@bbearai/mcp-server 0.5.0 → 0.6.0

package/dist/index.js

@@ -12,26 +12,30 @@ const supabase_js_1 = require("@supabase/supabase-js");
 // Configuration from environment
 const SUPABASE_URL = process.env.SUPABASE_URL || 'https://kyxgzjnqgvapvlnvqawz.supabase.co';
 const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY || '';
-const PROJECT_ID = process.env.BUGBEAR_PROJECT_ID || '';
+// Active project — set from env var, switchable via switch_project tool
+let currentProjectId = process.env.BUGBEAR_currentProjectId || '';
 // Initialize Supabase client
 let supabase;
 function validateConfig() {
-    const errors = [];
     if (!SUPABASE_ANON_KEY) {
-        errors.push('SUPABASE_ANON_KEY environment variable is required');
+        console.error('BugBear MCP Server: SUPABASE_ANON_KEY environment variable is required');
+        process.exit(1);
     }
-    if (!PROJECT_ID) {
-        errors.push('BUGBEAR_PROJECT_ID environment variable is required');
+    // Validate project ID format if provided
+    if (currentProjectId && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(currentProjectId)) {
+        console.error('BugBear MCP Server: BUGBEAR_currentProjectId must be a valid UUID');
+        process.exit(1);
     }
-    // Basic UUID format validation for project ID
-    if (PROJECT_ID && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(PROJECT_ID)) {
-        errors.push('BUGBEAR_PROJECT_ID must be a valid UUID');
+    if (!currentProjectId) {
+        console.error('BugBear MCP Server: No BUGBEAR_currentProjectId set. Use list_projects + switch_project to select one.');
     }
-    if (errors.length > 0) {
-        console.error('BugBear MCP Server configuration errors:');
-        errors.forEach(e => console.error(`  - ${e}`));
-        process.exit(1);
+}
+/** Guard for tools that require a project to be selected */
+function requireProject() {
+    if (!currentProjectId) {
+        throw new Error('No project selected. Use list_projects to see available projects, then switch_project to select one.');
     }
+    return currentProjectId;
 }
 function initSupabase() {
     validateConfig();
@@ -435,6 +439,10 @@ const tools = [
                     items: { type: 'string' },
                     description: 'List of files that were modified to fix this bug',
                 },
+                notify_tester: {
+                    type: 'boolean',
+                    description: 'If true, notify the original tester about the fix with a message and verification task. Default: false (silent resolve).',
+                },
             },
             required: ['report_id', 'commit_sha'],
         },
@@ -902,13 +910,366 @@ const tools = [
             },
         },
     },
+    // === TESTER & ASSIGNMENT MANAGEMENT TOOLS ===
+    {
+        name: 'list_testers',
+        description: 'List all QA testers for the project with their status, platforms, and workload counts.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                status: {
+                    type: 'string',
+                    enum: ['active', 'inactive', 'invited'],
+                    description: 'Filter by tester status (default: all)',
+                },
+                platform: {
+                    type: 'string',
+                    enum: ['ios', 'android', 'web'],
+                    description: 'Filter by platform support',
+                },
+            },
+        },
+    },
+    {
+        name: 'list_test_runs',
+        description: 'List testing campaigns (test runs) for the project with pass/fail stats.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                status: {
+                    type: 'string',
+                    enum: ['draft', 'active', 'paused', 'completed', 'archived'],
+                    description: 'Filter by test run status',
+                },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum number of runs to return (default: 20)',
+                },
+            },
+        },
+    },
+    {
+        name: 'create_test_run',
+        description: 'Create a new testing campaign (test run). Tests can then be assigned to testers within this run.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                name: {
+                    type: 'string',
+                    description: 'Name for the test run (e.g. "v2.1 QA Pass", "Sprint 5 Testing")',
+                },
+                description: {
+                    type: 'string',
+                    description: 'Optional description of the test run scope and goals',
+                },
+            },
+            required: ['name'],
+        },
+    },
+    {
+        name: 'list_test_assignments',
+        description: 'List test assignments showing which tests are assigned to which testers, with status tracking. Joins test case and tester info.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                tester_id: {
+                    type: 'string',
+                    description: 'Filter by tester UUID',
+                },
+                test_run_id: {
+                    type: 'string',
+                    description: 'Filter by test run UUID',
+                },
+                status: {
+                    type: 'string',
+                    enum: ['pending', 'in_progress', 'passed', 'failed', 'blocked', 'skipped'],
+                    description: 'Filter by assignment status',
+                },
+                limit: {
+                    type: 'number',
+                    description: 'Maximum number of assignments to return (default: 50, max: 200)',
+                },
+            },
+        },
+    },
+    {
+        name: 'assign_tests',
+        description: 'Assign one or more test cases to a tester. Optionally assign within a test run. Skips duplicates gracefully.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                tester_id: {
+                    type: 'string',
+                    description: 'UUID of the tester to assign tests to (required)',
+                },
+                test_case_ids: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Array of test case UUIDs to assign (required)',
+                },
+                test_run_id: {
+                    type: 'string',
+                    description: 'Optional test run UUID to group assignments under',
+                },
+            },
+            required: ['tester_id', 'test_case_ids'],
+        },
+    },
+    {
+        name: 'get_tester_workload',
+        description: 'View a specific tester\'s current workload — assignment counts by status and recent assignments.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                tester_id: {
+                    type: 'string',
+                    description: 'UUID of the tester (required)',
+                },
+            },
+            required: ['tester_id'],
+        },
+    },
+    // === NEW TESTER & ANALYTICS TOOLS ===
+    {
+        name: 'create_tester',
+        description: 'Add a new QA tester to the project without opening the dashboard.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                name: {
+                    type: 'string',
+                    description: 'Full name of the tester (required)',
+                },
+                email: {
+                    type: 'string',
+                    description: 'Email address of the tester (required, must be unique per project)',
+                },
+                platforms: {
+                    type: 'array',
+                    items: { type: 'string', enum: ['ios', 'android', 'web'] },
+                    description: 'Platforms the tester can test on (default: ["ios", "web"])',
+                },
+                tier: {
+                    type: 'number',
+                    description: 'Tester tier 1-3 (default: 1)',
+                },
+                notes: {
+                    type: 'string',
+                    description: 'Optional notes about the tester',
+                },
+            },
+            required: ['name', 'email'],
+        },
+    },
+    {
+        name: 'update_tester',
+        description: 'Update an existing tester\'s status, platforms, tier, or notes.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                tester_id: {
+                    type: 'string',
+                    description: 'UUID of the tester to update (required)',
+                },
+                status: {
+                    type: 'string',
+                    enum: ['active', 'inactive', 'invited'],
+                    description: 'New status for the tester',
+                },
+                platforms: {
+                    type: 'array',
+                    items: { type: 'string', enum: ['ios', 'android', 'web'] },
+                    description: 'Updated platforms array',
+                },
+                tier: {
+                    type: 'number',
+                    description: 'Updated tier (1-3)',
+                },
+                notes: {
+                    type: 'string',
+                    description: 'Updated notes',
+                },
+                name: {
+                    type: 'string',
+                    description: 'Updated name',
+                },
+            },
+            required: ['tester_id'],
+        },
+    },
+    {
+        name: 'bulk_update_reports',
+        description: 'Update the status of multiple bug reports at once. Useful after a fix session to close many bugs.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                report_ids: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Array of report UUIDs to update (required, max 50)',
+                },
+                status: {
+                    type: 'string',
+                    enum: ['new', 'triaging', 'confirmed', 'in_progress', 'fixed', 'resolved', 'verified', 'wont_fix', 'duplicate', 'closed'],
+                    description: 'New status for all reports (required)',
+                },
