@tonyclaw/llm-inspector 1.13.0 → 1.14.1

package/.output/server/_ssr/{router-D5ccnemB.mjs → router-B8X3GXM2.mjs}

@@ -8,7 +8,8 @@ import { C as Conf } from "../_libs/conf.mjs";
 import { randomUUID } from "crypto";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
-import { o as object, s as string, _ as _enum, u as union, a as array, b as boolean, n as number, d as discriminatedUnion, l as literal, r as record, c as _null, e as lazy, f as unknown } from "../_libs/zod.mjs";
+import { M as McpServer, W as WebStandardStreamableHTTPServerTransport } from "../_libs/modelcontextprotocol__server.mjs";
+import { d as object, _ as _enum, b as string, u as union, a as array, c as boolean, n as number, g as discriminatedUnion, l as literal, r as record, h as _null, k as lazy, e as unknown } from "../_libs/zod.mjs";
 import "../_libs/tiny-warning.mjs";
 import "../_libs/tanstack__router-core.mjs";
 import "../_libs/cookie-es.mjs";
@@ -44,8 +45,8 @@ import "../_libs/debounce-fn.mjs";
 import "../_libs/mimic-function.mjs";
 import "../_libs/semver.mjs";
 import "../_libs/uint8array-extras.mjs";
-const appCss = "/assets/index-B0anmGQr.css";
-const Route$h = createRootRoute({
+const appCss = "/assets/index-DEUddp_2.css";
+const Route$i = createRootRoute({
   head: () => ({
     meta: [
       { charSet: "utf-8" },
@@ -68,8 +69,8 @@ function RootDocument({ children }) {
     ] })
   ] });
 }
-const $$splitComponentImporter = () => import("./index-C8VC13EA.mjs");
-const Route$g = createFileRoute("/")({
+const $$splitComponentImporter = () => import("./index-Cso39vJc.mjs");
+const Route$h = createFileRoute("/")({
   component: lazyRouteComponent($$splitComponentImporter, "component")
 });
 const LOG_DIR_ENV = process.env["LOG_DIR"];
@@ -546,9 +547,19 @@ const OpenAIFunctionCall = object({
   name: string(),
   arguments: string()
 });
+const OpenAIToolCallSchema = object({
+  index: number().optional(),
+  id: string().optional(),
+  type: literal("function").optional(),
+  function: object({
+    name: string().optional(),
+    arguments: string().optional()
+  })
+});
 OpenAIMessage.extend({
   content: union([string(), array(object({ type: literal("text"), text: string() }))]).optional(),
-  function_call: OpenAIFunctionCall.optional()
+  function_call: OpenAIFunctionCall.optional(),
+  tool_calls: array(OpenAIToolCallSchema).optional()
 });
 const OpenAIToolDefinition = object({
   type: literal("function"),
@@ -603,7 +614,8 @@ const OpenAIChoice = object({
     // Some providers use 'thinking' field in message
     think: string().optional(),
     // MiniMax uses 'think' field in message
-    function_call: object({ name: string(), arguments: string() }).nullable().optional()
+    function_call: object({ name: string(), arguments: string() }).nullable().optional(),
+    tool_calls: array(OpenAIToolCallSchema).optional()
   }).optional(),
   delta: OpenAIChoiceDelta.optional(),
   finish_reason: string().nullable()
@@ -1602,6 +1614,7 @@ const ProviderConfigSchema = object({
   openaiBaseUrl: string().optional(),
   authHeader: _enum(["bearer", "x-api-key"]).optional().default("bearer"),
   apiDocsUrl: string().optional(),
+  source: _enum(["company", "personal"]).optional(),
   createdAt: string(),
   updatedAt: string()
 });
@@ -1683,22 +1696,23 @@ function getProvider(id) {
 function normalizeApiKey(apiKey) {
   return apiKey.replace(/^Bearer\s+/i, "").trim();
 }
-function addProvider(name, apiKey, format, baseUrl, model, authHeader, apiDocsUrl) {
+function addProvider(name, apiKey, format, baseUrl, model, authHeader, apiDocsUrl, anthropicBaseUrl, openaiBaseUrl, source) {
   const providers = getProviders();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const newProvider = {
     id: randomUUID(),
     name,
     apiKey: normalizeApiKey(apiKey),
-    format,
+    format: format ?? (anthropicBaseUrl !== void 0 ? "anthropic" : openaiBaseUrl !== void 0 ? "openai" : void 0),
     baseUrl,
     model,
     authHeader: authHeader ?? "bearer",
     apiDocsUrl,
     createdAt: now,
     updatedAt: now,
-    anthropicBaseUrl: format === "anthropic" && baseUrl !== void 0 ? baseUrl : "",
-    openaiBaseUrl: format === "openai" && baseUrl !== void 0 ? baseUrl : ""
+    anthropicBaseUrl: anthropicBaseUrl ?? "",
+    openaiBaseUrl: openaiBaseUrl ?? "",
+    source
   };
   providers.push(newProvider);
   store.set("providers", providers);
@@ -1721,7 +1735,8 @@ function updateProvider(id, updates) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     // Handle format-specific URLs
     anthropicBaseUrl: updates.anthropicBaseUrl !== void 0 ? updates.anthropicBaseUrl : existing.anthropicBaseUrl,
-    openaiBaseUrl: updates.openaiBaseUrl !== void 0 ? updates.openaiBaseUrl : existing.openaiBaseUrl
+    openaiBaseUrl: updates.openaiBaseUrl !== void 0 ? updates.openaiBaseUrl : existing.openaiBaseUrl,
+    source: updates.source !== void 0 ? updates.source : existing.source
   };
   const index = providers.findIndex((p) => p.id === id);
   providers[index] = updated;
@@ -2056,7 +2071,7 @@ function isClaudeCodeBillingHeaderBlock(text) {
   const trimmed = text.trimStart();
   return trimmed.toLowerCase().startsWith(BILLING_HEADER_PREFIX);
 }
-function getOwnProperty(obj, key) {
+function getOwnProperty$1(obj, key) {
   const desc = Object.getOwnPropertyDescriptor(obj, key);
   return desc?.value;
 }
@@ -2066,8 +2081,8 @@ function isObjectWithSystem(value) {
 }
 function isBillingHeaderTextBlock(block) {
   if (block === null || typeof block !== "object" || Array.isArray(block)) return false;
-  const typeVal = getOwnProperty(block, "type");
-  const textVal = getOwnProperty(block, "text");
+  const typeVal = getOwnProperty$1(block, "type");
+  const textVal = getOwnProperty$1(block, "text");
   if (typeof typeVal !== "string" || typeVal !== "text") return false;
   if (typeof textVal !== "string") return false;
   return isClaudeCodeBillingHeaderBlock(textVal);
@@ -2105,6 +2120,82 @@ function stripClaudeCodeBillingHeader(rawBody) {
   }
   return { body: JSON.stringify(parsed), removed };
 }
+const ROLE_ASSISTANT = "assistant";
+const ROLE_TOOL = "tool";
+function getOwnProperty(obj, key) {
+  const desc = Object.getOwnPropertyDescriptor(obj, key);
+  return desc?.value;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isObjectWithMessages(value) {
+  if (!isPlainObject(value)) return false;
+  if (!Object.prototype.hasOwnProperty.call(value, "messages")) return false;
+  const messages = getOwnProperty(value, "messages");
+  return Array.isArray(messages);
+}
+function collectAssistantToolCallIds(message, into) {
+  const toolCalls = getOwnProperty(message, "tool_calls");
+  if (!Array.isArray(toolCalls)) return;
+  for (const tc of toolCalls) {
+    if (!isPlainObject(tc)) continue;
+    const id = getOwnProperty(tc, "id");
+    if (typeof id === "string" && id.length > 0) {
+      into.add(id);
+    }
+  }
+}
+function findOrphanToolMessageIndices(messages) {
+  const knownToolCallIds = /* @__PURE__ */ new Set();
+  const indices = [];
+  const orphanIds = [];
+  for (let i = 0; i < messages.length; i++) {
+    const msg = messages[i];
+    if (!isPlainObject(msg)) continue;
+    const role = getOwnProperty(msg, "role");
+    if (role === ROLE_ASSISTANT) {
+      collectAssistantToolCallIds(msg, knownToolCallIds);
+      continue;
+    }
+    if (role === ROLE_TOOL) {
+      const id = getOwnProperty(msg, "tool_call_id");
+      if (typeof id !== "string" || id.length === 0) {
+        indices.push(i);
+        orphanIds.push(null);
+        continue;
+      }
+      if (!knownToolCallIds.has(id)) {
+        indices.push(i);
+        orphanIds.push(id);
+      }
+    }
+  }
+  return { indices, orphanIds };
+}
+function stripOpenAIOrphanToolMessages(rawBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawBody);
+  } catch {
+    return { body: rawBody, removed: 0, orphanIds: [] };
+  }
+  if (!isObjectWithMessages(parsed)) {
+    return { body: rawBody, removed: 0, orphanIds: [] };
+  }
+  const messages = parsed.messages;
+  const { indices, orphanIds } = findOrphanToolMessageIndices(messages);
+  if (indices.length === 0) {
+    return { body: rawBody, removed: 0, orphanIds: [] };
+  }
+  const dropSet = new Set(indices);
+  const kept = [];
+  for (let i = 0; i < messages.length; i++) {
+    if (!dropSet.has(i)) kept.push(messages[i]);
+  }
+  parsed.messages = kept;
+  return { body: JSON.stringify(parsed), removed: indices.length, orphanIds };
+}
 function describeApiRoute(apiPath) {
   const endpointPath = apiPath.split("?")[0] ?? "";
   const isChatCompletions = endpointPath === PATH_CHAT_COMPLETIONS || endpointPath === PATH_V1_CHAT_COMPLETIONS;
@@ -2196,10 +2287,13 @@ function buildFileLogEntry(log, upstreamUrl) {
 }
 function parseRequestPath(req, url) {
   const route = describeApiRoute(getProxyApiPath(url));
-  const isMessages = req.method === "POST" && (route.endpointPath === PATH_V1_MESSAGES || route.isChatCompletions);
+  const isPost = req.method === "POST";
+  const isChatCompletions = isPost && route.isChatCompletions;
+  const isMessages = isPost && (route.endpointPath === PATH_V1_MESSAGES || route.isChatCompletions);
   return {
     apiPath: route.apiPath,
     isMessages,
+    isChatCompletions,
     normalizedPath: route.normalizedPath
   };
 }
@@ -2299,6 +2393,15 @@ async function handleProxy(req) {
       bodyToForward = stripped.body;
     }
   }
+  if (bodyToForward !== null && parsed.isChatCompletions) {
+    const stripped = stripOpenAIOrphanToolMessages(bodyToForward);
+    if (stripped.removed > 0) {
+      logger.warn(
+        `[handler] Dropped ${stripped.removed} orphan OpenAI tool message(s) with tool_call_id(s) ${JSON.stringify(stripped.orphanIds)} — the client sent a tool result with no matching assistant.tool_calls`
+      );
+      bodyToForward = stripped.body;
+    }
+  }
   const { model, sessionId } = extractRequestMetadata(requestBody, req.headers);
   const matchedProviderConfig = model !== null ? findProviderByModel(model) : null;
   const route = describeApiRoute(parsed.apiPath);
@@ -2372,7 +2475,7 @@ async function handleProxy(req) {
   }
   return handleStreamingResponse(upstreamRes, req, startTime, formatHandler, upstreamUrl, log);
 }
-const Route$f = createFileRoute("/proxy/$")({
+const Route$g = createFileRoute("/proxy/$")({
   server: {
     handlers: {
       GET: ({ request }) => handleProxy(request),
@@ -2384,7 +2487,7 @@ const Route$f = createFileRoute("/proxy/$")({
     }
   }
 });
-const Route$e = createFileRoute("/api/sessions")({
+const Route$f = createFileRoute("/api/sessions")({
   server: {
     handlers: {
       GET: () => Response.json(getSessions())
@@ -2394,14 +2497,15 @@ const Route$e = createFileRoute("/api/sessions")({
 const ProviderInputSchema = object({
   name: string().min(1, "Name is required"),
   apiKey: string().min(1, "API key is required"),
-  format: _enum(["anthropic", "openai"]),
+  format: _enum(["anthropic", "openai"]).optional(),
   anthropicBaseUrl: string().optional(),
   openaiBaseUrl: string().optional(),
   model: string().min(1, "Model is required"),
   authHeader: _enum(["bearer", "x-api-key"]).optional().default("bearer"),
-  apiDocsUrl: string().optional()
+  apiDocsUrl: string().optional(),
+  source: _enum(["company", "personal"]).optional()
 });
-const Route$d = createFileRoute("/api/providers")({
+const Route$e = createFileRoute("/api/providers")({
   server: {
     handlers: {
       GET: () => {
@@ -2416,23 +2520,542 @@ const Route$d = createFileRoute("/api/providers")({
           parsed.data.name,
           parsed.data.apiKey,
           parsed.data.format,
-          parsed.data.format === "anthropic" ? parsed.data.anthropicBaseUrl : parsed.data.openaiBaseUrl,
+          void 0,
+          // baseUrl (legacy) — use format-specific URLs instead
           parsed.data.model,
           parsed.data.authHeader,
-          parsed.data.apiDocsUrl
+          parsed.data.apiDocsUrl,
+          parsed.data.anthropicBaseUrl,
+          parsed.data.openaiBaseUrl,
+          parsed.data.source
         );
         return Response.json(newProvider, { status: 201 });
       }
     }
   }
 });
-const Route$c = createFileRoute("/api/models")({
+const Route$d = createFileRoute("/api/models")({
   server: {
     handlers: {
       GET: () => Response.json(getModels())
     }
   }
 });
+let overridePort = null;
+function setCurrentPort(port) {
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    throw new Error(`setCurrentPort: invalid port ${port}`);
+  }
+  overridePort = port;
+}
+function getCurrentPort() {
+  if (overridePort !== null) return overridePort;
+  const envPort = process.env["PORT"];
+  if (envPort !== void 0 && envPort !== "") {
+    const n = Number(envPort);
+    if (Number.isInteger(n) && n > 0 && n <= 65535) return n;
+  }
+  throw new Error(
+    "Inspector server port not initialized: PORT env var is unset and setCurrentPort() has not been called"
+  );
+}
+const DEFAULT_TIMEOUT_MS = 3e4;
+class LoopbackTimeoutError extends Error {
+  constructor(path2, timeoutMs) {
+    super(`Loopback call to ${path2} timed out after ${timeoutMs}ms`);
+    this.path = path2;
+    this.timeoutMs = timeoutMs;
+    this.name = "LoopbackTimeoutError";
+  }
+}
+async function callApi(path2, options = {}) {
+  if (!path2.startsWith("/")) {
+    throw new Error(`callApi: path must start with '/', got: ${path2}`);
+  }
+  const port = getCurrentPort();
+  const url = `http://127.0.0.1:${port}${path2}`;
+  const { timeoutMs = DEFAULT_TIMEOUT_MS, signal: userSignal, ...rest } = options;
+  const controller = new AbortController();
+  const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
+  if (userSignal !== void 0 && userSignal !== null) {
+    if (userSignal.aborted) {
+      controller.abort();
+    } else {
+      userSignal.addEventListener("abort", () => controller.abort(), { once: true });
+    }
+  }
+  try {
+    return await fetch(url, { ...rest, signal: controller.signal });
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new LoopbackTimeoutError(path2, timeoutMs);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timeoutHandle);
+  }
+}
+const PREVIEW_MAX_CHARS = 500;
+function truncate(text) {
+  return text.length <= PREVIEW_MAX_CHARS ? text : text.slice(0, PREVIEW_MAX_CHARS);
+}
+function firstAnthropicText(content) {
+  if (typeof content === "string") {
+    return content.length > 0 ? content : null;
+  }
+  for (const block of content) {
+    if (block.type === "text" && typeof block.text === "string" && block.text.length > 0) {
+      return block.text;
+    }
+  }
+  return null;
+}
+function firstOpenAIText(content) {
+  if (content === null || content === void 0) return null;
+  if (typeof content === "string") {
+    return content.length > 0 ? content : null;
+  }
+  for (const part of content) {
+    if (part.type === "text" && typeof part.text === "string" && part.text.length > 0) {
+      return part.text;
+    }
+  }
+  return null;
+}
+function extractLastUserMessagePreview(log) {
+  if (log.apiFormat === "unknown") return null;
+  if (log.rawRequestBody === null) return null;
+  let json;
+  try {
+    json = JSON.parse(log.rawRequestBody);
+  } catch {
+    return null;
+  }
+  if (log.apiFormat === "anthropic") {
+    const parsed = AnthropicRequestSchema.safeParse(json);
+    if (!parsed.success) return null;
+    for (let i = parsed.data.messages.length - 1; i >= 0; i--) {
+      const msg = parsed.data.messages[i];
+      if (msg && msg.role === "user") {
+        const text = firstAnthropicText(msg.content);
+        return text === null ? null : truncate(text);
+      }
+    }
+    return null;
+  }
+  if (log.apiFormat === "openai") {
+    const parsed = OpenAIRequestSchema.safeParse(json);
+    if (!parsed.success) return null;
+    for (let i = parsed.data.messages.length - 1; i >= 0; i--) {
+      const msg = parsed.data.messages[i];
+      if (msg && msg.role === "user") {
+        const text = firstOpenAIText(msg.content);
+        return text === null ? null : truncate(text);
+      }
+    }
+    return null;
+  }
+  return null;
+}
+function extractResponsePreview(log) {
+  if (log.apiFormat === "unknown") return null;
+  if (log.responseText === null) return null;
+  let json;
+  try {
+    json = JSON.parse(log.responseText);
+  } catch {
+    return null;
+  }
+  if (log.apiFormat === "anthropic") {
+    const parsed = AnthropicResponseSchema$1.safeParse(json);
+    if (!parsed.success) return null;
+    for (const block of parsed.data.content) {
+      if (block.type === "text" && typeof block.text === "string" && block.text.length > 0) {
+        return truncate(block.text);
+      }
+    }
+    return null;
+  }
+  if (log.apiFormat === "openai") {
+    const parsed = OpenAIResponseSchema$1.safeParse(json);
+    if (!parsed.success) return null;
+    for (const choice of parsed.data.choices) {
+      const msg = choice.message;
+      if (!msg) continue;
+      const direct = firstOpenAIText(msg.content);
+      if (direct !== null) return truncate(direct);
+      const fallback = msg.reasoning_content ?? msg.thinking ?? msg.think;
+      if (typeof fallback === "string" && fallback.length > 0) return truncate(fallback);
+    }
+    return null;
+  }
+  return null;
+}
+const LogsListResponseSchema = object({
+  logs: array(CapturedLogSchema).optional(),
+  total: number().optional(),
+  offset: number().optional(),
+  limit: number().optional()
+});
+const PAGINATION_DEFAULTS = { offset: 0, limit: 3 };
+const LIMIT_HARD_CAP = 5;
+function clampLimit(input) {
+  if (input === void 0) return PAGINATION_DEFAULTS.limit;
+  if (!Number.isFinite(input) || input < 1) return 1;
+  return Math.min(Math.floor(input), LIMIT_HARD_CAP);
+}
+function textJson(data) {
+  return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+}
+function toolError(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function buildLogSummary(log) {
+  const hasError = log.error !== null && log.error !== void 0 && log.error.length > 0 || log.responseStatus !== null && log.responseStatus !== void 0 && log.responseStatus >= 400;
+  return {
+    id: log.id,
+    timestamp: log.timestamp,
+    provider: log.providerName ?? null,
+    model: log.model,
+    apiFormat: log.apiFormat,
+    method: log.method,
+    path: log.path,
+    status: log.responseStatus,
+    isStreaming: log.streaming,
+    hasError,
+    latencyMs: log.elapsedMs,
+    tokens: {
+      input: log.inputTokens,
+      output: log.outputTokens,
+      cacheCreate: log.cacheCreationInputTokens,
+      cacheRead: log.cacheReadInputTokens
+    },
+    sessionId: log.sessionId,
+    clientPid: log.clientPid ?? null,
+    lastUserMessagePreview: extractLastUserMessagePreview(log),
+    responsePreview: extractResponsePreview(log),
+    hasChunks: log.streamingChunks !== void 0 && log.streamingChunks !== null || log.streamingChunksPath !== null && log.streamingChunksPath !== void 0,
+    hasRawRequestBody: log.rawRequestBody !== null && log.rawRequestBody !== void 0
+  };
+}
+async function listLogsImpl(callApi2, args) {
+  const offset = args.offset ?? PAGINATION_DEFAULTS.offset;
+  const limit = clampLimit(args.limit);
+  const params = new URLSearchParams({ offset: String(offset), limit: String(limit) });
+  if (args.sessionId !== void 0 && args.sessionId.length > 0) {
+    params.set("sessionId", args.sessionId);
+  }
+  if (args.model !== void 0 && args.model.length > 0) {
+    params.set("model", args.model);
+  }
+  const res = await callApi2(`/api/logs?${params.toString()}`);
+  if (!res.ok) return toolError(`GET /api/logs returned ${res.status}`);
+  const rawBody = await res.json();
+  const parsed = LogsListResponseSchema.safeParse(rawBody);
+  if (!parsed.success) return toolError("GET /api/logs returned an unparseable shape");
+  const logs = parsed.data.logs ?? [];
+  return textJson(logs.map(buildLogSummary));
+}
+async function getLogImpl(callApi2, id) {
+  const res = await callApi2(`/api/logs/${id}`);
+  if (!res.ok) return toolError(`GET /api/logs/${id} returned ${res.status}`);
+  const rawBody = await res.json();
+  const parsed = CapturedLogSchema.safeParse(rawBody);
+  if (!parsed.success) {
+    return toolError(`GET /api/logs/${id} returned an unparseable CapturedLog`);
+  }
+  const { streamingChunks: _chunks, ...rest } = parsed.data;
+  return textJson(rest);
+}
+async function getLogChunksImpl(callApi2, id) {
+  const res = await callApi2(`/api/logs/${id}/chunks`);
+  if (!res.ok) return toolError(`GET /api/logs/${id}/chunks returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function listSessionsImpl(callApi2) {
+  const res = await callApi2("/api/sessions");
+  if (!res.ok) return toolError(`GET /api/sessions returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function listModelsImpl(callApi2) {
+  const res = await callApi2("/api/models");
+  if (!res.ok) return toolError(`GET /api/models returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function listProvidersImpl(callApi2) {
+  const res = await callApi2("/api/providers");
+  if (!res.ok) return toolError(`GET /api/providers returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function getProviderImpl(callApi2, id) {
+  const res = await callApi2(`/api/providers/${encodeURIComponent(id)}`);
+  if (!res.ok) return toolError(`GET /api/providers/${id} returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function replayLogImpl(callApi2, args) {
+  const logRes = await callApi2(`/api/logs/${args.id}`);
+  if (!logRes.ok) return toolError(`GET /api/logs/${args.id} returned ${logRes.status}`);
+  const logRaw = await logRes.json();
+  const logParsed = CapturedLogSchema.safeParse(logRaw);
+  if (!logParsed.success) {
+    return toolError(`GET /api/logs/${args.id} returned an unparseable CapturedLog`);
+  }
+  const log = logParsed.data;
+  if (log.rawRequestBody === null) return toolError("Log has no rawRequestBody to replay");
+  const replayRes = await callApi2(`/api/logs/${args.id}/replay`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ modifiedBody: log.rawRequestBody })
+  });
+  if (!replayRes.ok) {
+    return toolError(`POST /api/logs/${args.id}/replay returned ${replayRes.status}`);
+  }
+  return textJson(await replayRes.json());
+}
+async function addProviderImpl(callApi2, provider) {
+  const res = await callApi2("/api/providers", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(provider)
+  });
+  if (!res.ok) return toolError(`POST /api/providers returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function updateProviderImpl(callApi2, input) {
+  const { id, ...patch } = input;
+  const res = await callApi2(`/api/providers/${encodeURIComponent(id)}`, {
+    method: "PUT",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(patch)
+  });
+  if (!res.ok) return toolError(`PUT /api/providers/${id} returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function testProviderImpl(callApi2, id) {
+  const res = await callApi2(`/api/providers/${encodeURIComponent(id)}/test`, {
+    method: "POST"
+  });
+  if (!res.ok) return toolError(`POST /api/providers/${id}/test returned ${res.status}`);
+  return textJson(await res.json());
+}
+async function safeCall(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    if (err instanceof LoopbackTimeoutError) {
+      return toolError(`Internal loopback call timed out after ${err.timeoutMs}ms: ${err.path}`);
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return toolError(`Tool execution failed: ${message}`);
+  }
+}
+let initialized = null;
+let initPromise = null;
+function buildServer() {
+  const server = new McpServer(
+    { name: "llm-inspector", version: "1.0.0" },
+    { capabilities: { tools: {} } }
+  );
+  registerTools(server);
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    sessionIdGenerator: void 0
+    // stateless — see module docstring
+  });
+  void server.connect(transport);
+  return { server, transport };
+}
+async function getServer() {
+  if (initialized !== null) return initialized;
+  if (initPromise === null) {
+    initPromise = Promise.resolve(buildServer()).then((pair) => {
+      initialized = pair;
+      return pair;
+    });
+  }
+  return initPromise;
+}
+async function handleMcpRequest(request) {
+  try {
+    const url = new URL(request.url);
+    const port = Number(url.port);
+    if (port > 0) setCurrentPort(port);
+  } catch {
+  }
+  const { transport } = await getServer();
+  return transport.handleRequest(request);
+}
+const TOOL_LIST_LOGS_DESC = `List recent captured LLM proxy logs in reverse-chronological order with parsed previews. Useful for "what did I just send?" discovery.
+
+REFLEXIVE-LOOP WARNING: this list includes the agent's own recent /proxy calls. If results appear to be the agent's own tool calls (e.g., the agent called inspector_list_logs and now sees itself in the results), filter by clientPid (your own PID) or by timestamp on the client side.
+
+Parameters:
+  - offset (number, default 0): skip this many entries from the start of the filtered list
+  - limit (number, default 3, hard-clamped to 5): how many summaries to return
+  - sessionId (string, optional): filter by session/affinity id
+  - model (string, optional): filter by model name
+
+Returns: array of "thick summary" objects, each containing:
+  - id, timestamp, provider, model, apiFormat, method, path, status, isStreaming,
+    hasError, latencyMs, tokens { input, output, cacheCreate, cacheRead },
+    sessionId, clientPid,
+  - lastUserMessagePreview (string|null, ≤500 chars) — first text block of the last user message, parsed via the format-specific schema (NOT a raw body slice)
+  - responsePreview (string|null, ≤500 chars) — first text block of the assistant response
+  - hasChunks, hasRawRequestBody (booleans)
+
+Either preview field is null when the body is unknown format, unparseable, or the relevant content is non-text (e.g., image-only).`;
+const PROVIDER_WRITE_WARNING = "⚠ This tool mutates provider configuration. Confirm with the user before invoking.";
+function registerTools(server) {
+  server.registerTool(
+    "inspector_list_logs",
+    {
+      title: "List captured LLM logs",
+      description: TOOL_LIST_LOGS_DESC,
+      inputSchema: object({
+        offset: number().int().nonnegative().optional().describe("Skip this many entries."),
+        limit: number().int().positive().optional().describe("How many summaries to return. Hard-capped at 5."),
+        sessionId: string().optional().describe("Filter by session/affinity id."),
+        model: string().optional().describe("Filter by model name.")
+      })
+    },
+    (args) => safeCall(() => listLogsImpl(callApi, args))
+  );
+  server.registerTool(
+    "inspector_get_log",
+    {
+      title: "Get a single captured log by id",
+      description: "Returns the full CapturedLog for the given id, including rawRequestBody and responseText with no truncation. SSE streaming chunks are NOT included — use inspector_get_log_chunks for those. Returns an error if the id does not exist.",
+      inputSchema: object({
+        id: number().int().positive().describe("The log id.")
+      })
+    },
+    ({ id }) => safeCall(() => getLogImpl(callApi, id))
+  );
+  server.registerTool(
+    "inspector_get_log_chunks",
+    {
+      title: "Get SSE streaming chunks for a captured log",
+      description: "Returns the SSE chunks array for a streaming log, in the order they were received. Returns an error if the log has no chunks (i.e. was non-streaming or the log id is unknown).",
+      inputSchema: object({
+        id: number().int().positive().describe("The log id.")
+      })
+    },
+    ({ id }) => safeCall(() => getLogChunksImpl(callApi, id))
+  );
+  server.registerTool(
+    "inspector_list_sessions",
+    {
+      title: "List known session ids",
+      description: "Returns the array of session ids that have been observed in captured logs. Useful for discovering what sessionId values to pass to inspector_list_logs.",
+      inputSchema: object({})
+    },
+    () => safeCall(() => listSessionsImpl(callApi))
+  );
+  server.registerTool(
+    "inspector_list_models",
+    {
+      title: "List distinct model names seen in captured logs",
+      description: "Returns the array of distinct model names observed across all captured logs.",
+      inputSchema: object({})
+    },
+    () => safeCall(() => listModelsImpl(callApi))
+  );
+  server.registerTool(
+    "inspector_list_providers",
+    {
+      title: "List configured LLM providers",
+      description: "Returns the full ProviderConfig array, including apiKey in PLAINTEXT. MCP is localhost-only — any process that can call /api/mcp can also read <dataDir>/providers.json directly, so the apiKey is not redacted. Do not expose this MCP server to non-trusted local processes.",
+      inputSchema: object({})
+    },
+    () => safeCall(() => listProvidersImpl(callApi))
+  );
+  server.registerTool(
+    "inspector_get_provider",
+    {
+      title: "Get a single provider by id",
+      description: "Returns the full ProviderConfig for the given id, including apiKey in PLAINTEXT (same posture as inspector_list_providers).",
+      inputSchema: object({
+        id: string().describe("The provider id.")
+      })
+    },
+    ({ id }) => safeCall(() => getProviderImpl(callApi, id))
+  );
+  server.registerTool(
+    "inspector_replay_log",
+    {
+      title: "Replay a captured log against its provider",
+      description: "Re-sends the captured request body to the upstream LLM and returns the response summary: success flag, status, responseText, input/output token counts, elapsedMs, and whether the response was streaming. Useful for re-running a request after a fix or a transient failure. Returns an error if the log id is unknown or the upstream call fails.",
+      inputSchema: object({
+        id: number().int().positive().describe("The log id to replay.")
+      })
+    },
+    (args) => safeCall(() => replayLogImpl(callApi, args))
+  );
+  server.registerTool(
+    "inspector_add_provider",
+    {
+      title: "Add a new LLM provider",
+      description: `${PROVIDER_WRITE_WARNING}
+
+Persists a new provider to <dataDir>/providers.json. Required fields: name, apiKey, format (anthropic|openai), model. Optional: baseUrl, authHeader (default: bearer), apiDocsUrl.`,
+      inputSchema: object({
+        name: string().min(1),
+        apiKey: string().min(1),
+        format: _enum(["anthropic", "openai"]),
+        model: string().min(1),
+        anthropicBaseUrl: string().optional(),
+        openaiBaseUrl: string().optional(),
+        authHeader: _enum(["bearer", "x-api-key"]).optional(),
+        apiDocsUrl: string().optional()
+      })
+    },
+    (provider) => safeCall(() => addProviderImpl(callApi, provider))
+  );
+  server.registerTool(
+    "inspector_update_provider",
+    {
+      title: "Update an existing provider",
+      description: `${PROVIDER_WRITE_WARNING} Updating with nonsense values effectively soft-deletes a provider. Confirm with the user before invoking.
+
+PATCH-style update: only the fields you supply are changed. Returns the updated ProviderConfig.`,
+      inputSchema: object({
+        id: string().describe("The provider id to update."),
+        name: string().min(1).optional(),
+        apiKey: string().min(1).optional(),
+        format: _enum(["anthropic", "openai"]).optional(),
+        model: string().min(1).optional(),
+        baseUrl: string().min(1).optional(),
+        authHeader: _enum(["bearer", "x-api-key"]).optional(),
+        anthropicBaseUrl: string().optional(),
+        openaiBaseUrl: string().optional(),
+        apiDocsUrl: string().optional()
+      })
+    },
+    (input) => safeCall(() => updateProviderImpl(callApi, input))
+  );
+  server.registerTool(
+    "inspector_test_provider",
+    {
+      title: "Test a provider's connectivity",
+      description: "Runs the same connectivity test the UI's 'Test' button does, against both Anthropic and OpenAI endpoints if configured. Returns the per-endpoint success/failure result. Returns an error if the provider id is unknown.",
+      inputSchema: object({
+        id: string().describe("The provider id to test.")
+      })
+    },
+    ({ id }) => safeCall(() => testProviderImpl(callApi, id))
+  );
+}
+const Route$c = createFileRoute("/api/mcp")({
+  server: {
+    handlers: {
+      // The SDK may issue either POST, GET, or DELETE. TanStack Start only
+      // requires us to declare the methods we accept; routing by method is
+      // handled inside the transport.
+      POST: ({ request }) => handleMcpRequest(request),
+      GET: ({ request }) => handleMcpRequest(request),
+      DELETE: ({ request }) => handleMcpRequest(request)
+    }
+  }
+});
 const Route$b = createFileRoute("/api/logs")({
   server: {
     handlers: {
@@ -2563,7 +3186,8 @@ const ProviderUpdateSchema = object({
   authHeader: _enum(["bearer", "x-api-key"]).optional(),
   anthropicBaseUrl: string().optional(),
   openaiBaseUrl: string().optional(),
-  apiDocsUrl: string().optional()
+  apiDocsUrl: string().optional(),
+  source: _enum(["company", "personal"]).optional()
 });
 const Route$6 = createFileRoute("/api/providers/$providerId")({
   server: {
@@ -3472,45 +4096,50 @@ const Route = createFileRoute("/api/logs/$id/chunks")({
     }
   }
 });
-const IndexRoute = Route$g.update({
+const IndexRoute = Route$h.update({
   id: "/",
   path: "/",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
 });
-const ProxySplatRoute = Route$f.update({
+const ProxySplatRoute = Route$g.update({
   id: "/proxy/$",
   path: "/proxy/$",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
 });
-const ApiSessionsRoute = Route$e.update({
+const ApiSessionsRoute = Route$f.update({
   id: "/api/sessions",
   path: "/api/sessions",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
 });
-const ApiProvidersRoute = Route$d.update({
+const ApiProvidersRoute = Route$e.update({
   id: "/api/providers",
   path: "/api/providers",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
 });
-const ApiModelsRoute = Route$c.update({
+const ApiModelsRoute = Route$d.update({
   id: "/api/models",
   path: "/api/models",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
+});
+const ApiMcpRoute = Route$c.update({
+  id: "/api/mcp",
+  path: "/api/mcp",
+  getParentRoute: () => Route$i
 });
 const ApiLogsRoute = Route$b.update({
   id: "/api/logs",
   path: "/api/logs",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
 });
 const ApiHealthRoute = Route$a.update({
   id: "/api/health",
   path: "/api/health",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
 });
 const ApiConfigRoute = Route$9.update({
   id: "/api/config",
   path: "/api/config",
-  getParentRoute: () => Route$h
+  getParentRoute: () => Route$i
 });
 const ApiProvidersImportRoute = Route$8.update({
   id: "/import",
@@ -3594,12 +4223,13 @@ const rootRouteChildren = {
   ApiConfigRoute: ApiConfigRouteWithChildren,
   ApiHealthRoute,
   ApiLogsRoute: ApiLogsRouteWithChildren,
+  ApiMcpRoute,
   ApiModelsRoute,
   ApiProvidersRoute: ApiProvidersRouteWithChildren,
   ApiSessionsRoute,
   ProxySplatRoute
 };
-const routeTree = Route$h._addFileChildren(rootRouteChildren)._addFileTypes();
+const routeTree = Route$i._addFileChildren(rootRouteChildren)._addFileTypes();
 function getRouter() {
   const router2 = createRouter({
     routeTree,