pipebrain-mcp 0.43.1 → 0.44.1

package/dist/main.js

@@ -16622,6 +16622,30 @@ var ApiClient = class _ApiClient {
       timeoutMs: this.timeoutMs
     });
   }
+  /**
+   * The inverse of {@link forOrg}: a thin copy that stamps NO `X-Org-Id`, for the
+   * org-INDEPENDENT routes named above.
+   *
+   * IT EXISTS BECAUSE A BASE CLIENT IS NOT ALWAYS UNSCOPED. The rule above assumes the
+   * caller reaches those routes through the client it started with, which holds for the
+   * web application. It does not hold for `pipebrain-mcp`, which scopes its client ONCE at
+   * startup from `PIPEBRAIN_ORG` and hands that scoped client to the tool registry as its
+   * base — so an org-independent call made there carries a header anyway.
+   *
+   * That is harmless while the default is good and actively harmful when it is not. A
+   * default naming an organization its holder has since been removed from makes EVERY call
+   * of that session refuse, including the one call whose whole purpose is to tell the
+   * caller which organizations it may name instead. Asking that question has to work from
+   * inside the broken state, or it does not help in the only case it is needed.
+   */
+  unscoped() {
+    return new _ApiClient({
+      baseUrl: this.baseUrl,
+      auth: this.auth,
+      fetch: this.fetchImpl,
+      timeoutMs: this.timeoutMs
+    });
+  }
   // --- core ------------------------------------------------------------------
   /** Builds the auth + active-org headers for the configured mode. */
   authHeaders() {
@@ -17158,9 +17182,10 @@ var ApiClient = class _ApiClient {
    * Takes NO project and NO org PARAMETER: a queue you point at a project is the
    * per-project surface this replaces, and the organization is a property of the CLIENT,
    * which is where every caller already binds it — `X-Org-Id` for a session and for a
-   * bearer caller alike, falling back to the credential's own organization when nothing
-   * stamped one (PIPE-410 withdrew the rule that a bearer call's organization came off
-   * the token). The agent tool DOES take an `org`, and it is spent on `forOrg` before it
+   * bearer caller alike. A call that stamps none is refused rather than resolved against
+   * the credential, because PIPE-410 (an agent credential reaches every organization its
+   * owner belongs to) left no organization on a credential to resolve against. The agent
+   * tool DOES take an `org`, and it is spent on `forOrg` before it
    * gets here. `mine` narrows to the gates whose
    * work the viewer claimed — plus the requirement gates, which have no claimant at
    * all and would otherwise be waited on by nobody; omitting it is the wide view.
@@ -17628,6 +17653,29 @@ function createMcpServer(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__
       })
     );
   }
+  registerStrict("list_orgs", {
+    description: "List the organizations this credential may act in \u2014 each with its name, slug, id, kind (personal or shared) and your role there. THIS IS THE ONE TOOL THAT NEEDS NO `org`: every other call names the organization it acts in and is refused if it names none, and this is how you find out which names you may use. The answer is your live memberships at this moment, which is exactly what that check tests against, so an organization you have just joined appears here and one you have been removed from does not (\xA77)."
+    // NO inputSchema, and the absence is the point rather than an omission. There is
+    // nothing to narrow: the answer is the caller's own memberships, and a filter over a
+    // list this short would be a second way to ask one question.
+  }, () => (
+    // A BARE ARRAY, unlike `list_waiting`'s `{ items }`, and for the reason that tool
+    // gives rather than against it: the envelope has already been unwrapped by
+    // `ApiClient.listOrgs`, so passing it through is what avoids deciding the shape a
+    // second time. The sibling list tools return bare arrays for the same reason.
+    //
+    // `.unscoped()` IS LOAD-BEARING, and this is the only tool that uses it. Every other
+    // tool wants whatever scope is in force; this one must have none, because it is the
+    // tool a caller reaches for when the scope in force is the problem. Two ways in:
+    // a call naming an organization the caller cannot use, and — worse, because the
+    // caller names nothing at all — a stdio server started with a `PIPEBRAIN_ORG` whose
+    // organization its holder has since left, which scopes the registry's base client
+    // once at startup. In either state every other call refuses, and without this the
+    // one call that could say which organizations ARE available refuses along with them.
+    // The answer does not depend on scope, so dropping it costs nothing and is what
+    // makes the tool's own description true.
+    run(() => client2().unscoped().listOrgs(), GUIDANCE_POINTER)
+  ));
   registerStrict("list_projects", {
     description: "List all projects with their key, environments, milestones (token, label, active), deliverable targets (slug, label, active), and open-issue counts \u2014 the project switcher and workflow entry point (\xA77).",
     // Optional pagination (§9) — bounds mirror list_issues/list_requirements; the
@@ -17649,7 +17697,7 @@ function createMcpServer(baseClient, apiBaseUrl, orgInstructions2 = /* @__PURE__
     }
   }, (args) => run(() => client2().createProject(args)));
   registerStrict("list_waiting", {
-    description: "Every gate awaiting a PERSON across ALL projects in the organization this call acts in \u2014 name that organization with `org`, or omit it to read the one this session defaults to \u2014 longest wait first: a requirement revision awaiting approval, a question awaiting an answer, and work in `verify` holding at least one criterion not yet passed. Each entry names its project, the ref the action is taken on (`KEY-R{n}` for a revision, the ISSUE\u2019s `KEY-{n}` for a question or for work at verify), and `waitingSince` \u2014 the instant the wait began, not a duration. Nothing else is a gate: work in `triage` never appears, and neither does work in verify whose criteria have ALL passed. THIS TOOL is READ-ONLY and clears nothing; what clears each gate differs. Answering a question has no tool on this surface, by design. A requirement revision is approved with `approve_requirement`. A verify gate clears as its criteria pass \u2014 an `auto` one through `set_criterion_state`, a `manual` one only ever by a person in the web app. Use it to see what your work is blocked on before asking, rather than to act on it."
+    description: "Every gate awaiting a PERSON across ALL projects in the organization this call acts in \u2014 name that organization with `org`, which is refused if omitted unless this session has a default \u2014 longest wait first: a requirement revision awaiting approval, a question awaiting an answer, and work in `verify` holding at least one criterion not yet passed. Each entry names its project, the ref the action is taken on (`KEY-R{n}` for a revision, the ISSUE\u2019s `KEY-{n}` for a question or for work at verify), and `waitingSince` \u2014 the instant the wait began, not a duration. Nothing else is a gate: work in `triage` never appears, and neither does work in verify whose criteria have ALL passed. THIS TOOL is READ-ONLY and clears nothing; what clears each gate differs. Answering a question has no tool on this surface, by design. A requirement revision is approved with `approve_requirement`. A verify gate clears as its criteria pass \u2014 an `auto` one through `set_criterion_state`, a `manual` one only ever by a person in the web app. Use it to see what your work is blocked on before asking, rather than to act on it."
     // NO NARROWING ARGUMENTS. The one argument this tool does take — `org`, which every
     // tool takes — is not a narrowing: it says WHICH ORGANIZATION the call acts in, not
     // which of that organization's gates come back, and the caller's membership there is
@@ -18246,7 +18294,7 @@ function loadMcpConfig() {
 }
 
 // src/version.ts
-var VERSION = "0.43.1";
+var VERSION = "0.44.1";
 
 // src/main.ts
 async function scopedClient(base, org) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipebrain-mcp",
-  "version": "0.43.1",
+  "version": "0.44.1",
   "description": "Pipebrain MCP server for Claude Code and Claude Desktop — issues, requirements, decision records, conventions, prompts, content, assets, metadata-only secrets, and more of the platform's modules over the Pipebrain API.",
   "type": "module",
   "license": "MIT",