@absolutejs/mcp 0.17.7 → 0.17.9

package/CHANGELOG.md

@@ -6,6 +6,18 @@ This file is generated by `absolute-changelog` from the entries in
 `changelog/`. Edit an entry, not this file — and add new ones under
 `changelog/unreleased/`.
 
+## 0.17.9 — 2026-09-12
+
+### Added
+
+- **Document scoped individual Copilot paid-work eligibility and deployment budget requirements**
+
+## 0.17.8 — 2026-09-12
+
+### Fixed
+
+- **Correct the VS Code checkout canary after verifying native Windows link consent and document the individual Copilot channel review**
+
 ## 0.17.7 — 2026-09-12
 
 ### Added

package/canary/results/vscode-checkout-2026-09-12.json

@@ -11,18 +11,30 @@
     "linkCreationApprovalVisible": true,
     "toolResultReviewVisible": true,
     "clickableMarkdownAnchor": true,
-    "nativeAnchorLaunch": "unverified: mouse and keyboard activation did not produce a measured checkout request",
+    "nativeAnchorLaunch": true,
     "windowsHttpsHandlerOpensReturnedUrl": true,
     "nativeChromeCheckoutPage": true,
     "fragmentRemovedAfterLoad": true,
-    "beforeBrowserApproval": { "status": "not_started", "creditsGranted": 0 },
-    "afterBrowserApproval": { "status": "approved", "creditsGranted": 1000 },
-    "repeatedRead": { "status": "approved", "creditsGranted": 1000 }
+    "beforeBrowserApproval": {
+      "status": "not_started",
+      "creditsGranted": 0
+    },
+    "afterBrowserApproval": {
+      "status": "approved",
+      "creditsGranted": 1000
+    },
+    "repeatedRead": {
+      "status": "approved",
+      "creditsGranted": 1000
+    },
+    "nativeWindowsExternalSiteConfirmation": true,
+    "sameDefaultBrowserApproval": true
   },
   "limits": [
-    "Native link launch remains a host-canary gate; no one-click end-to-end claim.",
-    "Browser state assertions used a second visible Chrome profile after explicit navigation to the returned URL.",
-    "No OAuth, real gateway, rich payment UI, real sales approval or marketplace distribution certified.",
+    "Synthetic credits only; no real gateway or OAuth certified.",
+    "No editor patch, trusted-domain setting or browser default changed.",
+    "Rich payment UI and marketplace distribution are not certified.",
     "No checkout capability, purchase ID, card data or account credentials included."
-  ]
+  ],
+  "correction": "Earlier unverified result missed a native Windows #32770 external-site confirmation outside the CDP DOM. Full rerun used the native Open prompt and the same default Chrome page."
 }

package/changelog.json

@@ -2,6 +2,26 @@
 	"contract": 1,
 	"name": "@absolutejs/mcp",
 	"releases": [
+		{
+			"changes": [
+				{
+					"kind": "added",
+					"summary": "Document scoped individual Copilot paid-work eligibility and deployment budget requirements"
+				}
+			],
+			"date": "2026-09-12",
+			"version": "0.17.9"
+		},
+		{
+			"changes": [
+				{
+					"kind": "fixed",
+					"summary": "Correct the VS Code checkout canary after verifying native Windows link consent and document the individual Copilot channel review"
+				}
+			],
+			"date": "2026-09-12",
+			"version": "0.17.8"
+		},
 		{
 			"changes": [
 				{

package/docs/commerce-host-rules.md

@@ -277,3 +277,22 @@ individual Copilot uses GitHub ToS §J; volume licensing has separate current
 Generative AI Services Terms. The old Copilot product-specific terms are archived.
 The linked canary record preserves the exact native host result independently
 of commercial eligibility. Existing Claude and ChatGPT restrictions still apply.
+
+## September 12 individual Copilot external-checkout review
+
+The operator confirmed an individual subscription. The [scoped review](reviews/vscode-individual-external-checkout.md)
+concludes that user-requested, service-owned HTTPS credit checkout is eligible
+for an explicit deployment binding, with a dated interpretation and exact
+conditions. This does not change the global direct-MCP default. The complete
+native handoff now passes after accounting for Windows' external-site dialog;
+no link defect or need for an upstream link fix was established. Rich-view
+startup remains a separate tracked issue.
+
+## September 12 individual Copilot paid-work review
+
+The [bounded paid-work review](reviews/vscode-individual-paid-work.md) separately
+covers user-requested service work funded by existing service credits for the
+reviewed individual Copilot direct-MCP channel. Deployments must bind the exact
+registration/account and enforce budgets, retries and recovery. It expires
+October 12, 2026. It does not enable the shared default or expand checkout,
+organization-account or other-host eligibility.

package/docs/host-canaries.md

@@ -153,12 +153,22 @@ anchor. Native Chrome showed the fixture page with its fragment removed. Copilot
 reported `not_started`/0 after the browser opened, then `approved`/1000 after the
 operator's simulated approval, including a second unchanged status read.
 
-**Qualified result:** mouse/keyboard activation of the Copilot anchor did not
-produce a measured checkout request in the final navigation probe. Opening the
-returned URL through the Windows HTTPS handler worked in the default Chrome
-profile. Browser state assertions used explicit navigation in a separate visible
-Chrome profile. These are separate observations: native one-click chat-to-browser
-launch is still unverified. No upstream cause has been established. Use the
-returned URL manually during development; do not advertise the seamless host
-handoff as passed. See `canary/results/vscode-checkout-2026-09-12.json` for aggregate
-evidence. No host/source patch or browser-default change was applied.
+**Corrected after a complete native rerun:** the previous test missed a Windows
+native `#32770` dialog asking whether Code should open the external website. It
+is outside the CDP page DOM: `getByRole("dialog")` returning zero did not mean no
+prompt existed. Several previous clicks had queued confirmations. Dismissing
+stale test prompts and choosing **Open** for the fresh expected origin produced
+checkout GET and state POST responses. Windows accessibility verified the actual
+default Chrome page, then the operator explicitly invoked its **Simulate approval**
+button. Copilot read zero before that click and approved/1000 twice afterward.
+No manual URL navigation was needed in this final run.
+
+Use Windows native dialog inspection when a click appears inert; do not repeatedly
+click, change trusted domains, or patch the editor to bypass the prompt. Preserve
+normal per-link consent. This was a test-automation gap, not an established host
+link defect. See `canary/results/vscode-checkout-2026-09-12.json` for the corrected
+aggregate evidence. The separate rich-view startup issue is unchanged.
+
+The [individual Copilot external-checkout review](reviews/vscode-individual-external-checkout.md)
+records the exact eligible deployment scope and activation conditions; the
+synthetic fixture is not a real merchant/OAuth acceptance test.

package/docs/reviews/vscode-individual-external-checkout.md

@@ -0,0 +1,61 @@
+# VS Code individual Copilot: external service-credit checkout
+
+Reviewed September 12, 2026; re-review by October 12, 2026. The operator confirmed
+an **individual Copilot subscription**. Channel: native VS Code, manually configured
+remote MCP, service-owned HTTPS checkout. This review covers user-requested
+one-time purchases of non-transferable credits for the connected service.
+
+## Decision and evidence
+
+**Eligible for a deployment-specific external-checkout binding under the conditions
+below.** This is our documented interpretation of the reviewed terms, not a
+Microsoft/GitHub certification or an express vendor statement about credit sales.
+The inspected terms do not specifically prohibit this scoped flow. Do not describe
+that absence as permission for every commercial use or every Copilot account.
+
+- [GitHub additional product terms, Copilot](https://docs.github.com/en/site-policy/github-terms/github-terms-for-additional-products-and-features#github-copilot)
+  directs individual users to the general terms, including AI-feature terms.
+- [GitHub ToS, effective April 27, 2026](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#j-ai-features-training-and-your-data)
+  covers AI inputs/outputs, user responsibility, and individual data-use controls.
+  Section B.5 distinguishes third-party relationships; §H restricts API abuse.
+- [GitHub acceptable-use policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies)
+  forbid service resale without permission, unsolicited promotions/spam, privacy
+  violations and deceptive conduct. Our scope is a requested purchase of the
+  connected merchant's own service, with no GitHub-service resale or unsolicited
+  promotion. Do not source sales-lead data from GitHub contrary to these rules.
+- [VS Code license](https://code.visualstudio.com/license) and
+  [MCP documentation](https://code.visualstudio.com/docs/agent-customization/mcp-servers)
+  describe the editor and direct MCP/trust mechanisms. The license alone was
+  sufficient only for the earlier developer test; it is not a commerce certificate.
+
+Native VS Code 1.135.0 passed the synthetic handoff through its normal Windows
+external-site confirmation and the default browser. Opening the page granted
+nothing; explicit simulated approval produced one unchanged 1,000-credit result
+across repeated reads. See the [host canary](../host-canaries.md). This tests
+transport and user interaction; the real merchant/account flow needs its own
+staging validation before activation.
+
+## Required deployment scope
+
+1. Bind an operator-reviewed OAuth registration to the authenticated account and
+   this exact direct channel. Never grant eligibility from `clientInfo`, model
+   name, arbitrary client metadata, or a user-supplied profile. Confirm the
+   account's agreement; organization-managed accounts need a separate review.
+2. Limit this review to `external_checkout` / `usage_credits`. The shared
+   `direct-mcp` default remains unverified until the deployment supplies a fresh
+   review. Unknown, ambiguous and published restricted profiles stay closed.
+3. Create an expiring, account-bound link on the merchant's own HTTPS origin.
+   Keep card entry and explicit payment confirmation in that browser page.
+   Tool approval, native **Open**, page load and a chat claim never charge or
+   prove payment. Verify payment and grant credits on the server exactly once.
+4. Offer the link only in response to a purchase/top-up request. Keep normal
+   host trust prompts. Do not automatically opt out of review or mark all
+   domains trusted. Never collect payment credentials in MCP arguments or chat.
+5. Expire the binding at review expiry; re-review changed terms, account type,
+   distribution, categories or host behavior. Follow merchant privacy/terms and
+   applicable provider requirements. Treat transcripts as potentially retained.
+
+Excluded: Marketplace listings, GitHub-hosted storefronts, organization accounts,
+ChatGPT/Claude hosted channels, embedded card forms, saved-card tool charges,
+automatic refill, subscriptions and blanket approval for other MCP clients.
+The VS Code rich-view startup workaround is a separate issue and still applies.

