@absolutejs/mcp 0.17.2 → 0.17.4

package/CHANGELOG.md

@@ -6,6 +6,19 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.17.4 — 2026-09-11
+
+### Added
+
+- **Ship an authenticated two-account staging canary for read isolation, credential rejection and session reconnect with private credentials and aggregate-only results**
+
+## 0.17.3 — 2026-09-11
+
+### Fixed
+
+- **Authorize session deletion, recover explicit client initialization after expiry, and preserve typed HTTP failures without replaying tools**
+- **Accept the standard protocol-header compatibility fallback used by VS Code Copilot and record native report rendering evidence**
+
 ## 0.17.2 — 2026-09-11
 
 ### Added

package/canary/authenticated.ts

@@ -0,0 +1,192 @@
+/** Authenticated staging checks. Tokens/results remain in memory and are never logged. */
+import type { McpToolResult } from "@absolutejs/mcp";
+export type AuthenticatedCanaryOptions = {
+  url: string;
+  accounts: readonly [string, string];
+  tool: { name: string; arguments?: Record<string, unknown> };
+  /** Select stable account-owned data, excluding timestamps and shared metadata. */
+  fingerprint: (result: McpToolResult) => string;
+  request?: typeof fetch;
+};
+export const runAuthenticatedCanary = async (
+  options: AuthenticatedCanaryOptions,
+) => {
+  const url = new URL(options.url);
+  if (
+    url.protocol !== "https:" &&
+    !(
+      url.protocol === "http:" &&
+      ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)
+    )
+  )
+    throw Error("HTTPS required outside loopback");
+  if (
+    !options.accounts[0] ||
+    !options.accounts[1] ||
+    options.accounts[0] === options.accounts[1]
+  )
+    throw Error("Two distinct credentials required");
+  const request = options.request ?? fetch;
+  const checks: { name: string; passed: boolean }[] = [];
+  const sessions: { token: string; id: string; protocol: string }[] = [];
+  const send = async (
+    token: string | null,
+    session: (typeof sessions)[number] | undefined,
+    method: string,
+    params: unknown = {},
+  ) =>
+    request(options.url, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+        ...(session
+          ? {
+              "mcp-session-id": session.id,
+              "mcp-protocol-version": session.protocol,
+            }
+          : {}),
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+    });
+  const body = async (response: Response) => {
+    if (
+      !response.ok ||
+      !response.headers.get("content-type")?.includes("application/json")
+    )
+      throw Error("Canary requires successful JSON responses");
+    const value = await response.json();
+    if (value.error || !value.result || value.result.isError)
+      throw Error("Canary RPC failed");
+    return value.result;
+  };
+  const initialize = async (token: string) => {
+    const response = await send(token, undefined, "initialize", {
+      protocolVersion: "2025-11-25",
+      clientInfo: { name: "absolute-authenticated-canary", version: "1" },
+      capabilities: {
+        elicitation: {},
+        extensions: {
+          "io.modelcontextprotocol/ui": {
+            mimeTypes: ["text/html;profile=mcp-app"],
+          },
+        },
+      },
+    });
+    const result = await body(response);
+    const id = response.headers.get("mcp-session-id");
+    if (!id || typeof result.protocolVersion !== "string")
+      throw Error("Stateful MCP session required");
+    const session = { token, id, protocol: result.protocolVersion };
+    sessions.push(session);
+    await request(options.url, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json",
+        "mcp-session-id": id,
+        "mcp-protocol-version": session.protocol,
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        method: "notifications/initialized",
+      }),
+    });
+    return session;
+  };
+  const drop = (session: (typeof sessions)[number], authorized = true) =>
+    request(options.url, {
+      method: "DELETE",
+      redirect: "error",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        "mcp-session-id": session.id,
+        "mcp-protocol-version": session.protocol,
+        ...(authorized ? { authorization: `Bearer ${session.token}` } : {}),
+      },
+    });
+  const read = async (token: string, session: (typeof sessions)[number]) =>
+    options.fingerprint(
+      await body(await send(token, session, "tools/call", options.tool)),
+    );
+  try {
+    const a = await initialize(options.accounts[0]);
+    const b = await initialize(options.accounts[1]);
+    for (const session of [a, b]) {
+      const discovery = await body(
+        await send(session.token, session, "tools/list"),
+      );
+      if (
+        !discovery.tools?.some(
+          (tool: { name: string; annotations?: { readOnlyHint?: boolean } }) =>
+            tool.name === options.tool.name &&
+            tool.annotations?.readOnlyHint === true,
+        )
+      )
+        throw Error("Explicitly read-only tool required for both accounts");
+    }
+    const first = await read(a.token, a);
+    const second = await read(b.token, b);
+    if (!first || !second || first === second)
+      throw Error(
+        "Distinct stable account-owned results required; isolation is inconclusive",
+      );
+    checks.push({ name: "distinct-account-results", passed: true });
+    for (const [session, expected] of [
+      [a, first],
+      [b, second],
+    ] as const)
+      checks.push({
+        name: "stable-account-result",
+        passed: (await read(session.token, session)) === expected,
+      });
+    for (const [token, session, expected] of [
+      [b.token, a, second],
+      [a.token, b, first],
+    ] as const) {
+      const response = await send(token, session, "tools/call", options.tool);
+      // Binding a session to its owner is also safe; otherwise current credentials must select the data.
+      checks.push({
+        name: "cross-session-account-isolation",
+        passed:
+          [401, 403, 404].includes(response.status) ||
+          options.fingerprint(await body(response)) === expected,
+      });
+    }
+    for (const token of [null, "invalid-canary-credential"])
+      checks.push({
+        name: "invalid-credential-rejected",
+        passed: (await send(token, a, "tools/list")).status === 401,
+      });
+    checks.push({
+      name: "unauthenticated-delete-rejected",
+      passed: (await drop(a, false)).status === 401,
+    });
+    checks.push({
+      name: "session-survives-rejected-delete",
+      passed: (await send(a.token, a, "tools/list")).status === 200,
+    });
+    const deletion = await drop(b);
+    checks.push({
+      name: "own-session-deletion",
+      passed: deletion.status === 204,
+    });
+    checks.push({
+      name: "terminated-session-404",
+      passed: (await send(b.token, b, "tools/list")).status === 404,
+    });
+    const fresh = await initialize(b.token);
+    checks.push({
+      name: "fresh-session-read",
+      passed: fresh.id !== b.id && (await read(b.token, fresh)) === second,
+    });
+    return { passed: checks.every((check) => check.passed), checks };
+  } finally {
+    for (const session of sessions) await drop(session).catch(() => undefined);
+  }
+};

