@kraki/tentacle 0.1.0 → 0.2.0

package/dist/daemon.js

@@ -2,19 +2,16 @@
  * Daemon process management for Kraki tentacle.
  *
  * The daemon runs as a detached child process executing daemon-worker.js.
- * Its PID is tracked in ~/.kraki/daemon.pid.
+ * Its PID is tracked under the current Kraki home.
  */
-import { spawn, execSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { closeSync, mkdirSync, openSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getLogVerbosity, saveDaemonPid, loadDaemonPid, clearDaemonPid, } from './config.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
+import { getLogsDir, getLogVerbosity, saveDaemonPid, loadDaemonPid, clearDaemonPid, } from './config.js';
 const STARTUP_GRACE_MS = 1500;
-const BOOTSTRAP_LOG_PATH = join(homedir(), '.kraki', 'logs', 'daemon-bootstrap.log');
 export function getDaemonBootstrapLogPath() {
-    return BOOTSTRAP_LOG_PATH;
+    return join(getLogsDir(), 'daemon-bootstrap.log');
 }
 export function resolveDaemonLaunch(currentUrl = import.meta.url) {
     const moduleDir = dirname(fileURLToPath(currentUrl));
@@ -38,7 +35,7 @@ export function resolveDaemonLaunch(currentUrl = import.meta.url) {
         workerPath,
     };
 }
-function waitForDaemonBootstrap(child, timeoutMs = STARTUP_GRACE_MS) {
+function waitForDaemonBootstrap(child, bootstrapLogPath, timeoutMs = STARTUP_GRACE_MS) {
     return new Promise((resolve, reject) => {
         const cleanup = () => {
             clearTimeout(timer);
@@ -47,11 +44,11 @@ function waitForDaemonBootstrap(child, timeoutMs = STARTUP_GRACE_MS) {
         };
         const onError = (err) => {
             cleanup();
-            reject(new Error(`Kraki failed to start: ${err.message}. Check ${getDaemonBootstrapLogPath()}`));
+            reject(new Error(`Kraki failed to start: ${err.message}. Check ${bootstrapLogPath}`));
         };
         const onExit = (code, signal) => {
             cleanup();
-            reject(new Error(`Kraki exited during startup (code ${code ?? 'null'}, signal ${signal ?? 'none'}). Check ${getDaemonBootstrapLogPath()}`));
+            reject(new Error(`Kraki exited during startup (code ${code ?? 'null'}, signal ${signal ?? 'none'}). Check ${bootstrapLogPath}`));
         };
         const timer = setTimeout(() => {
             cleanup();
@@ -94,8 +91,9 @@ export async function startDaemon(config) {
     stopDaemon();
     const launch = resolveDaemonLaunch();
     launch.env.LOG_LEVEL = getLogVerbosity(config) === 'verbose' ? 'debug' : 'info';
-    mkdirSync(dirname(BOOTSTRAP_LOG_PATH), { recursive: true });
-    const bootstrapFd = openSync(BOOTSTRAP_LOG_PATH, 'w');
+    const bootstrapLogPath = getDaemonBootstrapLogPath();
+    mkdirSync(dirname(bootstrapLogPath), { recursive: true });
+    const bootstrapFd = openSync(bootstrapLogPath, 'w');
     const child = spawn(launch.runtime, launch.args, {
         detached: true,
         stdio: ['ignore', bootstrapFd, bootstrapFd],
@@ -104,10 +102,10 @@ export async function startDaemon(config) {
     });
     closeSync(bootstrapFd);
     if (!child.pid) {
-        throw new Error(`Kraki failed to start: no daemon PID returned. Check ${getDaemonBootstrapLogPath()}`);
+        throw new Error(`Kraki failed to start: no daemon PID returned. Check ${bootstrapLogPath}`);
     }
     try {
-        await waitForDaemonBootstrap(child);
+        await waitForDaemonBootstrap(child, bootstrapLogPath);
     }
     catch (err) {
         try {
@@ -133,31 +131,6 @@ export function stopDaemon() {
         }
         clearDaemonPid();
     }
-    // Kill any orphaned daemon-worker processes (missed by PID tracking)
-    killOrphanedWorkers();
     return pid !== null;
 }
-/**
- * Find and kill any daemon-worker processes not tracked by the PID file.
- */
-function killOrphanedWorkers() {
-    try {
-        const output = execSync('ps -eo pid,command', { encoding: 'utf8' });
-        for (const line of output.split('\n')) {
-            if (line.includes('daemon-worker') && !line.includes('grep')) {
-                const pidStr = line.trim().split(/\s+/)[0];
-                const orphanPid = parseInt(pidStr, 10);
-                if (orphanPid && orphanPid !== process.pid) {
-                    try {
-                        process.kill(orphanPid, 'SIGTERM');
-                    }
-                    catch { /* already gone */ }
-                }
-            }
-        }
-    }
-    catch {
-        // ps not available — skip orphan cleanup
-    }
-}
 //# sourceMappingURL=daemon.js.map

package/dist/daemon.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,eAAe,EAEf,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAUrF,MAAM,UAAU,yBAAyB;IACvC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,aAAqB,MAAM,CAAC,IAAI,CAAC,GAAG;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,UAAU;QACzB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAEhD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACjE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;QAC7C,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACtE;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB,EAAE,SAAS,GAAG,gBAAgB;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;YAC7B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,WAAW,yBAAyB,EAAE,EAAE,CAAC,CAAC,CAAC;QACnG,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;YACpE,OAAO,EAAE,CAAC;YACV,MAAM,CACJ,IAAI,KAAK,CACP,qCAAqC,IAAI,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,YAAY,yBAAyB,EAAE,EAAE,CACzH,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AASD,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;QACzC,cAAc,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,2DAA2D;AAE3D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAmB;IACnD,wDAAwD;IACxD,UAAU,EAAE,CAAC;IAEb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;QAC/C,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC;QAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC,CAAC;IAEH,SAAS,CAAC,WAAW,CAAC,CAAC;IAEvB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wDAAwD,yBAAyB,EAAE,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,cAAc,EAAE,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,mBAAmB,EAAE,CAAC;IAEtB,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI,SAAS,IAAI,SAAS,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;oBAC3C,IAAI,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,UAAU,EACV,eAAe,EAEf,aAAa,EACb,aAAa,EACb,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAU9B,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,aAAqB,MAAM,CAAC,IAAI,CAAC,GAAG;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,UAAU;QACzB,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAEhD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACjE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW;QAC7C,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACtE;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAmB,EACnB,gBAAwB,EACxB,SAAS,GAAG,gBAAgB;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;YAC7B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,WAAW,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAE,EAAE;YACpE,OAAO,EAAE,CAAC;YACV,MAAM,CACJ,IAAI,KAAK,CACP,qCAAqC,IAAI,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,YAAY,gBAAgB,EAAE,CAC9G,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AASD,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;QACzC,cAAc,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,2DAA2D;AAE3D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAmB;IACnD,wDAAwD;IACxD,UAAU,EAAE,CAAC;IAEb,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,MAAM,gBAAgB,GAAG,yBAAyB,EAAE,CAAC;IACrD,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;QAC/C,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC;QAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC,CAAC;IAEH,SAAS,CAAC,WAAW,CAAC,CAAC;IAEvB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wDAAwD,gBAAgB,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,cAAc,EAAE,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC"}

package/dist/logger.d.ts

@@ -2,7 +2,7 @@
  * Structured logging for Kraki tentacle.
  *
  * - Development: pretty-prints to stdout
- * - Production: writes to rotating log files under ~/.kraki/logs/
+ * - Production: writes to rotating log files under the current Kraki home
  */
 import pino from 'pino';
 export declare function createLogger(name: string): pino.Logger;

package/dist/logger.js

@@ -2,13 +2,11 @@
  * Structured logging for Kraki tentacle.
