@displaydev/cli 0.21.1 → 0.23.1

package/dist/api-client.js

@@ -285,6 +285,22 @@ function _ts_generator(thisArg, body) {
  * HTTP client for the display.dev API.
  * Used by the stdio MCP server to proxy tool calls to the REST API.
  */ import { readLatestVersionFromResponse } from './update-notice.js';
+/**
+ * Auto-detect actor type at ApiClient construction. Any of stdin /
+ * stdout / stderr being a TTY counts as interactive — handles the
+ * common `dsp publish < file.html` case where stdin is piped but the
+ * user is still at the terminal watching output. Non-TTY → `agent`,
+ * the assumption being that scripted/agent invocations outnumber
+ * humans-on-the-terminal as the agent-native model takes hold.
+ *
+ * Spec §3.2: detection happens once per `ApiClient` instance, not per
+ * request — process stdio doesn't change mid-run.
+ */ export function detectActorTypeFromTty() {
+    var stdinTty = Boolean(process.stdin.isTTY);
+    var stdoutTty = Boolean(process.stdout.isTTY);
+    var stderrTty = Boolean(process.stderr.isTTY);
+    return stdinTty || stdoutTty || stderrTty ? 'human' : 'agent';
+}
 export var ApiError = /*#__PURE__*/ function(Error1) {
     "use strict";
     _inherits(ApiError, Error1);
@@ -312,26 +328,84 @@ export var ApiClient = /*#__PURE__*/ function() {
     "use strict";
     function ApiClient(config) {
         _class_call_check(this, ApiClient);
-        var _config_clientType, _config_version, _config_clientSource;
+        var _config_clientType, _config_version, _config_clientSource, _config_actorType;
         _define_property(this, "baseUrl", void 0);
         _define_property(this, "apiKey", void 0);
         _define_property(this, "clientType", void 0);
         _define_property(this, "version", void 0);
         _define_property(this, "clientSource", void 0);
+        /**
+   * Final `X-Actor-Type` value. Defaults to the auto-detected value
+   * (TTY → `human`, non-TTY → `agent`) but `dsp mcp` clears it so
+   * the server's transport-based classification (`mcp` → `agent`)
+   * isn't layered on top of a CLI isTTY signal that's incoherent
+   * inside the spawned MCP server's request lifecycle.
+   */ _define_property(this, "actorType", void 0);
+        /**
+   * Per-request actor-name source. Resolved lazily at every fetch so
+   * the MCP server can plug in `() => server.server.getClientVersion()`
+   * without worrying about the `oninitialized` notification race —
+   * `getClientVersion()` is populated synchronously inside the SDK's
+   * `initialize` request handler, well before any subsequent tool call
+   * lands. Direct `dsp` subcommands set a static value via
+   * `setActorName(...)` from the `--actor-name` flag or
+   * `DISPLAYDEV_ACTOR_NAME` env.
+   */ _define_property(this, "actorNameProvider", null);
         this.baseUrl = config.baseUrl.replace(/\/$/, '');
         this.apiKey = config.apiKey;
         this.clientType = (_config_clientType = config.clientType) !== null && _config_clientType !== void 0 ? _config_clientType : 'mcp-stdio';
         this.version = (_config_version = config.version) !== null && _config_version !== void 0 ? _config_version : '';
         this.clientSource = (_config_clientSource = config.clientSource) !== null && _config_clientSource !== void 0 ? _config_clientSource : '';
+        this.actorType = (_config_actorType = config.actorType) !== null && _config_actorType !== void 0 ? _config_actorType : detectActorTypeFromTty();
+        if (config.actorName) {
+            this.setActorName(config.actorName);
+        }
     }
     _create_class(ApiClient, [
+        {
+            /** Clear the auto-detected `X-Actor-Type` (used by `dsp mcp`). */ key: "clearActorType",
+            value: function clearActorType() {
+                this.actorType = null;
+            }
+        },
+        {
+            /**
+   * Set a static `X-Actor-Name` value. Equivalent to passing a
+   * provider that always returns `name`. Pass `null` to clear.
+   * Normalization (ASCII strip + 128-char truncate) runs at wire
+   * time inside `resolveActorName`.
+   */ key: "setActorName",
+            value: function setActorName(name) {
+                if (name === null) {
+                    this.actorNameProvider = null;
+                    return;
+                }
+                this.actorNameProvider = function() {
+                    return name;
+                };
+            }
+        },
+        {
+            /**
+   * Set a callback resolved on every outgoing request. Used by the
+   * stdio MCP server to forward `server.server.getClientVersion()`
+   * lazily — the cached value lands during the SDK's `initialize`
+   * request handler (synchronously), so by the time the next tool
+   * call lands, the provider returns the correct
+   * `${name}@${version}` regardless of when `oninitialized` fires.
+   */ key: "setActorNameProvider",
+            value: function setActorNameProvider(provider) {
+                this.actorNameProvider = provider;
+            }
+        },
         {
             key: "clientHeaders",
             value: /**
    * Build the request-side header set. Always carries `X-Client-Type`;
    * adds `X-Client-Version` when the client was constructed with one;
    * adds `X-Client-Source` when a distribution-channel attribution was
-   * configured.
+   * configured; adds `X-Actor-Name` when a provider returns a non-empty
+   * normalized value.
    */ function clientHeaders(extra) {
                 var headers = _object_spread({
                     'X-Client-Type': this.clientType
@@ -339,10 +413,39 @@ export var ApiClient = /*#__PURE__*/ function() {
                     'X-Client-Version': this.version
                 } : {}, this.clientSource ? {
                     'X-Client-Source': this.clientSource
+                } : {}, this.actorType ? {
+                    'X-Actor-Type': this.actorType
                 } : {}, extra);
+                var actor = this.resolveActorName();
+                if (actor) {
+                    headers['X-Actor-Name'] = actor;
+                }
                 return headers;
             }
         },
+        {
+            key: "resolveActorName",
+            value: /**
+   * Resolve and normalize the current actor name. Returns `null` when
+   * no provider is set or the provider returns an empty string after
+   * sanitization. We strip non-ASCII and truncate to 128 chars as a
+   * defensive cleanup; the API re-normalizes (including comma-split
+   * + trim) in `normalizeActorName`, so the persisted value is
+   * authoritative — these client-side passes just keep the wire
+   * frame within bounds.
+   */ function resolveActorName() {
+                if (!this.actorNameProvider) {
+                    return null;
+                }
+                var raw = this.actorNameProvider();
+                if (!raw) {
+                    return null;
+                }
+                var cleaned = raw// eslint-disable-next-line no-control-regex
+                .replace(/[^\x20-\x7e]/g, '').slice(0, 128);
+                return cleaned.length > 0 ? cleaned : null;
+            }
+        },
         {
             key: "observeResponse",
             value: /**

package/dist/main.js

@@ -310,13 +310,58 @@ function resolveClientSource() {
     }
     return undefined;
 }
+/**
+ * User-grade override for the CLI's auto-detected isTTY classification
+ * — needed when a human pipes output (auto-detected as `agent`) or a
+ * custom script flips an interactive shell to `agent`. Server enforces
+ * the `{human, agent}` closed range; unknown values trip a clear error
+ * here so the user gets feedback instead of silent fallthrough. An
+ * explicit blank (`--actor-type=`) resets to "no override".
+ */ var actorFromFlag;
+var actorFlagPassed = false;
+function parseActorOrExit(raw, source) {
+    var lower = raw.trim().toLowerCase();
+    if (lower === 'human' || lower === 'agent') {
+        return lower;
+    }
+    console.error("Invalid ".concat(source, ": ").concat(raw, ". Use human or agent."));
+    process.exit(1);
+}
+function resolveActorOverride() {
+    if (actorFlagPassed) {
+        return actorFromFlag;
+    }
+    var env = process.env.DISPLAYDEV_ACTOR_TYPE;
+    if (typeof env === 'string' && env.length > 0) {
+        return parseActorOrExit(env, 'DISPLAYDEV_ACTOR_TYPE');
+    }
+    return undefined;
+}
+/**
+ * Independent of `--actor-type` — any actor type can carry a name
+ * (e.g. a script-mode label for a human, the key-name proxy for an
+ * org-key write).
+ */ var actorNameFromFlag;
+var actorNameFlagPassed = false;
+function resolveActorName() {
+    if (actorNameFlagPassed) {
+        return actorNameFromFlag;
+    }
+    var env = process.env.DISPLAYDEV_ACTOR_NAME;
+    if (typeof env === 'string' && env.length > 0) {
+        return env;
+    }
+    return undefined;
+}
 function createClient(auth) {
     return new ApiClient({
         baseUrl: auth.apiUrl,
         apiKey: auth.apiKey,
         clientType: 'cli',
         version: version,
-        clientSource: resolveClientSource()
+        clientSource: resolveClientSource(),
+        actorType: resolveActorOverride(),
+        actorName: resolveActorName()
     });
 }
 var program = new Command().name('dsp').description('display.dev CLI — publish artifacts behind company auth').version(version);
@@ -465,7 +510,9 @@ program.command('publish <path>').description('Publish an HTML or Markdown file.
                         apiKey: '',
                         clientType: 'cli',
                         version: version,
-                        clientSource: resolveClientSource()
+                        clientSource: resolveClientSource(),
+                        actorType: resolveActorOverride(),
+                        actorName: resolveActorName()
                     });
                     _state.label = 10;
                 case 10:
@@ -504,11 +551,11 @@ program.command('publish <path>').description('Publish an HTML or Markdown file.
                     console.log(JSON.stringify(publicResult));
                     process.stderr.write([
                         '',
-                        "Published anonymously — nobody owns this artifact yet.",
+                        "Published anonymously. Claim it to make it yours.",
                         "  Preview: ".concat(publicResult.previewUrl),
                         "  Claim:   ".concat(publicResult.claimUrl),
                         "  Expires: ".concat(publicResult.expiresAt),
-                        "Sign in at the claim URL to move it into your display.dev organization.",
+                        "Sign up at the claim URL to move it into your display.dev organization.",
                         ''
                     ].join('\n'));
                     return [
@@ -2391,7 +2438,40 @@ program.command('mcp').description('Start MCP server over stdin/stdout').action(
         }
     }
 }
+/**
+ * Actor flags walk the command tree alongside `--client-source` so
+ * every direct-HTTP subcommand can override the auto-detected isTTY
+ * classification or stamp a display name. The flags are also
+ * registered on `mcp` so `dsp mcp --actor-name foo` is silently
+ * accepted; the mcp action builds its `ApiClient` without reading the
+ * stash AND clears `actorType` afterwards so the spawned MCP server's
+ * actor model stays clean.
