@thehammer/danx-dashboard-mcp 0.1.300 → 0.1.302

package/dist/listen.js

@@ -11,11 +11,10 @@
  *   - `{type:"event", id, text}` — exactly one per event, the moment it arrives.
  *     `text` is what the session reads; an event it cannot read still produces one
  *     (`could not read event …`), never silence. `id` is `null` only for a frame
- *     that carried no usable id — which includes DX-2885's `nudge` frame
- *     (`formatNudgeLine`), DX-4340's `pacing` frame (`formatPacingLine`) and
- *     DX-4342's `resume` frame (`formatResumeLine`): all are advisory, written fresh by the dashboard's own keep-alive tick,
- *     and never replayed, so they ride this same shape with `id: null` rather
- *     than growing a THIRD output variant.
+ *     that carried no usable id. DX-2885's `nudge` frame (`formatNudgeLine`), DX-4340's `pacing` frame (`formatPacingLine`) and
+ *     DX-4342's `resume` frame (`formatResumeLine`) are advisory and ride this same shape rather than growing a THIRD output
+ *     variant. DX-5007: the dashboard stores each with an id and replays it until the id is reported, so they carry their id like
+ *     an activity line (an id-less one, from an older dashboard, carries `id: null`).
  *   - `{type:"stopped", reason, detail}` — once, last. `reason`
  *     is the dashboard's own end reason (`superseded`, `replaced`, `revoked`,
  *     `not_connected`), `refused` (the ticket was not admitted), or
@@ -492,9 +491,10 @@ export async function runListener(options, deps) {
         return code;
     }
     /**
-     * The shared path of an ADVISORY frame (DX-2885 `nudge`, DX-4340 `pacing`): it carries no usable id (re-derived or written fresh by the
-     * dashboard's keep-alive tick, never replayed - see `plan-session-stream.ts`'s module doc), so it rides the SAME `{type:"event", id:null, text}`
-     * shape an ordinary activity line uses. That is what lets the relay (`plan-events-relay.ts`) forward it with no change: it forwards any
+     * The shared path of an ADVISORY frame (DX-2885 `nudge`, DX-4340 `pacing`, DX-4342 `resume`): the dashboard stores each with an id (DX-5007,
+     * `plan-session-stream.ts`'s module doc), so it is deduplicated and remembered by that id exactly like an activity event: the id is reported as
+     * `Last-Event-ID` on reconnect, which is what stops the dashboard replaying a frame this reader already read. It rides the SAME
+     * `{type:"event", id, text}` shape an ordinary activity line uses. That is what lets the relay (`plan-events-relay.ts`) forward it with no change: it forwards any
      * `{type:"event", id, text}` record, keyed only on `type`.
      *
      * `origin: null` is DX-2730 D4's exemption: the frame is delivered at once, never held for a digest flush (a nudge exists to interrupt a quiet
@@ -511,10 +511,17 @@ export async function runListener(options, deps) {
         catch (err) {
             invalid = `not JSON: ${err.message}`;
         }
+        // `Number(null)` is 0: a frame with no id must never be read as id 0 (see the activity path below).
+        const id = message.id === null ? Number.NaN : Number(message.id);
+        const knownId = Number.isSafeInteger(id) && id > 0;
+        if (knownId && delivered.has(id))
+            return null;
         const text = invalid === null ? format(parsed) : `${LINE_PREFIX} could not read ${what} (${invalid}): ${oneLine(message.data, 300)}`;
         // DX-4721: an unreadable frame is a fault line, never the frame it failed to be (a malformed `critical` pacing frame is not a stop).
         const urgent = isUrgent(invalid === null ? sourceOf(parsed) : { source: "fault" });
-        deps.write({ type: "event", id: null, text, origin: null, urgent, ...(scope === undefined ? {} : { scope }) });
+        deps.write({ type: "event", id: knownId ? id : null, text, origin: null, urgent, ...(scope === undefined ? {} : { scope }) });
+        if (knownId)
+            remember(id);
         return null;
     };
     const handle = (message) => {

package/dist/route-board-scope.generated.js

@@ -40,6 +40,7 @@ export const GET_ROUTE_BOARD_SCOPE = [
     ["/api/platform/teams", "refuse"],
     ["/api/reminders", "refuse"],
     ["/api/repos", "refuse"],
+    ["/api/security-incidents", "refuse"],
     ["/api/self-repair/errors", "refuse"],
     ["/api/sync-root", "refuse"],
     ["/api/tasks", "refuse"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.300",
+  "version": "0.1.302",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, request_permission, attach_file, and danxbot_slack_reply) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",