@mgsoftwarebv/mg-dashboard-mcp 2.3.3 → 2.3.4

package/dist/index.js

@@ -375,404 +375,6 @@ ${rawJson.substring(0, 500)}`
   }
 }
 
-// src/script-tools.ts
-var SCRIPTS = [
-  {
-    name: "commit-feedback",
-    filename: "commit-feedback.ps1",
-    description: "PowerShell script that provides colored terminal feedback for the Ctrl+Shift+K commit & push keybinding. Polls for a new commit and shows branch, message, and file stats when done.",
-    content: `param()
-
-$initial = git log --oneline -1 2>$null
-
-Write-Host "\`n==========================================" -ForegroundColor Cyan
-Write-Host "  Starting Commit & Push..." -ForegroundColor Cyan
-Write-Host "==========================================" -ForegroundColor Cyan
-Write-Host "  [1/5] Pulling latest..." -ForegroundColor DarkGray
-Write-Host "  [2/5] Staging changes..." -ForegroundColor DarkGray
-Write-Host "  [3/5] Generating AI commit message..." -ForegroundColor DarkGray
-Write-Host "  [4/5] Committing..." -ForegroundColor DarkGray
-Write-Host "  [5/5] Pushing to remote..." -ForegroundColor DarkGray
-Write-Host ""
-Write-Host "  Waiting for commit" -ForegroundColor DarkGray -NoNewline
-
-$timeout = 60
-$elapsed = 0
-while ($elapsed -lt $timeout) {
-    $current = git log --oneline -1 2>$null
-    if ($current -ne $initial) { break }
-    Start-Sleep -Seconds 1
-    $elapsed++
-    Write-Host "." -ForegroundColor DarkGray -NoNewline
-}
-Write-Host ""
-
-if ($current -eq $initial) {
-    Write-Host ""
-    Write-Host "  [!] No new commit detected (timed out after \${timeout}s)" -ForegroundColor Yellow
-    Write-Host ""
-    exit
-}
-
-Start-Sleep -Seconds 2
-
-$branch = git rev-parse --abbrev-ref HEAD 2>$null
-$commit = git log --format='%h %s' -1 2>$null
-
-Write-Host ""
-Write-Host "==========================================" -ForegroundColor Cyan
-Write-Host "  [OK] Commit & Push Complete" -ForegroundColor Green
-Write-Host "==========================================" -ForegroundColor Cyan
-Write-Host "  Branch: $branch" -ForegroundColor Yellow
-Write-Host "  Commit: $commit" -ForegroundColor White
-Write-Host ""
-git --no-pager diff HEAD~1 --stat --color=always 2>$null
-Write-Host ""
-Write-Host "==========================================" -ForegroundColor Cyan
-Write-Host ""
-`
-  },
-  {
-    name: "create-pr",
-    filename: "create-pr.cmd",
-    description: "Windows batch script that auto-detects the target branch based on your release pipeline (v*-changes branches), merges the target into your branch, pushes, and creates a PR via gh CLI. Bound to Ctrl+Shift+J.",
-    content: `@echo off
-setlocal enabledelayedexpansion
-title MG Dashboard - Create PR
-
-REM --- ANSI color setup ---
-for /F %%a in ('echo prompt $E ^| cmd') do set "ESC=%%a"
-set "GREEN=%ESC%[32m"
-set "RED=%ESC%[31m"
-set "YELLOW=%ESC%[33m"
-set "CYAN=%ESC%[36m"
-set "DIM=%ESC%[90m"
-set "BOLD=%ESC%[1m"
-set "RESET=%ESC%[0m"
-
-echo.
-echo %CYAN%%BOLD%==========================================%RESET%
-echo %CYAN%%BOLD%   MG Dashboard - Create Pull Request%RESET%
-echo %CYAN%%BOLD%==========================================%RESET%
-echo.
-
-REM --- Merge origin/main first ---
-echo %CYAN%[0/4]%RESET% Merging origin/main into current branch...
-git fetch --prune >nul 2>&1
-git merge origin/main --no-edit >nul 2>&1
-if errorlevel 1 (
-    git merge --abort >nul 2>&1
-    echo %RED%X  Merge conflict with origin/main. Resolve manually.%RESET%
-    echo.
-    exit /b 1
-)
-echo %GREEN%   OK%RESET%
-echo.
-
-REM --- Prerequisite: gh CLI ---
-where gh >nul 2>&1
-if errorlevel 1 (
-    echo %RED%X  GitHub CLI ^(gh^) is not installed.%RESET%
-    echo %DIM%   Install it from: https://cli.github.com/%RESET%
-    echo.
