@nonbot/mcp 0.2.0 → 0.2.3

package/README.md

@@ -205,6 +205,14 @@ The supervisor surface: what the daemon and the fleet are doing, plus the three
 | `run_snapshot_request` | Ask the operator's daemon to capture the last lines of a RUNNING run's terminal pane (secrets scrubbed, 16KB tail cap, stored server-side for 5 minutes only). | write | `runs:control` |
 | `run_prompt_answer` | Answer a mid-run prompt on the operator's behalf — the daemon types the answer into the live pane. | destructive | `runs:respond` (explicit; a wildcard token does not satisfy it) |
 | `run_stop_daemon` | The panic button — queue a remote shutdown for the operator's daemon (CLI ≥0.9.12). | destructive | `runs:control` |
+
+### radBUGS (1)
+
+File a bug straight into the radBUGS inbox, stamped as filed from MCP.
+
+| Tool | What it does | Kind | PAT scope |
+|---|---|---|---|
+| `radbug_file` | File a bug report into the non.bot radBUGS inbox, stamped as filed from MCP. | write | `radbugs:write` |
 <!-- tool-table:end -->
 
 **Kind** is the tool's MCP annotation: *read* tools never change anything; *destructive* tools are confirm-gated (`portfolio_update` on large removals, `run_prompt_answer`, `run_stop_daemon`). `NON_BOT_MCP_READONLY=1` drops every non-read tool.
@@ -234,7 +242,7 @@ Safety rails on writes: `portfolio_update` pre-fetches the live version, backs t
 - `core/http.ts` — token-bound fetch wrapper
 - `core/validate.ts` — pre-flight graph validation
 - `core/server.ts` — `registerAll(server, ctx)` (the transport-agnostic heart) + `createNonbotMcpServer(ctx)`
-- `core/toolsets/{portfolio,whygraph,run,monitor,ip}.ts`, `core/resources.ts`, `core/prompts.ts`
+- `core/toolsets/{portfolio,whygraph,run,monitor,ip,radbugs}.ts`, `core/resources.ts`, `core/prompts.ts`
 - `src/stdio.ts` — the `nonbot-mcp` bin: env/CLI-auth token + filesystem backup hook
 - `scripts/gen-tool-table.mjs` — prints the tool tables above from the live definitions (`--portfolio-mcp` does the same for the legacy server)
 

package/dist/core/server.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { ApiContext } from './config.js';
 export declare const SERVER_NAME = "nonbot-mcp";
-export declare const SERVER_VERSION = "0.2.0";
+export declare const SERVER_VERSION = "0.2.3";
 export declare const INSTRUCTIONS: string;
 export declare function registerAll(server: McpServer, ctx: ApiContext): void;
 export declare function createNonbotMcpServer(ctx: ApiContext): McpServer;

package/dist/core/server.js

@@ -5,10 +5,11 @@ import { registerBuildTools } from './toolsets/build.js';
 import { registerWhygraphTools } from './toolsets/whygraph.js';
 import { registerRunTools } from './toolsets/run.js';
 import { registerMonitorTools } from './toolsets/monitor.js';
+import { registerRadbugsTools } from './toolsets/radbugs.js';
 import { registerResources } from './resources.js';
 import { registerPrompts } from './prompts.js';
 export const SERVER_NAME = 'nonbot-mcp';
-export const SERVER_VERSION = '0.2.0';
+export const SERVER_VERSION = '0.2.3';
 export const INSTRUCTIONS = [
     'non.bot MCP — work against the caller’s real product-management data, not a copy.',
     'Two domains: PORTFOLIOS (the SAFe portfolio canvas — epics → features → stories) and',
@@ -28,6 +29,7 @@ export const INSTRUCTIONS = [
     'tokens with the explicit runs:respond scope only).',
     'IP NODES: ip_list / ip_get read a patent or trademark disclosure; ip_update edits it (op list + expected_version);',
     'ip_evidence_add adds evidence the SERVER hashes, timestamps and numbers — never send a hash or a time.',
+    'RADBUGS: radbug_file files a bug into the non.bot radBUGS inbox (needs the radbugs:write scope).',
 ].join(' ');
 export function registerAll(server, ctx) {
     registerPortfolioTools(server, ctx);
@@ -36,6 +38,7 @@ export function registerAll(server, ctx) {
     registerWhygraphTools(server, ctx);
     registerRunTools(server, ctx);
     registerMonitorTools(server, ctx);
+    registerRadbugsTools(server, ctx);
     registerResources(server, ctx);
     registerPrompts(server, ctx);
 }

