@tonyclaw/agent-inspector 3.0.26 → 3.0.27

package/.output/server/{_tanstack-start-manifest_v-B50VTLrH.mjs → _tanstack-start-manifest_v-CoGjnkQD.mjs}

@@ -1,4 +1,4 @@
-const tsrStartManifest = () => ({ routes: { __root__: { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/__root.tsx", children: ["/", "/api/alerts", "/api/config", "/api/groups", "/api/health", "/api/logs", "/api/mcp", "/api/models", "/api/pi-agent", "/api/providers", "/api/runs", "/api/sessions", "/proxy/$", "/session/$sessionId", "/api/ecosystem/packages", "/api/ecosystem/tasks", "/api/knowledge/candidates", "/api/knowledge/project-context", "/api/knowledge/search", "/api/ecosystem/recipes/$recipeId/run", "/api/knowledge/sessions/$sessionId/candidates"], preloads: ["/assets/index-CSIL7-MK.js"], scripts: [{ attrs: { type: "module", async: true, src: "/assets/index-CSIL7-MK.js" } }] }, "/": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/index.tsx", children: void 0, preloads: ["/assets/index-DrVJsks2.js", "/assets/ProxyViewerContainer-BJvwOrSi.js"] }, "/session/$sessionId": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/session/$sessionId.tsx", children: void 0, preloads: ["/assets/_sessionId-D-V84cgw.js", "/assets/ProxyViewerContainer-BJvwOrSi.js"] } } });
+const tsrStartManifest = () => ({ routes: { __root__: { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/__root.tsx", children: ["/", "/api/alerts", "/api/config", "/api/groups", "/api/health", "/api/logs", "/api/mcp", "/api/models", "/api/pi-agent", "/api/providers", "/api/runs", "/api/sessions", "/proxy/$", "/session/$sessionId", "/api/ecosystem/packages", "/api/ecosystem/tasks", "/api/knowledge/candidates", "/api/knowledge/project-context", "/api/knowledge/search", "/api/ecosystem/recipes/$recipeId/run", "/api/knowledge/sessions/$sessionId/candidates"], preloads: ["/assets/index-B1atk19i.js"], scripts: [{ attrs: { type: "module", async: true, src: "/assets/index-B1atk19i.js" } }] }, "/": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/index.tsx", children: void 0, preloads: ["/assets/index-gY3I-7-D.js", "/assets/ProxyViewerContainer-CYOXB81n.js"] }, "/session/$sessionId": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/session/$sessionId.tsx", children: void 0, preloads: ["/assets/_sessionId-BnKGmJrR.js", "/assets/ProxyViewerContainer-CYOXB81n.js"] } } });
 export {
   tsrStartManifest
 };

package/.output/server/index.mjs

@@ -20,121 +20,121 @@ const assets = {
   "/assets/agent-inspector-58K1_MsC.ico": {
     "type": "image/vnd.microsoft.icon",
     "etag": '"38fa-ZD8kPABHYjPIkcH82FMY6iZM7fI"',
-    "mtime": "2026-07-11T00:24:54.156Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 14586,
     "path": "../public/assets/agent-inspector-58K1_MsC.ico"
   },
   "/assets/alibaba-TTwafVwX.svg": {
     "type": "image/svg+xml",
     "etag": '"171b-6dyV5K8QjiaY35sN9qNprh9zDIs"',
-    "mtime": "2026-07-11T00:24:54.156Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 5915,
     "path": "../public/assets/alibaba-TTwafVwX.svg"
   },
-  "/assets/json-viewer-C9Ji3gYN.js": {
+  "/assets/CompareDrawer-BVCAAbbu.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"1ae7-ywSQGg/SiMKKFOeSZzAyG3AC4DI"',
-    "mtime": "2026-07-11T00:24:54.158Z",
+    "etag": '"4bc4-Zb2MZSke4PGsZAZQWlHQldYzm9M"',
