@thehammer/danx-dashboard-mcp 0.1.19 → 0.1.21

package/dist/handlers.js

@@ -333,6 +333,28 @@ export async function issueRequiresHuman(client, args) {
         board,
     });
 }
+/**
+ * Flip a single card's per-card quality-gate `required` flag via
+ * POST /api/issues/:id/quality-gates/:gate {required} — the same write the
+ * dashboard drawer's Quality Gates tab performs (DX-1181). This is the ONLY
+ * post-create path to mark a gate required/not — `issue_create` carries
+ * `required_gates[]` at birth, and `issue_edit` rejects gate keys; without
+ * this tool an agent that created a card cannot turn a gate on afterward.
+ *
+ * `gate` is a registry name (`plan-dependency` | `plan-architecture` |
+ * `plan-tdd` | `code-test-quality` | `code-architecture` | `code-quality`).
+ * An unknown gate is a 400 from the server (never a silent no-op). The
+ * board-level master switch is a separate surface — a gate only RUNS when
+ * the board enables it AND the card marks it required.
+ */
+export async function issueQualityGate(client, args) {
+    return client.request({
+        method: "POST",
+        path: `/${encodeURIComponent(args.id)}/quality-gates/${encodeURIComponent(args.gate)}`,
+        body: { required: args.required },
+        board: args.board,
+    });
+}
 export async function issueRetro(client, args) {
     const { id, board, ...body } = args;
     return client.request({
@@ -370,7 +392,7 @@ const MIME_BY_EXT = {
     ".tgz": "application/gzip",
 };
 export function inferAttachmentMime(filename) {
-    return MIME_BY_EXT[extname(filename).toLowerCase()] ?? "application/octet-stream";
+    return (MIME_BY_EXT[extname(filename).toLowerCase()] ?? "application/octet-stream");
 }
 /**
  * Attach a local file to an issue card. Reads the bytes from the dispatch's

package/dist/handlers.test.js

@@ -0,0 +1,51 @@
+import { describe, it, expect } from "vitest";
+import { DashboardHttpClient } from "./http-client.js";
+import { issueList, issueTransition } from "./handlers.js";
+/**
+ * `issue_list` query-param forwarding. A fake `fetch` captures the built
+ * URL so each filter is asserted at the wire, through the real client's
+ * URL builder (`?repo=` always stamped, extra query merged after).
+ */
+function clientCapturing() {
+    const urls = [];
+    const fetchImpl = (async (url) => {
+        urls.push(url);
+        return new Response(JSON.stringify({ issues: [] }), { status: 200 });
+    });
+    const client = new DashboardHttpClient({ baseUrl: "http://localhost:5555", repo: "danxbot", token: "t" }, fetchImpl);
+    return { client, urls };
+}
+describe("issueList — query forwarding", () => {
+    it("forwards q as the server-side search needle", async () => {
+        const { client, urls } = clientCapturing();
+        await issueList(client, { q: "retire" });
+        expect(urls[0]).toContain("q=retire");
+    });
+    it("omits q when not provided", async () => {
+        const { client, urls } = clientCapturing();
+        await issueList(client, { include_closed: true });
+        expect(urls[0]).not.toContain("q=");
+        expect(urls[0]).toContain("include_closed=true");
+    });
+});
+describe("issueTransition — body forwarding", () => {
+    function clientCapturingBody() {
+        const bodies = [];
+        const fetchImpl = (async (_url, init) => {
+            bodies.push(JSON.parse(String(init?.body ?? "{}")));
+            return new Response(JSON.stringify({ issue: {} }), { status: 200 });
+        });
+        const client = new DashboardHttpClient({ baseUrl: "http://localhost:5555", repo: "danxbot", token: "t" }, fetchImpl);
+        return { client, bodies };
+    }
+    it("forwards manual: true on pickup (DX-946 operator self-pickup)", async () => {
+        const { client, bodies } = clientCapturingBody();
+        await issueTransition(client, { id: "DX-1", action: "pickup", manual: true });
+        expect(bodies[0]).toEqual({ action: "pickup", manual: true });
+    });
+    it("omits manual when not provided", async () => {
+        const { client, bodies } = clientCapturingBody();
+        await issueTransition(client, { id: "DX-1", action: "pickup" });
+        expect(bodies[0]).toEqual({ action: "pickup" });
+    });
+});

package/dist/http-client.js

@@ -11,6 +11,13 @@ export class DashboardHttpClient {
             Authorization: `Bearer ${this.config.token}`,
             Accept: "application/json",
         };
+        // DX-1398 Hop 3 (outbound) — stamp the cross-process trace at the SAME
+        // single choke point that stamps Authorization, so every call (GET + every
+        // write) chains under the originating launch. Omitted when the dispatch
+        // carries no trace context (the dashboard then mints a fresh root).
+        if (this.config.traceparent) {
+            headers["traceparent"] = this.config.traceparent;
+        }
         let bodyString;
         if (args.body !== undefined) {
             headers["Content-Type"] = "application/json";

package/dist/index.js

@@ -21,6 +21,7 @@
  *   - issue_checklist        POST/PATCH/DELETE /api/issues/:id/checklists[/:cid[/items[/:iid]]]
  *   - issue_dependency       POST/DELETE /api/issues/:id/dependencies[/:did]
  *   - issue_requires_human   POST/DELETE /api/issues/:id/requires-human
+ *   - issue_quality_gate     POST   /api/issues/:id/quality-gates/:gate
  *   - issue_retro            PUT    /api/issues/:id/retro
  *   - issue_attach           POST   /api/issues/:id/attachments (reads a local file)
  *
@@ -51,7 +52,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { DashboardHttpClient } from "./http-client.js";
-import { issueAttach, issueChecklist, issueComment, issueCreate, issueDependency, issueEdit, issueGet, issueList, issueRequiresHuman, issueRetro, issueTransition, issueTriage, } from "./handlers.js";
+import { issueAttach, issueChecklist, issueComment, issueCreate, issueDependency, issueEdit, issueGet, issueList, issueQualityGate, issueRequiresHuman, issueRetro, issueTransition, issueTriage, } from "./handlers.js";
 function readEnvOrDie(name) {
     const v = process.env[name];
     if (typeof v !== "string" || v === "") {
@@ -60,6 +61,17 @@ function readEnvOrDie(name) {
     }
     return v;
 }
+/**
+ * Read an OPTIONAL env var, treating empty string as absent. DX-1398 — the
+ * worker injects `DANXBOT_TRACEPARENT` for a traced dispatch and substitutes it
+ * to `""` for an untraced one (the optional-placeholder default), so empty
+ * MUST read as "no trace" rather than a literal value. Never exits — an
+ * untraced dispatch is valid.
+ */
+function readEnvOptional(name) {
+    const v = process.env[name];
+    return typeof v === "string" && v !== "" ? v : undefined;
+}
 // Compose the dispatch's qualified board id (`<repo>:<slug>`) from the
 // two env halves the worker injects. DANXBOT_BOARD_NAME already carries
 // the board SLUG at the spawn site (src/dispatch/core.ts sets it from
@@ -69,6 +81,10 @@ const config = {
     baseUrl: readEnvOrDie("DANXBOT_DASHBOARD_URL"),
     token: readEnvOrDie("DANXBOT_DISPATCH_TOKEN"),
     board: `${readEnvOrDie("DANX_REPO_NAME")}:${readEnvOrDie("DANXBOT_BOARD_NAME")}`,
+    // DX-1398 — OPTIONAL cross-process trace context. Present → stamped on every
+    // outbound call so the agent's card writes chain under the launch; absent
+    // (untraced dispatch) → omitted, and the dashboard mints a fresh root.
