@taiga-ai/mcp-server 0.26.0-dev.511 → 0.26.0-dev.515

package/dist/index.js

@@ -321,6 +321,7 @@ var TaigaClient = class {
 	async listBuildRuns(productId, opts) {
 		const params = new URLSearchParams();
 		if (opts?.backlogItemId) params.set("backlogItemId", opts.backlogItemId);
+		if (opts?.status?.length) params.set("status", opts.status.join(","));
 		if (opts?.limit) params.set("limit", String(opts.limit));
 		if (opts?.cursor) params.set("cursor", opts.cursor);
 		const qs = params.toString();
@@ -330,6 +331,7 @@ var TaigaClient = class {
 	async listBuildRunActivity(opts) {
 		const params = new URLSearchParams();
 		if (opts?.active) params.set("active", "true");
+		if (opts?.status?.length) params.set("status", opts.status.join(","));
 		if (opts?.limit) params.set("limit", String(opts.limit));
 		if (opts?.cursor) params.set("cursor", opts.cursor);
 		const qs = params.toString();
@@ -356,6 +358,17 @@ var TaigaClient = class {
 	async getFinding(id) {
 		return this.request("GET", `/maintenance/findings/${seg(id)}`);
 	}
+	/** The package inventory (PRO-2862); 404 where the `licenses` feature is not enabled. */
+	async listPackages(productId, opts) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/packages${query$1({ ...opts })}`);
+	}
+	async getLicenseSummary(productId) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/licenses`);
+	}
+	/** A repository's CycloneDX 1.5 SBOM (PRO-2894), the document itself. */
+	async getSbom(productId, repositoryId) {
+		return this.request("GET", `/products/${seg(productId)}/maintenance/repositories/${seg(repositoryId)}/sbom`);
+	}
 	async updateFinding(id, body) {
 		return this.request("PATCH", `/maintenance/findings/${seg(id)}`, body);
 	}
@@ -2461,7 +2474,7 @@ const DOCUMENT_INPUTS = Object.freeze({
 * reads as deleted) and fields they explain would simply be missing. So it
 * refuses to start, and says what to do.
 */
-function apiLevelProblem(introspection, apiUrl, required = 3, version = SERVER_VERSION) {
+function apiLevelProblem(introspection, apiUrl, required = 4, version = SERVER_VERSION) {
 	const offered = introspection.mcpApiLevel ?? 0;
 	if (offered >= required) return null;
 	return `The Taiga API at ${apiUrl} is older than @taiga-ai/mcp-server ${version} needs (API level ${offered}, needs ${required}). Run the version published for it, or wait for that API to be updated; an earlier release of this package works against it.`;
@@ -2703,8 +2716,8 @@ const BY_ARGUMENT = {
 	initiativeId: ITEM_ID_HINT,
 	runId: "taiga_list_runs lists the runs, of one product or of every product the key can see.",
 	planId: "taiga_get_plan gives the initiative's active plan and its ID.",
-	repositoryId: "taiga_list_product_repositories lists the product's repository links; a linkable repository id is not a link ID.",
-	replacesRepositoryId: "taiga_list_product_repositories lists the product's repository links.",
+	linkId: "taiga_list_product_repositories lists the product's repository links; a linkable repository id is not a link ID.",
+	replacesLinkId: "taiga_list_product_repositories lists the product's repository links.",
 	linkableRepositoryId: "taiga_list_linkable_repositories lists the repositories the GitHub connection reaches, with their ids.",
 	installationId: "taiga_list_linkable_repositories lists the connected GitHub accounts.",
 	jobId: "A job ID is what the tool that started the job returned (taiga_request_initiatives, taiga_start_import).",
@@ -2718,6 +2731,7 @@ const BY_ARGUMENT = {
 /** Where an argument means something else on one tool, or the tool's 404 needs its own word. */
 const BY_TOOL = {
 	taiga_resolve_action: () => "taiga_list_action_required lists the items with their IDs.",
+	taiga_get_sbom: () => "An SBOM exists once a sweep has inventoried that repository, where the licenses feature is enabled; taiga_list_packages (linkId) says whether it has packages, and taiga_list_product_repositories lists the links.",
