@myspec/mcp-server 1.1.1-next.164 → 1.1.1-next.166

package/README.md

@@ -363,6 +363,10 @@ Local state is stored under `~/.myspec/` (alongside the on-disk cache root), spl
 | `reply_spec_file_comment_thread` | `file_id`, `thread_id`, `body` | Replies to an existing thread. Conflicts on a trashed file |
 | `update_spec_file_comment` | `file_id`, `comment_id`, `body`, optional `expected_version` | Edits the body of one of YOUR OWN comments; the platform refuses somebody else's. `expected_version` is the **comment's** own `content_version`, not the file's — pairing it with the file would fail an edit because somebody saved the document. Works on a trashed file |
 | `delete_spec_file_comment` | `file_id`, `comment_id` | Soft-deletes one of YOUR OWN comments. Three outcomes, reported in the result: a reply disappears (`comment: null`); a first comment with live replies becomes a tombstone so the thread keeps a head (`comment` is the tombstone); a first comment with no live replies takes the whole thread (`thread_deleted: true`) |
+| `list_tasks` | `project_id`, optional `status`, `assignee_user_id` (a user id, `me` or `none`), `cycle`, `label`, `file_id`, `include_details`, `limit`, `offset` | The project's task board: every checkbox task in its tasks.md files, in file order, each with a stable `task_id`, `status` (`pending`/`in_progress`/`done`), assignee, `priority` (0 none … 4 low, plus `priority_name`), `story_points`, `cycle`, `start_date`/`end_date` (calendar days, `YYYY-MM-DD`), `labels`, and with `include_details` a 500-character preview of its details. Also the files (with the `content_version` their tasks reflect) and the labels and cycles in use. Filtered and paged by the platform: 100 tasks by default (`limit` up to 500), with `total_tasks` and, while more remain, `next_offset` |
+| `list_task_assignees` | `project_id` | Who the project's tasks can be assigned to: the org's people who can open the project (exactly who `update_tasks` accepts), each with `user_id`, `username` and `display_name`, plus your own `self_user_id`. May include people who left the org but whose profile remains; at most 1000 (`truncated`) |
+| `update_tasks` | `project_id`, `task_ids[]` (≤ 200), any of `assignee_user_id`, `priority`, `story_points`, `cycle`, `start_date`, `end_date`, `add_labels[]`, `remove_labels[]` | Edits planning fields on every task given. A field left out is left alone; `null` clears it. The assignee must be an org member who can open the project (`list_task_assignees`); `me` means you. All or nothing: an unknown id fails the call. Returns the tasks as they are now |
+| `set_task_status` | `project_id`, `task_ids[]` (≤ 200), `status`, optional `expected_versions[]` (`{spec_file_id, content_version}` from `list_tasks`) | Rewrites the tasks' checkboxes in tasks.md (`[ ]`, `[-]`, `[x]`), one revision per file, recorded as an AI change. A file that changed since the pinned version is not written (`file_changed`). Partial: returns `updated`/`unchanged`/`removed`/`failed` counts, an outcome per task (with an error code such as `conflict` or `quota_exceeded`) and per file, and the tasks as they are now; an error result only when every task failed |
 
 There is deliberately **no tool to resolve, unresolve or re-anchor a thread**. Those three are human-only: resolving declares a review finished, and re-anchoring is the repair a person makes after the automatic pass has already failed to locate the passage. The platform refuses them for an AI caller with a 403, so a tool would only ever return an error.
 

package/dist/index.js

@@ -1841,6 +1841,24 @@ function isProjectPermissionDeniedError(err) {
   const message = err.message;
   return typeof message === "string" && message.includes("PROJECT_PERMISSION_DENIED:");
 }
+var TASK_BOARD_DISABLED_CODE = "task_board_disabled";
+var PlatformTaskBoardDisabledError = class extends PlatformHttpError {
+  code = TASK_BOARD_DISABLED_CODE;
+  constructor(message, details) {
+    super(message, 403, details);
+    this.name = "PlatformTaskBoardDisabledError";
+  }
+};
+function isTaskBoardDisabledError(err) {
