[jcombs-pointblue]

Needs DirXMLDev 0.50.0 (PointBlueTechnology/DirXMLDev, branch apps-split-files): the image takes bin/apps from the core at its pinned tag. Release core 0.50.0 first, then pin it here.

Why

Someone who installs DirXMLDevWeb should get, for their agents, everything installing DirXMLDev gives: the CLIs, the skills and docs of this version, and an MCP server. The server should act for a person, under that person's roles. Design: docs/agents.md.

What

• MCP at /mcp. JSON-RPC over HTTP POST, stateless; GET answers 405.

  • 22 tools: orientation, edit operations (preview, then apply), commit, compare, compare environments, plan, deploy, rollback, driver control, simulate, trace.
  • Each tool is an in-process call to the server's own API, with the caller's headers. Sign-in, the origin check, roles, the audit log, the per-environment write lock and the production gate are all the API's, unchanged.
  • The server sends agents the rules when they connect.

• Personal agent tokens: agent tokens… next to your name.

  • An agent with your token acts as you: your roles, connections and workspace. The audit log marks it via the token's label.
  • Only a SHA-256 hash is kept, in users/<subject>/agent-tokens.json, owner-only.
  • Roles follow the person each time they use the page. An agent cannot make tokens.
  • Settings: agent.tokens and agent.tokens.maxDays.
  • The dialog shows the claude mcp add command and offers the kit as a download.

• The agent kit:

  • AGENTS.md and CLAUDE.md for this install;
  • the dirxml-dev skill (from DirXMLDev) and the dirxml-policy-testing skill (from DirXMLSimulator), each with a note on where its commands are here;
  • the agent docs.

  It's in the image, setup writes it to agent/, and /api/agent-kit serves it with the server's MCP address. The image workflow now also checks out DirXMLSimulator at its tag.

• sim and apps in the image beside idm. All three run in the person's workspace, through a shared bin/inworkspace.

• Docs: docs/agents.md (new), plus the quickstart, hosted-mode and the CHANGELOG.

Checked

• Automated: 103 server tests (new: AgentTokensTest), 54 page tests, bin/smoke.sh.
• bin/smoke-hosted.sh (110 checks), new ones:
  • a person makes a token, and her agent signs in as her;
  • an agent cannot make tokens;
  • MCP initialize, tools/list, a session as her, her branch's outline;
  • a deploy refused because she's an editor, not a deployer;
  • another host refused; no token gets 401; GET gets 405;
  • revoke stops the token;
  • the audit log marks via.
• bin/smoke-container.sh against a locally built image: sim, apps, /mcp, and the kit with both skills and the MCP address.
• A real local install from the test image (setup, compose up):
  • agent/ is written with the address filled in;
  • the person signs in, makes a token, uses it over MCP (acting as "me" with her roles), and revokes it (then 401);
  • the audit log shows create, sign-in via claude-test, and revoke.

🤖 Generated with Claude Code