resolve some devin review comments

Author: ericallam

apps/webapp/app/routes/api.v1.query.ts

@@ -19,7 +19,10 @@ const BodySchema = z.object({
 /** Extract table names from a TRQL query for authorization */
 function detectTables(query: string): string[] {
   return querySchemas
-    .filter((s) => new RegExp(`\\bFROM\\s+${s.name}\\b`, "i").test(query))
+    .filter((s) => {
+      const escaped = s.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      return new RegExp(`\\bFROM\\s+${escaped}\\b`, "i").test(query);
+    })
     .map((s) => s.name);
 }
 

packages/cli-v3/src/mcp/config.ts

@@ -116,7 +116,7 @@ export const toolsMetadata = {
     name: "get_query_schema",
     title: "Get Query Schema",
     description:
-      "Get the column schema for a specific TRQL table. Available tables: 'runs' (task execution data), 'metrics' (CPU, memory, custom metrics), 'llm_metrics' (LLM token usage, costs, latency). Returns columns, types, descriptions, and allowed values for the specified table.",
+      "Get the column schema for a specific TRQL table. Available tables: 'runs' (task execution data), 'metrics' (CPU, memory, custom metrics). Returns columns, types, descriptions, and allowed values for the specified table.",
   },
   list_dashboards: {
     name: "list_dashboards",

packages/cli-v3/src/mcp/tools.ts

@@ -21,11 +21,13 @@ import {
 import { getCurrentWorker, getTaskSchemaTool, triggerTaskTool } from "./tools/tasks.js";
 import { respondWithError } from "./utils.js";
 
-/** Tool names that perform write operations (deploy, trigger, cancel). */
+/** Tool names that perform write/mutating operations. */
 const WRITE_TOOLS = new Set([
   deployTool.name,
   triggerTaskTool.name,
   cancelRunTool.name,
+  createProjectInOrgTool.name,
+  initializeProjectTool.name,
 ]);
 
 export function registerTools(context: McpContext) {

packages/cli-v3/src/mcp/tools/dashboards.ts

@@ -35,8 +35,14 @@ export const listDashboardsTool = {
     });
 
     const cacheKey = `${projectRef}:${input.environment}:${input.branch ?? ""}`;
-    const result = await apiClient.listDashboards();
-    dashboardCache.set(cacheKey, { data: result, expiresAt: Date.now() + CACHE_TTL_MS });
+    const cached = dashboardCache.get(cacheKey);
+    let result: ListDashboardsResponseBody;
+    if (cached && Date.now() < cached.expiresAt) {
+      result = cached.data;
+    } else {
+      result = await apiClient.listDashboards();
+      dashboardCache.set(cacheKey, { data: result, expiresAt: Date.now() + CACHE_TTL_MS });
+    }
 
     const content: string[] = ["## Available Dashboards", ""];