+  if (err instanceof PlatformTaskBoardDisabledError) {
+    return true;
+  }
+  if (typeof err !== "object" || err === null) {
+    return false;
+  }
+  const code = err.code;
+  return typeof code === "string" && code.toLowerCase() === TASK_BOARD_DISABLED_CODE;
+}
 function isPlatformHttpError(err) {
   return typeof err === "object" && err !== null && err[PLATFORM_ERROR_BRAND] === true;
 }
@@ -1933,6 +1951,9 @@ function createPlatformError(message, status, details, code) {
   if (status === 403 && typeof code === "string" && code.toLowerCase() === PROJECT_PERMISSION_DENIED_CODE) {
     return new PlatformPermissionError(message, details);
   }
+  if (status === 403 && typeof code === "string" && code.toLowerCase() === TASK_BOARD_DISABLED_CODE) {
+    return new PlatformTaskBoardDisabledError(message, details);
+  }
   return new PlatformHttpError(message, status, details);
 }
 function truncate(text) {
@@ -1958,6 +1979,23 @@ async function throwFromResponse(response, fallbackMessage) {
   throw createPlatformError(`HTTP ${response.status}: ${message}`, response.status, details, code);
 }
 
+// ../../packages/platform-client/shared/jwt.ts
+function jwtSubject(token) {
+  const raw = token.startsWith("Bearer ") ? token.slice("Bearer ".length) : token;
+  const payloadSegment = raw.split(".")[1];
+  if (!payloadSegment) {
+    return null;
+  }
+  try {
+    const base64 = payloadSegment.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const payload = JSON.parse(atob(padded));
+    return typeof payload.sub === "string" && payload.sub !== "" ? payload.sub : null;
+  } catch {
+    return null;
+  }
+}
+
 // ../../packages/shared/logger.ts
 var LOG_LEVEL_PRIORITY = {
   debug: 0,
@@ -2318,13 +2356,146 @@ function transformSpecSessionResponse(raw) {
 // ../../packages/platform-client/project/types/lock.types.ts
 var SPEC_FILE_LOCK_TTL_MS = 2 * 6e4;
 
+// ../../packages/platform-client/project/types/task.types.ts
+var TASK_STATUSES = ["pending", "in_progress", "done"];
+var TASK_PRIORITIES = [0, 1, 2, 3, 4];
+var TASK_LIMITS = {
+  maxLabels: 20,
+  maxLabelLength: 40,
+  maxStoryPoints: 9999.99,
+  maxCycle: 1e5,
+  maxTasksPerRequest: 200,
+  /** The most tasks one page of a listing holds. */
+  maxPageSize: 500,
+  /** The most tasks.md files one board lists (and the most expected_versions a status change takes). */
+  maxBoardFiles: 500
+};
+function parseTimestamp(raw) {
+  if (!raw) return null;
+  const d = new Date(raw);
+  return Number.isNaN(d.getTime()) ? null : d;
+}
+function toStatus(raw) {
+  return TASK_STATUSES.includes(raw) ? raw : "pending";
+}
+function toPriority(raw) {
+  return TASK_PRIORITIES.includes(raw) ? raw : 0;
+}
+function toOutcome(raw) {
+  return raw === "updated" || raw === "unchanged" || raw === "removed" ? raw : "failed";
+}
+function transformProjectTask(raw) {
+  return {
+    id: raw.id,
+    projectId: raw.project_id,
+    specFileId: raw.spec_file_id,
+    parentTaskId: raw.parent_task_id ?? null,
+    key: raw.key,
+    title: raw.title,
+    section: raw.section,
+    position: raw.position,
+    depth: raw.depth,
+    status: toStatus(raw.status),
+    body: raw.body,
+    removedAt: parseTimestamp(raw.removed_at),
+    statusChangedAt: parseTimestamp(raw.status_changed_at),
+    completedAt: parseTimestamp(raw.completed_at),
+    assigneeUserId: raw.assignee_user_id ?? null,
+    priority: toPriority(raw.priority),
+    storyPoints: raw.story_points ?? null,
+    cycle: raw.cycle ?? null,
+    startAt: parseTimestamp(raw.start_at),
+    endAt: parseTimestamp(raw.end_at),
+    labels: raw.labels ?? [],
+    updatedBy: raw.updated_by ?? null,
+    createdAt: parseTimestamp(raw.created_at),
+    updatedAt: parseTimestamp(raw.updated_at)
+  };
+}
+function transformTaskBoard(raw) {
+  return {
+    projectId: raw.project_id,
+    files: (raw.files ?? []).map((f) => ({
+      specFileId: f.spec_file_id,
+      filePath: f.file_path,
+      contentVersion: f.content_version,
+      stale: f.stale
+    })),
+    tasks: (raw.tasks ?? []).map(transformProjectTask),
+    labels: raw.labels ?? [],