package/dist/core/toolsets/build.d.ts

@@ -25,74 +25,47 @@ export declare const toHtml: (s: string) => string;
 export declare function newItemId(now?: number): string;
 declare const itemSpec: z.ZodObject<{
     key: z.ZodOptional<z.ZodString>;
-    level: z.ZodEnum<["objective", "key-result", "epic", "feature", "story", "enabler", "milestone"]>;
+    level: z.ZodEnum<{
+        epic: "epic";
+        objective: "objective";
+        "key-result": "key-result";
+        feature: "feature";
+        story: "story";
+        enabler: "enabler";
+        milestone: "milestone";
+    }>;
     title: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     bluf: z.ZodOptional<z.ZodString>;
     acceptance_criteria: z.ZodOptional<z.ZodString>;
     hypothesis: z.ZodOptional<z.ZodString>;
-    state: z.ZodOptional<z.ZodEnum<["funnel", "reviewing", "analyzing", "ready", "implementing", "done"]>>;
+    state: z.ZodOptional<z.ZodEnum<{
+        done: "done";
+        funnel: "funnel";
+        reviewing: "reviewing";
+        analyzing: "analyzing";
+        ready: "ready";
+        implementing: "implementing";
+    }>>;
     parent: z.ZodOptional<z.ZodString>;
-    okr: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    depends_on: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    okr: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    depends_on: z.ZodOptional<z.ZodArray<z.ZodString>>;
     start_week: z.ZodOptional<z.ZodNumber>;
     start_date: z.ZodOptional<z.ZodString>;
     duration_weeks: z.ZodOptional<z.ZodNumber>;
-    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
     wsjf: z.ZodOptional<z.ZodTuple<[z.ZodNumber, z.ZodNumber, z.ZodNumber, z.ZodNumber], null>>;
     owner: z.ZodOptional<z.ZodString>;
     kr_target: z.ZodOptional<z.ZodString>;
     kr_current: z.ZodOptional<z.ZodString>;
-    okr_status: z.ZodOptional<z.ZodEnum<["on-track", "at-risk", "behind"]>>;
-    images: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    okr_status: z.ZodOptional<z.ZodEnum<{
+        "on-track": "on-track";
+        "at-risk": "at-risk";
+        behind: "behind";
+    }>>;
+    images: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    title: string;
-    level: "epic" | "objective" | "key-result" | "feature" | "story" | "enabler" | "milestone";
-    parent?: string | undefined;
-    description?: string | undefined;
-    acceptance_criteria?: string | undefined;
-    hypothesis?: string | undefined;
-    owner?: string | undefined;
-    key?: string | undefined;
-    bluf?: string | undefined;
-    state?: "done" | "funnel" | "reviewing" | "analyzing" | "ready" | "implementing" | undefined;
-    okr?: string[] | undefined;
-    depends_on?: string[] | undefined;
-    start_week?: number | undefined;
-    start_date?: string | undefined;
-    duration_weeks?: number | undefined;
-    tags?: string[] | undefined;
-    wsjf?: [number, number, number, number] | undefined;
-    kr_target?: string | undefined;
-    kr_current?: string | undefined;
-    okr_status?: "on-track" | "at-risk" | "behind" | undefined;
-    images?: string[] | undefined;
-    fields?: Record<string, unknown> | undefined;
-}, {
-    title: string;
-    level: "epic" | "objective" | "key-result" | "feature" | "story" | "enabler" | "milestone";
-    parent?: string | undefined;
-    description?: string | undefined;
-    acceptance_criteria?: string | undefined;
-    hypothesis?: string | undefined;
-    owner?: string | undefined;
-    key?: string | undefined;
-    bluf?: string | undefined;
-    state?: "done" | "funnel" | "reviewing" | "analyzing" | "ready" | "implementing" | undefined;
-    okr?: string[] | undefined;
-    depends_on?: string[] | undefined;
-    start_week?: number | undefined;
-    start_date?: string | undefined;
-    duration_weeks?: number | undefined;
-    tags?: string[] | undefined;
-    wsjf?: [number, number, number, number] | undefined;
-    kr_target?: string | undefined;
-    kr_current?: string | undefined;
-    okr_status?: "on-track" | "at-risk" | "behind" | undefined;
-    images?: string[] | undefined;
-    fields?: Record<string, unknown> | undefined;
-}>;
+}, z.core.$strip>;
 type ItemSpec = z.infer<typeof itemSpec>;
 export declare function buildItems(g: Graph, specs: ItemSpec[], now?: Date): {
     nodes: Node[];

