devglide 0.1.1

package/src/apps/kanban/src/mcp-helpers.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, expect } from 'vitest';
+import { normalizeEscapes, truncateDescription, DEFAULT_COLUMNS, mapColumnRow, mapIssueRow } from './mcp-helpers.js';
+import type { ColumnRow, IssueRow } from './db.js';
+
+describe('normalizeEscapes', () => {
+  it('converts literal \\n to newline', () => {
+    expect(normalizeEscapes('line1\\nline2')).toBe('line1\nline2');
+  });
+
+  it('converts literal \\t to tab', () => {
+    expect(normalizeEscapes('col1\\tcol2')).toBe('col1\tcol2');
+  });
+
+  it('handles multiple escapes', () => {
+    expect(normalizeEscapes('a\\nb\\nc\\td')).toBe('a\nb\nc\td');
+  });
+
+  it('returns unchanged string when no escapes', () => {
+    expect(normalizeEscapes('no escapes here')).toBe('no escapes here');
+  });
+});
+
+describe('truncateDescription', () => {
+  it('returns null for null/undefined input', () => {
+    expect(truncateDescription(null)).toBeNull();
+    expect(truncateDescription(undefined)).toBeNull();
+  });
+
+  it('returns short descriptions unchanged', () => {
+    expect(truncateDescription('short desc')).toBe('short desc');
+  });
+
+  it('truncates descriptions over 200 chars', () => {
+    const long = 'a'.repeat(250);
+    const result = truncateDescription(long)!;
+    expect(result.length).toBeLessThan(250);
+    expect(result).toContain('…(truncated)');
+  });
+
+  it('returns exactly 200 chars unchanged', () => {
+    const exact = 'x'.repeat(200);
+    expect(truncateDescription(exact)).toBe(exact);
+  });
+});
+
+describe('DEFAULT_COLUMNS', () => {
+  it('has 6 columns in correct order', () => {
+    expect(DEFAULT_COLUMNS).toHaveLength(6);
+    expect(DEFAULT_COLUMNS.map((c) => c.name)).toEqual([
+      'Backlog', 'Todo', 'In Progress', 'In Review', 'Testing', 'Done',
+    ]);
+  });
+
+  it('has sequential order values', () => {
+    expect(DEFAULT_COLUMNS.map((c) => c.order)).toEqual([0, 1, 2, 3, 4, 5]);
+  });
+});
+
+describe('mapColumnRow', () => {
+  it('remaps projectId to featureId', () => {
+    const row: ColumnRow = {
+      id: 'c1', name: 'Todo', order: 1, color: '#blue',
+      projectId: 'proj1', createdAt: '2025-01-01', updatedAt: '2025-01-01',
+    };
+    const mapped = mapColumnRow(row);
+    expect(mapped.featureId).toBe('proj1');
+    expect('projectId' in mapped).toBe(false);
+  });
+
+  it('returns undefined for undefined input', () => {
+    expect(mapColumnRow(undefined)).toBeUndefined();
+  });
+});
+
+describe('mapIssueRow', () => {
+  it('remaps projectId to featureId', () => {
+    const row: IssueRow = {
+      id: 'i1', title: 'Bug', description: null, type: 'BUG',
+      priority: 'HIGH', order: 0, labels: '[]', dueDate: null,
+      reviewFeedback: null, projectId: 'proj1', columnId: 'c1',
+      createdAt: '2025-01-01', updatedAt: '2025-01-01',
+    };
+    const mapped = mapIssueRow(row);
+    expect(mapped.featureId).toBe('proj1');
+    expect(mapped.title).toBe('Bug');
+    expect('projectId' in mapped).toBe(false);
+  });
+});

package/src/apps/kanban/src/mcp-helpers.ts

@@ -0,0 +1,60 @@
+import type Database from "better-sqlite3";
+import type { ColumnRow, IssueRow } from "./db.js";
+
+/** Convert literal escape sequences (\n, \t) to real characters. */
+export function normalizeEscapes(text: string): string {
+  return text.replace(/\\n/g, '\n').replace(/\\t/g, '\t');
+}
+
+// ── Constants ────────────────────────────────────────────────────────────────
+
+export const DEFAULT_COLUMNS = [
+  { name: "Backlog", color: "#64748b", order: 0 },
+  { name: "Todo", color: "#3b82f6", order: 1 },
+  { name: "In Progress", color: "#f59e0b", order: 2 },
+  { name: "In Review", color: "#8b5cf6", order: 3 },
+  { name: "Testing", color: "#14b8a6", order: 4 },
+  { name: "Done", color: "#22c55e", order: 5 },
+];
+
+// ── Row mappers ──────────────────────────────────────────────────────────────
+// Remap internal "projectId" column to external "featureId" for MCP consumers.
+
+type MappedColumn = Omit<ColumnRow, 'projectId'> & { featureId: string };
+type MappedIssue = Omit<IssueRow, 'projectId'> & { featureId: string };
+
+export function mapColumnRow(row: ColumnRow): MappedColumn;
+export function mapColumnRow(row: ColumnRow | undefined): MappedColumn | undefined;
+export function mapColumnRow(row: ColumnRow | undefined): MappedColumn | undefined {
+  if (!row) return row;
+  const { projectId, ...rest } = row;
+  return { ...rest, featureId: projectId };
+}
+
+export function mapIssueRow(row: IssueRow): MappedIssue;
+export function mapIssueRow(row: IssueRow | undefined): MappedIssue | undefined;
+export function mapIssueRow(row: IssueRow | undefined): MappedIssue | undefined {
+  if (!row) return row;
+  const { projectId, ...rest } = row;
+  return { ...rest, featureId: projectId };
+}
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+export function resolveColumnId(
+  db: Database.Database,
+  featureId: string,
+  columnName: string
+): string | null {
+  const col = db
+    .prepare('SELECT id FROM "Column" WHERE projectId = ? AND name = ?')
+    .get(featureId, columnName) as { id: string } | undefined;
+  return col?.id ?? null;
+}
+
+const DESC_TRUNCATE_LEN = 200;
+export function truncateDescription(desc: string | null | undefined): string | null {
+  if (!desc) return desc ?? null;
+  if (desc.length <= DESC_TRUNCATE_LEN) return desc;
+  return desc.slice(0, DESC_TRUNCATE_LEN) + "…(truncated)";
+}

package/src/apps/kanban/src/mcp.ts

@@ -0,0 +1,59 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { createDevglideMcpServer } from "../../../packages/mcp-utils/src/index.js";
+import { registerFeatureTools } from "./tools/feature-tools.js";
+import { registerItemTools } from "./tools/item-tools.js";
+import { registerVersionedEntryTools } from "./tools/versioned-entry-tools.js";
+
+// ── Factory ──────────────────────────────────────────────────────────────────
+
+export function createKanbanMcpServer(
+  projectId?: string | null
+): McpServer {
+  const server = createDevglideMcpServer(
+    "devglide-kanban",
+    "0.1.0",
+    "Kanban board management for features, tasks, and bugs",
+    {
+      instructions: [
+        "## Kanban — Workflow Conventions",
+        "",
+        "### Picking up work",
+        "- When looking for tasks to work on, search the **Todo** column by default (columnName: 'Todo') unless the user specifies a different column or a specific task.",
+        "- Each feature has its own kanban board with columns: Backlog → Todo → In Progress → In Review → Testing → Done.",
+        "",
+        "### Updating task status",
+        "- Move items to **In Progress** when starting work.",
+        "- Move items to **In Review** or **Testing** when work is complete.",
+        "- **Never** move items to **Done** — only the user can mark items as done.",
+        "",
+        "### Creating items",
+        "- New items can only be created in **Backlog** or **Todo** columns.",
+        "- Default priority is MEDIUM if not specified.",
+        "- Use labels to categorize work (e.g. 'ui', 'api', 'search', 'research').",
+        "",
+        "### Review feedback",
+        "- Items in **In Review** may have review history with versioned notes on what needs to change.",
+        "- Use `hasReviewFeedback: true` on kanban_list_items to find items that need revisions.",
+        "- Use `kanban_append_review` to add new review feedback (append-only, versioned).",
+        "- Use `kanban_get_review_history` to read the full review history.",
+        "",
+        "### Work log",
+        "- Use `kanban_append_work_log` to record what was done while working on a task.",
+        "- Use `kanban_get_work_log` to read the full work log history.",
+        "- Work log entries are append-only with automatic versioning.",
+        "",
+        "### Quick reference — commonly confused parameters",
+        "- `kanban_append_work_log(id, content)` — `content` is the log text (not `entry` or `text`).",
+        "- `kanban_append_review(id, content)` — `content` is the review feedback text.",
+        "- `kanban_create_item(title, featureId, ...)` — `title` and `featureId` are required. Use `columnName` (e.g. 'Todo') or `columnId` to place it.",
+        "- `kanban_move_item(id, ...)` — use `columnName` (e.g. 'In Progress') or `columnId` to set destination.",
+      ],
+    }
+  );
+
+  registerFeatureTools(server, projectId);
+  registerItemTools(server, projectId);
+  registerVersionedEntryTools(server, projectId);
+
+  return server;
+}

package/src/apps/kanban/src/routes/attachments.ts

@@ -0,0 +1,161 @@
+import { Router, Request, Response } from "express";
+import { getDb, generateId } from "../db.js";
+import multer from "multer";
+import path from "path";
+import fs from "fs";
+import fsp from "fs/promises";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const uploadsDir = path.join(__dirname, "..", "..", "uploads");
+
+/**
+ * Sanitize a filename to prevent Content-Disposition header injection.
+ * Strips everything except alphanumeric, dots, hyphens, underscores, and spaces.
+ * Falls back to "download" if the result is empty after sanitization.
+ */
+function sanitizeFilename(filename: string): string {
+  // Strip path separators to prevent directory traversal
+  const basename = filename.replace(/^.*[/\\]/, "");
+  // Keep only safe characters: alphanumeric, dot, hyphen, underscore, space
+  const sanitized = basename.replace(/[^a-zA-Z0-9.\-_ ]/g, "");
+  // Prevent empty filenames or dot-only filenames
+  const trimmed = sanitized.replace(/^\.+/, "").trim();
+  return trimmed || "download";
+}
+
+export const attachmentsRouter: Router = Router();
+
+const ALLOWED_MIME_TYPES = [
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "image/svg+xml",
+];
+
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 5 * 1024 * 1024 },
+});
+
+// POST /api/attachments
+attachmentsRouter.post("/", upload.single("file"), async (req: Request, res: Response) => {
+  try {
+    const file = req.file;
+    const issueId = req.body.issueId;
+
+    if (!file) {
+      res.status(400).json({ error: "No file uploaded" });
+      return;
+    }
+
+    if (!issueId) {
+      res.status(400).json({ error: "issueId is required" });
+      return;
+    }
+
+    if (!ALLOWED_MIME_TYPES.includes(file.mimetype)) {
+      res.status(400).json({
+        error: `Invalid file type: ${file.mimetype}. Allowed: ${ALLOWED_MIME_TYPES.join(", ")}`,
+      });
+      return;
+    }
+
+    const db = getDb(req.projectId);
+
+    // Verify issue exists
+    const issue = db.prepare(`SELECT "id" FROM "Issue" WHERE "id" = ?`).get(issueId);
+    if (!issue) {
+      res.status(404).json({ error: "Issue not found" });
+      return;
+    }
+
+    const id = generateId();
+    const safeFilename = sanitizeFilename(file.originalname);
+    const ext = path.extname(safeFilename);
+
+    // Ensure uploads directory exists
+    await fsp.mkdir(uploadsDir, { recursive: true });
+
+    // Save file to disk
+    const filePath = path.join(uploadsDir, `${id}${ext}`);
+    await fsp.writeFile(filePath, file.buffer);
+
+    // Create DB record (store sanitized filename)
+    db.prepare(
+      `INSERT INTO "Attachment" ("id", "filename", "mimeType", "size", "issueId")
+       VALUES (?, ?, ?, ?, ?)`
+    ).run(id, safeFilename, file.mimetype, file.size, issueId);
+
+    const row = db.prepare(`SELECT * FROM "Attachment" WHERE "id" = ?`).get(id);
+    res.status(201).json(row);
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});
+
+// GET /api/attachments/:id
+attachmentsRouter.get("/:id", (req: Request, res: Response) => {
+  try {
+    const { id } = req.params;
+    const db = getDb(req.projectId);
+
+    const row = db.prepare(`SELECT * FROM "Attachment" WHERE "id" = ?`).get(id) as any;
+    if (!row) {
+      res.status(404).json({ error: "Attachment not found" });
+      return;
+    }
+
+    const ext = path.extname(row.filename);
+    const filePath = path.join(uploadsDir, `${id}${ext}`);
+
+    if (!fs.existsSync(filePath)) {
+      res.status(404).json({ error: "Attachment file not found on disk" });
+      return;
+    }
+
+    // Sanitize filename on output as defense-in-depth (guards against
+    // pre-existing records stored before upload-time sanitization was added)
+    const safeDownloadName = sanitizeFilename(row.filename);
+    res.setHeader("Content-Type", row.mimeType);
+    res.setHeader(
+      "Content-Disposition",
+      `inline; filename="${safeDownloadName}"`
+    );
+    res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+    res.sendFile(filePath);
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});
+
+// DELETE /api/attachments/:id
+attachmentsRouter.delete("/:id", (req: Request, res: Response) => {
+  try {
+    const { id } = req.params;
+    const db = getDb(req.projectId);
+
+    const row = db.prepare(`SELECT * FROM "Attachment" WHERE "id" = ?`).get(id) as any;
+    if (!row) {
+      res.status(404).json({ error: "Attachment not found" });
+      return;
+    }
+
+    // Delete file from disk (ignore errors)
+    const ext = path.extname(row.filename);
+    const filePath = path.join(uploadsDir, `${id}${ext}`);
+    try {
+      fs.unlinkSync(filePath);
+    } catch {
+      // Ignore errors — file may already be deleted
+    }
+
+    // Delete DB record
+    db.prepare(`DELETE FROM "Attachment" WHERE "id" = ?`).run(id);
+
+    res.json({ success: true });
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});

