cliffhall
fef8f5ca5a
fix(oauth): pass the raw challenge scopes to the step-up scope filter ...
Copilot review round 10 on #2114 — a defect in round 8's fix, and the
precise loop that fix's extra argument was added to prevent.
`enrichChallengeWithScopes` narrows `requiredScopes` to the *missing*
subset, so a challenge requiring `offline_access tools:write` against a
stored scope that already carries `offline_access` arrives as just
`["tools:write"]`. Passing that narrowed list made the filter read the
server's explicit requirement as inherited and strip it, so
re-authorization would earn the same challenge forever.
Passes `challenge.requiredScopes` — the raw list — instead. The mixed
case is now covered, and fails against the narrowed list.
Also stops the checkbox promising more than the setting delivers: it
does not register anything for a preconfigured or CIMD client, and the
authorization server decides issuance either way. It now says it
declares the grant so the server *may* issue a refresh token.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-24 23:35:00 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
fix: gate submission on unsendable field text, and on required tool args
2026-08-15 21:19:04 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
feat(web): state the file store as a sentence, and copy its path on click
2026-08-22 14:05:13 -04:00
Merge pull request #2039 from modelcontextprotocol/v2/chore/1959-no-floating-promises
2026-08-16 22:35:52 -04:00
fix(web): render the connected header when a modern server omits serverInfo ( #1773 )
2026-07-25 11:40:31 -04:00
fix: gate submission on unsendable field text, and on required tool args
2026-08-15 21:19:04 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
fix: gate submission on unsendable field text, and on required tool args
2026-08-15 21:19:04 -04:00
MRTR: drive input_required manually to keep pending-request UX ( #1704 ) ( #1719 )
2026-07-17 23:15:19 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
fix(web): section-header hover outline + clear buttons out of tab order ( #1487 ) ( #1488 )
2026-06-14 22:27:46 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
fix: salvage a list result's valid entries when one is malformed ( #1909 )
2026-08-15 16:52:11 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
fix: mark a rejected standalone response entry as an error too
2026-08-08 17:11:34 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
fix(auth): explicit re-authorize when the OAuth callback state was lost ( #1808 ) ( #1810 )
2026-07-27 18:08:31 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
test: raise per-file coverage gate to 90 across all clients ( closes #1271 ) ( #1532 )
2026-06-27 15:26:03 -04:00
fix: read the completions map by own property, not through the prototype
2026-08-17 01:25:58 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
fix(web): focus the enlarged field before paint, and derive its section width
2026-08-24 10:03:44 -04:00
feat(web,core): import client configs and registry server.json ( #1348 ) ( #1511 )
2026-06-23 19:52:08 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
fix(auth): make the durability guard provenance-aware, and harden the claim
2026-08-22 22:10:07 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
fix(oauth): pass the raw challenge scopes to the step-up scope filter
2026-08-24 23:35:00 -04:00
feat(oauth): make the refresh_token grant opt-out per server
2026-08-24 19:50:57 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
fix(web): key tool selection by row identity, not name
2026-08-17 00:02:13 -04:00
fix(web): reset a tool form by row identity, not by tool name
2026-08-24 10:18:55 -04:00
refactor(web): sweep AGENTS.md TypeScript + Mantine rule violations ( #1771 )
2026-07-25 11:38:49 -04:00
fix(web): name an empty tool result instead of "No results yet" ( #1860 )
2026-08-16 18:31:01 -04:00
chore(lint): enable no-floating-promises in all five ESLint scopes
2026-08-16 20:57:32 -04:00
test(web): settle real-timer Transitions so the coverage gate can't leak 'window is not defined' ( #1786 ) ( #1793 )
2026-07-26 15:49:33 -04:00
Resources: subscriptions/listen model on modern servers (era fork) ( #1630 ) ( #1730 )
2026-07-20 19:33:40 -04:00
Resources: subscriptions/listen model on modern servers (era fork) ( #1630 ) ( #1730 )
2026-07-20 19:33:40 -04:00
fef8f5ca5a