@thehammer/danx-dashboard-mcp 0.1.263 → 0.1.264

package/README.md

@@ -1,6 +1,6 @@
 # @thehammer/danx-dashboard-mcp
 
-Stdio MCP server fronting danxbot's dashboard HTTP API. Since DX-3465 it exposes three generic tools (`danxbot_api`, `danxbot_api_list`, `danxbot_api_spec` — see "Tool surface" below) that reach any route the caller's credential may reach, plus a few dedicated tools for what no route call can do (`plan_connect`, `request_permission`, `attach_file`, `danxbot_slack_reply`) — there is no per-operation tool any more, and since DX-4525 no dispatch-callback tool either: `danxbot_api` is every agent's primary channel to the dashboard (ending a dispatch, gate sign-off, code-review request, Slack update, thread link, Slack recovery, evaluator summary and template-app load/save are all `danxbot_api` calls to the routes in `src/dispatch/callback-routes.ts`). The server instructions and the `danxbot_api_spec` description tell an agent to read the spec before its first call to a route it has not called before.
+Stdio MCP server fronting danxbot's dashboard HTTP API. Since DX-3465 it exposes three generic tools (`danxbot_api`, `danxbot_api_list`, `danxbot_api_spec` — see "Tool surface" below) that reach any route the caller's credential may reach, plus a handful of dedicated tools for agent-specific operations (`plan_connect`, `danxbot_complete`, Slack/template-app callbacks, …) — there is no per-operation tool any more.
 
 `danxbot_api` is Zod-validated at the MCP boundary, fetches under the hood, and passes the server response back to the agent verbatim. Refusal envelopes (`{error, ...extra}` with `failed_gate`, `non_terminal_phases`, `offending_keys`, etc.) come through as `{ok: false, status, body}` so the agent can pick the right next action without guessing. 5xx and network failures throw.
 
@@ -21,7 +21,7 @@ BOARD-ONLY (DX-1171): board is the first-level concept; repo is DERIVED from boa
 An operator session has no stored credential. Signed out, `plan_connect` (optionally with `title`, the session's own Claude title) posts `POST /api/access-requests` and answers at once `{state: "approval_required", approvalUrl, confirmCode, expiresAt, instruction}`: show the user the code and open the URL; they approve in the dashboard. The server polls `POST /api/access-requests/claim` in the background, so the key is stored when the approval lands; the next `plan_connect` waits up to about 45 seconds for it, then connects, or answers `approval_pending`. One tool call never blocks for minutes. `denied` is reported once; a request that lapsed (the dashboard deletes it within about a minute of expiry, so a claim answers 404) starts a fresh one on the next call.
 
 - **Storage.** `~/.config/danxbot/session-keys/<sha12(dashboard url)>/<session id>.json`, mode 0600, written write-then-rename, pruned after 7 days. One file per dashboard and per session; the bridge reads the same file through the `session-key` credential source and proves the fingerprint. The key lapses on the dashboard after 24 hours without use (every authenticated call, and the bridge's heartbeat, renew it), and is revocable from the account page.
-- **A 401 on the stored key** deletes the file and returns the sign-in halt (in `plan_connect`: a new request in the same call). That is a key that lapsed. A key a PERSON revoked is answered `401 key_revoked` (DX-4418): the key file is deleted and EVERY dashboard tool, `plan_connect` included, returns one stop halt (who revoked it and when; commit work in progress and end; a dispatched agent makes no further call), for the rest of the process. No access request is made. The worker finds the revocation itself and ends the dispatch as revoked (every dashboard route, the dispatch-complete one included, refuses a revoked key). The session's event bridge ends with the stop reason `key_revoked` the same way. **A 404 on create** means the dashboard predates request-and-approve and says so.
+- **A 401 on the stored key** deletes the file and returns the sign-in halt (in `plan_connect`: a new request in the same call). That is a key that lapsed. A key a PERSON revoked is answered `401 key_revoked` (DX-4418): the key file is deleted and EVERY dashboard tool, `plan_connect` included, returns one stop halt (who revoked it and when; commit work in progress and end; a dispatched agent ends with `danxbot_complete`), for the rest of the process. No access request is made. `danxbot_complete` and the other worker lifecycle tools do not use the dashboard key, so a dispatched agent can still end. The session's event bridge ends with the stop reason `key_revoked` the same way. **A 404 on create** means the dashboard predates request-and-approve and says so.
 - A dispatch's `DANX_DASHBOARD_CREDENTIAL` skips all of this. There is no token-file credential source.
 
 ### Asking for one more permission (DX-4434)
@@ -36,7 +36,7 @@ A session is shown only the tools it can call. `src/tool-access.ts` declares, fo
 
 - **Bootstrap set**, for every session and the whole of a signed-out one: `plan_connect`, `request_permission` and the `danxbot_api` trio.
 - **Permission tools** (`attach_file` needs `cards.edit`): shown once the key holds the permission the tool's dashboard route needs.
-- **Callback tool** (`danxbot_slack_reply`, the only one, DX-4525): shown when the worker injected its URL (`DANXBOT_SLACK_REPLY_URL`, `<dashboard>/api/slack/reply`, no dispatch id) AND the key holds `slack.threads.post`, so a non-Slack dispatch never sees it. It posts with the dispatch's own credential (`DANX_DASHBOARD_CREDENTIAL`), the same one `danxbot_api` uses.
+- **Callback tools**: shown when the worker injected the tool's per-dispatch URL (`DANXBOT_*_URL`). The six that post to dashboard routes (`danxbot_slack_*`, `link_thread_to_issue`, `slack_recovery_*`) also need the route's permission; the six that post to a worker route (`danxbot_complete`, `quality_gate_complete`, `request_code_review`, `danxbot_set_evaluator_summary`, `save_template_app`, `load_template_app`) authenticate with the dispatch's agent token and need only the URL.
 - **When it is applied.** At boot, as a session with no key; then, if the session holds a key (a dispatch's env credential, or a stored session key), right away from `GET /api/auth/me`; a dispatch retries that read three times and fails the boot rather than start without its tools. After `plan_connect` signs a session in. And again when a person approves a `request_permission` grant: the dashboard ends the key's open `/api/stream` with `event: end {reason: "permissions_changed"}`, this process holds one stream open on the key-self topic `key:self` (`src/permission-watch.ts`; any key may subscribe with no permission, because a dispatch's agent role holds no read-floor key), and after EVERY (re)connect re-reads the key's permissions (a failed read is retried with bounded backoff) and enables what is newly allowed in ONE `list_changed`. It reconnects with backoff after a drop, and stops when stdin closes. A grant that adds no tool, and a repeated read, switch nothing and send no notification, because a changed tool list costs the session its prompt cache.
 - A stream the dashboard refuses (any 4xx) is logged and ends the watch; that session's grants then show their tools at its next `plan_connect`. A permission read the dashboard refuses (401/403, other than the Terms halt) fails a dispatch's boot rather than quietly narrowing its tools.
 
