cdk-local 0.147.13 → 0.147.15

package/dist/{local-studio-5iIuMtjd.js → local-studio-BJxBmC75.js}

@@ -322,13 +322,15 @@ function buildStsClientConfig(args) {
 *
 * # What this does NOT close
 *
-* A single-LINE forged string still reaches readers other than a human.
-* `cdkl studio` matches every serve-child stdout line against an unanchored
-* ready-line regex and proxies to the URL it captures, so a message
-* containing `Server listening on http://...` can redirect the studio proxy.
-* That is not fixed here — the sanitizer bounds the line, it does not stop a
-* machine from reading it — and it predates this change (an ordinary handler
-* log line trips the same matcher). Tracked in issue #578.
+* A single-LINE forged string still reaches readers other than a human. It no
+* longer redirects the studio capture proxy: issue #578 anchored every
+* `cdkl studio` ready pattern to the start of the line, made the serve manager
+* skip a line carrying cdk-local's own `WARN: ` / `ERROR: ` decoration
+* outright, and bounded the resolved upstream to loopback — so a message
+* containing `Server listening on http://...` is neither read as a banner nor
+* usable as a destination. What remains is the reader this sanitizer was
+* always aimed at: a HUMAN scanning the log, for whom a forged-looking line is
+* still misleading text, which is why the flattening + capping stay.
 */
 /**
 * Longest service-exception message relayed into a `warn` line, in
@@ -5160,16 +5162,25 @@ async function fetchAllExports(client) {
 * S3-bucket-specific (it rewrites the synthetic `Unknown`/`UnknownError`
 * with bucket / region context), so the CFn provider extracts the
 * pieces directly here.
+*
+* Issue #578 — the result is FLATTENED TO ONE LINE via
+* {@link flattenToOneLine}, the same helper `credential-error` applies to
+* every other wire-derived value that lands on a log line, rather than a
+* second spelling of it. Both `err.name` and `err.message` come off the wire,
+* and this warn is relayed onto a `cdkl studio` serve child's stdout, where
+* `studio-serve-manager` splits on `\n`: an embedded newline puts line 2 on
+* the stream with no `WARN: ` prefix, so it clears the diagnostic bound and
+* matches a ready pattern at `^`. One line in, one line out.
 */
 function formatAwsErrorForWarn(err) {
-	if (!(err instanceof Error)) return String(err);
+	if (!(err instanceof Error)) return flattenToOneLine(String(err));
 	const name = err.name && err.name !== "Error" ? err.name : void 0;
 	const status = err.$metadata?.httpStatusCode;
 	const prefixParts = [];
 	if (name !== void 0) prefixParts.push(name);
 	if (status !== void 0) prefixParts.push(`HTTP ${status}`);
-	if (prefixParts.length === 0) return err.message;
-	return `${prefixParts.join(" ")}: ${err.message}`;
+	if (prefixParts.length === 0) return flattenToOneLine(err.message);
+	return flattenToOneLine(`${prefixParts.join(" ")}: ${err.message}`);
 }
 
 //#endregion
@@ -36990,6 +37001,154 @@ async function relayServeRequest(input, fetchFn = fetch, clock = Date.now) {
 //#region src/local/studio-proxy.ts
 let proxyIdCounter = 0;
 /**
+* True when `hostname` names this machine's loopback interface: `localhost`,
+* an IPv4 address in `127.0.0.0/8`, IPv6 `::1`, or an IPv4-mapped loopback
+* (`::ffff:127.0.0.1`, which `URL.hostname` renders in hex as
+* `[::ffff:7f00:1]`). Surrounding brackets, as `URL.hostname` keeps them for
+* an IPv6 literal, are tolerated. The match is EXACT — `localhost.example.com`
+* and `127.0.0.1.example.com` are ordinary DNS names that resolve wherever
+* their owner points them, and are NOT loopback.
+*
+* A `cdkl` serve child always listens on this machine, so this is the bound
+* studio puts on where it will ever forward a composer request (issue #578).
+* A destination that is not loopback did not come from a genuine serve, and
+* forwarding to it would carry the developer's request — headers and body —
+* off-box.
+*/
+function isLoopbackHostname(hostname) {
+	const h = hostname.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
+	if (h === "localhost") return true;
+	if (h === "::1" || h === "0:0:0:0:0:0:0:1") return true;
+	const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(h);
+	if (mapped) return parseInt(mapped[1], 16) >> 8 === 127;
+	const dotted = /^(?:::ffff:)?(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
+	if (!dotted) return false;
+	const octets = dotted.slice(1).map(Number);
+	if (octets.some((o) => o > 255)) return false;
+	return octets[0] === 127;
+}
+/**
+* Drop the brackets `URL.hostname` keeps around an IPv6 literal (`[::1]`), so
+* the host can be handed to `node:http` / `node:net`.
