alink-cli 0.11.8 → 0.11.10

package/dist/bin.mjs

@@ -11747,6 +11747,7 @@ const AuthAccessReadScope = "access:read";
 const AuthAccessWriteScope = "access:write";
 const AuthRelayReadScope = "relay:read";
 const AuthRelayWriteScope = "relay:write";
+const AuthPortProxyOperateScope = "port-proxy:operate";
 const AuthEnvironmentScope = Literals([
 	AuthOrchestrationReadScope,
 	AuthOrchestrationOperateScope,
@@ -11755,7 +11756,8 @@ const AuthEnvironmentScope = Literals([
 	AuthAccessReadScope,
 	AuthAccessWriteScope,
 	AuthRelayReadScope,
-	AuthRelayWriteScope
+	AuthRelayWriteScope,
+	AuthPortProxyOperateScope
 ]);
 const AuthEnvironmentScopes = ArraySchema(AuthEnvironmentScope);
 const AuthStandardClientScopes = [
@@ -11763,7 +11765,8 @@ const AuthStandardClientScopes = [
 	AuthOrchestrationOperateScope,
 	AuthTerminalOperateScope,
 	AuthReviewWriteScope,
-	AuthRelayReadScope
+	AuthRelayReadScope,
+	AuthPortProxyOperateScope
 ];
 const AuthAdministrativeScopes = [
 	...AuthStandardClientScopes,
@@ -22506,6 +22509,11 @@ const ReviewDiffPreviewResult = Struct({
 	sources: ArraySchema(ReviewDiffPreviewSource)
 });
 const ReviewDiffPreviewError = Union([VcsError, GitCommandError]);
+//#endregion
+//#region ../t3-contracts/src/portProxy.ts
+const PortProxyPort = PortSchema.pipe(brand("PortProxyPort"));
+const PortProxyListResult = Struct({ ports: ArraySchema(PortProxyPort) });
+const PortProxyPortInput = Struct({ port: PortProxyPort });
 const ResourceTelemetryIoSemantics = Literals([
 	"storage",
 	"logical",
@@ -23272,6 +23280,9 @@ const WS_METHODS = {
 	serverReportClientActivity: "server.reportClientActivity",
 	serverReportHostPowerState: "server.reportHostPowerState",
 	serverGetBackgroundPolicy: "server.getBackgroundPolicy",
+	portProxyList: "portProxy.list",
+	portProxyAuthorize: "portProxy.authorize",
+	portProxyRevoke: "portProxy.revoke",
 	cloudGetRelayClientStatus: "cloud.getRelayClientStatus",
 	cloudInstallRelayClient: "cloud.installRelayClient",
 	sourceControlLookupRepository: "sourceControl.lookupRepository",
@@ -23345,6 +23356,21 @@ const WsServerGetSettingsRpc = make$52(WS_METHODS.serverGetSettings, {
 	success: ServerSettings,
 	error: Union([ServerSettingsError, EnvironmentAuthorizationError])
 });
+const WsPortProxyListRpc = make$52(WS_METHODS.portProxyList, {
+	payload: Struct({}),
+	success: PortProxyListResult,
+	error: EnvironmentAuthorizationError
+});
+const WsPortProxyAuthorizeRpc = make$52(WS_METHODS.portProxyAuthorize, {
+	payload: PortProxyPortInput,
+	success: PortProxyListResult,
+	error: EnvironmentAuthorizationError
+});
+const WsPortProxyRevokeRpc = make$52(WS_METHODS.portProxyRevoke, {
+	payload: PortProxyPortInput,
+	success: PortProxyListResult,
+	error: EnvironmentAuthorizationError
+});
 const WsServerUpdateSettingsRpc = make$52(WS_METHODS.serverUpdateSettings, {
 	payload: Struct({ patch: ServerSettingsPatch }),
 	success: ServerSettings,
@@ -23670,7 +23696,7 @@ const WsOrchestrationSubscribeThreadRpc = make$52(ORCHESTRATION_WS_METHODS.subsc
 	error: Union([OrchestrationGetSnapshotError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = make$51(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpdateServerWithProgressRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerGetResourceTelemetryHistoryRpc, WsServerRetryResourceTelemetryRpc, WsServerSignalProcessRpc, WsServerReportClientActivityRpc, WsServerReportHostPowerStateRpc, WsServerGetBackgroundPolicyRpc, WsCloudGetRelayClientStatusRpc, WsCloudInstallRelayClientRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsReviewGetDiffFileContentsRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, make$52(WS_METHODS.subscribeTerminalEvents, {
+const WsRpcGroup = make$51(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpdateServerWithProgressRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerGetResourceTelemetryHistoryRpc, WsServerRetryResourceTelemetryRpc, WsServerSignalProcessRpc, WsServerReportClientActivityRpc, WsServerReportHostPowerStateRpc, WsServerGetBackgroundPolicyRpc, WsPortProxyListRpc, WsPortProxyAuthorizeRpc, WsPortProxyRevokeRpc, WsCloudGetRelayClientStatusRpc, WsCloudInstallRelayClientRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsReviewGetDiffFileContentsRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, make$52(WS_METHODS.subscribeTerminalEvents, {
 	payload: Struct({}),
 	success: TerminalEvent,
