@dypai-ai/mcp 1.7.6 → 1.7.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dypai-ai/mcp",
-  "version": "1.7.6",
+  "version": "1.7.8",
   "description": "DYPAI MCP Server — AI agent toolkit for building and deploying full-stack apps",
   "type": "module",
   "main": "src/index.js",
@@ -9,6 +9,8 @@
   },
   "scripts": {
     "build": "node scripts/embed-prompts.mjs",
+    "test": "node --test test-*.js",
+    "test:integration": "RUN_DYPAI_INTEGRATION=1 node --test test-clinic-manager-smoke.js test-generate-types.js",
     "prepublishOnly": "npm run build"
   },
   "files": [

package/src/tools/deploy.js

@@ -98,6 +98,16 @@ const BLOCKED = new Set([
 
 const ROOT_CONFIG_RE = /^(package\.json|package-lock\.json|pnpm-lock\.yaml|bun\.lockb|yarn\.lock|vite\.config|vitest\.config|tsconfig|tailwind\.config|postcss\.config|next\.config|vinext\.config|astro\.config|nuxt\.config|svelte\.config|remix\.config|gatsby-config|angular\.json|docusaurus\.config|wrangler\.toml|wrangler\.json|vercel\.json|netlify\.toml|turbo\.json|components\.json|uno\.config|eslint\.config|prettier\.config|jest\.config|playwright\.config|\.prettierrc|\.eslintrc|\.browserslistrc|\.nvmrc|\.node-version|index\.html)/
 
+const ROOT_DYPAI_FILES = new Set([
+  "dypai/schema.sql",
+  "dypai/realtime.yaml",
+  "dypai/dypai.config.yaml",
+  "dypai/capability-catalog.json",
+  "dypai/capability-brief.md",
+  "dypai/node-catalog.json",
+  "dypai/README.md",
+])
+
 // ─── Helpers ────────────────────────────────────────────────────────────────
 
 function extOf(entry) {
@@ -203,12 +213,16 @@ function isAllowedRootDypaiSourcePath(path) {
   if (!path.startsWith("dypai/")) return true
   if (
     path.startsWith("dypai/flows/")
+    || path.startsWith("dypai/automations/")
     || path.startsWith("dypai/endpoints/")
     || path.startsWith("dypai/migrations/")
+    || path.startsWith("dypai/prompts/")
+    || path.startsWith("dypai/code/")
+    || path.startsWith("dypai/sql/")
     || path.startsWith("dypai/types/")
     || path.startsWith("dypai/lib/")
   ) return true
-  return path === "dypai/schema.sql" || path === "dypai/realtime.yaml"
+  return ROOT_DYPAI_FILES.has(path)
 }
 
 function isSkippedRootDypaiDirectory(path) {

package/src/tools/sync/endpoint-names.js

@@ -27,3 +27,20 @@ export function findEndpointNameCollisions(endpointsOrNames) {
     .filter((item) => item.endpoints.length > 1)
     .sort((a, b) => a.canonical_name.localeCompare(b.canonical_name))
 }
+
+/**
+ * Return only the non-canonical aliases from underscore/hyphen collision pairs.
+ *
+ * A name is considered a legacy alias only when the exact canonical hyphen
+ * slug also exists. This deliberately avoids guessing when a project only has
+ * underscore names, or when two unusual aliases normalize to a slug that does
+ * not exist remotely.
+ */
+export function findLegacyAliasEndpointNames(endpointsOrNames) {
+  return findEndpointNameCollisions(endpointsOrNames)
+    .filter((collision) => collision.endpoints.includes(collision.canonical_name))
+    .flatMap((collision) => collision.endpoints
+      .filter((name) => name !== collision.canonical_name)
+      .map((name) => ({ name, canonical_name: collision.canonical_name })))
+    .sort((a, b) => a.name.localeCompare(b.name))
+}

package/src/tools/sync/pull.js

@@ -12,7 +12,7 @@
  *   - .dypai/state.json   — per-endpoint updated_at for conflict detection on push
  */
 
