@thehammer/danx-dashboard-mcp 0.1.16 → 0.1.18

package/dist/handlers.js

@@ -1,3 +1,28 @@
+/**
+ * Per-tool handlers for the dashboard MCP server.
+ *
+ * Each handler is a pure async function: validate args (Zod at the MCP
+ * boundary), build the HTTP request the corresponding `/api/issues/*`
+ * route expects, and pass the envelope back to the caller verbatim.
+ *
+ * BOARD-ONLY (DX-1171): board is the first-level concept; repo is
+ * DERIVED from board server-side, never passed. Every handler accepts an
+ * optional `board` arg — a qualified board id (`<repo>:<slug>`). When
+ * set, it overrides the dispatch's configured board for that single call
+ * (forwarded as `?board=<board>` — and into `body.board` for create — so
+ * an agent can target any board). Omitted → falls back to the dispatch's
+ * env-derived board. The dashboard route validates the board (owning
+ * board→repo) and 404s on unknown; the MCP forwards the refusal envelope
+ * verbatim, never duplicates validation.
+ *
+ * Zero transformation of the server response. Refusal payloads carry
+ * structured detail (`failed_gate`, `non_terminal_phases`,
+ * `offending_keys`, `received_reason`, etc.) that the agent uses to
+ * decide its next move; swallowing any of it would force the agent to
+ * guess.
+ */
+import { readFile } from "node:fs/promises";
+import { basename, extname, isAbsolute } from "node:path";
 export async function issueList(client, args) {
     // status_derived is display-only on the server but the route accepts
     // it as a projection filter — passthrough verbatim. parent_id=null is
@@ -212,3 +237,70 @@ export async function issueRetro(client, args) {
         board,
     });
 }
+/**
+ * Extension → MIME map for the agent-attached file types that matter for
+ * downstream rendering (image previews in the dashboard drawer, Trello card,
+ * and Slack thread all key on the persisted `mime`). This package is a
+ * standalone published artifact and cannot import the backend's helpers, so
+ * the small map lives here. An unknown extension resolves to the generic
+ * octet-stream — a sensible default for "we don't know the type", NOT a
+ * silenced error (the bytes still upload + the row is still written).
+ */
+const MIME_BY_EXT = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".csv": "text/csv",
+    ".txt": "text/plain",
+    ".log": "text/plain",
+    ".md": "text/markdown",
+    ".json": "application/json",
+    ".html": "text/html",
+    ".zip": "application/zip",
+    ".gz": "application/gzip",
+    ".tgz": "application/gzip",
+};
+export function inferAttachmentMime(filename) {
+    return MIME_BY_EXT[extname(filename).toLowerCase()] ?? "application/octet-stream";
+}
+/**
+ * Attach a local file to an issue card. Reads the bytes from the dispatch's
+ * shared filesystem (this MCP server runs co-located with the agent), then
+ * forwards to the dashboard's `POST /api/issues/:id/attachments` route — the
+ * SAME ingest the dashboard UI upload uses, which uploads to S3, inserts ONE
+ * danxbot-origin `issue_attachments` row (`source_type=''`), and publishes
+ * `issue:updated` so the DX-1122 outbound projection mirrors the file to both
+ * the linked Trello card and the Slack card-view thread.
+ *
+ * Fail-loud (`base:fail-loudly`): the path is validated (non-empty + absolute)
+ * and the file is read BEFORE any HTTP call, so a bad/missing/unreadable path
+ * throws here and NEVER reaches S3, the DB row, or the projection. An S3 /
+ * server fault on the route surfaces as a 5xx, which the HTTP client throws.
+ */
+export async function issueAttach(client, args, deps = {}) {
+    if (typeof args.file_path !== "string" || args.file_path.trim() === "") {
+        throw new Error("issue_attach: file_path must be a non-empty string");
+    }
+    if (!isAbsolute(args.file_path)) {
+        throw new Error(`issue_attach: file_path must be an absolute path (got "${args.file_path}")`);
+    }
+    const read = deps.readFile ?? readFile;
+    // A missing / unreadable file rejects here — no HTTP call is made, so no
+    // S3 upload, no row insert, and no projection are ever triggered.
+    const bytes = await read(args.file_path);
+    const filename = basename(args.file_path);
+    return client.request({
+        method: "POST",
+        path: `/${encodeURIComponent(args.id)}/attachments`,
+        body: {
+            filename,
+            contentType: inferAttachmentMime(filename),
+            base64: bytes.toString("base64"),
+        },
+        board: args.board,
+    });
+}

package/dist/index.js

@@ -21,6 +21,7 @@
  *   - issue_dependency       POST/DELETE /api/issues/:id/dependencies[/:did]
  *   - issue_requires_human   POST/DELETE /api/issues/:id/requires-human
  *   - issue_retro            PUT    /api/issues/:id/retro
+ *   - issue_attach           POST   /api/issues/:id/attachments (reads a local file)
  *
  * BOARD-ONLY (DX-1171): board is the first-level concept; repo is
  * DERIVED from board server-side, never passed. The package composes the
@@ -49,7 +50,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { DashboardHttpClient } from "./http-client.js";
-import { issueComment, issueCreate, issueDependency, issueEdit, issueGet, issueList, issueRequiresHuman, issueRetro, issueTransition, issueTriage, } from "./handlers.js";
+import { issueAttach, issueComment, issueCreate, issueDependency, issueEdit, issueGet, issueList, issueRequiresHuman, issueRetro, issueTransition, issueTriage, } from "./handlers.js";
 function readEnvOrDie(name) {
     const v = process.env[name];
     if (typeof v !== "string" || v === "") {
@@ -93,6 +94,13 @@ const EFFORT_VALUES = [
 ];
 const ISSUE_TYPES = ["Epic", "Bug", "Feature", "Story", "Chore"];
 const NON_EPIC_TYPES = ["Bug", "Feature", "Story", "Chore"];
+// DX-1290 — the uniform 4-state checklist-item status. Terminal = passing|cancelled.
+const CHECKLIST_ITEM_STATUSES = [
+    "incomplete",
+    "failing",
+    "passing",
+    "cancelled",
+];
 const TRANSITION_ACTIONS = [
     "ready",
     "pickup",
@@ -134,7 +142,7 @@ server.tool("issue_list", "List issues for the dispatch's board by default via G
     ...boardField,
 }, async (args) => jsonResult(await issueList(client, args)));
 // ---------------- issue_get ----------------
-server.tool("issue_get", "Fetch a single hydrated issue via GET /api/issues/:id. Board-scoped; defaults to the dispatch's board. Issue ids are globally unique, so this resolves from any dispatch regardless of `board`. Returns the full card (every joined child collection: ac, comments, dependencies, requires_human steps, retro action items + commits, triage history, quality_gates — DX-1177: one row per registered quality gate {gate, required, status pending|pass|fail, completed_at, message}; a required PRE gate not yet `pass` pre-empts the work dispatch with the gate reviewer, and `issue_transition complete` refuses while a required POST gate row != pass) plus the ancestor chain walked via parent_id. 404 envelope on unknown id.", {
+server.tool("issue_get", "Fetch a single hydrated issue via GET /api/issues/:id. Board-scoped; defaults to the dispatch's board. Issue ids are globally unique, so this resolves from any dispatch regardless of `board`. Returns the full card (every joined child collection: ac [the 2-state facade onto the default \"Acceptance Criteria\" checklist] + checklists [DX-1290: the full named-checklist model — each {name, items:[{label, detail, status: incomplete|failing|passing|cancelled}]}], comments, dependencies, requires_human steps, retro action items + commits, triage history, quality_gates — DX-1177: one row per registered quality gate {gate, required, status pending|pass|fail, completed_at, message}; a required PRE gate not yet `pass` pre-empts the work dispatch with the gate reviewer, and `issue_transition complete` refuses while a required POST gate row != pass) plus the ancestor chain walked via parent_id. 404 envelope on unknown id.", {
     id: z.string().min(1),
     ...boardField,
 }, async (args) => jsonResult(await issueGet(client, args)));
@@ -163,7 +171,7 @@ server.tool("issue_create", "Create a fresh card via POST /api/issues. Board-sco
     ...boardField,
 }, async (args) => jsonResult(await issueCreate(client, args, config.board)));
 // ---------------- issue_edit ----------------
-server.tool("issue_edit", "Patch prose fields only via PATCH /api/issues/:id/edit. ALLOWED keys: title, description, ac, effort_level, parent_id, list_id. ANY OTHER KEY (lifecycle timestamps, triage state, dependencies, retro, requires_human, blocked/dispatch gates) returns 400 with offending_keys[] and a pointer to the dedicated semantic handler — use issue_transition / issue_triage / issue_comment / issue_dependency / issue_requires_human / issue_retro instead. AC replacement is wholesale soft-delete + reinsert with fresh ordinals; check_item_id linkage survives via title match. list_id (DX-1192 / DX-1200) PINS the card to a specific board list. **Pass EITHER a board_lists id OR the list's display NAME (case-insensitive, e.g. a queue name like \"⚙️ Fulfillment Queue\") — the server resolves a name to its id.** Its type MUST match the card's CURRENT derived-status list-type (so to route a ToDo card into a `ready`-type queue, ready it first; mismatch / unknown name or id → 400); pass null to clear the pin (back to default-for-type).", {
+server.tool("issue_edit", "Patch prose fields only via PATCH /api/issues/:id/edit. ALLOWED keys: title, description, ac, checklists, effort_level, parent_id, list_id. ANY OTHER KEY (lifecycle timestamps, triage state, dependencies, retro, requires_human, blocked/dispatch gates) returns 400 with offending_keys[] and a pointer to the dedicated semantic handler — use issue_transition / issue_triage / issue_comment / issue_dependency / issue_requires_human / issue_retro instead. CHECKLISTS (DX-1290): a card carries 0..N named checklists, each item ONE 4-state status `incomplete|failing|passing|cancelled` (terminal = passing|cancelled). `ac` is the 2-state CONVENIENCE onto the default \"Acceptance Criteria\" checklist (checked:true ↔ passing, false ↔ incomplete) — wholesale soft-delete + reinsert of that checklist's items. `checklists` is the GENERIC wholesale write path: it REPLACES every named checklist on the card with full 4-state control (each `{name, items:[{label, detail?, status}]}`) — use it to author named checklists like \"Feature Tests\". Send EITHER `ac` OR `checklists`, NOT both (400). list_id (DX-1192 / DX-1200) PINS the card to a specific board list. **Pass EITHER a board_lists id OR the list's display NAME (case-insensitive, e.g. a queue name like \"⚙️ Fulfillment Queue\") — the server resolves a name to its id.** Its type MUST match the card's CURRENT derived-status list-type (so to route a ToDo card into a `ready`-type queue, ready it first; mismatch / unknown name or id → 400); pass null to clear the pin (back to default-for-type).", {
     id: z.string().min(1),
     title: z.string().min(1).optional(),
     description: z.string().optional(),
@@ -173,6 +181,16 @@ server.tool("issue_edit", "Patch prose fields only via PATCH /api/issues/:id/edi
         checked: z.boolean().optional(),
     }))
         .optional(),
+    checklists: z
+        .array(z.object({
+        name: z.string().min(1),
+        items: z.array(z.object({
+            label: z.string().min(1),
+            detail: z.string().optional(),
+            status: z.enum(CHECKLIST_ITEM_STATUSES),
+        })),
+    }))
+        .optional(),
     effort_level: z.enum(EFFORT_VALUES).nullable().optional(),
     parent_id: z.string().nullable().optional(),
     list_id: z.string().min(1).nullable().optional(),
@@ -241,6 +259,19 @@ server.tool("issue_retro", "Replace the retro block via PUT /api/issues/:id/retr
     })),
     ...boardField,
 }, async (args) => jsonResult(await issueRetro(client, args)));
+// ---------------- issue_attach ----------------
+// The "25 MB" ceiling quoted in the description below tracks the backend
+// route's MAX_DECODED_BYTES (src/issues/write/attachments.ts). This package is
+// a separate published artifact and cannot import that constant, so the number
+// is restated here as prose — keep the two in sync if the backend ceiling moves.
+server.tool("issue_attach", "Attach a LOCAL file to an issue card via POST /api/issues/:id/attachments. Pass `id` (the card) and `file_path` (an ABSOLUTE path to a file on the dispatch's shared filesystem — e.g. a screenshot, exported CSV, or diagram you wrote). This MCP server reads the bytes, infers the MIME type from the extension, and uploads through the dashboard, which: stores the bytes in S3, inserts ONE danxbot-origin issue_attachments row, and auto-mirrors the file to the card's linked Trello card AND its Slack card-view thread (DX-1122 outbound projection) — no extra step needed. Board-scoped; defaults to the dispatch's board. Pass `board` (a qualified id `<repo>:<slug>`) to attach on another board (unknown board → 404). Fail-loud: a relative/empty path is rejected at the MCP boundary, and a missing/unreadable file throws BEFORE any upload (no partial S3 object, no row). 25 MB decoded ceiling (413). Returns the hydrated issue plus the new attachment id.", {
+    id: z.string().min(1),
+    file_path: z
+        .string()
+        .min(1)
+        .describe("Absolute path to a local file on the dispatch's shared filesystem (must start with `/`)."),
+    ...boardField,
+}, async (args) => jsonResult(await issueAttach(client, args)));
 // ---------------- main ----------------
 async function main() {
     const transport = new StdioServerTransport();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Stdio MCP server wrapping danxbot's dashboard /api/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
   "license": "MIT",
   "type": "module",

package/dist/handlers.test.js

@@ -1,51 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { DashboardHttpClient } from "./http-client.js";
-import { issueList, issueTransition } from "./handlers.js";
-/**
- * `issue_list` query-param forwarding. A fake `fetch` captures the built
- * URL so each filter is asserted at the wire, through the real client's
- * URL builder (`?repo=` always stamped, extra query merged after).
- */
-function clientCapturing() {
-    const urls = [];
-    const fetchImpl = (async (url) => {
-        urls.push(url);
-        return new Response(JSON.stringify({ issues: [] }), { status: 200 });
-    });
-    const client = new DashboardHttpClient({ baseUrl: "http://localhost:5555", repo: "danxbot", token: "t" }, fetchImpl);
-    return { client, urls };
-}
-describe("issueList — query forwarding", () => {
-    it("forwards q as the server-side search needle", async () => {
-        const { client, urls } = clientCapturing();
-        await issueList(client, { q: "retire" });
-        expect(urls[0]).toContain("q=retire");
-    });
-    it("omits q when not provided", async () => {
-        const { client, urls } = clientCapturing();
-        await issueList(client, { include_closed: true });
-        expect(urls[0]).not.toContain("q=");
-        expect(urls[0]).toContain("include_closed=true");
-    });
-});
-describe("issueTransition — body forwarding", () => {
-    function clientCapturingBody() {
-        const bodies = [];
-        const fetchImpl = (async (_url, init) => {
-            bodies.push(JSON.parse(String(init?.body ?? "{}")));
-            return new Response(JSON.stringify({ issue: {} }), { status: 200 });
-        });
-        const client = new DashboardHttpClient({ baseUrl: "http://localhost:5555", repo: "danxbot", token: "t" }, fetchImpl);
-        return { client, bodies };
-    }
-    it("forwards manual: true on pickup (DX-946 operator self-pickup)", async () => {
-        const { client, bodies } = clientCapturingBody();
-        await issueTransition(client, { id: "DX-1", action: "pickup", manual: true });
-        expect(bodies[0]).toEqual({ action: "pickup", manual: true });
-    });
-    it("omits manual when not provided", async () => {
-        const { client, bodies } = clientCapturingBody();
-        await issueTransition(client, { id: "DX-1", action: "pickup" });
-        expect(bodies[0]).toEqual({ action: "pickup" });
-    });
-});