@thehammer/danx-dashboard-mcp 0.1.234 → 0.1.237

package/README.md

@@ -10,6 +10,7 @@ Stdio MCP server fronting danxbot's dashboard HTTP API. Since DX-3465 it exposes
 |---|---|
 | `DANXBOT_DASHBOARD_URL` | Dashboard base, e.g. `http://danxbot-dashboard:5555` (inside compose) or `http://localhost:5555` (host) |
 | `DANX_DASHBOARD_CREDENTIAL` | A DISPATCH's credential: the bearer verbatim, substituted into the materialized `.mcp.json` from its overlay (DX-2862, `src/credential.ts`). Authoritative when set; it never signs out. An operator session sets nothing: with no credential the server boots SIGNED OUT, every tool except `plan_connect` returns one "not signed in" halt, and `plan_connect` requests access (below). The same resolver serves the `bridge` subcommand, so a session's tools and its event stream can never sign in as two different identities |
+| `DANXBOT_TEAM` | OPTIONAL, non-secret (DX-4446): the team slug (or id) whose approvers see this session's access request in their danxbot site. Set it in the repo's `.mcp.json` env block or the shell. Unset, the request is answered by link only. A value that is not a team slug fails at boot; a team the dashboard does not know makes `plan_connect` answer `unknown_team` (fix `DANXBOT_TEAM`), never a silent link fallback |
 | `DANX_REPO_NAME` | Repo half of the qualified board id |
 | `DANXBOT_BOARD_NAME` | Board-slug half of the qualified board id (the dispatch injects `board.slug` here) |
 

package/dist/access-request.js

@@ -1,4 +1,14 @@
 import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-floor.js";
+// DX-4446: mirrors TEAM_SLUG_PATTERN in src/lib/auth-rules.ts (this package cannot import the main src/); a team ref is a slug,
+// and a team id's digits are a slug too. Keep the two in step.
+const TEAM_REF_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+/** DX-4446: the `DANXBOT_TEAM` value, or a loud error naming the variable. */
+export function assertMcpTeamRef(value) {
+    if (!TEAM_REF_PATTERN.test(value)) {
+        throw new Error(`[danx-dashboard-mcp] DANXBOT_TEAM "${value}" is not a team slug or id: lowercase letters and digits, joined by single hyphens`);
+    }
+    return value;
+}
 function baseOf(dashboardUrl) {
     return dashboardUrl.replace(/\/+$/, "");
 }
@@ -51,6 +61,9 @@ function isCreated(value) {
 export async function createAccessRequest(fetchImpl, dashboardUrl, input) {
     const url = `${baseOf(dashboardUrl)}/api/access-requests`;
     const { status, headers, json } = await postPublic(fetchImpl, url, input);
+    if (status === 400 && input.team !== undefined && json?.error === "unknown_team") {
+        return { kind: "unknown_team", team: input.team };
+    }
     if (status === 201) {
         if (!isCreated(json)) {
             throw new Error(`[danx-dashboard-mcp] POST ${url} answered 201 without the access request fields: ${JSON.stringify(json)}`);

package/dist/index.js

@@ -61,6 +61,12 @@
  *     otherwise this session's approved key (`session-key.ts`), else none: the
  *                           server boots SIGNED OUT, every tool but `plan_connect`
  *                           halts, and `plan_connect` requests access (`session-access.ts`)
+ *   DANXBOT_TEAM            OPTIONAL (DX-4446), non-secret: the team slug (or id) whose
+ *                           approvers see this session's access request in their danxbot
+ *                           site. Set it in the repo's `.mcp.json` env block or the shell.
+ *                           Unset: the request is answered by link only. Set but not a
+ *                           valid ref, or unknown to the dashboard: fails loud, never a
+ *                           silent fall back to the link flow.
  *   DANX_REPO_NAME          repo half of the qualified board id
  *   DANXBOT_BOARD_NAME      board-slug half of the qualified board id
  *                           (the dispatch injects `board.slug` here);
@@ -83,6 +89,7 @@ import { EVENT_TEXT_SUBCOMMAND, runEventTextCommand } from "./event-text.js";
 import { RESTART_NOTICE_SUBCOMMAND, runRestartNoticeCommand } from "./restart-notice.js";
 import { resolveBootCredential } from "./credential.js";
 import { SessionKeyUnusableError, deleteSessionKey } from "./session-key.js";
+import { assertMcpTeamRef } from "./access-request.js";
 import { SessionAccess } from "./session-access.js";
 import { PermissionRequests } from "./permission-request.js";
 import { withForbiddenHint } from "./forbidden-hint.js";
@@ -119,6 +126,19 @@ function readEnvOptional(name) {
     const v = process.env[name];
     return typeof v === "string" && v !== "" ? v : undefined;
 }
+/** DX-4446: optional `DANXBOT_TEAM`; set, it must be a valid team ref or boot fails loud (no fallback to the link flow). */
+function readTeamRef() {
+    const team = readEnvOptional("DANXBOT_TEAM");
+    if (team === undefined)
+        return undefined;
+    try {
+        return assertMcpTeamRef(team);
+    }
+    catch (err) {
+        console.error(err.message);
+        process.exit(1);
+    }
+}
 // The dispatch config + HTTP client are LATE-BOUND (assigned by `boot()` at
 // entrypoint, below). Tool registration happens at module import and the
 // callbacks close over these `let` bindings, reading them at CALL time — so the
@@ -168,6 +188,7 @@ function boot() {
         sessionId: session?.id,
         repo,
         clientVersion: readOwnVersion(),
+        team: readTeamRef(),
         setToken: (token) => dashboardClient.setToken(token),
         initial: resolveInitialCredential(dashboardUrl, session?.id),
         log: (line) => console.error(line),

package/dist/route-board-scope.generated.js

@@ -8,6 +8,7 @@
 export const GET_ROUTE_BOARD_SCOPE = [
     ["/api/access-requests", false],
     ["/api/account/sessions", false],
+    ["/api/agents/:agentId/halt-history", false],
     ["/api/audit-events", false],
     ["/api/boards", false],
     ["/api/boards/:boardId", false],
@@ -18,6 +19,7 @@ export const GET_ROUTE_BOARD_SCOPE = [
     ["/api/dispatches/:dispatchId/usage-events", false],
     ["/api/dispatches/dead-letter-ids", false],
     ["/api/docs/:repo/changes", false],
+    ["/api/docs/:repo/progress/:pathId", false],
     ["/api/failure-categories", false],
     ["/api/failure-categories/ambiguous", false],
     ["/api/failure-categories/uncategorized", false],
@@ -46,5 +48,10 @@ export const GET_ROUTE_BOARD_SCOPE = [
     ["/api/team/members", false],
     ["/api/team/roles", false],
     ["/api/users", false],
+    ["/api/worker/catalog-mcp-servers", false],
+    ["/api/worker/dispatches/:dispatchId", true],
+    ["/api/worker/dispatches/:dispatchId/usage-predecessor", false],
+    ["/api/worker/dispatches/non-terminal", false],
+    ["/api/worker/dispatches/recent-signal-failures", false],
     ["/api/workers", false],
 ];

package/dist/session-access.js

@@ -47,6 +47,7 @@ const DENIED_INSTRUCTION = "The user denied the request. Do not retry unless the
 const DASHBOARD_OUTDATED_ERROR = "this dashboard does not support request-and-approve yet (POST /api/access-requests answered 404): " +
     "it must be updated before this session can sign in";
 const RATE_LIMITED_ERROR = "too many access requests from this address; wait, then call plan_connect again";
+const unknownTeamError = (team) => `the dashboard has no team "${team}" (DANXBOT_TEAM); fix DANXBOT_TEAM in this server's env (the repo's .mcp.json env block or the shell) and restart the session`;
 const NO_SESSION_ID_ERROR = "this server has no CLAUDE_CODE_SESSION_ID, so it cannot request a session key";
 const CLAIMED_LOST_ERROR = "the dashboard says this request was already claimed, but this process never received the key; " +
     "start a new request";
@@ -212,10 +213,13 @@ export class SessionAccess {
             repo: this.deps.repo,
             machine: this.deps.machine ?? hostname(),
             clientVersion: this.deps.clientVersion,
+            ...(this.deps.team === undefined ? {} : { team: this.deps.team }),
         });
         switch (created.kind) {
             case "dashboard_outdated":
                 return notReady({ state: "dashboard_outdated", error: DASHBOARD_OUTDATED_ERROR }, true);
+            case "unknown_team":
+                return notReady({ state: "unknown_team", team: created.team, error: unknownTeamError(created.team) }, true);
             case "rate_limited":
                 return notReady({ state: "rate_limited", retryAfterSeconds: created.retryAfterSeconds, error: RATE_LIMITED_ERROR }, true);
             case "refused":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.234",
+  "version": "0.1.237",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",