Skip to content

docs: add changelog entry for the IPC UTF-8 fix #391

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jancurn merged 1 commit into from
Sep 10, 2026
Merged

docs: add changelog entry for the IPC UTF-8 fix #391

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Sessions authenticated with a pre-registered confidential client (`mcpc login --client-id … --client-secret …`, as Asana's MCP server requires) no longer die at the first access-token expiry. The token refresh now presents the stored `client_secret`, and it resolves the authorization server through the MCP server's protected resource metadata like login does, instead of probing the MCP origin's own well-known metadata. Against Asana that probe found the legacy `mcp.asana.com` authorization server, where the client registered at `app.asana.com` does not exist, so every refresh failed with `invalid_client` and the session needed a new `mcpc login` every hour. (#387)
- Confidential-client sessions now also refresh against authorization servers that accept only HTTP Basic client authentication. The refresh presents the client secret the way the login did and retries with the other form if the server rejects it. (#387)
- Sessions no longer lose their saved OAuth refresh token when a server that does not rotate refresh tokens omits `refresh_token` from the refresh response. The bridge used to overwrite the stored token with nothing, so the session could not authenticate after the access token expired and required a new `mcpc login`.
- Accented text, CJK characters, and emoji in large tool results are no longer corrupted in transit: a multibyte character that landed on a socket chunk boundary between the CLI and the bridge was replaced with `�`, and the JSON stayed valid so nothing reported an error. (#390)

### Security

Expand Down
Loading