Wave 1 rollup: integrated 1579-wave-1 (#1600)#1601

Merged

cliffhall merged 77 commits into

Jul 9, 2026

Commits on Jun 27, 2026

docs: add CONTRIBUTORS.md issues-only policy (#1517)

cliffhall
and
claude
committed
docs: add PR template redirecting external authors to issues-only policy (#1517)

cliffhall
and
claude
committed
docs: drop version-board details from CONTRIBUTORS.md (#1517)

cliffhall
and
claude
committed

Commits on Jul 1, 2026

feat(cli): exit-code map + structured JSON error envelopes (closes #1564)

cliffhall
and
claude
committed
feat(core): redact sensitive headers in the fetch log (closes #1561)

cliffhall
and
claude
committed
feat(core): add AppInfo + extractAppInfo() to core/mcp/apps.ts (closes #1556)

cliffhall
and
claude
committed
feat(web): generalize downloadFile.ts with downloadBlob, fileNameFromUri, isHttpUrl (closes #1560)

cliffhall
and
claude
committed
feat(test-servers): mcp_app_demo preset + _meta on tool/resource defs (closes #1557)

cliffhall
and
claude
committed
feat(web): extract hostContext utilities for the Apps host (closes #1559)

cliffhall
and
claude
committed
feat(web): add sandbox CSP builder library (closes #1558)

cliffhall
and
claude
committed
feat(auth): harden OAuth state generation and callback validation (closes #1562)

cliffhall
and
claude
committed
feat(core): honor HTTPS_PROXY/HTTP_PROXY/NO_PROXY in the Node transport (closes #1563)

cliffhall
and
claude
committed
feat(web): migrate OAuth store to shared /store API (RemoteOAuthStorage parity) (closes #1548)

cliffhall
and
claude
committed
fix(cli): guard numeric .code to HTTP range; bound cause-chain depth

cliffhall
and
claude
committed
test(test-servers): export MCP_APP_DEMO_URI, dedupe in integration test

cliffhall
and
claude
committed
refactor(auth): address review — accurate toast copy, document state asymmetry, tighten test

cliffhall
and
claude
committed
refactor(core): narrow readUiMeta from unknown; document ui-meta precedence

cliffhall
and
claude
committed
fix(ci): run CI on Node 22.x and correct undici 8 Node floor (#1563)

cliffhall
and
claude
committed
refactor(web): document + guard sandbox CSP builder per review

cliffhall
and
claude
committed
test(test-servers): pass tool _meta through the task-tool registration path

cliffhall
and
claude
committed
fix(auth): make clear* hydration-safe, migrate raw-key blobs, doc keepalive/memo caveats

cliffhall
and
claude
committed
fix(deps): sync root package-lock engines to Node >=22.19.0 (#1563)

cliffhall
and
claude
committed
docs(test-servers): note custom resource handlers must re-add _meta

cliffhall
and
claude
committed
fix(auth): route clearClientInformation through clearAfterHydration too

cliffhall
and
claude
committed
docs(auth): note getClientRegistrationKind's hydration invariant like getScope

cliffhall
and
claude
committed

Commits on Jul 2, 2026

Commits on Jul 3, 2026

Merge remote-tracking branch 'origin/v2/main' into 1579-wave-1
cliffhall
committed

Commits on Jul 4, 2026

docs: address review nits on the v2/main merge

cliffhall
and
claude
committed

Commits on Jul 9, 2026