mslxdff 0.1.203 → 0.1.208

package/src/cli/provider-row.js

@@ -1,126 +1,126 @@
-import { readFileSync, existsSync } from "node:fs";
-import { loadProviderKeys, loadProviderAuths, loadProviderConfigs, loadProviderAllowedModels, loadProviderAllowAnyModels, loadProviderBaseUrl } from "../state.js";
-
-/**
- * 聚合 genericIds：来自 providerConfigs + providerKeys + env MSLXDFF_*_KEY
- * 纯逻辑抽取，便于单测；默认读真实 stateFile 与 env，测试可注入 stateFile
- */
-export function buildProviderRows({ stateFile, env = process.env } = {}) {
-  // 复用 status 的聚合逻辑，但抽为纯函数
-  let configs = {};
-  try { configs = loadProviderConfigs(stateFile ? { file: stateFile } : undefined); } catch {}
-  const upstreamBase = env.UPSTREAM_BASE_URL || "https://opencode.ai";
-  const rows = [];
-  const opAllowed = (() => { try { return loadProviderAllowedModels("opencode", stateFile ? { file: stateFile } : undefined); } catch { return []; } })();
-  const opAllowAny = (() => { try { return loadProviderAllowAnyModels("opencode", stateFile ? { file: stateFile } : undefined); } catch { return true; } })();
-  rows.push({ id: "opencode", enabled: true, baseUrl: upstreamBase, keys: [], allowed: opAllowed, allowAny: opAllowAny !== false, share: false, note: "built-in, no key, cannot share", authCount: 0 });
-
-  const genericIds = new Set(Object.keys(configs).filter((id) => id !== "opencode"));
-  try {
-    const raw = JSON.parse(readFileSync(stateFile || "", "utf8"));
-    const pk = raw.providerKeys || {};
-    for (const id of Object.keys(pk)) if (id !== "opencode") genericIds.add(id);
-    const cfgRaw = raw.providerConfigs || {};
-    for (const id of Object.keys(cfgRaw)) if (id !== "opencode") genericIds.add(id);
-  } catch {}
-  for (const k of Object.keys(env)) {
-    const m = k.match(/^MSLXDFF_(.+)_KEY$/);
-    if (m) {
-      const id = m[1].toLowerCase().replace(/__/g, "-");
-      if (id !== "opencode") genericIds.add(id);
-    }
-  }
-
-  // 保证 openrouter 始终可见（即使 0 keys，供用户发现）
-  genericIds.add("openrouter");
-  for (const gid of [...genericIds].sort()) {
-    const cfg = configs[gid];
-    let keys = [];
-    let baseUrl = "";
-    let allowed = [];
-    let allowAny = false;
-    try { keys = loadProviderKeys(gid, stateFile ? { file: stateFile } : undefined); } catch {}
-    try { baseUrl = loadProviderBaseUrl(gid, stateFile ? { file: stateFile } : undefined) || cfg?.baseUrl || (gid === "openrouter" ? "https://openrouter.ai/api/v1" : gid === "workbuddy" ? "https://copilot.tencent.com" : gid === "traework" ? "https://trae-api-cn.mchost.guru" : gid === "qoder" ? "qoder://native" : gid === "qwenwork" ? "qwenwork://native" : gid === "globalqwenwork" ? "globalqwenwork://native" : gid === "zcode" ? "zcode://native" : gid === "raccoon" ? "raccoon://native" : ""); } catch { baseUrl = cfg?.baseUrl || ""; }
-    try { allowed = loadProviderAllowedModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
-    try { allowAny = loadProviderAllowAnyModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
-    // openrouter 特殊：opencode 例外默认 allowAny true，其余默认 false
-    if (gid === "opencode") allowAny = true;
-    let enabled = Boolean(baseUrl && keys.length) || (gid === "openrouter" && keys.length > 0) || ((gid === "qoder" || gid === "qwenwork" || gid === "globalqwenwork" || gid === "traework" || gid === "zcode" || gid === "raccoon") && keys.length > 0);
-    const auths = gid === "workbuddy" ? (() => { try { return loadProviderAuths(gid, stateFile ? { file: stateFile } : undefined) || []; } catch { return []; } })() : [];
-    let note = "";
