@yeaft/webchat-agent 1.0.173 → 1.0.175

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.173",
+  "version": "1.0.175",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/yeaft/work-center/bridge.js

@@ -18,14 +18,19 @@ let shuttingDown = false;
 let shutdownPromise = null;
 let serviceFactory = null;
 
-const BROWSER_DETAIL_OPS = new Set(['get', 'create', 'update', 'start', 'cancel', 'guide', 'retry']);
+const BROWSER_DETAIL_OPS = new Set(['get', 'create', 'update', 'start', 'cancel', 'action_input', 'guide', 'retry']);
+const BROWSER_ACTION_DEBUG_OPS = new Set(['get_action_messages', 'get_action_requests', 'get_action_request']);
 // `files` is an internal server-to-Agent field. The browser relay rejects any
 // client-supplied value and only emits files resolved from owned upload ids.
 const BROWSER_FILE_FIELDS = Object.freeze({
   create: [
     'title', 'goal', 'acceptanceCriteria', 'workItemType', 'workDir', 'reuseMemory', 'files', 'start',
   ],
+  action_input: ['id', 'text', 'actionId', 'revision', 'files'],
   guide: ['id', 'guidance', 'actionId', 'revision', 'files'],
+  get_action_messages: ['id', 'actionId', 'cursor', 'limit'],
+  get_action_requests: ['id', 'actionId'],
+  get_action_request: ['id', 'actionId', 'runId', 'requestId'],
 });
 
 function browserFilePayload(op, value) {
@@ -100,6 +105,7 @@ async function createDefaultService() {
     },
     policyProvider: async () => readWorkCenterSettings(yeaftDir),
     attachmentRoot: join(yeaftDir, 'work-center', 'attachments'),
+    yeaftDir,
     actionWorktreeRoot: join(yeaftDir, 'work-center', 'worktrees'),
     registry: defaultRegistry,
     store: null,
@@ -184,7 +190,7 @@ export async function handleWorkCenterRequest(msg) {
       const workCenter = await ensureWorkCenter();
       const payload = Object.hasOwn(BROWSER_FILE_FIELDS, op)
         ? browserFilePayload(op, msg.payload)
-        : (msg.payload || {});
+        : (BROWSER_ACTION_DEBUG_OPS.has(op) ? browserFilePayload(op, msg.payload) : (msg.payload || {}));
       data = await workCenter.handle(op, payload);
     }
     if (BROWSER_DETAIL_OPS.has(op)) data = projectWorkItemDetail(data);

package/yeaft/work-center/controller.js

@@ -210,16 +210,54 @@ export class WorkflowController {
         instruction: actionInstruction(step, workItem, context, renderSessionContextSnapshot(workItem.sessionContext)),
         maxAttempts: previous.maxAttempts || 2,
       };
-    }, input.attachments);
+    }, input.attachments, input.addedAttachments);
     if (!detail) throw new Error(`WorkItem not found: ${id}`);
     return detail;
   }
 
+  input(id, input = {}) {
+    const text = typeof input.text === 'string' ? input.text.trim().slice(0, 8_000) : '';
+    const addedAttachmentCount = Math.max(0, Number(input.addedAttachmentCount) || 0);
+    if (!text && addedAttachmentCount === 0) throw new Error('Action input or attachments are required');
+    const workItem = this.store.getWorkItem(id);
+    if (!workItem) throw new Error(`WorkItem not found: ${id}`);
+    if (['ready', 'running'].includes(workItem.status)) {
+      if (workItem.currentActionId !== input.actionId || workItem.revision !== input.revision) {
+        throw new Error('Action changed before input was applied; refresh and try again');
+      }
+      return this.guide(id, {
+        guidance: text,
+        actionId: input.actionId,
