@thehammer/danx-dashboard-mcp 0.1.260 → 0.1.261

package/README.md

@@ -14,7 +14,7 @@ Stdio MCP server fronting danxbot's dashboard HTTP API. Since DX-3465 it exposes
 | `DANX_REPO_NAME` | OPTIONAL (DX-4555): repo half of the qualified board id; sent as the access request's repo label |
 | `DANXBOT_BOARD_NAME` | OPTIONAL (DX-4555; needs `DANX_REPO_NAME`): board-slug half of the qualified board id (the dispatch injects `board.slug` here). With neither variable set (the danxbot plugin's own server) the server has no default board: a board-scoped call must carry its `board` argument or it fails loud |
 
-BOARD-ONLY (DX-1171): board is the first-level concept; repo is DERIVED from board server-side, never passed. At boot the package composes the dispatch's qualified board id `<repo>:<slug>` from `DANX_REPO_NAME` + `DANXBOT_BOARD_NAME` and appends it as `?board=<id>` (and `body.board` on create) to every `/api/issues/*` request. Each tool exposes an optional `board` arg — a FULL qualified id `<repo>:<slug>` (e.g. `platform:the-supply-operations-hub`) — that overrides it per-call for cross-board reads/writes (unknown board → 404). The dashboard owns board→repo resolution; this package never sends `repo`.
+BOARD-ONLY (DX-1171): board is the first-level concept; repo is DERIVED from board server-side, never passed. At boot the package composes the dispatch's qualified board id `<repo>:<slug>` from `DANX_REPO_NAME` + `DANXBOT_BOARD_NAME` and appends it as `?board=<id>` (and `body.board` on create) to every `/api/issues/*` request, except `GET /api/issues` (the list), whose board is OPTIONAL (DX-4542): there it sends a board only when the caller names one, because no board is the team's whole list across every board. Each tool exposes an optional `board` arg — a FULL qualified id `<repo>:<slug>` (e.g. `platform:the-supply-operations-hub`) — that overrides it per-call for cross-board reads/writes (unknown board → 404). The dashboard owns board→repo resolution; this package never sends `repo`.
 
 ## Signing in (DX-4390): request and approve
 

package/dist/http-client.js

@@ -1,4 +1,4 @@
-import { isBoardScopedRoute } from "./route-board-scope.js";
+import { boardStampOf } from "./route-board-scope.js";
 import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-floor.js";
 export class DashboardHttpClient {
     config;
@@ -110,7 +110,10 @@ export class DashboardHttpClient {
         }
         const params = new URLSearchParams(existingQs ?? "");
         // DX-3750 / DX-4303 — only a route the dashboard takes `?board=` on gets the stamp; see `route-board-scope.ts`.
-        if (isBoardScopedRoute(method, `${basePath}${cleanPath}`)) {
+        // DX-4542 — a route whose board is OPTIONAL (no board = the whole team) gets only the board the caller named: stamping the dispatch's
+        // board there would make the team-wide list impossible to ask for.
+        const stamp = boardStampOf(method, `${basePath}${cleanPath}`);
+        if (stamp === "stamp") {
             const board = boardOverride ?? this.config.board;
             // DX-4555: a board-less server (the danxbot plugin's, no DANX_REPO_NAME/DANXBOT_BOARD_NAME) has no board to stamp.
             if (board === undefined) {
@@ -118,6 +121,9 @@ export class DashboardHttpClient {
             }
             params.set("board", board);
         }
+        else if (stamp === "named" && boardOverride !== undefined) {
+            params.set("board", boardOverride);
+        }
         if (extraQuery) {
             for (const [k, v] of Object.entries(extraQuery)) {
                 if (v === undefined || v === null)
@@ -137,6 +143,7 @@ export class DashboardHttpClient {
                         : String(v));
             }
         }
-        return `${base}${basePath}${cleanPath}?${params.toString()}`;
+        const query = params.toString();
+        return `${base}${basePath}${cleanPath}${query === "" ? "" : `?${query}`}`;
     }
 }

package/dist/index.js

@@ -495,7 +495,7 @@ const boardField = {
         .string()
         .min(1)
         .optional()
-        .describe("Board id `<repo>:<slug>`; omit for this dispatch's board. Unknown → 404."),
+        .describe("Board id `<repo>:<slug>`; omit for this dispatch's board, except on `GET /api/issues`, where omitting it lists the whole team across every board. Unknown → 404."),
 };
 // DX-3465 (code-architecture gate finding, at 275f82c0d) — `resource_fields`
 // (DX-3426) was deleted from here: it was a dedicated wrapper around a plain

package/dist/route-board-scope.generated.js

@@ -1,57 +1,51 @@
-/**
- * GENERATED by src/dashboard/mcp-board-scope.ts (DX-4303) - do not edit by hand.
- * Regenerate: DANX_REGEN_MCP_BOARD_SCOPE=1 npx vitest run src/dashboard/mcp-board-scope.test.ts
- *
- * The GET /api/* route templates the client must know to stamp `?board=` correctly, and whether each takes it. The server refuses an
- * unknown key on a list read whose vocabulary omits `board` and on a route declaring `strictQuery`; a path no template names is stamped.
- */
 export const GET_ROUTE_BOARD_SCOPE = [
-    ["/api/access-requests", false],
-    ["/api/account/sessions", false],
-    ["/api/agents/:agentId/halt-history", false],
-    ["/api/audit-events", false],
-    ["/api/boards", false],
-    ["/api/boards/:boardId", false],
-    ["/api/catalog/:catalogId", false],
-    ["/api/dispatches", false],
-    ["/api/dispatches/:dispatchId", true],
-    ["/api/dispatches/:dispatchId/logs", false],
-    ["/api/dispatches/:dispatchId/usage-events", false],
-    ["/api/dispatches/dead-letter-ids", false],
-    ["/api/docs/:repo/changes", false],
-    ["/api/docs/:repo/progress/:pathId", false],
-    ["/api/failure-categories", false],
-    ["/api/failure-categories/ambiguous", false],
-    ["/api/failure-categories/uncategorized", false],
-    ["/api/failure-signatures", false],
-    ["/api/issues/:id/problems", false],
-    ["/api/issues/:id/usage-runs", false],
-    ["/api/issues/:id/usage-series", false],
-    ["/api/issues/:issueId/dispatches", false],
-    ["/api/notifications", false],
-    ["/api/plan-sessions", false],
-    ["/api/plans", false],
-    ["/api/plans/:planId/architecture/sections", false],
-    ["/api/plans/:planId/cards", false],
-    ["/api/plans/:planId/notes", false],
-    ["/api/plans/:planId/records", false],
-    ["/api/plans/:planId/usage-series", false],
-    ["/api/plans/mine/architecture/sections", false],
-    ["/api/platform/signup-codes", false],
-    ["/api/platform/teams", false],
-    ["/api/reminders", false],
-    ["/api/repos", false],
-    ["/api/self-repair/errors", false],
-    ["/api/sync-root", false],
-    ["/api/tasks", false],
-    ["/api/team/invitations", false],
-    ["/api/team/members", false],
-    ["/api/team/roles", false],
-    ["/api/users", false],
-    ["/api/worker/catalog-mcp-servers", false],
-    ["/api/worker/dispatches/:dispatchId", true],
-    ["/api/worker/dispatches/:dispatchId/usage-predecessor", false],
-    ["/api/worker/dispatches/non-terminal", false],
-    ["/api/worker/dispatches/recent-signal-failures", false],
-    ["/api/workers", false],
+    ["/api/access-requests", "refuse"],
+    ["/api/account/sessions", "refuse"],
+    ["/api/agents/:agentId/halt-history", "refuse"],
+    ["/api/audit-events", "refuse"],
+    ["/api/boards", "refuse"],
+    ["/api/boards/:boardId", "refuse"],
+    ["/api/catalog/:catalogId", "refuse"],
+    ["/api/dispatches", "refuse"],
+    ["/api/dispatches/:dispatchId", "stamp"],
+    ["/api/dispatches/:dispatchId/logs", "refuse"],
+    ["/api/dispatches/:dispatchId/usage-events", "refuse"],
+    ["/api/dispatches/dead-letter-ids", "refuse"],
+    ["/api/docs/:repo/changes", "refuse"],
+    ["/api/docs/:repo/progress/:pathId", "refuse"],
+    ["/api/failure-categories", "refuse"],
+    ["/api/failure-categories/ambiguous", "refuse"],
+    ["/api/failure-categories/uncategorized", "refuse"],
+    ["/api/failure-signatures", "refuse"],
+    ["/api/issues", "named"],
+    ["/api/issues/:id/problems", "refuse"],
+    ["/api/issues/:id/usage-runs", "refuse"],
+    ["/api/issues/:id/usage-series", "refuse"],
+    ["/api/issues/:issueId/dispatches", "refuse"],
+    ["/api/notifications", "refuse"],
+    ["/api/plan-sessions", "refuse"],
+    ["/api/plans", "refuse"],
+    ["/api/plans/:planId/architecture/sections", "refuse"],
+    ["/api/plans/:planId/cards", "refuse"],
+    ["/api/plans/:planId/notes", "refuse"],
+    ["/api/plans/:planId/records", "refuse"],
+    ["/api/plans/:planId/usage-series", "refuse"],
+    ["/api/plans/mine/architecture/sections", "refuse"],
+    ["/api/platform/signup-codes", "refuse"],
+    ["/api/platform/teams", "refuse"],
+    ["/api/reminders", "refuse"],
+    ["/api/repos", "refuse"],
+    ["/api/self-repair/errors", "refuse"],
+    ["/api/sync-root", "refuse"],
+    ["/api/tasks", "refuse"],
+    ["/api/team/invitations", "refuse"],
+    ["/api/team/members", "refuse"],
+    ["/api/team/roles", "refuse"],
+    ["/api/users", "refuse"],
+    ["/api/worker/catalog-mcp-servers", "refuse"],
+    ["/api/worker/dispatches/:dispatchId", "stamp"],
+    ["/api/worker/dispatches/:dispatchId/usage-predecessor", "refuse"],
+    ["/api/worker/dispatches/non-terminal", "refuse"],
+    ["/api/worker/dispatches/recent-signal-failures", "refuse"],
+    ["/api/workers", "refuse"],
 ];

package/dist/route-board-scope.js

@@ -1,5 +1,7 @@
 /**
- * DX-4303 - does the dashboard route a request reaches take a `?board=` query key?
+ * DX-4303 / DX-4542 - what the client does with a `?board=` query key on the dashboard route a request reaches: `stamp` it (the route
+ * takes it, so the dispatch's board is filled in), `refuse` it (the server 400s it) or `named` (the board is optional and no board is the
+ * whole team: sent only when the caller names one).
  *
  * The answer comes from the dashboard's own route table, shipped in this package as `route-board-scope.generated.ts` (generated by
  * the server's `src/dashboard/mcp-board-scope.ts`; a root test fails when it drifts). This file only matches a concrete request
@@ -11,12 +13,12 @@
  */
 import { GET_ROUTE_BOARD_SCOPE } from "./route-board-scope.generated.js";
 const RANK = { literal: 2, param: 1, rest: 0 };
-function compile(template, acceptsBoard) {
+function compile(template, stamp) {
     const segments = template
         .slice(1)
         .split("/")
         .map((s) => (s === "*" ? { kind: "rest" } : s.startsWith(":") ? { kind: "param" } : { kind: "literal", value: s }));
-    return { segments, rank: segments.map((s) => RANK[s.kind]), acceptsBoard };
+    return { segments, rank: segments.map((s) => RANK[s.kind]), stamp };
 }
 function compareRank(a, b) {
     const n = Math.max(a.length, b.length);
@@ -28,7 +30,7 @@ function compareRank(a, b) {
     }
     return 0;
 }
-const ROUTES = GET_ROUTE_BOARD_SCOPE.map(([template, accepts]) => compile(template, accepts)).sort((a, b) => compareRank(a.rank, b.rank));
+const ROUTES = GET_ROUTE_BOARD_SCOPE.map(([template, stamp]) => compile(template, stamp)).sort((a, b) => compareRank(a.rank, b.rank));
 function matches(route, parts) {
     for (let i = 0; i < route.segments.length; i++) {
         const seg = route.segments[i];
@@ -42,10 +44,14 @@ function matches(route, parts) {
     }
     return parts.length === route.segments.length;
 }
-/** Does the dashboard route `<method> <routePath>` (no query string) take a `?board=` query key? */
-export function isBoardScopedRoute(method, routePath) {
+/**
+ * What the client does with `?board=` on `<method> <routePath>` (no query string): `stamp` the dispatch's board when the caller names none,
+ * `refuse` to send it (the server 400s it), or (DX-4542) `named`: the route takes it OPTIONALLY and no board is the whole team, so it is sent
+ * only when the caller names one.
+ */
+export function boardStampOf(method, routePath) {
     if (method !== "GET")
-        return true;
+        return "stamp";
     const parts = routePath.slice(1).split("/");
-    return ROUTES.find((route) => matches(route, parts))?.acceptsBoard ?? true;
+    return ROUTES.find((route) => matches(route, parts))?.stamp ?? "stamp";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.260",
+  "version": "0.1.261",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",