@tonyclaw/agent-inspector 3.0.28 → 3.0.30

package/.output/cli.js

@@ -14,15 +14,156 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/proxy/privateDataPath.ts
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+function runWindowsCommand(executable, args) {
+  const result = spawnSync(executable, [...args], {
+    encoding: "utf8",
+    shell: false,
+    windowsHide: true
+  });
+  return { status: result.status, stdout: result.stdout };
+}
+function windowsUserSid(output) {
+  const match = /S-\d+(?:-\d+)+/.exec(output);
+  return match?.[0] ?? null;
+}
+function resolveWindowsUserSid(run) {
+  if (run === runWindowsCommand && cachedWindowsSid !== null) return cachedWindowsSid;
+  const identity = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+  if (identity.status !== 0) return null;
+  const sid = windowsUserSid(identity.stdout);
+  if (run === runWindowsCommand) cachedWindowsSid = sid;
+  return sid;
+}
+function windowsBroadGroupRemovalArgs() {
+  return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"];
+}
+function applyWindowsUserOnlyAcl(path2, kind, run = runWindowsCommand) {
+  const sid = resolveWindowsUserSid(run);
+  if (sid === null) return false;
+  const access = kind === "directory" ? `(OI)(CI)F` : "F";
+  const result = run("icacls.exe", [
+    path2,
+    "/inheritance:r",
+    "/grant:r",
+    `*${sid}:${access}`,
+    ...windowsBroadGroupRemovalArgs(),
+    "/q"
+  ]);
+  return result.status === 0;
+}
+function applyWindowsUserOnlyTreeAcl(root, run = runWindowsCommand) {
+  const sid = resolveWindowsUserSid(run);
+  if (sid === null) return false;
+  const result = run("icacls.exe", [
+    root,
+    "/inheritance:r",
+    "/grant:r",
+    `*${sid}:(OI)(CI)F`,
+    `*${sid}:F`,
+    ...windowsBroadGroupRemovalArgs(),
+    "/T",
+    "/C",
+    "/Q"
+  ]);
+  return result.status === 0;
+}
+function applyPrivatePermissionsSync(path2, kind) {
+  if (process.platform === "win32") {
+    return applyWindowsUserOnlyAcl(path2, kind);
+  }
+  try {
+    chmodSync(path2, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function secureOnce(path2, kind) {
+  const cacheKey = `${kind}:${path2}`;
+  if (securedPaths.has(cacheKey)) return true;
+  if (!applyPrivatePermissionsSync(path2, kind)) return false;
+  securedPaths.add(cacheKey);
+  return true;
+}
+function ensurePrivateDirectorySync(path2) {
+  try {
+    mkdirSync(path2, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+  } catch {
+    return false;
+  }
+  return secureOnce(path2, "directory");
+}
+function securePrivateFileSync(path2, forceAcl = false) {
+  let identity;
+  try {
+    const stats = statSync(path2);
+    identity = `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
+  } catch {
+    return false;
+  }
+  if (securedFileIdentities.get(path2) === identity) return true;
+  if (process.platform === "win32" && !forceAcl && securedPaths.has(`directory:${dirname(path2)}`)) {
+    securedFileIdentities.set(path2, identity);
+    return true;
+  }
+  if (!applyPrivatePermissionsSync(path2, "file")) return false;
+  securedFileIdentities.set(path2, identity);
+  return true;
+}
+function securePrivateTreeSync(root) {
+  if (!existsSync(root)) return false;
+  let stats;
+  try {
+    stats = lstatSync(root);
+  } catch {
+    return false;
+  }
+  if (stats.isSymbolicLink()) return true;
+  if (!stats.isDirectory()) return securePrivateFileSync(root, true);
+  if (process.platform === "win32") {
+    if (!applyWindowsUserOnlyTreeAcl(root)) return false;
+    securedPaths.add(`directory:${root}`);
+    return true;
+  }
+  if (!ensurePrivateDirectorySync(root)) return false;
+  let entries;
+  try {
+    entries = readdirSync(root);
+  } catch {
+    return false;
+  }
+  let secured = true;
+  for (const entry of entries) {
+    const childPath = join(root, entry);
+    if (!securePrivateTreeSync(childPath)) secured = false;
+  }
+  return secured;
+}
+var PRIVATE_DIRECTORY_MODE, PRIVATE_FILE_MODE, securedPaths, securedFileIdentities, cachedWindowsSid;
+var init_privateDataPath = __esm({
+  "src/proxy/privateDataPath.ts"() {
+    "use strict";
+    PRIVATE_DIRECTORY_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+    securedPaths = /* @__PURE__ */ new Set();
+    securedFileIdentities = /* @__PURE__ */ new Map();
+    cachedWindowsSid = null;
+  }
+});
+
 // src/proxy/dataDir.ts
-import { cpSync, existsSync, rmSync } from "node:fs";
-import { isAbsolute, join } from "node:path";
+import { cpSync, existsSync as existsSync2, rmSync } from "node:fs";
+import { isAbsolute, join as join2 } from "node:path";
 function getDataDir() {
   migrateLegacyDataDirs();
-  return resolveDataDir(existsSync);
+  return resolveDataDir(existsSync2);
 }
 function hasDataDirState(pathExists, dir) {
-  return pathExists(join(dir, "providers.json")) || pathExists(join(dir, "config.json")) || pathExists(join(dir, "logs")) || pathExists(join(dir, "chunks"));
+  return pathExists(join2(dir, "providers.json")) || pathExists(join2(dir, "config.json")) || pathExists(join2(dir, "logs")) || pathExists(join2(dir, "chunks"));
 }
 function defaultBaseDir(env = process.env, platform = process.platform) {
   return platform === "win32" ? env["USERPROFILE"] ?? env["APPDATA"] ?? "C:\\" : env["HOME"] ?? "/tmp";
@@ -31,13 +172,13 @@ function resolveDataDir(_pathExists, env = process.env, platform = process.platf
   const base = defaultBaseDir(env, platform);
   const dirEnv = env["AGENT_INSPECTOR_DATA_DIR"];
   if (dirEnv !== void 0 && dirEnv !== "") {
-    return isAbsolute(dirEnv) ? dirEnv : join(base, dirEnv);
+    return isAbsolute(dirEnv) ? dirEnv : join2(base, dirEnv);
   }
   const legacyDirEnv = env["AGENT_INSPECTOR_CONFIG_DIR"];
   if (legacyDirEnv !== void 0 && legacyDirEnv !== "") {
-    return isAbsolute(legacyDirEnv) ? legacyDirEnv : join(base, legacyDirEnv);
+    return isAbsolute(legacyDirEnv) ? legacyDirEnv : join2(base, legacyDirEnv);
   }
-  return join(base, CURRENT_DATA_DIR_NAME);
+  return join2(base, CURRENT_DATA_DIR_NAME);
 }
 function hasExplicitDataDir() {
   return process.env["AGENT_INSPECTOR_DATA_DIR"] !== void 0 && process.env["AGENT_INSPECTOR_DATA_DIR"] !== "" || process.env["AGENT_INSPECTOR_CONFIG_DIR"] !== void 0 && process.env["AGENT_INSPECTOR_CONFIG_DIR"] !== "";
@@ -45,13 +186,15 @@ function hasExplicitDataDir() {
 function migrateLegacyDataDirs() {
   if (hasExplicitDataDir()) return;
   const base = defaultBaseDir();
-  const currentDir = join(base, CURRENT_DATA_DIR_NAME);
-  if (hasDataDirState(existsSync, currentDir)) return;
+  const currentDir = join2(base, CURRENT_DATA_DIR_NAME);
+  if (hasDataDirState(existsSync2, currentDir)) return;
   for (const legacyName of LEGACY_DATA_DIR_NAMES) {
-    const legacyDir = join(base, legacyName);
-    if (!existsSync(legacyDir)) continue;
+    const legacyDir = join2(base, legacyName);
+    if (!existsSync2(legacyDir)) continue;
     try {
+      if (!ensurePrivateDirectorySync(currentDir)) return;
       cpSync(legacyDir, currentDir, { recursive: true, force: true });
+      if (!securePrivateTreeSync(currentDir)) return;
       rmSync(legacyDir, { recursive: true, force: true });
     } catch {
     }
@@ -61,15 +204,16 @@ var CURRENT_DATA_DIR_NAME, LEGACY_DATA_DIR_NAMES;
 var init_dataDir = __esm({
   "src/proxy/dataDir.ts"() {
     "use strict";
+    init_privateDataPath();
     CURRENT_DATA_DIR_NAME = ".agent-inspector";
     LEGACY_DATA_DIR_NAMES = [".llm-inspector", ".llm-agent"];
   }
 });
 
 // src/proxy/platformCommands.ts
-import { statSync } from "node:fs";
+import { statSync as statSync2 } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { delimiter, isAbsolute as isAbsolute2, join as join2 } from "node:path";
+import { delimiter, isAbsolute as isAbsolute2, join as join3 } from "node:path";
 function pathEntries(envPath) {
   if (envPath === void 0 || envPath.length === 0) return [];
   return envPath.split(delimiter).filter((entry) => entry.length > 0);
@@ -82,7 +226,7 @@ function windowsExecutableExtensions(envPathExt) {
 }
 function isExecutableCandidate(path2, platform) {
   try {
-    const stat3 = statSync(path2);
+    const stat3 = statSync2(path2);
     if (!stat3.isFile()) return false;
     if (platform === "win32" || process.platform === "win32") return true;
     return (stat3.mode & 73) !== 0;
@@ -93,14 +237,14 @@ function isExecutableCandidate(path2, platform) {
