@andypai/agent-kanban 0.6.2 → 0.6.3

package/src/__tests__/mcp-server.test.ts

@@ -5,6 +5,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { addTask, initSchema, seedDefaultColumns } from '../db'
 import { createTrackerCore, createTrackerMcpServer, TrackerMcpError } from '../mcp/index'
 import { LocalProvider } from '../providers/local'
+import { VERSION } from '../version'
 
 interface TestScope {
   actor: string
@@ -130,6 +131,22 @@ describe('createTrackerMcpServer', () => {
     }
   })
 
+  test('advertises the package version rather than a hard-coded one', async () => {
+    const runtime = startTrackerServer()
+    const transport = new StreamableHTTPClientTransport(runtime.url, {
+      requestInit: { headers: { Authorization: 'Bearer good-token' } },
+    })
+    const client = new Client({ name: 'test-client', version: '1.0.0' })
+
+    try {
+      await client.connect(transport)
+      expect(client.getServerVersion()?.version).toBe(VERSION)
+    } finally {
+      await client.close()
+      await runtime.close()
+    }
+  })
+
   test('round-trips updateComment end-to-end, handing the existing comment to the policy', async () => {
     const task = addTask(db, 'MCP task')
     const created = await provider.comment(task.id, 'original body')

package/src/__tests__/metrics-spec.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, test } from 'bun:test'
+import { assembleBoardMetrics, classifyColumnRoles } from '../metrics-spec'
+import type { ActivityEntry } from '../types'
+
+const columnCounts = [
+  { id: 'c1', name: 'Backlog', position: 0, count: 4 },
+  { id: 'c2', name: 'In Progress', position: 1, count: 2 },
+  { id: 'c3', name: 'Done', position: 2, count: 3 },
+]
+
+describe('assembleBoardMetrics', () => {
+  test('normalizes priority order by severity regardless of input order', () => {
+    const metrics = assembleBoardMetrics({
+      columnCounts,
+      // Deliberately unsorted / alphabetical-ish to prove the spec re-orders.
+      priorityCounts: [
+        { priority: 'low', count: 1 },
+        { priority: 'urgent', count: 2 },
+        { priority: 'medium', count: 3 },
+        { priority: 'high', count: 4 },
+      ],
+      totalTasks: 9,
+      tasksCreatedThisWeek: 5,
+      avgCompletionHours: 12,
+      recentActivity: [],
+      assignees: ['amy'],
+      projects: ['Dispatch'],
+    })
+    expect(metrics.tasksByPriority.map((row) => row.priority)).toEqual([
+      'urgent',
+      'high',
+      'medium',
+      'low',
+    ])
+  })
+
+  test('derives completed / in-progress counts and completion percent from column roles', () => {
+    const metrics = assembleBoardMetrics({
+      columnCounts,
+      priorityCounts: [],
+      totalTasks: 9,
+      tasksCreatedThisWeek: 0,
+      avgCompletionHours: null,
+      recentActivity: [],
+      assignees: [],
+      projects: [],
+    })
+    expect(metrics.completedTasks).toBe(3) // Done column
+    expect(metrics.inProgressCount).toBe(2) // In Progress column
+    expect(metrics.completionPercent).toBe(33) // round(3/9 * 100)
+    expect(metrics.tasksByColumn).toEqual([
+      { column_name: 'Backlog', count: 4 },
+      { column_name: 'In Progress', count: 2 },
+      { column_name: 'Done', count: 3 },
+    ])
+  })
+
+  test('completion percent is zero when there are no tasks', () => {
+    const metrics = assembleBoardMetrics({
+      columnCounts: [{ id: 'c1', name: 'Backlog', position: 0, count: 0 }],
+      priorityCounts: [],
+      totalTasks: 0,
+      tasksCreatedThisWeek: 0,
+      avgCompletionHours: null,
+      recentActivity: [],
+      assignees: [],
+      projects: [],
+    })
+    expect(metrics.completionPercent).toBe(0)
+    expect(metrics.completedTasks).toBe(0)
+  })
+
+  test('passes through avg hours, activity, assignees, and projects unchanged', () => {
+    const activity: ActivityEntry[] = [
+      {
+        id: 'a1',
+        task_id: 't1',
+        action: 'created',
+        field_changed: null,
+        old_value: null,
+        new_value: 'Task',
+        timestamp: '2026-01-01T00:00:00Z',
+      },
+    ]
+    const metrics = assembleBoardMetrics({
+      columnCounts,
+      priorityCounts: [],
+      totalTasks: 9,
+      tasksCreatedThisWeek: 5,
+      avgCompletionHours: 7.5,
+      recentActivity: activity,
+      assignees: ['amy', 'bob'],
+      projects: ['Dispatch'],
+    })
+    expect(metrics.avgCompletionHours).toBe(7.5)
+    expect(metrics.recentActivity).toBe(activity)
+    expect(metrics.tasksCreatedThisWeek).toBe(5)
+    expect(metrics.assignees).toEqual(['amy', 'bob'])
+    expect(metrics.projects).toEqual(['Dispatch'])
+  })
+})
+
+describe('classifyColumnRoles', () => {
+  test('recognizes done/in-progress synonyms and falls back to the terminal column', () => {
+    const roles = classifyColumnRoles([
+      { id: 'c1', name: 'Backlog', position: 0 },
+      { id: 'c2', name: 'WIP', position: 1 },
+      { id: 'c3', name: 'Shipped', position: 2 },
+    ])
+    expect(roles.doneColumnIds).toEqual(['c3'])
+    expect(roles.inProgressColumnIds).toEqual(['c2'])
+  })
+
+  test('falls back to the last column when no name reads as done', () => {
+    const roles = classifyColumnRoles([
+      { id: 'c1', name: 'Backlog', position: 0 },
+      { id: 'c2', name: 'Later', position: 1 },
+    ])
+    expect(roles.doneColumnIds).toEqual(['c2'])
+  })
+})