+*
+* Those two disagree with `URL` about the spelling: `http.request({ host:
+* '[::1]' })` fails with `ENOTFOUND` (it is looked up as a NAME), while `'::1'`
+* connects. {@link isLoopbackHostname} already tolerates the bracketed form —
+* so `--host ::1` on a serve child yields an upstream this proxy ACCEPTS and
+* then 502s every request through, which is the worst of the three outcomes.
+* Bracket-stripping is safe for every other spelling: a dotted IPv4, a name
+* and a bare hextet form carry no brackets to remove.
+*/
+function stripHostBrackets(hostname) {
+	return hostname.replace(/^\[/, "").replace(/\]$/, "");
+}
+/**
+* True when `hostname` is the UNSPECIFIED (wildcard) address: IPv4 `0.0.0.0`,
+* IPv6 `::` (`URL` normalises `0:0:0:0:0:0:0:0` to it), or the IPv4-mapped
+* `::ffff:0.0.0.0` (which `URL.hostname` renders as `[::ffff:0:0]`).
+*
+* A wildcard is a BIND address, not a destination — a server bound to it IS
+* reachable on loopback, and `--container-host 0.0.0.0` is an ordinary value
+* for `start-service` / `run-task` (default `127.0.0.1`) that `cdkl studio`
+* auto-renders in its "All options" section. So a wildcard is normalised to
+* loopback rather than refused; the security property is untouched, because a
+* line naming a real foreign host still names a real foreign host, and no
+* spelling of the wildcard reaches anywhere but this machine.
+*/
+function isWildcardHostname(hostname) {
+	const h = hostname.trim().replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
+	return h === "0.0.0.0" || h === "::" || h === "0:0:0:0:0:0:0:0" || h === "::ffff:0.0.0.0" || h === "::ffff:0:0";
+}
+/**
+* Rewrite the HOST TOKEN of a wildcard-bound URL to `127.0.0.1`, leaving
+* scheme, userinfo, port, path, query and fragment byte-for-byte (rather than
+* re-serialising the `URL`, which would append a `/` the child never printed).
+*
+* This is string surgery over an authority the WHATWG parser has ALREADY
+* accepted, and the two parsers do not agree on where the authority ends —
+* `\` terminates it for the parser and not for the `[/?#]` scan here, and any
+* future terminator will diverge the same way. So this is deliberately NOT the
+* decision-maker: {@link normalizeLocalUpstream} re-parses whatever comes back
+* and refuses it unless the RESULT is loopback. Returning a wrong string here
+* costs a refusal, never a foreign destination.
+*/
+function rewriteWildcardHostToken(upstream) {
+	const schemeEnd = upstream.indexOf("://");
+	if (schemeEnd === -1) return void 0;
+	const head = upstream.slice(0, schemeEnd + 3);
+	const rest = upstream.slice(schemeEnd + 3);
+	const cut = rest.search(/[/?#]/);
+	const authority = cut === -1 ? rest : rest.slice(0, cut);
+	const tail = cut === -1 ? "" : rest.slice(cut);
+	const at = authority.lastIndexOf("@");
+	const userinfo = at === -1 ? "" : authority.slice(0, at + 1);
+	const hostPort = at === -1 ? authority : authority.slice(at + 1);
+	const portAt = hostPort.startsWith("[") ? hostPort.indexOf("]") + 1 : hostPort.indexOf(":");
+	return `${head}${userinfo}127.0.0.1${portAt > 0 ? hostPort.slice(portAt) : ""}${tail}`;
+}
+/**
+* Resolve an upstream URL a serve child named into the URL studio may
+* actually use, or `undefined` when it must be refused (issue #578).
+*
+* A wildcard host is REWRITTEN to `127.0.0.1` (see
+* {@link isWildcardHostname}) and the rewritten URL is what gets adopted as
+* the endpoint and handed to the proxy, so the destination really is
+* loopback rather than merely tolerated. Everything else must already be
+* loopback; a foreign host or an unparseable URL resolves to `undefined`.
+*
+* # The answer is CHECKED, not asserted
+*
+* Whatever string this is about to return — the input verbatim, or the
+* host-token rewrite of {@link rewriteWildcardHostToken} — is re-parsed with
+* `new URL` and its `hostname` must satisfy {@link isLoopbackHostname}. That
+* single post-condition is the whole guarantee, and it is stated over the
+* VALUE HANDED BACK rather than over the value inspected on the way in, so it
+* cannot be outrun by a spelling nobody enumerated.
