@taiga-ai/mcp-server 0.26.0-rc.500 → 0.26.0-rc.510

package/dist/index.js

@@ -1457,6 +1457,24 @@ function hardeningCoverage(result) {
 		gaps
 	};
 }
+//#endregion
+//#region ../../packages/types/dist/inbox.js
+/** What action is required. Drives icon, copy, and completion logic. */
+const INBOX_ITEM_KINDS = [
+	"review_plan",
+	"review_backlog",
+	"review_doc",
+	"review_pr",
+	"review_maintenance",
+	"review_policy",
+	"setup_env_var",
+	"setup_secret",
+	"setup_third_party",
+	"setup_dns",
+	"setup_billing",
+	"setup_cloud_permission",
+	"setup_manual"
+];
 z.discriminatedUnion("kind", [
 	z.object({
 		type: z.literal("narrative"),
@@ -1919,6 +1937,7 @@ const ENVIRONMENT_TYPES = [
 const MAINTENANCE_FINDING_KINDS = [
 	"vulnerable_dependency",
 	"outdated_dependency",
+	"license_violation",
 	"secret",
 	"sast",
 	"iac_misconfig"
@@ -1943,7 +1962,11 @@ const CODE_REMEDIATION_KINDS = [
 	"iac_misconfig"
 ];
 new Map(Object.entries({
-	deps: ["vulnerable_dependency", "outdated_dependency"],
+	deps: [
+		"vulnerable_dependency",
+		"outdated_dependency",
+		"license_violation"
+	],
 	secrets: ["secret"],
 	sast: ["sast"],
 	iac: ["iac_misconfig"]
@@ -2030,6 +2053,19 @@ function lockfileScope(path, groups) {
 	}
 }
 /**
+* The kinds that are a package in a lockfile (PRO-2862): the ones with a
+* dependency scope, a relation and an inventory entry. A code kind reuses the
+* dependency columns for its rule and category and has none of those.
+*/
+const DEPENDENCY_FINDING_KINDS = [
+	"vulnerable_dependency",
+	"outdated_dependency",
+	"license_violation"
+];
+function isDependencyFindingKind(kind) {
+	return DEPENDENCY_FINDING_KINDS.includes(kind);
+}
+/**
 * Whether a dependency finding sits only in development dependencies, in at
 * least one runtime dependency set, or in lockfiles that do not say. Decided
 * per lockfile (`lockfileScope`) and combined pessimistically: one runtime
@@ -2040,8 +2076,12 @@ function lockfileScope(path, groups) {
 * install script in any group.
 */
 function dependencyScope(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const entries = Object.entries(finding.dependencyGroups ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return scopeFromGroups(finding.dependencyGroups);
+}
+/** The scope read from per-lockfile groups alone: for an inventory record, which is a package by construction. */
+function scopeFromGroups(dependencyGroups) {
+	const entries = Object.entries(dependencyGroups ?? {});
 	if (entries.length === 0) return "unknown";
 	return combineScopes(entries.map(([path, groups]) => lockfileScope(path, Array.isArray(groups) ? groups : [])));
 }
@@ -2059,8 +2099,12 @@ function combineScopes(scopes) {
 * remediation step already finds every resolved copy and its parent itself.
 */
 function dependencyRelation(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const values = Object.values(finding.dependencyRelation ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return relationFromLockfiles(finding.dependencyRelation);
+}
+/** The relation read from per-lockfile answers alone: for an inventory record, which is a package by construction. */
+function relationFromLockfiles(dependencyRelation) {
+	const values = Object.values(dependencyRelation ?? {});
 	if (values.includes("direct")) return "direct";
 	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
 	return "unknown";
@@ -2417,7 +2461,7 @@ const DOCUMENT_INPUTS = Object.freeze({
 * reads as deleted) and fields they explain would simply be missing. So it
 * refuses to start, and says what to do.
 */
-function apiLevelProblem(introspection, apiUrl, required = 2, version = SERVER_VERSION) {
+function apiLevelProblem(introspection, apiUrl, required = 3, version = SERVER_VERSION) {
 	const offered = introspection.mcpApiLevel ?? 0;
 	if (offered >= required) return null;
 	return `The Taiga API at ${apiUrl} is older than @taiga-ai/mcp-server ${version} needs (API level ${offered}, needs ${required}). Run the version published for it, or wait for that API to be updated; an earlier release of this package works against it.`;
@@ -2604,7 +2648,7 @@ function importStatusOf(product) {
 /** Why a side of the timeline is empty, for a list or a miss that shows one. */
 function emptyOriginNote(origin, product) {
 	const imported = isImportedProduct(product);
-	if (origin === "plan") return imported ? `This product was imported, so no discovery chain was generated for it: its derived documents are on the reality side. Only the documents a person writes (${PLAN_ONLY_DOCUMENT_TYPES.map(productDocumentName).join(", ")}) would appear here.` : "No plan documents are published yet: they are written during discovery in Taiga.";
+	if (origin === "plan") return imported ? `This product is set up from its code (an import), so no discovery chain is generated for it: its derived documents are on the reality side. Only the documents a person writes (${PLAN_ONLY_DOCUMENT_TYPES.map(productDocumentName).join(", ")}) would appear here.` : "No plan documents are published yet: they are written during discovery in Taiga.";
 	if (!imported) return "No reality documents yet: they are derived from the code once the first initiative is done (a merged pull request marks it done) or the repository is pushed to. Until then read the plan side.";
 	switch (importStatusOf(product)) {
 		case "pending": return "No reality documents yet: the import has not started. taiga_start_import starts it once a repository is linked; taiga_get_product's readiness says whether one is.";
@@ -2674,7 +2718,7 @@ const BY_ARGUMENT = {
 /** Where an argument means something else on one tool, or the tool's 404 needs its own word. */
 const BY_TOOL = {
 	taiga_resolve_action: () => "taiga_list_action_required lists the items with their IDs.",
-	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and taiga_plan_again asks for a new one." : ITEM_ID_HINT
+	taiga_get_plan: (said) => /\bplan\b/i.test(said) ? "taiga_get_initiative's situation says whether one is being planned or failed, and names the call that asks for one (taiga_queue_initiative off the line, taiga_plan_again for a failed plan)." : ITEM_ID_HINT
 };
 /**
 * What the API calls the thing each ID names, as its 404 says it ("Environment
@@ -2908,7 +2952,11 @@ async function runTool(handler) {
 		if (error instanceof TaigaApiError) {
 			const code = error.code ?? CODE_BY_STATUS[error.status] ?? "API_ERROR";
 			const worded = inProductWording(error.apiMessage ?? `Taiga API answered ${error.status}.`);
-			return toolError(code, error.status === 404 ? withNotFoundHint(worded) : worded, error.details);
+			return toolError(code, error.status === 404 ? withNotFoundHint(worded) : [
+				502,
+				503,
+				504
+			].includes(error.status) ? `${withStop(worded)} This is usually temporary: a read may answer on a retry; after a write, check whether it took effect before repeating it.` : worded, error.details);
 		}
 		if (isNetworkFailure(error)) return toolError("NETWORK_ERROR", `Could not reach the Taiga API: ${networkFailureDetail(error)}. Check TAIGA_API_URL.`);
 		throw error;
@@ -3313,7 +3361,7 @@ const SEARCH_PAGE_LIMIT = 10;
 * the whole list to find its ID. `more` is true when it stopped before the end.
 */
 async function searchPages(fetchPage, query, text, limit, keep = () => true, nameOf) {
-	const needle = query.toLowerCase();
+	const needle = searchable(query);
 	const rows = [];
 	const names = [];
 	let cursor;
@@ -3323,7 +3371,7 @@ async function searchPages(fetchPage, query, text, limit, keep = () => true, nam
 		for (const [at, row] of page.entries()) {
 			if (!keep(row)) continue;
 			if (nameOf) names.push(nameOf(row));
-			if (!text(row).some((value) => typeof value === "string" && value.toLowerCase().includes(needle))) continue;
+			if (!text(row).some((value) => typeof value === "string" && searchable(value).includes(needle))) continue;
 			rows.push(row);
 			if (rows.length === limit) return {
 				rows,
@@ -3346,12 +3394,18 @@ async function searchPages(fetchPage, query, text, limit, keep = () => true, nam
 	};
 }
 /**
+* Text as a search compares it: lower case, punctuation as spaces, so "sign in" finds "Staff Sign-In" (PRO-2823).
+*/
+function searchable(text) {
+	return text.normalize("NFC").toLowerCase().replace(/[^\p{L}\p{N}]+/gu, " ").trim() || text.toLowerCase();
+}
+/**
 * Up to three names close to a query that matched none: a typo of the name or
 * of one of its words, within a third of the query's length ("tiaga", "rally"
 * for ref-rallly), or a shared word of three letters or more. Closest first.
