feat: allow complex JSON values in request _meta

Closes #1910

`_meta` was typed `Record<string, string>` end to end in the Inspector —
on disk as a `{ key, value }[]` pair array, in the Server Settings form as
key/value rows, and in every request verb's per-call metadata parameter.
Nothing in the MCP spec restricts a `_meta` value to a string, and the SDK
models the field as a `z.looseObject`, so the restriction was ours alone.

Widen the whole path to `RequestMetadata` (`Record<string, JsonValue>`):

- Per-server default metadata is a JSON **object** on disk and in memory.
  The pre-#1910 pair array is still read (`normalizeStoredMetadata`) so an
  existing `mcp.json` keeps working; it is never written back, so a save
  migrates the entry.
- The Server Settings → Request Metadata section is a JSON editor
  (`JsonObjectInput`) instead of key/value rows — rows cannot express an
  object value. It keeps the typed text as the display source and emits
  only parsed JSON, the same draft split `SchemaJsonField` uses, so the box
  stays typeable; invalid text is flagged inline and not applied.
- The CLI stops flattening `--metadata` / `--tool-metadata` through
  `metaValueToString`. Those values were already JSON-parsed, so
  `trace={"id":"abc"}` used to reach the wire as the *string* `{"id":"abc"}`
  and now reaches it as an object.
- `servers/show` redaction replaces a sensitive key's whole value rather
  than a string, so a structured value cannot leak through its members.
- `progressTokenOf` narrows the reserved `progressToken` key back to
  `string | number` before it reaches the SDK; any other JSON still travels
  inside `_meta` but wires up no progress callback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/cli/src/handlers/collect-app-info.ts

@@ -2,6 +2,7 @@ import { InspectorClient } from "@inspector/core/mcp/index.js";
 import { extractAppInfo } from "@inspector/core/mcp/apps.js";
 import type { AppInfo } from "@inspector/core/mcp/apps.js";
 import type { CliAppInfo } from "./method-types.js";
+import type { RequestMetadata } from "@inspector/core/mcp/types.js";
 
 /**
  * Build the CLI's app-info for a tool. Never throws — failures fold into
@@ -10,7 +11,7 @@ import type { CliAppInfo } from "./method-types.js";
 export async function collectAppInfo(
   client: Pick<InspectorClient, "readResource">,
   tool: Parameters<typeof extractAppInfo>[0],
-  metadata: Record<string, string> | undefined,
+  metadata: RequestMetadata | undefined,
 ): Promise<CliAppInfo> {
   let base: AppInfo;
   try {

clients/cli/src/handlers/connect-timeout.ts

@@ -22,7 +22,7 @@ export function withConnectTimeout(
   if (settings) return { ...settings, connectionTimeout };
   return {
     headers: [],
-    metadata: [],
+    metadata: {},
     env: [],
     connectionTimeout,
     requestTimeout: 0,

clients/cli/src/handlers/method-types.ts

@@ -1,4 +1,5 @@
 import type { JsonValue } from "@inspector/core/mcp/index.js";
+import type { RequestMetadata } from "@inspector/core/mcp/types.js";
 import type { AppInfo } from "@inspector/core/mcp/apps.js";
 import type { LoggingLevel } from "@modelcontextprotocol/client";
 import type { OutputFormat } from "./format-output.js";
@@ -20,8 +21,8 @@ export type MethodArgs = {
   logLevel?: LoggingLevel;
   toolName?: string;
   toolArg?: Record<string, JsonValue>;
-  toolMeta?: Record<string, string>;
-  metadata?: Record<string, string>;
+  toolMeta?: RequestMetadata;
+  metadata?: RequestMetadata;
   appInfo?: boolean;
   format?: OutputFormat;
   /** Task id for tasks/get, tasks/cancel, tasks/result. */
@@ -110,13 +111,3 @@ export type OneShotMethod = (typeof ONE_SHOT_METHODS)[number];
 export function isOneShotMethod(method: string): method is OneShotMethod {
   return (ONE_SHOT_METHODS as readonly string[]).includes(method);
 }
-
-/**
- * Encode a metadata / tool-metadata value for MethodArgs (string map).
- * Strings pass through; objects/arrays use JSON.stringify so structure is kept
- * (avoids String(obj) → "[object Object]").
- */
-export function metaValueToString(value: JsonValue): string {
-  if (typeof value === "string") return value;
-  return JSON.stringify(value);
-}

clients/cli/src/handlers/servers-list.ts

@@ -157,10 +157,15 @@ export function sanitizeServerSettings(
       key: h.key,
       value: isSensitiveHeader(h.key) ? REDACTED : h.value,
     })),
-    metadata: (settings.metadata ?? []).map((m) => ({
-      key: m.key,
-      value: isSensitiveHeader(m.key) ? REDACTED : m.value,
-    })),
+    // Metadata is a JSON object whose values may be any JSON (#1910), so the
+    // redaction replaces the whole value rather than a string — a sensitive
+    // key holding an object must not leak through its members.
+    metadata: Object.fromEntries(
+      Object.entries(settings.metadata ?? {}).map(([key, value]) => [
+        key,
+        isSensitiveHeader(key) ? REDACTED : value,
+      ]),
+    ),
     env: (settings.env ?? []).map((e) => ({
       key: e.key,
       value: REDACTED,