Fix audit findings (non-docs): wire format, spec-conformance, bugs, security

recipes/_common/RecipeHarness.fs

@@ -44,7 +44,7 @@ let connectWithOptions
                 Features = features
                 BearerVerifier = DevModeBearerVerifier() :> IBearerVerifier }
             |> configureOptions
-        let server = ArcpServer(options)
+        let server = new ArcpServer(options)
         configureServer server
         let clientTransport, serverTransport = MemoryTransport.CreatePair()
         let serverTask = server.HandleSessionAsync(serverTransport, cts.Token)

samples/AspNetCore/Program.fs

@@ -15,7 +15,7 @@ let main argv =
     let builder = WebApplication.CreateBuilder(argv)
 
     let server =
-        ArcpServer(
+        new ArcpServer(
             { ArcpServerOptions.defaults with
                 Features = Features.All
             }

samples/CustomAuth/Program.fs

@@ -29,7 +29,7 @@ let main _argv =
             let cts = new System.Threading.CancellationTokenSource()
 
             let server =
-                ArcpServer(
+                new ArcpServer(
                     { ArcpServerOptions.defaults with
                         BearerVerifier = FixedBearerVerifier "secret" :> IBearerVerifier
                         Features = Features.All

samples/Giraffe/Program.fs

@@ -15,7 +15,7 @@ let main argv =
     let builder = WebApplication.CreateBuilder(argv)
 
     let server =
-        ArcpServer(
+        new ArcpServer(
             { ArcpServerOptions.defaults with
                 Features = Features.All
             }

samples/LiteLLM/Program.fs

@@ -89,7 +89,7 @@ type LiteLLMProvisioner(baseUrl: Uri, adminKey: string, http: HttpClient) =
             task {
                 let body = {| key = credentialId |} :> obj
                 let! _ = postJsonAsync "/key/delete" body ct
-                return true
+                return RevocationOutcome.Revoked
             }
 
 [<EntryPoint>]

samples/ProvisionedCredentials/Program.fs

@@ -31,7 +31,7 @@ type StaticProvisioner(revoked: HashSet<string>) =
 
         member _.RevokeAsync(credentialId, _ct) =
             lock revoked (fun () -> revoked.Add credentialId |> ignore)
-            Task.FromResult true
+            Task.FromResult RevocationOutcome.Revoked
 
 [<EntryPoint>]
 let main _argv =

samples/Stdio/Program.fs

@@ -12,7 +12,7 @@ open ARCP.Runtime
 [<EntryPoint>]
 let main _argv =
     let server =
-        ArcpServer(
+        new ArcpServer(
             { ArcpServerOptions.defaults with
                 Features = Features.All
                 AllowAnonymousAuth = true

samples/_common/SampleHarness.fs

@@ -42,7 +42,7 @@ let private makeServerWithOptions
         }
         |> configureOptions
 
-    let server = ArcpServer(options)
+    let server = new ArcpServer(options)
     configure server
     server
 

src/Arcp.Cli/Program.fs

@@ -65,7 +65,7 @@ let private serveStdio (token: string option) : Task<int> =
                 AllowAnonymousAuth = Option.isNone token
             }
 
-        let server = ArcpServer(options)
+        let server = new ArcpServer(options)
         server.RegisterAgent("echo", fun ctx -> task { return Json.serializeToElement<string> "echo" })
         let transport = StdioTransport.fromConsole ()
         errorLine "serve --stdio: ready"
@@ -88,7 +88,11 @@ let private streamEventsAsync (handle: JobHandle) : Task =
                 else
                     writeLine (sprintf "event: %s" (JobEventBody.kind enumerator.Current))
         finally
-            ignore (enumerator.DisposeAsync().AsTask())
+            ()
+
+        // §38: await disposal so teardown errors surface and complete
+        // before this function returns.
+        do! enumerator.DisposeAsync()
     }
     :> Task
 
@@ -162,7 +166,12 @@ let main argv =
                         let env = Environment.GetEnvironmentVariable "ARCP_TOKEN"
                         if String.IsNullOrEmpty env then None else Some env)
 
-                (serveStdio token).GetAwaiter().GetResult()
+                // §39: honor the --stdio flag instead of ignoring it.
+                if sub.Contains ServeArgs.Stdio then
+                    (serveStdio token).GetAwaiter().GetResult()
+                else
+                    errorLine "serve requires a transport flag; only --stdio is currently supported (pass --stdio)"
+                    2
             | Send sub :: _ ->
                 let url = sub.GetResult SendArgs.Url