 */
 function closestNames(query, names) {
-	const words = (text) => text.toLowerCase().split(/[^a-z0-9]+/).filter((word) => word.length >= 3);
+	const words = (text) => searchable(text).split(" ").filter((word) => word.length >= 3);
 	const wanted = new Set(words(query));
 	const ranked = names.map((name) => ({
 		name,
@@ -3870,10 +3924,17 @@ async function publishDraft(scope) {
 		...published.warnings ? { warnings: published.warnings } : {}
 	});
 }
+/** The policies the section ids name when every one is a control id (SEC-5.1), else none. */
+function policiesNamed(sections) {
+	if (sections.length === 0) return [];
+	const types = sections.map((id) => isControlId(id.toUpperCase()) ? policyNamedByControl(id.toUpperCase()) : void 0);
+	if (types.some((type) => type === void 0)) return [];
+	return [...new Set(types)];
+}
 function registerDocumentTools(server, client) {
 	if (client.hasCapability("tenant:documents:read")) server.registerTool("taiga_get_organization_document", {
 		title: "Get an organization document",
-		description: `Read the organization's own documents, which apply to every product. Two answers: without type, the list (type, name, version, draft state); with type, that document. The ${POLICY_TYPES.length} policies (${named$1(POLICY_TYPES)}) set the rules for every product; the others (${named$1(OTHER_TENANT_DOCUMENT_TYPES)}) carry goals, standards, voice and instructions. Policies are long: pass sections: [] for the outline, then the section ids you need, or a control id such as SEC-5.1; unknownSections names ids it lacks. A miss says which documents are published and whether a draft exists. A section's source (template, overlay-<id>, cloud-preset:<providers>) and priority (core: every organization keeps it) do not change what it requires.`,
+		description: `Read the organization's own documents, which apply to every product. Two answers: without type, the list (type, name, version, draft state); with type, that document. The ${POLICY_TYPES.length} policies (${named$1(POLICY_TYPES)}) set the rules for every product; the others (${named$1(OTHER_TENANT_DOCUMENT_TYPES)}) carry goals, standards, voice and instructions. Policies are long: pass sections: [] for the outline, then the section ids you need, or a control id such as SEC-5.1 (which names its policy, so type may be left out); unknownSections names ids it lacks. A miss says which documents are published and whether a draft exists. A section's source (template, overlay-<id>, cloud-preset:<providers>) and priority (core: every organization keeps it) do not change what it requires.`,
 		inputSchema: z.object({
 			type: tenantDocumentType.optional(),
 			sections: policySectionsInput,
@@ -3881,19 +3942,25 @@ function registerDocumentTools(server, client) {
 		}),
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => {
-		if (params.type === void 0) {
-			if (params.sections) return toolError("VALIDATION_ERROR", "Name the document (type) to read its sections.");
+		const named = params.type === void 0 && params.sections ? policiesNamed(params.sections) : [];
+		const args = params.type === void 0 && named.length === 1 ? {
+			...params,
+			type: named[0],
+			sections: params.sections?.map((id) => id.toUpperCase())
+		} : params;
+		if (args.type === void 0) {
+			if (args.sections) return toolError("VALIDATION_ERROR", named.length > 1 ? `Those control ids are in different policies (${named.join(", ")}): read one type at a time.` : "Name the document (type) to read its sections; a control id such as SEC-5.1 names its policy itself.");
 			const result = await client.listTenantDocuments({
-				limit: params.limit,
-				cursor: params.cursor
+				limit: args.limit,
+				cursor: args.cursor
 			});
 			return toolResult(page(summaries(result.data), result.nextCursor));
 		}
-		const type = params.type;
-		if (params.limit !== void 0 || params.cursor !== void 0) return toolError("VALIDATION_ERROR", "limit and cursor page the list; omit type to list, or drop them to read.");
+		const type = args.type;
+		if (args.limit !== void 0 || args.cursor !== void 0) return toolError("VALIDATION_ERROR", params.type === void 0 ? "limit and cursor page the list, which takes no sections; drop them to read the control." : "limit and cursor page the list; omit type to list, or drop them to read.");
 		try {
 			const doc = stripProvenance((await client.getTenantDocument(type)).data);
-			return params.sections ? sectionReadResult(doc, params.sections, type, { controlIds: POLICY_TYPES.includes(type) }) : toolResult(doc);
+			return args.sections ? sectionReadResult(doc, args.sections, type, { controlIds: POLICY_TYPES.includes(type) }) : toolResult(doc);
 		} catch (error) {
 			if (!(error instanceof TaigaApiError) || error.status !== 404) throw error;
 			const [draft, all] = await Promise.allSettled([client.getTenantDocumentDraft(type), client.listTenantDocuments({ limit: 100 })]);
@@ -4232,15 +4299,28 @@ function runOutcome(run) {
 		}[disposition] ?? status
 	};
 }
+/** Words a sentence does not end at: "e.g." and the like, and a lone initial. */
+const ABBREVIATION = /(?:\b(?:e\.g|i\.e|etc|vs|cf|incl|approx)|(?:^|\s)[A-Za-z])\.$/i;
+/** A finding's first sentence, capped: it ends at . ! or ? before white space, but not at an abbreviation. */
+function firstSentence$1(text) {
+	let sentence = text;
+	for (const match of text.matchAll(/[.!?](?=\s|$)/g)) {
+		const end = match.index + 1;
+		if (ABBREVIATION.test(text.slice(0, end))) continue;
+		sentence = text.slice(0, end);
+		break;
+	}
+	return sentence.length > 160 ? `${sentence.slice(0, 157)}...` : sentence;
+}
 /**
 * What hardening left blocking, in a sentence: the findings the run names (PRO-2817), or, for a run reported before
 * it recorded them, how many.
