tix-tracker 0.12.0

#[allow(clippy::wildcard_imports)]
use super::*;

pub(super) fn board_status(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let filter = opt_string(args, "filter")?;
    let health = opt_bool(args, "health")?.unwrap_or(false);
    let sort = opt_string(args, "sort")?;
    let group = opt_string(args, "group")?;
    // One evaluation for both surfaces: this tool does no listing, filtering,
    // sorting, counting or health construction of its own, so its
    // `structuredContent` **is** the document `tix status --json` prints. A
    // rejected filter (or an unavailable health document) is a tool error result,
    // not a JSON-RPC failure: it is a refusal the client asked for, and it carries
    // no `structuredContent` so a client cannot mistake it for a board with zeros.
    match status::evaluate(
        config,
        store,
        filter.as_deref(),
        sort.as_deref(),
        group.as_deref(),
        health,
    ) {
        Ok(outcome) => {
            let structured = serde_json::to_value(&outcome.document)
                .expect("board document serialization is infallible");
            Ok(success_result(outcome.text, structured))
        }
        Err(error) => Ok(error_result(crate::error::render_error(&error))),
    }
}

pub(super) fn comment_on_issue(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let (_, resolution) = crate::workflow::active_resolution(config);
    let raw = selector(args, "issue")?;
    let author = req_string(args, "author")?;
    let text = req_string(args, "text")?;
    let outcome = (|| -> TixResult<Issue> {
        let selector = parse_selector(store, &raw)?;
        let mut issue = store.get(selector)?;
        issue.add_comment(&author, &text);
        store.update(&issue.filename, &issue)?;
        Ok(issue)
    })();
    match outcome {
        Ok(issue) => Ok(success_result(
            format!("Commented on {}", issue.filename),
            issue_value(&issue, &resolution),
        )),
        Err(e) => Ok(error_result(crate::error::render_error(&e))),
    }
}

#[allow(clippy::too_many_lines)]
pub(super) fn create_issue(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let (_, resolution) = crate::workflow::active_resolution(config);
    if let Some(value) = reject_retired_links(args) {
        return Ok(value);
    }
    // T030. Every create value is read **raw** first, because the template path
    // hands the strings to the shared resolver exactly as the CLI does — an
    // explicit `""` is an override there, not the MCP-only "must not be empty"
    // refusal the no-template path keeps below.
    let template = opt_string(args, "template")?;
    let template_scope = opt_string(args, "scope")?;
    let title = opt_string(args, "title")?;
    let body = opt_string(args, "body")?;
    let status_raw = opt_string(args, "status")?;
    let priority_raw = opt_string(args, "priority")?;
    let assignee = opt_string(args, "assignee")?;
    let labels = opt_string(args, "labels")?;
    let files = opt_string(args, "files")?;
    let related_issues = opt_string(args, "related_issues")?;
    let type_ = opt_string(args, "type")?;
    let estimate = opt_string(args, "estimate")?;
    let cycles = opt_string(args, "cycles")?;
    let milestones = opt_string(args, "milestones")?;
    let reviewer = opt_string(args, "reviewer")?;
    let start_date = opt_string(args, "start_date")?;
    let due_date = opt_string(args, "due_date")?;
    // T028. `""` clears, exactly as `--parent ""` does on the CLI, because both go
    // through `commands::create`/`edit::apply` and those own the semantics. Omitted
    // is `None`, which is a different thing: "leave it alone", not "set none".
    let parent = opt_string(args, "parent")?;
    // T031. The project association list, raw: it is resolved through the project
    // service *after* the field validation below and *before* the issue exists, so
    // an unknown reference refuses the whole create (mirroring `create::run`).
    let projects = opt_string(args, "projects")?;
    // T033. The epic reference list, raw, exactly as `projects`: resolved through
    // the epic service *before* the issue exists, so an unknown reference refuses
    // the whole create.
    let epics = opt_string(args, "epics")?;

    // A call with neither a title nor a template is the same `-32602` it has
    // always been. The schema states title-or-template with `anyOf`, but the
    // schema is documentation a client may ignore, so the handler holds the line.
    if title.is_none() && template.is_none() {
        return Err(());
    }
    // `scope` selects which template to resolve; without one there is nothing to
    // scope, exactly as clap's `requires = "template"` refuses `--scope` alone.
    if template.is_none() && template_scope.is_some() {
        return Ok(template_error_result(
            "invalid input: `scope` requires `template` — a scope selects which \
             template to resolve and is meaningless without one"
                .to_string(),
            template_outcome_value(
                "create",
                "rejected",
                None,
                vec![json!({
                    "kind": "invalid-scope",
                    "field": "scope",
                    "message": "`scope` requires `template`",
                })],
            ),
        ));
    }