+    "mtime": "2026-07-11T04:43:38.031Z",
+    "size": 19396,
+    "path": "../public/assets/CompareDrawer-BVCAAbbu.js"
+  },
+  "/assets/json-viewer-CpyYpPjx.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": '"1ae7-AXjzdLeB9CtNkkvC/oR6PHIpZrw"',
+    "mtime": "2026-07-11T04:43:38.032Z",
     "size": 6887,
-    "path": "../public/assets/json-viewer-C9Ji3gYN.js"
+    "path": "../public/assets/json-viewer-CpyYpPjx.js"
   },
-  "/assets/CompareDrawer-SZRUDQc9.js": {
+  "/assets/index-gY3I-7-D.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"4bc4-c5yQQGgiYt3gI4zOesfAlSc3dno"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 19396,
-    "path": "../public/assets/CompareDrawer-SZRUDQc9.js"
+    "etag": '"265-61LM1QLhhYspwWAw/ft2ETl95Zg"',
+    "mtime": "2026-07-11T04:43:38.031Z",
+    "size": 613,
+    "path": "../public/assets/index-gY3I-7-D.js"
+  },
+  "/assets/index-9fMLCU4d.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": '"1cd2d-vhf/v641OwP3pvt2nzTr2vXPzE4"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 118061,
+    "path": "../public/assets/index-9fMLCU4d.js"
   },
   "/assets/minimax-BPMzvuL-.jpeg": {
     "type": "image/jpeg",
     "etag": '"1b06-IwivU89ko5UTMUM1/t7hn4sQK9A"',
-    "mtime": "2026-07-11T00:24:54.156Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 6918,
     "path": "../public/assets/minimax-BPMzvuL-.jpeg"
   },
-  "/assets/index-CSIL7-MK.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": '"537cd-GPVivJXxNqhczKks68tQgmJTPDE"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 341965,
-    "path": "../public/assets/index-CSIL7-MK.js"
-  },
   "/assets/index-CmeF5XXS.css": {
     "type": "text/css; charset=utf-8",
     "etag": '"28a56-x7Wmw+oL5ZFDjFw5JRwjxSop3gg"',
-    "mtime": "2026-07-11T00:24:54.156Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 166486,
     "path": "../public/assets/index-CmeF5XXS.css"
   },
-  "/assets/index-DgFWCxOs.js": {
+  "/assets/RequestAnatomy-S17pYDRc.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"1cd2d-3tCkJqLlCuTi9/Lz+b9h1l5nZgg"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 118061,
-    "path": "../public/assets/index-DgFWCxOs.js"
+    "etag": '"43f3-DId6+xakRnGM+B/ZQpGxfeV9YU0"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 17395,
+    "path": "../public/assets/RequestAnatomy-S17pYDRc.js"
   },
-  "/assets/ReplayDialog-DgfmqiM3.js": {
+  "/assets/ResponseView-Cf1XrawD.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"3348-7mNTOezyB/6M8SHCRaNHCBplHZk"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 13128,
-    "path": "../public/assets/ReplayDialog-DgfmqiM3.js"
+    "etag": '"47fe-kAztjtZjRuPE6xDPPKWIypxT0pw"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 18430,
+    "path": "../public/assets/ResponseView-Cf1XrawD.js"
   },
-  "/assets/RequestAnatomy-CS6c7Qfn.js": {
+  "/assets/StreamingChunkSequence-BdOrVlCi.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"43f3-iE7MB7sQUMWqMwG0cyR73BgkbuY"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 17395,
-    "path": "../public/assets/RequestAnatomy-CS6c7Qfn.js"
+    "etag": '"e96-lQJVKxQQeI+CfoFlIj48wFou0qg"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 3734,
+    "path": "../public/assets/StreamingChunkSequence-BdOrVlCi.js"
   },
-  "/assets/index-DrVJsks2.js": {
+  "/assets/ReplayDialog-DMX23O5G.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"265-GhY3Vadghb4WWaqhfjEikIO6zQU"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 613,
-    "path": "../public/assets/index-DrVJsks2.js"
+    "etag": '"3348-Y6DIYl0Hh8PNYNBckbjWZMRAVXk"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 13128,
+    "path": "../public/assets/ReplayDialog-DMX23O5G.js"
   },
-  "/assets/ResponseView-C0Ri_5gm.js": {
+  "/assets/_sessionId-BnKGmJrR.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"47fe-NHHoPnXJQBRlrFDWr/aopcQwmGk"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 18430,
-    "path": "../public/assets/ResponseView-C0Ri_5gm.js"
+    "etag": '"36d-RhevzYZMuLpSJjgi/aeqAk1rL4A"',
+    "mtime": "2026-07-11T04:43:38.031Z",
+    "size": 877,
+    "path": "../public/assets/_sessionId-BnKGmJrR.js"
   },
-  "/assets/StreamingChunkSequence-7dYcHWyZ.js": {
+  "/assets/index-B1atk19i.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"e96-r+HXGxAmoKjHyD3J/MqfzPojMWo"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 3734,
-    "path": "../public/assets/StreamingChunkSequence-7dYcHWyZ.js"
+    "etag": '"537cd-GY35Hkfq1WcIm1S1m2dfzIGL8WU"',
+    "mtime": "2026-07-11T04:43:38.031Z",
+    "size": 341965,
+    "path": "../public/assets/index-B1atk19i.js"
   },
   "/assets/zhipuai-BPNAnxo-.svg": {
     "type": "image/svg+xml",
     "etag": '"2bf8-hNaLCTi89nOFCsIIfWpP/jrfo0s"',
-    "mtime": "2026-07-11T00:24:54.156Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 11256,
     "path": "../public/assets/zhipuai-BPNAnxo-.svg"
   },
-  "/assets/_sessionId-D-V84cgw.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": '"36d-yOd6Us3ZWW0UESw+7JXnLzgeMbY"',
-    "mtime": "2026-07-11T00:24:54.156Z",
-    "size": 877,
-    "path": "../public/assets/_sessionId-D-V84cgw.js"
-  },
   "/assets/qwen-CONDcHqt.png": {
     "type": "image/png",
     "etag": '"572c3-cdJAPaHdOvFCGzuaQjagdgOu6XE"',
-    "mtime": "2026-07-11T00:24:54.156Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 357059,
     "path": "../public/assets/qwen-CONDcHqt.png"
   },
-  "/assets/ProxyViewerContainer-BJvwOrSi.js": {
+  "/assets/ProxyViewerContainer-CYOXB81n.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"14071d-2HnQGZd4Md0+aEEDy7Sa4wv0GEY"',
-    "mtime": "2026-07-11T00:24:54.158Z",
-    "size": 1312541,
-    "path": "../public/assets/ProxyViewerContainer-BJvwOrSi.js"
+    "etag": '"1404bd-m6RVh35PDpz6DtJ+NOh+zTs1XG8"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 1311933,
+    "path": "../public/assets/ProxyViewerContainer-CYOXB81n.js"
   }
 };
 function readAsset(id) {

package/README.md

@@ -31,6 +31,14 @@ npm install -g @tonyclaw/agent-inspector-mcp
 agent-inspector-mcp doctor
 ```
 
+Agent Inspector requires Node.js 22 or newer. Node.js 24 LTS is recommended for production use.
+
+By default, Agent Inspector binds to `127.0.0.1`. With `--host 0.0.0.0`, remote coding tools may
+use `/proxy`, while the UI, REST API, and MCP control plane remain local-only. Set
+`AGENT_INSPECTOR_CONTROL_TOKEN` for authenticated remote API/MCP clients, or explicitly set
+`AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL=1` only behind a trusted firewall or loopback-only port
+mapping.