-    exit /b 1
-)
-
-REM --- Prerequisite: git repo ---
-git rev-parse --is-inside-work-tree >nul 2>&1
-if errorlevel 1 (
-    echo %RED%X  Not inside a git repository.%RESET%
-    echo.
-    exit /b 1
-)
-
-REM --- Detect repo from git remote ---
-set "REPO="
-for /f "tokens=*" %%u in ('git remote get-url origin 2^>nul') do set "REMOTE_URL=%%u"
-if defined REMOTE_URL (
-    echo !REMOTE_URL! | findstr /r "git@github.com:" >nul 2>&1
-    if not errorlevel 1 (
-        set "REPO=!REMOTE_URL:git@github.com:=!"
-        set "REPO=!REPO:.git=!"
-    )
-    echo !REMOTE_URL! | findstr /r "https://github.com/" >nul 2>&1
-    if not errorlevel 1 (
-        set "REPO=!REMOTE_URL:https://github.com/=!"
-        set "REPO=!REPO:.git=!"
-    )
-)
-if not defined REPO (
-    echo %RED%X  Could not detect GitHub repo from git remote.%RESET%
-    echo %DIM%   Make sure origin points to a GitHub repository.%RESET%
-    echo.
-    exit /b 1
-)
-
-REM --- Get current branch ---
-for /f "tokens=*" %%b in ('git rev-parse --abbrev-ref HEAD') do set "CURRENT_BRANCH=%%b"
-
-echo %DIM%   Repository: !REPO!%RESET%
-echo %DIM%   Branch:     %CURRENT_BRANCH%%RESET%
-echo.
-
-REM --- Guard: don't PR from main or a bare version branch ---
-if "%CURRENT_BRANCH%"=="main" (
-    echo %RED%X  You are on main. Switch to a feature or changes branch first.%RESET%
-    echo.
-    exit /b 1
-)
-echo %CURRENT_BRANCH% | findstr /r "^v[0-9]*\\.[0-9]*\\.[0-9]*$" >nul 2>&1
-if not errorlevel 1 (
-    echo %RED%X  You are on a version branch ^(%CURRENT_BRANCH%^). Switch to a feature or changes branch first.%RESET%
-    echo.
-    exit /b 1
-)
-
-REM --- Fetch latest remote refs ---
-echo %CYAN%[1/4]%RESET% Fetching remote branches...
-git fetch --prune >nul 2>&1
-
-REM --- Determine target branch ---
-set "TARGET="
-
-REM Check if current branch is a -changes branch (last 8 chars)
-if "!CURRENT_BRANCH:~-8!"=="-changes" (
-    set "TARGET=!CURRENT_BRANCH:~0,-8!"
-    echo %GREEN%   Detected -changes branch. Target: %BOLD%!TARGET!%RESET%
-    goto :do_merge
-)
-
-REM Look for v*-changes branches on remote (highest version first)
-set "TARGET="
-for /f "tokens=*" %%r in ('git branch -r --sort=-version:refname --list "origin/v*-changes" 2^>nul') do (
-    if not defined TARGET (
-        set "RAW=%%r"
-        set "BRANCH=!RAW:  origin/=!"
-        set "BRANCH=!BRANCH:origin/=!"
-        set "TARGET=!BRANCH!"
-    )
-)
-
-if defined TARGET (
-    echo %GREEN%   Release pipeline detected. Target: %BOLD%!TARGET!%RESET%
-) else (
-    REM No -changes branch; try highest version branch
-    set "TARGET="
-    for /f "tokens=*" %%r in ('git branch -r --sort=-version:refname --list "origin/v*" 2^>nul') do (
-        if not defined TARGET (
-            set "RAW=%%r"
-            set "BRANCH=!RAW:  origin/=!"
-            set "BRANCH=!BRANCH:origin/=!"
-            set "TAIL=!BRANCH:~-8!"
-            if not "!TAIL!"=="-changes" set "TARGET=!BRANCH!"
-        )
-    )
-    if defined TARGET (
-        echo %GREEN%   Version branch detected. Target: %BOLD%!TARGET!%RESET%
-    ) else (
-        set "TARGET=main"
-        echo %YELLOW%   No release pipeline or version branch found. Target: %BOLD%main%RESET%
-    )
-)
-
-:do_merge
-echo.
-
-REM --- Merge target into current branch ---
-echo %CYAN%[2/4]%RESET% Merging %BOLD%!TARGET!%RESET% into %BOLD%%CURRENT_BRANCH%%RESET%...
-git merge origin/!TARGET! --no-edit
-if errorlevel 1 (
-    echo.
