes = [];
   const providerTemplates = ensureAllProviderEnvTemplates();
   const runnerTemplate = ensureBotRunnerConfigTemplate();
   for (const provider of PROVIDER_ENV_ORDER) {
@@ -3541,9 +3545,9 @@ async function runDoctor(flags) {
   if (runnerTemplate.error) {
     addDoctorCheck(rows, "warn", "local bot runner config", `${runnerTemplate.error} (${runnerTemplate.filePath})`);
   } else {
-    const runnerConfig = loadBotRunnerConfig({ persistIfNeeded: true });
+    runnerConfig = loadBotRunnerConfig({ persistIfNeeded: true });
     const runnerState = loadBotRunnerState();
-    const enabledRoutes = ensureArray(runnerConfig.routes).filter((routeRaw) => safeObject(routeRaw).enabled);
+    enabledRoutes = ensureArray(runnerConfig.routes).filter((routeRaw) => safeObject(routeRaw).enabled);
     if (!enabledRoutes.length) {
       addDoctorCheck(rows, "warn", "local bot runner config", `template ready (${runnerTemplate.filePath}), no enabled routes`);
     } else {
@@ -3662,6 +3666,82 @@ async function runDoctor(flags) {
         deps: buildDoctorChecksDeps(),
       });
     }
+
+    if (runnerConfig && enabledRoutes.length > 0) {
+      let serverBots = null;
+      try {
+        serverBots = await listUserBotsForRunner({
+          siteBaseURL: normalizeSiteBaseURL(context.baseURL),
+          token,
+          timeoutSeconds,
+        }, buildRunnerDataDeps());
+      } catch {
+        serverBots = null;
+      }
+      for (const routeRaw of enabledRoutes) {
+        const route = normalizeRunnerRoute(routeRaw);
+        const routeLabel = route.name || route.projectID || route.provider;
+        const envConfig = loadProviderEnvConfig(route.provider, {
+          botID: route.botID,
+          botName: route.botName,
+          route,
+        });
+        if (!envConfig.ok) {
+          addDoctorCheck(
+            rows,
+            "fail",
+            `runner route ${routeLabel} binding`,
+            `${providerEnvConfig(route.provider).label} local bot env is unresolved (${envConfig.error})`,
+          );
+          continue;
+        }
+        const detailParts = [];
+        if (envConfig.botKey) detailParts.push(`bot=${envConfig.botKey}`);
+        if (envConfig.botUsername) detailParts.push(`@${envConfig.botUsername}`);
+        if (envConfig.serverBotID) detailParts.push(`server_bot_id=${envConfig.serverBotID}`);
+        if (envConfig.client) detailParts.push(`ai=${envConfig.client}`);
+        addDoctorCheck(
+          rows,
+          "ok",
+          `runner route ${routeLabel} binding`,
+          detailParts.join(", ") || "resolved",
+        );
+        if (route.botID && envConfig.serverBotID && route.botID !== envConfig.serverBotID) {
+          addDoctorCheck(
+            rows,
+            strictMode ? "fail" : "warn",
+            `runner route ${routeLabel} server_bot_id`,
+            `route bot_id ${route.botID} != local env ${envConfig.serverBotID}`,
+          );
+        }
+        if (route.botID && !envConfig.serverBotID) {
+          addDoctorCheck(
+            rows,
+            strictMode ? "fail" : "warn",
+            `runner route ${routeLabel} server_bot_id`,
+            `route bot_id ${route.botID} is set, but local env entry does not carry SERVER_BOT_ID`,
+          );
+        }
+        if (serverBots && route.botID) {
+          const match = ensureArray(serverBots).find((bot) => String(bot.id || "").trim() === String(route.botID || "").trim());
+          addDoctorCheck(
+            rows,
+            match ? "ok" : (strictMode ? "fail" : "warn"),
+            `runner route ${routeLabel} server bot`,
+            match ? `${match.name || "(unnamed)"} [${match.role || "-"}]` : `server bot ${route.botID} not found`,
+          );
+        }
+      }
+      const telegramDefaultConfig = loadProviderEnvConfig("telegram");
+      if (telegramDefaultConfig.ok && !telegramDefaultConfig.botKey && String(telegramDefaultConfig.token || "").trim()) {
+        addDoctorCheck(
+          rows,
+          "warn",
+          "telegram legacy token",
+          "TELEGRAM_BOT_TOKEN fallback is still active; run bot migrate --provider telegram to move to named entries",
+        );
+      }
+    }
   }
 
