Skip to content

Refactor matchGrammarCompletion: extract phases and category handlers#3

Closed
curtisman wants to merge 476 commits intomainfrom
refactor2
Closed

Refactor matchGrammarCompletion: extract phases and category handlers#3
curtisman wants to merge 476 commits intomainfrom
refactor2

Conversation

@curtisman
Copy link
Copy Markdown
Owner

Summary

Refactor the ~870-line matchGrammarCompletion function in grammarCompletion.ts into standalone module-scope functions, eliminating all closure variables.

Changes

Commit 1: Extract phases into standalone functions

  • CompletionContext — plain object holding mutable state shared across phases (prefix, direction, maxPrefixLength, candidates).
  • createCompletionContext() — factory function.
  • updateMaxPrefixLength() — advances max and clears stale candidates.
  • collectPropertyCandidate() — collects property completion candidates.
  • tryCollectStringCandidate() — partial string match + candidate collect.
  • tryCollectBackwardCandidate() — backward backup to last matched item.
  • collectCandidates() (Phase A) — main loop over grammar states, categorizes into exact/partial/dirty and collects candidates.
  • resolveWildcardAnchors() (Phase B1) — resolves wildcard-at-EOI partial keyword anchors.
  • materializeCandidates() (Phase B2) — converts candidates into final completions[], properties[], and metadata.
  • matchGrammarCompletion() — thin orchestrator calling the above.

Commit 2: Extract category handlers from collectCandidates

  • processExactMatch() — Category 1: backs up to last matched term.
  • processCleanPartial() — Category 2: defers EOI descriptors, collects forward/backward candidates.
  • processDirtyPartial() — Category 3: handles unfinalizable wildcards (3a) and trailing text (3b).

Verification

  • Public API and behavior unchanged
  • All 431 completion tests pass (6 test suites)
  • Build succeeds with no errors
  • Single file changed: packages/actionGrammar/src/grammarCompletion.ts

dependabot bot and others added 30 commits January 8, 2026 18:15
…t#1812)

Bumps
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
from 1.24.0 to 1.25.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases"><code>@​modelcontextprotocol/sdk</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.25.2</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: trigger workflow on v1.x branch by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1319">modelcontextprotocol/typescript-sdk#1319</a></li>
<li>fix: README badges links destinations by <a
href="https://github.com/antonpk1"><code>@​antonpk1</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/907">modelcontextprotocol/typescript-sdk#907</a></li>
<li>fix: prevent ReDoS in UriTemplate regex patterns (v1.x backport) by
<a href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in
<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1365">modelcontextprotocol/typescript-sdk#1365</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/antonpk1"><code>@​antonpk1</code></a>
made their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/907">modelcontextprotocol/typescript-sdk#907</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/1.25.1...v1.25.2">https://github.com/modelcontextprotocol/typescript-sdk/compare/1.25.1...v1.25.2</a></p>
<h2>1.25.1</h2>
<h2>What's Changed</h2>
<ul>
<li>spec types - backwards compatibility changes by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1306">modelcontextprotocol/typescript-sdk#1306</a></li>
<li>chore: bump version for patch fix by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1307">modelcontextprotocol/typescript-sdk#1307</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/1.25.0...1.25.1">https://github.com/modelcontextprotocol/typescript-sdk/compare/1.25.0...1.25.1</a></p>
<h2>1.25.0</h2>
<h2>What's Changed</h2>
<ul>
<li>list changed handlers on client constructor by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1206">modelcontextprotocol/typescript-sdk#1206</a></li>
<li>Role - moved from inline to reusable type by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1221">modelcontextprotocol/typescript-sdk#1221</a></li>
<li>fix: use versioned npm tag for non-main branch releases by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1236">modelcontextprotocol/typescript-sdk#1236</a></li>
<li>No automatic completion support unless needed - Revisited yet again
by <a href="https://github.com/cliffhall"><code>@​cliffhall</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1237">modelcontextprotocol/typescript-sdk#1237</a></li>
<li>fix: Support updating output schema by <a
href="https://github.com/vincent0426"><code>@​vincent0426</code></a> in
<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1048">modelcontextprotocol/typescript-sdk#1048</a></li>
<li>Remove type dependency on <code>@​cfworker/json-schema</code> by <a
href="https://github.com/LucaButBoring"><code>@​LucaButBoring</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1229">modelcontextprotocol/typescript-sdk#1229</a></li>
<li>Relocate tests under <code>/test</code> by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1220">modelcontextprotocol/typescript-sdk#1220</a></li>
<li>Fix tsconfig: remove tests by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1240">modelcontextprotocol/typescript-sdk#1240</a></li>
<li>tsconfig - tests and build fix by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1243">modelcontextprotocol/typescript-sdk#1243</a></li>
<li>fix a typo in examples README by <a
href="https://github.com/DaleSeo"><code>@​DaleSeo</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1246">modelcontextprotocol/typescript-sdk#1246</a></li>
<li>Protocol date validation by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1247">modelcontextprotocol/typescript-sdk#1247</a></li>
<li>Flaky test fix on Types.test.ts by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1244">modelcontextprotocol/typescript-sdk#1244</a></li>
<li>SPEC COMPLIANCE: Remove loose/passthrough types not allowed/defined
by MCP spec + Task types by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1242">modelcontextprotocol/typescript-sdk#1242</a></li>
<li>Follow-up fixes for PR <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1242">#1242</a>
by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1274">modelcontextprotocol/typescript-sdk#1274</a></li>
<li>Update server examples and docs by <a
href="https://github.com/DaleSeo"><code>@​DaleSeo</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1285">modelcontextprotocol/typescript-sdk#1285</a></li>
<li>Update TypeScript config to ES2020 to fix AJV imports by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1297">modelcontextprotocol/typescript-sdk#1297</a></li>
<li>Fix Zod v4 schema description extraction by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1296">modelcontextprotocol/typescript-sdk#1296</a></li>
<li>Add optional description field to Implementation schema by <a
href="https://github.com/calclavia"><code>@​calclavia</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1295">modelcontextprotocol/typescript-sdk#1295</a></li>
<li>Add theme property to Icon schema by <a
href="https://github.com/DaleSeo"><code>@​DaleSeo</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1290">modelcontextprotocol/typescript-sdk#1290</a></li>
<li>feat: fetch transport by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1209">modelcontextprotocol/typescript-sdk#1209</a></li>
<li>chore: bump version for release by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1301">modelcontextprotocol/typescript-sdk#1301</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/vincent0426"><code>@​vincent0426</code></a>
made their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1048">modelcontextprotocol/typescript-sdk#1048</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/1.24.3...1.25.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/1.24.3...1.25.0</a></p>
<h2>1.24.3</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/b392f02ffcf37c088dbd114fedf25026ec3913d3"><code>b392f02</code></a>
fix: prevent ReDoS in UriTemplate regex patterns (v1.x backport) (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1365">#1365</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/a0c9b13484748acab9e5dc8317a7e89c06b52e37"><code>a0c9b13</code></a>
fix: README badges links destinations (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/907">#907</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/6dd08ac60804f30fd3c4ff71d60699c1fcbf5f68"><code>6dd08ac</code></a>
ci: trigger workflow on v1.x branch (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1319">#1319</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/384311b9b8452017f5f81819c133dc45c667cfa4"><code>384311b</code></a>
chore: bump version for patch fix (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1307">#1307</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/fb07af810b51003c338dc4885a9e42f54519f9af"><code>fb07af8</code></a>
spec types - backwards compatibility changes (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1306">#1306</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2b20ca95735e82a2ba7c47c9bd303057601b7f8e"><code>2b20ca9</code></a>
chore: bump version for release (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1301">#1301</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/67ba7adbb73a0e40c2c350c74280ae3ac0aa47d6"><code>67ba7ad</code></a>
feat: fetch transport (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1209">#1209</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/1d425471342ceb414aa47eaca0173d3f35014633"><code>1d42547</code></a>
Add theme property to Icon schema (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1290">#1290</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/54303b4f8c94c5ce0fdc6598d5957e7db5f9eccb"><code>54303b4</code></a>
Add optional description field to Implementation schema (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1295">#1295</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/9941294df9c3b9121c042a72419248bf83d45c5c"><code>9941294</code></a>
Fix Zod v4 schema description extraction (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1296">#1296</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/1.24.0...v1.25.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@modelcontextprotocol/sdk&package-manager=npm_and_yarn&previous-version=1.24.0&new-version=1.25.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/TypeAgent/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: robgruen <robgruen@microsoft.com>
…#1815)

Add service keys verification tool and dotenv dependency

- Introduced a new script `testServiceKeys.ts` for validating service
keys configured in the .env file.
- Implemented detailed checks for various services including Azure
OpenAI, OpenAI, Microsoft Graph, and others.
- Added color-coded console output for better visibility of test
results.
- Updated `package.json` to include `dotenv` as a development dependency
for loading environment variables.
    - fix for microsoft#1814

---------

Co-authored-by: robgruen <robgruen@microsoft.com>
Simple client to connect to agent-server and execute request, using a
URI format.
More autoshell updates:

- sparse virtual desktop management
- airplane mode toggle
- connect to a wifi network
- disconnect from wifi
- can supply multiple actions on the command line now
Benchmarking commands will run the answer generator for a set of
questions and compare the performance of StructuredRAG vs.
TraditionalRAG.
- wifi connect/disconnect
- airplane mode on/off
- toggle notification center
- create new tesktop
- pin window to all desktops
- next desktop
- previous desktop
- Fix solution to point to the right architecture.
- Add VS2026 support in ./Build.ps1
- Generate Test cert if it doesn't exist in ./Sign-Package.ps1
- Include 'ws' in the urihandler bundle
- Agent server should revert clientIO to null client IO after the client
disconnected to avoid "agent disconnect" error
- Move the bundle building to a postbuild command that always runs
instead of people having to run build:bundle.
- Consolidate the bundle-nodescript.ps1 logic into build.ps1
## Summary

This PR introduces a new MCP (Model Context Protocol) server that
enables Claude Code to execute TypeAgent commands through natural
language. The server bridges Claude Code and the TypeAgent dispatcher,
enabling music playback, list management, calendar operations, and other
TypeAgent capabilities.

## Key Features

- **WebSocket Connection**: Connects Claude Code to TypeAgent dispatcher
at `ws://localhost:8999`
- **Automatic Reconnection**: Monitors connection health and reconnects
every 5 seconds if needed
- **Lazy Connection**: Server starts even if TypeAgent dispatcher isn't
running yet
- **Comprehensive Logging**: All activity logged to temp files
(`/tmp/typeagent-mcp/`) for debugging
- **Clean Output**: HTML image tags are stripped from responses for
better readability in CLI

## Natural Language Commands

The server translates natural language into TypeAgent actions:

- Music: `"play bohemian rhapsody by queen"`, `"my ear wants to hear
thriller"`
- Lists: `"what's on my grocery list"`, `"add milk to shopping list"`
- Calendar: `"schedule meeting tomorrow at 2pm"` (when calendar agent is
available)

## Caching Behavior

The TypeAgent dispatcher includes intelligent caching that learns from
command patterns:
- First use of a sentence structure: AI translation (~1-2s)
- Subsequent uses: Cached translation (~0.001s)
- Cache persists across different songs/items with same structure

## Installation

Users add this to `.mcp.json` in the TypeAgent repo:

```json
{
  "mcpServers": {
    "command-executor": {
      "command": "node",
      "args": ["packages/commandExecutor/dist/server.js"]
    }
  }
}
```

## Files Added

- `packages/commandExecutor/` - Complete MCP server package
- `.mcp.json` - Example MCP configuration
- README with installation and usage instructions
- Logging utilities and test client

## Test Plan

- [x] Play music with various sentence structures
- [x] Manage lists (grocery, shopping)
- [x] Verify caching behavior (0.001s for cached, 1-2s for new patterns)
- [x] Test reconnection when TypeAgent server restarts
- [x] Verify clean output formatting