+*
+* It has to be, because the string surgery and the URL parser disagree about
+* where an authority ends. `http://0.0.0.0\@attacker.example/` parses to host
+* `0.0.0.0` (WHATWG treats `\` as an authority terminator) but the `[/?#]`
+* scan reads `0.0.0.0\@attacker.example` as one authority, so the rewrite
+* lands on the wrong token and produces `http://0.0.0.0\@127.0.0.1/` — which
+* re-parses to host `0.0.0.0`, NOT loopback, and is refused here. Adding `\`
+* to the cut set would close exactly that spelling and leave the next one
+* open; the post-condition closes the shape.
+*
+* Userinfo rides through byte-for-byte on the accepted path
+* (`http://tok@0.0.0.0:51234/` -> `http://tok@127.0.0.1:51234/`) — verified,
+* not assumed, since the post-condition now proves the destination that
+* string actually names.
+*/
+function normalizeLocalUpstream(upstream) {
+	let parsed;
+	try {
+		parsed = new URL(upstream);
+	} catch {
+		return;
+	}
+	const candidate = isWildcardHostname(parsed.hostname) ? rewriteWildcardHostToken(upstream) : upstream;
+	if (candidate === void 0) return void 0;
+	let confirmed;
+	try {
+		confirmed = new URL(candidate);
+	} catch {
+		return;
+	}
+	return isLoopbackHostname(confirmed.hostname) ? candidate : void 0;
+}
+/**
+* Render an UNTRUSTED endpoint string for a human-readable message. The
+* string reached studio from a child's stdout, so it can carry control
+* characters (ANSI escapes, a bare CR) that would forge extra output, and it
+* can be arbitrarily long. Non-printable-ASCII bytes become `?` and the result
+* is length-capped, the same shape `credential-error` applies to a relayed
+* service message.
+*/
+function describeEndpointForMessage(value) {
+	const flat = value.replace(/[^\x20-\x7e]/g, "?");
+	return flat.length > 120 ? `${flat.slice(0, 120)}...` : flat;
+}
+/**
 * Start a capturing reverse proxy in front of a studio serve target
 * (decision D4a: because every request to the served port flows through
 * `cdkl studio`, the timeline observes them regardless of source —
@@ -37006,6 +37165,12 @@ let proxyIdCounter = 0;
 * Studio is a control plane over the CLI, so this proxy sits in front of
 * the long-running `cdkl start-api` child the serve manager spawned; it
 * does NOT re-implement any routing — it forwards verbatim.
+*
+* Throws SYNCHRONOUSLY (rather than rejecting) when `upstream` is unparseable
+* or names a non-loopback host (issue #578) — a refusal to attempt the proxy
+* at all, rather than a runtime failure of one. A wildcard bind address
+* (`0.0.0.0` / `::`) is not a refusal: it is rewritten to `127.0.0.1` and
+* forwarded there ({@link normalizeLocalUpstream}).
 */
 function startStudioProxy(config) {
 	const host = config.host ?? "127.0.0.1";
@@ -37015,8 +37180,10 @@ function startStudioProxy(config) {
 		proxyIdCounter += 1;
 		return `req-${clock()}-${proxyIdCounter}`;
 	});
-	const upstreamUrl = new URL(config.upstream);
-	const upstreamHost = upstreamUrl.hostname;
+	const resolvedUpstream = normalizeLocalUpstream(config.upstream);
+	if (resolvedUpstream === void 0) throw new Error(`studio proxy refuses the non-loopback upstream '${describeEndpointForMessage(config.upstream)}': a serve child always listens on this machine, so a request forwarded there would leave it.`);
+	const upstreamUrl = new URL(resolvedUpstream);
+	const upstreamHost = stripHostBrackets(upstreamUrl.hostname);
 	const upstreamPort = Number(upstreamUrl.port) || 80;
 	const server = createServer$1((clientReq, clientRes) => {
 		const id = idFactory();
@@ -37198,25 +37365,27 @@ const SERVE_SPECS = {
 			"--host",
 			"127.0.0.1"
 		],
-		readyRe: /Server listening on (\S+)/,
-		capturesHttp: true
+		readyRe: /^Server listening on (\S+)/,
+		capturesHttp: true,
+		readyRepeats: true
 	},
 	alb: {
 		command: "start-alb",
 		portArgs: [],
-		readyRe: /ALB front-door: (https?:\/\/\S+)/,
-		capturesHttp: true
+		readyRe: /^ALB front-door: (https?:\/\/\S+)/,
+		capturesHttp: true,
+		readyRepeats: true
 	},
 	ecs: {
 		command: "start-service",
 		portArgs: [],
-		readyRe: /Service\(s\) running:/,
+		readyRe: /^Service\(s\) running:/,
 		capturesHttp: false
 	},
 	"ecs-task": {
 		command: "run-task",
