@buda-ai/connector 0.1.5 → 0.1.7

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import "./chunk-MCKGQKYU.js";
 
 // src/config.ts
 import { createHash as createHash2, randomBytes, randomUUID } from "crypto";
@@ -159,7 +160,7 @@ function getConnectorPaths(serverUrl, configRoot = path.join(homedir(), ".buda")
   return {
     configDir: configRoot,
     configPath: path.join(configRoot, "device.json"),
-    logPath: path.join(configRoot, "connector.log"),
+    logPath: path.join(configRoot, "logs", "connector.log"),
     workdirRoot: path.join(configRoot, "agents"),
     scopedLegacyConfigPath: path.join(scopedLegacyDir, "device.json"),
     scopedLegacyWorkdirRoot: path.join(scopedLegacyDir, "agents")
@@ -184,6 +185,13 @@ function getConnectorRelayUrl(serverUrl, connectorId) {
   url.searchParams.set("connectorId", connectorId);
   return url.toString();
 }
+function getConnectorTerminalUrl(serverUrl, connectorId, sessionId) {
+  const url = new URL("/api/connectors/terminal", serverUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.searchParams.set("connectorId", connectorId);
+  url.searchParams.set("sessionId", sessionId);
+  return url.toString();
+}
 function getWorkdirRoot(launchConfig) {
   return launchConfig?.workdirRoot || process.env.BUDA_CONNECTOR_WORKDIR || getConnectorPaths(getServerUrl(launchConfig)).workdirRoot;
 }
@@ -401,6 +409,349 @@ function parseLaunchConfig(raw) {
   };
 }
 
+// src/console-dashboard.ts
+import { closeSync, openSync } from "fs";
+import { ReadStream, WriteStream } from "tty";
+import { format, stripVTControlCharacters } from "util";
+var MAX_LINES_PER_PANE = 500;
+var MIN_DASHBOARD_WIDTH = 60;
+var MIN_DASHBOARD_HEIGHT = 18;
+var colors = {
+  cyan: "\x1B[36m",
+  dim: "\x1B[2m",
+  red: "\x1B[31m",
+  reset: "\x1B[0m",
+  reverse: "\x1B[7m",
+  yellow: "\x1B[33m"
+};
+var openControllingTerminal = () => {
+  const inputPath = process.platform === "win32" ? "CONIN$" : "/dev/tty";
+  const outputPath = process.platform === "win32" ? "CONOUT$" : "/dev/tty";
+  let inputFd;
+  let outputFd;
+  try {
+    inputFd = openSync(inputPath, "r");
+    outputFd = openSync(outputPath, "w");
+    const input = new ReadStream(inputFd);
+    const output = new WriteStream(outputFd);
+    return {
+      input,
+      output,
+      close: () => {
+        input.destroy();
+        output.destroy();
+      }
+    };
+  } catch {
+    if (inputFd !== void 0) closeSync(inputFd);
+    if (outputFd !== void 0) closeSync(outputFd);
+    return void 0;
+  }
+};
+var resolveDashboardStreams = () => {
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    return { input: process.stdin, output: process.stdout };
+  }
+  if (process.stdin.isTTY && process.stderr.isTTY) {
+    return { input: process.stdin, output: process.stderr };
+  }
+  return openControllingTerminal();
+};
+var sanitize = (value) => Array.from(stripVTControlCharacters(value).replaceAll("\r", "")).filter((character) => {
+  const code = character.charCodeAt(0);
+  return code === 9 || code >= 32;
+}).join("");
+var truncate = (value, width) => {
+  if (width <= 0) return "";
+  if (value.length <= width) return value.padEnd(width);
+  if (width === 1) return value.slice(0, 1);
+  return `${value.slice(0, width - 1)}~`;
+};
+var formatDuration = (durationMs) => {
+  const totalSeconds = Math.max(0, Math.floor(durationMs / 1e3));
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
+  const seconds = totalSeconds % 60;
+  return [hours, minutes, seconds].map((part) => String(part).padStart(2, "0")).join(":");
+};
+var createDashboardState = (startedAt = Date.now()) => ({
+  activePane: "activity",
+  activity: [],
+  agentDebug: [],
+  heartbeat: "Waiting",
+  relay: "Starting",
+  agent: "Starting",
+  server: "Unknown",
+  startedAt,
+  scroll: { activity: 0, agentDebug: 0 }
+});
+var classifyDashboardLine = (rawLine) => {
+  const line = sanitize(rawLine).trimEnd();
+  const prefix = "[buda-connector] ";
+  if (line.startsWith(prefix)) {
+    const message = line.slice(prefix.length);
+    const routineHealthCheck = /^relay request GET \/healthz\b/i.test(message);
+    return { pane: routineHealthCheck ? "agentDebug" : "activity", message };
+  }
+  return { pane: "agentDebug", message: line };
+};
+var classifyDashboardLevel = (fallback, formattedMessage, rawLine) => {
+  const normalizedLine = sanitize(rawLine).toLowerCase();
+  if (normalizedLine.includes("[error]") || normalizedLine.includes("[fatal]")) return "error";
+  if (normalizedLine.includes("[warning]") || normalizedLine.includes("[warn]")) return "warn";
+  const benignBunnyDiagnostic = [
+    "[bunny-agent:pi] getappendsystemprompt:",
+    "[bunny-agent:pi] loadskills",
+    "[bunny-agent:pi] resume:",
+    "[bunny-agent:pi] runner:"
+  ].some((prefix) => formattedMessage.toLowerCase().startsWith(prefix));
+  return benignBunnyDiagnostic ? "info" : fallback;
+};
+var updateStatusFromActivity = (state, message) => {
+  const normalized = message.toLowerCase();
+  if (normalized.startsWith("server ")) return { ...state, server: message.slice(7) };
+  if (normalized.startsWith("relay connected")) return { ...state, relay: "Connected" };
+  if (normalized.startsWith("relay reconnecting")) return { ...state, relay: "Retrying" };
+  if (normalized.startsWith("relay access revoked"))
+    return { ...state, relay: "Waiting for access" };
+  if (normalized.startsWith("relay disconnected") || normalized.startsWith("relay error") || normalized.startsWith("relay ping failed")) {
+    return { ...state, relay: "Disconnected" };
+  }
+  if (normalized.startsWith("bunny daemon listening") || normalized.startsWith("bunny daemon http")) {
+    return { ...state, agent: "Ready" };
+  }
+  if (normalized.startsWith("bunny daemon stopped")) return { ...state, agent: "Stopped" };
+  if (normalized.startsWith("heartbeat failed")) return { ...state, heartbeat: "Failed" };
+  return state;
+};
+var appendDashboardLine = (state, pane, level, message, time = (/* @__PURE__ */ new Date()).toLocaleTimeString("en-GB", { hour12: false })) => {
+  const current = state[pane];
+  const last = current.at(-1);
+  const nextLines = last?.message === message && last.level === level ? [...current.slice(0, -1), { ...last, count: last.count + 1, time }] : [...current, { count: 1, level, message, time }];
+  const trimmed = nextLines.slice(-MAX_LINES_PER_PANE);
+  const scroll = state.scroll[pane] > 0 ? { ...state.scroll, [pane]: Math.min(trimmed.length - 1, state.scroll[pane] + 1) } : state.scroll;
+  const next = { ...state, [pane]: trimmed, scroll };
+  return pane === "activity" ? updateStatusFromActivity(next, message) : next;
+};
+var scrollDashboardPane = (state, pane, delta) => {
+  const maxScroll = Math.max(0, state[pane].length - 1);
+  const nextScroll = delta === "follow" ? 0 : delta === "oldest" ? maxScroll : Math.max(0, Math.min(maxScroll, state.scroll[pane] + delta));
+  return { ...state, scroll: { ...state.scroll, [pane]: nextScroll } };
+};
+var parseDashboardMouseAction = (input, size) => {
+  const mouseEventPrefix = "\x1B[<";
+  if (!input.includes(mouseEventPrefix)) return void 0;
+  const event = input.split(mouseEventPrefix).at(-1);
+  const match = event?.match(/^(\d+);\d+;(\d+)[Mm]/);
+  if (!match) return void 0;
+  const button = Number(match[1]);
+  const row = Number(match[2]);
+  const availablePaneRows = Math.max(0, size.height - 6);
+  const activityHeight = Math.floor(availablePaneRows / 2);
+  const activityStart = 6;
+  const debugStart = activityStart + activityHeight;
+  const pane = row >= activityStart && row < debugStart ? "activity" : row >= debugStart && row < size.height ? "agentDebug" : void 0;
+  if (!pane) return void 0;
+  if (button === 64) return { pane, delta: 3 };
+  if (button === 65) return { pane, delta: -3 };
+  if (button === 0) return { pane };
+  return void 0;
+};
+var getTerminalCopyGesture = (termProgram = process.env.TERM_PROGRAM) => termProgram === "Apple_Terminal" ? "Fn+drag copy" : "Shift+drag copy";
+var renderStatus = (state, width, now) => {
+  const innerWidth = width - 2;
+  const status = (value) => value;
+  return [
+    `+${"-".repeat(innerWidth)}+`,
+    `|${colors.cyan}${truncate(" Buda Connector", innerWidth)}${colors.reset}|`,
+    `|${truncate(` Relay ${status(state.relay)}   Agent ${status(state.agent)}   Heartbeat ${status(state.heartbeat)}`, innerWidth)}|`,
+    `|${truncate(` Server ${state.server}   Uptime ${formatDuration(now - state.startedAt)}`, innerWidth)}|`,
+    `+${"-".repeat(innerWidth)}+`
+  ];
+};
+var renderPane = (title, lines, height, width, active, scroll) => {
+  const innerWidth = width - 2;
+  const contentHeight = Math.max(1, height - 2);
+  const end = Math.max(0, lines.length - scroll);
+  const visible = lines.slice(Math.max(0, end - contentHeight), end);
+  const headerSuffix = scroll === 0 ? "following" : `${scroll} lines behind`;
+  const titleText = ` ${title} ${active ? "[active]" : ""}`;
+  const headerFill = Math.max(1, innerWidth - titleText.length - headerSuffix.length);
+  const output = [
+    `${active ? colors.reverse : ""}+${titleText}${"-".repeat(headerFill)}${headerSuffix}+${colors.reset}`
+  ];
+  for (let index = 0; index < contentHeight; index += 1) {
+    const line = visible[index];
+    if (!line) {
+      output.push(`|${" ".repeat(innerWidth)}|`);
+      continue;
+    }
+    const levelColor = line.level === "error" ? colors.red : line.level === "warn" ? colors.yellow : colors.dim;
+    const count = line.count > 1 ? ` x${line.count}` : "";
+    const content = `${line.time} ${line.level.toUpperCase().padEnd(5)} ${line.message}${count}`;
+    output.push(`|${levelColor}${truncate(content, innerWidth)}${colors.reset}|`);
+  }
+  output.push(`+${"-".repeat(innerWidth)}+`);
+  return output;
+};
+var renderFooter = (width) => `${colors.dim}${truncate(` ${getTerminalCopyGesture()} | Click/wheel pane | Tab switch pane | F follow`, width)}${colors.reset}`;
+var renderDashboard = (state, size, now = Date.now()) => {
+  const width = Math.max(10, size.width);
+  const height = Math.max(4, size.height);
+  if (width < MIN_DASHBOARD_WIDTH || height < MIN_DASHBOARD_HEIGHT) {
+    return [
+      truncate("Buda Connector", width),
+      truncate("Terminal too small for dashboard. Resize or restart with --plain.", width),
+      truncate(`Relay ${state.relay} | Agent ${state.agent}`, width),
+      truncate(`Heartbeat ${state.heartbeat}`, width)
+    ].slice(0, height).join("\n");
+  }
+  const availablePaneRows = height - 6;
+  const activityHeight = Math.floor(availablePaneRows / 2);
+  const debugHeight = availablePaneRows - activityHeight;
+  return [
+    ...renderStatus(state, width, now),
+    ...renderPane(
+      "Activity",
+      state.activity,
+      activityHeight,
+      width,
+      state.activePane === "activity",
+      state.scroll.activity
+    ),
+    ...renderPane(
+      "Agent Debug",
+      state.agentDebug,
+      debugHeight,
+      width,
+      state.activePane === "agentDebug",
+      state.scroll.agentDebug
+    ),
+    renderFooter(width)
+  ].join("\n");
+};
+var ConnectorConsoleDashboard = class {
+  constructor(streams) {
+    this.streams = streams;
+  }
+  state = createDashboardState();
+  stopped = false;
+  renderQueued = false;
+  originalConsole = {
+    error: console.error,
+    log: console.log,
+    warn: console.warn
+  };
+  start() {
+    console.log = (...args) => this.capture("info", args);
+    console.warn = (...args) => this.capture("warn", args);
+    console.error = (...args) => this.capture("error", args);
+    this.streams.output.write("\x1B[?1049h\x1B[?25l\x1B[?1000h\x1B[?1006h");
+    if (this.streams.input.isTTY) this.streams.input.setRawMode(true);
+    this.streams.input.resume();
+    this.streams.input.on("data", this.handleInput);
+    this.streams.output.on("resize", this.scheduleRender);
+    process.once("exit", this.stop);
+    this.scheduleRender();
+  }
+  updateStatus(update) {
+    this.state = { ...this.state, ...update };
+    this.scheduleRender();
+  }
+  stop = () => {
+    if (this.stopped) return;
+    this.stopped = true;
+    console.log = this.originalConsole.log;
+    console.warn = this.originalConsole.warn;
+    console.error = this.originalConsole.error;
+    this.streams.input.off("data", this.handleInput);
+    this.streams.output.off("resize", this.scheduleRender);
+    process.off("exit", this.stop);
+    if (this.streams.input.isTTY) this.streams.input.setRawMode(false);
+    this.streams.input.pause();
+    this.streams.output.write("\x1B[?1006l\x1B[?1000l\x1B[?25h\x1B[?1049l");
+    this.streams.close?.();
+    if (activeDashboard === this) activeDashboard = void 0;
+  };
+  capture(level, args) {
+    const formatted = format(...args);
+    for (const rawLine of formatted.split("\n")) {
+      const { pane, message } = classifyDashboardLine(rawLine);
+      if (!message) continue;
+      this.state = appendDashboardLine(
+        this.state,
+        pane,
+        classifyDashboardLevel(level, formatted, rawLine),
+        message
+      );
+    }
+    this.scheduleRender();
+  }
+  handleInput = (chunk) => {
+    const key = chunk.toString();
+    if (key === "") {
+      this.stop();
+      process.kill(process.pid, "SIGINT");
+      return;
+    }
+    const size = {
+      width: this.streams.output.columns || 80,
+      height: this.streams.output.rows || 24
+    };
+    const mouseAction = parseDashboardMouseAction(key, size);
+    if (mouseAction) {
+      this.state = { ...this.state, activePane: mouseAction.pane };
+      if (mouseAction.delta !== void 0) {
+        this.state = scrollDashboardPane(this.state, mouseAction.pane, mouseAction.delta);
+      }
+    } else if (key === "	") {
+      this.state = {
+        ...this.state,
+        activePane: this.state.activePane === "activity" ? "agentDebug" : "activity"
+      };
+    } else if (key === "f" || key === "F" || key === "\x1B[F") {
+      this.state = scrollDashboardPane(this.state, this.state.activePane, "follow");
+    } else if (key === "\x1B[H") {
+      this.state = scrollDashboardPane(this.state, this.state.activePane, "oldest");
+    } else if (key === "\x1B[A") {
+      this.state = scrollDashboardPane(this.state, this.state.activePane, 1);
+    } else if (key === "\x1B[B") {
+      this.state = scrollDashboardPane(this.state, this.state.activePane, -1);
+    } else if (key === "\x1B[5~") {
+      this.state = scrollDashboardPane(this.state, this.state.activePane, 8);
+    } else if (key === "\x1B[6~") {
+      this.state = scrollDashboardPane(this.state, this.state.activePane, -8);
+    } else {
+      return;
+    }
+    this.scheduleRender();
+  };
+  scheduleRender = () => {
+    if (this.stopped || this.renderQueued) return;
+    this.renderQueued = true;
+    setImmediate(() => {
+      this.renderQueued = false;
+      if (this.stopped) return;
+      const width = this.streams.output.columns || 80;
+      const height = this.streams.output.rows || 24;
+      this.streams.output.write(`\x1B[H\x1B[2J${renderDashboard(this.state, { width, height })}`);
+    });
+  };
+};
+var activeDashboard;
+var startConnectorConsoleDashboard = (options = {}) => {
+  if (options.plain) return void 0;
+  const streams = options.streams ?? resolveDashboardStreams();
+  if (!streams?.input.isTTY || !streams.output.isTTY) return void 0;
+  if (activeDashboard) return activeDashboard;
+  activeDashboard = new ConnectorConsoleDashboard(streams);
+  activeDashboard.start();
+  return activeDashboard;
+};
+var updateConnectorDashboardStatus = (update) => {
+  activeDashboard?.updateStatus(update);
+};
+
 // src/onboard.ts
 import { cancel, intro, isCancel, log, note, outro, spinner, text } from "@clack/prompts";
 
@@ -409,8 +760,78 @@ import { mkdir as mkdir3 } from "fs/promises";
 import { createDaemon } from "@bunny-agent/daemon";
 
 // src/logger.ts
-import { appendFile, mkdir as mkdir2 } from "fs/promises";
+import { appendFile, mkdir as mkdir2, readdir, rename as rename2, stat as stat2, unlink as unlink3 } from "fs/promises";
+import path2 from "path";
+var CONNECTOR_LOG_MAX_BYTES = 2 * 1024 * 1024;
+var CONNECTOR_LOG_BACKUP_COUNT = 2;
+var CONNECTOR_LOG_RETENTION_DAYS = 7;
 var pendingLogs = [];
+var fileWriteQueue = Promise.resolve();
+var lastPrunedDate = "";
+var ignoreMissingFile = (error) => {
+  if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+    return;
+  }
+  throw error;
+};
+var formatConnectorLogDate = (date) => {
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, "0");
+  const day = String(date.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
+};
+var getDatedConnectorLogPath = (baseLogPath, date = /* @__PURE__ */ new Date()) => {
+  const parsed = path2.parse(baseLogPath);
+  return path2.join(parsed.dir, `${parsed.name}-${formatConnectorLogDate(date)}${parsed.ext}`);
+};
+async function pruneConnectorLogs(baseLogPath, now = /* @__PURE__ */ new Date(), retentionDays = CONNECTOR_LOG_RETENTION_DAYS) {
+  const parsed = path2.parse(baseLogPath);
+  const prefix = `${parsed.name}-`;
+  const cutoff = new Date(now);
+  cutoff.setHours(0, 0, 0, 0);
+  cutoff.setDate(cutoff.getDate() - Math.max(0, retentionDays - 1));
+  const cutoffDate = formatConnectorLogDate(cutoff);
+  const files = await readdir(parsed.dir).catch(() => []);
+  const expired = files.filter((fileName) => {
+    if (!fileName.startsWith(prefix)) return false;
+    const date = fileName.slice(prefix.length, prefix.length + 10);
+    const suffix = fileName.slice(prefix.length + 10);
+    const isDatedLog = /^\d{4}-\d{2}-\d{2}$/.test(date);
+    const segment = suffix.startsWith(`${parsed.ext}.`) ? suffix.slice(parsed.ext.length + 1) : "";
+    const isLogSegment = suffix === parsed.ext || /^\d+$/.test(segment);
+    return isDatedLog && isLogSegment && date < cutoffDate;
+  });
+  await Promise.all(expired.map((fileName) => unlink3(path2.join(parsed.dir, fileName))));
+  return expired.length;
+}
+async function rotateConnectorLogIfNeeded(logPath, maxBytes = CONNECTOR_LOG_MAX_BYTES, backupCount = CONNECTOR_LOG_BACKUP_COUNT) {
+  const currentSize = await stat2(logPath).then((value) => value.size).catch((error) => {
+    ignoreMissingFile(error);
+    return 0;
+  });
+  if (currentSize < maxBytes) return false;
+  await unlink3(`${logPath}.${backupCount}`).catch(ignoreMissingFile);
+  for (let index = backupCount - 1; index >= 1; index -= 1) {
+    await rename2(`${logPath}.${index}`, `${logPath}.${index + 1}`).catch(ignoreMissingFile);
+  }
+  await rename2(logPath, `${logPath}.1`).catch(ignoreMissingFile);
+  return true;
+}
+var appendConnectorLog = (baseLogPath, line, now = /* @__PURE__ */ new Date()) => {
+  const date = formatConnectorLogDate(now);
+  const logPath = getDatedConnectorLogPath(baseLogPath, now);
+  const write = async () => {
+    if (lastPrunedDate !== date) {
+      await pruneConnectorLogs(baseLogPath, now).catch(() => void 0);
+      lastPrunedDate = date;
+    }
+    await rotateConnectorLogIfNeeded(logPath);
+    await appendFile(logPath, line);
+  };
+  const queuedWrite = fileWriteQueue.then(write, write);
+  fileWriteQueue = queuedWrite.catch(() => void 0);
+  return queuedWrite;
+};
 async function writeLog(level, message, metadata) {
   const entry = {
     level,
@@ -421,8 +842,8 @@ async function writeLog(level, message, metadata) {
   pendingLogs.push(entry);
   if (pendingLogs.length > 100) pendingLogs.splice(0, pendingLogs.length - 100);
   const paths = getConnectorPaths(getServerUrl());
-  await mkdir2(paths.configDir, { recursive: true }).catch(() => void 0);
-  await appendFile(paths.logPath, `${JSON.stringify(entry)}
+  await mkdir2(path2.dirname(paths.logPath), { recursive: true }).catch(() => void 0);
+  await appendConnectorLog(paths.logPath, `${JSON.stringify(entry)}
 `).catch(() => void 0);
   const line = `[buda-connector] ${message}`;
   if (level === "error") console.error(line);
@@ -436,6 +857,347 @@ function restorePendingLogs(logs) {
   pendingLogs.unshift(...logs);
 }
 
+// src/terminal.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import path3 from "path";
+import WebSocket, { WebSocketServer } from "ws";
+var TERMINAL_IDLE_TTL_MS = 10 * 6e4;
+var TERMINAL_HANDSHAKE_TIMEOUT_MS = 1e4;
+var LOCAL_TERMINAL_GRANT_TTL_MS = 3e4;
+var LOCAL_TERMINAL_CLOSE_SPAWN_FAILED = 4401;
+var MAX_BUFFER_CHUNKS = 1e3;
+var MAX_TERMINAL_FRAME_BYTES = 1024 * 1024;
+var normalizeTerminalCloseCode = (code, fallback = 1011) => code >= 1e3 && code <= 1014 && ![1004, 1005, 1006].includes(code) || code >= 3e3 && code <= 4999 ? code : fallback;
+var truncateTerminalCloseReason = (reason, maxBytes = 120) => {
+  let result = reason;
+  while (Buffer.byteLength(result, "utf8") > maxBytes) result = result.slice(0, -1);
+  return result;
+};
+var sessions = /* @__PURE__ */ new Map();
+var localGrants = /* @__PURE__ */ new Map();
+var installedServers = /* @__PURE__ */ new WeakSet();
+var isSafeId = (value) => typeof value === "string" && /^[A-Za-z0-9_.:-]{1,160}$/.test(value);
+var parseDimension = (value, fallback, min, max) => typeof value === "number" && Number.isSafeInteger(value) ? Math.max(min, Math.min(max, value)) : fallback;
+var parseConnectorTerminalRequest = (request) => {
+  if (request.method !== "CONNECT" || request.path !== "/api/terminal") {
+    throw new Error("Invalid connector terminal request.");
+  }
+  if (!request.body || typeof request.body !== "object" || Array.isArray(request.body)) {
+    throw new Error("Connector terminal request body is invalid.");
+  }
+  const body = request.body;
+  if (!isSafeId(body.sessionId) || !isSafeId(body.tabId)) {
+    throw new Error("Connector terminal session identity is invalid.");
+  }
+  if (typeof body.token !== "string" || body.token.length < 32 || body.token.length > 2048) {
+    throw new Error("Connector terminal token is invalid.");
+  }
+  return {
+    sessionId: body.sessionId,
+    tabId: body.tabId,
+    token: body.token,
+    cols: parseDimension(body.cols, 80, 10, 500),
+    rows: parseDimension(body.rows, 24, 5, 200)
+  };
+};
+var clearIdleTimer = (session) => {
+  if (!session.idleTimer) return;
+  clearTimeout(session.idleTimer);
+  session.idleTimer = null;
+};
+var scheduleIdleCleanup = (sessionKey, session) => {
+  clearIdleTimer(session);
+  session.idleTimer = setTimeout(() => {
+    if (session.clients.size > 0 || sessions.get(sessionKey) !== session) return;
+    sessions.delete(sessionKey);
+    try {
+      session.pty.kill();
+    } catch {
+    }
+  }, TERMINAL_IDLE_TTL_MS);
+  session.idleTimer.unref();
+};
+var sendJson = (socket, value) => {
+  if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(value));
+};
+var LocalTerminalUnavailableError = class extends Error {
+};
+var serializeErrorMessage = (error) => error instanceof Error ? error.message : "Unknown error";
+var createTerminalSession = async (grant, nodePtyLoader) => {
+  let nodePty;
+  try {
+    nodePty = await nodePtyLoader();
+  } catch (error) {
+    void writeLog(
+      "error",
+      `local terminal could not load node-pty: ${serializeErrorMessage(error)}`
+    );
+    throw new LocalTerminalUnavailableError(
+      "Local terminal is unavailable because node-pty could not be loaded. The connector remains available for other capabilities."
+    );
+  }
+  const shell = process.platform === "win32" ? "powershell.exe" : process.env.SHELL || "/bin/bash";
+  const shellArgs = process.platform === "win32" ? [] : ["-l"];
+  let pty;
+  try {
+    pty = nodePty.spawn(shell, shellArgs, {
+      name: "xterm-256color",
+      cols: grant.cols,
+      rows: grant.rows,
+      cwd: path3.resolve(grant.cwd),
+      env: { ...process.env, TERM: "xterm-256color" }
+    });
+  } catch (error) {
+    const message = serializeErrorMessage(error);
+    void writeLog(
+      "error",
+      `local terminal failed to spawn shell=${shell} cwd=${grant.cwd}: ${message}`
+    );
+    throw new LocalTerminalUnavailableError(
+      "Local terminal is unavailable because node-pty could not start a shell. The connector remains available for other capabilities."
+    );
+  }
+  const session = {
+    pty,
+    clients: /* @__PURE__ */ new Set(),
+    buffer: [],
+    cols: grant.cols,
+    rows: grant.rows,
+    idleTimer: null
+  };
+  sessions.set(grant.sessionKey, session);
+  pty.onData((data) => {
+    session.buffer.push(data);
+    if (session.buffer.length > MAX_BUFFER_CHUNKS) session.buffer.shift();
+    for (const socket of session.clients) {
+      if (socket.readyState === WebSocket.OPEN) socket.send(data);
+    }
+  });
+  pty.onExit(({ exitCode }) => {
+    if (sessions.get(grant.sessionKey) === session) sessions.delete(grant.sessionKey);
+    clearIdleTimer(session);
+    for (const socket of session.clients) {
+      sendJson(socket, { type: "status", message: `exited (code ${exitCode})` });
+      socket.close(1e3, "Terminal exited");
+    }
+    session.clients.clear();
+  });
+  return session;
+};
+var attachLocalTerminal = async (socket, grant, nodePtyLoader) => {
+  const pendingMessages = [];
+  let session;
+  let started = false;
+  const handleMessage = (data) => {
+    if (!session) {
+      pendingMessages.push(data);
+      return;
+    }
+    try {
+      const message = JSON.parse(data);
+      if (message.type === "bridge-start") {
+        if (!started) {
+          started = true;
+          sendJson(socket, { type: "status", message: "connected" });
+          for (const chunk of session.buffer) socket.send(chunk);
+        }
+        return;
+      }
+      if (message.type === "input" && typeof message.data === "string") {
+        session.pty.write(message.data);
+        return;
+      }
+      if (message.type === "resize") {
+        const cols = parseDimension(message.cols, session.cols, 10, 500);
+        const rows = parseDimension(message.rows, session.rows, 5, 200);
+        if (cols !== session.cols || rows !== session.rows) {
+          session.cols = cols;
+          session.rows = rows;
+          session.pty.resize(cols, rows);
+        }
+        return;
+      }
+    } catch {
+    }
+    session.pty.write(data);
+  };
+  socket.on("message", (raw) => handleMessage(raw.toString()));
+  session = sessions.get(grant.sessionKey);
+  if (!session) session = await createTerminalSession(grant, nodePtyLoader);
+  else clearIdleTimer(session);
+  session.clients.add(socket);
+  for (const data of pendingMessages.splice(0)) handleMessage(data);
+  const detach = () => {
+    if (!session) return;
+    session.clients.delete(socket);
+    if (session.clients.size === 0) scheduleIdleCleanup(grant.sessionKey, session);
+  };
+  socket.once("close", detach);
+  socket.once("error", detach);
+};
+var installConnectorTerminalEndpoint = (server, options = {}) => {
+  if (installedServers.has(server)) return;
+  installedServers.add(server);
+  const terminalServer = new WebSocketServer({ noServer: true });
+  server.on("upgrade", (request, socket, head) => {
+    const url = new URL(request.url ?? "/", "http://connector.local");
+    if (url.pathname !== "/api/terminal") return;
+    const tokenHeader = request.headers["x-buda-local-terminal-token"];
+    const token = Array.isArray(tokenHeader) ? tokenHeader[0] : tokenHeader;
+    const grant = token ? localGrants.get(token) : void 0;
+    if (!token || !grant || grant.expiresAt <= Date.now()) {
+      if (token) localGrants.delete(token);
+      socket.destroy();
+      return;
+    }
+    localGrants.delete(token);
+    terminalServer.handleUpgrade(request, socket, head, (client) => {
+      void attachLocalTerminal(
+        client,
+        grant,
+        options.nodePtyLoader ?? (() => import("./lib-UX6C35VI.js"))
+      ).catch((error) => {
+        const message = error instanceof LocalTerminalUnavailableError ? error.message : "Local terminal is unavailable. The connector remains available for other capabilities.";
+        sendJson(client, { type: "error", fatal: true, message });
+        client.close(LOCAL_TERMINAL_CLOSE_SPAWN_FAILED, "Local terminal unavailable");
+      });
+    });
+  });
+  server.once("close", () => {
+    for (const client of terminalServer.clients) client.terminate();
+    terminalServer.close();
+    localGrants.clear();
+    for (const session of sessions.values()) {
+      clearIdleTimer(session);
+      try {
+        session.pty.kill();
+      } catch {
+      }
+    }
+    sessions.clear();
+  });
+};
+var registerLocalTerminal = (input) => {
+  if (!isSafeId(input.workspaceKey) || !isSafeId(input.tabId)) {
+    throw new Error("Invalid local terminal workspace session.");
+  }
+  const token = randomBytes2(32).toString("base64url");
+  localGrants.set(token, {
+    sessionKey: `${input.workspaceKey}:${input.tabId}`,
+    workspaceKey: input.workspaceKey,
+    cwd: input.cwd,
+    cols: input.cols,
+    rows: input.rows,
+    expiresAt: Date.now() + LOCAL_TERMINAL_GRANT_TTL_MS
+  });
+  const cleanupTimer = setTimeout(() => localGrants.delete(token), LOCAL_TERMINAL_GRANT_TTL_MS);
+  cleanupTimer.unref();
+  return token;
+};
+var toLocalTerminalUrl = (baseUrl) => {
+  const url = new URL("/api/terminal", baseUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  return url.toString();
+};
+var connectSocket = async (socket) => new Promise((resolve, reject) => {
+  const onOpen = () => {
+    socket.removeListener("error", onError);
+    resolve();
+  };
+  const onError = (error) => {
+    socket.removeListener("open", onOpen);
+    reject(error);
+  };
+  socket.once("open", onOpen);
+  socket.once("error", onError);
+});
+var proxyConnectorTerminalTunnel = async (input) => {
+  const cloud = new WebSocket(
+    getConnectorTerminalUrl(input.serverUrl, input.connectorId, input.sessionId),
+    {
+      headers: { "X-Buda-Terminal-Token": input.cloudToken },
+      handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
+    }
+  );
+  const local = new WebSocket(toLocalTerminalUrl(input.localBaseUrl), {
+    headers: { "X-Buda-Local-Terminal-Token": input.localToken },
+    handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
+  });
+  try {
+    await Promise.all([connectSocket(cloud), connectSocket(local)]);
+  } catch (error) {
+    cloud.terminate();
+    local.terminate();
+    throw error;
+  }
+  let bridgeAccepted = false;
+  let pendingBytes = 0;
+  const pendingCloudFrames = [];
+  const pendingLocalFrames = [];
+  const bufferFrame = (frames, data, isBinary) => {
+    const bytes = Array.isArray(data) ? data.reduce((total, chunk) => total + chunk.byteLength, 0) : data.byteLength;
+    if (pendingBytes + bytes > MAX_TERMINAL_FRAME_BYTES) {
+      cloud.close(1009, "Terminal handshake buffer too large");
+      local.close(1009, "Terminal handshake buffer too large");
+      return false;
+    }
+    pendingBytes += bytes;
+    frames.push([data, isBinary]);
+    return true;
+  };
+  cloud.on("message", (data, isBinary) => {
+    if (!bridgeAccepted) {
+      if (!isBinary && data.toString() === '{"type":"bridge-accepted"}') {
+        bridgeAccepted = true;
+        local.send(JSON.stringify({ type: "bridge-start" }));
+        for (const [frame, binary] of pendingCloudFrames) {
+          if (local.readyState === WebSocket.OPEN) local.send(frame, { binary });
+        }
+        for (const [frame, binary] of pendingLocalFrames) {
+          if (cloud.readyState === WebSocket.OPEN) cloud.send(frame, { binary });
+        }
+        pendingCloudFrames.length = 0;
+        pendingLocalFrames.length = 0;
+        pendingBytes = 0;
+        return;
+      }
+      bufferFrame(pendingCloudFrames, data, isBinary);
+      return;
+    }
+    if (local.readyState === WebSocket.OPEN) local.send(data, { binary: isBinary });
+  });
+  local.on("message", (data, isBinary) => {
+    if (!bridgeAccepted) {
+      bufferFrame(pendingLocalFrames, data, isBinary);
+      return;
+    }
+    if (cloud.readyState === WebSocket.OPEN) cloud.send(data, { binary: isBinary });
+  });
+  cloud.once("close", (code, reason) => {
+    if (!bridgeAccepted) {
+      void writeLog(
+        "warn",
+        `terminal cloud tunnel closed before readiness session=${input.sessionId} code=${code} reason=${truncateTerminalCloseReason(reason.toString())}`
+      );
+    }
+    if (local.readyState === WebSocket.OPEN) {
+      local.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
+    }
+  });
+  local.once("close", (code, reason) => {
+    if (cloud.readyState === WebSocket.OPEN) {
+      cloud.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
+    }
+  });
+  cloud.once("error", () => local.terminate());
+  local.once("error", () => cloud.terminate());
+  cloud.send(JSON.stringify({ type: "bridge-ready" }));
+  await writeLog(
+    "info",
+    `terminal proxy connected session=${input.sessionId} workspace=${input.workspaceKey}`
+  );
+};
+
 // src/bunny-daemon.ts
 async function startEmbeddedBunnyDaemon(config, launchConfig) {
   const host = getBunnyDaemonHost(launchConfig);
@@ -443,6 +1205,7 @@ async function startEmbeddedBunnyDaemon(config, launchConfig) {
   const root = config.workdirRoot;
   await mkdir3(root, { recursive: true });
   const server = createDaemon({ host, port, root });
+  installConnectorTerminalEndpoint(server);
   await new Promise((resolve, reject) => {
     const onError = (error) => {
       server.off("listening", onListening);
@@ -485,11 +1248,11 @@ import { platform as platform3, release } from "os";
 import { accessSync, constants, statSync } from "fs";
 import { mkdir as mkdir4 } from "fs/promises";
 import { platform as getPlatform, homedir as homedir2 } from "os";
-import path2 from "path";
+import path4 from "path";
 var DEFAULT_VIEWPORT = { width: 1280, height: 800 };
 var MAX_SCREENCAST_DIMENSION = 2560;
 var SESSION_ID_PATTERN = /^[A-Za-z0-9_.:-]{1,320}$/;
-var sessions = /* @__PURE__ */ new Map();
+var sessions2 = /* @__PURE__ */ new Map();
 var sessionPromises = /* @__PURE__ */ new Map();
 var getBrowserMode = () => {
   const configured = process.env.BUDA_CONNECTOR_BROWSER_MODE?.trim().toLowerCase();
@@ -605,7 +1368,7 @@ var normalizeSessionId = (value) => {
   return SESSION_ID_PATTERN.test(normalized) ? normalized : null;
 };
 async function ensureSession(sessionId, initialViewport = DEFAULT_VIEWPORT) {
-  const activeSession = sessions.get(sessionId);
+  const activeSession = sessions2.get(sessionId);
   if (activeSession) return activeSession;
   let sessionPromise = sessionPromises.get(sessionId);
   if (!sessionPromise) {
@@ -624,9 +1387,9 @@ async function ensureSession(sessionId, initialViewport = DEFAULT_VIEWPORT) {
         navigationQueue: Promise.resolve(),
         clientIds: /* @__PURE__ */ new Set()
       };
-      sessions.set(sessionId, nextSession);
+      sessions2.set(sessionId, nextSession);
       browser.on("disconnected", () => {
-        if (sessions.get(sessionId) === nextSession) sessions.delete(sessionId);
+        if (sessions2.get(sessionId) === nextSession) sessions2.delete(sessionId);
       });
       return nextSession;
     })();
@@ -671,9 +1434,9 @@ async function stopScreencast(s) {
   s.isScreencasting = false;
 }
 async function closeSession(sessionId) {
-  const activeSession = sessions.get(sessionId) ?? await sessionPromises.get(sessionId)?.catch(() => null);
+  const activeSession = sessions2.get(sessionId) ?? await sessionPromises.get(sessionId)?.catch(() => null);
   if (!activeSession) return;
-  if (sessions.get(sessionId) === activeSession) sessions.delete(sessionId);
+  if (sessions2.get(sessionId) === activeSession) sessions2.delete(sessionId);
   await stopScreencast(activeSession);
   await activeSession.cdpSession.detach().catch(() => {
   });
@@ -682,7 +1445,7 @@ async function closeSession(sessionId) {
   await writeLog("info", `browser session stopped ${sessionId}`);
 }
 async function closeAllBrowserSessions() {
-  const sessionIds = /* @__PURE__ */ new Set([...sessions.keys(), ...sessionPromises.keys()]);
+  const sessionIds = /* @__PURE__ */ new Set([...sessions2.keys(), ...sessionPromises.keys()]);
   await Promise.all([...sessionIds].map((sessionId) => closeSession(sessionId)));
 }
 async function resizeBrowser(s, viewport) {
@@ -791,15 +1554,15 @@ var resolveScreenshotPath = (workdirRoot, filePath) => {
   if (!workdirRoot) throw new Error("Connector workdir is unavailable for screenshots.");
   const raw = typeof filePath === "string" ? filePath.trim() : "";
   if (!raw) throw new Error("file_path is required");
-  const agentRoot = path2.resolve(workdirRoot, "agent");
+  const agentRoot = path4.resolve(workdirRoot, "agent");
   const relativeInput = raw === "/agent" ? "" : raw.startsWith("/agent/") ? raw.slice(7) : raw;
-  const absolutePath = path2.resolve(agentRoot, relativeInput);
-  if (absolutePath === agentRoot || !absolutePath.startsWith(`${agentRoot}${path2.sep}`)) {
+  const absolutePath = path4.resolve(agentRoot, relativeInput);
+  if (absolutePath === agentRoot || !absolutePath.startsWith(`${agentRoot}${path4.sep}`)) {
     throw new Error("file_path must stay under the connector agent drive");
   }
   return {
     absolutePath,
-    relativePath: path2.relative(agentRoot, absolutePath).split(path2.sep).join("/")
+    relativePath: path4.relative(agentRoot, absolutePath).split(path4.sep).join("/")
   };
 };
 async function handleBrowserRequest(requestPath, method, body, context = {}) {
@@ -834,7 +1597,7 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
     const input = body ?? {};
     const clientId = normalizeSessionId(input.clientId);
     if (!clientId) return jsonResponse(400, { ok: false, error: "valid client id required" });
-    const s = sessions.get(sessionId);
+    const s = sessions2.get(sessionId);
     if (!s) return jsonResponse(200, { ok: true, closed: false });
     s.clientIds.delete(clientId);
     if (s.clientIds.size > 0) return jsonResponse(200, { ok: true, closed: false });
@@ -915,7 +1678,7 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
     const input = body ?? {};
     const s = await ensureSession(sessionId);
     const screenshotPath = resolveScreenshotPath(context.workdirRoot, input.file_path);
-    await mkdir4(path2.dirname(screenshotPath.absolutePath), { recursive: true });
+    await mkdir4(path4.dirname(screenshotPath.absolutePath), { recursive: true });
     await s.page.screenshot({
       path: screenshotPath.absolutePath,
       fullPage: input.fullPage !== false
@@ -943,7 +1706,7 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
     return jsonResponse(200, { ok: true });
   }
   if (route === "location" && method === "GET") {
-    const s = sessions.get(sessionId);
+    const s = sessions2.get(sessionId);
     if (!s) return jsonResponse(200, { ok: true, url: "", title: "" });
     return jsonResponse(200, { ok: true, ...await getPageResult(s) });
   }
@@ -974,7 +1737,7 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
           if (s.screencastClients.size === 0) void stopScreencast(s);
         };
         checkInterval = setInterval(() => {
-          if (sessions.get(sessionId) !== s) {
+          if (sessions2.get(sessionId) !== s) {
             cleanup();
             controller.close();
           }
@@ -999,15 +1762,15 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
 // src/bundled.ts
 import { createHash as createHash3 } from "crypto";
 import { cpSync, existsSync, rmSync } from "fs";
-import { readdir, readFile as readFile3 } from "fs/promises";
-import path3 from "path";
+import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
+import path5 from "path";
 import { fileURLToPath } from "url";
-var PKG_ROOT = path3.resolve(fileURLToPath(import.meta.url), "../..");
-var BUNDLED_DIR = path3.join(PKG_ROOT, "agent-templates");
-var SYSTEM_SKILLS_DIR = path3.join(BUNDLED_DIR, "system-skills");
-var SCRIPTS_DIR = path3.join(BUNDLED_DIR, "scripts");
-var SHARED_DIR = path3.join(BUNDLED_DIR, "shared");
-var MONOREPO_SRC = path3.resolve(PKG_ROOT, "../buda/agent-templates");
+var PKG_ROOT = path5.resolve(fileURLToPath(import.meta.url), "../..");
+var BUNDLED_DIR = path5.join(PKG_ROOT, "agent-templates");
+var SYSTEM_SKILLS_DIR = path5.join(BUNDLED_DIR, "system-skills");
+var SCRIPTS_DIR = path5.join(BUNDLED_DIR, "scripts");
+var SHARED_DIR = path5.join(BUNDLED_DIR, "shared");
+var MONOREPO_SRC = path5.resolve(PKG_ROOT, "../buda/agent-templates");
 function syncTemplatesFromMonorepo() {
   if (!existsSync(MONOREPO_SRC)) {
     throw new Error(`Cannot sync agent-templates: source missing at ${MONOREPO_SRC}`);
@@ -1016,12 +1779,12 @@ function syncTemplatesFromMonorepo() {
   cpSync(MONOREPO_SRC, BUNDLED_DIR, {
     recursive: true,
     dereference: true,
-    filter: (src) => !src.split(path3.sep).includes("extensions")
+    filter: (src) => !src.split(path5.sep).includes("extensions")
   });
 }
 ensureBundledDir();
 function ensureBundledDir() {
-  const missingRequiredTemplate = !existsSync(path3.join(SHARED_DIR, "BOOTSTRAP.md"));
+  const missingRequiredTemplate = !existsSync(path5.join(SHARED_DIR, "BOOTSTRAP.md"));
   if (existsSync(BUNDLED_DIR) && !missingRequiredTemplate) return;
   if (!existsSync(MONOREPO_SRC)) {
     console.warn(
@@ -1035,7 +1798,7 @@ function ensureBundledDir() {
 var cached = null;
 async function readBundledManifest() {
   if (cached) return cached;
-  const systemSkillNames = (await readdir(SYSTEM_SKILLS_DIR, { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  const systemSkillNames = (await readdir2(SYSTEM_SKILLS_DIR, { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
   const version = await hashDir(BUNDLED_DIR);
   cached = {
     version,
@@ -1055,14 +1818,14 @@ async function hashDir(dir) {
   return hash.digest("hex");
 }
 async function walk(dir, visit, base = dir) {
-  const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await readdir2(dir, { withFileTypes: true }).catch(() => []);
   entries.sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
-    const abs = path3.join(dir, entry.name);
+    const abs = path5.join(dir, entry.name);
     if (entry.isDirectory()) {
       await walk(abs, visit, base);
     } else if (entry.isFile()) {
-      await visit(path3.relative(base, abs), abs);
+      await visit(path5.relative(base, abs), abs);
     }
   }
 }
@@ -1239,18 +2002,18 @@ import {
   lstat,
   mkdir as mkdir5,
   open as open2,
-  readdir as readdir2,
+  readdir as readdir3,
   readFile as readFile4,
   readlink,
   realpath,
-  rename as rename2,
+  rename as rename3,
   rm,
   symlink,
-  unlink as unlink3
+  unlink as unlink4
 } from "fs/promises";
-import path4 from "path";
+import path6 from "path";
 var MIGRATION_VERSION = 1;
-var MIGRATION_DIRECTORY = path4.join(".buda", "migrations", "legacy-workspace-v1");
+var MIGRATION_DIRECTORY = path6.join(".buda", "migrations", "legacy-workspace-v1");
 var JOURNAL_FILENAME = "journal.json";
 var IMMUTABLE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 var LEGACY_TEMPLATE_FILES = [
@@ -1295,9 +2058,9 @@ var migrateLegacyWorkspaceRoot = async (storageRoot, options = {}) => {
     );
   }
   const canonicalRoot = await realpath(storageRoot);
-  const migrationDirectory = path4.join(canonicalRoot, MIGRATION_DIRECTORY);
+  const migrationDirectory = path6.join(canonicalRoot, MIGRATION_DIRECTORY);
   await ensurePrivateDirectoryWithin(canonicalRoot, migrationDirectory);
-  const journalPath = path4.join(migrationDirectory, JOURNAL_FILENAME);
+  const journalPath = path6.join(migrationDirectory, JOURNAL_FILENAME);
   let journal = await readJournal(journalPath);
   if (journal) validateJournalPaths(journal, canonicalRoot, migrationDirectory);
