fix: e2e flaky fix - #75

…otifications

Add two layers of test coverage for the Streamable HTTP transport:

Rust integration tests (gateway_notifications.rs):
- Gateway capabilities advertisement (listChanged: true)
- Tools/prompts/resources list_changed forwarding to clients
- Server disconnect notification propagation
- Grant change notification delivery
- Content-based deduplication preventing spurious notifications
- Time-based throttling coalescing rapid notifications
- Server features refresh triggering notifications
- Full re-fetch cycle after notification

Tauri E2E tests (streamable-http.wdio.ts):
- Gateway Streamable HTTP endpoint serving
- Backend HTTP transport connection
- Stub server control endpoint verification
- All three notification types from backend
- Dynamic tool add/remove with notifications
- Rapid successive notification handling
- Server disable/re-enable reconnection cycle
- OAuth DCR registration and approval
- PKCE token exchange flow
- Authenticated MCP initialize with capabilities check
- Session management via Mcp-Session-Id header

Supporting infrastructure:
- Stub MCP server control endpoints for triggering notifications
- E2E helpers for OAuth flow and stub server control
- Enhanced transport-level notification tests (prompts, resources)

Signed-off-by: Myko <myko@mcpmux.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Remove unused imports flagged by code review:
- createClient, listClients, listFeatureSetsBySpace,
  grantFeatureSetToClient from tauri-api
- waitForGateway from mcp-client

Signed-off-by: Myko <myko@mcpmux.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Log response status and body before assertions to debug failures.
Read response as text first, then parse JSON, so CI output shows
the actual error returned by the gateway.

Signed-off-by: Myko <myko@mcpmux.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

The gateway returns 406 Not Acceptable when the Accept header doesn't
include both application/json and text/event-stream, as required by
the MCP Streamable HTTP transport spec (2025-03-26).

Add 'Accept: application/json, text/event-stream' to all fetch calls
in TC-SH-014 and TC-SH-015 E2E tests.

Signed-off-by: Myko <myko@mcpmux.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Per the MCP Streamable HTTP spec (2025-03-26), when a POST contains
JSON-RPC requests, the server may respond with either Content-Type:
application/json or text/event-stream. The client MUST support both.

Add parseMcpResponse() helper that checks the Content-Type header and
extracts JSON from SSE data: lines when the gateway returns an SSE
stream instead of plain JSON.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Three fixes for the SSE notification pipeline:

1. logging_middleware: Skip body.collect() for text/event-stream responses.
   The middleware was buffering infinite SSE streams, blocking forever and
   preventing VS Code from receiving any SSE events (notifications, pings).

2. mcp_notifier: Add `force` parameter to notify_all_list_changed().
   Grant/feature-set events now bypass content-based hash dedup since the
   hash is computed from all features in the space and can't detect
   per-client grant changes that alter effective visibility.

3. Upgrade rmcp to 0.15.0 from fork with SSE channel replacement fix
   (409 Conflict on duplicate GET streams) and adapt to new struct fields
   (granted_scopes, Default trait changes).

Signed-off-by: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

- Update rmcp to latest commit with comprehensive SSE shadow channel
  tests (15 tests covering reconnect, dead primary replacement,
  notification routing, resume paths, and edge cases)
- Add last-event-id to non-redacted headers in logging middleware
- Fix missing granted_scopes field in credential_store test initializers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

The integration test crate pinned rmcp to 0.14.0 while the workspace
patch targets 0.15.0, causing CI to use the unpatched crates.io version
which lacks the StoredCredentials::granted_scopes field and has
incompatible ServerHandler trait bounds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Updates rmcp to use 404 Not Found (instead of 401 Unauthorized) for
missing/terminated MCP sessions, per MCP spec. This prevents VS Code
from triggering full OAuth re-authentication on McpMux restart.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

- Remove process.exit(1) from tauri-driver crash handlers so JUnit XML
  reports are properly finalized (prevents malformed wdio-junit-*.xml)
- Use pkill without -f on Linux (match process name, not full cmdline)
  to avoid accidentally killing unrelated processes
- Force-kill lingering tauri-driver processes between specs to free
  port 4444 on Linux
- Add specFileRetries=1 on CI to retry transient WebKit2GTK crashes
- Add 1s pause in afterSession for Linux process teardown
- Wrap screenshot capture in try/catch for tauri-driver crash scenarios

https://claude.ai/code/session_01N5WUgi8V1zVQBHVw96eVzM
Signed-off-by: Claude <noreply@anthropic.com>

The root cause of the Linux CI failure was that when server-lifecycle.wdio.ts
(worker 0-7) crashed, ALL subsequent workers (0-8 through 0-12) failed with
"Failed to create a session" due to cascading process cleanup issues.

The problem was in the afterSession/beforeSession lifecycle:
- afterSession called pkill -9 tauri-driver while WebdriverIO's deleteSession
  was still in-flight, causing connection errors
- afterSession called stopMockServers() which could kill mock servers needed
  by subsequent specs
- No readiness check existed, so new tauri-driver instances started before
  the previous one fully released resources (ports, locks)

Changes:
- Move aggressive cleanup (pkill -9, killMcpmuxProcesses, fuser) from
  afterSession to beforeSession, executed BEFORE spawning new tauri-driver
- afterSession now only sends graceful SIGTERM via closeTauriDriver()
- Remove stopMockServers() from closeTauriDriver() (mock servers are
  started once in onPrepare and should live across all specs)
- Add waitForTauriDriverReady() health check that polls GET /status
  before letting WebdriverIO create a session
- Free gateway port 45818 between specs to prevent binding conflicts
- Add stopMockServers() to onShutdown handler as safety net

Result: 12/13 specs pass (up from 7/13). Only the actually crashing spec
(server-lifecycle.wdio.ts) fails; all subsequent specs recover cleanly.

Signed-off-by: Claude <noreply@anthropic.com>

https://claude.ai/code/session_01N5WUgi8V1zVQBHVw96eVzM
Signed-off-by: Claude <noreply@anthropic.com>

Make wdio-video-reporter opt-in (SAVE_ALL_VIDEOS=true) to prevent
screenshot-during-teardown race that causes UND_ERR_SOCKET on Linux
where WebKitGTK tears down synchronously on deleteSession. Also upgrade
E2E workflow to Node 22 so --experimental-strip-types fixtures work
without retry storms.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>