package/src/__tests__/postgres-linear-provider.test.ts

@@ -106,10 +106,14 @@ function linearFetchStub(calls: LinearStubCall[] = []): typeof fetch {
       return Response.json({ data: { team } })
     }
     if (query.includes('query Users')) {
-      return Response.json({ data: { users } })
+      return Response.json({
+        data: { users: { ...users, pageInfo: { hasNextPage: false, endCursor: null } } },
+      })
     }
     if (query.includes('query Projects')) {
-      return Response.json({ data: { projects } })
+      return Response.json({
+        data: { projects: { ...projects, pageInfo: { hasNextPage: false, endCursor: null } } },
+      })
     }
     if (query.includes('query IssueLabels')) {
       return Response.json({
@@ -121,6 +125,10 @@ function linearFetchStub(calls: LinearStubCall[] = []): typeof fetch {
         },
       })
     }
+    if (query.includes('query IssueById')) {
+      const issue = issues.find((candidate) => candidate.id === variables.id) ?? null
+      return Response.json({ data: { issue } })
+    }
     if (query.includes('query Issues')) {
       return Response.json({
         data: {

package/src/__tests__/postgres-local-provider.test.ts

@@ -113,6 +113,146 @@ describe('postgres local provider', () => {
     expect(comments[0]!.body).toBe('Projection comment stored in Postgres')
   })
 
