@ai-ecoverse/mcpcat 0.20.2 → 0.20.4

package/dist/host/mcpcat.mjs

@@ -7691,7 +7691,7 @@ async function consumeSseStream(stream, options) {
   let dataLines = [];
   let dataBytes = 0;
   const maxEventBytes = options.maxEventBytes ?? DEFAULT_MAX_MESSAGE_BYTES;
-  const dispatch = () => {
+  const dispatch2 = () => {
     if (dataLines.length === 0) {
       eventName = void 0;
       eventId = void 0;
@@ -7707,7 +7707,7 @@ async function consumeSseStream(stream, options) {
   const processLine = (rawLine) => {
     const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
     if (line === "") {
-      dispatch();
+      dispatch2();
       return;
     }
     if (line.startsWith(":"))
@@ -7748,7 +7748,7 @@ async function consumeSseStream(stream, options) {
     buffered += decoder3.decode();
     if (buffered)
       processLine(buffered);
-    dispatch();
+    dispatch2();
   } finally {
     reader.releaseLock();
   }
@@ -8352,18 +8352,118 @@ var PlatformStdioTransport = class {
   }
 };
 
+// src/client/modern.ts
+var MODERN_PROTOCOL_VERSION = "2026-07-28";
+var META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion";
+var META_CLIENT_INFO = "io.modelcontextprotocol/clientInfo";
+var META_CLIENT_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
+var META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
+var HEADER_MISMATCH = -32020;
+var MISSING_REQUIRED_CLIENT_CAPABILITY = -32021;
+var UNSUPPORTED_PROTOCOL_VERSION = -32022;
+var MODERN_ERROR_CODES = /* @__PURE__ */ new Set([
+  HEADER_MISMATCH,
+  MISSING_REQUIRED_CLIENT_CAPABILITY,
+  UNSUPPORTED_PROTOCOL_VERSION
+]);
+function isModernErrorCode(code2) {
+  return MODERN_ERROR_CODES.has(code2);
+}
+function modernRequestMeta(protocolVersion, clientInfo) {
+  return {
+    [META_PROTOCOL_VERSION]: protocolVersion,
+    [META_CLIENT_INFO]: clientInfo,
+    [META_CLIENT_CAPABILITIES]: {}
+  };
+}
+function modernRequestParams(params, protocolVersion, clientInfo) {
+  const { _inputResponses, ...rest } = params;
+  const out = { ...rest };
+  if (_inputResponses) out.inputResponses = _inputResponses;
+  out._meta = modernRequestMeta(protocolVersion, clientInfo);
+  return out;
+}
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Utf8(value) {
+  const bytes = new TextEncoder().encode(value);
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const a = bytes[i];
+    const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const n = a << 16 | b << 8 | c;
+    out += B64[n >> 18 & 63] + B64[n >> 12 & 63];
+    out += i + 1 < bytes.length ? B64[n >> 6 & 63] : "=";
+    out += i + 2 < bytes.length ? B64[n & 63] : "=";
+  }
+  return out;
+}
+function encodeHeaderValue(value) {
+  const safe = /^[\x20-\x7e\t]*$/.test(value) && value.trim() === value && !(value.startsWith("=?base64?") && value.endsWith("?="));
+  return safe ? value : `=?base64?${base64Utf8(value)}?=`;
+}
+function isModernRequest(params) {
+  if (!params || typeof params !== "object") return false;
+  const meta = Object.getOwnPropertyDescriptor(params, "_meta")?.value;
+  if (!meta || typeof meta !== "object") return false;
+  return typeof Object.getOwnPropertyDescriptor(meta, META_PROTOCOL_VERSION)?.value === "string";
+}
+function completeModernOutcome(outcome, params) {
+  if (outcome.status !== 200 || !isModernRequest(params)) return outcome;
+  const frame = JSON.parse(outcome.body);
+  const result = frame.result;
+  if (!result || typeof result !== "object" || Array.isArray(result)) return outcome;
+  if (Object.hasOwn(result, "resultType")) return outcome;
+  frame.result = { resultType: "complete", ...result };
+  return { ...outcome, body: JSON.stringify(frame) };
+}
+function modernDiscoverResult(supportedVersions, capabilities, serverInfo, instructions) {
+  return {
+    resultType: "complete",
+    supportedVersions,
+    capabilities,
+    serverInfo,
+    ...instructions ? { instructions } : {},
+    _meta: { [META_SERVER_INFO]: serverInfo }
+  };
+}
+
 // src/client/stateless-connection.ts
-var STATELESS_PROTOCOL_VERSION = "2026-07-28";
+var STATELESS_PROTOCOL_VERSION = MODERN_PROTOCOL_VERSION;
 var StatelessRpcError = class extends Error {
   code;
   data;
-  constructor(code2, message, data) {
+  httpStatus;
+  constructor(code2, message, data, httpStatus) {
     super(`MCP RPC error ${code2}: ${message}`);
     this.name = "StatelessRpcError";
     this.code = code2;
     this.data = data;
+    this.httpStatus = httpStatus;
+  }
+};
+var UnsupportedModernVersionError = class extends Error {
+  constructor(version, supported) {
+    super(`Server does not support ${version} (advertised: ${supported.join(", ") || "none"})`);
+    this.name = "UnsupportedModernVersionError";
   }
 };
+function supportedList(data) {
+  const list = data?.supported;
+  return Array.isArray(list) ? list.filter((v) => typeof v === "string") : void 0;
+}
+function indicatesLegacyServer(err, http) {
+  if (err instanceof UnsupportedModernVersionError) return true;
+  if (http && err instanceof StatelessHttpError) return err.status >= 400 && err.status < 500;
+  if (!(err instanceof StatelessRpcError)) return false;
+  if (err.code === UNSUPPORTED_PROTOCOL_VERSION) {
+    const supported = supportedList(err.data);
+    return !!supported && !supported.includes(STATELESS_PROTOCOL_VERSION);
+  }
+  if (isModernErrorCode(err.code)) return false;
+  if (!http || err.code === -32601) return true;
+  return err.httpStatus !== void 0 && err.httpStatus >= 400 && err.httpStatus < 500;
+}
 var StatelessHttpError = class extends Error {
   status;
   constructor(status, statusText, method, snippet) {
