@thehammer/danx-dashboard-mcp 0.1.215 → 0.1.217

package/dist/http-client.js

@@ -1,65 +1,5 @@
+import { isBoardScopedRoute } from "./route-board-scope.js";
 import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-floor.js";
-/**
- * DX-3750 — route-path prefixes (`<basePath><path>`, BEFORE any query
- * string) that are NEVER board-scoped: the dashboard route serving them
- * takes no `?board=` at all — either because the resource is GLOBAL
- * (plans — see `plan_list`'s own doc: "Plans are GLOBAL, not board-scoped")
- * or because it scopes some other way a `board` param would be meaningless
- * for (dispatches scope by `repo`; a board resolves from a PATH segment on
- * every route but its own list, which itself scopes by `repo`; `/api/routes`
- * and `/api/openapi` are cross-board discovery). Server-side, each of these
- * families' LIST route validates its query params with its own
- * `rejectUnknownParams(params, TOP_LEVEL_..._PARAM_KEYS)` allowlist
- * (`src/issues/plans-routes.ts`, `src/dashboard/dispatches-routes.ts`,
- * `src/issues/boards-routes.ts`) — none of those allowlists names `board`
- * (DX-3725), so stamping it 400s. THIS list and `NON_BOARD_SCOPED_PATH_PATTERNS` below are the only
- * classification; `isBoardScopedRoute` is the one function that reads them — no second, independently-drifting
- * copy anywhere else in this package.
- *
- * Deliberately prefix-matched, not exact-matched: every sub-route of a
- * non-board-scoped family (`/api/plans/:id/cards`, `/api/boards/:id/export`,
- * `/api/dispatches/:id/logs`, …) is equally never board-scoped — a plan, a
- * dispatch and a board-export all resolve their target from a PATH segment
- * or a `repo`/global scope, never from `?board=`.
- */
-const NON_BOARD_SCOPED_PATH_PREFIXES = [
-    "/api/plans",
-    "/api/dispatches",
-    "/api/boards",
-    "/api/routes",
-    "/api/openapi",
-    // DX-4261: install- or team-global families, whose list reads declare no `board` (the engine 400s an unknown key).
-    "/api/team",
-    "/api/users",
-    "/api/account",
-    "/api/platform",
-    "/api/failure-categories",
-    "/api/failure-signatures",
-    "/api/notifications",
-    "/api/self-repair",
-    "/api/audit-events",
-    "/api/docs",
-    "/api/repos",
-    "/api/sync-root",
-    "/api/workers",
-    "/api/tasks",
-    "/api/reminders",
-];
-/**
- * DX-4261: non-board-scoped routes a prefix cannot express, because their family root (`/api/issues`, `/api/catalog`) is board-scoped.
- * `/api/agents` stays stamped: `?board=` there selects the roster read (DX-4220).
- */
-const NON_BOARD_SCOPED_PATH_PATTERNS = [
-    /^\/api\/issues\/[^/]+\/(dispatches|problems)$/,
-    /^\/api\/catalog\/[^/]+$/,
-    // The LIST read only: `/api/plan-sessions/me/plan` reads the stamped board to pin the operator dispatch (DX-2954).
-    /^\/api\/plan-sessions$/,
-];
-/** DX-3750 — does `routePath` (`<basePath><path>`, no query string) take a `?board=` at all? See `NON_BOARD_SCOPED_PATH_PREFIXES`'s own doc. */
-export function isBoardScopedRoute(routePath) {
-    return !(NON_BOARD_SCOPED_PATH_PREFIXES.some((prefix) => routePath === prefix || routePath.startsWith(`${prefix}/`)) ||
-        NON_BOARD_SCOPED_PATH_PATTERNS.some((pattern) => pattern.test(routePath)));
-}
 export class DashboardHttpClient {
     config;
     fetchImpl;
@@ -71,7 +11,7 @@ export class DashboardHttpClient {
         this.fetchImpl = fetchImpl;
     }
     async request(args) {
-        const url = this.buildUrl(args.path, args.query, args.board, args.basePath);
+        const url = this.buildUrl(args.method, args.path, args.query, args.board, args.basePath);
         const headers = {
             Authorization: `Bearer ${this.config.token}`,
             Accept: "application/json",
@@ -147,7 +87,7 @@ export class DashboardHttpClient {
         }
         return { ok: false, status: res.status, body: parsed };
     }
-    buildUrl(path, extraQuery, boardOverride, basePath = "/api/issues") {
+    buildUrl(method, path, extraQuery, boardOverride, basePath = "/api/issues") {
         const base = this.config.baseUrl.replace(/\/+$/, "");
         const [rawPath, existingQs] = path.split("?", 2);
         let cleanPath;
@@ -158,10 +98,8 @@ export class DashboardHttpClient {
             cleanPath = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
         }
         const params = new URLSearchParams(existingQs ?? "");
-        // DX-3750 — only a board-scoped route takes `?board=` at all; see
-        // `isBoardScopedRoute`'s own doc for why an unconditional stamp 400s
-        // plans/dispatches/boards-list through `danxbot_api`.
-        if (isBoardScopedRoute(`${basePath}${cleanPath}`)) {
+        // DX-3750 / DX-4303 — only a route the dashboard takes `?board=` on gets the stamp; see `route-board-scope.ts`.
+        if (isBoardScopedRoute(method, `${basePath}${cleanPath}`)) {
             params.set("board", boardOverride ?? this.config.board);
         }
         if (extraQuery) {

