@tonyclaw/agent-inspector 3.1.19 → 3.1.21

package/.output/workers/sessionWorkerEntry.js

@@ -14948,6 +14948,8 @@ var ToolTraceEventSchema = external_exports.object({
   argumentsText: external_exports.string().nullable(),
   argumentsPreview: external_exports.string().nullable()
 });
+var StopReasonValueSchema = external_exports.enum(["end_turn", "tool_use", "stop", "length"]);
+var StopReasonSchema = StopReasonValueSchema.nullable();
 var StreamingChunksArraySchema = external_exports.object({
   chunks: external_exports.array(StreamingChunkSchema),
   truncated: external_exports.boolean().optional().default(false)
@@ -15008,6 +15010,7 @@ var CapturedLogSchema = external_exports.object({
   captureIncompleteReason: CaptureIncompleteReasonSchema.nullable().optional(),
   warnings: external_exports.array(external_exports.string()).optional(),
   toolTraceEvents: external_exports.array(ToolTraceEventSchema).optional(),
+  stopReason: StopReasonSchema.optional(),
   /** Error message from streaming response (e.g., SSE error event) */
   error: external_exports.string().nullable().optional()
 });
@@ -17164,6 +17167,264 @@ var idGenerationChain = Promise.resolve();
 import { AsyncLocalStorage } from "node:async_hooks";
 var publicRequestStorage = new AsyncLocalStorage();
 
