@dypai-ai/mcp 1.5.5 → 1.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dypai-ai/mcp",
-  "version": "1.5.5",
+  "version": "1.5.7",
   "description": "DYPAI MCP Server — AI agent toolkit for building and deploying full-stack apps",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -115,6 +115,7 @@ const REMOTE_TOOLS = [
   // ── Project ───────────────────────────────────────────────────────────────
   { name: "list_projects", description: "Lists all projects you have access to across your organizations. Returns project id, name, description, organization, subscription plan, and status. Use this as the first step to discover which projects are available, then pass project_id to other tools.", inputSchema: { type: "object", properties: { organization_id: { type: "string", description: "Optional. Filter projects by organization UUID." } }, required: [] } },
   { name: "get_project", description: "Gets detailed information about a specific project. Returns project name, description, organization, plan, status, engine URL, frontend slug, and timestamps.", inputSchema: { type: "object", properties: { project_id: { type: "string" } }, required: ["project_id"] } },
+  { name: "list_ai_models", description: "List only the DYPAI Managed AI models that are active for a project. Returns the project-gated OpenRouter model catalog, monthly included AI credits, monthly hard cap, RPM limit, max output tokens, active/available counts, and the exact node parameters to use. Call this before creating or editing an AI Agent node with DYPAI Managed models. Agents must not invent or use inactive model ids. Use provider='openrouter' and do NOT set credential_id; DYPAI uses the platform OpenRouter key and bills usage to the organization.", inputSchema: { type: "object", properties: { project_id: { type: "string", description: "Project UUID whose plan and Model Gateway settings determine the active Managed AI catalog." } }, required: ["project_id"] } },
   { name: "create_project", description: "Create a new DYPAI project (free plan). Creates a full project with database, engine, GitHub repo, and frontend hosting. BLOCKS by default until provisioning finishes (~60s typical, 120s max) — when it returns, the project_id is ready to use with execute_sql, endpoint tools, etc. Pass wait_until_ready:false for batch flows.\n\nName collision: if another project in the same org already uses the name (case-insensitive), returns {error:'name_taken', existing_project_id, suggestions:[...]}. Pick a different name or use the existing project.\n\nIMPORTANT: before calling, check for a matching template with `search_project_templates`. Passing a `template_slug` drops in a ready-made schema + endpoints + UI that cover 70% of common app types. Only create a blank project if nothing matches.", inputSchema: { type: "object", properties: { name: { type: "string", description: "Project name (e.g. 'My Veterinary App')" }, organization_id: { type: "string", description: "Optional. Uses default org if omitted." }, description: { type: "string" }, template_slug: { type: "string", description: "RECOMMENDED. Project template slug to start from (e.g. 'clinic', 'gym', 'waitlist', 'blank'). Always call search_project_templates first to find the best match." }, wait_until_ready: { type: "boolean", description: "If true (default), blocks until provisioning completes and the project is ready for all operations. If false, returns immediately with status='provisioning' — caller must poll get_project before using.", default: true } }, required: ["name"] } },
   { name: "get_app_credentials", description: "Lists available credentials in the current application. Returns API keys, anon key, service role key, and engine URL needed for SDK configuration.", inputSchema: { type: "object", properties: { project_id: { type: "string" } }, required: [] } },
 
@@ -353,7 +354,7 @@ Notes:
   // ── Triggers (Schedules + Webhooks) ──────────────────────────────────────
   // These tools OBSERVE + CONTROL trigger runtime state. The DEFINITION lives
   // in the endpoint YAML (`trigger.schedule` / `trigger.webhook`) — to change
-  // a cron expression or webhook path, edit the YAML and `dypai_push`.
+  // a cron expression or webhook path, edit the YAML and \`dypai_push\`.
   {
     name: "manage_schedules",
     description: `Observe + control cron schedules at runtime, by endpoint name.
@@ -562,35 +563,122 @@ A freshly created project has **zero** local files. The create response gives yo
 **Rule of thumb: if you can't \`Read\` it from disk, you can't touch it. Sync before you guess.**
 