-    const isWorkbuddyStub = gid === "workbuddy" && (keys.includes("k-new") || String(baseUrl).includes("127.0.0.1") || (keys.length === 1 && keys[0].length < 20));
-    if (isWorkbuddyStub) {
-      enabled = false;
-      note = "测试桩 (key=k-new, baseUrl=127.0.0.1) — 请重跑 node workbuddy-token-auto.js 写入真实 JWT";
-    } else if (!enabled) {
-      if (!baseUrl && !keys.length) note = "no baseUrl, no keys";
-      else if (!baseUrl) note = "missing baseUrl";
-      else if (!keys.length) note = "no keys";
-    } else if (gid === "workbuddy" && auths.length && auths.length !== keys.length) {
-      note = `${auths.length} auth(s) / ${keys.length} key(s) — 数量不一致请重跑 workbuddy-token-auto.js`;
-    }
-    rows.push({ id: gid, enabled, baseUrl: baseUrl || "(none)", keys, allowed, allowAny, note, authCount: auths.length });
-  }
-  return rows;
-}
-
-function maskKey(k) {
-  const s = String(k || "").trim();
-  if (s.length <= 8) return `${s.slice(0, 3)}…${s.slice(-2)}`;
-  return `${s.slice(0, 3)}…${s.slice(-4)}`;
-}
-
-export function formatProviderRow(p) {
-  const isBlocked = !p.allowed.length && !p.allowAny && p.id !== "opencode";
-  const dot = !p.enabled ? "○" : isBlocked ? "◐" : "●";
-  const state = !p.enabled ? "未启用" : isBlocked ? "已启用·阻断" : "已启用";
-  // keys
-  let keysInfo;
-  if (p.id === "opencode") keysInfo = "无需 key";
-  else if (!p.keys.length) keysInfo = "0 keys";
-  else if (p.keys.length === 1) keysInfo = `1 key ${maskKey(p.keys[0])}`;
-  else keysInfo = `${p.keys.length} keys ${p.keys.slice(0, 2).map(maskKey).join(", ")}${p.keys.length > 2 ? ` +${p.keys.length - 2}` : ""}`;
-  if (p.authCount) keysInfo += ` · ${p.authCount} acc`;
-  // allow — 空名单 + allowAny OFF = 阻断（安全默认）
-  let allowInfo;
-  if (!p.allowed.length) {
-    if (p.id === "opencode") allowInfo = "allow all";
-    else if (p.allowAny) allowInfo = "allow all";
-    else allowInfo = "allow none (BLOCKED)";
-  } else {
-    const head = p.allowed.slice(0, 2).join(", ");
-    const more = p.allowed.length > 2 ? ` …+${p.allowed.length - 2}` : "";
-    allowInfo = `allow ${p.allowed.length} → ${head}${more}`;
-  }
-  // share（ADR-0019：默认借出，无开关）
-  const shareInfo = p.id === "opencode" ? "无法共享" : "共享 借出";
-  // base
-  const base = p.baseUrl && p.baseUrl !== "(none)" ? p.baseUrl : "(none)";
-  const baseLine = `    └ ${base}${p.note ? `  · ${p.note}` : ""}`;
-  // 主行：id 固定 12，状态 6，keys 22，allow 自适应，share 固定
-  const main = `  ${dot} ${p.id.padEnd(12)}  ${state}  ${keysInfo.padEnd(22)}  ${allowInfo.padEnd(28)}  ${shareInfo}`;
-  return `${main}\n${baseLine}`;
-}
-
-export function formatProviderSection(rows) {
-  if (!rows.length) {
-    return [
-      "  (空) 暂无供应商 — 加一个试试：",
-      "    mslxdff -provider add myapi https://api.example.com/v1 sk-xxx",
-      "    或  node workbuddy-token-auto.js  (WorkBuddy 一键接入)",
-    ].join("\n");
-  }
-  const enabled = rows.filter((r) => r.enabled);
-  const disabled = rows.filter((r) => !r.enabled);
-  const out = [];
-  if (enabled.length) {
-    out.push(`  已启用 (${enabled.length})`);
-    for (const p of enabled) out.push(formatProviderRow(p));
-  }
-  if (disabled.length) {
-    if (enabled.length) out.push("");
-    out.push(`  未启用 / 需配置 (${disabled.length})`);
-    for (const p of disabled) out.push(formatProviderRow(p));
-  }
-  return out.join("\n");
-}
+import { readFileSync, existsSync } from "node:fs";
+import { loadProviderKeys, loadProviderAuths, loadProviderConfigs, loadProviderAllowedModels, loadProviderAllowAnyModels, loadProviderBaseUrl } from "../state.js";
+
+/**
+ * 聚合 genericIds：来自 providerConfigs + providerKeys + env MSLXDFF_*_KEY
+ * 纯逻辑抽取，便于单测；默认读真实 stateFile 与 env，测试可注入 stateFile