 function executableCandidates(bin, platform, env) {
   if (isAbsolute2(bin)) return [bin];
   const entries = pathEntries(env["PATH"] ?? env["Path"] ?? env["path"]);
-  if (platform !== "win32") return entries.map((entry) => join2(entry, bin));
+  if (platform !== "win32") return entries.map((entry) => join3(entry, bin));
   const hasExtension = /\.[^\\/]+$/.test(bin);
   const extensions = hasExtension ? [""] : windowsExecutableExtensions(env["PATHEXT"]);
   const candidates = [];
   for (const entry of entries) {
     for (const extension of extensions) {
-      candidates.push(join2(entry, `${bin}${extension.toLowerCase()}`));
-      candidates.push(join2(entry, `${bin}${extension.toUpperCase()}`));
+      candidates.push(join3(entry, `${bin}${extension.toLowerCase()}`));
+      candidates.push(join3(entry, `${bin}${extension.toUpperCase()}`));
     }
   }
   return candidates;
@@ -220,41 +364,41 @@ var init_platformCommands = __esm({
 });
 
 // src/cli/detect-tools.ts
-import { existsSync as existsSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { existsSync as existsSync3 } from "node:fs";
+import { join as join4 } from "node:path";
 import { homedir } from "node:os";
 function which(bin) {
   return resolveExecutableOnPath(bin);
 }
 function tryDir(path2) {
-  return existsSync2(path2) ? path2 : null;
+  return existsSync3(path2) ? path2 : null;
 }
 function detectClaudeCode() {
-  const configDir = tryDir(join3(homedir(), ".claude"));
+  const configDir = tryDir(join4(homedir(), ".claude"));
   const bin = which("claude");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectOpenCode() {
-  const configDir = tryDir(join3(homedir(), ".config", "opencode"));
+  const configDir = tryDir(join4(homedir(), ".config", "opencode"));
   const bin = which("opencode");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectMiMo() {
-  const configDir = tryDir(join3(homedir(), ".config", "mimocode")) ?? tryDir(join3(homedir(), ".mimocode"));
+  const configDir = tryDir(join4(homedir(), ".config", "mimocode")) ?? tryDir(join4(homedir(), ".mimocode"));
   const bin = which("mimo");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectCursor() {
-  const configDir = tryDir(join3(homedir(), ".cursor"));
+  const configDir = tryDir(join4(homedir(), ".cursor"));
   const bin = which("cursor");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectCody() {
-  const configDir = tryDir(join3(homedir(), ".config", "cody"));
+  const configDir = tryDir(join4(homedir(), ".config", "cody"));
   const bin = which("cody");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
@@ -1086,15 +1230,15 @@ __export(onboard_exports, {
 });
 import {
   mkdirSync as mkdirSync2,
-  writeFileSync as writeFileSync2,
-  existsSync as existsSync3,
+  writeFileSync,
+  existsSync as existsSync4,
   readFileSync,
   unlinkSync,
-  readdirSync,
+  readdirSync as readdirSync2,
   rmdirSync
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname, join as join4 } from "node:path";
+import { dirname as dirname2, join as join5 } from "node:path";
 import { fileURLToPath } from "node:url";
 function actionForStatus(label, state) {
   switch (state) {
@@ -1350,15 +1494,15 @@ Exit codes:
 `);
 }
 function resolveTargets(flags) {
-  const claudeRoot = flags.skillDir ?? join4(homedir2(), ".claude");
-  const claudeSkillDir = join4(claudeRoot, "skills", SKILL_DIR_NAME);
-  const claudeCommandsDir = join4(claudeRoot, "commands");
-  const codexRoot = process.env["CODEX_HOME"] ?? join4(homedir2(), ".codex");
-  const codexSkillsDir = flags.codexSkillDir ?? join4(codexRoot, "skills");
+  const claudeRoot = flags.skillDir ?? join5(homedir2(), ".claude");
+  const claudeSkillDir = join5(claudeRoot, "skills", SKILL_DIR_NAME);
+  const claudeCommandsDir = join5(claudeRoot, "commands");
+  const codexRoot = process.env["CODEX_HOME"] ?? join5(homedir2(), ".codex");
+  const codexSkillsDir = flags.codexSkillDir ?? join5(codexRoot, "skills");
   return {
-    claudeSkillFile: join4(claudeSkillDir, SKILL_FILE_NAME),
-    claudeCommandFile: join4(claudeCommandsDir, COMMAND_FILE_NAME),
-    codexSkillFile: join4(codexSkillsDir, SKILL_DIR_NAME, SKILL_FILE_NAME)
+    claudeSkillFile: join5(claudeSkillDir, SKILL_FILE_NAME),
+    claudeCommandFile: join5(claudeCommandsDir, COMMAND_FILE_NAME),
+    codexSkillFile: join5(codexSkillsDir, SKILL_DIR_NAME, SKILL_FILE_NAME)
   };
 }
 function isObject2(value) {
@@ -1377,33 +1521,33 @@ function resolveOpenCodeConfigPath(flags) {
   if (flags.opencodeConfig !== null) {
     return flags.opencodeConfig;
   }
-  const configDir = join4(homedir2(), ".config", "opencode");
-  const jsoncPath = join4(configDir, "opencode.jsonc");
-  if (existsSync3(jsoncPath)) {
+  const configDir = join5(homedir2(), ".config", "opencode");
+  const jsoncPath = join5(configDir, "opencode.jsonc");
+  if (existsSync4(jsoncPath)) {
     return jsoncPath;
   }
-  return join4(configDir, "opencode.json");
+  return join5(configDir, "opencode.json");
 }
 function resolveMiMoConfigPath(flags) {
   if (flags.mimoConfig !== null) {
     return flags.mimoConfig;
   }
-  const configDir = join4(homedir2(), ".config", "mimocode");
-  const jsoncPath = join4(configDir, "mimocode.jsonc");
-  if (existsSync3(jsoncPath)) {
+  const configDir = join5(homedir2(), ".config", "mimocode");
+  const jsoncPath = join5(configDir, "mimocode.jsonc");
+  if (existsSync4(jsoncPath)) {
     return jsoncPath;
   }
-  const jsonPath = join4(configDir, "mimocode.json");
-  if (existsSync3(jsonPath)) {
+  const jsonPath = join5(configDir, "mimocode.json");
+  if (existsSync4(jsonPath)) {
     return jsonPath;
   }
-  const legacyDir = join4(homedir2(), ".mimocode");
-  const legacyJsoncPath = join4(legacyDir, "config.jsonc");
-  if (existsSync3(legacyJsoncPath)) {
+  const legacyDir = join5(homedir2(), ".mimocode");
+  const legacyJsoncPath = join5(legacyDir, "config.jsonc");
+  if (existsSync4(legacyJsoncPath)) {
     return legacyJsoncPath;
   }
-  const legacyJsonPath = join4(legacyDir, "config.json");
-  if (existsSync3(legacyJsonPath)) {
+  const legacyJsonPath = join5(legacyDir, "config.json");
+  if (existsSync4(legacyJsonPath)) {
     return legacyJsonPath;
   }
   return jsoncPath;
@@ -1487,7 +1631,7 @@ function stripJsoncComments(raw) {
   return result;
 }
 function readAgentConfig(path2, target) {
-  if (!existsSync3(path2)) {
+  if (!existsSync4(path2)) {
     return { ok: true, exists: false, config: {} };
   }
   try {
@@ -1781,12 +1925,12 @@ function buildDetectedSummary() {
 }
 function readPackageVersion() {
   const packageJsonPaths = [
-    join4(__dirname, "..", "package.json"),
-    join4(__dirname, "..", "..", "package.json")
+    join5(__dirname, "..", "package.json"),
+    join5(__dirname, "..", "..", "package.json")
   ];
   try {
     for (const packageJsonPath of packageJsonPaths) {
-      if (existsSync3(packageJsonPath)) {
+      if (existsSync4(packageJsonPath)) {
         const raw = JSON.parse(readFileSync(packageJsonPath, "utf8"));
         if (isObject2(raw) && typeof raw["version"] === "string") {
           return raw["version"];
@@ -1881,7 +2025,7 @@ function isMatchingGeneratedFile(path2, currentVersion) {
   }
 }
 function readGeneratedFileStatus(file2, currentVersion) {
-  if (!existsSync3(file2.path)) {
+  if (!existsSync4(file2.path)) {
     return {
       label: file2.label,
       path: file2.path,
@@ -1986,7 +2130,7 @@ function shouldWrite(file2, force, currentVersion) {
   if (!file2.enabled) {
     return false;
   }
-  if (force || !existsSync3(file2.path)) {
+  if (force || !existsSync4(file2.path)) {
     return true;
   }
   const existingVersion = readGeneratedVersion(file2.path);
@@ -1997,11 +2141,11 @@ function shouldWrite(file2, force, currentVersion) {
   return comparison !== null && comparison < 0;
 }
 function shouldUninstall(file2, currentVersion) {
-  return file2.enabled && existsSync3(file2.path) && isMatchingGeneratedFile(file2.path, currentVersion);
+  return file2.enabled && existsSync4(file2.path) && isMatchingGeneratedFile(file2.path, currentVersion);
 }
 function removeEmptyDirectory(path2) {
   try {
-    if (readdirSync(path2).length === 0) {
+    if (readdirSync2(path2).length === 0) {
       rmdirSync(path2);
     }
   } catch {
@@ -2049,14 +2193,14 @@ No files were removed.
