@qwen-code/qwen-code 0.21.11-preview.0 → 0.21.11

package/chunks/{chunk-EV3LZGGK.js → chunk-TKAEODJR.js}

@@ -2,13 +2,25 @@
 "use strict";
 import {
   MissingCliEntryError
-} from "./chunk-DA4HRSBW.js";
+} from "./chunk-OPBATTFQ.js";
 import {
   redactLogCredentials
 } from "./chunk-M5GB774H.js";
 import {
   EXTERNAL_TOOL_GUARD_TOKEN_ENV
 } from "./chunk-BKHCW2BI.js";
+import {
+  CLIENT_METHODS,
+  zCreateTerminalRequest,
+  zKillTerminalCommandRequest,
+  zReadTextFileRequest,
+  zReleaseTerminalRequest,
+  zRequestPermissionRequest,
+  zSessionNotification,
+  zTerminalOutputRequest,
+  zWaitForTerminalExitRequest,
+  zWriteTextFileRequest
+} from "./chunk-IW6RQPQB.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";
@@ -26,6 +38,7 @@ import { getHeapStatistics } from "node:v8";
 // packages/acp-bridge/src/ndJsonStream.ts
 init_esbuild_shims();
 import { createHash } from "node:crypto";
+import { inspect } from "node:util";
 var NdJsonFrameTooLargeError = class extends Error {
   constructor(direction, limitBytes, observedBytes) {
     super(
@@ -68,31 +81,74 @@ var NdJsonIncompleteFrameError = class extends Error {
   }
   code = "ndjson_incomplete_frame";
 };
-function ndJsonStream(output, input, hooks, limits) {
+var NdJsonUnexpectedEofError = class extends Error {
+  static {
+    __name(this, "NdJsonUnexpectedEofError");
+  }
+  code = "ndjson_unexpected_eof";
+  constructor() {
+    super("NDJSON input ended while the bounded transport was active");
+    this.name = "NdJsonUnexpectedEofError";
+  }
+};
+var NdJsonInvalidMessageError = class extends Error {
+  constructor(code, observedBytes) {
+    super(`NDJSON input contains an invalid ${observedBytes}-byte message`);
+    this.code = code;
+    this.observedBytes = observedBytes;
+    this.name = "NdJsonInvalidMessageError";
+  }
+  static {
+    __name(this, "NdJsonInvalidMessageError");
+  }
+};
+var MAX_JSON_RPC_METHOD_BYTES = 1024;
+var MAX_JSON_RPC_ID_BYTES = 256;
+var MAX_JSON_RPC_ERROR_MESSAGE_BYTES = 1024;
+var MAX_JSON_DEPTH = 64;
+var MAX_JSON_NODES = 1e4;
+var MAX_JSON_ARRAY_LENGTH = 4096;
+function ndJsonStream(output, input, hooks, limits, validateInboundMessage, fatalCleanEof = false) {
   const textEncoder = new TextEncoder();
   const textDecoder = new TextDecoder();
   if (limits) validateNdJsonStreamLimits(limits);
-  const readable = limits ? createBoundedReadable(input, textDecoder, hooks, limits) : createLegacyReadable(input, textDecoder, hooks);
+  const outboundRequests = limits ? new BoundedOutstandingRequestLedger(limits) : void 0;
+  const inboundRequests = limits ? new BoundedInboundRequestLedger(limits) : void 0;
+  const readable = limits ? createBoundedReadable(
+    input,
+    textDecoder,
+    hooks,
+    limits,
+    outboundRequests,
+    inboundRequests,
+    validateInboundMessage,
+    fatalCleanEof
+  ) : createLegacyReadable(input, textDecoder, hooks);
   const writable = new WritableStream({
     async write(message) {
-      const content = JSON.stringify(message);
-      const payload = textEncoder.encode(content);
-      const frameBytes = payload.byteLength + 1;
-      if (limits && frameBytes > limits.maxFrameBytes) {
-        const error = new NdJsonFrameTooLargeError(
-          "sent",
-          limits.maxFrameBytes,
-          frameBytes
-        );
-        callHook(hooks?.onTransportError, error);
-        throw error;
-      }
-      const frame = new Uint8Array(frameBytes);
-      frame.set(payload);
-      frame[payload.byteLength] = 10;
-      const writer = output.getWriter();
+      let writer;
+      let expectedResponseId;
       try {
+        const content = JSON.stringify(message);
+        const payload = textEncoder.encode(content);
+        const frameBytes = payload.byteLength + 1;
+        if (limits && frameBytes > limits.maxFrameBytes) {
+          throw new NdJsonFrameTooLargeError(
+            "sent",
