npm - smashspace - Versions diffs - 0.3.0 → 0.4.0 - Mend

smashspace 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/README.md CHANGED Viewed

@@ -112,6 +112,45 @@ smash card update <cardId> --desc-file spec.md   # multi-line body from a file /
 Pick a board with `-b <label>` (defaults to `main`), or bypass config with
 `--board-id <id>`.
+## Agent inbox: who said what to whom
+Comments carry an optional **recipient**, so several agents can hand work to
+each other on the card it is about — no separate channel, and a human reads the
+same thread in the UI.
+```bash
+smash comment add <cardId> "PR is up, please review" --author codex --to claude-code
+smash inbox --to claude-code          # only what is addressed to me
+smash inbox --since <cursor>          # only what I have not read yet
+```
+`smash inbox` prints a `cursor` at the end; pass it as the next `--since` and
+you read each message once. `--json` gives `{ comments, cursor }`.
+## Write from CI or a cloud job (no CLI, no MCP)
+For environments where you cannot install anything — a scheduled cloud run, a
+webhook handler, a GitHub Action — issue a **board-scoped write-only token** and
+post with `curl`:
+```bash
+smash token create <boardId> "GitHub Actions"   # shown once; store it now
+smash token list <boardId>                      # prefix / created / last used
+smash token revoke <boardId> <tokenId>          # immediate
+curl -X POST https://smashspace.app/api/ingest \
+  -H "Authorization: Bearer smash_ing_xxxxxxxx" \
+  -H "Content-Type: application/json" \
+  -H "Idempotency-Key: my-event-123" \
+  -d '{"list":"やること","title":"支払いエラー","labels":["緊急"]}'
+```
+The token can only create cards and comments on that one board — it cannot read
+or delete. Lists and labels are matched by name, so the caller needs no internal
+ids, and a repeated `Idempotency-Key` returns the first card instead of making
+another (keys never expire). Tokens can also be issued from the space's
+**Settings → Connect** tab.
 ## Multiple repos on one machine
 `smash` is **directory-aware**: it walks up from your current directory to the

