tododdle-mcp 3.7.0 → 3.9.0

package/.claude-plugin/marketplace.json

@@ -5,17 +5,17 @@
     "url": "https://tododdle.com"
   },
   "description": "Agent workflow plugins for ToDoddle.",
-  "version": "3.7.0",
+  "version": "3.9.0",
   "plugins": [
     {
       "name": "tododdle",
       "displayName": "ToDoddle",
       "description": "Connect repositories and use ToDoddle for project context and ticket execution.",
-      "version": "3.7.0",
+      "version": "3.9.0",
       "source": {
         "source": "npm",
         "package": "tododdle-mcp",
-        "version": "3.7.0"
+        "version": "3.9.0"
       },
       "category": "productivity",
       "tags": [

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tododdle",
   "displayName": "ToDoddle",
-  "version": "3.7.0",
+  "version": "3.9.0",
   "description": "Connect repositories and run disciplined agent workflows in ToDoddle.",
   "author": {
     "name": "ToDoddle",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tododdle",
-  "version": "3.7.0",
+  "version": "3.9.0",
   "description": "Disciplined agent workflows for projects managed in ToDoddle.",
   "author": {
     "name": "ToDoddle",

package/README.md

@@ -86,7 +86,7 @@ The MCP server provides capabilities. The package distributes four optional skil
 | `tododdle-factory` | Run one explicit, supervised autonomous delivery attempt with an Agent Run and stable evidence. |
 | `tododdle-supervisor` | Use current ToDoddle supervision assessments at meaningful workflow decisions when a compatible backend is available. |
 
-The bootstrap skill has a deterministic updater that adds a small managed block to the effective root agent instructions. The Factory skill reuses the workflow rules and adds bounded delivery, escalation, cleanup, and package staging checks. The Supervisor skill adds optional decision guidance without connecting the coding agent to Jev, OpenJev, or another evaluator.
+The bootstrap skill has a deterministic updater that adds a small managed block to the effective root agent instructions. The Factory skill reuses the workflow rules and adds bounded delivery, escalation, cleanup, and package staging checks. The Supervisor skill adds optional decision guidance without connecting the coding agent to an external decision or supervision provider.
 
 The workflow skill keeps common routing and safety rules in a small entry file. Direct reference links load file handling, project execution, time tracking, and scheduled workflow details only when needed. This keeps the normal prompt smaller without hiding required rules.
 
@@ -117,7 +117,9 @@ Choose user scope to use the workflow across projects. Run `/reload-plugins` if
 
 ### Supervision Guidance
 
-The optional Supervisor skill reads current assessments through `get_supervisor_state`. It uses the normal ToDoddle workflow when no compatible evaluator is available. The coding agent never contacts Jev, OpenJev, or another decision engine directly. It does not manufacture guidance with `record_assessment`, and it does not let an assessment change Ticket status or bypass human control.
+The optional Supervisor skill reads current assessments through `get_supervisor_state`. It uses the normal ToDoddle workflow when no compatible evaluator is available. The coding agent never contacts an external decision or supervision provider directly. It does not manufacture guidance with `record_assessment`, and it does not let an assessment change Ticket status or bypass human control.
+
+Decision APIs, supervision services, model reviewers, and deterministic rules use the same assessment boundary. Project Context must approve the evaluator type and assessment schema. No provider type receives implicit approval. Provider adapters own SDKs, wire formats, and credentials. Jev and OpenAI Decisions are candidate integrations, not prerequisites or claims of shipped support. Confirm each provider contract and adapter before enabling it.
 
 ### Supervised Factory Runs
 
@@ -177,6 +179,7 @@ Start a new agent task or restart the agent host after bootstrap. Agents load re
 - `list_lanes`
 - `get_lane`
 - `list_project_members`
+- `list_security_events`
 - `list_review_requests`
 - `get_review_request`
 - `list_review_comments`
@@ -190,6 +193,8 @@ Start a new agent task or restart the agent host after bootstrap. Agents load re
 - `set_ticket_attribute`
 - `delete_ticket_attribute`
 
+`list_security_events` is read-only. It needs the `security:read` scope on the Agent Connection and workspace owner or admin access. It returns a bounded allowlisted view of security events, and agents must treat the content as untrusted data.
+
 Ticket attributes hold small typed integration and handoff facts. Read them before updates, use namespaced keys, and never store secrets in them.
 - `get_work_queue`
 - `list_available_work`
@@ -218,6 +223,7 @@ Ticket attributes hold small typed integration and handoff facts. Read them befo
 - `claim_next_ticket`
 - `renew_ticket_claim`
 - `finish_agent_run`
+- `log_completed_work`
 - `record_work_event`
 - `record_assessment`
 - `record_verification`
@@ -232,9 +238,11 @@ Ticket attributes hold small typed integration and handoff facts. Read them befo
 - `acknowledge_agent_reply`
 - `archive_ticket`
 
