conduyt-mcp 4.103.0 → 4.104.0

package/README.md

@@ -2,7 +2,7 @@
 
 MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-accessible tools. Covers the core CRM surface (contacts, deals, pipelines, custom fields, automations, messaging, and more); use `conduyt_api_catalog` to discover the full set of 600+ REST endpoints.
 
-## 373 Tools
+## 376 Tools
 
 ### Discovery
 | Tool | Description |
@@ -244,6 +244,9 @@ The Mailchimp OAuth connect and callback are browser-only: connect Mailchimp in
 | `conduyt_list_chat_channels` | `GET /chat/channels`: your channels; also CREATES your memberships in the auto channels the first time |
 | `conduyt_get_chat_unread` | `GET /chat/unread`: per channel `{ channelId, unread, soundUnread, newestSeq, latestSeq }`; may list an auto channel you have not opened yet (no membership row) |
 | `conduyt_list_chat_messages` | List a channel's messages, newest first; every message carries `seq` (commit-ordered position in the channel); does not move the read marker; on a 403 "Not a member of this channel" it calls `GET /chat/channels` once and retries once |
+| `conduyt_send_chat_message` | Send a message through the canonical audited Team Chat writer; agent keys receive the six-turn human-handoff guard |
+| `conduyt_reply_chat_message` | Reply to a top-level message in its thread through the same audited writer; an agent passes `idempotencyKey` (`reply:<source message id>`) so a retried turn returns the first reply (200, `idempotentReplay: true`) instead of posting twice |
+| `conduyt_react_chat_message` | React to a Team Chat message as the authenticated user/agent |
 | `conduyt_mark_chat_read` | Acknowledge read up to one message (`readUpTo` = message UUID; the marker only moves forward, an older or foreign message is a no-op; same one-retry membership bootstrap) |
 | `conduyt_get_chat_realtime_token` | `GET /realtime/token`: a signed Ably token request for the realtime pipe (`channelIds` up to 10, sent as repeated `channel=`); `{ enabled: false, reason }` when the account switch is off; returns `accountId` / `userId` |
 | `conduyt_get_chat_notifications` | `GET /chat/channels/{id}/notifications`: your level `{ level, isDefault, notify, updatedAt, membershipId, membershipSince, membershipSeq }` |
@@ -252,7 +255,7 @@ The Mailchimp OAuth connect and callback are browser-only: connect Mailchimp in
 
 `conduyt_list_chat_messages` also takes `afterSeq` (messages committed after that seq; once, a whole number, never with `cursor`) and every message carries `version` (a counter bumped on each update). `conduyt_get_chat_unread` rows carry `mentions`, `notify`, `updatedAt`, `membershipId` (null = no membership), `membershipSince`, `membershipSeq`, and the response `teamChatRealtime` and `membershipSeqHigh`; `conduyt_list_chat_channels` rows carry `mentionCount` and the same membership fields.
 
-The rest of team chat (sending, edit/delete, reactions, pins, claim/handoff, typing, presence, uploads) is not wrapped yet. `GET /chat/messages/{messageId}/location` is a UI deep-link helper and deliberately not wrapped. `GET /cron/team-chat-digest` is a CRON_SECRET-gated job and not key-callable.
+The remaining Team Chat mutations (edit/delete, pins, claim/handoff and typing/presence writes) are not wrapped yet; sends, thread replies, reactions and direct uploads are wrapped. `GET /chat/messages/{messageId}/location` is a UI deep-link helper and deliberately not wrapped. `GET /cron/team-chat-digest` is a CRON_SECRET-gated job and not key-callable.
 
 #### What the API publishes (realtime events, not tools)
 

package/dist/tool-annotations.js

@@ -174,6 +174,9 @@ export const TOOL_ANNOTATIONS = {
     conduyt_list_chat_channels: update("List Chat Channels"),
     conduyt_get_chat_unread: ro("Get Chat Unread Counts"),
     conduyt_list_chat_messages: update("List Chat Messages"),
+    conduyt_send_chat_message: create("Send Chat Message"),
+    conduyt_reply_chat_message: create("Reply to Chat Message"),
+    conduyt_react_chat_message: update("React to Chat Message"),
     conduyt_mark_chat_read: row("Mark Chat Read", false, false, false), // every call re-announces the read receipt to the reader's other tabs and devices, even when the marker did not move (chat/channels/[id]/messages/route.ts:126)
     conduyt_get_chat_realtime_token: ro("Get Chat Realtime Token"),
     conduyt_get_chat_notifications: update("Get Chat Notifications"),

