Closes#1910
`_meta` was typed `Record<string, string>` end to end in the Inspector —
on disk as a `{ key, value }[]` pair array, in the Server Settings form as
key/value rows, and in every request verb's per-call metadata parameter.
Nothing in the MCP spec restricts a `_meta` value to a string, and the SDK
models the field as a `z.looseObject`, so the restriction was ours alone.
Widen the whole path to `RequestMetadata` (`Record<string, JsonValue>`):
- Per-server default metadata is a JSON **object** on disk and in memory.
The pre-#1910 pair array is still read (`normalizeStoredMetadata`) so an
existing `mcp.json` keeps working; it is never written back, so a save
migrates the entry.
- The Server Settings → Request Metadata section is a JSON editor
(`JsonObjectInput`) instead of key/value rows — rows cannot express an
object value. It keeps the typed text as the display source and emits
only parsed JSON, the same draft split `SchemaJsonField` uses, so the box
stays typeable; invalid text is flagged inline and not applied.
- The CLI stops flattening `--metadata` / `--tool-metadata` through
`metaValueToString`. Those values were already JSON-parsed, so
`trace={"id":"abc"}` used to reach the wire as the *string* `{"id":"abc"}`
and now reaches it as an object.
- `servers/show` redaction replaces a sensitive key's whole value rather
than a string, so a structured value cannot leak through its members.
- `progressTokenOf` narrows the reserved `progressToken` key back to
`string | number` before it reaches the SDK; any other JSON still travels
inside `_meta` but wires up no progress callback.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>
Most tests import runCli()in-process (see helpers/cli-runner.ts) so
clients/cli/src is measured under the coverage gate. Suite-wide
helpers/mock-open-url.ts (vitest setupFiles) mocks open-url so an armed
interactive OAuth path cannot launch a real browser.
e2e.test.ts (and root scripts/smoke-cli.mjs) spawn the built binary for
shebang / process.exit paths — pretest builds test-servers + the CLI
bundle first.
Scripts (from clients/cli/)
npm test# pretest build + all tests
npm run test:cli # subset: cli.test.ts
npm run test:cli-tools # subset: tools.test.ts
npm run test:cli-headers # subset: headers.test.ts
npm run test:cli-metadata # subset: metadata.test.ts
npm run test:coverage # build + ≥90 per-file coverage gate
npm run validate # format:check && lint && typecheck && test
b33532c024