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Bumps [starlette](https://github.com/Kludex/starlette) from 0.48.0 to
0.49.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/releases">starlette's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.49.1</h2>
<p>This release fixes a security vulnerability in the parsing logic of
the <code>Range</code> header in <code>FileResponse</code>.</p>
<p>You can view the full security advisory: <a
href="https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8">GHSA-7f5h-v6xp-fcq8</a></p>
<h2>Fixed</h2>
<ul>
<li>Optimize the HTTP ranges parsing logic <a
href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5">4ea6e22b489ec388d6004cfbca52dd5b147127c5</a></li>
</ul>
<hr />
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/0.49.0...0.49.1">https://github.com/Kludex/starlette/compare/0.49.0...0.49.1</a></p>
<h2>Version 0.49.0</h2>
<h2>Added</h2>
<ul>
<li>Add <code>encoding</code> parameter to <code>Config</code> class <a
href="https://redirect.github.com/Kludex/starlette/pull/2996">#2996</a>.</li>
<li>Support multiple cookie headers in <code>Request.cookies</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3029">#3029</a>.</li>
<li>Use <code>Literal</code> type for <code>WebSocketEndpoint</code>
encoding values <a
href="https://redirect.github.com/Kludex/starlette/pull/3027">#3027</a>.</li>
</ul>
<h2>Changed</h2>
<ul>
<li>Do not pollute exception context in <code>Middleware</code> when
using <code>BaseHTTPMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/2976">#2976</a>.</li>
</ul>
<hr />
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/TheWesDias"><code>@​TheWesDias</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3017">Kludex/starlette#3017</a></li>
<li><a href="https://github.com/gmos2104"><code>@​gmos2104</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/3027">Kludex/starlette#3027</a></li>
<li><a
href="https://github.com/secrett2633"><code>@​secrett2633</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/2996">Kludex/starlette#2996</a></li>
<li><a
href="https://github.com/adam-sikora"><code>@​adam-sikora</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/starlette/pull/2976">Kludex/starlette#2976</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/starlette/compare/0.48.0...0.49.0">https://github.com/Kludex/starlette/compare/0.48.0...0.49.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.1 (October 28, 2025)</h2>
<p>This release fixes a security vulnerability in the parsing logic of
the <code>Range</code> header in <code>FileResponse</code>.</p>
<p>You can view the full security advisory: <a
href="https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8">GHSA-7f5h-v6xp-fcq8</a></p>
<h4>Fixed</h4>
<ul>
<li>Optimize the HTTP ranges parsing logic <a
href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5">4ea6e22b489ec388d6004cfbca52dd5b147127c5</a></li>
</ul>
<h2>0.49.0 (October 28, 2025)</h2>
<h4>Added</h4>
<ul>
<li>Add <code>encoding</code> parameter to <code>Config</code> class <a
href="https://redirect.github.com/Kludex/starlette/pull/2996">#2996</a>.</li>
<li>Support multiple cookie headers in <code>Request.cookies</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/3029">#3029</a>.</li>
<li>Use <code>Literal</code> type for <code>WebSocketEndpoint</code>
encoding values <a
href="https://redirect.github.com/Kludex/starlette/pull/3027">#3027</a>.</li>
</ul>
<h4>Changed</h4>
<ul>
<li>Do not pollute exception context in <code>Middleware</code> when
using <code>BaseHTTPMiddleware</code> <a
href="https://redirect.github.com/Kludex/starlette/pull/2976">#2976</a>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Kludex/starlette/commit/7e4b7428f273dbdc875dcd036d20804bcfc7b2ee"><code>7e4b742</code></a>
Version 0.49.1 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3047">#3047</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5"><code>4ea6e22</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/Kludex/starlette/commit/7d88ea6f8ec8aa99cdb5fc7a10b88db5aadfdfee"><code>7d88ea6</code></a>
Version 0.49.0 (<a
href="https://redirect.github.com/Kludex/starlette/issues/3046">#3046</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/26d66bbfb05c7bbecbbb57106c65f33682f8174e"><code>26d66bb</code></a>
Do not pollute exception context in Middleware (<a
href="https://redirect.github.com/Kludex/starlette/issues/2976">#2976</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/a59397db889e3a96c4f34b1406957a3b92e1e8b5"><code>a59397d</code></a>
Set encodings when reading config files (<a
href="https://redirect.github.com/Kludex/starlette/issues/2996">#2996</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/3b7f0cbf598be305528a498a35089ce723060372"><code>3b7f0cb</code></a>
test: add test for unknown status (<a
href="https://redirect.github.com/Kludex/starlette/issues/3035">#3035</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/b09ce1a99d352ee6f5b896597f03a1a57507afcd"><code>b09ce1a</code></a>
docs: fix legibility issues on sponsorship page (<a
href="https://redirect.github.com/Kludex/starlette/issues/3039">#3039</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/0f0edcf8007412d9536bf8714c5815ce8f5dba4b"><code>0f0edcf</code></a>
Revert &quot;Add Marcelo Trylesinski to the license (<a
href="https://redirect.github.com/Kludex/starlette/issues/3025">#3025</a>)&quot;
(<a
href="https://redirect.github.com/Kludex/starlette/issues/3044">#3044</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/3912d6313730cc6004dfb4436e37dbc1a81db7c8"><code>3912d63</code></a>
docs: add social icons (<a
href="https://redirect.github.com/Kludex/starlette/issues/3038">#3038</a>)</li>
<li><a
href="https://github.com/Kludex/starlette/commit/4915a9309fcad58ac08b9fa550563d3287b531ad"><code>4915a93</code></a>
Add discord to README/docs (<a
href="https://redirect.github.com/Kludex/starlette/issues/3034">#3034</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/starlette/compare/0.48.0...0.49.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=starlette&package-manager=uv&previous-version=0.48.0&new-version=0.49.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/TypeAgent/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: robgruen <robgruen@microsoft.com>
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.6.3</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Changes</h2>
<ul>
<li>Fixed a security issue where decompression-bomb safeguards of the
streaming API were bypassed when HTTP redirects were followed.
(CVE-2026-21441 reported by <a
href="https://github.com/D47A"><code>@​D47A</code></a>, 8.9 High,
GHSA-38jv-5279-wg99)</li>
<li>Started treating <code>Retry-After</code> times greater than 6 hours
as 6 hours by default. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3743">urllib3/urllib3#3743</a>)</li>
<li>Fixed <code>urllib3.connection.VerifiedHTTPSConnection</code> on
Emscripten. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3752">urllib3/urllib3#3752</a>)</li>
</ul>
<h2>2.6.2</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Changes</h2>
<ul>
<li>Fixed <code>HTTPResponse.read_chunked()</code> to properly handle
leftover data in the decoder's buffer when reading compressed chunked
responses. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3734">urllib3/urllib3#3734</a>)</li>
</ul>
<h2>2.6.1</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Changes</h2>
<ul>
<li>Restore previously removed <code>HTTPResponse.getheaders()</code>
and <code>HTTPResponse.getheader()</code> methods. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3731">#3731</a>)</li>
</ul>
<h2>2.6.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<ul>
<li>Fixed a security issue where streaming API could improperly handle
highly compressed HTTP content (&quot;decompression bombs&quot;) leading
to excessive resource consumption even when a small amount of data was
requested. Reading small chunks of compressed data is safer and much
more efficient now. (CVE-2025-66471 reported by <a
href="https://github.com/Cycloctane"><code>@​Cycloctane</code></a>, 8.9
High, GHSA-2xpw-w6gg-jr37)</li>
<li>Fixed a security issue where an attacker could compose an HTTP
response with virtually unlimited links in the
<code>Content-Encoding</code> header, potentially leading to a denial of
service (DoS) attack by exhausting system resources during decoding. The
number of allowed chained encodings is now limited to 5. (CVE-2025-66418
reported by <a
href="https://github.com/illia-v"><code>@​illia-v</code></a>, 8.9 High,
GHSA-gm62-xv2j-4w53)</li>
</ul>
<blockquote>
<p>[!IMPORTANT]</p>
<ul>
<li>If urllib3 is not installed with the optional
<code>urllib3[brotli]</code> extra, but your environment contains a
Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at
least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security
fixes and avoid warnings. Prefer using <code>urllib3[brotli]</code> to
install a compatible Brotli package automatically.</li>
</ul>
</blockquote>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.6.3 (2026-01-07)</h1>
<ul>
<li>Fixed a high-severity security issue where decompression-bomb
safeguards of
the streaming API were bypassed when HTTP redirects were followed.
(<code>GHSA-38jv-5279-wg99
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99&gt;</code>__)</li>
<li>Started treating <code>Retry-After</code> times greater than 6 hours
as 6 hours by
default. (<code>[#3743](urllib3/urllib3#3743)
&lt;https://github.com/urllib3/urllib3/issues/3743&gt;</code>__)</li>
<li>Fixed <code>urllib3.connection.VerifiedHTTPSConnection</code> on
Emscripten.
(<code>[#3752](urllib3/urllib3#3752)
&lt;https://github.com/urllib3/urllib3/issues/3752&gt;</code>__)</li>
</ul>
<h1>2.6.2 (2025-12-11)</h1>
<ul>
<li>Fixed <code>HTTPResponse.read_chunked()</code> to properly handle
leftover data in
the decoder's buffer when reading compressed chunked responses.
(<code>[#3734](urllib3/urllib3#3734)
&lt;https://github.com/urllib3/urllib3/issues/3734&gt;</code>__)</li>
</ul>
<h1>2.6.1 (2025-12-08)</h1>
<ul>
<li>Restore previously removed <code>HTTPResponse.getheaders()</code>
and
<code>HTTPResponse.getheader()</code> methods.
(<code>[#3731](urllib3/urllib3#3731)
&lt;https://github.com/urllib3/urllib3/issues/3731&gt;</code>__)</li>
</ul>
<h1>2.6.0 (2025-12-05)</h1>
<h2>Security</h2>
<ul>
<li>Fixed a security issue where streaming API could improperly handle
highly
compressed HTTP content (&quot;decompression bombs&quot;) leading to
excessive resource
consumption even when a small amount of data was requested. Reading
small
chunks of compressed data is safer and much more efficient now.
(<code>GHSA-2xpw-w6gg-jr37
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37&gt;</code>__)</li>
<li>Fixed a security issue where an attacker could compose an HTTP
response with
virtually unlimited links in the <code>Content-Encoding</code> header,
potentially
leading to a denial of service (DoS) attack by exhausting system
resources
during decoding. The number of allowed chained encodings is now limited
to 5.
(<code>GHSA-gm62-xv2j-4w53
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53&gt;</code>__)</li>
</ul>
<p>.. caution::</p>
<ul>
<li>If urllib3 is not installed with the optional
<code>urllib3[brotli]</code> extra, but
your environment contains a Brotli/brotlicffi/brotlipy package anyway,
make
sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to
benefit from the security fixes and avoid warnings. Prefer using</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/0248277dd7ac0239204889ca991353ad3e3a1ddc"><code>0248277</code></a>
Release 2.6.3</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"><code>8864ac4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/70cecb27ca99d56aaaeb63ac27ee270ef2b24c5c"><code>70cecb2</code></a>
Fix Scorecard issues related to vulnerable dev dependencies (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3755">#3755</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/41f249abe1ef3e20768588969c4035aba060a359"><code>41f249a</code></a>
Move &quot;v2.0 Migration Guide&quot; to the end of the table of
contents (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3747">#3747</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/fd4dffd2fc544166b76151a2fa3d7b7c0eab540c"><code>fd4dffd</code></a>
Patch <code>VerifiedHTTPSConnection</code> for Emscripten (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3752">#3752</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/13f0bfd55e4468fe1ea9c6f809d3a87b0f93ebab"><code>13f0bfd</code></a>
Handle massive values in Retry-After when calculating time to sleep for
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3743">#3743</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/8c480bf87bcefd321b3a1ae47f04e908b6b2ed7b"><code>8c480bf</code></a>
Bump actions/upload-artifact from 5.0.0 to 6.0.0 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3748">#3748</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/4b40616e959c0a2c466e8075f2a785a9f99bb0c1"><code>4b40616</code></a>
Bump actions/cache from 4.3.0 to 5.0.1 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3750">#3750</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/82b8479663d037d220c883f1584dd01a43bb273b"><code>82b8479</code></a>
Bump actions/download-artifact from 6.0.0 to 7.0.0 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3749">#3749</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/34284cb01700bb7d4fdd472f909e22393e9174e2"><code>34284cb</code></a>
Mention experimental features in the security policy (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3746">#3746</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/2.5.0...2.6.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=uv&previous-version=2.5.0&new-version=2.6.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/TypeAgent/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: robgruen <robgruen@microsoft.com>
Bumps [mcp](https://github.com/modelcontextprotocol/python-sdk) from
1.15.0 to 1.23.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/python-sdk/releases">mcp's
releases</a>.</em></p>
<blockquote>
<h2>v1.23.0</h2>
<h2>Summary</h2>
<p>This release brings us up to speed with the latest MCP spec
<code>2025-11-25</code>. Take a look at the <a
href="https://modelcontextprotocol.io/specification/2025-11-25">latest
spec</a> as well as the release <a
href="https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/">blog
post.</a></p>
<h2>What's Changed</h2>
<ul>
<li>Add tests for JSON Schema 2020-12 field preservation (SEP-1613) by
<a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1649">modelcontextprotocol/python-sdk#1649</a></li>
<li>Add client_secret_basic authentication support by <a
href="https://github.com/jonshea"><code>@​jonshea</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1334">modelcontextprotocol/python-sdk#1334</a></li>
<li>Implement SEP-1577 - Sampling With Tools by <a
href="https://github.com/ochafik"><code>@​ochafik</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594">modelcontextprotocol/python-sdk#1594</a></li>
<li>SEP-1330: Elicitation Enum Schema Improvements and Standards
Compliance by <a
href="https://github.com/chughtapan"><code>@​chughtapan</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1246">modelcontextprotocol/python-sdk#1246</a></li>
<li>[auth][conformance] add conformance auth client by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1640">modelcontextprotocol/python-sdk#1640</a></li>
<li>Implement SEP-986: Tool name validation by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1655">modelcontextprotocol/python-sdk#1655</a></li>
<li>fix: url for spec by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1659">modelcontextprotocol/python-sdk#1659</a></li>
<li>feat: implement SEP-991 URL-based client ID (CIMD) support by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1652">modelcontextprotocol/python-sdk#1652</a></li>
<li>Update doc string on custom_route by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1660">modelcontextprotocol/python-sdk#1660</a></li>
<li>Implement SEP-1036: URL mode elicitation for secure out-of-band
interactions by <a
href="https://github.com/cbcoutinho"><code>@​cbcoutinho</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1580">modelcontextprotocol/python-sdk#1580</a></li>
<li>Skip empty SSE data to avoid parsing errors by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1670">modelcontextprotocol/python-sdk#1670</a></li>
<li>SEP-1686: Tasks by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1645">modelcontextprotocol/python-sdk#1645</a></li>
<li>Add on_session_created callback option by <a
href="https://github.com/crondinini-ant"><code>@​crondinini-ant</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1710">modelcontextprotocol/python-sdk#1710</a></li>
<li>Add SSE polling support (SEP-1699) by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1654">modelcontextprotocol/python-sdk#1654</a></li>
<li>Support client_credentials flow with JWT and Basic auth by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1663">modelcontextprotocol/python-sdk#1663</a></li>
<li>feat: backwards-compatible create_message overloads for SEP-1577 by
<a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1713">modelcontextprotocol/python-sdk#1713</a></li>
<li>Auto-enable DNS rebinding protection for localhost servers by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a>
(d3a184119e4479ea6a63590bc41f01dc06e3fa99)</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/ochafik"><code>@​ochafik</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594">modelcontextprotocol/python-sdk#1594</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.22.0...v1.23.0">https://github.com/modelcontextprotocol/python-sdk/compare/v1.22.0...v1.23.0</a></p>
<h2>v1.22.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: Pass through and expose additional parameters in
<code>ClientSessionGroup.call_tool</code> and
<code>.connect_to_server</code> by <a
href="https://github.com/inaku-Gyan"><code>@​inaku-Gyan</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1576">modelcontextprotocol/python-sdk#1576</a></li>
<li>chore: Lazy import <code>jsonschema</code> library by <a
href="https://github.com/wuliang229"><code>@​wuliang229</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596">modelcontextprotocol/python-sdk#1596</a></li>
<li>docs: Update examples to use stateless HTTP with JSON responses by
<a href="https://github.com/domdomegg"><code>@​domdomegg</code></a> in
<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1499">modelcontextprotocol/python-sdk#1499</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/wuliang229"><code>@​wuliang229</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596">modelcontextprotocol/python-sdk#1596</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.21.1...v1.22.0">https://github.com/modelcontextprotocol/python-sdk/compare/v1.21.1...v1.22.0</a></p>
<h2>v1.21.2</h2>
<h2>Hotfix Release</h2>
<p>This is a hotfix release to address a critical bug in OAuth scope
handling that caused failures on 401 responses.</p>
<h3>Related:</h3>
<ul>
<li><a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1630">modelcontextprotocol/python-sdk#1630</a></li>
<li><a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1632">modelcontextprotocol/python-sdk#1632</a></li>
</ul>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99"><code>d3a1841</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/fa851d93a2036a37cce73e098f7dbc80a6c48765"><code>fa851d9</code></a>
feat: backwards-compatible create_message overloads for SEP-1577 (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1713">#1713</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/f82b0c937178815c1e96460455778578050c6d1a"><code>f82b0c9</code></a>
Support client_credentials flow with JWT and Basic auth (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1663">#1663</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/281fd4765e0fc2efaf2039d248c3bc0698416a8a"><code>281fd47</code></a>
Add SSE polling support (SEP-1699) (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1654">#1654</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/2cd178a962ab454e3add228ecd721784b7b36e99"><code>2cd178a</code></a>
Add on_session_created callback option (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1710">#1710</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/c92bb2f7ffaa61813d7cc350887f4ece38307769"><code>c92bb2f</code></a>
SEP-1686: Tasks (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1645">#1645</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/5983a650cc07d2dc6c6ba098e99d3545889157a9"><code>5983a65</code></a>
Skip empty SSE data to avoid parsing errors (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1670">#1670</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/02b78899296ce3631565345501e3d956b83ffe94"><code>02b7889</code></a>
Implement SEP-1036: URL mode elicitation for secure out-of-band
interactions ...</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/27279bc157cbc03f7fe7758fd55a4b34c5652f42"><code>27279bc</code></a>
Update doc string on custom_route (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1660">#1660</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/f22501315eab5b8358c603ac7f730f77bb09e4c4"><code>f225013</code></a>
feat: implement SEP-991 URL-based client ID (CIMD) support (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1652">#1652</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/python-sdk/compare/1.15.0...v1.23.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mcp&package-manager=uv&previous-version=1.15.0&new-version=1.23.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/TypeAgent/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: robgruen <robgruen@microsoft.com>
Bumps [azure-core](https://github.com/Azure/azure-sdk-for-python) from
1.35.1 to 1.38.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Azure/azure-sdk-for-python/releases">azure-core's
releases</a>.</em></p>
<blockquote>
<h2>azure-core_1.38.0</h2>
<h2>1.38.0 (2026-01-12)</h2>
<h3>Breaking Changes</h3>
<ul>
<li>Changed the continuation token format. Continuation tokens generated
by previous versions of azure-core are not compatible with this
version.</li>
</ul>
<h2>azure-core_1.37.0</h2>
<h2>1.37.0 (2025-12-11)</h2>
<h3>Features Added</h3>
<ul>
<li>Added <code>get_backcompat_attr_name</code> to
<code>azure.core.serialization</code>.
<code>get_backcompat_attr_name</code> gets the backcompat name of an
attribute using backcompat attribute access. <a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44084">#44084</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/6d2e6431ea0991861640e449e51e894247a7771a"><code>6d2e643</code></a>
update release date (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44609">#44609</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/ca2b965d8cce6eaa135fe01804b96164b56b7f16"><code>ca2b965</code></a>
[Core] Prep release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44590">#44590</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/fb8cbea1b9d85135f7ba99bfc6cbc2f3cee138ff"><code>fb8cbea</code></a>
Introduce new version of continuation token (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44574">#44574</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/6578a78f6a7429bbe73e27ebe904d7f362d7efa2"><code>6578a78</code></a>
[Core] Increment version for core release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44398">#44398</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/a69a3c26f3a3ed0c9e5a888d991ad447754ad00b"><code>a69a3c2</code></a>
add example to demo how to use truststore (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44343">#44343</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/5ade1087ec6a425d7639eefcff206ceffdf3d48f"><code>5ade108</code></a>
Bumping the targeted <code>httpx</code> for
<code>azure-core-experimental</code> dev reqs (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44328">#44328</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/cbb1db62711eae72aca1b2bbeedcbd7e02d21109"><code>cbb1db6</code></a>
[core] add tests and fix backcompat functions (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/44084">#44084</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/4adcc524b09e09e4916f1280a32f9802cc798788"><code>4adcc52</code></a>
[Core] Support timeout error in requests+aiohttp transports (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/43201">#43201</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/fd709673eacbebc1107d998f217a131fa3394326"><code>fd70967</code></a>
[Core] Increment version for core release (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/43435">#43435</a>)</li>
<li><a
href="https://github.com/Azure/azure-sdk-for-python/commit/b52527cdfdeff6b6aab4b93a87d4402b1403ce89"><code>b52527c</code></a>
[Core] Update TypeHandlerRegistry typing (<a
href="https://redirect.github.com/Azure/azure-sdk-for-python/issues/43393">#43393</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Azure/azure-sdk-for-python/compare/azure-core_1.35.1...azure-core_1.38.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=azure-core&package-manager=uv&previous-version=1.35.1&new-version=1.38.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/TypeAgent/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: robgruen <robgruen@microsoft.com>
Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.1 to 0.6.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pyasn1/pyasn1/releases">pyasn1's
releases</a>.</em></p>
<blockquote>
<h2>Release 0.6.2</h2>
<p>It's a minor release.</p>
<ul>
<li>Fixed continuation octet limits in OID/RELATIVE-OID decoder
(CVE-2026-23490).</li>
<li>Added support for Python 3.14.</li>
<li>Added SECURITY.md policy.</li>
<li>Migrated to pyproject.toml packaging.</li>
</ul>
<p>All changes are noted in the <a
href="https://github.com/pyasn1/pyasn1/blob/master/CHANGES.rst">CHANGELOG</a>.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst">pyasn1's
changelog</a>.</em></p>
<blockquote>
<h2>Revision 0.6.2, released 16-01-2026</h2>
<ul>
<li>CVE-2026-23490 (GHSA-63vm-454h-vhhq): Fixed continuation octet
limits
in OID/RELATIVE-OID decoder (thanks to tsigouris007)</li>
<li>Added support for Python 3.14
[pr <a
href="https://redirect.github.com/pyasn1/pyasn1/issues/97">#97</a>](<a
href="https://redirect.github.com/pyasn1/pyasn1/pull/97">pyasn1/pyasn1#97</a>)</li>
<li>Added SECURITY.md policy</li>
<li>Fixed unit tests failing due to missing code
[issue <a
href="https://redirect.github.com/pyasn1/pyasn1/issues/91">#91</a>](<a
href="https://redirect.github.com/pyasn1/pyasn1/issues/91">pyasn1/pyasn1#91</a>)
[pr <a
href="https://redirect.github.com/pyasn1/pyasn1/issues/92">#92</a>](<a
href="https://redirect.github.com/pyasn1/pyasn1/pull/92">pyasn1/pyasn1#92</a>)</li>
<li>Migrated to pyproject.toml packaging
[pr <a
href="https://redirect.github.com/pyasn1/pyasn1/issues/90">#90</a>](<a
href="https://redirect.github.com/pyasn1/pyasn1/pull/90">pyasn1/pyasn1#90</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pyasn1/pyasn1/commit/e7356f89cf32c130d65b1a0e903fe7ecce426424"><code>e7356f8</code></a>
Prepare release 0.6.2</li>
<li><a
href="https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970"><code>3908f14</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/pyasn1/pyasn1/commit/0a7e067674b1ec558f9d233a3bc173472fe27c6c"><code>0a7e067</code></a>
Add support for Python 3.14 (<a
href="https://redirect.github.com/pyasn1/pyasn1/issues/97">#97</a>)</li>
<li><a
href="https://github.com/pyasn1/pyasn1/commit/33656e986d8e2355123799e7267104ac7d8a6fb1"><code>33656e9</code></a>
Create Security Policy</li>
<li><a
href="https://github.com/pyasn1/pyasn1/commit/fa62307253f4423effac71a618e20fabaa37e22e"><code>fa62307</code></a>
fix for issue <a
href="https://redirect.github.com/pyasn1/pyasn1/issues/91">#91</a>: unit
tests failing due to missing code (<a
href="https://redirect.github.com/pyasn1/pyasn1/issues/92">#92</a>)</li>
<li><a
href="https://github.com/pyasn1/pyasn1/commit/f1ed02e41c193a66741572185bab94d34f43daec"><code>f1ed02e</code></a>
Package pyasn1 with pyproject.toml (<a
href="https://redirect.github.com/pyasn1/pyasn1/issues/90">#90</a>)</li>
<li><a
href="https://github.com/pyasn1/pyasn1/commit/93c4d4f0b6af84c13517b5700104ac57fb6d3fe5"><code>93c4d4f</code></a>
Switch documentation user to pyasn1 (<a
href="https://redirect.github.com/pyasn1/pyasn1/issues/89">#89</a>)</li>
<li>See full diff in <a
href="https://github.com/pyasn1/pyasn1/compare/v0.6.1...v0.6.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyasn1&package-manager=uv&previous-version=0.6.1&new-version=0.6.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/microsoft/TypeAgent/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: robgruen <robgruen@microsoft.com>
… internet (microsoft#1839)

