@taiga-ai/mcp-server 0.37.0-rc.956 → 0.37.0-rc.984

package/dist/index.js

@@ -23883,6 +23883,10 @@ var TaigaClient = class {
 	async listBuildRunSteps(id) {
 		return this.request("GET", `/builds/${seg(id)}/steps`);
 	}
+	/** The public hosts the run reached through the egress gateway (PRO-4268). */
+	async listBuildRunEgressHosts(id) {
+		return this.request("GET", `/builds/${seg(id)}/hosts`);
+	}
 	async getMaintenanceSummary(productId) {
 		return this.request("GET", `/products/${seg(productId)}/maintenance/summary`);
 	}
@@ -23957,6 +23961,10 @@ var TaigaClient = class {
 	async shipNotices(productId) {
 		return this.request("POST", `/products/${seg(productId)}/maintenance/notices`, {});
 	}
+	/** Sweep one of a product's repositories (PRO-4276): its primary when none is named. */
+	async startSweep(productId, productRepositoryId) {
+		return this.request("POST", `/products/${seg(productId)}/maintenance/sweeps`, productRepositoryId ? { productRepositoryId } : {});
+	}
 	async remediateFinding(productId, findingId) {
 		return this.request("POST", `/products/${seg(productId)}/maintenance/findings/${seg(findingId)}/remediate`, {});
 	}
@@ -26210,6 +26218,46 @@ const ENVIRONMENT_TYPES = [
 	"custom"
 ];
 //#endregion
+//#region ../../packages/types/dist/monitoring-rollups.js
+/**
+* Core Web Vitals weighted heaviest (LCP/INP/CLS are Google's "Core" trio);
+* FCP/TTFB are supporting signals. Thresholds are the published web.dev values.
+*/
+const METRICS = {
+	LCP: {
+		good: 2500,
+		ni: 4e3,
+		unit: "ms",
+		weight: 30
+	},
+	INP: {
+		good: 200,
+		ni: 500,
+		unit: "ms",
+		weight: 30
+	},
+	CLS: {
+		good: .1,
+		ni: .25,
+		unit: "score",
+		weight: 25
+	},
+	FCP: {
+		good: 1800,
+		ni: 3e3,
+		unit: "ms",
+		weight: 10
+	},
+	TTFB: {
+		good: 800,
+		ni: 1800,
+		unit: "ms",
+		weight: 5
+	}
+};
+Object.keys(METRICS);
+Object.fromEntries(Object.entries(METRICS).map(([name, spec]) => [name, spec.weight]));
+//#endregion
 //#region ../../packages/types/dist/api-keys.js
 /**
 * API key scopes control what operations a key can perform.
@@ -27218,16 +27266,18 @@ const EXCEL_MAX_ROW = 1048576;
 * Where an engineer build's sandbox may connect to (PRO-2793, part of
 * PRO-1980).
 *
-* The engineer pod's credential gateway is the sandbox's only way out. By
-* default it lets through a standard list: the public package registries,
-* toolchain downloads, container registries, GitHub for reading public
-* dependencies, and the tenant's own registries. A product adds to that:
+* The egress gateway is the sandbox's only way out for what the other
+* gateways do not carry (packages, images, toolchains, scanners). Reads are
+* open and writes are controlled (PRO-4266): every run is held to an upload
+* budget, the gateway refuses private and metadata addresses, and it never
+* hands the sandbox a credential, whichever access a product has.
 *
-* - `allowlist` (the default, also what `null` means): the standard list plus
-*   the product's own `networkHosts`.
-* - `unrestricted`: any public host. For a product whose builds need hosts
-*   nobody can list in advance; the gateway still refuses private and
-*   metadata addresses, and still never hands the sandbox a credential.
+* - `unrestricted` (the default, also what `null` means): any public host.
+*   A list of hosts nobody can keep complete broke builds one host at a time.
+* - `allowlist`: only the gateway's standard list (the public package
+*   registries, toolchain downloads, container registries, GitHub for public
+*   dependencies, the tenant's own registries) plus the product's own
+*   `networkHosts`. For a product that wants to name where its builds go.
