--- summary: "Framework bump to mcp-ts-core 0.13.6 declares stateless HTTP session mode in src/index.ts, moves argument rejections to an InvalidParams envelope with a Recovery line and reason suffix, and moves the skill tree to framework-skills/; a public Streamable HTTP endpoint is now declared in server.json." breaking: false security: false --- # 0.3.4 — 2026-09-19 ## Added - **Public hosted endpoint declared** — `server.json` carries a `streamable-http` remote at `https://census.caseyjhand.com/mcp`, and the README documents it as a no-install option alongside local stdio/HTTP. ## Changed - **`@cyanheads/mcp-ts-core`** `^0.12.3` → `^0.13.6`: - `src/index.ts` declares `sessionMode: 'stateless'` in `createApp()` rather than leaving HTTP session posture to `MCP_SESSION_MODE`'s `auto` default (which resolved to `stateful`); the Docker image already ran `stateless`, so container behavior is unchanged. - An argument rejection now classifies `InvalidParams` (`-32602`) instead of `ValidationError`, and its `content[0].text` closes with a `Recovery: ` line and a `(reason · retryable|not retryable)` suffix. - An underscore-prefixed root key a client adds (e.g. `_clientCallId`) is now dropped before validation instead of rejecting the call; any other undeclared key is still rejected. - The development skill tree moves from `skills/` to `framework-skills/`, so a plugin install no longer hands these development skills to the installing agent. - Bun engines floor raised to `>=1.4.0` (was `>=1.3.0`). - Every tool's `errors[]` entries the service layer throws now carry `thrownBy: 'service'`, satisfying the framework's new `error-contract-unthrown` lint rule. ## Fixed - **Claude Desktop and Codex plugin installs no longer hardcode an empty `CENSUS_API_KEY`** into `env`, which silently overrode a user's exported key. `.claude-plugin/plugin.json` wires it through a new `userConfig` entry; `.codex-plugin/mcp.json` lists it under `env_vars` instead. ## Dependencies - `@cyanheads/mcp-ts-core` `^0.12.3` → `^0.13.6` (includes upstream ReDoS hardening and reduced error-detail exposure — no fix in this project's own source) - `@biomejs/biome` `2.5.10` → `2.5.14` - `@types/node` `26.2.0` → `26.5.1` - `ignore` `^7.0.6` → `^7.0.9` - `tsc-alias` `^1.9.2` → `^1.9.5` 404 tests pass across 12 files; `bun run devcheck` clean.