@tonyclaw/agent-inspector 3.0.47 → 3.0.48

package/.output/cli.js

@@ -14,6 +14,206 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@tonyclaw/agent-inspector",
+      version: "3.0.48",
+      type: "module",
+      description: "Agent observability and knowledge capture layer for AI coding tools.",
+      license: "MIT",
+      engines: {
+        node: ">=22.0.0"
+      },
+      author: "TonyClaw",
+      repository: {
+        type: "git",
+        url: "git+https://gitcode.com/TonyClaw/agent-inspector.git"
+      },
+      homepage: "https://gitcode.com/TonyClaw/agent-inspector#readme",
+      workspaces: [
+        "packages/*"
+      ],
+      bugs: {
+        url: "https://gitcode.com/TonyClaw/agent-inspector/issues"
+      },
+      publishConfig: {
+        access: "public",
+        registry: "https://registry.npmjs.org/"
+      },
+      keywords: [
+        "claude",
+        "anthropic",
+        "openai",
+        "proxy",
+        "api-inspector",
+        "agent-observability",
+        "agent-memory",
+        "debugging",
+        "llm",
+        "ai-coding-tools"
+      ],
+      bin: {
+        "agent-inspector": "bin/agent-inspector.js"
+      },
+      files: [
+        "bin",
+        "src",
+        "!src/**/*.test.ts",
+        "!src/**/*.stories.tsx",
+        "!src/**/__fixtures__",
+        "!src/ui/routeTree.gen.ts",
+        "!src/backend/routeTree.gen.ts",
+        "scripts/setup-windows-runtime.mjs",
+        "scripts/setup-agent-skills.mjs",
+        "scripts/generate-theme-scales.mjs",
+        "docs/instance-control.openapi.yaml",
+        "styles",
+        ".output",
+        "!.output/*.exe"
+      ],
+      scripts: {
+        dev: "node scripts/dev-decoupled.mjs",
+        "dev:ui": "vite dev --config vite.ui.config.ts",
+        "dev:backend": "node scripts/dev-backend.mjs",
+        "test:smoke": "bun scripts/run-test-suite.mjs smoke",
+        "test:fast": "bun scripts/run-test-suite.mjs smoke",
+        "test:unit": "bun scripts/run-test-suite.mjs unit",
+        "test:integration": "bun scripts/run-test-suite.mjs integration",
+        "test:changed": "bun scripts/run-test-suite.mjs changed",
+        "test:all": "bun scripts/run-test-suite.mjs all",
+        "test:compatibility-tooling": "node --test scripts/compatibility/*.test.mjs",
+        start: "node .output/cli.js",
+        "start:backend": "node .output/cli.js --backend-only --no-open",
+        "preview:ui": "vite preview --config vite.ui.config.ts",
+        "clean:output": "node scripts/clean-output.mjs",
+        build: "bun clean:output && bun build:backend && bun build:ui && bun smoke:ui-preview && bun build:workers && bun build:cli && bun build:mcp && bun check:bundle && bun check:boundaries",
+        "build:backend": "vite build --config vite.backend.config.ts",
+        "build:ui": "vite build --config vite.ui.config.ts",
+        "build:workers": "npx esbuild src/proxy/logFinalizer.worker.ts src/proxy/sessionWorkerEntry.ts --bundle --platform=node --target=node22 --format=esm --outdir=.output/workers --external:better-sqlite3",
+        "smoke:workers": "node scripts/smoke-production-workers.mjs",
+        "smoke:packed-workers": "node scripts/smoke-packed-workers.mjs",
+        "smoke:instances": "node scripts/smoke-windows-instances.mjs",
+        "smoke:coding-agent-instances": "node scripts/smoke-coding-agent-instances.mjs",
+        "smoke:ui-preview": "node scripts/smoke-decoupled-ui-preview.mjs",
+        "check:bundle": "node scripts/check-client-bundle.mjs",
+        "check:boundaries": "node scripts/check-runtime-boundaries.mjs",
+        "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",
+        "compatibility:compare": "node scripts/compatibility/cli.mjs compare",
+        "compatibility:drift": "node scripts/check-backend-compatibility.mjs",
+        "compatibility:fixtures": "bun scripts/validate-compatibility-fixtures.ts",
+        "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",
+        "compatibility:run": "node scripts/compatibility/cli.mjs run",
+        "compatibility:performance": "node scripts/compatibility/performance-cli.mjs",
+        "compatibility:performance:verify": "node scripts/compatibility/performance-cli.mjs verify",
+        "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",
+        "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
+        "rust:build-package": "node scripts/rust/build-platform.mjs",
+        "rust:stage-package": "node scripts/rust/stage-platform.mjs",
+        "rust:verify-package": "node scripts/rust/verify-platform.mjs",
+        "rust:pack-package": "node scripts/rust/pack-platform.mjs",
+        "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",
+        "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",
+        "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/releaseCore.test.ts",
+        "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",
+        "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",
+        "themes:generate": "node scripts/generate-theme-scales.mjs",
+        postinstall: "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",
+        prepublishOnly: "node scripts/rust/require-release-orchestrator.mjs",
+        typecheck: "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",
+        lint: "eslint . --cache --cache-location .cache/eslintcache",
+        format: "biome format --write .",
+        "format:check": "biome format .",
+        "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",
+        "extension:zip": "node scripts/pack-chrome-extension.mjs",
+        "extension:release": "node scripts/release-chrome-extension.mjs",
+        release: "node scripts/release.mjs",
+        knip: "knip",
+        check: "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd && bun rust:packages:check",
+        prepare: "husky",
+        ladle: "ladle serve",
+        "ladle:build": "ladle build"
+      },
+      dependencies: {
+        "@mariozechner/pi-agent-core": "^0.73.1",
+        "@mariozechner/pi-ai": "^0.73.1",
+        "@modelcontextprotocol/server": "^2.0.0-beta.4",
+        "@tailwindcss/typography": "^0.5.20",
+        "@tanstack/react-router": "^1.170.18",
+        "@tanstack/react-start": "^1.168.28",
+        "@tanstack/react-virtual": "^3.14.6",
+        "class-variance-authority": "^0.7.1",
+        clsx: "^2.1.1",
+        conf: "^15.1.0",
+        diff: "^9.0.0",
+        jszip: "^3.10.1",
+        "lucide-react": "^0.563.0",
+        "radix-ui": "^1.6.2",
+        react: "^19.2.7",
+        "react-dom": "^19.2.7",
+        "react-markdown": "^10.1.0",
+        swr: "^2.4.2",
+        "tailwind-merge": "^3.6.0",
+        three: "0.185.1",
+        "tw-animate-css": "^1.4.0",
+        zod: "^4.4.3"
+      },
+      optionalDependencies: {
+        "@tonyclaw/agent-inspector-backend-darwin-arm64": "3.0.48",
+        "@tonyclaw/agent-inspector-backend-linux-x64-gnu": "3.0.48",
+        "@tonyclaw/agent-inspector-backend-win32-x64-msvc": "3.0.48",
+        "better-sqlite3": "^12.11.1",
+        rcedit: "4.0.1"
+      },
+      devDependencies: {
+        "@biomejs/biome": "^2.5.3",
+        "@eslint/js": "^10.0.1",
+        "@ladle/react": "^5.1.1",
+        "@radix-ui/colors": "^3.0.0",
+        "@tailwindcss/vite": "^4.3.2",
+        "@tanstack/router-plugin": "^1.168.20",
+        "@types/bun": "^1.3.14",
+        "@types/react": "^19.2.17",
+        "@types/react-dom": "^19.2.3",
+        "@types/three": "0.185.1",
+        "@typescript-eslint/eslint-plugin": "^8.64.0",
+        "@typescript-eslint/parser": "^8.64.0",
+        "@vitejs/plugin-react": "^5.2.0",
+        ajv: "8.20.0",
+        "ajv-formats": "3.0.1",
+        "colorjs.io": "^0.7.0",
+        esbuild: "^0.28.1",
+        eslint: "^9.39.5",
+        "eslint-plugin-eslint-comments": "^3.2.0",
+        "eslint-plugin-functional": "^9.0.5",
+        "eslint-plugin-unicorn": "^63.0.0",
+        husky: "^9.1.7",
+        knip: "^5.88.1",
+        nitro: "^3.0.260610-beta",
+        playwright: "^1.61.1",
+        tailwindcss: "^4.3.2",
+        typescript: "^5.9.3",
+        vite: "^7.3.6",
+        "vite-tsconfig-paths": "^6.1.1"
+      },
+      overrides: {
+        undici: ">=7.24.0 <8.0.0",
+        rollup: ">=4.59.0 <5.0.0",
+        postcss: ">=8.5.10 <9.0.0",
+        "js-yaml": ">=4.1.2 <5.0.0",
+        flatted: ">=3.4.0 <4.0.0",
+        "smol-toml": ">=1.6.1 <2.0.0",
+        koa: ">=2.16.4 <3.0.0",
+        "@babel/core": ">=7.29.1 <8.0.0",
+        "@typescript-eslint/typescript-estree": "^8.63.0",
+        vite: "^7.3.6"
+      }
+    };
+  }
+});
+
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/core/core.js
 // @__NO_SIDE_EFFECTS__
 function $constructor(name, initializer3, params) {
@@ -15374,229 +15574,542 @@ var init_networkHints = __esm({
   }
 });
 
-// src/lib/instanceContract.ts
-function isCanonicalPublicBasePath(value) {
-  const normalized = normalizePublicBasePath(value);
-  return normalized !== null && (normalized.length === 0 ? "/" : normalized) === value;
-}
-function isRetryableInstanceError(code) {
-  switch (code) {
-    case "launch_failed":
-    case "launch_unavailable":
-    case "lock_timeout":
-    case "port_exhausted":
-    case "registry_io":
-    case "restart_failed_degraded":
-    case "restart_failed_rolled_back":
-    case "shutdown_failed":
-      return true;
-    case "argument_invalid":
-    case "config_mismatch":
-    case "data_dir_conflict":
-    case "data_dir_invalid":
-    case "identity_mismatch":
-    case "instance_not_found":
-    case "lock_not_owned":
-    case "name_invalid":
-    case "port_conflict":
-    case "port_invalid":
-    case "record_invalid":
-    case "self_lifecycle_unsupported":
-      return false;
-  }
+// src/cli/rustBackendPackage.ts
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function packageFailure(code, message) {
+  return { kind: "error", error: { code, message } };
 }
-function instanceErrorOutput(error51) {
-  return { schemaVersion: INSTANCE_API_SCHEMA_VERSION, error: error51 };
+function targetFailure(message) {
+  return { kind: "error", error: { code: "unsupported_platform", message } };
 }
-var INSTANCE_API_SCHEMA_VERSION, InstanceStateSchema, InstanceStateReasonSchema, InstanceUrlsSchema, InstanceStatusOutputSchema, InstanceConnectionSurfacesSchema, InstanceConnectionOutputSchema, InstanceStartRequestSchema, InstanceEmptyRequestSchema, InstanceOperationSchema, InstanceOperationOutcomeSchema, InstanceOperationOutputSchema, InstanceListOutputSchema, InstancePublicErrorCodeSchema, InstancePublicErrorSchema, InstanceErrorOutputSchema;
-var init_instanceContract = __esm({
-  "src/lib/instanceContract.ts"() {
-    "use strict";
-    init_zod();
-    init_backendImplementation();
-    init_basePath();
-    INSTANCE_API_SCHEMA_VERSION = 1;
-    InstanceStateSchema = external_exports.enum(["running", "stopped", "conflict"]);
-    InstanceStateReasonSchema = external_exports.enum(["identity_mismatch", "port_conflict"]);
-    InstanceUrlsSchema = external_exports.object({
-      ui: external_exports.url(),
