feat(FOUR-33160): add ProcessMaker MCP agent for migration, design, a… - #9054
feat(FOUR-33160): add ProcessMaker MCP agent for migration, design, a…#9054gproly wants to merge 3 commits into
Conversation
…nd analysis Introduce PM4 MCP server (processmaker-agent) with 34 tools for PM3→PM4 migration, greenfield process design, and process improvement workflows. - Add WriterServer, Writer, and migration pipeline (BPMN sanitization, bpmndi fallback, dynaform/screen conversion, scripts, resume logs, gap reports) - Add Designer, Analyzer, PlatformWriter, and BPMN design/improvement tools - Register MCP routes in routes/ai.php (stdio + optional HTTP) - Add MCPReadme reference guide and PHPUnit coverage https://processmaker.atlassian.net/browse/FOUR-33160
PR SummaryHigh Risk Overview Documentation: New Migration pipeline: Introduces orchestration around Platform safety / compatibility: Risk note in docs: MCP is positioned as dev/migration tooling; HTTP MCP and unauthenticated PM3 reader access are called out as production concerns. Reviewed by Cursor Bugbot for commit 1f61564. Bugbot is set up for automated code reviews on this repo. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 7 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit fe87ea2. Configure here.
| $log->fail(MigrationLog::STEP_CREATE_PROCESS, $exception->getMessage()); | ||
| throw $exception; | ||
| } | ||
| } |
There was a problem hiding this comment.
Resume skips BPMN ID remapping
High Severity
sanitizeXmlIds and remapBundleElementIds run only inside STEP_CREATE_PROCESS. The resulting id_map is never stored on MigrationLog. After that step finishes, resume feeds the original PM3 bundle (numeric IDs) into linking, assignments, timers, ABE, and step triggers against BPMN that already uses node_* IDs, so those steps miss their targets.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit fe87ea2. Configure here.
| false, | ||
| $field['placeholder'] ?? null, | ||
| $selector | ||
| ); |
There was a problem hiding this comment.
Dropdown options dropped on convert
High Severity
PM3 dropdown, select, and suggest fields take the FormSelect mapping and then go through buildInput, which never copies options. Only radio / checkgroup call buildSelect. Migrated selects therefore keep catalog defaults instead of the source choices.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit fe87ea2. Configure here.
| $candidate = 'node_' . ($suffix !== '' ? $suffix : (string) $counter); | ||
|
|
||
| return self::isValidBpmnId($candidate) ? $candidate : 'node_' . $counter; | ||
| } |
There was a problem hiding this comment.
Sanitized BPMN IDs can collide
Medium Severity
makeValidBpmnId builds node_ plus the last eight alphanumeric characters of the old ID and never checks that the candidate is unused. Distinct PM3 UIDs that share that suffix map to the same ID, so remapped BPMN can contain duplicate id values and fail validation.
Reviewed by Cursor Bugbot for commit fe87ea2. Configure here.
| $node->appendChild($flowNode); | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
Child reorder always appends nodes
Medium Severity
reorderFlowChildren removes incoming / outgoing children and then tries insertBefore against the first removed node. After removeChild, that node is no longer a child, so the guard fails and every reference is appended. The intended in-place XSD order is never applied.
Reviewed by Cursor Bugbot for commit fe87ea2. Configure here.
|
|
||
| if ($this->hasInputFields($items)) { | ||
| $items[] = $this->buildSubmitButton(); | ||
| } |
There was a problem hiding this comment.
Grid-only screens omit submit
Medium Severity
hasInputFields and buildSubmitButton run before grids are turned into FormRecordList items. A dynaform that only has grids therefore gets no submit control on the parent screen, so users cannot complete the migrated task form.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit fe87ea2. Configure here.
| $outFlow->setAttribute('sourceRef', $scriptNodeId); | ||
| $outFlow->setAttribute('targetRef', $targetId); | ||
| $processNode->appendChild($outFlow); | ||
| } |
There was a problem hiding this comment.
Step scripts omit flow references
Medium Severity
insertStepScript rewires sequenceFlow sourceRef / targetRef but never writes incoming / outgoing on the new scriptTask or updates those children on the neighboring nodes. The inserted before/after scripts fail BPMN validation and can disappear from the modeler.
Reviewed by Cursor Bugbot for commit fe87ea2. Configure here.
Add project skill for PM3→PM4 MCP orchestration in Cursor and extend MCPReadme with setup and security documentation. - Add processmaker-migration SKILL.md with agent rules, tool flows, resume/fresh handling, and write confirmations - Add reference.md with PM3/PM4 tool index, bundle fields, and test commands - Link MCPReadme to the Cursor skill and replace local mcp.json paths with generic placeholders - Document dev-only security risks (HTTP MCP, PM3 reader auth, acting user) and production checklist https://processmaker.atlassian.net/browse/FOUR-33160
|
1 participant
…nd analysis
Introduce PM4 MCP server (processmaker-agent) with 34 tools for PM3→PM4 migration, greenfield process design, and process improvement workflows.
https://processmaker.atlassian.net/browse/FOUR-33160