ai-dev-requirements 0.1.13 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 daguanren21
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -10,8 +10,9 @@ An agent harness workflow for AI coding tools, enabling controlled requirement i
 
 | Deliverable | Description |
 |-------------|-------------|
-| **Requirements MCP Server** (`src/`) | MCP server for fetching requirements, with built-in ONES adapter. Installable via npm. |
+| **Requirements MCP Server** (`src/`) | MCP server for ONES work items. Routes 需求/任务/缺陷 by `issueType.detailType`. |
 | **Agent Harness Workflow Skill** (`skills/dev-workflow/`) | Self-contained agent harness skill. Install it to run requirement intake, planning, gated execution, verification, review, and handoff. |
+| **Grill-me Skills** (`skills/grill-me/`, `skills/grilling/`) | Interview loop for open product decisions. Uses `get_grilling_brief`; does not live in the MCP server. |
 
 ---
 
@@ -127,6 +128,14 @@ Add to your `.mcp.json`:
 }
 ```
 
+#### MCP security boundaries
+
+- ONES titles, descriptions, test cases, and attachment metadata are marked as untrusted data. Instructions embedded in them must never drive tool calls.
+- Rich HTML is converted to bounded plain text. URL credentials, query strings, fragments, remote error bodies, and internal API base URLs are not returned to the model.
+- Image downloads accept only configured-source URLs or URLs issued by the authenticated ONES attachment API. Redirects are revalidated; private-network targets are rejected unless they are the configured source itself.
+- A tool call downloads at most 8 PNG/JPEG/GIF/WebP images, each at most 8 MiB with a 10-second timeout.
+- Mutation tools remain separate calls and require explicit user confirmation in the workflow.
+
 ### 5. Add Companion MCP Servers (Optional)
 
 Requirements are not limited to ONES. Pair with official MCP servers for GitHub / Jira / Figma:
@@ -194,16 +203,14 @@ skills/dev-workflow/
 
 ```
 ai-dev-workflow/
-├── skills/dev-workflow/             # Agent Harness Workflow Skill (self-contained)
-│   ├── SKILL.md
-│   └── references/
-│       ├── workflow.md              # Agent harness lifecycle
-│       ├── task-types.md
-│       ├── service-transform.md
-│       └── templates/
+├── skills/
+│   ├── grill-me/                    # User-invoked grilling entry
+│   ├── grilling/                    # Interview primitive
+│   └── dev-workflow/                # Agent Harness Workflow Skill
 │
 ├── src/                             # Requirements MCP Server source
-│   ├── index.ts                     # Entry & MCP Server definition
+│   ├── index.ts                     # Stdio bootstrap
+│   ├── server.ts                    # MCP Server factory & tool registration (SDK v2)
 │   ├── adapters/
 │   │   ├── base.ts                  # BaseAdapter abstract class
 │   │   ├── ones.ts                  # ONES adapter
@@ -211,7 +218,8 @@ ai-dev-workflow/
 │   ├── config/
 │   │   └── loader.ts                # Config loading & env resolution
 │   ├── tools/
-│   │   ├── get-requirement.ts       # get_requirement tool
+│   │   ├── get-work-item.ts         # get_work_item tool
+│   │   ├── get-grilling-brief.ts    # get_grilling_brief tool
 │   │   ├── search-requirements.ts   # search_requirements tool
 │   │   └── list-sources.ts          # list_sources tool
 │   ├── types/
@@ -220,13 +228,17 @@ ai-dev-workflow/
 │   │   └── requirement.ts
 │   └── utils/
 │       ├── http.ts
-│       └── map-status.ts
+│       ├── map-status.ts
+│       └── ones-issue-kind.ts
 │
+├── packages/ai-dev-requirements/   # Publishable Changesets workspace package
+│   ├── package.json
+│   ├── tsdown.config.ts
+│   └── skills/
 ├── tests/                           # Tests
 ├── .requirements-mcp.json.example   # MCP Server config template
-├── package.json
+├── package.json                     # Private workspace orchestrator
 ├── tsconfig.json
-├── tsdown.config.ts
 └── vitest.config.ts
 ```
 
@@ -237,11 +249,11 @@ ai-dev-workflow/
 | Technology | Purpose |
 |------------|---------|
 | TypeScript | MCP Server language |
-| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | MCP protocol SDK |
+| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | MCP protocol SDK v2 |
 | [Zod](https://zod.dev/) | Schema validation & type inference |
 | [tsdown](https://github.com/nicepkg/tsdown) | Build tool (ESM + CJS + dts) |
 | [Vitest](https://vitest.dev/) | Test framework |
-| [bumpp](https://github.com/antfu/bumpp) | Version management & publishing |
+| [Changesets v3](https://github.com/changesets/changesets) | Version PRs, changelogs, and npm publishing |
 | Node.js >= 20 | Runtime |
 
 ---
@@ -265,14 +277,6 @@ pnpm test
 pnpm lint
 ```
 
-### Publishing
-
-This project uses [bumpp](https://github.com/antfu/bumpp) for version management:
-
-```bash
-# Interactive version bump, auto commit + tag + push
-pnpm release
-```
 
 ---
 

package/README.zh-CN.md

@@ -10,8 +10,9 @@
 
 | 交付物 | 说明 |
 |-------|------|
-| **Requirements MCP Server** (`src/`) | 需求获取 MCP 服务，内置 ONES 适配器，可通过 npm 安装 |
+| **Requirements MCP Server** (`src/`) | 需求获取 MCP 服务。按 `issueType.detailType` 区分需求 / 任务 / 缺陷。 |
 | **Agent Harness Workflow Skill** (`skills/dev-workflow/`) | 自包含的 AI agent harness 工作流 Skill，安装后即可跑通需求接入、计划、门禁执行、验证、审查和交付。 |
+| **Grill-me Skills** (`skills/grill-me/`, `skills/grilling/`) | 开工前访谈循环。先调 `get_grilling_brief`；访谈本身不进 MCP Server。 |
 
 ---
 
@@ -127,6 +128,14 @@ npm install -g ai-dev-requirements
 }
 ```
 
+#### MCP 安全边界
+
+- ONES 标题、正文、测试用例和附件元数据统一标记为不可信数据；其中夹带的指令不得触发工具调用。
+- 富文本会转换为有长度上限的纯文本；URL 凭据、query、fragment、远端错误正文和内部 API Base 不会返回给模型。
+- 图片仅允许来自已配置的源，或由已认证 ONES 附件 API 签发的 URL。每次跳转都会重新校验；除已配置源本身外，私网目标会被拒绝。
+- 单次工具调用最多下载 8 张 PNG/JPEG/GIF/WebP 图片，每张上限 8 MiB，超时 10 秒。
+- 写操作保持为独立工具调用，并由工作流要求用户明确确认。
+
 ### 5. 搭配其他 MCP Server（可选）
 
 需求不限于 ONES，可搭配官方 MCP Server 获取 GitHub / Jira / Figma 资源：
@@ -194,16 +203,13 @@ skills/dev-workflow/
 
 ```
 ai-dev-workflow/
-├── skills/dev-workflow/             # Agent Harness Workflow Skill（自包含工作流）
-│   ├── SKILL.md
-│   └── references/
-│       ├── workflow.md              # Agent harness 生命周期
-│       ├── task-types.md
-│       ├── service-transform.md
-│       └── templates/
-│
+├── skills/
+│   ├── grill-me/                    # 用户入口
+│   ├── grilling/                    # 访谈原语
+│   └── dev-workflow/                # Agent Harness Workflow Skill
 ├── src/                             # Requirements MCP Server 源码
-│   ├── index.ts                     # 入口 & MCP Server 定义
+│   ├── index.ts                     # Stdio 启动入口
+│   ├── server.ts                    # MCP Server 工厂与工具注册（SDK v2）
 │   ├── adapters/
 │   │   ├── base.ts                  # BaseAdapter 抽象类
 │   │   ├── ones.ts                  # ONES 适配器
@@ -211,7 +217,8 @@ ai-dev-workflow/
 │   ├── config/
 │   │   └── loader.ts                # 配置文件加载 & 环境变量解析
 │   ├── tools/
-│   │   ├── get-requirement.ts       # get_requirement 工具
+│   │   ├── get-work-item.ts         # get_work_item 工具
+│   │   ├── get-grilling-brief.ts    # get_grilling_brief 工具
 │   │   ├── search-requirements.ts   # search_requirements 工具
 │   │   └── list-sources.ts          # list_sources 工具
 │   ├── types/
@@ -220,13 +227,17 @@ ai-dev-workflow/
 │   │   └── requirement.ts
 │   └── utils/
 │       ├── http.ts
-│       └── map-status.ts
+│       ├── map-status.ts
+│       └── ones-issue-kind.ts
 │
+├── packages/ai-dev-requirements/   # Changesets 管理的可发布 workspace package
+│   ├── package.json
+│   ├── tsdown.config.ts
+│   └── skills/
 ├── tests/                           # 测试
 ├── .requirements-mcp.json.example   # MCP Server 配置模板
-├── package.json
+├── package.json                     # 私有 workspace 编排
 ├── tsconfig.json
-├── tsdown.config.ts
 └── vitest.config.ts
 ```
 
@@ -237,11 +248,11 @@ ai-dev-workflow/
 | 技术 | 用途 |
 |-----|------|
 | TypeScript | MCP Server 开发语言 |
-| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | MCP 协议 SDK |
+| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | MCP 协议 SDK v2 |
 | [Zod](https://zod.dev/) | 参数校验与类型推导 |
 | [tsdown](https://github.com/nicepkg/tsdown) | 构建工具（ESM + CJS + dts） |
 | [Vitest](https://vitest.dev/) | 测试框架 |
-| [bumpp](https://github.com/antfu/bumpp) | 版本管理与发布 |
+| [Changesets v3](https://github.com/changesets/changesets) | Version PR、变更日志与 npm 发布 |
 | Node.js >= 20 | 运行时 |
 
 ---
@@ -265,14 +276,6 @@ pnpm test
 pnpm lint
 ```
 
-### 发版流程
-
-本项目使用 [bumpp](https://github.com/antfu/bumpp) 管理版本：
-
-```bash
-# 交互式选择版本号，自动 commit + tag + push
-pnpm release
-```
 
 ---