[Afloat16]

Problem

The sandbox MCP client treats objects with a matching ID as responses without checking their JSON-RPC shape. Missing results can resolve as successful undefined values, and a null error aborts the reader with a TypeError. Invalid initialize results can also leave a client with missing server information and locked streams.

Changes

Validate the response version, require exactly one result or error, and validate error fields before settling a request. Reject a malformed response without breaking subsequent requests. Validate server information inside the initialization cleanup boundary. Keep server requests separate from responses even when IDs overlap.

Validation

The validation results below were recorded for this branch against baseline e7519957b9067c541825afa21a792fbe1f483047.

Node v24.22.1:

• TypeScript build: passed.
• node --test test/*.test.mjs in packages/@agent-browser/sandbox: 37 tests passed.
• All 10 new malformed-response and initialization regressions fail against the unmodified main implementation and pass with the fix.
• git diff --check: passed.

[vercel]

@Afloat16 is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.