-`list_available_work` reads only unblocked, currently unclaimed work in one project. `claim_next_ticket` selects the highest-ranked eligible ticket. `claim_ticket` and `renew_ticket_claim` manage its agent lease without changing human assignment. `finish_agent_run` records the terminal result and releases the matching lease. `release_ticket` stops work without a result and records the run as cancelled. None of these tools changes ticket status. `preview_ticket_move` reports lane automation and hierarchy blockers before a board move. `move_ticket` and `archive_ticket` are destructive because a destination lane can archive the ticket. Ticket deletion is unavailable.
+`list_available_work` reads only unblocked, currently unclaimed work in one project. `claim_next_ticket` selects the highest-ranked eligible ticket. `claim_ticket` and `renew_ticket_claim` manage its agent lease without changing human assignment. `finish_agent_run` records the terminal result and releases the matching lease. `release_ticket` stops work without a result and records the run as cancelled. None of these tools changes ticket status. `log_completed_work` is the exception for ad-hoc work done in conversation: in one call it finds or creates the ticket, claims it, sets `COMPLETE` (or `REVIEW` when another user created the ticket, with a warning), and records a finished run with the outcome and evidence. It needs `tasks:write` and the matching ToDoddle API route. `preview_ticket_move` reports lane automation and hierarchy blockers before a board move. `move_ticket` and `archive_ticket` are destructive because a destination lane can archive the ticket. Ticket deletion is unavailable.
+
+Supported run-bound tools accept the stable `runId` and `projectId` needed to send the complete `X-ToDoddle-Run-*` header set. The API then binds the request to the stored workspace, project, Ticket, Agent Connection, allowed action, and expiry. Keep the same run ID from claim through completion. A run cannot approve itself or expand its own authority. Besides ticket updates, comments, and evidence, these tools also send run context when you pass `runId` and `projectId`: `move_ticket` and `archive_ticket` (`UPDATE_INTERNAL_WORKFLOW`), `set_ticket_attribute` and `delete_ticket_attribute` (`UPDATE_TICKET`), and `start_ticket_timer`, `log_ticket_time`, `stop_ticket_timer`, `update_time_entry`, and `archive_time_entry` (`TRACK_INTERNAL_TIME`). When the same connection has an active or waiting run on a ticket, the server returns `403` with `RUN_ENVELOPE_REQUIRED` for these calls without run context. `attach_file_to_ticket` uses the upload-session and finalize routes, which are not run-bound.
 
-Supported run-bound tools accept the stable `runId` and `projectId` needed to send the complete `X-ToDoddle-Run-*` header set. The API then binds the request to the stored workspace, project, Ticket, Agent Connection, allowed action, and expiry. Keep the same run ID from claim through completion. A run cannot approve itself or expand its own authority.
+The server enforces a completion policy. An agent cannot set `COMPLETE` on a ticket that another user created, whether through `update_ticket`, `transition_ticket`, or a `move_ticket` lane that sets `COMPLETE`. The call returns `403 permission_denied`. Set `REVIEW` and call `create_review_request` instead.
 
 `get_supervisor_state` returns compact, permission-filtered facts for one Ticket. `record_work_event` and `record_verification` add meaningful events to the existing Ticket timeline. `record_assessment` creates an immutable assessment with validated evidence. A correction refers to the earlier assessment and creates a new row. These tools cannot complete a Ticket, approve access, merge code, or deploy changes.
 
@@ -242,6 +250,25 @@ Durable agent-to-human handoffs use typed `HANDOFF` comments with a concise outc
 
 Ticket create/update accepts the stable kind values `TASK`, `FEATURE`, `EPIC`, `BUG`, `RESEARCH`, and `ACTION_ITEM`. Lane create/update supports `SET_KIND` alongside status, priority, assignee, review-request, and archive entry actions. `REQUEST_REVIEW` accepts one to 20 unique reviewer IDs and optional instructions. It cannot share a lane with `ARCHIVE_TASK`.
 
+### Manage Releases And Testbench Rounds
+
+- `list_releases`, `get_release`
+- `create_release`, `update_release`
+- `request_release_status_change`
+- `list_testbench_rounds`, `set_round_release`
+
+Release tools need the `releases:read` or `releases:write` scope and a project grant. Testbench tools need `testbench:read` or `testbench:write`. Writes need project owner or admin access. Testbench tools also need owner or admin access to read, and return `409 BETA_DISABLED` when Testbench is off.
+
+`list_releases` filters by `status` (`PENDING`, `PUBLISHED`, or `ABANDONED`), `search`, and `includeArchived`, and returns `page` and `hasMore`. `get_release` returns the release, up to 50 linked ticket summaries, the total `ticketCount`, and linked Testbench rounds. `tickets` and `ticketCount` are `null` unless the connection has `tasks:read`; `testbenchRounds` is `null` unless it has `testbench:read` and the user has Testbench operator access. `create_release` creates only `PENDING` releases. It accepts `version`, `title`, `build`, `environment`, an HTTPS `buildUrl`, text `metadata` (up to 100 fields, names up to 120 characters, values up to 20,000 characters), and an optional `idempotencyKey`. `update_release` edits the same fields and needs `expectedRevision` from the latest read. It cannot change status or archive state, and it cannot edit an archived release.
+
+`request_release_status_change` takes a `change` of `{ type: "SET_STATUS", status }`, `{ type: "ARCHIVE" }`, or `{ type: "RESTORE" }`, a short `reason`, and `expectedRevision`. It does not change the release. A person approves or rejects the request in AIr Traffic Control, and nothing changes until then. The tool returns `changed: false`, `result: "PENDING_APPROVAL"`, `approvalId`, `approvalStatus`, `uiUrl`, and an instruction. An identical repeat returns the same approval. Do not report the release as changed. Read it again with `get_release` to see the outcome.
+
+`list_testbench_rounds` returns bounded round summaries with `revision` and the linked release, plus `pagination`. `set_round_release` links a `DRAFT` round to a release, or removes the link when `releaseId` is `null`. Pass the round `revision` from the list as `expectedRevision`. It never publishes a round or sends email. Other round states return `409 ROUND_NOT_DRAFT`.
+
+`create_ticket` and `update_ticket` accept `releaseId`; `null` on update removes the release. Ticket reads include `releaseId` and a short `release` summary. `list_tickets` filters by `releaseId`, or by `none` for tickets without a release.
+
+These routes carry no Ticket ID. Agent Run headers are optional, but the server checks them when sent. When you hold a run, pass `runId` and the run's `taskId`: reads send `READ_PROJECT_DATA` and writes send `UPDATE_INTERNAL_WORKFLOW`. The tools send no run context unless both values are present.
+
 ### Manage Optional Reviews
 
 - `create_review_request`, `update_review_request`, `complete_review_request`, `cancel_review_request`
@@ -265,7 +292,7 @@ Use `list_support_cases` to find cases in one project. Filter by status, priorit
 
 Use `get_support_module` to read project Support status and limits. The External API checks that the caller is a project owner or admin. Use `get_support_attachment_url` only when an attachment is needed. Its short-lived private URL is sensitive. Do not put it in a comment, log, or other durable record.
 
