CB-572: reject profile names as send targets

bridged/src/test/java/dev/ltms/bridged/mcp/BridgeMcpTest.java

@@ -53,6 +53,18 @@ class BridgeMcpTest {
         return ((McpSchema.TextContent) r.content().getFirst()).text();
     }
 
+    private void assertSendRoundTrips(String target, Set<String> profiles) throws Exception {
+        CompletableFuture<McpSchema.CallToolResult> send = CompletableFuture.supplyAsync(
+                () -> BridgeMcp.send(messages, target, "hi", 4000L, null, profiles));
+        long deadline = System.currentTimeMillis() + 3000;
+        while (!rendezvous.isWaiting(target) && System.currentTimeMillis() < deadline) {
+            Thread.sleep(5);
+        }
+        assertTrue(rendezvous.isWaiting(target), "send should be accepted for " + target);
+        BridgeMcp.reply(messages, target, "received");
+        assertEquals("received", textOf(send.get(6, TimeUnit.SECONDS)));
+    }
+
     private static ClaudeCodeLauncher workerService(FakeHerdr h, String baseUrl, Set<String> allow) {
         BridgedConfig.Profile cfg = new BridgedConfig.Profile(
                 "ltms-local", baseUrl, "coder", null, "BRIDGED_WORKER_TOKEN", null,
@@ -140,6 +152,31 @@ class BridgeMcpTest {
         assertTrue(BridgeMcp.send(messages, "term_a", "  ", null).isError());
     }
 
+    @Test
+    void sendRejectsAConfiguredProfileNameBeforeAcceptingIt() {
+        McpSchema.CallToolResult blocking = BridgeMcp.send(messages, "sol", "hi", 100L, null, Set.of("sol"));
+        McpSchema.CallToolResult async = BridgeMcp.sendAsync(messages, "sol", "hi", null, Set.of("sol"));
+
+        assertTrue(blocking.isError());
+        assertTrue(async.isError());
+        assertTrue(textOf(blocking).contains("sol"));
+        assertTrue(textOf(blocking).contains("configured profile name"));
+        assertTrue(textOf(blocking).contains("bridge_list"));
+        assertFalse(textOf(async).contains("ticket="));
+    }
+
+    @Test
+    void sendAllowsPeerLeadMemberAndUnclassifiedTargets() throws Exception {
+        Set<String> profiles = Set.of("sol");
+
+        assertSendRoundTrips("term_peer_lead", profiles);
+        assertSendRoundTrips("term_live_member", profiles);
+
+        // A herdr-owned pane outside the bridge roster cannot be classified at accept time.
+        McpSchema.CallToolResult result = BridgeMcp.send(messages, "external-pane", "hi", 10L, null, profiles);
+        assertFalse(result.isError(), "an unclassified target must not be rejected at acceptance time");
+    }
+
     @Test
     void replyWithNoPendingSendIsQueuedNotError() {
         // CB-307: a reply with no open send is now queued in the inbox, not an error.