@fruition/fcp-mcp-server 1.27.1 → 1.29.0

package/README.md

@@ -16,6 +16,33 @@ MCP (Model Context Protocol) server that gives Claude Code direct access to the
 | `fcp_add_progress_note` | Add progress notes to document work done |
 | `fcp_get_claude_md` | Generate CLAUDE.md content for a launch |
 
+### Tasker Freeze Management Tools
+
+| Tool | Description |
+|------|-------------|
+| `fcp_list_freezes` | List active + scheduled auto-merge freezes and the available repos |
+| `fcp_freeze_repo` | Schedule a freeze (by days or explicit window) to hold a repo's deploys |
+| `fcp_update_freeze` | Edit an existing freeze's window or reason |
+| `fcp_unfreeze` | Remove a freeze by id, or clear all freezes for a repo |
+
+### Certificate Tools
+
+| Tool | Description |
+|------|-------------|
+| `fcp_list_certificates` | Fleet TLS certs with status/expiry/cluster filters |
+| `fcp_get_certificate` | Single certificate detail (issuer, SANs, expiry) |
+| `fcp_scan_certificates` | Trigger a cert-monitor scan run |
+
+### Tasker Job Control Tools
+
+| Tool | Description |
+|------|-------------|
+| `fcp_spawn_task_job` | Spawn an automated code-change job for an Unroo task |
+| `fcp_get_job_status` | Job status by job_id/task_id (or all + stats) |
+| `fcp_list_jobs` | List the current Tasker job queue |
+| `fcp_approve_job` | Approve merge for a job needing human sign-off |
+| `fcp_override_merge_window` | Force-allow an auto-merge outside its deploy window (super_admin) |
+
 ### Unroo Task Management Tools
 
 | Tool | Description |

package/dist/index.d.ts

@@ -7,4 +7,436 @@
  * - Update checklist item status
  * - Get project context for migrations
  */
+interface Launch {
+    id: number;
+    name: string;
+    description: string | null;
+    platform: string;
+    launch_type: string;
+    status: string;
+    priority: string;
+    target_launch_date: string;
+    domain: string | null;
+    legacy_domain: string | null;
+    legacy_access_info: Record<string, any>;
+    [key: string]: any;
+}
+interface ChecklistItem {
+    id: number;
+    title: string;
+    description: string | null;
+    status: string;
+    category: string;
+    is_blocker: boolean;
+    claude_instructions: string | null;
+    [key: string]: any;
+}
+interface LaunchDetail {
+    launch: Launch;
+    checklist: ChecklistItem[];
+    [key: string]: any;
+}
+export declare class FCPClient {
+    private baseUrl;
+    private token;
+    private defaultTimeout;
+    constructor(baseUrl: string, token: string);
+    private fetch;
+    listLaunches(filters?: {
+        status?: string;
+        platform?: string;
+        upcoming?: number;
+        limit?: number;
+    }): Promise<{
+        launches: Launch[];
+    }>;
+    getLaunch(id: number): Promise<LaunchDetail>;
+    createChecklistItem(launchId: number, input: {
+        title: string;
+        category: string;
+        description?: string;
+        role?: string;
+        environment?: string;
+        assigned_to_id?: number;
+        due_date?: string;
+        sort_order?: number;
+        depends_on_item_id?: number;
+        is_required?: boolean;
+        is_blocking?: boolean;
+        external_link?: string;
+    }): Promise<ChecklistItem>;
+    updateChecklistItem(launchId: number, itemId: number, updates: {
+        status?: string;
+        notes?: string;
+        title?: string;
+        description?: string | null;
+        category?: string;
+        role?: string;
+        environment?: string;
+        assigned_to_id?: number | null;
+        due_date?: string | null;
+        sort_order?: number;
+        depends_on_item_id?: number | null;
+        is_required?: boolean;
+        is_blocking?: boolean;
+        external_link?: string | null;
+        evidence_url?: string | null;
+        jira_ticket_key?: string | null;
+        completion_notes?: string | null;
+    }): Promise<ChecklistItem>;
+    deleteChecklistItem(launchId: number, itemId: number): Promise<{
+        success: boolean;
+    }>;
+    private buildQuery;
+    listAlerts(q?: {
+        status?: string;
+        source?: string;
+        severity?: string;
+        cluster?: string;
+        namespace?: string;
+        domain?: string;
+        websiteId?: number;
+        environment?: string;
+        from?: string;
+        to?: string;
+        page?: number;
+        limit?: number;
+    }): Promise<any>;
+    getAlert(id: number): Promise<any>;
+    createAlert(input: {
+        alertName: string;
+        severity?: string;
+        summary?: string;
+        cluster?: string;
+        namespace?: string;
+        domain?: string;
+        websiteId?: number;
+    }): Promise<any>;
+    updateAlert(id: number, updates: {
+        status?: string;
+        acknowledgedBy?: string;
+        silencedUntil?: string;
+        silencedBy?: string;
+        adminNotes?: string;
+        websiteId?: number;
+        unrooTaskId?: number;
+    }): Promise<any>;
+    getAlertStats(): Promise<any>;
+    listAlertRules(accountId?: number): Promise<any>;
+    getAlertRule(ruleId: number): Promise<any>;
+    createAlertRule(input: Record<string, any>): Promise<any>;
+    updateAlertRule(ruleId: number, updates: Record<string, any>): Promise<any>;
+    deleteAlertRule(ruleId: number): Promise<any>;
+    listOutages(q?: {
+        status?: string;
+        accountId?: number;
+        limit?: number;
+    }): Promise<any>;
+    getOutage(outageId: number): Promise<any>;
+    createOutage(input: Record<string, any>): Promise<any>;
+    updateOutage(outageId: number, updates: Record<string, any>): Promise<any>;
+    resolveOutage(outageId: number): Promise<any>;
+    bulkNotifyClients(input: {
+        outageIds: number[];
+        notificationType: string;
+        subject: string;
+        message: string;
+        channels?: string[];
+        sentBy?: string;
+    }): Promise<any>;
+    getBulkNotifyHistory(limit?: number): Promise<any>;
+    createLaunch(input: {
+        name: string;
+        platform: string;
+        launch_type: string;
+        target_launch_date: string;
+        website_id?: number;
+        account_id?: number;
+        description?: string;
+        soft_launch_date?: string;
+        kickoff_date?: string;
+        priority?: string;
+        jira_project_key?: string;
+        unroo_project_id?: number;
+        webops_lead_id?: number;
+        devops_lead_id?: number;
+        dev_lead_id?: number;
+        seo_lead_id?: number;
+        client_contact?: string;
+        client_contact_email?: string;
+        use_default_checklist?: boolean;
+    }): Promise<{
+        launch: Launch;
+    }>;
+    updateLaunch(id: number, updates: {
+        website_id?: number | null;
+        account_id?: number | null;
+        name?: string;
+        description?: string;
+        platform?: string;
+        launch_type?: string;
+        target_launch_date?: string;
+        soft_launch_date?: string | null;
+        actual_launch_date?: string | null;
+        kickoff_date?: string | null;
+        status?: string;
+        priority?: string;
+        jira_project_key?: string | null;
+        unroo_project_id?: number | null;
+        webops_lead_id?: number | null;
+        devops_lead_id?: number | null;
+        dev_lead_id?: number | null;
+        seo_lead_id?: number | null;
+        client_contact?: string | null;
+        client_contact_email?: string | null;
+    }): Promise<any>;
+    deleteLaunch(id: number): Promise<{
+        success: boolean;
+    }>;
+    getSuccessFactors(launchId: number, itemId: number): Promise<{
+        factors: any[];
+    }>;
+    validateChecklistItem(launchId: number, itemId: number): Promise<any>;
+    getClaudeMd(launchId: number): Promise<{
+        content: string;
+    }>;
+    addNote(launchId: number, content: string): Promise<any>;
+    listFileSyncConfigs(filters?: {
+        enabled?: boolean;
+        search?: string;
+        sync_direction?: string;
+    }): Promise<{
+        success: boolean;
+        data: any[];
+        count: number;
+    }>;
+    getFileSyncJobs(filters?: {
+        config_id?: number;
+        status?: string;
+        limit?: number;
+    }): Promise<{
+        success: boolean;
+        data: any[];
+        count: number;
+    }>;
+    startFileSync(input: {
+        config_id: number;
+        trigger_type?: string;
+        triggered_by?: string;
+        confirmation_token?: string;
+    }): Promise<{
+        success: boolean;
+        data: any;
+        message: string;
+    }>;
+    cancelFileSync(jobId: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    getFileSyncConfirmation(configId: number): Promise<{
+        success: boolean;
+        data: {
+            token: string;
+            config_id: number;
+            expires_at: string;
+            ttl_seconds: number;
+            warnings: string[];
+        };
+    }>;
+    triggerNucleiScan(websiteId: number, options?: {
+        url?: string;
+        severity?: string;
