@taiga-ai/mcp-server 0.25.0-dev.468 → 0.25.0-dev.470

package/dist/index.js

@@ -3741,6 +3741,22 @@ function runOutcome(run) {
 	};
 }
 /**
+* What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
+* it recorded them, how many.
+*/
+function hardeningSaid(blocking, named) {
+	const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix`;
+	if (named.length === 0) return `${count}; the run records how many, not which.`;
+	const shown = named.slice(0, 3).map((finding) => {
+		const message = String(finding["message"]);
+		const where = finding["line"] ? `${String(finding["path"])}:${String(finding["line"])}` : String(finding["path"]);
+		return `${message} (${String(finding["tool"])}, ${where})`;
+	});
+	const rest = blocking - shown.length;
+	const recorded = named.length > shown.length ? `, ${named.length} recorded in taiga_get_run` : "";
+	return `${count}: ${shown.join("; ")}${rest > 0 ? `; and ${rest} more${recorded}` : ""}.`;
+}
+/**
 * What each failedReason means for the next move (PRO-2800): reviewers met dispatch_rejected and agent_reported as
 * bare enums. As @taiga/types documents them.
 */
@@ -3765,10 +3781,11 @@ function readableRun(run, opts = {}) {
 	const means = FAILED_REASON_MEANS[String(run["failedReason"])];
 	const hardening = run["hardeningResult"];
 	const blocking = typeof hardening?.blockingFindings === "number" ? hardening.blockingFindings : 0;
+	const named = Array.isArray(hardening?.blocking) ? hardening.blocking : [];
 	return {
 		...rest,
 		...means ? { failedReasonMeans: means } : {},
-		...blocking > 0 ? { hardeningNote: `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix; the run records how many, not which.` } : {},
+		...blocking > 0 ? { hardeningNote: hardeningSaid(blocking, named) } : {},
 		...opts.row || error === void 0 ? {} : { error },
 		...opts.row || reviewEscalation === void 0 ? {} : { reviewEscalation },
 		...typeof rest["prNumber"] === "number" || rest["prUrl"] ? { prDraft } : {},
@@ -5227,7 +5244,8 @@ const SETUP_TASK_FIELDS = [
 	"providerActionUrl",
 	"inboxItemId",
 	"inboxItemStatus",
-	"createdAt"
+	"createdAt",
+	"stale"
 ];
 /** The API's count across every page, on the first page; nothing from an API that does not send one. */
 function totalOf(result) {
@@ -5267,7 +5285,10 @@ function sameKeyOnce(rows) {
 			const { alsoFiledAs: _also, ...was } = kept;
 			for (const field of Object.keys(kept)) delete kept[field];
 			Object.assign(kept, row, { alsoFiledAs: [...also, record(was)] });
-		} else kept["alsoFiledAs"] = [...also, record(row)];
+		} else {
+			kept["alsoFiledAs"] = [...also, record(row)];
+			if (isOpen(row) && row["stale"] === void 0) delete kept["stale"];
+		}
 	}
 	return out;
 }
@@ -5342,7 +5363,7 @@ function registerInboxTools(server, client) {
 	}));
 	server.registerTool("taiga_list_setup_tasks", {
 		title: "List setup tasks",
-		description: "List what a person must set up for a product (secrets, variables, accounts), with exactly what and where: key (the name to create; Taiga never stores values), the provider page, and phase: prereq (the deploy fails without it), wiring (generated values back to providers) or followup (can wait until after launch). Runs do not wait for them. One product or all, oldest first; includeDone: true adds done and dismissed. A variable filed twice lists the others under alsoFiledAs; totalCount counts records, and a page that folded some says recordsOnPage. Unlike taiga_list_action_required, which lists the same work as items to resolve.",
+		description: "List what a person must set up for a product (secrets, variables, accounts), with exactly what and where: key (the name to create; Taiga never stores values), the provider page, and phase: prereq (the deploy fails without it), wiring (generated values back to providers) or followup (can wait until after launch). Runs do not wait for them. One product or all, oldest first; includeDone: true adds done and dismissed. A variable filed twice lists the others under alsoFiledAs; totalCount counts records, and a page that folded some says recordsOnPage. stale on an open task says no document derived from the code since it was raised mentions its key: it may not apply any more, so check before asking anyone to set it. Unlike taiga_list_action_required, which lists the same work as items to resolve.",
 		inputSchema: z.object({
 			productId: productId.optional(),
 			includeDone: z.boolean().optional().describe("Also the tasks already done or dismissed (default false)"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.25.0-dev.468",
+  "version": "0.25.0-dev.470",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",

package/src/server.integration.test.ts

@@ -6856,6 +6856,52 @@ describe('what the second agent review found (PRO-2778, PRO-2780)', () => {
     expect(sentUrl(fetchSpy, '/v1/inbox').searchParams.has('withTotal')).toBe(false);
   });
 
+  it("passes on a setup task's stale note (PRO-2819)", async () => {
+    const stale = "None of the current code's documents, derived since this task was raised, mention JWT_SECRET.";
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        'GET /v1/setup-tasks': {
+          data: [
+            {
+              id: ENV_ID,
+              productId: ENV_ID,
+              key: 'JWT_SECRET',
+              inboxItemStatus: 'open',
+              title: 'Set JWT_SECRET',
+              stale,
+            },
+          ],
+          nextCursor: null,
+        },
+      },
+    });
+
+    const tasks = parseToolResult(await client.callTool({ name: 'taiga_list_setup_tasks', arguments: {} }));
+    expect(tasks.data[0].stale).toBe(stale);
+  });
+
+  it('drops the stale note from a folded variable when one open record of it is live (PRO-2819)', async () => {
+    const stale = "None of the current code's documents, derived since this task was raised, mention JWT_SECRET.";
+    const record = { productId: ENV_ID, key: 'JWT_SECRET', inboxItemStatus: 'open' };
+    const { client } = await bootMcpPair({
+      capabilities: ALL_CAPABILITIES,
+      routes: {
+        'GET /v1/setup-tasks': {
+          data: [
+            { ...record, id: 'old', category: 'secret', title: 'Set JWT_SECRET', stale },
+            { ...record, id: 'new', category: 'env_var', title: 'Set JWT_SECRET' },
+          ],
+          nextCursor: null,
+        },
+      },
+    });
+
+    const tasks = parseToolResult(await client.callTool({ name: 'taiga_list_setup_tasks', arguments: {} }));
+    expect(tasks.data).toHaveLength(1);
+    expect(tasks.data[0].stale).toBeUndefined();
+  });
+
   it('carries who cancelled a failed plan and when, and leaves the item as it was when the history is refused', async () => {
     const failed = { id: ITEM_ID, title: 'Login', planningStatus: 'failed', planFailureCause: 'cancelled' };
     const history = {
@@ -8904,6 +8950,78 @@ describe('what the seventh agent review found (PRO-2800)', () => {
     expect(bundle.runs[0]).not.toHaveProperty('hardeningResult');
   });
 
+  it('names the blocking hardening findings a run recorded', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: {
+        [`/v1/builds/${BUILD_ID}/steps`]: { data: [] },
+        [`/v1/builds/${BUILD_ID}`]: {
+          data: {
+            id: BUILD_ID,
+            productId: PRODUCT_ID,
+            status: 'needs_review',
+            prNumber: 4,
+            hardeningResult: {
+              passed: false,
+              scanners: {},
+              blockingFindings: 1,
+              blocking: [
+                {
+                  tool: 'betterleaks',
+                  severity: 'critical',
+                  path: 'src/config.rs',
+                  line: 12,
+                  message: 'generic-api-key: Hardcoded API key',
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+
+    const run = parseToolResult(await client.callTool({ name: 'taiga_get_run', arguments: { runId: BUILD_ID } }));
+
+    expect(run.hardeningNote).toBe(
+      'Hardening ended with 1 blocking finding it could not fix: generic-api-key: Hardcoded API key (betterleaks, src/config.rs:12).'
+    );
+  });
+
+  it('always says where a blocking finding is, even when its title names the path', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: {
+        [`/v1/builds/${BUILD_ID}/steps`]: { data: [] },
+        [`/v1/builds/${BUILD_ID}`]: {
+          data: {
+            id: BUILD_ID,
+            productId: PRODUCT_ID,
+            status: 'needs_review',
+            hardeningResult: {
+              passed: false,
+              blockingFindings: 1,
+              blocking: [
+                {
+                  tool: 'betterleaks',
+                  severity: 'critical',
+                  path: 'src/config.rs',
+                  line: 12,
+                  message: 'aws-key: AWS key in src/config.rs',
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+
+    const run = parseToolResult(await client.callTool({ name: 'taiga_get_run', arguments: { runId: BUILD_ID } }));
+
+    expect(run.hardeningNote).toBe(
+      'Hardening ended with 1 blocking finding it could not fix: aws-key: AWS key in src/config.rs (betterleaks, src/config.rs:12).'
+    );
+  });
+
   it('says what the API says when it names the product holding a repository', async () => {
     const { client, fetchSpy } = await bootMcpPair({
       capabilities: ALL_CAPABILITIES,

package/src/tools/builds.ts

@@ -222,6 +222,24 @@ export function runOutcome(run: Record<string, unknown>): { disposition: string;
   return { disposition, outcome: sentence[disposition] ?? status };
 }
 
