@taiga-ai/mcp-server 0.25.0-dev.463 → 0.25.0-dev.466

package/dist/index.js

@@ -670,6 +670,29 @@ const POLICY_TYPE_BY_CONTROL_PREFIX = {
 	SCS: "policy_supply_chain",
 	CLD: "policy_cloud_governance"
 };
+/** The policy document a control id belongs to, or undefined for an unknown prefix. */
+function policyTypeForControl(controlId) {
+	return POLICY_TYPE_BY_CONTROL_PREFIX[controlId.split("-")[0] ?? ""];
+}
+/**
+* The policy a control id points a reader to (PRO-2809): its rightmost base
+* prefix. An overlay family names its host policy last: TEL-TIC-1.1 is a
+* telecom control in policy_tic, HC-FI-DATA-1.1 a Finnish healthcare control in
+* policy_data, ARC-AWS-5 an AWS preset in policy_architecture. A regulatory
+* family with no base prefix (GDPR, NIS2, AIACT) spans several policies and
+* names none.
+*
+* For saying where to read a control, not for deciding who holds it:
+* {@link policyTypeForControl} keeps an overlay control with the document it is
+* written in, whatever its id says.
+*/
+function policyNamedByControl(controlId) {
+	const prefixes = controlId.split("-").filter((part) => /^[A-Z]/.test(part));
+	for (let at = prefixes.length - 1; at >= 0; at -= 1) {
+		const owner = POLICY_TYPE_BY_CONTROL_PREFIX[prefixes[at]];
+		if (owner) return owner;
+	}
+}
 /**
 * The shape of a control id in a policy's control table: `SEC-3.4`, and the
 * overlay families too (`TEL-TIC-1.1`, `HC-FI-DATA-1.1`, `GDPR-1.1`). One
@@ -2663,17 +2686,6 @@ const sectionsInput = z.array(z.string().min(1).max(200)).max(50).optional().des
 /** The sections input of a company document, where a policy control id also names the sections that state it. */
 const policySectionsInput = sectionsInput.describe("Only these sections, by id, or a policy control id (SEC-5.1) for the sections that state it; [] for the outline (under outline: every section id and its size, no text); omit for the whole document");
 /**
-* The policy that states a control: the rightmost policy prefix in its id, so an overlay family's
-* TEL-TIC-1.1 is policy_tic and HC-FI-DATA-1.1 policy_data, as the overlays file them.
-*/
-function policyOfControl(id) {
-	const prefixes = id.split("-").filter((part) => /^[A-Z]/.test(part));
-	for (const prefix of prefixes.reverse()) {
-		const policy = POLICY_TYPE_BY_CONTROL_PREFIX[prefix];
-		if (policy) return policy;
-	}
-}
-/**
 * The sections that state each control id asked for (PRO-2800): policy
 * standing cites SEC-5.1, and the section holding it has an id of its own
 * (secretsManagement) an agent could only guess. A control id is found in
@@ -2699,7 +2711,7 @@ function withControls(outline, sections, policyType) {
 	return outline.map((entry) => {
 		const text = sectionContent(sections, entry.id) ?? "";
 		const ids = [...new Set([...text.matchAll(pattern)].filter((match) => !/^_?Reserved_?/i.test(match[2] ?? "")).map((match) => match[1]).filter((id) => {
-			const owner = POLICY_TYPE_BY_CONTROL_PREFIX[id.split("-")[0] ?? ""];
+			const owner = policyTypeForControl(id);
 			return owner === void 0 || owner === policyType;
 		}))];
 		return ids.length > 0 ? {
@@ -2727,7 +2739,7 @@ function sectionReadResult(doc, asked, label, options = {}) {
 	const known = ids.filter((id) => all.includes(id));
 	const found = Object.keys(controls).length > 0 ? { controls } : {};
 	const asControl = options.controlIds ? void 0 : unknownSections.find((id) => isControlId(id));
-	const policy = asControl ? policyOfControl(asControl) : void 0;
+	const policy = asControl ? policyNamedByControl(asControl) : void 0;
 	const controlNote = asControl ? { note: policy ? `${asControl} is a control of ${policy}: read it with taiga_get_document (type: ${policy}, sections: ["${asControl}"]).` : `${asControl} looks like a policy control id, which only a policy resolves: taiga_get_document without type lists them.` } : {};
 	if (known.length === 0) {