+ */
+export function buildProviderRows({ stateFile, env = process.env } = {}) {
+  // 复用 status 的聚合逻辑，但抽为纯函数
+  let configs = {};
+  try { configs = loadProviderConfigs(stateFile ? { file: stateFile } : undefined); } catch {}
+  const upstreamBase = env.UPSTREAM_BASE_URL || "https://opencode.ai";
+  const rows = [];
+  const opAllowed = (() => { try { return loadProviderAllowedModels("opencode", stateFile ? { file: stateFile } : undefined); } catch { return []; } })();
+  const opAllowAny = (() => { try { return loadProviderAllowAnyModels("opencode", stateFile ? { file: stateFile } : undefined); } catch { return true; } })();
+  rows.push({ id: "opencode", enabled: true, baseUrl: upstreamBase, keys: [], allowed: opAllowed, allowAny: opAllowAny !== false, share: false, note: "built-in, no key, cannot share", authCount: 0 });
+
+  const genericIds = new Set(Object.keys(configs).filter((id) => id !== "opencode"));
+  try {
+    const raw = JSON.parse(readFileSync(stateFile || "", "utf8"));
+    const pk = raw.providerKeys || {};
+    for (const id of Object.keys(pk)) if (id !== "opencode") genericIds.add(id);
+    const cfgRaw = raw.providerConfigs || {};
+    for (const id of Object.keys(cfgRaw)) if (id !== "opencode") genericIds.add(id);
+  } catch {}
+  for (const k of Object.keys(env)) {
+    const m = k.match(/^MSLXDFF_(.+)_KEY$/);
+    if (m) {
+      const id = m[1].toLowerCase().replace(/__/g, "-");
+      if (id !== "opencode") genericIds.add(id);
+    }
+  }
+
+  // 保证 openrouter 始终可见（即使 0 keys，供用户发现）
+  genericIds.add("openrouter");
+  for (const gid of [...genericIds].sort()) {
+    const cfg = configs[gid];
+    let keys = [];
+    let baseUrl = "";
+    let allowed = [];
+    let allowAny = false;
+    try { keys = loadProviderKeys(gid, stateFile ? { file: stateFile } : undefined); } catch {}
+    try { baseUrl = loadProviderBaseUrl(gid, stateFile ? { file: stateFile } : undefined) || cfg?.baseUrl || (gid === "openrouter" ? "https://openrouter.ai/api/v1" : gid === "workbuddy" ? "https://copilot.tencent.com" : gid === "traework" ? "https://trae-api-cn.mchost.guru" : gid === "qoder" ? "qoder://native" : gid === "qwenwork" ? "qwenwork://native" : gid === "globalqwenwork" ? "globalqwenwork://native" : gid === "zcode" ? "zcode://native" : gid === "raccoon" ? "raccoon://native" : ""); } catch { baseUrl = cfg?.baseUrl || ""; }
+    try { allowed = loadProviderAllowedModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
+    try { allowAny = loadProviderAllowAnyModels(gid, stateFile ? { file: stateFile } : undefined); } catch {}
+    // openrouter 特殊：opencode 例外默认 allowAny true，其余默认 false
+    if (gid === "opencode") allowAny = true;
+    let enabled = Boolean(baseUrl && keys.length) || (gid === "openrouter" && keys.length > 0) || ((gid === "qoder" || gid === "qwenwork" || gid === "globalqwenwork" || gid === "traework" || gid === "zcode" || gid === "raccoon") && keys.length > 0);
+    const auths = gid === "workbuddy" ? (() => { try { return loadProviderAuths(gid, stateFile ? { file: stateFile } : undefined) || []; } catch { return []; } })() : [];
+    let note = "";
+    const isWorkbuddyStub = gid === "workbuddy" && (keys.includes("k-new") || String(baseUrl).includes("127.0.0.1") || (keys.length === 1 && keys[0].length < 20));
+    if (isWorkbuddyStub) {
+      enabled = false;
+      note = "测试桩 (key=k-new, baseUrl=127.0.0.1) — 请重跑 node workbuddy-token-auto.js 写入真实 JWT";
+    } else if (!enabled) {
+      if (!baseUrl && !keys.length) note = "no baseUrl, no keys";
+      else if (!baseUrl) note = "missing baseUrl";