-    echo %RED%X  Merge conflict detected.%RESET%
-    git merge --abort >nul 2>&1
-    echo %DIM%   Resolve conflicts manually, then retry.%RESET%
-    echo.
-    exit /b 1
-)
-echo %GREEN%   OK%RESET%
-echo.
-
-REM --- Push current branch to origin ---
-echo %CYAN%[3/4]%RESET% Pushing %CURRENT_BRANCH% to origin...
-git push -u origin HEAD
-if errorlevel 1 (
-    echo.
-    echo %RED%X  Failed to push branch to origin.%RESET%
-    echo.
-    exit /b 1
-)
-echo %GREEN%   OK%RESET%
-echo.
-
-REM --- Guard: don't PR into the same branch ---
-if "!TARGET!"=="!CURRENT_BRANCH!" (
-    echo %RED%X  Target branch is the same as current branch ^(!TARGET!^). Cannot create PR.%RESET%
-    echo.
-    exit /b 1
-)
-
-echo %CYAN%[4/4]%RESET% Creating PR: %BOLD%%CURRENT_BRANCH%%RESET% %DIM%->%RESET% %BOLD%%TARGET%%RESET%
-echo.
-
-REM --- Create the PR ---
-gh pr create --repo "!REPO!" --base "%TARGET%" --fill
-if errorlevel 1 (
-    echo.
-    echo %RED%X  Failed to create pull request.%RESET%
-    echo %DIM%   Check the error above. A PR may already exist for this branch.%RESET%
-    echo.
-    exit /b 1
-)
-
-echo.
-echo %GREEN%%BOLD%   PR created successfully!%RESET%
-echo.
-`
-  },
-  {
-    name: "commit-and-pr",
-    filename: "commit-and-pr.ps1",
-    description: "PowerShell script that combines commit & push with PR creation. Checks for pending changes first: if changes exist, waits for the commit (triggered by Cursor keybinding), shows a summary, then runs create-pr.cmd. If no changes, skips straight to PR. Requires create-pr.cmd in the same directory. Bound to Ctrl+Shift+M.",
-    content: `param()
-
-$hasChanges = (git status --porcelain 2>$null)
-
-if ($hasChanges) {
-    $initial = git log --oneline -1 2>$null
-
-    Write-Host "\`n==========================================" -ForegroundColor Cyan
-    Write-Host "  Starting Commit, Push & PR..." -ForegroundColor Cyan
-    Write-Host "==========================================" -ForegroundColor Cyan
-    Write-Host "  [1/5] Pulling latest..." -ForegroundColor DarkGray
-    Write-Host "  [2/5] Staging changes..." -ForegroundColor DarkGray
-    Write-Host "  [3/5] Generating AI commit message..." -ForegroundColor DarkGray
-    Write-Host "  [4/5] Committing..." -ForegroundColor DarkGray
-    Write-Host "  [5/5] Pushing to remote..." -ForegroundColor DarkGray
-    Write-Host ""
-    Write-Host "  Waiting for commit" -ForegroundColor DarkGray -NoNewline
-
-    $timeout = 60
-    $elapsed = 0
-    while ($elapsed -lt $timeout) {
-        $current = git log --oneline -1 2>$null
-        if ($current -ne $initial) { break }
-        Start-Sleep -Seconds 1
-        $elapsed++
-        Write-Host "." -ForegroundColor DarkGray -NoNewline
-    }
-    Write-Host ""
-
-    if ($current -eq $initial) {
-        Write-Host ""
-        Write-Host "  [!] No new commit detected (timed out after \${timeout}s)" -ForegroundColor Yellow
-        Write-Host "  Skipping PR creation." -ForegroundColor Yellow
-        Write-Host ""
-        exit
-    }
-
-    Start-Sleep -Seconds 2
-
-    $branch = git rev-parse --abbrev-ref HEAD 2>$null
-    $commit = git log --format='%h %s' -1 2>$null
-
-    Write-Host ""
-    Write-Host "==========================================" -ForegroundColor Cyan
-    Write-Host "  [OK] Commit & Push Complete" -ForegroundColor Green
-    Write-Host "==========================================" -ForegroundColor Cyan
-    Write-Host "  Branch: $branch" -ForegroundColor Yellow
-    Write-Host "  Commit: $commit" -ForegroundColor White
-    Write-Host ""
-    git --no-pager diff HEAD~1 --stat --color=always 2>$null
-    Write-Host ""
-    Write-Host "==========================================" -ForegroundColor Cyan
-    Write-Host ""
-} else {
-    Write-Host "\`n==========================================" -ForegroundColor Cyan
-    Write-Host "  No changes to commit" -ForegroundColor DarkGray
-    Write-Host "  Proceeding to PR creation..." -ForegroundColor Cyan
-    Write-Host "==========================================" -ForegroundColor Cyan
-    Write-Host ""
-}
-
-& .\\create-pr.cmd
-`
-  }
-];
-var SCRIPT_TOOLS = [
-  {
-    name: "scripts-list",
-    description: "List available MG Dashboard workflow scripts that can be downloaded into your project. Returns script names, filenames, and descriptions.",
-    inputSchema: { type: "object", properties: {}, required: [] }
-  },
-  {
-    name: "script-get",
-    description: "Get the content of an MG Dashboard workflow script by name. Save the returned content to the filename indicated in the response. Place scripts in the repository root.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        name: {