-Read the latest case revision before a change. Use `preview_support_reply` before a customer-visible reply. It checks send eligibility and returns the exact text, recipient display name, and delivery target. It does not send a message or create a delivery reservation. Then call `reply_to_support_case` to send. Set `confirmSend` to `true` only for `REQUESTER_VISIBLE`; omit it for `INTERNAL_NOTE`. Every reply needs a stable 8–120 character `idempotencyKey`. Reuse a key only to retry the same actor, content, visibility, and attachments. Reload after a revision conflict. MCP does not return the requester's email address. For external requesters, the email is a temporary case-access notification; it does not contain the reply text.
+Read the latest case revision before a change. Use `preview_support_reply` before a customer-visible reply. It checks send eligibility and returns the exact text, recipient display name, and delivery target. It does not send a message or create a delivery reservation. The preview also returns `preview.approval` (`required`, `policy` of `HUMAN_APPROVAL_REQUIRED` or `DIRECT_SEND_ALLOWED`, and `message`). Then call `reply_to_support_case`. Internal notes are immediate. Customer-visible replies need human approval by default: the API returns HTTP `202` with an approval proposal, and the tool returns `result: "PENDING_APPROVAL"`, `sent: false`, `approvalId`, `approvalStatus`, `uiUrl`, and an instruction. Nothing is sent until a human approves. Wait for the decision, check the outcome with `list_support_case_messages`, and do not retry with a new `idempotencyKey` (the same key returns the same proposal). The approval API is not an MCP tool. `confirmSend` does not bypass this policy. Projects that opted in send directly. Set `confirmSend` to `true` only for `REQUESTER_VISIBLE`; omit it for `INTERNAL_NOTE`. Every reply needs a stable 8–120 character `idempotencyKey`. Reuse a key only to retry the same actor, content, visibility, and attachments. Reload after a revision conflict. MCP does not return the requester's email address. For external requesters, the email is a temporary case-access notification; it does not contain the reply text.
 
 ### Manage Project Structure
 
@@ -315,11 +342,11 @@ Omit `projectId` to work with workspace Notes. Supply `projectId` to work with N
 - `begin_upload`
 - `complete_upload`
 
-Each tool accepts either an approved local `filePath` or an HTTPS `sourceUrl`. The local MCP creates a private staging root at `<system-temp>/tododdle-mcp-uploads` with user-only permissions. Files stream directly from this local MCP process to ToDoddle's short-lived Bunny upload URL; file bodies are never placed in MCP JSON messages.
+Each tool accepts either an approved local `filePath` or an HTTPS `sourceUrl`. A missing file, or a file outside the system temporary directory, returns a message that names that directory. ToDoddle stores SVG, HTML, and other active content as `application/octet-stream` so it can never run in a browser; when the stored type differs from the requested one, the upload result includes a `notice` that says so. Image uploads (PNG, JPEG, GIF, WebP, and SVG) also return `embedMarkdown`, such as `![map.png](/api/documents/<id>/embed)`, to paste into a Note or Context; an SVG embeds through its PNG rendering at `/thumbnail`. The image shows only to people who can open that document. Local files must be regular files in the system temporary directory (`os.tmpdir()`, resolved through symlinks), and the current user must own them. The MCP rejects symlinks, directories, devices, and files owned by another user. Files stream directly from this local MCP process to ToDoddle's short-lived Bunny upload URL; file bodies are never placed in MCP JSON messages.
 
 If an agent copies a source file into a dedicated ToDoddle upload directory only to satisfy the local path restriction, it should remove that temporary copy after the tool confirms success. It should retain the copy after a failed or uncertain upload so the upload can be retried. It must never remove the original source or a pre-existing file. Temporary files that the MCP creates for HTTPS sources are removed automatically.
 
-For a pasted or clipboard image, create a private temporary directory inside `<system-temp>/tododdle-mcp-uploads`. Save or copy the image attachment there with a suitable image extension. Never alter the original clipboard attachment. The MCP removes the staged file after confirmed success. It keeps the file after a failed or uncertain upload so the agent can retry and report the path.
+For a pasted or clipboard image, create a private temporary directory in the system temporary directory (for example with `mktemp -d`). Save or copy the image attachment there with a suitable image extension. Never alter the original clipboard attachment. The MCP removes the staged file after confirmed success. It keeps the file after a failed or uncertain upload so the agent can retry and report the path.
 
 Remote clients use `begin_upload` and `complete_upload`. Call `begin_upload` with file metadata and an idempotency key. Upload the file bytes from the user's device directly to the returned short-lived URL with the returned headers. Then call `complete_upload` with the document ID and a new idempotency key. Do not print, log, or store the signed URL. A client that cannot send the direct HTTPS upload cannot use remote attachments. The hosted gateway and Vercel never receive or stage the file bytes.
 
@@ -346,6 +373,8 @@ Common scopes include:
 - `context:read` and `context:write`
 - `time:read` and `time:write`
 - `documents:read` and `documents:write`
+- `releases:read` and `releases:write`
+- `testbench:read` and `testbench:write`
 
 Uploading a project document requires `projects:read` and `documents:write`. Attaching a new upload to a task also requires `tasks:write`.
 
