stitchkit 0.110.4 → 0.110.6

package/CHANGELOG.md

@@ -15,6 +15,23 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.110.6] - 2026-10-15
+
+### Added
+
+- `stitchkit/server`: `createServer({ proxyOrigin: { trustedPeer } })` restores the external HTTP/HTTPS scheme from a single trusted ingress before fetch composition and routing. It validates the real TCP peer and one `X-Forwarded-Proto`, rejects competing URL headers, preserves wire Host/ports and native cancellation, peer lookup and WebSocket upgrade. `trustProxy` remains client-IP-only. The server surface grows by one configuration type, `ProxyOriginConfig`, owned by this entrypoint so the trust decision is explicit and independently testable (I8, I9, I12).
+
+### Fixed
+
+- `stitchkit/process`: bounded process-group settlement observations remain readable through nested cleanup errors in Node CI, including up to 16 actual states, the group id, sample count and elapsed time. Observation failures retain their original cause. Cleanup deadlines and the definition of a live process are unchanged; these diagnostics do not claim to repair a historical native termination failure.
+- `stitchkit/process`: stopping a process group repeats `SIGKILL` for members still confirmed alive within the original cleanup deadline. Fresh kernel absence ends further signals; dead-only, invalid and failed process observations never trigger a blind re-signal.
+
+## [0.110.5] - 2026-10-15
+
+### Added
+
+- `stitchkit/cli`: `--field:=JSON` assigns a whole JSON value, including explicit `null` for nullable fields, through the existing schema-driven parser. Ordinary `--field null` remains the string `"null"`; optional omission stays absent. Native/discovered help advertises the syntax; malformed JSON and conflicting assignments refuse before dispatch.
+
 ## [0.110.4] - 2026-10-15
 
 ### Fixed

package/dist/agent-runtime/branch-observations.d.ts

@@ -25,20 +25,8 @@ export declare function branchObservation(ids: BranchIdentities, kind: string, r
     delayMs?: number | undefined;
     reason?: string | undefined;
 } | {
-    effectName: string;
-    phase: "intent";
-    runId: string;
-    id?: string | undefined;
-} | {
-    effectName: string;
-    phase: "accepted";
+    stepName: string;
     encoded: string;
-    via: "reconcile" | "run";
-    runId: string;
-    id?: string | undefined;
-} | {
-    effectName: string;
-    phase: "uncertain";
     runId: string;
     id?: string | undefined;
 } | {
@@ -53,15 +41,27 @@ export declare function branchObservation(ids: BranchIdentities, kind: string, r
     id: string;
     runId: string;
 } | {
-    stepName: string;
+    event: string;
+    id: string;
     encoded: string;
     runId: string;
+} | {
+    effectName: string;
+    phase: "intent";
+    runId: string;
     id?: string | undefined;
 } | {
-    event: string;
-    id: string;
+    effectName: string;
+    phase: "accepted";
     encoded: string;
+    via: "reconcile" | "run";
+    runId: string;
+    id?: string | undefined;
+} | {
+    effectName: string;
+    phase: "uncertain";
     runId: string;
+    id?: string | undefined;
 } | {
     bytes: number;
     sha256?: string | undefined;

package/dist/entrypoints/agent-runtime/coding-tools.js

@@ -6,10 +6,10 @@ import {
   AgentCodingToolAuthorizationSchema2,
   AgentCodingToolPathAuthorizationSchema2,
   createAgentCodingTools2
-} from "../../index-bm180f2d.js";
+} from "../../index-ey15wx6j.js";
 import"../../index-2kbysk9s.js";
 import"../../index-84bf5spd.js";
-import"../../index-e1sjcjfy.js";
+import"../../index-7r4knwf8.js";
 import"../../index-zrtrjkbf.js";
 import"../../index-636mggad.js";
 export {

package/dist/entrypoints/agent-runtime/sandbox.js

@@ -3,7 +3,7 @@ import {
   missingSandboxRestrictions2,
   codingRefusal,
   createAgentCodingTools2
-} from "../../index-bm180f2d.js";
+} from "../../index-ey15wx6j.js";
 import"../../index-ct75c3at.js";
 import"../../index-q6crhe1n.js";
 import"../../index-fynr93w4.js";
@@ -17,7 +17,7 @@ import {
   nativeCommandOwner,
   terminateOwnedGroup,
   startNativeCommand
-} from "../../index-e1sjcjfy.js";
+} from "../../index-7r4knwf8.js";
 import"../../index-zrtrjkbf.js";
 import {
   MAX_TIMER_MS

