@agilemonster/mcp-server 1.0.5 → 1.0.6

package/dist/client.d.ts

@@ -33,7 +33,7 @@ export declare class AgileMonsterClient {
         provider: string;
         cards: Card[];
     }>;
-    claimTask(cardId: string, provider: string, runRef?: string): Promise<Card>;
+    claimTask(cardId: string, provider: string, runRef?: string, expectedBoardId?: string): Promise<Card>;
     askQuestion(cardId: string, provider: string, question: string): Promise<Card>;
     addProgress(cardId: string, provider: string, update: string, tokensUsed?: number, costUsd?: number): Promise<Card>;
     recordSpend(cardId: string, provider: string, tokens: number, costUsd: number, note?: string): Promise<Card>;

package/dist/client.js

@@ -195,10 +195,11 @@ export class AgileMonsterClient {
         const qs = params.toString();
         return this.request(`/api/agent/assigned${qs ? `?${qs}` : ''}`);
     }
-    async claimTask(cardId, provider, runRef) {
+    async claimTask(cardId, provider, runRef, expectedBoardId) {
+        const boardId = expectedBoardId || this.loadProjectConfig()?.board_id;
         return this.request(`/api/agent/cards/${cardId}/claim`, {
             method: 'POST',
-            body: JSON.stringify({ provider, run_ref: runRef }),
+            body: JSON.stringify({ provider, run_ref: runRef, board_id: boardId }),
         });
     }
     async askQuestion(cardId, provider, question) {

package/dist/orchestrator.js

@@ -12,6 +12,10 @@ export class AgileMonsterOrchestrator {
         const projectConfig = this.client.loadProjectConfig();
         const provider = options?.provider || projectConfig?.provider || 'any';
         const boardId = options?.boardId || projectConfig?.board_id;
+        // STRICT BOARD SCOPE GUARD: Never poll across all boards when current folder is unbound!
+        if (!boardId) {
+            return [];
+        }
         const result = await this.client.listAssigned(provider, undefined, boardId);
         return result.cards || [];
     }
@@ -34,8 +38,10 @@ export class AgileMonsterOrchestrator {
             console.log(`🤖 Default Provider: ${config.provider || 'any'}`);
         }
         else {
-            console.log(`ℹ️  No .agilemonster.json found in current directory (${cwdName}).`);
-            console.log('   Run "agilemonster-orchestrator init" to bind this repo to a board.\n');
+            console.log(`⚠️  [UNBOUND REPOSITORY] No .agilemonster.json found in "${cwdName}".`);
+            console.log('   To prevent agents from picking up tasks from the wrong board and burning tokens:');
+            console.log('   Run "npx -y @agilemonster/mcp-server bootstrap" in this folder first!\n');
+            return;
         }
         console.log('\n🔍 Checking for assigned agent tasks...');
         const tasks = await this.checkTasks();
@@ -217,13 +223,24 @@ export class AgileMonsterOrchestrator {
                     else {
                         const num = parseInt(choice, 10);
                         if (!Number.isNaN(num) && num >= 1 && num <= boards.length) {
-                            targetBoard = boards[num - 1];
-                        }
-                        else if (context.matched_board) {
-                            targetBoard = context.matched_board;
+                            const candidate = boards[num - 1];
+                            // Safety confirmation if user picks an existing board that AI said didn't match this folder
+                            if (aiMatch &&
+                                aiMatch.matched_board_id !== candidate.id &&
+                                candidate.name.toLowerCase() !== folderName.toLowerCase()) {
+                                const confirm = (await rl.question(`⚠️  Safety Check: Folder is "${folderName}" but board is "${candidate.name}". Are you sure they are the same project? [y/N]: `))
+                                    .trim()
+                                    .toLowerCase();
+                                if (confirm !== 'y' && confirm !== 'yes') {
+                                    console.log('❌ Cancelled to prevent connecting the wrong board.');
+                                    return;
+                                }
+                            }
+                            targetBoard = candidate;
                         }
                         else {
-                            targetBoard = boards[0];
+                            console.error(`❌ Invalid selection "${choice}". Aborting so we never bind the wrong board.`);
+                            return;
                         }
                     }
                 }
@@ -232,14 +249,15 @@ export class AgileMonsterOrchestrator {
                 }
             }
             else {
-                // Non-interactive fallback: use AI match if present, or create new board if none matched
-                if (context.matched_board) {
+                // Non-interactive mode: ONLY auto-bind if AI matched with high confidence OR --board was explicitly passed.
+                // NEVER auto-pick a board or create a board silently if ambiguous!
+                if (context.matched_board && aiMatch?.confidence === 'high') {
                     targetBoard = context.matched_board;
                 }
-                else if (boards.length > 0 || (context.workspaces && context.workspaces.length > 0)) {
-                    const workspaceId = boards[0]?.workspace_id || context.workspaces?.[0]?.id || '';
-                    targetBoard = await this.client.createBoard(workspaceId, suggestedNewBoardName, `Connected to repository ${folderName}`);
-                    console.log(`✨ Created new board "${targetBoard.name}" (${targetBoard.id})`);
+                else {
+                    console.error(`❌ Ambiguous board match for folder "${folderName}" in non-interactive mode.`);
+                    console.error(`   Please run interactively in your terminal or pass --board="<Board Name>" explicitly so we never connect the wrong board.`);
+                    return;
                 }
             }
         }
@@ -288,6 +306,8 @@ export class AgileMonsterOrchestrator {
             workspace_id: targetBoard.workspace_id,
             board_id: targetBoard.id,
             board_name: targetBoard.name,
+            project_name: folderName,
+            project_path: process.cwd(),
             provider: options?.provider || 'antigravity',
             review_list: 'In Review',
             done_list: 'Done',

package/dist/server.js

@@ -512,12 +512,30 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                     const status = args.status;
                     const boardId = args.board_id || projectConfig?.board_id;
                     const workspaceId = projectConfig?.workspace_id;
+                    if (!boardId) {
+                        return {
+                            isError: true,
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `⚠️ [BOARD SCOPE GUARD] Current project folder "${path.basename(process.cwd())}" is not bound to an Agile Monster board (.agilemonster.json is missing).\n` +
+                                        `Refusing to list tasks across all boards so you never accidentally pick up a task from the wrong project and burn tokens.\n` +
+                                        `Please run "npx -y @agilemonster/mcp-server bootstrap" in this folder or call agilemonster_get_context first to bind the right board.`,
+                                },
+                            ],
+                        };
+                    }
                     const result = await client.listAssigned(provider, status, boardId, workspaceId);
                     return {
                         content: [
                             {
                                 type: 'text',
-                                text: JSON.stringify(result, null, 2),
+                                text: JSON.stringify({
+                                    bound_board_id: boardId,
+                                    bound_board_name: projectConfig?.board_name,
+                                    bound_project_name: projectConfig?.project_name || path.basename(process.cwd()),
+                                    ...result,
+                                }, null, 2),
                             },
                         ],
                     };
@@ -526,12 +544,25 @@ Please strictly follow the Agile Monster Task Lifecycle Protocol:
                     const cardId = args.card_id;
                     const provider = args.provider || projectConfig?.provider || 'antigravity';
                     const runRef = args.run_ref;
-                    const card = await client.claimTask(cardId, provider, runRef);
+                    const expectedBoardId = projectConfig?.board_id;
+                    if (!expectedBoardId) {
+                        return {
+                            isError: true,
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `⚠️ [BOARD SCOPE GUARD] Cannot claim card ${cardId} because this repository folder ("${path.basename(process.cwd())}") has no .agilemonster.json board binding.\n` +
+                                        `Run "npx -y @agilemonster/mcp-server bootstrap" first so we verify this folder matches the card's board.`,
+                                },
+                            ],
+                        };
+                    }
+                    const card = await client.claimTask(cardId, provider, runRef, expectedBoardId);
                     return {
                         content: [
                             {
                                 type: 'text',
-                                text: `Task claimed successfully. Status is now "in_progress".\n${JSON.stringify(card, null, 2)}`,
+                                text: `Task claimed successfully on board "${card.board_name || expectedBoardId}". Status is now "in_progress".\n${JSON.stringify(card, null, 2)}`,
                             },
                         ],
                     };

package/dist/types.d.ts

@@ -2,6 +2,8 @@ export interface AgileMonsterProjectConfig {
     workspace_id?: string;
     board_id?: string;
     board_name?: string;
+    project_name?: string;
+    project_path?: string;
     provider?: string;
     review_list?: string;
     done_list?: string;

package/dist/worker.js

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+import path from 'node:path';
 import { AgileMonsterClient } from './client.js';
 export class AgileMonsterWorker {
     client;
@@ -59,8 +60,11 @@ export class AgileMonsterWorker {
         const projectConfig = this.client.loadProjectConfig();
         const provider = options.provider || projectConfig?.provider || 'antigravity';
         const boardId = options.boardId || projectConfig?.board_id;
+        if (!boardId) {
+            throw new Error(`[Board Scope Guard] No .agilemonster.json board binding found in "${path.basename(process.cwd())}". Refusing to poll tasks without an explicit board binding.`);
+        }
         const res = await this.client.listAssigned(provider, 'queued', boardId);
-        const tasks = res.cards || [];
+        const tasks = (res.cards || []).filter((c) => !c.board_id || c.board_id === boardId);
         if (tasks.length === 0) {
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agilemonster/mcp-server",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "type": "module",
   "description": "Official Model Context Protocol (MCP) server & Orchestrator for Agile Monster (Cursor, Claude Code, Antigravity, Codex, Hermes, Windsurf)",
   "main": "dist/server.js",