+    traceparent: readEnvOptional("DANXBOT_TRACEPARENT"),
 };
 const client = new DashboardHttpClient(config);
 const server = new McpServer({
@@ -143,12 +159,12 @@ server.tool("issue_list", "List issues for the dispatch's board by default via G
     ...boardField,
 }, async (args) => jsonResult(await issueList(client, args)));
 // ---------------- issue_get ----------------
-server.tool("issue_get", "Fetch a single hydrated issue via GET /api/issues/:id. Board-scoped; defaults to the dispatch's board. Issue ids are globally unique, so this resolves from any dispatch regardless of `board`. Returns the full card (every joined child collection: ac [the 2-state facade onto the default \"Acceptance Criteria\" checklist] + checklists [DX-1290: the full named-checklist model — each {name, items:[{label, detail, status: incomplete|failing|passing|cancelled}]}], comments, dependencies, requires_human steps, retro action items + commits, triage history, quality_gates — DX-1177: one row per registered quality gate {gate, required, status pending|pass|fail, completed_at, message}; a required PRE gate not yet `pass` pre-empts the work dispatch with the gate reviewer, and `issue_transition complete` refuses while a required POST gate row != pass) plus the ancestor chain walked via parent_id. 404 envelope on unknown id.", {
+server.tool("issue_get", 'Fetch a single hydrated issue via GET /api/issues/:id. Board-scoped; defaults to the dispatch\'s board. Issue ids are globally unique, so this resolves from any dispatch regardless of `board`. Returns the full card (every joined child collection: ac [the 2-state facade onto the default "Acceptance Criteria" checklist] + checklists [DX-1290: the full named-checklist model — each {name, items:[{label, detail, status: incomplete|failing|passing|cancelled}]}], comments, dependencies, requires_human steps, retro action items + commits, triage history, quality_gates — DX-1177: one row per registered quality gate {gate, required, status pending|pass|fail, completed_at, message}; a required PRE gate not yet `pass` pre-empts the work dispatch with the gate reviewer, and `issue_transition complete` refuses while a required POST gate row != pass) plus the ancestor chain walked via parent_id. 404 envelope on unknown id.', {
     id: z.string().min(1),
     ...boardField,
 }, async (args) => jsonResult(await issueGet(client, args)));
 // ---------------- issue_create ----------------
-server.tool("issue_create", "Create a fresh card via POST /api/issues. Board-scoped; defaults to the dispatch's board. Pass `board` (a qualified id `<repo>:<slug>`) to create the card on another board (forwarded into body.board + ?board=; unknown board → 404). INVARIANT: type=Epic REQUIRES non-empty phase_children[] (epic-with-phases atomicity per DX-575) and the route atomically inserts the epic + every phase in ONE transaction. Non-Epic types REFUSE phase_children[] with 400. Status defaults to Review (no lifecycle timestamps stamped on create). parent_id optional. ac items take {title}; phase children inherit the new epic's id as parent_id. Optional list_id PLACES the card directly into a column in ONE call. **Pass EITHER a board_lists id OR the list's display NAME (case-insensitive, emoji-tolerant — e.g. a queue name like \"⚙️ Fulfillment Queue\" or just \"Fulfillment Queue\") — the server resolves a name to its id.** The card lands DIRECTLY in that column with the matching lifecycle stamped automatically — a `ready`-type queue → ToDo, a `completed` list → Done, etc. **You do NOT need a separate issue_transition(ready) + issue_edit(list_id) afterward — just pass the queue name here and the card is created already in that column.** Omit list_id for the default (Review). NOT valid on type=Epic (Epic status derives from children) → 400. Unknown name/id → 400. Optional required_gates[] flags which quality gates (dependency, architecture, tdd, code) are REQUIRED on this card so they run pre-dispatch (only when the board also has that gate enabled); unknown gate name → 400.", {
+server.tool("issue_create", 'Create a fresh card via POST /api/issues. Board-scoped; defaults to the dispatch\'s board. Pass `board` (a qualified id `<repo>:<slug>`) to create the card on another board (forwarded into body.board + ?board=; unknown board → 404). INVARIANT: type=Epic REQUIRES non-empty phase_children[] (epic-with-phases atomicity per DX-575) and the route atomically inserts the epic + every phase in ONE transaction. Non-Epic types REFUSE phase_children[] with 400. Status defaults to Review (no lifecycle timestamps stamped on create). parent_id optional. ac items take {title}; phase children inherit the new epic\'s id as parent_id. Optional list_id PLACES the card directly into a column in ONE call. **Pass EITHER a board_lists id OR the list\'s display NAME (case-insensitive, emoji-tolerant — e.g. a queue name like "⚙️ Fulfillment Queue" or just "Fulfillment Queue") — the server resolves a name to its id.** The card lands DIRECTLY in that column with the matching lifecycle stamped automatically — a `ready`-type queue → ToDo, a `completed` list → Done, etc. **You do NOT need a separate issue_transition(ready) + issue_edit(list_id) afterward — just pass the queue name here and the card is created already in that column.** Omit list_id for the default (Review). NOT valid on type=Epic (Epic status derives from children) → 400. Unknown name/id → 400. Optional required_gates[] flags which quality gates (dependency, architecture, tdd, code) are REQUIRED on this card so they run pre-dispatch (only when the board also has that gate enabled); unknown gate name → 400.', {
     type: z.enum(ISSUE_TYPES),
     title: z.string().min(1),
     description: z.string(),
@@ -172,7 +188,7 @@ server.tool("issue_create", "Create a fresh card via POST /api/issues. Board-sco
     ...boardField,
 }, async (args) => jsonResult(await issueCreate(client, args, config.board)));
 // ---------------- issue_edit ----------------
-server.tool("issue_edit", "Patch prose fields only via PATCH /api/issues/:id/edit. ALLOWED keys: title, description, ac, checklists, effort_level, parent_id, list_id. ANY OTHER KEY (lifecycle timestamps, triage state, dependencies, retro, requires_human, blocked/dispatch gates) returns 400 with offending_keys[] and a pointer to the dedicated semantic handler — use issue_transition / issue_triage / issue_comment / issue_dependency / issue_requires_human / issue_retro instead. CHECKLISTS (DX-1290): a card carries 0..N named checklists, each item ONE 4-state status `incomplete|failing|passing|cancelled` (terminal = passing|cancelled). `ac` is the 2-state CONVENIENCE onto the default \"Acceptance Criteria\" checklist (checked:true ↔ passing, false ↔ incomplete) — wholesale soft-delete + reinsert of that checklist's items. `checklists` is the GENERIC wholesale write path: it REPLACES every named checklist on the card with full 4-state control (each `{name, items:[{label, detail?, status}]}`) — use it to author named checklists like \"Feature Tests\". Send EITHER `ac` OR `checklists`, NOT both (400). list_id (DX-1192 / DX-1200) PINS the card to a specific board list. **Pass EITHER a board_lists id OR the list's display NAME (case-insensitive, e.g. a queue name like \"⚙️ Fulfillment Queue\") — the server resolves a name to its id.** Its type MUST match the card's CURRENT derived-status list-type (so to route a ToDo card into a `ready`-type queue, ready it first; mismatch / unknown name or id → 400); pass null to clear the pin (back to default-for-type).", {
+server.tool("issue_edit", 'Patch prose fields only via PATCH /api/issues/:id/edit. ALLOWED keys: title, description, ac, checklists, effort_level, parent_id, list_id. ANY OTHER KEY (lifecycle timestamps, triage state, dependencies, retro, requires_human, blocked/dispatch gates) returns 400 with offending_keys[] and a pointer to the dedicated semantic handler — use issue_transition / issue_triage / issue_comment / issue_dependency / issue_requires_human / issue_retro instead. CHECKLISTS (DX-1290): a card carries 0..N named checklists, each item ONE 4-state status `incomplete|failing|passing|cancelled` (terminal = passing|cancelled). `ac` is the 2-state CONVENIENCE onto the default "Acceptance Criteria" checklist (checked:true ↔ passing, false ↔ incomplete) — wholesale soft-delete + reinsert of that checklist\'s items. `checklists` is the GENERIC wholesale write path: it REPLACES every named checklist on the card with full 4-state control (each `{name, items:[{label, detail?, status}]}`) — use it to author named checklists like "Feature Tests". Send EITHER `ac` OR `checklists`, NOT both (400). list_id (DX-1192 / DX-1200) PINS the card to a specific board list. **Pass EITHER a board_lists id OR the list\'s display NAME (case-insensitive, e.g. a queue name like "⚙️ Fulfillment Queue") — the server resolves a name to its id.** Its type MUST match the card\'s CURRENT derived-status list-type (so to route a ToDo card into a `ready`-type queue, ready it first; mismatch / unknown name or id → 400); pass null to clear the pin (back to default-for-type).', {
     id: z.string().min(1),
     title: z.string().min(1).optional(),
     description: z.string().optional(),
@@ -256,7 +272,7 @@ server.tool("issue_checklist", "Targeted checklist CUD via /api/issues/:id/check
     ...boardField,
 }, async (args) => jsonResult(await issueChecklist(client, args)));
 // ---------------- issue_dependency ----------------
-server.tool("issue_dependency", "Dependency CRUD via /api/issues/:id/dependencies[/:did]. action=add → POST {kind, target_id, reason} where kind ∈ {depends_on, conflict_on}. depends_on adds are CYCLE-CHECKED (BFS from target back to source — 409 if loop). Idempotent: re-adding a live triple returns the existing id. Self-loops refuse 409. action=remove → DELETE /:did. The server REQUIRES the literal reason=\"recorded_in_error\" on removal (encodes \"removal means NOT related, never satisfied\") — this MCP boundary hardcodes it, so callers do not pass reason on remove.", {
+server.tool("issue_dependency", 'Dependency CRUD via /api/issues/:id/dependencies[/:did]. action=add → POST {kind, target_id, reason} where kind ∈ {depends_on, conflict_on}. depends_on adds are CYCLE-CHECKED (BFS from target back to source — 409 if loop). Idempotent: re-adding a live triple returns the existing id. Self-loops refuse 409. action=remove → DELETE /:did. The server REQUIRES the literal reason="recorded_in_error" on removal (encodes "removal means NOT related, never satisfied") — this MCP boundary hardcodes it, so callers do not pass reason on remove.', {
     id: z.string().min(1),
     action: z.enum(["add", "remove"]),
     kind: z.enum(["depends_on", "conflict_on"]).optional(),
@@ -273,6 +289,20 @@ server.tool("issue_requires_human", "Set or clear the requires_human dispatch ga
     steps: z.array(z.string().min(1)).optional(),
     ...boardField,
 }, async (args) => jsonResult(await issueRequiresHuman(client, args)));
+// ---------------- issue_quality_gate ----------------
+server.tool("issue_quality_gate", "Toggle a single card's per-card quality-gate `required` flag via POST /api/issues/:id/quality-gates/:gate {required} — the SAME write the dashboard drawer's Quality Gates tab performs (DX-1181). This is the ONLY post-create way to mark a gate required/not-required: `issue_create` carries `required_gates[]` at birth, and `issue_edit` REJECTS gate keys (400 offending_keys) — without this tool a card created without a gate can never have it turned on by an agent. `gate` is a registry name: `plan-dependency` | `plan-architecture` | `plan-tdd` | `code-test-quality` | `code-architecture` | `code-quality` (the PRE/plan- gates run before the work dispatch; the POST/code- gates block issue_transition complete). Unknown gate → 400 (never a silent no-op); a card with no seeded row for a registered gate → 500 (canonical corruption). NOTE the board-level master switch is separate (the Agents-tab `board_quality_gate_settings`): a gate only RUNS when the board enables it AND the card marks it required — flipping `required` here is necessary but not sufficient if the board has the gate disabled. Returns the hydrated issue. Board-scoped; pass `board` (`<repo>:<slug>`) to target another board.", {
+    id: z.string().min(1),
+    gate: z.enum([
+        "plan-dependency",
+        "plan-architecture",
+        "plan-tdd",
+        "code-test-quality",
+        "code-architecture",
+        "code-quality",
+    ]),
+    required: z.boolean(),
+    ...boardField,
+}, async (args) => jsonResult(await issueQualityGate(client, args)));
 // ---------------- issue_retro ----------------
 server.tool("issue_retro", "Replace the retro block via PUT /api/issues/:id/retro. Body: {good, bad, action_item_ids[], commits[]}. REFUSES 409 unless the card is terminal (completed_at OR cancelled_at) — retro ships when work concludes. Replace semantics: good/bad upsert; action_item_ids[] + commits[] soft-delete prior live rows and insert with fresh ordinals. action_item_ids[] entries MUST match <PREFIX>-N. commits[] entries take {sha, subject?}.", {
     id: z.string().min(1),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Stdio MCP server wrapping danxbot's dashboard /api/issues/* normalized DB-backed HTTP routes for dispatched agents (DX-704 Phase 2).",
   "license": "MIT",
   "type": "module",