   for (const cliBin of MCP_CLIENTS) {

package/lib/bot-commands.mjs

@@ -79,6 +79,8 @@ function printBotUsage(deps) {
       `  ${cliName} bot add [--provider <telegram|slack|kakaotalk>] [--non-interactive <true|false>] [--yes <true|false>]`,
       `  ${cliName} bot edit [--provider <telegram|slack|kakaotalk>] [--non-interactive <true|false>] [--bot-key <key>]`,
       `  ${cliName} bot remove [--provider <telegram|slack|kakaotalk>] [--non-interactive <true|false>] [--bot-key <key>]`,
+      `  ${cliName} bot set-default --provider telegram [--bot-key <key>] [--non-interactive <true|false>]`,
+      `  ${cliName} bot migrate --provider telegram [--bot-key <key>] [--bot-id <uuid>] [--bot-name <name>] [--keep-legacy-token <true|false>] [--non-interactive <true|false>]`,
       `  ${cliName} bot verify [--provider <telegram|slack|kakaotalk>] [--bot-key <key>] [--timeout-seconds <n>] [--json <true|false>]`,
       `  ${cliName} bot global --provider telegram [--non-interactive <true|false>] [--api-base-url <url>] [--auto-clear-webhook <true|false>] [--allowed-updates <csv>] [--default-bot-key <key>]`,
       "",
@@ -201,6 +203,10 @@ function removeTelegramEntry(parsedEnv, botKey) {
   return parsed;
 }
 
+function hasNamedTelegramEntry(parsedEnv, deps) {
+  return telegramEntriesForDisplay(parsedEnv, deps).length > 0;
+}
+
 function upsertTelegramEntry(parsedEnv, entry) {
   const parsed = removeTelegramEntry(parsedEnv, entry.key);
   const keys = telegramEntryEnvKeys(entry.key);
@@ -1194,6 +1200,8 @@ async function runBotSetup(ui, flags, deps) {
     { value: "add", label: "Add bot" },
     { value: "edit", label: "Edit bot" },
     { value: "remove", label: "Remove bot" },
+    { value: "set_default", label: "Set default bot" },
+    { value: "migrate", label: "Migrate legacy token" },
     { value: "verify", label: "Verify bot" },
     { value: "global", label: "Telegram global settings" },
   ];
@@ -1244,6 +1252,14 @@ async function runBotSetup(ui, flags, deps) {
     }
     return;
   }
+  if (action.value === "set_default" && provider === "telegram") {
+    await runBotSetDefault(ui, flags, deps);
+    return;
+  }
+  if (action.value === "migrate" && provider === "telegram") {
+    await runBotMigrate(ui, flags, deps);
+    return;
+  }
   if (action.value === "verify") {
     await verifyProviderEntry(ui, provider, flags, deps);
     return;
@@ -1344,6 +1360,77 @@ async function runBotVerify(ui, flags, deps) {
   await verifyProviderEntry(ui, provider, flags, deps);
 }
 
+async function runBotSetDefault(ui, flags, deps) {
+  const provider = String(flags.provider || "").trim()
+    ? requireDependency(deps, "normalizeBotProvider")(flags.provider)
+    : "telegram";
+  if (provider !== "telegram") {
+    throw new Error("bot set-default currently supports only --provider telegram");
+  }
+  const state = loadProviderEnvState("telegram", deps);
+  const parsed = { ...state.parsed };
+  const nonInteractive = boolFromRaw(flags["non-interactive"] ?? flags.yes, false);
+  const selected = nonInteractive
+    ? findTelegramEntryByFlags(parsed, flags, deps)
+    : await chooseTelegramEntry(ui, parsed, deps, "Select default Telegram bot");
+  if (!selected) {
+    throw new Error("Telegram bot selector is required for set-default");
+  }
+  parsed.TELEGRAM_DEFAULT_BOT_KEY = selected.key;
+  const filePath = writeProviderEnvState("telegram", parsed, deps);
+  process.stdout.write(`Set TELEGRAM_DEFAULT_BOT_KEY=${selected.key} in ${filePath}\n`);
+}
+
+async function runBotMigrate(ui, flags, deps) {
+  const provider = String(flags.provider || "").trim()
+    ? requireDependency(deps, "normalizeBotProvider")(flags.provider)
+    : "telegram";
+  if (provider !== "telegram") {
+    throw new Error("bot migrate currently supports only --provider telegram");
+  }
+  const state = loadProviderEnvState("telegram", deps);
+  const parsed = { ...state.parsed };
+  const legacyToken = String(parsed.TELEGRAM_BOT_TOKEN || "").trim();
+  if (!legacyToken) {
+    process.stdout.write("No legacy TELEGRAM_BOT_TOKEN value is set.\n");
+    return;
+  }
+  const nonInteractive = boolFromRaw(flags["non-interactive"] ?? flags.yes, false);
+  const normalizeBotKey = requireDependency(deps, "normalizeTelegramBotEnvKey");
+  const existingKeys = new Set(telegramEntriesForDisplay(parsed, deps).map((entry) => entry.key));
+  const defaultKeyHint = normalizeBotKey(flags["bot-key"] || parsed.TELEGRAM_DEFAULT_BOT_KEY || "main", "main");
+  const botKey = normalizeBotKey(
+    nonInteractive
+      ? String(flags["bot-key"] || defaultKeyHint).trim()
+      : await promptRequiredLine(ui, "Local Telegram bot key for migrated entry", defaultKeyHint),
+    defaultKeyHint,
+  );
+  if (existingKeys.has(botKey)) {
+    throw new Error(`Telegram bot key "${botKey}" already exists`);
+  }
+  const nextParsed = upsertTelegramEntry(parsed, {
+    key: botKey,
+    serverBotID: String(flags["server-bot-id"] || flags["bot-id"] || "").trim(),
+    username: requireDependency(deps, "normalizeTelegramBotUsername")(flags["bot-name"] || flags.username || ""),
+    token: legacyToken,
+    roleProfile: requireDependency(deps, "normalizeRunnerRoleProfileName")(flags["role-profile"] || ""),
+    client: requireDependency(deps, "normalizeLocalAIClientName")(flags.client || "", ""),
+    model: String(flags.model || "").trim(),
+    permissionMode: requireDependency(deps, "normalizeLocalAIPermissionMode")(flags["permission-mode"] || "", ""),
+    reasoningEffort: requireDependency(deps, "normalizeLocalAIReasoningEffort")(flags["reasoning-effort"] || "", ""),
+  });
+  if (!hasNamedTelegramEntry(parsed, deps) || !String(nextParsed.TELEGRAM_DEFAULT_BOT_KEY || "").trim()) {
+    nextParsed.TELEGRAM_DEFAULT_BOT_KEY = botKey;
+  }
+  if (!boolFromRaw(flags["keep-legacy-token"], false)) {
+    nextParsed.TELEGRAM_BOT_TOKEN = "";
+  }
+  const filePath = writeProviderEnvState("telegram", nextParsed, deps);
+  process.stdout.write(
+    `Migrated TELEGRAM_BOT_TOKEN to named entry "${botKey}" in ${filePath}${boolFromRaw(flags["keep-legacy-token"], false) ? " (legacy token preserved)" : ""}\n`,
+  );
+}
+
 async function runBotGlobal(ui, flags, deps) {
   const provider = String(flags.provider || "").trim()
     ? requireDependency(deps, "normalizeBotProvider")(flags.provider)
@@ -1389,6 +1476,14 @@ export async function runBotCommand(argv, deps) {
       await runBotRemove(ui, flags, deps);
       return;
     }
+    if (command === "set-default") {
+      await runBotSetDefault(ui, flags, deps);
+      return;
+    }
+    if (command === "migrate") {
+      await runBotMigrate(ui, flags, deps);
+      return;
+    }
     if (command === "verify") {
       await runBotVerify(ui, flags, deps);
       return;
@@ -1397,7 +1492,7 @@ export async function runBotCommand(argv, deps) {
       await runBotGlobal(ui, flags, deps);
       return;
     }
-    throw new Error("bot requires a subcommand: setup | list | show | add | edit | remove | verify | global");
+    throw new Error("bot requires a subcommand: setup | list | show | add | edit | remove | set-default | migrate | verify | global");
   } finally {
     ui.close();
   }

package/lib/selftest-bot-commands.mjs

@@ -294,6 +294,23 @@ export async function runSelftestBotCommands(push, deps) {
       `client=${String(editedState.TELEGRAM_BOT_MAIN_TEST_AI_CLIENT || "")} model=${String(editedState.TELEGRAM_BOT_MAIN_TEST_AI_MODEL || "")}`,
     );
 
+    await runCLI({
+      cliPath,
+      args: [
+        "bot", "set-default",
+        "--provider", "telegram",
+        "--bot-key", "main_test",
+        "--non-interactive", "true",
+      ],
+      env,
+    });
+    const defaultState = parseSimpleEnvText(fs.readFileSync(telegramEnvPath, "utf8"));
+    push(
+      "bot_set_default_updates_default_bot_key",
+      String(defaultState.TELEGRAM_DEFAULT_BOT_KEY || "") === "main_test",
+      `default=${String(defaultState.TELEGRAM_DEFAULT_BOT_KEY || "")}`,
+    );
+
     const verifyResult = await runCLI({
       cliPath,
       args: [
@@ -341,6 +358,37 @@ export async function runSelftestBotCommands(push, deps) {
       ensureArray(telegramEntry.entries).length === 0,
       `entries=${String(ensureArray(telegramEntry.entries).length)}`,
     );
+
+    const migratedEnv = parseSimpleEnvText(fs.readFileSync(telegramEnvPath, "utf8"));
+    migratedEnv.TELEGRAM_BOT_TOKEN = "legacy-selftest-token";
+    fs.writeFileSync(
+      telegramEnvPath,
+      Object.entries(migratedEnv).map(([key, value]) => `${key}=${String(value ?? "")}`).join("\n") + "\n",
+      "utf8",
+    );
+    await runCLI({
+      cliPath,
+      args: [
+        "bot", "migrate",
+        "--provider", "telegram",
+        "--bot-key", "legacy_main",
+        "--bot-id", mock.bots[0].id,
+        "--bot-name", "MonitorSelftestBot",
+        "--role-profile", "monitor",
+        "--client", "codex",
+        "--permission-mode", "read_only",
+        "--reasoning-effort", "low",
+        "--non-interactive", "true",
+      ],
+      env,
+    });
+    const migratedState = parseSimpleEnvText(fs.readFileSync(telegramEnvPath, "utf8"));
+    push(
+      "bot_migrate_converts_legacy_token_to_named_entry",
+      String(migratedState.TELEGRAM_BOT_LEGACY_MAIN_TOKEN || "") === "legacy-selftest-token"
+        && String(migratedState.TELEGRAM_BOT_TOKEN || "") === "",
+      `legacy_named=${String(migratedState.TELEGRAM_BOT_LEGACY_MAIN_TOKEN || "")} fallback=${String(migratedState.TELEGRAM_BOT_TOKEN || "")}`,
+    );
   } catch (err) {
     push("bot_commands_smoke", false, String(err?.message || err));
   } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "metheus-governance-mcp-cli",
-  "version": "0.2.63",
+  "version": "0.2.64",
   "description": "Metheus Governance MCP CLI (setup + stdio proxy)",
   "type": "module",
   "files": [