+    cycles: raw.cycles ?? [],
+    filesTruncated: raw.files_truncated === true,
+    ...typeof raw.total === "number" ? {
+      page: {
+        total: raw.total,
+        offset: raw.offset ?? 0,
+        limit: raw.limit ?? 0,
+        nextOffset: typeof raw.next_offset === "number" ? raw.next_offset : null
+      }
+    } : {}
+  };
+}
+function toTaskListQueryString(query) {
+  if (!query) return "";
+  const params = new URLSearchParams();
+  if (query.status) params.set("status", query.status);
+  if (query.assigneeUserId) params.set("assignee_user_id", query.assigneeUserId);
+  if (query.cycle !== void 0) params.set("cycle", String(query.cycle));
+  if (query.label) params.set("label", query.label);
+  if (query.specFileId) params.set("spec_file_id", query.specFileId);
+  if (query.limit !== void 0) params.set("limit", String(query.limit));
+  if (query.offset !== void 0) params.set("offset", String(query.offset));
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
+}
+function transformSetTaskStatusResult(raw) {
+  return {
+    results: (raw.results ?? []).map((r) => ({
+      taskId: r.task_id,
+      outcome: toOutcome(r.outcome),
+      ...r.error ? { error: r.error } : {}
+    })),
+    files: (raw.files ?? []).map((f) => ({
+      specFileId: f.spec_file_id,
+      contentVersion: f.content_version,
+      written: f.written,
+      ...f.error ? { error: f.error } : {}
+    })),
+    tasks: (raw.tasks ?? []).map(transformProjectTask)
+  };
+}
+function transformTaskAssigneeList(raw) {
+  return {
+    assignees: (raw.assignees ?? []).map((a) => ({
+      userId: a.user_id,
+      username: a.username ?? "",
+      displayName: a.display_name ?? ""
+    })),
+    selfUserId: raw.self_user_id ?? "",
+    truncated: raw.truncated === true
+  };
+}
+function toRawUpdateTasksRequest(taskIds, patch) {
+  const set = {};
+  if ("assigneeUserId" in patch) set.assignee_user_id = patch.assigneeUserId ?? null;
+  if ("priority" in patch) set.priority = patch.priority ?? null;
+  if ("storyPoints" in patch) set.story_points = patch.storyPoints ?? null;
+  if ("cycle" in patch) set.cycle = patch.cycle ?? null;
+  if ("startAt" in patch) set.start_at = patch.startAt ? patch.startAt.toISOString() : null;
+  if ("endAt" in patch) set.end_at = patch.endAt ? patch.endAt.toISOString() : null;
+  const body = { task_ids: taskIds, set };
+  if (patch.addLabels?.length) body.add_labels = patch.addLabels;
+  if (patch.removeLabels?.length) body.remove_labels = patch.removeLabels;
+  return body;
+}
+
 // ../../packages/platform-client/project/types/comment.types.ts
 var COMMENT_THREAD_FILTER_PARAM = "status";
 var COMMENT_UNRESOLVED_ONLY_PARAM = "unresolved_only";
 var MAX_COMMENT_BODY_LENGTH = 1e4;
 var MAX_ANCHOR_QUOTE_LENGTH = 2e3;
 var MAX_ANCHOR_CONTEXT_LENGTH = 64;
-function parseTimestamp(raw) {
+function parseTimestamp2(raw) {
   if (!raw) {
     return null;
   }
@@ -2368,9 +2539,9 @@ function transformSpecFileCommentResponse(raw) {
     body: raw.body,
     deleted: raw.deleted,
     contentVersion: raw.content_version,
-    createdAt: parseTimestamp(raw.created_at),
-    updatedAt: parseTimestamp(raw.updated_at),
-    deletedAt: parseTimestamp(raw.deleted_at)
+    createdAt: parseTimestamp2(raw.created_at),
+    updatedAt: parseTimestamp2(raw.updated_at),
+    deletedAt: parseTimestamp2(raw.deleted_at)
   };
 }
 function transformSpecFileCommentThreadResponse(raw) {
@@ -2390,10 +2561,10 @@ function transformSpecFileCommentThreadResponse(raw) {
     anchorStatus: toAnchorStatus(raw.anchor_status),
     createdBy: raw.created_by,
     createdByKind: toCommentActorKind(raw.created_by_kind),
-    resolvedAt: parseTimestamp(raw.resolved_at),
+    resolvedAt: parseTimestamp2(raw.resolved_at),
     resolvedBy: raw.resolved_by ?? null,
-    createdAt: parseTimestamp(raw.created_at),
-    updatedAt: parseTimestamp(raw.updated_at),
+    createdAt: parseTimestamp2(raw.created_at),
+    updatedAt: parseTimestamp2(raw.updated_at),
     // Always an array: consumers map over it on every render, so the empty case
     // must not be a value each one has to guard.
