@taiga-ai/mcp-server 0.37.0-dev.974 → 0.37.0-dev.976

package/dist/index.js

@@ -23883,6 +23883,10 @@ var TaigaClient = class {
 	async listBuildRunSteps(id) {
 		return this.request("GET", `/builds/${seg(id)}/steps`);
 	}
+	/** The public hosts the run reached through the egress gateway (PRO-4268). */
+	async listBuildRunEgressHosts(id) {
+		return this.request("GET", `/builds/${seg(id)}/hosts`);
+	}
 	async getMaintenanceSummary(productId) {
 		return this.request("GET", `/products/${seg(productId)}/maintenance/summary`);
 	}
@@ -27218,16 +27222,18 @@ const EXCEL_MAX_ROW = 1048576;
 * Where an engineer build's sandbox may connect to (PRO-2793, part of
 * PRO-1980).
 *
-* The engineer pod's credential gateway is the sandbox's only way out. By
-* default it lets through a standard list: the public package registries,
-* toolchain downloads, container registries, GitHub for reading public
-* dependencies, and the tenant's own registries. A product adds to that:
+* The egress gateway is the sandbox's only way out for what the other
+* gateways do not carry (packages, images, toolchains, scanners). Reads are
+* open and writes are controlled (PRO-4266): every run is held to an upload
+* budget, the gateway refuses private and metadata addresses, and it never
+* hands the sandbox a credential, whichever access a product has.
 *
-* - `allowlist` (the default, also what `null` means): the standard list plus
-*   the product's own `networkHosts`.
-* - `unrestricted`: any public host. For a product whose builds need hosts
-*   nobody can list in advance; the gateway still refuses private and
-*   metadata addresses, and still never hands the sandbox a credential.
+* - `unrestricted` (the default, also what `null` means): any public host.
+*   A list of hosts nobody can keep complete broke builds one host at a time.
+* - `allowlist`: only the gateway's standard list (the public package
+*   registries, toolchain downloads, container registries, GitHub for public
+*   dependencies, the tenant's own registries) plus the product's own
+*   `networkHosts`. For a product that wants to name where its builds go.
 *
 * A host is one exact name (`api.example.com`). There are no wildcards: a
 * wildcard over a multi-label public suffix (`*.co.uk`) or a provider's
@@ -35739,7 +35745,7 @@ const PRODUCT_VIEW_FIELDS = [
 	"createdAt",
 	"updatedAt"
 ];
-const UNSET_MEANS = "A null setting is unset: kind reads as application; autoMerge follows the factory, then the organization; ownsInfrastructure and ownsDeployment follow the organization default (yes when it has none); ownsApplication is yes; emitDesignStandards follows how the product started; networkAccess is allowlist. signalAutonomy is what each kind of finding resolves to (off, notify, propose, build, merge) and what decided it: the product, the kind default or cap, or auto-merge consent. dailyFixLimit is how many fixes Taiga may raise on its own per day, set by the product or the starting value (setBy default).";
+const UNSET_MEANS = "A null setting is unset: kind reads as application; autoMerge follows the factory, then the organization; ownsInfrastructure and ownsDeployment follow the organization default (yes when it has none); ownsApplication is yes; emitDesignStandards follows how the product started; networkAccess is unrestricted. signalAutonomy is what each kind of finding resolves to (off, notify, propose, build, merge) and what decided it: the product, the kind default or cap, or auto-merge consent. dailyFixLimit is how many fixes Taiga may raise on its own per day, set by the product or the starting value (setBy default).";
 /**
 * Each product's policy standing beside its row: the counts the standing read opens with. A product still in setup
 * has none to read; a read the API refuses or fails says so on its row rather than failing the list.
@@ -37214,14 +37220,21 @@ function registerBuildTools(server, client) {
 	}));
 	server.registerTool("taiga_get_run", {
 		title: "Get run",
-		description: "Read one coding agent run, and why it failed when it did: its outcome, pull request, security pass (scanCoverage names scanners that did not run) and each step with its commit, files and checks. A failed run says where it stopped (stoppedIn) and the line of the error that says why (cause). full: true adds every step's instructions and report. lastReplan says what a request for changes did to the plan the run builds now: the steps it added, edited and dropped. A failed or stopped run's nextStep says how to carry it on (taiga_resume_initiative on its initiative).",