 	error: EnvironmentAuthorizationError,
@@ -50725,7 +50751,7 @@ const layer$12 = effect(ProviderMaintenanceRunner, fn("ProviderMaintenanceRunner
 })());
 //#endregion
 //#region src/orchestration/ActivityPayloadProjection.ts
-function asRecord$1(value) {
+function asRecord$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asTrimmedString$1(value) {
@@ -50748,7 +50774,7 @@ function collectChangedFiles(value, target, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$1(value);
+	const record = asRecord$2(value);
 	if (!record) return;
 	pushChangedFile(target, seen, record.path);
 	pushChangedFile(target, seen, record.filePath);
@@ -50774,13 +50800,13 @@ function collectChangedFiles(value, target, seen, depth) {
 	}
 }
 function projectCommandData(data) {
-	const item = asRecord$1(data.item);
+	const item = asRecord$2(data.item);
 	if (!item) return;
 	const projectedItem = {};
 	if ("command" in item) projectedItem.command = item.command;
-	const input = asRecord$1(item.input);
+	const input = asRecord$2(item.input);
 	if (input && "command" in input) projectedItem.input = { command: input.command };
-	const result = asRecord$1(item.result);
+	const result = asRecord$2(item.result);
 	if (result && "command" in result) projectedItem.result = { command: result.command };
 	return Object.keys(projectedItem).length > 0 ? projectedItem : void 0;
 }
@@ -50796,7 +50822,7 @@ function summarizeToolTextOutput(value) {
 	return null;
 }
 function projectRawOutput(value) {
-	const rawOutput = asRecord$1(value);
+	const rawOutput = asRecord$2(value);
 	if (!rawOutput) return;
 	if (typeof rawOutput.totalFiles === "number" && Number.isFinite(rawOutput.totalFiles)) return {
 		totalFiles: rawOutput.totalFiles,
@@ -50818,8 +50844,8 @@ function projectRawOutput(value) {
 * the full payload in persistence and the event store.
 */
 function projectActivityPayload(activity) {
-	const payload = asRecord$1(activity.payload);
-	const data = asRecord$1(payload?.data);
+	const payload = asRecord$2(activity.payload);
+	const data = asRecord$2(payload?.data);
 	if (!payload || !data || payload.itemType === "mcp_tool_call") return activity;
 	const projectedData = {};
 	const item = projectCommandData(data);
@@ -50848,7 +50874,7 @@ function projectActivityPayload(activity) {
 */
 function isResolvableContextWindowActivity(activity) {
 	if (activity.kind !== "context-window.updated") return false;
-	const usedTokens = asRecord$1(activity.payload)?.usedTokens;
+	const usedTokens = asRecord$2(activity.payload)?.usedTokens;
 	return typeof usedTokens === "number" && Number.isFinite(usedTokens) && usedTokens >= 0;
 }
 /**
@@ -51040,6 +51066,60 @@ const observeRpcStreamEffect = (method, effect, traceAttributes) => {
 	return withRpcStreamTracing(method, instrumented, traceAttributes);
 };
 //#endregion
+//#region src/portProxy.ts
+const ports = /* @__PURE__ */ new Set();
+const methods = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"OPTIONS"
+]);
+const requestHeaders = /* @__PURE__ */ new Set([
+	"authorization",
+	"cookie",
+	"host",
+	"connection",
+	"upgrade",
+	"proxy-authorization",
+	"proxy-connection"
+]);
+const responseHeaders = /* @__PURE__ */ new Set([
+	"set-cookie",
+	"connection",
+	"upgrade",
+	"proxy-authenticate",
+	"transfer-encoding"
+]);
+function listAuthorizedPorts() {
+	return [...ports].sort((a, b) => a - b);
+}
+function authorizePort(port) {
+	ports.add(port);
+	return listAuthorizedPorts();
+}
+function revokePort(port) {
+	ports.delete(port);
+	return listAuthorizedPorts();
+}
+function isPortAuthorized(port) {
+	return ports.has(port);
+}
+function authorizedPortBaseUrl(port) {
+	return isPortAuthorized(port) ? `http://127.0.0.1:${port}` : null;
+}
+function isPortProxyMethodAllowed(method) {
+	return methods.has(method.toUpperCase());
+}
+function isPortProxyRequestHeaderAllowed(header) {
+	return !requestHeaders.has(header.toLowerCase());
+}
+function isPortProxyResponseHeaderAllowed(header) {
+	return !responseHeaders.has(header.toLowerCase());
+}
+//#endregion
 //#region ../t3-shared/src/searchRanking.ts
 function normalizeSearchQuery(input, options) {
 	const trimmed = input.trim();
@@ -52379,6 +52459,9 @@ const RPC_REQUIRED_SCOPES = {
 	[WS_METHODS.serverReportClientActivity]: AuthOrchestrationReadScope,
 	[WS_METHODS.serverReportHostPowerState]: AuthOrchestrationOperateScope,
