@kaddo/mcp 3.82.0 → 3.84.0

package/dist/index.js

@@ -11657,7 +11657,7 @@ function systemImpactCandidatesTool(root, args) {
 
 // ../cli/src/services/integrations.ts
 import matter13 from "gray-matter";
-import { parse as parseYaml12 } from "yaml";
+import { parse as parseYaml12, stringify as stringifyYaml6 } from "yaml";
 
 // ../cli/src/core/work-item-write.ts
 import fs5 from "fs";
@@ -11751,6 +11751,71 @@ function parseCredentials(raw, id, findings) {
   }
   return creds;
 }
+function parseSecrets(raw, id, findings) {
+  const secrets = {};
+  if (raw == null) return secrets;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    findings.push({ level: "blocking", id, message: `Integration "${id}": secrets must be a mapping of logical references.` });
+    return secrets;
+  }
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value === "string" && value.trim()) {
+      if (value.length > 100 || /^(ghp_|sk-|xox[bpsa]-|glpat-|ey[A-Za-z0-9])/i.test(value)) {
+        findings.push({ level: "blocking", id, message: `Integration "${id}": secret "${key}" appears to contain an actual credential, not a reference name.` });
+        continue;
+      }
+      secrets[key] = value.trim();
+    } else {
+      findings.push({ level: "warning", id, message: `Integration "${id}": ignoring non-string secret entry "${key}".` });
+    }
+  }
+  return secrets;
+}
+function toStringArray3(raw) {
+  if (raw == null) return void 0;
+  if (Array.isArray(raw)) return raw.filter((v) => typeof v === "string" && v.trim() !== "").map((v) => v.trim());
+  if (typeof raw === "string" && raw.trim()) return [raw.trim()];
+  return void 0;
+}
+function parseFilters(raw) {
+  if (raw == null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const o2 = raw;
+  const filters = {};
+  let hasAny = false;
+  const types = toStringArray3(o2.types);
+  if (types?.length) {
+    filters.types = types;
+    hasAny = true;
+  }
+  const statuses = toStringArray3(o2.statuses);
+  if (statuses?.length) {
+    filters.statuses = statuses;
+    hasAny = true;
+  }
+  const labels = toStringArray3(o2.labels);
+  if (labels?.length) {
+    filters.labels = labels;
+    hasAny = true;
+  }
+  const assignees = toStringArray3(o2.assignees);
+  if (assignees?.length) {
+    filters.assignees = assignees;
+    hasAny = true;
+  }
+  if (typeof o2.updatedAfter === "string" && o2.updatedAfter.trim()) {
+    filters.updatedAfter = o2.updatedAfter.trim();
+    hasAny = true;
+  }
+  if (typeof o2.search === "string" && o2.search.trim()) {
+    filters.search = o2.search.trim();
+    hasAny = true;
+  }
+  if (typeof o2.providerQuery === "string" && o2.providerQuery.trim()) {
+    filters.providerQuery = o2.providerQuery.trim();
+    hasAny = true;
+  }
+  return hasAny ? filters : void 0;
+}
 function parseIntegrationsConfig(raw, opts) {
   const findings = [];
   const integrations = [];
@@ -11783,12 +11848,14 @@ function parseIntegrationsConfig(raw, opts) {
     const enabled = o2.enabled === void 0 ? true : o2.enabled === true || o2.enabled === "true";
     const config = o2.config && typeof o2.config === "object" && !Array.isArray(o2.config) ? o2.config : {};
     const credentials = parseCredentials(o2.credentials, id, findings);
+    const secrets = parseSecrets(o2.secrets, id, findings);
+    const filters = parseFilters(o2.filters);
     const timeoutMs = typeof o2.timeout_ms === "number" ? o2.timeout_ms : typeof o2.timeoutMs === "number" ? o2.timeoutMs : void 0;
-    integrations.push({ id, adapter, enabled, config, credentials, timeoutMs });
+    integrations.push({ id, adapter, enabled, config, credentials, secrets, filters, timeoutMs });
   }
   return { integrations, findings };
 }
-function resolveCredentials(integration, env) {
+async function resolveAllCredentials(integration, resolver, env) {
   const credentials = {};
   const missing = [];
   for (const [name, ref] of Object.entries(integration.credentials)) {
@@ -11796,8 +11863,104 @@ function resolveCredentials(integration, env) {
     if (value && value.length > 0) credentials[name] = value;
     else missing.push(ref.env);
   }
+  for (const [name, ref] of Object.entries(integration.secrets)) {
+    if (credentials[name]) continue;
+    const value = await resolver.resolve(ref);
+    if (value !== void 0) credentials[name] = value;
+    else missing.push(ref);
+  }
   return { credentials, missing };
 }
+function mergeFilters(base, overlay) {
+  if (!base && !overlay) return {};
+  if (!base) return { ...overlay };
+  if (!overlay) return { ...base };
+  return {
+    types: overlay.types?.length ? overlay.types : base.types,
+    statuses: overlay.statuses?.length ? overlay.statuses : base.statuses,
+    labels: overlay.labels?.length ? overlay.labels : base.labels,
+    assignees: overlay.assignees?.length ? overlay.assignees : base.assignees,
+    updatedAfter: overlay.updatedAfter ?? base.updatedAfter,
+    search: overlay.search ?? base.search,
+    providerQuery: overlay.providerQuery ?? base.providerQuery
+  };
+}
+
+// ../integrations/src/secrets.ts
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, existsSync as existsSync2, unlinkSync } from "fs";
+import { dirname as dirname2 } from "path";
+var SECRETS_FILENAME = ".secrets.json";
+function secretsPath(projectDir) {
+  return `${projectDir}/.kaddo/${SECRETS_FILENAME}`;
+}
+function loadStore(filePath) {
+  if (!existsSync2(filePath)) return {};
+  try {
+    const raw = readFileSync2(filePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+    return {};
+  } catch {
+    return {};
+  }
+}
+function saveStore(filePath, store) {
+  mkdirSync(dirname2(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(store, null, 2) + "\n", "utf-8");
+}
+function createLocalSecretProvider(projectDir) {
+  const fp = secretsPath(projectDir);
+  return {
+    async get(key) {
+      const store = loadStore(fp);
+      const val = store[key];
+      return val !== void 0 && val !== "" ? val : void 0;
+    },
+    async set(key, value) {
+      const store = loadStore(fp);
+      store[key] = value;
+      saveStore(fp, store);
+    },
+    async delete(key) {
+      const store = loadStore(fp);
+      delete store[key];
+      saveStore(fp, store);
+    },
+    async exists(key) {
+      const store = loadStore(fp);
+      return key in store && store[key] !== void 0 && store[key] !== "";
+    }
+  };
+}
+function createEnvSecretProvider(env = process.env) {
+  return {
+    async get(key) {
+      const val = env[key];
+      return val !== void 0 && val !== "" ? val : void 0;
+    },
+    async set() {
+      throw new Error("Environment secret provider is read-only.");
+    },
+    async delete() {
+      throw new Error("Environment secret provider is read-only.");
+    },
+    async exists(key) {
+      const val = env[key];
+      return val !== void 0 && val !== "";
+    }
+  };
+}
+function createCompositeResolver(...providers) {
+  return {
+    async resolve(reference) {
+      for (const provider of providers) {
+        const val = await provider.get(reference);
+        if (val !== void 0) return val;
+      }
+      return void 0;
+    }
+  };
+}
 
 // ../integrations/src/registry.ts
 var DuplicateAdapterError = class extends Error {
@@ -11838,6 +12001,7 @@ var DEFAULT_ITEMS = [
     status: "Open",
     url: "https://example.test/mock/EXT-001",
     labels: ["registration", "beta"],
+    assignees: [{ name: "Alice" }],
     createdAt: "2026-01-05T10:00:00.000Z",
     updatedAt: "2026-02-01T09:30:00.000Z",
     rawMetadata: { board: "delivery" }
@@ -11851,8 +12015,86 @@ var DEFAULT_ITEMS = [
     status: "To Do",
     url: "https://example.test/mock/EXT-002",
     labels: ["onboarding"],
+    assignees: [{ name: "Bob" }],
     createdAt: "2026-01-08T12:00:00.000Z",
     updatedAt: "2026-01-20T15:00:00.000Z"
+  },
+  {
+    externalId: "EXT-003",
+    provider: MOCK_ADAPTER_ID,
+    title: "Fix authentication error on mobile",
+    description: "Users on iOS 17 see a blank screen after OAuth redirect.",
+    type: "Bug",
+    status: "In Progress",
+    url: "https://example.test/mock/EXT-003",
+    labels: ["auth", "mobile", "critical"],
+    assignees: [{ name: "Alice" }],
+    createdAt: "2026-02-10T08:00:00.000Z",
+    updatedAt: "2026-03-01T14:00:00.000Z"
+  },
+  {
+    externalId: "EXT-004",
+    provider: MOCK_ADAPTER_ID,
+    title: "Design system token audit",
+    description: "Review and consolidate design tokens across the component library.",
+    type: "Task",
+    status: "To Do",
+    url: "https://example.test/mock/EXT-004",
+    labels: ["frontend", "design-system"],
+    createdAt: "2026-02-15T10:00:00.000Z",
+    updatedAt: "2026-02-20T11:00:00.000Z"
+  },
+  {
+    externalId: "EXT-005",
+    provider: MOCK_ADAPTER_ID,
+    title: "Migrate billing service to new payment gateway",
+    description: "Stripe v2 migration \u2014 switch from legacy Charges API to Payment Intents.",
+    type: "Epic",
+    status: "Open",
+    url: "https://example.test/mock/EXT-005",
+    labels: ["billing", "backend", "migration"],
+    assignees: [{ name: "Carol" }],
+    createdAt: "2026-01-20T09:00:00.000Z",
+    updatedAt: "2026-03-05T16:00:00.000Z"
+  },
+  {
+    externalId: "EXT-006",
+    provider: MOCK_ADAPTER_ID,
+    title: "Add CSV export to reports",
+    description: "Users need to export analytics reports as CSV for external tools.",
+    type: "Feature",
+    status: "In Progress",
+    url: "https://example.test/mock/EXT-006",
+    labels: ["reports", "backend"],
+    assignees: [{ name: "Bob" }],
+    createdAt: "2026-02-25T13:00:00.000Z",
+    updatedAt: "2026-03-10T10:00:00.000Z"
+  },
+  {
+    externalId: "EXT-007",
+    provider: MOCK_ADAPTER_ID,
+    title: "Improve search relevance scoring",
+    description: "Tweak TF-IDF weights and add trigram matching for better search results.",
+    type: "Task",
+    status: "Done",
+    url: "https://example.test/mock/EXT-007",
+    labels: ["search", "backend"],
+    assignees: [{ name: "Alice" }],
+    createdAt: "2026-01-12T07:00:00.000Z",
+    updatedAt: "2026-02-28T17:00:00.000Z"
+  },
+  {
+    externalId: "EXT-008",
+    provider: MOCK_ADAPTER_ID,
+    title: "Set up E2E test pipeline",
+    description: "Configure Playwright tests running on every PR via GitHub Actions.",
+    type: "Task",
+    status: "Done",
+    url: "https://example.test/mock/EXT-008",
+    labels: ["testing", "ci"],
+    assignees: [{ name: "Carol" }],
+    createdAt: "2026-01-30T11:00:00.000Z",
+    updatedAt: "2026-02-15T09:00:00.000Z"
   }
 ];
 function simulationOf(context, fallback) {
@@ -11883,7 +12125,41 @@ function createMockAdapter(opts = {}) {
       id: MOCK_ADAPTER_ID,
       displayName: "Mock Work Source",
       version: "1.0.0",
-      description: "Deterministic offline reference adapter for validating the integration foundation."
