@abide/abide 0.36.0 → 0.38.0

package/AGENTS.md

@@ -100,7 +100,7 @@ Test suites compile `.abide` and rewrite verbs under `bun test` via `preload = [
 
 - `abide/server/AppModule` — the type of `src/app.ts`'s optional hooks: `init` (boot + cleanup), `handle` (middleware), `handleError`, `health` (merges into `/__abide/health`), `forwardHeaders`.
 - `abide/server/agent` — `agent(engine, messages)`: run a model engine against the current request's MCP surface (caller auth forwarded into every tool call), yielding neutral `AgentFrame`s to wrap in `jsonl`/`sse`.
-- `abide/server/InspectorContext` — the capability bundle (`app`, `loadSurface`, `cacheSnapshot`, `onRecord`) handed to `@abide/inspector` when `ABIDE_ENABLE_INSPECTOR=true`.
+- `abide/server/InspectorContext` — the capability bundle (`app`, `loadSurface`, `cacheSnapshot`, `inFlightSnapshot`, `onRecord`) handed to `@abide/inspector` when `ABIDE_ENABLE_INSPECTOR=true`.
 
 ### Prompts — @documentation plumbing
 

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # abide
 
+## 0.38.0
+
+### Minor Changes
+
+- [`bcfd15a`](https://github.com/briancray/abide/commit/bcfd15af169787d733355d5879bf95aec164e698) - feat(dom): make `{snippet(args)}` interpolations reactive in their arguments. Previously `appendSnippet` read the call once at mount and never re-ran, so an argument derived from reactive state froze its initial value (e.g. `{grouped(Object.groupBy([...aired, ...upcoming]))}` rendered with `upcoming` still `[]`, never updating when a later effect populated it). The call is now bounded by a range and wrapped in an effect — like `when`/`each` — so an argument change tears the snippet down and re-mounts it with fresh args (the body's own reads stay fine-grained within a mount; args behave like props). Create mode now emits the `<!--abide:snippet-->` range markers the server already rendered, so the markers are congruent on both sides rather than a server-only asymmetry.
+
+### Patch Changes
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - restart ttl on revalidation and don't clobber a live streamed seed ([`2d07d53`](https://github.com/briancray/abide/commit/2d07d53b5aec54681e34f7490f636de2bf47fc7a))
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - harden rpc/runtime/socket edge cases ([`39581f4`](https://github.com/briancray/abide/commit/39581f46601b71ccad6c6112e37c55a03b069068))
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - propagate control-server worker start failure ([`3bb529b`](https://github.com/briancray/abide/commit/3bb529b00dc939c73212215cf6ae027b1078c053))
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - handle JSON-RPC notifications without replying ([`4315aa1`](https://github.com/briancray/abide/commit/4315aa11c7b834607e315e6403bc41c4c9bd6a8c))
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - drop unused error-page manifest ([`7f4f78a`](https://github.com/briancray/abide/commit/7f4f78af9829dca10a6062dd76b6e7fb9fddf739))
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - auto-vivify nested bind paths and escape persisted doc keys ([`a2f7d15`](https://github.com/briancray/abide/commit/a2f7d1546201b6edb3b645ffede56519890415cf))
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - avoid stdin hang and reject blank numeric flags ([`f1d47ef`](https://github.com/briancray/abide/commit/f1d47ef731235d7a4c4ebb727a83bb642102aac0))
+
+- [`2efd4ad`](https://github.com/briancray/abide/commit/2efd4ad1e572c46a0611d3d1d5cd1a02f80da629) - parse unquoted attributes and skip destructured binding rewrites ([`ff66d57`](https://github.com/briancray/abide/commit/ff66d57f5362af68f06d0e62dfc78d5f95322f99))
+
+- [`fab46dd`](https://github.com/briancray/abide/commit/fab46ddb0d3b8c4c8a1fa4f4615e8c5b1dfbf9e9) - fix(dom): skip control-flow rebuild when the end marker is detached. An effect for a `when`/`switch` block could fire one final time after an enclosing await/each block tore its branch down in the same microtask flush (before the owner scope disposed it), making `fillBefore` insert a fragment before a parentless comment — `HierarchyRequestError: The operation would yield an incorrect node tree`. `fillBefore` now bails when `end.parentNode` is null.
+
+- [`b081dd5`](https://github.com/briancray/abide/commit/b081dd5f7087c9f88960349d2477eab2c8d78005) - fix(compile): unify the layout `<slot/>` outlet rewrite across both back-ends and emit it scope-free. The hole-numbering refactor keys skeleton hole indices by node identity, but `generateBuild` ran `skeletonContext` over the original nodes while traversing `nodes.map(asOutlet)` — and `asOutlet` clones every element it descends, so a layout with any reactive hole (e.g. the kitchen-sink `layout.abide`'s active-link `<a href={url('/')}>`) threw `[abide] skeleton hole not numbered by the shared positional walk` at compile time, failing the page render. Both back-ends now apply the shared `asOutlet` before `skeletonContext`, so the indexed tree and the traversed tree are one. The rewrite also strips the outlet's style scope: the client cloned `<abide-outlet>` with the slot's annotated `data-a-…` scope while the server emitted it bare, a hydration mismatch (and `renderChain` folds the child layer via an exact bare-`<abide-outlet></abide-outlet>` match) — the outlet is a structural mount container, not styled content, so it now carries no attributes or scope on either side.
+
+- [`b081dd5`](https://github.com/briancray/abide/commit/b081dd5f7087c9f88960349d2477eab2c8d78005) - refactor(compile): fold skeleton hole numbering into the single `skeletonContext` walk. `generateBuild` previously threaded its own mutable `{ el, an }` counter through a second document-order walk parallel to the decision walk, free to drift from it — the compiler half of the hand-mirrored hole-ordering protocol. `skeletonContext` now assigns each hole its `el`/`an` index in the same pass that records `inSkeleton`/`markText` (el keyed by node, an keyed by node or by the reactive-text part), and `generateBuild` reads them via `holeIndex` instead of counting. One walk owns both the decisions and the numbering, so a counter-vs-decision drift is structurally impossible; a hole the shared walk didn't number now throws at compile time rather than surfacing as a runtime hydration desync. Behavior-preserving — no API or output change.
+
+## 0.37.0
+
+### Minor Changes
+
+- [`dfd9d9e`](https://github.com/briancray/abide/commit/dfd9d9e9149c16761c539f7b45358e9a969174d8) - manual scroll restoration + hash-only navigation ([`1b71ef1`](https://github.com/briancray/abide/commit/1b71ef195186c0cee5a36527307f5f981833b546))
+
+- [`dfd9d9e`](https://github.com/briancray/abide/commit/dfd9d9e9149c16761c539f7b45358e9a969174d8) - lead every tsv line with a wall-clock column ([`5784d47`](https://github.com/briancray/abide/commit/5784d47ddd2d52696fb9db111092c6f571270086))
+
+- [`dfd9d9e`](https://github.com/briancray/abide/commit/dfd9d9e9149c16761c539f7b45358e9a969174d8) - always-`abide-` component wrapper tag ([`711de46`](https://github.com/briancray/abide/commit/711de46f8b5210cbbff5c73cd7aceda410d87f47))
+
+- [`dfd9d9e`](https://github.com/briancray/abide/commit/dfd9d9e9149c16761c539f7b45358e9a969174d8) - inspector in-flight requests + prompts surface ([`823392d`](https://github.com/briancray/abide/commit/823392d0e644b3a84661293f86b28ca10d9a9de9))
+
+- [`dfd9d9e`](https://github.com/briancray/abide/commit/dfd9d9e9149c16761c539f7b45358e9a969174d8) - inspector client scope/router bridge ([`c25b45e`](https://github.com/briancray/abide/commit/c25b45e778f6f17eeaf0875a4b7ecdd63fccb978))
+
 ## 0.36.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abide/abide",
-    "version": "0.36.0",
+    "version": "0.38.0",
     "type": "module",
     "sideEffects": false,
     "description": "Isomorphic multimodal HTTP framework built for humans and machines in a single Bun runtime",

package/src/abideResolverPlugin.ts

@@ -201,7 +201,7 @@ export function abideResolverPlugin({
         setup(build) {
             build.onResolve(
                 {
-                    filter: /\/_virtual\/(rpc|sockets|prompts|pages|layouts|errors|app|config|mcp-resources|mcp|assets|public-assets|shell|app-info|cli-manifest|cli-name|cli-chrome|bundle-window|bundle-disconnected-component|bundle-disconnected)\.ts$/,
+                    filter: /\/_virtual\/(rpc|sockets|prompts|pages|layouts|app|config|mcp-resources|mcp|assets|public-assets|shell|app-info|cli-manifest|cli-name|cli-chrome|bundle-window|bundle-disconnected-component|bundle-disconnected)\.ts$/,
                 },
                 (args) => {
                     const name = fileStem(args.path)
@@ -434,17 +434,6 @@ ${optionLines}
                     })
                 }
 
