@tonyclaw/agent-inspector 3.0.45 → 3.0.46

package/.output/cli.js

@@ -18,6 +18,15 @@ var __export = (target, all) => {
 function trimSlashes(value) {
   return value.replace(/^\/+/u, "").replace(/\/+$/u, "");
 }
+function normalizePublicBasePath(value) {
+  const trimmed = value?.trim() ?? "";
+  if (trimmed.length === 0 || trimmed === "/") return "";
+  if (!trimmed.startsWith("/") || trimmed.startsWith("//")) return null;
+  const normalized = normalizeBasePath(trimmed);
+  if (!SAFE_PUBLIC_BASE_PATH_PATTERN.test(normalized)) return null;
+  if (normalized.split("/").some((segment) => segment === "." || segment === "..")) return null;
+  return normalized;
+}
 function normalizeBasePath(value) {
   const trimmed = value?.trim();
   if (trimmed === void 0 || trimmed.length === 0 || trimmed === "/") return "";
@@ -34,14 +43,10 @@ function readProcessBasePath() {
   return process.env[AGENT_INSPECTOR_BASE_PATH_ENV];
 }
 function getConfiguredBasePath(env) {
-  if (env !== void 0) {
-    return normalizeBasePath(
-      env[AGENT_INSPECTOR_BASE_PATH_ENV] ?? DEFAULT_AGENT_INSPECTOR_BASE_PATH
-    );
-  }
-  return normalizeBasePath(
-    readProcessBasePath() ?? readDocumentBasePath() ?? import.meta.env?.BASE_URL ?? DEFAULT_AGENT_INSPECTOR_BASE_PATH
-  );
+  const configured = env !== void 0 ? env[AGENT_INSPECTOR_BASE_PATH_ENV] ?? DEFAULT_AGENT_INSPECTOR_BASE_PATH : readProcessBasePath() ?? readDocumentBasePath() ?? import.meta.env?.BASE_URL ?? DEFAULT_AGENT_INSPECTOR_BASE_PATH;
+  const normalized = normalizePublicBasePath(configured);
+  if (normalized !== null) return normalized;
+  return normalizePublicBasePath(DEFAULT_AGENT_INSPECTOR_BASE_PATH) ?? "";
 }
 function withBasePath(path2, basePath = getConfiguredBasePath()) {
   const normalized = normalizeBasePath(basePath);
@@ -67,7 +72,7 @@ function stripBasePathFromRequestPath(rawPath, basePath) {
   const url2 = new URL(rawPath, "http://localhost");
   return `${stripBasePath(url2.pathname, basePath)}${url2.search}`;
 }
-var AGENT_INSPECTOR_BASE_PATH_ENV, AGENT_INSPECTOR_INTERNAL_STRIPPED_BASE_PATH_ENV, AGENT_INSPECTOR_BASE_PATH_META_NAME, AGENT_INSPECTOR_PUBLIC_BASE_PATH_HEADER, AGENT_INSPECTOR_PUBLIC_PORT_HEADER, DEFAULT_AGENT_INSPECTOR_BASE_PATH;
+var AGENT_INSPECTOR_BASE_PATH_ENV, AGENT_INSPECTOR_INTERNAL_STRIPPED_BASE_PATH_ENV, AGENT_INSPECTOR_BASE_PATH_META_NAME, AGENT_INSPECTOR_PUBLIC_BASE_PATH_HEADER, AGENT_INSPECTOR_PUBLIC_PORT_HEADER, AGENT_INSPECTOR_PUBLIC_ORIGIN_HEADER, DEFAULT_AGENT_INSPECTOR_BASE_PATH, SAFE_PUBLIC_BASE_PATH_PATTERN;
 var init_basePath = __esm({
   "src/lib/basePath.ts"() {
     "use strict";
@@ -76,7 +81,9 @@ var init_basePath = __esm({
     AGENT_INSPECTOR_BASE_PATH_META_NAME = "agent-inspector-base-path";
     AGENT_INSPECTOR_PUBLIC_BASE_PATH_HEADER = "x-agent-inspector-public-base-path";
     AGENT_INSPECTOR_PUBLIC_PORT_HEADER = "x-agent-inspector-public-port";
+    AGENT_INSPECTOR_PUBLIC_ORIGIN_HEADER = "x-agent-inspector-public-origin";
     DEFAULT_AGENT_INSPECTOR_BASE_PATH = "/inspector";
+    SAFE_PUBLIC_BASE_PATH_PATTERN = /^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/u;
   }
 });
 
@@ -139,6 +146,7 @@ var init_managedInstance = __esm({
 
 // src/cli/networkHints.ts
 import { networkInterfaces } from "node:os";
+import { isIP } from "node:net";
 function localUrlForPort(port) {
   return `http://localhost:${String(port)}`;
 }
@@ -153,7 +161,9 @@ function isWildcardHost(host) {
 function isLoopbackHost(host) {
   const trimmed = trimHost(host);
   if (trimmed === void 0) return false;
-  return trimmed === "localhost" || trimmed === "::1" || trimmed === "[::1]" || trimmed.startsWith("127.");
+  const normalized = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1).toLowerCase() : trimmed.toLowerCase();
+  if (normalized === "localhost" || normalized === "::1") return true;
+  return isIP(normalized) === 4 && normalized.split(".", 1)[0] === "127";
 }
 function bracketIpv6(host) {
   if (!host.includes(":")) return host;
@@ -215,20 +225,25 @@ function networkUrlsForBindHost(port, host, interfaces = networkInterfaces()) {
 function accessUrl(origin, path2, basePath) {
   return appendBasePathToOrigin(origin, path2, basePath);
 }
-function formatAccessHintLines(port, networkUrls, host = void 0, basePath = "") {
+function appendSurfaceLines(lines, label, origin, basePath, uiEnabled) {
+  const baseUrl = accessUrl(origin, "/", basePath);
+  if (uiEnabled) lines.push(`   ${label} UI:       ${baseUrl}`);
+  lines.push(`   ${label} control Base: ${baseUrl}`);
+  lines.push(`   ${label} agent Base:   ${baseUrl}`);
+  lines.push(`   ${label} REST API:     ${accessUrl(origin, "/api", basePath)}`);
+  lines.push(`   ${label} proxy:        ${accessUrl(origin, "/proxy", basePath)}`);
+  lines.push(`   ${label} MCP:          ${accessUrl(origin, "/api/mcp", basePath)}`);
+}
+function formatAccessHintLines(port, networkUrls, host = void 0, basePath = "", uiEnabled = true) {
   const normalizedBasePath = normalizeBasePath(basePath);
   const localUrl = localUrlForPort(port);
   const hostLabel = isWildcardHost(host) ? "all interfaces (0.0.0.0)" : trimHost(host) ?? "";
   const lines = ["Access URLs:", `   Bind host:      ${hostLabel}`];
   if (isLoopbackHost(host) || isWildcardHost(host)) {
-    lines.push(`   Local UI:       ${accessUrl(localUrl, "/", normalizedBasePath)}`);
-    lines.push(`   Local proxy:    ${accessUrl(localUrl, "/proxy", normalizedBasePath)}`);
-    lines.push(`   Local MCP:      ${accessUrl(localUrl, "/api/mcp", normalizedBasePath)}`);
+    appendSurfaceLines(lines, "Local", localUrl, normalizedBasePath, uiEnabled);
   } else {
     const boundUrl = urlForHost(port, host);
-    lines.push(`   Bound UI:       ${accessUrl(boundUrl, "/", normalizedBasePath)}`);
-    lines.push(`   Bound proxy:    ${accessUrl(boundUrl, "/proxy", normalizedBasePath)}`);
-    lines.push(`   Bound MCP:      ${accessUrl(boundUrl, "/api/mcp", normalizedBasePath)}`);
+    appendSurfaceLines(lines, "Bound", boundUrl, normalizedBasePath, uiEnabled);
     lines.push("   Localhost:      may not work because the server is bound to a specific host");
   }
   const firstNetworkUrl = networkUrls[0];
@@ -237,8 +252,7 @@ function formatAccessHintLines(port, networkUrls, host = void 0, basePath = "")
   } else if (firstNetworkUrl === void 0) {
     lines.push("   Network:        no non-loopback IPv4 address detected");
   } else {
-    lines.push(`   Network UI:     ${accessUrl(firstNetworkUrl, "/", normalizedBasePath)}`);
-    lines.push(`   Network proxy:  ${accessUrl(firstNetworkUrl, "/proxy", normalizedBasePath)}`);
+    appendSurfaceLines(lines, "Network", firstNetworkUrl, normalizedBasePath, uiEnabled);
     const moreUrls = networkUrls.slice(1);
     if (moreUrls.length > 0) {
       lines.push(`   Other IPs:      ${moreUrls.join(", ")}`);
@@ -15337,10 +15351,103 @@ var init_zod = __esm({
   }
 });
 
+// src/lib/browserRuntimeContract.ts
+function parseAbsoluteUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+function hasUnsafePathSegment(pathname) {
+  return pathname.split("/").some((segment) => segment === "." || segment === ".." || /%(?:2e|2f|5c)/iu.test(segment));
+}
+function hasControlCharacter(value) {
+  return [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code < 32 || code === 127;
+  });
+}
+function normalizeBrowserRuntimeBasePath(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return null;
+  const normalized = normalizePublicBasePath(trimmed);
+  if (normalized === null) return null;
+  return normalized.length === 0 ? "/" : normalized;
+}
+function normalizeBrowserRuntimeBaseUrl(value) {
+  if (value.trim() !== value || value.includes("\\") || hasControlCharacter(value) || hasUnsafePathSegment(value)) {
+    return null;
+  }
+  const parsed = parseAbsoluteUrl(value);
+  if (parsed === null) return null;
+  switch (parsed.protocol) {
+    case "http:":
+    case "https:":
+      break;
+    default:
+      return null;
+  }
+  if (parsed.username.length > 0 || parsed.password.length > 0 || parsed.search.length > 0 || parsed.hash.length > 0 || hasUnsafePathSegment(parsed.pathname)) {
+    return null;
+  }
+  const basePath = normalizeBrowserRuntimeBasePath(parsed.pathname);
+  if (basePath === null) return null;
+  return basePath === "/" ? parsed.origin : `${parsed.origin}${basePath}`;
+}
+var BROWSER_RUNTIME_SCHEMA_VERSION, BROWSER_RUNTIME_JSON_PLACEHOLDER, BrowserRuntimeBasePathSchema, BrowserRuntimeBaseUrlSchema, BrowserRuntimeCapabilitiesSchema, BrowserRuntimeDeploymentSchema;
+var init_browserRuntimeContract = __esm({
+  "src/lib/browserRuntimeContract.ts"() {
+    "use strict";
+    init_zod();
+    init_basePath();
+    BROWSER_RUNTIME_SCHEMA_VERSION = 1;
+    BROWSER_RUNTIME_JSON_PLACEHOLDER = "__AGENT_INSPECTOR_RUNTIME_JSON__";
+    BrowserRuntimeBasePathSchema = external_exports.string().min(1).max(2048).refine(
+      (value) => normalizeBrowserRuntimeBasePath(value) !== null,
+      "UI Base Path must be an absolute path without query, hash, backslash, or traversal"
+    ).transform((value) => normalizeBrowserRuntimeBasePath(value) ?? value);
+    BrowserRuntimeBaseUrlSchema = external_exports.string().min(1).max(2048).refine(
+      (value) => normalizeBrowserRuntimeBaseUrl(value) !== null,
+      "Runtime Base URL must be an HTTP(S) URL without credentials, query, hash, or traversal"
+    ).transform((value) => normalizeBrowserRuntimeBaseUrl(value) ?? value);
+    BrowserRuntimeCapabilitiesSchema = external_exports.object({
+      rest: external_exports.boolean(),
+      sse: external_exports.boolean(),
+      proxy: external_exports.boolean(),
+      mcp: external_exports.boolean()
+    }).strict();
+    BrowserRuntimeDeploymentSchema = external_exports.object({
+      schemaVersion: external_exports.literal(BROWSER_RUNTIME_SCHEMA_VERSION),
+      deploymentMode: external_exports.enum(["composed", "backend-only", "separated"]),
+      ui: external_exports.object({
+        basePath: BrowserRuntimeBasePathSchema
+      }).strict(),
+      control: external_exports.object({
+        baseUrl: BrowserRuntimeBaseUrlSchema
+      }).strict(),
+      agent: external_exports.object({
+        baseUrl: BrowserRuntimeBaseUrlSchema
+      }).strict(),
+      capabilities: BrowserRuntimeCapabilitiesSchema
+    }).strict();
+  }
+});
+
 // src/proxy/privateDataPath.ts
 import { spawnSync } from "node:child_process";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
+import {
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  realpathSync
+} from "node:fs";
+import { join, parse as parse3, resolve, sep } from "node:path";
 function windowsSystemPath(executable) {
   const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
   return `${systemRoot}\\System32\\${executable}`;
@@ -15369,9 +15476,7 @@ function resolveWindowsUserSid(run) {
 function windowsBroadGroupRemovalArgs() {
   return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"];
 }
-function applyWindowsUserOnlyAcl(path2, kind, run = runWindowsCommand) {
-  const sid = resolveWindowsUserSid(run);
-  if (sid === null) return false;
+function applyWindowsAclWithSid(path2, kind, sid, run) {
   const access = kind === "directory" ? `(OI)(CI)F` : "F";
   const result = run("icacls.exe", [
     path2,
@@ -15383,112 +15488,244 @@ function applyWindowsUserOnlyAcl(path2, kind, run = runWindowsCommand) {
   ]);
   return result.status === 0;
 }
-function applyWindowsUserOnlyTreeAcl(root, run = runWindowsCommand) {
+function applyWindowsUserOnlyAcl(path2, kind, run = runWindowsCommand) {
   const sid = resolveWindowsUserSid(run);
-  if (sid === null) return false;
-  const result = run("icacls.exe", [
-    root,
-    "/inheritance:r",
-    "/grant:r",
-    `*${sid}:(OI)(CI)F`,
-    `*${sid}:F`,
-    ...windowsBroadGroupRemovalArgs(),
-    "/T",
-    "/C",
-    "/Q"
-  ]);
-  return result.status === 0;
+  return sid !== null && applyWindowsAclWithSid(path2, kind, sid, run);
 }
-function applyPrivatePermissionsSync(path2, kind) {
+function comparablePath(path2) {
+  let normalized = path2;
   if (process.platform === "win32") {
-    return applyWindowsUserOnlyAcl(path2, kind);
-  }
-  try {
-    chmodSync(path2, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
-    return true;
-  } catch {
-    return false;
+    if (normalized.startsWith("\\\\?\\UNC\\")) {
+      normalized = `\\\\${normalized.slice(8)}`;
+    } else if (normalized.startsWith("\\\\?\\")) {
+      normalized = normalized.slice(4);
+    }
   }
+  const absolute = resolve(normalized);
+  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
 }
-function secureOnce(path2, kind) {
-  const cacheKey = `${kind}:${path2}`;
-  if (securedPaths.has(cacheKey)) return true;
-  if (!applyPrivatePermissionsSync(path2, kind)) return false;
-  securedPaths.add(cacheKey);
-  return true;
+function pathIdentity(stats) {
+  return `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
 }
-function ensurePrivateDirectorySync(path2) {
+function readPathEntry(path2) {
+  let stats;
   try {
-    mkdirSync(path2, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+    const observed = lstatSync(path2);
+    if (observed === void 0) return { status: "missing" };
+    stats = observed;
   } catch {
-    return false;
+    return { status: "missing" };
   }
-  return secureOnce(path2, "directory");
-}
-function securePrivateFileSync(path2, forceAcl = false) {
-  let identity;
+  if (stats.isSymbolicLink()) return { status: "unsafe" };
+  const kind = stats.isDirectory() ? "directory" : stats.isFile() ? "file" : null;
+  if (kind === null) return { status: "unsafe" };
+  let canonical;
   try {
-    const stats = statSync(path2);
-    identity = `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
+    canonical = realpathSync.native(path2);
   } catch {
-    return false;
+    return { status: "unsafe" };
   }
-  if (securedFileIdentities.get(path2) === identity) return true;
-  if (process.platform === "win32" && !forceAcl && securedPaths.has(`directory:${dirname(path2)}`)) {
-    securedFileIdentities.set(path2, identity);
-    return true;
+  if (comparablePath(canonical) !== comparablePath(path2)) return { status: "unsafe" };
+  return {
+    status: "ok",
+    entry: {
+      path: path2,
+      kind,
+      identity: pathIdentity(stats),
+      mode: stats.mode & 511
+    }
+  };
+}
+function snapshotPathChain(path2) {
+  const absolutePath = resolve(path2);
+  const root = parse3(absolutePath).root;
+  const suffix = absolutePath.slice(root.length);
+  const parts = suffix === "" ? [] : suffix.split(sep).filter((part) => part !== "");
+  const entries = [];
+  let current = root;
+  const rootRead = readPathEntry(root);
+  if (rootRead.status !== "ok" || rootRead.entry.kind !== "directory") return null;
+  entries.push(rootRead.entry);
+  for (let index = 0; index < parts.length; index += 1) {
+    const part = parts[index];
+    if (part === void 0) return null;
+    current = join(current, part);
+    const read = readPathEntry(current);
+    if (read.status === "unsafe") return null;
+    if (read.status === "missing") {
+      return {
+        absolutePath,
+        complete: false,
+        entries,
+        missingParts: parts.slice(index)
+      };
+    }
+    if (index < parts.length - 1 && read.entry.kind !== "directory") return null;
+    entries.push(read.entry);
   }
-  if (!applyPrivatePermissionsSync(path2, "file")) return false;
-  securedFileIdentities.set(path2, identity);
-  return true;
+  return { absolutePath, complete: true, entries, missingParts: [] };
 }
-function securePrivateTreeSync(root) {
-  if (!existsSync(root)) return false;
-  let stats;
+function chainFingerprint(snapshot) {
+  return snapshot.entries.map((entry) => `${entry.path}:${entry.identity}`).join("|");
+}
+function snapshotsRetainPrefix(before, after) {
+  if (after.entries.length < before.entries.length) return false;
+  return before.entries.every((entry, index) => {
+    const next = after.entries[index];
+    return next !== void 0 && next.path === entry.path && next.identity === entry.identity;
+  });
+}
+function completeSnapshotForKind(path2, kind) {
+  const snapshot = snapshotPathChain(path2);
+  if (snapshot === null || !snapshot.complete) return null;
+  const leaf = snapshot.entries.at(-1);
+  return leaf !== void 0 && leaf.kind === kind ? snapshot : null;
+}
+function applyPosixPermissions(path2, kind, expectedIdentity2) {
+  let descriptor = null;
   try {
-    stats = lstatSync(root);
+    const directoryFlag = kind === "directory" ? constants.O_DIRECTORY : 0;
+    descriptor = openSync(path2, constants.O_RDONLY | constants.O_NOFOLLOW | directoryFlag);
+    const before = fstatSync(descriptor);
+    if (pathIdentity(before) !== expectedIdentity2) return false;
+    fchmodSync(descriptor, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+    const after = fstatSync(descriptor);
+    return pathIdentity(after) === expectedIdentity2 && (after.mode & 511) === (kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
   } catch {
     return false;
+  } finally {
+    if (descriptor !== null) {
+      try {
+        closeSync(descriptor);
+      } catch {
+      }
+    }
   }
-  if (stats.isSymbolicLink()) return true;
-  if (!stats.isDirectory()) return securePrivateFileSync(root, true);
-  if (process.platform === "win32") {
-    if (!applyWindowsUserOnlyTreeAcl(root)) return false;
-    securedPaths.add(`directory:${root}`);
-    return true;
+}
+function permissionsArePrivate(entry) {
+  if (process.platform === "win32") return true;
+  return entry.mode === (entry.kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+}
+function secureExistingPath(path2, kind, forcePermissions = false) {
+  const before = completeSnapshotForKind(path2, kind);
+  if (before === null) return false;
+  const leaf = before.entries.at(-1);
+  if (leaf === void 0) return false;
+  const cacheKey = `${kind}:${before.absolutePath}`;
+  const beforeFingerprint = chainFingerprint(before);
+  if (!forcePermissions && securedPathFingerprints.get(cacheKey) === beforeFingerprint && permissionsArePrivate(leaf)) {
+    const cachedCheck = completeSnapshotForKind(path2, kind);
+    return cachedCheck !== null && chainFingerprint(cachedCheck) === beforeFingerprint;
+  }
+  const applied = process.platform === "win32" ? applyWindowsUserOnlyAcl(path2, kind) : applyPosixPermissions(path2, kind, leaf.identity);
+  if (!applied) return false;
+  const after = completeSnapshotForKind(path2, kind);
+  if (after === null || !snapshotsRetainPrefix(before, after)) return false;
+  const afterLeaf = after.entries.at(-1);
+  if (afterLeaf === void 0 || afterLeaf.identity !== leaf.identity) return false;
+  if (!permissionsArePrivate(afterLeaf)) return false;
+  securedPathFingerprints.set(cacheKey, chainFingerprint(after));
+  return true;
+}
+function ensurePrivateDirectorySync(path2) {
+  const before = snapshotPathChain(path2);
+  if (before === null) return false;
+  let current = before.entries.at(-1)?.path;
+  if (current === void 0) return false;
+  for (const part of before.missingParts) {
+    const next = join(current, part);
+    try {
+      mkdirSync(next, { mode: PRIVATE_DIRECTORY_MODE });
+    } catch {
+      const raced = readPathEntry(next);
+      if (raced.status !== "ok" || raced.entry.kind !== "directory") return false;
+    }
+    if (!secureExistingPath(next, "directory", true)) return false;
+    current = next;
   }
-  if (!ensurePrivateDirectorySync(root)) return false;
-  let entries;
-  try {
-    entries = readdirSync(root);
-  } catch {
-    return false;
+  const complete = completeSnapshotForKind(path2, "directory");
+  if (complete === null || !snapshotsRetainPrefix(before, complete)) return false;
+  return secureExistingPath(path2, "directory");
+}
+function securePrivateFileSync(path2, forceAcl = false) {
+  return secureExistingPath(path2, "file", forceAcl);
+}
+function collectSafeTree(root) {
+  const collected = [];
+  const visit = (path2) => {
+    const snapshot = snapshotPathChain(path2);
+    if (snapshot === null || !snapshot.complete) return false;
+    const leaf = snapshot.entries.at(-1);
+    if (leaf === void 0) return false;
+    const fingerprint = chainFingerprint(snapshot);
+    collected.push({ path: snapshot.absolutePath, kind: leaf.kind, fingerprint });
+    if (leaf.kind === "file") return true;
+    let entries;
+    try {
+      entries = readdirSync(path2);
+    } catch {
+      return false;
+    }
+    const afterRead = completeSnapshotForKind(path2, "directory");
+    if (afterRead === null || chainFingerprint(afterRead) !== fingerprint) return false;
+    for (const entry of entries) {
+      if (!visit(join(path2, entry))) return false;
+    }
+    return true;
+  };
+  return visit(root) ? collected : null;
+}
+function treeFingerprintsMatch(expected, observed) {
+  if (observed === null || observed.length !== expected.length) return false;
+  return expected.every((entry, index) => {
+    const next = observed[index];
+    return next !== void 0 && next.path === entry.path && next.kind === entry.kind && next.fingerprint === entry.fingerprint;
+  });
+}
+function isPathTreeFreeOfIndirectionSync(root) {
+  return collectSafeTree(root) !== null;
+}
+function applyWindowsUserOnlyTreeAcl(root, run = runWindowsCommand) {
+  const entries = collectSafeTree(root);
+  if (entries === null) return false;
+  const sid = resolveWindowsUserSid(run);
+  if (sid === null) return false;
+  for (const entry of entries) {
+    const before = completeSnapshotForKind(entry.path, entry.kind);
+    if (before === null || chainFingerprint(before) !== entry.fingerprint) return false;
+    if (!applyWindowsAclWithSid(entry.path, entry.kind, sid, run)) return false;
+    const after = completeSnapshotForKind(entry.path, entry.kind);
+    if (after === null || chainFingerprint(after) !== entry.fingerprint) return false;
+    securedPathFingerprints.set(`${entry.kind}:${entry.path}`, entry.fingerprint);
   }
-  let secured = true;
+  return treeFingerprintsMatch(entries, collectSafeTree(root));
+}
+function securePrivateTreeSync(root) {
+  const entries = collectSafeTree(root);
+  if (entries === null) return false;
+  if (process.platform === "win32") return applyWindowsUserOnlyTreeAcl(root);
   for (const entry of entries) {
-    const childPath = join(root, entry);
-    if (!securePrivateTreeSync(childPath)) secured = false;
+    if (!secureExistingPath(entry.path, entry.kind, true)) return false;
   }
-  return secured;
+  return treeFingerprintsMatch(entries, collectSafeTree(root));
 }
-var PRIVATE_DIRECTORY_MODE, PRIVATE_FILE_MODE, securedPaths, securedFileIdentities, cachedWindowsSid;
+var PRIVATE_DIRECTORY_MODE, PRIVATE_FILE_MODE, securedPathFingerprints, cachedWindowsSid;
 var init_privateDataPath = __esm({
   "src/proxy/privateDataPath.ts"() {
     "use strict";
     PRIVATE_DIRECTORY_MODE = 448;
     PRIVATE_FILE_MODE = 384;
-    securedPaths = /* @__PURE__ */ new Set();
-    securedFileIdentities = /* @__PURE__ */ new Map();
+    securedPathFingerprints = /* @__PURE__ */ new Map();
     cachedWindowsSid = null;
   }
 });
 
 // src/proxy/dataDir.ts
-import { cpSync, existsSync as existsSync2, rmSync } from "node:fs";
+import { cpSync, existsSync, readdirSync as readdirSync2, renameSync, rmSync } from "node:fs";
 import { isAbsolute, join as join2 } from "node:path";
 function getDataDir() {
   migrateLegacyDataDirs();
-  return resolveDataDir(existsSync2);
+  return resolveDataDir(existsSync);
 }
 function hasDataDirState(pathExists, dir) {
   return pathExists(join2(dir, "providers.json")) || pathExists(join2(dir, "config.json")) || pathExists(join2(dir, "logs")) || pathExists(join2(dir, "chunks"));
@@ -15515,16 +15752,42 @@ function migrateLegacyDataDirs() {
   if (hasExplicitDataDir()) return;
   const base = defaultBaseDir();
   const currentDir = join2(base, CURRENT_DATA_DIR_NAME);
-  if (hasDataDirState(existsSync2, currentDir)) return;
+  if (hasDataDirState(existsSync, currentDir)) return;
   for (const legacyName of LEGACY_DATA_DIR_NAMES) {
     const legacyDir = join2(base, legacyName);
-    if (!existsSync2(legacyDir)) continue;
+    if (!existsSync(legacyDir)) continue;
+    const stagingDir = join2(
+      base,
+      `${CURRENT_DATA_DIR_NAME}.migration-${String(process.pid)}-${String(Date.now())}`
+    );
     try {
-      if (!ensurePrivateDirectorySync(currentDir)) return;
-      cpSync(legacyDir, currentDir, { recursive: true, force: true });
-      if (!securePrivateTreeSync(currentDir)) return;
+      if (!isPathTreeFreeOfIndirectionSync(legacyDir)) return;
+      if (existsSync(currentDir)) {
+        if (readdirSync2(currentDir).length > 0) return;
+        rmSync(currentDir, { recursive: true, force: false });
+      }
+      if (!ensurePrivateDirectorySync(stagingDir)) return;
+      for (const entry of readdirSync2(legacyDir)) {
+        cpSync(join2(legacyDir, entry), join2(stagingDir, entry), {
+          recursive: true,
+          force: false,
+          errorOnExist: true
+        });
+      }
+      if (!isPathTreeFreeOfIndirectionSync(legacyDir)) {
+        rmSync(stagingDir, { recursive: true, force: true });
+        return;
+      }
+      if (!securePrivateTreeSync(stagingDir)) {
+        rmSync(stagingDir, { recursive: true, force: true });
+        return;
+      }
+      renameSync(stagingDir, currentDir);
       rmSync(legacyDir, { recursive: true, force: true });
+      return;
     } catch {
+      if (existsSync(stagingDir)) rmSync(stagingDir, { recursive: true, force: true });
+      return;
     }
   }
 }
@@ -15539,9 +15802,9 @@ var init_dataDir = __esm({
 });
 
