@thehammer/danx-dashboard-mcp 0.1.165 → 0.1.168

package/README.md

@@ -24,7 +24,8 @@ All exposed as `mcp__danx-dashboard__<name>` once wired through the workspace `m
 | `danxbot_api` | `{method, path, query?, body?}` — calls any dashboard route the caller's credential may reach (card/plan CRUD, comments, dependencies, problems/solutions, quality gates, retro, triage, transitions, …). Returns `{ok, status, body}`; `body` carries the route's own response, or its structured error verbatim when `ok:false`. |
 | `danxbot_api_list` | No args. Lists the routes this caller's credential may reach, one line each (`{method, path, summary, permission}`) — call this first when you don't know the route for what you need to do. |
 | `danxbot_api_spec` | `{endpoints}` (comma-joined `METHOD /path` list, required, min 1). Returns the exact OpenAPI contract for those routes — call this when you know the route but not its exact request/response shape. |
-| `resource_fields` | `GET /api/resources/:resource/fields` — what an opt-in field TREE may name for one resource: `{resource, description, always, hashes, fields, relations}`. Install-global, no `board`. `resource: "issue"` is the root; a relation's own `resource` in the response is what to call this again with, one level deeper. |
+
+There is no dedicated `resource_fields` tool (removed DX-3465 — it was a thin wrapper `danxbot_api` already reaches with no agent-specific behavior earning it its own tool). What an opt-in field TREE may name for one resource (`{resource, description, always, hashes, fields, relations}`) is `danxbot_api({method:"GET", path:"/api/resources/<resource>/fields"})` — install-global, no `board`; `resource: "issue"` is the root, and a relation's own `resource` in the response is what to call this again with, one level deeper.
 
 A dedicated tool survives only for something about the agent itself, never a card/plan operation: `plan_connect` (binds the session to a plan; the event-bridge hook keys on it) and the per-dispatch worker callbacks (`danxbot_complete`, `danxbot_slack_reply`, `danxbot_slack_post_update`, `load_template_app`/`save_template_app`, `quality_gate_complete`, `link_thread_to_issue`, `attach_file`, the `slack_recovery_*` trio, `danxbot_set_evaluator_summary`) — see `src/lifecycle.ts`. The live list is always `tool-defs.json` in this package, regenerated by `npm run gen-tool-defs` — read it rather than trusting a list copied into prose.
 

package/dist/http-client.js

@@ -102,16 +102,24 @@ export class DashboardHttpClient {
             for (const [k, v] of Object.entries(extraQuery)) {
                 if (v === undefined || v === null)
                     continue;
-                // DX-3465 (code-quality gate finding, at 275f82c0d) — a field TREE
-                // (`fields`, and any other tree-shaped route param) arrives here as a
-                // real object/array, not a string; `String(v)` on either produces
-                // the useless literal "[object Object]" (objects) or a comma-joined
-                // list that drops all nesting (arrays). JSON-encode both so the
-                // server's own `fields=` query-string parser (which expects exactly
-                // this shape — see `src/dashboard/...` field-tree route handling)
-                // receives what it can actually parse; a plain scalar still
-                // stringifies the same way it always did.
-                params.set(k, typeof v === "object" ? JSON.stringify(v) : String(v));
+                // DX-3465 round 2 (code-quality gate finding, at 27c9e4005) — a
+                // field TREE (`fields`, a plain object) is the only query param the
+                // server parses as JSON (`src/resources/field-tree.ts`); every
+                // LIST-valued param it has (`ids` on `GET /api/issues/batch`,
+                // `status` on the boards list, `endpoints` on `GET /api/openapi`)
+                // splits on commas instead. Round 1 JSON-encoded both objects and
+                // arrays alike, which silently broke every array-valued param: the
+                // server saw a JSON literal where it expected a comma list and
+                // returned a wrong-but-200 answer (e.g. `ids=["DX-1","DX-2"]`
+                // resolves zero cards) instead of the old loud zod refusal. Arrays
+                // are `typeof "object"` too, so they must be checked BEFORE the
+                // plain-object branch. A plain scalar still stringifies the same
+                // way it always did.
+                params.set(k, Array.isArray(v)
+                    ? v.map((item) => String(item)).join(",")
+                    : typeof v === "object"
+                        ? JSON.stringify(v)
+                        : String(v));
             }
         }
         return `${base}${basePath}${cleanPath}?${params.toString()}`;

package/dist/index.js

@@ -338,13 +338,17 @@ strictTool("danxbot_api", "Call any dashboard API route your credential may reac
         .startsWith("/api/")
         .describe('Full path starting with "/api/" — never a route template.'),
     // DX-3465 (code-quality gate finding, at 275f82c0d) — a query value may
-    // be a field TREE (a plain object or array, e.g.
+    // be a field TREE (a plain object, e.g.
     // `{"description":true,"comments":{"limit":20}}`), not just a scalar —
     // SERVER_INSTRUCTIONS below says "ALWAYS pass `fields` … a field tree"
     // and the OpenAPI spec agrees (`fields`'s schema is `{type:"object"}`),
     // so the schema here must accept what those two tell the caller to
-    // send. `DashboardHttpClient#buildUrl` JSON-encodes an object/array
-    // value into the query string; a scalar serializes as before.
+    // send. It may also be an array (e.g. `ids` on the batch-get route) —
+    // DX-3465 round 2 (code-quality gate finding, at 27c9e4005) —
+    // `DashboardHttpClient#buildUrl` JSON-encodes a plain-object value but
+    // comma-joins an array, matching the two shapes the server actually
+    // parses (a JSON field tree vs. a comma-separated list param); a scalar
+    // serializes as before.
     query: z
         .record(z.union([
         z.string(),
@@ -420,7 +424,7 @@ strictTool("attach_file", "Attach a LOCAL file to a card: `card_id` + `path` (an
 // no existing plan for an id to name yet.
 strictTool("plan_connect", 
 // DX-2735: trimmed with the problem tools to stay inside the work-profile budget.
-"Connect THIS session to a plan. ONE CALL IS ENOUGH TO START: the reply carries `{session, movedFrom, browserInstruction, briefing, listenerHealth}` — `browserInstruction` is a server-built action to take NOW: it names the plan's URL and tells you to open it (in-app browser if you have one, else default), keep that tab open for the whole session without navigating it away, and use a different tab for your own browsing — the operator's tab for following and talking to you. Returned on every connect, including a re-connect, so it doubles as the post-context-loss reminder. `briefing` is every goal/rule/caveat (ref+body), every architecture section (id+title), the plan's own ref/name/status, a first page of open cards (id/type/status/title/openProblemCount/assignedAgent) with a `morePagesHint` when more exist, and the closed-card count — usually replacing the plan read + card batch-read a fresh session used to need. A session is on AT MOST ONE plan: connecting elsewhere MOVES it, and `movedFrom: {id, name} | null` says which plan it left (null = no plan, or already this one). Binds only your OWN session, resolved from the session id this server forwards; afterwards every plan WRITE tool acts on this plan and takes no plan id. `listenerHealth` reports the event bridge's state — `null` (no session), or `{attached, state: \"unattached\"|\"credential_mismatch\"|\"healthy\", nextStep}` naming a concrete fix per unhealthy state (same shape the plan list/get routes report). Once healthy, every comment, answer, problem added and block/unblock on this plan's cards reaches the session unpolled, relayed by the plugin's event bridge as a line like `[DX-8 \"Title\" repo:board] newms87 answered \"<statement>\": chose \"Pause E2E\"`. Pass `title` (call `get_session({session_id:\"self\"})` first and forward its `title` verbatim) so the dashboard shows the same name Claude does — this server cannot read it itself. The response's `reminders[]` (when present) carries the mantra — read and follow it.", {
+"Connect THIS session to a plan. ONE CALL IS ENOUGH TO START: the reply carries `{session, movedFrom, browserInstruction, briefing, listenerHealth}` — `browserInstruction` is a server-built action to take NOW: it names the plan's URL and tells you to open it (in-app browser if you have one, else default), keep that tab open for the whole session without navigating it away, and use a different tab for your own browsing — the operator's tab for following and talking to you. Returned on every connect, including a re-connect, so it doubles as the post-context-loss reminder. `briefing` is every goal/rule/caveat (ref+body), every architecture section (id+title), the plan's own ref/name/status, a first page of open cards (id/type/status/title/openProblemCount/assignedAgent) with a `morePagesHint` when more exist, and the closed-card count — usually replacing the plan read + card batch-read a fresh session used to need. A session is on AT MOST ONE plan: connecting elsewhere MOVES it, and `movedFrom: {id, name} | null` says which plan it left (null = no plan, or already this one). Binds only your OWN session, resolved from the session id this server forwards; afterwards a `danxbot_api` call to a `/api/plans/mine/...` route (there is no dedicated plan-write tool) acts on this plan and takes no plan id. `listenerHealth` reports the event bridge's state — `null` (no session), or `{attached, state: \"unattached\"|\"credential_mismatch\"|\"healthy\", nextStep}` naming a concrete fix per unhealthy state (same shape the plan list/get routes report). Once healthy, every comment, answer, problem added and block/unblock on this plan's cards reaches the session unpolled, relayed by the plugin's event bridge as a line like `[DX-8 \"Title\" repo:board] newms87 answered \"<statement>\": chose \"Pause E2E\"`. Pass `title` (call `get_session({session_id:\"self\"})` first and forward its `title` verbatim) so the dashboard shows the same name Claude does — this server cannot read it itself. The response's `reminders[]` (when present) carries the mantra — read and follow it.", {
     plan_id: z.number().int().positive().describe("The plan id, from the plans list (`danxbot_api` `GET /api/plans`)."),
     title: z
         .string()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.165",
+  "version": "0.1.168",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",
@@ -21,7 +21,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json && node -e \"require('fs').chmodSync('dist/index.js', 0o755)\"",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && node -e \"require('fs').chmodSync('dist/index.js', 0o755)\"",
     "verify:boot": "bash scripts/verify-boot.sh",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",

package/dist/field-tree.js

@@ -1,45 +0,0 @@
-/**
- * DX-3426 — the shared recursive FIELD-TREE shape.
- *
- * The dashboard's single-card, batch card and plan reads (`danxbot_api`
- * against `GET /api/issues/:id`, `GET /api/issues`, `GET /api/plans/:planId`
- * — DX-3428) take a nested JSON tree instead of a
- * flat field-GROUP list: each key names a field or relation of the resource
- * at that level, and each value is either `true` (the field, or a relation's
- * child with its default fields), a non-negative integer (a cursor-paged
- * relation's own `limit` argument), an opaque cursor STRING (a paged
- * relation's `before` — DX-3428: not every relation's cursor is a plain
- * integer, e.g. a plan event's visibility-scanned row id), a non-empty
- * STRING or ARRAY OF STRINGS (a relation's own declared, non-paging argument
- * — e.g. `records`' `kind`, `events`' `kinds`/`origin`/`writer`), or another
- * field tree (a relation's child with a NAMED field selection). Example:
- *
- *   {"description": true, "ac": true, "problems": {"solutions": {"steps": true}, "decisions": true}, "comments": {"limit": 10}, "records": {"kind": "goal"}}
- *
- * One schema, one module — every tool that accepts a field tree imports THIS
- * export rather than redeclaring the shape, so the recursion is defined once
- * and every caller's JSON Schema serializes the same way. `z.lazy` is
- * required because the schema refers to itself; `zod-to-json-schema` (the
- * MCP SDK's own zod v3 → JSON Schema converter, see
- * `@modelcontextprotocol/sdk`'s `zod-json-schema-compat.ts`) resolves that
- * self-reference to a local `$ref` rather than unrolling it infinitely —
- * verified directly against the listed tool schema in
- * `__tests__/tool-defs.test.ts`, not assumed from reading the library's
- * source. The problem-solutions route's pre-existing `steps` field (DX-3310)
- * is the same `z.lazy` self-reference pattern already shipping on this server.
- */
-import { z } from "zod";
-/**
- * The shared schema. A record whose values are `true`, a non-negative
- * integer, a non-empty string, a non-empty array of non-empty strings, or
- * the same schema recursively — generic on purpose (no issue/plan-specific
- * field names baked in here) so every tool that reads a resource tree
- * reuses it unchanged.
- */
-export const fieldTreeSchema = z.lazy(() => z.record(z.union([
-    z.literal(true),
-    z.number().int().nonnegative(),
-    z.string().min(1),
-    z.array(z.string().min(1)).min(1),
-    fieldTreeSchema,
-])));

package/dist/priority.js

@@ -1,70 +0,0 @@
-/**
- * Tier-word → numeric priority resolution for `danxbot_api`'s
- * `PATCH /api/issues/:id/edit` route (DX-1532).
- *
- * Priority is a STRUCTURED numeric column `issues.priority` (float in `[0,6)`).
- * Both the Trello "priority" label and the dashboard priority badge read it via
- * `priorityTier(issue.priority)` — description PROSE ("Priority: Low") is read
- * by neither. So an agent that "sets priority" by editing description text
- * produces a silent false-positive: nothing downstream changes. The fix is to
- * let the agent write the numeric column through the issue-edit route.
- *
- * Agents (and operators) speak in tier WORDS ("low" / "high"), so the tool
- * accepts a tier word and resolves it to the tier's MIDPOINT here — the inverse
- * of `src/issue-tracker/priority-tier.ts#priorityTier`. A raw numeric is passed
- * through unchanged for the server route to range-validate (it 400s on
- * out-of-`[0,6)`), so the MCP boundary never has to duplicate that bound.
- *
- * This package is a standalone published artifact and cannot import the
- * backend's `priority-tier` module, so the midpoint table is duplicated here.
- * Each value IS the `[min,max)` bucket midpoint by construction and equals the
- * backend's `PRIORITY_TIERS.defaultValue`; `src/issue-tracker/priority-tier.test.ts`
- * asserts `priorityTier(defaultValue) === key` on the canonical side, pinning
- * the round-trip these midpoints rely on.
- */
-/**
- * The six priority tier words, low → high. A const tuple so it doubles as the
- * `z.enum` source in `index.ts`.
- */
-export const PRIORITY_TIER_WORDS = [
-    "lowest",
-    "low",
-    "medium",
-    "high",
-    "very_high",
-    "critical",
-];
-/**
- * Tier word → bucket midpoint (inverse of `priorityTier`). Lands the numeric
- * column squarely inside the requested tier so a later `priorityTier` read
- * returns the same word.
- */
-export const PRIORITY_TIER_MIDPOINTS = {
-    lowest: 0.5,
-    low: 1.5,
-    medium: 2.5,
-    high: 3.5,
-    very_high: 4.5,
-    critical: 5.5,
-};
-/**
- * Resolve a priority input — a tier WORD or a raw numeric — to the numeric
- * value the `PATCH /api/issues/:id/edit` route stores in `issues.priority`.
- *
- * - tier word → its bucket midpoint (`PRIORITY_TIER_MIDPOINTS`).
- * - number → passed through unchanged; the server route range-validates it to
- *   `[0,6)` and 400s otherwise (the MCP boundary deliberately does not
- *   re-validate the bound — single source of truth on the route).
- * - unknown string → throws here at the MCP boundary (no round-trip). The Zod
- *   enum on the tool schema already rejects this for tool callers; the explicit
- *   throw keeps the helper safe for any direct caller.
- */
-export function resolvePriority(input) {
-    if (typeof input === "number")
-        return input;
-    const midpoint = PRIORITY_TIER_MIDPOINTS[input];
-    if (midpoint === undefined) {
-        throw new Error(`issue-edit: unknown priority tier word "${input}" (expected one of ${PRIORITY_TIER_WORDS.join(", ")} or a number in [0,6))`);
-    }
-    return midpoint;
-}