@taiga-ai/mcp-server 0.36.0-rc.892 → 0.36.0-rc.926

package/dist/index.js

@@ -24687,6 +24687,19 @@ const PRODUCT_DOCUMENT_DISPLAY_NAMES = {
 const PRODUCT_DOCUMENT_ORIGINS = ["plan", "reality"];
 /** The forges a repository link can name: `FORGE_PROVIDERS`, under the name links have always used. */
 const VCS_PROVIDERS = FORGE_PROVIDERS;
+Object.fromEntries(Object.entries({
+	specification: "specification",
+	"user-flows": "user_flow",
+	architecture: "architecture",
+	"tech-decisions": "technology_decisions",
+	"data-flow": "data_flow",
+	"threat-model": "threat_model",
+	dpia: "privacy_assessment",
+	"risk-register": "risk_register",
+	"service-blueprint": "service_blueprint",
+	"ui-direction": "ui_direction",
+	"codebase-snapshot": "codebase_snapshot"
+}).map(([slug, apiType]) => [apiType, slug]));
 //#endregion
 //#region ../../packages/types/dist/route-key.js
 /**
@@ -25478,6 +25491,7 @@ discriminatedUnion("kind", [
 		})).max(20),
 		moreFailed: number$1().int().min(0).optional(),
 		observedAt: optionalMoment,
+		repository: string$2().min(1).max(255).optional(),
 		stepId: optionalUuid
 	}),
 	object({
@@ -26070,6 +26084,92 @@ object({
 	...outcomes === void 0 ? {} : { outcomes }
 }));
 //#endregion
+//#region ../../packages/types/dist/registries.js
+/**
+* The package ecosystems a registry can serve: every ecosystem the coding
+* agent builds (its skills and its image), keyed by the install tooling that
+* reads the credential. `maven` is a Maven repository, and Maven builds get
+* its credential (PRO-2916); Gradle builds name theirs in their own build
+* scripts and get none yet (PRO-2928).
+*/
+const REGISTRY_ECOSYSTEMS = [
+	"npm",
+	"terraform",
+	"pypi",
+	"nuget",
+	"go",
+	"cargo",
+	"maven",
+	"rubygems",
+	"composer"
+];
+const REGISTRY_VENDORS = [
+	"npmjs",
+	"github",
+	"gcp_artifact",
+	"generic",
+	"hcp_terraform",
+	"scalr",
+	"azure_artifacts",
+	"jfrog",
+	"git_host",
+	"aws_codeartifact"
+];
+/** An IAM role ARN, as the CodeArtifact credential takes it. */
+const AWS_ROLE_ARN_PATTERN = /^arn:aws:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/;
+//#endregion
+//#region ../../packages/types/dist/gitlab.js
+/**
+* GitLab connections (PRO-3096, P-PRO-150): the shared request/response
+* contract of `/v1/gitlab/connections`. A connection is one GitLab host
+* (GitLab.com, a self-managed instance or GitLab Dedicated) with a bot token
+* the tenant pasted. The token is write-only and appears in no response.
+*/
+const GITLAB_CONNECTION_STATUSES = [
+	"valid",
+	"auth_failed",
+	"unreachable"
+];
+//#endregion
+//#region ../../packages/types/dist/cloud-connections.js
+const CLOUD_CONNECTION_STATUSES = [
+	"pending_setup",
+	"validating",
+	"active",
+	"error",
+	"suspended",
+	"disconnected"
+];
+/**
+* Keys in `providerConfig` that only Taiga's provisioning path may write.
+*
+* PRO-858. `accountName` is the correlation key the AFT account-ready callback
+* arrives with, and the webhook resolves it under service context with no
+* tenant predicate -- it has to, because the callback carries no tenant. It is
+* also guessable: `generateAccountName` derives it from tenant, team and
+* project slugs. So a tenant that could write this key could plant a row
+* claiming another tenant's account name, wait for that callback, and have the
+* victim's `deployConfig` (accountId, deployRoleArn, stateBucket) delivered to
+* their own environment.
+*
+* `accountKey` is the same identity in unguessable form
+* (`sha256(tenantId:productId:envType)`), and is what the AFT module is named
+* for -- equally not the caller's to assert.