 		portArgs: [],
-		readyRe: /Task running \(family=/,
+		readyRe: /^Task running \(family=/,
 		capturesHttp: false
 	},
 	cloudfront: {
@@ -37227,7 +37396,7 @@ const SERVE_SPECS = {
 			"--host",
 			"127.0.0.1"
 		],
-		readyRe: /CloudFront distribution serving on (https?:\/\/\S+)/,
+		readyRe: /^CloudFront distribution serving on (https?:\/\/\S+)/,
 		capturesHttp: true
 	},
 	"agentcore-ws": {
@@ -37238,27 +37407,119 @@ const SERVE_SPECS = {
 			"--host",
 			"127.0.0.1"
 		],
-		readyRe: /Server listening on (\S+)/,
+		readyRe: /^Server listening on (\S+)/,
 		capturesHttp: true,
-		extraEndpointRe: /HTTP contract served on (https?:\/\/\S+)/
+		extraEndpointRe: /^HTTP contract served on (https?:\/\/\S+)/
 	}
 };
 /**
 * Parse an auto-published replica host endpoint from an `ecs` serve child's
 * stdout (issue #392). `start-service` publishes each replica's declared
 * container port on the host — auto-remapping a privileged port (< 1024) to a
-* free high port (issue #357) — and logs a line like
-* `... container port 80 published on 127.0.0.1:54321. Reach it at ...`. studio
-* surfaces the FIRST such endpoint as the serve's `hostUrl` so the in-workspace
-* request composer can target it even when the user passed no explicit
-* `--host-port`. Returns `http://<ip>:<port>` or `undefined` when the line does
-* not carry a published endpoint. Exported for unit testing.
+* free high port (issue #357) — and logs the WHOLE line
+* `Container 'web' container port 80 published on 127.0.0.1:54321. Reach it at
+* 127.0.0.1:54321.` (`ecs-task-runner`). studio surfaces the FIRST such
+* endpoint as the serve's `hostUrl` so the in-workspace request composer can
+* target it even when the user passed no explicit `--host-port`. Returns
+* `http://<ip>:<port>` or `undefined` when the line is not that banner.
+* Exported for unit testing.
+*
+* ANCHORED to the whole banner (issue #578), not just the `published on`
+* phrase: `hostUrl` is a destination the request composer posts to DIRECTLY,
+* with no proxy in between, so a mid-message occurrence of the phrase — in a
+* relayed error, or in a replica's own application output — must not be able
+* to name it. Pass the decoration-stripped line ({@link classifyChildLine}).
+* The loopback bound is applied by the CALLER (a parsed endpoint is still only
+* adopted when {@link normalizeLocalUpstream} accepts it), so this stays a pure
+* reader of the banner.
 */
 function parsePublishedHostEndpoint(line) {
-	const m = /published on (\d{1,3}(?:\.\d{1,3}){3}:\d+)/.exec(line);
+	const m = /^Container '[^']*' container port \d+ published on (\d{1,3}(?:\.\d{1,3}){3}:\d+)/.exec(line);
 	return m ? `http://${m[1]}` : void 0;
 }
 /**
+* The one wording for "studio will not send requests to that destination"
+* (issue #578), shared by every site that resolves a relay target: the ready
+* line, the agentcore extra-endpoint line, the ecs replica publish banner, and
+* the `--host-port` mapping. `endpoint` is untrusted text (child stdout, or a
+* user-supplied flag value), so it is flattened + length-capped before being
+* quoted back.
+*/
+function describeForeignEndpointRefusal(targetId, endpoint, what) {
+	const quoted = `'${describeEndpointForMessage(endpoint)}'`;
+	const outcome = "No endpoint was adopted and no capture proxy was started.";
+	if (!parsesAsUrl(endpoint)) return `refused an unparseable ${what} ${quoted} from '${targetId}': it is not a URL, so studio cannot tell where a request to it would go. ${outcome}`;
+	return `refused a non-loopback ${what} ${quoted} from '${targetId}': a serve child always listens on this machine, so studio will not send requests there. ${outcome}`;
+}
+/** True when `value` is a URL the WHATWG parser accepts. */
+function parsesAsUrl(value) {
+	try {
+		new URL(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** ANSI SGR colour escapes, as the logger wraps a warn / error line with. */
+const ANSI_SGR_RE = /\u001b\[[0-9;]*m/g;
+/** The verbose-mode preamble `<iso-timestamp> <LEVEL>  ` (`utils/logger`). */
+const VERBOSE_PREAMBLE_RE = /^\d{4}-\d{2}-\d{2}T[\d:.]+Z\s+(DEBUG|INFO|WARN|ERROR)\s+/;
+/**
+* A child logger's `[module] ` tag (`utils/logger`'s `ChildLogger`).
+*
+* Stripped ONLY after a verbose preamble, and ONLY for the ecs publish banner
+* ({@link ClassifiedChildLine.untagged}) — never for the ready-banner match.
+* `ChildLogger` emits the tag exclusively at `debug` level (`logger.ts`
+* `info` / `warn` / `error` prefix only when `getLevel() === 'debug'`), which
+* is also the level that renders the `<timestamp> <LEVEL>` preamble, so a BARE
+* `[tag] ` at column 0 is never cdk-local's. It IS how relayed third-party
+* container output arrives — `[<container>] ` (`ecs-task-runner`) and
+* `[svc=... r=... c=...] ` (`ecs-service-runner`) — so stripping it
+* unconditionally re-anchored an application's own log line to `^` and let it
+* impersonate a ready banner (issue #578).
+*/
+const MODULE_TAG_RE = /^\[[^\]]*\]\s+/;
+/** The compact-mode level prefix `WARN: ` / `ERROR: ` (`utils/logger`). */
+const COMPACT_LEVEL_RE = /^(WARN|ERROR):\s/;
+/**
+* Read the log decoration off one child stdout line (issue #578).
+*
+* `cdkl studio` runs its serve children with `CDKL_LOG_STREAM=stdout` (issue
+* #403), so cdk-local's own warn / error lines share the stream the ready
+* banners arrive on. Those lines relay wire-derived text (an AWS SDK error's
+* `message`), which is exactly the text that must never be able to name the
+* endpoint studio proxies to. The compact renderer prefixes them `WARN: ` /
+* `ERROR: ` (the same signal `studio-ui`'s `logLineClass` colours off) and the
+* verbose renderer (`--verbose` / `CDKL_LOG_LEVEL=debug`, both reachable in a
+* studio-spawned child) writes `<timestamp> <LEVEL>  [module] `. Both shapes
+* are recognised here, so the caller can skip a diagnostic line AND anchor its
+* patterns against `text` without the mode deciding whether the anchor holds.
+*/
+function classifyChildLine(line) {
+	let text = line.replace(ANSI_SGR_RE, "");
+	let diagnostic = false;
+	const verbose = VERBOSE_PREAMBLE_RE.exec(text);
+	if (verbose) {
+		if (verbose[1] === "WARN" || verbose[1] === "ERROR") diagnostic = true;
+		text = text.slice(verbose[0].length);
+	}
+	const level = COMPACT_LEVEL_RE.exec(text);
+	if (level) {
+		diagnostic = true;
+		text = text.slice(level[0].length);
+	}
+	let untagged = text;
+	if (verbose) {
+		const tag = MODULE_TAG_RE.exec(text);
+		if (tag) untagged = text.slice(tag[0].length);
+	}
+	return {
+		diagnostic,
+		text,
+		untagged
+	};
+}
+/**
 * Build the studio serve manager. Slice C1 drives a long-running
 * `cdkl start-api <target>` child — studio is a control plane over the
 * CLI (the same pattern as the single-shot invoke dispatcher), so it
@@ -37301,8 +37562,9 @@ function createStudioServeManager(config) {
 	* leaks when a serve stops / errors / times out.
