@taiga-ai/mcp-server 0.26.0-rc.500 → 0.26.0-rc.504

package/dist/index.js

@@ -1919,6 +1919,7 @@ const ENVIRONMENT_TYPES = [
 const MAINTENANCE_FINDING_KINDS = [
 	"vulnerable_dependency",
 	"outdated_dependency",
+	"license_violation",
 	"secret",
 	"sast",
 	"iac_misconfig"
@@ -1943,7 +1944,11 @@ const CODE_REMEDIATION_KINDS = [
 	"iac_misconfig"
 ];
 new Map(Object.entries({
-	deps: ["vulnerable_dependency", "outdated_dependency"],
+	deps: [
+		"vulnerable_dependency",
+		"outdated_dependency",
+		"license_violation"
+	],
 	secrets: ["secret"],
 	sast: ["sast"],
 	iac: ["iac_misconfig"]
@@ -2030,6 +2035,19 @@ function lockfileScope(path, groups) {
 	}
 }
 /**
+* The kinds that are a package in a lockfile (PRO-2862): the ones with a
+* dependency scope, a relation and an inventory entry. A code kind reuses the
+* dependency columns for its rule and category and has none of those.
+*/
+const DEPENDENCY_FINDING_KINDS = [
+	"vulnerable_dependency",
+	"outdated_dependency",
+	"license_violation"
+];
+function isDependencyFindingKind(kind) {
+	return DEPENDENCY_FINDING_KINDS.includes(kind);
+}
+/**
 * Whether a dependency finding sits only in development dependencies, in at
 * least one runtime dependency set, or in lockfiles that do not say. Decided
 * per lockfile (`lockfileScope`) and combined pessimistically: one runtime
@@ -2040,8 +2058,12 @@ function lockfileScope(path, groups) {
 * install script in any group.
 */
 function dependencyScope(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const entries = Object.entries(finding.dependencyGroups ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return scopeFromGroups(finding.dependencyGroups);
+}
+/** The scope read from per-lockfile groups alone: for an inventory record, which is a package by construction. */
+function scopeFromGroups(dependencyGroups) {
+	const entries = Object.entries(dependencyGroups ?? {});
 	if (entries.length === 0) return "unknown";
 	return combineScopes(entries.map(([path, groups]) => lockfileScope(path, Array.isArray(groups) ? groups : [])));
 }
@@ -2059,8 +2081,12 @@ function combineScopes(scopes) {
 * remediation step already finds every resolved copy and its parent itself.
 */
 function dependencyRelation(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const values = Object.values(finding.dependencyRelation ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return relationFromLockfiles(finding.dependencyRelation);
+}
+/** The relation read from per-lockfile answers alone: for an inventory record, which is a package by construction. */
+function relationFromLockfiles(dependencyRelation) {
+	const values = Object.values(dependencyRelation ?? {});
 	if (values.includes("direct")) return "direct";
 	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
 	return "unknown";
@@ -2604,7 +2630,7 @@ function importStatusOf(product) {
 /** Why a side of the timeline is empty, for a list or a miss that shows one. */
 function emptyOriginNote(origin, product) {
 	const imported = isImportedProduct(product);
-	if (origin === "plan") return imported ? `This product was imported, so no discovery chain was generated for it: its derived documents are on the reality side. Only the documents a person writes (${PLAN_ONLY_DOCUMENT_TYPES.map(productDocumentName).join(", ")}) would appear here.` : "No plan documents are published yet: they are written during discovery in Taiga.";
+	if (origin === "plan") return imported ? `This product is set up from its code (an import), so no discovery chain is generated for it: its derived documents are on the reality side. Only the documents a person writes (${PLAN_ONLY_DOCUMENT_TYPES.map(productDocumentName).join(", ")}) would appear here.` : "No plan documents are published yet: they are written during discovery in Taiga.";
 	if (!imported) return "No reality documents yet: they are derived from the code once the first initiative is done (a merged pull request marks it done) or the repository is pushed to. Until then read the plan side.";
 	switch (importStatusOf(product)) {
 		case "pending": return "No reality documents yet: the import has not started. taiga_start_import starts it once a repository is linked; taiga_get_product's readiness says whether one is.";
@@ -2674,7 +2700,7 @@ const BY_ARGUMENT = {
 /** Where an argument means something else on one tool, or the tool's 404 needs its own word. */
 const BY_TOOL = {
 	taiga_resolve_action: () => "taiga_list_action_required lists the items with their IDs.",
-	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and taiga_plan_again asks for a new one." : ITEM_ID_HINT
+	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and names the call that asks for one (taiga_queue_initiative off the line, taiga_plan_again for a failed plan)." : ITEM_ID_HINT
 };
 /**
 * What the API calls the thing each ID names, as its 404 says it ("Environment
@@ -3313,7 +3339,7 @@ const SEARCH_PAGE_LIMIT = 10;
 * the whole list to find its ID. `more` is true when it stopped before the end.
 */
 async function searchPages(fetchPage, query, text, limit, keep = () => true, nameOf) {
-	const needle = query.toLowerCase();
+	const needle = searchable(query);
 	const rows = [];
 	const names = [];
 	let cursor;
@@ -3323,7 +3349,7 @@ async function searchPages(fetchPage, query, text, limit, keep = () => true, nam
 		for (const [at, row] of page.entries()) {
 			if (!keep(row)) continue;
 			if (nameOf) names.push(nameOf(row));
-			if (!text(row).some((value) => typeof value === "string" && value.toLowerCase().includes(needle))) continue;
+			if (!text(row).some((value) => typeof value === "string" && searchable(value).includes(needle))) continue;
 			rows.push(row);
 			if (rows.length === limit) return {
 				rows,
@@ -3346,12 +3372,18 @@ async function searchPages(fetchPage, query, text, limit, keep = () => true, nam
 	};
 }
 /**
+* Text as a search compares it: lower case, punctuation as spaces, so "sign in" finds "Staff Sign-In" (PRO-2823).
+*/
+function searchable(text) {
+	return text.normalize("NFC").toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim() || text.toLowerCase();
+}
+/**
 * Up to three names close to a query that matched none: a typo of the name or
 * of one of its words, within a third of the query's length ("tiaga", "rally"
 * for ref-rallly), or a shared word of three letters or more. Closest first.
 */
 function closestNames(query, names) {
-	const words = (text) => text.toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length >= 3);
+	const words = (text) => searchable(text).split(" ").filter((word) => word.length >= 3);
 	const wanted = new Set(words(query));
 	const ranked = names.map((name) => ({
 		name,
@@ -4232,15 +4264,28 @@ function runOutcome(run) {
 		}[disposition] ?? status
 	};
 }
+/** Words a sentence does not end at: "e.g." and the like, and a lone initial. */
+const ABBREVIATION = /(?:\b(?:e\.g|i\.e|etc|vs|cf|incl|approx)|(?:^|\s)[A-Za-z])\.$/i;
+/** A finding's first sentence, capped: it ends at . ! or ? before white space, but not at an abbreviation. */
+function firstSentence$1(text) {
+	let sentence = text;
+	for (const match of text.matchAll(/[.!?](?=\s|$)/g)) {
+		const end = match.index + 1;
+		if (ABBREVIATION.test(text.slice(0, end))) continue;
+		sentence = text.slice(0, end);
+		break;
+	}
+	return sentence.length > 160 ? `${sentence.slice(0, 157)}...` : sentence;
+}
 /**
 * What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
 * it recorded them, how many.
 */
 function hardeningSaid(blocking, named) {
 	const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix`;
-	if (named.length === 0) return `${count}; the run records how many, not which.`;
+	if (named.length === 0) return `${count}; this run predates recording which.`;
 	const shown = named.slice(0, 3).map((finding) => {
-		const message = String(finding["message"]);
+		const message = firstSentence$1(String(finding["message"]));
 		const where = finding["line"] ? `${String(finding["path"])}:${String(finding["line"])}` : String(finding["path"]);
 		return `${message} (${String(finding["tool"])}, ${where})`;
 	});
@@ -5075,7 +5120,7 @@ function registerBacklogReads(server, client) {
 		}
 		if (params.cursor !== void 0) return toolError("VALIDATION_ERROR", "A title search answers one page; narrow the title, or leave query out to page through a column.");
 		let closedSeen = 0;
-		const needle = query.toLowerCase();
+		const needle = searchable(query);
 		const found = await searchPages((cursor) => client.listBacklogItems(id, {
 			...apiFilters,
 			...column === "open" ? { open: void 0 } : {},
@@ -5083,14 +5128,15 @@ function registerBacklogReads(server, client) {
 			cursor
 		}), query, (row) => [row.title], params.limit ?? 25, (row) => {
 			if (column !== "open" || !["done", "canceled"].includes(String(row.state))) return true;
-			if (String(row.title).toLowerCase().includes(needle)) closedSeen += 1;
+			if (searchable(String(row.title)).includes(needle)) closedSeen += 1;
 			return false;
-		});
+		}, (row) => String(row.title));
 		const hidden = column === "open" && !found.more ? closedSeen : 0;
 		return toolResult({
 			...page(situatedRows(found.rows), null),
 			...hidden > 0 ? { closedMatches: `${hidden} done or canceled initiative${hidden === 1 ? " also matches" : "s also match"}; column: 'all' lists them.` } : {},
-			...found.more ? { more: "There may be more than the limit carries: narrow the title, or pick one column." } : {}
+			...found.more ? { more: "There may be more than the limit carries: narrow the title, or pick one column." } : {},
+			...hidden === 0 ? nearNote(found.near) : {}
 		});
 	}));
 	server.registerTool("taiga_get_initiative", {
@@ -5346,6 +5392,11 @@ const FINDING_ROW_FIELDS = [
 * read off the row; remediableBy stays as the sweep recorded it.
