Re: [PR] feat(mcp): OAuth for remote MCP servers [maka]

["GabrielDrapor (via GitHub)" <gi...@apache.org>]

GabrielDrapor commented on PR #2653:
URL: https://github.com/apache/maka/pull/2653#issuecomment-5343445152

   Restacked onto the dual-era negotiation rewrite of `packages/mcp/src/index.ts`. How the two sides compose:
   
   - The OAuth provider, scoped fetch and header-exclusion logic now wrap the new probe path: `createStreamableHandshakeEvidence` takes the scoped fetch as its base instead of `globalThis.fetch`, so protocol-evidence collection and origin-confinement are the same request path.
   - `shouldFallbackToLegacySse` (404/405-only) subsumes the old explicit auth-error check — a 401 during the probe still propagates instead of falling back.
   - The scrub/needs-auth grafts were re-applied to the rewritten refresh loop, and the new upstream diagnostic surfaces (`refreshDiagnostic`, `subscriptionDiagnostic`, tool-list change-signal failures) are scrubbed before they reach status.
   - Two upstream fallback-contract tests adapted to this PR's semantics: HTTP 401 now asserts `needs-auth` (that is the feature), and the both-failures test asserts the rejection's cause chain is deliberately dropped — the scrubbed stable message is the public contract, since the rejection crosses IPC toward the renderer.
   
   mcp suite 164/164 green.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org