v0.8.14

v0.8.14

A patch release with three fixes from a day's work. Notifications go out without an id and no
transport answers one. A stateless Connect fails when the server is down or refuses the
credentials. And the events and room-bridge follow-ups from issue 1603 land: a refused event stream
is never confirmed, and events no longer go missing while a run waits for approval.

Fixed (wire)

• Notifications carry no id, and no transport answers one. The client wrote "id":null on
  every notification, which JSON-RPC 2.0 reads as a request; it now leaves the member out. On the
  server, an unknown or panicking notification got a JSON-RPC error body on both HTTP wires; the
  handler still runs and HTTP answers 202 with no body, while a refused stateless notification (a
  removed method, a bad envelope) gets only its 404 or 400. stdio treats "id":null as a
  notification too, and two notifications in flight on one session no longer collide in in-flight
  tracking, where the second used to be refused as a duplicate. (issue 1520, PR 1647)
• A stateless Connect fails when the server can't be reached or refuses the credentials.
  Every server/discover probe error used to be dropped, so a Group showed a down or
  unauthorised stateless server as ready until its first real call (chakra#112). A refused
  connection, a 5xx or a 401 now fails Connect, and a 401 classifies as needs-login. A server
  that answers discover with a JSON-RPC error, or doesn't implement it (issue 829), still
  connects. (PR 1648)
• ToolCall with Mcp-Param headers honours its context, so it can be cancelled. (PR 1646)

Fixed (events and room bridge)

• A refused event stream is never confirmed. events/stream sent
  notifications/events/active before running OnSubscribe, so a refused stream opened and then
  ended; SEP-3415 says no stream is opened. The hook now runs first. (issue 1603, PR 1646)
• New events.ErrSubscribeForbidden. An OnSubscribe hook that wraps it gets -32024
  Forbidden in all three delivery modes; any other refusal stays -32025. roomsevents' attach
  check uses it. (PR 1646)
• Events are no longer lost while a run waits for approval. A run parked in PendingApprover
  blocked the watch's delivery, the receiver's buffer filled, and it dropped the rest while
  answering 200. Each watch now has its own queue (Config.QueueSize, 1024 by default) and the
  receiver answers 503 on a drop so the server retries. (PR 1646)
• Resource and prompt handlers can report progress. ResourceContext and PromptContext gain
  Progress and ProgressToken, from _meta.progressToken, on both wires. (PR 1646)
• rooms-channel forwards page-tool progress to Claude Code, and opens a GET SSE stream so
  tools/list_changed from a page that registers tools after attach reaches it. (PR 1646)

Upgrading downstream

• agni: github.com/panyam/mcpkit and the rooms modules (experimental/ext/rooms,
  …/rooms/massrelay, …/integrations/roomsevents) at v0.8.14, and
  @panyam/mcpkit-rooms@0.8.14 (no change from 0.8.13 on the page side). A peer that treated our
  client's "id":null notifications as requests sees plain notifications now.
• chakra: picks up the stateless Connect readiness fix for chakra#112.
• Anything matching on -32025 for an OnSubscribe refusal: unchanged unless the hook wraps
  events.ErrSubscribeForbidden, which is new.