@thehammer/danx-dashboard-mcp 0.1.146 → 0.1.149

package/README.md

@@ -26,8 +26,8 @@ All exposed as `mcp__danx-dashboard__<name>` once wired through the workspace `m
 | `issue_create` | `POST /api/issues` | Epic REQUIRES non-empty `phase_children[]` (atomic insert). `title` = short domain-naming label; `summary` = 1–3 plain-language sentences, always shown; `description` = the collapsed "Context" body. Root and every phase child take their own `summary` |
 | `issue_edit` | `PATCH /api/issues/:id/edit` | Prose + structured keys (`title`, `summary` (null clears), `description`, `ac`, `checklists`, `effort_level`, `parent_id`, `priority`, `list_id`); semantic keys refused with 400 + pointer to dedicated handler. `priority` (DX-1532) takes a tier word (`low`/`high`/…) or a number in `[0,6)` — the ONLY way to set the numeric column the Trello label + dashboard badge read; never set priority via description prose |
 | `issue_transition` | `POST /api/issues/:id/transition` | Actions: ready, pickup, rollback_pickup, complete, cancel, block, unblock, archive, reopen. `block` is a dispatch hold only — it never marks the card as needing a human; use `issue_problem` add for that |
-| `issue_problem` | `GET/POST/PATCH/DELETE /api/issues/:id/problems[/:pid]` | Actions list / add / edit / remove. A problem is one statement the operator must resolve (a question or a plan flaw) with its own solutions and answers; `add` takes `statement` + optional `solutions[]` in one transaction and IS what puts the card in front of a human (`open_problem_count > 0`) — a successful add also returns a `reminders: [{key, text}]` array (DX-3365 — the reminder registry's middleware, DB-driven and operator-overridable from the dashboard). Edit + remove are hash-guarded (`base_hash`, 409 `stale_problem`); removing the card's last open problem is always allowed — it just means the card no longer needs a human |
-| `issue_solution` | `POST/PATCH/DELETE /api/issues/:id/problems/:pid/solutions[/:sid]` | Actions add / edit / remove, `problem_id` required (list via `issue_problem list`). Edit + remove are hash-guarded (`base_hash`, 409 `stale_solution` with the current row); at most one live `recommended` per problem; a chosen option cannot be edited. No answer action on any tool — the operator answers in the dashboard |
+| `issue_problem` | `GET/POST/PATCH/DELETE /api/issues/:id/problems[/:pid]` + `POST .../answer`, `change-answer`, `unanswer` | Actions list / add / edit / remove / answer / change_answer / unanswer (DX-3471). A problem is one statement the operator must resolve (a question or a plan flaw) with its own solutions and answers; `add` takes `statement` + optional `solutions[]` in one transaction and IS what puts the card in front of a human (`open_problem_count > 0`) — a successful add also returns a `reminders: [{key, text}]` array (DX-3365 — the reminder registry's middleware, DB-driven and operator-overridable from the dashboard). Edit + remove are hash-guarded (`base_hash`, 409 `stale_problem`); removing the card's last open problem is always allowed — it just means the card no longer needs a human. `answer` `{solution_id, note?}` \| `{freeform}` and `change_answer` (same + `base_hash` naming the live DECISION) / `unanswer` (`{base_hash}`) record or retract an operator's decision — server-refused 403 for a dispatched agent's machine credential (DX-2830), reachable from an OPERATOR SESSION relaying an in-chat decision, which also durably records the relaying session (`relayed_by_session`) via the same session header every call already carries |
+| `issue_solution` | `POST/PATCH/DELETE /api/issues/:id/problems/:pid/solutions[/:sid]` | Actions add / edit / remove, `problem_id` required (list via `issue_problem list`). Edit + remove are hash-guarded (`base_hash`, 409 `stale_solution` with the current row); at most one live `recommended` per problem; a chosen option cannot be edited. No answer action on THIS tool — see `issue_problem`'s answer / change_answer / unanswer actions |
 | `issue_triage` | `POST /api/issues/:id/triage` | Send `{confidence, reason}` — an integer 0-5 score; the server computes the verdict (approve/cancel/keep/defer) against the board's configured thresholds (DX-2086). `keep`/`defer` now block the card. None of these are a cross-card ordering gate; use `issue_dependency` to sequence cards |
 | `issue_comment` | `POST/PATCH/DELETE /api/issues/:id/comments[/:cid]` | Author server-stamped, soft-delete preserved |
 | `issue_dependency` | `POST/DELETE /api/issues/:id/dependencies[/:did]` | `depends_on` cycle-checked; remove hardcodes `reason: "recorded_in_error"`. The only mechanism the dispatch picker enforces to sequence one card after another — status alone is not a substitute |
@@ -60,10 +60,10 @@ CLAUDE_CODE_SESSION_ID=<session> npx -y @thehammer/danx-dashboard-mcp@<version>
 ```
 
 - **Credential — the session's own, never the ambient one (DX-2862).** The session id is the only thing `bridge` takes from its environment; `--resume-ids` is the only argument and holds no secret. Everything else comes from the connection record this session's own danx-dashboard MCP server wrote on `plan_connect` (`src/session-connection.ts`): the dashboard URL, the credential's SOURCE, and its FINGERPRINT. `bridge` resolves that source through the same resolver the server used and refuses to run unless the result fingerprints identically — `credential_mismatch`. Before that fix it used whatever `DANXBOT_DISPATCH_TOKEN` the session's environment held, and on a machine where that differed from the server's credential the dashboard admitted the stream and dropped every event, with nothing logged anywhere.
-- **No client-side reach check (DX-2920).** `bridge` used to prove board reach itself, before ever opening the stream (`GET /api/plans/mine?fields=cards` + a per-board `GET /api/issues/:id/problems`). That check is DELETED — the dashboard (DX-2863) now enforces the identical requirement server-side, and a second client-side copy of the same check was a duplicate source of truth, not a safety net: it refuses a mint (`403 issuer_cannot_read_plan_boards`), refuses stream admission (the SAME 403), and ends a live stream (`event: end`, `{"reason":"scope_narrowed","boards":[…]}`) the instant it stops being true. `bridge` only MAPS those refusals now — see "Stopping" below — it never independently verifies anything before streaming. Once a ticket is minted, `bridge` emits, once, `{"type":"ready"}` — no `boards` field, since reach is no longer proven client-side.
+- **No client-side reach check (DX-2920).** `bridge` used to prove board reach itself, before ever opening the stream (`GET /api/plans/mine?fields=cards` + a per-board `GET /api/issues/:id/problems`). That check is DELETED. The dashboard briefly enforced the identical requirement server-side (DX-2863: refusing a mint or stream admission with `403 issuer_cannot_read_plan_boards`, and ending a live stream `{"reason":"scope_narrowed","boards":[…]}`), but DX-3468 removed that mechanism too — DX-3409 made every credential team-bound, so a plan session's issuer and every board its connected plan covers are always in the same team, and the check could never fire any more. `bridge` no longer independently verifies board reach at all, client- or server-side. Once a ticket is minted, `bridge` emits, once, `{"type":"ready"}` — no `boards` field, since reach is no longer proven client-side.
 - **Ticket.** `bridge` mints the session's listener ticket (`POST /api/plan-sessions/me/stream-ticket`, 10 s timeout) and keeps it in the process. A ticket authorizes reading that one session's event stream and nothing else, and is only issued while the session is connected to a plan. Minting a new one ends the previous listener.
 - **Output — JSON Lines.** One `{"type":"event","id":<id|null>,"text":"…"}` per event on the connected plan's cards, where `text` is `[DX-8 "Title" repo:board] newms87 answered "Which rollout order?": chose "Pause E2E" — note: "only this week"`, `… answered "…": "<free-form answer>"`, `… commented: "…"`, `… opened a problem: "…"`, `… blocked the card: "…"`, or `… unblocked the card`. An event it cannot read still produces one, with a `could not read event` text. Nothing for keep-alives, reconnects or re-mints. The session's own writes are never echoed back to it.
-- **Stopping.** Last, one `{"type":"stopped","reason":"…","detail":"…","fix":"…"}` and exit, only on a terminal outcome. `fix` is the remedy shown to the session (`STOP_FIXES` in `src/bridge.ts` — never a log-only hint), so a session that hits a stop it cannot otherwise see still knows what to do about it. Terminal reasons: `no_connection_record` / `credential_unavailable` / `credential_mismatch` (the start-time checks above), `not_connected` (a `409 session_not_connected` at mint OR at stream admission, or a live `end("not_connected")` — all three mapped identically), `unauthorized` (401/403 for a reason OTHER than an unreadable board), `mint_refused` (any other non-transient mint refusal), `mint_bad_response`, `board_unreadable` (a `403 issuer_cannot_read_plan_boards` at mint OR at stream admission, naming the unreadable boards — DX-2920), `scope_narrowed` (a LIVE stream's `end("scope_narrowed", boards)` — the server's `end()` REQUIRES `boards` for this reason at the type level, `bridge` parses them off the wire and names them in `detail`/`fix`, never a generic message), `bad_end_payload` (a `scope_narrowed` end whose `boards` array was missing or malformed — a protocol error surfaced loudly, never silently downgraded to a boards-less `scope_narrowed`), `superseded` / `replaced` (exit 0 — a newer or replacing connection already serves this session, so `fix` says no action is needed), `revoked`, or `refused` (two freshly minted tickets refused in a row with no more specific classification). A transient mint failure (network, timeout, 408, 429, 5xx) backs off and retries; a lapsed ticket lease re-mints.
+- **Stopping.** Last, one `{"type":"stopped","reason":"…","detail":"…","fix":"…"}` and exit, only on a terminal outcome. `fix` is the remedy shown to the session (`STOP_FIXES` in `src/bridge.ts` — never a log-only hint), so a session that hits a stop it cannot otherwise see still knows what to do about it. Terminal reasons: `no_connection_record` / `credential_unavailable` / `credential_mismatch` (the start-time checks above), `not_connected` (a `409 session_not_connected` at mint OR at stream admission, or a live `end("not_connected")` — all three mapped identically), `unauthorized` (401/403), `mint_refused` (any other non-transient mint refusal), `mint_bad_response`, `superseded` / `replaced` (exit 0 — a newer or replacing connection already serves this session, so `fix` says no action is needed), `revoked`, or `refused` (two freshly minted tickets refused in a row with no more specific classification). A transient mint failure (network, timeout, 408, 429, 5xx) backs off and retries; a lapsed ticket lease re-mints.
 - **Reconnect and resume.** A read-idle timeout (three missed keep-alives) turns a silently dead connection into a drop. Capped exponential backoff (1s → 30s) that resets only after a healthy connection, with `Last-Event-ID`, so a dashboard restart replays what was missed and nothing is emitted twice. `--resume-ids` carries the same guarantee across a process restart: the ids already delivered seed the duplicate guard, and the highest is the first `Last-Event-ID`. The dashboard floors that replay at the later of the session's first ticket and when it joined its current plan, so a restart loses nothing and a plan move replays nothing from before the move.
 
 ## Build + test

package/dist/bridge.js

@@ -20,25 +20,17 @@
  *      credential from its session's tools streamed happily and relayed nothing.
  *   3. Mints the session's listener ticket (`POST /api/plan-sessions/me/stream-ticket`).
  *      The ticket stays in this process.
- *   4. DX-2920 — board-coverage reach is a SERVER-ENFORCED property now, never a
- *      client-side verify: the stream admits an event only when the ticket
- *      issuer's board allowlist covers that event's board (`isVisibleToStream`,
- *      dashboard), and the dashboard itself (DX-2863) refuses to hand out a
- *      ticket, refuses to admit a connection, and ends a live stream the instant
- *      that stops being true — `403 issuer_cannot_read_plan_boards` at MINT
- *      (`mintTicket`) AND at stream ADMISSION (`classifyAdmissionRefusal`,
- *      reading `listen.ts`'s structured `refusal`) are BOTH mapped to
- *      `board_unreadable`, naming the boards; `409 session_not_connected` at
- *      mint AND at admission are both mapped to `not_connected`; and
- *      `end("scope_narrowed", boards)` / `end("not_connected")` cover the
- *      same two failures once the stream is already live — `end`'s own
- *      overloaded signature in `plan-session-stream.ts` REQUIRES `boards` for
- *      `scope_narrowed` at the type level (round 3), and `listen.ts` parses
- *      them off the wire the same way it parses `reason`, so this module can
- *      name them in `scope_narrowed`'s detail/fix exactly like it already
- *      does for `board_unreadable`. This module no longer runs its own
- *      duplicate board-by-board check before streaming — see DX-2920 and the
- *      deleted `verifyPlanBoardsReadable`.
