@thehammer/danx-dashboard-mcp 0.1.250 → 0.1.254

package/README.md

@@ -11,8 +11,8 @@ Stdio MCP server fronting danxbot's dashboard HTTP API. Since DX-3465 it exposes
 | `DANXBOT_DASHBOARD_URL` | Dashboard base, e.g. `http://danxbot-dashboard:5555` (inside compose) or `http://localhost:5555` (host) |
 | `DANX_DASHBOARD_CREDENTIAL` | A DISPATCH's credential: the bearer verbatim, substituted into the materialized `.mcp.json` from its overlay (DX-2862, `src/credential.ts`). Authoritative when set; it never signs out. An operator session sets nothing: with no credential the server boots SIGNED OUT, every tool except `plan_connect` returns one "not signed in" halt, and `plan_connect` requests access (below). The same resolver serves the `bridge` subcommand, so a session's tools and its event stream can never sign in as two different identities |
 | `DANXBOT_TEAM` | OPTIONAL, non-secret (DX-4446): the team slug (or id) whose approvers see this session's access request in their danxbot site. Set it in the repo's `.mcp.json` env block or the shell. Unset, the request is answered by link only. A value that is not a team slug fails at boot; a team the dashboard does not know makes `plan_connect` answer `unknown_team` (fix `DANXBOT_TEAM`), never a silent link fallback |
-| `DANX_REPO_NAME` | Repo half of the qualified board id |
-| `DANXBOT_BOARD_NAME` | Board-slug half of the qualified board id (the dispatch injects `board.slug` here) |
+| `DANX_REPO_NAME` | OPTIONAL (DX-4555): repo half of the qualified board id; sent as the access request's repo label |
+| `DANXBOT_BOARD_NAME` | OPTIONAL (DX-4555; needs `DANX_REPO_NAME`): board-slug half of the qualified board id (the dispatch injects `board.slug` here). With neither variable set (the danxbot plugin's own server) the server has no default board: a board-scoped call must carry its `board` argument or it fails loud |
 
 BOARD-ONLY (DX-1171): board is the first-level concept; repo is DERIVED from board server-side, never passed. At boot the package composes the dispatch's qualified board id `<repo>:<slug>` from `DANX_REPO_NAME` + `DANXBOT_BOARD_NAME` and appends it as `?board=<id>` (and `body.board` on create) to every `/api/issues/*` request. Each tool exposes an optional `board` arg — a FULL qualified id `<repo>:<slug>` (e.g. `platform:the-supply-operations-hub`) — that overrides it per-call for cross-board reads/writes (unknown board → 404). The dashboard owns board→repo resolution; this package never sends `repo`.
 

package/dist/http-client.js

@@ -111,7 +111,12 @@ export class DashboardHttpClient {
         const params = new URLSearchParams(existingQs ?? "");
         // DX-3750 / DX-4303 — only a route the dashboard takes `?board=` on gets the stamp; see `route-board-scope.ts`.
         if (isBoardScopedRoute(method, `${basePath}${cleanPath}`)) {
-            params.set("board", boardOverride ?? this.config.board);
+            const board = boardOverride ?? this.config.board;
+            // DX-4555: a board-less server (the danxbot plugin's, no DANX_REPO_NAME/DANXBOT_BOARD_NAME) has no board to stamp.
+            if (board === undefined) {
+                throw new Error(`[danx-dashboard-mcp] ${method} ${basePath}${cleanPath} is board-scoped and this server has no configured board: pass the \`board\` argument (a qualified id, <repo>:<slug>)`);
+            }
+            params.set("board", board);
         }
         if (extraQuery) {
             for (const [k, v] of Object.entries(extraQuery)) {

