@seldonframe/mcp 1.27.2 → 1.27.4

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "@seldonframe/mcp",
-  "version": "1.27.2",
+  "version": "1.27.4",
+  "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.27.4: UNIFIED SIGN-OUT HOTFIX (CRM-side; MCP package contents unchanged from 1.27.3 but version bumped for SemVer hygiene). PROBLEM: dashboard-topbar 'Log out' called next-auth's signOut() which only clears the NextAuth session-token cookie. SF has THREE simultaneous auth sources since v1.25.0: NextAuth + operator-portal cookie (sf_operator_session) + admin-token Bearer header. Per v1.25.2 precedence, the operator portal cookie resolves FIRST in lib/auth/helpers.ts. So signing out via NextAuth left sf_operator_session intact → next request resolved as operator portal → user appears stuck in operator-portal mode (trimmed sidebar: Customers / Jobs / Booking only) and can't see the full admin dashboard with Agents / Pages / Email / etc. SYMPTOM: Acme AI agency operator builds an agent for Cypress Pine HVAC via Claude Code, opens https://app.seldonframe.com/dashboard, sees the operator-trimmed view (their agency dashboard hidden), clicks Log out → POST /api/auth/signout returns 200 + redirect /login → next request still resolves the same operator portal user via the surviving sf_operator_session cookie. Loop. Diagnostic logs showed 'userId: __sf_operator_portal__:fa5ba418-... ' even after the signout response. FIX: new lib/auth/actions.signOutAllSessionsAction server action that clears BOTH cookies in one call (operator portal first since it precedes NextAuth in resolution order, then NextAuth via signOut({redirect:false}), then redirect to /login). Admin-token doesn't need clearing — it's a stateless server-side credential, never stored in cookies. Wired into dashboard-topbar.tsx replacing the next-auth/react signOut() call with a form action — works without JavaScript, no client-side state to manage. NO migrations, NO new env vars. Backend redeploy required (the topbar component change ships with the next Vercel deploy of main).",
+  "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.27.3: MCP PARSE HOTFIX — v1.27.1 + v1.27.2 published broken to npm because welcome.js had a JS syntax error from a bad Edit. ROOT CAUSE: my v1.27.1 Edit replaced only the PREFIX of the FIRST_CALL_BANNER assignment ('export const FIRST_CALL_BANNER = `🚀 SeldonFrame v1.18.1 is connected.') instead of the full multi-line statement. The replacement template literal closed properly with `;` at its end, but the OLD content (everything after 'is connected.' from v1.18.1) remained as orphaned text → 'export const FIRST_CALL_BANNER = `<new>`; PREFERRED workspace creation: ... `;' which fails to parse with 'Unexpected identifier workspace' because PREFERRED workspace are two bare identifiers. tsc didn't run on this file (it's plain .js), and 'npm publish' has no syntax check by default, so the broken package shipped. v1.27.2's republish carried the same bug because my edits touched only the version string, not the surrounding broken syntax. SYMPTOM: Claude Code 'Failed to reconnect to seldonframe' — the npx-spawned MCP server crashes immediately at module load. v1.27.0 worked fine (its version was the last clean one before this regression), but v1.27.0's published code still references the broken backend ops, so it's not a fully usable fallback. FIX: rewrote the FIRST_CALL_BANNER as a single clean statement (consolidated the v1.27.x capability map content + the legacy workspace flow tail into one string, no orphan tail). VERIFIED with `node --input-type=module -e \"import('./welcome.js')\"` — file now parses, VERSION + WELCOME_MARKDOWN + FIRST_CALL_BANNER all loadable. PREVENTION: new npm script `check:syntax` runs `node --check` on each .js file in src/, wired into `prepublishOnly`. `node --check` is AST-parse-only (no execution, no import resolution needed) so it runs in <100ms and catches this entire bug class — including the version-bump-while-leaving-orphan-tail mistake — before npm publish can ship a broken tarball. Antifragile to future Edit-tool fumbles. NO tool descriptions changed, NO welcome.js capability map content changed (the v1.27.1 doc upgrade still applies as intended once Claude Code can actually reach the file). Republish only.