You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Following discussion on Discord, this uses the extracted Tasks implementation (see modelcontextprotocol/ext-tasks#21) to replace the implementation here.
Publishing as a draft for reference and comments; this is unusable until the actual extension SDK is merged and published to NPM (after which point I'll swap the new dependency to not be a local path). I'm keeping this PR in sync with the Tasks extension one, and once the Tasks extension one is merged, this PR can either be merged directly or used as the basis for a separate implementation.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The new dependency breaks the SDK watch invariant, and concurrent task calls can misattribute progress events.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
package.json:94
Adding this scoped package makes the nightly SDK watch fail immediately: scripts/sdk-watch.mjs:250-259 rejects every root @modelcontextprotocol/* dependency absent from SDK_GROUPS, which currently contains only the TypeScript SDK packages and ext-apps. Add ext-tasks as its own upstream group and update the sdk-watch fixtures/tests so releases of this new dependency are tracked instead of breaking the workflow.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Auth recovery can duplicate remote tasks, SDK-watch registration is missing, and the dependency remains an unpublished local path.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
package.json:94
Adding another @modelcontextprotocol/* dependency without registering it in SDK_GROUPS makes the nightly SDK watch fail in assertEveryPackageWatched (scripts/sdk-watch.mjs:250-258) before it can check any releases. Add an independent ext-tasks group (it has its own repository/release cadence) and update the watcher tests as part of this dependency addition.
Reuse SDK task types instead of duplicating contracts
core/mcp/types.ts:49
The extracted SDK already exposes generation-neutral TaskState and TaskView; introducing a second project-owned status union and near-copy of that view creates another contract that can drift whenever ext-tasks evolves. It also conflicts with the repository rule not to introduce InspectorTaskStatus. Reuse or alias the SDK-neutral types, adding only a narrowly documented normalized overlay if required by existing UI state.
Update SDK header to document ext-tasks
scripts/sdk-watch.mjs:104
Adding this third upstream leaves this file’s header inaccurate: lines 21–26 still state “Two upstreams, not one” and describe only TypeScript SDK plus ext-apps. Update that design rationale to include ext-tasks so the source documentation matches SDK_GROUPS.
The new known-handles branch is only tested with an empty store, so the test would still pass if this path returned immediately and never called getRequestorTask. Seed one known task before switching the fake to known-handles, then assert refresh re-polls that ID and still avoids listRequestorTasks; this is the behavior this branch is intended to protect.
Update security rationale to document all three upstreams
AGENTS.md:132
Adding the third upstream leaves the security rationale stale: AGENTS.md:165 and .github/workflows/sdk-watch.yml still say the analysis reads “both upstreams” and enumerate only TypeScript SDK and ext-apps. Update both to include ext-tasks so the documented first-party-input threat model matches what the workflow now analyzes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Following discussion on Discord, this uses the extracted Tasks implementation (see modelcontextprotocol/ext-tasks#21) to replace the implementation here.
Publishing as a draft for reference and comments; this is unusable until the actual extension SDK is merged and published to NPM (after which point I'll swap the new dependency to not be a local path). I'm keeping this PR in sync with the Tasks extension one, and once the Tasks extension one is merged, this PR can either be merged directly or used as the basis for a separate implementation.