+      description: "Deterministic offline reference adapter for validating the integration foundation.",
+      icon: "mock",
+      filterCapabilities: {
+        types: { supported: true, multiple: true },
+        statuses: { supported: true, multiple: true },
+        labels: { supported: true, multiple: true },
+        assignees: { supported: true, multiple: true },
+        updatedAfter: { supported: true },
+        search: { supported: true },
+        providerQuery: { supported: false }
+      },
+      configSchema: {
+        simulate: {
+          type: "select",
+          required: false,
+          label: "Simulation mode",
+          description: "Controls what the mock adapter simulates during verify/read operations.",
+          options: [
+            { value: "available", label: "Available" },
+            { value: "unauthorized", label: "Unauthorized" },
+            { value: "rate-limited", label: "Rate Limited" },
+            { value: "unavailable", label: "Unavailable" },
+            { value: "timeout", label: "Timeout" }
+          ],
+          defaultValue: "available"
+        }
+      },
+      secretSchema: {
+        token: {
+          type: "string",
+          required: false,
+          label: "API Token",
+          description: "Optional token for testing secret handling (not used by the mock adapter)."
+        }
+      }
     },
     capabilities: {
       workItems: { list: true, read: true, import: true, write: false, statusSync: false, comments: false, webhooks: false }
@@ -11906,9 +12182,24 @@ function createMockAdapter(opts = {}) {
       readFailure(simulationOf(request.context, defaultSim));
       let pool = items;
       const f3 = request.filters;
-      if (f3?.status) pool = pool.filter((i) => (i.status ?? "").toLowerCase() === f3.status.toLowerCase());
-      if (f3?.query) pool = pool.filter((i) => `${i.title} ${i.description ?? ""}`.toLowerCase().includes(f3.query.toLowerCase()));
-      if (f3?.updatedSince) pool = pool.filter((i) => (i.updatedAt ?? "") >= f3.updatedSince);
+      if (f3?.statuses?.length) {
+        const lower = f3.statuses.map((s) => s.toLowerCase());
+        pool = pool.filter((i) => lower.includes((i.status ?? "").toLowerCase()));
+      }
+      if (f3?.types?.length) {
+        const lower = f3.types.map((t) => t.toLowerCase());
+        pool = pool.filter((i) => lower.includes((i.type ?? "").toLowerCase()));
+      }
+      if (f3?.labels?.length) {
+        const lower = f3.labels.map((l2) => l2.toLowerCase());
+        pool = pool.filter((i) => i.labels?.some((il) => lower.includes(il.toLowerCase())));
+      }
+      if (f3?.assignees?.length) {
+        const lower = f3.assignees.map((a2) => a2.toLowerCase());
+        pool = pool.filter((i) => i.assignees?.some((a2) => lower.includes((a2.name ?? "").toLowerCase())));
+      }
+      if (f3?.search) pool = pool.filter((i) => `${i.title} ${i.description ?? ""}`.toLowerCase().includes(f3.search.toLowerCase()));
+      if (f3?.updatedAfter) pool = pool.filter((i) => (i.updatedAt ?? "") >= f3.updatedAfter);
       const size = Math.max(1, request.pageSize ?? defaultPageSize);
       const start = request.cursor ? Math.max(0, Number.parseInt(request.cursor, 10) || 0) : 0;
       const slice = pool.slice(start, start + size);
@@ -11960,6 +12251,9 @@ function configStatus(integration, findings) {
   if (blocking || !registry.has(integration.adapter)) return "invalid-config";
   return "configured";
 }
+function secretResolver(dir, env) {
+  return createCompositeResolver(createLocalSecretProvider(dir), createEnvSecretProvider(env));
+}
 function listIntegrations(dir) {
   const { integrations, findings } = loadIntegrations(dir);
   return integrations.map((integration) => {
@@ -11973,6 +12267,9 @@ function listIntegrations(dir) {
       capabilities: adapter?.capabilities ?? null,
