@tonyclaw/agent-inspector 3.0.25 → 3.0.27

package/.output/server/{_tanstack-start-manifest_v-BPuf86qB.mjs → _tanstack-start-manifest_v-CoGjnkQD.mjs}

@@ -1,4 +1,4 @@
-const tsrStartManifest = () => ({ routes: { __root__: { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/__root.tsx", children: ["/", "/api/alerts", "/api/config", "/api/groups", "/api/health", "/api/logs", "/api/mcp", "/api/models", "/api/pi-agent", "/api/providers", "/api/runs", "/api/sessions", "/proxy/$", "/session/$sessionId", "/api/ecosystem/packages", "/api/ecosystem/tasks", "/api/knowledge/candidates", "/api/knowledge/project-context", "/api/knowledge/search", "/api/ecosystem/recipes/$recipeId/run", "/api/knowledge/sessions/$sessionId/candidates"], preloads: ["/assets/index-BKi9IRtV.js"], scripts: [{ attrs: { type: "module", async: true, src: "/assets/index-BKi9IRtV.js" } }] }, "/": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/index.tsx", children: void 0, preloads: ["/assets/index-DdgTJ4QJ.js", "/assets/ProxyViewerContainer-DcqFqo1m.js"] }, "/session/$sessionId": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/session/$sessionId.tsx", children: void 0, preloads: ["/assets/_sessionId-Cq-2OqUU.js", "/assets/ProxyViewerContainer-DcqFqo1m.js"] } } });
+const tsrStartManifest = () => ({ routes: { __root__: { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/__root.tsx", children: ["/", "/api/alerts", "/api/config", "/api/groups", "/api/health", "/api/logs", "/api/mcp", "/api/models", "/api/pi-agent", "/api/providers", "/api/runs", "/api/sessions", "/proxy/$", "/session/$sessionId", "/api/ecosystem/packages", "/api/ecosystem/tasks", "/api/knowledge/candidates", "/api/knowledge/project-context", "/api/knowledge/search", "/api/ecosystem/recipes/$recipeId/run", "/api/knowledge/sessions/$sessionId/candidates"], preloads: ["/assets/index-B1atk19i.js"], scripts: [{ attrs: { type: "module", async: true, src: "/assets/index-B1atk19i.js" } }] }, "/": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/index.tsx", children: void 0, preloads: ["/assets/index-gY3I-7-D.js", "/assets/ProxyViewerContainer-CYOXB81n.js"] }, "/session/$sessionId": { filePath: "C:/Users/claw/workspace/agent-inspector/src/routes/session/$sessionId.tsx", children: void 0, preloads: ["/assets/_sessionId-BnKGmJrR.js", "/assets/ProxyViewerContainer-CYOXB81n.js"] } } });
 export {
   tsrStartManifest
 };

package/.output/server/index.mjs

@@ -17,124 +17,124 @@ const headers = ((m) => function headersRouteRule(event) {
   }
 });
 const assets = {
-  "/assets/CompareDrawer-BnvOPwpe.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": '"4bc4-5zhLacO6EX3WqI4FuA4lGMXjN0s"',
-    "mtime": "2026-07-10T08:00:31.058Z",
-    "size": 19396,
-    "path": "../public/assets/CompareDrawer-BnvOPwpe.js"
-  },
   "/assets/agent-inspector-58K1_MsC.ico": {
     "type": "image/vnd.microsoft.icon",
     "etag": '"38fa-ZD8kPABHYjPIkcH82FMY6iZM7fI"',
-    "mtime": "2026-07-10T08:00:31.057Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 14586,
     "path": "../public/assets/agent-inspector-58K1_MsC.ico"
   },
   "/assets/alibaba-TTwafVwX.svg": {
     "type": "image/svg+xml",
     "etag": '"171b-6dyV5K8QjiaY35sN9qNprh9zDIs"',