-          type: "string",
-          description: `Script name. Available: ${SCRIPTS.map((s) => s.name).join(", ")}`
-        }
-      },
-      required: ["name"]
-    }
-  }
-];
-var SCRIPT_TOOL_NAMES = new Set(SCRIPT_TOOLS.map((t) => t.name));
-function handleScriptTool(toolName, args2) {
-  switch (toolName) {
-    case "scripts-list": {
-      const list = SCRIPTS.map((s) => ({
-        name: s.name,
-        filename: s.filename,
-        description: s.description
-      }));
-      return {
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify(list, null, 2)
-          }
-        ]
-      };
-    }
-    case "script-get": {
-      const scriptName = String(args2.name);
-      const script = SCRIPTS.find((s) => s.name === scriptName);
-      if (!script) {
-        const available = SCRIPTS.map((s) => s.name).join(", ");
-        return {
-          content: [
-            {
-              type: "text",
-              text: `Unknown script: "${scriptName}". Available scripts: ${available}`
-            }
-          ]
-        };
-      }
-      return {
-        content: [
-          {
-            type: "text",
-            text: [
-              `Filename: ${script.filename}`,
-              `Description: ${script.description}`,
-              `Place this file in the repository root.`,
-              "",
-              "--- CONTENT START ---",
-              script.content,
-              "--- CONTENT END ---"
-            ].join("\n")
-          }
-        ]
-      };
-    }
-    default:
-      return { content: [{ type: "text", text: `Unknown script tool: ${toolName}` }] };
-  }
-}
-
 // src/agent-tools.ts
 var VALID_FINDING_TYPES = /* @__PURE__ */ new Set([
   "missing_docs",
@@ -794,13 +396,15 @@ var VALID_SCOPES = /* @__PURE__ */ new Set([
   "module",
   "component",
   "api",
-  "package"
+  "package",
+  "security",
+  "server_audit"
 ]);
 var VALID_REVIEW_STATUSES = /* @__PURE__ */ new Set([
   "pending",
-  "approved",
-  "rejected",
-  "outdated"
+  "agent_approved",
+  "agent_flagged",
+  "human_approved"
 ]);
 var AGENT_TOOLS = [
   {
@@ -908,10 +512,10 @@ var AGENT_TOOLS = [
         },
         path: {
           type: "string",
-          description: 'Path within the repo (e.g. "packages/ui", "__perf_audit__")'
+          description: 'Path within the repo (e.g. "packages/ui")'
         },
         title: { type: "string", description: "Document title" },
-        content: { type: "string", description: "Documentation content (markdown)" },
+        content: { type: "string", description: "Documentation content (Typst markup)" },
         review_status: {
           type: "string",
           enum: [...VALID_REVIEW_STATUSES],
@@ -940,7 +544,7 @@ var AGENT_TOOLS = [
         },
         status: {
           type: "string",
-          enum: ["open", "accepted", "rejected", "fixed"],
+          enum: ["open", "ticket_created", "resolved", "dismissed"],
           description: "Filter by status (default: all)"
         },
         limit: {
@@ -971,6 +575,56 @@ var AGENT_TOOLS = [
       },
       required: ["repo_slug"]
     }
+  },
+  {
+    name: "agent-validate-suggestions",
+    description: "Validate existing open suggestions against the actual codebase. For each suggestion, report whether it is valid, invalid (should be dismissed), or needs adjustment. Invalid suggestions are auto-dismissed with a reason.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo_slug: {
+          type: "string",
+          description: "Repository slug being validated"
+        },
+        results: {
+          type: "array",
+          description: "Validation results per suggestion",
+          items: {
+            type: "object",
+            properties: {
+              suggestion_id: {
+                type: "string",
+                description: "UUID of the doc_suggestion being validated"
+              },
+              verdict: {
+                type: "string",
+                enum: ["valid", "invalid", "adjusted"],
+                description: "Validation verdict: valid (keep as-is), invalid (dismiss), adjusted (update fields)"
+              },
+              reason: {
+                type: "string",
+                description: "Explanation of why this suggestion is valid/invalid/adjusted (max 2000 chars)"
+              },
+              adjusted_description: {
+                type: "string",
+                description: "Updated description (only for verdict=adjusted, max 2000 chars)"