    if let Some(template_id) = template {
        // T031. `--projects` beside `--template` is refused rather than dropped,
        // with the CLI's own words: silently ignoring it would create an issue the
        // caller believes is associated (see `commands::dispatch`'s `Create` arm,
        // which draws the same line for `tix create`). The predicate and wording
        // come from the one shared helper so the two surfaces cannot diverge.
        if let Some(error) = crate::commands::projects_beside_template_refused(projects.as_deref())
        {
            return Ok(error_result(crate::error::render_error(&error)));
        }
        // T033. `--epics` beside `--template` is refused the same way, with the
        // CLI's own words from the one shared helper.
        if let Some(error) = crate::commands::epics_beside_template_refused(epics.as_deref()) {
            return Ok(error_result(crate::error::render_error(&error)));
        }
        return create_issue_from_template(
            config,
            store,
            &template_id,
            template_scope.as_deref(),
            &cmd_templates::CreateFields {
                title: title.as_deref(),
                body: body.as_deref(),
                status: status_raw.as_deref(),
                priority: priority_raw.as_deref(),
                assignee: assignee.as_deref(),
                labels: labels.as_deref(),
                files: files.as_deref(),
                estimate: estimate.as_deref(),
                cycles: cycles.as_deref(),
                milestones: milestones.as_deref(),
                reviewer: reviewer.as_deref(),
                start_date: start_date.as_deref(),
                due_date: due_date.as_deref(),
                parent: parent.as_deref(),
                related_issues: related_issues.as_deref(),
                type_: type_.as_deref(),
            },
            &resolution,
        );
    }

    let status = match status_raw {
        None => None,
        Some(s) if s.trim().is_empty() => {
            return Ok(error_result(
                "invalid input: --status must not be empty".into(),
            ));
        }
        Some(s) => Some(Status::new(s)),
    };
    let priority = match priority_raw {
        None => None,
        Some(p) => match parse_priority(&p) {
            Ok(priority) => Some(priority),
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        },
    };
    // T031. Resolved through the project service **before** the issue is written,
    // exactly as `create::run` does, so an unknown reference refuses the whole
    // create rather than leaving a half-associated issue. The registry is re-read
    // from disk, because a project this session created must be resolvable here.
    let project_registry = match projects.as_deref() {
        None => None,
        Some(raw) => {
            let (registry, _path) = match registry_config(store) {
                Ok(loaded) => loaded,
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            };
            match crate::commands::project::resolve_projects(&registry, raw) {
                Ok(ids) => Some((registry, ids)),
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            }
        }
    };
    // T033. The same shape for epics: resolved through the epic service **before**
    // the issue is written, against a freshly loaded registry (a name resolves to
    // the same epic; duplicates collapse to one reference).
    let epic_registry = match epics.as_deref() {
        None => None,
        Some(raw) => {
            let (registry, _path) = match registry_config(store) {
                Ok(loaded) => loaded,
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            };
            match cmd_epic::resolve_epics(&registry, raw) {
                Ok(ids) => Some((registry, ids)),
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            }
        }
    };
    match create::create(
        config,
        store,
        // Guaranteed: the guard above refuses the only path that could arrive
        // here without a title.
        title.as_deref().expect("a title or a template is required"),
        body.as_deref(),
        status,
        priority,
        assignee.as_deref(),
        labels.as_deref(),
        files.as_deref(),
        estimate.as_deref(),
        cycles.as_deref(),
        milestones.as_deref(),
        reviewer.as_deref(),
        start_date.as_deref(),
        due_date.as_deref(),
        parent.as_deref(),
        related_issues.as_deref(),
        type_.as_deref(),
    ) {
        Ok(issue) => {
            let mut issue = issue;
            if let Some((registry, ids)) = &project_registry {
                if !ids.is_empty() {
                    // Each accepted association appends exactly one `## History`
                    // entry through the store's service-backed write; the create
                    // core stays free of project rules (T022 step 4).
                    let association = store_with_config(store, registry.clone());
                    if let Err(e) =
                        crate::commands::project::associate_created(&association, &issue, ids)
                    {
                        return Ok(error_result(crate::error::render_error(&e)));
                    }
                    // Re-read so the response carries the associations just written.
                    issue = match association.resolve_issue(&issue.number.to_string()) {
                        Ok(issue) => issue,
                        Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                    };
                }
            }
            // T033. Each accepted reference appends exactly one `## History` entry
            // through the store's service-backed `reference_epic`; the create core
            // stays free of epic rules (T033 step 3).
            if let Some((registry, ids)) = &epic_registry {
                if !ids.is_empty() {
                    let association = store_with_config(store, registry.clone());
                    if let Err(e) = cmd_epic::reference_created(&association, &issue, ids) {
                        return Ok(error_result(crate::error::render_error(&e)));
                    }
                    issue = match association.resolve_issue(&issue.number.to_string()) {
                        Ok(issue) => issue,
                        Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                    };
                }
            }
            Ok(success_result(
                format!("Created {}", issue.filename),
                issue_value(&issue, &resolution),
            ))
        }
        Err(e) => Ok(error_result(crate::error::render_error(&e))),
    }
}

pub(super) fn delete_issue(store: &Store, args: &Value) -> ToolOutcome {
    let raw = selector(args, "issue")?;
    if args.get("confirm").and_then(Value::as_bool) != Some(true) {
        return Ok(error_result(
            "delete requires confirm=true — the issue file is untouched".into(),
        ));
    }
    let filename = match resolve_filename(store, &raw) {
        Ok(f) => f,
        Err(e) => return Ok(error_result(crate::error::render_error(&e))),
    };
    match delete::remove(store, &raw, true) {
        Ok(()) => Ok(success_result(
            format!("Deleted {filename}"),
            json!({ "deleted": filename }),
        )),
        Err(e) => Ok(error_result(crate::error::render_error(&e))),
    }
}

// WP07: takes a `Config` for the category resolution. It had none, because until
// now it returned only frontmatter — which is a reason the category belongs on the
// *issue object* rather than bolted onto one handler, so that `list_issues`,
// `search_issues` and every write result carry it too.
pub(super) fn get_issue(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let (_, resolution) = crate::workflow::active_resolution(config);
    let raw = selector(args, "issue")?;
    match view::get(store, &raw) {
        Ok(issue) => {
            // The **same** hierarchy block `tix view` appends, from the same
            // `HierarchyFacts`. WP04 made `tix show` carry the block
            // (`contracts/cli-surface.md` §2), and the parity test
            // `parity_get_matches_cli_view` immediately reported the two surfaces
            // disagreeing — which is what it exists for.
            //
            // WP07 owns the rest of the hierarchy read tools (`parent show`,
            // `children`, `list`) and the `parent` field on `update_issue`. Appending
            // the block here is not that work: it is the smallest change that keeps
            // an existing parity guarantee true after a documented CLI change, and
            // it reuses the one renderer so the two cannot drift again.
            let mut contents = issue.to_file_contents();
            match crate::commands::parent::source(store) {
                Ok((index, issues, done_column)) => {
                    let facts = crate::commands::parent::facts_for(
                        &index,
                        &issues,
                        issue.number,
                        &done_column,
                    );
                    contents.push_str(&crate::commands::parent::detail_block(&facts));
                }
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            }
            // The `## Workflow` block, for the same reason and by the same
            // mechanism as the hierarchy block above: `tix view` appends it
            // unconditionally (WP08 T036), so a client reading this text would
            // otherwise see a *shorter* document than the CLI prints. The parity
            // test `parity_get_matches_cli_view` reported the divergence the moment
            // the block was added on the CLI side — which is what it is for.
            //
            // The category is *also* on the structured object (`issue_value`, WP07),
            // but that is a different channel: the contract requires the text to
            // mirror the CLI's stdout, and a field that only one surface carries is
            // exactly the drift this keeps closing.
            contents.push_str(&crate::commands::view::category_block(&issue, &resolution));
            // The `## Projects` block, for the same reason and by the same
            // mechanism as the two above: `tix view` appends it **unconditionally**
            // (`contracts/cli-surface.md` §4, `src/commands/view.rs`), so without it
            // an associated issue's document would be *shorter* than the CLI's and
            // `parity_get_matches_cli_view` would be asserting a difference. The
            // renderer is the CLI's own `projects_block`, and the registry is
            // re-read per call so a project this session created renders its health
            // line rather than `(missing reference)`.
            {
                let registry = match registry_config(store) {
                    Ok((registry, _path)) => registry,
                    Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                };
                match crate::commands::view::projects_block(
                    &store_with_config(store, registry),
                    &issue,
                ) {
                    Ok(block) => contents.push_str(&block),
                    Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                }
            }
            // The `## Epics` block, for the same reason and by the same mechanism as
            // the three above: `tix view` appends it **unconditionally**
            // (`contracts/cli-surface.md` §3, `src/commands/view.rs`), so without it
            // an issue that references an epic would render a *shorter* document
            // than the CLI's and `parity_get_matches_cli_view` would be asserting a
            // difference. The renderer is the CLI's own `epics_block`, and the
            // registry is re-read per call so an epic this session created renders
            // its figures rather than `(missing reference)`.
            {
                let registry = match registry_config(store) {
                    Ok((registry, _path)) => registry,
                    Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                };
                match crate::commands::view::epics_block(
                    &store_with_config(store, registry),
                    &issue,
                ) {
                    Ok(block) => contents.push_str(&block),
                    Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                }
            }
            // #1301 (F9): expose the relationships through the **service**, not the
            // issue's own stored `relationships` field. A typed edge is stored once,
            // in its canonical source, so the other endpoint's own field is empty and
            // a client reading it would see no relationship at all. The derived set is
            // a superset of the stored one (it includes this file's own edges), so
            // nothing is hidden by replacing the key — and it is what
            // `tix view --show relationships` and `list_relationships` already report.
            let mut value = issue_value(&issue, &resolution);
            match with_graph(store, |graph| {
                Ok(graph
                    .relationships_for(issue.number)
                    .into_iter()
                    .map(relationship_value)
                    .collect::<Vec<Value>>())
            }) {
                Ok(relationships) => value["relationships"] = json!(relationships),
                Err(result) => return Ok(result),
            }
            Ok(success_result(contents, value))
        }
        Err(e) => Ok(error_result(crate::error::render_error(&e))),
    }
}

