[dependabot]

The ext-apps 2.0.3 update was incompatible with the v1 McpServer, so plugin CI failed during typechecking. Use the supported split MCP client/server 2.3.1 packages at runtime, wrap the existing tool input shapes in Zod objects, and type the accumulated host styles as partial. Tool names, input fields, resource metadata, mutation envelopes, store and provider code remain unchanged.

SDK 1.32.1 is retained only as a development dependency. Existing compiled-server stdio tests and cross-client product evals use that v1 client to verify wire compatibility; the in-memory contract test now uses the v2 client and additionally confirms rejected inputs never reach mutation handling. Regenerated the tracked plugin HTML and server bundles and documented this boundary.

Updated dependency attributions and included the split SDK license files in plugin/install validation and the native bundle. Both native validators now compare bundled dependency notices byte-for-byte with their sources; the existing readiness fixture rejects a tampered license. The three new license files exactly match the installed packages.

Validation:

• npm run check: 170/170 tests, typecheck, build and plugin validation pass.
• npm run evals: all 7 synthetic scenarios pass, including v1-client/v2-server and native CLI consistency.
• npm run test:e2e: all 32 browser tests pass.
• npm audit --omit=dev --audit-level=high: zero production advisories.
• Notice-only follow-up: script syntax, readiness regressions (including tampered-license rejection), launch-asset validation, native build-script syntax and plugin validation pass locally. Exact-head hosted macOS checks validate the built bundle and its notices before merge.
• The concurrent Dependabot patch refresh was merged normally. All 880 installed SDK dist/type files and both rebuilt plugin bundles are byte-identical to the successfully tested predecessor versions; no force push or history rewrite was used for this repair.

The existing crash-recovery test initially hit its 50 ms acquisition budget locally; focused probes and the final full check passed unchanged. The original failure is retained in the local audit receipt. No production locking code, timeout, or acceptance criterion was relaxed. Full development audit still reports the pre-existing braces advisory through micromatch/vite-plugin-singlefile; npm's proposed incompatible downgrade was not applied.

Hosted checks are required on the exact final PR head before merge. This is a source/dependency update: no plugin installation, native UI acceptance, release gauntlet, distribution signing, notarization or deployment is claimed.

Reference: official ext-apps v2 migration guide.