@@ -47,14 +47,14 @@ All exposed as `mcp__danx-dashboard__<name>` once wired through the workspace `m
 | Tool | Purpose |
 |---|---|
 | `danxbot_api` | `{method, path, query?, body?}` — calls any dashboard route the caller's credential may reach (card/plan CRUD, comments, dependencies, problems/solutions, quality gates, retro, triage, transitions, …). Returns `{ok, status, body}`; `body` carries the route's own response, or its structured error verbatim when `ok:false`. While this session is plan-connected, the dashboard's own reminders for it (today: `plan_list.listener_unattached`, attached by the server to `GET /api/plans` when the event listener is unattached past the startup grace, DX-3997) are relayed into the body's `reminders[]`; the MCP carries no reminder text or state of its own and re-reads at most every 30s. |
-| `danxbot_api_list` | No args. Lists the routes this caller's credential may reach as `{routes: ["METHOD /path"]}` (one bare string per route, exactly what `danxbot_api_spec` takes; a dispatch's own callbacks are in it) — call this first when you don't know the route for what you need to do. |
+| `danxbot_api_list` | No args. Lists the routes this caller's credential may reach as `{routes: ["METHOD /path"], external: [{route, served_by}]}` (one bare string per route, exactly what `danxbot_api_spec` takes) — call this first when you don't know the route for what you need to do. |
 | `danxbot_api_spec` | `{endpoints}` (comma-joined `METHOD /path` list, required, min 1). Returns the exact OpenAPI contract for those routes — call this when you know the route but not its exact request/response shape. |
 | `attach_file` | `{card_id, path, replaces?, primary?, filename?, content_type?}` — the server reads the LOCAL file at `path` (absolute, `/tmp/a.png` or `C:\x\a.png`) and uploads it, so its bytes never pass through the agent's context. `replaces: <attachment id>` swaps that attachment's file in place (`PUT /api/issues/:id/attachments/:aid`: same id, name and cover flag) instead of adding one; `primary: true` makes it the card's single cover, atomically with the write. Reply: `{issue: <compact row>, attachment_id, url, thumbnail_url, is_primary}`. Shown to a key holding `cards.edit` (DX-4523); a dispatch profile still receives it only when its catalog selection names it (`slack-agent` and `work`, DX-4386, through `extraTools`). A screenshot of browser-visible work: first `primary: true`, then `replaces` at each milestone. |
 | `request_permission` | `{permissions, reason}` — asks a person to grant this key ONE MORE permission (see "Asking for one more permission" above). Answers at once with the approval URL and confirm code; the grant is picked up in the background. |
 
 There is no dedicated `resource_fields` tool (removed DX-3465 — it was a thin wrapper `danxbot_api` already reaches with no agent-specific behavior earning it its own tool). What an opt-in field TREE may name for one resource (`{resource, description, always, hashes, fields, relations}`) is `danxbot_api({method:"GET", path:"/api/resources/<resource>/fields"})` — install-global, no `board`; `resource: "issue"` is the root, and a relation's own `resource` in the response is what to call this again with, one level deeper.
 
-A dedicated tool survives only for something no `danxbot_api` call can do, never a card/plan/dispatch-callback operation: `request_permission` (asks for a permission its key lacks), `plan_connect` (binds the session to a plan; the event-bridge hook keys on it), and the two that read LOCAL files, `attach_file` and `danxbot_slack_reply` (`files[]`, see `src/lifecycle.ts`). The live list is always `tool-defs.json` in this package, regenerated by `npm run gen-tool-defs` — read it rather than trusting a list copied into prose.
+A dedicated tool survives only for something about the agent itself, never a card/plan operation: `request_permission` (asks for a permission its key lacks), `plan_connect` (binds the session to a plan; the event-bridge hook keys on it) and the per-dispatch worker callbacks (`danxbot_complete`, `danxbot_slack_reply`, `danxbot_slack_post_update`, `load_template_app`/`save_template_app`, `quality_gate_complete`, `link_thread_to_issue`, `attach_file`, the `slack_recovery_*` trio, `danxbot_set_evaluator_summary`) — see `src/lifecycle.ts`. The live list is always `tool-defs.json` in this package, regenerated by `npm run gen-tool-defs` — read it rather than trusting a list copied into prose.
 
 Card and plan reads/writes go through `danxbot_api` against the issue/plan route families documented in `GET /api/openapi` (via `danxbot_api_spec`) — `POST /api/issues`, `GET /api/issues/:id` (or `/batch` for many at once, DX-2727), `PATCH /api/issues/:id/edit`, `POST /api/issues/:id/transition`, the problems/solutions/dependencies/comments/quality-gates/retro sub-resource routes, and the equivalent `/api/plans/*` family (`GET /api/plans/:planId` — cheap scalars by default, `fields` opts into `cards`/`records`/`architecture`/`session_history`/`worker_dispatches`; `GET /api/plans` for the list, with an optional `status` filter over the same computed `complete`/`awaiting-session`/`building`/`planning` value `GET /api/plans/:planId` always returns ungated).
 

package/dist/danxbot-api-examples.js

@@ -21,10 +21,6 @@
  * list example filters by `q`/`include_closed` instead. Two haiku AC ticks
  * read `ac` (no checklist id) and sent `ac` / `0` as the checklist id: the
  * card read shows only `checklists`, and both tick ids name it.
- * DX-4525 - the card-list and comment examples were trimmed: a list or a comment sent wrong is refused with a body naming
- * the fix, and the spec call the description asks for first shows both. The dispatch-callback calls (complete, gate sign-off,
- * code review) are NOT shown here: only a dispatch makes them, so every operator session would pay for them in this
- * description; each profile's own instructions name its route and body.
  *
  * Kept as data, not prose, so danxbot's own tests can check each example
  * against the live server contract (route table, resource fields, body
@@ -37,6 +33,11 @@ export const DANXBOT_API_EXAMPLES = {
         path: "/api/issues/<id>",
         query: { fields: { description: true, comments: true, checklists: true, parent_title: true } },
     },
+    cardList: {
+        method: "GET",
+        path: "/api/issues",
+        query: { filter: { q: "<text>", include_closed: true } },
+    },
     cardCreate: {
         method: "POST",
         path: "/api/issues",
@@ -54,6 +55,11 @@ export const DANXBOT_API_EXAMPLES = {
         path: "/api/issues/<id>/edit",
         body: { description: "<markdown>", ac: [{ title: "<criterion>" }], content_hash: "<content_hash from your read>" },
     },
+    comment: {
+        method: "POST",
+        path: "/api/issues/<id>/comments",
+        body: { text: "<markdown>" },
+    },
     acTick: {
         method: "PATCH",
         path: "/api/issues/<id>/checklists/<checklists[].id>/items/<checklists[].items[].id>",
@@ -88,8 +94,10 @@ function render(example) {
 export function danxbotApiExamplesText() {
     const e = DANXBOT_API_EXAMPLES;
     return (`Correct first calls: card read ${render(e.cardRead)} (\`fields\` is an object, never a comma string); ` +
+        `card list ${render(e.cardList)} (filters only inside \`filter\`); ` +
         `card create ${render(e.cardCreate)} (\`plan\` required: "mine" or null; \`summary\` required, on every phase_children[] item too); ` +
         `card edit ${render(e.cardEdit)} (only the keys you change; \`ac\` replaces the list); ` +
+        `comment ${render(e.comment)}; ` +
         `AC tick ${render(e.acTick)}; ` +
         `transition ${render(e.transition)}; ` +
         `retro, only after \`complete\` or \`cancel\`, ${render(e.retro)} (description "" unless the flag is true; ` +

