@thehammer/danx-dashboard-mcp 0.1.168 → 0.1.170

package/README.md

@@ -1,8 +1,8 @@
 # @thehammer/danx-dashboard-mcp
 
-Stdio MCP server wrapping danxbot's dashboard `/api/issues/*` normalized DB-backed HTTP routes. Replaces the legacy "agents Edit/Write `.yml` files directly" pattern from before DX-704 / DX-811.
+Stdio MCP server fronting danxbot's dashboard HTTP API. Since DX-3465 it exposes three generic tools (`danxbot_api`, `danxbot_api_list`, `danxbot_api_spec` — see "Tool surface" below) that reach any route the caller's credential may reach, plus a handful of dedicated tools for agent-specific operations (`plan_connect`, `danxbot_complete`, Slack/template-app callbacks, …) — there is no per-operation tool any more.
 
-Each tool is a thin envelope over one HTTP route — Zod-validated at the MCP boundary, fetch under the hood, server response passed back to the agent verbatim. Refusal envelopes (`{error, ...extra}` with `failed_gate`, `non_terminal_phases`, `offending_keys`, etc.) come through as `{ok: false, status, body}` so the agent can pick the right next action without guessing. 5xx and network failures throw.
+`danxbot_api` is Zod-validated at the MCP boundary, fetches under the hood, and passes the server response back to the agent verbatim. Refusal envelopes (`{error, ...extra}` with `failed_gate`, `non_terminal_phases`, `offending_keys`, etc.) come through as `{ok: false, status, body}` so the agent can pick the right next action without guessing. 5xx and network failures throw.
 
 ## Env vars (required, fail-loud at boot)
 

package/dist/http-client.js

@@ -102,19 +102,14 @@ export class DashboardHttpClient {
             for (const [k, v] of Object.entries(extraQuery)) {
                 if (v === undefined || v === null)
                     continue;
-                // DX-3465 round 2 (code-quality gate finding, at 27c9e4005) — a
-                // field TREE (`fields`, a plain object) is the only query param the
-                // server parses as JSON (`src/resources/field-tree.ts`); every
-                // LIST-valued param it has (`ids` on `GET /api/issues/batch`,
-                // `status` on the boards list, `endpoints` on `GET /api/openapi`)
-                // splits on commas instead. Round 1 JSON-encoded both objects and
-                // arrays alike, which silently broke every array-valued param: the
-                // server saw a JSON literal where it expected a comma list and
-                // returned a wrong-but-200 answer (e.g. `ids=["DX-1","DX-2"]`
-                // resolves zero cards) instead of the old loud zod refusal. Arrays
-                // are `typeof "object"` too, so they must be checked BEFORE the
-                // plain-object branch. A plain scalar still stringifies the same
-                // way it always did.
+                // DX-3465 — a field TREE (`fields`, a plain object) is the only
+                // query param the server parses as JSON
+                // (`src/resources/field-tree.ts`); every LIST-valued param it has
+                // (`ids` on `GET /api/issues/batch`, `status` on the boards list,
+                // `endpoints` on `GET /api/openapi`) splits on commas instead, never
+                // JSON. Arrays are `typeof "object"` too, so the array check must
+                // come BEFORE the plain-object branch. A plain scalar stringifies
+                // as before.
                 params.set(k, Array.isArray(v)
                     ? v.map((item) => String(item)).join(",")
                     : typeof v === "object"

package/dist/index.js

@@ -84,6 +84,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { DashboardHttpClient } from "./http-client.js";
 import { planConnect, danxbotApi, danxbotApiList, danxbotApiSpec, attachFile, DANXBOT_API_METHODS, } from "./handlers.js";
+import { queryValueSchema } from "./types.js";
 import { registerLifecycleTools, applyLifecycleVisibility, readLifecycleUrlsFromEnv, } from "./lifecycle.js";
 function readEnvOrDie(name) {
     const v = process.env[name];
@@ -337,28 +338,16 @@ strictTool("danxbot_api", "Call any dashboard API route your credential may reac
         .min(1)
         .startsWith("/api/")
         .describe('Full path starting with "/api/" — never a route template.'),
-    // DX-3465 (code-quality gate finding, at 275f82c0d) — a query value may
-    // be a field TREE (a plain object, e.g.
-    // `{"description":true,"comments":{"limit":20}}`), not just a scalar —
-    // SERVER_INSTRUCTIONS below says "ALWAYS pass `fields` … a field tree"
-    // and the OpenAPI spec agrees (`fields`'s schema is `{type:"object"}`),
-    // so the schema here must accept what those two tell the caller to
-    // send. It may also be an array (e.g. `ids` on the batch-get route) —
-    // DX-3465 round 2 (code-quality gate finding, at 27c9e4005) —
-    // `DashboardHttpClient#buildUrl` JSON-encodes a plain-object value but
+    // DX-3465 — a query value may be a scalar, a field TREE (a plain
+    // object, e.g. `{"description":true,"comments":{"limit":20}}` — see
+    // SERVER_INSTRUCTIONS below and the OpenAPI spec's `fields` schema), or
+    // an array of scalars (e.g. `ids` on the batch-get route).
+    // `DashboardHttpClient#buildUrl` JSON-encodes a plain object but
     // comma-joins an array, matching the two shapes the server actually
-    // parses (a JSON field tree vs. a comma-separated list param); a scalar
-    // serializes as before.
-    query: z
-        .record(z.union([
-        z.string(),
-        z.number(),
-        z.boolean(),
-        z.null(),
-        z.record(z.unknown()),
-        z.array(z.unknown()),
-    ]))
-        .optional(),
+    // parses (a JSON field tree vs. a comma-separated list param) — so array
+    // elements are restricted to scalars, the only thing a comma-join can
+    // represent losslessly.
+    query: queryValueSchema.optional(),
     body: z.unknown().optional(),
     ...boardField,
 }, async (args) => jsonResult(await danxbotApi(client, args)));

package/dist/types.js

@@ -1 +1,16 @@
-export {};
+import { z } from "zod";
+/**
+ * The zod schema for `danxbot_api`'s `query` argument, matching the
+ * `QueryValue` type above — a scalar, a field-tree object, or an array
+ * whose elements are themselves scalars (never objects; a comma-join
+ * cannot represent one losslessly). Exported so it can be exercised
+ * directly in tests without going through the MCP tool-call machinery.
+ */
+export const queryValueSchema = z.record(z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.record(z.unknown()),
+    z.array(z.union([z.string(), z.number(), z.boolean()])),
+]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.168",
+  "version": "0.1.170",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",