v0.8.7

v0.8.7

The room bridge now runs on the stateless wire (issue 1610). Agreement moves from the bridge's MCP
sessions onto the page, as grants to principals, and every call names the room it's about. So the
bridge needs no session, a grant holds across every bridge in a room (one per replica, say), and it
survives the agent reconnecting. A declared catalog of page tools gives stateless callers a
tools/list that's the same for everyone. There's also a client fix for a race that #1601's
DELETE on Close introduced.

The room bridge is experimental, and these change its API. The Go bridge and the TS page change
together, so upgrade both, experimental/ext/rooms at v0.8.7 and @panyam/mcpkit-rooms@0.8.7.

Changed (room bridge)

• Pages hold agreement. A page grants principals: the subject of the caller's validated token,
  and optionally the client. It sends its grants to every bridge that lists it.
  • A grant ends on Revoke(principal) / RevokeAll(), or when the page leaves. It no longer ends
    with the MCP session.
  • The page adds a grant only for a code it offered or accepted, so another peer can't grant
    itself a page.
  • (PR 1612)
• Every call names its room. Through the room argument the bridge adds to page tools, or
  through the host's own argument with WithRoomOf. list_pages, pair and attach take a room
  and need no session. attach is now only a session-wire default room. (PR 1612)
• The default target is the agreed tab its user focused last, then the only agreed tab, then an
  error with the room's roster. It used to be the tab that agreed most recently. (PR 1612)
• API:
  • PageInfo.Paired is now Default.
  • Page.Revoke takes a Principal, and RevokeAll() and Grants() are new.
  • PairingRequest drops Session.
  • On the wire, notifications/rooms/grants replaces notifications/rooms/revoke.
  • TS: revoke({subject, client?}), revokeAll(), grants().

Added (room bridge)

• WithPageTools([]PageToolDecl) fixes the page-tool catalog, so tools/list is the same for
  every caller on either wire.
  • It's cacheable (server.WithListTTLMs) and needs no list_changed.
  • Tabs still offer any declared subset at runtime.
  • Serving the stateless wire requires it, and a stateless page-tool call without it is refused.
  • (PR 1613)
• The caller reaches the page: PageCall.Caller in Go, ctx.caller in TS, {subject, client}
  from the bridge's token. A page can apply its own rules per caller. (PR 1613)
• rooms.TrustBridges(subjects...) on JoinPage makes a Go page answer only the host's
  bridges, by relay subject. Without it, any holder of a relay token for the room can call a page
  directly. The TS page waits on massrelay issue 42. (PR 1613)
• The events fallbacks check agreement instead of attachment. next_request works with no
  session when it names its room, and the room resource reads on either wire. (PR 1613)

Fixed

• Client.Close no longer races requests in flight. v0.8.6's DELETE cleared the session id
  that other goroutines read unlocked. Only go test -race showed it. (PR 1614)
• Dependencies:
  • vitest 5.0.5 in conformance/ and the two report tools, past the @vitest/mocker advisory
    (PR 1608).
  • Dependabot's npm group bump, with the any-frontend views rebuilt (PR 1607).

Upgrading downstream

• agni:
  • Go: experimental/ext/rooms, …/rooms/massrelay and …/integrations/roomsevents at v0.8.7.
  • Browser: @panyam/mcpkit-rooms@0.8.7.
  • To serve stateless agents, declare the viewer's tools with WithPageTools. A proto service
    (#1609) is the natural source.
  • Map the design argument to its room with WithRoomOf.
  • Set TrustBridges on Go pages before relying on Caller.
• Anyone calling Client.Close concurrently with other requests: upgrade, especially under
  -race.