tascan-mcp 3.10.0 → 3.11.0

package/README.md

@@ -107,7 +107,7 @@ Add as a custom connector in Claude (Settings > Connectors). When you first use
 | Tool | Description | Type |
 |------|-------------|------|
 | `tascan_list_tasks` | List all tasks in an event | Read |
-| `tascan_get_task` | Get task details including completions | Read |
+| `tascan_get_task` | Get task details including completions; each completion carries `photo_url` (raw storage path) + `photo_signed_url` (fetchable, ~1h, `null` when no photo) | Read |
 | `tascan_add_tasks` | Bulk-create tasks in an event | Create |
 | `tascan_update_task` | Update task title, type, flags, order | Update |
 | `tascan_delete_task` | Delete a task and its completions | Delete |
@@ -125,7 +125,7 @@ Add as a custom connector in Claude (Settings > Connectors). When you first use
 | `tascan_generate_qr` | Generate a QR code for an event | Create |
 | `tascan_apply_template` | Apply a pre-built template to an event | Create |
 | `tascan_list_templates` | List available task templates | Read |
-| `tascan_get_report` | Get completion report for an event (optional `include_responses` returns submitted response data) | Read |
+| `tascan_get_report` | Get completion report for an event (optional `include_responses` returns submitted response data plus a per-task `photos[]` list of `{ path, signed_url, completed_at, worker_name }`) | Read |
 | `tascan_generate_report` | Mint a shareable Completion / Service (client-branded, acknowledgeable) / Project / Evidence Pack link; optionally text it | Write |
 | `tascan_list_reports` | Existing report links for a list or project with acknowledgment status | Read |
 | `tascan_invite_worker` | Consented intro to a marketplace worker: TaScan texts them, YES adds them to your org + sends the list, NO keeps them anonymous | Write |
@@ -262,6 +262,21 @@ API keys are scoped to your organization and support rate limiting (60 requests/
 - Photo-required tasks won't show as complete until the photo uploads
 - Check the event's response mode (single vs. multi-response)
 
+**Photo evidence links**
+- `photo_url` is the raw storage object path (stable, never changes). `photo_signed_url` is a fetchable HTTPS link that expires after ~1 hour (server default `TASCAN_PHOTO_URL_TTL=3600`). Re-run the read tool for a fresh link; never store the signed URL.
+- `photo_signed_url: null` with a non-null `photo_url` means signing was unavailable at read time (storage hiccup). The read still succeeds — retry for the link.
+
+## Changelog
+
+### v3.11.0 — 2026-09-11
+- **Signed photo URLs in every completion payload.** Photo evidence was invisible to AI agents: `photo_url` was a bare private-bucket path with no host or token. Every read path that returns a completion now also returns `photo_signed_url` (short-lived, default 1h, tunable via `TASCAN_PHOTO_URL_TTL`), `null` when there is no photo. Covered: `tascan_get_task` (task + subtask completions), `tascan_get_report` (new per-task `photos[]` when `include_responses` is true, replacing the bare `[+photo]` marker), `tascan_list_subtasks`, `tascan_query_responses`, `tascan_list_issues` / issue analysis (issue + injury photos), `tascan_zone_compliance` (PPE checkpoint photos), `tascan_condition_history` (assessment + baseline photos).
+- One batched storage signing call per response (a 40-task list fires one request, not 40). Signing failures log and degrade to `photo_signed_url: null` with the raw path intact; the tool call never fails.
+- Single shared signing helper on the server (`photo-sign-lib`) now backs the API, the photo proxy used by the Completion / Client / Project / Evidence Pack reports, and every AI vision fetcher, so URL construction cannot drift again.
+- Remote endpoint `serverInfo.version` now reads from this package instead of a stale hardcoded string.
+
+### v3.10.0 — 2026-09-03
+- 69 tools: invoices, P2P worker payments, hazard zones with AI-verified PPE checkpoints, full RLS lockdown, agent claims.
+
 ## Privacy Policy
 
 TaScan collects and processes task completion data, worker information (name, phone, email), GPS coordinates (with consent), and photos uploaded during task completion. Data is stored securely in Supabase with row-level security policies. API access is authenticated and rate-limited.

package/index.js

@@ -45,7 +45,7 @@ async function api(method, path, body) {
 }
 
 const server = new Server(
-  { name: 'tascan', version: '3.10.0' },
+  { name: 'tascan', version: '3.11.0' },
   { capabilities: { tools: {} } }
 );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tascan-mcp",
-  "version": "3.10.0",
+  "version": "3.11.0",
   "mcpName": "io.github.snowbikemike/tascan-mcp",
   "description": "TaScan MCP Server — Closed-loop autonomous operations protocol. 69 tools for projects, tasks, workers, QR codes, NFC tags, worker marketplace with consented SMS invites, geofenced zones with rules (work site / hazard + AI-verified PPE checkpoints / containment / restricted, breach alerts, zone compliance audit), AI condition assessment, worker passports, verification-gated gig payments, client invoicing from verified work (overtime / day rate / per diem / expenses), shareable report links (completion, client service report, project, evidence pack), cross-entity search, duplicate-worker detection, worker identity merge, AI issue analysis, and autonomous remediation dispatch. 15 patents filed (470+ claims). Task. Scan. Done.",
   "type": "module",

package/tools.cjs

@@ -395,7 +395,7 @@ const TOOLS = [
   },
   {
     name: 'tascan_get_task',
-    description: 'Get details of a specific task including completions',
+    description: 'Get details of a specific task including completions and subtasks. Each completion carries photo_url (raw storage path, stable) and photo_signed_url (short-lived fetchable URL, ~1h; null when no photo) so you can actually view the photo evidence.',
     inputSchema: {
       type: 'object',
       properties: { task_id: { type: 'string', description: 'Task ID' } },
@@ -733,7 +733,7 @@ const TOOLS = [
   },
   {
     name: 'tascan_get_report',
-    description: 'Get completion report for a task list (event) including task status, completions, workers, and photos. Set include_responses to also return the actual submitted response data (numbers, text, choices) for each completed task.',
+    description: 'Get completion report for a task list (event) including task status, completions, workers, and photos. Set include_responses to also return the actual submitted response data (numbers, text, choices) for each completed task plus a per-task photos list with fetchable signed URLs (short-lived, ~1h) for the photo evidence.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -762,7 +762,14 @@ const TOOLS = [
             text += `    -> ${value != null ? value : '(no value)'}${note ? ' — ' + note : ''} (${resp.worker_name}, ${resp.completed_at})\n`;
           }
         }
+        // Photo evidence: retrievable signed URLs (task.photos = [{ path, signed_url, completed_at, worker_name }])
+        if (args.include_responses && task.photos && task.photos.length > 0) {
+          for (const ph of task.photos) {
+            text += `    photo: ${ph.signed_url || ph.path + ' (signing unavailable)'} (${ph.worker_name}, ${ph.completed_at})\n`;
+          }
+        }
       }
+      if (args.include_responses) text += '\nphotos: signed URLs expire (~1h) — re-run this tool for fresh links.\n';
       return text;
     }
   },
@@ -793,8 +800,11 @@ const TOOLS = [
         text += `${when} · ${resp.list_name} · ${label}: ${value != null ? value : '(no value)'}`;
         if (note) text += ` — ${note}`;
         text += ` (${resp.worker_name})\n`;
+        // Photo evidence: fetchable signed URL (falls back to the raw path if signing was unavailable)
+        if (resp.photo_url) text += `    photo: ${resp.photo_signed_url || resp.photo_url + ' (signing unavailable)'}\n`;
       }
       if (r.responses.length === 0) text += '(no responses found)\n';
+      else if (r.responses.some(x => x.photo_url)) text += '\nphotos: signed URLs expire (~1h) — re-run this tool for fresh links.\n';
       return text;
     }
   },
@@ -818,8 +828,10 @@ const TOOLS = [
         text += `${i+1}. [${iss.status.toUpperCase()}] ${iss.title}\n`;
         text += `   ID: ${iss.id} | Type: ${iss.type} | Category: ${iss.category} | Severity: ${iss.severity || 'unset'}\n`;
         if (iss.tasks) text += `   Task: ${iss.tasks.title}\n`;
+        if (iss.photo_url) text += `   Photo: ${iss.photo_signed_url || iss.photo_url + ' (signing unavailable)'}\n`;
         text += `   Reported: ${iss.created_at}\n\n`;
       });
+      if (issues.some(x => x.photo_url)) text += 'photos: signed URLs expire (~1h) — re-run this tool for fresh links.\n';
       return text;
     }
   },
@@ -1473,7 +1485,10 @@ const TOOLS = [
         text += `\n${s.created_at.slice(0, 16).replace('T', ' ')} — ${s.condition_score ?? '?'}/100 (${s.condition_grade || '?'})`;
         if (s.delta_score != null) text += ` [${s.delta_score > 0 ? '+' : ''}${s.delta_score}]`;
         if (s.summary) text += `\n  ${s.summary}`;
+        if (s.photo_url) text += `\n  photo: ${s.photo_signed_url || s.photo_url + ' (signing unavailable)'}`;
       });
+      if (a.baseline_photo_url) text += `\n\nbaseline photo: ${a.baseline_photo_signed_url || a.baseline_photo_url + ' (signing unavailable)'}`;
+      if (a.baseline_photo_url || (a.assessments || []).some(s => s.photo_url)) text += '\n\nphotos: signed URLs expire (~1h) — re-run this tool for fresh links.';
       return text;
     }
   },