fix(server): say up front that attach pauses the target (#654) - #660

Fixes #654

Problem

attach_to_process (and the inline attach in create_debug_session) defaults stopOnEntry to true: thread verification, then a DAP pause. The docs said so, but the in-band schema an agent actually reads said only "Stop on entry after attaching", and create_debug_session did not advertise stopOnEntry at all even though its handler forwards it. start_debugging defaults the same flag to false, so an agent carrying that expectation over to a live server got state: "running" back and a frozen server nine seconds later, with nothing in the response saying a pause was coming.

Changes

• Schema (src/server/tool-schemas.ts): attach_to_process.stopOnEntry and a new create_debug_session.stopOnEntry state the default and the live-service case; start_debugging.dapLaunchArgs.stopOnEntry documents its opposite default; the create_debug_session description says attaching pauses. 24 tool-list snapshots regenerated — exactly those four hunks.
• Self-announcing pending pause (attach-controller.ts, session-tools.ts, error-messages.ts): when the post-attach pause has not landed by the time the tool answers, both message fields end with ; post-attach pause pending — the target stops when it next executes code (pass stopOnEntry: false to attach without pausing) next to the existing pending: true. Observed pauses and stopOnEntry: false keep the plain message. state stays "running" because that is true at that moment.
• set_breakpoint attach rejection (src/server.ts): the remedy is feature-specific — an expectedContent caller already passed line, so "use line addressing instead" read as a contradiction; it now says to drop expectedContent and keep line. statement keeps "use line addressing instead".
• Docs/skill: tool-reference (new create_debug_session param, a running + pending example, launch/attach contrast), agent guide, skills/debugging/SKILL.md attach bullet, javascript README, and the cpp/kubernetes notes that claimed the default was C/C++-specific.
• changelog.d/654.fixed.md.

Deliberately unchanged: the attach default itself (item 3 of the issue). Seven e2e attach tests across python/js/java/dotnet/ruby pin "omitted stopOnEntry ⇒ paused"; flipping it is a cross-language behavior change that deserves its own issue.

Verification

• npm run typecheck, typecheck:tests (ratchet unchanged), lint, changelog:check; targeted unit tests (attach controller pending message, inline-attach envelope, rejection wording, snapshot fence).
• Live, through a server built from this branch against node --inspect targets (the mcp-debugger HTTP server itself and an idle http server): omitted stopOnEntry → paused with the target frozen until continue_execution; stopOnEntry: false → running with the target still answering curl; set_breakpoint {line, expectedContent} / {statement} → the new wordings.
• Two defects found while dogfooding were filed separately: http: a client that drops without DELETE leaves its attach session holding the target paused for the 30-minute stale window, invisible to every other client #658 (a client that drops without DELETE leaves its paused attach target held for the 30-minute stale window) and Thrown McpErrors reach SDK clients with a doubled "MCP error -32602: MCP error -32602: …" prefix #659 (doubled MCP error prefix on thrown McpErrors).

🤖 Generated with Claude Code

https://claude.ai/code/session_01DP1W22KJbkHZi4ueAtMFPF