-import { writeFile, mkdir, rm, access, readFile } from "fs/promises"
+import { writeFile, mkdir, rm, access, readFile, readdir } from "fs/promises"
 import { existsSync } from "fs"
 import { join, resolve as resolvePath, dirname, isAbsolute, delimiter, sep } from "path"
 import { homedir } from "os"
@@ -21,7 +21,7 @@ import { proxyToolCall } from "../proxy.js"
 import { api } from "../../api.js"
 import { serializeEndpoint } from "./codec.js"
 import { dumpPublicSchema } from "./schema-dump.js"
-import { findEndpointNameCollisions } from "./endpoint-names.js"
+import { findEndpointNameCollisions, findLegacyAliasEndpointNames } from "./endpoint-names.js"
 // Codegen was removed from v1 — the agent reads dypai/schema.sql + endpoint YAMLs
 // directly instead of relying on auto-generated TS types. The codegen.js file
 // still lives on disk in case we resurface it later with a leaner design.
@@ -602,27 +602,34 @@ async function fetchPersistedFlowSources(projectId) {
 }
 
 /** Remove endpoint YAML files that would shadow or confuse a Flow-authored endpoint. */
-async function removeEndpointYamlFiles(outDir, name, groupName = null) {
-  const candidates = [
-    join(outDir, "endpoints", `${name}.yaml`),
-    join(outDir, "endpoints", `${name}.yml`),
-    join(outDir, "endpoints", `${name}.yaml.disabled`),
-    join(outDir, "endpoints", `${name}.yml.disabled`),
-  ]
-  if (groupName) {
-    candidates.push(
-      join(outDir, "endpoints", groupName, `${name}.yaml`),
-      join(outDir, "endpoints", groupName, `${name}.yml`),
-      join(outDir, "endpoints", groupName, `${name}.yaml.disabled`),
-      join(outDir, "endpoints", groupName, `${name}.yml.disabled`),
-    )
-  }
+async function removeEndpointYamlFiles(outDir, name) {
+  const targetNames = new Set([
+    `${name}.yaml`,
+    `${name}.yml`,
+    `${name}.yaml.disabled`,
+    `${name}.yml.disabled`,
+  ])
   const removed = []
-  for (const filePath of candidates) {
-    if (!existsSync(filePath)) continue
-    await rm(filePath, { force: true })
-    removed.push(filePath.slice(outDir.length + 1))
+
+  async function walk(dir) {
+    let entries
+    try {
+      entries = await readdir(dir, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const entry of entries) {
+      const filePath = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        await walk(filePath)
+      } else if (targetNames.has(entry.name)) {
+        await rm(filePath, { force: true })
+        removed.push(filePath.slice(outDir.length + 1))
+      }
+    }
   }
+
+  await walk(join(outDir, "endpoints"))
   return removed
 }
 
@@ -870,6 +877,7 @@ export const dypaiPullTool = {
     const filesWritten = []
     const errors = []
     const sourceRecoveryWarnings = []
+    const ignoredLegacyAliases = []
 
     const capabilityGroups = capabilityCatalogResult?.groups || []
     const capabilityDoc = {
@@ -897,11 +905,16 @@ export const dypaiPullTool = {
       endpointIdToName: Object.fromEntries(endpoints.map(e => [e.id, e.name])),
     }
 
-    const flowAuthoredEndpoints = endpoints.filter(raw => {
+    const endpointNameCollisions = findEndpointNameCollisions(endpoints)
+    const legacyAliasByName = new Map(
+      findLegacyAliasEndpointNames(endpoints).map((item) => [item.name, item]),
+    )
+
+    const editableSourceEndpoints = endpoints.filter(raw => {
       const source = parseMaybeJson(raw.workflow_source)
-      return isFlowTsSource(source)
+      return isEditableTsSource(source)
     })
-    const persistedFlowSources = flowAuthoredEndpoints.length
+    const persistedFlowSources = editableSourceEndpoints.length
       ? await fetchPersistedFlowSources(project_id)
       : { byPath: new Map(), ref: null, error: null }
 