-      api: external_exports.url(),
-      health: external_exports.url(),
-      proxy: external_exports.url(),
-      openai: external_exports.url(),
-      mcp: external_exports.url()
-    }).strict();
-    InstanceStatusOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      name: external_exports.string().min(1),
-      instanceId: external_exports.string().min(1),
-      state: InstanceStateSchema,
-      stateReason: InstanceStateReasonSchema.nullable(),
-      checkedAt: external_exports.iso.datetime(),
-      createdAt: external_exports.iso.datetime(),
-      updatedAt: external_exports.iso.datetime(),
-      launch: external_exports.object({
-        launchId: external_exports.string().min(1),
-        startedAt: external_exports.iso.datetime()
-      }).strict(),
-      host: external_exports.string().min(1),
-      publicPort: external_exports.number().int().min(1).max(65535),
-      upstreamPort: external_exports.number().int().min(1).max(65535),
-      basePath: external_exports.string().refine(isCanonicalPublicBasePath, "Invalid public Base Path"),
-      captureMode: external_exports.enum(["simple", "full"]),
-      backend: BackendImplementationSchema.default("typescript"),
-      uiEnabled: external_exports.boolean(),
-      dataDir: external_exports.string().min(1),
-      supervisorPid: external_exports.number().int().positive().nullable(),
-      urls: InstanceUrlsSchema
-    }).strict();
-    InstanceConnectionSurfacesSchema = external_exports.object({
-      ui: external_exports.object({
-        enabled: external_exports.boolean(),
-        baseUrl: external_exports.url().nullable()
-      }).strict(),
-      control: external_exports.object({ baseUrl: external_exports.url() }).strict(),
-      agent: external_exports.object({ baseUrl: external_exports.url() }).strict()
-    }).strict();
-    InstanceConnectionOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      uiEnabled: external_exports.boolean(),
-      instance: InstanceStatusOutputSchema,
-      surfaces: InstanceConnectionSurfacesSchema,
-      /** @deprecated Use surfaces.control.baseUrl or surfaces.agent.baseUrl. */
-      baseUrl: external_exports.url(),
-      endpoints: InstanceUrlsSchema,
-      environment: external_exports.object({
-        ANTHROPIC_BASE_URL: external_exports.url(),
-        LLM_BASE_URL: external_exports.url(),
-        OPENAI_BASE_URL: external_exports.url(),
-        AGENT_INSPECTOR_MCP_URL: external_exports.url()
-      }).strict(),
-      mcp: external_exports.object({
-        serverName: external_exports.string().min(1),
-        transport: external_exports.literal("streamable-http"),
-        url: external_exports.url()
-      }).strict(),
-      codex: external_exports.object({
-        providerName: external_exports.string().min(1),
-        baseUrl: external_exports.url(),
-        wireApi: external_exports.literal("responses")
-      }).strict()
-    }).strict();
-    InstanceStartRequestSchema = external_exports.object({
-      port: external_exports.number().int().min(1).max(65535).optional(),
-      basePath: external_exports.string().min(1).max(2048).refine(
-        (value) => normalizePublicBasePath(value) !== null,
-        "Base Path must use URL-safe path segments without traversal, encoded separators, or markup characters"
-      ).optional(),
-      host: external_exports.string().min(1).max(253).refine(
-        (value) => value.trim() === value && !value.includes("://") && !value.includes("/") && !value.includes("\\") && !/\s/u.test(value),
-        "Host must be a hostname or IP address without protocol, path, or whitespace"
-      ).optional(),
-      captureMode: external_exports.enum(["simple", "full"]).optional(),
-      backend: BackendImplementationSchema.optional(),
-      uiEnabled: external_exports.boolean().optional(),
-      dataDir: external_exports.string().trim().min(1).max(32767).optional()
-    }).strict();
-    InstanceEmptyRequestSchema = external_exports.object({}).strict();
-    InstanceOperationSchema = external_exports.enum(["start", "stop", "restart"]);
-    InstanceOperationOutcomeSchema = external_exports.enum([
-      "created",
-      "started",
-      "already_running",
-      "stopped",
-      "already_stopped",
-      "restarted"
-    ]);
-    InstanceOperationOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      operation: InstanceOperationSchema,
-      outcome: InstanceOperationOutcomeSchema,
-      instance: InstanceStatusOutputSchema
-    }).strict();
-    InstanceListOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      instances: external_exports.array(InstanceStatusOutputSchema)
-    }).strict();
-    InstancePublicErrorCodeSchema = external_exports.enum([
-      "argument_invalid",
-      "config_mismatch",
-      "data_dir_conflict",
-      "data_dir_invalid",
-      "identity_mismatch",
-      "instance_not_found",
-      "launch_failed",
-      "launch_unavailable",
-      "lock_not_owned",
-      "lock_timeout",
-      "name_invalid",
-      "port_conflict",
-      "port_exhausted",
-      "port_invalid",
-      "record_invalid",
-      "registry_io",
-      "restart_failed_degraded",
-      "restart_failed_rolled_back",
-      "self_lifecycle_unsupported",
-      "shutdown_failed"
-    ]);
-    InstancePublicErrorSchema = external_exports.object({
-      code: InstancePublicErrorCodeSchema,
-      message: external_exports.string().min(1),
-      retryable: external_exports.boolean()
-    }).strict();
-    InstanceErrorOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      error: InstancePublicErrorSchema
-    }).strict();
+function detectLinuxLibc() {
+  if (process.platform !== "linux") return "not-applicable";
+  const report = process.report.getReport();
+  const header = objectProperty(report, "header");
+  const glibcVersion = objectProperty(header, "glibcVersionRuntime");
+  if (typeof glibcVersion === "string" && glibcVersion.length > 0) {
+    return "glibc";
   }
-});
-
-// src/proxy/privateDataPath.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import {
-  closeSync,
-  constants,
-  fchmodSync,
-  fstatSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readdirSync,
-  realpathSync
-} from "node:fs";
-import { join, parse as parse3, resolve as resolve2, sep } from "node:path";
-function windowsSystemPath(executable) {
-  const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
-  return `${systemRoot}\\System32\\${executable}`;
-}
-function runWindowsCommand(executable, args) {
-  const resolved = process.platform === "win32" && /^(whoami|icacls)\.exe$/iu.test(executable) ? windowsSystemPath(executable) : executable;
-  const result = spawnSync2(resolved, [...args], {
-    encoding: "utf8",
-    shell: false,
-    windowsHide: true
-  });
-  return { status: result.status, stdout: result.stdout };
-}
-function windowsUserSid(output) {
-  const match = /S-\d+(?:-\d+)+/.exec(output);
-  return match?.[0] ?? null;
-}
-function resolveWindowsUserSid(run) {
-  if (run === runWindowsCommand && cachedWindowsSid !== null) return cachedWindowsSid;
-  const identity = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
-  if (identity.status !== 0) return null;
-  const sid = windowsUserSid(identity.stdout);
-  if (run === runWindowsCommand) cachedWindowsSid = sid;
-  return sid;
+  const sharedObjects = objectProperty(report, "sharedObjects");
+  return Array.isArray(sharedObjects) && sharedObjects.some((path2) => typeof path2 === "string" && path2.toLowerCase().includes("musl")) ? "musl" : "unknown";
 }
-function windowsBroadGroupRemovalArgs() {
-  return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"];
+function objectProperty(value, name) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  return Object.getOwnPropertyDescriptor(value, name)?.value;
 }
-function applyWindowsAclWithSid(path2, kind, sid, run) {
-  const access = kind === "directory" ? `(OI)(CI)F` : "F";
-  const result = run("icacls.exe", [
+function resolveRustBackendTarget(platform = process.platform, arch = process.arch, libc = platform === "linux" ? detectLinuxLibc() : "not-applicable") {
+  switch (platform) {
+    case "win32":
+      return arch === "x64" ? {
+        kind: "success",
+        value: {
+          packageName: "@tonyclaw/agent-inspector-backend-win32-x64-msvc",
+          target: "x86_64-pc-windows-msvc",
+          binary: "bin/agent-inspector-backend.exe",
+          os: "win32",
+          cpu: "x64",
+          libc: null
+        }
+      } : targetFailure(`Rust backend packages do not support Windows ${arch}.`);
+    case "linux":
+      if (arch !== "x64")
+        return targetFailure(`Rust backend packages do not support Linux ${arch}.`);
+      if (libc !== "glibc") {
+        return targetFailure(
+          `The Linux Rust backend package requires glibc; detected ${libc}. No binary was started.`
+        );
+      }
+      return {
+        kind: "success",
+        value: {
+          packageName: "@tonyclaw/agent-inspector-backend-linux-x64-gnu",
+          target: "x86_64-unknown-linux-gnu",
+          binary: "bin/agent-inspector-backend",
+          os: "linux",
+          cpu: "x64",
+          libc: "glibc"
+        }
+      };
+    case "darwin":
+      return arch === "arm64" ? {
+        kind: "success",
+        value: {
+          packageName: "@tonyclaw/agent-inspector-backend-darwin-arm64",
+          target: "aarch64-apple-darwin",
+          binary: "bin/agent-inspector-backend",
+          os: "darwin",
+          cpu: "arm64",
+          libc: null
+        }
+      } : targetFailure(`Rust backend packages do not support macOS ${arch}.`);
+    default:
+      return targetFailure(`Rust backend packages do not support ${platform} ${arch}.`);
+  }
+}
+function readJson(path2) {
+  try {
+    const value = JSON.parse(readFileSync(path2, "utf8"));
+    return { kind: "success", value };
+  } catch {
+    return { kind: "error" };
+  }
+}
+function isConfinedPath(root, candidate) {
+  const child = relative(root, candidate);
+  return child.length > 0 && !child.startsWith("..") && !isAbsolute(child);
+}
+function identitiesMatch(left, right) {
+  return left.schemaVersion === right.schemaVersion && left.name === right.name && left.packageVersion === right.packageVersion && left.target === right.target && left.binary === right.binary && left.cliProtocol === right.cliProtocol && left.productionReady === right.productionReady && left.capabilities.nodeProtectedIngress === right.capabilities.nodeProtectedIngress && left.capabilities.basePath === right.capabilities.basePath && left.capabilities.namedInstances === right.capabilities.namedInstances && left.capabilities.gracefulShutdown === right.capabilities.gracefulShutdown;
+}
+function probeBinaryIdentity(binaryPath, identityFlag) {
+  const result = spawnSync(binaryPath, [identityFlag], {
+    encoding: "utf8",
+    windowsHide: true,
+    timeout: RUST_BACKEND_IDENTITY_TIMEOUT_MS,
+    maxBuffer: 64 * 1024
+  });
+  if (result.error !== void 0) {
+    return { kind: "error", message: result.error.message };
+  }
+  if (result.status !== 0) {
+    return {
+      kind: "error",
