v0.8.15

v0.8.15

A patch release with three changes for clients on the 2026-07-28 wire and for hosts. A stateless
client can follow its own tasks on subscriptions/listen. A remote server lets a bearer-authenticated
browser extension through its Origin check. And the Go events client gains List for the
events/list catalog.

Added

• taskIds on subscriptions/listen. tasks.Register installs ext-tasks' filter key, so a
  stateless client that names its tasks gets notifications/tasks for them on the listen stream,
  with the full DetailedTask and the completed result. The acknowledgement echoes only the IDs the
  caller could read with tasks/get under its task bucket, and a client that hasn't declared the
  tasks extension gets -32021. Session clients keep getting the notifications on their GET stream.
  (issue 1523, PR 1652)
• Server.NotifyListeners delivers a notification to subscriptions/listen streams only, each
  applying its own filter key. It's the path behind taskIds, and the one to use for anything that
  belongs to one caller, since Broadcast also reaches every session. Local to a replica.
  (PR 1652)
• eventsclient.List reads a server's whole events/list catalog, following nextCursor, and
  returns ErrListOverrun past 1000 pages rather than a truncated list. The events bridge uses it
  in place of its own loop. (issue 1651, PR 1653)

Changed

• A request with a valid bearer token passes the Streamable HTTP Origin check. The DNS-rebinding
  check refused an authenticated browser extension (Origin: chrome-extension://…) on a remote
  server. A rebound page can't attach a bearer token, so an Authorization: Bearer request the
  server's validator accepts now passes whatever its Origin. Unauthenticated requests are checked
  as before. (issue 1547, PR 1650)
• Documented: a remote server must list its own host. With no WithAllowedOrigins the check
  admits only localhost and judges a request with no Origin by its Host, so a server reached as
  mcp.example.com refuses every unauthenticated client, curl and Claude Code included.
  server/README.md § Remote deployments shows the one-line fix. (issue 1547, PR 1650)
• Stateless streams are not resumable, as the 2026-07-28 revision says. No behaviour change:
  the stateless SSE writers emit no event ids and ignore Last-Event-ID, and two tests now pin it.
  (issue 825, PR 1649)

Upgrading downstream

• agni: github.com/panyam/mcpkit and the rooms modules at v0.8.15, and
  @panyam/mcpkit-rooms@0.8.15 (no change on the page side).
• chakra: bump to v0.8.15, then replace listEventDefs with eventsclient.List
  (chakra#135).
• A remote deployment that relied on clients sending no Origin should add its own host to
  WithAllowedOrigins; it was already refusing them.