@mcpjam/inspector 3.10.0 → 3.11.0

package/dist/server/index.js

@@ -35,7 +35,7 @@ import {
   supportsOwnershipProof,
   terminateOwnedProcess,
   terminateOwnedProcessGroup
-} from "./chunk-SPXMROZ2.js";
+} from "./chunk-3I6NEQHV.js";
 import {
   ALLOWED_HOSTS,
   BROWSER_CONSENT_HEADER,
@@ -9664,182 +9664,40 @@ var init_host = __esm({
     };
   }
 });
-var ToolDeclarationCapture = class {
-  snapshots = /* @__PURE__ */ new Map();
-  pending = /* @__PURE__ */ new Map();
-  generation = 0;
-  clear(serverId) {
-    this.snapshots.delete(serverId);
-    for (const [key, request3] of this.pending) {
-      if (request3.serverId === serverId) this.pending.delete(key);
-    }
-  }
-  read(serverId) {
-    const snapshot2 = this.snapshots.get(serverId);
-    return snapshot2 ? { tools: structuredClone(snapshot2.tools), capture: snapshot2.capture } : void 0;
-  }
-  observe(event) {
-    const message = event.message;
-    if (!message || typeof message !== "object" || message.id == null) return;
-    const key = JSON.stringify([event.serverId, typeof message.id, message.id]);
-    if (event.direction === "send") {
-      if (message.method !== "tools/list") return;
-      const params = message.params;
-      const cursor = params?.cursor;
-      let snapshot22 = this.snapshots.get(event.serverId);
-      if (cursor === void 0) {
-        snapshot22 = {
-          tools: [],
-          capture: "partial",
-          generation: ++this.generation,
-          cursors: /* @__PURE__ */ new Set(),
-          bytes: 0,
-          ambiguous: [...this.pending.values()].some(
-            (request22) => request22.serverId === event.serverId
-          )
-        };
-        this.snapshots.set(event.serverId, snapshot22);
-      } else if (!snapshot22 || snapshot22.capture === "complete" || snapshot22.nextCursor !== cursor || snapshot22.cursors.has(cursor)) {
-        return;
-      }
-      if (this.pending.size >= 512) {
-        this.clear(event.serverId);
-        return;
-      }
-      this.pending.set(key, {
-        serverId: event.serverId,
-        generation: snapshot22.generation,
-        cursor
-      });
-      if (cursor !== void 0) snapshot22.cursors.add(cursor);
-      return;
-    }
-    const request3 = this.pending.get(key);
-    if (!request3) return;
-    this.pending.delete(key);
-    const snapshot2 = this.snapshots.get(request3.serverId);
-    if (!snapshot2 || snapshot2.generation !== request3.generation) return;
-    const result = message.result;
-    if (message.error || !result || !Array.isArray(result.tools)) return;
-    const page3 = [];
-    for (const value of result.tools) {
-      if (!value || typeof value !== "object" || typeof value.name !== "string")
-        return;
-      const tool19 = {
-        name: value.name,
-        ...typeof value.description === "string" ? { description: value.description } : {},
-        ...value.inputSchema !== void 0 ? { inputSchema: value.inputSchema } : {},
-        ...value.outputSchema !== void 0 ? { outputSchema: value.outputSchema } : {},
-        ...value.annotations && typeof value.annotations === "object" && !Array.isArray(value.annotations) ? { annotations: value.annotations } : {}
-      };
-      snapshot2.bytes += new TextEncoder().encode(
-        JSON.stringify(tool19)
-      ).byteLength;
-      if (snapshot2.bytes > 4 * 1024 * 1024 || snapshot2.tools.length + page3.length >= 1e4)
-        return;
-      page3.push(structuredClone(tool19));
-    }
-    snapshot2.tools.push(...page3);
-    if (result.nextCursor === void 0) {
-      snapshot2.capture = snapshot2.ambiguous ? "partial" : "complete";
-      snapshot2.nextCursor = void 0;
-    } else if (typeof result.nextCursor === "string" && !snapshot2.cursors.has(result.nextCursor)) {
-      snapshot2.nextCursor = result.nextCursor;
-    } else {
-      snapshot2.nextCursor = void 0;
-    }
-  }
-};
-function isToolCall(body) {
-  if (typeof body !== "string") return false;
-  try {
-    return JSON.parse(body)?.method === "tools/call";
-  } catch {
-    return false;
+function extractNodeErrno(error, depth = 0) {
+  if (!error || typeof error !== "object" || depth > 3) {
+    return void 0;
   }
-}
-function wrapFetchForHttpErrors(fetchFn, hasAuthProvider) {
-  return (async (input, init2) => {
-    const response = await fetchFn(input, init2);
-    const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
-    if (method.toUpperCase() !== "POST" || !isToolCall(init2?.body) || response.ok || // HTTP 400 can carry a JSON-RPC error the transport needs to dispatch.
-    response.status === 400 || // The transport must handle authentication and scope retries itself.
-    // It raises InsufficientScopeError for step-up even without a provider.
-    response.status === 403 && extractWWWAuthenticateParams(response).error === "insufficient_scope" || hasAuthProvider && (response.status === 401 || response.status === 403)) {
-      return response;
-    }
-    const text2 = await response.text().catch(() => null);
-    const statusLine = [response.status, response.statusText].filter(Boolean).join(" ");
-    const challenge = response.headers.get("www-authenticate");
-    const retryAfter = response.headers.get("retry-after");
-    const body = text2 === null ? "(unreadable body)" : text2 || "(empty body)";
-    throw new SdkHttpError(
-      SdkErrorCode.ClientHttpNotImplemented,
-      `Error POSTing to endpoint (HTTP ${statusLine}): ${body}${challenge ? `
-WWW-Authenticate: ${challenge}` : ""}`,
-      {
-        status: response.status,
-        statusText: response.statusText,
-        text: text2,
-        ...retryAfter !== null ? { retryAfter } : {}
-      }
-    );
-  });
-}
-var DEFAULT_CLIENT_VERSION = "1.0.0";
-var DEFAULT_TIMEOUT = DEFAULT_REQUEST_TIMEOUT_MSEC;
-var HTTP_CONNECT_TIMEOUT = 3e3;
-var DEFAULT_ELICITATION_TIMEOUT_EXTENSION_MS = 10 * 60 * 1e3;
-function isMethodUnavailableError(error, method) {
-  if (!(error instanceof Error)) {
-    return false;
+  const code = error.code;
+  const ownCode = typeof code === "string" ? code : void 0;
+  if (ownCode !== void 0 && looksLikeNodeErrno(ownCode)) {
+    return ownCode;
   }
-  const message = error.message.toLowerCase();
-  const methodTokens = /* @__PURE__ */ new Set();
-  methodTokens.add(method.toLowerCase());
-  for (const part of method.split(/[/:._-]/)) {
-    if (part) {
-      methodTokens.add(part.toLowerCase());
+  const cause = error.cause;
+  if (cause !== void 0 && cause !== error) {
+    const fromCause = extractNodeErrno(cause, depth + 1);
+    if (fromCause !== void 0) {
+      return fromCause;
     }
   }
-  const indicators = [
-    "method not found",
-    "not implemented",
-    "unsupported",
-    "does not support",
-    "unimplemented",
-    "unknown method",
-    "unknown mcp method"
-  ];
-  const indicatorMatch = indicators.some(
-    (indicator) => message.includes(indicator)
-  );
-  if (!indicatorMatch) {
-    return false;
-  }
-  if (Array.from(methodTokens).some((token) => message.includes(token))) {
-    return true;
-  }
-  return true;
-}
-var nonRetryableErrors = /* @__PURE__ */ new WeakSet();
-function markNonRetryableError(error) {
-  nonRetryableErrors.add(error);
-  return error;
-}
-function isNonRetryableMarkedError(error) {
-  return typeof error === "object" && error !== null ? nonRetryableErrors.has(error) : false;
+  return ownCode;
 }
-function formatError(error) {
-  if (error instanceof Error) {
-    return error.message;
-  }
-  try {
-    return JSON.stringify(error);
-  } catch {
-    return String(error);
-  }
+function looksLikeNodeErrno(code) {
+  return RETRYABLE_NODE_ERROR_CODES.has(code) || code.startsWith("UND_ERR_");
 }
+var RETRYABLE_NODE_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "EAI_AGAIN",
+  "ENETDOWN",
+  "ENETUNREACH",
+  "ENOTFOUND",
+  "EPIPE",
+  "ETIMEDOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
 var MCPError = class extends Error {
   constructor(message, code, options) {
     super(message, options);
@@ -10060,40 +9918,212 @@ function isAuthError(error) {
   }
   return { isAuth: false };
 }
-function extractNodeErrno(error, depth = 0) {
-  if (!error || typeof error !== "object" || depth > 3) {
-    return void 0;
+function httpStatus(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current && typeof current === "object" && !seen.has(current)) {
+    seen.add(current);
+    const record22 = current;
+    for (const field2 of ["statusCode", "status", "code"]) {
+      const value = record22[field2];
+      if (typeof value === "number" && value >= 100 && value <= 599) {
+        return value;
+      }
+    }
+    const unwrapped = unwrapEraNegotiationCause(current);
+    current = unwrapped !== current ? unwrapped : record22.cause;
   }
-  const code = error.code;
-  const ownCode = typeof code === "string" ? code : void 0;
-  if (ownCode !== void 0 && looksLikeNodeErrno(ownCode)) {
-    return ownCode;
+  return void 0;
+}
+function connectionErrorMessage(url, errors, fallback) {
+  const endpoint = `${url.origin}${url.pathname}`;
+  const statuses = errors.map(httpStatus).filter((s) => s !== void 0);
+  if (statuses.length > 0 && statuses.every((status) => status === 404)) {
+    return `Server returned HTTP 404 at ${endpoint}. Check the MCP endpoint and server logs.`;
   }
-  const cause = error.cause;
-  if (cause !== void 0 && cause !== error) {
-    const fromCause = extractNodeErrno(cause, depth + 1);
-    if (fromCause !== void 0) {
-      return fromCause;
+  if (statuses.length === 0 && errors.some(
+    (error) => extractNodeErrno(unwrapEraNegotiationCause(error)) === "ECONNREFUSED"
+  )) {
+    return `Couldn't reach the server at ${endpoint}: connection refused (ECONNREFUSED). Check that it's running and that the host and port are correct.`;
+  }
+  return fallback;
+}
+var ToolDeclarationCapture = class {
+  snapshots = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  generation = 0;
+  clear(serverId) {
+    this.snapshots.delete(serverId);
+    for (const [key, request3] of this.pending) {
+      if (request3.serverId === serverId) this.pending.delete(key);
     }
   }
-  return ownCode;
+  read(serverId) {
+    const snapshot2 = this.snapshots.get(serverId);
+    return snapshot2 ? { tools: structuredClone(snapshot2.tools), capture: snapshot2.capture } : void 0;
+  }
+  observe(event) {
+    const message = event.message;
+    if (!message || typeof message !== "object" || message.id == null) return;
+    const key = JSON.stringify([event.serverId, typeof message.id, message.id]);
+    if (event.direction === "send") {
+      if (message.method !== "tools/list") return;
+      const params = message.params;
+      const cursor = params?.cursor;
+      let snapshot22 = this.snapshots.get(event.serverId);
+      if (cursor === void 0) {
+        snapshot22 = {
+          tools: [],
+          capture: "partial",
+          generation: ++this.generation,
+          cursors: /* @__PURE__ */ new Set(),
+          bytes: 0,
+          ambiguous: [...this.pending.values()].some(
+            (request22) => request22.serverId === event.serverId
+          )
+        };
+        this.snapshots.set(event.serverId, snapshot22);
+      } else if (!snapshot22 || snapshot22.capture === "complete" || snapshot22.nextCursor !== cursor || snapshot22.cursors.has(cursor)) {
+        return;
+      }
+      if (this.pending.size >= 512) {
+        this.clear(event.serverId);
+        return;
+      }
+      this.pending.set(key, {
+        serverId: event.serverId,
+        generation: snapshot22.generation,
+        cursor
+      });
+      if (cursor !== void 0) snapshot22.cursors.add(cursor);
+      return;
+    }
+    const request3 = this.pending.get(key);
+    if (!request3) return;
+    this.pending.delete(key);
+    const snapshot2 = this.snapshots.get(request3.serverId);
+    if (!snapshot2 || snapshot2.generation !== request3.generation) return;
+    const result = message.result;
+    if (message.error || !result || !Array.isArray(result.tools)) return;
+    const page3 = [];
+    for (const value of result.tools) {
+      if (!value || typeof value !== "object" || typeof value.name !== "string")
+        return;
+      const tool19 = {
+        name: value.name,
+        ...typeof value.description === "string" ? { description: value.description } : {},
+        ...value.inputSchema !== void 0 ? { inputSchema: value.inputSchema } : {},
+        ...value.outputSchema !== void 0 ? { outputSchema: value.outputSchema } : {},
+        ...value.annotations && typeof value.annotations === "object" && !Array.isArray(value.annotations) ? { annotations: value.annotations } : {}
+      };
+      snapshot2.bytes += new TextEncoder().encode(
+        JSON.stringify(tool19)
+      ).byteLength;
+      if (snapshot2.bytes > 4 * 1024 * 1024 || snapshot2.tools.length + page3.length >= 1e4)
+        return;
+      page3.push(structuredClone(tool19));
+    }
+    snapshot2.tools.push(...page3);
+    if (result.nextCursor === void 0) {
+      snapshot2.capture = snapshot2.ambiguous ? "partial" : "complete";
+      snapshot2.nextCursor = void 0;
+    } else if (typeof result.nextCursor === "string" && !snapshot2.cursors.has(result.nextCursor)) {
+      snapshot2.nextCursor = result.nextCursor;
+    } else {
+      snapshot2.nextCursor = void 0;
+    }
+  }
+};
+function isToolCall(body) {
+  if (typeof body !== "string") return false;
+  try {
+    return JSON.parse(body)?.method === "tools/call";
+  } catch {
+    return false;
+  }
 }
-function looksLikeNodeErrno(code) {
-  return RETRYABLE_NODE_ERROR_CODES.has(code) || code.startsWith("UND_ERR_");
+function wrapFetchForHttpErrors(fetchFn, hasAuthProvider) {
+  return (async (input, init2) => {
+    const response = await fetchFn(input, init2);
+    const method = init2?.method ?? (input instanceof Request ? input.method : "GET");
+    if (method.toUpperCase() !== "POST" || !isToolCall(init2?.body) || response.ok || // HTTP 400 can carry a JSON-RPC error the transport needs to dispatch.
+    response.status === 400 || // The transport must handle authentication and scope retries itself.
+    // It raises InsufficientScopeError for step-up even without a provider.
+    response.status === 403 && extractWWWAuthenticateParams(response).error === "insufficient_scope" || hasAuthProvider && (response.status === 401 || response.status === 403)) {
+      return response;
+    }
+    const text2 = await response.text().catch(() => null);
+    const statusLine = [response.status, response.statusText].filter(Boolean).join(" ");
+    const challenge = response.headers.get("www-authenticate");
+    const retryAfter = response.headers.get("retry-after");
+    const body = text2 === null ? "(unreadable body)" : text2 || "(empty body)";
+    throw new SdkHttpError(
+      SdkErrorCode.ClientHttpNotImplemented,
+      `Error POSTing to endpoint (HTTP ${statusLine}): ${body}${challenge ? `
+WWW-Authenticate: ${challenge}` : ""}`,
+      {
+        status: response.status,
+        statusText: response.statusText,
+        text: text2,
+        ...retryAfter !== null ? { retryAfter } : {}
+      }
+    );
+  });
+}
+var DEFAULT_CLIENT_VERSION = "1.0.0";
+var DEFAULT_TIMEOUT = DEFAULT_REQUEST_TIMEOUT_MSEC;
+var HTTP_CONNECT_TIMEOUT = 3e3;
+var DEFAULT_ELICITATION_TIMEOUT_EXTENSION_MS = 10 * 60 * 1e3;
+function isMethodUnavailableError(error, method) {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const message = error.message.toLowerCase();
+  const methodTokens = /* @__PURE__ */ new Set();
+  methodTokens.add(method.toLowerCase());
+  for (const part of method.split(/[/:._-]/)) {
+    if (part) {
+      methodTokens.add(part.toLowerCase());
+    }
+  }
+  const indicators = [
+    "method not found",
+    "not implemented",
+    "unsupported",
+    "does not support",
+    "unimplemented",
+    "unknown method",
+    "unknown mcp method"
+  ];
+  const indicatorMatch = indicators.some(
+    (indicator) => message.includes(indicator)
+  );
+  if (!indicatorMatch) {
+    return false;
+  }
+  if (Array.from(methodTokens).some((token) => message.includes(token))) {
+    return true;
+  }
+  return true;
+}
+var nonRetryableErrors = /* @__PURE__ */ new WeakSet();
+function markNonRetryableError(error) {
+  nonRetryableErrors.add(error);
+  return error;
+}
+function isNonRetryableMarkedError(error) {
+  return typeof error === "object" && error !== null ? nonRetryableErrors.has(error) : false;
+}
+function formatError(error) {
+  if (error instanceof Error) {
+    return error.message;
+  }
+  try {
+    return JSON.stringify(error);
+  } catch {
+    return String(error);
+  }
 }
-var RETRYABLE_NODE_ERROR_CODES = /* @__PURE__ */ new Set([
-  "ECONNREFUSED",
-  "ECONNRESET",
-  "EAI_AGAIN",
-  "ENETDOWN",
-  "ENETUNREACH",
-  "ENOTFOUND",
-  "EPIPE",
-  "ETIMEDOUT",
-  "UND_ERR_CONNECT_TIMEOUT",
-  "UND_ERR_HEADERS_TIMEOUT",
-  "UND_ERR_SOCKET"
-]);
 var DEFAULT_RETRY_POLICY = {
   retries: 0,
   retryDelayMs: 3e3
@@ -16613,9 +16643,11 @@ var MCPClientManager = class {
           ]);
           if (declaredPinFailure) throw declaredPinFailure;
           throw new Error(
-            `Failed to connect to MCP server "${serverId}" using Streamable HTTP, and this server's declared transport rules out the SSE fallback. Streamable HTTP error: ${formatError(
-              error
-            )}`,
+            connectionErrorMessage(
+              url,
+              [error],
+              `Failed to connect to MCP server "${serverId}" using Streamable HTTP, and this server's declared transport rules out the SSE fallback. Streamable HTTP error: ${formatError(error)}`
+            ),
             { cause: error }
           );
         }
@@ -16675,7 +16707,11 @@ var MCPClientManager = class {
       }
       throw attachStreamableCause(
         new Error(
-          `Failed to connect to MCP server "${serverId}" using HTTP transports.${streamableMessage} SSE error: ${sseErrorMessage}.`,
+          connectionErrorMessage(
+            url,
+            [streamableError, error],
+            `Failed to connect to MCP server "${serverId}" using HTTP transports.${streamableMessage} SSE error: ${sseErrorMessage}.`
+          ),
           { cause: error }
         ),
         streamableError
@@ -26479,7 +26515,7 @@ var noopPosthog = {
 var posthog = isTelemetryDisabled ? noopPosthog : new PostHog("phc_dTOPniyUNU2kD8Jx8yHMXSqiZHM8I91uWopTMX6EBE9", {
   host: "https://us.i.posthog.com"
 });
-var SDK_VERSION = "8.14.0";
+var SDK_VERSION = "8.15.0";
 var SDK_RELEASE = `@mcpjam/sdk@${SDK_VERSION}`;
 var CAPTURED_ERROR_SYMBOL = Symbol.for("@mcpjam/sdk/captured-eval-error");
 init_internal();
@@ -26490,7 +26526,7 @@ init_eval_tool_execution();
 init_internal();
 init_internal();
 function readSdkVersion() {
-  return "8.14.0";
+  return "8.15.0";
 }
 var DEFAULT_PLATFORM_USER_AGENT = `mcpjam-sdk/${readSdkVersion()}`;
 init_HostRunner();
@@ -74387,10 +74423,10 @@ function resolveSlug(error) {
   if (/\bout of MCPJam credits\b/i.test(message)) return { slug: "provider/mcpjam_limit" };
   const limitSlug = mcpjamLimitSlugForMessage(message);
   if (limitSlug) return { slug: limitSlug };
-  const httpStatus2 = httpStatusOf(error);
-  if (httpStatus2 !== void 0) {
-    const slug = classifyHttpStatus(httpStatus2);
-    if (slug) return { slug, rawCode: httpStatus2 };
+  const httpStatus22 = httpStatusOf(error);
+  if (httpStatus22 !== void 0) {
+    const slug = classifyHttpStatus(httpStatus22);
+    if (slug) return { slug, rawCode: httpStatus22 };
   }
   const oauthSlug = oauthBodySlug(error);
   if (oauthSlug) return { slug: oauthSlug };
@@ -83915,7 +83951,7 @@ var NEGATIVE_TEST_MODE_DETAILS = {
   }
 };
 function readSdkVersion2() {
-  return "8.14.0";
+  return "8.15.0";
 }
 var CONFORMANCE_CHECKER_VERSION2 = readSdkVersion2();
 var MUST_POINTS2 = 95;
@@ -84546,6 +84582,27 @@ function fetchTokenizerCount(text2, model) {
   });
 }
 
+// server/utils/fetch-error-cause.ts
+function isFetchConnectionFailure(error) {
+  return error instanceof TypeError && /fetch failed/i.test(error.message);
+}
+function getFetchErrorCause(error) {
+  const cause = error?.cause?.code;
+  return typeof cause === "string" ? cause : void 0;
+}
+function isFetchTimeout(error) {
+  let current = error;
+  for (let depth = 0; depth < 8; depth += 1) {
+    if (!current || typeof current !== "object") return false;
+    const name15 = current.name;
+    if (name15 === "TimeoutError" || name15 === "AbortError") return true;
+    const cause = current.cause;
+    if (cause === void 0 || cause === current) return false;
+    current = cause;
+  }
+  return false;
+}
+
 // server/utils/tokenizer-helpers.ts
 var MODEL_ID_MAPPINGS = {
   // Anthropic models
@@ -84665,13 +84722,6 @@ function mapModelIdToTokenizerBackend(modelId) {
 function estimateTokensFromChars(text2) {
   return Math.ceil(text2.length / 4);
 }
-function isFetchConnectionFailure(error) {
-  return error instanceof TypeError && /fetch failed/i.test(error.message);
-}
-function getFetchErrorCause(error) {
-  const cause = error?.cause?.code;
-  return typeof cause === "string" ? cause : void 0;
-}
 var MAX_BACKEND_TOKENIZER_CHARS = 4 * 1024 * 1024;
 var tokenizerPeak = { chars: 0, oversizeSkips: 0 };
 function getTokenizerPeak() {
@@ -86234,6 +86284,13 @@ function startGuestAuthProvisioningInBackground() {
 
 // server/utils/guest-session-source.ts
 var DEFAULT_REMOTE_GUEST_SESSION_URL = "https://app.mcpjam.com/api/web/guest-session";
+function classifyThrown(error, signal, fallback) {
+  if (isFetchTimeout(error)) return { reason: "timeout" };
+  const networkCode = getFetchErrorCause(error);
+  if (networkCode) return { reason: "network", networkCode };
+  if (signal?.aborted) return { reason: "timeout" };
+  return { reason: fallback };
+}
 function getConvexHttpUrl() {
   const convexHttpUrl3 = process.env.CONVEX_HTTP_URL;
   if (!convexHttpUrl3) {
@@ -86317,21 +86374,28 @@ async function performGuestSessionFetch(url, init2, source, mode) {
         kind: "error",
         status: response.status,
         setCookies,
-        ...retryAfterSeconds !== void 0 ? { retryAfterSeconds } : {}
+        ...retryAfterSeconds !== void 0 ? { retryAfterSeconds } : {},
+        reason: "upstream_status",
+        upstreamStatus: response.status
       };
     }
     let body;
     try {
       body = await response.json();
-    } catch {
-      return { kind: "error", status: 503, setCookies };
+    } catch (error) {
+      const failure = classifyThrown(error, init2.signal, "bad_json");
+      logger.warn(
+        `[guest-auth] Failed to read ${source} guest session response`,
+        failure
+      );
+      return { kind: "error", status: 503, setCookies, ...failure };
     }
     const session = parseSessionPayload(body);
     if (!session) {
       logger.warn(
         `[guest-auth] ${source} guest session response was missing token or expiresAt`
       );
-      return { kind: "error", status: 503, setCookies };
+      return { kind: "error", status: 503, setCookies, reason: "bad_payload" };
     }
     logger.info(
       `[guest-auth] Fetched guest token from ${source} guest session`
@@ -86339,10 +86403,12 @@ async function performGuestSessionFetch(url, init2, source, mode) {
     return { kind: "session", session, setCookies };
   } catch (error) {
     const errMsg = error instanceof Error ? error.message : String(error);
+    const failure = classifyThrown(error, init2.signal, "network");
     logger.warn(
-      `[guest-auth] Failed to fetch ${source} guest session: ${errMsg}`
+      `[guest-auth] Failed to fetch ${source} guest session: ${errMsg}`,
+      failure
     );
-    return { kind: "error", status: 503, setCookies: [] };
+    return { kind: "error", status: 503, setCookies: [], ...failure };
   }
 }
 var DEFAULT_GUEST_FETCH_TIMEOUT_MS = 1e4;
@@ -86367,7 +86433,12 @@ async function fetchConvexGuestSession(context, timeoutMs = DEFAULT_GUEST_FETCH_
     logger.warn(
       `[guest-auth] Failed to provision Convex guest auth env: ${errMsg}`
     );
-    return { kind: "error", status: 503, setCookies: [] };
+    return {
+      kind: "error",
+      status: 503,
+      setCookies: [],
+      reason: "provisioning"
+    };
   }
   if (isConvexProvisioningUnavailable()) {
     return fetchRemoteGuestSession(context, timeoutMs);
@@ -102324,9 +102395,9 @@ function decodePaneCommand(res) {
 
 // server/services/browserd/browserd-codec.ts
 var BrowserdClientError = class extends Error {
-  constructor(message, httpStatus2) {
+  constructor(message, httpStatus3) {
     super(message);
-    this.httpStatus = httpStatus2;
+    this.httpStatus = httpStatus3;
     this.name = "BrowserdClientError";
   }
 };
@@ -155068,7 +155139,7 @@ function platformRefusalHint(refusal) {
   return refusal.canTopUp === false ? `${when} This is a usage limit: topping up credits does not lift it.` : when;
 }
 function readSdkVersion3() {
-  return "8.14.0";
+  return "8.15.0";
 }
 var DEFAULT_PLATFORM_API_BASE_URL = "https://app.mcpjam.com/api/v1";
 function resolvePlatformRequestUrl(spec) {
@@ -187576,17 +187647,17 @@ function humanizeSwarmAttemptError(raw, errorCode2) {
   }
   if (!input) return { message: "The session failed for an unknown reason." };
   let body = input;
-  let httpStatus2;
+  let httpStatus3;
   const envelope = AGENT_ERROR_ENVELOPE.exec(input);
   if (envelope) {
-    httpStatus2 = Number(envelope[1] ?? envelope[2]);
+    httpStatus3 = Number(envelope[1] ?? envelope[2]);
     body = input.slice(envelope[0].length).trim();
   }
   if (looksLikeErrorPage(body)) {
     return {
       code: "upstream_error_page",
-      message: `The request was answered with an HTML error page instead of a response${httpStatus2 ? ` (HTTP ${httpStatus2})` : ""}. This usually means a proxy or CDN blocked it.`,
-      ...httpStatus2 !== void 0 ? { httpStatus: httpStatus2 } : {}
+      message: `The request was answered with an HTML error page instead of a response${httpStatus3 ? ` (HTTP ${httpStatus3})` : ""}. This usually means a proxy or CDN blocked it.`,
+      ...httpStatus3 !== void 0 ? { httpStatus: httpStatus3 } : {}
     };
   }
   const parsed = parseJsonObject(body);
@@ -187597,7 +187668,7 @@ function humanizeSwarmAttemptError(raw, errorCode2) {
         0,
         MAX_ATTEMPT_ERROR_CHARS
       ),
-      ...httpStatus2 !== void 0 ? { httpStatus: httpStatus2 } : {}
+      ...httpStatus3 !== void 0 ? { httpStatus: httpStatus3 } : {}
     };
   }
   const headline = str(parsed.error) ?? str(parsed.message) ?? "The session could not run.";
@@ -187616,7 +187687,7 @@ function humanizeSwarmAttemptError(raw, errorCode2) {
     ...num(parsed.outstandingHolds) !== void 0 ? { outstandingHolds: num(parsed.outstandingHolds) } : {},
     ...retryAfterMs !== void 0 ? { retryAfterMs } : {},
     ...canTopUp ? { canTopUp } : {},
-    ...httpStatus2 !== void 0 ? { httpStatus: httpStatus2 } : {}
+    ...httpStatus3 !== void 0 ? { httpStatus: httpStatus3 } : {}
   };
 }
 function humanizeSwarmAttemptErrorMessage(raw) {
@@ -195461,6 +195532,10 @@ function hostedCriterionId(predicate, scope) {
   ).slice(0, 12);
   return `${predicate.type}-${digest}`;
 }
+var HOSTED_RUBRIC_CHECKS_SCORER_PREFIX = "judge:rubricChecks:";
+function hostedRubricCheckScorerId(key) {
+  return `${HOSTED_RUBRIC_CHECKS_SCORER_PREFIX}${key}`;
+}
 
 // server/services/evals/score-definitions.ts
 var HOSTED_PREDICATE_EVALUATOR_VERSION = "1";
@@ -195530,6 +195605,26 @@ function hostedJudgeScoreDefinition(args) {
     ...args.model ? { model: args.model } : {}
   };
 }
+var HOSTED_RUBRIC_CHECKS_PROJECTION_VERSION = "1";
+var HOSTED_RUBRIC_CHECKS_MODEL = "typesafe-ai/jev";
+function hostedRubricCheckScoreDefinition(args) {
+  return {
+    scorerId: hostedRubricCheckScorerId(args.key),
+    idSource: "platform",
+    scorerVersion: HOSTED_RUBRIC_CHECKS_PROJECTION_VERSION,
+    implementationHash: export_canonicalDigest2({
+      kind: args.kind,
+      contentDigest: args.contentDigest,
+      templateVersion: args.templateVersion ?? null,
+      templateHash: args.templateHash ?? null
+    }),
+    label: `rubric check: ${args.label}`,
+    deterministic: false,
+    passThreshold: args.passThreshold,
+    role: "advisory",
+    model: HOSTED_RUBRIC_CHECKS_MODEL
+  };
+}
 var HOSTED_AGENT_ACTIVITY_SCORER_ID = "platform:agentActivity";
 var HOSTED_AGENT_ACTIVITY_VERSION = "1";
 function hostedAgentActivityScoreDefinition() {
@@ -195567,6 +195662,9 @@ function buildHostedScoreDefinitions(inputs) {
   if (inputs.agentActivityFired) {
     definitions2.push(hostedAgentActivityScoreDefinition());
   }
+  for (const question of inputs.rubricChecks ?? []) {
+    definitions2.push(hostedRubricCheckScoreDefinition(question));
+  }
   const byId = /* @__PURE__ */ new Map();
   for (const definition of definitions2) {
     const resolved = export_resolveScoreDefinition2(definition);
@@ -195581,6 +195679,42 @@ function buildHostedEvaluationConfig(inputs) {
 }
 
 // server/services/evals/score-rows.ts
+var RUBRIC_CHECK_KINDS = /* @__PURE__ */ new Set(["boolean", "choice", "score"]);
+function rubricCheckQuestionsFrom(verdict) {
+  if (!verdict || !Array.isArray(verdict.questions)) return [];
+  const templateVersion = isFiniteNumber(verdict.templateVersion) ? verdict.templateVersion : void 0;
+  const templateHash = typeof verdict.templateHash === "string" ? verdict.templateHash : void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of verdict.questions) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const q = raw;
+    if (typeof q.key !== "string" || !/^[cq]:[A-Za-z0-9_-]{1,64}$/.test(q.key) || seen.has(q.key) || typeof q.kind !== "string" || !RUBRIC_CHECK_KINDS.has(q.kind) || typeof q.contentDigest !== "string" || q.contentDigest.length === 0 || !isFiniteNumber(q.passThreshold)) {
+      continue;
+    }
+    seen.add(q.key);
+    const status = q.status === "scored" || q.status === "skipped" ? q.status : "error";
+    out.push({
+      key: q.key,
+      kind: q.kind,
+      label: typeof q.label === "string" ? q.label : q.key,
+      contentDigest: q.contentDigest,
+      passThreshold: q.passThreshold,
+      ...templateVersion !== void 0 ? { templateVersion } : {},
+      ...templateHash !== void 0 ? { templateHash } : {},
+      status,
+      ...isFiniteNumber(q.value) ? { value: q.value } : {},
+      ...typeof q.error === "string" ? { error: q.error } : q.status !== status ? { error: `unknown status ${JSON.stringify(q.status)}` } : {},
+      ...typeof q.rationale === "string" ? { rationale: q.rationale } : {},
+      ...Array.isArray(q.evidence) ? {
+        evidence: q.evidence.filter(
+          (entry3) => typeof entry3 === "string"
+        )
+      } : {}
+    });
+  }
+  return out;
+}
 function isFiniteNumber(value) {
   return typeof value === "number" && Number.isFinite(value);
 }
@@ -195592,6 +195726,7 @@ function judgeAbsenceStatus(verdict) {
 }
 function hostedScoreDefinitionInputs(inputs) {
   const judge = inputs.judgeVerdict;
+  const rubricChecks = rubricCheckQuestionsFrom(inputs.rubricChecksVerdict);
   return {
     ...inputs.predicateResults?.length ? {
       predicates: inputs.predicateResults.map((result) => ({
@@ -195635,7 +195770,20 @@ function hostedScoreDefinitionInputs(inputs) {
         ...isRequiredRole(judge.role) ? { role: export_authoredRequiredRole() } : {}
       }
     } : {},
-    ...inputs.agentActivity?.status === "no_agent_activity" ? { agentActivityFired: true } : {}
+    ...inputs.agentActivity?.status === "no_agent_activity" ? { agentActivityFired: true } : {},
+    ...rubricChecks.length > 0 ? {
+      rubricChecks: rubricChecks.map(
+        ({ key, kind, label, contentDigest, passThreshold, ...rest }) => ({
+          key,
+          kind,
+          label,
+          contentDigest,
+          passThreshold,
+          ...rest.templateVersion !== void 0 ? { templateVersion: rest.templateVersion } : {},
+          ...rest.templateHash !== void 0 ? { templateHash: rest.templateHash } : {}
+        })
+      )
+    } : {}
   };
 }
 function buildHostedScoreRows(inputs, config) {
@@ -195715,6 +195863,39 @@ function buildHostedScoreRows(inputs, config) {
       );
     }
   }
+  const rubricVerdict = inputs.rubricChecksVerdict;
+  const answeredBy = typeof rubricVerdict?.model === "string" && rubricVerdict.model.length > 0 ? rubricVerdict.model : void 0;
+  for (const question of rubricCheckQuestionsFrom(rubricVerdict)) {
+    const definition = byId.get(hostedRubricCheckScorerId(question.key));
+    if (!definition) continue;
+    if (question.status === "skipped") {
+      rows.push(
+        export_skippedScoreResult2(
+          definition,
+          typeof rubricVerdict?.reason === "string" ? `rubric checks did not run: ${rubricVerdict.reason}` : "rubric checks did not run"
+        )
+      );
+      continue;
+    }
+    if (question.status === "error" || question.value === void 0) {
+      rows.push(
+        export_errorScoreResult2(
+          definition,
+          question.error ?? (question.status === "scored" ? "rubric check reported no value" : "no_answer")
+        )
+      );
+      continue;
+    }
+    rows.push(
+      export_finalizeScoreResult2(definition, {
+        kind: "scored",
+        value: question.value,
+        ...question.rationale ? { rationale: question.rationale } : {},
+        ...question.evidence?.length ? { evidence: question.evidence } : {},
+        ...answeredBy ? { model: answeredBy } : {}
+      })
+    );
+  }
   return rows;
 }
 function describeToolMatch2(evaluation) {
@@ -212272,6 +212453,7 @@ function toCaseDto(testCase, vocabulary4 = 1) {
     updatedAt: testCase.updatedAt ?? null
   };
 }
+var PUBLIC_UNWRITABLE_JUDGE_SLOTS = ["groundedness", "rubricChecks"];
 function isCiOwnedSuiteDoc(suite) {
   const declared = suite.declaredSuiteId;
   return typeof declared === "string" && declared.length > 0 || suite.source === "sdk";
@@ -212740,6 +212922,12 @@ var suiteSettingsShape = {
      * while execution is unwired.
      */
     groundedness: z36.unknown().optional(),
+    /**
+     * App-only on day one (see the `judgeRubricChecks` manifest row).
+     * Accepted here for the same reason as `groundedness`: a caller who
+     * sends it gets a 400 naming the field, never a silent strip.
+     */
+    rubricChecks: z36.unknown().optional(),
     // The suite's own grading criteria, handed to the judge alongside
     // each case's expected output. `null` CLEARS them; an empty array is
     // refused because a rubric that asks nothing is not the absence of
@@ -212755,6 +212943,13 @@ var suiteSettingsShape = {
         message: "settings.judge.groundedness cannot be written while groundedness execution is not wired."
       });
     }
+    if (judge.rubricChecks !== void 0) {
+      ctx.addIssue({
+        code: z36.ZodIssueCode.custom,
+        path: ["rubricChecks"],
+        message: "settings.judge.rubricChecks is authored in the app only; the criteria it grades are settings.judge.rubric."
+      });
+    }
   }).optional(),
   // ── The v2 verdict policy ────────────────────────────────────────────
   //
@@ -215941,10 +216136,12 @@ evals.patch("/projects/:projectId/eval-suites/:suiteId", async (c) => {
         delete goalCompletion.severity;
       }
       if (s.judge.rubric !== void 0) updateArgs.judgeRubric = s.judge.rubric;
-      updateArgs.judgeConfig = {
-        goalCompletion,
-        ...suite.judgeConfig?.groundedness ? { groundedness: suite.judgeConfig.groundedness } : {}
-      };
+      const preserved = Object.fromEntries(
+        PUBLIC_UNWRITABLE_JUDGE_SLOTS.filter(
+          (slot) => suite.judgeConfig?.[slot]
+        ).map((slot) => [slot, suite.judgeConfig[slot]])
+      );
+      updateArgs.judgeConfig = { goalCompletion, ...preserved };
     }
     applyVerdictPolicySettings(
       suite,
@@ -225182,7 +225379,7 @@ function classifyByStatus(error) {
       return null;
   }
 }
-function httpStatus(refusal) {
+function httpStatus2(refusal) {
   return refusal.status;
 }
 
@@ -225510,7 +225707,7 @@ function webMcpErrorResponse(c, error, fallback) {
     logHostedRefusal(hostedRefusal);
     return c.json(
       { error: hostedRefusal.error, code: hostedRefusal.code },
-      httpStatus(hostedRefusal)
+      httpStatus2(hostedRefusal)
     );
   }
   reportRouteFailure("[webmcp] unhandled route error", error, {
@@ -225711,7 +225908,7 @@ webmcpInspector.post("/sessions", async (c) => {
         logHostedRefusal(refusal);
         return c.json(
           { error: refusal.error, code: refusal.code },
-          httpStatus(refusal)
+          httpStatus2(refusal)
         );
       }
       return webMcpErrorResponse(c, error, "Could not start your computer.");
@@ -240547,6 +240744,35 @@ var export_default2 = exporter2;
 
 // server/routes/web/guest-session.ts
 import { Hono as Hono57 } from "hono";
+
+// shared/guest-session-failure.ts
+var GUEST_SESSION_FAILURE_REASONS = [
+  "timeout",
+  "network",
+  "upstream_status",
+  "bad_json",
+  "bad_payload",
+  "provisioning"
+];
+var NETWORK_CODE_PATTERN = /^[A-Z][A-Z0-9_]{1,63}$/;
+function isFailureReason(value) {
+  return typeof value === "string" && GUEST_SESSION_FAILURE_REASONS.includes(value);
+}
+function sanitizeGuestSessionFailureDetails(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const { reason, upstreamStatus, networkCode } = raw;
+  if (!isFailureReason(reason)) return void 0;
+  const details = { reason };
+  if (typeof upstreamStatus === "number" && Number.isInteger(upstreamStatus) && upstreamStatus >= 100 && upstreamStatus <= 599) {
+    details.upstreamStatus = upstreamStatus;
+  }
+  if (typeof networkCode === "string" && NETWORK_CODE_PATTERN.test(networkCode)) {
+    details.networkCode = networkCode;
+  }
+  return details;
+}
+
+// server/routes/web/guest-session.ts
 var guestSession = new Hono57();
 var MAX_LEGACY_TOKEN_LENGTH = 4096;
 var GUEST_SESSION_REFUSED_MESSAGE = "Too many guest sessions from your network today. Sign in to continue.";
@@ -240631,11 +240857,17 @@ guestSession.post("/", async (c) => {
       429
     );
   }
+  const details = sanitizeGuestSessionFailureDetails({
+    reason: result.reason,
+    upstreamStatus: result.upstreamStatus,
+    networkCode: result.networkCode
+  });
   return webError(
     c,
     503,
     ErrorCode.INTERNAL_ERROR,
-    "Unable to obtain a guest session right now. Please try again."
+    "Unable to obtain a guest session right now. Please try again.",
+    details ? { ...details } : void 0
   );
 });
 function buildExpiredGuestSessionCookie() {
@@ -245640,6 +245872,10 @@ function readJudgeVerdict(metadata) {
   const verdict = metadata?.judgeVerdict;
   return typeof verdict === "object" && verdict !== null ? verdict : void 0;
 }
+function readRubricChecksVerdict(metadata) {
+  const verdict = metadata?.rubricChecksVerdict;
+  return typeof verdict === "object" && verdict !== null ? verdict : void 0;
+}
 function judgeEvidenceFromVerdict(verdict) {
   if (!verdict) return void 0;
   const status = verdict.status;
@@ -245788,7 +246024,8 @@ function deriveIterationPayload(args) {
     // same reason as `toolMatchAuthored`: an omitted definition leaves the
     // first pass's row unjoinable.
     ...storedAgentActivity ? { agentActivity: storedAgentActivity } : {},
-    ...judgeVerdict && isFiniteNumber3(judgeVerdict.threshold) ? { judgeVerdict } : {}
+    ...judgeVerdict && isFiniteNumber3(judgeVerdict.threshold) ? { judgeVerdict } : {},
+    ...args.rubricChecksVerdict ? { rubricChecksVerdict: args.rubricChecksVerdict } : {}
   });
   return scores.length > 0 ? { stage, scores, config: evaluationConfig } : { stage };
 }
@@ -245875,11 +246112,13 @@ async function runJudgeSecondPass(runId, ports = defaultPorts) {
     }
     let goalCompletionConfirmed = false;
     if (judgeVerdict && goalCompletionJobId !== void 0 && !goalCompletionFailed) {
+      const rubricChecksVerdict = readRubricChecksVerdict(iteration.metadata);
       const { stage, scores, config } = deriveIterationPayload({
         iteration,
         mode,
         judgeVerdict,
-        attributionVerdict: void 0
+        attributionVerdict: void 0,
+        ...rubricChecksVerdict ? { rubricChecksVerdict } : {}
       });
       if (Object.keys(stage).length > 0) {
         const fields = stageFields(stage);