package/dist/core/toolsets/build.js

@@ -68,7 +68,7 @@ const itemSpec = z.object({
     kr_current: z.string().max(200).optional(),
     okr_status: z.enum(OKR_STATUSES).optional(),
     images: z.array(z.string().max(2048)).max(8).optional().describe('Image URLs from portfolio_asset_upload — the first is the card hero.'),
-    fields: z.record(z.unknown()).optional().describe('Any other PortfolioItemData fields, merged last (structural keys are refused).'),
+    fields: z.record(z.string(), z.unknown()).optional().describe('Any other PortfolioItemData fields, merged last (structural keys are refused).'),
 });
 const DEFAULT_WEEKS = { epic: 8, feature: 4, story: 1, enabler: 2, milestone: 0, objective: 12, 'key-result': 12 };
 const LEGAL_PARENT = {
@@ -225,7 +225,7 @@ export function registerBuildTools(server, ctx) {
         inputSchema: {
             portfolio_id: z.string(),
             item_id: z.string(),
-            set: z.record(z.unknown()).optional(),
+            set: z.record(z.string(), z.unknown()).optional(),
             unset: z.array(z.string()).max(40).optional(),
             expected_version: z.number().int().optional(),
         },
@@ -251,7 +251,7 @@ export function registerBuildTools(server, ctx) {
         description: 'Re-position every item so the Timeline reads cleanly: x from each item\'s start date (the canvas reads dates off x), y top-down — objectives, key results, then one block per epic (epic, features, stories + enablers, milestones), each row lane-packed so overlapping items stack, IP nodes directly above their first source. Short items get a minimum painted width so titles fit. Content is untouched. `heights` overrides the estimated card height per id (px) when a card measures taller on screen.',
         inputSchema: {
             portfolio_id: z.string(),
-            heights: z.record(z.number().min(20).max(2000)).optional(),
+            heights: z.record(z.string(), z.number().min(20).max(2000)).optional(),
             expected_version: z.number().int().optional(),
         },
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
@@ -270,9 +270,9 @@ export function registerBuildTools(server, ctx) {
         inputSchema: {
             portfolio_id: z.string(),
             context_text: z.string().max(20000).optional(),
-            palette: z.object({ id: z.string().min(1).max(64), name: z.string().min(1).max(64), swatches: z.array(z.object({ hex: z.string().regex(/^#[0-9a-fA-F]{6}$/), label: z.string().max(32).optional() })).max(10), roles: z.record(z.string()).optional() }).optional(),
-            canvas_style: z.record(z.unknown()).optional(),
-            sprint_settings: z.record(z.unknown()).optional(),
+            palette: z.object({ id: z.string().min(1).max(64), name: z.string().min(1).max(64), swatches: z.array(z.object({ hex: z.string().regex(/^#[0-9a-fA-F]{6}$/), label: z.string().max(32).optional() })).max(10), roles: z.record(z.string(), z.string()).optional() }).optional(),
+            canvas_style: z.record(z.string(), z.unknown()).optional(),
+            sprint_settings: z.record(z.string(), z.unknown()).optional(),
             expected_version: z.number().int().optional(),
         },
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },

package/dist/core/toolsets/ip.js

@@ -75,7 +75,7 @@ export function registerIpTools(server, ctx) {
     server.registerTool('ip_update', {
         title: 'Edit an IP node (op list)',
         description: 'Apply an op list to one IP node in ONE versioned write: unit.set {unitId, value, expectedRev} · unit.confirm · unit.unconfirm · evidence.update {evId, patch} · evidence.remove {evId} (a tombstone) · evidence.witness {evId, witness:{for,name,line}|null} · evidence.add (max 5 per request; identical adds collapse into one row) · event.upsert · event.remove · filing.set · meta.set. A stale expected_version is HTTP 409 version_conflict with currentVersion — re-read with ip_get and retry.',
-        inputSchema: { ...ids, expected_version: z.number().int().describe('The graph version from ip_get.'), ops: z.array(z.record(z.unknown())).min(1).max(50).refine(o => o.filter(x => x.op === 'evidence.add').length <= 5, 'At most 5 evidence.add ops per request.').describe('The op list.') },
+        inputSchema: { ...ids, expected_version: z.number().int().describe('The graph version from ip_get.'), ops: z.array(z.record(z.string(), z.unknown())).min(1).max(50).refine(o => o.filter(x => x.op === 'evidence.add').length <= 5, 'At most 5 evidence.add ops per request.').describe('The op list.') },
         annotations: WRITE,
     }, async (a) => textResult(await patchNode(ctx, { portfolioId: a.portfolio_id, nodeId: a.node_id, expectedVersion: a.expected_version, ops: a.ops })));
     server.registerTool('ip_evidence_add', {
@@ -85,7 +85,7 @@ export function registerIpTools(server, ctx) {
             ...ids,
             expected_version: z.number().int().describe('The graph version from ip_get.'),
             kind: z.enum(KINDS),
-            from: z.record(z.unknown()).describe('Exactly one source (see description).'),
+            from: z.record(z.string(), z.unknown()).describe('Exactly one source (see description).'),
             title: z.string().min(1).max(300),
             describes: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional().describe('The date the evidence describes (YYYY-MM-DD).'),
             supports: z.array(z.enum(SUPPORTS)).max(5).optional(),

package/dist/core/toolsets/radbugs.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ApiContext } from '../config.js';
+export declare function registerRadbugsTools(server: McpServer, ctx: ApiContext): void;

package/dist/core/toolsets/radbugs.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import { api, expectJson } from '../http.js';
+const SCOPE_MESSAGE = 'This token needs the radbugs:write scope (or the account needs radBUGS access).';
+async function forbiddenText(res) {
+    let reason = '';
+    try {
+        const j = (await res.json());
+        const m = j && typeof j === 'object' ? (j.message ?? j.error) : undefined;
+        if (typeof m === 'string' && m.trim())
+            reason = m.trim().slice(0, 300);
+    }
+    catch {
+    }
+    return reason ? `${SCOPE_MESSAGE} Server said: ${reason}` : SCOPE_MESSAGE;
+}
+function textResult(data) {
+    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+}
+export function registerRadbugsTools(server, ctx) {
+    if (ctx.readonly)
+        return;
+    server.registerTool('radbug_file', {
+        title: 'File a radBUG',
+        description: 'File a bug report into the non.bot radBUGS inbox, stamped as filed from MCP. Give a short title; add a description (steps, expected vs actual), the product area, a priority, and the page URL when known. Returns the created inbox item. Requires the radbugs:write scope and an account with radBUGS access.',
+        inputSchema: {
+            title: z.string().min(1).max(500).describe('Short summary of the bug.'),
+            description: z.string().max(20000).optional().describe('Steps to reproduce, expected vs actual, context.'),
+            area: z.string().max(80).optional().describe('Product area, e.g. "portfolio" or "radmeeting".'),
+            priority: z.enum(['low', 'med', 'high']).optional().describe('How urgent it is.'),
+            page_url: z.string().max(2048).optional().describe('The page the bug was seen on.'),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async (a) => {
+        const body = { title: a.title };
+        if (a.description !== undefined)
+            body.description = a.description;
+        if (a.area !== undefined)
+            body.area = a.area;
+        if (a.priority !== undefined)
+            body.priority = a.priority;
+        if (a.page_url !== undefined)
+            body.page_url = a.page_url;
+        body.client = 'mcp';
+        const res = await api(ctx, '/api/admin/radbugs', { method: 'POST', body: JSON.stringify(body) });
+        if (res.status === 403) {
+            return { content: [{ type: 'text', text: await forbiddenText(res) }], isError: true };
+        }
+        return textResult(await expectJson(res, 'POST /api/admin/radbugs'));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nonbot/mcp",
-  "version": "0.2.0",
+  "version": "0.2.3",
   "type": "module",
   "description": "The non.bot MCP server — one server for your portfolios, decision graph, and Runs. Runs over stdio (Claude Code, Cursor, VS Code) with a pat_ token. Built on MCP protocol 2025-11-25.",
   "keywords": [
@@ -56,7 +56,7 @@
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^3.25.0"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^22.19.19",