@mcpjam/inspector 3.9.0 → 3.9.1

package/dist/server/{consent-lifetime-RZJBI5QR.js → consent-lifetime-T4A66FLH.js}

@@ -1,10 +1,10 @@
 import {
   createBrowserConsentLifetime,
   invalidateBrowserConsentLifetimes
-} from "./chunk-RRGPQWGQ.js";
+} from "./chunk-KOQ26LF3.js";
 import "./chunk-PZ5AY32C.js";
 export {
   createBrowserConsentLifetime,
   invalidateBrowserConsentLifetimes
 };
-//# sourceMappingURL=consent-lifetime-RZJBI5QR.js.map
+//# sourceMappingURL=consent-lifetime-T4A66FLH.js.map

package/dist/server/harness-install-cli.js

@@ -1,7 +1,7 @@
 import {
   installRuntimePack,
   readRuntimeInstallStatus
-} from "./chunk-PVTMGID7.js";
+} from "./chunk-PLEIFSCL.js";
 import "./chunk-PZ5AY32C.js";
 
 // server/harness-install-cli.ts

package/dist/server/index.js

@@ -35,11 +35,12 @@ import {
   supportsOwnershipProof,
   terminateOwnedProcess,
   terminateOwnedProcessGroup
-} from "./chunk-PVTMGID7.js";
+} from "./chunk-PLEIFSCL.js";
 import {
   ALLOWED_HOSTS,
   BROWSER_CONSENT_HEADER,
   CANIUSE_LANDING_HOSTS,
+  CORS_OPTIONS,
   CORS_ORIGINS,
   ELICITATION_FORM_TTL_MS,
   ELICITATION_POLL_INTERVAL_MS,
@@ -93,7 +94,7 @@ import {
   webmcpInspectorHostedEnabled,
   webmcpInspectorReachable,
   webmcpPageToolsMode
-} from "./chunk-RRGPQWGQ.js";
+} from "./chunk-KOQ26LF3.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -11092,9 +11093,10 @@ function wrapFetchForHttpLogging(serverId, logger3, fetchFn) {
   });
 }
 var RefreshTokenOAuthProvider = class {
-  constructor(_clientId, refreshToken, _clientSecret) {
+  constructor(_clientId, refreshToken, _clientSecret, _onTokensRotated) {
     this._clientId = _clientId;
     this._clientSecret = _clientSecret;
+    this._onTokensRotated = _onTokensRotated;
     this.currentRefreshToken = refreshToken;
   }
   currentRefreshToken;
@@ -11111,10 +11113,20 @@ var RefreshTokenOAuthProvider = class {
   tokens() {
     return this.currentTokens;
   }
-  saveTokens(tokens) {
+  async saveTokens(tokens) {
     this.currentTokens = tokens;
-    if (tokens.refresh_token) {
-      this.currentRefreshToken = tokens.refresh_token;
+    if (!tokens.refresh_token) return;
+    const rotated = tokens.refresh_token !== this.currentRefreshToken;
+    this.currentRefreshToken = tokens.refresh_token;
+    if (!rotated || !this._onTokensRotated) return;
+    try {
+      await this._onTokensRotated({
+        refreshToken: tokens.refresh_token,
+        // A copy: a handler must not be able to mutate the token set this
+        // provider is still holding.
+        tokens: { ...tokens }
+      });
+    } catch {
     }
   }
   prepareTokenRequest() {
@@ -16515,7 +16527,8 @@ var MCPClientManager = class {
       effectiveAuthProvider = new RefreshTokenOAuthProvider(
         trimmedClientId,
         trimmedRefresh,
-        trimmedClientSecret
+        trimmedClientSecret,
+        config.onTokensRotated
       );
       state.authProvider = effectiveAuthProvider instanceof RefreshTokenOAuthProvider ? effectiveAuthProvider : void 0;
       effectiveAccessToken = void 0;
@@ -26466,7 +26479,7 @@ var noopPosthog = {
 var posthog = isTelemetryDisabled ? noopPosthog : new PostHog("phc_dTOPniyUNU2kD8Jx8yHMXSqiZHM8I91uWopTMX6EBE9", {
   host: "https://us.i.posthog.com"
 });
-var SDK_VERSION = "8.12.0";
+var SDK_VERSION = "8.13.0";
 var SDK_RELEASE = `@mcpjam/sdk@${SDK_VERSION}`;
 var CAPTURED_ERROR_SYMBOL = Symbol.for("@mcpjam/sdk/captured-eval-error");
 init_internal();
@@ -26477,7 +26490,7 @@ init_eval_tool_execution();
 init_internal();
 init_internal();
 function readSdkVersion() {
-  return "8.12.0";
+  return "8.13.0";
 }
 var DEFAULT_PLATFORM_USER_AGENT = `mcpjam-sdk/${readSdkVersion()}`;
 init_HostRunner();
@@ -73937,7 +73950,7 @@ var ERROR_CATALOG = {
     [
       "Disable progressive tool discovery for this server, or move headers into the server config."
     ],
-    "paginated-tool-header-discovery-unsupported",
+    "paginated-tool-and-header-discovery-unsupported",
     "warning"
   ),
   // --- Provider / sampling ---
@@ -73989,7 +74002,7 @@ var ERROR_CATALOG = {
       // have no BYOK path, so adding a key does nothing for them.
       "Your own API key covers supported model inference. MCPJam features can still require credits; Swarm generation and persona turns always do."
     ],
-    "mcpjam-model-limit-reached",
+    "out-of-mcpjam-credits",
     "warning"
   ),
   "provider/mcpjam_limit_monthly": entry(
@@ -74004,7 +74017,7 @@ var ERROR_CATALOG = {
       "Wait for the billing period to renew.",
       "Your own API key covers supported model inference. MCPJam features can still require credits; Swarm generation and persona turns always do."
     ],
-    "mcpjam-model-limit-reached",
+    "out-of-mcpjam-credits",
     "warning"
   ),
   "provider/mcpjam_platform_budget": entry(
@@ -74037,7 +74050,7 @@ var ERROR_CATALOG = {
       "Wait for the allowance to reset.",
       "Your own API key covers supported model inference. MCPJam features can still require credits; Swarm generation and persona turns always do."
     ],
-    "mcpjam-model-limit-reached",
+    "out-of-mcpjam-credits",
     "warning"
   ),
   "provider/quota": entry(
@@ -74329,8 +74342,8 @@ function classifyHttpStatus(status) {
   return void 0;
 }
 function classifyByMessageHttp(message) {
-  if (/\b(?:http|status)[:\s-]*401\b/i.test(message)) return "auth/http_401";
-  if (/\b(?:http|status)[:\s-]*403\b/i.test(message)) return "auth/http_403";
+  if (/(?:^|[^\w.:])401\b/.test(message)) return "auth/http_401";
+  if (/(?:^|[^\w.:])403\b/.test(message)) return "auth/http_403";
   if (/(?:^|[^\w.:])429\b|too many requests/i.test(message))
     return "provider/quota";
   return void 0;
@@ -74372,7 +74385,7 @@ function resolveSlug(error) {
   if (/\bout of MCPJam credits\b/i.test(message)) return { slug: "provider/mcpjam_limit" };
   const limitSlug = mcpjamLimitSlugForMessage(message);
   if (limitSlug) return { slug: limitSlug };
-  const httpStatus2 = getHttpStatus(error);
+  const httpStatus2 = httpStatusOf(error);
   if (httpStatus2 !== void 0) {
     const slug = classifyHttpStatus(httpStatus2);
     if (slug) return { slug, rawCode: httpStatus2 };
@@ -74847,7 +74860,7 @@ function mergeConnectionToolsets(perKey, connectionsByServerId, options) {
         (t) => asSchema(t.inputSchema).jsonSchema
       );
       const canMerge = schemas.every(
-        (s) => s?.type === "object" && !Object.hasOwn(s.properties ?? {}, "account") && canonical2(s) === canonical2(schemas[0])
+        (s) => s?.type === "object" && !Object.hasOwn(s.properties ?? {}, "link_id") && canonical2(s) === canonical2(schemas[0])
       );
       if (!canMerge) {
         for (const connection of choices) {
@@ -74881,24 +74894,24 @@ function mergeConnectionToolsets(perKey, connectionsByServerId, options) {
       output[name15] = {
         ...baseTool,
         description: `${baseTool.description ?? ""}
-Connected accounts: ${choices.map((c) => `${c.label} (account=${c.connectionId})`).join("; ")}`,
+Connected accounts: ${choices.map((c) => `${c.label} (link_id=${c.connectionId})`).join("; ")}`,
         inputSchema: jsonSchema({
           ...schemas[0],
           properties: {
             ...schemas[0].properties,
-            account: {
+            link_id: {
               type: "string",
               enum: choices.map((c) => c.connectionId)
             }
           },
-          required: [...schemas[0].required ?? [], "account"]
+          required: [...schemas[0].required ?? [], "link_id"]
         }),
         execute: async (input, opts) => {
           const connection = choices.find(
-            (c) => c.connectionId === input?.account && options.snapshot.get(c.connectionId) === c.key
+            (c) => c.connectionId === input?.link_id && options.snapshot.get(c.connectionId) === c.key
           );
           if (!connection) return invalidAccount();
-          const { account: _account, ...args } = input;
+          const { link_id: _linkId, ...args } = input;
           const tool19 = perKey[connection.key][name15];
           selected.set(opts.toolCallId, { tool: tool19, connection, input: args });
           options.onRoute?.(opts.toolCallId, connection);
@@ -74914,7 +74927,7 @@ Connected accounts: ${choices.map((c) => `${c.label} (account=${c.connectionId})
             };
           return route.tool.toModelOutput ? route.tool.toModelOutput({ ...opts, input: route.input }) : { type: "json", value: opts.output };
         },
-        _connectionForInput: (input) => choices.find((c) => c.connectionId === input?.account),
+        _connectionForInput: (input) => choices.find((c) => c.connectionId === input?.link_id),
         _connectionForCall: (id3) => selected.get(id3)?.connection,
         _serverId: serverId,
         _mcpToolName: name15,
@@ -82954,7 +82967,7 @@ var ERROR_CATALOG2 = {
     [
       "Disable progressive tool discovery for this server, or move headers into the server config."
     ],
-    "paginated-tool-header-discovery-unsupported",
+    "paginated-tool-and-header-discovery-unsupported",
     "warning"
   ),
   // --- Provider / sampling ---
@@ -83006,7 +83019,7 @@ var ERROR_CATALOG2 = {
       // have no BYOK path, so adding a key does nothing for them.
       "Your own API key covers supported model inference. MCPJam features can still require credits; Swarm generation and persona turns always do."
     ],
-    "mcpjam-model-limit-reached",
+    "out-of-mcpjam-credits",
     "warning"
   ),
   "provider/mcpjam_limit_monthly": entry2(
@@ -83021,7 +83034,7 @@ var ERROR_CATALOG2 = {
       "Wait for the billing period to renew.",
       "Your own API key covers supported model inference. MCPJam features can still require credits; Swarm generation and persona turns always do."
     ],
-    "mcpjam-model-limit-reached",
+    "out-of-mcpjam-credits",
     "warning"
   ),
   "provider/mcpjam_platform_budget": entry2(
@@ -83054,7 +83067,7 @@ var ERROR_CATALOG2 = {
       "Wait for the allowance to reset.",
       "Your own API key covers supported model inference. MCPJam features can still require credits; Swarm generation and persona turns always do."
     ],
-    "mcpjam-model-limit-reached",
+    "out-of-mcpjam-credits",
     "warning"
   ),
   "provider/quota": entry2(
@@ -83900,7 +83913,7 @@ var NEGATIVE_TEST_MODE_DETAILS = {
   }
 };
 function readSdkVersion2() {
-  return "8.12.0";
+  return "8.13.0";
 }
 var CONFORMANCE_CHECKER_VERSION2 = readSdkVersion2();
 var MUST_POINTS2 = 95;
@@ -155020,7 +155033,7 @@ function platformRefusalHint(refusal) {
   return refusal.canTopUp === false ? `${when} This is a usage limit: topping up credits does not lift it.` : when;
 }
 function readSdkVersion3() {
-  return "8.12.0";
+  return "8.13.0";
 }
 var DEFAULT_PLATFORM_API_BASE_URL = "https://app.mcpjam.com/api/v1";
 function resolvePlatformRequestUrl(spec) {
@@ -194775,6 +194788,8 @@ function environmentServerRefsForManager(resolved, manager) {
 function environmentEffectiveServerIds(resolved) {
   return resolved.effectiveServerIds ?? resolved.selectedServerIds;
 }
+var EVAL_LAUNCH_SERVER_SOURCE = "environment_only";
+var loggedServerSourceDowngrade = false;
 async function resolveEnvironmentForLaunch(convexClient6, args) {
   let raw;
   try {
@@ -194791,7 +194806,20 @@ async function resolveEnvironmentForLaunch(convexClient6, args) {
         "This deployment cannot resolve project environments yet. Retry after the backend deploys."
       );
     }
-    throw error;
+    if (args.serverSource && /Object contains extra field [`'"]?serverSource(?:[`'"]|\b)/i.test(message)) {
+      if (!loggedServerSourceDowngrade) {
+        loggedServerSourceDowngrade = true;
+        logger.warn(
+          "[evals] Backend does not accept serverSource yet; eval launches fall back to the client's own servers until it deploys."
+        );
+      }
+      raw = await convexClient6.query(
+        "projectEnvironments:resolveEnvironmentForLaunch",
+        { projectId: args.projectId, environmentId: args.environmentId }
+      );
+    } else {
+      throw error;
+    }
   }
   const resolved = raw;
   if (!resolved || !resolved.environmentRef || typeof resolved.environmentRef.revision !== "number" || !Array.isArray(resolved.selectedServerIds)) {
@@ -194880,6 +194908,30 @@ function environmentLaunchConflictError(error) {
     message
   );
 }
+function translateEnvironmentResolveError(error) {
+  if (error instanceof WebRouteError) return error;
+  const data = error?.data;
+  if (data && typeof data === "object" && !Array.isArray(data)) {
+    const code = data.code;
+    const message = data.message;
+    if (typeof code === "string" && code.startsWith("ENV_")) {
+      if (code === "ENV_NOT_FOUND" || code === "ENV_CROSS_PROJECT") {
+        return new WebRouteError(
+          404,
+          ErrorCode.NOT_FOUND,
+          "Environment not found"
+        );
+      }
+      return new WebRouteError(
+        409,
+        ErrorCode.CONFLICT,
+        typeof message === "string" ? message : "Environment cannot be launched right now.",
+        { code }
+      );
+    }
+  }
+  return error;
+}
 
 // server/services/evals/recorder.ts
 var RUNTIME_TELEMETRY_TIMEOUT_MS = 2e3;
@@ -207148,8 +207200,11 @@ async function prepareEvalRun(clientManager, request3) {
       );
     }
     environmentLaunch = resolvedEnvironment && resolvedEnvironment.environmentRef.environmentId === environmentId ? resolvedEnvironment : await resolveEnvironmentForLaunch(convexClient6, {
+      serverSource: EVAL_LAUNCH_SERVER_SOURCE,
       projectId,
       environmentId
+    }).catch((error) => {
+      throw translateEnvironmentResolveError(error);
     });
   } else if (serverIds.length === 0) {
     throw new WebRouteError(
@@ -209566,30 +209621,6 @@ function isConvexFunctionMissing(error) {
 function convexFunctionUnavailableError(message) {
   return new WebRouteError(422, ErrorCode.FEATURE_NOT_SUPPORTED, message);
 }
-function translateEnvironmentResolveError(error) {
-  if (error instanceof WebRouteError) return error;
-  const data = error?.data;
-  if (data && typeof data === "object" && !Array.isArray(data)) {
-    const code = data.code;
-    const message = data.message;
-    if (typeof code === "string" && code.startsWith("ENV_")) {
-      if (code === "ENV_NOT_FOUND" || code === "ENV_CROSS_PROJECT") {
-        return new WebRouteError(
-          404,
-          ErrorCode.NOT_FOUND,
-          "Environment not found"
-        );
-      }
-      return new WebRouteError(
-        409,
-        ErrorCode.CONFLICT,
-        typeof message === "string" ? message : "Environment cannot be launched right now.",
-        { code }
-      );
-    }
-  }
-  return error;
-}
 function requireProjectMatch(resource, projectId, what) {
   if (!resource || String(resource.projectId ?? "") !== projectId) {
     throw new WebRouteError(404, ErrorCode.NOT_FOUND, `${what} not found`);
@@ -211372,6 +211403,7 @@ async function resolveLaunchServers(params) {
     const convex = createConvexReadClient(convexAuthToken);
     try {
       environmentLaunch = await resolveEnvironmentForLaunch(convex, {
+        serverSource: EVAL_LAUNCH_SERVER_SOURCE,
         projectId,
         environmentId
       });
@@ -214532,6 +214564,7 @@ evals.post(
       let launch;
       try {
         launch = await resolveEnvironmentForLaunch(readClient, {
+          serverSource: EVAL_LAUNCH_SERVER_SOURCE,
           projectId,
           environmentId
         });
@@ -215104,8 +215137,11 @@ async function handleEvalAuthoring(c, local) {
         serverField: "servers"
       });
       const environment = environmentId ? await resolveEnvironmentForLaunch(convex, {
+        serverSource: EVAL_LAUNCH_SERVER_SOURCE,
         projectId: input.projectId,
         environmentId
+      }).catch((error) => {
+        throw translateEnvironmentResolveError(error);
       }) : void 0;
       const selection = environment ? {
         serverIds: environmentServerIds(environment),
@@ -237783,13 +237819,18 @@ evals3.post(
       let preflightEnvironment;
       if (typeof rawBody.environmentId === "string" && rawBody.environmentId && typeof rawBody.projectId === "string" && rawBody.projectId) {
         const bearer = await getConvexBearerForRequest(c);
-        preflightEnvironment = await resolveEnvironmentForLaunch(
-          createConvexClient(bearer),
-          {
-            projectId: rawBody.projectId,
-            environmentId: rawBody.environmentId
-          }
-        );
+        try {
+          preflightEnvironment = await resolveEnvironmentForLaunch(
+            createConvexClient(bearer),
+            {
+              serverSource: EVAL_LAUNCH_SERVER_SOURCE,
+              projectId: rawBody.projectId,
+              environmentId: rawBody.environmentId
+            }
+          );
+        } catch (error) {
+          throw translateEnvironmentResolveError(error);
+        }
         rawBody.serverIds = environmentServerIds(preflightEnvironment);
         const serverNames = environmentServerNames(preflightEnvironment);
         if (serverNames.length) {
@@ -268964,6 +269005,7 @@ async function executeClaimedRun(claimed) {
       const resolved = await resolveEnvironmentForLaunch(
         createConvexClient(bearer),
         {
+          serverSource: EVAL_LAUNCH_SERVER_SOURCE,
           projectId: claimed.projectId,
           environmentId: claimed.environmentId
         }
@@ -269008,7 +269050,7 @@ async function executeClaimedRun(claimed) {
       await reportComplete({
         triggerId: claimed.triggerId,
         ok: false,
-        failureReason: classifyFailure(error)
+        failureReason: classifyFailure(translateEnvironmentResolveError(error))
       });
       return;
     }
@@ -269042,7 +269084,7 @@ async function executeClaimedRun(claimed) {
     await reportComplete({
       triggerId: claimed.triggerId,
       ok: false,
-      failureReason: classifyFailure(error)
+      failureReason: classifyFailure(translateEnvironmentResolveError(error))
     });
   } finally {
     if (manager) {
@@ -275363,13 +275405,7 @@ if (enableHttpLogs) {
     })
   );
 }
-app.use(
-  "*",
-  cors({
-    origin: CORS_ORIGINS,
-    credentials: true
-  })
-);
+app.use("*", cors(CORS_OPTIONS));
 app.use("/api/web/*", webBodyLimit());
 app.use("/api/*", requestLogContextMiddleware);
 if (!HOSTED_MODE) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcpjam/inspector",
   "productName": "MCPJam Inspector",
-  "version": "3.9.0",
+  "version": "3.9.1",
   "type": "module",
   "engines": {
     "node": ">=22.0.0"
@@ -147,7 +147,7 @@
     "@hookform/resolvers": "^3.10.0",
     "@lezer/highlight": "^1.2.3",
     "@mcp-ui/client": "^5.9.0",
-    "@mcpjam/sdk": "^8.12.0",
+    "@mcpjam/sdk": "^8.13.0",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/ext-apps": "^1.7.4",
     "@novnc/novnc": "^1.7.0",