@thehammer/danx-dashboard-mcp 0.1.123 → 0.1.126

package/dist/handlers.js

@@ -413,6 +413,39 @@ function argCheckers(tool, mode) {
         },
     };
 }
+/**
+ * Every action-dispatched tool's args carry these three regardless of
+ * `action` — never action-specific, so every per-action allow-list passed to
+ * `refuseInapplicableFields` is unioned with this rather than repeating it.
+ */
+const STRUCTURAL_ACTION_FIELDS = ["id", "action", "board"];
+/**
+ * DX-3310 (code-review nit) — a field the caller sent that means nothing for
+ * the chosen `action` used to be silently ignored: `issue_solution`'s `add`
+ * built its `content` object from `title`/`body`/`pro`/`con`/`recommended`
+ * regardless of action, then simply never read it on `remove`/`add_step`/etc,
+ * and `issue_problem`'s `remove` never looked at `statement`/`context`/
+ * `solutions` at all. Either way the caller got a 200 with the field quietly
+ * discarded — no different from a typo. Refused loud instead, mirroring
+ * `argCheckers`' own wording: every ACTUALLY-SUPPLIED (`!== undefined`) key
+ * outside the action's own allow-list (plus `STRUCTURAL_ACTION_FIELDS`,
+ * always allowed) is named in one error, so a caller fixes every offending
+ * field in one round trip rather than one at a time.
+ */
+// A9 (code-review fix) — takes `object` rather than `Record<string, unknown>`
+// so every caller (each with its own specific `*Args` interface, no index
+// signature) passes `args` directly, with no `as unknown as Record<...>`
+// bridge cast at the call site. `Object.entries` reads the key/value pairs
+// without needing an index signature on the input type either.
+function refuseInapplicableFields(tool, mode, args, allowed) {
+    const offending = Object.entries(args)
+        .filter(([key, value]) => value !== undefined && !STRUCTURAL_ACTION_FIELDS.includes(key) && !allowed.has(key))
+        .map(([key]) => key)
+        .sort();
+    if (offending.length > 0) {
+        throw new Error(`${tool} ${mode} refuses fields that do not apply to this action: ${offending.join(", ")}`);
+    }
+}
 export async function issueComment(client, args) {
     const idEnc = encodeURIComponent(args.id);
     const board = args.board;
@@ -614,10 +647,25 @@ export async function issueChecklist(client, args) {
  *
  * No answer action, for the reason `issueSolution` gives.
  */
+/**
+ * DX-3310 (nit) — per-action allow-list for `refuseInapplicableFields`.
+ * `id`/`action`/`board` are structural and never listed (every action takes
+ * them). `type` is listed under `edit` even though it can never actually be
+ * SENT there (see the dedicated throw below) — that keeps the generic
+ * refusal from firing first with a less specific message than the one that
+ * already names the real reason.
+ */
+const PROBLEM_ACTION_FIELDS = {
+    list: [],
+    add: ["statement", "context", "type", "summary", "solutions"],
+    edit: ["problem_id", "base_hash", "statement", "context", "summary", "type"],
+    remove: ["problem_id", "base_hash"],
+};
 export async function issueProblem(client, args) {
     const idEnc = encodeURIComponent(args.id);
     const board = args.board;
     const need = argCheckers("issue_problem", `action=${args.action}`);
+    refuseInapplicableFields("issue_problem", `action=${args.action}`, args, new Set(PROBLEM_ACTION_FIELDS[args.action]));
     switch (args.action) {
         case "list":
             return client.request({ method: "GET", path: `/${idEnc}/problems`, board });
@@ -693,11 +741,24 @@ export async function issueProblem(client, args) {
  * question could release the very stop it set to wait for a human. The operator
  * answers in the dashboard.
  */
+const SOLUTION_ACTION_FIELDS = {
+    add: ["title", "body", "pro", "con", "recommended", "steps"],
+    edit: ["solution_id", "base_hash", "title", "body", "pro", "con", "recommended", "steps", "steps_base_hash"],
+    remove: ["solution_id", "base_hash"],
+    add_step: ["solution_id", "title", "description", "parent_step_id", "position"],
+    edit_step: ["solution_id", "step_id", "base_hash", "title", "description"],
+    remove_step: ["solution_id", "step_id", "base_hash"],
+};
 export async function issueSolution(client, args) {
     const need = argCheckers("issue_solution", `action=${args.action}`);
     // DX-2735: checked at runtime too, not only by the schema — a caller that skips
     // the MCP boundary must never build `/problems/undefined/solutions`.
     const problemId = need.id(args.problem_id, "problem_id");
+    // DX-3310 (nit) — `problem_id` is unioned in here rather than listed in
+    // every `SOLUTION_ACTION_FIELDS` entry: unlike `issue_problem` (where it
+    // only applies to edit/remove), `issue_solution` requires it for every
+    // action (checked above), so it is structural FOR THIS TOOL specifically.
+    refuseInapplicableFields("issue_solution", `action=${args.action}`, args, new Set(["problem_id", ...SOLUTION_ACTION_FIELDS[args.action]]));
     const base = `/${encodeURIComponent(args.id)}/problems/${problemId}/solutions`;
     const board = args.board;
     const content = {};

package/dist/index.js

@@ -634,11 +634,11 @@ const STEP_INPUT = z.lazy(() => z
         .positive()
         .optional()
         .describe("present -> this node IS an existing step (matched on this id, 400 if it does not resolve to a live " +
-        "child of this exact parent scope — a supplied id is NEVER claimed by the positional/title fallback " +
-        "below); absent -> matched against unclaimed siblings by TITLE (first unclaimed match, in order), else " +
-        "created new. An id-less MIDDLE insert recreates every later id-less sibling's row unless you send ids " +
-        "for the ones you want preserved — send ids whenever an existing step's identity matters (checked " +
-        "progress, a later single-step edit)."),
+        "child of this exact parent scope — a supplied id is NEVER claimed by the fallback below); absent -> " +
+        "id-less nodes match the first unclaimed sibling with the same title under the same parent, else " +
+        "created new. This title-based match (never positional) is what lets an id-less MIDDLE insert keep " +
+        "every later id-less sibling's id — send ids anyway whenever an existing step's identity matters " +
+        "(checked progress, a later single-step edit), or when two siblings under the same parent share a title."),
     title: z
         .string()
         .min(1)
@@ -714,8 +714,9 @@ strictTool("issue_solution", "One problem's options via /api/issues/:id/problems
     "changed fields, steps?, steps_base_hash?}: `steps` omitted leaves the stored procedure untouched, an explicit " +
     "array (including [], refused if it would leave an action's solution with zero steps) DIFFS against it — send " +
     "back an existing step's `id` (read from the card) to keep it (even while retitling/reordering it) and omit " +
-    "`id` for a genuinely new step; any existing step you don't include gets removed, and an id-less MIDDLE insert " +
-    "recreates every later id-less sibling's row unless you send ids for the ones whose identity matters. " +
+    "`id` for a genuinely new step; any existing step you don't include gets removed. An id-less node matches the " +
+    "first unclaimed sibling with the same title under the same parent (never positional), so an id-less MIDDLE " +
+    "insert keeps every later id-less sibling's id — send ids anyway whenever an existing step's identity matters. " +
     "`steps_base_hash` is REQUIRED whenever `steps` is sent — the solution's current `steps_hash` (read it off the " +
     "card first); a stale value → 409 `stale_steps` carrying the current tree, so a step added/removed since your " +
     "read is never silently dropped. NEVER resend the whole tree just to fix one word — see add_step/edit_step/" +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.123",
+  "version": "0.1.126",
   "description": "Stdio MCP server wrapping danxbot's dashboard /api/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
   "license": "MIT",
   "type": "module",