+              },
+              adjusted_severity: {
+                type: "string",
+                enum: ["info", "warning", "critical"],
+                description: "Updated severity (only for verdict=adjusted)"
+              },
+              adjusted_suggested_fix: {
+                type: "string",
+                description: "Updated suggested fix (only for verdict=adjusted, max 5000 chars)"
+              }
+            },
+            required: ["suggestion_id", "verdict", "reason"]
+          }
+        }
+      },
+      required: ["repo_slug", "results"]
+    }
   }
 ];
 var AGENT_TOOL_NAMES = new Set(AGENT_TOOLS.map((t) => t.name));
@@ -979,7 +633,8 @@ var AGENT_TOOL_MODULE_MAP = {
   "agent-report-finding": "agent_reporting",
   "agent-save-documentation": "agent_reporting",
   "agent-list-findings": "agent_reporting",
-  "agent-get-documentation": "agent_reporting"
+  "agent-get-documentation": "agent_reporting",
+  "agent-validate-suggestions": "agent_reporting"
 };
 function clamp(val, min, max) {
   return Math.max(min, Math.min(max, val));
@@ -987,25 +642,24 @@ function clamp(val, min, max) {
 function sanitizeString(val, maxLen) {
   return String(val ?? "").slice(0, maxLen);
 }
-async function getOrCreateParentDoc(supabase2, repoSlug, refrontProjectId, category) {
-  const path = category === "perf_audit" ? "__perf_audit__" : "__scan_findings__";
-  const title = category === "perf_audit" ? `Performance Audit: ${repoSlug}` : `Scan Findings: ${repoSlug}`;
-  const { data: existing } = await supabase2.from("project_documentation").select("id").eq("repo_slug", repoSlug).eq("path", path).maybeSingle();
-  if (existing) return existing.id;
-  const { data: inserted, error } = await supabase2.from("project_documentation").insert({
-    refront_project_id: refrontProjectId,
-    repo_slug: repoSlug,
-    scope: "architecture",
-    path,
-    title,
-    content: `Auto-generated parent record for ${category.replace("_", " ")} suggestions.`,
-    generated_by: `${category}-agent-v1`,
-    review_status: "pending"
-  }).select("id").single();
-  if (error || !inserted) {
-    throw new Error(`Failed to create parent doc record: ${error?.message}`);
-  }
-  return inserted.id;
+function textSimilarity(a, b) {
+  if (a === b) return 1;
+  const norm = (s) => s.toLowerCase().replace(/\s+/g, " ").trim();
+  const na = norm(a);
+  const nb = norm(b);
+  if (na === nb) return 1;
+  if (na.length < 3 || nb.length < 3) return na === nb ? 1 : 0;
+  const trigrams = (s) => {
+    const set = /* @__PURE__ */ new Set();
+    for (let i = 0; i <= s.length - 3; i++) set.add(s.slice(i, i + 3));
+    return set;
+  };
+  const setA = trigrams(na);
+  const setB = trigrams(nb);
+  let intersection = 0;
+  for (const t of setA) if (setB.has(t)) intersection++;
+  const union = setA.size + setB.size - intersection;
+  return union === 0 ? 0 : intersection / union;
 }
 async function handleAgentTool(name, args2, deps) {
   const { supabase: supabase2 } = deps;
@@ -1061,30 +715,90 @@ async function handleAgentTool(name, args2, deps) {
         throw new Error('category must be "scan_findings" or "perf_audit"');
       }
       if (findings.length === 0) throw new Error("findings array must not be empty");
-      const parentDocId = await getOrCreateParentDoc(supabase2, repoSlug, refrontProjectId, category);
+      const SIMILARITY_THRESHOLD = 0.55;
+      const MAX_OPEN_PER_TYPE = 30;
+      const { data: existingFindings } = await supabase2.from("doc_suggestion").select("id, type, description, file_path, severity, category, status").eq("repo_slug", repoSlug).in("status", ["open", "dismissed"]).limit(500);
+      const existing = existingFindings ?? [];
+      const typeCountMap = /* @__PURE__ */ new Map();
+      for (const e of existing) {
+        if (e.status !== "open") continue;
+        const key = `${e.category}:${e.type}`;
+        typeCountMap.set(key, (typeCountMap.get(key) ?? 0) + 1);
+      }
       let inserted = 0;
+      let deduplicated = 0;
+      let grouped = 0;
       let errors = 0;
+      const overflowBucket = /* @__PURE__ */ new Map();
       for (const f of findings) {
         const findingType = VALID_FINDING_TYPES.has(f.type) ? f.type : "improvement";
         const severity = VALID_SEVERITIES.has(f.severity) ? f.severity : "info";
         const description = sanitizeString(f.description, 2e3);
+        const filePath = f.file_path ? sanitizeString(f.file_path, 500) : null;
         if (!description) continue;