+*
+* Neither is tenant-facing: no provider schema models them, and
+* `providerConfigProblem` documents them as the shape a MANAGED row has. The
+* update path merges and persists the RAW config precisely so Zod does not
+* strip them off managed rows, which is what made a tenant-supplied value
+* durable. Rejecting rather than stripping, so a client sending one is told,
+* instead of silently having it dropped.
+*/
+const TAIGA_MANAGED_PROVIDER_CONFIG_KEYS = ["accountName", "accountKey"];
+/** Whether `config` leaves alone the keys only Taiga's provisioning writes. */
+function isTenantWritableProviderConfig(config) {
+	return !TAIGA_MANAGED_PROVIDER_CONFIG_KEYS.some((key) => key in config);
+}
+const TAIGA_MANAGED_PROVIDER_CONFIG_MESSAGE = `providerConfig may not set ${TAIGA_MANAGED_PROVIDER_CONFIG_KEYS.join(" or ")}: Taiga's provisioning owns those keys`;
+//#endregion
 //#region ../../packages/types/dist/environments.js
 const ENVIRONMENT_TYPES = [
 	"development",
@@ -26083,6 +26183,31 @@ const ENVIRONMENT_TYPES = [
 //#endregion
 //#region ../../packages/types/dist/api-keys.js
 /**
+* API key scopes control what operations a key can perform.
+* Scopes act as a ceiling -- the effective permissions are the intersection
+* of the key's scopes and the user's role-based capabilities.
+*
+* Convention: "resource:action" matching the existing Capability type.
+*/
+const API_KEY_SCOPES = [
+	"products:read",
+	"products:write",
+	"backlog:read",
+	"backlog:write",
+	"factories:read",
+	"factories:documents:write",
+	"users:read",
+	"tenant:documents:read",
+	"tenant:documents:write",
+	"vcs:read",
+	"customDocuments:read",
+	"customDocuments:write",
+	"customDocuments:delete",
+	"factories:write",
+	"vcs:manage"
+];
+const API_KEY_PREFIX = "taiga_sk_live_";
+/**
 * The groups the MCP server's tools come in (PRO-2838). A key may name the ones
 * its AI tool sees; null is every one. This is focus, not security: a tool the
 * key's role or scopes do not allow is never offered, whatever is named here.
@@ -26216,10 +26341,24 @@ function isFixableFinding(finding) {
 	if (finding.status !== "open") return false;
 	if (finding.location?.historyOnly) return false;
 	if (!isAgentRemediable(finding)) return false;
-	if (finding.fingerprint?.startsWith("base-image:")) return typeof finding.baseMove === "boolean" ? finding.baseMove : baseImageMoveRemoves(finding.data);
+	if (finding.fingerprint?.startsWith("base-image:") || finding.baseImageFix) {
+		if (finding.baseImageFix) return finding.baseImageFix.way === "move" || finding.baseImageFix.way === "upgrade";
+		return typeof finding.baseMove === "boolean" ? finding.baseMove : baseImageMoveRemoves(finding.data);
+	}
 	if (finding.kind === "vulnerable_dependency" && isMaliciousPackageFinding(finding)) return true;
+	if (isPinBlocked(finding)) return false;
 	return isCodeRemediationKind(finding.kind) || !!finding.recommendedVersion;
 }
+/**
+* Whether a Fix cannot work: another package's pin caps this finding's fix, and
+* the last fix ended still vulnerable against it (`opentelemetry-api` under
+* `aws-opentelemetry-distro`'s `==1.44.0`). Another would spend a run to meet
+* it again. Blocked with no such fix, a person's Fix still runs (AC-17): they
+* may know a way round. The gate lifts the hold when the pin moves.