package/dist/smash.mjs CHANGED Viewed

@@ -4202,15 +4202,64 @@ cardCmd.command("search <query>").description(
   console.log(`
 ${allHits.length} card(s) found`);
 });
-cardCmd.command("comment <cardId> <body>").description("Add a comment to a card").option("--author <name>", "Author name").action(
+cardCmd.command("comment <cardId> <body>").description("Add a comment to a card").option("--author <name>", "Author name").option(
+  "--to <id>",
+  "Address the comment to an assignee id (repeatable). Agents poll their own with `smash inbox --to <id>`.",
+  collectRepeated,
+  []
+).action(
   async (cardId, body, opts) => {
     const comment = await api(`/api/cards/${cardId}/comments`, {
       method: "POST",
-      body: JSON.stringify({ body, authorName: opts.author })
+      body: JSON.stringify({
+        body,
+        authorName: opts.author,
+        ...opts.to.length > 0 ? { recipients: opts.to } : {}
+      })
     });
-    show(comment, [`\u2713 comment ${comment.id} added`]);
+    show(comment, [
+      `\u2713 comment ${comment.id} added${comment.recipients?.length ? ` \u2192 ${comment.recipients.join(", ")}` : ""}`
+    ]);
   }
 );
+function collectRepeated(value, previous) {
+  return [...previous, value];
+}
+program2.command("inbox").description(
+  `New comments across the resolved board (${CONFIG_FILENAME}). Poll with --since <cursor> to read only what you have not seen.`
+).option("-b, --board <label>", "board label from config").option("--board-id <id>", "explicit board id (bypass config)").option("--since <iso>", "only comments created after this ISO timestamp (exclusive)").option("--to <id>", "only comments addressed to this assignee id").option("--limit <n>", "max comments to read (default 100, max 500)").action(async (opts) => {
+  const ctx = resolveContext(opts);
+  const params = new URLSearchParams();
+  if (opts.since)
+    params.set("since", opts.since);
+  if (opts.to)
+    params.set("to", opts.to);
+  if (opts.limit)
+    params.set("limit", opts.limit);
+  const qs = params.toString();
+  const result = await api(
+    `/api/boards/${ctx.boardId}/comments${qs ? `?${qs}` : ""}`,
+    void 0,
+    ctx.baseUrl
+  );
+  if (getOpts().json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.comments.length === 0) {
+    console.log(`(no new comments)${result.cursor ? `  cursor: ${result.cursor}` : ""}`);
+    return;
+  }
+  for (const c of result.comments) {
+    const to = c.recipients?.length ? ` \u2192 ${c.recipients.join(", ")}` : "";
+    console.log(
+      `[${c.createdAt}] ${c.authorName ?? "anon"}${to}  (${c.listTitle} / ${c.cardTitle} \xB7 ${c.cardId})`
+    );
+    console.log(`  ${c.body.replace(/\n/g, "\n  ")}`);
+  }
+  console.log(`
+cursor: ${result.cursor}`);
+});
 var archiveCmd = program2.command("archive [cardId]").description("Archive a card (soft-delete). Without cardId: manage archived cards (list/restore/purge)").option("-b, --board <label>", `board label from ${CONFIG_FILENAME}`).option("--board-id <id>", "explicit board id (bypass config)").action(async (cardId, opts) => {
   if (!cardId) {
     archiveCmd.help();
@@ -4278,12 +4327,18 @@ checklistCmd.command("delete <itemId>").description("Delete a checklist item").a
   console.log(`\u2713 checklist item ${itemId} deleted`);
 });
 var commentCmd = program2.command("comment").description("Card comments (add / edit / delete)");
-commentCmd.command("add <cardId> <body>").description("Add a comment to a card").option("--author <name>", "Author name").action(async (cardId, body, opts) => {
+commentCmd.command("add <cardId> <body>").description("Add a comment to a card").option("--author <name>", "Author name").option("--to <id>", "Address the comment to an assignee id (repeatable)", collectRepeated, []).action(async (cardId, body, opts) => {
   const comment = await api(`/api/cards/${cardId}/comments`, {
     method: "POST",
-    body: JSON.stringify({ body, authorName: opts.author })
+    body: JSON.stringify({
+      body,
+      authorName: opts.author,
+      ...opts.to.length > 0 ? { recipients: opts.to } : {}
+    })
   });
-  show(comment, [`\u2713 comment ${comment.id} added`]);
+  show(comment, [
+    `\u2713 comment ${comment.id} added${comment.recipients?.length ? ` \u2192 ${comment.recipients.join(", ")}` : ""}`
+  ]);
 });
 commentCmd.command("edit <commentId> <body>").description("Edit (replace body of) an existing comment").action(async (commentId, body) => {
   const comment = await api(`/api/comments/${commentId}`, {
@@ -4396,6 +4451,48 @@ attachmentCmd.command("delete <attachmentId>").description("Delete an attachment
   await api(`/api/attachments/${attachmentId}`, { method: "DELETE" });
   console.log(`\u2713 attachment ${attachmentId} deleted`);
 });
+var tokenCmd = program2.command("token").description("Board-scoped write tokens for external services (POST /api/ingest)");
+tokenCmd.command("create <boardId> <name>").description("Issue a write-only token for one board. The token is shown once.").action(async (boardId, name) => {
+  const created = await api(
+    `/api/boards/${boardId}/ingest-tokens`,
+    { method: "POST", body: JSON.stringify({ name }) }
+  );
+  show(created, [
+    `\u2713 token ${created.id} created for ${boardId}`,
+    "",
+    created.token,
+    "",
+    "Store it now \u2014 it is not shown again. It can only create cards and",
+    "comments on this board:",
+    `  curl -X POST ${resolveBaseUrl()}/api/ingest \\`,
+    `    -H "Authorization: Bearer ${created.token}" \\`,
+    '    -H "Content-Type: application/json" \\',
+    `    -d '{"list":"\u3084\u308B\u3053\u3068","title":"\u2026"}'`
+  ]);
+});
+tokenCmd.command("list <boardId>").description("List a board's write tokens (prefix, created, last used)").action(async (boardId) => {
+  const items = await api(`/api/boards/${boardId}/ingest-tokens`);
+  if (getOpts().json) {
+    console.log(JSON.stringify(items, null, 2));
+    return;
+  }
+  if (items.length === 0) {
+    console.log("(no tokens)");
+    return;
+  }
+  for (const t of items) {
+    console.log(
+      `${t.id}  ${t.name}  ${t.tokenPrefix}\u2026  created ${t.createdAt}  last used ${t.lastUsedAt ?? "never"}`
+    );
+  }
+});
+tokenCmd.command("revoke <boardId> <tokenId>").description("Revoke a write token (takes effect immediately)").action(async (boardId, tokenId) => {
+  const revoked = await api(
+    `/api/boards/${boardId}/ingest-tokens/${tokenId}`,
+    { method: "DELETE" }
+  );
+  show(revoked, [`\u2713 token ${revoked.id} revoked at ${revoked.revokedAt}`]);
+});
 var labelCmd = program2.command("label").description("Labels");
 labelCmd.command("create <boardId> <name>").description("Create a board label").option(
   "--color <color>",

package/dist/smashspace-mcp.mjs CHANGED Viewed

@@ -15766,21 +15766,55 @@ var tools = [
   },
   {
     name: "smash_add_comment",
-    description: "Add a comment to a card. Markdown is supported.",
+    description: "Add a comment to a card. Markdown is supported. Use `recipients` to address the comment to specific assignee ids (the same ids as smash_set_assignees), so the addressee can poll just its own messages with smash_list_new_comments. Agent-to-agent hand-offs belong on the card they are about \u2014 there is no separate channel, which keeps the exchange attached to the work.",
     inputSchema: {
       type: "object",
       properties: {
         cardId: { type: "string" },
         body: { type: "string" },
-        authorName: { type: "string" }
+        authorName: { type: "string" },
+        recipients: {
+          type: "array",
+          items: { type: "string" },
+          description: "Assignee ids this comment is addressed to (e.g. ['claude-code'])"
+        }
       },
       required: ["cardId", "body"]
     },
     handler: async (args) => api(`/api/cards/${args.cardId}/comments`, {
       method: "POST",
-      body: JSON.stringify({ body: args.body, authorName: args.authorName })
+      body: JSON.stringify({
+        body: args.body,
+        authorName: args.authorName,
+        ...Array.isArray(args.recipients) && args.recipients.length > 0 ? { recipients: args.recipients } : {}
+      })
     })
   },
+  {
+    name: "smash_list_new_comments",
+    description: "Read comments across a whole board in created order \u2014 an agent inbox. Pass `since` (an ISO timestamp, exclusive) to get only what you have not seen, and `to` to keep just the comments addressed to you. The result carries a `cursor`; store it and pass it as the next `since`. Prefer this over re-reading the board: it is one request and returns only new messages.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        boardId: { type: "string" },
+        since: { type: "string", description: "ISO timestamp; returns comments created after it" },
+        to: { type: "string", description: "Only comments addressed to this assignee id" },
+        limit: { type: "number", description: "Max comments to read (default 100, max 500)" }
+      },
+      required: ["boardId"]
+    },
+    handler: async (args) => {
+      const params = new URLSearchParams();
+      if (typeof args.since === "string" && args.since)
+        params.set("since", args.since);
+      if (typeof args.to === "string" && args.to)
+        params.set("to", args.to);
+      if (typeof args.limit === "number")
+        params.set("limit", String(args.limit));
+      const qs = params.toString();
+      return api(`/api/boards/${args.boardId}/comments${qs ? `?${qs}` : ""}`);
+    }
+  },
   {
     name: "smash_add_checklist_item",
     description: "Add a checklist item to a card.",

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "smashspace",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "SmashSpace CLI + MCP — operate SmashSpace boards from your terminal, Claude Code, Cursor, and Codex.",
   "type": "module",
   "bin": {