package/dist/entrypoints/agent-runtime/sqlite/bun.js

@@ -1,20 +1,20 @@
 import"../../../index-jna0ejsa.js";
-import"../../../index-mpg1t7nv.js";
+import"../../../index-0z3kfphz.js";
 import"../../../index-8kzct1d6.js";
 import {
   initializeAgentRuntimeSqlite2,
   createSqliteAgentRuntimeStore2
-} from "../../../index-5pbtbce0.js";
+} from "../../../index-7c957abz.js";
 import"../../../index-kqnd6a85.js";
 import"../../../index-5w6t91ze.js";
-import"../../../index-bm180f2d.js";
+import"../../../index-ey15wx6j.js";
 import"../../../index-ct75c3at.js";
 import"../../../index-q6crhe1n.js";
 import"../../../index-fynr93w4.js";
 import"../../../index-2kbysk9s.js";
 import"../../../index-84bf5spd.js";
+import"../../../index-7r4knwf8.js";
 import"../../../index-snef22zr.js";
-import"../../../index-e1sjcjfy.js";
 import"../../../index-zrtrjkbf.js";
 import"../../../index-636mggad.js";
 

package/dist/entrypoints/agent-runtime/sqlite/node.js

@@ -1,20 +1,20 @@
 import"../../../index-jna0ejsa.js";
-import"../../../index-mpg1t7nv.js";
+import"../../../index-0z3kfphz.js";
 import"../../../index-8kzct1d6.js";
 import {
   initializeAgentRuntimeSqlite2,
   createSqliteAgentRuntimeStore2
-} from "../../../index-5pbtbce0.js";
+} from "../../../index-7c957abz.js";
 import"../../../index-kqnd6a85.js";
 import"../../../index-5w6t91ze.js";
-import"../../../index-bm180f2d.js";
+import"../../../index-ey15wx6j.js";
 import"../../../index-ct75c3at.js";
 import"../../../index-q6crhe1n.js";
 import"../../../index-fynr93w4.js";
 import"../../../index-2kbysk9s.js";
 import"../../../index-84bf5spd.js";
+import"../../../index-7r4knwf8.js";
 import"../../../index-snef22zr.js";
-import"../../../index-e1sjcjfy.js";
 import"../../../index-zrtrjkbf.js";
 import"../../../index-636mggad.js";
 

package/dist/entrypoints/agent-runtime/testing.js

@@ -10,18 +10,18 @@ import {
   advanceToolChronology
 } from "../../index-jna0ejsa.js";
 import"../../index-5w6t91ze.js";
-import"../../index-bm180f2d.js";
-import"../../index-mpg1t7nv.js";
+import"../../index-ey15wx6j.js";
+import"../../index-0z3kfphz.js";
 import"../../index-ct75c3at.js";
 import"../../index-q6crhe1n.js";
 import"../../index-fynr93w4.js";
 import"../../index-2kbysk9s.js";
 import"../../index-84bf5spd.js";
+import"../../index-7r4knwf8.js";
 import"../../index-snef22zr.js";
 import {
   createMemoryAgentRuntimeStore2
-} from "../../index-9ket8wzx.js";
-import"../../index-e1sjcjfy.js";
+} from "../../index-mnk5vgdr.js";
 import"../../index-zrtrjkbf.js";
 import {
   assertPositiveSafeInteger