package/canary/results/2026-09-11-vscode.json

@@ -0,0 +1,28 @@
+{
+  "date": "2026-09-11",
+  "runtimePackage": "@absolutejs/mcp@0.17.3 pre-release build",
+  "host": "Visual Studio Code 1.135.0, native Windows Copilot Chat",
+  "transport": "Streamable HTTP, isolated loopback synthetic workspace",
+  "protocol": "2025-11-25",
+  "protocolHeader": null,
+  "appsMimeType": "text/html;profile=mcp-app",
+  "successfulCalls": {
+    "get_billing_status": 2,
+    "get_usage_report": 2,
+    "list_receipts": 2
+  },
+  "observed": [
+    "All three native report views rendered after window reload",
+    "Balance and usage refresh succeeded",
+    "Daily usage expanded",
+    "Receipt pagination reached empty final page and hid Older receipts",
+    "Initial render and window reload made no extra report calls",
+    "All three app documents measured 242px with no horizontal document overflow"
+  ],
+  "limitations": [
+    "Initial balance webview was blank; window reload restored it; cause not isolated",
+    "Window reload restores original tool results, including first receipt page",
+    "OAuth, real-account isolation and expired-session reconnect against authenticated staging not tested",
+    "Host commerce permissions not certified"
+  ]
+}