+ *   4. DX-3468 — board-coverage narrowing (`403 issuer_cannot_read_plan_boards`
+ *      at mint or admission, mapped to `board_unreadable`; a live stream
+ *      ending `scope_narrowed`) was removed as dead code: DX-3409 made every
+ *      credential team-bound, so a plan session's issuer and every board its
+ *      connected plan covers are always in the same team (see the dashboard's
+ *      `plan-scope.ts` module banner). `409 session_not_connected` at mint
+ *      AND at admission are both mapped to `not_connected`, and
+ *      `end("not_connected")` covers the same failure once the stream is
+ *      already live. This module no longer runs its own duplicate
+ *      board-by-board check before streaming — see DX-2920 and the deleted
+ *      `verifyPlanBoardsReadable`.
  *   5. Streams through `runListener` (`listen.ts`), which reconnects within the
  *      ticket, and re-mints when that ticket's lease runs out or a fresh ticket
  *      is refused once.
@@ -59,26 +51,9 @@
  *   - `not_connected`         the mint, or the stream's admission / keep-alive,
  *                              answered `session_not_connected` (409 at mint and
  *                              at admission; `end("not_connected")` once live);
- *   - `unauthorized`          the mint answered 401 / 403 for a reason OTHER
- *                              than an unreadable board;
+ *   - `unauthorized`          the mint answered 401 / 403;
  *   - `mint_refused`          any other non-transient mint refusal (400, 404, …);
  *   - `mint_bad_response`     a 2xx mint whose body is not a ticket;
- *   - `board_unreadable`      the mint OR the stream's admission was refused
- *                              `403 issuer_cannot_read_plan_boards`, naming the
- *                              boards this credential cannot read (DX-2920);
- *   - `scope_narrowed`        a LIVE stream ended because the plan grew, or the
- *                              credential's allowlist shrank past, a board this
- *                              credential can no longer read — `boards` names
- *                              them, parsed from the dashboard's own `end`
- *                              payload by `listen.ts` the same way `reason`
- *                              itself is parsed, and `detail`/`fix` are built
- *                              dynamically from them (DX-2920 round 3 —
- *                              `boardUnreadableDetail` / `scopeNarrowedFix`),
- *                              never a static generic message;
- *   - `bad_end_payload`       a `scope_narrowed` end whose `boards` array was
- *                              missing or malformed — a PROTOCOL error, never
- *                              silently downgraded to a boards-less
- *                              `scope_narrowed` stop (DX-2920 round 3);
  *   - `superseded` / `replaced` (exit 0) — another listener now holds the session;
  *   - `revoked`               the dashboard revoked the ticket or its issuer;
  *   - `refused`               freshly minted tickets were refused twice in a row.
@@ -236,12 +211,6 @@ export const STOP_FIXES = {
     unauthorized: "give this session's danx-dashboard MCP server a dashboard credential that is accepted, then call plan_connect again",
     mint_refused: "check that this session is connected to a plan on the dashboard its MCP server points at, then call plan_connect again",
     mint_bad_response: "check that DANXBOT_DASHBOARD_URL for this session's MCP server points at a danxbot dashboard",
-    board_unreadable: "scope this session's dashboard credential to read that board, or connect a plan whose cards all live on boards it can read",
-    // DX-2920 (round 3) — a `scope_narrowed` end whose `boards` array was
-    // missing or invalid (`listen.ts`'s parse-time check). Named separately
-    // from `scope_narrowed` itself, which always carries boards and never
-    // reaches this generic map at all.
-    bad_end_payload: "call plan_connect again to mint a new listener ticket for this session",
     // A newer ticket exists (superseded) or another connection is already using
     // this one (replaced) — THIS process is ending because the session is
     // already served elsewhere, not because anything is broken.
@@ -278,9 +247,9 @@ export function parseBridgeArgs(argv, env) {
 export class BridgeStartError extends Error {
     // DX-2920 (round 4) — `ListenStopReason`, not `string`: a start-time failure
     // is always one of `no_connection_record` / `credential_unavailable` /
-    // `credential_mismatch`, never `scope_narrowed` (there is no stream yet), so
-    // this can be the closed reason type the eventual `write({type:"stopped",
-    // reason: start.reason, ...})` needs it to be.
+    // `credential_mismatch` (there is no stream yet), so this can be the closed
+    // reason type the eventual `write({type:"stopped", reason: start.reason,
+    // ...})` needs it to be.
     reason;
     fix;
     /** DX-3028 — see `BridgeOptions.instanceId`. Always populated: minted before any of the three start-time checks run. */
@@ -367,39 +336,6 @@ export function resolveBridgeOptions(args, env, options = {}) {
         watchedPaths,
     };
 }
-/**
- * DX-2920 — `body.boards` off a `403 issuer_cannot_read_plan_boards` refusal
- * (`unreadableBoardsRefusal`, dashboard `plan-scope.ts`), or `[]` when the body
- * doesn't carry a readable list (defensive — never trust the wire shape blindly).
- */
-function boardsOf(body) {
-    if (typeof body !== "object" || body === null)
-        return [];
-    const boards = body.boards;
-    return Array.isArray(boards) ? boards.filter((b) => typeof b === "string") : [];
-}
-/**
- * DX-2920 — the ONE `board_unreadable` detail-line builder, shared by the mint
- * 403 classification and the stream admission's identical 403, so the two can
- * never drift into two different ideas of how to phrase "these boards".
- */
-function boardUnreadableDetail(boards, fallback) {
-    return boards.length > 0
-        ? `this session's dashboard credential cannot read board(s) ${boards.join(", ")} on the connected plan`
-        : fallback;
-}
-/**
- * DX-2920 (round 3) — `scope_narrowed`'s fix, built dynamically from the
- * boards `listen.ts` parsed off the dashboard's own `end` payload (AC 30661:
- * "naming the missing boards and how to widen scope"), replacing the static
- * generic `STOP_FIXES` entry round 2 shipped before the server actually sent
- * a board list.
- */
-function scopeNarrowedFix(boards) {
-    return boards.length > 0
-        ? `widen this session's dashboard credential to cover board(s) ${boards.join(", ")}, or connect a plan whose cards all live on boards it can read`
-        : "widen this session's dashboard credential to cover every board the connected plan's cards live on, or connect a plan whose cards all live on boards it can read";
-}
 /**
  * One authenticated request, with a timeout, classifying the failures that are
  * about THIS MOMENT (network, timeout, 408/429, 5xx) as transient. Shared by
@@ -486,19 +422,6 @@ export async function mintTicket(options, deps) {
     if (status === 409 && errorCodeOf(body) === "session_is_worker") {
         return { kind: "terminal", reason: "session_is_worker", detail: "this session id belongs to a worker dispatch, not an operator plan session" };
     }
-    // DX-2920 (AC 30660) — this credential IS accepted; it just cannot read every
-    // board the connected plan covers (`unreadableBoardsRefusal`, dashboard
-    // `plan-scope.ts`). Calling that `unauthorized` told the session to fix its
-    // credential, which was the wrong remedy for a scope problem — this is
-    // `board_unreadable`, naming the boards, checked BEFORE the generic 401/403
-    // fallback below so it never falls into it.