+  pgTest('logs activity for project/description/metadata updates and comment writes', async () => {
+    const runtime = await openKanbanRuntime()
+    try {
+      const provider = runtime.provider
+      const created = await provider.createTask({ title: 'Activity task' })
+      await provider.updateTask(created.id, {
+        project: 'Dispatch',
+        description: 'updated description',
+        metadata: '{"k":"v"}',
+      })
+      const comment = await provider.comment(created.id, 'first comment')
+      await provider.updateComment(created.id, comment.id, 'edited comment')
+
+      const activity = await provider.getActivity(50, created.id)
+      const fields = activity.map((entry) => entry.field_changed)
+      expect(fields).toContain('project')
+      expect(fields).toContain('description')
+      expect(fields).toContain('metadata')
+
+      const commentEntries = activity.filter((entry) => entry.field_changed === 'comment')
+      expect(commentEntries).toHaveLength(2)
+      expect(commentEntries.some((entry) => entry.new_value === 'first comment')).toBe(true)
+      expect(commentEntries.some((entry) => entry.new_value === 'edited comment')).toBe(true)
+    } finally {
+      await runtime.close()
+    }
+  })
+
+  pgTest('listTasks pushes filter, sort, and limit down to SQL', async () => {
+    const runtime = await openKanbanRuntime()
+    try {
+      const provider = runtime.provider
+      const alpha = await provider.createTask({
+        title: 'Alpha',
+        priority: 'low',
+        assignee: 'amy',
+        project: 'Dispatch',
+      })
+      await provider.createTask({
+        title: 'Beta',
+        priority: 'high',
+        assignee: 'amy',
+        project: 'Dispatch',
+      })
+      await provider.createTask({
+        title: 'Gamma',
+        priority: 'high',
+        assignee: 'bob',
+        project: 'Other',
+      })
+
+      // Filter pushdown: only amy's Dispatch tasks come back.
+      const byAssignee = await provider.listTasks({ assignee: 'amy', project: 'Dispatch' })
+      expect(byAssignee.map((task) => task.title).sort()).toEqual(['Alpha', 'Beta'])
+
+      // Filter + priority pushdown.
+      const highPriority = await provider.listTasks({ priority: 'high' })
+      expect(highPriority.map((task) => task.title).sort()).toEqual(['Beta', 'Gamma'])
+
+      // Sort + limit pushdown: title order, capped at one row.
+      const firstByTitle = await provider.listTasks({ sort: 'title', limit: 1 })
+      expect(firstByTitle).toHaveLength(1)
+      expect(firstByTitle[0]?.title).toBe('Alpha')
+
+      // Comment counts are scoped per returned row.
+      await provider.comment(alpha.id, 'a note')
+      const withCounts = await provider.listTasks({ assignee: 'amy', project: 'Dispatch' })
+      const alphaRow = withCounts.find((task) => task.id === alpha.id)
+      const betaRow = withCounts.find((task) => task.title === 'Beta')
+      expect(alphaRow?.comment_count).toBe(1)
+      expect(betaRow?.comment_count).toBe(0)
+    } finally {
+      await runtime.close()
+    }
+  })
+
+  pgTest('reports configEdit:false and refuses config edits', async () => {
+    const runtime = await openKanbanRuntime()
+    try {
+      const context = await runtime.provider.getContext()
+      expect(context.capabilities.configEdit).toBe(false)
+      // Board administration has no Postgres provider path.
+      expect(context.capabilities.columnCrud).toBe(false)
+      expect(context.capabilities.bulk).toBe(false)
+
+      await expect(runtime.provider.patchConfig({ projects: ['Anything'] })).rejects.toMatchObject({
+        code: 'UNSUPPORTED_OPERATION',
+      })
+    } finally {
+      await runtime.close()
+    }
+  })
+
+  pgTest('migrates a pre-existing tasks table missing project/labels/revision', async () => {
+    // Simulate an older Postgres-local database created before project, labels,
+    // and revision columns existed. CREATE TABLE IF NOT EXISTS would not add
+    // them, so the provider's migration must backfill before any insert.
+    await sql!`
+      CREATE TABLE columns (
+        id TEXT PRIMARY KEY,
+        name TEXT UNIQUE NOT NULL,
+        position INTEGER NOT NULL,
+        color TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      )
+    `
+    await sql!`
+      CREATE TABLE tasks (
+        id TEXT PRIMARY KEY,
+        title TEXT NOT NULL,
+        description TEXT NOT NULL DEFAULT '',
+        column_id TEXT NOT NULL REFERENCES columns(id) ON DELETE RESTRICT,
+        position INTEGER NOT NULL DEFAULT 0,
+        priority TEXT NOT NULL DEFAULT 'medium',
+        assignee TEXT NOT NULL DEFAULT '',
+        metadata TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      )
+    `
+
+    // First provider use runs ensureSchema/migrateTasksTable and must succeed.
+    const created = expectOk<TaskWithColumn>(
+      await run(['task', 'add', 'After migration', '--project', 'Dispatch', '--label', 'smoke']),
+    )
+    expect(created.title).toBe('After migration')
+    expect(created.project).toBe('Dispatch')
+    expect(created.labels).toEqual(['smoke'])
+    expect(created.version).toBe('0')
+
+    const columnRows = await sql!<{ column_name: string }[]>`
+      SELECT column_name FROM information_schema.columns WHERE table_name = 'tasks'
+    `
+    const columnNames = columnRows.map((row) => row.column_name)
+    expect(columnNames).toContain('project')
+    expect(columnNames).toContain('labels')
+    expect(columnNames).toContain('revision')
+  })
+
   pgTest('seeds custom default columns for Garage local compose', async () => {
     process.env['KANBAN_DEFAULT_COLUMNS'] = 'Todo,In Progress,Human Review,Merging,Done'
 

