@tonyclaw/agent-inspector 3.1.19 → 3.1.21

package/.output/server/_ssr/{router-0qlvqhVh.mjs → router-Be6BLuut.mjs}

@@ -2,19 +2,21 @@ import { c as createRouter, a as createRootRoute, b as createFileRoute } from ".
 import { h as getRouterBasePath, r as runWithRequestPublicBasePath, g as getPublicBasePath, b as appendBasePathToOrigin, c as getPublicOrigin, w as withBasePath, s as stripBasePath, a as getConfiguredBasePath, n as normalizePublicBasePath, f as AGENT_INSPECTOR_BASE_PATH_ENV, d as getPublicPort, A as AGENT_INSPECTOR_PUBLIC_BASE_PATH_HEADER, e as AGENT_INSPECTOR_PUBLIC_PORT_HEADER } from "./publicBasePathContext-IH2ilOfu.mjs";
 import { randomUUID, timingSafeEqual, createHash, createDecipheriv, randomBytes, createCipheriv } from "node:crypto";
 import fs, { readdir, open, readFile, unlink, appendFile, writeFile, rename, stat, lstat, link, rm, statfs } from "node:fs/promises";
-import path, { basename, join, dirname, isAbsolute, resolve, win32, posix, parse, sep, relative } from "node:path";
-import { existsSync, readFileSync, writeFileSync, renameSync, createReadStream, mkdirSync, readdirSync, statSync, unlinkSync, copyFileSync, rmSync, constants, lstatSync, realpathSync, cpSync, openSync, fstatSync, fchmodSync, closeSync, writeSync, fsyncSync, createWriteStream } from "node:fs";
+import path, { dirname, join, basename, relative, resolve, isAbsolute, win32, posix, parse, sep } from "node:path";
+import { unlinkSync, existsSync, readFileSync, writeFileSync, renameSync, readdirSync, lstatSync, rmSync, cpSync, statSync, createReadStream, mkdirSync, copyFileSync, constants, realpathSync, openSync, fstatSync, fchmodSync, closeSync, writeSync, fsyncSync, createWriteStream } from "node:fs";
 import { spawn, execFileSync, execFile, spawnSync } from "node:child_process";
 import { Buffer } from "node:buffer";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Worker } from "node:worker_threads";
 import { createInterface } from "node:readline";
+import assert from "node:assert/strict";
 import { C as Conf } from "../_libs/conf.mjs";
 import { randomUUID as randomUUID$1 } from "crypto";
 import { promisify } from "node:util";
 import { lookup } from "node:dns/promises";
+import { request as request$1 } from "node:http";
+import { request } from "node:https";
 import { isIP, createServer } from "node:net";
-import assert from "node:assert/strict";
 import { M as McpServer, W as WebStandardStreamableHTTPServerTransport, R as ResourceTemplate } from "../_libs/modelcontextprotocol__server.mjs";
 import { J as JSZip } from "../_libs/jszip.mjs";
 import { homedir } from "node:os";
@@ -67,7 +69,7 @@ import "../_libs/lie.mjs";
 import "../_libs/immediate.mjs";
 import "../_libs/setimmediate.mjs";
 import "../_libs/pako.mjs";
-const Route$U = createRootRoute();
+const Route$W = createRootRoute();
 const PRIVATE_DIRECTORY_MODE = 448;
 const PRIVATE_FILE_MODE = 384;
 const securedPathFingerprints = /* @__PURE__ */ new Map();
@@ -449,6 +451,8 @@ const ToolTraceEventSchema = object({
   argumentsText: string().nullable(),
   argumentsPreview: string().nullable()
 });
+const StopReasonValueSchema = _enum(["end_turn", "tool_use", "stop", "length"]);
+const StopReasonSchema = StopReasonValueSchema.nullable();
 const StreamingChunksArraySchema = object({
   chunks: array(StreamingChunkSchema$1),
   truncated: boolean().optional().default(false)
@@ -509,6 +513,7 @@ const CapturedLogSchema = object({
   captureIncompleteReason: CaptureIncompleteReasonSchema.nullable().optional(),
   warnings: array(string()).optional(),
   toolTraceEvents: array(ToolTraceEventSchema).optional(),
+  stopReason: StopReasonSchema.optional(),
   /** Error message from streaming response (e.g., SSE error event) */
   error: string().nullable().optional()
 });
@@ -1297,8 +1302,8 @@ function canAppendCapturedLogFileOnExit(logDir, filePath) {
     return false;
   }
 }
-const DAY_MS = 24 * 60 * 60 * 1e3;
-const DEFAULT_RETENTION_DAYS = 7;
+const DAY_MS$1 = 24 * 60 * 60 * 1e3;
+const DEFAULT_RETENTION_DAYS$1 = 7;
 const DEFAULT_APP_LOG_MAX_BYTES = 10 * 1024 * 1024;
 const DEFAULT_APP_LOG_MAX_FILES = 5;
 function writeStderrFallback(message, error) {
@@ -1326,6 +1331,9 @@ function getInspectorLogPath() {
   }
   return path.join(getDataDir(), "logs", "inspector.log");
 }
+function resolveApplicationLogPath() {
+  return getInspectorLogPath();
+}
 function readBoundedInteger(name2, fallback, minimum, maximum) {
   const raw = process.env[name2];
   if (raw === void 0 || raw === "") return fallback;
@@ -1334,7 +1342,7 @@ function readBoundedInteger(name2, fallback, minimum, maximum) {
   return parsed;
 }
 function getApplicationLogPolicy() {
-  const retentionDays = readBoundedInteger("LOG_RETENTION_DAYS", DEFAULT_RETENTION_DAYS, 1, 3650);
+  const retentionDays = readBoundedInteger("LOG_RETENTION_DAYS", DEFAULT_RETENTION_DAYS$1, 1, 3650);
   return {
     maxBytes: readBoundedInteger(
       "AGENT_INSPECTOR_APP_LOG_MAX_BYTES",
@@ -1348,7 +1356,7 @@ function getApplicationLogPolicy() {
       1,
       100
     ),
-    retentionMs: retentionDays * DAY_MS
+    retentionMs: retentionDays * DAY_MS$1
   };
 }
 function getRotatedGeneration(entry, baseName) {
@@ -3167,6 +3175,98 @@ function extractToolTraceEvents(log) {
       return [];
   }
 }
+function normalizeAnthropicStopReason(value) {
+  switch (value) {
+    case "end_turn":
+    case "tool_use":
+      return value;
+    case "max_tokens":
+      return "length";
+    default:
+      return null;
+  }
+}
+function extractStopReasonFromJsonValue(value) {
+  if (!isRecord$2(value)) return null;
+  if (typeof value.stop_reason === "string") {
+    return normalizeAnthropicStopReason(value.stop_reason);
+  }
+  if (isRecord$2(value.delta) && typeof value.delta.stop_reason === "string") {
+    return normalizeAnthropicStopReason(value.delta.stop_reason);
+  }
+  if (Array.isArray(value.choices)) {
+    for (const choice of value.choices) {
+      if (!isRecord$2(choice) || typeof choice.finish_reason !== "string") continue;
+      const reason = normalizeOpenAIFinishReason(choice.finish_reason);
+      if (reason !== null) return reason;
+    }
+  }
+  if (Array.isArray(value.output)) {
+    for (const item of value.output) {
+      if (isRecord$2(item) && item.type === "function_call") {
+        return "tool_use";
+      }
+    }
+    if (value.status === "completed") {
+      return "stop";
+    }
+  }
+  if (value.status === "incomplete" && isRecord$2(value.incomplete_details)) {
+    const reason = value.incomplete_details.reason;
+    if (typeof reason === "string" && isResponsesLengthLimitReason(reason)) {
+      return "length";
+    }
+  }
+  return null;
+}
+function extractStopReasonFromSseText(text) {
+  let stopReason = null;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line.startsWith("data: ")) continue;
+    const data = line.slice(6).trim();
+    if (data === "[DONE]") break;
+    try {
+      const reason = extractStopReasonFromJsonValue(JSON.parse(data));
+      if (reason !== null) stopReason = reason;
+    } catch {
+    }
+  }
+  return stopReason;
+}
+function normalizeOpenAIFinishReason(value) {
+  switch (value) {
+    case "stop":
+    case "length":
+      return value;
+    case "max_tokens":
+      return "length";
+    default:
+      return null;
+  }
+}
+function isResponsesLengthLimitReason(value) {
+  switch (value) {
+    case "max_output_tokens":
+    case "max_tokens":
+      return true;
+    default:
+      return false;
+  }
+}
+function extractStopReason(log) {
+  if (log.stopReason !== void 0) return log.stopReason;
+  if (log.responseText === null) return null;
+  try {
+    let json = JSON.parse(log.responseText);
+    if (typeof json === "string") {
+      json = JSON.parse(json);
+    }
+    return extractStopReasonFromJsonValue(json);
+  } catch {
+    return extractStopReasonFromSseText(log.responseText);
+  }
+}
 const SQLITE_INDEX_FILE = "inspector.sqlite";
 const SQLITE_PACKAGE_NAME$1 = "better-sqlite3";
 const BUN_SQLITE_MODULE_NAME$1 = "bun:sqlite";
@@ -3209,6 +3309,7 @@ CREATE TABLE IF NOT EXISTS log_index (
   dropped_bytes INTEGER NOT NULL DEFAULT 0,
   capture_incomplete_reason TEXT,
   warnings_json TEXT,
+  stop_reason TEXT,
   tool_trace_events_json TEXT,
   error TEXT
 );
@@ -3255,10 +3356,11 @@ INSERT INTO log_index (
   dropped_bytes,
   capture_incomplete_reason,
   warnings_json,
+  stop_reason,
   tool_trace_events_json,
   error
 ) VALUES (
-  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
 )
 ON CONFLICT(id) DO UPDATE SET
   file = excluded.file,
@@ -3297,6 +3399,7 @@ ON CONFLICT(id) DO UPDATE SET
   dropped_bytes = excluded.dropped_bytes,
   capture_incomplete_reason = excluded.capture_incomplete_reason,
   warnings_json = excluded.warnings_json,
+  stop_reason = excluded.stop_reason,
   tool_trace_events_json = excluded.tool_trace_events_json,
   error = excluded.error
 `;
@@ -3378,6 +3481,7 @@ const REQUIRED_SCHEMA_COLUMNS = [
   { name: "dropped_chunks", definition: "INTEGER NOT NULL DEFAULT 0" },
   { name: "dropped_bytes", definition: "INTEGER NOT NULL DEFAULT 0" },
   { name: "capture_incomplete_reason", definition: "TEXT" },
+  { name: "stop_reason", definition: "TEXT" },
   { name: "tool_trace_events_json", definition: "TEXT" }
 ];
 function ensureSchemaColumns(db) {
@@ -3559,6 +3663,7 @@ function entryParams(entry) {
     summary?.droppedBytes ?? 0,
     summary?.captureIncompleteReason ?? null,
     warningJson(summary?.warnings),
+    summary?.stopReason ?? null,
     toolTraceEventsJson(summary),
     summary?.error ?? null
   ];
@@ -3567,6 +3672,143 @@ function readNumber$1(row, name2) {
   const value = readProperty$2(row, name2);
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
+function readString$2(row, name2) {
+  const value = readProperty$2(row, name2);
+  return typeof value === "string" ? value : null;
+}
+function readBoolean(row, name2) {
+  return readNumber$1(row, name2) === 1;
+}
+function readApiFormat(row) {
+  const value = readString$2(row, "api_format");
+  switch (value) {
+    case "anthropic":
+      return "anthropic";
+    case "openai":
+      return "openai";
+    case "unknown":
+    case null:
+      return "unknown";
+    default:
+      return "unknown";
+  }
+}
+function readCaptureIncompleteReason(row) {
+  const value = readString$2(row, "capture_incomplete_reason");
+  switch (value) {
+    case "capacity-exceeded":
+    case "pipeline-closed":
+    case "write-failed":
+    case "finalize-failed":
+    case "upstream-stream-error":
+    case "shutdown":
+      return value;
+    case null:
+    default:
+      return null;
+  }
+}
+function readStopReason(row) {
+  const value = readString$2(row, "stop_reason");
+  switch (value) {
+    case "end_turn":
+    case "tool_use":
+    case "stop":
+    case "length":
+      return value;
+    case null:
+    default:
+      return null;
+  }
+}
+function readWarnings(row) {
+  const value = readString$2(row, "warnings_json");
+  if (value === null) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) return void 0;
+    const warnings = [];
+    for (const item of parsed) {
+      if (typeof item !== "string") return void 0;
+      warnings.push(item);
+    }
+    return warnings;
+  } catch {
+    return void 0;
+  }
+}
+function readToolTraceEvents(row) {
+  const value = readString$2(row, "tool_trace_events_json");
+  if (value === null) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    const result = ToolTraceEventSchema.array().safeParse(parsed);
+    return result.success ? result.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readRequiredNumber(row, name2) {
+  const value = readNumber$1(row, name2);
+  return value === null || !Number.isInteger(value) ? null : value;
+}
+function summaryFromRow(row, id) {
+  return {
+    id,
+    timestamp: readString$2(row, "timestamp") ?? "",
+    method: readString$2(row, "method") ?? "",
+    path: readString$2(row, "path") ?? "",
+    model: readString$2(row, "model"),
+    sessionId: readString$2(row, "session_id"),
+    responseStatus: readNumber$1(row, "response_status"),
+    inputTokens: readNumber$1(row, "input_tokens"),
+    outputTokens: readNumber$1(row, "output_tokens"),
+    cacheCreationInputTokens: readNumber$1(row, "cache_creation_input_tokens"),
+    cacheReadInputTokens: readNumber$1(row, "cache_read_input_tokens"),
+    elapsedMs: readNumber$1(row, "elapsed_ms"),
+    firstChunkMs: readNumber$1(row, "first_chunk_ms"),
+    totalStreamMs: readNumber$1(row, "total_stream_ms"),
+    tokensPerSecond: readNumber$1(row, "tokens_per_second"),
+    streaming: readBoolean(row, "streaming"),
+    userAgent: readString$2(row, "user_agent"),
+    origin: readString$2(row, "origin"),
+    apiFormat: readApiFormat(row),
+    isTest: readBoolean(row, "is_test"),
+    replayOfLogId: readNumber$1(row, "replay_of_log_id"),
+    providerName: readString$2(row, "provider_name"),
+    clientPort: readNumber$1(row, "client_port"),
+    clientPid: readNumber$1(row, "client_pid"),
+    clientCwd: readString$2(row, "client_cwd"),
+    clientProjectFolder: readString$2(row, "client_project_folder"),
+    streamingChunksPath: readString$2(row, "streaming_chunks_path"),
+    rawRequestBodyBytes: readNumber$1(row, "raw_request_body_bytes"),
+    responseTextBytes: readNumber$1(row, "response_text_bytes"),
+    captureIncomplete: readBoolean(row, "capture_incomplete"),
+    droppedChunks: readNumber$1(row, "dropped_chunks") ?? 0,
+    droppedBytes: readNumber$1(row, "dropped_bytes") ?? 0,
+    captureIncompleteReason: readCaptureIncompleteReason(row),
+    warnings: readWarnings(row),
+    stopReason: readStopReason(row),
+    toolTraceEvents: readToolTraceEvents(row),
+    error: readString$2(row, "error")
+  };
+}
+function entryFromRow(row) {
+  const id = readRequiredNumber(row, "id");
+  const file = readString$2(row, "file");
+  const byteOffset = readRequiredNumber(row, "byte_offset");
+  const byteLength = readRequiredNumber(row, "byte_length");
+  if (id === null || file === null || byteOffset === null || byteLength === null) return null;
+  return {
+    id,
+    file,
+    byteOffset,
+    byteLength,
+    sessionId: readString$2(row, "session_id"),
+    model: readString$2(row, "model"),
+    summary: summaryFromRow(row, id)
+  };
+}
 async function getSqliteLogIndexMaxId() {
   const state = await getSqliteState();
   if (state.status !== "ready") return null;
@@ -3579,6 +3821,44 @@ async function upsertSqliteLogIndexEntry(entry) {
   if (state.status !== "ready") return false;
   return runPrepared$1(state.db, UPSERT_SQL$1, entryParams(entry));
 }
+function sqliteCursorWhereClause(filters) {
+  const clauses = [];
+  const params = [];
+  if (filters.sessionId !== void 0) {
+    clauses.push("session_id = ?");
+    params.push(filters.sessionId);
+  }
+  if (filters.model !== void 0) {
+    clauses.push("model = ?");
+    params.push(filters.model);
+  }
+  if (filters.clientPid !== void 0) {
+    clauses.push("client_pid = ?");
+    params.push(filters.clientPid);
+  }
+  return {
+    sql: clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`,
+    params
+  };
+}
+async function listSqliteLogCursorEntries(filters) {
+  const state = await getSqliteState();
+  if (state.status !== "ready") return null;
+  const where = sqliteCursorWhereClause(filters);
+  const rows = allPrepared$1(
+    state.db,
+    `SELECT * FROM log_index${where.sql} ORDER BY id ASC`,
+    where.params
+  );
+  if (rows === null) return null;
+  const entries = [];
+  for (const row of rows) {
+    const entry = entryFromRow(row);
+    if (entry === null || entry.summary === void 0) return null;
+    entries.push(entry);
+  }
+  return entries;
+}
 async function syncSqliteLogIndexEntries(entries) {
   const state = await getSqliteState();
   if (state.status !== "ready") return false;
@@ -4064,6 +4344,7 @@ function createLogIndexEntryMetadata(log) {
       droppedBytes: log.droppedBytes ?? 0,
       captureIncompleteReason: log.captureIncompleteReason ?? null,
       warnings: log.warnings,
+      stopReason: log.stopReason ?? extractStopReason(log),
       toolTraceEvents: extractToolTraceEvents(log),
       error: log.error ?? null
     }
@@ -4076,8 +4357,33 @@ function createEmptyIndex() {
     maxId: 0
   };
 }
+function createIndexFromEntries(entries) {
+  const index = createEmptyIndex();
+  for (const entry of entries) {
+    index.entries[entry.id] = entry;
+    index.maxId = Math.max(index.maxId, entry.id);
+  }
+  return index;
+}
+function sqliteProjectionReferencesExistingLedgers(entries) {
+  const logDir = resolveLogDir();
+  for (const entry of entries) {
+    if (!entry.file.endsWith(".jsonl")) return false;
+    if (!existsSync(join(logDir, entry.file))) return false;
+  }
+  return true;
+}
 async function loadIndex() {
   if (cachedIndex !== null) return cachedIndex;
+  const sqliteEntries = await listSqliteLogCursorEntries({});
+  if (sqliteEntries !== null) {
+    if (sqliteProjectionReferencesExistingLedgers(sqliteEntries)) {
+      cachedIndex = createIndexFromEntries(sqliteEntries);
+      allocatedMaxId = Math.max(allocatedMaxId, cachedIndex.maxId);
+      return cachedIndex;
+    }
+    logger.warn("[logIndex] SQLite projection references missing ledgers; rebuilding from JSONL");
+  }
   return await rebuildIndex();
 }
 async function saveIndex(index) {
@@ -4114,8 +4420,10 @@ async function addToIndex(id, file, byteOffset, byteLength, metadata) {
   if (id > index.maxId) {
     index.maxId = id;
   }
-  void upsertSqliteLogIndexEntry(entry);
-  scheduleIndexFlush();
+  const sqliteUpdated = await upsertSqliteLogIndexEntry(entry);
+  if (!sqliteUpdated) {
+    scheduleIndexFlush();
+  }
 }
 async function updateLogIndexEntryMetadata(log) {
   const index = await loadIndex();
@@ -4126,14 +4434,15 @@ async function updateLogIndexEntryMetadata(log) {
     ...createLogIndexEntryMetadata(log)
   };
   index.entries[log.id] = updated;
-  await upsertSqliteLogIndexEntry(updated);
-  scheduleIndexFlush();
+  const sqliteUpdated = await upsertSqliteLogIndexEntry(updated);
+  if (!sqliteUpdated) scheduleIndexFlush();
 }
 let indexFlushScheduled = false;
 let indexFlushTimeout = null;
 async function flushIndexAsync() {
   indexFlushScheduled = false;
   indexFlushTimeout = null;
+  if (await listSqliteLogCursorEntries({}) !== null) return;
   const index = await loadIndex();
   await saveIndex(index);
 }
@@ -4150,6 +4459,7 @@ async function flushIndex() {
     indexFlushTimeout = null;
   }
   indexFlushScheduled = false;
+  if (await listSqliteLogCursorEntries({}) !== null) return;
   const index = await loadIndex();
   await saveIndex(index);
 }
@@ -4236,6 +4546,19 @@ function readCaptureIncompleteReasonField(entry) {
       return null;
   }
 }
+function readStopReasonField(entry) {
+  const value = readStringOrNullField(entry, "stopReason");
+  switch (value) {
+    case "end_turn":
+    case "tool_use":
+    case "stop":
+    case "length":
+      return value;
+    case null:
+    default:
+      return null;
+  }
+}
 function readStringArrayField(entry, field) {
   const desc = Object.getOwnPropertyDescriptor(entry, field);
   if (desc === void 0 || !Array.isArray(desc.value)) return void 0;
@@ -4287,6 +4610,7 @@ function readLogIndexSummary(entry, id) {
     droppedBytes: readNumberOrNullField(entry, "droppedBytes") ?? 0,
     captureIncompleteReason: readCaptureIncompleteReasonField(entry),
     warnings: readStringArrayField(entry, "warnings"),
+    stopReason: readStopReasonField(entry),
     error: readStringOrNullField(entry, "error")
   };
 }
@@ -4886,94 +5210,876 @@ function getSessionIds() {
 function getSessionSnapshots() {
   return [...sessions$1.values()].map((session) => ({ ...session }));
 }
-const MAX_MEMORY_CACHE = 100;
-const memoryCache = /* @__PURE__ */ new Map();
-const MAX_CURSOR_PAGE_INDEXES = 16;
-const logCursorPageIndexes = /* @__PURE__ */ new Map();
-let sessionArchiveQueue = Promise.resolve();
-const SESSION_ARCHIVE_BATCH_SIZE = 128;
-const SESSION_ARCHIVE_FLUSH_DELAY_MS = 10;
-let sessionArchiveBuffer = [];
-let sessionArchiveFlushTimeout = null;
-function drainSessionArchiveBuffer() {
-  const logs = sessionArchiveBuffer;
-  sessionArchiveBuffer = [];
-  return logs;
-}
-function queueSessionArchiveFlush() {
-  const logs = drainSessionArchiveBuffer();
-  if (logs.length === 0) return;
-  sessionArchiveQueue = sessionArchiveQueue.catch(() => void 0).then(async () => {
-    await archiveSessionLogs(logs);
-  }).catch((err) => {
-    logger.warn("[store] Failed to archive session logs:", String(err));
-  });
-}
-function cancelSessionArchiveFlushTimer() {
-  if (sessionArchiveFlushTimeout === null) return;
-  clearTimeout(sessionArchiveFlushTimeout);
-  sessionArchiveFlushTimeout = null;
-}
-function scheduleSessionArchiveFlush() {
-  if (sessionArchiveFlushTimeout !== null) return;
-  sessionArchiveFlushTimeout = setTimeout(() => {
-    sessionArchiveFlushTimeout = null;
-    queueSessionArchiveFlush();
-  }, SESSION_ARCHIVE_FLUSH_DELAY_MS);
-}
-function cursorPageIndexKey(options) {
-  return JSON.stringify({
-    sessionId: options.sessionId ?? null,
-    model: options.model ?? null,
-    clientPid: options.clientPid ?? null
-  });
-}
-function matchesCursorIndexFilters(log, index) {
-  if (index.sessionId !== void 0 && getLogSessionId(log) !== index.sessionId) return false;
-  if (index.model !== void 0 && log.model !== index.model) return false;
-  if (index.clientPid !== void 0 && log.clientPid !== index.clientPid) return false;
-  return true;
-}
-function insertSortedLogId(ids, id) {
-  if (ids.includes(id)) return;
-  const insertionIndex = ids.findIndex((candidate) => candidate > id);
-  if (insertionIndex === -1) {
-    ids.push(id);
-    return;
+const MAX_REST_LOG_PAGE_SIZE = 200;
+const MAX_SEARCH_QUERY_CHARS = 512;
+const MAX_SEARCH_PROJECT_CHARS = 256;
+const MAX_PROVIDER_MODELS = 64;
+const MAX_PROVIDER_MODEL_NAME_CHARS = 256;
+const MAX_PROVIDER_MODEL_METADATA = 64;
+const MAX_SSE_CLIENTS = 32;
+const MAX_ACTIVE_PROVIDER_TESTS = 2;
+const MAX_PROVIDER_TEST_CONCURRENCY = 4;
+const MAX_ACTIVE_PROXY_REQUESTS = 16;
+const positiveInteger = number().int().positive();
+const RuntimeBudgetPolicySchema = object({
+  proxy: object({
+    requestBytes: positiveInteger,
+    responseBytes: positiveInteger,
+    headerBytes: positiveInteger,
+    deadlineMs: positiveInteger,
+    idleTimeoutMs: positiveInteger,
+    activeRequests: positiveInteger
+  }),
+  control: object({
+    requestBytes: positiveInteger,
+    responseBytes: positiveInteger,
+    headerBytes: positiveInteger,
+    deadlineMs: positiveInteger,
+    idleTimeoutMs: positiveInteger,
+    activeRequests: positiveInteger
+  }),
+  upstream: object({
+    fetchResponseBytes: positiveInteger,