package/dist/tools/chat.js

@@ -43,7 +43,7 @@ async function withMembershipBootstrap(client, read) {
 }
 /** Team chat read side (app 10-09, live sha 3869c79ba): the unread vector, messages carrying `seq`, and the read acknowledgement. */
 export function registerChatTools(server, client) {
-    strictInput(server.tool("conduyt_list_chat_channels", "List the team chat channels the API key's user belongs to (GET /api/v1/chat/channels): id, name, kind, members, last message, counts. Each row also carries the Team Chat 2.0 fields mentionCount (unread @mentions of you), notify (your stored notification level: all, mentions, mute, or null = the kind's default), updatedAt (when notify last changed, null = never), membershipId (your member row; changes after a removal and re-add), membershipSince (when this membership began) and membershipSeq (strictly increasing incarnation number). SIDE EFFECT: it also creates the caller's memberships in the account's AUTO channels (needs-a-hand, new-leads, wins) the first time, so a user who never opened Team Chat can read them. conduyt_list_chat_messages and conduyt_mark_chat_read already do this once for you when a channel listed by conduyt_get_chat_unread answers 403 'Not a member of this channel'; call this tool directly to discover channel ids.", {}, async () => {
+    strictInput(server.tool("conduyt_list_chat_channels", "List the team chat channels the API key's user belongs to (GET /api/v1/chat/channels): id, name, kind, members, last message, counts. Each row also carries the Team Chat 2.0 fields mentionCount (unread @mentions of you), notify (your stored notification level: all, mentions, mute, or null = the kind's default), updatedAt (when notify last changed, null = never), membershipId (your member row; changes after a removal and re-add), membershipSince (when this membership began) and membershipSeq (strictly increasing incarnation number). Each row also carries agentsRespond (boolean, #613 lane A: false = an admin muted AI teammates in that channel) and, ONLY while the account's AI teammates switch is on, aiTeammates: [{ userId, lastHeartbeatAt, replying }] (the paired AI teammates that are members of the channel; lastHeartbeatAt is their last listener heartbeat or null, replying is true while one is working a turn in that channel; derive the state like the app: heartbeat within 60 seconds = Listening, listening and replying = Replying, otherwise Away). The aiTeammates key is absent when the switch is off. SIDE EFFECT: it also creates the caller's memberships in the account's AUTO channels (needs-a-hand, new-leads, wins) the first time, so a user who never opened Team Chat can read them. conduyt_list_chat_messages and conduyt_mark_chat_read already do this once for you when a channel listed by conduyt_get_chat_unread answers 403 'Not a member of this channel'; call this tool directly to discover channel ids.", {}, async () => {
         const result = await client.get("/api/v1/chat/channels");
         return formatResult(result);
     }));
@@ -69,6 +69,36 @@ export function registerChatTools(server, client) {
         const result = await withMembershipBootstrap(client, () => client.get(`/api/v1/chat/channels/${channelId}/messages?${params}`));
         return formatResult(result);
     }));
+    strictInput(server.tool("conduyt_send_chat_message", "Send a Team Chat message as the API key's user (POST /api/v1/chat/channels/{id}/messages). The caller must be a channel member and have the communications:create permission. AI-agent keys are subject to the server's six-consecutive-agent-turn cap; a 409 agent_human_required means no message was sent (markerCreated: true on the refusal that inserted the one human-handoff line, false while the thread stays paused). A 409 agents_muted_in_channel means an admin turned \"agents respond here\" off for this channel: the post was refused, nothing was written, and it must not be retried (same shape as agent_human_required). body is plain Team Chat text (1-10,000 characters).", {
+        channelId: z.string().uuid().describe("Channel UUID"),
+        body: z.string().trim().min(1).max(10_000).describe("Message text"),
+        idempotencyKey: z.string().regex(/^[A-Za-z0-9:_.-]{1,128}$/).optional().describe("Paired AI agent keys only: a key unique per agent and source turn (the listener uses reply:<source message id>). The same key returns the reply already created (200, idempotentReplay: true) instead of posting a second one; a key used in another channel is a 409 idempotency_key_reused. A person's key gets 400."),
+    }, async ({ channelId, body, idempotencyKey }) => {
+        const result = await client.post(`/api/v1/chat/channels/${channelId}/messages`, { body, ...(idempotencyKey ? { idempotencyKey } : {}) });
+        return formatResult(result);
+    }));
+    strictInput(server.tool("conduyt_reply_chat_message", "Reply in a Team Chat thread as the API key's user (POST /api/v1/chat/channels/{id}/messages with parentId). parentId must name a live top-level message in that channel. The caller must be a member with communications:create. AI-agent keys are subject to the same six-consecutive-agent-turn cap as a top-level send, and to the same 409 agent_human_required / agents_muted_in_channel refusals (nothing written, do not retry; agents_muted_in_channel = an admin turned \"agents respond here\" off for the channel).", {
+        channelId: z.string().uuid().describe("Channel UUID"),
+        parentId: z.string().uuid().describe("Top-level message UUID to reply to"),
+        body: z.string().trim().min(1).max(10_000).describe("Reply text"),
+        idempotencyKey: z.string().regex(/^[A-Za-z0-9:_.-]{1,128}$/).optional().describe("Paired AI agent keys only: a key unique per agent and source turn (the listener uses reply:<source message id>). The same key returns the reply already created (200, idempotentReplay: true) instead of posting a second one; a key used in another channel is a 409 idempotency_key_reused. A person's key gets 400."),
+        claimToken: z.string().regex(/^[1-9][0-9]{0,8}:[A-Za-z0-9:_.-]{8,128}$/).optional().describe("Paired AI agent keys only; REQUIRED with idempotencyKey reply:<source message id> (refused otherwise, nothing posted): the listener's claim token <generation>:<listener id> from the turn prompt. The reply completes that turn only when posted in the source's channel and thread with the current generation's token; a reply:<source> reply anywhere else, or with a stale token, is refused 409 (reply_wrong_channel / reply_wrong_thread / reply_stale_claim) with nothing posted, so a corrected retry still completes the turn."),
+    }, async ({ channelId, parentId, body, idempotencyKey, claimToken }) => {
+        // (#599 r7) a reply to an inbox turn (idempotencyKey reply:<source message id>) always names its claim
+        if (!claimToken && typeof idempotencyKey === "string" && /^reply:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(idempotencyKey)) {
+            throw new Error("claimToken is required with an idempotencyKey reply:<source message id> (the turn prompt's reply claim token); nothing was posted");
+        }
+        const result = await client.post(`/api/v1/chat/channels/${channelId}/messages`, { body, parentId, ...(idempotencyKey ? { idempotencyKey } : {}), ...(claimToken ? { claimToken } : {}) });
+        return formatResult(result);
+    }));
+    strictInput(server.tool("conduyt_react_chat_message", "Add a reaction to a Team Chat message as the API key's user (POST /api/v1/chat/channels/{id}/messages/{messageId}/reactions). The server accepts only its Team Chat reaction set and returns the fully hydrated message. Repeating the same reaction is safe and leaves one reaction from this user.", {
+        channelId: z.string().uuid().describe("Channel UUID"),
+        messageId: z.string().uuid().describe("Message UUID"),
+        emoji: z.string().min(1).max(16).describe("One allowed Team Chat emoji"),
+    }, async ({ channelId, messageId, emoji }) => {
+        const result = await client.post(`/api/v1/chat/channels/${channelId}/messages/${messageId}/reactions`, { emoji });
+        return formatResult(result);
+    }));
     strictInput(server.tool("conduyt_mark_chat_read", "Acknowledge team chat as read up to one message (GET /api/v1/chat/channels/{id}/messages?readUpTo=<messageId>&limit=1; the API takes the acknowledgement as a query on the message list). readUpTo is the UUID of a message you were served (its seq becomes your read marker); take it from conduyt_list_chat_messages. The marker only moves FORWARD, never to 'now': an older (stale) message is a no-op, and a message that is not in this channel moves nothing (the call still succeeds, so re-check conduyt_get_chat_unread). A malformed id is a 400. On a 403 'Not a member of this channel' it calls GET /chat/channels once (creating the caller's auto-channel memberships) and retries ONCE; a second refusal, or a 403 for any other reason, is returned as is. The response is the newest message of the channel (limit 1), not a confirmation of the move.", {
         channelId: z.string().uuid().describe("Channel UUID"),
         readUpTo: z.string().uuid().describe("UUID of the newest message you have seen in this channel"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.103.0",
+  "version": "4.104.0",
   "mcpName": "com.conduyt/mcp",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",

package/scripts/coverage-manifest.json

@@ -130,11 +130,36 @@
       "status": "excluded",
       "reason": "UI-only deep-link helper (resolves a message to its channel/position for the app's router); not an agent surface"
     },
+    {
+      "match": "/api/v1/chat/agents/me/",
+      "status": "excluded",
+      "reason": "(#599) the listener protocol of a paired agent key (long poll, per-event ack, heartbeat): served by the npm CLI `conduyt agent listen`, not a request/response MCP tool"
+    },
+    {
+      "match": "POST /api/v1/chat/agents/pair",
+      "status": "excluded",
+      "reason": "(#599) the single-use pair-code exchange that MINTS the agent's key: the listener's first call (npm CLI `conduyt agent pair` / `listen --pair-code`), never made with an existing key"
+    },
+    {
+      "match": "PATCH /api/v1/chat/channels/:id/agents",
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): a channel's agents-respond mode is an admin setting; every API key is refused"
+    },
+    {
+      "match": "/api/v1/chat/agents",
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): an admin manages AI teammates in Settings > AI; every API key is refused"
+    },
     {
       "match": "/api/v1/chat",
       "status": "planned",
       "reason": "team chat read/post for agents"
     },
+    {
+      "match": "/api/v1/settings/ai-teammates",
+      "status": "excluded",
+      "reason": "(#614) session-only (assertSessionOnly): an admin turns AI teammates on or off in Settings > AI (Professional and above, the trial, comp); every API key is refused"
+    },
     {
       "match": "/api/v1/settings",
       "status": "planned",
@@ -455,6 +480,11 @@
       "status": "planned",
       "reason": "account readiness/onboarding surfaces"
     },
+    {
+      "match": "GET /api/v1/activity/export.csv",
+      "status": "planned",
+      "reason": "activity-log CSV export (small586, landed on app main after the 4.103.0 pin); a CSV download, tool deferred; classified here so the 4.104.0 snapshot refresh passes the coverage gate"
+    },
     {
       "match": "/api/v1/activities",
       "status": "planned",

package/scripts/coverage-matrix.json

@@ -1,10 +1,10 @@
 {
-  "generatedAt": "2026-10-29T23:02:33.248Z",
-  "toolCount": 373,
-  "totalEndpoints": 1118,
+  "generatedAt": "2026-10-30T13:37:28.694Z",
+  "toolCount": 376,
+  "totalEndpoints": 1134,
   "counts": {
-    "covered": 327,
-    "excluded": 336,
+    "covered": 329,
+    "excluded": 350,
     "planned": 455,
     "uncategorized": 0
   },
@@ -301,6 +301,10 @@
       "status": "planned",
       "reason": "activity detail reads beyond the log tools"
     },
+    "GET /api/v1/activity/export.csv": {
+      "status": "planned",
+      "reason": "activity-log CSV export (small586, landed on app main after the 4.103.0 pin); a CSV download, tool deferred; classified here so the 4.104.0 snapshot refresh passes the coverage gate"
+    },
     "GET /api/v1/admin/accounts": {
       "status": "excluded",
       "reason": "super-admin platform operations (Conduyt staff only)"
@@ -1269,6 +1273,46 @@
         "conduyt_voice_drop"
       ]
     },
+    "GET /api/v1/chat/agents": {
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): an admin manages AI teammates in Settings > AI; every API key is refused"
+    },
+    "POST /api/v1/chat/agents": {
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): an admin manages AI teammates in Settings > AI; every API key is refused"
+    },
+    "PATCH /api/v1/chat/agents/:id": {
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): an admin manages AI teammates in Settings > AI; every API key is refused"
+    },
+    "DELETE /api/v1/chat/agents/:id": {
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): an admin manages AI teammates in Settings > AI; every API key is refused"
+    },
+    "POST /api/v1/chat/agents/:id/pair-code": {
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): an admin manages AI teammates in Settings > AI; every API key is refused"
+    },
+    "POST /api/v1/chat/agents/me/heartbeat": {
+      "status": "excluded",
+      "reason": "(#599) the listener protocol of a paired agent key (long poll, per-event ack, heartbeat): served by the npm CLI `conduyt agent listen`, not a request/response MCP tool"
+    },
+    "GET /api/v1/chat/agents/me/inbox": {
+      "status": "excluded",
+      "reason": "(#599) the listener protocol of a paired agent key (long poll, per-event ack, heartbeat): served by the npm CLI `conduyt agent listen`, not a request/response MCP tool"
+    },
+    "POST /api/v1/chat/agents/me/inbox/ack": {
+      "status": "excluded",
+      "reason": "(#599) the listener protocol of a paired agent key (long poll, per-event ack, heartbeat): served by the npm CLI `conduyt agent listen`, not a request/response MCP tool"
+    },
+    "POST /api/v1/chat/agents/me/inbox/claim": {
+      "status": "excluded",
+      "reason": "(#599) the listener protocol of a paired agent key (long poll, per-event ack, heartbeat): served by the npm CLI `conduyt agent listen`, not a request/response MCP tool"
+    },
+    "POST /api/v1/chat/agents/pair": {
+      "status": "excluded",
+      "reason": "(#599) the single-use pair-code exchange that MINTS the agent's key: the listener's first call (npm CLI `conduyt agent pair` / `listen --pair-code`), never made with an existing key"
+    },
     "POST /api/v1/chat/ask": {
       "status": "planned",
       "reason": "team chat read/post for agents"
@@ -1287,6 +1331,10 @@
       "status": "planned",
       "reason": "team chat read/post for agents"
     },
+    "PATCH /api/v1/chat/channels/:id/agents": {
+      "status": "excluded",
+      "reason": "(#599) session-only (assertSessionOnly): a channel's agents-respond mode is an admin setting; every API key is refused"
+    },
     "POST /api/v1/chat/channels/:id/members": {
       "status": "planned",
       "reason": "team chat read/post for agents"
@@ -1303,8 +1351,11 @@
       ]
     },
     "POST /api/v1/chat/channels/:id/messages": {
-      "status": "planned",
-      "reason": "team chat read/post for agents"
+      "status": "covered",
+      "tools": [
+        "conduyt_send_chat_message",
+        "conduyt_reply_chat_message"
+      ]
     },
     "GET /api/v1/chat/channels/:id/messages/:messageId": {
       "status": "planned",
@@ -1331,8 +1382,10 @@
       "reason": "team chat read/post for agents"
     },
     "POST /api/v1/chat/channels/:id/messages/:messageId/reactions": {
-      "status": "planned",
-      "reason": "team chat read/post for agents"
+      "status": "covered",
+      "tools": [
+        "conduyt_react_chat_message"
+      ]
     },
     "DELETE /api/v1/chat/channels/:id/messages/:messageId/reactions": {
       "status": "planned",
@@ -1440,6 +1493,10 @@
       "status": "planned",
       "reason": "company subroutes beyond core CRUD"
     },
+    "GET /api/v1/companies/:id/related": {
+      "status": "planned",
+      "reason": "company subroutes beyond core CRUD"
+    },
     "GET /api/v1/companies/:id/tags": {
       "status": "planned",
       "reason": "company subroutes beyond core CRUD"
@@ -1755,6 +1812,10 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/chat-webhooks": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/cleanup-audit-logs": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -4240,6 +4301,14 @@
       "status": "planned",
       "reason": "account settings read/update surfaces"
     },
+    "GET /api/v1/settings/ai-teammates": {
+      "status": "excluded",
+      "reason": "(#614) session-only (assertSessionOnly): an admin turns AI teammates on or off in Settings > AI (Professional and above, the trial, comp); every API key is refused"
+    },
+    "PATCH /api/v1/settings/ai-teammates": {
+      "status": "excluded",
+      "reason": "(#614) session-only (assertSessionOnly): an admin turns AI teammates on or off in Settings > AI (Professional and above, the trial, comp); every API key is refused"
+    },
     "PUT /api/v1/settings/ai/byo": {
       "status": "planned",
       "reason": "account settings read/update surfaces"