@absolutejs/mcp 0.17.2 → 0.17.3

package/CHANGELOG.md

@@ -6,6 +6,13 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.17.3 — 2026-09-11
+
+### Fixed
+
+- **Authorize session deletion, recover explicit client initialization after expiry, and preserve typed HTTP failures without replaying tools**
+- **Accept the standard protocol-header compatibility fallback used by VS Code Copilot and record native report rendering evidence**
+
 ## 0.17.2 — 2026-09-11
 
 ### Added

package/canary/results/2026-09-11-vscode.json

@@ -0,0 +1,28 @@
+{
+  "date": "2026-09-11",
+  "runtimePackage": "@absolutejs/mcp@0.17.3 pre-release build",
+  "host": "Visual Studio Code 1.135.0, native Windows Copilot Chat",
+  "transport": "Streamable HTTP, isolated loopback synthetic workspace",
+  "protocol": "2025-11-25",
+  "protocolHeader": null,
+  "appsMimeType": "text/html;profile=mcp-app",
+  "successfulCalls": {
+    "get_billing_status": 2,
+    "get_usage_report": 2,
+    "list_receipts": 2
+  },
+  "observed": [
+    "All three native report views rendered after window reload",
+    "Balance and usage refresh succeeded",
+    "Daily usage expanded",
+    "Receipt pagination reached empty final page and hid Older receipts",
+    "Initial render and window reload made no extra report calls",
+    "All three app documents measured 242px with no horizontal document overflow"
+  ],
+  "limitations": [
+    "Initial balance webview was blank; window reload restored it; cause not isolated",
+    "Window reload restores original tool results, including first receipt page",
+    "OAuth, real-account isolation and expired-session reconnect against authenticated staging not tested",
+    "Host commerce permissions not certified"
+  ]
+}

package/canary/server.ts

@@ -49,7 +49,6 @@ const handler = createMcpHandler({
   issuer: "http://127.0.0.1:4428",
   path: "/mcp",
   serverInfo: { name: "absolute-billing-canary", version: "1" },
-  supportedProtocols: ["2025-06-18"],
   authorize: async () => ({
     ok: true,
     caller: "synthetic-fixture",
@@ -110,6 +109,7 @@ Bun.serve({
       JSON.stringify({
         method: rpc?.method ?? request.method,
         status: response.status,
+        protocolHeader: request.headers.get("mcp-protocol-version"),
         ...(rpc?.method === "initialize"
           ? {
               client: rpc.params?.clientInfo?.name,

package/changelog.json

@@ -2,6 +2,20 @@
   "contract": 1,
   "name": "@absolutejs/mcp",
   "releases": [
+    {
+      "version": "0.17.3",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "fixed",
+          "summary": "Authorize session deletion, recover explicit client initialization after expiry, and preserve typed HTTP failures without replaying tools"
+        },
+        {
+          "kind": "fixed",
+          "summary": "Accept the standard protocol-header compatibility fallback used by VS Code Copilot and record native report rendering evidence"
+        }
+      ]
+    },
     {
       "version": "0.17.2",
       "date": "2026-09-11",

package/dist/index.js

@@ -735,14 +735,25 @@ var createMcpClient = (options) => {
           });
         }
       }
-      const captured = response.headers.get("mcp-session-id");
-      if (captured)
-        sessionId = captured;
       if (response.status === 401) {
         throw new McpClientError("The MCP server rejected the credentials", {
           status: 401
         });
       }
+      if (!response.ok) {
+        if (response.status === 404 && sessionId === headers["mcp-session-id"]) {
+          sessionId = null;
+        }
+        const failure = await parseBody(response, maxBytes).catch(() => null);
+        const error = isRecord(failure) && isRecord(failure.error) ? failure.error : null;
+        throw new McpClientError(typeof error?.message === "string" ? error.message : `MCP HTTP request failed (${response.status})`, {
+          status: response.status,
+          code: typeof error?.code === "number" ? error.code : undefined
+        });
+      }
+      const captured = response.headers.get("mcp-session-id");
+      if (captured)
+        sessionId = captured;
       const isStream = (response.headers.get("content-type") ?? "").includes("text/event-stream");
       const payload = isStream ? await consumeSseStream(response, maxBytes, answerServer) : await parseBody(response, maxBytes);
       if (!isRecord(payload)) {
@@ -776,6 +787,7 @@ var createMcpClient = (options) => {
     });
   };
   const initialize = async () => {
+    sessionId = null;
     const result2 = await rpc("initialize", {
       capabilities: {
         ...options.onElicit ? { elicitation: { form: {}, url: {} } } : {},
@@ -2197,15 +2209,15 @@ var runMcpPost = async (config, request, body) => {
     return rpcError(null, JSONRPC_INVALID_REQUEST, "Batching is not supported");
   }
   const isInitialize = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
-  const protocolVersion = request.headers.get("mcp-protocol-version");
+  const protocolVersion = request.headers.get("mcp-protocol-version") ?? "2025-03-26";
   const supportedProtocols = config.supportedProtocols ?? [
     MCP_LATEST_PROTOCOL_VERSION,
     "2025-06-18",
     "2025-03-26",
     "2024-11-05"
   ];
-  if (!isInitialize && (protocolVersion === null || !supportedProtocols.includes(protocolVersion))) {
-    return new Response("Missing or unsupported MCP-Protocol-Version", {
+  if (!isInitialize && !supportedProtocols.includes(protocolVersion)) {
+    return new Response("Unsupported MCP-Protocol-Version", {
       status: 400
     });
   }
@@ -2215,13 +2227,17 @@ var runMcpPost = async (config, request, body) => {
     return new Response(null, { status: HTTP_NOT_FOUND });
   }
   return dispatchMcp(config, auth.caller, auth.scopes ?? [], body, {
-    protocolVersion: protocolVersion ?? MCP_LATEST_PROTOCOL_VERSION,
+    protocolVersion,
     requestSignal: request.signal,
     sessionId,
     sessions
   }).catch(() => rpcError(null, JSONRPC_INVALID_REQUEST, "Internal error"));
 };
 var runMcpDelete = async (config, request) => {
+  const auth = await config.authorize(request);
+  if (!auth.ok) {
+    return unauthorized(`${config.issuer}${metadataPathFor(config.path)}`, auth.reason);
+  }
   const sessions = registryFor(config);
   const sessionId = request.headers.get("mcp-session-id");
   if (!sessions || !sessionId) {

package/docs/host-canaries.md

@@ -4,7 +4,7 @@ The package ships `canary/server.ts`: a loopback-only, synthetic billing endpoin
 
 From an installed package, run `bun node_modules/@absolutejs/mcp/canary/server.ts`. From this repository, build first, then `bun run canary`. The fixed endpoint is `http://127.0.0.1:4428/mcp`. Startup validates all four report calls before listening. Stop it with Ctrl-C after the test. A port conflict fails startup rather than replacing another service.
 
-The JSONL log records protocol methods, status, client name/version, negotiated protocol, advertised Apps MIME types and tool success. It omits headers, session IDs, tool arguments and report bodies. Keep host transcripts local: host logs can contain unrelated account or environment information. Commit only reviewed evidence.
+The JSONL log records protocol methods, status, client name/version, negotiated protocol, advertised Apps MIME types and tool success. It records only the MCP protocol-version header and omits all other headers, session IDs, tool arguments and report bodies. Keep host transcripts local: host logs can contain unrelated account or environment information. Commit only reviewed evidence.
 
 ## Host connections
 
@@ -49,7 +49,7 @@ Terminal tests ran against the built `0.17.0` runtime. The later Claude web test
 | Claude Code 2.1.265, print mode, Streamable HTTP | Requested 2025-11-25; accepted server 2025-06-18; no Apps MIME extension | Four read calls passed, including cursor pagination; text/structured fallback; no embedded rendering claim |
 | Codex CLI 0.154.0, exec mode, Streamable HTTP    | Requested and accepted 2025-06-18; no Apps MIME extension                | Four read calls passed, including cursor pagination; text/structured fallback; no embedded rendering claim |
 | Claude web, Windows Chrome 152.0.7977.83         | Apps MIME advertised; accepted 2025-06-18                                | Three native views, refresh and pagination passed                                                          |
-| VS Code 1.135.0                                  | Installed version confirmed                                              | Interactive Copilot/MCP Apps UI not exercised                                                              |
+| VS Code 1.135.0                                  | Apps MIME advertised; negotiated 2025-11-25; omitted protocol header     | Three views, refresh and pagination verified after compatibility fix; initial balance required reload      |
 | Cursor, Gemini CLI, goose                        | Executables unavailable in this environment                              | Not tested                                                                                                 |
 | ChatGPT hosted surfaces                          | No host canary performed                                                 | Not tested                                                                                                 |
 
@@ -67,4 +67,12 @@ A temporary public tunnel allowed discovery but failed tool execution before rea
 
 For Windows/WSL testing, a headed Linux browser may not appear on the Windows desktop. Use a native Windows test browser with a separate persistent profile and loopback CDP endpoint. Reuse one Playwright CDP connection. If existing cross-origin frames are missing from automation, reload with that connection established; Claude uses a wrapper frame and a nested `about:blank` app frame. Never commit browser profiles or credentials.
 
-Conversational rendering is verified for this exact surface. VS Code/Cursor interactive rendering and authenticated staging reconnect/account-isolation remain separate open gates.
+Conversational rendering is verified for this exact surface. Cursor interactive rendering and authenticated staging reconnect/account-isolation remain separate open gates.
+
+## VS Code Copilot and session compatibility (0.17.3)
+
+Native Windows VS Code 1.135.0 advertised Apps MIME support but omitted MCP-Protocol-Version on subsequent requests. The shared handler now applies the specified 2025-03-26 fallback for an absent header; explicitly unsupported values still return 400. The fixture now uses default supported protocols instead of forcing a downgrade. See the [MCP transport specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#protocol-version-header).
+
+Three report views rendered in the signed-in isolated Copilot workspace. Balance and usage refresh, daily expansion and receipt pagination passed. There were six report calls: three initial calls and three explicit button actions. Reloading restored the original report results with no extra report calls. All app documents measured 242px without horizontal document overflow. The first balance webview was blank until a window reload; its cause is not isolated, so this is a qualified rendering result, not proof of reliable first-load behavior. Reviewed aggregate evidence: `canary/results/2026-09-11-vscode.json`.
+
+Package regressions verify authorization before session deletion, per-request account selection, expired-session HTTP 404, and fresh explicit client initialization. HTTP failures now produce McpClientError with status (and a JSON-RPC code when available), including empty/non-JSON responses. After a session 404, call client.initialize() to negotiate a fresh session before further operations. The failed tool is never automatically replayed; callers must decide whether retrying is appropriate. Synthetic credentials prove handler behavior, not OAuth correctness or real-tenant isolation. Authenticated staging remains a separate release gate.

package/package.json

@@ -86,5 +86,5 @@
     "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.17.2"
+  "version": "0.17.3"
 }