@taiga-ai/mcp-server 0.25.0-dev.469 → 0.25.0-dev.470

package/dist/index.js

@@ -3741,6 +3741,22 @@ function runOutcome(run) {
 	};
 }
 /**
+* What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
+* it recorded them, how many.
+*/
+function hardeningSaid(blocking, named) {
+	const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix`;
+	if (named.length === 0) return `${count}; the run records how many, not which.`;
+	const shown = named.slice(0, 3).map((finding) => {
+		const message = String(finding["message"]);
+		const where = finding["line"] ? `${String(finding["path"])}:${String(finding["line"])}` : String(finding["path"]);
+		return `${message} (${String(finding["tool"])}, ${where})`;
+	});
+	const rest = blocking - shown.length;
+	const recorded = named.length > shown.length ? `, ${named.length} recorded in taiga_get_run` : "";
+	return `${count}: ${shown.join("; ")}${rest > 0 ? `; and ${rest} more${recorded}` : ""}.`;
+}
+/**
 * What each failedReason means for the next move (PRO-2800): reviewers met dispatch_rejected and agent_reported as
 * bare enums. As @taiga/types documents them.
 */
@@ -3765,10 +3781,11 @@ function readableRun(run, opts = {}) {
 	const means = FAILED_REASON_MEANS[String(run["failedReason"])];
 	const hardening = run["hardeningResult"];
 	const blocking = typeof hardening?.blockingFindings === "number" ? hardening.blockingFindings : 0;
+	const named = Array.isArray(hardening?.blocking) ? hardening.blocking : [];
 	return {
 		...rest,
 		...means ? { failedReasonMeans: means } : {},
-		...blocking > 0 ? { hardeningNote: `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix; the run records how many, not which.` } : {},
+		...blocking > 0 ? { hardeningNote: hardeningSaid(blocking, named) } : {},
 		...opts.row || error === void 0 ? {} : { error },
 		...opts.row || reviewEscalation === void 0 ? {} : { reviewEscalation },
 		...typeof rest["prNumber"] === "number" || rest["prUrl"] ? { prDraft } : {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.25.0-dev.469",
+  "version": "0.25.0-dev.470",
   "description": "MCP server for Taiga -- gives AI assistants access to documents and products",
   "type": "module",
   "main": "./dist/index.js",

package/src/server.integration.test.ts

@@ -8950,6 +8950,78 @@ describe('what the seventh agent review found (PRO-2800)', () => {
     expect(bundle.runs[0]).not.toHaveProperty('hardeningResult');
   });
 
+  it('names the blocking hardening findings a run recorded', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: {
+        [`/v1/builds/${BUILD_ID}/steps`]: { data: [] },
+        [`/v1/builds/${BUILD_ID}`]: {
+          data: {
+            id: BUILD_ID,
+            productId: PRODUCT_ID,
+            status: 'needs_review',
+            prNumber: 4,
+            hardeningResult: {
+              passed: false,
+              scanners: {},
+              blockingFindings: 1,
+              blocking: [
+                {
+                  tool: 'betterleaks',
+                  severity: 'critical',
+                  path: 'src/config.rs',
+                  line: 12,
+                  message: 'generic-api-key: Hardcoded API key',
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+
+    const run = parseToolResult(await client.callTool({ name: 'taiga_get_run', arguments: { runId: BUILD_ID } }));
+
+    expect(run.hardeningNote).toBe(
+      'Hardening ended with 1 blocking finding it could not fix: generic-api-key: Hardcoded API key (betterleaks, src/config.rs:12).'
+    );
+  });
+
+  it('always says where a blocking finding is, even when its title names the path', async () => {
+    const { client } = await bootMcpPair({
+      capabilities: ['products:read'],
+      routes: {
+        [`/v1/builds/${BUILD_ID}/steps`]: { data: [] },
+        [`/v1/builds/${BUILD_ID}`]: {
+          data: {
+            id: BUILD_ID,
+            productId: PRODUCT_ID,
+            status: 'needs_review',
+            hardeningResult: {
+              passed: false,
+              blockingFindings: 1,
+              blocking: [
+                {
+                  tool: 'betterleaks',
+                  severity: 'critical',
+                  path: 'src/config.rs',
+                  line: 12,
+                  message: 'aws-key: AWS key in src/config.rs',
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+
+    const run = parseToolResult(await client.callTool({ name: 'taiga_get_run', arguments: { runId: BUILD_ID } }));
+
+    expect(run.hardeningNote).toBe(
+      'Hardening ended with 1 blocking finding it could not fix: aws-key: AWS key in src/config.rs (betterleaks, src/config.rs:12).'
+    );
+  });
+
   it('says what the API says when it names the product holding a repository', async () => {
     const { client, fetchSpy } = await bootMcpPair({
       capabilities: ALL_CAPABILITIES,

package/src/tools/builds.ts

@@ -222,6 +222,24 @@ export function runOutcome(run: Record<string, unknown>): { disposition: string;
   return { disposition, outcome: sentence[disposition] ?? status };
 }
 
+/**
+ * What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
+ * it recorded them, how many.
+ */
+function hardeningSaid(blocking: number, named: Record<string, unknown>[]): string {
+  const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? '' : 's'} it could not fix`;
+  if (named.length === 0) return `${count}; the run records how many, not which.`;
+  const shown = named.slice(0, 3).map((finding) => {
+    const message = String(finding['message']);
+    const where = finding['line'] ? `${String(finding['path'])}:${String(finding['line'])}` : String(finding['path']);
+    // Always where it is, though a scanner's title may repeat the path: a substring test would drop a real one.
+    return `${message} (${String(finding['tool'])}, ${where})`;
+  });
+  const rest = blocking - shown.length;
+  const recorded = named.length > shown.length ? `, ${named.length} recorded in taiga_get_run` : '';
+  return `${count}: ${shown.join('; ')}${rest > 0 ? `; and ${rest} more${recorded}` : ''}.`;
+}
+
 /**
  * What each failedReason means for the next move (PRO-2800): reviewers met dispatch_rejected and agent_reported as
  * bare enums. As @taiga/types documents them.
@@ -247,14 +265,15 @@ export function readableRun(run: Record<string, unknown>, opts: { row?: boolean
   const { prDraft, error, reviewEscalation, runtime: _runtime, ...rest } = run;
   const said = runOutcome(run);
   const means = FAILED_REASON_MEANS[String(run['failedReason'])];
-  const hardening = run['hardeningResult'] as { blockingFindings?: unknown } | null | undefined;
+  const hardening = run['hardeningResult'] as { blockingFindings?: unknown; blocking?: unknown } | null | undefined;
   const blocking = typeof hardening?.blockingFindings === 'number' ? hardening.blockingFindings : 0;
+  const named = Array.isArray(hardening?.blocking) ? (hardening.blocking as Record<string, unknown>[]) : [];
   return {
     ...rest,
     ...(means ? { failedReasonMeans: means } : {}),
     ...(blocking > 0
       ? {
-          hardeningNote: `Hardening ended with ${blocking} blocking finding${blocking === 1 ? '' : 's'} it could not fix; the run records how many, not which.`,
+          hardeningNote: hardeningSaid(blocking, named),
         }
       : {}),
     // A row's outcome says the error and the handback; the full read keeps them whole.