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.27.2: PRODUCTION HOTFIX — Vercel build has been failing since v1.26.2 because lib/agents/eval-runner.ts (a 'use server' Next.js Server Actions module) re-exported the constant PUBLISH_PASS_RATE_THRESHOLD with `export { PUBLISH_PASS_RATE_THRESHOLD };`. TypeScript's tsc --noEmit didn't flag this (server-action semantics aren't a tsc concern), but next build's page-data collection step rejects 'use server' modules that export anything other than async functions, with: `Error: A 'use server' file can only export async functions, found number.` MEANS production has been stuck on v1.26.1 for the past three ships — the new agent ops (run_evals, tail_conversations, get_conversation, replay_conversation, get_metrics) and the entire /agents dashboard surface (overview, settings, evals, sandbox, conversations) have NOT been deployable, and any operator hitting /agents in their browser would 404. ROOT CAUSE: I added the re-export thinking it was a convenience for store.ts publishAgent, but store.ts didn't actually need it (publishAgent uses summary.meetsPublishGate which is computed inside runEvalSuite). FIX: remove the offending line + add an explanatory comment so this doesn't recur. PREVENTION: new packages/crm/scripts/check-use-server.sh is a 60-line shell guard that scans every 'use server' file for `export const|let|var|{`-shaped exports. Wired into pnpm build so it runs BEFORE next build (fails in <1s with a clear message instead of wasting 45s of compile + page-data collection on Vercel). Catches the entire bug class going forward — antifragile to future server-action refactors. SWEPT all 46 'use server' files in packages/crm; eval-runner.ts was the only offender. NO MCP-tool changes (this is a backend-only hotfix), but I'm bumping the npm package version + republishing for SemVer hygiene so anyone on @seldonframe/mcp@latest is signaling that the BACKEND v1.26.2/v1.27.0/v1.27.1 features will start working as soon as Vercel deploys this commit. Backend redeploy required (the next push to main triggers it).",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.27.1: TOOL DISCOVERY DOC UPGRADE — Phase A of the Karpathy/antifragility refactor. PROBLEM v1.27.1 SOLVES: real-world dogfooding of v1.27.0 surfaced that Claude Code couldn't DISCOVER the agent tools we'd just shipped. Asked to 'create a chatbot for Cypress Pine HVAC and put it on the homepage,' Claude Code spent 33s + 7 tool calls inspecting list_blocks, find no chat-widget block type, and concluded 'SF doesn't expose a landing-page chatbot widget' — falling back to suggesting send_conversation_turn (the v1.18 SMS conversation primitive). The agent tools shipped in v1.26.x (configure_llm_provider, create_agent, publish_agent, list_agents, update_agent_blueprint) and v1.26.2 (run_agent_evals, tail_agent_conversations, get_agent_conversation, replay_conversation, get_agent_metrics) WERE there, just not surfaced through the noise of ~50 flat tools. WHY THIS HAPPENS: tools.js is 200KB+ flat catalog; welcome.js (the MCP `instructions` payload Claude Code reads as system context) was 309 lines all about the v1.18-era workspace creation flow with no mention of agents as a top-level primitive; tool descriptions described WHAT each tool does instead of WHEN to call it. PHILOSOPHY APPLIED — Karpathy 'LLM is the scheduler, don't compete with it': the antifragile fix is BETTER CONTEXT, not server-side keyword matchers. As Claude gets better, richer descriptions help more, not less. This contrasts with the originally-planned discover_tools server-side matcher (cut from Phase C — would compete with LLM judgment and DEGRADE as models improve). Thin harnesses + fat skills: harness = the 10 tool definitions, unchanged; skill = the prose descriptions + welcome.js capability map, dramatically expanded. WHAT SHIPS: (1) WELCOME.JS CAPABILITY MAP. New top-level table mapping operator-language ('add a chatbot to my website', 'reply to inbound SMS automatically', 'add hero/services/faq section') to the right SF primitive (AGENT, CONVERSATION, BLOCK) with the entry-point tool. CRITICAL ANTI-PATTERN section explicitly tells the LLM: chat widgets are NOT blocks — don't list_blocks