iit-mcp-autotask 0.38.4 → 0.38.5

package/README.md

@@ -9,9 +9,9 @@ packaged playbooks, strong security boundaries, and predictable per-tenant in-pr
 client + SDK-owned TTL caches).
 
 > **Package status (2026-10-29):** the runtime dependency `node-autotask` is published to public npm
-> at `0.39.1`; the committed `pnpm-lock.yaml` pins that
+> at `0.39.4`; the committed `pnpm-lock.yaml` pins that
 > release with its integrity hash, so installs resolve deterministically. The dependency is always npm
-> (node-autotask pinned exactly at `0.39.1`) — never a `file:`, `git:`, `link:` or workspace reference
+> (node-autotask pinned exactly at `0.39.4`) — never a `file:`, `git:`, `link:` or workspace reference
 > to a local checkout.
 
 > **0.6.0 is a breaking release** (unreleased): tool names, result shapes and configuration all
@@ -780,7 +780,7 @@ independent review with its resolutions, [`docs/reviews/0.6.0.md`](docs/reviews/
 
 ## SDK dependency
 
-`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.39.1`** (an exact pin —
+`iit-mcp-autotask` depends on **`node-autotask` from npm at exactly `0.39.4`** (an exact pin —
 no range operator; subpaths `.` / `/capabilities` / `/operations` / `/resources` / `/types` /
 `/pool`) — the only **vendor** dependency; the other two runtime dependencies are
 `@modelcontextprotocol/server` (the MCP framework) and `zod` (schema validation). It never

package/dist/tools/dispatch.js

@@ -319,6 +319,12 @@ export async function readOneItem(ctx, operation, args, signal, opts) {
         if (verdict.aborted)
             return { aborted: true, result: undefined };
         guardNote = verdict.note;
+        // #245: a no-filter walk answers the first rows of the tenant table; say so, so the page is not read as the full answer
+        const f = sent.filter;
+        if ((f === undefined || (Array.isArray(f) && f.length === 0)) && sent.latest === undefined && typeof sent.limit === 'number') {
+            const noFilter = `no filter: the first ${sent.limit} rows in id order, not a scoped or complete answer.`;
+            guardNote = guardNote === undefined ? noFilter : `${guardNote} ${noFilter}`;
+        }
     }
     if (operation === 'contracts.profitability') {
         const rawBag = cleanArgs[1];

package/dist/tools/scope-guard.d.ts

@@ -22,7 +22,8 @@ export declare const ACK_KEY = "acknowledgeUnscoped";
 /** Typed refusal of an unscoped walk: an error envelope (reason SCOPE_REQUIRED, next supply_input) or a typed slot error. */
 export declare class ScopeRequiredError extends Error {
     readonly code: "SCOPE_REQUIRED";
-    readonly field = "filter";
+    /** The reason pointer in the caller's arg shape: `args[0].filter` on autotask_read, `filter` on autotask_query (#245). */
+    readonly field: string;
     readonly count: number;
     readonly threshold: number;
     readonly operation: string;

package/dist/tools/scope-guard.js

@@ -7,7 +7,8 @@ export const ACK_KEY = 'acknowledgeUnscoped';
 /** Typed refusal of an unscoped walk: an error envelope (reason SCOPE_REQUIRED, next supply_input) or a typed slot error. */
 export class ScopeRequiredError extends Error {
     code = 'SCOPE_REQUIRED';
-    field = 'filter';
+    /** The reason pointer in the caller's arg shape: `args[0].filter` on autotask_read, `filter` on autotask_query (#245). */
+    field;
     count;
     threshold;
     operation;
@@ -17,6 +18,7 @@ export class ScopeRequiredError extends Error {
         const suggestedAction = `Filter on resolved ids (companyID, contractID, ticketID, resourceID with op eq or in), or autotask_query group_by, sum or count for totals, or pass ${ackName}: true to walk it anyway.`;
         // within the 200-char message bound (MAX_ERROR_MESSAGE_CHARS) whatever the resource name: data.operation names the op
         super(`${count} rows match with no id filter (over ${UNSCOPED_WALK_THRESHOLD}). Filter on companyID, contractID, ticketID or resourceID (eq or in; time entries: ticket.companyID) and call again, or pass ${ackName}: true.`);
+        this.field = ackName === ACK_KEY ? 'args[0].filter' : 'filter';
         this.operation = operation;
         this.count = count;
         this.threshold = UNSCOPED_WALK_THRESHOLD;

package/dist/tools/server-version.d.ts

@@ -1,3 +1,3 @@
 /** The wire identity of this server: a leaf module (no imports) so any tool can read it without an import cycle. */
 export declare const SERVER_NAME = "iit-mcp-autotask";
-export declare const SERVER_VERSION = "0.38.4";
+export declare const SERVER_VERSION = "0.38.5";

package/dist/tools/server-version.js

@@ -1,4 +1,4 @@
 /** The wire identity of this server: a leaf module (no imports) so any tool can read it without an import cycle. */
 export const SERVER_NAME = 'iit-mcp-autotask';
-export const SERVER_VERSION = '0.38.4';
+export const SERVER_VERSION = '0.38.5';
 //# sourceMappingURL=server-version.js.map

package/dist/tools/server.d.ts

@@ -60,7 +60,7 @@ export declare function serverInstructions(config: Pick<Config, 'AUTOTASK_PROFIL
 /** The full identity stamp (the `/metadata` build block — the era pair, FR-2). */
 export declare const SERVER_IDENTITY: {
     readonly name: "iit-mcp-autotask";
-    readonly version: "0.38.4";
+    readonly version: "0.38.5";
     readonly mcpProtocolBaseline: "2026-07-28";
     readonly legacyProtocolFallback: "2025-11-25";
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.38.4",
+  "version": "0.38.5",
   "description": "MCP server for the Autotask (Datto) PSA domain, built on the node-autotask SDK",
   "license": "MIT",
   "author": "Max Soukhomlinov",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "^2.2.0",
-    "node-autotask": "0.39.1",
+    "node-autotask": "0.39.4",
     "zod": "^4.6.7"
   },
   "devDependencies": {

package/server.json

@@ -1,6 +1,6 @@
 {
   "name": "iit-mcp-autotask",
-  "version": "0.38.4",
+  "version": "0.38.5",
   "description": "MCP server for the Autotask (Datto) PSA API, powered by the node-autotask SDK",
   "mcpProtocolBaseline": "2026-07-28",
   "legacyProtocolFallback": "2025-11-25",
@@ -61,7 +61,7 @@
   "capabilitiesManifest": "capabilities.json",
   "sdk": {
     "package": "node-autotask",
-    "versionRange": "0.39.1"
+    "versionRange": "0.39.4"
   },
   "vendorExtensions": false,
   "credentialModelNote": "per-request; server-held under stdio or, on HTTP, only behind AUTOTASK_HTTP_AUTH=tokens; operator plans and the ledger are keyed by principal and tenant id, never by credential, and an apply uses the credential on the apply request"