+                resolution_notes: {
+                    type: 'string',
+                    description: 'Optional resolution notes applied to all reports',
+                },
+            },
+            required: ['report_ids', 'status'],
+        },
+    },
+    {
+        name: 'get_bug_trends',
+        description: 'Get bug report trends over time — grouped by week, severity, category, or status. Useful for spotting patterns.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                group_by: {
+                    type: 'string',
+                    enum: ['week', 'severity', 'category', 'status'],
+                    description: 'How to group the trends (default: week)',
+                },
+                days: {
+                    type: 'number',
+                    description: 'Number of days to look back (default: 30, max: 180)',
+                },
+            },
+        },
+    },
+    {
+        name: 'get_tester_leaderboard',
+        description: 'Rank testers by testing activity — bugs found, tests completed, pass rate, and average test duration.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                days: {
+                    type: 'number',
+                    description: 'Number of days to look back (default: 30, max: 180)',
+                },
+                sort_by: {
+                    type: 'string',
+                    enum: ['bugs_found', 'tests_completed', 'pass_rate'],
+                    description: 'Sort metric (default: tests_completed)',
+                },
+            },
+        },
+    },
+    {
+        name: 'export_test_results',
+        description: 'Export test results for a specific test run as structured JSON — includes every assignment, tester, result, and duration.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                test_run_id: {
+                    type: 'string',
+                    description: 'UUID of the test run to export (required)',
+                },
+            },
+            required: ['test_run_id'],
+        },
+    },
+    {
+        name: 'get_testing_velocity',
+        description: 'Get a rolling average of test completions per day over the specified window. Shows daily completion counts and trend direction.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                days: {
+                    type: 'number',
+                    description: 'Number of days to analyze (default: 14, max: 90)',
+                },
+            },
+        },
+    },
+    // === PROJECT MANAGEMENT TOOLS ===
+    {
+        name: 'list_projects',
+        description: 'List all BugBear projects accessible with the current credentials. Use this to find project IDs for switch_project.',
+        inputSchema: {
+            type: 'object',
+            properties: {},
+        },
+    },
+    {
+        name: 'switch_project',
+        description: 'Switch the active project. All subsequent tool calls will use this project. Use list_projects first to find the project ID.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                project_id: {
+                    type: 'string',
+                    description: 'UUID of the project to switch to (required)',
+                },
+            },
+            required: ['project_id'],
+        },
+    },
+    {
+        name: 'get_current_project',
+        description: 'Show which project is currently active.',
+        inputSchema: {
+            type: 'object',
+            properties: {},
+        },
+    },
 ];
+// === Project management handlers ===
+async function listProjects() {
+    const { data, error } = await supabase
+        .from('projects')
+        .select('id, name, slug, is_qa_enabled, created_at')
+        .order('name');
+    if (error) {
+        return { error: error.message };
+    }
+    return {
+        currentProjectId: currentProjectId || null,
+        projects: data?.map(p => ({
+            id: p.id,
+            name: p.name,
+            slug: p.slug,
+            isQAEnabled: p.is_qa_enabled,
+            isActive: p.id === currentProjectId,
+            createdAt: p.created_at,
+        })) || [],
+    };
+}
+async function switchProject(args) {
+    if (!isValidUUID(args.project_id)) {
+        return { error: 'Invalid project_id format — must be a UUID' };
+    }
+    // Verify the project exists and is accessible
+    const { data, error } = await supabase
+        .from('projects')
+        .select('id, name, slug')
+        .eq('id', args.project_id)
+        .single();
+    if (error || !data) {
+        return { error: 'Project not found or not accessible' };
+    }
+    currentProjectId = data.id;
+    return {
+        success: true,
+        message: `Switched to project "${data.name}" (${data.slug})`,
+        projectId: data.id,
+        projectName: data.name,
+    };
+}
+function getCurrentProject() {
+    if (!currentProjectId) {
+        return { message: 'No project selected. Use list_projects to see available projects, then switch_project to select one.' };
+    }
+    return { projectId: currentProjectId };
+}
 // Tool handlers
 async function listReports(args) {
     let query = supabase
         .from('reports')
-        .select('id, report_type, severity, status, description, app_context, created_at, reporter_name, reporter_email, tester:testers(name, email)')
-        .eq('project_id', PROJECT_ID)
+        .select('id, report_type, severity, status, description, app_context, created_at, reporter_name, tester:testers(name)')
+        .eq('project_id', currentProjectId)
         .order('created_at', { ascending: false })
         .limit(Math.min(args.limit || 10, 50));
     if (args.status)
@@ -944,7 +1305,7 @@ async function getReport(args) {
         .from('reports')
         .select('*, tester:testers(*), track:qa_tracks(*)')
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID) // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId) // Security: ensure report belongs to this project
         .single();
     if (error) {
         return { error: error.message };
@@ -963,10 +1324,8 @@ async function getReport(args) {
             created_at: data.created_at,
             reporter: data.tester ? {
                 name: data.tester.name,
-                email: data.tester.email,
             } : (data.reporter_name ? {
                 name: data.reporter_name,
-                email: data.reporter_email,
             } : null),
             track: data.track ? {
                 name: data.track.name,
@@ -981,7 +1340,7 @@ async function searchReports(args) {
     let query = supabase
         .from('reports')
         .select('id, report_type, severity, status, description, app_context, created_at')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('created_at', { ascending: false })
         .limit(20);
     if (sanitizedQuery) {
@@ -1024,7 +1383,7 @@ async function updateReportStatus(args) {
         .from('reports')
         .update(updates)
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID); // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId); // Security: ensure report belongs to this project
     if (error) {
         return { error: error.message };
     }
@@ -1038,7 +1397,7 @@ async function getReportContext(args) {
         .from('reports')
         .select('app_context, device_info, navigation_history, enhanced_context')
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID) // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId) // Security: ensure report belongs to this project
         .single();
     if (error) {
         return { error: error.message };
@@ -1057,7 +1416,7 @@ async function getProjectInfo() {
     const { data: project, error: projectError } = await supabase
         .from('projects')
         .select('id, name, slug, is_qa_enabled')
-        .eq('id', PROJECT_ID)
+        .eq('id', currentProjectId)
         .single();
     if (projectError) {
         return { error: projectError.message };
@@ -1066,17 +1425,17 @@ async function getProjectInfo() {
     const { data: tracks } = await supabase
         .from('qa_tracks')
         .select('id, name, icon, test_template')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     // Get test case count
     const { count: testCaseCount } = await supabase
         .from('test_cases')
         .select('id', { count: 'exact', head: true })
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     // Get open bug count
     const { count: openBugCount } = await supabase
         .from('reports')
         .select('id', { count: 'exact', head: true })
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .in('status', ['new', 'confirmed', 'in_progress']);
     return {
@@ -1103,7 +1462,7 @@ async function getQaTracks() {
     const { data, error } = await supabase
         .from('qa_tracks')
         .select('*')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('sort_order');
     if (error) {
         return { error: error.message };
@@ -1126,16 +1485,19 @@ async function createTestCase(args) {
     // Find track ID if track name provided
     let trackId = null;
     if (args.track) {
-        const { data: trackData } = await supabase
-            .from('qa_tracks')
-            .select('id')
-            .eq('project_id', PROJECT_ID)
-            .ilike('name', `%${args.track}%`)
-            .single();
-        trackId = trackData?.id || null;
+        const sanitizedTrack = sanitizeSearchQuery(args.track);
+        if (sanitizedTrack) {
+            const { data: trackData } = await supabase
+                .from('qa_tracks')
+                .select('id')
+                .eq('project_id', currentProjectId)
+                .ilike('name', `%${sanitizedTrack}%`)
+                .single();
+            trackId = trackData?.id || null;
+        }
     }
     const testCase = {
-        project_id: PROJECT_ID,
+        project_id: currentProjectId,
         test_key: args.test_key,
         title: args.title,
         description: args.description || '',