+        revision: input.revision,
+        addedAttachmentCount,
+        addedAttachments: input.addedAttachments,
+        attachments: input.attachments,
+      });
+    }
+    if (!['waiting', 'needs_attention'].includes(workItem.status)) {
+      throw new Error(`WorkItem in ${workItem.status} cannot accept Action input`);
+    }
+    if (workItem.currentActionId !== input.actionId || workItem.revision !== input.revision) {
+      throw new Error('Action changed before input was applied; refresh and try again');
+    }
+    return this.retry(id, {
+      answer: text,
+      addedAttachmentCount,
+      expected: { actionId: input.actionId, revision: input.revision },
+      attachments: input.attachments,
+      inputEvent: {
+        text: text || `The user added ${addedAttachmentCount} attachment(s) as additional context for this Action.`,
+        attachments: input.addedAttachments,
+      },
+    });
+  }
+
   retry(id, input = {}) {
     const answer = typeof input.answer === 'string' ? input.answer.trim().slice(0, 8_000) : '';
+    const addedAttachmentCount = Math.max(0, Number(input.addedAttachmentCount) || 0);
     const detail = this.store.retryWorkItemAtomic(id, (workItem, previous, previousRun) => {
-      if (workItem.status === 'waiting' && !answer) {
-        throw new Error('answer is required to resume a waiting WorkItem');
+      if (workItem.status === 'waiting' && !answer && addedAttachmentCount === 0) {
+        throw new Error('answer or attachments are required to resume a waiting WorkItem');
       }
       const step = previous
         ? {
@@ -244,7 +282,9 @@ export class WorkflowController {
           summary: previousRun.summary || '',
           evidence: normalizeEvidence(previousRun.evidence),
           waitingReason: previousRun.waitingReason || null,
-          answer: answer || null,
+          answer: answer || (addedAttachmentCount > 0
+            ? `The user added ${addedAttachmentCount} attachment(s) as additional context for this Action.`
+            : null),
         });
       }
       return {
@@ -253,6 +293,10 @@ export class WorkflowController {
         instruction: actionInstruction(step, workItem, context, renderSessionContextSnapshot(workItem.sessionContext)),
         maxAttempts: previous?.maxAttempts || 2,
       };
+    }, {
+      expected: input.expected || null,
+      attachments: input.attachments,
+      inputEvent: input.inputEvent || null,
     });
     if (!detail) throw new Error(`WorkItem not found: ${id}`);
     return detail;

package/yeaft/work-center/debug-projection.js

@@ -0,0 +1,541 @@
+const MAX_DEBUG_STRING_BYTES = 64 * 1024;
+export const MAX_ACTION_REQUEST_DETAIL_BYTES = 256 * 1024;
+const MAX_ACTION_REQUEST_INPUT_BYTES = MAX_ACTION_REQUEST_DETAIL_BYTES;
+const MAX_ACTION_REQUEST_INPUT_LOOPS = 16;
+const MAX_ACTION_REQUEST_INPUT_TOOLS = MAX_ACTION_REQUEST_INPUT_LOOPS * 128;
+const MAX_DEBUG_ARRAY_ITEMS = 128;
+const SENSITIVE_NAMES = new Set([
+  'apikey', 'xapikey', 'token', 'accesstoken', 'refreshtoken', 'idtoken', 'clientsecret',
+  'secret', 'signature', 'sig', 'credential', 'password', 'passwd',
+  'authorization', 'proxyauthorization', 'auth', 'code', 'cookie', 'setcookie',
+]);
+const BINARY_DATA_TYPES = new Set(['base64', 'redactedthinking', 'redacted_thinking']);
+const MAX_SENSITIVE_NAME_LENGTH = Math.max(...[...SENSITIVE_NAMES].map(name => name.length));