+    fetchDeadlineMs: positiveInteger,
+    replayResponseBytes: positiveInteger,
+    replayDeadlineMs: positiveInteger,
+    metadataResponseBytes: positiveInteger,
+    metadataDeadlineMs: positiveInteger,
+    connectTimeoutMs: positiveInteger,
+    idleTimeoutMs: positiveInteger
+  }),
+  pagination: object({
+    restPageSize: positiveInteger,
+    searchQueryChars: positiveInteger,
+    searchProjectChars: positiveInteger
+  }),
+  sse: object({
+    clients: positiveInteger,
+    initLogs: positiveInteger,
+    heartbeatMs: positiveInteger
+  }),
+  imports: object({
+    archiveBytes: positiveInteger,
+    entries: positiveInteger,
+    entryBytes: positiveInteger,
+    uncompressedBytes: positiveInteger,
+    expansionRatio: positiveInteger
+  }),
+  fanOut: object({
+    providerModels: positiveInteger,
+    providerModelMetadata: positiveInteger,
+    providerTestConcurrency: positiveInteger,
+    activeProviderTests: positiveInteger
+  }),
+  queues: object({
+    proxyRequests: positiveInteger,
+    finalizerJobs: positiveInteger,
+    rawStreamMessages: positiveInteger,
+    rawStreamBytes: positiveInteger,
+    backgroundWorkers: positiveInteger
+  })
+}).superRefine((policy, context) => {
+  if (policy.control.requestBytes > policy.proxy.requestBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["control", "requestBytes"],
+      message: "control request budget must not exceed proxy request budget"
+    });
   }
-  ids.splice(insertionIndex, 0, id);
-}
-function upsertLogCursorPageIndexes(log) {
-  for (const index of logCursorPageIndexes.values()) {
-    if (!matchesCursorIndexFilters(log, index)) {
-      if (index.logsById.delete(log.id)) {
-        index.ids = index.ids.filter((id) => id !== log.id);
-      }
-      index.entriesById.delete(log.id);
-      continue;
-    }
-    index.logsById.set(log.id, log);
-    insertSortedLogId(index.ids, log.id);
+  if (policy.control.responseBytes > policy.proxy.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["control", "responseBytes"],
+      message: "control response budget must not exceed proxy response budget"
+    });
   }
-}
-function removeLogsFromCursorPageIndexes(ids) {
-  if (ids.size === 0) return;
-  for (const index of logCursorPageIndexes.values()) {
-    for (const id of ids) {
-      index.logsById.delete(id);
-      index.entriesById.delete(id);
-    }
-    index.ids = index.ids.filter((id) => !ids.has(id));
+  if (policy.control.activeRequests > policy.proxy.activeRequests) {
+    context.addIssue({
+      code: "custom",
+      path: ["control", "activeRequests"],
+      message: "control active request budget must not exceed proxy active request budget"
+    });
   }
-}
-function clearLogCursorPageIndexes() {
-  logCursorPageIndexes.clear();
-}
-function evictOldestIfNeeded() {
-  while (memoryCache.size > MAX_MEMORY_CACHE) {
-    const oldestKey = memoryCache.keys().next().value;
-    if (oldestKey === void 0) break;
-    memoryCache.delete(oldestKey);
+  if (policy.upstream.fetchResponseBytes > policy.proxy.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "fetchResponseBytes"],
+      message: "upstream fetch response budget must not exceed proxy response budget"
+    });
+  }
+  if (policy.upstream.replayResponseBytes > policy.proxy.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "replayResponseBytes"],
+      message: "upstream replay response budget must not exceed proxy response budget"
+    });
+  }
+  if (policy.upstream.metadataResponseBytes > policy.control.responseBytes) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "metadataResponseBytes"],
+      message: "upstream metadata response budget must not exceed control response budget"
+    });
+  }
+  if (policy.upstream.metadataDeadlineMs > policy.control.deadlineMs) {
+    context.addIssue({
+      code: "custom",
+      path: ["upstream", "metadataDeadlineMs"],
+      message: "upstream metadata deadline must not exceed control deadline"
+    });
+  }
+  if (policy.queues.proxyRequests < policy.proxy.activeRequests) {
+    context.addIssue({
+      code: "custom",
+      path: ["queues", "proxyRequests"],
+      message: "proxy request queue budget must cover active proxy requests"
+    });
+  }
+});
+const DEFAULT_RUNTIME_BUDGET_POLICY = RuntimeBudgetPolicySchema.parse({
+  proxy: {
+    requestBytes: 64 * 1024 * 1024,
+    responseBytes: 256 * 1024 * 1024,
+    headerBytes: 64 * 1024,
+    deadlineMs: 12e4,
+    idleTimeoutMs: 3e4,
+    activeRequests: MAX_ACTIVE_PROXY_REQUESTS
+  },
+  control: {
+    requestBytes: 8 * 1024 * 1024,
+    responseBytes: 64 * 1024 * 1024,
+    headerBytes: 32 * 1024,
+    deadlineMs: 3e4,
+    idleTimeoutMs: 1e4,
+    activeRequests: 8
+  },
+  upstream: {
+    fetchResponseBytes: 256 * 1024 * 1024,
+    fetchDeadlineMs: 12e4,
+    replayResponseBytes: 256 * 1024 * 1024,
+    replayDeadlineMs: 12e4,
+    metadataResponseBytes: 10 * 1024 * 1024,
+    metadataDeadlineMs: 3e4,
+    connectTimeoutMs: 1e4,
+    idleTimeoutMs: 3e4
+  },
+  pagination: {
+    restPageSize: MAX_REST_LOG_PAGE_SIZE,
+    searchQueryChars: MAX_SEARCH_QUERY_CHARS,
+    searchProjectChars: MAX_SEARCH_PROJECT_CHARS
+  },
+  sse: {
+    clients: MAX_SSE_CLIENTS,
+    initLogs: 500,
+    heartbeatMs: 15e3
+  },
+  imports: {
+    archiveBytes: 64 * 1024 * 1024,
+    entries: 5e3,
+    entryBytes: 32 * 1024 * 1024,
+    uncompressedBytes: 256 * 1024 * 1024,
+    expansionRatio: 20
+  },
+  fanOut: {
+    providerModels: MAX_PROVIDER_MODELS,
+    providerModelMetadata: MAX_PROVIDER_MODEL_METADATA,
+    providerTestConcurrency: MAX_PROVIDER_TEST_CONCURRENCY,
+    activeProviderTests: MAX_ACTIVE_PROVIDER_TESTS
+  },
+  queues: {
+    proxyRequests: MAX_ACTIVE_PROXY_REQUESTS,
+    finalizerJobs: 1e3,
+    rawStreamMessages: 16384,
+    rawStreamBytes: 64 * 1024 * 1024,
+    backgroundWorkers: 4
+  }
+});
+const ResourceLimitErrorCodeSchema = _enum([
+  "invalid-page-request",
+  "search-limit-exceeded",
+  "provider-model-limit-exceeded",
+  "sse-capacity-exceeded",
+  "provider-test-capacity-exceeded",
+  "proxy-capacity-exceeded"
+]);
+const ResourceLimitStatusSchema = union([
+  literal(400),
+  literal(413),
+  literal(429),
+  literal(503)
+]);
+const ResourceLimitErrorSchema = object({
+  error: string().min(1).max(300),
+  code: ResourceLimitErrorCodeSchema,
+  status: ResourceLimitStatusSchema,
+  resource: string().min(1).max(80),
+  limit: number().int().positive(),
+  retryable: boolean()
+});
+function createResourceLimitError(input) {
+  return ResourceLimitErrorSchema.parse(input);
+}
+function resourceLimitResponse(input) {
+  const body = createResourceLimitError(input);
+  const headers = new Headers({ "cache-control": "no-store" });
+  if (input.retryAfterSeconds !== void 0) {
+    headers.set("retry-after", String(input.retryAfterSeconds));
+  }
+  return Response.json(body, { status: input.status, headers });
+}
+function parseBoundedIntegerParameter(input) {
+  if (input.value === null) return { ok: true, value: input.fallback };
+  const parsed = Number(input.value);
+  if (!Number.isSafeInteger(parsed) || parsed < input.minimum || parsed > input.maximum) {
+    return {
+      ok: false,
+      response: resourceLimitResponse({
+        error: `Query parameter "${input.parameter}" must be an integer between ${String(input.minimum)} and ${String(input.maximum)}.`,
+        code: "invalid-page-request",
+        status: 400,
+        resource: input.resource,
+        limit: input.maximum,
+        retryable: false
+      })
+    };
+  }
+  return { ok: true, value: parsed };
+}
+function createCapacityLimiter(maxActive) {
+  const capacity = Number.isSafeInteger(maxActive) && maxActive > 0 ? maxActive : 1;
+  let active = 0;
+  return {
+    capacity,
+    activeCount: () => active,
+    tryAcquire: () => {
+      if (active >= capacity) return null;
+      active += 1;
+      let released = false;
+      return {
+        release: () => {
+          if (released) return;
+          released = true;
+          active = Math.max(0, active - 1);
+        }
+      };
+    }
+  };
+}
+async function runWithConcurrencyLimit(tasks2, maxConcurrent) {
+  if (tasks2.length === 0) return;
+  const concurrency = Number.isSafeInteger(maxConcurrent) && maxConcurrent > 0 ? maxConcurrent : 1;
+  const workerCount = Math.min(concurrency, tasks2.length);
+  let nextIndex = 0;
+  const runWorker = async () => {
+    while (nextIndex < tasks2.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      const task = tasks2[index];
+      if (task !== void 0) await task();
+    }
+  };
+  await Promise.all(Array.from({ length: workerCount }, runWorker));
+}
+const DEFAULT_MEMORY_LIMIT_BYTES = 1024 * 1024;
+const FILE_WRITE_BATCH_BYTES = 64 * 1024;
+const DEFAULT_QUEUE_MAX_MESSAGES = 256;
+const DEFAULT_QUEUE_MAX_BYTES = 8 * 1024 * 1024;
+const DEFAULT_GLOBAL_QUEUE_MAX_MESSAGES = 4096;
+const DEFAULT_GLOBAL_QUEUE_MAX_BYTES = 64 * 1024 * 1024;
+const activeCaptures = /* @__PURE__ */ new Set();
+function resolveMemoryLimitBytes() {
+  const raw = process.env["AGENT_INSPECTOR_STREAM_MEMORY_LIMIT_BYTES"];
+  if (raw === void 0 || raw === "") return DEFAULT_MEMORY_LIMIT_BYTES;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 0) return DEFAULT_MEMORY_LIMIT_BYTES;
+  return parsed;
+}
+function resolvePositiveIntegerEnv(name2, fallback) {
+  const raw = process.env[name2];
+  if (raw === void 0 || raw === "") return fallback;
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) return fallback;
+  return parsed;
+}
+function defaultQueueMaxMessages() {
+  return resolvePositiveIntegerEnv(
+    "AGENT_INSPECTOR_OBSERVATION_QUEUE_MESSAGES",
+    DEFAULT_QUEUE_MAX_MESSAGES
+  );
+}
+function defaultQueueMaxBytes() {
+  return resolvePositiveIntegerEnv(
+    "AGENT_INSPECTOR_OBSERVATION_QUEUE_BYTES",
+    DEFAULT_QUEUE_MAX_BYTES
+  );
+}
+class RawStreamObservationBudget {
+  constructor(maxMessages, maxBytes) {
+    this.maxMessages = maxMessages;
+    this.maxBytes = maxBytes;
+  }
+  maxMessages;
+  maxBytes;
+  messages = 0;
+  bytes = 0;
+  tryAcquire(bytes) {
+    if (this.messages + 1 > this.maxMessages || this.bytes + bytes > this.maxBytes) return null;
+    this.messages += 1;
+    this.bytes += bytes;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.messages -= 1;
+      this.bytes -= bytes;
+    };
+  }
+}
+const globalObservationBudget = new RawStreamObservationBudget(
+  resolvePositiveIntegerEnv(
+    "AGENT_INSPECTOR_OBSERVATION_GLOBAL_QUEUE_MESSAGES",
+    DEFAULT_GLOBAL_QUEUE_MAX_MESSAGES
+  ),
+  resolvePositiveIntegerEnv(
+    "AGENT_INSPECTOR_OBSERVATION_GLOBAL_QUEUE_BYTES",
+    DEFAULT_GLOBAL_QUEUE_MAX_BYTES
+  )
+);
+function getRawStreamDir() {
+  return join(getDataDir(), "raw-streams");
+}
+function createRawStreamPath() {
+  return join(getRawStreamDir(), `${Date.now()}-${randomUUID()}.stream.tmp`);
+}
+class RawStreamCapture {
+  memoryLimitBytes;
+  queueMaxMessages;
+  queueMaxBytes;
+  globalBudget;
+  chunks = [];
+  byteLength = 0;
+  filePath = null;
+  fileHandle = null;
+  pendingFileChunks = [];
+  pendingFileBytes = 0;
+  operation = Promise.resolve();
+  accepting = true;
+  closed = false;
+  sawChunk = false;
+  queuedMessages = 0;
+  queuedBytes = 0;
+  incomplete = false;
+  storageFailed = false;
+  droppedChunks = 0;
+  droppedBytes = 0;
+  gapReason = null;
+  constructor(options = {}) {
+    this.memoryLimitBytes = options.memoryLimitBytes ?? resolveMemoryLimitBytes();
+    this.queueMaxMessages = options.queueMaxMessages ?? defaultQueueMaxMessages();
+    this.queueMaxBytes = options.queueMaxBytes ?? defaultQueueMaxBytes();
+    this.globalBudget = options.globalBudget ?? globalObservationBudget;
+    activeCaptures.add(this);
+  }
+  get hasChunks() {
+    return this.sawChunk;
+  }
+  get status() {
+    return {
+      incomplete: this.incomplete,
+      droppedChunks: this.droppedChunks,
+      droppedBytes: this.droppedBytes,
+      reason: this.gapReason
+    };
+  }
+  recordDroppedObservation(reason, observedBytes) {
+    const safeObservedBytes = Number.isSafeInteger(observedBytes) && observedBytes >= 0 ? observedBytes : 0;
+    this.recordGap(reason, safeObservedBytes, safeObservedBytes > 0);
+  }
+  async append(text) {
+    if (text === "") return;
+    const next = this.operation.then(() => this.appendInternal(text));
+    this.operation = next.catch(() => void 0);
+    return next;
+  }
+  /**
+   * Submit an observation without waiting for file I/O. Once capacity is exceeded, capture remains
+   * incomplete and all later chunks are counted as dropped so the persisted value is an honest
+   * prefix rather than a misleading stream with an unmarked hole.
+   */
+  tryAppend(text, observedBytes) {
+    const safeObservedBytes = Number.isSafeInteger(observedBytes) && observedBytes >= 0 ? observedBytes : 0;
+    const queuedBytes = Math.max(safeObservedBytes, Buffer.byteLength(text, "utf-8"));
+    if (!this.accepting || this.closed) {
+      this.recordGap("pipeline-closed", safeObservedBytes, safeObservedBytes > 0 || text !== "");
+      return false;
+    }
+    if (this.incomplete) {
+      this.recordGap("capacity-exceeded", safeObservedBytes, safeObservedBytes > 0 || text !== "");
+      return false;
+    }
+    if (text === "") return true;
+    if (this.queuedMessages + 1 > this.queueMaxMessages || this.queuedBytes + queuedBytes > this.queueMaxBytes) {
+      this.recordGap("capacity-exceeded", safeObservedBytes, true);
+      return false;
+    }
+    const releaseGlobal = this.globalBudget.tryAcquire(queuedBytes);
+    if (releaseGlobal === null) {
+      this.recordGap("capacity-exceeded", safeObservedBytes, true);
+      return false;
+    }
+    this.queuedMessages += 1;
+    this.queuedBytes += queuedBytes;
+    this.operation = this.operation.then(async () => {
+      if (this.storageFailed) {
+        this.recordGap("write-failed", safeObservedBytes, true);
+        return;
+      }
+      await this.appendInternal(text);
+    }).catch(() => {
+      this.storageFailed = true;
+      this.recordGap("write-failed", safeObservedBytes, true);
+    }).finally(() => {
+      this.queuedMessages -= 1;
+      this.queuedBytes -= queuedBytes;
+      releaseGlobal();
+    });
+    return true;
+  }
+  async finalize() {
+    this.accepting = false;
+    const next = this.operation.then(() => this.finalizeInternal());
+    this.operation = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next.finally(() => activeCaptures.delete(this));
+  }
+  async appendInternal(text) {
+    if (this.closed) return;
+    this.sawChunk = true;
+    const nextBytes = Buffer.byteLength(text, "utf-8");
+    if (this.filePath === null && this.byteLength + nextBytes <= this.memoryLimitBytes) {
+      this.chunks.push(text);
+      this.byteLength += nextBytes;
+      return;
+    }
+    if (this.filePath === null) {
+      await this.spillToFile();
+    }
+    if (this.filePath !== null) {
+      this.pendingFileChunks.push(text);
+      this.pendingFileBytes += nextBytes;
+      this.byteLength += nextBytes;
+      if (this.pendingFileBytes >= FILE_WRITE_BATCH_BYTES) await this.flushFileBuffer();
+    }
+  }
+  recordGap(reason, observedBytes, countChunk) {
+    this.incomplete = true;
+    this.gapReason ??= reason;
+    if (countChunk) this.droppedChunks += 1;
+    this.droppedBytes += observedBytes;
+  }
+  async finalizeInternal() {
+    if (!this.closed) {
+      this.closed = true;
+      await this.flushFileBuffer();
+      if (this.fileHandle !== null) {
+        const handle = this.fileHandle;
+        this.fileHandle = null;
+        try {
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+      }
+    }
+    if (this.filePath !== null) {
+      return { type: "file", path: this.filePath };
+    }
+    return { type: "memory", rawStream: this.chunks.join("") };
+  }
+  async spillToFile() {
+    const path2 = createRawStreamPath();
+    assert(ensurePrivateDirectorySync(getRawStreamDir()), "Could not secure raw-stream directory");
+    const handle = await open(path2, "wx", PRIVATE_FILE_MODE);
+    let committed = false;
+    try {
+      const memoryText = this.chunks.join("");
+      if (memoryText.length > 0) await handle.write(memoryText, void 0, "utf-8");
+      assert(securePrivateFileSync(path2), "Could not secure raw-stream file");
+      this.filePath = path2;
+      this.fileHandle = handle;
+      this.chunks = [];
+      committed = true;
+    } finally {
+      if (!committed) {
+        await handle.close().catch(() => void 0);
+        await unlink(path2).catch(() => void 0);
+      }
+    }
+  }
+  async flushFileBuffer() {
+    if (this.fileHandle === null || this.pendingFileChunks.length === 0) return;
+    const text = this.pendingFileChunks.join("");
+    this.pendingFileChunks = [];
+    this.pendingFileBytes = 0;
+    await this.fileHandle.write(text, void 0, "utf-8");
+  }
+}
+async function flushAllRawStreamCaptures() {
+  await Promise.all([...activeCaptures].map((capture) => capture.finalize()));
+}
+const MAX_INVENTORY_DEPTH = 8;
+const DAY_MS = 24 * 60 * 60 * 1e3;
+const DEFAULT_RETENTION_DAYS = 7;
+const DEFAULT_MAX_TOTAL_BYTES = 2 * 1024 * 1024 * 1024;
+let lastStorageLifecycleGcResult = null;
+function emptyStats() {
+  return {
+    fileCount: 0,
+    bytes: 0,
+    oldestModifiedMs: null,
+    newestModifiedMs: null
+  };
+}
+function recordFile(stats, bytes, modifiedMs) {
+  stats.fileCount += 1;
+  stats.bytes += bytes;
+  stats.oldestModifiedMs = stats.oldestModifiedMs === null ? modifiedMs : Math.min(stats.oldestModifiedMs, modifiedMs);
+  stats.newestModifiedMs = stats.newestModifiedMs === null ? modifiedMs : Math.max(stats.newestModifiedMs, modifiedMs);
+}
+function isoFromMs(value) {
+  return value === null ? null : new Date(value).toISOString();
+}
+function isPathInsideRoot(root, path2) {
+  const relativePath = relative(resolve(root), resolve(path2));
+  return relativePath.length === 0 || !relativePath.startsWith("..") && !relativePath.startsWith("/") && !relativePath.startsWith("\\");
+}
+function collectRuleFiles(rule) {
+  const files = [];
+  if (!existsSync(rule.root)) return files;
+  const visit = (currentDir, depth) => {
+    if (depth > MAX_INVENTORY_DEPTH) return;
+    let entries;
+    try {
+      entries = readdirSync(currentDir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path2 = join(currentDir, entry);
+      if (!isPathInsideRoot(rule.root, path2)) continue;
+      try {
+        const fileStats = lstatSync(path2);
+        if (fileStats.isDirectory()) {
+          visit(path2, depth + 1);
+          continue;
+        }
+        if (!fileStats.isFile() || !rule.shouldCount(entry, path2)) continue;
+        files.push({ rule, path: path2, bytes: fileStats.size, modifiedMs: fileStats.mtimeMs });
+      } catch {
+      }
+    }
+  };
+  visit(rule.root, 0);
+  return files;
+}
+function collectRuleStats(rule) {
+  const stats = emptyStats();
+  for (const file of collectRuleFiles(rule)) {
+    recordFile(stats, file.bytes, file.modifiedMs);
+  }
+  return stats;
+}
+function isAutoDeletableCleanupBehavior(behavior) {
+  switch (behavior) {
+    case "retention-gc":
+    case "orphan-reclaim":
+      return true;
+    case "rotation":
+    case "manual-owner-delete":
+      return false;
+  }
+}
+function summarizeRule(rule) {
+  const stats = collectRuleStats(rule);
+  return {
+    kind: rule.kind,
+    root: rule.root,
+    sensitivity: rule.sensitivity,
+    cleanupBehavior: rule.cleanupBehavior,
+    fileCount: stats.fileCount,
+    bytes: stats.bytes,
+    oldestModifiedAt: isoFromMs(stats.oldestModifiedMs),
+    newestModifiedAt: isoFromMs(stats.newestModifiedMs)
+  };
+}
+function isSessionArchiveFile(fileName) {
+  return fileName === "session.sqlite" || fileName.startsWith("session.sqlite-");
+}
+function isSqliteLogIndexFile(fileName) {
+  return fileName === "inspector.sqlite" || fileName.startsWith("inspector.sqlite-");
+}
+function isBackupFile(fileName) {
+  return fileName.endsWith(".bak") || fileName.endsWith(".backup");
+}
+function applicationLogMatcher(logPath) {
+  const directory = dirname(logPath);
+  const baseName = basename(logPath);
+  return (fileName, path2) => {
+    if (dirname(path2) !== directory) return false;
+    if (fileName === baseName) return true;
+    return fileName.startsWith(`${baseName}.`) && /^\d+$/.test(fileName.slice(baseName.length + 1));
+  };
+}
+function parsePositiveIntegerEnv(name2, fallback) {
+  const value = process.env[name2];
+  if (value === void 0) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+  return parsed;
+}
+function resolveStorageLifecycleQuotaPolicy() {
+  const retentionDays = parsePositiveIntegerEnv(
+    "AGENT_INSPECTOR_STORAGE_RETENTION_DAYS",
+    parsePositiveIntegerEnv("LOG_RETENTION_DAYS", DEFAULT_RETENTION_DAYS)
+  );
+  return {
+    maxAgeMs: retentionDays * DAY_MS,
+    maxTotalBytes: parsePositiveIntegerEnv(
+      "AGENT_INSPECTOR_STORAGE_MAX_BYTES",
+      DEFAULT_MAX_TOTAL_BYTES
+    )
+  };
+}
+function getStorageLifecycleInventoryRules() {
+  const applicationLogPath = resolveApplicationLogPath();
+  return [
+    {
+      kind: "captured-log-jsonl",
+      root: resolveLogDir(),
+      sensitivity: "captured-data",
+      cleanupBehavior: "retention-gc",
+      shouldCount: (fileName) => fileName.endsWith(".jsonl")
+    },
+    {
+      kind: "sqlite-log-index",
+      root: resolveLogDir(),
+      sensitivity: "captured-data",
+      cleanupBehavior: "orphan-reclaim",
+      shouldCount: isSqliteLogIndexFile
+    },
+    {
+      kind: "session-archive",
+      root: getSessionArchiveRoot(),
+      sensitivity: "captured-data",
+      cleanupBehavior: "retention-gc",
+      shouldCount: isSessionArchiveFile
+    },
+    {
+      kind: "streaming-chunk",
+      root: getChunksDir(),
+      sensitivity: "captured-data",
+      cleanupBehavior: "retention-gc",
+      shouldCount: (fileName) => fileName.endsWith(".json")
+    },
+    {
+      kind: "raw-stream-temp",
+      root: getRawStreamDir(),
+      sensitivity: "captured-data",
+      cleanupBehavior: "orphan-reclaim",
+      shouldCount: () => true
+    },
+    {
+      kind: "application-log",
+      root: dirname(applicationLogPath),
+      sensitivity: "operational",
+      cleanupBehavior: "rotation",
+      shouldCount: applicationLogMatcher(applicationLogPath)
+    },
+    {
+      kind: "evidence",
+      root: join(getDataDir(), "evidence"),
+      sensitivity: "captured-data",
+      cleanupBehavior: "manual-owner-delete",
+      shouldCount: () => true
+    },
+    {
+      kind: "backup",
+      root: getDataDir(),
+      sensitivity: "secret-adjacent",
+      cleanupBehavior: "orphan-reclaim",
+      shouldCount: isBackupFile
+    }
+  ];
+}
+function getStorageLifecycleInventory(rules = getStorageLifecycleInventoryRules()) {