@@ -1175,7 +1537,7 @@ async function updateTestCase(args) {
         const { data: existing } = await supabase
             .from('test_cases')
             .select('id')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .eq('test_key', args.test_key)
             .single();
         if (!existing) {
@@ -1206,7 +1568,7 @@ async function updateTestCase(args) {
         .from('test_cases')
         .update(updates)
         .eq('id', testCaseId)
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .select('id, test_key, title, target_route')
         .single();
     if (error) {
@@ -1251,7 +1613,7 @@ async function deleteTestCases(args) {
         const { data: existing } = await supabase
             .from('test_cases')
             .select('id')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .eq('test_key', args.test_key)
             .single();
         if (!existing) {
@@ -1284,7 +1646,7 @@ async function deleteTestCases(args) {
         const { data: existing, error: lookupError } = await supabase
             .from('test_cases')
             .select('id, test_key')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .in('test_key', args.test_keys);
         if (lookupError) {
             return { error: lookupError.message };
@@ -1300,7 +1662,7 @@ async function deleteTestCases(args) {
     const { data: toDelete } = await supabase
         .from('test_cases')
         .select('id, test_key, title')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .in('id', idsToDelete);
     if (!toDelete || toDelete.length === 0) {
         return { error: 'No matching test cases found in this project' };
@@ -1309,7 +1671,7 @@ async function deleteTestCases(args) {
     const { error: deleteError } = await supabase
         .from('test_cases')
         .delete()
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .in('id', idsToDelete);
     if (deleteError) {
         return { error: deleteError.message };
@@ -1343,7 +1705,7 @@ async function listTestCases(args) {
       steps,
       track:qa_tracks(id, name, icon, color)
     `)
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('test_key', { ascending: true });
     // Apply filters
     if (args.priority) {
@@ -1390,7 +1752,7 @@ async function getBugPatterns(args) {
     let query = supabase
         .from('reports')
         .select('app_context, severity, status, created_at')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .order('created_at', { ascending: false })
         .limit(100);
@@ -1442,7 +1804,7 @@ async function suggestTestCases(args) {
     const { data: existingTests } = await supabase
         .from('test_cases')
         .select('test_key, title')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('test_key', { ascending: false })
         .limit(1);
     // Calculate next test key number
@@ -1477,7 +1839,7 @@ async function suggestTestCases(args) {
     const { data: relatedBugs } = await supabase
         .from('reports')
         .select('id, description, severity')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .limit(10);
     const routeBugs = (relatedBugs || []).filter(bug => {
@@ -1511,12 +1873,16 @@ async function getTestPriorities(args) {
     const minScore = args.min_score || 0;
     const includeFactors = args.include_factors !== false;
     // First, refresh the route stats
-    await supabase.rpc('refresh_route_test_stats', { p_project_id: PROJECT_ID });
+    const { error: refreshError } = await supabase.rpc('refresh_route_test_stats', { p_project_id: currentProjectId });
+    if (refreshError) {
+        // Non-fatal: proceed with potentially stale data but warn
+        console.warn('Failed to refresh route stats:', refreshError.message);
+    }
     // Get prioritized routes
     const { data: routes, error } = await supabase
         .from('route_test_stats')
         .select('*')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .gte('priority_score', minScore)
         .order('priority_score', { ascending: false })
         .limit(limit);
@@ -1633,7 +1999,7 @@ async function getCoverageGaps(args) {
     const { data: routesFromReports } = await supabase
         .from('reports')
         .select('app_context')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .not('app_context->currentRoute', 'is', null);
     const allRoutes = new Set();
     (routesFromReports || []).forEach(r => {
@@ -1645,7 +2011,7 @@ async function getCoverageGaps(args) {
     const { data: testCases } = await supabase
         .from('test_cases')
         .select('target_route, category, track_id')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     const coveredRoutes = new Set();
     const routeTrackCoverage = {};
     (testCases || []).forEach(tc => {
@@ -1662,13 +2028,13 @@ async function getCoverageGaps(args) {
     const { data: tracks } = await supabase
         .from('qa_tracks')
         .select('id, name')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     const trackMap = new Map((tracks || []).map(t => [t.id, t.name]));
     // Get route stats for staleness
     const { data: routeStats } = await supabase
         .from('route_test_stats')
         .select('route, last_tested_at, open_bugs, critical_bugs')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     const routeStatsMap = new Map((routeStats || []).map(r => [r.route, r]));
     // Find untested routes
     if (gapType === 'all' || gapType === 'untested_routes') {
@@ -1765,14 +2131,14 @@ async function getRegressions(args) {
     const { data: resolvedBugs } = await supabase
         .from('reports')
         .select('id, description, severity, app_context, resolved_at')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .in('status', ['resolved', 'fixed', 'verified', 'closed'])
         .gte('resolved_at', new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString());
     const { data: newBugs } = await supabase
         .from('reports')
         .select('id, description, severity, app_context, created_at')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .in('status', ['new', 'triaging', 'confirmed', 'in_progress', 'reviewed'])
         .gte('created_at', new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString());
@@ -1876,21 +2242,23 @@ async function getCoverageMatrix(args) {
     const { data: tracks } = await supabase
         .from('qa_tracks')
         .select('id, name, icon, color')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('sort_order');
     // Get test cases with track info
     const { data: testCases } = await supabase
         .from('test_cases')
         .select('id, target_route, category, track_id')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     // Get test assignments for execution data
     let assignments = [];
     if (includeExecution) {
         const { data } = await supabase
             .from('test_assignments')
             .select('test_case_id, status, completed_at')
-            .eq('project_id', PROJECT_ID)
-            .in('status', ['passed', 'failed']);
+            .eq('project_id', currentProjectId)
+            .in('status', ['passed', 'failed'])
+            .order('completed_at', { ascending: false })
+            .limit(2000);
         assignments = data || [];
     }
     // Get route stats for bug counts
@@ -1899,7 +2267,7 @@ async function getCoverageMatrix(args) {
         const { data } = await supabase
             .from('route_test_stats')
             .select('route, open_bugs, critical_bugs')
-            .eq('project_id', PROJECT_ID);
+            .eq('project_id', currentProjectId);
         routeStats = data || [];
     }
     const routeStatsMap = new Map(routeStats.map(r => [r.route, r]));
@@ -2038,12 +2406,16 @@ async function getStaleCoverage(args) {
     const daysThreshold = args.days_threshold || 14;
     const limit = args.limit || 20;
     // Refresh stats first
-    await supabase.rpc('refresh_route_test_stats', { p_project_id: PROJECT_ID });
+    const { error: refreshError } = await supabase.rpc('refresh_route_test_stats', { p_project_id: currentProjectId });
+    if (refreshError) {
+        // Non-fatal: proceed with potentially stale data but warn
+        console.warn('Failed to refresh route stats:', refreshError.message);
+    }
     // Get routes ordered by staleness and risk
     const { data: routes, error } = await supabase
         .from('route_test_stats')
         .select('route, last_tested_at, open_bugs, critical_bugs, test_case_count, priority_score')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('last_tested_at', { ascending: true, nullsFirst: true })
         .limit(limit * 2); // Get extra to filter
     if (error) {
@@ -2123,17 +2495,34 @@ async function generateDeployChecklist(args) {
             }
         });
     }
-    // Get test cases for these routes
-    const { data: testCases } = await supabase
-        .from('test_cases')
-        .select('id, test_key, title, target_route, category, priority, track:qa_tracks(name)')
-        .eq('project_id', PROJECT_ID)
-        .or(routes.map(r => `target_route.eq.${r}`).join(',') + ',' + routes.map(r => `category.eq.${r}`).join(','));
+    // Limit routes array to prevent query explosion
+    const safeRoutes = routes.slice(0, 100);
+    // Get test cases for these routes (use separate queries to avoid filter injection)
+    const [{ data: byRoute }, { data: byCategory }] = await Promise.all([
+        supabase
+            .from('test_cases')
+            .select('id, test_key, title, target_route, category, priority, track:qa_tracks(name)')
+            .eq('project_id', currentProjectId)
+            .in('target_route', safeRoutes),
+        supabase
+            .from('test_cases')
+            .select('id, test_key, title, target_route, category, priority, track:qa_tracks(name)')
+            .eq('project_id', currentProjectId)
+            .in('category', safeRoutes),
+    ]);
+    // Deduplicate by id
+    const seenIds = new Set();
+    const testCases = [...(byRoute || []), ...(byCategory || [])].filter(tc => {
+        if (seenIds.has(tc.id))
+            return false;
+        seenIds.add(tc.id);
+        return true;
+    });
     // Get route stats for risk assessment
     const { data: routeStats } = await supabase
         .from('route_test_stats')
         .select('*')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .in('route', Array.from(allRoutes));
     const routeStatsMap = new Map((routeStats || []).map(r => [r.route, r]));
     // Categorize tests
@@ -2232,30 +2621,30 @@ async function getQAHealth(args) {
     const { data: currentTests } = await supabase
         .from('test_assignments')
         .select('id, status, completed_at')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .gte('completed_at', periodStart.toISOString())
         .in('status', ['passed', 'failed']);
     const { data: currentBugs } = await supabase
         .from('reports')
         .select('id, severity, status, created_at')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .gte('created_at', periodStart.toISOString());
     const { data: resolvedBugs } = await supabase
         .from('reports')
         .select('id, created_at, resolved_at')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .in('status', ['resolved', 'fixed', 'verified', 'closed'])
         .gte('resolved_at', periodStart.toISOString());
     const { data: testers } = await supabase
         .from('testers')
         .select('id, status')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     const { data: routeStats } = await supabase
         .from('route_test_stats')
         .select('route, test_case_count')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     // Get previous period data for comparison
     let previousTests = [];
     let previousBugs = [];
@@ -2264,7 +2653,7 @@ async function getQAHealth(args) {
         const { data: pt } = await supabase
             .from('test_assignments')
             .select('id, status')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .gte('completed_at', previousStart.toISOString())
             .lt('completed_at', periodStart.toISOString())
             .in('status', ['passed', 'failed']);
@@ -2272,7 +2661,7 @@ async function getQAHealth(args) {
         const { data: pb } = await supabase
             .from('reports')
             .select('id, severity')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .eq('report_type', 'bug')
             .gte('created_at', previousStart.toISOString())
             .lt('created_at', periodStart.toISOString());
@@ -2280,7 +2669,7 @@ async function getQAHealth(args) {
         const { data: pr } = await supabase
             .from('reports')
             .select('id')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .in('status', ['resolved', 'fixed', 'verified', 'closed'])
             .gte('resolved_at', previousStart.toISOString())
             .lt('resolved_at', periodStart.toISOString());
@@ -2434,7 +2823,7 @@ async function getQASessions(args) {
       findings_count, bugs_filed, created_at,
       tester:testers(id, name, email)
     `)
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('started_at', { ascending: false })
         .limit(limit);
     if (status !== 'all') {
@@ -2484,12 +2873,12 @@ async function getQAAlerts(args) {
     const status = args.status || 'active';
     // Optionally refresh alerts
     if (args.refresh) {
-        await supabase.rpc('detect_all_alerts', { p_project_id: PROJECT_ID });
+        await supabase.rpc('detect_all_alerts', { p_project_id: currentProjectId });
     }
     let query = supabase
         .from('qa_alerts')
         .select('*')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('severity', { ascending: true }) // critical first
         .order('created_at', { ascending: false });
     if (severity !== 'all') {
@@ -2542,7 +2931,7 @@ async function getDeploymentAnalysis(args) {
             .from('deployments')
             .select('*')
             .eq('id', args.deployment_id)
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .single();
         if (error) {
             return { error: error.message };
@@ -2553,7 +2942,7 @@ async function getDeploymentAnalysis(args) {
     let query = supabase
         .from('deployments')
         .select('*')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('deployed_at', { ascending: false })
         .limit(limit);
     if (args.environment && args.environment !== 'all') {
@@ -2627,14 +3016,23 @@ async function analyzeCommitForTesting(args) {
     const { data: mappings } = await supabase
         .from('file_route_mapping')
         .select('file_pattern, route, feature, confidence')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     const affectedRoutes = [];
     for (const mapping of mappings || []) {
         const matchedFiles = filesChanged.filter(file => {
-            const pattern = mapping.file_pattern
-                .replace(/\*\*/g, '.*')
-                .replace(/\*/g, '[^/]*');
-            return new RegExp(pattern).test(file);
+            try {
+                // Validate pattern complexity to prevent ReDoS
+                if (mapping.file_pattern.length > 200)
+                    return false;
+                const pattern = mapping.file_pattern
+                    .replace(/[.+?^${}()|[\]\\]/g, '\\$&') // Escape regex special chars first
+                    .replace(/\\\*\\\*/g, '.*') // Then convert glob ** to .*
+                    .replace(/\\\*/g, '[^/]*'); // And glob * to [^/]*
+                return new RegExp(`^${pattern}$`).test(file);
+            }
+            catch {
+                return false; // Skip malformed patterns
+            }
         });
         if (matchedFiles.length > 0) {
             affectedRoutes.push({
@@ -2652,7 +3050,7 @@ async function analyzeCommitForTesting(args) {
         const { data: bugs } = await supabase
             .from('reports')
             .select('id, severity, description, route, created_at')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .eq('report_type', 'bug')
             .in('route', routes)
             .gte('created_at', new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString());
@@ -2684,7 +3082,7 @@ async function analyzeCommitForTesting(args) {
     // Optionally record as deployment
     if (args.record_deployment) {
         await supabase.rpc('record_deployment', {
-            p_project_id: PROJECT_ID,
+            p_project_id: currentProjectId,
             p_environment: 'production',
             p_commit_sha: args.commit_sha || null,
             p_commit_message: args.commit_message || null,
@@ -2773,12 +3171,12 @@ async function analyzeChangesForTests(args) {
     const { data: existingTests } = await supabase
         .from('test_cases')
         .select('test_key, title, target_route, description')
-        .eq('project_id', PROJECT_ID);
+        .eq('project_id', currentProjectId);
     // Get next test key
     const { data: lastTest } = await supabase
         .from('test_cases')
         .select('test_key')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('test_key', { ascending: false })
         .limit(1);
     const lastKey = lastTest?.[0]?.test_key || 'TC-000';
@@ -2790,7 +3188,7 @@ async function analyzeChangesForTests(args) {
         const { data: bugs } = await supabase
             .from('reports')
             .select('id, description, severity, app_context')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .eq('report_type', 'bug')
             .limit(50);
         relatedBugs = (bugs || []).filter(bug => {
@@ -3135,7 +3533,7 @@ async function createBugReport(args) {
     const { data: project } = await supabase
         .from('projects')
         .select('owner_id')
-        .eq('id', PROJECT_ID)
+        .eq('id', currentProjectId)
         .single();
     if (project?.owner_id) {
         reporterId = project.owner_id;
@@ -3145,14 +3543,14 @@ async function createBugReport(args) {
         const { data: testers } = await supabase
             .from('testers')
             .select('id')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .limit(1);
         if (testers && testers.length > 0) {
             reporterId = testers[0].id;
         }
     }
     const report = {
-        project_id: PROJECT_ID,
+        project_id: currentProjectId,
         report_type: 'bug',
         title: args.title,
         description: args.description,
@@ -3216,7 +3614,7 @@ async function getBugsForFile(args) {
     let query = supabase
         .from('reports')
         .select('id, title, description, severity, status, created_at, code_context')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug');
     if (!args.include_resolved) {
         query = query.in('status', ['new', 'confirmed', 'in_progress', 'reviewed']);
@@ -3282,7 +3680,7 @@ async function markFixedWithCommit(args) {
         .from('reports')
         .select('code_context')
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID) // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId) // Security: ensure report belongs to this project
         .single();
     if (fetchError) {
         return { error: fetchError.message };
@@ -3292,6 +3690,7 @@ async function markFixedWithCommit(args) {
         status: 'resolved',
         resolved_at: new Date().toISOString(),
         resolution_notes: args.resolution_notes || `Fixed in commit ${args.commit_sha.slice(0, 7)}`,
+        notify_tester: args.notify_tester === true, // Opt-in: only notify if explicitly requested
         code_context: {
             ...existingContext,
             fix: {
@@ -3307,15 +3706,19 @@ async function markFixedWithCommit(args) {
         .from('reports')
         .update(updates)
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID); // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId); // Security: ensure report belongs to this project
     if (error) {
         return { error: error.message };
     }
+    const notificationStatus = args.notify_tester
+        ? 'The original tester will be notified and assigned a verification task.'
+        : 'No notification sent (silent resolve). A verification task was created.';
     return {
         success: true,
-        message: `Bug marked as fixed in commit ${args.commit_sha.slice(0, 7)}`,
+        message: `Bug marked as fixed in commit ${args.commit_sha.slice(0, 7)}. ${notificationStatus}`,
         report_id: args.report_id,
         commit: args.commit_sha,
+        tester_notified: args.notify_tester === true,
         next_steps: [
             'Consider running create_regression_test to prevent this bug from recurring',
             'Push your changes to trigger CI/CD',
@@ -3327,7 +3730,7 @@ async function getBugsAffectingCode(args) {
     const { data, error } = await supabase
         .from('reports')
         .select('id, title, description, severity, status, code_context, app_context')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .eq('report_type', 'bug')
         .in('status', ['new', 'confirmed', 'in_progress', 'reviewed'])
         .order('severity', { ascending: true });
@@ -3432,7 +3835,7 @@ async function linkBugToCode(args) {
         .from('reports')
         .select('code_context')
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID) // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId) // Security: ensure report belongs to this project
         .single();
     if (fetchError) {
         return { error: fetchError.message };
@@ -3453,7 +3856,7 @@ async function linkBugToCode(args) {
         .from('reports')
         .update(updates)
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID); // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId); // Security: ensure report belongs to this project
     if (error) {
         return { error: error.message };
     }
@@ -3472,7 +3875,7 @@ async function createRegressionTest(args) {
         .from('reports')
         .select('*')
         .eq('id', args.report_id)
-        .eq('project_id', PROJECT_ID) // Security: ensure report belongs to this project
+        .eq('project_id', currentProjectId) // Security: ensure report belongs to this project
         .single();
     if (fetchError) {
         return { error: fetchError.message };
@@ -3489,7 +3892,7 @@ async function createRegressionTest(args) {
     const { data: existingTests } = await supabase
         .from('test_cases')
         .select('test_key')
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('test_key', { ascending: false })
         .limit(1);
     const lastKey = existingTests?.[0]?.test_key || 'TC-000';
@@ -3500,7 +3903,7 @@ async function createRegressionTest(args) {
     const targetRoute = appContext?.currentRoute;
     // Generate test case from bug
     const testCase = {
-        project_id: PROJECT_ID,
+        project_id: currentProjectId,
         test_key: newKey,
         title: `Regression: ${report.title}`,
         description: `Regression test to prevent recurrence of bug #${args.report_id.slice(0, 8)}\n\nOriginal bug: ${report.description}`,
@@ -3576,7 +3979,7 @@ async function getPendingFixes(args) {
       created_at,
       report:reports(id, title, severity, description)
     `)
-        .eq('project_id', PROJECT_ID)
+        .eq('project_id', currentProjectId)
         .order('created_at', { ascending: true })
         .limit(limit);
     if (!args.include_claimed) {
@@ -3626,7 +4029,7 @@ async function claimFixRequest(args) {
         .from('fix_requests')
         .select('id, status, claimed_by, prompt, title')
         .eq('id', args.fix_request_id)
-        .eq('project_id', PROJECT_ID) // Security: ensure fix request belongs to this project
+        .eq('project_id', currentProjectId) // Security: ensure fix request belongs to this project
         .single();
     if (checkError) {
         return { error: checkError.message };
@@ -3653,7 +4056,7 @@ async function claimFixRequest(args) {
         claimed_by: claimedBy,
     })
         .eq('id', args.fix_request_id)
-        .eq('project_id', PROJECT_ID) // Security: ensure fix request belongs to this project
+        .eq('project_id', currentProjectId) // Security: ensure fix request belongs to this project
         .eq('status', 'pending'); // Only claim if still pending (race condition protection)
     if (updateError) {
         return { error: updateError.message };
@@ -3688,7 +4091,7 @@ async function completeFixRequest(args) {
         .from('fix_requests')
         .update(updates)
         .eq('id', args.fix_request_id)
-        .eq('project_id', PROJECT_ID); // Security: ensure fix request belongs to this project
+        .eq('project_id', currentProjectId); // Security: ensure fix request belongs to this project
     if (error) {
         return { error: error.message };
     }
@@ -3771,7 +4174,7 @@ async function generatePromptContent(name, args) {
           created_at,
           report:reports(id, title, severity)
         `)
-                .eq('project_id', PROJECT_ID)
+                .eq('project_id', currentProjectId)
                 .eq('status', 'pending')
                 .order('created_at', { ascending: true })
                 .limit(5);
@@ -3779,7 +4182,7 @@ async function generatePromptContent(name, args) {
             let query = supabase
                 .from('reports')
                 .select('id, title, description, severity, status, code_context, created_at')
-                .eq('project_id', PROJECT_ID)
+                .eq('project_id', currentProjectId)
                 .eq('report_type', 'bug')
                 .in('status', ['new', 'confirmed', 'in_progress']);
             if (severity !== 'all') {
@@ -3929,7 +4332,7 @@ Would you like me to generate test cases for these files?`;
             const { data: resolvedBugs } = await supabase
                 .from('reports')
                 .select('id, title, description, severity, resolved_at, code_context')
-                .eq('project_id', PROJECT_ID)
+                .eq('project_id', currentProjectId)
                 .eq('report_type', 'bug')
                 .eq('status', 'resolved')
                 .order('resolved_at', { ascending: false })
@@ -4036,28 +4439,809 @@ Which files or areas would you like me to analyze?`;
             return 'Unknown prompt';
     }
 }
-// Main server setup
-async function main() {
-    initSupabase();
-    const server = new index_js_1.Server({
-        name: 'bugbear-mcp',
-        version: '0.1.0',
-    }, {
-        capabilities: {
-            tools: {},
-            resources: {},
-            prompts: {},
-        },
-    });
-    // Handle tool listing
-    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-        tools,
+// === TESTER & ASSIGNMENT MANAGEMENT HANDLERS ===
+async function listTesters(args) {
+    let query = supabase
+        .from('testers')
+        .select('id, name, email, status, platforms, tier, assigned_count, completed_count, notes, created_at')
+        .eq('project_id', currentProjectId)
+        .order('name', { ascending: true });
+    if (args.status) {
+        query = query.eq('status', args.status);
+    }
+    const { data, error } = await query;
+    if (error) {
+        return { error: error.message };
+    }
+    let testers = data || [];
+    // Filter by platform if specified (platforms is an array column)
+    if (args.platform) {
+        testers = testers.filter((t) => t.platforms && t.platforms.includes(args.platform));
+    }
+    return {
+        count: testers.length,
+        testers: testers.map((t) => ({
+            id: t.id,
+            name: t.name,
+            email: t.email,
+            status: t.status,
+            platforms: t.platforms,
+            tier: t.tier,
+            assignedCount: t.assigned_count,
+            completedCount: t.completed_count,
+            notes: t.notes,
+        })),
+    };
+}
+async function listTestRuns(args) {
+    const limit = Math.min(args.limit || 20, 50);
+    let query = supabase
+        .from('test_runs')
+        .select('id, name, description, status, total_tests, passed_tests, failed_tests, started_at, completed_at, created_at')
+        .eq('project_id', currentProjectId)
+        .order('created_at', { ascending: false })
+        .limit(limit);
+    if (args.status) {
+        query = query.eq('status', args.status);
+    }
+    const { data, error } = await query;
+    if (error) {
+        return { error: error.message };
+    }
+    return {
+        count: (data || []).length,
+        testRuns: (data || []).map((r) => ({
+            id: r.id,
+            name: r.name,
+            description: r.description,
+            status: r.status,
+            totalTests: r.total_tests,
+            passedTests: r.passed_tests,
+            failedTests: r.failed_tests,
+            passRate: r.total_tests > 0 ? Math.round((r.passed_tests / r.total_tests) * 100) : 0,
+            startedAt: r.started_at,
+            completedAt: r.completed_at,
+            createdAt: r.created_at,
+        })),
+    };
+}
+async function createTestRun(args) {
+    if (!args.name || args.name.trim().length === 0) {
+        return { error: 'Test run name is required' };
+    }
+    const { data, error } = await supabase
+        .from('test_runs')
+        .insert({
+        project_id: currentProjectId,
+        name: args.name.trim(),
+        description: args.description?.trim() || null,
+        status: 'draft',
+    })
+        .select('id, name, description, status, created_at')
+        .single();
+    if (error) {
+        return { error: error.message };
+    }
+    return {
+        success: true,
+        testRun: {
+            id: data.id,
+            name: data.name,
+            description: data.description,
+            status: data.status,
+            createdAt: data.created_at,
+        },
+        message: `Test run "${data.name}" created. Use assign_tests to add test assignments.`,