+        const isDuplicate = existing.some((e) => {
+          if (e.type !== findingType) return false;
+          if (filePath && e.file_path === filePath) {
+            return textSimilarity(e.description ?? "", description) > 0.4;
+          }
+          return textSimilarity(e.description ?? "", description) > SIMILARITY_THRESHOLD;
+        });
+        if (isDuplicate) {
+          deduplicated++;
+          continue;
+        }
+        const typeKey = `${category}:${findingType}`;
+        const currentCount = typeCountMap.get(typeKey) ?? 0;
+        if (currentCount >= MAX_OPEN_PER_TYPE) {
+          const bucket = overflowBucket.get(typeKey) ?? [];
+          bucket.push(`${filePath ? `${filePath}: ` : ""}${description.slice(0, 120)}`);
+          overflowBucket.set(typeKey, bucket);
+          grouped++;
+          continue;
+        }
         const { error } = await supabase2.from("doc_suggestion").insert({
-          documentation_id: parentDocId,
+          repo_slug: repoSlug,
+          refront_project_id: refrontProjectId,
+          category,
           type: findingType,
           severity,
           description,
-          file_path: f.file_path ? sanitizeString(f.file_path, 500) : null,
+          file_path: filePath,
           suggested_fix: f.suggested_fix ? sanitizeString(f.suggested_fix, 5e3) : null,
           status: "open"
         });
-        if (error) errors++;
-        else inserted++;
+        if (error) {
+          errors++;
+        } else {
+          inserted++;
+          typeCountMap.set(typeKey, currentCount + 1);
+          existing.push({ id: "", type: findingType, description, file_path: filePath, severity, category, status: "open" });
+        }
+      }
+      for (const [typeKey, items] of overflowBucket) {
+        const [cat, type] = typeKey.split(":");
+        const summary = `Gegroepeerd (${items.length} items):
+${items.map((i) => `\u2022 ${i}`).join("\n")}`;
+        await supabase2.from("doc_suggestion").insert({
+          repo_slug: repoSlug,
+          refront_project_id: refrontProjectId,
+          category: cat,
+          type,
+          severity: "info",
+          description: summary.slice(0, 5e3),
+          file_path: null,
+          suggested_fix: null,
+          status: "open"
+        });
       }
+      const parts = [`${inserted} inserted`];
+      if (deduplicated > 0) parts.push(`${deduplicated} deduplicated`);
+      if (grouped > 0) parts.push(`${grouped} grouped into ${overflowBucket.size} summary row(s)`);
+      if (errors > 0) parts.push(`${errors} errors`);
       return {
         content: [{
           type: "text",
-          text: `Findings reported: ${inserted} inserted under ${category}${errors > 0 ? `, ${errors} errors` : ""}`
+          text: `Findings reported under ${category}: ${parts.join(", ")}`
         }]
       };
     }
@@ -1108,10 +822,12 @@ async function handleAgentTool(name, args2, deps) {
           title,
           content,
           review_status: reviewStatus,
+          pdf_storage_path: null,
+          pdf_compiled_at: null,
           updated_at: (/* @__PURE__ */ new Date()).toISOString()
         }).eq("id", existing.id);
         if (error2) throw new Error(`Failed to update documentation: ${error2.message}`);
-        return { content: [{ type: "text", text: `Documentation updated: ${title} (${scope}/${path})` }] };
+        return { content: [{ type: "text", text: `Documentation updated: ${title} (${scope}/${path}). PDF compilation pending.` }] };
       }
       const generatedBy = deps.workspaceId ? `agent-${deps.workspaceId.slice(0, 8)}` : "agent-mcp";
       const { error } = await supabase2.from("project_documentation").insert({
@@ -1122,22 +838,19 @@ async function handleAgentTool(name, args2, deps) {
         title,
         content,
         generated_by: generatedBy,
-        review_status: reviewStatus
+        review_status: reviewStatus,
+        pdf_storage_path: null,
+        pdf_compiled_at: null
       });
       if (error) throw new Error(`Failed to save documentation: ${error.message}`);
-      return { content: [{ type: "text", text: `Documentation saved: ${title} (${scope}/${path})` }] };
+      return { content: [{ type: "text", text: `Documentation saved: ${title} (${scope}/${path}). PDF compilation pending.` }] };
     }
     // -----------------------------------------------------------------
     case "agent-list-findings": {
       const repoSlug = sanitizeString(args2.repo_slug, 200);
       if (!repoSlug) throw new Error("repo_slug is required");