 	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and names the call that asks for one (taiga_queue_initiative off the line, taiga_plan_again for a failed plan)." : ITEM_ID_HINT
 };
 /**
@@ -2730,8 +2744,8 @@ const MISSING_THING = {
 	initiativeId: /backlog item|initiative/i,
 	runId: /\b(build )?run\b/i,
 	planId: /\bplan\b/i,
-	repositoryId: /repository link|\blink\b/i,
-	replacesRepositoryId: /repository link|\blink\b/i,
+	linkId: /repository link|\blink\b|repository/i,
+	replacesLinkId: /repository link|\blink\b/i,
 	linkableRepositoryId: /github repository/i,
 	installationId: /installation|account/i,
 	jobId: /\bjob\b/i,
@@ -2812,6 +2826,7 @@ function ownArgumentLike(key, own) {
 const PRODUCT_WORDS = {
 	backlogItemId: "initiativeId",
 	buildRunId: "runId",
+	productRepositoryId: "linkId",
 	latestBuild: "latestRun"
 };
 /**
@@ -2854,7 +2869,7 @@ function inProductWords(value) {
 }
 /** The API's 404 sentence in the product's words: "Backlog item not found" is an initiative not found. */
 function inProductWording(said) {
-	return said.replace(/^Backlog item not found/i, "Initiative not found").replace(/^Build run step not found/i, "Run step not found").replace(/^Build run not found/i, "Run not found").replace(/^Custom document not found/i, "Knowledge file not found").replace(/^(Branch "[^"]*" does not exist in \S+?)\.?$/i, "$1. taiga_list_repository_branches lists the branches it has.").replace(/^This product already has a repository\. Change it instead of linking another\./i, "This product already has a repository. Pass replacesRepositoryId to swap it in one step, or taiga_unlink_repository first (taiga_list_product_repositories gives its ID).");
+	return said.replace(/^Backlog item not found/i, "Initiative not found").replace(/^Build run step not found/i, "Run step not found").replace(/^Build run not found/i, "Run not found").replace(/^Custom document not found/i, "Knowledge file not found").replace(/^(Branch "[^"]*" does not exist in \S+?)\.?$/i, "$1. taiga_list_repository_branches lists the branches it has.").replace(/^This product already has a repository\. Change it instead of linking another\./i, "This product already has a repository. Pass replacesLinkId to swap it in one step, or taiga_unlink_repository first (taiga_list_product_repositories gives its ID).");
 }
 /**
 * A float without its binary noise: six significant digits. Delivery metrics
@@ -3924,6 +3939,10 @@ async function publishDraft(scope) {
 		...published.warnings ? { warnings: published.warnings } : {}
 	});
 }
+/** The section ids that are not control ids at all. GDPR-1.1 is a control id, so it is not among them, though it names no single policy. */
+function notControls(sections) {
+	return sections.filter((id) => !isControlId(id.toUpperCase()));
+}
 /** The policies the section ids name when every one is a control id (SEC-5.1), else none. */
 function policiesNamed(sections) {
 	if (sections.length === 0) return [];
@@ -3949,7 +3968,7 @@ function registerDocumentTools(server, client) {
 			sections: params.sections?.map((id) => id.toUpperCase())
 		} : params;
 		if (args.type === void 0) {
-			if (args.sections) return toolError("VALIDATION_ERROR", named.length > 1 ? `Those control ids are in different policies (${named.join(", ")}): read one type at a time.` : "Name the document (type) to read its sections; a control id such as SEC-5.1 names its policy itself.");
+			if (args.sections) return toolError("VALIDATION_ERROR", named.length > 1 ? `Those control ids are in different policies (${named.join(", ")}): read one type at a time.` : notControls(args.sections).length > 0 && notControls(args.sections).length < args.sections.length ? `Not a control id: ${notControls(args.sections).join(", ")}. A control id such as SEC-5.1 names its policy; any other section id needs type.` : "Name the document (type) to read its sections; a control id such as SEC-5.1 names its policy itself, but one of a family that spans policies (GDPR, NIS2) does not.");
 			const result = await client.listTenantDocuments({
 				limit: args.limit,
 				cursor: args.cursor
@@ -4578,11 +4597,12 @@ function registerBuildTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_runs", {
 		title: "List runs",
-		description: "List coding agent runs, newest first: status, branch, pull request, step progress, actions and outcome, one sentence saying how it stands: running, waiting for a person to review and merge, merged, failed, stopped, its pull request closed unmerged, or nobody waiting on it because its initiative ended. Without productId, every product's runs; active: true keeps running ones. taiga_get_run reads one; carry work on from the initiative (taiga_resume_initiative).",
+		description: "List coding agent runs, newest first: status, branch, pull request, step progress, actions and outcome, one sentence saying how it stands: running, waiting for a person to review and merge, merged, failed, stopped, its pull request closed unmerged, or nobody waiting on it because its initiative ended. Without productId, every product's runs; active: true keeps running ones, and status narrows to some statuses (status: [\"failed\", \"stopped\"] for what failed). taiga_get_run reads one; carry work on from the initiative (taiga_resume_initiative).",
 		inputSchema: z.object({
 			productId: productId.optional(),
 			initiativeId: idInput("initiative", "taiga_list_initiatives (query finds one by title) gives it").optional().describe("Only this initiative's runs -- get from taiga_list_initiatives"),
 			active: z.boolean().optional().describe("Only runs the agent is executing now (cloning through reviewing; a queued pending run is not yet executing and is left out); for the org-wide list"),
+			status: z.array(z.enum(BUILD_RUN_STATUSES)).min(1).optional().describe("Only runs in these statuses, such as [\"failed\", \"stopped\"]"),
 			...pagination
 		}),
 		annotations: READ_ONLY
@@ -4593,6 +4613,7 @@ function registerBuildTools(server, client) {
 		if (productIdOf) {
 			const result = await client.listBuildRuns(productIdOf, {
 				backlogItemId: params.initiativeId,
+				status: params.status,
 				limit: params.limit,
 				cursor: params.cursor
 			});
@@ -4707,7 +4728,7 @@ function waitingOn(rows, station) {
 }
 const STATION_NAMED = 3;
 /** Who holds the station, or null when the key cannot read the backlog or the read failed. */
-async function stationHolders(client, product, head) {
+async function stationHolders(client, product, except) {
 	if (!client.hasCapability("backlog:read")) return null;
 	try {
 		const columns = await Promise.all(["plan", "build"].map((state) => client.listBacklogItems(product, {
@@ -4715,7 +4736,7 @@ async function stationHolders(client, product, head) {
 			order: "newest",
 			limit: 100
 		})));
-		const rows = columns.flatMap((page) => page.data).filter((row) => row.id !== head);
+		const rows = columns.flatMap((page) => page.data).filter((row) => !except.has(row.id));
 		const capped = columns.some((page) => page.nextCursor !== null);
 		return {
 			count: rows.length,
@@ -4791,10 +4812,14 @@ async function queueView(client, product, options = { name: "all" }) {
 	});
 	const note = unnamed === 0 ? null : !canName ? "Entries carry initiativeId only: naming them needs backlog:read, which this key lacks." : entries.length > NAMED_ENTRIES ? `Only the first ${NAMED_ENTRIES} entries are named; the rest carry initiativeId only.` : "An entry whose initiative could not be read carries initiativeId only; taiga_get_initiative reads it.";
