@taiga-ai/mcp-server 0.26.0-rc.496 → 0.26.0-rc.504

package/dist/index.js

@@ -562,6 +562,31 @@ function lenientList(item) {
 	return list;
 }
 //#endregion
+//#region ../../packages/types/dist/wire-fields.js
+/**
+* Zod fields shared by more than one wire schema, so a change to the rule
+* lands once rather than at every schema that carries the field.
+*/
+/**
+* Reusable optional-UUID field for nested schemas (e.g. discriminated-union
+* members that all accept an optional resource id). Centralising the rule
+* means a future change (UUID v7-only, error-message tweak) lands in one
+* place instead of N call sites.
+*/
+const optionalUuid = z.string().uuid().optional();
+/**
+* A source line anchor on a finding, or nothing.
+*
+* 0 means "no line anchor" -- a dependency in go.mod, a checkov rule on a
+* whole file -- and the scanners emit 0 for it. Rejecting it with `.min(1)`
+* bounced the WHOLE hardening report of staging run 01a07123 (52 findings,
+* `/findings/46/lineNumber too_small`), so the UI never saw the phase
+* (PRO-1481). Normalized to absent, never stored as 0. One schema for every
+* wire shape that carries a line (findings, narrative, residual findings) so
+* the next tightening cannot land on one of them and not the others.
+*/
+const optionalLineAnchor = z.number().int().min(0).optional().transform((v) => v ? v : void 0);
+//#endregion
 //#region ../../packages/types/dist/tenants.js
 const TENANT_DOCUMENT_TYPES = [
 	"policy_security",
@@ -1432,6 +1457,149 @@ function hardeningCoverage(result) {
 		gaps
 	};
 }
+z.discriminatedUnion("kind", [
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("decision"),
+		what: z.string().min(1).max(2e3),
+		why: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("tradeoff"),
+		picked: z.string().min(1).max(2e3),
+		over: z.string().min(1).max(2e3),
+		reason: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("assumption"),
+		what: z.string().min(1).max(2e3),
+		current_choice: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("attention"),
+		what: z.string().min(1).max(2e3),
+		currently_handling: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("scope_change"),
+		what: z.string().min(1).max(2e3),
+		reason: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("risk"),
+		what: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("outcome"),
+		capability: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("agent_update"),
+		agent: z.string().min(1).max(120),
+		state: z.string().min(1).max(60),
+		activity: z.string().max(200).optional(),
+		message: z.string().max(2e3).optional(),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("activity"),
+		verb: z.enum([
+			"exploring",
+			"drafting",
+			"testing",
+			"reviewing",
+			"preparing"
+		]),
+		target: z.string().min(1).max(2e3),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("setup_required"),
+		category: z.enum([
+			"env_var",
+			"secret",
+			"third_party_account",
+			"api_key",
+			"oauth_app",
+			"dns_record",
+			"billing_approval",
+			"cloud_permission",
+			"manual_config"
+		]),
+		title: z.string().min(1).max(300),
+		instructions: z.string().min(1).max(2e3),
+		key: z.string().regex(/^[A-Za-z_][A-Za-z0-9_.]*$/).max(255).optional(),
+		isSecret: z.boolean().default(false),
+		target: z.enum([
+			"github_secret",
+			"github_env",
+			"cloud_env",
+			"secrets_manager",
+			"local_env",
+			"external"
+		]).optional(),
+		providerDocUrl: z.string().url().max(1e3).refine((u) => /^https?:\/\//i.test(u), { message: "providerDocUrl must use http or https scheme" }).optional(),
+		providerActionUrl: z.string().url().max(1e3).refine((u) => /^https?:\/\//i.test(u), { message: "providerActionUrl must use http or https scheme" }).optional(),
+		phase: z.enum([
+			"prereq",
+			"wiring",
+			"followup"
+		]).optional(),
+		suggestedValue: z.string().max(2e3).optional(),
+		stepId: optionalUuid
+	}),
+	z.object({
+		type: z.literal("narrative"),
+		kind: z.literal("quality_finding"),
+		source: z.enum([
+			"tests",
+			"self_review",
+			"hardening",
+			"pr_review",
+			"ci_fix",
+			"post_remediation"
+		]),
+		severity: z.enum([
+			"blocking",
+			"advisory",
+			"info",
+			"pass"
+		]),
+		title: z.string().min(1).max(2e3),
+		body: z.string().max(2e3).optional(),
+		filePath: z.string().max(500).optional(),
+		lineNumber: optionalLineAnchor,
+		stepId: optionalUuid,
+		stats: z.object({
+			testsTotal: z.number().int().min(0).optional(),
+			testsPassed: z.number().int().min(0).optional(),
+			testsFailed: z.number().int().min(0).optional(),
+			testsAdded: z.number().int().min(0).optional(),
+			coveragePct: z.number().min(0).max(100).optional(),
+			coverageDelta: z.number().optional(),
+			blockingFindings: z.number().int().min(0).optional(),
+			advisoryFindings: z.number().int().min(0).optional(),
+			criticalsAddressed: z.number().int().min(0).optional(),
+			cycles: z.number().int().min(0).optional()
+		}).optional()
+	})
+]).options.map((option) => option.shape.kind.value);
