@thehammer/danx-dashboard-mcp 0.1.211 → 0.1.213

package/dist/http-client.js

@@ -12,8 +12,8 @@ import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-f
  * `rejectUnknownParams(params, TOP_LEVEL_..._PARAM_KEYS)` allowlist
  * (`src/issues/plans-routes.ts`, `src/dashboard/dispatches-routes.ts`,
  * `src/issues/boards-routes.ts`) — none of those allowlists names `board`
- * (DX-3725), so stamping it 400s. THIS is the one list; `isBoardScopedRoute`
- * is the one function that reads it — no second, independently-drifting
+ * (DX-3725), so stamping it 400s. THIS list and `NON_BOARD_SCOPED_PATH_PATTERNS` below are the only
+ * classification; `isBoardScopedRoute` is the one function that reads them — no second, independently-drifting
  * copy anywhere else in this package.
  *
  * Deliberately prefix-matched, not exact-matched: every sub-route of a
@@ -28,10 +28,37 @@ const NON_BOARD_SCOPED_PATH_PREFIXES = [
     "/api/boards",
     "/api/routes",
     "/api/openapi",
+    // DX-4261: install- or team-global families, whose list reads declare no `board` (the engine 400s an unknown key).
+    "/api/team",
+    "/api/users",
+    "/api/account",
+    "/api/platform",
+    "/api/failure-categories",
+    "/api/failure-signatures",
+    "/api/notifications",
+    "/api/self-repair",
+    "/api/audit-events",
+    "/api/docs",
+    "/api/repos",
+    "/api/sync-root",
+    "/api/workers",
+    "/api/tasks",
+    "/api/reminders",
+];
+/**
+ * DX-4261: non-board-scoped routes a prefix cannot express, because their family root (`/api/issues`, `/api/catalog`) is board-scoped.
+ * `/api/agents` stays stamped: `?board=` there selects the roster read (DX-4220).
+ */
+const NON_BOARD_SCOPED_PATH_PATTERNS = [
+    /^\/api\/issues\/[^/]+\/(dispatches|problems)$/,
+    /^\/api\/catalog\/[^/]+$/,
+    // The LIST read only: `/api/plan-sessions/me/plan` reads the stamped board to pin the operator dispatch (DX-2954).
+    /^\/api\/plan-sessions$/,
 ];
 /** DX-3750 — does `routePath` (`<basePath><path>`, no query string) take a `?board=` at all? See `NON_BOARD_SCOPED_PATH_PREFIXES`'s own doc. */
 export function isBoardScopedRoute(routePath) {
-    return !NON_BOARD_SCOPED_PATH_PREFIXES.some((prefix) => routePath === prefix || routePath.startsWith(`${prefix}/`));
+    return !(NON_BOARD_SCOPED_PATH_PREFIXES.some((prefix) => routePath === prefix || routePath.startsWith(`${prefix}/`)) ||
+        NON_BOARD_SCOPED_PATH_PATTERNS.some((pattern) => pattern.test(routePath)));
 }
 export class DashboardHttpClient {
     config;

package/dist/listen.js

@@ -122,6 +122,10 @@ export function invalidEventReason(value) {
     if (typeof value.origin !== "string" || !ACTIVITY_ORIGINS.has(value.origin)) {
         return "origin is not one of operator, agent, machine";
     }
+    // DX-4246 — the key snapshot is part of every event the dashboard sends, `null` when no key wrote it.
+    if (value.viaKey !== null && !(isRecord(value.viaKey) && typeof value.viaKey.id === "number" && typeof value.viaKey.name === "string")) {
+        return "viaKey is not null or {id, name}";
+    }
     const d = value.detail;
     if (!isRecord(d))
         return "detail is not an object";
@@ -187,7 +191,9 @@ export function invalidEventReason(value) {
  * reader would have to cross-reference.
  */
 function actorLabel(event) {
-    return `${event.actor} (${event.origin})`;
+    // DX-4246 — a write made through an API key names the user AND the key ("dan via claude-laptop (agent)").
+    const via = event.viaKey === null ? "" : ` via ${event.viaKey.name}`;
+    return `${event.actor}${via} (${event.origin})`;
 }
 /** Only ever called on an event `invalidEventReason` accepted, so its casts are checked. */
 function describe(event) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.211",
+  "version": "0.1.213",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",