@taiga-ai/mcp-server 0.25.0-dev.463 → 0.25.0-dev.465

package/dist/index.js

@@ -4815,7 +4815,7 @@ function registerMaintenanceTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_findings", {
 		title: "List maintenance findings",
-		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (upstream_only: no fixed version), breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.",
+		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.",
 		inputSchema: z.object({
 			productId,
 			status: z.enum(MAINTENANCE_FINDING_STATUSES).optional().describe("Only findings in this status; omit for the ones needing action"),
@@ -4944,7 +4944,7 @@ function registerMaintenanceTools(server, client) {
 	}));
 	server.registerTool("taiga_fix_finding", {
 		title: "Fix a finding",
-		description: "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the group in one initiative: every open advisory on that package version in one bump, or every location the same rule flagged. Refused for a secret only in history, anything in a submodule, and remediableBy upstream_only.",
+		description: "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the group in one initiative: every open advisory on that package version in one bump, or every location the same rule flagged. Refused for a secret only in history, remediableBy upstream_only (code in a submodule), and a dependency with no fixed version yet (fixable: false).",
 		inputSchema: z.object({
 			productId,
 			findingId,
@@ -21059,7 +21059,8 @@ const GITHUB_REPOSITORY_FIELDS = [
 	"defaultBranch",
 	"description",
 	"language",
-	"linked"
+	"linked",
+	"linkedProduct"
 ];
 const repositoryId = idInput("repository link", "taiga_list_product_repositories gives it; a linkable repository id is not one");
 /** Round-robin over lists: the first of each, then the second of each, and so on. */
@@ -21075,7 +21076,8 @@ function interleave(lists) {
 */
 async function holderOf(client, error, productId) {
 	if (!(error instanceof TaigaApiError) || error.status !== 409) return null;
-	const name = /^(\S+\/\S+) is already linked to another product\.?$/.exec(error.apiMessage ?? "")?.[1];
+	if (error.details?.["holder"]) return null;
+	const name = /^(\S+\/\S+) is already linked to another product\./.exec(error.apiMessage ?? "")?.[1];
 	if (!name) return null;
 	try {
 		const holders = (await client.listProducts({
@@ -21137,7 +21139,7 @@ function registerRepositoryTools(server, client) {
 	}
 	if (client.hasCapability("vcs:read")) server.registerTool("taiga_list_linkable_repositories", {
 		title: "Find a repository to link",
-		description: "List the repositories the organization's GitHub connection can reach, to link one with taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or installationId) reads one account, else rows come from every account in turn. linked: true means a product already links it (taiga_get_product with its URL says which). No connection means GitHub is not connected yet; someone who can install the app does that once, in the web.",
+		description: "List the repositories the organization's GitHub connection can reach, to link one with taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or installationId) reads one account, else rows come from every account in turn. linked: true means a product already links it, and linkedProduct names it to a key that sees every product. No connection means GitHub is not connected yet; someone who can install the app does that once, in the web.",
 		inputSchema: z.object({
 			query: z.string().trim().min(1).max(256).optional().describe("Part of the repository name"),
 			account: z.string().trim().min(1).max(140).optional().describe("The GitHub account login (the owner in owner/repo), case-insensitive"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.25.0-dev.463",
+  "version": "0.25.0-dev.465",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",

package/src/server.integration.test.ts

@@ -8848,4 +8848,55 @@ describe('what the seventh agent review found (PRO-2800)', () => {
     expect(bundle.runs[0].hardeningNote).toMatch(/^Hardening ended with 2 blocking findings/);
     expect(bundle.runs[0]).not.toHaveProperty('hardeningResult');
   });
+
+  it('says what the API says when it names the product holding a repository', async () => {
+    const { client, fetchSpy } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`POST /v1/products/${PRODUCT_ID}/repositories`]: refusal(
+          409,
+          'CONFLICT',
+          'taiga-sandbox/import-test-chi is already linked to Orders. A repository belongs to one product; unlink it there first.',
+          { holder: { productId: PRODUCT_ID_2, name: 'Orders' } }
+        ),
+      },
+    });
+
+    const result = parseToolResult(
+      await client.callTool({
+        name: 'taiga_link_repository',
+        arguments: { productId: PRODUCT_ID, linkableRepositoryId: '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f07' },
+      })
+    );
+
+    expect(result.message).toMatch(/already linked to Orders\./);
+    expect(result.details.holder).toEqual({ productId: PRODUCT_ID_2, name: 'Orders' });
+    // No second lookup when the API named it.
+    expect(fetchSpy.mock.calls.some((call: unknown[]) => String(call[0]).includes('/v1/products?'))).toBe(false);
+  });
+
+  it('passes on the product holding a linked repository when the API names it', async () => {
+    const INSTALL = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f0b';
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        'GET /v1/github/installations': { data: [{ id: INSTALL, accountLogin: 'acme' }], nextCursor: null },
+        [`/v1/github/installations/${INSTALL}/repositories`]: {
+          data: [
+            {
+              id: '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f0c',
+              fullName: 'acme/web',
+              linked: true,
+              linkedProduct: { id: PRODUCT_ID_2, name: 'Orders' },
+            },
+          ],
+          nextCursor: null,
+        },
+      },
+    });
+
+    const result = parseToolResult(await client.callTool({ name: 'taiga_list_linkable_repositories', arguments: {} }));
+
+    expect(result.repositories.data[0].linkedProduct).toEqual({ id: PRODUCT_ID_2, name: 'Orders' });
+  });
 });

package/src/tools/maintenance.ts

@@ -209,8 +209,10 @@ export function registerMaintenanceTools(server: McpServer, client: TaigaClient)
         "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code " +
         '(sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or ' +
         'failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: ' +
-        'likely and serious; elevated: one of the two; routine), location, remediableBy (upstream_only: no fixed ' +
-        'version), breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.',
+        'likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here ' +
+        'can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false ' +
+        'when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status ' +
+        'for open findings. taiga_get_finding reads one.',
       inputSchema: z.object({
         productId,
         status: z
@@ -462,8 +464,8 @@ export function registerMaintenanceTools(server: McpServer, client: TaigaClient)
         "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a " +
         "pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the " +
         'group in one initiative: every open advisory on that package version in one bump, or every location the ' +
-        'same rule flagged. Refused for a secret only in history, anything in a submodule, and remediableBy ' +
-        'upstream_only.',
+        'same rule flagged. Refused for a secret only in history, remediableBy upstream_only (code in a ' +
+        'submodule), and a dependency with no fixed version yet (fixable: false).',
       inputSchema: z.object({
         productId,
         findingId,

package/src/tools/repositories.ts

@@ -49,6 +49,8 @@ const GITHUB_REPOSITORY_FIELDS = [
   'language',
   // A product already links it (PRO-2800); absent from an API that predates the field.
   'linked',
+  // Which product holds it, to a key that sees every product (PRO-2822).
+  'linkedProduct',
 ] as const;
 
 const repositoryId = idInput(
@@ -72,7 +74,10 @@ export function interleave<T>(lists: T[][]): T[] {
  */
 async function holderOf(client: TaigaClient, error: unknown, productId: string) {
   if (!(error instanceof TaigaApiError) || error.status !== 409) return null;
-  const name = /^(\S+\/\S+) is already linked to another product\.?$/.exec(error.apiMessage ?? '')?.[1];
+  // An API that names the holder (PRO-2807) says it itself; an older one, or a key that cannot see every product,
+  // says "another product", and this lists the ones the key can see.
+  if (error.details?.['holder']) return null;
+  const name = /^(\S+\/\S+) is already linked to another product\./.exec(error.apiMessage ?? '')?.[1];
   if (!name) return null;
   try {
     // The refusal names the repository only, not its host, and the same name can live on github.com and on an
@@ -162,7 +167,7 @@ export function registerRepositoryTools(server: McpServer, client: TaigaClient)
           "List the repositories the organization's GitHub connection can reach, to link one with " +
           "taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or " +
           'installationId) reads one account, else rows come from every account in turn. linked: true means a ' +
-          'product already links it (taiga_get_product with its URL says which). No connection means GitHub is not ' +
+          'product already links it, and linkedProduct names it to a key that sees every product. No connection means GitHub is not ' +
           'connected yet; someone who can install the app does that once, in the web.',
         inputSchema: z.object({
           query: z.string().trim().min(1).max(256).optional().describe('Part of the repository name'),