loopctl-mcp-server 2.113.0 → 2.115.0

package/README.md

@@ -199,7 +199,8 @@ tool parameter.
 | `list_projects` | List all projects in the current tenant. |
 | `resolve_project` | Resolve a repo to its `project_id` in one cheap call — provide any of `slug`, `repo_url` (`git@github.com:owner/repo.git`, `https://github.com/owner/repo`, and bare `owner/repo` all match), or `name`. Precedence `slug > repo_url > name`, first match wins. Use the returned `id` to scope captures/recall (`memory_*`, `recall_context`). `404` `not_found` if nothing matches, `422` `no_identifier` if none supplied, `409` if a fuzzy identifier matches more than one active project. |
 | `create_project` | Create a new **work** project (epics/stories/custody). Requires orchestrator+ **and** a `human_anchored` tenant; an agent-rooted tenant gets `403 custody_tier_required` and should use `create_kb_scope`. |
-| `delete_project` | **Requires `LOOPCTL_USER_KEY`.** Delete a project and all of its dependent resources (epics, stories, audit entries). Irreversible — orchestrator role is not sufficient. |
+| `delete_project` | **Needs a user-role key:** `LOOPCTL_USER_KEY` verbatim when set, else the default key (orchestrator role is 403 `insufficient_role`). Archives the project (status `archived`); no rows are removed and its slug stays taken. |
+| `restore_project` | Restore an archived `kind: work` project, the reverse of `delete_project`; audited as `unarchived`. Orchestrator role or higher on a human-anchored tenant. Rejected (422) at the tenant's `max_projects` cap and for a kb scope (use `restore_kb_scope`). The only way to change a project's status back: PATCH refuses `status` with 422. |
 | `get_progress` | Get progress summary for a project, including story counts by status. Pass `include_cost=true` for cost data. |
 | `import_stories` | Import stories into a project from a structured payload (Epic 12 import format). Pass `merge: true` to add stories to epics that already exist (otherwise duplicates return 409). For large payloads, use `payload_path` to read JSON from disk instead of passing it inline. With `merge: true`, `report_orphans: true` adds `stories_orphaned` (the project's stories the payload does not mention; nothing is detached) — a signal only on a FULL round-trip of an export; without it the key is absent (#880). |
 

package/index.js

@@ -946,13 +946,23 @@ async function channelGraduate({ post_id, title, tags, category }) {
   return toContent(result);
 }
 
+// Pinned like `userKeyApiCall` (LOOPCTL_USER_KEY verbatim when set, so a global
+// LOOPCTL_API_KEY cannot displace it), spelled out so the route sweep sees the call.
 async function deleteProject({ project_id }) {
-  const result = await apiCall(
-    "DELETE",
-    `/api/v1/projects/${project_id}`,
-    null,
-    process.env.LOOPCTL_USER_KEY
-  );
+  const path = `/api/v1/projects/${project_id}`;
+  const key = process.env.LOOPCTL_USER_KEY;
+
+  const result = key
+    ? await apiCall("DELETE", path, null, key, { exactKey: true, keyHint: "LOOPCTL_USER_KEY" })
+    : await apiCall("DELETE", path, null);
+
+  return toContent(result);
+}
+
+// The reverse of deleteProject for a kind: work project. Default key: the route is
+// orchestrator+ (a user key passes too), so no role pin is needed.
+async function restoreProject({ project_id }) {
+  const result = await apiCall("POST", `/api/v1/projects/${project_id}/restore`, {});
   return toContent(result);
 }
 
@@ -1125,8 +1135,8 @@ async function getStory({ story_id }) {
 // Reads travel on the default key (any role passes). Create and update go through
 // `orchestratorPinnedApiCall`: the named orchestrator or user key VERBATIM, so a global
 // LOOPCTL_API_KEY of a lesser role cannot displace it, and the global key when neither is set. The deletes go through `userKeyApiCall`, pinned to LOOPCTL_USER_KEY so a
-// global LOOPCTL_API_KEY cannot displace it: they destroy rows. (`delete_project` is not
-// pinned this way.)
+// global LOOPCTL_API_KEY cannot displace it: they destroy rows. `delete_project` (an
+// archive) is pinned the same way, because its gate is `role: :user`.
 
 // ONE pinning rule for the epic and story writes: the env var `hint()` names is sent VERBATIM
 // when it is set, so a global LOOPCTL_API_KEY of a lesser role cannot displace it, and with none
@@ -4239,13 +4249,28 @@ const TOOLS = [
   {
     name: "delete_project",
     description:
-      "Delete a project and all of its dependent resources (epics, stories, audit entries scoped to it). REQUIRES LOOPCTL_USER_KEY to be set in the MCP server env (user role — orchestrator role is NOT sufficient for this destructive operation). The deletion is irreversible.",
+      "ARCHIVE a project (DELETE /api/v1/projects/:id sets status to archived; it removes no rows). Its epics, stories and audit entries stay, and an already-archived project is a no-op. The SLUG stays taken: slugs are unique per tenant across archived projects too, resolve_project by that slug still returns the archived project, create_project with it is refused 422, and no API call changes or releases a slug, so a new project needs a different one. The way back: restore_project for a work project, restore_kb_scope for a kb scope. Sent with LOOPCTL_USER_KEY verbatim when it is set (a global LOOPCTL_API_KEY does not displace it), else with the default key. Refusals: 403 insufficient_role below user role, 403 custody_tier_required on an agent-rooted tenant (the human-anchor gate), 404 for an id not in your tenant.",
     inputSchema: {
       type: "object",
       properties: {
         project_id: {
           type: "string",
-          description: "The UUID of the project to delete.",
+          description: "The UUID of the project to archive.",
+        },
+      },
+      required: ["project_id"],
+    },
+  },
+  {
+    name: "restore_project",
+    description:
+      "RESTORE an archived kind: work project (POST /api/v1/projects/:id/restore, the reverse of delete_project). Audited as unarchived; an already-active project comes back unchanged. Status cannot be changed any other way: PATCH /api/v1/projects/:id refuses a body carrying status with 422. Sent with the default key; the route needs orchestrator role or higher. Refusals: 422 when the tenant is at its max_projects cap (re-activating takes an active slot), 422 for a kind: kb scope (use restore_kb_scope), 403 insufficient_role below orchestrator role, 403 custody_tier_required on an agent-rooted tenant (the human-anchor gate), 404 for an id not in your tenant.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        project_id: {
+          type: "string",
+          description: "The UUID of the archived work project to restore.",
         },
       },
       required: ["project_id"],
@@ -10015,6 +10040,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     case "delete_project":
       return await deleteProject(args);
 
+    case "restore_project":
+      return await restoreProject(args);
+
     case "get_progress":
       return await getProgress(args);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopctl-mcp-server",
-  "version": "2.113.0",
+  "version": "2.115.0",
   "description": "MCP server for loopctl — structural trust for AI development loops",
   "type": "module",
   "main": "index.js",