@absolutejs/mcp 0.17.4 → 0.17.5

package/CHANGELOG.md

@@ -6,6 +6,12 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.17.5 — 2026-09-11
+
+### Added
+
+- **Distribute a verified VS Code webview startup-race source patch and actual-method regression checker, with explicit upstream delivery requirements**
+
 ## 0.17.4 — 2026-09-11
 
 ### Added

package/canary/vscode/README.md

@@ -0,0 +1,31 @@
+# VS Code webview mount race
+
+A host lifecycle race can leave an MCP App blank before its inner document loads. `mountTo` computes the parent-origin hash asynchronously. A subsequent mount can finish first; without a current-startup check, the older completion can overwrite the origin and reset the iframe after the newer connection is ready.
+
+`webview-mount-race.patch` fixes the host's source implementation by applying a completion only when its captured promise is still the current mount promise. It does not change MCP or billing code, disable sandboxing, retry tools, or add an arbitrary delay.
+
+The baseline is VS Code 1.135.0, commit `08d4889f9ec4a1685d257b9b95de036c8e1ce1e5`. The same mount method was present on upstream main when checked September 11, 2026. [Upstream source](https://github.com/microsoft/vscode/blob/08d4889f9ec4a1685d257b9b95de036c8e1ce1e5/src/vs/workbench/contrib/webview/browser/webviewElement.ts).
+
+## Reproduce and check the source fix
+
+Use a trusted VS Code checkout and the package's Bun checker. The checker extracts and executes the actual `mountTo` method; it does not substitute a second implementation. Other DOM/service hooks are stubbed, and hash completion order is controlled.
+
+```sh
+bun /path/to/node_modules/@absolutejs/mcp/canary/vscode/check-mount.ts src/vs/workbench/contrib/webview/browser/webviewElement.ts
+# Original: exits 1 for both obsolete-startup checks.
+git apply /path/to/node_modules/@absolutejs/mcp/canary/vscode/webview-mount-race.patch
+bun /path/to/node_modules/@absolutejs/mcp/canary/vscode/check-mount.ts src/vs/workbench/contrib/webview/browser/webviewElement.ts
+# Patched: all four checks pass; exits 0.
+```
+
+The checker executes code from the supplied source file. Use only a trusted checkout. It needs Bun and is a targeted lifecycle regression, not the complete VS Code test suite.
+
+## Native-host verification
+
+In the isolated, signed-in native Windows VS Code 1.135.0 test window, completing an earlier origin hash 350ms after a newer startup reproduced a blank report on the unmodified host. With the equivalent current-promise guard applied only in the test process, three repeated rounds across balance, usage and receipts rendered all views without reloading. Both source-level completion orders now pass, and disposed views remain excluded. No paid tools or customer data were used.
+
+Some unmodified first-load runs passed too: this is a timing-sensitive failure, and ordinary successful retries do not prove it fixed. The controlled race provides the regression. Additional host defects remain possible; this patch addresses the demonstrated obsolete-startup race.
+
+## Delivery status
+
+This package distributes a reviewable upstream source patch and regression checker. It does **not** patch users' VS Code installations. The in-memory test change does not survive an editor restart. An upstream release or an explicitly maintained patched host build is required before claiming that ordinary VS Code users receive this fix. Keep the first-load rollout gate open until that distribution is verified. No upstream submission is implied by this artifact.

package/canary/vscode/check-mount.ts

@@ -0,0 +1,75 @@
+/** Run against a trusted VS Code webviewElement.ts checkout; executes its real mountTo method. */
+import { readFile } from "node:fs/promises";
+const file = process.argv[2];
+if (!file) throw Error("Usage: bun check-mount.ts /path/to/webviewElement.ts");
+const source = await readFile(file, "utf8");
+const start = source.indexOf("\tpublic mountTo(");
+const end = source.indexOf("\n\tprivate _registerMessageHandler(", start);
+if (start < 0 || end < 0) throw Error("Unsupported source layout");
+const method = source.slice(start, end);
+const javascript = new Bun.Transpiler({ loader: "ts" }).transformSync(
+  `class MountProbe { ${method} }`,
+);
+type Probe = {
+  mountTo: (element: unknown, window: unknown) => void;
+  _encodedWebviewOrigin?: string;
+  _disposed: boolean;
+};
+const results: { name: string; passed: boolean }[] = [];
+for (const order of [
+  [1, 0],
+  [0, 1],
+]) {
+  const pending: ((origin: string) => void)[] = [];
+  const mounted: string[] = [];
+  const create = new Function(
+    "parentOriginHash",
+    "EventType",
+    "addDisposableListener",
+    `${javascript};return MountProbe;`,
+  );
+  const Constructor = create(
+    () => new Promise<string>((resolve) => pending.push(resolve)),
+    {},
+    () => ({}),
+  ) as new () => Probe;
+  const probe = new Constructor();
+  Object.assign(probe, {
+    element: {},
+    origin: "test",
+    _disposed: false,
+    _registerMessageHandler: () => {},
+    _register: () => {},
+    perfMark: () => {},
+    _initElement: (origin: string) => mounted.push(origin),
+  });
+  const container = { appendChild: () => {} };
+  probe.mountTo(container, { origin: "first-window", vscodeWindowId: 1 });
+  probe.mountTo(container, { origin: "second-window", vscodeWindowId: 2 });
+  for (const index of order) {
+    pending[index]!(index === 0 ? "old-origin" : "new-origin");
+    await new Promise<void>((resolve) => queueMicrotask(resolve));
+  }
+  results.push({
+    name:
+      order[0] === 1
+        ? "late-old-startup-ignored"
+        : "early-obsolete-startup-ignored",
+    passed:
+      mounted.length === 1 &&
+      mounted[0] === "new-origin" &&
+      probe._encodedWebviewOrigin === "new-origin",
+  });
+  mounted.length = 0;
+  probe.mountTo(container, { origin: "disposed-window", vscodeWindowId: 3 });
+  probe._disposed = true;
+  pending[2]!("disposed-origin");
+  await new Promise<void>((resolve) => queueMicrotask(resolve));
+  results.push({
+    name: "disposed-view-not-mounted",
+    passed: mounted.length === 0,
+  });
+}
+const passed = results.every((result) => result.passed);
+console.log(JSON.stringify({ passed, results }, null, 2));
+if (!passed) process.exitCode = 1;

package/canary/vscode/webview-mount-race.patch

@@ -0,0 +1,22 @@
+--- a/src/vs/workbench/contrib/webview/browser/webviewElement.ts
++++ b/src/vs/workbench/contrib/webview/browser/webviewElement.ts
+@@ -477,9 +477,16 @@
+ 		}
+ 
+ 		this._windowId = targetWindow.vscodeWindowId;
+-		this._encodedWebviewOriginPromise = parentOriginHash(targetWindow.origin, this.origin).then(id => this._encodedWebviewOrigin = id);
+-		this._encodedWebviewOriginPromise.then(encodedWebviewOrigin => {
+-			if (!this._disposed) {
++		const encodedWebviewOriginPromise = parentOriginHash(targetWindow.origin, this.origin).then(id => {
++			if (this._encodedWebviewOriginPromise === encodedWebviewOriginPromise) {
++				this._encodedWebviewOrigin = id;
++			}
++			return id;
++		});
++		this._encodedWebviewOriginPromise = encodedWebviewOriginPromise;
++		encodedWebviewOriginPromise.then(encodedWebviewOrigin => {
++			// A remount may supersede this startup before its origin hash resolves.
++			if (!this._disposed && this._encodedWebviewOriginPromise === encodedWebviewOriginPromise) {
+ 				this._initElement(encodedWebviewOrigin, this.extension, this._options, targetWindow);
+ 			}
+ 		});

package/changelog.json

@@ -2,6 +2,16 @@
   "contract": 1,
   "name": "@absolutejs/mcp",
   "releases": [
+    {
+      "version": "0.17.5",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "added",
+          "summary": "Distribute a verified VS Code webview startup-race source patch and actual-method regression checker, with explicit upstream delivery requirements"
+        }
+      ]
+    },
     {
       "version": "0.17.4",
       "date": "2026-09-11",

package/docs/host-canaries.md

@@ -93,3 +93,7 @@ const report = await runAuthenticatedCanary({
 Choose two accounts with known distinct data. The canary refuses identical results as inconclusive and verifies repeated reads remain stable. It checks both directions of session-ID substitution: rejecting the foreign session or returning the currently authenticated account's result is acceptable. It also checks missing/invalid credentials, unauthorized DELETE, authorized deletion, terminated-session 404, and fresh initialization/read. It creates and cleans up only its own MCP sessions, never purchases or modifies account data. Read-only annotations are a prerequisite, not a substitute for the operator selecting a known non-billable read tool. The current harness requires JSON RPC responses; SSE-only servers are not certified by it.
 
 This verifies the selected read path, not every tenant resource, token revocation, automatic host reconnect, or billing permissions. Session termination is explicit DELETE; timed TTL expiry needs a separate store test. Use dedicated test clients and remove their grants after verification. Do not publish tokens, transcripts, fingerprints, or raw account data.
+
+## VS Code first-load race identified
+
+MCP 0.17.5 includes `canary/vscode/README.md`, a VS Code source patch and an executable actual-method regression. A controlled out-of-order origin-hash completion reproduces a blank view in native VS Code 1.135.0. The candidate current-promise guard passed three rounds across all three report views and both source-level completion orders. This is a host fix, not an MCP renderer change. The package distributes the patch for review; it does not modify installed editors or certify an upstream release. First-load activation remains blocked until a supported host containing the fix is verified.

package/package.json

@@ -84,8 +84,8 @@
     "prepublishOnly": "bun run check:package",
     "build:apps": "bun scripts/build-apps.ts",
     "canary": "bun canary/server.ts",
-    "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts canary/authenticated.ts"
+    "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts canary/authenticated.ts canary/vscode/check-mount.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.17.4"
+  "version": "0.17.5"
 }