@tonyclaw/agent-inspector 3.0.18 → 3.0.20

package/.output/server/index.mjs

@@ -1,5 +1,5 @@
 globalThis.__nitro_main__ = import.meta.url;
-import { N as NodeResponse, s as serve } from "./_libs/srvx.mjs";
+import { c as NodeResponse, s as serve } from "./_libs/srvx.mjs";
 import { d as defineHandler, H as HTTPError, t as toEventHandler, a as defineLazyEventHandler, b as H3Core } from "./_libs/h3.mjs";
 import { d as decodePath, w as withLeadingSlash, a as withoutTrailingSlash, j as joinURL } from "./_libs/ufo.mjs";
 import { promises } from "node:fs";
@@ -11,24 +11,6 @@ import "node:stream/promises";
 import "node:https";
 import "node:http2";
 import "./_libs/rou3.mjs";
-function lazyService(loader) {
-  let promise, mod;
-  return {
-    fetch(req) {
-      if (mod) {
-        return mod.fetch(req);
-      }
-      if (!promise) {
-        promise = loader().then((_mod) => mod = _mod.default || _mod);
-      }
-      return promise.then((mod2) => mod2.fetch(req));
-    }
-  };
-}
-const services = {
-  ["ssr"]: lazyService(() => import("./_ssr/index.mjs"))
-};
-globalThis.__nitro_vite_envs__ = services;
 const headers = ((m) => function headersRouteRule(event) {
   for (const [key2, value] of Object.entries(m.options || {})) {
     event.res.headers.set(key2, value);
@@ -38,121 +20,121 @@ const assets = {
   "/assets/alibaba-TTwafVwX.svg": {
     "type": "image/svg+xml",
     "etag": '"171b-6dyV5K8QjiaY35sN9qNprh9zDIs"',
-    "mtime": "2026-07-08T09:20:47.299Z",
+    "mtime": "2026-07-09T06:59:01.790Z",
     "size": 5915,
     "path": "../public/assets/alibaba-TTwafVwX.svg"
   },
   "/assets/agent-inspector-58K1_MsC.ico": {
     "type": "image/vnd.microsoft.icon",
     "etag": '"38fa-ZD8kPABHYjPIkcH82FMY6iZM7fI"',
-    "mtime": "2026-07-08T09:20:47.299Z",
+    "mtime": "2026-07-09T06:59:01.790Z",
     "size": 14586,
     "path": "../public/assets/agent-inspector-58K1_MsC.ico"
   },
-  "/assets/json-viewer-BA-W-PZq.js": {
+  "/assets/CompareDrawer-CV7rBBty.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"1ae6-dvP4VHmxfaubFfn7DjIy5LP2VDM"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 6886,
-    "path": "../public/assets/json-viewer-BA-W-PZq.js"
+    "etag": '"4bc4-NeuRTrt7yHDOmT9FQIMZJsJttrg"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 19396,
+    "path": "../public/assets/CompareDrawer-CV7rBBty.js"
   },
-  "/assets/index-gm3A0idN.js": {
+  "/assets/index-DT476lno.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"264-bUtHugGp38xTQ/556OOmW4cTb30"',
-    "mtime": "2026-07-08T09:20:47.299Z",
-    "size": 612,
-    "path": "../public/assets/index-gm3A0idN.js"
+    "etag": '"265-MUXBG+nWxX37u2jGqJqLxo+dQ58"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 613,
+    "path": "../public/assets/index-DT476lno.js"
+  },
+  "/assets/index-DOspyaW6.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": '"1cd2d-wAQHK/XT8cmFNwY2u7tsp3R5u5E"',
+    "mtime": "2026-07-09T06:59:01.791Z",
+    "size": 118061,
+    "path": "../public/assets/index-DOspyaW6.js"
+  },
+  "/assets/index-B3YOj8-_.css": {
+    "type": "text/css; charset=utf-8",
+    "etag": '"25d7e-wT0HU4Abt/tuojN/MHx6/a/L3BA"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 155006,
+    "path": "../public/assets/index-B3YOj8-_.css"
   },
   "/assets/minimax-BPMzvuL-.jpeg": {
     "type": "image/jpeg",
     "etag": '"1b06-IwivU89ko5UTMUM1/t7hn4sQK9A"',
-    "mtime": "2026-07-08T09:20:47.299Z",
+    "mtime": "2026-07-09T06:59:01.790Z",
     "size": 6918,
     "path": "../public/assets/minimax-BPMzvuL-.jpeg"
   },
-  "/assets/index-ClQ7Vi3J.js": {
+  "/assets/RequestAnatomy-BXxKNdgk.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"1cd2c-4zCEbVXrILXYj2zEV1+iKezgPds"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 118060,
-    "path": "../public/assets/index-ClQ7Vi3J.js"
+    "etag": '"43f3-xfqa2g7z/1x7C7SVZel7b8TpVPs"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 17395,
+    "path": "../public/assets/RequestAnatomy-BXxKNdgk.js"
   },
-  "/assets/main-BnRC1932.js": {
+  "/assets/index-BLwqIxup.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"51754-C+GxW6/FcQjEc3T50yvdt1wbC+Q"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 333652,
-    "path": "../public/assets/main-BnRC1932.js"
+    "etag": '"5231f-HqTXsZ4wO12ASADoW2/b28qy0iU"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 336671,
+    "path": "../public/assets/index-BLwqIxup.js"
   },
-  "/assets/CompareDrawer-Daj03-RL.js": {
+  "/assets/ReplayDialog-yDeF-z9y.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"4bc3-br2IcvOX80Rt2Ihi0wTncTxpsjQ"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 19395,
-    "path": "../public/assets/CompareDrawer-Daj03-RL.js"
+    "etag": '"3348-KuuPZ1nE8LYKQOTTGWkhFYGrHTE"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 13128,
+    "path": "../public/assets/ReplayDialog-yDeF-z9y.js"
   },
-  "/assets/ResponseView-BwkMSsUa.js": {
+  "/assets/ResponseView-BIYNgUNB.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"47fc-0qG8LO4aEdS/plOjflbM11UR8Ow"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 18428,
-    "path": "../public/assets/ResponseView-BwkMSsUa.js"
+    "etag": '"47fe-zKVqch7wCsmDgW7eCqN7M7CT6xc"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 18430,
+    "path": "../public/assets/ResponseView-BIYNgUNB.js"
   },
-  "/assets/RequestAnatomy-DF0hHdQY.js": {
+  "/assets/StreamingChunkSequence-C1faiChu.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"43f2-Mtz9JWVo1c1JlS8OqgcPSXmE3lQ"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 17394,
-    "path": "../public/assets/RequestAnatomy-DF0hHdQY.js"
+    "etag": '"e96-OFL3QQfpjl325p412ILsH/ND4Z0"',
+    "mtime": "2026-07-09T06:59:01.791Z",
+    "size": 3734,
+    "path": "../public/assets/StreamingChunkSequence-C1faiChu.js"
   },
-  "/assets/ReplayDialog-5FR5crdo.js": {
+  "/assets/_sessionId-B34PrfCQ.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"3347-a97u4d282w761H2y42rBEmcN128"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 13127,
-    "path": "../public/assets/ReplayDialog-5FR5crdo.js"
-  },
