@thehammer/danx-dashboard-mcp 0.1.302 → 0.1.304

package/dist/http-client.js

@@ -1,5 +1,6 @@
 import { boardStampOf } from "./route-board-scope.js";
 import { assertVersionFloorSatisfied, MCP_MIN_VERSION_HEADER } from "./version-floor.js";
+import { PLUGIN_BACKGROUND_HEADER } from "./session-options.js";
 export class DashboardHttpClient {
     config;
     fetchImpl;
@@ -17,6 +18,14 @@ export class DashboardHttpClient {
     setToken(token) {
         this.config.token = token;
     }
+    /**
+     * DX-5076 - the ONE entry for a request this process makes on its own (the listener's health read, the key-permission read, the permission claim
+     * poll): it is never the agent acting, so it carries the background mark and ends no agent pause. A call the agent makes (`danxbot_api`, a
+     * permission-request create) goes through `request` instead. No call site sets `background` by hand.
+     */
+    requestOwn(args) {
+        return this.request({ ...args, background: true });
+    }
     async request(args) {
         if (this.config.token === "") {
             // DX-4390 — a caller reaches here only past the sign-in halt; a bearer-less call is a bug.
@@ -51,7 +60,7 @@ export class DashboardHttpClient {
             headers["x-danx-session-id"] = this.config.session.id;
         }
         if (args.background === true) {
-            headers["x-danx-plugin-background"] = "1";
+            headers[PLUGIN_BACKGROUND_HEADER] = "1";
         }
         let bodyString;
         if (args.body !== undefined) {

package/dist/index.js

@@ -217,11 +217,12 @@ function boot() {
     permissionRequests = new PermissionRequests({
         access,
         request: (args) => dashboardClient.request(args),
+        requestOwn: (args) => dashboardClient.requestOwn(args),
         log: (line) => console.error(line),
     });
     listenerReminder = createListenerReminder({
         sessionId: config.session?.id,
-        fetchHealth: () => dashboardClient.request({ method: "GET", basePath: "", path: "/api/plans", query: { limit: 1 } }),
+        fetchHealth: () => dashboardClient.requestOwn({ method: "GET", basePath: "", path: "/api/plans", query: { limit: 1 } }),
         isPlanConnected: isPlanConnectedOnThisMachine,
         now: Date.now,
         logLine: (line) => console.error(line),
@@ -270,7 +271,8 @@ function boot() {
 async function readKeyPermissions() {
     if (!access.isSignedIn())
         return { outcome: "no-key" };
-    const guarded = await access.guard(() => client.request({ method: "GET", basePath: "", path: "/api/auth/me" }));
+    // DX-5076: this process reading its own key's permissions is not the agent acting.
+    const guarded = await access.guard(() => client.requestOwn({ method: "GET", basePath: "", path: "/api/auth/me" }));
     if ("halt" in guarded)
         return { outcome: "no-key" };
     const { result } = guarded;
@@ -396,7 +398,7 @@ function readSessionConfig() {
  */
 const SERVER_INSTRUCTIONS = `\
 \`danxbot_api\` is your primary channel to the dashboard: every card, plan, Slack and dispatch-callback job (ending
-your dispatch included) is a call to it. Find a route with \`danxbot_api_list\`. Read its exact shape with
+yours too) is a call to it. Find a route with \`danxbot_api_list\`. Read its exact shape with
 \`danxbot_api_spec\` before the first call to any route you have not called before; never guess a body.
 
 RESOURCES. Most collections take GET (list) and POST (create); a single resource (\`<collection>/<id>\`) takes
@@ -405,7 +407,7 @@ GET, PATCH or PUT (send only the fields you change) and DELETE. A card is edited
 \`total\` (page with \`limit\` and \`offset\`). Name each other field or relation you need in the \`fields\` query
 tree. \`GET /api/resources/<resource>/fields\` lists the names.
 
-STALE HASH. A write to contested text (a card's title, description or checklists, a plan record, a problem) sends
+STALE HASH. A write to contested text (card text, a plan record, a problem) sends
 back the \`content_hash\` or \`base_hash\` you read from that resource. A stale hash is refused 409 with the current
 hash and content: merge your change into that and retry with the fresh hash.
 