@@ -944,6 +957,24 @@ export const dypaiPullTool = {
       row.workflow = parseMaybeJson(row.workflow)
       row.workflow_source = parseMaybeJson(row.workflow_source)
       try {
+        const legacyAlias = legacyAliasByName.get(row.name)
+        if (legacyAlias && !live_authoritative) {
+          const removedYaml = await removeEndpointYamlFiles(outDir, row.name)
+          if (removedYaml.length) filesWritten.push(...removedYaml.map(p => `(removed ${p})`))
+          ignoredLegacyAliases.push({
+            endpoint: row.name,
+            canonical_endpoint: legacyAlias.canonical_name,
+            id: row.id,
+            revision: row.revision,
+            updated_at: row.updated_at,
+          })
+          // The live alias remains intentionally remote-only. Recording it in
+          // state.json keeps conflict metadata fresh without making it an
+          // editable local endpoint that a later push could overwrite.
+          successfullyPulled.add(row.id)
+          continue
+        }
+
         const workflowSource = row.workflow_source
         if (isEditableTsSource(workflowSource) && !live_authoritative) {
           const groupName = row.group_id ? (mapsCtx.groupIdToName[row.group_id] || null) : null
@@ -955,9 +986,10 @@ export const dypaiPullTool = {
           const removedYaml = await removeEndpointYamlFiles(outDir, row.name, groupName)
           if (removedYaml.length) filesWritten.push(...removedYaml.map(p => `(removed ${p})`))
 
+          const flowPath = join(outDir, relFlowPath)
+          const existingFlowContent = await readUtf8IfExists(flowPath)
+
           if (flowContent != null) {
-            const flowPath = join(outDir, relFlowPath)
-            const existingFlowContent = await readUtf8IfExists(flowPath)
             const writeDecision = classifyFlowSourceWrite({
               existingContent: existingFlowContent,
               remoteContent: flowContent,
@@ -991,6 +1023,26 @@ export const dypaiPullTool = {
             continue
           }
 
+          if (existingFlowContent != null) {
+            keptLocalEndpoints.push({
+              endpoint: row.name,
+              id: row.id,
+              remote_updated_at: row.updated_at,
+              remote_revision: row.revision,
+              file: relFlowPath,
+              reason: "persisted_source_missing_local_source_preserved",
+            })
+            sourceRecoveryWarnings.push({
+              endpoint: row.name,
+              source_file: sourceFile,
+              recovered_as: "existing_local_typescript",
+              warning:
+                `Endpoint is source-authored but ${sourceFile} was not returned by persisted project source. ` +
+                "Kept the existing local TypeScript source and did not create a duplicate legacy YAML endpoint.",
+            })
+            continue
+          }
+
           // The editable TS source has been lost, but live still contains the
           // complete executable workflow. Recover it as legacy YAML so a live
           // repair pull remains complete and its state baseline stays honest.
@@ -1129,8 +1181,6 @@ export const dypaiPullTool = {
     const inactiveEndpoints = (endpoints || [])
       .filter(e => e.is_active === false)
       .map(e => e.name)
-    const endpointNameCollisions = findEndpointNameCollisions(endpoints)
-
     // `environment` is an internal flag we still surface in `overview.project`
     // for diagnostics / dashboard parity, but the agent-facing copy uses the
     // universal "drafts → publish" vocabulary regardless of the value.
@@ -1210,6 +1260,13 @@ export const dypaiPullTool = {
     }
 
     const safetyWarnings = [
+      ...(ignoredLegacyAliases.length ? [{
+        type: "legacy_endpoint_aliases_kept_remote_only",
+        count: ignoredLegacyAliases.length,
+        aliases: ignoredLegacyAliases.slice(0, 50),
+        truncated: ignoredLegacyAliases.length > 50,
+        hint: "Canonical hyphen endpoints are editable locally. Legacy underscore aliases remain live for compatibility but are not materialized as active YAML, so pull/validate/push cannot overwrite them accidentally.",
+      }] : []),
       ...(endpointNameCollisions.length ? [{
         type: "canonical_endpoint_name_collisions",
         count: endpointNameCollisions.length,
@@ -1229,6 +1286,7 @@ export const dypaiPullTool = {
       files_kept_local: keptLocalEndpoints.length,
       kept_local_endpoints: keptLocalEndpoints.length ? keptLocalEndpoints : undefined,
       source_recovery_warnings: sourceRecoveryWarnings.length ? sourceRecoveryWarnings : undefined,
+      ignored_legacy_aliases: ignoredLegacyAliases.length ? ignoredLegacyAliases : undefined,
       name_collisions: endpointNameCollisions.length,
       output_dir: outDir,
       out_dir_resolved_via: outDirSource,