+      else if (!keys.length) note = "no keys";
+    } else if (gid === "workbuddy" && auths.length && auths.length !== keys.length) {
+      note = `${auths.length} auth(s) / ${keys.length} key(s) — 数量不一致请重跑 workbuddy-token-auto.js`;
+    }
+    rows.push({ id: gid, enabled, baseUrl: baseUrl || "(none)", keys, allowed, allowAny, note, authCount: auths.length });
+  }
+  return rows;
+}
+
+function maskKey(k) {
+  const s = String(k || "").trim();
+  if (s.length <= 8) return `${s.slice(0, 3)}…${s.slice(-2)}`;
+  return `${s.slice(0, 3)}…${s.slice(-4)}`;
+}
+
+export function formatProviderRow(p) {
+  const isBlocked = !p.allowed.length && !p.allowAny && p.id !== "opencode";
+  const dot = !p.enabled ? "○" : isBlocked ? "◐" : "●";
+  const state = !p.enabled ? "未启用" : isBlocked ? "已启用·阻断" : "已启用";
+  // keys
+  let keysInfo;
+  if (p.id === "opencode") keysInfo = "无需 key";
+  else if (!p.keys.length) keysInfo = "0 keys";
+  else if (p.keys.length === 1) keysInfo = `1 key ${maskKey(p.keys[0])}`;
+  else keysInfo = `${p.keys.length} keys ${p.keys.slice(0, 2).map(maskKey).join(", ")}${p.keys.length > 2 ? ` +${p.keys.length - 2}` : ""}`;
+  if (p.authCount) keysInfo += ` · ${p.authCount} acc`;
+  // allow — 空名单 + allowAny OFF = 阻断（安全默认）
+  let allowInfo;
+  if (!p.allowed.length) {
+    if (p.id === "opencode") allowInfo = "allow all";
+    else if (p.allowAny) allowInfo = "allow all";
+    else allowInfo = "allow none (BLOCKED)";
+  } else {
+    const head = p.allowed.slice(0, 2).join(", ");
+    const more = p.allowed.length > 2 ? ` …+${p.allowed.length - 2}` : "";
+    allowInfo = `allow ${p.allowed.length} → ${head}${more}`;
+  }
+  // share（ADR-0019：默认借出，无开关）
+  const shareInfo = p.id === "opencode" ? "无法共享" : "共享 借出";
+  // base
+  const base = p.baseUrl && p.baseUrl !== "(none)" ? p.baseUrl : "(none)";
+  const baseLine = `    └ ${base}${p.note ? `  · ${p.note}` : ""}`;
+  // 主行：id 固定 12，状态 6，keys 22，allow 自适应，share 固定
+  const main = `  ${dot} ${p.id.padEnd(12)}  ${state}  ${keysInfo.padEnd(22)}  ${allowInfo.padEnd(28)}  ${shareInfo}`;
+  return `${main}\n${baseLine}`;
+}
+
+export function formatProviderSection(rows) {
+  if (!rows.length) {
+    return [
+      "  (空) 暂无供应商 — 加一个试试：",
+      "    mslxdff -provider add myapi https://api.example.com/v1 sk-xxx",
+      "    或  node workbuddy-token-auto.js  (WorkBuddy 一键接入)",
+    ].join("\n");
+  }
+  const enabled = rows.filter((r) => r.enabled);
+  const disabled = rows.filter((r) => !r.enabled);
+  const out = [];
+  if (enabled.length) {
+    out.push(`  已启用 (${enabled.length})`);
+    for (const p of enabled) out.push(formatProviderRow(p));
+  }
+  if (disabled.length) {
+    if (enabled.length) out.push("");
+    out.push(`  未启用 / 需配置 (${disabled.length})`);
+    for (const p of disabled) out.push(formatProviderRow(p));
+  }
+  return out.join("\n");
+}

package/src/cli/util.js

@@ -1,24 +1,24 @@
-import { readFileSync } from "node:fs";
-import { execFile } from "node:child_process";
-
-export function errMsg(err) { return String(err?.message || err); }
-
-export function readModelsCache(cacheFile) {
-  try {
-    return JSON.parse(readFileSync(cacheFile, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-export function npmCmd() {
-  return process.platform === "win32" ? "npm.cmd" : "npm";
-}
-
-export function run(cmd, args, opts = {}) {
-  const isWin = process.platform === "win32";
-  return new Promise((resolve) => {
-    const execOpts = isWin ? { shell: true, windowsHide: true } : {};
-    execFile(cmd, args, { timeout: 120_000, ...execOpts, ...opts }, (err, stdout, stderr) => resolve({ err, stdout, stderr }));
-  });
-}
+import { readFileSync } from "node:fs";
+import { execFile } from "node:child_process";
+
+export function errMsg(err) { return String(err?.message || err); }
+
+export function readModelsCache(cacheFile) {
+  try {
+    return JSON.parse(readFileSync(cacheFile, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function npmCmd() {
+  return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+
+export function run(cmd, args, opts = {}) {
+  const isWin = process.platform === "win32";
+  return new Promise((resolve) => {
+    const execOpts = isWin ? { shell: true, windowsHide: true } : {};
+    execFile(cmd, args, { timeout: 120_000, ...execOpts, ...opts }, (err, stdout, stderr) => resolve({ err, stdout, stderr }));
+  });
+}

package/src/compat.js

@@ -1,53 +1,53 @@
-// 运行时兼容层（项目要求 Node >=18，见 ADR-0024；源码里勿直接用裸 fetch/globalThis.fetch）。
-// 仍保留本层的原因：① undici 是显式依赖（Agent 连接池/keep-alive 要用），
-// 各家 fetch 实现统一从这里取，避免 globalThis.fetch 与 undici.fetch 混用；
-// ② AbortSignal.timeout/structuredClone 在 18+ 已原生，这里的兜底只为可读报错，
-// 不再承诺 <18 可用（<18 请走 assertMinNode 的人话提示）。
-import { randomUUID } from "node:crypto";
-
-let _undici = null;
-try { _undici = await import("undici"); } catch {}
-
-export function getUndici() {
-  return _undici || {};
-}
-
-const _nativeFetch = typeof globalThis.fetch === "function" ? globalThis.fetch.bind(globalThis) : null;
-
-export const compatFetch = _undici?.fetch || _nativeFetch || function noFetch() {
-  throw new Error("当前环境没有可用的 fetch：Node <18 且 undici 未安装。请 npm i undici@^5 或升级 Node >=18。");
-};
-
-export function timeoutSignal(ms) {
-  if (typeof AbortSignal?.timeout === "function") return AbortSignal.timeout(ms);
-  const ctl = new AbortController();
-  const t = setTimeout(() => ctl.abort(new Error(`aborted (timeout ${ms}ms)`)), ms);
-  if (typeof t.unref === "function") t.unref();
-  return ctl.signal;
-}
-
-export function clone(v) {
-  if (typeof structuredClone === "function") return structuredClone(v);
-  if (v === null || typeof v !== "object") return v;
-  return JSON.parse(JSON.stringify(v));
-}
-
-export const uuid = () => randomUUID();
-
-// ---- 运行环境门（强制）：项目要求 Node >=18（ADR-0024）----
-// Node <18 缺 Response/Headers/ReadableStream/TransformStream 等 Web 全局，
-// 上游适配层有 29 处裸用，跑起来必 ReferenceError；与其半途炸掉，不如入口给人话。
-export const MIN_NODE_MAJOR = 18;
-
-export function nodeMajor() {
-  return Number(String(process.versions?.node || "0").split(".")[0]) || 0;
-}
-
-export function assertMinNode({ min = MIN_NODE_MAJOR, label = "mslxdff" } = {}) {
-  const major = nodeMajor();
-  if (major >= min) return true;
-  console.error(`[运行环境不满足] ${label} 需要 Node ${min}+，当前 v${process.versions.node}。`);
-  console.error("原因：Node <18 没有 Response/Headers/ReadableStream 等全局对象，上游转发必然失败。");
-  console.error("升级方式：nvm install 20 && nvm use 20，或到 https://nodejs.org/ 装 LTS（推荐 20/22）。");
-  return false;
-}
+// 运行时兼容层（项目要求 Node >=18，见 ADR-0024；源码里勿直接用裸 fetch/globalThis.fetch）。
+// 仍保留本层的原因：① undici 是显式依赖（Agent 连接池/keep-alive 要用），
+// 各家 fetch 实现统一从这里取，避免 globalThis.fetch 与 undici.fetch 混用；
+// ② AbortSignal.timeout/structuredClone 在 18+ 已原生，这里的兜底只为可读报错，
+// 不再承诺 <18 可用（<18 请走 assertMinNode 的人话提示）。
+import { randomUUID } from "node:crypto";
+
+let _undici = null;
+try { _undici = await import("undici"); } catch {}
+
+export function getUndici() {
+  return _undici || {};
+}
+
+const _nativeFetch = typeof globalThis.fetch === "function" ? globalThis.fetch.bind(globalThis) : null;
+
+export const compatFetch = _undici?.fetch || _nativeFetch || function noFetch() {