package/dist/entrypoints/agent-runtime.js

@@ -5,7 +5,7 @@ import {
   missingSandboxRestrictions2,
   recordAgentSandboxProbe2,
   refuseUnknownSpillReference
-} from "../index-bm180f2d.js";
+} from "../index-ey15wx6j.js";
 import {
   AgentRecordIdSchema2,
   AgentRecordVersionSchema2,
@@ -58,7 +58,7 @@ import {
   AgentHistoryMutationSchema2,
   ACTIVE_AGENT_RUN_STATES2,
   createAgentRuntimeStore2
-} from "../index-mpg1t7nv.js";
+} from "../index-0z3kfphz.js";
 import {
   AgentStoreEventKindSchema2,
   AgentStoreEventEnvelopeSchema2,
@@ -188,13 +188,13 @@ import {
 import"../index-56yx8dxp.js";
 import"../index-2kbysk9s.js";
 import"../index-84bf5spd.js";
+import"../index-7r4knwf8.js";
 import {
   createMemoryAgentRuntimeStore2
-} from "../index-9ket8wzx.js";
+} from "../index-mnk5vgdr.js";
 import {
   createAgentRuntimeEventSink2
 } from "../index-616xh7f2.js";
-import"../index-e1sjcjfy.js";
 import"../index-zrtrjkbf.js";
 import {
   MAX_TIMER_MS

package/dist/entrypoints/cli.js

@@ -16,7 +16,7 @@ import {
   renderCliView2,
   pollUntilDone2,
   createCli2
-} from "../index-2tazbwhv.js";
+} from "../index-n7hrpngg.js";
 import"../index-fynr93w4.js";
 import"../index-ct75c3at.js";
 import"../index-q6crhe1n.js";

package/dist/entrypoints/process.js

@@ -9,7 +9,7 @@ import {
 } from "../index-84bf5spd.js";
 import {
   startNativeCommand
-} from "../index-e1sjcjfy.js";
+} from "../index-7r4knwf8.js";
 // src/process/command.ts
 function runNativeCommand(input) {
   return startNativeCommand(input).result;

package/dist/entrypoints/server.d.ts

@@ -23,6 +23,7 @@ export { createTrustFence, isLoopbackAddress, type TrustFence, type TrustFenceCo
 export { type MultipartLifecycle, type MultipartResult, parseMultipart, } from '../server/multipart.js';
 export { generateOpenApiDocument, type OpenApiConfig, type OpenApiDocument, type OpenApiInfo, type OpenApiServer, openApiRoute, } from '../server/openapi.js';
 export { bindProcessSignals, type ProcessSignalName, type ProcessSignalsBinding, type ProcessSignalsErrorPhase, type ProcessSignalsOptions, type ShutdownTarget, type SignalSource, } from '../server/process-signals.js';
+export type { ProxyOriginConfig } from '../server/proxy-origin.js';
 export { createRateLimiter, type RateLimitConfig } from '../server/rate-limit.js';
 export { errorResponse, parseBody, respondJson } from '../server/raw.js';
 export { bindRealtimeServer, type RealtimeServer, type RealtimeServerConnection, type RealtimeServerHandle, } from '../server/realtime.js';

package/dist/entrypoints/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/entrypoints/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,KAAK,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EACL,KAAK,eAAe,EACpB,SAAS,EACT,eAAe,EACf,aAAa,EACb,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIrD,OAAO,EAAE,cAAc,EAAE,KAAK,eAAe,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EACL,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,mBAAmB,IAAI,gBAAgB,EAC5C,KAAK,eAAe,IAAI,YAAY,EACpC,KAAK,gBAAgB,IAAI,aAAa,EACtC,KAAK,WAAW,IAAI,QAAQ,EAC5B,KAAK,kBAAkB,IAAI,eAAe,EAC1C,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,SAAS,EACd,cAAc,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,WAAW,EACX,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,gBAAgB,EACrB,SAAS,GACV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,2BAA2B,EAC3B,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,QAAQ,EACR,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,cAAc,EACd,aAAa,EACb,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,YAAY,EACZ,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,YAAY,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/entrypoints/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,KAAK,qBAAqB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EACL,KAAK,eAAe,EACpB,SAAS,EACT,eAAe,EACf,aAAa,EACb,UAAU,EACV,eAAe,EACf,cAAc,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIrD,OAAO,EAAE,cAAc,EAAE,KAAK,eAAe,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EACL,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,mBAAmB,IAAI,gBAAgB,EAC5C,KAAK,eAAe,IAAI,YAAY,EACpC,KAAK,gBAAgB,IAAI,aAAa,EACtC,KAAK,WAAW,IAAI,QAAQ,EAC5B,KAAK,kBAAkB,IAAI,eAAe,EAC1C,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,SAAS,EACd,cAAc,EACd,KAAK,gBAAgB,EACrB,SAAS,EACT,WAAW,EACX,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,gBAAgB,EACrB,SAAS,GACV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,2BAA2B,EAC3B,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,QAAQ,EACR,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,QAAQ,EACR,cAAc,EACd,aAAa,EACb,UAAU,EACV,SAAS,EACT,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,YAAY,EACZ,gCAAgC,GACjC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,YAAY,EACjB,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,SAAS,EACT,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,KAAK,eAAe,EACpB,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/entrypoints/server.js