+*/
+function isPinBlocked(finding) {
+	return finding.autoFixHeld?.reason === "blocked_by_dependency" && finding.autoFixHeld.fixFailed === true;
+}
 function baseImageMoveRemoves(data) {
 	const baseImage = typeof data === "object" && data !== null ? data.baseImage : null;
 	const bases = typeof baseImage === "object" && baseImage !== null ? baseImage.bases : null;
@@ -27080,6 +27219,14 @@ const cloudProviderConfig = discriminatedUnion("provider", [
 		bestPractices: cloudBestPractices
 	})
 ]);
+const newCloudConnection = strictObject({
+	name: string$2().min(1).max(150),
+	provider: _enum(CLOUD_PROVIDERS),
+	providerConfig: cloudProviderConfig
+}).refine((connection) => connection.provider === connection.providerConfig.provider, {
+	message: "connection.provider must match connection.providerConfig.provider",
+	path: ["providerConfig", "provider"]
+});
 const columnIndex = number$1().int().min(1).max(EXCEL_MAX_COLUMN);
 const sheetMap = object({
 	sheetName: string$2().min(1).max(120),
@@ -27137,7 +27284,7 @@ strictObject({ type: productDocumentType }), object({
 		shown: array(string$2()),
 		count: number$1().int().min(0)
 	})
-}), strictObject({ type: productDocumentType }), strictObject({ type: productDocumentType }), strictObject({}), object({ started: number$1().int().min(0) }), strictObject({
+}), strictObject({ type: productDocumentType }), strictObject({ type: productDocumentType }), strictObject({
 	githubRepositoryId: uuid.optional(),
 	/** A GitLab project, by the connection whose bot reaches it and GitLab's numeric id (P-PRO-150). */
 	gitlabConnectionId: uuid.optional(),
@@ -27223,15 +27370,8 @@ strictObject({ type: productDocumentType }), object({
 		literal(12)
 	]),
 	note: string$2().trim().max(1e3).optional()
-}), strictObject({ environments: array(string$2()).default(["development"]) }), strictObject({
-	connection: object({
-		name: string$2().min(1).max(150),
-		provider: _enum(CLOUD_PROVIDERS),
-		providerConfig: cloudProviderConfig
-	}).refine((connection) => connection.provider === connection.providerConfig.provider, {
-		message: "connection.provider must match connection.providerConfig.provider",
-		path: ["providerConfig", "provider"]
-	}),
+}), strictObject({ environments: array(string$2()).default(["development"]) }), object({ id: string$2().uuid() }), strictObject({
+	connection: newCloudConnection,
 	environment: object({
 		name: string$2().min(1).max(100),
 		slug: string$2().min(1).max(63).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must be lowercase letters, digits, and dashes"),
@@ -27240,6 +27380,19 @@ strictObject({ type: productDocumentType }), object({
 		isProtected: boolean().default(false)
 	}).optional()
 });
+/**
+* The MCP toolsets a key's AI tool sees: at least one, each once, or null for
+* every one (PRO-2838). An empty list would start a server with no tools at all.
+*/
+const mcpToolsets = array(_enum(MCP_TOOLSETS)).min(1).refine((sets) => new Set(sets).size === sets.length, "Name each toolset once").nullable();
+strictObject({
+	key: string$2().regex(new RegExp(`^${API_KEY_PREFIX}[0-9a-f]{64}$`)),
+	name: string$2().min(1).max(255),
+	scopes: array(_enum(API_KEY_SCOPES)).optional(),
+	expiresInDays: number$1().int().min(1).max(365).optional(),
+	mcpToolsets: mcpToolsets.optional()
+}), object({ keyId: uuid });
+strictObject({ mcpToolsets });
 object({
 	url: string$2().url(),
 	expiresAt: string$2()
@@ -27261,7 +27414,125 @@ object({
 /** A factory document type, its legacy name read as the current one. */
 const factoryDocumentType = _enum([...FACTORY_DOCUMENT_TYPES, LEGACY_FACTORY_INSTRUCTIONS_TYPE]).transform((type) => type === "team_instructions" ? FACTORY_INSTRUCTIONS_TYPE : type);
 strictObject({ type: factoryDocumentType }), strictObject({ type: factoryDocumentType });
-strictObject({ type: _enum(TENANT_DOCUMENT_TYPES) }), strictObject({ type: _enum(TENANT_DOCUMENT_TYPES).refine((type) => type !== "design_standards", { message: "The design standards draft is not made through sync" }) }), strictObject({
+/**
+* A registry scope: an npm scope ("@acme") or a Go module path prefix
+* ("github.com/acme"), as `POST /registries` takes one (PRO-3670). Which
+* ecosystem takes which is the service's rule.