     comments: (raw.comments ?? []).map(transformSpecFileCommentResponse)
@@ -3152,6 +3323,55 @@ var HttpSpecFileCommentClient = class {
   }
 };
 
+// ../../packages/platform-client/project/http/task.http-client.ts
+var HEADER_ACTOR_KIND3 = "X-Actor-Kind";
+function tasksPath(projectId) {
+  return `/project/v1/projects/${encodeURIComponent(projectId)}/tasks`;
+}
+var HttpProjectTaskClient = class {
+  httpClient;
+  constructor(httpClient) {
+    this.httpClient = httpClient;
+  }
+  async listProjectTasks(projectId, jwtToken, query) {
+    const raw = await this.httpClient.get(
+      `${tasksPath(projectId)}${toTaskListQueryString(query)}`,
+      jwtToken,
+      {}
+    );
+    return transformTaskBoard(raw);
+  }
+  async listProjectTaskAssignees(projectId, jwtToken) {
+    const raw = await this.httpClient.get(`${tasksPath(projectId)}/assignees`, jwtToken, {});
+    return transformTaskAssigneeList(raw);
+  }
+  async updateProjectTasks(projectId, taskIds, patch, jwtToken) {
+    const raw = await this.httpClient.patch(
+      tasksPath(projectId),
+      toRawUpdateTasksRequest(taskIds, patch),
+      jwtToken,
+      {}
+    );
+    return (raw.tasks ?? []).map(transformProjectTask);
+  }
+  async setProjectTaskStatus(projectId, taskIds, status, jwtToken, opts) {
+    const body = {
+      task_ids: taskIds,
+      status
+    };
+    if (opts?.expectedVersions && Object.keys(opts.expectedVersions).length > 0) {
+      body.expected_versions = opts.expectedVersions;
+    }
+    const raw = await this.httpClient.post(
+      `${tasksPath(projectId)}/status`,
+      body,
+      jwtToken,
+      opts?.actorKind ? { headers: { [HEADER_ACTOR_KIND3]: opts.actorKind } } : {}
+    );
+    return transformSetTaskStatusResult(raw);
+  }
+};
+
 // ../../packages/platform-client/artifact/types/artifact.types.ts
 function transformArtifactResponse(raw) {
   return {
@@ -3283,14 +3503,14 @@ function buildUpdateArtifactBody(request) {
 // ../../packages/platform-client/artifact/http/artifact.http-client.ts
 var BASE_PATH = "/artifact/v1";
 var HEADER_EXPECTED_VERSION3 = "X-Expected-Version";
-var HEADER_ACTOR_KIND3 = "X-Actor-Kind";
+var HEADER_ACTOR_KIND4 = "X-Actor-Kind";
 function writeHeaders(opts) {
   const headers = {};
   if (opts?.expectedVersion !== void 0) {
     headers[HEADER_EXPECTED_VERSION3] = String(opts.expectedVersion);
   }
   if (opts?.actorKind) {
-    headers[HEADER_ACTOR_KIND3] = opts.actorKind;
+    headers[HEADER_ACTOR_KIND4] = opts.actorKind;
   }
   return headers;
 }
@@ -3868,7 +4088,8 @@ var PlatformClient = class {
       attachment: new HttpAttachmentClient(httpClient),
       artifact: new HttpArtifactClient(httpClient),
       streamToken: new HttpStreamTokenClient(httpClient),
-      comment: new HttpSpecFileCommentClient(httpClient)
+      comment: new HttpSpecFileCommentClient(httpClient),
+      task: new HttpProjectTaskClient(httpClient)
     };
   }
   // ------------------------------------------------------- stream tokens
@@ -3972,6 +4193,41 @@ var PlatformClient = class {
       (jwt, c) => c.comment.deleteComment(fileId, commentId, jwt, { actorKind: "ai" })
     );
   }
+  // ---------------------------------------------------------------- tasks
+  //
+  // The project task board. A status change rewrites tasks.md, so it carries
+  // `actorKind: 'ai'` like every other file write here: the revision is then
+  // recorded as the assistant's, not filed under the user's name. A planning
+  // edit writes no file and the platform records no actor kind for it.
+  /** The live tasks of a project's tasks.md files: all, or those `query` keeps. */
+  async listProjectTasks(projectId, query) {
+    return this.withTokenRetry((jwt, c) => c.task.listProjectTasks(projectId, jwt, query));
+  }
+  /** Who the project's tasks can be assigned to, and the caller's own user id. */
+  async listProjectTaskAssignees(projectId) {
+    return this.withTokenRetry((jwt, c) => c.task.listProjectTaskAssignees(projectId, jwt));
+  }
+  /**
+   * The caller's own user id, read from the access token (unverified: only to
+   * turn "me" into an id the platform then checks). Null when the token does
+   * not carry one.
+   */
+  async currentUserId() {
+    return jwtSubject(await this.tokenManager.getValidAccessToken());
+  }
+  /** Applies one planning patch to up to 200 tasks; all or nothing. */
+  async updateProjectTasks(projectId, taskIds, patch) {
+    return this.withTokenRetry((jwt, c) => c.task.updateProjectTasks(projectId, taskIds, patch, jwt));
+  }
+  /**
+   * Sets the status of up to 200 tasks by rewriting their checkboxes.
+   * `expectedVersions` pins the file versions the caller's view came from.
+   */
+  async setProjectTaskStatus(projectId, taskIds, status, expectedVersions) {
+    return this.withTokenRetry(
+      (jwt, c) => c.task.setProjectTaskStatus(projectId, taskIds, status, jwt, { actorKind: "ai", expectedVersions })
+    );
+  }
   async withTokenRetry(call) {
     const clients = await this.clients();
     const jwt = await this.tokenManager.getValidAccessToken();
@@ -7180,6 +7436,258 @@ var startSpecSessionTool = {
   }
 };
 
+// src/server/tools/tasks.ts
+import { z as z39 } from "zod";
+var LIST_DEFAULT_TASKS = 100;
+var LIST_MAX_TASKS = 500;
+var LIST_MAX_OFFSET = 1e6;
+var DETAILS_PREVIEW_CHARS = 500;
+var ME = "me";
+var NONE = "none";
+var PRIORITY_NAMES = ["none", "urgent", "high", "medium", "low"];
+var STATUS = z39.enum(["pending", "in_progress", "done"]);
+function toDay(date) {
+  return date ? date.toISOString().slice(0, 10) : null;
+}
+function fromDay(day) {
+  return /* @__PURE__ */ new Date(`${day}T00:00:00Z`);
+}
+function taskSummary(task, opts = {}) {
+  const withDetails = opts.details === true && task.body !== "";
+  const truncated = withDetails && task.body.length > DETAILS_PREVIEW_CHARS;
+  return {
+    task_id: task.id,
+    spec_file_id: task.specFileId,
+    // The id written in the file ("1", "1.1", "T001"); '' when it has none.
