@mindfoldhq/runtime-manager 0.1.0 → 0.1.1

package/dist/vine-runtime-manager.js

@@ -1,13 +1,15 @@
-#!/usr/bin/env bun
+#!/usr/bin/env node
+process.env.VINE_LOG_PRETTY ??= "0";
 // @bun
-var __require = import.meta.require;
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/cli/index.ts
 import { hostname as hostname2 } from "os";
 
 // ../../packages/logger/src/index.ts
-import { mkdirSync } from "fs";
-import { dirname, join, resolve } from "path";
+import { mkdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import pino from "pino";
 
 // ../../packages/logger/src/sanitize.ts
@@ -472,9 +474,220 @@ function childLogger(context) {
 }
 
 // src/provider/runloop-smoke.ts
-import { randomUUID } from "crypto";
-import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join as join3 } from "node:path";
+
+// ../../packages/logger/src/index.ts
+import { mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+import pino2 from "pino";
+var logLevels2 = [
+  "trace",
+  "debug",
+  "info",
+  "warn",
+  "error",
+  "fatal",
+  "silent"
+];
+var logLevelSet2 = new Set(logLevels2);
+var configuredOptions2 = {};
+var sinks2 = null;
+var generation2 = 0;
+function envValue2(name) {
+  const value = process.env[name]?.trim();
+  return value && value.length > 0 ? value : undefined;
+}
+function isDisabled2(value) {
+  if (value === false || value === null)
+    return true;
+  if (typeof value !== "string")
+    return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "0" || normalized === "false" || normalized === "none";
+}
+function serviceName2() {
+  return configuredOptions2.serviceName?.trim() || envValue2("VINE_SERVICE_NAME") || "vine";
+}
+function normalizeLogLevel2(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (!normalized)
+    return;
+  return logLevelSet2.has(normalized) ? normalized : undefined;
+}
+function defaultLogLevel2() {
+  const isProd = false;
+  return isProd ? "info" : "debug";
+}
+function logLevel2() {
+  return normalizeLogLevel2(configuredOptions2.level) ?? normalizeLogLevel2(envValue2("VINE_LOG_LEVEL")) ?? defaultLogLevel2();
+}
+function usePretty2() {
+  if (configuredOptions2.pretty !== undefined)
+    return configuredOptions2.pretty;
+  return process.env.VINE_LOG_PRETTY !== "0";
+}
+function resolveLogFilePath2(name) {
+  if (isDisabled2(configuredOptions2.logFilePath))
+    return;
+  if (typeof configuredOptions2.logFilePath === "string") {
+    return resolve2(configuredOptions2.logFilePath);
+  }
+  const envFile = envValue2("VINE_LOG_FILE");
+  if (isDisabled2(envFile))
+    return;
+  if (envFile)
+    return resolve2(envFile);
+  if (isDisabled2(configuredOptions2.logDir))
+    return;
+  const configuredDir = typeof configuredOptions2.logDir === "string" ? configuredOptions2.logDir.trim() : undefined;
+  const envDir = envValue2("VINE_LOG_DIR");
+  const logDir = configuredDir && configuredDir.length > 0 ? configuredDir : envDir;
+  if (isDisabled2(logDir))
+    return;
+  if (logDir)
+    return resolve2(logDir, `${name}.log`);
+  if (isDisabled2(configuredOptions2.defaultLogFilePath))
+    return;
+  if (typeof configuredOptions2.defaultLogFilePath === "string") {
+    return resolve2(configuredOptions2.defaultLogFilePath);
+  }
+  return;
+}
+function resolveRemoteSink2(name) {
+  if (isDisabled2(configuredOptions2.remoteUrl))
+    return;
+  const configuredUrl = typeof configuredOptions2.remoteUrl === "string" ? configuredOptions2.remoteUrl.trim() : undefined;
+  const envUrl = envValue2("VINE_LOG_REMOTE_URL");
+  const url = configuredUrl && configuredUrl.length > 0 ? configuredUrl : envUrl;
+  if (isDisabled2(url) || !url)
+    return;
+  const configuredUser = typeof configuredOptions2.remoteUser === "string" ? configuredOptions2.remoteUser.trim() : undefined;
+  const configuredPassword = typeof configuredOptions2.remotePassword === "string" ? configuredOptions2.remotePassword : undefined;
+  const user = configuredUser && configuredUser.length > 0 ? configuredUser : envValue2("VINE_LOG_REMOTE_USER");
+  const password = configuredPassword ?? envValue2("VINE_LOG_REMOTE_PASSWORD");
+  return createRemoteSink({
+    url,
+    ...user ? { user } : {},
+    ...password ? { password } : {},
+    batchSize: Math.max(1, configuredOptions2.remoteBatchSize ?? 25),
+    flushIntervalMs: Math.max(10, configuredOptions2.remoteFlushIntervalMs ?? 1000),
+    serviceName: name
+  });
+}
+function baseOptions2(name) {
+  return {
+    level: logLevel2(),
+    base: { service: name },
+    timestamp: pino2.stdTimeFunctions.isoTime,
+    formatters: {
+      level: (label) => ({ level: label })
+    },
+    redact: {
+      paths: [...REDACT_PATHS],
+      censor: "[REDACTED]"
+    }
+  };
+}
+function createStdoutLogger2(options) {
+  if (usePretty2()) {
+    return pino2({
+      ...options,
+      transport: {
+        target: "pino-pretty",
+        options: {
+          colorize: true,
+          translateTime: "HH:MM:ss.l",
+          singleLine: false,
+          ignore: "pid,hostname"
+        }
+      }
+    });
+  }
+  return pino2(options);
+}
+function createSinks2() {
+  const name = serviceName2();
+  const options = baseOptions2(name);
+  const stdout = createStdoutLogger2(options);
+  const remote = resolveRemoteSink2(name);
+  const logFilePath = resolveLogFilePath2(name);
+  if (!logFilePath)
+    return { stdout, ...remote ? { remote } : {} };
+  mkdirSync2(dirname2(logFilePath), { recursive: true });
+  const fileDestination = pino2.destination({ dest: logFilePath, sync: false });
+  const file = pino2(options, fileDestination);
+  return { stdout, file, fileDestination, ...remote ? { remote } : {} };
+}
+function getSinks2() {
+  if (!sinks2)
+    sinks2 = createSinks2();
+  return sinks2;
+}
+function flushSinkSet2(target) {
+  target.stdout.flush?.();
+  target.file?.flush?.();
+  target.fileDestination?.flush?.();
+  target.remote?.flush();
+  try {
+    target.fileDestination?.flushSync?.();
+  } catch (err) {
+    if (!(err instanceof Error) || !err.message.includes("not ready yet")) {
+      throw err;
+    }
+  }
+}
+function flushLogger2() {
+  if (sinks2)
+    flushSinkSet2(sinks2);
+}
+function call2(method, target, args) {
+  const fn = target[method];
+  fn.apply(target, sanitizeLogArgs(args));
+}
+function scopedLogger2(context) {
+  let cachedGeneration = -1;
+  let cachedStdout = null;
+  let cachedFile;
+  function resolveScoped() {
+    const current = getSinks2();
+    if (cachedGeneration !== generation2 || cachedStdout === null) {
+      const safeContext = sanitizeLogValue(context, new WeakSet, undefined);
+      cachedStdout = current.stdout.child(safeContext);
+      cachedFile = current.file?.child(safeContext);
+      cachedGeneration = generation2;
+    }
+    return {
+      stdout: cachedStdout,
+      ...cachedFile ? { file: cachedFile } : {},
+      ...current.remote ? { remote: current.remote } : {}
+    };
+  }
+  function method(name) {
+    return (...args) => {
+      const current = resolveScoped();
+      call2(name, current.stdout, args);
+      if (current.file)
+        call2(name, current.file, args);
+      current.remote?.write(name, context, args);
+    };
+  }
+  return {
+    trace: method("trace"),
+    debug: method("debug"),
+    info: method("info"),
+    warn: method("warn"),
+    error: method("error"),
+    fatal: method("fatal"),
+    child: (more) => scopedLogger2({ ...context, ...more }),
+    flush: flushLogger2
+  };
+}
+var logger2 = scopedLogger2({});
+function childLogger2(context) {
+  return logger2.child(context);
+}
 
 // ../../packages/protocol/src/runtime-provider-config.ts
 import { z as z4 } from "zod";
@@ -2290,7 +2503,7 @@ function remoteProviderResourceMetadata(backend, spec) {
 }
 
 // src/provider/runloop.ts
-var log = childLogger({ subsystem: "provider-runloop" });
+var log = childLogger2({ subsystem: "provider-runloop" });
 var DEFAULT_WORKSPACE_BASE = "/home/user/vine-runtime-manager";
 var DEFAULT_READY_TIMEOUT_SECONDS = 180;
 var DEFAULT_WAIT_POLL_SECONDS = 30;
@@ -2843,7 +3056,7 @@ function redactRunloopApiBodyPreview(body) {
   return redacted.slice(0, 500);
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function omitUndefined(value) {
   const out = {};
@@ -2855,7 +3068,7 @@ function omitUndefined(value) {
 }
 
 // src/provider/runloop-smoke.ts
-var log2 = childLogger({ subsystem: "runloop-smoke" });
+var log2 = childLogger2({ subsystem: "runloop-smoke" });
 var DEFAULT_SMOKE_COMMAND = "sh -lc 'echo vine-runloop-smoke-ready; sleep 300'";
 async function runRunloopProviderSmoke() {
   const provider = new RunloopProvider({
@@ -2864,7 +3077,7 @@ async function runRunloopProviderSmoke() {
   const sessionId = randomUUID();
   const sessionToken = randomUUID();
   const managerWsUrl = process.env.VINE_RUNNER_LINK_PUBLIC_URL ?? "ws://127.0.0.1:9";
-  const workspaceRoot = join2(tmpdir(), "vine-runloop-smoke", sessionId);
+  const workspaceRoot = join3(tmpdir(), "vine-runloop-smoke", sessionId);
   let provisioned = null;
   try {
     provisioned = await provider.createSession({
@@ -2896,10 +3109,13 @@ async function pollLogs(provider, session) {
     const logs = await provider.getLogs(session);
     if (logs.length > 0)
       return logs;
-    await Bun.sleep(1000);
+    await sleep2(1000);
   }
   return await provider.getLogs(session);
 }
+function sleep2(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
 
 // src/provider-bootstrap.ts
 function parseRuntimeProviderBootstrapEnv(env) {
@@ -3004,9 +3220,9 @@ function nonEmptyTrimmed(value) {
 }
 
 // src/runner-link/smoke.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join6 } from "path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join7 } from "node:path";
 
 // ../../packages/protocol/src/agent-backend-auth-api.ts
 import { z as z18 } from "zod";
@@ -3641,7 +3857,7 @@ var RUNTIME_ENV_DESCRIPTORS = [
     provider_group: "anthropic",
     secret: true,
     display_label: "(forbidden)",
-    description: "Forbidden \u2014 Claude CLI's ANTHROPIC_AUTH_TOKEN bypasses our credential resolver. Use ANTHROPIC_API_KEY instead.",
+    description: "Forbidden — Claude CLI's ANTHROPIC_AUTH_TOKEN bypasses our credential resolver. Use ANTHROPIC_API_KEY instead.",
     forbidden: true,
     redact_in_value: true
   },
@@ -5987,22 +6203,23 @@ var WebServerFrame = z42.discriminatedUnion("type", [
   WebServerErrorFrame
 ]);
 // src/provider/docker.ts
-import { existsSync, mkdirSync as mkdirSync3, rmSync as rmSync2 } from "fs";
-import { homedir } from "os";
-import { join as join4 } from "path";
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync as mkdirSync4, rmSync as rmSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join5 } from "node:path";
 
 // src/provider/session-repos-file.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { chmodSync, mkdirSync as mkdirSync2, rmSync, writeFileSync } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join3 } from "path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { chmodSync, mkdirSync as mkdirSync3, rmSync, writeFileSync } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join4 } from "node:path";
 function writeSessionReposFile(repos) {
   if (repos.length === 0)
     return null;
-  const dir = join3(tmpdir2(), "vine-runtime-auth", randomUUID2());
-  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const dir = join4(tmpdir2(), "vine-runtime-auth", randomUUID2());
+  mkdirSync3(dir, { recursive: true, mode: 448 });
   chmodSync(dir, 448);
-  const filePath = join3(dir, "repos.json");
+  const filePath = join4(dir, "repos.json");
   writeFileSync(filePath, serializeRuntimeReposManifest(repos), {
     mode: 384
   });
@@ -6016,17 +6233,17 @@ function removeSessionReposFile(reposFile) {
 }
 
 // src/provider/docker.ts
-var log3 = childLogger({ subsystem: "provider-docker" });
+var log3 = childLogger2({ subsystem: "provider-docker" });
 var CONTAINER_HOME = "/home/vine";
 function credentialMountPolicy() {
   const home = homedir();
   return [
     {
-      hostPath: join4(home, ".codex", "auth.json"),
+      hostPath: join5(home, ".codex", "auth.json"),
       containerPath: `${CONTAINER_HOME}/.codex/auth.json`
     },
     {
-      hostPath: join4(home, ".local", "share", "opencode", "auth.json"),
+      hostPath: join5(home, ".local", "share", "opencode", "auth.json"),
       containerPath: `${CONTAINER_HOME}/.local/share/opencode/auth.json`
     }
   ];
@@ -6062,22 +6279,35 @@ class DockerCommandError extends Error {
     this.name = "DockerCommandError";
   }
 }
+var dockerCommandRunner = runDockerCommand;
 async function runDocker(args) {
-  const proc = Bun.spawn({
-    cmd: ["docker", ...args],
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited
-  ]);
+  const { stdout, stderr, exitCode } = await dockerCommandRunner(args);
   if (exitCode !== 0) {
     throw new DockerCommandError(args[0] ?? "", exitCode, stderr);
   }
   return stdout.trim();
 }
+function runDockerCommand(args) {
+  return new Promise((resolve3, reject) => {
+    const proc = spawn("docker", args, {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.setEncoding("utf8");
+    proc.stderr.setEncoding("utf8");
+    proc.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    proc.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      resolve3({ exitCode: code ?? 1, stderr, stdout });
+    });
+  });
+}
 function isContainerAlreadyAbsent(err) {
   if (!(err instanceof DockerCommandError))
     return false;
@@ -6094,7 +6324,7 @@ class DockerProvider {
   }
   async createSession(spec) {
     const managerWsUrl = containerReachableWsUrl(spec.managerWsUrl);
-    mkdirSync3(spec.workspaceRoot, { recursive: true });
+    mkdirSync4(spec.workspaceRoot, { recursive: true });
     const reposFile = writeSessionReposFile(spec.repos);
     const mountArgs = [
       "-v",
@@ -6136,7 +6366,7 @@ class DockerProvider {
       image: this.image,
       manager_ws: managerWsUrl,
       auth_mounts: authMounts
-    }, "docker run \u2014 creating session container");
+    }, "docker run — creating session container");
     let containerId;
     const userArg = containerUserArg();
     const userArgs = userArg ? ["--user", userArg] : [];
@@ -6177,7 +6407,7 @@ class DockerProvider {
       log3.info({ container_id: session.providerRuntimeId }, "session container removed");
     } catch (err) {
       if (isContainerAlreadyAbsent(err)) {
-        log3.info({ container_id: session.providerRuntimeId }, "docker rm \u2014 container already absent, treating as released");
+        log3.info({ container_id: session.providerRuntimeId }, "docker rm — container already absent, treating as released");
         return;
       }
       throw err;
@@ -6206,17 +6436,18 @@ class DockerProvider {
 function cleanupSessionGitAuthDir(workspaceRoot) {
   if (!workspaceRoot)
     return;
-  rmSync2(join4(workspaceRoot, ".vine", "git-auth"), {
+  rmSync2(join5(workspaceRoot, ".vine", "git-auth"), {
     recursive: true,
     force: true
   });
 }
 
 // src/provider/local.ts
-import { mkdirSync as mkdirSync4, rmSync as rmSync3 } from "fs";
-import { delimiter, join as join5 } from "path";
-import { fileURLToPath } from "url";
-var log4 = childLogger({ subsystem: "provider-local" });
+import { spawn as spawn2 } from "node:child_process";
+import { mkdirSync as mkdirSync5, rmSync as rmSync3 } from "node:fs";
+import { delimiter, join as join6 } from "node:path";
+import { fileURLToPath } from "node:url";
+var log4 = childLogger2({ subsystem: "provider-local" });
 function runnerEntryPath() {
   return new URL("../../../runtime-runner/src/cli/index.ts", import.meta.url).pathname;
 }
@@ -6239,7 +6470,7 @@ class LocalProvider {
   procs = new Map;
   reposFiles = new Map;
   async createSession(spec) {
-    mkdirSync4(spec.workspaceRoot, { recursive: true });
+    mkdirSync5(spec.workspaceRoot, { recursive: true });
     const entry = runnerEntryPath();
     log4.info({
       session_id: spec.sessionId,
@@ -6261,16 +6492,19 @@ class LocalProvider {
       env.VINE_REPOS_JSON_FILE = reposFile.filePath;
     let proc;
     try {
-      proc = Bun.spawn({
-        cmd: ["bun", "run", entry],
+      proc = spawn2("bun", ["run", entry], {
         env,
-        stdout: "inherit",
-        stderr: "inherit"
+        stdio: ["ignore", "inherit", "inherit"]
       });
     } catch (err) {
       removeSessionReposFile(reposFile);
       throw err;
     }
+    if (proc.pid === undefined) {
+      proc.kill();
+      removeSessionReposFile(reposFile);
+      throw new Error("local runner spawn did not return a pid");
+    }
     const providerRuntimeId = String(proc.pid);
     this.procs.set(providerRuntimeId, proc);
     if (reposFile) {
@@ -6292,7 +6526,7 @@ class LocalProvider {
     if (!proc) {
       this.cleanupReposFile(session.providerRuntimeId);
       cleanupSessionGitAuthDir2(session.workspaceRoot);
-      log4.warn({ provider_runtime_id: session.providerRuntimeId }, "releaseSession \u2014 no tracked process");
+      log4.warn({ provider_runtime_id: session.providerRuntimeId }, "releaseSession — no tracked process");
       return;
     }
     proc.kill();
@@ -6318,7 +6552,7 @@ class LocalProvider {
 function cleanupSessionGitAuthDir2(workspaceRoot) {
   if (!workspaceRoot)
     return;
-  rmSync3(join5(workspaceRoot, ".vine", "git-auth"), {
+  rmSync3(join6(workspaceRoot, ".vine", "git-auth"), {
     recursive: true,
     force: true
   });
@@ -6330,6 +6564,9 @@ function resolvePathKey(inputEnv) {
   return inputEnv.PATH === undefined && inputEnv.Path !== undefined ? "Path" : "PATH";
 }
 
+// src/runner-link/runner-link-server.ts
+import { createServer } from "node:http";
+
 // ../../packages/errors/src/app-error.ts
 class AppError extends Error {
   code;
@@ -6372,82 +6609,116 @@ function asAppError(err, defaultCode = "INTERNAL_UNKNOWN") {
   });
 }
 // src/runner-link/runner-link-server.ts
-var log5 = childLogger({ subsystem: "runner-link" });
+import WebSocket, { WebSocketServer } from "ws";
+var log5 = childLogger2({ subsystem: "runner-link" });
+var RUNNER_SOCKET_IDLE_TIMEOUT_MS = 120000;
 
 class RunnerLinkServer {
   opts;
-  server = null;
+  httpServer = null;
+  wsServer = null;
+  boundPort = null;
   credentials = new Map;
   runners = new Map;
+  idleTimers = new WeakMap;
   constructor(opts = {}) {
     this.opts = opts;
   }
-  start() {
+  async start() {
     const credentials = this.credentials;
     const runners = this.runners;
     const opts = this.opts;
     const envPort = Number(process.env.PORT);
     const resolvedPort = this.opts.port ?? (Number.isInteger(envPort) && envPort > 0 ? envPort : 0);
-    this.server = Bun.serve({
-      port: resolvedPort,
-      ...this.opts.host !== undefined ? { hostname: this.opts.host } : {},
-      fetch(req, server) {
-        if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
-          const ok = server.upgrade(req, { data: { sessionId: null } });
-          if (ok)
-            return;
-          return new Response("expected websocket upgrade", { status: 426 });
+    this.wsServer = new WebSocketServer({ noServer: true });
+    this.httpServer = createServer((req, res) => {
+      const path = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+      if (req.method === "GET" && (path === "/" || path === "/health")) {
+        res.writeHead(200, { "content-type": "text/plain" });
+        res.end("OK");
+        return;
+      }
+      res.writeHead(404, { "content-type": "text/plain" });
+      res.end("not found");
+    });
+    this.httpServer.on("upgrade", (req, socket, head) => {
+      this.wsServer?.handleUpgrade(req, socket, head, (ws) => {
+        const runnerWs = ws;
+        runnerWs.data = { sessionId: null };
+        this.wsServer?.emit("connection", runnerWs, req);
+      });
+    });
+    this.wsServer.on("connection", (ws) => {
+      log5.info("runner socket opened (awaiting runner.hello)");
+      this.armIdleTimeout(ws);
+      ws.on("message", (raw, isBinary) => {
+        this.armIdleTimeout(ws);
+        if (isBinary) {
+          log5.warn({ kind: "binary" }, "non-text frame dropped");
+          return;
         }
-        const path = new URL(req.url).pathname;
-        if (req.method === "GET" && (path === "/" || path === "/health")) {
-          return new Response("OK", { status: 200 });
+        let parsed;
+        try {
+          parsed = RunnerToManagerMessage.parse(JSON.parse(rawDataToText(raw)));
+        } catch (err) {
+          log5.error({ err: asAppError(err) }, "runner frame rejected");
+          return;
         }
-        return new Response("not found", { status: 404 });
-      },
-      websocket: {
-        idleTimeout: 120,
-        open() {
-          log5.info("runner socket opened (awaiting runner.hello)");
-        },
-        message(ws, raw) {
-          if (typeof raw !== "string") {
-            log5.warn({ kind: typeof raw }, "non-text frame dropped");
-            return;
-          }
-          let parsed;
-          try {
-            parsed = RunnerToManagerMessage.parse(JSON.parse(raw));
-          } catch (err) {
-            log5.error({ err: asAppError(err) }, "runner frame rejected");
-            return;
-          }
-          handleRunnerFrame(ws, parsed, credentials, runners, opts);
-        },
-        close(ws, code, reason) {
-          const { sessionId } = ws.data;
-          if (sessionId) {
-            if (runners.get(sessionId)?.socket === ws) {
-              runners.delete(sessionId);
-              opts.onRunnerClosed?.(sessionId);
-            }
-            log5.warn({ session_id: sessionId, code, reason }, "runner closed");
-          } else {
-            log5.warn({ code, reason }, "unauthenticated runner closed");
+        handleRunnerFrame(ws, parsed, credentials, runners, opts);
+      });
+      ws.on("close", (code, reason) => {
+        this.clearIdleTimeout(ws);
+        const { sessionId } = ws.data;
+        const closeReason = reason.toString();
+        if (sessionId) {
+          if (runners.get(sessionId)?.socket === ws) {
+            runners.delete(sessionId);
+            opts.onRunnerClosed?.(sessionId);
           }
+          log5.warn({ session_id: sessionId, code, reason: closeReason }, "runner closed");
+        } else {
+          log5.warn({ code, reason: closeReason }, "unauthenticated runner closed");
         }
-      }
+      });
+      ws.on("error", (err) => {
+        log5.warn({ err: asAppError(err) }, "runner socket error");
+      });
     });
-    const url = `ws://127.0.0.1:${this.server.port}`;
+    await new Promise((resolve3, reject) => {
+      const onError = (err) => {
+        this.httpServer?.off("listening", onListening);
+        reject(err);
+      };
+      const onListening = () => {
+        this.httpServer?.off("error", onError);
+        resolve3();
+      };
+      this.httpServer?.once("error", onError);
+      this.httpServer?.once("listening", onListening);
+      this.httpServer?.listen(resolvedPort, this.opts.host);
+    });
+    const address = this.httpServer.address();
+    if (address === null || typeof address === "string") {
+      throw new Error("runner-link server did not bind a TCP port");
+    }
+    this.boundPort = address.port;
+    const url = `ws://127.0.0.1:${this.boundPort}`;
     log5.info({ url }, "runner-link server listening");
     return url;
   }
   stop() {
-    this.server?.stop(true);
-    this.server = null;
+    for (const client of this.wsServer?.clients ?? []) {
+      client.terminate();
+    }
+    this.wsServer?.close();
+    this.httpServer?.close();
+    this.wsServer = null;
+    this.httpServer = null;
+    this.boundPort = null;
     this.runners.clear();
   }
   get url() {
-    return this.server ? `ws://127.0.0.1:${this.server.port}` : null;
+    return this.boundPort ? `ws://127.0.0.1:${this.boundPort}` : null;
   }
   registerSession(credential) {
     this.credentials.set(credential.sessionId, credential.sessionToken);
@@ -6477,9 +6748,29 @@ class RunnerLinkServer {
       log5.warn({ session_id: sessionId, type: msg.type }, "no runner to send");
       return false;
     }
+    if (runner.socket.readyState !== WebSocket.OPEN) {
+      log5.warn({ session_id: sessionId, type: msg.type }, "runner socket is not open");
+      return false;
+    }
     runner.socket.send(JSON.stringify(msg));
     return true;
   }
+  armIdleTimeout(ws) {
+    this.clearIdleTimeout(ws);
+    const timer = setTimeout(() => {
+      if (ws.readyState === WebSocket.OPEN) {
+        ws.close(1001, "runner idle timeout");
+      }
+    }, RUNNER_SOCKET_IDLE_TIMEOUT_MS);
+    timer.unref?.();
+    this.idleTimers.set(ws, timer);
+  }
+  clearIdleTimeout(ws) {
+    const timer = this.idleTimers.get(ws);
+    if (timer)
+      clearTimeout(timer);
+    this.idleTimers.delete(ws);
+  }
 }
 function handleRunnerFrame(ws, msg, credentials, runners, opts) {
   switch (msg.type) {
@@ -6494,7 +6785,7 @@ function handleRunnerFrame(ws, msg, credentials, runners, opts) {
       } = msg.payload;
       const expected = credentials.get(session_id);
       if (expected === undefined || expected !== session_token) {
-        log5.warn({ session_id, runner_kind }, "runner.hello rejected \u2014 token mismatch / unknown session");
+        log5.warn({ session_id, runner_kind }, "runner.hello rejected — token mismatch / unknown session");
         sendAck(ws, {
           session_id,
           result: "rejected",
@@ -6509,7 +6800,7 @@ function handleRunnerFrame(ws, msg, credentials, runners, opts) {
       }
       ws.data.sessionId = session_id;
       runners.set(session_id, { sessionId: session_id, socket: ws });
-      log5.info({ session_id, runner_kind, pid }, "runner.hello accepted \u2014 handshake complete");
+      log5.info({ session_id, runner_kind, pid }, "runner.hello accepted — handshake complete");
       sendAck(ws, { session_id, result: "accepted" });
       opts.onRunnerHello?.({
         sessionId: session_id,
@@ -6523,7 +6814,7 @@ function handleRunnerFrame(ws, msg, credentials, runners, opts) {
     case "runner.ready": {
       if (!frameMatchesAuthenticatedSession(ws, msg, runners))
         return;
-      log5.info({ session_id: msg.payload.session_id }, "runner.ready received \u2014 runner can accept turns");
+      log5.info({ session_id: msg.payload.session_id }, "runner.ready received — runner can accept turns");
       opts.onRunnerReady?.(msg.payload.session_id);
       return;
     }
@@ -6567,7 +6858,7 @@ function handleRunnerFrame(ws, msg, credentials, runners, opts) {
     }
     case "cli.request": {
       if (!ws.data.sessionId) {
-        log5.warn({ request_id: msg.payload.request_id }, "cli.request before runner.hello \u2014 dropping");
+        log5.warn({ request_id: msg.payload.request_id }, "cli.request before runner.hello — dropping");
         return;
       }
       opts.onCliRequest?.(ws.data.sessionId, msg.payload);
@@ -6613,7 +6904,7 @@ function runnerFrameSessionMatchesSocket(authenticatedSessionId, frameType, payl
     frame_type: frameType,
     authenticated_session_id: authenticatedSessionId,
     payload_session_id: payloadSessionId
-  }, "runner frame session_id does not match authenticated socket session \u2014 dropping");
+  }, "runner frame session_id does not match authenticated socket session — dropping");
   return false;
 }
 function framePayloadSessionId(msg) {
@@ -6625,7 +6916,7 @@ function frameMatchesAuthenticatedSession(ws, msg, runners) {
     return false;
   }
   if (sessionId === null || runners.get(sessionId)?.socket !== ws) {
-    log5.warn({ frame_type: msg.type, session_id: sessionId }, "runner frame from a socket that is not the session's current runner \u2014 dropping");
+    log5.warn({ frame_type: msg.type, session_id: sessionId }, "runner frame from a socket that is not the session's current runner — dropping");
     return false;
   }
   return true;
@@ -6634,9 +6925,17 @@ function sendAck(ws, payload) {
   const frame = { type: "hello.ack", payload };
   ws.send(JSON.stringify(frame));
 }
+function rawDataToText(raw) {
+  if (Array.isArray(raw))
+    return Buffer.concat(raw).toString("utf8");
+  if (raw instanceof ArrayBuffer) {
+    return Buffer.from(new Uint8Array(raw)).toString("utf8");
+  }
+  return Buffer.from(raw).toString("utf8");
+}
 
 // src/runner-link/smoke.ts
-var log6 = childLogger({ subsystem: "runner-link-smoke" });
+var log6 = childLogger2({ subsystem: "runner-link-smoke" });
 var HANDSHAKE_TIMEOUT_MS = 15000;
 var TURN_TIMEOUT_MS = 120000;
 var POLL_INTERVAL_MS = 100;
@@ -6674,7 +6973,7 @@ async function runRunnerLinkSmoke() {
       }, "smoke: turn.finished");
     }
   });
-  const managerWsUrl = server.start();
+  const managerWsUrl = await server.start();
   server.registerSession({ sessionId, sessionToken });
   log6.info({ session_id: sessionId, manager_ws: managerWsUrl }, "smoke: server up");
   const providerKind = normalizeRuntimeProviderKind(process.env.VINE_PROVIDER ?? "local_process");
@@ -6692,7 +6991,7 @@ async function runRunnerLinkSmoke() {
     default:
       throw new Error(`runner-link smoke does not support ${providerKind}`);
   }
-  const workspaceRoot = join6(tmpdir3(), "vine-runtime-smoke", sessionId);
+  const workspaceRoot = join7(tmpdir3(), "vine-runtime-smoke", sessionId);
   log6.info({ provider: provider.kind, workspace: workspaceRoot }, "smoke: provider");
   let provisioned;
   try {
@@ -6704,7 +7003,7 @@ async function runRunnerLinkSmoke() {
       repos: []
     });
   } catch (err) {
-    log6.error({ err }, "smoke: FAILED \u2014 could not provision runner");
+    log6.error({ err }, "smoke: FAILED — could not provision runner");
     server.stop();
     return 1;
   }
@@ -6712,15 +7011,15 @@ async function runRunnerLinkSmoke() {
   while (Date.now() < handshakeDeadline) {
     if (ready)
       break;
-    await Bun.sleep(POLL_INTERVAL_MS);
+    await sleep3(POLL_INTERVAL_MS);
   }
   if (!ready) {
-    log6.error({ session_id: sessionId, timeout_ms: HANDSHAKE_TIMEOUT_MS }, "smoke: FAILED \u2014 runner did not become ready in time");
+    log6.error({ session_id: sessionId, timeout_ms: HANDSHAKE_TIMEOUT_MS }, "smoke: FAILED — runner did not become ready in time");
     await provider.releaseSession(provisioned);
     server.stop();
     return 1;
   }
-  log6.info({ session_id: sessionId, runner_pid: provisioned.providerRuntimeId }, "smoke: handshake OK \u2014 dispatching turn");
+  log6.info({ session_id: sessionId, runner_pid: provisioned.providerRuntimeId }, "smoke: handshake OK — dispatching turn");
   const { backend, prompt } = smokeTurnConfig();
   const turnStart = {
     turn_id: turnId,
@@ -6741,17 +7040,20 @@ async function runRunnerLinkSmoke() {
   while (Date.now() < turnDeadline) {
     if (finished)
       break;
-    await Bun.sleep(POLL_INTERVAL_MS);
+    await sleep3(POLL_INTERVAL_MS);
   }
   await provider.releaseSession(provisioned);
   server.stop();
   if (!finished) {
-    log6.error({ turn_id: turnId, timeout_ms: TURN_TIMEOUT_MS, event_count: eventCount }, "smoke: FAILED \u2014 turn did not finish in time");
+    log6.error({ turn_id: turnId, timeout_ms: TURN_TIMEOUT_MS, event_count: eventCount }, "smoke: FAILED — turn did not finish in time");
     return 1;
   }
-  log6.info({ turn_id: turnId, event_count: eventCount }, "smoke: OK \u2014 turn completed end-to-end");
+  log6.info({ turn_id: turnId, event_count: eventCount }, "smoke: OK — turn completed end-to-end");
   return 0;
 }
+function sleep3(ms) {
+  return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
+}
 