agent-server can run dispatch with no internet connection and not fail.
…osoft#1840)

## Summary

This PR builds on the command executor MCP server by adding VSCode
automation support and enhancing the split editor functionality in the
Coda extension with more flexible editor selection and improved
TypeAgent schema disambiguation.

## Part 1: VSCode Support for MCP Server

Added VSCode automation capabilities to the command executor MCP server:

- ✅ Updated MCP tool description to advertise VSCode capabilities
- ✅ Updated README with VSCode automation examples
- ✅ Added comprehensive
[VSCODE_CAPABILITIES.md](packages/commandExecutor/VSCODE_CAPABILITIES.md)
documentation
- ✅ MCP server can now control VSCode through Coda extension (theme,
editor layout, files, terminal, etc.)

## Part 2: Enhanced Split Editor Functionality

### Bug Fixes
- ✅ Fix off-by-one error when selecting "first" or "last" editor by
sorting by `viewColumn`
- ✅ Fix multiple split issue by adding conditionals to focus changes
- ✅ Remove unnecessary focus restoration logic

### Features
- ✅ Add support for splitting editors by position: "first", "last",
"active", or numeric index
- ✅ Add support for splitting editors by file name: "split app.tsx to
the right"
- ✅ Search all open tabs using `tabGroups` API, not just visible editors
- ✅ Automatically open and focus files found in background tabs before
splitting

### Schema Improvements
- ✅ Add clear disambiguation between `splitEditor` and
`moveCursorInFile` actions
- ✅ Add "USE THIS for" and "DO NOT USE for" guidance in schema comments
- ✅ Add concrete examples to help LLM choose correct action
- ✅ Remove `moveCursorInFile` reference from main code schema

## Test Plan

Tested the following commands through the MCP server:
- [x] "split editor to the right" - splits active editor
- [x] "split the first editor to the right" - splits leftmost editor
- [x] "split the last editor" - splits rightmost editor  
- [x] "split codeActionHandler.ts to the right" - splits editor by file
name
- [x] "split the editor with speechToken to the right" - finds file in
background tab and splits it
- [x] "split codeActionHandler to the right" - correctly maps to
splitEditor (not moveCursorInFile)

All tests passed with no multiple splits and correct editor targeting.

## Files Changed

**Part 1 - VSCode MCP Support:**
- `packages/commandExecutor/README.md` - Updated documentation with
VSCode capabilities
- `packages/commandExecutor/src/commandServer.ts` - Updated tool
description
- `packages/commandExecutor/VSCODE_CAPABILITIES.md` - New comprehensive
documentation file

**Part 2 - Enhanced Split Editor:**
- `packages/agents/code/src/codeActionsSchema.ts` - Enhanced split
editor schema
- `packages/agents/code/src/vscode/editorCodeActionsSchema.ts` - Added
disambiguation guidance
- `packages/coda/src/handleVSCodeActions.ts` - Implemented enhanced
split editor handler

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
…icrosoft#1841)

## Summary

This PR adds support for creating playlists with lists of songs
specified by title and artist, eliminating the need to first search for
tracks and build a track list before creating or adding to playlists.