+  const artifacts = rules.map(summarizeRule);
+  return {
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    totalFiles: artifacts.reduce((sum, artifact) => sum + artifact.fileCount, 0),
+    totalBytes: artifacts.reduce((sum, artifact) => sum + artifact.bytes, 0),
+    artifacts
+  };
+}
+function collectLifecycleFiles(rules = getStorageLifecycleInventoryRules()) {
+  return rules.flatMap((rule) => collectRuleFiles(rule));
+}
+function selectGcCandidates(files, policy, nowMs) {
+  const autoDeletableFiles = files.filter(
+    (file) => isAutoDeletableCleanupBehavior(file.rule.cleanupBehavior)
+  );
+  const expiredFiles = autoDeletableFiles.filter(
+    (file) => nowMs - file.modifiedMs > policy.maxAgeMs
+  );
+  const expiredPaths = new Set(expiredFiles.map((file) => file.path));
+  const candidates2 = [...expiredFiles];
+  let totalBytes = files.reduce((sum, file) => sum + file.bytes, 0) - expiredFiles.reduce((sum, file) => sum + file.bytes, 0);
+  if (totalBytes <= policy.maxTotalBytes) return candidates2;
+  const quotaCandidates = autoDeletableFiles.filter((file) => !expiredPaths.has(file.path)).sort((a, b) => a.modifiedMs - b.modifiedMs);
+  for (const file of quotaCandidates) {
+    if (totalBytes <= policy.maxTotalBytes) break;
+    candidates2.push(file);
+    totalBytes -= file.bytes;
+  }
+  return candidates2;
+}
+function deleteLifecycleFile(file) {
+  if (!isPathInsideRoot(file.rule.root, file.path)) {
+    return { kind: file.rule.kind, path: file.path, message: "path outside lifecycle root" };
+  }
+  try {
+    unlinkSync(file.path);
+    return null;
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("ENOENT")) return null;
+    return { kind: file.rule.kind, path: file.path, message: String(err) };
+  }
+}
+function runStorageLifecycleGc(policy = resolveStorageLifecycleQuotaPolicy(), rules = getStorageLifecycleInventoryRules(), nowMs = Date.now()) {
+  const before = getStorageLifecycleInventory(rules);
+  const files = collectLifecycleFiles(rules);
+  const candidates2 = selectGcCandidates(files, policy, nowMs);
+  const errors = [];
+  let filesDeleted = 0;
+  let bytesDeleted = 0;
+  for (const file of candidates2) {
+    const error = deleteLifecycleFile(file);
+    if (error !== null) {
+      errors.push(error);
+      continue;
+    }
+    filesDeleted += 1;
+    bytesDeleted += file.bytes;
+  }
+  const after = getStorageLifecycleInventory(rules);
+  const autoDeletableBytes = after.artifacts.filter((artifact) => isAutoDeletableCleanupBehavior(artifact.cleanupBehavior)).reduce((sum, artifact) => sum + artifact.bytes, 0);
+  const result = {
+    checkedAt: new Date(nowMs).toISOString(),
+    policy,
+    before,
+    after,
+    filesScanned: files.length,
+    bytesScanned: files.reduce((sum, file) => sum + file.bytes, 0),
+    filesDeleted,
+    bytesDeleted,
+    reclaimableBytes: autoDeletableBytes,
+    errors
+  };
+  lastStorageLifecycleGcResult = result;
+  return result;
+}
+function getLastStorageLifecycleGcResult() {
+  return lastStorageLifecycleGcResult;
+}
+const MAX_MEMORY_CACHE = 100;
+const memoryCache = /* @__PURE__ */ new Map();
+const MAX_CURSOR_PAGE_INDEXES = 16;
+const logCursorPageIndexes = /* @__PURE__ */ new Map();
+let sessionArchiveQueue = Promise.resolve();
+const SESSION_ARCHIVE_BATCH_SIZE = 128;
+const SESSION_ARCHIVE_FLUSH_DELAY_MS = 10;
+let sessionArchiveBuffer = [];
+let sessionArchiveFlushTimeout = null;
+function drainSessionArchiveBuffer() {
+  const logs = sessionArchiveBuffer;
+  sessionArchiveBuffer = [];
+  return logs;
+}
+function queueSessionArchiveFlush() {
+  const logs = drainSessionArchiveBuffer();
+  if (logs.length === 0) return;
+  sessionArchiveQueue = sessionArchiveQueue.catch(() => void 0).then(async () => {
+    await archiveSessionLogs(logs);
+  }).catch((err) => {
+    logger.warn("[store] Failed to archive session logs:", String(err));
+  });
+}
+function cancelSessionArchiveFlushTimer() {
+  if (sessionArchiveFlushTimeout === null) return;
+  clearTimeout(sessionArchiveFlushTimeout);
+  sessionArchiveFlushTimeout = null;
+}
+function scheduleSessionArchiveFlush() {
+  if (sessionArchiveFlushTimeout !== null) return;
+  sessionArchiveFlushTimeout = setTimeout(() => {
+    sessionArchiveFlushTimeout = null;
+    queueSessionArchiveFlush();
+  }, SESSION_ARCHIVE_FLUSH_DELAY_MS);
+}
+function cursorPageIndexKey(options) {
+  return JSON.stringify({
+    sessionId: options.sessionId ?? null,
+    model: options.model ?? null,
+    clientPid: options.clientPid ?? null
+  });
+}
+function matchesCursorIndexFilters(log, index) {
+  if (index.sessionId !== void 0 && getLogSessionId(log) !== index.sessionId) return false;
+  if (index.model !== void 0 && log.model !== index.model) return false;
+  if (index.clientPid !== void 0 && log.clientPid !== index.clientPid) return false;
+  return true;
+}
+function insertSortedLogId(ids, id) {
+  if (ids.includes(id)) return;
+  const insertionIndex = ids.findIndex((candidate) => candidate > id);
+  if (insertionIndex === -1) {
+    ids.push(id);
+    return;
+  }
+  ids.splice(insertionIndex, 0, id);
+}
+function upsertLogCursorPageIndexes(log) {
+  for (const index of logCursorPageIndexes.values()) {
+    if (!matchesCursorIndexFilters(log, index)) {
+      if (index.logsById.delete(log.id)) {
+        index.ids = index.ids.filter((id) => id !== log.id);
+      }
+      index.entriesById.delete(log.id);
+      continue;
+    }
+    index.logsById.set(log.id, log);
+    insertSortedLogId(index.ids, log.id);
+  }
+}
+function removeLogsFromCursorPageIndexes(ids) {
+  if (ids.size === 0) return;
+  for (const index of logCursorPageIndexes.values()) {
+    for (const id of ids) {
+      index.logsById.delete(id);
+      index.entriesById.delete(id);
+    }
+    index.ids = index.ids.filter((id) => !ids.has(id));
+  }
+}
+function clearLogCursorPageIndexes() {
+  logCursorPageIndexes.clear();
+}
+function evictOldestIfNeeded() {
+  while (memoryCache.size > MAX_MEMORY_CACHE) {
+    const oldestKey = memoryCache.keys().next().value;
+    if (oldestKey === void 0) break;
+    memoryCache.delete(oldestKey);
   }
 }
 function normalizeLog(log) {
@@ -4984,7 +6090,8 @@ function normalizeLog(log) {
   const droppedChunks = log.droppedChunks ?? 0;
   const droppedBytes = log.droppedBytes ?? 0;
   const captureIncompleteReason = log.captureIncompleteReason ?? null;
-  if (sessionId === log.sessionId && apiFormat === log.apiFormat && log.captureIncomplete !== void 0 && log.droppedChunks !== void 0 && log.droppedBytes !== void 0 && log.captureIncompleteReason !== void 0) {
+  const stopReason = log.stopReason ?? extractStopReason(log);
+  if (sessionId === log.sessionId && apiFormat === log.apiFormat && log.captureIncomplete !== void 0 && log.droppedChunks !== void 0 && log.droppedBytes !== void 0 && log.captureIncompleteReason !== void 0 && log.stopReason !== void 0) {
     return log;
   }
   return {
@@ -4994,7 +6101,8 @@ function normalizeLog(log) {
     captureIncomplete,
     droppedChunks,
     droppedBytes,
-    captureIncompleteReason
+    captureIncompleteReason,
+    stopReason
   };
 }
 function addToCache(log) {
@@ -5033,6 +6141,7 @@ function compactLogForList(log) {
     rawHeaders: void 0,
     headers: void 0,
     streamingChunks: void 0,
+    stopReason: log.stopReason ?? extractStopReason(log),
     toolTraceEvents: log.toolTraceEvents ?? extractToolTraceEvents(log),
     rawRequestBodyBytes: log.rawRequestBodyBytes ?? textByteLength(log.rawRequestBody),
     responseTextBytes: log.responseTextBytes ?? textByteLength(log.responseText),
@@ -5078,6 +6187,7 @@ function compactLogFromIndexSummary(summary) {
     droppedBytes: summary.droppedBytes,
     captureIncompleteReason: summary.captureIncompleteReason,
     warnings: summary.warnings,
+    stopReason: summary.stopReason,
     toolTraceEvents: summary.toolTraceEvents,
     error: summary.error
   });
@@ -5440,17 +6550,42 @@ async function listLogsPage(options) {
     limit: options.limit
   };
 }
-function matchesCursorWindow(id, options) {
-  if (options.beforeLogId !== void 0 && id >= options.beforeLogId) return false;
-  if (options.afterLogId !== void 0 && id <= options.afterLogId) return false;
-  return true;
+function lowerBoundLogId(ids, target) {
+  let low = 0;
+  let high = ids.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    const id = ids[middle];
+    if (id === void 0 || id >= target) {
+      high = middle;
+      continue;
+    }
+    low = middle + 1;
+  }
+  return low;
+}
+function upperBoundLogId(ids, target) {
+  let low = 0;
+  let high = ids.length;
+  while (low < high) {
+    const middle = Math.floor((low + high) / 2);
+    const id = ids[middle];
+    if (id === void 0 || id > target) {
+      high = middle;
+      continue;
+    }
+    low = middle + 1;
+  }
+  return low;
 }
 function selectCursorPageLogs(ids, options) {
-  const matchingWindow = ids.filter((id) => matchesCursorWindow(id, options));
+  const windowStart = options.afterLogId === void 0 ? 0 : upperBoundLogId(ids, options.afterLogId);
+  const windowEnd = options.beforeLogId === void 0 ? ids.length : lowerBoundLogId(ids, options.beforeLogId);
+  if (windowStart >= windowEnd) return [];
   if (options.afterLogId !== void 0 || options.anchor === "oldest") {
-    return matchingWindow.slice(0, options.limit);
+    return ids.slice(windowStart, Math.min(windowEnd, windowStart + options.limit));
   }
-  return matchingWindow.slice(Math.max(0, matchingWindow.length - options.limit));
+  return ids.slice(Math.max(windowStart, windowEnd - options.limit), windowEnd);
 }
 function rememberLogCursorPageIndex(index) {
   if (logCursorPageIndexes.has(index.key)) {
@@ -5482,11 +6617,18 @@ function matchesLogIndexEntryFilters(entry, sessionId, model, clientPid) {
   return true;
 }
 async function buildLogCursorPageIndexFromLogIndex(options, allowRebuild) {
-  if (options.clientPid !== void 0) return null;
-  let entries = await listFilteredIndexEntries(options);
+  let entries = await listSqliteLogCursorEntries(options);
+  if (entries === null) {
+    if (options.clientPid !== void 0) return null;
+    entries = await listFilteredIndexEntries(options);
+  }
   if (entries.length === 0 && allowRebuild) {
     await rebuildIndex();
-    entries = await listFilteredIndexEntries(options);
+    entries = await listSqliteLogCursorEntries(options);
+    if (entries === null) {
+      if (options.clientPid !== void 0) return null;
+      entries = await listFilteredIndexEntries(options);
+    }
   }
   if (entries.some((entry) => !hasLogIndexFilterMetadata(entry))) {
     if (!allowRebuild) return null;
@@ -6301,9 +7443,9 @@ function validateValueAgainstSchema(schema, value, toolName, path2, warnings) {
     }
   }
 }
-function extractAnthropicToolSchemas(request) {
+function extractAnthropicToolSchemas(request2) {
   const tools = /* @__PURE__ */ new Map();
-  for (const tool of readArray(request, "tools")) {
+  for (const tool of readArray(request2, "tools")) {
     if (!isRecord$2(tool)) continue;
     const name2 = readString(tool, "name");
     if (name2 === null || name2 === "") continue;
@@ -6314,9 +7456,9 @@ function extractAnthropicToolSchemas(request) {
   }
   return tools;
 }
-function extractOpenAIToolSchemas(request) {
+function extractOpenAIToolSchemas(request2) {
   const tools = /* @__PURE__ */ new Map();
-  for (const tool of readArray(request, "tools")) {
+  for (const tool of readArray(request2, "tools")) {
     const functionDefinition = readObject(tool, "function");
     const name2 = functionDefinition === null ? readString(tool, "name") : readString(functionDefinition, "name") ?? readString(tool, "name");
     if (name2 === null || name2 === "") continue;
@@ -6335,16 +7477,16 @@ function mergeToolSchemas(primary, secondary) {
   }
   return merged;
 }
-function extractToolSchemas(request, apiFormat) {
+function extractToolSchemas(request2, apiFormat) {
   switch (apiFormat) {
     case "anthropic":
-      return extractAnthropicToolSchemas(request);
+      return extractAnthropicToolSchemas(request2);
     case "openai":
-      return extractOpenAIToolSchemas(request);
+      return extractOpenAIToolSchemas(request2);
     case "unknown":
       return mergeToolSchemas(
-        extractOpenAIToolSchemas(request),
-        extractAnthropicToolSchemas(request)
+        extractOpenAIToolSchemas(request2),
+        extractAnthropicToolSchemas(request2)
       );
   }
 }
@@ -6451,10 +7593,10 @@ function uniqueWarnings(warnings) {
   return unique2;
 }
 function analyzeToolSchemaWarnings(input) {
-  const request = parseJson$1(input.rawRequestBody);
+  const request2 = parseJson$1(input.rawRequestBody);
   const response = parseJson$1(input.responseText);
-  if (!request.ok || !response.ok) return [];
-  const toolSchemas = extractToolSchemas(request.value, input.apiFormat);
+  if (!request2.ok || !response.ok) return [];
+  const toolSchemas = extractToolSchemas(request2.value, input.apiFormat);
   const toolCalls = extractToolCalls(response.value, input.apiFormat);
   if (toolCalls.length === 0) return [];
   const warnings = [];
@@ -7061,6 +8203,84 @@ async function closeLogFinalizerWorkers() {
 function forceCloseLogFinalizerWorkers() {
   for (const worker of detachLogFinalizerWorkers()) void worker.terminate();
 }
+const UNASSIGNED_SESSION_QUEUE = "__unassigned__";
+const queues = /* @__PURE__ */ new Map();
+let queuedTaskCount = 0;
+class SessionTaskQueueRejectedError extends Error {
+  constructor(limit) {
+    super(`Session task queue is full; limit=${String(limit)}`);
+    this.name = "SessionTaskQueueRejectedError";
+  }
+}
+function queueKeyForSession(sessionId) {
+  return sessionId ?? UNASSIGNED_SESSION_QUEUE;
+}
+function resolveSessionTaskQueueLimit() {
+  const configured = Number(process.env["SESSION_TASK_QUEUE_LIMIT"]);
+  if (Number.isSafeInteger(configured) && configured > 0) return configured;
+  return DEFAULT_RUNTIME_BUDGET_POLICY.queues.finalizerJobs;
+}
+function errorMessage$1(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function runSessionTask(sessionId, taskName, task) {
+  markSessionTaskStarted(sessionId);
+  try {
+    const result = await task();
+    markSessionTaskFinished(sessionId, null);
+    return result;
+  } catch (err) {
+    const message = errorMessage$1(err);
+    logger.error(`[sessionRuntime] ${taskName} failed for session ${sessionId ?? "unassigned"}`);
+    markSessionTaskFinished(sessionId, message);
+    return Promise.reject(err);
+  }
+}
+function enqueueSessionTask(sessionId, taskName, task) {
+  const queueLimit = resolveSessionTaskQueueLimit();
+  if (queuedTaskCount >= queueLimit) {
+    logger.warn(
+      `[sessionRuntime] Rejecting ${taskName} for session ${sessionId ?? "unassigned"}: queue full (${String(queuedTaskCount)}/${String(queueLimit)})`
+    );
+    return Promise.reject(new SessionTaskQueueRejectedError(queueLimit));
+  }
+  const queueKey = queueKeyForSession(sessionId);
+  const previous = queues.get(queueKey) ?? Promise.resolve();
+  queuedTaskCount += 1;
+  markSessionTaskQueued(sessionId);
+  const current = previous.catch(() => void 0).then(() => runSessionTask(sessionId, taskName, task));
+  const settled = current.then(
+    () => void 0,
+    () => void 0
+  );
+  queues.set(queueKey, settled);
+  void settled.then(() => {
+    queuedTaskCount = Math.max(0, queuedTaskCount - 1);
+    if (queues.get(queueKey) === settled) {
+      queues.delete(queueKey);
+    }
+  });
+  return current;
+}
+function enqueueFinalizeLogJob(job) {
+  return enqueueSessionTask(
+    getLogSessionId(job.log),
+    "finalize-log",
+    () => executeFinalizeLogJob(job)
+  );
+}
+async function flushSessionTasks() {
+  while (queues.size > 0) {
+    await Promise.all([...queues.values()]);
+  }
+}
+function getSessionRuntimeQueueHealth() {
+  return {
+    activeQueues: queues.size,
+    queuedTasks: queuedTaskCount,
+    queueLimit: resolveSessionTaskQueueLimit()
+  };
+}
 const DEFAULT_CACHE_MS = 2e3;
 const DEFAULT_MIN_DISK_HEADROOM_BYTES = 256 * 1024 * 1024;
 const DEFAULT_MAX_FINALIZER_QUEUE = 256;
@@ -7099,6 +8319,7 @@ async function checkDiskHeadroom() {
 }
 function finalizerChecks() {
   const health = getFinalizerRuntimeHealth();
+  const sessionQueue = getSessionRuntimeQueueHealth();
   const runtimeArtifactMissing = health.runtime !== "inline" && !health.artifactAvailable;
   const initializedWorkerMissing = health.runtime === "worker" && health.activeWorkers !== null && health.activeWorkers < health.configuredWorkers;
   const workers = runtimeArtifactMissing || initializedWorkerMissing ? "unavailable" : health.runtime === "inline" ? "degraded" : "ok";
@@ -7107,7 +8328,7 @@ function finalizerChecks() {
     DEFAULT_MAX_FINALIZER_QUEUE
   );
   const warningThreshold = Math.max(1, Math.floor(queueLimit * 0.8));
-  const queue = health.pendingJobs >= queueLimit ? "unavailable" : health.pendingJobs >= warningThreshold ? "degraded" : "ok";
+  const queue = health.pendingJobs + sessionQueue.queuedTasks >= queueLimit ? "unavailable" : health.pendingJobs + sessionQueue.queuedTasks >= warningThreshold ? "degraded" : "ok";
   return { workers, queue };
 }
 function checkWorkers() {
@@ -7189,151 +8410,313 @@ function setRuntimeShuttingDown(shuttingDown) {
   runtimeShuttingDown = shuttingDown;
   readinessService.invalidate();
 }
-async function readinessResponse() {
-  const readiness = await getRuntimeReadiness();
-  return Response.json(readiness, {
-    status: readiness.status === "unavailable" ? 503 : 200,
-    headers: { "cache-control": "no-store" }
+async function readinessResponse() {
+  const readiness = await getRuntimeReadiness();
+  return Response.json(readiness, {
+    status: readiness.status === "unavailable" ? 503 : 200,
+    headers: { "cache-control": "no-store" }
+  });
+}
+const Route$V = createFileRoute("/readyz")({
+  server: {
+    handlers: {
+      GET: readinessResponse
+    }
+  }
+});
+const INITIAL_STREAM_LOG_LIMIT = 100;
+const UPDATE_COALESCE_MS = 50;
+const sseClientLimiter = createCapacityLimiter(MAX_SSE_CLIENTS);
+function getLogsStreamMetrics() {
+  return {
+    activeClients: sseClientLimiter.activeCount(),
+    capacity: sseClientLimiter.capacity
+  };
+}
+function streamIncludesBodies(url2) {
+  return url2.searchParams.get("compact") === "0";
+}
+function parseLastEventLogId(value) {
+  if (value === null) return void 0;
+  return parseLogId(value) ?? void 0;
+}
+function encodeSse(value, id) {
+  const idLine = id === void 0 ? "" : `id: ${String(id)}
+`;
+  return new TextEncoder().encode(`${idLine}data: ${JSON.stringify(value)}
+
+`);
+}
+function createLogsStreamResponse(request2, clientLimiter = sseClientLimiter) {
+  const lastEventIdHeader = request2.headers.get("last-event-id");
+  const lastEventLogId = parseLastEventLogId(lastEventIdHeader);
+  if (lastEventIdHeader !== null && lastEventLogId === void 0) {
+    return Response.json({ error: "Invalid Last-Event-ID" }, { status: 400 });
+  }
+  const lease = clientLimiter.tryAcquire();
+  if (lease === null) {
+    return resourceLimitResponse({
+      error: `SSE client capacity reached. At most ${String(clientLimiter.capacity)} live clients are allowed; retry after a connection closes.`,
+      code: "sse-capacity-exceeded",
+      status: 503,
+      resource: "sse-clients",
+      limit: clientLimiter.capacity,
+      retryable: true,
+      retryAfterSeconds: 1
+    });
+  }
+  const url2 = new URL(request2.url);
+  const sessionId = url2.searchParams.get("sessionId") ?? void 0;
+  const model = url2.searchParams.get("model") ?? void 0;
+  const includeBodies = streamIncludesBodies(url2);
+  let controllerRef = null;
+  let cleanedUp = false;
+  let updateTimer = null;
+  const pendingUpdates = /* @__PURE__ */ new Map();
+  const flushPendingUpdates = () => {
+    updateTimer = null;
+    const controller = controllerRef;
+    if (controller === null) return;
+    if (controller.desiredSize !== null && controller.desiredSize <= -16) {
+      controller.close();
+      cleanup();
+      return;
+    }
+    for (const log of pendingUpdates.values()) {
+      if (controller.desiredSize !== null && controller.desiredSize <= -16) {
+        controller.close();
+        cleanup();
+        return;
+      }
+      const payloadLog = includeBodies ? log : compactLogForList(log);
+      controller.enqueue(encodeSse({ type: "update", log: payloadLog }, log.id));
+    }
+    pendingUpdates.clear();
+  };
+  const unsubscribe = onLogUpdate((log) => {
+    if (controllerRef === null) return;
+    if (sessionId !== void 0 && getLogSessionId(log) !== sessionId) return;
+    if (model !== void 0 && log.model !== model) return;
+    pendingUpdates.set(log.id, log);
+    if (updateTimer === null) updateTimer = setTimeout(flushPendingUpdates, UPDATE_COALESCE_MS);
   });
-}
-const Route$T = createFileRoute("/readyz")({
-  server: {
-    handlers: {
-      GET: readinessResponse
+  const cleanup = () => {
+    if (cleanedUp) return;
+    cleanedUp = true;
+    clearInterval(heartbeat);
+    if (updateTimer !== null) clearTimeout(updateTimer);
+    updateTimer = null;
+    pendingUpdates.clear();
+    unsubscribe();
+    lease.release();
+    controllerRef = null;
+    request2.signal.removeEventListener("abort", cleanup);
+  };
+  const heartbeat = setInterval(() => {
+    if (controllerRef !== null) {
+      try {
+        controllerRef.enqueue(new TextEncoder().encode(": heartbeat\n\n"));
+      } catch {
+        cleanup();
+      }
     }
-  }
-});
-function livenessResponse() {
-  return Response.json({ status: "ok" }, { headers: { "cache-control": "no-store" } });
-}
-const Route$S = createFileRoute("/livez")({
-  server: {
-    handlers: {
-      GET: livenessResponse
+  }, 3e4);
+  request2.signal.addEventListener("abort", cleanup, { once: true });
+  const stream = new ReadableStream({
+    async start(controller) {
+      controllerRef = controller;
+      try {
+        const result = await listLogsCursorPage({
+          sessionId,
+          model,
+          limit: INITIAL_STREAM_LOG_LIMIT,
+          includeBodies,
+          afterLogId: lastEventLogId,
+          anchor: lastEventLogId === void 0 ? "newest" : void 0
+        });
+        if (cleanedUp) return;
+        const logs = result.logs;
+        const newestLogId = logs.at(-1)?.id;
+        controller.enqueue(encodeSse({ type: "init", logs }, newestLogId));
+      } catch (error) {
+        cleanup();
+        controller.error(error);
+      }
+    },
+    cancel() {
+      cleanup();
+    }
+  });
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
     }
-  }
-});
-const BACKEND_NOT_FOUND_BODY = {
-  error: "not_found",
-  message: "Agent Inspector backend does not serve the web UI."