 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-# TALKING TO THE USER — plain language, not tool names
+# TALKING TO THE USER — proactive, plain language, no internal machinery
 # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
-The user is **not a developer watching your tool calls**. They read only your prose. Never narrate actions by their technical name — translate every tool call into the real-world outcome.
+Assume most DYPAI users are non-technical. Many are not developers, do not know what an endpoint is, and should not need to learn DYPAI's internal workflow. The user should be able to say what they want in normal language; your job is to translate that into technical work, testing, and a guided path to publication.
+
+The user sees only TWO meaningful states:
+
+1. **Ready to test / listo para probar** — the change is available in their preview and does not affect real users.
+2. **Published / publicado** — the change is live for real users.
+
+Everything else is internal agent machinery. Do not make the user learn about \`dypai_push\`, drafts, overlays, workflow YAML, MCP tools, merge/publish mechanics, or endpoint staging unless they explicitly ask how it works under the hood.
+
+## Be proactive with non-technical users
+
+Do not wait for the user to know the next step. They often only know the outcome they want.
+
+When the user asks for a feature, bugfix, or change:
+
+1. Understand the desired product behavior.
+2. Choose a sensible implementation path.
+3. Make the change end-to-end when possible.
+4. If backend behavior changed, automatically save it to preview.
+5. Test what you can yourself.
+6. Give the user exactly one clear next action.
+7. Publish to production only after explicit approval.
+
+Never ask:
+
+- "Should I run dypai_push?"
+- "Should I push the endpoints?"
+- "Should I stage this draft?"
+- "Should I merge/publish the draft?"
+- "Should I call manage_drafts?"
+
+Say instead:
+
+- "Ya lo he dejado listo para que lo pruebes."
+- "Pruébalo en la previsualización."
+- "Todavía no afecta a tus usuarios reales."
+- "Cuando me digas que está bien, lo publico."
+- "¿Quieres que lo publique ya para tus usuarios?"
+
+## Internal workflow you MUST follow
+
+After changing backend behavior, ALWAYS make the change available in preview before telling the user to test it.
+
+Internally this means:
+
+1. edit backend files
+2. validate local backend changes
+3. save them to the preview environment
+4. test the preview version when practical
+5. then tell the user it is ready to try
+
+Never ask the user whether to run the internal save-to-preview step. It is safe, reversible, and required for the user to test the actual change.
+
+Publishing to production is different: it changes what real users see and ALWAYS needs explicit user approval.
+
+## If the user asks "how do I see it?"
+
+If the user asks "how do I see it?", "where do I test it?", "what now?", "pero como veo esto", or similar, do not explain backend states. Give the shortest practical next action in human terms.
+
+Good:
+
+- "Abre la previsualización y prueba crear un pedido."
+- "Ve al panel de administración y edita un producto."
+- "Prueba iniciar sesión con este usuario."
+- "Pulsa 'Crear producto'. Deberías ver el nuevo producto en la lista sin recargar."
+- "Dime si lo ves bien y lo publico."
+
+Bad:
+
+- "Está en el draft overlay."
+- "He hecho dypai_push."
+- "Falta manage_drafts publish."
+- "El endpoint está staged."
 
 ## Translation rule of thumb
 
-Replace the VERB with what the user perceives:
+Replace tool-speak with the outcome the user perceives:
 
 | Instead of (tool-speak) | Say (human) |
 |---|---|
-| "Voy a hacer dypai_push / I'll call dypai_push" | "Voy a subir los cambios al borrador para que los pruebes" |
-| "Voy a ejecutar manage_drafts(publish)" | "Voy a publicar los cambios en producción" |
+| "Voy a hacer dypai_push / I'll call dypai_push" | "Voy a dejar los cambios listos para que los pruebes" |
+| "He hecho dypai_push" | "Ya lo he dejado listo para probar" |
+| "Voy a ejecutar manage_drafts(publish)" | "Voy a publicarlo para tus usuarios" |
+| "He mergeado el draft" | "He publicado los cambios" |
 | "Ejecutando dypai_pull" | "Un momento, sincronizo tu proyecto" |
 | "Calling manage_frontend(deploy)" | "Voy a desplegar la nueva versión de tu web" |
 | "Running execute_sql to add a column" | "Voy a añadir un campo nuevo a la tabla X" |
 | "manage_database(operation:'apply_migration')" | "Voy a aplicar los cambios de estructura a la base de datos" |
 | "search_logs returned a 500" | "He mirado los registros: el error viene de..." |
 | "manage_drafts(list) shows 3 pending" | "Tienes 3 cambios pendientes de publicar" |
-| "On the draft overlay" / "en la overlay de draft" | "En tu entorno de previsualización" o "en el borrador" |
+| "On the draft overlay" / "en la overlay de draft" | "En tu entorno de previsualización" |
 | "dypai_validate rejected the workflow" | "Hay un problema con la configuración:" |
 
 ## Principles
 
-1. **State outcomes, not function calls.** The user cares about *"guardado"*, *"publicado"*, *"desplegado"*, *"probado"* — not *"pushed"*, *"dispatched"*, *"invalidated"*.
-2. **Draft vs live → borrador vs producción / previsualización vs en vivo.** Never say "overlay", "engine", "endpoint hit" in user-facing prose.
+1. **State outcomes, not function calls.** The user cares about *"listo para probar"*, *"publicado"*, *"desplegado"*, *"probado"* — not *"pushed"*, *"staged"*, *"invalidated"*, or *"merged"*.
+2. **Preview vs production → previsualización vs producción.** Prefer *"listo para probar"* and *"publicado"*. Avoid *"draft"*, *"borrador"*, *"mergear draft"*, *"overlay"*, *"engine"*, and *"endpoint hit"* in user-facing prose unless the user used those words first.
 3. **Errors: summarize, don't paste.** *"Falló porque estás comparando tipos distintos en la SQL"* beats pasting a Postgres stack.
-4. **Confirmations use real-world verbs.** *"¿Lo publico a producción?"* not *"¿Ejecuto manage_drafts(publish, confirm:true)?"*.
-5. **Progress updates in sentences, not tool names.** *"Primero guardo los cambios, luego te los muestro para que los pruebes, y si te cuadra los publicamos"* beats a 3-bullet list of tool calls.
+4. **Confirmations use real-world verbs.** *"¿Lo publico para tus usuarios?"* not *"¿Ejecuto manage_drafts(publish, confirm:true)?"*.
+5. **Progress updates in sentences, not tool names.** *"Estoy haciendo el cambio; cuando esté listo te digo exactamente dónde probarlo"* beats a bullet list of tool calls.
+6. **End every completed change with one practical next step.** Examples: *"Pruébalo en la previsualización"*, *"Dime si quieres que lo publique"*, *"Prueba hacer una compra con tarjeta de test"*.
+
+## Preferred user-facing phrases
+
+Use phrases like:
+
+- "Estoy haciendo el cambio."
+- "Ya lo he dejado listo para que lo pruebes."
+- "Abre la previsualización y prueba este flujo concreto: ..."
+- "Todavía no afecta a tus usuarios reales."
+- "Cuando me confirmes que está bien, lo publico."
+- "He revisado el error en los registros y viene de..."
+- "He actualizado la base de datos para añadir el nuevo campo."
 
 ## When you CAN mention a tool name
 

package/src/tools/proxy.js

@@ -16,6 +16,70 @@ const MCP_ENDPOINT = `${MCP_BASE}/mcp`
 
 let sessionId = null
 
+function extractLastSseData(text) {
+  const events = text.split(/\r?\n\r?\n/).filter(Boolean)
+  for (let i = events.length - 1; i >= 0; i--) {
+    const dataLines = events[i]
+      .split(/\r?\n/)
+      .filter((line) => line.startsWith("data:"))
+      .map((line) => line.replace(/^data:\s?/, ""))
+      .filter((line) => line && line !== "[DONE]")
+    if (dataLines.length) return dataLines.join("\n")
+  }
+  return null
+}
+
+function decodeTransportValue(value) {
+  let current = value
+  for (let i = 0; i < 5; i++) {
+    if (typeof current !== "string") return current
+    const trimmed = current.trim()
+    const sseData = extractLastSseData(trimmed)
+    const candidate = sseData || trimmed
+    try {
+      current = JSON.parse(candidate)
+    } catch {
+      return current
+    }
+  }
+  return current
+}
+
+function normalizeJsonRpcResponse(response) {
+  let current = decodeTransportValue(response)
+
+  for (let i = 0; i < 5; i++) {
+    if (!current || typeof current !== "object") return current
+
+    // Some HTTP/SSE transports get wrapped as { result: "<jsonrpc...>" } after
+    // a fallback parse path. Unwrap that so callers always see the real MCP
+    // JSON-RPC response instead of a stringified envelope.
+    if (
+      Object.keys(current).length === 1
+      && typeof current.result === "string"
+    ) {
+      const decoded = decodeTransportValue(current.result)
+      if (decoded !== current.result) {
+        current = decoded
+        continue
+      }
+    }
+
+    if (
+      current.result
+      && typeof current.result === "object"
+      && current.result.jsonrpc
+    ) {
+      current = current.result
+      continue
+    }
+
+    return current
+  }
+
+  return current
+}
+
 function mcpRequest(body) {
   const token = process.env.DYPAI_TOKEN || ""
 
@@ -50,18 +114,9 @@ function mcpRequest(body) {
       res.on("end", () => {
         if (res.statusCode >= 200 && res.statusCode < 300) {
           // Handle SSE responses (text/event-stream)
-          if (buf.includes("data: ")) {
-            const lines = buf.split("\n").filter(l => l.startsWith("data: "))
-            const lastData = lines[lines.length - 1]
-            if (lastData) {
-              try {
-                resolve(JSON.parse(lastData.replace("data: ", "")))
-              } catch {
-                resolve({ result: buf })
-              }
-            } else {
-              resolve({ result: buf })
-            }
+          const sseData = extractLastSseData(buf)
+          if (sseData) {
+            try { resolve(JSON.parse(sseData)) } catch { resolve({ result: sseData }) }
           } else {
             try { resolve(JSON.parse(buf)) } catch { resolve({ result: buf }) }
           }
@@ -116,7 +171,7 @@ async function ensureInitialized() {
 export async function proxyToolCall(toolName, args) {
   await ensureInitialized()
 
-  const response = await mcpRequest({
+  const response = normalizeJsonRpcResponse(await mcpRequest({
     jsonrpc: "2.0",
     id: `proxy-${Date.now()}`,
     method: "tools/call",
@@ -124,7 +179,7 @@ export async function proxyToolCall(toolName, args) {
       name: toolName,
       arguments: args || {},
     },
-  })
+  }))
 
   // Extract result from JSON-RPC response
   if (response.result) {
@@ -137,7 +192,7 @@ export async function proxyToolCall(toolName, args) {
 
     if (text != null) {
       let parsed
-      try { parsed = JSON.parse(text) } catch { parsed = text }
+      parsed = decodeTransportValue(text)
       // Some remote errors come as a plain string without isError flag
       if (typeof parsed === "string" && /^(Error:|Input validation error:|You don't have)/i.test(parsed)) {
         throw new Error(parsed)