vantage-peers-mcp 2.3.4 → 2.3.5

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## v2.3.5 — 2026-05-28
+
+**Critical hotfix** — v2.3.3 (PR #539) shipped the backend filters `createdBy` + `updatedSince` and the Zod schema exports but did NOT wire those params into the 4 list MCP tool args blocks. Pi pull-cycle quickstart `list_tasks createdBy="pi" status="review" fields="lite"` was silently dropping `createdBy` at the MCP boundary and returning all visible tasks. Auto-clamp safeguard (Day 83) also could not trigger because Zod `.default(50)` / `.default(20)` on `limit` overrode the absent-value signal before it reached the backend.
+
+Fixes:
+- `mcp-server/src/tools.ts` : 4 list tools now expose `createdBy` (`list_tasks` + `list_tasks_by_mission` only — `list_missions` + `list_briefing_notes` do not accept it backend-side) and `updatedSince` (all 4).
+- Removed `.default(50)` (3 tools) and `.default(20)` (1 tool) on `limit` so absent value reaches the backend, enabling the v2.3.3 auto-clamp safeguard.
+
+Tests : 8 new boundary-forwarding cases (`src/__tests__/list-queries-v2.3.5-wire-createdby-updatedsince.test.ts`) — verify MCP layer actually forwards new params to `convex.query` instead of dropping them. 0 regression on existing suites.
+
+Detection : Vantage-Bridge architecture review Sigma scope Day 84 — direct `grep`/`sed` inspection of `tools.ts` confirmed the gap. Backend already correct since v2.3.3 (`convex/tasks.ts:354-357`).
+
+Fix-pattern (Day 84 capitalize) : when adding a new param across backend + MCP wrapper, the test suite MUST cover not only schema validation but also the tool-handler→convex.query forwarding boundary. Schema-only tests passed cleanly in v2.3.3 while the actual feature was broken in prod.
+
+VP task : `k177tsvdxzase5sjy2qm9fdvp187kbwr`. Predecessor v2.3.3 PR #539 (`k1796s5j6jfkvkx0tn5n926ftd87jx9p`).
+
 ## v2.3.4 — 2026-05-28
 
 **Security fix** — DCR (Dynamic Client Registration) self-registration now defaults to tenant-scope only. Master scope requires explicit admin authorization (`ADMIN_DCR_TOKEN` / `BEARER_SECRET_MASTER` env var). Closes beta blocker for Marie/Iris RH onboarding identified in VP Cloud audit Day 84.
@@ -13,6 +29,28 @@ Tests: 5 new Convex security tests (`convex/oauth-dcr-security.test.ts`) + 5 new
 
 VP task: k17218rvqyncs1v6rwj3qdzfsn87jj4n. Beta unblock chain: DCR fix → 5 quick wins onboarding (seed-profiles + marie-iris-rh client + README VP Cloud + runbook + email).
 
+## v2.3.3 — 2026-05-28
+
+**Follow-up to v2.3.2 (Day 84 scope élargi)** — Extend list queries with `createdBy` + `updatedSince` filters + auto-clamp safeguard.
+
+Backend (Convex) :
+- `tasks.list` + `tasks.listByMission` : + `createdBy` (filter by task creator) + `updatedSince` (Unix ms window) + auto-clamp limit=30 when `fields="full"` and no explicit limit
+- `missions.list` : + `updatedSince` + auto-clamp (30)
+- `briefingNotes.list` : + `updatedSince` + auto-clamp (15 when fields=full)
+
+MCP wrapper :
+- 4 list tools forward the new params
+- New export `updatedSinceSchema` (positive integer ms)
+- `limit` `.default()` removed on the 4 list tools so absent limit flows to backend → enables auto-clamp
+
+Tests : 15 new MCP schema cases (`src/__tests__/list-queries-v2.3.3-createdby-updatedsince.test.ts`) + 6 new Convex round-trip cases.
+
+Pi pull cycle unblocked : `list_tasks createdBy="pi" status="review" fields="lite"` returns only Pi-dispatched tasks recently moved to review, payload 5-10× smaller.
+
+Cap fleet : 0 overflow tolérance future (auto-clamp).
+
+VP task: `k1796s5j6jfkvkx0tn5n926ftd87jx9p`. Successor of `k17e09ng1tf217n93z9m4tr0mx87hfe0` (v2.3.2 PR #537).
+
 ## v2.3.2 — 2026-05-28
 
 **Hotfix** — Expose `fields="lite"` + `status` array/aliases in MCP tool schemas (Day 82 sprint gap).

package/dist/src/tools.d.ts

@@ -96,6 +96,7 @@ export declare const fieldsSchema: z.ZodEnum<{
     lite: "lite";
     full: "full";
 }>;
+export declare const updatedSinceSchema: z.ZodNumber;
 export interface ParsedConvexError {
     code: string;
     message: string;

package/dist/src/tools.js

@@ -162,6 +162,14 @@ export const fieldsSchema = z
     .describe('Field projection — "lite" returns compact fields only ' +
     '(typical 5-10× smaller payload for large list scans), ' +
     '"full" (default) returns the full document.');
+// v2.3.3 — Unix timestamp ms filter for "updated since".
+// Pass `Date.now() - 24*60*60*1000` for "last 24h" pattern.
+export const updatedSinceSchema = z
+    .number()
+    .int()
+    .positive()
+    .describe("Unix timestamp (ms) — return only rows whose updatedAt >= this value. " +
+    "Typical usage: Date.now() - 24*60*60*1000 for last-24h window.");
 const mandateStatusSchema = z
     .enum(["requested", "accepted", "in_progress", "delivered", "settled"])
     .describe("Mandate lifecycle status");
@@ -1141,20 +1149,25 @@ export function registerTools(server, convex, oauthCtx) {
             .min(1)
             .max(200)
             .optional()
-            .default(50)
-            .describe("Maximum number of tasks to return (default 50)"),
+            .describe("Maximum number of tasks to return. Default 50 with fields=lite, auto-clamped to 30 when fields=full and no explicit limit (overflow protection)."),
         fields: fieldsSchema
             .optional()
             .describe('Field projection ("lite"|"full")'),
-    }, async ({ assignedTo, assignedToInstance, status, project, limit, fields, }) => {
+        createdBy: assigneeSchema
+            .optional()
+            .describe("Filter by task creator (e.g. 'pi' to find Pi-dispatched tasks)"),
+        updatedSince: updatedSinceSchema.optional(),
+    }, async ({ assignedTo, assignedToInstance, status, project, limit, fields, createdBy, updatedSince, }) => {
         try {
             const tasks = await convex.query("tasks:list", {
                 assignedTo,
                 assignedToInstance,
                 status,
                 project,
-                limit: limit ?? 50,
+                limit,
                 fields,
+                createdBy,
+                updatedSince,
             });
             return {
                 content: [
@@ -1470,18 +1483,23 @@ export function registerTools(server, convex, oauthCtx) {
             .min(1)
             .max(200)
             .optional()
-            .default(50)
-            .describe("Maximum number of tasks to return (default 50)"),
+            .describe("Maximum number of tasks to return. Default 50 with fields=lite, auto-clamped to 30 when fields=full and no explicit limit."),
         fields: fieldsSchema
             .optional()
             .describe('Field projection ("lite"|"full")'),
-    }, async ({ missionId, status, limit, fields }) => {
+        createdBy: assigneeSchema
+            .optional()
+            .describe("Filter by task creator"),
+        updatedSince: updatedSinceSchema.optional(),
+    }, async ({ missionId, status, limit, fields, createdBy, updatedSince }) => {
         try {
             const tasks = await convex.query("tasks:listByMission", {
                 missionId: missionId,
                 status,
-                limit: limit ?? 50,
+                limit,
                 fields,
+                createdBy,
+                updatedSince,
             });
             return {
                 content: [
@@ -1565,19 +1583,20 @@ export function registerTools(server, convex, oauthCtx) {
             .min(1)
             .max(200)
             .optional()
-            .default(50)
-            .describe("Maximum number of missions to return (default 50)"),
+            .describe("Maximum number of missions to return. Default 50 with fields=lite, auto-clamped to 30 when fields=full and no explicit limit."),
         fields: fieldsSchema
             .optional()
             .describe('Field projection ("lite"|"full")'),
-    }, async ({ project, pilot, status, limit, fields }) => {
+        updatedSince: updatedSinceSchema.optional(),
+    }, async ({ project, pilot, status, limit, fields, updatedSince }) => {
         try {
             const missions = await convex.query("missions:list", {
                 project,
                 pilot,
                 status,
-                limit: limit ?? 50,
+                limit,
                 fields,
+                updatedSince,
             });
             return {
                 content: [
@@ -1899,17 +1918,18 @@ export function registerTools(server, convex, oauthCtx) {
             .min(1)
             .max(100)
             .optional()
-            .default(20)
-            .describe("Maximum notes to return (default 20)"),
+            .describe("Maximum notes to return. Default 20 with fields=lite, auto-clamped to 15 when fields=full and no explicit limit."),
         fields: fieldsSchema
             .optional()
             .describe('Field projection ("lite"|"full")'),
-    }, async ({ topic, limit, fields }) => {
+        updatedSince: updatedSinceSchema.optional(),
+    }, async ({ topic, limit, fields, updatedSince }) => {
         try {
             const notes = await convex.query("briefingNotes:list", {
                 topic,
-                limit: limit ?? 20,
+                limit,
                 fields,
+                updatedSince,
             });
             return {
                 content: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vantage-peers-mcp",
-  "version": "2.3.4",
+  "version": "2.3.5",
   "description": "MCP server for VantagePeers — shared memory, messaging, and task coordination for AI agent teams",
   "type": "module",
   "main": "./dist/server.js",