feat: SEP-2575 subscriptionId value assertion + server-sent cancelled restriction#351
Draft
pja-ant wants to merge 1 commit into
Draft
feat: SEP-2575 subscriptionId value assertion + server-sent cancelled restriction#351pja-ant wants to merge 1 commit into
pja-ant wants to merge 1 commit into
Conversation
… cancelled restriction check (SEP-2575) Upstream spec PR modelcontextprotocol/modelcontextprotocol#2889 clarifies that io.modelcontextprotocol/subscriptionId MUST equal the JSON-RPC id of the subscriptions/listen request, and that servers MUST NOT send notifications/cancelled for any purpose other than tearing down a subscriptions/listen stream. - listenToStream now accepts an explicit request id so callers can assert against it; sep-2575-server-tags-subscription-id now also fails when the value does not match the listen request id (string/number normalised). - New check sep-2575-server-cancelled-only-for-subscription flags notifications/cancelled arriving on a non-subscription response stream; the tools/call probe stream is hoisted and shared with the existing no-independent-requests check. - sep-2575.yaml: add the new check row and an excluded row for the server-initiated teardown MUST (no portable black-box trigger). - stateless.test.ts: spec-compliant fallback now echoes the listen id; releaseLock moved onto the mock reader so frame inspection actually runs; added negative tests for the mismatched subscriptionId and stray notifications/cancelled cases plus positive assertions for each. Claude-Session: https://claude.ai/code/session_01Gbqx5LodtAghT5fRYFxeja
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns the SEP-2575 server scenario with the cancellation/subscription clarifications from modelcontextprotocol/modelcontextprotocol#2889:
io.modelcontextprotocol/subscriptionIdin notification_metaMUST equal the JSON-RPCidof thesubscriptions/listenrequest that opened the stream.notifications/cancelledfor any purpose other than tearing down asubscriptions/listenstream.notifications/cancelledreferencing the listen request id when tearing down that stream — no portable black-box trigger, so traceabilityexcluded.Check IDs
sep-2575-server-tags-subscription-id— strengthened: now also fails when the value does not match the listen request id (string/number normalised).sep-2575-server-cancelled-only-for-subscription— new: flagsnotifications/cancelledarriving on a non-subscription SSE response stream.Changes
listenToStreamnow accepts an explicit request id so callers can assert against it.tools/callprobe stream is hoisted and shared betweensep-2575-http-server-no-independent-requests-on-streamand the new cancelled check (one fewer round-trip).src/seps/sep-2575.yaml: new check row +excludedrow for the server-initiated teardown MUST.stateless.test.ts: spec-compliant fallback echoes the listen id;releaseLockmoved onto the mock reader so frame inspection runs; new negative tests for mismatchedsubscriptionIdand straynotifications/cancelled, each with a positive cross-assertion.npx tsc --noEmit,npm test(295 pass),npm run lintall green.https://claude.ai/code/session_01Gbqx5LodtAghT5fRYFxeja