Keep MCP-Apps rendering across a cold session restore - #1504
Merged
Conversation
The negotiated MCP-Apps capability lived only in the tool server instance, set from the client at initialize. A session whose Durable Object was evicted (deploy, idle) and cold-restored on the same mcp-session-id was rebuilt with no initialize to replay, so apps support read back as false and create-artifact/show-artifact answered with the deep-link fallback instead of the inline widget, mid-conversation. Persist the negotiated bit in SessionMeta and seed the rebuilt server from it. A real initialize still overrules the restored value in both directions, and init carries the stored bit through its re-resolve so restoring a session no longer erases it.
Contributor
Cloudflare previewTorn down — the PR is closed. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | 08cc11b | Commit Preview URL Branch Preview URL |
Jul 30 2026, 05:39 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
executor-cloud | 08cc11b | Jul 30 2026, 05:38 AM |
@executor-js/cli
@executor-js/config
@executor-js/execution
@executor-js/sdk
@executor-js/codemode-core
@executor-js/runtime-quickjs
@executor-js/plugin-file-secrets
@executor-js/plugin-graphql
@executor-js/plugin-keychain
@executor-js/plugin-mcp
@executor-js/plugin-onepassword
@executor-js/plugin-openapi
executor
commit: |
The persisted-capability seed alone did not fix the production symptom. On cold restore the agents runtime replays the persisted initialize REQUEST, which does re-establish the server's client capabilities — but it never replays the notifications/initialized NOTIFICATION, and oninitialized (the only hook that re-runs syncToolAvailability) fires solely on that notification. A restored session therefore held full apps capabilities while the cached flag still read its seeded value, and the replay is dispatched un-awaited, so a tool call can also land ahead of it. deliverArtifact now reads the live server's capabilities per render and reconciles the app-only tools when they disagree, so both orderings answer identically. The seeded value remains the fallback for the window before any capabilities exist. Also guard the persist path: a reading taken with no capabilities present must never be written back, or one such replay would make the deep-link downgrade durable for every future restore of the session.
RhysSullivan
marked this pull request as ready for review
July 30, 2026 16:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MCP-Apps rendering was lost on cold session restore: the same session rendered an inline widget before a Durable Object restore and a
fallback_urldeep link after, and once an isolate lost the capability it served fallbacks for the rest of its life.What actually happens
The first read of this was that a restored DO has no
initializeto replay, soappsEnabledstaysfalse. That is not the mechanism. Theagentsruntime persists theinitializerequest and replays it on restore (reinitializeServer), which does re-establish the server's client capabilities.The gap is that capabilities and the hook are set by two different messages:
_clientCapabilitiesis assigned by theinitializerequest handler.oninitialized— the only hook that re-runssyncToolAvailability— fires on thenotifications/initializednotification, which is never persisted or replayed.So a restored session holds full apps capabilities while the in-memory flag still reads its seeded value, and nothing ever reconciles the two. The replay is also dispatched un-awaited, so a tool call can land before it arrives. Both orderings produced the deep link.
The fix
deliverArtifactresolves capability from the live server on every render rather than trusting the cached flag, and reconciles the app-only tools when the two disagree — otherwise a restored session could render inline whileexecute-action, the tool the widget calls back into, stayed hidden. The persisted seed remains the fallback for the window before any capabilities exist.The persist path is guarded so a reading taken with no capabilities present is never written back; without that, one such replay would make the downgrade durable for every future restore of the session.
The host side (first commit) still persists the negotiated bit alongside
sessionMetaand rehydrates it.resolveAndStoreSessionMetacarries the stored value forward becauseinit()re-resolves meta from the bearer token on every restore, which carries no capabilities and would otherwise erase it.Tests
The headline test replays the
initializerequest under the SDK's restore sentinel id and sends noinitializednotification — the exact shape of a real restore — withrestoredAppsEnabled: false, so a pass cannot come from the seed. It asserts the inline payload and thatexecute-actionis listed. Verified by reverting the fix and watching it fail.