  *
  * - Development: pretty-prints to stdout
- * - Production: writes to rotating log files under ~/.kraki/logs/
+ * - Production: writes to rotating log files under the current Kraki home
  */
 import pino from 'pino';
-import { mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { homedir } from 'node:os';
-const LOG_DIR = join(homedir(), '.kraki', 'logs');
+import { getLogsDir } from './config.js';
 export function createLogger(name) {
     const level = process.env.LOG_LEVEL ?? 'info';
     const isDev = process.env.NODE_ENV !== 'production';
@@ -16,11 +14,11 @@ export function createLogger(name) {
         return pino({ name, level });
     }
     // Production: rotate log files via pino-roll
-    mkdirSync(LOG_DIR, { recursive: true });
+    const logDir = getLogsDir();
     const transport = pino.transport({
         target: 'pino-roll',
         options: {
-            file: join(LOG_DIR, `${name}.log`),
+            file: join(logDir, `${name}.log`),
             size: '5m',
             limit: { count: 5 },
         },

package/dist/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAElD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAEpD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,6CAA6C;IAC7C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC;YAClC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;SACpB;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAEpD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,6CAA6C;IAC7C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC;YACjC,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;SACpB;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC"}

package/dist/relay-client.d.ts

@@ -1,9 +1,9 @@
 /**
- * Relay client — connects the tentacle to the head via WebSocket.
+ * Relay client — connects the tentacle to the relay via WebSocket.
  *
- * Translates adapter events into protocol messages and sends them to the head.
- * Receives consumer actions from the head and routes them to the adapter.
- * Handles auth, reconnection, and session lifecycle.
+ * Translates adapter events into protocol messages and broadcasts them to apps.
+ * Receives unicast consumer actions from apps and routes them to the adapter.
+ * Handles auth, E2E encryption, reconnection, and session lifecycle.
  */
 import type { DeviceInfo, AuthOkMessage } from '@kraki/protocol';
 import type { AgentAdapter } from './adapters/base.js';
@@ -14,7 +14,9 @@ export interface RelayClientOptions {
     relayUrl: string;
     /** Device info for auth */
     device: DeviceInfo;
-    /** GitHub token or channel key */
+    /** How the relay should authenticate this device */
+    authMethod: 'github' | 'channel-key' | 'open';
+    /** Auth token, such as a GitHub token or channel/shared key */
     token?: string;
     /** Reconnect delay in ms. Default: 3000 */
     reconnectDelay?: number;
@@ -32,16 +34,21 @@ export declare class RelayClient {
     private reconnectAttempts;
     private reconnectTimer;
     private authInfo;
-    private e2eEnabled;
     /** Cached consumer public keys for E2E encryption */
     private consumerKeys;
     /** Messages queued when E2E is enabled but no consumer keys are available yet */
     private pendingE2eQueue;
     /** Maps pre-generated sessionId → requestId for concurrent create_session correlation */
     private pendingRequestIds;
-    private lastServerPingAt;
+    /** Monotonic seq counter — per tentacle, shared across all sessions. */
+    private seqCounter;
+    /** Tool kinds auto-approved via always_allow from apps */
+    private allowedTools;
+    /** Prefer challenge auth when the relay already knows this device */
+    private preferChallengeAuth;
+    private lastActivityAt;
     private staleCheckTimer;
-    /** How long without a server ping before we consider the connection stale (ms) */
+    /** How long without any activity before we consider the connection stale (ms) */
     private static readonly STALE_THRESHOLD;
     /** How often to check for stale connection (ms) */
     private static readonly STALE_CHECK_INTERVAL;
@@ -69,15 +76,28 @@ export declare class RelayClient {
      */
     getAuthInfo(): AuthOkMessage | null;
     private handleMessage;
+    private buildAuthPayload;
     private handleConsumerMessage;
     private handleCreateSession;
     private wireAdapterEvents;
     private resumeDisconnectedSessions;
     private send;
     /**
-     * Encrypt and send a message to the relay.
+     * Encrypt and send a message to the relay as a BroadcastEnvelope.
      */
     private sendEncrypted;
+    /**
+     * Encrypt and send a message to a single device as a UnicastEnvelope.
