From f3878f94a902f75ea8fdaf20d1ed3d434f818fd9 Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Sun, 23 Aug 2026 13:49:55 -0400
Subject: [PATCH] fix: widen the test recorder's metadata type and correct a
 stale comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`RecordedRequest.metadata` was still `Record<string, string>`, so the recorder
advertised a string-only contract it no longer honors. The new CLI tests assert
objects and arrays against it and passed only because `toEqual` does not
enforce the declared type.

Typed as `Record<string, unknown>` rather than core's `RequestMetadata`:
test-servers compiles standalone (`tsc -p test-servers`, NodeNext, no `paths`),
so it has no `@inspector/core` alias to import through.

Also update `progressTokenOf`'s doc comment, which still claimed an invalid
token "reaches the wire inside `_meta`" — untrue since mergeMeta started
deleting it. It now names the split: progressTokenOf governs callback
correlation, mergeMeta governs wire sanitization, both via isProgressToken.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>
---
 core/mcp/inspectorClient.ts          | 12 ++++++------
 test-servers/src/test-server-http.ts | 13 ++++++++++++-
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/core/mcp/inspectorClient.ts b/core/mcp/inspectorClient.ts
index a51b0e2e..ecec24ef 100644
--- a/core/mcp/inspectorClient.ts
+++ b/core/mcp/inspectorClient.ts
@@ -1091,12 +1091,12 @@ export class InspectorClient extends InspectorClientEventTarget {
    * The `progressToken` a caller stamped on its request metadata, when it is
    * one the SDK will accept.
    *
-   * `_meta` values are arbitrary JSON (#1910), but `progressToken` is a
-   * reserved key the spec types as `string | number`. Anything else — an
-   * object, an array, `null`, a boolean — is not a token the SDK can correlate
-   * a `notifications/progress` back to, so it is read as "no token" rather than
-   * forwarded. The key still reaches the wire inside `_meta`; this only governs
-   * whether the client wires up a progress callback for it.
+   * This governs only **callback correlation** — whether the client wires up an
+   * `onprogress` for the request. Keeping an invalid value off the **wire** is
+   * a separate concern handled in {@link mergeMeta}, which deletes the member
+   * from the outgoing `_meta` so a conforming server is never sent something
+   * `ProgressTokenSchema` rejects. The two use the same {@link isProgressToken}
+   * predicate, so they cannot disagree about what counts as valid.
    */
   private progressTokenOf(
     metadata: RequestMetadata | undefined,
diff --git a/test-servers/src/test-server-http.ts b/test-servers/src/test-server-http.ts
index bbbb47ce..b8a5007f 100644
--- a/test-servers/src/test-server-http.ts
+++ b/test-servers/src/test-server-http.ts
@@ -83,7 +83,18 @@ export interface RecordedRequest {
   method: string;
   params?: Record<string, unknown>;
   headers?: Record<string, string>;
-  metadata?: Record<string, string>;
+  /**
+   * The request's `_meta`, recorded verbatim. Values are arbitrary JSON —
+   * objects, arrays, numbers, booleans, `null` — not just strings (#1910), so
+   * a test asserting on a structured value gets a contract that matches what
+   * the recorder actually holds.
+   *
+   * Typed as `unknown` values rather than `@inspector/core`'s
+   * `RequestMetadata`: this package compiles standalone (`tsc -p test-servers`,
+   * NodeNext, no `paths`), so it has no `@inspector/core` alias to import
+   * through.
+   */
+  metadata?: Record<string, unknown>;
   response: unknown;
   timestamp: number;
 }