       metadata: adapter?.metadata ?? null,
       credentialRefs: Object.values(integration.credentials).map((c) => c.env),
+      secretRefs: Object.values(integration.secrets),
+      secretStatus: {},
+      filters: integration.filters,
       findings: findings.filter((f3) => f3.id === integration.id)
     };
   });
@@ -11981,15 +12278,16 @@ function requireIntegration(dir, id) {
   const { integrations, findings } = loadIntegrations(dir);
   const integration = integrations.find((i) => i.id === id);
   if (!integration) throw new IntegrationServiceError("INTEGRATION_NOT_CONFIGURED", `No integration "${id}" is configured in this project.`);
-  return { integration, findings };
+  return { integration, findings, all: integrations };
 }
 function resolveAdapter(integration) {
   const adapter = registry.get(integration.adapter);
   if (!adapter) throw new IntegrationServiceError("ADAPTER_NOT_FOUND", `Unknown integration adapter "${integration.adapter}".`);
   return adapter;
 }
-function buildContext(integration, env) {
-  const { credentials, missing } = resolveCredentials(integration, env);
+async function buildContextWithSecrets(dir, integration, env) {
+  const resolver = secretResolver(dir, env);
+  const { credentials, missing } = await resolveAllCredentials(integration, resolver, env);
   return {
     context: { integrationId: integration.id, config: integration.config, credentials, timeoutMs: integration.timeoutMs ?? DEFAULT_TIMEOUT_MS },
     missing
@@ -12012,7 +12310,7 @@ async function verifyIntegration(dir, id, env = process.env) {
   if (cfgStatus === "disabled") return { id, status: "disabled", connection: null, missingCredentials: [] };
   if (cfgStatus === "invalid-config") return { id, status: "invalid-config", connection: null, missingCredentials: [] };
   const adapter = resolveAdapter(integration);
-  const { context, missing } = buildContext(integration, env);
+  const { context, missing } = await buildContextWithSecrets(dir, integration, env);
   try {
     const connection = await withTimeout(adapter.verifyConnection(context), context.timeoutMs);
     return { id, status: statusOf(connection), connection, missingCredentials: missing, message: connection.message };
@@ -12037,14 +12335,15 @@ async function listExternalWorkItems(dir, id, opts = {}, env = process.env) {
   const { integration } = requireIntegration(dir, id);
   const adapter = resolveAdapter(integration);
   if (!adapter.capabilities.workItems.list) throw integrationError("UNSUPPORTED_CAPABILITY", `Adapter "${adapter.id}" cannot list work items.`);
-  const { context } = buildContext(integration, env);
-  return withTimeout(adapter.listWorkItems({ context, cursor: opts.cursor, pageSize: opts.pageSize, filters: opts.filters }), context.timeoutMs);
+  const { context } = await buildContextWithSecrets(dir, integration, env);
+  const filters = mergeFilters(integration.filters, opts.filters);
+  return withTimeout(adapter.listWorkItems({ context, cursor: opts.cursor, pageSize: opts.pageSize, filters }), context.timeoutMs);
 }
 async function getExternalWorkItem(dir, id, externalId, env = process.env) {
   const { integration } = requireIntegration(dir, id);
   const adapter = resolveAdapter(integration);
   if (!adapter.capabilities.workItems.read) throw integrationError("UNSUPPORTED_CAPABILITY", `Adapter "${adapter.id}" cannot read work items.`);
-  const { context } = buildContext(integration, env);
+  const { context } = await buildContextWithSecrets(dir, integration, env);
   return withTimeout(adapter.getWorkItem({ context, externalId }), context.timeoutMs);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaddo/mcp",
-  "version": "3.82.0",
+  "version": "3.84.0",
   "description": "MCP server for Kaddo project knowledge: read-only resources/tools/prompts plus safe derived generation under .kaddo/.",
   "license": "MIT",
   "repository": {