 */
 function hardeningSaid(blocking, named) {
 	const count = `Hardening ended with ${blocking} blocking finding${blocking === 1 ? "" : "s"} it could not fix`;
-	if (named.length === 0) return `${count}; the run records how many, not which.`;
+	if (named.length === 0) return `${count}; this run predates recording which.`;
 	const shown = named.slice(0, 3).map((finding) => {
-		const message = String(finding["message"]);
+		const message = firstSentence$1(String(finding["message"]));
 		const where = finding["line"] ? `${String(finding["path"])}:${String(finding["line"])}` : String(finding["path"]);
 		return `${message} (${String(finding["tool"])}, ${where})`;
 	});
@@ -5075,7 +5155,7 @@ function registerBacklogReads(server, client) {
 		}
 		if (params.cursor !== void 0) return toolError("VALIDATION_ERROR", "A title search answers one page; narrow the title, or leave query out to page through a column.");
 		let closedSeen = 0;
-		const needle = query.toLowerCase();
+		const needle = searchable(query);
 		const found = await searchPages((cursor) => client.listBacklogItems(id, {
 			...apiFilters,
 			...column === "open" ? { open: void 0 } : {},
@@ -5083,14 +5163,15 @@ function registerBacklogReads(server, client) {
 			cursor
 		}), query, (row) => [row.title], params.limit ?? 25, (row) => {
 			if (column !== "open" || !["done", "canceled"].includes(String(row.state))) return true;
-			if (String(row.title).toLowerCase().includes(needle)) closedSeen += 1;
+			if (searchable(String(row.title)).includes(needle)) closedSeen += 1;
 			return false;
-		});
+		}, (row) => String(row.title));
 		const hidden = column === "open" && !found.more ? closedSeen : 0;
 		return toolResult({
 			...page(situatedRows(found.rows), null),
 			...hidden > 0 ? { closedMatches: `${hidden} done or canceled initiative${hidden === 1 ? " also matches" : "s also match"}; column: 'all' lists them.` } : {},
-			...found.more ? { more: "There may be more than the limit carries: narrow the title, or pick one column." } : {}
+			...found.more ? { more: "There may be more than the limit carries: narrow the title, or pick one column." } : {},
+			...hidden === 0 ? nearNote(found.near) : {}
 		});
 	}));
 	server.registerTool("taiga_get_initiative", {
@@ -5346,6 +5427,11 @@ const FINDING_ROW_FIELDS = [
 * read off the row; remediableBy stays as the sweep recorded it.
 */
 function withFixability(row) {
+	if (row["kind"] === "license_violation") return {
+		...row,
+		fixable: false,
+		fixNote: "A license violation has no fix version: review the license or replace the package; taiga_fix_finding refuses it."