+ */ function addActorOptionsRecursive(cmd) {
+    cmd.option('--actor-type <type>', 'Actor classification: human or agent. Overrides the auto-detected isTTY classification.');
+    cmd.option('--actor-name <name>', 'Display name stamped on X-Actor-Name (≤128 chars, ASCII; e.g. ci-deploy-bot, manual-cleanup-batch-3).');
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = cmd.commands[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var child = _step.value;
+            addActorOptionsRecursive(child);
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+}
 addClientSourceOptionRecursive(program);
+addActorOptionsRecursive(program);
 /**
  * Resolve the parsed flag value before each action. Program-level
  * `preAction` hooks fire ahead of every subcommand action, so a single
@@ -2402,11 +2482,18 @@ addClientSourceOptionRecursive(program);
  */ program.hook('preAction', function(_thisCommand, actionCommand) {
     var cursor = actionCommand;
     while(cursor){
-        var val = cursor.opts().clientSource;
-        if (typeof val === 'string') {
+        var opts = cursor.opts();
+        if (!clientSourceFlagPassed && typeof opts.clientSource === 'string') {
             clientSourceFlagPassed = true;
-            clientSourceFromFlag = val.length > 0 ? val : undefined;
-            return;
+            clientSourceFromFlag = opts.clientSource.length > 0 ? opts.clientSource : undefined;
+        }
+        if (!actorFlagPassed && typeof opts.actorType === 'string') {
+            actorFlagPassed = true;
+            actorFromFlag = opts.actorType.length > 0 ? parseActorOrExit(opts.actorType, '--actor-type') : undefined;
+        }
+        if (!actorNameFlagPassed && typeof opts.actorName === 'string') {
+            actorNameFlagPassed = true;
+            actorNameFromFlag = opts.actorName.length > 0 ? opts.actorName : undefined;
         }
         cursor = cursor.parent;
     }

package/dist/mcp-server.js

@@ -279,6 +279,29 @@ export function startMcpServer(_0) {
                     }, {
                         instructions: mode === 'public' ? PUBLIC_INSTRUCTIONS : AUTHENTICATED_INSTRUCTIONS
                     });
+                    // The spawned MCP server is its own actor model: transport=`mcp` +
+                    // `clientInfo`-derived `actorName`. Layering the CLI's auto-
+                    // detected `X-Actor-Type` on top of MCP requests would be incoherent
+                    // (the `dsp mcp` host's TTY shape says nothing about the agent
+                    // talking through the MCP server), so clear it here — server-side
+                    // resolveActor classifies MCP transport as `agent` via rule 6.
+                    apiClient.clearActorType();
+                    // Plug the SDK's cached `clientInfo` into the apiClient on every
+                    // outgoing HTTP request. The MCP protocol populates the cache
+                    // synchronously inside the `initialize` request handler, which
+                    // completes before any subsequent tool call lands — using a lazy
+                    // provider (rather than the `oninitialized` notification handler)
+                    // sidesteps the notification-dispatch race where a fast client
+                    // pipelines tool calls right after `notifications/initialized`.
+                    // Server-side construction per spec §3.3 — the wire value is built
+                    // from SDK-cached fields, never from a client-supplied header.
+                    apiClient.setActorNameProvider(function() {
+                        var info = server.server.getClientVersion();
+                        if (!info || !info.name) {
+                            return null;
+                        }
+                        return info.version ? "".concat(info.name, "@").concat(info.version) : info.name;
+                    });
                     if (mode === 'public') {
                         registerPublicTools(server, apiClient);
                     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@displaydev/cli",
-  "version": "0.21.1",
+  "version": "0.23.1",
   "type": "module",
   "bin": {
     "dsp": "dist/main.js"