tododdle-mcp 3.7.0 → 3.8.0

package/.claude-plugin/marketplace.json

@@ -5,17 +5,17 @@
     "url": "https://tododdle.com"
   },
   "description": "Agent workflow plugins for ToDoddle.",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "plugins": [
     {
       "name": "tododdle",
       "displayName": "ToDoddle",
       "description": "Connect repositories and use ToDoddle for project context and ticket execution.",
-      "version": "3.7.0",
+      "version": "3.8.0",
       "source": {
         "source": "npm",
         "package": "tododdle-mcp",
-        "version": "3.7.0"
+        "version": "3.8.0"
       },
       "category": "productivity",
       "tags": [

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tododdle",
   "displayName": "ToDoddle",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "description": "Connect repositories and run disciplined agent workflows in ToDoddle.",
   "author": {
     "name": "ToDoddle",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tododdle",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "description": "Disciplined agent workflows for projects managed in ToDoddle.",
   "author": {
     "name": "ToDoddle",

package/README.md

@@ -86,7 +86,7 @@ The MCP server provides capabilities. The package distributes four optional skil
 | `tododdle-factory` | Run one explicit, supervised autonomous delivery attempt with an Agent Run and stable evidence. |
 | `tododdle-supervisor` | Use current ToDoddle supervision assessments at meaningful workflow decisions when a compatible backend is available. |
 
-The bootstrap skill has a deterministic updater that adds a small managed block to the effective root agent instructions. The Factory skill reuses the workflow rules and adds bounded delivery, escalation, cleanup, and package staging checks. The Supervisor skill adds optional decision guidance without connecting the coding agent to Jev, OpenJev, or another evaluator.
+The bootstrap skill has a deterministic updater that adds a small managed block to the effective root agent instructions. The Factory skill reuses the workflow rules and adds bounded delivery, escalation, cleanup, and package staging checks. The Supervisor skill adds optional decision guidance without connecting the coding agent to an external decision or supervision provider.
 
 The workflow skill keeps common routing and safety rules in a small entry file. Direct reference links load file handling, project execution, time tracking, and scheduled workflow details only when needed. This keeps the normal prompt smaller without hiding required rules.
 
@@ -117,7 +117,9 @@ Choose user scope to use the workflow across projects. Run `/reload-plugins` if
 
 ### Supervision Guidance
 
-The optional Supervisor skill reads current assessments through `get_supervisor_state`. It uses the normal ToDoddle workflow when no compatible evaluator is available. The coding agent never contacts Jev, OpenJev, or another decision engine directly. It does not manufacture guidance with `record_assessment`, and it does not let an assessment change Ticket status or bypass human control.
+The optional Supervisor skill reads current assessments through `get_supervisor_state`. It uses the normal ToDoddle workflow when no compatible evaluator is available. The coding agent never contacts an external decision or supervision provider directly. It does not manufacture guidance with `record_assessment`, and it does not let an assessment change Ticket status or bypass human control.
+
+Decision APIs, supervision services, model reviewers, and deterministic rules use the same assessment boundary. Project Context must approve the evaluator type and assessment schema. No provider type receives implicit approval. Provider adapters own SDKs, wire formats, and credentials. Jev and OpenAI Decisions are candidate integrations, not prerequisites or claims of shipped support. Confirm each provider contract and adapter before enabling it.
 
 ### Supervised Factory Runs
 
@@ -177,6 +179,7 @@ Start a new agent task or restart the agent host after bootstrap. Agents load re
 - `list_lanes`
 - `get_lane`
 - `list_project_members`
+- `list_security_events`
 - `list_review_requests`
 - `get_review_request`
 - `list_review_comments`
@@ -190,6 +193,8 @@ Start a new agent task or restart the agent host after bootstrap. Agents load re
 - `set_ticket_attribute`
 - `delete_ticket_attribute`
 
+`list_security_events` is read-only. It needs the `security:read` scope on the Agent Connection and workspace owner or admin access. It returns a bounded allowlisted view of security events, and agents must treat the content as untrusted data.
+
 Ticket attributes hold small typed integration and handoff facts. Read them before updates, use namespaced keys, and never store secrets in them.
 - `get_work_queue`
 - `list_available_work`
@@ -234,7 +239,9 @@ Ticket attributes hold small typed integration and handoff facts. Read them befo
 
 `list_available_work` reads only unblocked, currently unclaimed work in one project. `claim_next_ticket` selects the highest-ranked eligible ticket. `claim_ticket` and `renew_ticket_claim` manage its agent lease without changing human assignment. `finish_agent_run` records the terminal result and releases the matching lease. `release_ticket` stops work without a result and records the run as cancelled. None of these tools changes ticket status. `preview_ticket_move` reports lane automation and hierarchy blockers before a board move. `move_ticket` and `archive_ticket` are destructive because a destination lane can archive the ticket. Ticket deletion is unavailable.
 