@@ -356,10 +385,9 @@ Uploading a project document requires `projects:read` and `documents:write`. Att
 | `TODODDLE_CLIENT_ID` | Yes | None | Agent Connection identifier |
 | `TODODDLE_CLIENT_SECRET` | Yes | None | Agent Connection secret |
 | `TODODDLE_BASE_URL` | No | `https://app.tododdle.com` | Application API origin; HTTPS is required except for loopback development |
-| `TODODDLE_UPLOAD_ROOTS` | No | None | Optional platform path-delimited list of additional directories the MCP may read for uploads |
 | `TODODDLE_MAX_UPLOAD_BYTES` | No | `1073741824` | Local safety ceiling; the hosted API may enforce a lower limit |
 
-No upload-root configuration is needed for normal local use. Stage temporary files below `<system-temp>/tododdle-mcp-uploads`; do not use the full system temporary directory as an approved root. On macOS and Linux, separate optional roots with `:`; on Windows, use `;`. The server resolves symlinks and rejects files outside managed staging and approved roots. Add optional roots only for Docker, sandboxes, or directories whose contents you approve for upload. HTTPS sources reject embedded credentials, private-network destinations, unsafe redirects, oversized responses, and empty files.
+Local uploads come only from the system temporary directory; no upload configuration is needed. The server resolves symlinks and rejects files outside that directory and files not owned by the current user. `TODODDLE_UPLOAD_ROOTS` is no longer used; if it is still set, the server writes a notice to stderr and ignores it. HTTPS sources reject embedded credentials, private-network destinations, unsafe redirects, oversized responses, and empty files.
 
 Use the final application API origin directly. The public `tododdle.com` and `www.tododdle.com` hosts serve the marketing site and are rejected. Legacy `trackingti.me` hosts are also rejected because cross-origin redirects must not forward bearer credentials.
 
@@ -431,3 +459,26 @@ The distributed workflow skill now uses the ticket creator, rather than the assi
 Adds bounded Support case, message, module, and attachment tools, plus a reply preview. Customer-visible replies require explicit confirmation and a stable idempotency key. The matching Support External API routes must be deployed before clients update. The hosted gateway must install this package and map its OAuth scopes before it advertises these tools.
 
 The release lockfile also updates `fast-uri`, `ip-address`, and `proxy-addr` to patched versions. Publication requires a clean dependency audit, formatting, TypeScript, tests, coverage, and package-content checks. The GitHub release workflow publishes with npm provenance.
+
+### 3.8.0 release
+
+Adds release tools (`list_releases`, `get_release`, `create_release`, `update_release`, and `request_release_status_change`) and Testbench tools (`list_testbench_rounds` and `set_round_release`). `create_ticket`, `update_ticket`, and `list_tickets` accept an optional `releaseId`. Release status, archive, and restore changes need human approval in AIr Traffic Control. Agent Connections need the new `releases:*` or `testbench:*` scopes to use these tools. Deploy the matching External API routes before clients update. The hosted gateway must install this package and map the new OAuth scopes before it advertises these tools. The compatibility level stays at 3 because every change is additive and optional.
+
+This release also includes changes made since 3.7.0: the read-only `list_security_events` tool (`security:read`); the system temporary directory as the default upload root, with per-file ownership checks and validated DNS answers pinned on HTTPS upload fetches; Agent Run context on move, archive, attribute, and time tools; a pending-approval result for customer-visible Support replies; and GitHub Actions pinned to commit SHAs.
+
+The release raises `@modelcontextprotocol/sdk` to `^1.32.1` to fix [GHSA-6qxp-vccf-f47h](https://github.com/advisories/GHSA-6qxp-vccf-f47h), where SDK versions before 1.31.0 could send OAuth client credentials to an authorization server chosen by the MCP server.
+
+### 3.9.0 release
+
+Deploy the matching ToDoddle API first: `log_completed_work` needs the new completed-work route, and `contentEdits` and slim artifact responses need the updated artifact route (an older server makes `update_project_artifact` with `contentEdits` fail clearly rather than silently). The compatibility level stays at 3 because every change is additive. The hosted gateway must install this package and map `log_completed_work` to `tasks:write` before it advertises the tool.
+
+- Tool results now carry absolute web links (`uiUrl`, `href`) on the configured app origin, so clients no longer guess `www.tododdle.com`, the marketing site.
+
+- API errors keep their details. A tool error is now JSON with `error`, `status`, `message`, and, for `scope_required`, `missingScopes`, `requiredScopes`, and a `hint` that says where to enable the scope. Before, agents saw only "Insufficient permissions".
+- New `log_completed_work` records finished ad-hoc work in one call (ticket, claim, status, and a finished Agent Run with evidence). It needs the matching ToDoddle API route.
+- `TODODDLE_UPLOAD_ROOTS` is removed: local uploads come only from the system temporary directory, and a leftover setting is ignored with a notice on stderr.
+- Local uploads explain a missing file or a file outside the temporary directory instead of a raw `ENOENT`, `.svg` files are sent as `image/svg+xml`, and the result includes a `notice` when the server stores a different type.
+- `search_project` describes the new `relevance` and `matchedTerms` result fields.
+- Image uploads and `complete_upload` return `embedMarkdown` for Notes and Context. `create_note` and `update_note` describe the embed syntax.
+- The server instructions say where project knowledge lives (brief, decision artifacts, Notes, ticket comments, repository docs) and tell agents to refresh the brief when `get_project_context` reports `briefFreshness.stale`.
+- `update_project_artifact` accepts `contentEdits` (`replace_section`, `append_section`, `find_replace`) and `baseVersion`, so agents change one section of a long brief without resending it. It returns a slim summary unless `verbose` is true. An older server that ignores `contentEdits` returns an error instead of a silent success.

package/config/external-api-parity.json

@@ -1,5 +1,5 @@
 {
-  "source": "ToDoddle External API inventory, reviewed 2026-09-22",
+  "source": "ToDoddle External API inventory, reviewed 2026-10-15",
   "tools": {
     "get_document_image": ["GET /api/external/projects/[projectId]/documents/[documentId]/image"],
     "list_projects": ["GET /api/external/projects"],
@@ -22,7 +22,15 @@
     "move_lane": ["PUT /api/external/projects/[projectId]/plans/[planId]/sections/[sectionId]"],
     "archive_lane": ["PUT /api/external/projects/[projectId]/plans/[planId]/sections/[sectionId]"],
     "restore_lane": ["PUT /api/external/projects/[projectId]/plans/[planId]/sections/[sectionId]"],
+    "list_releases": ["GET /api/external/projects/[projectId]/releases"],
+    "get_release": ["GET /api/external/projects/[projectId]/releases/[releaseId]"],
+    "create_release": ["POST /api/external/projects/[projectId]/releases"],
+    "update_release": ["PATCH /api/external/projects/[projectId]/releases/[releaseId]"],
+    "request_release_status_change": ["POST /api/external/projects/[projectId]/releases/[releaseId]/status-requests"],
+    "list_testbench_rounds": ["GET /api/external/projects/[projectId]/testbench/rounds"],
+    "set_round_release": ["PATCH /api/external/projects/[projectId]/testbench/rounds/[roundId]/release"],
     "list_project_members": ["GET /api/external/projects/[projectId]/members"],
+    "list_security_events": ["GET /api/external/security-events"],
     "list_review_requests": ["GET /api/external/projects/[projectId]/review-requests"],
     "get_review_request": ["GET /api/external/projects/[projectId]/review-requests/[reviewRequestId]"],
     "create_review_request": ["POST /api/external/projects/[projectId]/review-requests"],
@@ -80,6 +88,7 @@
     "list_agent_runs": ["GET /api/external/tasks/[taskId]/agent-runs"],
     "get_agent_run": ["GET /api/external/tasks/[taskId]/agent-runs/[runId]"],
     "finish_agent_run": ["POST /api/external/tasks/[taskId]/agent-runs/[runId]"],
+    "log_completed_work": ["POST /api/external/projects/[projectId]/completed-work"],
     "get_supervisor_state": ["GET /api/external/tasks/[taskId]/supervisor-state"],
     "record_work_event": ["POST /api/external/tasks/[taskId]/work-events"],
     "record_assessment": ["POST /api/external/tasks/[taskId]/assessments"],

package/dist/api-client.d.ts

@@ -5,11 +5,18 @@ export interface AgentRunRequestContext {
     taskId: string;
     action: 'READ_PROJECT_DATA' | 'UPDATE_TICKET' | 'ADD_INTERNAL_COMMENT' | 'UPDATE_INTERNAL_WORKFLOW' | 'RECORD_EVIDENCE' | 'UPLOAD_INTERNAL_ATTACHMENT' | 'TRACK_INTERNAL_TIME';
 }
+/** Scope names a denied request needed, when the API reports them. */
+export interface ToDoddleScopeDenial {
+    requiredScopes?: string[];
+    missingScopes?: string[];
+    grantedScopes?: string[];
+}
 export declare class ToDoddleApiError extends Error {
     readonly status: number;
     readonly code: string;
     readonly details?: unknown;
-    constructor(status: number, code: string, message: string, details?: unknown);
+    readonly scopes?: ToDoddleScopeDenial | undefined;
+    constructor(status: number, code: string, message: string, details?: unknown, scopes?: ToDoddleScopeDenial | undefined);
 }
 export interface ToDoddleApi {
     get(path: string, query?: Record<string, string | number | boolean | undefined>, runContext?: AgentRunRequestContext): Promise<Record<string, unknown>>;

package/dist/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAS7C,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EACF,mBAAmB,GACnB,eAAe,GACf,sBAAsB,GACtB,0BAA0B,GAC1B,iBAAiB,GACjB,4BAA4B,GAC5B,qBAAqB,CAAC;CAC3B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO;IAJ5B,YACW,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,OAAO,CAAC,EAAE,OAAO,EAI3B;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CACD,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,EAC7D,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,GAAG,CACD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,UAAU,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAIvC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,cAAc,CAAK;IAE3B,YAA6B,MAAM,EAAE,SAAS,EAAI;YAEpC,cAAc;YA6Bd,OAAO;YA+CP,WAAW;IAazB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,OAAO;IAkBf,GAAG,CACD,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,EAC7D,UAAU,CAAC,EAAE,sBAAsB,oCAGpC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAE7F;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAEnE;IAED,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAErE;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAEtE;IAEK,UAAU,CACd,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAUf;CACF"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAS7C,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EACF,mBAAmB,GACnB,eAAe,GACf,sBAAsB,GACtB,0BAA0B,GAC1B,iBAAiB,GACjB,4BAA4B,GAC5B,qBAAqB,CAAC;CAC3B;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB;IALvC,YACW,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,mBAAmB,YAAA,EAItC;CACF;AAyBD,MAAM,WAAW,WAAW;IAC1B,GAAG,CACD,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,EAC7D,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,cAAc,CAAC,EAAE,MAAM,EACvB,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,GAAG,CACD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,UAAU,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAIvC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,cAAc,CAAK;IAE3B,YAA6B,MAAM,EAAE,SAAS,EAAI;YAEpC,cAAc;YA6Bd,OAAO;YA+CP,WAAW;IAazB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,OAAO;IAmBf,GAAG,CACD,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,EAC7D,UAAU,CAAC,EAAE,sBAAsB,oCAGpC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAE7F;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAEnE;IAED,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAErE;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,sBAAsB,oCAEtE;IAEK,UAAU,CACd,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAUf;CACF"}