package/src/__tests__/tracker-config-columns.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, test } from 'bun:test'
+import { trackerConfigFromEnv } from '../tracker-config'
+import { KanbanError } from '../errors'
+
+describe('trackerConfigFromEnv default columns', () => {
+  test('parses comma-separated default columns for the local provider', () => {
+    const config = trackerConfigFromEnv({ KANBAN_DEFAULT_COLUMNS: 'Todo, Doing , Done' })
+    expect(config).toMatchObject({ provider: 'local', defaultColumns: ['Todo', 'Doing', 'Done'] })
+  })
+
+  test('rejects case-insensitive duplicate default columns', () => {
+    expect(() => trackerConfigFromEnv({ KANBAN_DEFAULT_COLUMNS: 'Done,done' })).toThrow(KanbanError)
+    expect(() => trackerConfigFromEnv({ KANBAN_DEFAULT_COLUMNS: 'Done,done' })).toThrow(
+      /duplicate column name/i,
+    )
+  })
+
+  test('leaves default columns unset when the variable is absent', () => {
+    const config = trackerConfigFromEnv({})
+    expect(config).toMatchObject({ provider: 'local' })
+    expect((config as { defaultColumns?: string[] }).defaultColumns).toBeUndefined()
+  })
+})

package/src/__tests__/transport-input.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from 'bun:test'
+import { parsePositiveInt } from '../transport-input'
+
+describe('parsePositiveInt', () => {
+  test('returns undefined for absent values', () => {
+    expect(parsePositiveInt(null)).toBeUndefined()
+    expect(parsePositiveInt(undefined)).toBeUndefined()
+    expect(parsePositiveInt('')).toBeUndefined()
+  })
+
+  test('accepts positive integers', () => {
+    expect(parsePositiveInt('1')).toBe(1)
+    expect(parsePositiveInt('100')).toBe(100)
+  })
+
+  test.each([
+    '0',
+    '-5',
+    '3.9',
+    'abc',
+    '5abc',
+    'NaN',
+    'Infinity',
+    '1e100',
+    '1e3',
+    '0x10',
+    '1000000000000000000000000',
+  ])('rejects invalid value %p', (value) => {
+    expect(() => parsePositiveInt(value)).toThrow(/positive integer/)
+  })
+
+  test('uses the provided field name in the message', () => {
+    expect(() => parsePositiveInt('-1', 'count')).toThrow(/count must be a positive integer/)
+  })
+})

package/src/api.ts

@@ -1,6 +1,7 @@
 import { KanbanError, ErrorCode } from './errors'
 import type { BoardConfig, CliOutput, Task } from './types'
 import type { CreateTaskInput, UpdateTaskInput, KanbanProvider } from './providers/types'
+import { parsePositiveInt } from './transport-input'
 import * as useCases from './use-cases'
 
 export type WsEvent =
@@ -21,15 +22,21 @@ function json(data: unknown, status = 200): Response {
   return Response.json(data, { status })
 }
 
