@modelcontextprotocol/inspector 2.14.0 → 2.15.0

package/clients/web/build/index.js

@@ -37,20 +37,18 @@ import { createServer as createServer$2 } from "node:https";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { spawnSync } from "node:child_process";
-//#region ../../core/storage/store-id.ts
+// ../../core/storage/store-id.ts
 function validateStoreId(storeId) {
 	return /^[a-zA-Z0-9_-]+$/.test(storeId) && storeId !== "__proto__";
 }
-//#endregion
-//#region ../../core/storage/store-serialize.ts
+// ../../core/storage/store-serialize.ts
 function serializeStore(data) {
 	return JSON.stringify(data, null, 2);
 }
 function parseStore(raw) {
 	return JSON.parse(raw);
 }
-//#endregion
-//#region ../../core/storage/store-io.ts
+// ../../core/storage/store-io.ts
 function getDefaultStorageDir() {
 	const homeDir = process.env.HOME || process.env.USERPROFILE || ".";
 	return path$1.join(homeDir, ".mcp-inspector", "storage");
@@ -96,8 +94,7 @@ async function deleteStoreFile(filePath) {
 		if (error.code !== "ENOENT") throw error;
 	}
 }
-//#endregion
-//#region ../../core/mcp/types.ts
+// ../../core/mcp/types.ts
 const DEFAULT_TASK_TTL_MS = 6e4;
 const DEFAULT_MAX_FETCH_REQUESTS = 1e3;
 const MODERN_LOG_LEVELS = [
@@ -114,8 +111,7 @@ const MODERN_LOG_LEVELS = [
 function isModernLogLevel(value) {
 	return typeof value === "string" && MODERN_LOG_LEVELS.includes(value);
 }
-//#endregion
-//#region ../../core/extension/skills/schemas.ts
+// ../../core/extension/skills/schemas.ts
 const CACHE_FIELDS = {
 	ttlMs: ReadResourceDirectoryResultSchema.shape.ttlMs,
 	cacheScope: SkillCacheScopeSchema
@@ -227,13 +223,11 @@ SKILL_LIMITS.bytes;
 function isSkillCatalogLimit(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 }
-//#endregion
-//#region ../../core/auth/secret-fields.ts
+// ../../core/auth/secret-fields.ts
 const SECRET_FIELD_OAUTH_CLIENT_SECRET = "oauth-client-secret";
 const SECRET_FIELD_IDP_CLIENT_SECRET = "idp-client-secret";
 const envSecretField = (envKey) => `env:${envKey}`;
-//#endregion
-//#region ../../core/json/jsonUtils.ts
+// ../../core/json/jsonUtils.ts
 function isSerializableJson(value) {
 	if (value === null) return true;
 	switch (typeof value) {
@@ -247,8 +241,7 @@ function isSerializableJson(value) {
 function toRecord(value) {
 	return value;
 }
-//#endregion
-//#region ../../core/mcp/serverList.ts
+// ../../core/mcp/serverList.ts
 const VALID_SERVER_TYPES = /* @__PURE__ */ new Set([
 	"stdio",
 	"sse",
@@ -587,8 +580,7 @@ function defaultSeedConfig(tempDir) {
 		}
 	} };
 }
-//#endregion
-//#region ../../core/storage/own-entry.ts
+// ../../core/storage/own-entry.ts
 function setOwnEntry(map, key, value) {
 	Object.defineProperty(map, key, {
 		value,
@@ -600,8 +592,7 @@ function setOwnEntry(map, key, value) {
 function getOwnEntry(map, key) {
 	return map !== void 0 && Object.hasOwn(map, key) ? map[key] : void 0;
 }
-//#endregion
-//#region ../../core/mcp/node/config.ts
+// ../../core/mcp/node/config.ts
 function parseKeyValuePair(value, previous = {}) {
 	const parts = value.split("=");
 	const key = parts[0] ?? "";
@@ -770,8 +761,7 @@ function resolveServerConfigs(options, mode) {
 }
 const API_SERVER_ENV_VARS = { AUTH_TOKEN: "MCP_INSPECTOR_API_TOKEN" };
 const INSPECTOR_API_TOKEN_GLOBAL = "__INSPECTOR_API_TOKEN__";
-//#endregion
-//#region ../../core/auth/secret-storage-info.ts
+// ../../core/auth/secret-storage-info.ts
 function secretStorageLabel(info) {
 	switch (info.kind) {
 		case "keyring": return "OS keychain";
@@ -798,8 +788,7 @@ function secretStorageSummary(info) {
 	if (info.reason === "fallback") parts.push("— fell back from the OS keychain");
 	return parts.join(" ");
 }
-//#endregion
-//#region ../../core/node/version.ts
+// ../../core/node/version.ts
 const ROOT_PACKAGE_NAME = "@modelcontextprotocol/inspector";
 function readInspectorVersion(callerUrl) {
 	const startDir = dirname(fileURLToPath(callerUrl));
@@ -823,8 +812,7 @@ function readInspectorVersionSafe(callerUrl) {
 		return;
 	}
 }
-//#endregion
-//#region ../../core/node/openUrl.ts
+// ../../core/node/openUrl.ts
 const OPEN_URL_TIMEOUT_MS = 5e3;
 const OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
 function toOpenableHref(href) {
@@ -852,8 +840,7 @@ async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
 		clearTimeout(timer);
 	}
 }
-//#endregion
-//#region ../../core/node/hostUrl.ts
+// ../../core/node/hostUrl.ts
 function stripBrackets(host) {
 	return host.replace(/^\[(.*)\]$/, "$1");
 }
@@ -906,8 +893,7 @@ function isLoopbackHost(host) {