+            limits.maxFrameBytes,
+            frameBytes
+          );
+        }
+        const frame = new Uint8Array(frameBytes);
+        frame.set(payload);
+        frame[payload.byteLength] = 10;
+        if (outboundRequests && isJsonRpcRequestMessage(message)) {
+          outboundRequests.admit(message.id, frameBytes);
+          expectedResponseId = message.id;
+        }
+        writer = output.getWriter();
         await writer.write(frame);
+        inboundRequests?.release(message);
         callHook(hooks?.onMessageSent, payload.byteLength);
         callHook(hooks?.onMessageObserved, {
           direction: "sent",
@@ -100,10 +156,13 @@ function ndJsonStream(output, input, hooks, limits) {
           message
         });
       } catch (error) {
+        if (expectedResponseId !== void 0) {
+          outboundRequests?.discard(expectedResponseId);
+        }
         if (limits) callHook(hooks?.onTransportError, error);
         throw error;
       } finally {
-        writer.releaseLock();
+        writer?.releaseLock();
       }
     }
   });
@@ -130,7 +189,7 @@ function createLegacyReadable(input, textDecoder, hooks) {
   });
 }
 __name(createLegacyReadable, "createLegacyReadable");
-function createBoundedReadable(input, textDecoder, hooks, limits) {
+function createBoundedReadable(input, textDecoder, hooks, limits, outboundRequests, inboundRequests, validateInboundMessage, fatalCleanEof) {
   const pending = new BoundedFrameBuffer(limits.maxFrameBytes);
   const minimumQueueCharge = Math.ceil(
     limits.maxQueuedBytes / limits.maxQueuedMessages
@@ -149,6 +208,10 @@ function createBoundedReadable(input, textDecoder, hooks, limits) {
           textDecoder,
           hooks,
           limits,
+          outboundRequests,
+          inboundRequests,
+          validateInboundMessage,
+          fatalCleanEof,
           minimumQueueCharge,
           (charge) => {
             nextQueueCharge = charge;
@@ -169,7 +232,7 @@ function createBoundedReadable(input, textDecoder, hooks, limits) {
   );
 }
 __name(createBoundedReadable, "createBoundedReadable");
-async function pumpBoundedInput(reader, pending, controller, textDecoder, hooks, limits, minimumQueueCharge, setNextQueueCharge, isCanceled) {
+async function pumpBoundedInput(reader, pending, controller, textDecoder, hooks, limits, outboundRequests, inboundRequests, validateInboundMessage, fatalCleanEof, minimumQueueCharge, setNextQueueCharge, isCanceled) {
   try {
     while (true) {
       const result = await reader.read();
@@ -178,6 +241,7 @@ async function pumpBoundedInput(reader, pending, controller, textDecoder, hooks,
         if (pending.byteLength > 0) {
           throw new NdJsonIncompleteFrameError(pending.byteLength);
         }
+        if (fatalCleanEof) throw new NdJsonUnexpectedEofError();
         controller.close();
         return;
       }
@@ -189,6 +253,9 @@ async function pumpBoundedInput(reader, pending, controller, textDecoder, hooks,
         textDecoder,
         hooks,
         limits,
+        outboundRequests,
+        inboundRequests,
+        validateInboundMessage,
         minimumQueueCharge,
         setNextQueueCharge
       );
@@ -201,6 +268,8 @@ async function pumpBoundedInput(reader, pending, controller, textDecoder, hooks,
     if (!isCanceled()) controller.close();
   } finally {
     pending.clear();
+    outboundRequests.clear();
+    inboundRequests.clear();
     reader.releaseLock();
   }
 }
@@ -222,7 +291,7 @@ function readLegacyChunk(chunk, pending, controller, textDecoder, hooks) {
   }
 }
 __name(readLegacyChunk, "readLegacyChunk");
-function readBoundedChunk(chunk, pending, controller, textDecoder, hooks, limits, minimumQueueCharge, setNextQueueCharge) {
+function readBoundedChunk(chunk, pending, controller, textDecoder, hooks, limits, outboundRequests, inboundRequests, validateInboundMessage, minimumQueueCharge, setNextQueueCharge) {
   let start = 0;
   let newline = chunk.indexOf(10, start);
   while (newline !== -1) {
@@ -246,7 +315,15 @@ function readBoundedChunk(chunk, pending, controller, textDecoder, hooks, limits
       );
     }
     setNextQueueCharge(queueCharge);
-    handleBoundedLine(pending.take(current), controller, textDecoder, hooks);
+    handleBoundedLine(
+      pending.take(current),
+      controller,
+      textDecoder,
+      hooks,
+      outboundRequests,
+      inboundRequests,
+      validateInboundMessage
+    );
     start = newline + 1;
     newline = chunk.indexOf(10, start);
   }
@@ -280,28 +357,206 @@ function handleLegacyLine(lineBytes, controller, textDecoder, hooks) {
   }
 }
 __name(handleLegacyLine, "handleLegacyLine");
-function handleBoundedLine(lineBytes, controller, textDecoder, hooks) {
+function handleBoundedLine(lineBytes, controller, textDecoder, hooks, outboundRequests, inboundRequests, validateInboundMessage) {
   const line = textDecoder.decode(lineBytes);
   const trimmedLine = line.trim();
   if (!trimmedLine) return;
-  let message;
+  let parsed;
   try {
-    message = JSON.parse(trimmedLine);
+    parsed = JSON.parse(trimmedLine);
   } catch {
-    const bytes = jsonPayloadByteLength(lineBytes);
-    const digest = createHash("sha256").update(lineBytes.subarray(0, bytes)).digest("hex");
-    console.error("Failed to parse JSON message:", {
-      errorKind: "ndjson_parse_error",
-      bytes,
-      sha256: digest,
-      payloadOmitted: true
-    });
-    return;
+    throw logBoundedInvalidMessage("ndjson_parse_error", lineBytes);
+  }
+  if (!isJsonRpcMessage(parsed)) {
+    throw logBoundedInvalidMessage("ndjson_invalid_message", lineBytes);
+  }
+  const isResponse = isJsonRpcResponseMessage(parsed);
+  if (!isResponse && !hasBoundedJsonStructure(parsed) || validateInboundMessage && !validateInboundMessage(parsed)) {
+    throw logBoundedInvalidMessage("ndjson_invalid_message", lineBytes);
   }
+  if (isJsonRpcResponseMessage(parsed) && !outboundRequests?.consumeResponse(parsed.id)) {
+    throw logBoundedInvalidMessage("ndjson_invalid_message", lineBytes);
+  }
+  inboundRequests?.admit(parsed, lineBytes.byteLength + 1);
+  const message = installBoundedLogRedaction(parsed);
   controller.enqueue(message);
   reportReceivedMessage(lineBytes, message, hooks);
 }
 __name(handleBoundedLine, "handleBoundedLine");
+function installBoundedLogRedaction(message) {
+  Object.defineProperty(message, inspect.custom, {
+    configurable: false,
+    enumerable: false,
+    value: inspectBoundedJsonRpcMessage,
+    writable: false
+  });
+  return message;
+}
+__name(installBoundedLogRedaction, "installBoundedLogRedaction");
+function inspectBoundedJsonRpcMessage() {
+  return {
+    jsonrpc: "2.0",
+    messageType: "method" in this ? "id" in this ? "request" : "notification" : "response",
+    payloadOmitted: true
+  };
+}
+__name(inspectBoundedJsonRpcMessage, "inspectBoundedJsonRpcMessage");
+function isJsonRpcMessage(value) {
+  if (!isRecord(value) || value["jsonrpc"] !== "2.0") return false;
+  const hasMethod = Object.hasOwn(value, "method");
+  const hasId = Object.hasOwn(value, "id");
+  if (hasMethod) {
+    return typeof value["method"] === "string" && Buffer.byteLength(value["method"]) <= MAX_JSON_RPC_METHOD_BYTES && (!hasId || isJsonRpcId(value["id"]));
+  }
+  if (!hasId || !isJsonRpcId(value["id"])) return false;
+  const hasResult = Object.hasOwn(value, "result");
+  const hasError = Object.hasOwn(value, "error");
+  if (hasResult === hasError) return false;
+  if (!hasError) return true;
+  const error = value["error"];
+  return isRecord(error) && typeof error["code"] === "number" && Number.isFinite(error["code"]) && typeof error["message"] === "string" && Buffer.byteLength(error["message"]) <= MAX_JSON_RPC_ERROR_MESSAGE_BYTES;
+}
+__name(isJsonRpcMessage, "isJsonRpcMessage");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function hasBoundedJsonStructure(value) {