-};
-function backendNotFoundResponse() {
-  return Response.json(BACKEND_NOT_FOUND_BODY, {
-    status: 404,
-    headers: { "cache-control": "no-store" }
   });
 }
-const Route$R = createFileRoute("/$")({
+const Route$U = createFileRoute("/api/logs/stream")({
   server: {
     handlers: {
-      GET: backendNotFoundResponse,
-      POST: backendNotFoundResponse,
-      PUT: backendNotFoundResponse,
-      PATCH: backendNotFoundResponse,
-      DELETE: backendNotFoundResponse,
-      OPTIONS: backendNotFoundResponse
+      GET: ({ request: request2 }) => createLogsStreamResponse(request2)
     }
   }
 });
-function maskApiKey(apiKey) {
-  if (apiKey.length <= 8) return "••••••••";
-  return apiKey.slice(0, 4) + "••••••••" + apiKey.slice(-4);
+let acceptingRequests = true;
+let activeRequests = 0;
+const drainWaiters = /* @__PURE__ */ new Set();
+function notifyDrained() {
+  if (activeRequests !== 0) return;
+  for (const resolve2 of drainWaiters) resolve2();
+  drainWaiters.clear();
 }
-const MAX_REST_LOG_PAGE_SIZE = 200;
-const MAX_SEARCH_QUERY_CHARS = 512;
-const MAX_SEARCH_PROJECT_CHARS = 256;
-const MAX_PROVIDER_MODELS = 64;
-const MAX_PROVIDER_MODEL_NAME_CHARS = 256;
-const MAX_PROVIDER_MODEL_METADATA = 64;
-const MAX_SSE_CLIENTS = 32;
-const MAX_ACTIVE_PROVIDER_TESTS = 2;
-const MAX_PROVIDER_TEST_CONCURRENCY = 4;
-const MAX_ACTIVE_PROXY_REQUESTS = 16;
-const ResourceLimitErrorCodeSchema = _enum([
-  "invalid-page-request",
-  "search-limit-exceeded",
-  "provider-model-limit-exceeded",
-  "sse-capacity-exceeded",
-  "provider-test-capacity-exceeded",
-  "proxy-capacity-exceeded"
-]);
-const ResourceLimitStatusSchema = union([
-  literal(400),
-  literal(413),
-  literal(429),
-  literal(503)
-]);
-const ResourceLimitErrorSchema = object({
-  error: string().min(1).max(300),
-  code: ResourceLimitErrorCodeSchema,
-  status: ResourceLimitStatusSchema,
-  resource: string().min(1).max(80),
-  limit: number().int().positive(),
-  retryable: boolean()
-});
-function createResourceLimitError(input) {
-  return ResourceLimitErrorSchema.parse(input);
+function acquireRuntimeRequest() {
+  if (!acceptingRequests || activeRequests >= MAX_ACTIVE_PROXY_REQUESTS) return null;
+  activeRequests += 1;
+  let released = false;
+  return {
+    release() {
+      if (released) return;
+      released = true;
+      activeRequests = Math.max(0, activeRequests - 1);
+      notifyDrained();
+    }
+  };
 }
-function resourceLimitResponse(input) {
-  const body = createResourceLimitError(input);
-  const headers = new Headers({ "cache-control": "no-store" });
-  if (input.retryAfterSeconds !== void 0) {
-    headers.set("retry-after", String(input.retryAfterSeconds));
-  }
-  return Response.json(body, { status: input.status, headers });
+function stopRuntimeAdmission() {
+  acceptingRequests = false;
+  notifyDrained();
 }
-function parseBoundedIntegerParameter(input) {
-  if (input.value === null) return { ok: true, value: input.fallback };
-  const parsed = Number(input.value);
-  if (!Number.isSafeInteger(parsed) || parsed < input.minimum || parsed > input.maximum) {
+async function waitForRuntimeTrafficDrain() {
+  if (activeRequests === 0) return;
+  await new Promise((resolve2) => {
+    drainWaiters.add(resolve2);
+  });
+}
+function getRuntimeAdmissionState() {
+  return { acceptingRequests, activeRequests, capacity: MAX_ACTIVE_PROXY_REQUESTS };
+}
+const PERFORMANCE_METRICS_SCHEMA = "agent-inspector.performance-metrics/v1";
+const OPERATIONAL_METRICS_SCHEMA = "agent-inspector.operational-metrics/v1";
+async function getTruncationMetrics() {
+  const entries = await listSqliteLogCursorEntries({});
+  if (entries === null) {
     return {
-      ok: false,
-      response: resourceLimitResponse({
-        error: `Query parameter "${input.parameter}" must be an integer between ${String(input.minimum)} and ${String(input.maximum)}.`,
-        code: "invalid-page-request",
-        status: 400,
-        resource: input.resource,
-        limit: input.maximum,
-        retryable: false
-      })
+      captureIncompleteLogs: 0,
+      droppedChunks: 0,
+      droppedBytes: 0,
+      source: "unavailable"
     };
   }
-  return { ok: true, value: parsed };
+  return {
+    captureIncompleteLogs: entries.filter((entry) => entry.summary?.captureIncomplete === true).length,
+    droppedChunks: entries.reduce((sum, entry) => sum + (entry.summary?.droppedChunks ?? 0), 0),
+    droppedBytes: entries.reduce((sum, entry) => sum + (entry.summary?.droppedBytes ?? 0), 0),
+    source: "sqlite"
+  };
 }
-function createCapacityLimiter(maxActive) {
-  const capacity = Number.isSafeInteger(maxActive) && maxActive > 0 ? maxActive : 1;
-  let active = 0;
+async function getSafeOperationalMetrics(sse) {
+  const [readiness, truncation] = await Promise.all([
+    getRuntimeReadiness(),
+    getTruncationMetrics()
+  ]);
+  const admission = getRuntimeAdmissionState();
+  const workers = getFinalizerRuntimeHealth();
+  const sessionQueue = getSessionRuntimeQueueHealth();
+  const storageInventory = getStorageLifecycleInventory();
+  const lastGc = getLastStorageLifecycleGcResult();
+  const reclaimableBytes = storageInventory.artifacts.filter(
+    (artifact) => artifact.cleanupBehavior === "retention-gc" || artifact.cleanupBehavior === "orphan-reclaim"
+  ).reduce((sum, artifact) => sum + artifact.bytes, 0);
+  const queueDepth = workers.pendingJobs + sessionQueue.queuedTasks;
   return {
-    capacity,
-    activeCount: () => active,
-    tryAcquire: () => {
-      if (active >= capacity) return null;
-      active += 1;
-      let released = false;
-      return {
-        release: () => {
-          if (released) return;
-          released = true;
-          active = Math.max(0, active - 1);
+    schema: PERFORMANCE_METRICS_SCHEMA,
+    activeUpstream: admission.activeRequests,
+    queueDepth,
+    queueBytes: 0,
+    incompleteCaptures: truncation.captureIncompleteLogs,
+    finalizerLagMs: 0,
+    persistenceLagMs: 0,
+    activeLeases: sse.activeClients,
+    runtime: {
+      schema: OPERATIONAL_METRICS_SCHEMA,
+      collectedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      readiness,
+      requests: {
+        activeProxyRequests: admission.activeRequests,
+        proxyCapacity: admission.capacity,
+        acceptingRequests: admission.acceptingRequests
+      },
+      limits: DEFAULT_RUNTIME_BUDGET_POLICY,
+      queues: {
+        finalizerPendingJobs: workers.pendingJobs,
+        sessionQueuedTasks: sessionQueue.queuedTasks,
+        sessionActiveQueues: sessionQueue.activeQueues,
+        sessionQueueLimit: sessionQueue.queueLimit
+      },
+      workers,
+      storage: {
+        totalFiles: storageInventory.totalFiles,
+        totalBytes: storageInventory.totalBytes,
+        reclaimableBytes,
+        lastGc: lastGc === null ? null : {
+          checkedAt: lastGc.checkedAt,
+          filesDeleted: lastGc.filesDeleted,
+          bytesDeleted: lastGc.bytesDeleted,
+          errors: lastGc.errors.length
         }
-      };
+      },
+      sse,
+      truncation
+    }
+  };
+}
+const Route$T = createFileRoute("/metrics")({
+  server: {
+    handlers: {
+      GET: async () => {
+        const metrics = await getSafeOperationalMetrics(getLogsStreamMetrics());
+        return Response.json(metrics, { headers: { "cache-control": "no-store" } });
+      }
+    }
+  }
+});
+function livenessResponse() {
+  return Response.json({ status: "ok" }, { headers: { "cache-control": "no-store" } });
+}
+const Route$S = createFileRoute("/livez")({
+  server: {
+    handlers: {
+      GET: livenessResponse
     }
-  };
+  }
+});
+const BACKEND_NOT_FOUND_BODY = {
+  error: "not_found",
+  message: "Agent Inspector backend does not serve the web UI."
+};
+function backendNotFoundResponse() {
+  return Response.json(BACKEND_NOT_FOUND_BODY, {
+    status: 404,
+    headers: { "cache-control": "no-store" }
+  });
 }
-async function runWithConcurrencyLimit(tasks2, maxConcurrent) {
-  if (tasks2.length === 0) return;
-  const concurrency = Number.isSafeInteger(maxConcurrent) && maxConcurrent > 0 ? maxConcurrent : 1;
-  const workerCount = Math.min(concurrency, tasks2.length);
-  let nextIndex = 0;
-  const runWorker = async () => {
-    while (nextIndex < tasks2.length) {
-      const index = nextIndex;
-      nextIndex += 1;
-      const task = tasks2[index];
-      if (task !== void 0) await task();
+const Route$R = createFileRoute("/$")({
+  server: {
+    handlers: {
+      GET: backendNotFoundResponse,
+      POST: backendNotFoundResponse,
+      PUT: backendNotFoundResponse,
+      PATCH: backendNotFoundResponse,
+      DELETE: backendNotFoundResponse,
+      OPTIONS: backendNotFoundResponse
     }
-  };
-  await Promise.all(Array.from({ length: workerCount }, runWorker));
+  }
+});
+function maskApiKey(apiKey) {
+  if (apiKey.length <= 8) return "••••••••";
+  return apiKey.slice(0, 4) + "••••••••" + apiKey.slice(-4);
 }
 function httpUrl() {
   return string().refine((val) => {
@@ -8677,16 +10060,16 @@ function setCache(port, info) {
   cache.set(port, { ...info, expiresAt: Date.now() + CACHE_TTL_MS });
   evictCacheIfNeeded();
 }
-function extractRemotePort(request) {
+function extractRemotePort(request2) {
   const candidateSockets = [];
-  const requestAsUnknown = request;
+  const requestAsUnknown = request2;
   const ctx = pick(requestAsUnknown, "context");
   const nitro = pick(ctx, "nitro");
   const node = pick(nitro, "node");
   const innerReq = pick(node, "req");
   const sock = pick(innerReq, "socket") ?? pick(innerReq, "connection");
   if (sock !== void 0) candidateSockets.push(sock);
-  const descriptor = Object.getOwnPropertyDescriptor(request, "socket");
+  const descriptor = Object.getOwnPropertyDescriptor(request2, "socket");
   if (descriptor !== void 0 && descriptor.get === void 0) {
     candidateSockets.push(descriptor.value);
   }
@@ -8890,12 +10273,12 @@ function readIntHeader(headers, name2) {
   if (!Number.isInteger(parsed) || parsed < 0) return null;
   return parsed;
 }
-function readClientHeaders(request) {
-  const pid = readIntHeader(request.headers, CLIENT_HEADERS.pid);
+function readClientHeaders(request2) {
+  const pid = readIntHeader(request2.headers, CLIENT_HEADERS.pid);
   if (pid === null || pid === 0) return null;
-  const port = readIntHeader(request.headers, CLIENT_HEADERS.port);
-  const cwd = request.headers.get(CLIENT_HEADERS.cwd);
-  const projectFolder = request.headers.get(CLIENT_HEADERS.projectFolder);
+  const port = readIntHeader(request2.headers, CLIENT_HEADERS.port);
+  const cwd = request2.headers.get(CLIENT_HEADERS.cwd);
+  const projectFolder = request2.headers.get(CLIENT_HEADERS.projectFolder);
   return {
     pid,
     port: port !== null && port > 0 ? port : null,
@@ -8903,10 +10286,10 @@ function readClientHeaders(request) {
     projectFolder: projectFolder !== null && projectFolder !== "" ? projectFolder : null
   };
 }
-async function getClientInfo(request) {
-  const fromHeaders = readClientHeaders(request);
+async function getClientInfo(request2) {
+  const fromHeaders = readClientHeaders(request2);
   if (fromHeaders !== null) return fromHeaders;
-  const remotePort = extractRemotePort(request);
+  const remotePort = extractRemotePort(request2);
   if (remotePort !== null) {
     const cachedPort = getFromCache(remotePort);
     if (cachedPort !== null) return cachedPort;
@@ -9213,585 +10596,569 @@ function isLoopbackHost(hostname) {
   if (LOOPBACK_HOSTNAMES.has(lower2)) return true;
   if (lower2 === "::1") return true;
   if (lower2.startsWith("::ffff:127.")) return true;
-  if (lower2.startsWith("::ffff:7f00:")) return true;
-  return /^127\./.test(lower2);
-}
-function mappedIpv4Address(hostname) {
-  const lower2 = hostname.toLowerCase();
-  if (!lower2.startsWith("::ffff:")) return null;
-  const suffix = lower2.slice("::ffff:".length);
-  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(suffix)) return suffix;
-  const match = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(suffix);
-  if (match === null) return null;
-  const highText = match[1];
-  const lowText = match[2];
-  if (highText === void 0 || lowText === void 0) return null;
-  const high = Number.parseInt(highText, 16);
-  const low = Number.parseInt(lowText, 16);
-  return `${String(high >> 8)}.${String(high & 255)}.${String(low >> 8)}.${String(low & 255)}`;
-}
-function isInternalHost(hostname) {
-  if (LOOPBACK_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const mappedIpv4 = mappedIpv4Address(hostname);
-  if (mappedIpv4 !== null) return isInternalHost(mappedIpv4);
-  const ipv4Match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
-  if (ipv4Match !== null) {
-    const [, a, b] = ipv4Match;
-    if (a === void 0 || b === void 0) return false;
-    const first = Number.parseInt(a, 10);
-    const second = Number.parseInt(b, 10);
-    if (first === 127) return true;
-    if (first === 10) return true;
-    if (first === 172 && second >= 16 && second <= 31) return true;
-    if (first === 192 && second === 168) return true;
-    if (first === 169 && second === 254) return true;
-    if (first === 0) return true;
-    if (first === 100 && second >= 64 && second <= 127) return true;
-    if (first >= 224) return true;
-    if (first === 198 && (second === 18 || second === 19)) return true;
-    return false;
-  }
-  const lower2 = hostname.toLowerCase();
-  if (lower2 === "::") return true;
-  if (lower2 === "::1") return true;
-  if (/^fe[89ab]/.test(lower2)) return true;
-  if (lower2.startsWith("fc") || lower2.startsWith("fd")) return true;
-  if (lower2.startsWith("ff")) return true;
-  return false;
-}
-function evaluateUpstreamUrl(rawUrl, options = {}) {
-  if (options.bypass === true) return { allow: true };
-  let parsed;
-  try {
-    parsed = new URL(rawUrl);
-  } catch {
-    return { allow: false, reason: "Not a valid URL" };
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return { allow: false, reason: `Unsupported scheme "${parsed.protocol}"` };
-  }
-  if (options.allowLoopback === true && parsed.hostname === "localhost") {
-    return { allow: true };
-  }
-  const hostname = parsed.hostname.replace(/^\[|]$/g, "");
-  if (isInternalHost(hostname)) {
-    if (options.allowLoopback === true) {
-      if (isLoopbackHost(hostname)) return { allow: true };
-    }
-    return {
-      allow: false,
-      reason: `Refusing to proxy to internal address "${hostname}"`
-    };
-  }
-  return { allow: true };
-}
-async function defaultResolver(hostname) {
-  return lookup(hostname, { all: true, verbatim: true });
-}
-function isLoopbackAddress(hostname) {
-  const lower2 = hostname.toLowerCase();
-  return lower2 === "::1" || lower2.startsWith("::ffff:127.") || lower2.startsWith("::ffff:7f00:") || /^127\./.test(lower2);
-}
-async function evaluateResolvedUpstreamUrl(rawUrl, options = {}) {
-  const initial = evaluateUpstreamUrl(rawUrl, options);
-  if (!initial.allow || options.bypass === true) return initial;
-  const parsed = new URL(rawUrl);
-  const hostname = parsed.hostname.replace(/^\[|]$/g, "");
-  if (isIP(hostname) !== 0 || hostname.toLowerCase() === "localhost") return initial;
-  let addresses;
-  try {
-    addresses = await (options.resolver ?? defaultResolver)(hostname);
-  } catch (error) {
-    return {
-      allow: false,
-      reason: `Could not safely resolve upstream host "${hostname}": ${String(error)}`
-    };
-  }
-  if (addresses.length === 0) {
-    return { allow: false, reason: `Upstream host "${hostname}" resolved to no addresses` };
-  }
-  for (const resolved of addresses) {
-    if (!isInternalHost(resolved.address)) continue;
-    if (options.allowLoopback === true && isLoopbackAddress(resolved.address)) continue;
-    return {
-      allow: false,
-      reason: `Refusing upstream host "${hostname}" because it resolves to internal address "${resolved.address}"`
-    };
-  }
-  return { allow: true };
-}
-function isRedirectStatus(status) {
-  return status >= 300 && status < 400;
-}
-async function safeFetch(rawUrl, init = {}, options = {}) {
-  const decision = await evaluateResolvedUpstreamUrl(rawUrl, options);
-  if (!decision.allow) {
-    return { ok: false, kind: "network-policy", reason: decision.reason };
-  }
-  const response = await fetch(rawUrl, { ...init, redirect: "manual" });
