[zwanski-start]

Closes #135

What changed

• New MCP tool feature_report_bug(feature_id, bug_description, verification_steps?) (mcp_server/feature_mcp.py): instead of creating a near-duplicate feature, it appends BUG REPORT: … to the existing feature's description, appends any verification steps, sets passes=false / in_progress=false, and moves the feature to the front of the queue (MIN(priority) - 1). Runs in an atomic_transaction. It refuses features that an agent is currently working on (in_progress), so the report can't be lost when that agent marks the feature passing.
• Assistant (server/services/assistant_chat_session.py): the tool is now in the assistant's allowed tools. The system prompt describes three modes: Help (answer only), New feature (feature_create / _bulk), and Bug report (find the existing feature and call feature_report_bug; create a new feature only if no existing feature covers the behavior). The greeting mentions the three options.
• UI (AssistantChat.tsx, useAssistantChat.ts): three quick-start chips (Get help / New feature / Report a bug) above the input. They show until the user sends a first message, and clicking one pre-fills the input with a mode prefix. The input placeholder is updated, and the tool call is shown as "Reporting bug on feature #N (back to pending)".

Verification

• New test_feature_report_bug.py (5 tests, passing): passing feature → pending at front of queue with report and steps appended; steps unchanged when none are given; in-progress feature refused and left unchanged; unknown ID; tool is allowed for the assistant and not in its disallowed list.
• ruff check . clean, python test_security.py passes, and mypy shows no new errors. Its only output is pre-existing unused-type: ignore notes on lines this PR doesn't change.
• npm run lint (0 errors) and npm run build pass.
• I did not click through the assistant panel in a browser: opening it starts a real Claude session, which writes CLAUDE.md into a registered project. The UI change is small and covered by the type check and build.

Assumptions

• "Put it in pending" means passes=false, in_progress=false. I also move the feature to the front of the queue so the bug gets fixed next, which seemed the most useful default.
• The bug report lives in the description text (no schema change). This means coding agents see it automatically through feature_get_by_id.

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Dennis (cubefarm agent, in a fresh session) · Round: 1 · Author: Dennis

The new feature_report_bug MCP tool works as described: an existing feature goes back to pending at the front of the queue with the bug report and steps appended, in-progress and unknown features are refused, and bad input is rejected. The assistant can use the tool and the coding-agent tools stay blocked. The Help / New feature / Report a bug buttons and the tool-call label work in a real browser, including at phone width. Lint, build and the new tests pass; the pytest failures and mypy errors are the same as on master.

	Check	Details
✅	Issue acceptance: bug report modifies existing feature and puts it back in pending	Called feature_report_bug through a real MCP stdio client on a fresh DB after marking feature 1 passing: passes=false, in_progress=false, priority 0 (front of queue), 'BUG REPORT: …' appended to the description with non-ASCII intact, steps appended. feature_get_ready lists it first and feature_get_stats drops passing to 0.
✅	Edge cases / validation	Empty bug_description, feature_id=0 and feature_id='abc' are rejected by pydantic validation; ID 42 returns 'Feature with ID 42 not found'. The in-progress refusal is covered by a unit test. Minor: a description of only spaces passes min_length=1.
✅	Assistant tool permissions / security	feature_report_bug is in ASSISTANT_FEATURE_TOOLS and not in DISALLOWED_ASSISTANT_TOOLS. mark_passing/mark_failing/claim/in_progress stay disallowed. security.py and the localhost middleware are untouched. No schema change.
✅	Assistant system prompt and greeting	Help / New feature / Bug report modes are described and the greeting mentions all three. Non-blocking: the prompt suggests feature_get_ready/feature_get_blocked to find the feature, but both leave out passing features; feature_get_graph and feature_get_by_id are still available under bypassPermissions.
✅	UI quick-start buttons (browser, mocked assistant WebSocket)	The three buttons show under the greeting. 'Report a bug' fills in the prefix and focuses the textarea, and the buttons hide while there is input. Sending shows 'Reporting bug on feature #1 (back to pending)'. The buttons return in a new chat and when the input is cleared.
✅	Responsive layout	At 390x844 the buttons wrap onto two rows with no horizontal overflow.
✅	App renders (project list, Kanban, Graph) without console errors	Kanban shows the features and Graph renders 2 nodes. The only console error was a 404 for the fake conversation ID my mock sent, not from the PR.
✅	Backend lint/types/tests	ruff clean. mypy: same 24 errors as master. pytest: 149 passed, 21 failed; the same 21 test_devserver_security failures happen on master. The 5 new tests pass.
✅	Frontend build/lint	tsc -b && vite build succeeds; eslint 0 errors, 6 existing warnings.
⏭️	UI Playwright e2e	All 15 specs skip with 'No projects available': their picker selector (.neo-dropdown-item) no longer exists in the UI. The PR does not change these tests; the browser run above covered the changed UI.

🧪 Commands run

Command	Result
venv/bin/python -m ruff check .	All checks passed
venv/bin/python -m mypy .	24 errors, same set as origin/master (one line number shifted)
venv/bin/python -m pytest -q	149 passed, 21 failed (the same 21 fail on origin/master, all in test_devserver_security.py)
venv/bin/python -m pytest -q test_feature_report_bug.py	5 passed
venv/bin/python test_security.py	ALL TESTS PASSED
MCP stdio probe script calling feature_report_bug/feature_get_ready/feature_get_stats	Behaved as expected, validation errors on bad input
npm --prefix ui run lint	0 errors, 6 warnings
npm --prefix ui run build	success
uvicorn server.main:app --port 5247 (separate HOME, no claude on PATH); curl /api/projects, /api/projects/qa278/features, /api/projects/nope/features	200, 200, 404
VITE_API_PORT=5247 npx playwright test (system chromium)	15 skipped (stale project-picker selector in the specs, unrelated to this PR)

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}