@@ -335,6 +335,53 @@ function bindSocketRegistry(server, options) {
 }
 // src/server/bun.ts
 import { chmodSync, statSync, unlinkSync } from "node:fs";
+
+// src/server/proxy-origin.ts
+import { z } from "zod";
+var ProtocolSchema = z.enum(["http", "https"]);
+var AuthoritySchema = z.string().min(1).max(1024).regex(/^[^\s/\\?#@,;]+$/);
+var conflictingHeaders = ["forwarded", "x-forwarded-host", "x-forwarded-port"];
+function createProxyOrigin(policy) {
+  const originals = new WeakMap;
+  const original = (request) => originals.get(request) ?? request;
+  return {
+    bind(server) {
+      const requestIP = server.requestIP.bind(server);
+      const timeout = server.timeout.bind(server);
+      const upgrade = server.upgrade.bind(server);
+      server.requestIP = (request) => requestIP(original(request));
+      server.timeout = (request, seconds) => timeout(original(request), seconds);
+      server.upgrade = (request, options) => upgrade(original(request), options);
+    },
+    normalize(request, server) {
+      const peer = server.requestIP(request)?.address;
+      if (!peer || !policy.trustedPeer(peer))
+        return request;
+      const protocol = ProtocolSchema.safeParse(request.headers.get("x-forwarded-proto"));
+      const authority = AuthoritySchema.safeParse(request.headers.get("host"));
+      if (!protocol.success || !authority.success || conflictingHeaders.some((name) => request.headers.has(name))) {
+        return new Response("Invalid proxy origin", { status: 400 });
+      }
+      let origin;
+      try {
+        origin = new URL(`${protocol.data}://${authority.data}`);
+      } catch {
+        return new Response("Invalid proxy origin", { status: 400 });
+      }
+      const url = new URL(request.url);
+      url.protocol = origin.protocol;
+      url.host = origin.host;
+      url.port = origin.port;
+      if (url.href === request.url)
+        return request;
+      const normalized = new Request(url, request);
+      originals.set(normalized, request);
+      return normalized;
+    }
+  };
+}
+
+// src/server/bun.ts
 function reclaimStaleUnixSocket(path) {
   const stats = statSync(path, { throwIfNoEntry: false });
   if (stats === undefined)
@@ -492,17 +539,21 @@ function createServer(config) {
   const handler = createHandler2(config);
   const consumerFetch = config.wrapFetch ? config.wrapFetch(handler) : handler;
   const admittedFetch = lifecycle.wrapFetch(consumerFetch);
+  const proxyOrigin = config.proxyOrigin && createProxyOrigin(config.proxyOrigin);
   const fetch = async (request, server) => {
+    const normalized = proxyOrigin && server ? proxyOrigin.normalize(request, server) : request;
+    if (normalized instanceof Response)
+      return normalized;
     if (socket && socketRoutePrefix) {
-      const pathname = new URL(request.url).pathname;
+      const pathname = new URL(normalized.url).pathname;
       if (pathname.startsWith(socketRoutePrefix)) {
-        return await socket.route.handler(request, {
+        return await socket.route.handler(normalized, {
           params: { socketPath: pathname.slice(socketRoutePrefix.length) },
           server
         });
       }
     }
-    return admittedFetch(request, server);
+    return admittedFetch(normalized, server);
   };
   if (unixPath !== undefined) {
     reclaimStaleUnixSocket(unixPath);
@@ -538,6 +589,7 @@ function createServer(config) {
     });
   }
   const server = runtime;
+  proxyOrigin?.bind(server);
   return {
     url: server.url.toString().replace(/\/$/, ""),
     port: server.port ?? (unixPath !== undefined ? 0 : port),

package/dist/entrypoints/tools.js

@@ -74,7 +74,7 @@ import {
   WaitTimeoutError,
   runWaitOperation,
   createCli2
-} from "../index-2tazbwhv.js";
+} from "../index-n7hrpngg.js";
 import {
   ManagedFilePathSchema2,
   ManagedFileRefSchema2

package/dist/{index-mpg1t7nv.js → index-0z3kfphz.js}

@@ -4,7 +4,7 @@ import {
   AgentSandboxRestrictionSchema2,
   AgentSandboxGradeSchema2,
   AGENT_CODING_TOOL_NAMES
-} from "./index-bm180f2d.js";
+} from "./index-ey15wx6j.js";
 import {
   AgentRecordIdSchema2,
   AgentRecordVersionSchema2,

package/dist/{index-5pbtbce0.js → index-7c957abz.js}

@@ -19,7 +19,7 @@ import {
   appendEventIn,
   ArchiveProjectionSchema,
   createAgentRuntimeStore2
-} from "./index-mpg1t7nv.js";
+} from "./index-0z3kfphz.js";
 import {
   AgentConversationPageSchema2,
   AgentConversationMessagePageSchema2

package/dist/{index-e1sjcjfy.js → index-7r4knwf8.js}

@@ -23,6 +23,62 @@ import {
   assertPositiveSafeInteger
 } from "./index-0s4xebbg.js";
 
+// src/process/group-diagnostics.ts
+import { z } from "zod";
+var ObservationSchema = z.object({
+  failure: z.enum(["deadline", "observation"]),
+  groupId: z.number().int().positive(),
+  observations: z.number().int().nonnegative(),
+  lastStates: z.array(z.string().max(32)).max(16),
+  elapsedMs: z.number().int().nonnegative()
+});
+var observations = new WeakMap;
+
+class GroupSettlementError extends Error {
+  constructor(message, observation, cause = observation) {
+    super(`${message}: ${JSON.stringify(observation)}`, { cause });
+    observations.set(this, { ...observation, lastStates: [...observation.lastStates] });
+  }
+}
+function ownData(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor && "value" in descriptor ? descriptor.value : undefined;
+}
+function groupSettlementDiagnostics(cause) {
+  const pending = [{ value: cause, depth: 0 }];
+  const seen = new Set;
+  const found = [];
+  for (let visited = 0;pending.length && visited < 32 && found.length < 4; visited++) {
+    const entry = pending.pop();
+    if (!entry || seen.has(entry.value))
+      continue;
+    seen.add(entry.value);
+    try {
+      if (entry.value instanceof Error) {
+        const observation = observations.get(entry.value);
+        if (observation)
+          found.push(observation);
+      }
+      if (!(entry.value instanceof Error) || entry.depth >= 8)
+        continue;
+      if (entry.value instanceof AggregateError) {
+        const errors = ownData(entry.value, "errors");
+        if (Array.isArray(errors)) {
+          for (let index = 0;index < 16; index++) {
+            const value = ownData(errors, String(index));
+            if (value !== undefined)
+              pending.push({ value, depth: entry.depth + 1 });
+          }
+        }
+      }
+      const nested = ownData(entry.value, "cause");
+      if (nested !== undefined)
+        pending.push({ value: nested, depth: entry.depth + 1 });
+    } catch {}
+  }
+  return found;
+}
+
 // src/process/group-presence.ts
 function processGroupExists(pid) {
   try {
@@ -57,36 +113,49 @@ function processGroups(timeoutMs) {
   return new Promise((resolve, reject) => {
     execFile("ps", ["-axo", "pgid=,stat="], { encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", maxBuffer: 1024 * 1024 }, (error, stdout) => {
       if (error)
-        reject(new Error("Could not observe command process group settlement", { cause: error }));
+        reject(error);
       else
         resolve(stdout);
     });
   });
 }
-async function waitForProcessGroupExit(pid, deadline) {
+async function waitForProcessGroupExit(pid, deadline, killLiveMembers) {
   if (pid === undefined)
     return;
   let observations = 0;
   let lastStates = [];
-  for (;; ) {
-    const remaining = Math.ceil(deadline - performance.now());
-    if (remaining <= 0)
-      throw new Error("Command process group settlement was not confirmed after SIGKILL", {
-        cause: { groupId: pid, observations, lastStates }
-      });
-    if (!processGroupExists(pid))
-      return;
-    const table = await processGroups(remaining);
-    observations++;
-    if (!hasLiveGroupMember(table, pid))
-      return;
-    lastStates = table.split(/\r?\n/).flatMap((row) => {
-      const fields = /^\s*(\d+)\s+(\S+)\s*$/.exec(row);
-      return Number(fields?.[1]) === pid ? [fields?.[2] ?? "unknown"] : [];
-    }).slice(0, 16);
-    if (!processGroupExists(pid))
-      return;
-    await sleep(Math.min(5, Math.max(0, deadline - performance.now())));
+  const startedAt = performance.now();
+  const observation = () => ({
+    groupId: pid,
+    observations,
+    lastStates,
+    elapsedMs: Math.max(0, Math.ceil(performance.now() - startedAt))
+  });
+  try {
+    for (;; ) {
+      const remaining = Math.ceil(deadline - performance.now());
+      if (remaining <= 0)
+        throw new GroupSettlementError("Command process group settlement was not confirmed after SIGKILL", { ...observation(), failure: "deadline" });
+      if (!processGroupExists(pid))
+        return;
+      const table = await processGroups(remaining);
+      observations++;
+      if (!hasLiveGroupMember(table, pid))
+        return;
+      lastStates = table.split(/\r?\n/).flatMap((row) => {
+        const fields = /^\s*(\d+)\s+(\S+)\s*$/.exec(row);
+        return Number(fields?.[1]) === pid ? [(fields?.[2] ?? "unknown").slice(0, 32)] : [];
+      }).slice(0, 16);
+      if (!processGroupExists(pid))
+        return;
+      if (killLiveMembers && performance.now() < deadline && !await killLiveMembers())
+        return;
+      await sleep(Math.min(5, Math.max(0, deadline - performance.now())));
+    }
+  } catch (cause) {
+    if (cause instanceof GroupSettlementError)
+      throw cause;
+    throw new GroupSettlementError("Could not observe command process group settlement", { ...observation(), failure: "observation" }, cause);
   }
 }
 