   try {
     for (const file2 of filesToRemove) {
       unlinkSync(file2.path);
-      removeEmptyDirectory(dirname(file2.path));
+      removeEmptyDirectory(dirname2(file2.path));
       process.stdout.write(`Removed ${file2.label}: ${file2.path}
 `);
     }
     for (const plan of agentPlans) {
       if (plan.shouldRemove && plan.body !== null) {
-        mkdirSync2(dirname(plan.status.path), { recursive: true });
-        writeFileSync2(plan.status.path, plan.body, "utf8");
+        mkdirSync2(dirname2(plan.status.path), { recursive: true });
+        writeFileSync(plan.status.path, plan.body, "utf8");
         process.stdout.write(`Removed ${plan.status.label} entry from: ${plan.status.path}
 `);
       }
@@ -2198,7 +2342,7 @@ function runOnboardSync(argv) {
 
 `);
     for (const file2 of enabledFiles) {
-      const status = existsSync3(file2.path) ? "exists" : "missing";
+      const status = existsSync4(file2.path) ? "exists" : "missing";
       process.stdout.write(`${file2.label}: ${file2.path} (${status})
 `);
     }
@@ -2275,13 +2419,13 @@ No files were written.
   }
   try {
     for (const file2 of filesToWrite) {
-      mkdirSync2(dirname(file2.path), { recursive: true });
-      writeFileSync2(file2.path, file2.body, "utf8");
+      mkdirSync2(dirname2(file2.path), { recursive: true });
+      writeFileSync(file2.path, file2.body, "utf8");
     }
     for (const plan of agentPlansToWrite) {
       if (plan.body !== null) {
-        mkdirSync2(dirname(plan.status.path), { recursive: true });
-        writeFileSync2(plan.status.path, plan.body, "utf8");
+        mkdirSync2(dirname2(plan.status.path), { recursive: true });
+        writeFileSync(plan.status.path, plan.body, "utf8");
       }
     }
   } catch (err) {
@@ -2338,7 +2482,7 @@ var init_onboard = __esm({
     init_codex_skill_onboard();
     init_skill_onboard();
     __filename = fileURLToPath(import.meta.url);
-    __dirname = dirname(__filename);
+    __dirname = dirname2(__filename);
     DEFAULT_PORT = 9527;
     DEFAULT_MCP_URL = `http://localhost:${DEFAULT_PORT}/api/mcp`;
     LEGACY_MCP_URL = "http://localhost:9527/api/mcp";
@@ -2362,8 +2506,8 @@ __export(doctor_exports, {
   parseDoctorArgs: () => parseDoctorArgs,
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync4, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join5, resolve } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync2, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join6, resolve } from "node:path";
 import { createConnection } from "node:net";
 function check2(name, severity, message, hint = "") {
   return {
@@ -2478,10 +2622,10 @@ function providerConfigCandidates(options, deps) {
   }
   if (options.configDir !== null) {
     const dir = resolveMaybeRelative(deps.cwd, options.configDir);
-    return [join5(dir, "providers.json"), join5(dir, "config.json")];
+    return [join6(dir, "providers.json"), join6(dir, "config.json")];
   }
   const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
-  return [join5(dataDir, "providers.json"), join5(dataDir, "config.json")];
+  return [join6(dataDir, "providers.json"), join6(dataDir, "config.json")];
 }
 function checkProviderConfig(options, deps) {
   const providersJson = options.providersJson ?? deps.env["AGENT_INSPECTOR_PROVIDERS_JSON"] ?? null;
@@ -2567,7 +2711,7 @@ async function checkProxyHealth(port, deps) {
 function findProjectRoot(startDir, deps) {
   let current = resolve(startDir);
   for (let i = 0; i < 6; i++) {
-    if (deps.exists(join5(current, "package.json"))) return current;
+    if (deps.exists(join6(current, "package.json"))) return current;
     const next = resolve(current, "..");
     if (next === current) return startDir;
     current = next;
@@ -2575,7 +2719,7 @@ function findProjectRoot(startDir, deps) {
   return startDir;
 }
 function checkPackage(rootDir, deps) {
-  const packagePath = join5(rootDir, "package.json");
+  const packagePath = join6(rootDir, "package.json");
   const text = deps.readText(packagePath);
   if (text === null) {
     return check2("Package metadata", "warn", "package.json was not found near the CLI bundle.");
@@ -2600,7 +2744,7 @@ function countFilesInDir(dir, deps) {
   if (files === null) return null;
   let count = 0;
   for (const file2 of files) {
-    const fileStat = deps.stat(join5(dir, file2));
+    const fileStat = deps.stat(join6(dir, file2));
     if (fileStat !== null && !fileStat.isDirectory) count += 1;
   }
   return count;
@@ -2620,24 +2764,24 @@ function dirSize(dir, deps, depth = 0) {
   if (files === null) return null;
   let total = 0;
   for (const file2 of files) {
-    const childSize = dirSize(join5(dir, file2), deps, depth + 1);
+    const childSize = dirSize(join6(dir, file2), deps, depth + 1);
     if (childSize !== null) total += childSize;
   }
   return total;
 }
 function verboseChecks(options, deps) {
   const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
-  const logsDir = join5(dataDir, "logs");
-  const chunksDir = join5(dataDir, "chunks");
+  const logsDir = join6(dataDir, "logs");
+  const chunksDir = join6(dataDir, "chunks");
   const providerCandidates = providerConfigCandidates(options, deps);
   const captureMode = deps.env["AGENT_INSPECTOR_MODE"] ?? deps.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? "simple";
   const logCount = countFilesInDir(logsDir, deps);
   const logSize = dirSize(logsDir, deps);
   const chunkSize = dirSize(chunksDir, deps);
   const homeDir = deps.platform === "win32" ? deps.env["USERPROFILE"] ?? deps.env["APPDATA"] ?? null : deps.env["HOME"] ?? null;
-  const claudeSkill = homeDir === null ? null : join5(homeDir, ".claude", "skills", "agent-inspector-onboard", "SKILL.md");
-  const claudeCommand = homeDir === null ? null : join5(homeDir, ".claude", "commands", "agent-inspector-onboard.md");
-  const codexSkill = homeDir === null ? null : join5(homeDir, ".codex", "skills", "agent-inspector-onboard", "SKILL.md");
+  const claudeSkill = homeDir === null ? null : join6(homeDir, ".claude", "skills", "agent-inspector-onboard", "SKILL.md");
+  const claudeCommand = homeDir === null ? null : join6(homeDir, ".claude", "commands", "agent-inspector-onboard.md");
+  const codexSkill = homeDir === null ? null : join6(homeDir, ".codex", "skills", "agent-inspector-onboard", "SKILL.md");
   const hasClaudeOnboarding = claudeSkill !== null && claudeCommand !== null && deps.exists(claudeSkill) && deps.exists(claudeCommand);
   const hasCodexOnboarding = codexSkill !== null && deps.exists(codexSkill);
   return [
@@ -2669,8 +2813,8 @@ function verboseChecks(options, deps) {
   ];
 }
 function checkExtensionSource(rootDir, deps) {
-  const extensionDir = join5(rootDir, "extensions", "chrome");
-  const missing = EXTENSION_REQUIRED_FILES.filter((file2) => !deps.exists(join5(extensionDir, file2)));
+  const extensionDir = join6(rootDir, "extensions", "chrome");
+  const missing = EXTENSION_REQUIRED_FILES.filter((file2) => !deps.exists(join6(extensionDir, file2)));
   if (missing.length === 0) {
     return check2(
       "Chrome extension source",
@@ -2686,7 +2830,7 @@ function checkExtensionSource(rootDir, deps) {
   );
 }
 function extensionManifestVersion(rootDir, deps) {
-  const manifestText = deps.readText(join5(rootDir, "extensions", "chrome", "manifest.json"));
+  const manifestText = deps.readText(join6(rootDir, "extensions", "chrome", "manifest.json"));