@@ -415,8 +417,11 @@ REFUSALS. A 4xx body is \`{error, ...}\`, and its other fields name the fix: \`o
 WRITING STANDARD, for every title, summary, description, comment, problem, solution and plan record you write. The
 reader is new to the subject and will not read the code or docs: what you write is their documentation. Open with
 plain background (what the thing is, why it exists, what is wrong or what the choice changes) before evidence.
-Define each term a newcomer would not know. Cite exact ids, SHAs and paths. Be brief: less to read, never a
-transcript of your reasoning. A title or summary alone must let the reader decide.
+Define each term a newcomer would not know. Cite exact ids, SHAs and paths. Be brief; never transcribe your
+reasoning. A title or summary alone must let the reader decide.
+
+DESIGN. UI designs and style options go on a Design card (\`design_publish\`), never an Artifact or HTML page.
+Decide choices yourself; show alternatives as design states, never ask.
 `;
 assertWithinTextLimit("the server instructions", SERVER_INSTRUCTIONS);
 export const server = new McpServer({

package/dist/permission-request.js

@@ -96,7 +96,7 @@ export class PermissionRequests {
             let guarded;
             try {
                 // `guard` runs before EVERY claim (DX-4418): a revoked or signed-out session answers its halt without a request.
-                guarded = await this.deps.access.guard(() => this.deps.request({ method: "POST", basePath: PERMISSION_REQUESTS_BASE_PATH, path: `/${request.publicId}/claim` }));
+                guarded = await this.deps.access.guard(() => this.deps.requestOwn({ method: "POST", basePath: PERMISSION_REQUESTS_BASE_PATH, path: `/${request.publicId}/claim` }));
             }
             catch (err) {
                 // An outdated MCP will never get a different answer; any other failure is retried until the request ends.

package/dist/session-options.js

@@ -10,6 +10,8 @@ import { credentialFingerprint, describeCredentialSource, readCredential } from
 import { readSessionConnection } from "./session-connection.js";
 import { fixForStop } from "./stop-fixes.js";
 export const SESSION_ID_HEADER = "x-danx-session-id";
+/** DX-5033 / DX-5076 - marks a request as this process's own background work (not the agent acting): the dashboard ends no agent pause on it. */
+export const PLUGIN_BACKGROUND_HEADER = "x-danx-plugin-background";
 /** A start this process cannot make, named the way the session will be told about it. */
 export class SessionStartError extends Error {
     // `ListenStopReason`, not `string`: a start-time failure is always one of `no_connection_record` / `credential_unavailable`

package/dist/session-stream.js

@@ -10,7 +10,7 @@ import { errorCodeOf } from "./json-body.js";
 import { boundRequest } from "./request-bound.js";
 import { keyRevocationOf, keyRevokedHalt } from "./key-revoked-halt.js";
 import { oneLine } from "./one-line.js";
-import { SESSION_ID_HEADER } from "./session-options.js";
+import { PLUGIN_BACKGROUND_HEADER, SESSION_ID_HEADER } from "./session-options.js";
 import { isClaimState } from "@thehammer/danx-session-telemetry";
 /**
  * DX-3912 — the longest heartbeat `reason` the relay sends: one under the dashboard's own
@@ -74,6 +74,8 @@ async function request(options, deps, what, url, init = { method: "GET" }) {
                 Authorization: `Bearer ${options.token}`,
                 Accept: "application/json",
                 [SESSION_ID_HEADER]: options.sessionId,
+                // DX-5076: every request this module makes is the relay's own work (ticket mint, inventory read, heartbeat), never the agent acting, so it must not end an agent pause. One marking point, so a new request here cannot forget it.
+                [PLUGIN_BACKGROUND_HEADER]: "1",
             };
             if (init.body !== undefined)
                 headers["Content-Type"] = "application/json";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.302",
+  "version": "0.1.304",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, request_permission, attach_file, and danxbot_slack_reply) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",