pub(super) fn get_rollup(store: &Store, args: &Value) -> ToolOutcome {
    let number = match required_number(store, args) {
        Ok(number) => number,
        Err(()) => {
            return Ok(error_result(
                "invalid input: an `issue` selector is required".into(),
            ));
        }
    };
    let snapshot = match hierarchy_snapshot(store) {
        Ok(snapshot) => snapshot,
        Err(()) => return Ok(error_result("could not read the issue set".into())),
    };
    if !snapshot.index.contains(number) {
        return Ok(missing_issue(number));
    }
    let facts = crate::commands::parent::facts_for(
        &snapshot.index,
        &snapshot.issues,
        number,
        &snapshot.done_column,
    );
    // The rendered lines are read before `rollup` is moved out of `facts`.
    let text = format!("{} | {}", facts.child_count_line(), facts.completion_line());
    let rollup = facts.rollup;
    // The numbers, as numbers. `completion_basis` is carried as its own field
    // because the figures mean something only alongside the population they
    // describe — "3/5" over direct children and over the subtree are different
    // numbers wearing the same clothes.
    let value = json!({
        "issue": number,
        "parent": rollup.parent,
        "direct_children": rollup.direct_children,
        "completed_children": rollup.completed_children,
        "progress": { "done": rollup.progress.done, "total": rollup.progress.total },
        "completion_basis": rollup.completion_basis.as_str(),
        "text": text,
    });
    Ok(success_result(text, value))
}

pub(super) fn lint_issues(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let foreign = args.get("foreign").and_then(Value::as_bool).unwrap_or(true);
    let findings = match lint::collect_with(config, store, foreign) {
        Ok(f) => f,
        Err(e) => return Ok(error_result(crate::error::render_error(&e))),
    };
    let count = match store.list() {
        Ok(issues) => issues.len(),
        Err(e) => return Ok(error_result(crate::error::render_error(&e))),
    };
    let values: Vec<Value> = findings
        .iter()
        .map(|f| {
            json!({
                "file": f.file,
                "line": f.line,
                "column": f.column,
                "kind": f.kind,
                "value": f.value,
                "message": f.message,
            })
        })
        .collect();
    Ok(success_result(
        lint_text(count, &findings),
        json!({ "findings": values }),
    ))
}

pub(super) fn list_issues(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let (_, resolution) = crate::workflow::active_resolution(config);
    let status = opt_string(args, "status")?;
    let project = opt_string(args, "project")?;
    let epic = opt_string(args, "epic")?;
    let filter = opt_string(args, "filter")?;
    let sort = opt_string(args, "sort")?;
    let group = opt_string(args, "group")?;
    let all = opt_bool(args, "all")?.unwrap_or(false);
    // MCP carries no archive flag (out of scope for issue #1492), so it lists the
    // active set: archived issues are skipped without being read.
    //
    // The default scope comes from the one seam the CLI reads (#1711), so
    // `list_issues {}` and `tix list` are the same listing — scoped to your issues
    // in the board's entry column — and `all` is the escape hatch on both. A
    // `status`/`filter`/`project`/`epic` argument names a selection of its own and
    // replaces the scope rather than composing with it (#1711).
    match list::scoped_query(
        store,
        &list::ListSelection {
            status: status.as_deref(),
            filter: filter.as_deref(),
            project: project.as_deref(),
            epic: epic.as_deref(),
            all,
        },
        false,
    ) {
        Ok(issues) => {
            let mut issues = issues;
            // WP07 / T034: the project filter is a **bucket lookup** on the
            // service's derived membership index, not a second membership rule
            // (NFR-001, C-006). `tix list --project` reaches the same set once the
            // list surface grows the flag; until then this is the MCP spelling of
            // contract `project-service.md` §5's "filter by project" row, and
            // `project_membership` returns the identical set — both read the
            // **active** set and both resolve against the registry on disk.
            //
            // Resolved against a freshly loaded registry, not `store.config`: the
            // server's snapshot was taken when `mcp::serve` bootstrapped, so a
            // project this session created would read as `unknown_project` (and one
            // it deleted would still resolve) while every other project handler
            // re-read the file. Two snapshots for one registry is exactly the
            // disagreement this filter is documented not to have.
            if let Some(reference) = project.as_deref() {
                let registry = match registry_config(store) {
                    Ok((registry, _path)) => registry,
                    Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                };
                match crate::projects::membership(&registry, &issues, reference) {
                    Ok(membership) => {
                        let members: BTreeSet<u32> = membership
                            .members
                            .iter()
                            .map(|m| m.issue.number())
                            .collect();
                        issues.retain(|issue| members.contains(&issue.number));
                    }
                    Err(error) => {
                        return Ok(error_result(crate::error::render_error(
                            &crate::error::TixError::from(error),
                        )));
                    }
                }
            }
            // T033/T036: the epic filter is the same shape over the epic service's
            // derived membership — a bucket lookup, not a second rule — resolved
            // against a freshly loaded registry for the same reason the project
            // filter is, and returning the identical set `epic_membership` reads.
            if let Some(reference) = epic.as_deref() {
                let registry = match registry_config(store) {
                    Ok((registry, _path)) => registry,
                    Err(e) => return Ok(error_result(crate::error::render_error(&e))),
                };
                match crate::epics::membership(&registry, &issues, reference) {
                    Ok(membership) => {
                        let members: BTreeSet<u32> = membership
                            .members
                            .iter()
                            .map(|m| m.issue.number())
                            .collect();
                        issues.retain(|issue| members.contains(&issue.number));
                    }
                    Err(error) => {
                        return Ok(error_result(crate::error::render_error(
                            &crate::error::TixError::from(error),
                        )));
                    }
                }
            }
            let sort_key = sort.clone().or_else(|| {
                filter
                    .as_deref()
                    .and_then(|q| crate::search::control_token(q, "sort"))
            });
            let group_key = group.clone().or_else(|| {
                filter
                    .as_deref()
                    .and_then(|q| crate::search::control_token(q, "group"))
            });
            sort_issues(&mut issues, sort_key.as_deref());
            let values: Vec<Value> = issues.iter().map(|i| issue_value(i, &resolution)).collect();
            // WP04 T019: the service's resolution, so MCP's text mirror renders
            // `Overdue` and the group rollup through the same categories the CLI
            // does. This call passed a completion column *name* while the CLI
            // passed categories — the surfaces agreed only because both happened
            // to resolve the same board, which is a coincidence, not a contract.
            let (_, resolution) = crate::workflow::active_resolution(&store.config);
            Ok(success_result(
                list_text(&issues, group_key.as_deref(), &resolution),
                json!({ "issues": values }),
            ))
        }
        Err(e) => Ok(error_result(crate::error::render_error(&e))),
    }
}

pub(super) fn move_issue(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let (_, resolution) = crate::workflow::active_resolution(config);
    let raw = selector(args, "issue")?;
    let column = req_string(args, "column")?;
    let commit = opt_string(args, "commit")?;
    let yes = args.get("yes").and_then(Value::as_bool).unwrap_or(false);
    // Through the shared guard, not `mv::apply`. Calling the bare core here was a
    // parity defect: MCP could move blocked work to done with no warning, no
    // confirmation, and no History entry, while the CLI refused it. Same accept /
    // reject decision on every surface is the whole of `surface-parity.md` §2,
    // and this tool is a "bulk or import path" in the sense T016 step 6 names.
    // WP07: the `reason` argument, closing the gap WP03 recorded and WP04 could
    // not close. The seam already took an override reason; the CLI got the flag in
    // WP04; this is the MCP spelling of the same thing, so a client is no longer
    // refused by a rule it has no way to satisfy.
    //
    // Passed straight through — no MCP-side validation, no trimming, no default. The
    // service trims a blank reason and refuses the move, so a client that sends
    // `""` gets the same refusal the CLI gives, with the same message.
    let reason = opt_string(args, "reason")?;
    let override_wip = args
        .get("override")
        .and_then(Value::as_bool)
        .unwrap_or(false);

    // WP06 T028/T029 (mission `configurable-wip-limits-01M3C6WX`): the shared WIP
    // policy, exactly as the CLI's `wip_gate` asks it. MCP owns no evaluator and
    // compares no status strings: the decision, its diagnostics and the override's
    // History entry all come from the one service (C-006).
    let issues = match store.list() {
        Ok(issues) => issues,
        Err(error) => return Ok(error_result(crate::error::render_error(&error))),
    };
    let selector = match crate::commands::parse_selector(store, &raw) {
        Ok(selector) => selector,
        Err(error) => return Ok(error_result(crate::error::render_error(&error))),
    };
    let moved_issue = match store.get(selector) {
        Ok(issue) => issue,
        Err(error) => return Ok(error_result(crate::error::render_error(&error))),
    };
    let context = crate::wip::MoveContext::new(config, &issues);
    let mut request = crate::wip::MoveRequest::new(&moved_issue, &column);
    if let Some(reason) = reason.as_deref() {
        request = request.because(reason);
    }
    // The bound limit is the one in force now — the same request the CLI makes, and
    // the same staleness rule: a limit that changed makes the override stale rather
    // than silently authoritative.
    let decision = match config
        .default_config()
        .wip
        .effective_limit(&column)
        .cloned()
        .filter(|_| override_wip)
    {
        Some(limit) => {
            let over = crate::wip::OverrideRequest {
                // `yes` is the confirmation, and `override` alone is not: a flag
                // that authorizes is not a flag that confirms the authorization
                // (T029's "explicit actor/reason/confirmation").
                confirmed: yes,
                ..crate::wip::OverrideRequest::new(
                    crate::storage::actor_identity(),
                    crate::model::utc_now_rfc3339(),
                    reason.clone().unwrap_or_default(),
                    crate::wip::BoundLimit::of(&column, &limit),
                )
            };
            crate::wip::evaluate(&context, &request.overriding(&over))
        }
        None => crate::wip::evaluate(&context, &request),
    };