+	};
 	if ((row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency") && !row["recommendedVersion"] && row["remediableBy"] === "coding_agent") return {
 		...row,
 		fixable: false,
@@ -5363,7 +5449,7 @@ function withDependencyScope(row, { keepGroups = false } = {}) {
 		...row,
 		dependencyRelation: void 0
 	} : lean;
-	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	if (!isDependencyFindingKind(String(row["kind"]))) return rest;
 	const kind = row["kind"];
 	return {
 		...rest,
@@ -5385,7 +5471,7 @@ function findingRows(findings, extra = []) {
 		"dependencyGroups",
 		"dependencyRelation",
 		...extra
-	]).map((row) => withDependencyScope(row)).map(withFixability);
+	]).map((row) => withDependencyScope(row)).map(withFixability).map((row) => Object.fromEntries(Object.entries(row).filter(([key, value]) => value !== null || key === "ignoreExpiresAt" && row["status"] === "ignored")));
 }
 /** The parts of an advisory record an agent reads; the rest (every affected range, every reference) is full: true. */
 const ADVISORY_KEPT = [
@@ -5493,9 +5579,10 @@ function registerMaintenanceTools(server, client) {
 	if (!client.hasCapability("products:read")) return;
 	server.registerTool("taiga_list_findings", {
 		title: "List maintenance findings",
-		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. taiga_get_finding reads one.",
+		description: "List what maintenance sweeps found in a product's repository: dependencies, secrets, insecure code (sast) and infrastructure. The first page opens with sweep (open counts, latest sweeps), so an old or failed sweep is not read as an all-clear. Rows: severity, tier (act_now: known exploited; urgent: likely and serious; elevated: one of the two; routine), location, remediableBy (coding_agent: a run here can fix it; upstream_only: the code is in a submodule, so the fix belongs in its own repository), fixable: false when no fixed version is known yet, breached controls and initiativeId of a fix under way. Omit status for open findings. controlId lists the findings that breach one control. taiga_get_finding reads one.",
 		inputSchema: z.object({
 			productId,
+			controlId: z.string().trim().min(1).max(40).optional().describe("Only the findings that breach this control, such as SEC-5.1 (one page, searched across all)"),
 			status: z.enum(MAINTENANCE_FINDING_STATUSES).optional().describe("Only findings in this status; omit for the ones needing action"),
 			severity: z.enum(MAINTENANCE_FINDING_SEVERITIES).optional().describe("Only this severity"),
 			kind: z.enum(MAINTENANCE_FINDING_KINDS).optional().describe("Only this kind of finding"),
@@ -5503,7 +5590,21 @@ function registerMaintenanceTools(server, client) {
 		}),
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => {
-		const { productId: id, ...filters } = params;
+		const { productId: id, controlId, ...filters } = params;
+		if (controlId) {
+			if (params.cursor !== void 0) return toolError("VALIDATION_ERROR", "controlId reads every page itself; drop the cursor.");
+			const wanted = controlId.toUpperCase();
+			const found = await searchPages((cursor) => client.listFindings(id, {
+				...filters,
+				limit: 100,
+				cursor
+			}), "", () => [""], params.limit ?? 25, (row) => Array.isArray(row["controls"]) && row["controls"].some((c) => String(c).toUpperCase() === wanted));
+			return toolResult({
+				...page(findingRows(found.rows), null),
+				...found.more ? { more: found.rows.length < (params.limit ?? 25) ? `Only the first 1000 findings were searched; narrow by status, severity or kind to reach the rest.` : "There may be more than the limit carries: raise the limit, or narrow by status, severity or kind." } : {},
+				...found.rows.length === 0 && !found.more ? { note: `No ${params.status ? `${params.status} ` : "open "}finding breaches ${wanted}. That is no all-clear on its own: taiga_list_findings without controlId says when the product was last swept.` } : {}
+			});
+		}
 		const [result, sweep] = await Promise.all([client.listFindings(id, filters), params.cursor === void 0 ? sweepOverview(client, id).catch((error) => {
 			if (error instanceof TaigaApiError || isNetworkFailure(error)) return "unread";
 			throw error;
@@ -5555,7 +5656,7 @@ function registerMaintenanceTools(server, client) {
 		const summary = standingSummary(standing);
 		const assessment = standing.assessment;
 		const assessedAt = typeof assessment?.assessedAt === "string" ? assessment.assessedAt : null;
-		const note = assessment?.state === "never" ? "Never assessed: the documents have not been checked against the policies yet, so nothing here is an all-clear. An assessment runs when the reality documents are derived or refreshed (taiga_refresh_reality_documents, paid work: ask first)." : summary.controlsMet + summary.controlsNotApplicable === 0 && assessedAt ? `No control is recorded as met or not applicable: the last assessment (${assessedAt}) either ran before assessments recorded those verdicts, or found none. Until the next one, only violations are known; the rest are not assessed, which is no pass.` : null;
+		const note = assessment?.state === "never" ? "Never assessed: the documents have not been checked against the policies yet, so nothing here is an all-clear. " + (standing.canAssess === false && standing.hasPolicies !== false ? "It has no reality documents to assess yet: an import derives them (taiga_start_import for a product set up from its code, paid work: ask first), and the assessment follows." : "An assessment runs when the reality documents are derived or refreshed (taiga_refresh_reality_documents, paid work: ask first).") : summary.controlsMet + summary.controlsNotApplicable === 0 && assessedAt ? `No control is recorded as met or not applicable: the last assessment (${assessedAt}) either ran before assessments recorded those verdicts, or found none. Until the next one, only violations are known; the rest are not assessed, which is no pass.` : null;
 		const resolvedAny = Array.isArray(standing.resolvedDivergences) && standing.resolvedDivergences.length > 0;
 		const wording = violations.length > 0 || resolvedAny ? { wordingNote: "A violation's evidence is from its assessedAt; its title and summary may be from when it was first recorded. Where they disagree, the evidence is current." } : {};
 		if (params.controlId && params.violationId) return toolError("VALIDATION_ERROR", "Name either a control (controlId) or one violation (violationId), not both.");
@@ -5737,6 +5838,9 @@ function readWith(row, backlogRead) {
 * were the same things.