+/**
+ * What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
+ * it recorded them, how many.
+ */
+function hardeningSaid(blocking: number, named: Record<string, unknown>[]): string {
+  const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? '' : 's'} it could not fix`;
+  if (named.length === 0) return `${count}; the run records how many, not which.`;
+  const shown = named.slice(0, 3).map((finding) => {
+    const message = String(finding['message']);
+    const where = finding['line'] ? `${String(finding['path'])}:${String(finding['line'])}` : String(finding['path']);
+    // Always where it is, though a scanner's title may repeat the path: a substring test would drop a real one.
+    return `${message} (${String(finding['tool'])}, ${where})`;
+  });
+  const rest = blocking - shown.length;
+  const recorded = named.length > shown.length ? `, ${named.length} recorded in taiga_get_run` : '';
+  return `${count}: ${shown.join('; ')}${rest > 0 ? `; and ${rest} more${recorded}` : ''}.`;
+}
+
 /**
  * What each failedReason means for the next move (PRO-2800): reviewers met dispatch_rejected and agent_reported as
  * bare enums. As @taiga/types documents them.
@@ -247,14 +265,15 @@ export function readableRun(run: Record<string, unknown>, opts: { row?: boolean
   const { prDraft, error, reviewEscalation, runtime: _runtime, ...rest } = run;
   const said = runOutcome(run);
   const means = FAILED_REASON_MEANS[String(run['failedReason'])];
-  const hardening = run['hardeningResult'] as { blockingFindings?: unknown } | null | undefined;
+  const hardening = run['hardeningResult'] as { blockingFindings?: unknown; blocking?: unknown } | null | undefined;
   const blocking = typeof hardening?.blockingFindings === 'number' ? hardening.blockingFindings : 0;
+  const named = Array.isArray(hardening?.blocking) ? (hardening.blocking as Record<string, unknown>[]) : [];
   return {
     ...rest,
     ...(means ? { failedReasonMeans: means } : {}),
     ...(blocking > 0
       ? {
-          hardeningNote: `Hardening ended with ${blocking} blocking finding${blocking === 1 ? '' : 's'} it could not fix; the run records how many, not which.`,
+          hardeningNote: hardeningSaid(blocking, named),
         }
       : {}),
     // A row's outcome says the error and the handback; the full read keeps them whole.

package/src/tools/inbox.ts

@@ -306,6 +306,7 @@ const SETUP_TASK_FIELDS = [
   'inboxItemId',
   'inboxItemStatus',
   'createdAt',
+  'stale',
 ] as const;
 
 /** The API's count across every page, on the first page; nothing from an API that does not send one. */
@@ -350,6 +351,9 @@ export function sameKeyOnce(rows: Row[]): Row[] {
       Object.assign(kept, row, { alsoFiledAs: [...also, record(was)] });
     } else {
       kept['alsoFiledAs'] = [...also, record(row)];
+      // Stale only while every open record is (PRO-2819): one raised after the code's documents were derived
+      // is a live ask, whichever record leads.
+      if (isOpen(row) && row['stale'] === undefined) delete kept['stale'];
     }
   }
   return out;
@@ -471,7 +475,9 @@ export function registerInboxTools(server: McpServer, client: TaigaClient) {
         'deploy fails without it), wiring (generated values back to providers) or followup (can wait until after ' +
         'launch). Runs do not wait for them. One product or all, oldest first; includeDone: true adds done and ' +
         'dismissed. A variable filed twice lists the others under alsoFiledAs; totalCount counts records, and a ' +
-        'page that folded some says recordsOnPage. Unlike ' +
+        'page that folded some says recordsOnPage. stale on an open task says no document derived from the code ' +
+        'since it was raised mentions its key: it may not apply any more, so check before asking anyone to set ' +
+        'it. Unlike ' +
         'taiga_list_action_required, which lists the same work as items to resolve.',
       inputSchema: z.object({
         productId: productId.optional(),