@rallycry/conveyor-mcp 5.0.6 → 5.0.8

package/dist/{chunk-77XLXIFP.js → chunk-L3AI3EU2.js}

@@ -789,6 +789,13 @@ var ConveyorConnection = class {
     if (tags?.length) payload.tags = tags;
     return this.call("confirmProjectFileUpload", payload, 3e4);
   }
+  deleteAttachment(taskId, fileId, projectId) {
+    return this.call("deleteProjectTaskFile", {
+      projectId: this.resolveProjectId(projectId),
+      taskId,
+      fileId
+    });
+  }
   // ── Releases ────────────────────────────────────────────────────────
   createRelease(taskIds, projectId) {
     return this.call(

package/dist/cli.js

@@ -4,7 +4,7 @@ import {
 } from "./chunk-5KU3QS6A.js";
 import {
   ConveyorConnection
-} from "./chunk-77XLXIFP.js";
+} from "./chunk-L3AI3EU2.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -72,14 +72,14 @@ function registerProjectTools(server2, conn2) {
 // src/tools/connection.ts
 import { z as z4 } from "zod";
 
-// ../shared/dist/chunk-6NPOGQPP.js
+// ../shared/dist/chunk-U3HGG5NX.js
 import { z as z2 } from "zod";
 var DEFAULT_SONNET_MODEL = "claude-sonnet-5";
-var DEFAULT_OPUS_MODEL = "claude-opus-5";
+var DEFAULT_OPUS_MODEL = "claude-opus-5-5";
 var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
 var FABLE_MODEL = "claude-fable-5-1";
 var PREVIOUS_SONNET_MODEL = "claude-sonnet-4-6";
-var PREVIOUS_OPUS_MODEL = "claude-opus-4-8";
+var PREVIOUS_OPUS_MODEL = "claude-opus-5";
 var PTY_STREAM_PORT_BASE = 7420;
 var PTY_STREAM_PORT_ATTEMPTS = 8;
 var PREVIEW_PORT_DENY_LIST = [
@@ -1057,11 +1057,18 @@ var subtasksContracts = [
   setTaskParentContract
 ];
 var mcpTaskIdOrSlug = f.string({ desc: "The task ID or slug" });
+var agentTaskIdOrSlug = f.optional(
+  f.string({
+    desc: "Omit for the current card; pass a parent, sibling, or any other card in this project (id or slug) to read its files instead."
+  })
+);
 var listTaskFilesContract = defineToolContract({
   name: "list_task_files",
   agent: {
-    description: "List all files attached to this task with metadata. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment.",
-    fields: {}
+    description: "List all files attached to this task with metadata. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment. Pass task_id to list another card's files in this project, for example the pack parent's source documents.",
+    fields: {
+      task_id: agentTaskIdOrSlug
+    }
   },
   mcp: {
     description: "List all files attached to a task with metadata (no contents \u2014 fast and small). Pass projectId to target a specific project; otherwise the configured default project is used. Use before fetching a specific file to see what is available and how large each is. For file contents use get_attachment.",
@@ -1074,13 +1081,14 @@ var listTaskFilesContract = defineToolContract({
 var getAttachmentContract = defineToolContract({
   name: "get_attachment",
   agent: {
-    description: "Fetch one task file's content plus metadata by file ID. Call list_task_files first to discover IDs and check sizes \u2014 large binaries may be truncated by the service's size limit.",
+    description: "Fetch one task file's content plus metadata by file ID. This is the way to read attachment bytes: a document `downloadUrl` (anything that is not an image or video) answers 404 without a signed-in project member's session, so do not curl or WebFetch it from the pod. Call list_task_files first to discover IDs and check sizes \u2014 large binaries may be truncated by the service's size limit. Pass task_id when the file is attached to another card in this project, such as the pack parent.",
     fields: {
-      fileId: f.string({ desc: "The file ID to retrieve" })
+      fileId: f.string({ desc: "The file ID to retrieve" }),
+      task_id: agentTaskIdOrSlug
     }
   },
   mcp: {
-    description: "Fetch one task file's content plus metadata by file ID (accepts task id or slug). Pass projectId to target a specific project; otherwise the configured default project is used. Images are returned as viewable image blocks. Large text files (logs, JSON) are returned in pages \u2014 use `offset`/`maxBytes` to read more, or fetch `downloadUrl` for the whole file. Call list_task_files first to discover IDs and sizes.",
+    description: "Fetch one task file's content plus metadata by file ID (accepts task id or slug). Pass projectId to target a specific project; otherwise the configured default project is used. Images are returned as viewable image blocks. Large text files (logs, JSON) are returned in pages \u2014 use `offset`/`maxBytes` to read more. This tool is the way to read bytes: a document `downloadUrl` (anything that is not an image or video) answers 404 unless the request carries a signed-in project member's session, so do not curl or fetch it. Call list_task_files first to discover IDs and sizes.",
     fields: {
       projectId: mcpProjectId,
       taskId: mcpTaskIdOrSlug,
@@ -1147,10 +1155,29 @@ var uploadAttachmentContract = defineToolContract({
     }
   }
 });
+var DELETE_ATTACHMENT_WARNING = "Permanent, with no trash and no undo (unlike drive_delete_file): the file and its bytes are gone, and the chat message that announced it keeps its text but loses the attachment. Use it to remove a superseded upload once its replacement is attached. `fileId` comes from list_task_files.";
+var deleteAttachmentContract = defineToolContract({
+  name: "delete_attachment",
+  agent: {
+    description: `Delete one attachment from this task. ${DELETE_ATTACHMENT_WARNING} A pod can only delete files on its own card.`,
+    fields: {
+      fileId: f.string({ desc: "The file ID to delete" })
+    }
+  },
+  mcp: {
+    description: `Delete one attachment from a task (accepts task id or slug). ${DELETE_ATTACHMENT_WARNING} Requires Moderate on the project, the same bar as the web Files delete button. Pass projectId to target a specific project; otherwise the configured default project is used.`,
+    fields: {
+      projectId: mcpProjectId,
+      taskId: mcpTaskIdOrSlug,
+      fileId: f.string({ desc: "The file ID to delete" })
+    }
+  }
+});
 var attachmentsContracts = [
   listTaskFilesContract,
   getAttachmentContract,
-  uploadAttachmentContract
+  uploadAttachmentContract,
+  deleteAttachmentContract
 ];
 var createSuggestionContract = defineToolContract({
   name: "create_suggestion",
@@ -1473,7 +1500,7 @@ var createPullRequestContract = defineToolContract({
     fields: {
       title: f.string({ desc: "The PR title" }),
       body: f.string({
-        desc: "The PR description/body in markdown. If the diff changes anything a user sees rendered, the body MUST show the visual proof inline, not just point at the card: upload the capture with upload_attachment, then embed the downloadUrl it returns under a '## Screenshots' heading (![caption](url) for images, [caption](url) for video). Attach to the card as well \u2014 the card is the durable home, the PR body is what the reviewer reads."
+        desc: "The PR description/body in markdown. If the diff changes anything a user sees rendered, the body MUST show the visual proof inline, not just point at the card: upload the capture with upload_attachment, then embed the downloadUrl it returns under a '## Screenshots' heading (![caption](url) for images, [caption](url) for video). Only image and video URLs belong in a PR body: a document downloadUrl (csv, pdf, md, \u2026) needs a signed-in project member and shows 404 to a reviewer on GitHub, so point at the card instead. Attach to the card as well \u2014 the card is the durable home, the PR body is what the reviewer reads."
       }),
       branch: f.optional(
         f.string({
@@ -3010,6 +3037,9 @@ var MIME_BY_EXT = {
   ".yaml": "application/yaml",
   ".yml": "application/yaml",
   ".pdf": "application/pdf",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
   ".zip": "application/zip",
   ".gz": "application/gzip",
   ".mp4": "video/mp4",
@@ -3031,9 +3061,9 @@ function buildTextContent(file, content) {
   const start = file.contentByteOffset ?? 0;
   const shown = Buffer.byteLength(content, "utf-8");
   const total = file.contentTotalBytes ?? shown;
-  const more = file.contentTruncated ? ` \u2014 showing bytes ${start}\u2013${start + shown} of ${total}; pass offset=${start + shown} for the next page, or fetch the full file at downloadUrl` : "";
+  const more = file.contentTruncated ? ` \u2014 showing bytes ${start}\u2013${start + shown} of ${total}; pass offset=${start + shown} for the next page` : "";
   const header = `${file.fileName ?? "file"} (${file.mimeType ?? "?"}, ${total} bytes)${more}
-${file.downloadUrl ? `downloadUrl: ${file.downloadUrl}
+${file.downloadUrl ? `downloadUrl (signed-in project members only; read bytes with this tool): ${file.downloadUrl}
 ` : ""}---
 `;
   return [{ type: "text", text: header + content }];
@@ -3159,10 +3189,24 @@ function registerSetFileTags(server2, conn2) {
     }
   );
 }
+function registerDeleteAttachment(server2, conn2) {
+  registerContractTool(server2, deleteAttachmentContract, async (params) => {
+    const result = await conn2.deleteAttachment(params.taskId, params.fileId, params.projectId);
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Deleted ${result.fileName} (${result.id}) permanently. Any chat message that announced it keeps its text without the attachment.`
+        }
+      ]
+    };
+  });
+}
 function registerAttachmentTools(server2, conn2) {
   registerListTaskFiles(server2, conn2);
   registerGetAttachment(server2, conn2);
   registerUploadAttachment(server2, conn2);
+  registerDeleteAttachment(server2, conn2);
   registerSetFileTags(server2, conn2);
 }
 
@@ -3701,6 +3745,35 @@ var DEFAULT_TASK_STATUS_COLOR_INT = Number.parseInt(DEFAULT_TASK_STATUS_COLOR.sl
 var MAX_FILE_SIZE_BYTES2 = 25 * 1024 * 1024;
 var MAX_FILE_TAGS2 = 5;
 var MAX_FILE_TAG_LENGTH = 100;
+var ALLOWED_FILE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "application/json",
+  "text/csv",
+  "text/plain",
+  "text/markdown",
+  "text/vnd.mermaid",
+  "application/pdf",
+  // Reports (conveyor-consensus and friends) are single-file, no-JS HTML. Safe
+  // to store because the DOWNLOAD route serves these under a sandbox CSP with
+  // an opaque origin — see SANDBOXED_MIME in services/file/routes.ts.
+  "text/html",
+  // Office documents: the OOXML trio only (legacy .doc/.xls/.ppt stay out).
+  // Served inline like PDFs; browsers download them and nothing renders
+  // in-origin, so they need no SANDBOXED_MIME entry.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+];
+var ALLOWED_FILE_ACCEPT = [
+  ...ALLOWED_FILE_MIME_TYPES,
+  // Extensions too: a mime-only `accept` filters the OS picker by its own mime
+  // registry, which greys out .md/.mmd (and Office files on a machine without
+  // Office) even though the upload would succeed.
+  ".png,.jpg,.jpeg,.gif,.webp,.json,.csv,.txt,.md,.mmd,.pdf,.html,.docx,.xlsx,.pptx"
+].join(",");
 var EMBED_THRESHOLD_IMAGES = 5 * 1024 * 1024;
 var EMBED_THRESHOLD_TEXT = 2 * 1024 * 1024;
 var IDLE_HEARTBEAT_MS = 90 * 1e3;
@@ -3896,9 +3969,15 @@ var GetChatMessagesRequestSchema = z32.object({
   taskId: z32.string().optional()
 });
 var GetTaskFilesRequestSchema = z32.object({
-  sessionId: z32.string()
+  sessionId: z32.string(),
+  taskId: z32.string().optional()
 });
 var GetTaskFileRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileId: z32.string(),
+  taskId: z32.string().optional()
+});
+var DeleteTaskFileRequestSchema = z32.object({
   sessionId: z32.string(),
   fileId: z32.string()
 });
@@ -4828,6 +4907,12 @@ var GetProjectAttachmentRequestSchema = z52.object({
   /** Max bytes of text content to return from `offset`. Server default applies. */
   maxBytes: z52.number().int().positive().optional()
 });
+var DeleteProjectTaskFileRequestSchema = z52.object({
+  projectId: z52.string(),
+  taskId: z52.string(),
+  fileId: z52.string(),
+  requestingUserId: z52.string().optional()
+});
 var RequestProjectFileUploadRequestSchema = z52.object({
   projectId: z52.string(),
   taskId: z52.string(),
@@ -5185,6 +5270,10 @@ var CancelDecisionRequestSchema = z102.object({
   /** Why it is being dropped. Posted to the decision thread. */
   reason: z102.string().max(DECISION_RESOLUTION_MAX).optional()
 });
+var BulkDecisionIdsRequestSchema = z102.object({
+  projectId: z102.string().cuid("Invalid project ID"),
+  decisionIds: z102.array(z102.string().cuid()).min(1).max(200)
+});
 var ReopenDecisionRequestSchema = z102.object({
   decisionId: decisionIdSchema,
   deadlineHours: z102.number().min(DECISION_DEADLINE_MIN_HOURS).max(DECISION_DEADLINE_MAX_HOURS).optional()
@@ -5449,8 +5538,8 @@ function anthropicEntry(model, label, inputPerMillion, outputPerMillion, opts =
   };
 }
 var ANTHROPIC_CATALOG = [
-  anthropicEntry(DEFAULT_OPUS_MODEL, "Opus 5 Latest", 5, 25),
-  anthropicEntry(PREVIOUS_OPUS_MODEL, "Opus 4.8", 5, 25),
+  anthropicEntry(DEFAULT_OPUS_MODEL, "Opus 5.5 Latest", 4, 20),
+  anthropicEntry(PREVIOUS_OPUS_MODEL, "Opus 5", 5, 25),
   anthropicEntry(DEFAULT_SONNET_MODEL, "Sonnet 5 Latest", 3, 15),
   anthropicEntry(PREVIOUS_SONNET_MODEL, "Sonnet 4.6", 3, 15),
   // The Haiku line (4.5 and older) predates the tuning surface and 400s on it.

package/dist/{connection-DeBZ_T6f.d.ts → connection-K8I1nT9o.d.ts}

@@ -1,5 +1,5 @@
 import { io, Socket } from 'socket.io-client';
-import { ListDriveFilesResponse, ReadDriveFileResponse, DriveFileDTO, DeleteDriveFileResponse, ProjectIntegrationsSummary, GaAnalyticsSummaryDTO, ProjectChannelDTO, ReadChannelMessagesResponse, PostChannelMessageResponse, CreateProjectDecisionRequest, CreateProjectDecisionResponse, ListProjectDecisionsRequest, ProjectDecisionRow, ProjectDecisionDetail, VoteProjectDecisionRequest, ResolveProjectDecisionRequest, UpdateProjectDecisionRequest, ListMeetingsResponse, MeetingForAgent, ReadMeetingTranscriptResponse, MeetingChecklistItemForAgent } from '@project/shared';
+import { ListDriveFilesResponse, ReadDriveFileResponse, DriveFileDTO, DeleteDriveFileResponse, ProjectIntegrationsSummary, GaAnalyticsSummaryDTO, ProjectChannelDTO, ReadChannelMessagesResponse, PostChannelMessageResponse, CreateProjectDecisionRequest, CreateProjectDecisionResponse, ListProjectDecisionsRequest, ProjectDecisionRow, ProjectDecisionDetail, VoteProjectDecisionRequest, ResolveProjectDecisionRequest, UpdateProjectDecisionRequest, ListMeetingsResponse, MeetingForAgent, ReadMeetingTranscriptResponse, MeetingChecklistItemForAgent, DeletedTaskFile } from '@project/shared';
 
