simplemdg-dev-cli 1.4.1 → 2.0.4

package/dist/commands/cf.command.js

@@ -1,5 +1,7 @@
 import path from "node:path";
 import { spawn } from "node:child_process";
+import crypto from "node:crypto";
+import net from "node:net";
 import nodeFs from "node:fs";
 import fs from "fs-extra";
 import chalk from "chalk";
@@ -1145,6 +1147,1288 @@ async function runLogsCommand(options) {
         childProcess.on("close", () => resolve());
     });
 }
+function parseWebSocketUrl(value) {
+    const url = new URL(value);
+    return {
+        host: url.hostname,
+        port: Number(url.port || 80),
+        path: `${url.pathname}${url.search}`,
+    };
+}
+async function getNodeInspectorWebSocketUrl(localPort) {
+    const response = await fetch(`http://127.0.0.1:${localPort}/json/list`);
+    if (!response.ok) {
+        return undefined;
+    }
+    const targets = await response.json();
+    return targets.find((target) => target.webSocketDebuggerUrl)?.webSocketDebuggerUrl;
+}
+async function waitForNodeInspectorWebSocketUrl(localPort, timeoutMs = 15000) {
+    const startedAt = Date.now();
+    let lastError;
+    while (Date.now() - startedAt < timeoutMs) {
+        try {
+            const webSocketUrl = await getNodeInspectorWebSocketUrl(localPort);
+            if (webSocketUrl) {
+                return webSocketUrl;
+            }
+        }
+        catch (error) {
+            lastError = error;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500));
+    }
+    if (lastError instanceof Error) {
+        console.log(chalk.gray(`Could not read inspector WebSocket yet: ${lastError.message}`));
+    }
+    return undefined;
+}
+function encodeWebSocketFrame(payload) {
+    const payloadBuffer = Buffer.from(payload, "utf8");
+    const maskKey = crypto.randomBytes(4);
+    let header;
+    if (payloadBuffer.length < 126) {
+        header = Buffer.alloc(2);
+        header[0] = 0x81;
+        header[1] = 0x80 | payloadBuffer.length;
+    }
+    else if (payloadBuffer.length <= 0xffff) {
+        header = Buffer.alloc(4);
+        header[0] = 0x81;
+        header[1] = 0x80 | 126;
+        header.writeUInt16BE(payloadBuffer.length, 2);
+    }
+    else {
+        header = Buffer.alloc(10);
+        header[0] = 0x81;
+        header[1] = 0x80 | 127;
+        header.writeBigUInt64BE(BigInt(payloadBuffer.length), 2);
+    }
+    const maskedPayload = Buffer.alloc(payloadBuffer.length);
+    for (let index = 0; index < payloadBuffer.length; index += 1) {
+        maskedPayload[index] = payloadBuffer[index] ^ maskKey[index % 4];
+    }
+    return Buffer.concat([header, maskKey, maskedPayload]);
+}
+function decodeWebSocketFrames(buffer) {
+    const messages = [];
+    let offset = 0;
+    while (offset + 2 <= buffer.length) {
+        const firstByte = buffer[offset];
+        const secondByte = buffer[offset + 1];
+        const opcode = firstByte & 0x0f;
+        const isMasked = Boolean(secondByte & 0x80);
+        let payloadLength = secondByte & 0x7f;
+        let headerLength = 2;
+        if (payloadLength === 126) {
+            if (offset + 4 > buffer.length)
+                break;
+            payloadLength = buffer.readUInt16BE(offset + 2);
+            headerLength = 4;
+        }
+        else if (payloadLength === 127) {
+            if (offset + 10 > buffer.length)
+                break;
+            const longLength = buffer.readBigUInt64BE(offset + 2);
+            if (longLength > BigInt(Number.MAX_SAFE_INTEGER)) {
+                throw new Error("WebSocket frame is too large");
+            }
+            payloadLength = Number(longLength);
+            headerLength = 10;
+        }
+        const maskLength = isMasked ? 4 : 0;
+        const frameLength = headerLength + maskLength + payloadLength;
+        if (offset + frameLength > buffer.length) {
+            break;
+        }
+        let payload = buffer.subarray(offset + headerLength + maskLength, offset + frameLength);
+        if (isMasked) {
+            const maskKey = buffer.subarray(offset + headerLength, offset + headerLength + 4);
+            const unmaskedPayload = Buffer.alloc(payload.length);
+            for (let index = 0; index < payload.length; index += 1) {
+                unmaskedPayload[index] = payload[index] ^ maskKey[index % 4];
+            }
+            payload = unmaskedPayload;
+        }
+        if (opcode === 0x1) {
+            messages.push(payload.toString("utf8"));
+        }
+        offset += frameLength;
+    }
+    return { messages, remaining: buffer.subarray(offset) };
+}
+async function sendInspectorEvaluateCommand(options) {
+    const connection = parseWebSocketUrl(options.webSocketUrl);
+    const timeoutMs = options.timeoutMs ?? 10000;
+    const key = crypto.randomBytes(16).toString("base64");
+    const request = [
+        `GET ${connection.path} HTTP/1.1`,
+        `Host: ${connection.host}:${connection.port}`,
+        "Upgrade: websocket",
+        "Connection: Upgrade",
+        `Sec-WebSocket-Key: ${key}`,
+        "Sec-WebSocket-Version: 13",
+        "",
+        "",
+    ].join("\r\n");
+    await new Promise((resolve, reject) => {
+        const socket = net.createConnection({ host: connection.host, port: connection.port });
+        const commandId = 1;
+        let isHandshakeComplete = false;
+        let handshakeBuffer = Buffer.alloc(0);
+        let frameBuffer = Buffer.alloc(0);
+        const timer = setTimeout(() => {
+            socket.destroy();
+            reject(new Error("Inspector Runtime.evaluate timed out"));
+        }, timeoutMs);
+        const cleanup = () => {
+            clearTimeout(timer);
+            socket.removeAllListeners();
+            socket.end();
+            socket.destroy();
+        };
+        socket.on("connect", () => {
+            socket.write(request);
+        });
+        socket.on("error", (error) => {
+            cleanup();
+            reject(error);
+        });
+        socket.on("data", (chunk) => {
+            try {
+                if (!isHandshakeComplete) {
+                    handshakeBuffer = Buffer.concat([handshakeBuffer, chunk]);
+                    const headerEndIndex = handshakeBuffer.indexOf("\r\n\r\n");
+                    if (headerEndIndex < 0) {
+                        return;
+                    }
+                    const headerText = handshakeBuffer.subarray(0, headerEndIndex).toString("utf8");
+                    if (!/^HTTP\/1\.1 101/i.test(headerText)) {
+                        throw new Error(`Inspector WebSocket upgrade failed: ${headerText.split("\r\n")[0]}`);
+                    }
+                    isHandshakeComplete = true;
+                    const rest = handshakeBuffer.subarray(headerEndIndex + 4);
+                    frameBuffer = rest.length ? Buffer.concat([frameBuffer, rest]) : frameBuffer;
+                    const payload = JSON.stringify({
+                        id: commandId,
+                        method: "Runtime.evaluate",
