tina4ruby 3.13.50 → 3.13.51

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e5481c75ff116f52ef9981a60239741d14ebb21949d167e64760f6f618db2d0
-  data.tar.gz: 1eef903d1d00d45d21beef778ca31ffc5400208bd0ebebf0271cbe660e2b86d7
+  metadata.gz: acbf145f4e91880ca9b0763788134071b914c5923f3cdc84fc459a333097bb11
+  data.tar.gz: 04e0793ef84e6d044e578d6183526c05c45edd3f68dd04f2c1801458296d130c
 SHA512:
-  metadata.gz: afabfb4f602eab2b0e8f6d0be151f2f1bfb131f6c928d2627010b896b105fc6260f0d4647c42d07c5752a267c84222df2b080b8e7ac8c43b8406e8528832037c
-  data.tar.gz: 1249983018db2293240fe6d66d2938197a8e00febdb0dd818bd490c077ac49e794ea5f70bf8601db5863db452306458fb95a4c6064e588d71e7e5b04719b56b0
+  metadata.gz: 6cd653a5682bf5f1257ae0290a36d5b6784afb16c67e5433b56480c25d750003fa3f9d1560aa1246c2ec71c7720ce0073cf9e1f10703b7e031effe3a5d36e29c
+  data.tar.gz: 17e2ccf01f62cd8b5ce17d7606c50f8e2882e7e6c1ad32fd0021ff980b7850fccda44a818c2370ae832387fae745e22fefbb510f49a0a7c4f187f31d4cc38356

data/lib/tina4/dev_admin.rb

@@ -339,12 +339,13 @@ module Tina4
         return unless enabled?
 
         port = ENV["TINA4_PORT"] || ENV["PORT"] || "7147"
-        url  = "http://localhost:#{port}/__dev/api/mcp"
+        url  = "http://localhost:#{port}/__dev/mcp"
         target_dir = File.join(project_root, ".tina4")
         target = File.join(target_dir, "mcp.json")
         payload = {
           "mcpServers" => {
             "tina4-live-docs" => {
+              "type" => "http",
               "url" => url,
               "description" => "Live API docs for this Tina4 project (framework + user code)",
             },
@@ -659,8 +660,14 @@ module Tina4
             body = read_json_body(env) || {}
             json_response(mcp_tool_call(body))
           end
-        when ["POST", "/__dev/mcp"], ["POST", "/__dev/mcp/message"]
-          with_mcp_gate(env) { mcp_jsonrpc(env) }
+        when ["POST", "/__dev/mcp"]
+          with_mcp_gate(env) { mcp_streamable(env) }
+        when ["DELETE", "/__dev/mcp"]
+          with_mcp_gate(env) { mcp_delete(env) }
+        when ["GET", "/__dev/mcp"]
+          with_mcp_gate(env) { mcp_get_405 }
+        when ["POST", "/__dev/mcp/message"]
+          with_mcp_gate(env) { mcp_legacy_message(env) }
         when ["GET", "/__dev/mcp/sse"]
           with_mcp_gate(env) { mcp_sse_handshake }
         when ["GET", "/__dev/api/scaffold"]
@@ -1683,15 +1690,45 @@ module Tina4
       # clients POST a JSON-RPC 2.0 request; we hand the parsed body straight
       # to the default server's handle_message and echo the response. A
       # notification (no id) yields an empty 204, mirroring Python.
-      def mcp_jsonrpc(env)
-        body = read_json_body(env) || {}
+      # Streamable HTTP POST /__dev/mcp — the current MCP transport. initialize
+      # issues an Mcp-Session-Id; an unknown session on a non-initialize request
+      # is a 404; a notification is 202; anything else answers inline (200).
+      def mcp_streamable(env)
         server = Tina4._default_mcp_server
-        raw = server.handle_message(body)
-        if raw.nil? || raw.empty?
-          [204, { "content-type" => "application/json; charset=utf-8" }, []]
-        else
-          [200, { "content-type" => "application/json; charset=utf-8" }, [raw]]
-        end
+        out = server.dispatch_http(read_json_body(env) || {}, mcp_session_id(env))
+        mcp_triple(out)
+      end
+
+      # Legacy HTTP+SSE POST /__dev/mcp/message — inline, session-lenient.
+      def mcp_legacy_message(env)
+        server = Tina4._default_mcp_server
+        out = server.dispatch_http(read_json_body(env) || {}, "")
+        mcp_triple(out)
+      end
+
+      # DELETE /__dev/mcp — terminate the session (Streamable HTTP spec).
+      def mcp_delete(env)
+        Tina4._default_mcp_server.close_session(mcp_session_id(env))
+        [204, {}, []]
+      end
+
+      # GET /__dev/mcp — a server->client stream we do not open here.
+      def mcp_get_405
+        [405,
+         { "allow" => "POST, DELETE", "content-type" => "application/json; charset=utf-8" },
+         [McpProtocol.encode_error(nil, McpProtocol::INVALID_REQUEST, "Method Not Allowed")]]
+      end
+
+      # Read the Mcp-Session-Id request header (Rack: HTTP_MCP_SESSION_ID).
+      def mcp_session_id(env)
+        (env["HTTP_MCP_SESSION_ID"] || "").to_s
+      end
+
+      # Turn a dispatch_http result hash into a Rack [status, headers, body].
+      def mcp_triple(out)
+        headers = { "content-type" => "application/json; charset=utf-8" }.merge(out[:headers] || {})
+        body = out[:body].to_s
+        [out[:status], headers, body.empty? ? [] : [body]]
       end
 
       # SSE handshake (GET /__dev/mcp/sse). Tells the client where to POST

data/lib/tina4/mcp.rb

@@ -22,6 +22,7 @@ require "json"
 require "socket"
 require "fileutils"
 require "open3"
+require "securerandom"
 
 module Tina4
   # ── JSON-RPC 2.0 codec ────────────────────────────────────────────
@@ -216,6 +217,12 @@ module Tina4
 
   # ── McpServer ─────────────────────────────────────────────────────
   class McpServer
+    # MCP protocol versions this server can speak, newest first. The 2025-*
+    # versions are the Streamable HTTP era; 2024-11-05 is the legacy HTTP+SSE
+    # transport we still accept for older clients (Claude Desktop et al.).
+    SUPPORTED_PROTOCOL_VERSIONS = %w[2025-06-18 2025-03-26 2024-11-05].freeze
+    LATEST_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS.first
+
     attr_reader :path, :name, :version
 
     # Class-level registry of all MCP server instances
@@ -231,6 +238,10 @@ module Tina4
       @tools       = {}
       @resources   = {}
       @initialized = false
+      # Streamable HTTP sessions: id => opened-at epoch. `initialize` mints one
+      # (returned in the Mcp-Session-Id header); a request bearing an unknown id
+      # gets a 404 so the client re-initializes.
+      @sessions    = {}
       self.class.instances << self
     end
 
@@ -292,23 +303,102 @@ module Tina4
       end
     end
 
-    # Register HTTP routes for this MCP server on the Tina4 router.
+    # ── Streamable HTTP transport ─────────────────────────────────────
+    # Session lifecycle + protocol negotiation shared by every transport
+    # entry point so the wire behaviour is identical across all 4 frameworks.
+
+    # Mint a new session id and remember it. Called on `initialize`.
+    def open_session
+      sid = SecureRandom.hex(16)
+      @sessions[sid] = Time.now.to_f
+      sid
+    end
+
+    # True when +session_id+ was issued by this server and is still open.
+    def is_valid_session(session_id)
+      !session_id.to_s.empty? && @sessions.key?(session_id)
+    end
+
+    # Forget a session (client DELETE or SSE stream close). Returns true when a
+    # live session was actually removed.
+    def close_session(session_id)
+      !@sessions.delete(session_id).nil?
+    end
+
+    # Pick the protocol version to run on. Echo the client's requested version
+    # when we support it (proper negotiation), else fall back to the newest
+    # version we speak so an unversioned/old client still connects.
+    def negotiate_protocol_version(requested)
+      return requested if SUPPORTED_PROTOCOL_VERSIONS.include?(requested)
+
+      LATEST_PROTOCOL_VERSION
+    end
+
+    # Transport-agnostic Streamable HTTP POST handler. Every transport calls
+    # this so the wire behaviour stays identical:
+    #   - `initialize` mints a session id, returned in the Mcp-Session-Id header.
+    #   - a non-initialize request carrying an unknown session id is a 404
+    #     (JSON-RPC error) so the client knows to re-initialize.
+    #   - a notification / response-only POST (no id) yields 202 with an empty
+    #     body.
+    #   - anything else returns 200 with the JSON-RPC response as
+    #     application/json (the MCP Streamable HTTP spec permits a POST that
+    #     resolves to a single response to answer inline).
+    # Returns { status:, headers:, body: }.
+    def dispatch_http(raw_data, session_id = "")
+      is_init = peek_method(raw_data) == "initialize"
+      if !is_init && !session_id.to_s.empty? && !is_valid_session(session_id)
+        return {
+          status: 404,
+          headers: {},
+          body: McpProtocol.encode_error(nil, McpProtocol::INVALID_REQUEST, "session not found")
+        }
+      end
+
+      body = handle_message(raw_data)
+      headers = {}
+      headers["Mcp-Session-Id"] = open_session if is_init
+      return { status: 202, headers: headers, body: "" } if body.nil? || body.empty?
+
+      { status: 200, headers: headers, body: body }
+    end
+
+    # Register HTTP routes for this MCP server on the Tina4 router. Custom
+    # (developer-created) MCP servers use this; the built-in dev server mounts
+    # the same transport via DevAdmin's dispatcher.
     def register_routes(router = nil)
-      server   = self
-      msg_path = "#{@path}/message"
-      sse_path = "#{@path}/sse"
+      server    = self
+      base_path = @path
+      msg_path  = "#{@path}/message"
+      sse_path  = "#{@path}/sse"
+
+      # Streamable HTTP (current transport) — single POST endpoint.
+      Tina4::Router.post(base_path) do |request, response|
+        out = server.dispatch_http(request.body, (request.header("mcp-session-id") || "").to_s)
+        out[:headers].each { |k, v| response.header(k, v) }
+        response.call(out[:body], out[:status], "application/json")
+      end
 
