@taiga-ai/mcp-server 0.26.0-dev.486 → 0.26.0-dev.487

package/dist/index.js

@@ -1385,6 +1385,49 @@ z.object({
 	...e.failingChecks === void 0 ? {} : { failingChecks: e.failingChecks },
 	...e.blockers === void 0 ? {} : { blockers: e.blockers }
 }));
+/**
+* What a run's hardening came to, coverage included (PRO-2829). `passed`
+* counted only blocking findings, so a run whose scanners never ran said
+* "passed" all the same.
+*
+* - `failed`: blocking findings remain (the gaps are still listed).
+* - `not_scanned`: no scanner that applies to the repository ran to the end.
+* - `passed_with_gaps`: nothing blocks, but some scanner did not run.
+* - `passed`: nothing blocks and every scanner that applies ran.
+*/
+const HARDENING_VERDICTS = [
+	"passed",
+	"passed_with_gaps",
+	"not_scanned",
+	"failed"
+];
+/**
+* The verdict and the gaps of a hardening result (PRO-2829), for every reader
+* (the run read, the web's run page, the MCP), from what the agent reported.
+*
+* A gap is a scanner that applies and did not run: `not_run` (the scan never
+* reached it), `skipped` (its tool was missing), or `failed` with a reason,
+* which is a scanner that could not finish. A `failed` scanner without one
+* found something (tflint fails on a MAJOR that blocks nothing, and rows from
+* before `scannerReasons` used `failed` for "had findings"), so it ran and is
+* no gap. A scanner listed in `notApplicable` is no gap; on a result from
+* before that list, a skipped tflint is read the same way, as the only reason
+* the agent ever skipped it was a repository with no Terraform.
+*/
+function hardeningCoverage(result) {
+	const notApplicable = new Set(result.notApplicable ?? []);
+	const applies = Object.entries(result.scanners ?? {}).filter(([scanner, status]) => !notApplicable.has(scanner) && !(result.notApplicable === void 0 && scanner === "tflint" && status === "skipped"));
+	const reasons = result.scannerReasons ?? {};
+	const gaps = applies.filter(([scanner, status]) => status === "not_run" || status === "skipped" || status === "failed" && scanner in reasons).map(([scanner, status]) => ({
+		scanner,
+		status,
+		reason: reasons[scanner] ?? null
+	}));
+	return {
+		verdict: !result.passed ? "failed" : gaps.length === applies.length ? "not_scanned" : gaps.length > 0 ? "passed_with_gaps" : "passed",
+		gaps
+	};
+}
 [...BUILD_RUN_ACTIVE_STATUSES.filter((s) => s !== "reviewing")];
 //#endregion
 //#region ../../packages/types/dist/agents.js
@@ -3942,6 +3985,34 @@ function hardeningSaid(blocking, named) {
 	const recorded = named.length > shown.length ? `, ${named.length} recorded in taiga_get_run` : "";
 	return `${count}: ${shown.join("; ")}${rest > 0 ? `; and ${rest} more${recorded}` : ""}.`;
 }
+/** How each hardening verdict reads (PRO-2829): "passed" only when every scanner that applies ran. */
+const VERDICT_SAID = {
+	passed: "Hardening passed: every scanner that applies ran and nothing blocks",
+	passed_with_gaps: "Hardening passed, but not every scanner ran, so its checks are missing from the result",
+	not_scanned: "No security scanner ran in hardening: \"passed\" only means no blocking finding was recorded",
+	failed: "Hardening failed: blocking findings remain"
+};
+/**
+* What a run's hardening came to, coverage included (PRO-2829), from the
+* verdict the API reads off it, or read here from an API from before that.
+* Null without a hardening result.
+*/
+function scanSaid(hardening) {
+	if (!hardening || typeof hardening !== "object") return null;
+	const h = hardening;
+	const coverage = typeof h.verdict === "string" && HARDENING_VERDICTS.includes(h.verdict) && Array.isArray(h.gaps) ? {
+		verdict: h.verdict,
+		gaps: h.gaps
+	} : typeof h.passed === "boolean" && h.scanners ? hardeningCoverage(h) : null;
+	if (!coverage) return null;
+	const gaps = coverage.gaps.map((gap) => `${gap.scanner}${gap.status === "failed" ? " did not finish" : ""}${gap.reason ? ` (${gap.reason})` : ""}`);
+	const missing = gaps.length > 0 ? `; did not run: ${gaps.join(", ")}` : "";
+	return {
+		verdict: coverage.verdict,
+		gaps: gaps.length,
+		said: `${VERDICT_SAID[coverage.verdict]}${missing}.`
+	};
+}
 /**
 * What each failedReason means for the next move (PRO-2800): reviewers met dispatch_rejected and agent_reported as
 * bare enums. As @taiga/types documents them.
@@ -3968,9 +4039,11 @@ function readableRun(run, opts = {}) {
 	const hardening = run["hardeningResult"];
 	const blocking = typeof hardening?.blockingFindings === "number" ? hardening.blockingFindings : 0;
 	const named = Array.isArray(hardening?.blocking) ? hardening.blocking : [];
+	const scan = scanSaid(hardening);
 	return {
 		...rest,
 		...means ? { failedReasonMeans: means } : {},
+		...scan && scan.gaps + (scan.verdict === "not_scanned" ? 1 : 0) > 0 ? { scanCoverage: scan.said } : {},
 		...blocking > 0 ? { hardeningNote: hardeningSaid(blocking, named) } : {},
 		...opts.row || error === void 0 ? {} : { error },
 		...opts.row || reviewEscalation === void 0 ? {} : { reviewEscalation },
@@ -4172,7 +4245,7 @@ function registerBuildTools(server, client) {
 	}));
 	server.registerTool("taiga_get_run", {
 		title: "Get run",
-		description: "Read one run with its steps: outcome, disposition, pull request, hardening, and per step its title, status, commit, files changed, verification and headline (first paragraph of the agent's report). verification is Taiga's own check after the step (tests, lint, build), so a docs-only step can fail on the repository's failing tests (verificationNote says when one failed throughout). A failed or stopped run has stoppedIn, lastProgressAt and failedReasonMeans (what its failedReason means). full: true adds complete instructions and reports. actions: resume and retry_from_failed_step are taiga_resume_initiative; webOnlyActions (start_over) are in the web; to stop it, move the initiative out of Build. A maintenance run has no initiative and is retried from its finding.",
+		description: "Read one run with its steps: outcome, disposition, pull request, hardening (scanCoverage names the security scanners that did not run, and why; hardeningResult.verdict is passed only when every one ran), and per step its title, status, commit, files changed, verification and headline (first paragraph of the agent's report). verification is Taiga's own check after the step (tests, lint, build), so a docs-only step can fail on the repository's failing tests (verificationNote says when one failed throughout). A failed or stopped run has stoppedIn, lastProgressAt and failedReasonMeans (what its failedReason means). full: true adds complete instructions and reports. actions: resume and retry_from_failed_step are taiga_resume_initiative; webOnlyActions (start_over) are in the web; to stop it, move the initiative out of Build. A maintenance run has no initiative and is retried from its finding.",
 		inputSchema: z.object({
 			runId,
 			full: z.boolean().optional().describe("Carry each step's complete instructions and report (default false: a summary)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.486",
+  "version": "0.26.0-dev.487",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",