+                        params: {
+                            expression: options.expression,
+                            awaitPromise: false,
+                            returnByValue: true,
+                        },
+                    });
+                    socket.write(encodeWebSocketFrame(payload));
+                }
+                else {
+                    frameBuffer = Buffer.concat([frameBuffer, chunk]);
+                }
+                const decoded = decodeWebSocketFrames(frameBuffer);
+                frameBuffer = Buffer.from(decoded.remaining);
+                for (const message of decoded.messages) {
+                    const parsed = JSON.parse(message);
+                    if (parsed.id === commandId) {
+                        cleanup();
+                        if (parsed.error) {
+                            reject(new Error(`Inspector Runtime.evaluate failed: ${JSON.stringify(parsed.error)}`));
+                            return;
+                        }
+                        resolve();
+                        return;
+                    }
+                }
+            }
+            catch (error) {
+                cleanup();
+                reject(error);
+            }
+        });
+    });
+}
+function extractJsonFromCloudFoundryLogLine(line) {
+    const jsonStart = line.indexOf("{");
+    if (jsonStart < 0)
+        return undefined;
+    try {
+        return JSON.parse(line.slice(jsonStart));
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseHttpWatchAppLine(line) {
+    if (!line.includes("[APP/") || !line.includes("OUT"))
+        return undefined;
+    const payload = extractJsonFromCloudFoundryLogLine(line);
+    if (!payload)
+        return undefined;
+    const msg = String(payload.msg ?? "");
+    const methodMatch = msg.match(/\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s+([^\s{]+)/);
+    if (!methodMatch)
+        return undefined;
+    return {
+        source: "APP",
+        method: methodMatch[1],
+        url: methodMatch[2],
+        requestId: String(payload.request_id ?? payload.x_vcap_request_id ?? payload.x_request_id ?? ""),
+        correlationId: String(payload.correlation_id ?? payload.x_correlationid ?? payload.x_correlation_id ?? ""),
+        instance: String(payload.x_cf_instanceindex ?? payload.component_instance ?? ""),
+        user: String(payload.remote_user ?? ""),
+        tenant: String(payload.tenant_subdomain ?? payload.tenantid ?? payload.tenant_id ?? ""),
+        userAgent: String(payload.user_agent ?? ""),
+        contentLength: String(payload.content_length ?? payload.request_size_b ?? ""),
+        authorization: String(payload.authorization ?? ""),
+        message: msg,
+    };
+}
+function parseKeyValueFromRouterLine(line, key) {
+    const regex = new RegExp(`${key}:"([^"]*)"`);
+    return line.match(regex)?.[1];
+}
+function parseHttpWatchRouterLine(line) {
+    if (!line.includes("[RTR/") || !line.includes("HTTP/"))
+        return undefined;
+    const requestMatch = line.match(/"(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s+([^\s]+)\s+HTTP\/[^"]+"\s+(\d{3})\s+(\d+)\s+(\d+)/);
+    if (!requestMatch)
+        return undefined;
+    const responseTimeSeconds = Number(line.match(/response_time:([0-9.]+)/)?.[1] ?? "");
+    return {
+        source: "RTR",
+        method: requestMatch[1],
+        url: requestMatch[2],
+        status: requestMatch[3],
+        requestBytes: requestMatch[4],
+        responseBytes: requestMatch[5],
+        durationMs: Number.isFinite(responseTimeSeconds) ? Math.round(responseTimeSeconds * 1000) : undefined,
+        requestId: parseKeyValueFromRouterLine(line, "vcap_request_id"),
+        correlationId: parseKeyValueFromRouterLine(line, "x_correlationid"),
+        instance: line.match(/app_index:"([^"]*)"/)?.[1],
+        tenant: parseKeyValueFromRouterLine(line, "tenantid"),
+        userAgent: line.match(/"\s+"([^"]*)"\s+"[^\"]+:\d+"/)?.[1],
+    };
+}
+function parseHttpWatchLine(line) {
+    return parseHttpWatchAppLine(line) ?? parseHttpWatchRouterLine(line);
+}
+function formatHttpWatchEvent(appName, event) {
+    const status = event.status ? chalk.green(String(event.status)) : chalk.gray("APP");
+    const duration = event.durationMs !== undefined ? chalk.gray(`${event.durationMs}ms`) : "";
+    const source = event.source === "RTR" ? chalk.magenta("RTR") : chalk.blue("APP");
+    const requestId = event.requestId ? chalk.gray(` req=${event.requestId}`) : "";
+    const instance = event.instance ? chalk.gray(` i=${event.instance}`) : "";
+    const user = event.user ? chalk.gray(` user=${event.user}`) : "";
+    const tenant = event.tenant ? chalk.gray(` tenant=${event.tenant}`) : "";
+    const size = event.contentLength || event.requestBytes ? chalk.gray(` bytes=${event.contentLength || event.requestBytes}`) : "";
+    const auth = event.authorization ? chalk.gray(` auth=${event.authorization}`) : "";
+    return `${source} ${chalk.cyan(`[${appName}]`)} ${status} ${chalk.bold(event.method ?? "")} ${event.url ?? ""} ${duration}${instance}${user}${tenant}${size}${auth}${requestId}`.trim();
+}
+function printHttpWatchLine(appName, line, outputFile) {
+    const event = parseHttpWatchLine(line);
+    if (!event)
+        return;
+    const formatted = formatHttpWatchEvent(appName, event);
+    console.log(formatted);
+    if (outputFile) {
+        const plain = formatted.replace(/\u001b\[[0-9;]*m/g, "");
+        fs.appendFileSync(outputFile, `${plain}\n`, "utf8");
+    }
+}
+async function resolveHttpWatchApps(options) {
+    if (options.app?.trim()) {
+        return uniqueValues(options.app.split(","));
+    }
+    return resolveRequestTraceApps({ app: options.app, refresh: options.refresh });
+}
+async function runHttpWatchForApps(options) {
+    if (!options.appNames.length)
+        throw new Error("No app selected for HTTP watch");
+    if (options.out) {
+        await fs.ensureDir(path.dirname(path.resolve(options.out)));
+        await fs.writeFile(options.out, "", "utf8");
+    }
+    if (options.recent) {
+        for (const appName of options.appNames) {
+            const result = await runCommand("cf", ["logs", appName, "--recent"]);
+            const text = `${result.stdout}\n${result.stderr}`;
+            for (const line of text.split(/\r?\n/)) {
+                printHttpWatchLine(appName, line, options.out);
+            }
+        }
+        return;
+    }
+    const children = [];
+    const stopAll = () => {
+        for (const child of children) {
+            if (!child.killed)
+                child.kill();
+        }
+    };
+    process.once("SIGINT", () => {
+        console.log(chalk.gray("\nStopping HTTP watch..."));
+        stopAll();
+        process.exit(0);
+    });
+    for (const appName of options.appNames) {
+        const child = spawn("cf", ["logs", appName], {
+            stdio: ["ignore", "pipe", "pipe"],
+            shell: false,
+            windowsHide: true,
+        });
+        children.push(child);
+        child.stdout.on("data", (chunk) => {
+            for (const line of chunk.toString("utf8").split(/\r?\n/)) {
+                printHttpWatchLine(appName, line, options.out);
+            }
+        });
+        child.stderr.on("data", (chunk) => {
+            for (const line of chunk.toString("utf8").split(/\r?\n/)) {
+                printHttpWatchLine(appName, line, options.out);
+            }
+        });
+    }
+    console.log(chalk.green(`HTTP watch is watching ${options.appNames.length} app(s).`));
+    console.log(chalk.gray("This uses existing CF/CDS/RTR logs. It shows method/path/status/user/tenant/size, but not full request body or full token."));
+    console.log(chalk.gray("Press Ctrl+C to stop."));
+    await new Promise((resolve) => {
+        let closedCount = 0;
+        for (const child of children) {
+            child.on("close", () => {
+                closedCount += 1;
+                if (closedCount >= children.length)
+                    resolve();
+            });
+        }
+    });
+}
+async function runHttpWatchCommand(options) {
+    if (!options.skipOrgSelect) {
+        await maybeSwitchCloudFoundryTargetForDebug({ app: options.app, refresh: options.refresh, skipOrgSelect: false });
+    }
+    await ensureCloudFoundrySessionFromCache();
+    const appNames = await resolveHttpWatchApps(options);
+    await runHttpWatchForApps({ appNames, recent: options.recent, out: options.out });
+}
+async function runRequestTraceDoctorCommand(options) {
+    await maybeSwitchCloudFoundryTargetForDebug({
+        app: options.app,
+        refresh: options.refresh,
+        instance: options.instance,
+        process: options.process,
+        localPort: options.localPort,
+        remotePort: options.remotePort,
+        skipOrgSelect: options.skipOrgSelect,
+    });
+    await ensureCloudFoundrySessionFromCache();
+    const appNames = await resolveRequestTraceApps({ app: options.app, refresh: options.refresh });
+    const instanceIndex = await selectDebugInstance({ instance: options.instance });
+    for (const appName of appNames) {
+        console.log(chalk.cyan(`\nRequest trace doctor for ${appName} instance ${instanceIndex}`));
+        console.log(chalk.gray("Recent router/app HTTP traffic:"));
+        const result = await runCommand("cf", ["logs", appName, "--recent"]);
+        const text = `${result.stdout}\n${result.stderr}`;
+        let count = 0;
+        for (const line of text.split(/\r?\n/)) {
+            const event = parseHttpWatchLine(line);
+            if (event) {
+                count += 1;
+                console.log(formatHttpWatchEvent(appName, event));
+                if (count >= 10)
+                    break;
+            }
+        }
+        if (!count) {
+            console.log(chalk.yellow("No recent HTTP traffic found in CF logs for this app."));
+        }
+        console.log(chalk.gray("\nRemote process list:"));
+        const processList = await runCommand("cf", ["ssh", appName, "-i", instanceIndex, "-T", "-c", "ps -eo pid,args 2>/dev/null | head -n 40"]);
+        if (processList.stdout)
+            console.log(processList.stdout);
+        if (processList.stderr)
+            console.error(processList.stderr);
+    }
+    console.log(chalk.yellow("\nDoctor summary:"));
+    console.log("- If HTTP traffic appears above, the app is receiving requests.");
+    console.log("- Full body/token are not available from CF/CDS logs because they are intentionally omitted or masked.");
+    console.log("- Use smdg cf http-watch for stable live tracking.");
+    console.log("- Use deep request-trace only when you accept Inspector/preload limitations in dev/test.");
+}
+function buildRequestTraceInjectionExpression(options) {
+    const traceOptions = JSON.stringify(options);
+    const source = `(() => {
+    const options = ${traceOptions};
+    const globalKey = "__SMDG_NETWORK_SPY__";
+
+    const state = globalThis[globalKey] || {
+      installed: false,
+      requestSeq: 0,
+      options,
+      patchedRequests: new WeakSet(),
+      patchedResponses: new WeakSet(),
+      patchedServers: new WeakSet(),
+      activeRequests: new WeakMap(),
+    };
+
+    state.options = options;
+    globalThis[globalKey] = state;
+
+    function write(event) {
+      try {
+        console.log("SMDG_REQUEST_TRACE " + JSON.stringify(event));
+      } catch (error) {
+        console.log("SMDG_REQUEST_TRACE " + JSON.stringify({
+          type: "smdg-request-trace-error",
+          app: options.appName,
+          message: error && error.message ? error.message : String(error),
+        }));
+      }
+    }
+
+    function currentOptions() {
+      return globalThis[globalKey] && globalThis[globalKey].options ? globalThis[globalKey].options : options;
+    }
+
+    function shouldCaptureBody() {
+      const mode = currentOptions().mode;
+      return mode === "body" || mode === "response";
+    }
+
+    function shouldCaptureResponse() {
+      return currentOptions().mode === "response";
+    }
+
+    function maxBodyBytes() {
+      return Number(currentOptions().maxBodyBytes || 20000);
+    }
+
+    function maskAuthorization(value) {
+      if (!value) return undefined;
+      const authMode = currentOptions().authMode;
+      if (authMode === "omit") return undefined;
+      if (authMode === "full") return String(value);
+      const text = String(value);
+      return text.length <= 24 ? "***" : text.slice(0, 16) + "..." + text.slice(-8);
+    }
+
+    function normalizeHeaders(headers) {
+      if (currentOptions().mode === "path") return undefined;
+      const output = {};
+      for (const [key, value] of Object.entries(headers || {})) {
+        const lower = key.toLowerCase();
+        if (lower === "authorization") {
+          const auth = maskAuthorization(value);
+          if (auth !== undefined) output[key] = auth;
+          continue;
+        }
+        if (lower === "cookie" || lower === "set-cookie") {
+          output[key] = "***";
+          continue;
+        }
+        output[key] = value;
+      }
+      return output;
+    }
+
+    function appendChunk(record, chunk) {
+      if (!chunk || !shouldCaptureBody()) return;
+      try {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        record.requestBytes += buffer.length;
+        const currentBytes = record.requestChunks.reduce((sum, item) => sum + item.length, 0);
+        const limit = maxBodyBytes();
+        if (currentBytes < limit) {
+          record.requestChunks.push(buffer.subarray(0, Math.max(0, limit - currentBytes)));
+        }
+      } catch {}
+    }
+
+    function appendResponseChunk(record, chunk) {
+      if (!chunk || !shouldCaptureResponse()) return;
+      try {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        record.responseBytes += buffer.length;
+        const currentBytes = record.responseChunks.reduce((sum, item) => sum + item.length, 0);