+    key: task.key,
+    title: task.title,
+    section: task.section,
+    parent_task_id: task.parentTaskId,
+    status: task.status,
+    assignee_user_id: task.assigneeUserId,
+    priority: task.priority,
+    priority_name: PRIORITY_NAMES[task.priority],
+    story_points: task.storyPoints,
+    cycle: task.cycle,
+    start_date: toDay(task.startAt),
+    end_date: toDay(task.endAt),
+    labels: task.labels,
+    ...withDetails ? { details: truncated ? task.body.slice(0, DETAILS_PREVIEW_CHARS) : task.body } : {},
+    // Only ever present and true.
+    ...truncated ? { details_truncated: true } : {},
+    updated_at: task.updatedAt?.toISOString()
+  };
+}
+var userIdField = z39.string().trim().min(1);
+async function resolveMe(id, ctx) {
+  return id === ME ? ctx.client.currentUserId() : id;
+}
+var UNKNOWN_ME = 'Could not tell who you are from this connection, so "me" cannot be used. Pass your user id instead: list_task_assignees returns it as self_user_id.';
+var labelField = z39.string().trim().min(1).refine((label) => Array.from(label).length <= TASK_LIMITS.maxLabelLength, {
+  message: `A label is at most ${String(TASK_LIMITS.maxLabelLength)} characters.`
+});
+function taskIdsField(what) {
+  return z39.array(z39.uuid()).min(1).max(TASK_LIMITS.maxTasksPerRequest).describe(`${what} At most ${String(TASK_LIMITS.maxTasksPerRequest)} per call.`);
+}
+var listInputSchema2 = {
+  project_id: z39.uuid().describe("UUID of the project whose tasks to list."),
+  status: STATUS.optional().describe("Only tasks with this status."),
+  assignee_user_id: userIdField.optional().describe(
+    'Only tasks assigned to this user id (as returned in assignee_user_id or by list_task_assignees). "me" means you; "none" means unassigned tasks.'
+  ),
+  cycle: z39.number().int().min(1).max(TASK_LIMITS.maxCycle).optional().describe("Only tasks in this cycle (sprint) number."),
+  label: labelField.optional().describe("Only tasks carrying this label."),
+  file_id: z39.uuid().optional().describe("Only tasks from this tasks.md (its spec file id)."),
+  include_details: z39.boolean().optional().describe(
+    "Also return each task's details (its sub-bullets in tasks.md), previewed to 500 characters. Off by default: they make the result several times larger."
+  ),
+  limit: z39.number().int().min(1).max(LIST_MAX_TASKS).optional().describe(
+    `Tasks per page (default ${String(LIST_DEFAULT_TASKS)}, at most ${String(LIST_MAX_TASKS)}).`
+  ),
+  offset: z39.number().int().min(0).max(LIST_MAX_OFFSET).optional().describe("How many matching tasks to skip; pass next_offset from the previous page.")
+};
+function pageLocally(board, query) {
+  const assignee = query.assigneeUserId;
+  const label = query.label?.split(/\s+/).filter(Boolean).join(" ");
+  const matching = board.tasks.filter(
+    (task) => (query.status === void 0 || task.status === query.status) && (assignee === void 0 || (assignee === NONE ? task.assigneeUserId === null : task.assigneeUserId === assignee)) && (query.cycle === void 0 || task.cycle === query.cycle) && (label === void 0 || task.labels.includes(label)) && (query.specFileId === void 0 || task.specFileId === query.specFileId)
+  );
+  const offset = query.offset ?? 0;
+  const tasks = matching.slice(offset, offset + (query.limit ?? LIST_DEFAULT_TASKS));
+  const next = offset + tasks.length;
+  return {
+    tasks,
+    total: matching.length,
+    offset,
+    nextOffset: next < matching.length ? next : null
+  };
+}
+var listTasksTool = {
+  name: "list_tasks",
+  description: `List a project's tasks: every checkbox task in its tasks.md files, in file order, each with a stable task_id, status (pending, in_progress, done), assignee, priority (0 none, 1 urgent, 2 high, 3 medium, 4 low), story points, cycle, start/end dates (YYYY-MM-DD) and labels. Also returns the files (with the content_version their tasks reflect), and the labels and cycles in use. Filter by status, assignee ("me" for yourself, "none" for unassigned), cycle, label or file. Paged: 100 tasks by default (limit up to 500), with total_tasks and, while more remain, next_offset. Details (sub-bullets) only with include_details. Use the task_id values with update_tasks and set_task_status.`,
+  inputSchema: listInputSchema2,
+  handler: async (args, ctx) => {
+    let assignee;
+    if (args.assignee_user_id !== void 0) {
+      const resolved = await resolveMe(args.assignee_user_id, ctx);
+      if (resolved === null) return errorResult(UNKNOWN_ME);
+      assignee = resolved;
+    }
+    const query = {
+      ...args.status !== void 0 ? { status: args.status } : {},
+      ...assignee !== void 0 ? { assigneeUserId: assignee } : {},
+      ...args.cycle !== void 0 ? { cycle: args.cycle } : {},
+      ...args.label !== void 0 ? { label: args.label } : {},
+      ...args.file_id !== void 0 ? { specFileId: args.file_id } : {},
+      limit: args.limit ?? LIST_DEFAULT_TASKS,
+      offset: args.offset ?? 0
+    };
+    const board = await ctx.client.listProjectTasks(args.project_id, query);
+    const page = board.page ? {
+      tasks: board.tasks,
+      total: board.page.total,
+      offset: board.page.offset,
+      nextOffset: board.page.nextOffset
+    } : pageLocally(board, query);
+    return jsonResult({
+      project_id: board.projectId,
+      files: board.files.map((file) => ({
+        spec_file_id: file.specFileId,
+        file_path: file.filePath,
+        content_version: file.contentVersion,
+        // The file could not be re-read just now: its tasks are from the last read.
+        ...file.stale ? { stale: true } : {}
+      })),
+      // Only ever present and true: the project has more than 500 tasks.md
+      // files and the rest are left out.
+      ...board.filesTruncated ? { files_truncated: true } : {},
+      tasks: page.tasks.map((task) => taskSummary(task, { details: args.include_details })),
+      total_tasks: page.total,
+      offset: page.offset,
+      // Only while more remain, so its absence means "that was the last page".
+      ...page.nextOffset !== null ? { next_offset: page.nextOffset } : {},
+      labels: board.labels,
+      cycles: board.cycles
+    });
+  }
+};
+var assigneesInputSchema = {
+  project_id: z39.uuid().describe("UUID of the project whose tasks are being assigned.")
+};
+var listTaskAssigneesTool = {
+  name: "list_task_assignees",
+  description: `List who a project's tasks can be assigned to: the organisation's people who can open the project, which is exactly who update_tasks accepts as assignee_user_id. Each has a user_id, a username (handle) and a display_name ("" when unset). Also returns your own user id as self_user_id. May include people who have left the organisation but whose profile remains. At most 1000 people; truncated is true when the list was cut.`,
+  inputSchema: assigneesInputSchema,
+  handler: async (args, ctx) => {
+    const list = await ctx.client.listProjectTaskAssignees(args.project_id);
+    return jsonResult({
+      assignees: list.assignees.map((a) => ({
+        user_id: a.userId,
+        username: a.username,
+        display_name: a.displayName
+      })),
+      self_user_id: list.selfUserId,
+      // Only ever present and true.
+      ...list.truncated ? { truncated: true } : {}
+    });
+  }
+};
+var updateInputSchema2 = {
+  project_id: z39.uuid().describe("UUID of the project the tasks belong to."),
+  task_ids: taskIdsField("The tasks to change (task_id values from list_tasks)."),
+  assignee_user_id: userIdField.nullable().optional().describe(
+    'User id to assign ("me" for yourself), or null to unassign. The person must be a member of the organisation who can open the project: list_task_assignees lists them.'
+  ),
+  priority: z39.number().int().min(0).max(4).optional().describe("0 none, 1 urgent, 2 high, 3 medium, 4 low."),
+  story_points: z39.number().min(0).max(TASK_LIMITS.maxStoryPoints).nullable().optional().describe("Estimate in story points, or null to clear it."),
+  cycle: z39.number().int().min(1).max(TASK_LIMITS.maxCycle).nullable().optional().describe("Cycle (sprint) number, or null to clear it."),
+  start_date: z39.iso.date().nullable().optional().describe("Start day as YYYY-MM-DD, or null to clear it."),
+  end_date: z39.iso.date().nullable().optional().describe("Due day as YYYY-MM-DD, or null to clear it. Not before the start day."),
+  add_labels: z39.array(labelField).max(TASK_LIMITS.maxLabels).optional().describe(`Labels to add. A task carries at most ${String(TASK_LIMITS.maxLabels)}.`),
+  remove_labels: z39.array(labelField).max(TASK_LIMITS.maxLabels).optional().describe("Labels to remove.")
