Changelog

No behavior change — ask_findable stays document-only and never searches the web. The product Ask UI gained a "Web access" permission (default on) that lets the chat model search the web when useful, but the MCP ask_findable tool explicitly keeps web access off so its answers and citations stay scoped to your documents.

No behavior change — internal only. The SharePoint AppSubscriptions table these tools read is now owned by apps/integrations after the standalone findable-integrations repo was migrated into the monorepo. Same table, same byBuildingId GSI, same responses.

Private folders are now enforced for the documents these tools return. Previously both only checked that you could read the building, so documents inside private folders could be surfaced to building members without access — get_red_flag_item exposed their filenames + AI confidence/reasoning, and list_sharepoint_documents exposed their Findable + SharePoint ids. Now documents in a private folder are only included for users explicitly granted access to them; documents in normal folders are unaffected.

Private folders are now enforced when fetching a document by ID. Previously these tools only checked that you could read the building, so a document inside a private folder could be retrieved (file + metadata) by any building member who had its documentId. Now a document in a private folder is only returned to users explicitly granted access to it — matching search_documents and the folder browser. Documents in normal (non-private) folders are unaffected.

Documents paused before processing (e.g. when a building hits its ingestion volume cap) are no longer returned in folder listings, matching the dashboard — such documents are surfaced only in the dedicated Unprocessed pane, not in the normal file tree. Folders and non-paused documents are unaffected.

Now also returns previewUrl — a rendered page-1 thumbnail when one exists. The document-viewer widget renders PDFs inline (pdf.js to a canvas, since the host sandbox blocks <object>/<embed>), using previewUrl as the placeholder and fallback; downloadUrl still returns the real file with its original filename.

Each document now includes a preview thumbnail (previewUrl), like search_documents already does, so the folder browser shows rich previews instead of icon-only tiles.

A document’s download URL now serves the file inline and with its real filename (previously an opaque token), so PDFs preview directly in the document-viewer widget and saved files keep their original name. Response shape is unchanged — still { document fields…, downloadUrl }.

Internal system buildings (the hidden __system_workflows__ and __system_portfolio_documents__ records Findable uses behind the scenes) are no longer surfaced anywhere: they are excluded from list_buildings, from find_resources name searches, from a portfolio’s building roster, and from get_customer’s building_count and top_buildings. This matches the dashboard, which has always hidden them.

Each attached document now includes its filename (was documentId only), so a caller (or the compliance-card UI) can list the evidence documents for an item readably and open them without a separate get_document lookup just to learn the name.

MCP Apps (SEP-1865): these tools now render as interactive UI widgets in hosts that support them (document viewer, search-results grid, building/portfolio cards, compliance card) — text hosts are unaffected and get the same content as before. New/changed fields: get_building, list_buildings, get_portfolio and list_portfolios buildings now include an imageUrl (building photo); list_buildings also adds city, type and constructionYear; search_documents echoes the query and applied filters; get_red_flag adds buildingName and themes[].items (each theme’s leaf items with status + documentCount) so a UI can drill down without a follow-up call. Document download/preview links are served through a same-origin, 7-day, signed asset proxy (was 1h) so they keep working when a chat is reopened later.

Fixed (third time's the charm): red flag counts now match the dashboard exactly. Both prior same-day attempts (#6103, #6108) used MCP-local logic that diverged from the dashboard on regenerated buildings (duplicate nameId rows), GB buildings (different parent structure), and on the weighted percentage (the dashboard's headline uses partial credit for in_review/missing, not a strict done/total ratio). The aggregation primitive — template join via nameId → nest via nameParentId → walk leaves → weighted score — now lives in @findable/shared/utils/red-flag-aggregation and is imported by both the dashboard hooks and the MCP tools. Single source of truth. percentComplete is now the weighted dashboard score, not done/total.

Fixed: name matches buried past position 200 in the raw load order (e.g. asking about a customer whose row falls outside the first 200 visible to the caller) are now returned instead of dropped by the candidate cap. The truncated flag now means "more than 200 candidates scored as plausible matches", not "we capped before scoring."

Fixed: red flag counts now match the dashboard report view. Previously parent categories were counted alongside their leaves, inflating overall.total and per-theme totals (e.g. 282 vs the dashboard's 210 on the same building). Now only leaves are counted, mirroring the dashboard. percentComplete also excludes notRelevant from the denominator to match the dashboard's per-theme score. The list_red_flag_items.topLevelOnly param was removed (parents are no longer in the list); list response no longer carries hasSubcategories for the same reason.

New: browse a building's folder tree. Given a building_id (and optionally a folder_id), returns the direct sub-folders and paginated documents at that level — the same view the dashboard tree browser shows. Pair with find_resources to resolve a building, then walk the tree without relying on search.

Fixed: attached documents now appear. The underlying service returns empty documents[] arrays — joined the per-building docs endpoint client-side (like the dashboard). get_red_flag gains a top-level documentCount; list_red_flag_items.documentCount is no longer 0 everywhere; get_red_flag_item.documents[] now includes the LLM confidence + reasoning.

New: red flag tools. get_red_flag returns the per-theme rollup (Fire, Electrical, Drawings, …) + overall counts + generation status; list_red_flag_items filters items by theme / status; get_red_flag_item surfaces a single item with attached documents AND the LLM confidence + reasoning per auto-classified doc; generate_red_flag (write) kicks off a fresh ML classification run. NO buildings get full automation; GB buildings get the structure without ML. requires building#read for reads, building#administrate for generate.

BREAKING: input field naming standardised to camelCase. Renamed customer_id → customerId and customer_name → customerName on every tool that accepted them. Snake-case aliases are NOT supported — agents that previously sent {customer_id: ...} will get a Zod validation error and must update to {customerId: ...}. No behaviour change beyond the rename.

Fixed: list_users now accepts a Findable customerId (UUID), not the WorkOS organizationId. The WorkOS org id is resolved internally from the customer record. Previously the tool was unusable — the FGA check wanted a customer id and the WorkOS call wanted an org id, with no single input value satisfying both. Pass the `id` from get_customer / find_resources.

Added customerId scope. Pass customerId to list customer-level integrations (FAMAC, Dalux, Plania) without picking a building first. buildingId remains the path for SharePoint detail.

Removed the redundant citedDocuments array from the response. Use the citations map instead — each entry has document_id, document_filename, building_id, cited_text, and page_number, which is what citedDocuments was supposed to expose but never populated.

Reworded the not-configured notes to avoid leaking internal env var names and cross-repo references. No behavior change.

Fixed: category, floor, fileType, and asBuilt filters now actually filter results. They were silently no-ops before (the search-service layer dropped them) — agents got back unfiltered results regardless of filter values. Filters are now encoded into the query string using the same Lucene-style field syntax the dashboard uses.

Added serverVersion, recentChanges (this list), and fallbackGuidance fields to whoami so agents can detect schema-cache drift and route to ask_findable before declaring something unsupported.

Added filters: category (MOMD / NS 3451 code), floor, fileType (extension), and asBuilt (boolean toggle for Project Phase). Response now includes category + floor per hit.

Surfaces full admin-facing metadata: constructionYear, m2, type, city, postalCode, municipality, cadastralUnitNumber, owner + ownerCompanyName + manager, description, operationalInstructions, locationList, externalId + famacId + daluxBuildingId + planiaBuildingId, sortingProgress + labelingProgress, deficiencyReport block, isFavorite + isDeactivated + isArchived.

Added isFavorite, containerBuildingId (hidden portfolio_documents system building), dataRegion, createdAt, updatedAt.

Added customerType, companyType, organizationId, mfaPolicy + mfaEnabledAt, isFamacCustomer, dsyncEnabled, disabledFeatures, createdAt, updatedAt. Commercial / billing fields remain gated.

Added category filter (task | routine | deviation) so agents can split routines from ad-hoc tasks. Response summaries now include the category field.

Org-admin enumeration fix: enumeration calls now use OpenFGA batchCheck (dashboard pattern) instead of the denormalised grant table, so customer admins / group-mediated access correctly cascade to child resources.

Super-admin path: super_admins now refused on unscoped list_* with scope_required; find_resources uses findByNameContains for unscoped name search; whoami surfaces { isSuperAdmin: true }.