+        const limit = maxBodyBytes();
+        if (currentBytes < limit) {
+          record.responseChunks.push(buffer.subarray(0, Math.max(0, limit - currentBytes)));
+        }
+      } catch {}
+    }
+
+    function chunksToText(chunks) {
+      try {
+        if (!chunks || !chunks.length) return undefined;
+        return Buffer.concat(chunks).toString("utf8");
+      } catch {
+        return undefined;
+      }
+    }
+
+    function tryParseContent(text, headers) {
+      if (text === undefined) return undefined;
+      if (!currentOptions().parseBodyJson) return text;
+      const contentType = String((headers && (headers["content-type"] || headers["Content-Type"])) || "");
+      if (contentType.includes("application/json") || /^[\\s]*[\\{\\[]/.test(text)) {
+        try { return JSON.parse(text); } catch { return text; }
+      }
+      if (contentType.includes("application/x-www-form-urlencoded")) {
+        try { return Object.fromEntries(new URLSearchParams(text)); } catch { return text; }
+      }
+      return text;
+    }
+
+    function getRequestUrl(req) {
+      return req.originalUrl || req.url || req.path || "";
+    }
+
+    function patchRequestAndResponse(req, res, source) {
+      if (!req || !res || state.patchedRequests.has(req)) return false;
+
+      state.patchedRequests.add(req);
+      const record = {
+        id: ++state.requestSeq,
+        source,
+        startedAt: Date.now(),
+        requestChunks: [],
+        responseChunks: [],
+        requestBytes: 0,
+        responseBytes: 0,
+      };
+      state.activeRequests.set(req, record);
+
+      try {
+        if (!req.__SMDG_NETWORK_SPY_PUSH_PATCHED__) {
+          const originalPush = req.push;
+          if (typeof originalPush === "function") {
+            req.push = function smdgNetworkTraceRequestPush(chunk, encoding) {
+              appendChunk(record, chunk);
+              return originalPush.call(this, chunk, encoding);
+            };
+            Object.defineProperty(req, "__SMDG_NETWORK_SPY_PUSH_PATCHED__", { value: true, enumerable: false });
+          }
+        }
+      } catch {}
+
+      try {
+        const originalEmit = req.emit;
+        if (typeof originalEmit === "function" && !req.__SMDG_NETWORK_SPY_EMIT_PATCHED__) {
+          req.emit = function smdgNetworkTraceRequestEmit(eventName, chunk, ...args) {
+            if (eventName === "data") appendChunk(record, chunk);
+            return originalEmit.call(this, eventName, chunk, ...args);
+          };
+          Object.defineProperty(req, "__SMDG_NETWORK_SPY_EMIT_PATCHED__", { value: true, enumerable: false });
+        }
+      } catch {}
+
+      try {
+        if (!state.patchedResponses.has(res)) {
+          state.patchedResponses.add(res);
+          const originalWrite = res.write;
+          const originalEnd = res.end;
+
+          if (typeof originalWrite === "function") {
+            res.write = function smdgNetworkTraceResponseWrite(chunk, ...args) {
+              appendResponseChunk(record, chunk);
+              return originalWrite.call(this, chunk, ...args);
+            };
+          }
+
+          if (typeof originalEnd === "function") {
+            res.end = function smdgNetworkTraceResponseEnd(chunk, ...args) {
+              appendResponseChunk(record, chunk);
+              return originalEnd.call(this, chunk, ...args);
+            };
+          }
+        }
+      } catch {}
+
+      const finish = () => {
+        try {
+          const requestBodyText = chunksToText(record.requestChunks);
+          const responseBodyText = chunksToText(record.responseChunks);
+          const headers = req.headers || {};
+          const event = {
+            type: "smdg-request-trace",
+            app: currentOptions().appName,
+            source: record.source,
+            id: record.id,
+            timestamp: new Date(record.startedAt).toISOString(),
+            method: req.method,
+            url: getRequestUrl(req),
+            status: res.statusCode,
+            durationMs: Date.now() - record.startedAt,
+            requestBytes: record.requestBytes,
+            responseBytes: record.responseBytes,
+            headers: normalizeHeaders(headers),
+            body: shouldCaptureBody() ? tryParseContent(requestBodyText, headers) : undefined,
+            responseBody: shouldCaptureResponse() ? tryParseContent(responseBodyText, res.getHeaders ? res.getHeaders() : {}) : undefined,
+          };
+          write(event);
+        } catch (error) {
+          write({
+            type: "smdg-request-trace-error",
+            app: currentOptions().appName,
+            message: error && error.message ? error.message : String(error),
+          });
+        }
+      };
+
+      if (typeof res.once === "function") {
+        res.once("finish", finish);
+        res.once("close", () => {
+          if (!res.writableEnded) finish();
+        });
+      }
+
+      return true;
+    }
+
+    function installDiagnosticsChannelHook() {
+      try {
+        const diagnostics = require("diagnostics_channel");
+        if (!diagnostics || diagnostics.__SMDG_NETWORK_SPY_PATCHED__) return false;
+        const requestStart = diagnostics.channel("http.server.request.start");
+        requestStart.subscribe((message) => {
+          const req = message && (message.request || message.req);
+          const res = message && (message.response || message.res);
+          patchRequestAndResponse(req, res, "diagnostics_channel:http.server.request.start");
+        });
+        Object.defineProperty(diagnostics, "__SMDG_NETWORK_SPY_PATCHED__", { value: true, enumerable: false });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+
+    function installServerEmitHook() {
+      try {
+        const http = require("http");
+        const Server = http && http.Server;
+        if (!Server || !Server.prototype || Server.prototype.__SMDG_NETWORK_SPY_EMIT_PATCHED__) return false;
+        const originalEmit = Server.prototype.emit;
+        Server.prototype.emit = function smdgNetworkTraceServerEmit(eventName, req, res, ...args) {
+          if (eventName === "request") patchRequestAndResponse(req, res, "http.Server.emit");
+          return originalEmit.call(this, eventName, req, res, ...args);
+        };
+        Object.defineProperty(Server.prototype, "__SMDG_NETWORK_SPY_EMIT_PATCHED__", { value: true, enumerable: false });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+
+    function installCreateServerHook(moduleName) {
+      try {
+        const mod = require(moduleName);
+        if (!mod || mod.__SMDG_NETWORK_SPY_CREATE_SERVER_PATCHED__) return false;
+        const originalCreateServer = mod.createServer;
+        if (typeof originalCreateServer !== "function") return false;
+        mod.createServer = function smdgNetworkTraceCreateServer(...args) {
+          const server = originalCreateServer.apply(this, args);