+// src/lib/resourceLimits.ts
+var MAX_REST_LOG_PAGE_SIZE = 200;
+var MAX_SEARCH_QUERY_CHARS = 512;
+var MAX_SEARCH_PROJECT_CHARS = 256;
+var MAX_PROVIDER_MODELS = 64;
+var MAX_PROVIDER_MODEL_METADATA = 64;
+var MAX_SSE_CLIENTS = 32;
+var MAX_ACTIVE_PROVIDER_TESTS = 2;
+var MAX_PROVIDER_TEST_CONCURRENCY = 4;
+var MAX_ACTIVE_PROXY_REQUESTS = 16;
+var positiveInteger = external_exports.number().int().positive();
+var RuntimeBudgetPolicySchema = external_exports.object({
+  proxy: external_exports.object({
+    requestBytes: positiveInteger,
+    responseBytes: positiveInteger,
+    headerBytes: positiveInteger,
+    deadlineMs: positiveInteger,
+    idleTimeoutMs: positiveInteger,
+    activeRequests: positiveInteger
+  }),
+  control: external_exports.object({
+    requestBytes: positiveInteger,
+    responseBytes: positiveInteger,
+    headerBytes: positiveInteger,
+    deadlineMs: positiveInteger,
+    idleTimeoutMs: positiveInteger,
+    activeRequests: positiveInteger
+  }),
+  upstream: external_exports.object({
+    fetchResponseBytes: positiveInteger,
+    fetchDeadlineMs: positiveInteger,
+    replayResponseBytes: positiveInteger,
+    replayDeadlineMs: positiveInteger,
+    metadataResponseBytes: positiveInteger,
+    metadataDeadlineMs: positiveInteger,
+    connectTimeoutMs: positiveInteger,
+    idleTimeoutMs: positiveInteger
+  }),
+  pagination: external_exports.object({
+    restPageSize: positiveInteger,
+    searchQueryChars: positiveInteger,
+    searchProjectChars: positiveInteger
+  }),
+  sse: external_exports.object({
+    clients: positiveInteger,
+    initLogs: positiveInteger,
+    heartbeatMs: positiveInteger
+  }),
+  imports: external_exports.object({
+    archiveBytes: positiveInteger,
+    entries: positiveInteger,
+    entryBytes: positiveInteger,
+    uncompressedBytes: positiveInteger,
+    expansionRatio: positiveInteger
+  }),
+  fanOut: external_exports.object({
+    providerModels: positiveInteger,
+    providerModelMetadata: positiveInteger,
+    providerTestConcurrency: positiveInteger,
+    activeProviderTests: positiveInteger
+  }),
+  queues: external_exports.object({
+    proxyRequests: positiveInteger,
+    finalizerJobs: positiveInteger,
+    rawStreamMessages: positiveInteger,
+    rawStreamBytes: positiveInteger,
+    backgroundWorkers: positiveInteger
+  })
+}).superRefine((policy, context) => {
+  if (policy.control.requestBytes > policy.proxy.requestBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["control", "requestBytes"],
+      message: "control request budget must not exceed proxy request budget"
+    });
+  }
+  if (policy.control.responseBytes > policy.proxy.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["control", "responseBytes"],
+      message: "control response budget must not exceed proxy response budget"
+    });
+  }
+  if (policy.control.activeRequests > policy.proxy.activeRequests) {
+    context.addIssue({
+      code: "custom",
+      path: ["control", "activeRequests"],
+      message: "control active request budget must not exceed proxy active request budget"
+    });
+  }
+  if (policy.upstream.fetchResponseBytes > policy.proxy.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "fetchResponseBytes"],
+      message: "upstream fetch response budget must not exceed proxy response budget"
+    });
+  }
+  if (policy.upstream.replayResponseBytes > policy.proxy.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "replayResponseBytes"],
+      message: "upstream replay response budget must not exceed proxy response budget"
+    });
+  }
+  if (policy.upstream.metadataResponseBytes > policy.control.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "metadataResponseBytes"],
+      message: "upstream metadata response budget must not exceed control response budget"
+    });
+  }
+  if (policy.upstream.metadataDeadlineMs > policy.control.deadlineMs) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "metadataDeadlineMs"],
+      message: "upstream metadata deadline must not exceed control deadline"
+    });
+  }
+  if (policy.queues.proxyRequests < policy.proxy.activeRequests) {
+    context.addIssue({
+      code: "custom",
+      path: ["queues", "proxyRequests"],
+      message: "proxy request queue budget must cover active proxy requests"
+    });
+  }
+});
+var DEFAULT_RUNTIME_BUDGET_POLICY = RuntimeBudgetPolicySchema.parse({
+  proxy: {
+    requestBytes: 64 * 1024 * 1024,
+    responseBytes: 256 * 1024 * 1024,
+    headerBytes: 64 * 1024,
+    deadlineMs: 12e4,
+    idleTimeoutMs: 3e4,
+    activeRequests: MAX_ACTIVE_PROXY_REQUESTS
+  },
+  control: {
+    requestBytes: 8 * 1024 * 1024,
+    responseBytes: 64 * 1024 * 1024,
+    headerBytes: 32 * 1024,
+    deadlineMs: 3e4,
+    idleTimeoutMs: 1e4,
+    activeRequests: 8
+  },
+  upstream: {
+    fetchResponseBytes: 256 * 1024 * 1024,
+    fetchDeadlineMs: 12e4,
+    replayResponseBytes: 256 * 1024 * 1024,
+    replayDeadlineMs: 12e4,
+    metadataResponseBytes: 10 * 1024 * 1024,
+    metadataDeadlineMs: 3e4,
+    connectTimeoutMs: 1e4,
+    idleTimeoutMs: 3e4
+  },
+  pagination: {
+    restPageSize: MAX_REST_LOG_PAGE_SIZE,
+    searchQueryChars: MAX_SEARCH_QUERY_CHARS,
+    searchProjectChars: MAX_SEARCH_PROJECT_CHARS
+  },
+  sse: {
+    clients: MAX_SSE_CLIENTS,
+    initLogs: 500,
+    heartbeatMs: 15e3
+  },
+  imports: {
+    archiveBytes: 64 * 1024 * 1024,
+    entries: 5e3,
+    entryBytes: 32 * 1024 * 1024,
+    uncompressedBytes: 256 * 1024 * 1024,
+    expansionRatio: 20
+  },
+  fanOut: {
+    providerModels: MAX_PROVIDER_MODELS,
+    providerModelMetadata: MAX_PROVIDER_MODEL_METADATA,
+    providerTestConcurrency: MAX_PROVIDER_TEST_CONCURRENCY,
+    activeProviderTests: MAX_ACTIVE_PROVIDER_TESTS
+  },
+  queues: {
+    proxyRequests: MAX_ACTIVE_PROXY_REQUESTS,
+    finalizerJobs: 1e3,
+    rawStreamMessages: 16384,
+    rawStreamBytes: 64 * 1024 * 1024,
+    backgroundWorkers: 4
+  }
+});
+var ResourceLimitErrorCodeSchema = external_exports.enum([
+  "invalid-page-request",
+  "search-limit-exceeded",
+  "provider-model-limit-exceeded",
+  "sse-capacity-exceeded",
+  "provider-test-capacity-exceeded",
+  "proxy-capacity-exceeded"
+]);
+var ResourceLimitStatusSchema = external_exports.union([
+  external_exports.literal(400),
+  external_exports.literal(413),
+  external_exports.literal(429),
+  external_exports.literal(503)
+]);
+var ResourceLimitErrorSchema = external_exports.object({
+  error: external_exports.string().min(1).max(300),
+  code: ResourceLimitErrorCodeSchema,
+  status: ResourceLimitStatusSchema,
+  resource: external_exports.string().min(1).max(80),
+  limit: external_exports.number().int().positive(),
+  retryable: external_exports.boolean()
+});
+
+// src/proxy/rawStreamCapture.ts
+var DEFAULT_MEMORY_LIMIT_BYTES = 1024 * 1024;
+var FILE_WRITE_BATCH_BYTES = 64 * 1024;
+var DEFAULT_QUEUE_MAX_BYTES = 8 * 1024 * 1024;
+var DEFAULT_GLOBAL_QUEUE_MAX_MESSAGES = 4096;
+var DEFAULT_GLOBAL_QUEUE_MAX_BYTES = 64 * 1024 * 1024;
+function resolvePositiveIntegerEnv(name, fallback) {
+  const raw = process.env[name];
+  if (raw === void 0 || raw === "") return fallback;
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) return fallback;
+  return parsed;
+}
+var RawStreamObservationBudget = class {
+  constructor(maxMessages, maxBytes) {
+    this.maxMessages = maxMessages;
+    this.maxBytes = maxBytes;
+  }
+  maxMessages;
+  maxBytes;
+  messages = 0;
+  bytes = 0;
+  tryAcquire(bytes) {
+    if (this.messages + 1 > this.maxMessages || this.bytes + bytes > this.maxBytes) return null;
+    this.messages += 1;
+    this.bytes += bytes;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.messages -= 1;
+      this.bytes -= bytes;
+    };
+  }
+};
+var globalObservationBudget = new RawStreamObservationBudget(
+  resolvePositiveIntegerEnv(
+    "AGENT_INSPECTOR_OBSERVATION_GLOBAL_QUEUE_MESSAGES",
+    DEFAULT_GLOBAL_QUEUE_MAX_MESSAGES
+  ),
+  resolvePositiveIntegerEnv(
+    "AGENT_INSPECTOR_OBSERVATION_GLOBAL_QUEUE_BYTES",
+    DEFAULT_GLOBAL_QUEUE_MAX_BYTES
+  )
+);
+
+// src/proxy/storageLifecycle.ts
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
+var DEFAULT_MAX_TOTAL_BYTES = 2 * 1024 * 1024 * 1024;
+var DEFAULT_MAINTENANCE_INTERVAL_MS = 60 * 60 * 1e3;
+
 // src/proxy/store.ts
 var sessionArchiveQueue = Promise.resolve();
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tonyclaw/agent-inspector",
-  "version": "3.1.19",
+  "version": "3.1.21",
   "type": "module",
   "description": "Agent observability and knowledge capture layer for AI coding tools.",
   "license": "MIT",
@@ -64,6 +64,7 @@
     "test:integration": "node scripts/run-local-bun.mjs scripts/run-test-suite.mjs integration",
     "test:changed": "node scripts/run-local-bun.mjs scripts/run-test-suite.mjs changed",
     "test:all": "node scripts/run-local-bun.mjs scripts/run-test-suite.mjs all",
+    "test:hostile-inputs": "bun test src/proxy/identityProxy.test.ts src/proxy/handler.cancellationCompatibility.test.ts src/proxy/logImporter.test.ts src/backend/routes/api/-logs.stream.test.ts src/proxy/handler.admission.test.ts src/proxy/runtimeHealth.test.ts src/proxy/storageLifecycle.test.ts",
     "test:compatibility-tooling": "node scripts/run-compatibility-tests.mjs ultra",
     "test:compatibility-tooling:extended": "node scripts/run-compatibility-tests.mjs extended",
     "test:compatibility-conformance": "node scripts/run-compatibility-tests.mjs conformance",
@@ -82,6 +83,9 @@
     "smoke:ui-preview": "node scripts/smoke-decoupled-ui-preview.mjs",
     "check:bundle": "node scripts/check-client-bundle.mjs",
     "check:boundaries": "node scripts/check-runtime-boundaries.mjs",
+    "check:commercial-performance": "node scripts/check-commercial-performance-budgets.mjs",
+    "check:hostile-inputs": "node scripts/check-hostile-input-coverage.mjs",
+    "check:supply-chain": "node scripts/check-commercial-supply-chain.mjs",
     "compatibility:bdd": "node scripts/lint-bdd-catalog.mjs",
     "compatibility:compare": "node scripts/compatibility/cli.mjs compare",
     "compatibility:drift": "node scripts/check-backend-compatibility.mjs",
@@ -98,7 +102,10 @@
     "rust:pack-package": "node scripts/rust/pack-platform.mjs",
     "rust:native-artifact": "node scripts/rust/create-native-artifact.mjs",
     "rust:native:aggregate": "node scripts/rust/aggregate-native-artifacts.mjs",
-    "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/releaseCore.test.ts",
+    "rust:release-gate:preflight": "node scripts/rust/release-gate-preflight.mjs",
+    "commercial:release-gate:preflight": "node scripts/commercial-release-preflight.mjs",
+    "test:commercial-release-gate": "bun test scripts/commercialReleasePreflight.test.ts",
+    "test:rust-packaging": "bun test scripts/rust/npmPackaging.test.ts scripts/rust/nativeReleaseContract.test.ts scripts/rust/nativeStartupSmoke.test.ts scripts/rust/releaseGatePreflight.test.ts scripts/releaseCore.test.ts",
     "rust:packages:check": "node scripts/rust/sync-package-versions.mjs",
     "rust:packages:sync": "node scripts/rust/sync-package-versions.mjs --write",
     "themes:generate": "node scripts/generate-theme-scales.mjs",
@@ -116,7 +123,7 @@
     "extension:release": "node scripts/release-chrome-extension.mjs",
     "release": "node scripts/release.mjs",
     "knip": "knip",
-    "check": "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun compatibility:bdd && bun rust:packages:check",
+    "check": "bun scripts/run-static-checks.mjs --format && bun check:boundaries && bun check:commercial-performance && bun check:hostile-inputs && bun compatibility:bdd && bun rust:packages:check",
     "prepare": "husky",
     "ladle": "ladle serve",
     "ladle:build": "ladle build"
@@ -146,9 +153,9 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@tonyclaw/agent-inspector-backend-darwin-arm64": "3.1.19",
-    "@tonyclaw/agent-inspector-backend-linux-x64-gnu": "3.1.19",
-    "@tonyclaw/agent-inspector-backend-win32-x64-msvc": "3.1.19",
+    "@tonyclaw/agent-inspector-backend-darwin-arm64": "3.1.21",
+    "@tonyclaw/agent-inspector-backend-linux-x64-gnu": "3.1.21",
+    "@tonyclaw/agent-inspector-backend-win32-x64-msvc": "3.1.21",
     "better-sqlite3": "^12.11.1",
     "rcedit": "4.0.1"
   },