 *
 * A host is one exact name (`api.example.com`). There are no wildcards: a
 * wildcard over a multi-label public suffix (`*.co.uk`) or a provider's
@@ -27965,7 +28015,7 @@ const TOOLSET_PURPOSE = {
 	core: "where products, initiatives, runs, policies and findings stand",
 	operate: "moving work: queue, plans, runs, fixes, Action Required",
 	setup: "creating and configuring factories, products, repositories, environments and autonomy",
-	observe: "deployments, monitoring, delivery metrics and the package inventory",
+	observe: "deployments, monitoring, delivery metrics, the package inventory and the sweeps that read it",
 	documents: "writing documents and knowledge, and regenerating product documents"
 };
 /** Every tool's toolset. A tool missing here fails at registration, so none can be added without a home. */
@@ -28032,6 +28082,7 @@ const TOOLSET_OF = {
 	taiga_get_monitoring: "observe",
 	taiga_get_delivery_metrics: "observe",
 	taiga_list_packages: "observe",
+	taiga_start_sweep: "observe",
 	taiga_list_licenses: "observe",
 	taiga_change_license: "setup",
 	taiga_get_sbom: "observe",
@@ -34801,6 +34852,21 @@ const SWEEP_FIELDS = [
 	"createdAt",
 	"completedAt"
 ];
+/** Advisories a sweep's summary names, at most. */
+const ADVISORIES_SHOWN = 10;
+/**
+* The advisories whose arrival in OSV's feed started a sweep (PRO-116), only
+* where some did: a sweep a push, the clock or a person started says nothing.
+*/
+function startedByAdvisories(sweep) {
+	const raw = sweep.advisories;
+	const advisories = Array.isArray(raw) ? raw.filter((a) => typeof a === "string") : [];
+	if (advisories.length === 0) return {};
+	return advisories.length > ADVISORIES_SHOWN ? {
+		advisories: advisories.slice(0, ADVISORIES_SHOWN),
+		advisoriesCount: advisories.length
+	} : { advisories };
+}
 /**
 * The images a sweep's shipped images build on that it could not read, and
 * why (PRO-4073): a base nobody read is no clean base. Only where the API
@@ -34930,7 +34996,8 @@ async function sweepOverview(client, productId) {
 	const [summary, sweeps] = await Promise.all([client.getMaintenanceSummary(productId), client.listMaintenanceSweeps(productId, { limit: 3 })]);
 	const latest = sweeps.data.map((sweep) => ({
 		...pickFields([sweep], SWEEP_FIELDS)[0],
-		...notReadBases(sweep)
+		...notReadBases(sweep),
+		...startedByAdvisories(sweep)
 	}));
 	const { lastRun: _lastRun, lastRuns: _lastRuns, topFindings: _top, violatedControls: _controls, ...counts } = summary.data;
 	return {
@@ -35097,7 +35164,7 @@ function registerMaintenanceTools(server, client) {
 	}, (params) => runTool(async () => toolResult({ notices: await client.getNotices(params.productId, params.linkId) })));
 	server.registerTool("taiga_get_finding", {
 		title: "Get a maintenance finding",
-		description: "Read one finding: how likely it is to be exploited, the advisory and its fixed version, where it is, which policy controls it breaches, and any fix under way. fixable: false says taiga_fix_finding would refuse it. A secret's value is never stored.",
+		description: "Read one finding: how likely it is to be exploited, the advisory and its fixed version, where it is, which policy controls it breaches, any fix under way, and triage: whether the code reaches it, as its factory judged it at a commit (advice; it never changes the status). fixable: false says taiga_fix_finding would refuse it. A secret's value is never stored.",
 		inputSchema: object({
 			findingId,
 			full: boolean().optional().describe("Carry the advisory's whole record: every affected range and reference (default false)")
@@ -35240,6 +35307,21 @@ function registerMaintenanceTools(server, client) {
 			...params.expiresAt !== void 0 ? { ignoreExpiresAt: params.expiresAt } : {}
 		})).data);
 	}));
+	server.registerTool("taiga_start_sweep", {
+		title: "Sweep a repository",
+		description: "Scan one of a product's repositories now: its dependencies, secrets, code and infrastructure, the findings triaged and its code judged against the policies. Its primary repository when none is named. Returns the sweep; taiga_list_findings and taiga_get_policy_standing read what it found once it completes.",
+		inputSchema: object({
+			productId,
+			linkId: idInput("repository link", "taiga_list_product_repositories gives it (its id); a linkable repository id is not one").optional()
+		}),
+		annotations: OPERATE
+	}, (params) => runTool(async () => {
+		const { id, ...run } = (await client.startSweep(params.productId, params.linkId)).data;
+		return toolResult({
+			sweepId: id,
+			...run
+		});
+	}));
 	server.registerTool("taiga_fix_finding", {
 		title: "Fix a finding",
