@programinglive/dev-workflow-mcp-server 1.9.1 → 1.10.0

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@programinglive/dev-workflow-mcp-server",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "MCP server to enforce development workflow discipline",
   "homepage": "https://devworkflow.programinglive.com/",
   "mcpName": "io.github.programinglive/dev-workflow-mcp-server",
   "type": "module",
   "main": "index.js",
+  "engines": {
+    "node": ">=20"
+  },
   "bin": {
     "dev-workflow-mcp": "index.js"
   },
@@ -27,7 +30,8 @@
     "release:minor": "node scripts/release.cjs minor",
     "release:patch": "node scripts/release.cjs patch",
     "web": "npm start --prefix web",
-    "release:first": "node scripts/release.cjs --first-release"
+    "release:first": "node scripts/release.cjs --first-release",
+    "verify:bundle": "node scripts/verify-bundle.mjs"
   },
   "keywords": [
     "mcp",
@@ -43,19 +47,11 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "bcrypt": "^5.1.1",
     "better-sqlite3": "^12.11.1",
-    "connect-pg-simple": "^9.0.1",
-    "dotenv": "^17.2.3",
-    "esbuild": "^0.25.0",
-    "express": "^4.18.2",
-    "express-session": "^1.18.0",
-    "get-port": "^7.1.0",
-    "marked": "^12.0.2",
+    "dotenv": "^18.0.9",
     "mysql2": "^3.15.3",
-    "pg": "^8.16.3",
-    "vite": "^7.1.12",
-    "ws": "^8.16.0"
+    "pg": "^8.23.1",
+    "vite": "^7.1.12"
   },
   "publishConfig": {
     "access": "public"
@@ -64,17 +60,17 @@
     "tar": "7.5.22"
   },
   "devDependencies": {
-    "@commitlint/cli": "^20.3.1",
-    "@commitlint/config-conventional": "^20.3.1",
+    "@commitlint/cli": "^21.2.4",
+    "@commitlint/config-conventional": "^21.2.4",
     "@programinglive/commiter": "^1.2.17",
     "@types/node": "^26.6.5",
-    "autoprefixer": "^10.4.22",
+    "autoprefixer": "^10.6.1",
     "cross-env": "^10.1.0",
     "husky": "^9.1.7",
     "postcss": "^8.5.6",
     "standard-version": "^9.5.0",
-    "supertest": "^7.1.4",
-    "typescript": "^5.9.3"
+    "supertest": "^7.3.1",
+    "typescript": "^7.0.2"
   },
   "standard-version": {
     "releaseCommitMessageFormat": "chore(release): {{currentTag}} 🚀",

package/scripts/setup-test-dbs.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+#
+# Creates isolated test databases and users on the database host.
+#
+# Run this on bw-server (it uses sudo locally). It creates:
+#   - PostgreSQL database `devworkflow_test` and role `devworkflow_test`
+#   - MySQL database `devworkflow_test` and user `dwftest`
+#
+# It never touches an existing database, and the role is granted access only to
+# its own database. The adapter tests INSERT and UPDATE real rows, so pointing
+# them at a production database would corrupt real history data.
+#
+# Prints the two connection URLs at the end.