   if (journal?.status === "complete") {
@@ -1347,7 +2110,7 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
     await writeJournal(journalPath, journal);
     await checkpoint(options, "before-copy", item.id);
     await rm(item.staging, { recursive: true, force: true });
-    await ensurePrivateDirectoryWithin(storageRoot, path4.dirname(item.staging));
+    await ensurePrivateDirectoryWithin(storageRoot, path6.dirname(item.staging));
     await copyTree(item.source, item.staging, () => checkpoint(options, "during-copy", item.id));
     await checkpoint(options, "after-copy", item.id);
     item.phase = "copied";
@@ -1369,9 +2132,9 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
   }
   if (item.phase === "verified") {
     await checkpoint(options, "before-rename", item.id);
-    await ensurePrivateDirectoryWithin(storageRoot, path4.dirname(item.target));
-    await rename2(item.staging, item.target);
-    await syncDirectory(path4.dirname(item.target));
+    await ensurePrivateDirectoryWithin(storageRoot, path6.dirname(item.target));
+    await rename3(item.staging, item.target);
+    await syncDirectory(path6.dirname(item.target));
     await checkpoint(options, "after-rename", item.id);
     item.phase = "committed";
     await writeJournal(journalPath, journal);
@@ -1402,12 +2165,12 @@ var createJournal = async (storageRoot, migrationDirectory, owner) => {
   const ownership = owner ? "explicit-owner" : "shared-legacy";
   const label = owner ? `Legacy Connector root assigned to ${owner.spaceId}/${owner.agentId}` : "Shared legacy Connector root (ownership unassigned)";
   const sources = await inventoryLegacySources(storageRoot);
-  const stagingRoot = path4.join(migrationDirectory, "staging", randomUUID2());
+  const stagingRoot = path6.join(migrationDirectory, "staging", randomUUID2());
   const items = sources.map(({ id, source }) => ({
     id,
     source,
     target: deriveTarget(storageRoot, id, owner),
-    staging: path4.join(stagingRoot, id),
+    staging: path6.join(stagingRoot, id),
     phase: "pending"
   }));
   assertDistinctTargets(items);
@@ -1424,24 +2187,24 @@ var createJournal = async (storageRoot, migrationDirectory, owner) => {
   };
 };
 var inventoryLegacySources = async (storageRoot) => {
-  const rootEntries = await readdir2(storageRoot, { withFileTypes: true });
+  const rootEntries = await readdir3(storageRoot, { withFileTypes: true });
   const templateNames = new Set(LEGACY_TEMPLATE_FILES);
   for (const entry of rootEntries) {
     if (entry.name.endsWith(".md")) templateNames.add(entry.name);
   }
   const candidates = [
-    { id: "agent", source: path4.join(storageRoot, "agent") },
-    { id: "space", source: path4.join(storageRoot, "space") },
-    { id: "logs", source: path4.join(storageRoot, "logs") },
-    { id: "connector-log", source: path4.join(storageRoot, "connector.log") },
-    { id: "runtime-config", source: path4.join(storageRoot, "runtime-config") },
-    { id: "runtime-config-hidden", source: path4.join(storageRoot, ".runtime-config") },
-    { id: "runtime-config-file", source: path4.join(storageRoot, "runtime-config.json") },
-    { id: "runtime-config-hidden-file", source: path4.join(storageRoot, ".runtime-config.json") },
-    { id: "bunny-runtime", source: path4.join(storageRoot, ".bunny") },
+    { id: "agent", source: path6.join(storageRoot, "agent") },
+    { id: "space", source: path6.join(storageRoot, "space") },
+    { id: "logs", source: path6.join(storageRoot, "logs") },
+    { id: "connector-log", source: path6.join(storageRoot, "connector.log") },
+    { id: "runtime-config", source: path6.join(storageRoot, "runtime-config") },
+    { id: "runtime-config-hidden", source: path6.join(storageRoot, ".runtime-config") },
+    { id: "runtime-config-file", source: path6.join(storageRoot, "runtime-config.json") },
+    { id: "runtime-config-hidden-file", source: path6.join(storageRoot, ".runtime-config.json") },
+    { id: "bunny-runtime", source: path6.join(storageRoot, ".bunny") },
     ...[...templateNames].sort().map((name) => ({
       id: `template-${name}`,
-      source: path4.join(storageRoot, name)
+      source: path6.join(storageRoot, name)
     }))
   ];
   const found = [];
@@ -1454,29 +2217,29 @@ var inventoryLegacySources = async (storageRoot) => {
         `Legacy migration source ${candidate.id} must not be a symbolic link`
       );
     }
-    if (info.isDirectory() && (await readdir2(candidate.source)).length === 0) continue;
+    if (info.isDirectory() && (await readdir3(candidate.source)).length === 0) continue;
     found.push(candidate);
   }
   return found;
 };
 var deriveTarget = (storageRoot, id, owner) => {
-  if (!owner) return path4.join(storageRoot, ".buda", "legacy", "shared", id);
-  const spaceRoot = path4.join(storageRoot, ".buda", "spaces", owner.spaceId);
-  const agentRoot = path4.join(spaceRoot, "agents", owner.agentId);
-  if (id === "agent") return path4.join(agentRoot, "workspace", "legacy-connector-root");
-  if (id === "space") return path4.join(spaceRoot, "shared", "legacy-connector-root");
+  if (!owner) return path6.join(storageRoot, ".buda", "legacy", "shared", id);
+  const spaceRoot = path6.join(storageRoot, ".buda", "spaces", owner.spaceId);
+  const agentRoot = path6.join(spaceRoot, "agents", owner.agentId);
+  if (id === "agent") return path6.join(agentRoot, "workspace", "legacy-connector-root");
+  if (id === "space") return path6.join(spaceRoot, "shared", "legacy-connector-root");
   if (id.startsWith("template-")) {
-    return path4.join(spaceRoot, "shared", "legacy-templates", id.slice("template-".length));
+    return path6.join(spaceRoot, "shared", "legacy-templates", id.slice("template-".length));
   }
-  return path4.join(agentRoot, "state", "legacy-connector-root", id);
+  return path6.join(agentRoot, "state", "legacy-connector-root", id);
 };
 var copyTree = async (source, destination, onEntryCopied) => {
   const info = await lstat(source);
   if (info.isDirectory()) {
     await mkdir5(destination, { mode: info.mode & 4095 });
-    const entries = (await readdir2(source)).sort();
+    const entries = (await readdir3(source)).sort();
     for (const entry of entries) {
-      await copyTree(path4.join(source, entry), path4.join(destination, entry), onEntryCopied);
+      await copyTree(path6.join(source, entry), path6.join(destination, entry), onEntryCopied);
     }
     await chmod2(destination, info.mode & 4095);
     return;
@@ -1511,8 +2274,8 @@ var verifyTree = async (source, destination) => {
   }
   if (sourceInfo.isDirectory()) {
     const [sourceEntries, destinationEntries] = await Promise.all([
-      readdir2(source),
-      readdir2(destination)
+      readdir3(source),
+      readdir3(destination)
     ]);
     sourceEntries.sort();
     destinationEntries.sort();
@@ -1520,7 +2283,7 @@ var verifyTree = async (source, destination) => {
       throw verifyFailure("directory entries differ");
     }
     for (const entry of sourceEntries) {
-      await verifyTree(path4.join(source, entry), path4.join(destination, entry));
+      await verifyTree(path6.join(source, entry), path6.join(destination, entry));
     }
     return;
   }
@@ -1567,7 +2330,7 @@ var readJournal = async (journalPath) => {
 };
 var writeJournal = async (journalPath, journal) => {
   journal.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  await ensurePrivateDirectory(path4.dirname(journalPath));
+  await ensurePrivateDirectory(path6.dirname(journalPath));
   const temporaryPath = `${journalPath}.${process.pid}.${randomUUID2()}.tmp`;
   const handle = await open2(
     temporaryPath,
@@ -1582,11 +2345,11 @@ var writeJournal = async (journalPath, journal) => {
     await handle.close();
   }
   try {
-    await rename2(temporaryPath, journalPath);
+    await rename3(temporaryPath, journalPath);
     await chmod2(journalPath, 384);
-    await syncDirectory(path4.dirname(journalPath));
+    await syncDirectory(path6.dirname(journalPath));
   } finally {
-    await unlink3(temporaryPath).catch(() => void 0);
+    await unlink4(temporaryPath).catch(() => void 0);
   }
 };
 var syncDirectory = async (directory) => {
@@ -1614,10 +2377,10 @@ var ensurePrivateDirectoryWithin = async (storageRoot, directory) => {
   if (directory !== storageRoot && !isPathInside(storageRoot, directory)) {
     throw corrupt("Legacy migration control path escapes protected storage");
   }
-  const relative = path4.relative(storageRoot, directory);
+  const relative = path6.relative(storageRoot, directory);
   let current = storageRoot;
-  for (const segment of relative.split(path4.sep).filter(Boolean)) {
-    current = path4.join(current, segment);
+  for (const segment of relative.split(path6.sep).filter(Boolean)) {
+    current = path6.join(current, segment);
     await ensurePrivateDirectory(current);
   }
 };
@@ -1642,7 +2405,7 @@ var validateJournalPaths = (journal, storageRoot, migrationDirectory) => {
   const stagingPaths = /* @__PURE__ */ new Set();
   for (const item of journal.items) {
     const sourceRelative = sourceRelativePath(item.id);
-    if (!sourceRelative || item.source !== path4.join(storageRoot, sourceRelative)) {
+    if (!sourceRelative || item.source !== path6.join(storageRoot, sourceRelative)) {
       throw corrupt("Legacy migration journal contains an unexpected source path");
     }
     if (item.target !== deriveTarget(storageRoot, item.id, journal.owner)) {
@@ -1651,8 +2414,8 @@ var validateJournalPaths = (journal, storageRoot, migrationDirectory) => {
     if (!isPathInside(migrationDirectory, item.staging)) {
       throw corrupt("Legacy migration journal staging path escapes the migration directory");
     }
-    const stagingParent = path4.dirname(item.staging);
-    if (path4.dirname(stagingParent) !== path4.join(migrationDirectory, "staging") || item.staging !== path4.join(stagingParent, item.id)) {
+    const stagingParent = path6.dirname(item.staging);
+    if (path6.dirname(stagingParent) !== path6.join(migrationDirectory, "staging") || item.staging !== path6.join(stagingParent, item.id)) {
       throw corrupt("Legacy migration journal staging path is not canonical");
     }
     stagingParents.add(stagingParent);
@@ -1682,7 +2445,7 @@ var sourceRelativePath = (id) => {
   if (known[id]) return known[id];
   if (!id.startsWith("template-")) return null;
   const name = id.slice("template-".length);
-  return name.endsWith(".md") && path4.basename(name) === name ? name : null;
+  return name.endsWith(".md") && path6.basename(name) === name ? name : null;
 };
 var validateJournalOwnership = (journal) => {
   if (journal.ownership === "explicit-owner") {
@@ -1755,8 +2518,8 @@ var exists = async (filePath) => {
   }
 };
 var isPathInside = (parent, child) => {
-  const relative = path4.relative(parent, child);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative);
+  const relative = path6.relative(parent, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path6.sep}`) && !path6.isAbsolute(relative);
 };
 var isMissing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
 var isAlreadyExists2 = (error) => error instanceof Error && "code" in error && error.code === "EEXIST";
@@ -1768,9 +2531,9 @@ var corrupt = (message) => new LegacyWorkspaceMigrationError("MIGRATION_CORRUPT"
 var errorMessage = (error) => error instanceof Error ? error.message : String(error);
 
 // src/relay.ts
-import path6 from "path";
+import path8 from "path";
 import { createNextHandler } from "@bunny-agent/daemon/nextjs";
-import WebSocket from "ws";
+import WebSocket2 from "ws";
 
 // src/execution-identity.ts
 import {
@@ -1941,14 +2704,14 @@ import {
   copyFile as copyFile2,
   lstat as lstat2,
   mkdir as mkdir6,
-  readdir as readdir3,
+  readdir as readdir4,
   readFile as readFile5,
   realpath as realpath2,
   rm as rm2,
   symlink as symlink2,
   writeFile as writeFile2
 } from "fs/promises";
-import path5 from "path";
+import path7 from "path";
 var MOUNT_DIRECTORY = "mount";
 var ARCHIVE_MARKER = "archived.json";
 var AGENT_CONTEXT_TEMPLATE_FILES = [
@@ -1960,8 +2723,8 @@ var AGENT_CONTEXT_TEMPLATE_FILES = [
   "BOOTSTRAP.md",
   "MEMORY.md"
 ];
-var deriveSystemVolume = (descriptor) => path5.join(
-  path5.dirname(path5.dirname(path5.dirname(path5.dirname(descriptor.sharedVolume)))),
+var deriveSystemVolume = (descriptor) => path7.join(
+  path7.dirname(path7.dirname(path7.dirname(path7.dirname(descriptor.sharedVolume)))),
   "system"
 );
 var WorkspaceVolumeLifecycle = class {
@@ -1973,14 +2736,14 @@ var WorkspaceVolumeLifecycle = class {
   async mount() {
     await this.ensureVolumes();
     await this.bootstrapAgentTemplates((await readBundledManifest()).sharedDir);
-    const mountRoot = path5.join(this.descriptor.stateVolume, MOUNT_DIRECTORY);
+    const mountRoot = path7.join(this.descriptor.stateVolume, MOUNT_DIRECTORY);
     await mkdir6(mountRoot, { recursive: true, mode: 448 });
     const mounts = {
       mountRoot,
-      agent: path5.join(mountRoot, "agent"),
-      space: path5.join(mountRoot, "space"),
-      system: path5.join(mountRoot, "system"),
-      temporary: path5.join(mountRoot, "tmp")
+      agent: path7.join(mountRoot, "agent"),
+      space: path7.join(mountRoot, "space"),
+      system: path7.join(mountRoot, "system"),
+      temporary: path7.join(mountRoot, "tmp")
     };
     await Promise.all([
       ensureVolumeLink(this.descriptor.privateVolume, mounts.agent),
@@ -1988,18 +2751,18 @@ var WorkspaceVolumeLifecycle = class {
       ensureVolumeLink(this.systemVolume, mounts.system),
       ensureVolumeLink(this.descriptor.temporaryVolume, mounts.temporary)
     ]);
-    const daemonVolumes = path5.join(mountRoot, "volumes");
+    const daemonVolumes = path7.join(mountRoot, "volumes");
     await mkdir6(daemonVolumes, { recursive: true, mode: 448 });
     await Promise.all([
-      ensureVolumeLink(this.descriptor.privateVolume, path5.join(daemonVolumes, "agent")),
-      ensureVolumeLink(this.descriptor.sharedVolume, path5.join(daemonVolumes, "space")),
-      ensureVolumeLink(this.systemVolume, path5.join(daemonVolumes, "system")),
-      ensureVolumeLink(this.descriptor.temporaryVolume, path5.join(daemonVolumes, "tmp"))
+      ensureVolumeLink(this.descriptor.privateVolume, path7.join(daemonVolumes, "agent")),
+      ensureVolumeLink(this.descriptor.sharedVolume, path7.join(daemonVolumes, "space")),
+      ensureVolumeLink(this.systemVolume, path7.join(daemonVolumes, "system")),
+      ensureVolumeLink(this.descriptor.temporaryVolume, path7.join(daemonVolumes, "tmp"))
     ]);
     return mounts;
   }
   async unmount() {
-    await rm2(path5.join(this.descriptor.stateVolume, MOUNT_DIRECTORY), {
+    await rm2(path7.join(this.descriptor.stateVolume, MOUNT_DIRECTORY), {
       recursive: true,
       force: true
     });
@@ -2008,33 +2771,33 @@ var WorkspaceVolumeLifecycle = class {
     await this.unmount();
     await mkdir6(this.descriptor.stateVolume, { recursive: true, mode: 448 });
     await writeFile2(
-      path5.join(this.descriptor.stateVolume, ARCHIVE_MARKER),
+      path7.join(this.descriptor.stateVolume, ARCHIVE_MARKER),
       `${JSON.stringify({ archivedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
       { encoding: "utf8", mode: 384 }
     );
   }
   async restoreAgent() {
-    await rm2(path5.join(this.descriptor.stateVolume, ARCHIVE_MARKER), { force: true });
+    await rm2(path7.join(this.descriptor.stateVolume, ARCHIVE_MARKER), { force: true });
     return this.mount();
   }
   async deleteAgent(options) {
     requireConfirmation(options);
     await this.unmount();
-    const agentRoot = path5.dirname(this.descriptor.privateVolume);
+    const agentRoot = path7.dirname(this.descriptor.privateVolume);
     await rm2(agentRoot, { recursive: true, force: true });
   }
   async archiveSpace() {
     await mkdir6(this.descriptor.sharedVolume, { recursive: true, mode: 448 });
     await writeFile2(
-      path5.join(this.descriptor.sharedVolume, ARCHIVE_MARKER),
+      path7.join(this.descriptor.sharedVolume, ARCHIVE_MARKER),
       `${JSON.stringify({ archivedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
       { encoding: "utf8", mode: 384 }
     );
   }
   async restoreSpace() {
-    await rm2(path5.join(this.descriptor.sharedVolume, ARCHIVE_MARKER), { force: true });
+    await rm2(path7.join(this.descriptor.sharedVolume, ARCHIVE_MARKER), { force: true });
   }
   async deleteSpace(options) {
     requireConfirmation(options);
@@ -2046,11 +2809,11 @@ var WorkspaceVolumeLifecycle = class {
     const bootstrapped = [];
     const skipped = [];
     const entries = new Set(
-      (await readdir3(templateDirectory, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile()).map((entry) => entry.name)
+      (await readdir4(templateDirectory, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile()).map((entry) => entry.name)
     );
     for (const filename of AGENT_CONTEXT_TEMPLATE_FILES) {
       if (!entries.has(filename)) continue;
-      const destination = path5.join(this.descriptor.privateVolume, filename);
+      const destination = path7.join(this.descriptor.privateVolume, filename);
       try {
         await lstat2(destination);
         skipped.push(filename);
@@ -2058,7 +2821,7 @@ var WorkspaceVolumeLifecycle = class {
         if (!isMissingFile(error)) throw error;
         try {
           await copyFile2(
-            path5.join(templateDirectory, filename),
+            path7.join(templateDirectory, filename),
             destination,
             constants3.COPYFILE_EXCL
           );
@@ -2121,6 +2884,20 @@ var RELAY_RECONNECT_JITTER = 0.2;
 var RELAY_FAST_RECONNECT_MS = 500;
 var CONNECTOR_SOCKET_REPLACED_CLOSE_CODE = 4001;
 var CONNECTOR_SOCKET_REVOKED_CLOSE_CODE = 4003;
+var SAFE_TRACE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var getBudaCodingRunSessionId = (body) => {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record = body;
+  for (const key of ["systemEnv", "env"]) {
+    const env = record[key];
+    if (!env || typeof env !== "object" || Array.isArray(env)) continue;
+    const value = env.BUDA_SESSION_ID;
+    if (typeof value !== "string") continue;
+    const normalized = value.trim();
+    if (SAFE_TRACE_ID_PATTERN.test(normalized)) return normalized;
+  }
+  return void 0;
+};
 var shouldReconnectConnectorRelay = (closeCode) => closeCode !== CONNECTOR_SOCKET_REPLACED_CLOSE_CODE && closeCode !== CONNECTOR_SOCKET_REVOKED_CLOSE_CODE;
 var getConnectorRelayReconnectBaseDelay = (hadOpenConnection, backoffMs) => hadOpenConnection ? RELAY_FAST_RECONNECT_MS : backoffMs;
 var formatConnectorRelayError = (error, depth = 0) => {
@@ -2145,6 +2922,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
   let pingTimer = null;
   let pongTimer = null;
   let stopped = false;
+  let suspendedForAccessRevocation = false;
   let reconnectDelayMs = RELAY_RECONNECT_INTERVAL_MS;
   let hadOpenConnection = false;
   let activeRelayProtocol = relayProtocol;
@@ -2171,7 +2949,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     return Math.max(reconnectingEstablishedSocket ? 250 : 500, Math.round(base + jitter));
   };
   const scheduleReconnect = (reason) => {
-    if (stopped || reconnectTimer) return;
+    if (stopped || suspendedForAccessRevocation || reconnectTimer) return;
     const delay = nextReconnectDelay();
     void writeLog("info", `relay reconnecting in ${delay}ms (${reason})`);
     clearTimers();
@@ -2186,7 +2964,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     }, delay);
   };
   const connect = () => {
-    if (stopped) return;
+    if (stopped || suspendedForAccessRevocation) return;
     const relayUrl = getConnectorRelayUrl(config.serverUrl, config.connectorId);
     const oauthToken = launchConfig?.oauthToken?.trim();
     const token = config.token?.trim() || getConnectorToken(launchConfig);
@@ -2195,7 +2973,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     if (token) headers["X-Buda-Connector-Token"] = token;
     headers["X-Buda-Connector-Id"] = config.connectorId;
     if (config.deviceToken) headers["X-Buda-Connector-Device-Token"] = config.deviceToken;
-    const ws = new WebSocket(relayUrl, {
+    const ws = new WebSocket2(relayUrl, {
       headers: Object.keys(headers).length > 0 ? headers : void 0,
       handshakeTimeout: RELAY_HANDSHAKE_TIMEOUT_MS
