@thehammer/danx-dashboard-mcp 0.1.247 → 0.1.248

package/dist/access-request.js

@@ -54,8 +54,6 @@ function isCreated(value) {
         typeof v.secret === "string" &&
         typeof v.confirmCode === "string" &&
         typeof v.approvalUrl === "string" &&
-        typeof v.expiresAt === "string" &&
-        Number.isFinite(Date.parse(v.expiresAt)) &&
         typeof v.pollMs === "number");
 }
 export async function createAccessRequest(fetchImpl, dashboardUrl, input) {

package/dist/index.js

@@ -515,7 +515,8 @@ strictTool("attach_file", "Attach a LOCAL file to a card. This server reads and
 // ---------------- request_permission (DX-4434, parent DX-4432) ----------------
 strictTool("request_permission", "Ask a person to grant this key ONE MORE permission. Call it when a call was refused `403 forbidden` naming a " +
     "`permission`, or when you know you need one more. It returns AT ONCE with `{state, approvalUrl, confirmCode, " +
-    "expiresAt, instruction}`: show the person the code and URL, and keep working on anything else. If they approve, a " +
+    "instruction}`: show the person the code and URL, and keep working on anything else. It waits until this session " +
+    "ends; if expired, reconnect and ask again. If they approve, a " +
     "later call simply succeeds with the same key (no new key, no re-auth). The same permissions asked again while " +
     "pending return the pending request. A refusal (unknown permission, already held, rate limited) comes back as " +
     "`{ok:false, status, body}`. If you are blocked without it, raise a problem on the card.", {
@@ -551,7 +552,8 @@ strictTool("plan_connect",
 // DX-4390 — signed out, this is also how the session asks for access.
 "Connect THIS session to a plan; one call is enough to start. Signed out, it requests access instead: " +
     "the reply is `state: approval_required` or `approval_pending` with an `approvalUrl` and `confirmCode` " +
-    "(show the code, open the URL, then call again). Signed in, the reply carries `missedEvents` (operator " +
+    "(show the code, open the URL, then call again; it waits until this session ends; a call re-asks an expired one). " +
+    "Signed in, the reply carries `missedEvents` (operator " +
     "events on the plan that no session had been told about, oldest first: read them first), " +
     "`browserInstruction` (do it now), `briefing` (the plan's goals, rules, caveats, architecture section " +
     "titles and a first page of open cards) and `listenerHealth` (when its `state` is not `healthy`, do its " +

package/dist/permission-request.js

@@ -1,13 +1,13 @@
-import { POLL_GRACE_MS, defaultSleep } from "./session-access.js";
+import { defaultSleep } from "./session-access.js";
 import { McpOutdatedError } from "./version-floor.js";
 const PERMISSION_REQUESTS_BASE_PATH = "/api/permission-requests";
 const APPROVAL_REQUIRED_INSTRUCTION = "Show the person the approval URL and the confirm code (they check the code matches, then approve). Keep working on anything " +
-    "else: this call has returned and nothing waits. If they approve, this process picks the grant up in the background and a " +
-    "later call simply succeeds with the same key (no new key, no re-auth). If you are blocked without it, raise a problem on " +
-    "the card; a person sees problems in Needs You.";
-const APPROVAL_PENDING_INSTRUCTION = "This permission is already asked for and not yet decided. Remind the person of the confirm code and the approval URL; keep " +
-    "working on anything else. A grant is picked up in the background and a later call simply succeeds with the same key. If you " +
-    "are blocked without it, raise a problem on the card.";
+    "else: this call has returned and nothing waits. The request stays open until this session ends, however long they take. If " +
+    "they approve, this process picks the grant up in the background and a later call simply succeeds with the same key (no new " +
+    "key, no re-auth). If you are blocked without it, raise a problem on the card; a person sees problems in Needs You.";
+const APPROVAL_PENDING_INSTRUCTION = "This permission is already asked for and not yet decided; the request stays open until this session ends. Remind the person " +
+    "of the confirm code and the approval URL; keep working on anything else. A grant is picked up in the background and a later " +
+    "call simply succeeds with the same key. If you are blocked without it, raise a problem on the card.";
 /** The dedupe set: sorted and de-duplicated, so the order the agent listed them in never matters. */
 function setOf(permissions) {
     return [...new Set(permissions)].sort();
@@ -19,8 +19,6 @@ function isCreated(value) {
     return (typeof v.publicId === "string" &&
         typeof v.confirmCode === "string" &&
         typeof v.approvalUrl === "string" &&
-        typeof v.expiresAt === "string" &&
-        Number.isFinite(Date.parse(v.expiresAt)) &&
         typeof v.pollMs === "number");
 }
 /** A 429's own `retryAfterMs`, else 0 (the poll then waits its normal interval). */
@@ -32,11 +30,9 @@ export class PermissionRequests {
     deps;
     pending = new Map();
     queue = Promise.resolve();
-    now;
     sleep;
     constructor(deps) {
         this.deps = deps;
-        this.now = deps.now ?? Date.now;
         this.sleep = deps.sleep ?? defaultSleep;
     }
     ask(args) {
@@ -72,12 +68,11 @@ export class PermissionRequests {
             state,
             approvalUrl: request.approvalUrl,
             confirmCode: request.confirmCode,
-            expiresAt: request.expiresAt,
             instruction: state === "approval_required" ? APPROVAL_REQUIRED_INSTRUCTION : APPROVAL_PENDING_INSTRUCTION,
         };
     }
     /**
-     * Polls until the request is decided or lapsed, then frees its set so a later call may ask again. Every ending is final: a
+     * Polls until the request is decided or expired, then frees its set so a later call may ask again. Every ending is final: a
      * halt (revoked, signed out, key lapsed) stops it silently, since the session no longer holds a key that could be granted.
      */
     async pollUntilDecided(key, request) {
@@ -92,21 +87,19 @@ export class PermissionRequests {
                 this.pending.delete(key);
         }
     }
+    // DX-4530: no give-up time - the request is open until it is decided or the key dies (the `guard` halt).
     async poll(request) {
-        const giveUpAt = Date.parse(request.expiresAt) + POLL_GRACE_MS;
         let waitMs = request.pollMs;
         for (;;) {
             await this.sleep(waitMs);
             waitMs = request.pollMs;
-            if (this.now() > giveUpAt)
-                return;
             let guarded;
             try {
                 // `guard` runs before EVERY claim (DX-4418): a revoked or signed-out session answers its halt without a request.
                 guarded = await this.deps.access.guard(() => this.deps.request({ method: "POST", basePath: PERMISSION_REQUESTS_BASE_PATH, path: `/${request.publicId}/claim` }));
             }
             catch (err) {
-                // An outdated MCP will never get a different answer; any other failure is retried until the request lapses.
+                // An outdated MCP will never get a different answer; any other failure is retried until the request ends.
                 if (err instanceof McpOutdatedError)
                     throw err;
                 this.deps.log?.(`[danx-dashboard-mcp] permission request poll failed, retrying: ${err.message}`);
@@ -120,7 +113,7 @@ export class PermissionRequests {
                 continue;
             }
             if (claim.status === 404)
-                return; // unknown or already reaped: nothing left to wait for
+                return; // unknown or long since deleted: nothing left to wait for
             if (!claim.ok) {
                 throw new Error(`the dashboard refused the claim (${claim.status}): ${JSON.stringify(claim.body)}`);
             }

package/dist/session-access.js

@@ -18,6 +18,10 @@
  * the background, so the key is stored the moment the user approves, and the next `plan_connect`
  * waits at most `awaitMs` (about 45s) for it before answering `approval_pending`. The secret the
  * poll needs lives only in this process's memory; a restarted session asks again.
+ *
+ * DX-4530: a request has no deadline. It stays open for as long as this process keeps polling it, so it waits for a person
+ * however long they take, and it expires once the session ends (its polls stop). A poll that cannot reach the dashboard is
+ * retried; the dashboard answers `expired` if they stopped arriving for longer than its requester-gone window.
  */
 import { existsSync } from "node:fs";
 import { hostname } from "node:os";
@@ -28,8 +32,6 @@ import { deleteSessionKey, writeSessionKey } from "./session-key.js";
 import { McpOutdatedError } from "./version-floor.js";
 /** Longest a `plan_connect` call waits for an approval already asked for. */
 export const AWAIT_APPROVAL_MS = 45_000;
-/** The server reaps a lapsed request about a minute after expiry; polling past that finds nothing. */
-export const POLL_GRACE_MS = 90_000;
 /** A live server rewrites its key file this often, so an in-use key never ages out of the 7-day prune. */
 const KEEP_KEY_FILE_EVERY_MS = 60 * 60 * 1000;
 /** The request's title when the agent gave none: the session id's first characters. */
@@ -39,9 +41,10 @@ export const SIGN_IN_HALT = "Not signed in to the danxbot dashboard. Call `plan_
 export const KEY_LAPSED_HALT = "The dashboard no longer accepts this session's key (it lapsed after a day unused), so this session is signed out. " +
     SIGN_IN_HALT;
 const APPROVAL_REQUIRED_INSTRUCTION = "Show the user the confirm code and open the approval URL in their browser; they check the code " +
-    "matches and approve. Then call `plan_connect` again: it waits up to about 45 seconds for the approval.";
-const APPROVAL_PENDING_INSTRUCTION = "Still waiting for the user to approve. Remind them of the confirm code and the URL, then call " +
-    "`plan_connect` again.";
+    "matches and approve. Then call `plan_connect` again: it waits up to about 45 seconds for the approval. " +
+    "The request stays open until this session ends, however long the user takes.";
+const APPROVAL_PENDING_INSTRUCTION = "Still waiting for the user to approve; the request stays open until this session ends. Remind them of the " +
+    "confirm code and the URL, then call `plan_connect` again.";
 const DENIED_INSTRUCTION = "The user denied the request. Do not retry unless they ask; a new `plan_connect` makes a new request.";
 const DASHBOARD_OUTDATED_ERROR = "this dashboard does not support request-and-approve yet (POST /api/access-requests answered 404): " +
     "it must be updated before this session can sign in";
@@ -50,7 +53,8 @@ const unknownTeamError = (team) => `the dashboard has no team "${team}" (DANXBOT
 const NO_SESSION_ID_ERROR = "this server has no CLAUDE_CODE_SESSION_ID, so it cannot request a session key";
 const CLAIMED_LOST_ERROR = "the dashboard says this request was already claimed, but this process never received the key; " +
     "start a new request";
-const EXPIRED_NOTE = "The previous request expired before it was approved.";
+const EXPIRED_NOTE = "The previous request expired before it was approved: the dashboard stopped hearing from this session. This is a new " +
+    "request: show the user its new confirm code and URL.";
 export const defaultSleep = (ms) => new Promise((resolve) => {
     setTimeout(resolve, ms).unref();
 });
@@ -233,24 +237,21 @@ export class SessionAccess {
             state,
             approvalUrl: request.approvalUrl,
             confirmCode: request.confirmCode,
-            expiresAt: request.expiresAt,
             instruction: state === "approval_required" ? APPROVAL_REQUIRED_INSTRUCTION : APPROVAL_PENDING_INSTRUCTION,
         };
     }
+    // DX-4530: no give-up time - the polls are what keep the request open, until the dashboard answers how it ended.
     async pollUntilSettled(request) {
-        const giveUpAt = Date.parse(request.expiresAt) + POLL_GRACE_MS;
         let waitMs = request.pollMs;
         for (;;) {
             await this.sleep(waitMs);
             waitMs = request.pollMs;
-            if (this.now() > giveUpAt)
-                return { kind: "expired" };
             let claim;
             try {
                 claim = await claimAccessRequest(this.fetchImpl, this.deps.dashboardUrl, request.secret);
             }
             catch (err) {
-                // A claim the dashboard could not answer is retried until the request lapses; an outdated
+                // A claim the dashboard could not answer is retried until it answers how the request ended; an outdated
                 // MCP will never get a different answer, so that one ends it.
                 if (err instanceof McpOutdatedError)
                     return { kind: "failed", error: err.message };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.247",
+  "version": "0.1.248",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, danxbot_complete, and other per-dispatch lifecycle callbacks) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",