+      message: `identity command exited with status ${String(result.status)}`
+    };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(result.stdout);
+  } catch {
+    return { kind: "error", message: "identity command did not return JSON" };
+  }
+  const parsed = RustBackendIdentitySchema.safeParse(raw);
+  return parsed.success ? { kind: "success", value: parsed.data } : { kind: "error", message: "identity command returned an unsupported contract" };
+}
+function defaultResolvePackageJson(specifier) {
+  try {
+    return packageRequire.resolve(specifier);
+  } catch {
+    const suffix = "/package.json";
+    const packageName = specifier.endsWith(suffix) ? specifier.slice(0, -suffix.length) : "";
+    const directoryName = packageName.split("/").at(-1);
+    if (directoryName !== void 0 && directoryName.length > 0) {
+      const localPackageJson = resolve(
+        dirname(fileURLToPath(import.meta.url)),
+        "../packages",
+        directoryName,
+        "package.json"
+      );
+      if (existsSync(localPackageJson)) return localPackageJson;
+    }
+    return packageRequire.resolve(specifier);
+  }
+}
+function resolveRustBackendPackage(options) {
+  const target = resolveRustBackendTarget(options.platform, options.arch, options.libc);
+  if (target.kind === "error") return { kind: "error", error: target.error };
+  const packageJsonSpecifier = `${target.value.packageName}/package.json`;
+  let packageJsonPath;
+  try {
+    packageJsonPath = (options.resolvePackageJson ?? defaultResolvePackageJson)(
+      packageJsonSpecifier
+    );
+  } catch {
+    return packageFailure(
+      "package_missing",
+      `Rust backend ${target.value.target} was requested, but optional package ${target.value.packageName}@${options.rootVersion} is not installed. Reinstall without omitting optional dependencies; no TypeScript fallback was used.`
+    );
+  }
+  const rawPackage = readJson(packageJsonPath);
+  if (rawPackage.kind === "error") {
+    return packageFailure("package_invalid", `Cannot read ${packageJsonSpecifier}.`);
+  }
+  const packageJson = RustBackendPackageJsonSchema.safeParse(rawPackage.value);
+  if (!packageJson.success) {
+    return packageFailure(
+      "package_invalid",
+      `Package ${target.value.packageName} does not contain the Rust backend package contract.`
+    );
+  }
+  if (packageJson.data.name !== target.value.packageName || packageJson.data.version !== options.rootVersion) {
+    return packageFailure(
+      "version_mismatch",
+      `Rust backend package must exactly match @tonyclaw/agent-inspector@${options.rootVersion}; found ${packageJson.data.name}@${packageJson.data.version}.`
+    );
+  }
+  const metadata = packageJson.data.agentInspectorRustBackend;
+  const expectedLibc = target.value.libc === null ? void 0 : [target.value.libc];
+  if (metadata.target !== target.value.target || metadata.binary !== target.value.binary || metadata.manifest !== "binary-manifest.json" || packageJson.data.os.length !== 1 || packageJson.data.os[0] !== target.value.os || packageJson.data.cpu.length !== 1 || packageJson.data.cpu[0] !== target.value.cpu || JSON.stringify(packageJson.data.libc) !== JSON.stringify(expectedLibc)) {
+    return packageFailure(
+      "target_mismatch",
+      `Package ${target.value.packageName} does not match target ${target.value.target}.`
+    );
+  }
+  const packageRoot = dirname(packageJsonPath);
+  const manifestPath = resolve(packageRoot, metadata.manifest);
+  const binaryPath = resolve(packageRoot, metadata.binary);
+  if (!isConfinedPath(packageRoot, manifestPath) || !isConfinedPath(packageRoot, binaryPath)) {
+    return packageFailure(
+      "package_invalid",
+      `Package ${target.value.packageName} contains an unsafe artifact path.`
+    );
+  }
+  const rawManifest = readJson(manifestPath);
+  if (rawManifest.kind === "error") {
+    return packageFailure(
+      "manifest_invalid",
+      `Rust backend package ${target.value.packageName} is incomplete: binary-manifest.json is missing or invalid.`
+    );
+  }
+  const manifest = RustBackendBinaryManifestSchema.safeParse(rawManifest.value);
+  if (!manifest.success) {
+    return packageFailure(
+      "manifest_invalid",
+      `Rust backend package ${target.value.packageName} has an invalid target manifest.`
+    );
+  }
+  if (manifest.data.packageName !== target.value.packageName || manifest.data.packageVersion !== options.rootVersion || manifest.data.identity.packageVersion !== options.rootVersion) {
+    return packageFailure(
+      "version_mismatch",
+      `Rust backend manifest must exactly match @tonyclaw/agent-inspector@${options.rootVersion}.`
+    );
+  }
+  if (manifest.data.target !== target.value.target || manifest.data.binary !== target.value.binary || manifest.data.identity.target !== target.value.target || manifest.data.identity.binary !== target.value.binary) {
+    return packageFailure(
+      "target_mismatch",
+      `Rust backend manifest identity does not match target ${target.value.target}.`
+    );
+  }
+  let binaryBytes;
+  try {
+    const stats = statSync(binaryPath);
+    if (!stats.isFile()) {
+      return packageFailure("binary_invalid", `Rust backend artifact is not a regular file.`);
+    }
+    if (target.value.os !== "win32" && (stats.mode & 73) === 0) {
+      return packageFailure("binary_invalid", `Rust backend artifact is not executable.`);
+    }
+    binaryBytes = readFileSync(binaryPath);
+  } catch {
+    return packageFailure(
+      "binary_missing",
+      `Rust backend binary ${target.value.binary} is missing from ${target.value.packageName}.`
+    );
+  }
+  const sha256 = createHash("sha256").update(binaryBytes).digest("hex");
+  if (sha256 !== manifest.data.sha256) {
+    return packageFailure(
+      "hash_mismatch",
+      `Rust backend binary integrity check failed for ${target.value.packageName}; no binary was started.`
+    );
+  }
+  const probed = (options.identityProbe ?? probeBinaryIdentity)(binaryPath, metadata.identityFlag);
+  if (probed.kind === "error") {
+    return packageFailure(
+      "identity_failed",
+      `Rust backend binary did not pass the production identity gate: ${probed.message}. No TypeScript fallback was used.`
+    );
+  }
+  if (!identitiesMatch(probed.value, manifest.data.identity)) {
+    return packageFailure(
+      "identity_mismatch",
+      `Rust backend binary identity differs from its signed package manifest; no binary was started.`
+    );
+  }
+  return {
+    kind: "success",
+    value: {
+      command: binaryPath,
+      args: [],
+      packageName: target.value.packageName,
+      packageVersion: options.rootVersion,
+      target: target.value.target,
+      sha256
+    }
+  };
+}
+function resolvePreferredBackendImplementation(options) {
+  return resolveRustBackendPackage(options).kind === "success" ? "rust" : "typescript";
+}
+var RUST_BACKEND_IDENTITY_FLAG, RUST_BACKEND_CLI_PROTOCOL, RUST_BACKEND_IDENTITY_TIMEOUT_MS, RustBackendIdentitySchema, RustBackendPackageJsonSchema, RustBackendBinaryManifestSchema, packageRequire;
+var init_rustBackendPackage = __esm({
+  "src/cli/rustBackendPackage.ts"() {
+    "use strict";
+    init_zod();
+    RUST_BACKEND_IDENTITY_FLAG = "--agent-inspector-package-identity";
+    RUST_BACKEND_CLI_PROTOCOL = "agent-inspector-cli-backend-v1";
+    RUST_BACKEND_IDENTITY_TIMEOUT_MS = 2e3;
+    RustBackendIdentitySchema = external_exports.object({
+      schemaVersion: external_exports.literal(1),
+      name: external_exports.literal("agent-inspector-backend"),
+      packageVersion: external_exports.string().min(1),
+      target: external_exports.string().min(1),
+      binary: external_exports.string().min(1),
+      cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL),
+      productionReady: external_exports.literal(true),
+      capabilities: external_exports.object({
+        nodeProtectedIngress: external_exports.literal(true),
+        basePath: external_exports.literal(true),
+        namedInstances: external_exports.literal(true),
+        gracefulShutdown: external_exports.literal(true)
+      }).strict()
+    }).strict();
+    RustBackendPackageJsonSchema = external_exports.object({
+      name: external_exports.string().min(1),
+      version: external_exports.string().min(1),
+      os: external_exports.array(external_exports.string()).min(1),
+      cpu: external_exports.array(external_exports.string()).min(1),
+      libc: external_exports.array(external_exports.string()).optional(),
+      agentInspectorRustBackend: external_exports.object({
+        schemaVersion: external_exports.literal(1),
+        target: external_exports.string().min(1),
+        binary: external_exports.string().min(1),
+        manifest: external_exports.string().min(1),
+        identityFlag: external_exports.literal(RUST_BACKEND_IDENTITY_FLAG),
+        cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL)
+      }).strict()
+    }).passthrough();
+    RustBackendBinaryManifestSchema = external_exports.object({
+      schemaVersion: external_exports.literal(1),
+      packageName: external_exports.string().min(1),
+      packageVersion: external_exports.string().min(1),
+      target: external_exports.string().min(1),
+      binary: external_exports.string().min(1),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/u),
+      identity: RustBackendIdentitySchema
+    }).strict();
+    packageRequire = createRequire(import.meta.url);
+  }
+});
+
+// src/lib/instanceContract.ts
+function isCanonicalPublicBasePath(value) {
+  const normalized = normalizePublicBasePath(value);
+  return normalized !== null && (normalized.length === 0 ? "/" : normalized) === value;
+}
+function isRetryableInstanceError(code) {
+  switch (code) {
+    case "launch_failed":
+    case "launch_unavailable":
+    case "lock_timeout":
+    case "port_exhausted":
+    case "registry_io":
+    case "restart_failed_degraded":
+    case "restart_failed_rolled_back":
+    case "shutdown_failed":
+      return true;
+    case "argument_invalid":
+    case "config_mismatch":
+    case "data_dir_conflict":
+    case "data_dir_invalid":
+    case "identity_mismatch":
+    case "instance_not_found":
+    case "lock_not_owned":
+    case "name_invalid":
+    case "port_conflict":
+    case "port_invalid":
+    case "record_invalid":
+    case "self_lifecycle_unsupported":
+      return false;
+  }
+}
+function instanceErrorOutput(error51) {
+  return { schemaVersion: INSTANCE_API_SCHEMA_VERSION, error: error51 };
+}
+var INSTANCE_API_SCHEMA_VERSION, InstanceStateSchema, InstanceStateReasonSchema, InstanceUrlsSchema, InstanceStatusOutputSchema, InstanceConnectionSurfacesSchema, InstanceConnectionOutputSchema, InstanceStartRequestSchema, InstanceEmptyRequestSchema, InstanceOperationSchema, InstanceOperationOutcomeSchema, InstanceOperationOutputSchema, InstanceListOutputSchema, InstancePublicErrorCodeSchema, InstancePublicErrorSchema, InstanceErrorOutputSchema;
+var init_instanceContract = __esm({
+  "src/lib/instanceContract.ts"() {
+    "use strict";
+    init_zod();
+    init_backendImplementation();
+    init_basePath();