    // A refused *transition* is left to the seam, which makes the same call with the
    // wording and diagnostic kind this tool has always returned (`unknown_column`,
    // `invalid_transition`): one refusal, one wording (the CLI's rule).
    let transition_refusal = decision.diagnostics.first().is_some_and(|diagnostic| {
        diagnostic.kind == crate::wip::WipDiagnosticKind::RejectedTransition
    });
    if !transition_refusal && !decision.is_committable() {
        // A policy refusal: nothing was written, and the client gets the decision's
        // structure rather than only a sentence (T029).
        return Ok(wip_result(
            crate::wip::render_decision(&decision),
            &decision,
            true,
        ));
    }
    let wip_event = decision.history.clone();
    let wip_structured = wip_value(&decision);

    match mv::apply_guarded(
        config,
        store,
        &raw,
        &column,
        commit.as_deref(),
        reason.as_deref(),
        yes,
        wip_event.as_ref(),
    ) {
        Ok(moved) => {
            let mut text = format!("Moved {} to {column}", moved.issue.filename);
            if moved.acknowledged {
                text.push_str(" (blocked move acknowledged)");
            }
            if decision.outcome == crate::wip::WipOutcome::Warn {
                text.push('\n');
                text.push_str(&crate::wip::render_decision(&decision));
            }
            let mut structured = issue_value(&moved.issue, &resolution);
            structured["wip"] = wip_structured;
            Ok(success_result(text, structured))
        }
        Err(e) => Ok(error_result(crate::error::render_error(&e))),
    }
}

pub(super) fn search_issues(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let (_, resolution) = crate::workflow::active_resolution(config);
    let query = req_string(args, "query")?;
    match search::find(store, &query) {
        Ok(hits) => {
            let values: Vec<Value> = hits
                .iter()
                .map(|hit| json!({ "issue": issue_value(&hit.issue, &resolution), "matched_lines": hit.matched_lines }))
                .collect();
            Ok(success_result(
                search_text(&hits),
                json!({ "hits": values }),
            ))
        }
        Err(e) => Ok(error_result(crate::error::render_error(&e))),
    }
}