package/dist/index.js

@@ -52,7 +52,7 @@
  * DANX_REPO_NAME + DANXBOT_BOARD_NAME and sends it as `board` — the
  * dashboard owns board→repo resolution.
  *
- * Env at boot (validated fail-loud — missing → process.exit(1)):
+ * Env at boot (validated fail-loud — a missing required var → process.exit(1)):
  *   DANXBOT_DASHBOARD_URL   dashboard base (e.g. http://danxbot-dashboard:5555)
  *   the CREDENTIAL (DX-4390), resolved by the ONE resolver this package's event bridge
  *   also uses (`credential.ts`, DX-2862), and never a reason to exit:
@@ -67,8 +67,8 @@
  *                           Unset: the request is answered by link only. Set but not a
  *                           valid ref, or unknown to the dashboard: fails loud, never a
  *                           silent fall back to the link flow.
- *   DANX_REPO_NAME          repo half of the qualified board id
- *   DANXBOT_BOARD_NAME      board-slug half of the qualified board id
+ *   DANX_REPO_NAME          OPTIONAL (DX-4555): repo half of the qualified board id
+ *   DANXBOT_BOARD_NAME      OPTIONAL (DX-4555; needs DANX_REPO_NAME): board-slug half of the qualified board id
  *                           (the dispatch injects `board.slug` here);
  *                           composed as `<repo>:<slug>` and appended as
  *                           ?board=<id>. Each tool's optional `board` arg
@@ -172,17 +172,25 @@ let permissionWatch;
  * halves the worker injects and build the HTTP client. DANXBOT_BOARD_NAME
  * already carries the board SLUG at the spawn site (src/dispatch/core.ts sets it
  * from `board.slug`), so a plain join yields the canonical id — no transform.
- * Both halves are fail-loud required (Core Principle 1 — no fallback).
+ * Both unset (DX-4555) leaves the server board-less: a board-scoped call must then carry its own `board`
+ * argument (`DashboardHttpClient.buildUrl` refuses otherwise). A slug without its repo fails loud.
  */
 function boot() {
     const dashboardUrl = readEnvOrDie("DANXBOT_DASHBOARD_URL");
-    const repo = readEnvOrDie("DANX_REPO_NAME");
+    const repo = readEnvOptional("DANX_REPO_NAME");
+    const boardName = readEnvOptional("DANXBOT_BOARD_NAME");
+    // DX-4555: a session started from the danxbot plugin's own server names no board; each call then
+    // carries a `board` argument. A board slug with no repo half is a half-written .mcp.json: fail loud.
+    if (boardName !== undefined && repo === undefined) {
+        console.error("[danx-dashboard-mcp] DANXBOT_BOARD_NAME is set but DANX_REPO_NAME is missing or empty");
+        process.exit(1);
+    }
     const session = readSessionConfig();
     config = {
         baseUrl: dashboardUrl,
         // DX-4390 — set by `SessionAccess` below; "" while signed out.
         token: "",
-        board: `${repo}:${readEnvOrDie("DANXBOT_BOARD_NAME")}`,
+        board: boardName === undefined ? undefined : `${repo}:${boardName}`,
         // DX-1398 — OPTIONAL cross-process trace context. Present → stamped on every
         // outbound call so the agent's card writes chain under the launch; absent
         // (untraced dispatch) → omitted, and the dashboard mints a fresh root.
@@ -195,7 +203,7 @@ function boot() {
     access = new SessionAccess({
         dashboardUrl,
         sessionId: session?.id,
-        repo,
+        repo: repo ?? null,
         clientVersion: readOwnVersion(),
         team: readTeamRef(),
         setToken: (token) => dashboardClient.setToken(token),
@@ -632,6 +640,7 @@ strictTool("request_permission", "Ask a person to grant this key ONE MORE permis
 // a different reason: it MAKES a plan rather than acting on one, so there is
 // no existing plan for an id to name yet.
 strictTool("plan_connect", 
+// DX-4493 — the `naming` block carries the thread title the session must take before it connects.
 // DX-4318 — states only what to do with the reply. What it used to add arrives where it is used: a rejected
 // action's rule in the event line itself (`listen.ts`), the mantra in the reply's own `reminders[]` text.
 // DX-4390 — signed out, this is also how the session asks for access.
@@ -644,7 +653,7 @@ strictTool("plan_connect",
     "titles and a first page of open cards) and `listenerHealth` (when its `state` is not `healthy`, do its " +
     "`nextStep`). A session is on at most one plan: connecting elsewhere moves it, and `movedFrom` names the " +
     "plan it left. Afterwards a `danxbot_api` call to a `/api/plans/mine/...` route acts on this plan and " +
-    "takes no plan id. DX-4493: a reply's `naming` block (status `needed`) gives your `{Name}: PLAN-NNN {short " +
+    "takes no plan id. A reply's `naming` block (status `needed`) gives your `{Name}: PLAN-NNN {short " +
     "title}`; rename this thread to it (`set_session_title`, or ask for `/rename`), then connect again with that `title`.", {
     plan_id: z
         .number()
@@ -723,7 +732,7 @@ async function main() {
     process.stdin.once("end", () => permissionWatch.stop());
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error(`danx-dashboard-mcp running on stdio (dashboard=${config.baseUrl}, board=${config.board})`);
+    console.error(`danx-dashboard-mcp running on stdio (dashboard=${config.baseUrl}, board=${config.board ?? "none, each call names its own"})`);
 }
 // Boot the stdio server ONLY when run as the entrypoint (the published bin).
 // Importing this module (the tool-defs generator + its drift test) registers

