@checkbox-site/mcp 0.2.5 → 0.2.6

package/dist/server.d.ts

@@ -5,7 +5,7 @@ import type { KeyContext } from './permissions.ts';
 import { type IssuedKeys, type ToolContext, type ToolDef } from './tools.ts';
 export declare const SERVER_NAME = "checkbox";
 /** Kept equal to packages/mcp/package.json "version" (@checkbox-site/mcp); mcp.test.ts checks it. */
-export declare const SERVER_VERSION = "0.2.5";
+export declare const SERVER_VERSION = "0.2.6";
 export declare const DEFAULT_MCP_URL = "https://app.checkbox.site/mcp";
 /** The coverage phrase used across Checkbox (the API docs tests check the count against the rules catalog). */
 export declare const COVERAGE_PHRASE = "federal law, 27 states, DC and New York City";

package/dist/server.js

@@ -9,7 +9,7 @@ import { likelyMisspelling, unknownArgumentsMessage, unknownKeysParams } from ".
 import { outdatedNotice } from "./version-check.js";
 export const SERVER_NAME = 'checkbox';
 /** Kept equal to packages/mcp/package.json "version" (@checkbox-site/mcp); mcp.test.ts checks it. */
-export const SERVER_VERSION = '0.2.5';
+export const SERVER_VERSION = '0.2.6';
 export const DEFAULT_MCP_URL = 'https://app.checkbox.site/mcp';
 /** The coverage phrase used across Checkbox (the API docs tests check the count against the rules catalog). */
 export const COVERAGE_PHRASE = 'federal law, 27 states, DC and New York City';

package/dist/tools.d.ts

@@ -133,6 +133,12 @@ export declare function clipWords(v: unknown, n: number): unknown;
 export declare function unverifiedScanNote(u: unknown): string | null;
 /** Round 20: one line with the plans Checkbox judges the site against (setup's site_plans), so no second call is needed. */
 export declare function sitePlansNote(plans: unknown): string | null;
+/**
+ * Round 33 (pilot 32 item 22, new-app: setup_checkbox answered with about 30 KB on the first call): the first setup
+ * response leaves out what the agent does not need yet. The go-live steps become their one-line summary (get_compliance_plan
+ * and complete_setup carry them in full), and once the Stripe key is stored its permission checklist is dropped. Pure.
+ */
+export declare function compactSetupDoc<T>(doc: T): T;
 /**
  * Pilot round 9 (nextjs): setup_checkbox still showed `insurable: false` and `score: 26.8` next to the status label.
  * The API keeps both (deprecated) for backward compatibility; agents see only the one status.
@@ -211,6 +217,21 @@ interface PrecheckLite {
 }
 /** Audit: the pre-check's per-check results, one compact line each (agents only saw the overall verdict). */
 export declare function precheckLines(pre: PrecheckLite | null | undefined, max?: number): string[];
+interface FinalCheckLite {
+    check_id: string;
+    observed: string;
+    detail?: string;
+}
+/**
+ * Round 33 (pilot 32 item 10, new-app: the PASSED_WITH_NOTES text listed the stale pre-check bullets (needs_review)
+ * while the final checks lived only in the JSON): a finished verification is summarized from its FINAL checks; the
+ * pre-check lines show only while it is pending or when it has no final checks. Pure, exported for tests.
+ */
+export declare function verificationLines(v: {
+    status: string;
+    precheck?: PrecheckLite | null;
+    checks?: FinalCheckLite[] | null;
+}, max?: number): string[];
 /** createTestRun body from the tool's arguments (top-level shortcuts merged into `stripe`). Exported for tests. */
 export declare function startTestRunBody(args: Record<string, unknown>): Record<string, unknown>;
 interface ScheduledNotice {

package/dist/tools.js

@@ -461,10 +461,29 @@ async function setupOverOAuth(api, session, ctx) {
         data: (() => {
             const doc = { ...session, ...(fresh ?? {}) };
             const keys = labelledPublicKeys(doc.install?.snippet_key, doc.publishable_key);
-            return withoutLegacyScore({ ...doc, ...(keys.length ? { public_keys: keys } : {}), ...(firstCheck ? { first_check: firstCheck } : {}) });
+            return compactSetupDoc(withoutLegacyScore({ ...doc, ...(keys.length ? { public_keys: keys } : {}), ...(firstCheck ? { first_check: firstCheck } : {}) }));
         })(),
     };
 }
+/**
+ * Round 33 (pilot 32 item 22, new-app: setup_checkbox answered with about 30 KB on the first call): the first setup
+ * response leaves out what the agent does not need yet. The go-live steps become their one-line summary (get_compliance_plan
+ * and complete_setup carry them in full), and once the Stripe key is stored its permission checklist is dropped. Pure.
+ */
+export function compactSetupDoc(doc) {
+    if (!doc || typeof doc !== 'object')
+        return doc;
+    const d = { ...doc };
+    const g = d.go_live;
+    if (g && typeof g === 'object' && Array.isArray(g.steps))
+        d.go_live = { summary: g.summary ?? null, steps: g.steps.length, full: 'get_compliance_plan (go_live) or complete_setup' };
+    const st = d.stripe;
+    if (st && st.test_credential_stored === true && st.restricted_key && Array.isArray(st.restricted_key.permissions)) {
+        const { permissions: _p, ...rk } = st.restricted_key;
+        d.stripe = { ...st, restricted_key: rk };
+    }
+    return d;
+}
 /**
  * Pilot round 9 (nextjs): setup_checkbox still showed `insurable: false` and `score: 26.8` next to the status label.
  * The API keeps both (deprecated) for backward compatibility; agents see only the one status.
@@ -647,7 +666,7 @@ const setupCheckbox = {
                 notes: [
                     'Tell the human exactly one line, e.g. "Open <link> and click Approve to connect Checkbox (free, no card)." Do not ask them to copy keys.',
                     // Round 32 (pilot 31 item 13): the Stripe key box and the restricted key in the same message (one approval).
-                    `${args.billing_platform === 'stripe' ? 'In the same message' : 'If the site sells through Stripe, in the same message'}, ask them to tick “Let your agent store a Stripe test-mode key” on that page and, if the project has no rk_test_ key yet, to create a restricted key in Stripe Test mode (https://dashboard.stripe.com/test/apikeys → Create restricted key, with the permissions the approval page lists) and put it in the project's env file (never in the chat): one approval then covers the key and the test subscription.`,
+                    `${args.billing_platform === 'stripe' ? 'In the same message' : 'If the site sells through Stripe, in the same message'}, ask them to tick the box “Let your agent store a Stripe test-mode restricted key for this project” on that page and, if the project has no rk_test_ key yet, to create a restricted key in Stripe Test mode (https://dashboard.stripe.com/test/apikeys → Create restricted key, with the permissions the approval page lists) and put it in the project's env file (never in the chat): one approval then covers the key and the test subscription.`,
                     `Then call setup_checkbox again with device_code "${auth.device_code}" AND the same facts (site_url, checkout_url, merchant_name, plans, policy URLs): after the approval Checkbox applies them and runs the first checks in that call. Keep the device_code private; it is not shown to the human.`,
                 ],
                 next: { type: 'wait_for_approval', message: `Call setup_checkbox with device_code "${auth.device_code}" to wait for the approval.`, operation_id: 'createDeviceToken' },
@@ -670,7 +689,7 @@ const setupCheckbox = {
             notes,
             data: (() => {
                 const keys = labelledPublicKeys(session.install?.snippet_key, session.publishable_key);
-                return keys.length ? { ...withoutLegacyScore(session), public_keys: keys } : withoutLegacyScore(session);
+                return compactSetupDoc(keys.length ? { ...withoutLegacyScore(session), public_keys: keys } : withoutLegacyScore(session));
             })(),
         };
     },
@@ -957,6 +976,21 @@ export function precheckLines(pre, max = 12) {
     const lines = sorted.slice(0, max).map((c) => `${c.check_id}: ${c.status}${c.reason ? ` — ${untrusted(c.reason, 180)}` : ''}${c.fix ? ` Fix: ${untrusted(c.fix, 200)}` : ''}`);
     return [`Pre-check (${pre?.verdict ?? 'n/a'}), per check:`, ...lines, ...(checks.length > max ? [`and ${checks.length - max} more (data.precheck.checks)`] : [])];
 }
+/**
+ * Round 33 (pilot 32 item 10, new-app: the PASSED_WITH_NOTES text listed the stale pre-check bullets (needs_review)
+ * while the final checks lived only in the JSON): a finished verification is summarized from its FINAL checks; the
+ * pre-check lines show only while it is pending or when it has no final checks. Pure, exported for tests.
+ */
+export function verificationLines(v, max = 12) {
+    const checks = v.checks ?? [];
+    if (v.status === 'pending' || !checks.length)
+        return precheckLines(v.precheck, max);
+    const order = { fail: 0, needs_review: 1, missing_data: 1, pass: 2, informational: 2, not_applicable: 3 };
+    const sorted = [...checks].sort((a, b) => (order[a.observed] ?? 1) - (order[b.observed] ?? 1));
+    const lines = sorted.slice(0, max).map((c) => `${c.check_id}: ${c.observed}${c.detail ? ` — ${untrusted(c.detail, 180)}` : ''}`);
+    const pre = v.precheck?.verdict && v.precheck.checks?.length ? [`(The pre-check's estimate, ${v.precheck.verdict}, is superseded by these final checks: data.precheck keeps it.)`] : [];
+    return ['Final checks:', ...lines, ...(checks.length > max ? [`and ${checks.length - max} more (data.checks)`] : []), ...pre];
+}
 const verifyTask = {
     name: 'verify_task',
     title: 'Verify a task after applying its change',
@@ -966,7 +1000,7 @@ const verifyTask = {
         '- page tasks: html = the rendered page HTML (before or after deploy; ≤ ~900 KB). Without it Checkbox fetches the live page.',
         '- Stripe tasks: stripe_checkout_session = exactly the object your code now passes to stripe.checkout.sessions.create.',
         '- email tasks: email = { subject, text and/or html } of the new template.',
-        'Result: verification status passed / failed (with a diff of expected vs observed) / pending (waiting for the confirming scan). Waits up to `wait` seconds. Then follow next_action (usually get_compliance_plan). A verification with checks still needs_review is reported as failed with next_action type needs_review: it is not done. "informational" checks are notes on Stripe\'s own layout: nothing to change.',
+        'Result: verification status passed / needs_review / failed (with a diff of expected vs observed) / pending (waiting for the confirming scan). Waits up to `wait` seconds. Then follow next_action (usually get_compliance_plan). Status needs_review: nothing failed, but a check is still undecided; it is not done: follow next_action. "informational" checks are notes on Stripe\'s own layout: nothing to change.',
     ].join('\n'),
     input: {
         task: z.string().max(100).describe('Task id (task_…).'),
@@ -1001,7 +1035,7 @@ const verifyTask = {
         return {
             headline: `Verification ${v.id} of ${String(args.task)}: ${statusLine(v.status)}${v.plan_status ? `; plan is now ${planStatusWords(v.plan_status, v.plan_status_label)}` : ''}.${v.checked ? ` Checked: ${untrusted(v.checked, 300)}.` : ''}`,
             notes: [
-                ...precheckLines(v.precheck),
+                ...verificationLines(v),
                 ...((v.status === 'failed' || v.status === 'not_checked') && v.next_action?.type === 'verify_domain'
                     ? ['The domain is not verified yet. Waiting for the human to publish the DNS record / file / meta tag or install the snippet; don\'t retry until they say it\'s done. Nothing to change in the code.']
                     : v.next_action?.type === 'retry_later'
@@ -1011,15 +1045,17 @@ const verifyTask = {
                                 [v.next_action.description ?? 'Checkbox Notices sends this email: nothing to add to your code. Continue with the next task.']
                             : v.next_action?.type === 'bcc_then_continue'
                                 ? ['The copy is checked; the task closes when the first real email arrives with the BCC. Add the BCC to your sending code and continue with the next task (no need to poll).']
-                                : v.status === 'failed'
-                                    ? ['The change did not satisfy the check: read diff (expected vs observed), fix the code, and call verify_task again.']
-                                    : v.status === 'not_checked'
-                                        ? ['Not checked yet: Checkbox is missing evidence (see next_action), not a code problem. Do not change the code for this; provide what next_action asks for.']
-                                        : v.status === 'pending_live_check'
-                                            ? ['Live check pending: the email content passes; Checkbox has not seen it sent for a real event yet. Nothing to change in the code: it completes on the first real send (or a proof run).']
-                                            : v.status === 'pending'
-                                                ? ['Waiting for a confirming observation; call get_verification later (or continue with other tasks).']
-                                                : []),
+                                : v.status === 'needs_review'
+                                    ? ['Nothing failed, but a check is still undecided: it is not done. Follow Next (it says what decides it).']
+                                    : v.status === 'failed'
+                                        ? ['The change did not satisfy the check: read diff (expected vs observed), fix the code, and call verify_task again.']
+                                        : v.status === 'not_checked'
+                                            ? ['Not checked yet: Checkbox is missing evidence (see next_action), not a code problem. Do not change the code for this; provide what next_action asks for.']
+                                            : v.status === 'pending_live_check'
+                                                ? ['Live check pending: the email content passes; Checkbox has not seen it sent for a real event yet. Nothing to change in the code: it completes on the first real send (or a proof run).']
+                                                : v.status === 'pending'
+                                                    ? ['Waiting for a confirming observation; call get_verification later (or continue with other tasks).']
+                                                    : []),
                 ...hint,
             ],
             data: v,
@@ -1076,7 +1112,7 @@ const getVerification = {
     annotations: { ...ro, title: 'Verification' },
     async run(args, { api }) {
         const v = await api.request('GET', `/v1/verifications/${enc(String(args.verification))}`, { query: { wait: args.wait ?? 0 } });
-        const notes = precheckLines(v.precheck);
+        const notes = verificationLines(v);
         return { headline: `Verification ${v.id}: ${statusLine(v.status)}.`, ...(notes.length ? { notes } : {}), data: v };
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkbox-site/mcp",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Checkbox MCP server: auto-renewal law and subscription compliance checks for AI agents (FTC ROSCA, California ARL, New York and other states) on Stripe Checkout params, pricing pages, disclosures and emails. Remote at https://app.checkbox.site/mcp, or local stdio.",
   "keywords": [
     "checkbox",
@@ -77,7 +77,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@checkbox-site/node": "^0.2.5",
+    "@checkbox-site/node": "^0.2.6",
     "@modelcontextprotocol/sdk": "^1.32.2",
     "zod": "^4.6.7"
   }