@thehammer/danx-dashboard-mcp 0.1.175 → 0.1.177

package/dist/http-client.js

@@ -1,4 +1,38 @@
 import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-floor.js";
+/**
+ * DX-3750 — route-path prefixes (`<basePath><path>`, BEFORE any query
+ * string) that are NEVER board-scoped: the dashboard route serving them
+ * takes no `?board=` at all — either because the resource is GLOBAL
+ * (plans — see `plan_list`'s own doc: "Plans are GLOBAL, not board-scoped")
+ * or because it scopes some other way a `board` param would be meaningless
+ * for (dispatches scope by `repo`; a board resolves from a PATH segment on
+ * every route but its own list, which itself scopes by `repo`; `/api/routes`
+ * and `/api/openapi` are cross-board discovery). Server-side, each of these
+ * families' LIST route validates its query params with its own
+ * `rejectUnknownParams(params, TOP_LEVEL_..._PARAM_KEYS)` allowlist
+ * (`src/issues/plans-routes.ts`, `src/dashboard/dispatches-routes.ts`,
+ * `src/issues/boards-routes.ts`) — none of those allowlists names `board`
+ * (DX-3725), so stamping it 400s. THIS is the one list; `isBoardScopedRoute`
+ * is the one function that reads it — no second, independently-drifting
+ * copy anywhere else in this package.
+ *
+ * Deliberately prefix-matched, not exact-matched: every sub-route of a
+ * non-board-scoped family (`/api/plans/:id/cards`, `/api/boards/:id/export`,
+ * `/api/dispatches/:id/logs`, …) is equally never board-scoped — a plan, a
+ * dispatch and a board-export all resolve their target from a PATH segment
+ * or a `repo`/global scope, never from `?board=`.
+ */
+const NON_BOARD_SCOPED_PATH_PREFIXES = [
+    "/api/plans",
+    "/api/dispatches",
+    "/api/boards",
+    "/api/routes",
+    "/api/openapi",
+];
+/** DX-3750 — does `routePath` (`<basePath><path>`, no query string) take a `?board=` at all? See `NON_BOARD_SCOPED_PATH_PREFIXES`'s own doc. */
+export function isBoardScopedRoute(routePath) {
+    return !NON_BOARD_SCOPED_PATH_PREFIXES.some((prefix) => routePath === prefix || routePath.startsWith(`${prefix}/`));
+}
 export class DashboardHttpClient {
     config;
     fetchImpl;
@@ -97,7 +131,12 @@ export class DashboardHttpClient {
             cleanPath = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
         }
         const params = new URLSearchParams(existingQs ?? "");
-        params.set("board", boardOverride ?? this.config.board);
+        // DX-3750 — only a board-scoped route takes `?board=` at all; see
+        // `isBoardScopedRoute`'s own doc for why an unconditional stamp 400s
+        // plans/dispatches/boards-list through `danxbot_api`.
+        if (isBoardScopedRoute(`${basePath}${cleanPath}`)) {
+            params.set("board", boardOverride ?? this.config.board);
+        }
         if (extraQuery) {
             for (const [k, v] of Object.entries(extraQuery)) {
                 if (v === undefined || v === null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.175",
+  "version": "0.1.177",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",