 */
 const KIND_SAID = { review_backlog: "review_initiatives" };
+/** The kinds as the rows say them, for the kind filter, and the way back to the API's word. */
+const KINDS_SAID = INBOX_ITEM_KINDS.map((kind) => KIND_SAID[kind] ?? kind);
+const KIND_FROM_SAID = Object.fromEntries(Object.entries(KIND_SAID).map(([api, said]) => [said, api]));
 const SUBJECT_SAID = {
 	backlog_item: "initiative",
 	build_run: "run",
@@ -5827,7 +5931,7 @@ const STALE_CHECKS = 10;
 async function staleReviews(client, rows) {
 	const byId = new Map(rows.filter((row) => row["kind"] === "review_pr" && row["subjectType"] === "build_run").map((row) => [String(row["id"]), row]));
 	const candidates = [...byId.values()].slice(0, STALE_CHECKS);
-	let unchecked = byId.size - candidates.length;
+	const uncheckedIds = new Set([...byId.keys()].slice(STALE_CHECKS));
 	const out = /* @__PURE__ */ new Map();
 	await Promise.all(candidates.map(async (row) => {
 		try {
@@ -5835,19 +5939,20 @@ async function staleReviews(client, rows) {
 			if (run["prMerged"] === true) return void out.set(String(row["id"]), "its pull request has merged");
 			if (run["prState"] === "closed") return void out.set(String(row["id"]), "its pull request was closed");
 			if (typeof run["backlogItemId"] !== "string") return;
-			if (!client.hasCapability("backlog:read")) return void (unchecked += 1);
+			if (!client.hasCapability("backlog:read")) return void uncheckedIds.add(String(row["id"]));
 			const item = (await client.getBacklogItem(run["backlogItemId"])).data;
 			if (item["state"] === "canceled" || item["status"] === "canceled") out.set(String(row["id"]), "its initiative was canceled; the pull request is still open on the forge");
 			else if (item["state"] === "done" || item["status"] === "done") out.set(String(row["id"]), "its initiative is done; this run is not the one that landed it");
 		} catch (error) {
 			if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
-			unchecked += 1;
+			uncheckedIds.add(String(row["id"]));
 		}
 	}));
-	unchecked += await staleBacklogReviews(client, rows, out);
+	await staleBacklogReviews(client, rows, out, uncheckedIds);
 	return {
 		stale: out,
-		unchecked
+		unchecked: uncheckedIds.size,
+		uncheckedIds
 	};
 }
 /**
@@ -5855,12 +5960,13 @@ async function staleReviews(client, rows) {
 * waiting 15 days on a product whose initiatives had all moved on, with nothing an agent could act on. Best effort,
 * a handful of products; returns how many could not be checked.
 */
-async function staleBacklogReviews(client, rows, out) {
+async function staleBacklogReviews(client, rows, out, unchecked) {
 	const asks = [...new Map(rows.filter((row) => row["kind"] === "review_backlog" && typeof row["productId"] === "string").map((row) => [String(row["id"]), row])).values()];
-	if (asks.length === 0) return 0;
-	if (!client.hasCapability("backlog:read")) return asks.length;
+	const skip = (which) => which.forEach((row) => unchecked.add(String(row["id"])));
+	if (asks.length === 0) return;
+	if (!client.hasCapability("backlog:read")) return skip(asks);
 	const checked = [...new Set(asks.map((row) => String(row["productId"])))].slice(0, STALE_CHECKS);
-	let unchecked = asks.filter((row) => !checked.includes(String(row["productId"]))).length;
+	skip(asks.filter((row) => !checked.includes(String(row["productId"]))));
 	const empty = /* @__PURE__ */ new Set();
 	await Promise.all(checked.map(async (productId) => {
 		try {
@@ -5871,11 +5977,10 @@ async function staleBacklogReviews(client, rows, out) {
 			empty.add(productId);
 		} catch (error) {
 			if (!(error instanceof TaigaApiError || isNetworkFailure(error))) throw error;
-			unchecked += asks.filter((row) => row["productId"] === productId).length;
+			skip(asks.filter((row) => row["productId"] === productId));
 		}
 	}));
 	for (const row of asks) if (empty.has(String(row["productId"]))) out.set(String(row["id"]), "no initiative is in the backlog or todo now: the ones it asked about have moved on");
-	return unchecked;
 }
 /**
 * One product's Action Required as counts, the way the list's summary counts them: open is what still stands and is
@@ -5901,6 +6006,35 @@ function isDue(row, now) {
 }
 /** Pages read for the summary; past this it says it counted only those. */
 const SUMMARY_PAGE = 100;
+/** Pages the summary reads before it says it stopped: 1,000 items. */
+const SUMMARY_PAGES = 10;
+/** Every item the summary counts, up to SUMMARY_PAGES pages; nextCursor set when it stopped short. Null on failure. */
+async function everyItem(client, query, orNull = true) {
+	const data = [];
+	let cursor;
+	try {
+		for (let index = 0; index < SUMMARY_PAGES; index += 1) {
+			const page = await client.listInbox({
+				...query,
+				limit: SUMMARY_PAGE,
+				cursor
+			});
+			data.push(...page.data);
+			if (!page.nextCursor) return {
+				data,
+				nextCursor: null
+			};
+			cursor = page.nextCursor;
+		}
+		return {
+			data,
+			nextCursor: cursor ?? null
+		};
+	} catch (error) {
+		if (orNull && (error instanceof TaigaApiError || isNetworkFailure(error))) return null;
+		throw error;
+	}
+}
 const SETUP_TASK_FIELDS = [
 	"id",
 	"productId",
@@ -5979,15 +6113,17 @@ function registerInboxTools(server, client) {
 		inputSchema: z.object({
 			productId: productId.optional(),
 			category: z.enum(["gate", "setup"]).optional().describe("gate: things to review; setup: things to set up"),
+			kind: z.enum(KINDS_SAID).optional().describe("Only this kind, such as review_plan or review_pr, as the rows name it"),
 			resolved: z.boolean().optional().describe("Read the resolved archive (done and dismissed) instead"),
 			full: z.boolean().optional().describe("Carry each item's metadata, such as a document decision's whole text (default false)"),
 			...pagination
 		}),
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => {
-		const { resolved, full, ...rest } = params;
+		const { resolved, full, kind, ...rest } = params;
 		const query = {
 			...rest,
+			...kind ? { kind: KIND_FROM_SAID[kind] ?? kind } : {},
 			...resolved ? { resolved: true } : {}
 		};
 		const first = params.cursor === void 0;
@@ -5995,14 +6131,7 @@ function registerInboxTools(server, client) {
 			...query,
 			...first ? { withTotal: true } : {}
 		});
-		const overview = !first || resolved ? null : !result.nextCursor ? result : await client.listInbox({
-			...query,
-			limit: SUMMARY_PAGE,
-			cursor: void 0
-		}).catch((error) => {
-			if (error instanceof TaigaApiError || isNetworkFailure(error)) return null;
-			throw error;
-		});
+		const overview = !first || resolved ? null : !result.nextCursor ? result : await everyItem(client, query);
 		const now = Date.now();
 		const due_ = (row) => isDue(row, now);
 		const rows = result.data;
@@ -6011,26 +6140,35 @@ function registerInboxTools(server, client) {
 		const overviewDue = overview ? overview.data.filter(due_) : [];
 		const checked = resolved ? {
 			stale: /* @__PURE__ */ new Map(),
-			unchecked: 0
+			unchecked: 0,
+			uncheckedIds: /* @__PURE__ */ new Set()
 		} : await staleReviews(client, [...due, ...overviewDue]);
 		const stale = checked.stale;
 		return toolResult({
 			...overview ? {
 				summary: summaryOf(overviewDue, stale),
-				...overview.nextCursor ? { summaryNote: `The summary counts the first ${SUMMARY_PAGE} items` + (params.productId ? "." : "; productId narrows it to one product.") } : {}
+				...overview.nextCursor ? { summaryNote: `The summary counts the first 1000 items` + (params.productId ? "." : "; productId narrows it to one product.") } : {}
 			} : {},
 			...page(due.map((row) => {
 				const item = itemRow(row, now, full === true, client.hasCapability("backlog:read"));
 				const why = stale.get(String(row["id"]));
-				return why ? {
+				if (why) return {
 					...item,
 					stale: why
+				};
+				return checked.uncheckedIds.has(String(row["id"])) ? {
+					...item,
+					staleChecked: false
 				} : item;
 			}), result.nextCursor),
 			...totalOf(result),
-			...overview && typeof result.totalCount === "number" && (stale.size > 0 || overview.data.length > overviewDue.length || overview.nextCursor) ? { totalNote: "totalCount counts every item, stale and snoozed ones too; summary.open does not" + (overview.nextCursor ? `, and counts only the first ${SUMMARY_PAGE}.` : ".") } : {},
+			...overview && typeof result.totalCount === "number" && (stale.size > 0 || overview.data.length > overviewDue.length || overview.nextCursor) ? { totalNote: "totalCount counts every item, stale and snoozed ones too; summary.open does not" + (overview.nextCursor ? `, and counts only the first 1000.` : ".") } : {},
 			...hidden > 0 ? { snoozedHidden: hidden } : {},
-			...checked.unchecked > 0 ? { staleNote: `${checked.unchecked} review${checked.unchecked === 1 ? " was" : "s were"} not checked for whether its subject moved on (past the cap, or the read was refused), so a row without stale may still be stale: taiga_get_initiative or taiga_get_run on its subject says.` } : {}
+			...checked.unchecked > 0 ? (() => {
+				const onPage = due.filter((row) => checked.uncheckedIds.has(String(row["id"]))).length;
+				const beyond = checked.unchecked - onPage;
+				return { staleNote: `${[...onPage > 0 ? [`${onPage} review${onPage === 1 ? "" : "s"} on this page could not be checked for whether the subject moved on: those rows say staleChecked: false, and their readWith read tells`] : [], ...beyond > 0 ? [`${beyond} review${beyond === 1 ? "" : "s"} counted in the summary but not on this page could not be checked either, so the summary counts them open`] : []].join("; ")}.` };
+			})() : {}
 		});
 	}));
 	server.registerTool("taiga_list_setup_tasks", {
@@ -6395,13 +6533,10 @@ const CONTEXT_RUN_SAID = [
 * the list's disagree (18 open here, 16 there), because this one counted stale reviews and put-off items as open.
 */
 async function attentionPart(client, productId) {
-	const result = await client.listInbox({
-		productId,
-		limit: 100
-	});
+	const result = await everyItem(client, { productId }, false);
 	return {
 		...await attentionCounts(client, result.data),
-		...result.nextCursor ? { note: "These count the first 100 items; taiga_list_action_required pages the rest." } : {}
+		...result.nextCursor ? { note: "These count the first 1000 items; taiga_list_action_required pages the rest." } : {}
 	};
 }
 /** The latest sweep and what it left open, as counts; taiga_list_findings lists them. */
@@ -22976,7 +23111,7 @@ function registerAllTools(server, client, options = {}) {
 function registerWhoami(server, client, registered) {
 	server.registerTool("taiga_whoami", {
 		title: "Who am I",
-		description: "Read who this API key acts as: the API it talks to (api, which says the environment), the person's email and organization role, the key's scopes (null means every capability the person has), its capabilities, and its tools split into reads, writes, and ask-first writes (paid agent work, changes others see). A tool the key cannot use is not offered at all.",
+		description: "Read who this API key acts as: the API host it talks to (api), the person's email and organization role, the key's scopes (null means every capability the person has), its capabilities, and its tools split into reads, writes, and ask-first writes (paid agent work, changes others see). A tool the key cannot use is not offered at all.",
 		inputSchema: z.object({}),
 		annotations: READ_ONLY
 	}, () => runTool(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-rc.500",
+  "version": "0.26.0-rc.510",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",