+     */
+    private sendUnicastTo;
+    /**
+     * Broadcast a device_greeting to all connected apps (used on auth_ok).
+     */
+    private sendGreetingBroadcast;
+    /**
+     * Send a device_greeting unicast to a newly joined app.
+     */
+    private sendGreetingTo;
     /**
      * Flush queued E2E messages once consumer keys become available.
      */

package/dist/relay-client.js

@@ -1,12 +1,12 @@
 /**
- * Relay client — connects the tentacle to the head via WebSocket.
+ * Relay client — connects the tentacle to the relay via WebSocket.
  *
- * Translates adapter events into protocol messages and sends them to the head.
- * Receives consumer actions from the head and routes them to the adapter.
- * Handles auth, reconnection, and session lifecycle.
+ * Translates adapter events into protocol messages and broadcasts them to apps.
+ * Receives unicast consumer actions from apps and routes them to the adapter.
+ * Handles auth, E2E encryption, reconnection, and session lifecycle.
  */
 import { WebSocket } from 'ws';
-import { importPublicKey } from '@kraki/crypto';
+import { importPublicKey, encryptToBlob, decryptFromBlob, signChallenge } from '@kraki/crypto';
 import { createLogger } from './logger.js';
 const logger = createLogger('relay-client');
 export class RelayClient {
@@ -19,18 +19,23 @@ export class RelayClient {
     reconnectAttempts = 0;
     reconnectTimer = null;
     authInfo = null;
-    e2eEnabled = false;
     /** Cached consumer public keys for E2E encryption */
     consumerKeys = new Map();
     /** Messages queued when E2E is enabled but no consumer keys are available yet */
     pendingE2eQueue = [];
     /** Maps pre-generated sessionId → requestId for concurrent create_session correlation */
     pendingRequestIds = new Map();
-    // Stale connection detection — tracks server pings to detect sleep/network changes
-    lastServerPingAt = 0;
+    /** Monotonic seq counter — per tentacle, shared across all sessions. */
+    seqCounter = 0;
+    /** Tool kinds auto-approved via always_allow from apps */
+    allowedTools = new Set();
+    /** Prefer challenge auth when the relay already knows this device */
+    preferChallengeAuth = true;
+    // Stale connection detection — tracks last incoming message to detect sleep/network changes
+    lastActivityAt = 0;
     staleCheckTimer = null;
-    /** How long without a server ping before we consider the connection stale (ms) */
-    static STALE_THRESHOLD = 60_000; // 60s (server pings every 30s, so 2 missed pings)
+    /** How long without any activity before we consider the connection stale (ms) */
+    static STALE_THRESHOLD = 60_000;
     /** How often to check for stale connection (ms) */
     static STALE_CHECK_INTERVAL = 10_000;
     /** Called when relay state changes */
@@ -58,20 +63,17 @@ export class RelayClient {
         ws.on('open', () => {
             this.setState('authenticating');
             this.reconnectAttempts = 0;
-            this.lastServerPingAt = Date.now();
+            this.lastActivityAt = Date.now();
             this.startStaleCheck();
-            const authMsg = {
-                type: 'auth',
-                token: this.options.token,
-                device: {
-                    ...this.options.device,
-                    publicKey: this.keyManager?.getCompactPublicKey(),
-                },
+            const device = {
+                ...this.options.device,
+                publicKey: this.keyManager?.getCompactPublicKey(),
             };
-            ws.send(JSON.stringify(authMsg));
+            const auth = this.buildAuthPayload(device);
+            ws.send(JSON.stringify({ type: 'auth', auth, device }));
         });
         ws.on('message', (data) => {
-            this.lastServerPingAt = Date.now();
+            this.lastActivityAt = Date.now();
             try {
                 const msg = JSON.parse(data.toString());
                 this.handleMessage(msg);
@@ -89,9 +91,9 @@ export class RelayClient {
         ws.on('error', () => {
             // Error triggers close, which handles reconnect
         });
-        // Track server pings for stale connection detection
+        // Track any incoming frames as activity for stale detection
         ws.on('ping', () => {
-            this.lastServerPingAt = Date.now();
+            this.lastActivityAt = Date.now();
         });
     }
     /**
