---
summary: Task session isolation fixes, devcheck audit resilience, and broad test coverage across app lifecycle, CLI scaffold, task registration, auth, and HTTP authz
breaking: false
---

# 0.2.10 — 2026-03-30

Task ownership, devcheck resilience, and internal cleanup.

## Fixed

- **Task session ownership persistence** — `SessionAwareTaskStore` no longer deletes ownership tracking when a task reaches a terminal state (`completed`/`failed`). Previously, completed tasks became visible to other sessions, violating session isolation. Ownership now persists through the full task lifecycle.
- **Task list visibility for sessionless callers** — Sessionless `listTasks` calls now correctly return only unowned tasks, consistent with `StorageBackedTaskStore` behavior. Previously returned all tasks regardless of ownership.

## Changed

- **Devcheck audit resilience** — Security audit check now detects connection/registry failures and emits a warning instead of silently passing when the output doesn't resemble a valid audit response.
- **Internal object construction** — Replaced spread-with-conditionals patterns in `ctx.state.list()` and `SessionAwareTaskStore.listTasks()` with explicit object construction for clarity.

## Tests

- Updated `SessionAwareTaskStore` tests to assert ownership retention through terminal states and correct sessionless visibility filtering.
- **`core/app`** — Composition root lifecycle: service composition, name/version overrides, Supabase storage init, signal handler registration, graceful shutdown, OTel init failure resilience, lint warning logging, process gauge callbacks, fatal handler backstops.
- **`cli/init`** — Scaffold command: `--help` output, unknown subcommand rejection, invalid project name validation, named project scaffolding with templates/scripts/skills, current-directory init with skip-existing behavior.
- **`tool-registration.lifecycle`** — Task and auto-task registration: resource notification binding, `_meta` forwarding, duplicate name rejection across regular/task tools, missing services guard, experimental task API registration, auth scope enforcement, default/custom formatters, completed/failed result storage, cancellation detection, TTL timeout, task-store polling failure handling.
- **`heartbeat`** — Monitor start/stop, disabled no-op, failure counting with metric emission, recovery logging and counter reset, dead connection declaration after threshold, early-stop guard.
- **`jwtStrategy.mocked`** — Non-Error verification failure normalization via mocked `jose`.
- **`http-authz.e2e`** — End-to-end scoped tool authorization against a fixture server: scoped callers invoke both public and protected tools, missing scope returns MCP authz error.
- **`prompt-registration`** — Duplicate prompt name rejection, generation failure wrapping as `McpError`.
- **`authMiddleware.metrics`** — Active span identity attribute recording with tenant/subject fallbacks.
- **`authUtils`** — Parent request context passthrough for scope checking.
- **`jwtStrategy`** — Issuer and audience verification when configured, wrong audience rejection.
- **`oauthStrategy`** — Error and non-Error JWKS init failure wrapping, `aud` claim fallback for resource validation, non-Error verification failure normalization.

## Infrastructure

- **`tests/fixtures/auth-scoped-server.js`** — Minimal HTTP fixture server with one public and one scoped tool for authz e2e tests.
- **`tests/helpers/server-process.ts`** — `resolveEntrypoint()`, `assertServerEntrypoint()`, and `startServerFromEntrypoint()` for custom fixture server spawning.