+const MAX_SENSITIVE_NAME_SOURCE_CHARS = 256;
+const MAX_QUOTED_SECRET_VALUE_CHARS = 64 * 1024;
+const MAX_URL_NAME_DECODE_STEPS = 3;
+
+function byteLength(value) {
+  return Buffer.byteLength(String(value || ''), 'utf8');
+}
+
+function jsonByteLength(value) {
+  return Buffer.byteLength(JSON.stringify(value), 'utf8');
+}
+
+function truncateUtf8(value, maxBytes = MAX_DEBUG_STRING_BYTES) {
+  const bytes = Buffer.from(String(value || ''), 'utf8');
+  if (bytes.length <= maxBytes) return bytes.toString('utf8');
+  const marker = '\n[truncated to browser debug budget]';
+  const contentBytes = Math.max(0, maxBytes - byteLength(marker));
+  let end = Math.min(contentBytes, bytes.length);
+  while (end > 0 && (bytes[end] & 0xc0) === 0x80) end -= 1;
+  return `${bytes.subarray(0, end).toString('utf8')}${marker}`;
+}
+
+function normalizeSensitiveName(name) {
+  return String(name || '').toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+
+function isSensitiveName(name) {
+  return SENSITIVE_NAMES.has(normalizeSensitiveName(name));
+}
+
+function decodeQuotedName(value, quote) {
+  if (quote === "'") return value;
+  try {
+    return JSON.parse(`"${value}"`);
+  } catch {
+    return null;
+  }
+}
+
+function quotedNameBeforeOperator(text, operatorIndex) {
+  let end = operatorIndex;
+  while (end > 0 && /\s/.test(text[end - 1])) end -= 1;
+  const quote = text[end - 1];
+  if (quote !== '"' && quote !== "'") return undefined;
+  const earliest = Math.max(0, end - MAX_SENSITIVE_NAME_SOURCE_CHARS);
+  for (let start = end - 2; start >= earliest; start -= 1) {
+    if (text[start] !== quote) continue;
+    let slashCount = 0;
+    for (let cursor = start - 1; cursor >= earliest && text[cursor] === '\\'; cursor -= 1) {
+      slashCount += 1;
+    }
+    if (slashCount % 2 === 0) {
+      return decodeQuotedName(text.slice(start + 1, end - 1), quote);
+    }
+  }
+  return null;
+}
+
+function candidateStart(text, end, colonOperator) {
+  let start = end;
+  const boundary = colonOperator
+    ? /[\r\n,:=;{}\[\]()"'?&]/
+    : /[\r\n,=;{}\[\]()"'?&]/;
+  while (start > 0 && !boundary.test(text[start - 1])) start -= 1;
+  return start;
+}
+
+function hasSensitiveSuffix(text, start, end) {
+  let reversed = '';
+  const earliest = Math.max(start, end - MAX_SENSITIVE_NAME_SOURCE_CHARS);
+  for (let index = end - 1; index >= earliest; index -= 1) {
+    const character = text[index].toLowerCase();
+    if (/[a-z0-9]/.test(character)) {
+      reversed += character;
+      if (reversed.length > MAX_SENSITIVE_NAME_LENGTH) return false;
+      continue;
+    }
+    if (!reversed) continue;
+    const normalized = [...reversed].reverse().join('');
+    if (/[\s:&?;,={}\[\]()"']/.test(character)) {
+      if (SENSITIVE_NAMES.has(normalized)) return true;
+      if (!/[\s:]/.test(character)) return false;
+    }
+  }
+  return SENSITIVE_NAMES.has([...reversed].reverse().join(''));
+}
+
+function assignmentHasSensitiveName(text, operatorIndex, operator) {
+  let end = operatorIndex;
+  while (end > 0 && /\s/.test(text[end - 1])) end -= 1;
+  if (end === 0) return false;
+  const quotedName = quotedNameBeforeOperator(text, operatorIndex);
+  if (quotedName !== undefined) return quotedName == null || isSensitiveName(quotedName);
+  if (operator === '=') return hasSensitiveSuffix(text, 0, end);
