@thehammer/danx-dashboard-mcp 0.1.157 → 0.1.158

package/dist/http-client.js

@@ -1,6 +1,10 @@
+import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-floor.js";
 export class DashboardHttpClient {
     config;
     fetchImpl;
+    // DX-3597 — true once this instance has made ONE request, regardless of
+    // outcome. Drives the "first call OR any 4xx" version-floor check below.
+    hasCheckedVersionFloor = false;
     constructor(config, fetchImpl = fetch) {
         this.config = config;
         this.fetchImpl = fetchImpl;
@@ -50,6 +54,18 @@ export class DashboardHttpClient {
         catch (err) {
             throw new Error(`[danx-dashboard-mcp] network failure on ${args.method} ${url}: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // DX-3597 — proactive on the first call this instance ever makes
+        // (regardless of outcome: a stale client can otherwise look fine for a
+        // while on routes whose shape didn't change), and on every subsequent
+        // 4xx (a response that might otherwise read as an ordinary caller
+        // error when it's really "you're running an old MCP"). Throws
+        // McpOutdatedError instead of returning below when this package is
+        // behind the floor — see version-floor.ts's own doc.
+        const isFirstCall = !this.hasCheckedVersionFloor;
+        this.hasCheckedVersionFloor = true;
+        if (isFirstCall || (res.status >= 400 && res.status < 500)) {
+            assertVersionFloorSatisfied(res.headers.get(MCP_MIN_VERSION_HEADER));
+        }
         const text = await res.text();
         let parsed = null;
         if (text !== "") {

package/dist/version-floor.js

@@ -0,0 +1,128 @@
+/**
+ * DX-3597 — this package's half of the MCP-version-floor guard whose
+ * server-side half shipped in DX-3525 (`src/mcp-contract.ts`,
+ * `src/dashboard/serve-request.ts`, `src/resources/field-tree.ts`, all in
+ * the main danxbot repo — this package cannot import them, see below).
+ *
+ * The dashboard stamps `X-Danx-Mcp-Min-Version` on every routed `/api/*`
+ * response with its currently-advertised floor (`MIN_MCP_VERSION` in
+ * `src/mcp-contract.ts` — DX-3597 made that floor track the version where
+ * an MCP-exposed contract last changed, not "whatever's currently
+ * published"; see that file's module doc for the full decision).
+ *
+ * `DashboardHttpClient.request()` (`./http-client.ts`) reads this header on
+ * the FIRST call this process makes (regardless of outcome — a proactive
+ * check, since a stale client can otherwise appear to work for a while on
+ * routes whose shape didn't change) and on every subsequent 4xx (a response
+ * that might otherwise read as an ordinary caller error, when it's really
+ * "you're running an old MCP"). When this package's own version is behind
+ * the advertised floor, it throws `McpOutdatedError` instead of returning
+ * the ordinary envelope — the same "throw rather than fabricate/silently
+ * pass through" contract `http-client.ts` already applies to a 5xx/network
+ * failure (see that file's own doc): an outdated MCP is exactly that class
+ * of failure, nothing the calling tool can meaningfully work around.
+ *
+ * Everything here is duplicated, not imported, from the server's
+ * `src/mcp-contract.ts` — this package is an INDEPENDENTLY PUBLISHED npm
+ * artifact (DX-2103) and cannot depend on the danxbot service's own `src/`
+ * tree. Keep the header name, the package name, and the version-compare
+ * behavior in agreement with that file by hand when either changes.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** Must match `MCP_MIN_VERSION_HEADER` in danxbot's `src/mcp-contract.ts` verbatim. */
+export const MCP_MIN_VERSION_HEADER = "X-Danx-Mcp-Min-Version";
+/** Must match `MCP_PACKAGE_NAME` in danxbot's `src/mcp-contract.ts` verbatim. */
+export const MCP_PACKAGE_NAME = "@thehammer/danx-dashboard-mcp";
+/**
+ * Numeric-dotted version compare (major.minor.patch, ...) — mirrors
+ * `compareMcpVersions` in danxbot's `src/mcp-contract.ts` behavior
+ * byte-for-byte (duplicated, not imported — see module doc). Both sides of
+ * this contract have only ever used plain numeric dotted versions, so this
+ * throws rather than silently falling back to a lexical compare, which
+ * would misorder "0.1.9" vs "0.1.10".
+ */
+export function compareMcpVersions(a, b) {
+    const parse = (v) => {
+        if (!/^\d+(\.\d+)*$/.test(v)) {
+            throw new Error(`[danx-dashboard-mcp] "${v}" is not a plain numeric dotted version (major.minor.patch)`);
+        }
+        return v.split(".").map(Number);
+    };
+    const pa = parse(a);
+    const pb = parse(b);
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+        const da = pa[i] ?? 0;
+        const db = pb[i] ?? 0;
+        if (da !== db)
+            return da - db;
+    }
+    return 0;
+}
+let cachedOwnVersion;
+/**
+ * Reads this package's OWN version from its `package.json` — always present
+ * next to `dist/` (or `src/`, under `npm run dev`'s `tsx`) at runtime even
+ * though `files: ["dist","README.md"]` excludes it from the tarball
+ * MANIFEST: npm always includes `package.json` in what it publishes and
+ * what it installs, regardless of `files` (the same guarantee `README` /
+ * `LICENSE` / the `main` entry get) — this reads the copy npm actually
+ * installed next to this module, not danxbot's own source tree. Both
+ * `dist/version-floor.js` and `src/version-floor.ts` sit exactly one
+ * directory below the package root, so `../package.json` resolves
+ * correctly under both the published (dist) and dev (`tsx src/index.ts`)
+ * shapes. Memoized — the version cannot change mid-process.
+ */
+export function readOwnVersion() {
+    if (cachedOwnVersion !== undefined)
+        return cachedOwnVersion;
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkgJsonPath = join(here, "..", "package.json");
+    const raw = readFileSync(pkgJsonPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.version !== "string") {
+        throw new Error(`[danx-dashboard-mcp] could not read this package's own version from ${pkgJsonPath}`);
+    }
+    cachedOwnVersion = parsed.version;
+    return cachedOwnVersion;
+}
+/** Test-only escape hatch — real callers never need to override the memoized read. */
+export function __resetOwnVersionCacheForTests() {
+    cachedOwnVersion = undefined;
+}
+/**
+ * Thrown by `assertVersionFloorSatisfied` when this package is running
+ * behind the server's advertised floor. Carries structured `have`/`need`
+ * fields (not just a prose message) so a caller that wants to branch on
+ * "is this specifically an outdated-MCP failure" can check `error.code`
+ * rather than pattern-match the message text.
+ */
+export class McpOutdatedError extends Error {
+    code = "mcp_outdated";
+    have;
+    need;
+    constructor(have, need) {
+        super(`[danx-dashboard-mcp] mcp_outdated: this MCP is running ${MCP_PACKAGE_NAME}@${have}, but the dashboard ` +
+            `requires >= ${need}. Restart your Claude Code session to pick up the published update.`);
+        this.name = "McpOutdatedError";
+        this.have = have;
+        this.need = need;
+    }
+}
+/**
+ * Compares this package's own version against the floor a response header
+ * advertised. No-ops (returns) when compatible, or when `headerValue` is
+ * `null`/empty (an old-enough server, or a test stub, that never stamped
+ * one — nothing to compare against). Throws `McpOutdatedError` when this
+ * package is behind.
+ */
+export function assertVersionFloorSatisfied(headerValue) {
+    if (!headerValue)
+        return;
+    const have = readOwnVersion();
+    if (compareMcpVersions(have, headerValue) < 0) {
+        throw new McpOutdatedError(have, headerValue);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.157",
+  "version": "0.1.158",
   "description": "Stdio MCP server wrapping danxbot's dashboard /api/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
   "license": "MIT",
   "type": "module",