-function parseOptionalInt(value: string | null): number | undefined {
-  return value ? parseInt(value, 10) : undefined
+function requireArgument(value: unknown, field: string): void {
+  if (!value) {
+    throw new KanbanError(ErrorCode.MISSING_ARGUMENT, `${field} is required`)
+  }
 }
 
-function missingArgument(field: string): Response {
-  return json(
-    { ok: false, error: { code: 'MISSING_ARGUMENT', message: `${field} is required` } },
-    400,
-  )
+// Parse a JSON request body inside a wrapHandler scope so malformed/empty/
+// wrong-content-type bodies surface through the same { ok:false, error }
+// envelope as every other validation failure instead of escaping as a raw 500.
+async function parseJsonBody<T>(req: Request): Promise<T> {
+  try {
+    return (await req.json()) as T
+  } catch {
+    throw new KanbanError(ErrorCode.INVALID_REQUEST_BODY, 'Request body must be valid JSON')
+  }
 }
 
 function statusForCode(code: string): number {
@@ -131,7 +138,7 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
         const assignee = url.searchParams.get('assignee') ?? undefined
         const project = url.searchParams.get('project') ?? undefined
         const sort = url.searchParams.get('sort') ?? undefined
-        const limit = parseOptionalInt(url.searchParams.get('limit'))
+        const limit = parsePositiveInt(url.searchParams.get('limit'))
         return {
           ok: true,
           data: await useCases.listTasks(provider, {
@@ -149,10 +156,10 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
   }
 
   if (path === '/api/tasks' && method === 'POST') {
-    const body = (await req.json()) as Partial<CreateTaskInput>
-    if (!body.title) return { response: missingArgument('title'), mutated: false }
     let created: Task | null = null
     const response = await wrapHandler(async () => {
+      const body = await parseJsonBody<Partial<CreateTaskInput>>(req)
+      requireArgument(body.title, 'title')
       created = await useCases.createTask(provider, {
         title: body.title!,
         description: body.description,
@@ -184,9 +191,9 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
     }
 
     if (method === 'PATCH') {
-      const body = (await req.json()) as UpdateTaskInput
       let updated: Task | null = null
       const response = await wrapHandler(async () => {
+        const body = await parseJsonBody<UpdateTaskInput>(req)
         updated = await useCases.updateTask(provider, id, body)
         return { ok: true, data: updated }
       })
@@ -207,10 +214,10 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
   const moveMatch = path.match(/^\/api\/tasks\/([^/]+)\/move$/)
   if (moveMatch && method === 'PATCH') {
     const id = decodeURIComponent(moveMatch[1]!)
-    const body = (await req.json()) as MoveTaskBody
-    if (!body.column) return { response: missingArgument('column'), mutated: false }
     let moved: Task | null = null
     const response = await wrapHandler(async () => {
+      const body = await parseJsonBody<MoveTaskBody>(req)
+      requireArgument(body.column, 'column')
       moved = await useCases.moveTask(provider, id, body.column!)
       return { ok: true, data: moved }
     })
@@ -232,12 +239,11 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
     }
 
     if (method === 'POST') {
-      const body = (await req.json()) as CommentBody
-      if (!body.body) return { response: missingArgument('body'), mutated: false }
-      const response = await wrapHandler(async () => ({
-        ok: true,
-        data: await useCases.addComment(provider, id, body.body!),
-      }))
+      const response = await wrapHandler(async () => {
+        const body = await parseJsonBody<CommentBody>(req)
+        requireArgument(body.body, 'body')
+        return { ok: true, data: await useCases.addComment(provider, id, body.body!) }
+      })
       return { response, mutated: response.ok }
     }
   }
@@ -248,12 +254,11 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
     const commentId = decodeURIComponent(commentMatch[2]!)
 
     if (method === 'PATCH') {
-      const body = (await req.json()) as CommentBody
-      if (!body.body) return { response: missingArgument('body'), mutated: false }
-      const response = await wrapHandler(async () => ({
-        ok: true,
-        data: await useCases.updateComment(provider, id, commentId, body.body!),
-      }))
+      const response = await wrapHandler(async () => {
+        const body = await parseJsonBody<CommentBody>(req)
+        requireArgument(body.body, 'body')
+        return { ok: true, data: await useCases.updateComment(provider, id, commentId, body.body!) }
+      })
       return { response, mutated: response.ok }
     }
   }
@@ -262,7 +267,7 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
     return {
       response: await wrapHandler(async () => {
         const taskId = url.searchParams.get('taskId') ?? undefined
-        const limit = parseOptionalInt(url.searchParams.get('limit'))
+        const limit = parsePositiveInt(url.searchParams.get('limit'))
         return { ok: true, data: await useCases.getActivity(provider, limit, taskId) }
       }),
       mutated: false,
@@ -290,11 +295,10 @@ export async function handleRequest(provider: KanbanProvider, req: Request): Pro
   }
 
   if (path === '/api/config' && method === 'PATCH') {
-    const body = (await req.json()) as Partial<BoardConfig>
-    const response = await wrapHandler(async () => ({
-      ok: true,
-      data: await useCases.patchConfig(provider, body),
-    }))
+    const response = await wrapHandler(async () => {
+      const body = await parseJsonBody<Partial<BoardConfig>>(req)
+      return { ok: true, data: await useCases.patchConfig(provider, body) }
+    })
     return { response, mutated: response.ok }
   }
 

package/src/commands/mcp.ts

@@ -9,6 +9,7 @@ import { AjvJsonSchemaValidator } from '@modelcontextprotocol/sdk/validation/ajv
 import { createTrackerCore, defaultTools, TrackerMcpError } from '../mcp/index'
 import type { TrackerMcpPolicy, TrackerMcpTool } from '../mcp/index'
 import type { KanbanProvider } from '../providers/types'
+import { VERSION } from '../version'
 
 type LocalScope = Record<string, never>
 
@@ -38,7 +39,7 @@ export async function startStdioMcpServer(provider: KanbanProvider): Promise<voi
   )
 
   const server = new Server(
-    { name: 'agent-kanban', version: '1.0.0' },
+    { name: 'agent-kanban', version: VERSION },
     { capabilities: { tools: {} } },
   )
 

package/src/db.ts

@@ -697,7 +697,7 @@ export function bulkMoveAll(
     .all({ $col: fromCol.id }) as { id: string }[]
 
   const stmt = db.prepare(
-    "UPDATE tasks SET column_id = $toCol, position = $pos, updated_at = datetime('now') WHERE id = $id",
+    "UPDATE tasks SET column_id = $toCol, position = $pos, updated_at = datetime('now'), revision = revision + 1 WHERE id = $id",
   )
   db.transaction(() => {
     tasks.forEach(({ id }, i) => {

package/src/errors.ts

@@ -11,6 +11,8 @@ export const ErrorCode = {
   INVALID_METADATA: 'INVALID_METADATA',
   INVALID_POSITION: 'INVALID_POSITION',
   INVALID_CONFIG: 'INVALID_CONFIG',
+  INVALID_REQUEST_BODY: 'INVALID_REQUEST_BODY',
+  INVALID_ARGUMENT: 'INVALID_ARGUMENT',
   CONFLICT: 'CONFLICT',
   MISSING_ARGUMENT: 'MISSING_ARGUMENT',
   UNKNOWN_COMMAND: 'UNKNOWN_COMMAND',