 	*/
 	async function closeProxies(e) {
-		const proxies = e.proxies.splice(0);
-		await Promise.all(proxies.map((p) => p.close().catch(() => void 0)));
+		const proxies = [...e.proxies.values()];
+		e.proxies.clear();
+		await Promise.all(proxies.map((p) => p.then((x) => x.close()).catch(() => void 0)));
 		if (e.envDir) {
 			try {
 				rmSync(e.envDir, {
@@ -37392,7 +37654,7 @@ function createStudioServeManager(config) {
 			endpoints: [],
 			startedAt,
 			child,
-			proxies: []
+			proxies: /* @__PURE__ */ new Map()
 		};
 		if (child.pid !== void 0) entry.pid = child.pid;
 		if (envDir) entry.envDir = envDir;
@@ -37400,7 +37662,15 @@ function createStudioServeManager(config) {
 			const hp = req.options?.["--host-port"];
 			if (Array.isArray(hp)) {
 				const first = hp.find((r) => r && typeof r === "object" && typeof r.right === "string" && r.right.trim() !== "");
-				if (first) entry.hostUrl = "http://127.0.0.1:" + first.right.trim();
+				if (first) {
+					const candidate = "http://127.0.0.1:" + first.right.trim();
+					const local = normalizeLocalUpstream(candidate);
+					if (local === void 0) {
+						const msg = describeForeignEndpointRefusal(req.targetId, candidate, "--host-port mapping");
+						emitLog(config.bus, clock, req.targetId, `WARN: ${msg}`, "stderr");
+						getLogger().warn(msg);
+					} else entry.hostUrl = local;
+				}
 			}
 		}
 		entries.set(req.targetId, entry);
@@ -37410,13 +37680,13 @@ function createStudioServeManager(config) {
 			child.stdout.setEncoding("utf8");
 			child.stderr.setEncoding("utf8");
 			const timer = setTimeoutFn(() => {
-				if (settled) return;
+				if (settled || entry.stopping) return;
 				settled = true;
 				entry.status = "error";
 				emitServe(entry, `Timed out after ${readyTimeoutMs}ms waiting for the serve to be ready.`);
 				stopChild(child, stopGraceMs, setTimeoutFn, clearTimeoutFn);
 				closeProxies(entry);
-				entries.delete(req.targetId);
+				if (entries.get(req.targetId) === entry) entries.delete(req.targetId);
 				reject(/* @__PURE__ */ new Error(`'${req.targetId}' did not start within ${readyTimeoutMs}ms.`));
 			}, readyTimeoutMs);
 			timer.unref?.();
@@ -37428,19 +37698,87 @@ function createStudioServeManager(config) {
 				emitServe(entry);
 				resolve(publicState(entry));
 			};
-			const onReady = async (childUrl) => {
+			/**
+			* Refuse a destination a child's stdout named that is not on this
+			* machine (issue #578), and say so loudly: on the bus, so the studio
+			* LOGS panel shows it (rendered with the same `WARN: ` prefix the
+			* compact logger emits, which `studio-ui` colours), and on the studio
+			* process's own logger, for a user watching the terminal. The endpoint
+			* is untrusted text, so it is flattened + length-capped before being
+			* quoted back.
+			*/
+			const refuseForeignEndpoint = (endpoint, what) => {
+				const msg = describeForeignEndpointRefusal(req.targetId, endpoint, what);
+				emitLog(config.bus, clock, req.targetId, `WARN: ${msg}`, "stderr");
+				getLogger().warn(msg);
+				return msg;
+			};
+			/**
+			* Fail the serve NOW with `reason`, instead of leaving it `starting`
+			* until `readyTimeoutMs` expires (issue #578 review).
+			*
+			* A refused ready line is terminal: the child named the only endpoint it
+			* is going to name, and studio will not use it. Waiting out the default
+			* 120 s and then reporting `did not start within 120000ms` buries the
+			* real cause in the LOGS panel, and it is a live configuration rather
+			* than an attack that lands here — `cdkl start-alb --container-host
+			* <non-loopback>` makes the front-door banner the refused line. Mirrors
+			* the timeout path exactly (graceful SIGTERM so the child tears its own
+			* containers down, proxies closed, entry dropped) but carries the
+			* refusal text as the failure reason, so the UI error banner says why.
+			*
+			* The trade: a serve that would have recovered — a foreign-looking line
+			* arriving BEFORE the genuine banner — now dies instead of waiting. That
+			* line has to clear bound 1 (not a WARN / ERROR), bound 2 (column 0, and
+			* as of this change not tag-stripped) and still name a non-loopback,
+			* non-wildcard host, which is the misconfiguration case far more than
+			* the coincidence case; and the old outcome for it was a 120 s wait
+			* ending in the same failure with a worse message.
+			*/
+			const failServe = (reason) => {
+				if (settled || entry.stopping) return;
+				settled = true;
+				clearTimeoutFn(timer);
+				entry.status = "error";
+				emitServe(entry, reason);
+				stopChild(child, stopGraceMs, setTimeoutFn, clearTimeoutFn);
+				closeProxies(entry);
+				entries.delete(req.targetId);
+				reject(new Error(reason));
+			};
+			const onReady = async (readyUrl) => {
+				let childUrl = readyUrl;
+				if (readyUrl !== void 0) {
+					const local = normalizeLocalUpstream(readyUrl);
+					if (local === void 0) {
+						const msg = refuseForeignEndpoint(readyUrl, "ready line");
+						failServe(msg);
+						return;
+					}
+					childUrl = local;
+				}
 				let endpoint = childUrl;
 				if (childUrl && spec.capturesHttp && captureRequests && /^https?:/i.test(childUrl)) try {
-					const proxy = await proxyFactory({
-						bus: config.bus,
-						target: req.targetId,
-						kind: req.kind,
-						upstream: childUrl
-					});
-					entry.proxies.push(proxy);
-					endpoint = proxy.url;
+					let pending = entry.proxies.get(childUrl);
+					if (pending === void 0) {
+						pending = proxyFactory({
+							bus: config.bus,
+							target: req.targetId,
+							kind: req.kind,
+							upstream: childUrl
+						});
+						entry.proxies.set(childUrl, pending);
+					}
+					endpoint = (await pending).url;
 				} catch {
-					endpoint = childUrl;
+					entry.proxies.delete(childUrl);
+					const direct = normalizeLocalUpstream(childUrl);
+					if (direct === void 0) {
+						const msg = refuseForeignEndpoint(childUrl, "ready line");
+						failServe(msg);
+						return;
+					}
+					endpoint = direct;
 				}
 				if (entry.stopping || settled && !entries.has(req.targetId)) {
 					await closeProxies(entry);
@@ -37451,17 +37789,24 @@ function createStudioServeManager(config) {
 				else becomeRunning();
 			};
 			streamLines(child.stdout, (line) => {
-				const m = spec.readyRe.exec(line);
-				if (m) onReady(m[1]);
-				if (spec.extraEndpointRe) {
-					const me = spec.extraEndpointRe.exec(line);
-					if (me) onReady(me[1]);
-				}
-				if (req.kind === "ecs" && entry.hostUrl === void 0) {
-					const endpoint = parsePublishedHostEndpoint(line);
-					if (endpoint) {
-						entry.hostUrl = endpoint;
-						if (entry.status === "running") emitServe(entry);
+				const parsed = classifyChildLine(line);
+				if (!parsed.diagnostic) {
+					const m = spec.readyRepeats || !settled ? spec.readyRe.exec(parsed.text) : null;
+					if (m) onReady(m[1]);
+					if (spec.extraEndpointRe) {
+						const me = spec.extraEndpointRe.exec(parsed.text);
+						if (me) onReady(me[1]);
+					}
+					if (req.kind === "ecs" && entry.hostUrl === void 0) {
+						const endpoint = parsePublishedHostEndpoint(parsed.untagged);
+						if (endpoint) {
+							const local = normalizeLocalUpstream(endpoint);
+							if (local === void 0) refuseForeignEndpoint(endpoint, "published replica endpoint");
+							else {
+								entry.hostUrl = local;
+								if (entry.status === "running") emitServe(entry);
+							}
+						}
 					}
 				}
 				emitLog(config.bus, clock, req.targetId, line, "stdout");
@@ -38491,4 +38836,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, buildJwksUrlFromIssuer as $n, resolveCfnStackName as $r, buildCloudMapIndex as $t, startAgentCoreHttpServer as A, describeCredentialLoadFailure as Ai, classifySourceChange as An, ConnectionRegistry as Ar, addRunTaskSpecificOptions as At, idFromArn as B, buildStageMap as Bn, resolveRuntimeFileExtension as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, resolveAgentCoreTarget as Ci, waitForAgentCorePing as Cn, tryParseStatus as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, tryResolveImageFnJoin as Di, computeCodeImageTag as Dn, probeHostGatewaySupport as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, substituteImagePlaceholders as Ei, buildAgentCoreCodeImage as En, HOST_GATEWAY_MIN_VERSION as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, createWatchPredicates as Fn, buildDisconnectEvent as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, filterRoutesByApiIdentifiers as Gn, substituteEnvVarsFromState as Gr, enforceImageOverrideOrphans as Gt, createDeployedKvsDataSource as H, resolveEnvVars$1 as Hn, EcsTaskResolutionError as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, resolveApiTargetSubset as In, buildMessageEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, startApiServer as Jn, createLocalStateProvider as Jr, resolveImageOverrides as Jt, createS3OriginReader as K, groupRoutesByServer as Kn, substituteEnvVarsFromStateAsync as Kr, mergeForService as Kt, parseKvsFileOverrides as L, createAuthorizerCache as Ln, architectureToPlatform as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, resolveProfileCredentials as Mi, createLocalInvokeCommand as Mn, handleConnectionsRequest as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, addStartApiSpecificOptions as Nn, parseConnectionsPath as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, LocalInvokeBuildError as Oi, renderCodeDockerfile as On, resolveHostGatewayExtraHosts as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, createLocalStartApiCommand as Pn, buildConnectEvent as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, buildCognitoJwksUrl as Qn, resolveCfnRegion as Qr, listPinnedTargets as Qt, parseOriginOverrides as R, createFileWatcher as Rn, buildContainerImage as Rr, parseMaxTasks as Rt, StudioEventBus as S, pickAgentCoreCandidateStack as Si, waitForAgentCoreHttpReady as Sn, selectIntegrationResponse as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, formatStateRemedy as Ti, SUPPORTED_CODE_RUNTIMES as Tn, HOST_DOCKER_INTERNAL_GATEWAY as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, availableApiIdentifiers as Un, substituteAgainstState as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, materializeLayerFromArn as Vn, resolveRuntimeImage as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, filterRoutesByApiIdentifier as Wn, substituteAgainstStateAsync as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveServiceIntegrationParameters as Xn, rejectExplicitCfnStackWithMultipleStacks as Xr, describePinnedImageUri as Xt, resolveErrorResponseCandidates as Y, resolveSelectionExpression as Yn, isCfnFlagPresent as Yr, runImageOverrideBuilds as Yt, serveLambdaUrlOrigin as Z, defaultCredentialsLoader as Zn, resolveCfnFallbackRegion as Zr, isLocalCdkAssetImage as Zt, filterStudioTargetGroups as _, AGENTCORE_AGUI_PROTOCOL as _i, parseSseForJsonRpc as _n, applyAuthorizerOverlay as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, countTargets as ai, attachContainerLogStreamer as an, computeRequestIdentityHash as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_RUNTIME_TYPE as bi, AGENTCORE_SESSION_ID_HEADER as bn, evaluateResponseParameters as br, addAlbSpecificOptions as bt, startStudioProxy as c, discoverWebSocketApis as ci, bridgeAgentCoreWs as cn, invokeTokenAuthorizer as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, parseSelectionExpressionPath as di, A2A_PATH as dn, buildCorsConfigByApiId as dr, pickTargetFunctionLogicalId as dt, CfnLocalStateProvider as ei, CloudMapRegistry as en, createJwksCache as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, webSocketApiMatchesIdentifier as fi, a2aInvokeOnce as fn, buildCorsConfigFromCloudFrontChain as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, AGENTCORE_A2A_PROTOCOL as gi, mcpInvokeOnce as gn, translateLambdaResponse as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, resolveLambdaArnIntrinsic as hi, MCP_PROTOCOL_VERSION as hn, matchRoute as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSingleTarget as ii, getContainerNetworkIp as in, buildMethodArn as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, buildStsClientConfig as ji, addInvokeSpecificOptions as jn, buildMgmtEndpointEnvUrl as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, describeAwsFailureForWarn as ki, toCmdArgv as kn, bufferToBody as kr, serviceStrategy as kt, relayServeRequest as l, discoverWebSocketApisOrThrow as li, invokeAgentCoreWs as ln, attachAuthorizers as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, pickRefLogicalId as mi, MCP_PATH as mn, matchPreflight as mr, runViewerRequest as mt, coerceRunRequest as n, resolveSsmParameters as ni, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as nn, verifyJwtAuthorizer as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, listTargets as oi, addInvokeAgentCoreSpecificOptions as on, evaluateCachedLambdaPolicy as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, discoverRoutes as pi, MCP_CONTAINER_PORT as pn, isFunctionUrlOacFronted as pr, compileCloudFrontFunction as pt, matchBehavior as q, readMtlsMaterialsFromDisk as qn, LocalStateSourceError as qr, parseImageOverrideFlags as qt, coerceServeRequest as r, resolveWatchConfig as ri, setShadowReadyTimeoutMs as rn, verifyJwtViaDiscovery as rr, httpHeadersToEdge as rt, createStudioServeManager as s, availableWebSocketApiIdentifiers as si, createLocalInvokeAgentCoreCommand as sn, invokeRequestAuthorizer as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, collectSsmParameterRefs as ti, DEFAULT_SHADOW_READY_TIMEOUT_MS as tn, verifyCognitoJwt as tr, buildEdgeResponseEvent as tt, reinvoke as u, filterWebSocketApisByIdentifiers as ui, A2A_CONTAINER_PORT as un, applyCorsResponseHeaders as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_HTTP_PROTOCOL as vi, AGENTCORE_SIGV4_SERVICE as vn, buildHttpApiV2Event as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, derivePseudoParametersFromRegion as wi, downloadAndExtractS3Bundle as wn, VtlEvaluationError as wr, resolveAlbTarget as wt, createStudioStore as x, AgentCoreResolutionError as xi, invokeAgentCore as xn, pickResponseTemplate as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_MCP_PROTOCOL as yi, signAgentCoreInvocation as yn, buildRestV1Event as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, attachStageContext as zn, resolveRuntimeCodeMountPath as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-5iIuMtjd.js.map
+//# sourceMappingURL=local-studio-BJxBmC75.js.map