#[allow(clippy::too_many_lines)]
pub(super) fn update_issue(config: &Config, store: &Store, args: &Value) -> ToolOutcome {
    let (_, resolution) = crate::workflow::active_resolution(config);
    if let Some(value) = reject_retired_links(args) {
        return Ok(value);
    }
    let raw = selector(args, "issue")?;
    let title = opt_string(args, "title")?;
    let body = opt_string(args, "body")?;
    let status = opt_string(args, "status")?;
    // WP07: read here so the refusal surfaces as an MCP error result rather than a
    // `?`. `?` would return a tool *error*, which the protocol treats as a
    // malfunction of the server rather than a refusal the client asked for — and
    // `move_issue` returns a refusal as `isError: true` with the diagnostic as its
    // text, so the two tools would disagree about what a refusal looks like.
    let reason = opt_string(args, "reason")?;
    let priority = opt_string(args, "priority")?;
    let assignee = opt_string(args, "assignee")?;
    let labels = opt_string(args, "labels")?;
    let files = opt_string(args, "files")?;
    let related_issues = opt_string(args, "related_issues")?;
    let type_ = opt_string(args, "type")?;
    let estimate = opt_string(args, "estimate")?;
    let cycles = opt_string(args, "cycles")?;
    let milestones = opt_string(args, "milestones")?;
    let reviewer = opt_string(args, "reviewer")?;
    let start_date = opt_string(args, "start_date")?;
    let due_date = opt_string(args, "due_date")?;
    // T028. `""` clears, exactly as `--parent ""` does on the CLI, because both go
    // through `commands::create`/`edit::apply` and those own the semantics. Omitted
    // is `None`, which is a different thing: "leave it alone", not "set none".
    let parent = opt_string(args, "parent")?;
    let commit = opt_string(args, "commit")?;
    // T031. The project association inputs, with `tix edit`'s exact semantics.
    // `projects` **only clears** — a blank value drops every association, and a
    // non-blank value is refused rather than guessed at, so setting the set has
    // exactly one spelling (`add_project`). `projects` is comma-separated (the
    // `--projects` shape, parsed by the CLI's own `resolve_projects`), while
    // `add_project` / `remove_project` are **arrays whose entries stand for
    // occurrences of the CLI's repeatable flags**: each entry reaches
    // `plan_edit_associations` verbatim, so a padded or blank entry is the
    // reference the CLI would also refuse (`--add-project " p-a "`, `--add-project ""`)
    // rather than one this surface silently cleans up. A project is named by its
    // **stable id**; a name resolves to the same project.
    let projects = opt_string(args, "projects")?;
    let add_project = opt_string_array(args, "add_project")?;
    let remove_project = opt_string_array(args, "remove_project")?;
    // T033. The epic-reference inputs, with `tix edit`'s exact semantics and the
    // same shapes as the project ones above: `epics` **only clears**, `add_epic` /
    // `remove_epic` are **arrays whose entries stand for occurrences** of the CLI's
    // repeatable flags, each entry taken verbatim, and an epic is named by its
    // **stable id** (a name resolves to the same epic).
    let epics = opt_string(args, "epics")?;
    let add_epic = opt_string_array(args, "add_epic")?;
    let remove_epic = opt_string_array(args, "remove_epic")?;
    let clear_projects = match projects.as_deref() {
        None => false,
        Some(value) if crate::commands::edit_projects_clears(value) => true,
        Some(value) => {
            // The CLI's own words, so the refusal reads identically on both
            // surfaces (`commands::edit::run` raises this exact message).
            return Ok(error_result(crate::error::render_error(
                &crate::commands::edit_projects_must_be_clear(value),
            )));
        }
    };
    let add_refs: Vec<String> = add_project.unwrap_or_default();
    let remove_refs: Vec<String> = remove_project.unwrap_or_default();
    let has_projects = clear_projects || !add_refs.is_empty() || !remove_refs.is_empty();
    // `--epics` mirrors `--projects`: it exists to **clear**, and a non-blank value
    // is refused with the CLI's own words.
    let clear_epics = match epics.as_deref() {
        None => false,
        Some(value) if crate::commands::edit_epics_clears(value) => true,
        Some(value) => {
            return Ok(error_result(crate::error::render_error(
                &crate::commands::edit_epics_must_be_clear(value),
            )));
        }
    };
    let add_epic_refs: Vec<String> = add_epic.unwrap_or_default();
    let remove_epic_refs: Vec<String> = remove_epic.unwrap_or_default();
    let has_epics = clear_epics || !add_epic_refs.is_empty() || !remove_epic_refs.is_empty();
    // One list, two uses: the emptiness test and the sentence that names what the
    // caller may pass. They were separate hand-maintained enumerations, and a
    // field added to one and not the other is invisible — a caller told
    // "pass at least one of ..." would not learn that a field they just added
    // works, and the empty-update guard would reject a valid single-field edit.
    // That is not hypothetical: `parent` was reachable in the schema and silently
    // absent from both, so `update_issue {parent: "3"}` returned "no fields to
    // update" for a field the tool advertised.
    // `reason` is deliberately **absent**. It qualifies a `status` transition; it is
    // not an editable field, so `update_issue {issue: "1", reason: "because"}` must
    // still be "no fields to update" rather than silently succeeding. Adding it
    // would also mean a reason alone could satisfy the guard and then be discarded.
    const UPDATABLE: [&str; 17] = [
        "title",
        "body",
        "status",
        "priority",
        "assignee",
        "labels",
        "type",
        "files",
        "related_issues",
        "estimate",
        "cycles",
        "milestones",
        "reviewer",
        "start_date",
        "due_date",
        "parent",
        "commit",
    ];
    // `null` counts as absent, matching `opt_string`, which reads an explicit
    // `null` as `None`. Testing only for `is_none()` would let `{"parent": null}`
    // past the guard while every field still read as `None` — the call would fall
    // through to `edit::apply` with nothing to do instead of being refused here.
    let is_absent = |field: &str| match args.get(field) {
        None | Some(Value::Null) => true,
        Some(_) => false,
    };
    if UPDATABLE.iter().all(|field| is_absent(field)) && !has_projects && !has_epics {
        return Ok(error_result(format!(
            "invalid input: no fields to update — pass at least one of {}, or a project \
             association argument (projects, add_project, remove_project), or an epic \
             reference argument (epics, add_epic, remove_epic)",
            UPDATABLE.join(", ")
        )));
    }
    // T031. An association edit is validated **before** the field write, exactly as
    // `edit::run` does, so `add_project: "bogus"` refuses the whole update and
    // leaves every file byte-identical rather than applying the other fields and
    // then failing. The registry and the issue file are re-read from disk, because
    // a project this session created must be resolvable here, and the issue is
    // addressed by **number** so the mutations keep working after an `--assignee`
    // reassign moves the file.
    let has_fields = UPDATABLE.iter().any(|field| !is_absent(field));
    // One freshly-loaded registry for **both** association kinds, so a project or
    // epic this session created is resolvable here and the response can be read