looking for chat. WRONG path → RIGHT path side-by-side. Plus a 'canonical short flow — build a website chatbot' walkthrough showing the 5-call sequence (configure_llm_provider → create_agent → publish_agent test → operator sandbox-tests → publish_agent live). Plus the observability tool list with one-line summaries of when to call each. (2) FIRST_CALL_BANNER reorganized as a capability map first (a/b/c/d/e/f primitives with what-they-are summaries), chatbot canonical flow second, workspace flow third (legacy reference). The banner is what Claude Code shows on first use — anchoring it on capability decisions BEFORE workspace creation re-orients the entire mental model. (3) USE-WHEN TRIGGER PHRASES on every v1.26.x agent tool description. Each description now LEADS with 'USE WHEN USER SAYS:' followed by 4-6 example natural-language phrases, then the technical doc. This makes semantic-match win during tool selection. configure_llm_provider, create_agent, list_agents, publish_agent, update_agent_blueprint, run_agent_evals, tail_agent_conversations, get_agent_conversation, replay_conversation, get_agent_metrics — all 10 updated. create_agent additionally calls out the DON'T-CONFUSE-WITH cases (list_blocks, send_conversation_turn) inline. (4) VERSION constant bumped 1.18.1 → 1.27.1 (was stale 9 versions back). NO new tools, NO new endpoints, NO new migrations, NO new env vars. Backend redeploy NOT required (this only touches the MCP package). MCP republish only. EXPECTED IMPACT: the same 'create a chatbot for Cypress Pine HVAC' prompt that wasted 7 tool calls in v1.27.0 should now resolve in 3-5 calls (configure_llm_provider [if needed] → create_agent → publish_agent test). Phase B (v1.28.0 — build_website_chatbot skill bundle collapsing the 4-call sequence into 1, plus optional auto-inject onto a landing page block) and Phase C (v1.29.0 — get_skill_guide markdown how-tos, voice/email skill bundles, optional tool-name prefix renames) follow.",
   "description": "MCP server for SeldonFrame — AI-native Business OS platform. v1.27.0: AGENTS GET A PROPER HOME — discoverable nav + full in-dashboard agent management. PROBLEM v1.27 SOLVES: after v1.26.2 the chat-AI agents lived at /admin/agents (not in the sidebar nav, type-the-URL discovery), confusable with the existing /agents/runs (workflow run log) and /automations (workflow archetype configurator). SF clients had to use Claude Code MCP for ALL agent edits — no in-dashboard editing path. WHAT SHIPS: (1) NAV REWORK. /admin/agents promoted to /agents (operator-facing top-level route, not SF-internal). 'Agents' added to sidebar nav between Bookings and Pages with Bot icon (lucide-react). The existing /agents/runs (workflow runs log, 15 cross-refs) coexists at the same level — Next.js resolves the static 'runs' segment before falling through to dynamic '[id]', so /agents (chat AI list), /agents/<uuid>/* (chat AI detail), and /agents/runs (workflow runs) all route correctly. (2) AGENT DETAIL SHELL. New /agents/[id]/layout.tsx renders the agent header (← All agents back link, name, status pill, version, archetype, slug) + AgentTabs nav with 5 tabs: Overview / Sandbox / Conversations / Settings / Evals. Each child route is a tab body. (3) OVERVIEW TAB (/agents/[id]/page.tsx). At-a-glance stat grid (24h conversations, validator pass rate, eval pass rate, avg latency); daily-token-usage progress bar (green/amber/rose at 70/90%); 3 most recent conversations with quality marks visible; embed snippet copy block. OverviewActions client component lets operator toggle status (draft/test/live/paused) — 'live' triggers the eval gate server-side; failure surfaces the failing scenarios in-line with hint to fix in Settings. (4) SETTINGS TAB (/agents/[id]/settings + settings-client.tsx). INLINE BLUEPRINT EDITOR replicating MCP update_agent_blueprint without leaving the dashboard. Greeting textarea, capability checklist (5 capabilities: look_up_availability, book_appointment, find_my_existing_appointment, escalate_to_human, provide_faq_answer), FAQ rows (add/edit/delete), pricing facts rows (add/edit/delete with label+amount+currency), optional change-note input, Save button. saveAgentBlueprintAction validates with Zod, calls updateAgentBlueprint server action (bumps current_version + writes new agent_versions row), revalidates path, returns new version number. (5) EVALS TAB (/agents/[id]/evals + evals-client.tsx). Lists all 8 platform-owned scenarios (description + severity pill + category) with latest result inline (passed / failed / not run); failed rows show failure reasons + collapsible 'Agent response' detail. 