@nonbot/mcp 0.2.2 → 0.2.4

package/README.md

@@ -100,7 +100,7 @@ Ask your agent to "list my non.bot portfolios", "show what rules apply before I
 ## Tools
 
 <!-- tool-table:start — generated by `npm run gen:tools`; tests/readme-tool-table.test.ts fails if this drifts from the code -->
-### Portfolio (24)
+### Portfolio (27)
 
 The SAFe portfolio canvas: epics, features, stories, snapshots, personas, and the Run launch surface.
 
@@ -113,6 +113,7 @@ The SAFe portfolio canvas: epics, features, stories, snapshots, personas, and th
 | `portfolio_versions` | List the saved version snapshots (time-travel restore points) for a portfolio — id, label, node count, created time. | read | `portfolio:read` |
 | `portfolio_version_get` | Load one snapshot’s full graph (nodes + edges + viewport) — the restore source. | read | `portfolio:read` |
 | `portfolio_characters` | List the Character personas the caller can see (their own + team), optionally scoped to a portfolio. | read | `portfolio:read` |
+| `portfolio_comments_list` | List the threaded comments on one portfolio item (author, content, resolved flag, parent comment). | read | `portfolio:read` |
 | `portfolio_update` | Whole-graph replace: write the complete nodes + edges for a portfolio. | destructive | `portfolio:write` |
 | `portfolio_create_from_plan` | Create a DRAFT portfolio from an LLM-structured plan (epic + optional features/stories). | write | `portfolio:write` |
 | `portfolio_decompose` | Ask the server AI to decompose an item (epic→features or feature→stories) into SUGGESTED children for review. | write | `portfolio:write` |
@@ -124,6 +125,8 @@ The SAFe portfolio canvas: epics, features, stories, snapshots, personas, and th
 | `portfolio_create_activation` | Create an activation (a ▶ Run launch request) for a story. | write | `portfolio:write` + `runs:fire` |
 | `portfolio_update_activation_status` | Transition an activation: pending → running \| failed \| cancelled. | write | `portfolio:write` |
 | `portfolio_snapshot` | Save a labeled version snapshot of a portfolio’s CURRENT graph — a time-travel restore point. | write | `portfolio:write` |
+| `portfolio_move_subtree` | Move one item AND every descendant (by parentItemId) out of a portfolio into another one — an existing portfolio (target_portfolio_id) or a brand-new one (new_… | write | `portfolio:write` |
+| `portfolio_comment_post` | Post a comment on one portfolio item (optionally as a reply via parent_comment_id). | write | `portfolio:write` |
 | `portfolio_create` | Create a new, empty portfolio owned by the caller and return its id + version. | write | `portfolio:write` |
 | `portfolio_add_items` | Add up to 200 items of any level (objective, key-result, epic, feature, story, enabler, milestone) in one versioned write. | write | `portfolio:write` |
 | `portfolio_patch_item` | Change fields of ONE portfolio item without rewriting the graph (PATCH /api/portfolio/graph/node): `set` writes allowlisted PortfolioItemData fields (title, de… | write | `portfolio:write` |
@@ -205,6 +208,14 @@ The supervisor surface: what the daemon and the fleet are doing, plus the three
 | `run_snapshot_request` | Ask the operator's daemon to capture the last lines of a RUNNING run's terminal pane (secrets scrubbed, 16KB tail cap, stored server-side for 5 minutes only). | write | `runs:control` |
 | `run_prompt_answer` | Answer a mid-run prompt on the operator's behalf — the daemon types the answer into the live pane. | destructive | `runs:respond` (explicit; a wildcard token does not satisfy it) |
 | `run_stop_daemon` | The panic button — queue a remote shutdown for the operator's daemon (CLI ≥0.9.12). | destructive | `runs:control` |
+
+### radBUGS (1)
+
+File a bug straight into the radBUGS inbox, stamped as filed from MCP.
+
+| Tool | What it does | Kind | PAT scope |
+|---|---|---|---|
+| `radbug_file` | File a bug report into the non.bot radBUGS inbox, stamped as filed from MCP. | write | `radbugs:write` |
 <!-- tool-table:end -->
 
 **Kind** is the tool's MCP annotation: *read* tools never change anything; *destructive* tools are confirm-gated (`portfolio_update` on large removals, `run_prompt_answer`, `run_stop_daemon`). `NON_BOT_MCP_READONLY=1` drops every non-read tool.
@@ -234,7 +245,7 @@ Safety rails on writes: `portfolio_update` pre-fetches the live version, backs t
 - `core/http.ts` — token-bound fetch wrapper
 - `core/validate.ts` — pre-flight graph validation
 - `core/server.ts` — `registerAll(server, ctx)` (the transport-agnostic heart) + `createNonbotMcpServer(ctx)`
-- `core/toolsets/{portfolio,whygraph,run,monitor,ip}.ts`, `core/resources.ts`, `core/prompts.ts`
+- `core/toolsets/{portfolio,whygraph,run,monitor,ip,radbugs}.ts`, `core/resources.ts`, `core/prompts.ts`
 - `src/stdio.ts` — the `nonbot-mcp` bin: env/CLI-auth token + filesystem backup hook
 - `scripts/gen-tool-table.mjs` — prints the tool tables above from the live definitions (`--portfolio-mcp` does the same for the legacy server)
 

package/dist/core/server.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { ApiContext } from './config.js';
 export declare const SERVER_NAME = "nonbot-mcp";
-export declare const SERVER_VERSION = "0.2.2";
+export declare const SERVER_VERSION = "0.2.4";
 export declare const INSTRUCTIONS: string;
 export declare function registerAll(server: McpServer, ctx: ApiContext): void;
 export declare function createNonbotMcpServer(ctx: ApiContext): McpServer;

package/dist/core/server.js

@@ -5,10 +5,11 @@ import { registerBuildTools } from './toolsets/build.js';
 import { registerWhygraphTools } from './toolsets/whygraph.js';
 import { registerRunTools } from './toolsets/run.js';
 import { registerMonitorTools } from './toolsets/monitor.js';
+import { registerRadbugsTools } from './toolsets/radbugs.js';
 import { registerResources } from './resources.js';
 import { registerPrompts } from './prompts.js';
 export const SERVER_NAME = 'nonbot-mcp';
-export const SERVER_VERSION = '0.2.2';
+export const SERVER_VERSION = '0.2.4';
 export const INSTRUCTIONS = [
     'non.bot MCP — work against the caller’s real product-management data, not a copy.',
     'Two domains: PORTFOLIOS (the SAFe portfolio canvas — epics → features → stories) and',
@@ -28,6 +29,7 @@ export const INSTRUCTIONS = [
     'tokens with the explicit runs:respond scope only).',
     'IP NODES: ip_list / ip_get read a patent or trademark disclosure; ip_update edits it (op list + expected_version);',
     'ip_evidence_add adds evidence the SERVER hashes, timestamps and numbers — never send a hash or a time.',
+    'RADBUGS: radbug_file files a bug into the non.bot radBUGS inbox (needs the radbugs:write scope).',
 ].join(' ');
 export function registerAll(server, ctx) {
     registerPortfolioTools(server, ctx);
@@ -36,6 +38,7 @@ export function registerAll(server, ctx) {
     registerWhygraphTools(server, ctx);
     registerRunTools(server, ctx);
     registerMonitorTools(server, ctx);
+    registerRadbugsTools(server, ctx);
     registerResources(server, ctx);
     registerPrompts(server, ctx);
 }

package/dist/core/toolsets/portfolio.js

@@ -208,6 +208,15 @@ export function registerPortfolioTools(server, ctx) {
         const structured = { count: characters.length, characters };
         return { content: [text(structured)], structuredContent: structured };
     });
+    server.registerTool('portfolio_comments_list', {
+        title: 'List comments on an item',
+        description: 'List the threaded comments on one portfolio item (author, content, resolved flag, parent comment).',
+        inputSchema: { portfolio_id: z.string(), item_id: z.string() },
+        annotations: { readOnlyHint: true, openWorldHint: true },
+    }, async (a) => {
+        const res = await api(ctx, `/api/portfolio/comments?portfolioId=${encodeURIComponent(a.portfolio_id)}&itemId=${encodeURIComponent(a.item_id)}`);
+        return { content: [text(await expectJson(res, 'portfolio_comments_list'))] };
+    });
     if (ctx.readonly)
         return;
     async function gatedReq(method, path, body, label) {
@@ -518,4 +527,65 @@ export function registerPortfolioTools(server, ctx) {
         const structured = { ok: true, ...(versionId ? { versionId } : {}), ...(a.label ? { label: a.label } : {}) };
         return { content: [text(structured)], structuredContent: structured };
     });
+    async function currentVersion(portfolioId, label) {
+        const res = await api(ctx, `/api/portfolio/graph?id=${encodeURIComponent(portfolioId)}`);
+        const g = await expectJson(res, label);
+        const graph = (g.graph ?? g);
+        const v = Number(graph.version);
+        if (!Number.isFinite(v))
+            throw new Error(`${label}: portfolio ${portfolioId} returned no version`);
+        return v;
+    }
+    server.registerTool('portfolio_move_subtree', {
+        title: 'Move an item and its descendants to another portfolio',
+        description: 'Move one item AND every descendant (by parentItemId) out of a portfolio into another one — an existing portfolio (target_portfolio_id) or a brand-new one (new_portfolio_name). Atomic: both portfolios are written together or not at all. Hierarchy edges that cross the boundary are severed (the moved root becomes a root); dependency edges are kept as cross-portfolio links. Versions are read automatically when omitted.',
+        inputSchema: {
+            portfolio_id: z.string().describe('Source portfolio.'),
+            root_item_id: z.string().describe('The item to move; its whole subtree travels with it.'),
+            target_portfolio_id: z.string().optional().describe('Existing destination portfolio.'),
+            new_portfolio_name: z.string().optional().describe('Create a new destination portfolio with this name instead.'),
+            expected_version: z.number().int().optional().describe('Source version (OCC). Read automatically when omitted.'),
+            target_expected_version: z.number().int().optional().describe('Target version (OCC). Read automatically when omitted.'),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async (a) => {
+        if (!!a.target_portfolio_id === !!a.new_portfolio_name) {
+            return { content: [{ type: 'text', text: 'Provide exactly one of target_portfolio_id or new_portfolio_name.' }], isError: true };
+        }
+        const expectedVersion = a.expected_version ?? await currentVersion(a.portfolio_id, 'portfolio_move_subtree (source)');
+        const target = a.target_portfolio_id
+            ? {
+                kind: 'existing',
+                portfolioId: a.target_portfolio_id,
+                expectedVersion: a.target_expected_version ?? await currentVersion(a.target_portfolio_id, 'portfolio_move_subtree (target)'),
+            }
+            : { kind: 'new', name: a.new_portfolio_name };
+        const res = await api(ctx, `/api/portfolio/${encodeURIComponent(a.portfolio_id)}/move-subtree`, {
+            method: 'POST',
+            body: JSON.stringify({ rootNodeId: a.root_item_id, expectedVersion, target }),
+        });
+        return { content: [text(await expectJson(res, 'portfolio_move_subtree'))] };
+    });
+    server.registerTool('portfolio_comment_post', {
+        title: 'Comment on an item',
+        description: 'Post a comment on one portfolio item (optionally as a reply via parent_comment_id). Max 10 KB; the server allows 20 comments per minute.',
+        inputSchema: {
+            portfolio_id: z.string(),
+            item_id: z.string(),
+            content: z.string().min(1).max(10240),
+            parent_comment_id: z.string().optional(),
+        },
+        annotations: { readOnlyHint: false, openWorldHint: true },
+    }, async (a) => {
+        const res = await api(ctx, '/api/portfolio/comments', {
+            method: 'POST',
+            body: JSON.stringify({
+                portfolioId: a.portfolio_id,
+                itemId: a.item_id,
+                content: a.content,
+                ...(a.parent_comment_id ? { parentCommentId: a.parent_comment_id } : {}),
+            }),
+        });
+        return { content: [text(await expectJson(res, 'portfolio_comment_post'))] };
+    });
 }

