@modelcontextprotocol/inspector 2.13.0 → 2.15.0

package/clients/tui/build/index.js

@@ -31,7 +31,10 @@ import { runtimeCodecFromStandardSchema, taskId, toJsonValue } from "@modelconte
 import { CallToolResultSchema, ElicitResultSchema, EmptyResultSchema, GetPromptResultSchema, ListPromptsResultSchema, ListResourceTemplatesResultSchema, ListResourcesResultSchema, ListToolsResultSchema, NotificationSchema, OAuthClientInformationSchema, OAuthMetadataSchema, OAuthTokensSchema, OpenIdProviderDiscoveryMetadataSchema, ProgressTokenSchema, PromptSchema, ReadResourceResultSchema, RequestMetaSchema, ResourceSchema, ResourceTemplateSchema, TaskStatusNotificationSchema, ToolSchema } from "@modelcontextprotocol/core";
 import { TASKS_EXTENSION_ID_V2 as TASKS_EXTENSION_KEY } from "@modelcontextprotocol/ext-tasks/core/v2";
 import { RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/app-bridge";
-import { AjvJsonSchemaValidator } from "@modelcontextprotocol/client/validators/ajv";
+import Ajv from "ajv";
+import { Ajv2019 } from "ajv/dist/2019.js";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { addFormats } from "@modelcontextprotocol/client/validators/ajv";
 import { createServer } from "node:http";
 import pino from "pino";
 import open from "open";
@@ -40,15 +43,14 @@ import os from "node:os";
 import process$1 from "node:process";
 import tty from "node:tty";
 import { isDeepStrictEqual } from "node:util";
-//#region ../../core/storage/store-serialize.ts
+// ../../core/storage/store-serialize.ts
 function serializeStore(data) {
 	return JSON.stringify(data, null, 2);
 }
 function parseStore(raw) {
 	return JSON.parse(raw);
 }
-//#endregion
-//#region ../../core/storage/store-io.ts
+// ../../core/storage/store-io.ts
 function getDefaultStorageDir() {
 	const homeDir = process.env.HOME || process.env.USERPROFILE || ".";
 	return path$1.join(homeDir, ".mcp-inspector", "storage");
@@ -94,8 +96,7 @@ async function deleteStoreFile(filePath) {
 		if (error.code !== "ENOENT") throw error;
 	}
 }
-//#endregion
-//#region ../../core/mcp/types.ts
+// ../../core/mcp/types.ts
 function isTerminalStatus(status) {
 	return status === "disconnected" || status === "error";
 }
@@ -133,8 +134,7 @@ function eraToVersionNegotiation(era) {
 		case "legacy": return { mode: "legacy" };
 	}
 }
-//#endregion
-//#region ../../core/extension/skills/schemas.ts
+// ../../core/extension/skills/schemas.ts
 const CACHE_FIELDS = {
 	ttlMs: ReadResourceDirectoryResultSchema.shape.ttlMs,
 	cacheScope: SkillCacheScopeSchema
@@ -167,8 +167,7 @@ const DirectoryReadResultSchema = ReadResourceDirectoryResultSchema.partial({
 	ttlMs: true,
 	cacheScope: true
 });
-//#endregion
-//#region ../../core/extension/skills/sha256.ts
+// ../../core/extension/skills/sha256.ts
 const K = new Uint32Array([
 	1116352408,
 	1899447441,
@@ -294,8 +293,7 @@ function sha256Bytes(bytes) {
 	for (let i = 0; i < 8; i += 1) out.setUint32(i * 4, h[i]);
 	return digest;
 }
-//#endregion
-//#region ../../core/extension/skills/skillFile.ts
+// ../../core/extension/skills/skillFile.ts
 function splitSkillFile(text) {
 	if (!/^---[ \t]*\r?\n/.test(text)) return { body: text };
 	const rest = text.slice(text.indexOf("\n") + 1);
@@ -343,8 +341,7 @@ function parseSkillFrontmatter(yamlText) {
 	if (graphError) return { error: graphError };
 	return { fields: parsed };
 }
-//#endregion
-//#region ../../core/extension/skills/conformance.ts
+// ../../core/extension/skills/conformance.ts
 const SKILL_MAX_RESOURCE_ENTRIES = SKILL_LIMITS.files;
 const SKILL_MAX_TOTAL_BYTES = SKILL_LIMITS.bytes;
 const SKILL_MAX_CATALOG_BYTES = 67108864;
@@ -702,13 +699,11 @@ function checkSkillNameCollisions(entries) {
 	}
 	return issues;
 }
-//#endregion
-//#region ../../core/auth/secret-fields.ts
+// ../../core/auth/secret-fields.ts
 const SECRET_FIELD_OAUTH_CLIENT_SECRET = "oauth-client-secret";
 const SECRET_FIELD_IDP_CLIENT_SECRET = "idp-client-secret";
 const envSecretField = (envKey) => `env:${envKey}`;
-//#endregion
-//#region ../../core/json/localRefs.ts
+// ../../core/json/localRefs.ts
 const SUBSCHEMA_KEYWORDS$1 = /* @__PURE__ */ new Set([
 	"items",
 	"contains",
@@ -863,8 +858,7 @@ function inlineLocalRefs(schema) {
 	cache.set(schema, resolved);
 	return resolved;
 }
-//#endregion
-//#region ../../core/json/nullableUnion.ts
+// ../../core/json/nullableUnion.ts
 const RENDERABLE_TYPES = [
 	"string",
 	"number",
@@ -1017,8 +1011,7 @@ function normalizeNullableUnion(schema) {
 	}
 	return schema;
 }
-//#endregion
-//#region ../../core/json/rootUnion.ts
+// ../../core/json/rootUnion.ts
 function membersOf(value) {
 	return Array.isArray(value) ? value : [];
 }
@@ -1238,8 +1231,7 @@ function narrowBySuppliedNames(branches, candidates, suppliedNames) {
 	const named = new Set(suppliedNames.map((name) => exclusiveTo.get(name)).filter((index) => index !== void 0 && index >= 0));
 	return named.size === 1 ? [...named][0] : null;
 }
-//#endregion
-//#region ../../core/json/jsonUtils.ts
+// ../../core/json/jsonUtils.ts
 function isSerializableJson(value) {
 	if (value === null) return true;
 	switch (typeof value) {
@@ -1340,8 +1332,7 @@ function convertPromptArguments(args) {
 	else stringArgs[key] = JSON.stringify(value);
 	return stringArgs;
 }
-//#endregion
-//#region ../../core/mcp/serverList.ts
+// ../../core/mcp/serverList.ts
 const VALID_SERVER_TYPES = /* @__PURE__ */ new Set([
 	"stdio",
 	"sse",
@@ -1607,8 +1598,15 @@ function expectedSecretFields(stored) {
 	if (isStdioStored(stored) && stored.env) for (const k of Object.keys(stored.env)) fields.push(envSecretField(k));
 	return fields;
 }
-//#endregion
-//#region ../../core/storage/own-entry.ts
+function adHocServerName(config) {
+	if (config.type === "sse" || config.type === "streamable-http") try {
+		return new URL(config.url).host || "server";
+	} catch {
+		return "server";
+	}
+	return config.command?.split(/[\\/]/).pop() || "server";
+}
+// ../../core/storage/own-entry.ts
 function setOwnEntry(map, key, value) {
 	Object.defineProperty(map, key, {
 		value,
@@ -1620,8 +1618,7 @@ function setOwnEntry(map, key, value) {
 function getOwnEntry(map, key) {
 	return map !== void 0 && Object.hasOwn(map, key) ? map[key] : void 0;
 }
-//#endregion
-//#region ../../core/mcp/node/config.ts
+// ../../core/mcp/node/config.ts
 function parseKeyValuePair(value, previous = {}) {
 	const parts = value.split("=");
 	const key = parts[0] ?? "";
@@ -1812,8 +1809,7 @@ function resolveServerConfigs(options, mode) {
 	}
 	return [];
 }
-//#endregion
-//#region ../../core/auth/secret-storage-info.ts
+// ../../core/auth/secret-storage-info.ts
 function secretStorageLabel(info) {
 	switch (info.kind) {
 		case "keyring": return "OS keychain";
@@ -1840,8 +1836,7 @@ function secretStorageSummary(info) {
 	if (info.reason === "fallback") parts.push("— fell back from the OS keychain");
 	return parts.join(" ");
 }
-//#endregion
-//#region ../../core/auth/node/secret-store.ts
+// ../../core/auth/node/secret-store.ts
 const SERVICE_NAME = "mcp-inspector";
 let keyringLoad;
 var KeyringModuleShapeError = class extends Error {
@@ -2061,8 +2056,7 @@ var SessionSecretStore = class extends InMemorySecretStore {
 		return false;
 	}
 };
-//#endregion
-//#region ../../core/auth/node/file-lock.ts
+// ../../core/auth/node/file-lock.ts
 const STALE_MS = 1e4;
 const RETRY = {
 	retries: 20,
@@ -2194,8 +2188,7 @@ async function withSecretFileLock(filePath, fn) {
 		await release();
 	}
 }
-//#endregion
-//#region ../../core/auth/node/file-secret-store.ts
+// ../../core/auth/node/file-secret-store.ts
 const scrypt = (passphrase, salt, keylen, options) => new Promise((resolve, reject) => {
 	crypto$1.scrypt(passphrase, salt, keylen, options, (err, key) => {
 		/* v8 ignore next -- @preserve: node validates the cost parameters
@@ -2603,8 +2596,7 @@ async function readSecretFilePermissions(filePath) {
 		};
 	}
 }
-//#endregion
-//#region ../../core/auth/node/secret-store-selection.ts
+// ../../core/auth/node/secret-store-selection.ts
 const SECRET_STORE_ENV = "MCP_INSPECTOR_SECRET_STORE";
 const SECRET_FILE_ENV = "MCP_INSPECTOR_SECRET_FILE";
 const STORAGE_DIR_ENV = "MCP_STORAGE_DIR";
@@ -2911,8 +2903,7 @@ function defaultSecretStore() {
 async function resolveConcreteSecretStore(store) {
 	return store instanceof DeferredSecretStore ? (await resolveSecretStore()).store : store;
 }
-//#endregion
-//#region ../../core/mcp/node/server-secrets.ts
+// ../../core/mcp/node/server-secrets.ts
 async function rehydrateMcpConfigFromKeychain(config, secretStore) {
 	const entries = Object.entries(config.mcpServers);
 	const secrets = await secretStoreGetMany(secretStore, entries.map(([serverId, stored]) => ({
@@ -2923,8 +2914,7 @@ async function rehydrateMcpConfigFromKeychain(config, secretStore) {
 	for (const [id, stored] of entries) out.mcpServers[id] = mergeSecretsIntoStored(stored, secrets[id] ?? {});
 	return out;
 }
-//#endregion
-//#region ../../core/mcp/node/servers.ts
+// ../../core/mcp/node/servers.ts
 function headersToServerSettings(headers) {
 	if (!headers || Object.keys(headers).length === 0) return;
 	return {
@@ -2996,13 +2986,13 @@ async function loadServerEntries(serverOptions) {
 	}
 	const configs = resolveServerConfigs(serverOptions, "multi");
 	if (configs.length === 0) throw new Error("At least one server is required. Use --catalog/--config <path> or an ad-hoc target (command/URL).");
-	return { default: {
-		config: configs[0],
+	const config = configs[0];
+	return { [adHocServerName(config)]: {
+		config,
 		settings: mergeSettings(void 0, serverOptions)
 	} };
 }
-//#endregion
-//#region ../../core/mcp/config.ts
+// ../../core/mcp/config.ts
 function getServerType(config) {
 	if (!("type" in config) || config.type === void 0) return "stdio";
 	const type = config.type;
@@ -3011,8 +3001,7 @@ function getServerType(config) {
 	if (type === "streamable-http") return "streamable-http";
 	throw new Error(`Invalid server type: ${type}. Valid types are: stdio, sse, streamable-http`);
 }
-//#endregion
-//#region ../../core/mcp/fetchTracking.ts
+// ../../core/mcp/fetchTracking.ts
 const SENSITIVE_HEADERS = /* @__PURE__ */ new Set([
 	"authorization",
 	"cookie",
@@ -3065,6 +3054,37 @@ function redactUrlQuery(url) {
 	}
 }
 const EMBEDDED_URL_PATTERN = /\bhttps?:\/\/(?:(?!https?:\/\/)[^\s"<>])+/gi;
+function newUrlScan() {
+	return {
+		phase: "path",
+		name: "",
+		inValue: false,
+		sensitive: false,
+		endsWithEquals: false
+	};
+}
+function advanceUrlScan(scan, piece, sensitiveNames) {
+	for (const char of piece) {
+		if (scan.phase === "fragment") break;
+		if (char === "#") scan.phase = "fragment";
+		else if (scan.phase === "path") {
+			if (char === "?") scan.phase = "query";
+		} else if (char === "&") {
+			scan.name = "";
+			scan.inValue = false;
+			scan.sensitive = false;
+		} else if (!scan.inValue) {
+			if (char === "=") {
+				scan.inValue = true;
+				scan.sensitive = [...new URLSearchParams(`&${scan.name}=`).keys()].some((key) => sensitiveNames.has(key.toLowerCase()));
+			} else scan.name += char;
+		}
+	}
+	scan.endsWithEquals = scan.phase === "query" && scan.inValue && piece.endsWith("=");
+}
+function opensSensitiveValue(scan) {
+	return scan.endsWithEquals && scan.sensitive;
+}
 const TRAILING_PUNCTUATION = /* @__PURE__ */ new Set([
 	".",
 	",",
@@ -3082,10 +3102,37 @@ function trailingPunctuationStart(match) {
 	return end;
 }
 function redactUrlsInText(text) {
-	return text.replace(EMBEDDED_URL_PATTERN, (match) => {
-		const end = trailingPunctuationStart(match);
-		return redactUrlQuery(match.slice(0, end)) + match.slice(end);
-	});
+	return mapUrlsInText(text, redactUrlQuery);
+}
+function mapUrlsInText(text, redact, sensitiveNames = SENSITIVE_BODY_FIELDS) {
+	let out = "";
+	let copied = 0;
+	let pieces = [];
+	let scan = newUrlScan();
+	const flush = () => {
+		if (pieces.length === 0) return;
+		const joined = pieces.join("");
+		const end = trailingPunctuationStart(joined);
+		const redacted = redact(joined.slice(0, end));
+		out += pieces.length > 1 && redacted === joined.slice(0, end) ? pieces.map((piece) => redactMatch(piece, redact)).join("") : redacted + joined.slice(end);
+	};
+	for (const match of text.matchAll(EMBEDDED_URL_PATTERN)) {
+		if (match.index !== copied || !opensSensitiveValue(scan)) {
+			flush();
+			out += text.slice(copied, match.index);
+			pieces = [];
+			scan = newUrlScan();
+		}
+		pieces.push(match[0]);
+		advanceUrlScan(scan, match[0], sensitiveNames);
+		copied = match.index + match[0].length;
+	}
+	flush();
+	return out + text.slice(copied);
+}
+function redactMatch(match, redact) {
+	const end = trailingPunctuationStart(match);
+	return redact(match.slice(0, end)) + match.slice(end);
 }
 function redactJsonValue(value) {
 	if (Array.isArray(value)) return value.map(redactJsonValue);
@@ -3144,14 +3191,15 @@ function isLongLivedStreamResponse(method, contentType) {
 }
 const CHALLENGE_BODY_MAX_BYTES = 65536;
 const CHALLENGE_BODY_READ_MS = 2e3;
+const TRACKED_BODY_MAX_BYTES = 1048576;
 const TRUNCATED_BODY_SUFFIX = "\n[truncated]";
 const WITHHELD_TRUNCATED_JSON_BODY = "[truncated JSON body withheld: an incomplete body cannot be redacted]";
-function recordableChallengeBody(read, contentType) {
+function recordableBody(read, contentType) {
 	if (!read.truncated) return redactBody(read.text, contentType);
 	if ((contentType ?? "").toLowerCase().includes("json") || /^\s*[{[]/.test(read.text)) return WITHHELD_TRUNCATED_JSON_BODY;
 	return redactBody(read.text, contentType) + TRUNCATED_BODY_SUFFIX;
 }
-async function readChallengeBody(response) {
+async function readCappedBody(response, maxBytes, timeoutMs) {
 	let reader;
 	try {
 		const body = response.clone().body;
@@ -3165,20 +3213,23 @@ async function readChallengeBody(response) {
 	let text = "";
 	let bytes = 0;
 	let timer;
-	const deadline = new Promise((resolve) => {
-		timer = setTimeout(() => resolve("timeout"), CHALLENGE_BODY_READ_MS);
+	const deadline = timeoutMs === void 0 ? void 0 : new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), timeoutMs);
 	});
 	try {
-		while (bytes < CHALLENGE_BODY_MAX_BYTES) {
-			const next = await Promise.race([reader.read(), deadline]);
+		for (;;) {
+			const next = await (deadline ? Promise.race([reader.read(), deadline]) : reader.read());
 			if (next === "timeout") break;
 			if (next.done) return {
 				text: text + decoder.decode(),
 				truncated: false
 			};
-			const chunk = next.value.subarray(0, CHALLENGE_BODY_MAX_BYTES - bytes);
+			if (next.value.byteLength === 0) continue;
+			if (bytes >= maxBytes) break;
+			const chunk = next.value.subarray(0, maxBytes - bytes);
 			bytes += chunk.byteLength;
 			text += decoder.decode(chunk, { stream: true });
+			if (chunk.byteLength < next.value.byteLength) break;
 		}
 		reader.cancel().catch(() => {});
 		return {
@@ -3191,6 +3242,9 @@ async function readChallengeBody(response) {
 		clearTimeout(timer);
 	}
 }
+function readChallengeBody(response) {
+	return readCappedBody(response, CHALLENGE_BODY_MAX_BYTES, CHALLENGE_BODY_READ_MS);
+}
 function longLivedStreamFraming(contentType) {
 	return contentType?.toLowerCase().includes("application/x-ndjson") ? "ndjson" : "sse";
 }
@@ -3356,7 +3410,7 @@ function createFetchTracker(baseFetch, callbacks) {
 		};
 		if ((responseStatus === 401 || responseStatus === 403) && response.body && !response.bodyUsed) {
 			const read = await readChallengeBody(response);
-			entry.responseBody = read === void 0 ? void 0 : recordableChallengeBody(read, response.headers.get("content-type"));
+			entry.responseBody = read === void 0 ? void 0 : recordableBody(read, response.headers.get("content-type"));
 			callbacks.trackRequest?.(entry);
 			return response;
 		}
@@ -3364,17 +3418,17 @@ function createFetchTracker(baseFetch, callbacks) {
 		if (isLongLivedStream && response.body && !response.bodyUsed) watchLongLivedStream(response, id, longLivedStreamFraming(response.headers.get("content-type")), callbacks);
 		if (!isLongLivedStream && response.body && !response.bodyUsed) {
 			const responseContentType = response.headers.get("content-type");
-			try {
-				response.clone().text().then((body) => {
-					callbacks.updateResponseBody?.(id, redactBody(body, responseContentType) ?? body);
-				}).catch(() => {});
-			} catch {}
+			readCappedBody(response, TRACKED_BODY_MAX_BYTES).then((read) => {
+				if (read === void 0) return;
+				try {
+					callbacks.updateResponseBody?.(id, recordableBody(read, responseContentType));
+				} catch {}
+			});
 		}
 		return response;
 	};
 }
-//#endregion
-//#region ../../core/auth/utils.ts
+// ../../core/auth/utils.ts
 function parseHttpUrl(value, label) {
 	const trimmed = value.trim();
 	try {
@@ -3453,8 +3507,7 @@ function isUnauthorizedErrorDeep(err, seen) {
 	if (data !== null && typeof data === "object" && "cause" in data && isUnauthorizedErrorDeep(data.cause, seen)) return true;
 	return false;
 }
-//#endregion
-//#region ../../core/auth/challenge.ts
+// ../../core/auth/challenge.ts
 const EMA_STEP_UP_PENDING_URL = new URL("mcp-inspector:ema-step-up");
 var AuthChallengeError = class extends Error {
 	authChallenge;
@@ -3600,8 +3653,7 @@ function isAuthChallengeError(err) {
 	const wwwAuthenticate = authChallenge?.raw?.wwwAuthenticate ?? err.wwwAuthenticate ?? err.headers?.get?.("WWW-Authenticate") ?? void 0;
 	return wwwAuthenticate !== void 0 && wwwAuthenticate.length > 0;
 }
-//#endregion
-//#region ../../core/mcp/node/authChallengeFetch.ts
+// ../../core/mcp/node/authChallengeFetch.ts
 function createAuthChallengeInterceptFetch(baseFetch) {
 	return async (input, init) => {
 		const response = await baseFetch(input, init);
@@ -3622,8 +3674,7 @@ function createAuthChallengeObserverFetch(baseFetch, onChallenge) {
 		return response;
 	};
 }
-//#endregion
-//#region ../../core/mcp/node/proxyFetch.ts
+// ../../core/mcp/node/proxyFetch.ts
 function asUndiciInit(init) {
 	return init;
 }
@@ -3713,8 +3764,7 @@ function createProxyFetch() {
 		return (await loadedProxiedFetch)(input, init);
 	};
 }
-//#endregion
-//#region ../../core/auth/requestTimeout.ts
+// ../../core/auth/requestTimeout.ts
 const DEFAULT_OAUTH_REQUEST_TIMEOUT_MS = 3e4;
 var OAuthRequestTimeoutError = class extends Error {
 	url;
@@ -3842,11 +3892,39 @@ function withOAuthRequestTimeout(fetchFn, timeoutMs = DEFAULT_OAUTH_REQUEST_TIME
 		}
 	};
 }
-//#endregion
-//#region ../../core/mcp/node/fetchGuard.ts
+// ../../core/auth/fetchRefusal.ts
 var FetchTargetError = class extends Error {
 	name = "FetchTargetError";
+	url;
+	constructor(message, url) {
+		super(message);
+		if (url !== void 0) this.url = url;
+	}
 };
+function findFetchTargetError(err) {
+	let current = err;
+	for (let depth = 0; depth < 8 && current instanceof Error; depth++) {
+		if (current instanceof FetchTargetError) return current;
+		current = current.cause;
+	}
+}
+function formatFetchRefusal(refusal) {
+	return `Refused to fetch ${refusal.url}: ${refusal.reason}`;
+}
+function withFetchRefusalReporting(base, onRefusal) {
+	return async (input, init) => {
+		try {
+			return await base(input, init);
+		} catch (err) {
+			const refused = findFetchTargetError(err);
+			if (refused) onRefusal({
+				url: redactUrlQuery(refused.url ?? requestUrlOf$2(input)),
+				reason: refused.message
+			});
+			throw err;
+		}
+	};
+}
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	301,
 	302,
@@ -3855,11 +3933,12 @@ const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	308
 ]);
 const resolveWithSystemDns = async (hostname) => (await lookup(hostname, { all: true })).map((r) => r.address);
+const METADATA_IPV4_ADDRESSES = /* @__PURE__ */ new Set(["100.100.100.200", "192.0.0.192"]);
 function isBlockedAddress(ip) {
 	const kind = isIP(ip);
 	if (kind === 4) {
 		const [a, b] = ip.split(".").map(Number);
-		return a === 169 && b === 254;
+		return a === 169 && b === 254 || METADATA_IPV4_ADDRESSES.has(ip);
 	}
 	if (kind !== 6) return false;
 	const addr = ip.toLowerCase();
@@ -4016,27 +4095,35 @@ async function guardedFetch(url, init, options = {}) {
 		headers: init.headers
 	};
 	for (let hop = 0; hop <= 5; hop++) {
-		await assertAllowedTarget(request.url, resolveHost, viaProxy, init.signal);
-		const res = await fetchFn(request.url.href, {
-			method: request.method,
-			headers: new Headers(request.headers),
-			body: request.body,
-			signal: init.signal,
-			redirect: "manual"
-		});
+		let res;
+		try {
+			await assertAllowedTarget(request.url, resolveHost, viaProxy, init.signal);
+			res = await fetchFn(request.url.href, {
+				method: request.method,
+				headers: new Headers(request.headers),
+				body: request.body,
+				signal: init.signal,
+				redirect: "manual"
+			});
+		} catch (err) {
+			stampRefusedUrl(err, request.url);
+			throw err;
+		}
 		const location = res.headers.get("location");
 		if (!REDIRECT_STATUSES.has(res.status) || location === null) return res;
 		res.body?.cancel().catch(() => {});
-		request = nextRedirectRequest(request, res.status, location);
+		try {
+			request = nextRedirectRequest(request, res.status, location);
+		} catch (err) {
+			stampRefusedUrl(err, request.url);
+			throw err;
+		}
 	}
-	throw new FetchTargetError(`Refusing to follow more than 5 redirects`);
+	throw new FetchTargetError(`Refusing to follow more than 5 redirects`, request.url.href);
 }
-function findFetchTargetError(err) {
-	let current = err;
-	for (let depth = 0; depth < 8 && current instanceof Error; depth++) {
-		if (current instanceof FetchTargetError) return current;
-		current = current.cause;
-	}
+function stampRefusedUrl(err, url) {
+	const refused = findFetchTargetError(err);
+	if (refused && refused.url === void 0) refused.url = url.href;
 }
 async function bodyText(input, init) {
 	const body = init?.body !== void 0 ? init.body : input instanceof Request && input.body !== null ? await input.clone().text() : void 0;
@@ -4063,8 +4150,7 @@ function createGuardedFetch(options = {}) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/auth/routeOAuthRequests.ts
+// ../../core/auth/routeOAuthRequests.ts
 function isJsonRpcMessage(value) {
 	return typeof value === "object" && value !== null && value.jsonrpc === "2.0";
 }
@@ -4088,8 +4174,7 @@ function isMcpShapedRequest(input, init) {
 function routeOAuthRequests(mcpFetch, oauthFetch, isMcpEndpoint) {
 	return (input, init) => isMcpShapedRequest(input, init) && isMcpEndpoint(requestUrlOf$2(input), requestHeadersOf(input, init)) ? mcpFetch(input, init) : oauthFetch(input, init);
 }
-//#endregion
-//#region ../../core/mcp/node/notificationHeadersFetch.ts
+// ../../core/mcp/node/notificationHeadersFetch.ts
 function createNotificationHeadersFetch(baseFetch) {
 	return (input, init) => {
 		const method = modernNotificationMethod(init);
@@ -4125,8 +4210,7 @@ function modernNotificationMethod(init) {