@@ -8475,18 +8575,34 @@ function logHeaders(verbose, dir, entries) {
     else verbose.headerIn(k, v);
   }
 }
+function discoverServerInfo(discoverResult2) {
+  const meta = discoverResult2?._meta;
+  return meta?.[META_SERVER_INFO] ?? discoverResult2?.serverInfo;
+}
 function buildServerInfo(discoverResult2) {
+  const serverInfo = discoverServerInfo(discoverResult2);
   return {
-    name: discoverResult2?.serverInfo?.name,
-    version: discoverResult2?.serverInfo?.version,
-    title: discoverResult2?.serverInfo?.title,
+    name: serverInfo?.name,
+    version: serverInfo?.version,
+    title: serverInfo?.title,
     protocolVersion: STATELESS_PROTOCOL_VERSION,
     capabilities: discoverResult2?.capabilities ?? {},
     instructions: discoverResult2?.instructions
   };
 }
+function readHiddenTools(result) {
+  const meta = result?._meta;
+  const hidden = meta?.["io.mcpcat/hidden"];
+  const out = {};
+  if (!hidden || typeof hidden !== "object" || Array.isArray(hidden)) return out;
+  for (const [name, why] of Object.entries(hidden)) {
+    if (typeof why === "string") out[name] = why;
+  }
+  return out;
+}
 function buildStatelessMethods(requestFn, discoverResult2) {
   let serverInfoCache;
+  let hidden = {};
   return {
     async info() {
       if (serverInfoCache) return serverInfoCache;
@@ -8494,7 +8610,12 @@ function buildStatelessMethods(requestFn, discoverResult2) {
       return serverInfoCache;
     },
     async listTools() {
-      return (await requestFn("tools/list", {}))?.tools ?? [];
+      const result = await requestFn("tools/list", {});
+      hidden = readHiddenTools(result);
+      return result?.tools ?? [];
+    },
+    hiddenTool(name) {
+      return Object.hasOwn(hidden, name) ? hidden[name] : void 0;
     },
     async callTool(name, args2, _callOptions) {
       const params = {
@@ -8546,17 +8667,17 @@ async function createStatelessConnection(options) {
     redact: redact2 = (text) => text
   } = options;
   let nextId2 = 1;
-  let negotiatedVersion;
+  const protocolVersion = STATELESS_PROTOCOL_VERSION;
   function buildHeaders(method, params, token) {
     const h = {
       "Content-Type": "application/json",
       Accept: "application/json, text/event-stream",
+      "MCP-Protocol-Version": protocolVersion,
       "Mcp-Method": method,
       ...extraHeaders
     };
     const n = mcpNameForMethod(method, params);
-    if (n) h["Mcp-Name"] = n;
-    if (negotiatedVersion) h["Mcp-Protocol-Version"] = negotiatedVersion;
+    if (n) h["Mcp-Name"] = encodeHeaderValue(n);
     if (token) h["Authorization"] = `Bearer ${token}`;
     return h;
   }
@@ -8576,7 +8697,7 @@ async function createStatelessConnection(options) {
       if (p.error && typeof p.error.code === "number") rpc = p.error;
     } catch {
     }
-    if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data);
+    if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data, res.status);
     throw new StatelessHttpError(res.status, res.statusText, method, redact2(text).slice(0, 512));
   }
   async function doFetch(method, params, body) {
@@ -8619,7 +8740,12 @@ async function createStatelessConnection(options) {
     }
     if (verbose?.enabled) verbose.response(JSON.stringify(frame));
     if (frame.error) {
-      throw new StatelessRpcError(frame.error.code, frame.error.message, frame.error.data);
+      throw new StatelessRpcError(
+        frame.error.code,
+        frame.error.message,
+        frame.error.data,
+        res.status
+      );
     }
     return frame.result;
   }
@@ -8638,23 +8764,10 @@ async function createStatelessConnection(options) {
     }
   }
   async function request(method, params) {
-    const id = nextId2++;
-    const meta = {
-      protocolVersion: negotiatedVersion ?? STATELESS_PROTOCOL_VERSION,
-      clientInfo
-    };
-    const cleanParams = { ...params };
-    if (cleanParams._inputResponses) {
-      meta.inputResponses = cleanParams._inputResponses;
-      delete cleanParams._inputResponses;
-    }
-    const body = JSON.stringify({
-      jsonrpc: "2.0",
-      id,
-      method,
-      params: { ...cleanParams, _meta: meta }
-    });
+    const wireParams = modernRequestParams(params, protocolVersion, clientInfo);
     for (let attempt = 0; attempt < 2; attempt++) {
+      const id = nextId2++;
+      const body = JSON.stringify({ jsonrpc: "2.0", id, method, params: wireParams });
       const { res, token, detach } = await doFetch(method, params, body);
       let retry;
       try {
@@ -8674,16 +8787,11 @@ async function createStatelessConnection(options) {
     }
     throw new McpAuthError(401, url);
   }
-  const discoverResult2 = await request("server/discover", {
-    protocolVersion: STATELESS_PROTOCOL_VERSION
-  });
+  const discoverResult2 = await request("server/discover", {});
   const supported = discoverResult2?.supportedVersions?.filter((v) => typeof v === "string") ?? [];
   if (!supported.includes(STATELESS_PROTOCOL_VERSION)) {
-    throw new Error(
-      `Server does not support ${STATELESS_PROTOCOL_VERSION} (advertised: ${supported.join(", ") || "none"})`
-    );
+    throw new UnsupportedModernVersionError(STATELESS_PROTOCOL_VERSION, supported);
   }
-  negotiatedVersion = STATELESS_PROTOCOL_VERSION;
   const extra = buildStatelessMethods(request, discoverResult2);
   return {
     ...extra,
@@ -8830,14 +8938,13 @@ async function createPiConnection(options) {
 }
 
 // src/client/stdio-stateless.ts
-var PROTOCOL_VERSION = "2026-07-28";
+var PROTOCOL_VERSION = MODERN_PROTOCOL_VERSION;
 function createStdioJsonRpc(proc, platform2, options) {
   const encoder2 = new TextEncoder();
   const decoder3 = new TextDecoder();
   let nextId2 = 1;
   let readBuffer = "";
   const reader = proc.stdout.getReader();
-  let negotiatedVersion;
   const { version = "0.0.0", timeoutMs = 6e4, signal: externalSignal, verbose } = options;
   async function readLine2() {
     while (true) {
@@ -8877,20 +8984,11 @@ function createStdioJsonRpc(proc, platform2, options) {
   }
   async function request(method, params) {
     const id = nextId2++;
-    const meta = {
-      protocolVersion: negotiatedVersion ?? PROTOCOL_VERSION,
-      clientInfo: { name: "mcpcat", version }
-    };
-    const cleanParams = { ...params };
-    if (cleanParams._inputResponses) {
-      meta.inputResponses = cleanParams._inputResponses;
-      delete cleanParams._inputResponses;
-    }
     const body = JSON.stringify({
       jsonrpc: "2.0",
       id,
       method,
-      params: { ...cleanParams, _meta: meta }
+      params: modernRequestParams(params, PROTOCOL_VERSION, { name: "mcpcat", version })
     });
     if (verbose?.enabled) verbose.request(method, body);
     await send(body);
@@ -8924,22 +9022,29 @@ function createStdioJsonRpc(proc, platform2, options) {
   };
 }
 function buildServerInfo2(discoverResult2) {
+  const serverInfo = discoverServerInfo(discoverResult2);
   return {
-    name: discoverResult2?.serverInfo?.name,
-    version: discoverResult2?.serverInfo?.version,
-    title: discoverResult2?.serverInfo?.title,
+    name: serverInfo?.name,
+    version: serverInfo?.version,
+    title: serverInfo?.title,
     protocolVersion: PROTOCOL_VERSION,
     capabilities: discoverResult2?.capabilities ?? {},
     instructions: discoverResult2?.instructions
   };
 }
 function buildConnectionMethods(rpc, discoverResult2, proc) {
+  let hidden = {};
   return {
     async info() {
       return buildServerInfo2(discoverResult2);
     },
     async listTools() {
-      return (await rpc.request("tools/list", {}))?.tools ?? [];
+      const result = await rpc.request("tools/list", {});
+      hidden = readHiddenTools(result);
+      return result?.tools ?? [];
+    },
+    hiddenTool(name) {
+      return Object.hasOwn(hidden, name) ? hidden[name] : void 0;
     },
     async callTool(name, args2, callOptions) {
       const params = { name, arguments: args2 ?? {} };
@@ -8995,25 +9100,27 @@ async function probeStdioStateless(options) {
   });
   let discoverRaw;
   try {
-    discoverRaw = await rpc.request("server/discover", {
-      protocolVersion: PROTOCOL_VERSION
-    });
+    discoverRaw = await rpc.request("server/discover", {});
   } catch (err) {
     const pending = rpc.pendingBuffer();
     rpc.close();
     return { proc, pendingStdout: pending, error: err };
   }
-  void readStderr(proc, options.verbose);
   const discoverResult2 = discoverRaw;
-  const supported = (discoverResult2?.supportedVersions ?? []).filter(
+  const advertised = discoverResult2?.supportedVersions;
+  const supported = (Array.isArray(advertised) ? advertised : []).filter(
     (v) => typeof v === "string"
   );
   if (!supported.includes(PROTOCOL_VERSION)) {
-    await proc.kill("SIGTERM");
-    throw new Error(
-      `Server does not support ${PROTOCOL_VERSION} (advertised: ${supported.join(", ") || "none"})`
-    );
+    const pending = rpc.pendingBuffer();
+    rpc.close();
+    return {
+      proc,
+      pendingStdout: pending,
+      error: new UnsupportedModernVersionError(PROTOCOL_VERSION, supported)
+    };
   }
+  void readStderr(proc, options.verbose);
   return buildConnectionMethods(rpc, discoverResult2, proc);
 }
 async function readStderr(proc, verbose) {
@@ -9057,16 +9164,7 @@ async function connect(platform2, options) {
         verbose: options.verbose
       });
       if (!("proc" in result)) return result;
-      const isMethodNotFound = result.error instanceof StatelessRpcError && result.error.code === -32601;
-      const isUnsupported = result.error.message.includes("does not support");
-      if (options.protocolVersion?.startsWith("2026")) {
-        try {
-          await result.proc.kill("SIGTERM");
-        } catch {
-        }
-        throw result.error;
-      }
-      if (!isMethodNotFound && !isUnsupported) {
+      if (options.protocolVersion?.startsWith("2026") || !indicatesLegacyServer(result.error, false)) {
         try {
           await result.proc.kill("SIGTERM");
         } catch {
@@ -9109,12 +9207,11 @@ async function connect(platform2, options) {
       redact: options.redact
     });
   } catch (err) {
-    const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
     if (options.protocolVersion?.startsWith("2026")) throw err;
     if (err instanceof McpAuthError || err instanceof AuthStepUpError) throw err;
     if (err instanceof TransportRefusalError) throw err;
     if (err.name === "McpOAuthAuthorizationRequiredError") throw err;
-    if (isMethodNotFound) {
+    if (indicatesLegacyServer(err, true)) {
       return createPiConnection({
         url: options.url,
         headers: options.headers,
@@ -9141,7 +9238,7 @@ function readLine(platform2) {
   return new Promise((resolve, reject) => {
     const reader = platform2.stdin.getReader();
     const chunks = [];
-    function pump() {
+    function pump2() {
       reader.read().then(({ done, value }) => {
         if (done) {
           reader.releaseLock();
@@ -9155,10 +9252,10 @@ function readLine(platform2) {
           resolve(text.split("\n")[0]);
           return;
         }
-        pump();
+        pump2();
       }, reject);
     }
-    pump();
+    pump2();
   });
 }
 function concatChunks(chunks) {
@@ -10865,11 +10962,21 @@ async function probeLinkHeaders(fetcher, targetUrl, origin, page, userUrlIsPriva
   }
   return events;
 }
+function sseResponse(text, id) {
+  for (const block of text.replace(/\r\n?/g, "\n").split("\n\n")) {
+    const data = block.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).replace(/^ /, "")).join("\n");
+    const parsed = tryParseJson(data);
+    if (isRecord4(parsed) && parsed.id === id) return parsed;
+  }
+  return void 0;
+}
 function mcpJsonRpc(method, params, id = 1) {
   return JSON.stringify({ jsonrpc: "2.0", id, method, params });
 }
 function parseServerInfo(result) {
-  const si = isRecord4(result.serverInfo) ? result.serverInfo : void 0;
+  const meta = isRecord4(result._meta) ? result._meta : void 0;
+  const fromMeta = meta && isRecord4(meta[META_SERVER_INFO]) ? meta[META_SERVER_INFO] : void 0;
+  const si = fromMeta ?? (isRecord4(result.serverInfo) ? result.serverInfo : void 0);
   if (!si) return void 0;
   return {
     name: typeof si.name === "string" ? si.name : void 0,
@@ -10885,7 +10992,7 @@ function checkAuthResponse(resp) {
 async function tryMcpPost(fetcher, url, body, extraHeaders) {
   const headers = {
     "Content-Type": "application/json",
-    Accept: "application/json",
+    Accept: "application/json, text/event-stream",
     ...extraHeaders
   };
   try {
@@ -10900,7 +11007,8 @@ async function tryMcpPost(fetcher, url, body, extraHeaders) {
     if (authSignal) return { url, trust: [authSignal] };
     if (resp.status === 200) {
       const text = await resp.text();
-      const parsed = tryParseJson(text);
+      const sse = (resp.headers.get("content-type") ?? "").includes("text/event-stream");
+      const parsed = sse ? sseResponse(text, tryParseJson(body)?.id) : tryParseJson(text);
       if (isRecord4(parsed) && isRecord4(parsed.result)) {
         return { url, serverInfo: parseServerInfo(parsed.result), trust: [] };
       }
@@ -10911,18 +11019,22 @@ async function tryMcpPost(fetcher, url, body, extraHeaders) {
 }
 async function probeMcpEndpoint(fetcher, url) {
   const discoverBody = mcpJsonRpc("server/discover", {
-    protocolVersion: "2026-07-28",
-    clientInfo: { name: "mcpcat", version: "0.0.0" }
+    _meta: modernRequestMeta(MODERN_PROTOCOL_VERSION, { name: "mcpcat", version: "0.0.0" })
   });
   const hit = await tryMcpPost(fetcher, url, discoverBody, {
+    "MCP-Protocol-Version": MODERN_PROTOCOL_VERSION,
     "Mcp-Method": "server/discover"
   });
   if (hit) return hit;
-  const initBody = mcpJsonRpc("initialize", {
-    protocolVersion: "2025-11-25",
-    clientInfo: { name: "mcpcat", version: "0.0.0" },
-    capabilities: {}
-  });
+  const initBody = mcpJsonRpc(
+    "initialize",
+    {
+      protocolVersion: "2025-11-25",
+      clientInfo: { name: "mcpcat", version: "0.0.0" },
+      capabilities: {}
+    },
+    2
+  );
   return tryMcpPost(fetcher, url, initBody);
 }
 async function probeMcp(fetcher, origin, page, targetUrl) {
@@ -12037,7 +12149,7 @@ async function writeResponse(writer, response) {
 var PROTOCOL_VERSIONS = ["2026-07-28", "2025-11-25", "2025-06-18"];
 var OUTPUT_CAP = 1048576;
 var JSON_CT = "application/json; charset=utf-8";
-async function handleJsonRpc(raw, tools, call, serverName, serverVersion) {
+async function handleJsonRpc(raw, source, call, serverName, serverVersion) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -12051,19 +12163,35 @@ async function handleJsonRpc(raw, tools, call, serverName, serverVersion) {
   if (!hasOwn(parsed, "id")) return { status: 202, contentType: "text/plain", body: "" };
   const id = readId(parsed);
   const params = Object.getOwnPropertyDescriptor(parsed, "params")?.value;
+  return completeModernOutcome(
+    await dispatch(id, method, params, source, call, serverName, serverVersion),
+    params
+  );
+}
+async function dispatch(id, method, params, source, call, serverName, serverVersion) {
   if (method === "initialize")
     return rpcOk(id, initializeResult(params, serverName, serverVersion));
   if (method === "server/discover") return rpcOk(id, discoverResult(serverName, serverVersion));
-  if (method === "tools/list") return rpcOk(id, { tools });
   if (method === "ping") return rpcOk(id, {});
-  if (method === "tools/call") return toolCall(id, params, tools, call);
+  if (method === "tools/list" || method === "tools/call") {
+    const listing = Array.isArray(source) ? { tools: source } : await source();
+    if (listing.error) return rpcError(id, -32e3, listing.error);
+    if (method === "tools/call") return toolCall(id, params, listing, call);
+    const hidden = listing.hidden && Object.keys(listing.hidden).length > 0 ? listing.hidden : null;
+    return rpcOk(id, {
+      tools: listing.tools,
+      ...hidden ? { _meta: { "io.mcpcat/hidden": hidden } } : {}
+    });
+  }
   return rpcError(id, -32601, `Method not found: ${method}`);
 }
-async function toolCall(id, params, tools, call) {
+async function toolCall(id, params, { tools, hidden }, call) {
   const name = params && typeof params === "object" ? readString(params, "name") : void 0;
   if (!name) return rpcError(id, -32602, "tools/call requires a name");
-  if (!tools.some((tool) => tool.name === name))
-    return rpcError(id, -32602, `Unknown tool: ${name}`);
+  if (!tools.some((tool) => tool.name === name)) {
+    const why = hidden && Object.hasOwn(hidden, name) ? hidden[name] : void 0;
+    return rpcError(id, -32602, why ? `Unknown tool: ${name}: ${why}` : `Unknown tool: ${name}`);
+  }
   const args2 = params && typeof params === "object" ? Object.getOwnPropertyDescriptor(params, "arguments")?.value : void 0;
   try {
     const result = await call(name, args2);
@@ -12095,12 +12223,11 @@ function initializeResult(params, serverName, serverVersion) {
   };
 }
 function discoverResult(serverName, serverVersion) {
-  return {
-    protocolVersion: PROTOCOL_VERSIONS[0],
-    supportedVersions: PROTOCOL_VERSIONS,
-    capabilities: { tools: { listChanged: false } },
-    serverInfo: { name: serverName, version: serverVersion }
-  };
+  return modernDiscoverResult(
+    PROTOCOL_VERSIONS,
+    { tools: { listChanged: false } },
+    { name: serverName, version: serverVersion }
+  );
 }
 function cap(value) {
   if (value.length <= OUTPUT_CAP) return value;
@@ -12236,15 +12363,18 @@ function translateCapabilities(info) {
   if (info.capabilities.prompts) caps.prompts = { listChanged: false };
   return caps;
 }
+function proxyServerInfo(info) {
+  return {
+    name: info.name ?? "mcpcat-proxy",
+    version: info.version ?? "0.0.0",
+    ...info.title ? { title: info.title } : {}
+  };
+}
 function buildServerResult(info, protocolVersion) {
   return {
     protocolVersion,
     capabilities: translateCapabilities(info),
-    serverInfo: {
-      name: info.name ?? "mcpcat-proxy",
-      version: info.version ?? "0.0.0",
-      ...info.title ? { title: info.title } : {}
-    },
+    serverInfo: proxyServerInfo(info),
     ...info.instructions ? { instructions: info.instructions } : {}
   };
 }
@@ -12292,10 +12422,16 @@ function createProxyHandler(options) {
     return scrubOk(id, buildServerResult(cachedInfo, pv));
   }
   function handleDiscover(id) {
-    return scrubOk(id, {
-      ...buildServerResult(cachedInfo, PROTOCOL_VERSIONS2[0]),
-      supportedVersions: PROTOCOL_VERSIONS2
-    });
+    const info = cachedInfo;
+    return scrubOk(
+      id,
+      modernDiscoverResult(
+        PROTOCOL_VERSIONS2,
+        translateCapabilities(info),
+        proxyServerInfo(info),
+        info.instructions
+      )
+    );
   }
   async function forwardWithRetry(method, doForward, id) {
     try {
@@ -12322,7 +12458,7 @@ function createProxyHandler(options) {
       return scrubErr(id, -32e3, err.message);
     }
   }
-  async function dispatch(method, id, params) {
+  async function dispatch2(method, id, params) {
     try {
       await getConnection();
     } catch (err) {
@@ -12359,7 +12495,7 @@ function createProxyHandler(options) {
     if (!hasOwn2(parsed, "id")) return { status: 202, contentType: "text/plain", body: "" };
     const id = readId2(parsed);
     const params = Object.getOwnPropertyDescriptor(parsed, "params")?.value;
-    return dispatch(method, id, params);
+    return completeModernOutcome(await dispatch2(method, id, params), params);
   }
   async function shutdown() {
     if (conn) {
@@ -12427,7 +12563,149 @@ ${tail}`,
     }
   };
 }
-async function runProcess(platform2, argv, stdin, timeoutMs, limit) {
+var DIALOG_POLL_MS = 250;
+var DIALOG_READY_MS = 1e3;
+var DIALOG_STALL_MS = 1e3;
+function watchLoop(watch) {
+  let timer;
+  const result = new Promise((resolve) => {
+    timer = setInterval(() => {
+      const found = watch();
+      if (found) {
+        clearInterval(timer);
+        resolve(found);
+      }
+    }, DIALOG_POLL_MS);
+  });
+  return {
+    result,
+    stop() {
+      clearInterval(timer);
+    }
+  };
+}
+async function browserSocketUrl(platform2, cdp) {
+  if (/^wss?:\/\//i.test(cdp)) return cdp;
+  if (!/^https?:\/\//i.test(cdp)) return void 0;
+  const res = await platform2.fetch(`${cdp.replace(/\/+$/, "")}/json/version`, {
+    signal: AbortSignal.timeout(DIALOG_READY_MS)
+  });
+  const body = await res.json();
+  return typeof body.webSocketDebuggerUrl === "string" ? body.webSocketDebuggerUrl : void 0;
+}
+function parseCdp(data) {
+  try {
+    return JSON.parse(
+      typeof data === "string" ? data : new TextDecoder().decode(data)
+    );
+  } catch {
+    return void 0;
+  }
+}
+function applyCdp(state, channel, send, msg, settle) {
+  if (msg.method === "Page.javascriptDialogOpening") {
+    state.open = typeof msg.params?.type === "string" ? msg.params.type : "dialog";
+  } else if (msg.method === "Page.javascriptDialogClosed") {
+    state.open = void 0;
+  } else if (msg.method === "Target.detachedFromTarget") {
+    channel.close();
+  } else if (msg.id === 1) {
+    const sessionId = msg.result?.sessionId;
+    if (typeof sessionId !== "string") {
+      channel.close();
+      return;
+    }
+    state.enableSentAt = Date.now();
+    send({ id: 2, sessionId, method: "Page.enable" });
+  } else if (msg.id === 2) {
+    state.enableSentAt = void 0;
+    settle();
+  }
+}
+async function pump(state, channel, send, settle) {
+  const reader = channel.readable.getReader();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) return;
+      const msg = parseCdp(value);
+      if (msg) applyCdp(state, channel, send, msg, settle);
+    }
+  } catch {
+    return;
+  }
+}
+async function attachSocket(platform2, state, url, targetId) {
+  const channel = await platform2.websocket(url).catch(() => void 0);
+  if (!channel) return;
+  state.channel = channel;
+  const writer = channel.writable.getWriter();
+  const send = (message) => {
+    writer.write(JSON.stringify(message)).catch(() => channel.close());
+  };
+  let settle;
+  const settled = new Promise((resolve) => {
+    settle = resolve;
+  });
+  void pump(state, channel, send, settle).then(() => {
+    if (state.channel === channel) {
+      state.channel = void 0;
+      state.open = void 0;
+      state.enableSentAt = void 0;
+    }
+    channel.close();
+    settle();
+  });
+  send({ id: 1, method: "Target.attachToTarget", params: { targetId, flatten: true } });
+  await settled;
+}
+function watchJsDialogs(platform2, cdp, targetId) {
+  const state = {};
+  let connecting;
+  let closed = false;
+  const connect2 = async () => {
+    if (!platform2.websocket) return;
+    const url = await browserSocketUrl(platform2, cdp).catch(() => void 0);
+    if (!url || closed) return;
+    await attachSocket(platform2, state, url, targetId);
+  };
+  return {
+    async ready() {
+      if (closed || state.channel) return;
+      connecting ??= connect2().finally(() => {
+        connecting = void 0;
+      });
+      let timer;
+      await Promise.race([
+        connecting,
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, DIALOG_READY_MS);
+        })
+      ]);
+      clearTimeout(timer);
+    },
+    dialog: () => state.open,
+    stalled: () => state.enableSentAt !== void 0 && Date.now() - state.enableSentAt >= DIALOG_STALL_MS,
+    close() {
+      closed = true;
+      state.channel?.close();
+    }
+  };
+}
+function dialogMessage(tab, type) {
+  return `tab ${tab} is blocked by a JavaScript ${type.replace(/[^a-z]/gi, "")} dialog; answer or dismiss it in the browser, then retry`;
+}
+function timeoutMessage(verb, timeoutMs, tab, watcher) {
+  const head = `${verb} timed out after ${Math.round(timeoutMs / 1e3)}s`;
+  if (!watcher) {
+    return `${head}; if the page shows a JavaScript dialog (alert, confirm, prompt), answer it, and pass --cdp <url> so mcpcat can detect one`;
+  }
+  if (watcher.stalled()) {
+    return `${head}; tab ${tab} does not answer the DevTools protocol, so a JavaScript dialog opened before mcpcat attached may block it; answer it in the browser, then retry`;
+  }
+  return head;
+}
+async function runProcess(platform2, argv, stdin, timeoutMs, limit, watch) {
   let proc;
   try {
     proc = await platform2.spawn({ argv });
@@ -12471,12 +12749,20 @@ async function runProcess(platform2, argv, stdin, timeoutMs, limit) {
     readStream3(proc.stderr, err),
     proc.wait()
   ]);
-  const result = await Promise.race([work, timer]);
+  const watcher = watch ? watchLoop(watch) : void 0;
+  const blocked = watcher ? watcher.result.then((type) => ({ blocked: type })) : new Promise(() => {
+  });
+  const result = await Promise.race([work, timer, blocked]);
   clearTimeout(timeoutId);
+  watcher?.stop();
   if (result === "timeout") {
     await proc.kill("SIGTERM");
     return { stdout: "", stderr: "timed out", exitCode: 124, cut: false };
   }
+  if (!Array.isArray(result)) {
+    await proc.kill("SIGTERM");
+    return { stdout: "", stderr: "blocked", exitCode: 124, cut: false, blocked: result.blocked };
+  }
   const [, , exitResult] = result;
   const stdout = out.finish();
   const stderr = err.finish();
@@ -12487,7 +12773,7 @@ async function runProcess(platform2, argv, stdin, timeoutMs, limit) {
     cut: stdout.cut
   };
 }
-async function resolveWebMcpTab(platform2, options) {
+async function listTabs(platform2, options) {
   const argv = [options.playwrightCli, "tab-list"];
   if (options.cdp) argv.push("--cdp", options.cdp);
   const result = await runProcess(
@@ -12514,6 +12800,13 @@ async function resolveWebMcpTab(platform2, options) {
   if (new Set(rows.map((r) => r.id)).size !== rows.length || active.length > 1) {
     return { error: "could not read playwright-cli tab-list" };
   }
+  return { rows };
+}
+async function resolveWebMcpTab(platform2, options) {
+  const listed = await listTabs(platform2, options);
+  if ("error" in listed) return listed;
+  const { rows } = listed;
+  const active = rows.filter((r) => r.active);
   if (active.length === 1) return { tab: active[0].id };
   if (rows.length === 1) return { tab: rows[0].id };
   return {
@@ -12576,20 +12869,57 @@ function ambiguityError(name, peers) {
     `tool "${name}" is ambiguous: ${peers.length} tools on the page match it (${origins}), and playwright-cli runs the first tool by name and cannot select one by origin, so mcpcat refuses the call`
   );
 }
+async function blockedNow(watcher, tab) {
+  if (!watcher) return void 0;
+  await watcher.ready();
+  const open2 = watcher.dialog();
+  return open2 ? dialogMessage(tab, open2) : void 0;
+}
+async function tabGone(platform2, options) {
+  const { tab } = options;
+  if (!tab) return void 0;
+  const listed = await listTabs(platform2, options);
+  if ("error" in listed || listed.rows.some((r) => r.id === tab)) return void 0;
+  return `tab ${tab} is gone (the browser restarted or the tab closed); restart mcpcat serve --webmcp, or pass --tab <targetId> (see playwright-cli tab-list)`;
+}
+function hiddenToolMessage(name) {
+  return `tool ${name} exists on the page but is hidden because it is consequential (consequentialHint); restart with mcpcat serve --webmcp --allow-consequential to expose it`;
+}
 function createWebMcpHandler(platform2, options) {
   let cache;
   const baseArgs = buildBaseArgs(options);
   const listLimit = Math.max(options.maxOutput, WEBMCP_LIST_FLOOR);
+  const { cdp, tab } = options;
+  const watcher = cdp && tab ? watchJsDialogs(platform2, cdp, tab) : void 0;
+  const watch = watcher ? () => watcher.dialog() : void 0;
   async function listRaw(fresh = false) {
+    const blocked = await blockedNow(watcher, tab);
+    if (blocked) return { tools: [], error: blocked };
     const now = Date.now();
     if (!fresh && cache && now < cache.expiresAt) {
       return { tools: cache.tools };
     }
     const argv = [options.playwrightCli, "webmcp-list", "--json", ...baseArgs];
-    const result = await runProcess(platform2, argv, void 0, options.callTimeoutMs, listLimit);
+    const result = await runProcess(
+      platform2,
+      argv,
+      void 0,
+      options.callTimeoutMs,
+      listLimit,
+      watch
+    );
     if (result.exitCode === -1) {
       return { tools: [], error: result.stderr, notFound: true };
     }
+    if (result.blocked) {
+      return { tools: [], error: dialogMessage(tab, result.blocked) };
+    }
+    if (result.exitCode === 124) {
+      return {
+        tools: [],
+        error: timeoutMessage("webmcp-list", options.callTimeoutMs, tab, watcher)
+      };
+    }
     if (result.exitCode !== 0) {
       return { tools: [], error: result.stderr || `webmcp-list exited ${result.exitCode}` };
     }
@@ -12605,6 +12935,10 @@ function createWebMcpHandler(platform2, options) {
     if (!Array.isArray(parsed)) {
       return { tools: [], error: "webmcp-list did not return an array" };
     }
+    if (parsed.length === 0) {
+      const gone2 = await tabGone(platform2, options);
+      if (gone2) return { tools: [], error: gone2 };
+    }
     const tools = parsed;
     cache = { tools, expiresAt: now + options.ttlMs };
     return { tools };
@@ -12612,11 +12946,13 @@ function createWebMcpHandler(platform2, options) {
   async function getRpcTools() {
     const { tools, error, notFound } = await listRaw();
     if (notFound) return null;
-    if (error) return [];
+    if (error) return { tools: [], error };
     const rpcTools = [];
+    const hidden = {};
     for (const { name, tool, peers } of exposedTools(tools)) {
       if (peers.length > 1) continue;
       if (tool.annotations?.consequentialHint && !options.allowConsequential) {
+        hidden[name] = hiddenToolMessage(name);
         continue;
       }
       const mapped = mapDescriptionAnnotations(tool.annotations);
@@ -12627,7 +12963,7 @@ function createWebMcpHandler(platform2, options) {
         annotations: mapped
       });
     }
-    return rpcTools;
+    return { tools: rpcTools, hidden };
   }
   async function callTool(name, args2) {
     const { tools, error } = await listRaw(true);
@@ -12652,11 +12988,18 @@ function createWebMcpHandler(platform2, options) {
       argv,
       stdinData,
       options.callTimeoutMs,
-      options.maxOutput
+      options.maxOutput,
+      watch
     );
     if (result.exitCode === -1) {
       throw new Error(result.stderr || "playwright-cli not found");
     }
+    if (result.blocked) {
+      throw new Error(dialogMessage(tab, result.blocked));
+    }
+    if (result.exitCode === 124) {
+      throw new Error(timeoutMessage("webmcp-call", options.callTimeoutMs, tab, watcher));
+    }
     if (result.exitCode === 2) {
       throw new Error(result.stderr || "webmcp-call error");
     }
@@ -12678,7 +13021,10 @@ function createWebMcpHandler(platform2, options) {
   function invalidateCache() {
     cache = void 0;
   }
-  return { getRpcTools, callTool, invalidateCache };
+  function close() {
+    watcher?.close();
+  }
+  return { getRpcTools, callTool, invalidateCache, close };
 }
 
 // src/serve/runtime.ts
@@ -13441,23 +13787,42 @@ async function buildProxyConnectOpts(platform2, options, version) {
   }
   return { connectOpts, hiddenValues };
 }
-function resolvePlaywrightCli(platform2, explicit) {
+async function resolvePlaywrightCli(platform2, explicit) {
   if (explicit) return explicit;
   if (platform2.kind === "kernel") return "playwright-cli";
   const pathEnv = platform2.env.PATH ?? "";
-  const sep = pathEnv.includes(";") ? ";" : ":";
-  for (const dir of pathEnv.split(sep)) {
+  const windows = pathEnv.includes(";");
+  const names = windows ? ["playwright-cli.exe", "playwright-cli.cmd", "playwright-cli"] : ["playwright-cli"];
+  for (const dir of pathEnv.split(windows ? ";" : ":")) {
     if (!dir) continue;
-    return "playwright-cli";
+    for (const name of names) {
+      const candidate = `${dir.replace(/[\\/]+$/, "")}/${name}`;
+      if (await platform2.fs.exists(candidate).catch(() => false)) return "playwright-cli";
+    }
   }
   return void 0;
 }
+async function listenOrReport(platform2, options, label) {
+  try {
+    return await platform2.listen({ host: options.host, port: options.port });
+  } catch (err) {
+    const { code: code2, message } = err;
+    const reason = code2 === "EADDRINUSE" || /EADDRINUSE/.test(String(message)) ? "address already in use" : String(message ?? err);
+    const host = options.host.includes(":") ? `[${options.host}]` : options.host;
+    await platform2.write(
+      2,
+      sanitizeTerminal(`${label}: cannot listen on ${host}:${options.port}: ${reason}
+`)
+    );
+    return 3;
+  }
+}
 async function runWebMcpServe(platform2, options, version, resolvedBearer, generatedBearer) {
-  const cliPath = resolvePlaywrightCli(platform2, options.webmcpPlaywrightCli);
+  const cliPath = await resolvePlaywrightCli(platform2, options.webmcpPlaywrightCli);
   if (!cliPath) {
     await platform2.write(
       2,
-      "mcpcat serve --webmcp: playwright-cli not found. Install it with: curl -fsSL https://get.sliccy.ai/playwright-cli | sh\n"
+      "mcpcat serve --webmcp: playwright-cli not found on PATH. Install it with: curl -fsSL https://get.sliccy.ai/playwright-cli | sh\n"
     );
     return 3;
   }
@@ -13492,6 +13857,20 @@ async function runWebMcpServe(platform2, options, version, resolvedBearer, gener
     callTimeoutMs: options.callTimeout,
     maxOutput: options.maxOutput
   });
+  try {
+    return await serveWebMcpHandler(
+      platform2,
+      options,
+      handler,
+      version,
+      resolvedBearer,
+      generatedBearer
+    );
+  } finally {
+    handler.close();
+  }
+}
+async function serveWebMcpHandler(platform2, options, handler, version, resolvedBearer, generatedBearer) {
   const probe = await handler.getRpcTools();
   if (probe === null) {
     await platform2.write(
@@ -13501,7 +13880,7 @@ async function runWebMcpServe(platform2, options, version, resolvedBearer, gener
     return 3;
   }
   const serverName = "mcpcat-webmcp";
-  const getTools = async () => await handler.getRpcTools() ?? [];
+  const getTools = async () => await handler.getRpcTools() ?? { tools: [] };
   const callTool = (name, args2) => handler.callTool(name, args2);
   if (options.transport === "stdio") {
     return runWebMcpStdio(platform2, getTools, callTool, serverName, version);
@@ -13532,8 +13911,7 @@ async function runWebMcpStdio(platform2, getTools, callTool, serverName, version
         const line = buffer.slice(0, nlIdx).trim();
         buffer = buffer.slice(nlIdx + 1);
         if (!line) continue;
-        const tools = await getTools();
-        const outcome = await handleJsonRpc(line, tools, callTool, serverName, version);
+        const outcome = await handleJsonRpc(line, getTools, callTool, serverName, version);
         if (outcome.status === 202) continue;
         const writer = platform2.stdout.getWriter();
         await writer.write(enc.encode(`${outcome.body}
@@ -13560,7 +13938,8 @@ async function runWebMcpHttp(platform2, options, getTools, callTool, serverName,
     return 2;
   }
   const allowedOrigins = new Set(options.allowOrigins);
-  const listener = await platform2.listen({ host: options.host, port: options.port });
+  const listener = await listenOrReport(platform2, options, "mcpcat serve --webmcp");
+  if (typeof listener === "number") return listener;
   const actualPort = listener.port;
   const serverOrigins = buildServerOrigins(options.host, actualPort);
   const allowedHosts = buildAllowedHosts(options.host, actualPort, options.allowHosts);
@@ -13666,8 +14045,7 @@ async function runWebMcpHttp(platform2, options, getTools, callTool, serverName,
         };
       }
     }
-    const tools = await getTools();
-    const outcome = await handleJsonRpc(request.body, tools, callTool, serverName, version);
+    const outcome = await handleJsonRpc(request.body, getTools, callTool, serverName, version);
     return {
       status: outcome.status,
       reason: outcome.status === 200 ? "OK" : "Accepted",
@@ -13755,10 +14133,11 @@ async function runProxyHttp(platform2, options, proxy, resolvedBearer, generated
     return 2;
   }
   const allowedOrigins = new Set(options.allowOrigins);
-  const listener = await platform2.listen({
-    host: options.host,
-    port: options.port
-  });
+  const listener = await listenOrReport(platform2, options, "mcpcat serve --proxy");
+  if (typeof listener === "number") {
+    await proxy.shutdown();
+    return listener;
+  }
   const actualPort = listener.port;
   const serverOrigins = buildServerOrigins(options.host, actualPort);
   const allowedHosts = buildAllowedHosts(options.host, actualPort, options.allowHosts);
@@ -13939,7 +14318,8 @@ async function runHttpServer(platform2, options, tools, call, serverName, versio
     return 2;
   }
   const allowedOrigins = new Set(options.allowOrigins);
-  const listener = await platform2.listen({ host: options.host, port: options.port });
+  const listener = await listenOrReport(platform2, options, "mcpcat serve");
+  if (typeof listener === "number") return listener;
   const actualPort = listener.port;
   const serverOrigins = buildServerOrigins(options.host, actualPort);
   const allowedHosts = buildAllowedHosts(options.host, actualPort, options.allowHosts);
@@ -16071,6 +16451,11 @@ async function runCall(platform2, conn, toolName, dataArg, toolArgs, opts) {
   if (toolArgs.length > 0) {
     const tools = await conn.listTools();
     const tool = tools.find((t) => t.name === toolName);
+    const hidden = tool ? void 0 : conn.hiddenTool?.(toolName);
+    if (hidden) {
+      await writeErr(platform2, opts.json ?? false, "usage", hidden);
+      return EXIT_USAGE;
+    }
     const schema = tool?.inputSchema ?? { type: "object", properties: {} };
     const skipRequired = opts.noValidate || !!dataArg;
     const c = coerceArgsBySchema(toolArgs, schema, { noValidate: skipRequired });
@@ -17225,6 +17610,34 @@ function nodeListen(options) {
     });
   });
 }
+function hostWebSocket(url) {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(url);
+    ws.binaryType = "arraybuffer";
+    let feed;
+    const readable = new ReadableStream({
+      start(controller) {
+        feed = controller;
+      }
+    });
+    ws.onclose = () => feed.close();
+    ws.onerror = () => reject(new Error(`websocket ${url} failed`));
+    ws.onmessage = (event) => {
+      feed.enqueue(typeof event.data === "string" ? event.data : new Uint8Array(event.data));
+    };
+    ws.onopen = () => {
+      resolve({
+        readable,
+        writable: new WritableStream({
+          write(chunk) {
+            ws.send(chunk);
+          }
+        }),
+        close: () => ws.close()
+      });
+    };
+  });
+}
 function createHostPlatform() {
   const encoder2 = new TextEncoder();
   return {
@@ -17232,6 +17645,7 @@ function createHostPlatform() {
     fetch: globalThis.fetch,
     spawn: nodeSpawn,
     listen: nodeListen,
+    websocket: hostWebSocket,
     fs: hostFs,
     env: process.env,
     cwd: process.cwd(),
@@ -17269,5 +17683,5 @@ try {
   });
 } catch {
 }
-var code = await run(platform, "0.20.2", args);
+var code = await run(platform, "0.20.4", args);
 process.exit(code);