funifier-mcp 0.3.18 → 0.3.20

package/.cursor/rules/funifier.mdc

@@ -27,7 +27,8 @@ Then read a result with `funifier_read_doc path=<path>`.
 |-----------|-------------|
 | `skills/funifier/references/create-trigger.md` | Create a Funifier trigger — guided workflow from entity/event selection to Groovy code generation |
 | `skills/funifier/references/create-scheduler.md` | Create a Funifier scheduler — guided workflow from naming and cron expression to Groovy code generation |
-| `skills/funifier/references/create-aggregate.md` | Create a Funifier prepared aggregate — guided workflow for building MongoDB aggregate pipelines for reports and dashboards |
+| `skills/funifier/references/query-aggregate.md` | Run an ad-hoc MongoDB aggregate (one-off query) on a Funifier collection via POST /v3/database/{collection}/aggregate — for reports and exploration, without saving a resource |
+| `skills/funifier/references/create-aggregate.md` | Create/edit a Funifier prepared aggregate — a saved pipeline with _id, $param placeholders, optional Groovy script, cache and execution via POST /v3/find/{id}; for reusable dashboards and parametrized reports |
 | `skills/funifier/references/date-handling.md` | Create, edit, or query Date fields safely via REST, funifier_database, triggers, schedulers, aggregate, and prepared aggregate; use whenever a payload or filter contains dates |
 | `skills/funifier/references/create-challenge.md` | Create a Funifier challenge — missions with action rules and point rewards |
 | `skills/funifier/references/create-action.md` | Create a Funifier action — define trackable player behaviors with attributes |

package/.github/copilot-instructions.md

@@ -20,7 +20,8 @@ Detailed guided workflows live in `skills/funifier/references/`:
 |-----------|-------------|
 | `skills/funifier/references/create-trigger.md` | Create a Funifier trigger — guided workflow from entity/event selection to Groovy code generation |
 | `skills/funifier/references/create-scheduler.md` | Create a Funifier scheduler — guided workflow from naming and cron expression to Groovy code generation |
-| `skills/funifier/references/create-aggregate.md` | Create a Funifier prepared aggregate — guided workflow for building MongoDB aggregate pipelines for reports and dashboards |
+| `skills/funifier/references/query-aggregate.md` | Run an ad-hoc MongoDB aggregate (one-off query) on a Funifier collection via POST /v3/database/{collection}/aggregate — for reports and exploration, without saving a resource |
+| `skills/funifier/references/create-aggregate.md` | Create/edit a Funifier prepared aggregate — a saved pipeline with _id, $param placeholders, optional Groovy script, cache and execution via POST /v3/find/{id}; for reusable dashboards and parametrized reports |
 | `skills/funifier/references/date-handling.md` | Create, edit, or query Date fields safely via REST, funifier_database, triggers, schedulers, aggregate, and prepared aggregate; use whenever a payload or filter contains dates |
 | `skills/funifier/references/create-challenge.md` | Create a Funifier challenge — missions with action rules and point rewards |
 | `skills/funifier/references/create-action.md` | Create a Funifier action — define trackable player behaviors with attributes |

package/AGENTS.md

@@ -59,7 +59,8 @@ Before any `funifier_*` MCP tool call or Funifier task, find the matching row an
 |-----------|-------------|
 | `skills/funifier/references/create-trigger.md` | Create a Funifier trigger — guided workflow from entity/event selection to Groovy code generation |
 | `skills/funifier/references/create-scheduler.md` | Create a Funifier scheduler — guided workflow from naming and cron expression to Groovy code generation |
-| `skills/funifier/references/create-aggregate.md` | Create a Funifier prepared aggregate — guided workflow for building MongoDB aggregate pipelines for reports and dashboards |
+| `skills/funifier/references/query-aggregate.md` | Run an ad-hoc MongoDB aggregate (one-off query) on a Funifier collection via POST /v3/database/{collection}/aggregate — for reports and exploration, without saving a resource |
+| `skills/funifier/references/create-aggregate.md` | Create/edit a Funifier prepared aggregate — a saved pipeline with _id, $param placeholders, optional Groovy script, cache and execution via POST /v3/find/{id}; for reusable dashboards and parametrized reports |
 | `skills/funifier/references/date-handling.md` | Create, edit, or query Date fields safely via REST, funifier_database, triggers, schedulers, aggregate, and prepared aggregate; use whenever a payload or filter contains dates |
 | `skills/funifier/references/create-challenge.md` | Create a Funifier challenge — missions with action rules and point rewards |
 | `skills/funifier/references/create-action.md` | Create a Funifier action — define trackable player behaviors with attributes |

package/CHANGELOG.md

@@ -0,0 +1,78 @@
+# Changelog
+
+All notable changes to `funifier-mcp` are documented here. Format loosely follows
+[Keep a Changelog](https://keepachangelog.com/); versions follow semver.
+
+## [0.3.20]
+
+Documentation of trigger flow-interruption (strict mode) in the Funifier knowledge base.
+
+### Documentation
+- **Document `TriggerManager.executeStrict` (strict mode).** `DatabaseRest.insert/update/delete`
+  run `before_create`/`before_update`/`before_delete` triggers on database collections
+  (`/v3/database/{collection}`) in strict mode: an exception in the script aborts the
+  operation (document not written/removed; API responds **HTTP 500** with
+  `{ "message", "statusCode": 500 }`). Every other path (player/action/swap/quiz/bulk/`after_*`)
+  still uses plain `execute()`, which swallows exceptions and persists the document.
+- **Mode A (strict `throw`) vs Mode B (`after_create` + delete).** Rewrote
+  `guides/triggers-guide.md` §8 and updated `guides/trigger-examples.md` and
+  `modules/trigger.md` (new §2.5.1 `execute` vs `executeStrict`) to distinguish the two
+  rejection patterns and when each applies.
+- **Version-dependent feature + detection probe.** Strict mode was added in a recent Engine
+  update and is not on every instance; docs and the `funifier-create-trigger` skill now
+  include a disposable-trigger probe to detect support before relying on it.
+
+## [0.3.19]
+
+Implementation of the prioritized improvements from the MCP implementation review
+(`.specs/features/mcp-implementation-review/review-report.md`).
+
+### Security
+- **Stop leaking credentials in logs (P0/S1).** API errors are now logged through a
+  sanitizer that emits only the message + status; the raw axios error (which carries
+  `Authorization: Basic …` and the request body) is never written to stderr.
+- **Close path traversal in the docs resource (P0/S2).** `funifier://docs/{+path}` now
+  shares the same root-confinement guard as `funifier_read_doc` via `src/mcp/doc-path.ts`,
+  blocking `../` escapes.
+- **Restrict file permissions (P1/S3).** `funifier.json` and backup snapshots are written
+  with mode `0600` and the backup directory with `0700` (both hold plaintext secrets).
+- **Mark untrusted API data (P2/S6).** `funifier_database` query/aggregate and
+  `funifier_logs` responses are prefixed with a delimiter telling the agent to treat
+  end-user-influenced data as data, never as instructions.
+
+### Reliability
+- **Request timeout + retry (P0/P3).** The axios client now aborts after 30s and retries
+  idempotent GETs (network error / timeout / 5xx) with exponential backoff.
+- **Graceful shutdown (P2/M1).** The server closes the transport on `SIGTERM`/`SIGINT`.
+
+### Performance / token usage
+- **Aggregate result cap (P1).** Ad-hoc aggregate pipelines without an explicit `$limit`
+  get a `$limit:1000` backstop, and prepared-aggregate `run` results pass through the
+  response size guard.
+
+### Maintainability
+- **Resource-type registry (P1/A1).** `src/mcp/tools/_registry.ts` is now the single
+  source of truth mapping each resource type to its api-client methods and tool exposure,
+  replacing the duplicated switch/dispatch blocks in `save`/`delete`/`get`/`list`/
+  `_fetch-current`. A consistency test freezes per-tool membership and verifies every
+  registered method exists on the client.
+- **Structured logging (P1/O1).** A minimal JSON-lines stderr logger (`src/core/logger.ts`)
+  records one line per tool call (tool, duration, outcome) and the reason whenever a list
+  call returns `[]` due to an error.
+
+### Update notifications
+- The in-session update notice now links to this changelog, and scales its tone with
+  severity: routine patch/minor updates get a quiet one-liner, while major bumps
+  (including pre-1.0 minor bumps, per semver convention) warn about breaking changes
+  and tell the user to review the changelog before updating.
+
+### Tests
+- Added coverage for the doc-path guard, retry policy, aggregate cap, resource registry
+  dispatch/consistency, `ApiHolder`, and severity-aware update notices. Suite: 471 tests passing.
+
+### Deferred (documented, not changed)
+- Replacing the global `Range: items=0-1000` header with per-call pagination on the
+  generic list tool (platform-wide behavior change — needs a deliberate decision).
+- True GET-by-id in `fetchCurrentById` (most Funifier resources expose only list endpoints).
+- Automatic backup retention/expiry (auto-deleting snapshots is destructive; left manual).
+- Server-side aggregate stage denylist (`$out`/`$merge`) — pending confirmation of backend behavior.

package/README.md

@@ -7,7 +7,7 @@ Funifier AI toolkit — API client, MCP server, and AI assistant skills for the
 | Component | Description |
 |-----------|-------------|
 | **API Client** | Pure Node.js client for the Funifier REST API (80+ methods, 18 resource types) |
-| **MCP Server** | Model Context Protocol server — 11 tools, 3 prompts, documentation resources |
+| **MCP Server** | Model Context Protocol server — 14 tools, 3 prompts, documentation resources |
 | **Skills** | 32 guided workflows for Claude Code, Codex, OpenCode, Copilot, Continue, and Cursor |
 | **CLI** | `npx funifier-mcp@latest init` — interactive setup for AI platforms |
 

package/datasource-funifier-docs/.coverage.json

@@ -1,10 +1,11 @@
 {
-  "generatedAt": "2026-06-12T16:15:00.000Z",
+  "generatedAt": "2026-06-22T14:54:00.000Z",
   "docsRoot": "datasource-funifier-docs/",
   "docs": {
     "knowledge/guides/aggregates.md": {
       "status": "grouped",
       "skillIds": [
+        "funifier-query-aggregate",
         "funifier-create-aggregate",
         "funifier-date-handling",
         "funifier-create-custom-page",
@@ -15,6 +16,7 @@
     "knowledge/guides/database-access.md": {
       "status": "grouped",
       "skillIds": [
+        "funifier-query-aggregate",
         "funifier-create-aggregate",
         "funifier-date-handling",
         "funifier-implement-frontend"
@@ -148,6 +150,7 @@
     "knowledge/modules/database.md": {
       "status": "grouped",
       "skillIds": [
+        "funifier-query-aggregate",
         "funifier-create-aggregate",
         "funifier-date-handling",
         "funifier-create-audit",