@absolutejs/mcp 0.17.1 → 0.17.3

package/CHANGELOG.md

@@ -6,6 +6,19 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.17.3 — 2026-09-11
+
+### Fixed
+
+- **Authorize session deletion, recover explicit client initialization after expiry, and preserve typed HTTP failures without replaying tools**
+- **Accept the standard protocol-header compatibility fallback used by VS Code Copilot and record native report rendering evidence**
+
+## 0.17.2 — 2026-09-11
+
+### Added
+
+- **Record verified Claude web rendering, refresh, pagination and narrow-viewport host canary evidence**
+
 ## 0.17.1 — 2026-09-11
 
 ### Added

package/canary/results/2026-09-11-claude-web.json

@@ -0,0 +1,30 @@
+{
+  "date": "2026-09-11",
+  "runtimePackage": "@absolutejs/mcp@0.17.1",
+  "host": "Claude web custom connector",
+  "browser": "Windows Chrome 152.0.7977.83",
+  "data": "synthetic only",
+  "protocol": "2025-06-18",
+  "appsMimeType": "text/html;profile=mcp-app",
+  "successfulCalls": {
+    "get_billing_status": 2,
+    "get_usage_report": 2,
+    "list_receipts": 2
+  },
+  "observed": [
+    "Three native report views rendered",
+    "Balance refresh succeeded",
+    "Usage refresh and daily row expansion succeeded",
+    "Receipt pagination ended with empty page and hidden Older receipts button",
+    "No extra tool calls from initial rendering or page reload",
+    "390px desktop viewport: app widths 322px; no horizontal document overflow"
+  ],
+  "notVerified": [
+    "Native mobile application",
+    "OAuth login",
+    "Account isolation",
+    "Expired-session reconnect",
+    "IDE hosts"
+  ],
+  "cleanup": "Temporary connector and development route removed"
+}

package/canary/results/2026-09-11-vscode.json

@@ -0,0 +1,28 @@
+{
+  "date": "2026-09-11",
+  "runtimePackage": "@absolutejs/mcp@0.17.3 pre-release build",
+  "host": "Visual Studio Code 1.135.0, native Windows Copilot Chat",
+  "transport": "Streamable HTTP, isolated loopback synthetic workspace",
+  "protocol": "2025-11-25",
+  "protocolHeader": null,
+  "appsMimeType": "text/html;profile=mcp-app",
+  "successfulCalls": {
+    "get_billing_status": 2,
+    "get_usage_report": 2,
+    "list_receipts": 2
+  },
+  "observed": [
+    "All three native report views rendered after window reload",
+    "Balance and usage refresh succeeded",
+    "Daily usage expanded",
+    "Receipt pagination reached empty final page and hid Older receipts",
+    "Initial render and window reload made no extra report calls",
+    "All three app documents measured 242px with no horizontal document overflow"
+  ],
+  "limitations": [
+    "Initial balance webview was blank; window reload restored it; cause not isolated",
+    "Window reload restores original tool results, including first receipt page",
+    "OAuth, real-account isolation and expired-session reconnect against authenticated staging not tested",
+    "Host commerce permissions not certified"
+  ]
+}

package/canary/server.ts

@@ -49,7 +49,6 @@ const handler = createMcpHandler({
   issuer: "http://127.0.0.1:4428",
   path: "/mcp",
   serverInfo: { name: "absolute-billing-canary", version: "1" },
-  supportedProtocols: ["2025-06-18"],
   authorize: async () => ({
     ok: true,
     caller: "synthetic-fixture",
@@ -110,6 +109,7 @@ Bun.serve({
       JSON.stringify({
         method: rpc?.method ?? request.method,
         status: response.status,
+        protocolHeader: request.headers.get("mcp-protocol-version"),
         ...(rpc?.method === "initialize"
           ? {
               client: rpc.params?.clientInfo?.name,

package/changelog.json

@@ -2,6 +2,30 @@
   "contract": 1,
   "name": "@absolutejs/mcp",
   "releases": [
+    {
+      "version": "0.17.3",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "fixed",
+          "summary": "Authorize session deletion, recover explicit client initialization after expiry, and preserve typed HTTP failures without replaying tools"
+        },
+        {
+          "kind": "fixed",
+          "summary": "Accept the standard protocol-header compatibility fallback used by VS Code Copilot and record native report rendering evidence"
+        }
+      ]
+    },
+    {
+      "version": "0.17.2",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Record verified Claude web rendering, refresh, pagination and narrow-viewport host canary evidence"
+        }
+      ]
+    },
     {
       "version": "0.17.1",
       "date": "2026-09-11",

package/dist/index.js

@@ -735,14 +735,25 @@ var createMcpClient = (options) => {
           });
         }
       }
-      const captured = response.headers.get("mcp-session-id");
-      if (captured)
-        sessionId = captured;
       if (response.status === 401) {
         throw new McpClientError("The MCP server rejected the credentials", {
           status: 401
         });
       }
+      if (!response.ok) {
+        if (response.status === 404 && sessionId === headers["mcp-session-id"]) {
+          sessionId = null;
+        }
+        const failure = await parseBody(response, maxBytes).catch(() => null);
+        const error = isRecord(failure) && isRecord(failure.error) ? failure.error : null;
+        throw new McpClientError(typeof error?.message === "string" ? error.message : `MCP HTTP request failed (${response.status})`, {
+          status: response.status,
+          code: typeof error?.code === "number" ? error.code : undefined
+        });
+      }
+      const captured = response.headers.get("mcp-session-id");
+      if (captured)
+        sessionId = captured;
       const isStream = (response.headers.get("content-type") ?? "").includes("text/event-stream");
       const payload = isStream ? await consumeSseStream(response, maxBytes, answerServer) : await parseBody(response, maxBytes);
       if (!isRecord(payload)) {
@@ -776,6 +787,7 @@ var createMcpClient = (options) => {
     });
   };
   const initialize = async () => {
+    sessionId = null;
     const result2 = await rpc("initialize", {
       capabilities: {
         ...options.onElicit ? { elicitation: { form: {}, url: {} } } : {},
@@ -2197,15 +2209,15 @@ var runMcpPost = async (config, request, body) => {
     return rpcError(null, JSONRPC_INVALID_REQUEST, "Batching is not supported");
   }
   const isInitialize = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
-  const protocolVersion = request.headers.get("mcp-protocol-version");
+  const protocolVersion = request.headers.get("mcp-protocol-version") ?? "2025-03-26";
   const supportedProtocols = config.supportedProtocols ?? [
     MCP_LATEST_PROTOCOL_VERSION,
     "2025-06-18",
     "2025-03-26",
     "2024-11-05"
   ];
-  if (!isInitialize && (protocolVersion === null || !supportedProtocols.includes(protocolVersion))) {
-    return new Response("Missing or unsupported MCP-Protocol-Version", {
+  if (!isInitialize && !supportedProtocols.includes(protocolVersion)) {
+    return new Response("Unsupported MCP-Protocol-Version", {
       status: 400
     });
   }
@@ -2215,13 +2227,17 @@ var runMcpPost = async (config, request, body) => {
     return new Response(null, { status: HTTP_NOT_FOUND });
   }
   return dispatchMcp(config, auth.caller, auth.scopes ?? [], body, {
-    protocolVersion: protocolVersion ?? MCP_LATEST_PROTOCOL_VERSION,
+    protocolVersion,
     requestSignal: request.signal,
     sessionId,
     sessions
   }).catch(() => rpcError(null, JSONRPC_INVALID_REQUEST, "Internal error"));
 };
 var runMcpDelete = async (config, request) => {
+  const auth = await config.authorize(request);
+  if (!auth.ok) {
+    return unauthorized(`${config.issuer}${metadataPathFor(config.path)}`, auth.reason);
+  }
   const sessions = registryFor(config);
   const sessionId = request.headers.get("mcp-session-id");
   if (!sessions || !sessionId) {

package/docs/host-canaries.md

@@ -4,7 +4,7 @@ The package ships `canary/server.ts`: a loopback-only, synthetic billing endpoin
 
 From an installed package, run `bun node_modules/@absolutejs/mcp/canary/server.ts`. From this repository, build first, then `bun run canary`. The fixed endpoint is `http://127.0.0.1:4428/mcp`. Startup validates all four report calls before listening. Stop it with Ctrl-C after the test. A port conflict fails startup rather than replacing another service.
 
-The JSONL log records protocol methods, status, client name/version, negotiated protocol, advertised Apps MIME types and tool success. It omits headers, session IDs, tool arguments and report bodies. Keep host transcripts local: host logs can contain unrelated account or environment information. Commit only reviewed evidence.
+The JSONL log records protocol methods, status, client name/version, negotiated protocol, advertised Apps MIME types and tool success. It records only the MCP protocol-version header and omits all other headers, session IDs, tool arguments and report bodies. Keep host transcripts local: host logs can contain unrelated account or environment information. Commit only reviewed evidence.
 
 ## Host connections
 
@@ -42,19 +42,37 @@ Record the exact host version/surface, transport, requested and negotiated proto
 
 ## Observed September 11, 2026
 
-Tests ran against the built `0.17.0` runtime, with the reusable canary distributed starting in `0.17.1`.
+Terminal tests ran against the built `0.17.0` runtime. The later Claude web test used the published `0.17.1` canary.
 
 | Host                                             | Negotiation                                                              | Observed result                                                                                            |
 | ------------------------------------------------ | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |
 | Claude Code 2.1.265, print mode, Streamable HTTP | Requested 2025-11-25; accepted server 2025-06-18; no Apps MIME extension | Four read calls passed, including cursor pagination; text/structured fallback; no embedded rendering claim |
 | Codex CLI 0.154.0, exec mode, Streamable HTTP    | Requested and accepted 2025-06-18; no Apps MIME extension                | Four read calls passed, including cursor pagination; text/structured fallback; no embedded rendering claim |
-| Claude web                                       | Browser redirected to sign-in                                            | Not tested; requires signed-in test session and reachable synthetic staging endpoint                       |
-| VS Code 1.135.0                                  | Installed version confirmed                                              | Interactive Copilot/MCP Apps UI not exercised                                                              |
+| Claude web, Windows Chrome 152.0.7977.83         | Apps MIME advertised; accepted 2025-06-18                                | Three native views, refresh and pagination passed                                                          |
+| VS Code 1.135.0                                  | Apps MIME advertised; negotiated 2025-11-25; omitted protocol header     | Three views, refresh and pagination verified after compatibility fix; initial balance required reload      |
 | Cursor, Gemini CLI, goose                        | Executables unavailable in this environment                              | Not tested                                                                                                 |
 | ChatGPT hosted surfaces                          | No host canary performed                                                 | Not tested                                                                                                 |
 
 Both tested terminal clients tolerated GET 405 (no standalone SSE stream) and discovered all three tools. Claude Code also sent a `server/discover` probe that received 400 before successful initialization. These observations do not establish support in other versions or distributions. Initial fixture-development attempts failed receipt validation; the final fixture uses the billing package cursor encoder, supplies a valid receipt ID, and validates its records before listening.
 
-The remaining release gates are real conversational/IDE rendering, authenticated staging reconnect/isolation, then the product's migration and commerce approval gates. This evidence does not enable any host commerce profile.
+The remaining release gates are other host surfaces including IDE rendering, authenticated staging reconnect/isolation, then the product's migration and commerce approval gates. This evidence does not enable any host commerce profile.
 
 Sources: [Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp?surface=cli), [VS Code MCP servers](https://code.visualstudio.com/docs/copilot/customization/mcp-servers), and the installed `claude --help` / `claude mcp --help` output. Host observations above come from actual local runs, not documentation claims.
+
+## Claude web rendering evidence
+
+The signed-in custom-connector test used the published 0.17.1 synthetic canary and native Windows Chrome 152.0.7977.83. Claude identified the reports as three interactive tools. All three HTML resource reads and initial tool calls succeeded. There were exactly three initial report calls; loading/reloading the views did not issue extra tool calls. Explicit balance refresh, usage refresh and Older receipts produced three further successful read calls. Daily usage expanded correctly. The final receipt page was empty and the Older receipts button disappeared. At a 390-pixel desktop viewport the embedded views had 322-pixel widths and no horizontal document overflow. This is not a native mobile-app check.
+
+A temporary public tunnel allowed discovery but failed tool execution before reaching the handler. The passing run used a dedicated HTTPS development endpoint forwarding to the unchanged synthetic fixture. The temporary connector and route were removed afterward. No production application, billing data, OAuth grants or commerce profiles were changed. Reviewed aggregate evidence is in `canary/results/2026-09-11-claude-web.json`; it includes no endpoint addresses, headers, session IDs, credentials or chat transcripts. Patch 0.17.2 distributes this evidence; report runtime code is unchanged.
+
+For Windows/WSL testing, a headed Linux browser may not appear on the Windows desktop. Use a native Windows test browser with a separate persistent profile and loopback CDP endpoint. Reuse one Playwright CDP connection. If existing cross-origin frames are missing from automation, reload with that connection established; Claude uses a wrapper frame and a nested `about:blank` app frame. Never commit browser profiles or credentials.
+
+Conversational rendering is verified for this exact surface. Cursor interactive rendering and authenticated staging reconnect/account-isolation remain separate open gates.
+
+## VS Code Copilot and session compatibility (0.17.3)
+
+Native Windows VS Code 1.135.0 advertised Apps MIME support but omitted MCP-Protocol-Version on subsequent requests. The shared handler now applies the specified 2025-03-26 fallback for an absent header; explicitly unsupported values still return 400. The fixture now uses default supported protocols instead of forcing a downgrade. See the [MCP transport specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#protocol-version-header).
+
+Three report views rendered in the signed-in isolated Copilot workspace. Balance and usage refresh, daily expansion and receipt pagination passed. There were six report calls: three initial calls and three explicit button actions. Reloading restored the original report results with no extra report calls. All app documents measured 242px without horizontal document overflow. The first balance webview was blank until a window reload; its cause is not isolated, so this is a qualified rendering result, not proof of reliable first-load behavior. Reviewed aggregate evidence: `canary/results/2026-09-11-vscode.json`.
+
+Package regressions verify authorization before session deletion, per-request account selection, expired-session HTTP 404, and fresh explicit client initialization. HTTP failures now produce McpClientError with status (and a JSON-RPC code when available), including empty/non-JSON responses. After a session 404, call client.initialize() to negotiate a fresh session before further operations. The failed tool is never automatically replayed; callers must decide whether retrying is appropriate. Synthetic credentials prove handler behavior, not OAuth correctness or real-tenant isolation. Authenticated staging remains a separate release gate.

package/package.json

@@ -86,5 +86,5 @@
     "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.17.1"
+  "version": "0.17.3"
 }