@aipermission/mcp 0.2.25 → 0.2.27

package/README.md

@@ -31,7 +31,7 @@ npx -y @aipermission/mcp init \
   --name aipermission
 ```
 
-The init command prompts for your AIPermission API token and writes the MCP client configuration for the selected provider.
+The init command prompts for your AIPermission API token and writes the MCP client configuration for the selected provider. Generated runtime configs pin the exact package version that wrote them; re-run init when you intentionally upgrade a client.
 
 The generated MCP config contains a bearer token. Keep it private. For project-local configs such as `.mcp.json`, `.cursor/mcp.json`, and `.vscode/mcp.json`, the init command refuses to write into files already tracked by Git unless `--force` is passed. For untracked project-local configs, it adds the file to `.git/info/exclude` when it detects a Git repository. Use `--print` if you prefer to copy the config manually. If a token config is committed or shared, revoke that token in the AIPermission UI.
 
@@ -42,7 +42,7 @@ The generated MCP config contains a bearer token. Keep it private. For project-l
   "mcpServers": {
     "aipermission": {
       "command": "npx",
-      "args": ["-y", "@aipermission/mcp"],
+      "args": ["-y", "@aipermission/mcp@0.2.27"],
       "env": {
         "NODE_ENV": "production",
         "AIPERMISSION_API_URL": "http://localhost:3210",

package/dist/init.js

@@ -1,4 +1,5 @@
 import fs from "node:fs/promises";
+import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
 import readline from "node:readline/promises";
@@ -6,7 +7,12 @@ import { pathToFileURL } from "node:url";
 import { stdin as input, stdout as output } from "node:process";
 import { DEFAULT_API_URL, normalizeLocalAPIURL } from "./local-url.js";
 
-const PACKAGE_NAME = "@aipermission/mcp";
+const require = createRequire(import.meta.url);
+const packageMetadata = require("../package.json");
+
+export const PACKAGE_NAME = packageMetadata.name;
+export const PACKAGE_VERSION = packageMetadata.version;
+export const PACKAGE_SPECIFIER = `${PACKAGE_NAME}@${PACKAGE_VERSION}`;
 const useColor = output.isTTY && !process.env.NO_COLOR;
 const color = {
   reset: useColor ? "\x1b[0m" : "",
@@ -287,7 +293,7 @@ async function readStdin() {
 export function buildMCPServerConfig({ apiUrl, token }) {
   return {
     command: "npx",
-    args: ["-y", PACKAGE_NAME],
+    args: ["-y", PACKAGE_SPECIFIER],
     env: {
       NODE_ENV: "production",
       AIPERMISSION_API_URL: apiUrl,

package/dist/resources/aipermission-operator/SKILL.md

@@ -25,7 +25,7 @@ Before acting:
 2. Pick the relevant `target_ref`.
 3. Call `get_connector_help(target_ref)` the first time you use that connector.
 4. Call `get_connector_actions(target_ref)` and choose the narrowest action.
-5. Call `call_connector_action(target_ref, action_name, input, reason)`.
+5. Call `call_connector_action(target_ref, action_name, input, reason, idempotency_key)`.
 
 If no target is visible, say that the current token has no accessible connector
 targets. A target can be absent because its project is disabled for the token or
@@ -41,6 +41,11 @@ profile. Treat action errors as the current reachability/authorization signal.
 ## Reasons
 
 Every `call_connector_action` should include a short `reason`.
+Use one stable, unique `idempotency_key` for each logical action. Preserve that
+key while retrying an uncertain call. Never reuse it for a different target,
+action, input, or reason; the gateway rejects mismatched reuse.
+Blocked and missing-permission outcomes are also replayed. After the operator
+changes permission, use a new key for the new logical attempt.
 
 Good reasons:
 

package/dist/server.js

@@ -69,13 +69,15 @@ server.tool(
     action_name: z.string().min(1).describe("Action name from get_connector_actions."),
     input: z.record(z.unknown()).optional().describe("Connector-specific action input."),
     reason: z.string().optional().describe("Why this connector action is needed."),
+    idempotency_key: z.string().min(1).max(128).optional().describe("Caller-stable key that makes retries return the original request without running twice."),
   },
-  async ({ target_ref, action_name, input, reason }) => {
+  async ({ target_ref, action_name, input, reason, idempotency_key }) => {
     return jsonToolResult(() => apiPost("/api/mcp/connector-actions/call", {
       target_ref,
       action_name,
       input: input || {},
       reason: reason || "",
+      idempotency_key,
     }));
   }
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aipermission/mcp",
-  "version": "0.2.25",
+  "version": "0.2.27",
   "mcpName": "io.github.aipermission/aipermission-mcp",
   "description": "Local-first MCP bridge for the aipermission gateway.",
   "license": "AGPL-3.0-only",

package/server.json

@@ -3,12 +3,12 @@
   "name": "io.github.aipermission/aipermission-mcp",
   "title": "AIPermission",
   "description": "Local-first MCP bridge for the AIPermission gateway.",
-  "version": "0.2.25",
+  "version": "0.2.27",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@aipermission/mcp",
-      "version": "0.2.25",
+      "version": "0.2.27",
       "transport": {
         "type": "stdio"
       }