 	const line = typeof paused === "string" ? `The line is paused (since ${paused}): nothing is planned or built until a person resumes it.` : null;
+	const idle = rows.length > 0 && blockingIndex(rows, (row) => row.entryState) < 0;
+	const station = rows.length > 0 || options.name === "all" ? await stationHolders(client, product, new Set(idle ? [rows[0].backlogItemId] : rows.map((row) => row.backlogItemId))) : null;
+	const offLine = !idle && station && station.count > 0 ? { offTheLine: `${station.atLeast ? "At least " : ""}${station.count} initiative${station.count === 1 ? " is" : "s are"} in Plan or Build without a queue entry (${station.titles.map((title) => `"${title}"`).join(", ")}${station.count > station.titles.length ? ", and more" : ""}): moved there by hand or waiting on a pull request review. Each holds the station like the active entry; taiga_list_initiatives with column: 'plan' or 'build' lists them.` } : {};
 	return {
 		linePaused: paused === null ? null : typeof paused === "string",
 		entries: rows.map(({ lifecycle: _lifecycle, runId: _runId, ...row }) => row),
-		waitingOn: line ?? waitingOn(rows, rows.length > 0 && blockingIndex(rows, (row) => row.entryState) < 0 ? await stationHolders(client, product, rows[0].backlogItemId) : null),
+		waitingOn: line ?? waitingOn(rows, idle ? station : null),
+		...offLine,
 		...note ? { note } : {}
 	};
 }
@@ -5398,6 +5423,19 @@ function registerPlanVerdicts(server, client) {
 * next sweep no longer detects it, so there is no tool for either.
 */
 /** A finding as a list row: enough to decide whether to open, fix or ignore it. */
+const PACKAGE_ROW_FIELDS = [
+	"id",
+	"ecosystem",
+	"packageName",
+	"version",
+	"purl",
+	"licenses",
+	"scope",
+	"relation",
+	"sourcePath",
+	"productRepositoryId",
+	"detectedAt"
+];
 const FINDING_ROW_FIELDS = [
 	"id",
 	"kind",
@@ -5421,6 +5459,77 @@ const FINDING_ROW_FIELDS = [
 	"ignoreReason",
 	"ignoreExpiresAt"
 ];
+/** Locations a folded row names before it says how many more there are. */
+const GROUP_WHERE = 5;
+/** What makes two findings one rule's: its rule id for code, infrastructure and secrets, its license verdict for a license. */
+/** The scanner's title cap (deps.py _COLUMN_CAP): a title cut there ends in "...". */
+const TITLE_CAP = 300;
+/**
+* The license verdict of a license finding's title: what follows "<package> <version>: ". A title the scanner cut
+* at its cap has no whole verdict, so it folds with nothing: two cut titles could share a prefix and differ.
+*/
+function licenseVerdict(row) {
+	const title = String(row["title"] ?? "");
+	if (title.length >= TITLE_CAP && title.endsWith("...")) return "";
+	return title.split(": ").slice(1).join(": ");
+}
+function groupKey(row) {
+	const status = String(row["status"] ?? "");
+	const link = String(row["productRepositoryId"] ?? "");
+	if (row["kind"] === "license_violation") {
+		const verdict = licenseVerdict(row);
+		return verdict ? `license|${status}|${link}|${verdict}` : null;
+	}
+	const location = row["location"];
+	const rule = typeof location?.ruleId === "string" ? location.ruleId : null;
+	return rule ? `${String(row["kind"])}|${String(row["severity"])}|${status}|${link}|${rule}` : null;
+}
+/** Where one finding is, in a few characters: its path and line, or its package. */
+function whereOf(row) {
+	const location = row["location"];
+	if (typeof location?.path === "string") return location.line ? `${location.path}:${String(location.line)}` : location.path;
+	return [row["packageName"], row["currentVersion"]].filter(Boolean).join(" ") || String(row["id"]);
+}
+/**
+* Findings of one rule or license verdict on a page, folded into one row (PRO-2941): a review read seven
+* CKV_GHA_7 rows and fifteen sharp license rows, identical but for where. The first stands for them, with
+* count, every findingId (what fix and ignore take) and the first few locations.
