@thehammer/danx-dashboard-mcp 0.1.266 → 0.1.267

package/README.md

@@ -12,7 +12,7 @@ Stdio MCP server fronting danxbot's dashboard HTTP API. Since DX-3465 it exposes
 | `DANX_DASHBOARD_CREDENTIAL` | A DISPATCH's credential: the bearer verbatim, substituted into the materialized `.mcp.json` from its overlay (DX-2862, `src/credential.ts`). Authoritative when set; it never signs out. An operator session sets nothing: with no credential the server boots SIGNED OUT, every tool except `plan_connect` returns one "not signed in" halt, and `plan_connect` requests access (below). The same resolver serves the `bridge` subcommand, so a session's tools and its event stream can never sign in as two different identities |
 | `DANXBOT_TEAM` | OPTIONAL, non-secret (DX-4446): the team slug (or id) whose approvers see this session's access request in their danxbot site. Set it in the repo's `.mcp.json` env block or the shell. Unset, the request is answered by link only. A value that is not a team slug fails at boot; a team the dashboard does not know makes `plan_connect` answer `unknown_team` (fix `DANXBOT_TEAM`), never a silent link fallback |
 | `DANX_REPO_NAME` | OPTIONAL (DX-4555): repo half of the qualified board id; sent as the access request's repo label |
-| `DANXBOT_BOARD_NAME` | OPTIONAL (DX-4555; needs `DANX_REPO_NAME`): board-slug half of the qualified board id (the dispatch injects `board.slug` here). With neither variable set (the danxbot plugin's own server) the server has no default board: a board-scoped call must carry its `board` argument or it fails loud |
+| `DANXBOT_BOARD_NAME` | OPTIONAL (DX-4555; needs `DANX_REPO_NAME`): board-slug half of the qualified board id (the dispatch injects `board.slug` here). With neither variable set (the danxbot plugin's own server) the server has no default board: a call that needs a board must carry its `board` argument or the dashboard answers 400 (plan and plan-session routes take their boards from the plan and need none) |
 
 BOARD-ONLY (DX-1171): board is the first-level concept; repo is DERIVED from board server-side, never passed. At boot the package composes the dispatch's qualified board id `<repo>:<slug>` from `DANX_REPO_NAME` + `DANXBOT_BOARD_NAME` and appends it as `?board=<id>` (and `body.board` on create) to every `/api/issues/*` request, except `GET /api/issues` (the list), whose board is OPTIONAL (DX-4542): there it sends a board only when the caller names one, because no board is the team's whole list across every board. Each tool exposes an optional `board` arg — a FULL qualified id `<repo>:<slug>` (e.g. `platform:the-supply-operations-hub`) — that overrides it per-call for cross-board reads/writes (unknown board → 404). The dashboard owns board→repo resolution; this package never sends `repo`.
 

package/dist/handlers.js

@@ -11,7 +11,7 @@
  * set, it overrides the dispatch's configured board for that single call
  * (forwarded as `?board=<board>` — and into `body.board` for create — so
  * an agent can target any board). Omitted → falls back to the dispatch's
- * env-derived board. The dashboard route validates the board (owning
+ * env-derived board, if any (a board-less server stamps none). The dashboard route validates the board (owning
  * board→repo) and 404s on unknown; the MCP forwards the refusal envelope
  * verbatim, never duplicates validation.
  *

package/dist/http-client.js

@@ -115,11 +115,12 @@ export class DashboardHttpClient {
         const stamp = boardStampOf(method, `${basePath}${cleanPath}`);
         if (stamp === "stamp") {
             const board = boardOverride ?? this.config.board;
-            // DX-4555: a board-less server (the danxbot plugin's, no DANX_REPO_NAME/DANXBOT_BOARD_NAME) has no board to stamp.
-            if (board === undefined) {
-                throw new Error(`[danx-dashboard-mcp] ${method} ${basePath}${cleanPath} is board-scoped and this server has no configured board: pass the \`board\` argument (a qualified id, <repo>:<slug>)`);
-            }
-            params.set("board", board);
+            // DX-4592: a board-less server (the danxbot plugin's, no DANX_REPO_NAME/DANXBOT_BOARD_NAME) stamps nothing when the call names no
+            // board. Whether the route NEEDS one is the dashboard's to say: a route that does (issue create/import, quality-gate and settings
+            // routes, the dispatch verbs) answers 400 naming `board`, while a card-id, plan or plan-session route takes its board from the card
+            // or the plan. Refusing here (DX-4555) wrongly stopped every plan route, `plan_connect` first.
+            if (board !== undefined)
+                params.set("board", board);
         }
         else if (stamp === "named" && boardOverride !== undefined) {
             params.set("board", boardOverride);

package/dist/index.js

@@ -172,8 +172,8 @@ let permissionWatch;
  * halves the worker injects and build the HTTP client. DANXBOT_BOARD_NAME
  * already carries the board SLUG at the spawn site (src/dispatch/core.ts sets it
  * from `board.slug`), so a plain join yields the canonical id — no transform.
- * Both unset (DX-4555) leaves the server board-less: a board-scoped call must then carry its own `board`
- * argument (`DashboardHttpClient.buildUrl` refuses otherwise). A slug without its repo fails loud.
+ * Both unset (DX-4555) leaves the server board-less: a call that needs a board must then carry its own `board`
+ * argument, or the dashboard answers 400 (DX-4592: the client no longer refuses on its behalf). A slug without its repo fails loud.
  */
 function boot() {
     const dashboardUrl = readEnvOrDie("DANXBOT_DASHBOARD_URL");
@@ -495,7 +495,7 @@ const boardField = {
         .string()
         .min(1)
         .optional()
-        .describe("Board id `<repo>:<slug>`; omit for this dispatch's board, except on `GET /api/issues`, where omitting it lists the whole team across every board. Unknown → 404."),
+        .describe("Board id `<repo>:<slug>`; omit for this dispatch's board (none when this server has no default board), except on `GET /api/issues`, where omitting it lists the whole team across every board. Unknown → 404."),
 };
 // DX-3465 (code-architecture gate finding, at 275f82c0d) — `resource_fields`
 // (DX-3426) was deleted from here: it was a dedicated wrapper around a plain

package/dist/route-board-scope.js

@@ -1,6 +1,6 @@
 /**
  * DX-4303 / DX-4542 - what the client does with a `?board=` query key on the dashboard route a request reaches: `stamp` it (the route
- * takes it, so the dispatch's board is filled in), `refuse` it (the server 400s it) or `named` (the board is optional and no board is the
+ * takes it, so the dispatch's board is filled in when the server has one), `refuse` it (the server 400s it) or `named` (the board is optional and no board is the
  * whole team: sent only when the caller names one).
  *
  * The answer comes from the dashboard's own route table, shipped in this package as `route-board-scope.generated.ts` (generated by

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.266",
+  "version": "0.1.267",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, request_permission, attach_file, and danxbot_slack_reply) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",