@massa-ai/mcp-client 1.35.1 → 1.37.0

package/dist/config-cli.js

@@ -1162,7 +1162,8 @@ var init_config = __esm(() => {
     },
     logging: {
       level: process.env.LOG_LEVEL || fileConfig.logging?.level || "info",
-      enableMetrics: process.env.ENABLE_METRICS === "true" || process.env.ENABLE_METRICS === undefined && !!fileConfig.logging?.enableMetrics
+      enableMetrics: process.env.ENABLE_METRICS === "true" || process.env.ENABLE_METRICS === undefined && !!fileConfig.logging?.enableMetrics,
+      file: process.env.MASSA_AI_LOG_FILE || fileConfig.logging?.file || undefined
     },
     synapse: {
       enabled: process.env.SYNAPSE_ENABLED !== "false",
@@ -1316,20 +1317,25 @@ var init_types = __esm(() => {
 var init_interfaces = () => {};
 
 // ../../packages/shared/dist/utils/logger.js
+import fs2 from "fs";
+
 class Logger {
   _level;
   _enableMetrics;
+  _logFilePath;
   _initialized = false;
   constructor() {}
   ensureInitialized() {
     if (!this._initialized) {
       try {
-        const configLevel = config.get("logging").level;
-        this._level = this.parseLogLevel(configLevel);
-        this._enableMetrics = config.get("logging").enableMetrics;
+        const loggingConfig = config.get("logging");
+        this._level = this.parseLogLevel(loggingConfig.level);
+        this._enableMetrics = loggingConfig.enableMetrics;
+        this._logFilePath = loggingConfig.file;
       } catch {
         this._level = LogLevel.INFO;
         this._enableMetrics = false;
+        this._logFilePath = undefined;
       }
       this._initialized = true;
     }
@@ -1342,6 +1348,10 @@ class Logger {
     this.ensureInitialized();
     return this._enableMetrics;
   }
+  get logFilePath() {
+    this.ensureInitialized();
+    return this._logFilePath;
+  }
   parseLogLevel(level) {
     const levels = {
       debug: LogLevel.DEBUG,
@@ -1361,6 +1371,13 @@ class Logger {
   }
   write(message, _level) {
     console.error(message);
+    const filePath = this.logFilePath;
+    if (filePath) {
+      try {
+        fs2.appendFileSync(filePath, message + `
+`);
+      } catch {}
+    }
   }
   debug(message, meta) {
     if (this.shouldLog(LogLevel.DEBUG)) {
@@ -1770,7 +1787,7 @@ var init_hosts = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/state.js
-import fs2 from "fs";
+import fs3 from "fs";
 import path6 from "path";
 function namedError(name, message) {
   const err = new InstallStateError(message);
@@ -1797,7 +1814,7 @@ function validateShape(raw2, filePath) {
 function readInstallState(filePath) {
   let text;
   try {
-    text = fs2.readFileSync(filePath, "utf-8");
+    text = fs3.readFileSync(filePath, "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT")
@@ -1817,8 +1834,8 @@ function writeInstallState(filePath, state) {
   const text = `${JSON.stringify(validated, null, 2)}
 `;
   try {
-    fs2.mkdirSync(path6.dirname(filePath), { recursive: true });
-    fs2.writeFileSync(filePath, text);
+    fs3.mkdirSync(path6.dirname(filePath), { recursive: true });
+    fs3.writeFileSync(filePath, text);
   } catch (err) {
     throw UnwritableInstallStateError(filePath, err.message);
   }
@@ -1845,7 +1862,7 @@ var init_state = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/lock.js
-import fs3 from "fs";
+import fs4 from "fs";
 import path7 from "path";
 import os4 from "os";
 import crypto3 from "crypto";
@@ -1858,7 +1875,7 @@ function namedError2(name, message) {
 function readOwner(ownerPath) {
   let raw2;
   try {
-    raw2 = JSON.parse(fs3.readFileSync(ownerPath, "utf-8"));
+    raw2 = JSON.parse(fs4.readFileSync(ownerPath, "utf-8"));
   } catch {
     return null;
   }
@@ -1874,7 +1891,7 @@ function releaseIfOwned(lockDir, ownerPath, token) {
   const owner = readOwner(ownerPath);
   if (owner === null || owner.token !== token)
     return;
-  fs3.rmSync(lockDir, { recursive: true, force: true });
+  fs4.rmSync(lockDir, { recursive: true, force: true });
 }
 function acquireLock(stateFilePath, options = {}) {
   const lockDir = `${stateFilePath}.switch.lock`;
@@ -1883,11 +1900,11 @@ function acquireLock(stateFilePath, options = {}) {
   const identity = options.identity ?? DEFAULT_IDENTITY;
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
   const createFresh = () => {
-    fs3.mkdirSync(lockDir);
+    fs4.mkdirSync(lockDir);
     const pid = identity.pid();
     const startedAt = identity.processStart(pid);
     if (startedAt == null) {
-      fs3.rmSync(lockDir, { recursive: true, force: true });
+      fs4.rmSync(lockDir, { recursive: true, force: true });
       throw LockAcquireError(lockDir, "could not determine this process's start-time identity");
     }
     const token = crypto3.randomUUID();
@@ -1898,8 +1915,8 @@ function acquireLock(stateFilePath, options = {}) {
       token,
       timestamp: clock.now()
     };
-    fs3.mkdirSync(path7.dirname(ownerPath), { recursive: true });
-    fs3.writeFileSync(ownerPath, JSON.stringify(record));
+    fs4.mkdirSync(path7.dirname(ownerPath), { recursive: true });
+    fs4.writeFileSync(ownerPath, JSON.stringify(record));
     return { lockDir, release: () => releaseIfOwned(lockDir, ownerPath, token) };
   };
   try {
@@ -1914,11 +1931,11 @@ function acquireLock(stateFilePath, options = {}) {
     throw LockHeldError(lockDir);
   const reclaimDir = `${lockDir}.reclaim.${owner.token}`;
   try {
-    fs3.renameSync(lockDir, reclaimDir);
+    fs4.renameSync(lockDir, reclaimDir);
   } catch {
     throw LockHeldError(lockDir);
   }
-  fs3.rmSync(reclaimDir, { recursive: true, force: true });
+  fs4.rmSync(reclaimDir, { recursive: true, force: true });
   try {
     return createFresh();
   } catch {
@@ -1952,7 +1969,7 @@ var init_lock = __esm(() => {
 });
 