       const limit = clamp(Number(args2.limit) || 50, 1, 200);
-      let docQuery = supabase2.from("project_documentation").select("id").eq("repo_slug", repoSlug);
-      const docIds = await docQuery;
-      if (!docIds.data || docIds.data.length === 0) {
-        return { content: [{ type: "text", text: `No documentation records found for repo "${repoSlug}"` }] };
-      }
-      let query = supabase2.from("doc_suggestion").select("id, type, severity, description, file_path, status, created_at").in("documentation_id", docIds.data.map((d) => d.id)).order("created_at", { ascending: false }).limit(limit);
+      let query = supabase2.from("doc_suggestion").select("id, type, severity, description, file_path, status, category, created_at").eq("repo_slug", repoSlug).order("created_at", { ascending: false }).limit(limit);
       if (args2.type && VALID_FINDING_TYPES.has(args2.type)) {
         query = query.eq("type", args2.type);
       }
@@ -1199,6 +912,70 @@ ${output}` }]
       };
     }
     // -----------------------------------------------------------------
+    case "agent-validate-suggestions": {
+      const repoSlug = sanitizeString(args2.repo_slug, 200);
+      const results = Array.isArray(args2.results) ? args2.results : [];
+      if (!repoSlug) throw new Error("repo_slug is required");
+      if (results.length === 0) throw new Error("results array must not be empty");
+      const validatedBy = deps.workspaceId ? `validator-${deps.workspaceId.slice(0, 8)}` : "validator-mcp";
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      let dismissed = 0;
+      let adjusted = 0;
+      let validated = 0;
+      let errors = 0;
+      for (const r of results) {
+        const id = sanitizeString(r.suggestion_id, 100);
+        const verdict = r.verdict;
+        const reason = sanitizeString(r.reason, 2e3);
+        if (!id || !["valid", "invalid", "adjusted"].includes(verdict)) {
+          errors++;
+          continue;
+        }
+        if (verdict === "invalid") {
+          const { error } = await supabase2.from("doc_suggestion").update({
+            status: "dismissed",
+            dismissed_reason: reason || "Dismissed by validation agent",
+            validated_at: now,
+            validated_by: validatedBy
+          }).eq("id", id).eq("repo_slug", repoSlug);
+          if (error) errors++;
+          else dismissed++;
+        } else if (verdict === "adjusted") {
+          const updates = {
+            validated_at: now,
+            validated_by: validatedBy
+          };
+          if (r.adjusted_description) {
+            updates.description = sanitizeString(r.adjusted_description, 2e3);
+          }
+          if (r.adjusted_severity && VALID_SEVERITIES.has(r.adjusted_severity)) {
+            updates.severity = r.adjusted_severity;
+          }
+          if (r.adjusted_suggested_fix) {
+            updates.suggested_fix = sanitizeString(r.adjusted_suggested_fix, 5e3);
+          }
+          const { error } = await supabase2.from("doc_suggestion").update(updates).eq("id", id).eq("repo_slug", repoSlug);
+          if (error) errors++;
+          else adjusted++;
+        } else {
+          const { error } = await supabase2.from("doc_suggestion").update({ validated_at: now, validated_by: validatedBy }).eq("id", id).eq("repo_slug", repoSlug);
+          if (error) errors++;
+          else validated++;
+        }
+      }
+      const parts = [];
+      if (validated > 0) parts.push(`${validated} valid`);
+      if (dismissed > 0) parts.push(`${dismissed} dismissed`);
+      if (adjusted > 0) parts.push(`${adjusted} adjusted`);
+      if (errors > 0) parts.push(`${errors} errors`);
+      return {
+        content: [{
+          type: "text",
+          text: `Validation complete for "${repoSlug}": ${parts.join(", ")}`
+        }]
+      };
+    }
+    // -----------------------------------------------------------------
     default:
       return { content: [{ type: "text", text: `Unknown agent tool: ${name}` }] };
   }
@@ -1336,6 +1113,7 @@ var TOOL_MODULE_MAP = {
   "env-store": "ci_cd",
   "domain-list": "domains",
   "domain-get": "domains",
+  "domain-update-ns": "domains",
   "dns-list": "domains",
   "dns-create": "domains",
   "dns-update": "domains",
@@ -1570,7 +1348,7 @@ async function attemptVercelSync(appName, environment, knownStageId) {
         const envVars = keys.map((key) => ({
           key,
           value: pairs[key],
-          type: "plain",
+          type: "encrypted",
           ...targeting
         }));