package/dist/handlers.js

@@ -137,7 +137,7 @@ export async function danxbotApi(client, args) {
 const ROUTES_BASE_PATH = "/api/routes";
 /**
  * `danxbot_api_list()` — the routes YOUR credential may currently call,
- * `{routes: ["METHOD /path"]}`, one string each (DX-4401). Backed by DX-3528's
+ * `{routes: ["METHOD /path"], external: [{route, served_by}]}`, one string each (DX-4401). Backed by DX-3528's
  * `GET /api/routes`, which filters the served route table through the SAME
  * `isRouteAuthorizedForPrincipal` check `authorize()` enforces on every
  * request — a route listed here is always callable, and a route this

package/dist/index.js

@@ -108,7 +108,7 @@ import { bodyValueSchema, queryValueSchema } from "./types.js";
 import { termsAcceptanceCallHalt, termsHaltFor } from "./terms-halt.js";
 import { danxbotApiExamplesText } from "./danxbot-api-examples.js";
 import { assertWithinTextLimit } from "./text-limit.js";
-import { registerLifecycleTools, presentCallbacksFromEnv } from "./lifecycle.js";
+import { registerLifecycleTools, presentCallbacks, readLifecycleUrlsFromEnv, } from "./lifecycle.js";
 import { TOOL_ACCESS } from "./tool-access.js";
 import { ToolAccessSync, ToolSurface } from "./tool-surface.js";
 import { PermissionWatch } from "./permission-watch.js";
@@ -226,7 +226,7 @@ function boot() {
     // before `server.connect()`) as a session with no key: the bootstrap set plus the callback tools this dispatch's worker
     // gave a URL for. `syncToolsAfterSignIn` widens it once the key's permissions are read. The DX-1606 tool-defs
     // generator imports this module WITHOUT calling `boot()`, so it still sees every tool enabled.
-    const surface = new ToolSurface(registeredTools, presentCallbacksFromEnv(), () => server.sendToolListChanged());
+    const surface = new ToolSurface(registeredTools, presentCallbacks(readLifecycleUrlsFromEnv()), () => server.sendToolListChanged());
     surface.apply(new Set());
     toolAccessSync = new ToolAccessSync({
         surface,
@@ -361,8 +361,7 @@ function readSessionConfig() {
 }
 /**
  * DX-3465 (PLN-11 R-25) — the conventions shared by every `danxbot_api` call,
- * stated once here instead of on each tool. DX-4525 / DX-4015: its first paragraph makes `danxbot_api` THE channel and says
- * to read the spec first (an agent skipping the spec is a behaviour to fix, not a reason to keep a tool per job).
+ * stated once here instead of on each tool.
  *
  * DX-4318 — this block is the ONE home of the stale-hash rule and of the
  * writing standard (PLN-11 R-24): it is the only text every caller of these
@@ -372,9 +371,8 @@ function readSessionConfig() {
  * below refuses a block that would be cut again. Behaviour only, no rationale.
  */
 const SERVER_INSTRUCTIONS = `\
-\`danxbot_api\` is your primary channel to the dashboard: every card, plan, Slack and dispatch-callback job (ending
-your dispatch included) is a call to it. Find a route with \`danxbot_api_list\`. Read its exact shape with
-\`danxbot_api_spec\` before the first call to any route you have not called before; never guess a body.
+Conventions for every \`danxbot_api\` call. Find a route with \`danxbot_api_list\` and its exact shape with
+\`danxbot_api_spec\`.
 
 RESOURCES. Most collections take GET (list) and POST (create); a single resource (\`<collection>/<id>\`) takes
 GET, PATCH or PUT (send only the fields you change) and DELETE. A card is edited at
@@ -478,9 +476,11 @@ function strictTool(name, description, shape, cb) {
     registeredTools.set(name, tool);
     return tool;
 }
-// ---------------- lifecycle tool set (DX-3465 / PLN-11 R-25, DX-4525) ----------------
-// One tool is left, `danxbot_slack_reply` (it reads local files); every other dispatch callback is a `danxbot_api` call
-// (see `lifecycle.ts`). `toolsFor` (`tool-access.ts`) decides whether a session sees it.
+// ---------------- lifecycle tool set (DX-3465 / PLN-11 R-25) ----------------
+// Merged from `src/mcp/danxbot-server.ts` — see `lifecycle.ts` for the full
+// per-tool doc comments and the DX-3394 problem 1682 cleanup this merge
+// folded in. `danxbot_complete` registers unconditionally-visible; the rest
+// register here; `toolsFor` (`tool-access.ts`) decides which a session sees.
 registerLifecycleTools(strictTool);
 // Optional per-call board override shared by every tool. Omitted → the
 // dispatch's env-derived board (`<repo>:<slug>`) is used; provided → that
@@ -511,9 +511,9 @@ strictTool("danxbot_api",
 // to a plan-connected session; the reminder's text explains itself.
 "Call any dashboard API route your credential may reach. The answer is the route's JSON body: act on its " +
     "`reminders[]` when present. " +
-    // DX-4015 / DX-4525 — narrows SERVER_INSTRUCTIONS' general spec-first rule: a write shown below is
-    // copied from its example (3 of 3 canary sessions did, with zero 4xx), so only a write NOT shown, and
-    // always the retro, needs a spec call first.
+    // DX-4015 — the ONE statement of which writes need a spec call first; the
+    // `work` profile's spec-first sentence defers to this list. A shown write
+    // is copied from its example (3 of 3 canary sessions did, with zero 4xx).
     "Before your first write to a route not shown below, and always before `PUT /api/issues/:id/retro`, " +
     "call `danxbot_api_spec`. " +
     // DX-3923 — the shapes agents guessed wrong most often, shown before the
@@ -565,15 +565,13 @@ async (args) => {
 // ---------------- danxbot_api_list (DX-3465 A5, PLN-11 R-25) ----------------
 strictTool("danxbot_api_list", 
 // DX-3528 — the list is filtered by the same permission check every request takes.
-"Start here to find the route for any job: lists the dashboard API routes your credential may call, `{routes: " +
-    "[\"METHOD /path/template\", ...]}`, the strings `danxbot_api_spec` takes (`POST /api/issues/:id/transition`). A route " +
-    "not listed is not callable by you.", {}, async () => guardedBoundedJson(() => danxbotApiList(client)));
+"Lists the dashboard API routes your credential may call: `{routes: [\"METHOD /path/template\", ...], external: [...]}`, the " +
+    "strings `danxbot_api_spec` takes (`POST /api/issues/:id/transition`); `external` are worker-served routes. A route not " +
+    "listed is not callable by you.", {}, async () => guardedBoundedJson(() => danxbotApiList(client)));
 // ---------------- danxbot_api_spec (DX-3465, PLN-11 R-25) ----------------
 strictTool("danxbot_api_spec", 
-// DX-3527 — the contract is generated from the route table. DX-4015 / DX-4525 — read before the first call to a route you
-// have not called: `danxbot_api` is the only channel, and a guessed body is a 4xx or a wrong terminal call.
-"Read this before your first `danxbot_api` call to any route you have not called before. The OpenAPI 3.1 contract for the " +
-    "routes you name: request and response shape, required permission and " +
+// DX-3527 — the contract is generated from the route table.
+"The OpenAPI 3.1 contract for the routes you name: request and response shape, required permission and " +
     'every documented error. `endpoints`: `"METHOD /path/template"` strings as `danxbot_api_list` reports them ' +
     '(e.g. `"POST /api/issues/:id/transition"`), never a real path with ids. An endpoint the dashboard does ' +
     "not serve, or your credential may not call, is refused and named.", {