-                if (args.path === 'abide:errors') {
-                    const { errorFiles } = await scanPagesOnce()
-                    return manifestModule({
-                        files: errorFiles,
-                        keyForFile: pageUrlForFile,
-                        importDir: pagesDir,
-                        exportName: 'errors',
-                        label: 'error pages',
-                    })
-                }
-
                 if (args.path === 'abide:app') {
                     const userApp = `${cwd}/src/app.ts`
                     const hasAppModule = await Bun.file(userApp).exists()
@@ -788,7 +777,6 @@ ${encoded.map((entry) => entry.line).join('\n')}
 type PagesScan = {
     pageFiles: string[]
     layoutFiles: string[]
-    errorFiles: string[]
 }
 
 /*
@@ -796,19 +784,17 @@ Walks src/ui/pages once and classifies each `.abide` leaf by filename: a
 `page.abide` is a route (its URL is the folder path), a `layout.abide` is a
 layout that wraps every page at or below its folder (keyed by the same folder
 URL). Any other `.abide` file (a shared component) is ignored here — free to
-live anywhere and be imported relatively. errorFiles stay empty — there is no
-framework error resolution.
+live anywhere and be imported relatively.
 */
 async function scanPages(pagesDir: string): Promise<PagesScan> {
     if (!existsSync(pagesDir)) {
-        return { pageFiles: [], layoutFiles: [], errorFiles: [] }
+        return { pageFiles: [], layoutFiles: [] }
     }
     const allFiles = await Array.fromAsync(new Glob('**/*.abide').scan({ cwd: pagesDir }))
     const leafIs = (name: string) => (file: string) => (file.split('/').pop() ?? '') === name
     return {
         pageFiles: allFiles.filter(leafIs('page.abide')),
         layoutFiles: allFiles.filter(leafIs('layout.abide')),
-        errorFiles: [],
     }
 }
 

package/src/appEntry.ts

@@ -80,14 +80,24 @@ the connect screen. Resolving before this means a successful resume opens straig
 at the app — no connect-screen flash — at the cost of a brief window-less moment
 while it boots/probes (the OS shows the launching dock icon meanwhile).
 */
-const { origin, target } = await new Promise<{ origin: string; target: string }>((resolve) => {
-    worker.addEventListener('message', (event: MessageEvent) => {
-        const data = event.data as { type: string; origin?: string; target?: string }
-        if (data.type === 'ready' && data.origin && data.target) {
-            resolve({ origin: data.origin, target: data.target })
-        }
-    })
-})
+const { origin, target } = await new Promise<{ origin: string; target: string }>(
+    (resolve, reject) => {
+        worker.addEventListener('message', (event: MessageEvent) => {
+            const data = event.data as {
+                type: string
+                origin?: string
+                target?: string
+                error?: string
+            }
+            if (data.type === 'ready' && data.origin && data.target) {
+                resolve({ origin: data.origin, target: data.target })
+            } else if (data.type === 'error') {
+                /* The worker's start() rejected — fail fast instead of hanging on `ready`. */
+                reject(new Error(data.error ?? 'control server worker failed to start'))
+            }
+        })
+    },
+)
 
 /*
 The built-in File menu (Start / Disconnect), placed before Edit. Each item is a

package/src/controlServerWorker.ts

@@ -12,6 +12,7 @@ import { binaryDirEnvPath } from './lib/shared/binaryDirEnvPath.ts'
 import { clearLastConnection } from './lib/shared/clearLastConnection.ts'
 import { createLivenessWatch } from './lib/shared/createLivenessWatch.ts'
 import { dataDirEnvPath } from './lib/shared/dataDirEnvPath.ts'
+import { messageFromError } from './lib/shared/messageFromError.ts'
 import { readEnvFile } from './lib/shared/readEnvFile.ts'
 import { readLastConnection } from './lib/shared/readLastConnection.ts'
 import { serializeEnv } from './lib/shared/serializeEnv.ts'
@@ -417,7 +418,13 @@ self.addEventListener('message', (event: MessageEvent) => {
         | { type: 'window'; handle: number }
         | { type: 'shutdown' }
     if (data.type === 'init') {
-        void start(data.init)
+        /*
+        A rejected start() would leave the launcher's `await {type:'ready'}`
+        hanging forever — surface the failure so it can fail fast instead.
+        */
+        start(data.init).catch((startError) => {
+            self.postMessage({ type: 'error', error: messageFromError(startError) })
+        })
     } else if (data.type === 'window') {
         webviewHandle = data.handle
     } else if (data.type === 'shutdown') {

