backlog-mcp-server v0.14.0対応とbacklog-api 0.6.0更新

README.md

@@ -28,8 +28,8 @@ node bundle/backlog-api.mjs trace get_issue
 node bundle/backlog-api.mjs call get_issue --input request.json
 ```
 
-The CLI supports all 58 normal tools registered by the checked upstream
-`v0.13.2` source plus the Node-specific `get_rate_limit` operation. `call`
+The CLI supports all 62 normal tools registered by the checked upstream
+`v0.14.0` source plus the Node-specific `get_rate_limit` operation. `call`
 reads one JSON object and writes one structured JSON
 envelope containing the result, diagnostics, and upstream trace information.
 
@@ -40,6 +40,19 @@ permission metadata, confirmation requirements, and curated examples when
 available. `call <operation> --help` is an alias for the same credential-free
 JSON output.
 
+### Issue updates and relations
+
+The v0.14.0 compatibility baseline adds `update_issue_comment`,
+`get_related_issues`, `add_related_issue`, and `remove_related_issue`.
+`update_issue` also accepts an optional `parentIssueId`. Use `tools describe`
+for the exact input schema before calling an operation.
+
+`get_related_issues` is a READ operation. `add_related_issue` requires CREATE,
+`update_issue_comment` requires UPDATE, and `remove_related_issue` requires
+DELETE plus `--confirm-destructive`. Every operation accepts either a positive
+`issueId` or an `issueKey` for its source issue; when both are present, a
+non-positive `issueId` falls back to `issueKey`.
+
 Delete operations and broad notification reset require
 `--confirm-destructive`. Use `--dry-run` to validate input without calling
 Backlog or resolving a configured connection. Write permissions and destructive
@@ -57,7 +70,7 @@ Backlog API access to stderr. Events identify the operation, Backlog client
 method, CRUD category, and whether the default or a named organization was
 selected. A strict whitelist also exposes resource identifiers such as
 `spaceKey`, `projectId`, and `issueKey`, IDs returned by successful API
-operations, duration, changed field names without values, pagination, and an
+operations, related-issue IDs, duration, changed field names without values, pagination, and an
 HTTP failure status when the upstream error exposes one.
 
 Each line starts with `verbose: ` followed by a JSON object. Request and

THIRD_PARTY_NOTICES.md

@@ -3,7 +3,7 @@
 ## Nulab Backlog MCP Server
 
 This repository's generated Node runtime directly bundles published handler
-code from `backlog-mcp-server` version `0.13.2`.
+code from `backlog-mcp-server` version `0.14.0`.
 
 - Project: <https://github.com/nulab/backlog-mcp-server>
 - Copyright: Copyright (c) 2025 Nulab Inc.

TODO.md

@@ -18,9 +18,14 @@
 - [ ] Confirm that CI and release workflows pass independently in both
       repositories and that the Node release contains no Agent Skill files.
 - [x] Register the Node-specific GitHub Issues as
-      [Issues #2–#7](https://github.com/igapyon/backlog-api/issues).
+      [Issues #2–#7 and #18](https://github.com/igapyon/backlog-api/issues).
 
 ## Node Compatibility and Maintenance
 
+- [x] Refresh the upstream compatibility baseline to `backlog-mcp-server`
+      v0.14.0 for [Issue #18](https://github.com/igapyon/backlog-api/issues/18),
+      including operation mapping, safety contracts, differential tests, and
+      downstream handoff prerequisites for [Issue #7](https://github.com/igapyon/backlog-api/issues/7).
+
 Node compatibility and maintenance work is tracked in
-[GitHub Issues #2–#7](https://github.com/igapyon/backlog-api/issues).
+[GitHub Issues #2–#7 and #18](https://github.com/igapyon/backlog-api/issues).

