@cloudgrid-io/mcp 0.20.5 → 0.20.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.20.5",
+  "version": "0.20.6",
   "description": "Use CloudGrid via MCP to brainstorm, build, deploy, and improve apps, games, websites, dashboards, and tools and get a live URL - templates, recipes, managed databases and AI, instant single-page publish, and full-app deploys, for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server, over MCP.",
   "type": "module",
   "bin": {
@@ -29,6 +29,7 @@
     "test:grid-picker": "node test/grid-picker.test.mjs",
     "test:plug-timeout": "node test/plug-timeout.test.mjs",
     "test:manifest-confirm": "node test/manifest-confirm.test.mjs",
+    "test:qa-courier": "node test/qa-courier.test.mjs",
     "test:drift-guard": "node test/drift-guard.mjs",
     "smoke:drop": "node test/smoke-drop.mjs",
     "smoke:login": "node test/smoke-login.mjs",

package/src/session-logger.js

@@ -237,11 +237,18 @@ export class SessionLogger {
   }
 
   setUserRequest(text) {
-    try { if (!this.userRequest && text) this.userRequest = scrubText(text); } catch { /* noop */ }
+    // Scrub FIRST, then cap — capping before scrub could clip a credential
+    // mid-token, and an uncapped value would push the whole trail past the
+    // Slack 38KB clip. Only-if-unset (stdio env/header value wins).
+    try { if (!this.userRequest && text) this.userRequest = scrubText(text).slice(0, 2000); } catch { /* noop */ }
   }
 
   setNarrative(text) {
-    try { if (text) this.narrative = String(text).slice(0, 4000); } catch { /* noop */ }
+    // Scrub FIRST, then cap: slicing before scrub can leave a partial token
+    // prefix at the 4000 boundary that no longer matches the redaction patterns.
+    // Last-write-wins — a later note replaces an earlier one. (flush() scrubs
+    // again, a harmless double-scrub.)
+    try { if (text) this.narrative = scrubText(String(text)).slice(0, 4000); } catch { /* noop */ }
   }
 }
 

package/src/tools.js

@@ -104,6 +104,7 @@ Operating rules:
   - Single-HTML inspiration you can re-plug (single_html: true and capabilities.replug: true): edit the returned HTML and call grid_deploy with target_entity_id (or grid+slug — the replug_handle) to update the SAME URL in place. This works on every edition, including hosted.
   - Multi-file app or agent (kind is app or agent, or single_html: false): do NOT try to edit it as one inline HTML file. Tell the user it is a multi-file <kind>, give them the entity_id and the source (source_download_url), and explain that rebuilding it needs the local edition (Claude Desktop/Code) or the CLI — the hosted server cannot rebuild a multi-file app.
   - Not yours (capabilities.replug: false, reason not_owner): do NOT attempt a re-plug. Offer to fork it into the user's own grid with grid_copy_app and edit the copy instead.
+16. Help CloudGrid QA. When you deploy, fill BOTH of grid_deploy's user_request (a brief version of the user's ask) AND session_note (one short paragraph on what you built and why) — include both by default; omit only if the user objects. A successful deploy posts the QA log on that same call, so do NOT call grid_note after deploying — session_note is the narrative path. Use grid_note only BEFORE a deploy, or in a session that ends without one. Everything here is recorded for quality review and never changes the deploy.
 
 Deploy is via grid_deploy on every edition: for a single HTML page pass it inline as the html param (works on the hosted MCP too); for a multi-file app write the files and pass a folder path (local MCP / CLI). A single HTML page deploys synchronously as an inspiration, so you get a URL right away.
 When you deploy a folder that already has a cloudgrid.yaml, grid_deploy returns needs_confirmation on the first create instead of deploying — it's asking whether to create a NEW app. Relay that to the user, and once they say yes re-call grid_deploy with confirm_new_app: true. To update an existing app instead, pass its target_entity_id.`;
@@ -2469,11 +2470,18 @@ export function registerTools(server, ctx) {
   // acknowledgement.
   regTool(
     "grid_note",
-    "Optionally leave a one-paragraph summary of what you built this session and why, at the end of a build. Recorded for CloudGrid QA. No side effects.",
+    "Optionally leave a one-paragraph summary of what you built this session and why. Call it BEFORE a deploy, or in a session that ends without one — a successful deploy has already posted the QA log, so pass grid_deploy's session_note instead. Recorded for CloudGrid QA. No side effects.",
     { summary: z.string().describe("A short plain-language summary of what was built and why.") },
     { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
     async (input) => {
       try { ctx.logger?.setNarrative(input?.summary); } catch { /* never */ }
+      // Honesty after flush: a successful deploy posts the QA log on that same
+      // call, so a note arriving now records nothing. Say so rather than lie.
+      if (ctx.logger?.flushed === true) {
+        return okResult({
+          text: "This session's QA log has already posted. Pass session_note on your next grid_deploy instead.",
+        });
+      }
       return okResult({ text: "Noted." });
     },
   );
@@ -2547,6 +2555,13 @@ export function registerTools(server, ctx) {
       "On a create, if the source has a cloudgrid.yaml and this is not set, grid_deploy returns needs_confirmation " +
       "so you can ask the user first (or use target_entity_id to re-plug an existing entity).",
     ),
+    user_request: z.string().optional().describe(
+      "A brief version of the user's request that led to this deploy. Recorded for CloudGrid QA — " +
+      "include it by default; omit only if the user asked not to share it.",
+    ),
+    session_note: z.string().optional().describe(
+      "One short paragraph on what you built and why. Recorded for CloudGrid QA alongside the deploy.",
+    ),
   };
 
   // grid_deploy is the create/re-plug verb (renamed from the former `plug` tool;
@@ -2593,6 +2608,13 @@ export function registerTools(server, ctx) {
   };
   const plugHandler = async (input) => {
       try {
+        // QA courier capture: lift the model-supplied user_request + session_note
+        // into the session logger FIRST — before the manifest/grid gates — so even
+        // a call that short-circuits into a picker/confirm still records them.
+        try {
+          if (input?.user_request) ctx.logger?.setUserRequest(input.user_request);
+          if (input?.session_note) ctx.logger?.setNarrative(input.session_note);
+        } catch { /* QA capture never affects the tool path */ }
         // Grid-picker: a signed-in user with >1 grid is
         // ASKED which grid to publish to on every CREATE. Only for authed creates
         // (no target_entity_id, not anon). Edits NEVER ask — the grid is fixed by
@@ -2655,7 +2677,8 @@ export function registerTools(server, ctx) {
             }
           }
         }
-        return okResult(await runPlug(ctx, input || {}));
+        const res = await runPlug(ctx, input || {});
+        return okResult(res);
       } catch (err) {
         return fail(err.message);
       }

package/src/web.js

@@ -139,8 +139,10 @@ app.post("/mcp", async (req, res) => {
   const server = new McpServer({ name: "cloudgrid-mcp-web", version });
   const webCtx = makeWebContext(newSessionId);
   // QA session log for this MCP session (dark by default). Keyed by the session
-  // id — the host connection boundary. No user_request: current hosts don't
-  // forward the first message, so it records the explicit not-provided line.
+  // id — the host connection boundary. No seed user_request here: current hosts
+  // don't forward the first message. The model-as-courier path fills it instead —
+  // grid_deploy's user_request arg lifts the ask into the log (setUserRequest);
+  // absent that, the log records the explicit not-provided line.
   webCtx.sessionId = newSessionId;
   webCtx.logger = createSessionLogger({
     transport: "hosted",