 interface ConveyorMcpConfig {
     apiUrl: string;
@@ -818,6 +818,7 @@ declare class ConveyorConnection {
         appliedTags?: string[];
         unknownTags?: string[];
     }>;
+    deleteAttachment(taskId: string, fileId: string, projectId?: string): Promise<DeletedTaskFile>;
     createRelease(taskIds?: string[], projectId?: string): Promise<{
         taskId: string;
         version: string;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ActivePtySession, d as ConveyorConnection, e as ConveyorMcpConfig, P as PtyAttachSnapshot, c as PtyDataChunk } from './connection-DeBZ_T6f.js';
+export { A as ActivePtySession, d as ConveyorConnection, e as ConveyorMcpConfig, P as PtyAttachSnapshot, c as PtyDataChunk } from './connection-K8I1nT9o.js';
 export { AttachTunnelOptions, ResolvedPtySession, RunTunnelOptions, TunnelConnection, TunnelHandle, TunnelSession, TunnelTty, WaitForPtySessionOptions, attachTunnel, runTunnel, waitForPtySession } from './tunnel.js';
 import 'socket.io-client';
 import '@project/shared';

package/dist/index.js

@@ -5,7 +5,7 @@ import {
 } from "./chunk-HIVOGGE3.js";
 import {
   ConveyorConnection
-} from "./chunk-77XLXIFP.js";
+} from "./chunk-L3AI3EU2.js";
 export {
   ConveyorConnection,
   attachTunnel,

package/dist/tunnel-cli.js

@@ -7,7 +7,7 @@ import {
 } from "./chunk-5KU3QS6A.js";
 import {
   ConveyorConnection
-} from "./chunk-77XLXIFP.js";
+} from "./chunk-L3AI3EU2.js";
 
 // src/tunnel-cli.ts
 var HELP = `conveyor-tunnel \u2014 attach your local terminal to a cloud Claude Code session.

package/dist/tunnel.d.ts

@@ -1,4 +1,4 @@
-import { A as ActivePtySession, P as PtyAttachSnapshot, c as PtyDataChunk } from './connection-DeBZ_T6f.js';
+import { A as ActivePtySession, P as PtyAttachSnapshot, c as PtyDataChunk } from './connection-K8I1nT9o.js';
 import 'socket.io-client';
 import '@project/shared';
 

package/dist/wait-cli.js

@@ -4,7 +4,7 @@ import {
 } from "./chunk-5KU3QS6A.js";
 import {
   ConveyorConnection
-} from "./chunk-77XLXIFP.js";
+} from "./chunk-L3AI3EU2.js";
 import {
   runWait
 } from "./chunk-OPZL4NDT.js";

package/dist/wait-runner.d.ts

@@ -1,4 +1,4 @@
-import { C as CardCollectionPage, a as CardCollectionDelta } from './connection-DeBZ_T6f.js';
+import { C as CardCollectionPage, a as CardCollectionDelta } from './connection-K8I1nT9o.js';
 import { WaitFilter, WaitResult } from './wait.js';
 import 'socket.io-client';
 import '@project/shared';

package/dist/wait.d.ts

@@ -1,4 +1,4 @@
-import { b as CardCollectionItem } from './connection-DeBZ_T6f.js';
+import { b as CardCollectionItem } from './connection-K8I1nT9o.js';
 import 'socket.io-client';
 import '@project/shared';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-mcp",
-  "version": "5.0.6",
+  "version": "5.0.8",
   "description": "Conveyor MCP server for Claude Code PM integration",
   "keywords": [
     "claude",
@@ -45,6 +45,6 @@
     "@types/ws": "^8.18.1",
     "tsup": "^8.0.0",
     "typescript": "^5.3.0",
-    "vitest": "^4.0.17"
+    "vitest": "^5.0.1"
   }
 }