-    if (status === 403 && errorCodeOf(body) === "issuer_cannot_read_plan_boards") {
-        return {
-            kind: "terminal",
-            reason: "board_unreadable",
-            detail: boardUnreadableDetail(boardsOf(body), `ticket mint HTTP 403: issuer_cannot_read_plan_boards ${oneLine(text, 300)}`),
-        };
-    }
     if (status === 401 || status === 403) {
         return { kind: "terminal", reason: "unauthorized", detail: `ticket mint HTTP ${status} ${oneLine(text, 300)}` };
     }
@@ -558,18 +481,12 @@ export async function fetchPlanInventory(options, deps) {
 /**
  * DX-2920 — a stream admission refusal (`listen.ts`'s STRUCTURED `refused`
  * outcome — `{status, errorCode, body}`, parsed once in `connectOnce`) whose
- * shape matches one the mint route already gives its OWN name to. Two cases:
- *
- *   - `409 session_not_connected` — the SAME shape the mint route uses for "no
- *     plan connected" (`plan-session-stream.ts`, DX-2863 review finding M2). A
- *     session with no plan connected is the identical terminal state whether
- *     the dashboard says so at mint or at the stream's own admission check,
- *     and the session should see ONE remedy either way.
- *   - `403 issuer_cannot_read_plan_boards` — the SAME shape the mint route's
- *     board-coverage refusal uses (AC 30660's fix 4 — a ticket minted before a
- *     board became unreadable can still be refused ADMISSION for it later; that
- *     refusal deserves the same `board_unreadable` naming as the mint-time one,
- *     not a re-mint-and-retry loop that just hits the identical refusal again).
+ * shape matches one the mint route already gives its OWN name to: `409
+ * session_not_connected`, the SAME shape the mint route uses for "no plan
+ * connected" (`plan-session-stream.ts`, DX-2863 review finding M2). A session
+ * with no plan connected is the identical terminal state whether the
+ * dashboard says so at mint or at the stream's own admission check, and the
+ * session should see ONE remedy either way.
  *
  * Classifies by STATUS + ERROR CODE, never by re-deriving them from the
  * flattened `detail` string — the second-source-of-truth shape this card's fix
@@ -581,21 +498,15 @@ function classifyAdmissionRefusal(refusal) {
     if (refusal.status === 409 && refusal.errorCode === "session_not_connected") {
         return { reason: "not_connected", detail: "the session is not connected to a plan" };
     }
-    if (refusal.status === 403 && refusal.errorCode === "issuer_cannot_read_plan_boards") {
-        return {
-            reason: "board_unreadable",
-            detail: boardUnreadableDetail(boardsOf(refusal.body), "this session's dashboard credential cannot read a board on the connected plan"),
-        };
-    }
     return null;
 }
 // DX-3028 (code-review + architecture-review finding) — typed against
-// `ListenStopReason` (the closed union `scope_narrowed` aside — see that
-// type's own docblock), NOT bare `Set<string>`: a typo'd member here used to
-// have zero compile-time signal, silently falling into the generic
-// `degrade-server-fixable` default below — exactly the kind of drift this
-// safety-critical classification can least afford. `satisfies readonly
-// ListenStopReason[]` on each array is what makes a typo a build error.
+// `ListenStopReason` (see that type's own docblock), NOT bare `Set<string>`:
+// a typo'd member here used to have zero compile-time signal, silently
+// falling into the generic `degrade-server-fixable` default below — exactly
+// the kind of drift this safety-critical classification can least afford.
+// `satisfies readonly ListenStopReason[]` on each array is what makes a typo
+// a build error.
 const EXIT_NEVER_RESTART_LIST = [
     "no_connection_record",
     "not_connected",
@@ -746,16 +657,8 @@ export async function runBridge(options, deps) {
         }
         const policy = degradePolicyFor(reason);
         const degraded = policy !== "exit";
-        const fix = reason === "scope_narrowed" ? scopeNarrowedFix(extra?.boards ?? []) : (extra?.fix ?? fixForStop(reason));
-        if (reason === "scope_narrowed") {
-            if (extra?.boards === undefined) {
-                throw new Error('settle("scope_narrowed", ...) requires boards — unreachable through the exported overloads above');
-            }
-            deps.write({ type: "stopped", reason, detail, boards: extra.boards, fix, instanceId: options.instanceId, paths: options.watchedPaths, degraded });
-        }
-        else {
-            deps.write({ type: "stopped", reason, detail, refusal: extra?.refusal, fix, instanceId: options.instanceId, paths: options.watchedPaths, degraded });
-        }
+        const fix = extra?.fix ?? fixForStop(reason);
+        deps.write({ type: "stopped", reason, detail, refusal: extra?.refusal, fix, instanceId: options.instanceId, paths: options.watchedPaths, degraded });
         if (policy === "exit") {
             heartbeat.stop();
             return { kind: "exit", code };
@@ -1002,19 +905,6 @@ export async function runBridge(options, deps) {
             }
             continue;
         }
-        if (stopped.reason === "scope_narrowed") {
-            // DX-2920 (round 4) — `stopped.boards` is REQUIRED at the type level now
-            // (`ListenStopped`'s `scope_narrowed` member), populated by `listen.ts`'s
-            // parse of the dashboard's own `end` payload (never a re-derivation from
-            // `detail`) — no `?? []`, no optional check, `stopped.boards` IS
-            // `string[]` once narrowed to this branch.
-            const boards = stopped.boards;
-            const outcome = await settle("scope_narrowed", boardUnreadableDetail(boards, stopped.detail), 1, { boards });
-            if (outcome.kind === "exit")
-                return outcome.code;
-            refusedInRow = 0;
-            continue;
-        }
         {
             const outcome = await settle(stopped.reason, stopped.detail, 1);
             if (outcome.kind === "exit")

package/dist/handlers.js

@@ -568,7 +568,31 @@ export async function issueChecklist(client, args) {
  * `.describe()` in `index.ts` — that description, not this comment, is what
  * a calling agent actually reads.
  *
- * No answer action, for the reason `issueSolution` gives.
