popilot 0.5.0 → 0.7.0

package/scaffold/pm-api/src/index.ts

@@ -0,0 +1,114 @@
+import { Hono } from 'hono'
+import { cors } from 'hono/cors'
+import type { AppEnv } from './types.js'
+import { setAdapter } from './db/adapter.js'
+import { TursoAdapter } from './db/turso.js'
+import { authMiddleware } from './auth.js'
+import mcpRoutes from './mcp.js'
+import authRoutes from './routes/auth.js'
+
+import v2NavRoutes from './routes/v2-nav.js'
+import v2PageContentRoutes from './routes/v2-page-content.js'
+import v2ScenariosRoutes from './routes/v2-scenarios.js'
+import v2PmRoutes from './routes/v2-pm.js'
+import v2PolicyRoutes from './routes/v2-policy.js'
+import v2StandupRoutes from './routes/v2-standup.js'
+import v2RetroRoutes from './routes/v2-retro.js'
+import v2NotificationsRoutes from './routes/v2-notifications.js'
+import v2MemosRoutes from './routes/v2-memos.js'
+import v2UserRoutes from './routes/v2-user.js'
+import v2AdminRoutes from './routes/v2-admin.js'
+import v2DashboardRoutes from './routes/v2-dashboard.js'
+import v2KickoffRoutes from './routes/v2-kickoff.js'
+import v2InitiativeRoutes from './routes/v2-initiatives.js'
+import v2DocsRoutes from './routes/v2-docs.js'
+import v2MeetingsRoutes from './routes/v2-meetings.js'
+import v2RewardsRoutes from './routes/v2-rewards.js'
+import v2ActivityRoutes from './routes/v2-activity.js'
+import v2SearchRoutes from './routes/v2-search.js'
+
+const app = new Hono<AppEnv>()
+
+// CORS — origins from env var (comma-separated) or default to localhost
+app.use('*', cors({
+  origin: (origin, c) => {
+    const allowed = c.env.ALLOWED_ORIGINS
+      ? c.env.ALLOWED_ORIGINS.split(',').map(s => s.trim())
+      : ['http://localhost:5173', 'http://localhost:5174']
+    return allowed.includes(origin) ? origin : null
+  },
+  allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+  allowHeaders: ['Content-Type', 'Authorization'],
+}))
+
+// DB error handling
+app.onError((err, c) => {
+  if (err.name === 'DbError') {
+    return c.json({ error: err.message }, 500)
+  }
+  throw err
+})
+
+// Inject DB adapter per request
+app.use('*', async (c, next) => {
+  setAdapter(new TursoAdapter(c.env.TURSO_URL, c.env.TURSO_AUTH_TOKEN))
+  await next()
+})
+
+// Public routes (no auth)
+app.get('/health', (c) => c.json({ ok: true }))
+app.route('/api/auth', authRoutes)
+
+// Auth middleware for /api/* and /mcp
+app.use('/api/*', authMiddleware)
+app.use('/mcp/*', authMiddleware)
+
+// MCP endpoint
+app.route('/mcp', mcpRoutes)
+
+// v2 API routes
+app.route('/api/v2/nav', v2NavRoutes)
+app.route('/api/v2/page-content', v2PageContentRoutes)
+app.route('/api/v2/scenarios', v2ScenariosRoutes)
+app.route('/api/v2/pm', v2PmRoutes)
+app.route('/api/v2/policy', v2PolicyRoutes)
+app.route('/api/v2/standup', v2StandupRoutes)
+app.route('/api/v2/retro', v2RetroRoutes)
+app.route('/api/v2/notifications', v2NotificationsRoutes)
+app.route('/api/v2/memos', v2MemosRoutes)
+app.route('/api/v2/user', v2UserRoutes)
+app.route('/api/v2/admin', v2AdminRoutes)
+app.route('/api/v2/dashboard', v2DashboardRoutes)
+app.route('/api/v2/kickoff', v2KickoffRoutes)
+app.route('/api/v2/initiatives', v2InitiativeRoutes)
+app.route('/api/v2/docs', v2DocsRoutes)
+app.route('/api/v2/meetings', v2MeetingsRoutes)
+app.route('/api/v2/rewards', v2RewardsRoutes)
+app.route('/api/v2/activity', v2ActivityRoutes)
+app.route('/api/v2/search', v2SearchRoutes)
+
+// Proactive Nudge (Cron Trigger)
+import { handleScheduled } from './nudge.js'
+import { isAdmin } from './utils/admin.js'
+
+// Manual nudge trigger — admin only
+app.post('/api/v2/dashboard/nudge-trigger', async (c) => {
+  const userName = c.get('userName')
+  if (!await isAdmin(userName)) {
+    return c.json({ error: 'Admin permission required' }, 403)
+  }
+  const env = {
+    TURSO_URL: c.env.TURSO_URL,
+    TURSO_AUTH_TOKEN: c.env.TURSO_AUTH_TOKEN,
+    NUDGE_WEBHOOK_URL: c.env.NUDGE_WEBHOOK_URL,
+  }
+  await handleScheduled(env)
+  return c.json({ ok: true, message: 'Nudge triggered manually' })
+})
+
+export default {
+  fetch: app.fetch,
+  scheduled: async (event: ScheduledEvent, env: Record<string, string>) => {
+    await handleScheduled(env as unknown as { TURSO_URL: string; TURSO_AUTH_TOKEN: string; NUDGE_WEBHOOK_URL?: string })
+  },
+}

package/scaffold/pm-api/src/mcp-tools/dashboard.ts

@@ -0,0 +1,40 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolDashboard(user: string): Promise<ToolResult> {
+  const sprint = await resolveSprint()
+  if (!sprint) return err('No active sprint found.')
+
+  const [taskResult, memoResult, standupResult, notifResult] = await Promise.all([
+    query<{ status: string; cnt: number }>(
+      `SELECT t.status, COUNT(*) as cnt FROM pm_tasks t JOIN pm_stories s ON t.story_id = s.id WHERE t.assignee = ? AND s.sprint = ? GROUP BY t.status`,
+      [user, sprint],
+    ),
+    query<{ cnt: number }>("SELECT COUNT(*) as cnt FROM memos_v2 WHERE (assigned_to = ? OR assigned_to LIKE ? OR assigned_to LIKE ? OR assigned_to LIKE ?) AND status = 'open'", [user, `${user},%`, `%,${user},%`, `%,${user}`]),
+    query<{ id: number }>('SELECT id FROM pm_standup_entries WHERE user_name = ? AND sprint = ? AND entry_date = ? LIMIT 1', [user, sprint, today()]),
+    query<{ cnt: number }>("SELECT COUNT(*) as cnt FROM notifications WHERE user_name = ? AND is_read = 0", [user]),
+  ])
+
+  const s: Record<string, number> = { todo: 0, 'in-progress': 0, done: 0 }
+  if (!taskResult.error) for (const r of taskResult.rows) s[r.status] = r.cnt
+
+  return text([
+    `📊 ${user}'s Dashboard (${sprint.toUpperCase()})`,
+    '─────────────',
+    `📋 Tasks: todo ${s.todo} | in-progress ${s['in-progress']} | done ${s.done}`,
+    `📩 Unread memos: ${memoResult.rows[0]?.cnt ?? 0}`,
+    `🔔 Unread notifications: ${notifResult.rows[0]?.cnt ?? 0}`,
+    `📝 Today's standup: ${standupResult.rows.length > 0 ? 'submitted' : 'not submitted'}`,
+  ].join('\n'))
+}
+
+export async function toolListTeamMembers(): Promise<ToolResult> {
+  const result = await query<{ id: number; display_name: string; role: string }>('SELECT id, display_name, role FROM members WHERE is_active = 1 ORDER BY display_name')
+  if (result.error) return err(result.error)
+  const lines = ['👥 Team Members', '─────────────']
+  for (const r of result.rows) {
+    const badge = r.role === 'admin' ? ' 👑' : ''
+    lines.push(`  • [M${r.id}] ${r.display_name}${badge}`)
+  }
+  return text(lines.join('\n'))
+}

package/scaffold/pm-api/src/mcp-tools/epic.ts

@@ -0,0 +1,67 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolListEpics(): Promise<ToolResult> {
+  const result = await query<{ id: number; title: string; status: string; owner: string | null; story_count: number }>(
+    `SELECT e.id, e.title, e.status, e.owner, COUNT(s.id) as story_count
+     FROM pm_epics e LEFT JOIN pm_stories s ON s.epic_id = e.id
+     GROUP BY e.id ORDER BY e.title`,
+  )
+  if (result.error) return err(result.error)
+  if (result.rows.length === 0) return text('No epics found.')
+
+  const lines = ['🏷 Epic List', '─────────────']
+  for (const e of result.rows) {
+    const statusIcon: Record<string, string> = { active: '🟢', planned: '📋', completed: '✅', archived: '📦' }
+    lines.push(`${statusIcon[e.status] ?? '⚪'} [E${e.id}] ${e.title} (${e.status}, ${e.story_count} stories${e.owner ? `, owner: ${e.owner}` : ''})`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolAddEpic(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const title = args.title as string
+  const description = (args.description as string) ?? null
+  const owner = (args.owner as string) || user
+  const status = (args.status as string) || 'active'
+
+  const result = await execute(
+    'INSERT INTO pm_epics (title, description, owner, status) VALUES (?, ?, ?, ?)',
+    [title, description, owner, status],
+  )
+  if (result.error) return err(result.error)
+  const idResult = await query<{ id: number }>('SELECT last_insert_rowid() as id')
+  const newId = idResult.rows[0]?.id ?? '?'
+  return text(`✅ Epic created: ${title} (ID: ${newId})`)
+}
+
+export async function toolUpdateEpic(args: Record<string, unknown>): Promise<ToolResult> {
+  const epicId = args.epic_id as number
+  const fieldMap: Record<string, string> = { title: 'title', description: 'description', status: 'status', owner: 'owner' }
+  const sets: string[] = []
+  const sqlArgs: (string | number | null)[] = []
+
+  for (const [key, col] of Object.entries(fieldMap)) {
+    if (args[key] !== undefined) {
+      sets.push(`${col} = ?`)
+      sqlArgs.push(args[key] as string | number | null)
+    }
+  }
+  if (sets.length === 0) return text('No fields to update.')
+
+  sets.push('updated_at = CURRENT_TIMESTAMP')
+  sqlArgs.push(epicId)
+  const result = await execute(`UPDATE pm_epics SET ${sets.join(', ')} WHERE id = ?`, sqlArgs)
+  if (result.error) return err(result.error)
+  if (result.rowsAffected === 0) return err(`Epic #${epicId} not found.`)
+  return text(`✅ Epic #${epicId} updated`)
+}
+
+export async function toolDeleteEpic(args: Record<string, unknown>): Promise<ToolResult> {
+  const epicId = args.epic_id as number
+  const r1 = await execute('UPDATE pm_stories SET epic_id = NULL WHERE epic_id = ?', [epicId])
+  if (r1.error) return err(r1.error)
+  const r2 = await execute('DELETE FROM pm_epics WHERE id = ?', [epicId])
+  if (r2.error) return err(r2.error)
+  if (r2.rowsAffected === 0) return err(`Epic #${epicId} not found.`)
+  return text(`✅ Epic #${epicId} deleted`)
+}