+};
+var updateTasksTool = {
+  name: "update_tasks",
+  description: "Edit the planning fields of one or more tasks: assignee, priority, story points, cycle, start and due dates, and labels. The same change applies to every task given. A field left out is left alone; null clears it. Labels are added and removed, not replaced. Does not change status or the task's text, which live in tasks.md: use set_task_status for status. All or nothing: an unknown task id fails the whole call. Returns the tasks as they are now.",
+  inputSchema: updateInputSchema2,
+  handler: async (args, ctx) => {
+    const patch = {};
+    if (args.assignee_user_id === null) {
+      patch.assigneeUserId = null;
+    } else if (args.assignee_user_id !== void 0) {
+      const assignee = await resolveMe(args.assignee_user_id, ctx);
+      if (assignee === null) return errorResult(UNKNOWN_ME);
+      patch.assigneeUserId = assignee;
+    }
+    if (args.priority !== void 0) patch.priority = args.priority;
+    if (args.story_points !== void 0) patch.storyPoints = args.story_points;
+    if (args.cycle !== void 0) patch.cycle = args.cycle;
+    if (args.start_date !== void 0) {
+      patch.startAt = args.start_date === null ? null : fromDay(args.start_date);
+    }
+    if (args.end_date !== void 0) {
+      patch.endAt = args.end_date === null ? null : fromDay(args.end_date);
+    }
+    if (args.add_labels?.length) patch.addLabels = args.add_labels;
+    if (args.remove_labels?.length) patch.removeLabels = args.remove_labels;
+    if (Object.keys(patch).length === 0) {
+      return errorResult(
+        "Nothing to change: pass at least one of assignee_user_id, priority, story_points, cycle, start_date, end_date, add_labels or remove_labels."
+      );
+    }
+    const tasks = await ctx.client.updateProjectTasks(args.project_id, args.task_ids, patch);
+    return jsonResult({ tasks: tasks.map((task) => taskSummary(task)) });
+  }
+};
+var statusInputSchema = {
+  project_id: z39.uuid().describe("UUID of the project the tasks belong to."),
+  task_ids: taskIdsField("The tasks to move (task_id values from list_tasks)."),
+  status: STATUS.describe("The new status: pending, in_progress or done."),
+  expected_versions: z39.array(
+    z39.object({
+      spec_file_id: z39.uuid().describe("A tasks.md file (spec_file_id from list_tasks)."),
+      content_version: z39.number().int().min(0).describe("The content_version list_tasks returned for that file.")
+    })
+  ).max(TASK_LIMITS.maxBoardFiles).optional().describe(
+    "Optional. The file versions your view of these tasks came from (from list_tasks); only the files these tasks are in are checked, so passing just those is enough. A file that has changed since is not written and its tasks fail with file_changed, so a change never lands on a line you did not see; list again and retry."
+  )
+};
+var setTaskStatusTool = {
+  name: "set_task_status",
+  description: "Change the status of one or more tasks by rewriting their checkbox in the project's tasks.md files: `[ ]` pending, `[-]` in progress, `[x]` done. Each affected file gets one new revision, recorded as an AI change; nothing else in the file changes. Partial by nature: a file that cannot be written (it kept changing, it changed since the expected_versions you passed, the organisation is out of storage, or it was moved to the trash) fails only its own tasks. Returns an outcome per task (updated, unchanged, removed: no longer in its file, failed: with an error code), an outcome per file, and the tasks as they are now. Marked as an error only when every task failed.",
+  inputSchema: statusInputSchema,
+  handler: async (args, ctx) => {
+    const expected = args.expected_versions?.length ? Object.fromEntries(args.expected_versions.map((v) => [v.spec_file_id, v.content_version])) : void 0;
+    const result = await ctx.client.setProjectTaskStatus(
+      args.project_id,
+      args.task_ids,
+      args.status,
+      expected
+    );
+    const count = (outcome) => result.results.filter((r) => r.outcome === outcome).length;
+    const failed = count("failed");
+    const body = jsonResult({
+      updated: count("updated"),
+      unchanged: count("unchanged"),
+      removed: count("removed"),
+      failed,
+      results: result.results.map((r) => ({
+        task_id: r.taskId,
+        outcome: r.outcome,
+        ...r.error ? { error: r.error } : {}
+      })),
+      files: result.files.map((file) => ({
+        spec_file_id: file.specFileId,
+        content_version: file.contentVersion,
+        written: file.written,
+        ...file.error ? { error: file.error } : {}
+      })),
+      tasks: result.tasks.map((task) => taskSummary(task))
+    });
+    return failed > 0 && failed === result.results.length ? { ...body, isError: true } : body;
+  }
+};
+
 // src/server/server.ts
 function buildServer(deps) {
   const server = new McpServer({
@@ -7231,6 +7739,10 @@ function buildServer(deps) {
   registerTool(server, replySpecFileCommentThreadTool, ctx);
   registerTool(server, updateSpecFileCommentTool, ctx);
   registerTool(server, deleteSpecFileCommentTool, ctx);
+  registerTool(server, listTasksTool, ctx);
+  registerTool(server, listTaskAssigneesTool, ctx);
+  registerTool(server, updateTasksTool, ctx);
+  registerTool(server, setTaskStatusTool, ctx);
   return server;
 }
 async function startStdioServer(deps) {
@@ -7249,6 +7761,11 @@ function wrapToolHandler(tool, ctx) {
       if (isProjectPermissionDeniedError(err)) {
         return errorResult(`${tool.name} failed: ${permissionDeniedMessage(err)}`);
       }
+      if (isTaskBoardDisabledError(err)) {
+        return errorResult(
+          `${tool.name} failed: the task board is turned off in this MySpec environment, so the task tools are unavailable here until it is turned on.`
+        );
+      }
       const message = err instanceof Error ? err.message : String(err);
       return errorResult(`${tool.name} failed: ${message}`);
     }
@@ -7402,7 +7919,7 @@ async function canonicaliseRoot(root) {
 import { promises as fs4 } from "fs";
 import { join as join2, relative } from "path";
 import { spawn } from "child_process";
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // src/reverse/ignore.ts
@@ -7707,37 +8224,37 @@ var READ_FILE_MAX_LINES = 2e3;
 var LIST_DIR_HARD_CAP = 5e3;
 var LIST_DIR_DEFAULT_CAP = 1e3;
 var GREP_MAX_MATCHES_DEFAULT = 200;
-var listDirInput = z39.object({
-  path: z39.string(),
-  recursive: z39.boolean().optional(),
-  maxEntries: z39.number().int().positive().optional(),
-  includeIgnored: z39.boolean().optional()
+var listDirInput = z40.object({
+  path: z40.string(),
+  recursive: z40.boolean().optional(),
+  maxEntries: z40.number().int().positive().optional(),
+  includeIgnored: z40.boolean().optional()
 });
-var readFileInput = z39.object({
-  path: z39.string(),
-  offset: z39.number().int().nonnegative().optional(),
-  limit: z39.number().int().positive().optional(),
-  includeIgnored: z39.boolean().optional()
+var readFileInput = z40.object({
+  path: z40.string(),
+  offset: z40.number().int().nonnegative().optional(),
+  limit: z40.number().int().positive().optional(),
+  includeIgnored: z40.boolean().optional()
 });
-var grepInput = z39.object({
-  pattern: z39.string().describe(
+var grepInput = z40.object({
+  pattern: z40.string().describe(
     "Search pattern. Interpreted as a regular expression by default (ripgrep syntax), e.g. `foo|bar` or `[Rr]ole`. Set `isRegex: false` to match the pattern as an exact literal string instead."
   ),
-  path: z39.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
-  isRegex: z39.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
-  caseSensitive: z39.boolean().optional(),
-  maxMatches: z39.number().int().positive().optional(),
-  contextLines: z39.number().int().nonnegative().optional(),
-  includeIgnored: z39.boolean().optional()
+  path: z40.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
+  isRegex: z40.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
+  caseSensitive: z40.boolean().optional(),
+  maxMatches: z40.number().int().positive().optional(),
+  contextLines: z40.number().int().nonnegative().optional(),
+  includeIgnored: z40.boolean().optional()
 });
-var packCodebaseInput = z39.object({
-  subpath: z39.string().optional(),
-  includePatterns: z39.string().optional(),
-  ignorePatterns: z39.string().optional()
+var packCodebaseInput = z40.object({
+  subpath: z40.string().optional(),
+  includePatterns: z40.string().optional(),
+  ignorePatterns: z40.string().optional()
 });
-var packCodebaseReadPageInput = z39.object({
-  outputId: z39.string(),
-  page: z39.number().int().positive()
+var packCodebaseReadPageInput = z40.object({
+  outputId: z40.string(),
+  page: z40.number().int().positive()
 });
 function structuredError(error, message, extra) {
   const payload = { error, message, ...extra ?? {} };
@@ -8265,7 +8782,7 @@ function jsonSchemaFromZod(schema) {
   return zodToJson(schema);
 }
 function zodToJson(schema) {
-  if (schema instanceof z39.ZodObject) {
+  if (schema instanceof z40.ZodObject) {
     const shape = schema.shape;
     const properties = {};
     const required = [];
@@ -8280,19 +8797,19 @@ function zodToJson(schema) {
     if (required.length > 0) out.required = required;
     return out;
   }
-  if (schema instanceof z39.ZodOptional) {
+  if (schema instanceof z40.ZodOptional) {
     return zodToJson(schema.unwrap());
   }
-  if (schema instanceof z39.ZodString) {
+  if (schema instanceof z40.ZodString) {
     return { type: "string" };
   }
-  if (schema instanceof z39.ZodNumber) {
+  if (schema instanceof z40.ZodNumber) {
     return { type: "number" };
   }
-  if (schema instanceof z39.ZodBoolean) {
+  if (schema instanceof z40.ZodBoolean) {
     return { type: "boolean" };
   }
-  if (schema instanceof z39.ZodEnum) {
+  if (schema instanceof z40.ZodEnum) {
     return { type: "string", enum: schema.options };
   }
   return { type: "string" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "1.1.1-next.164",
+  "version": "1.1.1-next.166",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {