premanmcp 0.10.6 → 0.10.7

package/bin/verify.js

@@ -18,6 +18,7 @@
  * unless the repository has explicitly opted into blocking.
  */
 
+import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -25,7 +26,7 @@ import path from "node:path";
 import { changedFilesForPush, readChangedFiles, readPushRefsFromStdin, repoRoot } from "./changed.js";
 import { resolveLocalTarget } from "./detect.js";
 import { createReporter } from "./progress.js";
-import { backendUrl, callBackendJson, cliInvocation, makeArgs, resolveApiKey } from "./shared.js";
+import { backendUrl, callBackendJson, cliInvocation, makeArgs, nowMs, resolveApiKey } from "./shared.js";
 
 export const VERIFY_HELP = `
 Verify options:
@@ -42,6 +43,10 @@ Verify options:
 const DEFAULT_TIMEOUT_SECONDS = 120;
 const REQUEST_TIMEOUT_MS = 10_000;
 const CONCURRENCY = 6;
+const INVENTORY_PAGE_SIZE = 200;
+const INVENTORY_MAX_ENDPOINTS = 2000;
+// POST /projects/{id}/api-runs rejects more than this (schemas.pulse.MAX_UPLOAD_RUNS).
+const UPLOAD_BATCH_SIZE = 200;
 const READ_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 // Never fired automatically even against loopback: a destructive verb that
 // happens to point at a real datastore is not made safe by the port being local.
@@ -55,10 +60,6 @@ const REPO_CONFIG = ".preman.json";
 // push — the exact failure the advisory guarantee exists to prevent.
 export const BLOCK_EXIT_CODE = 97;
 
-function nowMs() {
-  return Number(process.hrtime.bigint() / 1000000n);
-}
-
 function originLabel() {
   const raw = `${os.hostname() || "local"}`.toLowerCase();
   const cleaned = raw.replace(/[^a-z0-9._-]/g, "-").replace(/^[^a-z0-9]+/, "");
@@ -103,7 +104,7 @@ async function runCase(baseUrl, endpoint, { batchId }) {
       client_run_id: `${batchId}:${method}:${endpoint.path_template || endpoint.path}`,
       method,
       url: target,
-      status: "errored",
+      status: "error",
       http_status: null,
       latency_ms: nowMs() - t0,
       error_message: aborted ? `timed out after ${REQUEST_TIMEOUT_MS}ms` : String(error?.message || error),
@@ -201,7 +202,7 @@ async function runGeneratedCase(testCase, { batchId, endpoint }) {
       endpoint: `${endpoint.method} ${endpoint.path}`,
       method,
       url: testCase.url,
-      status: "errored",
+      status: "error",
       http_status: null,
       latency_ms: nowMs() - t0,
       error_message: aborted ? `timed out after ${REQUEST_TIMEOUT_MS}ms` : String(error?.message || error),
@@ -239,19 +240,66 @@ async function safeCall(args, method, routePath, options) {
 }
 
 async function fetchInventory(args, token) {
-  const result = await safeCall(args, "POST", "/mcp/call-tool", {
-    token,
-    json: { tool: "get_endpoints", arguments: { format: "json" } },
-  });
-  if (!result.ok) return { endpoints: [], error: result.detail || `status ${result.status_code}` };
-
-  const payload = result.result ?? result.data ?? result;
-  const endpoints =
-    payload?.endpoints ||
-    payload?.result?.endpoints ||
-    (Array.isArray(payload) ? payload : []) ||
-    [];
-  return { endpoints: Array.isArray(endpoints) ? endpoints : [] };
+  const endpoints = [];
+  for (let offset = 0; offset < INVENTORY_MAX_ENDPOINTS; offset += INVENTORY_PAGE_SIZE) {
+    const result = await safeCall(args, "POST", "/mcp/call-tool", {
+      token,
+      json: {
+        tool: "get_endpoints",
+        arguments: { format: "json", limit: INVENTORY_PAGE_SIZE, offset },
+      },
+    });
+    if (!result.ok) {
+      return {
+        endpoints,
+        error: result.detail || `status ${result.status_code}`,
+      };
+    }
+
+    const payload = result.result ?? result.data ?? result;
+    const page =
+      payload?.endpoints ||
+      payload?.result?.endpoints ||
+      (Array.isArray(payload) ? payload : []) ||
+      [];
+    const rows = Array.isArray(page) ? page : [];
+    endpoints.push(...rows);
+    const pagination = payload?.pagination || payload?.result?.pagination;
+    if (!pagination?.has_more || rows.length === 0) break;
+    if (offset + INVENTORY_PAGE_SIZE >= INVENTORY_MAX_ENDPOINTS) {
+      return {
+        endpoints,
+        error: `endpoint inventory exceeds the ${INVENTORY_MAX_ENDPOINTS}-endpoint verification limit`,
+        incomplete: true,
+      };
+    }
+  }
+  return { endpoints };
+}
+
+async function uploadRuns(args, { token, projectId, batchId, runs }) {
+  if (!projectId || !runs.length) return { inserted: 0, error: null };
+  let inserted = 0;
+  for (let offset = 0; offset < runs.length; offset += UPLOAD_BATCH_SIZE) {
+    const chunk = runs.slice(offset, offset + UPLOAD_BATCH_SIZE);
+    const upload = await safeCall(args, "POST", `/projects/${projectId}/api-runs`, {
+      token,
+      json: {
+        origin: "local",
+        origin_label: originLabel(),
+        source: "ci",
+        batch_id: batchId,
+        batch_label: "pre-push verify",
+        runs: chunk,
+      },
+    });
+    if (!upload.ok) {
+      const detail = upload.detail || (upload.status_code ? `HTTP ${upload.status_code}` : "request failed");
+      return { inserted, error: `verification results were not uploaded: ${detail}` };
+    }
+    inserted += Number(upload.inserted || 0);
+  }
+  return { inserted, error: null };
 }
 
 function selectMethods(args) {
@@ -390,7 +438,7 @@ async function runPlan(
     stream: asJson ? process.stderr : process.stdout,
     live: asJson ? false : undefined,
   });
-  const batchId = `prepush-${Date.now().toString(36)}`;
+  const batchId = randomUUID();
   const changes = plan.changes || [];
 
   if (!asJson) {
@@ -449,21 +497,8 @@ async function runPlan(
   );
   const removed = changes.filter((c) => c.change_type === "removed");
 
-  let uploaded = 0;
-  if (projectId && completed.length) {
-    const upload = await safeCall(args, "POST", `/projects/${projectId}/api-runs`, {
-      token,
-      json: {
-        origin: "local",
-        origin_label: originLabel(),
-        source: "ci",
-        batch_id: batchId,
-        batch_label: "pre-push verify",
-        runs: completed,
-      },
-    });
-    if (upload.ok) uploaded = Number(upload.inserted || 0);
-  }
+  const upload = await uploadRuns(args, { token, projectId, batchId, runs: completed });
+  const uploaded = upload.inserted;
 
   const gate = blockOnBreaking(args, root);
   const shouldBlock = gate.blocking && (breaking.length > 0 || removed.length > 0);
@@ -479,6 +514,7 @@ async function runPlan(
     }
     if (withheld) reporter.line(`[preman] ${withheld} mutating case${withheld === 1 ? "" : "s"} withheld`);
     if (uploaded) reporter.line(`[preman] uploaded ${uploaded} run${uploaded === 1 ? "" : "s"}`);
+    if (upload.error) reporter.line(`[preman] ${upload.error}`);
     if (shouldBlock) {
       reporter.line(`[preman] blocking this push (${gate.from}). Set PREMAN_SKIP_HOOK=1 to override.`);
     } else if (breaking.length || removed.length) {
@@ -518,6 +554,7 @@ async function runPlan(
       error: r.error_message || null,
     })),
     uploaded,
+    upload_error: upload.error,
     // Advisory unless the repository opted in. `advisory` only flattens an
     // unexpected throw; a deliberate block has to survive it.
     exitCode: shouldBlock ? BLOCK_EXIT_CODE : 0,
@@ -589,7 +626,8 @@ async function runVerify(args) {
   }
 
   const extraPorts = args.value("--port", "") ? [args.value("--port", "")] : [];
-  const resolved = await resolveLocalTarget([...planEndpoints, ...endpoints], {
+  const confirmationEndpoints = planEndpoints.length ? planEndpoints : endpoints;
+  const resolved = await resolveLocalTarget(confirmationEndpoints, {
     extraPorts,
     timeoutMs: 2000,
   });
@@ -605,6 +643,7 @@ async function runVerify(args) {
 
   const target = resolved.target;
   const policy = selectMethods(args);
+  const targetInventory = resolved.inventory || endpoints;
 
   if (planned.plan?.selected?.length) {
     return finish(
@@ -623,7 +662,7 @@ async function runVerify(args) {
     );
   }
 
-  const selected = endpoints.filter((ep) => {
+  const selected = targetInventory.filter((ep) => {
     const method = String(ep.method || "GET").toUpperCase();
     if (READ_METHODS.has(method)) return true;
     if (DESTRUCTIVE_METHODS.has(method)) return false;
@@ -638,7 +677,7 @@ async function runVerify(args) {
     );
   }
 
-  const batchId = `prepush-${Date.now().toString(36)}`;
+  const batchId = randomUUID();
   const runs = await runPool(
     selected,
     (endpoint) =>
@@ -650,21 +689,8 @@ async function runVerify(args) {
   const completed = runs.filter(Boolean);
   const failed = completed.filter((r) => r.status !== "passed");
 
-  let uploaded = 0;
-  if (projectId && completed.length) {
-    const upload = await safeCall(args, "POST", `/projects/${projectId}/api-runs`, {
-      token,
-      json: {
-        origin: "local",
-        origin_label: originLabel(),
-        source: "ci",
-        batch_id: batchId,
-        batch_label: "pre-push verify",
-        runs: completed,
-      },
-    });
-    if (upload.ok) uploaded = Number(upload.inserted || 0);
-  }
+  const upload = await uploadRuns(args, { token, projectId, batchId, runs: completed });
+  const uploaded = upload.inserted;
 
   const outcome = {
     state: failed.length ? "failed" : "passed",
@@ -678,6 +704,7 @@ async function runVerify(args) {
       error: r.error_message || null,
     })),
     uploaded,
+    upload_error: upload.error,
     // Advisory by construction: a real failure still reports zero so the push
     // proceeds. The report is the product, not the gate.
     exitCode: 0,
@@ -695,6 +722,7 @@ async function runVerify(args) {
       process.stdout.write(`[preman] all ${completed.length} endpoints healthy\n`);
     }
     if (uploaded) process.stdout.write(`[preman] uploaded ${uploaded} run${uploaded === 1 ? "" : "s"}\n`);
+    if (upload.error) process.stdout.write(`[preman] ${upload.error}\n`);
   }
 
   return finish({ ...outcome, message: null });

package/dist/server.js

@@ -393,6 +393,7 @@ export function createServer() {
             "- 'preview my MCP before deploying': mcp_preview (read-only). 'actually deploy': mcp_deploy.",
             "- 'test the login endpoint' / 'hit POST /auth/login with body': test_api with the full URL. Use test_endpoint_by_id ONLY when the user references a saved endpoint by id/uuid.",
             "- 'import my Postman/OpenAPI/Bruno/curl collection': import_collection.",
+            "- 'migrate / move / switch from Postman', 'bring my Postman workspace over': migrate_from_postman — it imports AND creates scheduled suites, environments and alerts in one call. Prefer it over import_collection whenever the user frames this as leaving Postman.",
             "- 'generate tests for endpoint X' / 'write unit tests for X and run them': generate_endpoint_tests (set include_code=true and write the returned code_artifacts to disk when the user wants test files).",
             "- 'stress / load test X': run_stress_test. Read-only unless the user explicitly authorises writes — never set allow_writes yourself.",
             "- After discover_endpoints_from_codebase, call register_discovered_endpoints with the JSON array it asked for, then verify_endpoints_live to confirm they respond.",
@@ -410,6 +411,7 @@ export function createServer() {
             "2. **Import then generate**: import_collection (Postman/OpenAPI/curl) -> generate_tests -> test_api to run them.",
             '3. **Coverage audit**: get_coverage on a collection -> generate_tests(coverage_level="comprehensive") for gaps.',
             "4. **Drift detection**: detect_drift with a collection + base_url -> test_api on drifted endpoints.",
+            "5. **Postman migration**: migrate_from_postman -> review next_steps (base URLs, secrets needing values) -> re-run with activate=true -> failures open fix tasks you collect with preman_get_fix_task.",
             "",
             "## Auth",
             "PreMan API tools (get_endpoints, test_api, …) need an pm_live_ key. Preferred no-browser flow: user_auth_start_signup -> user_auth_set_password -> preman_create_api_key, or user_auth_login -> preman_create_api_key. Browser fallback: preman_login -> preman_login_complete.",
@@ -665,6 +667,57 @@ export function createServer() {
             });
         }
     });
+    // ── migrate_from_postman ──────────────────────────────────────────
+    server.tool("migrate_from_postman", "Move a Postman collection into PreMan, fully wired, in one call. Converts the collection keeping the assertions its pm.test blocks declared, splits the environment into shared variables and encrypted secrets, and creates one scheduled test suite per request seeded from those assertions. Suites are created switched OFF; pass activate=true to start them and attach alert rules so a failing check opens a fix task. Returns next_steps — the honest list of what still needs a human.", {
+        content: z.string().optional().describe("Raw Postman collection export (v2.x JSON)"),
+        collection_id: z.string().optional().describe("Pull from a connected Postman workspace instead of pasting content"),
+        environment: z.string().optional().describe("Raw Postman environment export (JSON)"),
+        name: z.string().optional().describe("Override the collection name"),
+        project_id: z.string().optional().describe("Scope the migration to a project"),
+        activate: z.boolean().optional().default(false).describe("Start the suites and create alert rules. Leave false to review first."),
+        channel_ids: z.array(z.string()).optional().describe("Alert channels to notify. Empty still records events and opens fix tasks."),
+        autofix_enabled: z.boolean().optional().default(false).describe("Let a failure dispatch to the coding agent automatically"),
+        include_yaml: z.boolean().optional().default(false).describe("Include the full .ot.yaml string (default false to save tokens)"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("migrate_from_postman", args);
+            const collectionId = result?.collection_id ?? "";
+            const dashPath = collectionId ? `/collections?id=${collectionId}` : "/collections";
+            emitActivity("navigate", { path: dashPath });
+            emitActivity("data_refresh", { scope: "collections" });
+            return withFrontendUrl({ ...result, ...agentSessionPayload(dashPath) }, dashPath);
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: [
+                    "Provide either content (a Postman v2.x export) or collection_id from a connected Postman workspace.",
+                    "Connect a workspace at /integrations/postman/connect to use collection_id.",
+                ],
+                related_tools: ["import_collection", "get_endpoints"],
+            });
+        }
+    });
+    // ── recover_assertions ────────────────────────────────────────────
+    server.tool("recover_assertions", "Hand back assertions you translated from a Postman script PreMan could not read. An import's migration_report lists every dropped pm.test block with the script attached under entries[].source — read that JavaScript, convert what it checks, and call this. The assertion lands on the collection endpoint, its workbench request and the scheduled suite, so the next run grades it. Each assertion accepts: status (int or '2xx'), status_not (int), response_time_ms ('< 500'), json_paths ({'json.id': 7}, or 'exists' to require a field).", {
+        collection_id: z.string().describe("The collection the import created"),
+        endpoint_id: z.string().describe("entries[].endpoint_id from the migration report (or the endpoint name)"),
+        assertions: z.array(z.record(z.any())).describe("The converted assertions"),
+    }, async (args) => {
+        try {
+            const result = await callBackend("recover_assertions", args);
+            emitActivity("data_refresh", { scope: "collections" });
+            return { content: [{ type: "text", text: JSON.stringify(result) }] };
+        }
+        catch (e) {
+            return toolError(e.message, inferErrorCode(e.message), {
+                next_actions: [
+                    "Check collection_id and endpoint_id against the migration_report entries.",
+                    "Each assertion must use the documented fields: status, status_not, response_time_ms, json_paths.",
+                ],
+                related_tools: ["get_collection", "migrate_from_postman"],
+            });
+        }
+    });
     // ── detect_drift ──────────────────────────────────────────────────
     server.tool("detect_drift", "Detect spec drift by comparing live API responses against a collection spec. Returns a list of drift alerts per endpoint with expected vs actual differences.", {
         base_url: z.string().describe("Base URL to test against (e.g. https://api.example.com)"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "0.10.6",
+  "version": "0.10.7",
   "description": "Turn APIs into agent-callable MCP tools with auth, testing, and audit logs",
   "type": "module",
   "bin": {
@@ -15,7 +15,7 @@
     "open-mcp-preview-in-cursor": "node scripts/open-cursor-preview.mjs",
     "test": "npm run build && npm run test:connect && npm run test:node",
     "test:connect": "node scripts/smoke-connect.mjs",
-    "test:node": "node --test --test-timeout=90000 scripts/smoke-launcher-config.mjs scripts/smoke-runner.mjs scripts/smoke-repo-config.mjs scripts/smoke-onboard.mjs scripts/smoke-local-detect.mjs scripts/smoke-prepush-hook.mjs scripts/smoke-cli-identity.mjs scripts/smoke-runner-heartbeat.mjs scripts/smoke-verify-prepush.mjs scripts/smoke-push-diff.mjs scripts/smoke-progress-reporter.mjs scripts/smoke-verify-plan.mjs scripts/smoke-install-desktop.mjs scripts/smoke-api-tools.mjs scripts/smoke-bin-scope.mjs"
+    "test:node": "node --test --test-timeout=90000 scripts/smoke-account.mjs scripts/smoke-cli-entrypoint.mjs scripts/smoke-launcher-config.mjs scripts/smoke-runner.mjs scripts/smoke-repo-config.mjs scripts/smoke-onboard.mjs scripts/smoke-local-detect.mjs scripts/smoke-prepush-hook.mjs scripts/smoke-cli-identity.mjs scripts/smoke-runner-heartbeat.mjs scripts/smoke-verify-prepush.mjs scripts/smoke-push-diff.mjs scripts/smoke-progress-reporter.mjs scripts/smoke-verify-plan.mjs scripts/smoke-install-desktop.mjs scripts/smoke-api-tools.mjs scripts/smoke-tests-workbench.mjs scripts/smoke-bin-scope.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^0.1.0",