fix: reject invalid Follow Up Boss task field projections

[cursor]

Sentry

• Issue: https://theperrygroup.sentry.io/issues/7710420986/
• Short ID: FOLLOWUPBOSS-MCP-1F
• Environment: production
• Release: followupboss-mcp@585d14ee1900157ac51c524edb25299ed7dab9f7

Root cause

followupboss_list_my_overdue_tasks and followupboss_list_my_tasks_due_today advertised person and dueDateTime as valid fields projections. Local validation accepted those names, then forwarded them to Follow Up Boss GET /tasks, which returned 400 Invalid field(s) in the fields parameter: person (and dueDateTime, person on the due-today helper). Sentry tagged the events mcp_error_expected=false / mcp_error_kind=followupboss_validation.

person and dueDateTime can still appear on task records when fields is omitted; they are not accepted as fields query values.

Code path verified

• followupboss_mcp.mcp_registration.followupboss_list_my_overdue_tasks
• followupboss_mcp.mcp_tools.FollowUpBossToolAdapter._list_my_tasks_by_due
• followupboss_mcp.services.tasks.TasksService.list_tasks
• followupboss_mcp.models.tasks.TaskListRequest / TaskProjectionField

Fix summary

• Remove person and dueDateTime from the public task projection enum.
• Validate task fields locally on TaskListRequest and owned-task helper input, with guidance to use personId / dueDate.
• Keep person and dueDateTime on TaskRecord response models.

Fixes FOLLOWUPBOSS-MCP-1F

Tests / checks run

• uv run pytest -x tests/mcp/test_mcp_tools_server_cli.py::test_task_list_request_rejects_unsupported_projection_with_guidance tests/mcp/test_mcp_tools_server_cli.py::test_list_my_overdue_tasks_rejects_invalid_projection_fields_locally tests/mcp/test_mcp_tools_server_cli.py::test_task_and_call_tools_publish_documented_field_enums
• uv run pytest -x tests/mcp/test_mcp_tools_server_cli.py::test_tool_adapter_success_and_failure_paths tests/unit/test_battle_test_ai.py::test_read_only_tool_specs_constrain_owned_task_fields tests/unit/test_services.py::test_tasks_service tests/unit/test_datetimes.py
• uv run ruff format --check .
• uv run ruff check .
• uv run mypy src tests

Residual risk

Follow Up Boss does not document the full GET /tasks fields allowlist. Other currently advertised projection names could still be rejected upstream. If that happens, extend _TASK_PROJECTION_FIELDS the same way. Clients that previously requested person or dueDateTime will now get a local validation error instead of an upstream 400; omit fields to receive the full task record.

  

[jp26jp]

Closed as superseded by merged #5. The task-field production files are byte-identical across #2, #4, and #5; #5 was the current-main superset and retained the earlier regressions plus list_tasks coverage. #5 passed make validate and 25/25 hosted checks before merge.