+          hookServer(server, moduleName + ".createServer");
+          return server;
+        };
+        Object.defineProperty(mod, "__SMDG_NETWORK_SPY_CREATE_SERVER_PATCHED__", { value: true, enumerable: false });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+
+    function hookServer(server, source) {
+      try {
+        if (!server || state.patchedServers.has(server)) return false;
+        if (typeof server.prependListener === "function") {
+          server.prependListener("request", (req, res) => patchRequestAndResponse(req, res, source));
+          state.patchedServers.add(server);
+          return true;
+        }
+      } catch {}
+      return false;
+    }
+
+    function hookActiveServers() {
+      let count = 0;
+      try {
+        const handles = typeof process._getActiveHandles === "function" ? process._getActiveHandles() : [];
+        for (const handle of handles) {
+          if (handle && typeof handle.on === "function" && typeof handle.address === "function") {
+            if (hookServer(handle, "active-handle")) count += 1;
+          }
+        }
+      } catch {}
+      return count;
+    }
+
+    const diagnosticsHooked = installDiagnosticsChannelHook();
+    const serverEmitHooked = installServerEmitHook();
+    const httpCreateHooked = installCreateServerHook("http");
+    const httpsCreateHooked = installCreateServerHook("https");
+    const activeServers = hookActiveServers();
+
+    state.installed = true;
+    state.installedAt = state.installedAt || new Date().toISOString();
+
+    write({
+      type: "smdg-request-trace-status",
+      app: options.appName,
+      status: "installed",
+      engine: "network-trace-v4",
+      diagnosticsHooked,
+      serverEmitHooked,
+      httpCreateHooked,
+      httpsCreateHooked,
+      activeServers,
+      mode: options.mode,
+      authMode: options.authMode,
+      maxBodyBytes: options.maxBodyBytes,
+    });
+
+    return "installed:network-trace-v4:" + activeServers;
+  })();`;
+    return source;
+}
+async function selectRequestTraceMode() {
+    return searchableSelectChoice({
+        message: "Select request trace mode",
+        choices: [
+            { title: "Path only", value: "path", description: "method, URL, status, duration" },
+            { title: "Headers", value: "headers", description: "include request headers, mask sensitive values" },
+            { title: "Headers + body", value: "body", description: "include request body up to a safe size limit" },
+            { title: "Headers + body + response", value: "response", description: "include request body and response body" },
+        ],
+        allowCustomValue: false,
+    });
+}
+async function selectRequestTraceAuthMode() {
+    return searchableSelectChoice({
+        message: "Authorization header handling",
+        choices: [
+            { title: "Mask token (recommended)", value: "mask" },
+            { title: "Show full token (dev/test only)", value: "full" },
+            { title: "Omit Authorization header", value: "omit" },
+        ],
+        allowCustomValue: false,
+    });
+}
+async function selectRequestTraceDisplayOptions(options) {
+    const headerPreset = await searchableSelectChoice({
+        message: "Headers to display in terminal",
+        choices: [
+            { title: "Minimal headers", value: "minimal", description: "host, content-type, authorization, request/correlation ids" },
+            { title: "Common debug headers", value: "common", description: "minimal + user-agent, origin, forwarded, CF/B3 headers" },
+            { title: "All captured headers", value: "all", description: "large output" },
+            { title: "Custom header list", value: "custom", description: "enter comma-separated headers" },
+        ],
+        allowCustomValue: false,
+    });
+    let headerNames = [];
+    if (headerPreset === "minimal")
+        headerNames = getMinimalTraceHeaderNames();
+    if (headerPreset === "common")
+        headerNames = getCommonTraceHeaderNames();
+    if (headerPreset === "custom") {
+        const response = await prompts({
+            type: "text",
+            name: "headers",
+            message: "Header names to display",
+            initial: "authorization,content-type,content-length,x-correlationid,x-vcap-request-id,tenantid,user-agent",
+            validate: (value) => value.trim() ? true : "At least one header is required",
+        });
+        headerNames = String(response.headers ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+    }
+    const parseResponse = await prompts({
+        type: "select",
+        name: "parseBodyJson",
+        message: "Try parse request/response body as JSON when possible?",
+        choices: [
+            { title: "Yes, parse JSON/form body when possible", value: true },
+            { title: "No, keep raw body string", value: false },
+        ],
+        initial: 0,
+    });
+    let outputFile = options.out;
+    if (!outputFile) {
+        const outResponse = await prompts({
+            type: "select",
+            name: "export",
+            message: "Export captured trace events to JSONL file?",
+            choices: [
+                { title: "No", value: false },
+                { title: "Yes", value: true },
+            ],
+            initial: 0,
+        });
+        if (outResponse.export) {
+            const fileResponse = await prompts({
+                type: "text",
+                name: "file",
+                message: "Trace output file",
+                initial: `smdg-request-trace-${new Date().toISOString().replace(/[:.]/g, "-")}.jsonl`,
+                validate: (value) => value.trim() ? true : "Output file is required",
+            });
+            outputFile = String(fileResponse.file ?? "").trim();
+        }
+    }
+    if (outputFile) {
+        await fs.ensureDir(path.dirname(path.resolve(outputFile)));
+        await fs.writeFile(outputFile, "", "utf8");
+        console.log(chalk.green(`Trace events will be exported to ${path.resolve(outputFile)}`));
+    }
+    return {
+        headerPreset,
+        headerNames,
+        parseBodyJson: Boolean(parseResponse.parseBodyJson),
+        outputFile,
+    };
+}
+async function resolveRequestTraceApps(options) {
+    if (options.app?.trim()) {
+        return uniqueValues(options.app.split(","));
+    }
+    const apps = await getAppsWithCache({ refresh: options.refresh, startBackgroundRefresh: !options.refresh });
+    const selectedApps = [];
+    while (true) {
+        const appName = await searchableSelectChoice({
+            message: selectedApps.length ? "Add another BTP app to trace, or finish" : "Search/select BTP app to trace",
+            choices: [
+                ...apps
+                    .filter((app) => !selectedApps.includes(app.name))
+                    .map((app) => ({
+                    title: [app.name, app.requestedState, app.routes].filter(Boolean).join(" | "),
+                    value: app.name,
+                })),
+                ...(selectedApps.length ? [{ title: "Done", value: "__DONE__" }] : []),
+            ],
+            validateCustomValue: validateRequired,
+            customValueTitle: (value) => `Use typed app name: ${value}`,
+        });
+        if (appName === "__DONE__") {
+            break;
+        }
+        selectedApps.push(appName);
+        await rememberSelectedApp(appName);
+        const moreResponse = await prompts({
+            type: "select",
+            name: "more",
+            message: "Trace another app at the same time?",
+            choices: [
+                { title: "No, start tracing now", value: false },
+                { title: "Yes, add another app", value: true },
+            ],
+            initial: 0,
+        });
+        if (!moreResponse.more) {
+            break;
+        }
+    }
+    return selectedApps;
+}
+function getMinimalTraceHeaderNames() {
+    return [
+        "host",
+        "content-type",
+        "content-length",
+        "authorization",
+        "x-correlation-id",
+        "x-correlationid",
+        "x-vcap-request-id",
+        "tenantid",
+    ];
+}
+function getCommonTraceHeaderNames() {
+    return [
+        ...getMinimalTraceHeaderNames(),
+        "user-agent",
+        "origin",
+        "referer",
+        "x-forwarded-for",
+        "x-forwarded-host",
+        "x-forwarded-path",
+        "x-forwarded-proto",
+        "x-cf-applicationid",
+        "x-cf-instanceindex",
+        "x-cf-true-client-ip",
+        "x-b3-traceid",
+        "x-b3-spanid",
+        "b3",
+    ];
+}
+function normalizeHeaderName(value) {
+    return value.trim().toLowerCase();
+}
+function filterTraceHeaders(headers, display) {
+    if (!headers || typeof headers !== "object")
+        return undefined;
+    const source = headers;
+    if (display.headerPreset === "all")
+        return source;
+    const names = new Set(display.headerNames.map(normalizeHeaderName));
+    const output = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (names.has(normalizeHeaderName(key)))
+            output[key] = value;
+    }
+    return output;
+}
+function stringifyTraceValue(value) {
+    if (value === undefined || value === null)
+        return "";
+    if (typeof value === "string")
+        return value;
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+function traceEventMatchesFilters(event, filters) {
+    if (filters.paused)
+        return false;
+    const method = String(event.method ?? "").toLowerCase();
+    const url = String(event.url ?? "").toLowerCase();
+    const status = String(event.status ?? "").toLowerCase();
+    const body = stringifyTraceValue(event.body).toLowerCase();
+    const responseBody = stringifyTraceValue(event.responseBody).toLowerCase();
+    const all = stringifyTraceValue(event).toLowerCase();
+    if (filters.method && method !== filters.method.toLowerCase())
+        return false;
+    if (filters.path && !url.includes(filters.path.toLowerCase()))
+        return false;
+    if (filters.status && !status.includes(filters.status.toLowerCase()))
+        return false;
+    if (filters.body && !body.includes(filters.body.toLowerCase()) && !responseBody.includes(filters.body.toLowerCase()))
+        return false;
+    if (filters.text && !all.includes(filters.text.toLowerCase()))
+        return false;
+    return true;
+}
+function buildPrintableTracePayload(event, display) {
+    const output = {
+        type: event.type,
+        app: event.app,
+        source: event.source,
+        id: event.id,
+        timestamp: event.timestamp,
+        method: event.method,
+        url: event.url,
+        status: event.status,
+        durationMs: event.durationMs,
+        requestBytes: event.requestBytes,
+        responseBytes: event.responseBytes,
+    };
+    const headers = filterTraceHeaders(event.headers, display);
+    if (headers && Object.keys(headers).length > 0)
+        output.headers = headers;
+    if (event.body !== undefined)
+        output.body = event.body;
+    if (event.responseBody !== undefined)
+        output.responseBody = event.responseBody;
+    return output;
+}
+function writeTraceEventToFile(outputFile, event) {
+    if (!outputFile)
+        return;
+    try {
+        fs.appendFileSync(outputFile, `${JSON.stringify(event)}\n`, "utf8");
+    }
+    catch (error) {
+        console.error(chalk.yellow(`Failed to write trace event to file: ${error instanceof Error ? error.message : String(error)}`));
+    }
+}
+function printRequestTraceEvent(appName, payload, runtime) {
+    const type = String(payload.type ?? "smdg-request-trace");
+    if (type === "smdg-request-trace-status") {
+        console.log(chalk.green(`[${appName}] ${String(payload.status ?? "trace-status")}`));
+        console.log(chalk.gray(`engine=${String(payload.engine ?? "unknown")} activeServers=${String(payload.activeServers ?? "?")} mode=${String(payload.mode ?? "")}`));
+        return;
+    }
+    if (type === "smdg-request-trace-error") {
+        console.log(chalk.red(`[${appName}] trace error: ${String(payload.message ?? "unknown")}`));
+        return;
+    }
+    runtime.events.push(payload);
+    writeTraceEventToFile(runtime.display.outputFile, payload);
+    if (!traceEventMatchesFilters(payload, runtime.filters))
+        return;
+    const time = String(payload.timestamp ?? new Date().toISOString());
+    const method = String(payload.method ?? "");
+    const url = String(payload.url ?? "");
+    const status = String(payload.status ?? "");
+    const duration = String(payload.durationMs ?? "");
+    console.log(chalk.cyan(`\n[${time}] [${appName}] ${method} ${url} → ${status} ${duration}ms`));
+    console.log(JSON.stringify(buildPrintableTracePayload(payload, runtime.display), null, 2));
+}
+function printRequestTraceLine(appName, line, runtime) {
+    const marker = line.includes("SMDG_REQUEST_TRACE ") ? "SMDG_REQUEST_TRACE " : line.includes("SMDG_REQUEST_SPY ") ? "SMDG_REQUEST_SPY " : undefined;
+    if (!marker)
+        return;
+    const markerIndex = line.indexOf(marker);
+    const payloadText = line.slice(markerIndex + marker.length).trim();
+    try {
+        const payload = JSON.parse(payloadText);
+        printRequestTraceEvent(appName, payload, runtime);
+    }
+    catch {
+        console.log(`[${appName}] ${payloadText}`);
+    }
+}
+function printTraceRuntimeHelp() {
+    console.log(chalk.gray("\nRuntime trace commands:"));
+    console.log(chalk.gray("  /method POST        show only one method"));
+    console.log(chalk.gray("  /path text          show only URLs containing text"));
+    console.log(chalk.gray("  /body text          show only request/response body containing text"));
+    console.log(chalk.gray("  /status 500         show only status containing value"));
+    console.log(chalk.gray("  /text value         search anywhere in the event"));
+    console.log(chalk.gray("  /headers a,b,c      change displayed headers while running"));
