@aipermission/mcp 0.1.8 → 0.1.11

package/README.md

@@ -54,6 +54,7 @@ The generated MCP config contains a bearer token. Keep it private. For project-l
 - `get_request`
 - `list_requests`
 - `read_console`
+- `restart_console_session`
 - `send_message`
 - `list_file_transfers`
 - `get_file_transfer`
@@ -97,11 +98,11 @@ Supported clients:
 - `gemini`: `GEMINI.md`
 - `custom`: prints portable Markdown to stdout
 
-These instructions teach the agent how to poll `approval_pending` and `running` requests, read live console output, write short reasons, use explicit file transfer paths, and avoid printing secrets. The default installer uses the operator instruction bundled in the npm package; `--source` accepts local file paths only and rejects HTTP(S) sources.
+These instructions teach the agent how to poll `approval_pending` and `running` requests, handle `stale` approvals by sending a fresh request, read live console output, recover stuck persistent console sessions with `restart_console_session`, write short reasons, use explicit file transfer paths, and avoid printing secrets. The default installer uses the operator instruction bundled in the npm package; `--source` accepts local file paths only and rejects HTTP(S) sources.
 
 ## Security Boundary
 
-This package talks to a local AIPermission gateway. `AIPERMISSION_API_URL` must point to `localhost`, `127.0.0.1`, or `[::1]`; remote URLs are rejected before the bearer token is sent. Do not expose the gateway on LAN or the public internet, and do not use it as a shared DevOps service. Tokens grant access only to the servers and execution rules configured in the gateway UI. Token/server permissions may be temporary; expired grants are omitted from `list_servers` and no longer authorize command, console, or file-transfer tools.
+This package talks to a local AIPermission gateway. `AIPERMISSION_API_URL` must point to `localhost`, `127.0.0.1`, or `[::1]`; remote URLs are rejected before the bearer token is sent. Do not expose the gateway on LAN or the public internet, and do not use it as a shared DevOps service. Tokens grant access only to the servers and execution rules configured in the gateway UI. Token/server permissions may be temporary; expired grants are omitted from `list_servers` and no longer authorize command, console, or file-transfer tools. `list_servers` is permission-scoped, not a live SSH health check; treat `exec` connection errors as the current reachability signal.
 
 ## License
 

package/dist/resources/aipermission-operator/SKILL.md

@@ -27,6 +27,11 @@ If no server is visible, say that the current token has no accessible servers.
 If `expires_at` is present, treat access as temporary. Finish within that
 maintenance window or ask the operator to extend access.
 
+`list_servers()` is permission-scoped, not a live health check. A visible server
+may still be powered off, unreachable, reject SSH authentication, or require host
+key review. Treat `exec` dial, timeout, authentication, and host-key errors as
+the current reachability signal.
+
 ## Command Reasons
 
 Every `exec` call should include a short `reason`.
@@ -67,9 +72,14 @@ failed
 declined
 blocked
 error
+stale
 ```
 
 If the request is `declined`, read `user_note` and follow the user's correction.
+If the request is `stale`, the approval context changed before execution; send a fresh `exec` request with the current command and reason instead of trying to reuse the old approval.
+If the request is `error`, read the error text. SSH reachability, refused ports,
+authentication failures, and host-key failures are current connection signals;
+do not assume a listed server is live just because `list_servers` returned it.
 
 ## Running Flow
 
@@ -80,6 +90,14 @@ When `exec` or `get_request` returns `running`:
 3. Use `read_console(server_id)` between polls only when the token has `always_run` permission.
 4. Do not start another long-running command on the same server until the active request reaches a terminal status, unless the user explicitly asks.
 
+If the request appears stuck for an unusually long time and `read_console`
+shows no useful progress, ask the operator before recovery unless they already
+asked you to recover the session. When recovery is approved, call
+`restart_console_session(server_id)`. This does not intentionally run a remote
+shell command; it closes the gateway-owned persistent console session and the
+next `exec` opens a fresh SSH session. Treat any canceled request as
+inconclusive and re-run only the minimal safe inspection needed.
+
 ## Message Flow
 
 Use `send_message(message, server_id?, session_id?)` for short operator-visible notes.

package/dist/server.js

@@ -72,6 +72,19 @@ server.tool(
   }
 );
 
+server.tool(
+  "restart_console_session",
+  "Restart the persistent console session for a server when it appears stuck. This closes the current gateway-owned console session and the next exec will open a fresh SSH session.",
+  {
+    server_id: z.number().int().positive().describe("Server id from list_servers."),
+  },
+  async ({ server_id }) => {
+    return jsonToolResult(() => apiPost("/api/mcp/console/restart", {
+      server_id,
+    }));
+  }
+);
+
 server.tool(
   "get_request",
   "Read an aipermission command request by id. Use this after exec returns approval_pending or running.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aipermission/mcp",
-  "version": "0.1.8",
+  "version": "0.1.11",
   "mcpName": "io.github.aipermission/aipermission-mcp",
   "description": "Local-first MCP bridge for the aipermission gateway.",
   "license": "MIT",

package/server.json

@@ -3,12 +3,12 @@
   "name": "io.github.aipermission/aipermission-mcp",
   "title": "AIPermission",
   "description": "Local-first MCP bridge for the AIPermission gateway.",
-  "version": "0.1.8",
+  "version": "0.1.11",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@aipermission/mcp",
-      "version": "0.1.8",
+      "version": "0.1.11",
       "transport": {
         "type": "stdio"
       }