package/src/lib/cli/parseArgvForRpc.ts

@@ -26,9 +26,12 @@ export async function parseArgvForRpc(
     /*
     Stdin override: if a JSON object is piped in, treat it as the
     starting args bag. `Bun.stdin.text()` reads the whole pipe; if
-    nothing was piped, the read resolves with an empty string.
+    nothing was piped, the read resolves with an empty string. Skip the
+    read entirely when argv already supplied args — a non-TTY pipe that
+    never sends EOF would otherwise hang the call forever even though the
+    args are fully on the command line.
     */
-    if (!process.stdin.isTTY) {
+    if (!process.stdin.isTTY && argv.length === 0) {
         const text = await Bun.stdin.text()
         if (text.trim()) {
             try {
@@ -81,7 +84,9 @@ export async function parseArgvForRpc(
             throw new Error(`--${name} requires a value`)
         }
         if (propType === 'number' || propType === 'integer') {
-            const n = Number(value)
+            // Reject a blank value explicitly — `Number('')` / `Number('  ')` is 0,
+            // not NaN, so the NaN guard alone would silently coerce it to zero.
+            const n = value.trim() === '' ? Number.NaN : Number(value)
             if (Number.isNaN(n)) {
                 throw new Error(`--${name} expects a number, got ${value}`)
             }

package/src/lib/mcp/createMcpServer.ts

@@ -42,6 +42,14 @@ export function createMcpServer(opts: McpServerOptions = {}): McpServer {
                 })
             }
             const envelope = await dispatchMcpRequest(request, opts, serverInfo)
+            /* A notification yields no envelope — JSON-RPC forbids replying, so
+               ack the receipt with an empty 202 instead of a response body. */
+            if (envelope === undefined) {
+                return new Response(undefined, {
+                    status: 202,
+                    headers: { 'Cache-Control': NO_STORE },
+                })
+            }
             return Response.json(envelope, { headers: { 'Cache-Control': NO_STORE } })
         },
     }

package/src/lib/mcp/dispatchMcpRequest.ts

@@ -53,18 +53,36 @@ export async function dispatchMcpRequest(
     request: Request,
     opts: McpServerOptions,
     serverInfo: { name: string; version: string },
-): Promise<JsonRpcResponse> {
+): Promise<JsonRpcResponse | undefined> {
     let envelope: JsonRpcRequest
     try {
         envelope = (await request.clone().json()) as JsonRpcRequest
     } catch {
         return jsonRpcError(null, -32700, 'Parse error')
     }
+    /* A notification has no `id` field at all (absent — `id: 0`/`id: null` are
+       valid ids). JSON-RPC 2.0 forbids replying to a notification, so dispatch it
+       for its side effect and return undefined to signal "no reply". */
+    const isNotification = !('id' in envelope)
     const id = envelope.id ?? null
     if (envelope.jsonrpc !== '2.0' || typeof envelope.method !== 'string') {
-        return jsonRpcError(id, -32600, 'Invalid Request')
+        return isNotification ? undefined : jsonRpcError(id, -32600, 'Invalid Request')
     }
 
+    // Run the method for its side effect, then drop the reply for a notification.
+    const response = await dispatchMethod(envelope, id, request, opts, serverInfo)
+    return isNotification ? undefined : response
+}
+
+/* Resolves a parsed, validated request to its JSON-RPC response. The caller
+   discards this for notifications; non-notifications get it verbatim. */
+async function dispatchMethod(
+    envelope: JsonRpcRequest,
+    id: string | number | null,
+    request: Request,
+    opts: McpServerOptions,
+    serverInfo: { name: string; version: string },
+): Promise<JsonRpcResponse> {
     if (opts.authorize) {
         try {
             await opts.authorize(request)

package/src/lib/mcp/toolResultFromResponse.ts

@@ -5,7 +5,12 @@ import { responseErrorText } from '../shared/responseErrorText.ts'
 import { streamResponse } from '../shared/streamResponse.ts'
 
 // Frames a value as MCP text content — strings verbatim, everything else as JSON.
+// An undefined body (204 / empty) becomes '' — `JSON.stringify(undefined)` is the
+// value `undefined`, not a string, which would make an invalid text content block.
 function asText(value: unknown): string {
+    if (value === undefined) {
+        return ''
+    }
     return typeof value === 'string' ? value : JSON.stringify(value)
 }
 

package/src/lib/server/rpc/parseArgs.ts

@@ -1,4 +1,5 @@
 import { carriesBodyArgs } from '../../shared/carriesBodyArgs.ts'
+import { contentTypeOf } from '../../shared/contentTypeOf.ts'
 import { HttpError } from '../../shared/HttpError.ts'
 import type { HttpVerb } from '../../shared/types/HttpVerb.ts'
 import { error } from '../error.ts'
@@ -86,7 +87,7 @@ export async function parseArgs(
                 store.req = bounded
             }
         }
-        const contentType = (bounded.headers.get('content-type') ?? '').toLowerCase()
+        const contentType = contentTypeOf(bounded.headers)
         try {
             if (contentType.includes('application/json')) {
                 const text = await bounded.text()
@@ -116,6 +117,16 @@ export async function parseArgs(
         return body
     }
 
+    /*
+    TODO(query-coercion): query params arrive as strings, so a numeric/boolean
+    field reaches schema validation as `'2'`/`'true'`. Deferred deliberately:
+    parseArgs has no access to the verb's inputSchema (it lives in defineVerb),
+    and Standard Schema exposes no type structure to drive type-aware coercion.
+    Blind value-shape coercion is unsafe — it would corrupt legitimately
+    string-typed fields whose value looks numeric/boolean (ids, zip codes,
+    version strings like '1.0'), silently breaking GET validation. A correct fix
+    needs the schema threaded in here (or a coercing schema adapter at the verb).
+    */
     const bodyObject = (body ?? {}) as Record<string, unknown>
     const merged = { ...Object.fromEntries(url.searchParams), ...bodyObject }
     if (Object.keys(merged).length === 0) {

package/src/lib/server/runtime/acceptsGzip.ts

@@ -20,5 +20,14 @@ export function acceptsGzip(req: Request): boolean {
         return false
     }
     const quality = directive.match(/;\s*q=([\d.]+)/)
-    return quality === null || Number(quality[1]) > 0
+    if (quality === null) {
+        return true
+    }
+    /*
+    A malformed q (e.g. `q=.` → NaN) is not an explicit refusal — fall back to
+    the default-accept path, matching how an absent q is treated. Only a parsed
+    quality of exactly 0 denies compression.
+    */
+    const parsed = Number(quality[1])
+    return Number.isNaN(parsed) || parsed > 0
 }

package/src/lib/server/runtime/buildInFlightSnapshot.ts

@@ -0,0 +1,35 @@
+import { inFlightRequests } from './inFlightRequests.ts'
+import type { InspectorInFlightRequest } from './types/InspectorInFlightRequest.ts'
+import type { InspectorInFlightSnapshot } from './types/InspectorInFlightSnapshot.ts'
+import type { RequestStore } from './types/RequestStore.ts'
+
+function projectStore(store: RequestStore, now: number): InspectorInFlightRequest {
+    return {
+        trace: store.trace.traceId,
+        method: store.req.method,
+        path: `${store.url.pathname}${store.url.search}`,
+        /* store.start is Bun.nanoseconds() at scope entry; elapsed is current at the read. */
+        elapsedMs: (now - store.start) / 1e6,
+        route: store.route,
+        params: store.params,
+    }
+}
+
+/*
+Snapshots the request scopes currently executing their handler. Read at call
+time so it reflects the in-flight set as it stands; returns empty when the
+inspector hasn't installed the tracking Set or the server is idle. Sorted by
+elapsed ascending — newest (least elapsed) first, so a long-running request
+sinks to the bottom as its elapsed grows.
+*/
+export function buildInFlightSnapshot(): InspectorInFlightSnapshot {
+    const tracked = inFlightRequests.tracked
+    if (!tracked) {
+        return { requests: [] }
+    }
+    const now = Bun.nanoseconds()
+    const requests = Array.from(tracked, (store) => projectStore(store, now)).sort(
+        (left, right) => left.elapsedMs - right.elapsedMs,
+    )
+    return { requests }
+}

package/src/lib/server/runtime/buildInspectorSurface.ts

@@ -1,4 +1,5 @@
 import { jsonSchemaForSchema } from '../../shared/jsonSchemaForSchema.ts'
+import { promptRegistry } from '../prompts/promptRegistry.ts'
 import { verbRegistry } from '../rpc/verbRegistry.ts'
 import { socketOperations } from '../sockets/socketOperations.ts'
 import { socketRegistry } from '../sockets/socketRegistry.ts'
@@ -33,5 +34,12 @@ export function buildInspectorSurface(): InspectorSurface {
             restUrl: operation.restUrl,
         })),
     }))
-    return { verbs, sockets }
+    /* jsonSchema is already JSON Schema (built from the frontmatter `arguments`
+       list by the resolver plugin), so it's passed through, not re-projected. */
+    const prompts = Array.from(promptRegistry.values()).map((entry) => ({
+        name: entry.prompt.name,
+        description: entry.prompt.description,
+        inputSchema: entry.jsonSchema,
+    }))
+    return { verbs, sockets, prompts }
 }

package/src/lib/server/runtime/createServer.ts

@@ -186,6 +186,13 @@ export async function createServer({
     // In dev, append the live-reload client to the shell so every rendered
     // page reconnects to /__abide/dev and reloads after a restart.
     const devShell = dev ? shell.replace('</body>', `${DEV_RELOAD_CLIENT_SCRIPT}</body>`) : shell
+    // When the inspector is enabled, flag the client so startClient installs the
+    // BroadcastChannel bridge that streams scope + router state to the inspector
+    // page. Independent of dev — the inspector can run on a build server too.
+    const inspectedShell =
+        process.env.ABIDE_ENABLE_INSPECTOR === 'true'
+            ? devShell.replace('</body>', `<script>window.__abideInspect=true</script></body>`)
+            : devShell
     /*
     Mount base from APP_URL's pathname (e.g. https://foo.com/v2 → /v2). Install
     the server-side resolver so url() prefixes SSR-generated links, and rewrite
@@ -197,7 +204,9 @@ export async function createServer({
     setBaseResolver(() => base)
     // Rebase the shell's rooted `/_app/` entry refs onto the mount base, matching
     // either quote style so a custom app.html using single quotes still rewrites.
-    const activeShell = base ? devShell.replace(/(["'])\/_app\//g, `$1${base}/_app/`) : devShell
+    const activeShell = base
+        ? inspectedShell.replace(/(["'])\/_app\//g, `$1${base}/_app/`)
+        : inspectedShell
     /*
     Boot-path disk scans run concurrently — they share no data, and under
     `abide dev` the worker-swap window is bounded by exactly this boot.

package/src/lib/server/runtime/gzipResponse.ts

@@ -1,3 +1,4 @@
+import { contentTypeOf } from '../../shared/contentTypeOf.ts'
 import { isStreamingResponse } from '../../shared/isStreamingResponse.ts'
 import { acceptsGzip } from './acceptsGzip.ts'
 import { flushingGzipStream } from './flushingGzipStream.ts'
@@ -40,7 +41,7 @@ export function gzipResponse(req: Request, response: Response): Response {
     if (!acceptsGzip(req) || isStreamingResponse(response)) {
         return response
     }
-    const contentType = (response.headers.get('content-type') ?? '').toLowerCase()
+    const contentType = contentTypeOf(response.headers)
     if (!COMPRESSIBLE_TYPE.test(contentType)) {
         return response
     }

package/src/lib/server/runtime/inFlightRequests.ts

@@ -0,0 +1,13 @@
+import type { RequestStore } from './types/RequestStore.ts'
+
+/*
+The set of request scopes currently executing their handler, for the inspector's
+in-flight view. `tracked` stays undefined until the inspector mounts and swaps in
+a live Set — so the request path adds nothing (no allocation, no membership
+churn) when the inspector is off. runWithRequestScope adds a store on scope entry
+and removes it when the handler settles; buildInFlightSnapshot reads it. Mirrors
+the on-demand, opt-in shape of the log/socket tap slots.
+*/
+export const inFlightRequests: { tracked: Set<RequestStore> | undefined } = {
+    tracked: undefined,
+}

package/src/lib/server/runtime/maybeMountInspector.ts

@@ -4,7 +4,9 @@ import { requestScopeSlot } from '../../shared/requestScopeSlot.ts'
 import { socketTapSlot } from '../../shared/socketTapSlot.ts'
 import type { LogRecord } from '../../shared/types/LogRecord.ts'
 import { buildCacheSnapshot } from './buildCacheSnapshot.ts'
+import { buildInFlightSnapshot } from './buildInFlightSnapshot.ts'
 import { buildInspectorSurface } from './buildInspectorSurface.ts'
+import { inFlightRequests } from './inFlightRequests.ts'
 import { ensureRegistriesLoaded } from './registryManifests.ts'
 import type { InspectorContext } from './types/InspectorContext.ts'
 
@@ -63,6 +65,10 @@ export async function maybeMountInspector(app: {
         )
         return undefined
     }
+    /* Arm in-flight tracking now the inspector is mounting: runWithRequestScope
+       fills this Set per request, kept process-wide (the events tap teardown is
+       per-connection; the Set outlives any single feed). */
+    inFlightRequests.tracked = new Set()
     const context: InspectorContext = {
         app,
         loadSurface: async () => {
@@ -70,6 +76,7 @@ export async function maybeMountInspector(app: {
             return buildInspectorSurface()
         },
         cacheSnapshot: buildCacheSnapshot,
+        inFlightSnapshot: buildInFlightSnapshot,
         /*
         One process-wide tap each for the log and socket chokepoints; the
         inspector owns both and fans out to its readers. Socket frames arrive

package/src/lib/server/runtime/runWithRequestScope.ts

@@ -5,6 +5,7 @@ import { formatTraceparent } from '../../shared/formatTraceparent.ts'
 import { isStreamingResponse } from '../../shared/isStreamingResponse.ts'
 import { logClosingRecord } from '../../shared/logClosingRecord.ts'
 import type { AppModule } from '../AppModule.ts'
+import { inFlightRequests } from './inFlightRequests.ts'
 import { internalErrorResponse } from './internalErrorResponse.ts'
 import { requestContext } from './requestContext.ts'
 import type { RequestStore } from './types/RequestStore.ts'
@@ -34,6 +35,10 @@ export function runWithRequestScope(
         start: Bun.nanoseconds(),
     }
     return requestContext.run(store, async () => {
+        /* Register the live handler for the inspector's in-flight view; the Set is
+           absent (a no-op) unless the inspector mounted. Removed once the handler
+           settles — its compute is done even if a streamed body keeps piping. */
+        inFlightRequests.tracked?.add(store)
         let response: Response
         try {
             response = await body(store)
@@ -44,6 +49,8 @@ export function runWithRequestScope(
                 abideLog.error(error)
                 response = internalErrorResponse(error)
             }
+        } finally {
+            inFlightRequests.tracked?.delete(store)
         }
         /*
         Flush any cookies the handler set onto the outgoing response. Only when

package/src/lib/server/runtime/snapshotEntryFromCache.ts

@@ -1,3 +1,4 @@
+import { contentTypeOf } from '../../shared/contentTypeOf.ts'
 import { isReplayableMethod } from '../../shared/isReplayableMethod.ts'
 import { isStreamingResponse } from '../../shared/isStreamingResponse.ts'
 import type { CacheEntry } from '../../shared/types/CacheEntry.ts'
@@ -47,7 +48,7 @@ export async function snapshotEntryFromCache(
     if (isStreamingResponse(response)) {
         return undefined
     }
-    const contentType = (response.headers.get('content-type') ?? '').toLowerCase()
+    const contentType = contentTypeOf(response.headers)
     if (!isTextual(contentType)) {
         return undefined
     }

package/src/lib/server/runtime/streamFromIterator.ts

@@ -46,6 +46,14 @@ export function streamFromIterator<T>(
                     enqueue throws on a closed/errored stream, and an uncaught
                     throw in a timer crashes the process. Guard + self-stop.
                     */
+                    /*
+                    Skip the tick under backpressure: a stalled consumer leaves
+                    desiredSize <= 0, and enqueuing anyway grows the internal
+                    queue unbounded. null = no HWM set, > 0 = consumer keeping up.
+                    */
+                    if (controller.desiredSize !== null && controller.desiredSize <= 0) {
+                        return
+                    }
                     try {
                         controller.enqueue(payload)
                     } catch {

package/src/lib/server/runtime/types/InspectorContext.ts

@@ -1,5 +1,6 @@
 import type { LogRecord } from '../../../shared/types/LogRecord.ts'
 import type { InspectorCacheSnapshot } from './InspectorCacheSnapshot.ts'
+import type { InspectorInFlightSnapshot } from './InspectorInFlightSnapshot.ts'
 import type { InspectorSurface } from './InspectorSurface.ts'
 
 /*
@@ -19,6 +20,9 @@ export type InspectorContext = {
     /* Snapshots the persistent (global) cache store — current entries with their
        lifecycle state, retention, tags, and a value preview. */
     cacheSnapshot: () => InspectorCacheSnapshot
+    /* Snapshots the requests whose handler is executing right now — the live
+       counterpart to the closing records onRecord emits once a request settles. */
+    inFlightSnapshot: () => InspectorInFlightSnapshot
     /*
     Subscribes to the unified event stream: every emitted log record (the log's
     structured form, trace context and all) plus published socket frames shaped

package/src/lib/server/runtime/types/InspectorInFlightRequest.ts

@@ -0,0 +1,20 @@
+/*
+One in-flight request projected for the inspector — the serializable facts the
+In-flight tab renders for a handler that's currently executing. The held Request
+and CacheStore aren't included; what an operator wants is which request it is,
+how long it's been running, and where it landed in routing.
+*/
+export type InspectorInFlightRequest = {
+    /* The W3C trace id, so the row links to the same trace the Logs/Traces tabs group by. */
+    trace: string
+    /* HTTP method of the inbound request. */
+    method: string
+    /* Request path with query string (app-space, as logged). */
+    path: string
+    /* Ms the handler has been running, measured from scope entry to snapshot time. */
+    elapsedMs: number
+    /* The matched page route pattern, once routing has landed; undefined on rpc/socket requests or before a match. */
+    route: string | undefined
+    /* The matched route's decoded params, when a page route landed. */
+    params: Record<string, string> | undefined
+}

package/src/lib/server/runtime/types/InspectorInFlightSnapshot.ts

@@ -0,0 +1,10 @@
+import type { InspectorInFlightRequest } from './InspectorInFlightRequest.ts'
+
+/*
+The requests executing their handler at snapshot time — a point-in-time read of
+the in-flight set, the live counterpart to the closing records the Logs tab
+shows once a request settles. Empty when the server is idle.
+*/
+export type InspectorInFlightSnapshot = {
+    requests: InspectorInFlightRequest[]
+}

package/src/lib/server/runtime/types/InspectorPrompt.ts

@@ -0,0 +1,15 @@
+/*
+One declared MCP prompt projected for the inspector: the serializable facts the
+Surface tab renders. The render closure isn't included — what an operator wants
+is the prompt's name, what it's for, and the arguments it interpolates, the same
+trio `prompts/list` advertises. Prompts are MCP-only, so there are no client
+surface flags to show.
+*/
+export type InspectorPrompt = {
+    /* The prompt's name (stamped from its file path under src/mcp/prompts/). */
+    name: string
+    /* The frontmatter description, when the prompt declared one. */
+    description: string | undefined
+    /* The argument shape as JSON Schema (from the frontmatter `arguments` list); undefined when it takes none. */
+    inputSchema: Record<string, unknown> | undefined
+}

package/src/lib/server/runtime/types/InspectorSurface.ts

@@ -1,13 +1,16 @@
+import type { InspectorPrompt } from './InspectorPrompt.ts'
 import type { InspectorSocket } from './InspectorSocket.ts'
 import type { InspectorVerb } from './InspectorVerb.ts'
 
 /*
 The app's machine surface projected for the inspector — the static catalog the
-UI renders. Built by reading the verb and socket registries after they're
-eager-loaded, so a freshly-booted server lists its whole surface, not just the
-verbs hit so far. Pages stay out: they're the human surface, already navigable.
+UI renders. Built by reading the verb, socket, and prompt registries after
+they're eager-loaded, so a freshly-booted server lists its whole surface, not
+just the verbs hit so far. Pages stay out: they're the human surface, already
+navigable.
 */
 export type InspectorSurface = {
     verbs: InspectorVerb[]
     sockets: InspectorSocket[]
+    prompts: InspectorPrompt[]
 }