-  "/assets/StreamingChunkSequence-CKeUd58x.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": '"e95-aUcHwmSf3cNmuFqJIhMNTBPZwHQ"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 3733,
-    "path": "../public/assets/StreamingChunkSequence-CKeUd58x.js"
+    "etag": '"36d-UKHpMMKVTcaT/1x9Bgn6o8Jt+G8"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 877,
+    "path": "../public/assets/_sessionId-B34PrfCQ.js"
   },
   "/assets/zhipuai-BPNAnxo-.svg": {
     "type": "image/svg+xml",
     "etag": '"2bf8-hNaLCTi89nOFCsIIfWpP/jrfo0s"',
-    "mtime": "2026-07-08T09:20:47.299Z",
+    "mtime": "2026-07-09T06:59:01.790Z",
     "size": 11256,
     "path": "../public/assets/zhipuai-BPNAnxo-.svg"
   },
-  "/assets/index-BHXN1Fsx.css": {
-    "type": "text/css; charset=utf-8",
-    "etag": '"25b0d-UyzOlNKIaucQXEUHv/FUiQk9+WM"',
-    "mtime": "2026-07-08T09:20:47.299Z",
-    "size": 154381,
-    "path": "../public/assets/index-BHXN1Fsx.css"
-  },
-  "/assets/_sessionId-CThgXa41.js": {
+  "/assets/json-viewer-C1S08J_2.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"36c-LhEJ0XDKnu7ufvoZ93ll2DTfzsE"',
-    "mtime": "2026-07-08T09:20:47.299Z",
-    "size": 876,
-    "path": "../public/assets/_sessionId-CThgXa41.js"
+    "etag": '"1ae7-30vssKRdTL6PhsFp1e/RPJHIleA"',
+    "mtime": "2026-07-09T06:59:01.790Z",
+    "size": 6887,
+    "path": "../public/assets/json-viewer-C1S08J_2.js"
   },
   "/assets/qwen-CONDcHqt.png": {
     "type": "image/png",
     "etag": '"572c3-cdJAPaHdOvFCGzuaQjagdgOu6XE"',
-    "mtime": "2026-07-08T09:20:47.299Z",
+    "mtime": "2026-07-09T06:59:01.790Z",
     "size": 357059,
     "path": "../public/assets/qwen-CONDcHqt.png"
   },
-  "/assets/ProxyViewerContainer-BLCRQtU_.js": {
+  "/assets/ProxyViewerContainer-CqRfBWJ3.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"bacfa-YqZ58vQYU45MNm0p7H9WPhfdV4M"',
-    "mtime": "2026-07-08T09:20:47.300Z",
-    "size": 765178,
-    "path": "../public/assets/ProxyViewerContainer-BLCRQtU_.js"
+    "etag": '"bd898-gg83MT9gqLxpBjOn+Tmh6I1/9N4"',
+    "mtime": "2026-07-09T06:59:01.791Z",
+    "size": 776344,
+    "path": "../public/assets/ProxyViewerContainer-CqRfBWJ3.js"
   }
 };
 function readAsset(id) {
@@ -180,7 +162,7 @@ const EncodingMap = {
   br: ".br",
   zstd: ".zst"
 };
-const _aYWmx5 = defineHandler((event) => {
+const _TahAqH = defineHandler((event) => {
   if (event.req.method && !METHODS.has(event.req.method)) {
     return;
   }
@@ -252,15 +234,15 @@ const findRouteRules = /* @__PURE__ */ (() => {
     return r;
   };
 })();
-const _lazy_bRSXJB = defineLazyEventHandler(() => import("./_chunks/ssr-renderer.mjs"));
+const _lazy_9A6hFz = defineLazyEventHandler(() => import("./_chunks/ssr-renderer.mjs"));
 const findRoute = /* @__PURE__ */ (() => {
-  const data = { route: "/**", handler: _lazy_bRSXJB };
+  const data = { route: "/**", handler: _lazy_9A6hFz };
   return ((_m, p) => {
     return { data, params: { "_": p.slice(1) } };
   });
 })();
 const globalMiddleware = [
-  toEventHandler(_aYWmx5)
+  toEventHandler(_TahAqH)
 ].filter(Boolean);
 const errorHandler$1 = (error, event) => {
   const res = defaultHandler(error, event);

package/README.md

@@ -130,13 +130,13 @@ The web UI runs at http://localhost:9527. The public proxy endpoint is also
 `http://localhost:9527/proxy`; internally Agent Inspector may run the app on a private helper port,
 but AI tools should use the public URL printed by the CLI.
 
-The legacy `http://localhost:25947` port is closed by default. If you need a temporary alias for
+The legacy `http://localhost:9527` port is closed by default. If you need a temporary alias for
 older AI tool or MCP configs, start with `agent-inspector --legacy-port`.
 
 ## v3.0 Port Migration
 
-Agent Inspector v3.0 changes the default public port from `25947` to `9527`. The packaged CLI now
-opens only `9527` by default. Existing AI coding tool and MCP configs that still point at `25947`
+Agent Inspector v3.0 changes the default public port from `9527` to `9527`. The packaged CLI now
+opens only `9527` by default. Existing AI coding tool and MCP configs that still point at `9527`
 should be moved to `9527`, or you can temporarily start with `agent-inspector --legacy-port`.
 
 Use these endpoints for new configs:
@@ -266,7 +266,7 @@ configure `http://localhost:9527/api/mcp` directly. If it only supports stdio, c
 `agent-inspector-mcp stdio`; that command is only a bridge to `/api/mcp`, not a second Inspector
 server.
 
-Legacy MCP configs that still use `http://localhost:25947/api/mcp` require starting the CLI with
+Legacy MCP configs that still use `http://localhost:9527/api/mcp` require starting the CLI with
 `agent-inspector --legacy-port`; new configs should use `http://localhost:9527/api/mcp`.
 
 Coding agents can use the MCP surface in three ways:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tonyclaw/agent-inspector",
-  "version": "3.0.18",
+  "version": "3.0.20",
   "type": "module",
   "description": "Agent observability and knowledge capture layer for AI coding tools.",
   "license": "MIT",
@@ -71,10 +71,7 @@
   "dependencies": {
     "@mariozechner/pi-agent-core": "^0.73.1",
     "@mariozechner/pi-ai": "^0.73.1",
-    "@mariozechner/pi-coding-agent": "^0.73.1",
     "@modelcontextprotocol/server": "^2.0.0-alpha.2",
-    "@radix-ui/react-dialog": "^1.1.14",
-    "@radix-ui/react-select": "^2.2.6",
     "@tailwindcss/typography": "^0.5.19",
     "@tanstack/react-router": "^1.160.2",
     "@tanstack/react-start": "^1.161.0",
@@ -104,24 +101,36 @@
     "@eslint/js": "^10.0.1",
     "@ladle/react": "^5.1.1",
     "@tailwindcss/vite": "^4.1.18",
-    "@types/bun": "latest",
+    "@types/bun": "1.3.8",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@typescript-eslint/eslint-plugin": "^8.55.0",
     "@typescript-eslint/parser": "^8.55.0",
     "@vitejs/plugin-react": "^5.1.4",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.1",
     "eslint": "^9.32.0",
     "eslint-plugin-eslint-comments": "^3.2.0",
     "eslint-plugin-functional": "^9.0.2",
     "eslint-plugin-unicorn": "^63.0.0",
     "husky": "^9.1.7",
     "knip": "^5.83.1",
-    "nitro": "^3.0.260603-beta",
+    "nitro": "^3.0.260610-beta",
     "playwright": "^1.60.0",
     "tailwindcss": "^4.1.11",
     "typescript": "^5.9.3",
-    "vite": "^7.3.1",
+    "vite": "^7.3.6",
     "vite-tsconfig-paths": "^6.1.1"
+  },
+  "overrides": {
+    "undici": ">=7.24.0 <8.0.0",
+    "rollup": ">=4.59.0 <5.0.0",
+    "postcss": ">=8.5.10 <9.0.0",
+    "js-yaml": ">=4.1.2 <5.0.0",
+    "flatted": ">=3.4.0 <4.0.0",
+    "smol-toml": ">=1.6.1 <2.0.0",
+    "koa": ">=2.16.4 <3.0.0",
+    "@babel/core": ">=7.29.1 <8.0.0",
+    "@typescript-eslint/typescript-estree": "^8.63.0",
+    "vite": "^7.3.6"
   }
 }

package/src/cli/onboard.ts

@@ -37,7 +37,7 @@ const __dirname = dirname(__filename);
 
 const DEFAULT_PORT = 9527;
 const DEFAULT_MCP_URL = `http://localhost:${DEFAULT_PORT}/api/mcp`;
-const LEGACY_MCP_URL = "http://localhost:25947/api/mcp";
+const LEGACY_MCP_URL = "http://localhost:9527/api/mcp";
 const SKILL_DIR_NAME = "agent-inspector-onboard";
 const SKILL_FILE_NAME = "SKILL.md";
 // Windows reserves `:` for NTFS alternate data streams, so a file named

package/src/cli.ts

@@ -24,12 +24,12 @@ import { findPidsByPort, killPid, openUrlCommand } from "./proxy/platformCommand
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
-// v3 defaults the public entrypoint to 9527. The legacy 25947 alias can be
+// v3 defaults the public entrypoint to 9527. The legacy 9527 alias can be
 // enabled explicitly for older AI-tool and MCP configs. The TanStack Start
 // runtime stays on a private upstream port and public ports reverse-proxy to
 // that same runtime, so logs, sessions, and MCP state remain unified.
 const DEFAULT_PORT = 9527;
-const LEGACY_ALIAS_PORT = 25947;
+const LEGACY_ALIAS_PORT = 9527;
 const DEFAULT_UPSTREAM_PORT = 9529;
 const LOCAL_PROBE_TIMEOUT_MS = 2000;
 const BRANDED_WINDOWS_RUNTIME_EXE = "agent-inspector.exe";

package/src/components/clients/ClientLogo.tsx

@@ -51,7 +51,11 @@ export function detectClientApp(input: ClientAppDetectionInput): ClientApp {
   }
   if (matchesAny(haystack, ["mimocode", "mimo-code", "mimo code"])) return "mimo-code";
   if (matchesAny(haystack, ["opencode", "open-code", "open code"])) return "opencode";
-  if (matchesAny(haystack, ["claude-code", "claude code", "claudecode"])) return "claude-code";
+  if (
+    matchesAny(haystack, ["claude-code", "claude code", "claudecode", "claude-cli", "claude cli"])
+  ) {
+    return "claude-code";
+  }
   if (matchesAny(haystack, ["codex desktop", "codex-cli", "openai-codex", "codex"])) {
     return "codex";
   }

package/src/components/proxy-viewer/RequestToolsPanel.tsx

@@ -183,6 +183,7 @@ function matchesQuery(tool: RequestToolDefinition, query: string): boolean {
   return haystack.includes(query);
 }
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const RequestTools = memo(function RequestTools({
   summary,
   calledToolNames,

package/src/components/proxy-viewer/ResponseView.tsx

@@ -66,6 +66,7 @@ function MarkdownFallbackView({ text }: { text: string }): JSX.Element {
   return <AnswerMarkdown text={text} />;
 }
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const ResponseView = memo(function ResponseView({
   responseText,
   responseStatus,

package/src/components/proxy-viewer/StreamingChunkSequence.tsx

@@ -30,6 +30,7 @@ const StreamingChunksResponseSchema = z.object({
 
 const CHUNK_FETCH_TIMEOUT_MS = 10_000;
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const StreamingChunkSequence = memo(function StreamingChunkSequence({
   logId,
   truncated,

package/src/components/proxy-viewer/TurnGroup.tsx

@@ -51,6 +51,7 @@ export type TurnGroupProps = {
   showLogClientMetadata?: boolean;
 };
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const TurnGroup = memo(function TurnGroup({
   entries,
   viewMode,

package/src/components/proxy-viewer/anatomy/SegmentBar.tsx

@@ -54,6 +54,7 @@ export type SegmentBarProps = {
  * context segment. Segment mode can activate a JSON path; aggregate modes stay
  * static so they do not imply a misleading jump target.
  */
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const SegmentBar = memo(function SegmentBar({
   segments,
   totalTokens,

package/src/components/proxy-viewer/formats/anthropic/ContentBlocks.tsx

@@ -38,6 +38,7 @@ function SystemReminderBlock({ text }: { text: string }): JSX.Element {
   );
 }
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const TextBlock = memo(function TextBlock({ text }: { text: string }): JSX.Element {
   if (text.includes("<system-reminder>")) {
     return <SystemReminderBlock text={text} />;
@@ -57,6 +58,7 @@ export const TextBlock = memo(function TextBlock({ text }: { text: string }): JS
   );
 });
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const ThinkingBlock = memo(function ThinkingBlock({
   thinking,
 }: {
@@ -97,6 +99,7 @@ export const ThinkingBlock = memo(function ThinkingBlock({
   );
 });
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const ToolUseBlock = memo(function ToolUseBlock({
   name,
   input,
@@ -160,6 +163,7 @@ export const ToolUseBlock = memo(function ToolUseBlock({
   );
 });
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const ResponseContentBlockRenderer = memo(function ResponseContentBlockRenderer({
   block,
   toolIndex,

package/src/components/proxy-viewer/formats/anthropic/ResponseView.tsx

@@ -7,6 +7,7 @@ import { Separator } from "../../../ui/separator";
 import type { ResponseToolFocus } from "../index";
 import { ResponseContentBlockRenderer } from "./ContentBlocks";
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const StructuredResponseViewAnthropic = memo(function StructuredResponseViewAnthropic({
   response,
   toolFocus,

package/src/components/proxy-viewer/formats/openai/ResponseView.tsx

@@ -283,6 +283,7 @@ function ResponsesFunctionCallBlock({
   );
 }
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const OpenAIResponseView = memo(function OpenAIResponseView({
   response,
   toolFocus,
@@ -378,6 +379,7 @@ export const OpenAIResponseView = memo(function OpenAIResponseView({
   );
 });
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const OpenAIResponsesResponseView = memo(function OpenAIResponsesResponseView({
   response,
   toolFocus,

package/src/components/ui/dialog.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import * as DialogPrimitive from "@radix-ui/react-dialog";
+import { Dialog as DialogPrimitive } from "radix-ui";
 import { X } from "lucide-react";
 import * as React from "react";
 

package/src/components/ui/json-viewer.tsx

@@ -220,6 +220,7 @@ function ExpandCollapseButton({
   );
 }
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 const JsonNode = memo(function JsonNode({
   name,
   value,
@@ -479,6 +480,7 @@ export type JsonViewerFromStringProps = {
   bulkRevision?: number;
 };
 
+// eslint-disable-next-line @typescript-eslint/no-shadow -- named function gives React DevTools a readable displayName
 export const JsonViewerFromString = memo(function JsonViewerFromString({
   text,
   defaultExpandDepth = 0,

package/src/components/ui/select.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import * as SelectPrimitive from "@radix-ui/react-select";
+import { Select as SelectPrimitive } from "radix-ui";
 import { CheckIcon, ChevronDownIcon, ChevronUpIcon } from "lucide-react";
 import * as React from "react";
 

package/src/contracts/json.ts

@@ -23,10 +23,15 @@ export const JsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>
 );
 
 /**
- * Re-types a value as `JsonValue` without re-walking it. Use this ONLY when
- * the value has already been validated and originated from `JSON.parse`.
+ * Re-types a value as `JsonValue` without a full recursive walk. A lightweight
+ * runtime guard rejects the most dangerous non-JSON types (undefined, bigint,
+ * functions) that would crash JSON.stringify downstream. Use when the value
+ * has already been validated by Zod or originated from JSON.parse.
  */
 export function trustAsJsonValue<T>(value: T): JsonValue {
+  if (value === undefined || typeof value === "bigint" || typeof value === "function") {
+    return null;
+  }
   // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
   return value as unknown as JsonValue;
 }

package/src/lib/providerContract.ts

@@ -1,5 +1,25 @@
 import { z } from "zod";
 
+/**
+ * Validates that a string is a well-formed http(s) URL. Rejects non-HTTP
+ * schemes (file:, ftp:, etc.) that could be used for SSRF. Local/private
+ * addresses are allowed because this tool legitimately proxies to local LLM
+ * servers (Ollama, LM Studio, etc.).
+ */
+function httpUrl(): z.ZodString {
+  return z.string().refine((val) => {
+    // Treat empty strings as "unset" so legacy/in-flight providers that
+    // store empty placeholders instead of null can still round-trip.
+    if (val.length === 0) return true;
+    try {
+      const parsed = new URL(val);
+      return parsed.protocol === "http:" || parsed.protocol === "https:";
+    } catch {
+      return false;
+    }
+  }, "Must be a valid http(s) URL");
+}
+
 export const ProviderModelMetadataSchema = z.object({
   model: z.string().min(1),
   contextWindow: z.number().int().positive().optional(),
@@ -20,12 +40,12 @@ export const ProviderConfigSchema = z.object({
   name: z.string(),
   apiKey: z.string(),
   model: z.string().optional(),
-  models: z.array(z.string()).min(1),
+  models: z.array(z.string()).optional().default([]),
   format: z.enum(["anthropic", "openai"]).optional(),
-  baseUrl: z.string().optional(),
-  anthropicBaseUrl: z.string().optional(),
-  openaiBaseUrl: z.string().optional(),
-  openaiResponsesBaseUrl: z.string().optional(),
+  baseUrl: httpUrl().optional(),
+  anthropicBaseUrl: httpUrl().optional(),
+  openaiBaseUrl: httpUrl().optional(),
+  openaiResponsesBaseUrl: httpUrl().optional(),
   authHeader: z.enum(["bearer", "x-api-key"]).optional().default("bearer"),
   apiDocsUrl: z.string().optional(),
   modelMetadataUrl: z.string().optional(),

package/src/mcp/server.ts

@@ -99,6 +99,7 @@ import {
   updateProviderImpl,
   type ToolResult,
 } from "./toolHandlers";
+import { logger } from "../proxy/logger";
 
 // ---------------------------------------------------------------------------
 // Lazy singleton: build the McpServer + transport on first use.
@@ -122,9 +123,17 @@ function buildServer(): ServerPair {
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: undefined, // stateless — see module docstring
   });
-  // The connect() call is async but we don't need to await it here; the SDK
-  // buffers the first request internally.
-  void server.connect(transport);
+  // The connect() call is async — handle rejection so a failed transport
+  // setup doesn't leave a broken singleton that silently fails all requests.
+  void server.connect(transport).then(
+    () => {},
+    (err) => {
+      logger.error(
+        "[mcp] server.connect failed:",
+        err instanceof Error ? err.message : String(err),
+      );
+    },
+  );
   return { server, transport };
 }
 

package/src/mcp/toolHandlers.ts

@@ -777,7 +777,12 @@ export async function diagnoseCaptureImpl(
   const runtime = await getRuntimeConfigImpl(callApi);
   if (runtime.isError === true) return runtime;
   const runtimeText = runtime.content[0]?.text ?? "{}";
-  const runtimePayload: unknown = JSON.parse(runtimeText);
+  let runtimePayload: unknown = {};
+  try {
+    runtimePayload = JSON.parse(runtimeText);
+  } catch {
+    // Non-JSON runtime config text — treat as empty config and continue diagnostics
+  }
   const runtimeRecord = isRecord(runtimePayload) ? runtimePayload : {};
   const configRecord = isRecord(runtimeRecord["config"]) ? runtimeRecord["config"] : {};
   const captureMode = stringField(configRecord, "captureMode");