+		description: "Read one coding agent run, and why it failed when it did: its outcome, pull request, security pass (scanCoverage names scanners that did not run) and each step with its commit, files and checks. A failed run says where it stopped (stoppedIn) and the line of the error that says why (cause). full: true adds every step's instructions and report. lastReplan says what a request for changes did to the plan the run builds now: the steps it added, edited and dropped. A failed or stopped run's nextStep says how to carry it on (taiga_resume_initiative on its initiative). hostsReached lists the public hosts the run reached through the egress gateway, first reached first, with the bytes it sent and received there.",
 		inputSchema: object({
 			runId,
 			full: boolean().optional().describe("Carry each step's complete instructions and report (default false: a summary)")
 		}),
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => {
-		const [run, steps] = await Promise.all([client.getBuildRun(params.runId), client.listBuildRunSteps(params.runId)]);
+		const [run, steps, hosts] = await Promise.all([
+			client.getBuildRun(params.runId),
+			client.listBuildRunSteps(params.runId),
+			client.listBuildRunEgressHosts(params.runId).catch((error) => {
+				if (error instanceof TaigaApiError && error.status === 404) return { data: [] };
+				throw error;
+			})
+		]);
 		const runRow = run.data;
 		const rows = steps.data.map((step) => neverStarted(step));
 		const where = stoppedIn(runRow, rows);
@@ -37239,7 +37252,8 @@ function registerBuildTools(server, client) {
 			...lastReplan ? { lastReplan: {
 				...lastReplan,
 				waitsForReview
-			} } : {}
+			} } : {},
+			...hostsReachedOf(hosts.data)
 		};
 		const note = verificationNote(rows);
 		const verification = note ? { verificationNote: note } : {};
@@ -37299,6 +37313,22 @@ function steerSituation(steer) {
 	if (steer === "after_round") return "The run is answering review comments or fixing CI; the request is planned when that round ends, and no further automatic round starts while it is open.";
 	return "A re-plan is already running; the request joins it.";
 }
+/** At most this many hosts in a run's read; the rest are counted. */
+const HOSTS_REACHED_SHOWN = 50;
+/** Where a run went (PRO-4268): its hosts, first reached first, or nothing for a run that reached none. */
+function hostsReachedOf(hosts) {
+	if (hosts.length === 0) return {};
+	const shown = hosts.slice(0, HOSTS_REACHED_SHOWN).map(({ host, sentBytes, receivedBytes, connections }) => ({
+		host,
+		sentBytes,
+		receivedBytes,
+		connections
+	}));
+	return {
+		hostsReached: shown,
+		...hosts.length > shown.length ? { hostsReachedNotShown: hosts.length - shown.length } : {}
+	};
+}
 //#endregion
 //#region src/tools/queue.ts
 /** How many entries the read names; past this an entry keeps its initiativeId only. */
@@ -55425,7 +55455,7 @@ function registerSetupTools(server, client) {
 	}));
 	server.registerTool("taiga_update_product", {
 		title: "Change a product's settings",
-		description: "Change a product's name, what Taiga builds for it (application, infrastructure, pipelines), or where its builds may connect (networkAccess: allowlist, Taiga's standard list plus the product's networkHosts, or unrestricted, any public host; networkHosts replaces the list, each one exact DNS name, no wildcard or domain anyone can host on, 100 at most; changes apply from the next build). A new name changes its slug. Later plans follow the change; planned work is not redone.",
+		description: "Change a product's name, what Taiga builds for it (application, infrastructure, pipelines), or where its builds may connect (networkAccess: unrestricted, any public host, the default; or allowlist, Taiga's standard list plus the product's networkHosts; networkHosts replaces the list, each one exact DNS name, no wildcard or domain anyone can host on, 100 at most; changes apply from the next build). A new name changes its slug. Later plans follow the change; planned work is not redone.",
 		inputSchema: object({
 			productId,
 			name: string$2().trim().min(1).max(255).optional().describe("A new name"),
@@ -55433,7 +55463,7 @@ function registerSetupTools(server, client) {
 			...buildScope,
 			deploymentNotes: deploymentNotes.nullable().optional(),
 			emitDesignStandards: boolean().nullable().optional().describe("Inherit the organization's design standards; null follows the default"),
-			networkAccess: _enum(PRODUCT_NETWORK_ACCESS).nullable().optional().describe("Where a build's sandbox may connect: allowlist (the default; null returns to it) or unrestricted"),
+			networkAccess: _enum(PRODUCT_NETWORK_ACCESS).nullable().optional().describe("Where a build's sandbox may connect: unrestricted (the default; null returns to it) or allowlist"),
 			networkHosts: array(string$2().trim().toLowerCase().min(1).max(253)).max(100).optional().describe("The product's own hosts beyond the standard list, replacing the current ones: exact DNS names such as api.example.com")
 		}),
 		annotations: OPERATE_SETTING

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.37.0-dev.974",
+  "version": "0.37.0-dev.976",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",