 	[WS_METHODS.serverGetBackgroundPolicy]: AuthOrchestrationReadScope,
+	[WS_METHODS.portProxyList]: AuthPortProxyOperateScope,
+	[WS_METHODS.portProxyAuthorize]: AuthPortProxyOperateScope,
+	[WS_METHODS.portProxyRevoke]: AuthPortProxyOperateScope,
 	[WS_METHODS.cloudGetRelayClientStatus]: AuthRelayReadScope,
 	[WS_METHODS.cloudInstallRelayClient]: AuthRelayWriteScope,
 	[WS_METHODS.sourceControlLookupRepository]: AuthOrchestrationReadScope,
@@ -52885,6 +52968,9 @@ const makeWsRpcLayer = (currentSession) => WsRpcGroup.toLayer(gen(function* () {
 		}), { "rpc.aggregate": "orchestration" }),
 		[WS_METHODS.serverProbe]: (_input) => observeRpcEffect$1(WS_METHODS.serverProbe, succeed$1({}), { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverGetConfig]: (_input) => observeRpcEffect$1(WS_METHODS.serverGetConfig, loadServerConfig, { "rpc.aggregate": "server" }),
+		[WS_METHODS.portProxyList]: (_input) => observeRpcEffect$1(WS_METHODS.portProxyList, sync(() => ({ ports: listAuthorizedPorts() })), { "rpc.aggregate": "port-proxy" }),
+		[WS_METHODS.portProxyAuthorize]: ({ port }) => observeRpcEffect$1(WS_METHODS.portProxyAuthorize, sync(() => ({ ports: authorizePort(port) })), { "rpc.aggregate": "port-proxy" }),
+		[WS_METHODS.portProxyRevoke]: ({ port }) => observeRpcEffect$1(WS_METHODS.portProxyRevoke, sync(() => ({ ports: revokePort(port) })), { "rpc.aggregate": "port-proxy" }),
 		[WS_METHODS.serverRefreshProviders]: (input) => observeRpcEffect$1(WS_METHODS.serverRefreshProviders, (input.instanceId !== void 0 ? providerRegistry.refreshInstance(input.instanceId) : providerRegistry.refresh()).pipe(map$4((providers) => ({ providers }))), { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverUpdateProvider]: (input) => observeRpcEffect$1(WS_METHODS.serverUpdateProvider, providerMaintenanceRunner.updateProvider(input), { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverUpdateSettings]: ({ patch }) => observeRpcEffect$1(WS_METHODS.serverUpdateSettings, serverSettings.updateSettings(patch).pipe(map$4(redactServerSettingsForClient)), { "rpc.aggregate": "server" }),
@@ -53185,7 +53271,8 @@ function makeAgentLinkFrameAssembler() {
 const TUNNEL_SCOPES = [
 	AuthOrchestrationReadScope,
 	AuthOrchestrationOperateScope,
-	AuthTerminalOperateScope
+	AuthTerminalOperateScope,
+	AuthPortProxyOperateScope
 ];
 function machineIdFromToken(token) {
 	const parts = token.split(".");
@@ -53322,7 +53409,7 @@ const splitHubFrame = (text) => {
 	};
 };
 function isHttpTunnelRequestFrame(value) {
-	return typeof value === "object" && value !== null && value._tag === "HttpRequest" && typeof value.id === "string" && typeof value.method === "string" && typeof value.path === "string" && Array.isArray(value.headers) && (value.body === null || typeof value.body === "string");
+	return typeof value === "object" && value !== null && value._tag === "HttpRequest" && typeof value.id === "string" && typeof value.method === "string" && typeof value.path === "string" && Array.isArray(value.headers) && (value.body === null || typeof value.body === "string") && (value.targetPort === void 0 || Number.isInteger(value.targetPort) && Number(value.targetPort) >= 1 && Number(value.targetPort) <= 65535);
 }
 function encodeHttpTunnelResponseFrame(frame) {
 	return JSON.stringify(frame);
@@ -53455,7 +53542,7 @@ const runHubTunnel = (config) => gen(function* () {
 			});
 			yield* addFinalizer(() => sessionsStore.markDisconnected(issued.sessionId).pipe(andThen(serverAuth.revokeSession(issued.sessionId)), ignore$1));
 			yield* sessionsStore.markConnected(issued.sessionId);
-			const localBaseUrl = `http://127.0.0.1:${serverConfig.port}`;
+			const daemonBaseUrl = `http://127.0.0.1:${serverConfig.port}`;
 			const sendEncrypted = (frame) => {
 				try {
 					for (const part of chunkAgentLinkFrame(encodeHttpTunnelResponseFrame(frame))) {
@@ -53496,12 +53583,35 @@ const runHubTunnel = (config) => gen(function* () {
 					});
 					return;
 				}
+				const portProxyBaseUrl = requestFrame.targetPort === void 0 ? void 0 : authorizedPortBaseUrl(requestFrame.targetPort);
+				if (portProxyBaseUrl === null) {
+					sendEncrypted({
+						_tag: "HttpResponse",
+						id: requestFrame.id,
+						status: 403,
+						statusText: "Forbidden",
+						headers: [["content-type", "text/plain; charset=utf-8"]],
+						body: Buffer.from("This port has not been authorized in AgentLink settings.").toString("base64")
