@kivimedia/kmhub 2.0.0 → 2.9.1

package/tools.mjs

@@ -26,11 +26,11 @@
  * wants one side of the workspace. `full` is the default and holds everything, so
  * an existing client sees no change.
  */
-import { readdirSync } from 'node:fs';
+import { readdirSync, readFileSync } from 'node:fs';
 import { z } from 'zod';
 
 export const SERVER_NAME = 'kmhub';
-export const SERVER_VERSION = '2.0.0';
+export const SERVER_VERSION = '2.9.1';
 
 export const DEFAULT_BASE =
   process.env.KMHUB_API_BASE ||
@@ -89,7 +89,15 @@ export function out(r) {
     lines.push(url ? `To pick things back up, open ${url} and restart the subscription.` : BILLING_FALLBACK);
     return { content: [{ type: 'text', text: lines.join('\n\n') }], isError: true };
   }
-  return { content: [{ type: 'text', text: JSON.stringify(r.data, null, 2) }], isError: !r.ok };
+  // The way back to the window (Freshdesk #271, Jackie): "I always have this problem
+  // of not getting back to the correct window using Claude and KM Hub once it is
+  // closed." A route that answers out of one page of the app says so in
+  // `open_in_km_hub`, and that line is appended in plain text rather than left buried
+  // in the JSON, so the model reliably shows her a link she can click twice.
+  const link = typeof body.open_in_km_hub === 'string' ? body.open_in_km_hub.trim() : '';
+  const json = JSON.stringify(r.data, null, 2);
+  const payload = link ? `${json}\n\nOpen in KM Hub: ${link}` : json;
+  return { content: [{ type: 'text', text: payload }], isError: !r.ok };
 }
 
 /** A plain prose answer. Defaults to a success result: not every "no" is an error. */
@@ -138,7 +146,8 @@ export function qs(params) {
 //                 A play's task calls tools from every family at once, so a run
 //                 started on a narrow profile fails halfway through, which is a
 //                 worse outcome than not offering the play.
-//   money     38  The money side, whole. The nine read-only money tools, plus crm
+//   money         The money side, whole. The read-only money tools, plus hr because
+//                 payroll is money owed to the people who did the work, plus crm
 //                 so you can open the client you are about to chase, plus knowledge
 //                 because the published ladder is the only legal source of a number.
 //   outreach  51  The cold outreach machine: outreach and sourcing, plus crm to turn
@@ -147,19 +156,28 @@ export function qs(params) {
 //                 saves the least of the three, and that is honest rather than
 //                 disappointing: the outreach job genuinely reaches most of the
 //                 workspace. `core` is the profile that buys real context back.
-//   full      63  Everything, including the plays. The default.
+//   content       The being-found side: SEO and the newsletter, plus crm and
+//                 knowledge, because content that does not know who buys or what
+//                 the business sounds like is generic content. This profile only
+//                 became real when the marketing family shipped (workstream B1);
+//                 before that the name existed in the installer and silently fell
+//                 back to `full`, which was a small lie told to anyone who used it.
+//   full          Everything, including the plays. The default.
+//   coach         Fully Booked Coach operations, client delivery, acquisition,
+//                 content requests, and approval previews. It exposes no send
+//                 or publish tool.
 //
-// There is deliberately no `content` profile. There are no content tools. An older
-// client that still asks for one gets `full` rather than an error, exactly as any
-// other unknown name does.
+// An unknown profile name still gets `full` rather than an error, exactly as before.
 
 export const DEFAULT_PROFILE = 'full';
 
 export const PROFILES = {
   core: ['core', 'meta', 'briefing'],
-  money: ['core', 'meta', 'briefing', 'crm', 'knowledge', 'money'],
-  outreach: ['core', 'meta', 'briefing', 'crm', 'calendar', 'knowledge', 'outreach', 'sourcing'],
+  money: ['core', 'meta', 'briefing', 'crm', 'knowledge', 'money', 'hr'],
+  outreach: ['core', 'meta', 'briefing', 'crm', 'calendar', 'knowledge', 'outreach', 'sourcing', 'marketing'],
+  content: ['core', 'meta', 'briefing', 'crm', 'knowledge', 'marketing'],
   full: '*',
+  coach: ['coach'],
 };
 
