From b7da3ebc29e49d54037f5f8d57c3b697629751f0 Mon Sep 17 00:00:00 2001 From: coseto6125 <80243681+coseto6125@users.noreply.github.com> Date: Tue, 1 Sep 2026 10:14:45 +0800 Subject: [PATCH 1/2] =?UTF-8?q?chore(deps):=20cargo=20update=20=E2=80=94?= =?UTF-8?q?=209=20packages,=20no=20manifest=20changes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Lockfile-only refresh. Nothing here needed adaptation code; every crate builds, clippies and tests unchanged. borsh / borsh-derive 1.8.0 -> 1.8.1 cpufeatures 0.3.0 -> 0.3.1 indexmap 2.14.0 -> 2.14.1 lru 0.18.2 -> 0.18.3 (ratatui-core's copy) rmcp / rmcp-macros 3.1.4 -> 3.2.0 tree-sitter-language 0.1.7 -> 0.1.8 uuid 1.25.0 -> 1.26.0 Five direct dependencies were behind. Two stay behind, for reasons that are not ours to fix from this repo: - `cc` 1.2.67 -> 1.4.4 does not resolve. tree-sitter-sequel 0.3.11 declares a build-dep on `cc ~1.2.1`, which caps the whole graph at 1.2.x; every other grammar uses a caret range that would accept 1.4. - `tree-sitter` 0.26.13 -> 0.27.0 and `ast-grep-core` 0.45.2 -> 0.45.3 are one change, not two: ast-grep-core 0.45.3 requires tree-sitter ^0.27.0, and `tree-sitter` carries `links = "tree-sitter"`, so exactly one copy may exist in the graph. The move is feasible — the only blockers are our own seven vendored grammars pinning 0.26, and with those relaxed the resolve succeeds — but 0.27 returns `u32` from `Node::child_count` (tree-sitter#5313, 19 call sites here) and fixes cross-branch capture contamination in query alternations (tree-sitter#5317), which can move parse output. That belongs in its own PR with the 14-language matrix, not bundled into a lock refresh. RUSTSEC-2026-0253 (lru 0.16.4, via tantivy 0.26.1's `lru ^0.16.3`) remains the one open advisory, still with the reason and the pinning test recorded in .cargo/audit.toml. tantivy 0.26.1 is the latest. Gates, run per crate at -j 4: check ecp-core, ecp-analyzer, ecp-mcp, egent-code-plexus clean clippy same four, --all-targets --all-features -D warnings clean fmt cargo fmt --all --check clean test ecp-mcp 50, ecp-core 366, ecp-analyzer 403 pass test egent-code-plexus 58 targets, 634 passed, 1 failed That one failure, find_cmd::find_exact_match_returns_single_definition, is pre-existing and not caused by this change: the same suite on origin/main's own Cargo.lock gives the identical 58 / 634 / 1 / 4. It depends on the developer's real ~/.ecp — with ECP_HOME pointed at an empty directory all 16 find_cmd tests pass. CI is green because CI's ~/.ecp never holds this repo. --- Cargo.lock | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 1e2f7538a..7e032f82d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -264,7 +264,7 @@ dependencies = [ "cc", "cfg-if", "constant_time_eq", - "cpufeatures 0.3.0", + "cpufeatures 0.3.1", ] [[package]] @@ -310,9 +310,9 @@ dependencies = [ [[package]] name = "borsh" -version = "1.8.0" +version = "1.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a88b7ea17d208c4193f2c1e6de3c35fe71f98c96982d5ced308bdcc749ff6e1f" +checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a" dependencies = [ "borsh-derive", "bytes", @@ -321,15 +321,15 @@ dependencies = [ [[package]] name = "borsh-derive" -version = "1.8.0" +version = "1.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d8f347189c62a579b8cd5f80714efa178f52e461dc2e6d701d264f5ff22e566c" +checksum = "12cdfe656708a01f89b451a7d36466e6fe6c414de0aa18fc54f864f6f9ca9f56" dependencies = [ "once_cell", "proc-macro-crate", "proc-macro2", "quote", - "syn 2.0.119", + "syn 3.0.4", ] [[package]] @@ -603,9 +603,9 @@ dependencies = [ [[package]] name = "cpufeatures" -version = "0.3.0" +version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566" dependencies = [ "libc", ] @@ -1617,9 +1617,9 @@ dependencies = [ [[package]] name = "indexmap" -version = "2.14.0" +version = "2.14.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9" +checksum = "07aa2048142242915a31d35844fb311e0e53fcca590c3a0a40dcf1b841fa09eb" dependencies = [ "equivalent", "hashbrown 0.17.1", @@ -1852,9 +1852,9 @@ dependencies = [ [[package]] name = "lru" -version = "0.18.2" +version = "0.18.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5d2f2f9b4ba7e6b24d95e7e899329d35be83bcded72c8540cdd5368932d1d90a" +checksum = "0d317b4b9eb398e6acce275758ec6125535505e7a146fb1a9b8bda2451b0ff4c" dependencies = [ "hashbrown 0.17.1", ] @@ -2602,7 +2602,7 @@ dependencies = [ "hashbrown 0.17.1", "itertools 0.14.0", "kasuari", - "lru 0.18.2", + "lru 0.18.3", "palette", "serde", "strum", @@ -2794,9 +2794,9 @@ dependencies = [ [[package]] name = "rmcp" -version = "3.1.4" +version = "3.