+    };
+}
+async function listTestAssignments(args) {
+    const limit = Math.min(args.limit || 50, 200);
+    if (args.tester_id && !isValidUUID(args.tester_id)) {
+        return { error: 'Invalid tester_id format' };
+    }
+    if (args.test_run_id && !isValidUUID(args.test_run_id)) {
+        return { error: 'Invalid test_run_id format' };
+    }
+    let query = supabase
+        .from('test_assignments')
+        .select(`
+      id,
+      status,
+      assigned_at,
+      started_at,
+      completed_at,
+      duration_seconds,
+      is_verification,
+      notes,
+      test_case:test_cases(id, test_key, title, priority, target_route),
+      tester:testers(id, name, email),
+      test_run:test_runs(id, name)
+    `)
+        .eq('project_id', currentProjectId)
+        .order('assigned_at', { ascending: false })
+        .limit(limit);
+    if (args.tester_id) {
+        query = query.eq('tester_id', args.tester_id);
+    }
+    if (args.test_run_id) {
+        query = query.eq('test_run_id', args.test_run_id);
+    }
+    if (args.status) {
+        query = query.eq('status', args.status);
+    }
+    const { data, error } = await query;
+    if (error) {
+        return { error: error.message };
+    }
+    return {
+        count: (data || []).length,
+        assignments: (data || []).map((a) => ({
+            id: a.id,
+            status: a.status,
+            assignedAt: a.assigned_at,
+            startedAt: a.started_at,
+            completedAt: a.completed_at,
+            durationSeconds: a.duration_seconds,
+            isVerification: a.is_verification,
+            notes: a.notes,
+            testCase: a.test_case ? {
+                id: a.test_case.id,
+                testKey: a.test_case.test_key,
+                title: a.test_case.title,
+                priority: a.test_case.priority,
+                targetRoute: a.test_case.target_route,
+            } : null,
+            tester: a.tester ? {
+                id: a.tester.id,
+                name: a.tester.name,
+                email: a.tester.email,
+            } : null,
+            testRun: a.test_run ? {
+                id: a.test_run.id,
+                name: a.test_run.name,
+            } : null,
+        })),
+    };
+}
+async function assignTests(args) {
+    // Validate inputs
+    if (!isValidUUID(args.tester_id)) {
+        return { error: 'Invalid tester_id format' };
+    }
+    if (!args.test_case_ids || args.test_case_ids.length === 0) {
+        return { error: 'At least one test_case_id is required' };
+    }
+    if (args.test_case_ids.length > 50) {
+        return { error: 'Maximum 50 test cases per assignment batch' };
+    }
+    for (const id of args.test_case_ids) {
+        if (!isValidUUID(id)) {
+            return { error: `Invalid test_case_id format: ${id}` };
+        }
+    }
+    if (args.test_run_id && !isValidUUID(args.test_run_id)) {
+        return { error: 'Invalid test_run_id format' };
+    }
+    // Verify tester exists and is active
+    const { data: tester, error: testerErr } = await supabase
+        .from('testers')
+        .select('id, name, email, status')
+        .eq('id', args.tester_id)
+        .eq('project_id', currentProjectId)
+        .single();
+    if (testerErr || !tester) {
+        return { error: 'Tester not found in this project' };
+    }
+    if (tester.status !== 'active') {
+        return { error: `Tester "${tester.name}" is ${tester.status}, not active` };
+    }
+    // Verify test cases exist for this project
+    const { data: testCases, error: tcErr } = await supabase
+        .from('test_cases')
+        .select('id, test_key, title')
+        .eq('project_id', currentProjectId)
+        .in('id', args.test_case_ids);
+    if (tcErr) {
+        return { error: tcErr.message };
+    }
+    const foundIds = new Set((testCases || []).map((tc) => tc.id));
+    const missingIds = args.test_case_ids.filter(id => !foundIds.has(id));
+    if (missingIds.length > 0) {
+        return {
+            error: `Test cases not found in this project: ${missingIds.join(', ')}`,
+        };
+    }
+    // Verify test run exists if provided
+    if (args.test_run_id) {
+        const { data: run, error: runErr } = await supabase
+            .from('test_runs')
+            .select('id')
+            .eq('id', args.test_run_id)
+            .eq('project_id', currentProjectId)
+            .single();
+        if (runErr || !run) {
+            return { error: 'Test run not found in this project' };
+        }
+    }
+    // Build assignment rows
+    const rows = args.test_case_ids.map(tcId => ({
+        project_id: currentProjectId,
+        test_case_id: tcId,
+        tester_id: args.tester_id,
+        test_run_id: args.test_run_id || null,
+        status: 'pending',
+    }));
+    // Insert — use upsert-like approach: insert and handle conflicts
+    const { data: inserted, error: insertErr } = await supabase
+        .from('test_assignments')
+        .insert(rows)
+        .select('id, test_case_id');
+    if (insertErr) {
+        // Check if it's a unique constraint violation
+        if (insertErr.message.includes('duplicate') || insertErr.message.includes('unique')) {
+            // Try inserting one by one to find duplicates
+            const created = [];
+            const skipped = [];
+            for (const row of rows) {
+                const { data: single, error: singleErr } = await supabase
+                    .from('test_assignments')
+                    .insert(row)
+                    .select('id, test_case_id')
+                    .single();
+                if (singleErr) {
+                    const tc = testCases?.find((t) => t.id === row.test_case_id);
+                    skipped.push(tc?.test_key || row.test_case_id);
+                }
+                else if (single) {
+                    created.push(single);
+                }
+            }
+            return {
+                success: true,
+                created: created.length,
+                skipped: skipped.length,
+                skippedTests: skipped,
+                tester: { id: tester.id, name: tester.name },
+                message: `Assigned ${created.length} test(s) to ${tester.name}. ${skipped.length} skipped (already assigned).`,
+            };
+        }
+        return { error: insertErr.message };
+    }
+    return {
+        success: true,
+        created: (inserted || []).length,
+        skipped: 0,
+        tester: { id: tester.id, name: tester.name },
+        testRun: args.test_run_id || null,
+        message: `Assigned ${(inserted || []).length} test(s) to ${tester.name}.`,
+    };
+}
+async function getTesterWorkload(args) {
+    if (!isValidUUID(args.tester_id)) {
+        return { error: 'Invalid tester_id format' };
+    }
+    // Get tester info
+    const { data: tester, error: testerErr } = await supabase
+        .from('testers')
+        .select('id, name, email, status, platforms, tier')
+        .eq('id', args.tester_id)
+        .eq('project_id', currentProjectId)
+        .single();
+    if (testerErr || !tester) {
+        return { error: 'Tester not found in this project' };
+    }
+    // Get all assignments for this tester in this project
+    const { data: assignments, error: assignErr } = await supabase
+        .from('test_assignments')
+        .select(`
+      id,
+      status,
+      assigned_at,
+      completed_at,
+      test_case:test_cases(test_key, title, priority),
+      test_run:test_runs(name)
+    `)
+        .eq('project_id', currentProjectId)
+        .eq('tester_id', args.tester_id)
+        .order('assigned_at', { ascending: false });
+    if (assignErr) {
+        return { error: assignErr.message };
+    }
+    const all = assignments || [];
+    // Count by status
+    const counts = {
+        pending: 0,
+        in_progress: 0,
+        passed: 0,
+        failed: 0,
+        blocked: 0,
+        skipped: 0,
+    };
+    for (const a of all) {
+        counts[a.status] = (counts[a.status] || 0) + 1;
+    }
+    return {
+        tester: {
+            id: tester.id,
+            name: tester.name,
+            email: tester.email,
+            status: tester.status,
+            platforms: tester.platforms,
+            tier: tester.tier,
+        },
+        totalAssignments: all.length,
+        counts,
+        activeLoad: counts.pending + counts.in_progress,
+        recentAssignments: all.slice(0, 10).map((a) => ({
+            id: a.id,
+            status: a.status,
+            assignedAt: a.assigned_at,
+            completedAt: a.completed_at,
+            testCase: a.test_case ? {
+                testKey: a.test_case.test_key,
+                title: a.test_case.title,
+                priority: a.test_case.priority,
+            } : null,
+            testRun: a.test_run?.name || null,
+        })),
+    };
+}
+// === NEW TESTER & ANALYTICS HANDLERS ===
+async function createTester(args) {
+    if (!args.name || args.name.trim().length === 0) {
+        return { error: 'Tester name is required' };
+    }
+    if (!args.email || !args.email.includes('@')) {
+        return { error: 'A valid email address is required' };
+    }
+    if (args.tier !== undefined && (args.tier < 1 || args.tier > 3)) {
+        return { error: 'Tier must be 1, 2, or 3' };
+    }
+    const validPlatforms = ['ios', 'android', 'web'];
+    if (args.platforms) {
+        for (const p of args.platforms) {
+            if (!validPlatforms.includes(p)) {
+                return { error: `Invalid platform "${p}". Must be one of: ${validPlatforms.join(', ')}` };
+            }
+        }
+    }
+    const { data, error } = await supabase
+        .from('testers')
+        .insert({
+        project_id: currentProjectId,
+        name: args.name.trim(),
+        email: args.email.trim().toLowerCase(),
+        platforms: args.platforms || ['ios', 'web'],
+        tier: args.tier ?? 1,
+        notes: args.notes?.trim() || null,
+        status: 'active',
+    })
+        .select('id, name, email, status, platforms, tier, notes, created_at')
+        .single();
+    if (error) {
+        if (error.message.includes('duplicate') || error.message.includes('unique')) {
+            return { error: `A tester with email "${args.email}" already exists in this project` };
+        }
+        return { error: error.message };
+    }
+    return {
+        success: true,
+        tester: {
+            id: data.id,
+            name: data.name,
+            email: data.email,
+            status: data.status,
+            platforms: data.platforms,
+            tier: data.tier,
+            notes: data.notes,
+            createdAt: data.created_at,
+        },
+        message: `Tester "${data.name}" added to the project. Use assign_tests to give them test cases.`,
+    };
+}
+async function updateTester(args) {
+    if (!isValidUUID(args.tester_id)) {
+        return { error: 'Invalid tester_id format' };
+    }
+    const updates = {};
+    if (args.status)
+        updates.status = args.status;
+    if (args.platforms)
+        updates.platforms = args.platforms;
+    if (args.tier !== undefined) {
+        if (args.tier < 1 || args.tier > 3) {
+            return { error: 'Tier must be 1, 2, or 3' };
+        }
+        updates.tier = args.tier;
+    }
+    if (args.notes !== undefined)
+        updates.notes = args.notes.trim() || null;
+    if (args.name)
+        updates.name = args.name.trim();
+    if (Object.keys(updates).length === 0) {
+        return { error: 'No fields to update. Provide at least one of: status, platforms, tier, notes, name' };
+    }
+    const { data, error } = await supabase
+        .from('testers')
+        .update(updates)
+        .eq('id', args.tester_id)
+        .eq('project_id', currentProjectId)
+        .select('id, name, email, status, platforms, tier, notes')
+        .single();
+    if (error) {
+        return { error: error.message };
+    }
+    if (!data) {
+        return { error: 'Tester not found in this project' };
+    }
+    return {
+        success: true,
+        tester: {
+            id: data.id,
+            name: data.name,
+            email: data.email,
+            status: data.status,
+            platforms: data.platforms,
+            tier: data.tier,
+            notes: data.notes,
+        },
+        updatedFields: Object.keys(updates),
+    };
+}
+async function bulkUpdateReports(args) {
+    if (!args.report_ids || args.report_ids.length === 0) {
+        return { error: 'At least one report_id is required' };
+    }
+    if (args.report_ids.length > 50) {
+        return { error: 'Maximum 50 reports per bulk update' };
+    }
+    for (const id of args.report_ids) {
+        if (!isValidUUID(id)) {
+            return { error: `Invalid report_id format: ${id}` };
+        }
+    }
+    const updates = { status: args.status };
+    if (args.resolution_notes) {
+        updates.resolution_notes = args.resolution_notes;
+    }
+    // Set resolved_at timestamp for terminal statuses
+    if (['fixed', 'resolved', 'verified', 'wont_fix', 'duplicate', 'closed'].includes(args.status)) {
+        updates.resolved_at = new Date().toISOString();
+    }
+    const { data, error } = await supabase
+        .from('reports')
+        .update(updates)
+        .eq('project_id', currentProjectId)
+        .in('id', args.report_ids)
+        .select('id, status, description');
+    if (error) {
+        return { error: error.message };
+    }
+    const updated = data || [];
+    const updatedIds = new Set(updated.map((r) => r.id));
+    const notFound = args.report_ids.filter(id => !updatedIds.has(id));
+    return {
+        success: true,
+        updatedCount: updated.length,
+        requestedCount: args.report_ids.length,
+        notFound: notFound.length > 0 ? notFound : undefined,
+        status: args.status,
+        reports: updated.map((r) => ({
+            id: r.id,
+            status: r.status,
+            description: r.description?.slice(0, 80),
+        })),
+        message: `Updated ${updated.length} report(s) to "${args.status}".${notFound.length > 0 ? ` ${notFound.length} report(s) not found.` : ''}`,
+    };
+}
+async function getBugTrends(args) {
+    const days = Math.min(args.days || 30, 180);
+    const groupBy = args.group_by || 'week';
+    const since = new Date(Date.now() - days * 86400000).toISOString();
+    const { data, error } = await supabase
+        .from('reports')
+        .select('id, severity, category, status, report_type, created_at')
+        .eq('project_id', currentProjectId)
+        .gte('created_at', since)
+        .order('created_at', { ascending: true });
+    if (error) {
+        return { error: error.message };
+    }
+    const reports = data || [];
+    if (groupBy === 'week') {
+        const weeks = {};
+        for (const r of reports) {
+            const d = new Date(r.created_at);
+            // Get Monday of that week
+            const day = d.getDay();
+            const diff = d.getDate() - day + (day === 0 ? -6 : 1);
+            const monday = new Date(d.setDate(diff));
+            const weekKey = monday.toISOString().slice(0, 10);
+            if (!weeks[weekKey])
+                weeks[weekKey] = { count: 0, critical: 0, high: 0, medium: 0, low: 0 };
+            weeks[weekKey].count++;
+            const sev = (r.severity || 'low');
+            weeks[weekKey][sev]++;
+        }
+        return {
+            period: `${days} days`,
+            groupBy: 'week',
+            totalReports: reports.length,
+            weeks: Object.entries(weeks).map(([week, data]) => ({ week, ...data })),
+        };
+    }
+    if (groupBy === 'severity') {
+        const groups = { critical: 0, high: 0, medium: 0, low: 0 };
+        for (const r of reports)
+            groups[r.severity || 'low']++;
+        return { period: `${days} days`, groupBy: 'severity', totalReports: reports.length, breakdown: groups };
+    }
+    if (groupBy === 'category') {
+        const groups = {};
+        for (const r of reports) {
+            const cat = r.category || 'uncategorized';
+            groups[cat] = (groups[cat] || 0) + 1;
+        }
+        return { period: `${days} days`, groupBy: 'category', totalReports: reports.length, breakdown: groups };
+    }
+    if (groupBy === 'status') {
+        const groups = {};
+        for (const r of reports) {
+            groups[r.status] = (groups[r.status] || 0) + 1;
+        }
+        return { period: `${days} days`, groupBy: 'status', totalReports: reports.length, breakdown: groups };
+    }
+    return { error: `Invalid group_by: ${groupBy}. Must be one of: week, severity, category, status` };
+}
+async function getTesterLeaderboard(args) {
+    const days = Math.min(args.days || 30, 180);
+    const sortBy = args.sort_by || 'tests_completed';
+    const since = new Date(Date.now() - days * 86400000).toISOString();
+    // Get all testers for the project
+    const { data: testers, error: testerErr } = await supabase
+        .from('testers')
+        .select('id, name, email, status, platforms, tier')
+        .eq('project_id', currentProjectId)
+        .eq('status', 'active');
+    if (testerErr)
+        return { error: testerErr.message };
+    // Get completed assignments in the period
+    const { data: assignments, error: assignErr } = await supabase
+        .from('test_assignments')
+        .select('tester_id, status, completed_at, duration_seconds')
+        .eq('project_id', currentProjectId)
+        .gte('completed_at', since)
+        .in('status', ['passed', 'failed']);
+    if (assignErr)
+        return { error: assignErr.message };
+    // Get bugs filed in the period
+    const { data: bugs, error: bugErr } = await supabase
+        .from('reports')
+        .select('tester_id, severity')
+        .eq('project_id', currentProjectId)
+        .gte('created_at', since)
+        .not('tester_id', 'is', null);
+    if (bugErr)
+        return { error: bugErr.message };
+    // Aggregate per tester
+    const testerMap = new Map();
+    for (const t of testers || []) {
+        testerMap.set(t.id, {
+            id: t.id,
+            name: t.name,
+            email: t.email,
+            tier: t.tier,
+            testsCompleted: 0,
+            testsPassed: 0,
+            testsFailed: 0,
+            bugsFound: 0,
+            criticalBugs: 0,
+            avgDurationSeconds: 0,
+            totalDuration: 0,
+        });
+    }
+    for (const a of assignments || []) {
+        const entry = testerMap.get(a.tester_id);
+        if (!entry)
+            continue;
+        entry.testsCompleted++;
+        if (a.status === 'passed')
+            entry.testsPassed++;
+        if (a.status === 'failed')
+            entry.testsFailed++;
+        if (a.duration_seconds)
+            entry.totalDuration += a.duration_seconds;
+    }
+    for (const b of bugs || []) {
+        const entry = testerMap.get(b.tester_id);
+        if (!entry)
+            continue;
+        entry.bugsFound++;
+        if (b.severity === 'critical')
+            entry.criticalBugs++;
+    }
+    let leaderboard = Array.from(testerMap.values()).map(t => ({
+        ...t,
+        passRate: t.testsCompleted > 0 ? Math.round((t.testsPassed / t.testsCompleted) * 100) : 0,
+        avgDurationSeconds: t.testsCompleted > 0 ? Math.round(t.totalDuration / t.testsCompleted) : 0,
+        totalDuration: undefined,
+    }));
+    // Sort
+    if (sortBy === 'bugs_found') {
+        leaderboard.sort((a, b) => b.bugsFound - a.bugsFound);
+    }
+    else if (sortBy === 'pass_rate') {
+        leaderboard.sort((a, b) => b.passRate - a.passRate);
+    }
+    else {
+        leaderboard.sort((a, b) => b.testsCompleted - a.testsCompleted);
+    }
+    return {
+        period: `${days} days`,
+        sortedBy: sortBy,
+        leaderboard,
+    };
+}
+async function exportTestResults(args) {
+    if (!isValidUUID(args.test_run_id)) {
+        return { error: 'Invalid test_run_id format' };
+    }
+    // Get the test run
+    const { data: run, error: runErr } = await supabase
+        .from('test_runs')
+        .select('id, name, description, status, total_tests, passed_tests, failed_tests, started_at, completed_at, created_at')
+        .eq('id', args.test_run_id)
+        .eq('project_id', currentProjectId)
+        .single();
+    if (runErr || !run) {
+        return { error: 'Test run not found in this project' };
+    }
+    // Get all assignments for this run
+    const { data: assignments, error: assignErr } = await supabase
+        .from('test_assignments')
+        .select(`
+      id,
+      status,
+      assigned_at,
+      started_at,
+      completed_at,
+      duration_seconds,
+      is_verification,
+      notes,
+      skip_reason,
+      test_result,
+      feedback_rating,
+      feedback_note,
+      test_case:test_cases(id, test_key, title, priority, description, target_route),
+      tester:testers(id, name, email)
+    `)
+        .eq('test_run_id', args.test_run_id)
+        .eq('project_id', currentProjectId)
+        .order('assigned_at', { ascending: true });
+    if (assignErr) {
+        return { error: assignErr.message };
+    }
+    const all = assignments || [];
+    const passCount = all.filter(a => a.status === 'passed').length;
+    const failCount = all.filter(a => a.status === 'failed').length;
+    return {
+        testRun: {
+            id: run.id,
+            name: run.name,
+            description: run.description,
+            status: run.status,
+            startedAt: run.started_at,
+            completedAt: run.completed_at,
+            createdAt: run.created_at,
+        },
+        summary: {
+            totalAssignments: all.length,
+            passed: passCount,
+            failed: failCount,
+            blocked: all.filter(a => a.status === 'blocked').length,
+            skipped: all.filter(a => a.status === 'skipped').length,
+            pending: all.filter(a => a.status === 'pending').length,
+            inProgress: all.filter(a => a.status === 'in_progress').length,
+            passRate: all.length > 0 ? Math.round((passCount / all.length) * 100) : 0,
+        },
+        assignments: all.map((a) => ({
+            id: a.id,
+            status: a.status,
+            assignedAt: a.assigned_at,
+            startedAt: a.started_at,
+            completedAt: a.completed_at,
+            durationSeconds: a.duration_seconds,
+            isVerification: a.is_verification,
+            notes: a.notes,
+            skipReason: a.skip_reason,
+            testResult: a.test_result,
+            feedbackRating: a.feedback_rating,
+            feedbackNote: a.feedback_note,
+            testCase: a.test_case ? {
+                id: a.test_case.id,
+                testKey: a.test_case.test_key,
+                title: a.test_case.title,
+                priority: a.test_case.priority,
+                description: a.test_case.description,
+                targetRoute: a.test_case.target_route,
+            } : null,
+            tester: a.tester ? {
+                id: a.tester.id,
+                name: a.tester.name,
+                email: a.tester.email,
+            } : null,
+        })),
+    };
+}
+async function getTestingVelocity(args) {
+    const days = Math.min(args.days || 14, 90);
+    const since = new Date(Date.now() - days * 86400000).toISOString();
+    const { data, error } = await supabase
+        .from('test_assignments')
+        .select('completed_at, status')
+        .eq('project_id', currentProjectId)
+        .gte('completed_at', since)
+        .in('status', ['passed', 'failed'])
+        .order('completed_at', { ascending: true });
+    if (error) {
+        return { error: error.message };
+    }
+    const completions = data || [];
+    // Group by day
+    const dailyCounts = {};
+    for (let i = 0; i < days; i++) {
+        const d = new Date(Date.now() - (days - 1 - i) * 86400000);
+        dailyCounts[d.toISOString().slice(0, 10)] = 0;
+    }
+    for (const c of completions) {
+        const day = new Date(c.completed_at).toISOString().slice(0, 10);
+        if (dailyCounts[day] !== undefined) {
+            dailyCounts[day]++;
+        }
+    }
+    const dailyArray = Object.entries(dailyCounts).map(([date, count]) => ({ date, count }));
+    const totalCompleted = completions.length;
+    const avgPerDay = days > 0 ? Math.round((totalCompleted / days) * 10) / 10 : 0;
+    // Trend: compare first half to second half
+    const mid = Math.floor(dailyArray.length / 2);
+    const firstHalf = dailyArray.slice(0, mid).reduce((sum, d) => sum + d.count, 0);
+    const secondHalf = dailyArray.slice(mid).reduce((sum, d) => sum + d.count, 0);
+    const trend = secondHalf > firstHalf ? 'increasing' : secondHalf < firstHalf ? 'decreasing' : 'stable';
+    return {
+        period: `${days} days`,
+        totalCompleted,
+        averagePerDay: avgPerDay,
+        trend,
+        daily: dailyArray,
+    };
+}
+// Main server setup
+async function main() {
+    initSupabase();
+    const server = new index_js_1.Server({
+        name: 'bugbear-mcp',
+        version: '0.1.0',
+    }, {
+        capabilities: {
+            tools: {},
+            resources: {},
+            prompts: {},
+        },
+    });
+    // Handle tool listing
+    server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
+        tools,
     }));
     // Handle tool execution
     server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
         const { name, arguments: args } = request.params;
         try {
             let result;
+            // Project management tools don't require a project to be selected
+            const projectFreeTools = ['list_projects', 'switch_project', 'get_current_project'];
+            if (!projectFreeTools.includes(name)) {
+                requireProject();
+            }
             switch (name) {
                 case 'list_reports':
                     result = await listReports(args);
@@ -4171,6 +5355,57 @@ async function main() {
                 case 'get_testing_patterns':
                     result = await getTestingPatterns(args);
                     break;
+                // === TESTER & ASSIGNMENT MANAGEMENT ===
+                case 'list_testers':
+                    result = await listTesters(args);
+                    break;
+                case 'list_test_runs':
+                    result = await listTestRuns(args);
+                    break;
+                case 'create_test_run':
+                    result = await createTestRun(args);
+                    break;
+                case 'list_test_assignments':
+                    result = await listTestAssignments(args);
+                    break;
+                case 'assign_tests':
+                    result = await assignTests(args);
+                    break;
+                case 'get_tester_workload':
+                    result = await getTesterWorkload(args);
+                    break;
+                // === NEW TESTER & ANALYTICS TOOLS ===
+                case 'create_tester':
+                    result = await createTester(args);
+                    break;
+                case 'update_tester':
+                    result = await updateTester(args);
+                    break;
+                case 'bulk_update_reports':
+                    result = await bulkUpdateReports(args);
+                    break;
+                case 'get_bug_trends':
+                    result = await getBugTrends(args);
+                    break;
+                case 'get_tester_leaderboard':
+                    result = await getTesterLeaderboard(args);
+                    break;
+                case 'export_test_results':
+                    result = await exportTestResults(args);
+                    break;
+                case 'get_testing_velocity':
+                    result = await getTestingVelocity(args);
+                    break;
+                // === PROJECT MANAGEMENT ===
+                case 'list_projects':
+                    result = await listProjects();
+                    break;
+                case 'switch_project':
+                    result = await switchProject(args);
+                    break;
+                case 'get_current_project':
+                    result = getCurrentProject();
+                    break;
                 default:
                     return {
                         content: [{ type: 'text', text: `Unknown tool: ${name}` }],
@@ -4190,13 +5425,17 @@ async function main() {
     });
     // Handle resource listing (reports as resources)
     server.setRequestHandler(types_js_1.ListResourcesRequestSchema, async () => {
-        const { data } = await supabase
+        const { data, error } = await supabase
             .from('reports')
             .select('id, description, report_type, severity')
-            .eq('project_id', PROJECT_ID)
+            .eq('project_id', currentProjectId)
             .eq('status', 'new')
             .order('created_at', { ascending: false })
             .limit(10);
+        if (error) {
+            console.error('Failed to list resources:', error.message);
+            return { resources: [] };
+        }
         return {
             resources: (data || []).map(r => ({
                 uri: `bugbear://reports/${r.id}`,