@@ -125,43 +127,77 @@ export class RelayClient {
     handleMessage(msg) {
         if (msg.type === 'auth_ok') {
             this.authInfo = msg;
-            this.e2eEnabled = this.authInfo.e2e && !!this.keyManager;
+            this.preferChallengeAuth = true;
             // Cache consumer device public keys for E2E
-            if (this.e2eEnabled && this.authInfo.devices) {
+            if (this.authInfo.devices) {
                 this.updateConsumerKeys(this.authInfo.devices);
             }
             this.setState('connected');
             this.onAuthenticated?.(this.authInfo);
             this.resumeDisconnectedSessions();
+            this.sendGreetingBroadcast();
             return;
         }
         if (msg.type === 'auth_error') {
-            this.onFatalError?.(msg.message);
+            const authError = msg;
+            if (authError.code === 'unknown_device' && this.preferChallengeAuth && this.options.device.deviceId && this.keyManager) {
+                logger.warn('Challenge auth rejected for unknown device; retrying with full auth');
+                this.preferChallengeAuth = false;
+                this.ws?.close();
+                return;
+            }
+            this.onFatalError?.(authError.message);
             this.disconnect();
             return;
         }
+        if (msg.type === 'auth_challenge') {
+            if (this.keyManager && this.ws && this.ws.readyState === WebSocket.OPEN) {
+                try {
+                    const signature = signChallenge(msg.nonce, this.keyManager.getKeyPair().privateKey);
+                    this.ws.send(JSON.stringify({ type: 'auth_response', signature }));
+                }
+                catch (err) {
+                    logger.error({ err }, 'Failed to sign auth challenge');
+                }
+            }
+            return;
+        }
+        if (msg.type === 'server_error') {
+            logger.error({ message: msg.message, ref: msg.ref }, 'Server error');
+            return;
+        }
         if (msg.type === 'pong') {
             return;
         }
-        if (msg.type === 'head_notice') {
-            // Update consumer keys when devices change
-            if (this.e2eEnabled && msg.event === 'device_online') {
-                const dev = msg.data?.device;
-                const key = dev?.encryptionKey ?? dev?.publicKey;
-                if (dev && key) {
-                    this.consumerKeys.set(dev.id, key);
+        if (msg.type === 'ping') {
+            if (this.ws?.readyState === WebSocket.OPEN) {
+                this.ws.send(JSON.stringify({ type: 'pong' }));
+            }
+            return;
+        }
+        // Device presence notifications — update consumer keys dynamically
+        if (msg.type === 'device_joined') {
+            const device = msg.device;
+            if (device.role === 'app') {
+                const key = device.encryptionKey ?? device.publicKey;
+                if (key) {
+                    this.consumerKeys.set(device.id, key);
                     this.flushE2eQueue();
+                    // Send a greeting unicast so the app learns our capabilities
+                    this.sendGreetingTo(device.id, key);
                 }
             }
-            if (msg.event === 'device_offline' || msg.event === 'device_removed') {
-                this.consumerKeys.delete(msg.data?.deviceId);
-            }
             return;
         }
-        // In E2E mode, incoming consumer messages may be encrypted
-        if (msg.type === 'encrypted' && this.keyManager && this.authInfo) {
+        if (msg.type === 'device_left') {
+            const deviceId = msg.deviceId;
+            this.consumerKeys.delete(deviceId);
+            return;
+        }
+        // Incoming unicast messages from apps — decrypt and handle inner message
+        if (msg.type === 'unicast' && this.keyManager && this.authInfo) {
             try {
-                const decrypted = this.keyManager.decryptForMe({ iv: msg.iv, ciphertext: msg.ciphertext, tag: msg.tag, keys: msg.keys }, this.authInfo.deviceId);
+                const decrypted = decryptFromBlob({ blob: msg.blob, keys: msg.keys }, this.authInfo.deviceId, this.keyManager.getKeyPair().privateKey);
                 const inner = JSON.parse(decrypted);
                 this.handleConsumerMessage(inner);
             }
@@ -170,9 +206,37 @@ export class RelayClient {
             }
             return;
         }
-        // Plaintext consumer messages
+        // Plaintext consumer messages (fallback when no keyManager)
         this.handleConsumerMessage(msg);
     }
+    buildAuthPayload(device) {
+        if (this.preferChallengeAuth && device.deviceId && this.keyManager) {
+            return {
+                method: 'challenge',
+                deviceId: device.deviceId,
+            };
+        }
+        switch (this.options.authMethod) {
+            case 'github':
+                if (!this.options.token) {
+                    throw new Error('GitHub auth requires a token or an already-known device for challenge auth');
+                }
+                return {
+                    method: 'github_token',
+                    token: this.options.token,
+                };
+            case 'channel-key':
+                return {
+                    method: 'open',
+                    sharedKey: this.options.token,
+                };
+            case 'open':
+            default:
+                return this.options.token
+                    ? { method: 'open', sharedKey: this.options.token }
+                    : { method: 'open' };
+        }
+    }
     handleConsumerMessage(msg) {
         // create_session is special — no sessionId yet
         if (msg.type === 'create_session') {
@@ -203,6 +267,10 @@ export class RelayClient {
                         .catch((err) => logger.error({ err, sessionId }, 'respondToPermission failed'));
                     break;
                 case 'always_allow':
+                    // Track auto-approved tool kinds for future permissions
+                    if (msg.payload.toolKind) {
+                        this.allowedTools.add(msg.payload.toolKind);
+                    }
                     this.adapter.respondToPermission(sessionId, msg.payload.permissionId, 'always_allow')
                         .catch((err) => logger.error({ err, sessionId }, 'respondToPermission failed'));
                     break;
@@ -218,6 +286,12 @@ export class RelayClient {
                     this.adapter.abortSession(sessionId)
                         .catch((err) => logger.error({ err, sessionId }, 'abortSession failed'));
                     break;
+                case 'delete_session':
+                    this.adapter.killSession(sessionId)
+                        .catch((err) => logger.error({ err, sessionId }, 'killSession on delete failed'));
+                    this.sessionManager.deleteSession(sessionId);
+                    this.send({ type: 'session_deleted', sessionId, payload: {} });
+                    break;
                 default: {
                     // Handle extended message types (e.g. set_session_mode)
                     const ext = msg;
@@ -302,6 +376,12 @@ export class RelayClient {
             });
         };
         this.adapter.onPermissionRequest = (sessionId, event) => {
+            // Auto-approve if tool kind is in the always-allowed set
+            if (this.allowedTools.has(event.toolArgs.toolName)) {
+                this.adapter.respondToPermission(sessionId, event.id, 'approve')
+                    .catch((err) => logger.error({ err, sessionId }, 'auto-approve failed'));
+                return;
+            }
             this.send({
                 type: 'permission',
                 sessionId,
@@ -408,7 +488,16 @@ export class RelayClient {
     send(msg) {
         if (!this.ws || this.ws.readyState !== WebSocket.OPEN)
             return;
-        if (this.e2eEnabled && this.keyManager) {
+        // Outbound messages also prove connectivity
+        this.lastActivityAt = Date.now();
+        // Tentacle assigns seq and timestamp before encryption
+        const enriched = msg;
+        enriched.seq = ++this.seqCounter;
+        enriched.timestamp = new Date().toISOString();
+        if (this.authInfo) {
+            enriched.deviceId = this.authInfo.deviceId;
+        }
+        if (this.keyManager) {
             if (this.consumerKeys.size === 0) {
                 // No consumers online — queue (bounded to prevent memory growth)
                 if (this.pendingE2eQueue.length < 1000) {
@@ -430,7 +519,7 @@ export class RelayClient {
         }
     }
     /**
-     * Encrypt and send a message to the relay.
+     * Encrypt and send a message to the relay as a BroadcastEnvelope.