 [...BUILD_RUN_ACTIVE_STATUSES.filter((s) => s !== "reviewing")];
 //#endregion
 //#region ../../packages/types/dist/agents.js
@@ -1751,6 +1919,7 @@ const ENVIRONMENT_TYPES = [
 const MAINTENANCE_FINDING_KINDS = [
 	"vulnerable_dependency",
 	"outdated_dependency",
+	"license_violation",
 	"secret",
 	"sast",
 	"iac_misconfig"
@@ -1775,7 +1944,11 @@ const CODE_REMEDIATION_KINDS = [
 	"iac_misconfig"
 ];
 new Map(Object.entries({
-	deps: ["vulnerable_dependency", "outdated_dependency"],
+	deps: [
+		"vulnerable_dependency",
+		"outdated_dependency",
+		"license_violation"
+	],
 	secrets: ["secret"],
 	sast: ["sast"],
 	iac: ["iac_misconfig"]
@@ -1862,6 +2035,19 @@ function lockfileScope(path, groups) {
 	}
 }
 /**
+* The kinds that are a package in a lockfile (PRO-2862): the ones with a
+* dependency scope, a relation and an inventory entry. A code kind reuses the
+* dependency columns for its rule and category and has none of those.
+*/
+const DEPENDENCY_FINDING_KINDS = [
+	"vulnerable_dependency",
+	"outdated_dependency",
+	"license_violation"
+];
+function isDependencyFindingKind(kind) {
+	return DEPENDENCY_FINDING_KINDS.includes(kind);
+}
+/**
 * Whether a dependency finding sits only in development dependencies, in at
 * least one runtime dependency set, or in lockfiles that do not say. Decided
 * per lockfile (`lockfileScope`) and combined pessimistically: one runtime
@@ -1872,8 +2058,12 @@ function lockfileScope(path, groups) {
 * install script in any group.
 */
 function dependencyScope(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const entries = Object.entries(finding.dependencyGroups ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return scopeFromGroups(finding.dependencyGroups);
+}
+/** The scope read from per-lockfile groups alone: for an inventory record, which is a package by construction. */
+function scopeFromGroups(dependencyGroups) {
+	const entries = Object.entries(dependencyGroups ?? {});
 	if (entries.length === 0) return "unknown";
 	return combineScopes(entries.map(([path, groups]) => lockfileScope(path, Array.isArray(groups) ? groups : [])));
 }
@@ -1891,8 +2081,12 @@ function combineScopes(scopes) {
 * remediation step already finds every resolved copy and its parent itself.
 */
 function dependencyRelation(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const values = Object.values(finding.dependencyRelation ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return relationFromLockfiles(finding.dependencyRelation);
+}
+/** The relation read from per-lockfile answers alone: for an inventory record, which is a package by construction. */
+function relationFromLockfiles(dependencyRelation) {
+	const values = Object.values(dependencyRelation ?? {});
 	if (values.includes("direct")) return "direct";
 	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
 	return "unknown";
@@ -2436,7 +2630,7 @@ function importStatusOf(product) {
 /** Why a side of the timeline is empty, for a list or a miss that shows one. */
 function emptyOriginNote(origin, product) {
 	const imported = isImportedProduct(product);
-	if (origin === "plan") return imported ? `This product was imported, so no discovery chain was generated for it: its derived documents are on the reality side. Only the documents a person writes (${PLAN_ONLY_DOCUMENT_TYPES.map(productDocumentName).join(", ")}) would appear here.` : "No plan documents are published yet: they are written during discovery in Taiga.";
+	if (origin === "plan") return imported ? `This product is set up from its code (an import), so no discovery chain is generated for it: its derived documents are on the reality side. Only the documents a person writes (${PLAN_ONLY_DOCUMENT_TYPES.map(productDocumentName).join(", ")}) would appear here.` : "No plan documents are published yet: they are written during discovery in Taiga.";
 	if (!imported) return "No reality documents yet: they are derived from the code once the first initiative is done (a merged pull request marks it done) or the repository is pushed to. Until then read the plan side.";
 	switch (importStatusOf(product)) {
 		case "pending": return "No reality documents yet: the import has not started. taiga_start_import starts it once a repository is linked; taiga_get_product's readiness says whether one is.";
@@ -2506,7 +2700,7 @@ const BY_ARGUMENT = {
 /** Where an argument means something else on one tool, or the tool's 404 needs its own word. */
 const BY_TOOL = {
 	taiga_resolve_action: () => "taiga_list_action_required lists the items with their IDs.",
-	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and taiga_plan_again asks for a new one." : ITEM_ID_HINT
+	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and names the call that asks for one (taiga_queue_initiative off the line, taiga_plan_again for a failed plan)." : ITEM_ID_HINT
 };
 /**
 * What the API calls the thing each ID names, as its 404 says it ("Environment
@@ -3145,7 +3339,7 @@ const SEARCH_PAGE_LIMIT = 10;
 * the whole list to find its ID. `more` is true when it stopped before the end.
 */
 async function searchPages(fetchPage, query, text, limit, keep = () => true, nameOf) {
-	const needle = query.toLowerCase();
+	const needle = searchable(query);
 	const rows = [];
 	const names = [];
 	let cursor;
@@ -3155,7 +3349,7 @@ async function searchPages(fetchPage, query, text, limit, keep = () => true, nam
 		for (const [at, row] of page.entries()) {
 			if (!keep(row)) continue;
 			if (nameOf) names.push(nameOf(row));
-			if (!text(row).some((value) => typeof value === "string" && value.toLowerCase().includes(needle))) continue;
+			if (!text(row).some((value) => typeof value === "string" && searchable(value).includes(needle))) continue;
 			rows.push(row);
 			if (rows.length === limit) return {
 				rows,
@@ -3178,12 +3372,18 @@ async function searchPages(fetchPage, query, text, limit, keep = () => true, nam
 	};
 }
 /**
+* Text as a search compares it: lower case, punctuation as spaces, so "sign in" finds "Staff Sign-In" (PRO-2823).
+*/
+function searchable(text) {
+	return text.normalize("NFC").toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim() || text.toLowerCase();
+}
+/**
 * Up to three names close to a query that matched none: a typo of the name or
 * of one of its words, within a third of the query's length ("tiaga", "rally"
 * for ref-rallly), or a shared word of three letters or more. Closest first.
 */
 function closestNames(query, names) {
-	const words = (text) => text.toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length >= 3);
+	const words = (text) => searchable(text).split(" ").filter((word) => word.length >= 3);
 	const wanted = new Set(words(query));
 	const ranked = names.map((name) => ({
 		name,
@@ -4064,15 +4264,28 @@ function runOutcome(run) {
 		}[disposition] ?? status
 	};
 }
+/** Words a sentence does not end at: "e.g." and the like, and a lone initial. */
+const ABBREVIATION = /(?:\b(?:e\.g|i\.e|etc|vs|cf|incl|approx)|(?:^|\s)[A-Za-z])\.$/i;
+/** A finding's first sentence, capped: it ends at . ! or ? before white space, but not at an abbreviation. */
+function firstSentence$1(text) {
+	let sentence = text;
+	for (const match of text.matchAll(/[.!?](?=\s|$)/g)) {
+		const end = match.index + 1;
+		if (ABBREVIATION.test(text.slice(0, end))) continue;
+		sentence = text.slice(0, end);
+		break;
+	}
+	return sentence.length > 160 ? `${sentence.slice(0, 157)}...` : sentence;
+}
 /**
 * What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
 * it recorded them, how many.
 */
 function hardeningSaid(blocking, named) {
 	const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix`;
-	if (named.length === 0) return `${count}; the run records how many, not which.`;
+	if (named.length === 0) return `${count}; this run predates recording which.`;
 	const shown = named.slice(0, 3).map((finding) => {
-		const message = String(finding["message"]);
+		const message = firstSentence$1(String(finding["message"]));
 		const where = finding["line"] ? `${String(finding["path"])}:${String(finding["line"])}` : String(finding["path"]);
 		return `${message} (${String(finding["tool"])}, ${where})`;
 	});
@@ -4907,7 +5120,7 @@ function registerBacklogReads(server, client) {
 		}
 		if (params.cursor !== void 0) return toolError("VALIDATION_ERROR", "A title search answers one page; narrow the title, or leave query out to page through a column.");
 		let closedSeen = 0;
-		const needle = query.toLowerCase();
+		const needle = searchable(query);
 		const found = await searchPages((cursor) => client.listBacklogItems(id, {
 			...apiFilters,
 			...column === "open" ? { open: void 0 } : {},
@@ -4915,14 +5128,15 @@ function registerBacklogReads(server, client) {
 			cursor
 		}), query, (row) => [row.title], params.limit ?? 25, (row) => {
 			if (column !== "open" || !["done", "canceled"].includes(String(row.state))) return true;
-			if (String(row.title).toLowerCase().includes(needle)) closedSeen += 1;
+			if (searchable(String(row.title)).includes(needle)) closedSeen += 1;
 			return false;
-		});
+		}, (row) => String(row.title));
 		const hidden = column === "open" && !found.more ? closedSeen : 0;
 		return toolResult({
 			...page(situatedRows(found.rows), null),
 			...hidden > 0 ? { closedMatches: `${hidden} done or canceled initiative${hidden === 1 ? " also matches" : "s also match"}; column: 'all' lists them.` } : {},
-			...found.more ? { more: "There may be more than the limit carries: narrow the title, or pick one column." } : {}
+			...found.more ? { more: "There may be more than the limit carries: narrow the title, or pick one column." } : {},
+			...hidden === 0 ? nearNote(found.near) : {}
 		});
 	}));
 	server.registerTool("taiga_get_initiative", {
@@ -5178,6 +5392,11 @@ const FINDING_ROW_FIELDS = [
 * read off the row; remediableBy stays as the sweep recorded it.
 */
 function withFixability(row) {
+	if (row["kind"] === "license_violation") return {
+		...row,
+		fixable: false,
+		fixNote: "A license violation has no fix version: review the license or replace the package; taiga_fix_finding refuses it."
+	};
 	if ((row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency") && !row["recommendedVersion"] && row["remediableBy"] === "coding_agent") return {
 		...row,
 		fixable: false,
@@ -5195,7 +5414,7 @@ function withDependencyScope(row, { keepGroups = false } = {}) {
 		...row,
 		dependencyRelation: void 0
 	} : lean;
-	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	if (!isDependencyFindingKind(String(row["kind"]))) return rest;
 	const kind = row["kind"];
 	return {
 		...rest,
@@ -5387,7 +5606,7 @@ function registerMaintenanceTools(server, client) {
 		const summary = standingSummary(standing);
 		const assessment = standing.assessment;
 		const assessedAt = typeof assessment?.assessedAt === "string" ? assessment.assessedAt : null;
-		const note = assessment?.state === "never" ? "Never assessed: the documents have not been checked against the policies yet, so nothing here is an all-clear. An assessment runs when the reality documents are derived or refreshed (taiga_refresh_reality_documents, paid work: ask first)." : summary.controlsMet + summary.controlsNotApplicable === 0 && assessedAt ? `No control is recorded as met or not applicable: the last assessment (${assessedAt}) either ran before assessments recorded those verdicts, or found none. Until the next one, only violations are known; the rest are not assessed, which is no pass.` : null;
+		const note = assessment?.state === "never" ? "Never assessed: the documents have not been checked against the policies yet, so nothing here is an all-clear. " + (standing.canAssess === false && standing.hasPolicies !== false ? "It has no reality documents to assess yet: an import derives them (taiga_start_import for a product set up from its code, paid work: ask first), and the assessment follows." : "An assessment runs when the reality documents are derived or refreshed (taiga_refresh_reality_documents, paid work: ask first).") : summary.controlsMet + summary.controlsNotApplicable === 0 && assessedAt ? `No control is recorded as met or not applicable: the last assessment (${assessedAt}) either ran before assessments recorded those verdicts, or found none. Until the next one, only violations are known; the rest are not assessed, which is no pass.` : null;
 		const resolvedAny = Array.isArray(standing.resolvedDivergences) && standing.resolvedDivergences.length > 0;