+*/
+const namedSegments = (value) => value.split("/").every((seg) => seg !== "" && seg !== "." && seg !== "..");
+const registryScope = string$2().regex(/^@?[A-Za-z0-9][A-Za-z0-9._~/-]*$/, "Not a valid scope").max(214).refine(namedSegments, "Not a valid scope");
+/** The package a registry's check fetches, in the union of the ecosystems' grammars. */
+const registryTestPackage = string$2().min(1).max(214).regex(/^@?[A-Za-z0-9_][A-Za-z0-9._~/:-]*$/, "Must be a valid package name").refine(namedSegments, "Must be a valid package name");
+/** KMS direct-encrypt takes 4096 bytes; the raw secret stays well under. */
+const REGISTRY_CREDENTIAL_MAX_BYTES = 3500;
+/** A registry's write-only credential: exactly one of a token, a GCP key or an AWS role, as the route takes it. */
+const registryCredential = strictObject({
+	token: string$2().min(1).max(REGISTRY_CREDENTIAL_MAX_BYTES).optional(),
+	username: string$2().min(1).max(256).regex(/^[^:\s]+$/, "Username must not contain a colon or whitespace").optional(),
+	credentialsJson: string$2().min(2).max(REGISTRY_CREDENTIAL_MAX_BYTES).optional(),
+	awsRoleArn: string$2().max(600).regex(AWS_ROLE_ARN_PATTERN, "Not an IAM role ARN").optional()
+}).refine((c) => [
+	c.token,
+	c.credentialsJson,
+	c.awsRoleArn
+].filter((v) => v != null).length === 1, { message: "Provide exactly one of token, credentialsJson or awsRoleArn" }).refine((c) => c.username == null || c.token != null, { message: "A username goes with a token" }).refine((c) => new TextEncoder().encode(JSON.stringify(c)).length <= 4e3, { message: "Credential is too large to encrypt (must be under 4 KB once JSON-encoded)" });
+/** An instant as an ISO string, which the service reads as a date. */
+const isoInstant = string$2().datetime({ offset: true });
+object({
+	status: _enum([
+		"unvalidated",
+		"valid",
+		"auth_failed",
+		"unreachable"
+	]),
+	lastValidatedAt: string$2(),
+	detail: string$2().nullable()
+});
+strictObject({
+	displayName: string$2().min(1).max(255).optional(),
+	registryUrl: string$2().url().max(512).optional(),
+	scopes: array(registryScope).max(50).optional(),
+	expiresAt: isoInstant.nullable().optional(),
+	credential: registryCredential.optional(),
+	testPackage: registryTestPackage.nullable().optional()
+});
+/** A GitLab bot token, as the route takes one. */
+const gitlabToken = string$2().trim().min(20, "That does not look like a GitLab access token").max(1024).regex(/^[A-Za-z0-9_.-]+$/, "That does not look like a GitLab access token");
+/** A private CA as PEM certificates; the service parses it. */
+const gitlabCaBundle = string$2().min(1).max(65536);
+/** What a connect or a token change learned, beyond the connection's record. */
+const gitlabValidationReport = object({
+	pushableProjectCount: number$1().int().nullable(),
+	warnings: array(string$2())
+});
+strictObject({
+	displayName: string$2().trim().min(1).max(255).optional(),
+	token: gitlabToken.optional(),
+	caBundlePem: gitlabCaBundle.nullable().optional()
+}), gitlabValidationReport.optional(), object({
+	status: _enum(GITLAB_CONNECTION_STATUSES),
+	lastValidatedAt: string$2(),
+	detail: string$2().nullable()
+}), object({ finished: boolean() }), strictObject({ search: string$2().trim().max(100).optional() }), object({
+	projects: array(object({
+		id: number$1().int(),
+		pathWithNamespace: string$2(),
+		nameWithNamespace: string$2(),
+		webUrl: string$2(),
+		defaultBranch: string$2().nullable()
+	})).nullable(),
+	truncated: boolean()
+});
+object({
+	outcome: _enum([
+		"uninstalled",
+		"left_in_use",
+		"uninstall_failed"
+	]),
+	manageUrl: string$2().nullable()
+});
+/** A value GitHub's redirect carries back: a state token, or a one-time code. */
+const githubCallbackSecret = string$2().trim().min(1).max(1024);
+strictObject({
+	displayName: string$2().trim().min(1).max(255),
+	baseUrl: string$2().trim().min(1).max(480),
+	token: gitlabToken,
+	caBundlePem: gitlabCaBundle.nullable().optional()
+}), object({
+	connectionId: uuid,
+	validation: gitlabValidationReport
+}), strictObject({
+	displayName: string$2().min(1).max(255),
+	ecosystem: _enum(REGISTRY_ECOSYSTEMS).optional(),
+	vendor: _enum(REGISTRY_VENDORS),
+	registryUrl: string$2().url().max(512),
+	scopes: array(registryScope).max(50).optional(),
+	expiresAt: isoInstant.nullable().optional(),
+	credential: registryCredential,
+	testPackage: registryTestPackage.optional()
+}), strictObject({ hostId: uuid.optional() }), object({ installUrl: string$2().url() }), strictObject({ state: githubCallbackSecret }), object({
+	clientId: string$2(),
+	authorizeUrl: string$2(),
+	redirectUri: string$2().optional()
+}), strictObject({
+	installationId: number$1().int().positive(),
+	setupAction: _enum(["install", "update"]),
+	state: githubCallbackSecret.optional(),
+	code: githubCallbackSecret.optional()
+}), strictObject({
+	subdomain: string$2().min(1).max(39).optional(),
+	serverUrl: string$2().min(1).max(2048).optional(),
+	caBundlePem: string$2().max(65536).optional(),
+	orgLogin: string$2().min(1).max(39),
+	displayName: string$2().max(255).optional()
+}), object({
+	manifest: record(string$2(), unknown$1()),
+	postUrl: string$2().url(),
+	state: string$2()
+}), strictObject({
+	state: githubCallbackSecret,
+	code: githubCallbackSecret
+}), strictObject({ type: _enum(TENANT_DOCUMENT_TYPES) }), strictObject({ type: _enum(TENANT_DOCUMENT_TYPES).refine((type) => type !== "design_standards", { message: "The design standards draft is not made through sync" }) }), strictObject({
 	name: string$2().min(1).max(50),
 	action: _enum(["accept", "decline"])
 }), object({
@@ -27306,10 +27577,19 @@ strictObject({ type: _enum(TENANT_DOCUMENT_TYPES) }), strictObject({ type: _enum
 }).refine((a) => Boolean(a.approve) !== Boolean(a.remove), { message: "Name one license to approve or remove" }), object({
 	enrolled: number$1().int().nonnegative(),
 	total: number$1().int().nonnegative()
+}), object({
+	principalArn: string$2().nullable(),
+	externalId: string$2()
 });
 strictObject({ kind: _enum(["sbom", "notices"]) }), object({
 	url: string$2().url().nullable(),
 	expiresAt: string$2().nullable()
+}), object({
+	branches: array(object({
+		name: string$2(),
+		protected: boolean()
+	})).nullable(),
+	truncated: boolean()
 });
 strictObject({
 	ignoreReason: _enum(MAINTENANCE_IGNORE_REASONS),
@@ -27322,6 +27602,11 @@ strictObject({ tier: _enum([
 	"staging",
 	"production"
 ]) });
+strictObject({
+	name: string$2().min(1).max(150).optional(),
+	status: _enum(CLOUD_CONNECTION_STATUSES).optional(),
+	providerConfig: record(string$2(), unknown$1()).refine(isTenantWritableProviderConfig, { message: TAIGA_MANAGED_PROVIDER_CONFIG_MESSAGE }).optional()
+});
 object({
 	url: string$2().url(),
 	expiresAt: string$2(),
@@ -28379,6 +28664,7 @@ const FINDING_ROW_FIELDS = [
 	"malicious",
 	"baseMove",
 	"baseImageMove",
+	"baseImageFix",
 	"removal",
 	"replaceable",
 	"status",
@@ -28506,7 +28792,7 @@ function withFixability(row) {
 		return {
 			...row,
 			fixable: false,
-			fixNote: reason === "not_shipped" ? "No longer applies: the package is only a build for platforms the repository does not deploy to. Nothing to do." : reason === "license_approved" ? "No longer applies: its license is on the organization's approved list. Nothing to do." : reason === "license_undecided" ? "No longer applies: its license can no longer be judged against the list (some of what it can stand for is approved). Nothing to do." : reason === "superseded" ? "Replaced by the repository's finding of its license, which lists every package under it. Nothing to do here." : "Resolved: the sweep no longer reports it. Nothing to do."
