@thehammer/danx-dashboard-mcp 0.1.200 → 0.1.202

package/dist/danxbot-api-examples.js

@@ -16,6 +16,11 @@
  * retro before the `complete` transition (the list went AC tick -> retro,
  * with no transition between) and 14 of 24 writing the transition with no
  * spec call: the transition is now a shown write, placed before the retro.
+ * DX-3923 (phase E) — four triage card reads asked `fields` for
+ * `status_derived`, a LIST filter key the card-list example showed, so the
+ * list example filters by `q`/`include_closed` instead. Two haiku AC ticks
+ * read `ac` (no checklist id) and sent `ac` / `0` as the checklist id: the
+ * card read shows only `checklists`, and both tick ids name it.
  *
  * Kept as data, not prose, so danxbot's own tests can check each example
  * against the live server contract (route table, resource fields, body
@@ -26,12 +31,12 @@ export const DANXBOT_API_EXAMPLES = {
     cardRead: {
         method: "GET",
         path: "/api/issues/<id>",
-        query: { fields: { description: true, ac: true, comments: true, checklists: true, parent_title: true } },
+        query: { fields: { description: true, comments: true, checklists: true, parent_title: true } },
     },
     cardList: {
         method: "GET",
         path: "/api/issues",
-        query: { filter: { status_derived: "ToDo", q: "<text>" } },
+        query: { filter: { q: "<text>", include_closed: true } },
     },
     cardCreate: {
         method: "POST",
@@ -50,7 +55,7 @@ export const DANXBOT_API_EXAMPLES = {
     },
     acTick: {
         method: "PATCH",
-        path: "/api/issues/<id>/checklists/<checklists[].id>/items/<items[].id>",
+        path: "/api/issues/<id>/checklists/<checklists[].id>/items/<checklists[].items[].id>",
         body: { status: "passing" },
     },
     transition: {

package/dist/index.js

@@ -86,6 +86,7 @@ import { z } from "zod";
 import { DashboardHttpClient } from "./http-client.js";
 import { planConnect, danxbotApi, danxbotApiList, danxbotApiSpec, attachFile, DANXBOT_API_METHODS, } from "./handlers.js";
 import { bodyValueSchema, queryValueSchema } from "./types.js";
+import { termsAcceptanceCallHalt, termsHaltFor } from "./terms-halt.js";
 import { danxbotApiExamplesText } from "./danxbot-api-examples.js";
 import { registerLifecycleTools, applyLifecycleVisibility, readLifecycleUrlsFromEnv, } from "./lifecycle.js";
 function readEnvOrDie(name) {
@@ -278,6 +279,9 @@ export const server = new McpServer({
     name: "danx-dashboard-mcp",
     version: "0.1.0",
 }, { instructions: SERVER_INSTRUCTIONS });
+function haltResult(text) {
+    return { content: [{ type: "text", text }], isError: true };
+}
 function jsonResult(value) {
     return {
         content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
@@ -385,7 +389,17 @@ strictTool("danxbot_api", "Call any dashboard API route your credential may reac
 }, 
 // DX-3997 — the result rides back verbatim, plus the dashboard's own `reminders[]` entries
 // for this plan-connected session (the server decides; `listener-reminder.ts` only relays).
-async (args) => jsonResult(await listenerReminder.apply(await danxbotApi(client, args))));
+async (args) => {
+    // DX-4148 — an agent never accepts the Terms, and a terms refusal halts it (see terms-halt.ts).
+    const refused = termsAcceptanceCallHalt(args, config.baseUrl);
+    if (refused)
+        return haltResult(refused);
+    const result = await danxbotApi(client, args);
+    const halt = termsHaltFor(result);
+    if (halt)
+        return haltResult(halt);
+    return jsonResult(await listenerReminder.apply(result));
+});
 // ---------------- danxbot_api_list (DX-3465 A5, PLN-11 R-25) ----------------
 strictTool("danxbot_api_list", "Lists the dashboard API routes your credential may call right now — `[{method, path, summary, permission}]`, " +
     "one line each, in the route TEMPLATE form `danxbot_api_spec` also expects (e.g. " +

package/dist/terms-halt.js

@@ -0,0 +1,33 @@
+const TERMS_ACCEPTANCE_PATH = "/api/account/terms-acceptance";
+// Mirrors `termsAcceptUrl("/")` in src/lib/terms-accept-path.ts (a published package cannot import it);
+// terms-gate.integration.test.ts pins the server's link to the same literal. Only meaningful for an
+// operator session: a dispatch's DANXBOT_DASHBOARD_URL is internal, and agent credentials are never terms-gated.
+const ACCEPT_SCREEN_PATH = "/terms/accept?return=%2F";
+/** Keep in step with `termsRefusalInstruction` in src/dashboard/route-policy.ts. */
+export function haltText(acceptUrl) {
+    return ("STOP ALL WORK NOW. The dashboard refuses your access until the person you act for accepts the " +
+        "current Terms of Use.\n\n" +
+        `Give the person this link to accept them: ${acceptUrl}\n\n` +
+        "Do not retry, do not look for another route, and never accept the Terms yourself. " +
+        "A dispatched agent ends with danxbot_complete({status: \"failed\", summary}) naming this link, " +
+        "and never blocks the card.");
+}
+/** The halt text for a `403 terms_not_accepted` result, or null for any other result. */
+export function termsHaltFor(result) {
+    if (result.ok || result.status !== 403)
+        return null;
+    const body = result.body;
+    if (body?.error !== "terms_not_accepted")
+        return null;
+    if (typeof body.acceptUrl !== "string") {
+        throw new Error("[danx-dashboard-mcp] a terms_not_accepted refusal carried no acceptUrl");
+    }
+    return haltText(body.acceptUrl);
+}
+/** The refusal for a call that would accept the Terms (never an agent's act), or null for any other call. */
+export function termsAcceptanceCallHalt(args, dashboardUrl) {
+    const path = args.path.split("?")[0].replace(/\/+$/, "");
+    if (args.method !== "POST" || path !== TERMS_ACCEPTANCE_PATH)
+        return null;
+    return haltText(`${dashboardUrl.replace(/\/+$/, "")}${ACCEPT_SCREEN_PATH}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.200",
+  "version": "0.1.202",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",