PostMessageTransport: make debug logging opt-in (or accept a logger)

The issue points to src/message-transport.ts, specifically lines where console.debug is called. Start by examining the PostMessageTransport constructor and its current signature. The task is to add an optional third argument for a logger, defaulting to no logging. Check how the transport is instantiated elsewhere in the codebase to ensure backward compatibility. Write a test to verify logging only occurs when a logger is provided.

Problem

PostMessageTransport calls console.debug unconditionally (src/message-transport.ts at 264d9ca, lines 77, 82, 87 and 128):

• "Sending message" for every outgoing message except tool-input-partial
• "Parsed message" for every valid incoming message
• "Ignoring message from unknown source" for every message from another frame

A host cannot turn these off. The transport takes no option for it, and the only workaround is wrapping console.debug globally.

The noise grows with the number of Apps on a page. Each card's host transport listens on the same window, so a message from any View reaches every bridge. The owning bridge logs "Parsed message", and each of the other N−1 bridges logs "Ignoring message from unknown source" with the full MessageEvent. With four cards in a conversation, every View message produces four host lines, plus the View's own "Sending message" inside its frame. Size changes and host-context updates fan out the same way.

The source check is correct. Only the logging is the problem.

Prior discussion

• #237 / #239 moved the unknown-source log from console.error to console.debug.
• #546 skipped the log for tool-input-partial because it flooded the console.
• #741 asked for opt-in logging or a configurable logger, and noted that full payloads, including tool-result _meta, reach the console. Its filer closed it without a change.

Proposal

Make transport logging opt-in through an options argument:

new PostMessageTransport(eventTarget, eventSource, { logger?: Pick<Console, "debug"> })

Log nothing when logger is absent. The console.error for a malformed JSON-RPC message can stay. The third argument keeps the existing constructor compatible.

Happy to open a PR if this direction works.

Seen on 1.7.5; unchanged on main as of v2.0.0.