@edda-business/mcp 0.72.0 → 0.74.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edda-business/mcp",
-  "version": "0.72.0",
+  "version": "0.74.0",
   "description": "Edda — the company data layer for AI agents.",
   "license": "Apache-2.0",
   "publishConfig": {

package/src/server.js

@@ -66,22 +66,40 @@ async function resolvePathToId(path) {
   const base = norm(segs[segs.length - 1] ?? "");
   const folderSegs = segs.length > 1 ? segs.slice(0, -1).map(norm) : null;
   let cands = pages.filter((p) => norm(p.name) === base);
-  // EDDA-91: a folder-qualified request MUST honour its folder. The old basename-only match
-  // silently substituted an unrelated same-named page from the caller's visible scope when the
-  // requested folder was out of scope (or misspelled) — an exact read must return THAT document
-  // or a truthful unavailable, never masquerade. The message deliberately does not reveal
-  // whether the path exists for someone else.
+
+  // EDDA-91: a folder-qualified request MUST honour its folder. A basename-only match silently
+  // substituted an unrelated same-named page — an exact read returns THAT document or a truthful
+  // unavailable, never a masquerade.
+  //
+  // EDDA-151: it must honour the WHOLE folder path. The previous check asked only whether the
+  // page's leaf folder name appeared somewhere among the requested segments, so
+  // `AION/Context/_context` matched every project's `Context/_context.md` — six indistinguishable
+  // candidates, and the agent opening unrelated projects to find the one it asked for. Match
+  // against the page's full path (now returned by /pages) as a trailing sequence of segments, so
+  // `AION/Context/_context` matches `Projects/AION/Context/_context.md` and nothing else.
   if (folderSegs) {
-    cands = cands.filter((p) => p.folder && folderSegs.includes(norm(p.folder)));
+    const wanted = segs.map(norm);
+    const scored = cands.map((p) => {
+      const full = String(p.path || [p.folder, p.name].filter(Boolean).join("/")).split("/").map(norm);
+      // strip the extension from the final segment for comparison
+      const tail = full.slice(-wanted.length);
+      const exact = tail.length === wanted.length && tail.every((seg, i) => seg === wanted[i]);
+      return { p, exact };
+    });
+    const exact = scored.filter((x) => x.exact).map((x) => x.p);
+    // Fall back to the old leaf-name behaviour only when nothing matches the full path, so a
+    // legacy flat row (no folder tree) still resolves.
+    cands = exact.length ? exact : cands.filter((p) => !p.path && p.folder && folderSegs.includes(norm(p.folder)));
   }
+
   if (!cands.length) {
     return { error: folderSegs
       ? `"${String(path)}" is not available here — it either does not exist or is outside what this seat can read. Use search to see what you can access.`
       : `No company page named "${String(path).split("/").pop()}". Use search to find the exact path first.` };
   }
   if (cands.length > 1) {
-    const opts = cands.map((p) => `  • ${[p.folder, p.name].filter(Boolean).join("/")}  (id: ${p.id})`).join("\n");
-    return { error: `Several pages match "${base}". Pass one of these ids as \`id\`:\n${opts}` };
+    const opts = cands.map((p) => `  • ${p.path || [p.folder, p.name].filter(Boolean).join("/")}  (id: ${p.id})`).join("\n");
+    return { error: `Several pages match "${String(path)}". Pass one of these ids as \`id\`:\n${opts}` };
   }
   return { id: cands[0].id };
 }
@@ -110,6 +128,28 @@ async function uploadLocalFile(filePath, { sourceId } = {}) {
   return { originalId: r?.original?.id ?? null, name, sha256, bytes: r?.original?.byte_size ?? bytes.length };
 }
 
+// A submit-only seat has no `inbox` tool, so the submit response is the ONLY place it can learn
+// what happened to anything it sent. Render it there or the loop never closes.
+function loopLines(r) {
+  const out = [];
+  const d = r?.recent_decisions;
+  if (d && d.total) {
+    const bits = [];
+    if (d.filed) bits.push(`${d.filed} filed`);
+    if (d.rejected) bits.push(`${d.rejected} rejected`);
+    out.push("", `Since ${String(d.since).slice(0, 10)}, of what you sent: ${bits.join(", ") || `${d.total} decided`}.`);
+    for (const e of d.examples ?? []) {
+      out.push(e.status === "rejected"
+        ? `  ✗ ${e.name} — rejected${e.reason ? ` — ${e.reason}` : " (no reason given)"}`
+        : `  ✓ ${e.name} → ${e.location}`);
+    }
+  }
+  if (typeof r?.pending_mine === "number" && r.pending_mine > 0) {
+    out.push(`${r.pending_mine} of your submissions ${r.pending_mine === 1 ? "is" : "are"} still waiting for review.`);
+  }
+  return out;
+}
+
 export function createServer() {
   // EfB seat boundary: with EDDA_MCP_READONLY set (the flag Hermes EfB box profiles use),
   // the personal agent gets EXACTLY search + read — the write tools (push/update/create) are
@@ -142,7 +182,9 @@ export function createServer() {
     "connected sources (Slack, HubSpot, Stripe, calls). This is the default retrieval tool: reach " +
     "for it before answering from generic knowledge about how the company works or what happened. " +
     "Each hit is tagged [company] (a wiki page) or [company·distilled] (from activity), with a " +
-    "snippet; wiki hits include a `path:` you can pass to read for the full text. " +
+    "snippet. A [company] hit carries an `id:` — pass THAT to read, it opens exactly the document " +
+    "you found. The `path:` is shown for context; prefer the id. Every hit returned is one you " +
+    "can actually open. " +
     "Narrow with `kind`: 'documents' (wiki only), 'distilled' (activity only), or 'all' (default).",
     {
       question: z.string().describe("Natural-language query."),
@@ -185,8 +227,13 @@ export function createServer() {
         const tag = declared ? "[company]" : "[company·distilled]";
         const from = d.source_member ? ` · from ${d.source_member}` : "";
         lines.push(`${tag} ${String(d.name ?? "").replace(/\.md$/, "")}${from}  (${pct(d.similarity)})`);
-        if (declared && d.ref) lines.push(`  path: ${d.ref}`);          // pass to read
-        else if (d.ref) lines.push(`  source: ${d.ref}`);              // distilled: origin, read-only
+        // EDDA-151: the ID is what reliably opens the document. The API always returned it and
+        // this tool never printed it, so the agent had to go back through a path — and a path
+        // built from the leaf folder name could not tell one project's `Context/_context.md` from
+        // another's. Print the id first and say plainly that it is the thing to use.
+        if (declared && d.id) lines.push(`  id: ${d.id}   ← pass this to read`);
+        if (declared && d.ref) lines.push(`  path: ${d.ref}`);
+        else if (!declared && d.ref) lines.push(`  source: ${d.ref}`);   // distilled: origin, read-only
         if (d.snippet) lines.push(`  ${d.snippet}`);
         lines.push("");
       }
@@ -201,8 +248,9 @@ export function createServer() {
   server.tool(
     "read",
     "Read the FULL text of one company wiki page — search returns snippets; use this to " +
-    "get the whole document. Pass the `path:` shown under a [company] search hit (e.g. " +
-    "'Company/Policies/Refund Policy.md'), or an `id` if you already have one. Also returns the " +
+    "get the whole document. PREFER the `id:` from a [company] search hit — it opens exactly that " +
+    "document with no ambiguity. A `path` also works, but pass the FULL project-qualified path as " +
+    "search printed it (e.g. 'Projects/AION/Context/_context.md'), not a fragment. Also returns the " +
     "page's LINK GRAPH — outgoing [[links]] and backlinks — so you can TRAVERSE the wiki to " +
     "complete the picture (read a linked page next, or see what references this one). Distilled " +
     "hits ([company·distilled]) aren't pages — their content is in the search snippet.",
@@ -362,10 +410,11 @@ export function createServer() {
         const n = Array.isArray(claims) ? claims.length : 0;
         // Say what is waiting, including the belief change — the person needs to know a claim is
         // pending a human decision, not quietly applied.
-        return text(
+        return text([
           `Staged "${name}" into the company Inbox (${rc?.location ?? "Inbox"}). The company will route it to the right folder on the next reconcile.`
           + (n ? `\n${n} proposed knowledge update${n === 1 ? "" : "s"} rides with it — shown in the review gate as a belief change and applied only on approval.` : ""),
-        );
+          ...loopLines(r),
+        ].join("\n"));
       } catch (e) {
         const msg = String(e?.message || e);
         if (msg.includes("read_only") || msg.includes("admins_only") || msg.includes("(403)")) return text("This seat is read-only on the company Edda, so it can search and read but not contribute. Ask an admin for a write role.");
@@ -443,6 +492,7 @@ export function createServer() {
           else if (rec.suggestion_dropped) lines.push(`  • ${rec.name} — staged; your suggested destination was dropped (not visible to you)`);
         }
         lines.push("", "They wait for a person to review and file them. Nothing has been placed in a project yet.");
+        lines.push(...loopLines(r));
         return text(lines.join("\n"));
       } catch (e) {
         const msg = String(e?.message || e);