+*/
+function grouped(rows, fold) {
+	if (!fold) return rows;
+	const groups = /* @__PURE__ */ new Map();
+	const order = [];
+	for (const row of rows) {
+		const key = groupKey(row);
+		if (!key) {
+			order.push(row);
+			continue;
+		}
+		if (!groups.has(key)) {
+			groups.set(key, []);
+			order.push(key);
+		}
+		groups.get(key).push(row);
+	}
+	return order.map((entry) => {
+		if (typeof entry !== "string") return entry;
+		const members = groups.get(entry);
+		if (members.length === 1) return members[0];
+		const where = members.map(whereOf);
+		const first = members[0];
+		const shared = Object.fromEntries(Object.entries(first).filter(([key, value]) => key !== "id" && members.every((member) => JSON.stringify(member[key]) === JSON.stringify(value))));
+		const location = first["location"];
+		const said = first["kind"] === "license_violation" ? licenseVerdict(first) : typeof location?.ruleId === "string" ? location.ruleId : String(first["title"]);
+		return {
+			...shared,
+			...shared["title"] === void 0 ? { title: said } : {},
+			count: members.length,
+			findingIds: members.map((member) => member["id"]),
+			where: where.slice(0, GROUP_WHERE),
+			...where.length > GROUP_WHERE ? { moreWhere: where.length - GROUP_WHERE } : {}
+		};
+	});
+}
 /**
 * Whether taiga_fix_finding would take a finding, said on the row (PRO-2800): three reviews found a dependency
 * marked remediableBy coding_agent with no fixed version, which the API refuses to fix. The API's own refusals,
@@ -5579,13 +5688,14 @@ function registerMaintenanceTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_findings", {
 		title: "List maintenance findings",
-		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. controlId lists the findings that breach one control. taiga_get_finding reads one.",
+		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. controlId lists the findings that breach one control. Findings of one rule or license verdict in one repository fold into one row per page, with count, findingIds (what fix and ignore take), where, and only the fields they share; group: false lists each. taiga_get_finding reads one.",
 		inputSchema: z.object({
 			productId,
 			controlId: z.string().trim().min(1).max(40).optional().describe("Only the findings that breach this control, such as SEC-5.1 (one page, searched across all)"),
 			status: z.enum(MAINTENANCE_FINDING_STATUSES).optional().describe("Only findings in this status; omit for the ones needing action"),
 			severity: z.enum(MAINTENANCE_FINDING_SEVERITIES).optional().describe("Only this severity"),
 			kind: z.enum(MAINTENANCE_FINDING_KINDS).optional().describe("Only this kind of finding"),
+			group: z.boolean().optional().describe("Fold findings of one rule or license on this page into one row (default true); false lists each"),
 			...pagination
 		}),
 		annotations: READ_ONLY
@@ -5600,7 +5710,7 @@ function registerMaintenanceTools(server, client) {
 				cursor
 			}), "", () => [""], params.limit ?? 25, (row) => Array.isArray(row["controls"]) && row["controls"].some((c) => String(c).toUpperCase() === wanted));
 			return toolResult({
-				...page(findingRows(found.rows), null),
+				...page(grouped(findingRows(found.rows), params.group !== false), null),
 				...found.more ? { more: found.rows.length < (params.limit ?? 25) ? `Only the first 1000 findings were searched; narrow by status, severity or kind to reach the rest.` : "There may be more than the limit carries: raise the limit, or narrow by status, severity or kind." } : {},
 				...found.rows.length === 0 && !found.more ? { note: `No ${params.status ? `${params.status} ` : "open "}finding breaches ${wanted}. That is no all-clear on its own: taiga_list_findings without controlId says when the product was last swept.` } : {}
 			});
@@ -5614,11 +5724,43 @@ function registerMaintenanceTools(server, client) {
 				sweep: null,
 				sweepNote: "The sweep overview could not be read: an empty list here is not an all-clear."
