---
summary: Task manager lifecycle fix, error metadata on responses, resource output validation, HTTP tenant isolation hardening, config override timing
breaking: false
---

# 0.1.6 — 2026-03-16

Task lifecycle improvements, error metadata for programmatic clients, resource output validation, and tenant isolation hardening.

## Added

- **Error metadata on tool responses** — Error responses now include `_meta.error` with the JSON-RPC error code and, for explicitly thrown `McpError` instances, the `data` payload. Programmatic clients can distinguish error types (auth, validation, not-found, etc.) without parsing the text message.
- **Resource output validation** — Resource handler factory validates handler output against the `output` schema when defined, matching tool handler behavior.

## Fixed

- **Task manager lifecycle** — `TaskManager` is now created inside `composeServices()` and its `taskStore`/`taskMessageQueue` are passed directly to the `McpServer` constructor. Previously, the task manager was created after service composition in `createApp()`, which meant the SDK server had no task support wired in.
- **Config override timing** — `name`/`version` overrides from `createApp()` options are now applied before OTEL initialization, so the telemetry service name reflects the actual server identity.
- **Context TTL edge case** — `ctx.state.set()` and `ctx.state.setMany()` now use `opts?.ttl !== undefined` instead of a truthy check, allowing `ttl: 0` to be passed through correctly.
- **HTTP tenant isolation** — HTTP transport without auth now leaves `tenantId` unset instead of defaulting to `'default'`. `ctx.state` operations fail-closed via `requireContext()`, preventing unauthenticated callers from sharing a single tenant namespace. Stdio continues to default to `'default'`.

## Changed

- Reverted `js-yaml` optional peer dependency from `^4.0.0` back to `^3.14.2`.
- Updated dev dependencies: `@cloudflare/workers-types`, `@supabase/supabase-js`, `msw`, `openai`.
- Improved HTTP transport port-detection test with proper `try/finally` cleanup.
