@tonyclaw/agent-inspector 3.0.47 → 3.1.0

package/.output/cli.js

@@ -14,6 +14,206 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "@tonyclaw/agent-inspector",
+      version: "3.1.0",
+      type: "module",
+      description: "Agent observability and knowledge capture layer for AI coding tools.",
+      license: "MIT",
+      engines: {
+        node: ">=22.0.0"
+      },
+      author: "TonyClaw",
+      repository: {
+        type: "git",
+        url: "git+https://gitcode.com/TonyClaw/agent-inspector.git"
+      },
+      homepage: "https://gitcode.com/TonyClaw/agent-inspector#readme",
+      workspaces: [
+        "packages/*"
+      ],
+      bugs: {
+        url: "https://gitcode.com/TonyClaw/agent-inspector/issues"
+      },
+      publishConfig: {
+        access: "public",
+        registry: "https://registry.npmjs.org/"
+      },
+      keywords: [
+        "claude",
+        "anthropic",
+        "openai",
+        "proxy",
+        "api-inspector",
+        "agent-observability",
+        "agent-memory",
+        "debugging",
+        "llm",
+        "ai-coding-tools"
+      ],
+      bin: {
+        "agent-inspector": "bin/agent-inspector.js"
+      },
+      files: [
+        "bin",
+        "src",
+        "!src/**/*.test.ts",
+        "!src/**/*.stories.tsx",
+        "!src/**/__fixtures__",
+        "!src/ui/routeTree.gen.ts",
+        "!src/backend/routeTree.gen.ts",
+        "scripts/setup-windows-runtime.mjs",
+        "scripts/setup-agent-skills.mjs",
+        "scripts/generate-theme-scales.mjs",
+        "docs/instance-control.openapi.yaml",
+        "styles",
+        ".output",
+        "!.output/*.exe"
+      ],
+      scripts: {
+        dev: "node scripts/dev-decoupled.mjs",
+        "dev:ui": "vite dev --config vite.ui.config.ts",
+        "dev:backend": "node scripts/dev-backend.mjs",
+        "test:smoke": "bun scripts/run-test-suite.mjs smoke",
+        "test:fast": "bun scripts/run-test-suite.mjs smoke",
+        "test:unit": "bun scripts/run-test-suite.mjs unit",
+        "test:integration": "bun scripts/run-test-suite.mjs integration",
+        "test:changed": "bun scripts/run-test-suite.mjs changed",
+        "test:all": "bun scripts/run-test-suite.mjs all",
+        "test:compatibility-tooling": "node --test scripts/compatibility/*.test.mjs",
+        start: "node .output/cli.js",
+        "start:backend": "node .output/cli.js --backend-only --no-open",
+        "preview:ui": "vite preview --config vite.ui.config.ts",
+        "clean:output": "node scripts/clean-output.mjs",
+        build: "bun clean:output && bun build:backend && bun build:ui && bun smoke:ui-preview && bun build:workers && bun build:cli && bun build:mcp && bun check:bundle && bun check:boundaries",
+        "build:backend": "vite build --config vite.backend.config.ts",
+        "build:ui": "vite build --config vite.ui.config.ts",
+        "build:workers": "npx esbuild src/proxy/logFinalizer.worker.ts src/proxy/sessionWorkerEntry.ts --bundle --platform=node --target=node22 --format=esm --outdir=.output/workers --external:better-sqlite3",
+        "smoke:workers": "node scripts/smoke-production-workers.mjs",
+        "smoke:packed-workers": "node scripts/smoke-packed-workers.mjs",
+        "smoke:instances": "node scripts/smoke-windows-instances.mjs",
+        "smoke:coding-agent-instances": "node scripts/smoke-coding-agent-instances.mjs",
+        "smoke:ui-preview": "node scripts/smoke-decoupled-ui-preview.mjs",
+        "check:bundle": "node scripts/check-client-bundle.mjs",
+        "check:boundaries": "node scripts/check-runtime-boundaries.mjs",
+        "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",
+        "compatibility:compare": "node scripts/compatibility/cli.mjs compare",
+        "compatibility:drift": "node scripts/check-backend-compatibility.mjs",
+        "compatibility:fixtures": "bun scripts/validate-compatibility-fixtures.ts",
+        "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",
+        "compatibility:run": "node scripts/compatibility/cli.mjs run",
+        "compatibility:performance": "node scripts/compatibility/performance-cli.mjs",
+        "compatibility:performance:verify": "node scripts/compatibility/performance-cli.mjs verify",
+        "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",
+        "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
+        "rust:build-package": "node scripts/rust/build-platform.mjs",
+        "rust:stage-package": "node scripts/rust/stage-platform.mjs",
+        "rust:verify-package": "node scripts/rust/verify-platform.mjs",
+        "rust:pack-package": "node scripts/rust/pack-platform.mjs",
+        "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",
+        "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",
+        "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/releaseCore.test.ts",
+        "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",
+        "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",
+        "themes:generate": "node scripts/generate-theme-scales.mjs",
+        postinstall: "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",
+        prepublishOnly: "node scripts/rust/require-release-orchestrator.mjs",
+        typecheck: "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",
+        lint: "eslint . --cache --cache-location .cache/eslintcache",
+        format: "biome format --write .",
+        "format:check": "biome format .",
+        "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",
+        "extension:zip": "node scripts/pack-chrome-extension.mjs",
+        "extension:release": "node scripts/release-chrome-extension.mjs",
+        release: "node scripts/release.mjs",
+        knip: "knip",
+        check: "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd && bun rust:packages:check",
+        prepare: "husky",
+        ladle: "ladle serve",
+        "ladle:build": "ladle build"
+      },
+      dependencies: {
+        "@mariozechner/pi-agent-core": "^0.73.1",
+        "@mariozechner/pi-ai": "^0.73.1",
+        "@modelcontextprotocol/server": "^2.0.0-beta.4",
+        "@tailwindcss/typography": "^0.5.20",
+        "@tanstack/react-router": "^1.170.18",
+        "@tanstack/react-start": "^1.168.28",
+        "@tanstack/react-virtual": "^3.14.6",
+        "class-variance-authority": "^0.7.1",
+        clsx: "^2.1.1",
+        conf: "^15.1.0",
+        diff: "^9.0.0",
+        jszip: "^3.10.1",
+        "lucide-react": "^0.563.0",
+        "radix-ui": "^1.6.2",
+        react: "^19.2.7",
+        "react-dom": "^19.2.7",
+        "react-markdown": "^10.1.0",
+        swr: "^2.4.2",
+        "tailwind-merge": "^3.6.0",
+        three: "0.185.1",
+        "tw-animate-css": "^1.4.0",
+        zod: "^4.4.3"
+      },
+      optionalDependencies: {
+        "@tonyclaw/agent-inspector-backend-darwin-arm64": "3.1.0",
+        "@tonyclaw/agent-inspector-backend-linux-x64-gnu": "3.1.0",
+        "@tonyclaw/agent-inspector-backend-win32-x64-msvc": "3.1.0",
+        "better-sqlite3": "^12.11.1",
+        rcedit: "4.0.1"
+      },
+      devDependencies: {
+        "@biomejs/biome": "^2.5.3",
+        "@eslint/js": "^10.0.1",
+        "@ladle/react": "^5.1.1",
+        "@radix-ui/colors": "^3.0.0",
+        "@tailwindcss/vite": "^4.3.2",
+        "@tanstack/router-plugin": "^1.168.20",
+        "@types/bun": "^1.3.14",
+        "@types/react": "^19.2.17",
+        "@types/react-dom": "^19.2.3",
+        "@types/three": "0.185.1",
+        "@typescript-eslint/eslint-plugin": "^8.64.0",
+        "@typescript-eslint/parser": "^8.64.0",
+        "@vitejs/plugin-react": "^5.2.0",
+        ajv: "8.20.0",
+        "ajv-formats": "3.0.1",
+        "colorjs.io": "^0.7.0",
+        esbuild: "^0.28.1",
+        eslint: "^9.39.5",
+        "eslint-plugin-eslint-comments": "^3.2.0",
+        "eslint-plugin-functional": "^9.0.5",
+        "eslint-plugin-unicorn": "^63.0.0",
+        husky: "^9.1.7",
+        knip: "^5.88.1",
+        nitro: "^3.0.260610-beta",
+        playwright: "^1.61.1",
+        tailwindcss: "^4.3.2",
+        typescript: "^5.9.3",
+        vite: "^7.3.6",
+        "vite-tsconfig-paths": "^6.1.1"
+      },
+      overrides: {
+        undici: ">=7.24.0 <8.0.0",
+        rollup: ">=4.59.0 <5.0.0",
+        postcss: ">=8.5.10 <9.0.0",
+        "js-yaml": ">=4.1.2 <5.0.0",
+        flatted: ">=3.4.0 <4.0.0",
+        "smol-toml": ">=1.6.1 <2.0.0",
+        koa: ">=2.16.4 <3.0.0",
+        "@babel/core": ">=7.29.1 <8.0.0",
+        "@typescript-eslint/typescript-estree": "^8.63.0",
+        vite: "^7.3.6"
+      }
+    };
+  }
+});
+
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/core/core.js
 // @__NO_SIDE_EFFECTS__
 function $constructor(name, initializer3, params) {
@@ -15374,555 +15574,868 @@ var init_networkHints = __esm({
   }
 });
 
-// src/lib/instanceContract.ts
-function isCanonicalPublicBasePath(value) {
-  const normalized = normalizePublicBasePath(value);
-  return normalized !== null && (normalized.length === 0 ? "/" : normalized) === value;
-}
-function isRetryableInstanceError(code) {
-  switch (code) {
-    case "launch_failed":
-    case "launch_unavailable":
-    case "lock_timeout":
-    case "port_exhausted":
-    case "registry_io":
-    case "restart_failed_degraded":
-    case "restart_failed_rolled_back":
-    case "shutdown_failed":
-      return true;
-    case "argument_invalid":
-    case "config_mismatch":
-    case "data_dir_conflict":
-    case "data_dir_invalid":
-    case "identity_mismatch":
-    case "instance_not_found":
-    case "lock_not_owned":
-    case "name_invalid":
-    case "port_conflict":
-    case "port_invalid":
-    case "record_invalid":
-    case "self_lifecycle_unsupported":
-      return false;
-  }
+// src/cli/rustBackendPackage.ts
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function packageFailure(code, message) {
+  return { kind: "error", error: { code, message } };
 }
-function instanceErrorOutput(error51) {
-  return { schemaVersion: INSTANCE_API_SCHEMA_VERSION, error: error51 };
+function targetFailure(message) {
+  return { kind: "error", error: { code: "unsupported_platform", message } };
 }
-var INSTANCE_API_SCHEMA_VERSION, InstanceStateSchema, InstanceStateReasonSchema, InstanceUrlsSchema, InstanceStatusOutputSchema, InstanceConnectionSurfacesSchema, InstanceConnectionOutputSchema, InstanceStartRequestSchema, InstanceEmptyRequestSchema, InstanceOperationSchema, InstanceOperationOutcomeSchema, InstanceOperationOutputSchema, InstanceListOutputSchema, InstancePublicErrorCodeSchema, InstancePublicErrorSchema, InstanceErrorOutputSchema;
-var init_instanceContract = __esm({
-  "src/lib/instanceContract.ts"() {
-    "use strict";
-    init_zod();
-    init_backendImplementation();
-    init_basePath();
-    INSTANCE_API_SCHEMA_VERSION = 1;
-    InstanceStateSchema = external_exports.enum(["running", "stopped", "conflict"]);
-    InstanceStateReasonSchema = external_exports.enum(["identity_mismatch", "port_conflict"]);
-    InstanceUrlsSchema = external_exports.object({
-      ui: external_exports.url(),
-      api: external_exports.url(),
-      health: external_exports.url(),
-      proxy: external_exports.url(),
-      openai: external_exports.url(),
-      mcp: external_exports.url()
-    }).strict();
-    InstanceStatusOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      name: external_exports.string().min(1),
-      instanceId: external_exports.string().min(1),
-      state: InstanceStateSchema,
-      stateReason: InstanceStateReasonSchema.nullable(),
-      checkedAt: external_exports.iso.datetime(),
-      createdAt: external_exports.iso.datetime(),
-      updatedAt: external_exports.iso.datetime(),
-      launch: external_exports.object({
-        launchId: external_exports.string().min(1),
-        startedAt: external_exports.iso.datetime()
-      }).strict(),
-      host: external_exports.string().min(1),
-      publicPort: external_exports.number().int().min(1).max(65535),
-      upstreamPort: external_exports.number().int().min(1).max(65535),
-      basePath: external_exports.string().refine(isCanonicalPublicBasePath, "Invalid public Base Path"),
-      captureMode: external_exports.enum(["simple", "full"]),
-      backend: BackendImplementationSchema.default("typescript"),
-      uiEnabled: external_exports.boolean(),
-      dataDir: external_exports.string().min(1),
-      supervisorPid: external_exports.number().int().positive().nullable(),
-      urls: InstanceUrlsSchema
-    }).strict();
-    InstanceConnectionSurfacesSchema = external_exports.object({
-      ui: external_exports.object({
-        enabled: external_exports.boolean(),
-        baseUrl: external_exports.url().nullable()
-      }).strict(),
-      control: external_exports.object({ baseUrl: external_exports.url() }).strict(),
-      agent: external_exports.object({ baseUrl: external_exports.url() }).strict()
-    }).strict();
-    InstanceConnectionOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      uiEnabled: external_exports.boolean(),
-      instance: InstanceStatusOutputSchema,
-      surfaces: InstanceConnectionSurfacesSchema,
-      /** @deprecated Use surfaces.control.baseUrl or surfaces.agent.baseUrl. */
-      baseUrl: external_exports.url(),
-      endpoints: InstanceUrlsSchema,
-      environment: external_exports.object({
-        ANTHROPIC_BASE_URL: external_exports.url(),
-        LLM_BASE_URL: external_exports.url(),
-        OPENAI_BASE_URL: external_exports.url(),
-        AGENT_INSPECTOR_MCP_URL: external_exports.url()
-      }).strict(),
-      mcp: external_exports.object({
-        serverName: external_exports.string().min(1),
-        transport: external_exports.literal("streamable-http"),
-        url: external_exports.url()
-      }).strict(),
-      codex: external_exports.object({
-        providerName: external_exports.string().min(1),
-        baseUrl: external_exports.url(),
-        wireApi: external_exports.literal("responses")
-      }).strict()
-    }).strict();
-    InstanceStartRequestSchema = external_exports.object({
-      port: external_exports.number().int().min(1).max(65535).optional(),
-      basePath: external_exports.string().min(1).max(2048).refine(
-        (value) => normalizePublicBasePath(value) !== null,
-        "Base Path must use URL-safe path segments without traversal, encoded separators, or markup characters"
-      ).optional(),
-      host: external_exports.string().min(1).max(253).refine(
-        (value) => value.trim() === value && !value.includes("://") && !value.includes("/") && !value.includes("\\") && !/\s/u.test(value),
-        "Host must be a hostname or IP address without protocol, path, or whitespace"
-      ).optional(),
-      captureMode: external_exports.enum(["simple", "full"]).optional(),
-      backend: BackendImplementationSchema.optional(),
-      uiEnabled: external_exports.boolean().optional(),
-      dataDir: external_exports.string().trim().min(1).max(32767).optional()
-    }).strict();
-    InstanceEmptyRequestSchema = external_exports.object({}).strict();
-    InstanceOperationSchema = external_exports.enum(["start", "stop", "restart"]);
-    InstanceOperationOutcomeSchema = external_exports.enum([
-      "created",
-      "started",
-      "already_running",
-      "stopped",
-      "already_stopped",
-      "restarted"
-    ]);
-    InstanceOperationOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      operation: InstanceOperationSchema,
-      outcome: InstanceOperationOutcomeSchema,
-      instance: InstanceStatusOutputSchema
-    }).strict();
-    InstanceListOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      instances: external_exports.array(InstanceStatusOutputSchema)
-    }).strict();
-    InstancePublicErrorCodeSchema = external_exports.enum([
-      "argument_invalid",
-      "config_mismatch",
-      "data_dir_conflict",
-      "data_dir_invalid",
-      "identity_mismatch",
-      "instance_not_found",
-      "launch_failed",
-      "launch_unavailable",
-      "lock_not_owned",
-      "lock_timeout",
-      "name_invalid",
-      "port_conflict",
-      "port_exhausted",
-      "port_invalid",
-      "record_invalid",
-      "registry_io",
-      "restart_failed_degraded",
-      "restart_failed_rolled_back",
-      "self_lifecycle_unsupported",
-      "shutdown_failed"
-    ]);
-    InstancePublicErrorSchema = external_exports.object({
-      code: InstancePublicErrorCodeSchema,
-      message: external_exports.string().min(1),
-      retryable: external_exports.boolean()
-    }).strict();
-    InstanceErrorOutputSchema = external_exports.object({
-      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
-      error: InstancePublicErrorSchema
-    }).strict();
+function detectLinuxLibc() {
+  if (process.platform !== "linux") return "not-applicable";
+  const report = process.report.getReport();
+  const header = objectProperty(report, "header");
+  const glibcVersion = objectProperty(header, "glibcVersionRuntime");
+  if (typeof glibcVersion === "string" && glibcVersion.length > 0) {
+    return "glibc";
   }
-});
-
-// src/proxy/privateDataPath.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import {
-  closeSync,
-  constants,
-  fchmodSync,
-  fstatSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readdirSync,
-  realpathSync
-} from "node:fs";
-import { join, parse as parse3, resolve as resolve2, sep } from "node:path";
-function windowsSystemPath(executable) {
-  const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
-  return `${systemRoot}\\System32\\${executable}`;
-}
-function runWindowsCommand(executable, args) {
-  const resolved = process.platform === "win32" && /^(whoami|icacls)\.exe$/iu.test(executable) ? windowsSystemPath(executable) : executable;
-  const result = spawnSync2(resolved, [...args], {
-    encoding: "utf8",
-    shell: false,
-    windowsHide: true
-  });
-  return { status: result.status, stdout: result.stdout };
-}
-function windowsUserSid(output) {
-  const match = /S-\d+(?:-\d+)+/.exec(output);
-  return match?.[0] ?? null;
-}
-function resolveWindowsUserSid(run) {
-  if (run === runWindowsCommand && cachedWindowsSid !== null) return cachedWindowsSid;
-  const identity = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
-  if (identity.status !== 0) return null;
-  const sid = windowsUserSid(identity.stdout);
-  if (run === runWindowsCommand) cachedWindowsSid = sid;
-  return sid;
+  const sharedObjects = objectProperty(report, "sharedObjects");
+  return Array.isArray(sharedObjects) && sharedObjects.some((path2) => typeof path2 === "string" && path2.toLowerCase().includes("musl")) ? "musl" : "unknown";
 }
-function windowsBroadGroupRemovalArgs() {
-  return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"];
+function objectProperty(value, name) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  return Object.getOwnPropertyDescriptor(value, name)?.value;
 }
-function applyWindowsAclWithSid(path2, kind, sid, run) {
-  const access = kind === "directory" ? `(OI)(CI)F` : "F";
-  const result = run("icacls.exe", [
-    path2,
-    "/inheritance:r",
-    "/grant:r",
-    `*${sid}:${access}`,
-    ...windowsBroadGroupRemovalArgs(),
-    "/q"
-  ]);
-  return result.status === 0;
-}
-function applyWindowsUserOnlyAcl(path2, kind, run = runWindowsCommand) {
-  const sid = resolveWindowsUserSid(run);
-  return sid !== null && applyWindowsAclWithSid(path2, kind, sid, run);
-}
-function comparablePath(path2) {
-  let normalized = path2;
-  if (process.platform === "win32") {
-    if (normalized.startsWith("\\\\?\\UNC\\")) {
-      normalized = `\\\\${normalized.slice(8)}`;
-    } else if (normalized.startsWith("\\\\?\\")) {