+    INSTANCE_API_SCHEMA_VERSION = 1;
+    InstanceStateSchema = external_exports.enum(["running", "stopped", "conflict"]);
+    InstanceStateReasonSchema = external_exports.enum(["identity_mismatch", "port_conflict"]);
+    InstanceUrlsSchema = external_exports.object({
+      ui: external_exports.url(),
+      api: external_exports.url(),
+      health: external_exports.url(),
+      proxy: external_exports.url(),
+      openai: external_exports.url(),
+      mcp: external_exports.url()
+    }).strict();
+    InstanceStatusOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      name: external_exports.string().min(1),
+      instanceId: external_exports.string().min(1),
+      state: InstanceStateSchema,
+      stateReason: InstanceStateReasonSchema.nullable(),
+      checkedAt: external_exports.iso.datetime(),
+      createdAt: external_exports.iso.datetime(),
+      updatedAt: external_exports.iso.datetime(),
+      launch: external_exports.object({
+        launchId: external_exports.string().min(1),
+        startedAt: external_exports.iso.datetime()
+      }).strict(),
+      host: external_exports.string().min(1),
+      publicPort: external_exports.number().int().min(1).max(65535),
+      upstreamPort: external_exports.number().int().min(1).max(65535),
+      basePath: external_exports.string().refine(isCanonicalPublicBasePath, "Invalid public Base Path"),
+      captureMode: external_exports.enum(["simple", "full"]),
+      backend: BackendImplementationSchema.default("typescript"),
+      uiEnabled: external_exports.boolean(),
+      dataDir: external_exports.string().min(1),
+      supervisorPid: external_exports.number().int().positive().nullable(),
+      urls: InstanceUrlsSchema
+    }).strict();
+    InstanceConnectionSurfacesSchema = external_exports.object({
+      ui: external_exports.object({
+        enabled: external_exports.boolean(),
+        baseUrl: external_exports.url().nullable()
+      }).strict(),
+      control: external_exports.object({ baseUrl: external_exports.url() }).strict(),
+      agent: external_exports.object({ baseUrl: external_exports.url() }).strict()
+    }).strict();
+    InstanceConnectionOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      uiEnabled: external_exports.boolean(),
+      instance: InstanceStatusOutputSchema,
+      surfaces: InstanceConnectionSurfacesSchema,
+      /** @deprecated Use surfaces.control.baseUrl or surfaces.agent.baseUrl. */
+      baseUrl: external_exports.url(),
+      endpoints: InstanceUrlsSchema,
+      environment: external_exports.object({
+        ANTHROPIC_BASE_URL: external_exports.url(),
+        LLM_BASE_URL: external_exports.url(),
+        OPENAI_BASE_URL: external_exports.url(),
+        AGENT_INSPECTOR_MCP_URL: external_exports.url()
+      }).strict(),
+      mcp: external_exports.object({
+        serverName: external_exports.string().min(1),
+        transport: external_exports.literal("streamable-http"),
+        url: external_exports.url()
+      }).strict(),
+      codex: external_exports.object({
+        providerName: external_exports.string().min(1),
+        baseUrl: external_exports.url(),
+        wireApi: external_exports.literal("responses")
+      }).strict()
+    }).strict();
+    InstanceStartRequestSchema = external_exports.object({
+      port: external_exports.number().int().min(1).max(65535).optional(),
+      basePath: external_exports.string().min(1).max(2048).refine(
+        (value) => normalizePublicBasePath(value) !== null,
+        "Base Path must use URL-safe path segments without traversal, encoded separators, or markup characters"
+      ).optional(),
+      host: external_exports.string().min(1).max(253).refine(
+        (value) => value.trim() === value && !value.includes("://") && !value.includes("/") && !value.includes("\\") && !/\s/u.test(value),
+        "Host must be a hostname or IP address without protocol, path, or whitespace"
+      ).optional(),
+      captureMode: external_exports.enum(["simple", "full"]).optional(),
+      backend: BackendImplementationSchema.optional(),
+      uiEnabled: external_exports.boolean().optional(),
+      dataDir: external_exports.string().trim().min(1).max(32767).optional()
+    }).strict();
+    InstanceEmptyRequestSchema = external_exports.object({}).strict();
+    InstanceOperationSchema = external_exports.enum(["start", "stop", "restart"]);
+    InstanceOperationOutcomeSchema = external_exports.enum([
+      "created",
+      "started",
+      "already_running",
+      "stopped",
+      "already_stopped",
+      "restarted"
+    ]);
+    InstanceOperationOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      operation: InstanceOperationSchema,
+      outcome: InstanceOperationOutcomeSchema,
+      instance: InstanceStatusOutputSchema
+    }).strict();
+    InstanceListOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      instances: external_exports.array(InstanceStatusOutputSchema)
+    }).strict();
+    InstancePublicErrorCodeSchema = external_exports.enum([
+      "argument_invalid",
+      "config_mismatch",
+      "data_dir_conflict",
+      "data_dir_invalid",
+      "identity_mismatch",
+      "instance_not_found",
+      "launch_failed",
+      "launch_unavailable",
+      "lock_not_owned",
+      "lock_timeout",
+      "name_invalid",
+      "port_conflict",
+      "port_exhausted",
+      "port_invalid",
+      "record_invalid",
+      "registry_io",
+      "restart_failed_degraded",
+      "restart_failed_rolled_back",
+      "self_lifecycle_unsupported",
+      "shutdown_failed"
+    ]);
+    InstancePublicErrorSchema = external_exports.object({
+      code: InstancePublicErrorCodeSchema,
+      message: external_exports.string().min(1),
+      retryable: external_exports.boolean()
+    }).strict();
+    InstanceErrorOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      error: InstancePublicErrorSchema
+    }).strict();
+  }
+});
+
+// src/proxy/privateDataPath.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import {
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  realpathSync
+} from "node:fs";
+import { join, parse as parse3, resolve as resolve2, sep } from "node:path";
+function windowsSystemPath(executable) {
+  const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
+  return `${systemRoot}\\System32\\${executable}`;
+}
+function runWindowsCommand(executable, args) {
+  const resolved = process.platform === "win32" && /^(whoami|icacls)\.exe$/iu.test(executable) ? windowsSystemPath(executable) : executable;
+  const result = spawnSync2(resolved, [...args], {
+    encoding: "utf8",
+    shell: false,
+    windowsHide: true
+  });
+  return { status: result.status, stdout: result.stdout };
+}
+function windowsUserSid(output) {
+  const match = /S-\d+(?:-\d+)+/.exec(output);
+  return match?.[0] ?? null;
+}
+function resolveWindowsUserSid(run) {
+  if (run === runWindowsCommand && cachedWindowsSid !== null) return cachedWindowsSid;
+  const identity = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+  if (identity.status !== 0) return null;
+  const sid = windowsUserSid(identity.stdout);
+  if (run === runWindowsCommand) cachedWindowsSid = sid;
+  return sid;
+}
+function windowsBroadGroupRemovalArgs() {
+  return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"];
+}
+function applyWindowsAclWithSid(path2, kind, sid, run) {
+  const access = kind === "directory" ? `(OI)(CI)F` : "F";
+  const result = run("icacls.exe", [
     path2,
     "/inheritance:r",
     "/grant:r",
@@ -16277,7 +16790,7 @@ Usage:
   agent-inspector instance restart <name> [options]
 
 Start/restart options:
-  --backend <typescript|rust> Persist the backend implementation (default: typescript)
+  --backend <typescript|rust> Persist the backend implementation (default: rust when native package is available)
   --port, -p <port>       Public ingress port (auto-allocated on first start)
   --base-path <path>      Public Base Path (default: /inspector; use / for root)
   --host, -H <host>       Bind host (default: 127.0.0.1)
@@ -17427,6 +17940,9 @@ function validateInstanceDataDirectory(rawPath, records, excludeName) {
   }
   return success2(assigned.value.path);
 }
+function resolveDefaultInstanceBackend(deps) {
+  return deps.resolveDefaultBackend?.() ?? resolvePreferredBackendImplementation({ rootVersion: package_default.version });
+}
 async function createNewRecord(root, action, deps) {
   const recordsResult = listInstanceRecords(root);
   if (recordsResult.kind === "error") return fromRegistry(recordsResult);
@@ -17450,7 +17966,7 @@ async function createNewRecord(root, action, deps) {
     upstreamPort: pairResult.value.upstreamPort,
     basePath: action.overrides.basePath ?? getConfiguredBasePath(process.env),
     captureMode: action.overrides.captureMode ?? DEFAULT_INSTANCE_CAPTURE_MODE,
-    backend: action.overrides.backend ?? "typescript",
+    backend: action.overrides.backend ?? resolveDefaultInstanceBackend(deps),
     uiEnabled: action.overrides.uiEnabled ?? true,
     dataDir: dataDirResult.value
   });
@@ -17827,6 +18343,7 @@ var DEFAULT_INSTANCE_HOST, DEFAULT_INSTANCE_CAPTURE_MODE, INSTANCE_READY_TIMEOUT
 var init_instance = __esm({
   "src/cli/instance.ts"() {
     "use strict";
+    init_package();
     init_basePath();
     init_instanceContract();
     init_managedInstance();
@@ -17836,6 +18353,7 @@ var init_instance = __esm({
     init_instanceControl();
     init_instanceRegistry();
     init_networkHints();
+    init_rustBackendPackage();
     DEFAULT_INSTANCE_HOST = "127.0.0.1";
     DEFAULT_INSTANCE_CAPTURE_MODE = "simple";
     INSTANCE_READY_TIMEOUT_MS = 15e3;
@@ -21101,777 +21619,280 @@ function parseAliasArgs(argv) {
       if (rawBasePath === void 0 || positional.length !== 2) {
         return { kind: "error", message: `alias: ${command} requires exactly one base path` };
       }
-      const basePath = normalizeAliasPath(rawBasePath);
-      if (basePath === null) {
-        return {
-          kind: "error",
-          message: `alias: ${command} base path must be an absolute URL path without a query or hash`
-        };
-      }
-      const action = { kind: command, basePath };
-      return { kind: "ok", options: { action, host, port, json: json2 } };
-    }
-    case void 0:
-      return { kind: "error", message: "alias: expected add <path>, list, or remove <path>" };
-    default:
-      return { kind: "error", message: `alias: unknown command ${command}` };
-  }
-}
-function aliasHelp() {
-  return `agent-inspector alias - mount additional base paths on a running runtime
-
-Usage:
-  agent-inspector alias add <path> [--host <host>] [--port <port>] [--json]
-  agent-inspector alias list [--host <host>] [--port <port>] [--json]
-  agent-inspector alias remove <path> [--host <host>] [--port <port>] [--json]
-
-Options:
-  --host <host>  Running instance host (default: localhost)
-  --port <port>  Running instance port (default: 9527)
-  --json         Emit machine-readable output
-  --help, -h     Show this help
-
-Aliases are runtime-scoped. This command never starts another Agent Inspector runtime.
-`;
-}
-function isObject4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function parseAliasSnapshot(value) {
-  if (!isObject4(value)) return null;
-  const canonicalBasePath = value["canonicalBasePath"];
-  const aliases = value["aliases"];
-  const runtimeScoped = value["runtimeScoped"];
-  if (typeof canonicalBasePath !== "string" || !Array.isArray(aliases) || !aliases.every((alias) => typeof alias === "string") || runtimeScoped !== true) {
-    return null;
-  }
-  return {
-    canonicalBasePath: normalizeBasePath(canonicalBasePath),
-    aliases: aliases.map((alias) => normalizeBasePath(alias)),
-    runtimeScoped: true
-  };
-}
-function readErrorDetail(value) {
-  if (!isObject4(value)) return null;
-  const error51 = value["error"];
-  if (typeof error51 === "string" && error51.trim() !== "") return error51;
-  const message = value["message"];
-  return typeof message === "string" && message.trim() !== "" ? message : null;
-}
-async function readJson2(response) {
-  try {
-    const value = await response.json();
-    return value;
-  } catch {
-    return null;
-  }
-}
-async function requestAliases(endpoint2, action, fetchImpl) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => {
-    controller.abort();
-  }, REQUEST_TIMEOUT_MS);
-  const method = action.kind === "list" ? "GET" : action.kind === "add" ? "POST" : "DELETE";
-  const basePath = action.kind === "list" ? null : action.basePath;
-  const init = {
-    method,
-    headers: action.kind === "list" ? { accept: "application/json" } : {
-      accept: "application/json",
-      "content-type": "application/json",
-      "x-agent-inspector-csrf": "1"
-    },
-    signal: controller.signal
-  };
-  if (basePath !== null) init.body = JSON.stringify({ basePath });
-  try {
-    const response = await fetchImpl(endpoint2, init);
-    const value = await readJson2(response);
-    if (!response.ok) {
-      return { kind: "http-error", status: response.status, detail: readErrorDetail(value) };
-    }
-    const snapshot = parseAliasSnapshot(value);
-    return snapshot === null ? { kind: "invalid-response" } : { kind: "success", snapshot };
-  } catch (error51) {
-    const timedOut = controller.signal.aborted || error51 instanceof Error && error51.name === "AbortError";
-    return { kind: "network-error", timedOut };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function displayBasePath2(basePath) {
-  const normalized = normalizeBasePath(basePath);
-  return normalized === "" ? "/" : normalized;
-}
-function fullUrl(origin, basePath) {
-  return `${origin}${normalizeBasePath(basePath)}`;
-}
-function buildOutput(origin, action, snapshot) {
-  return {
-    action: action.kind,
-    canonicalBasePath: displayBasePath2(snapshot.canonicalBasePath),
-    canonicalUrl: fullUrl(origin, snapshot.canonicalBasePath),
-    aliases: snapshot.aliases.map(displayBasePath2),
-    aliasUrls: snapshot.aliases.map((alias) => fullUrl(origin, alias)),
-    runtimeScoped: true
-  };
-}
-function formatHumanOutput(output) {
-  const heading = output.action === "add" ? "Base-path alias added." : output.action === "remove" ? "Base-path alias removed." : "Base-path aliases for the running runtime:";
-  const aliasPaths = output.aliases.length === 0 ? "(none)" : output.aliases.join(", ");
-  const aliasUrls = output.aliasUrls.length === 0 ? "  (none)" : output.aliasUrls.map((url2) => `  - ${url2}`).join("\n");
-  return `${heading}
-Canonical base path: ${output.canonicalBasePath}
-Canonical URL: ${output.canonicalUrl}
-Alias base paths: ${aliasPaths}
-Alias URLs:
-${aliasUrls}
-Scope: current runtime only; no second runtime was started and aliases are not persisted.
-`;
-}
-function writeError2(io, json2, code, message) {
-  if (json2) {
-    io.stderr(`${JSON.stringify({ error: code, message, runtimeStarted: false })}
-`);
-    return;
-  }
-  io.stderr(`agent-inspector alias: ${message}
-`);
-}
-function oldRuntimeMessage(origin) {
-  return `the runtime at ${origin} does not support base-path aliases. Upgrade Agent Inspector and restart that instance, then retry; this command did not start a runtime.`;
-}
-async function handleHttpError(options, endpoint2, origin, result, fetchImpl, io) {
-  if (result.status === 404 && options.action.kind === "remove") {
-    const probe = await requestAliases(endpoint2, { kind: "list" }, fetchImpl);
-    if (probe.kind === "success") {
-      writeError2(
-        io,
-        options.json,
-        "alias_not_found",
-        `base path ${displayBasePath2(options.action.basePath)} is not mounted. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
-      );
-      return 1;
-    }
-    if (probe.kind === "network-error") {
-      writeError2(
-        io,
-        options.json,
-        probe.timedOut ? "request_timeout" : "runtime_unreachable",
-        `${probe.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
-      );
-      return 1;
-    }
-    if (probe.kind === "http-error" && (probe.status === 404 || probe.status === 405)) {
-      writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
-      return 1;
-    }
-  }
-  if (result.status === 404 || result.status === 405) {
-    writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
-    return 1;
-  }
-  if (result.status === 409) {
-    writeError2(
-      io,
-      options.json,
-      "alias_conflict",
-      `${result.detail ?? "the base path is already mounted or conflicts with another mount"}. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
-    );
-    return 1;
-  }
-  const detail = result.detail === null ? "the runtime rejected the request" : result.detail;
-  writeError2(
-    io,
-    options.json,
-    "runtime_rejected_request",
-    `${detail} (HTTP ${result.status}). Check the running instance and retry; no runtime was started.`
-  );
-  return 1;
-}
-async function runAlias(argv, fetchImpl = fetch, io = processIo2) {
-  const parsed = parseAliasArgs(argv);
-  if (parsed.kind === "help") {
-    io.stdout(aliasHelp());
-    return 0;
-  }
-  if (parsed.kind === "error") {
-    io.stderr(`${parsed.message}
-
-${aliasHelp()}`);
-    return 2;
-  }
-  const { options } = parsed;
-  const origin = `http://${formatHostForUrl(options.host)}:${options.port}`;
-  const endpoint2 = `${origin}${ALIAS_CONTROL_PATH}`;
-  const result = await requestAliases(endpoint2, options.action, fetchImpl);
-  switch (result.kind) {
-    case "success": {
-      const output = buildOutput(origin, options.action, result.snapshot);
-      io.stdout(options.json ? `${JSON.stringify(output, null, 2)}
-` : formatHumanOutput(output));
-      return 0;
-    }
-    case "network-error":
-      writeError2(
-        io,
-        options.json,
-        result.timedOut ? "request_timeout" : "runtime_unreachable",
-        `${result.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
-      );
-      return 1;
-    case "invalid-response":
-      writeError2(
-        io,
-        options.json,
-        "invalid_runtime_response",
-        `the runtime at ${origin} returned an invalid alias response. Upgrade and restart that instance, then retry; no runtime was started.`
-      );
-      return 1;
-    case "http-error":
-      return handleHttpError(options, endpoint2, origin, result, fetchImpl, io);
-  }
-}
-var DEFAULT_ALIAS_HOST, DEFAULT_ALIAS_PORT, ALIAS_CONTROL_PATH, REQUEST_TIMEOUT_MS, processIo2;
-var init_alias = __esm({
-  "src/cli/alias.ts"() {
-    "use strict";
-    init_basePath();
-    DEFAULT_ALIAS_HOST = "localhost";
-    DEFAULT_ALIAS_PORT = 9527;
-    ALIAS_CONTROL_PATH = "/.agent-inspector/base-path-aliases";
-    REQUEST_TIMEOUT_MS = 5e3;
-    processIo2 = {
-      stdout: (text) => {
-        process.stdout.write(text);
-      },
-      stderr: (text) => {
-        process.stderr.write(text);
-      }
-    };
-  }
-});
-
-// src/cli.ts
-import { Buffer as Buffer5 } from "node:buffer";
-import { spawn as spawn2 } from "node:child_process";
-import { createConnection as createConnection2 } from "node:net";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname3, join as join9, resolve as resolvePath2 } from "node:path";
-import { existsSync as existsSync8 } from "node:fs";
-
-// package.json
-var package_default = {
-  name: "@tonyclaw/agent-inspector",
-  version: "3.0.47",
-  type: "module",
-  description: "Agent observability and knowledge capture layer for AI coding tools.",
-  license: "MIT",
-  engines: {
-    node: ">=22.0.0"
-  },
-  author: "TonyClaw",
-  repository: {
-    type: "git",
-    url: "git+https://gitcode.com/TonyClaw/agent-inspector.git"
-  },
-  homepage: "https://gitcode.com/TonyClaw/agent-inspector#readme",
-  workspaces: [
-    "packages/*"
-  ],
-  bugs: {
-    url: "https://gitcode.com/TonyClaw/agent-inspector/issues"
-  },
-  publishConfig: {
-    access: "public",
-    registry: "https://registry.npmjs.org/"
-  },
-  keywords: [
-    "claude",
-    "anthropic",
-    "openai",
-    "proxy",
-    "api-inspector",
-    "agent-observability",
-    "agent-memory",
-    "debugging",
-    "llm",
-    "ai-coding-tools"
-  ],
-  bin: {
-    "agent-inspector": "bin/agent-inspector.js"
-  },
-  files: [
-    "bin",
-    "src",
-    "!src/**/*.test.ts",
-    "!src/**/*.stories.tsx",
-    "!src/**/__fixtures__",
-    "!src/ui/routeTree.gen.ts",
-    "!src/backend/routeTree.gen.ts",
-    "scripts/setup-windows-runtime.mjs",
-    "scripts/setup-agent-skills.mjs",
-    "scripts/generate-theme-scales.mjs",
-    "docs/instance-control.openapi.yaml",
-    "styles",
-    ".output",
-    "!.output/*.exe"
-  ],
-  scripts: {
-    dev: "node scripts/dev-decoupled.mjs",
-    "dev:ui": "vite dev --config vite.ui.config.ts",
-    "dev:backend": "node scripts/dev-backend.mjs",
-    "test:smoke": "bun scripts/run-test-suite.mjs smoke",
-    "test:fast": "bun scripts/run-test-suite.mjs smoke",
-    "test:unit": "bun scripts/run-test-suite.mjs unit",
-    "test:integration": "bun scripts/run-test-suite.mjs integration",
-    "test:changed": "bun scripts/run-test-suite.mjs changed",
-    "test:all": "bun scripts/run-test-suite.mjs all",
-    "test:compatibility-tooling": "node --test scripts/compatibility/*.test.mjs",
-    start: "node .output/cli.js",
-    "start:backend": "node .output/cli.js --backend-only --no-open",
-    "preview:ui": "vite preview --config vite.ui.config.ts",
-    "clean:output": "node scripts/clean-output.mjs",
-    build: "bun clean:output && bun build:backend && bun build:ui && bun smoke:ui-preview && bun build:workers && bun build:cli && bun build:mcp && bun check:bundle && bun check:boundaries",
-    "build:backend": "vite build --config vite.backend.config.ts",
-    "build:ui": "vite build --config vite.ui.config.ts",
-    "build:workers": "npx esbuild src/proxy/logFinalizer.worker.ts src/proxy/sessionWorkerEntry.ts --bundle --platform=node --target=node22 --format=esm --outdir=.output/workers --external:better-sqlite3",
-    "smoke:workers": "node scripts/smoke-production-workers.mjs",
-    "smoke:packed-workers": "node scripts/smoke-packed-workers.mjs",
-    "smoke:instances": "node scripts/smoke-windows-instances.mjs",
-    "smoke:coding-agent-instances": "node scripts/smoke-coding-agent-instances.mjs",
-    "smoke:ui-preview": "node scripts/smoke-decoupled-ui-preview.mjs",
-    "check:bundle": "node scripts/check-client-bundle.mjs",
-    "check:boundaries": "node scripts/check-runtime-boundaries.mjs",
-    "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",
-    "compatibility:compare": "node scripts/compatibility/cli.mjs compare",
-    "compatibility:drift": "node scripts/check-backend-compatibility.mjs",
-    "compatibility:fixtures": "bun scripts/validate-compatibility-fixtures.ts",
-    "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",
-    "compatibility:run": "node scripts/compatibility/cli.mjs run",
-    "compatibility:performance": "node scripts/compatibility/performance-cli.mjs",
-    "compatibility:performance:verify": "node scripts/compatibility/performance-cli.mjs verify",
-    "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",
-    "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
-    "rust:build-package": "node scripts/rust/build-platform.mjs",
-    "rust:stage-package": "node scripts/rust/stage-platform.mjs",
-    "rust:verify-package": "node scripts/rust/verify-platform.mjs",
-    "rust:pack-package": "node scripts/rust/pack-platform.mjs",
-    "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",
-    "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",
-    "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/releaseCore.test.ts",
-    "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",
-    "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",
-    "themes:generate": "node scripts/generate-theme-scales.mjs",
-    postinstall: "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",
-    prepublishOnly: "node scripts/rust/require-release-orchestrator.mjs",
-    typecheck: "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",
-    lint: "eslint . --cache --cache-location .cache/eslintcache",
-    format: "biome format --write .",
-    "format:check": "biome format .",
-    "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",
-    "extension:zip": "node scripts/pack-chrome-extension.mjs",
-    "extension:release": "node scripts/release-chrome-extension.mjs",
-    release: "node scripts/release.mjs",
-    knip: "knip",
-    check: "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd && bun rust:packages:check",
-    prepare: "husky",
-    ladle: "ladle serve",
-    "ladle:build": "ladle build"
-  },
-  dependencies: {
-    "@mariozechner/pi-agent-core": "^0.73.1",
-    "@mariozechner/pi-ai": "^0.73.1",
-    "@modelcontextprotocol/server": "^2.0.0-beta.4",
-    "@tailwindcss/typography": "^0.5.20",
-    "@tanstack/react-router": "^1.170.18",
-    "@tanstack/react-start": "^1.168.28",
-    "@tanstack/react-virtual": "^3.14.6",
-    "class-variance-authority": "^0.7.1",
-    clsx: "^2.1.1",
-    conf: "^15.1.0",
-    diff: "^9.0.0",
-    jszip: "^3.10.1",
-    "lucide-react": "^0.563.0",
-    "radix-ui": "^1.6.2",
-    react: "^19.2.7",
-    "react-dom": "^19.2.7",
-    "react-markdown": "^10.1.0",
-    swr: "^2.4.2",
-    "tailwind-merge": "^3.6.0",
-    three: "0.185.1",
-    "tw-animate-css": "^1.4.0",
-    zod: "^4.4.3"
-  },
-  optionalDependencies: {
-    "@tonyclaw/agent-inspector-backend-darwin-arm64": "3.0.47",
-    "@tonyclaw/agent-inspector-backend-linux-x64-gnu": "3.0.47",
-    "@tonyclaw/agent-inspector-backend-win32-x64-msvc": "3.0.47",
-    "better-sqlite3": "^12.11.1",
-    rcedit: "4.0.1"
-  },
-  devDependencies: {
-    "@biomejs/biome": "^2.5.3",
-    "@eslint/js": "^10.0.1",
-    "@ladle/react": "^5.1.1",
-    "@radix-ui/colors": "^3.0.0",
-    "@tailwindcss/vite": "^4.3.2",
-    "@tanstack/router-plugin": "^1.168.20",
-    "@types/bun": "^1.3.14",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@types/three": "0.185.1",
-    "@typescript-eslint/eslint-plugin": "^8.64.0",
-    "@typescript-eslint/parser": "^8.64.0",
-    "@vitejs/plugin-react": "^5.2.0",
-    ajv: "8.20.0",
-    "ajv-formats": "3.0.1",
-    "colorjs.io": "^0.7.0",
-    esbuild: "^0.28.1",
-    eslint: "^9.39.5",
-    "eslint-plugin-eslint-comments": "^3.2.0",
-    "eslint-plugin-functional": "^9.0.5",
-    "eslint-plugin-unicorn": "^63.0.0",
-    husky: "^9.1.7",
-    knip: "^5.88.1",
-    nitro: "^3.0.260610-beta",
-    playwright: "^1.61.1",
-    tailwindcss: "^4.3.2",
-    typescript: "^5.9.3",
-    vite: "^7.3.6",
-    "vite-tsconfig-paths": "^6.1.1"
-  },
-  overrides: {
-    undici: ">=7.24.0 <8.0.0",
-    rollup: ">=4.59.0 <5.0.0",
-    postcss: ">=8.5.10 <9.0.0",
-    "js-yaml": ">=4.1.2 <5.0.0",
-    flatted: ">=3.4.0 <4.0.0",
-    "smol-toml": ">=1.6.1 <2.0.0",
-    koa: ">=2.16.4 <3.0.0",
-    "@babel/core": ">=7.29.1 <8.0.0",
-    "@typescript-eslint/typescript-estree": "^8.63.0",
-    vite: "^7.3.6"
+      const basePath = normalizeAliasPath(rawBasePath);
+      if (basePath === null) {
+        return {
+          kind: "error",
+          message: `alias: ${command} base path must be an absolute URL path without a query or hash`
+        };
+      }
+      const action = { kind: command, basePath };
+      return { kind: "ok", options: { action, host, port, json: json2 } };
+    }
+    case void 0:
+      return { kind: "error", message: "alias: expected add <path>, list, or remove <path>" };
+    default:
+      return { kind: "error", message: `alias: unknown command ${command}` };
   }
-};
+}
+function aliasHelp() {
+  return `agent-inspector alias - mount additional base paths on a running runtime
 
-// src/cli.ts
-init_backendImplementation();
-init_basePath();
-init_managedInstance();
-init_networkHints();
+Usage:
+  agent-inspector alias add <path> [--host <host>] [--port <port>] [--json]
+  agent-inspector alias list [--host <host>] [--port <port>] [--json]
+  agent-inspector alias remove <path> [--host <host>] [--port <port>] [--json]
 
-// src/cli/startupOutput.ts
-function shouldSuppressServerOutputLine(line, context) {
-  if (!context.enableIdentityProxy) return false;
-  if (context.publicPort === context.upstreamPort) return false;
-  const lowerLine = line.toLowerCase();
-  return lowerLine.includes("listening on") && lowerLine.includes(`:${context.upstreamPort}`);
-}
+Options:
+  --host <host>  Running instance host (default: localhost)
+  --port <port>  Running instance port (default: 9527)
+  --json         Emit machine-readable output
+  --help, -h     Show this help
 
-// src/cli/rustBackendPackage.ts
-import { spawnSync } from "node:child_process";
-init_zod();
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-var RUST_BACKEND_IDENTITY_FLAG = "--agent-inspector-package-identity";
-var RUST_BACKEND_CLI_PROTOCOL = "agent-inspector-cli-backend-v1";
-var RUST_BACKEND_IDENTITY_TIMEOUT_MS = 2e3;
-var RustBackendIdentitySchema = external_exports.object({
-  schemaVersion: external_exports.literal(1),
-  name: external_exports.literal("agent-inspector-backend"),
-  packageVersion: external_exports.string().min(1),
-  target: external_exports.string().min(1),
-  binary: external_exports.string().min(1),
-  cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL),
-  productionReady: external_exports.literal(true),
-  capabilities: external_exports.object({
-    nodeProtectedIngress: external_exports.literal(true),
-    basePath: external_exports.literal(true),
-    namedInstances: external_exports.literal(true),
-    gracefulShutdown: external_exports.literal(true)
-  }).strict()
-}).strict();
-var RustBackendPackageJsonSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  version: external_exports.string().min(1),
-  os: external_exports.array(external_exports.string()).min(1),
-  cpu: external_exports.array(external_exports.string()).min(1),
-  libc: external_exports.array(external_exports.string()).optional(),
-  agentInspectorRustBackend: external_exports.object({
-    schemaVersion: external_exports.literal(1),
-    target: external_exports.string().min(1),
-    binary: external_exports.string().min(1),
-    manifest: external_exports.string().min(1),
-    identityFlag: external_exports.literal(RUST_BACKEND_IDENTITY_FLAG),
-    cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL)
-  }).strict()
-}).passthrough();
-var RustBackendBinaryManifestSchema = external_exports.object({
-  schemaVersion: external_exports.literal(1),
-  packageName: external_exports.string().min(1),
-  packageVersion: external_exports.string().min(1),
-  target: external_exports.string().min(1),
-  binary: external_exports.string().min(1),
-  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/u),
-  identity: RustBackendIdentitySchema
-}).strict();
-function packageFailure(code, message) {
-  return { kind: "error", error: { code, message } };
+Aliases are runtime-scoped. This command never starts another Agent Inspector runtime.
+`;
 }
-function targetFailure(message) {
-  return { kind: "error", error: { code: "unsupported_platform", message } };
+function isObject4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function detectLinuxLibc() {
-  if (process.platform !== "linux") return "not-applicable";
-  const report = process.report.getReport();
-  const header = objectProperty(report, "header");
-  const glibcVersion = objectProperty(header, "glibcVersionRuntime");
-  if (typeof glibcVersion === "string" && glibcVersion.length > 0) {
-    return "glibc";
+function parseAliasSnapshot(value) {
+  if (!isObject4(value)) return null;
+  const canonicalBasePath = value["canonicalBasePath"];
+  const aliases = value["aliases"];
+  const runtimeScoped = value["runtimeScoped"];
+  if (typeof canonicalBasePath !== "string" || !Array.isArray(aliases) || !aliases.every((alias) => typeof alias === "string") || runtimeScoped !== true) {
+    return null;
   }
-  const sharedObjects = objectProperty(report, "sharedObjects");
-  return Array.isArray(sharedObjects) && sharedObjects.some((path2) => typeof path2 === "string" && path2.toLowerCase().includes("musl")) ? "musl" : "unknown";
+  return {
+    canonicalBasePath: normalizeBasePath(canonicalBasePath),
+    aliases: aliases.map((alias) => normalizeBasePath(alias)),
+    runtimeScoped: true
+  };
 }
-function objectProperty(value, name) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-  return Object.getOwnPropertyDescriptor(value, name)?.value;
+function readErrorDetail(value) {
+  if (!isObject4(value)) return null;
+  const error51 = value["error"];
+  if (typeof error51 === "string" && error51.trim() !== "") return error51;
+  const message = value["message"];
+  return typeof message === "string" && message.trim() !== "" ? message : null;
 }
-function resolveRustBackendTarget(platform = process.platform, arch = process.arch, libc = platform === "linux" ? detectLinuxLibc() : "not-applicable") {
-  switch (platform) {
-    case "win32":
-      return arch === "x64" ? {
-        kind: "success",
-        value: {
-          packageName: "@tonyclaw/agent-inspector-backend-win32-x64-msvc",
-          target: "x86_64-pc-windows-msvc",
-          binary: "bin/agent-inspector-backend.exe",
-          os: "win32",
-          cpu: "x64",
-          libc: null
-        }
-      } : targetFailure(`Rust backend packages do not support Windows ${arch}.`);
-    case "linux":
-      if (arch !== "x64")
-        return targetFailure(`Rust backend packages do not support Linux ${arch}.`);
-      if (libc !== "glibc") {
-        return targetFailure(
-          `The Linux Rust backend package requires glibc; detected ${libc}. No binary was started.`
-        );
-      }
-      return {
-        kind: "success",
-        value: {
-          packageName: "@tonyclaw/agent-inspector-backend-linux-x64-gnu",
-          target: "x86_64-unknown-linux-gnu",
-          binary: "bin/agent-inspector-backend",
-          os: "linux",
-          cpu: "x64",
-          libc: "glibc"
-        }
-      };
-    case "darwin":
-      return arch === "arm64" ? {
-        kind: "success",
-        value: {
-          packageName: "@tonyclaw/agent-inspector-backend-darwin-arm64",
-          target: "aarch64-apple-darwin",
-          binary: "bin/agent-inspector-backend",
-          os: "darwin",
-          cpu: "arm64",
-          libc: null
-        }
-      } : targetFailure(`Rust backend packages do not support macOS ${arch}.`);
-    default:
-      return targetFailure(`Rust backend packages do not support ${platform} ${arch}.`);
+async function readJson2(response) {
+  try {
+    const value = await response.json();
+    return value;
+  } catch {
+    return null;
   }
 }
-function readJson(path2) {
+async function requestAliases(endpoint2, action, fetchImpl) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => {
+    controller.abort();
+  }, REQUEST_TIMEOUT_MS);
+  const method = action.kind === "list" ? "GET" : action.kind === "add" ? "POST" : "DELETE";
+  const basePath = action.kind === "list" ? null : action.basePath;
+  const init = {
+    method,
+    headers: action.kind === "list" ? { accept: "application/json" } : {
+      accept: "application/json",
+      "content-type": "application/json",
+      "x-agent-inspector-csrf": "1"
+    },
+    signal: controller.signal
+  };
+  if (basePath !== null) init.body = JSON.stringify({ basePath });
   try {
-    const value = JSON.parse(readFileSync(path2, "utf8"));
-    return { kind: "success", value };
-  } catch {
-    return { kind: "error" };
+    const response = await fetchImpl(endpoint2, init);
+    const value = await readJson2(response);
+    if (!response.ok) {
+      return { kind: "http-error", status: response.status, detail: readErrorDetail(value) };
+    }
+    const snapshot = parseAliasSnapshot(value);
+    return snapshot === null ? { kind: "invalid-response" } : { kind: "success", snapshot };
+  } catch (error51) {
+    const timedOut = controller.signal.aborted || error51 instanceof Error && error51.name === "AbortError";
+    return { kind: "network-error", timedOut };
+  } finally {
+    clearTimeout(timeout);
   }
 }
-function isConfinedPath(root, candidate) {
-  const child = relative(root, candidate);
-  return child.length > 0 && !child.startsWith("..") && !isAbsolute(child);
+function displayBasePath2(basePath) {
+  const normalized = normalizeBasePath(basePath);
+  return normalized === "" ? "/" : normalized;
 }
-function identitiesMatch(left, right) {
-  return left.schemaVersion === right.schemaVersion && left.name === right.name && left.packageVersion === right.packageVersion && left.target === right.target && left.binary === right.binary && left.cliProtocol === right.cliProtocol && left.productionReady === right.productionReady && left.capabilities.nodeProtectedIngress === right.capabilities.nodeProtectedIngress && left.capabilities.basePath === right.capabilities.basePath && left.capabilities.namedInstances === right.capabilities.namedInstances && left.capabilities.gracefulShutdown === right.capabilities.gracefulShutdown;
+function fullUrl(origin, basePath) {
+  return `${origin}${normalizeBasePath(basePath)}`;
 }
-function probeBinaryIdentity(binaryPath, identityFlag) {
-  const result = spawnSync(binaryPath, [identityFlag], {
-    encoding: "utf8",
-    windowsHide: true,
-    timeout: RUST_BACKEND_IDENTITY_TIMEOUT_MS,
-    maxBuffer: 64 * 1024
-  });
-  if (result.error !== void 0) {
-    return { kind: "error", message: result.error.message };
-  }
-  if (result.status !== 0) {
-    return {
-      kind: "error",
-      message: `identity command exited with status ${String(result.status)}`
-    };
-  }
-  let raw;
-  try {
-    raw = JSON.parse(result.stdout);
-  } catch {
-    return { kind: "error", message: "identity command did not return JSON" };
+function buildOutput(origin, action, snapshot) {
+  return {
+    action: action.kind,
+    canonicalBasePath: displayBasePath2(snapshot.canonicalBasePath),
+    canonicalUrl: fullUrl(origin, snapshot.canonicalBasePath),
+    aliases: snapshot.aliases.map(displayBasePath2),
+    aliasUrls: snapshot.aliases.map((alias) => fullUrl(origin, alias)),
+    runtimeScoped: true
+  };
+}
+function formatHumanOutput(output) {
+  const heading = output.action === "add" ? "Base-path alias added." : output.action === "remove" ? "Base-path alias removed." : "Base-path aliases for the running runtime:";
+  const aliasPaths = output.aliases.length === 0 ? "(none)" : output.aliases.join(", ");
+  const aliasUrls = output.aliasUrls.length === 0 ? "  (none)" : output.aliasUrls.map((url2) => `  - ${url2}`).join("\n");
+  return `${heading}
+Canonical base path: ${output.canonicalBasePath}
+Canonical URL: ${output.canonicalUrl}
+Alias base paths: ${aliasPaths}
+Alias URLs:
+${aliasUrls}
+Scope: current runtime only; no second runtime was started and aliases are not persisted.
+`;
+}
+function writeError2(io, json2, code, message) {
+  if (json2) {
+    io.stderr(`${JSON.stringify({ error: code, message, runtimeStarted: false })}
+`);
+    return;
   }
-  const parsed = RustBackendIdentitySchema.safeParse(raw);
-  return parsed.success ? { kind: "success", value: parsed.data } : { kind: "error", message: "identity command returned an unsupported contract" };
+  io.stderr(`agent-inspector alias: ${message}
+`);
 }
-var packageRequire = createRequire(import.meta.url);
-function defaultResolvePackageJson(specifier) {
-  try {
-    return packageRequire.resolve(specifier);
-  } catch {
-    const suffix = "/package.json";
-    const packageName = specifier.endsWith(suffix) ? specifier.slice(0, -suffix.length) : "";
-    const directoryName = packageName.split("/").at(-1);
-    if (directoryName !== void 0 && directoryName.length > 0) {
-      const localPackageJson = resolve(
-        dirname(fileURLToPath(import.meta.url)),
-        "../packages",
-        directoryName,
-        "package.json"
+function oldRuntimeMessage(origin) {
+  return `the runtime at ${origin} does not support base-path aliases. Upgrade Agent Inspector and restart that instance, then retry; this command did not start a runtime.`;
+}
+async function handleHttpError(options, endpoint2, origin, result, fetchImpl, io) {
+  if (result.status === 404 && options.action.kind === "remove") {
+    const probe = await requestAliases(endpoint2, { kind: "list" }, fetchImpl);
+    if (probe.kind === "success") {
+      writeError2(
+        io,
+        options.json,
+        "alias_not_found",
+        `base path ${displayBasePath2(options.action.basePath)} is not mounted. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
       );
-      if (existsSync(localPackageJson)) return localPackageJson;
+      return 1;
+    }
+    if (probe.kind === "network-error") {
+      writeError2(
+        io,
+        options.json,
+        probe.timedOut ? "request_timeout" : "runtime_unreachable",
+        `${probe.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
+      );
+      return 1;
+    }
+    if (probe.kind === "http-error" && (probe.status === 404 || probe.status === 405)) {
+      writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
+      return 1;
     }
-    return packageRequire.resolve(specifier);
-  }
-}
-function resolveRustBackendPackage(options) {
-  const target = resolveRustBackendTarget(options.platform, options.arch, options.libc);
-  if (target.kind === "error") return { kind: "error", error: target.error };
-  const packageJsonSpecifier = `${target.value.packageName}/package.json`;
-  let packageJsonPath;
-  try {
-    packageJsonPath = (options.resolvePackageJson ?? defaultResolvePackageJson)(
-      packageJsonSpecifier
-    );
-  } catch {
-    return packageFailure(
-      "package_missing",
-      `Rust backend ${target.value.target} was requested, but optional package ${target.value.packageName}@${options.rootVersion} is not installed. Reinstall without omitting optional dependencies; no TypeScript fallback was used.`
-    );
-  }
-  const rawPackage = readJson(packageJsonPath);
-  if (rawPackage.kind === "error") {
-    return packageFailure("package_invalid", `Cannot read ${packageJsonSpecifier}.`);
-  }
-  const packageJson = RustBackendPackageJsonSchema.safeParse(rawPackage.value);
-  if (!packageJson.success) {
-    return packageFailure(
-      "package_invalid",
-      `Package ${target.value.packageName} does not contain the Rust backend package contract.`
-    );
-  }
-  if (packageJson.data.name !== target.value.packageName || packageJson.data.version !== options.rootVersion) {
-    return packageFailure(
-      "version_mismatch",
-      `Rust backend package must exactly match @tonyclaw/agent-inspector@${options.rootVersion}; found ${packageJson.data.name}@${packageJson.data.version}.`
-    );
-  }
-  const metadata = packageJson.data.agentInspectorRustBackend;
-  const expectedLibc = target.value.libc === null ? void 0 : [target.value.libc];
-  if (metadata.target !== target.value.target || metadata.binary !== target.value.binary || metadata.manifest !== "binary-manifest.json" || packageJson.data.os.length !== 1 || packageJson.data.os[0] !== target.value.os || packageJson.data.cpu.length !== 1 || packageJson.data.cpu[0] !== target.value.cpu || JSON.stringify(packageJson.data.libc) !== JSON.stringify(expectedLibc)) {
-    return packageFailure(
-      "target_mismatch",
-      `Package ${target.value.packageName} does not match target ${target.value.target}.`
-    );
-  }
-  const packageRoot = dirname(packageJsonPath);
-  const manifestPath = resolve(packageRoot, metadata.manifest);
-  const binaryPath = resolve(packageRoot, metadata.binary);
-  if (!isConfinedPath(packageRoot, manifestPath) || !isConfinedPath(packageRoot, binaryPath)) {
-    return packageFailure(
-      "package_invalid",
-      `Package ${target.value.packageName} contains an unsafe artifact path.`
-    );
   }
-  const rawManifest = readJson(manifestPath);
-  if (rawManifest.kind === "error") {
-    return packageFailure(
-      "manifest_invalid",
-      `Rust backend package ${target.value.packageName} is incomplete: binary-manifest.json is missing or invalid.`
-    );
+  if (result.status === 404 || result.status === 405) {
+    writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
+    return 1;
   }
-  const manifest = RustBackendBinaryManifestSchema.safeParse(rawManifest.value);
-  if (!manifest.success) {
-    return packageFailure(
-      "manifest_invalid",
-      `Rust backend package ${target.value.packageName} has an invalid target manifest.`
+  if (result.status === 409) {
+    writeError2(
+      io,
+      options.json,
+      "alias_conflict",
+      `${result.detail ?? "the base path is already mounted or conflicts with another mount"}. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
     );
+    return 1;
   }
-  if (manifest.data.packageName !== target.value.packageName || manifest.data.packageVersion !== options.rootVersion || manifest.data.identity.packageVersion !== options.rootVersion) {
-    return packageFailure(
-      "version_mismatch",
-      `Rust backend manifest must exactly match @tonyclaw/agent-inspector@${options.rootVersion}.`
-    );
+  const detail = result.detail === null ? "the runtime rejected the request" : result.detail;
+  writeError2(
+    io,
+    options.json,
+    "runtime_rejected_request",
+    `${detail} (HTTP ${result.status}). Check the running instance and retry; no runtime was started.`
+  );
+  return 1;
+}
+async function runAlias(argv, fetchImpl = fetch, io = processIo2) {
+  const parsed = parseAliasArgs(argv);
+  if (parsed.kind === "help") {
+    io.stdout(aliasHelp());
+    return 0;
   }
-  if (manifest.data.target !== target.value.target || manifest.data.binary !== target.value.binary || manifest.data.identity.target !== target.value.target || manifest.data.identity.binary !== target.value.binary) {
-    return packageFailure(
-      "target_mismatch",
-      `Rust backend manifest identity does not match target ${target.value.target}.`
-    );
+  if (parsed.kind === "error") {
+    io.stderr(`${parsed.message}
+
+${aliasHelp()}`);
+    return 2;
   }
-  let binaryBytes;
-  try {
-    const stats = statSync(binaryPath);
-    if (!stats.isFile()) {
-      return packageFailure("binary_invalid", `Rust backend artifact is not a regular file.`);
-    }
-    if (target.value.os !== "win32" && (stats.mode & 73) === 0) {
-      return packageFailure("binary_invalid", `Rust backend artifact is not executable.`);
+  const { options } = parsed;
+  const origin = `http://${formatHostForUrl(options.host)}:${options.port}`;
+  const endpoint2 = `${origin}${ALIAS_CONTROL_PATH}`;
+  const result = await requestAliases(endpoint2, options.action, fetchImpl);
+  switch (result.kind) {
+    case "success": {
+      const output = buildOutput(origin, options.action, result.snapshot);
+      io.stdout(options.json ? `${JSON.stringify(output, null, 2)}
+` : formatHumanOutput(output));
+      return 0;
     }
-    binaryBytes = readFileSync(binaryPath);
-  } catch {
-    return packageFailure(
-      "binary_missing",
-      `Rust backend binary ${target.value.binary} is missing from ${target.value.packageName}.`
-    );
-  }
-  const sha256 = createHash("sha256").update(binaryBytes).digest("hex");
-  if (sha256 !== manifest.data.sha256) {
-    return packageFailure(
-      "hash_mismatch",
-      `Rust backend binary integrity check failed for ${target.value.packageName}; no binary was started.`
-    );
-  }
-  const probed = (options.identityProbe ?? probeBinaryIdentity)(binaryPath, metadata.identityFlag);
-  if (probed.kind === "error") {
-    return packageFailure(
-      "identity_failed",
-      `Rust backend binary did not pass the production identity gate: ${probed.message}. No TypeScript fallback was used.`
-    );
+    case "network-error":
+      writeError2(
+        io,
+        options.json,
+        result.timedOut ? "request_timeout" : "runtime_unreachable",
+        `${result.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
+      );
+      return 1;
+    case "invalid-response":
+      writeError2(
+        io,
+        options.json,
+        "invalid_runtime_response",
+        `the runtime at ${origin} returned an invalid alias response. Upgrade and restart that instance, then retry; no runtime was started.`
+      );
+      return 1;
+    case "http-error":
+      return handleHttpError(options, endpoint2, origin, result, fetchImpl, io);
   }
-  if (!identitiesMatch(probed.value, manifest.data.identity)) {
-    return packageFailure(
-      "identity_mismatch",
-      `Rust backend binary identity differs from its signed package manifest; no binary was started.`
-    );
+}
+var DEFAULT_ALIAS_HOST, DEFAULT_ALIAS_PORT, ALIAS_CONTROL_PATH, REQUEST_TIMEOUT_MS, processIo2;
+var init_alias = __esm({
+  "src/cli/alias.ts"() {
+    "use strict";
+    init_basePath();
+    DEFAULT_ALIAS_HOST = "localhost";
+    DEFAULT_ALIAS_PORT = 9527;
+    ALIAS_CONTROL_PATH = "/.agent-inspector/base-path-aliases";
+    REQUEST_TIMEOUT_MS = 5e3;
+    processIo2 = {
+      stdout: (text) => {
+        process.stdout.write(text);
+      },
+      stderr: (text) => {
+        process.stderr.write(text);
+      }
+    };
   }
-  return {
-    kind: "success",
-    value: {
-      command: binaryPath,
-      args: [],
-      packageName: target.value.packageName,
-      packageVersion: options.rootVersion,
-      target: target.value.target,
-      sha256
-    }
-  };
+});
+
+// src/cli.ts
+init_package();
+init_backendImplementation();
+init_basePath();
+init_managedInstance();
+init_networkHints();
+import { Buffer as Buffer5 } from "node:buffer";
+import { spawn as spawn2 } from "node:child_process";
+import { createConnection as createConnection2 } from "node:net";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { dirname as dirname3, join as join9, resolve as resolvePath2 } from "node:path";
+import { existsSync as existsSync8 } from "node:fs";
+
+// src/cli/startupOutput.ts
+function shouldSuppressServerOutputLine(line, context) {
+  if (!context.enableIdentityProxy) return false;
+  if (context.publicPort === context.upstreamPort) return false;
+  const lowerLine = line.toLowerCase();
+  return lowerLine.includes("listening on") && lowerLine.includes(`:${context.upstreamPort}`);
 }
 
+// src/cli.ts
+init_rustBackendPackage();
+
 // src/cli/instanceApi.ts
 init_instance();
 init_instanceContract();
@@ -24781,7 +24802,7 @@ Global options:
   -v, --version   Print the package version
 
 Start options:
-  --backend <typescript|rust> Select the backend implementation (default: typescript)
+  --backend <typescript|rust> Select the backend implementation (default: rust when native package is available)
   --backend-only, --headless  Start the API, proxy, and MCP runtime without serving the UI
   --with-ui                  Serve the independently built UI through the protected ingress
   --port, -p <port>          Public ingress port (default: 9527)
@@ -25144,7 +25165,8 @@ async function runStart(args) {
   const portDefault = envPort !== void 0 ? Number(envPort) : DEFAULT_PORT4;
   const envHost = process.env["NITRO_HOST"] ?? process.env["HOST"];
   const envMode = process.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? process.env["AGENT_INSPECTOR_MODE"];
-  const envBackend = parseBackendImplementation(process.env[AGENT_INSPECTOR_BACKEND_ENV]);
+  const rawEnvBackend = process.env[AGENT_INSPECTOR_BACKEND_ENV];
+  const envBackend = rawEnvBackend === void 0 ? void 0 : parseBackendImplementation(rawEnvBackend);
   if (envBackend === null) {
     console.error(
       `Invalid ${AGENT_INSPECTOR_BACKEND_ENV}. Use typescript or rust; no backend was started.`
@@ -25165,7 +25187,8 @@ async function runStart(args) {
   let enableIdentityProxy = true;
   let legacyAliasEnabled = false;
   let serveUi = process.env["AGENT_INSPECTOR_BACKEND_ONLY"] !== "1";
-  let backend = envBackend;
+  let backend = envBackend ?? "typescript";
+  let backendWasSpecified = envBackend !== void 0;
   if (envMode !== void 0 && envMode !== "") {
     const parsedMode = parseCaptureMode(envMode);
     if (parsedMode === null) {
@@ -25219,6 +25242,7 @@ async function runStart(args) {
         return;
       }
       backend = parsedBackend.data;
+      backendWasSpecified = true;
       continue;
     }
     switch (arg) {
@@ -25249,6 +25273,7 @@ async function runStart(args) {
           return;
         }
         backend = parsedBackend.data;
+        backendWasSpecified = true;
         i++;
         break;
       }
@@ -25338,6 +25363,9 @@ async function runStart(args) {
     process.exitCode = 1;
     return;
   }
+  if (!backendWasSpecified) {
+    backend = managedLaunch?.backend ?? resolvePreferredBackendImplementation({ rootVersion: package_default.version });
+  }
   if (managedLaunch !== null && managedLaunch.backend !== backend) {
     console.error(
       `Managed instance backend mismatch: launch identity requires ${managedLaunch.backend}, but ${backend} was selected.`