 // src/proxy/platformCommands.ts
-import { statSync as statSync2 } from "node:fs";
+import { statSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { delimiter, isAbsolute as isAbsolute2, join as join3 } from "node:path";
+import { delimiter, isAbsolute as isAbsolute2, join as join4 } from "node:path";
 function pathEntries(envPath) {
   if (envPath === void 0 || envPath.length === 0) return [];
   return envPath.split(delimiter).filter((entry) => entry.length > 0);
@@ -15554,10 +15817,10 @@ function windowsExecutableExtensions(envPathExt) {
 }
 function isExecutableCandidate(path2, platform) {
   try {
-    const stat3 = statSync2(path2);
-    if (!stat3.isFile()) return false;
+    const stat4 = statSync(path2);
+    if (!stat4.isFile()) return false;
     if (platform === "win32" || process.platform === "win32") return true;
-    return (stat3.mode & 73) !== 0;
+    return (stat4.mode & 73) !== 0;
   } catch {
     return false;
   }
@@ -15565,14 +15828,14 @@ function isExecutableCandidate(path2, platform) {
 function executableCandidates(bin, platform, env) {
   if (isAbsolute2(bin)) return [bin];
   const entries = pathEntries(env["PATH"] ?? env["Path"] ?? env["path"]);
-  if (platform !== "win32") return entries.map((entry) => join3(entry, bin));
+  if (platform !== "win32") return entries.map((entry) => join4(entry, bin));
   const hasExtension = /\.[^\\/]+$/.test(bin);
   const extensions = hasExtension ? [""] : windowsExecutableExtensions(env["PATHEXT"]);
   const candidates = [];
   for (const entry of entries) {
     for (const extension of extensions) {
-      candidates.push(join3(entry, `${bin}${extension.toLowerCase()}`));
-      candidates.push(join3(entry, `${bin}${extension.toUpperCase()}`));
+      candidates.push(join4(entry, `${bin}${extension.toLowerCase()}`));
+      candidates.push(join4(entry, `${bin}${extension.toUpperCase()}`));
     }
   }
   return candidates;
@@ -15693,7 +15956,7 @@ var init_platformCommands = __esm({
 
 // src/cli/detect-tools.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { homedir } from "node:os";
 function which(bin) {
   return resolveExecutableOnPath(bin);
@@ -15702,31 +15965,31 @@ function tryDir(path2) {
   return existsSync3(path2) ? path2 : null;
 }
 function detectClaudeCode() {
-  const configDir = tryDir(join4(homedir(), ".claude"));
+  const configDir = tryDir(join5(homedir(), ".claude"));
   const bin = which("claude");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectOpenCode() {
-  const configDir = tryDir(join4(homedir(), ".config", "opencode"));
+  const configDir = tryDir(join5(homedir(), ".config", "opencode"));
   const bin = which("opencode");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectMiMo() {
-  const configDir = tryDir(join4(homedir(), ".config", "mimocode")) ?? tryDir(join4(homedir(), ".mimocode"));
+  const configDir = tryDir(join5(homedir(), ".config", "mimocode")) ?? tryDir(join5(homedir(), ".mimocode"));
   const bin = which("mimo");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectCursor() {
-  const configDir = tryDir(join4(homedir(), ".cursor"));
+  const configDir = tryDir(join5(homedir(), ".cursor"));
   const bin = which("cursor");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
 }
 function detectCody() {
-  const configDir = tryDir(join4(homedir(), ".config", "cody"));
+  const configDir = tryDir(join5(homedir(), ".config", "cody"));
   const bin = which("cody");
   if (configDir === null && bin === null) return { found: false };
   return { found: true, path: configDir ?? bin ?? "" };
@@ -15786,7 +16049,7 @@ var init_runtimeConfig = __esm({
 });
 
 // src/cli/instanceModel.ts
-import { randomBytes, randomUUID } from "node:crypto";
+import { randomBytes, randomUUID as randomUUID2 } from "node:crypto";
 import { isAbsolute as isAbsolute3 } from "node:path";
 function instanceRegistrySuccess(value) {
   return { kind: "success", value };
@@ -15803,19 +16066,13 @@ function validateInstanceName(rawName) {
   ) : instanceRegistrySuccess(normalized);
 }
 function normalizeInstanceBasePath(rawBasePath) {
-  const value = rawBasePath ?? "";
-  const trimmed = value.trim();
-  const hasControlCharacter = [...trimmed].some((character) => {
-    const codePoint = character.codePointAt(0) ?? 0;
-    return codePoint < 32 || codePoint === 127;
-  });
-  if (trimmed.length > 0 && (!trimmed.startsWith("/") || trimmed.includes("?") || trimmed.includes("#") || trimmed.includes("\\") || hasControlCharacter)) {
+  const normalized = normalizePublicBasePath(rawBasePath);
+  if (normalized === null) {
     return instanceRegistryError(
       "record_invalid",
-      "Instance Base Path must be an absolute URL path without a query, hash, backslash, or control character."
+      "Instance Base Path must use URL-safe path segments without traversal, encoded separators, or markup characters."
     );
   }
-  const normalized = normalizeBasePath(trimmed);
   const reservedControlRoot = MANAGED_INSTANCE_CONTROL_PATH.replace(/\/instance$/u, "");
   if (normalized === reservedControlRoot || normalized.startsWith(`${reservedControlRoot}/`)) {
     return instanceRegistryError(
@@ -15827,7 +16084,7 @@ function normalizeInstanceBasePath(rawBasePath) {
 }
 function createLaunch(factory, now) {
   return {
-    launchId: factory.createLaunchId?.() ?? randomUUID(),
+    launchId: factory.createLaunchId?.() ?? randomUUID2(),
     controlToken: factory.createControlToken?.() ?? randomBytes(32).toString("base64url"),
     startedAt: now.toISOString()
   };
@@ -15842,7 +16099,7 @@ function createInstanceRecord(input, factory = {}) {
   const candidate = {
     schemaVersion: INSTANCE_RECORD_SCHEMA_VERSION,
     name: name.value,
-    instanceId: factory.createInstanceId?.() ?? randomUUID(),
+    instanceId: factory.createInstanceId?.() ?? randomUUID2(),
     createdAt: timestamp,
     updatedAt: timestamp,
     host: input.host.trim(),
@@ -15850,6 +16107,7 @@ function createInstanceRecord(input, factory = {}) {
     upstreamPort: input.upstreamPort,
     basePath: basePath.value,
     captureMode: input.captureMode,
+    uiEnabled: input.uiEnabled ?? true,
     dataDir: input.dataDir,
     launch: createLaunch(factory, now)
   };
@@ -15911,6 +16169,7 @@ var init_instanceModel = __esm({
       upstreamPort: PortSchema,
       basePath: NormalizedBasePathSchema,
       captureMode: CaptureModeSchema,
+      uiEnabled: external_exports.boolean().default(true),
       dataDir: external_exports.string().min(1).refine((path2) => isAbsolute3(path2)),
       launch: InstanceLaunchSchema
     }).strict().superRefine((record2, context) => {
@@ -15926,23 +16185,23 @@ var init_instanceModel = __esm({
 });
 
 // src/cli/instanceRegistry.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import {
-  closeSync,
+  closeSync as closeSync3,
   existsSync as existsSync4,
   mkdirSync as mkdirSync2,
-  openSync,
+  openSync as openSync3,
   readFileSync,
-  readdirSync as readdirSync2,
-  realpathSync,
-  renameSync,
+  readdirSync as readdirSync3,
+  realpathSync as realpathSync2,
+  renameSync as renameSync2,
   rmSync as rmSync2,
-  statSync as statSync3,
+  statSync as statSync2,
   writeFileSync
 } from "node:fs";
 import { createServer } from "node:net";
 import { homedir as homedir2 } from "node:os";
-import { join as join5, posix, win32 } from "node:path";
+import { join as join6, posix, win32 } from "node:path";
 function getInstancesRoot(env = process.env, platform = process.platform) {
   const pathApi = platform === "win32" ? win32 : posix;
   const explicitRoot = env[AGENT_INSPECTOR_INSTANCES_DIR_ENV];
@@ -15965,13 +16224,13 @@ function getInstancesRoot(env = process.env, platform = process.platform) {
 function getInstancePaths(root, rawName) {
   const name = validateInstanceName(rawName);
   if (name.kind === "error") return name;
-  const instanceDir = join5(root, name.value);
+  const instanceDir = join6(root, name.value);
   return instanceRegistrySuccess({
     root,
     instanceDir,
-    dataDir: join5(instanceDir, "data"),
-    recordPath: join5(instanceDir, INSTANCE_RECORD_FILE_NAME),
-    lockPath: join5(instanceDir, INSTANCE_LOCK_DIRECTORY_NAME)
+    dataDir: join6(instanceDir, "data"),
+    recordPath: join6(instanceDir, INSTANCE_RECORD_FILE_NAME),
+    lockPath: join6(instanceDir, INSTANCE_LOCK_DIRECTORY_NAME)
   });
 }
 function ensureInstancesRoot(root = getInstancesRoot()) {
@@ -16011,7 +16270,7 @@ function listInstanceRecords(root) {
   if (!existsSync4(root)) return instanceRegistrySuccess([]);
   let entries;
   try {
-    entries = readdirSync2(root, { withFileTypes: true });
+    entries = readdirSync3(root, { withFileTypes: true });
   } catch {
     return instanceRegistryError("registry_io", `Cannot read the instance registry at ${root}.`);
   }
@@ -16019,7 +16278,7 @@ function listInstanceRecords(root) {
   const names = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const recordPath = join5(root, entry.name, INSTANCE_RECORD_FILE_NAME);
+    const recordPath = join6(root, entry.name, INSTANCE_RECORD_FILE_NAME);
     if (!existsSync4(recordPath)) continue;
     const record2 = readRecordFile(recordPath);
     if (record2.kind === "error") return record2;
@@ -16066,16 +16325,16 @@ function writeInstanceRecord(root, record2) {
       `Cannot create or secure the data directory for instance ${validated.data.name}.`
     );
   }
-  const temporaryPath = join5(
+  const temporaryPath = join6(
     paths.value.instanceDir,
-    `.${INSTANCE_RECORD_FILE_NAME}.${String(process.pid)}.${randomUUID2()}.tmp`
+    `.${INSTANCE_RECORD_FILE_NAME}.${String(process.pid)}.${randomUUID3()}.tmp`
   );
   let descriptor = null;
   try {
-    descriptor = openSync(temporaryPath, "wx", PRIVATE_FILE_MODE);
+    descriptor = openSync3(temporaryPath, "wx", PRIVATE_FILE_MODE);
     writeFileSync(descriptor, `${JSON.stringify(validated.data, null, 2)}
 `, "utf8");
-    closeSync(descriptor);
+    closeSync3(descriptor);
     descriptor = null;
     if (!securePrivateFileSync(temporaryPath)) {
       cleanupFile(temporaryPath);
@@ -16084,12 +16343,12 @@ function writeInstanceRecord(root, record2) {
         `Cannot secure the saved record for instance ${validated.data.name}.`
       );
     }
-    renameSync(temporaryPath, paths.value.recordPath);
+    renameSync2(temporaryPath, paths.value.recordPath);
     return instanceRegistrySuccess(validated.data);
   } catch {
     if (descriptor !== null) {
       try {
-        closeSync(descriptor);
+        closeSync3(descriptor);
       } catch {
       }
     }
@@ -16116,7 +16375,7 @@ function defaultIsProcessAlive(pid) {
 }
 function readLockOwner(lockPath) {
   try {
-    const raw = JSON.parse(readFileSync(join5(lockPath, LOCK_OWNER_FILE_NAME), "utf8"));
+    const raw = JSON.parse(readFileSync(join6(lockPath, LOCK_OWNER_FILE_NAME), "utf8"));
     const parsed = InstanceLockOwnerSchema.safeParse(raw);
     return parsed.success ? parsed.data : null;
   } catch {
@@ -16126,7 +16385,7 @@ function readLockOwner(lockPath) {
 function lockCreatedAt(lockPath, owner) {
   if (owner !== null) return Date.parse(owner.createdAt);
   try {
-    return statSync3(lockPath).mtimeMs;
+    return statSync2(lockPath).mtimeMs;
   } catch {
     return null;
   }
@@ -16136,9 +16395,9 @@ function recoverStaleLock(lockPath, staleAfterMs, now, isProcessAlive) {
   const createdAt = lockCreatedAt(lockPath, owner);
   if (createdAt === null || now - createdAt < staleAfterMs) return false;
   if (owner !== null && isProcessAlive(owner.pid)) return false;
-  const recoveredPath = `${lockPath}.stale-${randomUUID2()}`;
+  const recoveredPath = `${lockPath}.stale-${randomUUID3()}`;
   try {
-    renameSync(lockPath, recoveredPath);
+    renameSync2(lockPath, recoveredPath);
     rmSync2(recoveredPath, { recursive: true, force: true });
     return true;
   } catch {
@@ -16169,7 +16428,7 @@ async function acquireDirectoryLock(lockPath, options) {
   const now = options.now ?? Date.now;
   const sleep3 = options.sleep ?? defaultSleep;
   const isProcessAlive = options.isProcessAlive ?? defaultIsProcessAlive;
-  const createToken = options.createToken ?? randomUUID2;
+  const createToken = options.createToken ?? randomUUID3;
   const startedAt = now();
   while (now() - startedAt <= timeoutMs) {
     const token = createToken();
@@ -16195,7 +16454,7 @@ async function acquireDirectoryLock(lockPath, options) {
         token,
         createdAt: new Date(now()).toISOString()
       };
-      const ownerPath = join5(lockPath, LOCK_OWNER_FILE_NAME);
+      const ownerPath = join6(lockPath, LOCK_OWNER_FILE_NAME);
       writeFileSync(ownerPath, `${JSON.stringify(owner)}
 `, {
         encoding: "utf8",
@@ -16225,7 +16484,7 @@ async function acquireDirectoryLock(lockPath, options) {
 }
 async function acquireRegistryLock(root, options = {}) {
   const ensured = ensureInstancesRoot(root);
-  return ensured.kind === "error" ? ensured : acquireDirectoryLock(join5(root, ROOT_LOCK_DIRECTORY_NAME), options);
+  return ensured.kind === "error" ? ensured : acquireDirectoryLock(join6(root, ROOT_LOCK_DIRECTORY_NAME), options);
 }
 async function acquireInstanceLock(root, rawName, options = {}) {
   const paths = getInstancePaths(root, rawName);
@@ -16268,7 +16527,7 @@ function canonicalizeDataDirectory(rawPath, options = {}) {
   const resolvedPath = resolveRealPathWithMissingTail(
     absolutePath,
     pathApi,
-    options.realpath ?? realpathSync.native
+    options.realpath ?? realpathSync2.native
   );
   const normalizedPath = pathApi.normalize(resolvedPath);
   const root = pathApi.parse(normalizedPath).root;
@@ -16419,18 +16678,21 @@ var init_instanceRegistry = __esm({
 });
 
 // src/cli/onboardTarget.ts
-function targetFromBase(kind, instanceName, mcpName, port, baseUrl) {
+function targetFromSurfaces(kind, instanceName, mcpName, port, controlBaseUrl, agentBaseUrl, uiUrl) {
   return {
     kind,
     instanceName,
     mcpName,
     port,
-    baseUrl,
-    apiUrl: `${baseUrl}/api`,
-    healthUrl: `${baseUrl}/api/health`,
-    anthropicProxyUrl: `${baseUrl}/proxy`,
-    openAiProxyUrl: `${baseUrl}/proxy/v1`,
-    mcpUrl: `${baseUrl}/api/mcp`
+    uiUrl,
+    controlBaseUrl,
+    agentBaseUrl,
+    baseUrl: controlBaseUrl,
+    apiUrl: `${controlBaseUrl}/api`,
+    healthUrl: `${controlBaseUrl}/api/health`,
+    anthropicProxyUrl: `${agentBaseUrl}/proxy`,
+    openAiProxyUrl: `${agentBaseUrl}/proxy/v1`,
+    mcpUrl: `${agentBaseUrl}/api/mcp`
   };
 }
 function validateMcpName(rawName) {
@@ -16438,29 +16700,35 @@ function validateMcpName(rawName) {
   return name === rawName && MCP_NAME_PATTERN.test(name) ? name : null;
 }
 function normalizeExplicitBaseUrl(rawBaseUrl) {
-  const candidate = rawBaseUrl.trim();
-  if (candidate.length === 0 || candidate !== rawBaseUrl || candidate.includes("?") || candidate.includes("#")) {
+  const baseUrl = normalizeBrowserRuntimeBaseUrl(rawBaseUrl);
+  if (baseUrl === null) return null;
+  try {
+    const parsed = new URL(baseUrl);
+    const defaultPort = parsed.protocol === "https:" ? 443 : 80;
+    const port = parsed.port === "" ? defaultPort : Number(parsed.port);
+    return Number.isInteger(port) && port >= 1 && port <= 65535 ? { baseUrl, port } : null;
+  } catch {
     return null;
   }
+}
+function normalizePublicOrigin(rawOrigin) {
+  if (rawOrigin.trim() !== rawOrigin) return null;
   try {
-    const parsed = new URL(candidate);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.hostname.length === 0 || parsed.username.length > 0 || parsed.password.length > 0) {
+    const parsed = new URL(rawOrigin);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username.length > 0 || parsed.password.length > 0 || parsed.pathname !== "/" || parsed.search.length > 0 || parsed.hash.length > 0) {
       return null;
     }
-    const pathname = parsed.pathname.replace(/\/+$/u, "");
-    const baseUrl = `${parsed.origin}${pathname === "" ? "" : pathname}`;
-    const defaultPort = parsed.protocol === "https:" ? 443 : 80;
-    const port = parsed.port === "" ? defaultPort : Number(parsed.port);
-    return Number.isInteger(port) && port >= 1 && port <= 65535 ? { baseUrl, port } : null;
+    return parsed.origin;
   } catch {
     return null;
   }
 }
 function resolveOnboardTarget(options, env = process.env) {
-  if (options.instanceName !== null && options.baseUrl !== null) {
+  const hasExplicitSurface = options.baseUrl !== null || options.controlBaseUrl !== null && options.controlBaseUrl !== void 0 || options.agentBaseUrl !== null && options.agentBaseUrl !== void 0 || options.uiUrl !== void 0;
+  if (options.instanceName !== null && hasExplicitSurface) {
     return {
       ok: false,
-      message: "--instance and --base-url are mutually exclusive"
+      message: "--instance and explicit --base-url/--control-base-url/--agent-base-url/--ui-url options are mutually exclusive"
     };
   }
   const explicitMcpName = options.mcpName === null ? null : validateMcpName(options.mcpName);
@@ -16470,22 +16738,29 @@ function resolveOnboardTarget(options, env = process.env) {
       message: "--mcp-name must be 1-128 letters, digits, dots, hyphens, or underscores and start with a letter or digit"
     };
   }
-  if (options.baseUrl !== null) {
-    const explicit = normalizeExplicitBaseUrl(options.baseUrl);
-    if (explicit === null) {
+  if (hasExplicitSurface) {
+    const sharedRaw = options.baseUrl;
+    const controlRaw = options.controlBaseUrl ?? sharedRaw ?? options.agentBaseUrl;
+    const agentRaw = options.agentBaseUrl ?? sharedRaw ?? options.controlBaseUrl;
+    const control = controlRaw === null || controlRaw === void 0 ? null : normalizeExplicitBaseUrl(controlRaw);
+    const agent = agentRaw === null || agentRaw === void 0 ? null : normalizeExplicitBaseUrl(agentRaw);
+    const ui = options.uiUrl === void 0 || options.uiUrl === null ? null : normalizeExplicitBaseUrl(options.uiUrl);
+    if (control === null || agent === null || options.uiUrl !== void 0 && options.uiUrl !== null && ui === null) {
       return {
         ok: false,
-        message: "--base-url must be a credential-free HTTP or HTTPS URL without a query or fragment"
+        message: "Explicit UI, control, and agent Base URLs must be credential-free HTTP(S) URLs without a query or fragment"
       };
     }
     return {
       ok: true,
-      target: targetFromBase(
+      target: targetFromSurfaces(
         "base-url",
         null,
         explicitMcpName ?? "agent-inspector",
-        explicit.port,
-        explicit.baseUrl
+        control.port,
+        control.baseUrl,
+        agent.baseUrl,
+        ui?.baseUrl ?? null
       )
     };
   }
@@ -16508,36 +16783,50 @@ function resolveOnboardTarget(options, env = process.env) {
     const baseUrl2 = appendBasePathToOrigin(origin, "/", record2.value.basePath);
     return {
       ok: true,
-      target: targetFromBase(
+      target: targetFromSurfaces(
         "instance",
         record2.value.name,
         explicitMcpName ?? `agent-inspector-${record2.value.name}`,
         record2.value.publicPort,
-        baseUrl2
+        baseUrl2,
+        baseUrl2,
+        record2.value.uiEnabled ? baseUrl2 : null
       )
     };
   }
-  const baseUrl = appendBasePathToOrigin(DEFAULT_ORIGIN, "/", getConfiguredBasePath(env));
+  const configuredPublicOrigin = env[AGENT_INSPECTOR_PUBLIC_ORIGIN_ENV];
+  const publicOrigin = configuredPublicOrigin === void 0 ? DEFAULT_ORIGIN : normalizePublicOrigin(configuredPublicOrigin);
+  if (publicOrigin === null) {
+    return {
+      ok: false,
+      message: "AGENT_INSPECTOR_PUBLIC_ORIGIN must be an exact credential-free HTTP(S) origin without a path, query, or fragment"
+    };
+  }
+  const baseUrl = appendBasePathToOrigin(publicOrigin, "/", getConfiguredBasePath(env));
   return {
     ok: true,
-    target: targetFromBase(
+    target: targetFromSurfaces(
       "default",
       null,
       explicitMcpName ?? "agent-inspector",
       DEFAULT_PORT,
-      baseUrl
+      baseUrl,
+      baseUrl,
+      env["AGENT_INSPECTOR_BACKEND_ONLY"] === "1" ? null : baseUrl
     )
   };
 }
-var DEFAULT_PORT, DEFAULT_ORIGIN, MCP_NAME_PATTERN;
+var DEFAULT_PORT, DEFAULT_ORIGIN, AGENT_INSPECTOR_PUBLIC_ORIGIN_ENV, MCP_NAME_PATTERN;
 var init_onboardTarget = __esm({
   "src/cli/onboardTarget.ts"() {
     "use strict";
     init_basePath();
+    init_browserRuntimeContract();
     init_instanceRegistry();
     init_networkHints();
     DEFAULT_PORT = 9527;
     DEFAULT_ORIGIN = `http://localhost:${String(DEFAULT_PORT)}`;
+    AGENT_INSPECTOR_PUBLIC_ORIGIN_ENV = "AGENT_INSPECTOR_PUBLIC_ORIGIN";
     MCP_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
   }
 });
@@ -16564,22 +16853,28 @@ var init_command_onboard = __esm({
 
 // src/cli/templates/codex-skill-onboard.ts
 function renderCodexSkillOnboard(ctx) {
-  const { version: version2, baseUrl } = ctx;
+  const { version: version2 } = ctx;
+  const controlBaseUrl = ctx.controlBaseUrl ?? ctx.baseUrl;
+  const agentBaseUrl = ctx.agentBaseUrl ?? ctx.baseUrl;
+  const uiUrl = ctx.uiUrl === void 0 ? ctx.baseUrl : ctx.uiUrl;
   const mcpName = ctx.mcpName ?? "agent-inspector";
   const targetKind = ctx.targetKind ?? "default";
   const targetArguments = ctx.onboardTargetArguments ?? "";
   const instanceName = ctx.instanceName ?? null;
-  const healthUrl = `${baseUrl}/api/health`;
-  const configUrl = `${baseUrl}/api/config`;
-  const anthropicProxyUrl = `${baseUrl}/proxy`;
-  const openAiProxyUrl = `${baseUrl}/proxy/v1`;
-  const mcpUrl = `${baseUrl}/api/mcp`;
+  const healthUrl = `${controlBaseUrl}/api/health`;
+  const runtimeUrl = `${controlBaseUrl}/api/runtime`;
+  const configUrl = `${controlBaseUrl}/api/config`;
+  const anthropicProxyUrl = `${agentBaseUrl}/proxy`;
+  const openAiProxyUrl = `${agentBaseUrl}/proxy/v1`;
+  const mcpUrl = `${agentBaseUrl}/api/mcp`;
   const mcpTomlKey = /^[A-Za-z0-9_-]+$/u.test(mcpName) ? mcpName : JSON.stringify(mcpName);
   const statusCommand = `agent-inspector onboard --status${targetArguments}`;
   const refreshCommand = `agent-inspector onboard --force${targetArguments}`;
-  const startCommand = targetKind === "instance" && instanceName !== null ? `agent-inspector instance start ${instanceName}` : targetKind === "base-url" ? `# Explicit target ${baseUrl}: do not start a replacement local runtime.` : "agent-inspector --mode simple --background --no-open";
+  const startCommand = targetKind === "instance" && instanceName !== null ? `agent-inspector instance start ${instanceName}` : targetKind === "base-url" ? `# Explicit control target ${controlBaseUrl}: do not start a replacement local runtime.` : "agent-inspector --mode simple --background --no-open";
   const fullModeCommand = targetKind === "instance" && instanceName !== null ? `agent-inspector instance restart ${instanceName} --mode full` : targetKind === "base-url" ? "ask the target operator to enable Full capture mode" : "agent-inspector --mode full --force-restart";
-  const startExplanation = targetKind === "base-url" ? `The selected Inspector target is the explicit Base URL \`${baseUrl}\`. Do not start the default local runtime as a substitute; verify the selected target and ask its operator for help if it is unavailable.` : `Start or reuse the selected Agent Inspector runtime before wiring MCP. Prefer the installed binary so Windows users get the branded runtime in Task Manager. Use \`${fullModeCommand}\` only when the user needs raw headers, raw response, or SSE chunks.`;
+  const startExplanation = targetKind === "base-url" ? `The selected Inspector target uses control Base URL \`${controlBaseUrl}\` and agent Base URL \`${agentBaseUrl}\`. Do not start the default local runtime as a substitute; verify the selected target and ask its operator for help if it is unavailable.` : `Start or reuse the selected Agent Inspector backend before wiring MCP. The default command composes a UI, while backend-only named instances retain proxy, REST, health, and MCP without UI files. Prefer the installed binary so Windows users get the branded runtime in Task Manager. Use \`${fullModeCommand}\` only when the user needs raw headers, raw response, or SSE chunks.`;
+  const selectedUi = uiUrl === null ? "not supplied (do not infer one from a backend URL)" : `\`${uiUrl}\``;
+  const providerTestUiGuidance = uiUrl === null ? `No UI URL was supplied. Do not open \`${controlBaseUrl}\` or \`${agentBaseUrl}\` as a page; use the MCP Provider Test tools and log/session resources, or ask the operator for a standalone UI URL.` : `The operator supplied the explicit composed or standalone UI URL \`${uiUrl}\`. Use that URL for browser steps; do not substitute the control or agent Base URL.`;
   return `---
 name: agent-inspector-onboard
 description: Guide Codex users through connecting Agent Inspector v${version2} as a local MCP server.
@@ -16592,7 +16887,13 @@ metadata:
 
 Use this skill when the user wants to set up Agent Inspector inside Codex, connect the Agent Inspector MCP server, inspect captured model traffic from Codex, or turn Inspector sessions into reviewable knowledge candidates.
 
-Agent Inspector runs a local web UI, proxy, REST API, and MCP endpoint on the same port. The default MCP endpoint is:
+The selected deployment has these explicit surfaces:
+
+- UI URL: ${selectedUi}
+- Control Base URL: \`${controlBaseUrl}\`
+- Agent Base URL: \`${agentBaseUrl}\`
+
+Composed mode may use one URL for all three, but backend-only mode and separately hosted UI deployments do not require UI and backend to share a process, origin, or port. The selected MCP endpoint is:
 
 \`\`\`text
 ${mcpUrl}
@@ -16610,6 +16911,8 @@ Do not configure both transports in the same MCP client, or the client may show
 
 Keep this setup local and explicit. Agent Inspector MCP tools can read captured requests and provider configuration, so only wire it into trusted local Codex environments.
 
+The backend publishes token-free runtime discovery at \`${runtimeUrl}\`. Treat \`backend-only\` as healthy when REST, proxy, and MCP capabilities are present.
+
 Agent Inspector starts in **Simple mode** by default. Keep Simple mode for everyday capture: requests, responses, tools, timing, and token usage stay available without retaining heavier raw headers, raw response, or detailed SSE chunk artifacts. Use **Full mode** only when the user is debugging provider headers, raw response payloads, or SSE stream details.
 
 ---
@@ -16652,12 +16955,14 @@ ${startExplanation}
 \`\`\`powershell
 ${startCommand}
 Invoke-RestMethod -Uri "${healthUrl}" -TimeoutSec 3
+Invoke-RestMethod -Uri "${runtimeUrl}" -TimeoutSec 3 | Select-Object deploymentMode, capabilities
 Invoke-RestMethod -Uri "${configUrl}" -TimeoutSec 3 | Select-Object captureMode
 \`\`\`
 
 \`\`\`bash
 ${startCommand}
 curl -fsS "${healthUrl}"
+curl -fsS "${runtimeUrl}"
 curl -fsS "${configUrl}" | grep -o '"captureMode":"[^"]*"'
 \`\`\`
 
@@ -16701,7 +17006,7 @@ When editing:
 - Keep existing \`mcp_servers.*\`, \`projects.*\`, profiles, sandbox, approval, and model settings intact.
 - Remove any duplicate Inspector MCP entry that points to the same \`/api/mcp\` endpoint or runs the same \`agent-inspector-mcp stdio\` bridge under another name.
 - Do not write provider API keys into Codex config.
-- Do not expose Agent Inspector MCP beyond localhost.
+- Do not expose a raw Inspector listener to untrusted networks. For remote use, require the operator's authenticated same-origin gateway and keep control credentials in environment variables rather than generated config.
 
 ---
 
@@ -16782,14 +17087,18 @@ Inspector, \`localhost\` points at the tool's own environment. Replace \`localho
 address reachable from that environment, then verify the network/firewall path before debugging
 provider credentials.
 
-For a Provider Test memory probe, run a provider test in the Agent Inspector UI:
+For a Provider Test memory probe, first read \`${runtimeUrl}\`. ${providerTestUiGuidance}
+
+When an explicit UI URL is available:
 
-1. Open \`${baseUrl}\`.
+1. Open the supplied UI URL.
 2. Go to Settings -> Providers.
 3. Add or edit a Provider.
 4. Run Test.
 5. Check the \`provider-test\` session.
 
+If discovery reports \`backend-only\`, do not fail onboarding. A separately hosted UI may still exist only when its URL was explicitly supplied; otherwise use the MCP Provider Test tools and log/session resources. Proxy, REST, health, and MCP remain fully usable without UI files.
+
 Then ask Codex:
 
 \`\`\`text
@@ -16823,35 +17132,43 @@ var init_codex_skill_onboard = __esm({
 
 // src/cli/templates/skill-onboard.ts
 function renderSkillOnboard(ctx) {
-  const { version: version2, port, baseUrl, detectedSummary } = ctx;
+  const { version: version2, port, detectedSummary } = ctx;
+  const controlBaseUrl = ctx.controlBaseUrl ?? ctx.baseUrl;
+  const agentBaseUrl = ctx.agentBaseUrl ?? ctx.baseUrl;
+  const uiUrl = ctx.uiUrl === void 0 ? ctx.baseUrl : ctx.uiUrl;
   const mcpName = ctx.mcpName ?? "agent-inspector";
   const targetKind = ctx.targetKind ?? "default";
   const targetArguments = ctx.onboardTargetArguments ?? "";
   const instanceName = ctx.instanceName ?? null;
-  const healthUrl = `${baseUrl}/api/health`;
-  const configUrl = `${baseUrl}/api/config`;
-  const anthropicProxyUrl = `${baseUrl}/proxy`;
-  const openAiProxyUrl = `${baseUrl}/proxy/v1`;
-  const mcpUrl = `${baseUrl}/api/mcp`;
-  const logsUrl = `${baseUrl}/api/logs`;
+  const healthUrl = `${controlBaseUrl}/api/health`;
+  const runtimeUrl = `${controlBaseUrl}/api/runtime`;
+  const configUrl = `${controlBaseUrl}/api/config`;
+  const anthropicProxyUrl = `${agentBaseUrl}/proxy`;
+  const openAiProxyUrl = `${agentBaseUrl}/proxy/v1`;
+  const mcpUrl = `${agentBaseUrl}/api/mcp`;
+  const logsUrl = `${controlBaseUrl}/api/logs`;
+  const providersUrl = `${controlBaseUrl}/api/providers`;
   const statusCommand = `agent-inspector onboard --status${targetArguments}`;
   const refreshCommand = `agent-inspector onboard --force${targetArguments}`;
-  const startCommand = targetKind === "instance" && instanceName !== null ? `agent-inspector instance start ${instanceName}` : targetKind === "base-url" ? `# Explicit target ${baseUrl}: do not start a replacement local runtime.` : "agent-inspector --mode simple --background --no-open";
+  const startCommand = targetKind === "instance" && instanceName !== null ? `agent-inspector instance start ${instanceName}` : targetKind === "base-url" ? `# Explicit control target ${controlBaseUrl}: do not start a replacement local runtime.` : "agent-inspector --mode simple --background --no-open";
   const fullModeCommand = targetKind === "instance" && instanceName !== null ? `agent-inspector instance restart ${instanceName} --mode full` : targetKind === "base-url" ? "ask the target operator to enable Full capture mode" : "agent-inspector --mode full --force-restart";
   const bashStartSnippet = targetKind === "base-url" ? startCommand : `${startCommand} > /tmp/agent-inspector.log 2>&1`;
   const windowsStartArguments = targetKind === "instance" && instanceName !== null ? `instance start ${instanceName}` : "--mode simple --background --no-open";
   const powershellStartSnippet = targetKind === "base-url" ? startCommand : `$found = Get-Command agent-inspector -ErrorAction SilentlyContinue
 if (-not $found) { throw 'agent-inspector is not on PATH' }
 & $found.Source ${windowsStartArguments}`;
-  const startExplanation = targetKind === "base-url" ? `The selected Inspector target is the explicit Base URL \`${baseUrl}\`. Do not launch a default local runtime as a substitute; verify the selected target and ask its operator for help if it is unavailable.` : `Start or reuse the selected Inspector runtime. It listens on port ${String(port)} and preserves the selected Base Path. Use \`${fullModeCommand}\` only when the user needs raw headers, raw response, or SSE chunks.`;
-  const stopSnippet = targetKind === "instance" && instanceName !== null ? `agent-inspector instance stop ${instanceName}` : targetKind === "base-url" ? `# Ask the operator of ${baseUrl} to stop the selected runtime.` : `# Unix / macOS
+  const startExplanation = targetKind === "base-url" ? `The selected Inspector target uses control Base URL \`${controlBaseUrl}\` and agent Base URL \`${agentBaseUrl}\`. Do not launch a default local runtime as a substitute; verify the selected target and ask its operator for help if it is unavailable.` : `Start or reuse the selected Inspector backend. Its public control and agent endpoints preserve the selected Base Path; a Web UI may be composed at the same URL, hosted separately, or intentionally absent in backend-only mode. Use \`${fullModeCommand}\` only when the user needs raw headers, raw response, or SSE chunks.`;
+  const stopSnippet = targetKind === "instance" && instanceName !== null ? `agent-inspector instance stop ${instanceName}` : targetKind === "base-url" ? `# Ask the operator of ${controlBaseUrl} to stop the selected runtime.` : `# Unix / macOS
   lsof -ti:${String(port)} | xargs -r kill -9
 
   # Windows PowerShell
   Get-NetTCPConnection -LocalPort ${String(port)} | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force }`;
+  const providerScopeGuidance = targetKind === "default" ? "The unmanaged default target owns the local Agent Inspector data directory used by the file checks below." : `The selected target is not the unmanaged default data directory. Do not inspect or edit local ~/.agent-inspector Provider files as a substitute. Query \`${providersUrl}\`, use the selected target's MCP Provider tools with explicit approval, or ask its operator to configure Providers. Skip local-file commands below.`;
+  const selectedUi = uiUrl === null ? "not supplied (do not infer one from a backend URL)" : `\`${uiUrl}\``;
+  const uiTour = uiUrl === null ? "not supplied; continue with MCP/REST, and ask the operator for a standalone UI URL only if the user needs one" : `\`${uiUrl}\` \u2014 use this explicit composed or standalone browser URL; do not replace it with the control or agent Base URL`;
   return `---
 name: agent-inspector-onboard
-description: Guided setup for Agent Inspector v${version2}: start the proxy, wire your AI coding tool, capture your first request, and learn the Web UI.
+description: Guided setup for Agent Inspector v${version2}: start or select the backend, wire your AI coding tool, and capture your first request with or without a Web UI.
 metadata:
   author: agent-inspector
   version: ${version2}
@@ -16859,12 +17176,16 @@ metadata:
 
 # Agent Inspector onboard
 
-Guide the user from "I just installed Agent Inspector" to "I can see my AI tool's traffic in the Web UI". This is a teaching experience: you'll do real work in their environment while explaining each step.
+Guide the user from "I just installed Agent Inspector" to "my coding agent can use the proxy, REST API, and MCP surface". The backend works in composed and headless deployments; treat the Web UI as an optional presentation surface.
 
 Environment detected by the installer:
 ${detectedSummary || "  (no known AI tool detected \u2014 the user can still use the generic curl example in Phase 4)"}
 
-Selected Inspector target: \`${baseUrl}\` (MCP key: \`${mcpName}\`).
+Selected Inspector surfaces:
+- UI URL: ${selectedUi}
+- Control Base URL: \`${controlBaseUrl}\`
+- Agent Base URL: \`${agentBaseUrl}\`
+- MCP key: \`${mcpName}\`
 
 > **PAUSE protocol.** Every \`**PAUSE**\` marker in this skill is a real stop.
 > Use the \`AskUserQuestion\` tool to actually wait for the user before
@@ -16892,9 +17213,11 @@ ${statusCommand}
 
 **DO:** Then probe the three pieces of state this skill touches. Use targeted checks \u2014 do **not** read large JSON files into the conversation.
 
+**DO:** ${providerScopeGuidance}
+
 \`\`\`bash
-# 1. Is the proxy already up?
-curl -fsS "${healthUrl}" 2>/dev/null && echo "PROXY: up" || echo "PROXY: down"
+# 1. Is the backend already up?
+curl -fsS "${healthUrl}" 2>/dev/null && echo "BACKEND: up" || echo "BACKEND: down"
 
 # 2. Does the provider config have a real provider key?
 agent_inspector_data_dir() {
@@ -16960,12 +17283,12 @@ $dataDir = Resolve-AgentInspectorDataDir
 $providers = Join-Path $dataDir 'providers.json'
 $legacyConfig = Join-Path $dataDir 'config.json'
 
-# 1. Is the proxy already up?
+# 1. Is the backend already up?
 try {
   $null = Invoke-RestMethod -Uri "${healthUrl}" -TimeoutSec 2 -ErrorAction Stop
-  Write-Host 'PROXY: up'
+  Write-Host 'BACKEND: up'
 } catch {
-  Write-Host 'PROXY: down'
+  Write-Host 'BACKEND: down'
 }
 
 # 2. Does the config have a real provider key?
@@ -17035,7 +17358,7 @@ node -e "const fs=require('node:fs'),p=require('node:path');const names=process.
 \`\`\`
 ## Welcome to Agent Inspector!
 
-Agent Inspector is an agent observability and knowledge-capture platform for AI coding tools. The \`agent-inspector\` CLI runs a transparent local proxy + Web UI, so you can see model requests and responses, system prompts, tool definitions, message history, timing, and token counts captured live in a browser tab.
+Agent Inspector is an agent observability and knowledge-capture platform for AI coding tools. Its backend owns the transparent model proxy, REST/SSE APIs, capture storage, and MCP server. The default CLI composes a Web UI at the same public Base URL, while \`--backend-only\` keeps every Coding Agent surface available without serving UI files.
 
 Agent Inspector starts in **Simple mode** by default. Simple mode is the right habit for everyday use: it keeps requests, responses, tools, timing, and token usage while avoiding heavier raw headers, raw response, and detailed SSE chunk artifacts. Use **Full mode** only when the user is debugging provider headers, raw response payloads, or SSE stream details.
 
@@ -17055,6 +17378,8 @@ Ready? Let's start with the provider.
 
 ## Phase 2: Provider setup
 
+**DO:** ${providerScopeGuidance}
+
 **EXPLAIN:** "A 'provider' is an upstream LLM endpoint \u2014 Anthropic, OpenAI, MiniMax, etc. agent-inspector routes each request to the right upstream based on the model name. You need at least one provider configured for the proxy to forward traffic."
 
 **DO:** First, re-check whether \`<dataDir>/providers.json\` already has a real key (Phase 0 may have raced with a manual edit). Use the same data-dir resolution and \`grep -qE '"apiKey":"sk-'\` (bash) or \`Select-String\` (PowerShell) check from Phase 0. If a real key is present, skip the rest of this phase.
@@ -17155,7 +17480,7 @@ $json | Set-Content -Path $file -Encoding UTF8
 
 **EXPLAIN:** "${startExplanation}"
 
-**DO:** Skip this phase entirely if the Phase 0 health check already reported \`PROXY: up\` and the user opted to skip done phases.
+**DO:** Skip this phase entirely if the Phase 0 health check already reported \`BACKEND: up\` and the user opted to skip done phases.
 
 **DO:** Otherwise, use the selected target command below. An explicit wrapper Base URL is connection-only and must not cause a replacement local runtime to start.
 
@@ -17168,7 +17493,7 @@ ${bashStartSnippet}
 ${powershellStartSnippet}
 \`\`\`
 
-Then wait for the port to be ready:
+Then wait for the selected backend health URL to be ready:
 
 \`\`\`bash
 for i in $(seq 1 20); do
@@ -17177,12 +17502,18 @@ for i in $(seq 1 20); do
 done
 \`\`\`
 
-**DO:** Hit the health endpoint to confirm the proxy is alive:
+**DO:** Hit the health endpoint to confirm the backend is alive:
 
 \`\`\`bash
 curl -sS "${healthUrl}"
 \`\`\`
 
+**DO:** Read the token-free runtime discovery document. Report \`deploymentMode\` and capabilities; do not treat \`backend-only\` as a failure or infer that a UI is present.
+
+\`\`\`bash
+curl -sS "${runtimeUrl}"
+\`\`\`
+
 **DO:** Read \`/api/config\` and tell the user which capture mode is active. If deeper capture is required, offer \`${fullModeCommand}\`.
 
 \`\`\`bash
@@ -17322,10 +17653,11 @@ done
 
 ## Phase 6: Tour & wrap
 
-**EXPLAIN:** "Everything's working. Here's the cheat sheet for the Web UI and the supporting surfaces:"
+**EXPLAIN:** "Everything's working. Here's the cheat sheet for the backend surfaces and the optional Web UI:"
 
-- **Web UI**: \`${baseUrl}\` \u2014 collapsible log rows, per-tab Copy/Expand in the log header, Diff with Raw (request body), Diff with Previous (compare adjacent requests), Replay (re-send a request), Export (JSON ZIP).
-- **MCP server**: \`${mcpUrl}\` \u2014 connect from your coding agent to query logs, replay, and test providers without leaving the editor. Look for the "MCP Ready" badge in the Web UI header.
+- **Runtime discovery**: \`${runtimeUrl}\` \u2014 token-free deployment mode, UI Base Path, control/agent Base URLs, and capabilities.
+- **Web UI**: ${uiTour}.
+- **MCP server**: \`${mcpUrl}\` \u2014 connect from the coding agent to query logs, replay, and test providers; it does not require a Web UI process.
 - **REST API**: \`/api/logs\`, \`/api/sessions\`, \`/api/providers\` \u2014 for scripting and shell-based inspection.
 - **Stop the proxy**:
 
@@ -17336,7 +17668,7 @@ ${stopSnippet}
 - **Re-run onboard**: \`${refreshCommand}\` refreshes this skill.
 - **Check onboard files**: \`${statusCommand}\` shows whether generated skills are
   current, outdated, missing, newer, or custom.
-- **Full docs**: see the project README (linked from the Web UI footer).
+- **Full docs**: see the project README; do not depend on a UI footer being available.
 
 > **PAUSE** \u2014 use \`AskUserQuestion\` with header \`All set?\` and options \`["All set, I'm done", "Wait, I want to revisit a phase"]\`. Wait for the answer.
 
