- Role-gate denial checks no longer match a bare "error" substring that
could appear inside a successful response; they now require
"isError":true or a real JSON-RPC error object ("error":{).
- cleanup_app_passwords_for now escapes backslashes before single
quotes when interpolating the user login into the wp eval PHP
snippet.
- The CIMD discovery check now requires
client_id_metadata_document_supported to be true, not just present.
- Mcp-Session-Id extraction no longer aborts under pipefail when the
header is absent; a missing header now yields an empty SESSION, as
already handled downstream.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7