    // back from the same store the writes went through. Addressed by **number**, so
    // the mutations keep working after an `--assignee` reassign moves the file.
    let association_registry = if has_projects || has_epics {
        let (registry, _path) = match registry_config(store) {
            Ok(loaded) => loaded,
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        };
        Some(store_with_config(store, registry))
    } else {
        None
    };
    let association = if has_projects {
        let registry = association_registry
            .as_ref()
            .expect("built when a project argument is present");
        let selector = match registry.resolve_issue(&raw) {
            Ok(issue) => issue.number.to_string(),
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        };
        match crate::commands::project::plan_edit_associations(
            &registry.config,
            registry,
            &selector,
            &add_refs,
            &remove_refs,
            clear_projects,
        ) {
            Ok(plan) => Some((selector, plan)),
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        }
    } else {
        None
    };
    // The epic inputs are planned **before** any write too, so `add_epic: ["bogus"]`
    // refuses the whole update and leaves every file byte-identical (T033 step 5).
    // The plan is the service's: resolution, uniqueness and the stale-id repair
    // path all live in `crate::commands::epic` / `crate::epics`.
    let epic_association = if has_epics {
        let registry = association_registry
            .as_ref()
            .expect("built when an epic argument is present");
        let selector = match registry.resolve_issue(&raw) {
            Ok(issue) => issue.number.to_string(),
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        };
        match cmd_epic::plan_edit_epics(
            &registry.config,
            registry,
            &selector,
            &add_epic_refs,
            &remove_epic_refs,
            clear_epics,
        ) {
            Ok(plan) => Some((selector, plan)),
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        }
    } else {
        None
    };
    // The field write, through the same core the CLI calls. An association-only
    // update has no fields to write, so it reads the issue instead — which is what
    // `edit::run` does, and what keeps a no-op association edit from bumping
    // `updated`.
    let issue = if has_fields {
        match edit::apply(
            config,
            store,
            &raw,
            title.as_deref(),
            body.as_deref(),
            status.as_deref(),
            priority.as_deref(),
            assignee.as_deref(),
            labels.as_deref(),
            files.as_deref(),
            estimate.as_deref(),
            cycles.as_deref(),
            milestones.as_deref(),
            reviewer.as_deref(),
            start_date.as_deref(),
            due_date.as_deref(),
            // `commit` **then** `parent` — `edit::apply`'s order. Passing them the
            // other way round compiles, and the compiler cannot help: both are
            // `Option<&str>`. It put the parent selector into the `commit` slot and
            // persisted it as a commit hash (`commit: '99'` in the issue file), so
            // the parent was silently never set and no validation ran. Found by
            // driving the real binary over JSON-RPC and reading the file it wrote,
            // not by the type checker and not by any existing test.
            commit.as_deref(),
            parent.as_deref(),
            // WP07: the `reason` parameter, closing the gap WP04 recorded. A client can
            // now leave a terminal column through `update_issue` exactly as it can
            // through `move_issue` and the CLI — the same escape on every surface, and
            // the reason recorded in the same `TransitionDecision`.
            //
            // Passed straight through, like `move_issue`'s: no MCP-side validation and
            // no default. A permissive default here would hand MCP a silent override
            // nobody recorded, which the contract calls an escalation trigger.
            reason.as_deref(),
            related_issues.as_deref(),
            type_.as_deref(),
        ) {
            Ok(issue) => issue,
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        }
    } else {
        match store.resolve_issue(&raw) {
            Ok(issue) => issue,
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        }
    };
    // Every association mutation goes through the store's service-backed write, so
    // `updated` and the one History entry are handled in the single place that owns
    // both. Order is clear → remove → add, exactly as `edit::run` applies it, and
    // the project write precedes the epic one as it does there.
    let project_changed = match (&association, association_registry.as_ref()) {
        (Some((selector, plan)), Some(registry)) => {
            match crate::commands::project::apply_edit_associations(registry, selector, plan) {
                Ok(changed) => changed,
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            }
        }
        _ => false,
    };
    let epics_changed = match (&epic_association, association_registry.as_ref()) {
        (Some((selector, plan)), Some(registry)) => {
            match cmd_epic::apply_edit_epics(registry, selector, plan) {
                Ok(changed) => changed,
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            }
        }
        _ => false,
    };
    let associations_changed = project_changed || epics_changed;
    // The response carries the final state, associations included.
    let issue = match (&association, association_registry.as_ref()) {
        (Some((selector, _)), Some(registry)) => match registry.resolve_issue(selector) {
            Ok(issue) => issue,
            Err(e) => return Ok(error_result(crate::error::render_error(&e))),
        },
        _ => match (&epic_association, association_registry.as_ref()) {
            (Some((selector, _)), Some(registry)) => match registry.resolve_issue(selector) {
                Ok(issue) => issue,
                Err(e) => return Ok(error_result(crate::error::render_error(&e))),
            },
            _ => issue,
        },
    };
    // The success line must not claim a write that never happened: an
    // association-only edit that changed nothing writes nothing and bumps no date,
    // so it says so (the CLI's own wording for the same case).
    let text = if has_fields || associations_changed {
        format!("Updated {}", issue.filename)
    } else {
        format!("Updated {} (no association change)", issue.filename)
    };
    Ok(success_result(text, issue_value(&issue, &resolution)))
}

pub(super) fn dispatch(
    config: &Config,
    store: &Store,
    name: &str,
    arguments: &Value,
) -> Option<ToolOutcome> {
    match name {
        "create_issue" => Some(create_issue(config, store, arguments)),
        "list_issues" => Some(list_issues(config, store, arguments)),
        "get_issue" => Some(get_issue(config, store, arguments)),
        "board_status" => Some(board_status(config, store, arguments)),
        "update_issue" => Some(update_issue(config, store, arguments)),
        "move_issue" => Some(move_issue(config, store, arguments)),
        "get_rollup" => Some(get_rollup(store, arguments)),
        "delete_issue" => Some(delete_issue(store, arguments)),
        "search_issues" => Some(search_issues(config, store, arguments)),
        "comment_on_issue" => Some(comment_on_issue(config, store, arguments)),
        "lint_issues" => Some(lint_issues(config, store, arguments)),
        _ => None,
    }
}