---
summary: "HTTP session-init gate, expected client error log-level split, plugin metadata scaffolding, skill updates"
breaking: false
security: false
agent-notes: |
  New scaffold templates added: templates/.claude-plugin/ and templates/.codex-plugin/.
  templates/AGENTS.md and templates/CLAUDE.md now include a plugin file checklist item.
  changelog/template.md has a new optional agent-notes frontmatter field.
  Skills updated: maintenance (plugin metadata step), polish-docs-meta (plugin metadata step),
  design-mcp-server (new patterns), git-wrapup, release-and-publish.
---

# 0.9.10 — 2026-05-26

## Added

- **`templates/.claude-plugin/`** and **`templates/.codex-plugin/`** — scaffold templates for Claude Code and Codex plugin metadata files, copied into new servers via `bunx @cyanheads/mcp-ts-core init`.
- **`templates/AGENTS.md`** and **`templates/CLAUDE.md`** — plugin file checklist item added to the orient block.
- **`changelog/template.md`** — `agent-notes` frontmatter field documented; optional free-form notes for maintenance agents processing a release.
- **`skills/maintenance/SKILL.md`** — plugin metadata step added to Phase B.
- **`skills/polish-docs-meta/SKILL.md`** — plugin metadata verification step added.
- **`skills/design-mcp-server/SKILL.md`** — tool design patterns and API prior art guidance expanded.

## Fixed

- **HTTP session-init gate** (`httpTransport.ts`) — stateful HTTP mode now rejects non-`initialize` requests that arrive without an `Mcp-Session-Id` header with HTTP 400, preventing uninitialized sessions from being minted on first contact ([#154](https://github.com/cyanheads/mcp-ts-core/issues/154)).
- **`httpErrorHandler`** — expected client errors (401, 403, 400, 404) now use `classifyOnly` + `logger.warning` instead of full `ErrorHandler.handleError` pipeline with stack traces, reducing noise in error logs ([#158](https://github.com/cyanheads/mcp-ts-core/issues/158)).

## Changed

- **`skills/git-wrapup/SKILL.md`** and **`skills/release-and-publish/SKILL.md`** — minor clarifications.
- **Dependency bumps:**
  - `hono` ^4.12.22 → ^4.12.23
  - `@cloudflare/vitest-pool-workers` ^0.16.9 → ^0.16.10
  - `@cloudflare/workers-types` ^4.20260524.1 → ^4.20260527.1
  - `@duckdb/node-api` ^1.5.3-r.1 → ^1.5.3-r.2
  - `@supabase/supabase-js` ^2.106.1 → ^2.106.2