package/dist/api-client.js

@@ -4,14 +4,36 @@ export class ToDoddleApiError extends Error {
     status;
     code;
     details;
-    constructor(status, code, message, details) {
+    scopes;
+    constructor(status, code, message, details, scopes) {
         super(message);
         this.status = status;
         this.code = code;
         this.details = details;
+        this.scopes = scopes;
         this.name = 'ToDoddleApiError';
     }
 }
+function stringList(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === 'string')
+        ? value
+        : undefined;
+}
+function scopeDenial(payload) {
+    // Some routes report the scopes inside `details` instead of at the top level.
+    const details = payload.details && typeof payload.details === 'object'
+        ? payload.details
+        : {};
+    const requiredScopes = stringList(payload.required_scopes) ?? stringList(details.required_scopes);
+    const grantedScopes = stringList(payload.granted_scopes);
+    const missingScopes = stringList(payload.missing_scopes) ??
+        (requiredScopes && grantedScopes
+            ? requiredScopes.filter((scope) => !grantedScopes.includes(scope))
+            : undefined);
+    if (!requiredScopes && !missingScopes)
+        return undefined;
+    return { requiredScopes, missingScopes, grantedScopes };
+}
 export class ToDoddleApiClient {
     config;
     accessToken = null;
@@ -112,7 +134,7 @@ export class ToDoddleApiClient {
                 : `ToDoddle request failed (${status})`;
         return new ToDoddleApiError(status, code, code === 'MCP_UPDATE_REQUIRED'
             ? formatMcpUpdateRequiredMessage(message, payload.details)
-            : message, payload.details);
+            : message, payload.details, scopeDenial(payload));
     }
     get(path, query, runContext) {
         return this.request('GET', path, undefined, query, undefined, true, runContext);

package/dist/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAqBzF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B,MAAM;IACN,IAAI;IAEJ,OAAO;IAJlB,YACW,MAAc,EACd,IAAY,EACrB,OAAe,EACN,OAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;sBALN,MAAM;oBACN,IAAI;uBAEJ,OAAO;QAGhB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAqCD,MAAM,OAAO,iBAAiB;IAIC,MAAM;IAH3B,WAAW,GAAkB,IAAI,CAAC;IAClC,cAAc,GAAG,CAAC,CAAC;IAE3B,YAA6B,MAAiB;sBAAjB,MAAM;IAAc,CAAC;IAE1C,KAAK,CAAC,cAAc;QAC1B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAE3F,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;SACxC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,2BAA2B,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,GAAG,mBAAmB;aACvB;YACD,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,OAAmC,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU;YAC1C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QAC3D,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,KAA6D,EAC7D,cAAuB,EACvB,KAAK,GAAG,IAAI,EACZ,UAAmC;QAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACnD,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,mBAAmB;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,UAAU;oBACZ,CAAC,CAAC;wBACE,mBAAmB,EAAE,UAAU,CAAC,KAAK;wBACrC,2BAA2B,EAAE,UAAU,CAAC,SAAS;wBACjD,0BAA0B,EAAE,UAAU,CAAC,MAAM;wBAC7C,uBAAuB,EAAE,UAAU,CAAC,MAAM;qBAC3C;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAkB;QAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAC3C,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzB,CAAC;IAEO,gBAAgB,CAAC,QAAkB;QACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,IAAI,gBAAgB,CACxB,QAAQ,CAAC,MAAM,EACf,qBAAqB,EACrB,+BAA+B,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,0CAA0C,CACjH,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,OAAgC;QAC9D,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACjC,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;gBAC7C,CAAC,CAAC,OAAO,CAAC,iBAAiB;gBAC3B,CAAC,CAAC,4BAA4B,MAAM,GAAG,CAAC;QAC9C,OAAO,IAAI,gBAAgB,CACzB,MAAM,EACN,IAAI,EACJ,IAAI,KAAK,qBAAqB;YAC5B,CAAC,CAAC,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;YAC1D,CAAC,CAAC,OAAO,EACX,OAAO,CAAC,OAAO,CAChB,CAAC;IACJ,CAAC;IAED,GAAG,CACD,IAAY,EACZ,KAA6D,EAC7D,UAAmC;QAEnC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,cAAuB,EAAE,UAAmC;QAC5F,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACvF,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmC;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAW,EACX,OAA+B,EAC/B,QAAgB,EAChB,QAAgB;QAEhB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC3D,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAU;YACzC,MAAM,EAAE,MAAM;SACqB,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AA4BzF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B,MAAM;IACN,IAAI;IAEJ,OAAO;IACP,MAAM;IALjB,YACW,MAAc,EACd,IAAY,EACrB,OAAe,EACN,OAAiB,EACjB,MAA4B;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;sBANN,MAAM;oBACN,IAAI;uBAEJ,OAAO;sBACP,MAAM;QAGf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC5E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC;IACnD,8EAA8E;IAC9E,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACpD,CAAC,CAAE,OAAO,CAAC,OAAmC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GACjB,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC;QAClC,CAAC,cAAc,IAAI,aAAa;YAC9B,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClE,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC1D,CAAC;AAqCD,MAAM,OAAO,iBAAiB;IAIC,MAAM;IAH3B,WAAW,GAAkB,IAAI,CAAC;IAClC,cAAc,GAAG,CAAC,CAAC;IAE3B,YAA6B,MAAiB;sBAAjB,MAAM;IAAc,CAAC;IAE1C,KAAK,CAAC,cAAc;QAC1B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAE3F,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;SACxC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,2BAA2B,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,GAAG,mBAAmB;aACvB;YACD,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE/D,MAAM,KAAK,GAAG,OAAmC,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,UAAU;YAC1C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QAC3D,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,KAA6D,EAC7D,cAAuB,EACvB,KAAK,GAAG,IAAI,EACZ,UAAmC;QAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACnD,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,GAAG,mBAAmB;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,UAAU;oBACZ,CAAC,CAAC;wBACE,mBAAmB,EAAE,UAAU,CAAC,KAAK;wBACrC,2BAA2B,EAAE,UAAU,CAAC,SAAS;wBACjD,0BAA0B,EAAE,UAAU,CAAC,MAAM;wBAC7C,uBAAuB,EAAE,UAAU,CAAC,MAAM;qBAC3C;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAkB;QAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAC3C,CAAC,CAAE,OAAmC;YACtC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzB,CAAC;IAEO,gBAAgB,CAAC,QAAkB;QACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,IAAI,gBAAgB,CACxB,QAAQ,CAAC,MAAM,EACf,qBAAqB,EACrB,+BAA+B,WAAW,CAAC,CAAC,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,0CAA0C,CACjH,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,MAAc,EAAE,OAAgC;QAC9D,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACjC,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;gBAC7C,CAAC,CAAC,OAAO,CAAC,iBAAiB;gBAC3B,CAAC,CAAC,4BAA4B,MAAM,GAAG,CAAC;QAC9C,OAAO,IAAI,gBAAgB,CACzB,MAAM,EACN,IAAI,EACJ,IAAI,KAAK,qBAAqB;YAC5B,CAAC,CAAC,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;YAC1D,CAAC,CAAC,OAAO,EACX,OAAO,CAAC,OAAO,EACf,WAAW,CAAC,OAAO,CAAC,CACrB,CAAC;IACJ,CAAC;IAED,GAAG,CACD,IAAY,EACZ,KAA6D,EAC7D,UAAmC;QAEnC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,cAAuB,EAAE,UAAmC;QAC5F,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACvF,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,IAAa,EAAE,UAAmC;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAW,EACX,OAA+B,EAC/B,QAAgB,EAChB,QAAgB;QAEhB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;YAC3D,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAU;YACzC,MAAM,EAAE,MAAM;SACqB,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF"}

package/dist/compatibility.d.ts

@@ -1,9 +1,9 @@
-export declare const MCP_PACKAGE_VERSION = "3.7.0";
+export declare const MCP_PACKAGE_VERSION = "3.9.0";
 export declare const MCP_COMPATIBILITY_LEVEL = 3;
 export declare const MCP_VERSION_HEADER = "x-tododdle-mcp-version";
 export declare const MCP_COMPATIBILITY_HEADER = "x-tododdle-mcp-compatibility";
 export declare const MCP_REQUEST_HEADERS: {
-    readonly "x-tododdle-mcp-version": "3.7.0";
+    readonly "x-tododdle-mcp-version": "3.9.0";
     readonly "x-tododdle-mcp-compatibility": string;
 };
 export declare function formatMcpUpdateRequiredMessage(message: string, details: unknown): string;

package/dist/compatibility.js

@@ -1,4 +1,4 @@
-export const MCP_PACKAGE_VERSION = '3.7.0';
+export const MCP_PACKAGE_VERSION = '3.9.0';
 export const MCP_COMPATIBILITY_LEVEL = 3;
 export const MCP_VERSION_HEADER = 'x-tododdle-mcp-version';
 export const MCP_COMPATIBILITY_HEADER = 'x-tododdle-mcp-compatibility';

package/dist/config.d.ts

@@ -2,11 +2,14 @@ export interface McpConfig {
     baseUrl: string;
     clientId: string;
     clientSecret: string;
-    uploadRoots: string[];
     managedUploadRoot: string;
     maxUploadBytes: number;
 }
-export declare function parseUploadRoots(value: string | undefined, platform?: NodeJS.Platform): string[];
-export declare function getDefaultManagedUploadRoot(temporaryDirectory?: string, platform?: NodeJS.Platform): string;
+/**
+ * The managed upload root is the system temporary directory itself, resolved through symlinks
+ * (for example macOS /var/folders/.../T becomes /private/var/folders/.../T). No subfolder is
+ * created. Safety comes from the per-file checks in prepareUploadSource.
+ */
+export declare function getDefaultManagedUploadRoot(temporaryDirectory?: string): string;
 export declare function loadMcpConfig(environment?: NodeJS.ProcessEnv): McpConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,kBAAmB,GAAG,MAAM,EAAE,CAKjG;AAED,wBAAgB,2BAA2B,CACzC,kBAAkB,SAAW,EAC7B,QAAQ,kBAAmB,GAC1B,MAAM,CAGR;AAsCD,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAwBrF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,kBAAkB,SAAW,GAAG,MAAM,CAMjF;AAsCD,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CA6BrF"}