'Run evals now' button calls runEvalsAction → runEvalSuite → returns updated summary. Header shows aggregate pass count + meets-gate badge + last-run timestamp. (6) CONVERSATIONS TAB (existing, polished). Same expand-in-place transcript as v1.26.2 plus QualityMarker client component on every expanded conversation: good/bad pill toggles + notes input. markConversationQualityAction writes operator_quality + operator_notes (already in schema since v1.26.0); collapsed-row preview shows the quality mark + first 60 chars of notes so operators can scan the list for already-reviewed chats. (7) SERVER ACTIONS (lib/agents/actions.ts). saveAgentBlueprintAction, setAgentStatusAction, runEvalsAction, markConversationQualityAction. All workspace-scoped via getOrgId(). Zod-validated input. Each calls revalidatePath so the dashboard reflects new state without hard refresh. (8) DUPLICATE-HEADER TRIM. /agents/[id]/test/page.tsx and /agents/[id]/conversations/page.tsx had their own h1 + back-link UI (from v1.26.2 when they were at /admin/agents); v1.27.0 removes those since the layout.tsx provides them at the parent level. Cleaner, no duplication. NO new migrations (v1.26.0 0044 still covers everything; operator_quality + operator_notes columns already there). NO new env vars. Backend redeploy + npm publish required. DEFERRED to v1.28: real Anthropic-streaming-passthrough on /turn (mid-turn tool_use streaming); voice-receptionist + sms-followup-bot specialized eval scenarios; per-scenario eval history graph; conversation-detail standalone page; 'fold operator-marked good/bad chats into future eval scenarios' (signal pipeline). The existing /agents/runs workflow run log will move to /automations/runs in v1.28 once we've audited the 15 cross-refs.",
@@ -66,7 +68,9 @@
     "node": ">=18"
   },
   "scripts": {
-    "start": "node src/index.js"
+    "start": "node src/index.js",
+    "check:syntax": "node --check --input-type=module < src/index.js && node --check --input-type=module < src/client.js && node --check --input-type=module < src/tools.js && node --check --input-type=module < src/welcome.js",
+    "prepublishOnly": "npm run check:syntax"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.4"

package/src/welcome.js

@@ -8,7 +8,7 @@
 // stripped. `create_full_workspace` is the only workspace-creation
 // path mentioned anywhere in this briefing.
 
-export const VERSION = "1.27.2";
+export const VERSION = "1.27.4";
 
 export const WELCOME_MARKDOWN = `# SeldonFrame — create a real Business OS in one conversation
 
@@ -402,4 +402,4 @@ admin dashboard. Pre-fills their email automatically.
 <https://seldonframe.com> · **Discord:** <https://discord.gg/sbVUu976NW>
 `;
 
-export const FIRST_CALL_BANNER = `🚀 SeldonFrame v1.27.2 is connected. CAPABILITY MAP — pick the right primitive BEFORE exploring tools: (a) "build me a website" → WORKSPACE → create_workspace_v2 + block tools. (b) "add a chatbot to my website / landing page" → AGENT (web chat) → create_agent({archetype:"website-chatbot"}) → embed.js script. CRITICAL ANTI-PATTERN: chat widgets are NOT blocks. Don't search list_blocks for chat — chat agents are a separate primitive (v1.26+). (c) "auto-reply to inbound SMS/email" → CONVERSATION → send_conversation_turn (one-shot Soul-aware reply, not a website widget). (d) "add hero/services/faq/cta section" → BLOCK → get_block_skill + persist_block. (e) "send campaign email/sms" → MESSAGING. (f) CRM ops → list_contacts/create_deal/etc. CHATBOT CANONICAL FLOW (5 calls): configure_llm_provider (BYOK Anthropic, skip if already set) → create_agent (faq + pricing_facts + greeting) → publish_agent({status:"test"}) → operator sandbox-tests at /agents/[id]/test → publish_agent({status:"live"}) auto-runs 8-scenario eval gate (≥87.5% pass required). Observability tools after publish: list_agents, tail_agent_conversations, get_agent_conversation, get_agent_metrics, run_agent_evals, replay_conversation. Dashboard