 			} : sweep ? { sweep } : {},
-			...page(findingRows(result.data), result.nextCursor),
+			...page(grouped(findingRows(result.data), params.group !== false), result.nextCursor),
 			...typeof result.totalCount === "number" ? { totalCount: result.totalCount } : {},
 			...params.status === void 0 && params.severity === void 0 && params.kind === void 0 && typeof result.totalCount === "number" && sweep && sweep !== "unread" && typeof sweep["openFindings"] === "number" && sweep["openFindings"] !== result.totalCount ? { totalNote: "totalCount includes findings with a fix under way (remediating) and ignored findings whose ignore has expired; sweep.openFindings counts open ones only." } : {}
 		});
 	}));
+	server.registerTool("taiga_list_packages", {
+		title: "List the package inventory",
+		description: "Every package a product's repositories resolve, vulnerable or not, as the latest sweep read it: name, version, ecosystem, SPDX licenses, scope (dev / runtime / unknown), relation (direct / transitive / unknown) and the lockfile. The first page opens with licenses: each license string across the inventory, how many packages carry it and its standing against the allowlist (allowed, not_allowed, unknown), plus the allowlist and when each repository was last inventoried. Filter by one license string (UNKNOWN for the ones the data source could not name), a name substring or a repository. A license outside the allowlist is also a license_violation finding in taiga_list_findings. Where the licenses feature is not enabled the product answers NOT_FOUND. taiga_get_sbom downloads one repository as CycloneDX.",
+		inputSchema: z.object({
+			productId,
+			license: z.string().min(1).max(4096).optional().describe("Only packages carrying exactly this SPDX string"),
+			search: z.string().min(1).max(255).optional().describe("Case-insensitive substring of the package name"),
+			linkId: idInput("repository link", "taiga_list_product_repositories gives it", "only this repository").optional(),
+			...pagination
+		}),
+		annotations: READ_ONLY
+	}, (params) => runTool(async () => {
+		const { productId: id, linkId: link, ...filters } = params;
+		const [result, summary] = await Promise.all([client.listPackages(id, {
+			...filters,
+			...link ? { productRepositoryId: link } : {}
+		}), params.cursor === void 0 ? client.getLicenseSummary(id) : Promise.resolve(null)]);
+		return toolResult({
+			...summary ? { licenses: summary.data } : {},
+			...page(pickFields(result.data, PACKAGE_ROW_FIELDS), result.nextCursor),
+			...typeof result.totalCount === "number" ? { totalCount: result.totalCount } : {}
+		});
+	}));
+	server.registerTool("taiga_get_sbom", {
+		title: "Download a repository SBOM",
+		description: "One repository's software bill of materials as a CycloneDX 1.5 JSON document, rendered from the stored package inventory: metadata (timestamp, tools, the repository), every package with its purl, license and scope, and the packages the repository declares directly. The whole document is returned, so for a large repository the answer is large; read taiga_list_packages when a summary is enough. NOT_FOUND where the licenses feature is not enabled, and for a repository no sweep has inventoried yet.",
+		inputSchema: z.object({
+			productId,
+			linkId: idInput("repository link", "taiga_list_product_repositories gives it")
+		}),
+		annotations: READ_ONLY
+	}, (params) => runTool(async () => toolResult(await client.getSbom(params.productId, params.linkId))));
 	server.registerTool("taiga_get_finding", {
 		title: "Get a maintenance finding",
 		description: "Read one maintenance finding: exploit likelihood (EPSS, known-exploited list), the advisory summarized (full: true for its whole record: every affected range and reference) and fixed version, code location, breached policy controls, why it ranks where it does, history (reintroduced, previously resolved) and the remediation under way. fixable: false with fixNote says taiga_fix_finding would refuse it. A secret's value is never stored, only the rule and location.",
@@ -6558,10 +6700,15 @@ async function standingPart(client, productId) {
 	const standing = (await client.getPolicyStanding(productId)).data;
 	const summary = standingSummary(standing);
 	const state = standing.assessment?.state;
+	const controls = Array.isArray(standing.controls) ? standing.controls : [];
+	const withAny = (key) => controls.filter((control) => Number(control[key] ?? 0) > 0).length;
 	return {
 		openViolations: summary.violations,
 		bySeverity: summary.bySeverity,
-		controlsViolated: summary.controls,
+		controlsBreached: withAny("findingCount"),
+		controlsDiverged: withAny("divergenceCount"),
+		controlsMet: summary.controlsMet,
+		controlsNotApplicable: summary.controlsNotApplicable,
 		...state === "never" || state === "failed" ? { note: `The assessment ${state === "never" ? "has never run" : "failed"}: no violations here is not an all-clear.` } : {}
 	};
 }
@@ -21942,7 +22089,11 @@ const GITHUB_REPOSITORY_FIELDS = [
 	"linked",
 	"linkedProduct"
 ];
-const repositoryId = idInput("repository link", "taiga_list_product_repositories gives it; a linkable repository id is not one");
+/**
+* A product's link to a repository: one name for it in every tool (PRO-2941). Reviews met it as repositoryId
+* here, productRepositoryId on findings and packages, and linkableRepositoryId (a different thing) beside both.