+  const stack = [{ value, depth: 1 }];
+  let nodes = 0;
+  while (stack.length > 0) {
+    const current = stack.pop();
+    nodes++;
+    if (nodes > MAX_JSON_NODES || current.depth > MAX_JSON_DEPTH) return false;
+    if (Array.isArray(current.value)) {
+      if (current.value.length > MAX_JSON_ARRAY_LENGTH) return false;
+      for (let index = current.value.length - 1; index >= 0; index--) {
+        if (nodes + stack.length >= MAX_JSON_NODES || current.depth + 1 > MAX_JSON_DEPTH) {
+          return false;
+        }
+        stack.push({
+          value: current.value[index],
+          depth: current.depth + 1
+        });
+      }
+    } else if (isRecord(current.value)) {
+      for (const key in current.value) {
+        if (!Object.hasOwn(current.value, key)) continue;
+        if (nodes + stack.length >= MAX_JSON_NODES || current.depth + 1 > MAX_JSON_DEPTH) {
+          return false;
+        }
+        stack.push({
+          value: current.value[key],
+          depth: current.depth + 1
+        });
+      }
+    }
+  }
+  return true;
+}
+__name(hasBoundedJsonStructure, "hasBoundedJsonStructure");
+function isJsonRpcId(value) {
+  return value === null || typeof value === "string" && Buffer.byteLength(value) <= MAX_JSON_RPC_ID_BYTES || typeof value === "number" && Number.isFinite(value);
+}
+__name(isJsonRpcId, "isJsonRpcId");
+function isJsonRpcRequestMessage(value) {
+  return "method" in value && "id" in value && typeof value.method === "string" && isJsonRpcId(value.id);
+}
+__name(isJsonRpcRequestMessage, "isJsonRpcRequestMessage");
+function isJsonRpcResponseMessage(value) {
+  return !("method" in value) && "id" in value;
+}
+__name(isJsonRpcResponseMessage, "isJsonRpcResponseMessage");
+var BoundedInboundRequestLedger = class {
+  constructor(limits) {
+    this.limits = limits;
+  }
+  static {
+    __name(this, "BoundedInboundRequestLedger");
+  }
+  requests = /* @__PURE__ */ new Map();
+  retainedBytes = 0;
+  admit(message, frameBytes) {
+    if (!isJsonRpcRequestMessage(message)) return;
+    const availableBytes = Math.max(
+      0,
+      this.limits.maxQueuedBytes - this.retainedBytes
+    );
+    if (this.requests.has(message.id) || this.requests.size >= this.limits.maxQueuedMessages || frameBytes > availableBytes) {
+      throw new NdJsonQueueLimitError(
+        this.limits.maxQueuedMessages,
+        this.limits.maxQueuedBytes,
+        frameBytes,
+        this.requests.has(message.id) ? 0 : availableBytes
+      );
+    }
+    this.requests.set(message.id, frameBytes);
+    this.retainedBytes += frameBytes;
+  }
+  release(message) {
+    if (!isJsonRpcResponseMessage(message)) return;
+    const frameBytes = this.requests.get(message.id);
+    if (frameBytes === void 0) return;
+    this.requests.delete(message.id);
+    this.retainedBytes -= frameBytes;
+  }
+  clear() {
+    this.requests.clear();
+    this.retainedBytes = 0;
+  }
+};
+var BoundedOutstandingRequestLedger = class {
+  constructor(limits) {
+    this.limits = limits;
+  }
+  static {
+    __name(this, "BoundedOutstandingRequestLedger");
+  }
+  requests = /* @__PURE__ */ new Map();
+  retainedBytes = 0;
+  admit(id, frameBytes) {
+    const availableBytes = Math.max(
+      0,
+      this.limits.maxQueuedBytes - this.retainedBytes
+    );
+    if (this.requests.has(id) || this.requests.size >= this.limits.maxQueuedMessages || frameBytes > availableBytes) {
+      throw new NdJsonQueueLimitError(
+        this.limits.maxQueuedMessages,
+        this.limits.maxQueuedBytes,
+        frameBytes,
+        this.requests.has(id) ? 0 : availableBytes
+      );
+    }
+    this.requests.set(id, frameBytes);
+    this.retainedBytes += frameBytes;
+  }
+  consumeResponse(id) {
+    return this.discard(id);
+  }
+  discard(id) {
+    const frameBytes = this.requests.get(id);
+    if (frameBytes === void 0) return false;
+    this.requests.delete(id);
+    this.retainedBytes -= frameBytes;
+    return true;
+  }
+  clear() {
+    this.requests.clear();
+    this.retainedBytes = 0;
+  }
+};
+function logBoundedInvalidMessage(errorKind, lineBytes) {
+  const bytes = jsonPayloadByteLength(lineBytes);
+  const digest = createHash("sha256").update(lineBytes.subarray(0, bytes)).digest("hex");
+  console.error("Failed to parse JSON message:", {
+    errorKind,
+    bytes,
+    sha256: digest,
+    payloadOmitted: true
+  });
+  return new NdJsonInvalidMessageError(errorKind, bytes);
+}
+__name(logBoundedInvalidMessage, "logBoundedInvalidMessage");
 function reportReceivedMessage(lineBytes, message, hooks) {
   const bytes = jsonPayloadByteLength(lineBytes);
   callHook(hooks?.onMessageReceived, bytes);
@@ -566,6 +821,232 @@ var DAEMON_ACP_NDJSON_LIMITS = Object.freeze({
   maxQueuedMessages: 256,
   maxQueuedBytes: 64 * 1024 * 1024
 });
+var daemonClientParamValidators = /* @__PURE__ */ new Map([
+  [CLIENT_METHODS.fs_read_text_file, zReadTextFileRequest],
+  [CLIENT_METHODS.fs_write_text_file, zWriteTextFileRequest],
+  [CLIENT_METHODS.session_request_permission, zRequestPermissionRequest],
+  [CLIENT_METHODS.session_update, zSessionNotification],
+  [CLIENT_METHODS.terminal_create, zCreateTerminalRequest],
+  [CLIENT_METHODS.terminal_kill, zKillTerminalCommandRequest],
+  [CLIENT_METHODS.terminal_output, zTerminalOutputRequest],
+  [CLIENT_METHODS.terminal_release, zReleaseTerminalRequest],
+  [CLIENT_METHODS.terminal_wait_for_exit, zWaitForTerminalExitRequest]
+]);
+function validateDaemonInboundMessage(message) {
+  if (!("method" in message)) return true;
+  const validator = daemonClientParamValidators.get(message.method);
+  return !validator || validator.safeParse(message.params).success;
+}
+__name(validateDaemonInboundMessage, "validateDaemonInboundMessage");
+var PreparedResponseBudget = class {
+  constructor(limits) {
+    this.limits = limits;
+  }
+  static {
+    __name(this, "PreparedResponseBudget");
+  }
+  objectCharges = /* @__PURE__ */ new WeakMap();
+  primitiveCharges = /* @__PURE__ */ new Map();
+  retainedCount = 0;
+  retainedBytes = 0;
+  closed = false;
+  reserve(value) {
+    if (this.closed) return;
+    const availableBytes = Math.max(
+      0,
+      this.limits.maxQueuedBytes - this.retainedBytes
+    );
+    const envelopeBytes = Math.min(2048, this.limits.maxQueuedBytes);
+    const charge = envelopeBytes + estimatePreparedResponseBytes(
+      value,
+      Math.max(0, availableBytes - envelopeBytes)
+    );
+    if (this.retainedCount >= this.limits.maxQueuedMessages || charge > availableBytes) {
+      throw new NdJsonQueueLimitError(
+        this.limits.maxQueuedMessages,
+        this.limits.maxQueuedBytes,
+        charge,
+        availableBytes
+      );
+    }
+    const charges = this.getCharges(value, true);
+    charges.push(charge);
+    this.retainedCount++;
+    this.retainedBytes += charge;
+  }
+  releaseMessage(message) {
+    if (!isPlainRecord(message) || Object.hasOwn(message, "method") || !Object.hasOwn(message, "id")) {
+      return;
+    }
+    const value = Object.hasOwn(message, "result") ? message["result"] : message["error"];
+    const charges = this.getCharges(value, false);
+    if (!charges) return;
+    const charge = charges.shift();
+    if (charge === void 0) return;
+    if (charges.length === 0 && !isObjectValue(value)) {
+      this.primitiveCharges.delete(value);
+    }
+    this.retainedCount--;
+    this.retainedBytes -= charge;
+  }
+  close() {
+    this.closed = true;
+    this.objectCharges = /* @__PURE__ */ new WeakMap();
+    this.primitiveCharges.clear();
+    this.retainedCount = 0;
+    this.retainedBytes = 0;
+  }
+  getCharges(value, create) {
+    const charges = isObjectValue(value) ? this.objectCharges.get(value) : this.primitiveCharges.get(value);
+    if (charges || !create) return charges;
+    const created = [];
+    if (isObjectValue(value)) {
+      this.objectCharges.set(value, created);
+    } else {
+      this.primitiveCharges.set(value, created);
+    }
+    return created;
+  }
+};
+var OutboundOperationBudget = class {
+  constructor(limits) {
+    this.limits = limits;
+  }
+  static {
+    __name(this, "OutboundOperationBudget");
+  }
+  retainedCount = 0;
+  retainedBytes = 0;
+  generation = 0;
+  closed = false;
+  reserve(value) {
+    if (this.closed) return () => {
+    };
+    const availableBytes = Math.max(
+      0,
+      this.limits.maxQueuedBytes - this.retainedBytes
+    );
+    const envelopeBytes = Math.min(2048, this.limits.maxQueuedBytes);
+    const charge = envelopeBytes + estimatePreparedResponseBytes(
+      value,
+      Math.max(0, availableBytes - envelopeBytes)
+    );
+    if (this.retainedCount >= this.limits.maxQueuedMessages || charge > availableBytes) {
+      throw new NdJsonQueueLimitError(
+        this.limits.maxQueuedMessages,
+        this.limits.maxQueuedBytes,
+        charge,
+        availableBytes
+      );
+    }
+    this.retainedCount++;
+    this.retainedBytes += charge;
+    const generation = this.generation;
+    let active = true;
+    return () => {
+      if (!active) return;
+      active = false;
+      if (this.closed || this.generation !== generation) return;
+      this.retainedCount--;
+      this.retainedBytes -= charge;
+    };
+  }
+  close() {
+    this.closed = true;
+    this.generation++;
+    this.retainedCount = 0;
+    this.retainedBytes = 0;
+  }
+};
+function* enumerableOwnKeys(value) {
+  for (const key in value) {
+    if (Object.hasOwn(value, key)) yield key;
+  }
+}
+__name(enumerableOwnKeys, "enumerableOwnKeys");
+function estimatePreparedResponseBytes(value, limitBytes) {
+  let bytes = 0;
+  const stack = [{ kind: "value", value }];
+  const seen = /* @__PURE__ */ new WeakSet();
+  while (stack.length > 0) {
+    const frame = stack.pop();
+    if (frame.kind === "array") {
+      if (frame.index >= frame.value.length) continue;
+      if (frame.index > 0) bytes++;
+      if (bytes > limitBytes) return limitBytes + 1;
+      const descriptor = Object.getOwnPropertyDescriptor(
+        frame.value,
+        String(frame.index)
+      );
+      if (descriptor?.get || descriptor?.set) return limitBytes + 1;
+      stack.push({ ...frame, index: frame.index + 1 });
+      stack.push({ kind: "value", value: descriptor?.value });
+      continue;
+    }
+    if (frame.kind === "record") {
+      const next = frame.keys.next();
+      if (next.done) continue;
+      const descriptor = Object.getOwnPropertyDescriptor(
+        frame.value,
+        next.value
+      );
+      if (!descriptor || descriptor.get || descriptor.set) {
+        return limitBytes + 1;
+      }
+      bytes += (frame.first ? 0 : 1) + Buffer.byteLength(next.value) + 3;
+      if (bytes > limitBytes) return limitBytes + 1;
+      stack.push({ ...frame, first: false });
+      stack.push({ kind: "value", value: descriptor.value });
+      continue;
+    }
+    const current = frame.value;
+    if (current === null) {
+      bytes += 4;
+    } else if (current === void 0) {
+      bytes += 4;
+    } else if (typeof current === "string") {
+      bytes += Buffer.byteLength(current) + 2;
+    } else if (typeof current === "number") {
+      bytes += 24;
+    } else if (typeof current === "boolean") {
+      bytes += 5;
+    } else if (Array.isArray(current)) {
+      if (seen.has(current) || Object.hasOwn(current, "toJSON")) {
+        return limitBytes + 1;
+      }
+      seen.add(current);
+      bytes += 2;
+      stack.push({ kind: "array", value: current, index: 0 });
+    } else if (isPlainRecord(current)) {
+      if (seen.has(current) || Object.hasOwn(current, "toJSON")) {
+        return limitBytes + 1;
+      }
+      seen.add(current);
+      bytes += 2;
+      stack.push({
+        kind: "record",
+        value: current,
+        keys: enumerableOwnKeys(current),
+        first: true
+      });
+    } else {
+      return limitBytes + 1;
+    }
+    if (bytes > limitBytes) return limitBytes + 1;
+  }
+  return Math.max(1, bytes);
+}
+__name(estimatePreparedResponseBytes, "estimatePreparedResponseBytes");
+function isObjectValue(value) {
+  return typeof value === "object" && value !== null;
+}
+__name(isObjectValue, "isObjectValue");
+function isPlainRecord(value) {
+  if (!isObjectValue(value) || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+__name(isPlainRecord, "isPlainRecord");
 function getAcpMemoryArgs() {
   if (cachedMemoryArgs) return cachedMemoryArgs;
   const constrainedMemory = process.constrainedMemory;
@@ -680,22 +1161,71 @@ function createSpawnChannelFactory(options = {}) {
     }
     const writable = Writable.toWeb(child.stdin);
     const readable = Readable.toWeb(child.stdout);
+    const preparedResponses = options.pipeLimits ? new PreparedResponseBudget(options.pipeLimits) : void 0;
+    const outboundOperations = options.pipeLimits ? new OutboundOperationBudget(options.pipeLimits) : void 0;
+    let reportTransportFailure;
+    let transportFailureReported = false;
+    const transportFailed = options.pipeLimits ? new Promise((resolve) => {
+      reportTransportFailure = resolve;
+    }) : void 0;
+    const failTransport = options.pipeLimits ? (error) => {
+      if (transportFailureReported) return;
+      transportFailureReported = true;
+      reportTransportFailure?.(error);
+      reportTransportFailure = void 0;
+      preparedResponses?.close();
+      outboundOperations?.close();
+      child.stdout?.destroy();
+      child.stdin?.destroy();
+      void trackedChild.terminate().catch(() => {
+      });
+      options.pipeHooks?.onTransportError?.(error);
+    } : void 0;
     const pipeHooks = options.pipeLimits ? {
       ...options.pipeHooks,
-      onTransportError: /* @__PURE__ */ __name((error) => {
-        void trackedChild.terminate().catch(() => {
-        });
-        options.pipeHooks?.onTransportError?.(error);
-      }, "onTransportError")
+      onMessageObserved: /* @__PURE__ */ __name((observation) => {
+        if (observation.direction === "sent") {
+          preparedResponses?.releaseMessage(observation.message);
+        }
+        options.pipeHooks?.onMessageObserved?.(observation);
+      }, "onMessageObserved"),
+      onTransportError: failTransport
     } : options.pipeHooks;
     const stream = ndJsonStream(
       writable,
       readable,
       pipeHooks,
-      options.pipeLimits
+      options.pipeLimits,
+      options.pipeLimits ? validateDaemonInboundMessage : void 0,
+      options.pipeLimits !== void 0
     );
     return {
       stream,
+      ...transportFailed ? { transportFailed } : {},
+      ...failTransport && options.pipeLimits ? {
+        transportGuard: {
+          maxActiveHandlers: options.pipeLimits.maxQueuedMessages,
+          maxActiveHandlerBytes: options.pipeLimits.maxQueuedBytes,
+          reserveOutboundOperation: /* @__PURE__ */ __name((value) => {
+            try {
+              return outboundOperations?.reserve(value) ?? (() => {
+              });
+            } catch (error) {
+              failTransport(error);
+              throw error;
+            }
+          }, "reserveOutboundOperation"),
+          reservePreparedResponse: /* @__PURE__ */ __name((value) => {
+            try {
+              preparedResponses?.reserve(value);
+            } catch (error) {
+              failTransport(error);
+              throw error;
+            }
+          }, "reservePreparedResponse"),
+          fail: failTransport
+        }
+      } : {},
       kill: /* @__PURE__ */ __name(() => trackedChild.terminate(), "kill"),
       killSync: /* @__PURE__ */ __name(() => trackedChild.killSync(), "killSync"),
       exited: trackedChild.exited