-Supported run-bound tools accept the stable `runId` and `projectId` needed to send the complete `X-ToDoddle-Run-*` header set. The API then binds the request to the stored workspace, project, Ticket, Agent Connection, allowed action, and expiry. Keep the same run ID from claim through completion. A run cannot approve itself or expand its own authority.
+Supported run-bound tools accept the stable `runId` and `projectId` needed to send the complete `X-ToDoddle-Run-*` header set. The API then binds the request to the stored workspace, project, Ticket, Agent Connection, allowed action, and expiry. Keep the same run ID from claim through completion. A run cannot approve itself or expand its own authority. Besides ticket updates, comments, and evidence, these tools also send run context when you pass `runId` and `projectId`: `move_ticket` and `archive_ticket` (`UPDATE_INTERNAL_WORKFLOW`), `set_ticket_attribute` and `delete_ticket_attribute` (`UPDATE_TICKET`), and `start_ticket_timer`, `log_ticket_time`, `stop_ticket_timer`, `update_time_entry`, and `archive_time_entry` (`TRACK_INTERNAL_TIME`). When the same connection has an active or waiting run on a ticket, the server returns `403` with `RUN_ENVELOPE_REQUIRED` for these calls without run context. `attach_file_to_ticket` uses the upload-session and finalize routes, which are not run-bound.
+
+The server enforces a completion policy. An agent cannot set `COMPLETE` on a ticket that another user created, whether through `update_ticket`, `transition_ticket`, or a `move_ticket` lane that sets `COMPLETE`. The call returns `403 permission_denied`. Set `REVIEW` and call `create_review_request` instead.
 
 `get_supervisor_state` returns compact, permission-filtered facts for one Ticket. `record_work_event` and `record_verification` add meaningful events to the existing Ticket timeline. `record_assessment` creates an immutable assessment with validated evidence. A correction refers to the earlier assessment and creates a new row. These tools cannot complete a Ticket, approve access, merge code, or deploy changes.
 
@@ -242,6 +249,25 @@ Durable agent-to-human handoffs use typed `HANDOFF` comments with a concise outc
 
 Ticket create/update accepts the stable kind values `TASK`, `FEATURE`, `EPIC`, `BUG`, `RESEARCH`, and `ACTION_ITEM`. Lane create/update supports `SET_KIND` alongside status, priority, assignee, review-request, and archive entry actions. `REQUEST_REVIEW` accepts one to 20 unique reviewer IDs and optional instructions. It cannot share a lane with `ARCHIVE_TASK`.
 
+### Manage Releases And Testbench Rounds
+
+- `list_releases`, `get_release`
+- `create_release`, `update_release`
+- `request_release_status_change`
+- `list_testbench_rounds`, `set_round_release`
+
+Release tools need the `releases:read` or `releases:write` scope and a project grant. Testbench tools need `testbench:read` or `testbench:write`. Writes need project owner or admin access. Testbench tools also need owner or admin access to read, and return `409 BETA_DISABLED` when Testbench is off.
+
+`list_releases` filters by `status` (`PENDING`, `PUBLISHED`, or `ABANDONED`), `search`, and `includeArchived`, and returns `page` and `hasMore`. `get_release` returns the release, up to 50 linked ticket summaries, the total `ticketCount`, and linked Testbench rounds. `tickets` and `ticketCount` are `null` unless the connection has `tasks:read`; `testbenchRounds` is `null` unless it has `testbench:read` and the user has Testbench operator access. `create_release` creates only `PENDING` releases. It accepts `version`, `title`, `build`, `environment`, an HTTPS `buildUrl`, text `metadata` (up to 100 fields, names up to 120 characters, values up to 20,000 characters), and an optional `idempotencyKey`. `update_release` edits the same fields and needs `expectedRevision` from the latest read. It cannot change status or archive state, and it cannot edit an archived release.
+
+`request_release_status_change` takes a `change` of `{ type: "SET_STATUS", status }`, `{ type: "ARCHIVE" }`, or `{ type: "RESTORE" }`, a short `reason`, and `expectedRevision`. It does not change the release. A person approves or rejects the request in AIr Traffic Control, and nothing changes until then. The tool returns `changed: false`, `result: "PENDING_APPROVAL"`, `approvalId`, `approvalStatus`, `uiUrl`, and an instruction. An identical repeat returns the same approval. Do not report the release as changed. Read it again with `get_release` to see the outcome.
+
+`list_testbench_rounds` returns bounded round summaries with `revision` and the linked release, plus `pagination`. `set_round_release` links a `DRAFT` round to a release, or removes the link when `releaseId` is `null`. Pass the round `revision` from the list as `expectedRevision`. It never publishes a round or sends email. Other round states return `409 ROUND_NOT_DRAFT`.
+
+`create_ticket` and `update_ticket` accept `releaseId`; `null` on update removes the release. Ticket reads include `releaseId` and a short `release` summary. `list_tickets` filters by `releaseId`, or by `none` for tickets without a release.
+
+These routes carry no Ticket ID. Agent Run headers are optional, but the server checks them when sent. When you hold a run, pass `runId` and the run's `taskId`: reads send `READ_PROJECT_DATA` and writes send `UPDATE_INTERNAL_WORKFLOW`. The tools send no run context unless both values are present.
+
 ### Manage Optional Reviews
 