+
+set -euo pipefail
+
+PG_DB=devworkflow_test
+PG_USER=devworkflow_test
+PG_PASS="$(openssl rand -hex 16)"
+
+MY_DB=devworkflow_test
+MY_USER=dwftest
+MY_PASS="$(openssl rand -hex 16)"
+
+echo "=== PostgreSQL ==="
+sudo -u postgres psql -v ON_ERROR_STOP=1 <<SQL
+DO \$\$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname='${PG_USER}') THEN
+    CREATE ROLE ${PG_USER} WITH LOGIN PASSWORD '${PG_PASS}';
+  ELSE
+    ALTER ROLE ${PG_USER} WITH LOGIN PASSWORD '${PG_PASS}';
+  END IF;
+END
+\$\$;
+SQL
+
+sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname='${PG_DB}'" | grep -q 1 \
+  || sudo -u postgres createdb -O "${PG_USER}" "${PG_DB}"
+
+sudo -u postgres psql -d "${PG_DB}" -c "GRANT ALL ON SCHEMA public TO ${PG_USER};" > /dev/null
+sudo -u postgres psql -d "${PG_DB}" -c "ALTER SCHEMA public OWNER TO ${PG_USER};" > /dev/null
+
+echo "=== MySQL ==="
+sudo mysql <<SQL
+CREATE DATABASE IF NOT EXISTS \`${MY_DB}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+CREATE USER IF NOT EXISTS '${MY_USER}'@'localhost' IDENTIFIED BY '${MY_PASS}';
+ALTER USER '${MY_USER}'@'localhost' IDENTIFIED BY '${MY_PASS}';
+GRANT ALL PRIVILEGES ON \`${MY_DB}\`.* TO '${MY_USER}'@'localhost';
+FLUSH PRIVILEGES;
+SQL
+
+echo "=== verification ==="
+mysql -h 127.0.0.1 -u "${MY_USER}" -p"${MY_PASS}" -N -B -e "SELECT 'mysql ok'" "${MY_DB}"
+
+echo
+echo "Add these to your shell before running scripts/test-db-adapters.sh"
+echo "(ports are the local tunnel ports):"
+echo
+echo "TEST_POSTGRES_URL=postgresql://${PG_USER}:${PG_PASS}@127.0.0.1:15432/${PG_DB}"
+echo "TEST_MYSQL_URL=mysql://${MY_USER}:${MY_PASS}@127.0.0.1:13306/${MY_DB}"

package/scripts/test-db-adapters.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+#
+# Runs the database adapter tests against real MySQL and PostgreSQL.
+#
+# The two adapters are skipped in the default suite because they need a live
+# database. This script opens an SSH tunnel to bw-server (where both servers
+# run on localhost), runs only the adapter tests, and closes the tunnel.
+#
+# Usage:
+#   ./scripts/test-db-adapters.sh
+#
+# Requires:
+#   - an SSH host alias `bw-tunnel` that can reach 127.0.0.1:3306 and :5432
+#     (see ~/.ssh/config; the restricted dbtunnel account is enough)
+#   - TEST_MYSQL_URL / TEST_POSTGRES_URL pointing at the forwarded ports,
+#     or the defaults below
+#
+# The test databases are created by scripts/setup-test-dbs.sh on the server.
+# Tests write real rows, so never point these at a production database.
+
+set -euo pipefail
+
+LOCAL_PG_PORT="${LOCAL_PG_PORT:-15432}"
+LOCAL_MY_PORT="${LOCAL_MY_PORT:-13306}"
+SSH_HOST="${SSH_HOST:-bw-tunnel}"
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if ! command -v ssh > /dev/null 2>&1; then
+  echo "ssh not found; this script needs an SSH tunnel to the database host." >&2
+  exit 1
+fi
+
+cleanup() {
+  if [ -n "${TUNNEL_PID:-}" ] && kill -0 "$TUNNEL_PID" 2> /dev/null; then
+    kill "$TUNNEL_PID" 2> /dev/null || true
+    wait "$TUNNEL_PID" 2> /dev/null || true
+    echo "tunnel closed"
+  fi
+}
+trap cleanup EXIT
+
+echo "opening tunnel to $SSH_HOST ($LOCAL_PG_PORT -> 5432, $LOCAL_MY_PORT -> 3306)"
+ssh -o BatchMode=yes -o ExitOnForwardFailure=yes -N \
+  -L "${LOCAL_PG_PORT}:127.0.0.1:5432" \
+  -L "${LOCAL_MY_PORT}:127.0.0.1:3306" \
+  "$SSH_HOST" &
+TUNNEL_PID=$!
+
+# Wait for the forwards to accept connections.
