@inspecto-dev/plugin 0.2.0-alpha.1 → 0.2.0-alpha.2

package/dist/rollup.js

@@ -41,6 +41,10 @@ function shouldTransform(filePath, options) {
   if (filePath.includes("node_modules")) return false;
   if (filePath.startsWith("\0")) return false;
   if (/[/\\](dist|build|\.next|\.nuxt)[/\\]/.test(filePath)) return false;
+  const ext = filePath.split(".").pop()?.toLowerCase();
+  if (ext && !["js", "jsx", "ts", "tsx", "mjs", "mts", "vue"].includes(ext)) {
+    return false;
+  }
   return true;
 }
 function buildEscapeTagsSet(escapeTags) {
@@ -205,7 +209,10 @@ function transformVue(options) {
     const loc = node.loc;
     if (!loc) return;
     const { line, column } = loc.start;
-    const attrValue = formatAttrValue(normalizedPath, line, column + 1);
+    const templateStartLoc = descriptor.template.loc.start;
+    const absoluteLine = templateStartLoc.line + line - 1;
+    const absoluteColumn = line === 1 ? templateStartLoc.column + column - 1 : column;
+    const attrValue = formatAttrValue(normalizedPath, absoluteLine, absoluteColumn);
     const tagNameEnd = loc.start.offset + tagName.length + 1;
     const absoluteOffset = templateBlockStart + tagNameEnd;
     ms.appendLeft(absoluteOffset, ` ${attributeName}="${attrValue}"`);
@@ -265,9 +272,11 @@ import http from "http";
 import fs3 from "fs";
 import path6 from "path";
 import os2 from "os";
+import crypto from "crypto";
 import { execSync, execFileSync } from "child_process";
 import portfinder from "portfinder";
 import { launchIDE } from "launch-ide";
+import { INSPECTO_API_PATHS } from "@inspecto-dev/types";
 
 // src/server/snippet.ts
 import * as fs from "fs";
@@ -382,9 +391,84 @@ import fs2 from "fs";
 import path5 from "path";
 import os from "os";
 import { createDefu } from "defu";
-import { DEFAULT_TOOL_MODE, VALID_MODES } from "@inspecto-dev/types";
+import {
+  DEFAULT_PROVIDER_MODE,
+  VALID_MODES,
+  DEFAULT_INTENTS
+} from "@inspecto-dev/types";
+
+// src/utils/logger.ts
+var LOG_LEVELS = {
+  silent: 0,
+  error: 1,
+  warn: 2,
+  info: 3
+};
+function isDebugEnabled(namespace) {
+  if (typeof process === "undefined" || !process.env) return false;
+  const debugEnv = process.env.DEBUG;
+  if (!debugEnv) return false;
+  const namespaces = debugEnv.split(",").map((s) => s.trim());
+  for (const ns of namespaces) {
+    if (ns === "*") return true;
+    if (ns.endsWith("*")) {
+      const prefix = ns.slice(0, -1);
+      if (namespace.startsWith(prefix)) return true;
+    } else if (ns === namespace) {
+      return true;
+    }
+  }
+  return false;
+}
+var globalLevel = "warn";
+var registeredLoggers = /* @__PURE__ */ new Set();
+function setLoggerGlobalLevel(level) {
+  globalLevel = level;
+  for (const logger of registeredLoggers) {
+    if (logger.setLevel) {
+      logger.setLevel(level);
+    }
+  }
+}
+function createLogger(namespace, options) {
+  let currentLevel = options?.logLevel ?? globalLevel;
+  let numericLevel = LOG_LEVELS[currentLevel] ?? 2;
+  const debugEnabled = isDebugEnabled(namespace);
+  const logger = {
+    setLevel(level) {
+      currentLevel = level;
+      numericLevel = LOG_LEVELS[level] ?? 2;
+    },
+    info(msg, ...args) {
+      if (numericLevel >= LOG_LEVELS.info) {
+        console.log(`\x1B[36m[inspecto]\x1B[0m ${msg}`, ...args);
+      }
+    },
+    warn(msg, ...args) {
+      if (numericLevel >= LOG_LEVELS.warn) {
+        console.warn(`\x1B[33m[inspecto] WARN:\x1B[0m ${msg}`, ...args);
+      }
+    },
+    error(msg, ...args) {
+      if (numericLevel >= LOG_LEVELS.error) {
+        console.error(`\x1B[31m[inspecto] ERROR:\x1B[0m ${msg}`, ...args);
+      }
+    },
+    debug(msg, ...args) {
+      if (debugEnabled) {
+        console.log(`\x1B[90m[${namespace}]\x1B[0m ${msg}`, ...args);
+      }
+    }
+  };
+  registeredLoggers.add(logger);
+  return logger;
+}
+
+// src/config.ts
+var configLogger = createLogger("inspecto:config");
 var loadedConfig = null;
 var loadedPrompts = null;
+var globalLogLevel = "warn";
 var isWatching = false;
 var arrayReplaceMerge = createDefu((obj, key, val) => {
   if (Array.isArray(val)) {
@@ -392,6 +476,15 @@ var arrayReplaceMerge = createDefu((obj, key, val) => {
     return true;
   }
 });
+function setGlobalLogLevel(level) {
+  if (level) {
+    globalLogLevel = level;
+    setLoggerGlobalLevel(level);
+  }
+}
+function getGlobalLogLevel() {
+  return globalLogLevel;
+}
 function resolveConfigRoots(cwd, gitRoot) {
   const roots = [];
   let current = cwd;
@@ -421,7 +514,7 @@ function loadUserConfigSync(force = false, cwd = process.cwd(), gitRoot) {
     layers.push(readJsonSafely(path5.join(root, ".inspecto", "settings.json")));
   }
   layers.push(readJsonSafely(path5.join(os.homedir(), ".inspecto", "settings.json")));
-  layers.push({ providers: {} });
+  layers.push({});
   const validLayers = layers.filter((l) => l !== null);
   loadedConfig = arrayReplaceMerge(...validLayers);
   return loadedConfig;
@@ -464,50 +557,147 @@ function readJsonSafely(filePath) {
     }
   } catch (e) {
     if (e instanceof SyntaxError) {
-      console.warn(`[inspecto] Failed to parse config at ${filePath}: Invalid JSON`);
+      configLogger.warn(`Failed to parse config at ${filePath}: Invalid JSON`);
     } else {
-      console.warn(`[inspecto] Failed to read config at ${filePath}:`, e);
+      configLogger.warn(`Failed to read config at ${filePath}:`, e);
     }
   }
   return null;
 }
-function resolveTargetTool(config) {
-  if (config.prefer) {
-    return config.prefer;
+function resolveTargetTool(config, ide = "vscode") {
+  const defaultProvider = config["provider.default"];
+  if (defaultProvider) {
+    const tool = defaultProvider.split(".")[0];
+    return tool;
   }
-  if (config.providers && Object.keys(config.providers).length > 0) {
-    return Object.keys(config.providers)[0];
-  }
-  return "github-copilot";
+  return "copilot";
 }
-function resolveToolMode(tool, ide, config) {
+function resolveProviderMode(tool, ide, config) {
   let requestedType = void 0;
-  if (config.providers && config.providers[tool] && config.providers[tool].type) {
-    const type = config.providers[tool].type;
-    if (type === "plugin" || type === "cli") {
-      requestedType = type;
-    }
+  const defaultProvider = config["provider.default"];
+  if (defaultProvider && defaultProvider.startsWith(`${tool}.`)) {
+    const mode = defaultProvider.split(".")[1];
+    if (mode === "extension") requestedType = "extension";
+    if (mode === "cli") requestedType = "cli";
   }
-  requestedType = requestedType ?? DEFAULT_TOOL_MODE[tool];
-  const valid = VALID_MODES[tool] || [DEFAULT_TOOL_MODE[tool]];
+  requestedType = requestedType ?? DEFAULT_PROVIDER_MODE[tool];
+  const valid = VALID_MODES[tool] || [DEFAULT_PROVIDER_MODE[tool]];
   return requestedType && valid.includes(requestedType) ? requestedType : valid[0];
 }
 function extractToolOverrides(ide, config) {
   const result = {};
-  if (!config.providers) return result;
-  for (const [tool, cfg] of Object.entries(config.providers)) {
-    if (!cfg) continue;
-    const overrides = {
-      type: cfg.type || DEFAULT_TOOL_MODE[tool] || "plugin"
-    };
-    if (cfg.bin) overrides.binaryPath = cfg.bin;
-    if (cfg.args) overrides.args = cfg.args;
-    if (cfg.cwd) overrides.cwd = cfg.cwd;
-    if (cfg.autoSend !== void 0) overrides.autoSend = cfg.autoSend;
-    result[tool] = overrides;
+  if (!config) return result;
+  for (const [key, value] of Object.entries(config)) {
+    if (!key.startsWith("provider.")) continue;
+    if (key === "provider.default") continue;
+    const toolIndex = 1;
+    const modeIndex = 2;
+    const propIndex = 3;
+    const parts = key.split(".");
+    if (parts.length >= propIndex + 1) {
+      const tool = parts[toolIndex];
+      const mode = parts[modeIndex];
+      const prop = parts[propIndex];
+      if (!result[tool]) {
+        result[tool] = { type: mode };
+      }
+      const overrides = result[tool];
+      if (prop === "bin") overrides.binaryPath = value;
+      if (prop === "args") overrides.args = value;
+      if (prop === "cwd") overrides.cwd = value;
+      if (prop === "coldStartDelay") overrides.coldStartDelay = value;
+    }
   }
   return result;
 }
+function resolveIntents(serverPrompts) {
+  const baseMap = /* @__PURE__ */ new Map();
+  for (const intent of DEFAULT_INTENTS) {
+    if (intent.id) baseMap.set(intent.id, { ...intent });
+  }
+  const defaults = () => ensureOpenInEditorLast(Array.from(baseMap.values()));
+  if (!serverPrompts) return defaults();
+  const isReplace = !Array.isArray(serverPrompts) && typeof serverPrompts === "object" && serverPrompts.$replace === true;
+  const promptsArray = Array.isArray(serverPrompts) ? serverPrompts : isReplace ? serverPrompts.items : [];
+  if (!promptsArray || promptsArray.length === 0) return defaults();
+  if (isReplace) {
+    const result = [];
+    for (const item of promptsArray) {
+      if (typeof item === "string") {
+        if (baseMap.has(item)) {
+          result.push(baseMap.get(item));
+        } else {
+          configLogger.warn(
+            `Unknown built-in intent id: "${item}". Available: ${[...baseMap.keys()].join(", ")}`
+          );
+        }
+      } else if (typeof item === "object") {
+        if (!item.id) {
+          configLogger.warn('Intent object missing required "id" field, skipping.');
+          continue;
+        }
+        if (item.enabled === false) {
+          configLogger.warn(
+            `Intent "${item.id}" is listed in $replace but has enabled:false \u2014 it will be excluded.`
+          );
+          continue;
+        }
+        if (item.isAction && item.id !== "open-in-editor") {
+          configLogger.warn(
+            `isAction is reserved for built-in actions. Ignoring intent "${item.id}".`
+          );
+          continue;
+        }
+        result.push(baseMap.has(item.id) ? { ...baseMap.get(item.id), ...item } : item);
+      }
+    }
+    return ensureOpenInEditorLast(result);
+  }
+  const merged = Array.from(baseMap.values());
+  for (const item of promptsArray) {
+    if (typeof item === "string") {
+      if (!baseMap.has(item)) {
+        configLogger.warn(
+          `Unknown built-in intent id: "${item}". In append mode, strings have no effect on ordering \u2014 use $replace to control order.`
+        );
+      }
+      continue;
+    }
+    if (typeof item === "object") {
+      if (!item.id) {
+        configLogger.warn('Intent object missing required "id" field, skipping.');
+        continue;
+      }
+      if (item.isAction && item.id !== "open-in-editor") {
+        configLogger.warn(
+          `isAction is reserved for built-in actions. Ignoring intent "${item.id}".`
+        );
+        continue;
+      }
+      const existingIdx = merged.findIndex((i) => i.id === item.id);
+      if (existingIdx !== -1) {
+        if (item.enabled === false) {
+          merged.splice(existingIdx, 1);
+        } else {
+          merged[existingIdx] = { ...merged[existingIdx], ...item };
+        }
+      } else {
+        if (item.enabled !== false) {
+          merged.push(item);
+        }
+      }
+    }
+  }
+  return ensureOpenInEditorLast(merged);
+}
+function ensureOpenInEditorLast(intents) {
+  const idx = intents.findIndex((i) => i.id === "open-in-editor");
+  if (idx === -1 || idx === intents.length - 1) return intents;
+  const result = [...intents];
+  const item = result.splice(idx, 1)[0];
+  result.push(item);
+  return result;
+}
 var watchers = [];
 function watchConfig(onReload, cwd = process.cwd(), gitRoot) {
   if (isWatching) return;
@@ -542,6 +732,19 @@ function watchConfig(onReload, cwd = process.cwd(), gitRoot) {
 }
 
 // src/server/index.ts
+var serverLogger = createLogger("inspecto:server", { logLevel: getGlobalLogLevel() });
+var payloadTickets = /* @__PURE__ */ new Map();
+function createTicket(payload) {
+  const ticketId = crypto.randomUUID();
+  payloadTickets.set(ticketId, JSON.stringify(payload));
+  setTimeout(
+    () => {
+      payloadTickets.delete(ticketId);
+    },
+    5 * 60 * 1e3
+  );
+  return ticketId;
+}
 var serverState = {
   port: null,
   running: false,
@@ -553,8 +756,11 @@ var serverInstance = null;
 function resolveProjectRoot() {
   let gitRoot;
   try {
+    serverLogger.info("Resolving project root...");
     gitRoot = execSync("git rev-parse --show-toplevel", { encoding: "utf-8" }).trim();
-  } catch {
+    serverLogger.info("Resolved project root: " + gitRoot);
+  } catch (e) {
+    serverLogger.error("Failed to resolve project root:", e);
     gitRoot = process.cwd();
   }
   let current = gitRoot;
@@ -576,7 +782,7 @@ function launchURI(uri) {
       execFileSync("xdg-open", [uri]);
     }
   } catch (e) {
-    console.error("[inspecto] Failed to launch URI via execFileSync, falling back to launchIDE:", e);
+    serverLogger.error("Failed to launch URI via execFileSync, falling back to launchIDE:", e);
     launchIDE({ file: uri });
   }
 }
@@ -591,7 +797,7 @@ async function startServer() {
   const port = await portfinder.getPortPromise();
   watchConfig(
     () => {
-      console.log("[inspecto] user config reloaded.");
+      serverLogger.info("user config reloaded.");
     },
     serverState.cwd,
     serverState.configRoot
@@ -607,7 +813,7 @@ async function startServer() {
     }
     const url = new URL(req.url ?? "/", `http://localhost:${port}`);
     handleRequest(url, req, res).catch((err) => {
-      console.error("[inspecto] server error:", err);
+      serverLogger.error("server error:", err);
       res.writeHead(500, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ success: false, error: String(err) }));
     });
@@ -620,22 +826,41 @@ async function startServer() {
     serverInstance.once("error", reject);
   });
   serverInstance.on("error", (err) => {
-    console.error("[inspecto] persistent server error:", err);
+    serverLogger.error("persistent server error:", err);
   });
   serverState.port = port;
   serverState.running = true;
-  const portFile = path6.join(os2.tmpdir(), "inspecto.port");
+  const portFile = path6.join(os2.tmpdir(), "inspecto.port.json");
   try {
-    fs3.writeFileSync(portFile, String(port), "utf-8");
-  } catch {
+    let portData = {};
+    if (fs3.existsSync(portFile)) {
+      try {
+        portData = JSON.parse(fs3.readFileSync(portFile, "utf-8"));
+      } catch (e) {
+      }
+    }
+    const rootHash = crypto.createHash("md5").update(serverState.projectRoot).digest("hex");
+    portData[rootHash] = port;
+    fs3.writeFileSync(portFile, JSON.stringify(portData, null, 2), "utf-8");
+  } catch (e) {
+    serverLogger.warn("Failed to write port file:", e);
   }
   process.once("exit", () => {
     try {
-      fs3.unlinkSync(portFile);
+      if (fs3.existsSync(portFile)) {
+        const portData = JSON.parse(fs3.readFileSync(portFile, "utf-8"));
+        const rootHash = crypto.createHash("md5").update(serverState.projectRoot).digest("hex");
+        delete portData[rootHash];
+        if (Object.keys(portData).length === 0) {
+          fs3.unlinkSync(portFile);
+        } else {
+          fs3.writeFileSync(portFile, JSON.stringify(portData, null, 2), "utf-8");
+        }
+      }
     } catch {
     }
   });
-  console.log(`[inspecto] server running at http://127.0.0.1:${port}`);
+  serverLogger.info(`server running at http://127.0.0.1:${port}`);
   return port;
 }
 async function readBody(req) {
@@ -648,66 +873,63 @@ async function readBody(req) {
 }
 async function handleRequest(url, req, res) {
   const pathname = url.pathname;
-  if (pathname === "/health" && req.method === "GET") {
+  if ((pathname === "/health" || pathname === INSPECTO_API_PATHS.HEALTH) && req.method === "GET") {
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ ok: true, port: serverState.port }));
     return;
   }
-  if (pathname === "/config" && req.method === "GET") {
+  if (pathname === INSPECTO_API_PATHS.CLIENT_CONFIG && req.method === "GET") {
     const userConfig = loadUserConfigSync(false, serverState.cwd, serverState.configRoot);
     const promptsConfig = await loadPromptsConfig(false, serverState.cwd, serverState.configRoot);
     const effectiveIde = userConfig.ide ?? "vscode";
     let info;
     if (!serverState.ideInfo) {
-      const fallbackTargets = userConfig.providers ? Object.keys(userConfig.providers) : ["claude-code", "gemini", "coco", "codex"];
       info = {
-        ide: effectiveIde,
-        providers: fallbackTargets.reduce(
-          (acc, target) => {
-            acc[target] = {
-              mode: resolveToolMode(target, effectiveIde, userConfig),
-              installed: false
-            };
-            return acc;
-          },
-          {}
-        )
+        ide: effectiveIde
       };
     } else {
       const { scheme: _scheme, ...rest } = serverState.ideInfo;
       info = rest;
     }
-    const resolvedProviders = { ...info.providers };
-    for (const tool in resolvedProviders) {
-      resolvedProviders[tool].mode = resolveToolMode(tool, info.ide, userConfig);
-    }
     const config = {
       ...info,
-      providers: resolvedProviders,
-      providerOverrides: extractToolOverrides(info.ide, userConfig),
-      prompts: promptsConfig,
-      hotKeys: userConfig.hotKeys,
-      includeSnippet: userConfig.includeSnippet
+      prompts: resolveIntents(promptsConfig),
+      hotKeys: userConfig["inspector.hotKey"] ?? "alt",
+      theme: userConfig["inspector.theme"] ?? "auto",
+      includeSnippet: userConfig["prompt.includeSnippet"] ?? false,
+      autoSend: userConfig["prompt.autoSend"] ?? false
     };
+    delete config.providers;
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(JSON.stringify(config));
     return;
   }
-  if (pathname === "/config" && req.method === "POST") {
+  if (pathname === INSPECTO_API_PATHS.IDE_INFO && req.method === "POST") {
     try {
       const body = JSON.parse(await readBody(req));
-      serverState.ideInfo = body;
-      console.log(`[inspecto] Received IDE info from extension:`, body);
+      const ideWorkspace = body.workspaceRoot || "";
+      const serverProjectRoot = serverState.projectRoot || "";
+      const isSameProject = !ideWorkspace || !serverProjectRoot || ideWorkspace === serverProjectRoot || serverProjectRoot.startsWith(ideWorkspace);
+      if (isSameProject) {
+        serverState.ideInfo = body;
+        serverLogger.debug(
+          `Accepted IDE info from matched workspace (ide-${body.ide} / schema-${body.scheme})`
+        );
+      } else {
+        serverLogger.debug(
+          `Ignored IDE info from unrelated workspace (IDE Workspace: ${ideWorkspace}, Server: ${serverProjectRoot}, Scheme: ${body.scheme}, IDE: ${body.ide})`
+        );
+      }
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ success: true }));
     } catch (e) {
-      console.error("[inspecto] Error parsing /config POST request:", e);
+      serverLogger.error(`Error parsing ${INSPECTO_API_PATHS.IDE_INFO} POST request:`, e);
       res.writeHead(400, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: "Invalid JSON body" }));
     }
     return;
   }
-  if (pathname === "/open" && req.method === "POST") {
+  if (pathname === INSPECTO_API_PATHS.IDE_OPEN && req.method === "POST") {
     let body;
     try {
       body = JSON.parse(await readBody(req));
@@ -716,28 +938,98 @@ async function handleRequest(url, req, res) {
       res.end(JSON.stringify({ error: "Invalid JSON body" }));
       return;
     }
-    const absolutePath = path6.isAbsolute(body.file) ? body.file : path6.resolve(serverState.cwd, body.file);
+    const absolutePath = path6.isAbsolute(body.file) ? path6.resolve(body.file) : path6.resolve(serverState.cwd, body.file);
+    const relativeToRoot = path6.relative(serverState.projectRoot, absolutePath);
+    if (relativeToRoot.startsWith("..") || path6.isAbsolute(relativeToRoot)) {
+      serverLogger.warn(`Security: Blocked path traversal attempt in IDE_OPEN: ${body.file}`);
+      res.writeHead(403, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Access denied: File is outside of project workspace" }));
+      return;
+    }
     const userConfig = loadUserConfigSync(false, serverState.cwd, serverState.configRoot);
-    const ide = userConfig.ide ?? "vscode";
-    const editorHint = "code";
-    launchIDE({
-      file: absolutePath,
-      line: body.line,
-      column: body.column,
-      editor: editorHint,
-      type: process.platform === "darwin" ? "open" : "exec"
-    });
+    const configuredIde = userConfig.ide;
+    const activeIde = serverState.ideInfo?.ide;
+    const activeIdeScheme = serverState.ideInfo?.scheme;
+    const rawEditorHint = configuredIde || activeIde || activeIdeScheme || "code";
+    if (configuredIde && activeIdeScheme && !activeIdeScheme.includes(configuredIde)) {
+      serverLogger.warn(
+        `Active IDE is ${activeIdeScheme}, but config forces ${configuredIde}. Using configured IDE.`
+      );
+    }
+    let editorHint = rawEditorHint;
+    if (rawEditorHint === "vscode") editorHint = "code";
+    else if (rawEditorHint === "vscode-insiders") editorHint = "code-insiders";
+    else if (rawEditorHint === "vscodium") editorHint = "codium";
+    else if (rawEditorHint === "trae-cn" || rawEditorHint === "trae") editorHint = "trae";
+    serverLogger.debug(
+      `IDE_OPEN: activeIde=${activeIde}, activeIdeScheme=${activeIdeScheme}, configuredIde=${configuredIde} -> rawEditorHint=${rawEditorHint}, finalEditorHint=${editorHint}`
+    );
+    const VSCODE_FAMILY_SCHEMES = [
+      "vscode",
+      "vscode-insiders",
+      "cursor",
+      "windsurf",
+      "trae",
+      "trae-cn",
+      "vscodium",
+      "codebuddy",
+      "codebuddy-cn",
+      "antigravity"
+    ];
+    if (VSCODE_FAMILY_SCHEMES.includes(rawEditorHint)) {
+      const uri = `${rawEditorHint}://file${absolutePath}:${body.line}:${body.column}`;
+      serverLogger.debug(`IDE_OPEN: Bypassing launchIDE, using URI scheme directly: ${uri}`);
+      try {
+        if (process.platform === "darwin") {
+          execFileSync("open", [uri]);
+        } else if (process.platform === "win32") {
+          execFileSync("cmd", ["/c", "start", '""', uri]);
+        } else {
+          execFileSync("xdg-open", [uri]);
+        }
+      } catch (e) {
+        serverLogger.error(`Failed to launch URI for IDE_OPEN (${uri}):`, e);
+        launchIDE({
+          file: absolutePath,
+          line: body.line,
+          column: body.column,
+          editor: editorHint,
+          type: process.platform === "darwin" ? "open" : "exec"
+        });
+      }
+    } else {
+      launchIDE({
+        file: absolutePath,
+        line: body.line,
+        column: body.column,
+        editor: editorHint,
+        type: process.platform === "darwin" ? "open" : "exec"
+      });
+    }
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ success: true }));
     return;
   }
-  if (pathname === "/snippet" && req.method === "GET") {
+  if (pathname === INSPECTO_API_PATHS.PROJECT_SNIPPET && req.method === "GET") {
     const file = url.searchParams.get("file") ?? "";
     const line = parseInt(url.searchParams.get("line") ?? "1", 10);
     const column = parseInt(url.searchParams.get("column") ?? "1", 10);
     const maxLines = parseInt(url.searchParams.get("maxLines") ?? "100", 10);
     try {
-      const absolutePath = path6.isAbsolute(file) ? file : path6.resolve(serverState.cwd, file);
+      const absolutePath = path6.isAbsolute(file) ? path6.resolve(file) : path6.resolve(serverState.cwd, file);
+      const relativeToRoot = path6.relative(serverState.projectRoot, absolutePath);
+      if (relativeToRoot.startsWith("..") || path6.isAbsolute(relativeToRoot)) {
+        serverLogger.warn(`Security: Blocked path traversal attempt in PROJECT_SNIPPET: ${file}`);
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            success: false,
+            error: "Access denied: File is outside of project workspace",
+            errorCode: "FORBIDDEN"
+          })
+        );
+        return;
+      }
       const result = await extractSnippet({ file: absolutePath, line, column, maxLines });
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify(result));
@@ -749,7 +1041,7 @@ async function handleRequest(url, req, res) {
     }
     return;
   }
-  if (pathname === "/send-to-ai" && req.method === "POST") {
+  if (pathname === INSPECTO_API_PATHS.AI_DISPATCH && req.method === "POST") {
     try {
       const rawBody = await readBody(req);
       const body = JSON.parse(rawBody);
@@ -757,19 +1049,30 @@ async function handleRequest(url, req, res) {
       res.writeHead(result.success ? 200 : 500, { "Content-Type": "application/json" });
       res.end(JSON.stringify(result));
     } catch (e) {
-      console.error("[inspecto] Error parsing /send-to-ai request:", e);
+      serverLogger.error(`Error parsing ${INSPECTO_API_PATHS.AI_DISPATCH} request:`, e);
       res.writeHead(500, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ success: false, error: String(e), errorCode: "INTERNAL_ERROR" }));
     }
     return;
   }
+  if (pathname.startsWith(`${INSPECTO_API_PATHS.AI_TICKET}/`) && req.method === "GET") {
+    const ticketId = pathname.substring(INSPECTO_API_PATHS.AI_TICKET.length + 1);
+    const payloadStr = payloadTickets.get(ticketId);
+    if (!payloadStr) {
+      res.writeHead(404, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ success: false, error: "Ticket not found or expired" }));
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(payloadStr);
+    return;
+  }
   res.writeHead(404, { "Content-Type": "application/json" });
   res.end(JSON.stringify({ error: "not found" }));
 }
 async function dispatchToAi(req) {
   const { location, snippet, prompt } = req;
   const userConfig = loadUserConfigSync(false, serverState.cwd, serverState.configRoot);
-  const ide = userConfig.ide ?? "vscode";
   const resolvedTarget = resolveTargetTool(userConfig);
   const formattedPrompt = prompt ?? `Please help me with this code from \`${location.file}\` (line ${location.line}):
 
@@ -777,22 +1080,45 @@ async function dispatchToAi(req) {
 ${snippet}
 \`\`\`
 `;
+  const ideReportedMode = serverState.ideInfo?.providers[resolvedTarget]?.mode;
+  const configuredIde = userConfig.ide;
+  const activeIde = serverState.ideInfo?.ide;
+  const activeIdeScheme = serverState.ideInfo?.scheme;
+  const finalIde = configuredIde || activeIdeScheme || activeIde || "vscode";
+  if (configuredIde && activeIdeScheme && !activeIdeScheme.includes(configuredIde)) {
+    serverLogger.warn(
+      `dispatchToAi: Active IDE is ${activeIdeScheme}, but config forces ${configuredIde}. Using configured IDE.`
+    );
+  }
+  const mode = resolveProviderMode(resolvedTarget, finalIde, userConfig);
+  const overrides = extractToolOverrides(finalIde, userConfig)[resolvedTarget] || {};
+  overrides.type = mode;
+  const fullPayload = {
+    ide: finalIde,
+    target: resolvedTarget,
+    targetType: mode,
+    prompt: formattedPrompt,
+    filePath: location.file,
+    line: location.line,
+    column: location.column,
+    snippet,
+    overrides: Object.keys(overrides).length > 0 ? overrides : void 0,
+    autoSend: userConfig["prompt.autoSend"] !== void 0 ? Boolean(userConfig["prompt.autoSend"]) : void 0
+  };
+  const ticketId = createTicket(fullPayload);
   const params = new URLSearchParams();
+  params.set("ticket", ticketId);
   params.set("target", resolvedTarget);
-  const overrides = extractToolOverrides(ide, userConfig)[resolvedTarget];
-  if (overrides) {
-    params.set("overrides", JSON.stringify(overrides));
-  }
-  params.set("prompt", formattedPrompt);
-  params.set("file", location.file);
-  params.set("line", String(location.line));
-  params.set("col", String(location.column));
-  params.set("snippet", snippet);
-  const scheme = serverState.ideInfo?.scheme || "vscode";
-  const uri = `${scheme}://inspecto.inspecto/send?${params.toString()}`;
-  console.log(`[inspecto] dispatchToAi: Generated URI: ${uri}`);
+  const uri = `${finalIde}://inspecto.inspecto/send?${params.toString()}`;
+  serverLogger.debug(`dispatchToAi: Generated URI: ${uri}`);
   launchURI(uri);
-  return { success: true };
+  return {
+    success: true,
+    fallbackPayload: {
+      prompt: formattedPrompt,
+      file: location.file
+    }
+  };
 }
 
 // src/injectors/utils.ts
@@ -848,9 +1174,11 @@ if (typeof window !== 'undefined') {
 }
 function injectWebpack(compiler, serverPortFn, resolveClientModule2) {
   const inspectoClientPath = resolveClientModule2();
-  new compiler.webpack.EntryPlugin(compiler.context, inspectoClientPath, { name: void 0 }).apply(
-    compiler
-  );
+  if (compiler.webpack && compiler.webpack.EntryPlugin) {
+    new compiler.webpack.EntryPlugin(compiler.context, inspectoClientPath, {
+      name: void 0
+    }).apply(compiler);
+  }
   compiler.hooks.compilation.tap("inspecto-overlay", (compilation) => {
     const HtmlWebpackPlugin = compiler.options.plugins.find(
       (p) => p && p.constructor && p.constructor.name === "HtmlWebpackPlugin"
@@ -932,7 +1260,8 @@ var DEFAULT_OPTIONS = {
   exclude: [],
   escapeTags: [],
   pathType: "absolute",
-  attributeName: "data-inspecto"
+  attributeName: "data-inspecto",
+  logLevel: "warn"
 };
 var DEFAULT_PORT = 5678;
 var getCleanId = (id) => id.split("?")[0];
@@ -941,6 +1270,8 @@ var InspectoPlugin = createUnplugin((userOptions = {}) => {
     ...DEFAULT_OPTIONS,
     ...userOptions
   };
+  setGlobalLogLevel(options.logLevel);
+  const pluginLogger = createLogger("inspecto:plugin", { logLevel: options.logLevel });
   const isProduction = process.env["NODE_ENV"] === "production";
   let projectRoot = process.cwd();
   let serverPort = null;
@@ -956,7 +1287,7 @@ var InspectoPlugin = createUnplugin((userOptions = {}) => {
     buildStart() {
       if (isProduction) return;
       projectRoot = serverState.cwd || process.cwd();
-      ensureServer().catch(console.error);
+      ensureServer().catch((err) => pluginLogger.error("Failed to start server:", err));
     },
     buildEnd() {
     },