 function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-//#endregion
-//#region ../../core/mcp/node/suppressNotificationStreamFetch.ts
+// ../../core/mcp/node/suppressNotificationStreamFetch.ts
 function createSuppressNotificationStreamFetch(baseFetch, endpoint) {
 	return async (input, init) => {
 		if (isStandaloneStreamRequest(input, init, endpoint)) return new Response(null, {
@@ -4152,8 +4236,7 @@ function isStandaloneStreamRequest(input, init, endpoint) {
 	const headers = new Headers(init?.headers ?? request?.headers);
 	return (headers.get("accept")?.toLowerCase() ?? "").includes("text/event-stream") && !headers.has("last-event-id");
 }
-//#endregion
-//#region ../../core/mcp/node/transport.ts
+// ../../core/mcp/node/transport.ts
 function headersFromSettings(settings) {
 	if (!settings || settings.headers.length === 0) return void 0;
 	const out = {};
@@ -4235,8 +4318,7 @@ function createTransportNode(config, options = {}) {
 		}) };
 	}
 }
-//#endregion
-//#region ../../core/client/config-parse.ts
+// ../../core/client/config-parse.ts
 function isAbsoluteHttpUrl(value) {
 	let url;
 	try {
@@ -4319,8 +4401,7 @@ const ClientConfigSchema = z$1.object({
 function parseClientConfig(raw) {
 	return ClientConfigSchema.parse(raw);
 }
-//#endregion
-//#region ../../core/client/secrets.ts
+// ../../core/client/secrets.ts
 const CLIENT_KEYCHAIN_ID = "client";
 function hasClientPlaintextSecret(config) {
 	const secret = config.enterpriseManagedAuth?.idp?.clientSecret;
@@ -4361,8 +4442,7 @@ function mergeSecretsIntoClientConfig(config, secrets) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/client/node-persistence.ts
+// ../../core/client/node-persistence.ts
 async function withClientConfigLock(filePath, action, body) {
 	let entered = false;
 	try {
@@ -4412,8 +4492,7 @@ async function readClientConfigStore(filePath, secretStore) {
 	const secrets = await readIdpSecretFromKeychain(secretStore);
 	return mergeSecretsIntoClientConfig(config, secrets);
 }
-//#endregion
-//#region ../../core/client/config.ts
+// ../../core/client/config.ts
 function getClientConfigFilePath(customPath) {
 	return customPath ?? getStoreFilePath(getDefaultStorageDir(), "client");
 }
@@ -4424,8 +4503,7 @@ async function loadClientConfig(options) {
 	if (raw === null) return {};
 	return parseClientConfig(parseStore(raw));
 }
-//#endregion
-//#region ../../core/client/types.ts
+// ../../core/client/types.ts
 function isEnterpriseManagedAuthEnabled(config) {
 	const ema = config.enterpriseManagedAuth;
 	if (!ema?.idp) return false;
@@ -4442,8 +4520,7 @@ function getActiveCimdClientMetadataUrl(config) {
 	if (!isCimdEnabled(config)) return void 0;
 	return config.cimd?.clientMetadataUrl?.trim() || void 0;
 }
-//#endregion
-//#region ../../core/client/runner.ts
+// ../../core/client/runner.ts
 async function loadRunnerClientConfig(options) {
 	return loadClientConfig({
 		filePath: options?.clientConfigPath?.trim() || process.env.MCP_CLIENT_CONFIG_PATH?.trim() || void 0,
@@ -4486,8 +4563,7 @@ function buildRunnerClientAuthOptions(clientConfig, savedSettings, cliOverrides)
 		...oauth && { directAuthRecovery: true }
 	};
 }
-//#endregion
-//#region ../../core/node/version.ts
+// ../../core/node/version.ts
 const ROOT_PACKAGE_NAME = "@modelcontextprotocol/inspector";
 function readInspectorVersion(callerUrl) {
 	const startDir = dirname$1(fileURLToPath$1(callerUrl));
@@ -4504,8 +4580,7 @@ function readInspectorVersion(callerUrl) {
 	}
 	throw new Error(`Could not locate the ${ROOT_PACKAGE_NAME} root package.json above ${startDir}`);
 }
-//#endregion
-//#region ../../core/node/hostUrl.ts
+// ../../core/node/hostUrl.ts
 function stripBrackets(host) {
 	return host.replace(/^\[(.*)\]$/, "$1");
 }
@@ -4533,8 +4608,7 @@ function isLoopbackHost(host) {
 	const h = canonicalUrlHost(host).replace(/\.$/, "");
 	return h === "localhost" || h === "[::1]" || /^127(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$/.test(h);
 }
-//#endregion
-//#region ../../core/auth/node/runner-oauth-callback.ts
+// ../../core/auth/node/runner-oauth-callback.ts
 const RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME = "127.0.0.1";
 const RUNNER_OAUTH_CALLBACK_DEFAULT_PORT = 6276;
 const RUNNER_OAUTH_CALLBACK_PATH = "/oauth/callback";
@@ -4578,8 +4652,7 @@ function parseRunnerOAuthCallbackUrl(cliCallbackUrl) {
 function formatRunnerOAuthRedirectUrl(config) {
 	return `http://${formatHostForUrl(config.hostname)}:${config.port}${config.pathname}`;
 }
-//#endregion
-//#region ../../core/json/xMcpHeader.ts
+// ../../core/json/xMcpHeader.ts
 const X_MCP_HEADER_KEY = "x-mcp-header";
 const MCP_PARAM_HEADER_PREFIX = "Mcp-Param-";
 const RFC9110_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
@@ -4727,8 +4800,7 @@ function mcpParamHeadersForTool(tool, args) {
 	if (!scan.valid || scan.declarations.length === 0) return {};
 	return buildMcpParamHeaders(scan.declarations, args);
 }
-//#endregion
-//#region ../../core/mcp/subscriptionAck.ts
+// ../../core/mcp/subscriptionAck.ts
 const NEVER_ACKNOWLEDGED_SDK_MESSAGE = "closed the subscription gracefully before acknowledging";
 const NEVER_ACKNOWLEDGED_SUBSCRIPTION_MESSAGE = "The server closed the subscription without acknowledging it. A subscriptions/listen request must first be answered with a notifications/subscriptions/acknowledged notification; a JSON-RPC result for the listen id means graceful closure. Not retrying — the server would answer the same way again.";
 function isNeverAcknowledgedSubscriptionClose(error) {
@@ -4738,8 +4810,7 @@ function subscriptionFailureMessage(error) {
 	if (isNeverAcknowledgedSubscriptionClose(error)) return NEVER_ACKNOWLEDGED_SUBSCRIPTION_MESSAGE;
 	return error instanceof Error ? error.message : String(error);
 }
-//#endregion
-//#region ../../core/mcp/subscriptionRefusal.ts
+// ../../core/mcp/subscriptionRefusal.ts
 const REFUSAL_STATUSES = /* @__PURE__ */ new Set([
 	400,
 	403,
@@ -4756,8 +4827,7 @@ function subscriptionListenRefusal(error) {
 function subscriptionListenRefusalMessage(refusal) {
 	return `The server refused subscriptions/listen (HTTP ${refusal.statusText ? `${refusal.status} ${refusal.statusText}` : String(refusal.status)}). Not retrying — the server would answer the same way again.`;
 }
-//#endregion
-//#region ../../core/mcp/messageTrackingTransport.ts
+// ../../core/mcp/messageTrackingTransport.ts
 var MessageTrackingTransport = class {
 	baseTransport;
 	callbacks;
@@ -4830,8 +4900,7 @@ var MessageTrackingTransport = class {
 		return this.negotiatedProtocolVersion;
 	}
 };
-//#endregion
-//#region ../../core/extension/tasks/errors.ts
+// ../../core/extension/tasks/errors.ts
 function abortError(signal) {
 	return signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted", "AbortError");
 }
@@ -4845,14 +4914,12 @@ function toProtocolError(reason) {
 	const normalized = unwrapTaskDispatchError(reason);
 	return normalized instanceof ProtocolError ? normalized : new ProtocolError(ProtocolErrorCode.InternalError, normalized instanceof Error ? normalized.message : String(normalized));
 }
-//#endregion
-//#region ../../core/extension/tasks/notificationSchemas.ts
+// ../../core/extension/tasks/notificationSchemas.ts
 const TasksListChangedNotificationSchema = NotificationSchema.extend({
 	method: z.literal("notifications/tasks/list_changed"),
 	params: z.record(z.string(), z.unknown()).optional()
 });
-//#endregion
-//#region ../../core/extension/tasks/progress.ts
+// ../../core/extension/tasks/progress.ts
 var TaskProgressRouter = class {
 	taskIds = /* @__PURE__ */ new Map();
 	owners = /* @__PURE__ */ new Map();
@@ -4883,8 +4950,7 @@ var TaskProgressRouter = class {
 		this.owners.clear();
 	}
 };
-//#endregion
-//#region ../../core/extension/tasks/rawWireChannel.ts
+// ../../core/extension/tasks/rawWireChannel.ts
 const RAW_WIRE_ID_PREFIX = "inspector-ext-";
 var RawWireChannel = class {
 	pending = /* @__PURE__ */ new Map();
@@ -5013,8 +5079,7 @@ var RawWireChannel = class {
 		}
 	}
 };
-//#endregion
-//#region ../../core/extension/tasks/session.ts
+// ../../core/extension/tasks/session.ts
 function taskSessionEndpointId(config, clientInfo) {
 	return createTaskSessionEndpointId("inspector", config.type === "sse" || config.type === "streamable-http" ? {
 		host: clientInfo,
@@ -5037,8 +5102,7 @@ function isTasksExtensionNegotiated(era, capabilities) {
 	const extension = capabilities?.extensions?.[TASKS_EXTENSION_KEY];
 	return extension !== null && typeof extension === "object" && !Array.isArray(extension) && Object.keys(extension).length === 0;
 }
-//#endregion
-//#region ../../core/extension/tasks/wire.ts
+// ../../core/extension/tasks/wire.ts
 const taskToolResultCodec = runtimeCodecFromStandardSchema({ "~standard": {
 	version: 1,
 	vendor: "mcp-inspector",
@@ -5075,8 +5139,7 @@ function taskInputOrigin(delivery) {
 	if (delivery === "request-retry") return "input-required";
 	return "server-request";
 }
-//#endregion
-//#region ../../core/mcp/extensions.ts
+// ../../core/mcp/extensions.ts
 const EMA_EXTENSION_KEY = "io.modelcontextprotocol/enterprise-managed-authorization";
 const UI_EXTENSION_KEY = "io.modelcontextprotocol/ui";
 const MCP_APP_MIME_TYPE = RESOURCE_MIME_TYPE;
@@ -5113,8 +5176,7 @@ function buildClientExtensions(input) {
 	if (input.enterpriseManaged) map[EMA_EXTENSION_KEY] = {};
 	return map;
 }
-//#endregion
-//#region ../../core/mcp/appElicitation.ts
+// ../../core/mcp/appElicitation.ts
 function uiExtension(capabilities) {
 	const ext = capabilities?.extensions?.[UI_EXTENSION_KEY];
 	return typeof ext === "object" && ext !== null ? ext : void 0;
@@ -5169,8 +5231,7 @@ function validateAppElicitResult(provider, params, result) {
 		return;
 	}
 }
-//#endregion
-//#region ../../core/mcp/toolOutputValidation.ts
+// ../../core/mcp/toolOutputValidation.ts
 function validateToolOutput(provider, tool, result) {
 	if (!tool.outputSchema) return void 0;
 	const structured = result.structuredContent;
@@ -5182,6 +5243,625 @@ function validateToolOutput(provider, tool, result) {
 		return;
 	}
 }
+// ../../core/json/linearRegExp.ts
+var CharMatcher = class {
+	re;
+	ascii = /* @__PURE__ */ new Uint8Array(128);
+	constructor(source, unicode) {
+		this.re = new RegExp(`^(?:${source})$`, unicode ? "u" : "");
+	}
+	matches(cp, unicode) {
+		if (cp < 128) {
+			const memo = this.ascii[cp];
+			if (memo !== 0) return memo === 1;
+			const result = this.re.test(String.fromCharCode(cp));
+			this.ascii[cp] = result ? 1 : 2;
+			return result;
+		}
+		return this.re.test(unicode ? String.fromCodePoint(cp) : String.fromCharCode(cp));
+	}
+};
+var Unsupported = class extends Error {};
+const MAX_GROUP_DEPTH = 64;
+const MAX_PROGRAM_SIZE = 1e4;
+const MAX_COMPILE_STEPS = 10 * MAX_PROGRAM_SIZE;
+const MAX_PATTERN_LENGTH = 8192;
+const COMPILE_BUDGET_EXHAUSTED = "the patterns together exceed the compilation budget";
+function isCompileBudgetExhausted(budget) {
+	return budget.steps < 0 || budget.size < 0;
+}
+const QUANTIFIER_BRACES = /\{(\d+)(?:(,)(\d*))?\}/y;
+const HEX4 = /^[0-9a-fA-F]{4}$/;
+const HEX2 = /^[0-9a-fA-F]{2}$/;
+var Parser = class {
+	pos = 0;
+	src;
+	unicode;
+	constructor(src, unicode) {
+		this.src = src;
+		this.unicode = unicode;
+	}
+	parse() {
+		const node = this.parseAlternation(0);
+		/* v8 ignore next -- the native RegExp constructor rejects an unbalanced `)` first */
+		if (this.pos !== this.src.length) throw new Unsupported("unbalanced group");
+		return node;
+	}
+	parseAlternation(depth) {
+		const options = [this.parseSequence(depth)];
+		while (this.src[this.pos] === "|") {
+			this.pos++;
+			options.push(this.parseSequence(depth));
+		}
+		return options.length === 1 ? options[0] : {
+			kind: "alt",
+			options
+		};
+	}
+	parseSequence(depth) {
+		const items = [];
+		while (this.pos < this.src.length && this.src[this.pos] !== "|" && this.src[this.pos] !== ")") items.push(this.parseTerm(depth));
+		return items.length === 1 ? items[0] : {
+			kind: "seq",
+			items
+		};
+	}
+	parseTerm(depth) {
+		const atom = this.parseAtom(depth);
+		const quantifier = this.readQuantifier();
+		if (!quantifier) return atom;
+		if (this.src[this.pos] === "?") this.pos++;
+		return {
+			kind: "repeat",
+			body: atom,
+			...quantifier
+		};
+	}
+	readQuantifier() {
+		const c = this.src[this.pos];
+		if (c === "*") {
+			this.pos++;
+			return {
+				min: 0,
+				max: Infinity
+			};
+		}
+		if (c === "+") {
+			this.pos++;
+			return {
+				min: 1,
+				max: Infinity
+			};
+		}
+		if (c === "?") {
+			this.pos++;
+			return {
+				min: 0,
+				max: 1
+			};
+		}
+		if (c === "{") {
+			QUANTIFIER_BRACES.lastIndex = this.pos;
+			const m = QUANTIFIER_BRACES.exec(this.src);
+			if (!m) return void 0;
+			this.pos += m[0].length;
+			const min = Number(m[1]);
+			return {
+				min,
+				max: m[2] === void 0 ? min : m[3] ? Number(m[3]) : Infinity
+			};
+		}
+	}
+	parseAtom(depth) {
+		switch (this.src[this.pos]) {
+			case "(": return this.parseGroup(depth);
+			case "[": return this.parseClass();
+			case "\\": return this.parseEscape();
+			case ".":
+				this.pos++;
+				return {
+					kind: "char",
+					source: "."
+				};
+			case "^":
+				this.pos++;
+				return {
+					kind: "assert",
+					assertion: "start"
+				};
+			case "$":
+				this.pos++;
+				return {
+					kind: "assert",
+					assertion: "end"
+				};
+			case "*":
+			case "+":
+			case "?":
+ /* v8 ignore next -- "nothing to repeat" is a native syntax error */
+			throw new Unsupported("nothing to repeat");
+			case "{":
+				QUANTIFIER_BRACES.lastIndex = this.pos;
+				if (QUANTIFIER_BRACES.test(this.src))
+ /* v8 ignore next -- rejected by the native RegExp constructor first */
+				throw new Unsupported("nothing to repeat");
+				this.pos++;
+				return {
+					kind: "char",
+					source: "\\{"
+				};
+			default: {
+				const width = this.codePointWidth(this.pos);
+				const source = this.src.slice(this.pos, this.pos + width);
+				this.pos += width;
+				return {
+					kind: "char",
+					source
+				};
+			}
+		}
+	}
+	codePointWidth(at) {
+		if (!this.unicode) return 1;
+		return this.src.codePointAt(at) > 65535 ? 2 : 1;
+	}
+	parseGroup(depth) {
+		if (depth >= MAX_GROUP_DEPTH) throw new Unsupported("groups nested too deeply");
+		this.pos++;
+		if (this.src.startsWith("?:", this.pos)) this.pos += 2;
+		else if (this.src.startsWith("?<", this.pos) && this.src[this.pos + 2] !== "=" && this.src[this.pos + 2] !== "!") {
+			const close = this.src.indexOf(">", this.pos);
+			/* v8 ignore next -- an unterminated group name is a native syntax error */
+			if (close < 0) throw new Unsupported("unterminated group name");
+			this.pos = close + 1;
+		} else if (this.src[this.pos] === "?") throw new Unsupported("lookaround or group modifier");
+		const body = this.parseAlternation(depth + 1);
+		/* v8 ignore next -- an unterminated group is a native syntax error */
+		if (this.src[this.pos] !== ")") throw new Unsupported("unterminated group");
+		this.pos++;
+		return body;
+	}
+	parseClass() {
+		const start = this.pos;
+		this.pos++;
+		while (this.pos < this.src.length && this.src[this.pos] !== "]") this.pos += this.src[this.pos] === "\\" ? 2 : 1;
+		/* v8 ignore next -- an unterminated class is a native syntax error */
+		if (this.pos >= this.src.length) throw new Unsupported("unterminated class");
+		this.pos++;
+		return {
+			kind: "char",
+			source: this.src.slice(start, this.pos)
+		};
+	}
+	parseEscape() {
+		const next = this.src[this.pos + 1];
+		/* v8 ignore next -- a trailing backslash is a native syntax error */
+		if (next === void 0) throw new Unsupported("trailing backslash");
+		switch (next) {
+			case "b":
+				this.pos += 2;
+				return {
+					kind: "assert",
+					assertion: "wordBoundary"
+				};
+			case "B":
+				this.pos += 2;
+				return {
+					kind: "assert",
+					assertion: "notWordBoundary"
+				};
+			case "1":
+			case "2":
+			case "3":
+			case "4":
+			case "5":
+			case "6":
+			case "7":
+			case "8":
+			case "9":
+			case "k": throw new Unsupported("backreference");
+			case "0":
+				if (/[0-9]/.test(this.src[this.pos + 2] ?? "")) throw new Unsupported("octal escape");
+				return this.takeChar(2);
+			case "c":
+				if (!/[a-zA-Z]/.test(this.src[this.pos + 2] ?? "")) throw new Unsupported("incomplete control escape");
+				return this.takeChar(3);
+			case "p":
+			case "P":
+				if (this.unicode && this.src[this.pos + 2] === "{") return this.takeThrough("}");
+				return this.takeChar(2);
+			case "x": return this.takeChar(HEX2.test(this.src.slice(this.pos + 2, this.pos + 4)) ? 4 : 2);
+			case "u": return this.parseUnicodeEscape();
+			default: return this.takeChar(1 + this.codePointWidth(this.pos + 1));
+		}
+	}
+	parseUnicodeEscape() {
+		if (this.unicode && this.src[this.pos + 2] === "{") return this.takeThrough("}");
+		const hex = this.src.slice(this.pos + 2, this.pos + 6);
+		if (!HEX4.test(hex)) return this.takeChar(2);
+		const unit = parseInt(hex, 16);
+		if (this.unicode && unit >= 55296 && unit <= 56319 && this.src.startsWith("\\u", this.pos + 6)) {
+			const low = this.src.slice(this.pos + 8, this.pos + 12);
+			if (HEX4.test(low)) {
+				const lowUnit = parseInt(low, 16);
+				if (lowUnit >= 56320 && lowUnit <= 57343) return this.takeChar(12);
+			}
+		}
+		return this.takeChar(6);
+	}
+	takeChar(length) {
+		const source = this.src.slice(this.pos, this.pos + length);
+		this.pos += length;
+		return {
+			kind: "char",
+			source
+		};
+	}
+	takeThrough(terminator) {
+		const end = this.src.indexOf(terminator, this.pos);
+		/* v8 ignore next -- an unterminated `\p{` / `\u{` is a native syntax error */
+		if (end < 0) throw new Unsupported("unterminated escape");
+		return this.takeChar(end + 1 - this.pos);
+	}
+};
+var Compiler = class {
+	prog = [];
+	matchers = /* @__PURE__ */ new Map();
+	unicode;
+	budget;
+	steps = 0;
+	constructor(unicode, budget) {
+		this.unicode = unicode;
+		this.budget = budget;
+	}
+	emit(inst) {
+		if (this.prog.length >= 1e4) throw new Unsupported("pattern too complex");
+		if (this.budget && --this.budget.size < 0) throw new Unsupported(COMPILE_BUDGET_EXHAUSTED);
+		this.prog.push(inst);
+		return this.prog.length - 1;
+	}
+	matcher(source) {
+		let matcher = this.matchers.get(source);
+		if (!matcher) {
+			try {
+				matcher = new CharMatcher(source, this.unicode);
+			} catch {
+				/* v8 ignore start -- defensive: each atom is a slice the native constructor already accepted in context */
+				throw new Unsupported("unrecognized character syntax");
+			}
+			this.matchers.set(source, matcher);
+		}
+		return matcher;
+	}
+	compile(node) {
+		if (++this.steps > 1e5) throw new Unsupported("pattern too complex");
+		if (this.budget && --this.budget.steps < 0) throw new Unsupported(COMPILE_BUDGET_EXHAUSTED);
+		switch (node.kind) {
+			case "char":
+				this.emit({
+					op: "char",
+					matcher: this.matcher(node.source)
+				});
+				return;
+			case "assert":
+				this.emit({
+					op: "assert",
+					assertion: node.assertion
+				});
+				return;
+			case "seq":
+				for (const item of node.items) this.compile(item);
+				return;
+			case "alt":
+				this.compileAlternation(node.options);
+				return;
+			case "repeat":
+				this.compileRepeat(node.body, node.min, node.max);
+				return;
+		}
+	}
+	compileAlternation(options) {
+		const jumps = [];
+		for (let i = 0; i < options.length - 1; i++) {
+			const split = this.emit({
+				op: "split",
+				a: 0,
+				b: 0
+			});
+			this.patchSplit(split, split + 1, -1);
+			this.compile(options[i]);
+			jumps.push(this.emit({
+				op: "jmp",
+				to: 0
+			}));
+			this.patchSplit(split, -1, this.prog.length);
+		}
+		this.compile(options[options.length - 1]);
+		for (const jump of jumps) this.patchJump(jump, this.prog.length);
+	}
+	compileRepeat(body, min, max) {
+		for (let i = 0; i < min; i++) {
+			const before = this.prog.length;
+			this.compile(body);
+			if (this.prog.length === before) return;
+		}
+		if (max === Infinity) {
+			const split = this.emit({
+				op: "split",
+				a: 0,
+				b: 0
+			});
+			this.compile(body);
+			this.emit({
+				op: "jmp",
+				to: split
+			});
+			this.patchSplit(split, split + 1, this.prog.length);
+			return;
+		}
+		const splits = [];
+		for (let i = min; i < max; i++) {
+			const split = this.emit({
+				op: "split",
+				a: 0,
+				b: 0
+			});
+			this.patchSplit(split, split + 1, -1);
+			splits.push(split);
+			this.compile(body);
+		}
+		for (const split of splits) this.patchSplit(split, -1, this.prog.length);
+	}
+	patchSplit(at, a, b) {
+		const inst = this.prog[at];
+		if (a >= 0) inst.a = a;
+		if (b >= 0) inst.b = b;
+	}
+	patchJump(at, to) {
+		this.prog[at].to = to;
+	}
+};
+function isWordUnit(unit) {
+	return unit >= 48 && unit <= 57 || unit >= 65 && unit <= 90 || unit >= 97 && unit <= 122 || unit === 95;
+}
+var LinearRegExp = class {
+	anchoredStart;
+	prog;
+	unicode;
+	constructor(prog, unicode) {
+		this.prog = prog;
+		this.unicode = unicode;
+		const first = prog[0];
+		this.anchoredStart = first !== void 0 && first.op === "assert" && first.assertion === "start";
+	}
+	get size() {
+		return this.prog.length;
+	}
+	cost(input) {
+		return (input.length + 1) * this.prog.length;
+	}
+	search(input, budget) {
+		if (this.cost(input) > budget) return void 0;
+		const prog = this.prog;
+		const size = prog.length;
+		const mark = new Int32Array(size).fill(-1);
+		const stack = [];
+		let clist = new Int32Array(size);
+		let nlist = new Int32Array(size);
+		const add = (list, count, start, pos, generation) => {
+			stack.push(start);
+			while (stack.length > 0) {
+				const pc = stack.pop();
+				if (mark[pc] === generation) continue;
+				mark[pc] = generation;
+				const inst = prog[pc];
+				switch (inst.op) {
+					case "match":
+						stack.length = 0;
+						return -1;
+					case "jmp":
+						stack.push(inst.to);
+						break;
+					case "split":
+						stack.push(inst.b, inst.a);
+						break;
+					case "assert":
+						if (this.holds(inst.assertion, input, pos)) stack.push(pc + 1);
+						break;
+					case "char": list[count++] = pc;
+				}
+			}
+			return count;
+		};
+		let pos = 0;
+		let generation = 0;
+		let clen = add(clist, 0, 0, pos, generation);
+		if (clen < 0) return true;
+		while (pos < input.length) {
+			if (this.anchoredStart && clen === 0) return false;
+			const cp = this.unicode ? input.codePointAt(pos) : input.charCodeAt(pos);
+			const next = pos + (this.unicode && cp > 65535 ? 2 : 1);
+			generation++;
+			let nlen = 0;
+			for (let i = 0; i < clen; i++) {
+				const pc = clist[i];
+				if (prog[pc].matcher.matches(cp, this.unicode)) {
+					nlen = add(nlist, nlen, pc + 1, next, generation);
+					if (nlen < 0) return true;
+				}
+			}
+			nlen = add(nlist, nlen, 0, next, generation);
+			if (nlen < 0) return true;
+			[clist, nlist] = [nlist, clist];
+			clen = nlen;
+			pos = next;
+		}
+		return false;
+	}
+	holds(assertion, input, pos) {
+		switch (assertion) {
+			case "start": return pos === 0;
+			case "end": return pos === input.length;
+			case "wordBoundary":
+			case "notWordBoundary": return (pos > 0 && isWordUnit(input.charCodeAt(pos - 1))) !== (pos < input.length && isWordUnit(input.charCodeAt(pos))) === (assertion === "wordBoundary");
+		}
+	}
+};
+function compileLinearRegExp(pattern, unicode, budget) {
+	if (pattern.length > 8192) return {
+		ok: false,
+		reason: `pattern longer than ${MAX_PATTERN_LENGTH} characters`
+	};
+	if (budget) {
+		budget.steps -= pattern.length;
+		if (isCompileBudgetExhausted(budget)) return {
+			ok: false,
+			reason: COMPILE_BUDGET_EXHAUSTED
+		};
+	}
+	new RegExp(pattern, unicode ? "u" : "");
+	try {
+		const ast = new Parser(pattern, unicode).parse();
+		const compiler = new Compiler(unicode, budget);
+		compiler.compile(ast);
+		compiler.prog.push({ op: "match" });
+		return {
+			ok: true,
+			regExp: new LinearRegExp(compiler.prog, unicode)
+		};
+	} catch (error) {
+		/* v8 ignore next -- every throw inside the parser/compiler is an Unsupported */
+		if (!(error instanceof Unsupported)) throw error;
+		return {
+			ok: false,
+			reason: error.message
+		};
+	}
+}
+// ../../core/mcp/linearPatternValidator.ts
+const PATTERN_EVALUATION_BUDGET = 2e7;
+const SCHEMA_COMPILE_BUDGET = {
+	steps: 10 * MAX_COMPILE_STEPS,
+	size: 10 * MAX_PROGRAM_SIZE
+};
+const MAX_QUOTED_PATTERN = 120;
+const DRAFT_2020_12 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2020-12/schema", "http://json-schema.org/draft/2020-12/schema"]);
+const DRAFT_2019_09 = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2019-09/schema", "http://json-schema.org/draft/2019-09/schema"]);
+const DRAFT_07_OR_06 = /* @__PURE__ */ new Set([
+	"https://json-schema.org/draft-07/schema",
+	"http://json-schema.org/draft-07/schema",
+	"https://json-schema.org/draft-06/schema",
+	"http://json-schema.org/draft-06/schema"
+]);
+function declaredDialect(schema) {
+	const declared = schema.$schema;
+	if (typeof declared !== "string") return "2020-12";
+	const uri = declared.replace(/#$/, "");
+	if (DRAFT_2020_12.has(uri)) return "2020-12";
+	if (DRAFT_2019_09.has(uri)) return "2019-09";
+	if (DRAFT_07_OR_06.has(uri)) return "draft-7";
+	throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${declared.slice(0, 200)}"). Supported: JSON Schema 2020-12, 2019-09, draft-07, and draft-06.`);
+}
+function quote(pattern) {
+	return pattern.length > MAX_QUOTED_PATTERN ? `${pattern.slice(0, MAX_QUOTED_PATTERN)}…` : pattern;
+}
+var PatternLedger = class {
+	remaining = PATTERN_EVALUATION_BUDGET;
+	unevaluated = /* @__PURE__ */ new Set();
+	reset() {
+		this.remaining = PATTERN_EVALUATION_BUDGET;
+		this.unevaluated.clear();
+	}
+};
+var LinearPattern = class {
+	source;
+	flags;
+	compiled;
+	ledger;
+	constructor(source, flags, compiled, ledger) {
+		this.source = source;
+		this.flags = flags;
+		this.compiled = compiled;
+		this.ledger = ledger;
+	}
+	test(input) {
+		if (!this.compiled.ok) return this.skip(this.compiled.reason);
+		const { regExp } = this.compiled;
+		const cost = regExp.cost(input);
+		if (cost > this.ledger.remaining) return this.skip(`checking a ${input.length}-character value would exceed the evaluation budget`);
+		this.ledger.remaining -= cost;
+		return regExp.search(input, cost) === true;
+	}
+	skip(reason) {
+		this.ledger.unevaluated.add(`pattern "${quote(this.source)}" was not evaluated (${reason})`);
+		return true;
+	}
+	toString() {
+		return `/${this.source}/${this.flags}`;
+	}
+};
+function createRegExpEngine(ledger, budget) {
+	const engine = (pattern, flags) => new LinearPattern(pattern, flags, compileLinearRegExp(pattern, flags.includes("u"), budget()), ledger);
+	return Object.assign(engine, { code: "linearRegExp" });
+}
+var LinearPatternJsonSchemaValidator = class {
+	ledger = new PatternLedger();
+	engines = /* @__PURE__ */ new Map();
+	compileBudget = { ...SCHEMA_COMPILE_BUDGET };
+	overBudget = /* @__PURE__ */ new WeakSet();
+	engineFor(dialect) {
+		let engine = this.engines.get(dialect);
+		if (!engine) {
+			const options = {
+				strict: false,
+				validateFormats: true,
+				validateSchema: false,
+				allErrors: true,
+				code: { regExp: createRegExpEngine(this.ledger, () => this.compileBudget) }
+			};
+			engine = dialect === "2020-12" ? new Ajv2020(options) : dialect === "2019-09" ? new Ajv2019(options) : new Ajv(options);
+			addFormats(engine);
+			this.engines.set(dialect, engine);
+		}
+		return engine;
+	}
+	getValidator(schema) {
+		const engine = this.engineFor(declaredDialect(schema));
+		const id = schema.$id;
+		const validate = this.tracked(() => (typeof id === "string" ? engine.getSchema(id) : void 0) ?? engine.compile(schema));
+		const overBudget = this.overBudget.has(validate);
+		return (input) => {
+			this.ledger.reset();
+			const valid = validate(input);
+			const unevaluated = [...this.ledger.unevaluated];
+			if (overBudget) unevaluated.unshift("the schema's patterns exceed the compilation budget");
+			if (valid && unevaluated.length === 0) return {
+				valid: true,
+				data: input,
+				errorMessage: void 0
+			};
+			const messages = valid ? [] : [engine.errorsText(validate.errors)];
+			if (unevaluated.length > 0) messages.push(`${unevaluated.join("; ")}, so the value could not be verified against the schema`);
+			return {
+				valid: false,
+				data: void 0,
+				errorMessage: messages.join("; ")
+			};
+		};
+	}
+	tracked(run) {
+		const outer = this.compileBudget;
+		const budget = { ...SCHEMA_COMPILE_BUDGET };
+		this.compileBudget = budget;
+		try {
+			const validate = run();
+			if (isCompileBudgetExhausted(budget)) this.overBudget.add(validate);
+			return validate;
+		} finally {
+			this.compileBudget = outer;
+		}
+	}
+};
 function listPaginationExceeded(method) {
 	return /* @__PURE__ */ new Error(`Salvage walk for ${method} exceeded 64 pages without the server's pagination converging`);
 }
@@ -5282,8 +5962,7 @@ function stripExecution(tool) {
 function eraToolItemSchema(wire, normalize) {
 	return wire.transform((parsed) => normalize(parsed));
 }
-//#endregion
-//#region ../../core/mcp/uriTemplate.ts
+// ../../core/mcp/uriTemplate.ts
 const OPERATORS = [
 	"+",
 	"#",
@@ -5508,8 +6187,7 @@ function valueLengthError(values, names) {
 function declaredNames(parts) {
 	return [...new Set(parts.flatMap((part) => part.kind === "expression" ? part.names : []))];
 }
-//#endregion
-//#region ../../core/mcp/typedEventTarget.ts
+// ../../core/mcp/typedEventTarget.ts
 var TypedEventGeneric = class extends CustomEvent {
 	constructor(type, detail) {
 		super(type, { detail });
@@ -5535,11 +6213,9 @@ var TypedEventTarget = class extends EventTarget {
 		super.removeEventListener(type, listener, options);
 	}
 };
-//#endregion
-//#region ../../core/mcp/inspectorClientEventTarget.ts
+// ../../core/mcp/inspectorClientEventTarget.ts
 var InspectorClientEventTarget = class extends TypedEventTarget {};
-//#endregion
-//#region ../../core/mcp/samplingCreateMessage.ts
+// ../../core/mcp/samplingCreateMessage.ts
 var SamplingCreateMessage = class {
 	id;
 	timestamp;
@@ -5583,8 +6259,7 @@ var SamplingCreateMessage = class {
 		this.onRemove(this.id);
 	}
 };
-//#endregion
-//#region ../../core/mcp/elicitationCreateMessage.ts
+// ../../core/mcp/elicitationCreateMessage.ts
 var ElicitationCreateMessage = class {
 	id;
 	timestamp;
@@ -5631,8 +6306,7 @@ var ElicitationCreateMessage = class {
 		this.onRemove(this.id);
 	}
 };
-//#endregion
-//#region ../../core/mcp/urlElicitation.ts
+// ../../core/mcp/urlElicitation.ts
 var UrlElicitationLoopError = class extends Error {
 	url;
 	constructor(url) {
@@ -5646,8 +6320,7 @@ function getUrlElicitationsFromError(error) {
 	if (error instanceof ProtocolError && error.code === ProtocolErrorCode.UrlElicitationRequired) return error.data?.elicitations ?? [];
 	return null;
 }
-//#endregion
-//#region ../../core/mcp/toolCallCancelledError.ts
+// ../../core/mcp/toolCallCancelledError.ts
 var ToolCallCancelledError = class extends Error {
 	toolName;
 	constructor(toolName) {
@@ -5656,8 +6329,7 @@ var ToolCallCancelledError = class extends Error {
 		this.toolName = toolName;
 	}
 };
-//#endregion
-//#region ../../core/auth/endpointOverrides.ts
+// ../../core/auth/endpointOverrides.ts
 const OVERRIDE_FIELDS = {
 	authorizationUrl: "authorization_endpoint",
 	tokenUrl: "token_endpoint"
@@ -5834,8 +6506,7 @@ function withOAuthEndpointOverrides(fetchFn, getOverrides) {
 		return responseWithBody(response, JSON.stringify(applyOAuthEndpointOverrides(parsed, overrides)));
 	};
 }
-//#endregion
-//#region ../../core/auth/oidcDiscoveryCompat.ts
+// ../../core/auth/oidcDiscoveryCompat.ts
 const RFC8414_WELL_KNOWN = "/.well-known/oauth-authorization-server";
 const OIDC_WELL_KNOWN$1 = "/.well-known/openid-configuration";
 const COMPAT_SOURCE_HEADER = "x-inspector-oauth-metadata-source";
@@ -5957,8 +6628,7 @@ function withRfc8414OidcCompat(fetchFn) {
 		return response;
 	};
 }
-//#endregion
-//#region ../../core/logging/logger.ts
+// ../../core/logging/logger.ts
 const noop = () => {};
 function createSilentLogger() {
 	const logger = {
@@ -5975,8 +6645,7 @@ function createSilentLogger() {
 	return logger;
 }
 const silentLogger = createSilentLogger();
-//#endregion
-//#region ../../core/mcp/connectionDiagnostics.ts
+// ../../core/mcp/connectionDiagnostics.ts
 function isRequestTimeoutData(value) {
 	return typeof value === "object" && value !== null && typeof value.timeout === "number";
 }
@@ -5998,7 +6667,7 @@ function httpStatusTextOf(err) {
 	if (typeof err !== "object" || err === null || !("statusText" in err)) return;
 	return typeof err.statusText === "string" ? err.statusText : void 0;
 }
-function formatDuration(ms) {
+function formatDuration$1(ms) {
 	const clamped = Math.max(0, ms);
 	if (clamped < 1e3) return `${Math.round(clamped)}ms`;
 	const totalSeconds = Math.round(clamped / 1e3);
@@ -6021,7 +6690,7 @@ function plural(count, noun) {
 }
 function describeOutstanding(requests, now) {
 	if (requests.length === 0) return "No requests are unanswered.";
-	const listed = requests.slice(0, 5).map((r) => `${r.method} (sent ${formatDuration(now - r.sentAt)} ago)`);
+	const listed = requests.slice(0, 5).map((r) => `${r.method} (sent ${formatDuration$1(now - r.sentAt)} ago)`);
 	const rest = requests.length - listed.length;
 	const tail = rest > 0 ? `, and ${rest} more` : "";
 	const verb = requests.length === 1 ? "is" : "are";
@@ -6029,14 +6698,14 @@ function describeOutstanding(requests, now) {
 }
 function describeLastResponse(lastResponse, now) {
 	if (!lastResponse) return "No response has been received this session.";
-	return `Last response received ${formatDuration(now - lastResponse.receivedAt)} ago (${lastResponse.method}).`;
+	return `Last response received ${formatDuration$1(now - lastResponse.receivedAt)} ago (${lastResponse.method}).`;
 }
 function describeStream(stream, now) {
 	if (!stream) return void 0;
 	const endpoint = describeStreamEndpoint(stream.url);
 	const events = plural(stream.eventCount, "event");
-	if (stream.closedAt !== void 0) return `Notification stream (${endpoint}) closed ${formatDuration(now - stream.closedAt)} ago after ${formatDuration(stream.closedAt - stream.openedAt)}, ${events} delivered.`;
-	return `Notification stream (${endpoint}) open for ${formatDuration(now - stream.openedAt)}, ${events} delivered.`;
+	if (stream.closedAt !== void 0) return `Notification stream (${endpoint}) closed ${formatDuration$1(now - stream.closedAt)} ago after ${formatDuration$1(stream.closedAt - stream.openedAt)}, ${events} delivered.`;
+	return `Notification stream (${endpoint}) open for ${formatDuration$1(now - stream.openedAt)}, ${events} delivered.`;
 }
 function describeConnectionDiagnostics(diagnostics) {
 	const now = diagnostics.capturedAt;
@@ -6053,7 +6722,7 @@ function annotateRequestTimeout(err, method, diagnostics) {
 		method,
 		diagnostics
 	};
-	const message = `Request timed out after ${formatDuration(err.data.timeout)} (${method}). ${describeConnectionDiagnostics(diagnostics)}`;
+	const message = `Request timed out after ${formatDuration$1(err.data.timeout)} (${method}). ${describeConnectionDiagnostics(diagnostics)}`;
 	const annotated = new SdkError(SdkErrorCode.RequestTimeout, message, data);
 	annotated.cause = err;
 	return annotated;
@@ -6123,7 +6792,7 @@ function attachRetryAfter(err, retryAfter) {
 	err.data.retryAfter = retryAfter;
 }
 function describeRetry(retryAfter, retryAfterMs) {
-	if (retryAfterMs !== void 0) return `The server asked to retry after ${formatDuration(retryAfterMs)}.`;
+	if (retryAfterMs !== void 0) return `The server asked to retry after ${formatDuration$1(retryAfterMs)}.`;
 	if (retryAfter !== void 0) return `The server sent an unparseable Retry-After (${retryAfter}).`;
 	return "The server sent no Retry-After header.";
 }
@@ -6168,8 +6837,7 @@ function applyAuthorizationParams(authorizationUrl, params) {
 	for (const [key, value] of applicable) merged.searchParams.set(key.trim(), value);
 	return merged;
 }
-//#endregion
-//#region ../../core/auth/scopes.ts
+// ../../core/auth/scopes.ts
 const computeScopeUnion$1 = computeScopeUnion;
 const isStrictScopeSuperset$1 = isStrictScopeSuperset;
 const OFFLINE_ACCESS_SCOPE = "offline_access";
@@ -6197,8 +6865,7 @@ function resolveEffectiveGrantedScope(storedScope, tokenScope) {
 	if (granted) return granted;
 	return computeScopeUnion$1(storedScope, tokenScope);
 }
-//#endregion
-//#region ../../core/auth/providers.ts
+// ../../core/auth/providers.ts
 var MutableRedirectUrlProvider = class {
 	redirectUrl = "";
 	getRedirectUrl() {
@@ -6429,8 +7096,7 @@ var BaseOAuthClientProvider = class {
 		}
 	}
 };
-//#endregion
-//#region ../../core/auth/types.ts
+// ../../core/auth/types.ts
 function authProtocolFromEnterpriseManaged(enterpriseManaged) {
 	return enterpriseManaged ? "ema" : "standard";
 }
@@ -6451,8 +7117,7 @@ const EMPTY_OAUTH_FLOW_STATE = {
 	statusMessage: null,
 	validationError: null
 };
-//#endregion
-//#region ../../core/auth/mcpAuth.ts
+// ../../core/auth/mcpAuth.ts
 async function mcpAuth(provider, options) {
 	if (options.forceReauthorization && options.authorizationCode !== void 0) throw new Error("forceReauthorization cannot be combined with authorizationCode");
 	return auth(provider, {
@@ -6723,8 +7388,7 @@ async function runPlan(plan, params) {
 	}
 	return aggregateOutcomes(outcomes);
 }
-//#endregion
-//#region ../../core/auth/ema/clientConfigError.ts
+// ../../core/auth/ema/clientConfigError.ts
 function emaClientNotConfiguredMessage(reason) {
 	if (reason === "disabled") return "This server uses enterprise-managed authorization, but Enterprise IdP is turned off in Client Settings. Open Client Settings, enable \"Enterprise IdP configuration\", then try connecting again.";
 	return "This server uses enterprise-managed authorization, but the Inspector client IdP is not configured. Open Client Settings, enable Enterprise IdP, and set issuer, client ID, and client secret.";
@@ -6740,12 +7404,10 @@ var EmaClientNotConfiguredError = class extends Error {
 function isEmaClientNotConfiguredError(err) {
 	return err instanceof EmaClientNotConfiguredError;
 }
-//#endregion
-//#region ../../core/auth/ema/constants.ts
+// ../../core/auth/ema/constants.ts
 const GRANT_TYPE_JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 const IDP_OIDC_SCOPES = "openid offline_access";
-//#endregion
-//#region ../../core/auth/ema/jwt.ts
+// ../../core/auth/ema/jwt.ts
 function decodeBase64Url(segment) {
 	const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
 	const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
@@ -6772,8 +7434,19 @@ function isJwtFormat(token) {
 	const parts = token.split(".");
 	return parts.length === 3 && parts[0].length > 0 && parts[1].length > 0 && parts[2] !== void 0;
 }
-//#endregion
-//#region ../../core/auth/ema/storage.ts
+function decodeJwtPayload(token) {
+	if (!isJwtFormat(token)) return void 0;
+	const parts = token.split(".");
+	try {
+		return {
+			header: JSON.parse(decodeBase64Url(parts[0])),
+			payload: JSON.parse(decodeBase64Url(parts[1]))
+		};
+	} catch {
+		return;
+	}
+}
+// ../../core/auth/ema/storage.ts
 function normalizeIdpIssuer(issuer) {
 	return issuer.replace(/\/$/, "");
 }
@@ -6781,8 +7454,7 @@ const IDP_OAUTH_KEY_PREFIX = "ema-idp:";
 function idpOAuthStorageKey(issuer) {
 	return `${IDP_OAUTH_KEY_PREFIX}${normalizeIdpIssuer(issuer)}`;
 }
-//#endregion
-//#region ../../core/auth/ema/tokenEndpoint.ts
+// ../../core/auth/ema/tokenEndpoint.ts
 async function parseOAuthTokenErrorResponse(response, step) {
 	let body;
 	try {
@@ -6826,8 +7498,7 @@ async function postOAuthTokenRequest(tokenUrl, body, metadata, clientInformation
 		body
 	});
 }
-//#endregion
-//#region ../../core/auth/ema/idpOidc.ts
+// ../../core/auth/ema/idpOidc.ts
 function idpClientInformation(idp) {
 	return {
 		client_id: idp.clientId,
@@ -6950,8 +7621,7 @@ async function getValidIdToken(params) {
 		return;
 	}
 }
-//#endregion
-//#region ../../core/auth/discovery.ts
+// ../../core/auth/discovery.ts
 function serverUrlAsAuthorizationServer(serverUrl) {
 	try {
 		const url = new URL(serverUrl);
@@ -6993,8 +7663,7 @@ async function discoverAuthorizationServerMetadataFromCandidates(candidates, dis
 async function discoverAuthorizationServerMetadataForServer(serverUrl, resourceMetadata, fetchFn) {
 	return (await discoverAuthorizationServerMetadataFromCandidates(getAuthorizationServerUrlCandidates(serverUrl, resourceMetadata), (candidate) => discoverAuthorizationServerMetadata(candidate, { fetchFn })))?.metadata;
 }
-//#endregion
-//#region ../../core/auth/ema/resourceContext.ts
+// ../../core/auth/ema/resourceContext.ts
 function resolveEmaScopes(resourceMetadata, configuredScope) {
 	const trimmed = configuredScope?.trim();
 	if (trimmed) return trimmed;
@@ -7027,8 +7696,7 @@ async function discoverResourceAsMetadata(resourceAsUrl, fetchFn) {
 	if (!metadata) throw new Error("Failed to discover resource authorization server metadata");
 	return metadata;
 }
-//#endregion
-//#region ../../core/auth/ema/wire.ts
+// ../../core/auth/ema/wire.ts
 async function exchangeIdJag(params) {
 	const issuer = normalizeIdpIssuer(params.idp.issuer);
 	const resource = params.resource.trim();
@@ -7072,8 +7740,7 @@ async function redeemIdJagForAccessToken(params) {
 	if (!response.ok) throw await parseOAuthTokenErrorResponse(response, "EMA leg 3 (resource AS JWT bearer grant)");
 	return OAuthTokensSchema.parse(await response.json());
 }
-//#endregion
-//#region ../../core/auth/ema/emaFlow.ts
+// ../../core/auth/ema/emaFlow.ts
 function wrapEmaMintError(err) {
 	const message = err instanceof Error ? err.message : String(err);
 	return new Error(`EMA legs 2–3 (resource token mint): ${message}`, { cause: err });
@@ -7173,8 +7840,7 @@ async function refreshEmaResourceTokens(config) {
 	await saveMintedTokens(config, minted);
 	return minted.tokens;
 }
-//#endregion
-//#region ../../core/auth/ema/idpSession.ts
+// ../../core/auth/ema/idpSession.ts
 async function getEmaIdpLoginState(storage, issuer) {
 	const normalized = normalizeIdpIssuer(issuer);
 	if (!normalized) return "none";
@@ -7184,8 +7850,7 @@ async function getEmaIdpLoginState(storage, issuer) {
 	if (session.refreshToken) return "logged_in";
 	return "expired";
 }
-//#endregion
-//#region ../../core/auth/connection-state.ts
+// ../../core/auth/connection-state.ts
 function isAccessTokenUsable$1(tokens) {
 	if (!tokens?.access_token) return false;
 	return !isJwtExpired(tokens.access_token);
@@ -7268,8 +7933,7 @@ async function hasPersistedOAuthServerState(storage, serverUrl) {
 function protocolFromOAuthConfig(config) {
 	return authProtocolFromEnterpriseManaged(config.enterpriseManaged);
 }
-//#endregion
-//#region ../../core/auth/cimd.ts
+// ../../core/auth/cimd.ts
 async function ensureCimdClientRegistration(params) {
 	const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
 	if (!clientMetadataUrl) return;
@@ -7295,8 +7959,7 @@ async function ensureCimdClientRegistration(params) {
 		...issuer && { issuer }
 	});
 }
-//#endregion
-//#region ../../core/auth/ema/transportProvider.ts
+// ../../core/auth/ema/transportProvider.ts
 function isAccessTokenUsable(tokens, skewMs = 6e4) {
 	if (!tokens.access_token) return false;
 	return !isJwtExpired(tokens.access_token, skewMs);
@@ -7356,8 +8019,7 @@ var EmaTransportOAuthProvider = class {
 		return this.inner.codeVerifier();
 	}
 };
-//#endregion
-//#region ../../core/auth/oauthUx.ts
+// ../../core/auth/oauthUx.ts
 function isStandardOAuthStepUp(challenge, options) {
 	return challenge.reason === "insufficient_scope" && !options?.enterpriseManaged;
 }
@@ -7429,8 +8091,7 @@ function issuerBindingFailureCopy(failure, options) {
 		})
 	};
 }
-//#endregion
-//#region ../../core/mcp/oauthManager.ts
+// ../../core/mcp/oauthManager.ts
 var OAuthManager = class {
 	params;
 	oauthConfig;
@@ -7913,8 +8574,7 @@ var OAuthManager = class {
 		return provider;
 	}
 };
-//#endregion
-//#region ../../core/mcp/remote/types.ts
+// ../../core/mcp/remote/types.ts
 function oauthTokensToRemoteAuthState(tokens) {
 	return { oauthTokens: {
 		access_token: tokens.access_token,
@@ -7925,8 +8585,7 @@ function oauthTokensToRemoteAuthState(tokens) {
 		id_token: tokens.id_token
 	} };
 }
-//#endregion
-//#region ../../core/mcp/remote/progressToken.ts
+// ../../core/mcp/remote/progressToken.ts
 function progressTokenOf(message) {
 	if ("method" in message && message.method === "notifications/progress" && "params" in message && typeof message.params === "object" && message.params !== null) {
 		const parsed = ProgressTokenSchema.safeParse(message.params.progressToken);
@@ -7939,8 +8598,7 @@ function waitForProgressToken(waits, token) {
 	const numeric = Number(token);
 	return Number.isSafeInteger(numeric) ? waits.get(numeric) : void 0;
 }
-//#endregion
-//#region ../../core/mcp/remote/remoteClientTransport.ts
+// ../../core/mcp/remote/remoteClientTransport.ts
 const DEFAULT_SSE_RESPONSE_TIMEOUT_MS = 6e4;
 function requestIdForMessage(message) {
 	if ("method" in message && "id" in message && message.id !== null && message.id !== void 0) {
@@ -8084,7 +8742,8 @@ var RemoteClientTransport = class {
 		const body = {
 			config: this.config,
 			...authState && { authState },
-			...this.options.settings && { settings: this.options.settings }
+			...this.options.settings && { settings: this.options.settings },
+			...this.options.serverName && { serverName: this.options.serverName }
 		};
 		const res = await this.fetchFn(`${this.baseUrl}/api/mcp/connect`, {
 			method: "POST",
@@ -8333,6 +8992,16 @@ var RemoteClientTransport = class {
 		}
 		return await res.json();
 	}
+	releaseOnPageHide() {
+		if (!this._sessionId) return false;
+		this.fetchFn(`${this.baseUrl}/api/mcp/disconnect`, {
+			method: "POST",
+			headers: this.headers,
+			body: JSON.stringify({ sessionId: this._sessionId }),
+			keepalive: true
+		}).catch(() => {});
+		return true;
+	}
 	async close() {
 		if (this.closed) return;
 		this.closed = true;
@@ -8360,8 +9029,25 @@ var RemoteClientTransport = class {
 	onerror;
 	onmessage;
 };
-//#endregion
-//#region ../../core/mcp/inspectorClient.ts
+// ../../core/mcp/sessionTermination.ts
+function canTerminateSession(transport) {
+	return typeof transport === "object" && transport !== null && "terminateSession" in transport && typeof transport.terminateSession === "function";
+}
+const SESSION_TERMINATE_TIMEOUT_MS = 3e3;
+async function terminateSessionBestEffort(transport, timeoutMs = SESSION_TERMINATE_TIMEOUT_MS) {
+	if (!canTerminateSession(transport) || !transport.sessionId) return false;
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(false), timeoutMs);
+	});
+	const terminated = new Promise((resolve) => resolve(transport.terminateSession())).then(() => true, () => false);
+	try {
+		return await Promise.race([terminated, timedOut]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+// ../../core/mcp/inspectorClient.ts
 const corePackageJson = {
 	name: "mcp-inspector",
 	version: "0.0.0"
@@ -8490,6 +9176,7 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 	transportClientFactory;
 	fetchFn;
 	effectiveAuthFetch;
+	fetchRefusals = [];
 	sessionId;
 	transportConfig;
 	directAuthRecoveryActive = null;
@@ -8525,8 +9212,9 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 			resources: options.listChangedNotifications?.resources ?? true,
 			prompts: options.listChangedNotifications?.prompts ?? true
 		};
-		const transportBase = this.fetchFn ?? fetch;
-		const oauthBase = options.environment.oauthFetch;
+		const reportRefusal = (refusal) => this.recordFetchRefusal(refusal);
+		const transportBase = withFetchRefusalReporting(this.fetchFn ?? fetch, reportRefusal);
+		const oauthBase = options.environment.oauthFetch && withFetchRefusalReporting(options.environment.oauthFetch, reportRefusal);
 		const isMcpEndpoint = exemptMcpEndpoint(() => this.getServerUrl(), () => this.transportConfig?.type === "sse");
 		const getOverrides = () => this.oauthManager?.getEndpointOverrides();
 		const withOverrides = withOAuthEndpointOverrides(oauthBase ? routeOAuthRequests(transportBase, oauthBase, isMcpEndpoint) : transportBase, getOverrides);
@@ -9063,6 +9751,7 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 					while (handlers?.size !== void 0 && handlers.size > 0 && Date.now() < deadline) await new Promise((r) => setTimeout(r, 10));
 				}
 				await this.closeTaskSessionBestEffort();
+				await terminateSessionBestEffort(this.baseTransport);
 				try {
 					await this.client.close();
 				} catch {}
@@ -9105,6 +9794,14 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 		this.dispatchTypedEvent("excludedToolsChange", this.excludedTools);
 		this.dispatchTypedEvent("malformedListItemsChange", []);
 	}
+	getFetchRefusals() {
+		return [...this.fetchRefusals];
+	}
+	recordFetchRefusal(refusal) {
+		if (this.fetchRefusals.some((r) => r.url === refusal.url && r.reason === refusal.reason)) return;
+		this.fetchRefusals = [...this.fetchRefusals, refusal].slice(-20);
+		this.dispatchTypedEvent("fetchRefused", refusal);
+	}
 	getAppRendererClient() {
 		if (!this.client || this.status !== "connected") return null;
 		return this.client;
@@ -9270,7 +9967,7 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 				params: request.params,
 				signal: controller.signal
 			});
-			this.outputValidator ??= new AjvJsonSchemaValidator();
+			this.outputValidator ??= new LinearPatternJsonSchemaValidator();
 			const invalid = validateAppElicitResult(this.outputValidator, request.params, result);
 			if (invalid) {
 				this.logger.warn({
@@ -9869,7 +10566,7 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 		});
 	}
 	validateToolOutput(tool, result) {
-		this.outputValidator ??= new AjvJsonSchemaValidator();
+		this.outputValidator ??= new LinearPatternJsonSchemaValidator();
 		return validateToolOutput(this.outputValidator, tool, result);
 	}
 	cancelPendingTaskInput(taskId) {
@@ -10716,6 +11413,10 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 	getRemoteBackendSessionId() {
 		if (this.baseTransport instanceof RemoteClientTransport) return this.baseTransport.getRemoteBackendSessionId();
 	}
+	releaseRemoteSessionOnPageHide() {
+		if (this.baseTransport instanceof RemoteClientTransport) return this.baseTransport.releaseOnPageHide();
+		return false;
+	}
 	async resumeAfterOAuth(authorizationCode, options) {
 		await this.completeOAuthFlow(authorizationCode, options?.iss, options?.state);
 		const remoteSessionId = options?.remoteSessionId;
@@ -10753,8 +11454,7 @@ var InspectorClient = class InspectorClient extends InspectorClientEventTarget {
 		return this.oauthManager.getOAuthState();
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/managedListState.ts
+// ../../core/mcp/state/managedListState.ts
 var ManagedListState = class extends TypedEventTarget {
 	items = [];
 	client = null;
@@ -10899,8 +11599,7 @@ var ManagedListState = class extends TypedEventTarget {
 		this.loaded = false;
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/managedToolsState.ts
+// ../../core/mcp/state/managedToolsState.ts
 var ManagedToolsState = class extends ManagedListState {
 	constructor(client, debounceMs = 250) {
 		super(client, {
@@ -10923,8 +11622,7 @@ var ManagedToolsState = class extends ManagedListState {
 		return this.getItems();
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/messageLogState.ts
+// ../../core/mcp/state/messageLogState.ts
 var MessageLogState = class extends TypedEventTarget {
 	messages = [];
 	pendingRequestEntries = /* @__PURE__ */ new Map();
@@ -10941,6 +11639,16 @@ var MessageLogState = class extends TypedEventTarget {
 			this.dispatchTypedEvent("message", entry);
 			this.dispatchTypedEvent("messagesChange", this.getMessages());
 		};
+		const replaceEntry = (entry, changes) => {
+			const index = this.messages.lastIndexOf(entry);
+			if (index < 0) return void 0;
+			const updated = {
+				...entry,
+				...changes
+			};
+			this.messages[index] = updated;
+			return updated;
+		};
 		const onMessage = (event) => {
 			const entry = event.detail;
 			if (entry.direction === "request") {
@@ -10954,9 +11662,12 @@ var MessageLogState = class extends TypedEventTarget {
 				const requestEntry = messageId !== void 0 ? this.pendingRequestEntries.get(messageId) : void 0;
 				if (requestEntry) {
 					this.pendingRequestEntries.delete(messageId);
-					requestEntry.response = entry.message;
-					requestEntry.duration = entry.timestamp.getTime() - requestEntry.timestamp.getTime();
-					this.dispatchTypedEvent("message", requestEntry);
+					const updated = replaceEntry(requestEntry, {
+						response: entry.message,
+						duration: entry.timestamp.getTime() - requestEntry.timestamp.getTime()
+					});
+					if (!updated) return;
+					this.dispatchTypedEvent("message", updated);
 					this.dispatchTypedEvent("messagesChange", this.getMessages());
 					return;
 				}
@@ -10970,8 +11681,12 @@ var MessageLogState = class extends TypedEventTarget {
 				if (entry.message.id !== id) continue;
 				if (entry.direction === "notification") continue;
 				if (entry.direction === "request" && !entry.response) continue;
-				entry.clientError = reason;
-				this.dispatchTypedEvent("message", entry);
+				const updated = {
+					...entry,
+					clientError: reason
+				};
+				this.messages[i] = updated;
+				this.dispatchTypedEvent("message", updated);
 				this.dispatchTypedEvent("messagesChange", this.getMessages());
 				return;
 			}
@@ -10981,9 +11696,12 @@ var MessageLogState = class extends TypedEventTarget {
 			const requestEntry = this.pendingRequestEntries.get(id);
 			if (!requestEntry) return;
 			this.pendingRequestEntries.delete(id);
-			requestEntry.clientError = reason;
-			requestEntry.duration = Date.now() - requestEntry.timestamp.getTime();
-			this.dispatchTypedEvent("message", requestEntry);
+			const updated = replaceEntry(requestEntry, {
+				clientError: reason,
+				duration: Date.now() - requestEntry.timestamp.getTime()
+			});
+			if (!updated) return;
+			this.dispatchTypedEvent("message", updated);
 			this.dispatchTypedEvent("messagesChange", this.getMessages());
 		};
 		const onStatusChange = () => {
@@ -11027,8 +11745,7 @@ var MessageLogState = class extends TypedEventTarget {
 		this.pendingRequestEntries.clear();
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/fetchRequestLogState.ts
+// ../../core/mcp/state/fetchRequestLogState.ts
 var FetchRequestLogState = class extends TypedEventTarget {
 	fetchRequests = [];
 	client = null;
@@ -11147,8 +11864,7 @@ var FetchRequestLogState = class extends TypedEventTarget {
 		this.fetchRequests = [];
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/stderrLogState.ts
+// ../../core/mcp/state/stderrLogState.ts
 var StderrLogState = class extends TypedEventTarget {
 	stderrLogs = [];
 	client = null;
@@ -11185,8 +11901,7 @@ var StderrLogState = class extends TypedEventTarget {
 		this.stderrLogs = [];
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/managedResourcesState.ts
+// ../../core/mcp/state/managedResourcesState.ts
 var ManagedResourcesState = class extends ManagedListState {
 	constructor(client, debounceMs = 250) {
 		super(client, {
@@ -11209,8 +11924,7 @@ var ManagedResourcesState = class extends ManagedListState {
 		return this.getItems();
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/managedResourceTemplatesState.ts
+// ../../core/mcp/state/managedResourceTemplatesState.ts
 var ManagedResourceTemplatesState = class extends ManagedListState {
 	constructor(client, debounceMs = 250) {
 		super(client, {
@@ -11233,8 +11947,7 @@ var ManagedResourceTemplatesState = class extends ManagedListState {
 		return this.getItems();
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/managedPromptsState.ts
+// ../../core/mcp/state/managedPromptsState.ts
 var ManagedPromptsState = class extends ManagedListState {
 	constructor(client, debounceMs = 250) {
 		super(client, {
@@ -11257,8 +11970,7 @@ var ManagedPromptsState = class extends ManagedListState {
 		return this.getItems();
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/mergeTaskIntoList.ts
+// ../../core/mcp/state/mergeTaskIntoList.ts
 function mergeTaskIntoList(tasks, taskId, task) {
 	const normalized = {
 		...task,
@@ -11271,8 +11983,7 @@ function mergeTaskIntoList(tasks, taskId, task) {
 	next[idx] = normalized;
 	return next;
 }
-//#endregion
-//#region ../../core/mcp/state/managedRequestorTasksState.ts
+// ../../core/mcp/state/managedRequestorTasksState.ts
 const MAX_PAGES = 100;
 const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"completed",
@@ -11407,8 +12118,7 @@ var ManagedRequestorTasksState = class extends TypedEventTarget {
 		this.cancelledTaskIds.clear();
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/resourceSubscriptionsState.ts
+// ../../core/mcp/state/resourceSubscriptionsState.ts
 var ResourceSubscriptionsState = class extends TypedEventTarget {
 	subscribedUris = [];
 	lastUpdatedByUri = /* @__PURE__ */ new Map();
@@ -11497,8 +12207,7 @@ var ResourceSubscriptionsState = class extends TypedEventTarget {
 		this.streamState = INACTIVE_SUBSCRIPTION_STREAM_STATE;
 	}
 };
-//#endregion
-//#region ../../core/mcp/state/managedSkillsState.ts
+// ../../core/mcp/state/managedSkillsState.ts
 const REPEATED_CURSOR_MESSAGE = "Server repeated a pagination cursor in skills/list; stopped to avoid an infinite walk.";
 const SKILLS_MAX_PAGES = 64;
 const SKILLS_PAGE_LIMIT_MESSAGE = `skills/list exceeded ${SKILLS_MAX_PAGES} pages without the server's pagination converging`;
@@ -11607,17 +12316,45 @@ var ManagedSkillsState = class extends TypedEventTarget {
 		this.error = null;
 	}
 };
-//#endregion
-//#region ../../core/react/useStoreSnapshot.ts
-function useStoreSnapshot(store, event, read, whenAbsent) {
+// ../../core/react/notifyScheduler.ts
+function coalesce(onChange, schedule) {
+	let cancelPending = null;
+	return {
+		notify: () => {
+			if (cancelPending) return;
+			cancelPending = schedule(() => {
+				cancelPending = null;
+				onChange();
+			});
+		},
+		cancel: () => {
+			cancelPending?.();
+			cancelPending = null;
+		}
+	};
+}
+// ../../core/react/useStoreSnapshot.ts
+function useStoreSnapshot(store, event, read, whenAbsent, schedule) {
 	const cache = useRef(null);
 	const subscribe = useCallback((onStoreChange) => {
 		if (!store) return () => {};
-		store.addEventListener(event, onStoreChange);
+		if (!schedule) {
+			store.addEventListener(event, onStoreChange);
+			return () => {
+				store.removeEventListener(event, onStoreChange);
+			};
+		}
+		const { notify, cancel } = coalesce(onStoreChange, schedule);
+		store.addEventListener(event, notify);
 		return () => {
-			store.removeEventListener(event, onStoreChange);
+			store.removeEventListener(event, notify);
+			cancel();
 		};
-	}, [store, event]);
+	}, [
+		store,
+		event,
+		schedule
+	]);
 	const getSnapshot = useCallback(() => {
 		const revision = store ? store.getEventRevision(event) : 0;
 		const cached = cache.current;
@@ -11640,8 +12377,7 @@ function useStoreSnapshot(store, event, read, whenAbsent) {
 	]);
 	return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
 }
-//#endregion
-//#region ../../core/react/useInspectorClient.ts
+// ../../core/react/useInspectorClient.ts
 const EMPTY_CLIENT_CAPABILITIES = Object.freeze({});
 const NO_EXCLUDED_TOOLS = [];
 const NO_MALFORMED_LIST_ITEMS = [];
@@ -11659,7 +12395,7 @@ const readDiscoverResult = (client) => client.getDiscoverResult();
 const readExcludedTools = (client) => client.getExcludedTools();
 const readMalformedListItems = (client) => client.getMalformedListItems();
 const readConnectionDiagnostics = (client) => client.getConnectionDiagnostics?.() ?? NO_CONNECTION_DIAGNOSTICS;
-function useInspectorClient(inspectorClient) {
+function useInspectorClient(inspectorClient, diagnosticsSchedule) {
 	const status = useStoreSnapshot(inspectorClient, "statusChange", readStatus, "disconnected");
 	const capabilities = useStoreSnapshot(inspectorClient, "capabilitiesChange", readCapabilities, void 0);
 	const serverInfo = useStoreSnapshot(inspectorClient, "serverInfoChange", readServerInfo, void 0);
@@ -11669,7 +12405,7 @@ function useInspectorClient(inspectorClient) {
 	const discoverResult = useStoreSnapshot(inspectorClient, "discoverResultChange", readDiscoverResult, void 0);
 	const excludedTools = useStoreSnapshot(inspectorClient, "excludedToolsChange", readExcludedTools, NO_EXCLUDED_TOOLS);
 	const malformedListItems = useStoreSnapshot(inspectorClient, "malformedListItemsChange", readMalformedListItems, NO_MALFORMED_LIST_ITEMS);
-	const connectionDiagnostics = useStoreSnapshot(inspectorClient, "connectionDiagnosticsChange", readConnectionDiagnostics, NO_CONNECTION_DIAGNOSTICS);
+	const connectionDiagnostics = useStoreSnapshot(inspectorClient, "connectionDiagnosticsChange", readConnectionDiagnostics, NO_CONNECTION_DIAGNOSTICS, diagnosticsSchedule);
 	const [errorState, setErrorState] = useState({ client: inspectorClient });
 	if (errorState.client !== inspectorClient) setErrorState({ client: inspectorClient });
 	const lastError = errorState.client === inspectorClient ? errorState.message : void 0;
@@ -11717,8 +12453,7 @@ function useInspectorClient(inspectorClient) {
 		disconnect
 	};
 }
-//#endregion
-//#region ../../core/react/useListError.ts
+// ../../core/react/useListError.ts
 function useListError(state) {
 	const subscribe = useCallback((onStoreChange) => {
 		if (!state) return () => {};
@@ -11731,8 +12466,7 @@ function useListError(state) {
 	const getSnapshot = useCallback(() => state?.getError() ?? null, [state]);
 	return useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
 }
-//#endregion
-//#region ../../core/react/useManagedTools.ts
+// ../../core/react/useManagedTools.ts
 const NO_TOOLS = [];
 const readTools = (state) => state.getTools();
 const readListChanged$2 = (state) => state.getListChanged();
@@ -11756,8 +12490,18 @@ function useManagedTools(client, managedToolsState) {
 		}, [managedToolsState])
 	};
 }
-//#endregion
-//#region ../../core/react/useManagedResources.ts
+// ../../core/mcp/toolOrder.ts
+const toolLabelCollator = new Intl.Collator(void 0, {
+	sensitivity: "base",
+	numeric: true
+});
+function compareToolLabels(a, b) {
+	return toolLabelCollator.compare(a, b);
+}
+function compareToolsByName(a, b) {
+	return compareToolLabels(a.name, b.name);
+}
+// ../../core/react/useManagedResources.ts
 const NO_RESOURCES = [];
 const readResources = (state) => state.getResources();
 const readListChanged$1 = (state) => state.getListChanged();
@@ -11781,8 +12525,7 @@ function useManagedResources(client, managedResourcesState) {
 		}, [managedResourcesState])
 	};
 }
-//#endregion
-//#region ../../core/react/useManagedResourceTemplates.ts
+// ../../core/react/useManagedResourceTemplates.ts
 const NO_RESOURCE_TEMPLATES = [];
 const readResourceTemplates = (state) => state.getResourceTemplates();
 function useManagedResourceTemplates(client, managedResourceTemplatesState) {
@@ -11795,8 +12538,7 @@ function useManagedResourceTemplates(client, managedResourceTemplatesState) {
 		}, [client, managedResourceTemplatesState])
 	};
 }
-//#endregion
-//#region ../../core/react/useManagedPrompts.ts
+// ../../core/react/useManagedPrompts.ts
 const NO_PROMPTS = [];
 const readPrompts = (state) => state.getPrompts();
 const readListChanged = (state) => state.getListChanged();
@@ -11820,8 +12562,7 @@ function useManagedPrompts(client, managedPromptsState) {
 		}, [managedPromptsState])
 	};
 }
-//#endregion
-//#region ../../core/react/useManagedSkills.ts
+// ../../core/react/useManagedSkills.ts
 const NO_SKILLS = [];
 const NO_SKILLS_PAGINATION = Object.freeze({ pageCount: 0 });
 const readSkills = (state) => state.getSkills();
@@ -11839,29 +12580,25 @@ function useManagedSkills(client, managedSkillsState) {
 		}, [client, managedSkillsState])
 	};
 }
-//#endregion
-//#region ../../core/react/useMessageLog.ts
+// ../../core/react/useMessageLog.ts
 const NO_MESSAGES = [];
 const readMessages = (state) => state.getMessages();
-function useMessageLog(messageLogState) {
-	return { messages: useStoreSnapshot(messageLogState, "messagesChange", readMessages, NO_MESSAGES) };
+function useMessageLog(messageLogState, schedule) {
+	return { messages: useStoreSnapshot(messageLogState, "messagesChange", readMessages, NO_MESSAGES, schedule) };
 }
-//#endregion
-//#region ../../core/react/useFetchRequestLog.ts
+// ../../core/react/useFetchRequestLog.ts
 const NO_FETCH_REQUESTS = [];
 const readFetchRequests = (state) => state.getFetchRequests();
-function useFetchRequestLog(fetchRequestLogState) {
-	return { fetchRequests: useStoreSnapshot(fetchRequestLogState, "fetchRequestsChange", readFetchRequests, NO_FETCH_REQUESTS) };
+function useFetchRequestLog(fetchRequestLogState, schedule) {
+	return { fetchRequests: useStoreSnapshot(fetchRequestLogState, "fetchRequestsChange", readFetchRequests, NO_FETCH_REQUESTS, schedule) };
 }
-//#endregion
-//#region ../../core/react/useStderrLog.ts
+// ../../core/react/useStderrLog.ts
 const NO_STDERR_LOGS = [];
 const readStderrLogs = (state) => state.getStderrLogs();
-function useStderrLog(stderrLogState) {
-	return { stderrLogs: useStoreSnapshot(stderrLogState, "stderrLogsChange", readStderrLogs, NO_STDERR_LOGS) };
+function useStderrLog(stderrLogState, schedule) {
+	return { stderrLogs: useStoreSnapshot(stderrLogState, "stderrLogsChange", readStderrLogs, NO_STDERR_LOGS, schedule) };
 }
-//#endregion
-//#region ../../core/react/useManagedRequestorTasks.ts
+// ../../core/react/useManagedRequestorTasks.ts
 const NO_TASKS = [];
 const readTasks = (state) => state.getTasks();
 function useManagedRequestorTasks(client, managedRequestorTasksState) {
@@ -11876,8 +12613,7 @@ function useManagedRequestorTasks(client, managedRequestorTasksState) {
 		}, [managedRequestorTasksState])
 	};
 }
-//#endregion
-//#region ../../core/react/useResourceSubscriptions.ts
+// ../../core/react/useResourceSubscriptions.ts
 const NO_SUBSCRIPTIONS = [];
 const readSubscriptions = (state) => state.getSubscriptions();
 const readStreamState = (state) => state.getStreamState();
@@ -11887,8 +12623,18 @@ function useResourceSubscriptions(state) {
 		streamState: useStoreSnapshot(state, "streamStateChange", readStreamState, INACTIVE_SUBSCRIPTION_STREAM_STATE)
 	};
 }
-//#endregion
-//#region ../../core/auth/issuerBinding.ts
+// ../../core/react/usePendingClientRequests.ts
+const NO_SAMPLES = [];
+const NO_ELICITATIONS = [];
+const readPendingSamples = (client) => client.getPendingSamples();
+const readPendingElicitations = (client) => client.getPendingElicitations();
+function usePendingClientRequests(inspectorClient) {
+	return {
+		pendingSamples: useStoreSnapshot(inspectorClient, "pendingSamplesChange", readPendingSamples, NO_SAMPLES),
+		pendingElicitations: useStoreSnapshot(inspectorClient, "pendingElicitationsChange", readPendingElicitations, NO_ELICITATIONS)
+	};
+}
+// ../../core/auth/issuerBinding.ts
 const MISSING_DISCOVERY_STATE_PHRASE = "discoveryState was not available";
 function isAuthorizationServerMismatchShape(err) {
 	if (err === null || typeof err !== "object") return false;
@@ -11928,8 +12674,7 @@ function classifyAuthorizationServerMismatch(err) {
 		currentIssuer: err.currentIssuer
 	};
 }
-//#endregion
-//#region ../../core/auth/oauth-storage.ts
+// ../../core/auth/oauth-storage.ts
 function withIssuer(value, issuer) {
 	return issuer === void 0 ? value : {
 		...value,
@@ -12206,8 +12951,7 @@ var OAuthStorageBase = class {
 		await this.persist({ servers });
 	}
 };
-//#endregion
-//#region ../../core/auth/store.ts
+// ../../core/auth/store.ts
 var OAuthMemoryStore = class {
 	servers = {};
 	idpSessions = {};
@@ -12270,8 +13014,7 @@ var OAuthMemoryStore = class {
 		this.idpSessions = { ...snapshot.idpSessions ?? {} };
 	}
 };
-//#endregion
-//#region ../../core/auth/oauth-persist.ts
+// ../../core/auth/oauth-persist.ts
 function mergeOAuthSections(disk, snapshot, sections) {
 	const merged = {
 		servers: { ...disk?.servers },
@@ -12336,8 +13079,7 @@ function parseOAuthPersistBlob(raw) {
 function serializeOAuthPersistBlob(snapshot) {
 	return serializeStore(snapshot);
 }
-//#endregion
-//#region ../../core/auth/node/oauth-secrets.ts
+// ../../core/auth/node/oauth-secrets.ts
 const PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
 const warnedPolicyValues = /* @__PURE__ */ new Set();
 function getPersistTokensPolicy(env = process.env) {
@@ -12607,8 +13349,7 @@ function snapshotHasPlaintextSecrets(snapshot) {
 	for (const session of Object.values(snapshot.idpSessions)) if (session.idToken !== void 0 || session.refreshToken !== void 0) return true;
 	return false;
 }
-//#endregion
-//#region ../../core/auth/node/oauth-namespace-ledger.ts
+// ../../core/auth/node/oauth-namespace-ledger.ts
 const namespaceLedgerPath = (stateFilePath) => `${stateFilePath}.namespaces.json`;
 const KEYRING_LOCATION = "keyring";
 const FILE_LOCATION_PREFIX = "file:";
@@ -12866,8 +13607,7 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current, ow
 		warnLedgerFailure("update", error);
 	}
 }
-//#endregion
-//#region ../../core/auth/node/oauth-persist-file.ts
+// ../../core/auth/node/oauth-persist-file.ts
 const warnedStoreFailures = /* @__PURE__ */ new Set();
 function warnStoreWriteFailure(error) {
 	const reason = error instanceof Error ? error.message : String(error);
@@ -13413,8 +14153,7 @@ function createFileOAuthPersistBackend(options) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/auth/node/storage-node.ts
+// ../../core/auth/node/storage-node.ts
 const DEFAULT_STATE_PATH = getStoreFilePath(getDefaultStorageDir(), "oauth");
 function getStateFilePath(customPath) {
 	if (customPath) return customPath;
@@ -13445,25 +14184,41 @@ var NodeOAuthStorage = class extends OAuthStorageBase {
 		}), shared.coordination);
 	}
 };
-//#endregion
-//#region ../../core/auth/node/oauth-callback-server.ts
+// ../../core/auth/node/oauth-callback-server.ts
 const DEFAULT_HOSTNAME = "127.0.0.1";
 const DEFAULT_CALLBACK_PATH = "/oauth/callback";
-const SUCCESS_HTML = `<!DOCTYPE html>
-<html>
-<head><meta charset="utf-8"><title>OAuth complete</title></head>
-<body><p>OAuth complete. You can close this window.</p></body>
-</html>`;
-function errorHtml(message) {
+const SUCCESS_HTML = page("OAuth complete", "OAuth complete. You can close this window.");
+const NOT_CALLBACK_HTML = page("Not the OAuth callback", "This address is not the OAuth callback the Inspector is waiting for. Sign-in has not finished; return to the Inspector to continue.");
+const STATE_MISMATCH_HTML = page("OAuth callback ignored", "This callback does not belong to the sign-in in progress and was ignored. Sign-in has not finished; the Inspector is still waiting for the authorization server.");
+const ALREADY_HANDLED_HTML = page("OAuth callback already received", "This sign-in has already received its callback. You can close this window.");
+const STOPPED_HTML = page("OAuth callback not expected", "The Inspector is no longer waiting for this sign-in. Start sign-in again from the Inspector.");
+function errorHtml(serverText) {
+	return page("OAuth error", `OAuth failed. The authorization server said: ${serverText}`);
+}
+function exchangeErrorHtml(message) {
+	return page("OAuth error", `OAuth failed: ${message}`);
+}
+function page(title, text) {
 	return `<!DOCTYPE html>
 <html>
-<head><meta charset="utf-8"><title>OAuth error</title></head>
-<body><p>OAuth failed: ${escapeHtml(message)}</p></body>
+<head><meta charset="utf-8"><title>${escapeHtml(title)}</title></head>
+<body><p>${escapeHtml(text)}</p></body>
 </html>`;
 }
 function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+const ANY_STATE = Symbol("any-state");
+const STOPPED = Symbol("stopped");
+function createStopSignal() {
+	let fire;
+	return {
+		stopped: new Promise((resolve) => {
+			fire = () => resolve(STOPPED);
+		}),
+		fire
+	};
+}
 var OAuthCallbackServer = class {
 	server = null;
 	port = 0;
@@ -13471,6 +14226,8 @@ var OAuthCallbackServer = class {
 	handled = false;
 	onCallback;
 	onError;
+	expectedState = Promise.resolve(ANY_STATE);
+	stopSignal = createStopSignal();
 	async start(options = {}) {
 		const { port = 0, hostname = DEFAULT_HOSTNAME, path = DEFAULT_CALLBACK_PATH, onCallback, onError } = options;
 		if (!path.startsWith("/")) return Promise.reject(/* @__PURE__ */ new Error("Callback path must start with '/' (absolute path)"));
@@ -13478,6 +14235,8 @@ var OAuthCallbackServer = class {
 		this.onError = onError;
 		this.handled = false;
 		this.callbackPath = path;
+		this.stopSignal = createStopSignal();
+		this.expectedState = "expectedState" in options ? Promise.race([Promise.resolve(options.expectedState).catch(() => STOPPED), this.stopSignal.stopped]) : Promise.resolve(ANY_STATE);
 		return new Promise((resolve, reject) => {
 			this.server = createServer((req, res) => this.handleRequest(req, res));
 			this.server.on("error", reject);
@@ -13501,6 +14260,7 @@ var OAuthCallbackServer = class {
 	}
 	async stop() {
 		if (!this.server) return;
+		this.stopSignal.fire();
 		await new Promise((resolve) => {
 			this.server.close(() => resolve());
 		});
@@ -13509,11 +14269,14 @@ var OAuthCallbackServer = class {
 	handleRequest(req, res) {
 		const needJson = req.headers["accept"]?.includes("application/json");
 		const send = (status, body, contentType = "text/html; charset=utf-8") => {
-			res.writeHead(status, { "Content-Type": contentType });
+			res.writeHead(status, {
+				"Content-Type": contentType,
+				Connection: "close"
+			});
 			res.end(body);
 		};
 		if (req.method !== "GET") {
-			send(405, needJson ? "{\"error\":\"Method Not Allowed\"}" : SUCCESS_HTML);
+			send(405, needJson ? "{\"error\":\"Method Not Allowed\"}" : NOT_CALLBACK_HTML);
 			return;
 		}
 		let pathname;
@@ -13530,15 +14293,26 @@ var OAuthCallbackServer = class {
 			search = u.search;
 			state = u.searchParams.get("state") ?? void 0;
 		} catch {
-			send(400, needJson ? "{\"error\":\"Bad Request\"}" : SUCCESS_HTML);
+			send(400, needJson ? "{\"error\":\"Bad Request\"}" : NOT_CALLBACK_HTML);
 			return;
 		}
 		if (pathname !== this.callbackPath) {
-			send(404, needJson ? "{\"error\":\"Not Found\"}" : SUCCESS_HTML);
+			send(404, needJson ? "{\"error\":\"Not Found\"}" : NOT_CALLBACK_HTML);
+			return;
+		}
+		this.expectedState.then((expected) => this.handleCallback(expected, state, search, needJson, send));
+	}
+	handleCallback(expected, state, search, needJson, send) {
+		if (expected === STOPPED) {
+			send(503, needJson ? "{\"error\":\"Not waiting for a callback\"}" : STOPPED_HTML);
+			return;
+		}
+		if (expected !== ANY_STATE && state !== expected) {
+			send(400, needJson ? "{\"error\":\"State mismatch\"}" : STATE_MISMATCH_HTML);
 			return;
 		}
 		if (this.handled) {
-			send(409, needJson ? "{\"error\":\"Callback already handled\"}" : SUCCESS_HTML);
+			send(409, needJson ? "{\"error\":\"Callback already handled\"}" : ALREADY_HANDLED_HTML);
 			return;
 		}
 		const params = parseOAuthCallbackParams(search);
@@ -13556,9 +14330,10 @@ var OAuthCallbackServer = class {
 				const msg = err instanceof Error ? err.message : String(err);
 				this.onError?.({
 					error: "callback_error",
-					error_description: msg
+					error_description: msg,
+					source: "callback"
 				});
-				send(500, errorHtml(msg));
+				send(500, exchangeErrorHtml(msg));
 				this.stop();
 			});
 			else {
@@ -13571,7 +14346,8 @@ var OAuthCallbackServer = class {
 		const msg = generateOAuthErrorDescription(params);
 		this.onError?.({
 			error: params.error,
-			error_description: params.error_description ?? void 0
+			error_description: params.error_description ?? void 0,
+			source: "redirect"
 		});
 		send(400, errorHtml(msg));
 	}
@@ -13582,6 +14358,28 @@ function createOAuthCallbackServer() {
 function buildRedirectUrl(host, port, path) {
 	return `http://${formatHostForUrl(host)}:${port}${path}`;
 }
+var OAuthCallbackError = class extends Error {
+	name = "OAuthCallbackError";
+	oauthError;
+	oauthErrorDescription;
+	source;
+	constructor(params) {
+		super(callbackErrorMessage(params));
+		this.source = params.source;
+		if (params.source === "redirect") {
+			if (params.error) this.oauthError = params.error;
+			if (params.error_description) this.oauthErrorDescription = params.error_description;
+		}
+	}
+};
+var OAuthCallbackTimeoutError = class extends Error {
+	name = "OAuthCallbackTimeoutError";
+	timeoutMs;
+	constructor(timeoutMs) {
+		super(`OAuth callback timed out after ${Math.round(timeoutMs / 1e3)}s`);
+		this.timeoutMs = timeoutMs;
+	}
+};
 function toRunnerOAuthError(err) {
 	const failure = findIssuerBindingFailure(err);
 	if (failure) {
@@ -13590,6 +14388,14 @@ function toRunnerOAuthError(err) {
 	}
 	return err instanceof Error ? err : new Error(String(err));
 }
+function stateOf(authorizationUrl) {
+	return authorizationUrl.searchParams.get("state") ?? void 0;
+}
+function callbackErrorMessage(params) {
+	if (params.source === "callback") return params.error_description ?? "OAuth callback failed";
+	if (!params.error && !params.error_description) return "OAuth error";
+	return `OAuth authorization failed. The authorization server said: ${params.error_description ? `${params.error_description} (${params.error})` : params.error}`;
+}
 async function runRunnerInteractiveOAuth(options) {
 	const server = (options.createCallbackServer ?? createOAuthCallbackServer)();
 	let flowResolve;
@@ -13619,11 +14425,16 @@ async function runRunnerInteractiveOAuth(options) {
 		process.on("SIGTERM", onSignal);
 	}
 	let timeoutId;
+	let resolveExpectedState;
+	const expectedState = new Promise((resolve) => {
+		resolveExpectedState = resolve;
+	});
 	try {
 		const { redirectUrl } = await racingSignals(server.start({
 			hostname: options.callbackListen.hostname,
 			port: options.callbackListen.port,
 			path: options.callbackListen.pathname,
+			expectedState,
 			onCallback: async (params) => {
 				try {
 					await options.client.completeOAuthFlow(params.code, params.iss, params.state);
@@ -13633,10 +14444,7 @@ async function runRunnerInteractiveOAuth(options) {
 				}
 			},
 			onError: (params) => {
-				flowReject(new Error(
-					/* v8 ignore next -- params.error is a required non-null string, so the "OAuth error" fallback is unreachable */
-					params.error_description ?? params.error ?? "OAuth error"
-				));
+				flowReject(new OAuthCallbackError(params));
 			}
 		}));
 		options.onCallbackServer?.(server);
@@ -13647,15 +14455,21 @@ async function runRunnerInteractiveOAuth(options) {
 			if (timeoutId !== void 0) clearTimeout(timeoutId);
 		}), new Promise((_, reject) => {
 			timeoutId = setTimeout(() => {
-				reject(/* @__PURE__ */ new Error(`OAuth callback timed out after ${Math.round(timeoutMs / 1e3)}s`));
+				reject(new OAuthCallbackTimeoutError(timeoutMs));
 			}, timeoutMs);
 		})]);
 		waitForCallback.catch(() => {});
 		if (options.authorizationUrl) {
+			resolveExpectedState(stateOf(options.authorizationUrl));
 			await racingSignals(options.client.beginInteractiveAuthorization(options.authorizationUrl));
 			await waitForCallback;
-		} else if (await racingSignals(options.client.authenticate()) !== void 0) await waitForCallback;
-		else return { kind: "already_authorized" };
+		} else {
+			const authUrl = await racingSignals(options.client.authenticate());
+			if (authUrl !== void 0) {
+				resolveExpectedState(stateOf(authUrl));
+				await waitForCallback;
+			} else return { kind: "already_authorized" };
+		}
 		if (options.authChallenge) {
 			if (!await racingSignals(options.client.checkAuthChallengeSatisfied(options.authChallenge, { scopeOnly: true }))) return {
 				kind: "insufficient_scope",
@@ -13672,13 +14486,11 @@ async function runRunnerInteractiveOAuth(options) {
 		await server.stop().catch(() => {});
 	}
 }
-//#endregion
-//#region src/oauthMessageTone.ts
+// src/oauthMessageTone.ts
 function oauthMessageToneFor(message, warningText) {
 	return message !== null && message === warningText ? "warning" : "info";
 }
-//#endregion
-//#region src/logger.ts
+// src/logger.ts
 let tuiLoggerInstance;
 function getTuiLogger() {
 	if (!tuiLoggerInstance) {
@@ -13695,8 +14507,7 @@ function getTuiLogger() {
 	}
 	return tuiLoggerInstance;
 }
-//#endregion
-//#region ../../core/node/openUrl.ts
+// ../../core/node/openUrl.ts
 const OPEN_URL_TIMEOUT_MS = 5e3;
 const OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
 function toOpenableHref(href) {
@@ -13724,8 +14535,7 @@ async function openUrl$1(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
 		clearTimeout(timer);
 	}
 }
-//#endregion
-//#region src/utils/openUrl.ts
+// src/utils/openUrl.ts
 function browserOpenFailedMessage(href) {
 	return `Could not open a browser automatically. Open this URL manually to authorize: ${href}`;
 }
@@ -13737,13 +14547,11 @@ async function openUrl(url, onFailure) {
 		onFailure?.(browserOpenFailedMessage(href));
 	}
 }
-//#endregion
-//#region src/utils/tuiOAuth.ts
+// src/utils/tuiOAuth.ts
 function isStepUpConfirmation(challenge, settings) {
 	return isStepUpConfirmation$1(challenge, { enterpriseManaged: settings?.enterpriseManaged });
 }
-//#endregion
-//#region src/components/tabsConfig.ts
+// src/components/tabsConfig.ts
 const tabs = [
 	{
 		id: "info",
@@ -13829,8 +14637,7 @@ function tabBarRows(visible, counts, width) {
 	}
 	return rows;
 }
-//#endregion
-//#region src/components/Tabs.tsx
+// src/components/Tabs.tsx
 function splitLabelAtAccelerator(label, accelerator) {
 	const idx = label.toLowerCase().indexOf(accelerator.toLowerCase());
 	if (idx < 0) return {
@@ -13891,8 +14698,7 @@ function Tabs({ activeTab, width, counts = {}, focused = false, showAuth = true,
 		})
 	});
 }
-//#endregion
-//#region node_modules/ink-scroll-view/dist/index.js
+// node_modules/ink-scroll-view/dist/index.js
 var MeasurableItem = ({ children, onMeasure, index, width, measureKey }) => {
 	const ref = useRef(null);
 	useLayoutEffect(() => {
@@ -14174,8 +14980,7 @@ var ScrollView = forwardRef(({ onScroll, onViewportSizeChange, onContentHeightCh
 		...boxProps
 	});
 });
-//#endregion
-//#region src/components/InfoTab.tsx
+// src/components/InfoTab.tsx
 function InfoTab({ serverName, serverConfig, serverSettings = null, serverState, width, height, focused = false, roots = [], onEditRoots }) {
 	const headerPairs = serverSettings?.headers ?? [];
 	const headersBlock = headerPairs.length > 0 ? /* @__PURE__ */ jsx(Box, {
@@ -14414,8 +15219,7 @@ function InfoTab({ serverName, serverConfig, serverSettings = null, serverState,
 		})] }) : null]
 	});
 }
-//#endregion
-//#region src/components/SelectableItem.tsx
+// src/components/SelectableItem.tsx
 function SelectableItem({ isSelected, bold, children }) {
 	return /* @__PURE__ */ jsxs(Box, {
 		flexShrink: 0,
@@ -14432,8 +15236,7 @@ function SelectableItem({ isSelected, bold, children }) {
 		})]
 	});
 }
-//#endregion
-//#region src/utils/clipboard.ts
+// src/utils/clipboard.ts
 const OSC52_LARGE_PAYLOAD_BYTES = 1e5;
 function toCopyText(value) {
 	if (typeof value === "string") return value;
@@ -14533,8 +15336,7 @@ function useCopyKeys(value, label) {
 function copyStatusColor(tone) {
 	return tone === "success" ? "green" : tone === "warning" ? "yellow" : "red";
 }
-//#endregion
-//#region src/utils/oauthDisplay.ts
+// src/utils/oauthDisplay.ts
 function formatAuthProtocol(protocol) {
 	return protocol === "ema" ? "Enterprise-managed" : "Standard";
 }
@@ -14556,8 +15358,7 @@ function formatScopes(state) {
 	const scopes = (state.grantedScope ?? state.configuredScope)?.split(" ").filter(Boolean);
 	return scopes && scopes.length > 0 ? scopes.join(", ") : void 0;
 }
-//#endregion
-//#region src/utils/errorText.ts
+// src/utils/errorText.ts
 function errorMessage$1(err) {
 	return redactUrlsInText(err instanceof Error ? err.message : String(err));
 }
@@ -14567,8 +15368,128 @@ function redactErrorText(text) {
 function redactedJson(value) {
 	return redactUrlsInText(JSON.stringify(value, null, 2) ?? String(value));
 }
-//#endregion
-//#region src/components/AuthTab.tsx
+// ../../core/auth/accessTokenClaims.ts
+const CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
+function clean(value) {
+	return value.replace(CONTROL_CHARS, "");
+}
+function stringClaim(value) {
+	if (typeof value !== "string") return void 0;
+	const cleaned = clean(value).trim();
+	return cleaned.length > 0 ? cleaned : void 0;
+}
+function listClaim(value) {
+	const strings = (Array.isArray(value) ? value : [value]).map(stringClaim).filter((s) => s !== void 0);
+	return strings.length > 0 ? strings : void 0;
+}
+function scopeString(value) {
+	const s = stringClaim(value);
+	if (s === void 0) return void 0;
+	return s.split(/\s+/).filter(Boolean);
+}
+function numericClaim(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function summarizeAccessToken(tokens) {
+	const claims = decodeJwtPayload(tokens.access_token)?.payload;
+	if (claims && typeof claims === "object" && !Array.isArray(claims)) return {
+		format: "jwt",
+		issuer: stringClaim(claims.iss),
+		audience: listClaim(claims.aud),
+		subject: stringClaim(claims.sub),
+		clientId: stringClaim(claims.client_id) ?? stringClaim(claims.azp),
+		scopes: scopeString(claims.scope) ?? (typeof claims.scp === "string" ? scopeString(claims.scp) : listClaim(claims.scp)),
+		issuedAt: numericClaim(claims.iat),
+		expiresAt: numericClaim(claims.exp)
+	};
+	return {
+		format: "opaque",
+		scopes: scopeString(tokens.scope),
+		expiresIn: numericClaim(tokens.expires_in)
+	};
+}
+function isAccessTokenSummaryExpired(summary, nowMs) {
+	return summary.expiresAt !== void 0 && summary.expiresAt * 1e3 <= nowMs;
+}
+function formatDuration(seconds) {
+	const s = Math.floor(Math.abs(seconds));
+	if (s < 60) return `${s}s`;
+	const m = Math.floor(s / 60);
+	if (m < 60) return `${m}m`;
+	const h = Math.floor(m / 60);
+	if (h < 24) return m % 60 === 0 ? `${h}h` : `${h}h ${m % 60}m`;
+	const d = Math.floor(h / 24);
+	return h % 24 === 0 ? `${d}d` : `${d}d ${h % 24}h`;
+}
+function formatEpoch(epochSeconds) {
+	const date = /* @__PURE__ */ new Date(epochSeconds * 1e3);
+	return Number.isNaN(date.getTime()) ? String(epochSeconds) : date.toISOString();
+}
+function relativeTo(epochSeconds, nowMs) {
+	const delta = epochSeconds - nowMs / 1e3;
+	return delta >= 0 ? `in ${formatDuration(delta)}` : `${formatDuration(delta)} ago`;
+}
+function accessTokenDetailLines(summary, nowMs) {
+	const lines = [];
+	if (summary.format === "jwt") {
+		lines.push({
+			label: "Format",
+			value: "JWT (signature not verified)"
+		});
+		if (summary.issuer) lines.push({
+			label: "Issuer",
+			value: summary.issuer
+		});
+		if (summary.audience) lines.push({
+			label: "Audience",
+			value: summary.audience.join(", ")
+		});
+		if (summary.subject) lines.push({
+			label: "Subject",
+			value: summary.subject
+		});
+		if (summary.clientId) lines.push({
+			label: "Client",
+			value: summary.clientId
+		});
+		if (summary.scopes) lines.push({
+			label: "Scopes",
+			value: summary.scopes.join(", ")
+		});
+		if (summary.issuedAt !== void 0) lines.push({
+			label: "Issued",
+			value: `${formatEpoch(summary.issuedAt)} (${relativeTo(summary.issuedAt, nowMs)})`
+		});
+		if (summary.expiresAt !== void 0) {
+			const expired = isAccessTokenSummaryExpired(summary, nowMs);
+			const rel = relativeTo(summary.expiresAt, nowMs);
+			lines.push({
+				label: "Expires",
+				value: `${formatEpoch(summary.expiresAt)} (${expired ? `expired ${rel}` : rel})`
+			});
+		} else lines.push({
+			label: "Expires",
+			value: "no exp claim"
+		});
+		return lines;
+	}
+	lines.push({
+		label: "Format",
+		value: "Opaque (not a JWT)"
+	});
+	if (summary.scopes) lines.push({
+		label: "Scopes",
+		value: summary.scopes.join(", ")
+	});
+	lines.push({
+		label: "Expires in",
+		value: summary.expiresIn !== void 0 ? `${formatDuration(summary.expiresIn)} from issuance (token response expires_in)` : "not stated by the token response"
+	});
+	return lines;
+}
+// src/components/AuthTab.tsx
+const NO_REFUSALS = [];
+const readFetchRefusals = (client) => client.getFetchRefusals();
 function OAuthDetailRow({ label, value }) {
 	return /* @__PURE__ */ jsxs(Box, {
 		flexDirection: "row",
@@ -14654,6 +15575,7 @@ function AuthTab({ serverName, inspectorClient, oauthStatus, oauthMessage, oauth
 			inspectorClient.removeEventListener("oauthComplete", update);
 		};
 	}, [inspectorClient, refreshOAuthState]);
+	const fetchRefusals = useStoreSnapshot(inspectorClient, "fetchRefused", readFetchRefusals, NO_REFUSALS);
 	const accessToken = oauthState?.tokens?.access_token;
 	const { handleCopyKey, status: copyStatus } = useCopyKeys(accessToken, "access token");
 	useInput((input, key) => {
@@ -14725,6 +15647,7 @@ function AuthTab({ serverName, inspectorClient, oauthStatus, oauthMessage, oauth
 		})
 	});
 	const scopes = oauthState ? formatScopes(oauthState) : void 0;
+	const tokenDetails = oauthState?.tokens?.access_token ? accessTokenDetailLines(summarizeAccessToken(oauthState.tokens), Date.now()) : [];
 	return /* @__PURE__ */ jsxs(Box, {
 		width,
 		height,
@@ -14763,6 +15686,19 @@ function AuthTab({ serverName, inspectorClient, oauthStatus, oauthMessage, oauth
 							color: oauthMessageTone === "warning" ? "yellow" : "cyan",
 							children: oauthMessage
 						}),
+						fetchRefusals.length > 0 && /* @__PURE__ */ jsxs(Box, {
+							marginTop: 1,
+							flexDirection: "column",
+							gap: 0,
+							children: [/* @__PURE__ */ jsx(Text, {
+								bold: true,
+								color: "yellow",
+								children: "Refused requests"
+							}), fetchRefusals.map((refusal) => /* @__PURE__ */ jsx(Text, {
+								color: "yellow",
+								children: formatFetchRefusal(refusal)
+							}, `${refusal.url} ${refusal.reason}`))]
+						}),
 						pendingStepUp ? /* @__PURE__ */ jsxs(Box, {
 							marginTop: 1,
 							flexDirection: "column",
@@ -14824,53 +15760,68 @@ function AuthTab({ serverName, inspectorClient, oauthStatus, oauthMessage, oauth
 							flexDirection: "column",
 							marginTop: 1,
 							gap: 0,
-							children: [/* @__PURE__ */ jsx(Text, {
-								bold: true,
-								children: "OAuth Details"
-							}), /* @__PURE__ */ jsxs(Box, {
-								marginTop: 1,
-								flexDirection: "column",
-								paddingLeft: 0,
-								gap: 0,
-								children: [
-									/* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "Protocol",
-										value: formatAuthProtocol(oauthState.protocol)
-									}),
-									/* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "Status",
-										value: oauthState.authorized ? "Authorized" : "Not authorized"
-									}),
-									oauthState.client?.clientId && /* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "Client ID",
-										value: oauthState.client.clientId
-									}),
-									oauthState.client?.registrationKind && /* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "Client registration",
-										value: formatClientRegistrationKind(oauthState.client.registrationKind)
-									}),
-									oauthState.protocol === "ema" && oauthState.ema?.idpSession && /* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "IdP session",
-										value: formatIdpSession(oauthState.ema.idpSession)
-									}),
-									oauthState.authorizationServerMetadata?.authorization_endpoint && /* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "Auth URL",
-										value: oauthState.authorizationServerMetadata.authorization_endpoint
-									}),
-									scopes && /* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "Scopes",
-										value: scopes
-									}),
-									accessToken && /* @__PURE__ */ jsx(OAuthDetailRow, {
-										label: "Access token",
-										value: `${accessToken.slice(0, 24)}…`
-									}),
-									accessToken && copyStatus && /* @__PURE__ */ jsx(Text, {
-										color: copyStatusColor(copyStatus.tone),
-										children: copyStatus.message
-									})
-								]
-							})]
+							children: [
+								/* @__PURE__ */ jsx(Text, {
+									bold: true,
+									children: "OAuth Details"
+								}),
+								/* @__PURE__ */ jsxs(Box, {
+									marginTop: 1,
+									flexDirection: "column",
+									paddingLeft: 0,
+									gap: 0,
+									children: [
+										/* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "Protocol",
+											value: formatAuthProtocol(oauthState.protocol)
+										}),
+										/* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "Status",
+											value: oauthState.authorized ? "Authorized" : "Not authorized"
+										}),
+										oauthState.client?.clientId && /* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "Client ID",
+											value: oauthState.client.clientId
+										}),
+										oauthState.client?.registrationKind && /* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "Client registration",
+											value: formatClientRegistrationKind(oauthState.client.registrationKind)
+										}),
+										oauthState.protocol === "ema" && oauthState.ema?.idpSession && /* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "IdP session",
+											value: formatIdpSession(oauthState.ema.idpSession)
+										}),
+										oauthState.authorizationServerMetadata?.authorization_endpoint && /* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "Auth URL",
+											value: oauthState.authorizationServerMetadata.authorization_endpoint
+										}),
+										scopes && /* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "Scopes",
+											value: scopes
+										}),
+										accessToken && /* @__PURE__ */ jsx(OAuthDetailRow, {
+											label: "Access token",
+											value: `${accessToken.slice(0, 24)}…`
+										}),
+										accessToken && copyStatus && /* @__PURE__ */ jsx(Text, {
+											color: copyStatusColor(copyStatus.tone),
+											children: copyStatus.message
+										})
+									]
+								}),
+								tokenDetails.length > 0 && /* @__PURE__ */ jsxs(Box, {
+									marginTop: 1,
+									flexDirection: "column",
+									gap: 0,
+									children: [/* @__PURE__ */ jsx(Text, {
+										bold: true,
+										children: "Access Token Details"
+									}), tokenDetails.map((line) => /* @__PURE__ */ jsx(OAuthDetailRow, {
+										label: line.label,
+										value: line.value
+									}, line.label))]
+								})
+							]
 						}) : oauthStatus !== "authenticating" && /* @__PURE__ */ jsxs(Box, {
 							marginTop: 1,
 							flexDirection: "column",
@@ -14932,8 +15883,7 @@ function AuthTab({ serverName, inspectorClient, oauthStatus, oauthMessage, oauth
 		]
 	});
 }
-//#endregion
-//#region src/hooks/useSelectableList.ts
+// src/hooks/useSelectableList.ts
 function clampFirstVisible(first, selected, visibleCount) {
 	if (selected < first) return selected;
 	if (selected >= first + visibleCount) return selected - visibleCount + 1;
@@ -14965,12 +15915,11 @@ function useSelectableList(itemCount, visibleCount, options) {
 	]);
 	return {
 		selectedIndex,
-		firstVisible,
+		firstVisible: clampFirstVisible(firstVisible, selectedIndex, visibleCount),
 		setSelection
 	};
 }
-//#endregion
-//#region src/hooks/useListFilter.ts
+// src/hooks/useListFilter.ts
 function printable(input) {
 	return input.replace(/[\u0000-\u001f\u007f]/g, "");
 }
@@ -15097,8 +16046,7 @@ function ListFilterBar({ query, editing, focused }) {
 function filterCount(active, shown, total) {
 	return active ? `${shown}/${total}` : String(total);
 }
-//#endregion
-//#region src/components/ResourcesTab.tsx
+// src/components/ResourcesTab.tsx
 function resourceFilterFields(item) {
 	return item.type === "resource" ? [
 		item.data.name,
@@ -15277,7 +16225,10 @@ function ResourcesTab({ resources, resourceTemplates = [], inspectorClient, widt
 						return /* @__PURE__ */ jsx(Box, {
 							paddingY: 0,
 							flexShrink: 0,
-							children: /* @__PURE__ */ jsxs(Text, { children: [isSelected ? "▶ " : "  ", label] })
+							children: /* @__PURE__ */ jsxs(Text, {
+								wrap: "truncate-end",
+								children: [isSelected ? "▶ " : "  ", label]
+							})
 						}, key);
 					})
 				})
@@ -15435,8 +16386,7 @@ function ResourcesTab({ resources, resourceTemplates = [], inspectorClient, widt
 		})]
 	});
 }
-//#endregion
-//#region src/components/PromptsTab.tsx
+// src/components/PromptsTab.tsx
 function promptFilterFields(prompt) {
 	return [prompt.name, prompt.title];
 }
@@ -15561,7 +16511,10 @@ function PromptsTab({ prompts, inspectorClient, width, height, focusedPane = nul
 						return /* @__PURE__ */ jsx(Box, {
 							paddingY: 0,
 							flexShrink: 0,
-							children: /* @__PURE__ */ jsxs(Text, { children: [isSelected ? "▶ " : "  ", prompt.name || `Prompt ${ordinal + 1}`] })
+							children: /* @__PURE__ */ jsxs(Text, {
+								wrap: "truncate-end",
+								children: [isSelected ? "▶ " : "  ", prompt.name || `Prompt ${ordinal + 1}`]
+							})
 						}, `${ordinal}:${prompt.name}`);
 					})
 				})
@@ -15649,8 +16602,7 @@ function PromptsTab({ prompts, inspectorClient, width, height, focusedPane = nul
 		})]
 	});
 }
-//#endregion
-//#region ../../core/extension/skills/verification.ts
+// ../../core/extension/skills/verification.ts
 const DEFAULT_SKILL_BUDGET_HINT = {
 	raise: "with the server's skillCatalogMaxSkills / skillCatalogMaxBytes settings",
 	verifyOne: "by verifying this skill alone"
@@ -15823,8 +16775,7 @@ async function verifySkills(client, entries, metadata, budgetHint = DEFAULT_SKIL
 	}
 	return reports;
 }
-//#endregion
-//#region src/components/SkillsTab.tsx
+// src/components/SkillsTab.tsx
 function skillFilterFields(skill) {
 	return [skillDisplayName(skill), skill.frontmatter.name];
 }
@@ -16279,8 +17230,7 @@ function SkillsTab({ skills, pageCount, loadError = null, inspectorClient, width
 		})]
 	});
 }
-//#endregion
-//#region ../../core/json/schemaLint.ts
+// ../../core/json/schemaLint.ts
 const BOOLEAN_VALUED_KEYWORDS = /* @__PURE__ */ new Set([
 	"additionalProperties",
 	"unevaluatedProperties",
@@ -16474,8 +17424,7 @@ function lintToolSchemas(tool) {
 	if (tool.outputSchema !== void 0) lintSchema(tool.outputSchema, "outputSchema", findings);
 	return findings;
 }
-//#endregion
-//#region src/components/ToolsTab.tsx
+// src/components/ToolsTab.tsx
 const SEVERITY_MARKER = {
 	error: {
 		glyph: "!",
@@ -16603,17 +17552,19 @@ function ToolsTab({ tools, isConnected, width, height, focusedPane = null, onTes
 						const isSelected = index === selectedIndex;
 						const marker = schemaMarker(findingsByTool.get(tool));
 						const ordinal = filter.indices[index];
-						return /* @__PURE__ */ jsx(Box, {
+						return /* @__PURE__ */ jsxs(Box, {
 							paddingY: 0,
 							flexShrink: 0,
-							children: /* @__PURE__ */ jsxs(Text, { children: [
-								isSelected ? "▶ " : "  ",
-								tool.name || `Tool ${ordinal + 1}`,
-								marker && /* @__PURE__ */ jsxs(Text, {
+							children: [/* @__PURE__ */ jsxs(Text, {
+								wrap: "truncate-end",
+								children: [isSelected ? "▶ " : "  ", tool.name || `Tool ${ordinal + 1}`]
+							}), marker && /* @__PURE__ */ jsx(Box, {
+								flexShrink: 0,
+								children: /* @__PURE__ */ jsxs(Text, {
 									color: marker.color,
 									children: [" ", marker.glyph]
 								})
-							] })
+							})]
 						}, `${ordinal}:${tool.name}`);
 					})
 				})
@@ -16628,18 +17579,23 @@ function ToolsTab({ tools, isConnected, width, height, focusedPane = null, onTes
 				/* @__PURE__ */ jsxs(Box, {
 					flexShrink: 0,
 					flexDirection: "row",
+					flexWrap: "wrap",
 					justifyContent: "space-between",
+					columnGap: 1,
 					paddingTop: 1,
 					children: [/* @__PURE__ */ jsx(Text, {
 						bold: true,
 						backgroundColor: focusedPane === "details" ? "yellow" : void 0,
 						...focusedPane === "details" ? {} : { color: "cyan" },
 						children: selectedTool.name
-					}), isConnected && /* @__PURE__ */ jsx(Text, { children: /* @__PURE__ */ jsx(Text, {
-						color: "cyan",
-						bold: true,
-						children: "[Enter to Test]"
-					}) })]
+					}), isConnected && /* @__PURE__ */ jsx(Box, {
+						flexShrink: 0,
+						children: /* @__PURE__ */ jsx(Text, {
+							color: "cyan",
+							bold: true,
+							children: "[Enter to Test]"
+						})
+					})]
 				}),
 				/* @__PURE__ */ jsxs(ScrollView, {
 					ref: scrollViewRef,
@@ -16732,8 +17688,7 @@ function ToolsTab({ tools, isConnected, width, height, focusedPane = null, onTes
 		})]
 	});
 }
-//#endregion
-//#region src/components/NotificationsTab.tsx
+// src/components/NotificationsTab.tsx
 function NotificationsTab({ stderrLogs, width, height, onCountChange, focused = false }) {
 	const scrollViewRef = useRef(null);
 	const onCountChangeRef = useRef(onCountChange);
@@ -16821,8 +17776,7 @@ function layoutBody(body, maxLines = 500, maxLineChars = MAX_BODY_LINE_CHARS) {
 		totalLines: all.length
 	};
 }
-//#endregion
-//#region src/components/BodyLines.tsx
+// src/components/BodyLines.tsx
 function BodyLines({ body, keyPrefix }) {
 	const { lines, hiddenLines, totalLines } = layoutBody(body);
 	return /* @__PURE__ */ jsxs(Fragment, { children: [lines.map((line, idx) => /* @__PURE__ */ jsx(Box, {
@@ -16849,8 +17803,7 @@ function BodyLines({ body, keyPrefix }) {
 		})
 	})] });
 }
-//#endregion
-//#region src/components/HistoryTab.tsx
+// src/components/HistoryTab.tsx
 function HistoryTab({ messages, width, height, onCountChange, focusedPane = null, onViewDetails, modalOpen = false }) {
 	const visibleCount = Math.max(1, height - 7);
 	const { selectedIndex, firstVisible, setSelection } = useSelectableList(messages.length, visibleCount);
@@ -17058,8 +18011,7 @@ function HistoryTab({ messages, width, height, onCountChange, focusedPane = null
 		})]
 	});
 }
-//#endregion
-//#region src/components/RequestsTab.tsx
+// src/components/RequestsTab.tsx
 function RequestsTab({ requests, width, height, onCountChange, focusedPane = null, onViewDetails, modalOpen = false }) {
 	const visibleCount = Math.max(1, height - 7);
 	const { selectedIndex, firstVisible, setSelection } = useSelectableList(requests.length, visibleCount);
@@ -17355,8 +18307,7 @@ function RequestsTab({ requests, width, height, onCountChange, focusedPane = nul
 		})]
 	});
 }
-//#endregion
-//#region node_modules/ink-form/lib/FormHeader.js
+// node_modules/ink-form/lib/FormHeader.js
 const FormHeader = (props) => {
 	const sections = props.form.sections;
 	useInput((input, key) => {
@@ -17375,8 +18326,7 @@ const FormHeader = (props) => {
 		underline: props.currentTab === id
 	}, section.title), React$1.createElement(Text, null, " "))) : React$1.createElement(Box, null, React$1.createElement(Text, null, "Editing ", props.editingField)))));
 };
-//#endregion
-//#region node_modules/chalk/source/vendor/ansi-styles/index.js
+// node_modules/chalk/source/vendor/ansi-styles/index.js
 const ANSI_BACKGROUND_OFFSET = 10;
 const wrapAnsi16 = (offset = 0) => (code) => `\u001B[${code + offset}m`;
 const wrapAnsi256 = (offset = 0) => (code) => `\u001B[${38 + offset};5;${code}m`;
@@ -17539,8 +18489,7 @@ function assembleStyles() {
 	return styles$1;
 }
 const ansiStyles = assembleStyles();
-//#endregion
-//#region node_modules/chalk/source/vendor/supports-color/index.js
+// node_modules/chalk/source/vendor/supports-color/index.js
 function hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process$1.argv) {
 	const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
 	const position = argv.indexOf(prefix + flag);
@@ -17627,8 +18576,7 @@ const supportsColor = {
 	stdout: createSupportsColor({ isTTY: tty.isatty(1) }),
 	stderr: createSupportsColor({ isTTY: tty.isatty(2) })
 };
-//#endregion
-//#region node_modules/chalk/source/utilities.js
+// node_modules/chalk/source/utilities.js
 function stringReplaceAll(string, substring, replacer) {
 	let index = string.indexOf(substring);
 	if (index === -1) return string;
@@ -17655,8 +18603,7 @@ function stringEncaseCRLFWithFirstIndex(string, prefix, postfix, index) {
 	returnValue += string.slice(endIndex);
 	return returnValue;
 }
-//#endregion
-//#region node_modules/chalk/source/index.js
+// node_modules/chalk/source/index.js
 const { stdout: stdoutColor, stderr: stderrColor } = supportsColor;
 const GENERATOR = Symbol("GENERATOR");
 const STYLER = Symbol("STYLER");
@@ -17777,8 +18724,7 @@ const applyStyle = (self, string) => {
 Object.defineProperties(createChalk.prototype, styles);
 const chalk = createChalk();
 createChalk({ level: stderrColor ? stderrColor.level : 0 });
-//#endregion
-//#region node_modules/ink-text-input/build/index.js
+// node_modules/ink-text-input/build/index.js
 function TextInput({ value: originalValue, placeholder = "", focus = true, mask, highlightPastedText = false, showCursor = true, onChange, onSubmit }) {
 	const [state, setState] = useState({
 		cursorOffset: (originalValue || "").length,
@@ -17847,8 +18793,7 @@ function TextInput({ value: originalValue, placeholder = "", focus = true, mask,
 	}, { isActive: focus });
 	return React.createElement(Text, null, placeholder ? value.length > 0 ? renderedValue : renderedPlaceholder : renderedValue);
 }
-//#endregion
-//#region node_modules/ink-form/lib/NumberFieldRenderer.js
+// node_modules/ink-form/lib/NumberFieldRenderer.js
 const FLOAT_REGEX = /^-?((\d+)|(\d*\.\d+))$/;
 const INTEGER_REGEX = /^-?\d+$/;
 const NumberFieldRenderer = (props) => {
@@ -17897,8 +18842,7 @@ const NumberFieldRenderer = (props) => {
 		onSubmit: () => props.onSetEditingField(void 0)
 	})), React.createElement(Box, null, React.createElement(Text, { dimColor: true }, "Press UP/DOWN to increase or decrease the value.")));
 };
-//#endregion
-//#region node_modules/ink-form/lib/managers/FloatFormFieldManager.js
+// node_modules/ink-form/lib/managers/FloatFormFieldManager.js
 var FloatFormFieldManager = class {
 	type = "float";
 	renderField = (props) => React.createElement(NumberFieldRenderer, {
@@ -17907,8 +18851,7 @@ var FloatFormFieldManager = class {
 	});
 	renderValue = (props) => React.createElement(React.Fragment, null, props.value);
 };
-//#endregion
-//#region node_modules/ink-form/lib/managers/IntegerFormFieldManager.js
+// node_modules/ink-form/lib/managers/IntegerFormFieldManager.js
 var IntegerFormFieldManager = class {
 	type = "integer";
 	renderField = (props) => React.createElement(NumberFieldRenderer, {
@@ -17917,16 +18860,14 @@ var IntegerFormFieldManager = class {
 	});
 	renderValue = (props) => React.createElement(React.Fragment, null, props.value);
 };
-//#endregion
-//#region node_modules/is-unicode-supported/index.js
+// node_modules/is-unicode-supported/index.js
 function isUnicodeSupported() {
 	const { env } = process$1;
 	const { TERM, TERM_PROGRAM } = env;
 	if (process$1.platform !== "win32") return TERM !== "linux";
 	return Boolean(env.WT_SESSION) || Boolean(env.TERMINUS_SUBLIME) || env.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-//#endregion
-//#region node_modules/figures/index.js
+// node_modules/figures/index.js
 const common = {
 	circleQuestionMark: "(?)",
 	questionMarkPrefix: "(?)",
@@ -18205,18 +19146,15 @@ const fallbackSymbols = {
 };
 const figures = isUnicodeSupported() ? mainSymbols : fallbackSymbols;
 Object.entries(specialMainSymbols);
-//#endregion
-//#region node_modules/ink-select-input/build/Indicator.js
+// node_modules/ink-select-input/build/Indicator.js
 function Indicator({ isSelected = false }) {
 	return React.createElement(Box, { marginRight: 1 }, isSelected ? React.createElement(Text, { color: "blue" }, figures.pointer) : React.createElement(Text, null, " "));
 }
-//#endregion
-//#region node_modules/ink-select-input/build/Item.js
+// node_modules/ink-select-input/build/Item.js
 function Item({ isSelected = false, label }) {
 	return React$1.createElement(Text, { color: isSelected ? "blue" : void 0 }, label);
 }
-//#endregion
-//#region node_modules/to-rotated/index.js
+// node_modules/to-rotated/index.js
 function toRotated(array, steps) {
 	if (!Array.isArray(array)) throw new TypeError(`Expected an array, got \`${typeof array}\`.`);
 	if (!Number.isSafeInteger(steps)) throw new TypeError(`The \`steps\` parameter must be an integer, got ${steps}.`);
@@ -18226,8 +19164,7 @@ function toRotated(array, steps) {
 	if (normalizedSteps === 0) return [...array];
 	return [...array.slice(-normalizedSteps), ...array.slice(0, -normalizedSteps)];
 }
-//#endregion
-//#region node_modules/ink-select-input/build/SelectInput.js
+// node_modules/ink-select-input/build/SelectInput.js
 function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicatorComponent = Indicator, itemComponent = Item, limit: customLimit, onSelect, onHighlight }) {
 	const hasLimit = typeof customLimit === "number" && items.length > customLimit;
 	const limit = hasLimit ? Math.min(customLimit, items.length) : items.length;
@@ -18294,8 +19231,7 @@ function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicator
 		}));
 	}));
 }
-//#endregion
-//#region node_modules/ink-form/lib/managers/SelectFormFieldManager.js
+// node_modules/ink-form/lib/managers/SelectFormFieldManager.js
 var SelectFormFieldManager = class {
 	type = "select";
 	renderField = (props) => React.createElement(Box, {
@@ -18311,8 +19247,7 @@ var SelectFormFieldManager = class {
 	}));
 	renderValue = (props) => React.createElement(React.Fragment, null, props.field.options.find((option) => option.value === props.value)?.label ?? props.value ?? "No value");
 };
-//#endregion
-//#region node_modules/ink-form/lib/managers/StringFormFieldManager.js
+// node_modules/ink-form/lib/managers/StringFormFieldManager.js
 var StringFormFieldManager = class {
 	type = "string";
 	renderField = (props) => React.createElement(Box, {
@@ -18331,8 +19266,7 @@ var StringFormFieldManager = class {
 	}));
 	renderValue = (props) => React.createElement(Transform, { transform: props.value !== void 0 && props.field.mask ? (text) => text.split("").map((char) => "*").join("") : (text) => text }, props.value);
 };
-//#endregion
-//#region node_modules/ink-form/lib/managers/BooleanFormFieldManager.js
+// node_modules/ink-form/lib/managers/BooleanFormFieldManager.js
 var BooleanFormFieldManager = class {
 	type = "boolean";
 	renderField = (props) => {
@@ -18348,8 +19282,7 @@ var BooleanFormFieldManager = class {
 	};
 	renderValue = (props) => React.createElement(Text, null, props.value === void 0 ? "[Not set]" : props.value ? "[True]" : "[False]");
 };
-//#endregion
-//#region node_modules/ink-form/lib/managers/managers.js
+// node_modules/ink-form/lib/managers/managers.js
 const managers = [
 	new FloatFormFieldManager(),
 	new IntegerFormFieldManager(),
@@ -18360,8 +19293,7 @@ const managers = [
 const getManager = (formFieldType, customManagers = []) => {
 	return [...managers, ...customManagers].find((manager) => manager.type === formFieldType);
 };
-//#endregion
-//#region node_modules/ink-form/lib/DescriptionRenderer.js
+// node_modules/ink-form/lib/DescriptionRenderer.js
 const DescriptionRenderer = (props) => {
 	if (!props.description) return null;
 	else if (props.description.type) return props.description;
@@ -18372,8 +19304,7 @@ const DescriptionRenderer = (props) => {
 	}, React.createElement(Text, null, line))));
 	else return React.createElement(Text, null, props.description);
 };
-//#endregion
-//#region node_modules/ink-form/lib/FormFieldRenderer.js
+// node_modules/ink-form/lib/FormFieldRenderer.js
 const FormFieldRenderer = (props) => {
 	const manager = getManager(props.field.type, props.customManagers);
 	const [error, setError] = useState();
@@ -18439,13 +19370,11 @@ const FormFieldRenderer = (props) => {
 		}, React.createElement(Box, null, React.createElement(Text, null, props.field.label ?? props.field.name), props.field.required && React.createElement(Text, { color: "red" }, "*"), React.createElement(Text, null, ": ")), React.createElement(Box, null, component), props.field.description && React.createElement(Box, null, React.createElement(Text, { dimColor: true }, React.createElement(DescriptionRenderer, { description: props.field.description }))), error && React.createElement(Box, null, React.createElement(Text, { color: "red" }, "Error: ", error)), React.createElement(Box, { marginTop: 2 }, React.createElement(Text, { dimColor: true }, error ? React.createElement(React.Fragment, null, "Press ESC to cancel.") : React.createElement(React.Fragment, null, "Press ", manager?.needCtrlToReturnSave ? "CTRL+Enter" : "Enter", " to complete field, or ESC to cancel."))));
 	}
 };
-//#endregion
-//#region node_modules/ink-form/lib/canSubmit.js
+// node_modules/ink-form/lib/canSubmit.js
 const canSubmit = (form, value) => {
 	return form.sections.map((section) => section.fields).reduce((fields1, fields2) => [...fields1, ...fields2], []).map((field) => !field.required || value[field.name] !== void 0 && value[field.name] !== "").reduce((field1, field2) => field1 && field2, true);
 };
-//#endregion
-//#region node_modules/ink-form/lib/SubmitButton.js
+// node_modules/ink-form/lib/SubmitButton.js
 const SubmitButton = (props) => {
 	const { isFocused } = useFocus({ isActive: props.canSubmit });
 	useInput((input, key) => {
@@ -18464,8 +19393,7 @@ const SubmitButton = (props) => {
 		underline: isFocused
 	}, props.canSubmit ? "Submit form" : "Cannot submit form yet")));
 };
-//#endregion
-//#region node_modules/ink-form/lib/Form.js
+// node_modules/ink-form/lib/Form.js
 const Form = (props) => {
 	const isControlled = props.value !== void 0;
 	const [currentTab, setCurrentTab] = useState(0);
@@ -18525,8 +19453,29 @@ const Form = (props) => {
 		onSubmit: () => props.onSubmit?.(value)
 	})));
 };
-//#endregion
-//#region src/utils/schemaToForm.ts
+// src/utils/multiSelectField.ts
+const MULTISELECT_FIELD_TYPE = "multiselect";
+function toggleChoice(selected, value, options) {
+	const next = new Set(selected);
+	if (next.has(value)) next.delete(value);
+	else next.add(value);
+	return options.map((option) => option.value).filter((each) => next.has(each));
+}
+function boundsHint(minItems, maxItems) {
+	if (minItems !== void 0 && maxItems !== void 0) return minItems === maxItems ? `Choose exactly ${minItems}` : `Choose ${minItems} to ${maxItems}`;
+	if (minItems !== void 0) return `Choose at least ${minItems}`;
+	if (maxItems !== void 0) return `Choose at most ${maxItems}`;
+}
+function selectionLabel(options, value) {
+	if (value === void 0) return "No value";
+	if (value.length === 0) return "None selected";
+	return value.map((each) => options.find((option) => option.value === each)?.label ?? each).join(", ");
+}
+function windowStart(cursor, count, limit) {
+	if (count <= limit) return 0;
+	return Math.min(Math.max(0, cursor - Math.floor(limit / 2)), count - limit);
+}
+// src/utils/schemaToForm.ts
 function toSelectOptions(values, names) {
 	const useNames = names !== void 0 && names.length === values.length;
 	return values.map((val, index) => ({
@@ -18534,6 +19483,19 @@ function toSelectOptions(values, names) {
 		value: String(val)
 	}));
 }
+function choiceOptions(members, names) {
+	return toSelectOptions(members, names).map((option, index) => ({
+		label: option.label,
+		value: String(index)
+	}));
+}
+function choiceIds(members, chosen) {
+	return chosen.map((value) => members.findIndex((member) => sameJsonValue(member, value))).filter((index) => index >= 0).map(String);
+}
+function memberForChoiceId(members, id) {
+	const index = typeof id === "string" && /^\d+$/.test(id) ? Number(id) : -1;
+	return index >= 0 && index < members.length ? members[index] : id;
+}
 function generatedNames(base, branches) {
 	const declared = [...Object.keys(base.properties ?? {}), ...branches.flatMap((branch) => branch.declaredFields)];
 	let variant = "__variant";
@@ -18570,6 +19532,12 @@ function constOf(schema) {
 	if (typeof schema !== "object" || schema === null) return void 0;
 	return schema.const;
 }
+function isChoiceArray(property) {
+	return property.type === "array" && Array.isArray(property.items?.enum);
+}
+function declarationOf(prop) {
+	return normalizeNullableUnion(typeof prop === "object" && prop !== null ? prop : {});
+}
 function schemaToForm(schema, toolName) {
 	const title = `Test Tool: ${toolName}`;
 	if (!schema) return {
@@ -18625,7 +19593,7 @@ function schemaToForm(schema, toolName) {
 }
 function decodeFormValues(schema, values) {
 	const { base, branches } = resolveRootUnion(schema ?? {});
-	if (branches.length === 0) return applyConstants(base.properties ?? {}, values, requiredOf(base));
+	if (branches.length === 0) return restoreChoices(base.properties ?? {}, applyConstants(base.properties ?? {}, values, requiredOf(base)), requiredOf(base));
 	const { variant, prefix } = generatedNames(base, branches);
 	const branchIndex = selectedBranchIndex(base, branches, values);
 	const branch = branches[branchIndex];
@@ -18635,7 +19603,9 @@ function decodeFormValues(schema, values) {
 	});
 	const decoded = Object.fromEntries([...Object.entries(values).filter(([name]) => !generated.has(name)), ...branchFields(base, branches, branchIndex).map((name) => [name, values[branchFieldName(prefix, branchIndex, name)]]).filter(([, value]) => value !== void 0)]);
 	/* v8 ignore next -- an offerable branch always carries properties */
-	return applyConstants(branch.schema.properties ?? {}, decoded, requiredOf(branch.schema));
+	const properties = branch.schema.properties ?? {};
+	const required = requiredOf(branch.schema);
+	return restoreChoices(properties, applyConstants(properties, decoded, required), required);
 }
 function selectedBranchIndex(base, branches, values) {
 	const { variant } = generatedNames(base, branches);
@@ -18647,12 +19617,24 @@ function applyConstants(properties, values, required) {
 	if (pinned.length === 0) return values;
 	return Object.fromEntries([...Object.entries(values), ...pinned.map(([name, schema]) => [name, constOf(schema)])]);
 }
+function restoreChoices(properties, values, required) {
+	const choiceFields = Object.entries(properties).map(([name, prop]) => [name, declarationOf(prop)]).filter(([name, property]) => isChoiceArray(property) && property.const === void 0 && Object.hasOwn(values, name) && Array.isArray(values[name]));
+	if (choiceFields.length === 0) return values;
+	const restored = new Map(choiceFields.map(([name, property]) => {
+		const chosen = values[name];
+		if (chosen.length === 0 && !required.includes(name)) return [name, void 0];
+		/* v8 ignore next -- `isChoiceArray` guarantees `items.enum` above */
+		const members = property.items?.enum ?? [];
+		return [name, chosen.map((each) => memberForChoiceId(members, each))];
+	}));
+	return Object.fromEntries(Object.entries(values).map(([name, value]) => restored.has(name) ? [name, restored.get(name)] : [name, value]).filter(([, value]) => value !== void 0));
+}
 function buildFields(schema, { optional = false } = {}) {
 	const fields = [];
 	const properties = schema.properties || {};
 	const required = Array.isArray(schema.required) ? schema.required : [];
 	for (const [key, prop] of Object.entries(properties)) {
-		const property = normalizeNullableUnion(typeof prop === "object" && prop !== null ? prop : {});
+		const property = declarationOf(prop);
 		const baseField = {
 			name: key,
 			label: property.title || key,
@@ -18673,12 +19655,18 @@ function buildFields(schema, { optional = false } = {}) {
 			});
 			continue;
 		}
-		if (property.type === "array" && property.items?.enum) field = {
-			type: "select",
-			...baseField,
-			options: toSelectOptions(property.items.enum, property.items.enumNames)
-		};
-		else if (isStringEnum(property.enum)) field = {
+		if (isChoiceArray(property)) {
+			const multi = {
+				type: MULTISELECT_FIELD_TYPE,
+				...baseField,
+				options: choiceOptions(property.items.enum, property.items.enumNames),
+				...typeof property.minItems === "number" && { minItems: property.minItems },
+				...typeof property.maxItems === "number" && { maxItems: property.maxItems },
+				...Array.isArray(property.default) && { initialValue: choiceIds(property.items.enum, property.default) }
+			};
+			fields.push(multi);
+			continue;
+		} else if (isStringEnum(property.enum)) field = {
 			type: "select",
 			...baseField,
 			/* v8 ignore next -- guarded by `isStringEnum(property.enum)` above */
@@ -18738,8 +19726,95 @@ function missingRequiredFields(schema, decoded, rawValues = {}) {
 		return value === void 0;
 	});
 }
-//#endregion
-//#region ../../core/mcp/resultFile.ts
+function selectionCountErrors(schema, decoded, rawValues = {}) {
+	const { base, branches } = resolveRootUnion(schema ?? {});
+	/* v8 ignore next -- an offerable branch always carries properties */
+	const properties = (branches.length === 0 ? base : branches[selectedBranchIndex(base, branches, rawValues)].schema).properties ?? {};
+	return Object.entries(properties).flatMap(([name, prop]) => {
+		const value = Object.hasOwn(decoded, name) ? decoded[name] : void 0;
+		if (!Array.isArray(value)) return [];
+		const { minItems, maxItems } = declarationOf(prop);
+		if (typeof minItems === "number" && value.length < minItems) return [`${name}: choose at least ${minItems}`];
+		if (typeof maxItems === "number" && value.length > maxItems) return [`${name}: choose at most ${maxItems}`];
+		return [];
+	});
+}
+function MultiSelectInput({ field, value, onChange }) {
+	const [cursor, setCursor] = useState(0);
+	const selected = value ?? [];
+	const count = field.options.length;
+	useInput((input, key) => {
+		if (key.upArrow) setCursor((current) => Math.max(0, current - 1));
+		else if (key.downArrow) setCursor((current) => Math.min(count - 1, current + 1));
+		else if (input === " ") {
+			const option = field.options[cursor];
+			if (option) onChange(toggleChoice(selected, option.value, field.options));
+		}
+	});
+	const start = windowStart(cursor, count, 8);
+	const hint = boundsHint(field.minItems, field.maxItems);
+	return /* @__PURE__ */ jsxs(Box, {
+		width: "100%",
+		borderStyle: "round",
+		flexDirection: "column",
+		children: [
+			field.options.slice(start, start + 8).map((option, offset) => {
+				const active = start + offset === cursor;
+				const checked = selected.includes(option.value);
+				return /* @__PURE__ */ jsxs(Text, {
+					color: active ? "blue" : void 0,
+					children: [
+						active ? "❯ " : "  ",
+						checked ? "[x] " : "[ ] ",
+						option.label ?? option.value
+					]
+				}, option.value);
+			}),
+			count > 8 && /* @__PURE__ */ jsxs(Text, {
+				dimColor: true,
+				children: [
+					start + 1,
+					"-",
+					start + 8,
+					" of ",
+					count
+				]
+			}),
+			/* @__PURE__ */ jsxs(Text, {
+				dimColor: true,
+				children: [
+					"Up/Down to move, Space to toggle (",
+					selected.length,
+					" selected)",
+					hint ? `. ${hint}` : ""
+				]
+			})
+		]
+	});
+}
+function isMultiSelectField(field) {
+	return field.type === MULTISELECT_FIELD_TYPE;
+}
+function asSelection(value) {
+	return Array.isArray(value) ? value.filter((each) => typeof each === "string") : void 0;
+}
+const FORM_FIELD_MANAGERS = [{
+	type: MULTISELECT_FIELD_TYPE,
+	renderField: (props) => isMultiSelectField(props.field) ? /* @__PURE__ */ jsx(MultiSelectInput, {
+		field: props.field,
+		value: asSelection(props.value),
+		onChange: props.onChange
+	}) : null,
+	renderValue: (props) => isMultiSelectField(props.field) ? /* @__PURE__ */ jsx(Fragment, { children: selectionLabel(props.field.options, asSelection(props.value)) }) : null
+}];
+// src/utils/formHeader.ts
+function untitledForm(form) {
+	return {
+		...form,
+		title: void 0
+	};
+}
+// ../../core/mcp/resultFile.ts
 var RawResultUnavailableError = class extends Error {
 	method;
 	binaryCount;
@@ -18785,8 +19860,7 @@ function renderResultForFile(result, method, format) {
 function renderedByteLength(data) {
 	return typeof data === "string" ? new TextEncoder().encode(data).length : data.length;
 }
-//#endregion
-//#region src/utils/saveResult.ts
+// src/utils/saveResult.ts
 function fileSafe(name) {
 	const safe = name.replace(/[^A-Za-z0-9._-]/g, "_");
 	return safe === "" ? "tool" : safe;
@@ -18830,8 +19904,7 @@ async function writeResult(result, path, format, cwd) {
 function errorMessage(err) {
 	return err instanceof Error ? err.message : String(err);
 }
-//#endregion
-//#region src/components/SaveResultBar.tsx
+// src/components/SaveResultBar.tsx
 function SaveResultBar({ prompt, status }) {
 	if (prompt) return /* @__PURE__ */ jsxs(Box, {
 		flexShrink: 0,
@@ -18866,9 +19939,8 @@ function SaveResultBar({ prompt, status }) {
 	});
 	return null;
 }
-//#endregion
-//#region src/components/ToolTestModal.tsx
-function ToolTestModal({ tool, inspectorClient, width, height, onClose, onAuthRecoveryRequired }) {
+// src/components/ToolTestModal.tsx
+function ToolTestModal({ tool, inspectorClient, width, height, onClose, inputActive = true, onAuthRecoveryRequired }) {
 	const [state, setState] = useState("form");
 	const [result, setResult] = useState(null);
 	const [savePrompt, setSavePromptState] = useState(null);
@@ -18942,7 +20014,7 @@ function ToolTestModal({ tool, inspectorClient, width, height, onClose, onAuthRe
 			}
 		}
 	};
-	useInput((input, key) => handleInputRef.current(input, key), { isActive: true });
+	useInput((input, key) => handleInputRef.current(input, key), { isActive: inputActive });
 	const openSavePrompt = () => {
 		if (!result?.callResult) {
 			setSaveStatus({
@@ -19014,6 +20086,7 @@ function ToolTestModal({ tool, inspectorClient, width, height, onClose, onAuthRe
 		}
 	};
 	const handleFormSubmit = async (rawValues) => {
+		if (!inputActive) return;
 		if (!inspectorClient || !tool) return;
 		const values = decodeFormValues(inputSchema, rawValues);
 		const missing = missingRequiredFields(inputSchema, values, rawValues);
@@ -19027,6 +20100,17 @@ function ToolTestModal({ tool, inspectorClient, width, height, onClose, onAuthRe
 			setState("results");
 			return;
 		}
+		const outOfBounds = selectionCountErrors(inputSchema, values, rawValues);
+		if (outOfBounds.length > 0) {
+			setResult({
+				input: values,
+				output: null,
+				error: `Invalid argument${outOfBounds.length > 1 ? "s" : ""}: ${outOfBounds.join("; ")}`,
+				duration: 0
+			});
+			setState("results");
+			return;
+		}
 		setState("loading");
 		const startTime = Date.now();
 		try {
@@ -19116,7 +20200,8 @@ function ToolTestModal({ tool, inspectorClient, width, height, onClose, onAuthRe
 						flexGrow: 1,
 						width: "100%",
 						children: /* @__PURE__ */ jsx(Form, {
-							form: formStructure,
+							form: untitledForm(formStructure),
+							customManagers: FORM_FIELD_MANAGERS,
 							onSubmit: (value) => void handleFormSubmit(value)
 						})
 					}),
@@ -19224,8 +20309,7 @@ function ToolTestModal({ tool, inspectorClient, width, height, onClose, onAuthRe
 		})
 	});
 }
-//#endregion
-//#region src/utils/uriTemplateToForm.ts
+// src/utils/uriTemplateToForm.ts
 function uriTemplateToForm(uriTemplate, templateName) {
 	let fields = [];
 	try {
@@ -19249,15 +20333,14 @@ function uriTemplateToForm(uriTemplate, templateName) {
 		sections
 	};
 }
-//#endregion
-//#region src/components/ResourceTestModal.tsx
+// src/components/ResourceTestModal.tsx
 function getErrorMessage$1(error) {
 	if (error instanceof Error) return error.message;
 	if (typeof error === "string") return error;
 	if (error && typeof error === "object" && "message" in error) return String(error.message);
 	return "Unknown error";
 }
-function ResourceTestModal({ template, inspectorClient, width, height, onClose, onAuthRecoveryRequired }) {
+function ResourceTestModal({ template, inspectorClient, width, height, onClose, inputActive = true, onAuthRecoveryRequired }) {
 	const [state, setState] = useState("form");
 	const [result, setResult] = useState(null);
 	const scrollViewRef = React.useRef(null);
@@ -19304,8 +20387,9 @@ function ResourceTestModal({ template, inspectorClient, width, height, onClose,
 				scrollViewRef.current?.scrollBy(-viewportHeight);
 			}
 		}
-	}, { isActive: true });
+	}, { isActive: inputActive });
 	const handleFormSubmit = async (values) => {
+		if (!inputActive) return;
 		if (!inspectorClient || !template) return;
 		const unmetGroups = unmetRequiredGroups(requiredGroups(template.uriTemplate), values);
 		if (unmetGroups.length > 0) {
@@ -19408,7 +20492,7 @@ function ResourceTestModal({ template, inspectorClient, width, height, onClose,
 								children: template.description
 							})
 						}), /* @__PURE__ */ jsx(Form, {
-							form: formStructure,
+							form: untitledForm(formStructure),
 							onSubmit: (values) => handleFormSubmit(values)
 						})]
 					}),
@@ -19533,8 +20617,7 @@ function ResourceTestModal({ template, inspectorClient, width, height, onClose,
 		})
 	});
 }
-//#endregion
-//#region src/utils/promptArgsToForm.ts
+// src/utils/promptArgsToForm.ts
 function promptArgsToForm(promptArguments, promptName) {
 	const fields = [];
 	if (!promptArguments || promptArguments.length === 0) return {
@@ -19563,15 +20646,14 @@ function promptArgsToForm(promptArguments, promptName) {
 		sections
 	};
 }
-//#endregion
-//#region src/components/PromptTestModal.tsx
+// src/components/PromptTestModal.tsx
 function getErrorMessage(error) {
 	if (error instanceof Error) return error.message;
 	if (typeof error === "string") return error;
 	if (error && typeof error === "object" && "message" in error) return String(error.message);
 	return "Unknown error";
 }
-function PromptTestModal({ prompt, inspectorClient, width, height, onClose, onAuthRecoveryRequired }) {
+function PromptTestModal({ prompt, inspectorClient, width, height, onClose, inputActive = true, onAuthRecoveryRequired }) {
 	const [state, setState] = useState("form");
 	const [result, setResult] = useState(null);
 	const scrollViewRef = React.useRef(null);
@@ -19618,8 +20700,9 @@ function PromptTestModal({ prompt, inspectorClient, width, height, onClose, onAu
 				scrollViewRef.current?.scrollBy(-viewportHeight);
 			}
 		}
-	}, { isActive: true });
+	}, { isActive: inputActive });
 	const handleFormSubmit = async (values) => {
+		if (!inputActive) return;
 		if (!inspectorClient || !prompt) return;
 		setState("loading");
 		const startTime = Date.now();
@@ -19705,7 +20788,7 @@ function PromptTestModal({ prompt, inspectorClient, width, height, onClose, onAu
 								children: prompt.description
 							})
 						}), /* @__PURE__ */ jsx(Form, {
-							form: formStructure,
+							form: untitledForm(formStructure),
 							onSubmit: (values) => handleFormSubmit(values)
 						})]
 					}),
@@ -19818,9 +20901,8 @@ function PromptTestModal({ prompt, inspectorClient, width, height, onClose, onAu
 		})
 	});
 }
-//#endregion
-//#region src/components/DetailsModal.tsx
-function DetailsModal({ title, content, width, height, onClose, copyText }) {
+// src/components/DetailsModal.tsx
+function DetailsModal({ title, content, width, height, onClose, inputActive = true, copyText }) {
 	const scrollViewRef = useRef(null);
 	const { handleCopyKey, status: copyStatus } = useCopyKeys(copyText, "details");
 	const [terminalDimensions, setTerminalDimensions] = React.useState({
@@ -19852,7 +20934,7 @@ function DetailsModal({ title, content, width, height, onClose, copyText }) {
 			const viewportHeight = scrollViewRef.current?.getViewportHeight() || 1;
 			scrollViewRef.current?.scrollBy(-viewportHeight);
 		}
-	}, { isActive: true });
+	}, { isActive: inputActive });
 	const modalWidth = terminalDimensions.width - 2;
 	const modalHeight = terminalDimensions.height - 2;
 	return /* @__PURE__ */ jsx(Box, {
@@ -19909,8 +20991,7 @@ function DetailsModal({ title, content, width, height, onClose, copyText }) {
 		})
 	});
 }
-//#endregion
-//#region src/utils/keybindings.ts
+// src/utils/keybindings.ts
 function tabAcceleratorBinding(visible) {
 	return {
 		keys: visible.map((tab) => tab.accelerator).join(" "),
@@ -20157,10 +21238,9 @@ function keyColumnWidth(sections) {
 	for (const section of sections) for (const binding of section.bindings) width = Math.max(width, binding.keys.length);
 	return width;
 }
-//#endregion
-//#region src/components/HelpOverlay.tsx
+// src/components/HelpOverlay.tsx
 const COLUMN_GAP = 2;
-function HelpOverlay({ sections, width, height, onClose }) {
+function HelpOverlay({ sections, width, height, onClose, inputActive = true }) {
 	const scrollViewRef = useRef(null);
 	const keysWidth = keyColumnWidth(sections) + COLUMN_GAP;
 	useInput((input, key) => {
@@ -20170,7 +21250,7 @@ function HelpOverlay({ sections, width, height, onClose }) {
 		else if (key.upArrow) view?.scrollBy(-1);
 		else if (key.pageDown) view?.scrollBy(view.getViewportHeight());
 		else if (key.pageUp) view?.scrollBy(-view.getViewportHeight());
-	});
+	}, { isActive: inputActive });
 	return /* @__PURE__ */ jsx(Box, {
 		position: "absolute",
 		width,
@@ -20229,8 +21309,7 @@ function HelpOverlay({ sections, width, height, onClose }) {
 		})
 	});
 }
-//#endregion
-//#region src/components/TasksTab.tsx
+// src/components/TasksTab.tsx
 const STATUS_STYLE = {
 	working: {
 		glyph: "◐",
@@ -20582,8 +21661,7 @@ function subscribableResources(resources, subscriptions) {
 	}
 	return rows;
 }
-//#endregion
-//#region src/components/SubscriptionsTab.tsx
+// src/components/SubscriptionsTab.tsx
 const STREAM_STATUS_TEXT = {
 	connecting: {
 		text: "connecting…",
@@ -20863,8 +21941,7 @@ function SubscriptionsTab({ resources, subscriptions, streamState, messages, ins
 		})]
 	});
 }
-//#endregion
-//#region src/components/RootsModal.tsx
+// src/components/RootsModal.tsx
 const ADD_ROOT_FORM = {
 	title: "Add Root",
 	sections: [{
@@ -20890,7 +21967,7 @@ function rootFromForm(values) {
 		name
 	} : { uri };
 }
-function RootsModal({ roots, inspectorClient, connected, width, height, onClose }) {
+function RootsModal({ roots, inspectorClient, connected, width, height, onClose, inputActive = true }) {
 	const [mode, setMode] = useState("list");
 	const [error, setError] = useState(null);
 	const [saving, setSaving] = useState(false);
@@ -20915,6 +21992,7 @@ function RootsModal({ roots, inspectorClient, connected, width, height, onClose
 		}
 	};
 	const handleSubmit = (values) => {
+		if (!inputActive) return;
 		const root = rootFromForm(values);
 		if ("error" in root) {
 			setError(root.error);
@@ -20946,7 +22024,7 @@ function RootsModal({ roots, inspectorClient, connected, width, height, onClose
 			}
 			save(roots.filter((_, i) => i !== selectedIndex));
 		}
-	});
+	}, { isActive: inputActive });
 	return /* @__PURE__ */ jsx(Box, {
 		position: "absolute",
 		width,
@@ -21057,8 +22135,468 @@ function RootsModal({ roots, inspectorClient, connected, width, height, onClose
 		})
 	});
 }
-//#endregion
-//#region src/App.tsx
+// src/utils/pendingRequests.ts
+const SAMPLING_STOP_REASONS = [
+	"endTurn",
+	"stopSequence",
+	"maxTokens"
+];
+const DEFAULT_SAMPLING_MODEL = "stub-model";
+const SAMPLING_RESPONSE_FORM = { sections: [{
+	title: "Response",
+	fields: [
+		{
+			type: "string",
+			name: "text",
+			label: "Response text"
+		},
+		{
+			type: "string",
+			name: "model",
+			label: "Model",
+			required: true,
+			initialValue: DEFAULT_SAMPLING_MODEL
+		},
+		{
+			type: "select",
+			name: "stopReason",
+			label: "Stop reason",
+			required: true,
+			initialValue: "endTurn",
+			options: SAMPLING_STOP_REASONS.map((reason) => ({
+				label: reason,
+				value: reason
+			}))
+		}
+	]
+}] };
+function samplingResultFromForm(values) {
+	const text = typeof values.text === "string" ? values.text : "";
+	return {
+		role: "assistant",
+		model: typeof values.model === "string" && values.model.trim() !== "" ? values.model.trim() : DEFAULT_SAMPLING_MODEL,
+		stopReason: typeof values.stopReason === "string" ? values.stopReason : "endTurn",
+		content: {
+			type: "text",
+			text
+		}
+	};
+}
+function describeBlock(block) {
+	if (typeof block !== "object" || block === null) return String(block);
+	const typed = block;
+	if (typed.type === "text" && typeof typed.text === "string") return typed.text;
+	if (typeof typed.mimeType === "string") return `[${String(typed.type)}: ${typed.mimeType}]`;
+	if (typeof typed.name === "string") return `[${String(typed.type)}: ${typed.name}]`;
+	return `[${String(typed.type ?? "unknown")}]`;
+}
+function describeSamplingRequest(params) {
+	const lines = [];
+	if (params.systemPrompt) lines.push(`System prompt: ${params.systemPrompt}`);
+	lines.push(`Max tokens: ${params.maxTokens}`);
+	const hints = (params.modelPreferences?.hints ?? []).map((hint) => hint.name).filter((name) => typeof name === "string");
+	if (hints.length > 0) lines.push(`Model hints: ${hints.join(", ")}`);
+	lines.push("");
+	for (const message of params.messages) {
+		const [first = "", ...rest] = (Array.isArray(message.content) ? message.content : [message.content]).map(describeBlock).join(" ").split("\n");
+		lines.push(`${message.role}: ${first}`);
+		for (const line of rest) lines.push(`  ${line}`);
+	}
+	return lines;
+}
+function constOptions(members) {
+	if (!Array.isArray(members) || members.length === 0) return void 0;
+	const values = [];
+	const names = [];
+	for (const member of members) {
+		if (typeof member !== "object" || member === null) return void 0;
+		const { const: value, title } = member;
+		if (typeof value !== "string") return void 0;
+		values.push(value);
+		names.push(typeof title === "string" ? title : value);
+	}
+	return {
+		values,
+		names
+	};
+}
+function normalizeElicitationSchema(schema) {
+	const properties = Object.fromEntries(Object.entries(schema.properties).map(([name, property]) => {
+		const { oneOf, items, ...rest } = property;
+		const single = constOptions(oneOf);
+		if (single) return [name, {
+			...rest,
+			enum: single.values,
+			enumNames: single.names
+		}];
+		const multi = constOptions(items?.anyOf);
+		if (multi) return [name, {
+			...rest,
+			items: {
+				enum: multi.values,
+				enumNames: multi.names
+			}
+		}];
+		return [name, property];
+	}));
+	return {
+		...schema,
+		properties
+	};
+}
+function elicitationForm(schema) {
+	const [first, ...rest] = schemaToForm(normalizeElicitationSchema(schema), "elicitation").sections;
+	return { sections: [{
+		...first,
+		title: "Response"
+	}, ...rest] };
+}
+function elicitationContentFromForm(schema, rawValues) {
+	const normalized = normalizeElicitationSchema(schema);
+	const decoded = decodeFormValues(normalized, rawValues);
+	const missing = missingRequiredFields(normalized, decoded, rawValues);
+	if (missing.length > 0) return { missing };
+	const invalid = selectionCountErrors(normalized, decoded, rawValues);
+	if (invalid.length > 0) return { invalid };
+	return { result: {
+		action: "accept",
+		content: Object.fromEntries(Object.entries(decoded).filter(([, value]) => value !== void 0 && value !== null).map(([name, value]) => {
+			return [name, normalized.properties[name]?.type === "array" && typeof value === "string" ? [value] : value];
+		}))
+	} };
+}
+function messageBoxHeight(message, columns, terminalRows) {
+	const perRow = Math.max(1, columns);
+	const wrapped = message.split("\n").reduce((rows, line) => rows + Math.max(1, Math.ceil(line.length / perRow)), 0);
+	return Math.max(1, Math.min(wrapped, Math.floor(terminalRows / 3)));
+}
+function elicitationUrlRefusal(url) {
+	try {
+		const { protocol } = new URL(url);
+		if (protocol === "http:" || protocol === "https:") return void 0;
+	} catch {}
+	return "Refusing to open this URL: only http: and https: URLs can be opened from an elicitation request.";
+}
+// src/components/PendingRequestModal.tsx
+function useSettle(onError) {
+	const busyRef = useRef(false);
+	return (action) => {
+		if (busyRef.current) return;
+		busyRef.current = true;
+		action().catch((err) => {
+			busyRef.current = false;
+			onError(errorMessage$1(err));
+		});
+	};
+}
+function useDismissPrompt() {
+	const [confirming, setConfirming] = useState(false);
+	const openRef = useRef(false);
+	const closingRef = useRef(false);
+	return {
+		confirming,
+		isOpen: () => openRef.current,
+		open: () => {
+			openRef.current = true;
+			setConfirming(true);
+		},
+		close: () => {
+			openRef.current = false;
+			closingRef.current = true;
+			setConfirming(false);
+			setTimeout(() => {
+				closingRef.current = false;
+			}, 0);
+		},
+		submitBlocked: () => openRef.current || closingRef.current
+	};
+}
+function originNote(origin, taskId) {
+	if (origin === "task-input-required") return `Requested by task ${taskId ?? "(unknown)"} (input_required)`;
+	if (origin === "input-required") return "Requested mid-call (input_required round)";
+	return null;
+}
+function ModalFrame({ title, hint, queueLabel, note, status, width, height, children }) {
+	return /* @__PURE__ */ jsx(Box, {
+		position: "absolute",
+		width,
+		height,
+		flexDirection: "column",
+		justifyContent: "center",
+		alignItems: "center",
+		children: /* @__PURE__ */ jsxs(Box, {
+			width: width - 2,
+			height: height - 2,
+			borderStyle: "single",
+			borderColor: "yellow",
+			flexDirection: "column",
+			paddingX: 1,
+			paddingY: 1,
+			backgroundColor: "black",
+			children: [
+				/* @__PURE__ */ jsxs(Box, {
+					flexShrink: 0,
+					children: [/* @__PURE__ */ jsx(Text, {
+						bold: true,
+						color: "yellow",
+						children: title
+					}), queueLabel && /* @__PURE__ */ jsxs(Text, {
+						dimColor: true,
+						children: [
+							" (",
+							queueLabel,
+							")"
+						]
+					})]
+				}),
+				/* @__PURE__ */ jsx(Box, {
+					flexShrink: 0,
+					children: /* @__PURE__ */ jsx(Text, {
+						dimColor: true,
+						children: hint
+					})
+				}),
+				note && /* @__PURE__ */ jsx(Box, {
+					flexShrink: 0,
+					children: /* @__PURE__ */ jsx(Text, {
+						dimColor: true,
+						children: note
+					})
+				}),
+				status && /* @__PURE__ */ jsx(Box, {
+					flexShrink: 0,
+					children: /* @__PURE__ */ jsx(Text, {
+						color: "red",
+						children: status
+					})
+				}),
+				/* @__PURE__ */ jsx(Box, {
+					flexGrow: 1,
+					flexDirection: "column",
+					overflow: "hidden",
+					marginTop: 1,
+					children
+				})
+			]
+		})
+	});
+}
+function DismissPrompt({ choices }) {
+	return /* @__PURE__ */ jsx(Box, {
+		flexShrink: 0,
+		children: /* @__PURE__ */ jsx(Text, {
+			color: "yellow",
+			children: choices
+		})
+	});
+}
+function SamplingRequest({ sample, queueLabel, width, height }) {
+	const [status, setStatus] = useState(null);
+	const settle = useSettle(setStatus);
+	const prompt = useDismissPrompt();
+	const scrollViewRef = useRef(null);
+	useInput((input, key) => {
+		if (prompt.isOpen()) {
+			prompt.close();
+			if (input === "r") settle(() => sample.reject(/* @__PURE__ */ new Error("Sampling request rejected by user.")));
+			return;
+		}
+		if (key.escape) prompt.open();
+		else if (key.pageDown) scrollViewRef.current?.scrollBy(1);
+		else if (key.pageUp) scrollViewRef.current?.scrollBy(-1);
+	});
+	const summaryHeight = Math.max(3, Math.floor((height - 8) * .4));
+	return /* @__PURE__ */ jsxs(ModalFrame, {
+		title: "Sampling request",
+		hint: "(Enter on Submit to approve, ESC to reject, PgUp/PgDn to scroll)",
+		queueLabel,
+		note: originNote(sample.origin, sample.taskId),
+		status,
+		width,
+		height,
+		children: [
+			/* @__PURE__ */ jsx(Box, {
+				height: summaryHeight,
+				flexShrink: 0,
+				flexDirection: "column",
+				overflow: "hidden",
+				children: /* @__PURE__ */ jsx(ScrollView, {
+					ref: scrollViewRef,
+					children: describeSamplingRequest(sample.request.params).map((line, idx) => /* @__PURE__ */ jsx(Text, { children: line || " " }, idx))
+				})
+			}),
+			prompt.confirming && /* @__PURE__ */ jsx(DismissPrompt, { choices: "Reject this sampling request? r: reject   any other key: back" }),
+			/* @__PURE__ */ jsx(Box, {
+				flexGrow: 1,
+				width: "100%",
+				children: /* @__PURE__ */ jsx(Form, {
+					form: SAMPLING_RESPONSE_FORM,
+					onSubmit: (values) => {
+						if (prompt.submitBlocked()) return;
+						settle(() => sample.respond(samplingResultFromForm(values)));
+					}
+				})
+			})
+		]
+	});
+}
+function settleElicitation(elicitation, result, inspectorClient) {
+	if (result.action === "cancel" && elicitation.origin === "task-input-required" && elicitation.taskId && inspectorClient) return inspectorClient.cancelRequestorTask(elicitation.taskId);
+	return elicitation.respond(result);
+}
+function ElicitationFormRequest({ elicitation, params, inspectorClient, queueLabel, width, height }) {
+	const [status, setStatus] = useState(null);
+	const settleWith = useSettle(setStatus);
+	const prompt = useDismissPrompt();
+	const messageRef = useRef(null);
+	const [form] = useState(() => elicitationForm(params.requestedSchema));
+	const settle = (result) => settleWith(() => settleElicitation(elicitation, result, inspectorClient));
+	useInput((input, key) => {
+		if (prompt.isOpen()) {
+			prompt.close();
+			if (input === "d") settle({ action: "decline" });
+			else if (input === "c") settle({ action: "cancel" });
+			return;
+		}
+		if (key.escape) prompt.open();
+		else if (key.pageDown) messageRef.current?.scrollBy(1);
+		else if (key.pageUp) messageRef.current?.scrollBy(-1);
+	});
+	const handleSubmit = (values) => {
+		if (prompt.submitBlocked()) return;
+		const outcome = elicitationContentFromForm(params.requestedSchema, values);
+		if ("missing" in outcome) {
+			setStatus(`Missing required field${outcome.missing.length > 1 ? "s" : ""}: ${outcome.missing.join(", ")}`);
+			return;
+		}
+		if ("invalid" in outcome) {
+			setStatus(`Invalid field${outcome.invalid.length > 1 ? "s" : ""}: ${outcome.invalid.join("; ")}`);
+			return;
+		}
+		settle(outcome.result);
+	};
+	return /* @__PURE__ */ jsxs(ModalFrame, {
+		title: "Elicitation request",
+		hint: "(Enter on Submit to accept, ESC to decline or cancel, PgUp/PgDn to scroll)",
+		queueLabel,
+		note: originNote(elicitation.origin, elicitation.taskId),
+		status,
+		width,
+		height,
+		children: [
+			/* @__PURE__ */ jsx(Box, {
+				height: messageBoxHeight(params.message, width - 6, height),
+				flexShrink: 0,
+				flexDirection: "column",
+				overflow: "hidden",
+				marginBottom: 1,
+				children: /* @__PURE__ */ jsx(ScrollView, {
+					ref: messageRef,
+					children: /* @__PURE__ */ jsx(Text, { children: params.message })
+				})
+			}),
+			prompt.confirming && /* @__PURE__ */ jsx(DismissPrompt, { choices: "Dismiss this request? d: decline   c: cancel   any other key: back" }),
+			/* @__PURE__ */ jsx(Box, {
+				flexGrow: 1,
+				width: "100%",
+				children: /* @__PURE__ */ jsx(Form, {
+					form,
+					customManagers: FORM_FIELD_MANAGERS,
+					onSubmit: (values) => handleSubmit(values)
+				})
+			})
+		]
+	});
+}
+function ElicitationUrlRequest({ elicitation, message, url, inspectorClient, queueLabel, width, height }) {
+	const [status, setStatus] = useState(null);
+	const settleWith = useSettle(setStatus);
+	const refusal = elicitationUrlRefusal(url);
+	const messageRef = useRef(null);
+	const settle = (result) => settleWith(() => settleElicitation(elicitation, result, inspectorClient));
+	useInput((input, key) => {
+		if (input === "o") {
+			if (refusal) {
+				setStatus(refusal);
+				return;
+			}
+			openUrl(url, setStatus);
+		} else if (key.return) settle({ action: "accept" });
+		else if (input === "d") settle({ action: "decline" });
+		else if (key.escape || input === "c") settle({ action: "cancel" });
+		else if (key.pageDown) messageRef.current?.scrollBy(1);
+		else if (key.pageUp) messageRef.current?.scrollBy(-1);
+	});
+	return /* @__PURE__ */ jsxs(ModalFrame, {
+		title: "Elicitation request (URL)",
+		hint: "(o: open in browser, Enter: done, d: decline, ESC: cancel, PgUp/PgDn: scroll)",
+		queueLabel,
+		note: originNote(elicitation.origin, elicitation.taskId),
+		status,
+		width,
+		height,
+		children: [
+			/* @__PURE__ */ jsx(Box, {
+				flexShrink: 0,
+				marginBottom: 1,
+				children: /* @__PURE__ */ jsx(Text, {
+					color: "cyan",
+					children: url
+				})
+			}),
+			/* @__PURE__ */ jsx(Box, {
+				height: messageBoxHeight(message, width - 6, height),
+				flexShrink: 0,
+				flexDirection: "column",
+				overflow: "hidden",
+				children: /* @__PURE__ */ jsx(ScrollView, {
+					ref: messageRef,
+					children: /* @__PURE__ */ jsx(Text, { children: message })
+				})
+			}),
+			/* @__PURE__ */ jsx(Box, {
+				flexShrink: 0,
+				marginTop: 1,
+				children: /* @__PURE__ */ jsx(Text, {
+					dimColor: true,
+					children: "Complete the flow in your browser, then press Enter. The Inspector cannot observe the external flow finishing."
+				})
+			})
+		]
+	});
+}
+function PendingRequestModal({ pendingSamples, pendingElicitations, inspectorClient, width, height }) {
+	const total = pendingSamples.length + pendingElicitations.length;
+	const queueLabel = total > 1 ? `${total} pending` : "";
+	const sample = pendingSamples[0];
+	if (sample) return /* @__PURE__ */ jsx(SamplingRequest, {
+		sample,
+		queueLabel,
+		width,
+		height
+	}, sample.id);
+	const elicitation = pendingElicitations[0];
+	if (!elicitation) return null;
+	const params = elicitation.request.params;
+	if (params.mode === "url") return /* @__PURE__ */ jsx(ElicitationUrlRequest, {
+		elicitation,
+		message: params.message,
+		url: params.url,
+		inspectorClient,
+		queueLabel,
+		width,
+		height
+	}, elicitation.id);
+	return /* @__PURE__ */ jsx(ElicitationFormRequest, {
+		elicitation,
+		params,
+		inspectorClient,
+		queueLabel,
+		width,
+		height
+	}, elicitation.id);
+}
+// src/App.tsx
 const APP_NAME = "MCP Inspector TUI";
 const APP_DESCRIPTION = "Terminal User Interface for the Model Context Protocol Inspector";
 const APP_VERSION = readInspectorVersion(import.meta.url);
@@ -21075,7 +22613,6 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 	const [activeTab, setActiveTab] = useState("info");
 	const [paneFocus, setFocus] = useState("serverList");
 	const [helpOpen, setHelpOpen] = useState(false);
-	const focus = helpOpen ? "help" : paneFocus;
 	const [listFilterEditing, setListFilterEditing] = useState(false);
 	const [listFilterClaimsEscape, setListFilterClaimsEscape] = useState(false);
 	const [tabCounts, setTabCounts] = useState({});
@@ -21178,6 +22715,11 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 				...defaultMetadata && Object.keys(defaultMetadata).length > 0 && { defaultMetadata },
 				...savedSettings && { serverSettings: savedSettings },
 				roots: cleanRoots(savedSettings?.roots ?? []),
+				sample: true,
+				elicit: {
+					form: true,
+					url: true
+				},
 				...savedSettings?.protocolEra && { versionNegotiation: eraToVersionNegotiation(savedSettings.protocolEra) },
 				...clientAuthOptions
 			};
@@ -21333,6 +22875,9 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 		if (activeTab === "auth" && selectedServerConfig && !isOAuthCapableServerConfig(selectedServerConfig)) setActiveTab("info");
 	}, [activeTab, selectedServerConfig]);
 	const selectedInspectorClient = useMemo(() => selectedServer ? inspectorClients[selectedServer] : null, [selectedServer, inspectorClients]);
+	const { pendingSamples, pendingElicitations } = usePendingClientRequests(selectedInspectorClient);
+	const pendingRequestOpen = pendingSamples.length + pendingElicitations.length > 0;
+	const focus = helpOpen || pendingRequestOpen ? "overlay" : paneFocus;
 	const { status: inspectorStatus, capabilities: inspectorCapabilities, serverInfo: inspectorServerInfo, instructions: inspectorInstructions, connect: connectInspector, disconnect: disconnectInspector, lastError: inspectorLastError } = useInspectorClient(selectedInspectorClient);
 	const selectedMessageLogState = useMemo(() => selectedServer && messageLogStates[selectedServer] ? messageLogStates[selectedServer] : null, [selectedServer, messageLogStates]);
 	const selectedFetchRequestLogState = useMemo(() => selectedServer && fetchRequestLogStates[selectedServer] ? fetchRequestLogStates[selectedServer] : null, [selectedServer, fetchRequestLogStates]);
@@ -21341,6 +22886,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 	const { fetchRequests: inspectorFetchRequests } = useFetchRequestLog(selectedFetchRequestLogState);
 	const { stderrLogs: inspectorStderrLogs } = useStderrLog(selectedStderrLogState);
 	const { tools: managedTools } = useManagedTools(selectedInspectorClient, useMemo(() => selectedServer && managedToolsStates[selectedServer] ? managedToolsStates[selectedServer] : null, [selectedServer, managedToolsStates]));
+	const sortedTools = useMemo(() => [...managedTools].sort(compareToolsByName), [managedTools]);
 	const selectedManagedResourcesState = useMemo(() => selectedServer && managedResourcesStates[selectedServer] ? managedResourcesStates[selectedServer] : null, [selectedServer, managedResourcesStates]);
 	const selectedManagedResourceTemplatesState = useMemo(() => selectedServer && managedResourceTemplatesStates[selectedServer] ? managedResourceTemplatesStates[selectedServer] : null, [selectedServer, managedResourceTemplatesStates]);
 	const selectedManagedPromptsState = useMemo(() => selectedServer && managedPromptsStates[selectedServer] ? managedPromptsStates[selectedServer] : null, [selectedServer, managedPromptsStates]);
@@ -21640,7 +23186,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 			resources: managedResources,
 			resourceTemplates: managedResourceTemplates,
 			prompts: managedPrompts,
-			tools: managedTools,
+			tools: sortedTools,
 			stderrLogs: inspectorStderrLogs
 		};
 	}, [
@@ -21654,7 +23200,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 		managedResources,
 		managedResourceTemplates,
 		managedPrompts,
-		managedTools,
+		sortedTools,
 		inspectorStderrLogs
 	]);
 	const renderResourceDetails = (resource) => /* @__PURE__ */ jsxs(Fragment, { children: [
@@ -22041,7 +23587,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 		inspectorClients
 	]);
 	useInput((input, key) => {
-		if (toolTestModal || resourceTestModal || promptTestModal || detailsModal || helpOpen || rootsModalOpen) return;
+		if (toolTestModal || resourceTestModal || promptTestModal || detailsModal || helpOpen || rootsModalOpen || pendingRequestOpen) return;
 		if (key.ctrl && input === "c") exit();
 		if (listFilterEditing) return;
 		if (input === "?") {
@@ -22668,6 +24214,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 				width: dimensions.width,
 				height: dimensions.height,
 				onClose: () => setToolTestModal(null),
+				inputActive: !pendingRequestOpen,
 				onAuthRecoveryRequired: (error) => {
 					onAuthRecoveryRequired(error);
 					setToolTestModal(null);
@@ -22679,6 +24226,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 				width: dimensions.width,
 				height: dimensions.height,
 				onClose: () => setResourceTestModal(null),
+				inputActive: !pendingRequestOpen,
 				onAuthRecoveryRequired: (error) => {
 					onAuthRecoveryRequired(error);
 					setResourceTestModal(null);
@@ -22690,6 +24238,7 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 				width: dimensions.width,
 				height: dimensions.height,
 				onClose: () => setPromptTestModal(null),
+				inputActive: !pendingRequestOpen,
 				onAuthRecoveryRequired: (error) => {
 					onAuthRecoveryRequired(error);
 					setPromptTestModal(null);
@@ -22699,7 +24248,8 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 				sections: keybindingSections(activeTab, shownTabs),
 				width: dimensions.width,
 				height: dimensions.height,
-				onClose: () => setHelpOpen(false)
+				onClose: () => setHelpOpen(false),
+				inputActive: !pendingRequestOpen
 			}),
 			rootsModalOpen && /* @__PURE__ */ jsx(RootsModal, {
 				roots: advertisedRoots,
@@ -22707,7 +24257,8 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 				connected: inspectorStatus === "connected",
 				width: dimensions.width,
 				height: dimensions.height,
-				onClose: () => setRootsModalOpen(false)
+				onClose: () => setRootsModalOpen(false),
+				inputActive: !pendingRequestOpen
 			}),
 			detailsModal && !helpOpen && /* @__PURE__ */ jsx(DetailsModal, {
 				title: detailsModal.title,
@@ -22715,13 +24266,20 @@ function App({ mcpServers, clientConfig, clientId, clientSecret, clientMetadataU
 				width: dimensions.width,
 				height: dimensions.height,
 				onClose: () => setDetailsModal(null),
-				copyText: detailsModal.copyText
+				copyText: detailsModal.copyText,
+				inputActive: !pendingRequestOpen
+			}),
+			/* @__PURE__ */ jsx(PendingRequestModal, {
+				pendingSamples,
+				pendingElicitations,
+				inspectorClient: selectedInspectorClient,
+				width: dimensions.width,
+				height: dimensions.height
 			})
 		]
 	});
 }
-//#endregion
-//#region tui.tsx
+// tui.tsx
 async function runTui(args) {
 	const program = new Command();
 	program.name("mcp-inspector-tui").description("Terminal UI for MCP Inspector").version(readInspectorVersion(import.meta.url), "-V, --version", "Print the Inspector version").option("--catalog <path>", "Writable catalog file (created if missing; default: ~/.mcp-inspector/mcp.json, or MCP_CATALOG_PATH)").option("--config <path>", "Read-only session config file (served as-is, never written or seeded; errors if absent)").option("-e <key=value...>", "Environment variables for stdio servers", parseKeyValuePair, {}).option("--cwd <path>", "Working directory for stdio servers").option("--header <header...>", "HTTP headers as \"Name: Value\"", parseHeaderPair, {}).option("--protocol-era <era>", "Protocol era to negotiate: legacy, auto, or modern (overrides the file's protocolEra; default legacy)", parseProtocolEra).option("--skill-catalog-max-skills <n>", "Skills catalog budget: the most skills one multi-skill verification run reads (positive integer; overrides the file's skillCatalogMaxSkills; default 256). Bounds the Skills pane's v (verify all); Enter verifies one skill in full", skillCatalogLimitParser("--skill-catalog-max-skills")).option("--skill-catalog-max-bytes <n>", "Skills catalog budget: the most bytes one multi-skill verification run reads (positive integer; overrides the file's skillCatalogMaxBytes; default 64 MiB). Bounds the Skills pane's v (verify all); Enter verifies one skill in full", skillCatalogLimitParser("--skill-catalog-max-bytes")).option("--client-id <id>", "OAuth client ID (static client) for HTTP servers").option("--client-secret <secret>", "OAuth client secret (for confidential clients)").option("--client-metadata-url <url>", "OAuth Client ID Metadata Document URL (CIMD) for HTTP servers").option("--client-config <path>", "Install-level client config (default: ~/.mcp-inspector/storage/client.json, or MCP_CLIENT_CONFIG_PATH)").option("--callback-url <url>", `OAuth redirect/callback listener URL; must be loopback (default: ${DEFAULT_RUNNER_OAUTH_CALLBACK_URL}, or MCP_OAUTH_CALLBACK_URL)`).argument("[target...]", "Command and args or URL for a single ad-hoc server (when not using --config)").option("--transport <type>", "Transport: stdio, sse, or http (ad-hoc only)").option("--server-url <url>", "Server URL (ad-hoc only)").parse(args ?? process.argv);
@@ -22776,8 +24334,7 @@ async function runTui(args) {
 		process.exit(1);
 	}
 }
-//#endregion
-//#region index.ts
+// index.ts
 const __filename = fileURLToPath(import.meta.url);
 if (process.argv[1] !== void 0 && resolve(process.argv[1]) === resolve(__filename)) runTui(process.argv).catch((err) => {
 	console.error("Error:", err instanceof Error ? err.message : err);
@@ -22788,5 +24345,4 @@ if (process.argv[1] !== void 0 && resolve(process.argv[1]) === resolve(__filenam
 	if ((debugOn(process.env.MCP_DEBUG) || debugOn(process.env.DEBUG)) && err instanceof Error) console.error(err.stack);
 	process.exit(1);
 });
-//#endregion
 export { runTui };