cliffhall
1e501fa5cb
fix: redact sensitive query values from timeout diagnostics ( #2319 round 23) ...
The timeout message interpolated the raw request URL, and
createFetchTracker records that message verbatim into the Network log
and the persisted session. An OAuth endpoint's query string can carry a
`code`, an `access_token` or a `client_secret` — exactly the fields
fetchTracking already redacts everywhere else it records a URL — so a
stalled signed endpoint would have written its secret to both.
Redacted with the existing `redactUrlQuery`, in the
OAuthRequestTimeoutError constructor rather than at each display site,
so both the message and the public `url` field are covered by
construction and no future consumer can reintroduce it. The route's own
proxied-timeout message and the URL in its 504 marker get the same
treatment, since both cross back to the browser and are recorded there.
The path and every non-sensitive parameter survive, so the endpoint
stays identifiable — which was the point of naming it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-11 07:57:38 -04:00
fix: walk past an empty-string cursor in the legacy task refresh ( #2220 )
2026-09-06 13:59:51 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
Merge remote-tracking branch 'origin/v2/main' into v2/fix/2071-oauth-resource-metadata
2026-08-24 21:26:59 -04:00
fix: redact sensitive query values from timeout diagnostics ( #2319 round 23)
2026-09-11 07:57:38 -04:00
feat: Skills extension phase 3 — CLI, TUI, directory reads, frontmatter check
2026-09-07 18:10:37 -04:00
fix(apps): address review of app-rendered elicitations
2026-08-22 19:43:44 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
chore: close quality-gate coverage gaps ( #1689 ) ( #1766 )
2026-07-24 17:20:12 -04:00
fix(core): register peer-request handlers before connect ( #1797 ) ( #1798 )
2026-07-27 11:32:23 -04:00
feat(apps): negotiated app-rendered form elicitations
2026-08-22 19:05:33 -04:00
Network: modern Mcp-* headers, new error codes, cancellation-as-abort ( #1628 ) ( #1722 )
2026-07-18 17:32:05 -04:00
fix: salvage a list result's valid entries when one is malformed ( #1909 )
2026-08-15 16:52:11 -04:00
fix: narrow the exemption per transport ( #2319 round 18)
2026-09-11 06:40:07 -04:00
feat: allow complex JSON values in request _meta
2026-08-23 12:23:40 -04:00
feat: Skills extension phase 3 — CLI, TUI, directory reads, frontmatter check
2026-09-07 18:10:37 -04:00
fix: return the era-parsed tool, and hide aggregate reports in paginated mode ( #1909 )
2026-08-15 20:08:03 -04:00
fix: cancel a Streamable HTTP call by closing its stream ( #2140 )
2026-08-28 00:55:29 -04:00
Tasks: io.modelcontextprotocol/tasks extension on modern servers (era fork) ( #1731 )
2026-07-21 19:17:04 -04:00
fix(web): address Copilot review on the OAuth recovery failure arms
2026-08-29 01:54:53 -04:00
fix(core): register peer-request handlers before connect ( #1797 ) ( #1798 )
2026-07-27 11:32:23 -04:00
feat: seed the MCP org example server as a remote first-run card ( #2201 )
2026-09-06 22:57:53 -04:00
feat(core): port v1.5 hook layer ( #1243 ) ( #1300 )
2026-05-13 17:43:07 -04:00
fix: address Copilot review round 4 on #2251
2026-09-04 22:38:03 -04:00
fix: address Copilot review round 8 on #2248
2026-09-07 21:09:26 -04:00
fix: address Copilot review round 19 on #2248
2026-09-07 23:55:53 -04:00
fix: address Copilot review round 13 on #2248
2026-09-07 22:09:19 -04:00
fix: address Copilot review round 19 on #2248
2026-09-07 23:55:53 -04:00
fix(core): say why a never-acknowledged subscriptions/listen ended
2026-08-27 20:49:55 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
fix(web): send a cancellation notification when cancelling an ordinary tool call ( #1458 ) ( #1463 )
2026-06-13 22:23:02 -04:00
Refactor / justify codebase-wide 'as unknown as' casts ( #1690 ) ( #1756 )
2026-07-24 09:34:32 -04:00
fix(core): read state stores during render instead of re-syncing in an effect
2026-08-29 02:07:53 -04:00
fix(auth): keep the failure path total, and align the docs with the new order ( #2144 )
2026-08-28 05:55:00 -04:00
fix: scope the value ceiling to the names a template references
2026-08-17 01:54:37 -04:00
Address @claude review: format core/, typed output-validation error, document progress heuristic
2026-07-15 11:08:54 -04:00
1e501fa5cb