+ * DX-3471 — `answer` {solution_id, note?} | {freeform} → POST :pid/answer;
+ * `change_answer` {base_hash, solution_id, note?} | {base_hash, freeform} →
+ * POST :pid/change-answer (retracts the live decision and records a new one
+ * in ONE server transaction); `unanswer` {base_hash} → POST :pid/unanswer
+ * (retracts with no new answer, reopening the problem). `base_hash` on these
+ * two names the live DECISION (`decisionContentHash`), NOT the problem —
+ * read it off a problem's `decisions[].content_hash` (from `list`), never
+ * off the problem's own `content_hash`. A stale one → 409 `stale_decision`
+ * with `currentHash` + `currentProblem`: merge, then retry.
+ *
+ * ALL THREE ARE OPERATOR-SESSION ONLY. The server's route policy admits only
+ * a `human` principal on these three routes (`route-policies/index.ts`) — a
+ * dispatched agent's machine credential is refused before it ever reaches a
+ * handler, for the DX-2830 reason: an agent that could answer its own
+ * question could release the very human gate it set to stop and wait for.
+ * An operator-session agent (running under the OPERATOR's own dashboard
+ * token, human-authenticated) CAN call these — this is what turns "the
+ * operator decided in chat" into a durable, correctly-attributed decision
+ * instead of a comment or a raw curl call. The decision records the human
+ * decider (`decided_by`) and, when this call carries the session id
+ * `@thehammer/danx-dashboard-mcp` already stamps on every request
+ * (`x-danx-session-id`, DX-2683 — no separate parameter needed here),
+ * which working session relayed it (`relayed_by_session` on the resulting
+ * decision, DX-3471) — so a decision entered from the dashboard's own UI
+ * (no header) stays distinguishable from one an agent relayed in chat.
  */
 /**
  * DX-3310 (nit) — per-action allow-list for `refuseInapplicableFields`.
@@ -583,6 +607,9 @@ const PROBLEM_ACTION_FIELDS = {
     add: ["statement", "context", "type", "summary", "solutions"],
     edit: ["problem_id", "base_hash", "statement", "context", "summary", "type"],
     remove: ["problem_id", "base_hash"],
+    answer: ["problem_id", "solution_id", "note", "freeform"],
+    change_answer: ["problem_id", "base_hash", "solution_id", "note", "freeform"],
+    unanswer: ["problem_id", "base_hash"],
 };
 export async function issueProblem(client, args) {
     const idEnc = encodeURIComponent(args.id);
@@ -652,8 +679,66 @@ export async function issueProblem(client, args) {
                 board,
             });
         }
+        // DX-3471 — answer/change_answer share the exact-one-of solution_id/freeform
+        // shape the server's own `validateAnswer` enforces (`write/problem-answer.ts`);
+        // checked here too so a caller gets the same clear boundary error every
+        // OTHER missing/conflicting-arg case in this tool already gets, rather than
+        // a round trip to the server for a 400 the client could have caught.
+        case "answer": {
+            const problemId = need.id(args.problem_id, "problem_id");
+            return client.request({
+                method: "POST",
+                path: `/${idEnc}/problems/${problemId}/answer`,
+                body: answerChoiceBody(args, "answer"),
+                board,
+            });
+        }
+        case "change_answer": {
+            const problemId = need.id(args.problem_id, "problem_id");
+            const baseHash = need.string(args.base_hash, "base_hash");
+            return client.request({
+                method: "POST",
+                path: `/${idEnc}/problems/${problemId}/change-answer`,
+                body: { base_hash: baseHash, ...answerChoiceBody(args, "change_answer") },
+                board,
+            });
+        }
+        case "unanswer": {
+            const problemId = need.id(args.problem_id, "problem_id");
+            const baseHash = need.string(args.base_hash, "base_hash");
+            return client.request({
+                method: "POST",
+                path: `/${idEnc}/problems/${problemId}/unanswer`,
+                body: { base_hash: baseHash },
+                board,
+            });
+        }
     }
 }
+/**
+ * DX-3471 — the either/or answer shape `answer`/`change_answer` both send:
+ * `{solution_id, note?}` XOR `{freeform}`, mirroring the server's own
+ * `validateAnswer` (`write/problem-answer.ts`) so a caller gets the SAME
+ * refusal at this client boundary that the server would otherwise 400 on,
+ * with no round trip.
+ */
+function answerChoiceBody(args, mode) {
+    const hasSolution = args.solution_id !== undefined;
+    const hasFreeform = args.freeform !== undefined;
+    if (hasSolution === hasFreeform) {
+        throw new Error(`issue_problem ${mode} requires either solution_id or freeform (never both, never neither)`);
+    }
+    if (hasFreeform) {
+        if (args.note !== undefined) {
+            throw new Error(`issue_problem ${mode}: note qualifies a chosen solution — it is not valid with freeform`);
+        }
+        return { freeform: args.freeform };
+    }
+    const body = { solution_id: args.solution_id };
+    if (args.note !== undefined)
+        body.note = args.note;
+    return body;
+}
 /**
  * One problem's candidate solutions, AND (DX-3310) one solution's individual
  * procedure steps, via `/api/issues/:id/problems/:pid/solutions[/:sid][/steps[/:stepId]]`
@@ -664,10 +749,13 @@ export async function issueProblem(client, args) {
  * solution/step id from the wrong scope → 404, nesting past depth 3 → 400)
  * pass through verbatim.
  *
- * There is deliberately NO answer action, on this tool or any other. Answering
- * releases the human gate on a card — an agent that could answer its own
- * question could release the very stop it set to wait for a human. The operator
- * answers in the dashboard.
+ * There is deliberately NO answer action on THIS tool — answering releases the
+ * human gate on a card, and this tool has no notion of "who is calling".
+ * `issue_problem`'s `answer` / `change_answer` / `unanswer` actions (DX-3471)
+ * are where that lives instead: server-side human-principal-only (a
+ * dispatched agent's machine credential is refused 403), so an operator
+ * session can record a decision but a dispatched worker cannot release its
+ * own gate.
