@thehammer/danx-dashboard-mcp 0.1.328 → 0.1.330

package/dist/permission-watch.js

@@ -17,6 +17,7 @@
  */
 import { SYNC_ATTEMPTS, retryBounded } from "./bounded-retry.js";
 import { SseParser } from "./listen.js";
+import { PLUGIN_BACKGROUND_HEADER } from "./session-options.js";
 const STREAM_PATH = "/api/stream?topics=key:self";
 const PERMISSIONS_CHANGED = "permissions_changed";
 export const WATCH_INITIAL_BACKOFF_MS = 1_000;
@@ -83,7 +84,8 @@ export class PermissionWatch {
         const healthy = () => opened && this.now() - openedAt >= WATCH_HEALTHY_CONNECTION_MS;
         try {
             const response = await this.fetchImpl(`${this.deps.dashboardUrl.replace(/\/+$/, "")}${STREAM_PATH}`, {
-                headers: { Authorization: `Bearer ${token}`, Accept: "text/event-stream" },
+                // DX-5354: the watch is this process's own work, never the agent acting, so neither its connect nor any reconnect extends the session's key.
+                headers: { Authorization: `Bearer ${token}`, Accept: "text/event-stream", [PLUGIN_BACKGROUND_HEADER]: "1" },
                 signal: controller.signal,
             });
             if (response.status >= 400 && response.status < 500 && !RETRYABLE_REFUSALS.has(response.status)) {

package/dist/restart-notice.js

@@ -42,7 +42,7 @@
  */
 import { z } from "zod";
 import { boundRequest } from "./request-bound.js";
-import { resolveDashboardAuth, SESSION_ID_HEADER, SessionStartError } from "./session-options.js";
+import { PLUGIN_BACKGROUND_HEADER, resolveDashboardAuth, SESSION_ID_HEADER, SessionStartError } from "./session-options.js";
 import { findPredecessorCandidates, projectKeyOf, readSessionConnection } from "./session-connection.js";
 import { checkedTranscriptPath } from "./session-stats.js";
 import { readTranscriptLineage, TranscriptReadAborted, TranscriptUnreadable } from "./transcript-lineage.js";
@@ -64,6 +64,8 @@ export async function sendSessionRequest(options, path, init, deps) {
                     Accept: "application/json",
                     ...(init.body !== undefined ? { "Content-Type": "application/json" } : {}),
                     [SESSION_ID_HEADER]: options.sessionId,
+                    // DX-5354: the session-start hook's lookup is the plugin's own work, never the agent acting, so it does not extend the session's key.
+                    [PLUGIN_BACKGROUND_HEADER]: "1",
                 },
                 body: init.body,
                 signal: bound.signal,

package/dist/route-board-scope.generated.js

@@ -50,6 +50,7 @@ export const GET_ROUTE_BOARD_SCOPE = [
     ["/api/sync-root", "refuse"],
     ["/api/tasks", "refuse"],
     ["/api/team/audit-events", "refuse"],
+    ["/api/team/consumer-tokens", "refuse"],
     ["/api/team/invitations", "refuse"],
     ["/api/team/members", "refuse"],
     ["/api/team/roles", "refuse"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thehammer/danx-dashboard-mcp",
-  "version": "0.1.328",
+  "version": "0.1.330",
   "description": "Stdio MCP server fronting danxbot's dashboard API for agents (operator sessions and dispatched workers alike): the generic danxbot_api/danxbot_api_list/danxbot_api_spec tools reach any route the caller's credential may call, plus dedicated agent-specific tools (plan_connect, request_permission, attach_file, and danxbot_slack_reply) (DX-3465, PLN-11 R-25).",
   "license": "MIT",
   "type": "module",