+    console.log(chalk.gray("  /headers all        display all captured headers"));
+    console.log(chalk.gray("  /clear              clear active filters"));
+    console.log(chalk.gray("  /show               show active filters"));
+    console.log(chalk.gray("  /replay             print matching events already captured"));
+    console.log(chalk.gray("  /pause or /resume   pause/resume terminal display"));
+    console.log(chalk.gray("  /help               show this help"));
+}
+function applyTraceRuntimeCommand(input, runtime) {
+    const trimmed = input.trim();
+    if (!trimmed)
+        return;
+    if (!trimmed.startsWith("/")) {
+        runtime.filters.text = trimmed;
+        console.log(chalk.yellow(`Search text filter: ${trimmed}`));
+        return;
+    }
+    const [commandRaw, ...restParts] = trimmed.slice(1).split(" ");
+    const command = commandRaw.toLowerCase();
+    const value = restParts.join(" ").trim();
+    if (command === "method")
+        runtime.filters.method = value || undefined;
+    else if (command === "path")
+        runtime.filters.path = value || undefined;
+    else if (command === "body")
+        runtime.filters.body = value || undefined;
+    else if (command === "status")
+        runtime.filters.status = value || undefined;
+    else if (command === "text")
+        runtime.filters.text = value || undefined;
+    else if (command === "pause")
+        runtime.filters.paused = true;
+    else if (command === "resume")
+        runtime.filters.paused = false;
+    else if (command === "clear") {
+        runtime.filters.method = undefined;
+        runtime.filters.path = undefined;
+        runtime.filters.body = undefined;
+        runtime.filters.status = undefined;
+        runtime.filters.text = undefined;
+        runtime.filters.paused = false;
+    }
+    else if (command === "headers") {
+        if (!value || value.toLowerCase() === "common") {
+            runtime.display.headerPreset = "common";
+            runtime.display.headerNames = getCommonTraceHeaderNames();
+        }
+        else if (value.toLowerCase() === "minimal") {
+            runtime.display.headerPreset = "minimal";
+            runtime.display.headerNames = getMinimalTraceHeaderNames();
+        }
+        else if (value.toLowerCase() === "all") {
+            runtime.display.headerPreset = "all";
+            runtime.display.headerNames = [];
+        }
+        else {
+            runtime.display.headerPreset = "custom";
+            runtime.display.headerNames = value.split(",").map((item) => item.trim()).filter(Boolean);
+        }
+    }
+    else if (command === "show") {
+        console.log(chalk.gray(JSON.stringify({ filters: runtime.filters, display: runtime.display, captured: runtime.events.length }, null, 2)));
+        return;
+    }
+    else if (command === "replay") {
+        console.log(chalk.gray(`Replaying ${runtime.events.length} captured event(s) with current filters...`));
+        for (const event of runtime.events) {
+            if (traceEventMatchesFilters(event, runtime.filters)) {
+                const appName = String(event.app ?? "app");
+                const time = String(event.timestamp ?? "");
+                console.log(chalk.cyan(`\n[${time}] [${appName}] ${String(event.method ?? "")} ${String(event.url ?? "")} → ${String(event.status ?? "")} ${String(event.durationMs ?? "")}ms`));
+                console.log(JSON.stringify(buildPrintableTracePayload(event, runtime.display), null, 2));
+            }
+        }
+        return;
+    }
+    else if (command === "help" || command === "?") {
+        printTraceRuntimeHelp();
+        return;
+    }
+    else {
+        console.log(chalk.yellow(`Unknown runtime command: ${command}`));
+        printTraceRuntimeHelp();
+        return;
+    }
+    console.log(chalk.yellow(`Trace runtime updated: ${trimmed}`));
+}
+function attachTraceRuntimeCommands(runtime) {
+    printTraceRuntimeHelp();
+    process.stdin.setEncoding("utf8");
+    process.stdin.resume();
+    process.stdin.on("data", (chunk) => {
+        for (const line of chunk.split(/\r?\n/)) {
+            applyTraceRuntimeCommand(line, runtime);
+        }
+    });
+}
+function startRequestTraceLogStream(appName, runtime) {
+    const childProcess = spawn("cf", ["logs", appName], {
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: false,
+        windowsHide: true,
+    });
+    childProcess.stdout.on("data", (chunk) => {
+        const lines = chunk.toString("utf8").split(/\r?\n/);
+        for (const line of lines)
+            printRequestTraceLine(appName, line, runtime);
+    });
+    childProcess.stderr.on("data", (chunk) => {
+        const text = chunk.toString("utf8");
+        if (/SMDG_REQUEST_(TRACE|SPY)/.test(text)) {
+            for (const line of text.split(/\r?\n/))
+                printRequestTraceLine(appName, line, runtime);
+        }
+    });
+    return childProcess;
+}
+async function runRequestTraceCommand(options) {
+    await maybeSwitchCloudFoundryTargetForDebug({
+        app: options.app,
+        refresh: options.refresh,
+        instance: options.instance,
+        process: options.process,
+        localPort: options.localPort,
+        remotePort: options.remotePort,
+        skipOrgSelect: options.skipOrgSelect,
+    });
+    await ensureCloudFoundrySessionFromCache();
+    const appNames = await resolveRequestTraceApps(options);
+    if (!appNames.length) {
+        throw new Error("No app selected for request trace");
+    }
+    const engine = await searchableSelectChoice({
+        message: "Select request trace engine",
+        choices: [
+            {
+                title: "HTTP watch from existing CF/CDS logs (recommended, stable)",
+                value: "http-watch",
+                description: "Shows method/path/status/user/tenant/size. No restart and no source-code change.",
+            },
+            {
+                title: "Deep Node Inspector trace (experimental body capture)",
+                value: "inspector-trace",
+                description: "Attempts runtime injection. May not work for every CAP runtime. Dev/test only.",
+            },
+            {
+                title: "Doctor: verify traffic, process, and limits",
+                value: "doctor",
+            },
+        ],
+        allowCustomValue: false,
+    });
+    if (engine === "http-watch") {
+        await runHttpWatchForApps({ appNames, recent: false, out: undefined });
+        return;
+    }
+    if (engine === "doctor") {
+        await runRequestTraceDoctorCommand({ ...options, app: appNames.join(",") });
+        return;
+    }
+    const traceMode = await selectRequestTraceMode();
+    const authMode = await selectRequestTraceAuthMode();
+    const displayOptions = await selectRequestTraceDisplayOptions(options);
+    const runtime = {
+        display: displayOptions,
+        filters: { paused: false },
+        events: [],