-  if (!isRedirectStatus(response.status)) return { ok: true, response };
-  if (response.body !== null) {
-    await response.body.cancel().catch(() => void 0);
-  }
-  const location = response.headers.get("location");
-  return {
-    ok: false,
-    kind: "redirect",
-    reason: location === null ? `Upstream returned blocked redirect HTTP ${String(response.status)}` : `Upstream redirect to "${location}" is blocked; configure the final API URL directly`
-  };
-}
-const BILLING_HEADER_PREFIX = "x-anthropic-billing-header:";
-function isClaudeCodeBillingHeaderBlock(text) {
-  const trimmed = text.trimStart();
-  return trimmed.toLowerCase().startsWith(BILLING_HEADER_PREFIX);
-}
-function isObjectWithSystem(value) {
-  if (!isPlainRecord(value)) return false;
-  return Object.prototype.hasOwnProperty.call(value, "system");
-}
-function isBillingHeaderTextBlock(block) {
-  if (!isPlainRecord(block)) return false;
-  const typeVal = safeGetOwnProperty(block, "type");
-  const textVal = safeGetOwnProperty(block, "text");
-  if (typeof typeVal !== "string" || typeVal !== "text") return false;
-  if (typeof textVal !== "string") return false;
-  return isClaudeCodeBillingHeaderBlock(textVal);
-}
-function stripClaudeCodeBillingHeader(rawBody) {
-  let parsed;
-  try {
-    parsed = JSON.parse(rawBody);
-  } catch {
-    return { body: rawBody, removed: 0 };
-  }
-  if (!isObjectWithSystem(parsed)) {
-    return { body: rawBody, removed: 0 };
-  }
-  const system = parsed.system;
-  if (!Array.isArray(system) || system.length === 0) {
-    return { body: rawBody, removed: 0 };
-  }
-  const kept = [];
-  let removed = 0;
-  for (const block of system) {
-    if (isBillingHeaderTextBlock(block)) {
-      removed += 1;
-      continue;
-    }
-    kept.push(block);
-  }
-  if (removed === 0) {
-    return { body: rawBody, removed: 0 };
-  }
-  if (kept.length === 0) {
-    delete parsed.system;
-  } else {
-    parsed.system = kept;
-  }
-  return { body: JSON.stringify(parsed), removed };
-}
-const ROLE_ASSISTANT = "assistant";
-const ROLE_TOOL = "tool";
-function isObjectWithMessages(value) {
-  if (!isPlainRecord(value)) return false;
-  if (!Object.prototype.hasOwnProperty.call(value, "messages")) return false;
-  const messages = safeGetOwnProperty(value, "messages");
-  return Array.isArray(messages);
-}
-function collectAssistantToolCallIds(message, into) {
-  if (!isPlainRecord(message)) return;
-  const toolCalls = safeGetOwnProperty(message, "tool_calls");
-  if (!Array.isArray(toolCalls)) return;
-  for (const tc of toolCalls) {
-    if (!isPlainRecord(tc)) continue;
-    const id = safeGetOwnProperty(tc, "id");
-    if (typeof id === "string" && id.length > 0) {
-      into.add(id);
-    }
-  }
-}
-function findOrphanToolMessageIndices(messages) {
-  const knownToolCallIds = /* @__PURE__ */ new Set();
-  const indices = [];
-  const orphanIds = [];
-  for (let i = 0; i < messages.length; i++) {
-    const msg = messages[i];
-    if (!isPlainRecord(msg)) continue;
-    const role = safeGetOwnProperty(msg, "role");
-    if (role === ROLE_ASSISTANT) {
-      collectAssistantToolCallIds(msg, knownToolCallIds);
-      continue;
-    }
-    if (role === ROLE_TOOL) {
-      const id = safeGetOwnProperty(msg, "tool_call_id");
-      if (typeof id !== "string" || id.length === 0) {
-        indices.push(i);
-        orphanIds.push(null);
-        continue;
-      }
-      if (!knownToolCallIds.has(id)) {
-        indices.push(i);
-        orphanIds.push(id);
-      }
-    }
+  if (lower2.startsWith("::ffff:7f00:")) return true;
+  return /^127\./.test(lower2);
+}
+function mappedIpv4Address(hostname) {
+  const lower2 = hostname.toLowerCase();
+  if (!lower2.startsWith("::ffff:")) return null;
+  const suffix = lower2.slice("::ffff:".length);
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(suffix)) return suffix;
+  const match = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(suffix);
+  if (match === null) return null;
+  const highText = match[1];
+  const lowText = match[2];
+  if (highText === void 0 || lowText === void 0) return null;
+  const high = Number.parseInt(highText, 16);
+  const low = Number.parseInt(lowText, 16);
+  return `${String(high >> 8)}.${String(high & 255)}.${String(low >> 8)}.${String(low & 255)}`;
+}
+function isInternalHost(hostname) {
+  if (LOOPBACK_HOSTNAMES.has(hostname.toLowerCase())) return true;
+  const mappedIpv4 = mappedIpv4Address(hostname);
+  if (mappedIpv4 !== null) return isInternalHost(mappedIpv4);
+  const ipv4Match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+  if (ipv4Match !== null) {
+    const [, a, b] = ipv4Match;
+    if (a === void 0 || b === void 0) return false;
+    const first = Number.parseInt(a, 10);
+    const second = Number.parseInt(b, 10);
+    if (first === 127) return true;
+    if (first === 10) return true;
+    if (first === 172 && second >= 16 && second <= 31) return true;
+    if (first === 192 && second === 168) return true;
+    if (first === 169 && second === 254) return true;
+    if (first === 0) return true;
+    if (first === 100 && second >= 64 && second <= 127) return true;
+    if (first >= 224) return true;
+    if (first === 198 && (second === 18 || second === 19)) return true;
+    return false;
   }
-  return { indices, orphanIds };
+  const lower2 = hostname.toLowerCase();
+  if (lower2 === "::") return true;
+  if (lower2 === "::1") return true;
+  if (/^fe[89ab]/.test(lower2)) return true;
+  if (lower2.startsWith("fc") || lower2.startsWith("fd")) return true;
+  if (lower2.startsWith("ff")) return true;
+  return false;
 }
-function stripOpenAIOrphanToolMessages(rawBody) {
+function evaluateUpstreamUrl(rawUrl, options = {}) {
+  if (options.bypass === true) return { allow: true };
   let parsed;
   try {
-    parsed = JSON.parse(rawBody);
+    parsed = new URL(rawUrl);
   } catch {
-    return { body: rawBody, removed: 0, orphanIds: [] };
+    return { allow: false, reason: "Not a valid URL" };
   }
-  if (!isObjectWithMessages(parsed)) {
-    return { body: rawBody, removed: 0, orphanIds: [] };
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return { allow: false, reason: `Unsupported scheme "${parsed.protocol}"` };
   }
-  const messages = parsed.messages;
-  const { indices, orphanIds } = findOrphanToolMessageIndices(messages);
-  if (indices.length === 0) {
-    return { body: rawBody, removed: 0, orphanIds: [] };
+  if (options.allowLoopback === true && parsed.hostname === "localhost") {
+    return { allow: true };
   }
-  const dropSet = new Set(indices);
-  const kept = [];
-  for (let i = 0; i < messages.length; i++) {
-    if (!dropSet.has(i)) kept.push(messages[i]);
+  const hostname = parsed.hostname.replace(/^\[|]$/g, "");
+  if (isInternalHost(hostname)) {
+    if (options.allowLoopback === true) {
+      if (isLoopbackHost(hostname)) return { allow: true };
+    }
+    return {
+      allow: false,
+      reason: `Refusing to proxy to internal address "${hostname}"`
+    };
   }
-  parsed.messages = kept;
-  return { body: JSON.stringify(parsed), removed: indices.length, orphanIds };
+  return { allow: true };
 }
-const UNASSIGNED_SESSION_QUEUE = "__unassigned__";
-const queues = /* @__PURE__ */ new Map();
-function queueKeyForSession(sessionId) {
-  return sessionId ?? UNASSIGNED_SESSION_QUEUE;
+async function defaultResolver(hostname) {
+  return lookup(hostname, { all: true, verbatim: true });
 }
-function errorMessage$1(err) {
-  return err instanceof Error ? err.message : String(err);
+function isLoopbackAddress(hostname) {
+  const lower2 = hostname.toLowerCase();
+  return lower2 === "::1" || lower2.startsWith("::ffff:127.") || lower2.startsWith("::ffff:7f00:") || /^127\./.test(lower2);
 }
-async function runSessionTask(sessionId, taskName, task) {
-  markSessionTaskStarted(sessionId);
+async function evaluateResolvedUpstreamUrlForFetch(rawUrl, options) {
+  const initial = evaluateUpstreamUrl(rawUrl, options);
+  if (!initial.allow) return initial;
+  const parsed = new URL(rawUrl);
+  const hostname = parsed.hostname.replace(/^\[|]$/g, "");
+  if (options.bypass === true) return { allow: true, hostname, addresses: [] };
+  const ipFamily = isIP(hostname);
+  if (ipFamily !== 0)
+    return { allow: true, hostname, addresses: [{ address: hostname, family: ipFamily }] };
+  let addresses;
   try {
-    const result = await task();
-    markSessionTaskFinished(sessionId, null);
-    return result;
-  } catch (err) {
-    const message = errorMessage$1(err);
-    logger.error(`[sessionRuntime] ${taskName} failed for session ${sessionId ?? "unassigned"}`);
-    markSessionTaskFinished(sessionId, message);
-    return Promise.reject(err);
+    addresses = await (options.resolver ?? defaultResolver)(hostname);
+  } catch (error) {
+    return {
+      allow: false,
+      reason: `Could not safely resolve upstream host "${hostname}": ${String(error)}`
+    };
   }
+  if (addresses.length === 0) {
+    return { allow: false, reason: `Upstream host "${hostname}" resolved to no addresses` };
+  }
+  for (const resolved of addresses) {
+    if (!isInternalHost(resolved.address)) continue;
+    if (options.allowLoopback === true && isLoopbackAddress(resolved.address)) continue;
+    return {
+      allow: false,
+      reason: `Refusing upstream host "${hostname}" because it resolves to internal address "${resolved.address}"`
+    };
+  }
+  return { allow: true, hostname, addresses };
 }
-function enqueueSessionTask(sessionId, taskName, task) {
-  const queueKey = queueKeyForSession(sessionId);
-  const previous = queues.get(queueKey) ?? Promise.resolve();
-  markSessionTaskQueued(sessionId);
-  const current = previous.catch(() => void 0).then(() => runSessionTask(sessionId, taskName, task));
-  const settled = current.then(
-    () => void 0,
-    () => void 0
-  );
-  queues.set(queueKey, settled);
-  void settled.then(() => {
-    if (queues.get(queueKey) === settled) {
-      queues.delete(queueKey);
-    }
-  });
-  return current;
-}
-function enqueueFinalizeLogJob(job) {
-  return enqueueSessionTask(
-    getLogSessionId(job.log),
-    "finalize-log",
-    () => executeFinalizeLogJob(job)
-  );
+function isRedirectStatus(status) {
+  return status >= 300 && status < 400;
 }
-async function flushSessionTasks() {
-  while (queues.size > 0) {
-    await Promise.all([...queues.values()]);
-  }
+function formatByteLimit(limit) {
+  return `${String(limit)} bytes`;
 }
-const DEFAULT_MEMORY_LIMIT_BYTES = 1024 * 1024;
-const FILE_WRITE_BATCH_BYTES = 64 * 1024;
-const DEFAULT_QUEUE_MAX_MESSAGES = 256;
-const DEFAULT_QUEUE_MAX_BYTES = 8 * 1024 * 1024;
-const DEFAULT_GLOBAL_QUEUE_MAX_MESSAGES = 4096;
-const DEFAULT_GLOBAL_QUEUE_MAX_BYTES = 64 * 1024 * 1024;
-const activeCaptures = /* @__PURE__ */ new Set();
-function resolveMemoryLimitBytes() {
-  const raw = process.env["AGENT_INSPECTOR_STREAM_MEMORY_LIMIT_BYTES"];
-  if (raw === void 0 || raw === "") return DEFAULT_MEMORY_LIMIT_BYTES;
-  const parsed = Number(raw);
-  if (!Number.isInteger(parsed) || parsed < 0) return DEFAULT_MEMORY_LIMIT_BYTES;
+function parseContentLength(value) {
+  if (value === null) return null;
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) return null;
   return parsed;
 }
-function resolvePositiveIntegerEnv(name2, fallback) {
-  const raw = process.env[name2];
-  if (raw === void 0 || raw === "") return fallback;
-  const parsed = Number(raw);
-  if (!Number.isSafeInteger(parsed) || parsed < 1) return fallback;
-  return parsed;
+function isPinnedDnsEnabled(options) {
+  const disabledForTest = typeof process !== "undefined" && process.env["NODE_ENV"] === "test" && process.env["AGENT_INSPECTOR_DISABLE_DNS_PINNING_FOR_TESTS"] === "1";
+  if (disabledForTest) return false;
+  return options.pinDns !== false && options.bypass !== true;
 }
-function defaultQueueMaxMessages() {
-  return resolvePositiveIntegerEnv(
-    "AGENT_INSPECTOR_OBSERVATION_QUEUE_MESSAGES",
-    DEFAULT_QUEUE_MAX_MESSAGES
-  );
+function choosePinnedAddress(addresses) {
+  return addresses[0] ?? null;
 }
-function defaultQueueMaxBytes() {
-  return resolvePositiveIntegerEnv(
-    "AGENT_INSPECTOR_OBSERVATION_QUEUE_BYTES",
-    DEFAULT_QUEUE_MAX_BYTES
-  );
+function hostHeaderValue(parsed) {
+  return parsed.port.length === 0 ? parsed.host : `${parsed.hostname}:${parsed.port}`;
 }
-class RawStreamObservationBudget {
-  constructor(maxMessages, maxBytes) {
-    this.maxMessages = maxMessages;
-    this.maxBytes = maxBytes;
-  }
-  maxMessages;
-  maxBytes;
-  messages = 0;
-  bytes = 0;
-  tryAcquire(bytes) {
-    if (this.messages + 1 > this.maxMessages || this.bytes + bytes > this.maxBytes) return null;
-    this.messages += 1;
-    this.bytes += bytes;
-    let released = false;
-    return () => {
-      if (released) return;
-      released = true;
-      this.messages -= 1;
-      this.bytes -= bytes;
-    };
+function headersToRecord$1(headers, parsed) {
+  const normalized = new Headers(headers);
+  if (!normalized.has("host")) {
+    normalized.set("host", hostHeaderValue(parsed));
   }
+  const result = {};
+  normalized.forEach((value, key) => {
+    result[key] = value;
+  });
+  return result;
 }
-const globalObservationBudget = new RawStreamObservationBudget(
-  resolvePositiveIntegerEnv(
-    "AGENT_INSPECTOR_OBSERVATION_GLOBAL_QUEUE_MESSAGES",
-    DEFAULT_GLOBAL_QUEUE_MAX_MESSAGES
-  ),
-  resolvePositiveIntegerEnv(
-    "AGENT_INSPECTOR_OBSERVATION_GLOBAL_QUEUE_BYTES",
-    DEFAULT_GLOBAL_QUEUE_MAX_BYTES
-  )
-);
-function getRawStreamDir() {
-  return join(getDataDir(), "raw-streams");
-}
-function createRawStreamPath() {
-  return join(getRawStreamDir(), `${Date.now()}-${randomUUID()}.stream.tmp`);
-}
-class RawStreamCapture {
-  memoryLimitBytes;
-  queueMaxMessages;
-  queueMaxBytes;
-  globalBudget;
-  chunks = [];
-  byteLength = 0;
-  filePath = null;
-  fileHandle = null;
-  pendingFileChunks = [];
-  pendingFileBytes = 0;
-  operation = Promise.resolve();
-  accepting = true;
-  closed = false;
-  sawChunk = false;
-  queuedMessages = 0;
-  queuedBytes = 0;
-  incomplete = false;
-  storageFailed = false;
-  droppedChunks = 0;
-  droppedBytes = 0;
-  gapReason = null;
-  constructor(options = {}) {
-    this.memoryLimitBytes = options.memoryLimitBytes ?? resolveMemoryLimitBytes();
-    this.queueMaxMessages = options.queueMaxMessages ?? defaultQueueMaxMessages();
-    this.queueMaxBytes = options.queueMaxBytes ?? defaultQueueMaxBytes();
-    this.globalBudget = options.globalBudget ?? globalObservationBudget;
-    activeCaptures.add(this);
-  }
-  get hasChunks() {
-    return this.sawChunk;
+async function requestBodyToUint8Array(body) {
+  if (body === void 0 || body === null) return { ok: true, body: null, contentType: null };
+  if (typeof body === "string") {
+    return { ok: true, body: new TextEncoder().encode(body), contentType: null };
   }
-  get status() {
+  if (body instanceof URLSearchParams) {
     return {
-      incomplete: this.incomplete,
-      droppedChunks: this.droppedChunks,
-      droppedBytes: this.droppedBytes,
-      reason: this.gapReason
+      ok: true,
+      body: new TextEncoder().encode(body.toString()),
+      contentType: "application/x-www-form-urlencoded;charset=UTF-8"
     };
   }
-  recordDroppedObservation(reason, observedBytes) {
-    const safeObservedBytes = Number.isSafeInteger(observedBytes) && observedBytes >= 0 ? observedBytes : 0;
-    this.recordGap(reason, safeObservedBytes, safeObservedBytes > 0);
+  if (body instanceof Uint8Array) return { ok: true, body, contentType: null };
+  if (body instanceof ArrayBuffer) {
+    return { ok: true, body: new Uint8Array(body), contentType: null };
   }
-  async append(text) {
-    if (text === "") return;
-    const next = this.operation.then(() => this.appendInternal(text));
-    this.operation = next.catch(() => void 0);
-    return next;
+  if (body instanceof Blob) {
+    return { ok: true, body: new Uint8Array(await body.arrayBuffer()), contentType: body.type };
   }
-  /**
-   * Submit an observation without waiting for file I/O. Once capacity is exceeded, capture remains
-   * incomplete and all later chunks are counted as dropped so the persisted value is an honest
-   * prefix rather than a misleading stream with an unmarked hole.
-   */
-  tryAppend(text, observedBytes) {
-    const safeObservedBytes = Number.isSafeInteger(observedBytes) && observedBytes >= 0 ? observedBytes : 0;
-    const queuedBytes = Math.max(safeObservedBytes, Buffer.byteLength(text, "utf-8"));
-    if (!this.accepting || this.closed) {
-      this.recordGap("pipeline-closed", safeObservedBytes, safeObservedBytes > 0 || text !== "");
-      return false;
-    }
-    if (this.incomplete) {
-      this.recordGap("capacity-exceeded", safeObservedBytes, safeObservedBytes > 0 || text !== "");
-      return false;
-    }
-    if (text === "") return true;
-    if (this.queuedMessages + 1 > this.queueMaxMessages || this.queuedBytes + queuedBytes > this.queueMaxBytes) {
-      this.recordGap("capacity-exceeded", safeObservedBytes, true);
-      return false;
+  return {
+    ok: false,
+    reason: "Pinned upstream fetch only supports buffered request bodies"
+  };
+}
+function pinnedLookup(pinnedAddress) {
+  return (_hostname, options, callback) => {
+    if (options.all === true) {
+      callback(null, [pinnedAddress]);
+      return;
     }
-    const releaseGlobal = this.globalBudget.tryAcquire(queuedBytes);
-    if (releaseGlobal === null) {
-      this.recordGap("capacity-exceeded", safeObservedBytes, true);
-      return false;
+    callback(null, pinnedAddress.address, pinnedAddress.family);
+  };
+}
+function requestOptionsForPinnedFetch(parsed, init, pinnedAddress, contentType) {
+  const headers = headersToRecord$1(init.headers, parsed);
+  if (contentType !== null && !new Headers(headers).has("content-type")) {
+    headers["content-type"] = contentType;
+  }
+  return {
+    protocol: parsed.protocol,
+    hostname: parsed.hostname,
+    port: parsed.port,
+    path: `${parsed.pathname}${parsed.search}`,
+    method: init.method ?? "GET",
+    headers,
+    lookup: pinnedLookup(pinnedAddress)
+  };
+}
+function streamFromIncomingMessage(incoming, maxBytes) {
+  let seenBytes = 0;
+  return new ReadableStream({
+    start(controller) {
+      incoming.on("data", (chunk) => {
+        seenBytes += chunk.byteLength;
+        if (maxBytes !== void 0 && seenBytes > maxBytes) {
+          incoming.destroy(
+            new Error(
+              `Upstream response exceeded configured limit of ${formatByteLimit(maxBytes)}`
+            )
+          );
+          controller.error(
+            new Error(
+              `Upstream response exceeded configured limit of ${formatByteLimit(maxBytes)}`
+            )
+          );
+          return;
+        }
+        controller.enqueue(chunk);
+      });
+      incoming.on("end", () => {
+        controller.close();
+      });
+      incoming.on("error", (error) => {
+        controller.error(error);
+      });
+    },
+    cancel() {
+      incoming.destroy();
     }
-    this.queuedMessages += 1;
-    this.queuedBytes += queuedBytes;
-    this.operation = this.operation.then(async () => {
-      if (this.storageFailed) {
-        this.recordGap("write-failed", safeObservedBytes, true);
+  });
+}
+async function cancelBody(response) {
+  if (response.body === null) return;
+  await response.body.cancel().catch(() => void 0);
+}
+function responseWithByteLimit(response, maxBytes) {
+  if (response.body === null) return response;
+  let seenBytes = 0;
+  const reader = response.body.getReader();
+  const body = new ReadableStream({
+    async pull(controller) {
+      const chunk = await reader.read();
+      if (chunk.done) {
+        controller.close();
         return;
       }
-      await this.appendInternal(text);
-    }).catch(() => {
-      this.storageFailed = true;
-      this.recordGap("write-failed", safeObservedBytes, true);
-    }).finally(() => {
-      this.queuedMessages -= 1;
-      this.queuedBytes -= queuedBytes;
-      releaseGlobal();
-    });
-    return true;
+      seenBytes += chunk.value.byteLength;
+      if (seenBytes > maxBytes) {
+        void reader.cancel().catch(() => void 0);
+        controller.error(
+          new Error(`Upstream response exceeded configured limit of ${formatByteLimit(maxBytes)}`)
+        );
+        return;
+      }
+      controller.enqueue(chunk.value);
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    }
+  });
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function shouldUseBudgetedSignal(init, deadlineMs) {
+  return deadlineMs !== void 0 || init.signal !== void 0;
+}
+async function pinnedNodeFetch(rawUrl, init, options, decision) {
+  const parsed = new URL(rawUrl);
+  const pinnedAddress = choosePinnedAddress(decision.addresses);
+  if (pinnedAddress === null) {
+    return {
+      ok: false,
+      kind: "network-policy",
+      reason: `Could not pin a resolved upstream address for "${decision.hostname}"`
+    };
   }
-  async finalize() {
-    this.accepting = false;
-    const next = this.operation.then(() => this.finalizeInternal());
-    this.operation = next.then(
-      () => void 0,
-      () => void 0
+  const encodedBody = await requestBodyToUint8Array(init.body);
+  if (!encodedBody.ok) {
+    return { ok: false, kind: "resource-limit", reason: encodedBody.reason };
+  }
+  return await new Promise((resolve2, reject) => {
+    const linkedSignal = init.signal ?? void 0;
+    const transport = parsed.protocol === "https:" ? request : request$1;
+    const requestOptions = requestOptionsForPinnedFetch(
+      parsed,
+      init,
+      pinnedAddress,
+      encodedBody.contentType
     );
-    return next.finally(() => activeCaptures.delete(this));
-  }
-  async appendInternal(text) {
-    if (this.closed) return;
-    this.sawChunk = true;
-    const nextBytes = Buffer.byteLength(text, "utf-8");
-    if (this.filePath === null && this.byteLength + nextBytes <= this.memoryLimitBytes) {
-      this.chunks.push(text);
-      this.byteLength += nextBytes;
-      return;
+    const request$2 = transport(requestOptions, (incoming) => {
+      const status = incoming.statusCode ?? 0;
+      if (isRedirectStatus(status)) {
+        incoming.resume();
+        const location = incoming.headers.location;
+        resolve2({
+          ok: false,
+          kind: "redirect",
+          reason: location === void 0 ? `Upstream returned blocked redirect HTTP ${String(status)}` : `Upstream redirect to "${location}" is blocked; configure the final API URL directly`
+        });
+        return;
+      }
+      const maxBytes = options.responseBytes;
+      const headers = new Headers();
+      for (const [key, value] of Object.entries(incoming.headers)) {
+        if (Array.isArray(value)) {
+          headers.set(key, value.join(", "));
+          continue;
+        }
+        if (value !== void 0) headers.set(key, value);
+      }
+      if (maxBytes !== void 0) {
+        const declaredBytes = parseContentLength(headers.get("content-length"));
+        if (declaredBytes !== null && declaredBytes > maxBytes) {
+          incoming.destroy();
+          resolve2({
+            ok: false,
+            kind: "resource-limit",
+            reason: `Upstream declared ${String(declaredBytes)} response bytes, exceeding configured limit of ${formatByteLimit(maxBytes)}`
+          });
+          return;
+        }
+      }
+      resolve2({
+        ok: true,
+        response: new Response(streamFromIncomingMessage(incoming, maxBytes), {
+          status,
+          statusText: incoming.statusMessage,
+          headers
+        })
+      });
+    });
+    let timedOut = false;
+    let timeout;
+    const finishAbort = () => {
+      request$2.destroy(new DOMException("Safe fetch aborted", "AbortError"));
+    };
+    if (linkedSignal !== void 0) {
+      if (linkedSignal.aborted) {
+        finishAbort();
+      } else {
+        linkedSignal.addEventListener("abort", finishAbort, { once: true });
+      }
     }
-    if (this.filePath === null) {
-      await this.spillToFile();
+    if (options.deadlineMs !== void 0) {
+      timeout = setTimeout(() => {
+        timedOut = true;
+        request$2.destroy(new DOMException("Safe fetch deadline exceeded", "TimeoutError"));
+      }, options.deadlineMs);
     }
-    if (this.filePath !== null) {
-      this.pendingFileChunks.push(text);
-      this.pendingFileBytes += nextBytes;
-      this.byteLength += nextBytes;
-      if (this.pendingFileBytes >= FILE_WRITE_BATCH_BYTES) await this.flushFileBuffer();
+    request$2.on("error", (error) => {
+      if (timeout !== void 0) clearTimeout(timeout);
+      if (linkedSignal !== void 0) {
+        linkedSignal.removeEventListener("abort", finishAbort);
+      }
+      if (timedOut) {
+        resolve2({
+          ok: false,
+          kind: "timeout",
+          reason: `Upstream request exceeded configured deadline of ${String(options.deadlineMs)} ms`
+        });
+        return;
+      }
+      reject(error);
+    });
+    request$2.on("close", () => {
+      if (timeout !== void 0) clearTimeout(timeout);
+      if (linkedSignal !== void 0) {
+        linkedSignal.removeEventListener("abort", finishAbort);
+      }
+    });
+    if (encodedBody.body !== null) request$2.write(encodedBody.body);
+    request$2.end();
+  });
+}
+async function safeFetch(rawUrl, init = {}, options = {}) {
+  const resolvedDecision = await evaluateResolvedUpstreamUrlForFetch(rawUrl, options);
+  if (!resolvedDecision.allow) {
+    return { ok: false, kind: "network-policy", reason: resolvedDecision.reason };
+  }
+  if (isPinnedDnsEnabled(options)) {
+    return await pinnedNodeFetch(rawUrl, init, options, resolvedDecision);
+  }
+  const deadlineMs = options.deadlineMs;
+  const useBudgetedSignal = shouldUseBudgetedSignal(init, deadlineMs);
+  const controller = useBudgetedSignal ? new AbortController() : void 0;
+  let timedOut = false;
+  let timeout;
+  const linkedSignal = init.signal ?? void 0;
+  const forwardAbort = () => {
+    controller?.abort(linkedSignal?.reason);
+  };
+  if (controller !== void 0 && linkedSignal !== void 0) {
+    if (linkedSignal.aborted) {
+      forwardAbort();
+    } else {
+      linkedSignal.addEventListener("abort", forwardAbort, { once: true });
     }
   }
-  recordGap(reason, observedBytes, countChunk) {
-    this.incomplete = true;
-    this.gapReason ??= reason;
-    if (countChunk) this.droppedChunks += 1;
-    this.droppedBytes += observedBytes;
+  if (controller !== void 0 && deadlineMs !== void 0) {
+    timeout = setTimeout(() => {
+      timedOut = true;
+      controller.abort(new DOMException("Safe fetch deadline exceeded", "TimeoutError"));
+    }, deadlineMs);
   }
-  async finalizeInternal() {
-    if (!this.closed) {
-      this.closed = true;
-      await this.flushFileBuffer();
-      if (this.fileHandle !== null) {
-        const handle = this.fileHandle;
-        this.fileHandle = null;
-        try {
-          await handle.sync();
-        } finally {
-          await handle.close();
-        }
+  try {
+    const response = await fetch(rawUrl, {
+      ...init,
+      redirect: "manual",
+      signal: controller?.signal ?? init.signal
+    });
+    if (!isRedirectStatus(response.status)) {
+      const maxBytes = options.responseBytes;
+      if (maxBytes === void 0) return { ok: true, response };
+      const declaredBytes = parseContentLength(response.headers.get("content-length"));
+      if (declaredBytes !== null && declaredBytes > maxBytes) {
+        await cancelBody(response);
+        return {
+          ok: false,
+          kind: "resource-limit",
+          reason: `Upstream declared ${String(declaredBytes)} response bytes, exceeding configured limit of ${formatByteLimit(maxBytes)}`
+        };
       }
+      return { ok: true, response: responseWithByteLimit(response, maxBytes) };
     }
-    if (this.filePath !== null) {
-      return { type: "file", path: this.filePath };
+    await cancelBody(response);
+    const location = response.headers.get("location");
+    return {
+      ok: false,
+      kind: "redirect",
+      reason: location === null ? `Upstream returned blocked redirect HTTP ${String(response.status)}` : `Upstream redirect to "${location}" is blocked; configure the final API URL directly`
+    };
+  } catch (error) {
+    if (timedOut) {
+      return {
+        ok: false,
+        kind: "timeout",
+        reason: deadlineMs === void 0 ? "Upstream request exceeded its configured deadline" : `Upstream request exceeded configured deadline of ${String(deadlineMs)} ms`
+      };
+    }
+    return Promise.reject(error);
+  } finally {
+    if (timeout !== void 0) clearTimeout(timeout);
+    if (controller !== void 0 && linkedSignal !== void 0) {
+      linkedSignal.removeEventListener("abort", forwardAbort);
     }
-    return { type: "memory", rawStream: this.chunks.join("") };
   }
-  async spillToFile() {
-    const path2 = createRawStreamPath();
-    assert(ensurePrivateDirectorySync(getRawStreamDir()), "Could not secure raw-stream directory");
-    const handle = await open(path2, "wx", PRIVATE_FILE_MODE);
-    let committed = false;
-    try {
-      const memoryText = this.chunks.join("");
-      if (memoryText.length > 0) await handle.write(memoryText, void 0, "utf-8");
-      assert(securePrivateFileSync(path2), "Could not secure raw-stream file");
-      this.filePath = path2;
-      this.fileHandle = handle;
-      this.chunks = [];
-      committed = true;
-    } finally {
-      if (!committed) {
-        await handle.close().catch(() => void 0);
-        await unlink(path2).catch(() => void 0);
-      }
+}
+const BILLING_HEADER_PREFIX = "x-anthropic-billing-header:";
+function isClaudeCodeBillingHeaderBlock(text) {
+  const trimmed = text.trimStart();
+  return trimmed.toLowerCase().startsWith(BILLING_HEADER_PREFIX);
+}
+function isObjectWithSystem(value) {
+  if (!isPlainRecord(value)) return false;
+  return Object.prototype.hasOwnProperty.call(value, "system");
+}
+function isBillingHeaderTextBlock(block) {
+  if (!isPlainRecord(block)) return false;
+  const typeVal = safeGetOwnProperty(block, "type");
+  const textVal = safeGetOwnProperty(block, "text");
+  if (typeof typeVal !== "string" || typeVal !== "text") return false;
+  if (typeof textVal !== "string") return false;
+  return isClaudeCodeBillingHeaderBlock(textVal);
+}
+function stripClaudeCodeBillingHeader(rawBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawBody);
+  } catch {
+    return { body: rawBody, removed: 0 };
+  }
+  if (!isObjectWithSystem(parsed)) {
+    return { body: rawBody, removed: 0 };
+  }
+  const system = parsed.system;
+  if (!Array.isArray(system) || system.length === 0) {
+    return { body: rawBody, removed: 0 };
+  }
+  const kept = [];
+  let removed = 0;
+  for (const block of system) {
+    if (isBillingHeaderTextBlock(block)) {
+      removed += 1;
+      continue;
     }
+    kept.push(block);
   }
-  async flushFileBuffer() {
-    if (this.fileHandle === null || this.pendingFileChunks.length === 0) return;
-    const text = this.pendingFileChunks.join("");
-    this.pendingFileChunks = [];
-    this.pendingFileBytes = 0;
-    await this.fileHandle.write(text, void 0, "utf-8");
+  if (removed === 0) {
+    return { body: rawBody, removed: 0 };
   }
+  if (kept.length === 0) {
+    delete parsed.system;
+  } else {
+    parsed.system = kept;
+  }
+  return { body: JSON.stringify(parsed), removed };
 }
-async function flushAllRawStreamCaptures() {
-  await Promise.all([...activeCaptures].map((capture) => capture.finalize()));
-}
-let acceptingRequests = true;
-let activeRequests = 0;
-const drainWaiters = /* @__PURE__ */ new Set();
-function notifyDrained() {
-  if (activeRequests !== 0) return;
-  for (const resolve2 of drainWaiters) resolve2();
-  drainWaiters.clear();
+const ROLE_ASSISTANT = "assistant";
+const ROLE_TOOL = "tool";
+function isObjectWithMessages(value) {
+  if (!isPlainRecord(value)) return false;
+  if (!Object.prototype.hasOwnProperty.call(value, "messages")) return false;
+  const messages = safeGetOwnProperty(value, "messages");
+  return Array.isArray(messages);
 }
-function acquireRuntimeRequest() {
-  if (!acceptingRequests || activeRequests >= MAX_ACTIVE_PROXY_REQUESTS) return null;
-  activeRequests += 1;
-  let released = false;
-  return {
-    release() {
-      if (released) return;
-      released = true;
-      activeRequests = Math.max(0, activeRequests - 1);
-      notifyDrained();
+function collectAssistantToolCallIds(message, into) {
+  if (!isPlainRecord(message)) return;
+  const toolCalls = safeGetOwnProperty(message, "tool_calls");
+  if (!Array.isArray(toolCalls)) return;
+  for (const tc of toolCalls) {
+    if (!isPlainRecord(tc)) continue;
+    const id = safeGetOwnProperty(tc, "id");
+    if (typeof id === "string" && id.length > 0) {
+      into.add(id);
     }
-  };
-}
-function stopRuntimeAdmission() {
-  acceptingRequests = false;
-  notifyDrained();
+  }
 }
-async function waitForRuntimeTrafficDrain() {
-  if (activeRequests === 0) return;
-  await new Promise((resolve2) => {
-    drainWaiters.add(resolve2);
-  });
+function findOrphanToolMessageIndices(messages) {
+  const knownToolCallIds = /* @__PURE__ */ new Set();
+  const indices = [];
+  const orphanIds = [];
+  for (let i = 0; i < messages.length; i++) {
+    const msg = messages[i];
+    if (!isPlainRecord(msg)) continue;
+    const role = safeGetOwnProperty(msg, "role");
+    if (role === ROLE_ASSISTANT) {
+      collectAssistantToolCallIds(msg, knownToolCallIds);
+      continue;
+    }
+    if (role === ROLE_TOOL) {
+      const id = safeGetOwnProperty(msg, "tool_call_id");
+      if (typeof id !== "string" || id.length === 0) {
+        indices.push(i);
+        orphanIds.push(null);
+        continue;
+      }
+      if (!knownToolCallIds.has(id)) {
+        indices.push(i);
+        orphanIds.push(id);
+      }
+    }
+  }
+  return { indices, orphanIds };
 }
-function getRuntimeAdmissionState() {
-  return { acceptingRequests, activeRequests, capacity: MAX_ACTIVE_PROXY_REQUESTS };
+function stripOpenAIOrphanToolMessages(rawBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawBody);
+  } catch {
+    return { body: rawBody, removed: 0, orphanIds: [] };
+  }
+  if (!isObjectWithMessages(parsed)) {
+    return { body: rawBody, removed: 0, orphanIds: [] };
+  }
+  const messages = parsed.messages;
+  const { indices, orphanIds } = findOrphanToolMessageIndices(messages);
+  if (indices.length === 0) {
+    return { body: rawBody, removed: 0, orphanIds: [] };
+  }
+  const dropSet = new Set(indices);
+  const kept = [];
+  for (let i = 0; i < messages.length; i++) {
+    if (!dropSet.has(i)) kept.push(messages[i]);
+  }
+  parsed.messages = kept;
+  return { body: JSON.stringify(parsed), removed: indices.length, orphanIds };
 }
 const PATH_V1_CHAT_COMPLETIONS = "/v1/chat/completions";
 function buildUpstreamUrl(upstreamBase, normalizedPath) {
@@ -10281,10 +11648,14 @@ async function handleAdmittedProxy(req) {
         body: bodyToForward,
         signal: req.signal
       },
-      { allowLoopback: ALLOW_LOOPBACK$2 }
+      {
+        allowLoopback: ALLOW_LOOPBACK$2,
+        deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.fetchDeadlineMs,
+        responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.fetchResponseBytes
+      }
     );
     if (!fetchResult.ok) {
-      const status = fetchResult.kind === "network-policy" ? STATUS_FORBIDDEN : STATUS_BAD_GATEWAY;
+      const status = fetchResult.kind === "network-policy" ? STATUS_FORBIDDEN : fetchResult.kind === "resource-limit" ? STATUS_PAYLOAD_TOO_LARGE : STATUS_BAD_GATEWAY;
       logger.warn(`[handler] Safe fetch blocked ${upstreamUrl}: ${fetchResult.reason}`);
       log.elapsedMs = Date.now() - startTime;
       log.responseStatus = status;
@@ -10292,7 +11663,7 @@ async function handleAdmittedProxy(req) {
       appendLogEntry({ ...buildFileLogEntry(log, upstreamUrl), error: fetchResult.reason });
       await persistFinalizedLogUpdate(log);
       return new Response(
-        fetchResult.kind === "network-policy" ? "Forbidden: upstream URL is not permitted" : "Proxy error: upstream redirects are not permitted",
+        fetchResult.kind === "network-policy" ? "Forbidden: upstream URL is not permitted" : fetchResult.kind === "resource-limit" ? "Proxy error: upstream response exceeded configured limits" : fetchResult.kind === "timeout" ? "Proxy error: upstream request timed out" : "Proxy error: upstream redirects are not permitted",
         { status }
       );
     }
@@ -10394,23 +11765,62 @@ async function handleProxy(req) {
 const Route$Q = createFileRoute("/proxy/$")({
   server: {
     handlers: {
-      GET: ({ request }) => handleProxy(request),
-      POST: ({ request }) => handleProxy(request),
-      PUT: ({ request }) => handleProxy(request),
-      DELETE: ({ request }) => handleProxy(request),
-      PATCH: ({ request }) => handleProxy(request),
-      OPTIONS: ({ request }) => handleProxy(request)
+      GET: ({ request: request2 }) => handleProxy(request2),
+      POST: ({ request: request2 }) => handleProxy(request2),
+      PUT: ({ request: request2 }) => handleProxy(request2),
+      DELETE: ({ request: request2 }) => handleProxy(request2),
+      PATCH: ({ request: request2 }) => handleProxy(request2),
+      OPTIONS: ({ request: request2 }) => handleProxy(request2)
+    }
+  }
+});
+function summarizeGcResult(result) {
+  if (result === null) return null;
+  return {
+    checkedAt: result.checkedAt,
+    filesDeleted: result.filesDeleted,
+    bytesDeleted: result.bytesDeleted,
+    errors: result.errors.length,
+    beforeTotalBytes: result.before.totalBytes,
+    afterTotalBytes: result.after.totalBytes
+  };
+}
+function getStorageResponse() {
+  const logStats = getLogStorageStats();
+  const inventory = getStorageLifecycleInventory();
+  const policy = resolveStorageLifecycleQuotaPolicy();
+  const reclaimableBytes = inventory.artifacts.filter(
+    (artifact) => artifact.cleanupBehavior === "retention-gc" || artifact.cleanupBehavior === "orphan-reclaim"
+  ).reduce((sum, artifact) => sum + artifact.bytes, 0);
+  return {
+    memoryCount: logStats.memoryCount,
+    inventory,
+    policy,
+    reclaimableBytes,
+    lastGc: summarizeGcResult(getLastStorageLifecycleGcResult())
+  };
+}
+const Route$P = createFileRoute("/api/storage")({
+  server: {
+    handlers: {
+      GET: () => {
+        return Response.json(getStorageResponse(), { headers: { "cache-control": "no-store" } });
+      },
+      POST: () => {
+        runStorageLifecycleGc();
+        return Response.json(getStorageResponse(), { headers: { "cache-control": "no-store" } });
+      }
     }
   }
 });
 function parseBooleanFlag(value) {
   return value === "1" || value === "true";
 }
-const Route$P = createFileRoute("/api/sessions")({
+const Route$O = createFileRoute("/api/sessions")({
   server: {
     handlers: {
-      GET: async ({ request }) => {
-        const url2 = new URL(request.url);
+      GET: async ({ request: request2 }) => {
+        const url2 = new URL(request2.url);
         const sessionId = url2.searchParams.get("sessionId");
         if (sessionId !== null) {
           if (sessionId.length === 0) {
@@ -10539,7 +11949,7 @@ function runtimeDiscoveryResponse(env = process.env) {
     headers: { "cache-control": "no-store" }
   });
 }
-const Route$O = createFileRoute("/api/runtime")({
+const Route$N = createFileRoute("/api/runtime")({
   server: {
     handlers: {
       GET: () => runtimeDiscoveryResponse()
@@ -11948,20 +13358,20 @@ function readInspectorRunEvidence(runId) {
   }
   return serviceOk({ run, evidence: run.evidence, markdown });
 }
-async function readJsonBody$6(request) {
+async function readJsonBody$6(request2) {
   try {
-    const raw = await request.text();
+    const raw = await request2.text();
     if (raw.trim().length === 0) return { ok: true, value: void 0 };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     return { ok: false };
   }
 }
-const Route$N = createFileRoute("/api/runs")({
+const Route$M = createFileRoute("/api/runs")({
   server: {
     handlers: {
-      GET: ({ request }) => {
-        const url2 = new URL(request.url);
+      GET: ({ request: request2 }) => {
+        const url2 = new URL(request2.url);
         if (url2.searchParams.get("failures") === "1") {
           const limitResult = parseBoundedIntegerParameter({
             value: url2.searchParams.get("limit"),
@@ -11976,8 +13386,8 @@ const Route$N = createFileRoute("/api/runs")({
         }
         return Response.json(listInspectorRuns());
       },
-      POST: async ({ request }) => {
-        const body = await readJsonBody$6(request);
+      POST: async ({ request: request2 }) => {
+        const body = await readJsonBody$6(request2);
         if (!body.ok) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -12009,16 +13419,16 @@ const ProviderInputSchema = object({
   modelMetadata: ProviderModelMetadataListSchema.optional(),
   source: _enum(["company", "personal"]).optional()
 });
-const Route$M = createFileRoute("/api/providers")({
+const Route$L = createFileRoute("/api/providers")({
   server: {
     handlers: {
       GET: () => {
         return Response.json(redactProviders(getProviders()));
       },
-      POST: async ({ request }) => {
+      POST: async ({ request: request2 }) => {
         let body;
         try {
-          body = await request.json();
+          body = await request2.json();
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -13637,8 +15047,8 @@ function firstModel(provider) {
   }
   return void 0;
 }
-function providerCandidates(request) {
-  if (request.providerId === void 0) {
+function providerCandidates(request2) {
+  if (request2.providerId === void 0) {
     return getProviders().toSorted((left, right) => {
       const leftCompanyRank = left.source === "company" ? 0 : 1;
       const rightCompanyRank = right.source === "company" ? 0 : 1;
@@ -13646,12 +15056,12 @@ function providerCandidates(request) {
       return left.name.localeCompare(right.name);
     });
   }
-  const provider = getProvider(request.providerId);
+  const provider = getProvider(request2.providerId);
   return provider === void 0 ? [] : [provider];
 }
-function selectProvider(request) {
-  for (const provider of providerCandidates(request)) {
-    const modelName = request.model ?? firstModel(provider);
+function selectProvider(request2) {
+  for (const provider of providerCandidates(request2)) {
+    const modelName = request2.model ?? firstModel(provider);
     if (modelName === void 0) continue;
     const responsesBaseUrl = nonEmpty$1(provider.openaiResponsesBaseUrl);
     if (responsesBaseUrl !== void 0) {
@@ -13694,8 +15104,8 @@ function truncateContext(value, maxLength) {
   return `${value.slice(0, maxLength)}
 ...[truncated ${String(value.length - maxLength)} chars]`;
 }
-function lastUserQuestion(request) {
-  const history = request.history ?? [];
+function lastUserQuestion(request2) {
+  const history = request2.history ?? [];
   for (let index = history.length - 1; index >= 0; index -= 1) {
     const message = history[index];
     if (message !== void 0 && message.role === "user") return message.content;
@@ -13716,13 +15126,13 @@ function emptySummary() {
     sourceCounts: { log: 0, knowledge: 0, alert: 0, run: 0, group: 0, provider: 0 }
   };
 }
-async function retrieveInspectorContext(request) {
+async function retrieveInspectorContext(request2) {
   try {
     return await retrievePiAgentEvidence({
-      question: request.question,
-      sessionId: request.sessionId,
-      recentUserQuestion: lastUserQuestion(request),
-      limits: request.logLimit === void 0 ? void 0 : { maxEvidence: request.logLimit }
+      question: request2.question,
+      sessionId: request2.sessionId,
+      recentUserQuestion: lastUserQuestion(request2),
+      limits: request2.logLimit === void 0 ? void 0 : { maxEvidence: request2.logLimit }
     });
   } catch (err) {
     return {
@@ -13872,11 +15282,11 @@ function lastAssistantMessage(messages) {
   }
   return null;
 }
-function boundedHistory(request) {
-  const history = (request.history ?? []).slice(-12).map((message) => `${message.role}: ${message.content.slice(0, MAX_HISTORY_CHARS)}`);
+function boundedHistory(request2) {
+  const history = (request2.history ?? []).slice(-12).map((message) => `${message.role}: ${message.content.slice(0, MAX_HISTORY_CHARS)}`);
   return history.length > 0 ? history.join("\n\n") : "No prior conversation in this request.";
 }
-function buildContext(request, retrieval) {
+function buildContext(request2, retrieval) {
   return {
     systemPrompt: buildSystemPrompt(),
     messages: [
@@ -13884,16 +15294,16 @@ function buildContext(request, retrieval) {
         role: "user",
         content: [
           "Bounded conversation history:",
-          boundedHistory(request),
+          boundedHistory(request2),
           "",
-          buildUserPrompt(request.question, retrieval)
+          buildUserPrompt(request2.question, retrieval)
         ].join("\n"),
         timestamp: Date.now()
       }
     ]
   };
 }
-async function askPi(selected, request, retrieval) {
+async function askPi(selected, request2, retrieval) {
   const { Agent } = await import(
     /* @vite-ignore */
     "../_libs/mariozechner__pi-agent-core.mjs"
@@ -13909,7 +15319,7 @@ async function askPi(selected, request, retrieval) {
     sessionId: selected.provider.id,
     maxRetryDelayMs: 1e4
   });
-  const context = buildContext(request, retrieval);
+  const context = buildContext(request2, retrieval);
   await agent.prompt(context.messages);
   const assistantMessage = lastAssistantMessage(agent.state.messages);
   if (assistantMessage === null) {
@@ -13919,9 +15329,9 @@ async function askPi(selected, request, retrieval) {
   if (answer !== "") return stripReasoningTags(answer);
   return assistantMessage.errorMessage ?? "Inspector Assistant received an empty provider response.";
 }
-async function runPiAgent(request) {
-  const retrieval = await retrieveInspectorContext(request);
-  const selected = selectProvider(request);
+async function runPiAgent(request2) {
+  const retrieval = await retrieveInspectorContext(request2);
+  const selected = selectProvider(request2);
   if (selected === null) {
     return {
       answer: "Inspector Assistant needs at least one Provider with OpenAI Responses, OpenAI Chat, or Anthropic Messages configured.",
@@ -13937,7 +15347,7 @@ async function runPiAgent(request) {
   }
   let answer;
   try {
-    answer = await askPi(selected, request, retrieval);
+    answer = await askPi(selected, request2, retrieval);
   } catch (err) {
     answer = `Inspector Assistant provider request failed: ${err instanceof Error ? err.message : String(err)}`;
   }
@@ -13953,13 +15363,13 @@ async function runPiAgent(request) {
     queryStats: retrieval.queryStats
   };
 }
-const Route$L = createFileRoute("/api/pi-agent")({
+const Route$K = createFileRoute("/api/pi-agent")({
   server: {
     handlers: {
-      POST: async ({ request }) => {
+      POST: async ({ request: request2 }) => {
         let body;
         try {
-          body = await request.json();
+          body = await request2.json();
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -13976,7 +15386,7 @@ const Route$L = createFileRoute("/api/pi-agent")({
     }
   }
 });
-const Route$K = createFileRoute("/api/models")({
+const Route$J = createFileRoute("/api/models")({
   server: {
     handlers: {
       GET: () => Response.json(getModels())
@@ -13984,7 +15394,7 @@ const Route$K = createFileRoute("/api/models")({
   }
 });
 const name = "@tonyclaw/agent-inspector";
-const version = "3.1.19";
+const version = "3.1.21";
 const packageJson = {
   name,
   version
@@ -14321,8 +15731,8 @@ async function getInstanceConnectionImpl(callApi2, name2) {
 }
 async function startInstanceImpl(callApi2, input) {
   const path2 = instancePath(input.name, "/start");
-  const request = lifecycleRequest(input);
-  const response = await callApi2(path2, jsonPost(InstanceStartRequestSchema.parse(request)));
+  const request2 = lifecycleRequest(input);
+  const response = await callApi2(path2, jsonPost(InstanceStartRequestSchema.parse(request2)));
   return validatedInstanceResponse(response, InstanceOperationOutputSchema, `POST ${path2}`);
 }
 async function stopInstanceImpl(callApi2, name2) {
@@ -14332,8 +15742,8 @@ async function stopInstanceImpl(callApi2, name2) {
 }
 async function restartInstanceImpl(callApi2, input) {
   const path2 = instancePath(input.name, "/restart");
-  const request = lifecycleRequest(input);
-  const response = await callApi2(path2, jsonPost(InstanceStartRequestSchema.parse(request)));
+  const request2 = lifecycleRequest(input);
+  const response = await callApi2(path2, jsonPost(InstanceStartRequestSchema.parse(request2)));
   return validatedInstanceResponse(response, InstanceOperationOutputSchema, `POST ${path2}`);
 }
 function groupEvidenceDir(groupId) {
@@ -15992,10 +17402,10 @@ async function getServer() {
   }
   return initPromise;
 }
-async function handleMcpRequest(request) {
-  return runWithRequestPublicBasePath(request, async () => {
+async function handleMcpRequest(request2) {
+  return runWithRequestPublicBasePath(request2, async () => {
     const { transport } = await getServer();
-    return transport.handleRequest(request);
+    return transport.handleRequest(request2);
   });
 }
 const TOOL_LIST_LOGS_DESC = `List recent captured agent/model proxy logs in reverse-chronological order with parsed previews. Useful for "what did I just send?" discovery.
@@ -17645,15 +19055,15 @@ const PROMPT_NAMES = [
   "inspector_generate_group_report",
   "inspector_extract_repro_steps"
 ];
-const Route$J = createFileRoute("/api/mcp")({
+const Route$I = createFileRoute("/api/mcp")({
   server: {
     handlers: {
       // The SDK may issue either POST, GET, or DELETE. TanStack Start only
       // requires us to declare the methods we accept; routing by method is
       // handled inside the transport.
-      POST: ({ request }) => handleMcpRequest(request),
-      GET: ({ request }) => handleMcpRequest(request),
-      DELETE: ({ request }) => handleMcpRequest(request)
+      POST: ({ request: request2 }) => handleMcpRequest(request2),
+      GET: ({ request: request2 }) => handleMcpRequest(request2),
+      DELETE: ({ request: request2 }) => handleMcpRequest(request2)
     }
   }
 });
@@ -17763,11 +19173,11 @@ function parseOptionalLogId(value) {
   const parsed = parseLogId(value);
   return parsed === null ? { ok: false } : { ok: true, value: parsed };
 }
-const Route$I = createFileRoute("/api/logs")({
+const Route$H = createFileRoute("/api/logs")({
   server: {
     handlers: {
-      GET: async ({ request }) => {
-        const url2 = new URL(request.url);
+      GET: async ({ request: request2 }) => {
+        const url2 = new URL(request2.url);
         if (url2.searchParams.get("stats") === "1") {
           return Response.json(getLogStorageStats());
         }
@@ -17871,10 +19281,10 @@ const Route$I = createFileRoute("/api/logs")({
           await listLogsPage({ sessionId, model, clientPid, offset, limit, includeBodies })
         );
       },
-      DELETE: async ({ request }) => {
+      DELETE: async ({ request: request2 }) => {
         let body = void 0;
         try {
-          const raw = await request.text();
+          const raw = await request2.text();
           if (raw !== "") {
             const parsed = JSON.parse(raw);
             const result2 = DeleteLogsBodySchema.safeParse(parsed);
@@ -19681,10 +21091,10 @@ function instanceErrorResponse(error) {
 function instanceResultResponse(result, successStatus = 200) {
   return result.kind === "error" ? instanceErrorResponse(result.error) : Response.json(result.value, { status: successStatus, headers: NO_STORE_HEADERS$1 });
 }
-async function parseInstanceBody(request, schema) {
+async function parseInstanceBody(request2, schema) {
   let value;
   try {
-    const text = await request.text();
+    const text = await request2.text();
     value = text.trim().length === 0 ? {} : JSON.parse(text);
   } catch {
     return {
@@ -19723,7 +21133,7 @@ function instanceListResponse(instances) {
     { headers: NO_STORE_HEADERS$1 }
   );
 }
-const Route$H = createFileRoute("/api/instances")({
+const Route$G = createFileRoute("/api/instances")({
   server: {
     handlers: {
       GET: async () => {
@@ -20033,6 +21443,11 @@ const tasks = /* @__PURE__ */ new Map();
 const activeTasks = /* @__PURE__ */ new Map();
 let acceptingTasks = true;
 let shutdownForceTimer = null;
+function activeTaskLimit() {
+  const configured = Number(process.env["ECOSYSTEM_TASK_ACTIVE_LIMIT"]);
+  if (Number.isSafeInteger(configured) && configured > 0) return configured;
+  return DEFAULT_RUNTIME_BUDGET_POLICY.queues.backgroundWorkers;
+}
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -20227,6 +21642,7 @@ function listEcosystemTasks() {
 }
 function startEcosystemTask(packageId, action) {
   if (!acceptingTasks) return null;
+  if (activeTasks.size >= activeTaskLimit()) return null;
   if (action === "recipe") return null;
   const definition = action === "runner-presets" ? findEcosystemPackage("eval-harness") : findEcosystemPackage(packageId);
   if (definition === null) return null;
@@ -20253,6 +21669,7 @@ function startEcosystemTask(packageId, action) {
 }
 function startEcosystemRecipeTask(recipeId) {
   if (!acceptingTasks) return null;
+  if (activeTasks.size >= activeTaskLimit()) return null;
   const recipe = findEcosystemRecipe(recipeId);
   if (recipe === null) return null;
   if (!recipe.runnable) return null;
@@ -20415,7 +21832,7 @@ function installRuntimeShutdownSignalHandlers() {
 }
 installRuntimeShutdownSignalHandlers();
 logger.debug("Health endpoint loaded");
-const Route$G = createFileRoute("/api/health")({
+const Route$F = createFileRoute("/api/health")({
   server: {
     handlers: {
       GET: async () => {
@@ -20428,18 +21845,18 @@ const Route$G = createFileRoute("/api/health")({
     }
   }
 });
-async function readJsonBody$5(request) {
+async function readJsonBody$5(request2) {
   try {
-    const raw = await request.text();
+    const raw = await request2.text();
     if (raw.trim().length === 0) return { ok: true, value: void 0 };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     return { ok: false };
   }
 }
-function readDeleteEvidenceFlag$1(request) {
+function readDeleteEvidenceFlag$1(request2) {
   try {
-    const value = new URL(request.url).searchParams.get("deleteEvidence");
+    const value = new URL(request2.url).searchParams.get("deleteEvidence");
     switch (value) {
       case null:
         return { ok: true, value: void 0 };
@@ -20456,12 +21873,12 @@ function readDeleteEvidenceFlag$1(request) {
     return { ok: false };
   }
 }
-const Route$F = createFileRoute("/api/groups")({
+const Route$E = createFileRoute("/api/groups")({
   server: {
     handlers: {
       GET: () => Response.json(listInspectorGroups()),
-      POST: async ({ request }) => {
-        const body = await readJsonBody$5(request);
+      POST: async ({ request: request2 }) => {
+        const body = await readJsonBody$5(request2);
         if (!body.ok) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -20474,8 +21891,8 @@ const Route$F = createFileRoute("/api/groups")({
         }
         return Response.json(createInspectorGroup(parsed.data), { status: 201 });
       },
-      DELETE: ({ request }) => {
-        const deleteEvidence = readDeleteEvidenceFlag$1(request);
+      DELETE: ({ request: request2 }) => {
+        const deleteEvidence = readDeleteEvidenceFlag$1(request2);
         if (!deleteEvidence.ok) {
           return Response.json(
             { error: "deleteEvidence must be one of true, false, 1, or 0" },
@@ -20500,16 +21917,16 @@ const RuntimeConfigPatchSchema = object({
 }).strict().refine((v) => Object.keys(v).length > 0, {
   message: "At least one field must be provided"
 });
-const Route$E = createFileRoute("/api/config")({
+const Route$D = createFileRoute("/api/config")({
   server: {
     handlers: {
       GET: () => {
         return Response.json(getConfig());
       },
-      PATCH: async ({ request }) => {
+      PATCH: async ({ request: request2 }) => {
         let body;
         try {
-          body = await request.json();
+          body = await request2.json();
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -20614,11 +22031,11 @@ function parseFilters(url2) {
     source: sourceResult.success ? sourceResult.data : void 0
   };
 }
-const Route$D = createFileRoute("/api/alerts")({
+const Route$C = createFileRoute("/api/alerts")({
   server: {
     handlers: {
-      GET: async ({ request }) => {
-        const url2 = new URL(request.url);
+      GET: async ({ request: request2 }) => {
+        const url2 = new URL(request2.url);
         const limitResult = parseBoundedIntegerParameter({
           value: url2.searchParams.get("limit"),
           parameter: "limit",
@@ -20648,16 +22065,16 @@ const Route$D = createFileRoute("/api/alerts")({
     }
   }
 });
-async function readJsonBody$4(request) {
+async function readJsonBody$4(request2) {
   try {
-    const raw = await request.text();
+    const raw = await request2.text();
     if (raw.trim().length === 0) return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     return { ok: false };
   }
 }
-const Route$C = createFileRoute("/api/runs/$runId")({
+const Route$B = createFileRoute("/api/runs/$runId")({
   server: {
     handlers: {
       GET: ({ params }) => {
@@ -20667,8 +22084,8 @@ const Route$C = createFileRoute("/api/runs/$runId")({
         }
         return Response.json(run.value);
       },
-      PATCH: async ({ params, request }) => {
-        const body = await readJsonBody$4(request);
+      PATCH: async ({ params, request: request2 }) => {
+        const body = await readJsonBody$4(request2);
         if (!body.ok) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -21190,7 +22607,7 @@ function consumeProviderScan(scanId, selectionIds, now = Date.now()) {
   }
   return selected;
 }
-const Route$B = createFileRoute("/api/providers/scan")({
+const Route$A = createFileRoute("/api/providers/scan")({
   server: {
     handlers: {
       POST: () => {
@@ -21236,12 +22653,12 @@ const ProviderScanImportRequestSchema = object({
   selectionIds: array(string().uuid()).min(1).max(100)
 });
 const ProviderFileImportSchema = union([string(), object({ providers: unknown() })]);
-const Route$A = createFileRoute("/api/providers/import")({
+const Route$z = createFileRoute("/api/providers/import")({
   server: {
     handlers: {
-      POST: async ({ request }) => {
+      POST: async ({ request: request2 }) => {
         try {
-          const rawBody = await request.text();
+          const rawBody = await request2.text();
           let jsonContent;
           try {
             const parsedBody = JSON.parse(rawBody);
@@ -21308,7 +22725,7 @@ function exportResponse(json, filename) {
     }
   });
 }
-const Route$z = createFileRoute("/api/providers/export")({
+const Route$y = createFileRoute("/api/providers/export")({
   server: {
     handlers: {
       GET: () => {
@@ -21317,8 +22734,8 @@ const Route$z = createFileRoute("/api/providers/export")({
           `agent-inspector-providers-safe-${Date.now()}.json`
         );
       },
-      POST: async ({ request }) => {
-        const body = await request.json().catch(() => null);
+      POST: async ({ request: request2 }) => {
+        const body = await request2.json().catch(() => null);
         const parsed = SecretExportRequestSchema.safeParse(body);
         if (!parsed.success) {
           return Response.json(
@@ -21351,7 +22768,7 @@ const ProviderUpdateSchema = object({
   modelMetadata: ProviderModelMetadataListSchema.optional(),
   source: _enum(["company", "personal"]).optional()
 });
-const Route$y = createFileRoute("/api/providers/$providerId")({
+const Route$x = createFileRoute("/api/providers/$providerId")({
   server: {
     handlers: {
       GET: ({ params }) => {
@@ -21362,10 +22779,10 @@ const Route$y = createFileRoute("/api/providers/$providerId")({
         }
         return Response.json(redactProvider(provider));
       },
-      PUT: async ({ params, request }) => {
+      PUT: async ({ params, request: request2 }) => {
         let body;
         try {
-          body = await request.json();
+          body = await request2.json();
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -21416,139 +22833,6 @@ const Route$y = createFileRoute("/api/providers/$providerId")({
     }
   }
 });
-const INITIAL_STREAM_LOG_LIMIT = 100;
-const UPDATE_COALESCE_MS = 50;
-const sseClientLimiter = createCapacityLimiter(MAX_SSE_CLIENTS);
-function streamIncludesBodies(url2) {
-  return url2.searchParams.get("compact") === "0";
-}
-function parseLastEventLogId(value) {
-  if (value === null) return void 0;
-  return parseLogId(value) ?? void 0;
-}
-function encodeSse(value, id) {
-  const idLine = id === void 0 ? "" : `id: ${String(id)}
-`;
-  return new TextEncoder().encode(`${idLine}data: ${JSON.stringify(value)}
-
-`);
-}
-function createLogsStreamResponse(request, clientLimiter = sseClientLimiter) {
-  const lastEventIdHeader = request.headers.get("last-event-id");
-  const lastEventLogId = parseLastEventLogId(lastEventIdHeader);
-  if (lastEventIdHeader !== null && lastEventLogId === void 0) {
-    return Response.json({ error: "Invalid Last-Event-ID" }, { status: 400 });
-  }
-  const lease = clientLimiter.tryAcquire();
-  if (lease === null) {
-    return resourceLimitResponse({
-      error: `SSE client capacity reached. At most ${String(clientLimiter.capacity)} live clients are allowed; retry after a connection closes.`,
-      code: "sse-capacity-exceeded",
-      status: 503,
-      resource: "sse-clients",
-      limit: clientLimiter.capacity,
-      retryable: true,
-      retryAfterSeconds: 1
-    });
-  }
-  const url2 = new URL(request.url);
-  const sessionId = url2.searchParams.get("sessionId") ?? void 0;
-  const model = url2.searchParams.get("model") ?? void 0;
-  const includeBodies = streamIncludesBodies(url2);
-  let controllerRef = null;
-  let cleanedUp = false;
-  let updateTimer = null;
-  const pendingUpdates = /* @__PURE__ */ new Map();
-  const flushPendingUpdates = () => {
-    updateTimer = null;
-    const controller = controllerRef;
-    if (controller === null) return;
-    if (controller.desiredSize !== null && controller.desiredSize <= -16) {
-      controller.close();
-      cleanup();
-      return;
-    }
-    for (const log of pendingUpdates.values()) {
-      if (controller.desiredSize !== null && controller.desiredSize <= -16) {
-        controller.close();
-        cleanup();
-        return;
-      }
-      const payloadLog = includeBodies ? log : compactLogForList(log);
-      controller.enqueue(encodeSse({ type: "update", log: payloadLog }, log.id));
-    }
-    pendingUpdates.clear();
-  };
-  const unsubscribe = onLogUpdate((log) => {
-    if (controllerRef === null) return;
-    if (sessionId !== void 0 && getLogSessionId(log) !== sessionId) return;
-    if (model !== void 0 && log.model !== model) return;
-    pendingUpdates.set(log.id, log);
-    if (updateTimer === null) updateTimer = setTimeout(flushPendingUpdates, UPDATE_COALESCE_MS);
-  });
-  const cleanup = () => {
-    if (cleanedUp) return;
-    cleanedUp = true;
-    clearInterval(heartbeat);
-    if (updateTimer !== null) clearTimeout(updateTimer);
-    updateTimer = null;
-    pendingUpdates.clear();
-    unsubscribe();
-    lease.release();
-    controllerRef = null;
-    request.signal.removeEventListener("abort", cleanup);
-  };
-  const heartbeat = setInterval(() => {
-    if (controllerRef !== null) {
-      try {
-        controllerRef.enqueue(new TextEncoder().encode(": heartbeat\n\n"));
-      } catch {
-        cleanup();
-      }
-    }
-  }, 3e4);
-  request.signal.addEventListener("abort", cleanup, { once: true });
-  const stream = new ReadableStream({
-    async start(controller) {
-      controllerRef = controller;
-      try {
-        const result = await listLogsCursorPage({
-          sessionId,
-          model,
-          limit: INITIAL_STREAM_LOG_LIMIT,
-          includeBodies,
-          afterLogId: lastEventLogId,
-          anchor: lastEventLogId === void 0 ? "newest" : void 0
-        });
-        if (cleanedUp) return;
-        const logs = result.logs;
-        const newestLogId = logs.at(-1)?.id;
-        controller.enqueue(encodeSse({ type: "init", logs }, newestLogId));
-      } catch (error) {
-        cleanup();
-        controller.error(error);
-      }
-    },
-    cancel() {
-      cleanup();
-    }
-  });
-  return new Response(stream, {
-    headers: {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      Connection: "keep-alive",
-      "X-Accel-Buffering": "no"
-    }
-  });
-}
-const Route$x = createFileRoute("/api/logs/stream")({
-  server: {
-    handlers: {
-      GET: ({ request }) => createLogsStreamResponse(request)
-    }
-  }
-});
 const DEFAULT_LOG_IMPORT_LIMITS = {
   maxCompressedBytes: 200 * 1024 * 1024,
   maxEntries: 1e4,
@@ -22150,8 +23434,8 @@ function declaredContentLength(value) {
   const parsed = Number.parseInt(value, 10);
   return Number.isSafeInteger(parsed) ? parsed : "invalid";
 }
-async function readBoundedBody(request, maxBytes) {
-  const declaredBytes = declaredContentLength(request.headers.get("content-length"));
+async function readBoundedBody(request2, maxBytes) {
+  const declaredBytes = declaredContentLength(request2.headers.get("content-length"));
   if (declaredBytes === "invalid") {
     return { ok: false, status: 400, message: "Invalid Content-Length header" };
   }
@@ -22162,7 +23446,7 @@ async function readBoundedBody(request, maxBytes) {
       message: `Import request exceeds maximum size of ${String(maxBytes)} bytes.`
     };
   }
-  const body = request.body;
+  const body = request2.body;
   if (body === null) {
     return { ok: false, status: 400, message: "Expected multipart form data" };
   }
@@ -22198,14 +23482,14 @@ async function readBoundedBody(request, maxBytes) {
 function isUploadedFile(value) {
   return value instanceof File;
 }
-async function readBoundedLogImportUpload(request, options = {}) {
-  const contentType = request.headers.get("content-type");
+async function readBoundedLogImportUpload(request2, options = {}) {
+  const contentType = request2.headers.get("content-type");
   if (contentType === null || !contentType.toLowerCase().startsWith("multipart/form-data")) {
     return { ok: false, status: 400, message: "Expected multipart form data" };
   }
   const maxFileBytes = options.maxFileBytes ?? DEFAULT_LOG_IMPORT_LIMITS.maxCompressedBytes;
   const maxRequestBytes = options.maxRequestBytes ?? MAX_LOG_IMPORT_REQUEST_BYTES;
-  const body = await readBoundedBody(request, maxRequestBytes);
+  const body = await readBoundedBody(request2, maxRequestBytes);
   if (!body.ok) return body;
   let formData;
   try {
@@ -22235,8 +23519,8 @@ async function readBoundedLogImportUpload(request, options = {}) {
 const Route$w = createFileRoute("/api/logs/import")({
   server: {
     handlers: {
-      POST: async ({ request }) => {
-        const upload = await readBoundedLogImportUpload(request);
+      POST: async ({ request: request2 }) => {
+        const upload = await readBoundedLogImportUpload(request2);
         if (!upload.ok) {
           return Response.json({ error: upload.message }, { status: upload.status });
         }
@@ -22501,7 +23785,11 @@ async function searchOpenClawGateway(query, project) {
         sessionKey: getOpenClawSessionKey()
       })
     },
-    { bypass: true }
+    {
+      bypass: true,
+      deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataDeadlineMs,
+      responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataResponseBytes
+    }
   );
   if (!fetchResult.ok) return { results: [], warning: fetchResult.reason };
   const response = fetchResult.response;
@@ -22704,7 +23992,11 @@ async function promoteToOpenClaw(candidate) {
       headers: authHeaders(),
       body: JSON.stringify(buildOpenClawPayload(candidate))
     },
-    { bypass: true }
+    {
+      bypass: true,
+      deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataDeadlineMs,
+      responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataResponseBytes
+    }
   );
   if (!fetchResult.ok) return { success: false, error: fetchResult.reason };
   const response = fetchResult.response;
@@ -22736,7 +24028,11 @@ async function searchOpenClaw(query, project) {
       method: "GET",
       headers: authHeaders()
     },
-    { bypass: true }
+    {
+      bypass: true,
+      deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataDeadlineMs,
+      responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataResponseBytes
+    }
   );
   if (!fetchResult.ok) return { results: [], warning: fetchResult.reason };
   const response = fetchResult.response;
@@ -22776,8 +24072,8 @@ function bodySearchQuery(value) {
 const Route$u = createFileRoute("/api/knowledge/search")({
   server: {
     handlers: {
-      GET: async ({ request }) => {
-        const url2 = new URL(request.url);
+      GET: async ({ request: request2 }) => {
+        const url2 = new URL(request2.url);
         const query = url2.searchParams.get("q") ?? "";
         const project = url2.searchParams.get("project") ?? void 0;
         if (query === "") {
@@ -22786,10 +24082,10 @@ const Route$u = createFileRoute("/api/knowledge/search")({
         if (query.length > MAX_SEARCH_QUERY_CHARS) return searchLimitResponse();
         return Response.json(await searchOpenClaw(query, project));
       },
-      POST: async ({ request }) => {
+      POST: async ({ request: request2 }) => {
         let body;
         try {
-          body = await request.json();
+          body = await request2.json();
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -22809,8 +24105,8 @@ const Route$u = createFileRoute("/api/knowledge/search")({
 const Route$t = createFileRoute("/api/knowledge/project-context")({
   server: {
     handlers: {
-      GET: async ({ request }) => {
-        const url2 = new URL(request.url);
+      GET: async ({ request: request2 }) => {
+        const url2 = new URL(request2.url);
         const project = url2.searchParams.get("project") ?? "";
         if (project === "") {
           return Response.json({ error: "Missing project search parameter" }, { status: 400 });
@@ -22845,18 +24141,18 @@ const Route$r = createFileRoute("/api/instances/$name")({
     }
   }
 });
-async function readJsonBody$3(request) {
+async function readJsonBody$3(request2) {
   try {
-    const raw = await request.text();
+    const raw = await request2.text();
     if (raw.trim().length === 0) return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     return { ok: false };
   }
 }
-function readDeleteEvidenceFlag(request) {
+function readDeleteEvidenceFlag(request2) {
   try {
-    const value = new URL(request.url).searchParams.get("deleteEvidence");
+    const value = new URL(request2.url).searchParams.get("deleteEvidence");
     switch (value) {
       case null:
         return { ok: true, value: void 0 };
@@ -22883,8 +24179,8 @@ const Route$q = createFileRoute("/api/groups/$groupId")({
         }
         return Response.json(group.value);
       },
-      PATCH: async ({ params, request }) => {
-        const body = await readJsonBody$3(request);
+      PATCH: async ({ params, request: request2 }) => {
+        const body = await readJsonBody$3(request2);
         if (!body.ok) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -22901,8 +24197,8 @@ const Route$q = createFileRoute("/api/groups/$groupId")({
         }
         return Response.json(updated.value);
       },
-      DELETE: ({ params, request }) => {
-        const deleteEvidence = readDeleteEvidenceFlag(request);
+      DELETE: ({ params, request: request2 }) => {
+        const deleteEvidence = readDeleteEvidenceFlag(request2);
         if (!deleteEvidence.ok) {
           return Response.json(
             { error: "deleteEvidence must be one of true, false, 1, or 0" },
@@ -22957,8 +24253,8 @@ const Route$n = createFileRoute("/api/config/paths")({
 const Route$m = createFileRoute("/api/alerts/summary")({
   server: {
     handlers: {
-      GET: async ({ request }) => {
-        const url2 = new URL(request.url);
+      GET: async ({ request: request2 }) => {
+        const url2 = new URL(request2.url);
         const scanLimitResult = parseBoundedIntegerParameter({
           value: url2.searchParams.get("scanLimit"),
           parameter: "scanLimit",
@@ -22977,9 +24273,9 @@ const Route$m = createFileRoute("/api/alerts/summary")({
     }
   }
 });
-async function readJsonBody$2(request) {
+async function readJsonBody$2(request2) {
   try {
-    const raw = await request.text();
+    const raw = await request2.text();
     if (raw.trim().length === 0) return { ok: true, value: void 0 };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
@@ -22996,8 +24292,8 @@ const Route$l = createFileRoute("/api/runs/$runId/evidence")({
         }
         return Response.json(evidence.value);
       },
-      POST: async ({ params, request }) => {
-        const body = await readJsonBody$2(request);
+      POST: async ({ params, request: request2 }) => {
+        const body = await readJsonBody$2(request2);
         if (!body.ok) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -23011,7 +24307,7 @@ const Route$l = createFileRoute("/api/runs/$runId/evidence")({
         const exported = await exportInspectorRunEvidence(
           params.runId,
           parsed.data,
-          new URL(request.url).origin
+          new URL(request2.url).origin
         );
         if (!exported.ok) {
           return Response.json({ error: exported.message }, { status: exported.status });
@@ -23919,12 +25215,12 @@ async function readRegistryJson(response) {
 const Route$j = createFileRoute("/api/providers/$providerId/model-metadata")({
   server: {
     handlers: {
-      POST: async ({ params, request }) => {
+      POST: async ({ params, request: request2 }) => {
         const provider = getProvider(params.providerId);
         if (provider === void 0) {
           return Response.json({ error: "Provider not found" }, { status: 404 });
         }
-        const parsed = RefreshModelMetadataInputSchema.safeParse(await request.json());
+        const parsed = RefreshModelMetadataInputSchema.safeParse(await request2.json());
         if (!parsed.success) {
           return Response.json({ error: parsed.error.message }, { status: 400 });
         }
@@ -23958,9 +25254,16 @@ const Route$j = createFileRoute("/api/providers/$providerId/model-metadata")({
         }
         let response;
         try {
-          const fetchResult = await safeFetch(sourceUrl, {
-            headers: { Accept: "application/json" }
-          });
+          const fetchResult = await safeFetch(
+            sourceUrl,
+            {
+              headers: { Accept: "application/json" }
+            },
+            {
+              deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataDeadlineMs,
+              responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.metadataResponseBytes
+            }
+          );
           if (!fetchResult.ok) {
             return Response.json(
               { error: `Model metadata URL blocked: ${fetchResult.reason}` },
@@ -24034,14 +25337,14 @@ const ReplayRequestSchema = object({
 const Route$i = createFileRoute("/api/logs/$id/replay")({
   server: {
     handlers: {
-      POST: async ({ params, request }) => {
+      POST: async ({ params, request: request2 }) => {
         const id = parseLogId(params.id);
         if (id === null) {
           return Response.json({ error: "Invalid log ID" }, { status: 400 });
         }
         let replayRequest;
         try {
-          const raw = await request.json();
+          const raw = await request2.json();
           const parsed = ReplayRequestSchema.safeParse(raw);
           if (!parsed.success) {
             return Response.json({ error: "Invalid request body" }, { status: 400 });
@@ -24099,7 +25402,11 @@ const Route$i = createFileRoute("/api/logs/$id/replay")({
               headers,
               body: modifiedBody
             },
-            { allowLoopback: process.env["AGENT_INSPECTOR_ALLOW_LOOPBACK"] === "1" }
+            {
+              allowLoopback: process.env["AGENT_INSPECTOR_ALLOW_LOOPBACK"] === "1",
+              deadlineMs: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.replayDeadlineMs,
+              responseBytes: DEFAULT_RUNTIME_BUDGET_POLICY.upstream.replayResponseBytes
+            }
           );
           if (!fetchResult.ok) {
             return Response.json({
@@ -24353,12 +25660,12 @@ function parseIntegerParam(value, fallback) {
 const Route$g = createFileRoute("/api/logs/$id/body")({
   server: {
     handlers: {
-      GET: async ({ params, request }) => {
+      GET: async ({ params, request: request2 }) => {
         const id = parseLogId(params.id);
         if (id === null) {
           return Response.json({ error: "Invalid log ID" }, { status: 400 });
         }
-        const url2 = new URL(request.url);
+        const url2 = new URL(request2.url);
         const partResult = LogBodyPartSchema.safeParse(url2.searchParams.get("part"));
         if (!partResult.success) {
           return Response.json({ error: "Invalid body part" }, { status: 400 });
@@ -24400,7 +25707,7 @@ object({
 const Route$f = createFileRoute("/api/knowledge/candidates/$candidateId")({
   server: {
     handlers: {
-      PATCH: async ({ params, request }) => {
+      PATCH: async ({ params, request: request2 }) => {
         const existing = getCandidate(params.candidateId);
         if (existing === null) {
           return Response.json({ error: "Knowledge candidate not found" }, { status: 404 });
@@ -24411,7 +25718,7 @@ const Route$f = createFileRoute("/api/knowledge/candidates/$candidateId")({
             { status: 409 }
           );
         }
-        const raw = await request.json().catch(() => null);
+        const raw = await request2.json().catch(() => null);
         const parsed = CandidateUpdateSchema.safeParse(raw);
         if (!parsed.success) {
           return Response.json({ error: parsed.error.message }, { status: 400 });
@@ -24428,8 +25735,8 @@ const Route$f = createFileRoute("/api/knowledge/candidates/$candidateId")({
 const Route$e = createFileRoute("/api/instances/$name/stop")({
   server: {
     handlers: {
-      POST: async ({ params, request }) => {
-        const body = await parseInstanceBody(request, InstanceEmptyRequestSchema);
+      POST: async ({ params, request: request2 }) => {
+        const body = await parseInstanceBody(request2, InstanceEmptyRequestSchema);
         if (!body.ok) return body.response;
         const selfError = selfLifecycleError(params.name);
         if (selfError !== null) return instanceErrorResponse(selfError);
@@ -24441,8 +25748,8 @@ const Route$e = createFileRoute("/api/instances/$name/stop")({
 const Route$d = createFileRoute("/api/instances/$name/start")({
   server: {
     handlers: {
-      POST: async ({ params, request }) => {
-        const body = await parseInstanceBody(request, InstanceStartRequestSchema);
+      POST: async ({ params, request: request2 }) => {
+        const body = await parseInstanceBody(request2, InstanceStartRequestSchema);
         if (!body.ok) return body.response;
         const result = await startNamedInstance(params.name, body.value);
         const status = result.kind === "success" && result.value.outcome === "created" ? 201 : 200;
@@ -24454,8 +25761,8 @@ const Route$d = createFileRoute("/api/instances/$name/start")({
 const Route$c = createFileRoute("/api/instances/$name/restart")({
   server: {
     handlers: {
-      POST: async ({ params, request }) => {
-        const body = await parseInstanceBody(request, InstanceStartRequestSchema);
+      POST: async ({ params, request: request2 }) => {
+        const body = await parseInstanceBody(request2, InstanceStartRequestSchema);
         if (!body.ok) return body.response;
         const selfError = selfLifecycleError(params.name);
         if (selfError !== null) return instanceErrorResponse(selfError);
@@ -24471,9 +25778,9 @@ const Route$b = createFileRoute("/api/instances/$name/connection")({
     }
   }
 });
-async function readJsonBody$1(request) {
+async function readJsonBody$1(request2) {
   try {
-    const raw = await request.text();
+    const raw = await request2.text();
     if (raw.trim().length === 0) return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
@@ -24490,8 +25797,8 @@ const Route$a = createFileRoute("/api/groups/$groupId/sessions")({
         }
         return Response.json(sessions2.value);
       },
-      POST: async ({ params, request }) => {
-        const body = await readJsonBody$1(request);
+      POST: async ({ params, request: request2 }) => {
+        const body = await readJsonBody$1(request2);
         if (!body.ok) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -24511,9 +25818,9 @@ const Route$a = createFileRoute("/api/groups/$groupId/sessions")({
     }
   }
 });
-async function readJsonBody(request) {
+async function readJsonBody(request2) {
   try {
-    const raw = await request.text();
+    const raw = await request2.text();
     if (raw.trim().length === 0) return { ok: true, value: void 0 };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
@@ -24530,8 +25837,8 @@ const Route$9 = createFileRoute("/api/groups/$groupId/evidence")({
         }
         return Response.json(evidence.value);
       },
-      POST: async ({ params, request }) => {
-        const body = await readJsonBody(request);
+      POST: async ({ params, request: request2 }) => {
+        const body = await readJsonBody(request2);
         if (!body.ok) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -24545,7 +25852,7 @@ const Route$9 = createFileRoute("/api/groups/$groupId/evidence")({
         const exported = await exportInspectorGroupEvidence(
           params.groupId,
           parsed.data,
-          new URL(request.url).origin
+          new URL(request2.url).origin
         );
         if (!exported.ok) {
           return Response.json({ error: exported.message }, { status: exported.status });
@@ -24885,14 +26192,14 @@ async function logModelResults(displayName, providerName, providerSessionId, ant
 const Route$7 = createFileRoute("/api/providers/$providerId/test/log")({
   server: {
     handlers: {
-      POST: async ({ params, request }) => {
+      POST: async ({ params, request: request2 }) => {
         const provider = getProvider(params.providerId);
         if (!provider) {
           return Response.json({ error: "Provider not found" }, { status: 404 });
         }
         let body;
         try {
-          body = await request.json();
+          body = await request2.json();
         } catch {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
@@ -25210,12 +26517,12 @@ const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
 function noStoreJson(body, status = 200) {
   return Response.json(body, { status, headers: NO_STORE_HEADERS });
 }
-async function readExecutionRequest(request) {
-  const body = await request.json().catch(() => null);
+async function readExecutionRequest(request2) {
+  const body = await request2.json().catch(() => null);
   return EcosystemExecutionRequestSchema.safeParse(body);
 }
-async function handleEcosystemPackageExecution(request, packageId, action, startTask = startEcosystemTask) {
-  const parsed = await readExecutionRequest(request);
+async function handleEcosystemPackageExecution(request2, packageId, action, startTask = startEcosystemTask) {
+  const parsed = await readExecutionRequest(request2);
   if (!parsed.success) {
     auditEcosystemExecution("confirmation_rejected", action, null, "invalid_request");
     return noStoreJson({ error: "Explicit local command confirmation is required" }, 400);
@@ -25247,9 +26554,9 @@ async function handleEcosystemPackageExecution(request, packageId, action, start
   auditEcosystemExecution("execution_started", action, plan.targetId, "none");
   return noStoreJson({ task });
 }
-async function handleEcosystemRecipeExecution(request, recipeId, startTask = startEcosystemRecipeTask) {
+async function handleEcosystemRecipeExecution(request2, recipeId, startTask = startEcosystemRecipeTask) {
   const action = "recipe";
-  const parsed = await readExecutionRequest(request);
+  const parsed = await readExecutionRequest(request2);
   if (!parsed.success) {
     auditEcosystemExecution("confirmation_rejected", action, null, "invalid_request");
     return noStoreJson({ error: "Explicit local command confirmation is required" }, 400);
@@ -25284,149 +26591,159 @@ async function handleEcosystemRecipeExecution(request, recipeId, startTask = sta
 const Route$4 = createFileRoute("/api/ecosystem/recipes/$recipeId/run")({
   server: {
     handlers: {
-      POST: ({ params, request }) => handleEcosystemRecipeExecution(request, params.recipeId)
+      POST: ({ params, request: request2 }) => handleEcosystemRecipeExecution(request2, params.recipeId)
     }
   }
 });
 const Route$3 = createFileRoute("/api/ecosystem/packages/$packageId/upgrade")({
   server: {
     handlers: {
-      POST: ({ params, request }) => handleEcosystemPackageExecution(request, params.packageId, "upgrade")
+      POST: ({ params, request: request2 }) => handleEcosystemPackageExecution(request2, params.packageId, "upgrade")
     }
   }
 });
 const Route$2 = createFileRoute("/api/ecosystem/packages/$packageId/runner-presets")({
   server: {
     handlers: {
-      POST: ({ params, request }) => handleEcosystemPackageExecution(request, params.packageId, "runner-presets")
+      POST: ({ params, request: request2 }) => handleEcosystemPackageExecution(request2, params.packageId, "runner-presets")
     }
   }
 });
 const Route$1 = createFileRoute("/api/ecosystem/packages/$packageId/install")({
   server: {
     handlers: {
-      POST: ({ params, request }) => handleEcosystemPackageExecution(request, params.packageId, "install")
+      POST: ({ params, request: request2 }) => handleEcosystemPackageExecution(request2, params.packageId, "install")
     }
   }
 });
 const Route = createFileRoute("/api/ecosystem/packages/$packageId/help")({
   server: {
     handlers: {
-      POST: ({ params, request }) => handleEcosystemPackageExecution(request, params.packageId, "help")
+      POST: ({ params, request: request2 }) => handleEcosystemPackageExecution(request2, params.packageId, "help")
     }
   }
 });
-const ReadyzRoute = Route$T.update({
+const ReadyzRoute = Route$V.update({
   id: "/readyz",
   path: "/readyz",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
+});
+const MetricsRoute = Route$T.update({
+  id: "/metrics",
+  path: "/metrics",
+  getParentRoute: () => Route$W
 });
 const LivezRoute = Route$S.update({
   id: "/livez",
   path: "/livez",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const SplatRoute = Route$R.update({
   id: "/$",
   path: "/$",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ProxySplatRoute = Route$Q.update({
   id: "/proxy/$",
   path: "/proxy/$",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
+});
+const ApiStorageRoute = Route$P.update({
+  id: "/api/storage",
+  path: "/api/storage",
+  getParentRoute: () => Route$W
 });
-const ApiSessionsRoute = Route$P.update({
+const ApiSessionsRoute = Route$O.update({
   id: "/api/sessions",
   path: "/api/sessions",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiRuntimeRoute = Route$O.update({
+const ApiRuntimeRoute = Route$N.update({
   id: "/api/runtime",
   path: "/api/runtime",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiRunsRoute = Route$N.update({
+const ApiRunsRoute = Route$M.update({
   id: "/api/runs",
   path: "/api/runs",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiProvidersRoute = Route$M.update({
+const ApiProvidersRoute = Route$L.update({
   id: "/api/providers",
   path: "/api/providers",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiPiAgentRoute = Route$L.update({
+const ApiPiAgentRoute = Route$K.update({
   id: "/api/pi-agent",
   path: "/api/pi-agent",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiModelsRoute = Route$K.update({
+const ApiModelsRoute = Route$J.update({
   id: "/api/models",
   path: "/api/models",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiMcpRoute = Route$J.update({
+const ApiMcpRoute = Route$I.update({
   id: "/api/mcp",
   path: "/api/mcp",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiLogsRoute = Route$I.update({
+const ApiLogsRoute = Route$H.update({
   id: "/api/logs",
   path: "/api/logs",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiInstancesRoute = Route$H.update({
+const ApiInstancesRoute = Route$G.update({
   id: "/api/instances",
   path: "/api/instances",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiHealthRoute = Route$G.update({
+const ApiHealthRoute = Route$F.update({
   id: "/api/health",
   path: "/api/health",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiGroupsRoute = Route$F.update({
+const ApiGroupsRoute = Route$E.update({
   id: "/api/groups",
   path: "/api/groups",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiConfigRoute = Route$E.update({
+const ApiConfigRoute = Route$D.update({
   id: "/api/config",
   path: "/api/config",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiAlertsRoute = Route$D.update({
+const ApiAlertsRoute = Route$C.update({
   id: "/api/alerts",
   path: "/api/alerts",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
-const ApiRunsRunIdRoute = Route$C.update({
+const ApiRunsRunIdRoute = Route$B.update({
   id: "/$runId",
   path: "/$runId",
   getParentRoute: () => ApiRunsRoute
 });
-const ApiProvidersScanRoute = Route$B.update({
+const ApiProvidersScanRoute = Route$A.update({
   id: "/scan",
   path: "/scan",
   getParentRoute: () => ApiProvidersRoute
 });
-const ApiProvidersImportRoute = Route$A.update({
+const ApiProvidersImportRoute = Route$z.update({
   id: "/import",
   path: "/import",
   getParentRoute: () => ApiProvidersRoute
 });
-const ApiProvidersExportRoute = Route$z.update({
+const ApiProvidersExportRoute = Route$y.update({
   id: "/export",
   path: "/export",
   getParentRoute: () => ApiProvidersRoute
 });
-const ApiProvidersProviderIdRoute = Route$y.update({
+const ApiProvidersProviderIdRoute = Route$x.update({
   id: "/$providerId",
   path: "/$providerId",
   getParentRoute: () => ApiProvidersRoute
 });
-const ApiLogsStreamRoute = Route$x.update({
+const ApiLogsStreamRoute = Route$U.update({
   id: "/stream",
   path: "/stream",
   getParentRoute: () => ApiLogsRoute
@@ -25444,17 +26761,17 @@ const ApiLogsIdRoute = Route$v.update({
 const ApiKnowledgeSearchRoute = Route$u.update({
   id: "/api/knowledge/search",
   path: "/api/knowledge/search",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ApiKnowledgeProjectContextRoute = Route$t.update({
   id: "/api/knowledge/project-context",
   path: "/api/knowledge/project-context",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ApiKnowledgeCandidatesRoute = Route$s.update({
   id: "/api/knowledge/candidates",
   path: "/api/knowledge/candidates",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ApiInstancesNameRoute = Route$r.update({
   id: "/$name",
@@ -25469,12 +26786,12 @@ const ApiGroupsGroupIdRoute = Route$q.update({
 const ApiEcosystemTasksRoute = Route$p.update({
   id: "/api/ecosystem/tasks",
   path: "/api/ecosystem/tasks",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ApiEcosystemPackagesRoute = Route$o.update({
   id: "/api/ecosystem/packages",
   path: "/api/ecosystem/packages",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ApiConfigPathsRoute = Route$n.update({
   id: "/paths",
@@ -25564,7 +26881,7 @@ const ApiProvidersProviderIdTestLogRoute = Route$7.update({
 const ApiKnowledgeSessionsSessionIdCandidatesRoute = Route$6.update({
   id: "/api/knowledge/sessions/$sessionId/candidates",
   path: "/api/knowledge/sessions/$sessionId/candidates",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ApiKnowledgeCandidatesCandidateIdPromoteRoute = Route$5.update({
   id: "/promote",
@@ -25574,7 +26891,7 @@ const ApiKnowledgeCandidatesCandidateIdPromoteRoute = Route$5.update({
 const ApiEcosystemRecipesRecipeIdRunRoute = Route$4.update({
   id: "/api/ecosystem/recipes/$recipeId/run",
   path: "/api/ecosystem/recipes/$recipeId/run",
-  getParentRoute: () => Route$U
+  getParentRoute: () => Route$W
 });
 const ApiEcosystemPackagesPackageIdUpgradeRoute = Route$3.update({
   id: "/$packageId/upgrade",
@@ -25704,6 +27021,7 @@ const ApiKnowledgeCandidatesRouteWithChildren = ApiKnowledgeCandidatesRoute._add
 const rootRouteChildren = {
   SplatRoute,
   LivezRoute,
+  MetricsRoute,
   ReadyzRoute,
   ApiAlertsRoute: ApiAlertsRouteWithChildren,
   ApiConfigRoute: ApiConfigRouteWithChildren,
@@ -25718,6 +27036,7 @@ const rootRouteChildren = {
   ApiRunsRoute: ApiRunsRouteWithChildren,
   ApiRuntimeRoute,
   ApiSessionsRoute,
+  ApiStorageRoute,
   ProxySplatRoute,
   ApiEcosystemPackagesRoute: ApiEcosystemPackagesRouteWithChildren,
   ApiEcosystemTasksRoute: ApiEcosystemTasksRouteWithChildren,
@@ -25727,7 +27046,7 @@ const rootRouteChildren = {
   ApiEcosystemRecipesRecipeIdRunRoute,
   ApiKnowledgeSessionsSessionIdCandidatesRoute
 };
-const routeTree = Route$U._addFileChildren(rootRouteChildren)._addFileTypes();
+const routeTree = Route$W._addFileChildren(rootRouteChildren)._addFileTypes();
 function defaultRouterBasePath() {
   return getRouterBasePath(typeof process === "undefined" ? void 0 : process.env);
 }