package/dist/core/toolsets/radbugs.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ApiContext } from '../config.js';
+export declare function registerRadbugsTools(server: McpServer, ctx: ApiContext): void;

package/dist/core/toolsets/radbugs.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import { api, expectJson } from '../http.js';
+const SCOPE_MESSAGE = 'This token needs the radbugs:write scope (or the account needs radBUGS access).';
+async function forbiddenText(res) {
+    let reason = '';
+    try {
+        const j = (await res.json());
+        const m = j && typeof j === 'object' ? (j.message ?? j.error) : undefined;
+        if (typeof m === 'string' && m.trim())
+            reason = m.trim().slice(0, 300);
+    }
+    catch {
+    }
+    return reason ? `${SCOPE_MESSAGE} Server said: ${reason}` : SCOPE_MESSAGE;
+}
+function textResult(data) {
+    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+}
+export function registerRadbugsTools(server, ctx) {
+    if (ctx.readonly)
+        return;
+    server.registerTool('radbug_file', {
+        title: 'File a radBUG',
+        description: 'File a bug report into the non.bot radBUGS inbox, stamped as filed from MCP. Give a short title; add a description (steps, expected vs actual), the product area, a priority, and the page URL when known. Returns the created inbox item. Requires the radbugs:write scope and an account with radBUGS access.',
+        inputSchema: {
+            title: z.string().min(1).max(500).describe('Short summary of the bug.'),
+            description: z.string().max(20000).optional().describe('Steps to reproduce, expected vs actual, context.'),
+            area: z.string().max(80).optional().describe('Product area, e.g. "portfolio" or "radmeeting".'),
+            priority: z.enum(['low', 'med', 'high']).optional().describe('How urgent it is.'),
+            page_url: z.string().max(2048).optional().describe('The page the bug was seen on.'),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+    }, async (a) => {
+        const body = { title: a.title };
+        if (a.description !== undefined)
+            body.description = a.description;
+        if (a.area !== undefined)
+            body.area = a.area;
+        if (a.priority !== undefined)
+            body.priority = a.priority;
+        if (a.page_url !== undefined)
+            body.page_url = a.page_url;
+        body.client = 'mcp';
+        const res = await api(ctx, '/api/admin/radbugs', { method: 'POST', body: JSON.stringify(body) });
+        if (res.status === 403) {
+            return { content: [{ type: 'text', text: await forbiddenText(res) }], isError: true };
+        }
+        return textResult(await expectJson(res, 'POST /api/admin/radbugs'));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nonbot/mcp",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "type": "module",
   "description": "The non.bot MCP server — one server for your portfolios, decision graph, and Runs. Runs over stdio (Claude Code, Cursor, VS Code) with a pat_ token. Built on MCP protocol 2025-11-25.",
   "keywords": [