package/scaffold/pm-api/src/mcp-tools/event.ts

@@ -0,0 +1,89 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolEmitEvent(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  if (!checkRateLimit(user)) {
+    return err('Rate limit exceeded: Maximum 10 events per minute.')
+  }
+
+  const eventType = args.event_type as string
+
+  const HOOK_ONLY_TYPES = ['memo_assigned', 'memo_replied', 'memo_resolved']
+  if (HOOK_ONLY_TYPES.includes(eventType)) {
+    return err('Memo-related events are emitted automatically. Cannot emit directly.')
+  }
+  const targetAgent = args.target_agent as string
+  const targetUser = args.target_user as string
+  const payload = args.payload as string
+  const ttlHours = (args.ttl_hours as number) ?? 24
+  const sourceAgent = (args.source_agent as string) ?? user
+
+  // Validate payload is valid JSON
+  try {
+    JSON.parse(payload)
+  } catch {
+    return err('Payload is not valid JSON.')
+  }
+
+  const expiresAt = new Date(Date.now() + ttlHours * 3600_000).toISOString()
+
+  const result = await execute(
+    `INSERT INTO agent_events (event_type, source_agent, target_agent, target_user, payload, expires_at)
+     VALUES (?, ?, ?, ?, ?, ?)`,
+    [eventType, sourceAgent, targetAgent, targetUser, payload, expiresAt],
+  )
+  if (result.error) return err(result.error)
+
+  const idResult = await query<{ id: number }>('SELECT last_insert_rowid() as id')
+  const newId = idResult.rows[0]?.id ?? '?'
+
+  return text(`✅ Event emitted: [${eventType}] → ${targetUser} (ID: ${newId}, TTL: ${ttlHours}h)`)
+}
+
+export async function toolPollEvents(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const eventType = args.event_type as string | undefined
+  const limit = (args.limit as number) ?? 20
+
+  let sql = `SELECT id, event_type, source_agent, target_agent, payload, status, created_at
+             FROM agent_events
+             WHERE target_user = ? AND status = 'pending'
+               AND (expires_at IS NULL OR expires_at > datetime('now'))`
+  const sqlArgs: (string | number)[] = [user]
+
+  if (eventType) {
+    sql += ' AND event_type = ?'
+    sqlArgs.push(eventType)
+  }
+
+  sql += ' ORDER BY created_at DESC LIMIT ?'
+  sqlArgs.push(limit)
+
+  const result = await query<{
+    id: number; event_type: string; source_agent: string; target_agent: string
+    payload: string; status: string; created_at: string
+  }>(sql, sqlArgs)
+
+  if (result.error) return err(result.error)
+  if (result.rows.length === 0) return text('📭 No pending events.')
+
+  const lines = [`📬 Pending events (${result.rows.length})`, '─────────────']
+  for (const e of result.rows) {
+    const payloadPreview = e.payload.length > 60 ? e.payload.slice(0, 60) + '...' : e.payload
+    lines.push(`[E${e.id}] ${e.event_type} from ${e.source_agent} (${e.created_at.slice(5, 16)})`)
+    lines.push(`  payload: ${payloadPreview}`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolAckEvent(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const eventId = args.event_id as number
+
+  const result = await execute(
+    `UPDATE agent_events SET status = 'acked', acked_at = datetime('now')
+     WHERE id = ? AND status IN ('pending', 'delivered') AND target_user = ?`,
+    [eventId, user],
+  )
+  if (result.error) return err(result.error)
+  if (result.rowsAffected === 0) return err(`Event #${eventId} not found or already acknowledged.`)
+  return text(`✅ Event #${eventId} acknowledged`)
+}

package/scaffold/pm-api/src/mcp-tools/index.ts

@@ -0,0 +1,11 @@
+export * from './sprint.js'
+export * from './epic.js'
+export * from './story.js'
+export * from './task.js'
+export * from './memo.js'
+export * from './initiative.js'
+export * from './notification.js'
+export * from './standup.js'
+export * from './retro.js'
+export * from './dashboard.js'
+export * from './event.js'

package/scaffold/pm-api/src/mcp-tools/initiative.ts

@@ -0,0 +1,51 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolCreateInitiative(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const title = args.title as string
+  const content = args.content as string
+  if (!title?.trim() || !content?.trim()) return err('title, content required')
+  const decider = (args.decider as string) ?? null
+  const sourceContext = (args.source_context as string) ?? null
+  const r = await execute(
+    'INSERT INTO initiatives (title, content, author, decider, source_context) VALUES (?, ?, ?, ?, ?)',
+    [title, content, user, decider, sourceContext],
+  )
+  if (r.error) return err(r.error)
+  return text(`✅ Initiative created: "${title}"`)
+}
+
+export async function toolListInitiatives(args: Record<string, unknown>): Promise<ToolResult> {
+  const status = args.status as string | undefined
+  let sql = 'SELECT id, title, author, decider, status, created_at FROM initiatives'
+  const sqlArgs: string[] = []
+  if (status) { sql += ' WHERE status = ?'; sqlArgs.push(status) }
+  sql += ' ORDER BY created_at DESC LIMIT 20'
+  const r = await query<{ id: number; title: string; author: string; decider: string | null; status: string; created_at: string }>(sql, sqlArgs)
+  if (r.error) return err(r.error)
+  if (!r.rows.length) return text('No initiatives found.')
+  const lines = ['📋 Initiative List', '─────────────']
+  for (const i of r.rows) {
+    const dec = i.decider ? ` → ${i.decider}` : ''
+    lines.push(`  [${i.status}] #${i.id}: ${i.title} (${i.author}${dec})`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolUpdateInitiativeStatus(args: Record<string, unknown>): Promise<ToolResult> {
+  const id = args.initiative_id as number
+  const newStatus = args.status as string
+  const note = (args.decision_note as string) ?? null
+  if (!id || !newStatus) return err('initiative_id, status required')
+  const { canTransition } = await import('../utils/initiative.js')
+  const current = await query<{ status: string }>('SELECT status FROM initiatives WHERE id = ?', [id])
+  if (!current.rows.length) return err('Initiative not found.')
+  if (!canTransition(current.rows[0].status as 'pending' | 'approved' | 'rejected' | 'deferred', newStatus as 'pending' | 'approved' | 'rejected' | 'deferred')) {
+    return err(`${current.rows[0].status} → ${newStatus} transition not allowed`)
+  }
+  await execute(
+    `UPDATE initiatives SET status = ?, decision_note = ?, decided_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP WHERE id = ?`,
+    [newStatus, note, id],
+  )
+  return text(`✅ Initiative #${id}: ${current.rows[0].status} → ${newStatus}`)
+}