-    "mtime": "2026-07-10T08:00:31.057Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 5915,
     "path": "../public/assets/alibaba-TTwafVwX.svg"
   },
-  "/assets/index-Cf8O0Oos.js": {
+  "/assets/CompareDrawer-BVCAAbbu.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"1cd2d-AGj19VeYRg/9gMa5rYxB2Gy4elE"',
-    "mtime": "2026-07-10T08:00:31.059Z",
-    "size": 118061,
-    "path": "../public/assets/index-Cf8O0Oos.js"
+    "etag": '"4bc4-Zb2MZSke4PGsZAZQWlHQldYzm9M"',
+    "mtime": "2026-07-11T04:43:38.031Z",
+    "size": 19396,
+    "path": "../public/assets/CompareDrawer-BVCAAbbu.js"
   },
-  "/assets/json-viewer-Bqu_4hmm.js": {
+  "/assets/json-viewer-CpyYpPjx.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"1ae7-jUWDYATBX58XxyLVOXIiwVxMfPI"',
-    "mtime": "2026-07-10T08:00:31.058Z",
+    "etag": '"1ae7-AXjzdLeB9CtNkkvC/oR6PHIpZrw"',
+    "mtime": "2026-07-11T04:43:38.032Z",
     "size": 6887,
-    "path": "../public/assets/json-viewer-Bqu_4hmm.js"
+    "path": "../public/assets/json-viewer-CpyYpPjx.js"
   },
-  "/assets/index-DdgTJ4QJ.js": {
+  "/assets/index-gY3I-7-D.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"265-BRfPYJKASpguG88PPnfHirahKOw"',
-    "mtime": "2026-07-10T08:00:31.058Z",
+    "etag": '"265-61LM1QLhhYspwWAw/ft2ETl95Zg"',
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 613,
-    "path": "../public/assets/index-DdgTJ4QJ.js"
+    "path": "../public/assets/index-gY3I-7-D.js"
+  },
+  "/assets/index-9fMLCU4d.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": '"1cd2d-vhf/v641OwP3pvt2nzTr2vXPzE4"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 118061,
+    "path": "../public/assets/index-9fMLCU4d.js"
   },
   "/assets/minimax-BPMzvuL-.jpeg": {
     "type": "image/jpeg",
     "etag": '"1b06-IwivU89ko5UTMUM1/t7hn4sQK9A"',
-    "mtime": "2026-07-10T08:00:31.057Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 6918,
     "path": "../public/assets/minimax-BPMzvuL-.jpeg"
   },
-  "/assets/index-BMYuDL5X.css": {
+  "/assets/index-CmeF5XXS.css": {
     "type": "text/css; charset=utf-8",
-    "etag": '"28e37-OXmMvZYPi52EjG2ZPrkos0Yet/c"',
-    "mtime": "2026-07-10T08:00:31.058Z",
-    "size": 167479,
-    "path": "../public/assets/index-BMYuDL5X.css"
-  },
-  "/assets/ReplayDialog-BJgoQWdW.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": '"3348-pJMqX96FOv3wEI7PoEEMFpyJ11w"',
-    "mtime": "2026-07-10T08:00:31.058Z",
-    "size": 13128,
-    "path": "../public/assets/ReplayDialog-BJgoQWdW.js"
+    "etag": '"28a56-x7Wmw+oL5ZFDjFw5JRwjxSop3gg"',
+    "mtime": "2026-07-11T04:43:38.031Z",
+    "size": 166486,
+    "path": "../public/assets/index-CmeF5XXS.css"
   },
-  "/assets/index-BKi9IRtV.js": {
+  "/assets/RequestAnatomy-S17pYDRc.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"537cd-NpaS3vYeHdZF95h5WDIkIatdcX0"',
-    "mtime": "2026-07-10T08:00:31.058Z",
-    "size": 341965,
-    "path": "../public/assets/index-BKi9IRtV.js"
+    "etag": '"43f3-DId6+xakRnGM+B/ZQpGxfeV9YU0"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 17395,
+    "path": "../public/assets/RequestAnatomy-S17pYDRc.js"
   },
-  "/assets/ResponseView-CWmyRb2M.js": {
+  "/assets/ResponseView-Cf1XrawD.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"47fe-mthzJeh/5dJs4thyJybLb40gzQU"',
-    "mtime": "2026-07-10T08:00:31.058Z",
+    "etag": '"47fe-kAztjtZjRuPE6xDPPKWIypxT0pw"',
+    "mtime": "2026-07-11T04:43:38.032Z",
     "size": 18430,
-    "path": "../public/assets/ResponseView-CWmyRb2M.js"
+    "path": "../public/assets/ResponseView-Cf1XrawD.js"
   },
-  "/assets/RequestAnatomy-CpBZEHnM.js": {
+  "/assets/StreamingChunkSequence-BdOrVlCi.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"43f3-kQtXfcJUijWAqHKIJ9J6WDhAalk"',
-    "mtime": "2026-07-10T08:00:31.058Z",
-    "size": 17395,
-    "path": "../public/assets/RequestAnatomy-CpBZEHnM.js"
+    "etag": '"e96-lQJVKxQQeI+CfoFlIj48wFou0qg"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 3734,
+    "path": "../public/assets/StreamingChunkSequence-BdOrVlCi.js"
   },
-  "/assets/StreamingChunkSequence-BWhC8bwx.js": {
+  "/assets/ReplayDialog-DMX23O5G.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"e96-7Va31IQl/fjqjSwrob8+e019E5I"',
-    "mtime": "2026-07-10T08:00:31.058Z",
-    "size": 3734,
-    "path": "../public/assets/StreamingChunkSequence-BWhC8bwx.js"
+    "etag": '"3348-Y6DIYl0Hh8PNYNBckbjWZMRAVXk"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 13128,
+    "path": "../public/assets/ReplayDialog-DMX23O5G.js"
   },
-  "/assets/_sessionId-Cq-2OqUU.js": {
+  "/assets/_sessionId-BnKGmJrR.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"36d-8YmcvYBABgWm2DQdCJBCjo4Afc0"',
-    "mtime": "2026-07-10T08:00:31.058Z",
+    "etag": '"36d-RhevzYZMuLpSJjgi/aeqAk1rL4A"',
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 877,
-    "path": "../public/assets/_sessionId-Cq-2OqUU.js"
+    "path": "../public/assets/_sessionId-BnKGmJrR.js"
+  },
+  "/assets/index-B1atk19i.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": '"537cd-GY35Hkfq1WcIm1S1m2dfzIGL8WU"',
+    "mtime": "2026-07-11T04:43:38.031Z",
+    "size": 341965,
+    "path": "../public/assets/index-B1atk19i.js"
   },
   "/assets/zhipuai-BPNAnxo-.svg": {
     "type": "image/svg+xml",
     "etag": '"2bf8-hNaLCTi89nOFCsIIfWpP/jrfo0s"',
-    "mtime": "2026-07-10T08:00:31.057Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 11256,
     "path": "../public/assets/zhipuai-BPNAnxo-.svg"
   },
   "/assets/qwen-CONDcHqt.png": {
     "type": "image/png",
     "etag": '"572c3-cdJAPaHdOvFCGzuaQjagdgOu6XE"',
-    "mtime": "2026-07-10T08:00:31.058Z",
+    "mtime": "2026-07-11T04:43:38.031Z",
     "size": 357059,
     "path": "../public/assets/qwen-CONDcHqt.png"
   },
-  "/assets/ProxyViewerContainer-DcqFqo1m.js": {
+  "/assets/ProxyViewerContainer-CYOXB81n.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": '"c05a2-306DxDkEwbbNJTt8wEArkoeNWgM"',
-    "mtime": "2026-07-10T08:00:31.058Z",
-    "size": 787874,
-    "path": "../public/assets/ProxyViewerContainer-DcqFqo1m.js"
+    "etag": '"1404bd-m6RVh35PDpz6DtJ+NOh+zTs1XG8"',
+    "mtime": "2026-07-11T04:43:38.032Z",
+    "size": 1311933,
+    "path": "../public/assets/ProxyViewerContainer-CYOXB81n.js"
   }
 };
 function readAsset(id) {

package/README.md

@@ -31,6 +31,14 @@ npm install -g @tonyclaw/agent-inspector-mcp
 agent-inspector-mcp doctor
 ```
 
+Agent Inspector requires Node.js 22 or newer. Node.js 24 LTS is recommended for production use.
+
+By default, Agent Inspector binds to `127.0.0.1`. With `--host 0.0.0.0`, remote coding tools may
+use `/proxy`, while the UI, REST API, and MCP control plane remain local-only. Set
+`AGENT_INSPECTOR_CONTROL_TOKEN` for authenticated remote API/MCP clients, or explicitly set
+`AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL=1` only behind a trusted firewall or loopback-only port
+mapping.
+
 `@tonyclaw/agent-inspector` runs the local UI, proxy, REST API, storage, and built-in
 `/api/mcp` endpoint. `@tonyclaw/agent-inspector-mcp` is the enhancement package for
 stdio-first MCP clients and setup automation; it bridges to the local Inspector endpoint without

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@tonyclaw/agent-inspector",
-  "version": "3.0.25",
+  "version": "3.0.27",
   "type": "module",
   "description": "Agent observability and knowledge capture layer for AI coding tools.",
   "license": "MIT",
   "engines": {
-    "node": ">=18.18.0"
+    "node": ">=22.0.0"
   },
   "author": "TonyClaw",
   "repository": {
@@ -55,8 +55,8 @@
     "dev": "vite dev",
     "start": "node .output/cli.js",
     "build": "vite build && bun build:cli && bun build:mcp",
-    "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node18 --format=esm --outfile=.output/cli.js",
-    "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node20 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
+    "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",
+    "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
     "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",
     "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit",
@@ -92,6 +92,7 @@
     "react-markdown": "^10.1.0",
     "swr": "^2.4.1",
     "tailwind-merge": "^3.4.0",
+    "three": "0.185.1",
     "tw-animate-css": "^1.4.0",
     "zod": "^4.3.6"
   },
@@ -101,13 +102,13 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",
-    "@cfworker/json-schema": "^4.1.1",
     "@eslint/js": "^10.0.1",
     "@ladle/react": "^5.1.1",
     "@tailwindcss/vite": "^4.1.18",
     "@types/bun": "1.3.8",
     "@types/react": "^19",
     "@types/react-dom": "^19",
+    "@types/three": "0.185.1",
     "@typescript-eslint/eslint-plugin": "^8.55.0",
     "@typescript-eslint/parser": "^8.55.0",
     "@vitejs/plugin-react": "^5.1.4",

package/src/cli.ts

@@ -8,6 +8,7 @@ import { existsSync } from "node:fs";
 import type { Readable, Writable } from "node:stream";
 import {
   formatAccessHintLines,
+  isLoopbackHost,
   isValidBindHost,
   localUrlForPort,
   networkUrlsForBindHost,
@@ -31,6 +32,7 @@ const __dirname = dirname(__filename);
 const DEFAULT_PORT = 9527;
 const LEGACY_ALIAS_PORT = 9527;
 const DEFAULT_UPSTREAM_PORT = 9529;
+const DEFAULT_BIND_HOST = "127.0.0.1";
 const LOCAL_PROBE_TIMEOUT_MS = 2000;
 const BRANDED_WINDOWS_RUNTIME_EXE = "agent-inspector.exe";
 const DEFAULT_CAPTURE_MODE = "simple";
@@ -229,6 +231,16 @@ function printAccessHints(port: number, host?: string): void {
   for (const line of formatAccessHintLines(port, networkUrls, host)) {
     console.log(line);
   }
+  if (!isLoopbackHost(host)) {
+    if (process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] === "1") {
+      console.warn("   Control plane:  REMOTE ACCESS ENABLED by administrator override");
+    } else {
+      console.log("   Control plane:  local only; remote clients may use /proxy");
+      if ((process.env["AGENT_INSPECTOR_CONTROL_TOKEN"] ?? "") !== "") {
+        console.log("   Remote API:     Bearer token authentication enabled");
+      }
+    }
+  }
 }
 
 type BackgroundSupervisorOptions = {
@@ -289,13 +301,18 @@ function pickUpstreamPort(publicPort: number, legacyAliasPort: number | null): n
 async function tryStartIdentityProxy(
   identityPort: number,
   upstreamPort: number,
-  upstreamHost: string | undefined,
+  listenHost: string,
+  upstreamHost: string,
 ): Promise<import("node:http").Server | null> {
   try {
     const server = await startIdentityProxy({
       listenPort: identityPort,
-      upstreamHost: upstreamHost ?? "127.0.0.1",
+      listenHost,
+      upstreamHost,
       upstreamPort,
+      restrictRemoteControl: !isLoopbackHost(listenHost),
+      allowRemoteControl: process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] === "1",
+      controlToken: process.env["AGENT_INSPECTOR_CONTROL_TOKEN"],
     });
     return server;
   } catch (err) {
@@ -317,7 +334,8 @@ async function runStart(args: string[]): Promise<void> {
     process.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? process.env["AGENT_INSPECTOR_MODE"];
 
   let port = portDefault;
-  let host = envHost !== undefined && envHost.trim().length > 0 ? envHost.trim() : undefined;
+  let host =
+    envHost !== undefined && envHost.trim().length > 0 ? envHost.trim() : DEFAULT_BIND_HOST;
   let open = true;
   let openWasSpecified = false;
   let background = false;
@@ -457,6 +475,18 @@ async function runStart(args: string[]): Promise<void> {
     return;
   }
 
+  if (
+    !enableIdentityProxy &&
+    !isLoopbackHost(host) &&
+    process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] !== "1"
+  ) {
+    console.error(
+      "Refusing an unprotected remote bind with --no-identity-proxy. Keep the identity proxy enabled or set AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL=1 explicitly.",
+    );
+    process.exitCode = 1;
+    return;
+  }
+
   /**
    * Check if a port is in use and kill the process using it
    */
@@ -475,6 +505,7 @@ async function runStart(args: string[]): Promise<void> {
   // the public-facing port(s). When the identity proxy is disabled we fall
   // back to TanStack listening on the public port directly.
   const upstreamPort = enableIdentityProxy ? pickUpstreamPort(port, legacyAliasPort) : port;
+  const upstreamHost = enableIdentityProxy ? DEFAULT_BIND_HOST : host;
   process.env["PORT"] = String(upstreamPort);
 
   const url = urlForHost(port, host);
@@ -627,10 +658,8 @@ async function runStart(args: string[]): Promise<void> {
   if (providersJson !== undefined) {
     serverEnv["AGENT_INSPECTOR_PROVIDERS_JSON"] = providersJson;
   }
-  if (host !== undefined) {
-    serverEnv["HOST"] = host;
-    serverEnv["NITRO_HOST"] = host;
-  }
+  serverEnv["HOST"] = upstreamHost;
+  serverEnv["NITRO_HOST"] = upstreamHost;
   serverEnv["AGENT_INSPECTOR_PUBLIC_PORT"] = String(port);
   serverEnv["PROXY_PORT"] = String(port);
   serverEnv["AGENT_INSPECTOR_CAPTURE_MODE"] = captureMode;
@@ -664,12 +693,17 @@ async function runStart(args: string[]): Promise<void> {
     server: import("node:http").Server;
   }> = [];
   if (enableIdentityProxy) {
-    const primaryProxy = await tryStartIdentityProxy(port, upstreamPort, host);
+    const primaryProxy = await tryStartIdentityProxy(port, upstreamPort, host, upstreamHost);
     if (primaryProxy !== null) {
       identityProxies.push({ label: "primary", port, server: primaryProxy });
     }
     if (legacyAliasPort !== null) {
-      const legacyProxy = await tryStartIdentityProxy(legacyAliasPort, upstreamPort, host);
+      const legacyProxy = await tryStartIdentityProxy(
+        legacyAliasPort,
+        upstreamPort,
+        host,
+        upstreamHost,
+      );
       if (legacyProxy !== null) {
         identityProxies.push({ label: "legacy", port: legacyAliasPort, server: legacyProxy });
       }