+  const start = candidateStart(text, end, true);
+  const candidate = text.slice(start, end).trim();
+  if (/(?:^|\s)status\s+code$/i.test(candidate)) return false;
+  return isSensitiveName(candidate) || hasSensitiveSuffix(text, start, end);
+}
+
+function sensitiveAssignmentOperators(value, allowColon = true) {
+  const text = String(value || '');
+  const operators = [];
+  for (let index = 0; index < text.length; index += 1) {
+    const operator = text[index];
+    if (operator !== '=' && operator !== ':') continue;
+    if (operator === ':') {
+      if (!allowColon) continue;
+      let valueStart = index + 1;
+      const valueLimit = Math.min(text.length, index + MAX_SENSITIVE_NAME_SOURCE_CHARS);
+      while (valueStart < valueLimit && /[\t ]/.test(text[valueStart])) valueStart += 1;
+      const quotedName = quotedNameBeforeOperator(text, index);
+      const hasStructuredValue = valueStart > index + 1 || /["']/.test(text[valueStart] || '');
+      if (quotedName === undefined && !hasStructuredValue) {
+        let end = index;
+        const earliest = Math.max(0, index - MAX_SENSITIVE_NAME_SOURCE_CHARS);
+        while (end > earliest && /\s/.test(text[end - 1])) end -= 1;
+        const start = candidateStart(text, end, true);
+        if (start > 0 && text[start - 1] === ':') continue;
+      }
+    }
+    if (assignmentHasSensitiveName(text, index, operator)) operators.push(index);
+  }
+  return operators;
+}
+
+function containsSensitiveFieldSyntax(value) {
+  return sensitiveAssignmentOperators(value).length > 0;
+}
+
+function assignmentUsesWholeLogicalValue(text, operatorIndex) {
+  let end = operatorIndex;
+  while (end > 0 && /\s/.test(text[end - 1])) end -= 1;
+  const start = candidateStart(text, end, text[operatorIndex] === ':');
+  const normalized = normalizeSensitiveName(text.slice(start, end));
+  return ['authorization', 'proxyauthorization', 'cookie', 'setcookie']
+    .some(name => normalized.endsWith(name));
+}
+
+function assignmentValueReplacement(text, operatorIndex) {
+  let start = operatorIndex + 1;
+  const valueLimit = Math.min(text.length, operatorIndex + MAX_SENSITIVE_NAME_SOURCE_CHARS);
+  while (start < valueLimit && /[\t ]/.test(text[start])) start += 1;
+  if (start === valueLimit && start < text.length) {
+    return { start: operatorIndex + 1, end: text.length, value: '***' };
+  }
+  if (start >= text.length || /[\r\n]/.test(text[start])) return null;
+  if (assignmentUsesWholeLogicalValue(text, operatorIndex)) {
+    let end = start;
+    while (end < text.length && !/[;\r\n]/.test(text[end])) end += 1;
+    return { start, end, value: '***' };
+  }
+  const quote = text[start];
+  if (quote === '"' || quote === "'") {
+    let end = start + 1;
+    const quoteLimit = Math.min(text.length, start + MAX_QUOTED_SECRET_VALUE_CHARS);
+    while (end < quoteLimit && !/[\r\n]/.test(text[end])) {
+      if (text[end] === quote && text[end - 1] !== '\\') {
+        return { start, end: end + 1, value: `${quote}***${quote}` };
+      }
+      end += 1;
+    }
+    return { start, end, value: `${quote}***${quote}` };
+  }
+  let end = start;
+  while (end < text.length && !/[\s,;=&}\]]/.test(text[end])) end += 1;
+  return end > start ? { start, end, value: '***' } : null;
+}
+
+function redactSensitiveAssignments(value, allowColon = true) {
+  const text = String(value || '');