+  throw new Error("当前环境没有可用的 fetch：Node <18 且 undici 未安装。请 npm i undici@^5 或升级 Node >=18。");
+};
+
+export function timeoutSignal(ms) {
+  if (typeof AbortSignal?.timeout === "function") return AbortSignal.timeout(ms);
+  const ctl = new AbortController();
+  const t = setTimeout(() => ctl.abort(new Error(`aborted (timeout ${ms}ms)`)), ms);
+  if (typeof t.unref === "function") t.unref();
+  return ctl.signal;
+}
+
+export function clone(v) {
+  if (typeof structuredClone === "function") return structuredClone(v);
+  if (v === null || typeof v !== "object") return v;
+  return JSON.parse(JSON.stringify(v));
+}
+
+export const uuid = () => randomUUID();
+
+// ---- 运行环境门（强制）：项目要求 Node >=18（ADR-0024）----
+// Node <18 缺 Response/Headers/ReadableStream/TransformStream 等 Web 全局，
+// 上游适配层有 29 处裸用，跑起来必 ReferenceError；与其半途炸掉，不如入口给人话。
+export const MIN_NODE_MAJOR = 18;
+
+export function nodeMajor() {
+  return Number(String(process.versions?.node || "0").split(".")[0]) || 0;
+}
+
+export function assertMinNode({ min = MIN_NODE_MAJOR, label = "mslxdff" } = {}) {
+  const major = nodeMajor();
+  if (major >= min) return true;
+  console.error(`[运行环境不满足] ${label} 需要 Node ${min}+，当前 v${process.versions.node}。`);
+  console.error("原因：Node <18 没有 Response/Headers/ReadableStream 等全局对象，上游转发必然失败。");
+  console.error("升级方式：nvm install 20 && nvm use 20，或到 https://nodejs.org/ 装 LTS（推荐 20/22）。");
+  return false;
+}

package/src/events.js

@@ -1,39 +1,39 @@
-// In-memory event bus for live debugging: routes.js emits, -debug streams
-// over HTTP. Keeps a small ring buffer so late subscribers can catch up.
-
-const MAX_BUFFERED = 500;
-
-export function createEventBus() {
-  let buffer = [];
-  const listeners = new Set();
-
-  return {
-    // emit an event to every current subscriber (sync, never throws)
-    emit(event) {
-      buffer.push(event);
-      if (buffer.length > MAX_BUFFERED) buffer.splice(0, buffer.length - MAX_BUFFERED);
-      for (const fn of listeners) {
-        try {
-          fn(event);
-        } catch {
-          // subscriber errors must never break the request path
-        }
-      }
-    },
-    // subscribe; returns an unsubscribe fn
-    subscribe(fn) {
-      listeners.add(fn);
-      return () => listeners.delete(fn);
-    },
-    // buffered events since start (or from offset), consumed left-to-right
-    replay({ since = 0 } = {}) {
-      return buffer.slice(since);
-    },
-    replayAll() {
-      return buffer.slice();
-    },
-    size() {
-      return buffer.length;
-    },
-  };
+// In-memory event bus for live debugging: routes.js emits, -debug streams
+// over HTTP. Keeps a small ring buffer so late subscribers can catch up.
+
+const MAX_BUFFERED = 500;
+
+export function createEventBus() {
+  let buffer = [];
+  const listeners = new Set();
+
+  return {
+    // emit an event to every current subscriber (sync, never throws)
+    emit(event) {
+      buffer.push(event);
+      if (buffer.length > MAX_BUFFERED) buffer.splice(0, buffer.length - MAX_BUFFERED);
+      for (const fn of listeners) {
+        try {
+          fn(event);
+        } catch {
+          // subscriber errors must never break the request path
+        }
+      }
+    },
+    // subscribe; returns an unsubscribe fn
+    subscribe(fn) {
+      listeners.add(fn);
+      return () => listeners.delete(fn);
+    },
+    // buffered events since start (or from offset), consumed left-to-right
+    replay({ since = 0 } = {}) {
+      return buffer.slice(since);
+    },
+    replayAll() {
+      return buffer.slice();
+    },
+    size() {
+      return buffer.length;
+    },
+  };
 }