     });
@@ -2214,7 +2992,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
       hadOpenConnection = true;
       reconnectDelayMs = RELAY_RECONNECT_INTERVAL_MS;
       pingTimer = setInterval(() => {
-        if (ws.readyState !== WebSocket.OPEN) return;
+        if (ws.readyState !== WebSocket2.OPEN) return;
         try {
           ws.ping();
         } catch (error) {
@@ -2244,17 +3022,22 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
         config.connectorId,
         activeRelayProtocol,
         replayGuard,
-        workspaceRegistry
+        workspaceRegistry,
+        config.serverUrl,
+        bunnyDaemon.baseUrl
       );
     });
     ws.on("close", (code) => {
       detach();
       if (!shouldReconnectConnectorRelay(code)) {
-        stopped = true;
-        void writeLog(
-          "warn",
-          code === CONNECTOR_SOCKET_REPLACED_CLOSE_CODE ? "relay replaced by another process for this connector" : "relay access revoked; restore access and restart the Connector to reconnect"
-        );
+        clearTimers();
+        if (code === CONNECTOR_SOCKET_REPLACED_CLOSE_CODE) {
+          stopped = true;
+          void writeLog("warn", "relay replaced by another process for this connector");
+        } else {
+          suspendedForAccessRevocation = true;
+          void writeLog("warn", "relay access revoked; waiting for access to be restored");
+        }
         return;
       }
       void writeLog("warn", "relay disconnected");
@@ -2280,6 +3063,19 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
         void writeLog("info", `relay protocol key updated ${nextRelayProtocol.keyId}`);
       }
     },
+    resumeAfterAccessRestore() {
+      if (stopped || !suspendedForAccessRevocation) return;
+      suspendedForAccessRevocation = false;
+      reconnectDelayMs = RELAY_RECONNECT_INTERVAL_MS;
+      hadOpenConnection = false;
+      void writeLog("info", "relay access restored; reconnecting");
+      try {
+        connect();
+      } catch (error) {
+        void writeLog("warn", `relay reconnect threw: ${formatConnectorRelayError(error)}`);
+        scheduleReconnect("access-restored");
+      }
+    },
     stop() {
       stopped = true;
       if (reconnectTimer) {
@@ -2291,8 +3087,8 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     }
   };
 }
-async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedConnectorId, relayProtocol, replayGuard, workspaceRegistry) {
-  if (!socket || socket.readyState !== WebSocket.OPEN) return;
+async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedConnectorId, relayProtocol, replayGuard, workspaceRegistry, serverUrl, localDaemonBaseUrl) {
+  if (!socket || socket.readyState !== WebSocket2.OPEN) return;
   let message;
   try {
     message = JSON.parse(raw);
@@ -2309,6 +3105,52 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
     return;
   }
   if (message.type === "event") {
+    if (message.event.channel === "terminal-open") {
+      try {
+        if (!workspaceRegistry || !serverUrl || !localDaemonBaseUrl) {
+          throw new ConnectorRelayProtocolError("PROTOCOL_UNSUPPORTED");
+        }
+        const identity = verifyConnectorExecutionIdentity({
+          protocolVersion: message.event.payload.protocolVersion,
+          executionIdentity: message.event.payload.executionIdentity,
+          request: message.event.payload.request,
+          protocol: relayProtocol,
+          expectedConnectorId,
+          replayGuard
+        });
+        const terminal = parseConnectorTerminalRequest(message.event.payload.request);
+        if (terminal.sessionId !== message.event.sessionId) {
+          throw new ConnectorRelayProtocolError("IDENTITY_INVALID");
+        }
+        const descriptor = await workspaceRegistry.resolve(identity.spaceId, identity.agentId);
+        if (descriptor.spaceId !== identity.spaceId || descriptor.agentId !== identity.agentId) {
+          throw new ConnectorRelayProtocolError("WORKSPACE_MISMATCH");
+        }
+        const mounts = await new WorkspaceVolumeLifecycle(descriptor).mount();
+        const localToken = registerLocalTerminal({
+          workspaceKey: descriptor.workspaceKey,
+          tabId: terminal.tabId,
+          cwd: mounts.agent,
+          cols: terminal.cols,
+          rows: terminal.rows
+        });
+        await proxyConnectorTerminalTunnel({
+          serverUrl,
+          connectorId: expectedConnectorId,
+          sessionId: terminal.sessionId,
+          cloudToken: terminal.token,
+          localBaseUrl: localDaemonBaseUrl,
+          localToken,
+          workspaceKey: descriptor.workspaceKey
+        });
+      } catch (error) {
+        await writeLog(
+          "warn",
+          `terminal open rejected: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+      return;
+    }
     await writeLog("warn", "relay rejected unsigned browser input event");
     return;
   }
@@ -2334,6 +3176,15 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
   }
   const controller = new AbortController();
   inflight.set(message.requestId, controller);
+  const codingRunStartedAt = message.request.path === "/api/coding/run" ? Date.now() : void 0;
+  const codingRunTrace = codingRunStartedAt !== void 0 && executionIdentity ? {
+    requestId: message.requestId,
+    connectorId: executionIdentity.connectorId,
+    agentId: executionIdentity.agentId,
+    runId: executionIdentity.runId,
+    budaSessionId: getBudaCodingRunSessionId(message.request.body) ?? null
+  } : void 0;
+  let codingRunStatus = null;
   try {
     const requestPath = message.request.path;
     const isBrowserRequest = requestPath.startsWith("/browser/") || requestPath === "/browser";
@@ -2394,6 +3245,14 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
         signal: controller.signal
       });
     }
+    if (codingRunTrace && codingRunStartedAt !== void 0) {
+      codingRunStatus = response.status;
+      await writeLog("info", "relay request coding run started", {
+        ...codingRunTrace,
+        status: codingRunStatus,
+        durationMs: Date.now() - codingRunStartedAt
+      });
+    }
     sendRelayMessage(socket, {
       type: "start",
       requestId: message.requestId,
@@ -2436,7 +3295,21 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
       type: "end",
       requestId: message.requestId
     });
+    if (codingRunTrace && codingRunStartedAt !== void 0) {
+      await writeLog("info", "relay request coding run completed", {
+        ...codingRunTrace,
+        status: codingRunStatus,
+        durationMs: Date.now() - codingRunStartedAt
+      });
+    }
   } catch (error) {
+    if (codingRunTrace && codingRunStartedAt !== void 0) {
+      await writeLog("error", "relay request coding run error", {
+        ...codingRunTrace,
+        status: codingRunStatus,
+        durationMs: Date.now() - codingRunStartedAt
+      });
+    }
     sendRelayError(socket, message.requestId, error);
   } finally {
     inflight.delete(message.requestId);
@@ -2461,12 +3334,12 @@ var normalizeWorkspaceRequest = (request, mounts) => {
   }
   const body = request.body;
   const cwd = typeof body.cwd === "string" ? body.cwd : "/agent";
-  const normalized = path6.posix.normalize(cwd);
+  const normalized = path8.posix.normalize(cwd);
   const [mount, relative] = normalized === "/agent" || normalized.startsWith("/agent/") ? [mounts.agent, normalized.slice("/agent".length)] : normalized === "/space" || normalized.startsWith("/space/") ? [mounts.space, normalized.slice("/space".length)] : [];
   if (!mount || relative === void 0) {
     throw new ConnectorRelayProtocolError("WORKSPACE_MISMATCH");
   }
-  return { ...request, body: { ...body, cwd: path6.join(mount, relative) } };
+  return { ...request, body: { ...body, cwd: path8.join(mount, relative) } };
 };
 function sendRelayError(socket, requestId, error) {
   sendRelayMessage(socket, {
@@ -2477,7 +3350,7 @@ function sendRelayError(socket, requestId, error) {
   });
 }
 function sendRelayMessage(socket, message) {
-  if (socket.readyState !== WebSocket.OPEN) return;
+  if (socket.readyState !== WebSocket2.OPEN) return;
   socket.send(JSON.stringify(message));
 }
 function headersToRecord(headers) {
@@ -2497,14 +3370,14 @@ function getHeaderValue(headers, name) {
 }
 
 // src/workdir-layout.ts
-import { lstat as lstat3, mkdir as mkdir7, symlink as symlink3, unlink as unlink4 } from "fs/promises";
-import path7 from "path";
+import { lstat as lstat3, mkdir as mkdir7, symlink as symlink3, unlink as unlink5 } from "fs/promises";
+import path9 from "path";
 async function provisionWorkdirLayout(workdirRoot) {
   const manifest = await readBundledManifest();
   await mkdir7(workdirRoot, { recursive: true });
-  await mkdir7(path7.join(workdirRoot, "system", ".agents"), { recursive: true });
-  const systemSkillsLink = path7.join(workdirRoot, "system", ".agents", "skills");
-  const systemScriptsLink = path7.join(workdirRoot, "system", "scripts");
+  await mkdir7(path9.join(workdirRoot, "system", ".agents"), { recursive: true });
+  const systemSkillsLink = path9.join(workdirRoot, "system", ".agents", "skills");
+  const systemScriptsLink = path9.join(workdirRoot, "system", "scripts");
   await ensureSymlink(manifest.systemSkillsDir, systemSkillsLink);
   await ensureSymlink(manifest.scriptsDir, systemScriptsLink);
   await writeLog("info", "workdir layout provisioned", {
@@ -2524,7 +3397,7 @@ async function ensureSymlink(target, linkPath) {
   try {
     const existing = await lstat3(linkPath);
     if (existing.isSymbolicLink()) {
-      await unlink4(linkPath);
+      await unlink5(linkPath);
     } else if (existing.isDirectory()) {
       await writeLog(
         "warn",
@@ -2532,11 +3405,11 @@ async function ensureSymlink(target, linkPath) {
       );
       return;
     } else {
-      await unlink4(linkPath);
+      await unlink5(linkPath);
     }
   } catch {
   }
-  await mkdir7(path7.dirname(linkPath), { recursive: true });
+  await mkdir7(path9.dirname(linkPath), { recursive: true });
   await symlink3(target, linkPath, "dir");
 }
 
@@ -2549,11 +3422,11 @@ import {
   open as open3,
   readFile as readFile6,
   realpath as realpath3,
-  rename as rename3,
+  rename as rename4,
   statfs,
-  unlink as unlink5
+  unlink as unlink6
 } from "fs/promises";
-import path8 from "path";
+import path10 from "path";
 var REGISTRY_VERSION = 1;
 var REGISTRY_DIRECTORY = ".buda";
 var REGISTRY_FILENAME = "workspace-registry.json";
@@ -2577,9 +3450,9 @@ var LocalWorkspaceRegistry = class _LocalWorkspaceRegistry {
     await mkdir8(storageRoot, { recursive: true, mode: 448 });
     await rejectUnsafeFilesystem(storageRoot);
     const canonicalRoot = await canonicalDirectory(storageRoot, "storage root");
-    const registryDirectory = path8.join(canonicalRoot, REGISTRY_DIRECTORY);
+    const registryDirectory = path10.join(canonicalRoot, REGISTRY_DIRECTORY);
     await ensurePrivateDirectory2(registryDirectory);
-    const registryPath = path8.join(registryDirectory, REGISTRY_FILENAME);
+    const registryPath = path10.join(registryDirectory, REGISTRY_FILENAME);
     const document = await withExclusiveFileLock(registryPath, async () => {
       let current;
       try {
@@ -2655,16 +3528,16 @@ var readRegistryDocument = async (registryPath) => {
   }
 };
 var deriveWorkspace = (storageRoot, spaceId, agentId) => {
-  const spaceRoot = path8.join(storageRoot, REGISTRY_DIRECTORY, "spaces", spaceId);
-  const agentRoot = path8.join(spaceRoot, "agents", agentId);
+  const spaceRoot = path10.join(storageRoot, REGISTRY_DIRECTORY, "spaces", spaceId);
+  const agentRoot = path10.join(spaceRoot, "agents", agentId);
   return {
     workspaceKey: `${spaceId}:${agentId}`,
     spaceId,
     agentId,
-    privateVolume: path8.join(agentRoot, "workspace"),
-    sharedVolume: path8.join(spaceRoot, "shared"),
-    stateVolume: path8.join(agentRoot, "state"),
-    temporaryVolume: path8.join(agentRoot, "tmp")
+    privateVolume: path10.join(agentRoot, "workspace"),
+    sharedVolume: path10.join(spaceRoot, "shared"),
+    stateVolume: path10.join(agentRoot, "state"),
+    temporaryVolume: path10.join(agentRoot, "tmp")
   };
 };
 var parseRegistry = (raw) => {
@@ -2785,10 +3658,10 @@ var writeRegistryAtomically = async (registryPath, document) => {
     await handle.close();
   }
   try {
-    await rename3(temporaryPath, registryPath);
+    await rename4(temporaryPath, registryPath);
     await chmod3(registryPath, 384);
   } catch (error) {
-    await unlink5(temporaryPath).catch(() => void 0);
+    await unlink6(temporaryPath).catch(() => void 0);
     throw error;
   }
 };
@@ -2811,8 +3684,8 @@ var assertContained = (root, candidate) => {
   if (!isPathInside2(root, candidate)) throw corrupt2("Workspace path escapes the storage root");
 };
 var isPathInside2 = (parent, child) => {
-  const relative = path8.relative(parent, child);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path8.sep}`) && !path8.isAbsolute(relative);
+  const relative = path10.relative(parent, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(relative);
 };
 var toDescriptor = (workspace) => ({
   workspaceKey: workspace.workspaceKey,
@@ -2842,7 +3715,7 @@ var corrupt2 = (message) => new WorkspaceRegistryError("REGISTRY_CORRUPT", messa
 var collision = (message) => new WorkspaceRegistryError("WORKSPACE_COLLISION", message);
 
 // src/onboard.ts
-async function runOnboard(launchConfig) {
+async function runOnboard(launchConfig, options = {}) {
   intro("Welcome to Buda Connector");
   const existing = await readDeviceConfig(launchConfig);
   let relayProtocol;
@@ -2935,23 +3808,33 @@ async function runOnboard(launchConfig) {
     launchConfig
   );
   s.stop("Daemon running");
-  await writeLog("info", `server ${config.serverUrl}`);
-  await writeLog("info", `config ${paths.configPath}`);
-  await writeLog("info", `workdir root ${config.workdirRoot}`);
-  await writeLog("info", `bunny daemon ${bunnyDaemon.baseUrl}`);
-  await writeLog("info", `log file ${paths.logPath}`);
   note(
     [
       `Server: ${config.serverUrl}`,
       `Bunny daemon: ${bunnyDaemon.baseUrl}`,
       `Relay: connected`,
-      `Logs: ${paths.logPath}`
+      `Logs: ${getDatedConnectorLogPath(paths.logPath)}`
     ].join("\n"),
     "Status"
   );
   outro("Buda Connector is running. Press Ctrl+C to stop.");
+  const dashboard = startConnectorConsoleDashboard({ plain: options.plain });
+  updateConnectorDashboardStatus({
+    agent: "Ready",
+    relay: "Connected",
+    server: config.serverUrl
+  });
+  await writeLog("info", `server ${config.serverUrl}`);
+  await writeLog("info", `config ${paths.configPath}`);
+  await writeLog("info", `workdir root ${config.workdirRoot}`);
+  await writeLog("info", `bunny daemon ${bunnyDaemon.baseUrl}`);
+  await writeLog("info", `log file ${getDatedConnectorLogPath(paths.logPath)}`);
   const interval = setInterval(() => {
-    heartbeatConnector(config, launchConfig, bunnyDaemon).catch((error) => {
+    heartbeatConnector(config, launchConfig, bunnyDaemon).then(() => {
+      updateConnectorDashboardStatus({
+        heartbeat: `OK ${(/* @__PURE__ */ new Date()).toLocaleTimeString("en-GB", { hour12: false })}`
+      });
+    }).catch((error) => {
       void writeLog(
         "warn",
         `heartbeat failed: ${error instanceof Error ? error.message : String(error)}`
@@ -2959,6 +3842,7 @@ async function runOnboard(launchConfig) {
     });
   }, HEARTBEAT_INTERVAL_MS);
   const shutdown = async () => {
+    dashboard?.stop();
     clearInterval(interval);
     relay.stop();
     await unregisterConnector(config, launchConfig);
@@ -2971,7 +3855,7 @@ async function runOnboard(launchConfig) {
 
 // src/runtime.ts
 import { mkdir as mkdir9 } from "fs/promises";
-import path9 from "path";
+import path11 from "path";
 async function runNewConnector(launchConfig) {
   const existing = await readDeviceConfig(launchConfig);
   const config = await ensureDeviceConfig(launchConfig);
@@ -2986,14 +3870,14 @@ async function runNewConnector(launchConfig) {
   await writeDeviceConfig(config);
   await writeLog("info", `wrote ${paths.configPath}`);
   await writeLog("info", `workdir root ${config.workdirRoot}`);
-  await writeLog("info", `log file ${paths.logPath}`);
+  await writeLog("info", `log file ${getDatedConnectorLogPath(paths.logPath)}`);
 }
 async function runConnectorDaemon(launchConfig) {
   const existing = await readDeviceConfig(launchConfig);
   const config = await ensureDeviceConfig(launchConfig);
   const paths = getConnectorPaths(config.serverUrl);
   const daemonLockTarget = getConnectorDaemonLockTarget(config.serverUrl, config.connectorId);
-  await mkdir9(path9.dirname(daemonLockTarget), { recursive: true, mode: 448 });
+  await mkdir9(path11.dirname(daemonLockTarget), { recursive: true, mode: 448 });
   let daemonLock = await acquireExclusiveFileLock(daemonLockTarget, { timeoutMs: 0 }).catch(() => {
     throw new Error(
       `Another Buda Connector daemon is already running for this profile on ${config.serverUrl}. Stop it before starting another instance.`
@@ -3016,7 +3900,7 @@ async function runConnectorDaemon(launchConfig) {
         config.serverUrl,
         registration.connectorId
       );
-      await mkdir9(path9.dirname(registeredLockTarget), { recursive: true, mode: 448 });
+      await mkdir9(path11.dirname(registeredLockTarget), { recursive: true, mode: 448 });
       const registeredLock = await acquireExclusiveFileLock(registeredLockTarget, {
         timeoutMs: 0
       }).catch(() => {
@@ -3040,11 +3924,15 @@ async function runConnectorDaemon(launchConfig) {
     await writeLog("info", `server ${config.serverUrl}`);
     await writeLog("info", `config ${paths.configPath}`);
     await writeLog("info", `workdir root ${config.workdirRoot}`);
-    await writeLog("info", `log file ${paths.logPath}`);
+    await writeLog("info", `log file ${getDatedConnectorLogPath(paths.logPath)}`);
     await writeLog("info", `bunny daemon ${activeBunnyDaemon.baseUrl}`);
     const interval = setInterval(() => {
       heartbeatConnector(config, launchConfig, activeBunnyDaemon).then(({ relayProtocol: nextRelayProtocol }) => {
         relay.updateRelayProtocol(nextRelayProtocol);
+        relay.resumeAfterAccessRestore();
+        updateConnectorDashboardStatus({
+          heartbeat: `OK ${(/* @__PURE__ */ new Date()).toLocaleTimeString("en-GB", { hour12: false })}`
+        });
       }).catch((error) => {
         void writeLog(
           "warn",
@@ -3079,7 +3967,7 @@ async function runConnectorDaemon(launchConfig) {
 // src/cli.ts
 function printHelp() {
   console.log(
-    "Help: buda-connector [onboard | new | dev | daemon] [--token <token>] [--server-url <url>] [--workdir <path>] [--launch-config-stdin]\n       pnpm --filter @buda-ai/connector dev\n\nCommands (default: onboard in TTY, daemon otherwise):\n  onboard  Interactive first-time setup + start daemon\n  new      Create/register a new connector identity\n  dev      Run the connector daemon in development\n  daemon   Run the connector daemon for sidecar/service usage"
+    "Help: buda-connector [onboard | new | dev | daemon] [--token <token>] [--server-url <url>] [--workdir <path>] [--plain] [--launch-config-stdin]\n       pnpm --filter @buda-ai/connector dev\n\nCommands (default: onboard in TTY, daemon otherwise):\n  onboard  Interactive first-time setup + start daemon\n  new      Create/register a new connector identity\n  dev      Run the connector daemon in development\n  daemon   Run the connector daemon for sidecar/service usage\n\nOptions:\n  --plain  Disable the interactive dashboard and print ordinary logs"
   );
 }
 function readFlagValue(name) {
@@ -3146,15 +4034,17 @@ async function main() {
     console.error("[buda-connector] uncaughtException:", error);
   });
   const launchConfig = await readLaunchConfig();
+  const plain = process.argv.includes("--plain");
   if (command === "new") {
     await runNewConnector(launchConfig);
     return;
   }
   if (command === "onboard") {
-    await runOnboard(launchConfig);
+    await runOnboard(launchConfig, { plain });
     return;
   }
   if (command === "dev" || command === "daemon") {
+    startConnectorConsoleDashboard({ plain });
     await runConnectorDaemon(launchConfig);
     return;
   }