@taiga-ai/mcp-server 0.26.0-dev.495 → 0.26.0-dev.501

package/dist/index.js

@@ -562,6 +562,31 @@ function lenientList(item) {
 	return list;
 }
 //#endregion
+//#region ../../packages/types/dist/wire-fields.js
+/**
+* Zod fields shared by more than one wire schema, so a change to the rule
+* lands once rather than at every schema that carries the field.
+*/
+/**
+* Reusable optional-UUID field for nested schemas (e.g. discriminated-union
+* members that all accept an optional resource id). Centralising the rule
+* means a future change (UUID v7-only, error-message tweak) lands in one
+* place instead of N call sites.
+*/
+const optionalUuid = z.string().uuid().optional();
+/**
+* A source line anchor on a finding, or nothing.
+*
+* 0 means "no line anchor" -- a dependency in go.mod, a checkov rule on a
+* whole file -- and the scanners emit 0 for it. Rejecting it with `.min(1)`
+* bounced the WHOLE hardening report of staging run 01a07123 (52 findings,
+* `/findings/46/lineNumber too_small`), so the UI never saw the phase
+* (PRO-1481). Normalized to absent, never stored as 0. One schema for every
+* wire shape that carries a line (findings, narrative, residual findings) so
+* the next tightening cannot land on one of them and not the others.
+*/
+const optionalLineAnchor = z.number().int().min(0).optional().transform((v) => v ? v : void 0);
+//#endregion
 //#region ../../packages/types/dist/tenants.js
 const TENANT_DOCUMENT_TYPES = [
 	"policy_security",
@@ -1432,6 +1457,149 @@ function hardeningCoverage(result) {
 		gaps
 	};
 }
+z.discriminatedUnion("kind", [
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("decision"),
+		what: z.string().min(1).max(2e3),
+		why: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("tradeoff"),
+		picked: z.string().min(1).max(2e3),
+		over: z.string().min(1).max(2e3),
+		reason: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("assumption"),
+		what: z.string().min(1).max(2e3),
+		current_choice: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("attention"),
+		what: z.string().min(1).max(2e3),
+		currently_handling: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("scope_change"),
+		what: z.string().min(1).max(2e3),
+		reason: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("risk"),
+		what: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("outcome"),
+		capability: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("agent_update"),
+		agent: z.string().min(1).max(120),
+		state: z.string().min(1).max(60),
+		activity: z.string().max(200).optional(),
+		message: z.string().max(2e3).optional(),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("activity"),
+		verb: z.enum([
+			"exploring",
+			"drafting",
+			"testing",
+			"reviewing",
+			"preparing"
+		]),
+		target: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("setup_required"),
+		category: z.enum([
+			"env_var",
+			"secret",
+			"third_party_account",
+			"api_key",
+			"oauth_app",
+			"dns_record",
+			"billing_approval",
+			"cloud_permission",
+			"manual_config"
+		]),
+		title: z.string().min(1).max(300),
+		instructions: z.string().min(1).max(2e3),
+		key: z.string().regex(/^[A-Za-z_][A-Za-z0-9_.]*$/).max(255).optional(),
+		isSecret: z.boolean().default(false),
+		target: z.enum([
+			"github_secret",
+			"github_env",
+			"cloud_env",
+			"secrets_manager",
+			"local_env",
+			"external"
+		]).optional(),
+		providerDocUrl: z.string().url().max(1e3).refine((u) => /^https?:\/\//i.test(u), { message: "providerDocUrl must use http or https scheme" }).optional(),
+		providerActionUrl: z.string().url().max(1e3).refine((u) => /^https?:\/\//i.test(u), { message: "providerActionUrl must use http or https scheme" }).optional(),
+		phase: z.enum([
+			"prereq",
+			"wiring",
+			"followup"
+		]).optional(),
+		suggestedValue: z.string().max(2e3).optional(),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("quality_finding"),
+		source: z.enum([
+			"tests",
+			"self_review",
+			"hardening",
+			"pr_review",
+			"ci_fix",
+			"post_remediation"
+		]),
+		severity: z.enum([
+			"blocking",
+			"advisory",
+			"info",
+			"pass"
+		]),
+		title: z.string().min(1).max(2e3),
+		body: z.string().max(2e3).optional(),
+		filePath: z.string().max(500).optional(),
+		lineNumber: optionalLineAnchor,
+		stepId: optionalUuid,
+		stats: z.object({
+			testsTotal: z.number().int().min(0).optional(),
+			testsPassed: z.number().int().min(0).optional(),
+			testsFailed: z.number().int().min(0).optional(),
+			testsAdded: z.number().int().min(0).optional(),
+			coveragePct: z.number().min(0).max(100).optional(),
+			coverageDelta: z.number().optional(),
+			blockingFindings: z.number().int().min(0).optional(),
+			advisoryFindings: z.number().int().min(0).optional(),
+			criticalsAddressed: z.number().int().min(0).optional(),
+			cycles: z.number().int().min(0).optional()
+		}).optional()
+	})
+]).options.map((option) => option.shape.kind.value);
 [...BUILD_RUN_ACTIVE_STATUSES.filter((s) => s !== "reviewing")];
 //#endregion
 //#region ../../packages/types/dist/agents.js
@@ -1751,6 +1919,7 @@ const ENVIRONMENT_TYPES = [
 const MAINTENANCE_FINDING_KINDS = [
 	"vulnerable_dependency",
 	"outdated_dependency",
+	"license_violation",
 	"secret",
 	"sast",
 	"iac_misconfig"
@@ -1775,7 +1944,11 @@ const CODE_REMEDIATION_KINDS = [
 	"iac_misconfig"
 ];
 new Map(Object.entries({
-	deps: ["vulnerable_dependency", "outdated_dependency"],
+	deps: [
+		"vulnerable_dependency",
+		"outdated_dependency",
+		"license_violation"
+	],
 	secrets: ["secret"],
 	sast: ["sast"],
 	iac: ["iac_misconfig"]
@@ -1862,6 +2035,19 @@ function lockfileScope(path, groups) {
 	}
 }
 /**
+* The kinds that are a package in a lockfile (PRO-2862): the ones with a
+* dependency scope, a relation and an inventory entry. A code kind reuses the
+* dependency columns for its rule and category and has none of those.
+*/
+const DEPENDENCY_FINDING_KINDS = [
+	"vulnerable_dependency",
+	"outdated_dependency",
+	"license_violation"
+];
+function isDependencyFindingKind(kind) {
+	return DEPENDENCY_FINDING_KINDS.includes(kind);
+}
+/**
 * Whether a dependency finding sits only in development dependencies, in at
 * least one runtime dependency set, or in lockfiles that do not say. Decided
 * per lockfile (`lockfileScope`) and combined pessimistically: one runtime
@@ -1872,8 +2058,12 @@ function lockfileScope(path, groups) {
 * install script in any group.
 */
 function dependencyScope(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const entries = Object.entries(finding.dependencyGroups ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return scopeFromGroups(finding.dependencyGroups);
+}
+/** The scope read from per-lockfile groups alone: for an inventory record, which is a package by construction. */
+function scopeFromGroups(dependencyGroups) {
+	const entries = Object.entries(dependencyGroups ?? {});
 	if (entries.length === 0) return "unknown";
 	return combineScopes(entries.map(([path, groups]) => lockfileScope(path, Array.isArray(groups) ? groups : [])));
 }
@@ -1891,8 +2081,12 @@ function combineScopes(scopes) {
 * remediation step already finds every resolved copy and its parent itself.
 */
 function dependencyRelation(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const values = Object.values(finding.dependencyRelation ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return relationFromLockfiles(finding.dependencyRelation);
+}
+/** The relation read from per-lockfile answers alone: for an inventory record, which is a package by construction. */
+function relationFromLockfiles(dependencyRelation) {
+	const values = Object.values(dependencyRelation ?? {});
 	if (values.includes("direct")) return "direct";
 	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
 	return "unknown";
@@ -5178,6 +5372,11 @@ const FINDING_ROW_FIELDS = [
 * read off the row; remediableBy stays as the sweep recorded it.
 */
 function withFixability(row) {
+	if (row["kind"] === "license_violation") return {
+		...row,
+		fixable: false,
+		fixNote: "A license violation has no fix version: review the license or replace the package; taiga_fix_finding refuses it."
+	};
 	if ((row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency") && !row["recommendedVersion"] && row["remediableBy"] === "coding_agent") return {
 		...row,
 		fixable: false,
@@ -5195,7 +5394,7 @@ function withDependencyScope(row, { keepGroups = false } = {}) {
 		...row,
 		dependencyRelation: void 0
 	} : lean;
-	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	if (!isDependencyFindingKind(String(row["kind"]))) return rest;
 	const kind = row["kind"];
 	return {
 		...rest,
@@ -5400,8 +5599,8 @@ function registerMaintenanceTools(server, client) {
 				...control,
 				...control.state === "no_evidence" ? { meaning: "Not assessed: no finding or violation is recorded against it, and the documents were not found to show it met. That is no evidence either way, not a pass." } : {},
 				...control.assessment == null && (control.state === "breached" || control.state === "diverged") ? { assessmentNote: "No met or not-applicable verdict is shown: an open finding or violation against the control outranks one." } : {},
+				...Number(control.findingCount ?? 0) > 0 ? { findingsNote: `${String(control.findingCount)} open scanner finding${control.findingCount === 1 ? "" : "s"} breach it; taiga_list_findings (productId) lists them with the controls each breaches. violations below are the documents' only.` } : {},
 				violations: pickFields(own, VIOLATION_FIELDS),
-				...Number(control.findingCount ?? 0) > 0 ? { findingsNote: `${String(control.findingCount)} open scanner finding${control.findingCount === 1 ? "" : "s"} breach it; taiga_list_findings (productId) lists them with the controls each breaches.` } : {},
 				...own.length > 0 ? wording : {}
 			});
 		}
@@ -6317,7 +6516,7 @@ function registerContextTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_get_product_context", {
 		title: "Get product context",
-		description: `Read where a product stands in one call; the first read for any product question. Name it by ID, slug or git remote URL. Returns product (in setup, readiness and next move), factory with its instructions, specification and architecture outlines (section ids, sizes), policies with section counts, a count of initiatives per board column (done and canceled too) and up to ${BACKLOG_IN_CONTEXT} open ones, a person's turn first (taiga_list_initiatives lists the rest), repositories, the latest five runs (taiga_list_runs has more), and counts for Action Required, open findings and policy violations. A part that failed is under unavailable, one the key cannot read under notGranted; neither shows as empty. documents: budget returns whole sections up to about ${DOCUMENT_BUDGET / 1e3}k characters each, full returns all.`,
+		description: `Read where a product stands in one call; the first read for any product question. Name it by ID, slug or git remote URL. Returns product (in setup, readiness and next move), factory with its instructions, specification and architecture outlines (section ids, sizes), policies with section counts, a count of initiatives per board column (done and canceled too) and up to ${BACKLOG_IN_CONTEXT} open ones, a person's turn first (taiga_list_initiatives lists them all, newest first), repositories, the latest five runs (taiga_list_runs has more), and counts for Action Required, open findings and policy violations. A part that failed is under unavailable, one the key cannot read under notGranted; neither shows as empty. documents: budget returns whole sections up to about ${DOCUMENT_BUDGET / 1e3}k characters each, full returns all.`,
 		inputSchema: z.object({
 			productId: productId.optional(),
 			slug: slug.optional(),
@@ -21990,6 +22189,8 @@ const MISSING_DOCUMENTS_HOW = "An imported product gets them from its import (ta
 * allowDuplicateName says the person means it.
 */
 const allowDuplicateName = z.boolean().optional().describe("Create it even when one with the same name exists (default false: refused, naming the existing one)");
+/** The same choice on a rename (PRO-2823). */
+const allowDuplicateRename = z.boolean().optional().describe("Rename it even when another has the new name (default false: refused, naming the existing one)");
 /**
 * A product name is refused when taken in its own factory only; the same name
 * in another factory is allowed and the slug takes a suffix. A review read the
@@ -22072,13 +22273,25 @@ function registerSetupTools(server, client) {
 		}));
 		server.registerTool("taiga_rename_factory", {
 			title: "Rename a factory",
-			description: "Rename a factory. Its slug follows the new name, so links to it change; products, members, knowledge and instructions stay as they are.",
+			description: "Rename a factory. Its slug follows the new name, so links to it change; products, members, knowledge and instructions stay as they are. A name another factory has is refused, as on create.",
 			inputSchema: z.object({
 				factoryId,
-				name: z.string().trim().min(1).max(255).describe("The new name")
+				name: z.string().trim().min(1).max(255).describe("The new name"),
+				allowDuplicateName: allowDuplicateRename
 			}),
 			annotations: OPERATE_SETTING
-		}, (params) => runTool(async () => toolResult(pickFields([(await client.updateFactory(params.factoryId, { name: params.name })).data], FACTORY_FIELDS)[0])));
+		}, (params) => runTool(async () => {
+			try {
+				return toolResult(pickFields([(await client.updateFactory(params.factoryId, {
+					name: params.name,
+					refuseDuplicateName: !params.allowDuplicateName
+				})).data], FACTORY_FIELDS)[0]);
+			} catch (error) {
+				const refused = duplicateName("factory", error, "in this organization");
+				if (refused) return refused;
+				throw error;
+			}
+		}));
 		server.registerTool("taiga_preview_product_move", {
 			title: "Preview moving a product to another factory",
 			description: "Show who gains and who loses access if a product moves to another factory: the source factory's members lose it, the target's gain it; people in both, the product's own members, and owners and admins keep it, named with why. Show it to the person before taiga_move_product.",
@@ -22160,21 +22373,32 @@ function registerSetupTools(server, client) {
 		inputSchema: z.object({
 			productId,
 			name: z.string().trim().min(1).max(255).optional().describe("A new name"),
+			allowDuplicateName: allowDuplicateRename,
 			...buildScope,
 			deploymentNotes: deploymentNotes.nullable().optional(),
 			emitDesignStandards: z.boolean().nullable().optional().describe("Inherit the organization's design standards; null follows the default")
 		}),
 		annotations: OPERATE_SETTING
 	}, (params) => runTool(async () => {
-		const { productId: id, ...changes } = params;
+		const { productId: id, allowDuplicateName: allowed, ...changes } = params;
 		if (Object.values(changes).every((value) => value === void 0)) return toolError("VALIDATION_ERROR", "Change at least one setting.");
 		const contradiction = notesWithNothingToDescribe(params);
 		if (contradiction) return contradiction;
-		const updated = (await client.updateProduct(id, changes)).data;
+		let updated;
+		try {
+			updated = (await client.updateProduct(id, {
+				...changes,
+				...changes.name !== void 0 ? { refuseDuplicateName: !allowed } : {}
+			})).data;
+		} catch (error) {
+			const refused = duplicateName("product", error, "in this factory");
+			if (refused) return refused;
+			throw error;
+		}
 		const warnings = missingNotesWarning(updated);
 		return toolResult({
-			...await productRow(client, updated),
-			...warnings.length > 0 ? { warnings } : {}
+			...warnings.length > 0 ? { warnings } : {},
+			...await productRow(client, updated)
 		});
 	}));
 	server.registerTool("taiga_refresh_reality_documents", {
@@ -22822,7 +23046,7 @@ const SERVER_INSTRUCTIONS = [
 	"Taiga is a policy-aware software delivery platform. Use these tools (taiga_*) for anything about a Taiga",
 	"product: its initiatives, runs, policies, findings, deployments or setup.",
 	"",
-	"**Which read.** Where a product stands (counts, not detail): taiga_get_product_context, by remote URL, slug",
+	"**Which read.** Where a product stands (counts, first rows): taiga_get_product_context, by remote URL, slug",
 	"or ID. What waits on people: taiga_list_action_required. A policy: taiga_get_organization_document (sections:",
 	"[], or a control id such as SEC-5.1), or the taiga://documents/{type} resources. Findings: taiga_list_findings.",
 	"One initiative or run: taiga_get_initiative, taiga_get_run. What this key may call: taiga_whoami.",
@@ -22830,10 +23054,10 @@ const SERVER_INSTRUCTIONS = [
 	"**Words.** An initiative is a unit of work, on a board of columns (backlog, todo, queue, plan, build, done,",
 	"canceled); plan and build are stations, and the line starts the next queued initiative when both are empty. A",
 	"run is one coding-agent attempt; hardening is its security pass; handed back means a person must act. A gate is",
-	"a person's review; a sweep is a scan for findings; standing is how a product meets the policies. Discovery sets",
-	"up a new product, from a web conversation or an import. A factory owns products.",
+	"a person's review; a sweep is a scan for findings; standing is how a product meets policy. Discovery sets",
+	"up a new product, from a web conversation or an import. Factories own products.",
 	"",
-	"**IDs** are UUIDs; the product, factory and initiative lists take query (product and factory misses name the",
+	"**IDs** are UUIDs; the product, factory and initiative lists take query (product and factory misses may name the",
 	"closest). A NOT_FOUND names the tool that lists the right ones. Lists page with nextCursor. outcome, situation",
 	"and nextStep are one-sentence summaries; setup writes return readiness. Product documents have two timelines:",
 	"plan (intent) and reality (from the code).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.495",
+  "version": "0.26.0-dev.501",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",