Adds a todo for the authenticated user with optional description (max
2000) and optional product scope. Verifies product access if a
product_id is given. Demo accounts get PERMISSION_DENIED.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three write tools that append StoryLog entries:
- log_implementation: type=IMPLEMENTATION_PLAN
- log_test_result: type=TEST_RESULT, status PASSED|FAILED
- log_commit: type=COMMIT with hash and message
All accept optional metadata in input but skip writing it for now —
the StoryLog.metadata JSONB column lands with Scrum4Me PR #2.
After that PR merges, run sync-schema and add `metadata` to each
prisma.create's data field.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- src/access.ts: shared product/story/task access checks via product
ownership or membership
- update_task_status accepts lowercase API values, converts to DB
enum, rejects unknown values
- update_task_plan replaces implementation_plan on a task
- Both call requireWriteAccess() so demo accounts get
PERMISSION_DENIED before any DB write
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- health: pings DB via SELECT 1 and returns status/version/time
- list_products: active products owned or shared with the auth user
- get_claude_context: bundled product + active sprint + next story
(with tasks, status mapped to lowercase) + 50 open todos
prisma.ts switches to a lazy proxy so the server bootstrap doesn't
crash before tools fire when DATABASE_URL is unset.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- src/status.ts: bidirectional Task/Story status mappers — DB stays
UPPER_SNAKE, MCP tools expose lowercase (matches REST API contract)
- src/errors.ts: formatZodError, toolError, toolJson and the
withToolErrors() wrapper so each tool turns thrown exceptions
(PermissionDenied, ZodError, generic) into structured MCP errors
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- src/prisma.ts: PrismaClient via PrismaPg adapter and pg.Pool,
same pattern as Scrum4Me's lib/prisma.ts
- src/auth.ts: getAuth() resolves SCRUM4ME_TOKEN once, caches
{ userId, username, isDemo }. requireWriteAccess() throws
PermissionDeniedError for demo tokens — write tools call this
before any DB mutation
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add vendor/scrum4me as a git submodule (read-only source of truth)
- scripts/sync-schema.sh copies schema.prisma into prisma/, stripping
the upstream prisma-erd-generator block we don't ship
- Track the synced schema in git so a fresh clone works after
'git submodule update --init && npm install'
- postinstall runs 'prisma generate' so @prisma/client is ready
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Initial repo with TypeScript strict, MCP SDK 1.29, Prisma 7,
zod and tsx. Stdio-transport bootstrap in src/index.ts boots
without crashing. Tools and prompts to be added in ST-705..ST-709.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