package/src/index.ts

@@ -9,6 +9,7 @@ import { boardInit, boardReset } from './commands/board'
 import { columnAdd, columnDelete, columnList, columnRename, columnReorder } from './commands/column'
 import { bulkClearDoneCmd, bulkMoveAllCmd } from './commands/bulk'
 import { getConfigPath, loadConfig, saveConfig } from './config'
+import { parsePositiveInt } from './transport-input'
 import type { CliOutput, Priority } from './types'
 import { unsupportedOperation } from './providers/errors'
 import { openKanbanRuntime } from './provider-runtime'
@@ -83,7 +84,7 @@ async function routeTask(
           priority: values.p as string | undefined,
           assignee: values.a as string | undefined,
           project: values.project as string | undefined,
-          limit: values.l ? parseInt(values.l as string, 10) : undefined,
+          limit: parsePositiveInt(values.l as string | undefined),
           sort: values.sort as string | undefined,
         }),
       )
@@ -374,6 +375,10 @@ async function run(argv: string[]): Promise<{ output: CliOutput; exitCode: numbe
         output = routeBulk(sqliteDb, provider.type, action, positionals)
         break
       case 'config':
+        // routeConfig persists to the SQLite-side config file, so it only runs
+        // when a SQLite database is present. Postgres-local has no config
+        // repository (configEdit:false), so edits are refused here — matching the
+        // HTTP API, which fails through the provider's patchConfig.
         if (sqliteDb) {
           output = await routeConfig(provider, dbPath, action, positionals, values)
         } else {

package/src/mcp/core.ts

@@ -1,5 +1,5 @@
 import type { KanbanProvider } from '../providers/types'
-import type { Task, TaskComment } from '../types'
+import type { BoardView, Task, TaskComment } from '../types'
 import * as useCases from '../use-cases'
 import { TrackerMcpError, toTrackerMcpError } from './errors'
 import type { TrackerMcpHooks, TrackerMcpPolicy } from './types'
@@ -52,6 +52,21 @@ async function filterComments<TScope>(
   return comments.filter((_, index) => allowed[index])
 }
 
+async function filterBoard<TScope>(
+  scope: TScope,
+  board: BoardView,
+  policy: TrackerMcpPolicy<TScope>,
+): Promise<BoardView> {
+  if (!policy.filterTask) return board
+  const columns = await Promise.all(
+    board.columns.map(async (column) => {
+      const allowed = await Promise.all(column.tasks.map((task) => policy.filterTask!(scope, task)))
+      return { ...column, tasks: column.tasks.filter((_, index) => allowed[index]) }
+    }),
+  )
+  return { ...board, columns }
+}
+
 export function createTrackerCore<TScope>(input: {
   provider: KanbanProvider
   policy: TrackerMcpPolicy<TScope>
@@ -146,7 +161,14 @@ export function createTrackerCore<TScope>(input: {
         return runTool({
           scope,
           tool: 'getBoard',
-          execute: async () => useCases.getBoard(provider),
+          execute: async () => {
+            await policy.canReadBoard?.(scope)
+            const board = await useCases.getBoard(provider)
+            return filterBoard(scope, board, policy)
+          },
+          resultMeta: (board) => ({
+            taskCount: board.columns.reduce((total, column) => total + column.tasks.length, 0),
+          }),
         })
       },
 

package/src/mcp/server.ts

@@ -16,6 +16,7 @@ import type {
 import type { TrackerCore } from './core'
 import { TrackerMcpError, toMcpError, toTrackerMcpError, trackerMcpJsonRpcCode } from './errors'
 import type { TrackerMcpAuthResolver, TrackerMcpServer, TrackerMcpTool } from './types'
+import { VERSION } from '../version'
 
 const EMPTY_OBJECT_SCHEMA = {
   type: 'object',
@@ -169,7 +170,7 @@ function createSessionServer<TScope>(
   entry: SessionEntry<TScope>,
 ): Server {
   const server = new Server(
-    { name: 'agent-kanban-tracker-mcp', version: '1.0.0' },
+    { name: 'agent-kanban-tracker-mcp', version: VERSION },
     { capabilities: { tools: {} } },
   )