+        templates?: string;
+    }): Promise<any>;
+    getNucleiResults(websiteId: number, options?: {
+        scan_id?: string;
+        limit?: number;
+        status?: string;
+    }): Promise<any>;
+    scanSecurityHeaders(websiteId: number): Promise<any>;
+    getSecurityHeadersResults(websiteId: number, scanId?: string): Promise<any>;
+    listSites(filters?: {
+        account_id?: number;
+        cms?: string;
+        environment?: string;
+        fru_hosted?: boolean;
+        retired?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<any>;
+    searchSites(query: string, limit?: number): Promise<any>;
+    getSite(siteId: number): Promise<any>;
+    createSite(production: {
+        account_id: number;
+        domain: string;
+        cms: string;
+        url_full?: string;
+        git_provider?: string;
+        git_link?: string;
+        hosting_provider?: string;
+        fru_hosted?: boolean;
+        k8s_cluster?: string;
+        k8s_namespace?: string;
+    }, staging?: Array<{
+        domain: string;
+        k8s_namespace: string;
+    }>): Promise<any>;
+    updateSite(siteId: number, updates: Record<string, any>): Promise<any>;
+    deleteSite(siteId: number, options?: {
+        reason?: string;
+        forward_url?: string;
+    }): Promise<any>;
+    getLocalSetupGuide(siteId: number): Promise<any>;
+    listClients(filters?: {
+        q?: string;
+        webops_lead?: string;
+        contract_type?: string;
+        tier?: string;
+        marketing?: boolean;
+        status?: string;
+        limit?: number;
+    }): Promise<any>;
+    getClient(accountId: number): Promise<any>;
+    updateClientProfile(accountId: number, updates: Record<string, any>): Promise<any>;
+    shieldListDomains(filters?: {
+        status?: string;
+        account_id?: number;
+    }): Promise<any>;
+    shieldAddDomain(input: {
+        domain: string;
+        origin_type?: 'custom' | 's3';
+        origin_host?: string;
+        origin_port?: number;
+        origin_protocol?: string;
+        s3_bucket?: string;
+        s3_region?: string;
+        s3_origin_path?: string;
+        website_id?: number;
+        account_id?: number;
+        cache_profile?: string;
+        waf_profile?: string;
+        geo_block_countries?: string[];
+        bot_control_enabled?: boolean;
+        notes?: string;
+    }): Promise<any>;
+    shieldGetDomain(domainId: number): Promise<any>;
+    shieldUpdateDomain(domainId: number, updates: Record<string, any>): Promise<any>;
+    shieldRemoveDomain(domainId: number): Promise<any>;
+    shieldGetMetrics(): Promise<any>;
+    shieldVerifyDomain(domainId: number): Promise<any>;
+    private fetchText;
+    trustedIpListRanges(filters?: {
+        group?: string;
+        include_pending?: boolean;
+        include_expired?: boolean;
+    }): Promise<any>;
+    trustedIpAddRange(input: {
+        group_id: number;
+        cidr: string;
+        label?: string;
+        purpose?: string;
+        ticket_ref?: string;
+        expires_at?: string;
+        override_reason?: string;
+    }): Promise<any>;
+    trustedIpUpdateRange(id: number, updates: Record<string, unknown>): Promise<any>;
+    trustedIpRemoveRange(id: number): Promise<any>;
+    trustedIpExport(opts?: {
+        format?: string;
+        group?: string;
+        purpose?: string;
+        separator?: string;
+    }): Promise<string>;
+    listFreezes(): Promise<any>;
+    freezeRepo(input: {
+        repo: string;
+        reason: string;
+        days?: number;
+        starts_at?: string;
+        ends_at?: string;
+    }): Promise<any>;
+    updateFreeze(id: number, updates: Record<string, unknown>): Promise<any>;
+    unfreeze(input: {
+        id?: number;
+        repo?: string;
+    }): Promise<any>;
+    listCertificates(filters?: {
+        status?: string;
+        cluster?: string;
+        namespace?: string;
+        certType?: string;
+        expiringWithinDays?: number;
+        sortBy?: string;
+        sortDir?: string;
+        page?: number;
+        limit?: number;
+    }): Promise<any>;
+    getCertificate(certId: string | number): Promise<any>;
+    scanCertificates(input?: {
+        dryRun?: boolean;
+    }): Promise<any>;
+    spawnTaskJob(input: {
+        task_id: string;
+        task_title: string;
+        project_key: string;
+        task_description?: string;
+        labels?: string[];
+    }): Promise<any>;
+    getJobStatus(opts: {
+        job_id?: string;
+        task_id?: string;
