@modelcontextprotocol/inspector 2.13.0 → 2.14.0

package/clients/tui/build/index.js

@@ -31,7 +31,10 @@ import { runtimeCodecFromStandardSchema, taskId, toJsonValue } from "@modelconte
 import { CallToolResultSchema, ElicitResultSchema, EmptyResultSchema, GetPromptResultSchema, ListPromptsResultSchema, ListResourceTemplatesResultSchema, ListResourcesResultSchema, ListToolsResultSchema, NotificationSchema, OAuthClientInformationSchema, OAuthMetadataSchema, OAuthTokensSchema, OpenIdProviderDiscoveryMetadataSchema, ProgressTokenSchema, PromptSchema, ReadResourceResultSchema, RequestMetaSchema, ResourceSchema, ResourceTemplateSchema, TaskStatusNotificationSchema, ToolSchema } from "@modelcontextprotocol/core";
 import { TASKS_EXTENSION_ID_V2 as TASKS_EXTENSION_KEY } from "@modelcontextprotocol/ext-tasks/core/v2";
 import { RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/app-bridge";
-import { AjvJsonSchemaValidator } from "@modelcontextprotocol/client/validators/ajv";
+import Ajv from "ajv";
+import { Ajv2019 } from "ajv/dist/2019.js";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { addFormats } from "@modelcontextprotocol/client/validators/ajv";
 import { createServer } from "node:http";
 import pino from "pino";
 import open from "open";
@@ -1607,6 +1610,14 @@ function expectedSecretFields(stored) {
 	if (isStdioStored(stored) && stored.env) for (const k of Object.keys(stored.env)) fields.push(envSecretField(k));
 	return fields;
 }
+function adHocServerName(config) {
+	if (config.type === "sse" || config.type === "streamable-http") try {
+		return new URL(config.url).host || "server";
+	} catch {
+		return "server";
+	}
+	return config.command?.split(/[\\/]/).pop() || "server";
+}
 //#endregion
 //#region ../../core/storage/own-entry.ts
 function setOwnEntry(map, key, value) {
@@ -2996,8 +3007,9 @@ async function loadServerEntries(serverOptions) {
 	}
 	const configs = resolveServerConfigs(serverOptions, "multi");
 	if (configs.length === 0) throw new Error("At least one server is required. Use --catalog/--config <path> or an ad-hoc target (command/URL).");
-	return { default: {
-		config: configs[0],
+	const config = configs[0];
+	return { [adHocServerName(config)]: {
+		config,
 		settings: mergeSettings(void 0, serverOptions)
 	} };
 }
@@ -5182,6 +5194,627 @@ function validateToolOutput(provider, tool, result) {
 		return;
 	}
 }
+//#endregion
+//#region ../../core/json/linearRegExp.ts
+var CharMatcher = class {
+	re;
+	ascii = /* @__PURE__ */ new Uint8Array(128);
+	constructor(source, unicode) {
+		this.re = new RegExp(`^(?:${source})$`, unicode ? "u" : "");
+	}
+	matches(cp, unicode) {
+		if (cp < 128) {
+			const memo = this.ascii[cp];
+			if (memo !== 0) return memo === 1;
+			const result = this.re.test(String.fromCharCode(cp));
+			this.ascii[cp] = result ? 1 : 2;
+			return result;
+		}
+		return this.re.test(unicode ? String.fromCodePoint(cp) : String.fromCharCode(cp));
+	}
+};
+var Unsupported = class extends Error {};
+const MAX_GROUP_DEPTH = 64;
+const MAX_PROGRAM_SIZE = 1e4;
+const MAX_COMPILE_STEPS = 10 * MAX_PROGRAM_SIZE;
+const MAX_PATTERN_LENGTH = 8192;
+const COMPILE_BUDGET_EXHAUSTED = "the patterns together exceed the compilation budget";
+function isCompileBudgetExhausted(budget) {
+	return budget.steps < 0 || budget.size < 0;
+}
+const QUANTIFIER_BRACES = /\{(\d+)(?:(,)(\d*))?\}/y;
+const HEX4 = /^[0-9a-fA-F]{4}$/;
+const HEX2 = /^[0-9a-fA-F]{2}$/;
+var Parser = class {
+	pos = 0;
+	src;
+	unicode;
+	constructor(src, unicode) {
+		this.src = src;
+		this.unicode = unicode;
+	}
+	parse() {
+		const node = this.parseAlternation(0);
+		/* v8 ignore next -- the native RegExp constructor rejects an unbalanced `)` first */
+		if (this.pos !== this.src.length) throw new Unsupported("unbalanced group");
+		return node;
+	}
+	parseAlternation(depth) {
+		const options = [this.parseSequence(depth)];
+		while (this.src[this.pos] === "|") {
+			this.pos++;
+			options.push(this.parseSequence(depth));
+		}
+		return options.length === 1 ? options[0] : {
+			kind: "alt",
+			options
+		};
+	}
+	parseSequence(depth) {
+		const items = [];
+		while (this.pos < this.src.length && this.src[this.pos] !== "|" && this.src[this.pos] !== ")") items.push(this.parseTerm(depth));
+		return items.length === 1 ? items[0] : {
+			kind: "seq",
+			items
+		};
+	}
+	parseTerm(depth) {
+		const atom = this.parseAtom(depth);
+		const quantifier = this.readQuantifier();
+		if (!quantifier) return atom;
+		if (this.src[this.pos] === "?") this.pos++;
+		return {
+			kind: "repeat",
+			body: atom,
+			...quantifier
+		};
+	}
+	readQuantifier() {
+		const c = this.src[this.pos];
+		if (c === "*") {
+			this.pos++;
+			return {
+				min: 0,
+				max: Infinity
+			};
+		}
+		if (c === "+") {
+			this.pos++;
+			return {
+				min: 1,
+				max: Infinity
+			};
+		}
+		if (c === "?") {
+			this.pos++;
+			return {
+				min: 0,
+				max: 1
+			};
+		}
+		if (c === "{") {
+			QUANTIFIER_BRACES.lastIndex = this.pos;
+			const m = QUANTIFIER_BRACES.exec(this.src);
+			if (!m) return void 0;
+			this.pos += m[0].length;
+			const min = Number(m[1]);
+			return {
+				min,
+				max: m[2] === void 0 ? min : m[3] ? Number(m[3]) : Infinity
+			};
+		}
+	}
+	parseAtom(depth) {
+		switch (this.src[this.pos]) {
+			case "(": return this.parseGroup(depth);
+			case "[": return this.parseClass();
+			case "\\": return this.parseEscape();
+			case ".":
+				this.pos++;
+				return {
+					kind: "char",
+					source: "."
+				};
+			case "^":
+				this.pos++;
+				return {
+					kind: "assert",
+					assertion: "start"
+				};
+			case "$":
+				this.pos++;
+				return {
+					kind: "assert",
+					assertion: "end"
+				};
+			case "*":
+			case "+":
+			case "?":
+ /* v8 ignore next -- "nothing to repeat" is a native syntax error */
+			throw new Unsupported("nothing to repeat");
+			case "{":
+				QUANTIFIER_BRACES.lastIndex = this.pos;
+				if (QUANTIFIER_BRACES.test(this.src))
+ /* v8 ignore next -- rejected by the native RegExp constructor first */
+				throw new Unsupported("nothing to repeat");
+				this.pos++;
+				return {
+					kind: "char",
+					source: "\\{"
+				};
+			default: {
+				const width = this.codePointWidth(this.pos);
+				const source = this.src.slice(this.pos, this.pos + width);
+				this.pos += width;
+				return {
+					kind: "char",
+					source
+				};
+			}
+		}
+	}
+	codePointWidth(at) {
+		if (!this.unicode) return 1;
+		return this.src.codePointAt(at) > 65535 ? 2 : 1;
+	}
+	parseGroup(depth) {
+		if (depth >= MAX_GROUP_DEPTH) throw new Unsupported("groups nested too deeply");
+		this.pos++;
+		if (this.src.startsWith("?:", this.pos)) this.pos += 2;
+		else if (this.src.startsWith("?<", this.pos) && this.src[this.pos + 2] !== "=" && this.src[this.pos + 2] !== "!") {
+			const close = this.src.indexOf(">", this.pos);
+			/* v8 ignore next -- an unterminated group name is a native syntax error */
+			if (close < 0) throw new Unsupported("unterminated group name");
+			this.pos = close + 1;
+		} else if (this.src[this.pos] === "?") throw new Unsupported("lookaround or group modifier");
+		const body = this.parseAlternation(depth + 1);
+		/* v8 ignore next -- an unterminated group is a native syntax error */
+		if (this.src[this.pos] !== ")") throw new Unsupported("unterminated group");
+		this.pos++;
+		return body;
+	}
+	parseClass() {
+		const start = this.pos;
+		this.pos++;
+		while (this.pos < this.src.length && this.src[this.pos] !== "]") this.pos += this.src[this.pos] === "\\" ? 2 : 1;
+		/* v8 ignore next -- an unterminated class is a native syntax error */
+		if (this.pos >= this.src.length) throw new Unsupported("unterminated class");
+		this.pos++;
+		return {
+			kind: "char",
+			source: this.src.slice(start, this.pos)
+		};
+	}
+	parseEscape() {
+		const next = this.src[this.pos + 1];
+		/* v8 ignore next -- a trailing backslash is a native syntax error */
+		if (next === void 0) throw new Unsupported("trailing backslash");
+		switch (next) {
+			case "b":
+				this.pos += 2;
+				return {
+					kind: "assert",
+					assertion: "wordBoundary"
+				};
+			case "B":
+				this.pos += 2;
+				return {
+					kind: "assert",
+					assertion: "notWordBoundary"
+				};
+			case "1":
+			case "2":
+			case "3":
+			case "4":
+			case "5":
+			case "6":
+			case "7":
+			case "8":
+			case "9":
+			case "k": throw new Unsupported("backreference");
+			case "0":
+				if (/[0-9]/.test(this.src[this.pos + 2] ?? "")) throw new Unsupported("octal escape");
+				return this.takeChar(2);
+			case "c":
+				if (!/[a-zA-Z]/.test(this.src[this.pos + 2] ?? "")) throw new Unsupported("incomplete control escape");
+				return this.takeChar(3);
+			case "p":
+			case "P":
+				if (this.unicode && this.src[this.pos + 2] === "{") return this.takeThrough("}");
+				return this.takeChar(2);
+			case "x": return this.takeChar(HEX2.test(this.src.slice(this.pos + 2, this.pos + 4)) ? 4 : 2);
+			case "u": return this.parseUnicodeEscape();
+			default: return this.takeChar(1 + this.codePointWidth(this.pos + 1));
+		}
+	}
+	parseUnicodeEscape() {
+		if (this.unicode && this.src[this.pos + 2] === "{") return this.takeThrough("}");
+		const hex = this.src.slice(this.pos + 2, this.pos + 6);
+		if (!HEX4.test(hex)) return this.takeChar(2);
+		const unit = parseInt(hex, 16);
+		if (this.unicode && unit >= 55296 && unit <= 56319 && this.src.startsWith("\\u", this.pos + 6)) {
+			const low = this.src.slice(this.pos + 8, this.pos + 12);
+			if (HEX4.test(low)) {
+				const lowUnit = parseInt(low, 16);
+				if (lowUnit >= 56320 && lowUnit <= 57343) return this.takeChar(12);
+			}
+		}
+		return this.takeChar(6);
+	}
+	takeChar(length) {
+		const source = this.src.slice(this.pos, this.pos + length);
+		this.pos += length;
+		return {
+			kind: "char",
+			source
+		};
+	}
+	takeThrough(terminator) {
+		const end = this.src.indexOf(terminator, this.pos);
+		/* v8 ignore next -- an unterminated `\p{` / `\u{` is a native syntax error */
+		if (end < 0) throw new Unsupported("unterminated escape");
+		return this.takeChar(end + 1 - this.pos);
+	}
+};
+var Compiler = class {
+	prog = [];
+	matchers = /* @__PURE__ */ new Map();
+	unicode;
+	budget;
+	steps = 0;
+	constructor(unicode, budget) {
+		this.unicode = unicode;
+		this.budget = budget;
+	}
+	emit(inst) {
+		if (this.prog.length >= 1e4) throw new Unsupported("pattern too complex");
+		if (this.budget && --this.budget.size < 0) throw new Unsupported(COMPILE_BUDGET_EXHAUSTED);
+		this.prog.push(inst);
+		return this.prog.length - 1;
+	}
+	matcher(source) {
+		let matcher = this.matchers.get(source);
+		if (!matcher) {
+			try {
+				matcher = new CharMatcher(source, this.unicode);
+			} catch {
+				/* v8 ignore start -- defensive: each atom is a slice the native constructor already accepted in context */
+				throw new Unsupported("unrecognized character syntax");
+			}
+			this.matchers.set(source, matcher);
+		}
+		return matcher;
+	}
+	compile(node) {
+		if (++this.steps > 1e5) throw new Unsupported("pattern too complex");
+		if (this.budget && --this.budget.steps < 0) throw new Unsupported(COMPILE_BUDGET_EXHAUSTED);
+		switch (node.kind) {
+			case "char":
+				this.emit({
+					op: "char",
+					matcher: this.matcher(node.source)
+				});
+				return;
+			case "assert":
+				this.emit({
+					op: "assert",
+					assertion: node.assertion
+				});
+				return;
+			case "seq":
+				for (const item of node.items) this.compile(item);
+				return;
+			case "alt":
+				this.compileAlternation(node.options);
+				return;
+			case "repeat":
+				this.compileRepeat(node.body, node.min, node.max);
+				return;
+		}
+	}
+	compileAlternation(options) {
+		const jumps = [];
+		for (let i = 0; i < options.length - 1; i++) {
+			const split = this.emit({
+				op: "split",
+				a: 0,
+				b: 0
+			});
+			this.patchSplit(split, split + 1, -1);
+			this.compile(options[i]);
+			jumps.push(this.emit({
+				op: "jmp",
+				to: 0
+			}));
+			this.patchSplit(split, -1, this.prog.length);
+		}
+		this.compile(options[options.length - 1]);
+		for (const jump of jumps) this.patchJump(jump, this.prog.length);
+	}
+	compileRepeat(body, min, max) {
+		for (let i = 0; i < min; i++) {
+			const before = this.prog.length;
+			this.compile(body);
+			if (this.prog.length === before) return;
+		}
+		if (max === Infinity) {
+			const split = this.emit({
+				op: "split",
+				a: 0,
+				b: 0
+			});
+			this.compile(body);
+			this.emit({
+				op: "jmp",
+				to: split
+			});
+			this.patchSplit(split, split + 1, this.prog.length);
+			return;
+		}
+		const splits = [];
+		for (let i = min; i < max; i++) {
+			const split = this.emit({
+				op: "split",
+				a: 0,
+				b: 0
+			});
+			this.patchSplit(split, split + 1, -1);
+			splits.push(split);
+			this.compile(body);
+		}
+		for (const split of splits) this.patchSplit(split, -1, this.prog.length);
+	}
+	patchSplit(at, a, b) {
+		const inst = this.prog[at];
+		if (a >= 0) inst.a = a;
+		if (b >= 0) inst.b = b;
+	}
+	patchJump(at, to) {
+		this.prog[at].to = to;
+	}
+};
+function isWordUnit(unit) {
+	return unit >= 48 && unit <= 57 || unit >= 65 && unit <= 90 || unit >= 97 && unit <= 122 || unit === 95;
+}
+var LinearRegExp = class {
+	anchoredStart;
+	prog;
+	unicode;
+	constructor(prog, unicode) {
+		this.prog = prog;
+		this.unicode = unicode;
+		const first = prog[0];
+		this.anchoredStart = first !== void 0 && first.op === "assert" && first.assertion === "start";
+	}
+	get size() {
+		return this.prog.length;
+	}
+	cost(input) {
+		return (input.length + 1) * this.prog.length;
+	}
+	search(input, budget) {
+		if (this.cost(input) > budget) return void 0;
+		const prog = this.prog;
+		const size = prog.length;
+		const mark = new Int32Array(size).fill(-1);
+		const stack = [];
+		let clist = new Int32Array(size);
+		let nlist = new Int32Array(size);
+		const add = (list, count, start, pos, generation) => {
+			stack.push(start);
+			while (stack.length > 0) {
+				const pc = stack.pop();
+				if (mark[pc] === generation) continue;
+				mark[pc] = generation;
+				const inst = prog[pc];
+				switch (inst.op) {
+					case "match":
+						stack.length = 0;
+						return -1;
+					case "jmp":
+						stack.push(inst.to);
+						break;
+					case "split":
+						stack.push(inst.b, inst.a);
+						break;
+					case "assert":
+						if (this.holds(inst.assertion, input, pos)) stack.push(pc + 1);
+						break;
+					case "char": list[count++] = pc;
+				}
+			}
+			return count;
+		};
+		let pos = 0;
+		let generation = 0;
+		let clen = add(clist, 0, 0, pos, generation);
+		if (clen < 0) return true;
+		while (pos < input.length) {
+			if (this.anchoredStart && clen === 0) return false;
+			const cp = this.unicode ? input.codePointAt(pos) : input.charCodeAt(pos);
+			const next = pos + (this.unicode && cp > 65535 ? 2 : 1);
+			generation++;
+			let nlen = 0;
+			for (let i = 0; i < clen; i++) {
+				const pc = clist[i];
+				if (prog[pc].matcher.matches(cp, this.unicode)) {
+					nlen = add(nlist, nlen, pc + 1, next, generation);
+					if (nlen < 0) return true;
+				}
+			}
+			nlen = add(nlist, nlen, 0, next, generation);
+			if (nlen < 0) return true;
+			[clist, nlist] = [nlist, clist];
+			clen = nlen;
+			pos = next;
+		}
+		return false;
+	}
+	holds(assertion, input, pos) {
+		switch (assertion) {
+			case "start": return pos === 0;
+			case "end": return pos === input.length;
+			case "wordBoundary":
+			case "notWordBoundary": return (pos > 0 && isWordUnit(input.charCodeAt(pos - 1))) !== (pos < input.length && isWordUnit(input.charCodeAt(pos))) === (assertion === "wordBoundary");
+		}
+	}
+};
+function compileLinearRegExp(pattern, unicode, budget) {
+	if (pattern.length > 8192) return {
+		ok: false,
+		reason: `pattern longer than ${MAX_PATTERN_LENGTH} characters`
+	};
+	if (budget) {
+		budget.steps -= pattern.length;
+		if (isCompileBudgetExhausted(budget)) return {
+			ok: false,
+			reason: COMPILE_BUDGET_EXHAUSTED
+		};
+	}
+	new RegExp(pattern, unicode ? "u" : "");
+	try {
+		const ast = new Parser(pattern, unicode).parse();
+		const compiler = new Compiler(unicode, budget);
+		compiler.compile(ast);
+		compiler.prog.push({ op: "match" });
+		return {
+			ok: true,
+			regExp: new LinearRegExp(compiler.prog, unicode)
+		};
+	} catch (error) {
+		/* v8 ignore next -- every throw inside the parser/compiler is an Unsupported */
+		if (!(error instanceof Unsupported)) throw error;
+		return {
+			ok: false,
+			reason: error.message
+		};
+	}
+}
+//#endregion
+//#region ../../core/mcp/linearPatternValidator.ts
+const PATTERN_EVALUATION_BUDGET = 2e7;
+const SCHEMA_COMPILE_BUDGET = {
+	steps: 10 * MAX_COMPILE_STEPS,
+	size: 10 * MAX_PROGRAM_SIZE
+};
+const MAX_QUOTED_PATTERN = 120;
+const DRAFT_2020_12 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2020-12/schema", "http://json-schema.org/draft/2020-12/schema"]);
+const DRAFT_2019_09 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2019-09/schema", "http://json-schema.org/draft/2019-09/schema"]);
+const DRAFT_07_OR_06 = /* @__PURE__ */ new Set([
+	"https://json-schema.org/draft-07/schema",
+	"http://json-schema.org/draft-07/schema",
+	"https://json-schema.org/draft-06/schema",
+	"http://json-schema.org/draft-06/schema"
+]);
+function declaredDialect(schema) {
+	const declared = schema.$schema;
+	if (typeof declared !== "string") return "2020-12";
+	const uri = declared.replace(/#$/, "");
+	if (DRAFT_2020_12.has(uri)) return "2020-12";
+	if (DRAFT_2019_09.has(uri)) return "2019-09";
+	if (DRAFT_07_OR_06.has(uri)) return "draft-7";
+	throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${declared.slice(0, 200)}"). Supported: JSON Schema 2020-12, 2019-09, draft-07, and draft-06.`);
+}
+function quote(pattern) {
+	return pattern.length > MAX_QUOTED_PATTERN ? `${pattern.slice(0, MAX_QUOTED_PATTERN)}…` : pattern;
+}
+var PatternLedger = class {
+	remaining = PATTERN_EVALUATION_BUDGET;
+	unevaluated = /* @__PURE__ */ new Set();
+	reset() {
+		this.remaining = PATTERN_EVALUATION_BUDGET;
+		this.unevaluated.clear();
+	}
+};
+var LinearPattern = class {
+	source;
+	flags;
+	compiled;
+	ledger;
+	constructor(source, flags, compiled, ledger) {
+		this.source = source;
+		this.flags = flags;
+		this.compiled = compiled;
+		this.ledger = ledger;
+	}
+	test(input) {
+		if (!this.compiled.ok) return this.skip(this.compiled.reason);
+		const { regExp } = this.compiled;
+		const cost = regExp.cost(input);
+		if (cost > this.ledger.remaining) return this.skip(`checking a ${input.length}-character value would exceed the evaluation budget`);
+		this.ledger.remaining -= cost;
+		return regExp.search(input, cost) === true;
+	}
+	skip(reason) {
+		this.ledger.unevaluated.add(`pattern "${quote(this.source)}" was not evaluated (${reason})`);
+		return true;
+	}
+	toString() {
+		return `/${this.source}/${this.flags}`;
+	}
+};
+function createRegExpEngine(ledger, budget) {
+	const engine = (pattern, flags) => new LinearPattern(pattern, flags, compileLinearRegExp(pattern, flags.includes("u"), budget()), ledger);
+	return Object.assign(engine, { code: "linearRegExp" });
+}
+var LinearPatternJsonSchemaValidator = class {
+	ledger = new PatternLedger();
+	engines = /* @__PURE__ */ new Map();
+	compileBudget = { ...SCHEMA_COMPILE_BUDGET };
+	overBudget = /* @__PURE__ */ new WeakSet();
+	engineFor(dialect) {
+		let engine = this.engines.get(dialect);
+		if (!engine) {
+			const options = {
+				strict: false,
+				validateFormats: true,
+				validateSchema: false,
+				allErrors: true,
+				code: { regExp: createRegExpEngine(this.ledger, () => this.compileBudget) }
+			};
+			engine = dialect === "2020-12" ? new Ajv2020(options) : dialect === "2019-09" ? new Ajv2019(options) : new Ajv(options);
+			addFormats(engine);
+			this.engines.set(dialect, engine);
+		}
+		return engine;
+	}
+	getValidator(schema) {
+		const engine = this.engineFor(declaredDialect(schema));
+		const id = schema.$id;
+		const validate = this.tracked(() => (typeof id === "string" ? engine.getSchema(id) : void 0) ?? engine.compile(schema));
+		const overBudget = this.overBudget.has(validate);
+		return (input) => {
+			this.ledger.reset();
+			const valid = validate(input);
+			const unevaluated = [...this.ledger.unevaluated];
+			if (overBudget) unevaluated.unshift("the schema's patterns exceed the compilation budget");
+			if (valid && unevaluated.length === 0) return {
+				valid: true,
+				data: input,
+				errorMessage: void 0
+			};
+			const messages = valid ? [] : [engine.errorsText(validate.errors)];
+			if (unevaluated.length > 0) messages.push(`${unevaluated.join("; ")}, so the value could not be verified against the schema`);
+			return {
+				valid: false,
+				data: void 0,
+				errorMessage: messages.join("; ")
+			};
+		};
+	}
+	tracked(run) {
+		const outer = this.compileBudget;
+		const budget = { ...SCHEMA_COMPILE_BUDGET };
+		this.compileBudget = budget;
+		try {
+			const validate = run();
+			if (isCompileBudgetExhausted(budget)) this.overBudget.add(validate);
+			return validate;
+		} finally {
+			this.compileBudget = outer;
+		}
+	}
+};
 function listPaginationExceeded(method) {
 	return /* @__PURE__ */ new Error(`Salvage walk for ${method} exceeded 64 pages without the server's pagination converging`);
 }
@@ -8333,6 +8966,16 @@ var RemoteClientTransport = class {
 		}
 		return await res.json();
 	}
+	releaseOnPageHide() {
+		if (!this._sessionId) return false;
+		this.fetchFn(`${this.baseUrl}/api/mcp/disconnect`, {
+			method: "POST",
+			headers: this.headers,
+			body: JSON.stringify({ sessionId: this._sessionId }),
+			keepalive: true
+		}).catch(() => {});
+		return true;
+	}
 	async close() {
 		if (this.closed) return;
 		this.closed = true;
@@ -9270,7 +9913,7 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 				params: request.params,
 				signal: controller.signal
 			});
-			this.outputValidator ??= new AjvJsonSchemaValidator();
+			this.outputValidator ??= new LinearPatternJsonSchemaValidator();
 			const invalid = validateAppElicitResult(this.outputValidator, request.params, result);
 			if (invalid) {
 				this.logger.warn({
@@ -9869,7 +10512,7 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 		});
 	}
 	validateToolOutput(tool, result) {
-		this.outputValidator ??= new AjvJsonSchemaValidator();
+		this.outputValidator ??= new LinearPatternJsonSchemaValidator();
 		return validateToolOutput(this.outputValidator, tool, result);
 	}
 	cancelPendingTaskInput(taskId) {
@@ -10716,6 +11359,10 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 	getRemoteBackendSessionId() {
 		if (this.baseTransport instanceof RemoteClientTransport) return this.baseTransport.getRemoteBackendSessionId();
 	}
+	releaseRemoteSessionOnPageHide() {
+		if (this.baseTransport instanceof RemoteClientTransport) return this.baseTransport.releaseOnPageHide();
+		return false;
+	}
 	async resumeAfterOAuth(authorizationCode, options) {
 		await this.completeOAuthFlow(authorizationCode, options?.iss, options?.state);
 		const remoteSessionId = options?.remoteSessionId;
@@ -11757,6 +12404,18 @@ function useManagedTools(client, managedToolsState) {
 	};
 }
 //#endregion
+//#region ../../core/mcp/toolOrder.ts
+const toolLabelCollator = new Intl.Collator(void 0, {
+	sensitivity: "base",
+	numeric: true
+});
+function compareToolLabels(a, b) {
+	return toolLabelCollator.compare(a, b);
+}
+function compareToolsByName(a, b) {
+	return compareToolLabels(a.name, b.name);
+}
+//#endregion
 //#region ../../core/react/useManagedResources.ts
 const NO_RESOURCES = [];
 const readResources = (state) => state.getResources();
@@ -13449,21 +14108,38 @@ var NodeOAuthStorage = class extends OAuthStorageBase {
 //#region ../../core/auth/node/oauth-callback-server.ts
 const DEFAULT_HOSTNAME = "127.0.0.1";
 const DEFAULT_CALLBACK_PATH = "/oauth/callback";
-const SUCCESS_HTML = `<!DOCTYPE html>
-<html>
-<head><meta charset="utf-8"><title>OAuth complete</title></head>
-<body><p>OAuth complete. You can close this window.</p></body>
-</html>`;
-function errorHtml(message) {
+const SUCCESS_HTML = page("OAuth complete", "OAuth complete. You can close this window.");
+const NOT_CALLBACK_HTML = page("Not the OAuth callback", "This address is not the OAuth callback the Inspector is waiting for. Sign-in has not finished; return to the Inspector to continue.");
+const STATE_MISMATCH_HTML = page("OAuth callback ignored", "This callback does not belong to the sign-in in progress and was ignored. Sign-in has not finished; the Inspector is still waiting for the authorization server.");
+const ALREADY_HANDLED_HTML = page("OAuth callback already received", "This sign-in has already received its callback. You can close this window.");
+const STOPPED_HTML = page("OAuth callback not expected", "The Inspector is no longer waiting for this sign-in. Start sign-in again from the Inspector.");
+function errorHtml(serverText) {
+	return page("OAuth error", `OAuth failed. The authorization server said: ${serverText}`);
+}
+function exchangeErrorHtml(message) {
+	return page("OAuth error", `OAuth failed: ${message}`);
+}
+function page(title, text) {
 	return `<!DOCTYPE html>
 <html>
-<head><meta charset="utf-8"><title>OAuth error</title></head>
-<body><p>OAuth failed: ${escapeHtml(message)}</p></body>
+<head><meta charset="utf-8"><title>${escapeHtml(title)}</title></head>
+<body><p>${escapeHtml(text)}</p></body>
 </html>`;
 }
 function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+const ANY_STATE = Symbol("any-state");
+const STOPPED = Symbol("stopped");
+function createStopSignal() {
+	let fire;
+	return {
+		stopped: new Promise((resolve) => {
+			fire = () => resolve(STOPPED);
+		}),
+		fire
+	};
+}
 var OAuthCallbackServer = class {
 	server = null;
 	port = 0;
@@ -13471,6 +14147,8 @@ var OAuthCallbackServer = class {
 	handled = false;
 	onCallback;
 	onError;
+	expectedState = Promise.resolve(ANY_STATE);
+	stopSignal = createStopSignal();
 	async start(options = {}) {
 		const { port = 0, hostname = DEFAULT_HOSTNAME, path = DEFAULT_CALLBACK_PATH, onCallback, onError } = options;
 		if (!path.startsWith("/")) return Promise.reject(/* @__PURE__ */ new Error("Callback path must start with '/' (absolute path)"));
@@ -13478,6 +14156,8 @@ var OAuthCallbackServer = class {
 		this.onError = onError;
 		this.handled = false;
 		this.callbackPath = path;
+		this.stopSignal = createStopSignal();
+		this.expectedState = "expectedState" in options ? Promise.race([Promise.resolve(options.expectedState).catch(() => STOPPED), this.stopSignal.stopped]) : Promise.resolve(ANY_STATE);
 		return new Promise((resolve, reject) => {
 			this.server = createServer((req, res) => this.handleRequest(req, res));
 			this.server.on("error", reject);
@@ -13501,6 +14181,7 @@ var OAuthCallbackServer = class {
 	}
 	async stop() {
 		if (!this.server) return;
+		this.stopSignal.fire();
 		await new Promise((resolve) => {
 			this.server.close(() => resolve());
 		});
@@ -13509,11 +14190,14 @@ var OAuthCallbackServer = class {
 	handleRequest(req, res) {
 		const needJson = req.headers["accept"]?.includes("application/json");
 		const send = (status, body, contentType = "text/html; charset=utf-8") => {
-			res.writeHead(status, { "Content-Type": contentType });
+			res.writeHead(status, {
+				"Content-Type": contentType,
+				Connection: "close"
+			});
 			res.end(body);
 		};
 		if (req.method !== "GET") {
-			send(405, needJson ? "{\"error\":\"Method Not Allowed\"}" : SUCCESS_HTML);
+			send(405, needJson ? "{\"error\":\"Method Not Allowed\"}" : NOT_CALLBACK_HTML);
 			return;
 		}
 		let pathname;
@@ -13530,15 +14214,26 @@ var OAuthCallbackServer = class {
 			search = u.search;
 			state = u.searchParams.get("state") ?? void 0;
 		} catch {
-			send(400, needJson ? "{\"error\":\"Bad Request\"}" : SUCCESS_HTML);
+			send(400, needJson ? "{\"error\":\"Bad Request\"}" : NOT_CALLBACK_HTML);
 			return;
 		}
 		if (pathname !== this.callbackPath) {
-			send(404, needJson ? "{\"error\":\"Not Found\"}" : SUCCESS_HTML);
+			send(404, needJson ? "{\"error\":\"Not Found\"}" : NOT_CALLBACK_HTML);
+			return;
+		}
+		this.expectedState.then((expected) => this.handleCallback(expected, state, search, needJson, send));
+	}
+	handleCallback(expected, state, search, needJson, send) {
+		if (expected === STOPPED) {
+			send(503, needJson ? "{\"error\":\"Not waiting for a callback\"}" : STOPPED_HTML);
+			return;
+		}
+		if (expected !== ANY_STATE && state !== expected) {
+			send(400, needJson ? "{\"error\":\"State mismatch\"}" : STATE_MISMATCH_HTML);
 			return;
 		}
 		if (this.handled) {
-			send(409, needJson ? "{\"error\":\"Callback already handled\"}" : SUCCESS_HTML);
+			send(409, needJson ? "{\"error\":\"Callback already handled\"}" : ALREADY_HANDLED_HTML);
 			return;
 		}
 		const params = parseOAuthCallbackParams(search);
@@ -13556,9 +14251,10 @@ var OAuthCallbackServer = class {
 				const msg = err instanceof Error ? err.message : String(err);
 				this.onError?.({
 					error: "callback_error",
-					error_description: msg
+					error_description: msg,
+					source: "callback"
 				});
-				send(500, errorHtml(msg));
+				send(500, exchangeErrorHtml(msg));
 				this.stop();
 			});
 			else {
@@ -13571,7 +14267,8 @@ var OAuthCallbackServer = class {
 		const msg = generateOAuthErrorDescription(params);
 		this.onError?.({
 			error: params.error,
-			error_description: params.error_description ?? void 0
+			error_description: params.error_description ?? void 0,
+			source: "redirect"
 		});
 		send(400, errorHtml(msg));
 	}
@@ -13590,6 +14287,14 @@ function toRunnerOAuthError(err) {
 	}
 	return err instanceof Error ? err : new Error(String(err));
 }
+function stateOf(authorizationUrl) {
+	return authorizationUrl.searchParams.get("state") ?? void 0;
+}
+function callbackErrorMessage(params) {
+	if (params.source === "callback") return params.error_description ?? "OAuth callback failed";
+	if (!params.error && !params.error_description) return "OAuth error";
+	return `OAuth authorization failed. The authorization server said: ${params.error_description ? `${params.error_description} (${params.error})` : params.error}`;
+}
 async function runRunnerInteractiveOAuth(options) {
 	const server = (options.createCallbackServer ?? createOAuthCallbackServer)();
 	let flowResolve;
@@ -13619,11 +14324,16 @@ async function runRunnerInteractiveOAuth(options) {
 		process.on("SIGTERM", onSignal);
 	}
 	let timeoutId;
+	let resolveExpectedState;
+	const expectedState = new Promise((resolve) => {
+		resolveExpectedState = resolve;
+	});
 	try {
 		const { redirectUrl } = await racingSignals(server.start({
 			hostname: options.callbackListen.hostname,
 			port: options.callbackListen.port,
 			path: options.callbackListen.pathname,
+			expectedState,
 			onCallback: async (params) => {
 				try {
 					await options.client.completeOAuthFlow(params.code, params.iss, params.state);
@@ -13633,10 +14343,7 @@ async function runRunnerInteractiveOAuth(options) {
 				}
 			},
 			onError: (params) => {
-				flowReject(new Error(
-					/* v8 ignore next -- params.error is a required non-null string, so the "OAuth error" fallback is unreachable */
-					params.error_description ?? params.error ?? "OAuth error"
-				));
+				flowReject(new Error(callbackErrorMessage(params)));
 			}
 		}));
 		options.onCallbackServer?.(server);
@@ -13652,10 +14359,16 @@ async function runRunnerInteractiveOAuth(options) {
 		})]);
 		waitForCallback.catch(() => {});
 		if (options.authorizationUrl) {
+			resolveExpectedState(stateOf(options.authorizationUrl));
 			await racingSignals(options.client.beginInteractiveAuthorization(options.authorizationUrl));
 			await waitForCallback;
-		} else if (await racingSignals(options.client.authenticate()) !== void 0) await waitForCallback;
-		else return { kind: "already_authorized" };
+		} else {
+			const authUrl = await racingSignals(options.client.authenticate());
+			if (authUrl !== void 0) {
+				resolveExpectedState(stateOf(authUrl));
+				await waitForCallback;
+			} else return { kind: "already_authorized" };
+		}
 		if (options.authChallenge) {
 			if (!await racingSignals(options.client.checkAuthChallengeSatisfied(options.authChallenge, { scopeOnly: true }))) return {
 				kind: "insufficient_scope",
@@ -14965,7 +15678,7 @@ function useSelectableList(itemCount, visibleCount, options) {
 	]);
 	return {
 		selectedIndex,
-		firstVisible,
+		firstVisible: clampFirstVisible(firstVisible, selectedIndex, visibleCount),
 		setSelection
 	};
 }
@@ -15277,7 +15990,10 @@ function ResourcesTab({ resources, resourceTemplates = [], inspectorClient, widt
 						return /* @__PURE__ */ jsx(Box, {
 							paddingY: 0,
 							flexShrink: 0,
-							children: /* @__PURE__ */ jsxs(Text, { children: [isSelected ? "▶ " : "  ", label] })
+							children: /* @__PURE__ */ jsxs(Text, {
+								wrap: "truncate-end",
+								children: [isSelected ? "▶ " : "  ", label]
+							})
 						}, key);
 					})
 				})
@@ -15561,7 +16277,10 @@ function PromptsTab({ prompts, inspectorClient, width, height, focusedPane = nul
 						return /* @__PURE__ */ jsx(Box, {
 							paddingY: 0,
 							flexShrink: 0,
-							children: /* @__PURE__ */ jsxs(Text, { children: [isSelected ? "▶ " : "  ", prompt.name || `Prompt ${ordinal + 1}`] })
+							children: /* @__PURE__ */ jsxs(Text, {
+								wrap: "truncate-end",
+								children: [isSelected ? "▶ " : "  ", prompt.name || `Prompt ${ordinal + 1}`]
+							})
 						}, `${ordinal}:${prompt.name}`);
 					})
 				})
@@ -16603,17 +17322,19 @@ function ToolsTab({ tools, isConnected, width, height, focusedPane = null, onTes
 						const isSelected = index === selectedIndex;
 						const marker = schemaMarker(findingsByTool.get(tool));
 						const ordinal = filter.indices[index];
-						return /* @__PURE__ */ jsx(Box, {
+						return /* @__PURE__ */ jsxs(Box, {
 							paddingY: 0,
 							flexShrink: 0,
-							children: /* @__PURE__ */ jsxs(Text, { children: [
-								isSelected ? "▶ " : "  ",
-								tool.name || `Tool ${ordinal + 1}`,
-								marker && /* @__PURE__ */ jsxs(Text, {
+							children: [/* @__PURE__ */ jsxs(Text, {
+								wrap: "truncate-end",
+								children: [isSelected ? "▶ " : "  ", tool.name || `Tool ${ordinal + 1}`]
+							}), marker && /* @__PURE__ */ jsx(Box, {
+								flexShrink: 0,
+								children: /* @__PURE__ */ jsxs(Text, {
 									color: marker.color,
 									children: [" ", marker.glyph]
 								})
-							] })
+							})]
 						}, `${ordinal}:${tool.name}`);
 					})
 				})
@@ -16628,18 +17349,23 @@ function ToolsTab({ tools, isConnected, width, height, focusedPane = null, onTes
 				/* @__PURE__ */ jsxs(Box, {
 					flexShrink: 0,
 					flexDirection: "row",
+					flexWrap: "wrap",
 					justifyContent: "space-between",
+					columnGap: 1,
 					paddingTop: 1,
 					children: [/* @__PURE__ */ jsx(Text, {
 						bold: true,
 						backgroundColor: focusedPane === "details" ? "yellow" : void 0,
 						...focusedPane === "details" ? {} : { color: "cyan" },
 						children: selectedTool.name
-					}), isConnected && /* @__PURE__ */ jsx(Text, { children: /* @__PURE__ */ jsx(Text, {
-						color: "cyan",
-						bold: true,
-						children: "[Enter to Test]"
-					}) })]
+					}), isConnected && /* @__PURE__ */ jsx(Box, {
+						flexShrink: 0,
+						children: /* @__PURE__ */ jsx(Text, {
+							color: "cyan",
+							bold: true,
+							children: "[Enter to Test]"
+						})
+					})]
 				}),
 				/* @__PURE__ */ jsxs(ScrollView, {
 					ref: scrollViewRef,
@@ -18739,6 +19465,14 @@ function missingRequiredFields(schema, decoded, rawValues = {}) {
 	});
 }
 //#endregion
+//#region src/utils/formHeader.ts
+function untitledForm(form) {
+	return {
+		...form,
+		title: void 0
+	};
+}
+//#endregion
 //#region ../../core/mcp/resultFile.ts
 var RawResultUnavailableError = class extends Error {
 	method;
@@ -19116,7 +19850,7 @@ function ToolTestModal({ tool, inspectorClient, width, height, onClose, onAuthRe
 						flexGrow: 1,
 						width: "100%",
 						children: /* @__PURE__ */ jsx(Form, {
-							form: formStructure,
+							form: untitledForm(formStructure),
 							onSubmit: (value) => void handleFormSubmit(value)
 						})
 					}),
@@ -19408,7 +20142,7 @@ function ResourceTestModal({ template, inspectorClient, width, height, onClose,
 								children: template.description
 							})
 						}), /* @__PURE__ */ jsx(Form, {
-							form: formStructure,
+							form: untitledForm(formStructure),
 							onSubmit: (values) => handleFormSubmit(values)
 						})]
 					}),
@@ -19705,7 +20439,7 @@ function PromptTestModal({ prompt, inspectorClient, width, height, onClose, onAu
 								children: prompt.description
 							})
 						}), /* @__PURE__ */ jsx(Form, {
-							form: formStructure,
+							form: untitledForm(formStructure),
 							onSubmit: (values) => handleFormSubmit(values)
 						})]
 					}),
@@ -21341,6 +22075,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 	const { fetchRequests: inspectorFetchRequests } = useFetchRequestLog(selectedFetchRequestLogState);
 	const { stderrLogs: inspectorStderrLogs } = useStderrLog(selectedStderrLogState);
 	const { tools: managedTools } = useManagedTools(selectedInspectorClient, useMemo(() => selectedServer && managedToolsStates[selectedServer] ? managedToolsStates[selectedServer] : null, [selectedServer, managedToolsStates]));
+	const sortedTools = useMemo(() => [...managedTools].sort(compareToolsByName), [managedTools]);
 	const selectedManagedResourcesState = useMemo(() => selectedServer && managedResourcesStates[selectedServer] ? managedResourcesStates[selectedServer] : null, [selectedServer, managedResourcesStates]);
 	const selectedManagedResourceTemplatesState = useMemo(() => selectedServer && managedResourceTemplatesStates[selectedServer] ? managedResourceTemplatesStates[selectedServer] : null, [selectedServer, managedResourceTemplatesStates]);
 	const selectedManagedPromptsState = useMemo(() => selectedServer && managedPromptsStates[selectedServer] ? managedPromptsStates[selectedServer] : null, [selectedServer, managedPromptsStates]);
@@ -21640,7 +22375,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 			resources: managedResources,
 			resourceTemplates: managedResourceTemplates,
 			prompts: managedPrompts,
-			tools: managedTools,
+			tools: sortedTools,
 			stderrLogs: inspectorStderrLogs
 		};
 	}, [
@@ -21654,7 +22389,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 		managedResources,
 		managedResourceTemplates,
 		managedPrompts,
-		managedTools,
+		sortedTools,
 		inspectorStderrLogs
 	]);
 	const renderResourceDetails = (resource) => /* @__PURE__ */ jsxs(Fragment, { children: [