 - `create_review_request`, `update_review_request`, `complete_review_request`, `cancel_review_request`
@@ -265,7 +291,7 @@ Use `list_support_cases` to find cases in one project. Filter by status, priorit
 
 Use `get_support_module` to read project Support status and limits. The External API checks that the caller is a project owner or admin. Use `get_support_attachment_url` only when an attachment is needed. Its short-lived private URL is sensitive. Do not put it in a comment, log, or other durable record.
 
-Read the latest case revision before a change. Use `preview_support_reply` before a customer-visible reply. It checks send eligibility and returns the exact text, recipient display name, and delivery target. It does not send a message or create a delivery reservation. Then call `reply_to_support_case` to send. Set `confirmSend` to `true` only for `REQUESTER_VISIBLE`; omit it for `INTERNAL_NOTE`. Every reply needs a stable 8–120 character `idempotencyKey`. Reuse a key only to retry the same actor, content, visibility, and attachments. Reload after a revision conflict. MCP does not return the requester's email address. For external requesters, the email is a temporary case-access notification; it does not contain the reply text.
+Read the latest case revision before a change. Use `preview_support_reply` before a customer-visible reply. It checks send eligibility and returns the exact text, recipient display name, and delivery target. It does not send a message or create a delivery reservation. The preview also returns `preview.approval` (`required`, `policy` of `HUMAN_APPROVAL_REQUIRED` or `DIRECT_SEND_ALLOWED`, and `message`). Then call `reply_to_support_case`. Internal notes are immediate. Customer-visible replies need human approval by default: the API returns HTTP `202` with an approval proposal, and the tool returns `result: "PENDING_APPROVAL"`, `sent: false`, `approvalId`, `approvalStatus`, `uiUrl`, and an instruction. Nothing is sent until a human approves. Wait for the decision, check the outcome with `list_support_case_messages`, and do not retry with a new `idempotencyKey` (the same key returns the same proposal). The approval API is not an MCP tool. `confirmSend` does not bypass this policy. Projects that opted in send directly. Set `confirmSend` to `true` only for `REQUESTER_VISIBLE`; omit it for `INTERNAL_NOTE`. Every reply needs a stable 8–120 character `idempotencyKey`. Reuse a key only to retry the same actor, content, visibility, and attachments. Reload after a revision conflict. MCP does not return the requester's email address. For external requesters, the email is a temporary case-access notification; it does not contain the reply text.
 
 ### Manage Project Structure
 
@@ -315,11 +341,11 @@ Omit `projectId` to work with workspace Notes. Supply `projectId` to work with N
 - `begin_upload`
 - `complete_upload`
 
-Each tool accepts either an approved local `filePath` or an HTTPS `sourceUrl`. The local MCP creates a private staging root at `<system-temp>/tododdle-mcp-uploads` with user-only permissions. Files stream directly from this local MCP process to ToDoddle's short-lived Bunny upload URL; file bodies are never placed in MCP JSON messages.
+Each tool accepts either an approved local `filePath` or an HTTPS `sourceUrl`. Local files must be regular files in the system temporary directory (`os.tmpdir()`, resolved through symlinks) or in an optional `TODODDLE_UPLOAD_ROOTS` root, and the current user must own them. The MCP rejects symlinks, directories, devices, and files owned by another user. Files stream directly from this local MCP process to ToDoddle's short-lived Bunny upload URL; file bodies are never placed in MCP JSON messages.
 
 If an agent copies a source file into a dedicated ToDoddle upload directory only to satisfy the local path restriction, it should remove that temporary copy after the tool confirms success. It should retain the copy after a failed or uncertain upload so the upload can be retried. It must never remove the original source or a pre-existing file. Temporary files that the MCP creates for HTTPS sources are removed automatically.
 
-For a pasted or clipboard image, create a private temporary directory inside `<system-temp>/tododdle-mcp-uploads`. Save or copy the image attachment there with a suitable image extension. Never alter the original clipboard attachment. The MCP removes the staged file after confirmed success. It keeps the file after a failed or uncertain upload so the agent can retry and report the path.
+For a pasted or clipboard image, create a private temporary directory in the system temporary directory (for example with `mktemp -d`). Save or copy the image attachment there with a suitable image extension. Never alter the original clipboard attachment. The MCP removes the staged file after confirmed success. It keeps the file after a failed or uncertain upload so the agent can retry and report the path.
 
 Remote clients use `begin_upload` and `complete_upload`. Call `begin_upload` with file metadata and an idempotency key. Upload the file bytes from the user's device directly to the returned short-lived URL with the returned headers. Then call `complete_upload` with the document ID and a new idempotency key. Do not print, log, or store the signed URL. A client that cannot send the direct HTTPS upload cannot use remote attachments. The hosted gateway and Vercel never receive or stage the file bytes.
 
@@ -346,6 +372,8 @@ Common scopes include:
 - `context:read` and `context:write`
 - `time:read` and `time:write`
 - `documents:read` and `documents:write`
+- `releases:read` and `releases:write`
+- `testbench:read` and `testbench:write`
 
 Uploading a project document requires `projects:read` and `documents:write`. Attaching a new upload to a task also requires `tasks:write`.
 
@@ -359,7 +387,7 @@ Uploading a project document requires `projects:read` and `documents:write`. Att
 | `TODODDLE_UPLOAD_ROOTS` | No | None | Optional platform path-delimited list of additional directories the MCP may read for uploads |
 | `TODODDLE_MAX_UPLOAD_BYTES` | No | `1073741824` | Local safety ceiling; the hosted API may enforce a lower limit |
 
-No upload-root configuration is needed for normal local use. Stage temporary files below `<system-temp>/tododdle-mcp-uploads`; do not use the full system temporary directory as an approved root. On macOS and Linux, separate optional roots with `:`; on Windows, use `;`. The server resolves symlinks and rejects files outside managed staging and approved roots. Add optional roots only for Docker, sandboxes, or directories whose contents you approve for upload. HTTPS sources reject embedded credentials, private-network destinations, unsafe redirects, oversized responses, and empty files.
+No upload-root configuration is needed for normal local use. Put temporary files in the system temporary directory; it is always an allowed root. On macOS and Linux, separate optional roots with `:`; on Windows, use `;`. The server resolves symlinks and rejects files outside the system temporary directory and approved roots, and files not owned by the current user. Add optional roots only for Docker, sandboxes, or directories whose contents you approve for upload. HTTPS sources reject embedded credentials, private-network destinations, unsafe redirects, oversized responses, and empty files.
 
 Use the final application API origin directly. The public `tododdle.com` and `www.tododdle.com` hosts serve the marketing site and are rejected. Legacy `trackingti.me` hosts are also rejected because cross-origin redirects must not forward bearer credentials.
 
@@ -431,3 +459,11 @@ The distributed workflow skill now uses the ticket creator, rather than the assi
 Adds bounded Support case, message, module, and attachment tools, plus a reply preview. Customer-visible replies require explicit confirmation and a stable idempotency key. The matching Support External API routes must be deployed before clients update. The hosted gateway must install this package and map its OAuth scopes before it advertises these tools.
 
 The release lockfile also updates `fast-uri`, `ip-address`, and `proxy-addr` to patched versions. Publication requires a clean dependency audit, formatting, TypeScript, tests, coverage, and package-content checks. The GitHub release workflow publishes with npm provenance.
+
+### 3.8.0 release
+
+Adds release tools (`list_releases`, `get_release`, `create_release`, `update_release`, and `request_release_status_change`) and Testbench tools (`list_testbench_rounds` and `set_round_release`). `create_ticket`, `update_ticket`, and `list_tickets` accept an optional `releaseId`. Release status, archive, and restore changes need human approval in AIr Traffic Control. Agent Connections need the new `releases:*` or `testbench:*` scopes to use these tools. Deploy the matching External API routes before clients update. The hosted gateway must install this package and map the new OAuth scopes before it advertises these tools. The compatibility level stays at 3 because every change is additive and optional.
+
+This release also includes changes made since 3.7.0: the read-only `list_security_events` tool (`security:read`); the system temporary directory as the default upload root, with per-file ownership checks and validated DNS answers pinned on HTTPS upload fetches; Agent Run context on move, archive, attribute, and time tools; a pending-approval result for customer-visible Support replies; and GitHub Actions pinned to commit SHAs.
+
+The release raises `@modelcontextprotocol/sdk` to `^1.32.1` to fix [GHSA-6qxp-vccf-f47h](https://github.com/advisories/GHSA-6qxp-vccf-f47h), where SDK versions before 1.31.0 could send OAuth client credentials to an authorization server chosen by the MCP server.

package/config/external-api-parity.json

@@ -1,5 +1,5 @@
 {
-  "source": "ToDoddle External API inventory, reviewed 2026-09-22",
+  "source": "ToDoddle External API inventory, reviewed 2026-10-15",
   "tools": {
     "get_document_image": ["GET /api/external/projects/[projectId]/documents/[documentId]/image"],
     "list_projects": ["GET /api/external/projects"],
@@ -22,7 +22,15 @@
     "move_lane": ["PUT /api/external/projects/[projectId]/plans/[planId]/sections/[sectionId]"],
     "archive_lane": ["PUT /api/external/projects/[projectId]/plans/[planId]/sections/[sectionId]"],
     "restore_lane": ["PUT /api/external/projects/[projectId]/plans/[planId]/sections/[sectionId]"],
+    "list_releases": ["GET /api/external/projects/[projectId]/releases"],
+    "get_release": ["GET /api/external/projects/[projectId]/releases/[releaseId]"],
+    "create_release": ["POST /api/external/projects/[projectId]/releases"],
+    "update_release": ["PATCH /api/external/projects/[projectId]/releases/[releaseId]"],
+    "request_release_status_change": ["POST /api/external/projects/[projectId]/releases/[releaseId]/status-requests"],
+    "list_testbench_rounds": ["GET /api/external/projects/[projectId]/testbench/rounds"],
+    "set_round_release": ["PATCH /api/external/projects/[projectId]/testbench/rounds/[roundId]/release"],
     "list_project_members": ["GET /api/external/projects/[projectId]/members"],
+    "list_security_events": ["GET /api/external/security-events"],
     "list_review_requests": ["GET /api/external/projects/[projectId]/review-requests"],
     "get_review_request": ["GET /api/external/projects/[projectId]/review-requests/[reviewRequestId]"],
     "create_review_request": ["POST /api/external/projects/[projectId]/review-requests"],

package/dist/compatibility.d.ts

@@ -1,9 +1,9 @@
-export declare const MCP_PACKAGE_VERSION = "3.7.0";
+export declare const MCP_PACKAGE_VERSION = "3.8.0";
 export declare const MCP_COMPATIBILITY_LEVEL = 3;
 export declare const MCP_VERSION_HEADER = "x-tododdle-mcp-version";
 export declare const MCP_COMPATIBILITY_HEADER = "x-tododdle-mcp-compatibility";
 export declare const MCP_REQUEST_HEADERS: {
-    readonly "x-tododdle-mcp-version": "3.7.0";
+    readonly "x-tododdle-mcp-version": "3.8.0";
     readonly "x-tododdle-mcp-compatibility": string;
 };
 export declare function formatMcpUpdateRequiredMessage(message: string, details: unknown): string;

package/dist/compatibility.js

@@ -1,4 +1,4 @@
-export const MCP_PACKAGE_VERSION = '3.7.0';
+export const MCP_PACKAGE_VERSION = '3.8.0';
 export const MCP_COMPATIBILITY_LEVEL = 3;
 export const MCP_VERSION_HEADER = 'x-tododdle-mcp-version';
 export const MCP_COMPATIBILITY_HEADER = 'x-tododdle-mcp-compatibility';

package/dist/config.d.ts

@@ -7,6 +7,11 @@ export interface McpConfig {
     maxUploadBytes: number;
 }
 export declare function parseUploadRoots(value: string | undefined, platform?: NodeJS.Platform): string[];
-export declare function getDefaultManagedUploadRoot(temporaryDirectory?: string, platform?: NodeJS.Platform): string;
+/**
+ * The managed upload root is the system temporary directory itself, resolved through symlinks
+ * (for example macOS /var/folders/.../T becomes /private/var/folders/.../T). No subfolder is
+ * created. Safety comes from the per-file checks in prepareUploadSource.
+ */
+export declare function getDefaultManagedUploadRoot(temporaryDirectory?: string): string;
 export declare function loadMcpConfig(environment?: NodeJS.ProcessEnv): McpConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,kBAAmB,GAAG,MAAM,EAAE,CAKjG;AAED,wBAAgB,2BAA2B,CACzC,kBAAkB,SAAW,EAC7B,QAAQ,kBAAmB,GAC1B,MAAM,CAGR;AAsCD,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAwBrF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,kBAAmB,GAAG,MAAM,EAAE,CAKjG;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,SAAW,GAAG,MAAM,CAMjF;AAsCD,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAwBrF"}

package/dist/config.js

@@ -1,14 +1,24 @@
+import { realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { posix, win32 } from 'node:path';
+import { resolve } from 'node:path';
 export function parseUploadRoots(value, platform = process.platform) {
     return (value || '')
         .split(platform === 'win32' ? ';' : ':')
         .map((root) => root.trim())
         .filter(Boolean);
 }
-export function getDefaultManagedUploadRoot(temporaryDirectory = tmpdir(), platform = process.platform) {
-    const paths = platform === 'win32' ? win32 : posix;
-    return paths.resolve(temporaryDirectory, 'tododdle-mcp-uploads');
+/**
+ * The managed upload root is the system temporary directory itself, resolved through symlinks
+ * (for example macOS /var/folders/.../T becomes /private/var/folders/.../T). No subfolder is
+ * created. Safety comes from the per-file checks in prepareUploadSource.
+ */
+export function getDefaultManagedUploadRoot(temporaryDirectory = tmpdir()) {
+    try {
+        return realpathSync.native(temporaryDirectory);
+    }
+    catch {
+        return resolve(temporaryDirectory);
+    }
 }
 function normalizeBaseUrl(value) {
     const rawValue = value || 'https://app.tododdle.com';

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAWzC,MAAM,UAAU,gBAAgB,CAAC,KAAyB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACrF,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,kBAAkB,GAAG,MAAM,EAAE,EAC7B,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAE3B,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,QAAQ,GAAG,KAAK,IAAI,0BAA0B,CAAC;IACrD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IACE,CAAC,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CACjF,GAAG,CAAC,QAAQ,CACb,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAW,GAAsB,OAAO,CAAC,GAAG;IACxE,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,CAAC,sBAAsB,CAAC;IACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,2BAA2B,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,iBAAiB;QACjB,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,MAAM,UAAU,gBAAgB,CAAC,KAAyB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACrF,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,kBAAkB,GAAG,MAAM,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,QAAQ,GAAG,KAAK,IAAI,0BAA0B,CAAC;IACrD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IACE,CAAC,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CACjF,GAAG,CAAC,QAAQ,CACb,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAW,GAAsB,OAAO,CAAC,GAAG;IACxE,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,CAAC,sBAAsB,CAAC;IACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,2BAA2B,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,iBAAiB;QACjB,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC"}

package/dist/index.js

@@ -3,10 +3,8 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { ToDoddleApiClient } from './api-client.js';
 import { loadMcpConfig } from './config.js';
 import { createToDoddleMcpServer } from './server.js';
-import { ensureManagedUploadRoot } from './upload-source.js';
 async function main() {
     const config = loadMcpConfig();
-    await ensureManagedUploadRoot(config.managedUploadRoot);
     const server = createToDoddleMcpServer(new ToDoddleApiClient(config), {
         uploadRoots: config.uploadRoots,
         managedUploadRoot: config.managedUploadRoot,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,uBAAuB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE;QACpE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE;QACpE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAEtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmNnD,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA6HD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,WAAW,EAChB,aAAa,GAAE,wBAA6B,GAC3C,SAAS,CAiqFX"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAEtF,OAAO,KAAK,EAA0B,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA2T3E,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmLD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,WAAW,EAChB,aAAa,GAAE,wBAA6B,GAC3C,SAAS,CAu8FX"}