package/dist/key-revoked-halt.js

@@ -14,14 +14,13 @@ export function keyRevocationOf(result) {
     return { revokedBy: body.revokedBy, revokedAt: body.revokedAt };
 }
 /**
- * The one halt. `dispatched` is a dispatch's own credential: it makes no further call (every dashboard route, the
- * dispatch-complete one included, refuses a revoked key; DX-4525), because the worker finds the revocation itself and ends the
- * dispatch as revoked, not as the agent's failure (`src/worker/dispatch-execution.ts`). An operator session ends by telling the
- * person; it has no tool that ends it.
+ * The one halt. `dispatched` is a dispatch's own credential: it ends with `danxbot_complete` (a worker tool, which does not
+ * use the revoked key), and the worker records the end as revoked, not as the agent's failure. An operator session ends by
+ * telling the person; it has no tool that ends it.
  */
 export function keyRevokedHalt(revocation, dispatched) {
     const ending = dispatched
-        ? "Then stop and make no further call: the worker ends this dispatch itself and records it as revoked, not as a failure."
+        ? 'End this dispatch with danxbot_complete({status: "failed", summary: "<where your work is committed>"}); the worker records it as revoked, not as a failure.'
         : "Then end this session: tell the person what you committed and stop.";
     return (`STOP ALL WORK NOW. ${revocation.revokedBy} revoked your access to the danxbot dashboard at ${revocation.revokedAt}.\n\n` +
         "Commit your work in progress now (commit what you have; do not run agent-finalize.sh and do not merge). " +

package/dist/lifecycle.js

@@ -1,44 +1,111 @@
 /**
- * DX-3465 (PLN-11 R-25) / DX-4525 - the "lifecycle" tool set: the one agent-specific dispatch callback that is
- * still a dedicated tool, `danxbot_slack_reply`.
+ * DX-3465 (PLN-11 R-25 / plan rule R-25) — the "lifecycle" tool set: agent-
+ * specific dispatch callbacks, merged from danxbot's own `src/mcp/danxbot-server.ts`
+ * (DX-3459 problem 1754, decision: one server, named tool sets, switched on
+ * per profile). These are NOT dashboard CRUD — they are the agent's own
+ * self-report channel to the worker/dashboard that spawned it: "I'm done"
+ * (`danxbot_complete`), Slack reply/update/recovery, quality-gate sign-off,
+ * template-app load/save, and the evaluator summary. Every dashboard CRUD
+ * operation these tools used to sit beside (issue_*, plan_* etc.) goes
+ * through `danxbot_api` instead (R-25) — see `index.ts`.
  *
- * Every other dispatch callback is a `danxbot_api` call: an agent makes
- * the dispatch-complete, gate sign-off, code-review request, evaluator-summary, template-app load / save, Slack update and
- * recovery calls through it (`src/dispatch/callback-routes.ts` names each route), so a dispatch learns ONE channel to the dashboard and reads its
- * spec instead of carrying a tool schema per job. This one stays a tool because it reads local files (`files[]`) and
- * uploads their bytes, which no `danxbot_api` call can do.
+ * Registered UNCONDITIONALLY at module load (so the DX-1606 tool-defs
+ * generator — which never calls `boot()` — still introspects every one of
+ * them for token-cost accounting). Which of them a session SEES is decided by
+ * `toolsFor` (`tool-access.ts`) from the key's permissions and the callback
+ * URLs present (`presentCallbacks`), applied by `tool-surface.ts` (DX-4523).
  *
- * Registered UNCONDITIONALLY at module load (so the DX-1606 tool-defs generator, which never calls `boot()`, still
- * introspects it for token-cost accounting). Whether a session SEES it is decided by `toolsFor` (`tool-access.ts`) from the
- * key's permissions and the callback URL present (`presentCallbacksFromEnv`), applied by `tool-surface.ts` (DX-4523).
+ * DX-3394 problem 1682 cleanup folded into this merge:
+ *  - `danxbot_restart_worker` — already removed on `main` before this card
+ *    (DX-3231 host-mode removal); never carried over.
+ *  - `quality_gate_skip` folded into `quality_gate_complete` as
+ *    `status: "skipped"` (reason ≥20 chars, same server-side bar).
+ *  - `slack_replace_message` + `slack_purge_message` merged into
+ *    `slack_recovery_message({action: "replace" | "purge", ts, text?})`.
+ *  - `ready` / `archive` / `review` removed from `AGENT_COMPLETE_STATUSES`
+ *    (Core Principle 1 — no legacy aliases). The `danx-flesh-out` plugin
+ *    skill instructed the old aliases; that is Part B (plugin-side prose),
+ *    not reachable from this repo.
+ *  - `danxbot_update_router_prompt` DELETED OUTRIGHT (DX-3459 problem 1755,
+ *    decision 251: the router prompt becomes an ordinary board setting,
+ *    reached through `danxbot_api` with a scoped permission — no dedicated
+ *    tool). The slack-agent profile documents the route (Part B).
+ *  - Descriptions trimmed of DX-card historical narration where cheap to do
+ *    without re-deriving the byte-for-byte target DX-3394 measured.
  */
 import { readFile, stat } from "node:fs/promises";
 import { basename, isAbsolute } from "node:path";
 import { z } from "zod";
 import { CALLBACK_ENV } from "./tool-access.js";
-import { CREDENTIAL_TOKEN_ENV } from "./credential.js";
-/** The callbacks whose URL the worker injected into this process's environment (an empty value reads as absent): what `toolsFor` takes as this dispatch's callbacks. */
-export function presentCallbacksFromEnv() {
-    return new Set(Object.keys(CALLBACK_ENV).filter((name) => (process.env[CALLBACK_ENV[name]] ?? "") !== ""));
+/**
+ * The five canonical agent-visible `danxbot_complete` statuses. DX-3394
+ * problem 1682 / Core Principle 1 — the pre-DX-770 deprecated aliases
+ * (`completed`, `agent_blocked`) were already gone; this merge additionally
+ * drops the `ready` / `archive` / `review` backward-compat aliases that
+ * Core Principle 1 forbids as standing legacy tolerance. A dispatch that
+ * needs one of those non-terminal lifecycle stamps transitions the card
+ * FIRST through `danxbot_api` ({method:'POST', path:'/api/issues/:id/transition',
+ * body:{action:'ready'|'archive'}}), then calls
+ * `danxbot_complete({status:'complete'})`.
+ */
+export const AGENT_COMPLETE_STATUSES = [
+    "complete",
+    "cancelled",
+    "failed",
+    "critical_failure",
+    "waiting_on_dependency",
+];
+/** DX-722 — minimum `summary` length for `failed` to count as a legitimate self-block. */
+export const ADEQUATE_SUMMARY_MIN_CHARS = 30;
+/** DX-1369 — minimum reason length for a `quality_gate_complete` "skipped" verdict. */
+export const QUALITY_GATE_SKIP_REASON_MIN_CHARS = 20;
+export function hasAdequateBlockSummary(summary) {
+    return typeof summary === "string" && summary.trim().length >= ADEQUATE_SUMMARY_MIN_CHARS;
+}
+/** The callbacks whose URL is present: what `toolsFor` takes as this dispatch's callbacks (`tool-access.ts`). */
+export function presentCallbacks(urls) {
+    return new Set(Object.keys(urls).filter((name) => urls[name] !== undefined));
+}
+/** Read the lifecycle callback URLs straight from `process.env`; an empty value reads as absent. */
+export function readLifecycleUrlsFromEnv() {
+    const urls = {};
+    for (const name of Object.keys(CALLBACK_ENV)) {
+        const v = process.env[CALLBACK_ENV[name]];
+        if (typeof v === "string" && v !== "")
+            urls[name] = v;
+    }
+    return urls;
 }
 async function postJson(url, body, bearer) {
     return fetch(url, {
         method: "POST",
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${bearer}` },
+        headers: {
+            "Content-Type": "application/json",
+            ...(bearer ? { Authorization: `Bearer ${bearer}` } : {}),
+        },
         body: JSON.stringify(body),
     });
 }
-/**
- * DX-4525 - the dispatch's own credential, the one `danxbot_api` calls the dashboard with: a dispatch declares it in
- * `DANX_DASHBOARD_CREDENTIAL` (`credential.ts`) and it never signs out. Read here, not through the late-bound `SessionAccess`,
- * so the tool works wherever the module is imported; a missing one is a loud failure, never an unauthenticated post.
- */
-function dispatchCredential() {
-    const token = process.env[CREDENTIAL_TOKEN_ENV];
-    if (typeof token !== "string" || token.trim() === "") {
-        throw new Error(`danxbot_slack_reply: ${CREDENTIAL_TOKEN_ENV} is not set for this dispatch`);
+/** DX-925 — bearer for dispatch-internal WORKER routes (stop, quality-gate, template-app, ...). */
+function agentBearer() {
+    return process.env.DANX_AGENT_TOKEN;
+}
+/** DX-2246 — bearer for the callbacks that target the DASHBOARD (slack reply/update, link-thread, slack-recovery). */
+function dashboardBearer() {
+    return process.env.DANXBOT_DASHBOARD_TOKEN;
+}
+async function postWorkerRoute(url, body, toolName, bearer) {
+    const response = await postJson(url, body, bearer);
+    const text = await response.text();
+    if (!response.ok) {
+        throw new Error(`${toolName} worker endpoint returned HTTP ${response.status}: ${text}`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { raw: text };
     }
-    return token.trim();
 }
 /** Must match `MAX_DECODED_BYTES` in danxbot's `src/issues/attachment-limits.ts` (duplicated, not imported: this package is published on its own). */
 const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
@@ -73,30 +140,89 @@ async function responseFailure(label, response) {
     return new Error(`${label} returned HTTP ${response.status}${text ? `: ${text}` : ""}`);
 }
 /**
- * Registers the lifecycle tool on `server` via the caller's `strictTool` wrapper (so it gets the same DX-3238 strict-shape
- * guard the rest of this package's tools use).
+ * Registers every lifecycle tool on `server` via the caller's `strictTool`
+ * wrapper (so every tool here gets the same DX-3238 strict-shape guard the
+ * rest of this package's tools use) and returns the `RegisteredTool` handles
+ * for the ones that are conditionally visible — `boot()` disables each based
+ * on `readLifecycleUrlsFromEnv()`.
  */
 export function registerLifecycleTools(strictTool) {
+    // ---------------- danxbot_complete ----------------
+    // DX-3465 (code-quality gate finding, at 275f82c0d) — this tool used to be
+    // unconditionally visible on the theory that "every dispatch ends with
+    // it", but an OPERATOR session is not a dispatch: it has no
+    // DANXBOT_STOP_URL, so `danxbot_complete` was always advertised there and
+    // every call threw. It is now gated on the stop URL exactly like every
+    // other lifecycle tool below (`toolsFor`, `tool-access.ts`) — a real
+    // dispatch always has the URL, so nothing is lost there; an operator
+    // session simply never sees a tool it could never successfully call.
+    strictTool("danxbot_complete", "Finalize the current dispatch. Releases the worker's per-dispatch scope and ends the dispatch row. " +
+        "Does NOT move any card — if you're working an issue-bound dispatch and want the card to move " +
+        "(Done / Blocked / Cancelled / etc.), transition the card FIRST through danxbot_api " +
+        "({method:'POST', path:'/api/issues/:id/transition', body:{action:...}}), then call this tool. " +
+        "Always call this when done instead of simply stopping output.", {
+        status: z.enum(AGENT_COMPLETE_STATUSES).describe("complete = work shipped, ends the dispatch row (does NOT move the card — transition it first); " +
+            "failed = the dispatch stopped without shipping: an environment failure, a card-specific block, " +
+            "or a stop for an operator decision. Ends the dispatch row failed; it strikes your agent only " +
+            `when the summary is under ${ADEQUATE_SUMMARY_MIN_CHARS} characters. Does NOT block the card — if the ` +
+            "cause is card-specific, first transition the card with action 'block' and a reason through " +
+            "danxbot_api ({method:'POST', path:'/api/issues/:id/transition', body:{action:'block', reason}}). " +
+            "Waiting on other work is a depends_on edge, not a block; when a human is 100% required, first " +
+            "add a problem with solutions (POST /api/issues/:id/problems), then end with this status; " +
+            "cancelled = agent voluntarily abandons the dispatch (does NOT cancel the card — transition it first); " +
+            "critical_failure = environment broken in a way that affects every dispatch (MCP tools not loading, " +
+            "Bash unavailable, Claude auth missing) — halts the poller until a human clears it; " +
+            // DX-4318 — the steps live in each profile that grants this ending (`work` and `failure-repair`,
+            // `required-profiles.yaml`), never repeated here.
+            "waiting_on_dependency = blocked on a card that must land on another board or repo: do your " +
+            "profile's steps for work that needs another repo or board's change first."),
+        summary: z
+            .string()
+            .describe("Brief summary of what happened. For failed, why the dispatch stopped, " +
+            `≥${ADEQUATE_SUMMARY_MIN_CHARS} chars or your agent takes a strike. For ` +
+            "critical_failure, the specific environment issue. For complete, a one-line summary of what shipped. " +
+            "Card-side context belongs on the transition call (through danxbot_api), not here."),
+    }, async (args) => {
+        const stopUrl = readLifecycleUrlsFromEnv().stop;
+        if (!stopUrl) {
+            throw new Error("danxbot_complete: DANXBOT_STOP_URL not configured for this dispatch");
+        }
+        let response;
+        try {
+            response = await postJson(stopUrl, { status: args.status, summary: args.summary }, agentBearer());
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            throw new Error(`danxbot_complete: POST to worker stop endpoint failed (${detail}) — terminal transition NOT applied.`);
+        }
+        if (!response.ok) {
+            const text = await response.text();
+            throw new Error(`danxbot_complete: worker stop endpoint returned HTTP ${response.status}: ${text} — terminal transition NOT applied.`);
+        }
+        return {
+            content: [{ type: "text", text: `Agent signaled ${args.status}: ${args.summary}` }],
+        };
+    });
     // ---------------- danxbot_slack_reply ----------------
     strictTool("danxbot_slack_reply", 
     // DX-4253 — no ordering against another tool here: the Slack persona (`src/agent/persona.ts`) and the
     // `slack-agent` profile own the order (reply, link, attach, complete).
     "Post the final user-facing reply to the originating Slack thread, once per dispatch. Files in `files[]` " +
-        "post with the text as one thread message. For a progress update, `danxbot_api` `POST /api/slack/update` `{text}`.", {
+        "post with the text as one thread message. For progress updates use danxbot_slack_post_update.", {
         text: z.string().describe("The final reply text to post to the Slack thread."),
         files: z
             .array(z.string())
             .optional()
             .describe("Absolute paths of your own files to attach; bytes are uploaded."),
     }, async (args) => {
-        const url = process.env[CALLBACK_ENV.slackReply];
+        const url = readLifecycleUrlsFromEnv().slackReply;
         if (!url)
             throw new Error("danxbot_slack_reply called outside a Slack dispatch");
         const files = await readAttachments(args.files);
         const body = { text: args.text };
         if (files.length > 0)
             body.files = files;
-        const response = await postJson(url, body, dispatchCredential());
+        const response = await postJson(url, body, dashboardBearer());
         if (!response.ok)
             throw await responseFailure("Slack reply API", response);
         return {
@@ -110,4 +236,225 @@ export function registerLifecycleTools(strictTool) {
             ],
         };
     });
+    // ---------------- danxbot_slack_post_update ----------------
+    strictTool("danxbot_slack_post_update", "Post an intermediate progress update to the originating Slack thread. Use SPARINGLY — only for " +
+        "meaningful status the user cares about. Do NOT post for every file read or trivial step.", { text: z.string().describe("The intermediate status update text.") }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().slackUpdate;
+        if (!url)
+            throw new Error("danxbot_slack_post_update called outside a Slack dispatch");
+        const response = await postJson(url, { text: args.text }, dashboardBearer());
+        if (!response.ok)
+            throw await responseFailure("Slack update API", response);
+        return { content: [{ type: "text", text: "Update posted to Slack thread" }] };
+    });
+    // ---------------- link_thread_to_issue ----------------
+    strictTool("link_thread_to_issue", "Upgrade THIS Slack thread into a tracked card: bind the thread to ONE issue (immutable 1:1) and " +
+        "register the Slack mirror so future card updates re-render the thread's card-view message. Thread " +
+        "scope is IMPLICIT (channel + thread_ts come from the dispatch) — pass only the issue id. Call this " +
+        "AFTER posting your substantive answer with danxbot_slack_reply (that reply becomes the card-view " +
+        '"message #1"). A second call on an already-linked thread fails loud with a 409 — never a silent re-link.', { issue_id: z.string().describe('The card id to bind this thread to (e.g. "ABC-123").') }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().linkThreadToIssue;
+        if (!url)
+            throw new Error("link_thread_to_issue called outside a Slack dispatch");
+        const result = await postWorkerRoute(url, { issue_id: args.issue_id }, "link_thread_to_issue", dashboardBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- slack_recovery_list ----------------
+    strictTool("slack_recovery_list", "Read-only. Returns the Slack thread's full stored message history plus failures[], the recorded " +
+        "router failures projected out of those same messages, so you can reason about what happened before " +
+        "mutating anything. Only available on a slack-recovery dispatch.", {}, async () => {
+        const url = readLifecycleUrlsFromEnv().slackRecoveryList;
+        if (!url)
+            throw new Error("slack_recovery_list called outside a slack-recovery dispatch");
+        const result = await postWorkerRoute(url, {}, "slack_recovery_list", dashboardBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- slack_recovery_message (merged replace+purge, DX-3394 problem 1682) ----------------
+    strictTool("slack_recovery_message", "Replace or delete ONE message you posted in this thread. `action: 'replace'` (`chat.update`) rewrites " +
+        "the message text — the replaced message becomes this thread's card-view anchor ('message #1'): a " +
+        "later link_thread_to_issue registers THIS ts, and danxbot re-renders the real card view into this " +
+        "exact slot, so write a short human line, never a hand-written card view, in `text`. `action: 'purge'` " +
+        "(`chat.delete` + prunes the matching thread-history entry in ONE call — never post-and-hope these " +
+        "happen separately). Both REFUSE any ts you did not author (server-side) and are idempotent: replacing " +
+        "or purging an already-gone ts succeeds as a no-op.", {
+        action: z.enum(["replace", "purge"]),
+        ts: z
+            .string()
+            .describe("The Slack message timestamp to act on. Must be a message this bot authored (from " +
+            "slack_recovery_list's messages[] with isBot:true — every failures[] postedTs is one)."),
+        text: z
+            .string()
+            .optional()
+            .describe("Required for action:'replace' — the new message text. Ignored for 'purge'."),
+    }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().slackRecoveryMessage;
+        if (!url)
+            throw new Error("slack_recovery_message called outside a slack-recovery dispatch");
+        if (args.action === "replace" && args.text === undefined) {
+            throw new Error("slack_recovery_message: text is required for action:'replace'");
+        }
+        const body = { action: args.action, ts: args.ts };
+        if (args.text !== undefined)
+            body.text = args.text;
+        const result = await postWorkerRoute(url, body, "slack_recovery_message", dashboardBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- slack_recovery_create_or_link ----------------
+    strictTool("slack_recovery_create_or_link", "The ONLY way to get a card id for this thread on a slack-recovery dispatch (danxbot_api's card-create " +
+        "route, POST /api/issues, is not available here). Resolves SERVER-SIDE whether the thread already " +
+        "resolves to a card before creating " +
+        "anything: a hit returns that existing card's id (created:false) and creates NOTHING; a miss creates a " +
+        "fresh card with the fields you pass (created:true) — a duplicate card is structurally impossible. " +
+        "Either way, follow up with link_thread_to_issue({issue_id}) using the returned id.", {
+        type: z
+            .enum(["Bug", "Story", "Chore"])
+            .describe("The card type. Never Epic/Feature — a single Slack request never warrants a container card."),
+        title: z.string().describe("Card title."),
+        // DX-4515: the create route refuses a card with no summary.
+        summary: z
+            .string()
+            .min(1)
+            .describe("REQUIRED: one plain line saying what the card is, shown at the top of the card page."),
+        description: z
+            .string()
+            .describe("Card description — sourced from the triggering human message's content."),
+        ac: z
+            .array(z.object({ title: z.string() }).strict())
+            .optional()
+            .describe("Optional acceptance-criteria items."),
+        effort_level: z.string().optional().describe("Optional effort level."),
+        priority: z.number().optional().describe("Optional priority in [0, 6)."),
+        triage_enabled: z.boolean().optional().describe("Optional auto-triage opt-in; absent → false."),
+    }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().slackRecoveryCreateOrLink;
+        if (!url)
+            throw new Error("slack_recovery_create_or_link called outside a slack-recovery dispatch");
+        const body = {
+            type: args.type,
+            title: args.title,
+            summary: args.summary,
+            description: args.description,
+        };
+        if (args.ac !== undefined)
+            body.ac = args.ac;
+        if (args.effort_level !== undefined)
+            body.effort_level = args.effort_level;
+        if (args.priority !== undefined)
+            body.priority = args.priority;
+        if (args.triage_enabled !== undefined)
+            body.triage_enabled = args.triage_enabled;
+        const result = await postWorkerRoute(url, body, "slack_recovery_create_or_link", dashboardBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- quality_gate_complete (absorbs quality_gate_skip, DX-3394 problem 1682) ----------------
+    strictTool("quality_gate_complete", 
+    // DX-3741 — every gate runs as its own gate-reviewer dispatch, the only one that sees this tool. DX-4318 —
+    // what a status does, per phase; how to review (read-only, no transition) is the gate-reviewer profile's
+    // (`required-profiles.yaml`). The "3-pass cap" mirrors CODE_GATE_MAX_REVIEW_PASSES
+    // (`src/issues/quality-gates/registry.ts`), which this separately published package cannot import;
+    // `src/tokens/tool-defs.test.ts` compares the two.
+    "Sign off the quality gate you are reviewing. It is your dispatch's TERMINAL call: never follow it with " +
+        "danxbot_complete. PLAN gate: `pass` releases the card to the next gate or the work agent; `fail` blocks " +
+        "the card with `message` as the reason; `retry` means you edited the card into a sounder plan and want " +
+        "a fresh pass. CODE gate: report every finding in `findings[]`; `fail` returns the findings to the " +
+        "author, who fixes them and requests review again, and at the 3-pass cap blocks the card instead (sign " +
+        "on the findings alone; the dispatcher enforces the cap); `pass` releases toward the next code gate or " +
+        "the author's finalize; `retry` is refused. `skipped`: the gate obviously does not apply to this diff " +
+        "(one line, docs only, nothing in its lane), with `message` as the mandatory justification of at least " +
+        `${QUALITY_GATE_SKIP_REASON_MIN_CHARS} characters; never skip to dodge a real review.`, {
+        gate: z.string().describe("Registered gate name, e.g. 'plan-architecture' or 'code-quality'."),
+        status: z.enum(["pass", "fail", "retry", "skipped"]),
+        message: z
+            .string()
+            .describe("Sign-off rationale / verdict summary. On a plan-gate fail this becomes the card's block reason. " +
+            `On 'skipped' this is the mandatory ≥${QUALITY_GATE_SKIP_REASON_MIN_CHARS}-char justification.`),
+        findings: z
+            .array(z
+            .object({
+            title: z.string(),
+            description: z.string().optional(),
+            status: z.string().optional(),
+            reasoning: z.string().optional(),
+        })
+            .strict())
+            .optional()
+            .describe("Code gates only — structured findings, one object per finding. Omit for plan gates."),
+    }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().qualityGate;
+        if (!url)
+            throw new Error("quality_gate_complete called outside a quality-gate-capable dispatch");
+        if (args.status === "skipped" &&
+            args.message.trim().length < QUALITY_GATE_SKIP_REASON_MIN_CHARS) {
+            throw new Error(`quality_gate_complete: message must be at least ${QUALITY_GATE_SKIP_REASON_MIN_CHARS} characters ` +
+                `for status:'skipped' — it is the accountability record for skipping the "${args.gate}" gate`);
+        }
+        const body = { gate: args.gate, status: args.status, message: args.message };
+        if (args.findings !== undefined)
+            body.findings = args.findings;
+        const result = await postWorkerRoute(url, body, "quality_gate_complete", agentBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- request_code_review (DX-3741) ----------------
+    strictTool("request_code_review", "TERMINAL for this dispatch — call it when your diff is done and its own tests are green, instead of " +
+        "danxbot_complete. Pushes your branch (card/<id> to origin/card/<id>), then dispatches every code " +
+        "gate this card carries as its OWN independent gate-reviewer dispatch (you never sign or review your " +
+        "own diff). Ends this dispatch 'completed' and releases the card to ToDo; when the card is " +
+        "re-dispatched to you, read its quality_gates (through danxbot_api): every code gate pass/skipped → " +
+        "run agent-finalize.sh and complete normally; any fail → fix its findings, then call " +
+        "request_code_review again (never sign or remove a code gate yourself — removal is refused, 409). " +
+        "Takes no arguments. A card with no code gates has nothing to request — finalize directly instead.", {}, async () => {
+        const url = readLifecycleUrlsFromEnv().requestCodeReview;
+        if (!url)
+            throw new Error("request_code_review called outside a work dispatch");
+        const result = await postWorkerRoute(url, {}, "request_code_review", agentBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- danxbot_set_evaluator_summary ----------------
+    strictTool("danxbot_set_evaluator_summary", "Write the root-cause summary for a 3-strike broken agent. ONLY the system-evaluator dispatch sees this " +
+        "tool. Call exactly once at the END of the dispatch, immediately before danxbot_complete. A dispatch " +
+        "that exits without calling this tool is treated as evaluator failure.", {
+        reason: z
+            .string()
+            .describe("Markdown body the dashboard banner renders: ## Root cause(s) (1-3 bullets), ## Per-strike detail " +
+            "(one bullet per strike), ## Recommended human action (one paragraph)."),
+        suggested_steps: z
+            .array(z.string())
+            .optional()
+            .describe("Ordered list of concrete operator actions. Empty/absent is allowed."),
+    }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().evaluatorSummary;
+        if (!url)
+            throw new Error("danxbot_set_evaluator_summary called without an evaluator dispatch");
+        const result = await postWorkerRoute(url, { reason: args.reason, suggested_steps: args.suggested_steps ?? [] }, "danxbot_set_evaluator_summary", agentBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- save_template_app ----------------
+    strictTool("save_template_app", "Build and ship ONE template app, keyed by template id. Walks <cwd>/templates/<template_id>/source/, " +
+        "builds, packs the bundle, then on success fires an async callback to the repo's configured save_url. " +
+        "Returns the synchronous build verdict. Call once per app after its edits are complete.", {
+        template_id: z
+            .string()
+            .describe("Receiver-side template id — selects the source location and keys the output bundle."),
+    }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().saveTemplateApp;
+        if (!url)
+            throw new Error("save_template_app called without a template_app-configured dispatch");
+        const result = await postWorkerRoute(url, { template_id: args.template_id }, "save_template_app", agentBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
+    // ---------------- load_template_app ----------------
+    strictTool("load_template_app", "Set up ONE template app on demand and bring its live HMR preview up. On a FRESH dispatch this WHOLESALE-" +
+        "RESETS <cwd>/templates/<template_id>/source/ (pulling the consumer's source or scaffolding a default) " +
+        "— call this BEFORE you start editing, never after. On a RESUMED dispatch it touches nothing. Returns " +
+        "{template_id, hmr_url, source_dir} — source_dir is the ONLY path to edit; the build reads it directly.", {
+        template_id: z
+            .string()
+            .describe("Receiver-side template id — defines the source location and is echoed to consumer callbacks."),
+    }, async (args) => {
+        const url = readLifecycleUrlsFromEnv().loadTemplateApp;
+        if (!url)
+            throw new Error("load_template_app called without a template_app-configured dispatch");
+        const result = await postWorkerRoute(url, { template_id: args.template_id }, "load_template_app", agentBearer());
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    });
 }

package/dist/route-board-scope.generated.js

@@ -38,6 +38,7 @@ export const GET_ROUTE_BOARD_SCOPE = [
     ["/api/self-repair/errors", "refuse"],
     ["/api/sync-root", "refuse"],
     ["/api/tasks", "refuse"],
+    ["/api/team/audit-events", "refuse"],
     ["/api/team/invitations", "refuse"],
     ["/api/team/members", "refuse"],
     ["/api/team/roles", "refuse"],

package/dist/terms-halt.js

@@ -12,8 +12,8 @@ export function haltText(acceptUrl, owner) {
         " accepts the current Terms of Use.\n\n" +
         `Give the person this link to accept them: ${acceptUrl}\n\n` +
         "Do not retry, do not look for another route, and never accept the Terms yourself. " +
-        "A dispatched agent ends with danxbot_api POST /api/dispatch-callbacks/complete {status: \"failed\", summary} " +
-        "naming this link (stop if that call is refused too), and never blocks the card.");
+        "A dispatched agent ends with danxbot_complete({status: \"failed\", summary}) naming this link, " +
+        "and never blocks the card.");
 }
 /** The halt text for a `403 terms_not_accepted` result, or null for any other result. */
 export function termsHaltFor(result) {

package/dist/tool-access.js

@@ -12,8 +12,10 @@
  *                 `plan_connect` (sign in, bind to a plan), `request_permission`, and the `danxbot_api` trio.
  *   - permission  `{permission}` - the dashboard route the tool calls needs this permission, so a key without it can
  *                 never succeed. Shown once the key holds it, which includes a grant a person approves mid-session.
- *   - callback    `{callback}` - the tool posts to a per-dispatch URL the worker injected (`lifecycle.ts`), so it is usable
- *                 only when that URL exists. It also names the `permission` its dashboard route needs (both must hold).
+ *   - callback    `{callback}` - the tool posts to a per-dispatch URL the worker injected (`lifecycle.ts`). The worker
+ *                 authenticates it with the dispatch's own agent token, so no dashboard permission is involved: the tool
+ *                 is usable exactly when its URL exists. A tool whose route is a dashboard route also names its
+ *                 `permission` (both must hold).
  *
  * This module is pure data and one function, with no imports, because the danxbot service imports it directly and
  * cannot take this package's MCP-SDK or zod dependencies.
@@ -23,10 +25,22 @@
  * (`src/dispatch/dispatch-callbacks.ts`) writes them, so the name of a callback exists once.
  */
 export const CALLBACK_ENV = {
+    stop: "DANXBOT_STOP_URL",
     slackReply: "DANXBOT_SLACK_REPLY_URL",
+    slackUpdate: "DANXBOT_SLACK_UPDATE_URL",
+    linkThreadToIssue: "DANXBOT_LINK_THREAD_TO_ISSUE_URL",
+    slackRecoveryList: "DANXBOT_SLACK_RECOVERY_LIST_URL",
+    slackRecoveryMessage: "DANXBOT_SLACK_RECOVERY_MESSAGE_URL",
+    slackRecoveryCreateOrLink: "DANXBOT_SLACK_RECOVERY_CREATE_OR_LINK_URL",
+    qualityGate: "DANXBOT_QUALITY_GATE_URL",
+    requestCodeReview: "DANXBOT_REQUEST_CODE_REVIEW_URL",
+    evaluatorSummary: "DANXBOT_EVALUATOR_SUMMARY_URL",
+    saveTemplateApp: "DANXBOT_TEMPLATE_APP_SAVE_URL",
+    loadTemplateApp: "DANXBOT_TEMPLATE_APP_LOAD_URL",
 };
 const BOOTSTRAP = { permission: null, callback: null };
 const needs = (permission) => ({ permission, callback: null });
+const postsTo = (callback) => ({ permission: null, callback });
 const needsAndPostsTo = (permission, callback) => ({ permission, callback });
 /**
  * Every tool this server registers, with what makes it usable. `index.ts` refuses to register a tool that is not
@@ -40,9 +54,20 @@ export const TOOL_ACCESS = {
     danxbot_api_spec: BOOTSTRAP,
     // `POST /api/issues/:id/attachments`
     attach_file: needs("cards.edit"),
-    // The one dispatch callback that stays a tool (DX-4525): it reads local files. Its dashboard route's own policy names the
-    // permission (`route-policies/index.ts`); every other callback is a `danxbot_api` call to a route under `callback-routes.ts`.
+    // The dispatch's own terminal and sign-off calls: worker routes, authenticated by the dispatch's agent token.
+    danxbot_complete: postsTo("stop"),
+    quality_gate_complete: postsTo("qualityGate"),
+    request_code_review: postsTo("requestCodeReview"),
+    danxbot_set_evaluator_summary: postsTo("evaluatorSummary"),
+    save_template_app: postsTo("saveTemplateApp"),
+    load_template_app: postsTo("loadTemplateApp"),
+    // Dashboard callback routes; each route's own policy names the permission (`route-policies/index.ts`).
     danxbot_slack_reply: needsAndPostsTo("slack.threads.post", "slackReply"),
+    danxbot_slack_post_update: needsAndPostsTo("slack.threads.post", "slackUpdate"),
+    link_thread_to_issue: needsAndPostsTo("cards.edit", "linkThreadToIssue"),
+    slack_recovery_list: needsAndPostsTo("slack.recovery.manage", "slackRecoveryList"),
+    slack_recovery_message: needsAndPostsTo("slack.recovery.manage", "slackRecoveryMessage"),
+    slack_recovery_create_or_link: needsAndPostsTo("slack.recovery.manage", "slackRecoveryCreateOrLink"),
 };
 /** True when a session holding `grant` can call the tool declared by `access`. */
 export function isUsable(access, grant) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.263",
-  "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, request_permission, attach_file, and danxbot_slack_reply) (DX-3465, PLN-11 R-25).",
+  "version": "0.1.264",
+  "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",