surfaces /agents, /agents/[id]/test, /agents/[id]/settings, /agents/[id]/evals, /agents/[id]/conversations let operators iterate without leaving the browser. WORKSPACE FLOW (legacy reference): create_workspace_v2 → IN PARALLEL for all 7 recommended_blocks: get_block_skill + persist_block → complete_workspace_v2 → finalize_workspace({workspace_id, email}). v1.10+ TIER 2 CUSTOMIZE: regenerate_block, upload_workspace_image (image_url preferred over base64). v1.11+ STRUCTURAL: get_landing_structure, move_section, delete_section. v1.12+ COMPOSITES: add_composite_section / update_composite_section. Run blocks in PARALLEL (Promise.all). Skipping finalize_workspace leaves the operator with no admin login. Every URL is real. NEVER create local files.`; PREFERRED workspace creation: create_workspace_v2 → IN PARALLEL for all 7 recommended_blocks (hero, services, about, faq, cta, booking, intake): get_block_skill + persist_block → complete_workspace_v2 → finalize_workspace({ workspace_id, email }). The v2 flow puts YOUR LLM in charge of every operator-facing surface using one SKILL.md per block. Each block's prop schema is server-validated. Run blocks in PARALLEL (Promise.all) — sequential takes 60+ seconds. v1.10+ TIER 2 CUSTOMIZE TOOLS: regenerate_block (re-do one block with operator instructions; thin-harness — server bundles context, your LLM generates), upload_workspace_image (set logo/hero_background; v1.10.1+ accepts image_url or local_file_path — DON'T base64 unless you have to, the encoded string eats your tool-call token budget). v1.11+ STRUCTURAL PRIMITIVES: get_landing_structure → move_section → delete_section. INDEX-based, handle duplicate section types, atomic. v1.12+ COMPOSITE TREES: add_composite_section / update_composite_section — manifest ANY block (comparison, pricing, "how it works," stats, custom CTAs) from 12 low-level primitives. Server validates + renders; YOUR LLM composes. Read the SKILL.md via get_block_skill('composite') before composing. Every URL is real. NEVER create local files. Skipping finalize_workspace leaves the operator with no admin login.`;
+export const FIRST_CALL_BANNER = `🚀 SeldonFrame v1.27.4 is connected. CAPABILITY MAP — pick the right primitive BEFORE exploring tools: (a) "build me a website" → WORKSPACE → create_workspace_v2 + block tools. (b) "add a chatbot to my website / landing page" → AGENT (web chat) → create_agent({archetype:"website-chatbot"}) → embed.js script. CRITICAL ANTI-PATTERN: chat widgets are NOT blocks. Don't search list_blocks for chat — chat agents are a separate primitive (v1.26+). (c) "auto-reply to inbound SMS/email" → CONVERSATION → send_conversation_turn (one-shot Soul-aware reply, not a website widget). (d) "add hero/services/faq/cta section" → BLOCK → get_block_skill + persist_block. (e) "send campaign email/sms" → MESSAGING. (f) CRM ops → list_contacts/create_deal/etc. CHATBOT CANONICAL FLOW (5 calls): configure_llm_provider (BYOK Anthropic, skip if already set) → create_agent (faq + pricing_facts + greeting) → publish_agent({status:"test"}) → operator sandbox-tests at /agents/[id]/test → publish_agent({status:"live"}) auto-runs 8-scenario eval gate (≥87.5% pass required). Observability tools after publish: list_agents, tail_agent_conversations, get_agent_conversation, get_agent_metrics, run_agent_evals, replay_conversation. Dashboard surfaces /agents, /agents/[id]/test, /agents/[id]/settings, /agents/[id]/evals, /agents/[id]/conversations let operators iterate without leaving the browser. WORKSPACE FLOW (legacy reference): create_workspace_v2 → IN PARALLEL for all 7 recommended_blocks (hero, services, about, faq, cta, booking, intake): get_block_skill + persist_block → complete_workspace_v2 → finalize_workspace({workspace_id, email}). Run blocks in PARALLEL (Promise.all) — sequential takes 60+ seconds. v1.10+ CUSTOMIZE: regenerate_block, upload_workspace_image (image_url preferred over base64). v1.11+ STRUCTURAL: get_landing_structure, move_section, delete_section. v1.12+ COMPOSITES: add_composite_section / update_composite_section — manifest ANY block from 12 low-level primitives. Skipping finalize_workspace leaves the operator with no admin login. Every URL is real. NEVER create local files.`;