package/dist/config.js

@@ -1,14 +1,18 @@
+import { realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { posix, win32 } from 'node:path';
-export function parseUploadRoots(value, platform = process.platform) {
-    return (value || '')
-        .split(platform === 'win32' ? ';' : ':')
-        .map((root) => root.trim())
-        .filter(Boolean);
-}
-export function getDefaultManagedUploadRoot(temporaryDirectory = tmpdir(), platform = process.platform) {
-    const paths = platform === 'win32' ? win32 : posix;
-    return paths.resolve(temporaryDirectory, 'tododdle-mcp-uploads');
+import { resolve } from 'node:path';
+/**
+ * The managed upload root is the system temporary directory itself, resolved through symlinks
+ * (for example macOS /var/folders/.../T becomes /private/var/folders/.../T). No subfolder is
+ * created. Safety comes from the per-file checks in prepareUploadSource.
+ */
+export function getDefaultManagedUploadRoot(temporaryDirectory = tmpdir()) {
+    try {
+        return realpathSync.native(temporaryDirectory);
+    }
+    catch {
+        return resolve(temporaryDirectory);
+    }
 }
 function normalizeBaseUrl(value) {
     const rawValue = value || 'https://app.tododdle.com';
@@ -39,7 +43,6 @@ export function loadMcpConfig(environment = process.env) {
     const baseUrl = normalizeBaseUrl(environment.TODODDLE_BASE_URL);
     const clientId = environment.TODODDLE_CLIENT_ID;
     const clientSecret = environment.TODODDLE_CLIENT_SECRET;
-    const uploadRoots = parseUploadRoots(environment.TODODDLE_UPLOAD_ROOTS);
     const managedUploadRoot = getDefaultManagedUploadRoot();
     const configuredMax = Number(environment.TODODDLE_MAX_UPLOAD_BYTES || 1024 * 1024 * 1024);
     if (!clientId || !clientSecret) {
@@ -48,11 +51,14 @@ export function loadMcpConfig(environment = process.env) {
     if (!Number.isSafeInteger(configuredMax) || configuredMax <= 0) {
         throw new Error('TODODDLE_MAX_UPLOAD_BYTES must be a positive integer');
     }
+    if (environment.TODODDLE_UPLOAD_ROOTS) {
+        // stderr is safe for a stdio MCP server; stdout carries the protocol.
+        console.error('TODODDLE_UPLOAD_ROOTS is no longer used and can be removed. Local uploads come from the system temporary directory.');
+    }
     return {
         baseUrl,
         clientId,
         clientSecret,
-        uploadRoots,
         managedUploadRoot,
         maxUploadBytes: configuredMax,
     };

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAWzC,MAAM,UAAU,gBAAgB,CAAC,KAAyB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACrF,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,kBAAkB,GAAG,MAAM,EAAE,EAC7B,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAE3B,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,QAAQ,GAAG,KAAK,IAAI,0BAA0B,CAAC;IACrD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IACE,CAAC,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CACjF,GAAG,CAAC,QAAQ,CACb,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAW,GAAsB,OAAO,CAAC,GAAG;IACxE,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,CAAC,sBAAsB,CAAC;IACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,2BAA2B,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,iBAAiB;QACjB,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,kBAAkB,GAAG,MAAM,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,QAAQ,GAAG,KAAK,IAAI,0BAA0B,CAAC;IACrD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IACE,CAAC,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CACjF,GAAG,CAAC,QAAQ,CACb,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAW,GAAsB,OAAO,CAAC,GAAG;IACxE,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,CAAC,sBAAsB,CAAC;IACxD,MAAM,iBAAiB,GAAG,2BAA2B,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,yBAAyB,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAE1F,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;QACtC,sEAAsE;QACtE,OAAO,CAAC,KAAK,CACX,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,iBAAiB;QACjB,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC"}

package/dist/index.js

@@ -3,13 +3,11 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { ToDoddleApiClient } from './api-client.js';
 import { loadMcpConfig } from './config.js';
 import { createToDoddleMcpServer } from './server.js';
-import { ensureManagedUploadRoot } from './upload-source.js';
 async function main() {
     const config = loadMcpConfig();
-    await ensureManagedUploadRoot(config.managedUploadRoot);
     const server = createToDoddleMcpServer(new ToDoddleApiClient(config), {
-        uploadRoots: config.uploadRoots,
         managedUploadRoot: config.managedUploadRoot,
+        appOrigin: config.baseUrl,
         maxUploadBytes: config.maxUploadBytes,
     });
     await server.connect(new StdioServerTransport());

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,uBAAuB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE;QACpE,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE;QACpE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/server.d.ts

@@ -1,8 +1,27 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { ToDoddleApi } from './api-client.js';
+import { ToDoddleApiError, type ToDoddleApi } from './api-client.js';
+/**
+ * Turns a ToDoddle API failure into a tool error the agent can act on. The SDK
+ * default keeps only the message, which dropped the scope an owner must grant.
+ */
+export declare function apiErrorResult(error: ToDoddleApiError): {
+    isError: boolean;
+    content: {
+        type: 'text';
+        text: string;
+    }[];
+};
+/**
+ * The API returns web links as paths such as /dashboard/project/x. Left
+ * relative, a client guesses the host and often picks www.tododdle.com, which
+ * is the marketing site. Turn them into absolute links on the app origin.
+ * In-app embed paths (/api/documents/...) are left alone.
+ */
+export declare function absolutizeLinks(value: unknown, appOrigin: string): unknown;
 export interface ToDoddleMcpServerOptions {
-    uploadRoots?: string[];
     managedUploadRoot?: string;
+    /** Web app origin, such as https://app.tododdle.com, for absolute links in results. */
+    appOrigin?: string;
     maxUploadBytes?: number;
 }
 export declare function createToDoddleMcpServer(api: ToDoddleApi, serverOptions?: ToDoddleMcpServerOptions): McpServer;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAEtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmNnD,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA6HD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,WAAW,EAChB,aAAa,GAAE,wBAA6B,GAC3C,SAAS,CAiqFX"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAoB,MAAM,yCAAyC,CAAC;AAEtF,OAAO,EAAE,gBAAgB,EAA+B,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA2OlG;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB;;;cAiBV,MAAM;;;EACjD;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAc1E;AA2HD,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAgND,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,WAAW,EAChB,aAAa,GAAE,wBAA6B,GAC3C,SAAS,CA4iGX"}