   if (manifestText === null) return null;
   try {
     const manifest = JSON.parse(manifestText);
@@ -2698,7 +2842,7 @@ function extensionManifestVersion(rootDir, deps) {
   }
 }
 function checkExtensionPackage(rootDir, deps) {
-  const distDir = join5(rootDir, "dist", "chrome-extension");
+  const distDir = join6(rootDir, "dist", "chrome-extension");
   const files = deps.listDir(distDir);
   if (files === null) {
     return check2(
@@ -2844,14 +2988,14 @@ function readText(path2) {
 }
 function listDir(path2) {
   try {
-    return readdirSync2(path2);
+    return readdirSync3(path2);
   } catch {
     return null;
   }
 }
 function stat2(path2) {
   try {
-    const fileStat = statSync2(path2);
+    const fileStat = statSync3(path2);
     return { isDirectory: fileStat.isDirectory(), size: fileStat.size };
   } catch {
     return null;
@@ -2862,7 +3006,7 @@ function createDoctorDeps() {
     env: process.env,
     platform: process.platform,
     cwd: process.cwd(),
-    exists: existsSync4,
+    exists: existsSync5,
     readText,
     listDir,
     stat: stat2,
@@ -2911,12 +3055,12 @@ var init_doctor = __esm({
 });
 
 // src/cli.ts
-import { Buffer as Buffer3 } from "node:buffer";
+import { Buffer as Buffer4 } from "node:buffer";
 import { spawn } from "node:child_process";
 import { createConnection as createConnection2 } from "node:net";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname2, join as join6, resolve as resolvePath } from "node:path";
-import { existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname3, join as join7, resolve as resolvePath } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
 
 // src/cli/networkHints.ts
 import { networkInterfaces } from "node:os";
@@ -3037,8 +3181,9 @@ function shouldSuppressServerOutputLine(line, context) {
 
 // src/proxy/identityProxy.ts
 import http from "node:http";
-import { Buffer as Buffer2 } from "node:buffer";
+import { Buffer as Buffer3 } from "node:buffer";
 import { timingSafeEqual } from "node:crypto";
+import { isIP } from "node:net";
 
 // src/proxy/socketTracker.ts
 import { execFile } from "node:child_process";
@@ -17561,10 +17706,15 @@ config(en_default());
 
 // src/proxy/logger.ts
 init_dataDir();
-import { readdir, stat, unlink, appendFile, mkdir } from "node:fs/promises";
-import { writeFileSync, mkdirSync } from "node:fs";
+init_privateDataPath();
+import { Buffer as Buffer2 } from "node:buffer";
+import { appendFileSync } from "node:fs";
+import { appendFile, readdir, rename, stat, unlink } from "node:fs/promises";
 import path from "node:path";
-var RETENTION_DAYS = Number(process.env["LOG_RETENTION_DAYS"] ?? "7");
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_RETENTION_DAYS = 7;
+var DEFAULT_APP_LOG_MAX_BYTES = 10 * 1024 * 1024;
+var DEFAULT_APP_LOG_MAX_FILES = 5;
 function writeStderrFallback(message, error51) {
   process.stderr.write(`${message} ${String(error51)}
 `);
@@ -17590,45 +17740,211 @@ function getInspectorLogPath() {
   }
   return path.join(getDataDir(), "logs", "inspector.log");
 }
+function readBoundedInteger(name, fallback, minimum, maximum) {
+  const raw = process.env[name];
+  if (raw === void 0 || raw === "") return fallback;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) return fallback;
+  return parsed;
+}
+function getApplicationLogPolicy() {
+  const retentionDays = readBoundedInteger("LOG_RETENTION_DAYS", DEFAULT_RETENTION_DAYS, 1, 3650);
+  return {
+    maxBytes: readBoundedInteger(
+      "AGENT_INSPECTOR_APP_LOG_MAX_BYTES",
+      DEFAULT_APP_LOG_MAX_BYTES,
+      1,
+      1024 * 1024 * 1024
+    ),
+    maxFiles: readBoundedInteger(
+      "AGENT_INSPECTOR_APP_LOG_MAX_FILES",
+      DEFAULT_APP_LOG_MAX_FILES,
+      1,
+      100
+    ),
+    retentionMs: retentionDays * DAY_MS
+  };
+}
+function getRotatedGeneration(entry, baseName) {
+  const prefix = `${baseName}.`;
+  if (!entry.startsWith(prefix)) return null;
+  const suffix = entry.slice(prefix.length);
+  if (!/^\d+$/.test(suffix)) return null;
+  const generation = Number(suffix);
+  if (!Number.isSafeInteger(generation) || generation < 1) return null;
+  return generation;
+}
+async function listApplicationLogFiles(logPath) {
+  const directory = path.dirname(logPath);
+  const baseName = path.basename(logPath);
+  const entries = await readdir(directory);
+  const files = [];
+  for (const entry of entries) {
+    const generation = entry === baseName ? 0 : getRotatedGeneration(entry, baseName);
+    if (generation === null) continue;
+    const filePath = path.join(directory, entry);
+    try {
+      const fileStat = await stat(filePath);
+      if (!fileStat.isFile()) continue;
+      files.push({ generation, modifiedAt: fileStat.mtimeMs, path: filePath });
+    } catch {
+    }
+  }
+  return files;
+}
+async function removeApplicationLog(filePath) {
+  try {
+    await stat(filePath);
+  } catch {
+    return true;
+  }
+  try {
+    await unlink(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function maintainApplicationLogs(logPath, policy) {
+  const directory = path.dirname(logPath);
+  if (!ensurePrivateDirectorySync(directory)) return false;
+  let files;
+  try {
+    files = await listApplicationLogFiles(logPath);
+  } catch {
+    return false;
+  }
+  for (const file2 of files) {
+    if (!securePrivateFileSync(file2.path)) return false;
+  }
+  const cutoff = Date.now() - policy.retentionMs;
+  const retained = files.filter((file2) => file2.modifiedAt >= cutoff);
+  let maintained = true;
+  for (const file2 of files) {
+    if (file2.modifiedAt < cutoff && !await removeApplicationLog(file2.path)) maintained = false;
+  }
+  const rotated = retained.filter((file2) => file2.generation > 0).sort((left, right) => right.modifiedAt - left.modifiedAt);
+  const retainedRotatedCount = Math.max(0, policy.maxFiles - 1);
+  for (const file2 of rotated.slice(retainedRotatedCount)) {
+    if (!await removeApplicationLog(file2.path)) maintained = false;
+  }
+  return maintained;
+}
+async function moveApplicationLog(source, destination) {
+  try {
+    await stat(source);
+  } catch {
+    return true;
+  }
+  try {
+    await rename(source, destination);
+    if (!securePrivateFileSync(destination)) {
+      writeStderrFallback("[logger] Failed to secure rotated application log:", destination);
+      return false;
+    }
+    return true;
+  } catch (error51) {
+    writeStderrFallback("[logger] Failed to rotate application log:", error51);
+    return false;
+  }
+}
+async function rotateApplicationLog(logPath, maxFiles) {
+  if (maxFiles === 1) {
+    return await removeApplicationLog(logPath);
+  }
+  if (!await removeApplicationLog(`${logPath}.${String(maxFiles - 1)}`)) return false;
+  for (let generation = maxFiles - 2; generation >= 1; generation -= 1) {
+    if (!await moveApplicationLog(
+      `${logPath}.${String(generation)}`,
+      `${logPath}.${String(generation + 1)}`
+    )) {
+      return false;
+    }
+  }
+  return await moveApplicationLog(logPath, `${logPath}.1`);
+}
+async function rotateApplicationLogIfNeeded(logPath, incomingBytes, policy) {
+  try {
+    const fileStat = await stat(logPath);
+    if (fileStat.size > 0 && fileStat.size + incomingBytes > policy.maxBytes) {
+      return await rotateApplicationLog(logPath, policy.maxFiles);
+    }
+    return true;
+  } catch {
+    return true;
+  }
+}
 async function initLogger() {
   const dir = resolveLogDir();
-  const retentionMs = RETENTION_DAYS * 24 * 60 * 60 * 1e3;
-  const cutoff = Date.now() - retentionMs;
+  const policy = getApplicationLogPolicy();
+  const cutoff = Date.now() - policy.retentionMs;
   try {
-    await mkdir(dir, { recursive: true });
-    const entries = await readdir(dir);
-    for (const entry of entries) {
-      if (!entry.endsWith(".jsonl")) continue;
-      const fullPath = path.join(dir, entry);
-      try {
-        const s = await stat(fullPath);
-        if (s.mtimeMs < cutoff) {
-          await unlink(fullPath);
+    if (!ensurePrivateDirectorySync(dir)) {
+      writeStderrFallback("[logger] Failed to secure log directory:", dir);
+    } else if (!securePrivateTreeSync(dir)) {
+      writeStderrFallback("[logger] Failed to secure existing log files:", dir);
+    } else {
+      const entries = await readdir(dir);
+      for (const entry of entries) {
+        if (!entry.endsWith(".jsonl")) continue;
+        const fullPath = path.join(dir, entry);
+        try {
+          const s = await stat(fullPath);
+          if (s.mtimeMs < cutoff) {
+            await unlink(fullPath);
+          }
+        } catch {
         }
-      } catch {
       }
     }
   } catch (err) {
     writeStderrFallback("[logger] Failed to initialize log directory:", err);
   }
+  const applicationLogPath = getInspectorLogPath();
+  if (!await maintainApplicationLogs(applicationLogPath, policy)) {
+    writeStderrFallback(
+      "[logger] Failed to initialize application log lifecycle:",
+      applicationLogPath
+    );
+  }
 }
-var loggerInitialized = false;
-async function writeAppLog(message) {
-  if (!loggerInitialized) {
-    loggerInitialized = true;
-    void initLogger();
+var loggerInitialization = null;
+var applicationLogWriteQueue = Promise.resolve();
+function ensureLoggerInitialized() {
+  if (loggerInitialization === null) loggerInitialization = initLogger();
+  return loggerInitialization;
+}
+async function appendApplicationLogLine(logPath, line, policy) {
+  const logDirPath = path.dirname(logPath);
+  if (!ensurePrivateDirectorySync(logDirPath)) {
+    return { ok: false, reason: "application log directory is not private" };
   }
-  const logPath = getInspectorLogPath();
   try {
-    const logDirPath = path.dirname(logPath);
-    await mkdir(logDirPath, { recursive: true });
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    await appendFile(logPath, `[${timestamp}] ${message}
-`, "utf-8");
-  } catch (err) {
-    writeStderrFallback(`[logger] Failed to write to ${logPath}:`, err);
+    if (!await rotateApplicationLogIfNeeded(logPath, Buffer2.byteLength(line, "utf-8"), policy)) {
+      return { ok: false, reason: "application log rotation failed" };
+    }
+    await appendFile(logPath, line, { encoding: "utf-8", mode: PRIVATE_FILE_MODE });
+    if (!securePrivateFileSync(logPath)) {
+      return { ok: false, reason: "application log permissions could not be secured" };
+    }
+    return { ok: true };
+  } catch (error51) {
+    return { ok: false, reason: error51 };
   }
 }
+async function writeAppLog(message) {
+  const logPath = getInspectorLogPath();
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+`;
+  const initialization = ensureLoggerInitialized();
+  const write = async () => {
+    await initialization;
+    const result = await appendApplicationLogLine(logPath, line, getApplicationLogPolicy());
+    if (!result.ok) writeStderrFallback(`[logger] Failed to write to ${logPath}:`, result.reason);
+  };
+  applicationLogWriteQueue = applicationLogWriteQueue.then(write, write);
+  await applicationLogWriteQueue;
+}
 var logger = {
   debug(message, ...args) {
     const msg = args.length > 0 ? `${message} ${args.map(String).join(" ")}` : message;
@@ -17650,62 +17966,23 @@ var logger = {
 var writeBuffer = [];
 var writeQueue = Promise.resolve();
 var logWriteLock = Promise.resolve();
-async function runWithLogWriteLock(fn) {
-  const previousLock = logWriteLock;
-  let releaseLock = () => {
-  };
-  logWriteLock = new Promise((resolve2) => {
-    releaseLock = resolve2;
-  });
-  await previousLock;
-  try {
-    return await fn();
-  } finally {
-    releaseLock();
-  }
-}
 function drainBuffer() {
   const toWrite = writeBuffer.join("");
   writeBuffer = [];
   return toWrite;
 }
-async function flushWriteBufferUnlocked() {
-  let toWrite;
-  {
-    toWrite = drainBuffer();
-  }
-  if (toWrite.length === 0) return;
-  try {
-    const filePath = getLogFilePath();
-    await mkdir(path.dirname(filePath), { recursive: true });
-    await appendFile(filePath, toWrite, "utf-8");
-  } catch (err) {
-    writeBuffer.unshift(toWrite);
-    writeStderrFallback("[logger] Failed to flush write buffer, re-queued:", err);
-  }
-}
-async function flushLogBuffer() {
-  await writeQueue;
-  if (writeBuffer.length > 0) {
-    await runWithLogWriteLock(flushWriteBufferUnlocked);
-  }
-}
 process.on("exit", () => {
   if (writeBuffer.length > 0) {
     const toWrite = drainBuffer();
     try {
       const filePath = getLogFilePath();
-      mkdirSync(path.dirname(filePath), { recursive: true });
-      writeFileSync(filePath, toWrite, "utf-8");
+      if (!ensurePrivateDirectorySync(path.dirname(filePath))) return;
+      appendFileSync(filePath, toWrite, { encoding: "utf-8", mode: PRIVATE_FILE_MODE });
+      void securePrivateFileSync(filePath);
     } catch {
     }
   }
 });
-for (const signal of ["SIGINT", "SIGTERM"]) {
-  process.on(signal, () => {
-    void flushLogBuffer().then(() => process.exit(0));
-  });
-}
 
 // src/proxy/socketTracker.ts
 var execFileAsync = promisify(execFile);
@@ -17871,6 +18148,12 @@ var IDENTITY_HEADERS = {
   cwd: "x-agent-inspector-client-cwd",
   projectFolder: "x-agent-inspector-client-project-folder"
 };
+var IDENTITY_HEADER_PREFIX = "x-agent-inspector-";
+var PROXY_TOKEN_HEADER = "x-agent-inspector-proxy-token";
+var CSRF_HEADER = "x-agent-inspector-csrf";
+var DEFAULT_MAX_REQUEST_BYTES = 64 * 1024 * 1024;
+var DEFAULT_REQUEST_TIMEOUT_MS = 12e4;
+var identityProxyRuntimeStates = /* @__PURE__ */ new WeakMap();
 var REQUEST_HOP_BY_HOP = /* @__PURE__ */ new Set([
   "connection",
   "keep-alive",
@@ -17892,6 +18175,24 @@ var RESPONSE_HOP_BY_HOP = /* @__PURE__ */ new Set([
   "transfer-encoding",
   "upgrade"
 ]);
+var BASE_SECURITY_HEADERS = {
+  "permissions-policy": "camera=(), microphone=(), geolocation=()",
+  "referrer-policy": "no-referrer",
+  "x-content-type-options": "nosniff",
+  "x-frame-options": "DENY"
+};
+var DOCUMENT_CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "base-uri 'self'",
+  "connect-src 'self'",
+  "font-src 'self' data:",
+  "frame-ancestors 'none'",
+  "img-src 'self' data: blob:",
+  "object-src 'none'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "worker-src 'self' blob:"
+].join("; ");
 function isLoopbackPeer(address) {
   if (address === void 0) return false;
   const normalized = address.toLowerCase();
@@ -17904,22 +18205,92 @@ function bearerToken(authorization) {
 }
 function tokensMatch(received, expected) {
   if (received === null || expected === void 0 || expected === "") return false;
-  const receivedBuffer = Buffer2.from(received);
-  const expectedBuffer = Buffer2.from(expected);
+  const receivedBuffer = Buffer3.from(received);
+  const expectedBuffer = Buffer3.from(expected);
   return receivedBuffer.byteLength === expectedBuffer.byteLength && timingSafeEqual(receivedBuffer, expectedBuffer);
 }
+function firstHeader(value) {
+  return typeof value === "string" ? value : value?.[0];
+}
+function normalizedHostname(value) {
+  const candidate = value.trim();
+  if (candidate.length === 0) return null;
+  try {
+    return new URL(`http://${candidate}`).hostname.toLowerCase().replace(/^\[|]$/g, "");
+  } catch {
+    return null;
+  }
+}
+function isLoopbackHostname(hostname3) {
+  return hostname3 === "localhost" || hostname3 === "::1" || hostname3.startsWith("127.");
+}
+function isTrustedIdentityProxyHost(host, options) {
+  if (host === void 0) return false;
+  const hostname3 = normalizedHostname(host);
+  if (hostname3 === null) return false;
+  if (isLoopbackHostname(hostname3) || isIP(hostname3) !== 0) return true;
+  const listenHostname = normalizedHostname(options.listenHost);
+  if (listenHostname !== null && hostname3 === listenHostname) return true;
+  return (options.trustedHosts ?? []).some(
+    (trustedHost) => normalizedHostname(trustedHost) === hostname3
+  );
+}
+function isSafeMethod(method) {
+  const normalized = (method ?? "GET").toUpperCase();
+  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
+}
+function isPublicHealthPath(pathname) {
+  return pathname === "/livez" || pathname === "/readyz" || pathname === "/api/health";
+}
+function configuredPositiveInteger(value, fallback) {
+  return value !== void 0 && Number.isSafeInteger(value) && value > 0 ? value : fallback;
+}
+function declaredContentLength(value) {
+  if (value === void 0) return null;
+  if (!/^\d+$/.test(value)) return Number.NaN;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) ? parsed : Number.NaN;
+}
+function isBrowserMutationAllowed(input) {
+  if (isSafeMethod(input.method)) return true;
+  const pathname = new URL(input.path, "http://localhost").pathname;
+  if (pathname === "/proxy" || pathname.startsWith("/proxy/")) return true;
+  const fetchSite = input.secFetchSite?.toLowerCase();
+  const browserRequest = input.origin !== void 0 || fetchSite !== void 0;
+  if (!browserRequest) return true;
+  if (fetchSite !== void 0 && fetchSite !== "same-origin") return false;
+  if (input.origin !== void 0) {
+    try {
+      const originHost = new URL(input.origin).host.toLowerCase();
+      if (originHost !== input.host?.toLowerCase()) return false;
+    } catch {
+      return false;
+    }
+  }
+  return input.csrfToken === "1";
+}
 function isIdentityProxyRequestAllowed(input) {
   if (input.options.restrictRemoteControl !== true) return true;
   if (input.options.allowRemoteControl === true) return true;
   if (isLoopbackPeer(input.remoteAddress)) return true;
   const pathname = new URL(input.path, "http://localhost").pathname;
-  if (pathname === "/proxy" || pathname.startsWith("/proxy/")) return true;
-  if (pathname === "/api/health") return true;
+  if (pathname === "/proxy" || pathname.startsWith("/proxy/")) {
+    if (input.options.allowUnauthenticatedRemoteProxy === true) return true;
+    const proxyCredential = bearerToken(input.proxyAuthorization) ?? input.proxyTokenHeader ?? null;
+    return tokensMatch(proxyCredential, input.options.proxyToken);
+  }
+  if (isPublicHealthPath(pathname)) return true;
   return tokensMatch(bearerToken(input.authorization), input.options.controlToken);
 }
 function startIdentityProxy(options) {
   return new Promise((resolve2, reject) => {
     const server = http.createServer();
+    const runtimeState = {
+      acceptingRequests: true,
+      activeRequests: 0,
+      drainWaiters: /* @__PURE__ */ new Set()
+    };
+    identityProxyRuntimeStates.set(server, runtimeState);
     server.on("connection", (socket) => {
       const remotePort = socket.remotePort;
       if (remotePort !== void 0 && remotePort > 0) {
@@ -17927,6 +18298,29 @@ function startIdentityProxy(options) {
       }
     });
     server.on("request", (req, res) => {
+      if (!runtimeState.acceptingRequests) {
+        res.writeHead(503, {
+          "content-type": "application/json; charset=utf-8",
+          "cache-control": "no-store",
+          connection: "close",
+          "retry-after": "5"
+        });
+        res.end(JSON.stringify({ error: "Agent Inspector is shutting down" }));
+        req.resume();
+        return;
+      }
+      runtimeState.activeRequests += 1;
+      let released = false;
+      const release = () => {
+        if (released) return;
+        released = true;
+        runtimeState.activeRequests = Math.max(0, runtimeState.activeRequests - 1);
+        if (runtimeState.activeRequests !== 0) return;
+        for (const resolveDrain of runtimeState.drainWaiters) resolveDrain();
+        runtimeState.drainWaiters.clear();
+      };
+      res.once("finish", release);
+      res.once("close", release);
       void handleRequest(req, res, options).catch((err) => {
         const message = err instanceof Error ? err.message : String(err);
         if (!res.headersSent) {
@@ -17942,11 +18336,65 @@ function startIdentityProxy(options) {
     });
   });
 }
+function stopIdentityProxyAdmission(server) {
+  const state = identityProxyRuntimeStates.get(server);
+  if (state !== void 0) state.acceptingRequests = false;
+}
+async function waitForIdentityProxyDrain(server) {
+  const state = identityProxyRuntimeStates.get(server);
+  if (state === void 0 || state.activeRequests === 0) return;
+  await new Promise((resolve2) => {
+    state.drainWaiters.add(resolve2);
+  });
+}
+async function closeIdentityProxyGracefully(server) {
+  stopIdentityProxyAdmission(server);
+  const closed = new Promise((resolve2) => {
+    if (!server.listening) {
+      resolve2();
+      return;
+    }
+    server.close(() => resolve2());
+  });
+  await Promise.all([closed, waitForIdentityProxyDrain(server)]);
+}
+function forceCloseIdentityProxy(server) {
+  stopIdentityProxyAdmission(server);
+  server.closeAllConnections();
+  server.close();
+}
 async function handleRequest(req, res, options) {
+  if (!isTrustedIdentityProxyHost(req.headers.host, options)) {
+    res.writeHead(400, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    res.end(JSON.stringify({ error: "Untrusted Host header" }));
+    req.resume();
+    return;
+  }
+  if (!isBrowserMutationAllowed({
+    path: req.url ?? "/",
+    method: req.method,
+    host: req.headers.host,
+    origin: req.headers.origin,
+    secFetchSite: firstHeader(req.headers["sec-fetch-site"]),
+    csrfToken: firstHeader(req.headers[CSRF_HEADER])
+  })) {
+    res.writeHead(403, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    res.end(JSON.stringify({ error: "Browser mutation requires same-origin CSRF proof" }));
+    req.resume();
+    return;
+  }
   if (!isIdentityProxyRequestAllowed({
     path: req.url ?? "/",
     remoteAddress: req.socket.remoteAddress,
     authorization: req.headers.authorization,
+    proxyAuthorization: req.headers["proxy-authorization"],
+    proxyTokenHeader: firstHeader(req.headers[PROXY_TOKEN_HEADER]),
     options
   })) {
     res.writeHead(403, {
@@ -17955,9 +18403,10 @@ async function handleRequest(req, res, options) {
     });
     res.end(
       JSON.stringify({
-        error: "Remote control-plane access is disabled. Use the proxy endpoint or connect locally."