 		const wording = violations.length > 0 || resolvedAny ? { wordingNote: "A violation's evidence is from its assessedAt; its title and summary may be from when it was first recorded. Where they disagree, the evidence is current." } : {};
 		if (params.controlId && params.violationId) return toolError("VALIDATION_ERROR", "Name either a control (controlId) or one violation (violationId), not both.");
@@ -5400,8 +5619,8 @@ function registerMaintenanceTools(server, client) {
 				...control,
 				...control.state === "no_evidence" ? { meaning: "Not assessed: no finding or violation is recorded against it, and the documents were not found to show it met. That is no evidence either way, not a pass." } : {},
 				...control.assessment == null && (control.state === "breached" || control.state === "diverged") ? { assessmentNote: "No met or not-applicable verdict is shown: an open finding or violation against the control outranks one." } : {},
+				...Number(control.findingCount ?? 0) > 0 ? { findingsNote: `${String(control.findingCount)} open scanner finding${control.findingCount === 1 ? "" : "s"} breach it; taiga_list_findings (productId) lists them with the controls each breaches. violations below are the documents' only.` } : {},
 				violations: pickFields(own, VIOLATION_FIELDS),
-				...Number(control.findingCount ?? 0) > 0 ? { findingsNote: `${String(control.findingCount)} open scanner finding${control.findingCount === 1 ? "" : "s"} breach it; taiga_list_findings (productId) lists them with the controls each breaches.` } : {},
 				...own.length > 0 ? wording : {}
 			});
 		}
@@ -5659,7 +5878,7 @@ const STALE_CHECKS = 10;
 async function staleReviews(client, rows) {
 	const byId = new Map(rows.filter((row) => row["kind"] === "review_pr" && row["subjectType"] === "build_run").map((row) => [String(row["id"]), row]));
 	const candidates = [...byId.values()].slice(0, STALE_CHECKS);
-	let unchecked = byId.size - candidates.length;
+	const uncheckedIds = new Set([...byId.keys()].slice(STALE_CHECKS));
 	const out = /* @__PURE__ */ new Map();
 	await Promise.all(candidates.map(async (row) => {
 		try {
@@ -5667,19 +5886,20 @@ async function staleReviews(client, rows) {
 			if (run["prMerged"] === true) return void out.set(String(row["id"]), "its pull request has merged");
 			if (run["prState"] === "closed") return void out.set(String(row["id"]), "its pull request was closed");
 			if (typeof run["backlogItemId"] !== "string") return;
-			if (!client.hasCapability("backlog:read")) return void (unchecked += 1);
+			if (!client.hasCapability("backlog:read")) return void uncheckedIds.add(String(row["id"]));
 			const item = (await client.getBacklogItem(run["backlogItemId"])).data;
 			if (item["state"] === "canceled" || item["status"] === "canceled") out.set(String(row["id"]), "its initiative was canceled; the pull request is still open on the forge");
 			else if (item["state"] === "done" || item["status"] === "done") out.set(String(row["id"]), "its initiative is done; this run is not the one that landed it");
 		} catch (error) {
 			if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
-			unchecked += 1;
+			uncheckedIds.add(String(row["id"]));
 		}
 	}));
-	unchecked += await staleBacklogReviews(client, rows, out);
+	await staleBacklogReviews(client, rows, out, uncheckedIds);
 	return {
 		stale: out,
-		unchecked
+		unchecked: uncheckedIds.size,
+		uncheckedIds
 	};
 }
 /**
@@ -5687,12 +5907,13 @@ async function staleReviews(client, rows) {
 * waiting 15 days on a product whose initiatives had all moved on, with nothing an agent could act on. Best effort,
 * a handful of products; returns how many could not be checked.
 */
-async function staleBacklogReviews(client, rows, out) {
+async function staleBacklogReviews(client, rows, out, unchecked) {
 	const asks = [...new Map(rows.filter((row) => row["kind"] === "review_backlog" && typeof row["productId"] === "string").map((row) => [String(row["id"]), row])).values()];
-	if (asks.length === 0) return 0;
-	if (!client.hasCapability("backlog:read")) return asks.length;
+	const skip = (which) => which.forEach((row) => unchecked.add(String(row["id"])));
+	if (asks.length === 0) return;
+	if (!client.hasCapability("backlog:read")) return skip(asks);
 	const checked = [...new Set(asks.map((row) => String(row["productId"])))].slice(0, STALE_CHECKS);
-	let unchecked = asks.filter((row) => !checked.includes(String(row["productId"]))).length;
+	skip(asks.filter((row) => !checked.includes(String(row["productId"]))));
 	const empty = /* @__PURE__ */ new Set();
 	await Promise.all(checked.map(async (productId) => {
 		try {
@@ -5703,11 +5924,10 @@ async function staleBacklogReviews(client, rows, out) {
 			empty.add(productId);
 		} catch (error) {
 			if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
-			unchecked += asks.filter((row) => row["productId"] === productId).length;
+			skip(asks.filter((row) => row["productId"] === productId));
 		}
 	}));