@@ -151,7 +220,7 @@ async function killAndSettleGroup(pid, deadline, cleanupTimeoutMs) {
   const cleanupDeadline = Math.min(deadline, performance.now() + cleanupTimeoutMs);
   const signalled = await signalUntilSettled(pid, "SIGKILL", cleanupDeadline);
   if (signalled)
-    await waitForProcessGroupExit(pid, cleanupDeadline);
+    await waitForProcessGroupExit(pid, cleanupDeadline, () => signalUntilSettled(pid, "SIGKILL", cleanupDeadline));
   return signalled;
 }
 async function stopCommandGroup(stop) {
@@ -235,7 +304,9 @@ async function stopLeaderAlone(stop) {
   return send("SIGKILL") || signalled;
 }
 function commandCleanupError(cause) {
-  return new NativeCommandError2("COMMAND_CLEANUP", "Command cleanup did not complete", {
+  const observations = groupSettlementDiagnostics(cause);
+  const message = observations.length ? `Command cleanup did not complete: ${JSON.stringify(observations)}` : "Command cleanup did not complete";
+  return new NativeCommandError2("COMMAND_CLEANUP", message, {
     cause
   });
 }

package/dist/{index-bm180f2d.js → index-ey15wx6j.js}

@@ -7,7 +7,7 @@ import {
 import {
   CommandStopped,
   startNativeCommand
-} from "./index-e1sjcjfy.js";
+} from "./index-7r4knwf8.js";
 import {
   NumericFileHandle,
   descriptorPath,

package/dist/{index-9ket8wzx.js → index-mnk5vgdr.js}

@@ -17,7 +17,7 @@ import {
   replaceMessage,
   ArchiveSpillSchema,
   createAgentRuntimeStore2
-} from "./index-mpg1t7nv.js";
+} from "./index-0z3kfphz.js";
 
 // src/agent-runtime/store-memory.ts
 import { z as z2 } from "zod";