+					});
+					return;
+				}
+				if (portProxyBaseUrl !== void 0 && !isPortProxyMethodAllowed(requestFrame.method)) {
+					sendEncrypted({
+						_tag: "HttpResponse",
+						id: requestFrame.id,
+						status: 405,
+						statusText: "Method Not Allowed",
+						headers: [["content-type", "text/plain; charset=utf-8"]],
+						body: Buffer.from("Unsupported port proxy method.").toString("base64")
+					});
+					return;
+				}
 				runFork(gen(function* () {
-					const targetUrl = `${localBaseUrl}${requestFrame.path}`;
-					const headers = { authorization: `Bearer ${issued.token}` };
+					const targetUrl = `${portProxyBaseUrl ?? daemonBaseUrl}${requestFrame.path}`;
+					const headers = requestFrame.targetPort === void 0 ? { authorization: `Bearer ${issued.token}` } : {};
 					for (const [key, value] of requestFrame.headers) {
 						const lower = key.toLowerCase();
-						if (lower === "authorization" || lower === "cookie") continue;
+						if (requestFrame.targetPort === void 0 ? lower === "authorization" || lower === "cookie" : !isPortProxyRequestHeaderAllowed(lower)) continue;
 						headers[lower] = value;
 					}
 					let request = make$65(requestFrame.method)(targetUrl).pipe(setHeaders(headers));
@@ -53509,7 +53619,7 @@ const runHubTunnel = (config) => gen(function* () {
 					const response = yield* httpClient.execute(request);
 					const responseBody = yield* response.arrayBuffer;
 					const responseHeaders = [];
-					for (const [key, value] of Object.entries(response.headers)) if (typeof value === "string") responseHeaders.push([key, value]);
+					for (const [key, value] of Object.entries(response.headers)) if (typeof value === "string" && (requestFrame.targetPort === void 0 || isPortProxyResponseHeaderAllowed(key))) responseHeaders.push([key, value]);
 					return {
 						_tag: "HttpResponse",
 						id: requestFrame.id,
@@ -60178,7 +60288,7 @@ const CodexAppServerSchemaIssueKind = Literals([
 	"Forbidden",
 	"OneOf"
 ]);
-const schemaIssueDiagnostics$1 = (root) => {
+const schemaIssueDiagnostics$2 = (root) => {
 	let issueCount = 0;
 	let maximumPathDepth = 0;
 	const issueKinds = /* @__PURE__ */ new Set();
@@ -60283,7 +60393,7 @@ var CodexAppServerProtocolParseError = class CodexAppServerProtocolParseError ex
 		return new CodexAppServerProtocolParseError({
 			operation,
 			...context,
-			...schemaIssueDiagnostics$1(cause.issue),
+			...schemaIssueDiagnostics$2(cause.issue),
 			cause
 		});
 	}
@@ -60401,7 +60511,7 @@ var CodexAppServerRequestError = class CodexAppServerRequestError extends Tagged
 		});
 	}
 	static invalidPayload(method, operation, cause) {
-		const diagnostics = schemaIssueDiagnostics$1(cause.issue);
+		const diagnostics = schemaIssueDiagnostics$2(cause.issue);
 		return new CodexAppServerRequestError({
 			code: -32602,
 			errorMessage: `Invalid payload for method '${method}' during '${operation}'`,
@@ -84374,7 +84484,7 @@ const AcpSchemaIssueKind = Literals([
 	"Forbidden",
 	"OneOf"
 ]);
-const schemaIssueDiagnostics = (root) => {
+const schemaIssueDiagnostics$1 = (root) => {
 	let issueCount = 0;
 	let maximumPathDepth = 0;
 	const issueKinds = /* @__PURE__ */ new Set();
@@ -84423,7 +84533,8 @@ var AcpProcessExitedError = class extends TaggedErrorClass()("AcpProcessExitedEr
 const AcpProtocolParseOperation = Literals([
 	"encode-message",
 	"decode-wire-message",
-	"decode-notification-payload"
+	"decode-notification-payload",
+	"decode-rpc-result"
 ]);
 var AcpProtocolParseError = class AcpProtocolParseError extends TaggedErrorClass()("AcpProtocolParseError", {
 	operation: AcpProtocolParseOperation,
@@ -84442,7 +84553,7 @@ var AcpProtocolParseError = class AcpProtocolParseError extends TaggedErrorClass
 		return new AcpProtocolParseError({
 			operation,
 			method,
-			...schemaIssueDiagnostics(cause.issue),
+			...schemaIssueDiagnostics$1(cause.issue),
 			cause
 		});
 	}
@@ -84569,7 +84680,7 @@ var AcpRequestError = class AcpRequestError extends TaggedErrorClass()("AcpReque
 		});
 	}
 	static invalidExtensionPayload(method, cause) {
-		const diagnostics = schemaIssueDiagnostics(cause.issue);
+		const diagnostics = schemaIssueDiagnostics$1(cause.issue);
 		return new AcpRequestError({
 			code: -32602,
 			errorMessage: `Invalid payload for ACP extension method '${method}'.`,
@@ -84655,6 +84766,65 @@ const isAcpError = is(AcpError);
 const decodeSessionUpdate = decodeUnknownEffect(SessionNotification);
 const decodeElicitationComplete = decodeUnknownEffect(ElicitationCompleteNotification);
 const parserFactory = ndJsonRpc();
+const canonicalStopReasons$1 = /* @__PURE__ */ new Set([
+	"end_turn",
+	"max_tokens",
+	"max_turn_requests",
+	"refusal",
+	"cancelled"
+]);
+const structuralName = (value) => value.length <= 128 && /^[A-Za-z][A-Za-z0-9._:/-]*$/.test(value) ? value : "unknown";
+const valueType = (value) => value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
+const boundedFieldNames = (value) => Object.keys(value).slice(0, 16).map(structuralName);
+const safeWireDiagnostics = (data) => {
+	const lines = (typeof data === "string" ? data : new TextDecoder().decode(data)).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+	if (lines.length === 0 || lines.length > 16) return { jsonSyntaxValid: false };
+	let decoded;
+	try {
+		decoded = lines.map((line) => JSON.parse(line));
+	} catch {
+		return { jsonSyntaxValid: false };
+	}
+	const candidate = decoded.at(-1);
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) return {
+		jsonSyntaxValid: true,
+		frameCount: decoded.length,
+		topLevelType: valueType(candidate)
+	};
+	const frame = candidate;
+	const result = frame.result !== null && typeof frame.result === "object" && !Array.isArray(frame.result) ? frame.result : void 0;
+	const stopReason = result?.stopReason;
+	return {
+		jsonSyntaxValid: true,
+		frameCount: decoded.length,
+		topLevelFields: boundedFieldNames(frame),
+		...Object.hasOwn(frame, "jsonrpc") ? { jsonrpcType: valueType(frame.jsonrpc) } : {},
+		...Object.hasOwn(frame, "id") ? { idType: valueType(frame.id) } : {},
+		...typeof frame.method === "string" ? { method: structuralName(frame.method) } : {},
+		...result ? { resultFields: boundedFieldNames(result) } : {},
+		...result && Object.hasOwn(result, "stopReason") ? {
+			stopReasonType: valueType(stopReason),
+			...typeof stopReason === "string" && canonicalStopReasons$1.has(stopReason) ? { canonicalStopReason: stopReason } : {}
+		} : {}
+	};
+};
+const safeTerminationDiagnostics = (error) => {
+	const record = error;
+	return {
+		errorTag: error._tag,
+		...typeof record.operation === "string" ? { operation: structuralName(record.operation) } : {},
+		...typeof record.method === "string" ? { method: structuralName(record.method) } : {},
+		...Object.hasOwn(record, "requestId") ? {
+			requestIdType: valueType(record.requestId),
+			requestId: "redacted"
+		} : {},
+		...typeof record.issueCount === "number" ? { issueCount: Math.min(Math.max(0, record.issueCount), 1e4) } : {},
+		...Array.isArray(record.issueKinds) ? { issueKinds: record.issueKinds.slice(0, 16).map((kind) => structuralName(String(kind))) } : {},
+		...typeof record.maximumPathDepth === "number" ? { maximumPathDepth: Math.min(Math.max(0, record.maximumPathDepth), 1e3) } : {},
+		...typeof record.pid === "number" ? { pid: record.pid } : {},
+		...typeof record.code === "number" ? { exitCode: record.code } : {}
+	};
+};
 const makeAcpPatchedProtocol = fn("makeAcpPatchedProtocol")(function* (options) {
 	const parser = parserFactory.makeUnsafe();
 	const serverQueue = yield* unbounded$2();
@@ -84724,6 +84894,11 @@ const makeAcpPatchedProtocol = fn("makeAcpPatchedProtocol")(function* (options)
 			yield* offer$1(disconnects, 0);
 			const error = yield* classify();
 			if (!error) return;
+			yield* logProtocol({
+				direction: "incoming",
+				stage: "terminated",
+				payload: safeTerminationDiagnostics(error)
+			});
 			yield* failAllExtPending(error);
 			yield* emitClientProtocolError(error);
 			if (options.onTermination) yield* options.onTermination(error);
@@ -84823,18 +84998,22 @@ const makeAcpPatchedProtocol = fn("makeAcpPatchedProtocol")(function* (options)
 		direction: "incoming",
 		stage: "decoded",
 		payload: messages
-	})), tapErrorTag("AcpProtocolParseError", (error) => logProtocol({
+	})), flatMap$1((messages) => forEach(messages, routeDecodedMessage, { discard: true })), tapErrorTag("AcpProtocolParseError", (error) => logProtocol({
 		direction: "incoming",
 		stage: "decode_failed",
 		payload: {
 			operation: error.operation,
+			...error.operation === "decode-wire-message" ? safeWireDiagnostics(data) : {},
 			...error.method === void 0 ? {} : { method: error.method },
-			...error.requestId === void 0 ? {} : { requestId: error.requestId },