@@ -17372,11 +17704,11 @@ import {
   existsSync as existsSync5,
   readFileSync as readFileSync2,
   unlinkSync,
-  readdirSync as readdirSync3,
+  readdirSync as readdirSync4,
   rmdirSync
 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { dirname, join as join7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function actionForStatus(label, state) {
   switch (state) {
@@ -17422,6 +17754,9 @@ function parseFlags(argv) {
     mimoMcpUrl: null,
     instanceName: null,
     baseUrl: null,
+    controlBaseUrl: null,
+    agentBaseUrl: null,
+    uiUrl: void 0,
     mcpName: null,
     uninstall: false,
     status: false,
@@ -17572,6 +17907,39 @@ function parseFlags(argv) {
         i++;
         break;
       }
+      case "--control-base-url": {
+        const next = argv[i + 1];
+        if (next === void 0 || next.trim().length === 0) {
+          process.stderr.write("agent-inspector onboard: --control-base-url requires a URL\n");
+          process.exit(2);
+        }
+        flags.controlBaseUrl = next;
+        i++;
+        break;
+      }
+      case "--agent-base-url": {
+        const next = argv[i + 1];
+        if (next === void 0 || next.trim().length === 0) {
+          process.stderr.write("agent-inspector onboard: --agent-base-url requires a URL\n");
+          process.exit(2);
+        }
+        flags.agentBaseUrl = next;
+        i++;
+        break;
+      }
+      case "--ui-url": {
+        const next = argv[i + 1];
+        if (next === void 0 || next.trim().length === 0) {
+          process.stderr.write("agent-inspector onboard: --ui-url requires a URL\n");
+          process.exit(2);
+        }
+        flags.uiUrl = next;
+        i++;
+        break;
+      }
+      case "--no-ui":
+        flags.uiUrl = null;
+        break;
       case "--mcp-name": {
         const next = argv[i + 1];
         if (next === void 0 || next.trim().length === 0) {
@@ -17652,7 +18020,11 @@ Options:
                            MiMo Code MCP transport to write (default: local)
   --mimo-mcp-url <url>     Agent Inspector MCP endpoint for MiMo Code
   --instance <name>        Target a registered named Inspector instance
-  --base-url <url>         Target an explicit credential-free Inspector Base URL
+  --base-url <url>         Target an explicit credential-free backend control/agent Base URL
+  --control-base-url <url> Control API Base URL for a separated deployment
+  --agent-base-url <url>   Proxy and MCP Base URL for Coding Agents
+  --ui-url <url>           Browser UI URL for a separated deployment
+  --no-ui                  Declare that the explicit target has no browser UI
   --mcp-name <name>        MCP config key (named default: agent-inspector-<instance>)
   --uninstall              Remove generated files whose version matches this package
   --status                 Show installed onboarding file versions and suggested action
@@ -17668,15 +18040,15 @@ Exit codes:
 `);
 }
 function resolveTargets(flags) {
-  const claudeRoot = flags.skillDir ?? join6(homedir3(), ".claude");
-  const claudeSkillDir = join6(claudeRoot, "skills", SKILL_DIR_NAME);
-  const claudeCommandsDir = join6(claudeRoot, "commands");
-  const codexRoot = process.env["CODEX_HOME"] ?? join6(homedir3(), ".codex");
-  const codexSkillsDir = flags.codexSkillDir ?? join6(codexRoot, "skills");
+  const claudeRoot = flags.skillDir ?? join7(homedir3(), ".claude");
+  const claudeSkillDir = join7(claudeRoot, "skills", SKILL_DIR_NAME);
+  const claudeCommandsDir = join7(claudeRoot, "commands");
+  const codexRoot = process.env["CODEX_HOME"] ?? join7(homedir3(), ".codex");
+  const codexSkillsDir = flags.codexSkillDir ?? join7(codexRoot, "skills");
   return {
-    claudeSkillFile: join6(claudeSkillDir, SKILL_FILE_NAME),
-    claudeCommandFile: join6(claudeCommandsDir, COMMAND_FILE_NAME),
-    codexSkillFile: join6(codexSkillsDir, SKILL_DIR_NAME, SKILL_FILE_NAME)
+    claudeSkillFile: join7(claudeSkillDir, SKILL_FILE_NAME),
+    claudeCommandFile: join7(claudeCommandsDir, COMMAND_FILE_NAME),
+    codexSkillFile: join7(codexSkillsDir, SKILL_DIR_NAME, SKILL_FILE_NAME)
   };
 }
 function isObject2(value) {
@@ -17695,32 +18067,32 @@ function resolveOpenCodeConfigPath(flags) {
   if (flags.opencodeConfig !== null) {
     return flags.opencodeConfig;
   }
-  const configDir = join6(homedir3(), ".config", "opencode");
-  const jsoncPath = join6(configDir, "opencode.jsonc");
+  const configDir = join7(homedir3(), ".config", "opencode");
+  const jsoncPath = join7(configDir, "opencode.jsonc");
   if (existsSync5(jsoncPath)) {
     return jsoncPath;
   }
-  return join6(configDir, "opencode.json");
+  return join7(configDir, "opencode.json");
 }
 function resolveMiMoConfigPath(flags) {
   if (flags.mimoConfig !== null) {
     return flags.mimoConfig;
   }
-  const configDir = join6(homedir3(), ".config", "mimocode");
-  const jsoncPath = join6(configDir, "mimocode.jsonc");
+  const configDir = join7(homedir3(), ".config", "mimocode");
+  const jsoncPath = join7(configDir, "mimocode.jsonc");
   if (existsSync5(jsoncPath)) {
     return jsoncPath;
   }
-  const jsonPath = join6(configDir, "mimocode.json");
+  const jsonPath = join7(configDir, "mimocode.json");
   if (existsSync5(jsonPath)) {
     return jsonPath;
   }
-  const legacyDir = join6(homedir3(), ".mimocode");
-  const legacyJsoncPath = join6(legacyDir, "config.jsonc");
+  const legacyDir = join7(homedir3(), ".mimocode");
+  const legacyJsoncPath = join7(legacyDir, "config.jsonc");
   if (existsSync5(legacyJsoncPath)) {
     return legacyJsoncPath;
   }
-  const legacyJsonPath = join6(legacyDir, "config.json");
+  const legacyJsonPath = join7(legacyDir, "config.json");
   if (existsSync5(legacyJsonPath)) {
     return legacyJsonPath;
   }
@@ -17731,7 +18103,18 @@ function onboardSelectionArguments(flags, target) {
   if (target.kind === "instance" && target.instanceName !== null) {
     args.push("--instance", target.instanceName);
   } else if (target.kind === "base-url") {
-    args.push("--base-url", target.baseUrl);
+    const usedSharedBaseUrl = flags.baseUrl !== null && flags.controlBaseUrl === null && flags.agentBaseUrl === null && flags.uiUrl === void 0;
+    if (usedSharedBaseUrl) {
+      args.push("--base-url", target.baseUrl);
+    } else {
+      args.push("--control-base-url", target.controlBaseUrl);
+      args.push("--agent-base-url", target.agentBaseUrl);
+      if (target.uiUrl === null) {
+        args.push("--no-ui");
+      } else {
+        args.push("--ui-url", target.uiUrl);
+      }
+    }
   }
   if (flags.mcpName !== null) args.push("--mcp-name", target.mcpName);
   return args.length === 0 ? "" : ` ${args.join(" ")}`;
@@ -18114,8 +18497,8 @@ function buildDetectedSummary() {
 }
 function readPackageVersion() {
   const packageJsonPaths = [
-    join6(__dirname, "..", "package.json"),
-    join6(__dirname, "..", "..", "package.json")
+    join7(__dirname, "..", "package.json"),
+    join7(__dirname, "..", "..", "package.json")
   ];
   try {
     for (const packageJsonPath of packageJsonPaths) {
@@ -18289,6 +18672,9 @@ function buildPlannedFiles(flags, targets, version2, onboardTarget) {
     version: version2,
     port: onboardTarget.port,
     baseUrl: onboardTarget.baseUrl,
+    controlBaseUrl: onboardTarget.controlBaseUrl,
+    agentBaseUrl: onboardTarget.agentBaseUrl,
+    uiUrl: onboardTarget.uiUrl,
     mcpName: onboardTarget.mcpName,
     targetKind: onboardTarget.kind,
     instanceName: onboardTarget.instanceName,
@@ -18300,6 +18686,9 @@ function buildPlannedFiles(flags, targets, version2, onboardTarget) {
     version: version2,
     port: onboardTarget.port,
     baseUrl: onboardTarget.baseUrl,
+    controlBaseUrl: onboardTarget.controlBaseUrl,
+    agentBaseUrl: onboardTarget.agentBaseUrl,
+    uiUrl: onboardTarget.uiUrl,
     mcpName: onboardTarget.mcpName,
     targetKind: onboardTarget.kind,
     instanceName: onboardTarget.instanceName,
@@ -18345,7 +18734,7 @@ function shouldUninstall(file2, currentVersion) {
 }
 function removeEmptyDirectory(path2) {
   try {
-    if (readdirSync3(path2).length === 0) {
+    if (readdirSync4(path2).length === 0) {
       rmdirSync(path2);
     }
   } catch {
@@ -18393,13 +18782,13 @@ No files were removed.
   try {
     for (const file2 of filesToRemove) {
       unlinkSync(file2.path);
-      removeEmptyDirectory(dirname2(file2.path));
+      removeEmptyDirectory(dirname(file2.path));
       process.stdout.write(`Removed ${file2.label}: ${file2.path}
 `);
     }
     for (const plan of agentPlans) {
       if (plan.shouldRemove && plan.body !== null) {
-        mkdirSync3(dirname2(plan.status.path), { recursive: true });
+        mkdirSync3(dirname(plan.status.path), { recursive: true });
         writeFileSync2(plan.status.path, plan.body, "utf8");
         process.stdout.write(`Removed ${plan.status.label} entry from: ${plan.status.path}
 `);
@@ -18516,6 +18905,9 @@ function runOnboardSync(argv) {
   const resolvedTarget = resolveOnboardTarget({
     instanceName: flags.instanceName,
     baseUrl: flags.baseUrl,
+    controlBaseUrl: flags.controlBaseUrl,
+    agentBaseUrl: flags.agentBaseUrl,
+    uiUrl: flags.uiUrl,
     mcpName: flags.mcpName
   });
   if (!resolvedTarget.ok) {
@@ -18636,12 +19028,12 @@ No files were written.
   }
   try {
     for (const file2 of filesToWrite) {
-      mkdirSync3(dirname2(file2.path), { recursive: true });
+      mkdirSync3(dirname(file2.path), { recursive: true });
       writeFileSync2(file2.path, file2.body, "utf8");
     }
     for (const plan of agentPlansToWrite) {
       if (plan.body !== null) {
-        mkdirSync3(dirname2(plan.status.path), { recursive: true });
+        mkdirSync3(dirname(plan.status.path), { recursive: true });
         writeFileSync2(plan.status.path, plan.body, "utf8");
       }
     }
@@ -18701,7 +19093,7 @@ var init_onboard = __esm({
     init_codex_skill_onboard();
     init_skill_onboard();
     __filename = fileURLToPath(import.meta.url);
-    __dirname = dirname2(__filename);
+    __dirname = dirname(__filename);
     DEFAULT_PORT2 = 9527;
     DEFAULT_ORIGIN2 = `http://localhost:${DEFAULT_PORT2}`;
     DEFAULT_MCP_URL = appendBasePathToOrigin(
@@ -18730,8 +19122,8 @@ __export(doctor_exports, {
   parseDoctorArgs: () => parseDoctorArgs,
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync6, readFileSync as readFileSync3, readdirSync as readdirSync4, statSync as statSync4 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join7, resolve } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync3, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
+import { isAbsolute as isAbsolute4, join as join8, resolve as resolve4 } from "node:path";
 import { createConnection } from "node:net";
 function check2(name, severity, message, hint = "") {
   return {
@@ -18834,7 +19226,7 @@ function providerCountFromJson(raw) {
   }
 }
 function resolveMaybeRelative(base, value) {
-  return isAbsolute4(value) ? value : resolve(base, value);
+  return isAbsolute4(value) ? value : resolve4(base, value);
 }
 function resolveDefaultDataDir(env, platform, exists) {
   return resolveDataDir(exists, env, platform);
@@ -18846,10 +19238,10 @@ function providerConfigCandidates(options, deps) {
   }
   if (options.configDir !== null) {
     const dir = resolveMaybeRelative(deps.cwd, options.configDir);
-    return [join7(dir, "providers.json"), join7(dir, "config.json")];
+    return [join8(dir, "providers.json"), join8(dir, "config.json")];
   }
   const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
-  return [join7(dataDir, "providers.json"), join7(dataDir, "config.json")];
+  return [join8(dataDir, "providers.json"), join8(dataDir, "config.json")];
 }
 function checkProviderConfig(options, deps) {
   const providersJson = options.providersJson ?? deps.env["AGENT_INSPECTOR_PROVIDERS_JSON"] ?? null;
@@ -18895,58 +19287,71 @@ function checkProviderConfig(options, deps) {
       "Provider config",
       "warn",
       `Provider config exists but no providers were found: ${candidate}`,
-      "Add a provider in Settings or import provider settings."
+      "Add a provider through the control API/MCP, or use Settings when a UI is available."
     );
   }
   return check2(
     "Provider config",
     "warn",
     "No provider config was found.",
-    "Add a provider in the web UI, import providers, or pass --providers for this check."
+    "Add a provider through the control API/MCP, use Settings when a UI is available, or pass --providers for this check."
   );
 }
+function publicOriginForDoctor(port, env) {
+  const configured = env["AGENT_INSPECTOR_PUBLIC_ORIGIN"];
+  if (configured !== void 0 && configured.trim() === configured) {
+    try {
+      const parsed = new URL(configured);
+      if ((parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username.length === 0 && parsed.password.length === 0 && parsed.pathname === "/" && parsed.search.length === 0 && parsed.hash.length === 0) {
+        return parsed.origin;
+      }
+    } catch {
+    }
+  }
+  return `http://localhost:${String(port)}`;
+}
 async function checkProxyHealth(port, deps) {
   const basePath = getConfiguredBasePath(deps.env);
   const health = await deps.fetchHealth(port, basePath);
-  const url2 = `http://localhost:${port}`;
+  const url2 = publicOriginForDoctor(port, deps.env);
   const proxyUrl = appendBasePathToOrigin(url2, "/proxy", basePath);
   const healthPath = appendBasePathToOrigin("", "/api/health", basePath);
   if (health.ok) {
     return check2(
-      "Proxy health",
+      "Backend health",
       "pass",
-      `agent-inspector is healthy at ${appendBasePathToOrigin(url2, "/", basePath)}.`,
-      `Proxy URL: ${proxyUrl}`
+      `Agent Inspector backend is healthy at ${appendBasePathToOrigin(url2, "/", basePath)}.`,
+      `Agent proxy URL: ${proxyUrl}. UI availability is not part of this backend check.`
     );
   }
   if (await deps.isPortOpen(port)) {
     const suffix = health.status === null ? "" : ` (HTTP ${health.status})`;
     return check2(
-      "Proxy health",
+      "Backend health",
       "fail",
       `Port ${port} is accepting connections, but ${healthPath} is not healthy${suffix}.`,
       "Stop that process, choose --port <n>, or start agent-inspector with --force-restart."
     );
   }
   return check2(
-    "Proxy health",
+    "Backend health",
     "warn",
     `No process is listening on port ${port}.`,
     "Start with `agent-inspector`, `agent-inspector --background`, or `bun run dev`."
   );
 }
 function findProjectRoot(startDir, deps) {
-  let current = resolve(startDir);
+  let current = resolve4(startDir);
   for (let i = 0; i < 6; i++) {
-    if (deps.exists(join7(current, "package.json"))) return current;
-    const next = resolve(current, "..");
+    if (deps.exists(join8(current, "package.json"))) return current;
+    const next = resolve4(current, "..");
     if (next === current) return startDir;
     current = next;
   }
   return startDir;
 }
 function checkPackage(rootDir, deps) {
-  const packagePath = join7(rootDir, "package.json");
+  const packagePath = join8(rootDir, "package.json");
   const text = deps.readText(packagePath);
   if (text === null) {
     return check2("Package metadata", "warn", "package.json was not found near the CLI bundle.");
@@ -18971,7 +19376,7 @@ function countFilesInDir(dir, deps) {
   if (files === null) return null;
   let count = 0;
   for (const file2 of files) {
-    const fileStat = deps.stat(join7(dir, file2));
+    const fileStat = deps.stat(join8(dir, file2));
     if (fileStat !== null && !fileStat.isDirectory) count += 1;
   }
   return count;
@@ -18991,24 +19396,24 @@ function dirSize(dir, deps, depth = 0) {
   if (files === null) return null;
   let total = 0;
   for (const file2 of files) {
-    const childSize = dirSize(join7(dir, file2), deps, depth + 1);
+    const childSize = dirSize(join8(dir, file2), deps, depth + 1);
     if (childSize !== null) total += childSize;
   }
   return total;
 }
 function verboseChecks(options, deps) {
   const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
-  const logsDir = join7(dataDir, "logs");
-  const chunksDir = join7(dataDir, "chunks");
+  const logsDir = join8(dataDir, "logs");
+  const chunksDir = join8(dataDir, "chunks");
   const providerCandidates = providerConfigCandidates(options, deps);
   const captureMode = deps.env["AGENT_INSPECTOR_MODE"] ?? deps.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? "simple";
   const logCount = countFilesInDir(logsDir, deps);
   const logSize = dirSize(logsDir, deps);
   const chunkSize = dirSize(chunksDir, deps);
   const homeDir = deps.platform === "win32" ? deps.env["USERPROFILE"] ?? deps.env["APPDATA"] ?? null : deps.env["HOME"] ?? null;
-  const claudeSkill = homeDir === null ? null : join7(homeDir, ".claude", "skills", "agent-inspector-onboard", "SKILL.md");
-  const claudeCommand = homeDir === null ? null : join7(homeDir, ".claude", "commands", "agent-inspector-onboard.md");
-  const codexSkill = homeDir === null ? null : join7(homeDir, ".codex", "skills", "agent-inspector-onboard", "SKILL.md");
+  const claudeSkill = homeDir === null ? null : join8(homeDir, ".claude", "skills", "agent-inspector-onboard", "SKILL.md");
+  const claudeCommand = homeDir === null ? null : join8(homeDir, ".claude", "commands", "agent-inspector-onboard.md");
+  const codexSkill = homeDir === null ? null : join8(homeDir, ".codex", "skills", "agent-inspector-onboard", "SKILL.md");
   const hasClaudeOnboarding = claudeSkill !== null && claudeCommand !== null && deps.exists(claudeSkill) && deps.exists(claudeCommand);
   const hasCodexOnboarding = codexSkill !== null && deps.exists(codexSkill);
   return [
@@ -19040,8 +19445,8 @@ function verboseChecks(options, deps) {
   ];
 }
 function checkExtensionSource(rootDir, deps) {
-  const extensionDir = join7(rootDir, "extensions", "chrome");
-  const missing = EXTENSION_REQUIRED_FILES.filter((file2) => !deps.exists(join7(extensionDir, file2)));
+  const extensionDir = join8(rootDir, "extensions", "chrome");
+  const missing = EXTENSION_REQUIRED_FILES.filter((file2) => !deps.exists(join8(extensionDir, file2)));
   if (missing.length === 0) {
     return check2(
       "Chrome extension source",
@@ -19057,7 +19462,7 @@ function checkExtensionSource(rootDir, deps) {
   );
 }
 function extensionManifestVersion(rootDir, deps) {
-  const manifestText = deps.readText(join7(rootDir, "extensions", "chrome", "manifest.json"));
+  const manifestText = deps.readText(join8(rootDir, "extensions", "chrome", "manifest.json"));
   if (manifestText === null) return null;
   try {
     const manifest = JSON.parse(manifestText);
@@ -19069,7 +19474,7 @@ function extensionManifestVersion(rootDir, deps) {
   }
 }
 function checkExtensionPackage(rootDir, deps) {
-  const distDir = join7(rootDir, "dist", "chrome-extension");
+  const distDir = join8(rootDir, "dist", "chrome-extension");
   const files = deps.listDir(distDir);
   if (files === null) {
     return check2(
@@ -19169,7 +19574,8 @@ function doctorHelp() {
     "Usage:",
     "  agent-inspector doctor [--port <port>] [--config-dir <dir>] [--providers <json>] [--fix] [--json] [--verbose] [--chrome-extension]",
     "",
-    "Checks local proxy health, provider config presence, and package metadata.",
+    "Checks local backend health, provider config presence, and package metadata.",
+    "The backend check probes the local health endpoint and does not require a composed Web UI.",
     "Pass --fix to run safe local repairs before checks, including legacy data-dir migration.",
     "Pass --json to emit a machine-readable report for CI, scripts, and Jenkins.",
     "Pass --verbose to include local paths, capture mode, and log storage checks.",
@@ -19218,14 +19624,14 @@ function readText(path2) {
 }
 function listDir(path2) {
   try {
-    return readdirSync4(path2);
+    return readdirSync5(path2);
   } catch {
     return null;
   }
 }
-function stat2(path2) {
+function stat3(path2) {
   try {
-    const fileStat = statSync4(path2);
+    const fileStat = statSync3(path2);
     return { isDirectory: fileStat.isDirectory(), size: fileStat.size };
   } catch {
     return null;
@@ -19239,7 +19645,7 @@ function createDoctorDeps() {
     exists: existsSync6,
     readText,
     listDir,
-    stat: stat2,
+    stat: stat3,
     fetchHealth,
     isPortOpen
   };
@@ -19298,11 +19704,7 @@ function parsePort2(raw) {
   return port;
 }
 function normalizeAliasPath(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed.startsWith("/") || trimmed.includes("?") || trimmed.includes("#") || trimmed.includes("\\")) {
-    return null;
-  }
-  return normalizeBasePath(trimmed);
+  return normalizePublicBasePath(raw);
 }
 function isValidHost(host) {
   const trimmed = host.trim();
@@ -19627,6 +20029,10 @@ var init_alias = __esm({
 });
 
 // src/lib/instanceContract.ts
+function isCanonicalPublicBasePath(value) {
+  const normalized = normalizePublicBasePath(value);
+  return normalized !== null && (normalized.length === 0 ? "/" : normalized) === value;
+}
 function isRetryableInstanceError(code) {
   switch (code) {
     case "launch_failed":
@@ -19653,11 +20059,12 @@ function isRetryableInstanceError(code) {
       return false;
   }
 }
-var INSTANCE_API_SCHEMA_VERSION, InstanceStateSchema, InstanceStateReasonSchema, InstanceUrlsSchema, InstanceStatusOutputSchema, InstanceConnectionOutputSchema, InstanceStartRequestSchema, InstanceEmptyRequestSchema, InstanceOperationSchema, InstanceOperationOutcomeSchema, InstanceOperationOutputSchema, InstanceListOutputSchema, InstancePublicErrorCodeSchema, InstancePublicErrorSchema, InstanceErrorOutputSchema;
+var INSTANCE_API_SCHEMA_VERSION, InstanceStateSchema, InstanceStateReasonSchema, InstanceUrlsSchema, InstanceStatusOutputSchema, InstanceConnectionSurfacesSchema, InstanceConnectionOutputSchema, InstanceStartRequestSchema, InstanceEmptyRequestSchema, InstanceOperationSchema, InstanceOperationOutcomeSchema, InstanceOperationOutputSchema, InstanceListOutputSchema, InstancePublicErrorCodeSchema, InstancePublicErrorSchema, InstanceErrorOutputSchema;
 var init_instanceContract = __esm({
   "src/lib/instanceContract.ts"() {
     "use strict";
     init_zod();
+    init_basePath();
     INSTANCE_API_SCHEMA_VERSION = 1;
     InstanceStateSchema = external_exports.enum(["running", "stopped", "conflict"]);
     InstanceStateReasonSchema = external_exports.enum(["identity_mismatch", "port_conflict"]);
@@ -19685,15 +20092,27 @@ var init_instanceContract = __esm({
       host: external_exports.string().min(1),
       publicPort: external_exports.number().int().min(1).max(65535),
       upstreamPort: external_exports.number().int().min(1).max(65535),
-      basePath: external_exports.string().startsWith("/"),
+      basePath: external_exports.string().refine(isCanonicalPublicBasePath, "Invalid public Base Path"),
       captureMode: external_exports.enum(["simple", "full"]),
+      uiEnabled: external_exports.boolean(),
       dataDir: external_exports.string().min(1),
       supervisorPid: external_exports.number().int().positive().nullable(),
       urls: InstanceUrlsSchema
     }).strict();
+    InstanceConnectionSurfacesSchema = external_exports.object({
+      ui: external_exports.object({
+        enabled: external_exports.boolean(),
+        baseUrl: external_exports.url().nullable()
+      }).strict(),
+      control: external_exports.object({ baseUrl: external_exports.url() }).strict(),
+      agent: external_exports.object({ baseUrl: external_exports.url() }).strict()
+    }).strict();
     InstanceConnectionOutputSchema = external_exports.object({
       schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      uiEnabled: external_exports.boolean(),
       instance: InstanceStatusOutputSchema,
+      surfaces: InstanceConnectionSurfacesSchema,
+      /** @deprecated Use surfaces.control.baseUrl or surfaces.agent.baseUrl. */
       baseUrl: external_exports.url(),
       endpoints: InstanceUrlsSchema,
       environment: external_exports.object({
@@ -19716,14 +20135,15 @@ var init_instanceContract = __esm({
     InstanceStartRequestSchema = external_exports.object({
       port: external_exports.number().int().min(1).max(65535).optional(),
       basePath: external_exports.string().min(1).max(2048).refine(
-        (value) => value.startsWith("/") && !value.includes("?") && !value.includes("#") && !value.includes("\\"),
-        "Base Path must be an absolute URL path without query, hash, or backslash"
+        (value) => normalizePublicBasePath(value) !== null,
+        "Base Path must use URL-safe path segments without traversal, encoded separators, or markup characters"
       ).optional(),
       host: external_exports.string().min(1).max(253).refine(
         (value) => value.trim() === value && !value.includes("://") && !value.includes("/") && !value.includes("\\") && !/\s/u.test(value),
         "Host must be a hostname or IP address without protocol, path, or whitespace"
       ).optional(),
       captureMode: external_exports.enum(["simple", "full"]).optional(),
+      uiEnabled: external_exports.boolean().optional(),
       dataDir: external_exports.string().trim().min(1).max(32767).optional()
     }).strict();
     InstanceEmptyRequestSchema = external_exports.object({}).strict();
@@ -19790,10 +20210,8 @@ function parseMode(value) {
   return value === "simple" || value === "full" ? value : null;
 }
 function parseBasePath(value) {
-  if (value === void 0 || !value.startsWith("/") || value.includes("?") || value.includes("#") || value.includes("\\")) {
-    return null;
-  }
-  return normalizeBasePath(value);
+  if (value === void 0) return null;
+  return normalizePublicBasePath(value);
 }
 function optionWithEquals(arg) {
   if (!arg.startsWith("--") || !arg.includes("=")) return null;
@@ -19807,6 +20225,7 @@ function emptyOverrides() {
     host: null,
     captureMode: null,
     dataDir: null,
+    uiEnabled: null,
     open: false
   };
 }
@@ -19880,6 +20299,24 @@ function parseInstanceArgs(argv) {
       case "--open":
         options.overrides.open = true;
         break;
+      case "--backend-only":
+        if (options.overrides.uiEnabled === true) {
+          return {
+            kind: "error",
+            message: "instance: --backend-only and --with-ui are mutually exclusive"
+          };
+        }
+        options.overrides.uiEnabled = false;
+        break;
+      case "--with-ui":
+        if (options.overrides.uiEnabled === false) {
+          return {
+            kind: "error",
+            message: "instance: --backend-only and --with-ui are mutually exclusive"
+          };
+        }
+        options.overrides.uiEnabled = true;
+        break;
       case "--port":
       case "-p":
       case "--base-path":
@@ -19906,7 +20343,7 @@ function parseInstanceArgs(argv) {
     if (options.positional.length !== 1) {
       return { kind: "error", message: "instance: list does not accept an instance name" };
     }
-    if (options.overrides.port !== null || options.overrides.basePath !== null || options.overrides.host !== null || options.overrides.captureMode !== null || options.overrides.dataDir !== null || options.overrides.open) {
+    if (options.overrides.port !== null || options.overrides.basePath !== null || options.overrides.host !== null || options.overrides.captureMode !== null || options.overrides.dataDir !== null || options.overrides.uiEnabled !== null || options.overrides.open) {
       return { kind: "error", message: "instance: list accepts only --json" };
     }
     return { kind: "ok", action: { kind: "list", json: options.json } };
@@ -19916,7 +20353,7 @@ function parseInstanceArgs(argv) {
     if (name === void 0 || options.positional.length !== 2) {
       return { kind: "error", message: `instance: ${command} requires exactly one instance name` };
     }
-    if (options.overrides.port !== null || options.overrides.basePath !== null || options.overrides.host !== null || options.overrides.captureMode !== null || options.overrides.dataDir !== null || options.overrides.open) {
+    if (options.overrides.port !== null || options.overrides.basePath !== null || options.overrides.host !== null || options.overrides.captureMode !== null || options.overrides.dataDir !== null || options.overrides.uiEnabled !== null || options.overrides.open) {
       return {
         kind: "error",
         message: `instance: ${command} accepts only an instance name and --json`
@@ -19932,6 +20369,9 @@ function parseInstanceArgs(argv) {
     if (name === void 0 || options.positional.length !== 2) {
       return { kind: "error", message: `instance: ${command} requires exactly one instance name` };
     }
+    if (options.overrides.uiEnabled === false && options.overrides.open) {
+      return { kind: "error", message: "instance: --open cannot be used with --backend-only" };
+    }
     return {
       kind: "ok",
       action: { kind: command, name, overrides: options.overrides, json: options.json }
@@ -19962,6 +20402,8 @@ Start/restart options:
   --host, -H <host>       Bind host (default: 127.0.0.1)
   --mode <simple|full>    Capture mode (default: simple)
   --data-dir <path>       Isolated data/config directory
+  --backend-only          Persist a headless backend without serving the UI
+  --with-ui               Persist composed UI serving (the default for new instances)
   --open                  Open the UI after readiness
   --json                  Emit machine-readable output
   --help, -h              Show this help
@@ -20093,9 +20535,9 @@ var init_instanceControl = __esm({
 // src/cli/instance.ts
 var instance_exports = {};
 __export(instance_exports, {
+  buildInstanceLaunchArgs: () => buildInstanceLaunchArgs,
   getNamedInstance: () => getNamedInstance,
   getNamedInstanceConnection: () => getNamedInstanceConnection,
-  instanceLifecycleForTests: () => instanceLifecycleForTests,
   listNamedInstances: () => listNamedInstances,
   restartNamedInstance: () => restartNamedInstance,
   runInstance: () => runInstance,
@@ -20152,6 +20594,7 @@ function statusOutput(record2, live, checkedAt = /* @__PURE__ */ new Date()) {
     upstreamPort: record2.upstreamPort,
     basePath: displayBasePath2(record2.basePath),
     captureMode: record2.captureMode,
+    uiEnabled: record2.uiEnabled,
     dataDir: record2.dataDir,
     supervisorPid: live.supervisorPid,
     urls: recordUrls(record2)
@@ -20169,7 +20612,16 @@ function connectionOutput(instance) {
   const serverName = `agent-inspector-${instance.name}`;
   return {
     schemaVersion: INSTANCE_API_SCHEMA_VERSION,
+    uiEnabled: instance.uiEnabled,
     instance,
+    surfaces: {
+      ui: {
+        enabled: instance.uiEnabled,
+        baseUrl: instance.uiEnabled ? instance.urls.ui : null
+      },
+      control: { baseUrl: instance.urls.ui },
+      agent: { baseUrl: instance.urls.ui }
+    },
     baseUrl: instance.urls.ui,
     endpoints: instance.urls,
     environment: {
@@ -20235,7 +20687,7 @@ function defaultOpenUrl(targetUrl) {
   child.once("error", () => void 0);
   child.unref();
 }
-function launchArgs(record2, open) {
+function buildInstanceLaunchArgs(record2, open2) {
   const args = [
     "--background",
     "--no-open",
@@ -20246,11 +20698,12 @@ function launchArgs(record2, open) {
     "--mode",
     record2.captureMode
   ];
-  if (open) args.push("--open");
+  if (!record2.uiEnabled) args.push("--backend-only");
+  if (open2 && record2.uiEnabled) args.push("--open");
   return args;
 }
-async function defaultLaunch(record2, open, cliEntry) {
-  const child = spawn(process.execPath, [cliEntry, ...launchArgs(record2, open)], {
+async function defaultLaunch(record2, open2, cliEntry) {
+  const child = spawn(process.execPath, [cliEntry, ...buildInstanceLaunchArgs(record2, open2)], {
     stdio: "ignore",
     windowsHide: true,
     env: {
@@ -20268,12 +20721,12 @@ async function defaultLaunch(record2, open, cliEntry) {
   });
   return await waitForProcess(child) === 0;
 }
-async function launchRecord(record2, open, deps) {
+async function launchRecord(record2, open2, deps) {
   const cliEntry = deps.cliEntry ?? process.env[AGENT_INSPECTOR_CLI_ENTRY_ENV] ?? process.argv[1];
   if (deps.launch === void 0 && (cliEntry === void 0 || cliEntry.length === 0)) {
     return failure("launch_unavailable", "Cannot resolve the packaged Agent Inspector CLI entry.");
   }
-  const launched = deps.launch === void 0 ? await defaultLaunch(record2, open, cliEntry ?? "") : await deps.launch(record2, open);
+  const launched = deps.launch === void 0 ? await defaultLaunch(record2, open2, cliEntry ?? "") : await deps.launch(record2, open2);
   if (!launched) {
     return failure(
       "launch_failed",
@@ -20379,6 +20832,7 @@ function overridesDiffer(record2, action) {
   if (overrides.basePath !== null && overrides.basePath !== record2.basePath) return true;
   if (overrides.host !== null && overrides.host !== record2.host) return true;
   if (overrides.captureMode !== null && overrides.captureMode !== record2.captureMode) return true;
+  if (overrides.uiEnabled !== null && overrides.uiEnabled !== record2.uiEnabled) return true;
   if (overrides.dataDir !== null) {
     const requested = canonicalizeDataDirectory(overrides.dataDir);
     const saved = canonicalizeDataDirectory(record2.dataDir);
@@ -20396,6 +20850,7 @@ function updatedRecord(record2, action, pair, dataDir) {
     upstreamPort: pair.upstreamPort,
     basePath: action.overrides.basePath ?? record2.basePath,
     captureMode: action.overrides.captureMode ?? record2.captureMode,
+    uiEnabled: action.overrides.uiEnabled ?? record2.uiEnabled,
     dataDir
   };
   const parsed = InstanceRecordSchema.safeParse(candidate);
@@ -20446,6 +20901,7 @@ async function createNewRecord(root, action, deps) {
     upstreamPort: pairResult.value.upstreamPort,
     basePath: action.overrides.basePath ?? getConfiguredBasePath(process.env),
     captureMode: action.overrides.captureMode ?? DEFAULT_INSTANCE_CAPTURE_MODE,
+    uiEnabled: action.overrides.uiEnabled ?? true,
     dataDir: dataDirResult.value
   });
   return created.kind === "error" ? fromRegistry(created) : saveRecord(root, created.value);
@@ -20486,7 +20942,9 @@ async function startAction(root, action, deps) {
     }
     const live = await classifyRecord(record2, deps);
     if (live.state === "running") {
-      if (action.overrides.open) (deps.openUrl ?? defaultOpenUrl)(recordUrls(record2).ui);
+      if (action.overrides.open && record2.uiEnabled) {
+        (deps.openUrl ?? defaultOpenUrl)(recordUrls(record2).ui);
+      }
       return success2(operationOutput("start", "already_running", statusOutput(record2, live)));
     }
     if (live.state === "conflict") {
@@ -20616,9 +21074,10 @@ async function listAction(root, deps) {
 function requestActionOverrides(input) {
   return {
     port: input.port ?? null,
-    basePath: input.basePath === void 0 ? null : normalizeBasePath(input.basePath),
+    basePath: input.basePath === void 0 ? null : normalizePublicBasePath(input.basePath),
     host: input.host ?? null,
     captureMode: input.captureMode ?? null,
+    uiEnabled: input.uiEnabled ?? null,
     dataDir: input.dataDir ?? null,
     open: false
   };
@@ -20668,8 +21127,10 @@ async function listNamedInstances(deps = {}) {
 function formatStatus(output) {
   const pid = output.supervisorPid === null ? "-" : String(output.supervisorPid);
   const reason = output.stateReason === null ? "-" : output.stateReason;
+  const ui = output.uiEnabled ? output.urls.ui : `disabled (configured URL: ${output.urls.ui})`;
   return `Instance ${output.name}: ${output.state}
-  UI:             ${output.urls.ui}
+  UI:             ${ui}
+  UI enabled:     ${output.uiEnabled ? "yes" : "no"}
   Proxy:          ${output.urls.proxy}
   OpenAI /v1:     ${output.urls.openai}
   MCP:            ${output.urls.mcp}
@@ -20810,7 +21271,7 @@ ${instanceHelp()}`);
     }
   }
 }
-var DEFAULT_INSTANCE_HOST, DEFAULT_INSTANCE_CAPTURE_MODE, INSTANCE_READY_TIMEOUT_MS, INSTANCE_STOP_TIMEOUT_MS, INSTANCE_POLL_INTERVAL_MS, processIo2, instanceLifecycleForTests;
+var DEFAULT_INSTANCE_HOST, DEFAULT_INSTANCE_CAPTURE_MODE, INSTANCE_READY_TIMEOUT_MS, INSTANCE_STOP_TIMEOUT_MS, INSTANCE_POLL_INTERVAL_MS, processIo2;
 var init_instance = __esm({
   "src/cli/instance.ts"() {
     "use strict";
@@ -20832,26 +21293,21 @@ var init_instance = __esm({
       stdout: (text) => process.stdout.write(text),
       stderr: (text) => process.stderr.write(text)
     };
-    instanceLifecycleForTests = {
-      classifyRecord,
-      launchArgs,
-      statusOutput
-    };
   }
 });
 