docs/backlog-project-constraints.md

@@ -55,6 +55,31 @@ Backlog APIからHTTP 400、エラーコード7が返され、プロジェクト
 `issueIdOrKey`を指定すると`Issue ID or key is required`となり、
 `issueKey`へ修正することで取得に成功しました。
 
+`issueId`と`issueKey`を同時に指定した場合、正の`issueId`を優先します。
+`issueId`が`0`以下の場合は、`issueKey`を指定していればそちらへフォールバック
+します。どちらも有効でない場合は入力エラーです。
+
+## Related Issues
+
+`get_related_issues`は、課題に紐づく関連課題を読み取ります。`issueId`または
+`issueKey`のいずれかが必要です。
+
+```json
+{"issueKey":"PROJECT-1"}
+```
+
+`add_related_issue`は、元課題の`issueId`または`issueKey`と、関連付け先の
+数値`targetIssueId`を必要とするCREATE操作です。
+
+```json
+{"issueKey":"PROJECT-1","targetIssueId":12346}
+```
+
+`remove_related_issue`は、元課題の`issueId`または`issueKey`と、解除する
+数値`relatedIssueId`を必要とするDELETE操作です。実行には環境側と呼び出し側の
+`DELETE`許可に加え、`--confirm-destructive`が必要です。作成・解除の前には
+同じ入力でdry-runを実行して確認してください。
+
 ## Issue Listing
 
 `get_issues`でプロジェクトを絞り込む場合、`projectId`は単一の数値ではなく
@@ -151,3 +176,11 @@ Backlog APIからHTTP 400、エラーコード7が返され、プロジェクト
 
 コメント追加はBacklogを変更する操作です。事前に同じ入力でdry-runを実行し、
 実行は1回に限定してください。
+
+`update_issue_comment`は、`issueId`または`issueKey`、数値`commentId`、
+新しい`content`を必要とするUPDATE操作です。環境側と呼び出し側の両方で
+`UPDATE`を許可したうえで、dry-runによる入力検証後に実行してください。
+
+```json
+{"issueKey":"PROJECT-1","commentId":12345,"content":"更新後のコメント"}
+```

docs/backlog-rate-limit.md

@@ -57,7 +57,7 @@ Backlog APIのレート制限は、APIキー単位ではなくユーザー単位
 - verboseログでは3つのレート制限ヘッダーだけをホワイトリストで取得し、URL、
   APIキー、レスポンス本文、その他のヘッダーを出力しない
 - ヘッダーからリクエスト種別を確定できない場合は、`read`などを推測して記録しない
-- `get_rate_limit`は、既存の上流由来58操作とは異なるNode CLI独自のREAD操作
+- `get_rate_limit`は、既存の上流由来62操作とは異なるNode CLI独自のREAD操作
   としてトレース情報へ記録する
 - `get_rate_limit`自体もAPIアクセスを1回消費する
 

docs/development.md

@@ -3,7 +3,7 @@
 ## Initial Design Record
 
 - checked date: 2026-07-22
-- repository version: `0.5.0`
+- repository version: `0.6.0`
 - implementation maturity: beta standalone Node Core/CLI
 - split source: `backlog-api-skills` initial combined implementation
 
@@ -19,9 +19,9 @@
 ## Upstream Anchor
 
 - repository: <https://github.com/nulab/backlog-mcp-server>
-- compatibility version: `v0.13.2`
-- checked commit: `d12f010de976af11bcd43f1d3497dc7043d26e62`
-- npm package: `backlog-mcp-server@0.13.2`
+- compatibility version: `v0.14.0`
+- checked commit: `9da42fcfb5b69f1455e3864c49f2b57a45a4cbe9`
+- npm package: `backlog-mcp-server@0.14.0`
 - upstream license: MIT
 - disposable checkout: `workplace/upstream/backlog-mcp-server`
 
@@ -52,7 +52,7 @@ cross-product integrations.
 
 - preserve every upstream normal tool name as one Node operation
 - expose `get_rate_limit` as a clearly identified Node-specific operation
-- use one generic, tested operation runner instead of duplicating 58 handlers
+- use one generic, tested operation runner instead of duplicating 62 handlers
 - generate and commit an upstream tool mapping
 - bundle CLI and importable runtime artifacts separately
 - require a CLI-level confirmation flag for destructive and broad-reset calls

docs/traceability/cli-json-parity.md

@@ -9,6 +9,19 @@
 - upstream Backlog error parsing
 - upstream source and test identity in trace metadata
 
+## v0.14.0 Upstream Delta
+
+- `update_issue_comment` is exposed as an UPDATE operation.
+- `get_related_issues`, `add_related_issue`, and `remove_related_issue` are
+  exposed as READ, CREATE, and destructive DELETE operations respectively.
+- `update_issue` preserves the upstream optional `parentIssueId` input.
+- Issue handlers use `issueKey` when both identifiers are supplied and
+  `issueId` is non-positive, matching the upstream resolver.
+
+The Node policy layer adds the same issue ID/key alternative validation to the
+new issue operations. `remove_related_issue` is a DELETE operation and therefore
+also requires `--confirm-destructive`.
+
 ## CLI Envelope
 
 Successful calls write one JSON object to stdout:
@@ -58,6 +71,8 @@ use the same envelope with `success: false` and error diagnostics.
 - `--verbose` writes sanitized Backlog access start/outcome JSON events to
   stderr; a whitelist permits resource identifiers, duration, changed field
   names, pagination, actual response status, and validated rate-limit metadata
+- related-issue target and relation IDs are included as whitelisted resource
+  identifiers when supplied
 - content values, full request/response data, organization names, credentials,
 personal data, and upstream error text are omitted from verbose events
 - `get_rate_limit` is a Node-specific READ operation, not an upstream normal

docs/traceability/downstream-runtime-handoff.md

@@ -0,0 +1,40 @@
+# Downstream Runtime Handoff
+
+## Compatibility Baseline
+
+- upstream package: `backlog-mcp-server@0.14.0`
+- upstream tag: `v0.14.0`
+- upstream commit: `9da42fcfb5b69f1455e3864c49f2b57a45a4cbe9`
+- current package version: `0.6.0`
+- normal upstream operations: 62
+- Node-specific operations: `get_rate_limit`
+
+## Runtime Changes for `backlog-api-skills`
+
+- added `get_related_issues` (READ)
+- added `add_related_issue` (CREATE)
+- added `update_issue_comment` (UPDATE)
+- added `remove_related_issue` (DELETE and destructive confirmation)
+- preserved `update_issue.parentIssueId`
+- preserved fallback from non-positive `issueId` to `issueKey`
+
+The Node runtime continues to require the environment permission ceiling and
+call-level `--allow` for every write. `remove_related_issue` also requires
+`--confirm-destructive`.
+
+## Handoff Preconditions
+
+Do not pin an uncommitted local bundle in the downstream repository. After the
+source change is committed and a release version or accepted tag suffix is
+chosen, rebuild from a clean worktree and provide all of the following:
+
+1. the exact `backlog-api` commit and release tag
+2. `bundle/backlog-api.mjs`
+3. `bundle/backlog-api-runtime.mjs`
+4. `bundle/backlog-api-sources.tgz`
+5. SHA-256 values calculated from those clean-build artifacts
+6. the v0.14.0 compatibility and safety delta above
+
+Run `npm run typecheck`, `npm run trace:refresh`, `npm test`, and
+`npm run smoke:node` before recording the runtime identity in
+`backlog-api-skills`.

docs/traceability/upstream-followup-log.md

@@ -1,5 +1,20 @@
 # Upstream Follow-Up Log
 
+## 2026-07-31 — v0.14.0 Compatibility Refresh
+
+- pinned npm packages `backlog-mcp-server@0.14.0` and `backlog-js@0.19.0`
+- checked upstream tag `v0.14.0` at commit
+  `9da42fcfb5b69f1455e3864c49f2b57a45a4cbe9`
+- regenerated mappings for 62 upstream normal tools plus the Node-specific
+  `get_rate_limit` operation
+- exposed `update_issue_comment`, `get_related_issues`, `add_related_issue`,
+  and `remove_related_issue` with explicit READ/CREATE/UPDATE/DELETE policy
+  and destructive confirmation for relation removal
+- preserved `update_issue.parentIssueId` and non-positive `issueId` fallback to
+  `issueKey` through the upstream handlers
+- added differential coverage for all new and changed issue operations and
+  retained the Node-only permission, dry-run, verbose, and rate-limit guards
+
 ## 2026-07-22 — Initial v0.13.2 Conversion
 
 - pinned npm package `backlog-mcp-server@0.13.2`

docs/traceability/upstream-snapshot.md

@@ -1,10 +1,10 @@
 # Upstream Snapshot
 
 - repository: <https://github.com/nulab/backlog-mcp-server>
-- tag: `v0.13.2`
-- commit: `d12f010de976af11bcd43f1d3497dc7043d26e62`
-- npm package: `backlog-mcp-server@0.13.2`
-- checked: 2026-07-22
+- tag: `v0.14.0`
+- commit: `9da42fcfb5b69f1455e3864c49f2b57a45a4cbe9`
+- npm package: `backlog-mcp-server@0.14.0`
+- checked: 2026-07-31
 - local checkout: `workplace/upstream/backlog-mcp-server`
 - license: MIT
 

docs/traceability/upstream-tool-mapping.json

@@ -2,15 +2,15 @@
   "schemaVersion": 1,
   "upstream": {
     "repository": "https://github.com/nulab/backlog-mcp-server",
-    "version": "0.13.2",
-    "tag": "v0.13.2",
-    "commit": "d12f010de976af11bcd43f1d3497dc7043d26e62",
-    "checked": "2026-07-22"
+    "version": "0.14.0",
+    "tag": "v0.14.0",
+    "commit": "9da42fcfb5b69f1455e3864c49f2b57a45a4cbe9",
+    "checked": "2026-07-31"
   },
   "target": {
     "repository": "backlog-api",
     "product": "backlog-api",
-    "version": "0.5.0",
+    "version": "0.6.0",
     "strategy": "published-handler-direct-invocation"
   },
   "operations": [
@@ -74,6 +74,16 @@
       "targetEntry": "src/core/run-operation.ts",
       "targetTest": "tests/upstream-differential.test.mjs"
     },
+    {
+      "operation": "add_related_issue",
+      "toolset": "issue",
+      "mutationClass": "mutation",
+      "origin": "upstream",
+      "upstreamSource": "src/tools/addRelatedIssue.ts",
+      "upstreamTest": "src/tools/addRelatedIssue.test.ts",
+      "targetEntry": "src/core/run-operation.ts",
+      "targetTest": "tests/upstream-differential.test.mjs"
+    },
     {
       "operation": "add_version_milestone",
       "toolset": "issue",
@@ -384,6 +394,16 @@
       "targetEntry": "src/core/local-tools.ts",
       "targetTest": "tests/access-policy-and-rate-limit.test.mjs"
     },
+    {
+      "operation": "get_related_issues",
+      "toolset": "issue",
+      "mutationClass": "read",
+      "origin": "upstream",
+      "upstreamSource": "src/tools/getRelatedIssues.ts",
+      "upstreamTest": "src/tools/getRelatedIssues.test.ts",
+      "targetEntry": "src/core/run-operation.ts",
+      "targetTest": "tests/upstream-differential.test.mjs"
+    },
     {
       "operation": "get_resolutions",
       "toolset": "issue",
@@ -524,6 +544,16 @@
       "targetEntry": "src/core/run-operation.ts",
       "targetTest": "tests/upstream-differential.test.mjs"
     },
+    {
+      "operation": "remove_related_issue",
+      "toolset": "issue",
+      "mutationClass": "destructive",
+      "origin": "upstream",
+      "upstreamSource": "src/tools/removeRelatedIssue.ts",
+      "upstreamTest": "src/tools/removeRelatedIssue.test.ts",
+      "targetEntry": "src/core/run-operation.ts",
+      "targetTest": "tests/upstream-differential.test.mjs"
+    },
     {
       "operation": "reset_unread_notification_count",
       "toolset": "notifications",
@@ -544,6 +574,16 @@
       "targetEntry": "src/core/run-operation.ts",
       "targetTest": "tests/upstream-differential.test.mjs"
     },
+    {
+      "operation": "update_issue_comment",
+      "toolset": "issue",
+      "mutationClass": "mutation",
+      "origin": "upstream",
+      "upstreamSource": "src/tools/updateIssueComment.ts",
+      "upstreamTest": "src/tools/updateIssueComment.test.ts",
+      "targetEntry": "src/core/run-operation.ts",
+      "targetTest": "tests/upstream-differential.test.mjs"
+    },
     {
       "operation": "update_project",
       "toolset": "project",