## Changes

### Schema Enhancements
([playerSchema.ts](packages/agents/player/src/agent/playerSchema.ts))

1. **Added `SongSpecification` interface**
- Allows specifying songs by `trackName`, optional `artist`, and
optional `albumName`

2. **Extended `CreatePlaylistAction`**
   - Added optional `songs?: SongSpecification[]` parameter
   - Now supports creating a playlist with songs in one action
   - Maintains backward compatibility (songs parameter is optional)

3. **Added `AddSongsToPlaylistAction`**
   - New action for bulk adding songs to existing playlists
   - Takes playlist name and array of song specifications

### Implementation ([client.ts](packages/agents/player/src/client.ts))

1. **Added `searchSongsAndGetUris` helper function**
   - Searches Spotify for each song specification
   - Builds optimal search queries using track name, artist, and album
   - Returns URIs for found songs and list of songs not found

2. **Enhanced `createPlaylist` handler**
   - Searches for songs if provided in parameters
   - Creates playlist with all found songs
   - Reports songs that couldn't be found

3. **Implemented `addSongsToPlaylist` handler**
   - Finds playlist by name
   - Searches for specified songs
   - Adds found tracks to playlist
   - Reports success with count and any songs not found

### Validation Support
([playerHandlers.ts](packages/agents/player/src/agent/playerHandlers.ts))

- Added `addSongsToPlaylist` to playlist name validation autocomplete

## Example Usage

Users can now make requests like:
- "Create a playlist called 'My Favorites' with these songs: Blinding
Lights by The Weeknd, Shape of You by Ed Sheeran"
- "Add the top 10 current Spotify streaming songs to a new playlist
called 'Top Hits'"
- "Add these songs to my 'Workout' playlist: Lose Yourself by Eminem,
Till I Collapse by Eminem"

## Testing

Successfully tested by creating a "Top Hits" playlist with 10 songs in a
single request. The agent correctly:
- Parsed the natural language request
- Extracted all song titles and artists into `SongSpecification` objects
- Searched Spotify for each song
- Created the playlist with all 10 tracks
- Reported success

See test results in MCP server log showing the parsed action with all
song specifications.

## Benefits

✅ Create playlists with songs in one request
✅ Add multiple songs to playlists without building track lists first
✅ Flexible search with track name, artist, and album support
✅ Clear error reporting for songs not found
✅ Backward compatible - existing functionality unchanged
✅ Uses Spotify batch API for efficient operations

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
## Summary

This PR adds a new `coderWrapper` package that provides a pseudo
terminal wrapper for CLI coding assistants (like Claude Code) with
transparent I/O passthrough and extensibility for future caching
capabilities.

## New Package: `ts/packages/coderWrapper`

### Purpose

Wrap CLI coding assistants in a pseudo terminal (PTY) to:
- Provide transparent passthrough of all I/O
- Support multiple CLI assistants (Claude Code, Node REPL, Python, etc.)
- Enable future integration with TypeAgent cache for faster responses
- Maintain full terminal features (colors, cursor control, resizing)

### Architecture

```
User Input → CoderWrapper (node-pty PTY) → CLI Assistant → Output
```

### Key Components

1.
**[assistantConfig.ts](packages/coderWrapper/src/assistantConfig.ts)**
   - Pluggable configuration system for different assistants
   - Currently supports: Claude Code, Node REPL, Python REPL
   - Easy to extend with new assistants

2. **[ptyWrapper.ts](packages/coderWrapper/src/ptyWrapper.ts)**
   - Core PTY wrapper using `node-pty`
   - Handles process spawning, I/O forwarding, and lifecycle management
   - Windows compatibility (automatic `.exe` handling)
   - Terminal resizing support

3. **[cli.ts](packages/coderWrapper/src/cli.ts)**
   - Command-line interface entry point
   - Argument parsing and help text
   - Graceful shutdown handling (Ctrl+C, SIGTERM)

4. **[index.ts](packages/coderWrapper/src/index.ts)**
   - Public API exports for programmatic usage

### Features

✅ **Transparent Passthrough**: All stdin/stdout/stderr flows through
unchanged
✅ **Multi-Assistant Support**: Configurable for different CLI tools  
✅ **Terminal Features**: Full support for colors, cursor control,
interactive prompts
✅ **Windows Compatible**: Handles `.exe` extensions automatically  
✅ **Clean Exit**: Graceful shutdown on Ctrl+C and process termination  
✅ **Extensible**: Easy to add new assistants via configuration  
✅ **Real TTY**: Uses `node-pty` for proper pseudo terminal emulation  

### Usage

```bash
# Use Claude Code (default)
coder-wrapper

# Use Node REPL for testing
coder-wrapper -a node

# Use Python REPL
coder-wrapper -a python

# Show help
coder-wrapper --help
```

### Installation & Building

```bash
cd packages/coderWrapper
pnpm install
npm run build
npm start  # Runs with default assistant (Claude Code)
```

### Testing

The wrapper requires a **real terminal (TTY)** to function properly
since `node-pty` needs actual terminal features. See
[TESTING.md](packages/coderWrapper/TESTING.md) for detailed manual
testing procedures.

**Quick test with Node REPL:**
```bash
cd packages/coderWrapper
node dist/cli.js -a node
# Type: 1+1 <Enter>
# Should show: 2
# Type: .exit to quit
```

### Future Enhancements

The foundation is in place for these planned features:

- [ ] **Cache Integration**: Check TypeAgent dispatcher cache before
forwarding requests
- [ ] **Request/Response Logging**: Track all interactions for debugging
- [ ] **Performance Metrics**: Measure response times and cache
effectiveness
- [ ] **Cache Statistics**: Report hit/miss rates and speedup
- [ ] **Request Interception**: Ability to modify or validate requests
before forwarding

### Documentation

- [README.md](packages/coderWrapper/README.md) - Overview and usage
- [TESTING.md](packages/coderWrapper/TESTING.md) - Testing procedures
and requirements

### Dependencies

- `node-pty`: ^1.0.0 - Pseudo terminal support
- `@typeagent/agent-server-client`: workspace:* - Future cache
integration
- `@typeagent/dispatcher-types`: workspace:* - Type definitions

---

This package provides the foundation for intelligent caching of CLI
coding assistant requests, which will significantly speed up repetitive
queries by checking the TypeAgent cache before forwarding to the
assistant.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
)

## Summary

Adds optional caching functionality to the coderWrapper package,
allowing it to check TypeAgent's cache before forwarding commands to the
wrapped CLI agent. The cache is **disabled by default** to ensure safe,
predictable behavior.

## Key Features

### Cache Support (Optional)
- New `cacheClient.ts` connects to command-executor MCP server to check
cache
- Cache checking happens before forwarding to wrapped agent
- Results returned immediately on cache hit, bypassing wrapped agent
entirely
- Debug mode shows cache timing: `(385ms)` indicator
- Disabled by default - must explicitly enable with `--enable-cache`
flag

### Multi-Client Cache Sharing
- Agent server uses AsyncLocalStorage for request-scoped routing
- Multiple coderWrapper instances can share the same TypeAgent cache
- Each client receives isolated results despite shared dispatcher

### Input Handling Improvements
- Fixed Windows \r\n double-execution issue
- Processing lock prevents concurrent command handling
- Proper handling of Enter key variations (CR, LF, CRLF)

### Debug Logging
- Optional debug logs written to `~/.tmp/typeagent-coder-wrapper/`
- Enable with `--debug` flag
- Logs include stdin events, cache checks, timing information

## Changed Packages

### coderWrapper
- Added `cacheClient.ts` - MCP client for cache checking
- Added `debugLogger.ts` - Debug logging utility
- Updated `ptyWrapper.ts` - Cache support, input handling fixes
- Updated CLI - New `--enable-cache` and `--debug` flags

### commandExecutor
- Fixed startup race condition (cache miss instead of error)
- Added `CACHE_HIT` prefix for client detection
- Improved error handling for disconnected dispatcher

### dispatcher (RPC)
- Added `checkCache` method to RPC interface
- Implemented in client and server

### agentServer
- AsyncLocalStorage-based multi-client routing
- Context preservation for checkCache calls

## Test Plan

- [x] Basic passthrough works without cache (default behavior)
- [x] Cache can be enabled with `--enable-cache` flag
- [x] Cache hits return immediately with timing indicator
- [x] Cache misses forward to wrapped agent correctly
- [x] Multiple clients can share cache via agent server
- [x] Windows \r\n input handling works correctly
- [x] Debug logging captures detailed information
- [x] Startup race condition handled gracefully

## Notes

- Cache is **disabled by default** for safety
- Users must explicitly opt-in with `enableCache: true` or
`--enable-cache`
- Debug mode adds helpful timing indicators but is also opt-in

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
The functionality in this package is superseded by the agentRpc package.
hillary-mutisya and others added 25 commits March 26, 2026 03:53
…y benchmark (microsoft#2080)

Replace single executeScriptFlow/executeTaskFlow routing with per-flow
action types that preserve named parameters in both grammar rules and
dynamic schema. This fixes schema validation rejecting flow-specific
parameters (P2) and gives the LLM translator richer type information for
semantic matching.

- ScriptFlow/TaskFlow: grammar rules now generate actionName per flow
(e.g. "listFiles", "createTopSongsPlaylist") instead of
"executeScriptFlow"/ "executeTaskFlow" with flowName param
- Dynamic schema generates per-flow types with typed parameters instead
of a single generic type with [key: string]: unknown
  - Index entries store parameter metadata for schema generation
- ScriptFlow benchmark evaluator updated for new action name extraction
- TaskFlow benchmark: 52 scenarios across 8 categories (seeding,
grammar, LLM translation, execution, CRUD, recording, step patterns,
error handling)
- Baseline: 100% grammar match, 100% parameter extraction, 62.2% overall
…alKeywordBackup (microsoft#2081)

## Summary

Refactors how `partialKeywordBackup` interacts with range-candidate
processing in `matchGrammarCompletion`, fixing a bug where a successful
`findPartialKeywordInWildcard` match for one alternative blocked **all
other alternatives** from contributing completions at the same backed-up
position.

## Changes

### `grammarMatcher.ts`
- **Per-state partial keyword tracking**: Introduced a local
`partialKeywordForThisState` flag so that range-candidate collection is
only skipped for the specific state where `findPartialKeywordInWildcard`
succeeded, rather than globally for all alternatives.
- **(b)** The position is anchored by a partial keyword
(`partialKeywordBackup`) — the keyword fragment pins the position even
though a wildcard boundary is open.
- **Extracted `processRangeCandidates`** boolean to deduplicate the
gating condition (was duplicated for Phase B processing and
`directionSensitive`).
- Added invariant comment: `partialKeywordBackup` implies
`openWildcard`.

### `grammarCompletionPrefixLength.spec.ts`
- Added tests for player-like grammars where multiple keyword
alternatives (`by`, `from`, `track`, `song`) follow a wildcard phrase —
verifies all alternatives appear in completions rather than only the
partial-keyword-matched one.
- Added cross-rule-family test (`PlayTrackNumberCommand` +
`PlaySpecificTrack`) verifying keywords from both rule families
contribute at the backed-up position.
- Added negative edge-case test (`play first penguin z`) confirming no
partial keyword match when no keyword is prefixed.
…ng (microsoft#2076)

## Changes

- **Fix `+` operator pass1/pass2 consistency**: Changed `||` to `&&` in
the `+` case of `deriveValueTypeImpl` so pass 1 type inference matches
pass 2 validation semantics — both operands must be strings to infer
`string`.

