@seldonframe/mcp 1.25.3 → 1.25.4

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@seldonframe/mcp",
-  "version": "1.25.3",
+  "version": "1.25.4",
+  "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.25.4: operator 'Today' snapshot widget + remaining polish. NEW: replaces the v1.25.3 gap (where SF agency operators saw 'Newly installed blocks') with an operator-actionable 'Today' overview at the top of /dashboard. Four cards: today's bookings (count + first 3 with time/name), unread customer-portal messages, deals stuck >5 days (closedAt IS NULL + updatedAt < 5d ago), bookings-this-week trend. Each card click-throughs to its source surface (/bookings, /contacts, /deals). Below the cards: 'Up next' list of today's first 3 bookings rendered as time/name/title rows. All queries scoped by session orgId; widget renders only for isOperatorSession. POLISH: SeldonChat (the SF AI assistant floating button) hidden for operator sessions — that's an SF-builder tool. Command palette items split by session type — operator sessions only see Dashboard/Contacts/Deals/Bookings + their contact + deal hits; non-operator sessions get the full SF palette including Soul Marketplace, Studio, Seldon It, Pages, Email, Settings, Recent Activity. NO migrations, NO new env vars. Backend redeploy required.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.25.3: operator dashboard polish — hide SF-meta / SF-developer surfaces for operator sessions. From first principles: an HVAC owner / dentist doesn't have a build-time, doesn't speak block / soul / BLOCK.md, doesn't manage multiple workspaces, doesn't get support from SF Discord (their agency Acme AI is their support). Hides from /dashboard for operator sessions: (1) 'For the best experience, use Seldon directly from Claude Code with our MCP + Skill' hint banner — SF developer-facing. (2) 'Create New Client OS' button in the welcome header — agency-only action. (3) 'Newly installed blocks' section entirely — build-time SF-meta surface with View Public Page / Open Admin buttons. (4) 'BLOCK.md view metadata' subtitle on Pipeline section — replaced with 'Drag deals between stages to update their status' for operator sessions. (5) 'Docs' link in topbar — points at SF developer docs. (6) HelpButton floating popover — Discord / SF docs / report-a-bug links. (7) 'Discord' / 'Help' link from sidebar (already trimmed in v1.25.1; v1.25.3 fully removes it from operator nav). The welcome heading copy switches from 'This is your calm workspace overview' to 'Here's what's happening at your workspace today' for operator sessions — grounding the page in their business rather than SF-meta workspace concept. Each gate threaded via isOperatorSession prop from /(dashboard)/layout.tsx → DashboardTopbar / Sidebar / dashboard/page.tsx. NO migrations, NO new env vars. Backend redeploy required. v1.25.4 candidate (deferred): replace the now-empty top section with an operator-actionable 'Today snapshot' widget — count of today's bookings, deals needing attention, unread messages.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.25.2: TWO HOTFIXES from the v1.25.1 production smoke. (1) Operator session now PRECEDES NextAuth in helpers.ts. Pre-1.25.2 getCurrentUser/getOrgId/requireAuth checked NextAuth first, then operator-portal as a fallback. Smoke surfaced 2026-05-07: a user with BOTH a stale NextAuth cookie (from a prior /signup attempt that hit the Verification error) AND a fresh operator-portal cookie was treated as a NextAuth user — full SF admin nav showed instead of the trimmed operator nav. v1.25.2 reorders: operator portal cookie wins when present + valid. Falls through to NextAuth → admin-token otherwise. Intent-based — clicking an operator magic link clearly means the user wants operator portal access. Same precedence applied across getCurrentUser, getOrgId, requireAuth. (2) Dashboard page org_members + organizations queries now gate on isOperatorPortalUserId. Pre-1.25.2 the dashboard page had its own org_members lookup `where userId = synthetic-id` that bypassed the v1.25.0 helpers' opCtx check, crashing with PostgreSQL 22P02 'invalid input syntax for type uuid' (the synthetic id `__sf_operator_portal__:<orgId>` isn't a valid uuid). v1.25.2 short-circuits: when isOperatorPortalUserId(user.id), membershipRows = [{ orgId }] (the operator's single workspace) instead of querying org_members, and directWorkspaceRows queries by organizations.id only (skipping the ownerId/parentUserId clauses that also crash). Defense-in-depth: lib/billing/orgs.ts's listManagedOrganizations + listManagedOrganizationsForUser now early-return [] when user.id doesn't match the UUID_SHAPE regex (8-4-4-4-12 hex). NO migrations, NO new env vars. Backend redeploy required.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.25.1: hotfix — operator-portal sessions on /dashboard see a TRIMMED nav (Dashboard / Contacts / Deals / Bookings + Help) instead of the full SF nav (Soul Marketplace, Pages, Email, Forms, Automations, Studio, Settings). Pre-1.25.1, v1.25.0 unlocked the admin dashboard for operator sessions but didn't gate the sidebar — operators could see + click into SF-internal pages they shouldn't. v1.25.1: Sidebar component takes new props isOperatorSession + agencyBrandName threaded from the (dashboard) layout. When isOperatorSession=true: nav groups become OVERVIEW (Dashboard) / CRM (Contacts/Deals/Bookings) / ACCOUNT (Help) — Soul Marketplace, Pages, Email, Forms, Automations, Studio, Settings hidden. When agencyBrandName is set (via getEffectiveBrandingForWorkspace), the sidebar's brand subtitle shows the agency name + 'Cypress & Pine HVAC's CRM' subtitle instead of the default 'SeldonFrame / Operating system for modern teams'. Defense-in-depth: hidden nav items are still ROUTABLE if the operator types the URL directly — v1.25.2 will add a server-side gate that 404s SF-internal routes for operator sessions. NO migrations, NO new env vars. Backend redeploy required.",