package/canary/server.ts

@@ -49,7 +49,6 @@ const handler = createMcpHandler({
   issuer: "http://127.0.0.1:4428",
   path: "/mcp",
   serverInfo: { name: "absolute-billing-canary", version: "1" },
-  supportedProtocols: ["2025-06-18"],
   authorize: async () => ({
     ok: true,
     caller: "synthetic-fixture",
@@ -110,6 +109,7 @@ Bun.serve({
       JSON.stringify({
         method: rpc?.method ?? request.method,
         status: response.status,
+        protocolHeader: request.headers.get("mcp-protocol-version"),
         ...(rpc?.method === "initialize"
           ? {
               client: rpc.params?.clientInfo?.name,

package/changelog.json

@@ -2,6 +2,30 @@
   "contract": 1,
   "name": "@absolutejs/mcp",
   "releases": [
+    {
+      "version": "0.17.4",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Ship an authenticated two-account staging canary for read isolation, credential rejection and session reconnect with private credentials and aggregate-only results"
+        }
+      ]
+    },
+    {
+      "version": "0.17.3",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "fixed",
+          "summary": "Authorize session deletion, recover explicit client initialization after expiry, and preserve typed HTTP failures without replaying tools"
+        },
+        {
+          "kind": "fixed",
+          "summary": "Accept the standard protocol-header compatibility fallback used by VS Code Copilot and record native report rendering evidence"
+        }
+      ]
+    },
     {
       "version": "0.17.2",
       "date": "2026-09-11",

package/dist/index.js

@@ -735,14 +735,25 @@ var createMcpClient = (options) => {
           });
         }
       }
-      const captured = response.headers.get("mcp-session-id");
-      if (captured)
-        sessionId = captured;
       if (response.status === 401) {
         throw new McpClientError("The MCP server rejected the credentials", {
           status: 401
         });
       }
+      if (!response.ok) {
+        if (response.status === 404 && sessionId === headers["mcp-session-id"]) {
+          sessionId = null;
+        }
+        const failure = await parseBody(response, maxBytes).catch(() => null);
+        const error = isRecord(failure) && isRecord(failure.error) ? failure.error : null;
+        throw new McpClientError(typeof error?.message === "string" ? error.message : `MCP HTTP request failed (${response.status})`, {
+          status: response.status,
+          code: typeof error?.code === "number" ? error.code : undefined
+        });
+      }
+      const captured = response.headers.get("mcp-session-id");
+      if (captured)
+        sessionId = captured;
       const isStream = (response.headers.get("content-type") ?? "").includes("text/event-stream");
       const payload = isStream ? await consumeSseStream(response, maxBytes, answerServer) : await parseBody(response, maxBytes);
       if (!isRecord(payload)) {
@@ -776,6 +787,7 @@ var createMcpClient = (options) => {
     });
   };
   const initialize = async () => {
+    sessionId = null;
     const result2 = await rpc("initialize", {
       capabilities: {
         ...options.onElicit ? { elicitation: { form: {}, url: {} } } : {},
@@ -2197,15 +2209,15 @@ var runMcpPost = async (config, request, body) => {
     return rpcError(null, JSONRPC_INVALID_REQUEST, "Batching is not supported");
   }
   const isInitialize = typeof body === "object" && body !== null && "method" in body && body.method === "initialize";
-  const protocolVersion = request.headers.get("mcp-protocol-version");
+  const protocolVersion = request.headers.get("mcp-protocol-version") ?? "2025-03-26";
   const supportedProtocols = config.supportedProtocols ?? [
     MCP_LATEST_PROTOCOL_VERSION,
     "2025-06-18",
     "2025-03-26",
     "2024-11-05"
   ];
-  if (!isInitialize && (protocolVersion === null || !supportedProtocols.includes(protocolVersion))) {
-    return new Response("Missing or unsupported MCP-Protocol-Version", {
+  if (!isInitialize && !supportedProtocols.includes(protocolVersion)) {
+    return new Response("Unsupported MCP-Protocol-Version", {
       status: 400
     });
   }
@@ -2215,13 +2227,17 @@ var runMcpPost = async (config, request, body) => {
     return new Response(null, { status: HTTP_NOT_FOUND });
   }
   return dispatchMcp(config, auth.caller, auth.scopes ?? [], body, {
-    protocolVersion: protocolVersion ?? MCP_LATEST_PROTOCOL_VERSION,
+    protocolVersion,
     requestSignal: request.signal,
     sessionId,
     sessions
   }).catch(() => rpcError(null, JSONRPC_INVALID_REQUEST, "Internal error"));
 };
 var runMcpDelete = async (config, request) => {
+  const auth = await config.authorize(request);
+  if (!auth.ok) {
+    return unauthorized(`${config.issuer}${metadataPathFor(config.path)}`, auth.reason);
+  }
   const sessions = registryFor(config);
   const sessionId = request.headers.get("mcp-session-id");
   if (!sessions || !sessionId) {