+*/
+const linkId = idInput("repository link", "taiga_list_product_repositories gives it (its id); a linkable repository id is not one");
 /** Round-robin over lists: the first of each, then the second of each, and so on. */
 function interleave(lists) {
 	const out = [];
@@ -22006,11 +22157,11 @@ function registerRepositoryTools(server, client) {
 			description: "List the branches of a product's linked repository, each with whether it is protected, to choose the one Taiga works on (taiga_set_repository_branch). truncated: true means there are more than listed.",
 			inputSchema: z.object({
 				productId,
-				repositoryId
+				linkId
 			}),
 			annotations: READ_ONLY
 		}, (params) => runTool(async () => {
-			const result = await client.listRepositoryBranches(params.productId, params.repositoryId);
+			const result = await client.listRepositoryBranches(params.productId, params.linkId);
 			return toolResult({
 				data: result.data,
 				truncated: result.truncated
@@ -22066,11 +22217,11 @@ function registerRepositoryTools(server, client) {
 	if (!client.hasCapability("vcs:manage")) return;
 	server.registerTool("taiga_link_repository", {
 		title: "Link a repository to a product",
-		description: "Link a GitHub repository to a product (taiga_list_linkable_repositories gives its id). replacesRepositoryId swaps out the one linked now in one step (the same one changes nothing); linking while one is linked without it is refused. A managed link (isManaged) cannot be replaced or unlinked. Once linked, planning reads its code, runs open pull requests in it, sweeps scan it, and its deployment history is imported.",
+		description: "Link a GitHub repository to a product (taiga_list_linkable_repositories gives its id). replacesLinkId swaps out that link in one step (the same one changes nothing). Whether a product may link more than one repository depends on the organization; when it may not, a second link is refused and the refusal says to pass replacesLinkId. A managed link (isManaged) cannot be replaced or unlinked. Once linked, planning reads its code, runs open pull requests in it, sweeps scan it, and its deployment history is imported.",
 		inputSchema: z.object({
 			productId,
 			linkableRepositoryId: idInput("linkable repository", "taiga_list_linkable_repositories gives it (a row's id; not GitHub's numeric id, not a link ID)"),
-			replacesRepositoryId: repositoryId.optional().describe("The link this one replaces")
+			replacesLinkId: linkId.optional().describe("The link this one replaces")
 		}),
 		annotations: OPERATE
 	}, (params) => runTool(async () => {
@@ -22078,7 +22229,7 @@ function registerRepositoryTools(server, client) {
 		try {
 			linked = await client.linkRepository(params.productId, {
 				githubRepositoryId: params.linkableRepositoryId,
-				...params.replacesRepositoryId ? { replacesRepositoryId: params.replacesRepositoryId } : {}
+				...params.replacesLinkId ? { replacesRepositoryId: params.replacesLinkId } : {}
 			});
 		} catch (error) {
 			const holder = await holderOf(client, error, params.productId);
@@ -22095,14 +22246,14 @@ function registerRepositoryTools(server, client) {
 		description: "Choose the branch Taiga branches from and opens pull requests against (taiga_list_repository_branches lists them), or null for the repository's default. A protected branch is accepted, but Taiga may not be able to merge into it; the result says when it is protected. Optionally sets a label for the link.",
 		inputSchema: z.object({
 			productId,
-			repositoryId,
+			linkId,
 			baseBranch: z.string().trim().min(1).max(255).nullable().optional().describe("The branch; null for the default"),
 			label: z.string().trim().min(1).max(100).nullable().optional().describe("A label for the link; null clears it")
 		}),
 		annotations: OPERATE_SETTING
 	}, (params) => runTool(async () => {
 		if (params.baseBranch === void 0 && params.label === void 0) return toolError("VALIDATION_ERROR", "Set baseBranch, label or both.");
-		const updated = (await client.updateRepository(params.productId, params.repositoryId, {
+		const updated = (await client.updateRepository(params.productId, params.linkId, {
 			...params.baseBranch !== void 0 ? { baseBranch: params.baseBranch } : {},
 			...params.label !== void 0 ? { label: params.label } : {}
 		})).data;
@@ -22114,16 +22265,16 @@ function registerRepositoryTools(server, client) {
 	}));
 	server.registerTool("taiga_unlink_repository", {
 		title: "Unlink a repository from a product",
-		description: "Unlink a repository from a product. The product keeps its documents and initiatives, but nothing is planned against code, built or swept. The repository itself is untouched; one Taiga created for the product cannot be unlinked. To swap it, use taiga_link_repository with replacesRepositoryId.",
+		description: "Unlink a repository from a product. The product keeps its documents and initiatives, but nothing is planned against code, built or swept. The repository itself is untouched; one Taiga created for the product cannot be unlinked. To swap it, use taiga_link_repository with replacesLinkId.",
 		inputSchema: z.object({
 			productId,
-			repositoryId
+			linkId
 		}),
 		annotations: OPERATE
 	}, (params) => runTool(async () => {
-		await client.unlinkRepository(params.productId, params.repositoryId);
+		await client.unlinkRepository(params.productId, params.linkId);
 		return toolResult({
-			repositoryId: params.repositoryId,
+			linkId: params.linkId,
 			unlinked: true
 		});
 	}));
@@ -22933,6 +23084,12 @@ function refusedArguments(args) {
 	}));
 	return toolError("VALIDATION_ERROR", `Invalid arguments for ${tool}. ${lines.map((line) => line.argument ? `${line.argument}: ${line.message}` : line.message).join(" ")}`, { arguments: lines });
 }
+/** Argument names this release replaced, and what replaced them. */
+const RENAMED_ARGUMENTS = {
+	repositoryId: "linkId",
+	replacesRepositoryId: "replacesLinkId",
+	productRepositoryId: "linkId"
+};
 /**
 * A refused call says what to do next (PRO-2841), as a 404 already does. The
 * SDK validates the arguments before the handler runs, where the 404 hints
@@ -22947,6 +23104,8 @@ function withRecoveryHints(tool, schema, inputs, isRead) {
 	const hinted = (issue) => {
 		if (issue.code === "unrecognized_keys" && issue.keys?.length) {
 			const pointers = issue.keys.map((key) => {
+				const renamed = RENAMED_ARGUMENTS[key];
+				if (renamed && (inputs.get(tool) ?? []).includes(renamed)) return `${tool} takes ${renamed}, which replaced ${key}.`;
 				const own = ownArgumentLike(key, inputs.get(tool) ?? []);
 				if (own) return `${tool} takes ${own}, spelled that way.`;
 				const other = closestToolTaking(key, tool, inputs, isRead);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.511",
+  "version": "0.26.0-dev.515",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",