 		const { data: _data, ...meta } = cut.doc;
@@ -4815,7 +4827,7 @@ function registerMaintenanceTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_findings", {
 		title: "List maintenance findings",
-		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (upstream_only: no fixed version), breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.",
+		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.",
 		inputSchema: z.object({
 			productId,
 			status: z.enum(MAINTENANCE_FINDING_STATUSES).optional().describe("Only findings in this status; omit for the ones needing action"),
@@ -4944,7 +4956,7 @@ function registerMaintenanceTools(server, client) {
 	}));
 	server.registerTool("taiga_fix_finding", {
 		title: "Fix a finding",
-		description: "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the group in one initiative: every open advisory on that package version in one bump, or every location the same rule flagged. Refused for a secret only in history, anything in a submodule, and remediableBy upstream_only.",
+		description: "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the group in one initiative: every open advisory on that package version in one bump, or every location the same rule flagged. Refused for a secret only in history, remediableBy upstream_only (code in a submodule), and a dependency with no fixed version yet (fixable: false).",
 		inputSchema: z.object({
 			productId,
 			findingId,
@@ -21059,7 +21071,8 @@ const GITHUB_REPOSITORY_FIELDS = [
 	"defaultBranch",
 	"description",
 	"language",
-	"linked"
+	"linked",
+	"linkedProduct"
 ];
 const repositoryId = idInput("repository link", "taiga_list_product_repositories gives it; a linkable repository id is not one");
 /** Round-robin over lists: the first of each, then the second of each, and so on. */
@@ -21075,7 +21088,8 @@ function interleave(lists) {
 */
 async function holderOf(client, error, productId) {
 	if (!(error instanceof TaigaApiError) || error.status !== 409) return null;
-	const name = /^(\S+\/\S+) is already linked to another product\.?$/.exec(error.apiMessage ?? "")?.[1];
+	if (error.details?.["holder"]) return null;
+	const name = /^(\S+\/\S+) is already linked to another product\./.exec(error.apiMessage ?? "")?.[1];
 	if (!name) return null;
 	try {
 		const holders = (await client.listProducts({
@@ -21137,7 +21151,7 @@ function registerRepositoryTools(server, client) {
 	}
 	if (client.hasCapability("vcs:read")) server.registerTool("taiga_list_linkable_repositories", {
 		title: "Find a repository to link",
-		description: "List the repositories the organization's GitHub connection can reach, to link one with taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or installationId) reads one account, else rows come from every account in turn. linked: true means a product already links it (taiga_get_product with its URL says which). No connection means GitHub is not connected yet; someone who can install the app does that once, in the web.",
+		description: "List the repositories the organization's GitHub connection can reach, to link one with taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or installationId) reads one account, else rows come from every account in turn. linked: true means a product already links it, and linkedProduct names it to a key that sees every product. No connection means GitHub is not connected yet; someone who can install the app does that once, in the web.",
 		inputSchema: z.object({
 			query: z.string().trim().min(1).max(256).optional().describe("Part of the repository name"),
 			account: z.string().trim().min(1).max(140).optional().describe("The GitHub account login (the owner in owner/repo), case-insensitive"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.25.0-dev.463",
+  "version": "0.25.0-dev.466",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",