 /**
@@ -168,6 +186,10 @@ export const PROFILES = {
  * has to be named here on its own, because it is placed too and placed nowhere but
  * `full`: without this line its own ['*'] would put it back into all three.
  */
+// Coach is a public pilot surface with an explicit safety review. New families
+// must not silently join it through a wildcard declaration.
+const CLOSED_PROFILES = new Set(['coach']);
+
 const PLACED = new Set([...Object.values(PROFILES).filter(Array.isArray).flat(), 'plays']);
 
 export const PROFILE_NAMES = Object.keys(PROFILES);
@@ -256,6 +278,7 @@ function inProfile(family, profile) {
   const listed = PROFILES[profile];
   if (listed === '*') return true;
   if (Array.isArray(listed) && listed.includes(family.FAMILY)) return true;
+  if (CLOSED_PROFILES.has(profile)) return false;
   if (PLACED.has(family.FAMILY)) return false;
   return family.PROFILES.includes('*') || family.PROFILES.includes(profile);
 }
@@ -286,6 +309,41 @@ export const TOOL_NAMES = toolNamesFor(DEFAULT_PROFILE);
  * make the SDK throw mid-request and cost the caller every tool, not just the
  * clashing one. `raw` is there for the rare family that needs the real server.
  */
+/**
+ * The tools announced as read-only, from read-only-tools.json (generated from the tool
+ * source by scripts/generate-read-only-tools.mjs - see there for the rule).
+ *
+ * 🚨 CODEX STOPS EVERY UNANNOTATED TOOL FOR AN APPROVAL. With no hint on any KM Hub tool,
+ * a Codex session asked permission before `km_me`, and `codex exec` failed every call with
+ * "MCP tool call requires approval". readOnlyHint: true is what lets a read run. Writes stay
+ * unannotated on purpose, so the person still approves each one.
+ *
+ * A missing or broken file costs the hints, never the tools.
+ */
+const READ_ONLY_TOOLS = (() => {
+  try {
+    const doc = JSON.parse(readFileSync(new URL('./read-only-tools.json', import.meta.url), 'utf8'));
+    return new Set(Array.isArray(doc.tools) ? doc.tools : []);
+  } catch (e) {
+    warn(`read-only-tools.json could not be read (${String(e?.message || e)}). Every tool will be announced without a read-only hint.`);
+    return new Set();
+  }
+})();
+
+export function isReadOnlyTool(name) {
+  return READ_ONLY_TOOLS.has(name);
+}
+
+function markReadOnly(name, registeredTool) {
+  if (!registeredTool || !READ_ONLY_TOOLS.has(name) || typeof registeredTool.update !== 'function') return registeredTool;
+  try {
+    registeredTool.update({ annotations: { ...(registeredTool.annotations || {}), readOnlyHint: true } });
+  } catch (e) {
+    warn(`could not mark '${name}' read-only (${String(e?.message || e)}). It still works; hosts will ask before running it.`);
+  }
+  return registeredTool;
+}
+
 function guardedRegistrar(server, taken, family, registered) {
   const claim = (name) => {
     if (typeof name !== 'string' || !name.trim()) {
@@ -302,8 +360,8 @@ function guardedRegistrar(server, taken, family, registered) {
     return true;
   };
   return {
-    tool: (name, ...rest) => (claim(name) ? server.tool(name, ...rest) : undefined),
-    registerTool: (name, ...rest) => (claim(name) ? server.registerTool(name, ...rest) : undefined),
+    tool: (name, ...rest) => (claim(name) ? markReadOnly(name, server.tool(name, ...rest)) : undefined),
+    registerTool: (name, ...rest) => (claim(name) ? markReadOnly(name, server.registerTool(name, ...rest)) : undefined),
     prompt: (...args) => server.prompt(...args),
     resource: (...args) => server.resource(...args),
     raw: server,