@thehammer/danx-dashboard-mcp 0.1.17 → 0.1.19

package/dist/handlers.js

@@ -1,3 +1,28 @@
+/**
+ * Per-tool handlers for the dashboard MCP server.
+ *
+ * Each handler is a pure async function: validate args (Zod at the MCP
+ * boundary), build the HTTP request the corresponding `/api/issues/*`
+ * route expects, and pass the envelope back to the caller verbatim.
+ *
+ * BOARD-ONLY (DX-1171): board is the first-level concept; repo is
+ * DERIVED from board server-side, never passed. Every handler accepts an
+ * optional `board` arg — a qualified board id (`<repo>:<slug>`). When
+ * set, it overrides the dispatch's configured board for that single call
+ * (forwarded as `?board=<board>` — and into `body.board` for create — so
+ * an agent can target any board). Omitted → falls back to the dispatch's
+ * env-derived board. The dashboard route validates the board (owning
+ * board→repo) and 404s on unknown; the MCP forwards the refusal envelope
+ * verbatim, never duplicates validation.
+ *
+ * Zero transformation of the server response. Refusal payloads carry
+ * structured detail (`failed_gate`, `non_terminal_phases`,
+ * `offending_keys`, `received_reason`, etc.) that the agent uses to
+ * decide its next move; swallowing any of it would force the agent to
+ * guess.
+ */
+import { readFile } from "node:fs/promises";
+import { basename, extname, isAbsolute } from "node:path";
 export async function issueList(client, args) {
     // status_derived is display-only on the server but the route accepts
     // it as a projection filter — passthrough verbatim. parent_id=null is
@@ -180,6 +205,111 @@ export async function issueDependency(client, args) {
         board,
     });
 }
+/**
+ * DX-1362 — targeted checklist CUD. Action-dispatched onto the
+ * `/api/issues/:id/checklists[/:cid[/items[/:iid]]]` route family so an agent
+ * mutates ONE checklist or item without the wholesale `issue_edit({checklists})`
+ * replace (which silently drops any omitted checklist + churns every item id).
+ * A missing required arg for the chosen action throws at this boundary (no
+ * round-trip). The dashboard's structured error envelope passes through verbatim.
+ */
+export async function issueChecklist(client, args) {
+    const idEnc = encodeURIComponent(args.id);
+    const board = args.board;
+    switch (args.action) {
+        case "add_list": {
+            if (typeof args.name !== "string") {
+                throw new Error("issue_checklist action=add_list requires name");
+            }
+            const body = { name: args.name };
+            if (args.items !== undefined)
+                body.items = args.items;
+            return client.request({
+                method: "POST",
+                path: `/${idEnc}/checklists`,
+                body,
+                board,
+            });
+        }
+        case "update_list": {
+            if (args.checklist_id === undefined) {
+                throw new Error("issue_checklist action=update_list requires checklist_id");
+            }
+            if (typeof args.name !== "string") {
+                throw new Error("issue_checklist action=update_list requires name");
+            }
+            return client.request({
+                method: "PATCH",
+                path: `/${idEnc}/checklists/${args.checklist_id}`,
+                body: { name: args.name },
+                board,
+            });
+        }
+        case "remove_list": {
+            if (args.checklist_id === undefined) {
+                throw new Error("issue_checklist action=remove_list requires checklist_id");
+            }
+            return client.request({
+                method: "DELETE",
+                path: `/${idEnc}/checklists/${args.checklist_id}`,
+                board,
+            });
+        }
+        case "add_item": {
+            if (args.checklist_id === undefined) {
+                throw new Error("issue_checklist action=add_item requires checklist_id");
+            }
+            if (typeof args.label !== "string") {
+                throw new Error("issue_checklist action=add_item requires label");
+            }
+            const body = { label: args.label };
+            if (args.detail !== undefined)
+                body.detail = args.detail;
+            if (args.status !== undefined)
+                body.status = args.status;
+            return client.request({
+                method: "POST",
+                path: `/${idEnc}/checklists/${args.checklist_id}/items`,
+                body,
+                board,
+            });
+        }
+        case "update_item": {
+            if (args.checklist_id === undefined) {
+                throw new Error("issue_checklist action=update_item requires checklist_id");
+            }
+            if (args.item_id === undefined) {
+                throw new Error("issue_checklist action=update_item requires item_id");
+            }
+            const body = {};
+            if (args.label !== undefined)
+                body.label = args.label;
+            if (args.detail !== undefined)
+                body.detail = args.detail;
+            if (args.status !== undefined)
+                body.status = args.status;
+            return client.request({
+                method: "PATCH",
+                path: `/${idEnc}/checklists/${args.checklist_id}/items/${args.item_id}`,
+                body,
+                board,
+            });
+        }
+        case "remove_item": {
+            if (args.checklist_id === undefined) {
+                throw new Error("issue_checklist action=remove_item requires checklist_id");
+            }
+            if (args.item_id === undefined) {
+                throw new Error("issue_checklist action=remove_item requires item_id");
+            }
+            return client.request({
+                method: "DELETE",
+                path: `/${idEnc}/checklists/${args.checklist_id}/items/${args.item_id}`,
+                board,
+            });
+        }
+    }
+}
 export async function issueRequiresHuman(client, args) {
     const idEnc = encodeURIComponent(args.id);
     const board = args.board;
@@ -212,3 +342,70 @@ export async function issueRetro(client, args) {
         board,
     });
 }
+/**
+ * Extension → MIME map for the agent-attached file types that matter for
+ * downstream rendering (image previews in the dashboard drawer, Trello card,
+ * and Slack thread all key on the persisted `mime`). This package is a
+ * standalone published artifact and cannot import the backend's helpers, so
+ * the small map lives here. An unknown extension resolves to the generic
+ * octet-stream — a sensible default for "we don't know the type", NOT a
+ * silenced error (the bytes still upload + the row is still written).
+ */
+const MIME_BY_EXT = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".csv": "text/csv",
+    ".txt": "text/plain",
+    ".log": "text/plain",
+    ".md": "text/markdown",
+    ".json": "application/json",
+    ".html": "text/html",
+    ".zip": "application/zip",
+    ".gz": "application/gzip",
+    ".tgz": "application/gzip",
+};
+export function inferAttachmentMime(filename) {
+    return MIME_BY_EXT[extname(filename).toLowerCase()] ?? "application/octet-stream";
+}
+/**
+ * Attach a local file to an issue card. Reads the bytes from the dispatch's
+ * shared filesystem (this MCP server runs co-located with the agent), then
+ * forwards to the dashboard's `POST /api/issues/:id/attachments` route — the
+ * SAME ingest the dashboard UI upload uses, which uploads to S3, inserts ONE
+ * danxbot-origin `issue_attachments` row (`source_type=''`), and publishes
+ * `issue:updated` so the DX-1122 outbound projection mirrors the file to both
+ * the linked Trello card and the Slack card-view thread.
+ *
+ * Fail-loud (`base:fail-loudly`): the path is validated (non-empty + absolute)
+ * and the file is read BEFORE any HTTP call, so a bad/missing/unreadable path
+ * throws here and NEVER reaches S3, the DB row, or the projection. An S3 /
+ * server fault on the route surfaces as a 5xx, which the HTTP client throws.
+ */
+export async function issueAttach(client, args, deps = {}) {
+    if (typeof args.file_path !== "string" || args.file_path.trim() === "") {
+        throw new Error("issue_attach: file_path must be a non-empty string");
+    }
+    if (!isAbsolute(args.file_path)) {
+        throw new Error(`issue_attach: file_path must be an absolute path (got "${args.file_path}")`);
+    }
+    const read = deps.readFile ?? readFile;
+    // A missing / unreadable file rejects here — no HTTP call is made, so no
+    // S3 upload, no row insert, and no projection are ever triggered.
+    const bytes = await read(args.file_path);
+    const filename = basename(args.file_path);
+    return client.request({
+        method: "POST",
+        path: `/${encodeURIComponent(args.id)}/attachments`,
+        body: {
+            filename,
+            contentType: inferAttachmentMime(filename),
+            base64: bytes.toString("base64"),
+        },
+        board: args.board,
+    });
+}

package/dist/index.js

@@ -18,9 +18,11 @@
  *   - issue_transition       POST   /api/issues/:id/transition
  *   - issue_triage           POST   /api/issues/:id/triage
  *   - issue_comment          POST/PATCH/DELETE /api/issues/:id/comments[/:cid]
+ *   - issue_checklist        POST/PATCH/DELETE /api/issues/:id/checklists[/:cid[/items[/:iid]]]
  *   - issue_dependency       POST/DELETE /api/issues/:id/dependencies[/:did]
  *   - issue_requires_human   POST/DELETE /api/issues/:id/requires-human
  *   - issue_retro            PUT    /api/issues/:id/retro
+ *   - issue_attach           POST   /api/issues/:id/attachments (reads a local file)
  *
  * BOARD-ONLY (DX-1171): board is the first-level concept; repo is
  * DERIVED from board server-side, never passed. The package composes the
@@ -49,7 +51,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { DashboardHttpClient } from "./http-client.js";
-import { issueComment, issueCreate, issueDependency, issueEdit, issueGet, issueList, issueRequiresHuman, issueRetro, issueTransition, issueTriage, } from "./handlers.js";
+import { issueAttach, issueChecklist, issueComment, issueCreate, issueDependency, issueEdit, issueGet, issueList, issueRequiresHuman, issueRetro, issueTransition, issueTriage, } from "./handlers.js";
 function readEnvOrDie(name) {
     const v = process.env[name];
     if (typeof v !== "string" || v === "") {
@@ -228,6 +230,31 @@ server.tool("issue_comment", "Comment CRUD via /api/issues/:id/comments[/:cid].
     text: z.string().min(1).optional(),
     ...boardField,
 }, async (args) => jsonResult(await issueComment(client, args)));
+// ---------------- issue_checklist ----------------
+const CHECKLIST_ITEM_INPUT = z.object({
+    label: z.string().min(1),
+    detail: z.string().optional(),
+    status: z.enum(CHECKLIST_ITEM_STATUSES).optional(),
+});
+server.tool("issue_checklist", "Targeted checklist CUD via /api/issues/:id/checklists[/:cid[/items[/:iid]]] (DX-1362). Mutates ONE checklist or item WITHOUT the wholesale `issue_edit({checklists})` replace — use this for the common case (flip an item's status, add/rename a checklist, add/edit/remove an item); the wholesale path silently DROPS any checklist you omit and churns every item id (orphaning its Trello mirror), so prefer this for single-item changes. Action-dispatched: add_list (POST :id/checklists {name, items?}) — create a named checklist, optionally with initial items; update_list (PATCH :id/checklists/:cid {name}) — rename; remove_list (DELETE :id/checklists/:cid) — soft-delete the checklist (audit trail preserved); add_item (POST :id/checklists/:cid/items {label, detail?, status?}) — append an item (status defaults `incomplete`); update_item (PATCH :id/checklists/:cid/items/:iid {label?, detail?, status?}) — change ONLY the fields you pass, in place (the item keeps its id + Trello linkage; at least one field required); remove_item (DELETE :id/checklists/:cid/items/:iid) — soft-delete one item. 4-state status: incomplete|failing|passing|cancelled (terminal = passing|cancelled). checklist_id is required for every action except add_list; item_id for update_item/remove_item. Each returns the {ok,status,body} envelope; unknown card/checklist/item → 404, invalid status → 400. ADDITIVE — the wholesale `issue_edit({checklists})` path stays for bulk authoring.", {
+    id: z.string().min(1),
+    action: z.enum([
+        "add_list",
+        "update_list",
+        "remove_list",
+        "add_item",
+        "update_item",
+        "remove_item",
+    ]),
+    checklist_id: z.number().int().positive().optional(),
+    item_id: z.number().int().positive().optional(),
+    name: z.string().min(1).optional(),
+    items: z.array(CHECKLIST_ITEM_INPUT).optional(),
+    label: z.string().min(1).optional(),
+    detail: z.string().optional(),
+    status: z.enum(CHECKLIST_ITEM_STATUSES).optional(),
+    ...boardField,
+}, async (args) => jsonResult(await issueChecklist(client, args)));
 // ---------------- issue_dependency ----------------
 server.tool("issue_dependency", "Dependency CRUD via /api/issues/:id/dependencies[/:did]. action=add → POST {kind, target_id, reason} where kind ∈ {depends_on, conflict_on}. depends_on adds are CYCLE-CHECKED (BFS from target back to source — 409 if loop). Idempotent: re-adding a live triple returns the existing id. Self-loops refuse 409. action=remove → DELETE /:did. The server REQUIRES the literal reason=\"recorded_in_error\" on removal (encodes \"removal means NOT related, never satisfied\") — this MCP boundary hardcodes it, so callers do not pass reason on remove.", {
     id: z.string().min(1),
@@ -258,6 +285,19 @@ server.tool("issue_retro", "Replace the retro block via PUT /api/issues/:id/retr
     })),
     ...boardField,
 }, async (args) => jsonResult(await issueRetro(client, args)));
+// ---------------- issue_attach ----------------
+// The "25 MB" ceiling quoted in the description below tracks the backend
+// route's MAX_DECODED_BYTES (src/issues/write/attachments.ts). This package is
+// a separate published artifact and cannot import that constant, so the number
+// is restated here as prose — keep the two in sync if the backend ceiling moves.
+server.tool("issue_attach", "Attach a LOCAL file to an issue card via POST /api/issues/:id/attachments. Pass `id` (the card) and `file_path` (an ABSOLUTE path to a file on the dispatch's shared filesystem — e.g. a screenshot, exported CSV, or diagram you wrote). This MCP server reads the bytes, infers the MIME type from the extension, and uploads through the dashboard, which: stores the bytes in S3, inserts ONE danxbot-origin issue_attachments row, and auto-mirrors the file to the card's linked Trello card AND its Slack card-view thread (DX-1122 outbound projection) — no extra step needed. Board-scoped; defaults to the dispatch's board. Pass `board` (a qualified id `<repo>:<slug>`) to attach on another board (unknown board → 404). Fail-loud: a relative/empty path is rejected at the MCP boundary, and a missing/unreadable file throws BEFORE any upload (no partial S3 object, no row). 25 MB decoded ceiling (413). Returns the hydrated issue plus the new attachment id.", {
+    id: z.string().min(1),
+    file_path: z
+        .string()
+        .min(1)
+        .describe("Absolute path to a local file on the dispatch's shared filesystem (must start with `/`)."),
+    ...boardField,
+}, async (args) => jsonResult(await issueAttach(client, args)));
 // ---------------- main ----------------
 async function main() {
     const transport = new StdioServerTransport();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Stdio MCP server wrapping danxbot's dashboard /api/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
   "license": "MIT",
   "type": "module",