+  const replacements = sensitiveAssignmentOperators(text, allowColon)
+    .map(index => assignmentValueReplacement(text, index))
+    .filter(Boolean);
+  const merged = [];
+  for (const replacement of replacements) {
+    const previous = merged.at(-1);
+    if (!previous || replacement.start >= previous.end) {
+      merged.push({ ...replacement });
+      continue;
+    }
+    if (replacement.end <= previous.end) continue;
+    previous.end = replacement.end;
+    previous.value = '***';
+  }
+  if (merged.length === 0) return text;
+  const parts = [];
+  let cursor = 0;
+  for (const replacement of merged) {
+    parts.push(text.slice(cursor, replacement.start), replacement.value);
+    cursor = replacement.end;
+  }
+  parts.push(text.slice(cursor));
+  return parts.join('');
+}
+
+function isSensitiveUrlName(name) {
+  let decoded = String(name || '');
+  for (let step = 0; step < MAX_URL_NAME_DECODE_STEPS; step += 1) {
+    if (isSensitiveName(decoded)) return true;
+    let next;
+    try {
+      next = decodeURIComponent(decoded.replace(/\+/g, ' '));
+    } catch {
+      return true;
+    }
+    if (next === decoded) return false;
+    decoded = next;
+  }
+  return isSensitiveName(decoded) || decoded.includes('%');
+}
+
+function boundedDebugInputBytes(value, maxBytes) {
+  let bytes = 0;
+  const seen = new Set();
+  const stack = [value];
+  while (stack.length > 0 && bytes <= maxBytes) {
+    const item = stack.pop();
+    if (item == null) {
+      bytes += 4;
+      continue;
+    }
+    if (typeof item === 'string') {
+      if (item.length > maxBytes - bytes) return maxBytes + 1;
+      bytes += byteLength(item);
+      continue;
+    }
+    if (typeof item !== 'object') {
+      bytes += byteLength(item);
+      continue;
+    }
+    if (seen.has(item)) continue;
+    seen.add(item);
+    if (Array.isArray(item)) {
+      const length = Math.min(item.length, MAX_DEBUG_ARRAY_ITEMS);
+      if (item.length > length) bytes += 32;
+      for (let index = length - 1; index >= 0; index -= 1) stack.push(item[index]);
+      continue;
+    }
+    for (const key in item) {
+      if (!Object.hasOwn(item, key)) continue;
+      bytes += byteLength(key);
+      if (bytes > maxBytes) break;
+      stack.push(item[key]);
+    }
+  }
+  return bytes > maxBytes ? maxBytes + 1 : bytes;
+}
+
+export function limitActionRequestDebugInput(loopValues, toolValues) {
+  const sourceLoops = Array.isArray(loopValues) ? loopValues : [];
+  const sourceTools = Array.isArray(toolValues) ? toolValues : [];
+  const candidates = sourceLoops.slice(-MAX_ACTION_REQUEST_INPUT_LOOPS);
+  const candidateNumbers = new Set(candidates.map(loop => Number(loop?.loopNumber) || 0));
+  const toolsByLoop = new Map();
+  for (const tool of sourceTools.slice(-MAX_ACTION_REQUEST_INPUT_TOOLS)) {
+    const loopNumber = Number(tool?.loopNumber) || 0;
+    if (!candidateNumbers.has(loopNumber)) continue;
+    const tools = toolsByLoop.get(loopNumber) || [];
+    tools.push(tool);
+    toolsByLoop.set(loopNumber, tools);
+  }
+
+  let remainingBytes = MAX_ACTION_REQUEST_INPUT_BYTES;
+  const loops = [];
+  const tools = [];
+  for (let index = candidates.length - 1; index >= 0; index -= 1) {
+    const loop = candidates[index];
+    const loopTools = toolsByLoop.get(Number(loop?.loopNumber) || 0) || [];
+    const inputBytes = boundedDebugInputBytes({ loop, tools: loopTools }, remainingBytes);