  */
 const SOLUTION_ACTION_FIELDS = {
     add: ["title", "body", "pro", "con", "recommended", "steps"],

package/dist/index.js

@@ -657,11 +657,39 @@ const STEP_INPUT = z.lazy(() => z
     steps: z.array(STEP_INPUT).optional().describe("this step's own children, nested — refused past 3 levels total"),
 })
     .strict());
-strictTool("issue_problem", "A card's PROBLEMS: one statement the operator must resolve (a question, or a flaw in the plan) OR an action only a person can carry out, each with its own solutions/answers — one problem per question. OPEN = not yet answered; the card needs a human exactly while open_problem_count > 0 — adding a problem IS putting the card in front of a human, there is no separate flag. list → live problems in order, each {id, statement, context, type, summary, content_hash, open, solutions[], decisions[]}; add {statement, context?, type?, summary?, solutions?} → problem_id + solution_ids in one transaction (zero solutions is valid: the operator answers free-form) plus a `reminders: [{key, text}]` array (DX-3365 — every MCP-response reminder rides this ONE field now, DB-registry-driven and operator-overridable from the dashboard) naming each still-open problem's solution count; edit :pid {base_hash, statement, context?, summary?}; remove :pid {base_hash} — always allowed, even as the card's last open problem (removing it just means the card no longer needs a human). A stale base_hash → 409 `stale_problem` with currentHash + currentProblem: merge, then retry. No answer action — the operator answers in the dashboard. `statement` is capped at 200 characters (400 names the actual length otherwise): one plain sentence, with any investigation detail in `context` (markdown, no cap) instead. Read `type`'s and `summary`'s own descriptions below before your first `add` — together they teach which type this is and the three-field split (`statement`/`summary`/`context`) an action needs.", {
+strictTool("issue_problem", "A card's PROBLEMS: one statement the operator must resolve (a question, or a flaw in the plan) OR an action only a person can carry out, each with its own solutions/answers — one problem per question. OPEN = not yet answered; the card needs a human exactly while open_problem_count > 0 — adding a problem IS putting the card in front of a human, there is no separate flag. list → live problems in order, each {id, statement, context, type, summary, content_hash, open, solutions[], decisions[]} (each decision carries `relayed_by_session`, DX-3471 — the working session that recorded it, or null for one entered directly in the dashboard); add {statement, context?, type?, summary?, solutions?} → problem_id + solution_ids in one transaction (zero solutions is valid: the operator answers free-form) plus a `reminders: [{key, text}]` array (DX-3365 — every MCP-response reminder rides this ONE field now, DB-registry-driven and operator-overridable from the dashboard) naming each still-open problem's solution count; edit :pid {base_hash, statement, context?, summary?}; remove :pid {base_hash} — always allowed, even as the card's last open problem (removing it just means the card no longer needs a human). A stale base_hash → 409 `stale_problem` with currentHash + currentProblem: merge, then retry. " +
+    "DX-3471 — answer :pid {solution_id, note?} | {freeform} records the operator's decision on a LIVE problem (exactly one of solution_id/freeform; note only qualifies a chosen solution); change_answer :pid {base_hash, solution_id, note?} | {base_hash, freeform} retracts the current decision and records a new one in ONE server transaction; unanswer :pid {base_hash} retracts with no new answer, reopening the problem. `base_hash` on these two names the live DECISION (from that problem's `decisions[].content_hash` in `list`), NOT the problem's own hash — a stale one → 409 `stale_decision` with currentHash + currentDecision: merge, then retry. " +
+    "**These three are OPERATOR-SESSION ONLY** — the server refuses a dispatched agent's machine credential 403 (DX-2830: an agent that could answer its own question could release the very human gate it set to stop and wait for); call them only when relaying a decision the OPERATOR actually made in this chat, never a decision you are making yourself. Session attribution is automatic (the same `x-danx-session-id` every call already carries, DX-2683) — no session parameter to pass here. " +
+    "`statement` is capped at 200 characters (400 names the actual length otherwise): one plain sentence, with any investigation detail in `context` (markdown, no cap) instead. Read `type`'s and `summary`'s own descriptions below before your first `add` — together they teach which type this is and the three-field split (`statement`/`summary`/`context`) an action needs.", {
     id: z.string().min(1),
-    action: z.enum(["list", "add", "edit", "remove"]),
-    problem_id: z.number().int().positive().optional().describe("edit/remove"),
-    base_hash: z.string().min(1).optional().describe("content_hash last read; edit/remove"),
+    action: z.enum(["list", "add", "edit", "remove", "answer", "change_answer", "unanswer"]),
+    problem_id: z.number().int().positive().optional().describe("edit/remove/answer/change_answer/unanswer"),
+    base_hash: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("edit/remove: content_hash last read for the PROBLEM. change_answer/unanswer: content_hash last read for " +
+        "the live DECISION instead (that problem's `decisions[].content_hash` from `list`) — the two are never " +
+        "interchangeable."),
+    solution_id: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("answer/change_answer only. The chosen option's id, from this problem's own solutions[]. Exactly one of " +
+        "solution_id / freeform — never both, never neither (refused before any request)."),
+    note: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("answer/change_answer only, solution_id answers only: an optional qualification (\"this, but…\"). Refused " +
+        "alongside freeform, which is already the operator's own words."),
+    freeform: z
+        .string()
+        .min(1)
+        .optional()
+        .describe("answer/change_answer only. The operator's own words, when no listed solution fits. Exactly one of " +
+        "solution_id / freeform — never both, never neither."),
     statement: z
         .string()
         .min(1)
@@ -981,7 +1009,7 @@ strictTool("plan_create", "Create a new, empty plan. Global — not board-scoped
 }, async (args) => jsonResult(await planCreate(client, args)));
 strictTool("plan_connect", 
 // DX-2735: trimmed with the problem tools to stay inside the work-profile budget.
-"Connect THIS session to a plan. ONE CALL IS ENOUGH TO START: the reply carries `{session, movedFrom, browserInstruction, briefing, listenerHealth}` — `browserInstruction` is a server-built action to take NOW: it names the plan's URL and tells you to open it (in-app browser if you have one, else default), keep that tab open for the whole session without navigating it away, and use a different tab for your own browsing — the operator's tab for following and talking to you. Returned on every connect, including a re-connect, so it doubles as the post-context-loss reminder. `briefing` is every goal/rule/caveat (ref+body), every architecture section (id+title), the plan's own ref/name/status, a first page of open cards (id/type/status/title/openProblemCount/assignedAgent) with a `morePagesHint` when more exist, and the closed-card count — usually replacing the `plan_get({fields:[...]})` + card batch-read a fresh session used to need. A session is on AT MOST ONE plan: connecting elsewhere MOVES it, and `movedFrom: {id, name} | null` says which plan it left (null = no plan, or already this one). Binds only your OWN session, resolved from the session id this server forwards; afterwards every plan WRITE tool acts on this plan and takes no plan id. `listenerHealth` reports the event bridge's state — `null` (no session), or `{attached, state: \"unattached\"|\"credential_mismatch\"|\"board_scope_narrowed\"|\"healthy\", nextStep}` naming a concrete fix per unhealthy state (same shape `plan_list`/`plan_get` report). Once healthy, every comment, answer, problem added and block/unblock on this plan's cards reaches the session unpolled, relayed by the plugin's event bridge as a line like `[DX-8 \"Title\" repo:board] newms87 answered \"<statement>\": chose \"Pause E2E\"`. Pass `title` (call `get_session({session_id:\"self\"})` first and forward its `title` verbatim) so the dashboard shows the same name Claude does — this server cannot read it itself.", {
+"Connect THIS session to a plan. ONE CALL IS ENOUGH TO START: the reply carries `{session, movedFrom, browserInstruction, briefing, listenerHealth}` — `browserInstruction` is a server-built action to take NOW: it names the plan's URL and tells you to open it (in-app browser if you have one, else default), keep that tab open for the whole session without navigating it away, and use a different tab for your own browsing — the operator's tab for following and talking to you. Returned on every connect, including a re-connect, so it doubles as the post-context-loss reminder. `briefing` is every goal/rule/caveat (ref+body), every architecture section (id+title), the plan's own ref/name/status, a first page of open cards (id/type/status/title/openProblemCount/assignedAgent) with a `morePagesHint` when more exist, and the closed-card count — usually replacing the `plan_get({fields:[...]})` + card batch-read a fresh session used to need. A session is on AT MOST ONE plan: connecting elsewhere MOVES it, and `movedFrom: {id, name} | null` says which plan it left (null = no plan, or already this one). Binds only your OWN session, resolved from the session id this server forwards; afterwards every plan WRITE tool acts on this plan and takes no plan id. `listenerHealth` reports the event bridge's state — `null` (no session), or `{attached, state: \"unattached\"|\"credential_mismatch\"|\"healthy\", nextStep}` naming a concrete fix per unhealthy state (same shape `plan_list`/`plan_get` report). Once healthy, every comment, answer, problem added and block/unblock on this plan's cards reaches the session unpolled, relayed by the plugin's event bridge as a line like `[DX-8 \"Title\" repo:board] newms87 answered \"<statement>\": chose \"Pause E2E\"`. Pass `title` (call `get_session({session_id:\"self\"})` first and forward its `title` verbatim) so the dashboard shows the same name Claude does — this server cannot read it itself.", {
     plan_id: z.number().int().positive().describe("The plan id, from `plan_list`."),
     title: z
         .string()

package/dist/json-body.js

@@ -9,7 +9,7 @@
  * that wanted to react to a SPECIFIC refusal (the admission-time 409 the
  * mint route also uses) had to regex-scrape that flattened string back apart,
  * a second, fragile source of truth for the same fact. This module is generic
- * — it knows nothing about "session_not_connected" or "issuer_cannot_read_plan_boards",
+ * — it knows nothing about "session_not_connected" or "stream_ticket_invalid",
  * only that a JSON object may carry a top-level string field named `error` —
  * so it can live in BOTH the domain-aware `bridge.ts` and the deliberately
  * generic `listen.ts` (whose own docblock states it carries no domain

package/dist/listen.js

@@ -15,27 +15,21 @@
  *     (`formatNudgeLine`): it is advisory, re-derived fresh every tick by the
  *     dashboard's own keep-alive tick, and never replayed, so it rides this
  *     same shape with `id: null` rather than growing a THIRD output variant.
- *   - `{type:"stopped", reason, detail, refusal?, boards?}` — once, last. `reason`
+ *   - `{type:"stopped", reason, detail, refusal?}` — once, last. `reason`
  *     is the dashboard's own end reason (`superseded`, `replaced`, `revoked`,
- *     `scope_narrowed`, `not_connected`), `refused` (the ticket was not
- *     admitted), `bad_end_payload` (a `scope_narrowed` end whose `boards` array
- *     was missing/invalid — a protocol error, never silently downgraded), or
+ *     `not_connected`), `refused` (the ticket was not admitted), or
  *     `lease_expired` (no healthy connection for the lease). DX-2920 —
  *     `refusal` is populated ONLY for `reason === "refused"`: `{status,
  *     errorCode, body}`, the admission response parsed ONCE here, so a
  *     consumer can recognize a SPECIFIC refusal (the dashboard's own
  *     `409 session_not_connected`, the same shape the mint route uses) by
  *     status + error code rather than re-deriving it from the flattened
- *     `detail` string. `boards` is REQUIRED (round 4 — a discriminated union,
- *     not an optional field: see `ListenStopped` / `ListenStopReason`) for
- *     `reason === "scope_narrowed"` and absent for every other reason, parsed
- *     from the dashboard's `end` payload the SAME way `reason` itself is
- *     parsed — never re-derived from `detail`. A wire `reason` value this
- *     build does not recognize (a newer dashboard's reason an older bridge
- *     hasn't shipped yet) normalizes to `"unknown"` rather than passing the
- *     raw string through, so the closed set stays closed — `fixForStop`'s
- *     generic `DEFAULT_STOP_FIX` handles it exactly as it already handled a
- *     verbatim unrecognized string.
+ *     `detail` string. A wire `reason` value this build does not recognize (a
+ *     newer dashboard's reason an older bridge hasn't shipped yet)
+ *     normalizes to `"unknown"` rather than passing the raw string through,
+ *     so the closed set stays closed — `fixForStop`'s generic
+ *     `DEFAULT_STOP_FIX` handles it exactly as it already handled a verbatim
+ *     unrecognized string.
  *   - nothing for keep-alives, the connect marker, or a successful reconnect.
  *
  * RECONNECT AND RESUME. The stream drops whenever the dashboard restarts, and can
@@ -345,16 +339,12 @@ function parseBlock(block) {
 }
 /**
  * DX-2920 (round 4) — the dashboard's own `StreamEndReason` values this
- * client recognizes on the wire, EXCLUDING `scope_narrowed` (parsed by its own
- * dedicated branch in `handle()` below, since it alone carries `boards`).
- * Hand-copied from `StreamEndReason` in `src/issues/plan-session-listeners.ts`
- * — this published package cannot import danxbot source. A wire `reason` this
- * set does not contain (a newer dashboard's reason this build predates)
- * normalizes to `"unknown"` rather than passing the raw string through, which
- * is what lets `Outcome`'s `reason` field below be a closed union instead of
- * `string` — see `ListenStopReason`'s docblock for why that closure is what
- * makes the `scope_narrowed`-requires-`boards` invariant an actual compile
- * error rather than a comment's promise.
+ * client recognizes on the wire. Hand-copied from `StreamEndReason` in
+ * `src/issues/plan-session-listeners.ts` — this published package cannot
+ * import danxbot source. A wire `reason` this set does not contain (a newer
+ * dashboard's reason this build predates) normalizes to `"unknown"` rather
+ * than passing the raw string through, which is what lets `Outcome`'s
+ * `reason` field below be a closed union instead of `string`.
  */
 const KNOWN_WIRE_END_REASONS = new Set(["superseded", "replaced", "revoked", "not_connected"]);
 function isKnownWireEndReason(reason) {
@@ -390,27 +380,13 @@ export async function runListener(options, deps) {
     for (const id of capResumeIds(options.resumeIds))
         remember(id);
     function stop(reason, detail, code, extra) {
-        if (reason === "scope_narrowed") {
-            if (extra?.boards === undefined) {
-                throw new Error('stop("scope_narrowed", ...) requires boards — unreachable through the exported overloads above');
-            }
-            deps.write({ type: "stopped", reason, detail, boards: extra.boards });
-            return code;
-        }
         deps.write({ type: "stopped", reason, detail, refusal: extra?.refusal });
         return code;
     }
     const handle = (message) => {
         if (message.event === "end") {
             // DX-2920 (round 3) — a JSON.parse failure here falls through to the
-            // pre-existing "unknown" reason below via `isRecord(null)`, unchanged
-            // from before this round. Only a `scope_narrowed` reason additionally
-            // REQUIRES a valid `boards` string array (matching the server's `end`
-            // overload, which cannot emit `scope_narrowed` without one) — a
-            // `scope_narrowed` frame that fails that check is a PROTOCOL error
-            // (a server too old to have sent boards, or a corrupted frame), never
-            // silently downgraded to the generic "the dashboard ended this
-            // listener" message the caller cannot act on.
+            // pre-existing "unknown" reason below via `isRecord(null)`.
             let parsed;
             try {
                 parsed = JSON.parse(message.data);
@@ -420,23 +396,10 @@ export async function runListener(options, deps) {
             }
             const reasonRaw = isRecord(parsed) ? parsed.reason : undefined;
             const reason = typeof reasonRaw === "string" ? reasonRaw : "unknown";
-            if (reason === "scope_narrowed") {
-                const boardsRaw = isRecord(parsed) ? parsed.boards : undefined;
-                const boards = Array.isArray(boardsRaw) && boardsRaw.length > 0 && boardsRaw.every((b) => typeof b === "string")
-                    ? boardsRaw
-                    : null;
-                if (boards === null) {
-                    return { kind: "ended", reason: "bad_end_payload" };
-                }
-                return { kind: "ended", reason, boards };
-            }
             // DX-2920 (round 4) — a wire reason this build does not recognize (a
             // newer dashboard's reason an older bridge hasn't shipped yet)
             // normalizes to "unknown" rather than passing the raw string through:
-            // `Outcome`'s "ended" reason is now a closed set (`EndedReason`), and an
-            // open passthrough here would be exactly the hole that lets a
-            // missing-`boards` "scope_narrowed" construction slip past the compiler
-            // elsewhere — see `ListenStopReason`'s docblock.
+            // `Outcome`'s "ended" reason is a closed set (`EndedReason`).
             return { kind: "ended", reason: isKnownWireEndReason(reason) ? reason : "unknown" };
         }
         if (message.event === "nudge") {
@@ -597,17 +560,6 @@ export async function runListener(options, deps) {
             if (outcome.reason === "superseded" || outcome.reason === "replaced") {
                 return stop(outcome.reason, "another listener for this session took over", 0);
             }
-            if (outcome.reason === "bad_end_payload") {
-                return stop("bad_end_payload", "the dashboard's scope_narrowed end event carried no valid boards array — this is a protocol error, not an ordinary end", 1);
-            }
-            // DX-2920 (round 4) — split explicitly rather than the old conditional
-            // `outcome.boards === undefined ? undefined : {boards}` pass-through:
-            // `Outcome`'s "ended" kind is now itself discriminated on `reason`, so
-            // `outcome.boards` is GUARANTEED present here (no `?? []`, no optional
-            // check needed) once narrowed to `"scope_narrowed"`.
-            if (outcome.reason === "scope_narrowed") {
-                return stop("scope_narrowed", "the dashboard ended this listener", 1, { boards: outcome.boards });
-            }
             return stop(outcome.reason, "the dashboard ended this listener", 1);
         }
         if (outcome.kind === "refused") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.146",
+  "version": "0.1.149",
   "description": "Stdio MCP server wrapping danxbot's dashboard /api/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
   "license": "MIT",
   "type": "module",

package/dist/entrypoint.test.js

@@ -1,43 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll } from "vitest";
-import { mkdtempSync, writeFileSync, symlinkSync, rmSync, realpathSync, } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
-import { isEntrypointModule } from "./entrypoint.js";
-describe("isEntrypointModule (DX-1647)", () => {
-    let dir;
-    let real;
-    let link;
-    beforeAll(() => {
-        dir = mkdtempSync(join(tmpdir(), "entrypoint-test-"));
-        real = join(dir, "index.js");
-        writeFileSync(real, "// stub entry\n");
-        link = join(dir, "danx-dashboard-mcp"); // mimics node_modules/.bin symlink
-        symlinkSync(real, link);
-    });
-    afterAll(() => {
-        rmSync(dir, { recursive: true, force: true });
-    });
-    // import.meta.url always reports the module REALPATH — model that here.
-    const moduleUrl = () => pathToFileURL(realpathSync(real)).href;
-    it("true when argv[1] is the real file (direct `node index.js`)", () => {
-        expect(isEntrypointModule(moduleUrl(), real)).toBe(true);
-    });
-    it("true when argv[1] is a SYMLINK to the file (npx / global bin) — the fleet regression", () => {
-        // The symlink path !== the realpath, but the entrypoint MUST still be
-        // detected, or npx imports the module and exits without booting the server.
-        expect(link).not.toBe(realpathSync(link));
-        expect(isEntrypointModule(moduleUrl(), link)).toBe(true);
-    });
-    it("false when argv[1] is undefined (module imported, not run as bin)", () => {
-        expect(isEntrypointModule(moduleUrl(), undefined)).toBe(false);
-    });
-    it("false when argv[1] is an empty string", () => {
-        expect(isEntrypointModule(moduleUrl(), "")).toBe(false);
-    });
-    it("false when argv[1] points at a different real file", () => {
-        const other = join(dir, "other.js");
-        writeFileSync(other, "// other\n");
-        expect(isEntrypointModule(moduleUrl(), other)).toBe(false);
-    });
-});