 	const h = canonicalUrlHost(host).replace(/\.$/, "");
 	return h === "localhost" || h === "[::1]" || /^127(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$/.test(h);
 }
-//#endregion
-//#region server/resolve-bind-host.ts
+// server/resolve-bind-host.ts
 const BIND_ALL_INTERFACES_ENV = "DANGEROUSLY_BIND_ALL_INTERFACES";
 function isEnvFlagEnabled(value) {
 	const v = value?.trim().toLowerCase();
@@ -923,8 +909,7 @@ function resolveBindHostname(env = process.env) {
 	}
 	return stripBrackets(host);
 }
-//#endregion
-//#region server/host-allow-list.ts
+// server/host-allow-list.ts
 const ALLOWED_HOSTS_ENV = "MCP_INSPECTOR_ALLOWED_HOSTS";
 const HOSTNAME_RE = /^[a-z0-9._-]+$/;
 function normalizeHostname(hostname) {
@@ -1006,8 +991,7 @@ function hostAllowListMiddleware(options) {
 		await next();
 	};
 }
-//#endregion
-//#region server/sandbox-controller.ts
+// server/sandbox-controller.ts
 const __dirname$3 = dirname(fileURLToPath(import.meta.url));
 function isSandboxPath(url) {
 	const path = (url ?? "").split("?", 1)[0];
@@ -1328,8 +1312,7 @@ function createAppOriginController(options) {
 		}
 	};
 }
-//#endregion
-//#region server/public-address.ts
+// server/public-address.ts
 const SANDBOX_FULL_ADDRESS_ENV = "MCP_SANDBOX_FULL_ADDRESS";
 const APP_ORIGIN_FULL_ADDRESS_ENV = "MCP_APP_ORIGIN_FULL_ADDRESS";
 const SANDBOX_PATH = "/sandbox";
@@ -1398,8 +1381,7 @@ function resolveAppOriginPublicOrigin(raw, allowedOrigins, sandboxUrl) {
 	warnMixedContent(APP_ORIGIN_FULL_ADDRESS_ENV, url, allowedOrigins);
 	return url.origin;
 }
-//#endregion
-//#region server/tls.ts
+// server/tls.ts
 const TLS_KEY_PATH_ENV = "INSPECTOR_TLS_KEY_PATH";
 const TLS_CERT_PATH_ENV = "INSPECTOR_TLS_CERT_PATH";
 function webScheme(tls) {
@@ -1435,8 +1417,7 @@ function resolveTlsConfig(env = process.env) {
 		cert
 	};
 }
-//#endregion
-//#region server/web-server-config.ts
+// server/web-server-config.ts
 const inspectorVersion = readInspectorVersionSafe(import.meta.url);
 function defaultEnvironmentFromProcess(extra) {
 	const keys = process.platform === "win32" ? [
@@ -1625,8 +1606,7 @@ function resolveAutoOpen() {
 	if (flag === "false") return false;
 	return !process.env.VITEST;
 }
-//#endregion
-//#region ../../core/mcp/config.ts
+// ../../core/mcp/config.ts
 function getServerType(config) {
 	if (!("type" in config) || config.type === void 0) return "stdio";
 	const type = config.type;
@@ -1635,8 +1615,7 @@ function getServerType(config) {
 	if (type === "streamable-http") return "streamable-http";
 	throw new Error(`Invalid server type: ${type}. Valid types are: stdio, sse, streamable-http`);
 }
-//#endregion
-//#region ../../core/mcp/fetchTracking.ts
+// ../../core/mcp/fetchTracking.ts
 const SENSITIVE_HEADERS = /* @__PURE__ */ new Set([
 	"authorization",
 	"cookie",
@@ -1745,14 +1724,15 @@ function isLongLivedStreamResponse(method, contentType) {
 }
 const CHALLENGE_BODY_MAX_BYTES = 65536;
 const CHALLENGE_BODY_READ_MS = 2e3;
+const TRACKED_BODY_MAX_BYTES = 1048576;
 const TRUNCATED_BODY_SUFFIX = "\n[truncated]";
 const WITHHELD_TRUNCATED_JSON_BODY = "[truncated JSON body withheld: an incomplete body cannot be redacted]";
-function recordableChallengeBody(read, contentType) {
+function recordableBody(read, contentType) {
 	if (!read.truncated) return redactBody(read.text, contentType);
 	if ((contentType ?? "").toLowerCase().includes("json") || /^\s*[{[]/.test(read.text)) return WITHHELD_TRUNCATED_JSON_BODY;
 	return redactBody(read.text, contentType) + TRUNCATED_BODY_SUFFIX;
 }
-async function readChallengeBody(response) {
+async function readCappedBody(response, maxBytes, timeoutMs) {
 	let reader;
 	try {
 		const body = response.clone().body;
@@ -1766,20 +1746,23 @@ async function readChallengeBody(response) {
 	let text = "";
 	let bytes = 0;
 	let timer;
-	const deadline = new Promise((resolve) => {
-		timer = setTimeout(() => resolve("timeout"), CHALLENGE_BODY_READ_MS);
+	const deadline = timeoutMs === void 0 ? void 0 : new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), timeoutMs);
 	});
 	try {
-		while (bytes < CHALLENGE_BODY_MAX_BYTES) {
-			const next = await Promise.race([reader.read(), deadline]);
+		for (;;) {
+			const next = await (deadline ? Promise.race([reader.read(), deadline]) : reader.read());
 			if (next === "timeout") break;
 			if (next.done) return {
 				text: text + decoder.decode(),
 				truncated: false
 			};
-			const chunk = next.value.subarray(0, CHALLENGE_BODY_MAX_BYTES - bytes);
+			if (next.value.byteLength === 0) continue;
+			if (bytes >= maxBytes) break;
+			const chunk = next.value.subarray(0, maxBytes - bytes);
 			bytes += chunk.byteLength;
 			text += decoder.decode(chunk, { stream: true });
+			if (chunk.byteLength < next.value.byteLength) break;
 		}
 		reader.cancel().catch(() => {});
 		return {
@@ -1792,6 +1775,9 @@ async function readChallengeBody(response) {
 		clearTimeout(timer);
 	}
 }
+function readChallengeBody(response) {
+	return readCappedBody(response, CHALLENGE_BODY_MAX_BYTES, CHALLENGE_BODY_READ_MS);
+}
 function longLivedStreamFraming(contentType) {
 	return contentType?.toLowerCase().includes("application/x-ndjson") ? "ndjson" : "sse";
 }
@@ -1957,7 +1943,7 @@ function createFetchTracker(baseFetch, callbacks) {
 		};
 		if ((responseStatus === 401 || responseStatus === 403) && response.body && !response.bodyUsed) {
 			const read = await readChallengeBody(response);
-			entry.responseBody = read === void 0 ? void 0 : recordableChallengeBody(read, response.headers.get("content-type"));
+			entry.responseBody = read === void 0 ? void 0 : recordableBody(read, response.headers.get("content-type"));
 			callbacks.trackRequest?.(entry);
 			return response;
 		}
@@ -1965,11 +1951,12 @@ function createFetchTracker(baseFetch, callbacks) {
 		if (isLongLivedStream && response.body && !response.bodyUsed) watchLongLivedStream(response, id, longLivedStreamFraming(response.headers.get("content-type")), callbacks);
 		if (!isLongLivedStream && response.body && !response.bodyUsed) {
 			const responseContentType = response.headers.get("content-type");
-			try {
-				response.clone().text().then((body) => {
-					callbacks.updateResponseBody?.(id, redactBody(body, responseContentType) ?? body);
-				}).catch(() => {});
-			} catch {}
+			readCappedBody(response, TRACKED_BODY_MAX_BYTES).then((read) => {
+				if (read === void 0) return;
+				try {
+					callbacks.updateResponseBody?.(id, recordableBody(read, responseContentType));
+				} catch {}
+			});
 		}
 		return response;
 	};
@@ -2035,8 +2022,7 @@ function parseAuthChallengeFromResponse(response, context) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/mcp/node/authChallengeFetch.ts
+// ../../core/mcp/node/authChallengeFetch.ts
 function createAuthChallengeInterceptFetch(baseFetch) {
 	return async (input, init) => {
 		const response = await baseFetch(input, init);
@@ -2057,8 +2043,7 @@ function createAuthChallengeObserverFetch(baseFetch, onChallenge) {
 		return response;
 	};
 }
-//#endregion
-//#region ../../core/mcp/node/proxyFetch.ts
+// ../../core/mcp/node/proxyFetch.ts
 function asUndiciInit(init) {
 	return init;
 }
@@ -2148,8 +2133,7 @@ function createProxyFetch() {
 		return (await loadedProxiedFetch)(input, init);
 	};
 }
-//#endregion
-//#region ../../core/auth/requestTimeout.ts
+// ../../core/auth/requestTimeout.ts
 const OAUTH_TIMEOUT_WIRE_CODE = "oauth_request_timeout";
 function readNegotiatesEndpoint(hint) {
 	if (!hint) return true;
@@ -2196,11 +2180,23 @@ function callerSignalOf(input, init) {
 	if (explicit !== void 0) return explicit ?? void 0;
 	if (typeof input !== "string" && !(input instanceof URL)) return input.signal;
 }
-//#endregion
-//#region ../../core/mcp/node/fetchGuard.ts
+// ../../core/auth/fetchRefusal.ts
 var FetchTargetError = class extends Error {
 	name = "FetchTargetError";
+	url;
+	constructor(message, url) {
+		super(message);
+		if (url !== void 0) this.url = url;
+	}
 };
+function findFetchTargetError(err) {
+	let current = err;
+	for (let depth = 0; depth < 8 && current instanceof Error; depth++) {
+		if (current instanceof FetchTargetError) return current;
+		current = current.cause;
+	}
+}
+const FETCH_TARGET_REFUSED_WIRE_CODE = "fetch_target_refused";
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	301,
 	302,
@@ -2209,11 +2205,12 @@ const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	308
 ]);
 const resolveWithSystemDns = async (hostname) => (await lookup(hostname, { all: true })).map((r) => r.address);
+const METADATA_IPV4_ADDRESSES = /* @__PURE__ */ new Set(["100.100.100.200", "192.0.0.192"]);
 function isBlockedAddress(ip) {
 	const kind = isIP(ip);
 	if (kind === 4) {
 		const [a, b] = ip.split(".").map(Number);
-		return a === 169 && b === 254;
+		return a === 169 && b === 254 || METADATA_IPV4_ADDRESSES.has(ip);
 	}
 	if (kind !== 6) return false;
 	const addr = ip.toLowerCase();
@@ -2376,27 +2373,35 @@ async function guardedFetch(url, init, options = {}) {
 		headers: init.headers
 	};
 	for (let hop = 0; hop <= 5; hop++) {
-		await assertAllowedTarget(request.url, resolveHost, viaProxy, init.signal);
-		const res = await fetchFn(request.url.href, {
-			method: request.method,
-			headers: new Headers(request.headers),
-			body: request.body,
-			signal: init.signal,
-			redirect: "manual"
-		});
+		let res;
+		try {
+			await assertAllowedTarget(request.url, resolveHost, viaProxy, init.signal);
+			res = await fetchFn(request.url.href, {
+				method: request.method,
+				headers: new Headers(request.headers),
+				body: request.body,
+				signal: init.signal,
+				redirect: "manual"
+			});
+		} catch (err) {
+			stampRefusedUrl(err, request.url);
+			throw err;
+		}
 		const location = res.headers.get("location");
 		if (!REDIRECT_STATUSES.has(res.status) || location === null) return res;
 		res.body?.cancel().catch(() => {});
-		request = nextRedirectRequest(request, res.status, location);
+		try {
+			request = nextRedirectRequest(request, res.status, location);
+		} catch (err) {
+			stampRefusedUrl(err, request.url);
+			throw err;
+		}
 	}
-	throw new FetchTargetError(`Refusing to follow more than 5 redirects`);
+	throw new FetchTargetError(`Refusing to follow more than 5 redirects`, request.url.href);
 }
-function findFetchTargetError(err) {
-	let current = err;
-	for (let depth = 0; depth < 8 && current instanceof Error; depth++) {
-		if (current instanceof FetchTargetError) return current;
-		current = current.cause;
-	}
+function stampRefusedUrl(err, url) {
+	const refused = findFetchTargetError(err);
+	if (refused && refused.url === void 0) refused.url = url.href;
 }
 async function bodyText(input, init) {
 	const body = init?.body !== void 0 ? init.body : input instanceof Request && input.body !== null ? await input.clone().text() : void 0;
@@ -2423,8 +2428,7 @@ function createGuardedFetch(options = {}) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/auth/routeOAuthRequests.ts
+// ../../core/auth/routeOAuthRequests.ts
 function isJsonRpcMessage(value) {
 	return typeof value === "object" && value !== null && value.jsonrpc === "2.0";
 }
@@ -2448,8 +2452,7 @@ function isMcpShapedRequest(input, init) {
 function routeOAuthRequests(mcpFetch, oauthFetch, isMcpEndpoint) {
 	return (input, init) => isMcpShapedRequest(input, init) && isMcpEndpoint(requestUrlOf(input), requestHeadersOf(input, init)) ? mcpFetch(input, init) : oauthFetch(input, init);
 }
-//#endregion
-//#region ../../core/mcp/node/notificationHeadersFetch.ts
+// ../../core/mcp/node/notificationHeadersFetch.ts
 function createNotificationHeadersFetch(baseFetch) {
 	return (input, init) => {
 		const method = modernNotificationMethod(init);
@@ -2485,8 +2488,7 @@ function modernNotificationMethod(init) {
 function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-//#endregion
-//#region ../../core/mcp/node/suppressNotificationStreamFetch.ts
+// ../../core/mcp/node/suppressNotificationStreamFetch.ts
 function createSuppressNotificationStreamFetch(baseFetch, endpoint) {
 	return async (input, init) => {
 		if (isStandaloneStreamRequest(input, init, endpoint)) return new Response(null, {
@@ -2512,8 +2514,7 @@ function isStandaloneStreamRequest(input, init, endpoint) {
 	const headers = new Headers(init?.headers ?? request?.headers);
 	return (headers.get("accept")?.toLowerCase() ?? "").includes("text/event-stream") && !headers.has("last-event-id");
 }
-//#endregion
-//#region ../../core/mcp/node/transport.ts
+// ../../core/mcp/node/transport.ts
 function headersFromSettings(settings) {
 	if (!settings || settings.headers.length === 0) return void 0;
 	const out = {};
@@ -2595,8 +2596,7 @@ function createTransportNode(config, options = {}) {
 		}) };
 	}
 }
-//#endregion
-//#region ../../core/mcp/remote/node/cappedBody.ts
+// ../../core/mcp/remote/node/cappedBody.ts
 async function readCappedText(body, maxBytes) {
 	const reader = body.getReader();
 	const decoder = new TextDecoder();
@@ -2665,6 +2665,24 @@ var RateLimitLedger = class {
 function isRateLimitError(err) {
 	return SdkHttpError.isInstance(err) && err.status === 429;
 }
+// ../../core/mcp/sessionTermination.ts
+function canTerminateSession(transport) {
+	return typeof transport === "object" && transport !== null && "terminateSession" in transport && typeof transport.terminateSession === "function";
+}
+const SESSION_TERMINATE_TIMEOUT_MS = 3e3;
+async function terminateSessionBestEffort(transport, timeoutMs = SESSION_TERMINATE_TIMEOUT_MS) {
+	if (!canTerminateSession(transport) || !transport.sessionId) return false;
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(false), timeoutMs);
+	});
+	const terminated = new Promise((resolve) => resolve(transport.terminateSession())).then(() => true, () => false);
+	try {
+		return await Promise.race([terminated, timedOut]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
 function mergeOAuthSections(disk, snapshot, sections) {
 	const merged = {
 		servers: { ...disk?.servers },
@@ -2781,8 +2799,7 @@ function parseOAuthStoreWriteBody(body) {
 	if (!snapshot || !snapshotHasValidSecretPayloads(snapshot)) return null;
 	return { snapshot };
 }
-//#endregion
-//#region ../../core/auth/node/secret-store.ts
+// ../../core/auth/node/secret-store.ts
 const SERVICE_NAME = "mcp-inspector";
 let keyringLoad;
 var KeyringModuleShapeError = class extends Error {
@@ -3002,8 +3019,7 @@ var SessionSecretStore = class extends InMemorySecretStore {
 		return false;
 	}
 };
-//#endregion
-//#region ../../core/auth/node/file-lock.ts
+// ../../core/auth/node/file-lock.ts
 const STALE_MS = 1e4;
 const RETRY = {
 	retries: 20,
@@ -3135,8 +3151,7 @@ async function withSecretFileLock(filePath, fn) {
 		await release();
 	}
 }
-//#endregion
-//#region ../../core/auth/node/file-secret-store.ts
+// ../../core/auth/node/file-secret-store.ts
 const scrypt = (passphrase, salt, keylen, options) => new Promise((resolve, reject) => {
 	crypto$1.scrypt(passphrase, salt, keylen, options, (err, key) => {
 		/* v8 ignore next -- @preserve: node validates the cost parameters
@@ -3544,8 +3559,7 @@ async function readSecretFilePermissions(filePath) {
 		};
 	}
 }
-//#endregion
-//#region ../../core/auth/node/secret-store-selection.ts
+// ../../core/auth/node/secret-store-selection.ts
 const SECRET_STORE_ENV = "MCP_INSPECTOR_SECRET_STORE";
 const SECRET_FILE_ENV = "MCP_INSPECTOR_SECRET_FILE";
 const STORAGE_DIR_ENV = "MCP_STORAGE_DIR";
@@ -3857,8 +3871,7 @@ function defaultSecretStore() {
 async function resolveConcreteSecretStore(store) {
 	return store instanceof DeferredSecretStore ? (await resolveSecretStore()).store : store;
 }
-//#endregion
-//#region ../../core/auth/node/oauth-secrets.ts
+// ../../core/auth/node/oauth-secrets.ts
 const PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
 const warnedPolicyValues = /* @__PURE__ */ new Set();
 function getPersistTokensPolicy(env = process.env) {
@@ -4128,8 +4141,7 @@ function snapshotHasPlaintextSecrets(snapshot) {
 	for (const session of Object.values(snapshot.idpSessions)) if (session.idToken !== void 0 || session.refreshToken !== void 0) return true;
 	return false;
 }
-//#endregion
-//#region ../../core/auth/node/oauth-namespace-ledger.ts
+// ../../core/auth/node/oauth-namespace-ledger.ts
 const namespaceLedgerPath = (stateFilePath) => `${stateFilePath}.namespaces.json`;
 const KEYRING_LOCATION = "keyring";
 const FILE_LOCATION_PREFIX = "file:";
@@ -4387,8 +4399,7 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current, ow
 		warnLedgerFailure("update", error);
 	}
 }
-//#endregion
-//#region ../../core/auth/node/oauth-persist-file.ts
+// ../../core/auth/node/oauth-persist-file.ts
 const warnedStoreFailures = /* @__PURE__ */ new Set();
 function warnStoreWriteFailure(error) {
 	const reason = error instanceof Error ? error.message : String(error);
@@ -4920,8 +4931,7 @@ async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
 		if (locked) await purgeSupersededNamespaces(filePath, secretStore, void 0);
 	});
 }
-//#endregion
-//#region ../../core/mcp/import/clientConfig.ts
+// ../../core/mcp/import/clientConfig.ts
 function parseJsonObject(raw) {
 	let data;
 	try {
@@ -4951,8 +4961,7 @@ function parseVsCodeConfig(raw) {
 	if (!servers || typeof servers !== "object" || Array.isArray(servers)) throw new Error("No 'servers' object found in VS Code config file");
 	return { mcpServers: normalizeServerMap(servers) };
 }
-//#endregion
-//#region ../../core/mcp/import/strategies.ts
+// ../../core/mcp/import/strategies.ts
 function join$1(...segments) {
 	return segments.map((s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")).filter((s) => s.length > 0).join("/");
 }
@@ -4993,8 +5002,7 @@ const IMPORT_STRATEGIES = Object.fromEntries([
 function getImportStrategy(id) {
 	return IMPORT_STRATEGIES[id];
 }
-//#endregion
-//#region ../../core/mcp/import/resolveSource.ts
+// ../../core/mcp/import/resolveSource.ts
 function resolveImportSource(type, platform, homeDir, readFile) {
 	const strategy = getImportStrategy(type);
 	if (!strategy) return null;
@@ -5037,8 +5045,7 @@ function resolveImportSource(type, platform, homeDir, readFile) {
 		searched
 	};
 }
-//#endregion
-//#region ../../core/mcp/remote/progressToken.ts
+// ../../core/mcp/remote/progressToken.ts
 function progressTokenOf(message) {
 	if ("method" in message && message.method === "notifications/progress" && "params" in message && typeof message.params === "object" && message.params !== null) {
 		const parsed = ProgressTokenSchema.safeParse(message.params.progressToken);
@@ -5051,13 +5058,17 @@ function waitForProgressToken(waits, token) {
 	const numeric = Number(token);
 	return Number.isSafeInteger(numeric) ? waits.get(numeric) : void 0;
 }
-//#endregion
-//#region ../../core/mcp/remote/node/remote-session.ts
+// ../../core/mcp/remote/node/remote-session.ts
 var RemoteSession = class RemoteSession {
 	static DEFAULT_DETACH_GRACE_MS = 6e4;
 	static MAX_QUEUED_EVENTS = 1e3;
 	sessionId;
+	serverName;
+	transportType;
+	createdAt;
+	lastConsumerSeenAt = null;
 	transport;
+	terminated = new AbortController();
 	eventQueue = [];
 	droppedEventCount = 0;
 	detachTimer;
@@ -5072,8 +5083,31 @@ var RemoteSession = class RemoteSession {
 	appliedProtocolVersion;
 	rateLimits = new RateLimitLedger();
 	static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
-	constructor(sessionId) {
+	constructor(sessionId, descriptor = {}) {
 		this.sessionId = sessionId;
+		this.serverName = descriptor.serverName;
+		this.transportType = descriptor.transport ?? "stdio";
+		this.createdAt = /* @__PURE__ */ new Date();
+	}
+	get terminatedSignal() {
+		return this.terminated.signal;
+	}
+	terminate() {
+		this.terminated.abort();
+	}
+	describe() {
+		const attached = this.eventConsumer !== null;
+		const lastSeen = attached ? /* @__PURE__ */ new Date() : this.lastConsumerSeenAt;
+		return {
+			sessionId: this.sessionId,
+			...this.serverName !== void 0 && { serverName: this.serverName },
+			transport: this.transportType,
+			createdAt: this.createdAt.toISOString(),
+			consumerAttached: attached,
+			lastConsumerSeenAt: lastSeen ? lastSeen.toISOString() : null,
+			queuedEvents: this.eventQueue.length,
+			transportDead: this.transportDead
+		};
 	}
 	setAuthProviderHandle(handle) {
 		this.authProviderHandle = handle;
@@ -5093,6 +5127,7 @@ var RemoteSession = class RemoteSession {
 	setEventConsumer(consumer) {
 		this.cancelDetachGrace();
 		this.eventConsumer = consumer;
+		this.lastConsumerSeenAt = /* @__PURE__ */ new Date();
 		if (this.droppedEventCount > 0) {
 			const dropped = this.droppedEventCount;
 			this.droppedEventCount = 0;
@@ -5107,12 +5142,14 @@ var RemoteSession = class RemoteSession {
 		while (this.eventQueue.length > 0) consumer(this.eventQueue.shift());
 	}
 	clearEventConsumer() {
+		if (this.eventConsumer !== null) this.lastConsumerSeenAt = /* @__PURE__ */ new Date();
 		this.eventConsumer = null;
 		return this.transportDead;
 	}
 	detachEventConsumer(consumer) {
 		if (this.eventConsumer !== consumer) return false;
 		this.eventConsumer = null;
+		this.lastConsumerSeenAt = /* @__PURE__ */ new Date();
 		return true;
 	}
 	armDetachGrace(graceMs, onExpire) {
@@ -5301,8 +5338,7 @@ var RemoteSession = class RemoteSession {
 		});
 	}
 };
-//#endregion
-//#region ../../core/mcp/remote/node/tokenAuthProvider.ts
+// ../../core/mcp/remote/node/tokenAuthProvider.ts
 const REMOTE_OAUTH_STUB_METADATA = {
 	redirect_uris: [],
 	scope: ""
@@ -5367,8 +5403,7 @@ function createRemoteAuthProvider(initialAuthState) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/client/config-parse.ts
+// ../../core/client/config-parse.ts
 function isAbsoluteHttpUrl(value) {
 	let url;
 	try {
@@ -5460,8 +5495,7 @@ function formatClientConfigLoadError(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
-//#endregion
-//#region ../../core/client/secrets.ts
+// ../../core/client/secrets.ts
 const CLIENT_KEYCHAIN_ID = "client";
 function hasClientPlaintextSecret(config) {
 	const secret = config.enterpriseManagedAuth?.idp?.clientSecret;
@@ -5502,8 +5536,7 @@ function mergeSecretsIntoClientConfig(config, secrets) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/client/node-persistence.ts
+// ../../core/client/node-persistence.ts
 async function withClientConfigLock(filePath, action, body) {
 	let entered = false;
 	try {
@@ -5595,25 +5628,44 @@ async function deleteClientConfigStore(filePath, secretStore) {
 		}
 	});
 }
-//#endregion
-//#region ../../core/mcp/remote/node/server.ts
+// ../../core/mcp/remote/node/server.ts
 const SSE_PRIMING_COMMENT = ":\n\n";
 function closeAbortedStream(stream) {
 	stream.close().catch(() => {});
 }
-async function primeAndHoldSseStream(stream, cleanup) {
+async function primeAndHoldSseStream(stream, cleanup, end) {
 	let done = false;
-	const aborted = new Promise((resolve) => {
-		stream.onAbort(() => {
-			if (done) return;
-			done = true;
-			cleanup();
+	const finish = () => {
+		if (done) return false;
+		done = true;
+		cleanup();
+		return true;
+	};
+	const released = new Promise((resolve) => {
+		let closed = false;
+		const release = () => {
+			if (closed) return;
+			closed = true;
 			closeAbortedStream(stream);
 			resolve();
+		};
+		let detachEnd = () => {};
+		stream.onAbort(() => {
+			if (finish()) detachEnd();
+			release();
 		});
+		if (!end) return;
+		const { signal, flush } = end;
+		const onEnd = () => {
+			if (!finish()) return;
+			flush().catch(() => {}).then(release);
+		};
+		detachEnd = () => signal.removeEventListener("abort", onEnd);
+		if (signal.aborted) onEnd();
+		else signal.addEventListener("abort", onEnd, { once: true });
 	});
 	await stream.write(SSE_PRIMING_COMMENT);
-	await aborted;
+	await released;
 }
 const MAX_APP_DOCUMENT_CHARS = 8388608;
 const MAX_APP_DOCUMENT_BODY_BYTES = 25165824;
@@ -5720,6 +5772,13 @@ function mcpParamHeadersOnly(headers) {
 	for (const [key, value] of Object.entries(headers)) if (typeof value === "string" && key.toLowerCase().startsWith("Mcp-Param-".toLowerCase())) out[key] = value;
 	return Object.keys(out).length > 0 ? out : void 0;
 }
+const SESSION_TERMINATED_MESSAGE = "Session terminated from the Inspector's active session list";
+const MAX_SESSION_SERVER_NAME_CHARS = 256;
+function sessionServerName(value) {
+	if (typeof value !== "string") return void 0;
+	const name = value.trim();
+	return name === "" ? void 0 : name.slice(0, MAX_SESSION_SERVER_NAME_CHARS);
+}
 function createRemoteApp(options) {
 	const dangerouslyOmitAuth = !!options.dangerouslyOmitAuth;
 	const authToken = dangerouslyOmitAuth ? "" : options.authToken || process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] || randomBytes(32).toString("hex");
@@ -5730,7 +5789,8 @@ function createRemoteApp(options) {
 		session.armDetachGrace(sessionDetachGraceMs, () => {
 			sessions.delete(session.sessionId);
 			session.rejectActiveRequestWaits(/* @__PURE__ */ new Error("Session closed: no client attached"));
-			session.transport.close().catch(() => {});
+			const transport = session.transport;
+			terminateSessionBestEffort(transport).then(() => transport.close().catch(() => {}));
 		});
 	};
 	const { logger: fileLogger, allowedOrigins } = options;
@@ -5846,7 +5906,10 @@ function createRemoteApp(options) {
 		const config = body.config;
 		if (!config) return c.json({ error: "Missing config" }, 400);
 		const sessionId = crypto.randomUUID();
-		const session = new RemoteSession(sessionId);
+		const session = new RemoteSession(sessionId, {
+			serverName: sessionServerName(body.serverName),
+			transport: config.type ?? "stdio"
+		});
 		let transport;
 		let authHandle;
 		try {
@@ -6010,12 +6073,13 @@ function createRemoteApp(options) {
 		const session = sessions.get(sessionId);
 		if (!session) return c.json({ error: "Session not found" }, 404);
 		return streamSSE(c, async (stream) => {
+			let lastWrite = Promise.resolve();
 			const consumer = (event) => {
 				const data = JSON.stringify(event);
-				stream.writeSSE({
+				lastWrite = stream.writeSSE({
 					event: event.type,
 					data
-				});
+				}).catch(() => {});
 			};
 			session.setEventConsumer(consumer);
 			if (session.isTransportDead()) {
@@ -6031,6 +6095,9 @@ function createRemoteApp(options) {
 					return;
 				}
 				armSessionReap(session);
+			}, {
+				signal: session.terminatedSignal,
+				flush: () => lastWrite
 			});
 		});
 	});
@@ -6047,11 +6114,28 @@ function createRemoteApp(options) {
 		if (session) {
 			session.cancelDetachGrace();
 			session.clearEventConsumer();
+			await terminateSessionBestEffort(session.transport);
 			await session.transport.close();
 			sessions.delete(sessionId);
 		}
 		return c.json({ ok: true });
 	});
+	app.get("/api/mcp/sessions", (c) => {
+		const list = { sessions: [...sessions.values()].map((session) => session.describe()).sort((a, b) => a.createdAt.localeCompare(b.createdAt)) };
+		return c.json(list);
+	});
+	app.delete("/api/mcp/sessions/:sessionId", async (c) => {
+		const sessionId = c.req.param("sessionId");
+		const session = sessions.get(sessionId);
+		if (!session) return c.json({ error: "Session not found" }, 404);
+		sessions.delete(sessionId);
+		session.cancelDetachGrace();
+		session.markTransportDead(SESSION_TERMINATED_MESSAGE);
+		session.terminate();
+		session.rejectActiveRequestWaits(/* @__PURE__ */ new Error(SESSION_TERMINATED_MESSAGE));
+		await session.transport.close().catch(() => {});
+		return c.json({ ok: true });
+	});
 	app.post("/api/mcp/auth-state", async (c) => {
 		let body;
 		try {
@@ -6143,7 +6227,14 @@ function createRemoteApp(options) {
 				timeoutMs: deadlineMs
 			}, 504);
 			const refused = findFetchTargetError(err);
-			if (refused) return c.json({ error: refused.message }, 403);
+			if (refused) {
+				const body = {
+					error: refused.message,
+					code: FETCH_TARGET_REFUSED_WIRE_CODE,
+					url: redactUrlQuery(refused.url ?? url)
+				};
+				return c.json(body, 403);
+			}
 			return c.json({ error: msg }, 500);
 		} finally {
 			if (timer !== void 0) clearTimeout(timer);
@@ -6989,8 +7080,7 @@ function createRemoteApp(options) {
 		}
 	};
 }
-//#endregion
-//#region server/inject-auth-token.ts
+// server/inject-auth-token.ts
 function serializeTokenForScript(token) {
 	return JSON.stringify(token).replace(/</g, "\\u003c");
 }
@@ -7003,8 +7093,7 @@ function injectAuthToken(html, token) {
 	if (bodyClose !== -1) return html.slice(0, bodyClose) + script + html.slice(bodyClose);
 	return script + html;
 }
-//#endregion
-//#region server/health.ts
+// server/health.ts
 const HEALTH_PATH = "/healthz";
 const HEALTH_BODY = Object.freeze({ status: "ok" });
 const HEALTH_HEADERS = Object.freeze({
@@ -7034,8 +7123,7 @@ function handleNodeHealthRequest(req, res) {
 	else res.end(body);
 	return true;
 }
-//#endregion
-//#region server/node-request-bridge.ts
+// server/node-request-bridge.ts
 function fetchUrlForNodeRequest(headers, pathname, scheme) {
 	return `${scheme}://${headers.host ?? headers[":authority"]}${pathname}`;
 }
@@ -7057,8 +7145,7 @@ const CONNECTION_SPECIFIC_HEADERS = /* @__PURE__ */ new Set([
 function isResponseHeaderAllowed(name, httpVersionMajor) {
 	return httpVersionMajor < 2 || !CONNECTION_SPECIFIC_HEADERS.has(name.toLowerCase());
 }
-//#endregion
-//#region server/vite-hono-plugin.ts
+// server/vite-hono-plugin.ts
 function honoMiddlewarePlugin(config) {
 	let resolvedAuthToken = "";
 	return {
@@ -7200,8 +7287,7 @@ function honoMiddlewarePlugin(config) {
 		}
 	};
 }
-//#endregion
-//#region server/vite-base-config.ts
+// server/vite-base-config.ts
 const NODE_ONLY_OPTIMIZE_DEPS_EXCLUDE = [
 	"@modelcontextprotocol/client/stdio",
 	"atomically",
@@ -7344,8 +7430,7 @@ function vitestSharedPaths(clientDir) {
 		}
 	};
 }
-//#endregion
-//#region server/start-vite-dev-server.ts
+// server/start-vite-dev-server.ts
 const __dirname$2 = dirname(fileURLToPath(import.meta.url));
 async function startViteDevServer(config) {
 	const root = resolve(join(__dirname$2, ".."));
@@ -7378,8 +7463,7 @@ async function startViteDevServer(config) {
 		await server.close();
 	} };
 }
-//#endregion
-//#region server/server.ts
+// server/server.ts
 function isApiPath(path) {
 	return path === "/api" || path.startsWith("/api/");
 }
@@ -7481,8 +7565,7 @@ async function startHonoServer(config) {
 		});
 	} };
 }
-//#endregion
-//#region server/ensure-web-build.ts
+// server/ensure-web-build.ts
 function runViteBuild(webRoot, log) {
 	const result = spawnSync("npm", ["run", "build:client"], {
 		cwd: webRoot,
@@ -7501,8 +7584,7 @@ function ensureWebBuild(webRoot, distRoot, deps = {}) {
 	log("No production web build found at clients/web/dist. Building the web UI now (first run only; this can take a minute)...");
 	if (build(webRoot, log) !== 0 || !exists(indexHtml)) throw new Error("Could not build the web UI automatically. Build it manually with `npm run build` (run from clients/web), or launch with `--dev` to use the Vite dev server.");
 }
-//#endregion
-//#region server/run-web.ts
+// server/run-web.ts
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function ensureStdioCwd(config) {
 	if ((config.type === "stdio" || config.type === void 0) && config.command && !config.cwd) return {
@@ -7631,12 +7713,10 @@ async function runWeb(argv) {
 	process.on("SIGTERM", shutdown);
 	return new Promise(() => {});
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
 const __filename = fileURLToPath(import.meta.url);
 if (process.argv[1] !== void 0 && resolve(process.argv[1]) === resolve(__filename)) runWeb(process.argv).then((code) => process.exit(code ?? 0)).catch((e) => {
 	console.error(e);
 	process.exit(1);
 });
-//#endregion
 export { runWeb };