-      normalized = normalized.slice(4);
-    }
+function resolveRustBackendTarget(platform = process.platform, arch = process.arch, libc = platform === "linux" ? detectLinuxLibc() : "not-applicable") {
+  switch (platform) {
+    case "win32":
+      return arch === "x64" ? {
+        kind: "success",
+        value: {
+          packageName: "@tonyclaw/agent-inspector-backend-win32-x64-msvc",
+          target: "x86_64-pc-windows-msvc",
+          binary: "bin/agent-inspector-backend.exe",
+          os: "win32",
+          cpu: "x64",
+          libc: null
+        }
+      } : targetFailure(`Rust backend packages do not support Windows ${arch}.`);
+    case "linux":
+      if (arch !== "x64")
+        return targetFailure(`Rust backend packages do not support Linux ${arch}.`);
+      if (libc !== "glibc") {
+        return targetFailure(
+          `The Linux Rust backend package requires glibc; detected ${libc}. No binary was started.`
+        );
+      }
+      return {
+        kind: "success",
+        value: {
+          packageName: "@tonyclaw/agent-inspector-backend-linux-x64-gnu",
+          target: "x86_64-unknown-linux-gnu",
+          binary: "bin/agent-inspector-backend",
+          os: "linux",
+          cpu: "x64",
+          libc: "glibc"
+        }
+      };
+    case "darwin":
+      return arch === "arm64" ? {
+        kind: "success",
+        value: {
+          packageName: "@tonyclaw/agent-inspector-backend-darwin-arm64",
+          target: "aarch64-apple-darwin",
+          binary: "bin/agent-inspector-backend",
+          os: "darwin",
+          cpu: "arm64",
+          libc: null
+        }
+      } : targetFailure(`Rust backend packages do not support macOS ${arch}.`);
+    default:
+      return targetFailure(`Rust backend packages do not support ${platform} ${arch}.`);
   }
-  const absolute = resolve2(normalized);
-  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
-}
-function pathIdentity(stats) {
-  return `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
 }
-function readPathEntry(path2) {
-  let stats;
-  try {
-    const observed = lstatSync(path2);
-    if (observed === void 0) return { status: "missing" };
-    stats = observed;
-  } catch {
-    return { status: "missing" };
-  }
-  if (stats.isSymbolicLink()) return { status: "unsafe" };
-  const kind = stats.isDirectory() ? "directory" : stats.isFile() ? "file" : null;
-  if (kind === null) return { status: "unsafe" };
-  let canonical;
+function readJson(path2) {
   try {
-    canonical = realpathSync.native(path2);
+    const value = JSON.parse(readFileSync(path2, "utf8"));
+    return { kind: "success", value };
   } catch {
-    return { status: "unsafe" };
+    return { kind: "error" };
   }
-  if (comparablePath(canonical) !== comparablePath(path2)) return { status: "unsafe" };
-  return {
-    status: "ok",
-    entry: {
-      path: path2,
-      kind,
-      identity: pathIdentity(stats),
-      mode: stats.mode & 511
-    }
-  };
 }
-function snapshotPathChain(path2) {
-  const absolutePath = resolve2(path2);
-  const root = parse3(absolutePath).root;
-  const suffix = absolutePath.slice(root.length);
-  const parts = suffix === "" ? [] : suffix.split(sep).filter((part) => part !== "");
-  const entries = [];
-  let current = root;
-  const rootRead = readPathEntry(root);
-  if (rootRead.status !== "ok" || rootRead.entry.kind !== "directory") return null;
-  entries.push(rootRead.entry);
-  for (let index = 0; index < parts.length; index += 1) {
-    const part = parts[index];
-    if (part === void 0) return null;
-    current = join(current, part);
-    const read = readPathEntry(current);
-    if (read.status === "unsafe") return null;
-    if (read.status === "missing") {
-      return {
-        absolutePath,
-        complete: false,
-        entries,
-        missingParts: parts.slice(index)
-      };
-    }
-    if (index < parts.length - 1 && read.entry.kind !== "directory") return null;
-    entries.push(read.entry);
-  }
-  return { absolutePath, complete: true, entries, missingParts: [] };
+function isConfinedPath(root, candidate) {
+  const child = relative(root, candidate);
+  return child.length > 0 && !child.startsWith("..") && !isAbsolute(child);
 }
-function chainFingerprint(snapshot) {
-  return snapshot.entries.map((entry) => `${entry.path}:${entry.identity}`).join("|");
+function identitiesMatch(left, right) {
+  return left.schemaVersion === right.schemaVersion && left.name === right.name && left.packageVersion === right.packageVersion && left.target === right.target && left.binary === right.binary && left.cliProtocol === right.cliProtocol && left.productionReady === right.productionReady && left.capabilities.nodeProtectedIngress === right.capabilities.nodeProtectedIngress && left.capabilities.basePath === right.capabilities.basePath && left.capabilities.namedInstances === right.capabilities.namedInstances && left.capabilities.gracefulShutdown === right.capabilities.gracefulShutdown;
 }
-function snapshotsRetainPrefix(before, after) {
-  if (after.entries.length < before.entries.length) return false;
-  return before.entries.every((entry, index) => {
-    const next = after.entries[index];
-    return next !== void 0 && next.path === entry.path && next.identity === entry.identity;
+function probeBinaryIdentity(binaryPath, identityFlag) {
+  const result = spawnSync(binaryPath, [identityFlag], {
+    encoding: "utf8",
+    windowsHide: true,
+    timeout: RUST_BACKEND_IDENTITY_TIMEOUT_MS,
+    maxBuffer: 64 * 1024
   });
-}
-function completeSnapshotForKind(path2, kind) {
-  const snapshot = snapshotPathChain(path2);
-  if (snapshot === null || !snapshot.complete) return null;
-  const leaf = snapshot.entries.at(-1);
-  return leaf !== void 0 && leaf.kind === kind ? snapshot : null;
-}
-function applyPosixPermissions(path2, kind, expectedIdentity2) {
-  let descriptor = null;
+  if (result.error !== void 0) {
+    return { kind: "error", message: result.error.message };
+  }
+  if (result.status !== 0) {
+    return {
+      kind: "error",
+      message: `identity command exited with status ${String(result.status)}`
+    };
+  }
+  let raw;
   try {
-    const directoryFlag = kind === "directory" ? constants.O_DIRECTORY : 0;
-    descriptor = openSync(path2, constants.O_RDONLY | constants.O_NOFOLLOW | directoryFlag);
-    const before = fstatSync(descriptor);
-    if (pathIdentity(before) !== expectedIdentity2) return false;
-    fchmodSync(descriptor, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
-    const after = fstatSync(descriptor);
-    return pathIdentity(after) === expectedIdentity2 && (after.mode & 511) === (kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+    raw = JSON.parse(result.stdout);
   } catch {
-    return false;
-  } finally {
-    if (descriptor !== null) {
-      try {
-        closeSync(descriptor);
-      } catch {
-      }
-    }
-  }
-}
-function permissionsArePrivate(entry) {
-  if (process.platform === "win32") return true;
-  return entry.mode === (entry.kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
-}
-function secureExistingPath(path2, kind, forcePermissions = false) {
-  const before = completeSnapshotForKind(path2, kind);
-  if (before === null) return false;
-  const leaf = before.entries.at(-1);
-  if (leaf === void 0) return false;
-  const cacheKey = `${kind}:${before.absolutePath}`;
-  const beforeFingerprint = chainFingerprint(before);
-  if (!forcePermissions && securedPathFingerprints.get(cacheKey) === beforeFingerprint && permissionsArePrivate(leaf)) {
-    const cachedCheck = completeSnapshotForKind(path2, kind);
-    return cachedCheck !== null && chainFingerprint(cachedCheck) === beforeFingerprint;
+    return { kind: "error", message: "identity command did not return JSON" };
   }
-  const applied = process.platform === "win32" ? applyWindowsUserOnlyAcl(path2, kind) : applyPosixPermissions(path2, kind, leaf.identity);
-  if (!applied) return false;
-  const after = completeSnapshotForKind(path2, kind);
-  if (after === null || !snapshotsRetainPrefix(before, after)) return false;
-  const afterLeaf = after.entries.at(-1);
-  if (afterLeaf === void 0 || afterLeaf.identity !== leaf.identity) return false;
-  if (!permissionsArePrivate(afterLeaf)) return false;
-  securedPathFingerprints.set(cacheKey, chainFingerprint(after));
-  return true;
+  const parsed = RustBackendIdentitySchema.safeParse(raw);
+  return parsed.success ? { kind: "success", value: parsed.data } : { kind: "error", message: "identity command returned an unsupported contract" };
 }
-function ensurePrivateDirectorySync(path2) {
-  const before = snapshotPathChain(path2);
-  if (before === null) return false;
-  let current = before.entries.at(-1)?.path;
-  if (current === void 0) return false;
-  for (const part of before.missingParts) {
-    const next = join(current, part);
-    try {
-      mkdirSync(next, { mode: PRIVATE_DIRECTORY_MODE });
-    } catch {
-      const raced = readPathEntry(next);
-      if (raced.status !== "ok" || raced.entry.kind !== "directory") return false;
+function defaultResolvePackageJson(specifier) {
+  try {
+    return packageRequire.resolve(specifier);
+  } catch {
+    const suffix = "/package.json";
+    const packageName = specifier.endsWith(suffix) ? specifier.slice(0, -suffix.length) : "";
+    const directoryName = packageName.split("/").at(-1);
+    if (directoryName !== void 0 && directoryName.length > 0) {
+      const localPackageJson = resolve(
+        dirname(fileURLToPath(import.meta.url)),
+        "../packages",
+        directoryName,
+        "package.json"
+      );
+      if (existsSync(localPackageJson)) return localPackageJson;
     }
-    if (!secureExistingPath(next, "directory", true)) return false;
-    current = next;
+    return packageRequire.resolve(specifier);
   }
-  const complete = completeSnapshotForKind(path2, "directory");
-  if (complete === null || !snapshotsRetainPrefix(before, complete)) return false;
-  return secureExistingPath(path2, "directory");
 }
-function securePrivateFileSync(path2, forceAcl = false) {
-  return secureExistingPath(path2, "file", forceAcl);
-}
-function collectSafeTree(root) {
-  const collected = [];
-  const visit = (path2) => {
-    const snapshot = snapshotPathChain(path2);
-    if (snapshot === null || !snapshot.complete) return false;
-    const leaf = snapshot.entries.at(-1);
-    if (leaf === void 0) return false;
-    const fingerprint = chainFingerprint(snapshot);
-    collected.push({ path: snapshot.absolutePath, kind: leaf.kind, fingerprint });
-    if (leaf.kind === "file") return true;
-    let entries;
-    try {
-      entries = readdirSync(path2);
-    } catch {
-      return false;
-    }
-    const afterRead = completeSnapshotForKind(path2, "directory");
-    if (afterRead === null || chainFingerprint(afterRead) !== fingerprint) return false;
-    for (const entry of entries) {
-      if (!visit(join(path2, entry))) return false;
-    }
-    return true;
-  };
-  return visit(root) ? collected : null;
-}
-function treeFingerprintsMatch(expected, observed) {
-  if (observed === null || observed.length !== expected.length) return false;
-  return expected.every((entry, index) => {
-    const next = observed[index];
-    return next !== void 0 && next.path === entry.path && next.kind === entry.kind && next.fingerprint === entry.fingerprint;
-  });
-}
-function isPathTreeFreeOfIndirectionSync(root) {
-  return collectSafeTree(root) !== null;
-}
-function applyWindowsUserOnlyTreeAcl(root, run = runWindowsCommand) {
-  const entries = collectSafeTree(root);
-  if (entries === null) return false;
-  const sid = resolveWindowsUserSid(run);
-  if (sid === null) return false;
-  for (const entry of entries) {
-    const before = completeSnapshotForKind(entry.path, entry.kind);
-    if (before === null || chainFingerprint(before) !== entry.fingerprint) return false;
-    if (!applyWindowsAclWithSid(entry.path, entry.kind, sid, run)) return false;
-    const after = completeSnapshotForKind(entry.path, entry.kind);
-    if (after === null || chainFingerprint(after) !== entry.fingerprint) return false;
-    securedPathFingerprints.set(`${entry.kind}:${entry.path}`, entry.fingerprint);
+function resolveRustBackendPackage(options) {
+  const target = resolveRustBackendTarget(options.platform, options.arch, options.libc);
+  if (target.kind === "error") return { kind: "error", error: target.error };
+  const packageJsonSpecifier = `${target.value.packageName}/package.json`;
+  let packageJsonPath;
+  try {
+    packageJsonPath = (options.resolvePackageJson ?? defaultResolvePackageJson)(
+      packageJsonSpecifier
+    );
+  } catch {
+    return packageFailure(
+      "package_missing",
+      `Rust backend ${target.value.target} was requested, but optional package ${target.value.packageName}@${options.rootVersion} is not installed. Reinstall without omitting optional dependencies; no TypeScript fallback was used.`
+    );
   }
-  return treeFingerprintsMatch(entries, collectSafeTree(root));
-}
-function securePrivateTreeSync(root) {
-  const entries = collectSafeTree(root);
-  if (entries === null) return false;
-  if (process.platform === "win32") return applyWindowsUserOnlyTreeAcl(root);
-  for (const entry of entries) {
-    if (!secureExistingPath(entry.path, entry.kind, true)) return false;
+  const rawPackage = readJson(packageJsonPath);
+  if (rawPackage.kind === "error") {
+    return packageFailure("package_invalid", `Cannot read ${packageJsonSpecifier}.`);
   }
-  return treeFingerprintsMatch(entries, collectSafeTree(root));
-}
-var PRIVATE_DIRECTORY_MODE, PRIVATE_FILE_MODE, securedPathFingerprints, cachedWindowsSid;
-var init_privateDataPath = __esm({
-  "src/proxy/privateDataPath.ts"() {
-    "use strict";
-    PRIVATE_DIRECTORY_MODE = 448;
-    PRIVATE_FILE_MODE = 384;
-    securedPathFingerprints = /* @__PURE__ */ new Map();
-    cachedWindowsSid = null;
+  const packageJson = RustBackendPackageJsonSchema.safeParse(rawPackage.value);
+  if (!packageJson.success) {
+    return packageFailure(
+      "package_invalid",
+      `Package ${target.value.packageName} does not contain the Rust backend package contract.`
+    );
   }
-});
-
-// src/proxy/dataDir.ts
-import { cpSync, existsSync as existsSync2, readdirSync as readdirSync2, renameSync, rmSync } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join2 } from "node:path";
-function getDataDir() {
-  migrateLegacyDataDirs();
-  return resolveDataDir(existsSync2);
-}
-function hasDataDirState(pathExists, dir) {
-  return pathExists(join2(dir, "providers.json")) || pathExists(join2(dir, "config.json")) || pathExists(join2(dir, "logs")) || pathExists(join2(dir, "chunks"));
-}
-function defaultBaseDir(env = process.env, platform = process.platform) {
-  return platform === "win32" ? env["USERPROFILE"] ?? env["APPDATA"] ?? "C:\\" : env["HOME"] ?? "/tmp";
-}
-function resolveDataDir(_pathExists, env = process.env, platform = process.platform) {
-  const base = defaultBaseDir(env, platform);
-  const dirEnv = env["AGENT_INSPECTOR_DATA_DIR"];
-  if (dirEnv !== void 0 && dirEnv !== "") {
-    return isAbsolute2(dirEnv) ? dirEnv : join2(base, dirEnv);
+  if (packageJson.data.name !== target.value.packageName || packageJson.data.version !== options.rootVersion) {
+    return packageFailure(
+      "version_mismatch",
+      `Rust backend package must exactly match @tonyclaw/agent-inspector@${options.rootVersion}; found ${packageJson.data.name}@${packageJson.data.version}.`
+    );
   }
-  const legacyDirEnv = env["AGENT_INSPECTOR_CONFIG_DIR"];
-  if (legacyDirEnv !== void 0 && legacyDirEnv !== "") {
-    return isAbsolute2(legacyDirEnv) ? legacyDirEnv : join2(base, legacyDirEnv);
+  const metadata = packageJson.data.agentInspectorRustBackend;
+  const expectedLibc = target.value.libc === null ? void 0 : [target.value.libc];
+  if (metadata.target !== target.value.target || metadata.binary !== target.value.binary || metadata.manifest !== "binary-manifest.json" || packageJson.data.os.length !== 1 || packageJson.data.os[0] !== target.value.os || packageJson.data.cpu.length !== 1 || packageJson.data.cpu[0] !== target.value.cpu || JSON.stringify(packageJson.data.libc) !== JSON.stringify(expectedLibc)) {
+    return packageFailure(
+      "target_mismatch",
+      `Package ${target.value.packageName} does not match target ${target.value.target}.`
+    );
   }
-  return join2(base, CURRENT_DATA_DIR_NAME);
-}
-function hasExplicitDataDir() {
-  return process.env["AGENT_INSPECTOR_DATA_DIR"] !== void 0 && process.env["AGENT_INSPECTOR_DATA_DIR"] !== "" || process.env["AGENT_INSPECTOR_CONFIG_DIR"] !== void 0 && process.env["AGENT_INSPECTOR_CONFIG_DIR"] !== "";
-}
-function migrateLegacyDataDirs() {
-  if (hasExplicitDataDir()) return;
-  const base = defaultBaseDir();
-  const currentDir = join2(base, CURRENT_DATA_DIR_NAME);
-  if (hasDataDirState(existsSync2, currentDir)) return;
-  for (const legacyName of LEGACY_DATA_DIR_NAMES) {
-    const legacyDir = join2(base, legacyName);
-    if (!existsSync2(legacyDir)) continue;
-    const stagingDir = join2(
-      base,
-      `${CURRENT_DATA_DIR_NAME}.migration-${String(process.pid)}-${String(Date.now())}`
+  const packageRoot = dirname(packageJsonPath);
+  const manifestPath = resolve(packageRoot, metadata.manifest);
+  const binaryPath = resolve(packageRoot, metadata.binary);
+  if (!isConfinedPath(packageRoot, manifestPath) || !isConfinedPath(packageRoot, binaryPath)) {
+    return packageFailure(
+      "package_invalid",
+      `Package ${target.value.packageName} contains an unsafe artifact path.`
     );
-    try {
-      if (!isPathTreeFreeOfIndirectionSync(legacyDir)) return;
-      if (existsSync2(currentDir)) {
-        if (readdirSync2(currentDir).length > 0) return;
-        rmSync(currentDir, { recursive: true, force: false });
-      }
-      if (!ensurePrivateDirectorySync(stagingDir)) return;
-      for (const entry of readdirSync2(legacyDir)) {
-        cpSync(join2(legacyDir, entry), join2(stagingDir, entry), {
-          recursive: true,
-          force: false,
-          errorOnExist: true
-        });
-      }
-      if (!isPathTreeFreeOfIndirectionSync(legacyDir)) {
-        rmSync(stagingDir, { recursive: true, force: true });
-        return;
-      }
-      if (!securePrivateTreeSync(stagingDir)) {
-        rmSync(stagingDir, { recursive: true, force: true });
-        return;
-      }
-      renameSync(stagingDir, currentDir);
-      rmSync(legacyDir, { recursive: true, force: true });
-      return;
-    } catch {
-      if (existsSync2(stagingDir)) rmSync(stagingDir, { recursive: true, force: true });
-      return;
+  }
+  const rawManifest = readJson(manifestPath);
+  if (rawManifest.kind === "error") {
+    return packageFailure(
+      "manifest_invalid",
+      `Rust backend package ${target.value.packageName} is incomplete: binary-manifest.json is missing or invalid.`
+    );
+  }
+  const manifest = RustBackendBinaryManifestSchema.safeParse(rawManifest.value);
+  if (!manifest.success) {
+    return packageFailure(
+      "manifest_invalid",
+      `Rust backend package ${target.value.packageName} has an invalid target manifest.`
+    );
+  }
+  if (manifest.data.packageName !== target.value.packageName || manifest.data.packageVersion !== options.rootVersion || manifest.data.identity.packageVersion !== options.rootVersion) {
+    return packageFailure(
+      "version_mismatch",
+      `Rust backend manifest must exactly match @tonyclaw/agent-inspector@${options.rootVersion}.`
+    );
+  }
+  if (manifest.data.target !== target.value.target || manifest.data.binary !== target.value.binary || manifest.data.identity.target !== target.value.target || manifest.data.identity.binary !== target.value.binary) {
+    return packageFailure(
+      "target_mismatch",
+      `Rust backend manifest identity does not match target ${target.value.target}.`
+    );
+  }
+  let binaryBytes;
+  try {
+    const stats = statSync(binaryPath);
+    if (!stats.isFile()) {
+      return packageFailure("binary_invalid", `Rust backend artifact is not a regular file.`);
+    }
+    if (target.value.os !== "win32" && (stats.mode & 73) === 0) {
+      return packageFailure("binary_invalid", `Rust backend artifact is not executable.`);
     }
+    binaryBytes = readFileSync(binaryPath);
+  } catch {
+    return packageFailure(
+      "binary_missing",
+      `Rust backend binary ${target.value.binary} is missing from ${target.value.packageName}.`
+    );
+  }
+  const sha256 = createHash("sha256").update(binaryBytes).digest("hex");
+  if (sha256 !== manifest.data.sha256) {
+    return packageFailure(
+      "hash_mismatch",
+      `Rust backend binary integrity check failed for ${target.value.packageName}; no binary was started.`
+    );
+  }
+  const probed = (options.identityProbe ?? probeBinaryIdentity)(binaryPath, metadata.identityFlag);
+  if (probed.kind === "error") {
+    return packageFailure(
+      "identity_failed",
+      `Rust backend binary did not pass the production identity gate: ${probed.message}. No TypeScript fallback was used.`
+    );
+  }
+  if (!identitiesMatch(probed.value, manifest.data.identity)) {
+    return packageFailure(
+      "identity_mismatch",
+      `Rust backend binary identity differs from its signed package manifest; no binary was started.`
+    );
   }
+  return {
+    kind: "success",
+    value: {
+      command: binaryPath,
+      args: [],
+      packageName: target.value.packageName,
+      packageVersion: options.rootVersion,
+      target: target.value.target,
+      sha256
+    }
+  };
 }
-var CURRENT_DATA_DIR_NAME, LEGACY_DATA_DIR_NAMES;
-var init_dataDir = __esm({
-  "src/proxy/dataDir.ts"() {
+function resolvePreferredBackendImplementation(options) {
+  return resolveRustBackendPackage(options).kind === "success" ? "rust" : "typescript";
+}
+var RUST_BACKEND_IDENTITY_FLAG, RUST_BACKEND_CLI_PROTOCOL, RUST_BACKEND_IDENTITY_TIMEOUT_MS, RustBackendIdentitySchema, RustBackendPackageJsonSchema, RustBackendBinaryManifestSchema, packageRequire;
+var init_rustBackendPackage = __esm({
+  "src/cli/rustBackendPackage.ts"() {
     "use strict";
-    init_privateDataPath();
-    CURRENT_DATA_DIR_NAME = ".agent-inspector";
-    LEGACY_DATA_DIR_NAMES = [".llm-inspector", ".llm-agent"];
+    init_zod();
+    RUST_BACKEND_IDENTITY_FLAG = "--agent-inspector-package-identity";
+    RUST_BACKEND_CLI_PROTOCOL = "agent-inspector-cli-backend-v1";
+    RUST_BACKEND_IDENTITY_TIMEOUT_MS = 2e3;
+    RustBackendIdentitySchema = external_exports.object({
+      schemaVersion: external_exports.literal(1),
+      name: external_exports.literal("agent-inspector-backend"),
+      packageVersion: external_exports.string().min(1),
+      target: external_exports.string().min(1),
+      binary: external_exports.string().min(1),
+      cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL),
+      productionReady: external_exports.literal(true),
+      capabilities: external_exports.object({
+        nodeProtectedIngress: external_exports.literal(true),
+        basePath: external_exports.literal(true),
+        namedInstances: external_exports.literal(true),
+        gracefulShutdown: external_exports.literal(true)
+      }).strict()
+    }).strict();
+    RustBackendPackageJsonSchema = external_exports.object({
+      name: external_exports.string().min(1),
+      version: external_exports.string().min(1),
+      os: external_exports.array(external_exports.string()).min(1),
+      cpu: external_exports.array(external_exports.string()).min(1),
+      libc: external_exports.array(external_exports.string()).optional(),
+      agentInspectorRustBackend: external_exports.object({
+        schemaVersion: external_exports.literal(1),
+        target: external_exports.string().min(1),
+        binary: external_exports.string().min(1),
+        manifest: external_exports.string().min(1),
+        identityFlag: external_exports.literal(RUST_BACKEND_IDENTITY_FLAG),
+        cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL)
+      }).strict()
+    }).passthrough();
+    RustBackendBinaryManifestSchema = external_exports.object({
+      schemaVersion: external_exports.literal(1),
+      packageName: external_exports.string().min(1),
+      packageVersion: external_exports.string().min(1),
+      target: external_exports.string().min(1),
+      binary: external_exports.string().min(1),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/u),
+      identity: RustBackendIdentitySchema
+    }).strict();
+    packageRequire = createRequire(import.meta.url);
   }
 });
 
-// src/proxy/platformCommands.ts
-import { statSync as statSync2 } from "node:fs";
-import { execFileSync } from "node:child_process";
-import { delimiter, isAbsolute as isAbsolute3, join as join3 } from "node:path";
+// src/lib/instanceContract.ts
+function isCanonicalPublicBasePath(value) {
+  const normalized = normalizePublicBasePath(value);
+  return normalized !== null && (normalized.length === 0 ? "/" : normalized) === value;
+}
+function isRetryableInstanceError(code) {
+  switch (code) {
+    case "launch_failed":
+    case "launch_unavailable":
+    case "lock_timeout":
+    case "port_exhausted":
+    case "registry_io":
+    case "restart_failed_degraded":
+    case "restart_failed_rolled_back":
+    case "shutdown_failed":
+      return true;
+    case "argument_invalid":
+    case "config_mismatch":
+    case "data_dir_conflict":
+    case "data_dir_invalid":
+    case "identity_mismatch":
+    case "instance_not_found":
+    case "lock_not_owned":
+    case "name_invalid":
+    case "port_conflict":
+    case "port_invalid":
+    case "record_invalid":
+    case "self_lifecycle_unsupported":
+      return false;
+  }
+}
+function instanceErrorOutput(error51) {
+  return { schemaVersion: INSTANCE_API_SCHEMA_VERSION, error: error51 };
+}
+var INSTANCE_API_SCHEMA_VERSION, InstanceStateSchema, InstanceStateReasonSchema, InstanceUrlsSchema, InstanceStatusOutputSchema, InstanceConnectionSurfacesSchema, InstanceConnectionOutputSchema, InstanceStartRequestSchema, InstanceEmptyRequestSchema, InstanceOperationSchema, InstanceOperationOutcomeSchema, InstanceOperationOutputSchema, InstanceListOutputSchema, InstancePublicErrorCodeSchema, InstancePublicErrorSchema, InstanceErrorOutputSchema;
+var init_instanceContract = __esm({
+  "src/lib/instanceContract.ts"() {
+    "use strict";
+    init_zod();
+    init_backendImplementation();
+    init_basePath();
+    INSTANCE_API_SCHEMA_VERSION = 1;
+    InstanceStateSchema = external_exports.enum(["running", "stopped", "conflict"]);
+    InstanceStateReasonSchema = external_exports.enum(["identity_mismatch", "port_conflict"]);
+    InstanceUrlsSchema = external_exports.object({
+      ui: external_exports.url(),
+      api: external_exports.url(),
+      health: external_exports.url(),
+      proxy: external_exports.url(),
+      openai: external_exports.url(),
+      mcp: external_exports.url()
+    }).strict();
+    InstanceStatusOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      name: external_exports.string().min(1),
+      instanceId: external_exports.string().min(1),
+      state: InstanceStateSchema,
+      stateReason: InstanceStateReasonSchema.nullable(),
+      checkedAt: external_exports.iso.datetime(),
+      createdAt: external_exports.iso.datetime(),
+      updatedAt: external_exports.iso.datetime(),
+      launch: external_exports.object({
+        launchId: external_exports.string().min(1),
+        startedAt: external_exports.iso.datetime()
+      }).strict(),
+      host: external_exports.string().min(1),
+      publicPort: external_exports.number().int().min(1).max(65535),
+      upstreamPort: external_exports.number().int().min(1).max(65535),
+      basePath: external_exports.string().refine(isCanonicalPublicBasePath, "Invalid public Base Path"),
+      captureMode: external_exports.enum(["simple", "full"]),
+      backend: BackendImplementationSchema.default("typescript"),
+      uiEnabled: external_exports.boolean(),
+      dataDir: external_exports.string().min(1),
+      supervisorPid: external_exports.number().int().positive().nullable(),
+      urls: InstanceUrlsSchema
+    }).strict();
+    InstanceConnectionSurfacesSchema = external_exports.object({
+      ui: external_exports.object({
+        enabled: external_exports.boolean(),
+        baseUrl: external_exports.url().nullable()
+      }).strict(),
+      control: external_exports.object({ baseUrl: external_exports.url() }).strict(),
+      agent: external_exports.object({ baseUrl: external_exports.url() }).strict()
+    }).strict();
+    InstanceConnectionOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      uiEnabled: external_exports.boolean(),
+      instance: InstanceStatusOutputSchema,
+      surfaces: InstanceConnectionSurfacesSchema,
+      /** @deprecated Use surfaces.control.baseUrl or surfaces.agent.baseUrl. */
+      baseUrl: external_exports.url(),
+      endpoints: InstanceUrlsSchema,
+      environment: external_exports.object({
+        ANTHROPIC_BASE_URL: external_exports.url(),
+        LLM_BASE_URL: external_exports.url(),
+        OPENAI_BASE_URL: external_exports.url(),
+        AGENT_INSPECTOR_MCP_URL: external_exports.url()
+      }).strict(),
+      mcp: external_exports.object({
+        serverName: external_exports.string().min(1),
+        transport: external_exports.literal("streamable-http"),
+        url: external_exports.url()
+      }).strict(),
+      codex: external_exports.object({
+        providerName: external_exports.string().min(1),
+        baseUrl: external_exports.url(),
+        wireApi: external_exports.literal("responses")
+      }).strict()
+    }).strict();
+    InstanceStartRequestSchema = external_exports.object({
+      port: external_exports.number().int().min(1).max(65535).optional(),
+      basePath: external_exports.string().min(1).max(2048).refine(
+        (value) => normalizePublicBasePath(value) !== null,
+        "Base Path must use URL-safe path segments without traversal, encoded separators, or markup characters"
+      ).optional(),
+      host: external_exports.string().min(1).max(253).refine(
+        (value) => value.trim() === value && !value.includes("://") && !value.includes("/") && !value.includes("\\") && !/\s/u.test(value),
+        "Host must be a hostname or IP address without protocol, path, or whitespace"
+      ).optional(),
+      captureMode: external_exports.enum(["simple", "full"]).optional(),
+      backend: BackendImplementationSchema.optional(),
+      uiEnabled: external_exports.boolean().optional(),
+      dataDir: external_exports.string().trim().min(1).max(32767).optional()
+    }).strict();
+    InstanceEmptyRequestSchema = external_exports.object({}).strict();
+    InstanceOperationSchema = external_exports.enum(["start", "stop", "restart"]);
+    InstanceOperationOutcomeSchema = external_exports.enum([
+      "created",
+      "started",
+      "already_running",
+      "stopped",
+      "already_stopped",
+      "restarted"
+    ]);
+    InstanceOperationOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      operation: InstanceOperationSchema,
+      outcome: InstanceOperationOutcomeSchema,
+      instance: InstanceStatusOutputSchema
+    }).strict();
+    InstanceListOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      instances: external_exports.array(InstanceStatusOutputSchema)
+    }).strict();
+    InstancePublicErrorCodeSchema = external_exports.enum([
+      "argument_invalid",
+      "config_mismatch",
+      "data_dir_conflict",
+      "data_dir_invalid",
+      "identity_mismatch",
+      "instance_not_found",
+      "launch_failed",
+      "launch_unavailable",
+      "lock_not_owned",
+      "lock_timeout",
+      "name_invalid",
+      "port_conflict",
+      "port_exhausted",
+      "port_invalid",
+      "record_invalid",
+      "registry_io",
+      "restart_failed_degraded",
+      "restart_failed_rolled_back",
+      "self_lifecycle_unsupported",
+      "shutdown_failed"
+    ]);
+    InstancePublicErrorSchema = external_exports.object({
+      code: InstancePublicErrorCodeSchema,
+      message: external_exports.string().min(1),
+      retryable: external_exports.boolean()
+    }).strict();
+    InstanceErrorOutputSchema = external_exports.object({
+      schemaVersion: external_exports.literal(INSTANCE_API_SCHEMA_VERSION),
+      error: InstancePublicErrorSchema
+    }).strict();
+  }
+});
+
+// src/proxy/privateDataPath.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import {
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  realpathSync
+} from "node:fs";
+import { join, parse as parse3, resolve as resolve2, sep } from "node:path";
+function windowsSystemPath(executable) {
+  const systemRoot = process.env["SystemRoot"] ?? "C:\\Windows";
+  return `${systemRoot}\\System32\\${executable}`;
+}
+function runWindowsCommand(executable, args) {
+  const resolved = process.platform === "win32" && /^(whoami|icacls)\.exe$/iu.test(executable) ? windowsSystemPath(executable) : executable;
+  const result = spawnSync2(resolved, [...args], {
+    encoding: "utf8",
+    shell: false,
+    windowsHide: true
+  });
+  return { status: result.status, stdout: result.stdout };
+}
+function windowsUserSid(output) {
+  const match = /S-\d+(?:-\d+)+/.exec(output);
+  return match?.[0] ?? null;
+}
+function resolveWindowsUserSid(run) {
+  if (run === runWindowsCommand && cachedWindowsSid !== null) return cachedWindowsSid;
+  const identity = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+  if (identity.status !== 0) return null;
+  const sid = windowsUserSid(identity.stdout);
+  if (run === runWindowsCommand) cachedWindowsSid = sid;
+  return sid;
+}
+function windowsBroadGroupRemovalArgs() {
+  return ["/remove:g", "*S-1-1-0", "*S-1-5-11", "*S-1-5-32-545"];
+}
+function applyWindowsAclWithSid(path2, kind, sid, run) {
+  const access = kind === "directory" ? `(OI)(CI)F` : "F";
+  const result = run("icacls.exe", [
+    path2,
+    "/inheritance:r",
+    "/grant:r",
+    `*${sid}:${access}`,
+    ...windowsBroadGroupRemovalArgs(),
+    "/q"
+  ]);
+  return result.status === 0;
+}
+function applyWindowsUserOnlyAcl(path2, kind, run = runWindowsCommand) {
+  const sid = resolveWindowsUserSid(run);
+  return sid !== null && applyWindowsAclWithSid(path2, kind, sid, run);
+}
+function comparablePath(path2) {
+  let normalized = path2;
+  if (process.platform === "win32") {
+    if (normalized.startsWith("\\\\?\\UNC\\")) {
+      normalized = `\\\\${normalized.slice(8)}`;
+    } else if (normalized.startsWith("\\\\?\\")) {
+      normalized = normalized.slice(4);
+    }
+  }
+  const absolute = resolve2(normalized);
+  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+}
+function pathIdentity(stats) {
+  return `${String(stats.dev)}:${String(stats.ino)}:${String(stats.birthtimeMs)}`;
+}
+function readPathEntry(path2) {
+  let stats;
+  try {
+    const observed = lstatSync(path2);
+    if (observed === void 0) return { status: "missing" };
+    stats = observed;
+  } catch {
+    return { status: "missing" };
+  }
+  if (stats.isSymbolicLink()) return { status: "unsafe" };
+  const kind = stats.isDirectory() ? "directory" : stats.isFile() ? "file" : null;
+  if (kind === null) return { status: "unsafe" };
+  let canonical;
+  try {
+    canonical = realpathSync.native(path2);
+  } catch {
+    return { status: "unsafe" };
+  }
+  if (comparablePath(canonical) !== comparablePath(path2)) return { status: "unsafe" };
+  return {
+    status: "ok",
+    entry: {
+      path: path2,
+      kind,
+      identity: pathIdentity(stats),
+      mode: stats.mode & 511
+    }
+  };
+}
+function snapshotPathChain(path2) {
+  const absolutePath = resolve2(path2);
+  const root = parse3(absolutePath).root;
+  const suffix = absolutePath.slice(root.length);
+  const parts = suffix === "" ? [] : suffix.split(sep).filter((part) => part !== "");
+  const entries = [];
+  let current = root;
+  const rootRead = readPathEntry(root);
+  if (rootRead.status !== "ok" || rootRead.entry.kind !== "directory") return null;
+  entries.push(rootRead.entry);
+  for (let index = 0; index < parts.length; index += 1) {
+    const part = parts[index];
+    if (part === void 0) return null;
+    current = join(current, part);
+    const read = readPathEntry(current);
+    if (read.status === "unsafe") return null;
+    if (read.status === "missing") {
+      return {
+        absolutePath,
+        complete: false,
+        entries,
+        missingParts: parts.slice(index)
+      };
+    }
+    if (index < parts.length - 1 && read.entry.kind !== "directory") return null;
+    entries.push(read.entry);
+  }
+  return { absolutePath, complete: true, entries, missingParts: [] };
+}
+function chainFingerprint(snapshot) {
+  return snapshot.entries.map((entry) => `${entry.path}:${entry.identity}`).join("|");
+}
+function snapshotsRetainPrefix(before, after) {
+  if (after.entries.length < before.entries.length) return false;
+  return before.entries.every((entry, index) => {
+    const next = after.entries[index];
+    return next !== void 0 && next.path === entry.path && next.identity === entry.identity;
+  });
+}
+function completeSnapshotForKind(path2, kind) {
+  const snapshot = snapshotPathChain(path2);
+  if (snapshot === null || !snapshot.complete) return null;
+  const leaf = snapshot.entries.at(-1);
+  return leaf !== void 0 && leaf.kind === kind ? snapshot : null;
+}
+function applyPosixPermissions(path2, kind, expectedIdentity2) {
+  let descriptor = null;
+  try {
+    const directoryFlag = kind === "directory" ? constants.O_DIRECTORY : 0;
+    descriptor = openSync(path2, constants.O_RDONLY | constants.O_NOFOLLOW | directoryFlag);
+    const before = fstatSync(descriptor);
+    if (pathIdentity(before) !== expectedIdentity2) return false;
+    fchmodSync(descriptor, kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+    const after = fstatSync(descriptor);
+    return pathIdentity(after) === expectedIdentity2 && (after.mode & 511) === (kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+  } catch {
+    return false;
+  } finally {
+    if (descriptor !== null) {
+      try {
+        closeSync(descriptor);
+      } catch {
+      }
+    }
+  }
+}
+function permissionsArePrivate(entry) {
+  if (process.platform === "win32") return true;
+  return entry.mode === (entry.kind === "directory" ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE);
+}
+function secureExistingPath(path2, kind, forcePermissions = false) {
+  const before = completeSnapshotForKind(path2, kind);
+  if (before === null) return false;
+  const leaf = before.entries.at(-1);
+  if (leaf === void 0) return false;
+  const cacheKey = `${kind}:${before.absolutePath}`;
+  const beforeFingerprint = chainFingerprint(before);
+  if (!forcePermissions && securedPathFingerprints.get(cacheKey) === beforeFingerprint && permissionsArePrivate(leaf)) {
+    const cachedCheck = completeSnapshotForKind(path2, kind);
+    return cachedCheck !== null && chainFingerprint(cachedCheck) === beforeFingerprint;
+  }
+  const applied = process.platform === "win32" ? applyWindowsUserOnlyAcl(path2, kind) : applyPosixPermissions(path2, kind, leaf.identity);
+  if (!applied) return false;
+  const after = completeSnapshotForKind(path2, kind);
+  if (after === null || !snapshotsRetainPrefix(before, after)) return false;
+  const afterLeaf = after.entries.at(-1);