+			fixNote: reason === "not_shipped" ? "No longer applies: the package is only a build for platforms the repository does not deploy to. Nothing to do." : reason === "license_approved" ? "No longer applies: its license is on the organization's approved list. Nothing to do." : reason === "license_undecided" ? "No longer applies: its license can no longer be judged against the list (some of what it can stand for is approved). Nothing to do." : reason === "superseded" ? "Replaced by the repository's finding of its license, which lists every package under it. Nothing to do here." : reason === "license_not_judged" ? "No longer applies: an OS package's license is judged only when it restricts use. Its packages keep it. Nothing to do." : "Resolved: the sweep no longer reports it. Nothing to do."
 		};
 	}
 	if (row["kind"] === "license_violation" && row["replaceable"] === true) return {
@@ -28545,7 +28831,30 @@ function withFixability(row) {
 		fixable: true,
 		fixNote: "A malicious package: taiga_fix_finding removes it (or replaces it), with every advisory on that version."
 	} : row;
-	if (typeof row["baseMove"] === "boolean" && isAgentRemediable({ remediableBy: typeof row["remediableBy"] === "string" ? row["remediableBy"] : null })) return row["baseMove"] === true && row["status"] === "open" ? {
+	const held = row["autoFixHeld"];
+	const inBase = row["baseImageFix"] != null || typeof row["baseMove"] === "boolean";
+	if (row["status"] === "open" && !inBase && held && isPinBlocked({ autoFixHeld: held })) {
+		const what = held.blockingPackage ?? "another dependency";
+		return {
+			...row,
+			fixable: false,
+			fixNote: `Waiting on ${what}${held.blockingConstraint ? `, which requires ${held.blockingConstraint}` : ""}. taiga_fix_finding refuses it until that moves.`
+		};
+	}
+	const base = row["baseImageFix"];
+	if (base && base.way !== "move" && isAgentRemediable({ remediableBy: remediableByOf(row) })) {
+		if (base.way === "upgrade") return row["status"] === "open" ? {
+			...row,
+			fixable: true,
+			fixNote: "taiga_fix_finding adds a temporary line to the Dockerfile that upgrades this package over its base, until the base publishes a build with the fix."
+		} : row;
+		return {
+			...row,
+			fixable: false,
+			fixNote: baseImageWaitNote(base)
+		};
+	}
+	if (typeof row["baseMove"] === "boolean" && isAgentRemediable({ remediableBy: remediableByOf(row) })) return row["baseMove"] === true && row["status"] === "open" ? {
 		...row,
 		fixable: true,
 		fixNote: "taiga_fix_finding moves the base images it is in to the builds their tags name now, the FROM line alone, with every other advisory that move removes."