+    }): Promise<any>;
+    listJobs(opts?: {
+        refresh?: boolean;
+    }): Promise<any>;
+    approveJob(id: string): Promise<any>;
+    overrideMergeWindow(id: string, input: {
+        action: 'set' | 'clear';
+        reason?: string;
+        ttl_minutes?: number;
+    }): Promise<any>;
+    backupListSites(): Promise<any>;
+    backupGetConfig(): Promise<any>;
+    backupListEligible(): Promise<any>;
+    backupEnable(siteId: number): Promise<any>;
+    backupTrigger(websiteId: number, triggerType?: string): Promise<any>;
+    backupCheckTrigger(websiteId: number): Promise<any>;
+    backupListBackups(siteId: string): Promise<any>;
+    backupGetStatus(options: {
+        backupId?: string;
+        websiteId?: number;
+    }): Promise<any>;
+    backupDownload(backupId: string): Promise<any>;
+    backupDownloadPrepared(input: {
+        siteId: string;
+        backupId: string;
+        downloadType: string;
+        format?: string;
+        sanitize?: boolean;
+    }): Promise<any>;
+    backupSanitizeStatus(jobId: string): Promise<any>;
+    backupListPairings(siteId?: number): Promise<any>;
+    backupUpdatePairing(siteId: number, pairingConfig: Record<string, any>): Promise<any>;
+    backupDeletePairing(siteId: number): Promise<any>;
+    kinstaBackupListSites(): Promise<any>;
+    kinstaBackupListBackups(siteId: string): Promise<any>;
+    kinstaBackupDownload(s3Key: string): Promise<any>;
+    cloneToStagingConfirm(productionSiteId: number, stagingSiteId: number): Promise<any>;
+    cloneToStaging(params: {
+        productionSiteId: number;
+        stagingSiteId: number;
+        includeFiles?: boolean;
+        includeDatabase?: boolean;
+        runSearchReplace?: boolean;
+        confirmationToken: string;
+        backupId?: string;
+    }): Promise<any>;
+    getCloneStatus(cloneId: string): Promise<any>;
+    listCloneOperations(params?: {
+        productionSiteId?: number;
+        stagingSiteId?: number;
+        limit?: number;
+    }): Promise<any>;
+    getDevEnvironmentInfo(siteId: number): Promise<any>;
+}
 export {};

package/dist/index.js

@@ -98,6 +98,8 @@ const TOOL_PERMISSIONS = {
     fcp_trusted_ip_remove_range: 'super_admin',
     fcp_backup_delete_pairing: 'super_admin',
     fcp_filesync_cancel_sync: 'super_admin',
+    fcp_unfreeze: 'super_admin', // lifting a freeze releases a held deploy
+    fcp_override_merge_window: 'super_admin', // bypasses the deploy-window safety gate
     // --- admin+: mutating ops with real-world side effects ---
     fcp_create_launch: 'admin',
     fcp_update_launch: 'admin',
@@ -108,6 +110,11 @@ const TOOL_PERMISSIONS = {
     fcp_shield_update_domain: 'admin',
     fcp_trusted_ip_add_range: 'admin',
     fcp_trusted_ip_update_range: 'admin',
+    fcp_freeze_repo: 'admin',
+    fcp_update_freeze: 'admin',
+    fcp_scan_certificates: 'admin',
+    fcp_spawn_task_job: 'admin',
+    fcp_approve_job: 'admin',
     fcp_backup_enable: 'admin',
     fcp_backup_trigger: 'admin',
     fcp_backup_check_trigger: 'admin',
@@ -157,6 +164,11 @@ const TOOL_PERMISSIONS = {
     fcp_shield_get_metrics: 'viewer',
     fcp_trusted_ip_list_ranges: 'viewer',
     fcp_trusted_ip_export: 'viewer',
+    fcp_list_freezes: 'viewer',
+    fcp_list_certificates: 'viewer',
+    fcp_get_certificate: 'viewer',
+    fcp_list_jobs: 'viewer',
+    fcp_get_job_status: 'viewer',
     fcp_backup_list_sites: 'viewer',
     fcp_backup_get_config: 'viewer',
     fcp_backup_list_eligible: 'viewer',
@@ -346,7 +358,7 @@ async function initializeProjectDetection() {
     }
 }
 // API Client
-class FCPClient {
+export class FCPClient {
     baseUrl;
     token;
     defaultTimeout = 15000; // 15 seconds
@@ -795,6 +807,109 @@ class FCPClient {
         return this.fetchText(`/api/infrastructure/trusted-ips/export${qs ? `?${qs}` : ''}`);
     }
     // ============================================================================
+    // Tasker Freeze Management Methods
+    // ============================================================================
+    async listFreezes() {
+        return this.fetch('/api/ticket-workflow/freeze');
+    }
+    async freezeRepo(input) {
+        return this.fetch('/api/ticket-workflow/freeze', {
+            method: 'POST',
+            body: JSON.stringify(input),
+        });
+    }
+    async updateFreeze(id, updates) {
+        return this.fetch('/api/ticket-workflow/freeze', {
+            method: 'PATCH',
+            body: JSON.stringify({ id, ...updates }),
