@bli-cockpit/mcp 0.1.52 → 0.1.53

package/README.md

@@ -34,7 +34,7 @@ about what an agent can reach.
 
 <!-- BEGIN GENERATED verb census — `npm run mcp:readme` -->
 
-**103 of 108 Tower verbs have an MCP twin.**
+**104 of 109 Tower verbs have an MCP twin.**
 Each tool goes through the SAME door its CLI verb calls, with the same
 collector device token — never a second route and never a service-role
 reader. `src/verb-census.test.ts` fails when a verb is in none of the
@@ -62,6 +62,7 @@ three tables below.
 | `cockpit careers send-takehome` | `careers_send_takehome` | `POST /api/careers/applications/[id]/invite` |
 | `cockpit careers list` | `careers_list` | `GET /api/careers/applications` |
 | `cockpit careers rescreen` | `careers_rescreen` | `POST /api/careers/applications/[id]/rescreen` |
+| `cockpit careers resume` | `careers_resume_url` | `GET /api/careers/applications/[id]/resume-url` |
 | `cockpit careers settings set` | `careers_settings_set` | `PUT /api/careers/settings` |
 | `cockpit careers settings show` | `careers_settings_show` | `GET /api/careers/settings` |
 | `cockpit careers show` | `careers_show` | `GET /api/careers/applications/[id]` |

package/dist/careers-tools.d.ts

@@ -8,6 +8,10 @@ import { type ToolDeps } from './tool-result.js';
  * something the browser refuses. `careers_takehome_show` returns the RUBRIC,
  * which is reviewer material: it is readable by a super_admin's agent and is
  * never part of what a candidate receives.
+ *
+ * BLI-4462 added `careers_resume_url`, the twin of the drawer's Open resume
+ * button and of `cockpit careers resume`. It hands back a link that lives 60
+ * seconds, which is the whole reason the description says so out loud.
  */
 export declare function registerCareersTools(server: {
     registerTool: (...args: never[]) => unknown;

package/dist/careers-tools.js

@@ -10,6 +10,10 @@ import { doorFailureText, errorResult, registrarFor, textResult, withSession } f
  * something the browser refuses. `careers_takehome_show` returns the RUBRIC,
  * which is reviewer material: it is readable by a super_admin's agent and is
  * never part of what a candidate receives.
+ *
+ * BLI-4462 added `careers_resume_url`, the twin of the drawer's Open resume
+ * button and of `cockpit careers resume`. It hands back a link that lives 60
+ * seconds, which is the whole reason the description says so out loud.
  */
 export function registerCareersTools(server, deps) {
     const register = registrarFor(server);
@@ -52,6 +56,26 @@ export function registerCareersTools(server, deps) {
         const answer = await callAgentDoor(session, deps.fetchImpl, 'POST', `/api/careers/applications/${encodeURIComponent(String(args.id))}/grade`, { now: args.now === true }, 60_000);
         return answer.ok ? textResult('Queued for grading', answer.body) : errorResult(doorFailureText('careers_grade', answer));
     }));
+    // BLI-4462. The drawer has an "Open resume" button and this surface had no
+    // word for it, so an agent could read every screening line about a candidate
+    // and not reach the document they wrote about themselves. Same door, same
+    // super_admin gate, same 60 seconds: the link is a bearer credential for one
+    // private object and it dies quickly on purpose, so the description says so
+    // rather than letting a caller park it in a note for later.
+    register('careers_resume_url', {
+        title: 'Link to a resume',
+        description: 'Super-admin only. A signed link to one applicant\'s resume file, the same one the Open resume button uses. THE LINK DIES IN 60 SECONDS: fetch it and read it in the same turn, never store it. An application with no resume on file is refused rather than answered with an empty link.',
+        inputSchema: { id: z.string().uuid() },
+    }, async (args) => withSession(deps, async (session) => {
+        const answer = await callAgentDoor(session, deps.fetchImpl, 'GET', `/api/careers/applications/${encodeURIComponent(String(args.id))}/resume-url`);
+        if (!answer.ok)
+            return errorResult(doorFailureText('careers_resume_url', answer));
+        // The door says `expires_in`; every surface a person reads says
+        // `expires_in_seconds`, because 60 with no unit reads as minutes.
+        const body = (answer.body ?? {});
+        const expires = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in : 60;
+        return textResult('Resume link', { url: body.url, expires_in_seconds: expires });
+    }));
     register('careers_decide', {
         title: 'Decide on an application',
         description: 'Super-admin only. Records the call on one application: `passed_on`, `archived`, or `reopen` to put it back at `screened`.',

package/dist/verb-census.js

@@ -220,6 +220,9 @@ export const MCP_TWINS = {
     "careers invite": { tool: "careers_send_takehome", door: "POST /api/careers/applications/[id]/invite" },
     "careers decide": { tool: "careers_decide", door: "POST /api/careers/applications/[id]/decide" },
     "careers grade": { tool: "careers_grade", door: "POST /api/careers/applications/[id]/grade" },
+    // BLI-4462: the drawer's Open resume button, typed. Both twins call the door
+    // that signs a 60-second link to the private resume object.
+    "careers resume": { tool: "careers_resume_url", door: "GET /api/careers/applications/[id]/resume-url" },
     "careers takehome-show": { tool: "careers_takehome_show", door: "GET /api/careers/takehomes/[role]" },
     "careers takehome-set": { tool: "careers_takehome_set", door: "PUT /api/careers/takehomes/[role]" },
     "careers settings-show": { tool: "careers_settings_show", door: "GET /api/careers/settings" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/mcp",
-  "version": "0.1.52",
+  "version": "0.1.53",
   "private": false,
   "description": "bli-tower: an MCP server over BLI Cockpit's agent doors: JARVIS (jarvis_*), documents (docs_*), channels (msg_*), issues (work_*), the daily page (brief_*), meeting notes (notes_*), the ops board (ops_status/slack_*), settings/team/model, Scout and the workbook, plus the legacy event-stream tools (emit_event, get_ticket_timeline, get_active_tickets).",
   "type": "module",