@@ -28615,6 +28924,14 @@ function withResolutionLabel(row) {
 		previouslyResolvedReason: resolvedReason
 	};
 }
+/** Why a base image's finding has no Fix, in the page's words (`maintaining_base_wait_*`). */
+function baseImageWaitNote(fix) {
+	if (fix.way === "wait_for_distro") return `${fix.distro} has no fix for this yet.`;
+	if (fix.way === "end_of_life") return `${fix.distro} has reached its end of life, so upgrading this one package is no fix. It clears when the base moves to a supported release.`;
+	const image = fix.images.join(", ") || "The base image";
+	return `${fix.distro} has fixed this, but ${image} has not published a build with the fix yet. It clears when it does.`;
+}
+const remediableByOf = (row) => typeof row["remediableBy"] === "string" ? row["remediableBy"] : null;
 /** A finding as a tool answers it: the row fields, the scope, and whether Fix would take it. */
 function findingRows(findings, extra = []) {
 	return pickFields(findings, [
@@ -30602,10 +30919,11 @@ function runOutcome(run) {
 	const why = errorSaid(run["error"]) ?? (typeof run["failedReason"] === "string" ? run["failedReason"] : null);
 	const handback = handbackSaid(run["reviewEscalation"]);
 	const draft = run["prDraft"] === true ? `, still a draft` : "";
+	const blocked = reasonOnOneLine(run["factoryBlockedBecause"]);
 	return {
 		disposition,
 		outcome: {
-			in_flight: status === "pending" ? "Queued: waiting to start." : status === "replanning" ? steerPaused(run["failedReason"], progress) : `Running: ${RUNNING[status] ?? status}${progress}.`,
+			in_flight: blocked ? `Blocked: the factory has stopped working on this run${progress}. ${blocked}` : status === "pending" ? "Queued: waiting to start." : status === "replanning" ? steerPaused(run["failedReason"], progress) : `Running: ${RUNNING[status] ?? status}${progress}.`,
 			gated: handback ? `Handed back to a person: ${handback}. ${pr}${draft ? `${draft},` : ""} waits for them to ${handbackNextStep(run["reviewEscalation"], run["provider"])}.` : `Waiting for a person to review and merge ${pr}${draft}.`,
 			succeeded: `Merged: ${pr} is in ${typeof run["baseBranch"] === "string" ? run["baseBranch"] : "the base branch"}.`,
 			unmerged: typeof run["prNumber"] === "number" || run["prUrl"] ? `Settled without merging: ${pr} was left unmerged.` : "Settled without a merged pull request.",
@@ -30629,12 +30947,12 @@ function steerPaused(reason, progress) {
 */
 function replanHandedBack(reason, error, progress) {
 	if (reason !== "replan_refused" && reason !== "replan_failed") return null;
-	const why = plannerReasonSaid(error);
+	const why = reasonOnOneLine(error);
 	if (reason === "replan_refused") return `Stopped${progress}, handed back: the planner would not plan the request for changes${why ? `: ${why}` : "."} Resume continues the original plan.`;
 	return `Stopped${progress}, handed back: ${why ?? "the plan could not be revised."} Resume continues the original plan.`;
 }
 /** A hand-back's reason on one line, ending as a sentence, capped for a row. */
-function plannerReasonSaid(error) {
+function reasonOnOneLine(error) {
 	if (typeof error !== "string") return null;
 	const text = error.replace(/\s+/g, " ").trim();
 	if (!text) return null;
@@ -30720,7 +31038,7 @@ const FAILED_REASON_MEANS = {
 * text out: its first sentence is in the outcome, and taiga_get_run has it all.
 */
 function readableRun(run, opts = {}) {
-	const { prDraft, error, reviewEscalation, runtime: _runtime, origin, ...rest } = run;
+	const { prDraft, error, reviewEscalation, runtime: _runtime, origin, factoryBlockedBecause: _inTheOutcome, ...rest } = run;
 	const said = runOutcome(run);
 	const means = FAILED_REASON_MEANS[String(run["failedReason"])];
 	const hardening = run["hardeningResult"];
@@ -31085,6 +31403,7 @@ function registerBuildTools(server, client) {
 }
 /** What happened to a request that steers a run (PRO-3161), in one sentence. */
 function steerSituation(steer) {
+	if (steer === "sent") return "The run takes it as an instruction while it keeps working.";
 	if (steer === "replanning") return "The run has paused and its plan is being revised for the request.";
 	if (steer === "after_step") return "The run stops when the step it is building ends, then its plan is revised.";
 	if (steer === "after_round") return "The run is answering review comments or fixing CI; the request is planned when that round ends, and no further automatic round starts while it is open.";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.36.0-rc.892",
+  "version": "0.36.0-rc.926",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",