feat(web): add per-server Roots config + client roots capability (#1425) (#1431)

* feat(web): add per-server Roots config + client roots capability (#1425)

Add MCP roots support to the v2 web Inspector as a per-server config
section in the server settings form (no separate Roots tab/screen).

- Persistence: add `roots: Root[]` to `InspectorServerSettings` and
  `StoredMCPServer`; thread through serverList converters (lift on read,
  drop empty-uri rows / blank names on write, omit when empty) and the
  remote server's read-side drop guard + `validateSettings`.
- Capability: `setupClientForServer` always advertises the roots
  capability (`roots: cleanRoots(savedSettings?.roots ?? [])`) so the
  server can issue `roots/list` and receive `roots/list_changed`.
- Live apply: edits to a connected server's roots are pushed via
  `inspectorClient.setRoots(...)` once, on settings-dialog close — diffed
  against the client's current roots — rather than per keystroke, to
  avoid flooding the server with `roots/list_changed` / `roots/list`.
- Form: new Roots accordion section with a required URI and an optional
  name per row (unlike v1, which was URI-only), + Add Root, and remove.

Tests cover the persistence round-trip (serverList + servers-route),
the form/modal section, and reuse the existing InspectorClient
roots/`setRoots` integration coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(roots): address review — dedup guards/cleanRoots, preserve extra fields, test live-apply

Responding to the PR #1431 code review:

- Dedup `isRootArray`: drop the copy inside `validateSettings` and reuse the
  module-scope guard the read path uses, so the two can't drift
  (core/mcp/remote/node/server.ts).
- Dedup the clean-roots normalizer: hoist a single exported `cleanRoots`
  into core/mcp/serverList.ts and reuse it from both
  `inspectorSettingsToStoredFields` and App.tsx (drops the local copy).
- Preserve non-form root fields (e.g. `_meta`): `cleanRoots` now spreads the
  carried-through fields and only normalizes uri/name, and the modal's
  `handleRootChange` spreads the existing root on edit — so a hand-edited
  root's `_meta` survives load + persist + edit instead of being silently
  dropped.
- Test the App live-apply-on-close path: new App.test.tsx cases assert
  setRoots is called once with cleaned roots when changed on the active
  server, and not called when the cleaned roots already match what the
  client advertises. Adds a cleanRoots unit test (blank drop + _meta
  preserve).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/mcp/remote/node/server.ts

@@ -870,6 +870,21 @@ export function createRemoteApp(
     }
     return true;
   };
+  // A roots array: each entry must have a string `uri` and, when present, a
+  // string `name` (SDK `Root`). Other keys (e.g. `_meta`) pass through — we
+  // only gate the two fields the Inspector reads/writes.
+  const isRootArray = (
+    v: unknown,
+  ): v is { uri: string; name?: string }[] => {
+    if (!Array.isArray(v)) return false;
+    return v.every((e) => {
+      if (e === null || typeof e !== "object") return false;
+      const o = e as Record<string, unknown>;
+      if (typeof o.uri !== "string") return false;
+      if (o.name !== undefined && typeof o.name !== "string") return false;
+      return true;
+    });
+  };
   // `Number.isFinite` rejects `Infinity` and `NaN` as well as non-numbers,
   // matching the write-side semantics in `validateSettings`. A hand-edited
   // file with `connectionTimeout: Infinity` would otherwise pass the guard
@@ -954,6 +969,13 @@ export function createRemoteApp(
         );
         delete valObj.oauth;
       }
+      if ("roots" in valObj && !isRootArray(valObj.roots)) {
+        logWarn(
+          { route: "/api/servers", id, droppedKey: "roots" },
+          "Dropping malformed `roots` field — expected `Array<{ uri: string, name?: string }>`.",
+        );
+        delete valObj.roots;
+      }
 
       out[id] = normalizeServerType(
         valObj as Record<string, unknown> & { type?: string },
@@ -1096,6 +1118,16 @@ export function createRemoteApp(
         return { ok: false, error: `settings.${optional} must be a string` };
       }
     }
+    // roots is optional on the wire (older clients won't send it); when
+    // present it must be an array of `{ uri, name? }`. Reuses the same
+    // module-scope `isRootArray` guard the read path applies in
+    // `normalizeMcpServers`, so the two paths can't drift.
+    if (obj.roots !== undefined && !isRootArray(obj.roots)) {
+      return {
+        ok: false,
+        error: "settings.roots must be an array of { uri, name? }",
+      };
+    }
     // Build the validated value from explicitly named fields rather than
     // casting the raw object through. Unknown keys silently drop so a
     // misconfigured client can't smuggle stowaways onto disk, and consumers
@@ -1114,6 +1146,11 @@ export function createRemoteApp(
       // to disk for a client that didn't send one.
       taskTtl:
         typeof obj.taskTtl === "number" ? obj.taskTtl : DEFAULT_TASK_TTL_MS,
+      // Absent → empty list, matching the read side
+      // (storedFieldsToInspectorSettings). Empty rows are dropped on the way
+      // to disk by inspectorSettingsToStoredFields, so an empty array here
+      // writes no spurious `roots` field.
+      roots: isRootArray(obj.roots) ? obj.roots : [],
     };
     if (typeof obj.oauthClientId === "string" && obj.oauthClientId !== "") {
       value.oauthClientId = obj.oauthClientId;