- **Use `formatSchemaType()` in error messages**: Replaced raw `.type`
discriminant strings with `formatSchemaType()` for richer,
human-readable type descriptions (e.g. `string | number` instead of
`type-union`). Removed the redundant union-iteration branch in
`validateValueType` that duplicated logic already handled by
`isTypeAssignable`.

- **Pre-resolve expected type in `validateVariableAgainstSchema`**:
Resolve the expected type and short-circuit on `any` before calling into
structural validation.

- **Add symmetric coinductive guard for type-reference cycles**: The
`isTypeAssignable` visited-set now guards both `inferred` and `expected`
type-references, preventing infinite recursion when the expected type is
self-recursive (e.g. `A = string | A`).

- **Replace shallow `isTypeAssignable` with structural
`validateInferredAgainstExpected`**: Both `validateVariableType` and
`validateVariableAgainstSchema` now use structural validation so object
fields and array element types are checked, not just the top-level type
discriminant.

- **Remove dead `resolvedTypes` parameter**: Eliminated the unused
`resolvedTypes: Map<string, SchemaTypeDefinition>` parameter from
`validateValueType`, `validateObjectValue`, `validateArrayValue`, and
`validateVariableAgainstSchema`.

- **Include variable name in validation error messages**: Errors now
report which variable caused the mismatch (e.g. `Variable '$myVar'
expected number, got string`).

- **Add tests for variable name error reporting**: Three new test cases
verify that variable names appear in error messages for direct type
mismatches, implicit variable mismatches, and nested field errors.

- **Add TODO for boolean literal type precision**: Documented a future
improvement to return `true`/`false` literal types from boolean
constants (blocked on `actionSchema` lacking boolean literal factories).
…t#2079)

## Summary

Enforce strict type conformance in the action grammar value validator,
closing several soundness gaps where values could pass validation
despite type mismatches.

## Changes

- **Boolean literal types**: Add `SchemaCreator.true_()` and `false_()`
factories; infer boolean literal types (`true`/`false`) instead of bare
`boolean`
- **Remove unsound widening**: Remove implicit widening rules from
`isTypeAssignable` (`string→string-union`, `boolean→true/false`) to
enforce strict conformance
- **Tighten string union validation**: `validateStringUnionValue` now
rejects bare `string` for enum fields
- **Tighten boolean literal validation**: `validateLiteralBooleanValue`
checks variable types against the expected literal
- **Derive string-union types**: String-part alternatives (e.g., `<Mode>
= fast | slow`) now produce proper string-union types
- **Structural expression conformance**: Expression conformance uses
structural `validateInferredAgainstExpected` instead of shallow
`isTypeAssignable` (catches array element type mismatches)
- **Array structural recursion**: Add array element type checking in
`validateInferredAgainstExpected`
- **Remove blanket undefined acceptance**: Optional captures (`T |
undefined`) are now rejected for required fields without a `??` fallback
- **Dead code marking**: Mark unreachable `string`/`phraseSet` cases in
`derivePartType`
- **Schema fix**: desktop-automation `KnownPrograms → KnownPrograms |
string`
- **Documentation**: Document Strict Conformance as design principle # 1
in actionGrammar.md
- **Tests**: Add tests for boolean literal conformance,
string/string-union conformance, expression structural conformance,
undefined/optional conformance

## Files Changed

- `packages/actionGrammar/src/grammarValueTypeValidator.ts` — Core
validation logic
- `packages/actionGrammar/test/grammarValueExprTypeChecking.spec.ts` —
New expression type checking tests
- `packages/actionGrammar/test/grammarValueTypeInference.spec.ts` — New
type inference tests
- `packages/actionGrammar/test/grammarValueTypeValidation.spec.ts` — New
validation tests
- `packages/actionGrammar/test/grammarValueStringUnion.spec.ts` —
Updated string union tests
- `packages/actionSchema/src/creator.ts` — Boolean literal type
factories
- `packages/agents/desktop/src/actionsSchema.ts` — Schema fix
- `docs/architecture/actionGrammar.md` — Design principles documentation
…g; add invariant docs and test infrastructure (microsoft#2082)

## Summary

Fix a bug where `directionSensitive` recompute was skipped when
`openWildcard=true`, and add comprehensive invariant documentation and
automated checking infrastructure.

### Bug fix (`grammarMatcher.ts`)

The `directionSensitive` recompute for backed-up backward positions was
gated on `processRangeCandidates`, which included
`rangeCandidateGateOpen = !openWildcard || partialKeywordBackup`. When
`openWildcard=true` and no partial keyword backup, the recompute was
skipped, leaving a potentially stale `directionSensitive` value. Changed
the guard to explicitly check `direction === "backward" &&
backwardEmitted && maxPrefixLength < prefix.length`, decoupling the
recompute from range-candidate processing.

### Documentation

- **New Invariants section in `completion.md`** — full catalog of 12
correctness invariants (#1microsoft#12) across grammar-matcher, cross-direction,
field-specific, and merge layers, with a quick-reference
symptom→invariant table and a Known Gaps section
- **Cross-reference trailing-separator-commits** to invariant #3
(`directionSensitive` biconditional) in `actionGrammar.md`
- **Clarify `properties` scope** in `actionGrammar.md` — `properties` is
a grammar-matcher concept; at the dispatcher layer, `closedSet=false ↔
properties non-empty` does not hold
- **Expand `directionSensitive=false`** description in `completion.md`
noting backward can back up past trailing whitespace into wildcards (→
`directionSensitive=true`)
- **Fix stale claim** in `actionGrammar.md` about recompute being
skipped when `partialKeywordBackup` or `openWildcard` is set (that
condition was removed from the code)
- **Add cross-reference** from `actionGrammar.md` metadata section to
`completion.md` § Invariants

### Test infrastructure

- **`withInvariantChecks` wrapper** (`testUtils.ts`) — wraps the grammar
completion function to run both forward and backward on every call,
automatically checking invariants #1microsoft#4; wired into
`createTestCompletion` for the `"grammar"` variant so all existing
grammar tests gain invariant checking for free
- **Replace `expect()`-based equality** with `node:util`
`isDeepStrictEqual` so the invariant checker works outside a Jest
assertion context
- **Regression test** for `directionSensitive` recompute when
`openWildcard=true` — uses `play $(track:TrackName) now` grammar to
verify backward correctly reports `directionSensitive=true` at the
backed-up position
…oft#2084)

Move the completion system (`matchGrammarCompletion`,
`GrammarCompletionResult`, and all supporting completion functions) into
a dedicated `grammarCompletion.ts` module.

### Changes
- **New file**: `packages/actionGrammar/src/grammarCompletion.ts` —
contains all completion logic previously in `grammarMatcher.ts`
- **Updated exports** in `index.ts` to re-export from the new module
- **Fixed imports** in `nfaCompletion.ts` and `testUtils.ts`
- **Updated documentation** in `README.md`, `NFA_README.md`, and
`docs/architecture/actionGrammar.md` to reference the new file
)

## Summary

This PR eliminates the separate `entity` declaration syntax in `.agr`
grammar files and unifies it into the existing `import` statement as a
**source-less import** (no `from` clause).

### Before
```
entity Ordinal, Cardinal;
import { PlayerActions } from "./playerSchema.ts";
```

### After
```
import { Ordinal, Cardinal };
import { PlayerActions } from "./playerSchema.ts";
```

## Changes

### Grammar types (`grammarTypes.ts`)
- `ImportStatement.source` is now `string | undefined` — `undefined` for
source-less (entity) imports
- Removed the `EntityDeclaration` type entirely
- `GrammarParseResult` no longer has `entityDeclarations`; `entities`
are derived from source-less imports

### Parser (`grammarRuleParser.ts`)
- Removed `parseEntityDeclaration()` method
- Extended `parseImportStatement()` to handle an optional `from` clause
- Wildcard imports (`import *`) still require a `from` clause (error if
missing)
- Entity names are derived from source-less imports in `parse()`

### Writer (`grammarRuleWriter.ts`)
- Removed `writeEntityDeclaration()` and entity-block writing code
- Import writer now conditionally emits `from "..."` only when `source`
is defined

### Compiler (`grammarCompiler.ts`)
- Removed non-null assertions and an unused parameter (cleanup)

### Grammar files
- Updated `playerSchema.agr`, `localPlayerSchema.agr`,
`calendarModule.agr`, and `globalModule.agr` to use the new syntax

### Tests
- Updated all test files to use `import { ... };` instead of `entity
...;`
- Added new test section "Source-less Imports (Entities)" in
`grammarCompileError.spec.ts` covering unused import warnings
- Updated snapshots for formatting tests
Source-less import entity names were tracked in both the parser
(`parseResult.entities`) and the compiler (`grammar.entities`) from
different sources, then merged in the loader. Since the compiler already
receives the import statements and populates `importedTypeNames`, it can
include source-less import entities directly in `grammar.entities`.

### Changes
- Remove `entities` field from `GrammarParseResult`
- Collect source-less import entities in `compileGrammar`
- Remove merge logic from `grammarLoader`
- Add TODO for better entity discovery mechanism

### Testing
All 2089 actionGrammar tests pass. Full build succeeds.
…ema (microsoft#2086)

Replace per-hostname dynamic agent registration with server-side grammar
and schema generation, aligning WebFlow with ScriptFlow/TaskFlow
patterns. WebFlow actions are now visible to LLM translation and
discover_actions.

- WebFlowStore: add parameter metadata and grammarRuleText to index,
getDynamicGrammarText(), generateDynamicSchemaText(), findSimilar()
- Browser agent: add getDynamicGrammar/getDynamicSchema callbacks,
initialize and seed WebFlowStore on startup with race-condition-safe
shared promise across parallel updateAction calls
- WebFlowAgent (extension): remove per-site registerForHost and
buildSchemaFromFlows; keep continuation support and flow caching
- Script generation: include existing flows in LLM prompt for dedup
awareness; filter noop recordings (<2 meaningful actions)
- Recording prompt: add WebFlow section to learn: trigger with
auto-detection of browser tasks
- Browser grammar: fix 26 compilation errors (remove parameters: {} from
parameterless actions, fix changeTabs -> changeTab)
  - Enable webFlows sub-schema by default (defaultEnabled: true)
## Summary

Updates the VS Code AGR language extension to support all current
grammar features with proper syntax coloring.