package/src/server.integration.test.ts

@@ -8848,4 +8848,55 @@ describe('what the seventh agent review found (PRO-2800)', () => {
     expect(bundle.runs[0].hardeningNote).toMatch(/^Hardening ended with 2 blocking findings/);
     expect(bundle.runs[0]).not.toHaveProperty('hardeningResult');
   });
+
+  it('says what the API says when it names the product holding a repository', async () => {
+    const { client, fetchSpy } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        [`POST /v1/products/${PRODUCT_ID}/repositories`]: refusal(
+          409,
+          'CONFLICT',
+          'taiga-sandbox/import-test-chi is already linked to Orders. A repository belongs to one product; unlink it there first.',
+          { holder: { productId: PRODUCT_ID_2, name: 'Orders' } }
+        ),
+      },
+    });
+
+    const result = parseToolResult(
+      await client.callTool({
+        name: 'taiga_link_repository',
+        arguments: { productId: PRODUCT_ID, linkableRepositoryId: '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f07' },
+      })
+    );
+
+    expect(result.message).toMatch(/already linked to Orders\./);
+    expect(result.details.holder).toEqual({ productId: PRODUCT_ID_2, name: 'Orders' });
+    // No second lookup when the API named it.
+    expect(fetchSpy.mock.calls.some((call: unknown[]) => String(call[0]).includes('/v1/products?'))).toBe(false);
+  });
+
+  it('passes on the product holding a linked repository when the API names it', async () => {
+    const INSTALL = '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f0b';
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        'GET /v1/github/installations': { data: [{ id: INSTALL, accountLogin: 'acme' }], nextCursor: null },
+        [`/v1/github/installations/${INSTALL}/repositories`]: {
+          data: [
+            {
+              id: '0199a1b2-c3d4-7e5f-8a9b-0c1d2e3f4f0c',
+              fullName: 'acme/web',
+              linked: true,
+              linkedProduct: { id: PRODUCT_ID_2, name: 'Orders' },
+            },
+          ],
+          nextCursor: null,
+        },
+      },
+    });
+
+    const result = parseToolResult(await client.callTool({ name: 'taiga_list_linkable_repositories', arguments: {} }));
+
+    expect(result.repositories.data[0].linkedProduct).toEqual({ id: PRODUCT_ID_2, name: 'Orders' });
+  });
 });

package/src/tools/maintenance.ts

@@ -209,8 +209,10 @@ export function registerMaintenanceTools(server: McpServer, client: TaigaClient)
         "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code " +
         '(sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or ' +
         'failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: ' +
-        'likely and serious; elevated: one of the two; routine), location, remediableBy (upstream_only: no fixed ' +
-        'version), breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.',
+        'likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here ' +
+        'can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false ' +
+        'when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status ' +
+        'for open findings. taiga_get_finding reads one.',
       inputSchema: z.object({
         productId,
         status: z
@@ -462,8 +464,8 @@ export function registerMaintenanceTools(server: McpServer, client: TaigaClient)
         "Raise an initiative that fixes a maintenance finding, at the end of the product's line; it ends in a " +
         "pull request a person merges, and the initiative's review gate applies. wholeGroup: true fixes the " +
         'group in one initiative: every open advisory on that package version in one bump, or every location the ' +
-        'same rule flagged. Refused for a secret only in history, anything in a submodule, and remediableBy ' +
-        'upstream_only.',
+        'same rule flagged. Refused for a secret only in history, remediableBy upstream_only (code in a ' +
+        'submodule), and a dependency with no fixed version yet (fixable: false).',
       inputSchema: z.object({
         productId,
         findingId,

package/src/tools/repositories.ts

@@ -49,6 +49,8 @@ const GITHUB_REPOSITORY_FIELDS = [
   'language',
   // A product already links it (PRO-2800); absent from an API that predates the field.
   'linked',
+  // Which product holds it, to a key that sees every product (PRO-2822).
+  'linkedProduct',
 ] as const;
 
 const repositoryId = idInput(
@@ -72,7 +74,10 @@ export function interleave<T>(lists: T[][]): T[] {
  */
 async function holderOf(client: TaigaClient, error: unknown, productId: string) {
   if (!(error instanceof TaigaApiError) || error.status !== 409) return null;
-  const name = /^(\S+\/\S+) is already linked to another product\.?$/.exec(error.apiMessage ?? '')?.[1];
+  // An API that names the holder (PRO-2807) says it itself; an older one, or a key that cannot see every product,
+  // says "another product", and this lists the ones the key can see.
+  if (error.details?.['holder']) return null;
+  const name = /^(\S+\/\S+) is already linked to another product\./.exec(error.apiMessage ?? '')?.[1];
   if (!name) return null;
   try {
     // The refusal names the repository only, not its host, and the same name can live on github.com and on an
@@ -162,7 +167,7 @@ export function registerRepositoryTools(server: McpServer, client: TaigaClient)
           "List the repositories the organization's GitHub connection can reach, to link one with " +
           "taiga_link_repository (it takes the row's id as linkableRepositoryId). query searches by name; account (login, owner, or " +
           'installationId) reads one account, else rows come from every account in turn. linked: true means a ' +
-          'product already links it (taiga_get_product with its URL says which). No connection means GitHub is not ' +
+          'product already links it, and linkedProduct names it to a key that sees every product. No connection means GitHub is not ' +
           'connected yet; someone who can install the app does that once, in the web.',
         inputSchema: z.object({
           query: z.string().trim().min(1).max(256).optional().describe('Part of the repository name'),

package/src/tools/sections.ts

@@ -13,7 +13,7 @@
 
 import type { CallToolResult } from '@modelcontextprotocol/server';
 import { z } from 'zod';
-import { CONTROL_ID_SOURCE, isControlId, POLICY_TYPE_BY_CONTROL_PREFIX } from '@taiga/types';
+import { CONTROL_ID_SOURCE, isControlId, policyNamedByControl, policyTypeForControl } from '@taiga/types';
 import { toolError, toolResult } from './errors.js';
 
 /** A document's section map, keyed by section id: each value a `StoredSection` or (older rows) a bare string. */
@@ -177,19 +177,6 @@ export const policySectionsInput = sectionsInput.describe(
   'Only these sections, by id, or a policy control id (SEC-5.1) for the sections that state it; [] for the outline (under outline: every section id and its size, no text); omit for the whole document'
 );
 
-/**
- * The policy that states a control: the rightmost policy prefix in its id, so an overlay family's
- * TEL-TIC-1.1 is policy_tic and HC-FI-DATA-1.1 policy_data, as the overlays file them.
- */
-function policyOfControl(id: string): string | undefined {
-  const prefixes = id.split('-').filter((part) => /^[A-Z]/.test(part));
-  for (const prefix of prefixes.reverse()) {
-    const policy = POLICY_TYPE_BY_CONTROL_PREFIX[prefix];
-    if (policy) return policy;
-  }
-  return undefined;
-}
-
 /**
  * The sections that state each control id asked for (PRO-2800): policy
  * standing cites SEC-5.1, and the section holding it has an id of its own
@@ -231,7 +218,7 @@ function withControls(outline: { id: string; characters: number }[], sections: S
           // A base control belongs to the policy its prefix names: an SEC row in the data policy is a stale mention,
           // as heldControlMap reads it. An overlay prefix stays where it is written.
           .filter((id) => {
-            const owner = POLICY_TYPE_BY_CONTROL_PREFIX[id.split('-')[0] ?? ''];
+            const owner = policyTypeForControl(id);
             return owner === undefined || owner === policyType;
           })
       ),
@@ -267,7 +254,7 @@ export function sectionReadResult(
   const found = Object.keys(controls).length > 0 ? { controls } : {};
   // A control id asked of a document that does not state controls: name the policy that does.
   const asControl = options.controlIds ? undefined : unknownSections.find((id) => isControlId(id));
-  const policy = asControl ? policyOfControl(asControl) : undefined;
+  const policy = asControl ? policyNamedByControl(asControl) : undefined;
   const controlNote = asControl
     ? {
         note: policy