+      # DELETE terminates the session (Streamable HTTP spec).
+      Tina4::Router.delete(base_path) do |request, response|
+        server.close_session((request.header("mcp-session-id") || "").to_s)
+        response.call("", 204)
+      end
+
+      # GET on the endpoint is a server->client stream we do not open here.
+      Tina4::Router.get(base_path) do |_request, response|
+        response.header("allow", "POST, DELETE")
+        response.call({ "error" => "Method Not Allowed" }, 405, "application/json")
+      end
+
+      # Legacy HTTP+SSE POST target — inline, session-lenient.
       Tina4::Router.post(msg_path) do |request, response|
-        body = request.body
-        raw  = body.is_a?(Hash) ? body : (body.is_a?(String) ? body : body.to_s)
-        result = server.handle_message(raw)
-        if result.nil? || result.empty?
-          response.call("", 204)
-        else
-          response.call(JSON.parse(result))
-        end
+        out = server.dispatch_http(request.body, "")
+        out[:headers].each { |k, v| response.header(k, v) }
+        response.call(out[:body], out[:status], "application/json")
       end
 
+      # Legacy HTTP+SSE handshake — one-shot endpoint event.
       Tina4::Router.get(sse_path) do |request, response|
         endpoint_url = "#{request.url.sub(%r{/sse\z}, "")}/message"
         sse_data = "event: endpoint\ndata: #{endpoint_url}\n\n"
@@ -334,7 +424,8 @@ module Tina4
       config["mcpServers"] ||= {}
       server_key = @name.downcase.gsub(" ", "-")
       config["mcpServers"][server_key] = {
-        "url" => "http://localhost:#{port}#{@path}/sse"
+        "type" => "http",
+        "url"  => "http://localhost:#{port}#{@path}"
       }
 
       File.write(config_file, JSON.pretty_generate(config) + "\n")
@@ -352,10 +443,24 @@ module Tina4
 
     private
 
-    def _handle_initialize(_params)
+    # Read the JSON-RPC `method` from a raw request without dispatching. Used by
+    # the transport to spot `initialize` (mint a session) before handing the
+    # message to handle_message. Accepts a parsed Hash or a raw JSON string.
+    def peek_method(raw_data)
+      obj = if raw_data.is_a?(Hash)
+              raw_data
+            else
+              str = raw_data.to_s
+              str.empty? ? {} : (JSON.parse(str) rescue nil)
+            end
+      obj.is_a?(Hash) ? obj["method"] : nil
+    end
+
+    def _handle_initialize(params)
       @initialized = true
+      requested = params.is_a?(Hash) ? params["protocolVersion"] : nil
       {
-        "protocolVersion" => "2024-11-05",
+        "protocolVersion" => negotiate_protocol_version(requested),
         "capabilities"    => {
           "tools"     => { "listChanged" => false },
           "resources" => { "subscribe" => false, "listChanged" => false }

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.50"
+  VERSION = "3.13.51"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.50
+  version: 3.13.51
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-02 00:00:00.000000000 Z
+date: 2026-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack