@modelcontextprotocol/inspector 2.1.0 → 2.2.0

package/clients/web/build/index.js

@@ -1680,6 +1680,9 @@ var RemoteSession = class _RemoteSession {
   static AUTH_HTTP_ECHO_SUPPRESS_MS = 3e4;
   requestWaits = /* @__PURE__ */ new Map();
   authProviderHandle = null;
+  appliedProtocolVersion;
+  /** A protocol version is a dated token (`2025-11-25`, `2026-07-28`, …). */
+  static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
   constructor(sessionId) {
     this.sessionId = sessionId;
   }
@@ -1695,6 +1698,27 @@ var RemoteSession = class _RemoteSession {
   setTransport(transport) {
     this.transport = transport;
   }
+  /**
+   * Apply the client's negotiated protocol version to the upstream transport
+   * (#1935). The browser's SDK Client owns the `initialize` handshake, so the
+   * `setProtocolVersion` call it makes lands on the *remote* transport; without
+   * this the backend's real HTTP transport never learns the version and drops
+   * `Mcp-Protocol-Version` from every subsequent request.
+   *
+   * Ignores anything that isn't a plausible version token so a client can't
+   * push arbitrary bytes into an upstream header, and re-applies only on
+   * change (the value rides every `/api/mcp/send`). The value arrives from an
+   * unvalidated JSON body, so the type is checked rather than assumed —
+   * `RegExp.test` would otherwise coerce a `123` or `true` into a "matching"
+   * string and hand the wrong type to the transport.
+   */
+  applyProtocolVersion(version) {
+    if (typeof version !== "string" || version === this.appliedProtocolVersion || !_RemoteSession.PROTOCOL_VERSION_PATTERN.test(version)) {
+      return;
+    }
+    this.appliedProtocolVersion = version;
+    this.transport.setProtocolVersion?.(version);
+  }
   setEventConsumer(consumer) {
     this.eventConsumer = consumer;
     while (this.eventQueue.length > 0) {
@@ -1953,8 +1977,42 @@ function createRemoteAuthProvider(initialAuthState) {
 }
 
 // ../../core/auth/node/secret-store.ts
-import { AsyncEntry, findCredentialsAsync } from "@napi-rs/keyring";
 var SERVICE_NAME = "mcp-inspector";
+var keyringLoad;
+var KeyringModuleShapeError = class extends Error {
+  constructor(detail, options) {
+    super(`@napi-rs/keyring loaded but ${detail}`, options);
+    this.name = "KeyringModuleShapeError";
+  }
+};
+var checkKeyringShape = (mod) => {
+  try {
+    if (typeof mod.AsyncEntry === "function" && typeof mod.findCredentialsAsync === "function") {
+      return { ok: true, mod };
+    }
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        "did not expose AsyncEntry / findCredentialsAsync"
+      )
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      err: new KeyringModuleShapeError(
+        `its exports could not be read: ${err instanceof Error ? err.message : String(err)}`,
+        { cause: err }
+      )
+    };
+  }
+};
+var loadKeyring = () => {
+  keyringLoad ??= import("@napi-rs/keyring").then(
+    checkKeyringShape,
+    (err) => ({ ok: false, err })
+  );
+  return keyringLoad;
+};
 function parseAccount(account) {
   const idx = account.indexOf(":");
   if (idx <= 0 || idx === account.length - 1) return null;
@@ -1966,16 +2024,31 @@ function parseAccount(account) {
 var buildAccount = (serverId, field) => `${serverId}:${field}`;
 var KeychainUnavailableError = class extends Error {
   constructor(cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
     super(
-      `OS keychain is not available. On Linux, install libsecret / gnome-keyring. Underlying error: ${cause instanceof Error ? cause.message : String(cause)}`
+      `OS keychain is not available. ${hintFor(cause, message)} Underlying error: ${message}`
     );
     this.name = "KeychainUnavailableError";
   }
 };
+var hintFor = (cause, message) => {
+  if (cause instanceof KeyringModuleShapeError) {
+    return `The @napi-rs/keyring package loaded but does not expose the API this build expects \u2014 most likely a version or packaging mismatch; reinstall the Inspector, and report this if it persists.`;
+  }
+  if (message.includes("Cannot find native binding")) {
+    return `The @napi-rs/keyring platform package for this OS is missing or unavailable \u2014 reinstall the Inspector (for npx, clear the npx cache under your npm cache directory first).`;
+  }
+  return `On Linux, install libsecret / gnome-keyring.`;
+};
 var KeyringSecretStore = class {
   async get(serverId, field) {
-    const entry = new AsyncEntry(SERVICE_NAME, buildAccount(serverId, field));
     try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return null;
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
       const v = await entry.getPassword();
       return v ?? null;
     } catch {
@@ -1983,16 +2056,27 @@ var KeyringSecretStore = class {
     }
   }
   async set(serverId, field, value) {
-    const entry = new AsyncEntry(SERVICE_NAME, buildAccount(serverId, field));
     try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) throw new KeychainUnavailableError(keyring.err);
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
       await entry.setPassword(value);
     } catch (err) {
+      if (err instanceof KeychainUnavailableError) throw err;
       throw new KeychainUnavailableError(err);
     }
   }
   async delete(serverId, field) {
-    const entry = new AsyncEntry(SERVICE_NAME, buildAccount(serverId, field));
     try {
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return;
+      const entry = new keyring.mod.AsyncEntry(
+        SERVICE_NAME,
+        buildAccount(serverId, field)
+      );
       await entry.deleteCredential();
     } catch {
     }
@@ -2000,7 +2084,9 @@ var KeyringSecretStore = class {
   async deleteAllForServer(serverId) {
     let creds;
     try {
-      creds = await findCredentialsAsync(SERVICE_NAME);
+      const keyring = await loadKeyring();
+      if (!keyring.ok) return;
+      creds = await keyring.mod.findCredentialsAsync(SERVICE_NAME);
     } catch {
       return;
     }
@@ -2232,6 +2318,7 @@ async function deleteClientConfigStore(filePath, secretStore) {
 
 // ../../core/mcp/remote/node/server.ts
 import { ZodError as ZodError2 } from "zod";
+var SSE_PRIMING_COMMENT = ":\n\n";
 function createOriginMiddleware(allowedOrigins) {
   return async (c, next) => {
     if (!allowedOrigins || allowedOrigins.length === 0) {
@@ -2571,7 +2658,7 @@ function createRemoteApp(options) {
     } catch {
       return c.json({ error: "Invalid JSON body" }, 400);
     }
-    const { sessionId, message, relatedRequestId, headers } = body;
+    const { sessionId, message, relatedRequestId, headers, protocolVersion } = body;
     if (!sessionId || !message) {
       return c.json({ error: "Missing sessionId or message" }, 400);
     }
@@ -2583,6 +2670,7 @@ function createRemoteApp(options) {
       const errorMsg = session.getTransportError() || "Transport closed";
       return c.json({ ok: false, kind: "transport_error", error: errorMsg });
     }
+    session.applyProtocolVersion(protocolVersion);
     session.beginSend();
     const requestId = requestIdForSendWait(message);
     let responseWait;
@@ -2642,6 +2730,7 @@ function createRemoteApp(options) {
         sessions.delete(sessionId);
         return;
       }
+      await stream.write(SSE_PRIMING_COMMENT);
       stream.onAbort(() => {
         const shouldCleanup = session.clearEventConsumer();
         stream.close();
@@ -3612,6 +3701,7 @@ function createRemoteApp(options) {
         serverEventSubscribers.add(send);
         ensureWatcher();
       }
+      await stream.write(SSE_PRIMING_COMMENT);
       stream.onAbort(() => {
         serverEventSubscribers.delete(send);
         void maybeStopWatcher();
@@ -3852,7 +3942,9 @@ var NODE_ONLY_OPTIMIZE_DEPS_EXCLUDE = [
   "which",
   // `@napi-rs/keyring` is loaded only inside
   // `core/auth/node/secret-store.ts` from the Hono `/api/servers`
-  // handlers. It's a native-binding package (no browser code path) so
+  // handlers — and lazily even there, via a cached dynamic import, so
+  // an unsupported platform degrades instead of crashing at startup
+  // (#1905). It's a native-binding package (no browser code path) so
   // excluding it keeps Vite's dep scanner from chasing into the
   // platform-specific binaries during dev startup.
   "@napi-rs/keyring"
@@ -3947,9 +4039,20 @@ function vitestSharedPaths(clientDir) {
       find: /^@napi-rs\/keyring$/,
       replacement: path2.resolve(dirname8, "node_modules/@napi-rs/keyring")
     },
+    // `express` and `yaml` resolve from the **repo root**, unlike every pin
+    // above. Both are reached only through `test-servers/src` — express by the
+    // http/oauth servers, yaml by `load-config.ts` — which is root-owned code
+    // with no manifest of its own, so the root is where they are declared and
+    // the only place a client's resolution chain is guaranteed to find them.
+    // Pointing these at `<client>/node_modules` is what broke when the MCP
+    // packages moved to the root (#1970): express was never declared by a client
+    // at all, it arrived in `clients/cli` as a peer of `express-rate-limit`
+    // under `@modelcontextprotocol/server-legacy`, so removing that manifest
+    // entry took express with it and every cli test that spawns a test server
+    // failed to resolve it.
     {
       find: /^express$/,
-      replacement: path2.resolve(dirname8, "node_modules/express")
+      replacement: path2.resolve(repoRoot, "node_modules/express")
     },
     {
       find: /^yaml$/,