package/docs/reviews/vscode-individual-paid-work.md

@@ -0,0 +1,69 @@
+# VS Code individual Copilot: bounded paid service work
+
+Reviewed September 12, 2026; expires October 12, 2026. Channel: native VS Code,
+manually configured remote MCP, individual Copilot subscription. Scope:
+user-requested work delivered by the connected service, paid from that service's
+existing credit balance. This review is separate from
+[external checkout](vscode-individual-external-checkout.md).
+
+## Decision
+
+Eligible for a deployment-specific `paid_access` binding for `usage_credits` and
+`digital_service` under the conditions below. This is our interpretation of the
+reviewed terms, not vendor certification or express approval of every paid MCP.
+The reviewed terms do not identify a specific prohibition on this bounded use
+of an independently operated service. Re-review account type, distribution,
+service behavior and changed terms before expanding the scope.
+
+## Primary sources and interpretation
+
+- [GitHub additional product terms](https://docs.github.com/en/site-policy/github-terms/github-terms-for-additional-products-and-features#github-copilot)
+  directs individual Copilot users to GitHub ToS section J; organizational
+  agreements are outside this review.
+- [GitHub ToS](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service)
+  distinguishes third-party relationships in B.5. Section H prohibits API abuse
+  and certain data uses; J covers AI output responsibility and individual data
+  controls. Our inference: the user's separate service agreement can govern
+  metered service work, while the user's Copilot obligations continue to apply.
+- [GitHub acceptable-use policies](https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies)
+  restrict resale of GitHub services, spam, privacy misuse and abusive activity.
+  The reviewed service sells its own work. It must not sell Copilot access,
+  share accounts, evade usage limits, or obtain GitHub data for prohibited sales
+  or solicitation. Ordinary task drafts do not authorize sending outreach.
+- [VS Code MCP documentation](https://code.visualstudio.com/docs/agent-customization/mcp-servers)
+  documents remote-server configuration and host trust/tool interaction.
+  Technical support for a tool is not commercial permission. Preserve the host's
+  approvals; the service's ledger must independently enforce its budget.
+
+## Required deployment controls
+
+1. Bind the reviewed origin, verified OAuth registration and authenticated
+   account on the server. Client names, `clientInfo`, prompts, tool arguments or
+   claimed host capabilities cannot select the review. Unknown clients stay
+   ineligible. Organization accounts require a separate review.
+2. Make service-credit charging clear before work starts. Require a stable work
+   ID and an explicit maximum service-credit budget. Service credits are not
+   Copilot tokens or a promise of monetary return. Never infer an unlimited
+   spending authorization from authentication, a tool result or a chat claim.
+3. Reserve and settle atomically, cap the account's charge, and deduplicate
+   retries. Replaying a completed work ID returns its stored result. Reject
+   changed inputs under the same ID. Preserve uncertain work for reconciliation;
+   do not release its hold and repeat its effects without verification.
+4. Keep account ownership, cancellation/deletion, entitlement and balance checks
+   on the server. Exhaustion blocks new paid work but preserves bounded status
+   and recovery access. Background work needs its own durable budget propagation;
+   exclude handlers that cannot uphold the cap across detached work.
+5. This review grants only `paid_access`; checkout needs its own review. It does
+   not permit card collection in chat, saved-card charges, subscriptions,
+   automatic refill, bulk outreach or arbitrary third-party purchases. Retain
+   any separate approval needed for outbound effects and sensitive actions.
+6. Limit outputs to information the user is authorized to access. Treat host
+   transcripts as retained data. Apply the service's privacy obligations and do
+   not expose credentials, capability links or unrelated account records in
+   diagnostics or reusable canary evidence.
+
+A deployment must validate its ledger migration, actual host/account connection,
+retry behavior, budget limits and recovery before activation. A review alone
+neither activates tools nor certifies their accounting. This document does not
+change the shared `direct-mcp` default or restrictions for Claude, ChatGPT,
+marketplaces, organization-managed Copilot or other hosts.

package/package.json

@@ -73,7 +73,8 @@
     "docs/third-party",
     "canary",
     "docs/host-canaries.md",
-    "UPSTREAM_ISSUES.md"
+    "UPSTREAM_ISSUES.md",
+    "docs/reviews"
   ],
   "scripts": {
     "build": "bun run build:apps && rm -rf dist && bun build src/index.ts src/manifest.ts src/commerce.ts src/apps.ts --outdir dist --root ./src --target=bun --external @absolutejs/agency --external '@absolutejs/agency/*' --external elysia && tsc --emitDeclarationOnly --project tsconfig.json && absolute-manifest emit",
@@ -89,5 +90,5 @@
     "canary:checkout": "bun canary/checkout.ts"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.17.7"
+  "version": "0.17.9"
 }