Add SPA session validation and buglist, update migration docs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

node_modules/playwright/lib/mcp/sdk/http.js

@@ -67,11 +67,12 @@ function httpAddressToString(address) {
     resolvedHost = "localhost";
   return `http://${resolvedHost}:${resolvedPort}`;
 }
-async function installHttpTransport(httpServer, serverBackendFactory, allowedHosts) {
+async function installHttpTransport(httpServer, serverBackendFactory, unguessableUrl, allowedHosts) {
   const url = httpAddressToString(httpServer.address());
   const host = new URL(url).host;
   allowedHosts = (allowedHosts || [host]).map((h) => h.toLowerCase());
   const allowAnyHost = allowedHosts.includes("*");
+  const pathPrefix = unguessableUrl ? `/${import_crypto.default.randomUUID()}` : "";
   const sseSessions = /* @__PURE__ */ new Map();
   const streamableSessions = /* @__PURE__ */ new Map();
   httpServer.on("request", async (req, res) => {
@@ -86,7 +87,12 @@ async function installHttpTransport(httpServer, serverBackendFactory, allowedHos
         return res.end("Access is only allowed at " + allowedHosts.join(", "));
       }
     }
-    const url2 = new URL(`http://localhost${req.url}`);
+    if (!req.url?.startsWith(pathPrefix)) {
+      res.statusCode = 404;
+      return res.end("Not found");
+    }
+    const path = req.url?.slice(pathPrefix.length);
+    const url2 = new URL(`http://localhost${path}`);
     if (url2.pathname === "/killkillkill" && req.method === "GET") {
       res.statusCode = 200;
       res.end("Killing process");
@@ -98,6 +104,7 @@ async function installHttpTransport(httpServer, serverBackendFactory, allowedHos
     else
       await handleStreamable(serverBackendFactory, req, res, streamableSessions);
   });
+  return `${url}${pathPrefix}`;
 }
 async function handleSSE(serverBackendFactory, req, res, url, sessions) {
   if (req.method === "POST") {