@thehammer/danx-dashboard-mcp 0.1.123 → 0.1.125

package/dist/handlers.js

@@ -413,6 +413,33 @@ function argCheckers(tool, mode) {
         },
     };
 }
+/**
+ * Every action-dispatched tool's args carry these three regardless of
+ * `action` — never action-specific, so every per-action allow-list passed to
+ * `refuseInapplicableFields` is unioned with this rather than repeating it.
+ */
+const STRUCTURAL_ACTION_FIELDS = ["id", "action", "board"];
+/**
+ * DX-3310 (code-review nit) — a field the caller sent that means nothing for
+ * the chosen `action` used to be silently ignored: `issue_solution`'s `add`
+ * built its `content` object from `title`/`body`/`pro`/`con`/`recommended`
+ * regardless of action, then simply never read it on `remove`/`add_step`/etc,
+ * and `issue_problem`'s `remove` never looked at `statement`/`context`/
+ * `solutions` at all. Either way the caller got a 200 with the field quietly
+ * discarded — no different from a typo. Refused loud instead, mirroring
+ * `argCheckers`' own wording: every ACTUALLY-SUPPLIED (`!== undefined`) key
+ * outside the action's own allow-list (plus `STRUCTURAL_ACTION_FIELDS`,
+ * always allowed) is named in one error, so a caller fixes every offending
+ * field in one round trip rather than one at a time.
+ */
+function refuseInapplicableFields(tool, mode, args, allowed) {
+    const offending = Object.keys(args)
+        .filter((key) => args[key] !== undefined && !STRUCTURAL_ACTION_FIELDS.includes(key) && !allowed.has(key))
+        .sort();
+    if (offending.length > 0) {
+        throw new Error(`${tool} ${mode} refuses fields that do not apply to this action: ${offending.join(", ")}`);
+    }
+}
 export async function issueComment(client, args) {
     const idEnc = encodeURIComponent(args.id);
     const board = args.board;
@@ -614,10 +641,25 @@ export async function issueChecklist(client, args) {
  *
  * No answer action, for the reason `issueSolution` gives.
  */
+/**
+ * DX-3310 (nit) — per-action allow-list for `refuseInapplicableFields`.
+ * `id`/`action`/`board` are structural and never listed (every action takes
+ * them). `type` is listed under `edit` even though it can never actually be
+ * SENT there (see the dedicated throw below) — that keeps the generic
+ * refusal from firing first with a less specific message than the one that
+ * already names the real reason.
+ */
+const PROBLEM_ACTION_FIELDS = {
+    list: [],
+    add: ["statement", "context", "type", "summary", "solutions"],
+    edit: ["problem_id", "base_hash", "statement", "context", "summary", "type"],
+    remove: ["problem_id", "base_hash"],
+};
 export async function issueProblem(client, args) {
     const idEnc = encodeURIComponent(args.id);
     const board = args.board;
     const need = argCheckers("issue_problem", `action=${args.action}`);
+    refuseInapplicableFields("issue_problem", `action=${args.action}`, args, new Set(PROBLEM_ACTION_FIELDS[args.action]));
     switch (args.action) {
         case "list":
             return client.request({ method: "GET", path: `/${idEnc}/problems`, board });
@@ -693,11 +735,24 @@ export async function issueProblem(client, args) {
  * question could release the very stop it set to wait for a human. The operator
  * answers in the dashboard.
  */
+const SOLUTION_ACTION_FIELDS = {
+    add: ["title", "body", "pro", "con", "recommended", "steps"],
+    edit: ["solution_id", "base_hash", "title", "body", "pro", "con", "recommended", "steps", "steps_base_hash"],
+    remove: ["solution_id", "base_hash"],
+    add_step: ["solution_id", "title", "description", "parent_step_id", "position"],
+    edit_step: ["solution_id", "step_id", "base_hash", "title", "description"],
+    remove_step: ["solution_id", "step_id", "base_hash"],
+};
 export async function issueSolution(client, args) {
     const need = argCheckers("issue_solution", `action=${args.action}`);
     // DX-2735: checked at runtime too, not only by the schema — a caller that skips
     // the MCP boundary must never build `/problems/undefined/solutions`.
     const problemId = need.id(args.problem_id, "problem_id");
+    // DX-3310 (nit) — `problem_id` is unioned in here rather than listed in
+    // every `SOLUTION_ACTION_FIELDS` entry: unlike `issue_problem` (where it
+    // only applies to edit/remove), `issue_solution` requires it for every
+    // action (checked above), so it is structural FOR THIS TOOL specifically.
+    refuseInapplicableFields("issue_solution", `action=${args.action}`, args, new Set(["problem_id", ...SOLUTION_ACTION_FIELDS[args.action]]));
     const base = `/${encodeURIComponent(args.id)}/problems/${problemId}/solutions`;
     const board = args.board;
     const content = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.123",
+  "version": "0.1.125",
   "description": "Stdio MCP server wrapping danxbot's dashboard /api/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
   "license": "MIT",
   "type": "module",