      */
     sendEncrypted(msg) {
         if (!this.ws || this.ws.readyState !== WebSocket.OPEN || !this.keyManager)
@@ -440,26 +529,70 @@ export class RelayClient {
             recipients.push({ deviceId, publicKey: importPublicKey(compactKey) });
         }
         const plaintext = JSON.stringify(msg);
-        const encrypted = this.keyManager.encryptForRecipients(plaintext, recipients);
+        const { blob, keys } = encryptToBlob(plaintext, recipients);
         const envelope = {
-            type: 'encrypted',
-            sessionId: msg.sessionId,
-            iv: encrypted.iv,
-            ciphertext: encrypted.ciphertext,
-            tag: encrypted.tag,
-            keys: encrypted.keys,
+            type: 'broadcast',
+            blob,
+            keys,
         };
-        // Expose agent/model for session_created so the head can register properly
-        if (msg.type === 'session_created' && msg.payload) {
-            envelope.agent = msg.payload.agent;
-            envelope.model = msg.payload.model;
-        }
-        // Mark ephemeral messages — head forwards but doesn't persist
-        if (msg.type === 'agent_message_delta' || msg.type === 'idle') {
-            envelope.ephemeral = true;
+        // Send push notifications for permission and question messages
+        if (msg.type === 'permission' || msg.type === 'question') {
+            envelope.notify = true;
         }
         this.ws.send(JSON.stringify(envelope));
     }
+    /**
+     * Encrypt and send a message to a single device as a UnicastEnvelope.
+     */
+    sendUnicastTo(targetDeviceId, compactPubKey, msg) {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN || !this.keyManager)
+            return;
+        const recipientPubKey = importPublicKey(compactPubKey);
+        const plaintext = JSON.stringify(msg);
+        const { blob, keys } = encryptToBlob(plaintext, [
+            { deviceId: targetDeviceId, publicKey: recipientPubKey },
+        ]);
+        const envelope = {
+            type: 'unicast',
+            to: targetDeviceId,
+            blob,
+            keys,
+        };
+        this.ws.send(JSON.stringify(envelope));
+    }
+    /**
+     * Broadcast a device_greeting to all connected apps (used on auth_ok).
+     */
+    sendGreetingBroadcast() {
+        this.sendEncrypted({
+            type: 'device_greeting',
+            deviceId: this.authInfo?.deviceId ?? '',
+            seq: ++this.seqCounter,
+            timestamp: new Date().toISOString(),
+            payload: {
+                name: this.options.device.name,
+                kind: this.options.device.kind,
+                models: this.options.device.capabilities?.models,
+            },
+        });
+    }
+    /**
+     * Send a device_greeting unicast to a newly joined app.
+     */
+    sendGreetingTo(targetDeviceId, compactPubKey) {
+        const greeting = {
+            type: 'device_greeting',
+            deviceId: this.authInfo?.deviceId ?? '',
+            seq: ++this.seqCounter,
+            timestamp: new Date().toISOString(),
+            payload: {
+                name: this.options.device.name,
+                kind: this.options.device.kind,
+                models: this.options.device.capabilities?.models,
+            },
+        };
+        this.sendUnicastTo(targetDeviceId, compactPubKey, greeting);
+    }
     /**
      * Flush queued E2E messages once consumer keys become available.
      */
@@ -489,9 +622,9 @@ export class RelayClient {
         this.staleCheckTimer = setInterval(() => {
             if (this.state !== 'connected' && this.state !== 'authenticating')
                 return;
-            const elapsed = Date.now() - this.lastServerPingAt;
+            const elapsed = Date.now() - this.lastActivityAt;
             if (elapsed > RelayClient.STALE_THRESHOLD) {
-                logger.warn(`No server ping for ${Math.round(elapsed / 1000)}s — connection stale, reconnecting`);
+                logger.warn(`No activity for ${Math.round(elapsed / 1000)}s — connection stale, reconnecting`);
                 this.ws?.close();
             }
         }, RelayClient.STALE_CHECK_INTERVAL);