@setluca/mcp 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -10,6 +10,86 @@ input schema, or changing what a tool does to a workspace.
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-10-23
+
+### Fixed
+
+- Connections keep working past their first hour. The 401 challenge now asks
+  for `offline_access` along with the luca scopes, and the authorization server
+  issues a refresh token only when the grant carries it. Claude and ChatGPT ask
+  for exactly what the challenge names, so until now neither got a refresh
+  token and each connection lapsed with its one-hour access token.
+- claude.ai can connect. `serverInfo` no longer carries `icons`, which makes
+  claude.ai abandon the session after `initialize`
+  ([anthropics/claude-ai-mcp#474](https://github.com/anthropics/claude-ai-mcp/issues/474)).
+  The server card at `/.well-known/mcp/server-card.json` still lists them.
+- `luca_conversations_media_retry` and `luca_review_queue_media_retry` set
+  `openWorldHint: true`. A retried transcription sends the voice note to
+  OpenRouter's speech-to-text. Neither reaches a lead, so neither needs
+  `confirm: true`.
+- `luca_analytics_rollup` returns per-campaign analytics. It looked for
+  campaigns under `items`, but the API lists them under `campaigns`, so its
+  `campaigns` section had always come back empty.
+- `luca_conversations_send_status`, `luca_bookings_managed_availability`, and
+  `luca_webhooks_events_list` require `query`. Each route has a required query
+  parameter, so a call without `query` already failed with the API's 400; the
+  tool schema now says so. No call that worked before is rejected.
+- `luca_leads_draft` and `luca_draft_reply` set `destructiveHint: true` and
+  `openWorldHint: true`. Drafting again replaces the lead's earlier unapproved
+  draft from these tools, and the drafter sends the conversation to
+  OpenRouter's language model, the same reach that makes a transcription
+  retry open-world. Neither sends to the lead, so neither needs
+  `confirm: true`.
+- Descriptions that said more than the API does:
+  - `luca_campaigns_generate` builds its plan with fixed rules, not an AI
+    model;
+  - `luca_leads_update` cannot set a score;
+  - `luca_reschedule_call`, `luca_bookings_update`, and `luca_bookings_cancel`
+    say that a Google Calendar booking's calendar emails the lead, and Cal.com
+    may too, where the reschedule tool had said no message is sent.
+
+### Changed
+
+- The 401 challenge asks for every scope instead of `luca:read luca:draft`.
+  Claude requests what the challenge names, and the consent screen offers only
+  what was requested, so a coach could not let Claude send or book. The consent
+  screen still starts at read and draft, with every higher scope unticked.
+- Built on Effect 4.0.6, up from 4.0.0. Its JSON Schema output flattens a
+  nested `anyOf`, which reshapes `luca_close_call_loop`'s output schema without
+  changing what it accepts. No other tool's schema changed.
+- `typecheck` and `build` run the Effect language service
+  ([`@effect/tsgo`](https://github.com/Effect-TS/tsgo)) and fail on any of its
+  errors, warnings, or suggestions.
+
+## [0.5.1] - 2026-10-22
+
+### Fixed
+
+- Tool annotations now match what each tool does, as the October 2026 audit
+  for the OpenAI app directory listed them. All 203 tools it covered match its
+  corrected values, and the 21 tools added in 0.5.0 follow the same rules.
+  - `idempotentHint` is true for 33 writes that a repeat with the same input
+    cannot move further, such as `luca_leads_notes_delete`,
+    `luca_insights_dismiss`, `luca_broadcasts_cancel`, and
+    `luca_pause_cadence`. It was true only for reads before.
+  - `openWorldHint` is true for writes the coach's webhook subscribers hear
+    about (`luca_leads_create`, `luca_leads_update`,
+    `luca_leads_identities_attach`, `luca_review_queue_reject`,
+    `luca_review_queue_bulk_reject`, `luca_broadcasts_pause`) and for the call
+    summaries that later reach the CRM (`luca_call_events_summary_generate`,
+    `luca_call_events_backfill`). None of them needs `confirm: true`.
+  - `luca_leads_import_preview` is read-only. It saves nothing.
+  - `luca_integrations_crm_connections_schema` is no longer read-only, because
+    it refreshes Luca's cached copy of the CRM schema.
+  - `luca_review_queue_objection_variant` is no longer destructive. It adds a
+    learning event and leaves the draft as it was.
+- `luca_integrations_crm_sync_runs_create` is titled "Preview a CRM sync" and
+  no longer asks for `confirm: true` or claims to reach the CRM. The API
+  refuses a live sync, so the tool only records a dry-run preview.
+- `luca_reschedule_call` says that a Cal.com or Google Calendar move waits for
+  the provider: until it confirms, the booking reads `pending_provider` and
+  keeps its old time.
+
 ## [0.5.0] - 2026-10-22
 
 ### Breaking

package/dist/annotations.js

@@ -10,6 +10,7 @@ export function operationAnnotationSource(operation) {
         title: operation.title,
         readOnly: operation.readOnly,
         mutatesExisting: operation.mutatesExisting,
+        idempotent: operation.idempotent,
         ...optionalField("confirm", operation.confirm),
         openWorld: operation.openWorld,
     };
@@ -34,11 +35,11 @@ export function toolAnnotations(source) {
         // existed before the call.
         destructiveHint: !source.readOnly &&
             (source.confirm !== undefined || source.mutatesExisting),
-        // The idempotency key is optional in the MCP input. The HTTP layer mints a
-        // new key when it is absent, so two otherwise identical writes can still
-        // have different effects. Only advertise the unconditional read guarantee
-        // until the key becomes a required tool argument.
-        idempotentHint: source.readOnly,
+        // Stated per operation: every read, plus the writes a repeat cannot move
+        // further, such as a delete, a dismiss, or a whole-value replace. It never
+        // leans on the idempotency key, which the HTTP layer mints fresh when the
+        // caller leaves it out.
+        idempotentHint: source.idempotent,
         // Every call goes to the Luca API, but most only touch the coach's own
         // workspace. The hint is true only when the call can reach past it: a
         // lead's inbox, an outside URL, or a connected calendar or CRM.

package/dist/completions.js

@@ -1,9 +1,8 @@
 import * as Arr from "effect/Array";
 import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
 import * as R from "effect/Record";
-import * as Schema from "effect/Schema";
 import { LucaApi } from "./http.js";
+import { recordIdsOf } from "./pagination.js";
 /**
  * Argument completion for the two ids a coach types by hand. MCP completes
  * prompt arguments and resource-template variables; there is no tool-argument
@@ -28,27 +27,6 @@ const COMPLETION_SOURCES = {
  * array it gets back, so a source with more ids than this page cannot say so.
  */
 const COMPLETION_PAGE_SIZE = 100;
-/**
- * Reads a list page down to the ids in one array field, ignoring every other
- * field on the page and every other field on a record. A page that arrives in
- * any other shape decodes to nothing, which the caller offers as no
- * suggestions.
- */
-function idsDecoder(itemsKey) {
-    const decode = Schema.decodeUnknownOption(Schema.Struct({
-        [itemsKey]: Schema.Array(Schema.Struct({ id: Schema.String })),
-    }));
-    return (page) => Option.match(decode(page), {
-        onNone: () => [],
-        // Read through the values rather than the key: the struct declares
-        // exactly one field, so a page that decoded carries that field's records
-        // and nothing else. Indexing by `itemsKey` would say the same thing while
-        // reading as though the key might be missing.
-        onSome: (decoded) => R.values(decoded)
-            .flat()
-            .map((record) => record.id),
-    });
-}
 /**
  * The completion callbacks for one server, closed over the layer that serves
  * the reads.
@@ -62,14 +40,9 @@ export function completionCallbacks(operationById, lucaLayer) {
         const operation = operationById(operationId);
         // A completion source has to be a list route: the ids come out of the
         // page's own array field, and a route that does not paginate carries none.
-        // Naming one that cannot serve them is a wiring mistake, so it is refused
-        // while the server is being built rather than on a keystroke.
-        const itemsKey = operation.pageContract?.itemsKey;
-        if (itemsKey === undefined) {
-            // oxlint-disable-next-line effect/avoid-untagged-errors -- raw failure on an invariant or interop path; not a caller-recoverable domain failure
-            throw new Error(`Completion source ${operationId} carries no list of records to read ids from`);
-        }
-        const idsOn = idsDecoder(itemsKey);
+        // `recordIdsOf` refuses any other while the server is being built rather
+        // than on a keystroke.
+        const idsOn = recordIdsOf(operation);
         return (value) => Effect.runPromise(Effect.gen(function* () {
             const api = yield* LucaApi;
             const page = yield* api.request({
@@ -81,7 +54,7 @@ export function completionCallbacks(operationById, lucaLayer) {
             // Ids are UUIDs, which print in either case, and a client may type
             // the capitals it copied from elsewhere.
             const typed = (value ?? "").toLowerCase();
-            return idsOn(page).filter((id) => id.toLowerCase().startsWith(typed));
+            return idsOn(page, COMPLETION_PAGE_SIZE).filter((id) => id.toLowerCase().startsWith(typed));
         }).pipe(Effect.provide(lucaLayer), 
         // A failed read answers with no suggestions. A defect is left alone:
         // that one is our own bug, and an empty list is exactly how it would

package/dist/errors.js

@@ -18,7 +18,7 @@ export class LucaDecodeError extends Schema.TaggedError()("LucaDecodeError", {
 }) {
 }
 export class LucaHttpError extends Schema.TaggedError()("LucaHttpError", {
-    status: Schema.Number,
+    status: Schema.Int,
     statusText: Schema.String,
     body: Schema.Json,
     requestId: Schema.optionalKey(Schema.String),
@@ -26,7 +26,7 @@ export class LucaHttpError extends Schema.TaggedError()("LucaHttpError", {
      * How long the server asked us to wait, from its `Retry-After` header. Absent
      * when the header was missing or unreadable.
      */
-    retryAfterMs: Schema.optionalKey(Schema.Number),
+    retryAfterMs: Schema.optionalKey(Schema.Finite),
 }) {
 }
 /**