* feat(servers): flatten mcp.json settings to top-level fields (#1358)
Eliminate the nested `settings` block introduced in #1352 so each
server entry's Inspector-extension fields live as direct keys alongside
`type` / `url`, matching the `.mcp.json` shape Claude Code / Cursor /
Cline write:
- `headers` becomes a `Record<string, string>` on disk (was nested
`settings.headers` as a pair-array)
- `oauth` becomes a nested `{ clientId?, clientSecret?, scopes? }`
object (was flat `settings.oauthClientId` / `oauthClientSecret` /
`oauthScopes`)
- `metadata`, `connectionTimeout`, `requestTimeout` move to the
entry's top level as-is (Inspector-only fields)
The in-memory + wire shape is unchanged from #1352: `InspectorServerSettings`
keeps pair-array `headers` and flat `oauth*` fields because the form
needs them in that shape to drive controlled-component editing. The
bidirectional conversion lives in `serverList.ts`
(`storedFieldsToInspectorSettings` / `inspectorSettingsToStoredFields`)
and is invoked by `mcpConfigToServerEntries` / `serverEntriesToMcpConfig`
and by the server route's `buildStoredEntry`. The `PUT /api/servers/:id`
wire envelope keeps the preserve/clear/apply semantics from #1353 — the
backend splats validated `settings.*` onto top-level disk keys when
assembling the next on-disk shape.
Hard-cutover migration per the issue's decision 4: files written by the
one pre-#1358 v2/main build have a nested `settings` block; we drop the
node on read with a one-line warn including the server id. The persisted
headers / metadata / timeouts / OAuth credentials are intentionally lost
on first read — users re-enter them via the form (or hand-edit the file
into the flat shape). v2 has not shipped a stable release with the
nested shape, so the blast radius is dogfooders only.
The smuggle-guard in `buildStoredEntry` widens from just `settings` to
all six Inspector-extension keys (`settings`, `headers`, `metadata`,
`connectionTimeout`, `requestTimeout`, `oauth`), so a caller can't
bypass `validateSettings` by nesting any of them inside `config`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(servers): address PR review on flatten (#1359)
- Single-source the Inspector-extension key list with `satisfies`
(finding 1). `INSPECTOR_FIELD_KEY_MAP satisfies Record<keyof
StoredInspectorFields, true>` in serverList.ts means a new field on
the type forces a compile error here. The set is exported and
re-used by the server route's smuggle guard, so adding `proxy` or
similar in the future updates all three sites in lockstep. The PUT
preserve path now uses a new `stripInspectorFields` helper that
derives from the same source instead of hand-destructuring.
- Add read-path shape validation in `normalizeMcpServers` (finding 2):
`headers: "oops"` / `metadata: 42` / `oauth: []` / non-numeric
timeouts are dropped individually with a warn, so a hand-edited
malformed file can't put garbage rows into the form. Mirrors the
write-side `validateSettings` symmetry. New integration test covers
each malformed shape with a partial fixture so a single bad key
doesn't take out the whole entry.
- Align new warns to the `fileLogger || console.warn` fallback pattern
(finding 3) via a small `logWarn` helper, so the legacy-drop and
smuggle warns are visible in `npm run dev` where the logger is
often unconfigured.
- Spec doc tweak: the CLI/TUI out-of-scope note's "writes to
`settings.headers`" reference now reads "writes to the entry's
top-level `headers` field on disk (post-#1358 flat shape)" (finding
4). Avoids confusion for future readers.
- Nits: replace `current.mcpServers[originalId]!` with explicit
narrowing; add a comment on the OAuth truthiness drop in
`storedFieldsToInspectorSettings` mirroring the write-side comment.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(servers): address pass-2 review on flatten (#1359)
- Tighten `isNonNegNumber` with `Number.isFinite` so `Infinity` and
`NaN` are rejected at the read boundary, matching the write-side
intent (finding D). Hand-edited `connectionTimeout: Infinity` would
have passed the prior check and propagated to the form.
- Add a one-line comment in `normalizeMcpServers` noting that the
per-entry object is mutated in place via the `delete` calls — safe
for today's callers (freshly parsed JSON, no other reference held)
but worth flagging for the next reader (finding A).
Skipping findings B (move type guards to module scope — single call
site) and C (`isOauthObject` lenient on extra keys — reviewer
confirmed this is the intended forward-compat behavior, matching
`normalizeServerType`'s unknown-key passthrough).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(servers): fix mutation-comment caller branch label (#1359)
The previous comment named the GET handler's "seed branch" as a caller
of normalizeMcpServers, but that branch returns DEFAULT_SEED_CONFIG
directly without normalizing. The actual second caller is the
file-present branch (after parseStore). Correcting the label so a
future reader looking for the seed branch caller doesn't waste time.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
a9df501856