Merge upstream v0.42.1 into dp-stable

.claude/agents/mcp-protocol-expert.md

@@ -37,9 +37,10 @@ Defer to: oauth-expert (OAuth/OIDC), kubernetes-expert (K8s operator), toolhive-
    - For the full, current set of pages under that version, fetch `https://modelcontextprotocol.io/sitemap.xml` and filter for the resolved version string — this is self-correcting as pages are added, renamed, or removed, unlike a hand-maintained list.
    - Common pages to expect (verify against the sitemap, don't assume the exact path): architecture, basic, basic/authorization, basic/lifecycle, basic/transports, basic/utilities/{cancellation,ping,progress,tasks}, client/{elicitation,roots,sampling}, server, server/{tools,resources,prompts}, server/utilities/{completion,logging,pagination}, schema, changelog.
    - Also check `https://modelcontextprotocol.io/extensions/auth/overview` for MCP auth extensions, which live outside the versioned spec tree.
-3. Cross-reference whichever source answered with ToolHive's implementation.
-4. Provide guidance based on the latest spec.
-5. Explicitly note any discrepancies between spec and implementation, and note which source (context7 vs. WebFetch) backed the answer if it's non-obvious.
+3. **For schema-level questions (exact field names, required-vs-optional, discriminated unions, literal error-code values), prefer the raw TypeScript schema over the rendered `.../schema` page or context7 snippets.** The rendered/curated sources can summarize or truncate a ~3k-line file; the ground truth both are generated from is `https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/schema/<version>/schema.ts` (plain text, JSDoc-commented). Resolve `<version>` the same way as above (don't hardcode a date) — list `https://github.com/modelcontextprotocol/modelcontextprotocol/tree/main/schema` if unsure which dated folder is current — then WebFetch that file directly with a narrow prompt for the type in question.
+4. Cross-reference whichever source answered with ToolHive's implementation.
+5. Provide guidance based on the latest spec.
+6. Explicitly note any discrepancies between spec and implementation, and note which source (context7, WebFetch docs, or schema.ts) backed the answer if it's non-obvious.
 
 ## Your Expertise
 

.claude/rules/go-style.md

@@ -200,3 +200,18 @@ Before implementing any non-trivial functionality from scratch:
 3. **Look for existing Go packages** — search for well-maintained OSS libraries that solve the problem before writing custom implementations.
 
 Implementing from scratch should be a last resort, justified by a specific gap no existing solution fills.
+
+## JSON-RPC Envelopes
+
+Never `json.Marshal` (or `json.NewEncoder().Encode`) a `jsonrpc2` type.
+`jsonrpc2.Response` carries no json tags and `jsonrpc2.ID`'s only field is
+unexported, so reflection emits Go-capitalized keys, drops the mandatory
+`"jsonrpc":"2.0"` tag, and renders every id — valid or not — as `{}` (#5950).
+Serialize through `jsonrpc2.EncodeMessage`; for HTTP error responses use
+`pkg/mcp.EncodeJSONRPCError` / `pkg/mcp.WriteJSONRPCError`, which add
+encode-before-header ordering and a conformant fallback body.
+
+When an envelope must be hand-built as a map (only where no `jsonrpc2.ID` is
+in hand), omit the `"id"` key when the id is absent — never emit `"id":null`.
+MCP's `RequestId` is `string | number`, so null is not representable, and the
+reference TypeScript SDK client throws on it inside its transport (#6038).

.github/workflows/api-compat.yml

@@ -50,7 +50,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout PR HEAD
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6

.github/workflows/claude.yml

@@ -46,7 +46,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 1
 
@@ -59,7 +59,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@f1bd27ca5b54584506e40e17884d90bdaaa1a9b3 # v1
+        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # Security: Restrict tools to prevent arbitrary code execution.

.github/workflows/create-release-pr.yml

@@ -38,7 +38,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:

.github/workflows/create-release-tag.yml

@@ -28,7 +28,7 @@ jobs:
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 

.github/workflows/e2e-tests.yml

@@ -11,7 +11,7 @@ jobs:
     name: Build ToolHive Binary
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -50,15 +50,20 @@ jobs:
           - title: core
             label_filter: core
             artifact: e2e-test-results-core
+            procs: 4
           - title: mcp-run
             label_filter: mcp-run
             artifact: e2e-test-results-mcp-run
           - title: mcp-protocol
             label_filter: mcp-protocol
             artifact: e2e-test-results-mcp-protocol
           - title: proxy
-            label_filter: proxy
+            label_filter: "proxy && !isolation"
             artifact: e2e-test-results-proxy
+          - title: network-isolation
+            label_filter: isolation
+            artifact: e2e-test-results-network-isolation
+            test_timeout: 25m
           - title: middleware
             label_filter: 'middleware || stability'
             artifact: e2e-test-results-middleware
@@ -86,7 +91,7 @@ jobs:
             label_filter: llm
             artifact: e2e-test-results-llm
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -99,7 +104,7 @@ jobs:
           go mod download
       - name: Install Ginkgo CLI
         run: |
-          go install github.com/onsi/ginkgo/v2/ginkgo@latest
+          go install github.com/onsi/ginkgo/v2/ginkgo@v2.28.1
 
       - name: Download ToolHive binary
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -121,29 +126,60 @@ jobs:
 
