@thehammer/danx-dashboard-mcp 0.1.203 → 0.1.204

package/dist/index.js

@@ -87,6 +87,7 @@ import { z } from "zod";
 import { DashboardHttpClient } from "./http-client.js";
 import { planConnect, danxbotApi, danxbotApiList, danxbotApiSpec, attachFile, DANXBOT_API_METHODS, } from "./handlers.js";
 import { bodyValueSchema, queryValueSchema } from "./types.js";
+import { termsAcceptanceCallHalt, termsHaltFor } from "./terms-halt.js";
 import { danxbotApiExamplesText } from "./danxbot-api-examples.js";
 import { registerLifecycleTools, applyLifecycleVisibility, readLifecycleUrlsFromEnv, } from "./lifecycle.js";
 function readEnvOrDie(name) {
@@ -279,6 +280,9 @@ export const server = new McpServer({
     name: "danx-dashboard-mcp",
     version: "0.1.0",
 }, { instructions: SERVER_INSTRUCTIONS });
+function haltResult(text) {
+    return { content: [{ type: "text", text }], isError: true };
+}
 function jsonResult(value) {
     return {
         content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
@@ -386,7 +390,17 @@ strictTool("danxbot_api", "Call any dashboard API route your credential may reac
 }, 
 // DX-3997 — the result rides back verbatim, plus the dashboard's own `reminders[]` entries
 // for this plan-connected session (the server decides; `listener-reminder.ts` only relays).
-async (args) => jsonResult(await listenerReminder.apply(await danxbotApi(client, args))));
+async (args) => {
+    // DX-4148 — an agent never accepts the Terms, and a terms refusal halts it (see terms-halt.ts).
+    const refused = termsAcceptanceCallHalt(args, config.baseUrl);
+    if (refused)
+        return haltResult(refused);
+    const result = await danxbotApi(client, args);
+    const halt = termsHaltFor(result);
+    if (halt)
+        return haltResult(halt);
+    return jsonResult(await listenerReminder.apply(result));
+});
 // ---------------- danxbot_api_list (DX-3465 A5, PLN-11 R-25) ----------------
 strictTool("danxbot_api_list", "Lists the dashboard API routes your credential may call right now — `[{method, path, summary, permission}]`, " +
     "one line each, in the route TEMPLATE form `danxbot_api_spec` also expects (e.g. " +

package/dist/terms-halt.js

@@ -0,0 +1,33 @@
+const TERMS_ACCEPTANCE_PATH = "/api/account/terms-acceptance";
+// Mirrors `termsAcceptUrl("/")` in src/lib/terms-accept-path.ts (a published package cannot import it);
+// terms-gate.integration.test.ts pins the server's link to the same literal. Only meaningful for an
+// operator session: a dispatch's DANXBOT_DASHBOARD_URL is internal, and agent credentials are never terms-gated.
+const ACCEPT_SCREEN_PATH = "/terms/accept?return=%2F";
+/** Keep in step with `termsRefusalInstruction` in src/dashboard/route-policy.ts. */
+export function haltText(acceptUrl) {
+    return ("STOP ALL WORK NOW. The dashboard refuses your access until the person you act for accepts the " +
+        "current Terms of Use.\n\n" +
+        `Give the person this link to accept them: ${acceptUrl}\n\n` +
+        "Do not retry, do not look for another route, and never accept the Terms yourself. " +
+        "A dispatched agent ends with danxbot_complete({status: \"failed\", summary}) naming this link, " +
+        "and never blocks the card.");
+}
+/** The halt text for a `403 terms_not_accepted` result, or null for any other result. */
+export function termsHaltFor(result) {
+    if (result.ok || result.status !== 403)
+        return null;
+    const body = result.body;
+    if (body?.error !== "terms_not_accepted")
+        return null;
+    if (typeof body.acceptUrl !== "string") {
+        throw new Error("[danx-dashboard-mcp] a terms_not_accepted refusal carried no acceptUrl");
+    }
+    return haltText(body.acceptUrl);
+}
+/** The refusal for a call that would accept the Terms (never an agent's act), or null for any other call. */
+export function termsAcceptanceCallHalt(args, dashboardUrl) {
+    const path = args.path.split("?")[0].replace(/\/+$/, "");
+    if (args.method !== "POST" || path !== TERMS_ACCEPTANCE_PATH)
+        return null;
+    return haltText(`${dashboardUrl.replace(/\/+$/, "")}${ACCEPT_SCREEN_PATH}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.203",
+  "version": "0.1.204",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",