package/scaffold/pm-api/src/mcp-tools/memo.ts

@@ -0,0 +1,164 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolSendMemo(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const toUserRaw = args.to_user as string
+  const recipients = toUserRaw.split(',').map(s => s.trim()).filter(Boolean)
+  const assignedTo = recipients.join(',')
+  const content = args.content as string
+  const pageId = (args.page_id as string) || 'home'
+  const memoType = (args.memo_type as string) || 'memo'
+  const preview = content.length > 50 ? content.slice(0, 50) + '…' : content
+
+  // Parse [D-XX] tags → related_decisions
+  const decisionMatches = content.match(/\[D-\d+\]/g)
+  const relatedDecisions = decisionMatches ? JSON.stringify([...new Set(decisionMatches.map(m => m.slice(1, -1)))]) : null
+  const reviewRequired = (args.review_required as boolean) ? 1 : 0
+  const title = (args.title as string) ?? null
+  const supersedesId = (args.supersedes_id as number) ?? null
+
+  // Decision type requires title
+  if (memoType === 'decision' && !title) {
+    return err('Decision type memos require a title.')
+  }
+
+  // Supersede: update previous memo status
+  if (supersedesId) {
+    await execute('UPDATE memos_v2 SET status = ? WHERE id = ?', ['superseded', supersedesId])
+  }
+
+  // Resolve member IDs
+  const createdById = await resolveMemberId(user)
+  const assignedToId = recipients.length === 1 ? await resolveMemberId(recipients[0]) : null
+
+  const result = await execute(
+    'INSERT INTO memos_v2 (page_id, content, memo_type, created_by, created_by_id, assigned_to, assigned_to_id, related_decisions, review_required, title, supersedes_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+    [pageId, content, memoType, user, createdById, assignedTo, assignedToId, relatedDecisions, reviewRequired, title, supersedesId],
+  )
+  if (result.error) return err(result.error)
+
+  const idResult = await query<{ id: number }>('SELECT last_insert_rowid() as id')
+  const memoId = idResult.rows[0]?.id ?? 0
+
+  // Notify each recipient
+  for (const r of recipients) {
+    await notify(r, 'memo_received', `New memo: ${user}`, preview, 'memo', memoId, pageId, user)
+  }
+
+  // Auto-emit agent events
+  for (const r of recipients) {
+    await emitAgentEvent('memo_assigned', user, r, r, {
+      memo_id: memoId, from: user, preview, page_id: pageId,
+    })
+  }
+
+  // Agent webhook notification
+  const { notifyByName } = await import('../utils/agent-notify.js')
+  for (const r of recipients) {
+    await notifyByName(r, `📋 New memo: ${user}`, `${preview}\n\nMemo #${memoId} | ${memoType}`)
+  }
+
+  return text(`✅ Memo sent: ${user} → ${assignedTo}`)
+}
+
+export async function toolListMemos(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  let sql = "SELECT * FROM memos_v2 WHERE (assigned_to = ? OR assigned_to LIKE ? OR assigned_to LIKE ? OR assigned_to LIKE ?)"
+  const sqlArgs: (string | number)[] = [user, `${user},%`, `%,${user},%`, `%,${user}`]
+  if (args.unread_only) { sql += " AND status = 'open'" }
+  sql += ' ORDER BY created_at DESC LIMIT 20'
+
+  const result = await query<{ id: number; page_id: string; content: string; memo_type: string; status: string; created_by: string; assigned_to: string | null; created_at: string }>(sql, sqlArgs)
+  if (result.error) return err(result.error)
+  if (result.rows.length === 0) return text('📩 No memos found.')
+
+  const lines = [`📩 ${user}'s Memos`, '─────────────']
+  for (const m of result.rows) {
+    const icon = m.status === 'open' ? '📩' : m.status === 'resolved' ? '✅' : '📖'
+    const preview = m.content.length > 60 ? m.content.slice(0, 60) + '…' : m.content
+    lines.push(`${icon} [M${m.id}] ${m.created_by} (${m.page_id}): ${preview}`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolReadMemo(args: Record<string, unknown>): Promise<ToolResult> {
+  const memoId = args.memo_id as number
+  const result = await query<{ id: number; page_id: string; content: string; memo_type: string; status: string; created_by: string; assigned_to: string | null; resolved_by: string | null; resolved_at: string | null; created_at: string }>('SELECT * FROM memos_v2 WHERE id = ?', [memoId])
+  if (result.error) return err(result.error)
+  if (result.rows.length === 0) return err(`Memo #${memoId} not found.`)
+
+  const m = result.rows[0]
+
+  const repliesResult = await query<{ id: number; content: string; created_by: string; created_at: string }>('SELECT * FROM memo_replies WHERE memo_id = ? ORDER BY created_at ASC', [memoId])
+
+  const lines = [`📩 Memo #${m.id}`, '─────────────', `From: ${m.created_by} → ${m.assigned_to ?? 'all'}`, `Page: ${m.page_id}`, `Status: ${m.status}`, `Date: ${m.created_at}`, '', m.content]
+  if (m.resolved_by) lines.push('', `✅ Resolved: ${m.resolved_by} (${m.resolved_at})`)
+  if (!repliesResult.error && repliesResult.rows.length > 0) {
+    lines.push('', '💬 Replies:')
+    for (const r of repliesResult.rows) lines.push(`  ${r.created_by} (${r.created_at}): ${r.content}`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolReplyMemo(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const memoId = args.memo_id as number
+  const content = args.content as string
+  const reviewType = (args.review_type as string) || 'comment'
+  const result = await execute(
+    'INSERT INTO memo_replies (memo_id, content, created_by, review_type) VALUES (?, ?, ?, ?)',
+    [memoId, content, user, reviewType],
+  )
+  if (result.error) return err(result.error)
+
+  // Notify memo author
+  const memoResult = await query<{ created_by: string; assigned_to: string | null }>(
+    'SELECT created_by, assigned_to FROM memos_v2 WHERE id = ?', [memoId],
+  )
+  if (!memoResult.error && memoResult.rows.length > 0) {
+    const memo = memoResult.rows[0]
+    const preview = content.length > 50 ? content.slice(0, 50) + '…' : content
+    // Notify author
+    await notify(memo.created_by, 'memo_reply', `Memo reply: ${user}`, preview, 'memo', memoId, 'home', user)
+    // If assigned_to is different from author and from replier, notify them too
+    if (memo.assigned_to && memo.assigned_to !== memo.created_by && memo.assigned_to !== user) {
+      await notify(memo.assigned_to, 'memo_reply', `Memo reply: ${user}`, preview, 'memo', memoId, 'home', user)
+    }
+    // Auto-emit agent event
+    await emitAgentEvent('memo_replied', user, memo.created_by, memo.created_by, {
+      memo_id: memoId, reply_by: user, preview,
+    })
+  }
+
+  return text(`✅ Reply sent to Memo #${memoId}`)
+}
+
+export async function toolResolveMemo(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const memoId = args.memo_id as number
+  const result = await execute(
+    `UPDATE memos_v2 SET status = 'resolved', resolved_by = ?, resolved_at = CURRENT_TIMESTAMP, updated_at = CURRENT_TIMESTAMP WHERE id = ?`,
+    [user, memoId],
+  )
+  if (result.error) return err(result.error)
+  if (result.rowsAffected === 0) return err(`Memo #${memoId} not found.`)
+
+  // Notify memo author
+  const memoResult = await query<{ created_by: string }>(
+    'SELECT created_by FROM memos_v2 WHERE id = ?', [memoId],
+  )
+  if (!memoResult.error && memoResult.rows.length > 0) {
+    await notify(memoResult.rows[0].created_by, 'memo_resolved', `Memo resolved: ${user}`, `${user} resolved Memo #${memoId}.`, 'memo', memoId, 'home', user)
+    // Auto-emit agent event
+    await emitAgentEvent('memo_resolved', user, memoResult.rows[0].created_by, memoResult.rows[0].created_by, {
+      memo_id: memoId, resolved_by: user,
+    })
+  }
+
+  return text(`✅ Memo #${memoId} resolved`)
+}
+
+export async function toolRejectMemo(args: Record<string, unknown>): Promise<ToolResult> {
+  const memoId = args.memo_id as number
+  if (!memoId) return err('memo_id required')
+  const r = await execute("UPDATE memos_v2 SET status = 'open', resolved_by = NULL, resolved_at = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?", [memoId])
+  if (r.error) return err(r.error)
+  return text(`✅ Memo #${memoId} rejected (reopened)`)
+}