+    if (inputBytes > remainingBytes) continue;
+    loops.unshift(loop);
+    tools.unshift(...loopTools);
+    remainingBytes -= inputBytes;
+  }
+  return {
+    loops,
+    tools,
+    omittedLoopCount: sourceLoops.length - loops.length,
+  };
+}
+
+function sanitizeUrlQueryNames(value) {
+  return String(value || '').replace(
+    /([?&])([^=&#]+)=([^&#]*)/g,
+    (match, prefix, name) => (isSensitiveUrlName(name) ? `${prefix}${name}=***` : match),
+  );
+}
+
+export function sanitizeDebugUrl(value) {
+  const text = sanitizeUrlQueryNames(truncateUtf8(value, MAX_DEBUG_STRING_BYTES));
+  try {
+    const url = new URL(text);
+    url.username = '';
+    url.password = '';
+    return truncateUtf8(url.toString());
+  } catch {
+    return truncateUtf8(text.replace(/\/\/[^/@\s]+@/g, '//'));
+  }
+}
+
+function redactSensitiveHeaderLines(value) {
+  return String(value || '').replace(
+    /(^|\r\n|\r|\n)([\t ]*)([^:\r\n]{1,256})([\t ]*:[\t ]*)([^\r\n]*)/g,
+    (match, boundary, whitespace, name, operator) => (isSensitiveName(name)
+      ? `${boundary}${whitespace}${name}${operator}***`
+      : match),
+  );
+}
+
+export function sanitizeDiagnosticText(value, maxBytes = 8 * 1024) {
+  let text = truncateUtf8(value, maxBytes);
+  text = text.replace(/https?:\/\/[^\s"'<>]+/gi, match => sanitizeDebugUrl(match));
+  text = redactSensitiveHeaderLines(text);
+  text = redactSensitiveAssignments(text);
+  text = text.replace(/\b(Bearer)\s+[^\s,;}\]]+/gi, '$1 ***');
+  return truncateUtf8(text, maxBytes);
+}
+
+function omittedBinary(value) {
+  return `[binary data omitted: ${byteLength(value)} bytes]`;
+}
+
+function sanitizeSseMetadataLine(line) {
+  const match = String(line || '').match(/^(\s*(?:event|id|retry)?\s*:)(.*)$/i);
+  if (!match) return sanitizeDiagnosticText(line, MAX_DEBUG_STRING_BYTES);
+  let value = truncateUtf8(match[2], MAX_DEBUG_STRING_BYTES);
+  value = value.replace(/https?:\/\/[^\s"'<>]+/gi, url => sanitizeDebugUrl(url));
+  value = redactSensitiveAssignments(value, false);
+  const colonValue = value.match(/^(\s*)([^:=\s]+)(\s+|\s*:\s+)(.+)$/);
+  if (colonValue && isSensitiveName(colonValue[2])) {
+    value = `${colonValue[1]}${colonValue[2]}${colonValue[3]}***`;
+  }
+  value = value.replace(/\b(Bearer)\s+[^\s,;}\]]+/gi, '$1 ***');
+  return truncateUtf8(`${match[1]}${value}`, MAX_DEBUG_STRING_BYTES);
+}
+
+function sanitizeSseEvent(event, seen) {
+  const lines = event.split(/\r?\n/);
+  const dataIndexes = [];
+  const dataParts = [];
+  for (const [index, line] of lines.entries()) {
+    const match = line.match(/^\s*data:\s?(.*)$/);
+    if (!match) continue;
+    dataIndexes.push(index);
+    dataParts.push(match[1]);
+  }
+  if (dataParts.length === 0) {
+    return lines.map(line => sanitizeSseMetadataLine(line)).join('\n');
+  }
+
+  const data = dataParts.join('\n');
+  let sanitized = data;
+  if (data !== '[DONE]') {
+    try {
+      sanitized = JSON.stringify(sanitizeDebugValue(JSON.parse(data), null, '', seen));
+    } catch {
+      sanitized = containsSensitiveFieldSyntax(data)
+        ? '[redacted SSE event: malformed sensitive data]'
+        : sanitizeDiagnosticText(data, MAX_DEBUG_STRING_BYTES);
+    }
+  }
+
+  const firstDataIndex = dataIndexes[0];
+  const dataIndexSet = new Set(dataIndexes);
+  const sanitizedDataLines = String(sanitized).split('\n').map(line => `data: ${line}`).join('\n');
+  const sanitizedLines = [];
+  for (const [index, line] of lines.entries()) {
+    if (dataIndexSet.has(index)) {
+      if (index === firstDataIndex) sanitizedLines.push(sanitizedDataLines);
+      continue;
+    }
+    sanitizedLines.push(sanitizeSseMetadataLine(line));
+  }
+  return sanitizedLines.join('\n');
+}
+
+function sanitizeSseBody(value, seen) {
+  const text = truncateUtf8(value, MAX_DEBUG_STRING_BYTES);
+  const trailingSeparator = /(?:\r?\n){2}$/.test(text) ? '\n\n' : '';
+  const events = text.split(/(?:\r?\n){2}/);
+  if (events.at(-1) === '') events.pop();
+  return truncateUtf8(`${events.map(event => sanitizeSseEvent(event, seen)).join('\n\n')}${trailingSeparator}`);
+}
+
+function sanitizeHeaderEntries(entries, seen) {
+  return entries.map(([name, headerValue]) => [
+    String(name || ''),
+    isSensitiveName(name) ? '***' : sanitizeDebugValue(headerValue, null, String(name || ''), seen),
+  ]);
+}
+
+function sanitizeHeaders(value, seen, raw = false) {
+  if (typeof value === 'string') return sanitizeDiagnosticText(value, MAX_DEBUG_STRING_BYTES);
+  if (!value || typeof value !== 'object') return sanitizeDebugValue(value, null, '', seen);
+  if (!Array.isArray(value)) {
+    return Object.fromEntries(sanitizeHeaderEntries(Object.entries(value), seen));
+  }
+  const items = value.slice(0, MAX_DEBUG_ARRAY_ITEMS);
+  if (raw || items.every(item => !Array.isArray(item))) {
+    const out = [];
+    for (let index = 0; index < items.length; index += 2) {
+      const name = items[index];
+      out.push(name);
+      if (index + 1 < items.length) {
+        out.push(isSensitiveName(name)
+          ? '***'
+          : sanitizeDebugValue(items[index + 1], null, String(name || ''), seen));
+      }
+    }
+    if (value.length > items.length) out.push(`[${value.length - items.length} additional items omitted]`);
+    return out;
+  }
+  const out = items.map(item => {
+    if (!Array.isArray(item) || item.length < 2) return sanitizeDebugValue(item, value, '', seen);
+    const [name, headerValue, ...rest] = item;
+    return [name, isSensitiveName(name) ? '***' : sanitizeDebugValue(headerValue, null, String(name || ''), seen),
+      ...rest.map(valueItem => sanitizeDebugValue(valueItem, item, '', seen))];
+  });
+  if (value.length > items.length) out.push(`[${value.length - items.length} additional items omitted]`);
+  return out;
+}
+
+export function sanitizeDebugValue(value, parent = null, key = '', seen = new WeakSet()) {
+  if (key && isSensitiveName(key)) return '***';
+  if (value == null || typeof value === 'number' || typeof value === 'boolean') return value;
+  if (typeof value === 'string') {
+    const text = truncateUtf8(value, MAX_DEBUG_STRING_BYTES);
+    if (key === 'url') return sanitizeDebugUrl(text);
+    if (text.startsWith('data:') && text.includes(';base64,')) return omittedBinary(value);
+    const parentType = String(parent?.type || '').toLowerCase().replace(/[^a-z0-9_]/g, '');
+    if (key === 'data' && BINARY_DATA_TYPES.has(parentType)) return omittedBinary(value);
+    if (key === 'body' && /^[\s\r\n]*[\[{]/.test(text)) {
+      try {
+        return truncateUtf8(JSON.stringify(sanitizeDebugValue(JSON.parse(text), null, '', seen)));
+      } catch {
+        if (containsSensitiveFieldSyntax(text)) {