### Syntax highlighting additions

- **Block comments** (`/* ... */`) — previously only line comments were
supported
- **`export` keyword** — for exported rule definitions
- **`[spacing=...]` annotations** — `required`, `optional`, `auto`,
`none` with distinct scopes
- **Value type annotations** — `: TypeName | TypeName` after rule names
- **Source-less entity imports** — `import { Ordinal, CalendarDate };`
(no `from` clause)
- **Value expression operators** — `===`, `!==`, `??`, `?.`, `||`, `&&`,
ternary `? :`, `typeof`, arithmetic, member access
- **Template literals** — `\`text \${expr} text\`` with recursive
expression highlighting inside `\${}`
- **Spread operator** — `...` in value positions
- **Capture quantifiers** — `?`, `*`, `+` on captures and rule
references
- **Grouped expressions** — `(expr)` and function call arguments in
value context

### Bug fixes

- **Single-quote handling** — Apostrophes in expression context (e.g.
`what('s | is)`) are now treated as literal characters, not string
delimiters. Previously this broke all highlighting from that point
onward.
- **Action object values** — Replaced embedded `source.js` grammar with
native AGR value syntax for correct highlighting of AGR-specific
constructs.

### Other changes

- **language-configuration.json** — Added `blockComment` support for `/*
*/` toggle
- **grammarRuleParser.ts** — Added comprehensive BNF for value
expressions to the parser documentation comment
- **sample.agr** — Updated with examples demonstrating all new features

### Files changed

- `extensions/agr-language/syntaxes/agr.tmLanguage.json`
- `extensions/agr-language/language-configuration.json`
- `extensions/agr-language/sample.agr`
- `packages/actionGrammar/src/grammarRuleParser.ts`
- Streamline `@browser` commands namespaces
- Cleanup obsolete webplan authoring code
- Fix typecheck errors
… completion (microsoft#2089)

## Summary

Refactor and harden the grammar completion engine
(`grammarCompletion.ts`) with a series of incremental improvements to
correctness, clarity, and cross-direction consistency.

## Key changes

### Forward EOI wildcard deferral (Phase B extraction)
When a wildcard absorbs all input to end-of-string, forward string-part
candidates are now **deferred** and instantiated in Phase B at the
appropriate anchor position (partial keyword position or
`prefix.length`). This prevents wildcard-at-EOI states from pushing
`maxPrefixLength` past more meaningful candidates.

- Per-candidate fields (`closedSet`, `openWildcard`,
`partialKeywordBackup`, `separatorMode`) moved from shared state into
`FixedCandidate`; output values are derived in Phase B from surviving
candidates.
- New `ForwardPartialKeywordCandidate` and `forwardEoiCandidates`
deferral mechanism.
- `partialKeywordAgreesWithForward` tracking avoids false
`directionSensitive` when both directions use
`findPartialKeywordInWildcard`.

### Category 1 exact-match fix
Category 1 (rule fully matched, prefix fully consumed) now calls
`collectBackwardCandidate` for **both** directions, making it
direction-agnostic. Both forward and backward get the same completions
at the same position.

### Condition merges and needsSep relocation
- `matchKeywordWordsFrom`: merged duplicate if-blocks for
consumed-to-EOI and partial-prefix cases.
- `needsSep` computation moved from Phase A to Phase B via
`computeNeedsSep()`, since all surviving candidates share
`maxPrefixLength`.

### Position-local `directionSensitive` fix
Added post-loop recomputation: at any `0 < P < prefix.length` with
completions/properties and not `openWildcard`, set `directionSensitive =
true`. Backward always backs up at end-of-string boundary, so the
position is inherently direction-sensitive.

### Cross-direction invariant overhaul
Replaced old cross-direction invariants with 5 position-local
invariants:
1. Same `matchedPrefixLength` → identical results
2. `fwd.directionSensitive = false` → fwd ===
backward(input\[0..fwd.mpl\])
3. `bwd.directionSensitive = false` → bwd ===
forward(input\[0..bwd.mpl\])
4. `fwd.directionSensitive = true` → backward(truncated) backs up
5. Different mpl + `bwd.directionSensitive` → forward reaches bwd pos

### Cross-grammar merge guard
`mergeCompletionResults` now prevents an EOI open-wildcard result from
displacing a shorter result that anchors inside the input
(`isEoiWildcard`/`anchorsInsideInput` helpers).

## Files changed

- **`packages/actionGrammar/src/grammarCompletion.ts`** — Core
completion engine refactor
- **`packages/cache/src/constructions/constructionCache.ts`** —
`isEoiWildcard()`, `anchorsInsideInput()` helpers; EOI guard in
`mergeCompletionResults`
- **`packages/cache/src/cache/grammarStore.ts`** — Cross-grammar merge
EOI guard
- **`packages/cache/src/cache/cache.ts`**, **`constructionStore.ts`** —
Signature updates for `prefixLength` param
- **`packages/actionGrammar/test/`** — Updated and new test expectations
across 5 spec files
- **`packages/cache/test/`** — New `grammarIntegration.spec.ts`; updated
`mergeCompletionResults.spec.ts`
- **`docs/architecture/completion.md`** — Updated invariants, Category 2
table, merge algorithm docs

## Testing
- 38 tests updated across 3 existing spec files for new
`directionSensitive` expectations
- New spec file: `grammarCompletionMultiWordKeywordEOI.spec.ts` for
forward partial keyword anchoring
- New integration test: `grammarIntegration.spec.ts` for cross-grammar
EOI merge
- Updated `mergeCompletionResults.spec.ts` with EOI guard test cases
- All 5 cross-direction invariants verified in `testUtils.ts`
Now that we consolidated page action and knowledge discovery into the
chat panel, we can remove the previous pageMacros, pageKnowledge and
pageQnA sidepanels. Also remove the RPC methods that were added to
support those panels
Remove previous user actions pool which had the global actions that
could be enabled on pages. With the webFlows approach, we use the list
of all flows in the user's local instance storage, allowing more
extensiblity
…on (microsoft#2092)

## Summary

Replaces the scattered, mutation-based `directionSensitive` accumulation
in `matchGrammarCompletion` with a single post-loop decision tree. Also
simplifies the cache-layer equivalent in `constructionCache.ts`.

### Key changes

- **`constructionCache.ts`:** Move `noTrailingSeparator` out of the hot
loop into a single post-loop derivation (`hasMatchedPart &&
noTrailingSeparator`).
- **`tryPartialStringMatch`:** Rename return field `directionSensitive`
→ `couldBackUp` for clarity (local function shouldn't claim to compute
the global property). Add JSDoc.
- **Tests:** Update ~20 expected values where `openWildcard: true` cases
now correctly report `directionSensitive: true`. Remove `openWildcard`
guards from cross-direction invariant checks — invariants are now
validated uniformly.
- **Docs:** Add forward/backward equivalence analysis tables to
`actionGrammar.md`. Add scope blurbs cross-referencing
`actionGrammar.md` ↔ `completion.md`. Compact wide tables for
narrow-context readability.

### Design rationale

`openWildcard → directionSensitive=true` is the correct semantic:
wildcard boundaries are genuinely ambiguous. Truncating to `input[0..P]`
removes the wildcard content that established the anchor, so
`completion(input[0..P], "backward")` always diverges. This eliminates
`partialKeywordAgrees` tracking entirely and enables unguarded
cross-query invariant checking in tests.

All 419 grammar completion tests pass.
microsoft#2093)

…th draft scripts

- Remove 9 direct browser action types (clickOnElement,
enterTextInElement, setDropdownValue, awaitPageLoad, getHTML,
getElementByDescription, isPageStateMatched, queryPageContent,
downloadImage) and their handlers from the browser agent. These were
previously used by reasoning agents but are now superseded by
WebFlow-based execution.

- Add checkPageState() and queryContent() to the WebFlow browser API,
preserving the LLM-based semantic query capabilities that were unique to
the removed actions.

- Replace the webtask recipe generator (TaskFlow recipes) with a WebFlow
generator that produces WebFlowDefinitions from execution plans. Add
webflow__list, webflow__execute, and webflow__run_draft MCP tools so the
webtask agent can discover, invoke, and author WebFlows. Route webflow
schema calls through the execute_action handler to the browser agent.
Remove broken MCP tools that referenced deleted actions.

- Update the webtask subagent prompt to use draft scripts for all page
interactions instead of direct DOM tools or execute_command. Add
integration test tasks for the WebFlow-based execution model.
…y main loop (microsoft#2094)

## Summary

Refactors `matchGrammarCompletion` in `grammarCompletion.ts` to improve
readability and maintainability. All 2101 tests pass with no behavior
changes.

### Changes

**Commit 1 — Phase B1/B2 extraction:**
- Introduces `WildcardEoiDescriptor` type to defer wildcard-at-EOI
states from Phase A to a new Phase B1.
- Phase B1 runs `findPartialKeywordInWildcard` on all deferred
descriptors in one loop (previously duplicated inline in forward and
backward branches).
- Phase B2 materializes surviving candidates into final
completions/properties.
- Removes ~100 lines from the main loop by consolidating the
`findPartialKeywordInWildcard` logic.

**Commit 2 — `tryCollectStringCandidate` helper:**
- Merges `collectStringCandidate` + inline `tryPartialStringMatch` calls
into a single `tryCollectStringCandidate` helper that handles partial
matching, candidate collection, and `backwardEmitted` tracking.
- Updates docs/architecture/actionGrammar.md to reflect Phase B1/B2
terminology.

**Commit 3 — Polish:**
- Fix `tryCollectStringCandidate` comment: returns true when a partial
match is found, not when a candidate is collected.
- Narrow `forwardEoiCandidates` type to `Extract<RangeCandidate, { kind:
"wildcardString" }>[]`, removing the runtime kind guard.
- Add inline note explaining Phase B1 backward condition equivalence (`<
prefix.length` vs old `< state.index`).

### Testing

All 2101 unit tests pass. No new tests needed (behavior-preserving
refactor).
…#2096)

Three fixes to the grammar completion engine:

1. **Reset backwardEmitted in updateMaxPrefixLength** — when a wildcard
rule's backward candidate is cleared by a longer keyword match, the
stale flag no longer blocks trailing-separator advancement.

2. **Decouple range-candidate gate from backwardEmitted** — use
`rangeCandidates.length > 0` directly, and track `rangeCandidateEmitted`
to also block trailing-sep advancement when range candidates produce
output.

3. **Separator-only gap check in Phase B2** — when the gap between
`maxPrefixLength` and anchor consists entirely of separator characters
(whitespace/punctuation), merge existing Cat 2 candidates instead of
displacing them. Demote `separatorMode` to `optional` since the
separator has been consumed.

**Before:** `'play beautiful '` with grammar `play $(song) by $(artist)
| play beautiful music` would displace `'music'` (Cat 2 at mpl=14),
returning only `['by']`.

**After:** merges to `['music', 'by']` at mpl=15.

### Tests
- 6 new tests for stale backwardEmitted regression
- 6 new tests for Phase B2 separator-only gap (merge vs displace)
- Updated 2 existing test expectations
- All 2113 tests pass (41 suites)
…crosoft#15 (microsoft#2097)

## Summary

Fix two backward completion bugs in the grammar completion engine,
extract a helper, add a new invariant (# 3 — truncated-forward
idempotency), and renumber all invariants to a continuous # 1–# 15
scheme.

## Changes

### Bug fixes
- **Backward property fallback**: when `tryCollectBackwardCandidate`
returns false (all keyword words fully matched with trailing separator),
the engine now falls back to `collectPropertyCandidate` so unfilled
wildcard slots (e.g. `$(artist)`) are still offered.
- **Range candidate truncation**: range candidate processing now
truncates the prefix to `maxPrefixLength` before calling
`tryPartialStringMatch`, preventing peeking at input beyond what was
consumed.
- **Separator-only gap preservation**: `updateMaxPrefixLength` is
bypassed when the gap to the new position contains only separator
characters, preserving legitimate existing candidates instead of
clearing them.
- **Phase B EOI merge with partial keywords**: removes the
`!hasPartialKeyword` guard — partial keyword paths with separator-only
gaps now merge rather than displacing.

### Refactor
- Extract `isSeparatorOnlyGap(text, from, to)` helper for reuse across
Phase B partial-keyword and Phase B EOI anchor merge paths.
- Add `normalizeCompletionResult` (sort completions before comparing) in
test utils.
- Strengthen `direction` parameter types from `string` to `"forward" |
"backward"` literal union.

### New invariant
- **# 3 — Truncated-forward idempotency**: `matchedPrefixLength <
prefix.length` → `result === completion(input[0..matchedPrefixLength],
"forward")`. Checked automatically by `assertTruncatedForwardInvariant`
for both directions.

### Documentation
- Renumber all invariants to continuous # 1–# 15 in document order
across `completion.md`, `actionGrammar.md`, and test code.
- Update the quick-reference symptom→invariant table.
- Add unified invariant mapping table replacing the old test↔doc
mapping.

## Test coverage
- New test: `"play hello by "` backward — property fallback via Category
3a.
- New test: `"play something play"` backward — separator-only gap
preserves "good".
- New test: `"play something played"` backward — range candidate uses
truncated prefix.
- Updated test: `"play something play"` forward — now expects `["good",
"played"]` (merge).
- All invariants (# 1–# 8) automatically checked via
`withInvariantChecks` wrapper.
Exercise the real grammar matcher through `PartialCompletionSession`
with mocked entity data. Two grammars (music, settings) drive scenarios
for:

- **Keyword completions** and trie narrowing
- **Keyword → entity transitions** with separator deferral
- **Multi-level hierarchy** (entity → keyword → entity)
- **Open wildcard / anchor sliding**
- **Direction sensitivity** (backward re-fetch at anchor)
- **`getCompletionPrefix`** public API

Also adds `action-grammar` as a shell devDependency for the grammar
imports.
…icrosoft#2099)

## Summary

Remove the trailing-separator advancement step from grammar completion
matching and simplify the `directionSensitive` computation to a clean
two-condition formula.

## Changes

### Core: `grammarCompletion.ts`
- **Remove `consumeTrailingSeparators()`** — the grammar matcher no
longer advances `matchedPrefixLength` past trailing whitespace. This
preserves `separatorMode` fidelity (the shell sees the grammar's spacing
annotation, not a collapsed `"optional"`) and keeps `directionSensitive`
correct at trailing-space positions.
- **Remove `backwardEmitted` tracking** — this write-only variable is no
longer needed since trailing-separator advancement (its only consumer)
is removed.
- **Simplify `directionSensitive`** — replaces a 4-branch decision tree
with: `openWildcard || P !== minPrefixLength`. True whenever something
was matched beyond the caller's floor or the wildcard boundary is
ambiguous.
- **Category 1 (exact match) trailing-separator stripping** — pass
`effectivePrefixEnd` to `tryPartialStringMatch` so that trailing
separators in the input are logically ignored when backing up, avoiding
incorrect `couldBackUp=false`.

### Tests
- Update expected `matchedPrefixLength` values in tests that previously
expected trailing-space advancement (e.g., `"play music "` now yields
P=10 not P=11).
- Remove stale `backwardEmitted` references from test names and
comments.
- Rename 'commit' terminology to 'separator boundary' in test names for
clarity.
- Strengthen E2E `grammarE2E.spec.ts` assertions: verify `menuItems`
content and add exact-match-with-trailing-whitespace scenarios.

### Documentation: `actionGrammar.md` / `completion.md`
- Document the "trailing separators are not consumed" design choice with
rationale.
- Clarify that `directionSensitive` is defined by the cross-query on
truncated input (`completion(input[0..P], backward)` vs `forward`), not
on the full input.
- Mark 'committed' rows in equivalence tables as hypothetical (P never
lands there in practice).
- Fix contradictory section header: split into
`directionSensitive=false` cases and `both directions agree despite
directionSensitive=true` cases.
…nSensitive (microsoft#2100)

## Summary

Strip trailing separator characters from `matchedPrefixLength` (P) so it
always
lands before the flex-space, aligning wildcard→keyword transitions with
keyword→keyword transitions. Simplify `directionSensitive` to `P > 0`.

## Changes

### Core: `grammarCompletion.ts`
- **`stripTrailingSeparators` helper** — scans backward from a position,
  stripping separator characters down to a lower bound.
- **Phase B1 (backward)** — partial keyword positions are stripped
before
  advancing `maxPrefixLength`, so the backward anchor sits at the last
  non-separator boundary.
- **Phase B2 (forward)** — anchor is stripped before the displace/merge
  decision.  The old `isSeparatorOnlyGap` check in Phase B2 is replaced:
stripping collapses separator-only gaps naturally (anchor =
maxPrefixLength
→ merge), while non-separator gaps remain above maxPrefixLength (→
displace).
- **`mergeSepMode` helper** — combines the old `computeNeedsSep` +
`mergeSeparatorMode` two-step into a single function, reducing
boilerplate
  at every call site.
- **`directionSensitive` simplified** — from
  `openWildcard || P != minPrefixLength` to `P > 0`.
  `minPrefixLength` is a caller-supplied floor, not a result property.
- **Named type `WildcardStringRangeCandidate`** replaces inline
  `Extract<RangeCandidate, {kind: "wildcardString"}>`.

### Tests
- Updated `matchedPrefixLength` expectations (−1 for trailing separator
no
  longer counted) and corresponding `separatorMode` changes
  (`"optional"` → `"spacePunctuation"` where separator is now required).
- One `directionSensitive: false` → `true` for the minPrefixLength floor
case.
- Cross-direction invariant checks now pass `undefined` for
`minPrefixLength`.
- **New E2E scenarios** in `grammarE2E.spec.ts`: wildcard→keyword trie
  narrowing, backspace round-trip, double-space, wildcard→keyword→entity
  pipeline.  Extracted `primeWildcard()` helper for DRY setup.

### Documentation
- `actionGrammar.md` — updated Phase B1/B2 descriptions,
`directionSensitive`
  decision tree, and design-choice rationale.
- `completion.md` — updated `separatorMode`, `directionSensitive`, and
  decision tree sections.
…ions

Extract the ~870-line matchGrammarCompletion closure into a
CompletionContext type and standalone module-scope functions:

- CompletionContext: plain object holding mutable state shared
  across phases (prefix, direction, maxPrefixLength, candidates).
- createCompletionContext(): factory function.
- updateMaxPrefixLength(): advances max and clears stale candidates.
- collectPropertyCandidate(): collects property completion candidates.
- tryCollectStringCandidate(): partial string match + candidate collect.
- tryCollectBackwardCandidate(): backward backup to last matched item.
- collectCandidates() (Phase A): main loop over grammar states,
  categorizes into exact/partial/dirty and collects candidates.
- resolveWildcardAnchors() (Phase B1): resolves wildcard-at-EOI
  partial keyword anchors via findPartialKeywordInWildcard.
- materializeCandidates() (Phase B2): converts candidates into
  final completions[], properties[], and metadata.
- matchGrammarCompletion(): thin orchestrator calling the above.

No closure variables remain. Public API and behavior unchanged.
All 431 completion tests pass.
Extract the three match-category branches from collectCandidates
into standalone functions:

- processExactMatch() — Category 1: backs up to last matched term
- processCleanPartial() — Category 2: defers EOI descriptors,
  collects forward/backward candidates and range candidates
- processDirtyPartial() — Category 3: handles unfinalizable
  pending wildcards (3a) and trailing text partial matches (3b)

collectCandidates loop body is now a clean dispatch:
  if (finalizeState) {
    if (matched) processExactMatch(...); else processCleanPartial(...);
  } else {
    processDirtyPartial(...);
  }

All 431 completion tests pass.
@curtisman curtisman closed this Mar 30, 2026
curtisman added a commit that referenced this pull request Apr 3, 2026
…lict

- Remove droppedCandidates field from CompletionContext; hasSepConflict
  already implies candidates were dropped (early return when false).
- Merge filter + P-advance into a single if/else branch keyed on
  trailing separator state (forward only; backward treats separator
  as absent per Invariant #3).
- Replace resolveAsTrailingSep local with inline condition.
- Tighten Invariant microsoft#7 to strict inequality (backward must back up).
curtisman added a commit that referenced this pull request Apr 4, 2026
- Fix mergeSepMode comment: 'at position' → 'at position - 1'
- Expand effectiveTrailingSep JSDoc with specific recomputation details
- Clarify 'wildcard-at-EOI string states' → 'states with a string next-part'
- Change computeRangeNeedsSep return type to tri-state (needsSep/noSep/drop)
- actionGrammar.md: 'Fixed:' → 'Handled via:' in summary table
- actionGrammar.md: plain-text three-way table → proper markdown table
- completion.md: add inline invariant descriptions (#3, microsoft#7, microsoft#8, microsoft#9, microsoft#13)
- grammarStore.ts: add cross-reference to filterSepConflicts
- Test: 'wins over optional' → 'is strongest merged mode'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants