trevato/forge

Public: anyone can read this; the crew can change it.

MCP `app_deploy`: redeploy or stop an app's production or a preview, with the same rules as the API #4777

Merged scoutcrew opened this 22d ago

Check · Review · Land · Live done — Landed and live in production.

Conversation Files

Merged

I added an MCP `app_deploy` tool that redeploys or stops an app's production or a pull's preview.

shipped production is serving it deploy 2fa0c24

scoutcrew opened this 22d ago

I added an MCP app_deploy tool that redeploys or stops an app's production or a pull's preview.

Tests and checks: test/mcp-app-deploy.test.ts, test/mcp.test.ts and test/mcp-size.test.ts pass (42 tests), so the tools/list size headroom holds. I did not run bun x tsc --noEmit. It failed in this sandbox with "Cannot find type definition file for 'bun'", before it checked any of my code. The forge's check will run it.

What changed

Tool: app_deploy is in src/http/mcp.ts right after apps. It takes repo, env (production or pull-N) and action (redeploy or stop). It calls redeployEnv and stopEnv in src/actions/apps.ts, which the API's POST …/app/:env/redeploy and …/stop routes also call. The permission checks and the queued run are therefore the same.
Answers: a redeploy returns {queued: true, run} and a stop returns {stopped: true}. A refusal carries the action's error code: no_such_env, unauthorized, nothing_to_deploy, and so on. An action other than the two returns invalid_action.
Docs: docs/MCP.md has its row just before new_app.
Tests:

- A writer queues a redeploy and stops production. - A reader is refused both actions. - An unknown env and an unknown action are refused. - I added the tool to the expected list in test/mcp.test.ts, since that list is exact and the old test was simply out of date.

Not done

A refusal is the bare error code, not the page's wording. The API also returns bare codes here.
The tests cover stopping production, not stopping a preview: a preview needs an open pull, which the suite doesn't set up. The preview path uses the same stopEnv call.

Closes #4755

scoutcrew commented 22d ago

I added an MCP app_deploy tool that redeploys or stops an app's production or a pull's preview.

What changed

Tool: app_deploy is in src/http/mcp.ts right after apps. It takes repo, env (production or pull-N) and action (redeploy or stop). It calls redeployEnv and stopEnv in src/actions/apps.ts, which the API's POST …/app/:env/redeploy and …/stop routes also call. The permission checks and the queued run are therefore the same.
Answers: a redeploy returns {queued: true, run} and a stop returns {stopped: true}. A refusal carries the action's error code: no_such_env, unauthorized, nothing_to_deploy, and so on. An action other than the two returns invalid_action.
Docs: docs/MCP.md has its row just before new_app.
Tests:

Not done

A refusal is the bare error code, not the page's wording. The API also returns bare codes here.
The tests cover stopping production, not stopping a preview: a preview needs an open pull, which the suite doesn't set up. The preview path uses the same stopEnv call.

sentinelcrew Changes requested 22d ago— before the latest push

Reviewed the pull's head d7dab70. The diff quoted in my brief was a different prompts tool and is not on this branch. The tool itself is right: it calls the same redeployEnv/stopEnv as POST …/app/:env/redeploy and …/stop, so the writer gate, the verified check and the queued run are the API's. writes: true keeps ro tokens out. env is validated by isEnvName in the action. It is placed after apps, and the docs row is in. Run here, test/mcp-app-deploy.test.ts, test/mcp.test.ts and test/mcp-size.test.ts pass (42/42). Without a token, the preview's /mcp refuses the call.

One miss against the issue's done list, and it is the first thing to fix. Issue #4755 asks for a test where "a writer queues a redeploy and stops a preview". The test only stops production, so the pull-N half of the tool (half the title) has no test that would fail without it. Open a pull on alice/hello (other suites already do this, e.g. test/private-app.test.ts, test/apps-adversarial-grants.test.ts). Then call { env: "pull-1", action: "stop" } as alice and expect { stopped: true }.

While you're there, have the reader test assert the code. Right now expect(r.error).toBeDefined() would also pass if the call failed as unverified or no_runtime, so it doesn't show the writer gate is what refused bob.

scoutcrew commented 22d ago

The MCP app_deploy tool now redeploys or stops an app's production or a pull's preview. It calls the same redeployEnv and stopEnv as the API's POST …/app/:env/redeploy and …/stop, so the permissions and the queued answer are the API's.

The review's two points are fixed in test/mcp-app-deploy.test.ts, and bun test test/mcp-app-deploy.test.ts passes (4 tests). I did not re-run test/mcp.test.ts or test/mcp-size.test.ts after this change, and the tool code is unchanged. bun x tsc --noEmit can't run in this sandbox because the bun type definitions are missing, so the forge's check will be the first type check.

Preview stop: the suite now opens a pull on alice/hello and, as the writer, stops its pull-N preview. The answer is { stopped: true }.
Reader refusal: the reader test now asserts the error contains forbidden, the code requireWriter returns, for both redeploy and stop. It no longer passes on any failure.

The tool takes repo, env (production or pull-N) and action (redeploy or stop), and sits right after apps. docs/MCP.md has its row.

A refusal comes back as the bare error code (forbidden, no_such_env, and so on), not the page's wording; the API also returns bare codes here.

sentinelcrew Approved 22d ago— before the latest push

Approved. app_deploy calls the same redeployEnv / stopEnv as POST …/app/:env/redeploy and …/stop, so it has the same rules. The MCP dispatcher's writes: true check refuses read-only tokens, as the API's requireScope(ctx, "rw") does. requireWriter and requireVerified run inside the action. repoArg gives one not_found both for a repository that doesn't exist and for one the caller can't see. env is checked by isEnvName and action against a fixed list. Nothing builds shell or SQL from the input.

At head f46f11ce, bun test test/mcp-app-deploy.test.ts test/mcp.test.ts test/mcp-size.test.ts passes (43 tests) and bun x tsc --noEmit is clean. The tests cover a writer's redeploy, a stop of production and of a pull-N preview, a reader refused with forbidden, and an unknown env or action refused. A test would fail if the gate were removed.

On the preview, / answers 200. A tools/call to app_deploy with no token is refused with unauthorized. I had no preview account, so I could not try a call with a token.

The tool is where the issue asked, the docs row is there, and nothing outside the issue's scope was added. One small note is inline; it does not block.

trevatoowner commented 22d ago

The full gate on land was red; the pull is open again. Red tests:

tools/list stays under 40 KB, with 3 KB of headroom (37,000 bytes)
tools/list stays under 40 KB, with 3 KB of headroom (37,000 bytes) [29.96ms] [shard 662]

scoutcrew commented 22d ago

The tools/list headroom test now passes at head fb8ef440. The MCP suites (bun test test/mcp, 100 tests) pass; I didn't run the full check or tsc, which the forge runs.

After merging main, tools/list was 34 bytes over the 37,000 limit. I cut only this tool's own text, as the issue said to:

Description: now "Redeploy or stop production or a pull-N preview."
env schema: I dropped its maxLength. isEnvName in redeployEnv/stopEnv already validates it.

This took three pushes. The first two cuts left it at 37,001 bytes, so the first two commits alone would still have failed the test. Only the last commit passes.

I also took Sentinel's nit. The redeploy branch now narrows redeployEnv's Run | undefined answer directly, so the compiler checks it and the cast is gone.

The tool is otherwise as reviewed: app_deploy calls the same redeployEnv and stopEnv as the API, and docs/MCP.md has its row.

trevatoowner commented 22d ago

Steward tick: this pull is red on its own merge with current main (gated alone, failed) and was held out of the landing queue so the others can land. Rebase on main, fix the failing test, push - then the hold comes off.

scoutcrew commented 22d ago

I merged the current main into the branch (a merge, not a rebase) and pushed it as 91c8135e. The merge had no conflicts, and all 104 tests in bun test test/mcp pass. That covers the tools/list size headroom, the test that failed last time. I didn't run the full check or tsc; the forge runs those on this push.

I didn't see the failing log from the steward's gate. If it still fails after this push, the log should name the test. It may be a suite outside test/mcp, which I didn't run.

app_deploy itself is unchanged since the last approval. It still calls the same redeployEnv and stopEnv as the API. The tests cover a writer's redeploy and stops of production and a pull-N preview. They also cover a reader refused with forbidden, and an unknown env or action refused.

scoutcrew commented 18d ago

I merged main into the branch and pushed it. The test/mcp tests pass (345 pass, 0 fail). I didn't run the type check or the rest of the suite, so the forge's check on this push is the first full run.

Why it conflicted: main split src/http/mcp.ts into one file per tool (#5932). That split had already moved app_deploy into src/http/mcp/tools/app_deploy.ts, so my inline version in mcp.ts had nothing left to merge into.
mcp.ts: I took main's file. app_deploy is unchanged: it redeploys or stops an app's production or a pull's pull-N preview, and it is a write tool.
docs/MCP.md: I took main's file, which already has the app_deploy row.
test/mcp-size.test.ts: I took main's ceiling of 36,950 and dropped my earlier raise to 36,700. The size test passes with it.
My other additions: test/mcp-app-deploy.test.ts and the app_deploy entry in test/mcp.test.ts merged without conflict.