+			...error.requestId === void 0 ? {} : {
+				requestIdType: valueType(error.requestId),
+				requestId: "redacted"
+			},
 			...error.issueCount === void 0 ? {} : { issueCount: error.issueCount },
 			...error.issueKinds === void 0 ? {} : { issueKinds: error.issueKinds },
 			...error.maximumPathDepth === void 0 ? {} : { maximumPathDepth: error.maximumPathDepth }
 		}
-	})), flatMap$1((messages) => forEach(messages, routeDecodedMessage, { discard: true })))), matchEffect({
+	})))), matchEffect({
 		onFailure: (error) => {
 			const normalized = isAcpError(error) ? error : new AcpTransportError({
 				operation: "read-input-stream",
@@ -85028,7 +85207,7 @@ const ClientRpcs = make$51(ReadTextFileRpc, WriteTextFileRpc, RequestPermissionR
 //#endregion
 //#region ../effect-acp/src/_internal/shared.ts
 const isError = is(Error$1);
-const callRpc = (method, effect) => effect.pipe(catchIf(isError, (error) => fail(AcpRequestError.fromProtocolError(error, { method }))), catchTags({ RpcClientError: (cause) => fail(new AcpTransportError({
+const callRpc = (method, effect) => effect.pipe(catchDefect((defect) => isSchemaError(defect) ? fail(AcpProtocolParseError.fromSchemaError("decode-rpc-result", method, defect)) : die(defect)), catchIf(isError, (error) => fail(AcpRequestError.fromProtocolError(error, { method }))), catchTags({ RpcClientError: (cause) => fail(new AcpTransportError({
 	operation: "call-rpc",
 	method,
 	cause
@@ -85388,7 +85567,7 @@ const registerLocalToolHandlers = (input) => gen(function* () {
 });
 //#endregion
 //#region ../t3-shared/src/toolActivity.ts
-function asRecord(value) {
+function asRecord$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function asTrimmedString(value) {
@@ -85418,10 +85597,10 @@ function extractCommandFromTitle$1(title) {
 	return /`([^`]+)`/u.exec(title)?.[1]?.trim() || void 0;
 }
 function extractToolCommand(data, title) {
-	const item = asRecord(data?.item);
-	const itemInput = asRecord(item?.input);
-	const itemResult = asRecord(item?.result);
-	const rawInput = asRecord(data?.rawInput);
+	const item = asRecord$1(data?.item);
+	const itemInput = asRecord$1(item?.input);
+	const itemResult = asRecord$1(item?.result);
+	const rawInput = asRecord$1(data?.rawInput);
 	const direct = [
 		normalizeCommandValue$1(item?.command),
 		normalizeCommandValue$1(itemInput?.command),
@@ -85449,7 +85628,7 @@ function collectPaths(value, paths, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord(value);
+	const record = asRecord$1(value);
 	if (!record) return;
 	for (const key of [
 		"path",
@@ -85508,7 +85687,7 @@ function deriveToolActivityPresentation(input) {
 	const title = asTrimmedString(input.title);
 	const detail = stripTrailingExitCode(asTrimmedString(input.detail));
 	const fallbackSummary = asTrimmedString(input.fallbackSummary) ?? "Tool";
-	const data = asRecord(input.data);
+	const data = asRecord$1(input.data);
 	const command = extractToolCommand(data, title);
 	const primaryPath = extractPrimaryPath(data);
 	const action = classifyToolAction({
@@ -85532,7 +85711,7 @@ function deriveToolActivityPresentation(input) {
 		...primaryPath ? { detail: primaryPath } : {}
 	};
 	if (action === "search") {
-		const query = asTrimmedString(asRecord(data?.rawInput)?.query) ?? asTrimmedString(asRecord(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord(data?.rawInput)?.searchTerm);
+		const query = asTrimmedString(asRecord$1(data?.rawInput)?.query) ?? asTrimmedString(asRecord$1(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord$1(data?.rawInput)?.searchTerm);
 		return {
 			summary: "Searched files",
 			...query ? { detail: query } : {}
@@ -85841,6 +86020,20 @@ function parseSessionUpdateEvent(params) {
 function formatConfigOptionValue(value) {
 	return JSON.stringify(value);
 }
+function safeProcessCommand(command) {
+	const basename = command.split(/[\\/]/).at(-1) ?? "unknown";
+	return basename.length <= 128 && /^[A-Za-z0-9._-]+$/.test(basename) ? basename : "unknown";
+}
+function safeArgumentKind(argument) {
+	return argument.startsWith("-") ? "flag" : "positional";
+}
+function safeErrorTag(error) {
+	if (error !== null && typeof error === "object" && "_tag" in error) {
+		const tag = error._tag;
+		if (typeof tag === "string" && /^[A-Za-z][A-Za-z0-9._-]*$/.test(tag)) return tag;
+	}
+	return "unknown";
+}
 const defaultSessionLoadTimeout = seconds(90);
