Fetching from the wire…
01
02
03
04
05
06
07
08
Infra2026-09-07 · source-backed
authorizationServerMetadataURLs decided an issuer had a path component by testing baseURL.Path == "" (go-sdk #1245). An issuer written as https://auth.example.com/ has Path == "/", so it took the path-insertion branch and probed /.well-known/oauth-authorization-server/ and //.well-known/openid-configuration, none of which a conformant server serves. Discovery found nothing and the caller fell back to guessed 2025-03-26 endpoints. RFC 8414 §3.1 requires stripping the terminating slash first.
Each link below shares sources, entities, or timing with this story.
PR #3398 makes the OAuth client fix its expected issuer before fetching any authorization server metadata. On the 2025-03-26 legacy fallback path the document's issuer was never checked and stored-credential binding was re-evaluated against whatever issuer the document named,...
PR #29081, merged August 26 and in nightly v0.59.0-nightly.20260827, enforces RFC 9728 §7.7 and RFC 8414 constraints across MCP OAuth metadata discovery, dynamic client registration, and token exchange. It requires HTTPS for remote endpoints with HTTP allowed only for loopback...
TrustMeBro is a Go tool at 327 stars, created August 26, that intercepts commands invoked by Codex, Claude Code and pi through PATH shims alone. No plugin, no hook, no MCP. Rules decide whether to fabricate output, rewrite stdout while preserving stderr and exit status, block,...
A Chinese lab shipped a runtime that manages two American coding agents as subagents, and it went from repo creation to 145,439 stars in four days. deepseek-ai/deepseek-harness published dsh-v0.1.0-rc.7 at 12:01 UTC today, its first tagged release since the repo appeared on Au...
holaboss-ai/holaOS puts Claude Code, Codex and its own agent in one Electron workspace where context and history live as editable local files rather than a hosted database, so memory persists across sessions *and* across agents. Built-in frontier models (Kimi K3, GLM 5.2, GPT...
JSON payloads are rejected past 1000 levels of nesting before the parser recurses, both SSE readers cap per-event bytes through a new MaxEventSize, stdio caps a single JSON-RPC frame via StdioTransport.MaxLineLength, and OAuth dynamic client registration responses are capped a...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.