package/docs/host-canaries.md

@@ -4,7 +4,7 @@ The package ships `canary/server.ts`: a loopback-only, synthetic billing endpoin
 
 From an installed package, run `bun node_modules/@absolutejs/mcp/canary/server.ts`. From this repository, build first, then `bun run canary`. The fixed endpoint is `http://127.0.0.1:4428/mcp`. Startup validates all four report calls before listening. Stop it with Ctrl-C after the test. A port conflict fails startup rather than replacing another service.
 
-The JSONL log records protocol methods, status, client name/version, negotiated protocol, advertised Apps MIME types and tool success. It omits headers, session IDs, tool arguments and report bodies. Keep host transcripts local: host logs can contain unrelated account or environment information. Commit only reviewed evidence.
+The JSONL log records protocol methods, status, client name/version, negotiated protocol, advertised Apps MIME types and tool success. It records only the MCP protocol-version header and omits all other headers, session IDs, tool arguments and report bodies. Keep host transcripts local: host logs can contain unrelated account or environment information. Commit only reviewed evidence.
 
 ## Host connections
 
@@ -49,7 +49,7 @@ Terminal tests ran against the built `0.17.0` runtime. The later Claude web test
 | Claude Code 2.1.265, print mode, Streamable HTTP | Requested 2025-11-25; accepted server 2025-06-18; no Apps MIME extension | Four read calls passed, including cursor pagination; text/structured fallback; no embedded rendering claim |
 | Codex CLI 0.154.0, exec mode, Streamable HTTP    | Requested and accepted 2025-06-18; no Apps MIME extension                | Four read calls passed, including cursor pagination; text/structured fallback; no embedded rendering claim |
 | Claude web, Windows Chrome 152.0.7977.83         | Apps MIME advertised; accepted 2025-06-18                                | Three native views, refresh and pagination passed                                                          |
-| VS Code 1.135.0                                  | Installed version confirmed                                              | Interactive Copilot/MCP Apps UI not exercised                                                              |
+| VS Code 1.135.0                                  | Apps MIME advertised; negotiated 2025-11-25; omitted protocol header     | Three views, refresh and pagination verified after compatibility fix; initial balance required reload      |
 | Cursor, Gemini CLI, goose                        | Executables unavailable in this environment                              | Not tested                                                                                                 |
 | ChatGPT hosted surfaces                          | No host canary performed                                                 | Not tested                                                                                                 |
 
@@ -67,4 +67,29 @@ A temporary public tunnel allowed discovery but failed tool execution before rea
 
 For Windows/WSL testing, a headed Linux browser may not appear on the Windows desktop. Use a native Windows test browser with a separate persistent profile and loopback CDP endpoint. Reuse one Playwright CDP connection. If existing cross-origin frames are missing from automation, reload with that connection established; Claude uses a wrapper frame and a nested `about:blank` app frame. Never commit browser profiles or credentials.
 
-Conversational rendering is verified for this exact surface. VS Code/Cursor interactive rendering and authenticated staging reconnect/account-isolation remain separate open gates.
+Conversational rendering is verified for this exact surface. Cursor interactive rendering and authenticated staging reconnect/account-isolation remain separate open gates.
+
+## VS Code Copilot and session compatibility (0.17.3)
+
+Native Windows VS Code 1.135.0 advertised Apps MIME support but omitted MCP-Protocol-Version on subsequent requests. The shared handler now applies the specified 2025-03-26 fallback for an absent header; explicitly unsupported values still return 400. The fixture now uses default supported protocols instead of forcing a downgrade. See the [MCP transport specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#protocol-version-header).
+
+Three report views rendered in the signed-in isolated Copilot workspace. Balance and usage refresh, daily expansion and receipt pagination passed. There were six report calls: three initial calls and three explicit button actions. Reloading restored the original report results with no extra report calls. All app documents measured 242px without horizontal document overflow. The first balance webview was blank until a window reload; its cause is not isolated, so this is a qualified rendering result, not proof of reliable first-load behavior. Reviewed aggregate evidence: `canary/results/2026-09-11-vscode.json`.
+
+Package regressions verify authorization before session deletion, per-request account selection, expired-session HTTP 404, and fresh explicit client initialization. HTTP failures now produce McpClientError with status (and a JSON-RPC code when available), including empty/non-JSON responses. After a session 404, call client.initialize() to negotiate a fresh session before further operations. The failed tool is never automatically replayed; callers must decide whether retrying is appropriate. Synthetic credentials prove handler behavior, not OAuth correctness or real-tenant isolation. Authenticated staging remains a separate release gate.
+
+## Authenticated two-account staging canary
+
+Import `runAuthenticatedCanary` from `@absolutejs/mcp/canary/authenticated` in a local Bun script. Supply an HTTPS endpoint, two distinct access tokens obtained through the application's normal OAuth flow, an explicitly read-only tool, and a fingerprint function selecting stable account-owned data. Credentials, fingerprints and results remain in memory; the returned report contains only check names and booleans. Keep the calling script and tokens outside the repository.
+
+```ts
+const report = await runAuthenticatedCanary({
+  url: stagingMcpUrl,
+  accounts: [firstAccessToken, secondAccessToken],
+  tool: { name: accountReadTool, arguments: {} },
+  fingerprint: (result) => JSON.stringify(result.content),
+});
+```
+
+Choose two accounts with known distinct data. The canary refuses identical results as inconclusive and verifies repeated reads remain stable. It checks both directions of session-ID substitution: rejecting the foreign session or returning the currently authenticated account's result is acceptable. It also checks missing/invalid credentials, unauthorized DELETE, authorized deletion, terminated-session 404, and fresh initialization/read. It creates and cleans up only its own MCP sessions, never purchases or modifies account data. Read-only annotations are a prerequisite, not a substitute for the operator selecting a known non-billable read tool. The current harness requires JSON RPC responses; SSE-only servers are not certified by it.
+
+This verifies the selected read path, not every tenant resource, token revocation, automatic host reconnect, or billing permissions. Session termination is explicit DELETE; timed TTL expiry needs a separate store test. Use dedicated test clients and remove their grants after verification. Do not publish tokens, transcripts, fingerprints, or raw account data.

package/package.json

@@ -46,7 +46,8 @@
       "types": "./dist/src/apps.d.ts",
       "import": "./dist/apps.js",
       "default": "./dist/apps.js"
-    }
+    },
+    "./canary/authenticated": "./canary/authenticated.ts"
   },
   "publishConfig": {
     "access": "public"
@@ -83,8 +84,8 @@
     "prepublishOnly": "bun run check:package",
     "build:apps": "bun scripts/build-apps.ts",
     "canary": "bun canary/server.ts",
-    "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts"
+    "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts canary/authenticated.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.17.2"
+  "version": "0.17.4"
 }