[zwanski-start]

Problem

In #72 the chat wrote a JSON feature file (prompts/theme_update_features.json) and then told the user to run npx claude-spec feature_import .... That command doesn't exist, so the user got a 404 from npm. The chat had no tool that could import an existing feature file, so the model made up a CLI command.

Some of this was fixed on master after the report: the assistant chat now gets feature_create/feature_create_bulk, and its prompt says not to suggest CLI commands. Importing a file that already exists was still not possible.

Changes

• New MCP tool feature_import_file(file_path) in mcp_server/feature_mcp.py. It reads a JSON file from inside the project directory and creates the features through feature_create_bulk, so validation, priorities and depends_on_indices all behave the same way.
  • The file can hold a JSON array of features or an object with a "features" array.
  • The path can be relative to the project or absolute, but must resolve inside the project dir (blocks .. traversal). Files over 5 MB are rejected.
  • Missing files, bad JSON, empty lists and non-object items return clear errors.
• Both the assistant chat and the expand-project chat now get the tool (in allowed_tools and the settings allowlist).
• The assistant system prompt and .claude/commands/expand-project.md now say there is no CLI/npx/curl command for importing features. When the user has a JSON file, the model should call feature_import_file.
• Added feature_import_file to the MCP tool list in CLAUDE.md.

Verification

• python -m pytest test_feature_import.py: 9 new tests pass. They cover array and object formats, dependency resolution, rejecting paths outside the project (absolute and ..), and bad content.
• Started the real MCP server over stdio, called feature_import_file("prompts/theme_update_features.json"), and feature_get_stats then reported the new feature.
• ruff check . passes. mypy mcp_server/feature_mcp.py is clean. test_security.py and test_client.py pass.
• No UI changes, so I didn't do a browser check.

Assumptions

• I read "full screen chat" as the assistant/expand chat sessions. The coding and initializer agents don't get the new tool because they don't need it.
• I didn't add an import button to the UI or a REST endpoint. POST /api/projects/{name}/features/bulk already exists for programmatic use.

Closes #72

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Ken (cubefarm agent, in a fresh session) · Round: 1 · Author: Guido

The PR adds the feature_import_file MCP tool and gives it to the assistant and expand chats. I confirmed through the real stdio MCP server that the issue's file (prompts/theme_update_features.json) imports, with dependencies, and shows up in the API, the Kanban board and the dependency graph. Path containment holds against .., outside absolute paths, a same-prefix sibling folder and a symlink pointing outside, and bad content gets clear errors. ruff is clean; mypy and pytest show exactly the same errors and failures as master, and the 9 new tests pass.

	Check	Details
✅	Issue repro: importing an existing JSON feature file from a chat	Ran the MCP server over stdio and called feature_import_file('prompts/theme_update_features.json'). It returned {created:2, with_dependencies:1}. feature_get_stats and GET /api/projects/qa325/features showed the imported features, with dependencies resolved (#4 depends on #3).
✅	Assistant/expand chat tool wiring and prompt	feature_import_file is in ASSISTANT_FEATURE_TOOLS (allowed_tools and the settings allow list) and in EXPAND_FEATURE_TOOLS, and not in DISALLOWED_ASSISTANT_TOOLS. The system prompt names the tool and says there is no CLI/npx command for importing. expand-project.md was updated the same way.
✅	Path containment / security	Rejects ../proj2/x.json, absolute paths outside the project, /etc/passwd, a sibling folder with the same name prefix (proj vs proj2) and a symlink inside the project pointing outside it. Files over 5 MB are rejected. security.py and the localhost middleware are untouched.
✅	Bad input handling	Missing file, directory, bad JSON, null, an empty array, an object without 'features', items that aren't objects, missing required fields and forward depends_on_indices all return clear JSON errors. An empty path is rejected by the schema (minLength 1). Minor, not blocking: UTF-8-with-BOM and CP1252 files are rejected as invalid JSON.
✅	Python lint/type/tests vs master baseline	ruff is clean. mypy shows 24 errors both on this branch and on master (only line numbers shifted). pytest: 21 failed / 153 passed here vs 21 failed / 144 passed on master; the failing set is identical and none of it is related to this PR. The 9 new tests pass.
✅	Backend boot + REST	uvicorn server.main:app on 127.0.0.1:5345: /api/health returned 200, project create worked, bulk feature create worked, an unknown project returned 404 and the features list returned 200. The server log had no errors, and the port was free after stopping it.
✅	UI build/lint and browser sanity	npm run build succeeded. npm run lint gave 0 errors and 6 warnings. In the browser, the dashboard (with a live WebSocket), the Kanban board with the imported cards and the Graph with the imported dependency edge rendered with 0 console errors or warnings. At phone width the sidebar stays expanded; the PR makes no UI changes, so this is how master behaves too.
⏭️	UI e2e tests	The PR doesn't touch ui/, so I didn't run test:e2e.

🧪 Commands run

Command	Result
python -m pytest test_feature_import.py -v	9 passed
ruff check .	All checks passed
mypy . (PR vs origin/master worktree)	24 errors on both, identical apart from line numbers; none from this PR
python -m pytest -q (PR vs origin/master)	PR 21 failed/153 passed; master 21 failed/144 passed; same failing tests
python test_security.py	ALL TESTS PASSED
python test_security_integration.py	ALL INTEGRATION TESTS PASSED
python probe.py (direct edge-case calls of feature_import_file)	Valid imports succeed; traversal, sibling-prefix, symlink, large, bad and empty inputs are rejected
python stdio.py (real MCP stdio client: list_tools + call_tool)	Tool listed with schema; import created features; stats total updated
npm --prefix ui run build	built successfully
npm --prefix ui run lint	0 errors, 6 warnings
uvicorn server.main:app --port 5345 + curl routes	health 200, unknown project 404, features 200, bulk create OK

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}