         const { created, error } = await syncEnvVarsToVercel(token, app.vercelProjectId, envVars);
@@ -2366,7 +2144,7 @@ var TOOLS = [
       type: "object",
       properties: {
         appName: { type: "string", description: "Application name (e.g. backoffice, api, web)" },
-        environment: { type: "string", description: "Environment name (e.g. production, staging, development, local)" },
+        environment: { type: "string", enum: ["production", "staging", "development", "local"], description: "Environment name" },
         releaseProfile: { type: "string", description: "Release profile name (usually matches the project folder name or git repo name, e.g. prefabaanbouw). Required when multiple profiles exist. Use env-list to discover available profiles." }
       },
       required: ["appName", "environment"]
@@ -2379,7 +2157,7 @@ var TOOLS = [
       type: "object",
       properties: {
         appName: { type: "string", description: "Application name (e.g. backoffice, api, web)" },
-        environment: { type: "string", description: "Environment name (e.g. production, staging, development, local)" },
+        environment: { type: "string", enum: ["production", "staging", "development", "local"], description: "Environment name" },
         content: { type: "string", description: "The .env file content to store" },
         description: { type: "string", description: "Optional description" },
         releaseProfile: { type: "string", description: "Release profile name (usually matches the project folder name or git repo name, e.g. prefabaanbouw). Required when multiple profiles exist. Use env-list to discover available profiles." }
@@ -2415,6 +2193,18 @@ var TOOLS = [
       required: ["domain"]
     }
   },
+  {
+    name: "domain-update-ns",
+    description: 'Update nameservers for a domain. Use alias "default-mijnhost" to reset to mijn.host defaults. Pushes the change to the domain registry.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        domain: { type: "string", description: "Domain name (e.g. example.com)" },
+        nameserver: { type: "string", description: 'Nameserver profile alias (e.g. "default-mijnhost")' }
+      },
+      required: ["domain", "nameserver"]
+    }
+  },
   {
     name: "dns-list",
     description: "List all DNS records for a domain. Returns type (A, AAAA, CNAME, MX, TXT, etc.), name, value, and TTL for each record.",
@@ -2473,8 +2263,6 @@ var TOOLS = [
   },
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS,
-  // ----- Scripts -----
-  ...SCRIPT_TOOLS,
   // ----- Agent Reporting -----
   ...AGENT_TOOLS
 ];
@@ -2823,6 +2611,24 @@ ${lines.join("\n")}` }] };
         }
         return { content: [{ type: "text", text: sections.join("\n") }] };
       }
+      case "domain-update-ns": {
+        const domain = String(a.domain);
+        const nameserver = String(a.nameserver);
+        if (!domain || !nameserver) throw new Error("domain and nameserver are required");
+        await mijnhostFetch(`/domains/${encodeURIComponent(domain)}`, {
+          method: "PUT",
+          body: JSON.stringify({ nameserver })
+        });
+        const verify = await mijnhostFetch(`/domains/${encodeURIComponent(domain)}`);
+        const ns = verify.data.nameservers;
+        return {
+          content: [{
+            type: "text",
+            text: `Nameservers for ${domain} updated to profile "${nameserver}".
+Current nameservers: ${ns.join(", ")}`
+          }]
+        };
+      }
       case "dns-list": {
         const domain = String(a.domain);
         if (!domain) throw new Error("domain is required");
@@ -2924,9 +2730,6 @@ ${lines.join("\n")}` }] };
         if (TRIGGER_TOOL_NAMES.has(name)) {
           return handleTriggerTool(name, a, { sshExec, getServerConnection });
         }
-        if (SCRIPT_TOOL_NAMES.has(name)) {
-          return handleScriptTool(name, a);
-        }
         if (AGENT_TOOL_NAMES.has(name)) {
           return handleAgentTool(name, a, { supabase, workspaceId: agentWorkspaceId });
         }
@@ -2963,7 +2766,8 @@ async function main() {
       "/api/report-finding": "agent-report-finding",
       "/api/save-documentation": "agent-save-documentation",
       "/api/list-findings": "agent-list-findings",
-      "/api/get-documentation": "agent-get-documentation"
+      "/api/get-documentation": "agent-get-documentation",
+      "/api/validate-suggestions": "agent-validate-suggestions"
     };
     const httpServer = createServer(async (req, res) => {
       const url = new URL(req.url ?? "/", `http://localhost:${httpPort}`);