inspector

Wave 1 rollup — integration branch This issue is the rollup / integration point for Wave 1 of the #1579 decomposition. Rather than merging each Wave-1 PR individually into , they are integrated onto a single branch * (base: ), verified together, and reviewed as a unit. is NOT touched until the rollup is approved. What's on Original Wave 1 (10): #1556 core / (PR #1584) #1557 test-servers + (PR #1587) #1558 web sandbox CSP builder (PR #1588) #1559 web hostContext utilities (PR #1591) #1560 web enhancements (PR #1586) #1561 core redact fetch-log headers (PR #1585) #1562 auth + callback state reject (PR #1589) #1563 core // (PR #1590) #1564 cli exit-code map + JSON error envelopes (PR #1583) #1548 web parity + async hydration (PR #1592) Wave 1 follow-ups (surfaced during review/smoke): #1595 docs: complete version-board/label table (PR #1537) #1596 test-stability: eliminate web-suite timeout flakiness (PR #1597) #1593 core: redact fetch-log bodies + URL query strings (PR #1598) #1594 test-infra: gate under coverage (PR #1599) Verification posted here Each PR above already went through: exhaustive review to clean + an individual smoke-test/AGENTS.md audit on its own issue. This rollup issue additionally receives the integrated verification run against : 1. root (all clients) + web (e2e) on the merged branch; 2. every individual issue's smoke test replayed* against , proving the features work together. Refs: tracking #1579.

Closes #1596 What Deterministically fixes the recurring 5s-timeout flakes in the suite that surfaced under v8-instrumented, concurrent load. Test-only — no product source changed. No test was skipped/disabled, no global timeout was inflated, and the per-file coverage gate (≥90 on all four dimensions) still holds for every touched file. Per-test root cause + fix Common root cause (modals/forms/screens): schedules a real between keystrokes. Under CPU contention those event-loop yields balloon, so multi-field interactions accumulated past the 5s per-test timeout — exactly the "clustered at the default 5s timeout under load" symptom. Fix: removes the per-keystroke real-timer dependence (keystrokes dispatch synchronously), making the suites load-independent. ServerConfigModal, ServerImportConfigModal, ServerImportJsonModal, ResourcesScreen, InspectorView (localStorage/History): on every . The debounced validation in the import modals was already awaited via /, so it needed no change beyond fast typing. PromptArgumentsForm* (completions): the tests slept on the wall clock just past the 300ms completion debounce (), which races the debounce timer under load. Replaced every such sleep with awaited conditions (/) on the real rendered outcome plus ; they now resolve as soon as the debounce fires and the response settles, and never depend on machine speed. Negative assertions (stale-option clearing, cancelled debounce) rely on the component's synchronous state/timer teardown rather than a timed window, so they're deterministic. A scoped 3s timeout (commented) covers the legitimate debounce + async settle under heavy load. inspectorClient integration ("should track stderr logs for stdio transport"): the child process's stderr is piped out-of-band from the tool's JSON-RPC response, so reading synchronously right after resolved raced the stderr chunk. Wrapped the assertion in so it polls until the line lands. Verification All green with zero intermittent failures: (web) — 191 files / 2438 tests. (web) — run 6×: 4 sequential + 2 concurrent under load* (two full coverage runs in parallel, the issue's suggested load harness). Every run: 229 files / 3237 tests passed, coverage gate clean (0 threshold errors). (web) standalone — 38 files / 799 tests. 🤖 Generated with Claude Code https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX

Closes #1517. Closes #1595. Summary Adds a root documenting the contribution policy: we accept issues, not pull requests. Maintainers handle design and implementation through the prompt-driven workflow described in . Contributors who have already built a change locally are asked to share the prompt they used, not a diff. The doc covers every requirement from the issue: Policy statement — issues only; external PRs are not merged; maintainers own design/implementation. How to report a bug / request a feature — open a well-scoped issue on the right version board. Includes a version → base-branch → project-board → label table (v1 / v1.5 / v2) plus a "Label by version" note mirroring the convention in . _(Added in the latest commit — the table is now actually present; see #1595.)_ If you've already fixed it locally — don't send a diff; share the prompt(s), before/after behavior, and how you verified. What makes a good issue / prompt submission — reproduction or use case, expected vs. actual, affected client (Web / TUI / CLI), and exact prompt text. Rationale — explains the prompt-driven workflow so the policy reads as intentional, with a welcoming tone. Cross-reference — adds a "Contributing" section to linking to . (There is no root in this repo, so is the cross-reference point — the issue allows "README.md and/or AGENTS.md".) Notes Docs-only change to root files; no client code is touched, so the build/test gates don't apply (no root-level prettier scope covers these files either; the markdown was formatted with manually). The optional follow-up (a redirect / PR template to steer would-be PR authors) is left for a separate issue if desired. 🤖 Generated with Claude Code https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX