mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
Andrew Khadder
485c79cc56
* fix(client): clean up sandbox message listener and cancel readiness wait on unmount in ViewRenderer (#2421) * fix(client): clean up sandbox message listener on unmount and add timeout in ViewRenderer * fix(client): avoid early handshake promise rejection on blob fetch abort and verify timeout listener cleanup * fix(client): tie ViewRenderer sandbox readiness wait to effect lifecycle and clean up on unmount * refactor(client): support optional timeoutMs in waitForSandboxProxyReady and add timeout unit tests * test(client): add ViewRenderer default 15s timeout integration test * refactor(client): remove sandbox readiness timeout and verify exact listener teardown * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(server): report a malformed verifier resource as configuration (#2412) createJwtVerifier canonicalizes options.resource with canonicalUrl, the same helper used for the resource claim carried by a token. That helper raises invalidToken, so misconfiguring the server throws an OAuth invalid_token error at construction, complaining about a token resource claim when no token exists yet. oauthCustomProvider validates the same option with a TypeError. Validation now happens in configuredResourceUrl, which applies the same URL rules and reports a config problem as TypeError. Deliberately not normalizedProviderUrl, which the first revision used: that helper prefixes https:// onto a scheme-less string. Right for a provider domain, wrong here, because it would have accepted "api.example.com/mcp" from a JavaScript caller that the URL type does not constrain. Which URLs are accepted is therefore unchanged from before this PR; only the error type and message move. canonicalUrl now only ever sees a token claim, so it takes a string. * chore(typescript): version packages (canary) * fix(tunnel): default localHostHeader to localhost in standalone mcp-tunnel CLI (#2456) * fix(tunnel): default localHostHeader to localhost in standalone mcp-tunnel CLI * fix(tunnel): drop redundant --local-host-header alias and document Host rewriting * fix(tunnel): drop --local-host CLI flag per maintainer review while keeping localhost default * docs(tunnel): document forwarded Host: localhost default and x-forwarded-host in README * chore(typescript): version packages (canary) * fix(cli): warn on env set secret downgrade, document --secret required on every write (#2423) * fix(cli): preserve sensitive flag on env update when --secret is omitted * refactor: simplify sensitive flag expression per review feedback * fix(cli): warn on env set secret downgrade, document --secret required every write * chore: remove stale changeset describing reverted behavior * fix(cli): tighten env set messages and drop downgradedFromSecret per review * refactor(cli): drop env set downgrade detection, keep help and docs clarification Scope the change to help text, docs, and the success message. The success message now depends only on whether --secret was passed on this invocation. Write semantics and JSON output are unchanged. * chore(typescript): version packages (canary) * fix(client): stabilize useMcp configuration dependencies to prevent reconnection loops (#2403) * fix(client): stabilize useMcp configuration dependencies to prevent reconnection loops * test(client): expand array comparison and clientOptions stability test coverage * feat(client): trigger reconnection in useMcp when headers or clientOptions change * refactor(client): scope useMcp stability to clientInfo and proxyConfig * fix(client): preserve absent vs empty icon fields and normalize proxy headers * fix(client): preserve raw proxyConfig and strengthen useMcp stability and transition tests * fix(client): return shallow copy in clientInfo and proxyConfig useMemo callbacks * test(client): remove oversized integration test file and retain focused helper tests * chore(typescript): version packages (canary) * fix(cli): report a malformed JSON argument as a usage error (#2444) parseMcpArguments raises a clean UsageError for a key=value grammar mistake and for JSON that parses but is not an object, then lets the engine's own SyntaxError escape for JSON that does not parse at all. $ mcp-use client probe tools call foo '{bad json' Expected property name or '}' in JSON at position 1 (line 1 column 2) exit 1 Exit 1 is the operational-failure code, so a typed command line is reported as an API or runtime problem, and the message says nothing about which argument was wrong. That matters most for the key:=<json> form, where one token out of several is at fault. Both parses now go through a helper that names the argument and raises UsageError, so they exit 2 like every other grammar mistake in the same function. The parse runs during argument validation, before the client connects, so this is reachable without a reachable server. * chore(typescript): version packages (canary) * fix(cli): validate servers list pagination before authenticating (#2448) * fix(cli): validate servers list pagination before authenticating servers list creates the cloud client and then validates --limit and --skip, so signed out the check never runs: $ mcp-use servers list --limit 0 Not logged in. Run `mcp-use login`. exit 1 deployments list takes the same two options and reports them properly, because it validates first: $ mcp-use deployments list --limit 0 --limit must be an integer from 1 to 100. exit 2 Moving the call above cloudApiForOrganization makes the two agree, and stops the command reaching for credentials to run something that cannot run either way. * test(cli): cover the --skip message in the validate-before-auth case parsePagination raises a distinct message for --skip, and the fix moves both checks ahead of the cloud client, so both deserve coverage. Reverting servers.ts to the canary ordering now fails two tests rather than one. * chore(typescript): version packages (canary) * fix(client): coalesce concurrent connector operations and prevent process leaks (#2458) * fix(client): coalesce concurrent connector operations and prevent process leaks In @mcp-use/client, BaseConnector delegated connect() to subclasses with only a synchronous `if (this.connected)` guard. Because this.connected was only set after child process spawning, transport creation, and protocol handshakes: 1. Concurrent connect() calls on StdioConnector instantiated multiple StdioConnectionManager instances, spawning duplicate OS child processes and overwriting this.connectionManager. The first child process was abandoned and leaked permanently in the OS. 2. Concurrent connect() calls on HttpConnector overwrote transport and client references, causing partial teardowns mid-flight on failure or leaking SSE sessions. 3. Invoking disconnect() while connect() was in flight saw !this.connected and returned immediately as a no-op, leaving the connection and its underlying resources permanently open after connect() settled. 4. Concurrent disconnect() calls issued racing duplicate calls to cleanupResources(). This moves lifecycle synchronization directly into BaseConnector: - Coalesce concurrent connect() calls using an internal connectPromise. - Coalesce concurrent disconnect() calls using an internal disconnectPromise. - When disconnect() is called while connect() is in flight, await the in-flight connection attempt before tearing down resources so nothing is orphaned, and prevent the connector from marking itself connected. - When connect() is called while disconnect() is in flight, wait for teardown to complete before opening a new connection. - Subclasses now implement protected establishTransport() without needing to re-implement connection concurrency guards. * fix(client): reject in-flight connect when cancelled by disconnect When disconnect() is initiated while establishTransport() is in flight, connect() now rejects with 'Connection cancelled by disconnect' instead of fulfilling. This prevents callers awaiting connect() from assuming the connection succeeded and then encountering disconnected-state errors on subsequent operations. * fix(client): cancel queued reconnects on later disconnect * chore(client): add patch changeset for connector lifecycle fixes --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server): keep upstream resource annotations and _meta when proxying (#2469) ResourceDefinition carries annotations and _meta, and both survive local registration. The proxy mount copies only title, description and mimeType, and ProxyResource does not even declare the other two, so an upstream resource loses its client hints and its extension metadata the moment the server is composed with use(). Both are documented on the resource descriptor and neither has a framework-derived counterpart, unlike a tool's _meta.ui.* keys, which the server computes from view and visibility. There is nothing to collide with here, so forwarding is a straight passthrough. Prompts need no equivalent change: PromptDefinition has no _meta. * chore(typescript): version packages (canary) * ci: add CLI mirror workflow to canary * feat(server): add public chat CTA to landing page (#2496) * chore(typescript): version packages (canary) * chore(typescript): use official ext-apps 2.0.0 (#2498) * chore(typescript): version packages (canary) * fix(agent): use Responses API for OpenRouter OpenAI models (#2501) * fix(agent): use Responses API for OpenRouter * fix(agent): preserve Responses request options and errors * test(agent): remove OpenRouter Responses coverage * fix(agent): scope OpenRouter Responses to OpenAI models * docs(agent): clarify OpenRouter BYOK fix * fix(agent): preserve direct OpenAI temperature behavior * chore(typescript): version packages (canary) * fix(release): propagate bundled Inspector releases and validate peers (#2504) * fix(release): propagate bundled artifacts and validate published peers * fix(ci): include release automation in dependency analysis * chore(typescript): version packages (canary) * fix(release): allow npm publish-time scanning to finish (#2505) * chore(release): update changelogs for Inspector and TypeScript packages to reflect recent patch releases and enhancements --------- Co-authored-by: Rohith Reddy Nama <104615697+rohith500@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Ayaan Gazali <ayaangazali.work@gmail.com> Co-authored-by: aishwary-dongre <87765118+aishwary-dongre@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com>