 const defaultSessionLoadReplayIdleGap = seconds(2);
 var AcpSessionRuntime = class extends Service$2()("t3/provider/acp/AcpSessionRuntime") {};
@@ -85892,6 +86085,38 @@ const make$4 = (options) => gen(function* () {
 		command: options.spawn.command,
 		cause
 	})));
+	const logProcessEvent = (stage, payload) => options.protocolLogging?.logger?.({
+		direction: "incoming",
+		stage,
+		payload
+	}) ?? void_$1;
+	yield* logProcessEvent("process_spawned", {
+		command: safeProcessCommand(spawnCommand.command),
+		argumentCount: Math.min(spawnCommand.args.length, 1e3),
+		argumentKinds: spawnCommand.args.slice(0, 32).map(safeArgumentKind),
+		pid: child.pid
+	});
+	yield* child.stderr.pipe(runForEach((chunk) => {
+		const text = new TextDecoder().decode(chunk);
+		return logProcessEvent("process_stderr", {
+			pid: child.pid,
+			byteLength: chunk.byteLength,
+			lineBreakCount: Math.min(text.match(/\n/g)?.length ?? 0, 1e4)
+		});
+	}), catch_((error) => logProcessEvent("process_stderr", {
+		pid: child.pid,
+		errorTag: safeErrorTag(error)
+	})), forkIn(runtimeScope));
+	yield* child.exitCode.pipe(matchEffect({
+		onFailure: (error) => logProcessEvent("process_exited", {
+			pid: child.pid,
+			errorTag: safeErrorTag(error)
+		}),
+		onSuccess: (exitCode) => logProcessEvent("process_exited", {
+			pid: child.pid,
+			exitCode
+		})
+	}), forkIn(runtimeScope));
 	const acpContext = yield* build(layerChildProcess(child, {
 		...options.protocolLogging?.logIncoming !== void 0 ? { logIncoming: options.protocolLogging.logIncoming } : {},
 		...options.protocolLogging?.logOutgoing !== void 0 ? { logOutgoing: options.protocolLogging.logOutgoing } : {},
@@ -86642,6 +86867,13 @@ function makeAcpContentDeltaEvent(input) {
 }
 //#endregion
 //#region src/provider/acp/AcpNativeLogging.ts
+const canonicalStopReasons = /* @__PURE__ */ new Set([
+	"end_turn",
+	"max_tokens",
+	"max_turn_requests",
+	"refusal",
+	"cancelled"
+]);
 function structuralMethod(value) {
 	return value.length <= 128 && /^[A-Za-z][A-Za-z0-9._:/-]*$/.test(value) ? value : "unknown";
 }
@@ -86672,7 +86904,127 @@ function summarizePayload(payload) {
 		return { valueType: "object" };
 	}
 }
+function boundedNumber(value, maximum) {
+	return typeof value === "number" && Number.isFinite(value) ? Math.min(Math.max(0, value), maximum) : void 0;
+}
+function structuralNames(value) {
+	return Array.isArray(value) ? value.slice(0, 16).map((item) => typeof item === "string" ? structuralMethod(item) : "unknown") : void 0;
+}
+function schemaIssueDiagnostics(root) {
+	let issueCount = 0;
+	let maximumPathDepth = 0;
+	const issueKinds = /* @__PURE__ */ new Set();
+	const visit = (issue, pathDepth) => {
+		if (issueCount >= 1e4) return;
+		issueCount += 1;
+		issueKinds.add(structuralMethod(issue._tag));
+		maximumPathDepth = Math.max(maximumPathDepth, pathDepth);
+		switch (issue._tag) {
+			case "Filter":
+			case "Encoding":
+				visit(issue.issue, pathDepth);
+				break;
+			case "Pointer":
+				visit(issue.issue, Math.min(pathDepth + issue.path.length, 1e3));
+				break;
+			case "Composite":
+			case "AnyOf":
+				for (const child of issue.issues.slice(0, 1e3)) visit(child, pathDepth);
+				break;
+		}
+	};
+	visit(root, 0);
+	return {
+		issueCount,
+		issueKinds: [...issueKinds].slice(0, 16),
+		maximumPathDepth
+	};
+}
+function asRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function summarizeRequestCause(cause) {
+	for (const reason of cause.reasons) {
+		if (reason._tag !== "Fail") continue;
+		const failure = asRecord(reason.error);
+		if (failure?._tag === "AcpProtocolParseError" && failure.operation === "decode-rpc-result") {
+			const issueCount = boundedNumber(failure.issueCount, 1e4);
+			const issueKinds = structuralNames(failure.issueKinds);
+			const maximumPathDepth = boundedNumber(failure.maximumPathDepth, 1e3);
+			return {
+				failureKind: "rpc-result-decode",
+				causeTags: ["AcpProtocolParseError", "SchemaError"],
+				...issueCount === void 0 ? {} : { issueCount },
+				...issueKinds ? { issueKinds } : {},
+				...maximumPathDepth === void 0 ? {} : { maximumPathDepth }
+			};
+		}
+		const transport = failure;
+		if (transport?._tag !== "AcpTransportError" || transport.operation !== "call-rpc") continue;
+		const rpcClient = asRecord(transport.cause);
+		if (rpcClient?._tag !== "RpcClientError") continue;
+		const rpcDefect = asRecord(rpcClient.reason);