package/dist/lifecycle.js

@@ -252,7 +252,7 @@ export function registerLifecycleTools(strictTool) {
         "register the Slack mirror so future card updates re-render the thread's card-view message. Thread " +
         "scope is IMPLICIT (channel + thread_ts come from the dispatch) — pass only the issue id. Call this " +
         "AFTER posting your substantive answer with danxbot_slack_reply (that reply becomes the card-view " +
-        '"message #1"). A second call on an already-linked thread fails loud with a 409 — never a silent re-link.', { issue_id: z.string().describe('The card id to bind this thread to (e.g. "DX-1086").') }, async (args) => {
+        '"message #1"). A second call on an already-linked thread fails loud with a 409 — never a silent re-link.', { issue_id: z.string().describe('The card id to bind this thread to (e.g. "ABC-123").') }, async (args) => {
         const url = readLifecycleUrlsFromEnv().linkThreadToIssue;
         if (!url)
             throw new Error("link_thread_to_issue called outside a Slack dispatch");
@@ -310,10 +310,11 @@ export function registerLifecycleTools(strictTool) {
             .enum(["Bug", "Story", "Chore"])
             .describe("The card type. Never Epic/Feature — a single Slack request never warrants a container card."),
         title: z.string().describe("Card title."),
+        // DX-4515: the create route refuses a card with no summary.
         summary: z
             .string()
             .min(1)
-            .describe("REQUIRED (DX-4515): one plain line saying what the card is, shown at the top of the card page."),
+            .describe("REQUIRED: one plain line saying what the card is, shown at the top of the card page."),
         description: z
             .string()
             .describe("Card description — sourced from the triggering human message's content."),
@@ -397,7 +398,7 @@ export function registerLifecycleTools(strictTool) {
     strictTool("request_code_review", "TERMINAL for this dispatch — call it when your diff is done and its own tests are green, instead of " +
         "danxbot_complete. Pushes your branch (card/<id> to origin/card/<id>), then dispatches every code " +
         "gate this card carries as its OWN independent gate-reviewer dispatch (you never sign or review your " +
-        "own diff — DX-3741). Ends this dispatch 'completed' and releases the card to ToDo; when the card is " +
+        "own diff). Ends this dispatch 'completed' and releases the card to ToDo; when the card is " +
         "re-dispatched to you, read its quality_gates (through danxbot_api): every code gate pass/skipped → " +
         "run agent-finalize.sh and complete normally; any fail → fix its findings, then call " +
         "request_code_review again (never sign or remove a code gate yourself — removal is refused, 409). " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.250",
+  "version": "0.1.254",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",