+for port in "$LOCAL_PG_PORT" "$LOCAL_MY_PORT"; do
+  ready=0
+  for _ in $(seq 1 20); do
+    if (exec 3<>"/dev/tcp/127.0.0.1/$port") 2> /dev/null; then
+      exec 3>&- 3<&-
+      ready=1
+      break
+    fi
+    sleep 0.5
+  done
+  if [ "$ready" -ne 1 ]; then
+    echo "port $port did not open; is $SSH_HOST reachable?" >&2
+    exit 1
+  fi
+done
+
+: "${TEST_POSTGRES_URL:?set TEST_POSTGRES_URL (see scripts/setup-test-dbs.sh)}"
+: "${TEST_MYSQL_URL:?set TEST_MYSQL_URL (see scripts/setup-test-dbs.sh)}"
+
+cd "$REPO_ROOT"
+node --no-deprecation --test tests/db-adapters.test.js

package/scripts/verify-bundle.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+
+/**
+ * Verifies that the built bundle actually starts.
+ *
+ * `npm run build:server` succeeding only means the bundler emitted a file. It
+ * says nothing about whether that file runs. This bit us with vite 8: the build
+ * was green and smaller, but `node dist/index.mjs` threw
+ *
+ *   Calling `require` for "fs" in an environment that doesn't expose the
+ *   `require` function
+ *
+ * because rolldown's CJS shim assumed CommonJS. CI only ran the build, so a
+ * broken artefact would have shipped.
+ *
+ * The MCP server is a stdio server: it exits cleanly when stdin closes. So the
+ * pass condition is the startup banner, not the exit code - the same rule used
+ * by scripts/setup-stack.js and the release workflow.
+ *
+ * Usage: node scripts/verify-bundle.mjs [dist/index.mjs]
+ */
+
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+const entry = path.resolve(process.argv[2] || 'dist/index.mjs');
+const STARTUP_PATTERN = /running on stdio|MCP Server starting/i;
+const TIMEOUT_MS = 15000;
+
+if (!existsSync(entry)) {
+  console.error(`✖ Bundle not found: ${entry}`);
+  console.error('  Run "npm run build:server" first.');
+  process.exit(1);
+}
+
+console.log(`Verifying ${path.relative(process.cwd(), entry)}`);
+
+const child = spawn(process.execPath, [entry], {
+  stdio: ['pipe', 'pipe', 'pipe'],
+});
+
+let stdout = '';
+let stderr = '';
+let settled = false;
+
+child.stdout.on('data', (chunk) => {
+  stdout += chunk.toString();
+});
+child.stderr.on('data', (chunk) => {
+  stderr += chunk.toString();
+});
+
+function finish(ok, reason) {
+  if (settled) return;
+  settled = true;
+  clearTimeout(timer);
+  try {
+    child.kill();
+  } catch {
+    // already gone
+  }
+
+  const output = `${stdout}${stderr}`;
+  if (ok) {
+    console.log(`✓ ${reason}`);
+    process.exit(0);
+  }
+
+  console.error(`✖ ${reason}`);
+  console.error('--- bundle output ---');
+  console.error(output.trim() || '(no output)');
+  process.exit(1);
+}
+
+child.on('error', (error) => finish(false, `Failed to spawn: ${error.message}`));
+
+child.on('exit', (code) => {
+  if (STARTUP_PATTERN.test(`${stdout}${stderr}`)) {
+    finish(true, 'Bundle started and exited cleanly (stdin closed).');
+  } else {
+    finish(false, `Bundle exited with code ${code} without reporting that it started.`);
+  }
+});
+
+const timer = setTimeout(() => {
+  if (STARTUP_PATTERN.test(`${stdout}${stderr}`)) {
+    finish(true, 'Bundle started and stayed alive.');
+  } else {
+    finish(false, `Bundle produced no startup output within ${TIMEOUT_MS}ms.`);
+  }
+}, TIMEOUT_MS);

package/tools/definitions.js

@@ -362,5 +362,129 @@ export function getToolList() {
         properties: {},
       },
     },
+    {
+      name: "list_factory_tasks",
+      description:
+        "List tasks from the Factory board (factory.programinglive.com), newest activity first. Defaults to work that still needs attention: running, queued, backlog, review and blocked. Requires FACTORY_URL plus FACTORY_TOKEN, or FACTORY_EMAIL and FACTORY_PASSWORD.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          statuses: {
+            type: "array",
+            items: { type: "string", enum: ["backlog", "queued", "running", "review", "blocked", "done", "cancelled"] },
+            description: "Statuses to include. Defaults to running, queued, backlog, review and blocked.",
+          },
+          project: {
+            type: "string",
+            description: "Optional project name or id to filter by (case-insensitive substring).",
+          },
+          limit: {
+            type: "number",
+            description: "Maximum number of tasks to return (1-200, default 50).",
+          },
+        },
+      },
+    },
+    {
+      name: "list_factory_projects",
+      description:
+        "List projects in the Factory workspace with their UUIDs. Run this before create_factory_task, because Factory requires a real projectId and cannot accept an invented one.",
+      inputSchema: {
+        type: "object",
+        properties: {},
+      },
+    },
+    {
+      name: "create_factory_task",
+      description:
+        "Create a task on the Factory board through the official write path (POST /api/factory create_task). Defaults to status 'backlog', which records the work WITHOUT starting a worker run. Only pass status 'queued' when you really want the worker to execute it - Factory rejects a queued task (409) unless 'acceptance' contains a ```run block. Use list_factory_projects first to get a real projectId.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          projectId: {
+            type: "string",
+            description: "Project UUID from list_factory_projects. Required.",
+          },
+          title: {
+            type: "string",
+            description: "Task title, 3-140 characters.",
+          },
+          description: {
+            type: "string",
+            description: "Optional context: current behaviour, what should change. Max 4000 characters.",
+          },
+          acceptance: {
+            type: "string",
+            description:
+              "What must be true for this task to be done. 3-3000 characters. Required by Factory.",
+          },
+          priority: {
+            type: "string",
+            enum: ["low", "normal", "high"],
+            description: "Defaults to normal.",
+          },
+          status: {
+            type: "string",
+            enum: ["backlog", "queued"],
+            description:
+              "Defaults to backlog. 'queued' also creates a worker run and requires a ```run block in acceptance.",
+          },
+        },
+        required: ["projectId", "title", "acceptance"],
+      },
+    },
+    {
+      name: "claim_factory_task",
+      description:
+        "Claim a task by opening a Factory work session. This is what moves the task to 'running' on the board, because Factory has no plain status edit for it. Also starts the local workflow for that task. Use the task id from list_factory_tasks. If the task is held by another device, pass 'takeoverReason' to take it over; Factory records that reason on the board and locks the previous holder out.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          recordId: {
+            type: "string",
+            description: "Factory task id (UUID) to claim.",
+          },
+          step: {
+            type: "string",
+            description: "Short description of what you are about to do, shown on the device row (max 240 chars).",
+          },
+          takeoverReason: {
+            type: "string",
+            description:
+              "Alasan mengambil alih task yang sedang dipegang perangkat lain (3-500 karakter). Wajib diisi hanya bila task itu dipegang perangkat lain. Alasannya dicatat di papan.",
+          },
+        },
+        required: ["recordId"],
+      },
+    },
+    {
+      name: "sync_task_status",
+      description:
+        "Report a task status change to Factory using the endpoint that supports it: review, blocked and paused finish the work session; backlog, queued, cancelled and done move the task. 'done' is the approval step: Factory accepts it only when the task is currently in review, and it marks the work as finished. 'running' is set by claim_factory_task, not here.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          recordId: {
+            type: "string",
+            description: "Factory task id (UUID).",
+          },
+          status: {
+            type: "string",
+            enum: ["backlog", "queued", "review", "blocked", "paused", "cancelled", "done"],
+            description:
+              "New status. 'running' is set by claim_factory_task, not here. 'done' is the approval step and is only valid when the task is currently in review.",
+          },
+          reason: {
+            type: "string",
+            description: "Required when status is 'blocked'; used as the session summary otherwise.",
+          },
+          nextAction: {
+            type: "string",
+            description: "What happens next. Appended to the session summary.",
+          },
+        },
+        required: ["recordId", "status"],
+      },
+    },
   ];
 }