+        });
+    }
+    async unfreeze(input) {
+        const hasId = input.id !== undefined && input.id !== null;
+        const hasRepo = typeof input.repo === 'string' && input.repo.length > 0;
+        if (hasId === hasRepo) {
+            throw new Error('unfreeze requires exactly one of "id" or "repo"');
+        }
+        const body = hasId ? { id: input.id } : { repo: input.repo };
+        return this.fetch('/api/ticket-workflow/freeze', {
+            method: 'DELETE',
+            body: JSON.stringify(body),
+        });
+    }
+    // ============================================================================
+    // Certificate Methods
+    // ============================================================================
+    async listCertificates(filters) {
+        const p = new URLSearchParams();
+        if (filters?.status)
+            p.append('status', filters.status);
+        if (filters?.cluster)
+            p.append('cluster', filters.cluster);
+        if (filters?.namespace)
+            p.append('namespace', filters.namespace);
+        if (filters?.certType)
+            p.append('certType', filters.certType);
+        if (filters?.expiringWithinDays != null)
+            p.append('expiringWithinDays', String(filters.expiringWithinDays));
+        if (filters?.sortBy)
+            p.append('sortBy', filters.sortBy);
+        if (filters?.sortDir)
+            p.append('sortDir', filters.sortDir);
+        if (filters?.page != null)
+            p.append('page', String(filters.page));
+        if (filters?.limit != null)
+            p.append('limit', String(filters.limit));
+        const qs = p.toString();
+        return this.fetch(`/api/certificates${qs ? `?${qs}` : ''}`);
+    }
+    async getCertificate(certId) {
+        return this.fetch(`/api/certificates/${encodeURIComponent(String(certId))}`);
+    }
+    async scanCertificates(input) {
+        return this.fetch('/api/certificates/scan', {
+            method: 'POST',
+            body: JSON.stringify(input || {}),
+        });
+    }
+    // ============================================================================
+    // Tasker Job Control Methods
+    // ============================================================================
+    async spawnTaskJob(input) {
+        return this.fetch('/api/ticket-workflow/spawn', {
+            method: 'POST',
+            body: JSON.stringify(input),
+        });
+    }
+    async getJobStatus(opts) {
+        const p = new URLSearchParams();
+        if (opts.job_id)
+            p.append('job_id', opts.job_id);
+        if (opts.task_id)
+            p.append('task_id', opts.task_id);
+        const qs = p.toString();
+        return this.fetch(`/api/ticket-workflow/status${qs ? `?${qs}` : ''}`);
+    }
+    async listJobs(opts) {
+        const qs = opts?.refresh ? '?refresh=true' : '';
+        return this.fetch(`/api/ticket-workflow/queue${qs}`);
+    }
+    async approveJob(id) {
+        return this.fetch(`/api/ticket-workflow/jobs/${encodeURIComponent(id)}/approve`, {
+            method: 'POST',
+            body: JSON.stringify({}),
+        });
+    }
+    async overrideMergeWindow(id, input) {
+        const path = `/api/ticket-workflow/jobs/${encodeURIComponent(id)}/override`;
+        if (input.action === 'clear') {
+            return this.fetch(path, { method: 'DELETE' });
+        }
+        const body = { reason: input.reason };
+        if (input.ttl_minutes != null)
+            body.ttl_minutes = input.ttl_minutes;
+        return this.fetch(path, { method: 'POST', body: JSON.stringify(body) });
+    }
+    // ============================================================================
     // Backup Management Methods
     // ============================================================================
     async backupListSites() {
@@ -3075,6 +3190,153 @@ const TOOLS = [
             },
         },
     },
+    {
+        name: 'fcp_list_freezes',
+        description: 'List Tasker auto-merge freezes. Returns frozen_repos (active now), scheduled_repos (future windows), and available_repos (every repo you may freeze, with project keys + domains). A frozen repo has its release/security PRs held from the 6-7 AM MT deployment window. Call this before fcp_freeze_repo to pick a valid repo and avoid duplicate freezes.',
+        inputSchema: {
+            type: 'object',
+            properties: {},
+        },
+    },
+    {
+        name: 'fcp_freeze_repo',
