feat: allow complex JSON values in request _meta

Closes #1910

`_meta` was typed `Record<string, string>` end to end in the Inspector —
on disk as a `{ key, value }[]` pair array, in the Server Settings form as
key/value rows, and in every request verb's per-call metadata parameter.
Nothing in the MCP spec restricts a `_meta` value to a string, and the SDK
models the field as a `z.looseObject`, so the restriction was ours alone.

Widen the whole path to `RequestMetadata` (`Record<string, JsonValue>`):

- Per-server default metadata is a JSON **object** on disk and in memory.
  The pre-#1910 pair array is still read (`normalizeStoredMetadata`) so an
  existing `mcp.json` keeps working; it is never written back, so a save
  migrates the entry.
- The Server Settings → Request Metadata section is a JSON editor
  (`JsonObjectInput`) instead of key/value rows — rows cannot express an
  object value. It keeps the typed text as the display source and emits
  only parsed JSON, the same draft split `SchemaJsonField` uses, so the box
  stays typeable; invalid text is flagged inline and not applied.
- The CLI stops flattening `--metadata` / `--tool-metadata` through
  `metaValueToString`. Those values were already JSON-parsed, so
  `trace={"id":"abc"}` used to reach the wire as the *string* `{"id":"abc"}`
  and now reaches it as an object.
- `servers/show` redaction replaces a sensitive key's whole value rather
  than a string, so a structured value cannot leak through its members.
- `progressTokenOf` narrows the reserved `progressToken` key back to
  `string | number` before it reaches the SDK; any other JSON still travels
  inside `_meta` but wires up no progress callback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/cli/__tests__/helpers/oauth-test-fakes.ts

@@ -63,7 +63,7 @@ export function makeFakeServerSettings(
 ): InspectorServerSettings {
   return {
     headers: [],
-    metadata: [],
+    metadata: {},
     env: [],
     connectionTimeout: 0,
     requestTimeout: 0,

clients/cli/__tests__/metadata.test.ts

@@ -373,16 +373,17 @@ describe("Metadata Tests", () => {
 
         expectCliSuccess(result);
 
-        // Validate metadata values are sent as strings
+        // A JSON-parseable value goes out as that JSON type, not as its
+        // string spelling (#1910) — `_meta` takes any JSON.
         const recordedRequests = server.getRecordedRequests();
         const toolsListRequest = recordedRequests.find(
           (r) => r.method === "tools/list",
         );
         expect(toolsListRequest).toBeDefined();
         expect(toolsListRequest?.metadata).toEqual({
-          integer_value: "42",
-          decimal_value: "3.14159",
-          negative_value: "-10",
+          integer_value: 42,
+          decimal_value: 3.14159,
+          negative_value: -10,
         });
       } finally {
         await server.stop();
@@ -428,7 +429,7 @@ describe("Metadata Tests", () => {
       }
     });
 
-    it("JSON.stringifies object/array metadata (not String → [object Object])", async () => {
+    it("sends object/array/boolean metadata as real JSON, not stringified (#1910)", async () => {
       const server = createTestServerHttp({
         serverInfo: createTestServerInfo(),
         tools: [createEchoTool()],
@@ -456,9 +457,9 @@ describe("Metadata Tests", () => {
           (r) => r.method === "tools/list",
         );
         expect(toolsListRequest?.metadata).toEqual({
-          nested: '{"key":"value"}',
-          list: "[1,2,3]",
-          flag: "true",
+          nested: { key: "value" },
+          list: [1, 2, 3],
+          flag: true,
         });
       } finally {
         await server.stop();
@@ -819,7 +820,7 @@ describe("Metadata Tests", () => {
         );
         expect(toolsListRequest).toBeDefined();
         expect(toolsListRequest?.metadata).toEqual({
-          integration_test: "true",
+          integration_test: true,
           test_phase: "all_methods",
         });
       } finally {
@@ -866,8 +867,8 @@ describe("Metadata Tests", () => {
         );
         expect(toolCallRequest).toBeDefined();
         expect(toolCallRequest?.metadata).toEqual({
-          session_id: "12345",
-          user_id: "67890",
+          session_id: 12345,
+          user_id: 67890,
           timestamp: "2024-01-01T00:00:00Z",
           request_id: "req-abc-123",
           tool_session: "session-xyz-789",
@@ -919,8 +920,8 @@ describe("Metadata Tests", () => {
         expect(toolCallRequest).toBeDefined();
         expect(toolCallRequest?.metadata).toEqual({
           valid_key: "valid_value",
-          numeric_key: "123",
-          boolean_key: "true",
+          numeric_key: 123,
+          boolean_key: true,
           json_key: '\'{"test":"value"}\'', // Single quotes are preserved
           special_key: "!@#$%^&*()",
           unicode_key: "🚀🎉✨",

clients/cli/__tests__/method-types.test.ts

@@ -1,7 +1,6 @@
 import { describe, it, expect } from "vitest";
 import {
   isOneShotMethod,
-  metaValueToString,
   ONE_SHOT_METHODS,
   SESSION_RPC_METHODS,
 } from "../src/handlers/method-types.js";
@@ -26,11 +25,3 @@ describe("ONE_SHOT_METHODS", () => {
     expect(ONE_SHOT_METHODS).not.toContain("logging/tail");
   });
 });
-
-describe("metaValueToString", () => {
-  it("passes strings through and JSON-encodes structured values", () => {
-    expect(metaValueToString("plain")).toBe("plain");
-    expect(metaValueToString({ a: 1 })).toBe('{"a":1}');
-    expect(metaValueToString([1, 2])).toBe("[1,2]");
-  });
-});

clients/cli/__tests__/programmatic-ergonomics.test.ts

@@ -12,7 +12,7 @@ import {
 describe("withConnectTimeout", () => {
   const baseSettings: InspectorServerSettings = {
     headers: [{ key: "X-Test", value: "1" }],
-    metadata: [],
+    metadata: {},
     env: [],
     connectionTimeout: 42,
     requestTimeout: 0,

clients/cli/__tests__/servers-list.test.ts

@@ -219,10 +219,14 @@ describe("showServerEntry / servers/show", () => {
         { key: "Authorization", value: "Bearer x" },
         { key: "X-Custom", value: "ok" },
       ],
-      metadata: [
-        { key: "Authorization", value: "Bearer meta" },
-        { key: "X-Custom", value: "ok" },
-      ],
+      metadata: {
+        Authorization: "Bearer meta",
+        "X-Custom": "ok",
+        // A structured value under a sensitive key: the redaction must replace
+        // the whole value, not walk into it (#1910).
+        "X-Api-Key": { primary: "sk-live-1", fallback: "sk-live-2" },
+        nested: { keep: true },
+      },
       env: [
         { key: "TOKEN", value: "secret" },
         { key: "", value: "still-secret" },
@@ -242,10 +246,13 @@ describe("showServerEntry / servers/show", () => {
       { key: "Authorization", value: "[redacted]" },
       { key: "X-Custom", value: "ok" },
     ]);
-    expect(sanitized.metadata).toEqual([
-      { key: "Authorization", value: "[redacted]" },
-      { key: "X-Custom", value: "ok" },
-    ]);
+    expect(sanitized.metadata).toEqual({
+      Authorization: "[redacted]",
+      "X-Custom": "ok",
+      "X-Api-Key": "[redacted]",
+      // A structured value under a non-sensitive key survives intact.
+      nested: { keep: true },
+    });
     expect(sanitized.env).toEqual([
       { key: "TOKEN", value: "[redacted]" },
       { key: "", value: "[redacted]" },