package/scaffold/pm-api/src/mcp-tools/notification.ts

@@ -0,0 +1,37 @@
+import { query, execute } from '../db/adapter.js'
+import { text, err, today, resolveSprint, notify, checkRateLimit, emitAgentEvent, validateAssignee, resolveMemberId, type ToolResult } from './utils.js'
+
+export async function toolCheckNotifications(user: string, args: Record<string, unknown>): Promise<ToolResult> {
+  const unreadOnly = args.unread_only as boolean | undefined
+  let sql = 'SELECT * FROM notifications WHERE user_name = ?'
+  const sqlArgs: (string | number)[] = [user]
+  if (unreadOnly) { sql += ' AND is_read = 0' }
+  sql += ' ORDER BY created_at DESC LIMIT 30'
+
+  const result = await query<{ id: number; type: string; title: string; body: string | null; source_type: string; source_id: string; actor: string; is_read: number; created_at: string }>(sql, sqlArgs)
+  if (result.error) return err(result.error)
+  if (result.rows.length === 0) return text(unreadOnly ? '🔔 No unread notifications.' : '🔔 No notifications.')
+
+  const unread = result.rows.filter(n => !n.is_read).length
+  const lines = [`🔔 Notifications (${unread} unread)`, '─────────────']
+  for (const n of result.rows) {
+    const icon = n.is_read ? '  ' : '🔴'
+    const body = n.body ? ` — ${n.body.length > 40 ? n.body.slice(0, 40) + '…' : n.body}` : ''
+    lines.push(`${icon} [N${n.id}] ${n.title}${body} (${n.actor}, ${n.created_at.slice(5, 16)})`)
+  }
+  return text(lines.join('\n'))
+}
+
+export async function toolMarkNotificationRead(args: Record<string, unknown>): Promise<ToolResult> {
+  const notifId = args.notification_id as number
+  const result = await execute('UPDATE notifications SET is_read = 1 WHERE id = ?', [notifId])
+  if (result.error) return err(result.error)
+  if (result.rowsAffected === 0) return err(`Notification #${notifId} not found.`)
+  return text(`✅ Notification #${notifId} marked as read`)
+}
+
+export async function toolMarkAllNotificationsRead(user: string): Promise<ToolResult> {
+  const result = await execute('UPDATE notifications SET is_read = 1 WHERE user_name = ? AND is_read = 0', [user])
+  if (result.error) return err(result.error)
+  return text(`✅ ${result.rowsAffected} notifications marked as read.`)
+}