SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') (#1624)

Migrate all three clients + core + test-servers from
@modelcontextprotocol/sdk@1.29 to SDK v2 (2.0.0-beta.4), keeping behavior
identical against legacy (2025-11-25) servers. Foundation for the SDK V2 +
New Spec stack.

Packages
- Split @modelcontextprotocol/sdk -> @modelcontextprotocol/client (Client,
  transports, OAuth, error taxonomy, protocol types) + core (Zod schemas);
  stdio -> client/stdio, Ajv -> client/validators/ajv. Test-servers ->
  @modelcontextprotocol/server (+ server-legacy/sse). Deterministic import
  rewrite (schemas -> core, everything else -> client); the codemod misroutes
  client code to /server so it was not used for path routing.
- new Client(..., { versionNegotiation: { mode: 'legacy' } }) — nothing
  2026-era goes on the wire.

Runtime (core/mcp/inspectorClient.ts)
- Error taxonomy: McpError -> ProtocolError, ErrorCode -> ProtocolErrorCode;
  RequestTimeout -> SdkError/SdkErrorCode.
- Handlers take method strings; task methods (tasks/*, notifications/tasks/*)
  use the 3-arg custom form (excluded from v2's spec-method set).
- Legacy tasks kept working (per project requirement): requestor tasks re-
  implemented over raw client.request + explicit deprecated schemas;
  experimental.tasks.callToolStream replaced by a local pollTaskToolCall
  async generator (with _progressHandlers revival so task-execution progress
  still reaches the caller). Receiver (server-initiated) tasks: the v2 Client
  validates a sampling/elicit handler result and rejects the legacy { task }
  response with -32602 — installReceiverTaskResponseBypass swaps the wrapped
  entry in the private _requestHandlers map for the task-augmented branch so
  { task } reaches the wire (fixes server-initiated sampling-via-task).
- Pagination: list verbs use raw client.request({method}, List*ResultSchema)
  for single-page behavior (v2's client.listX() auto-aggregate all pages).

Web / auth / apps
- Rename local JsonSchemaType -> InspectorFormSchema + add toFormSchema()
  structural narrowing at the SDK-schema -> form boundary.
- ext-apps still peers on SDK v1: one compat boundary with documented casts
  (remove when ext-apps#702 lands a v2 peer).
- OAuth provider saveClientInformation reconciled with v2's
  OAuthClientInformationContext; InvalidClientMetadataError re-homed as a
  local class (server-legacy/auth is not browser-safe).
- vitest.shared.mts dedupes @modelcontextprotocol/client+core to one copy so
  vi.mock intercepts the SUT's import.

Accepted v2 behavior changes (per #1624 / spec §9.2): unknown-tool call
rejects with -32602; cancellation is stream-abort (no guaranteed
notifications/cancelled frame); output-schema strictness restored via the
Inspector's own Ajv check on the default path.

npm run ci green: validate (web 3087 / cli 212 / tui 274 / launcher 5),
coverage (>=90 per-file, all clients), smoke (launcher/cli/web), storybook
(410).

Closes #1624

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/web/src/test/integration/mcp/inspectorClient-coverage-backfill.test.ts

@@ -23,8 +23,8 @@ import {
   createNumberedResources,
   createNumberedPrompts,
 } from "@modelcontextprotocol/inspector-test-server";
-import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+import type { Tool } from "@modelcontextprotocol/client";
+import { ProtocolError, ProtocolErrorCode } from "@modelcontextprotocol/client";
 
 const serverCommand = getTestMcpServerCommand();
 
@@ -184,7 +184,10 @@ describe("InspectorClient coverage backfill", () => {
       };
       const original = c.client.complete;
       c.client.complete = async () => {
-        throw new McpError(ErrorCode.MethodNotFound, "Method not found");
+        throw new ProtocolError(
+          ProtocolErrorCode.MethodNotFound,
+          "Method not found",
+        );
       };
       try {
         await expect(
@@ -591,11 +594,13 @@ describe("InspectorClient coverage backfill", () => {
       client = stdioClient();
       await client.connect();
       // Force the streaming API to throw synchronously so the error-path
-      // metadata-merge branches run for each combination.
+      // metadata-merge branches run for each combination. `callToolStream`
+      // drives tasks via the private `pollTaskToolCall` generator (SDK v2
+      // removed `client.experimental.tasks`), so patch that instead.
       const c = client as unknown as {
-        client: { experimental: { tasks: { callToolStream: () => never } } };
+        pollTaskToolCall: () => never;
       };
-      c.client.experimental.tasks.callToolStream = () => {
+      c.pollTaskToolCall = () => {
         throw new Error("forced-stream-failure");
       };
 
@@ -747,9 +752,9 @@ describe("InspectorClient coverage backfill", () => {
       await client.connect();
       const echo = await getTool(client, "echo");
       const c = client as unknown as {
-        client: { experimental: { tasks: { callToolStream: () => never } } };
+        pollTaskToolCall: () => never;
       };
-      c.client.experimental.tasks.callToolStream = () => {
+      c.pollTaskToolCall = () => {
         throw "string-stream-failure";
       };
       await expect(
@@ -761,18 +766,12 @@ describe("InspectorClient coverage backfill", () => {
       client = stdioClient();
       await client.connect();
       const c = client as unknown as {
-        client: {
-          listResources: () => Promise<unknown>;
-          listResourceTemplates: () => Promise<unknown>;
-          listPrompts: () => Promise<unknown>;
-          listTools: () => Promise<unknown>;
-        };
+        client: { request: () => Promise<unknown> };
       };
-      // Return responses missing the array field → `|| []` fallback branches.
-      c.client.listResources = async () => ({});
-      c.client.listResourceTemplates = async () => ({});
-      c.client.listPrompts = async () => ({});
-      c.client.listTools = async () => ({});
+      // InspectorClient's list methods issue raw `client.request({method:"…/list"})`
+      // (SDK v2's `client.listX()` auto-aggregate pages), so mock `request` to
+      // return a body missing the array field → `|| []` fallback branches.
+      c.client.request = async () => ({});
 
       expect((await client.listResources()).resources).toEqual([]);
       expect((await client.listResourceTemplates()).resourceTemplates).toEqual(
@@ -800,19 +799,26 @@ describe("InspectorClient coverage backfill", () => {
       gen: () => AsyncGenerator<unknown>,
       getTaskResult?: () => Promise<unknown>,
     ): void {
+      // SDK v2 removed `client.experimental.tasks`; `callToolStream` now drives
+      // tasks via the private `pollTaskToolCall` generator, and the no-result
+      // fallback fetches the payload with a raw `client.request({method:"tasks/result"})`.
       const internal = c as unknown as {
+        pollTaskToolCall: () => AsyncGenerator<unknown>;
         client: {
-          experimental: {
-            tasks: {
-              callToolStream: () => AsyncGenerator<unknown>;
-              getTaskResult: (id: string) => Promise<unknown>;
-            };
-          };
+          request: (
+            req: { method: string },
+            schema: unknown,
+            opts: unknown,
+          ) => Promise<unknown>;
         };
       };
-      internal.client.experimental.tasks.callToolStream = gen;
+      internal.pollTaskToolCall = gen;
       if (getTaskResult) {
-        internal.client.experimental.tasks.getTaskResult = getTaskResult;
+        const origRequest = internal.client.request.bind(internal.client);
+        internal.client.request = (req, schema, opts) =>
+          req.method === "tasks/result"
+            ? getTaskResult()
+            : origRequest(req, schema, opts);
       }
     }