package/src/apps/kanban/src/routes/features.ts

@@ -0,0 +1,233 @@
+import { Router, Request, Response } from "express";
+import { getDb, generateId, nowIso } from "../db.js";
+import path from "path";
+import fs from "fs";
+import { fileURLToPath } from "url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const uploadsDir = path.join(__dirname, "..", "..", "uploads");
+
+export const featuresRouter: Router = Router();
+
+const DEFAULT_COLUMNS = [
+  { name: "Backlog", color: "#64748b", order: 0 },
+  { name: "Todo", color: "#3b82f6", order: 1 },
+  { name: "In Progress", color: "#f59e0b", order: 2 },
+  { name: "In Review", color: "#8b5cf6", order: 3 },
+  { name: "Testing", color: "#14b8a6", order: 4 },
+  { name: "Done", color: "#22c55e", order: 5 },
+];
+
+function mapColumn(row: any) {
+  if (!row) return row;
+  const { projectId, ...rest } = row;
+  return { ...rest, featureId: projectId };
+}
+
+function mapIssue(row: any) {
+  if (!row) return row;
+  const { projectId, ...rest } = row;
+  return { ...rest, featureId: projectId };
+}
+
+// GET /api/features
+featuresRouter.get("/", (req: Request, res: Response) => {
+  try {
+    const db = getDb(req.projectId);
+
+    const rows = db
+      .prepare(
+        `SELECT p.*,
+          (SELECT COUNT(*) FROM "Issue" i
+           JOIN "Column" c ON c."id" = i."columnId"
+           WHERE i."projectId" = p."id" AND c."name" != 'Done') AS issueCount
+         FROM "Project" p
+         ORDER BY p."name" COLLATE NOCASE ASC`
+      )
+      .all() as any[];
+
+    const features = rows.map((row) => {
+      const { issueCount, ...rest } = row;
+      return { ...rest, _count: { issues: issueCount } };
+    });
+
+    res.json(features);
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});
+
+// POST /api/features
+featuresRouter.post("/", (req: Request, res: Response) => {
+  try {
+    const { name, description, color } = req.body;
+
+    if (!name || typeof name !== "string" || !name.trim()) {
+      res.status(400).json({ error: "name is required" });
+      return;
+    }
+
+    if (name.length > 500) {
+      res.status(400).json({ error: "name must be at most 500 characters" });
+      return;
+    }
+
+    const db = getDb(req.projectId);
+    const now = nowIso();
+    const featureId = generateId();
+
+    const txn = db.transaction(() => {
+      db.prepare(
+        `INSERT INTO "Project" ("id", "name", "description", "color", "updatedAt")
+         VALUES (?, ?, ?, ?, ?)`
+      ).run(featureId, name, description ?? null, color ?? "#6366f1", now);
+
+      for (const col of DEFAULT_COLUMNS) {
+        const colId = generateId();
+        db.prepare(
+          `INSERT INTO "Column" ("id", "name", "order", "color", "projectId", "updatedAt")
+           VALUES (?, ?, ?, ?, ?, ?)`
+        ).run(colId, col.name, col.order, col.color, featureId, now);
+      }
+    });
+
+    txn();
+
+    const feature = db.prepare(`SELECT * FROM "Project" WHERE "id" = ?`).get(featureId) as Record<string, unknown>;
+    const columns = db
+      .prepare(`SELECT * FROM "Column" WHERE "projectId" = ? ORDER BY "order" ASC`)
+      .all(featureId);
+
+    res.status(201).json({ ...feature, columns: columns.map(mapColumn) });
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});
+
+// GET /api/features/:id
+featuresRouter.get("/:id", (req: Request, res: Response) => {
+  try {
+    const { id } = req.params;
+    const db = getDb(req.projectId);
+
+    const feature = db.prepare(`SELECT * FROM "Project" WHERE "id" = ?`).get(id) as any;
+
+    if (!feature) {