 	for (const row of asks) if (empty.has(String(row["productId"]))) out.set(String(row["id"]), "no initiative is in the backlog or todo now: the ones it asked about have moved on");
-	return unchecked;
 }
 /**
 * One product's Action Required as counts, the way the list's summary counts them: open is what still stands and is
@@ -5733,6 +5953,35 @@ function isDue(row, now) {
 }
 /** Pages read for the summary; past this it says it counted only those. */
 const SUMMARY_PAGE = 100;
+/** Pages the summary reads before it says it stopped: 1,000 items. */
+const SUMMARY_PAGES = 10;
+/** Every item the summary counts, up to SUMMARY_PAGES pages; nextCursor set when it stopped short. Null on failure. */
+async function everyItem(client, query, orNull = true) {
+	const data = [];
+	let cursor;
+	try {
+		for (let index = 0; index < SUMMARY_PAGES; index += 1) {
+			const page = await client.listInbox({
+				...query,
+				limit: SUMMARY_PAGE,
+				cursor
+			});
+			data.push(...page.data);
+			if (!page.nextCursor) return {
+				data,
+				nextCursor: null
+			};
+			cursor = page.nextCursor;
+		}
+		return {
+			data,
+			nextCursor: cursor ?? null
+		};
+	} catch (error) {
+		if (orNull && (error instanceof TaigaApiError || isNetworkFailure(error))) return null;
+		throw error;
+	}
+}
 const SETUP_TASK_FIELDS = [
 	"id",
 	"productId",
@@ -5827,14 +6076,7 @@ function registerInboxTools(server, client) {
 			...query,
 			...first ? { withTotal: true } : {}
 		});
-		const overview = !first || resolved ? null : !result.nextCursor ? result : await client.listInbox({
-			...query,
-			limit: SUMMARY_PAGE,
-			cursor: void 0
-		}).catch((error) => {
-			if (error instanceof TaigaApiError || isNetworkFailure(error)) return null;
-			throw error;
-		});
+		const overview = !first || resolved ? null : !result.nextCursor ? result : await everyItem(client, query);
 		const now = Date.now();
 		const due_ = (row) => isDue(row, now);
 		const rows = result.data;
@@ -5843,26 +6085,35 @@ function registerInboxTools(server, client) {
 		const overviewDue = overview ? overview.data.filter(due_) : [];
 		const checked = resolved ? {
 			stale: /* @__PURE__ */ new Map(),
-			unchecked: 0
+			unchecked: 0,
+			uncheckedIds: /* @__PURE__ */ new Set()
 		} : await staleReviews(client, [...due, ...overviewDue]);
 		const stale = checked.stale;
 		return toolResult({
 			...overview ? {
 				summary: summaryOf(overviewDue, stale),
-				...overview.nextCursor ? { summaryNote: `The summary counts the first ${SUMMARY_PAGE} items` + (params.productId ? "." : "; productId narrows it to one product.") } : {}
+				...overview.nextCursor ? { summaryNote: `The summary counts the first 1000 items` + (params.productId ? "." : "; productId narrows it to one product.") } : {}
 			} : {},
 			...page(due.map((row) => {
 				const item = itemRow(row, now, full === true, client.hasCapability("backlog:read"));
 				const why = stale.get(String(row["id"]));
-				return why ? {
+				if (why) return {
 					...item,
 					stale: why
+				};
+				return checked.uncheckedIds.has(String(row["id"])) ? {
+					...item,
+					staleChecked: false
 				} : item;
 			}), result.nextCursor),
 			...totalOf(result),
-			...overview && typeof result.totalCount === "number" && (stale.size > 0 || overview.data.length > overviewDue.length || overview.nextCursor) ? { totalNote: "totalCount counts every item, stale and snoozed ones too; summary.open does not" + (overview.nextCursor ? `, and counts only the first ${SUMMARY_PAGE}.` : ".") } : {},
+			...overview && typeof result.totalCount === "number" && (stale.size > 0 || overview.data.length > overviewDue.length || overview.nextCursor) ? { totalNote: "totalCount counts every item, stale and snoozed ones too; summary.open does not" + (overview.nextCursor ? `, and counts only the first 1000.` : ".") } : {},
 			...hidden > 0 ? { snoozedHidden: hidden } : {},
-			...checked.unchecked > 0 ? { staleNote: `${checked.unchecked} review${checked.unchecked === 1 ? " was" : "s were"} not checked for whether its subject moved on (past the cap, or the read was refused), so a row without stale may still be stale: taiga_get_initiative or taiga_get_run on its subject says.` } : {}
+			...checked.unchecked > 0 ? (() => {
+				const onPage = due.filter((row) => checked.uncheckedIds.has(String(row["id"]))).length;
+				const beyond = checked.unchecked - onPage;
+				return { staleNote: `${[...onPage > 0 ? [`${onPage} review${onPage === 1 ? "" : "s"} on this page could not be checked for whether the subject moved on: those rows say staleChecked: false, and their readWith read tells`] : [], ...beyond > 0 ? [`${beyond} review${beyond === 1 ? "" : "s"} counted in the summary but not on this page could not be checked either, so the summary counts them open`] : []].join("; ")}.` };
+			})() : {}
 		});
 	}));
 	server.registerTool("taiga_list_setup_tasks", {
@@ -6227,13 +6478,10 @@ const CONTEXT_RUN_SAID = [
 * the list's disagree (18 open here, 16 there), because this one counted stale reviews and put-off items as open.
 */
 async function attentionPart(client, productId) {
-	const result = await client.listInbox({
-		productId,
-		limit: 100
-	});
+	const result = await everyItem(client, { productId }, false);
 	return {
 		...await attentionCounts(client, result.data),
-		...result.nextCursor ? { note: "These count the first 100 items; taiga_list_action_required pages the rest." } : {}
+		...result.nextCursor ? { note: "These count the first 1000 items; taiga_list_action_required pages the rest." } : {}
 	};
 }
 /** The latest sweep and what it left open, as counts; taiga_list_findings lists them. */
@@ -6317,7 +6565,7 @@ function registerContextTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_get_product_context", {
 		title: "Get product context",
-		description: `Read where a product stands in one call; the first read for any product question. Name it by ID, slug or git remote URL. Returns product (in setup, readiness and next move), factory with its instructions, specification and architecture outlines (section ids, sizes), policies with section counts, a count of initiatives per board column (done and canceled too) and up to ${BACKLOG_IN_CONTEXT} open ones, a person's turn first (taiga_list_initiatives lists the rest), repositories, the latest five runs (taiga_list_runs has more), and counts for Action Required, open findings and policy violations. A part that failed is under unavailable, one the key cannot read under notGranted; neither shows as empty. documents: budget returns whole sections up to about ${DOCUMENT_BUDGET / 1e3}k characters each, full returns all.`,
+		description: `Read where a product stands in one call; the first read for any product question. Name it by ID, slug or git remote URL. Returns product (in setup, readiness and next move), factory with its instructions, specification and architecture outlines (section ids, sizes), policies with section counts, a count of initiatives per board column (done and canceled too) and up to ${BACKLOG_IN_CONTEXT} open ones, a person's turn first (taiga_list_initiatives lists them all, newest first), repositories, the latest five runs (taiga_list_runs has more), and counts for Action Required, open findings and policy violations. A part that failed is under unavailable, one the key cannot read under notGranted; neither shows as empty. documents: budget returns whole sections up to about ${DOCUMENT_BUDGET / 1e3}k characters each, full returns all.`,
 		inputSchema: z.object({
 			productId: productId.optional(),
 			slug: slug.optional(),
@@ -21990,6 +22238,8 @@ const MISSING_DOCUMENTS_HOW = "An imported product gets them from its import (ta
 * allowDuplicateName says the person means it.
 */
 const allowDuplicateName = z.boolean().optional().describe("Create it even when one with the same name exists (default false: refused, naming the existing one)");
+/** The same choice on a rename (PRO-2823). */
+const allowDuplicateRename = z.boolean().optional().describe("Rename it even when another has the new name (default false: refused, naming the existing one)");
 /**
 * A product name is refused when taken in its own factory only; the same name
 * in another factory is allowed and the slug takes a suffix. A review read the
@@ -22072,13 +22322,25 @@ function registerSetupTools(server, client) {
 		}));
 		server.registerTool("taiga_rename_factory", {
 			title: "Rename a factory",
-			description: "Rename a factory. Its slug follows the new name, so links to it change; products, members, knowledge and instructions stay as they are.",
+			description: "Rename a factory. Its slug follows the new name, so links to it change; products, members, knowledge and instructions stay as they are. A name another factory has is refused, as on create.",
 			inputSchema: z.object({
 				factoryId,
-				name: z.string().trim().min(1).max(255).describe("The new name")
+				name: z.string().trim().min(1).max(255).describe("The new name"),
+				allowDuplicateName: allowDuplicateRename
 			}),
 			annotations: OPERATE_SETTING
-		}, (params) => runTool(async () => toolResult(pickFields([(await client.updateFactory(params.factoryId, { name: params.name })).data], FACTORY_FIELDS)[0])));
+		}, (params) => runTool(async () => {
+			try {
+				return toolResult(pickFields([(await client.updateFactory(params.factoryId, {
+					name: params.name,
+					refuseDuplicateName: !params.allowDuplicateName
+				})).data], FACTORY_FIELDS)[0]);
+			} catch (error) {
+				const refused = duplicateName("factory", error, "in this organization");
+				if (refused) return refused;
+				throw error;
+			}
+		}));
 		server.registerTool("taiga_preview_product_move", {
 			title: "Preview moving a product to another factory",
 			description: "Show who gains and who loses access if a product moves to another factory: the source factory's members lose it, the target's gain it; people in both, the product's own members, and owners and admins keep it, named with why. Show it to the person before taiga_move_product.",
@@ -22160,21 +22422,32 @@ function registerSetupTools(server, client) {
 		inputSchema: z.object({
 			productId,
 			name: z.string().trim().min(1).max(255).optional().describe("A new name"),
+			allowDuplicateName: allowDuplicateRename,
 			...buildScope,
 			deploymentNotes: deploymentNotes.nullable().optional(),
 			emitDesignStandards: z.boolean().nullable().optional().describe("Inherit the organization's design standards; null follows the default")
 		}),
 		annotations: OPERATE_SETTING
 	}, (params) => runTool(async () => {
-		const { productId: id, ...changes } = params;
+		const { productId: id, allowDuplicateName: allowed, ...changes } = params;
 		if (Object.values(changes).every((value) => value === void 0)) return toolError("VALIDATION_ERROR", "Change at least one setting.");
 		const contradiction = notesWithNothingToDescribe(params);
 		if (contradiction) return contradiction;
-		const updated = (await client.updateProduct(id, changes)).data;
+		let updated;
+		try {
+			updated = (await client.updateProduct(id, {
+				...changes,
+				...changes.name !== void 0 ? { refuseDuplicateName: !allowed } : {}
+			})).data;
+		} catch (error) {
+			const refused = duplicateName("product", error, "in this factory");
+			if (refused) return refused;
+			throw error;
+		}
 		const warnings = missingNotesWarning(updated);
 		return toolResult({
-			...await productRow(client, updated),
-			...warnings.length > 0 ? { warnings } : {}
+			...warnings.length > 0 ? { warnings } : {},
+			...await productRow(client, updated)
 		});
 	}));
 	server.registerTool("taiga_refresh_reality_documents", {
@@ -22783,7 +23056,7 @@ function registerAllTools(server, client, options = {}) {
 function registerWhoami(server, client, registered) {
 	server.registerTool("taiga_whoami", {
 		title: "Who am I",
-		description: "Read who this API key acts as: the API it talks to (api, which says the environment), the person's email and organization role, the key's scopes (null means every capability the person has), its capabilities, and its tools split into reads, writes, and ask-first writes (paid agent work, changes others see). A tool the key cannot use is not offered at all.",
+		description: "Read who this API key acts as: the API host it talks to (api), the person's email and organization role, the key's scopes (null means every capability the person has), its capabilities, and its tools split into reads, writes, and ask-first writes (paid agent work, changes others see). A tool the key cannot use is not offered at all.",
 		inputSchema: z.object({}),
 		annotations: READ_ONLY
 	}, () => runTool(async () => {
@@ -22822,7 +23095,7 @@ const SERVER_INSTRUCTIONS = [
 	"Taiga is a policy-aware software delivery platform. Use these tools (taiga_*) for anything about a Taiga",
 	"product: its initiatives, runs, policies, findings, deployments or setup.",
 	"",
-	"**Which read.** Where a product stands (counts, not detail): taiga_get_product_context, by remote URL, slug",
+	"**Which read.** Where a product stands (counts, first rows): taiga_get_product_context, by remote URL, slug",
 	"or ID. What waits on people: taiga_list_action_required. A policy: taiga_get_organization_document (sections:",
 	"[], or a control id such as SEC-5.1), or the taiga://documents/{type} resources. Findings: taiga_list_findings.",
 	"One initiative or run: taiga_get_initiative, taiga_get_run. What this key may call: taiga_whoami.",
@@ -22830,10 +23103,10 @@ const SERVER_INSTRUCTIONS = [
 	"**Words.** An initiative is a unit of work, on a board of columns (backlog, todo, queue, plan, build, done,",
 	"canceled); plan and build are stations, and the line starts the next queued initiative when both are empty. A",
 	"run is one coding-agent attempt; hardening is its security pass; handed back means a person must act. A gate is",
-	"a person's review; a sweep is a scan for findings; standing is how a product meets the policies. Discovery sets",
-	"up a new product, from a web conversation or an import. A factory owns products.",
+	"a person's review; a sweep is a scan for findings; standing is how a product meets policy. Discovery sets",
+	"up a new product, from a web conversation or an import. Factories own products.",
 	"",
-	"**IDs** are UUIDs; the product, factory and initiative lists take query (product and factory misses name the",
+	"**IDs** are UUIDs; the product, factory and initiative lists take query (product and factory misses may name the",
 	"closest). A NOT_FOUND names the tool that lists the right ones. Lists page with nextCursor. outcome, situation",
 	"and nextStep are one-sentence summaries; setup writes return readiness. Product documents have two timelines:",
 	"plan (intent) and reality (from the code).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-rc.496",
+  "version": "0.26.0-rc.504",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",