+        description: 'Schedule a Tasker auto-merge freeze for a repo (blocks release-PR auto-promotion + security auto-merge while active). Provide either days (1-90) or an explicit ends_at; starts_at defaults to now and cannot be backdated >5 min. The repo must exist in github_repo_mappings (else 404 \u2014 use fcp_list_freezes available_repos). Appends a new window each call.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                repo: { type: 'string', description: 'owner/repo, e.g. "fruition/metroairport"' },
+                reason: { type: 'string', description: 'Why the repo is being frozen (required)' },
+                days: { type: 'number', description: 'Freeze length in days (1-90); alternative to ends_at' },
+                starts_at: { type: 'string', description: 'ISO-8601 start (optional; defaults to now, no backdating >5 min)' },
+                ends_at: { type: 'string', description: 'ISO-8601 end (alternative to days)' },
+            },
+            required: ['repo', 'reason'],
+        },
+    },
+    {
+        name: 'fcp_update_freeze',
+        description: 'Edit an existing freeze by id (from fcp_list_freezes). Change the window (starts_at / ends_at, or days as a shorthand for ends_at) and/or the reason. Window rules match fcp_freeze_repo (<=90 days, no backdating >5 min).',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: { type: 'number', description: 'Freeze id to edit' },
+                starts_at: { type: 'string', description: 'New ISO-8601 start' },
+                ends_at: { type: 'string', description: 'New ISO-8601 end' },
+                days: { type: 'number', description: 'New length in days (recomputes ends_at from starts_at)' },
+                reason: { type: 'string', description: 'New reason' },
+            },
+            required: ['id'],
+        },
+    },
+    {
+        name: 'fcp_unfreeze',
+        description: 'Remove a Tasker freeze. Pass exactly one of: id (remove that single freeze) or repo (remove ALL active + scheduled freezes for that owner/repo). Lifting a freeze lets a held deploy through, so this is a super_admin action.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: { type: 'number', description: 'Freeze id to remove (single)' },
+                repo: { type: 'string', description: 'owner/repo to clear all active+scheduled freezes for' },
+            },
+        },
+    },
+    // ============================================================================
+    // Certificate Tools
+    // ============================================================================
+    {
+        name: 'fcp_list_certificates',
+        description: 'List TLS certificates across the fleet (cert-monitor). Filter by status (valid|warning|critical|expired), expiringWithinDays, cluster, namespace, certType; sort and paginate. Use to find certs about to expire before a migration/cutover.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                status: { type: 'string', description: 'valid | warning | critical | expired | unknown' },
+                expiringWithinDays: { type: 'number', description: 'Only certs expiring within N days' },
+                cluster: { type: 'string', description: 'Filter by k8s cluster' },
+                namespace: { type: 'string', description: 'Filter by namespace' },
+                certType: { type: 'string', description: 'Filter by certificate type' },
+                sortBy: { type: 'string', description: 'name | cluster | namespace | certType | status | expiry | subjectCn' },
+                sortDir: { type: 'string', enum: ['asc', 'desc'], description: 'Sort direction (default asc)' },
+                page: { type: 'number', description: 'Page number (1-based)' },
+                limit: { type: 'number', description: 'Page size' },
+            },
+        },
+    },
+    {
+        name: 'fcp_get_certificate',
+        description: 'Get a single certificate by id, including issuer, SANs, expiry, and history.',
+        inputSchema: {
+            type: 'object',
+            properties: { certId: { type: 'string', description: 'Certificate id' } },
+            required: ['certId'],
+        },
+    },
+    {
+        name: 'fcp_scan_certificates',
+        description: 'Trigger a cert-monitor scan run across clusters to refresh certificate inventory and expiry. Pass dryRun=true to compute without persisting.',
+        inputSchema: {
+            type: 'object',
