fix(local-mcp): match the sandbox's null-id notification check, reuse sanitizeHeaders

The desktop relay executor only treated payload.id === undefined as a
fire-and-forget notification, but the sandbox's McpRelayServer treats
undefined or null as a notification. An id: null message ran as a real
request against the user's local server and its response was rejected as
an orphaned mcp_response. Aligned both checks.

Also dropped sanitizeStringRecord, a byte-for-byte copy of mcp-config.ts's
sanitizeHeaders that this file already imports from — exported and reused it
instead of maintaining two copies of the same header/env sanitizer.

Author: richardsolomou

packages/agent/src/adapters/claude/session/mcp-config.ts

@@ -85,7 +85,9 @@ export function loadUserClaudeJsonMcpServers(
   return servers;
 }
 
-function sanitizeHeaders(headers: unknown): Record<string, string> | undefined {
+export function sanitizeHeaders(
+  headers: unknown,
+): Record<string, string> | undefined {
   if (!headers || typeof headers !== "object") return undefined;
   const entries = Object.entries(headers as Record<string, unknown>).filter(
     (entry): entry is [string, string] => typeof entry[1] === "string",

packages/workspace-server/src/services/mcp-relay/mcp-relay.test.ts

@@ -181,6 +181,21 @@ describe("McpRelayServiceImpl", () => {
     ]);
   });
 
+  it("treats an explicit null id the same as a missing id (fire-and-forget)", async () => {
+    const service = makeService("srv");
+
+    const execution = await service.execute("run-1", "srv", {
+      jsonrpc: "2.0",
+      id: null,
+      method: "notifications/initialized",
+    });
+
+    expect(execution).toEqual({});
+    expect(service.transports[0].sent).toEqual([
+      { jsonrpc: "2.0", id: null, method: "notifications/initialized" },
+    ]);
+  });
+
   it("replaces a response over 256 KB with a -32003 error", async () => {
     const service = makeService("srv");
 

packages/workspace-server/src/services/mcp-relay/mcp-relay.ts

@@ -9,6 +9,7 @@ import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
 import {
   type ClaudeJsonMcpServerEntry,
   loadUserClaudeJsonMcpServerEntries,
+  sanitizeHeaders,
 } from "@posthog/agent/adapters/claude/session/mcp-config";
 import {
   ROOT_LOGGER,
@@ -39,16 +40,6 @@ function errorMessage(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
 }
 
-function sanitizeStringRecord(
-  value: unknown,
-): Record<string, string> | undefined {
-  if (!value || typeof value !== "object") return undefined;
-  const entries = Object.entries(value as Record<string, unknown>).filter(
-    (entry): entry is [string, string] => typeof entry[1] === "string",
-  );
-  return entries.length > 0 ? Object.fromEntries(entries) : undefined;
-}
-
 /**
  * Desktop-side executor for the cloud MCP relay (docs/cloud-mcp-relay.md).
  *
@@ -120,8 +111,9 @@ export class McpRelayServiceImpl implements McpRelayService {
       return { error: { code: -32000, message: errorMessage(err) } };
     }
 
-    if (payload.id === undefined) {
+    if (payload.id === undefined || payload.id === null) {
       // JSON-RPC notification: fire-and-forget, no response correlation.
+      // Matches the sandbox's own notification check (mcp-relay-server.ts).
       try {
         await connection.transport.send(payload as JSONRPCMessage);
       } catch (err) {
@@ -161,7 +153,7 @@ export class McpRelayServiceImpl implements McpRelayService {
     const type = typeof raw.type === "string" ? raw.type : undefined;
     const url = typeof raw.url === "string" ? raw.url : undefined;
     const command = typeof raw.command === "string" ? raw.command : undefined;
-    const headers = sanitizeStringRecord(raw.headers);
+    const headers = sanitizeHeaders(raw.headers);
 
     if ((type === undefined || type === "stdio") && command) {
       const args = Array.isArray(raw.args)
@@ -170,7 +162,7 @@ export class McpRelayServiceImpl implements McpRelayService {
       return new StdioClientTransport({
         command,
         args,
-        env: { ...getDefaultEnvironment(), ...sanitizeStringRecord(raw.env) },
+        env: { ...getDefaultEnvironment(), ...sanitizeHeaders(raw.env) },
       });
     }
     if (type === "sse" && url) {
@@ -293,7 +285,7 @@ export class McpRelayServiceImpl implements McpRelayService {
       pending.resolve({
         error: {
           code: -32003,
-          message: "Relayed MCP response exceeds 256 KB",
+          message: `Relayed MCP response exceeds ${MAX_RESPONSE_BYTES / 1000} KB`,
         },
       });
       return;