       - name: Pre-pull container images
         run: |
-          # Pre-pull images used by E2E tests so that workload creation
-          # does not pay the image-pull cost inside the 60s API timeout.
-          docker pull ghcr.io/stackloklabs/osv-mcp/server:0.1.3 &
-          docker pull ghcr.io/stackloklabs/gofetch/server:1.0.2 &
-          docker pull ghcr.io/stacklok/toolhive/egress-proxy:latest &
+          # Pre-pull images used by E2E tests so that workload startup does not
+          # pay the image-pull cost inside a spec's readiness timeout.
+          #
+          # Images that tests reach through a registry server name (`thv run
+          # fetch`) are resolved from the binary under test instead of being
+          # hardcoded here. Renovate bumps github.com/stacklok/toolhive-catalog
+          # daily but has no manager for these docker pull lines, so hardcoded
+          # tags drift out of sync with the catalog silently and the pre-pull
+          # stops covering what the tests actually run.
+          servers="fetch osv"
+          images="ghcr.io/stacklok/toolhive/egress-proxy:latest"
           # yardstick is only needed for the vmcp test suite
           if [ "${{ matrix.label_filter }}" = "vmcp" ]; then
-            docker pull ghcr.io/stackloklabs/yardstick/yardstick-server:1.1.1 &
+            images="$images ghcr.io/stackloklabs/yardstick/yardstick-server:1.2.0"
+          fi
+          # the time server and yardstick (dual-era barrier mode) are only
+          # used by the proxy (streamable-http) test suite
+          if [ "${{ matrix.label_filter }}" = "proxy && !isolation" ]; then
+            servers="$servers time"
+            images="$images ghcr.io/stackloklabs/yardstick/yardstick-server:1.2.0"
           fi
-          # the time server is only used by the proxy (streamable-http) test suite
-          if [ "${{ matrix.label_filter }}" = "proxy" ]; then
-            docker pull ghcr.io/stacklok/dockyard/uvx/mcp-server-time:2026.1.26 &
+          # Envoy is only used by the network-isolation test suite
+          if [ "${{ matrix.title }}" = "network-isolation" ]; then
+            images="$images envoyproxy/envoy-distroless:v1.32.3"
           fi
+
+          for server in $servers; do
+            image="$(./bin/thv registry info "$server" --format json | jq -er '.image')"
+            echo "Resolved registry server '$server' -> $image"
+            images="$images $image"
+          done
+
+          for image in $images; do
+            docker pull -q "$image" &
+          done
           wait
+
+          # `wait` reports success even when a background pull failed, so check
+          # each image landed locally. Failing here is far cheaper to diagnose
+          # than a spec timing out later while it waits on a live pull.
           echo "Pre-pulled images:"
-          docker images --format '{{.Repository}}:{{.Tag}}' | grep -E 'osv-mcp|gofetch|egress-proxy|yardstick|mcp-server-time'
+          for image in $images; do
+            docker image inspect "$image" >/dev/null \
+              || { echo "::error::failed to pre-pull $image"; exit 1; }
+            echo "  $image"
+          done
 
       - name: Run E2E tests (${{ matrix.title }})
         env:
           THV_BINARY: ${{ github.workspace }}/bin/thv
           TOOLHIVE_EGRESS_IMAGE: ghcr.io/stacklok/toolhive/egress-proxy:latest
           TEST_TIMEOUT: ${{ matrix.test_timeout || '15m' }}
           LABEL_FILTER: ${{ matrix.label_filter }}
+          PROCS: ${{ matrix.procs || 1 }}
         run: ./test/e2e/run_tests.sh
 
       - name: Upload test results (${{ matrix.title }})
@@ -160,8 +196,12 @@ jobs:
     runs-on: ubuntu-8cores-32gb
     needs: build-binary
     timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [proxy, vmcp]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -185,12 +225,13 @@ jobs:
       - name: Run MCP conformance suite
         env:
           THV_BINARY: ${{ github.workspace }}/bin/thv
+          CONFORMANCE_TARGET: ${{ matrix.target }}
         run: ./test/conformance/run-conformance.sh
 
       - name: Upload conformance results
         if: always()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: conformance-results
+          name: conformance-results-${{ matrix.target }}
           path: test/conformance/results
           retention-days: 7

.github/workflows/helm-charts-test.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 

.github/workflows/helm-publish.yml

@@ -14,7 +14,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Verify tag matches VERSION file
         run: |
@@ -61,7 +61,7 @@ jobs:
             path: deploy/charts/operator-crds
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Extract version
         id: version

.github/workflows/image-build-and-publish.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -85,7 +85,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Compute version number
         id: version-string
@@ -147,7 +147,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -227,7 +227,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -296,7 +296,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6

.github/workflows/issue-triage.yml

@@ -14,12 +14,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
       - name: Run Claude Code for Issue Triage
-        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1.0.165
+        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
         with:
           prompt: |
             You are an issue triage assistant. Analyze issue #${{ github.event.issue.number }} in ${{ github.repository }} and apply appropriate labels.

.github/workflows/license-headers.yml

@@ -14,7 +14,7 @@ jobs:
     name: Check License Headers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6

.github/workflows/lint.yml

@@ -12,7 +12,7 @@ jobs:
     name: Lint Go Code
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6

.github/workflows/operator-ci.yml

@@ -12,7 +12,7 @@ jobs:
     name: Operator Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -33,7 +33,7 @@ jobs:
     name: Operator Tests Integration
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -54,7 +54,7 @@ jobs:
     name: Build Operator
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -75,7 +75,7 @@ jobs:
     name: Generate CRDs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -108,7 +108,7 @@ jobs:
     name: Generate CRD Docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
@@ -157,7 +157,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
     - name: Set up Helm
       uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1