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1a15bc53261a9dc37e105df006e4656c598379a8f9581f8950debb130f27a7cf" +checksum = "42b6914fac0be956fe704a38239c3f44a9f841d1b06a5713d2f638065593f5b5" dependencies = [ "base64 0.23.1", "chrono", @@ -2817,9 +2817,9 @@ dependencies = [ [[package]] name = "rmcp-macros" -version = "3.1.4" +version = "3.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a85d45508e9b4ba024fe996c2638799635d75b6dd0ba8f32ccf08f8026f0c780" +checksum = "cdf1c49bd4d52014b94db0877410db273c2008f01628b0252a2e9460ad9b7fda" dependencies = [ "darling", "proc-macro2", @@ -3032,7 +3032,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures 0.3.1", "digest 0.11.3", ] @@ -3912,9 +3912,9 @@ dependencies = [ [[package]] name = "tree-sitter-language" -version = "0.1.7" +version = "0.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "009994f150cc0cd50ff54917d5bc8bffe8cad10ca10d81c34da2ec421ae61782" +checksum = "ca0d1bf6fdd806e43ae5198f82f527056d359def39e54e67a0f478ac09dac081" [[package]] name = "tree-sitter-lua" From cdb23a282150f398f62e605b53ef09b671348dca Mon Sep 17 00:00:00 2001 From: coseto6125 <80243681+coseto6125@users.noreply.github.com> Date: Tue, 1 Sep 2026 10:14:56 +0800 Subject: [PATCH 2/2] docs(mcp): say why the cache-hint branch cannot fire over stdio MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit rmcp 3.2.0 changes what `context.protocol_version()` returns, which is the value `list_tools_result` gates the SEP-2549 `ttlMs` / `cacheScope` fields on. Before, `negotiate_protocol_version` echoed the client's requested version whenever `supported_protocol_versions()` contained it, so a client that handshook claiming `2026-07-28` got `2026-07-28` back and we attached the hints. rust-sdk#1228 fixed that against the 2026-07-28 versioning spec: an `initialize` request selects legacy semantics whatever version it names. Every path through the new `negotiate_protocol_version` returns a legacy version or an error — verified by reading rmcp-3.2.0/src/service/server.rs — and `uses_discover_lifecycle` is set only in the streamable-HTTP tower service. `serve_stdio` goes through `serve_server`, so on the stdio transport the negotiated version is now always below the gate. We adopt that. The alternative is sending 2026-07-28-only fields to a peer the spec says is on legacy semantics, and rmcp removed the knob that would let us anyway. The branch stays. It is what a discover-lifecycle peer must receive, its three unit tests still pin the mapping, and it goes live the day `ecp` gains an HTTP transport or rmcp gives stdio that lifecycle. Without this note the next reader has a branch with no reachable caller and a plausible reason to delete it. The dependency requirement moves 3.1 -> 3.2 so the comment cannot go stale against a lockfile that resolved 3.1.x. No lockfile change: the refresh in the parent commit already landed 3.2.0. --- crates/ecp-mcp/Cargo.toml | 2 +- crates/ecp-mcp/src/server.rs | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/crates/ecp-mcp/Cargo.toml b/crates/ecp-mcp/Cargo.toml index 80bee9435..9fddd8294 100644 --- a/crates/ecp-mcp/Cargo.toml +++ b/crates/ecp-mcp/Cargo.toml @@ -17,7 +17,7 @@ ecp-core = { workspace = true } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "process"] } -rmcp = { version = "3.1", features = ["server", "transport-io"] } +rmcp = { version = "3.2", features = ["server", "transport-io"] } [dev-dependencies] clap = { version = "4.5", features = ["derive"] } diff --git a/crates/ecp-mcp/src/server.rs b/crates/ecp-mcp/src/server.rs index 4a116d29f..78eaa32f0 100644 --- a/crates/ecp-mcp/src/server.rs +++ b/crates/ecp-mcp/src/server.rs @@ -142,6 +142,16 @@ const TOOL_LIST_TTL_MS: u64 = 60_000; /// /// Older peers predate both fields and keep the legacy wire shape, matching /// how rmcp's own `#[tool_handler]` gates them. +/// +/// Since rmcp 3.2.0 the hints branch is unreachable over stdio, and that is the +/// spec's intent rather than a bug to route around. `negotiate_protocol_version` +/// (rust-sdk#1228) now returns a legacy version on every path, because an +/// `initialize` handshake selects legacy semantics whatever version the client +/// names; `2026-07-28` arrives only through the discover lifecycle, which rmcp +/// wires in the streamable-HTTP tower service alone. `serve_stdio` goes through +/// `serve_server`, so `protocol` is always below the gate today. Keep the branch: +/// it is what a discover-lifecycle peer must receive, and it goes live the day +/// `ecp` gains an HTTP transport or rmcp gives stdio that lifecycle. fn list_tools_result( tools: Vec, protocol: Option,