 // ../../packages/shared/dist/profile-switch/engine.js
-import fs4 from "fs";
+import fs5 from "fs";
 import path8 from "path";
 import os5 from "os";
 import crypto4 from "crypto";
@@ -1986,7 +2003,7 @@ function listProfiles(opts = {}) {
         availableProfiles: []
       };
     }
-    const installed = fs4.existsSync(layout.activeDir);
+    const installed = fs5.existsSync(layout.activeDir);
     const availableProfiles = listVariantProfiles(layout);
     const platform = state.platforms[host];
     return {
@@ -2002,9 +2019,9 @@ function listProfiles(opts = {}) {
   return { hosts };
 }
 function listVariantProfiles(layout) {
-  if (!fs4.existsSync(layout.variantsRoot))
+  if (!fs5.existsSync(layout.variantsRoot))
     return [];
-  return fs4.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  return fs5.readdirSync(layout.variantsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
 }
 function matchesGlob(filename, glob) {
   const starIdx = glob.indexOf("*");
@@ -2017,32 +2034,32 @@ function matchesGlob(filename, glob) {
 function assertStateWritable(stateFilePath) {
   const dir = path8.dirname(stateFilePath);
   try {
-    fs4.mkdirSync(dir, { recursive: true });
+    fs5.mkdirSync(dir, { recursive: true });
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
-  const checkPath = fs4.existsSync(stateFilePath) ? stateFilePath : dir;
+  const checkPath = fs5.existsSync(stateFilePath) ? stateFilePath : dir;
   try {
-    fs4.accessSync(checkPath, fs4.constants.W_OK);
+    fs5.accessSync(checkPath, fs5.constants.W_OK);
   } catch (err) {
     throw UnwritableInstallStateError(stateFilePath, err.message);
   }
 }
 function copyFileRouteVariant(layout, variantDir) {
-  fs4.mkdirSync(layout.activeDir, { recursive: true });
+  fs5.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs4.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs5.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
-    fs4.copyFileSync(path8.join(variantDir, entry.name), path8.join(layout.activeDir, entry.name));
+    fs5.copyFileSync(path8.join(variantDir, entry.name), path8.join(layout.activeDir, entry.name));
     changed++;
   }
   return changed;
 }
 function repointOpencodeVariant(layout, variantDir) {
-  fs4.mkdirSync(layout.activeDir, { recursive: true });
+  fs5.mkdirSync(layout.activeDir, { recursive: true });
   let changed = 0;
-  for (const entry of fs4.readdirSync(variantDir, { withFileTypes: true })) {
+  for (const entry of fs5.readdirSync(variantDir, { withFileTypes: true })) {
     if (!entry.isFile() || !matchesGlob(entry.name, layout.activeGlob))
       continue;
     const dest = path8.join(layout.activeDir, entry.name);
@@ -2050,15 +2067,15 @@ function repointOpencodeVariant(layout, variantDir) {
     let destExists = true;
     let destIsSymlink = false;
     try {
-      destIsSymlink = fs4.lstatSync(dest).isSymbolicLink();
+      destIsSymlink = fs5.lstatSync(dest).isSymbolicLink();
     } catch {
       destExists = false;
     }
     if (destExists && !destIsSymlink)
       continue;
     const tmp = `${dest}.massa-ai-switch.${crypto4.randomUUID()}`;
-    fs4.symlinkSync(target, tmp);
-    fs4.renameSync(tmp, dest);
+    fs5.symlinkSync(target, tmp);
+    fs5.renameSync(tmp, dest);
     changed++;
   }
   return changed;
@@ -2080,13 +2097,13 @@ function switchProfile(opts) {
   if (fileHosts.length === 0) {
     return { profile: opts.profile, dryRun, hosts: orderRows(universe, skipRows), restartRequired: false };
   }
-  const installedFileHosts = fileHosts.filter((h) => fs4.existsSync(h.layout.activeDir));
+  const installedFileHosts = fileHosts.filter((h) => fs5.existsSync(h.layout.activeDir));
   if (installedFileHosts.length === 0)
     throw NoHostsDetectedError();
   const withAvailability = fileHosts.map((h) => {
-    const variantsRootExists = fs4.existsSync(h.layout.variantsRoot);
+    const variantsRootExists = fs5.existsSync(h.layout.variantsRoot);
     const variantDir = h.layout.variantDir(opts.profile);
-    const available = variantsRootExists && fs4.existsSync(variantDir) && fs4.statSync(variantDir).isDirectory();
+    const available = variantsRootExists && fs5.existsSync(variantDir) && fs5.statSync(variantDir).isDirectory();
     return { ...h, variantsRootExists, variantDir, available };
   });
   if (!withAvailability.some((h) => h.available)) {
@@ -6300,8 +6317,8 @@ var init_esm4 = __esm(() => {
     #children;
     nocase;
     #fs;
-    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs5 = defaultFS } = {}) {
-      this.#fs = fsFromOption(fs5);
+    constructor(cwd = process.cwd(), pathImpl, sep2, { nocase, childrenCacheSize = 16 * 1024, fs: fs6 = defaultFS } = {}) {
+      this.#fs = fsFromOption(fs6);
       if (cwd instanceof URL || cwd.startsWith("file://")) {
         cwd = fileURLToPath(cwd);
       }
@@ -6776,8 +6793,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(dir) {
       return win32.parse(dir).root.toUpperCase();
     }
-    newRoot(fs5) {
-      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs5 });
+    newRoot(fs6) {
+      return new PathWin32(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs6 });
     }
     isAbsolute(p) {
       return p.startsWith("/") || p.startsWith("\\") || /^[a-z]:(\/|\\)/i.test(p);
@@ -6793,8 +6810,8 @@ var init_esm4 = __esm(() => {
     parseRootPath(_dir) {
       return "/";
     }
-    newRoot(fs5) {
-      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs5 });
+    newRoot(fs6) {
+      return new PathPosix(this.rootPath, IFDIR, undefined, this.roots, this.nocase, this.childrenCache(), { fs: fs6 });
     }
     isAbsolute(p) {
       return p.startsWith("/");
@@ -8200,7 +8217,7 @@ var init_capture_policy = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/ignore-patterns.js
-import fs5 from "fs/promises";
+import fs6 from "fs/promises";
 import path10 from "path";
 function buildExtensionGlob(extensions) {
   return extensions.map((ext2) => `**/*${ext2}`);
@@ -8225,7 +8242,7 @@ async function loadProjectIgnore(projectPath) {
   ig.add(DEFAULT_IGNORES);
   try {
     const gitignorePath = path10.join(projectPath, ".gitignore");
-    const gitignoreContent = await fs5.readFile(gitignorePath, "utf8");
+    const gitignoreContent = await fs6.readFile(gitignorePath, "utf8");
     const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
     ig.add(rules);
@@ -9821,15 +9838,15 @@ var require_pg_connection_string = __commonJS((exports, module) => {
     if (config2.sslnegotiation === "direct" && config2.ssl === undefined) {
       config2.ssl = true;
     }
-    const fs6 = config2.sslcert || config2.sslkey || config2.sslrootcert ? __require("fs") : null;
+    const fs7 = config2.sslcert || config2.sslkey || config2.sslrootcert ? __require("fs") : null;
     if (config2.sslcert) {
-      config2.ssl.cert = fs6.readFileSync(config2.sslcert).toString();
+      config2.ssl.cert = fs7.readFileSync(config2.sslcert).toString();
     }
     if (config2.sslkey) {
-      config2.ssl.key = fs6.readFileSync(config2.sslkey).toString();
+      config2.ssl.key = fs7.readFileSync(config2.sslkey).toString();
     }
     if (config2.sslrootcert) {
-      config2.ssl.ca = fs6.readFileSync(config2.sslrootcert).toString();
+      config2.ssl.ca = fs7.readFileSync(config2.sslrootcert).toString();
     }
     if (options.useLibpqCompat && config2.uselibpqcompat) {
       throw new Error("Both useLibpqCompat and uselibpqcompat are set. Please use only one of them.");
@@ -11708,15 +11725,15 @@ var require_helper = __commonJS((exports, module) => {
 // ../../node_modules/pgpass/lib/index.js
 var require_lib = __commonJS((exports, module) => {
   var path11 = __require("path");
-  var fs6 = __require("fs");
+  var fs7 = __require("fs");
   var helper = require_helper();
   module.exports = function(connInfo, cb) {
     var file = helper.getFileName();
-    fs6.stat(file, function(err, stat) {
+    fs7.stat(file, function(err, stat) {
       if (err || !helper.usePgPass(stat, file)) {
         return cb(undefined);
       }
-      var st = fs6.createReadStream(file);
+      var st = fs7.createReadStream(file);
       helper.getPassword(connInfo, st, cb);
     });
   };
@@ -13246,6 +13263,89 @@ var init_db_connection = __esm(() => {
   init_config();
 });
 
+// ../../packages/core/dist/kernel/sanitize/credential-scrub.js
+function markerFor(id) {
+  return `[REDACTED:${id}]`;
+}
+function fullMatchRule(id, pattern) {
+  const marker = markerFor(id);
+  return {
+    id,
+    replace(text) {
+      let count = 0;
+      const replaced = text.replace(pattern, () => {
+        count++;
+        return marker;
+      });
+      return { text: replaced, count };
+    }
+  };
+}
+function scrubCredentials(payloadJson) {
+  const redactions = {};
+  for (const id of RULE_IDS)
+    redactions[id] = 0;
+  let text = payloadJson;
+  for (const rule of RULES) {
+    const { text: next, count } = rule.replace(text);
+    text = next;
+    redactions[rule.id] += count;
+  }
+  const total = Object.values(redactions).reduce((sum, n) => sum + n, 0);
+  return {
+    sanitized: text,
+    redactions,
+    total
+  };
+}
+var PEM_PATTERN, JWT_PATTERN, AWS_KEY_PATTERN, SK_KEY_PATTERN, GITHUB_TOKEN_PATTERN, SLACK_TOKEN_PATTERN, BEARER_PATTERN, RULES, RULE_IDS;
+var init_credential_scrub = __esm(() => {
+  PEM_PATTERN = /-----BEGIN [A-Z ]{0,32}PRIVATE KEY-----[\s\S]{0,8192}?-----END [A-Z ]{0,32}PRIVATE KEY-----/g;
+  JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+  AWS_KEY_PATTERN = /\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g;
+  SK_KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{20,}\b/g;
+  GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g;
+  SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{18,}\b/g;
+  BEARER_PATTERN = /(Bearer\s+)([A-Za-z0-9._~+/=-]{20,})/g;
+  RULES = [
+    fullMatchRule("pem", PEM_PATTERN),
+    fullMatchRule("jwt", JWT_PATTERN),
+    fullMatchRule("aws-key", AWS_KEY_PATTERN),
+    fullMatchRule("sk-key", SK_KEY_PATTERN),
+    fullMatchRule("github-token", GITHUB_TOKEN_PATTERN),
+    fullMatchRule("slack-token", SLACK_TOKEN_PATTERN),
+    {
+      id: "bearer",
+      replace(text) {
+        let count = 0;
+        const replaced = text.replace(BEARER_PATTERN, (_m, prefix) => {
+          count++;
+          return `${prefix}${markerFor("bearer")}`;
+        });
+        return { text: replaced, count };
+      }
+    }
+  ];
+  RULE_IDS = RULES.map((r) => r.id);
+});
+
+// ../../packages/core/dist/kernel/sanitize/safe-error-summary.js
+function safeErrorSummary(error) {
+  if (error instanceof Error) {
+    return {
+      name: error.name,
+      message: scrubCredentials(error.message).sanitized
+    };
+  }
+  return {
+    name: "UnknownError",
+    message: scrubCredentials(String(error)).sanitized
+  };
+}
+var init_safe_error_summary = __esm(() => {
+  init_credential_scrub();
+});
+
 // ../../packages/core/dist/kernel/alias-resolver.js
 class ProjectIdentityAliasResolver {
   ttlMs;
@@ -13271,9 +13371,7 @@ class ProjectIdentityAliasResolver {
       this.cache.set(projectId, { canonical, expiresAt: this.now() + this.ttlMs });
       return canonical;
     } catch (error) {
-      logger.warn("[project-identity] alias resolution failed; using original id (sanitized)", {
-        name: error instanceof Error ? error.name : "unknown"
-      });
+      logger.warn("[project-identity] alias resolution failed; using original id", safeErrorSummary(error));
       return projectId;
     }
   }
@@ -13330,10 +13428,11 @@ var DEFAULT_TTL_MS = 30000, DEFAULT_RESOLVE_TIMEOUT_MS = 250, sharedResolver = n
 var init_alias_resolver = __esm(() => {
   init_dist();
   init_db_connection();
+  init_safe_error_summary();
 });
 
 // ../../packages/core/dist/services/search/index-manager.js
-import fs6 from "fs";
+import fs7 from "fs";
 import path11 from "path";
 
 class IndexManager {
@@ -13429,7 +13528,7 @@ class IndexManager {
       for (const filePath of indexedFiles) {
         const fullPath = path11.join(projectPath, filePath);
         try {
-          const stat = await fs6.promises.stat(fullPath);
+          const stat = await fs7.promises.stat(fullPath);
           fileMetadata[filePath] = {
             path: filePath,
             mtime: stat.mtimeMs,
@@ -13482,7 +13581,7 @@ class IndexManager {
         }
         const fullPath = path11.join(projectPath, match2);
         try {
-          const stat = await fs6.promises.stat(fullPath);
+          const stat = await fs7.promises.stat(fullPath);
           files.set(match2, {
             path: match2,
             mtime: stat.mtimeMs,
@@ -35173,7 +35272,7 @@ var require_auth_config = __commonJS((exports, module) => {
     writeAuthConfig: () => writeAuthConfig
   });
   module.exports = __toCommonJS2(auth_config_exports);
-  var fs7 = __toESM2(__require("fs"));
+  var fs8 = __toESM2(__require("fs"));
   var path12 = __toESM2(__require("path"));
   var import_token_util = require_token_util();
   function getAuthConfigPath() {
@@ -35186,10 +35285,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function readAuthConfig() {
     try {
       const authPath = getAuthConfigPath();
-      if (!fs7.existsSync(authPath)) {
+      if (!fs8.existsSync(authPath)) {
         return null;
       }
-      const content = fs7.readFileSync(authPath, "utf8");
+      const content = fs8.readFileSync(authPath, "utf8");
       if (!content) {
         return null;
       }
@@ -35201,10 +35300,10 @@ var require_auth_config = __commonJS((exports, module) => {
   function writeAuthConfig(config3) {
     const authPath = getAuthConfigPath();
     const authDir = path12.dirname(authPath);
-    if (!fs7.existsSync(authDir)) {
-      fs7.mkdirSync(authDir, { mode: 504, recursive: true });
+    if (!fs8.existsSync(authDir)) {
+      fs8.mkdirSync(authDir, { mode: 504, recursive: true });
     }
-    fs7.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
+    fs8.writeFileSync(authPath, JSON.stringify(config3, null, 2), { mode: 384 });
   }
   function isValidAccessToken(authConfig, expirationBufferMs = 0) {
     if (!authConfig.token)
@@ -35380,7 +35479,7 @@ var require_token_util = __commonJS((exports, module) => {
   });
   module.exports = __toCommonJS2(token_util_exports);
   var path12 = __toESM2(__require("path"));
-  var fs7 = __toESM2(__require("fs"));
+  var fs8 = __toESM2(__require("fs"));
   var import_token_error = require_token_error();
   var import_token_io = require_token_io();
   var import_auth_config = require_auth_config();
@@ -35461,10 +35560,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find project root directory. Have you linked your project with `vc link?`");
     }
     const prjPath = path12.join(dir, ".vercel", "project.json");
-    if (!fs7.existsSync(prjPath)) {
+    if (!fs8.existsSync(prjPath)) {
       throw new import_token_error.VercelOidcTokenError("project.json not found, have you linked your project with `vc link?`");
     }
-    const prj = JSON.parse(fs7.readFileSync(prjPath, "utf8"));
+    const prj = JSON.parse(fs8.readFileSync(prjPath, "utf8"));
     if (typeof prj.projectId !== "string" && typeof prj.orgId !== "string") {
       throw new TypeError("Expected a string-valued projectId property. Try running `vc link` to re-link your project.");
     }
@@ -35477,9 +35576,9 @@ var require_token_util = __commonJS((exports, module) => {
     }
     const tokenPath = path12.join(dir, "com.vercel.token", `${projectId}.json`);
     const tokenJson = JSON.stringify(token);
-    fs7.mkdirSync(path12.dirname(tokenPath), { mode: 504, recursive: true });
-    fs7.writeFileSync(tokenPath, tokenJson);
-    fs7.chmodSync(tokenPath, 432);
+    fs8.mkdirSync(path12.dirname(tokenPath), { mode: 504, recursive: true });
+    fs8.writeFileSync(tokenPath, tokenJson);
+    fs8.chmodSync(tokenPath, 432);
     return;
   }
   function loadToken(projectId) {
@@ -35488,10 +35587,10 @@ var require_token_util = __commonJS((exports, module) => {
       throw new import_token_error.VercelOidcTokenError("Unable to find user data directory. Please reach out to Vercel support.");
     }
     const tokenPath = path12.join(dir, "com.vercel.token", `${projectId}.json`);
-    if (!fs7.existsSync(tokenPath)) {
+    if (!fs8.existsSync(tokenPath)) {
       return null;
     }
-    const token = JSON.parse(fs7.readFileSync(tokenPath, "utf8"));
+    const token = JSON.parse(fs8.readFileSync(tokenPath, "utf8"));
     assertVercelOidcTokenResponse(token);
     return token;
   }
@@ -62921,26 +63020,26 @@ var require_process = __commonJS((exports, module) => {
 
 // ../../node_modules/detect-libc/lib/filesystem.js
 var require_filesystem = __commonJS((exports, module) => {
-  var fs7 = __require("fs");
+  var fs8 = __require("fs");
   var LDD_PATH = "/usr/bin/ldd";
   var SELF_PATH = "/proc/self/exe";
   var MAX_LENGTH = 2048;
   var readFileSync2 = (path12) => {
-    const fd = fs7.openSync(path12, "r");
+    const fd = fs8.openSync(path12, "r");
     const buffer = Buffer.alloc(MAX_LENGTH);
-    const bytesRead = fs7.readSync(fd, buffer, 0, MAX_LENGTH, 0);
-    fs7.close(fd, () => {});
+    const bytesRead = fs8.readSync(fd, buffer, 0, MAX_LENGTH, 0);
+    fs8.close(fd, () => {});
     return buffer.subarray(0, bytesRead);
   };
   var readFile = (path12) => new Promise((resolve4, reject) => {
-    fs7.open(path12, "r", (err, fd) => {
+    fs8.open(path12, "r", (err, fd) => {
       if (err) {
         reject(err);
       } else {
         const buffer = Buffer.alloc(MAX_LENGTH);
-        fs7.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
+        fs8.read(fd, buffer, 0, MAX_LENGTH, 0, (_, bytesRead) => {
           resolve4(buffer.subarray(0, bytesRead));
-          fs7.close(fd, () => {});
+          fs8.close(fd, () => {});
         });
       }
     });
@@ -99603,10 +99702,10 @@ Note that ${s.bold("include")} statements only accept relation fields.`, a;
       super(t, "P2023", r);
     }
   };
-  var fs7 = new WeakMap;
+  var fs8 = new WeakMap;
   function Ep(e) {
-    let t = fs7.get(e);
-    return t || (t = Object.entries(e), fs7.set(e, t)), t;
+    let t = fs8.get(e);
+    return t || (t = Object.entries(e), fs8.set(e, t)), t;
   }
   function hs(e, t, r) {
     switch (t.type) {
@@ -114415,6 +114514,89 @@ var init_reranker = __esm(() => {
   });
 });
 
+// ../../packages/core/dist/kernel/search-diagnostics.js
+function searchBackendUnavailable(component, cause) {
+  return cause instanceof SearchServiceError ? cause : new SearchServiceError("SEARCH_BACKEND_UNAVAILABLE", component, { cause });
+}
+function storeCorruption(component, cause) {
+  return cause instanceof SearchServiceError ? cause : new SearchServiceError("STORE_CORRUPTION", component, {
+    cause,
+    statusCode: 500
+  });
+}
+function projectNotIndexed(projectId, message) {
+  return new SearchServiceError("PROJECT_NOT_INDEXED", projectId, {
+    message,
+    statusCode: 404
+  });
+}
+function recordSearchDegradation(code, component, projectId) {
+  const degradation = {
+    code,
+    component,
+    message: DEGRADATION_MESSAGES[code]
+  };
+  diagnostics.push({
+    kind: "degradation",
+    ...degradation,
+    projectId,
+    timestamp: new Date().toISOString()
+  });
+  if (diagnostics.length > MAX_DIAGNOSTICS) {
+    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
+  }
+  return degradation;
+}
+function recordSearchFailure(error51, projectId) {
+  if (recordedFailures.has(error51))
+    return;
+  recordedFailures.add(error51);
+  diagnostics.push({
+    kind: "failure",
+    code: error51.code,
+    component: error51.component,
+    message: error51.message,
+    projectId,
+    timestamp: new Date().toISOString()
+  });
+  if (diagnostics.length > MAX_DIAGNOSTICS) {
+    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
+  }
+}
+function getSearchDiagnostics() {
+  return diagnostics.map((diagnostic) => ({ ...diagnostic }));
+}
+function resetSearchDiagnosticsForTests() {
+  diagnostics.length = 0;
+}
+var MAX_DIAGNOSTICS = 100, diagnostics, recordedFailures, DEGRADATION_MESSAGES, SearchServiceError;
+var init_search_diagnostics = __esm(() => {
+  diagnostics = [];
+  recordedFailures = new WeakSet;
+  DEGRADATION_MESSAGES = {
+    QUERY_UNDERSTANDING_UNAVAILABLE: "Query understanding was unavailable; original query used",
+    TRIGRAM_UNAVAILABLE: "Trigram enrichment was unavailable",
+    FUZZY_SEARCH_UNAVAILABLE: "Fuzzy enrichment was unavailable",
+    PROXIMITY_RERANK_UNAVAILABLE: "Proximity reranking was unavailable; fused order preserved",
+    GRAPH_AUGMENTATION_UNAVAILABLE: "Graph augmentation was unavailable",
+    SYNAPSE_UNAVAILABLE: "Synapse enrichment was unavailable; stateless results used",
+    SEARCH_AUDIT_UNAVAILABLE: "Search event auditing was unavailable",
+    SEARCH_ANALYTICS_UNAVAILABLE: "Search analytics were unavailable"
+  };
+  SearchServiceError = class SearchServiceError extends Error {
+    code;
+    component;
+    statusCode;
+    constructor(code, component, options) {
+      super(options?.message ?? (code === "STORE_CORRUPTION" ? "Stored data is invalid" : "A required search backend is unavailable"), options?.cause === undefined ? undefined : { cause: options.cause });
+      this.code = code;
+      this.component = component;
+      this.name = "SearchServiceError";
+      this.statusCode = options?.statusCode ?? 503;
+    }
+  };
+});
+
 // ../../packages/core/dist/kernel/enum-validation.js
 function validateEnum(paramName, value, validValues) {
   if (typeof value !== "string" || !validValues.includes(value)) {
@@ -114523,7 +114705,7 @@ class SearchController {
     });
     const admission = await this.contextualSearch.checkSearchAdmission(projectId, projectPath);
     if (!admission.admitted) {
-      throw new Error(admission.error ?? `Project '${projectId}' is not indexed`);
+      throw projectNotIndexed(projectId, admission.error ?? `Project '${projectId}' is not indexed`);
     }
     const staleWarning = admission.stale ?? null;
     let reindexInfo = null;
@@ -114747,6 +114929,7 @@ var init_search_controller = __esm(() => {
   init_contextual_search_rlm();
   init_event_bus();
   init_reranker();
+  init_search_diagnostics();
   init_esm();
   init_filter_validation();
 });
@@ -115232,83 +115415,6 @@ var init_session_bias = __esm(() => {
   init_synapse();
 });
 
-// ../../packages/core/dist/kernel/search-diagnostics.js
-function searchBackendUnavailable(component, cause) {
-  return cause instanceof SearchServiceError ? cause : new SearchServiceError("SEARCH_BACKEND_UNAVAILABLE", component, { cause });
-}
-function storeCorruption(component, cause) {
-  return cause instanceof SearchServiceError ? cause : new SearchServiceError("STORE_CORRUPTION", component, {
-    cause,
-    statusCode: 500
-  });
-}
-function recordSearchDegradation(code, component, projectId) {
-  const degradation = {
-    code,
-    component,
-    message: DEGRADATION_MESSAGES[code]
-  };
-  diagnostics.push({
-    kind: "degradation",
-    ...degradation,
-    projectId,
-    timestamp: new Date().toISOString()
-  });
-  if (diagnostics.length > MAX_DIAGNOSTICS) {
-    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
-  }
-  return degradation;
-}
-function recordSearchFailure(error51, projectId) {
-  if (recordedFailures.has(error51))
-    return;
-  recordedFailures.add(error51);
-  diagnostics.push({
-    kind: "failure",
-    code: error51.code,
-    component: error51.component,
-    message: error51.message,
-    projectId,
-    timestamp: new Date().toISOString()
-  });
-  if (diagnostics.length > MAX_DIAGNOSTICS) {
-    diagnostics.splice(0, diagnostics.length - MAX_DIAGNOSTICS);
-  }
-}
-function getSearchDiagnostics() {
-  return diagnostics.map((diagnostic) => ({ ...diagnostic }));
-}
-function resetSearchDiagnosticsForTests() {
-  diagnostics.length = 0;
-}
-var MAX_DIAGNOSTICS = 100, diagnostics, recordedFailures, DEGRADATION_MESSAGES, SearchServiceError;
-var init_search_diagnostics = __esm(() => {
-  diagnostics = [];
-  recordedFailures = new WeakSet;
-  DEGRADATION_MESSAGES = {
-    QUERY_UNDERSTANDING_UNAVAILABLE: "Query understanding was unavailable; original query used",
-    TRIGRAM_UNAVAILABLE: "Trigram enrichment was unavailable",
-    FUZZY_SEARCH_UNAVAILABLE: "Fuzzy enrichment was unavailable",
-    PROXIMITY_RERANK_UNAVAILABLE: "Proximity reranking was unavailable; fused order preserved",
-    GRAPH_AUGMENTATION_UNAVAILABLE: "Graph augmentation was unavailable",
-    SYNAPSE_UNAVAILABLE: "Synapse enrichment was unavailable; stateless results used",
-    SEARCH_AUDIT_UNAVAILABLE: "Search event auditing was unavailable",
-    SEARCH_ANALYTICS_UNAVAILABLE: "Search analytics were unavailable"
-  };
-  SearchServiceError = class SearchServiceError extends Error {
-    code;
-    component;
-    statusCode;
-    constructor(code, component, options) {
-      super(code === "STORE_CORRUPTION" ? "Stored data is invalid" : "A required search backend is unavailable", options?.cause === undefined ? undefined : { cause: options.cause });
-      this.code = code;
-      this.component = component;
-      this.name = "SearchServiceError";
-      this.statusCode = options?.statusCode ?? 503;
-    }
-  };
-});
-
 // ../../packages/core/dist/services/search/hybrid-search.js
 async function search(deps, query, projectId, options = {}) {
   const maxResults = options.maxResults ?? 10;
@@ -116665,7 +116771,7 @@ var init_managed_run_repository_pg = __esm(() => {
 });
 
 // ../../packages/core/dist/services/search/project-indexer.js
-import fs7 from "fs/promises";
+import fs8 from "fs/promises";
 import path13 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 async function runWithIndexLock(lockMap, projectId, work) {
@@ -116925,7 +117031,7 @@ async function checkSearchAdmission(deps, projectId, projectPath) {
 }
 async function indexFile(deps, filePath, projectId, projectRoot, centralityMap) {
   projectId = await getProjectIdentityAliasResolver().resolve(projectId);
-  const content = await fs7.readFile(filePath, "utf-8");
+  const content = await fs8.readFile(filePath, "utf-8");
   const relativePath = path13.relative(projectRoot, filePath);
   const maxFileSize = config.get("security").maxFileSize || 1024 * 1024;
   if (content.length > maxFileSize) {
@@ -120524,7 +120630,7 @@ __export(exports_symbol_graph_service, {
   SymbolGraphService: () => SymbolGraphService
 });
 import path14 from "path";
-import fs8 from "fs/promises";
+import fs9 from "fs/promises";
 
 class SymbolGraphService {
   identityLookup;
@@ -120852,7 +120958,7 @@ class SymbolGraphService {
   async readSnippet(relativePath, lineStart, lineEnd, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs8.readFile(absolutePath, "utf-8");
+      const content = await fs9.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       return lines.slice(Math.max(0, lineStart - 1), Math.min(lines.length, lineEnd)).join(`
@@ -120864,7 +120970,7 @@ class SymbolGraphService {
   async readContext(relativePath, lineNumber, contextLines, projectId) {
     try {
       const absolutePath = await this.resolveToAbsolute(relativePath, projectId);
-      const content = await fs8.readFile(absolutePath, "utf-8");
+      const content = await fs9.readFile(absolutePath, "utf-8");
       const lines = content.split(`
 `);
       const start = Math.max(0, lineNumber - contextLines - 1);
@@ -124673,7 +124779,7 @@ var init_l1_memory_cache = __esm(() => {
 });
 
 // ../../packages/core/dist/services/health/local-health-checker.js
-import fs9 from "fs/promises";
+import fs10 from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
 import path15 from "path";
 
@@ -124709,10 +124815,10 @@ class LocalHealthChecker {
     const start = Date.now();
     try {
       if (!existsSync3(this.dataDir))
-        await fs9.mkdir(this.dataDir, { recursive: true });
+        await fs10.mkdir(this.dataDir, { recursive: true });
       const probe = path15.join(this.dataDir, ".health-check-test");
-      await fs9.writeFile(probe, "ok");
-      await fs9.unlink(probe);
+      await fs10.writeFile(probe, "ok");
+      await fs10.unlink(probe);
       return { available: true, latency: Date.now() - start, details: { path: this.dataDir, writable: true } };
     } catch (error51) {
       return { available: false, latency: Date.now() - start, error: `Data directory error: ${error51.message}` };
@@ -125291,6 +125397,7 @@ class IndexJobTracker {
           filesIndexed: r?.filesIndexed ?? 0,
           chunksIndexed: r?.chunksIndexed ?? 0,
           symbolsIndexed: 0,
+          errors: r?.errors ?? 0,
           durationMs: r?.duration ?? 0,
           activatedGraphGenerationId: r?.activatedGraphGenerationId ?? ""
         });
@@ -127411,7 +127518,7 @@ var init_scheduler2 = __esm(() => {
 });
 
 // ../../packages/core/dist/services/pricing/models-dev-client.js
-import fs10 from "fs/promises";
+import fs11 from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import path16 from "path";
 function getModelsDevClient() {
@@ -127441,7 +127548,7 @@ var init_models_dev_client = __esm(() => {
         if (!existsSync4(cachePath)) {
           return null;
         }
-        const content = await fs10.readFile(cachePath, "utf-8");
+        const content = await fs11.readFile(cachePath, "utf-8");
         const data = JSON.parse(content);
         const age = Date.now() - data.timestamp;
         if (age > ModelsDevClient.LOCAL_CACHE_TTL) {
@@ -127469,13 +127576,13 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         const dir = path16.dirname(cachePath);
-        await fs10.mkdir(dir, { recursive: true });
+        await fs11.mkdir(dir, { recursive: true });
         const data = {
           timestamp: Date.now(),
           version: "1.0.0",
           models: Object.fromEntries(models)
         };
-        await fs10.writeFile(cachePath, JSON.stringify(data), "utf-8");
+        await fs11.writeFile(cachePath, JSON.stringify(data), "utf-8");
         logger.debug("Saved pricing to local cache", {
           models: models.size,
           path: cachePath
@@ -127804,7 +127911,7 @@ var init_models_dev_client = __esm(() => {
       const cachePath = this.getLocalCachePath();
       try {
         if (existsSync4(cachePath)) {
-          await fs10.unlink(cachePath);
+          await fs11.unlink(cachePath);
           logger.debug("Local pricing cache file deleted");
         }
       } catch (error51) {
@@ -128782,8 +128889,13 @@ var init_auto_checkpointer = __esm(() => {
   };
 });
 
+// ../../packages/core/dist/kernel/sanitize/strip-nul.js
+function stripNul(content) {
+  return content.includes("\x00") ? content.replaceAll("\x00", "") : content;
+}
+
 // ../../packages/core/dist/services/etl/stages/discover.js
-import fs11 from "fs/promises";
+import fs12 from "fs/promises";
 import path17 from "path";
 import { createHash as createHash8 } from "crypto";
 
@@ -128871,8 +128983,8 @@ class DiscoverStage {
   async processFile(ctx, relativePath, forceReindex) {
     const absolutePath = path17.join(ctx.projectPath, relativePath);
     try {
-      const stat = await fs11.stat(absolutePath);
-      const content = await fs11.readFile(absolutePath, "utf-8");
+      const stat = await fs12.stat(absolutePath);
+      const content = stripNul(await fs12.readFile(absolutePath, "utf-8"));
       const contentHash = createHash8("sha256").update(content).digest("hex");
       let needsReparse = forceReindex;
       if (!forceReindex) {
@@ -128916,7 +129028,7 @@ class DiscoverStage {
     }
     try {
       const gitignorePath = path17.join(projectPath, ".gitignore");
-      const gitignoreContent = await fs11.readFile(gitignorePath, "utf8");
+      const gitignoreContent = await fs12.readFile(gitignorePath, "utf8");
       const rules = gitignoreContent.split(`
 `).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
       ig.add(rules);
@@ -131245,7 +131357,7 @@ var init_structural_runtime = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/parse.js
 import path18 from "path";
-import fs12 from "fs/promises";
+import fs13 from "fs/promises";
 function resolveChunkerMaxChars() {
   const global2 = Number(process.env.EMBEDDING_MAX_CHARS);
   if (Number.isFinite(global2) && global2 > 0)
@@ -131337,7 +131449,7 @@ class ParseStage {
     if (!file2.needsReparse) {
       const extension = path18.extname(file2.relativePath).toLowerCase();
       if ([".c", ".cpp", ".hpp"].includes(extension)) {
-        const content = file2.snapshotContent ?? await fs12.readFile(file2.absolutePath, "utf8");
+        const content = file2.snapshotContent ?? await fs13.readFile(file2.absolutePath, "utf8");
         const outcome = await this.runtime.parse({ extension, source: Buffer.from(content) });
         if (outcome.status === "failed")
           throw new StructuralEtlParseError(file2.relativePath, outcome.failureKind, `Structural evidence parse failed (${outcome.failureKind})`, outcome.diagnosticCount, outcome.diagnostics.slice(0, 10));
@@ -131349,7 +131461,7 @@ class ParseStage {
       return { file: file2, chunks: [], symbols: [], rawImports: [], rawEdges: [] };
     }
     try {
-      const content = file2.snapshotContent ?? await fs12.readFile(file2.absolutePath, "utf-8");
+      const content = file2.snapshotContent ?? await fs13.readFile(file2.absolutePath, "utf-8");
       const ext2 = path18.extname(file2.relativePath).toLowerCase();
       const chunkerMaxChars = resolveChunkerMaxChars();
       const chunks = smartChunk(content, file2.relativePath, chunkerMaxChars ? { maxChunkChars: chunkerMaxChars } : {});
@@ -132390,7 +132502,7 @@ var init_data_document2 = __esm(() => {
 
 // ../../packages/core/dist/services/etl/stages/resolve.js
 import path21 from "path";
-import fs13 from "fs";
+import fs14 from "fs";
 
 class ResolveStage {
   symbolRepository;
@@ -132707,7 +132819,7 @@ class ResolveStage {
     const aliases = [];
     const tsconfigPath = path21.join(projectPath, "tsconfig.json");
     try {
-      const raw2 = fs13.readFileSync(tsconfigPath, "utf-8");
+      const raw2 = fs14.readFileSync(tsconfigPath, "utf-8");
       const stripped = raw2.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
       const tsconfig = JSON.parse(stripped);
       const paths = tsconfig?.compilerOptions?.paths ?? {};
@@ -132933,6 +133045,7 @@ class LoadStage {
     let chunksLoaded = 0;
     let symbolsLoaded = 0;
     let errors4 = 0;
+    const fileErrors = [];
     let processedSinceStart = 0;
     let lastEtaLogAt = 0;
     const BATCH = 10;
@@ -133003,6 +133116,12 @@ class LoadStage {
         } catch (err) {
           errors4++;
           processedSinceStart++;
+          if (fileErrors.length < MAX_FILE_ERRORS) {
+            fileErrors.push({
+              filePath: file2.file.relativePath,
+              error: err.message
+            });
+          }
           if (emitLifecycle)
             ctx.emit({
               type: "file_error",
@@ -133068,7 +133187,7 @@ class LoadStage {
       duration: formatDuration(durationMs),
       filesPerSec: filesLoaded > 0 && durationMs > 0 ? Number((filesLoaded / durationMs * 1000).toFixed(2)) : 0
     });
-    return { filesLoaded, chunksLoaded, symbolsLoaded, errors: errors4 };
+    return { filesLoaded, chunksLoaded, symbolsLoaded, errors: errors4, fileErrors };
   }
   async loadToSearchStores(ctx, file2) {
     if (file2.chunks.length === 0)
@@ -133140,6 +133259,7 @@ class LoadStage {
     return batch.definitions.length;
   }
 }
+var MAX_FILE_ERRORS = 50;
 var init_load = __esm(() => {
   init_dist();
   init_with_deadlock_retry();
@@ -133882,7 +134002,12 @@ var init_pipeline = __esm(() => {
           throw managedRunLeaseLost;
         stageTimings.load = Math.round(performance.now() - st4);
         if (loadResult.errors > 0) {
-          throw new Error(`ETL completed with ${loadResult.errors} file error${loadResult.errors === 1 ? "" : "s"}`);
+          logger.warn("EtlPipeline: completed with file errors", {
+            projectId,
+            jobId,
+            errors: loadResult.errors,
+            fileErrors: (loadResult.fileErrors ?? []).slice(0, 10)
+          });
         }
         const activationSnapshot = await abortable(this.discover.run(ctx, { forceReindex, includeTests: include_tests }), graphAbortController.signal);
         if (buildGraphInputSnapshotHash(activationSnapshot) !== graphGenerationLease.inputSnapshotHash) {
@@ -133939,6 +134064,7 @@ var init_pipeline = __esm(() => {
           filesIndexed: result.filesIndexed,
           chunksIndexed: result.chunksIndexed,
           errors: result.errors,
+          fileErrors: loadResult.fileErrors ?? [],
           duration: durationMs,
           activatedGraphGenerationId: result.activatedGraphGenerationId,
           parserDiagnostics: result.parserDiagnostics
@@ -133949,6 +134075,7 @@ var init_pipeline = __esm(() => {
           filesIndexed: result.filesIndexed,
           chunksIndexed: result.chunksIndexed,
           symbolsIndexed: result.symbolsIndexed,
+          errors: result.errors,
           durationMs,
           activatedGraphGenerationId: result.activatedGraphGenerationId
         });
@@ -151900,6 +152027,7 @@ var init_services = __esm(() => {
   init_search_analytics_pg();
   init_index_manager();
   init_search_diagnostics();
+  init_safe_error_summary();
   init_memory_controller();
   init_llm_client();
   init_search_controller();