@absolutejs/mcp 0.17.5 → 0.17.6

package/CHANGELOG.md

@@ -6,6 +6,16 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.17.6 — 2026-09-11
+
+### Added
+
+- **Allow verified patched hosts through the version fallback with optional Apps configuration** (`clientSupportsMcpApps`, `McpAppsConfig`)
+
+### Fixed
+
+- **Use text and structured report results on affected VS Code builds while their upstream webview startup race remains unresolved**
+
 ## 0.17.5 — 2026-09-11
 
 ### Added

package/UPSTREAM_ISSUES.md

@@ -0,0 +1,19 @@
+# Upstream issues
+
+## VS Code webviews can go blank after a remount
+
+Tracking: [microsoft/vscode#335908](https://github.com/microsoft/vscode/issues/335908). An issue was submitted; no pull request was submitted.
+
+An earlier asynchronous origin-hash completion can replace the iframe after a newer mount connects. In native Windows VS Code 1.135.0, delaying the first hash reproduced a blank report. A current-promise guard passed three rounds across balance, usage and receipts in the isolated test process. The same unguarded method was found in the local 1.136.1 bundle; that version was source-inspected, not runtime-tested. See [the source patch and regression checker](canary/vscode/README.md).
+
+### Shared workaround in MCP 0.17.6
+
+New sessions identifying themselves as `Visual Studio Code` version `1.135.0` or `1.136.1` receive text and structured results without Apps metadata or HTML resources. Report tools remain available. Authorization, billing and other host negotiations are unchanged. This exact-version rule is a presentation workaround, not a security boundary or a certification of other versions.
+
+For an existing VS Code connection, run **MCP: Reset Cached Tools**, then **Developer: Reload Window**, reconnect/start the MCP server and open a new chat. Reconnection alone reused old UI metadata in our test. Reconnect the MCP server after upgrading: the negotiated Apps capability is stored in the session, so existing sessions retain their old decision. Consumers get the workaround through the package; they do not need a project-specific renderer or an editor patch.
+
+`apps.allowKnownBrokenHosts: true` bypasses the version exclusion for controlled testing of a verified patched host. It still requires the host to advertise the Apps MIME capability. Do not enable it on ordinary affected installations. The diagnostic in-memory VS Code patch does not survive restart and is not the deployed workaround.
+
+### Removal
+
+Keep the fallback for affected builds until they can reliably render Apps. When an upstream fix ships, verify fresh conversations, repeated mounts, refresh and pagination in the released host before certifying rich views there. Remove the override when a patched test build is retired. Keep the source regression and issue history so a successful retry is not mistaken for a fix.

package/canary/vscode/README.md

@@ -28,4 +28,6 @@ Some unmodified first-load runs passed too: this is a timing-sensitive failure,
 
 ## Delivery status
 
-This package distributes a reviewable upstream source patch and regression checker. It does **not** patch users' VS Code installations. The in-memory test change does not survive an editor restart. An upstream release or an explicitly maintained patched host build is required before claiming that ordinary VS Code users receive this fix. Keep the first-load rollout gate open until that distribution is verified. No upstream submission is implied by this artifact.
+The bug is reported in [microsoft/vscode#335908](https://github.com/microsoft/vscode/issues/335908); no PR was submitted. This package distributes the source patch and checker for review, but does not modify installed editors. The test-process patch disappears on restart.
+
+MCP 0.17.6 instead defaults affected versions to text and structured reports. Reconnect after upgrading to negotiate the fallback. See [UPSTREAM_ISSUES.md](../../UPSTREAM_ISSUES.md) for the exact version scope, diagnostic override and removal conditions. Rich first-load support remains unverified in an unmodified released host.

package/changelog.json

@@ -2,6 +2,24 @@
   "contract": 1,
   "name": "@absolutejs/mcp",
   "releases": [
+    {
+      "version": "0.17.6",
+      "date": "2026-09-11",
+      "changes": [
+        {
+          "kind": "fixed",
+          "summary": "Use text and structured report results on affected VS Code builds while their upstream webview startup race remains unresolved"
+        },
+        {
+          "kind": "added",
+          "summary": "Allow verified patched hosts through the version fallback with optional Apps configuration",
+          "symbols": [
+            "clientSupportsMcpApps",
+            "McpAppsConfig"
+          ]
+        }
+      ]
+    },
     {
       "version": "0.17.5",
       "date": "2026-09-11",

package/dist/apps.js

@@ -49,9 +49,11 @@ var createBillingApps = () => {
 
 // src/apps.ts
 var MCP_APP_MIME = "text/html;profile=mcp-app";
-var clientSupportsMcpApps = (params) => {
+var clientSupportsMcpApps = (params, options = {}) => {
   if (!isRecord(params) || !isRecord(params.capabilities) || !isRecord(params.capabilities.extensions))
     return false;
+  if (!options.allowKnownBrokenHosts && isRecord(params.clientInfo) && params.clientInfo.name === "Visual Studio Code" && (params.clientInfo.version === "1.135.0" || params.clientInfo.version === "1.136.1"))
+    return false;
   const ui = params.capabilities.extensions["io.modelcontextprotocol/ui"];
   return isRecord(ui) && Array.isArray(ui.mimeTypes) && ui.mimeTypes.includes(MCP_APP_MIME);
 };

package/dist/index.js

@@ -49,9 +49,11 @@ var createBillingApps = () => {
 
 // src/apps.ts
 var MCP_APP_MIME = "text/html;profile=mcp-app";
-var clientSupportsMcpApps = (params) => {
+var clientSupportsMcpApps = (params, options = {}) => {
   if (!isRecord(params) || !isRecord(params.capabilities) || !isRecord(params.capabilities.extensions))
     return false;
+  if (!options.allowKnownBrokenHosts && isRecord(params.clientInfo) && params.clientInfo.name === "Visual Studio Code" && (params.clientInfo.version === "1.135.0" || params.clientInfo.version === "1.136.1"))
+    return false;
   const ui = params.capabilities.extensions["io.modelcontextprotocol/ui"];
   return isRecord(ui) && Array.isArray(ui.mimeTypes) && ui.mimeTypes.includes(MCP_APP_MIME);
 };
@@ -1379,7 +1381,7 @@ var initialize = async (config, id, params, context) => {
   if (!config.elicitation?.enabled && !config.apps || !context.sessions)
     return response;
   const elicitation = clientElicitation(params);
-  const sessionId = await context.sessions.create(elicitation.form || elicitation.url, elicitation.url, Boolean(config.apps) && clientSupportsMcpApps(params));
+  const sessionId = await context.sessions.create(elicitation.form || elicitation.url, elicitation.url, Boolean(config.apps) && clientSupportsMcpApps(params, config.apps));
   response.headers.set("Mcp-Session-Id", sessionId);
   return response;
 };

package/dist/src/apps.d.ts

@@ -5,11 +5,13 @@ export type McpAppResource = {
     html: string;
 };
 export type McpAppsConfig = {
+    /** Only enable for a host build whose upstream rendering fix has been verified. */
+    allowKnownBrokenHosts?: boolean;
     resources: Record<string, McpAppResource>;
     store?: McpSessionStore;
 };
 /** Capability is presentation only; never a commerce or authorization decision. */
-export declare const clientSupportsMcpApps: (params: unknown) => boolean;
+export declare const clientSupportsMcpApps: (params: unknown, options?: Pick<McpAppsConfig, "allowKnownBrokenHosts">) => boolean;
 export declare const withMcpApp: (tool: McpTool, resourceUri: string) => McpTool;
 /** Offline templates: all data comes through authenticated tool results and the
  * official host bridge. Network, nested frames and privileged permissions are not requested. */

package/docs/host-canaries.md

@@ -97,3 +97,9 @@ This verifies the selected read path, not every tenant resource, token revocatio
 ## VS Code first-load race identified
 
 MCP 0.17.5 includes `canary/vscode/README.md`, a VS Code source patch and an executable actual-method regression. A controlled out-of-order origin-hash completion reproduces a blank view in native VS Code 1.135.0. The candidate current-promise guard passed three rounds across all three report views and both source-level completion orders. This is a host fix, not an MCP renderer change. The package distributes the patch for review; it does not modify installed editors or certify an upstream release. First-load activation remains blocked until a supported host containing the fix is verified.
+
+## Temporary VS Code fallback (0.17.6)
+
+The issue is tracked in [microsoft/vscode#335908](https://github.com/microsoft/vscode/issues/335908). Known affected versions now receive text and structured reports on new sessions, keeping tools usable without invoking the faulty webview path. Other hosts retain their negotiated presentation. See [UPSTREAM_ISSUES.md](../UPSTREAM_ISSUES.md) for scope and removal conditions. This workaround does not certify rich rendering on affected editors.
+
+Native Windows VS Code 1.135.0 verification: after removing the in-memory editor patch, reconnecting alone left cached UI metadata and produced resource errors. Running **MCP: Reset Cached Tools**, reloading the window and opening a new chat cleared it. The final run returned all three reports as visible text, with three successful tool calls, no resource reads and no App frames. This is a verified text fallback, not rich rendering evidence.

package/package.json

@@ -72,7 +72,8 @@
     "docs/mcp-apps.md",
     "docs/third-party",
     "canary",
-    "docs/host-canaries.md"
+    "docs/host-canaries.md",
+    "UPSTREAM_ISSUES.md"
   ],
   "scripts": {
     "build": "bun run build:apps && rm -rf dist && bun build src/index.ts src/manifest.ts src/commerce.ts src/apps.ts --outdir dist --root ./src --target=bun --external @absolutejs/agency --external '@absolutejs/agency/*' --external elysia && tsc --emitDeclarationOnly --project tsconfig.json && absolute-manifest emit",
@@ -87,5 +88,5 @@
     "check:canary": "tsc --noEmit --strict --skipLibCheck --moduleResolution bundler --module esnext --target esnext --types bun canary/server.ts canary/authenticated.ts canary/vscode/check-mount.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.17.5"
+  "version": "0.17.6"
 }