package/dist/route-board-scope.generated.js

@@ -0,0 +1,49 @@
+/**
+ * GENERATED by src/dashboard/mcp-board-scope.ts (DX-4303) - do not edit by hand.
+ * Regenerate: DANX_REGEN_MCP_BOARD_SCOPE=1 npx vitest run src/dashboard/mcp-board-scope.test.ts
+ *
+ * The GET /api/* route templates the client must know to stamp `?board=` correctly, and whether each takes it. The server refuses an
+ * unknown key on a list read whose vocabulary omits `board` and on a route declaring `strictQuery`; a path no template names is stamped.
+ */
+export const GET_ROUTE_BOARD_SCOPE = [
+    ["/api/account/sessions", false],
+    ["/api/audit-events", false],
+    ["/api/boards", false],
+    ["/api/boards/:boardId", false],
+    ["/api/catalog/:catalogId", false],
+    ["/api/dispatches", false],
+    ["/api/dispatches/:dispatchId", true],
+    ["/api/dispatches/:dispatchId/logs", false],
+    ["/api/dispatches/:dispatchId/usage-events", false],
+    ["/api/dispatches/dead-letter-ids", false],
+    ["/api/docs/:repo/changes", false],
+    ["/api/failure-categories", false],
+    ["/api/failure-categories/ambiguous", false],
+    ["/api/failure-categories/uncategorized", false],
+    ["/api/failure-signatures", false],
+    ["/api/issues/:id/problems", false],
+    ["/api/issues/:id/usage-runs", false],
+    ["/api/issues/:id/usage-series", false],
+    ["/api/issues/:issueId/dispatches", false],
+    ["/api/notifications", false],
+    ["/api/plan-sessions", false],
+    ["/api/plans", false],
+    ["/api/plans/:planId/architecture/sections", false],
+    ["/api/plans/:planId/cards", false],
+    ["/api/plans/:planId/notes", false],
+    ["/api/plans/:planId/records", false],
+    ["/api/plans/:planId/usage-series", false],
+    ["/api/plans/mine/architecture/sections", false],
+    ["/api/platform/signup-codes", false],
+    ["/api/platform/teams", false],
+    ["/api/reminders", false],
+    ["/api/repos", false],
+    ["/api/self-repair/errors", false],
+    ["/api/sync-root", false],
+    ["/api/tasks", false],
+    ["/api/team/invitations", false],
+    ["/api/team/members", false],
+    ["/api/team/roles", false],
+    ["/api/users", false],
+    ["/api/workers", false],
+];

package/dist/route-board-scope.js

@@ -0,0 +1,51 @@
+/**
+ * DX-4303 - does the dashboard route a request reaches take a `?board=` query key?
+ *
+ * The answer comes from the dashboard's own route table, shipped in this package as `route-board-scope.generated.ts` (generated by
+ * the server's `src/dashboard/mcp-board-scope.ts`; a root test fails when it drifts). This file only matches a concrete request
+ * path against those templates, the way the server's `RouteTable` does: segments compared left to right, a literal beating a
+ * `:param` beating a trailing `*`. It holds no route knowledge of its own.
+ *
+ * Only GET routes are listed - the server refuses an unknown query key on a read alone - so every other method takes the key. A
+ * GET path no template matches takes it too: the server answers it with a 404 whatever the query.
+ */
+import { GET_ROUTE_BOARD_SCOPE } from "./route-board-scope.generated.js";
+const RANK = { literal: 2, param: 1, rest: 0 };
+function compile(template, acceptsBoard) {
+    const segments = template
+        .slice(1)
+        .split("/")
+        .map((s) => (s === "*" ? { kind: "rest" } : s.startsWith(":") ? { kind: "param" } : { kind: "literal", value: s }));
+    return { segments, rank: segments.map((s) => RANK[s.kind]), acceptsBoard };
+}
+function compareRank(a, b) {
+    const n = Math.max(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+        const x = a[i] ?? -1;
+        const y = b[i] ?? -1;
+        if (x !== y)
+            return y - x;
+    }
+    return 0;
+}
+const ROUTES = GET_ROUTE_BOARD_SCOPE.map(([template, accepts]) => compile(template, accepts)).sort((a, b) => compareRank(a.rank, b.rank));
+function matches(route, parts) {
+    for (let i = 0; i < route.segments.length; i++) {
+        const seg = route.segments[i];
+        if (seg.kind === "rest")
+            return true;
+        const part = parts[i];
+        if (part === undefined)
+            return false;
+        if (seg.kind === "literal" ? part !== seg.value : part === "")
+            return false;
+    }
+    return parts.length === route.segments.length;
+}
+/** Does the dashboard route `<method> <routePath>` (no query string) take a `?board=` query key? */
+export function isBoardScopedRoute(method, routePath) {
+    if (method !== "GET")
+        return true;
+    const parts = routePath.slice(1).split("/");
+    return ROUTES.find((route) => matches(route, parts))?.acceptsBoard ?? true;
+}

package/dist/terms-halt.js

@@ -1,7 +1,9 @@
 const TERMS_ACCEPTANCE_PATH = "/api/account/terms-acceptance";
 // Mirrors `termsAcceptUrl("/")` in src/lib/terms-accept-path.ts (a published package cannot import it);
 // terms-gate.integration.test.ts pins the server's link to the same literal. Only meaningful for an
-// operator session: a dispatch's DANXBOT_DASHBOARD_URL is internal, and a dispatch's own agent credential is never terms-gated.
+// operator session: a dispatch's DANXBOT_DASHBOARD_URL is internal, and a dispatch's own key is its
+// owner's API key (DX-4191), so a dispatched agent can meet this refusal too and hands the link to the
+// owner's operator.
 const ACCEPT_SCREEN_PATH = "/terms/accept?return=%2F";
 /** Keep in step with `termsRefusalInstruction` in src/dashboard/route-policy.ts. */
 export function haltText(acceptUrl, owner) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.215",
+  "version": "0.1.217",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",