* feat(web): catalog vs read-only session launch model + apply --header (#1481, #1483) Per specification/v2_catalog_launch_config.md, `mcp-inspector --web` now selects the backend's server-list source and a session-wide writability, instead of seeding an inert `initialMcpConfig` the UI never read: - `--catalog <path>` (and `MCP_CATALOG_PATH`) → active WRITABLE catalog (seed/CRUD/watch), like the default catalog. - `--config <path>` → READ-ONLY session file: served in the UI but never written, seeded, or plaintext-secret-migrated — safe to point at a foreign config (e.g. claude_desktop_config.json). - ad-hoc `--server-url`/command (+ `--header`) → one server held IN MEMORY (no file written); `--header` is lifted onto the entry so the seeded connection actually uses it (closes the #1483 warn-only no-op). - nothing → default catalog (writable), unchanged. Backend (`createRemoteApp`): new `writable` + `initialServers` options. GET /api/servers branches three ways (in-memory / read-only file with no seed+no migrate / writable catalog); the four mutating routes return 403 when read-only; `/api/config` carries `writable`; the file watcher is skipped for in-memory sessions. `--catalog`/`--config` are mutually exclusive and neither combines with an ad-hoc target or `--header`; `--header` requires an ad-hoc HTTP/SSE server (clear errors otherwise — no silent no-op). UI: `useServerListWritable` reads `writable` from /api/config; the Servers screen hides add/edit/clone/remove/reorder/settings and shows a read-only banner when false. All new props default to writable=true (back-compatible). Docs: spec gaps G2/G3/G4 updated; launcher README documents the flags. Verified end-to-end against the built launcher: --config (writable:false, file byte-stable, mutations 403), ad-hoc --header (in-memory, header lifted), and --catalog (writable:true, POST persists). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(web): address review — Mantine <Code> in read-only banner, clarify watcher comment - Replace raw <code> with Mantine <Code> in the read-only-session Alert (repo convention: prefer Mantine primitives over raw HTML). - Add a comment near `watchable` clarifying that a read-only `--config` file is still watched on purpose (read-only blocks UI writes, not external observation; `writable` does not gate watching). Deferred (per reviewer): consolidating useSandboxUrl + useServerListWritable into one useConfig hook to avoid the duplicate /api/config fetch — optional follow-up. The redundant ad-hoc header type-guard is kept as defensive. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
83 lines
2.9 KiB
TypeScript
83 lines
2.9 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { createRemoteApp } from "@inspector/core/mcp/remote/node/server.js";
|
|
|
|
describe("createRemoteApp GET /api/config", () => {
|
|
it("includes sandboxUrl in response when option is set", async () => {
|
|
const sandboxUrl = "http://localhost:9123/sandbox";
|
|
const { app } = createRemoteApp({
|
|
dangerouslyOmitAuth: true,
|
|
allowedOrigins: ["http://127.0.0.1:6274"],
|
|
sandboxUrl,
|
|
initialConfig: { defaultEnvironment: {} },
|
|
});
|
|
const res = await app.request(new Request("http://test/api/config"));
|
|
expect(res.status).toBe(200);
|
|
const data = (await res.json()) as { sandboxUrl?: string };
|
|
expect(data.sandboxUrl).toBe(sandboxUrl);
|
|
});
|
|
|
|
it("omits sandboxUrl when option is not set", async () => {
|
|
const { app } = createRemoteApp({
|
|
dangerouslyOmitAuth: true,
|
|
allowedOrigins: ["http://127.0.0.1:6274"],
|
|
initialConfig: { defaultEnvironment: {} },
|
|
});
|
|
const res = await app.request(new Request("http://test/api/config"));
|
|
expect(res.status).toBe(200);
|
|
const data = (await res.json()) as { sandboxUrl?: string };
|
|
expect(data).not.toHaveProperty("sandboxUrl");
|
|
});
|
|
|
|
it("uses initialConfig when provided instead of env", async () => {
|
|
const { app } = createRemoteApp({
|
|
dangerouslyOmitAuth: true,
|
|
allowedOrigins: ["http://127.0.0.1:6274"],
|
|
initialConfig: {
|
|
defaultCommand: "my-server",
|
|
defaultArgs: ["--foo"],
|
|
defaultTransport: "stdio",
|
|
defaultCwd: "/tmp",
|
|
defaultEnvironment: { PATH: "/usr/bin" },
|
|
},
|
|
});
|
|
const res = await app.request(new Request("http://test/api/config"));
|
|
expect(res.status).toBe(200);
|
|
const data = (await res.json()) as {
|
|
defaultCommand?: string;
|
|
defaultArgs?: string[];
|
|
defaultTransport?: string;
|
|
defaultCwd?: string;
|
|
defaultEnvironment?: Record<string, string>;
|
|
};
|
|
expect(data.defaultCommand).toBe("my-server");
|
|
expect(data.defaultArgs).toEqual(["--foo"]);
|
|
expect(data.defaultTransport).toBe("stdio");
|
|
expect(data.defaultCwd).toBe("/tmp");
|
|
expect(data.defaultEnvironment).toEqual({ PATH: "/usr/bin" });
|
|
});
|
|
|
|
it("reports writable:true by default and writable:false when set", async () => {
|
|
const writableApp = createRemoteApp({
|
|
dangerouslyOmitAuth: true,
|
|
initialConfig: { defaultEnvironment: {} },
|
|
}).app;
|
|
const writableRes = await writableApp.request(
|
|
new Request("http://test/api/config"),
|
|
);
|
|
expect(
|
|
((await writableRes.json()) as { writable?: boolean }).writable,
|
|
).toBe(true);
|
|
|
|
const readOnlyApp = createRemoteApp({
|
|
dangerouslyOmitAuth: true,
|
|
writable: false,
|
|
initialConfig: { defaultEnvironment: {} },
|
|
}).app;
|
|
const readOnlyRes = await readOnlyApp.request(
|
|
new Request("http://test/api/config"),
|
|
);
|
|
expect(
|
|
((await readOnlyRes.json()) as { writable?: boolean }).writable,
|
|
).toBe(false);
|
|
});
|
|
});
|