@thehammer/danx-dashboard-mcp 0.1.301 → 0.1.303

package/dist/http-client.js

@@ -1,5 +1,6 @@
 import { boardStampOf } from "./route-board-scope.js";
 import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-floor.js";
+import { PLUGIN_BACKGROUND_HEADER } from "./session-options.js";
 export class DashboardHttpClient {
     config;
     fetchImpl;
@@ -17,6 +18,14 @@ export class DashboardHttpClient {
     setToken(token) {
         this.config.token = token;
     }
+    /**
+     * DX-5076 - the ONE entry for a request this process makes on its own (the listener's health read, the key-permission read, the permission claim
+     * poll): it is never the agent acting, so it carries the background mark and ends no agent pause. A call the agent makes (`danxbot_api`, a
+     * permission-request create) goes through `request` instead. No call site sets `background` by hand.
+     */
+    requestOwn(args) {
+        return this.request({ ...args, background: true });
+    }
     async request(args) {
         if (this.config.token === "") {
             // DX-4390 — a caller reaches here only past the sign-in halt; a bearer-less call is a bug.
@@ -51,7 +60,7 @@ export class DashboardHttpClient {
             headers["x-danx-session-id"] = this.config.session.id;
         }
         if (args.background === true) {
-            headers["x-danx-plugin-background"] = "1";
+            headers[PLUGIN_BACKGROUND_HEADER] = "1";
         }
         let bodyString;
         if (args.body !== undefined) {

package/dist/index.js

@@ -217,11 +217,12 @@ function boot() {
     permissionRequests = new PermissionRequests({
         access,
         request: (args) => dashboardClient.request(args),
+        requestOwn: (args) => dashboardClient.requestOwn(args),
         log: (line) => console.error(line),
     });
     listenerReminder = createListenerReminder({
         sessionId: config.session?.id,
-        fetchHealth: () => dashboardClient.request({ method: "GET", basePath: "", path: "/api/plans", query: { limit: 1 } }),
+        fetchHealth: () => dashboardClient.requestOwn({ method: "GET", basePath: "", path: "/api/plans", query: { limit: 1 } }),
         isPlanConnected: isPlanConnectedOnThisMachine,
         now: Date.now,
         logLine: (line) => console.error(line),
@@ -270,7 +271,8 @@ function boot() {
 async function readKeyPermissions() {
     if (!access.isSignedIn())
         return { outcome: "no-key" };
-    const guarded = await access.guard(() => client.request({ method: "GET", basePath: "", path: "/api/auth/me" }));
+    // DX-5076: this process reading its own key's permissions is not the agent acting.
+    const guarded = await access.guard(() => client.requestOwn({ method: "GET", basePath: "", path: "/api/auth/me" }));
     if ("halt" in guarded)
         return { outcome: "no-key" };
     const { result } = guarded;

package/dist/permission-request.js

@@ -96,7 +96,7 @@ export class PermissionRequests {
             let guarded;
             try {
                 // `guard` runs before EVERY claim (DX-4418): a revoked or signed-out session answers its halt without a request.
-                guarded = await this.deps.access.guard(() => this.deps.request({ method: "POST", basePath: PERMISSION_REQUESTS_BASE_PATH, path: `/${request.publicId}/claim` }));
+                guarded = await this.deps.access.guard(() => this.deps.requestOwn({ method: "POST", basePath: PERMISSION_REQUESTS_BASE_PATH, path: `/${request.publicId}/claim` }));
             }
             catch (err) {
                 // An outdated MCP will never get a different answer; any other failure is retried until the request ends.

package/dist/route-board-scope.generated.js

@@ -40,6 +40,7 @@ export const GET_ROUTE_BOARD_SCOPE = [
     ["/api/platform/teams", "refuse"],
     ["/api/reminders", "refuse"],
     ["/api/repos", "refuse"],
+    ["/api/security-incidents", "refuse"],
     ["/api/self-repair/errors", "refuse"],
     ["/api/sync-root", "refuse"],
     ["/api/tasks", "refuse"],

package/dist/session-options.js

@@ -10,6 +10,8 @@ import { credentialFingerprint, describeCredentialSource, readCredential } from
 import { readSessionConnection } from "./session-connection.js";
 import { fixForStop } from "./stop-fixes.js";
 export const SESSION_ID_HEADER = "x-danx-session-id";
+/** DX-5033 / DX-5076 - marks a request as this process's own background work (not the agent acting): the dashboard ends no agent pause on it. */
+export const PLUGIN_BACKGROUND_HEADER = "x-danx-plugin-background";
 /** A start this process cannot make, named the way the session will be told about it. */
 export class SessionStartError extends Error {
     // `ListenStopReason`, not `string`: a start-time failure is always one of `no_connection_record` / `credential_unavailable`

package/dist/session-stream.js

@@ -10,7 +10,7 @@ import { errorCodeOf } from "./json-body.js";
 import { boundRequest } from "./request-bound.js";
 import { keyRevocationOf, keyRevokedHalt } from "./key-revoked-halt.js";
 import { oneLine } from "./one-line.js";
-import { SESSION_ID_HEADER } from "./session-options.js";
+import { PLUGIN_BACKGROUND_HEADER, SESSION_ID_HEADER } from "./session-options.js";
 import { isClaimState } from "@thehammer/danx-session-telemetry";
 /**
  * DX-3912 — the longest heartbeat `reason` the relay sends: one under the dashboard's own
@@ -74,6 +74,8 @@ async function request(options, deps, what, url, init = { method: "GET" }) {
                 Authorization: `Bearer ${options.token}`,
                 Accept: "application/json",
                 [SESSION_ID_HEADER]: options.sessionId,
+                // DX-5076: every request this module makes is the relay's own work (ticket mint, inventory read, heartbeat), never the agent acting, so it must not end an agent pause. One marking point, so a new request here cannot forget it.
+                [PLUGIN_BACKGROUND_HEADER]: "1",
             };
             if (init.body !== undefined)
                 headers["Content-Type"] = "application/json";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.301",
+  "version": "0.1.303",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, request_permission, attach_file, and danxbot_slack_reply) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",