+        error: "Remote access requires a credential scoped to this endpoint."
       })
     );
+    req.resume();
     return;
   }
   const remotePort = req.socket.remotePort;
@@ -17969,14 +18418,34 @@ async function handleRequest(req, res, options) {
       identity = null;
     }
   }
-  const chunks = [];
-  for await (const chunk of req) {
-    chunks.push(typeof chunk === "string" ? Buffer2.from(chunk) : toBuffer(chunk));
+  const maxRequestBytes = configuredPositiveInteger(
+    options.maxRequestBytes,
+    DEFAULT_MAX_REQUEST_BYTES
+  );
+  const contentLength = declaredContentLength(req.headers["content-length"]);
+  if (contentLength !== null && (!Number.isFinite(contentLength) || contentLength < 0)) {
+    res.writeHead(400, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    res.end(JSON.stringify({ error: "Invalid Content-Length header" }));
+    req.resume();
+    return;
+  }
+  if (contentLength !== null && contentLength > maxRequestBytes) {
+    res.writeHead(413, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    res.end(JSON.stringify({ error: `Request body exceeds ${String(maxRequestBytes)} bytes` }));
+    req.resume();
+    return;
   }
-  const body = Buffer2.concat(chunks);
   const upstreamHeaders = {};
   for (const [name, value] of Object.entries(req.headers)) {
-    if (REQUEST_HOP_BY_HOP.has(name.toLowerCase())) continue;
+    const lowerName = name.toLowerCase();
+    if (REQUEST_HOP_BY_HOP.has(lowerName)) continue;
+    if (lowerName.startsWith(IDENTITY_HEADER_PREFIX)) continue;
     if (value === void 0) continue;
     upstreamHeaders[name] = value;
   }
@@ -17992,6 +18461,11 @@ async function handleRequest(req, res, options) {
       upstreamHeaders[IDENTITY_HEADERS.projectFolder] = identity.projectFolder;
     }
   }
+  let terminal = false;
+  const requestTimeoutMs = configuredPositiveInteger(
+    options.requestTimeoutMs,
+    DEFAULT_REQUEST_TIMEOUT_MS
+  );
   const proxyReq = http.request(
     {
       hostname: options.upstreamHost,
@@ -18001,38 +18475,100 @@ async function handleRequest(req, res, options) {
       headers: upstreamHeaders
     },
     (proxyRes) => {
+      if (terminal) {
+        proxyRes.resume();
+        return;
+      }
       const outHeaders = {};
       for (const [name, value] of Object.entries(proxyRes.headers)) {
         if (RESPONSE_HOP_BY_HOP.has(name.toLowerCase())) continue;
         if (value === void 0) continue;
         outHeaders[name] = value;
       }
+      for (const [name, value] of Object.entries(BASE_SECURITY_HEADERS)) {
+        outHeaders[name] = value;
+      }
+      const contentType = firstHeader(proxyRes.headers["content-type"]);
+      if (contentType?.toLowerCase().includes("text/html") === true) {
+        outHeaders["content-security-policy"] = DOCUMENT_CONTENT_SECURITY_POLICY;
+      }
       res.writeHead(proxyRes.statusCode ?? 502, outHeaders);
       proxyRes.pipe(res);
     }
   );
+  const deadline = setTimeout(() => {
+    failRequest(408, "Request body deadline exceeded");
+  }, requestTimeoutMs);
+  deadline.unref();
+  function clearDeadline() {
+    clearTimeout(deadline);
+  }
+  function failRequest(status, error51) {
+    if (terminal) return;
+    terminal = true;
+    clearDeadline();
+    proxyReq.destroy();
+    if (res.headersSent) {
+      res.destroy();
+    } else {
+      res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store"
+      });
+      res.end(JSON.stringify({ error: error51 }));
+    }
+    req.resume();
+  }
   proxyReq.on("error", (err) => {
+    if (terminal) return;
+    terminal = true;
+    clearDeadline();
     if (!res.headersSent) {
       res.writeHead(502, { "content-type": "text/plain" });
     }
     res.end(`Upstream error: ${err.message}`);
   });
-  if (body.length > 0) proxyReq.write(body);
-  proxyReq.end();
+  proxyReq.on("drain", () => req.resume());
+  res.once("close", () => {
+    clearDeadline();
+    if (!res.writableEnded) proxyReq.destroy();
+  });
+  let receivedBytes = 0;
+  req.on("data", (chunk) => {
+    if (terminal) return;
+    const buffer = toBuffer(chunk);
+    receivedBytes += buffer.byteLength;
+    if (receivedBytes > maxRequestBytes) {
+      failRequest(413, `Request body exceeds ${String(maxRequestBytes)} bytes`);
+      return;
+    }
+    if (buffer.byteLength > 0 && !proxyReq.write(buffer)) req.pause();
+  });
+  req.on("end", () => {
+    if (terminal) return;
+    clearDeadline();
+    proxyReq.end();
+  });
+  req.on("aborted", () => {
+    failRequest(400, "Client aborted request body");
+  });
+  req.on("error", () => {
+    failRequest(400, "Request body stream failed");
+  });
 }
 function toBuffer(chunk) {
-  if (Buffer2.isBuffer(chunk)) return chunk;
-  if (typeof chunk === "string") return Buffer2.from(chunk);
-  if (chunk instanceof ArrayBuffer) return Buffer2.from(chunk);
+  if (Buffer3.isBuffer(chunk)) return chunk;
+  if (typeof chunk === "string") return Buffer3.from(chunk);
+  if (chunk instanceof ArrayBuffer) return Buffer3.from(chunk);
   if (chunk instanceof Uint8Array)
-    return Buffer2.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
-  return Buffer2.alloc(0);
+    return Buffer3.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+  return Buffer3.alloc(0);
 }
 
 // src/cli.ts
 init_platformCommands();
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = dirname2(__filename2);
+var __dirname2 = dirname3(__filename2);
 var DEFAULT_PORT3 = 9527;
 var LEGACY_ALIAS_PORT = 9527;
 var DEFAULT_UPSTREAM_PORT = 9529;
@@ -18040,6 +18576,8 @@ var DEFAULT_BIND_HOST = "127.0.0.1";
 var LOCAL_PROBE_TIMEOUT_MS = 2e3;
 var BRANDED_WINDOWS_RUNTIME_EXE = "agent-inspector.exe";
 var DEFAULT_CAPTURE_MODE = "simple";
+var DEFAULT_SHUTDOWN_DEADLINE_MS = 15e3;
+var SUPERVISOR_SHUTDOWN_GRACE_MS = 2e3;
 process.title = "Agent Inspector";
 var subcommand = process.argv[2];
 if (subcommand === "onboard") {
@@ -18142,7 +18680,7 @@ function pipeServerOutputStream(stream, target, context) {
   if (stream === null) return;
   let buffered = "";
   stream.on("data", (chunk) => {
-    const text = Buffer3.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
+    const text = Buffer4.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
     const lines = `${buffered}${text}`.split(/\r?\n/);
     buffered = lines.pop() ?? "";
     for (const line of lines) {
@@ -18161,8 +18699,8 @@ function pipeServerOutputStream(stream, target, context) {
   });
 }
 function resolveServerCommand(outputDir, serverPath) {
-  const brandedRuntime = join6(outputDir, BRANDED_WINDOWS_RUNTIME_EXE);
-  return process.platform === "win32" && existsSync5(brandedRuntime) ? { command: brandedRuntime, args: [serverPath] } : { command: process.execPath, args: [serverPath] };
+  const brandedRuntime = join7(outputDir, BRANDED_WINDOWS_RUNTIME_EXE);
+  return process.platform === "win32" && existsSync6(brandedRuntime) ? { command: brandedRuntime, args: [serverPath] } : { command: process.execPath, args: [serverPath] };
 }
 function parseCaptureMode(value) {
   switch (value) {
@@ -18188,16 +18726,33 @@ function printAccessHints(port, host) {
     console.log(line);
   }
   if (!isLoopbackHost(host)) {
+    const proxyTokenConfigured = (process.env["AGENT_INSPECTOR_PROXY_TOKEN"] ?? "") !== "";
+    const legacyProxyEnabled = process.env["AGENT_INSPECTOR_ALLOW_UNAUTHENTICATED_REMOTE_PROXY"] === "1";
+    if (proxyTokenConfigured) {
+      console.log("   Remote proxy:   dedicated token authentication enabled");
+    } else if (legacyProxyEnabled) {
+      console.warn("   Remote proxy:   UNAUTHENTICATED compatibility mode enabled");
+    } else {
+      console.warn("   Remote proxy:   blocked until AGENT_INSPECTOR_PROXY_TOKEN is configured");
+    }
     if (process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] === "1") {
       console.warn("   Control plane:  REMOTE ACCESS ENABLED by administrator override");
     } else {
-      console.log("   Control plane:  local only; remote clients may use /proxy");
+      console.log("   Control plane:  local only by default");
       if ((process.env["AGENT_INSPECTOR_CONTROL_TOKEN"] ?? "") !== "") {
         console.log("   Remote API:     Bearer token authentication enabled");
       }
     }
   }
 }
+function readPositiveIntegerEnv(name) {
+  const raw = process.env[name];
+  if (raw === void 0 || raw.trim().length === 0) return void 0;
+  const parsed = Number(raw);
+  if (Number.isSafeInteger(parsed) && parsed > 0) return parsed;
+  console.warn(`Ignoring invalid ${name}=${raw}; expected a positive integer.`);
+  return void 0;
+}
 function buildBackgroundSupervisorArgs(options) {
   const args = ["--no-open", "--port", String(options.port), "--mode", options.captureMode];
   if (options.host !== void 0) {
@@ -18236,7 +18791,12 @@ async function tryStartIdentityProxy(identityPort, upstreamPort, listenHost, ups
       upstreamPort,
       restrictRemoteControl: !isLoopbackHost(listenHost),
       allowRemoteControl: process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] === "1",
-      controlToken: process.env["AGENT_INSPECTOR_CONTROL_TOKEN"]
+      controlToken: process.env["AGENT_INSPECTOR_CONTROL_TOKEN"],
+      proxyToken: process.env["AGENT_INSPECTOR_PROXY_TOKEN"],
+      allowUnauthenticatedRemoteProxy: process.env["AGENT_INSPECTOR_ALLOW_UNAUTHENTICATED_REMOTE_PROXY"] === "1",
+      trustedHosts: (process.env["AGENT_INSPECTOR_TRUSTED_HOSTS"] ?? "").split(",").map((host) => host.trim()).filter((host) => host.length > 0),
+      maxRequestBytes: readPositiveIntegerEnv("AGENT_INSPECTOR_MAX_REQUEST_BYTES"),
+      requestTimeoutMs: readPositiveIntegerEnv("AGENT_INSPECTOR_REQUEST_TIMEOUT_MS")
     });
     return server;
   } catch (err) {
@@ -18388,9 +18948,9 @@ async function runStart(args) {
     process.exitCode = 1;
     return;
   }
-  if (!enableIdentityProxy && !isLoopbackHost(host) && process.env["AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL"] !== "1") {
+  if (!enableIdentityProxy && process.env["AGENT_INSPECTOR_ALLOW_UNPROTECTED_INGRESS"] !== "1") {
     console.error(
-      "Refusing an unprotected remote bind with --no-identity-proxy. Keep the identity proxy enabled or set AGENT_INSPECTOR_ALLOW_REMOTE_CONTROL=1 explicitly."
+      "Refusing --no-identity-proxy because it also disables Host, CSRF, credential-scope, and first-hop budget enforcement. Keep the protected ingress enabled or set AGENT_INSPECTOR_ALLOW_UNPROTECTED_INGRESS=1 explicitly for temporary diagnostics."
     );
     process.exitCode = 1;
     return;
@@ -18518,11 +19078,11 @@ async function runStart(args) {
     openBrowser(url2);
   }
   const outputDir = __dirname2;
-  const serverPath = join6(outputDir, "../.output/server/index.mjs");
+  const serverPath = join7(outputDir, "../.output/server/index.mjs");
   const serverCommand = resolveServerCommand(outputDir, serverPath);
   const serverEnv = { ...process.env };
   if (configDir !== void 0) {
-    let resolvedPath = join6(configDir);
+    let resolvedPath = join7(configDir);
     const msysMatch = /^\\([a-z])\\(.*)$/i.exec(resolvedPath);
     if (msysMatch !== null) {
       const drive = (msysMatch[1] ?? "").toUpperCase();
@@ -18541,6 +19101,10 @@ async function runStart(args) {
   serverEnv["AGENT_INSPECTOR_PUBLIC_PORT"] = String(port);
   serverEnv["PROXY_PORT"] = String(port);
   serverEnv["AGENT_INSPECTOR_CAPTURE_MODE"] = captureMode;
+  const workerDir = join7(__dirname2, "workers");
+  if (existsSync6(workerDir)) {
+    serverEnv["AGENT_INSPECTOR_WORKER_DIR"] = workerDir;
+  }
   const serverProcess = spawn(serverCommand.command, serverCommand.args, {
     stdio: background ? ["ignore", "ignore", "ignore"] : ["ignore", "pipe", "pipe"],
     detached: background,
@@ -18559,6 +19123,37 @@ async function runStart(args) {
     });
   }
   const identityProxies = [];
+  let supervisorShutdownPromise = null;
+  const requestSupervisorShutdown = (signal) => {
+    if (supervisorShutdownPromise !== null) return;
+    for (const proxy of identityProxies) stopIdentityProxyAdmission(proxy.server);
+    serverProcess.kill(signal);
+    const childDeadline = readPositiveIntegerEnv("AGENT_INSPECTOR_SHUTDOWN_TIMEOUT_MS") ?? DEFAULT_SHUTDOWN_DEADLINE_MS;
+    let deadline = null;
+    let forced = false;
+    const graceful = Promise.all([
+      serverExit.then(() => void 0),
+      ...identityProxies.map(async (proxy) => await closeIdentityProxyGracefully(proxy.server))
+    ]).then(() => void 0);
+    const timedOut = new Promise((resolve2) => {
+      deadline = setTimeout(() => {
+        forced = true;
+        for (const proxy of identityProxies) forceCloseIdentityProxy(proxy.server);
+        if (serverProcess.exitCode === null) serverProcess.kill("SIGKILL");
+        resolve2();
+      }, childDeadline + SUPERVISOR_SHUTDOWN_GRACE_MS);
+    });
+    supervisorShutdownPromise = Promise.race([graceful, timedOut]).finally(() => {
+      if (deadline !== null) clearTimeout(deadline);
+    }).then(() => {
+      if (forced) process.exitCode = 1;
+    });
+  };
+  const handleSigint = () => requestSupervisorShutdown("SIGINT");
+  const handleSigterm = () => requestSupervisorShutdown("SIGTERM");
+  const currentSupervisorShutdown = () => supervisorShutdownPromise;
+  process.on("SIGINT", handleSigint);
+  process.on("SIGTERM", handleSigterm);
   if (enableIdentityProxy) {
     const primaryProxy = await tryStartIdentityProxy(port, upstreamPort, host, upstreamHost);
     if (primaryProxy !== null) {
@@ -18618,7 +19213,12 @@ async function runStart(args) {
     }
   }
   process.exitCode = await serverExit;
-  for (const proxy of identityProxies) {
-    await new Promise((resolve2) => proxy.server.close(() => resolve2()));
+  const activeSupervisorShutdown = currentSupervisorShutdown();
+  if (activeSupervisorShutdown !== null) {
+    await activeSupervisorShutdown;
+  } else {
+    await Promise.all(identityProxies.map((proxy) => closeIdentityProxyGracefully(proxy.server)));
   }
+  process.off("SIGINT", handleSigint);
+  process.off("SIGTERM", handleSigterm);
 }