cliffhall
fef8f5ca5a
fix(oauth): pass the raw challenge scopes to the step-up scope filter ...
Copilot review round 10 on #2114 — a defect in round 8's fix, and the
precise loop that fix's extra argument was added to prevent.
`enrichChallengeWithScopes` narrows `requiredScopes` to the *missing*
subset, so a challenge requiring `offline_access tools:write` against a
stored scope that already carries `offline_access` arrives as just
`["tools:write"]`. Passing that narrowed list made the filter read the
server's explicit requirement as inherited and strip it, so
re-authorization would earn the same challenge forever.
Passes `challenge.requiredScopes` — the raw list — instead. The mixed
case is now covered, and fails against the narrowed list.
Also stops the checkbox promising more than the setting delivers: it
does not register anything for a preconfigured or CIMD client, and the
authorization server decides issuance either way. It now says it
declares the grant so the server *may* issue a refresh token.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-24 23:35:00 -04:00
feat: allow complex JSON values in request _meta
2026-08-23 12:23:40 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
Merge remote-tracking branch 'origin/v2/main' into v2/fix/2071-oauth-resource-metadata
2026-08-24 21:26:59 -04:00
feat(oauth): make the refresh_token grant opt-out per server
2026-08-24 19:50:57 -04:00
feat: allow complex JSON values in request _meta
2026-08-23 12:23:40 -04:00
fix(apps): address review of app-rendered elicitations
2026-08-22 19:43:44 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
chore: close quality-gate coverage gaps ( #1689 ) ( #1766 )
2026-07-24 17:20:12 -04:00
fix(core): register peer-request handlers before connect ( #1797 ) ( #1798 )
2026-07-27 11:32:23 -04:00
feat(apps): negotiated app-rendered form elicitations
2026-08-22 19:05:33 -04:00
Network: modern Mcp-* headers, new error codes, cancellation-as-abort ( #1628 ) ( #1722 )
2026-07-18 17:32:05 -04:00
fix: salvage a list result's valid entries when one is malformed ( #1909 )
2026-08-15 16:52:11 -04:00
Merge branch 'v2/main' into v2/feat/2068-refresh-token-toggle
2026-08-24 22:55:00 -04:00
feat: allow complex JSON values in request _meta
2026-08-23 12:23:40 -04:00
feat: allow complex JSON values in request _meta
2026-08-23 12:23:40 -04:00
fix: return the era-parsed tool, and hide aggregate reports in paginated mode ( #1909 )
2026-08-15 20:08:03 -04:00
Tasks: io.modelcontextprotocol/tasks extension on modern servers (era fork) ( #1731 )
2026-07-21 19:17:04 -04:00
Tasks: io.modelcontextprotocol/tasks extension on modern servers (era fork) ( #1731 )
2026-07-21 19:17:04 -04:00
fix(oauth): pass the raw challenge scopes to the step-up scope filter
2026-08-24 23:35:00 -04:00
fix(core): register peer-request handlers before connect ( #1797 ) ( #1798 )
2026-07-27 11:32:23 -04:00
feat(oauth): make the refresh_token grant opt-out per server
2026-08-24 19:50:57 -04:00
feat(core): port v1.5 hook layer ( #1243 ) ( #1300 )
2026-05-13 17:43:07 -04:00
SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') ( #1624 )
2026-07-15 10:44:24 -04:00
fix(web): send a cancellation notification when cancelling an ordinary tool call ( #1458 ) ( #1463 )
2026-06-13 22:23:02 -04:00
Refactor / justify codebase-wide 'as unknown as' casts ( #1690 ) ( #1756 )
2026-07-24 09:34:32 -04:00
Test/1396 harden managed state connect tests ( #1508 )
2026-06-24 10:46:09 -04:00
Merge branch 'v2/main' into v2/feat/2068-refresh-token-toggle
2026-08-24 22:55:00 -04:00
fix: scope the value ceiling to the names a template references
2026-08-17 01:54:37 -04:00
Address @claude review: format core/, typed output-validation error, document progress heuristic
2026-07-15 11:08:54 -04:00
fef8f5ca5a