chore(deps): bump ahp from 0.1.0 to 0.3.0 in /cli

[dependabot]

Bumps ahp from 0.1.0 to 0.3.0.

Release notes

Sourced from ahp's releases.

AHP Spec v0.3.0

[0.3.0] — 2026-06-05

Spec version: 0.3.0

Added

• McpServerCustomization now models MCP servers as first-class session customizations: enabled, state (a discriminated McpServerState union covering starting, ready, authRequired, error, stopped), an optional channel URI for an mcp:// side-channel into the upstream server, and an optional mcpApp block carrying AhpMcpUiHostCapabilities so clients can render MCP Apps.
• McpServerAuthRequiredState carries ProtectedResourceMetadata plus reason / requiredScopes / description, letting clients drive the existing authenticate command for per-MCP-server auth challenges.
• Customization now includes McpServerCustomization at the top level (hosts MAY surface globally-configured MCP servers directly rather than only inside a plugin or directory). MCP servers remain valid as children of a container.
• New session/mcpServerStateChanged action — narrow upsert of state + channel on an existing McpServerCustomization by id, intended for the high-frequency starting/ready/authRequired transitions. Other customization fields stay in session/customizationUpdated territory.
• InitializeParams.capabilities — optional client-capability bag declared during the handshake. First entry is mcpApps?: {}; hosts SHOULD only populate McpServerCustomization.mcpApp / channel for clients that declared it.
• New guide page docs/guide/mcp.md (with an MCP Apps subsection) and new spec page docs/specification/mcp-channel.md.
• Added changeKind to Changeset (well-known values: 'session', 'branch', 'uncommitted', 'turn', 'compare-turns') so clients can group, sort, or pick an icon without parsing uriTemplate.
• Added status and error to ChangesetOperation and a new changeset/operationStatusChanged action so servers can reflect an operation's execution lifecycle (idle → running → error) back into changeset state.

Changed

• Replaced ToolCallBase.toolClientId?: string with a discriminated ToolCallBase.contributor?: ToolCallContributor union (ToolCallClientContributor / ToolCallMcpContributor) so MCP-served tool calls can be attributed back to their originating McpServerCustomization. session/toolCallStart carries the new contributor? field in place of toolClientId?.

• Added optional _meta provider metadata to AgentCustomization.

... (truncated)

Changelog

Sourced from ahp's changelog.

[0.3.0] — 2026-06-05

Spec version: 0.3.0

Added

• McpServerCustomization now models MCP servers as first-class session customizations: enabled, state (a discriminated McpServerState union covering starting, ready, authRequired, error, stopped), an optional channel URI for an mcp:// side-channel into the upstream server, and an optional mcpApp block carrying AhpMcpUiHostCapabilities so clients can render MCP Apps.
• McpServerAuthRequiredState carries ProtectedResourceMetadata plus reason / requiredScopes / description, letting clients drive the existing authenticate command for per-MCP-server auth challenges.
• Customization now includes McpServerCustomization at the top level (hosts MAY surface globally-configured MCP servers directly rather than only inside a plugin or directory). MCP servers remain valid as children of a container.
• New session/mcpServerStateChanged action — narrow upsert of state + channel on an existing McpServerCustomization by id, intended for the high-frequency starting/ready/authRequired transitions. Other customization fields stay in session/customizationUpdated territory.
• InitializeParams.capabilities — optional client-capability bag declared during the handshake. First entry is mcpApps?: {}; hosts SHOULD only populate McpServerCustomization.mcpApp / channel for clients that declared it.
• New guide page docs/guide/mcp.md (with an MCP Apps subsection) and new spec page docs/specification/mcp-channel.md.
• Added changeKind to Changeset (well-known values: 'session', 'branch', 'uncommitted', 'turn', 'compare-turns') so clients can group, sort, or pick an icon without parsing uriTemplate.
• Added status and error to ChangesetOperation and a new changeset/operationStatusChanged action so servers can reflect an operation's execution lifecycle (idle → running → error) back into changeset state.

Changed

• Replaced ToolCallBase.toolClientId?: string with a discriminated ToolCallBase.contributor?: ToolCallContributor union (ToolCallClientContributor / ToolCallMcpContributor) so MCP-served tool calls can be attributed back to their originating McpServerCustomization. session/toolCallStart carries the new contributor? field in place of toolClientId?.

• Added optional _meta provider metadata to AgentCustomization.

• Added optional changes field of type ChangesSummary to SessionSummary,

... (truncated)

Commits

• b639a27 release: AHP 0.3.0 across all clients
• 185675f Merge pull request #196 from microsoft/dependabot/npm_and_yarn/plugins/copilo...
• f5b8826 build(deps): bump hono in /plugins/copilot-plugin/mcp-server
• 0ce713b Merge pull request #188 from microsoft/connor4312/mcp-2
• 6e9cbcc Merge remote-tracking branch 'origin/main' into connor4312/mcp-2
• ee30b2d Merge pull request #194 from microsoft/agents/let-s-add-changekind-string-to-...
• 553f2ce docs(changeset): rename turn-compare to compare-turns
• 2084e4b test(changeset): add changeKind to changesetsChanged fixtures
• 48ed260 feat(changeset): add required changeKind field to Changeset
• 1972e91 Merge pull request #193 from microsoft/agents/let-s-remove-the-changesets-fro...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)