 		description: "Raise an initiative that fixes a finding; it ends in a pull request, which merges on its own only where the product's auto-merge allows it. wholeGroup: true fixes, in that repository, every open advisory on that package version in one bump, or every place the rule flagged. A malicious package is removed, with every advisory on that version, whatever wholeGroup says. A license finding the row marks fixable has its packages replaced by ones on the approved list. A language runtime moves every file declaring it together, in a container image only to a tag the image has published. Refused when there is no version to move to (fixable: false; for a runtime, also while its image has not published the fix), the code is in a submodule, or a secret is only in history (rotate it outside Taiga).",
@@ -35723,7 +35805,7 @@ const PRODUCT_VIEW_FIELDS = [
 	"createdAt",
 	"updatedAt"
 ];
-const UNSET_MEANS = "A null setting is unset: kind reads as application; autoMerge follows the factory, then the organization; ownsInfrastructure and ownsDeployment follow the organization default (yes when it has none); ownsApplication is yes; emitDesignStandards follows how the product started; networkAccess is allowlist. signalAutonomy is what each kind of finding resolves to (off, notify, propose, build, merge) and what decided it: the product, the kind default or cap, or auto-merge consent. dailyFixLimit is how many fixes Taiga may raise on its own per day, set by the product or the starting value (setBy default).";
+const UNSET_MEANS = "A null setting is unset: kind reads as application; autoMerge follows the factory, then the organization; ownsInfrastructure and ownsDeployment follow the organization default (yes when it has none); ownsApplication is yes; emitDesignStandards follows how the product started; networkAccess is unrestricted. signalAutonomy is what each kind of finding resolves to (off, notify, propose, build, merge) and what decided it: the product, the kind default or cap, or auto-merge consent. dailyFixLimit is how many fixes Taiga may raise on its own per day, set by the product or the starting value (setBy default).";
 /**
 * Each product's policy standing beside its row: the counts the standing read opens with. A product still in setup
 * has none to read; a read the API refuses or fails says so on its row rather than failing the list.
@@ -36752,13 +36834,14 @@ function changeRequestRef(provider, number) {
 }
 /** What a person does about a handback, by its reason, as the web's handback detail says it, on the run's forge. */
 function handbackNextStep(escalation, provider = null) {
-	const terms = FORGE_TERMS[forgeOf({ provider }) ?? "github"];
-	const where = terms.name;
+	const forge = forgeOf({ provider });
+	const terms = FORGE_TERMS[forge ?? "github"];
+	const where = forge ? ` on ${terms.name}` : "";
 	const changeRequest = terms.changeRequest;
 	const reason = escalation && typeof escalation === "object" ? escalation.reason : null;
-	if (reason === "check_weakened") return `review that change on ${where} before merging`;
-	if (reason === "ci_never_settled") return `look at what is still running or queued in CI on ${where}, then review the ${changeRequest}`;
-	return `fix it by hand, or review the ${changeRequest} on ${where}, which hands it back to the agent`;
+	if (reason === "check_weakened") return `review that change${where} before merging`;
+	if (reason === "ci_never_settled") return `look at what is still running or queued in CI${where}, then review the ${changeRequest}`;
+	return `fix it by hand, or review the ${changeRequest}${where}, which hands it back to the agent`;
 }
 /** The web's words for why Taiga keeps a pull request a draft. */
 const READY_BLOCKER_SAID = {
@@ -37197,14 +37280,21 @@ function registerBuildTools(server, client) {
 	}));
 	server.registerTool("taiga_get_run", {
 		title: "Get run",
-		description: "Read one coding agent run, and why it failed when it did: its outcome, pull request, security pass (scanCoverage names scanners that did not run) and each step with its commit, files and checks. A failed run says where it stopped (stoppedIn) and the line of the error that says why (cause). full: true adds every step's instructions and report. lastReplan says what a request for changes did to the plan the run builds now: the steps it added, edited and dropped. A failed or stopped run's nextStep says how to carry it on (taiga_resume_initiative on its initiative).",
+		description: "Read one coding agent run, and why it failed when it did: its outcome, pull request, security pass (scanCoverage names scanners that did not run) and each step with its commit, files and checks. A failed run says where it stopped (stoppedIn) and the line of the error that says why (cause). full: true adds every step's instructions and report. lastReplan says what a request for changes did to the plan the run builds now: the steps it added, edited and dropped. A failed or stopped run's nextStep says how to carry it on (taiga_resume_initiative on its initiative). hostsReached lists the public hosts the run reached through the egress gateway, first reached first, with the bytes it sent and received there.",
