@rigstate/mcp 0.7.2 → 0.7.4

package/dist/index.js

@@ -1937,14 +1937,19 @@ async function getProjectContext(supabase, userId, projectId) {
     repository_tree: projectRow.repository_tree
   };
   const stackDef = projectRow.architectural_dna?.stack_definition;
-  const [activeTaskResult, nextTaskResult] = await Promise.all([
-    supabase.from("roadmap_chunks").select("id, title, step_number, role, instruction_set").eq("project_id", projectId).in("status", ["IN_PROGRESS", "ACTIVE"]).limit(1).maybeSingle(),
-    supabase.from("roadmap_chunks").select("id, title, step_number, role").eq("project_id", projectId).in("status", ["PENDING", "LOCKED"]).order("step_number", { ascending: true }).limit(1).maybeSingle()
-  ]);
-  const activeTask = activeTaskResult.data;
-  const nextTask = nextTaskResult.data;
-  const { data: agentTasks } = await supabase.from("agent_bridge").select("id, roadmap_chunks(title), execution_summary, completed_at").eq("project_id", projectId).eq("status", "COMPLETED").order("completed_at", { ascending: false }).limit(2);
-  const { data: roadmapItems } = await supabase.from("roadmap_chunks").select("title, status, updated_at").eq("project_id", projectId).order("updated_at", { ascending: false }).limit(2);
+  const { data: allChunks, error: chunksError } = await supabase.rpc("get_roadmap_chunks_secure", {
+    p_project_id: projectId,
+    p_user_id: userId
+  });
+  const tasks = allChunks || [];
+  const activeTask = tasks.find((t) => ["IN_PROGRESS", "ACTIVE"].includes(t.status));
+  const nextTask = tasks.filter((t) => ["PENDING", "LOCKED"].includes(t.status)).sort((a, b) => a.step_number - b.step_number)[0];
+  const { data: agentTasks } = await supabase.rpc("get_agent_bridge_secure", {
+    p_project_id: projectId,
+    p_user_id: userId,
+    p_limit: 2
+  });
+  const roadmapItems = tasks.sort((a, b) => new Date(b.updated_at || b.created_at).getTime() - new Date(a.updated_at || a.created_at).getTime()).slice(0, 2);
   const techStack = {
     framework: null,
     orm: null,
@@ -2027,7 +2032,7 @@ Description: ${project.description}`);
     summaryParts.push("\nLatest AI Executions:");
     agentTasks.forEach((t) => {
       const time = t.completed_at ? new Date(t.completed_at).toLocaleString() : "Recently";
-      summaryParts.push(`- [${time}] ${t.roadmap_chunks?.title || "Task"}: ${t.execution_summary || "Completed"}`);
+      summaryParts.push(`- [${time}] ${t.roadmap_title || "Task"}: ${t.execution_summary || "Completed"}`);
     });
   }
   if (roadmapItems && roadmapItems.length > 0) {
@@ -2211,8 +2216,11 @@ including active roadmap steps and council session feedback.`,
   }
 });
 async function getLatestDecisions(supabase, userId, projectId, limit = 5) {
-  const { data: project, error: projectError } = await supabase.from("projects").select("id").eq("id", projectId).eq("owner_id", userId).single();
-  if (projectError || !project) {
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", {
+    p_project_id: projectId,
+    p_user_id: userId
+  });
+  if (accessError || !hasAccess) {
     throw new Error("Project not found or access denied");
   }
   const { data: sessionData, error: sessionError } = await supabase.from("council_sessions").select("id, project_id, recruited_agents, feedback_summary, duration_ms, sprints_count, tasks_count, created_at").eq("project_id", projectId).order("created_at", { ascending: false }).limit(limit);
@@ -2767,22 +2775,30 @@ Shows active and locked steps with their step numbers.`,
   }
 });
 async function listRoadmapTasks(supabase, userId, projectId) {
-  const { data: project, error: projectError } = await supabase.from("projects").select("id").eq("id", projectId).eq("owner_id", userId).single();
-  if (projectError || !project) {
-    throw new Error("Project not found or access denied");
-  }
-  const { data: tasks, error } = await supabase.from("roadmap_chunks").select("id, title, priority, status, step_number, prompt_content").eq("project_id", projectId).neq("status", "COMPLETED").order("priority", { ascending: false }).order("step_number", { ascending: true });
+  const { data: tasks, error } = await supabase.rpc("get_roadmap_chunks_secure", {
+    p_project_id: projectId,
+    p_user_id: userId
+  });
   if (error) {
+    if (error.message.includes("Access Denied")) {
+      throw new Error("Project not found or access denied");
+    }
     console.error("Failed to fetch roadmap tasks:", error);
     throw new Error("Failed to fetch roadmap tasks");
   }
-  const formatted = (tasks || []).length > 0 ? (tasks || []).map((t) => {
+  const activeTasks = (tasks || []).filter((t) => t.status !== "COMPLETED").sort((a, b) => {
+    if (a.priority !== b.priority) {
+      const priorityOrder = { "CRITICAL": 3, "HIGH": 2, "MEDIUM": 1, "LOW": 0 };
+      return (priorityOrder[b.priority] || 0) - (priorityOrder[a.priority] || 0);
+    }
+    return a.step_number - b.step_number;
+  });
+  const formatted = activeTasks.length > 0 ? activeTasks.map((t) => {
     const statusEmoji = t.status === "ACTIVE" ? "\u{1F535}" : "\u{1F512}";
-    const priorityStr = t.priority ? `[${t.priority}]` : "";
     return `${statusEmoji} Step ${t.step_number}: ${t.title} (ID: ${t.id})`;
   }).join("\n") : "No active or locked tasks found in the roadmap.";
   return {
-    tasks: (tasks || []).map((t) => ({
+    tasks: activeTasks.map((t) => ({
       id: t.id,
       title: t.title,
       priority: t.priority,
@@ -2804,29 +2820,38 @@ Useful for transitioning between tasks.`,
   handler: async (args, context) => {
     const result = await getNextRoadmapStep(
       context.supabase,
+      context.userId,
       args.projectId,
       args.currentStepId
     );
     return { content: [{ type: "text", text: result.message }] };
   }
 });
-async function getNextRoadmapStep(supabase, projectId, currentStepId) {
+async function getNextRoadmapStep(supabase, userId, projectId, currentStepId) {
+  const { data: allTasks, error: fetchError } = await supabase.rpc("get_roadmap_chunks_secure", {
+    p_project_id: projectId,
+    p_user_id: userId
+  });
+  if (fetchError) {
+    throw new Error(`Failed to fetch roadmap data: ${fetchError.message}`);
+  }
+  const tasks = allTasks || [];
   let currentStepNumber = 0;
   if (currentStepId) {
-    const { data: current } = await supabase.from("roadmap_chunks").select("step_number").eq("id", currentStepId).single();
+    const current = tasks.find((t) => t.id === currentStepId);
     if (current) {
       currentStepNumber = current.step_number;
     }
   } else {
-    const { data: active } = await supabase.from("roadmap_chunks").select("step_number").eq("project_id", projectId).in("status", ["ACTIVE", "IN_PROGRESS"]).order("step_number", { ascending: true }).limit(1).single();
+    const active = tasks.filter((t) => ["ACTIVE", "IN_PROGRESS"].includes(t.status)).sort((a, b) => a.step_number - b.step_number)[0];
     if (active) {
-      currentStepNumber = active.step_number;
+      return {
+        nextStep: active,
+        message: `Current active step: [Step ${active.step_number}] ${active.title}`
+      };
     }
   }
-  const { data: nextStep, error } = await supabase.from("roadmap_chunks").select("*").eq("project_id", projectId).gt("step_number", currentStepNumber).neq("status", "COMPLETED").order("step_number", { ascending: true }).limit(1).single();
-  if (error && error.code !== "PGRST116") {
-    throw new Error(`Failed to fetch next roadmap step: ${error.message}`);
-  }
+  const nextStep = tasks.filter((t) => t.step_number > currentStepNumber && t.status !== "COMPLETED").sort((a, b) => a.step_number - b.step_number)[0];
   if (!nextStep) {
     return {
       nextStep: null,
@@ -3617,8 +3642,8 @@ registry.register({
 });
 async function saveToProjectBrain(supabase, userId, input) {
   const { projectId, title, content, category, tags } = input;
-  const { data: p, error: pErr } = await supabase.from("projects").select("id").eq("id", projectId).eq("owner_id", userId).single();
-  if (pErr || !p) throw new Error("Access denied");
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", { p_project_id: projectId, p_user_id: userId });
+  if (accessError || !hasAccess) throw new Error("Access denied");
   const fullContent = `# ${title}
 
 ${content}`;
@@ -3640,6 +3665,8 @@ ${content}`;
 }
 async function updateRoadmapStatus(supabase, userId, input) {
   const { projectId, chunkId, status } = input;
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", { p_project_id: projectId, p_user_id: userId });
+  if (accessError || !hasAccess) throw new Error("Access denied");
   const dbStatus = status === "TODO" ? "LOCKED" : status === "IN_PROGRESS" ? "ACTIVE" : "COMPLETED";
   const { error } = await supabase.from("roadmap_chunks").update({ status: dbStatus }).eq("id", chunkId).eq("project_id", projectId);
   if (error) throw new Error(`Update failed: ${error.message}`);
@@ -3653,6 +3680,8 @@ async function updateRoadmapStatus(supabase, userId, input) {
 }
 async function addRoadmapChunk(supabase, userId, input) {
   const { projectId, title, description, priority } = input;
+  const { data: hasAccess, error: accessError } = await supabase.rpc("check_project_access_secure", { p_project_id: projectId, p_user_id: userId });
+  if (accessError || !hasAccess) throw new Error("Access denied");
   const { data: maxStep } = await supabase.from("roadmap_chunks").select("step_number").eq("project_id", projectId).order("step_number", { ascending: false }).limit(1).single();
   const nextStepNum = (maxStep?.step_number || 0) + 1;
   const { data, error } = await supabase.from("roadmap_chunks").insert({