+          return '[redacted malformed JSON: sensitive data]';
+        }
+      }
+    }
+    return sanitizeDiagnosticText(text, MAX_DEBUG_STRING_BYTES);
+  }
+  if (typeof value !== 'object') return truncateUtf8(String(value));
+  if (seen.has(value)) return '[circular value omitted]';
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      const items = value.slice(0, MAX_DEBUG_ARRAY_ITEMS)
+        .map(item => sanitizeDebugValue(item, value, '', seen));
+      if (value.length > items.length) {
+        items.push(`[${value.length - items.length} additional items omitted]`);
+      }
+      return items;
+    }
+    const out = {};
+    for (const [childKey, item] of Object.entries(value)) {
+      if (childKey === 'headers' || childKey === 'rawHeaders') {
+        out[childKey] = sanitizeHeaders(item, seen, childKey === 'rawHeaders');
+      } else if (childKey === 'body' && value.format === 'sse' && typeof item === 'string') {
+        out.body = sanitizeSseBody(item, seen);
+      } else {
+        out[childKey] = sanitizeDebugValue(item, value, childKey, seen);
+      }
+    }
+    return out;
+  } finally {
+    seen.delete(value);
+  }
+}
+
+export function enforceActionRequestDetailBudget(detail, omittedLoopCount = 0) {
+  if (omittedLoopCount > 0 && detail?.request) {
+    detail.request.truncated = true;
+    detail.request.omittedLoopCount = omittedLoopCount;
+  }
+  if (!detail?.request || jsonByteLength(detail) <= MAX_ACTION_REQUEST_DETAIL_BYTES) return detail;
+  detail.request.truncated = true;
+  const loops = Array.isArray(detail.request.loops) ? detail.request.loops : [];
+  const stages = [
+    loop => { loop.rawResponse = null; },
+    loop => { loop.rawRequest = null; },
+    loop => {
+      for (const tool of Array.isArray(loop.tools) ? loop.tools : []) {
+        tool.output = null;
+        tool.input = null;
+      }
+    },
+    loop => { loop.messages = []; },
+    loop => { loop.systemPrompt = ''; },
+    loop => { loop.response = ''; },
+  ];
+  for (const stage of stages) {
+    for (const loop of loops) stage(loop);
+    if (jsonByteLength(detail) <= MAX_ACTION_REQUEST_DETAIL_BYTES) return detail;
+  }
+  while (loops.length > 1 && jsonByteLength(detail) > MAX_ACTION_REQUEST_DETAIL_BYTES) {
+    loops.shift();
+    detail.request.omittedLoopCount = (detail.request.omittedLoopCount || 0) + 1;
+  }
+  if (jsonByteLength(detail) <= MAX_ACTION_REQUEST_DETAIL_BYTES) return detail;
+  detail.request.omittedLoopCount = (detail.request.omittedLoopCount || 0) + loops.length;
+  detail.request.loops = [];
+  if (jsonByteLength(detail) <= MAX_ACTION_REQUEST_DETAIL_BYTES) return detail;
+  const request = detail.request;
+  const metadata = value => truncateUtf8(value, 4 * 1024);
+  return {
+    actionId: metadata(detail.actionId),
+    request: {
+      id: metadata(request.id),
+      runId: metadata(request.runId),
+      status: metadata(request.status),
+      model: metadata(request.model),
+      vp: request.vp ? {
+        id: metadata(request.vp.id),
+        name: metadata(request.vp.name),
+      } : null,
+      openedAt: request.openedAt,
+      closedAt: request.closedAt,
+      loopCount: request.loopCount,
+      totalMs: request.totalMs,
+      totalTokens: request.totalTokens,
+      loops: [],
+      truncated: true,
+      omittedLoopCount: detail.request.omittedLoopCount,
+    },
+  };
+}