+      res.status(404).json({ error: "Feature not found" });
+      return;
+    }
+
+    const columns = db
+      .prepare(`SELECT * FROM "Column" WHERE "projectId" = ? ORDER BY "order" ASC`)
+      .all(id) as any[];
+
+    const issues = db
+      .prepare(
+        `SELECT i.*,
+                (SELECT COUNT(*) FROM "VersionedEntry" ve WHERE ve."issueId" = i."id" AND ve."type" = 'review') AS reviewCount,
+                (SELECT COUNT(*) FROM "VersionedEntry" ve WHERE ve."issueId" = i."id" AND ve."type" = 'work_log') AS workLogCount
+         FROM "Issue" i WHERE i."projectId" = ? ORDER BY i."order" ASC`
+      )
+      .all(id) as any[];
+
+    // Group issues by columnId
+    const issuesByColumn = new Map<string, any[]>();
+    for (const issue of issues) {
+      const list = issuesByColumn.get(issue.columnId) ?? [];
+      list.push(mapIssue(issue));
+      issuesByColumn.set(issue.columnId, list);
+    }
+
+    const mappedColumns = columns.map((col) => ({
+      ...mapColumn(col),
+      issues: issuesByColumn.get(col.id) ?? [],
+    }));
+
+    res.json({ ...feature, columns: mappedColumns });
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});
+
+// PATCH /api/features/:id
+featuresRouter.patch("/:id", (req: Request, res: Response) => {
+  try {
+    const { id } = req.params;
+    const db = getDb(req.projectId);
+
+    const existing = db.prepare(`SELECT * FROM "Project" WHERE "id" = ?`).get(id);
+    if (!existing) {
+      res.status(404).json({ error: "Feature not found" });
+      return;
+    }
+
+    const allowedFields: Record<string, string> = {
+      name: '"name"',
+      description: '"description"',
+      color: '"color"',
+    };
+
+    const setClauses: string[] = [];
+    const params: any[] = [];
+
+    for (const [key, col] of Object.entries(allowedFields)) {
+      if (req.body[key] !== undefined) {
+        setClauses.push(`${col} = ?`);
+        params.push(req.body[key]);
+      }
+    }
+
+    if (setClauses.length === 0) {
+      res.status(400).json({ error: "No valid fields to update" });
+      return;
+    }
+
+    const now = nowIso();
+    setClauses.push(`"updatedAt" = ?`);
+    params.push(now);
+
+    params.push(id);
+
+    db.prepare(`UPDATE "Project" SET ${setClauses.join(", ")} WHERE "id" = ?`).run(...params);
+
+    const row = db.prepare(`SELECT * FROM "Project" WHERE "id" = ?`).get(id);
+    res.json(row);
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});
+
+// DELETE /api/features/:id
+featuresRouter.delete("/:id", (req: Request, res: Response) => {
+  try {
+    const { id } = req.params;
+    const db = getDb(req.projectId);
+
+    const existing = db.prepare(`SELECT * FROM "Project" WHERE "id" = ?`).get(id);
+    if (!existing) {
+      res.status(404).json({ error: "Feature not found" });
+      return;
+    }
+
+    // Clean up attachment files from disk before deleting
+    const attachments = db
+      .prepare(
+        `SELECT a."id", a."filename" FROM "Attachment" a
+         JOIN "Issue" i ON a."issueId" = i."id"
+         WHERE i."projectId" = ?`
+      )
+      .all(id) as any[];
+
+    for (const att of attachments) {
+      const ext = path.extname(att.filename);
+      const filePath = path.join(uploadsDir, `${att.id}${ext}`);
+      try { fs.unlinkSync(filePath); } catch {}
+    }
+
+    db.prepare(`DELETE FROM "Project" WHERE "id" = ?`).run(id);
+
+    res.json({ success: true });
+  } catch (err: unknown) {
+    res.status(500).json({ error: (err instanceof Error ? err.message : String(err)) });
+  }
+});