package/src/backend/routes/api/logs.$id.replay.ts

@@ -24,6 +24,7 @@ import {
 } from "../../../proxy/upstream";
 import { computeTokensPerSecond } from "../../../proxy/streamTiming";
 import { safeFetch } from "../../../lib/safeFetch";
+import { DEFAULT_RUNTIME_BUDGET_POLICY } from "../../../lib/resourceLimits";
 
 type ReplayRequest = {
   modifiedBody: string;
@@ -136,7 +137,11 @@ export const Route = createFileRoute("/api/logs/$id/replay")({
               headers,
               body: modifiedBody,
             },
-            { allowLoopback: process.env["AGENT_INSPECTOR_ALLOW_LOOPBACK"] === "1" },
+            {
+              allowLoopback: process.env["AGENT_INSPECTOR_ALLOW_LOOPBACK"] === "1",
+              deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.replayDeadlineMs,
+              responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.replayResponseBytes,
+            },
           );
           if (!fetchResult.ok) {
             return Response.json({

package/src/backend/routes/api/logs.stream.ts

@@ -18,6 +18,13 @@ const UPDATE_COALESCE_MS = 50;
 const MAX_BUFFERED_UPDATE_EVENTS = 16;
 const sseClientLimiter = createCapacityLimiter(MAX_SSE_CLIENTS);
 
+export function getLogsStreamMetrics(): { activeClients: number; capacity: number } {
+  return {
+    activeClients: sseClientLimiter.activeCount(),
+    capacity: sseClientLimiter.capacity,
+  };
+}
+
 export function streamIncludesBodies(url: URL): boolean {
   return url.searchParams.get("compact") === "0";
 }

package/src/backend/routes/api/providers.$providerId.model-metadata.ts

@@ -9,7 +9,11 @@ import {
   ProviderModelRegistrySchema,
 } from "../../../lib/providerModelMetadata";
 import { safeFetch } from "../../../lib/safeFetch";
-import { MAX_PROVIDER_MODELS, resourceLimitResponse } from "../../../lib/resourceLimits";
+import {
+  DEFAULT_RUNTIME_BUDGET_POLICY,
+  MAX_PROVIDER_MODELS,
+  resourceLimitResponse,
+} from "../../../lib/resourceLimits";
 
 const RefreshModelMetadataInputSchema = z.object({
   url: z.string().optional(),
@@ -85,9 +89,16 @@ export const Route = createFileRoute("/api/providers/$providerId/model-metadata"
 
         let response: Response;
         try {
-          const fetchResult = await safeFetch(sourceUrl, {
-            headers: { Accept: "application/json" },
-          });
+          const fetchResult = await safeFetch(
+            sourceUrl,
+            {
+              headers: { Accept: "application/json" },
+            },
+            {
+              deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataDeadlineMs,
+              responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataResponseBytes,
+            },
+          );
           if (!fetchResult.ok) {
             return Response.json(
               { error: `Model metadata URL blocked: ${fetchResult.reason}` },

package/src/backend/routes/api/storage.ts

@@ -0,0 +1,56 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { getLogStorageStats } from "../../../proxy/store";
+import {
+  getLastStorageLifecycleGcResult,
+  getStorageLifecycleInventory,
+  resolveStorageLifecycleQuotaPolicy,
+  runStorageLifecycleGc,
+  type StorageLifecycleGcResult,
+} from "../../../proxy/storageLifecycle";
+
+function summarizeGcResult(result: StorageLifecycleGcResult | null) {
+  if (result === null) return null;
+  return {
+    checkedAt: result.checkedAt,
+    filesDeleted: result.filesDeleted,
+    bytesDeleted: result.bytesDeleted,
+    errors: result.errors.length,
+    beforeTotalBytes: result.before.totalBytes,
+    afterTotalBytes: result.after.totalBytes,
+  };
+}
+
+function getStorageResponse() {
+  const logStats = getLogStorageStats();
+  const inventory = getStorageLifecycleInventory();
+  const policy = resolveStorageLifecycleQuotaPolicy();
+  const reclaimableBytes = inventory.artifacts
+    .filter(
+      (artifact) =>
+        artifact.cleanupBehavior === "retention-gc" ||
+        artifact.cleanupBehavior === "orphan-reclaim",
+    )
+    .reduce((sum, artifact) => sum + artifact.bytes, 0);
+
+  return {
+    memoryCount: logStats.memoryCount,
+    inventory,
+    policy,
+    reclaimableBytes,
+    lastGc: summarizeGcResult(getLastStorageLifecycleGcResult()),
+  };
+}
+
+export const Route = createFileRoute("/api/storage")({
+  server: {
+    handlers: {
+      GET: () => {
+        return Response.json(getStorageResponse(), { headers: { "cache-control": "no-store" } });
+      },
+      POST: () => {
+        runStorageLifecycleGc();
+        return Response.json(getStorageResponse(), { headers: { "cache-control": "no-store" } });
+      },
+    },
+  },
+});

package/src/backend/routes/metrics.ts

@@ -0,0 +1,14 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { getLogsStreamMetrics } from "./api/logs.stream";
+import { getSafeOperationalMetrics } from "../../proxy/runtimeMetrics";
+
+export const Route = createFileRoute("/metrics")({
+  server: {
+    handlers: {
+      GET: async () => {
+        const metrics = await getSafeOperationalMetrics(getLogsStreamMetrics());
+        return Response.json(metrics, { headers: { "cache-control": "no-store" } });
+      },
+    },
+  },
+});