@thehammer/danx-dashboard-mcp 0.1.225 → 0.1.227

package/dist/index.js

@@ -87,6 +87,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import { DashboardHttpClient } from "./http-client.js";
 import { planConnect, danxbotApi, danxbotApiList, danxbotApiSpec, attachFile, DANXBOT_API_METHODS, } from "./handlers.js";
+import { boundedResultText } from "./result-limit.js";
 import { bodyValueSchema, queryValueSchema } from "./types.js";
 import { termsAcceptanceCallHalt, termsHaltFor } from "./terms-halt.js";
 import { danxbotApiExamplesText } from "./danxbot-api-examples.js";
@@ -283,18 +284,28 @@ function accessReply(ready, note) {
     if (ready.halt !== undefined)
         return haltResult(ready.halt);
     const answer = note ? { ...ready.answer, note } : ready.answer;
-    return ready.isError ? haltResult(JSON.stringify(answer, null, 2)) : jsonResult(answer);
+    return ready.isError ? haltResult(JSON.stringify(answer)) : jsonResult(answer);
 }
 /** DX-4390 — a tool's dashboard call behind the sign-in halt (and the 401 sign-out). */
 async function guardedJson(run) {
     const guarded = await access.guard(run);
     return "halt" in guarded ? haltResult(guarded.halt) : jsonResult(guarded.result);
 }
+/** DX-4400 — `guardedJson` for the read tools whose answer can be a whole document: bounded. */
+async function guardedBoundedJson(run) {
+    const guarded = await access.guard(run);
+    return "halt" in guarded ? haltResult(guarded.halt) : boundedJsonResult(guarded.result);
+}
 function jsonResult(value) {
     return {
-        content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
+        // DX-4400: compact — nothing parses the indentation and it costs every call 16% to 55% more characters.
+        content: [{ type: "text", text: JSON.stringify(value) }],
     };
 }
+/** DX-4400 — a dashboard route's result, refused with the way to narrow it when over `MCP_MAX_RESULT_CHARS`. */
+function boundedJsonResult(result) {
+    return { content: [{ type: "text", text: boundedResultText(result) }] };
+}
 /**
  * DX-3238 — every tool on this server MUST reject an undeclared/mistyped
  * argument instead of silently stripping it. `server.tool(name, description,
@@ -407,14 +418,14 @@ async (args) => {
     const halt = termsHaltFor(result);
     if (halt)
         return haltResult(halt);
-    return jsonResult(await listenerReminder.apply(result));
+    return boundedJsonResult(await listenerReminder.apply(result));
 });
 // ---------------- danxbot_api_list (DX-3465 A5, PLN-11 R-25) ----------------
 strictTool("danxbot_api_list", 
 // DX-3528 — the list is filtered by the same permission check every request takes.
 "Lists the dashboard API routes your credential may call: `[{method, path, summary, permission}]`, each " +
     "`path` a route template (`/api/issues/:id/transition`), the form `danxbot_api_spec` takes. A route not " +
-    "listed is not callable by you.", {}, async () => guardedJson(() => danxbotApiList(client)));
+    "listed is not callable by you.", {}, async () => guardedBoundedJson(() => danxbotApiList(client)));
 // ---------------- danxbot_api_spec (DX-3465, PLN-11 R-25) ----------------
 strictTool("danxbot_api_spec", 
 // DX-3527 — the contract is generated from the route table.
@@ -423,7 +434,7 @@ strictTool("danxbot_api_spec",
     '(e.g. `"POST /api/issues/:id/transition"`), never a real path with ids. An endpoint the dashboard does ' +
     "not serve, or your credential may not call, is refused and named.", {
     endpoints: z.array(z.string().min(1)).min(1),
-}, async (args) => guardedJson(() => danxbotApiSpec(client, args)));
+}, async (args) => guardedBoundedJson(() => danxbotApiSpec(client, args)));
 // ---------------- attach_file (DX-3465 A4, checklist item 36140) ----------------
 //
 // The "25 MB" ceiling quoted below tracks the backend route's
@@ -436,9 +447,8 @@ strictTool("danxbot_api_spec",
 // might hold locally, e.g. the Slack recovery agent's CSV path).
 strictTool("attach_file", "Attach a LOCAL file to a card. This server reads and uploads the bytes, so they never pass through your " +
     "context. The attachment mirrors to the card's linked Trello card and Slack thread. 25 MB limit (413). " +
-    "Returns `{issue, attachment_id, s3_key}`: the entry of `issue.attachments` with that `attachment_id` " +
-    "carries a permanent `url`: embed it in any markdown field as `![description](url)` and it renders " +
-    "inline. Use it when a screenshot or file judges something faster than prose, or instead of pasting a " +
+    "Returns `{issue, attachment_id, url, thumbnail_url, is_primary}`: `url` is permanent, embed it in any " +
+    "markdown field as `![description](url)` and it renders inline. Use it when a screenshot or file judges something faster than prose, or instead of pasting a " +
     "large CSV or log into a card field.", {
     card_id: z.string().min(1).describe("The card id to attach the file to."),
     path: z

package/dist/result-limit.js

@@ -0,0 +1,25 @@
+/**
+ * DX-4400 — the most characters one `danxbot_api`, `danxbot_api_spec` or `danxbot_api_list` result may carry
+ * back to the agent. Every character is context the agent pays for on every later call, and Claude Code itself
+ * saves a larger result to a file with no hint how to narrow, after the cost is paid. A deliberate, narrow
+ * exception to PLAN-11 rule R-25 (verbatim forwarding): `plan_connect` and the lifecycle tools never pass here.
+ */
+export const MCP_MAX_RESULT_CHARS = 100_000;
+/** A runtime result text, not a tool description: the DX-4318 text limit does not apply to it. */
+const HOW_TO_NARROW = "Ask for less: `limit` and `offset` page a collection, `fields` names only the columns or relations you need, " +
+    "`filter` and `since` (epoch milliseconds) select rows. Then repeat the call.";
+/**
+ * The text the agent receives for `result`: its compact JSON when that fits `MCP_MAX_RESULT_CHARS`, otherwise
+ * `{ok, status, body_omitted:{chars, limit, how_to_narrow}}`. Never truncates, never forwards a part. `ok`
+ * and `status` stay so a write that already committed is still reported as committed.
+ */
+export function boundedResultText(result) {
+    const text = JSON.stringify(result);
+    if (text.length <= MCP_MAX_RESULT_CHARS)
+        return text;
+    return JSON.stringify({
+        ok: result.ok,
+        status: result.status,
+        body_omitted: { chars: text.length, limit: MCP_MAX_RESULT_CHARS, how_to_narrow: HOW_TO_NARROW },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.225",
+  "version": "0.1.227",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",