 // src/cli.ts
-import { Buffer as Buffer4 } from "node:buffer";
+import { Buffer as Buffer5 } from "node:buffer";
 import { spawn as spawn2 } from "node:child_process";
 import { createConnection as createConnection2 } from "node:net";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname3, join as join8, resolve as resolvePath2 } from "node:path";
+import { dirname as dirname2, join as join9, resolve as resolvePath2 } from "node:path";
 import { existsSync as existsSync7 } from "node:fs";
 
 // package.json
 var package_default = {
   name: "@tonyclaw/agent-inspector",
-  version: "3.0.45",
+  version: "3.0.46",
   type: "module",
   description: "Agent observability and knowledge capture layer for AI coding tools.",
   license: "MIT",
@@ -20895,7 +21351,8 @@ var package_default = {
     "!src/**/*.test.ts",
     "!src/**/*.stories.tsx",
     "!src/**/__fixtures__",
-    "!src/routeTree.gen.ts",
+    "!src/ui/routeTree.gen.ts",
+    "!src/backend/routeTree.gen.ts",
     "scripts/setup-windows-runtime.mjs",
     "scripts/setup-agent-skills.mjs",
     "scripts/generate-theme-scales.mjs",
@@ -20905,21 +21362,37 @@ var package_default = {
     "!.output/*.exe"
   ],
   scripts: {
-    dev: "vite dev",
+    dev: "node scripts/dev-decoupled.mjs",
+    "dev:ui": "vite dev --config vite.ui.config.ts",
+    "dev:backend": "node scripts/dev-backend.mjs",
     "test:smoke": "bun scripts/run-test-suite.mjs smoke",
     "test:fast": "bun scripts/run-test-suite.mjs smoke",
     "test:unit": "bun scripts/run-test-suite.mjs unit",
     "test:integration": "bun scripts/run-test-suite.mjs integration",
     "test:changed": "bun scripts/run-test-suite.mjs changed",
     "test:all": "bun scripts/run-test-suite.mjs all",
+    "test:compatibility-tooling": "node --test scripts/compatibility/*.test.mjs",
     start: "node .output/cli.js",
-    build: "vite build && bun build:workers && bun build:cli && bun build:mcp && bun check:bundle",
+    "start:backend": "node .output/cli.js --backend-only --no-open",
+    "preview:ui": "vite preview --config vite.ui.config.ts",
+    "clean:output": "node scripts/clean-output.mjs",
+    build: "bun clean:output && bun build:backend && bun build:ui && bun smoke:ui-preview && bun build:workers && bun build:cli && bun build:mcp && bun check:bundle && bun check:boundaries",
+    "build:backend": "vite build --config vite.backend.config.ts",
+    "build:ui": "vite build --config vite.ui.config.ts",
     "build:workers": "npx esbuild src/proxy/logFinalizer.worker.ts src/proxy/sessionWorkerEntry.ts --bundle --platform=node --target=node22 --format=esm --outdir=.output/workers --external:better-sqlite3",
     "smoke:workers": "node scripts/smoke-production-workers.mjs",
     "smoke:packed-workers": "node scripts/smoke-packed-workers.mjs",
     "smoke:instances": "node scripts/smoke-windows-instances.mjs",
     "smoke:coding-agent-instances": "node scripts/smoke-coding-agent-instances.mjs",
+    "smoke:ui-preview": "node scripts/smoke-decoupled-ui-preview.mjs",
     "check:bundle": "node scripts/check-client-bundle.mjs",
+    "check:boundaries": "node scripts/check-runtime-boundaries.mjs",
+    "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",
+    "compatibility:compare": "node scripts/compatibility/cli.mjs compare",
+    "compatibility:drift": "node scripts/check-backend-compatibility.mjs",
+    "compatibility:fixtures": "bun scripts/validate-compatibility-fixtures.ts",
+    "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",
+    "compatibility:run": "node scripts/compatibility/cli.mjs run",
     "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",
     "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
     "themes:generate": "node scripts/generate-theme-scales.mjs",
@@ -20934,7 +21407,7 @@ var package_default = {
     "extension:release": "node scripts/release-chrome-extension.mjs",
     release: "node scripts/release.mjs",
     knip: "knip",
-    check: "bun scripts/run-static-checks.mjs --format",
+    check: "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd",
     prepare: "husky",
     ladle: "ladle serve",
     "ladle:build": "ladle build"
@@ -20973,6 +21446,7 @@ var package_default = {
     "@ladle/react": "^5.1.1",
     "@radix-ui/colors": "^3.0.0",
     "@tailwindcss/vite": "^4.3.2",
+    "@tanstack/router-plugin": "^1.168.20",
     "@types/bun": "^1.3.14",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
@@ -20980,6 +21454,8 @@ var package_default = {
     "@typescript-eslint/eslint-plugin": "^8.64.0",
     "@typescript-eslint/parser": "^8.64.0",
     "@vitejs/plugin-react": "^5.2.0",
+    ajv: "8.20.0",
+    "ajv-formats": "3.0.1",
     "colorjs.io": "^0.7.0",
     esbuild: "^0.28.1",
     eslint: "^9.39.5",
@@ -21023,53 +21499,887 @@ function shouldSuppressServerOutputLine(line, context) {
 }
 
 // src/proxy/identityProxy.ts
+init_browserRuntimeContract();
 init_basePath();
 init_managedInstance();
 import http from "node:http";
-import { Buffer as Buffer3 } from "node:buffer";
-import { createHash, timingSafeEqual } from "node:crypto";
-import { isIP } from "node:net";
+import { Buffer as Buffer4 } from "node:buffer";
+import { createHash as createHash2, timingSafeEqual } from "node:crypto";
+import { isIP as isIP2 } from "node:net";
 
 // src/proxy/socketTracker.ts
 init_zod();
 import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { readFile as readFile2 } from "node:fs/promises";
 import { promisify } from "node:util";
 
 // src/proxy/logger.ts
 init_dataDir();
 init_privateDataPath();
-import { Buffer as Buffer2 } from "node:buffer";
-import { appendFileSync } from "node:fs";
-import { appendFile, readdir, rename, stat, unlink } from "node:fs/promises";
+import { Buffer as Buffer3 } from "node:buffer";
+import { closeSync as closeSync2, constants as constants3, fsyncSync, openSync as openSync2, writeSync } from "node:fs";
+import { appendFile, readdir as readdir2, rename, stat as stat2, unlink as unlink2 } from "node:fs/promises";
 import path from "node:path";
-var DAY_MS = 24 * 60 * 60 * 1e3;
-var DEFAULT_RETENTION_DAYS = 7;
-var DEFAULT_APP_LOG_MAX_BYTES = 10 * 1024 * 1024;
-var DEFAULT_APP_LOG_MAX_FILES = 5;
-function writeStderrFallback(message, error51) {
-  process.stderr.write(`${message} ${String(error51)}
-`);
-}
-function resolveLogDir() {
-  const logDirEnv = process.env["LOG_DIR"];
-  if (logDirEnv !== void 0 && logDirEnv !== "") {
-    return path.isAbsolute(logDirEnv) ? logDirEnv : path.join(getDataDir(), logDirEnv);
-  }
-  return path.join(getDataDir(), "logs");
-}
-function getLogFilePath() {
-  const date5 = /* @__PURE__ */ new Date();
-  const yyyy = date5.getUTCFullYear();
-  const mm = String(date5.getUTCMonth() + 1).padStart(2, "0");
-  const dd = String(date5.getUTCDate()).padStart(2, "0");
-  return path.join(resolveLogDir(), `${yyyy}-${mm}-${dd}.jsonl`);
-}
-function getInspectorLogPath() {
-  const logFileEnv = process.env["AGENT_INSPECTOR_LOG_FILE"];
-  if (logFileEnv !== void 0 && logFileEnv !== "") {
-    return logFileEnv;
-  }
+
+// src/proxy/jsonlRecovery.ts
+import { createHash, randomUUID } from "node:crypto";
+import { Buffer as Buffer2 } from "node:buffer";
+import { constants as constants2, existsSync as existsSync2, lstatSync as lstatSync2 } from "node:fs";
+import { link, lstat, open, readFile, readdir, stat, unlink } from "node:fs/promises";
+import { basename, join as join3, resolve as resolve2 } from "node:path";
+
+// src/proxy/schemas.ts
+init_zod();
+
+// src/contracts/json.ts
+init_zod();
+var JsonValueSchema = external_exports.lazy(
+  () => external_exports.union([
+    external_exports.string(),
+    external_exports.number(),
+    external_exports.boolean(),
+    external_exports.null(),
+    external_exports.array(JsonValueSchema),
+    external_exports.record(external_exports.string(), JsonValueSchema)
+  ])
+);
+
+// src/contracts/log.ts
+init_zod();
+var LogIdSchema = external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var CaptureIncompleteReasonSchema = external_exports.enum([
+  "capacity-exceeded",
+  "pipeline-closed",
+  "write-failed",
+  "finalize-failed",
+  "upstream-stream-error",
+  "shutdown"
+]);
+var StreamingChunkSchema = external_exports.object({
+  index: external_exports.number(),
+  timestamp: external_exports.number(),
+  type: external_exports.string(),
+  data: JsonValueSchema
+});
+var StreamingChunksArraySchema = external_exports.object({
+  chunks: external_exports.array(StreamingChunkSchema),
+  truncated: external_exports.boolean().optional().default(false)
+});
+var LogBodyPartSchema = external_exports.enum(["request", "response"]);
+var LogBodyChunkSchema = external_exports.object({
+  logId: LogIdSchema,
+  part: LogBodyPartSchema,
+  text: external_exports.string(),
+  offset: external_exports.number().int().nonnegative(),
+  limit: external_exports.number().int().positive(),
+  totalBytes: external_exports.number().int().nonnegative(),
+  textBytes: external_exports.number().int().nonnegative(),
+  nextOffset: external_exports.number().int().nonnegative().nullable(),
+  hasMore: external_exports.boolean(),
+  contentMode: external_exports.enum(["empty", "partial", "full"])
+});
+var CapturedLogSchema = external_exports.object({
+  id: LogIdSchema,
+  timestamp: external_exports.string(),
+  method: external_exports.string(),
+  path: external_exports.string(),
+  model: external_exports.string().nullable(),
+  sessionId: external_exports.string().nullable(),
+  rawRequestBody: external_exports.string().nullable(),
+  responseStatus: external_exports.number().nullable(),
+  responseText: external_exports.string().nullable(),
+  inputTokens: external_exports.number().nullable(),
+  outputTokens: external_exports.number().nullable(),
+  cacheCreationInputTokens: external_exports.number().nullable(),
+  cacheReadInputTokens: external_exports.number().nullable(),
+  elapsedMs: external_exports.number().nullable(),
+  firstChunkMs: external_exports.number().nullable().optional(),
+  totalStreamMs: external_exports.number().nullable().optional(),
+  tokensPerSecond: external_exports.number().nullable().optional(),
+  streaming: external_exports.boolean(),
+  userAgent: external_exports.string().nullable(),
+  origin: external_exports.string().nullable(),
+  rawHeaders: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  /** Headers sent to the upstream LLM */
+  headers: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  apiFormat: external_exports.enum(["anthropic", "openai", "unknown"]).default("unknown"),
+  isTest: external_exports.boolean().optional().default(false),
+  replayOfLogId: LogIdSchema.nullable().optional(),
+  providerName: external_exports.string().nullable().optional(),
+  clientPort: external_exports.number().nullable().optional(),
+  clientPid: external_exports.number().nullable().optional(),
+  clientCwd: external_exports.string().nullable().optional(),
+  clientProjectFolder: external_exports.string().nullable().optional(),
+  streamingChunks: StreamingChunksArraySchema.optional(),
+  streamingChunksPath: external_exports.string().nullable().optional(),
+  rawRequestBodyBytes: external_exports.number().int().nonnegative().nullable().optional(),
+  responseTextBytes: external_exports.number().int().nonnegative().nullable().optional(),
+  bodyContentMode: external_exports.enum(["full", "compact", "truncated"]).optional(),
+  captureIncomplete: external_exports.boolean().optional(),
+  droppedChunks: external_exports.number().int().nonnegative().optional(),
+  droppedBytes: external_exports.number().int().nonnegative().optional(),
+  captureIncompleteReason: CaptureIncompleteReasonSchema.nullable().optional(),
+  warnings: external_exports.array(external_exports.string()).optional(),
+  /** Error message from streaming response (e.g., SSE error event) */
+  error: external_exports.string().nullable().optional()
+});
+
+// src/contracts/anthropic.ts
+init_zod();
+var CacheControl = external_exports.object({
+  type: external_exports.string(),
+  ttl: external_exports.string().optional(),
+  scope: external_exports.string().optional()
+});
+var TextContentBlock = external_exports.object({
+  type: external_exports.literal("text"),
+  text: external_exports.string(),
+  cache_control: CacheControl.optional()
+});
+var ThinkingContentBlock = external_exports.object({
+  type: external_exports.literal("thinking"),
+  thinking: external_exports.string(),
+  signature: external_exports.string().optional()
+});
+var ThinkContentBlock = external_exports.object({
+  type: external_exports.literal("think"),
+  thinking: external_exports.string(),
+  signature: external_exports.string().optional()
+});
+var ImageSourceBlock = external_exports.object({
+  type: external_exports.literal("base64"),
+  media_type: external_exports.string(),
+  data: external_exports.string()
+});
+var ImageContentBlock = external_exports.object({
+  type: external_exports.literal("image"),
+  source: ImageSourceBlock
+});
+var ToolUseContentBlock = external_exports.object({
+  type: external_exports.literal("tool_use"),
+  id: external_exports.string(),
+  name: external_exports.string(),
+  input: external_exports.record(external_exports.string(), JsonValueSchema)
+});
+var ToolResultContentItem = external_exports.discriminatedUnion("type", [TextContentBlock, ImageContentBlock]);
+var ToolResultContentBlock = external_exports.object({
+  type: external_exports.literal("tool_result"),
+  tool_use_id: external_exports.string().optional(),
+  content: external_exports.union([external_exports.string(), external_exports.array(ToolResultContentItem)]),
+  is_error: external_exports.boolean().optional()
+});
+var ContentBlock = external_exports.discriminatedUnion("type", [
+  TextContentBlock,
+  ThinkingContentBlock,
+  ImageContentBlock,
+  ToolUseContentBlock,
+  ToolResultContentBlock
+]);
+var MessageContent = external_exports.union([external_exports.string(), external_exports.array(ContentBlock)]);
+var Message = external_exports.object({
+  role: external_exports.enum(["user", "assistant"]),
+  content: MessageContent
+});
+var SystemBlock = external_exports.object({
+  type: external_exports.literal("text"),
+  text: external_exports.string(),
+  cache_control: CacheControl.optional()
+});
+var InputSchema = external_exports.object({
+  type: external_exports.string(),
+  properties: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), JsonValueSchema)).optional(),
+  required: external_exports.array(external_exports.string()).optional(),
+  additionalProperties: external_exports.boolean().optional(),
+  $schema: external_exports.string().optional()
+});
+var ToolDefinition = external_exports.object({
+  name: external_exports.string(),
+  description: external_exports.string().optional(),
+  input_schema: InputSchema.optional(),
+  cache_control: CacheControl.optional()
+});
+var ThinkingConfig = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("enabled"), budget_tokens: external_exports.number() }),
+  external_exports.object({ type: external_exports.literal("disabled") }),
+  external_exports.object({ type: external_exports.literal("adaptive") })
+]);
+var AnthropicRequestSchema = external_exports.object({
+  model: external_exports.string(),
+  messages: external_exports.array(Message),
+  system: external_exports.array(SystemBlock).optional(),
+  tools: external_exports.array(ToolDefinition).optional(),
+  max_tokens: external_exports.number().optional(),
+  temperature: external_exports.number().optional(),
+  stream: external_exports.boolean().optional(),
+  thinking: ThinkingConfig.optional(),
+  metadata: external_exports.object({
+    user_id: external_exports.string().optional()
+  }).optional()
+});
+var ResponseContentBlock = external_exports.discriminatedUnion("type", [
+  TextContentBlock,
+  ThinkingContentBlock,
+  ThinkContentBlock,
+  ToolUseContentBlock
+]);
+var ResponseUsageSchema = external_exports.object({
+  input_tokens: external_exports.number().nullable().optional(),
+  output_tokens: external_exports.number().nullable().optional(),
+  cache_creation_input_tokens: external_exports.number().nullable().optional(),
+  cache_read_input_tokens: external_exports.number().nullable().optional()
+}).passthrough();
+var AnthropicResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  type: external_exports.literal("message"),
+  model: external_exports.string(),
+  role: external_exports.literal("assistant"),
+  content: external_exports.array(ResponseContentBlock),
+  stop_reason: external_exports.string().nullable(),
+  stop_sequence: external_exports.string().nullable().optional(),
+  usage: ResponseUsageSchema
+}).passthrough();
+var SseMessageStartEvent = external_exports.object({
+  type: external_exports.literal("message_start"),
+  message: external_exports.object({
+    id: external_exports.string(),
+    type: external_exports.literal("message"),
+    model: external_exports.string(),
+    role: external_exports.literal("assistant"),
+    content: external_exports.array(ResponseContentBlock),
+    stop_reason: external_exports.null(),
+    stop_sequence: external_exports.null(),
+    usage: external_exports.object({
+      input_tokens: external_exports.number(),
+      cache_creation_input_tokens: external_exports.number().optional(),
+      cache_read_input_tokens: external_exports.number().optional()
+    }).passthrough()
+  })
+});
+var SseContentBlockStartEvent = external_exports.object({
+  type: external_exports.literal("content_block_start"),
+  index: external_exports.number(),
+  content_block: ResponseContentBlock
+});
+var SseDeltaBlock = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("text_delta"), text: external_exports.string() }),
+  external_exports.object({ type: external_exports.literal("input_json_delta"), partial_json: external_exports.string() }),
+  external_exports.object({ type: external_exports.literal("thinking_delta"), thinking: external_exports.string() }),
+  external_exports.object({ type: external_exports.literal("signature_delta"), signature: external_exports.string() })
+]);
+var SseContentBlockDeltaEvent = external_exports.object({
+  type: external_exports.literal("content_block_delta"),
+  index: external_exports.number(),
+  delta: SseDeltaBlock
+});
+var SseContentBlockStopEvent = external_exports.object({
+  type: external_exports.literal("content_block_stop"),
+  index: external_exports.number()
+});
+var SseMessageDeltaEvent = external_exports.object({
+  type: external_exports.literal("message_delta"),
+  delta: external_exports.object({
+    stop_reason: external_exports.string().nullable(),
+    stop_sequence: external_exports.string().nullable().optional()
+  }),
+  usage: external_exports.object({
+    output_tokens: external_exports.number(),
+    input_tokens: external_exports.number().optional(),
+    cache_creation_input_tokens: external_exports.number().optional(),
+    cache_read_input_tokens: external_exports.number().optional()
+  }).passthrough()
+});
+var SseMessageStopEvent = external_exports.object({
+  type: external_exports.literal("message_stop")
+});
+var SsePingEvent = external_exports.object({
+  type: external_exports.literal("ping")
+});
+var SseErrorEvent = external_exports.object({
+  type: external_exports.literal("error"),
+  error: external_exports.object({
+    type: external_exports.string(),
+    message: external_exports.string()
+  })
+});
+var SseEventSchema = external_exports.discriminatedUnion("type", [
+  SseMessageStartEvent,
+  SseContentBlockStartEvent,
+  SseContentBlockDeltaEvent,
+  SseContentBlockStopEvent,
+  SseMessageDeltaEvent,
+  SseMessageStopEvent,
+  SsePingEvent,
+  SseErrorEvent
+]);
+
+// src/contracts/openai.ts
+init_zod();
+var OpenAIMessageContent = external_exports.union([
+  external_exports.string(),
+  external_exports.array(
+    external_exports.discriminatedUnion("type", [
+      external_exports.object({ type: external_exports.literal("text"), text: external_exports.string() }),
+      external_exports.object({
+        type: external_exports.literal("image_url"),
+        image_url: external_exports.object({ url: external_exports.string(), detail: external_exports.string().optional() })
+      })
+    ])
+  )
+]);
+var OpenAIMessage = external_exports.object({
+  role: external_exports.enum(["system", "user", "assistant", "tool"]),
+  content: OpenAIMessageContent,
+  name: external_exports.string().optional(),
+  reasoning_content: external_exports.string().optional(),
+  thinking: external_exports.string().optional(),
+  think: external_exports.string().optional()
+});
+var OpenAIFunctionCall = external_exports.object({
+  name: external_exports.string(),
+  arguments: external_exports.string()
+});
+var OpenAIToolCallSchema = external_exports.object({
+  index: external_exports.number().optional(),
+  id: external_exports.string().optional(),
+  type: external_exports.literal("function").optional(),
+  function: external_exports.object({
+    name: external_exports.string().optional(),
+    arguments: external_exports.string().optional()
+  })
+});
+var OpenAIMessageWithFunctionCall = OpenAIMessage.extend({
+  content: external_exports.union([external_exports.string(), external_exports.array(external_exports.object({ type: external_exports.literal("text"), text: external_exports.string() }))]).optional(),
+  function_call: OpenAIFunctionCall.optional(),
+  tool_calls: external_exports.array(OpenAIToolCallSchema).optional()
+});
+var OpenAIToolDefinition = external_exports.object({
+  type: external_exports.literal("function"),
+  function: external_exports.object({
+    name: external_exports.string(),
+    description: external_exports.string().optional(),
+    parameters: external_exports.record(external_exports.string(), JsonValueSchema)
+  })
+});
+var OpenAIRequestSchema = external_exports.object({
+  model: external_exports.string(),
+  messages: external_exports.array(OpenAIMessage),
+  temperature: external_exports.number().optional(),
+  max_tokens: external_exports.number().optional(),
+  stream: external_exports.boolean().optional(),
+  tools: external_exports.array(OpenAIToolDefinition).optional(),
+  tool_choice: external_exports.union([
+    external_exports.enum(["auto", "none", "required"]),
+    external_exports.object({ type: external_exports.literal("auto") }),
+    external_exports.object({ type: external_exports.literal("none") }),
+    external_exports.object({ type: external_exports.literal("function"), function: external_exports.object({ name: external_exports.string() }) })
+  ]).optional(),
+  user: external_exports.string().optional()
+});
+var OpenAIResponsesToolDefinition = external_exports.object({
+  type: external_exports.string(),
+  name: external_exports.string().optional(),
+  description: external_exports.string().optional(),
+  parameters: JsonValueSchema.optional(),
+  function: external_exports.object({
+    name: external_exports.string().optional(),
+    description: external_exports.string().optional(),
+    parameters: JsonValueSchema.optional()
+  }).optional()
+}).passthrough();
+var OpenAIResponsesRequestSchema = external_exports.object({
+  model: external_exports.string(),
+  input: external_exports.unknown().optional(),
+  instructions: external_exports.union([external_exports.string(), external_exports.null()]).optional(),
+  stream: external_exports.boolean().optional(),
+  tools: external_exports.array(OpenAIResponsesToolDefinition).optional(),
+  tool_choice: external_exports.unknown().optional(),
+  max_output_tokens: external_exports.number().optional(),
+  temperature: external_exports.number().optional(),
+  user: external_exports.string().optional(),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).passthrough();
+var OpenAIChoiceDelta = external_exports.object({
+  role: external_exports.enum(["assistant"]).optional(),
+  content: external_exports.string().nullable().optional(),
+  reasoning_content: external_exports.string().nullable().optional(),
+  thinking: external_exports.string().nullable().optional(),
+  think: external_exports.string().nullable().optional(),
+  function_call: external_exports.object({ name: external_exports.string().optional(), arguments: external_exports.string().optional() }).nullable().optional(),
+  tool_calls: external_exports.array(
+    external_exports.object({
+      index: external_exports.number(),
+      id: external_exports.string().optional(),
+      type: external_exports.literal("function").optional(),
+      function: external_exports.object({
+        name: external_exports.string().optional(),
+        arguments: external_exports.string().optional()
+      })
+    })
+  ).nullable().optional()
+});
+var OpenAIChoice = external_exports.object({
+  index: external_exports.number(),
+  message: external_exports.object({
+    role: external_exports.enum(["assistant"]),
+    content: external_exports.string().nullable(),
+    reasoning_content: external_exports.string().optional(),
+    thinking: external_exports.string().optional(),
+    think: external_exports.string().optional(),
+    function_call: external_exports.object({ name: external_exports.string(), arguments: external_exports.string() }).nullable().optional(),
+    tool_calls: external_exports.array(OpenAIToolCallSchema).optional()
+  }).optional(),
+  delta: OpenAIChoiceDelta.optional(),
+  finish_reason: external_exports.string().nullable()
+});
+var OpenAIResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  object: external_exports.literal("chat.completion"),
+  created: external_exports.number(),
+  model: external_exports.string(),
+  choices: external_exports.array(OpenAIChoice),
+  usage: external_exports.object({
+    prompt_tokens: external_exports.number().nullable().optional(),
+    completion_tokens: external_exports.number().nullable().optional(),
+    total_tokens: external_exports.number().nullable().optional()
+  }).passthrough(),
+  service_tier: external_exports.string().nullable().optional(),
+  system_fingerprint: external_exports.string().nullable().optional()
+}).passthrough();
+var OpenAISSERawChunkSchema = external_exports.object({
+  id: external_exports.string(),
+  object: external_exports.literal("chat.completion.chunk"),
+  created: external_exports.number(),
+  model: external_exports.string(),
+  choices: external_exports.array(
+    external_exports.object({
+      index: external_exports.number(),
+      delta: OpenAIChoiceDelta,
+      finish_reason: external_exports.string().nullable().optional()
+    })
+  ),
+  usage: external_exports.object({
+    prompt_tokens: external_exports.number().nullable().optional(),
+    completion_tokens: external_exports.number().nullable().optional(),
+    total_tokens: external_exports.number().nullable().optional()
+  }).passthrough().nullable().optional()
+}).passthrough();
+var OpenAIResponsesUsageSchema = external_exports.object({
+  input_tokens: external_exports.number().nullable().optional(),
+  output_tokens: external_exports.number().nullable().optional(),
+  total_tokens: external_exports.number().nullable().optional(),
+  input_tokens_details: external_exports.object({
+    cached_tokens: external_exports.number().nullable().optional()
+  }).passthrough().nullable().optional(),
+  output_tokens_details: external_exports.object({
+    reasoning_tokens: external_exports.number().nullable().optional()
+  }).passthrough().nullable().optional()
+}).passthrough();
+var OpenAIResponsesOutputItemSchema = external_exports.object({
+  type: external_exports.string()
+}).passthrough();
+var OpenAIResponsesResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  object: external_exports.literal("response").optional(),
+  created_at: external_exports.number().optional(),
+  status: external_exports.string().nullable().optional(),
+  model: external_exports.string().optional(),
+  output: external_exports.array(OpenAIResponsesOutputItemSchema).optional(),
+  output_text: external_exports.string().optional(),
+  usage: OpenAIResponsesUsageSchema.nullable().optional(),
+  error: external_exports.unknown().optional()
+}).passthrough();
+var OpenAIResponsesSSEventSchema = external_exports.object({
+  type: external_exports.string()
+}).passthrough();
+
+// src/proxy/schemas.ts
+var RequestModelSchema = external_exports.object({
+  model: external_exports.string()
+});
+var LooseRequestSchema = external_exports.object({
+  model: external_exports.string().optional(),
+  metadata: external_exports.object({ user_id: external_exports.string().optional() }).passthrough().optional()
+});
+
+// src/proxy/jsonlRecovery.ts
+init_privateDataPath();
+var READ_CHUNK_BYTES = 64 * 1024;
+var QUARANTINE_DIRECTORY = "quarantine";
+var activeContext = null;
+function emptyHealth() {
+  return {
+    level: "ok",
+    diagnostic: null,
+    repairedFiles: 0,
+    delimiterRepairs: 0,
+    quarantinedTails: 0
+  };
+}
+function contextFor(logDir) {
+  const root = resolve2(logDir);
+  if (activeContext === null || activeContext.root !== root) {
+    activeContext = {
+      root,
+      health: emptyHealth(),
+      startup: null,
+      startupComplete: false,
+      safeFiles: /* @__PURE__ */ new Map()
+    };
+  }
+  return activeContext;
+}
+function copyHealth(health) {
+  return { ...health };
+}
+function hashBytes(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function signatureFromStats(stats) {
+  return {
+    size: stats.size,
+    modifiedAt: stats.mtimeMs,
+    changedAt: stats.ctimeMs,
+    device: stats.dev,
+    inode: stats.ino
+  };
+}
+function signaturesMatch(left, right) {
+  return left.size === right.size && left.modifiedAt === right.modifiedAt && left.changedAt === right.changedAt && left.device === right.device && left.inode === right.inode;
+}
+function validateRecord(bytes) {
+  const withoutCarriageReturn = bytes.length > 0 && bytes[bytes.length - 1] === 13 ? bytes.subarray(0, -1) : bytes;
+  const text = withoutCarriageReturn.toString("utf-8");
+  if (text.trim() === "") return { valid: true };
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return { valid: false, reason: "invalid-json" };
+  }
+  return CapturedLogSchema.safeParse(parsed).success ? { valid: true } : { valid: false, reason: "invalid-log-schema" };
+}
+async function scanFile(handle, size) {
+  const readBuffer = Buffer2.alloc(READ_CHUNK_BYTES);
+  let position = 0;
+  let pending = Buffer2.alloc(0);
+  let pendingOffset = 0;
+  let line = 1;
+  while (position < size) {
+    const length = Math.min(READ_CHUNK_BYTES, size - position);
+    let bytesRead;
+    try {
+      const result = await handle.read(readBuffer, 0, length, position);
+      bytesRead = result.bytesRead;
+    } catch (error51) {
+      return { status: "failed", reason: `read failed: ${String(error51)}` };
+    }
+    if (bytesRead === 0) {
+      return { status: "failed", reason: "captured-log file changed while being scanned" };
+    }
+    const chunk = readBuffer.subarray(0, bytesRead);
+    const combined = pending.length === 0 ? Buffer2.from(chunk) : Buffer2.concat([pending, chunk]);
+    let consumed = 0;
+    let newline = combined.indexOf(10, consumed);
+    while (newline !== -1) {
+      const record2 = combined.subarray(consumed, newline);
+      const validation = validateRecord(record2);
+      if (!validation.valid) {
+        return {
+          status: "interior-corruption",
+          line,
+          byteOffset: pendingOffset + consumed,
+          recordHash: hashBytes(record2),
+          reason: validation.reason
+        };
+      }
+      consumed = newline + 1;
+      line += 1;
+      newline = combined.indexOf(10, consumed);
+    }
+    pending = Buffer2.from(combined.subarray(consumed));
+    pendingOffset += consumed;
+    position += bytesRead;
+  }
+  return { status: "complete", pending, pendingOffset, nextLine: line };
+}
+async function syncDirectory(directory) {
+  let handle = null;
+  try {
+    handle = await open(directory, "r");
+    await handle.sync();
+  } catch {
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function removeTemporaryFile(filePath) {
+  await unlink(filePath).catch(() => void 0);
+}
+function readOwnProperty(value, name) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  return Object.getOwnPropertyDescriptor(value, name)?.value;
+}
+async function inspectExistingQuarantine(filePath, expected) {
+  if (!existsSync2(filePath)) return "missing";
+  try {
+    const parsed = JSON.parse(await readFile(filePath, "utf-8"));
+    return readOwnProperty(parsed, "schemaVersion") === expected.schemaVersion && readOwnProperty(parsed, "reason") === expected.reason && readOwnProperty(parsed, "sourceFile") === expected.sourceFile && readOwnProperty(parsed, "sourcePathHash") === expected.sourcePathHash && readOwnProperty(parsed, "tailOffset") === expected.tailOffset && readOwnProperty(parsed, "tailBytes") === expected.tailBytes && readOwnProperty(parsed, "tailSha256") === expected.tailSha256 && readOwnProperty(parsed, "tailBase64") === expected.tailBase64 ? "matching" : "conflicting";
+  } catch {
+    return "conflicting";
+  }
+}
+async function quarantineTail(context, sourceFile, tail, tailOffset) {
+  const quarantineDirectory = join3(context.root, QUARANTINE_DIRECTORY);
+  if (!ensurePrivateDirectorySync(quarantineDirectory)) return null;
+  const tailSha256 = hashBytes(tail);
+  const sourceFileName = basename(sourceFile);
+  const destination = join3(quarantineDirectory, `${sourceFileName}.tail-${tailSha256}.json`);
+  const temporary = join3(
+    quarantineDirectory,
+    `.${sourceFileName}.${String(process.pid)}.${randomUUID()}.tmp`
+  );
+  const record2 = {
+    schemaVersion: 1,
+    reason: "invalid-final-jsonl-record",
+    sourceFile: sourceFileName,
+    sourcePathHash: hashBytes(Buffer2.from(resolve2(sourceFile), "utf-8")),
+    recoveredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    tailOffset,
+    tailBytes: tail.length,
+    tailSha256,
+    tailBase64: tail.toString("base64")
+  };
+  const existing = await inspectExistingQuarantine(destination, record2);
+  if (existing === "matching") {
+    return securePrivateFileSync(destination) ? destination : null;
+  }
+  if (existing === "conflicting") return null;
+  let handle = null;
+  try {
+    handle = await open(temporary, "wx", PRIVATE_FILE_MODE);
+    await handle.writeFile(`${JSON.stringify(record2)}
+`, "utf-8");
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    if (!securePrivateFileSync(temporary)) {
+      await removeTemporaryFile(temporary);
+      return null;
+    }
+    await link(temporary, destination);
+    await unlink(temporary);
+    if (!securePrivateFileSync(destination)) return null;
+    await syncDirectory(quarantineDirectory);
+    return destination;
+  } catch {
+    await handle?.close().catch(() => void 0);
+    await removeTemporaryFile(temporary);
+    const racedExisting = await inspectExistingQuarantine(destination, record2);
+    return racedExisting === "matching" && securePrivateFileSync(destination) ? destination : null;
+  }
+}
+async function recoverFile(context, filePath) {
+  if (!existsSync2(filePath)) {
+    context.safeFiles.delete(filePath);
+    return {
+      status: "clean",
+      signature: { size: 0, modifiedAt: 0, changedAt: 0, device: 0, inode: 0 }
+    };
+  }
+  let fileStats;
+  try {
+    fileStats = await lstat(filePath);
+  } catch (error51) {
+    return { status: "failed", reason: `stat failed: ${String(error51)}` };
+  }
+  if (fileStats.isSymbolicLink() || !fileStats.isFile()) {
+    return { status: "failed", reason: "captured-log path is not a regular private file" };
+  }
+  const initialSignature = signatureFromStats(fileStats);
+  const safeSignature = context.safeFiles.get(filePath);
+  if (safeSignature !== void 0 && signaturesMatch(safeSignature, initialSignature)) {
+    return { status: "clean", signature: initialSignature };
+  }
+  let handle = null;
+  try {
+    handle = await open(filePath, constants2.O_RDWR | constants2.O_NOFOLLOW);
+    const openedStats = await handle.stat();
+    if (!openedStats.isFile()) {
+      return { status: "failed", reason: "captured-log handle is not a regular file" };
+    }
+    const openedSignature = signatureFromStats(openedStats);
+    if (!signaturesMatch(initialSignature, openedSignature)) {
+      return {
+        status: "failed",
+        reason: "captured-log path changed between metadata validation and open"
+      };
+    }
+    const scan = await scanFile(handle, openedStats.size);
+    const scannedSignature = signatureFromStats(await handle.stat());
+    if (!signaturesMatch(openedSignature, scannedSignature)) {
+      return {
+        status: "failed",
+        reason: "captured-log file changed while recovery was scanning it"
+      };
+    }
+    switch (scan.status) {
+      case "failed":
+        return scan;
+      case "interior-corruption":
+        return scan;
+      case "complete": {
+        if (scan.pending.length === 0) {
+          return { status: "clean", signature: signatureFromStats(await handle.stat()) };
+        }
+        const validation = validateRecord(scan.pending);
+        if (validation.valid) {
+          const write = await handle.write(Buffer2.from("\n", "utf-8"), 0, 1, openedStats.size);
+          if (write.bytesWritten !== 1) {
+            return { status: "failed", reason: "captured-log delimiter append was incomplete" };
+          }
+          await handle.sync();
+          return {
+            status: "delimiter-appended",
+            signature: signatureFromStats(await handle.stat())
+          };
+        }
+        const quarantinePath = await quarantineTail(
+          context,
+          filePath,
+          scan.pending,
+          scan.pendingOffset
+        );
+        if (quarantinePath === null) {
+          return { status: "failed", reason: "invalid tail could not be privately quarantined" };
+        }
+        const beforeTruncate = signatureFromStats(await handle.stat());
+        if (!signaturesMatch(openedSignature, beforeTruncate)) {
+          return {
+            status: "failed",
+            reason: "captured-log file changed before invalid-tail truncation"
+          };
+        }
+        await handle.truncate(scan.pendingOffset);
+        await handle.sync();
+        return {
+          status: "tail-quarantined",
+          signature: signatureFromStats(await handle.stat())
+        };
+      }
+    }
+    return { status: "failed", reason: "unsupported captured-log scan state" };
+  } catch (error51) {
+    return { status: "failed", reason: String(error51) };
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+function applyFileResult(context, filePath, result) {
+  const file2 = basename(filePath);
+  switch (result.status) {
+    case "clean":
+      context.safeFiles.set(filePath, result.signature);
+      return;
+    case "delimiter-appended":
+      context.safeFiles.set(filePath, result.signature);
+      context.health.delimiterRepairs += 1;
+      context.health.repairedFiles += 1;
+      return;
+    case "tail-quarantined":
+      context.safeFiles.set(filePath, result.signature);
+      context.health.quarantinedTails += 1;
+      context.health.repairedFiles += 1;
+      if (context.health.level !== "unavailable") {
+        context.health.level = "degraded";
+        context.health.diagnostic = `Recovered and quarantined an invalid JSONL tail in ${file2}`;
+      }
+      return;
+    case "interior-corruption":
+      context.safeFiles.delete(filePath);
+      context.health.level = "unavailable";
+      context.health.diagnostic = `JSONL corruption in ${file2} at line ${String(result.line)} (offset ${String(result.byteOffset)}, ${result.reason}, sha256 ${result.recordHash})`;
+      return;
+    case "failed":
+      context.safeFiles.delete(filePath);
+      context.health.level = "unavailable";
+      context.health.diagnostic = `JSONL recovery failed for ${file2}: ${result.reason}`;
+  }
+}
+async function runStartupRecovery(context) {
+  if (!ensurePrivateDirectorySync(context.root)) {
+    context.health.level = "unavailable";
+    context.health.diagnostic = "Captured-log directory could not be made private";
+    return copyHealth(context.health);
+  }
+  let entries;
+  try {
+    entries = await readdir(context.root);
+  } catch (error51) {
+    context.health.level = "unavailable";
+    context.health.diagnostic = `Captured-log directory could not be listed: ${String(error51)}`;
+    return copyHealth(context.health);
+  }
+  const files = entries.filter((entry) => entry.endsWith(".jsonl")).sort();
+  for (const file2 of files) {
+    const filePath = join3(context.root, file2);
+    const result = await recoverFile(context, filePath);
+    applyFileResult(context, filePath, result);
+    if (context.health.level === "unavailable") break;
+  }
+  return copyHealth(context.health);
+}
+async function recoverCapturedLogStorage(logDir) {
+  const context = contextFor(logDir);
+  if (context.startup === null) {
+    context.startup = runStartupRecovery(context).then((health) => {
+      context.startupComplete = true;
+      return health;
+    });
+  }
+  return await context.startup;
+}
+function canAppendCapturedLogFileOnExit(logDir, filePath) {
+  const context = contextFor(logDir);
+  if (!context.startupComplete || context.health.level === "unavailable") return false;
+  const trusted = context.safeFiles.get(filePath);
+  if (trusted === void 0) return false;
+  try {
+    const observed = lstatSync2(filePath);
+    if (observed === void 0 || observed.isSymbolicLink() || !observed.isFile()) return false;
+    return signaturesMatch(trusted, signatureFromStats(observed));
+  } catch {
+    return false;
+  }
+}
+
+// src/proxy/logger.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_RETENTION_DAYS = 7;
+var DEFAULT_APP_LOG_MAX_BYTES = 10 * 1024 * 1024;
+var DEFAULT_APP_LOG_MAX_FILES = 5;
+function writeStderrFallback(message, error51) {
+  process.stderr.write(`${message} ${String(error51)}
+`);
+}
+function resolveLogDir() {
+  const logDirEnv = process.env["LOG_DIR"];
+  if (logDirEnv !== void 0 && logDirEnv !== "") {
+    return path.isAbsolute(logDirEnv) ? logDirEnv : path.join(getDataDir(), logDirEnv);
+  }
+  return path.join(getDataDir(), "logs");
+}
+function getLogFilePath() {
+  const date5 = /* @__PURE__ */ new Date();
+  const yyyy = date5.getUTCFullYear();
+  const mm = String(date5.getUTCMonth() + 1).padStart(2, "0");
+  const dd = String(date5.getUTCDate()).padStart(2, "0");
+  return path.join(resolveLogDir(), `${yyyy}-${mm}-${dd}.jsonl`);
+}
+function getInspectorLogPath() {
+  const logFileEnv = process.env["AGENT_INSPECTOR_LOG_FILE"];
+  if (logFileEnv !== void 0 && logFileEnv !== "") {
+    return logFileEnv;
+  }
   return path.join(getDataDir(), "logs", "inspector.log");
 }
 function readBoundedInteger(name, fallback, minimum, maximum) {
@@ -21109,14 +22419,14 @@ function getRotatedGeneration(entry, baseName) {
 async function listApplicationLogFiles(logPath) {
   const directory = path.dirname(logPath);
   const baseName = path.basename(logPath);
-  const entries = await readdir(directory);
+  const entries = await readdir2(directory);
   const files = [];
   for (const entry of entries) {
     const generation = entry === baseName ? 0 : getRotatedGeneration(entry, baseName);
     if (generation === null) continue;
     const filePath = path.join(directory, entry);
     try {
-      const fileStat = await stat(filePath);
+      const fileStat = await stat2(filePath);
       if (!fileStat.isFile()) continue;
       files.push({ generation, modifiedAt: fileStat.mtimeMs, path: filePath });
     } catch {
@@ -21126,12 +22436,12 @@ async function listApplicationLogFiles(logPath) {
 }
 async function removeApplicationLog(filePath) {
   try {
-    await stat(filePath);
+    await stat2(filePath);
   } catch {
     return true;
   }
   try {
-    await unlink(filePath);
+    await unlink2(filePath);
     return true;
   } catch {
     return false;
@@ -21164,7 +22474,7 @@ async function maintainApplicationLogs(logPath, policy) {
 }
 async function moveApplicationLog(source, destination) {
   try {
-    await stat(source);
+    await stat2(source);
   } catch {
     return true;
   }
@@ -21197,7 +22507,7 @@ async function rotateApplicationLog(logPath, maxFiles) {
 }
 async function rotateApplicationLogIfNeeded(logPath, incomingBytes, policy) {
   try {
-    const fileStat = await stat(logPath);
+    const fileStat = await stat2(logPath);
     if (fileStat.size > 0 && fileStat.size + incomingBytes > policy.maxBytes) {
       return await rotateApplicationLog(logPath, policy.maxFiles);
     }
@@ -21216,16 +22526,24 @@ async function initLogger() {
     } else if (!securePrivateTreeSync(dir)) {
       writeStderrFallback("[logger] Failed to secure existing log files:", dir);
     } else {
-      const entries = await readdir(dir);
-      for (const entry of entries) {
-        if (!entry.endsWith(".jsonl")) continue;
-        const fullPath = path.join(dir, entry);
-        try {
-          const s = await stat(fullPath);
-          if (s.mtimeMs < cutoff) {
-            await unlink(fullPath);
+      const recovery = await recoverCapturedLogStorage(dir);
+      if (recovery.level === "unavailable") {
+        writeStderrFallback(
+          "[logger] Captured-log recovery blocked readiness:",
+          recovery.diagnostic ?? "unknown recovery failure"
+        );
+      } else {
+        const entries = await readdir2(dir);
+        for (const entry of entries) {
+          if (!entry.endsWith(".jsonl")) continue;
+          const fullPath = path.join(dir, entry);
+          try {
+            const s = await stat2(fullPath);
+            if (s.mtimeMs < cutoff) {
+              await unlink2(fullPath);
+            }
+          } catch {
           }
-        } catch {
         }
       }
     }
@@ -21252,7 +22570,7 @@ async function appendApplicationLogLine(logPath, line, policy) {
     return { ok: false, reason: "application log directory is not private" };
   }
   try {
-    if (!await rotateApplicationLogIfNeeded(logPath, Buffer2.byteLength(line, "utf-8"), policy)) {
+    if (!await rotateApplicationLogIfNeeded(logPath, Buffer3.byteLength(line, "utf-8"), policy)) {
       return { ok: false, reason: "application log rotation failed" };
     }
     await appendFile(logPath, line, { encoding: "utf-8", mode: PRIVATE_FILE_MODE });
@@ -21309,7 +22627,24 @@ process.on("exit", () => {
     try {
       const filePath = getLogFilePath();
       if (!ensurePrivateDirectorySync(path.dirname(filePath))) return;
-      appendFileSync(filePath, toWrite, { encoding: "utf-8", mode: PRIVATE_FILE_MODE });
+      if (!canAppendCapturedLogFileOnExit(resolveLogDir(), filePath)) return;
+      const descriptor = openSync2(
+        filePath,
+        constants3.O_WRONLY | constants3.O_APPEND | constants3.O_NOFOLLOW,
+        PRIVATE_FILE_MODE
+      );
+      try {
+        const payload = Buffer3.from(toWrite, "utf-8");
+        let written = 0;
+        while (written < payload.length) {
+          const writeCount = writeSync(descriptor, payload, written, payload.length - written);
+          if (writeCount === 0) return;
+          written += writeCount;
+        }
+        fsyncSync(descriptor);
+      } finally {
+        closeSync2(descriptor);
+      }
       void securePrivateFileSync(filePath);
     } catch {
     }
@@ -21323,15 +22658,15 @@ var RemotePortSchema = external_exports.number().int().min(1).max(65535);
 var SocketSchema = external_exports.object({
   remotePort: RemotePortSchema.nullish()
 }).passthrough();
-function parseCommandLine(commandLine, sep) {
+function parseCommandLine(commandLine, sep3) {
   if (!commandLine) return { cwd: null, projectFolder: null };
   const exeMatch = commandLine.match(/^"([^"]+)"/) || commandLine.match(/^([^\s]+)/);
   if (exeMatch?.[1] !== void 0) {
     const exePath = exeMatch[1];
-    const lastSep = exePath.lastIndexOf(sep);
+    const lastSep = exePath.lastIndexOf(sep3);
     if (lastSep > 0) {
       const exeDir = exePath.substring(0, lastSep);
-      return { cwd: exeDir, projectFolder: exeDir.split(sep).pop() ?? null };
+      return { cwd: exeDir, projectFolder: exeDir.split(sep3).pop() ?? null };
     }
   }
   return { cwd: null, projectFolder: null };
@@ -21357,7 +22692,7 @@ async function lookupProcessInfo(pid) {
       if (commandLine.length > 0) return parseCommandLine(commandLine, "\\");
     } else {
       try {
-        const raw = await readFile(`/proc/${String(pid)}/cmdline`, "utf8");
+        const raw = await readFile2(`/proc/${String(pid)}/cmdline`, "utf8");
         const commandLine = raw.replace(/\0/g, " ").trim();
         if (commandLine) {
           return parseCommandLine(commandLine, "/");
@@ -21473,6 +22808,88 @@ async function lookupPidByLocalPort(clientPort) {
   }
 }
 
+// src/proxy/uiAssetServer.ts
+import { readFile as readFile3 } from "node:fs/promises";
+import { extname, relative, resolve as resolve3, sep as sep2 } from "node:path";
+var CONTENT_TYPES = {
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".map": "application/json; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+function safeDecodedPath(pathname) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+  if (decoded.includes("\\") || decoded.includes("\0")) return null;
+  if (decoded.split("/").some((segment) => segment === "." || segment === "..")) return null;
+  return decoded;
+}
+function isInsideDirectory(path2, directory) {
+  const child = relative(directory, path2);
+  return child === "" || !child.startsWith("..") && !child.startsWith(sep2);
+}
+function assetPath(uiDirectory, pathname) {
+  const decoded = safeDecodedPath(pathname);
+  if (decoded === null) return null;
+  const target = resolve3(uiDirectory, `.${decoded}`);
+  return isInsideDirectory(target, resolve3(uiDirectory)) ? target : null;
+}
+async function readAsset(path2) {
+  try {
+    return await readFile3(path2);
+  } catch {
+    return null;
+  }
+}
+function contentTypeFor(path2) {
+  return CONTENT_TYPES[extname(path2).toLowerCase()] ?? "application/octet-stream";
+}
+function isBackendNamespace(pathname) {
+  return pathname === "/api" || pathname.startsWith("/api/") || pathname === "/proxy" || pathname.startsWith("/proxy/") || pathname === "/livez" || pathname === "/readyz";
+}
+function shouldUseDocumentFallback(pathname) {
+  if (pathname === "/" || pathname.length === 0) return true;
+  const lastSegment = pathname.split("/").at(-1) ?? "";
+  return !lastSegment.includes(".");
+}
+async function loadUiAsset(uiDirectory, pathname) {
+  if (isBackendNamespace(pathname)) return null;
+  const requestedPath = assetPath(uiDirectory, pathname);
+  if (requestedPath === null) return null;
+  const requestedBody = await readAsset(requestedPath);
+  if (requestedBody !== null) {
+    return {
+      body: requestedBody,
+      cacheControl: pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache",
+      contentType: contentTypeFor(requestedPath),
+      document: extname(requestedPath).toLowerCase() === ".html"
+    };
+  }
+  if (!shouldUseDocumentFallback(pathname)) return null;
+  const indexPath = resolve3(uiDirectory, "index.html");
+  const indexBody = await readAsset(indexPath);
+  if (indexBody === null) return null;
+  return {
+    body: indexBody,
+    cacheControl: "no-store",
+    contentType: CONTENT_TYPES[".html"] ?? "text/html; charset=utf-8",
+    document: true
+  };
+}
+
 // src/proxy/identityProxy.ts
 var IDENTITY_HEADERS = {
   pid: "x-agent-inspector-client-pid",
@@ -21489,26 +22906,19 @@ var ALIAS_CONTROL_MAX_REQUEST_BYTES = 8 * 1024;
 var IDENTITY_PROXY_CONTROL_NAMESPACE = "/.agent-inspector";
 var IDENTITY_PROXY_ALIAS_CONTROL_PATH = `${IDENTITY_PROXY_CONTROL_NAMESPACE}/base-path-aliases`;
 function normalizedAliasCandidate(value) {
-  const normalized = normalizeBasePath(value);
-  if (normalized.length === 0) {
-    return {
-      ok: false,
-      code: "invalid",
-      error: "Base Path aliases must be non-root paths such as /inspector."
-    };
-  }
-  if (!/^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/u.test(normalized)) {
+  const normalized = normalizePublicBasePath(value);
+  if (normalized === null) {
     return {
       ok: false,
       code: "invalid",
       error: "Base Path aliases may contain only URL-safe path segments."
     };
   }
-  if (normalized.split("/").some((segment) => segment === "." || segment === "..")) {
+  if (normalized.length === 0) {
     return {
       ok: false,
       code: "invalid",
-      error: "Base Path aliases cannot contain dot path segments."
+      error: "Base Path aliases must be non-root paths such as /inspector."
     };
   }
   if (normalized === IDENTITY_PROXY_CONTROL_NAMESPACE || normalized.startsWith(`${IDENTITY_PROXY_CONTROL_NAMESPACE}/`)) {
@@ -21537,7 +22947,7 @@ function basePathsOverlap(left, right) {
   return pathMatchesBasePath(left, right) || pathMatchesBasePath(right, left);
 }
 function createBasePathAliasRegistry(canonicalBasePath, initialAliases = []) {
-  const canonical = normalizeBasePath(canonicalBasePath);
+  const canonical = normalizePublicBasePath(canonicalBasePath) ?? "";
   const aliases = [];
   const add = (value) => {
     const candidate = normalizedAliasCandidate(value);
@@ -21596,7 +23006,7 @@ function createBasePathAliasRegistry(canonicalBasePath, initialAliases = []) {
     aliases.splice(index, 1);
     return { ok: true, basePath: candidate.basePath };
   };
-  const resolve2 = (rawPath) => {
+  const resolve5 = (rawPath) => {
     const requestUrl = new URL(rawPath, "http://localhost");
     const alias = aliases.find((candidate) => pathMatchesBasePath(requestUrl.pathname, candidate));
     const effectiveBasePath = alias ?? canonical;
@@ -21611,7 +23021,7 @@ function createBasePathAliasRegistry(canonicalBasePath, initialAliases = []) {
     add,
     list: () => [...aliases],
     remove,
-    resolve: resolve2
+    resolve: resolve5
   };
   for (const alias of initialAliases) add(alias);
   return registry2;
@@ -21664,8 +23074,9 @@ function htmlAttributeEscape(value) {
 }
 function rewriteRootRelativePublicPath(value, effectiveBasePath, sourceBasePath) {
   if (!value.startsWith("/") || value.startsWith("//")) return value;
-  const normalizedEffective = normalizeBasePath(effectiveBasePath);
-  const normalizedSource = normalizeBasePath(sourceBasePath);
+  const normalizedEffective = normalizePublicBasePath(effectiveBasePath);
+  const normalizedSource = normalizePublicBasePath(sourceBasePath);
+  if (normalizedEffective === null || normalizedSource === null) return value;
   const suffixIndex = value.search(/[?#]/u);
   const pathname = suffixIndex === -1 ? value : value.slice(0, suffixIndex);
   const suffix = suffixIndex === -1 ? "" : value.slice(suffixIndex);
@@ -21677,14 +23088,19 @@ function rewriteRootRelativePublicPath(value, effectiveBasePath, sourceBasePath)
   const trailingSlash = pathname.endsWith("/") && !rewritten.endsWith("/") ? "/" : "";
   return `${rewritten}${trailingSlash}${suffix}`;
 }
-function rewriteQuotedAssetPaths(source, effectiveBasePath, sourceBasePath) {
+function rewriteQuotedAssetPaths(source, effectiveBasePath, sourceBasePath, escape) {
   return source.replace(
     /(["'])(\/(?:[^"'/]+\/)*assets\/)/gu,
-    (_match, quote, assetPrefix) => `${quote}${rewriteRootRelativePublicPath(assetPrefix, effectiveBasePath, sourceBasePath)}`
+    (_match, quote, assetPrefix) => `${quote}${escape(
+      rewriteRootRelativePublicPath(assetPrefix, effectiveBasePath, sourceBasePath),
+      quote
+    )}`
   );
 }
 function rewriteHtmlForBasePath(html, basePath, sourceBasePath = "") {
-  const normalized = normalizeBasePath(basePath);
+  const normalized = normalizePublicBasePath(basePath);
+  const normalizedSource = normalizePublicBasePath(sourceBasePath);
+  if (normalized === null || normalizedSource === null) return html;
   const escaped = htmlAttributeEscape(normalized);
   const meta3 = `<meta name="${AGENT_INSPECTOR_BASE_PATH_META_NAME}" content="${escaped}">`;
   const metaPattern = new RegExp(
@@ -21700,29 +23116,112 @@ function rewriteHtmlForBasePath(html, basePath, sourceBasePath = "") {
   const withMeta = replacedMeta ? withReplacedMeta : withReplacedMeta.replace(/<head(\s[^>]*)?>/iu, (match) => `${match}${meta3}`);
   const withRewrittenAttributes = withMeta.replace(
     /\b(href|src|action)=(["'])(\/(?!\/)[^"']*)\2/giu,
-    (_match, attribute, quote, path2) => `${attribute}=${quote}${rewriteRootRelativePublicPath(path2, normalized, sourceBasePath)}${quote}`
+    (_match, attribute, quote, path2) => `${attribute}=${quote}${htmlAttributeEscape(
+      rewriteRootRelativePublicPath(path2, normalized, normalizedSource)
+    )}${quote}`
+  );
+  return rewriteQuotedAssetPaths(
+    withRewrittenAttributes,
+    normalized,
+    normalizedSource,
+    (value) => htmlAttributeEscape(value)
   );
-  return rewriteQuotedAssetPaths(withRewrittenAttributes, normalized, sourceBasePath);
 }
-function javaScriptStringEscape(value) {
-  return value.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"');
+function javaScriptStringEscape(value, quote) {
+  const escaped = value.replace(/\\/gu, "\\\\").replace(/\r/gu, "\\r").replace(/\n/gu, "\\n").replace(/\u2028/gu, "\\u2028").replace(/\u2029/gu, "\\u2029").replace(/&/gu, "\\u0026").replace(/</gu, "\\u003c").replace(/>/gu, "\\u003e");
+  return quote === "'" ? escaped.replace(/'/gu, "\\'") : escaped.replace(/"/gu, '\\"');
 }
 function rewriteJavaScriptForBasePath(source, basePath, sourceBasePath = "") {
-  const normalized = normalizeBasePath(basePath);
-  const escaped = javaScriptStringEscape(normalized);
+  const normalized = normalizePublicBasePath(basePath);
+  const normalizedSource = normalizePublicBasePath(sourceBasePath);
+  if (normalized === null || normalizedSource === null) return source;
+  const escaped = javaScriptStringEscape(normalized, '"');
   const withRouterBasePath = source.replace(
     /\bbasepath:\s*(["'])[^"']*\1/gu,
     `basepath:"${escaped}"`
   );
   const withDynamicPaths = withRouterBasePath.replace(
     /return(["'])(\/(?!\/)[^"']*)\1\+([A-Za-z_$][\w$]*)/gu,
-    (_match, quote, path2, variable) => `return${quote}${rewriteRootRelativePublicPath(
-      path2,
-      normalized,
-      sourceBasePath
-    )}${quote}+${variable}`
+    (_match, quote, path2, variable) => {
+      const rewritten = rewriteRootRelativePublicPath(path2, normalized, normalizedSource);
+      return `return${quote}${javaScriptStringEscape(rewritten, quote)}${quote}+${variable}`;
+    }
+  );
+  return rewriteQuotedAssetPaths(
+    withDynamicPaths,
+    normalized,
+    normalizedSource,
+    javaScriptStringEscape
   );
-  return rewriteQuotedAssetPaths(withDynamicPaths, normalized, sourceBasePath);
+}
+function publicOriginForRequest(req, options) {
+  if (options.publicOrigin !== void 0) {
+    try {
+      return new URL(options.publicOrigin).origin;
+    } catch {
+    }
+  }
+  return `http://${req.headers.host ?? "localhost"}`;
+}
+function browserRuntimeForRequest(req, options, basePath) {
+  const origin = publicOriginForRequest(req, options);
+  const normalized = normalizePublicBasePath(basePath) ?? "";
+  const baseUrl = normalized.length === 0 ? origin : `${origin}${normalized}`;
+  return {
+    schemaVersion: BROWSER_RUNTIME_SCHEMA_VERSION,
+    deploymentMode: "composed",
+    ui: { basePath: normalized.length === 0 ? "/" : normalized },
+    control: { baseUrl },
+    agent: { baseUrl },
+    capabilities: {
+      rest: true,
+      sse: true,
+      proxy: true,
+      mcp: true
+    }
+  };
+}
+function safeInlineJson(value) {
+  return JSON.stringify(value).replace(/&/gu, "\\u0026").replace(/</gu, "\\u003c").replace(/>/gu, "\\u003e").replace(/\u2028/gu, "\\u2028").replace(/\u2029/gu, "\\u2029");
+}
+function injectBrowserRuntime(html, runtime) {
+  const runtimeJson = safeInlineJson(runtime);
+  if (html.includes(BROWSER_RUNTIME_JSON_PLACEHOLDER)) {
+    return html.replaceAll(BROWSER_RUNTIME_JSON_PLACEHOLDER, runtimeJson);
+  }
+  const bootstrap = `<script>window.__AGENT_INSPECTOR_RUNTIME__=${runtimeJson};</script>`;
+  return html.replace(/<head(\s[^>]*)?>/iu, (head) => `${head}${bootstrap}`);
+}
+async function tryServeUiAsset(req, res, options, pathname, basePath, sourceBasePath) {
+  const method = (req.method ?? "GET").toUpperCase();
+  if (method !== "GET" && method !== "HEAD" || options.uiDirectory === void 0) return false;
+  const asset = await loadUiAsset(options.uiDirectory, pathname);
+  if (asset === null) return false;
+  let body = asset.body;
+  if (asset.document) {
+    const rewritten = rewriteHtmlForBasePath(body.toString("utf8"), basePath, sourceBasePath);
+    body = Buffer4.from(
+      injectBrowserRuntime(rewritten, browserRuntimeForRequest(req, options, basePath)),
+      "utf8"
+    );
+  } else if (basePath.length > 0 && asset.contentType.includes("javascript")) {
+    body = Buffer4.from(
+      rewriteJavaScriptForBasePath(body.toString("utf8"), basePath, sourceBasePath),
+      "utf8"
+    );
+  }
+  const headers = {
+    ...BASE_SECURITY_HEADERS,
+    "cache-control": asset.cacheControl,
+    "content-length": body.byteLength,
+    "content-type": asset.contentType
+  };
+  if (asset.document) headers["content-security-policy"] = DOCUMENT_CONTENT_SECURITY_POLICY;
+  res.writeHead(200, headers);
+  if (method === "HEAD") res.end();
+  else res.end(body);
+  req.resume();
+  return true;
 }
 function isLoopbackPeer(address) {
   if (address === void 0) return false;
@@ -21736,14 +23235,14 @@ function bearerToken(authorization) {
 }
 function tokensMatch(received, expected) {
   if (received === null || expected === void 0 || expected === "") return false;
-  const receivedBuffer = Buffer3.from(received);
-  const expectedBuffer = Buffer3.from(expected);
+  const receivedBuffer = Buffer4.from(received);
+  const expectedBuffer = Buffer4.from(expected);
   return receivedBuffer.byteLength === expectedBuffer.byteLength && timingSafeEqual(receivedBuffer, expectedBuffer);
 }
 function managedInstanceTokensMatch(received, expected) {
   if (received === void 0 || received.length === 0 || expected.length === 0) return false;
-  const receivedDigest = createHash("sha256").update(received).digest();
-  const expectedDigest = createHash("sha256").update(expected).digest();
+  const receivedDigest = createHash2("sha256").update(received).digest();
+  const expectedDigest = createHash2("sha256").update(expected).digest();
   return timingSafeEqual(receivedDigest, expectedDigest);
 }
 function firstHeader(value) {
@@ -21759,13 +23258,42 @@ function normalizedHostname(value) {
   }
 }
 function isLoopbackHostname(hostname3) {
-  return hostname3 === "localhost" || hostname3 === "::1" || hostname3.startsWith("127.");
+  if (hostname3 === "localhost" || hostname3 === "::1") return true;
+  if (isIP2(hostname3) !== 4) return false;
+  return hostname3.split(".", 1)[0] === "127";
+}
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+function parseUiOriginAllowlist(value) {
+  const origins = [];
+  const rejected = [];
+  for (const entry of (value ?? "").split(",")) {
+    const candidate = entry.trim();
+    if (candidate.length === 0) continue;
+    const parsed = parseUrl(candidate);
+    const valid = parsed !== null && (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username.length === 0 && parsed.password.length === 0 && parsed.pathname === "/" && parsed.search.length === 0 && parsed.hash.length === 0 && isLoopbackHostname(parsed.hostname.toLowerCase().replace(/^\[|\]$/gu, ""));
+    if (!valid || parsed === null) {
+      rejected.push(candidate);
+      continue;
+    }
+    if (!origins.includes(parsed.origin)) origins.push(parsed.origin);
+  }
+  return { origins, rejected };
+}
+function normalizeTrustedPublicOrigin(value) {
+  if (value === void 0) return void 0;
+  return normalizedRequestOrigin(value.trim());
 }
 function isTrustedIdentityProxyHost(host, options) {
   if (host === void 0) return false;
   const hostname3 = normalizedHostname(host);
   if (hostname3 === null) return false;
-  if (isLoopbackHostname(hostname3) || isIP(hostname3) !== 0) return true;
+  if (isLoopbackHostname(hostname3) || isIP2(hostname3) !== 0) return true;
   const listenHostname = normalizedHostname(options.listenHost);
   if (listenHostname !== null && hostname3 === listenHostname) return true;
   return (options.trustedHosts ?? []).some(
@@ -21776,6 +23304,83 @@ function isSafeMethod(method) {
   const normalized = (method ?? "GET").toUpperCase();
   return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS";
 }
+var UI_CORS_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+var UI_CORS_HEADERS = ["authorization", "content-type", "last-event-id", CSRF_HEADER];
+function normalizedRequestOrigin(origin) {
+  try {
+    const parsed = new URL(origin);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+    if (parsed.username.length > 0 || parsed.password.length > 0) return null;
+    if (parsed.pathname !== "/" || parsed.search.length > 0 || parsed.hash.length > 0) return null;
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+}
+function isSameRequestOrigin(origin, host, publicOrigin) {
+  const parsedOrigin = normalizedRequestOrigin(origin);
+  if (parsedOrigin === null) return false;
+  const expected = normalizedRequestOrigin(publicOrigin ?? `http://${host ?? "localhost"}`);
+  return expected !== null && parsedOrigin === expected;
+}
+function matchedUiOrigin(origin, allowedUiOrigins) {
+  if (origin === void 0) return null;
+  return (allowedUiOrigins ?? []).find((candidate) => candidate === origin) ?? null;
+}
+function isUiControlPath(pathname) {
+  if (pathname === "/livez" || pathname === "/readyz") return true;
+  if (pathname === "/api/mcp") return false;
+  return pathname === "/api" || pathname.startsWith("/api/");
+}
+function isModelProxyPath(pathname) {
+  return pathname === "/proxy" || pathname.startsWith("/proxy/");
+}
+function uiCorsHeaders(origin) {
+  if (origin === null) return {};
+  return {
+    "access-control-allow-origin": origin,
+    "access-control-expose-headers": "Content-Disposition",
+    vary: "Origin"
+  };
+}
+function appendVaryHeader(existing, name) {
+  const values = (Array.isArray(existing) ? existing.join(",") : existing ?? "").split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  if (!values.some((value) => value.toLowerCase() === name.toLowerCase())) values.push(name);
+  return values.join(", ");
+}
+function requestedCorsHeaders(value) {
+  return (value ?? "").split(",").map((header) => header.trim().toLowerCase()).filter((header) => header.length > 0);
+}
+function handleUiCorsPreflight(req, res, origin) {
+  const requestedMethod = firstHeader(req.headers["access-control-request-method"])?.toUpperCase();
+  const requestedHeaders = requestedCorsHeaders(
+    firstHeader(req.headers["access-control-request-headers"])
+  );
+  const methodAllowed = requestedMethod !== void 0 && UI_CORS_METHODS.some((method) => method === requestedMethod);
+  const headersAllowed = requestedHeaders.every(
+    (header) => UI_CORS_HEADERS.some((allowedHeader) => allowedHeader === header)
+  );
+  if (!methodAllowed || !headersAllowed) {
+    res.writeHead(403, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store",
+      ...uiCorsHeaders(origin)
+    });
+    res.end(JSON.stringify({ error: "CORS preflight is not allowed for this request." }));
+    req.resume();
+    return;
+  }
+  res.writeHead(204, {
+    "cache-control": "no-store",
+    "access-control-allow-origin": origin,
+    "access-control-allow-methods": UI_CORS_METHODS.join(", "),
+    "access-control-allow-headers": UI_CORS_HEADERS.join(", "),
+    "access-control-max-age": "600",
+    vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers"
+  });
+  res.end();
+  req.resume();
+}
 function isPublicHealthPath(pathname) {
   return pathname === "/livez" || pathname === "/readyz" || pathname === "/api/health";
 }
@@ -21797,16 +23402,21 @@ function isBrowserMutationAllowed(input) {
     new URL(input.path, "http://localhost").pathname,
     input.basePath ?? getConfiguredBasePath(process.env)
   );
-  if (pathname === "/proxy" || pathname.startsWith("/proxy/")) return true;
   const fetchSite = input.secFetchSite?.toLowerCase();
   const browserRequest = input.origin !== void 0 || fetchSite !== void 0;
   if (!browserRequest) return true;
-  if (fetchSite !== void 0 && fetchSite !== "same-origin") return false;
+  if (isModelProxyPath(pathname)) {
+    if (fetchSite !== void 0 && fetchSite !== "same-origin") return false;
+    if (input.origin !== void 0 && !isSameRequestOrigin(input.origin, input.host, input.publicOrigin)) {
+      return false;
+    }
+    return input.csrfToken === "1";
+  }
+  const allowedOrigin = matchedUiOrigin(input.origin, input.allowedUiOrigins);
+  if (fetchSite !== void 0 && fetchSite !== "same-origin" && allowedOrigin === null)
+    return false;
   if (input.origin !== void 0) {
-    try {
-      const originHost = new URL(input.origin).host.toLowerCase();
-      if (originHost !== input.host?.toLowerCase()) return false;
-    } catch {
+    if (!isSameRequestOrigin(input.origin, input.host, input.publicOrigin) && allowedOrigin === null) {
       return false;
     }
   }
@@ -21845,14 +23455,14 @@ function readAliasControlBody(req) {
       error: `Alias control body exceeds ${String(ALIAS_CONTROL_MAX_REQUEST_BYTES)} bytes`
     });
   }
-  return new Promise((resolve2) => {
+  return new Promise((resolve5) => {
     const chunks = [];
     let receivedBytes = 0;
     let settled = false;
     const finish = (result) => {
       if (settled) return;
       settled = true;
-      resolve2(result);
+      resolve5(result);
     };
     req.on("data", (chunk) => {
       if (settled) return;
@@ -21869,7 +23479,7 @@ function readAliasControlBody(req) {
       chunks.push(buffer);
     });
     req.on("end", () => {
-      finish({ ok: true, body: Buffer3.concat(chunks).toString("utf8") });
+      finish({ ok: true, body: Buffer4.concat(chunks).toString("utf8") });
     });
     req.on("aborted", () => {
       finish({ ok: false, status: 400, error: "Client aborted alias control request" });
@@ -22040,7 +23650,28 @@ function isIdentityProxyControlPath(pathname) {
   return pathname === IDENTITY_PROXY_CONTROL_NAMESPACE || pathname.startsWith(`${IDENTITY_PROXY_CONTROL_NAMESPACE}/`);
 }
 function startIdentityProxy(options) {
-  return new Promise((resolve2, reject) => {
+  const allowedUiOrigins = parseUiOriginAllowlist(options.allowedUiOrigins?.join(","));
+  if (allowedUiOrigins.rejected.length > 0) {
+    return Promise.reject(
+      new Error(
+        `Unsafe UI origins are not accepted: ${allowedUiOrigins.rejected.join(", ")}. Only exact loopback HTTP(S) origins are supported.`
+      )
+    );
+  }
+  const publicOrigin = normalizeTrustedPublicOrigin(options.publicOrigin);
+  if (publicOrigin === null) {
+    return Promise.reject(
+      new Error(
+        "publicOrigin must be an exact HTTP(S) origin without credentials, path, or query."
+      )
+    );
+  }
+  const effectiveOptions = {
+    ...options,
+    allowedUiOrigins: allowedUiOrigins.origins,
+    publicOrigin
+  };
+  return new Promise((resolve5, reject) => {
     const server = http.createServer();
     const aliasRegistry = options.aliasRegistry ?? createBasePathAliasRegistry(getConfiguredBasePath(process.env));
     const runtimeState = {
@@ -22079,7 +23710,7 @@ function startIdentityProxy(options) {
       };
       res.once("finish", release);
       res.once("close", release);
-      void handleRequest(req, res, options, aliasRegistry).catch((err) => {
+      void handleRequest(req, res, effectiveOptions, aliasRegistry).catch((err) => {
         const message = err instanceof Error ? err.message : String(err);
         if (!res.headersSent) {
           res.writeHead(502, { "content-type": "text/plain" });
@@ -22090,7 +23721,7 @@ function startIdentityProxy(options) {
     server.once("error", reject);
     server.listen(options.listenPort, options.listenHost, () => {
       server.removeListener("error", reject);
-      resolve2(server);
+      resolve5(server);
     });
   });
 }
@@ -22101,18 +23732,18 @@ function stopIdentityProxyAdmission(server) {
 async function waitForIdentityProxyDrain(server) {
   const state = identityProxyRuntimeStates.get(server);
   if (state === void 0 || state.activeRequests === 0) return;
-  await new Promise((resolve2) => {
-    state.drainWaiters.add(resolve2);
+  await new Promise((resolve5) => {
+    state.drainWaiters.add(resolve5);
   });
 }
 async function closeIdentityProxyGracefully(server) {
   stopIdentityProxyAdmission(server);
-  const closed = new Promise((resolve2) => {
+  const closed = new Promise((resolve5) => {
     if (!server.listening) {
-      resolve2();
+      resolve5();
       return;
     }
-    server.close(() => resolve2());
+    server.close(() => resolve5());
   });
   await Promise.all([closed, waitForIdentityProxyDrain(server)]);
 }
@@ -22148,6 +23779,48 @@ async function handleRequest(req, res, options, aliasRegistry) {
   const resolution = resolveBasePathAliasRequest(aliasRegistry, req.url ?? "/");
   const basePath = resolution.effectiveBasePath;
   const upstreamPath = resolution.upstreamPath;
+  const upstreamPathname = new URL(upstreamPath, "http://localhost").pathname;
+  const requestOrigin = req.headers.origin;
+  const requestPublicOrigin = publicOriginForRequest(req, options);
+  const crossOriginRequest = requestOrigin !== void 0 && !isSameRequestOrigin(requestOrigin, req.headers.host, requestPublicOrigin);
+  const allowedUiOrigin = crossOriginRequest ? matchedUiOrigin(requestOrigin, options.allowedUiOrigins) : null;
+  if (crossOriginRequest && isModelProxyPath(upstreamPathname)) {
+    res.writeHead(403, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    res.end(
+      JSON.stringify({ error: "Cross-origin browser access to the model proxy is forbidden." })
+    );
+    req.resume();
+    return;
+  }
+  if (crossOriginRequest && upstreamPathname === "/api/mcp") {
+    res.writeHead(403, {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store"
+    });
+    res.end(JSON.stringify({ error: "Browser CORS is not enabled for the MCP endpoint." }));
+    req.resume();
+    return;
+  }
+  if (crossOriginRequest && isUiControlPath(upstreamPathname)) {
+    if (allowedUiOrigin === null) {
+      res.writeHead(403, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store"
+      });
+      res.end(
+        JSON.stringify({ error: "UI origin is not allowed by this Agent Inspector runtime." })
+      );
+      req.resume();
+      return;
+    }
+    if ((req.method ?? "GET").toUpperCase() === "OPTIONS") {
+      handleUiCorsPreflight(req, res, allowedUiOrigin);
+      return;
+    }
+  }
   if (basePath.length > 0 && requestUrl.pathname.startsWith("/assets/")) {
     res.writeHead(307, {
       location: `${basePath}${requestUrl.pathname}${requestUrl.search}`,
@@ -22164,11 +23837,14 @@ async function handleRequest(req, res, options, aliasRegistry) {
     host: req.headers.host,
     origin: req.headers.origin,
     secFetchSite: firstHeader(req.headers["sec-fetch-site"]),
-    csrfToken: firstHeader(req.headers[CSRF_HEADER])
+    csrfToken: firstHeader(req.headers[CSRF_HEADER]),
+    allowedUiOrigins: options.allowedUiOrigins,
+    publicOrigin: requestPublicOrigin
   })) {
     res.writeHead(403, {
       "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store"
+      "cache-control": "no-store",
+      ...uiCorsHeaders(allowedUiOrigin)
     });
     res.end(JSON.stringify({ error: "Browser mutation requires same-origin CSRF proof" }));
     req.resume();
@@ -22185,7 +23861,8 @@ async function handleRequest(req, res, options, aliasRegistry) {
   })) {
     res.writeHead(403, {
       "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store"
+      "cache-control": "no-store",
+      ...uiCorsHeaders(allowedUiOrigin)
     });
     res.end(
       JSON.stringify({
@@ -22195,6 +23872,16 @@ async function handleRequest(req, res, options, aliasRegistry) {
     req.resume();
     return;
   }
+  if (await tryServeUiAsset(
+    req,
+    res,
+    options,
+    upstreamPathname,
+    basePath,
+    aliasRegistry.canonicalBasePath
+  )) {
+    return;
+  }
   const remotePort = req.socket.remotePort;
   let identity = null;
   if (remotePort !== void 0 && remotePort > 0) {
@@ -22212,7 +23899,8 @@ async function handleRequest(req, res, options, aliasRegistry) {
   if (contentLength !== null && (!Number.isFinite(contentLength) || contentLength < 0)) {
     res.writeHead(400, {
       "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store"
+      "cache-control": "no-store",
+      ...uiCorsHeaders(allowedUiOrigin)
     });
     res.end(JSON.stringify({ error: "Invalid Content-Length header" }));
     req.resume();
@@ -22221,7 +23909,8 @@ async function handleRequest(req, res, options, aliasRegistry) {
   if (contentLength !== null && contentLength > maxRequestBytes) {
     res.writeHead(413, {
       "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store"
+      "cache-control": "no-store",
+      ...uiCorsHeaders(allowedUiOrigin)
     });
     res.end(JSON.stringify({ error: `Request body exceeds ${String(maxRequestBytes)} bytes` }));
     req.resume();
@@ -22234,10 +23923,12 @@ async function handleRequest(req, res, options, aliasRegistry) {
     if (basePath.length > 0 && (lowerName === "accept-encoding" || lowerName === "range" || lowerName === "if-range"))
       continue;
     if (lowerName.startsWith(IDENTITY_HEADER_PREFIX)) continue;
+    if (lowerName === "authorization" && !isModelProxyPath(upstreamPathname)) continue;
     if (value === void 0) continue;
     upstreamHeaders[name] = value;
   }
   upstreamHeaders[AGENT_INSPECTOR_PUBLIC_BASE_PATH_HEADER] = basePath.length === 0 ? "/" : basePath;
+  upstreamHeaders[AGENT_INSPECTOR_PUBLIC_ORIGIN_HEADER] = requestPublicOrigin;
   const publicPort = req.socket.localPort;
   if (publicPort !== void 0 && publicPort > 0 && publicPort <= 65535) {
     upstreamHeaders[AGENT_INSPECTOR_PUBLIC_PORT_HEADER] = String(publicPort);
@@ -22311,6 +24002,11 @@ async function handleRequest(req, res, options, aliasRegistry) {
       for (const [name, value] of Object.entries(BASE_SECURITY_HEADERS)) {
         outHeaders[name] = value;
       }
+      if (allowedUiOrigin !== null && isUiControlPath(upstreamPathname)) {
+        outHeaders["access-control-allow-origin"] = allowedUiOrigin;
+        outHeaders["access-control-expose-headers"] = "Content-Disposition";
+        outHeaders["vary"] = appendVaryHeader(outHeaders["vary"], "Origin");
+      }
       if (contentType?.toLowerCase().includes("text/html") === true) {
         outHeaders["content-security-policy"] = DOCUMENT_CONTENT_SECURITY_POLICY;
       }
@@ -22322,7 +24018,7 @@ async function handleRequest(req, res, options, aliasRegistry) {
           chunks.push(toBuffer(chunk));
         });
         proxyRes.on("end", () => {
-          const body = Buffer3.concat(chunks).toString("utf8");
+          const body = Buffer4.concat(chunks).toString("utf8");
           res.write(
             shouldRewriteHtml ? rewriteHtmlForBasePath(body, basePath, aliasRegistry.canonicalBasePath) : rewriteJavaScriptForBasePath(body, basePath, aliasRegistry.canonicalBasePath)
           );
@@ -22397,18 +24093,18 @@ async function handleRequest(req, res, options, aliasRegistry) {
   });
 }
 function toBuffer(chunk) {
-  if (Buffer3.isBuffer(chunk)) return chunk;
-  if (typeof chunk === "string") return Buffer3.from(chunk);
-  if (chunk instanceof ArrayBuffer) return Buffer3.from(chunk);
+  if (Buffer4.isBuffer(chunk)) return chunk;
+  if (typeof chunk === "string") return Buffer4.from(chunk);
+  if (chunk instanceof ArrayBuffer) return Buffer4.from(chunk);
   if (chunk instanceof Uint8Array)
-    return Buffer3.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
-  return Buffer3.alloc(0);
+    return Buffer4.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+  return Buffer4.alloc(0);
 }
 
 // src/cli.ts
 init_platformCommands();
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = dirname3(__filename2);
+var __dirname2 = dirname2(__filename2);
 var DEFAULT_PORT4 = 9527;
 var LEGACY_ALIAS_PORT = 9527;
 var DEFAULT_UPSTREAM_PORT = 9529;
@@ -22434,6 +24130,14 @@ Global options:
   -h, --help      Show this help without starting a runtime
   -v, --version   Print the package version
 
+Start options:
+  --backend-only, --headless  Start the API, proxy, and MCP runtime without serving the UI
+  --with-ui                  Serve the independently built UI through the protected ingress
+  --port, -p <port>          Public ingress port (default: 9527)
+  --host, -H <host>          Bind host (default: 127.0.0.1)
+  --background               Start a hidden supervisor and return after readiness
+  --no-open                  Do not open the UI after startup
+
 Run \`agent-inspector instance --help\`, \`agent-inspector onboard --help\`, or
 \`agent-inspector doctor --help\` for command-specific options.`);
 }
@@ -22523,12 +24227,12 @@ async function getRunningCaptureMode(port, host, basePath = "") {
   }
 }
 function isPortAcceptingConnections(port, host) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve5) => {
     const socket = createConnection2({ host: probeHostForBindHost(host), port });
     const finish = (value) => {
       socket.removeAllListeners();
       socket.destroy();
-      resolve2(value);
+      resolve5(value);
     };
     socket.setTimeout(LOCAL_PROBE_TIMEOUT_MS);
     socket.once("connect", () => finish(true));
@@ -22537,8 +24241,8 @@ function isPortAcceptingConnections(port, host) {
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => {
-    setTimeout(resolve2, ms);
+  return new Promise((resolve5) => {
+    setTimeout(resolve5, ms);
   });
 }
 async function waitForInspectorHealthy(port, timeoutMs, host, basePath = "") {
@@ -22562,12 +24266,12 @@ function openBrowser(targetUrl) {
   browserProcess.unref();
 }
 function waitForProcessExit(child) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve5) => {
     child.once("exit", (code) => {
-      resolve2(code ?? 1);
+      resolve5(code ?? 1);
     });
     child.once("error", () => {
-      resolve2(1);
+      resolve5(1);
     });
   });
 }
@@ -22579,7 +24283,7 @@ function pipeServerOutputStream(stream, target, context) {
   if (stream === null) return;
   let buffered = "";
   stream.on("data", (chunk) => {
-    const text = Buffer4.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
+    const text = Buffer5.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
     const lines = `${buffered}${text}`.split(/\r?\n/);
     buffered = lines.pop() ?? "";
     for (const line of lines) {
@@ -22598,7 +24302,7 @@ function pipeServerOutputStream(stream, target, context) {
   });
 }
 function resolveServerCommand(outputDir, serverPath) {
-  const brandedRuntime = join8(outputDir, BRANDED_WINDOWS_RUNTIME_EXE);
+  const brandedRuntime = join9(outputDir, BRANDED_WINDOWS_RUNTIME_EXE);
   return process.platform === "win32" && existsSync7(brandedRuntime) ? { command: brandedRuntime, args: [serverPath] } : { command: process.execPath, args: [serverPath] };
 }
 function parseCaptureMode(value) {
@@ -22619,11 +24323,20 @@ function readCaptureMode(raw) {
   const value = descriptor?.value;
   return typeof value === "string" ? parseCaptureMode(value) : null;
 }
-function printAccessHints(port, host, basePath = "") {
+function printAccessHints(port, host, basePath, serveUi, publicOrigin) {
   const networkUrls = networkUrlsForBindHost(port, host);
-  for (const line of formatAccessHintLines(port, networkUrls, host, basePath)) {
+  for (const line of formatAccessHintLines(port, networkUrls, host, basePath, serveUi)) {
     console.log(line);
   }
+  if (publicOrigin !== void 0) {
+    const publicBaseUrl = appendBasePathToOrigin(publicOrigin, "/", basePath);
+    if (serveUi) console.log(`   Public UI:      ${publicBaseUrl}`);
+    console.log(`   Public control Base: ${publicBaseUrl}`);
+    console.log(`   Public agent Base:   ${publicBaseUrl}`);
+    console.log(`   Public REST API: ${appendBasePathToOrigin(publicOrigin, "/api", basePath)}`);
+    console.log(`   Public proxy:    ${appendBasePathToOrigin(publicOrigin, "/proxy", basePath)}`);
+    console.log(`   Public MCP:     ${appendBasePathToOrigin(publicOrigin, "/api/mcp", basePath)}`);
+  }
   if (!isLoopbackHost(host)) {
     const proxyTokenConfigured = (process.env["AGENT_INSPECTOR_PROXY_TOKEN"] ?? "") !== "";
     const legacyProxyEnabled = process.env["AGENT_INSPECTOR_ALLOW_UNAUTHENTICATED_REMOTE_PROXY"] === "1";
@@ -22652,6 +24365,18 @@ function readPositiveIntegerEnv(name) {
   console.warn(`Ignoring invalid ${name}=${raw}; expected a positive integer.`);
   return void 0;
 }
+function normalizeExplicitPublicOrigin(value) {
+  if (value === void 0 || value.trim().length === 0) return void 0;
+  try {
+    const parsed = new URL(value.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+    if (parsed.username.length > 0 || parsed.password.length > 0) return null;
+    if (parsed.pathname !== "/" || parsed.search.length > 0 || parsed.hash.length > 0) return null;
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+}
 function buildBackgroundSupervisorArgs(options) {
   const args = ["--no-open", "--port", String(options.port), "--mode", options.captureMode];
   if (options.host !== void 0) {
@@ -22669,6 +24394,9 @@ function buildBackgroundSupervisorArgs(options) {
   if (options.legacyAliasEnabled) {
     args.push("--legacy-port");
   }
+  if (!options.serveUi) {
+    args.push("--backend-only");
+  }
   return args;
 }
 function pickUpstreamPort(publicPort, legacyAliasPort) {
@@ -22681,7 +24409,7 @@ function pickUpstreamPort(publicPort, legacyAliasPort) {
   }
   return DEFAULT_UPSTREAM_PORT;
 }
-async function tryStartIdentityProxy(identityPort, upstreamPort, listenHost, upstreamHost, managedInstance) {
+async function tryStartIdentityProxy(identityPort, upstreamPort, listenHost, upstreamHost, managedInstance, allowedUiOrigins, uiDirectory, publicOrigin) {
   try {
     const server = await startIdentityProxy({
       listenPort: identityPort,
@@ -22694,6 +24422,9 @@ async function tryStartIdentityProxy(identityPort, upstreamPort, listenHost, ups
       proxyToken: process.env["AGENT_INSPECTOR_PROXY_TOKEN"],
       allowUnauthenticatedRemoteProxy: process.env["AGENT_INSPECTOR_ALLOW_UNAUTHENTICATED_REMOTE_PROXY"] === "1",
       trustedHosts: (process.env["AGENT_INSPECTOR_TRUSTED_HOSTS"] ?? "").split(",").map((host) => host.trim()).filter((host) => host.length > 0),
+      allowedUiOrigins,
+      uiDirectory,
+      publicOrigin,
       maxRequestBytes: readPositiveIntegerEnv("AGENT_INSPECTOR_MAX_REQUEST_BYTES"),
       requestTimeoutMs: readPositiveIntegerEnv("AGENT_INSPECTOR_REQUEST_TIMEOUT_MS"),
       managedInstance
@@ -22701,9 +24432,7 @@ async function tryStartIdentityProxy(identityPort, upstreamPort, listenHost, ups
     return server;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.warn(
-      `[identity-proxy] Could not listen on port ${identityPort}: ${message}. Falling back to OS-scan heuristic on port ${upstreamPort}. Pass --identity-proxy-port <n> to choose another port, or --no-identity-proxy to disable.`
-    );
+    console.warn(`[identity-proxy] Could not listen on port ${identityPort}: ${message}.`);
     return null;
   }
 }
@@ -22721,7 +24450,7 @@ async function runStart(args) {
   const envMode = process.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? process.env["AGENT_INSPECTOR_MODE"];
   let port = portDefault;
   let host = envHost !== void 0 && envHost.trim().length > 0 ? envHost.trim() : DEFAULT_BIND_HOST;
-  let open = true;
+  let open2 = true;
   let openWasSpecified = false;
   let background = false;
   let forceRestart = false;
@@ -22731,6 +24460,7 @@ async function runStart(args) {
   let captureModeWasSpecified = false;
   let enableIdentityProxy = true;
   let legacyAliasEnabled = false;
+  let serveUi = process.env["AGENT_INSPECTOR_BACKEND_ONLY"] !== "1";
   if (envMode !== void 0 && envMode !== "") {
     const parsedMode = parseCaptureMode(envMode);
     if (parsedMode === null) {
@@ -22793,11 +24523,11 @@ async function runStart(args) {
         break;
       }
       case "--no-open":
-        open = false;
+        open2 = false;
         openWasSpecified = true;
         break;
       case "--open":
-        open = true;
+        open2 = true;
         openWasSpecified = true;
         break;
       case "--force-restart":
@@ -22807,6 +24537,14 @@ async function runStart(args) {
       case "--background":
         background = true;
         break;
+      case "--backend-only":
+      case "--headless":
+        serveUi = false;
+        open2 = false;
+        break;
+      case "--with-ui":
+        serveUi = true;
+        break;
       case "--config-dir":
         configDir = args[i + 1];
         i++;
@@ -22877,6 +24615,40 @@ async function runStart(args) {
     process.exitCode = 1;
     return;
   }
+  if (!serveUi) open2 = false;
+  if (!enableIdentityProxy && serveUi) {
+    console.error(
+      "The decoupled UI is composed only by the protected ingress. Use --backend-only with --no-identity-proxy, or keep the identity proxy enabled."
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const uiOriginAllowlist = parseUiOriginAllowlist(process.env["AGENT_INSPECTOR_UI_ORIGINS"]);
+  if (uiOriginAllowlist.rejected.length > 0) {
+    console.error(
+      `Invalid AGENT_INSPECTOR_UI_ORIGINS entries: ${uiOriginAllowlist.rejected.join(", ")}. Only exact loopback http(s) origins are accepted; use a same-origin authenticated gateway for remote UI hosting.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const publicOrigin = normalizeExplicitPublicOrigin(process.env["AGENT_INSPECTOR_PUBLIC_ORIGIN"]);
+  if (publicOrigin === null) {
+    console.error(
+      "Invalid AGENT_INSPECTOR_PUBLIC_ORIGIN. Use an exact http(s) origin without credentials, path, query, or fragment."
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const uiDirectoryCandidate = join9(__dirname2, "../.output/ui");
+  const uiIndexPath = join9(uiDirectoryCandidate, "index.html");
+  const uiDirectory = serveUi && existsSync7(uiIndexPath) ? uiDirectoryCandidate : void 0;
+  if (serveUi && uiDirectory === void 0) {
+    console.error(
+      `Agent Inspector UI artifact is missing at ${uiIndexPath}. Run the composed build or use --backend-only.`
+    );
+    process.exitCode = 1;
+    return;
+  }
   function killProcessOnPort(targetPort) {
     const pids = findPidsByPort(targetPort);
     for (const pid of pids) {
@@ -22893,17 +24665,30 @@ async function runStart(args) {
   }
   const upstreamHost = enableIdentityProxy ? DEFAULT_BIND_HOST : host;
   process.env["PORT"] = String(upstreamPort);
+  const configuredBasePath = process.env[AGENT_INSPECTOR_BASE_PATH_ENV];
+  if (configuredBasePath !== void 0 && normalizePublicBasePath(configuredBasePath) === null) {
+    console.error(
+      `Invalid ${AGENT_INSPECTOR_BASE_PATH_ENV}. Use / for root or URL-safe path segments such as /inspector or /foo-bar/v1.`
+    );
+    process.exitCode = 1;
+    return;
+  }
   const basePath = getConfiguredBasePath(process.env);
-  const url2 = urlForHost(port, host);
-  const uiUrl = appendBasePathToOrigin(url2, "/", basePath);
-  const proxyUrl = appendBasePathToOrigin(url2, "/proxy", basePath);
-  const proxyMessagesUrl = appendBasePathToOrigin(url2, "/proxy/v1/messages", basePath);
+  const bindOrigin = urlForHost(port, host);
+  const outwardOrigin = publicOrigin ?? bindOrigin;
+  const surfaceBaseUrl = appendBasePathToOrigin(outwardOrigin, "/", basePath);
+  const uiUrl = serveUi ? surfaceBaseUrl : null;
+  const proxyUrl = appendBasePathToOrigin(outwardOrigin, "/proxy", basePath);
+  const openAiProxyUrl = appendBasePathToOrigin(outwardOrigin, "/proxy/v1", basePath);
+  const proxyMessagesUrl = appendBasePathToOrigin(outwardOrigin, "/proxy/v1/messages", basePath);
   const legacyUrl = legacyAliasPort === null ? null : appendBasePathToOrigin(localUrlForPort(legacyAliasPort), "/", basePath);
   const legacyProxyUrl = legacyAliasPort === null ? null : appendBasePathToOrigin(localUrlForPort(legacyAliasPort), "/proxy", basePath);
   const legacyMcpUrl = legacyAliasPort === null ? null : appendBasePathToOrigin(localUrlForPort(legacyAliasPort), "/api/mcp", basePath);
   if (!forceRestart && await isInspectorHealthy(port, host, basePath)) {
-    console.log(`agent-inspector is already running at ${uiUrl}`);
-    printAccessHints(port, host, basePath);
+    console.log(
+      `agent-inspector ${serveUi ? "is already running" : "backend is already running"} at ${surfaceBaseUrl}`
+    );
+    printAccessHints(port, host, basePath, serveUi, publicOrigin);
     if (captureModeWasSpecified) {
       const runningMode = await getRunningCaptureMode(port, host, basePath);
       if (runningMode !== null && runningMode !== captureMode) {
@@ -22912,7 +24697,7 @@ async function runStart(args) {
       }
     }
     console.log(`Use --force-restart to restart the existing instance.`);
-    if (open && openWasSpecified) {
+    if (open2 && openWasSpecified && uiUrl !== null) {
       openBrowser(uiUrl);
     }
     return;
@@ -22948,7 +24733,8 @@ async function runStart(args) {
       providersJson,
       captureMode,
       enableIdentityProxy,
-      legacyAliasEnabled
+      legacyAliasEnabled,
+      serveUi
     });
     const supervisorProcess = spawn2(process.execPath, [cliEntry, ...supervisorArgs], {
       stdio: "ignore",
@@ -22961,8 +24747,10 @@ async function runStart(args) {
     });
     supervisorProcess.unref();
     if (await waitForInspectorHealthy(port, 1e4, host, basePath)) {
-      console.log(`agent-inspector background server is ready at ${uiUrl}`);
-      printAccessHints(port, host, basePath);
+      console.log(
+        `agent-inspector background ${serveUi ? "server" : "backend"} is ready at ${surfaceBaseUrl}`
+      );
+      printAccessHints(port, host, basePath, serveUi, publicOrigin);
       if (legacyProxyUrl !== null && legacyMcpUrl !== null) {
         console.log(`   Legacy proxy:  ${legacyProxyUrl}`);
         console.log(`   Legacy MCP:    ${legacyMcpUrl}`);
@@ -22971,46 +24759,18 @@ async function runStart(args) {
       console.log(`Route AI coding tools through the identity proxy for accurate PID attribution:`);
       console.log(`   Claude Code:  ANTHROPIC_BASE_URL=${proxyUrl} claude`);
       console.log(`   OpenCode:     LLM_BASE_URL=${proxyUrl} opencode`);
-      console.log(`   MiMo Code:    OPENAI_BASE_URL=${proxyUrl} mimo`);
-      if (open && openWasSpecified) {
+      console.log(`   MiMo Code:    OPENAI_BASE_URL=${openAiProxyUrl} mimo`);
+      if (open2 && openWasSpecified && uiUrl !== null) {
         openBrowser(uiUrl);
       }
       return;
     }
-    console.error(`agent-inspector background server did not become ready at ${uiUrl}.`);
+    console.error(`agent-inspector background server did not become ready at ${surfaceBaseUrl}.`);
     process.exitCode = 1;
     return;
   }
-  console.log(`Server running at ${uiUrl}`);
-  console.log(`   Capture mode: ${captureMode}`);
-  console.log(`   Proxy: ${proxyUrl}`);
-  printAccessHints(port, host, basePath);
-  if (legacyUrl !== null && legacyProxyUrl !== null && legacyMcpUrl !== null) {
-    console.log(`   Legacy UI:      ${legacyUrl}`);
-    console.log(`   Legacy proxy:   ${legacyProxyUrl}`);
-    console.log(`   Legacy MCP:     ${legacyMcpUrl}`);
-  }
-  console.log(``);
-  console.log(`Route AI coding tools through the proxy:`);
-  console.log(`   Claude Code:  ANTHROPIC_BASE_URL=${proxyUrl} claude`);
-  console.log(`   OpenCode:     LLM_BASE_URL=${proxyUrl} opencode`);
-  console.log(`   MiMo Code:    OPENAI_BASE_URL=${proxyUrl} mimo`);
-  console.log(`   Direct HTTP:  curl ${proxyMessagesUrl} -d '{"model":"...","messages":[...]}'`);
-  console.log(
-    `   Remote/container tools: use the Network proxy URL above when shown; otherwise restart with --host 0.0.0.0 or a reachable IP.`
-  );
-  console.log(``);
-  console.log(`Routing environment variables:`);
-  console.log(`   ROUTES            JSON map of model prefix -> upstream URL`);
-  console.log(`   DEFAULT_UPSTREAM  Fallback upstream for unmatched models`);
-  console.log(
-    `   Example: ROUTES='{"claude-":"https://api.anthropic.com","MiniMax":"https://api.minimaxi.com/anthropic"}'`
-  );
-  if (open) {
-    openBrowser(uiUrl);
-  }
   const outputDir = __dirname2;
-  const serverPath = join8(outputDir, "../.output/server/index.mjs");
+  const serverPath = join9(outputDir, "../.output/server/index.mjs");
   const serverCommand = resolveServerCommand(outputDir, serverPath);
   const serverEnv = { ...process.env };
   const currentCliEntry = process.env[AGENT_INSPECTOR_CLI_ENTRY_ENV] ?? process.argv[1];
@@ -23018,7 +24778,7 @@ async function runStart(args) {
     serverEnv[AGENT_INSPECTOR_CLI_ENTRY_ENV] = currentCliEntry;
   }
   if (configDir !== void 0) {
-    let resolvedPath = join8(configDir);
+    let resolvedPath = join9(configDir);
     const msysMatch = /^\\([a-z])\\(.*)$/i.exec(resolvedPath);
     if (msysMatch !== null) {
       const drive = (msysMatch[1] ?? "").toUpperCase();
@@ -23040,7 +24800,8 @@ async function runStart(args) {
   serverEnv["AGENT_INSPECTOR_PUBLIC_PORT"] = String(port);
   serverEnv["PROXY_PORT"] = String(port);
   serverEnv["AGENT_INSPECTOR_CAPTURE_MODE"] = captureMode;
-  const workerDir = join8(__dirname2, "workers");
+  serverEnv["AGENT_INSPECTOR_BACKEND_ONLY"] = serveUi ? "0" : "1";
+  const workerDir = join9(__dirname2, "workers");
   if (existsSync7(workerDir)) {
     serverEnv["AGENT_INSPECTOR_WORKER_DIR"] = workerDir;
   }
@@ -23080,12 +24841,12 @@ async function runStart(args) {
       serverExit.then(() => void 0),
       ...identityProxies.map(async (proxy) => await closeIdentityProxyGracefully(proxy.server))
     ]).then(() => void 0);
-    const timedOut = new Promise((resolve2) => {
+    const timedOut = new Promise((resolve5) => {
       deadline = setTimeout(() => {
         forced = true;
         for (const proxy of identityProxies) forceCloseIdentityProxy(proxy.server);
         if (serverProcess.exitCode === null) serverProcess.kill("SIGKILL");
-        resolve2();
+        resolve5();
       }, childDeadline + SUPERVISOR_SHUTDOWN_GRACE_MS);
     });
     supervisorShutdownPromise = Promise.race([graceful, timedOut]).finally(() => {
@@ -23116,18 +24877,34 @@ async function runStart(args) {
       upstreamPort,
       host,
       upstreamHost,
-      managedInstanceControl
+      managedInstanceControl,
+      uiOriginAllowlist.origins,
+      uiDirectory,
+      publicOrigin
     );
-    if (primaryProxy !== null) {
-      identityProxies.push({ label: "primary", port, server: primaryProxy });
+    if (primaryProxy === null) {
+      console.error(
+        `Agent Inspector could not bind its protected public ingress at ${bindOrigin}; stopping the private backend.`
+      );
+      requestSupervisorShutdown("SIGTERM");
+      const failedStartupShutdown = currentSupervisorShutdown();
+      if (failedStartupShutdown !== null) await failedStartupShutdown;
+      process.off("SIGINT", handleSigint);
+      process.off("SIGTERM", handleSigterm);
+      process.exitCode = 1;
+      return;
     }
+    identityProxies.push({ label: "primary", port, server: primaryProxy });
     if (legacyAliasPort !== null) {
       const legacyProxy = await tryStartIdentityProxy(
         legacyAliasPort,
         upstreamPort,
         host,
         upstreamHost,
-        managedInstanceControl
+        managedInstanceControl,
+        uiOriginAllowlist.origins,
+        uiDirectory,
+        publicOrigin
       );
       if (legacyProxy !== null) {
         identityProxies.push({ label: "legacy", port: legacyAliasPort, server: legacyProxy });
@@ -23138,11 +24915,13 @@ async function runStart(args) {
     serverProcess.unref();
     const upstreamProbeBasePath = enableIdentityProxy ? "" : basePath;
     if (await waitForInspectorHealthy(upstreamPort, 5e3, host, upstreamProbeBasePath)) {
-      console.log(`agent-inspector background server is ready at ${uiUrl}`);
+      console.log(
+        `agent-inspector background ${serveUi ? "server" : "backend"} is ready at ${surfaceBaseUrl}`
+      );
       if (identityProxies.length > 0) {
         console.log(`Identity proxy ready on port ${port} (PID-attributing proxy).`);
       }
-      printAccessHints(port, host, basePath);
+      printAccessHints(port, host, basePath, serveUi, publicOrigin);
       if (legacyProxyUrl !== null && legacyMcpUrl !== null) {
         console.log(`   Legacy proxy:  ${legacyProxyUrl}`);
         console.log(`   Legacy MCP:    ${legacyMcpUrl}`);
@@ -23153,19 +24932,29 @@ async function runStart(args) {
           `Route AI coding tools through the identity proxy for accurate PID attribution:`,
           `   Claude Code:  ANTHROPIC_BASE_URL=${proxyUrl} claude`,
           `   OpenCode:     LLM_BASE_URL=${proxyUrl} opencode`,
-          `   MiMo Code:    OPENAI_BASE_URL=${proxyUrl} mimo`,
+          `   MiMo Code:    OPENAI_BASE_URL=${openAiProxyUrl} mimo`,
           legacyProxyUrl === null ? `   Override the port with --port <n> when needed.` : `   Legacy configs using ${legacyProxyUrl} still work.`
         );
       }
       return;
     }
-    console.error(`agent-inspector background server did not become ready at ${uiUrl}.`);
+    console.error(`agent-inspector background server did not become ready at ${surfaceBaseUrl}.`);
+    process.exitCode = 1;
+    return;
+  }
+  if (!await waitForInspectorHealthy(port, 1e4, host, basePath)) {
+    console.error(`Agent Inspector did not become ready at ${surfaceBaseUrl}; stopping startup.`);
+    requestSupervisorShutdown("SIGTERM");
+    const failedStartupShutdown = currentSupervisorShutdown();
+    if (failedStartupShutdown !== null) await failedStartupShutdown;
+    process.off("SIGINT", handleSigint);
+    process.off("SIGTERM", handleSigterm);
     process.exitCode = 1;
     return;
   }
   if (identityProxies.length > 0) {
     console.log(``);
-    console.log(`Identity proxy ready at ${url2} (PID-attributing public entrypoint).`);
+    console.log(`Identity proxy ready at ${bindOrigin} (PID-attributing ingress).`);
     if (legacyAliasPort !== null) {
       const legacyReady = identityProxies.some((proxy) => proxy.label === "legacy");
       if (legacyReady) {
@@ -23176,6 +24965,27 @@ async function runStart(args) {
       console.log(`   Internal runtime port ${upstreamPort} is hidden behind the public proxy.`);
     }
   }
+  console.log(
+    `${serveUi ? "UI and backend" : "Backend control and agent runtime"} running at ${surfaceBaseUrl}`
+  );
+  console.log(`   Capture mode: ${captureMode}`);
+  console.log(`   Proxy: ${proxyUrl}`);
+  printAccessHints(port, host, basePath, serveUi, publicOrigin);
+  if (legacyUrl !== null && legacyProxyUrl !== null && legacyMcpUrl !== null) {
+    console.log(`   Legacy UI:      ${legacyUrl}`);
+    console.log(`   Legacy proxy:   ${legacyProxyUrl}`);
+    console.log(`   Legacy MCP:     ${legacyMcpUrl}`);
+  }
+  console.log(``);
+  console.log(`Route AI coding tools through the proxy:`);
+  console.log(`   Claude Code:  ANTHROPIC_BASE_URL=${proxyUrl} claude`);
+  console.log(`   OpenCode:     LLM_BASE_URL=${proxyUrl} opencode`);
+  console.log(`   MiMo Code:    OPENAI_BASE_URL=${openAiProxyUrl} mimo`);
+  console.log(`   Direct HTTP:  curl ${proxyMessagesUrl} -d '{"model":"...","messages":[...]}'`);
+  console.log(
+    `   Remote/container tools: use the Network proxy URL above when shown; otherwise restart with --host 0.0.0.0 or a reachable IP.`
+  );
+  if (open2 && uiUrl !== null) openBrowser(uiUrl);
   process.exitCode = await serverExit;
   const activeSupervisorShutdown = currentSupervisorShutdown();
   if (activeSupervisorShutdown !== null) {