+		if (rpcDefect?._tag !== "RpcClientDefect" || !isSchemaError(rpcDefect.cause)) continue;
+		return {
+			failureKind: "rpc-result-decode",
+			causeTags: [
+				"AcpTransportError",
+				"RpcClientError",
+				"RpcClientDefect",
+				"SchemaError"
+			],
+			...schemaIssueDiagnostics(rpcDefect.cause.issue)
+		};
+	}
+}
+function summarizeProtocolDiagnostics(payload) {
+	if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return summarizePayload(payload);
+	const record = payload;
+	const requestIdType = typeof record.requestIdType === "string" ? structuralMethod(record.requestIdType) : Object.hasOwn(record, "requestId") ? record.requestId === null ? "null" : Array.isArray(record.requestId) ? "array" : typeof record.requestId : void 0;
+	const issueCount = boundedNumber(record.issueCount, 1e4);
+	const maximumPathDepth = boundedNumber(record.maximumPathDepth, 1e3);
+	const frameCount = boundedNumber(record.frameCount, 16);
+	const pid = boundedNumber(record.pid, Number.MAX_SAFE_INTEGER);
+	const exitCode = boundedNumber(record.exitCode, 255);
+	const byteLength = boundedNumber(record.byteLength, Number.MAX_SAFE_INTEGER);
+	const lineBreakCount = boundedNumber(record.lineBreakCount, 1e4);
+	const argumentCount = boundedNumber(record.argumentCount, 1e3);
+	const argumentKinds = structuralNames(record.argumentKinds);
+	const issueKinds = structuralNames(record.issueKinds);
+	const topLevelFields = structuralNames(record.topLevelFields);
+	const resultFields = structuralNames(record.resultFields);
+	return {
+		valueType: "object",
+		...typeof record.errorTag === "string" ? { errorTag: structuralMethod(record.errorTag) } : {},
+		...typeof record.command === "string" ? { command: structuralMethod(record.command) } : {},
+		...argumentCount === void 0 ? {} : { argumentCount },
+		...argumentKinds ? { argumentKinds } : {},
+		...typeof record.operation === "string" ? { operation: structuralMethod(record.operation) } : {},
+		...typeof record.method === "string" ? { method: structuralMethod(record.method) } : {},
+		...requestIdType ? {
+			requestIdType,
+			requestId: "redacted"
+		} : {},
+		...issueCount === void 0 ? {} : { issueCount },
+		...issueKinds ? { issueKinds } : {},
+		...maximumPathDepth === void 0 ? {} : { maximumPathDepth },
+		...typeof record.jsonSyntaxValid === "boolean" ? { jsonSyntaxValid: record.jsonSyntaxValid } : {},
+		...frameCount === void 0 ? {} : { frameCount },
+		...typeof record.topLevelType === "string" ? { topLevelType: structuralMethod(record.topLevelType) } : {},
+		...topLevelFields ? { topLevelFields } : {},
+		...typeof record.jsonrpcType === "string" ? { jsonrpcType: structuralMethod(record.jsonrpcType) } : {},
+		...typeof record.idType === "string" ? { idType: structuralMethod(record.idType) } : {},
+		...resultFields ? { resultFields } : {},
+		...typeof record.stopReasonType === "string" ? { stopReasonType: structuralMethod(record.stopReasonType) } : {},
+		...typeof record.canonicalStopReason === "string" && canonicalStopReasons.has(record.canonicalStopReason) ? { canonicalStopReason: record.canonicalStopReason } : {},
+		...pid === void 0 ? {} : { pid },
+		...exitCode === void 0 ? {} : { exitCode },
+		...byteLength === void 0 ? {} : { byteLength },
+		...lineBreakCount === void 0 ? {} : { lineBreakCount }
+	};
+}
 function formatRequestLogPayload(event) {
+	const causeDiagnostics = event.cause ? summarizeRequestCause(event.cause) : void 0;
 	return {
 		method: structuralMethod(event.method),
 		status: event.status,
@@ -86680,7 +87032,8 @@ function formatRequestLogPayload(event) {
 		...event.result !== void 0 ? { result: summarizePayload(event.result) } : {},
 		...event.cause !== void 0 ? {
 			errorTag: causeErrorTag(event.cause),
-			reasonCount: event.cause.reasons.length
+			reasonCount: event.cause.reasons.length,
+			...causeDiagnostics ?? {}
 		} : {}
 	};
 }
@@ -86688,7 +87041,7 @@ function formatProtocolLogPayload(event) {
 	return {
 		direction: event.direction,
 		stage: event.stage,
-		payload: summarizePayload(event.payload)
+		payload: event.stage === "decode_failed" || event.stage === "terminated" || event.stage === "process_spawned" || event.stage === "process_stderr" || event.stage === "process_exited" ? summarizeProtocolDiagnostics(event.payload) : summarizePayload(event.payload)
 	};
 }
 const makeAcpNativeLoggerFactory = fn("makeAcpNativeLoggerFactory")(function* () {