+  if (afterLeaf === void 0 || afterLeaf.identity !== leaf.identity) return false;
+  if (!permissionsArePrivate(afterLeaf)) return false;
+  securedPathFingerprints.set(cacheKey, chainFingerprint(after));
+  return true;
+}
+function ensurePrivateDirectorySync(path2) {
+  const before = snapshotPathChain(path2);
+  if (before === null) return false;
+  let current = before.entries.at(-1)?.path;
+  if (current === void 0) return false;
+  for (const part of before.missingParts) {
+    const next = join(current, part);
+    try {
+      mkdirSync(next, { mode: PRIVATE_DIRECTORY_MODE });
+    } catch {
+      const raced = readPathEntry(next);
+      if (raced.status !== "ok" || raced.entry.kind !== "directory") return false;
+    }
+    if (!secureExistingPath(next, "directory", true)) return false;
+    current = next;
+  }
+  const complete = completeSnapshotForKind(path2, "directory");
+  if (complete === null || !snapshotsRetainPrefix(before, complete)) return false;
+  return secureExistingPath(path2, "directory");
+}
+function securePrivateFileSync(path2, forceAcl = false) {
+  return secureExistingPath(path2, "file", forceAcl);
+}
+function collectSafeTree(root) {
+  const collected = [];
+  const visit = (path2) => {
+    const snapshot = snapshotPathChain(path2);
+    if (snapshot === null || !snapshot.complete) return false;
+    const leaf = snapshot.entries.at(-1);
+    if (leaf === void 0) return false;
+    const fingerprint = chainFingerprint(snapshot);
+    collected.push({ path: snapshot.absolutePath, kind: leaf.kind, fingerprint });
+    if (leaf.kind === "file") return true;
+    let entries;
+    try {
+      entries = readdirSync(path2);
+    } catch {
+      return false;
+    }
+    const afterRead = completeSnapshotForKind(path2, "directory");
+    if (afterRead === null || chainFingerprint(afterRead) !== fingerprint) return false;
+    for (const entry of entries) {
+      if (!visit(join(path2, entry))) return false;
+    }
+    return true;
+  };
+  return visit(root) ? collected : null;
+}
+function treeFingerprintsMatch(expected, observed) {
+  if (observed === null || observed.length !== expected.length) return false;
+  return expected.every((entry, index) => {
+    const next = observed[index];
+    return next !== void 0 && next.path === entry.path && next.kind === entry.kind && next.fingerprint === entry.fingerprint;
+  });
+}
+function isPathTreeFreeOfIndirectionSync(root) {
+  return collectSafeTree(root) !== null;
+}
+function applyWindowsUserOnlyTreeAcl(root, run = runWindowsCommand) {
+  const entries = collectSafeTree(root);
+  if (entries === null) return false;
+  const sid = resolveWindowsUserSid(run);
+  if (sid === null) return false;
+  for (const entry of entries) {
+    const before = completeSnapshotForKind(entry.path, entry.kind);
+    if (before === null || chainFingerprint(before) !== entry.fingerprint) return false;
+    if (!applyWindowsAclWithSid(entry.path, entry.kind, sid, run)) return false;
+    const after = completeSnapshotForKind(entry.path, entry.kind);
+    if (after === null || chainFingerprint(after) !== entry.fingerprint) return false;
+    securedPathFingerprints.set(`${entry.kind}:${entry.path}`, entry.fingerprint);
+  }
+  return treeFingerprintsMatch(entries, collectSafeTree(root));
+}
+function securePrivateTreeSync(root) {
+  const entries = collectSafeTree(root);
+  if (entries === null) return false;
+  if (process.platform === "win32") return applyWindowsUserOnlyTreeAcl(root);
+  for (const entry of entries) {
+    if (!secureExistingPath(entry.path, entry.kind, true)) return false;
+  }
+  return treeFingerprintsMatch(entries, collectSafeTree(root));
+}
+var PRIVATE_DIRECTORY_MODE, PRIVATE_FILE_MODE, securedPathFingerprints, cachedWindowsSid;
+var init_privateDataPath = __esm({
+  "src/proxy/privateDataPath.ts"() {
+    "use strict";
+    PRIVATE_DIRECTORY_MODE = 448;
+    PRIVATE_FILE_MODE = 384;
+    securedPathFingerprints = /* @__PURE__ */ new Map();
+    cachedWindowsSid = null;
+  }
+});
+
+// src/proxy/dataDir.ts
+import { cpSync, existsSync as existsSync2, readdirSync as readdirSync2, renameSync, rmSync } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join2 } from "node:path";
+function getDataDir() {
+  migrateLegacyDataDirs();
+  return resolveDataDir(existsSync2);
+}
+function hasDataDirState(pathExists, dir) {
+  return pathExists(join2(dir, "providers.json")) || pathExists(join2(dir, "config.json")) || pathExists(join2(dir, "logs")) || pathExists(join2(dir, "chunks"));
+}
+function defaultBaseDir(env = process.env, platform = process.platform) {
+  return platform === "win32" ? env["USERPROFILE"] ?? env["APPDATA"] ?? "C:\\" : env["HOME"] ?? "/tmp";
+}
+function resolveDataDir(_pathExists, env = process.env, platform = process.platform) {
+  const base = defaultBaseDir(env, platform);
+  const dirEnv = env["AGENT_INSPECTOR_DATA_DIR"];
+  if (dirEnv !== void 0 && dirEnv !== "") {
+    return isAbsolute2(dirEnv) ? dirEnv : join2(base, dirEnv);
+  }
+  const legacyDirEnv = env["AGENT_INSPECTOR_CONFIG_DIR"];
+  if (legacyDirEnv !== void 0 && legacyDirEnv !== "") {
+    return isAbsolute2(legacyDirEnv) ? legacyDirEnv : join2(base, legacyDirEnv);
+  }
+  return join2(base, CURRENT_DATA_DIR_NAME);
+}
+function hasExplicitDataDir() {
+  return process.env["AGENT_INSPECTOR_DATA_DIR"] !== void 0 && process.env["AGENT_INSPECTOR_DATA_DIR"] !== "" || process.env["AGENT_INSPECTOR_CONFIG_DIR"] !== void 0 && process.env["AGENT_INSPECTOR_CONFIG_DIR"] !== "";
+}
+function migrateLegacyDataDirs() {
+  if (hasExplicitDataDir()) return;
+  const base = defaultBaseDir();
+  const currentDir = join2(base, CURRENT_DATA_DIR_NAME);
+  if (hasDataDirState(existsSync2, currentDir)) return;
+  for (const legacyName of LEGACY_DATA_DIR_NAMES) {
+    const legacyDir = join2(base, legacyName);
+    if (!existsSync2(legacyDir)) continue;
+    const stagingDir = join2(
+      base,
+      `${CURRENT_DATA_DIR_NAME}.migration-${String(process.pid)}-${String(Date.now())}`
+    );
+    try {
+      if (!isPathTreeFreeOfIndirectionSync(legacyDir)) return;
+      if (existsSync2(currentDir)) {
+        if (readdirSync2(currentDir).length > 0) return;
+        rmSync(currentDir, { recursive: true, force: false });
+      }
+      if (!ensurePrivateDirectorySync(stagingDir)) return;
+      for (const entry of readdirSync2(legacyDir)) {
+        cpSync(join2(legacyDir, entry), join2(stagingDir, entry), {
+          recursive: true,
+          force: false,
+          errorOnExist: true
+        });
+      }
+      if (!isPathTreeFreeOfIndirectionSync(legacyDir)) {
+        rmSync(stagingDir, { recursive: true, force: true });
+        return;
+      }
+      if (!securePrivateTreeSync(stagingDir)) {
+        rmSync(stagingDir, { recursive: true, force: true });
+        return;
+      }
+      renameSync(stagingDir, currentDir);
+      rmSync(legacyDir, { recursive: true, force: true });
+      return;
+    } catch {
+      if (existsSync2(stagingDir)) rmSync(stagingDir, { recursive: true, force: true });
+      return;
+    }
+  }
+}
+var CURRENT_DATA_DIR_NAME, LEGACY_DATA_DIR_NAMES;
+var init_dataDir = __esm({
+  "src/proxy/dataDir.ts"() {
+    "use strict";
+    init_privateDataPath();
+    CURRENT_DATA_DIR_NAME = ".agent-inspector";
+    LEGACY_DATA_DIR_NAMES = [".llm-inspector", ".llm-agent"];
+  }
+});
+
+// src/proxy/platformCommands.ts
+import { statSync as statSync2 } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { delimiter, isAbsolute as isAbsolute3, join as join3 } from "node:path";
 function pathEntries(envPath) {
   if (envPath === void 0 || envPath.length === 0) return [];
   return envPath.split(delimiter).filter((entry) => entry.length > 0);
@@ -16277,7 +16790,7 @@ Usage:
   agent-inspector instance restart <name> [options]
 
 Start/restart options:
-  --backend <typescript|rust> Persist the backend implementation (default: typescript)
+  --backend <typescript|rust> Persist the backend implementation (default: rust when native package is available)
   --port, -p <port>       Public ingress port (auto-allocated on first start)
   --base-path <path>      Public Base Path (default: /inspector; use / for root)
   --host, -H <host>       Bind host (default: 127.0.0.1)
@@ -17427,6 +17940,9 @@ function validateInstanceDataDirectory(rawPath, records, excludeName) {
   }
   return success2(assigned.value.path);
 }
+function resolveDefaultInstanceBackend(deps) {
+  return deps.resolveDefaultBackend?.() ?? resolvePreferredBackendImplementation({ rootVersion: package_default.version });
+}
 async function createNewRecord(root, action, deps) {
   const recordsResult = listInstanceRecords(root);
   if (recordsResult.kind === "error") return fromRegistry(recordsResult);
@@ -17450,7 +17966,7 @@ async function createNewRecord(root, action, deps) {
     upstreamPort: pairResult.value.upstreamPort,
     basePath: action.overrides.basePath ?? getConfiguredBasePath(process.env),
     captureMode: action.overrides.captureMode ?? DEFAULT_INSTANCE_CAPTURE_MODE,
-    backend: action.overrides.backend ?? "typescript",
+    backend: action.overrides.backend ?? resolveDefaultInstanceBackend(deps),
     uiEnabled: action.overrides.uiEnabled ?? true,
     dataDir: dataDirResult.value
   });
@@ -17827,6 +18343,7 @@ var DEFAULT_INSTANCE_HOST, DEFAULT_INSTANCE_CAPTURE_MODE, INSTANCE_READY_TIMEOUT
 var init_instance = __esm({
   "src/cli/instance.ts"() {
     "use strict";
+    init_package();
     init_basePath();
     init_instanceContract();
     init_managedInstance();
@@ -17836,6 +18353,7 @@ var init_instance = __esm({
     init_instanceControl();
     init_instanceRegistry();
     init_networkHints();
+    init_rustBackendPackage();
     DEFAULT_INSTANCE_HOST = "127.0.0.1";
     DEFAULT_INSTANCE_CAPTURE_MODE = "simple";
     INSTANCE_READY_TIMEOUT_MS = 15e3;
@@ -20542,1336 +21060,839 @@ function providerCountFromParsed(value) {
 }
 function providerCountFromJson(raw) {
   try {
-    const parsed = JSON.parse(raw);
-    return providerCountFromParsed(parsed);
-  } catch {
-    return "invalid";
-  }
-}
-function resolveMaybeRelative(base, value) {
-  return isAbsolute5(value) ? value : resolve5(base, value);
-}
-function resolveDefaultDataDir(env, platform, exists) {
-  return resolveDataDir(exists, env, platform);
-}
-function providerConfigCandidates(options, deps) {
-  const explicitPath = deps.env["AGENT_INSPECTOR_CONFIG_PATH"];
-  if (explicitPath !== void 0 && explicitPath !== "") {
-    return [resolveMaybeRelative(deps.cwd, explicitPath)];
-  }
-  if (options.configDir !== null) {
-    const dir = resolveMaybeRelative(deps.cwd, options.configDir);
-    return [join8(dir, "providers.json"), join8(dir, "config.json")];
-  }
-  const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
-  return [join8(dataDir, "providers.json"), join8(dataDir, "config.json")];
-}
-function checkProviderConfig(options, deps) {
-  const providersJson = options.providersJson ?? deps.env["AGENT_INSPECTOR_PROVIDERS_JSON"] ?? null;
-  if (providersJson !== null) {
-    const count = providerCountFromJson(providersJson);
-    if (count === "invalid") {
-      return check2(
-        "Provider config",
-        "fail",
-        "Provider JSON override is not valid JSON.",
-        "Fix --providers or AGENT_INSPECTOR_PROVIDERS_JSON; doctor never prints the raw value."
-      );
-    }
-    if (count !== null) {
-      return check2("Provider config", "pass", `${count} provider(s) found in JSON override.`);
-    }
-    return check2(
-      "Provider config",
-      "fail",
-      "Provider JSON override does not look like a provider array or { providers } object.",
-      "Use an exported providers JSON payload or configure providers in the UI."
-    );
-  }
-  const candidates = providerConfigCandidates(options, deps);
-  for (const candidate of candidates) {
-    if (!deps.exists(candidate)) continue;
-    const text = deps.readText(candidate);
-    if (text === null) {
-      return check2(
-        "Provider config",
-        "fail",
-        `Provider config exists but could not be read: ${candidate}`
-      );
-    }
-    const count = providerCountFromJson(text);
-    if (count === "invalid") {
-      return check2("Provider config", "fail", `Provider config is invalid JSON: ${candidate}`);
-    }
-    if (count !== null && count > 0) {
-      return check2("Provider config", "pass", `${count} provider(s) configured.`);
-    }
-    return check2(
-      "Provider config",
-      "warn",
-      `Provider config exists but no providers were found: ${candidate}`,
-      "Add a provider through the control API/MCP, or use Settings when a UI is available."
-    );
-  }
-  return check2(
-    "Provider config",
-    "warn",
-    "No provider config was found.",
-    "Add a provider through the control API/MCP, use Settings when a UI is available, or pass --providers for this check."
-  );
-}
-function publicOriginForDoctor(port, env) {
-  const configured = env["AGENT_INSPECTOR_PUBLIC_ORIGIN"];
-  if (configured !== void 0 && configured.trim() === configured) {
-    try {
-      const parsed = new URL(configured);
-      if ((parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username.length === 0 && parsed.password.length === 0 && parsed.pathname === "/" && parsed.search.length === 0 && parsed.hash.length === 0) {
-        return parsed.origin;
-      }
-    } catch {
-    }
-  }
-  return `http://localhost:${String(port)}`;
-}
-async function checkProxyHealth(port, deps) {
-  const basePath = getConfiguredBasePath(deps.env);
-  const health = await deps.fetchHealth(port, basePath);
-  const url2 = publicOriginForDoctor(port, deps.env);
-  const proxyUrl = appendBasePathToOrigin(url2, "/proxy", basePath);
-  const healthPath = appendBasePathToOrigin("", "/api/health", basePath);
-  if (health.ok) {
-    return check2(
-      "Backend health",
-      "pass",
-      `Agent Inspector backend is healthy at ${appendBasePathToOrigin(url2, "/", basePath)}.`,
-      `Agent proxy URL: ${proxyUrl}. UI availability is not part of this backend check.`
-    );
-  }
-  if (await deps.isPortOpen(port)) {
-    const suffix = health.status === null ? "" : ` (HTTP ${health.status})`;
-    return check2(
-      "Backend health",
-      "fail",
-      `Port ${port} is accepting connections, but ${healthPath} is not healthy${suffix}.`,
-      "Stop that process, choose --port <n>, or start agent-inspector with --force-restart."
-    );
-  }
-  return check2(
-    "Backend health",
-    "warn",
-    `No process is listening on port ${port}.`,
-    "Start with `agent-inspector`, `agent-inspector --background`, or `bun run dev`."
-  );
-}
-function findProjectRoot(startDir, deps) {
-  let current = resolve5(startDir);
-  for (let i = 0; i < 6; i++) {
-    if (deps.exists(join8(current, "package.json"))) return current;
-    const next = resolve5(current, "..");
-    if (next === current) return startDir;
-    current = next;
-  }
-  return startDir;
-}
-function checkPackage(rootDir, deps) {
-  const packagePath = join8(rootDir, "package.json");
-  const text = deps.readText(packagePath);
-  if (text === null) {
-    return check2("Package metadata", "warn", "package.json was not found near the CLI bundle.");
-  }
-  try {
-    const parsed = JSON.parse(text);
-    if (!isObject3(parsed)) {
-      return check2("Package metadata", "warn", "package.json is not an object.");
-    }
-    const name = parsed["name"];
-    const version2 = parsed["version"];
-    if (typeof name === "string" && typeof version2 === "string") {
-      return check2("Package metadata", "pass", `${name}@${version2}`);
-    }
-    return check2("Package metadata", "warn", "package.json is missing name or version.");
-  } catch {
-    return check2("Package metadata", "warn", "package.json is not valid JSON.");
-  }
-}
-function countFilesInDir(dir, deps) {
-  const files = deps.listDir(dir);
-  if (files === null) return null;
-  let count = 0;
-  for (const file2 of files) {
-    const fileStat = deps.stat(join8(dir, file2));
-    if (fileStat !== null && !fileStat.isDirectory) count += 1;
-  }
-  return count;
-}
-function formatBytes(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KiB`;
-  if (bytes < 1024 * 1024 * 1024) return `${(bytes / 1024 / 1024).toFixed(1)} MiB`;
-  return `${(bytes / 1024 / 1024 / 1024).toFixed(1)} GiB`;
-}
-function dirSize(dir, deps, depth = 0) {
-  const dirStat = deps.stat(dir);
-  if (dirStat === null) return null;
-  if (!dirStat.isDirectory) return dirStat.size;
-  if (depth > 4) return 0;
-  const files = deps.listDir(dir);
-  if (files === null) return null;
-  let total = 0;
-  for (const file2 of files) {
-    const childSize = dirSize(join8(dir, file2), deps, depth + 1);
-    if (childSize !== null) total += childSize;
-  }
-  return total;
-}
-function verboseChecks(options, deps) {
-  const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
-  const logsDir = join8(dataDir, "logs");
-  const chunksDir = join8(dataDir, "chunks");
-  const providerCandidates = providerConfigCandidates(options, deps);
-  const captureMode = deps.env["AGENT_INSPECTOR_MODE"] ?? deps.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? "simple";
-  const logCount = countFilesInDir(logsDir, deps);
-  const logSize = dirSize(logsDir, deps);
-  const chunkSize = dirSize(chunksDir, deps);
-  const homeDir = deps.platform === "win32" ? deps.env["USERPROFILE"] ?? deps.env["APPDATA"] ?? null : deps.env["HOME"] ?? null;
-  const claudeSkill = homeDir === null ? null : join8(homeDir, ".claude", "skills", "agent-inspector-onboard", "SKILL.md");
-  const claudeCommand = homeDir === null ? null : join8(homeDir, ".claude", "commands", "agent-inspector-onboard.md");
-  const codexSkill = homeDir === null ? null : join8(homeDir, ".codex", "skills", "agent-inspector-onboard", "SKILL.md");
-  const hasClaudeOnboarding = claudeSkill !== null && claudeCommand !== null && deps.exists(claudeSkill) && deps.exists(claudeCommand);
-  const hasCodexOnboarding = codexSkill !== null && deps.exists(codexSkill);
-  return [
-    check2("Data directory", "pass", dataDir),
-    check2("Provider config search", "pass", providerCandidates.join(", ")),
-    check2("Capture mode env", "pass", captureMode),
-    check2(
-      "Log storage",
-      logCount === null ? "warn" : "pass",
-      logCount === null ? `Log directory was not found or could not be read: ${logsDir}` : `${logCount} file(s), ${formatBytes(logSize ?? 0)} under ${logsDir}`
-    ),
-    check2(
-      "Chunk storage",
-      chunkSize === null ? "warn" : "pass",
-      chunkSize === null ? `Chunk directory was not found or could not be read: ${chunksDir}` : `${formatBytes(chunkSize)} under ${chunksDir}`
-    ),
-    check2(
-      "Claude onboarding",
-      hasClaudeOnboarding ? "pass" : "warn",
-      hasClaudeOnboarding ? "Claude Code skill and slash command are installed." : "Claude Code onboarding files were not found.",
-      "Run `agent-inspector onboard --force` after installing or upgrading."
-    ),
-    check2(
-      "Codex onboarding",
-      hasCodexOnboarding ? "pass" : "warn",
-      hasCodexOnboarding ? "Codex onboarding skill is installed." : "Codex onboarding skill was not found.",
-      "Run `agent-inspector onboard --force` after installing or upgrading."
-    )
-  ];
-}
-function checkExtensionSource(rootDir, deps) {
-  const extensionDir = join8(rootDir, "extensions", "chrome");
-  const missing = EXTENSION_REQUIRED_FILES.filter((file2) => !deps.exists(join8(extensionDir, file2)));
-  if (missing.length === 0) {
-    return check2(
-      "Chrome extension source",
-      "pass",
-      "Manifest, side panel, service worker, and icons are present."
-    );
-  }
-  return check2(
-    "Chrome extension source",
-    "fail",
-    `Missing ${missing.length} Chrome extension file(s): ${missing.join(", ")}`,
-    "Restore the extension files before packaging or loading unpacked."
-  );
-}
-function extensionManifestVersion(rootDir, deps) {
-  const manifestText = deps.readText(join8(rootDir, "extensions", "chrome", "manifest.json"));
-  if (manifestText === null) return null;
-  try {
-    const manifest = JSON.parse(manifestText);
-    if (!isObject3(manifest)) return null;
-    const version2 = manifest["version"];
-    return typeof version2 === "string" && version2 !== "" ? version2 : null;
+    const parsed = JSON.parse(raw);
+    return providerCountFromParsed(parsed);
   } catch {
-    return null;
+    return "invalid";
   }
 }
-function checkExtensionPackage(rootDir, deps) {
-  const distDir = join8(rootDir, "dist", "chrome-extension");
-  const files = deps.listDir(distDir);
-  if (files === null) {
-    return check2(
-      "Chrome extension package",
-      "warn",
-      "No packaged Chrome extension artifact was found.",
-      "Run `npm run extension:zip` before Chrome Web Store upload."
-    );
+function resolveMaybeRelative(base, value) {
+  return isAbsolute5(value) ? value : resolve5(base, value);
+}
+function resolveDefaultDataDir(env, platform, exists) {
+  return resolveDataDir(exists, env, platform);
+}
+function providerConfigCandidates(options, deps) {
+  const explicitPath = deps.env["AGENT_INSPECTOR_CONFIG_PATH"];
+  if (explicitPath !== void 0 && explicitPath !== "") {
+    return [resolveMaybeRelative(deps.cwd, explicitPath)];
   }
-  const manifestVersion = extensionManifestVersion(rootDir, deps);
-  if (manifestVersion !== null) {
-    const zipName = `agent-inspector-companion-v${manifestVersion}.zip`;
-    const checksumName = `${zipName}.sha256`;
-    const hasZip = files.includes(zipName);
-    const hasChecksum = files.includes(checksumName);
-    if (hasZip && hasChecksum) {
-      return check2("Chrome extension package", "pass", `${zipName} with checksum is present.`);
-    }
-    if (hasZip) {
+  if (options.configDir !== null) {
+    const dir = resolveMaybeRelative(deps.cwd, options.configDir);
+    return [join8(dir, "providers.json"), join8(dir, "config.json")];
+  }
+  const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
+  return [join8(dataDir, "providers.json"), join8(dataDir, "config.json")];
+}
+function checkProviderConfig(options, deps) {
+  const providersJson = options.providersJson ?? deps.env["AGENT_INSPECTOR_PROVIDERS_JSON"] ?? null;
+  if (providersJson !== null) {
+    const count = providerCountFromJson(providersJson);
+    if (count === "invalid") {
       return check2(
-        "Chrome extension package",
-        "warn",
-        `${zipName} exists but no .sha256 checksum was found.`,
-        "Run `npm run extension:zip` to regenerate the zip and checksum."
+        "Provider config",
+        "fail",
+        "Provider JSON override is not valid JSON.",
+        "Fix --providers or AGENT_INSPECTOR_PROVIDERS_JSON; doctor never prints the raw value."
       );
     }
+    if (count !== null) {
+      return check2("Provider config", "pass", `${count} provider(s) found in JSON override.`);
+    }
     return check2(
-      "Chrome extension package",
-      "warn",
-      `Current Chrome extension package was not found: ${zipName}`,
-      "Run `npm run extension:zip` before Chrome Web Store upload."
+      "Provider config",
+      "fail",
+      "Provider JSON override does not look like a provider array or { providers } object.",
+      "Use an exported providers JSON payload or configure providers in the UI."
     );
   }
-  const zip = files.find((file2) => file2.endsWith(".zip"));
-  const checksum = files.find((file2) => file2.endsWith(".zip.sha256"));
-  if (zip !== void 0 && checksum !== void 0) {
-    return check2("Chrome extension package", "pass", `${zip} with checksum is present.`);
-  }
-  if (zip !== void 0) {
+  const candidates = providerConfigCandidates(options, deps);
+  for (const candidate of candidates) {
+    if (!deps.exists(candidate)) continue;
+    const text = deps.readText(candidate);
+    if (text === null) {
+      return check2(
+        "Provider config",
+        "fail",
+        `Provider config exists but could not be read: ${candidate}`
+      );
+    }
+    const count = providerCountFromJson(text);
+    if (count === "invalid") {
+      return check2("Provider config", "fail", `Provider config is invalid JSON: ${candidate}`);
+    }
+    if (count !== null && count > 0) {
+      return check2("Provider config", "pass", `${count} provider(s) configured.`);
+    }
     return check2(
-      "Chrome extension package",
+      "Provider config",
       "warn",
-      `${zip} exists but no .sha256 checksum was found.`,
-      "Run `npm run extension:zip` to regenerate the zip and checksum."
+      `Provider config exists but no providers were found: ${candidate}`,
+      "Add a provider through the control API/MCP, or use Settings when a UI is available."
     );
   }
   return check2(
-    "Chrome extension package",
+    "Provider config",
     "warn",
-    "No Chrome extension zip artifact was found.",
-    "Run `npm run extension:zip` before Chrome Web Store upload."
-  );
-}
-async function buildDoctorReport(options, deps = createDoctorDeps()) {
-  const rootDir = findProjectRoot(deps.cwd, deps);
-  const coreChecks = [
-    await checkProxyHealth(options.port, deps),
-    checkProviderConfig(options, deps),
-    checkPackage(rootDir, deps)
-  ];
-  const checksWithExtension = options.chromeExtension ? [...coreChecks, checkExtensionSource(rootDir, deps), checkExtensionPackage(rootDir, deps)] : coreChecks;
-  const checks = options.verbose ? [...checksWithExtension, ...verboseChecks(options, deps)] : checksWithExtension;
-  const passCount = checks.filter((item) => item.severity === "pass").length;
-  const warnCount = checks.filter((item) => item.severity === "warn").length;
-  const failCount = checks.filter((item) => item.severity === "fail").length;
-  return {
-    checks,
-    passCount,
-    warnCount,
-    failCount,
-    exitCode: failCount > 0 ? 1 : 0
-  };
-}
-function formatDoctorReport(report) {
-  const lines = ["agent-inspector doctor", ""];
-  for (const item of report.checks) {
-    lines.push(`${item.severity.toUpperCase().padEnd(4)} ${item.name}: ${item.message}`);
-    if (item.hint !== null) {
-      lines.push(`     ${item.hint}`);
-    }
-  }
-  lines.push("");
-  lines.push(
-    `Summary: ${report.passCount} pass, ${report.warnCount} warn, ${report.failCount} fail`
+    "No provider config was found.",
+    "Add a provider through the control API/MCP, use Settings when a UI is available, or pass --providers for this check."
   );
-  return `${lines.join("\n")}
-`;
-}
-function formatDoctorJson(report) {
-  return `${JSON.stringify(report, null, 2)}
-`;
-}
-function doctorHelp() {
-  return [
-    "agent-inspector doctor",
-    "",
-    "Usage:",
-    "  agent-inspector doctor [--port <port>] [--config-dir <dir>] [--providers <json>] [--fix] [--json] [--verbose] [--chrome-extension]",
-    "",
-    "Checks local backend health, provider config presence, and package metadata.",
-    "The backend check probes the local health endpoint and does not require a composed Web UI.",
-    "Pass --fix to run safe local repairs before checks, including legacy data-dir migration.",
-    "Pass --json to emit a machine-readable report for CI, scripts, and Jenkins.",
-    "Pass --verbose to include local paths, capture mode, and log storage checks.",
-    "Pass --chrome-extension to also check Chrome companion source and packaged artifacts.",
-    ""
-  ].join("\n");
 }
-async function fetchHealth(port, basePath) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
-  try {
-    const response = await fetch(
-      appendBasePathToOrigin(`http://127.0.0.1:${port}`, "/api/health", basePath),
-      {
-        cache: "no-store",
-        signal: controller.signal
+function publicOriginForDoctor(port, env) {
+  const configured = env["AGENT_INSPECTOR_PUBLIC_ORIGIN"];
+  if (configured !== void 0 && configured.trim() === configured) {
+    try {
+      const parsed = new URL(configured);
+      if ((parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.username.length === 0 && parsed.password.length === 0 && parsed.pathname === "/" && parsed.search.length === 0 && parsed.hash.length === 0) {
+        return parsed.origin;
       }
-    );
-    return { ok: response.ok, status: response.status };
-  } catch {
-    return { ok: false, status: null };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function isPortOpen(port) {
-  return new Promise((resolveOpen) => {
-    const socket = createConnection({ host: "127.0.0.1", port });
-    const finish = (value) => {
-      socket.removeAllListeners();
-      socket.destroy();
-      resolveOpen(value);
-    };
-    socket.setTimeout(PROBE_TIMEOUT_MS);
-    socket.once("connect", () => finish(true));
-    socket.once("timeout", () => finish(false));
-    socket.once("error", () => finish(false));
-  });
-}
-function readText(path2) {
-  try {
-    return readFileSync4(path2, "utf8");
-  } catch {
-    return null;
-  }
-}
-function listDir(path2) {
-  try {
-    return readdirSync5(path2);
-  } catch {
-    return null;
-  }
-}
-function stat3(path2) {
-  try {
-    const fileStat = statSync4(path2);
-    return { isDirectory: fileStat.isDirectory(), size: fileStat.size };
-  } catch {
-    return null;
+    } catch {
+    }
   }
+  return `http://localhost:${String(port)}`;
 }
-function createDoctorDeps() {
-  return {
-    env: process.env,
-    platform: process.platform,
-    cwd: process.cwd(),
-    exists: existsSync7,
-    readText,
-    listDir,
-    stat: stat3,
-    fetchHealth,
-    isPortOpen
-  };
-}
-async function runDoctor(argv) {
-  const parsed = parseDoctorArgs(argv);
-  if (parsed.kind === "error") {
-    process.stderr.write(`${parsed.message}
-`);
-    return 2;
-  }
-  if (parsed.options.help) {
-    process.stdout.write(doctorHelp());
-    return 0;
+async function checkProxyHealth(port, deps) {
+  const basePath = getConfiguredBasePath(deps.env);
+  const health = await deps.fetchHealth(port, basePath);
+  const url2 = publicOriginForDoctor(port, deps.env);
+  const proxyUrl = appendBasePathToOrigin(url2, "/proxy", basePath);
+  const healthPath = appendBasePathToOrigin("", "/api/health", basePath);
+  if (health.ok) {
+    return check2(
+      "Backend health",
+      "pass",
+      `Agent Inspector backend is healthy at ${appendBasePathToOrigin(url2, "/", basePath)}.`,
+      `Agent proxy URL: ${proxyUrl}. UI availability is not part of this backend check.`
+    );
   }
-  if (parsed.options.fix) {
-    migrateLegacyDataDirs();
+  if (await deps.isPortOpen(port)) {
+    const suffix = health.status === null ? "" : ` (HTTP ${health.status})`;
+    return check2(
+      "Backend health",
+      "fail",
+      `Port ${port} is accepting connections, but ${healthPath} is not healthy${suffix}.`,
+      "Stop that process, choose --port <n>, or start agent-inspector with --force-restart."
+    );
   }
-  const report = await buildDoctorReport(parsed.options);
-  process.stdout.write(parsed.options.json ? formatDoctorJson(report) : formatDoctorReport(report));
-  return report.exitCode;
+  return check2(
+    "Backend health",
+    "warn",
+    `No process is listening on port ${port}.`,
+    "Start with `agent-inspector`, `agent-inspector --background`, or `bun run dev`."
+  );
 }
-var DEFAULT_PORT3, PROBE_TIMEOUT_MS, EXTENSION_REQUIRED_FILES;
-var init_doctor = __esm({
-  "src/cli/doctor.ts"() {
-    "use strict";
-    init_basePath();
-    init_dataDir();
-    DEFAULT_PORT3 = 9527;
-    PROBE_TIMEOUT_MS = 2e3;
-    EXTENSION_REQUIRED_FILES = [
-      "manifest.json",
-      "sidepanel.html",
-      "sidepanel.js",
-      "sidepanel.css",
-      "service-worker.js",
-      "icons/icon.svg",
-      "icons/icon-16.png",
-      "icons/icon-32.png",
-      "icons/icon-48.png",
-      "icons/icon-128.png"
-    ];
+function findProjectRoot(startDir, deps) {
+  let current = resolve5(startDir);
+  for (let i = 0; i < 6; i++) {
+    if (deps.exists(join8(current, "package.json"))) return current;
+    const next = resolve5(current, "..");
+    if (next === current) return startDir;
+    current = next;
   }
-});
-
-// src/cli/alias.ts
-var alias_exports = {};
-__export(alias_exports, {
-  parseAliasArgs: () => parseAliasArgs,
-  runAlias: () => runAlias
-});
-function parsePort3(raw) {
-  if (raw === void 0 || raw.trim() === "") return null;
-  const port = Number(raw);
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
-  return port;
-}
-function normalizeAliasPath(raw) {
-  return normalizePublicBasePath(raw);
-}
-function isValidHost(host) {
-  const trimmed = host.trim();
-  return trimmed.length > 0 && !trimmed.includes("://") && !trimmed.includes("/") && !trimmed.includes("?") && !trimmed.includes("#") && !/\s/u.test(trimmed);
-}
-function formatHostForUrl(host) {
-  if (host.startsWith("[") && host.endsWith("]")) return host;
-  return host.includes(":") ? `[${host}]` : host;
+  return startDir;
 }
-function parseAliasArgs(argv) {
-  let host = DEFAULT_ALIAS_HOST;
-  let port = DEFAULT_ALIAS_PORT;
-  let json2 = false;
-  let help = false;
-  const positional = [];
-  for (let index = 0; index < argv.length; index++) {
-    const arg = argv[index];
-    switch (arg) {
-      case void 0:
-        continue;
-      case "--help":
-      case "-h":
-        help = true;
-        break;
-      case "--host": {
-        const value = argv[index + 1];
-        if (value === void 0 || !isValidHost(value)) {
-          return {
-            kind: "error",
-            message: "alias: --host requires a hostname or IP address without a protocol or path"
-          };
-        }
-        host = value.trim();
-        index++;
-        break;
-      }
-      case "--port":
-      case "-p": {
-        const value = parsePort3(argv[index + 1]);
-        if (value === null) {
-          return {
-            kind: "error",
-            message: "alias: --port must be an integer from 1 to 65535"
-          };
-        }
-        port = value;
-        index++;
-        break;
-      }
-      case "--json":
-        json2 = true;
-        break;
-      default:
-        if (arg.startsWith("-")) {
-          return { kind: "error", message: `alias: unknown option ${arg}` };
-        }
-        positional.push(arg);
-    }
+function checkPackage(rootDir, deps) {
+  const packagePath = join8(rootDir, "package.json");
+  const text = deps.readText(packagePath);
+  if (text === null) {
+    return check2("Package metadata", "warn", "package.json was not found near the CLI bundle.");
   }
-  if (help) return { kind: "help" };
-  const command = positional[0];
-  switch (command) {
-    case "list":
-      if (positional.length !== 1) {
-        return { kind: "error", message: "alias: list does not accept a base path" };
-      }
-      return { kind: "ok", options: { action: { kind: "list" }, host, port, json: json2 } };
-    case "add":
-    case "remove": {
-      const rawBasePath = positional[1];
-      if (rawBasePath === void 0 || positional.length !== 2) {
-        return { kind: "error", message: `alias: ${command} requires exactly one base path` };
-      }
-      const basePath = normalizeAliasPath(rawBasePath);
-      if (basePath === null) {
-        return {
-          kind: "error",
-          message: `alias: ${command} base path must be an absolute URL path without a query or hash`
-        };
-      }
-      const action = { kind: command, basePath };
-      return { kind: "ok", options: { action, host, port, json: json2 } };
+  try {
+    const parsed = JSON.parse(text);
+    if (!isObject3(parsed)) {
+      return check2("Package metadata", "warn", "package.json is not an object.");
     }
-    case void 0:
-      return { kind: "error", message: "alias: expected add <path>, list, or remove <path>" };
-    default:
-      return { kind: "error", message: `alias: unknown command ${command}` };
+    const name = parsed["name"];
+    const version2 = parsed["version"];
+    if (typeof name === "string" && typeof version2 === "string") {
+      return check2("Package metadata", "pass", `${name}@${version2}`);
+    }
+    return check2("Package metadata", "warn", "package.json is missing name or version.");
+  } catch {
+    return check2("Package metadata", "warn", "package.json is not valid JSON.");
   }
 }
-function aliasHelp() {
-  return `agent-inspector alias - mount additional base paths on a running runtime
-
-Usage:
-  agent-inspector alias add <path> [--host <host>] [--port <port>] [--json]
-  agent-inspector alias list [--host <host>] [--port <port>] [--json]
-  agent-inspector alias remove <path> [--host <host>] [--port <port>] [--json]
-
-Options:
-  --host <host>  Running instance host (default: localhost)
-  --port <port>  Running instance port (default: 9527)
-  --json         Emit machine-readable output
-  --help, -h     Show this help
-
-Aliases are runtime-scoped. This command never starts another Agent Inspector runtime.
-`;
+function countFilesInDir(dir, deps) {
+  const files = deps.listDir(dir);
+  if (files === null) return null;
+  let count = 0;
+  for (const file2 of files) {
+    const fileStat = deps.stat(join8(dir, file2));
+    if (fileStat !== null && !fileStat.isDirectory) count += 1;
+  }
+  return count;
 }
-function isObject4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KiB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / 1024 / 1024).toFixed(1)} MiB`;
+  return `${(bytes / 1024 / 1024 / 1024).toFixed(1)} GiB`;
 }
-function parseAliasSnapshot(value) {
-  if (!isObject4(value)) return null;
-  const canonicalBasePath = value["canonicalBasePath"];
-  const aliases = value["aliases"];
-  const runtimeScoped = value["runtimeScoped"];
-  if (typeof canonicalBasePath !== "string" || !Array.isArray(aliases) || !aliases.every((alias) => typeof alias === "string") || runtimeScoped !== true) {
-    return null;
+function dirSize(dir, deps, depth = 0) {
+  const dirStat = deps.stat(dir);
+  if (dirStat === null) return null;
+  if (!dirStat.isDirectory) return dirStat.size;
+  if (depth > 4) return 0;
+  const files = deps.listDir(dir);
+  if (files === null) return null;
+  let total = 0;
+  for (const file2 of files) {
+    const childSize = dirSize(join8(dir, file2), deps, depth + 1);
+    if (childSize !== null) total += childSize;
   }
-  return {
-    canonicalBasePath: normalizeBasePath(canonicalBasePath),
-    aliases: aliases.map((alias) => normalizeBasePath(alias)),
-    runtimeScoped: true
-  };
+  return total;
+}
+function verboseChecks(options, deps) {
+  const dataDir = resolveDefaultDataDir(deps.env, deps.platform, deps.exists);
+  const logsDir = join8(dataDir, "logs");
+  const chunksDir = join8(dataDir, "chunks");
+  const providerCandidates = providerConfigCandidates(options, deps);
+  const captureMode = deps.env["AGENT_INSPECTOR_MODE"] ?? deps.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? "simple";
+  const logCount = countFilesInDir(logsDir, deps);
+  const logSize = dirSize(logsDir, deps);
+  const chunkSize = dirSize(chunksDir, deps);
+  const homeDir = deps.platform === "win32" ? deps.env["USERPROFILE"] ?? deps.env["APPDATA"] ?? null : deps.env["HOME"] ?? null;
+  const claudeSkill = homeDir === null ? null : join8(homeDir, ".claude", "skills", "agent-inspector-onboard", "SKILL.md");
+  const claudeCommand = homeDir === null ? null : join8(homeDir, ".claude", "commands", "agent-inspector-onboard.md");
+  const codexSkill = homeDir === null ? null : join8(homeDir, ".codex", "skills", "agent-inspector-onboard", "SKILL.md");
+  const hasClaudeOnboarding = claudeSkill !== null && claudeCommand !== null && deps.exists(claudeSkill) && deps.exists(claudeCommand);
+  const hasCodexOnboarding = codexSkill !== null && deps.exists(codexSkill);
+  return [
+    check2("Data directory", "pass", dataDir),
+    check2("Provider config search", "pass", providerCandidates.join(", ")),
+    check2("Capture mode env", "pass", captureMode),
+    check2(
+      "Log storage",
+      logCount === null ? "warn" : "pass",
+      logCount === null ? `Log directory was not found or could not be read: ${logsDir}` : `${logCount} file(s), ${formatBytes(logSize ?? 0)} under ${logsDir}`
+    ),
+    check2(
+      "Chunk storage",
+      chunkSize === null ? "warn" : "pass",
+      chunkSize === null ? `Chunk directory was not found or could not be read: ${chunksDir}` : `${formatBytes(chunkSize)} under ${chunksDir}`
+    ),
+    check2(
+      "Claude onboarding",
+      hasClaudeOnboarding ? "pass" : "warn",
+      hasClaudeOnboarding ? "Claude Code skill and slash command are installed." : "Claude Code onboarding files were not found.",
+      "Run `agent-inspector onboard --force` after installing or upgrading."
+    ),
+    check2(
+      "Codex onboarding",
+      hasCodexOnboarding ? "pass" : "warn",
+      hasCodexOnboarding ? "Codex onboarding skill is installed." : "Codex onboarding skill was not found.",
+      "Run `agent-inspector onboard --force` after installing or upgrading."
+    )
+  ];
 }
-function readErrorDetail(value) {
-  if (!isObject4(value)) return null;
-  const error51 = value["error"];
-  if (typeof error51 === "string" && error51.trim() !== "") return error51;
-  const message = value["message"];
-  return typeof message === "string" && message.trim() !== "" ? message : null;
+function checkExtensionSource(rootDir, deps) {
+  const extensionDir = join8(rootDir, "extensions", "chrome");
+  const missing = EXTENSION_REQUIRED_FILES.filter((file2) => !deps.exists(join8(extensionDir, file2)));
+  if (missing.length === 0) {
+    return check2(
+      "Chrome extension source",
+      "pass",
+      "Manifest, side panel, service worker, and icons are present."
+    );
+  }
+  return check2(
+    "Chrome extension source",
+    "fail",
+    `Missing ${missing.length} Chrome extension file(s): ${missing.join(", ")}`,
+    "Restore the extension files before packaging or loading unpacked."
+  );
 }
-async function readJson2(response) {
+function extensionManifestVersion(rootDir, deps) {
+  const manifestText = deps.readText(join8(rootDir, "extensions", "chrome", "manifest.json"));
+  if (manifestText === null) return null;
   try {
-    const value = await response.json();
-    return value;
+    const manifest = JSON.parse(manifestText);
+    if (!isObject3(manifest)) return null;
+    const version2 = manifest["version"];
+    return typeof version2 === "string" && version2 !== "" ? version2 : null;
   } catch {
     return null;
   }
 }
-async function requestAliases(endpoint2, action, fetchImpl) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => {
-    controller.abort();
-  }, REQUEST_TIMEOUT_MS);
-  const method = action.kind === "list" ? "GET" : action.kind === "add" ? "POST" : "DELETE";
-  const basePath = action.kind === "list" ? null : action.basePath;
-  const init = {
-    method,
-    headers: action.kind === "list" ? { accept: "application/json" } : {
-      accept: "application/json",
-      "content-type": "application/json",
-      "x-agent-inspector-csrf": "1"
-    },
-    signal: controller.signal
-  };
-  if (basePath !== null) init.body = JSON.stringify({ basePath });
-  try {
-    const response = await fetchImpl(endpoint2, init);
-    const value = await readJson2(response);
-    if (!response.ok) {
-      return { kind: "http-error", status: response.status, detail: readErrorDetail(value) };
+function checkExtensionPackage(rootDir, deps) {
+  const distDir = join8(rootDir, "dist", "chrome-extension");
+  const files = deps.listDir(distDir);
+  if (files === null) {
+    return check2(
+      "Chrome extension package",
+      "warn",
+      "No packaged Chrome extension artifact was found.",
+      "Run `npm run extension:zip` before Chrome Web Store upload."
+    );
+  }
+  const manifestVersion = extensionManifestVersion(rootDir, deps);
+  if (manifestVersion !== null) {
+    const zipName = `agent-inspector-companion-v${manifestVersion}.zip`;
+    const checksumName = `${zipName}.sha256`;
+    const hasZip = files.includes(zipName);
+    const hasChecksum = files.includes(checksumName);
+    if (hasZip && hasChecksum) {
+      return check2("Chrome extension package", "pass", `${zipName} with checksum is present.`);
     }
-    const snapshot = parseAliasSnapshot(value);
-    return snapshot === null ? { kind: "invalid-response" } : { kind: "success", snapshot };
-  } catch (error51) {
-    const timedOut = controller.signal.aborted || error51 instanceof Error && error51.name === "AbortError";
-    return { kind: "network-error", timedOut };
-  } finally {
-    clearTimeout(timeout);
+    if (hasZip) {
+      return check2(
+        "Chrome extension package",
+        "warn",
+        `${zipName} exists but no .sha256 checksum was found.`,
+        "Run `npm run extension:zip` to regenerate the zip and checksum."
+      );
+    }
+    return check2(
+      "Chrome extension package",
+      "warn",
+      `Current Chrome extension package was not found: ${zipName}`,
+      "Run `npm run extension:zip` before Chrome Web Store upload."
+    );
   }
+  const zip = files.find((file2) => file2.endsWith(".zip"));
+  const checksum = files.find((file2) => file2.endsWith(".zip.sha256"));
+  if (zip !== void 0 && checksum !== void 0) {
+    return check2("Chrome extension package", "pass", `${zip} with checksum is present.`);
+  }
+  if (zip !== void 0) {
+    return check2(
+      "Chrome extension package",
+      "warn",
+      `${zip} exists but no .sha256 checksum was found.`,
+      "Run `npm run extension:zip` to regenerate the zip and checksum."
+    );
+  }
+  return check2(
+    "Chrome extension package",
+    "warn",
+    "No Chrome extension zip artifact was found.",
+    "Run `npm run extension:zip` before Chrome Web Store upload."
+  );
 }
-function displayBasePath2(basePath) {
-  const normalized = normalizeBasePath(basePath);
-  return normalized === "" ? "/" : normalized;
-}
-function fullUrl(origin, basePath) {
-  return `${origin}${normalizeBasePath(basePath)}`;
-}
-function buildOutput(origin, action, snapshot) {
+async function buildDoctorReport(options, deps = createDoctorDeps()) {
+  const rootDir = findProjectRoot(deps.cwd, deps);
+  const coreChecks = [
+    await checkProxyHealth(options.port, deps),
+    checkProviderConfig(options, deps),
+    checkPackage(rootDir, deps)
+  ];
+  const checksWithExtension = options.chromeExtension ? [...coreChecks, checkExtensionSource(rootDir, deps), checkExtensionPackage(rootDir, deps)] : coreChecks;
+  const checks = options.verbose ? [...checksWithExtension, ...verboseChecks(options, deps)] : checksWithExtension;
+  const passCount = checks.filter((item) => item.severity === "pass").length;
+  const warnCount = checks.filter((item) => item.severity === "warn").length;
+  const failCount = checks.filter((item) => item.severity === "fail").length;
   return {
-    action: action.kind,
-    canonicalBasePath: displayBasePath2(snapshot.canonicalBasePath),
-    canonicalUrl: fullUrl(origin, snapshot.canonicalBasePath),
-    aliases: snapshot.aliases.map(displayBasePath2),
-    aliasUrls: snapshot.aliases.map((alias) => fullUrl(origin, alias)),
-    runtimeScoped: true
+    checks,
+    passCount,
+    warnCount,
+    failCount,
+    exitCode: failCount > 0 ? 1 : 0
   };
 }
-function formatHumanOutput(output) {
-  const heading = output.action === "add" ? "Base-path alias added." : output.action === "remove" ? "Base-path alias removed." : "Base-path aliases for the running runtime:";
-  const aliasPaths = output.aliases.length === 0 ? "(none)" : output.aliases.join(", ");
-  const aliasUrls = output.aliasUrls.length === 0 ? "  (none)" : output.aliasUrls.map((url2) => `  - ${url2}`).join("\n");
-  return `${heading}
-Canonical base path: ${output.canonicalBasePath}
-Canonical URL: ${output.canonicalUrl}
-Alias base paths: ${aliasPaths}
-Alias URLs:
-${aliasUrls}
-Scope: current runtime only; no second runtime was started and aliases are not persisted.
+function formatDoctorReport(report) {
+  const lines = ["agent-inspector doctor", ""];
+  for (const item of report.checks) {
+    lines.push(`${item.severity.toUpperCase().padEnd(4)} ${item.name}: ${item.message}`);
+    if (item.hint !== null) {
+      lines.push(`     ${item.hint}`);
+    }
+  }
+  lines.push("");
+  lines.push(
+    `Summary: ${report.passCount} pass, ${report.warnCount} warn, ${report.failCount} fail`
+  );
+  return `${lines.join("\n")}
 `;
 }
-function writeError2(io, json2, code, message) {
-  if (json2) {
-    io.stderr(`${JSON.stringify({ error: code, message, runtimeStarted: false })}
-`);
-    return;
-  }
-  io.stderr(`agent-inspector alias: ${message}
-`);
+function formatDoctorJson(report) {
+  return `${JSON.stringify(report, null, 2)}
+`;
 }
-function oldRuntimeMessage(origin) {
-  return `the runtime at ${origin} does not support base-path aliases. Upgrade Agent Inspector and restart that instance, then retry; this command did not start a runtime.`;
+function doctorHelp() {
+  return [
+    "agent-inspector doctor",
+    "",
+    "Usage:",
+    "  agent-inspector doctor [--port <port>] [--config-dir <dir>] [--providers <json>] [--fix] [--json] [--verbose] [--chrome-extension]",
+    "",
+    "Checks local backend health, provider config presence, and package metadata.",
+    "The backend check probes the local health endpoint and does not require a composed Web UI.",
+    "Pass --fix to run safe local repairs before checks, including legacy data-dir migration.",
+    "Pass --json to emit a machine-readable report for CI, scripts, and Jenkins.",
+    "Pass --verbose to include local paths, capture mode, and log storage checks.",
+    "Pass --chrome-extension to also check Chrome companion source and packaged artifacts.",
+    ""
+  ].join("\n");
 }
-async function handleHttpError(options, endpoint2, origin, result, fetchImpl, io) {
-  if (result.status === 404 && options.action.kind === "remove") {
-    const probe = await requestAliases(endpoint2, { kind: "list" }, fetchImpl);
-    if (probe.kind === "success") {
-      writeError2(
-        io,
-        options.json,
-        "alias_not_found",
-        `base path ${displayBasePath2(options.action.basePath)} is not mounted. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
-      );
-      return 1;
-    }
-    if (probe.kind === "network-error") {
-      writeError2(
-        io,
-        options.json,
-        probe.timedOut ? "request_timeout" : "runtime_unreachable",
-        `${probe.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
-      );
-      return 1;
-    }
-    if (probe.kind === "http-error" && (probe.status === 404 || probe.status === 405)) {
-      writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
-      return 1;
-    }
+async function fetchHealth(port, basePath) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+  try {
+    const response = await fetch(
+      appendBasePathToOrigin(`http://127.0.0.1:${port}`, "/api/health", basePath),
+      {
+        cache: "no-store",
+        signal: controller.signal
+      }
+    );
+    return { ok: response.ok, status: response.status };
+  } catch {
+    return { ok: false, status: null };
+  } finally {
+    clearTimeout(timeout);
   }
-  if (result.status === 404 || result.status === 405) {
-    writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
-    return 1;
+}
+function isPortOpen(port) {
+  return new Promise((resolveOpen) => {
+    const socket = createConnection({ host: "127.0.0.1", port });
+    const finish = (value) => {
+      socket.removeAllListeners();
+      socket.destroy();
+      resolveOpen(value);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  });
+}
+function readText(path2) {
+  try {
+    return readFileSync4(path2, "utf8");
+  } catch {
+    return null;
   }
-  if (result.status === 409) {
-    writeError2(
-      io,
-      options.json,
-      "alias_conflict",
-      `${result.detail ?? "the base path is already mounted or conflicts with another mount"}. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
-    );
-    return 1;
+}
+function listDir(path2) {
+  try {
+    return readdirSync5(path2);
+  } catch {
+    return null;
   }
-  const detail = result.detail === null ? "the runtime rejected the request" : result.detail;
-  writeError2(
-    io,
-    options.json,
-    "runtime_rejected_request",
-    `${detail} (HTTP ${result.status}). Check the running instance and retry; no runtime was started.`
-  );
-  return 1;
 }
-async function runAlias(argv, fetchImpl = fetch, io = processIo2) {
-  const parsed = parseAliasArgs(argv);
-  if (parsed.kind === "help") {
-    io.stdout(aliasHelp());
-    return 0;
+function stat3(path2) {
+  try {
+    const fileStat = statSync4(path2);
+    return { isDirectory: fileStat.isDirectory(), size: fileStat.size };
+  } catch {
+    return null;
   }
+}
+function createDoctorDeps() {
+  return {
+    env: process.env,
+    platform: process.platform,
+    cwd: process.cwd(),
+    exists: existsSync7,
+    readText,
+    listDir,
+    stat: stat3,
+    fetchHealth,
+    isPortOpen
+  };
+}
+async function runDoctor(argv) {
+  const parsed = parseDoctorArgs(argv);
   if (parsed.kind === "error") {
-    io.stderr(`${parsed.message}
-
-${aliasHelp()}`);
+    process.stderr.write(`${parsed.message}
+`);
     return 2;
   }
-  const { options } = parsed;
-  const origin = `http://${formatHostForUrl(options.host)}:${options.port}`;
-  const endpoint2 = `${origin}${ALIAS_CONTROL_PATH}`;
-  const result = await requestAliases(endpoint2, options.action, fetchImpl);
-  switch (result.kind) {
-    case "success": {
-      const output = buildOutput(origin, options.action, result.snapshot);
-      io.stdout(options.json ? `${JSON.stringify(output, null, 2)}
-` : formatHumanOutput(output));
-      return 0;
-    }
-    case "network-error":
-      writeError2(
-        io,
-        options.json,
-        result.timedOut ? "request_timeout" : "runtime_unreachable",
-        `${result.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
-      );
-      return 1;
-    case "invalid-response":
-      writeError2(
-        io,
-        options.json,
-        "invalid_runtime_response",
-        `the runtime at ${origin} returned an invalid alias response. Upgrade and restart that instance, then retry; no runtime was started.`
-      );
-      return 1;
-    case "http-error":
-      return handleHttpError(options, endpoint2, origin, result, fetchImpl, io);
+  if (parsed.options.help) {
+    process.stdout.write(doctorHelp());
+    return 0;
+  }
+  if (parsed.options.fix) {
+    migrateLegacyDataDirs();
   }
+  const report = await buildDoctorReport(parsed.options);
+  process.stdout.write(parsed.options.json ? formatDoctorJson(report) : formatDoctorReport(report));
+  return report.exitCode;
 }
-var DEFAULT_ALIAS_HOST, DEFAULT_ALIAS_PORT, ALIAS_CONTROL_PATH, REQUEST_TIMEOUT_MS, processIo2;
-var init_alias = __esm({
-  "src/cli/alias.ts"() {
+var DEFAULT_PORT3, PROBE_TIMEOUT_MS, EXTENSION_REQUIRED_FILES;
+var init_doctor = __esm({
+  "src/cli/doctor.ts"() {
     "use strict";
     init_basePath();
-    DEFAULT_ALIAS_HOST = "localhost";
-    DEFAULT_ALIAS_PORT = 9527;
-    ALIAS_CONTROL_PATH = "/.agent-inspector/base-path-aliases";
-    REQUEST_TIMEOUT_MS = 5e3;
-    processIo2 = {
-      stdout: (text) => {
-        process.stdout.write(text);
-      },
-      stderr: (text) => {
-        process.stderr.write(text);
-      }
-    };
+    init_dataDir();
+    DEFAULT_PORT3 = 9527;
+    PROBE_TIMEOUT_MS = 2e3;
+    EXTENSION_REQUIRED_FILES = [
+      "manifest.json",
+      "sidepanel.html",
+      "sidepanel.js",
+      "sidepanel.css",
+      "service-worker.js",
+      "icons/icon.svg",
+      "icons/icon-16.png",
+      "icons/icon-32.png",
+      "icons/icon-48.png",
+      "icons/icon-128.png"
+    ];
   }
 });
 
-// src/cli.ts
-import { Buffer as Buffer5 } from "node:buffer";
-import { spawn as spawn2 } from "node:child_process";
-import { createConnection as createConnection2 } from "node:net";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { dirname as dirname3, join as join9, resolve as resolvePath2 } from "node:path";
-import { existsSync as existsSync8 } from "node:fs";
-
-// package.json
-var package_default = {
-  name: "@tonyclaw/agent-inspector",
-  version: "3.0.47",
-  type: "module",
-  description: "Agent observability and knowledge capture layer for AI coding tools.",
-  license: "MIT",
-  engines: {
-    node: ">=22.0.0"
-  },
-  author: "TonyClaw",
-  repository: {
-    type: "git",
-    url: "git+https://gitcode.com/TonyClaw/agent-inspector.git"
-  },
-  homepage: "https://gitcode.com/TonyClaw/agent-inspector#readme",
-  workspaces: [
-    "packages/*"
-  ],
-  bugs: {
-    url: "https://gitcode.com/TonyClaw/agent-inspector/issues"
-  },
-  publishConfig: {
-    access: "public",
-    registry: "https://registry.npmjs.org/"
-  },
-  keywords: [
-    "claude",
-    "anthropic",
-    "openai",
-    "proxy",
-    "api-inspector",
-    "agent-observability",
-    "agent-memory",
-    "debugging",
-    "llm",
-    "ai-coding-tools"
-  ],
-  bin: {
-    "agent-inspector": "bin/agent-inspector.js"
-  },
-  files: [
-    "bin",
-    "src",
-    "!src/**/*.test.ts",
-    "!src/**/*.stories.tsx",
-    "!src/**/__fixtures__",
-    "!src/ui/routeTree.gen.ts",
-    "!src/backend/routeTree.gen.ts",
-    "scripts/setup-windows-runtime.mjs",
-    "scripts/setup-agent-skills.mjs",
-    "scripts/generate-theme-scales.mjs",
-    "docs/instance-control.openapi.yaml",
-    "styles",
-    ".output",
-    "!.output/*.exe"
-  ],
-  scripts: {
-    dev: "node scripts/dev-decoupled.mjs",
-    "dev:ui": "vite dev --config vite.ui.config.ts",
-    "dev:backend": "node scripts/dev-backend.mjs",
-    "test:smoke": "bun scripts/run-test-suite.mjs smoke",
-    "test:fast": "bun scripts/run-test-suite.mjs smoke",
-    "test:unit": "bun scripts/run-test-suite.mjs unit",
-    "test:integration": "bun scripts/run-test-suite.mjs integration",
-    "test:changed": "bun scripts/run-test-suite.mjs changed",
-    "test:all": "bun scripts/run-test-suite.mjs all",
-    "test:compatibility-tooling": "node --test scripts/compatibility/*.test.mjs",
-    start: "node .output/cli.js",
-    "start:backend": "node .output/cli.js --backend-only --no-open",
-    "preview:ui": "vite preview --config vite.ui.config.ts",
-    "clean:output": "node scripts/clean-output.mjs",
-    build: "bun clean:output && bun build:backend && bun build:ui && bun smoke:ui-preview && bun build:workers && bun build:cli && bun build:mcp && bun check:bundle && bun check:boundaries",
-    "build:backend": "vite build --config vite.backend.config.ts",
-    "build:ui": "vite build --config vite.ui.config.ts",
-    "build:workers": "npx esbuild src/proxy/logFinalizer.worker.ts src/proxy/sessionWorkerEntry.ts --bundle --platform=node --target=node22 --format=esm --outdir=.output/workers --external:better-sqlite3",
-    "smoke:workers": "node scripts/smoke-production-workers.mjs",
-    "smoke:packed-workers": "node scripts/smoke-packed-workers.mjs",
-    "smoke:instances": "node scripts/smoke-windows-instances.mjs",
-    "smoke:coding-agent-instances": "node scripts/smoke-coding-agent-instances.mjs",
-    "smoke:ui-preview": "node scripts/smoke-decoupled-ui-preview.mjs",
-    "check:bundle": "node scripts/check-client-bundle.mjs",
-    "check:boundaries": "node scripts/check-runtime-boundaries.mjs",
-    "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",
-    "compatibility:compare": "node scripts/compatibility/cli.mjs compare",
-    "compatibility:drift": "node scripts/check-backend-compatibility.mjs",
-    "compatibility:fixtures": "bun scripts/validate-compatibility-fixtures.ts",
-    "compatibility:freeze": "node scripts/freeze-backend-baseline.mjs",
-    "compatibility:run": "node scripts/compatibility/cli.mjs run",
-    "compatibility:performance": "node scripts/compatibility/performance-cli.mjs",
-    "compatibility:performance:verify": "node scripts/compatibility/performance-cli.mjs verify",
-    "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=.output/cli.js",
-    "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node22 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",
-    "rust:build-package": "node scripts/rust/build-platform.mjs",
-    "rust:stage-package": "node scripts/rust/stage-platform.mjs",
-    "rust:verify-package": "node scripts/rust/verify-platform.mjs",
-    "rust:pack-package": "node scripts/rust/pack-platform.mjs",
-    "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",
-    "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",
-    "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/releaseCore.test.ts",
-    "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",
-    "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",
-    "themes:generate": "node scripts/generate-theme-scales.mjs",
-    postinstall: "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",
-    prepublishOnly: "node scripts/rust/require-release-orchestrator.mjs",
-    typecheck: "tsc --noEmit --incremental --tsBuildInfoFile .cache/tsconfig.tsbuildinfo",
-    lint: "eslint . --cache --cache-location .cache/eslintcache",
-    format: "biome format --write .",
-    "format:check": "biome format .",
-    "verify:fast": "bun scripts/run-static-checks.mjs --format && bun test:changed",
-    "extension:zip": "node scripts/pack-chrome-extension.mjs",
-    "extension:release": "node scripts/release-chrome-extension.mjs",
-    release: "node scripts/release.mjs",
-    knip: "knip",
-    check: "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd && bun rust:packages:check",
-    prepare: "husky",
-    ladle: "ladle serve",
-    "ladle:build": "ladle build"
-  },
-  dependencies: {
-    "@mariozechner/pi-agent-core": "^0.73.1",
-    "@mariozechner/pi-ai": "^0.73.1",
-    "@modelcontextprotocol/server": "^2.0.0-beta.4",
-    "@tailwindcss/typography": "^0.5.20",
-    "@tanstack/react-router": "^1.170.18",
-    "@tanstack/react-start": "^1.168.28",
-    "@tanstack/react-virtual": "^3.14.6",
-    "class-variance-authority": "^0.7.1",
-    clsx: "^2.1.1",
-    conf: "^15.1.0",
-    diff: "^9.0.0",
-    jszip: "^3.10.1",
-    "lucide-react": "^0.563.0",
-    "radix-ui": "^1.6.2",
-    react: "^19.2.7",
-    "react-dom": "^19.2.7",
-    "react-markdown": "^10.1.0",
-    swr: "^2.4.2",
-    "tailwind-merge": "^3.6.0",
-    three: "0.185.1",
-    "tw-animate-css": "^1.4.0",
-    zod: "^4.4.3"
-  },
-  optionalDependencies: {
-    "@tonyclaw/agent-inspector-backend-darwin-arm64": "3.0.47",
-    "@tonyclaw/agent-inspector-backend-linux-x64-gnu": "3.0.47",
-    "@tonyclaw/agent-inspector-backend-win32-x64-msvc": "3.0.47",
-    "better-sqlite3": "^12.11.1",
-    rcedit: "4.0.1"
-  },
-  devDependencies: {
-    "@biomejs/biome": "^2.5.3",
-    "@eslint/js": "^10.0.1",
-    "@ladle/react": "^5.1.1",
-    "@radix-ui/colors": "^3.0.0",
-    "@tailwindcss/vite": "^4.3.2",
-    "@tanstack/router-plugin": "^1.168.20",
-    "@types/bun": "^1.3.14",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@types/three": "0.185.1",
-    "@typescript-eslint/eslint-plugin": "^8.64.0",
-    "@typescript-eslint/parser": "^8.64.0",
-    "@vitejs/plugin-react": "^5.2.0",
-    ajv: "8.20.0",
-    "ajv-formats": "3.0.1",
-    "colorjs.io": "^0.7.0",
-    esbuild: "^0.28.1",
-    eslint: "^9.39.5",
-    "eslint-plugin-eslint-comments": "^3.2.0",
-    "eslint-plugin-functional": "^9.0.5",
-    "eslint-plugin-unicorn": "^63.0.0",
-    husky: "^9.1.7",
-    knip: "^5.88.1",
-    nitro: "^3.0.260610-beta",
-    playwright: "^1.61.1",
-    tailwindcss: "^4.3.2",
-    typescript: "^5.9.3",
-    vite: "^7.3.6",
-    "vite-tsconfig-paths": "^6.1.1"
-  },
-  overrides: {
-    undici: ">=7.24.0 <8.0.0",
-    rollup: ">=4.59.0 <5.0.0",
-    postcss: ">=8.5.10 <9.0.0",
-    "js-yaml": ">=4.1.2 <5.0.0",
-    flatted: ">=3.4.0 <4.0.0",
-    "smol-toml": ">=1.6.1 <2.0.0",
-    koa: ">=2.16.4 <3.0.0",
-    "@babel/core": ">=7.29.1 <8.0.0",
-    "@typescript-eslint/typescript-estree": "^8.63.0",
-    vite: "^7.3.6"
-  }
-};
-
-// src/cli.ts
-init_backendImplementation();
-init_basePath();
-init_managedInstance();
-init_networkHints();
-
-// src/cli/startupOutput.ts
-function shouldSuppressServerOutputLine(line, context) {
-  if (!context.enableIdentityProxy) return false;
-  if (context.publicPort === context.upstreamPort) return false;
-  const lowerLine = line.toLowerCase();
-  return lowerLine.includes("listening on") && lowerLine.includes(`:${context.upstreamPort}`);
-}
-
-// src/cli/rustBackendPackage.ts
-import { spawnSync } from "node:child_process";
-init_zod();
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-var RUST_BACKEND_IDENTITY_FLAG = "--agent-inspector-package-identity";
-var RUST_BACKEND_CLI_PROTOCOL = "agent-inspector-cli-backend-v1";
-var RUST_BACKEND_IDENTITY_TIMEOUT_MS = 2e3;
-var RustBackendIdentitySchema = external_exports.object({
-  schemaVersion: external_exports.literal(1),
-  name: external_exports.literal("agent-inspector-backend"),
-  packageVersion: external_exports.string().min(1),
-  target: external_exports.string().min(1),
-  binary: external_exports.string().min(1),
-  cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL),
-  productionReady: external_exports.literal(true),
-  capabilities: external_exports.object({
-    nodeProtectedIngress: external_exports.literal(true),
-    basePath: external_exports.literal(true),
-    namedInstances: external_exports.literal(true),
-    gracefulShutdown: external_exports.literal(true)
-  }).strict()
-}).strict();
-var RustBackendPackageJsonSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  version: external_exports.string().min(1),
-  os: external_exports.array(external_exports.string()).min(1),
-  cpu: external_exports.array(external_exports.string()).min(1),
-  libc: external_exports.array(external_exports.string()).optional(),
-  agentInspectorRustBackend: external_exports.object({
-    schemaVersion: external_exports.literal(1),
-    target: external_exports.string().min(1),
-    binary: external_exports.string().min(1),
-    manifest: external_exports.string().min(1),
-    identityFlag: external_exports.literal(RUST_BACKEND_IDENTITY_FLAG),
-    cliProtocol: external_exports.literal(RUST_BACKEND_CLI_PROTOCOL)
-  }).strict()
-}).passthrough();
-var RustBackendBinaryManifestSchema = external_exports.object({
-  schemaVersion: external_exports.literal(1),
-  packageName: external_exports.string().min(1),
-  packageVersion: external_exports.string().min(1),
-  target: external_exports.string().min(1),
-  binary: external_exports.string().min(1),
-  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/u),
-  identity: RustBackendIdentitySchema
-}).strict();
-function packageFailure(code, message) {
-  return { kind: "error", error: { code, message } };
+// src/cli/alias.ts
+var alias_exports = {};
+__export(alias_exports, {
+  parseAliasArgs: () => parseAliasArgs,
+  runAlias: () => runAlias
+});
+function parsePort3(raw) {
+  if (raw === void 0 || raw.trim() === "") return null;
+  const port = Number(raw);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return port;
 }
-function targetFailure(message) {
-  return { kind: "error", error: { code: "unsupported_platform", message } };
+function normalizeAliasPath(raw) {
+  return normalizePublicBasePath(raw);
 }
-function detectLinuxLibc() {
-  if (process.platform !== "linux") return "not-applicable";
-  const report = process.report.getReport();
-  const header = objectProperty(report, "header");
-  const glibcVersion = objectProperty(header, "glibcVersionRuntime");
-  if (typeof glibcVersion === "string" && glibcVersion.length > 0) {
-    return "glibc";
-  }
-  const sharedObjects = objectProperty(report, "sharedObjects");
-  return Array.isArray(sharedObjects) && sharedObjects.some((path2) => typeof path2 === "string" && path2.toLowerCase().includes("musl")) ? "musl" : "unknown";
+function isValidHost(host) {
+  const trimmed = host.trim();
+  return trimmed.length > 0 && !trimmed.includes("://") && !trimmed.includes("/") && !trimmed.includes("?") && !trimmed.includes("#") && !/\s/u.test(trimmed);
 }
-function objectProperty(value, name) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-  return Object.getOwnPropertyDescriptor(value, name)?.value;
+function formatHostForUrl(host) {
+  if (host.startsWith("[") && host.endsWith("]")) return host;
+  return host.includes(":") ? `[${host}]` : host;
 }
-function resolveRustBackendTarget(platform = process.platform, arch = process.arch, libc = platform === "linux" ? detectLinuxLibc() : "not-applicable") {
-  switch (platform) {
-    case "win32":
-      return arch === "x64" ? {
-        kind: "success",
-        value: {
-          packageName: "@tonyclaw/agent-inspector-backend-win32-x64-msvc",
-          target: "x86_64-pc-windows-msvc",
-          binary: "bin/agent-inspector-backend.exe",
-          os: "win32",
-          cpu: "x64",
-          libc: null
-        }
-      } : targetFailure(`Rust backend packages do not support Windows ${arch}.`);
-    case "linux":
-      if (arch !== "x64")
-        return targetFailure(`Rust backend packages do not support Linux ${arch}.`);
-      if (libc !== "glibc") {
-        return targetFailure(
-          `The Linux Rust backend package requires glibc; detected ${libc}. No binary was started.`
-        );
+function parseAliasArgs(argv) {
+  let host = DEFAULT_ALIAS_HOST;
+  let port = DEFAULT_ALIAS_PORT;
+  let json2 = false;
+  let help = false;
+  const positional = [];
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    switch (arg) {
+      case void 0:
+        continue;
+      case "--help":
+      case "-h":
+        help = true;
+        break;
+      case "--host": {
+        const value = argv[index + 1];
+        if (value === void 0 || !isValidHost(value)) {
+          return {
+            kind: "error",
+            message: "alias: --host requires a hostname or IP address without a protocol or path"
+          };
+        }
+        host = value.trim();
+        index++;
+        break;
       }
-      return {
-        kind: "success",
-        value: {
-          packageName: "@tonyclaw/agent-inspector-backend-linux-x64-gnu",
-          target: "x86_64-unknown-linux-gnu",
-          binary: "bin/agent-inspector-backend",
-          os: "linux",
-          cpu: "x64",
-          libc: "glibc"
+      case "--port":
+      case "-p": {
+        const value = parsePort3(argv[index + 1]);
+        if (value === null) {
+          return {
+            kind: "error",
+            message: "alias: --port must be an integer from 1 to 65535"
+          };
         }
-      };
-    case "darwin":
-      return arch === "arm64" ? {
-        kind: "success",
-        value: {
-          packageName: "@tonyclaw/agent-inspector-backend-darwin-arm64",
-          target: "aarch64-apple-darwin",
-          binary: "bin/agent-inspector-backend",
-          os: "darwin",
-          cpu: "arm64",
-          libc: null
+        port = value;
+        index++;
+        break;
+      }
+      case "--json":
+        json2 = true;
+        break;
+      default:
+        if (arg.startsWith("-")) {
+          return { kind: "error", message: `alias: unknown option ${arg}` };
         }
-      } : targetFailure(`Rust backend packages do not support macOS ${arch}.`);
-    default:
-      return targetFailure(`Rust backend packages do not support ${platform} ${arch}.`);
+        positional.push(arg);
+    }
   }
-}
-function readJson(path2) {
-  try {
-    const value = JSON.parse(readFileSync(path2, "utf8"));
-    return { kind: "success", value };
-  } catch {
-    return { kind: "error" };
+  if (help) return { kind: "help" };
+  const command = positional[0];
+  switch (command) {
+    case "list":
+      if (positional.length !== 1) {
+        return { kind: "error", message: "alias: list does not accept a base path" };
+      }
+      return { kind: "ok", options: { action: { kind: "list" }, host, port, json: json2 } };
+    case "add":
+    case "remove": {
+      const rawBasePath = positional[1];
+      if (rawBasePath === void 0 || positional.length !== 2) {
+        return { kind: "error", message: `alias: ${command} requires exactly one base path` };
+      }
+      const basePath = normalizeAliasPath(rawBasePath);
+      if (basePath === null) {
+        return {
+          kind: "error",
+          message: `alias: ${command} base path must be an absolute URL path without a query or hash`
+        };
+      }
+      const action = { kind: command, basePath };
+      return { kind: "ok", options: { action, host, port, json: json2 } };
+    }
+    case void 0:
+      return { kind: "error", message: "alias: expected add <path>, list, or remove <path>" };
+    default:
+      return { kind: "error", message: `alias: unknown command ${command}` };
   }
 }
-function isConfinedPath(root, candidate) {
-  const child = relative(root, candidate);
-  return child.length > 0 && !child.startsWith("..") && !isAbsolute(child);
+function aliasHelp() {
+  return `agent-inspector alias - mount additional base paths on a running runtime
+
+Usage:
+  agent-inspector alias add <path> [--host <host>] [--port <port>] [--json]
+  agent-inspector alias list [--host <host>] [--port <port>] [--json]
+  agent-inspector alias remove <path> [--host <host>] [--port <port>] [--json]
+
+Options:
+  --host <host>  Running instance host (default: localhost)
+  --port <port>  Running instance port (default: 9527)
+  --json         Emit machine-readable output
+  --help, -h     Show this help
+
+Aliases are runtime-scoped. This command never starts another Agent Inspector runtime.
+`;
 }
-function identitiesMatch(left, right) {
-  return left.schemaVersion === right.schemaVersion && left.name === right.name && left.packageVersion === right.packageVersion && left.target === right.target && left.binary === right.binary && left.cliProtocol === right.cliProtocol && left.productionReady === right.productionReady && left.capabilities.nodeProtectedIngress === right.capabilities.nodeProtectedIngress && left.capabilities.basePath === right.capabilities.basePath && left.capabilities.namedInstances === right.capabilities.namedInstances && left.capabilities.gracefulShutdown === right.capabilities.gracefulShutdown;
+function isObject4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function probeBinaryIdentity(binaryPath, identityFlag) {
-  const result = spawnSync(binaryPath, [identityFlag], {
-    encoding: "utf8",
-    windowsHide: true,
-    timeout: RUST_BACKEND_IDENTITY_TIMEOUT_MS,
-    maxBuffer: 64 * 1024
-  });
-  if (result.error !== void 0) {
-    return { kind: "error", message: result.error.message };
-  }
-  if (result.status !== 0) {
-    return {
-      kind: "error",
-      message: `identity command exited with status ${String(result.status)}`
-    };
-  }
-  let raw;
-  try {
-    raw = JSON.parse(result.stdout);
-  } catch {
-    return { kind: "error", message: "identity command did not return JSON" };
+function parseAliasSnapshot(value) {
+  if (!isObject4(value)) return null;
+  const canonicalBasePath = value["canonicalBasePath"];
+  const aliases = value["aliases"];
+  const runtimeScoped = value["runtimeScoped"];
+  if (typeof canonicalBasePath !== "string" || !Array.isArray(aliases) || !aliases.every((alias) => typeof alias === "string") || runtimeScoped !== true) {
+    return null;
   }
-  const parsed = RustBackendIdentitySchema.safeParse(raw);
-  return parsed.success ? { kind: "success", value: parsed.data } : { kind: "error", message: "identity command returned an unsupported contract" };
+  return {
+    canonicalBasePath: normalizeBasePath(canonicalBasePath),
+    aliases: aliases.map((alias) => normalizeBasePath(alias)),
+    runtimeScoped: true
+  };
 }
-var packageRequire = createRequire(import.meta.url);
-function defaultResolvePackageJson(specifier) {
+function readErrorDetail(value) {
+  if (!isObject4(value)) return null;
+  const error51 = value["error"];
+  if (typeof error51 === "string" && error51.trim() !== "") return error51;
+  const message = value["message"];
+  return typeof message === "string" && message.trim() !== "" ? message : null;
+}
+async function readJson2(response) {
   try {
-    return packageRequire.resolve(specifier);
+    const value = await response.json();
+    return value;
   } catch {
-    const suffix = "/package.json";
-    const packageName = specifier.endsWith(suffix) ? specifier.slice(0, -suffix.length) : "";
-    const directoryName = packageName.split("/").at(-1);
-    if (directoryName !== void 0 && directoryName.length > 0) {
-      const localPackageJson = resolve(
-        dirname(fileURLToPath(import.meta.url)),
-        "../packages",
-        directoryName,
-        "package.json"
-      );
-      if (existsSync(localPackageJson)) return localPackageJson;
-    }
-    return packageRequire.resolve(specifier);
+    return null;
   }
 }
-function resolveRustBackendPackage(options) {
-  const target = resolveRustBackendTarget(options.platform, options.arch, options.libc);
-  if (target.kind === "error") return { kind: "error", error: target.error };
-  const packageJsonSpecifier = `${target.value.packageName}/package.json`;
-  let packageJsonPath;
+async function requestAliases(endpoint2, action, fetchImpl) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => {
+    controller.abort();
+  }, REQUEST_TIMEOUT_MS);
+  const method = action.kind === "list" ? "GET" : action.kind === "add" ? "POST" : "DELETE";
+  const basePath = action.kind === "list" ? null : action.basePath;
+  const init = {
+    method,
+    headers: action.kind === "list" ? { accept: "application/json" } : {
+      accept: "application/json",
+      "content-type": "application/json",
+      "x-agent-inspector-csrf": "1"
+    },
+    signal: controller.signal
+  };
+  if (basePath !== null) init.body = JSON.stringify({ basePath });
   try {
-    packageJsonPath = (options.resolvePackageJson ?? defaultResolvePackageJson)(
-      packageJsonSpecifier
-    );
-  } catch {
-    return packageFailure(
-      "package_missing",
-      `Rust backend ${target.value.target} was requested, but optional package ${target.value.packageName}@${options.rootVersion} is not installed. Reinstall without omitting optional dependencies; no TypeScript fallback was used.`
-    );
-  }
-  const rawPackage = readJson(packageJsonPath);
-  if (rawPackage.kind === "error") {
-    return packageFailure("package_invalid", `Cannot read ${packageJsonSpecifier}.`);
-  }
-  const packageJson = RustBackendPackageJsonSchema.safeParse(rawPackage.value);
-  if (!packageJson.success) {
-    return packageFailure(
-      "package_invalid",
-      `Package ${target.value.packageName} does not contain the Rust backend package contract.`
-    );
-  }
-  if (packageJson.data.name !== target.value.packageName || packageJson.data.version !== options.rootVersion) {
-    return packageFailure(
-      "version_mismatch",
-      `Rust backend package must exactly match @tonyclaw/agent-inspector@${options.rootVersion}; found ${packageJson.data.name}@${packageJson.data.version}.`
-    );
-  }
-  const metadata = packageJson.data.agentInspectorRustBackend;
-  const expectedLibc = target.value.libc === null ? void 0 : [target.value.libc];
-  if (metadata.target !== target.value.target || metadata.binary !== target.value.binary || metadata.manifest !== "binary-manifest.json" || packageJson.data.os.length !== 1 || packageJson.data.os[0] !== target.value.os || packageJson.data.cpu.length !== 1 || packageJson.data.cpu[0] !== target.value.cpu || JSON.stringify(packageJson.data.libc) !== JSON.stringify(expectedLibc)) {
-    return packageFailure(
-      "target_mismatch",
-      `Package ${target.value.packageName} does not match target ${target.value.target}.`
-    );
-  }
-  const packageRoot = dirname(packageJsonPath);
-  const manifestPath = resolve(packageRoot, metadata.manifest);
-  const binaryPath = resolve(packageRoot, metadata.binary);
-  if (!isConfinedPath(packageRoot, manifestPath) || !isConfinedPath(packageRoot, binaryPath)) {
-    return packageFailure(
-      "package_invalid",
-      `Package ${target.value.packageName} contains an unsafe artifact path.`
-    );
-  }
-  const rawManifest = readJson(manifestPath);
-  if (rawManifest.kind === "error") {
-    return packageFailure(
-      "manifest_invalid",
-      `Rust backend package ${target.value.packageName} is incomplete: binary-manifest.json is missing or invalid.`
-    );
-  }
-  const manifest = RustBackendBinaryManifestSchema.safeParse(rawManifest.value);
-  if (!manifest.success) {
-    return packageFailure(
-      "manifest_invalid",
-      `Rust backend package ${target.value.packageName} has an invalid target manifest.`
-    );
-  }
-  if (manifest.data.packageName !== target.value.packageName || manifest.data.packageVersion !== options.rootVersion || manifest.data.identity.packageVersion !== options.rootVersion) {
-    return packageFailure(
-      "version_mismatch",
-      `Rust backend manifest must exactly match @tonyclaw/agent-inspector@${options.rootVersion}.`
-    );
+    const response = await fetchImpl(endpoint2, init);
+    const value = await readJson2(response);
+    if (!response.ok) {
+      return { kind: "http-error", status: response.status, detail: readErrorDetail(value) };
+    }
+    const snapshot = parseAliasSnapshot(value);
+    return snapshot === null ? { kind: "invalid-response" } : { kind: "success", snapshot };
+  } catch (error51) {
+    const timedOut = controller.signal.aborted || error51 instanceof Error && error51.name === "AbortError";
+    return { kind: "network-error", timedOut };
+  } finally {
+    clearTimeout(timeout);
   }
-  if (manifest.data.target !== target.value.target || manifest.data.binary !== target.value.binary || manifest.data.identity.target !== target.value.target || manifest.data.identity.binary !== target.value.binary) {
-    return packageFailure(
-      "target_mismatch",
-      `Rust backend manifest identity does not match target ${target.value.target}.`
-    );
+}
+function displayBasePath2(basePath) {
+  const normalized = normalizeBasePath(basePath);
+  return normalized === "" ? "/" : normalized;
+}
+function fullUrl(origin, basePath) {
+  return `${origin}${normalizeBasePath(basePath)}`;
+}
+function buildOutput(origin, action, snapshot) {
+  return {
+    action: action.kind,
+    canonicalBasePath: displayBasePath2(snapshot.canonicalBasePath),
+    canonicalUrl: fullUrl(origin, snapshot.canonicalBasePath),
+    aliases: snapshot.aliases.map(displayBasePath2),
+    aliasUrls: snapshot.aliases.map((alias) => fullUrl(origin, alias)),
+    runtimeScoped: true
+  };
+}
+function formatHumanOutput(output) {
+  const heading = output.action === "add" ? "Base-path alias added." : output.action === "remove" ? "Base-path alias removed." : "Base-path aliases for the running runtime:";
+  const aliasPaths = output.aliases.length === 0 ? "(none)" : output.aliases.join(", ");
+  const aliasUrls = output.aliasUrls.length === 0 ? "  (none)" : output.aliasUrls.map((url2) => `  - ${url2}`).join("\n");
+  return `${heading}
+Canonical base path: ${output.canonicalBasePath}
+Canonical URL: ${output.canonicalUrl}
+Alias base paths: ${aliasPaths}
+Alias URLs:
+${aliasUrls}
+Scope: current runtime only; no second runtime was started and aliases are not persisted.
+`;
+}
+function writeError2(io, json2, code, message) {
+  if (json2) {
+    io.stderr(`${JSON.stringify({ error: code, message, runtimeStarted: false })}
+`);
+    return;
   }
-  let binaryBytes;
-  try {
-    const stats = statSync(binaryPath);
-    if (!stats.isFile()) {
-      return packageFailure("binary_invalid", `Rust backend artifact is not a regular file.`);
+  io.stderr(`agent-inspector alias: ${message}
+`);
+}
+function oldRuntimeMessage(origin) {
+  return `the runtime at ${origin} does not support base-path aliases. Upgrade Agent Inspector and restart that instance, then retry; this command did not start a runtime.`;
+}
+async function handleHttpError(options, endpoint2, origin, result, fetchImpl, io) {
+  if (result.status === 404 && options.action.kind === "remove") {
+    const probe = await requestAliases(endpoint2, { kind: "list" }, fetchImpl);
+    if (probe.kind === "success") {
+      writeError2(
+        io,
+        options.json,
+        "alias_not_found",
+        `base path ${displayBasePath2(options.action.basePath)} is not mounted. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
+      );
+      return 1;
     }
-    if (target.value.os !== "win32" && (stats.mode & 73) === 0) {
-      return packageFailure("binary_invalid", `Rust backend artifact is not executable.`);
+    if (probe.kind === "network-error") {
+      writeError2(
+        io,
+        options.json,
+        probe.timedOut ? "request_timeout" : "runtime_unreachable",
+        `${probe.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
+      );
+      return 1;
+    }
+    if (probe.kind === "http-error" && (probe.status === 404 || probe.status === 405)) {
+      writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
+      return 1;
     }
-    binaryBytes = readFileSync(binaryPath);
-  } catch {
-    return packageFailure(
-      "binary_missing",
-      `Rust backend binary ${target.value.binary} is missing from ${target.value.packageName}.`
-    );
   }
-  const sha256 = createHash("sha256").update(binaryBytes).digest("hex");
-  if (sha256 !== manifest.data.sha256) {
-    return packageFailure(
-      "hash_mismatch",
-      `Rust backend binary integrity check failed for ${target.value.packageName}; no binary was started.`
-    );
+  if (result.status === 404 || result.status === 405) {
+    writeError2(io, options.json, "unsupported_runtime", oldRuntimeMessage(origin));
+    return 1;
   }
-  const probed = (options.identityProbe ?? probeBinaryIdentity)(binaryPath, metadata.identityFlag);
-  if (probed.kind === "error") {
-    return packageFailure(
-      "identity_failed",
-      `Rust backend binary did not pass the production identity gate: ${probed.message}. No TypeScript fallback was used.`
+  if (result.status === 409) {
+    writeError2(
+      io,
+      options.json,
+      "alias_conflict",
+      `${result.detail ?? "the base path is already mounted or conflicts with another mount"}. Run "agent-inspector alias list --host ${options.host} --port ${options.port}" to inspect the current runtime.`
     );
+    return 1;
   }
-  if (!identitiesMatch(probed.value, manifest.data.identity)) {
-    return packageFailure(
-      "identity_mismatch",
-      `Rust backend binary identity differs from its signed package manifest; no binary was started.`
-    );
+  const detail = result.detail === null ? "the runtime rejected the request" : result.detail;
+  writeError2(
+    io,
+    options.json,
+    "runtime_rejected_request",
+    `${detail} (HTTP ${result.status}). Check the running instance and retry; no runtime was started.`
+  );
+  return 1;
+}
+async function runAlias(argv, fetchImpl = fetch, io = processIo2) {
+  const parsed = parseAliasArgs(argv);
+  if (parsed.kind === "help") {
+    io.stdout(aliasHelp());
+    return 0;
   }
-  return {
-    kind: "success",
-    value: {
-      command: binaryPath,
-      args: [],
-      packageName: target.value.packageName,
-      packageVersion: options.rootVersion,
-      target: target.value.target,
-      sha256
+  if (parsed.kind === "error") {
+    io.stderr(`${parsed.message}
+
+${aliasHelp()}`);
+    return 2;
+  }
+  const { options } = parsed;
+  const origin = `http://${formatHostForUrl(options.host)}:${options.port}`;
+  const endpoint2 = `${origin}${ALIAS_CONTROL_PATH}`;
+  const result = await requestAliases(endpoint2, options.action, fetchImpl);
+  switch (result.kind) {
+    case "success": {
+      const output = buildOutput(origin, options.action, result.snapshot);
+      io.stdout(options.json ? `${JSON.stringify(output, null, 2)}
+` : formatHumanOutput(output));
+      return 0;
     }
-  };
+    case "network-error":
+      writeError2(
+        io,
+        options.json,
+        result.timedOut ? "request_timeout" : "runtime_unreachable",
+        `${result.timedOut ? "timed out contacting" : "cannot reach"} ${origin}. Confirm the existing runtime is running and the --host/--port values are correct; no runtime was started.`
+      );
+      return 1;
+    case "invalid-response":
+      writeError2(
+        io,
+        options.json,
+        "invalid_runtime_response",
+        `the runtime at ${origin} returned an invalid alias response. Upgrade and restart that instance, then retry; no runtime was started.`
+      );
+      return 1;
+    case "http-error":
+      return handleHttpError(options, endpoint2, origin, result, fetchImpl, io);
+  }
+}
+var DEFAULT_ALIAS_HOST, DEFAULT_ALIAS_PORT, ALIAS_CONTROL_PATH, REQUEST_TIMEOUT_MS, processIo2;
+var init_alias = __esm({
+  "src/cli/alias.ts"() {
+    "use strict";
+    init_basePath();
+    DEFAULT_ALIAS_HOST = "localhost";
+    DEFAULT_ALIAS_PORT = 9527;
+    ALIAS_CONTROL_PATH = "/.agent-inspector/base-path-aliases";
+    REQUEST_TIMEOUT_MS = 5e3;
+    processIo2 = {
+      stdout: (text) => {
+        process.stdout.write(text);
+      },
+      stderr: (text) => {
+        process.stderr.write(text);
+      }
+    };
+  }
+});
+
+// src/cli.ts
+init_package();
+init_backendImplementation();
+init_basePath();
+init_managedInstance();
+init_networkHints();
+import { Buffer as Buffer5 } from "node:buffer";
+import { spawn as spawn2 } from "node:child_process";
+import { createConnection as createConnection2 } from "node:net";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { dirname as dirname3, join as join9, resolve as resolvePath2 } from "node:path";
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync4 } from "node:fs";
+
+// src/cli/startupOutput.ts
+function shouldSuppressServerOutputLine(line, context) {
+  if (!context.enableIdentityProxy) return false;
+  if (context.publicPort === context.upstreamPort) return false;
+  const lowerLine = line.toLowerCase();
+  return lowerLine.includes("listening on") && lowerLine.includes(`:${context.upstreamPort}`);
 }
 
+// src/cli.ts
+init_rustBackendPackage();
+
 // src/cli/instanceApi.ts
 init_instance();
 init_instanceContract();
@@ -24753,6 +24774,7 @@ function toBuffer(chunk) {
 
 // src/cli.ts
 init_platformCommands();
+init_dataDir();
 var __filename2 = fileURLToPath3(import.meta.url);
 var __dirname2 = dirname3(__filename2);
 var DEFAULT_PORT4 = 9527;
@@ -24764,6 +24786,7 @@ var BRANDED_WINDOWS_RUNTIME_EXE = "agent-inspector.exe";
 var DEFAULT_CAPTURE_MODE2 = "simple";
 var DEFAULT_SHUTDOWN_DEADLINE_MS = 15e3;
 var SUPERVISOR_SHUTDOWN_GRACE_MS = 2e3;
+var AGENT_INSPECTOR_BACKGROUND_SUPERVISOR_ENV = "AGENT_INSPECTOR_BACKGROUND_SUPERVISOR";
 process.title = "Agent Inspector";
 var subcommand = process.argv[2];
 function printGlobalHelp() {
@@ -24781,7 +24804,7 @@ Global options:
   -v, --version   Print the package version
 
 Start options:
-  --backend <typescript|rust> Select the backend implementation (default: typescript)
+  --backend <typescript|rust> Select the backend implementation (default: rust when native package is available)
   --backend-only, --headless  Start the API, proxy, and MCP runtime without serving the UI
   --with-ui                  Serve the independently built UI through the protected ingress
   --port, -p <port>          Public ingress port (default: 9527)
@@ -24952,6 +24975,25 @@ function pipeServerOutput(child, context) {
   pipeServerOutputStream(child.stdout, process.stdout, context);
   pipeServerOutputStream(child.stderr, process.stderr, context);
 }
+function createBackgroundSupervisorLogs(env) {
+  try {
+    const logsDir = join9(resolveDataDir(existsSync8, env), "logs");
+    mkdirSync4(logsDir, { recursive: true });
+    const stdoutPath = join9(logsDir, "backend.stdout.log");
+    const stderrPath = join9(logsDir, "backend.stderr.log");
+    const header = `
+[${(/* @__PURE__ */ new Date()).toISOString()}] Agent Inspector backend process started
+`;
+    appendFileSync(stdoutPath, header, { encoding: "utf8" });
+    appendFileSync(stderrPath, header, { encoding: "utf8" });
+    return { stdoutPath, stderrPath };
+  } catch (error51) {
+    const message = error51 instanceof Error ? error51.message : String(error51);
+    process.stderr.write(`Failed to open Agent Inspector background logs: ${message}
+`);
+    return null;
+  }
+}
 function pipeServerOutputStream(stream, target, context) {
   if (stream === null) return;
   let buffered = "";
@@ -24974,6 +25016,34 @@ function pipeServerOutputStream(stream, target, context) {
     buffered = "";
   });
 }
+function appendBackgroundLog(path2, text) {
+  try {
+    appendFileSync(path2, text, { encoding: "utf8" });
+  } catch {
+  }
+}
+function pipeServerOutputStreamToFile(stream, targetPath, context) {
+  if (stream === null) return;
+  let buffered = "";
+  stream.on("data", (chunk) => {
+    const text = Buffer5.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
+    const lines = `${buffered}${text}`.split(/\r?\n/);
+    buffered = lines.pop() ?? "";
+    for (const line of lines) {
+      if (!shouldSuppressServerOutputLine(line, context)) {
+        appendBackgroundLog(targetPath, `${line}
+`);
+      }
+    }
+  });
+  stream.on("end", () => {
+    if (buffered.length === 0) return;
+    if (!shouldSuppressServerOutputLine(buffered, context)) {
+      appendBackgroundLog(targetPath, buffered);
+    }
+    buffered = "";
+  });
+}
 function resolveServerCommand(outputDir, serverPath, backend) {
   if (backend === "rust") {
     const resolved = resolveRustBackendPackage({ rootVersion: package_default.version });
@@ -25144,7 +25214,8 @@ async function runStart(args) {
   const portDefault = envPort !== void 0 ? Number(envPort) : DEFAULT_PORT4;
   const envHost = process.env["NITRO_HOST"] ?? process.env["HOST"];
   const envMode = process.env["AGENT_INSPECTOR_CAPTURE_MODE"] ?? process.env["AGENT_INSPECTOR_MODE"];
-  const envBackend = parseBackendImplementation(process.env[AGENT_INSPECTOR_BACKEND_ENV]);
+  const rawEnvBackend = process.env[AGENT_INSPECTOR_BACKEND_ENV];
+  const envBackend = rawEnvBackend === void 0 ? void 0 : parseBackendImplementation(rawEnvBackend);
   if (envBackend === null) {
     console.error(
       `Invalid ${AGENT_INSPECTOR_BACKEND_ENV}. Use typescript or rust; no backend was started.`
@@ -25165,7 +25236,8 @@ async function runStart(args) {
   let enableIdentityProxy = true;
   let legacyAliasEnabled = false;
   let serveUi = process.env["AGENT_INSPECTOR_BACKEND_ONLY"] !== "1";
-  let backend = envBackend;
+  let backend = envBackend ?? "typescript";
+  let backendWasSpecified = envBackend !== void 0;
   if (envMode !== void 0 && envMode !== "") {
     const parsedMode = parseCaptureMode(envMode);
     if (parsedMode === null) {
@@ -25219,6 +25291,7 @@ async function runStart(args) {
         return;
       }
       backend = parsedBackend.data;
+      backendWasSpecified = true;
       continue;
     }
     switch (arg) {
@@ -25249,6 +25322,7 @@ async function runStart(args) {
           return;
         }
         backend = parsedBackend.data;
+        backendWasSpecified = true;
         i++;
         break;
       }
@@ -25338,6 +25412,9 @@ async function runStart(args) {
     process.exitCode = 1;
     return;
   }
+  if (!backendWasSpecified) {
+    backend = managedLaunch?.backend ?? resolvePreferredBackendImplementation({ rootVersion: package_default.version });
+  }
   if (managedLaunch !== null && managedLaunch.backend !== backend) {
     console.error(
       `Managed instance backend mismatch: launch identity requires ${managedLaunch.backend}, but ${backend} was selected.`
@@ -25494,7 +25571,11 @@ async function runStart(args) {
     const supervisorProcess = spawn2(process.execPath, [cliEntry, ...supervisorArgs], {
       stdio: "ignore",
       detached: true,
-      env: { ...process.env, [AGENT_INSPECTOR_CLI_ENTRY_ENV]: cliEntry },
+      env: {
+        ...process.env,
+        [AGENT_INSPECTOR_CLI_ENTRY_ENV]: cliEntry,
+        [AGENT_INSPECTOR_BACKGROUND_SUPERVISOR_ENV]: "1"
+      },
       windowsHide: true
     });
     supervisorProcess.once("error", (err) => {
@@ -25558,22 +25639,38 @@ async function runStart(args) {
   if (existsSync8(workerDir)) {
     serverEnv["AGENT_INSPECTOR_WORKER_DIR"] = workerDir;
   }
+  const runningInBackgroundSupervisor = process.env[AGENT_INSPECTOR_BACKGROUND_SUPERVISOR_ENV] === "1";
+  const backgroundSupervisorLogs = runningInBackgroundSupervisor ? createBackgroundSupervisorLogs(serverEnv) : null;
   const serverProcess = spawn2(serverCommand.command, serverCommand.args, {
     stdio: managedLaunch === null ? background ? ["ignore", "ignore", "ignore"] : ["ignore", "pipe", "pipe"] : backend === "typescript" ? background ? ["ignore", "ignore", "ignore", "ipc"] : ["ignore", "pipe", "pipe", "ipc"] : background ? ["ignore", "ignore", "ignore"] : ["ignore", "pipe", "pipe"],
     detached: background,
     env: serverEnv,
-    windowsHide: background
+    windowsHide: background || runningInBackgroundSupervisor
   });
   serverProcess.once("error", (err) => {
     console.error(`Failed to start Agent Inspector runtime: ${err.message}`);
   });
   const serverExit = waitForProcessExit(serverProcess);
   if (!background) {
-    pipeServerOutput(serverProcess, {
+    const outputContext = {
       enableIdentityProxy,
       publicPort: port,
       upstreamPort
-    });
+    };
+    if (backgroundSupervisorLogs === null) {
+      pipeServerOutput(serverProcess, outputContext);
+    } else {
+      pipeServerOutputStreamToFile(
+        serverProcess.stdout,
+        backgroundSupervisorLogs.stdoutPath,
+        outputContext
+      );
+      pipeServerOutputStreamToFile(
+        serverProcess.stderr,
+        backgroundSupervisorLogs.stderrPath,
+        outputContext
+      );
+    }
   }
   const identityProxies = [];
   let supervisorShutdownPromise = null;