+    };
+    const instanceIndex = await selectDebugInstance({ instance: options.instance });
+    const baseLocalPort = await selectDebugPort({
+        value: options.localPort,
+        message: "Select first local inspector port for request trace",
+        defaultPort: 9329,
+    });
+    const remotePort = parsePositivePort(options.remotePort, 9229);
+    const maxBodyBytes = parsePositivePort(options.maxBodyBytes, 20000);
+    console.log("");
+    console.log(chalk.yellow("Request trace attaches to the running Node.js app through Node Inspector."));
+    console.log(chalk.gray("It does not modify your repository source code. It is temporary and disappears after app restart."));
+    const prepareMode = await selectNodeInspectorPrepareMode({ appName: appNames.join(", "), remotePort });
+    const tunnelProcesses = [];
+    const logProcesses = [];
+    const stopAll = () => {
+        for (const child of [...tunnelProcesses, ...logProcesses]) {
+            if (!child.killed)
+                child.kill();
+        }
+    };
+    process.once("SIGINT", () => {
+        console.log(chalk.gray("\nStopping request trace..."));
+        stopAll();
+        process.exit(0);
+    });
+    for (const [index, appName] of appNames.entries()) {
+        const localPort = baseLocalPort + index;
+        await ensureSshEnabledForDebug(appName);
+        if (prepareMode === "set-env-restart") {
+            await setNodeInspectorEnvironmentAndRestart({ appName, remotePort });
+        }
+        console.log(chalk.gray(`Opening inspector tunnel for ${appName}: localhost:${localPort} -> 127.0.0.1:${remotePort}`));
+        const tunnelProcess = spawn("cf", buildCloudFoundryDebugSshArgs({
+            appName,
+            instanceIndex,
+            processName: options.process,
+            localPort,
+            remotePort,
+            prepareMode,
+        }), {
+            stdio: ["ignore", "pipe", "pipe"],
+            shell: false,
+            windowsHide: true,
+        });
+        tunnelProcesses.push(tunnelProcess);
+        tunnelProcess.stdout.on("data", (chunk) => process.stdout.write(chalk.gray(`[${appName}:ssh] ${chunk.toString("utf8")}`)));
+        tunnelProcess.stderr.on("data", (chunk) => process.stderr.write(chalk.yellow(`[${appName}:ssh] ${chunk.toString("utf8")}`)));
+        const webSocketUrl = await waitForNodeInspectorWebSocketUrl(localPort, 20000);
+        if (!webSocketUrl) {
+            console.log(chalk.red(`Cannot reach Node Inspector for ${appName} on localhost:${localPort}.`));
+            console.log(chalk.yellow("Try again and choose: Set NODE_OPTIONS and restart app."));
+            continue;
+        }
+        const expression = buildRequestTraceInjectionExpression({
+            appName,
+            mode: traceMode,
+            authMode,
+            maxBodyBytes,
+            parseBodyJson: displayOptions.parseBodyJson,
+        });
+        await sendInspectorEvaluateCommand({ webSocketUrl, expression });
+        console.log(chalk.green(`Request trace injected into ${appName}.`));
+        const logProcess = startRequestTraceLogStream(appName, runtime);
+        logProcesses.push(logProcess);
+    }
+    console.log("");
+    console.log(chalk.green(`Request trace is watching ${appNames.length} app(s).`));
+    console.log(chalk.gray("Send requests to your services. Type /help for runtime search commands. Press Ctrl+C to stop tunnels and log streams."));
+    attachTraceRuntimeCommands(runtime);
+    await new Promise((resolve) => {
+        const watchedProcesses = [...tunnelProcesses, ...logProcesses];
+        let closedCount = 0;
+        for (const child of watchedProcesses) {
+            child.on("close", () => {
+                closedCount += 1;
+                if (closedCount >= watchedProcesses.length)
+                    resolve();
+            });
+        }
+    });
+}
 async function runDebugCommand(options) {
     await maybeSwitchCloudFoundryTargetForDebug(options);
     await ensureCloudFoundrySessionFromCache();
@@ -1412,6 +2696,43 @@ export function registerCloudFoundryCommands(program) {
         .option("--open", "Open current folder in VS Code after creating launch.json")
         .option("--skip-org-select", "Use current CF org/space without asking")
         .action(runDebugCommand);
+    cfCommand
+        .command("http-watch")
+        .alias("watch-http")
+        .description("Watch incoming HTTP requests using existing CF/CDS/RTR logs. Stable and does not modify apps.")
+        .option("--app <appName>", "BTP app name. Use comma-separated names to watch multiple apps")
+        .option("--refresh", "Refresh app list before selecting")
+        .option("--recent", "Parse recent logs and exit")
+        .option("--out <fileName>", "Write parsed HTTP events to a file")
+        .option("--skip-org-select", "Use current CF org/space without asking")
+        .action(runHttpWatchCommand);
+    cfCommand
+        .command("request-trace-doctor")
+        .description("Diagnose why deep request-trace may not capture body/header in a BTP Node.js app")
+        .option("--app <appName>", "BTP app name. Use comma-separated names")
+        .option("--refresh", "Refresh app list before selecting")
+        .option("--instance <index>", "App instance index", "0")
+        .option("--process <processName>", "CF process name for multi-process apps")
+        .option("--local-port <port>", "First local inspector port", "9329")
+        .option("--remote-port <port>", "Remote inspector port in app container", "9229")
+        .option("--max-body-bytes <bytes>", "Maximum request/response body bytes to print", "20000")
+        .option("--skip-org-select", "Use current CF org/space without asking")
+        .action(runRequestTraceDoctorCommand);
+    cfCommand
+        .command("request-trace")
+        .alias("network-trace")
+        .alias("traffic")
+        .description("Watch incoming HTTP requests from BTP Node.js apps without editing backend source code")
+        .option("--app <appName>", "BTP app name. Use comma-separated names to trace multiple apps")
+        .option("--refresh", "Refresh app list before selecting")
+        .option("--instance <index>", "App instance index", "0")
+        .option("--process <processName>", "CF process name for multi-process apps")
+        .option("--local-port <port>", "First local inspector port", "9329")
+        .option("--remote-port <port>", "Remote inspector port in app container", "9229")
+        .option("--max-body-bytes <bytes>", "Maximum request/response body bytes to print", "20000")
+        .option("--out <fileName>", "Export captured trace events to a JSONL file")
+        .option("--skip-org-select", "Use current CF org/space without asking")
+        .action(runRequestTraceCommand);
     cfCommand
         .command("apps-cache-refresh")
         .description("Refresh cached cf apps for current target. Internal command used by smdg cf apps.")