cliffhall
d95a6e629c
fix: stop dropping oauth.onInsufficientScope when extracting the client secret ( #2018 ) ...
Copilot round 4 (one suppressed finding, and a real bug).
`extractSecretsFromStored` rebuilt the stripped `oauth` object from an
allow-list of the non-secret fields. That list had gone stale: it never named
`onInsufficientScope`, so a server carrying both a client secret and a
non-default SEP-2350 policy silently lost the policy on save, falling back to
`reauthorize`. This predates #2018 — the PR only extended the same list with
`authorizationParams` — but the list is the defect, so fix the class rather
than add a third entry to it.
The stripped entry now subtracts the one secret instead of enumerating what to
keep, so any field added to `oauth` later is preserved by construction.
Regression test verified to fail against the allow-list version:
`expected { clientId: 'cid' } to deeply equal { clientId: 'cid', onInsufficientScope: 'throw' }`.
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-15 21:54:16 -04:00
fix: surface list-fetch failures instead of swallowing them
2026-08-08 16:48:48 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
fix: only attribute a decode rejection to a Protocol entry
2026-08-08 17:26:36 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
chore: close quality-gate coverage gaps ( #1689 ) ( #1766 )
2026-07-24 17:20:12 -04:00
fix(core): register peer-request handlers before connect ( #1797 ) ( #1798 )
2026-07-27 11:32:23 -04:00
Extensions: Connection Info both eras + io.modelcontextprotocol/ui advertisement (Phase 3 of #1633 ) ( #1744 )
2026-07-23 10:11:36 -04:00
Network: modern Mcp-* headers, new error codes, cancellation-as-abort ( #1628 ) ( #1722 )
2026-07-18 17:32:05 -04:00
Guided-auth removal, OAuth smoke testing, and TUI/CLI support ( #1531 )
2026-06-29 15:35:51 -04:00
Merge remote-tracking branch 'origin/v2/main' into v2/feat/2018-custom-authorization-params
2026-08-15 20:45:40 -04:00
fix: surface list-fetch failures instead of swallowing them
2026-08-08 16:48:48 -04:00
fix: surface list-fetch failures instead of swallowing them
2026-08-08 16:48:48 -04:00
Tasks: io.modelcontextprotocol/tasks extension on modern servers (era fork) ( #1731 )
2026-07-21 19:17:04 -04:00
Tasks: io.modelcontextprotocol/tasks extension on modern servers (era fork) ( #1731 )
2026-07-21 19:17:04 -04:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
fix(core): register peer-request handlers before connect ( #1797 ) ( #1798 )
2026-07-27 11:32:23 -04:00
fix: stop dropping oauth.onInsufficientScope when extracting the client secret ( #2018 )
2026-08-15 21:54:16 -04:00
feat(core): port v1.5 hook layer ( #1243 ) ( #1300 )
2026-05-13 17:43:07 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
fix(web): send a cancellation notification when cancelling an ordinary tool call ( #1458 ) ( #1463 )
2026-06-13 22:23:02 -04:00
Refactor / justify codebase-wide 'as unknown as' casts ( #1690 ) ( #1756 )
2026-07-24 09:34:32 -04:00
Test/1396 harden managed state connect tests ( #1508 )
2026-06-24 10:46:09 -04:00
Merge remote-tracking branch 'origin/v2/main' into v2/feat/2018-custom-authorization-params
2026-08-15 20:45:40 -04:00
Address @claude review: format core/, typed output-validation error, document progress heuristic
2026-07-15 11:08:54 -04:00
d95a6e629c