+            properties: { dryRun: { type: 'boolean', description: 'Compute without writing results (default false)' } },
+        },
+    },
+    // ============================================================================
+    // Tasker Job Control Tools
+    // ============================================================================
+    {
+        name: 'fcp_spawn_task_job',
+        description: 'Spawn a Tasker automated code-change job for an Unroo task (Claude Code in K8s -> PR). Requires task_id, task_title, project_key. Rejects if a job is already in progress for the task.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                task_id: { type: 'string', description: 'Unroo task id' },
+                task_title: { type: 'string', description: 'Task title' },
+                project_key: { type: 'string', description: 'Project key (resolves the repo)' },
+                task_description: { type: 'string', description: 'Optional task description / instructions' },
+                labels: { type: 'array', items: { type: 'string' }, description: 'Optional labels' },
+            },
+            required: ['task_id', 'task_title', 'project_key'],
+        },
+    },
+    {
+        name: 'fcp_get_job_status',
+        description: 'Get Tasker job status. Pass job_id or task_id for a specific job; omit both for all jobs + stats.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                job_id: { type: 'string', description: 'Tasker job id' },
+                task_id: { type: 'string', description: 'Unroo task id (alternative to job_id)' },
+            },
+        },
+    },
+    {
+        name: 'fcp_list_jobs',
+        description: 'List the current Tasker job queue. Pass refresh=true to re-sync statuses from K8s first.',
+        inputSchema: {
+            type: 'object',
+            properties: { refresh: { type: 'boolean', description: 'Re-sync from K8s before listing (default false)' } },
+        },
+    },
+    {
+        name: 'fcp_approve_job',
+        description: 'Approve the merge for a Tasker job that requires human sign-off (e.g. HIGH/CRITICAL security PRs). The job still respects its deploy window unless overridden.',
+        inputSchema: {
+            type: 'object',
+            properties: { id: { type: 'string', description: 'Tasker job id' } },
+            required: ['id'],
+        },
+    },
+    {
+        name: 'fcp_override_merge_window',
+        description: 'Force-allow a Tasker auto-merge OUTSIDE its configured deploy window (super_admin). action=set grants an override for ttl_minutes (reason required); action=clear cancels it. Bypasses the safety gate \u2014 use deliberately.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                id: { type: 'string', description: 'Tasker job id' },
+                action: { type: 'string', enum: ['set', 'clear'], description: 'set = grant override, clear = cancel' },
+                reason: { type: 'string', description: 'Justification (required when action=set)' },
+                ttl_minutes: { type: 'number', description: 'How long the override lasts (when action=set)' },
+            },
+            required: ['id', 'action'],
+        },
+    },
     // ============================================================================
     // Backup Management Tools
     // ============================================================================
@@ -4924,6 +5186,93 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             // ============================================================================
+            // Tasker Freeze Management Handlers
+            // ============================================================================
+            case 'fcp_list_freezes': {
+                const result = await client.listFreezes();
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+                };
+            }
+            case 'fcp_freeze_repo': {
+                const { repo, reason, days, starts_at, ends_at } = args;
+                const result = await client.freezeRepo({ repo, reason, days, starts_at, ends_at });
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+                };
+            }
+            case 'fcp_update_freeze': {
+                const { id, starts_at, ends_at, days, reason } = args;
+                const updates = {};
+                if (starts_at !== undefined)
+                    updates.starts_at = starts_at;
+                if (ends_at !== undefined)
+                    updates.ends_at = ends_at;
+                if (days !== undefined)
+                    updates.days = days;
+                if (reason !== undefined)
+                    updates.reason = reason;
+                const result = await client.updateFreeze(id, updates);
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+                };
+            }
+            case 'fcp_unfreeze': {
+                const { id, repo } = args;
+                const result = await client.unfreeze({ id, repo });
+                return {
+                    content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+                };
+            }
+            // ============================================================================
+            // Certificate Handlers
+            // ============================================================================
+            case 'fcp_list_certificates': {
+                const result = await client.listCertificates(args);
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            case 'fcp_get_certificate': {
+                const { certId } = args;
+                const result = await client.getCertificate(certId);
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            case 'fcp_scan_certificates': {
+                const { dryRun } = args;
+                const result = await client.scanCertificates({ dryRun });
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            // ============================================================================
+            // Tasker Job Control Handlers
+            // ============================================================================
+            case 'fcp_spawn_task_job': {
+                const { task_id, task_title, project_key, task_description, labels } = args;
+                const result = await client.spawnTaskJob({ task_id, task_title, project_key, task_description, labels });
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            case 'fcp_get_job_status': {
+                const { job_id, task_id } = args;
+                const result = await client.getJobStatus({ job_id, task_id });
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            case 'fcp_list_jobs': {
+                const { refresh } = args;
+                const result = await client.listJobs({ refresh });
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            case 'fcp_approve_job': {
+                const { id } = args;
+                const result = await client.approveJob(id);
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            case 'fcp_override_merge_window': {
+                const { id, action, reason, ttl_minutes } = args;
+                if (action === 'set' && (!reason || !reason.trim())) {
+                    throw new Error('fcp_override_merge_window: reason is required when action=set');
+                }
+                const result = await client.overrideMergeWindow(id, { action, reason, ttl_minutes });
+                return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
+            }
+            // ============================================================================
             // Backup Management Handlers
             // ============================================================================
             case 'fcp_backup_list_sites': {
@@ -5581,7 +5930,7 @@ if (process.argv[2] === 'sync-skills') {
         process.exit(1);
     });
 }
-else {
+else if (!process.env.VITEST) {
     main().catch((error) => {
         console.error('Fatal error:', error);
         process.exit(1);

package/dist/skills-sync.d.ts

@@ -22,6 +22,7 @@
  *   - `private: true` in frontmatter also opts out.
  *   - Network failures and missing auth never block startup — we log + continue.
  */
+import { basename } from 'path';
 export interface SkillFrontmatter {
     name?: string;
     description?: string;
@@ -151,5 +152,5 @@ export declare const __test__: {
     detectSecret: typeof detectSecret;
     pushSkipReason: typeof pushSkipReason;
     hashBody: typeof hashBody;
-    basename: (path: string, suffix?: string) => string;
+    basename: typeof basename;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fruition/fcp-mcp-server",
-  "version": "1.27.1",
+  "version": "1.29.0",
   "description": "MCP Server for FCP Launch Coordination System - enables Claude Code to interact with FCP launches and track development time",
   "main": "dist/index.js",
   "type": "module",