+
 `@tonyclaw/agent-inspector` runs the local UI, proxy, REST API, storage, and built-in
 `/api/mcp` endpoint. `@tonyclaw/agent-inspector-mcp` is the enhancement package for
 stdio-first MCP clients and setup automation; it bridges to the local Inspector endpoint without

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@tonyclaw/agent-inspector",
-  "version": "3.0.26",
+  "version": "3.0.27",
   "type": "module",
   "description": "Agent observability and knowledge capture layer for AI coding tools.",
   "license": "MIT",
   "engines": {
-    "node": ">=18.18.0"
+    "node": ">=22.0.0"
   },
   "author": "TonyClaw",
   "repository": {
@@ -55,8 +55,8 @@
     "dev": "vite dev",
     "start": "node .output/cli.js",
     "build": "vite build && bun build:cli && bun build:mcp",
-    "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node18 --format=esm --outfile=.output/cli.js",
-    "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node20 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
+    "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",
+    "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
     "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",
     "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit",
@@ -102,7 +102,6 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",
-    "@cfworker/json-schema": "^4.1.1",
     "@eslint/js": "^10.0.1",
     "@ladle/react": "^5.1.1",
     "@tailwindcss/vite": "^4.1.18",

package/src/cli.ts

@@ -8,6 +8,7 @@ import { existsSync } from "node:fs";
 import type { Readable, Writable } from "node:stream";
 import {
   formatAccessHintLines,
+  isLoopbackHost,
   isValidBindHost,
   localUrlForPort,
   networkUrlsForBindHost,
@@ -31,6 +32,7 @@ const __dirname = dirname(__filename);
 const DEFAULT_PORT = 9527;
 const LEGACY_ALIAS_PORT = 9527;
 const DEFAULT_UPSTREAM_PORT = 9529;
+const DEFAULT_BIND_HOST = "127.0.0.1";
 const LOCAL_PROBE_TIMEOUT_MS = 2000;
 const BRANDED_WINDOWS_RUNTIME_EXE = "agent-inspector.exe";
 const DEFAULT_CAPTURE_MODE = "simple";
@@ -229,6 +231,16 @@ function printAccessHints(port: number, host?: string): void {
   for (const line of formatAccessHintLines(port, networkUrls, host)) {
     console.log(line);
   }
+  if (!isLoopbackHost(host)) {
+    if (process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] === "1") {
+      console.warn("   Control plane:  REMOTE ACCESS ENABLED by administrator override");
+    } else {
+      console.log("   Control plane:  local only; remote clients may use /proxy");
+      if ((process.env["AGENT_INSPECTOR_CONTROL_TOKEN"] ?? "") !== "") {
+        console.log("   Remote API:     Bearer token authentication enabled");
+      }
+    }
+  }
 }
 
 type BackgroundSupervisorOptions = {
@@ -289,13 +301,18 @@ function pickUpstreamPort(publicPort: number, legacyAliasPort: number | null): n
 async function tryStartIdentityProxy(
   identityPort: number,
   upstreamPort: number,
-  upstreamHost: string | undefined,
+  listenHost: string,
+  upstreamHost: string,
 ): Promise<import("node:http").Server | null> {
   try {
     const server = await startIdentityProxy({
       listenPort: identityPort,
-      upstreamHost: upstreamHost ?? "127.0.0.1",
+      listenHost,
+      upstreamHost,
       upstreamPort,
+      restrictRemoteControl: !isLoopbackHost(listenHost),
+      allowRemoteControl: process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] === "1",
+      controlToken: process.env["AGENT_INSPECTOR_CONTROL_TOKEN"],
     });
     return server;
   } catch (err) {
@@ -317,7 +334,8 @@ async function runStart(args: string[]): Promise<void> {
     process.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? process.env["AGENT_INSPECTOR_MODE"];
 
   let port = portDefault;
-  let host = envHost !== undefined && envHost.trim().length > 0 ? envHost.trim() : undefined;
+  let host =
+    envHost !== undefined && envHost.trim().length > 0 ? envHost.trim() : DEFAULT_BIND_HOST;
   let open = true;
   let openWasSpecified = false;
   let background = false;
@@ -457,6 +475,18 @@ async function runStart(args: string[]): Promise<void> {
     return;
   }
 
+  if (
+    !enableIdentityProxy &&
+    !isLoopbackHost(host) &&
+    process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] !== "1"
+  ) {
+    console.error(
+      "Refusing an unprotected remote bind with --no-identity-proxy. Keep the identity proxy enabled or set AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL=1 explicitly.",
+    );
+    process.exitCode = 1;
+    return;
+  }
+
   /**
    * Check if a port is in use and kill the process using it
    */
@@ -475,6 +505,7 @@ async function runStart(args: string[]): Promise<void> {
   // the public-facing port(s). When the identity proxy is disabled we fall
   // back to TanStack listening on the public port directly.
   const upstreamPort = enableIdentityProxy ? pickUpstreamPort(port, legacyAliasPort) : port;
+  const upstreamHost = enableIdentityProxy ? DEFAULT_BIND_HOST : host;
   process.env["PORT"] = String(upstreamPort);
 
   const url = urlForHost(port, host);
@@ -627,10 +658,8 @@ async function runStart(args: string[]): Promise<void> {
   if (providersJson !== undefined) {
     serverEnv["AGENT_INSPECTOR_PROVIDERS_JSON"] = providersJson;
   }
-  if (host !== undefined) {
-    serverEnv["HOST"] = host;
-    serverEnv["NITRO_HOST"] = host;
-  }
+  serverEnv["HOST"] = upstreamHost;
+  serverEnv["NITRO_HOST"] = upstreamHost;
   serverEnv["AGENT_INSPECTOR_PUBLIC_PORT"] = String(port);
   serverEnv["PROXY_PORT"] = String(port);
   serverEnv["AGENT_INSPECTOR_CAPTURE_MODE"] = captureMode;
@@ -664,12 +693,17 @@ async function runStart(args: string[]): Promise<void> {
     server: import("node:http").Server;
   }> = [];
   if (enableIdentityProxy) {
-    const primaryProxy = await tryStartIdentityProxy(port, upstreamPort, host);
+    const primaryProxy = await tryStartIdentityProxy(port, upstreamPort, host, upstreamHost);
     if (primaryProxy !== null) {
       identityProxies.push({ label: "primary", port, server: primaryProxy });
     }
     if (legacyAliasPort !== null) {
-      const legacyProxy = await tryStartIdentityProxy(legacyAliasPort, upstreamPort, host);
+      const legacyProxy = await tryStartIdentityProxy(
+        legacyAliasPort,
+        upstreamPort,
+        host,
+        upstreamHost,
+      );
       if (legacyProxy !== null) {
         identityProxies.push({ label: "legacy", port: legacyAliasPort, server: legacyProxy });
       }

package/src/components/providers/ProviderCard.tsx

@@ -2,22 +2,16 @@ import { type JSX, useState } from "react";
 import { Button } from "../ui/button";
 import { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider } from "../ui/tooltip";
 import {
-  Eye,
-  EyeOff,
   Pencil,
   Trash2,
   RotateCw,
   CheckCircle,
   ExternalLink,
   Clock,
-  Copy,
-  Check,
   ChevronDown,
   ChevronRight,
 } from "lucide-react";
 import type { ProviderConfig } from "../../proxy/providers";
-import { copyTextToClipboard } from "../../lib/clipboard";
-import { maskApiKey } from "../../lib/mask";
 import {
   findProviderModelMetadata,
   providerHasContextMetadata,
@@ -174,18 +168,8 @@ export function ProviderCard({
   onRefreshMetadata,
   isRefreshingMetadata = false,
 }: ProviderCardProps): JSX.Element {
-  const [showApiKey, setShowApiKey] = useState(false);
-  const [copied, setCopied] = useState(false);
   const [showDetails, setShowDetails] = useState(false);
 
-  function handleCopy() {
-    void copyTextToClipboard(provider.apiKey).then((success) => {
-      if (!success) return;
-      setCopied(true);
-      setTimeout(() => setCopied(false), 2000);
-    });
-  }
-
   const docsUrl =
     provider.apiDocsUrl ??
     Object.entries(KNOWN_PROVIDER_DOCS).find(([keyword]) =>
@@ -285,26 +269,9 @@ export function ProviderCard({
 
       {showDetails && (
         <div className="space-y-3 border-t border-border/60 pt-3">
-          <div className="flex items-center gap-2">
-            <code className="flex-1 truncate rounded bg-muted px-2 py-1 text-xs text-muted-foreground">
-              {showApiKey ? provider.apiKey : maskApiKey(provider.apiKey)}
-            </code>
-            <button
-              type="button"
-              onClick={() => setShowApiKey((s) => !s)}
-              className="p-1 text-muted-foreground transition-colors hover:text-foreground"
-              aria-label={showApiKey ? "Hide API key" : "Show API key"}
-            >
-              {showApiKey ? <EyeOff className="size-4" /> : <Eye className="size-4" />}
-            </button>
-            <button
-              type="button"
-              onClick={handleCopy}
-              className="p-1 text-muted-foreground transition-colors hover:text-foreground"
-              aria-label="Copy API key"
-            >
-              {copied ? <Check className="size-4 text-cyan-300" /> : <Copy className="size-4" />}
-            </button>
+          <div className="flex items-center gap-2 text-xs text-muted-foreground">
+            <CheckCircle className="size-3.5 text-emerald-500" />
+            <span>API key configured</span>
           </div>
 
           {provider.models !== undefined && provider.models.length > 0 && (

package/src/components/providers/ProviderForm.tsx

@@ -4,7 +4,6 @@ import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from ".
 import { Eye, EyeOff, Copy, Check, ChevronDown } from "lucide-react";
 import type { ProviderConfig, ProviderModelMetadata } from "../../lib/providerContract";
 import { copyTextToClipboard } from "../../lib/clipboard";
-import { maskApiKey } from "../../lib/mask";
 import {
   PATH_V1_CHAT_COMPLETIONS,
   PATH_V1_MESSAGES,
@@ -327,7 +326,7 @@ function EndpointUrlPreview({
 export function ProviderForm({ provider, onSubmit, onCancel }: ProviderFormProps): JSX.Element {
   const initialCapabilities = deriveProviderCapabilities(provider);
   const [name, setName] = useState(provider?.name ?? "");
-  const [apiKey, setApiKey] = useState(provider?.apiKey ?? "");
+  const [apiKey, setApiKey] = useState("");
   const [showApiKey, setShowApiKey] = useState(false);
   const [copied, setCopied] = useState(false);
   const initialModels = provider?.models;
@@ -411,7 +410,8 @@ export function ProviderForm({ provider, onSubmit, onCancel }: ProviderFormProps
   useEffect(() => {
     if (provider) {
       setName(provider.name);
-      setApiKey(provider.apiKey);
+      setApiKey("");
+      setShowApiKey(false);
       const nextModels = (provider.models?.length ?? 0) > 0 ? provider.models : [""];
       setModels(nextModels);
       setModelMetadataDrafts(createMetadataDrafts(provider, nextModels));
@@ -482,7 +482,7 @@ export function ProviderForm({ provider, onSubmit, onCancel }: ProviderFormProps
     if (!name.trim()) {
       newErrors.name = "Name is required";
     }
-    if (!apiKey.trim()) {
+    if (provider === undefined && !apiKey.trim()) {
       newErrors.apiKey = "API key is required";
     }
     if (models.length === 0 || models.every((m) => !m.trim())) {
@@ -950,19 +950,15 @@ export function ProviderForm({ provider, onSubmit, onCancel }: ProviderFormProps
 
       <div className="space-y-2">
         <label htmlFor="provider-apikey" className="text-sm font-medium">
-          API Key <span className="text-destructive">*</span>
+          API Key {provider === undefined && <span className="text-destructive">*</span>}
         </label>
         <div className="flex items-center gap-2">
           <input
             id="provider-apikey"
-            type="text"
-            value={showApiKey || apiKey.length === 0 ? apiKey : maskApiKey(apiKey)}
+            type={showApiKey ? "text" : "password"}
+            value={apiKey}
             onChange={(e) => setApiKey(e.target.value)}
-            onFocus={() => {
-              if (!showApiKey && apiKey.length > 0) setShowApiKey(true);
-            }}
-            placeholder="sk-ant-..."
-            readOnly={!showApiKey && apiKey.length > 0}
+            placeholder={provider === undefined ? "sk-ant-..." : "Leave blank to keep current key"}
             className="flex-1 rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:border-ring focus-visible:outline-ring focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50"
           />
           <button
@@ -982,6 +978,11 @@ export function ProviderForm({ provider, onSubmit, onCancel }: ProviderFormProps
             {copied ? <Check className="size-4 text-cyan-300" /> : <Copy className="size-4" />}
           </button>
         </div>
+        {provider !== undefined && apiKey.trim() === "" && (
+          <p className="text-xs text-muted-foreground">
+            A key is configured. Enter a new value only to rotate it.
+          </p>
+        )}
         {errors.apiKey !== undefined && <p className="text-xs text-destructive">{errors.apiKey}</p>}
       </div>
 

package/src/components/providers/ProvidersPanel.tsx

@@ -81,7 +81,7 @@ function endpointPayloadValue(
 function createProviderPayload(data: ProviderFormData, preserveEmptyEndpoints = false) {
   return {
     name: data.name,
-    apiKey: data.apiKey,
+    ...(data.apiKey.trim() === "" ? {} : { apiKey: data.apiKey }),
     models: data.models,
     anthropicBaseUrl: endpointPayloadValue(data.anthropicBaseUrl, preserveEmptyEndpoints),
     openaiBaseUrl: endpointPayloadValue(data.openaiBaseUrl, preserveEmptyEndpoints),
@@ -430,7 +430,7 @@ export function ProvidersPanel({
         refreshProviders();
         // Only run connection test when critical fields (apiKey, model, base URLs) changed
         const criticalFieldsChanged =
-          (data.apiKey ?? "") !== (editingProvider.apiKey ?? "") ||
+          data.apiKey.trim() !== "" ||
           JSON.stringify(data.models) !== JSON.stringify(editingProvider.models) ||
           (data.anthropicBaseUrl ?? "") !== (editingProvider.anthropicBaseUrl ?? "") ||
           (data.openaiBaseUrl ?? "") !== (editingProvider.openaiBaseUrl ?? "") ||

package/src/components/providers/SettingsDialog.tsx

@@ -471,9 +471,9 @@ function McpSettingsTab(): JSX.Element {
         value: `agent-inspector-mcp doctor --url ${endpoint}`,
       },
       {
-        id: "readonly",
-        label: "Readonly mode",
-        value: "AGENT_INSPECTOR_MCP_READONLY=1 agent-inspector",
+        id: "writes",
+        label: "Enable write tools",
+        value: "AGENT_INSPECTOR_MCP_WRITES=1 agent-inspector",
       },
       {
         id: "capabilities",

package/src/components/proxy-viewer/ProviderLogoStack.tsx

@@ -5,9 +5,6 @@ import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "../ui/
 
 const MAX_VISIBLE_LOGOS = 3;
 
-export const ROW_CHEVRON_SLOT_CLASS =
-  "flex h-8 w-5 shrink-0 items-center justify-center text-muted-foreground";
-
 export type ProviderLogoStackItem = {
   provider: Provider;
   tooltip: string;

package/src/contracts/anthropic.ts

@@ -228,8 +228,3 @@ export const SseEventSchema = z.discriminatedUnion("type", [
 
 export type AnthropicResponse = z.infer<typeof AnthropicResponseSchema>;
 export type ResponseContentBlockType = z.infer<typeof ResponseContentBlock>;
-
-// Backward-compatible aliases (originally named Inspector*)
-export const InspectorRequestSchema = AnthropicRequestSchema;
-export const InspectorResponseSchema = AnthropicResponseSchema;
-export type InspectorResponse = AnthropicResponse;

package/src/contracts/index.ts

@@ -12,7 +12,6 @@ export type {
   CapturedLog,
   LogBodyChunk,
   LogBodyPart,
-  RequestFormat,
   StreamingChunk,
   TokenUsage,
 } from "./log";
@@ -46,9 +45,6 @@ export {
 } from "./openai";
 export type {
   OpenAIResponse,
-  OpenAIResponsesRequest,
   OpenAIResponsesResponse,
-  OpenAIResponsesSSEvent,
-  OpenAIResponsesOutputItem,
   OpenAIToolCall,
 } from "./openai";

package/src/contracts/log.ts

@@ -2,7 +2,6 @@ import { z } from "zod";
 import { JsonValueSchema } from "./json";
 
 export type ApiFormat = "anthropic" | "openai" | "unknown";
-export type RequestFormat = ApiFormat;
 
 /**
  * A single SSE event from a streaming response.

package/src/contracts/openai.ts

@@ -242,10 +242,7 @@ export const OpenAIResponsesSSEventSchema = z
   .passthrough();
 
 export type OpenAIResponse = z.infer<typeof OpenAIResponseSchema>;
-export type OpenAIResponsesRequest = z.infer<typeof OpenAIResponsesRequestSchema>;
 export type OpenAIResponsesResponse = z.infer<typeof OpenAIResponsesResponseSchema>;
-export type OpenAIResponsesSSEvent = z.infer<typeof OpenAIResponsesSSEventSchema>;
-export type OpenAIResponsesOutputItem = z.infer<typeof OpenAIResponsesOutputItemSchema>;
 
 export function parseOpenAIResponse(rawBody: string): OpenAIResponse | null {
   try {