 */
 function withFixability(row) {
+	if (row["kind"] === "license_violation") return {
+		...row,
+		fixable: false,
+		fixNote: "A license violation has no fix version: review the license or replace the package; taiga_fix_finding refuses it."
+	};
 	if ((row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency") && !row["recommendedVersion"] && row["remediableBy"] === "coding_agent") return {
 		...row,
 		fixable: false,
@@ -5363,7 +5414,7 @@ function withDependencyScope(row, { keepGroups = false } = {}) {
 		...row,
 		dependencyRelation: void 0
 	} : lean;
-	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	if (!isDependencyFindingKind(String(row["kind"]))) return rest;
 	const kind = row["kind"];
 	return {
 		...rest,
@@ -5555,7 +5606,7 @@ function registerMaintenanceTools(server, client) {
 		const summary = standingSummary(standing);
 		const assessment = standing.assessment;
 		const assessedAt = typeof assessment?.assessedAt === "string" ? assessment.assessedAt : null;
-		const note = assessment?.state === "never" ? "Never assessed: the documents have not been checked against the policies yet, so nothing here is an all-clear. An assessment runs when the reality documents are derived or refreshed (taiga_refresh_reality_documents, paid work: ask first)." : summary.controlsMet + summary.controlsNotApplicable === 0 && assessedAt ? `No control is recorded as met or not applicable: the last assessment (${assessedAt}) either ran before assessments recorded those verdicts, or found none. Until the next one, only violations are known; the rest are not assessed, which is no pass.` : null;
+		const note = assessment?.state === "never" ? "Never assessed: the documents have not been checked against the policies yet, so nothing here is an all-clear. " + (standing.canAssess === false && standing.hasPolicies !== false ? "It has no reality documents to assess yet: an import derives them (taiga_start_import for a product set up from its code, paid work: ask first), and the assessment follows." : "An assessment runs when the reality documents are derived or refreshed (taiga_refresh_reality_documents, paid work: ask first).") : summary.controlsMet + summary.controlsNotApplicable === 0 && assessedAt ? `No control is recorded as met or not applicable: the last assessment (${assessedAt}) either ran before assessments recorded those verdicts, or found none. Until the next one, only violations are known; the rest are not assessed, which is no pass.` : null;
 		const resolvedAny = Array.isArray(standing.resolvedDivergences) && standing.resolvedDivergences.length > 0;
 		const wording = violations.length > 0 || resolvedAny ? { wordingNote: "A violation's evidence is from its assessedAt; its title and summary may be from when it was first recorded. Where they disagree, the evidence is current." } : {};
 		if (params.controlId && params.violationId) return toolError("VALIDATION_ERROR", "Name either a control (controlId) or one violation (violationId), not both.");
@@ -5827,7 +5878,7 @@ const STALE_CHECKS = 10;
 async function staleReviews(client, rows) {
 	const byId = new Map(rows.filter((row) => row["kind"] === "review_pr" && row["subjectType"] === "build_run").map((row) => [String(row["id"]), row]));
 	const candidates = [...byId.values()].slice(0, STALE_CHECKS);
-	let unchecked = byId.size - candidates.length;
+	const uncheckedIds = new Set([...byId.keys()].slice(STALE_CHECKS));
 	const out = /* @__PURE__ */ new Map();
 	await Promise.all(candidates.map(async (row) => {
 		try {
@@ -5835,19 +5886,20 @@ async function staleReviews(client, rows) {
 			if (run["prMerged"] === true) return void out.set(String(row["id"]), "its pull request has merged");
 			if (run["prState"] === "closed") return void out.set(String(row["id"]), "its pull request was closed");
 			if (typeof run["backlogItemId"] !== "string") return;
-			if (!client.hasCapability("backlog:read")) return void (unchecked += 1);
+			if (!client.hasCapability("backlog:read")) return void uncheckedIds.add(String(row["id"]));
 			const item = (await client.getBacklogItem(run["backlogItemId"])).data;
 			if (item["state"] === "canceled" || item["status"] === "canceled") out.set(String(row["id"]), "its initiative was canceled; the pull request is still open on the forge");
 			else if (item["state"] === "done" || item["status"] === "done") out.set(String(row["id"]), "its initiative is done; this run is not the one that landed it");
 		} catch (error) {
 			if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
-			unchecked += 1;
+			uncheckedIds.add(String(row["id"]));
 		}
 	}));
-	unchecked += await staleBacklogReviews(client, rows, out);
+	await staleBacklogReviews(client, rows, out, uncheckedIds);
 	return {
 		stale: out,
-		unchecked
+		unchecked: uncheckedIds.size,
+		uncheckedIds
 	};
 }
 /**
@@ -5855,12 +5907,13 @@ async function staleReviews(client, rows) {
 * waiting 15 days on a product whose initiatives had all moved on, with nothing an agent could act on. Best effort,
 * a handful of products; returns how many could not be checked.
 */
-async function staleBacklogReviews(client, rows, out) {
+async function staleBacklogReviews(client, rows, out, unchecked) {
 	const asks = [...new Map(rows.filter((row) => row["kind"] === "review_backlog" && typeof row["productId"] === "string").map((row) => [String(row["id"]), row])).values()];
-	if (asks.length === 0) return 0;
-	if (!client.hasCapability("backlog:read")) return asks.length;
+	const skip = (which) => which.forEach((row) => unchecked.add(String(row["id"])));
+	if (asks.length === 0) return;
+	if (!client.hasCapability("backlog:read")) return skip(asks);
 	const checked = [...new Set(asks.map((row) => String(row["productId"])))].slice(0, STALE_CHECKS);
-	let unchecked = asks.filter((row) => !checked.includes(String(row["productId"]))).length;
+	skip(asks.filter((row) => !checked.includes(String(row["productId"]))));
 	const empty = /* @__PURE__ */ new Set();
 	await Promise.all(checked.map(async (productId) => {
 		try {
@@ -5871,11 +5924,10 @@ async function staleBacklogReviews(client, rows, out) {
 			empty.add(productId);
 		} catch (error) {
 			if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
-			unchecked += asks.filter((row) => row["productId"] === productId).length;
+			skip(asks.filter((row) => row["productId"] === productId));
 		}
 	}));
 	for (const row of asks) if (empty.has(String(row["productId"]))) out.set(String(row["id"]), "no initiative is in the backlog or todo now: the ones it asked about have moved on");
-	return unchecked;
 }
 /**
 * One product's Action Required as counts, the way the list's summary counts them: open is what still stands and is
@@ -5901,6 +5953,35 @@ function isDue(row, now) {
 }
 /** Pages read for the summary; past this it says it counted only those. */
 const SUMMARY_PAGE = 100;
+/** Pages the summary reads before it says it stopped: 1,000 items. */
+const SUMMARY_PAGES = 10;
+/** Every item the summary counts, up to SUMMARY_PAGES pages; nextCursor set when it stopped short. Null on failure. */
+async function everyItem(client, query, orNull = true) {
+	const data = [];
+	let cursor;
+	try {
+		for (let index = 0; index < SUMMARY_PAGES; index += 1) {
+			const page = await client.listInbox({
+				...query,
+				limit: SUMMARY_PAGE,
+				cursor
+			});
+			data.push(...page.data);
+			if (!page.nextCursor) return {
+				data,
+				nextCursor: null
+			};
+			cursor = page.nextCursor;
+		}
+		return {
+			data,
+			nextCursor: cursor ?? null
+		};
+	} catch (error) {
+		if (orNull && (error instanceof TaigaApiError || isNetworkFailure(error))) return null;
+		throw error;
+	}
+}
 const SETUP_TASK_FIELDS = [
 	"id",
 	"productId",
@@ -5995,14 +6076,7 @@ function registerInboxTools(server, client) {
 			...query,
 			...first ? { withTotal: true } : {}
 		});
-		const overview = !first || resolved ? null : !result.nextCursor ? result : await client.listInbox({
-			...query,
-			limit: SUMMARY_PAGE,
-			cursor: void 0
-		}).catch((error) => {
-			if (error instanceof TaigaApiError || isNetworkFailure(error)) return null;
-			throw error;
-		});
+		const overview = !first || resolved ? null : !result.nextCursor ? result : await everyItem(client, query);
 		const now = Date.now();
 		const due_ = (row) => isDue(row, now);
 		const rows = result.data;
@@ -6011,26 +6085,35 @@ function registerInboxTools(server, client) {
 		const overviewDue = overview ? overview.data.filter(due_) : [];
 		const checked = resolved ? {
 			stale: /* @__PURE__ */ new Map(),
-			unchecked: 0
+			unchecked: 0,
+			uncheckedIds: /* @__PURE__ */ new Set()
 		} : await staleReviews(client, [...due, ...overviewDue]);
 		const stale = checked.stale;
 		return toolResult({
 			...overview ? {
 				summary: summaryOf(overviewDue, stale),
-				...overview.nextCursor ? { summaryNote: `The summary counts the first ${SUMMARY_PAGE} items` + (params.productId ? "." : "; productId narrows it to one product.") } : {}
+				...overview.nextCursor ? { summaryNote: `The summary counts the first 1000 items` + (params.productId ? "." : "; productId narrows it to one product.") } : {}
 			} : {},
 			...page(due.map((row) => {
 				const item = itemRow(row, now, full === true, client.hasCapability("backlog:read"));
 				const why = stale.get(String(row["id"]));
-				return why ? {
+				if (why) return {
 					...item,
 					stale: why
+				};
+				return checked.uncheckedIds.has(String(row["id"])) ? {
+					...item,
+					staleChecked: false
 				} : item;
 			}), result.nextCursor),
 			...totalOf(result),
-			...overview && typeof result.totalCount === "number" && (stale.size > 0 || overview.data.length > overviewDue.length || overview.nextCursor) ? { totalNote: "totalCount counts every item, stale and snoozed ones too; summary.open does not" + (overview.nextCursor ? `, and counts only the first ${SUMMARY_PAGE}.` : ".") } : {},
+			...overview && typeof result.totalCount === "number" && (stale.size > 0 || overview.data.length > overviewDue.length || overview.nextCursor) ? { totalNote: "totalCount counts every item, stale and snoozed ones too; summary.open does not" + (overview.nextCursor ? `, and counts only the first 1000.` : ".") } : {},
 			...hidden > 0 ? { snoozedHidden: hidden } : {},
-			...checked.unchecked > 0 ? { staleNote: `${checked.unchecked} review${checked.unchecked === 1 ? " was" : "s were"} not checked for whether its subject moved on (past the cap, or the read was refused), so a row without stale may still be stale: taiga_get_initiative or taiga_get_run on its subject says.` } : {}
+			...checked.unchecked > 0 ? (() => {
+				const onPage = due.filter((row) => checked.uncheckedIds.has(String(row["id"]))).length;
+				const beyond = checked.unchecked - onPage;
+				return { staleNote: `${[...onPage > 0 ? [`${onPage} review${onPage === 1 ? "" : "s"} on this page could not be checked for whether the subject moved on: those rows say staleChecked: false, and their readWith read tells`] : [], ...beyond > 0 ? [`${beyond} review${beyond === 1 ? "" : "s"} counted in the summary but not on this page could not be checked either, so the summary counts them open`] : []].join("; ")}.` };
+			})() : {}
 		});
 	}));
 	server.registerTool("taiga_list_setup_tasks", {
@@ -6395,13 +6478,10 @@ const CONTEXT_RUN_SAID = [
 * the list's disagree (18 open here, 16 there), because this one counted stale reviews and put-off items as open.
 */
 async function attentionPart(client, productId) {
-	const result = await client.listInbox({
-		productId,
-		limit: 100
-	});
+	const result = await everyItem(client, { productId }, false);
 	return {
 		...await attentionCounts(client, result.data),
-		...result.nextCursor ? { note: "These count the first 100 items; taiga_list_action_required pages the rest." } : {}
+		...result.nextCursor ? { note: "These count the first 1000 items; taiga_list_action_required pages the rest." } : {}
 	};
 }
 /** The latest sweep and what it left open, as counts; taiga_list_findings lists them. */
@@ -22976,7 +23056,7 @@ function registerAllTools(server, client, options = {}) {
 function registerWhoami(server, client, registered) {
 	server.registerTool("taiga_whoami", {
 		title: "Who am I",
-		description: "Read who this API key acts as: the API it talks to (api, which says the environment), the person's email and organization role, the key's scopes (null means every capability the person has), its capabilities, and its tools split into reads, writes, and ask-first writes (paid agent work, changes others see). A tool the key cannot use is not offered at all.",
+		description: "Read who this API key acts as: the API host it talks to (api), the person's email and organization role, the key's scopes (null means every capability the person has), its capabilities, and its tools split into reads, writes, and ask-first writes (paid agent work, changes others see). A tool the key cannot use is not offered at all.",
 		inputSchema: z.object({}),
 		annotations: READ_ONLY
 	}, () => runTool(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-rc.500",
+  "version": "0.26.0-rc.504",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",