 		inputSchema: object({
 			runId,
 			full: boolean().optional().describe("Carry each step's complete instructions and report (default false: a summary)")
 		}),
 		annotations: READ_ONLY
 	}, (params) => runTool(async () => {
-		const [run, steps] = await Promise.all([client.getBuildRun(params.runId), client.listBuildRunSteps(params.runId)]);
+		const [run, steps, hosts] = await Promise.all([
+			client.getBuildRun(params.runId),
+			client.listBuildRunSteps(params.runId),
+			client.listBuildRunEgressHosts(params.runId).catch((error) => {
+				if (error instanceof TaigaApiError && error.status === 404) return { data: [] };
+				throw error;
+			})
+		]);
 		const runRow = run.data;
 		const rows = steps.data.map((step) => neverStarted(step));
 		const where = stoppedIn(runRow, rows);
@@ -37222,7 +37312,8 @@ function registerBuildTools(server, client) {
 			...lastReplan ? { lastReplan: {
 				...lastReplan,
 				waitsForReview
-			} } : {}
+			} } : {},
+			...hostsReachedOf(hosts.data)
 		};
 		const note = verificationNote(rows);
 		const verification = note ? { verificationNote: note } : {};
@@ -37282,6 +37373,22 @@ function steerSituation(steer) {
 	if (steer === "after_round") return "The run is answering review comments or fixing CI; the request is planned when that round ends, and no further automatic round starts while it is open.";
 	return "A re-plan is already running; the request joins it.";
 }
+/** At most this many hosts in a run's read; the rest are counted. */
+const HOSTS_REACHED_SHOWN = 50;
+/** Where a run went (PRO-4268): its hosts, first reached first, or nothing for a run that reached none. */
+function hostsReachedOf(hosts) {
+	if (hosts.length === 0) return {};
+	const shown = hosts.slice(0, HOSTS_REACHED_SHOWN).map(({ host, sentBytes, receivedBytes, connections }) => ({
+		host,
+		sentBytes,
+		receivedBytes,
+		connections
+	}));
+	return {
+		hostsReached: shown,
+		...hosts.length > shown.length ? { hostsReachedNotShown: hosts.length - shown.length } : {}
+	};
+}
 //#endregion
 //#region src/tools/queue.ts
 /** How many entries the read names; past this an entry keeps its initiativeId only. */
@@ -55408,7 +55515,7 @@ function registerSetupTools(server, client) {
 	}));
 	server.registerTool("taiga_update_product", {
 		title: "Change a product's settings",
-		description: "Change a product's name, what Taiga builds for it (application, infrastructure, pipelines), or where its builds may connect (networkAccess: allowlist, Taiga's standard list plus the product's networkHosts, or unrestricted, any public host; networkHosts replaces the list, each one exact DNS name, no wildcard or domain anyone can host on, 100 at most; changes apply from the next build). A new name changes its slug. Later plans follow the change; planned work is not redone.",
+		description: "Change a product's name, what Taiga builds for it (application, infrastructure, pipelines), or where its builds may connect (networkAccess: unrestricted, any public host, the default; or allowlist, Taiga's standard list plus the product's networkHosts; networkHosts replaces the list, each one exact DNS name, no wildcard or domain anyone can host on, 100 at most; changes apply from the next build). A new name changes its slug. Later plans follow the change; planned work is not redone.",
 		inputSchema: object({
 			productId,
 			name: string$2().trim().min(1).max(255).optional().describe("A new name"),
@@ -55416,7 +55523,7 @@ function registerSetupTools(server, client) {
 			...buildScope,
 			deploymentNotes: deploymentNotes.nullable().optional(),
 			emitDesignStandards: boolean().nullable().optional().describe("Inherit the organization's design standards; null follows the default"),
-			networkAccess: _enum(PRODUCT_NETWORK_ACCESS).nullable().optional().describe("Where a build's sandbox may connect: allowlist (the default; null returns to it) or unrestricted"),
+			networkAccess: _enum(PRODUCT_NETWORK_ACCESS).nullable().optional().describe("Where a build's sandbox may connect: unrestricted (the default; null returns to it) or allowlist"),
 			networkHosts: array(string$2().trim().toLowerCase().min(1).max(253)).max(100).optional().describe("The product's own hosts beyond the standard list, replacing the current ones: exact DNS names such as api.example.com")
 		}),
 		annotations: OPERATE_SETTING
@@ -55724,6 +55831,7 @@ const PAID_WORK = /* @__PURE__ */ new Set([
 	"taiga_review_plan",
 	"taiga_set_auto_build",
 	"taiga_start_import",
+	"taiga_start_sweep",
 	"taiga_stop_generating_documents",
 	"taiga_stop_run",
 	"taiga_sync_design_tokens"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.37.0-rc.956",
+  "version": "0.37.0-rc.984",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "license": "UNLICENSED",