 // src/cli-dispatch/handlers/question.ts
 async function handleAskCommand(input, command, deps) {
@@ -6785,7 +7087,7 @@ async function handleAskCommand(input, command, deps) {
   };
 }
 function activeTurnError(requestId, active) {
-  return errorResponse(requestId, active.code, active.code === "ASK_NOT_IN_ACTIVE_TURN" ? "no active agent turn for this session \u2014 ask is only valid inside a running turn" : "session has more than one active agent turn \u2014 cannot attribute the ask");
+  return errorResponse(requestId, active.code, active.code === "ASK_NOT_IN_ACTIVE_TURN" ? "no active agent turn for this session — ask is only valid inside a running turn" : "session has more than one active agent turn — cannot attribute the ask");
 }
 function errorResponse(requestId, code, message) {
   return {
@@ -6932,7 +7234,7 @@ class TaskContentCache {
 }
 
 // src/cli-dispatch/index.ts
-var log7 = childLogger({ subsystem: "runtime-manager.cli-dispatch" });
+var log7 = childLogger2({ subsystem: "runtime-manager.cli-dispatch" });
 function createCliDispatcher(deps) {
   return {
     async handle(input) {
@@ -6959,7 +7261,7 @@ function createCliDispatcher(deps) {
 }
 
 // src/provider/e2b.ts
-var log8 = childLogger({ subsystem: "provider-e2b" });
+var log8 = childLogger2({ subsystem: "provider-e2b" });
 var DEFAULT_WORKSPACE_BASE2 = "/home/user/vine-runtime-manager";
 var DEFAULT_CLEANUP_TIMEOUT_MS = 30000;
 var DEFAULT_RUNNER_START_GUARD_MS = 2000;
@@ -7046,7 +7348,7 @@ class E2BProvider {
       log8.warn({
         default_timeout_ms: DEFAULT_E2B_SANDBOX_TIMEOUT_MS,
         default_idle_ttl_sec: Math.floor(DEFAULT_E2B_SANDBOX_TIMEOUT_MS / 1000)
-      }, "E2B idle_ttl_sec unconfigured \u2014 falling back to default sandbox lifetime; set capacity_policy.idle_ttl_sec to tune");
+      }, "E2B idle_ttl_sec unconfigured — falling back to default sandbox lifetime; set capacity_policy.idle_ttl_sec to tune");
     }
     const normalizedConfig = normalizeRuntimeProviderConfigForBackend("e2b", {
       ...config,
@@ -7068,7 +7370,7 @@ class E2BProvider {
       resolved_timeout_ms: this.timeoutMs,
       lifecycle_on_timeout: this.lifecycleOnTimeout,
       auto_resume: this.autoResume
-    }, "E2B provider configured \u2014 resolved sandbox lifetime");
+    }, "E2B provider configured — resolved sandbox lifetime");
     this.capacityPolicy = this.currentCapacityPolicy();
     this.config = this.currentConfig(config.runner_link_public_url);
     this.client = this.injectedClient ?? (this.apiKey ? new E2BSdkClient : null);
@@ -7166,12 +7468,12 @@ class E2BProvider {
       await this.touchSandboxActivity(sandbox);
     } catch (err) {
       if (isSandboxMissingError(err)) {
-        log8.warn({ sandbox_id: sandboxId, err: asAppError(err) }, "E2B keepalive ping found missing sandbox \u2014 stopping keepalive");
+        log8.warn({ sandbox_id: sandboxId, err: asAppError(err) }, "E2B keepalive ping found missing sandbox — stopping keepalive");
         this.stopKeepalive(sandboxId);
         this.sessions.delete(sandboxId);
         return;
       }
-      log8.warn({ sandbox_id: sandboxId, err: asAppError(err) }, "E2B keepalive ping failed \u2014 will retry");
+      log8.warn({ sandbox_id: sandboxId, err: asAppError(err) }, "E2B keepalive ping failed — will retry");
     }
   }
   async touchSandboxActivity(sandbox) {
@@ -7208,7 +7510,7 @@ class E2BProvider {
         sandbox_id: sandbox.sandboxId,
         requested_timeout_ms: this.timeoutMs,
         err: asAppError(err)
-      }, "E2B initial lease refresh failed \u2014 create timeout remains authoritative");
+      }, "E2B initial lease refresh failed — create timeout remains authoritative");
     }
     await this.observeLease(sandbox, sessionId, "initial_refresh");
   }
@@ -7307,7 +7609,7 @@ class E2BProvider {
         err: asAppError(err),
         session_id: spec.sessionId,
         sandbox_id: session.providerRuntimeId
-      }, "E2B sandbox missing during respawn \u2014 provisioning replacement sandbox");
+      }, "E2B sandbox missing during respawn — provisioning replacement sandbox");
       return this.createSession(spec);
     }
     const workspaceRoot = tracked.workspaceRoot;
@@ -7335,7 +7637,7 @@ class E2BProvider {
           err: asAppError(err),
           session_id: spec.sessionId,
           sandbox_id: session.providerRuntimeId
-        }, "E2B sandbox disappeared during respawn \u2014 provisioning replacement sandbox");
+        }, "E2B sandbox disappeared during respawn — provisioning replacement sandbox");
         return this.createSession(spec);
       }
       if (reposFilePath) {
@@ -7363,14 +7665,14 @@ class E2BProvider {
     const staleCommandId = tracked.commandId;
     tracked.command = null;
     if (!stale.kill) {
-      log8.warn({ reason, command_id: staleCommandId }, "prior E2B runner command has no kill() method \u2014 skipping");
+      log8.warn({ reason, command_id: staleCommandId }, "prior E2B runner command has no kill() method — skipping");
       return;
     }
     try {
       const killed = await stale.kill();
       log8.info({ reason, command_id: staleCommandId, killed }, "killed prior E2B runner command before respawn");
     } catch (err) {
-      log8.warn({ reason, command_id: staleCommandId, err: asAppError(err) }, "failed to kill prior E2B runner command \u2014 proceeding to spawn anyway");
+      log8.warn({ reason, command_id: staleCommandId, err: asAppError(err) }, "failed to kill prior E2B runner command — proceeding to spawn anyway");
     }
   }
   async getLogs(session) {
@@ -7439,7 +7741,7 @@ class E2BProvider {
       return;
     const outcome = await Promise.race([
       command.wait().then((result) => ({ kind: "result", result }), (err) => ({ kind: "error", err })),
-      sleep2(DEFAULT_RUNNER_START_GUARD_MS).then(() => ({
+      sleep4(DEFAULT_RUNNER_START_GUARD_MS).then(() => ({
         kind: "timeout"
       }))
     ]);
@@ -7712,9 +8014,9 @@ function isSandboxMissingError(err) {
   const text = `${err.name} ${err.message}`.toLowerCase();
   return text.includes("sandboxnotfound") || text.includes("sandbox not found") || text.includes("sandbox was not found") || text.includes("notfounderror");
 }
-function sleep2(ms) {
-  return new Promise((resolve2) => {
-    const timer = setTimeout(resolve2, ms);
+function sleep4(ms) {
+  return new Promise((resolve3) => {
+    const timer = setTimeout(resolve3, ms);
     const maybeTimer = timer;
     maybeTimer.unref?.();
   });
@@ -7731,8 +8033,8 @@ function omitUndefined2(value) {
 }
 
 // src/provider/vercel.ts
-import { Writable } from "stream";
-var log9 = childLogger({ subsystem: "provider-vercel" });
+import { Writable } from "node:stream";
+var log9 = childLogger2({ subsystem: "provider-vercel" });
 var DEFAULT_WORKSPACE_BASE3 = "/vercel/sandbox/vine-runtime-manager";
 var DEFAULT_RUNNER_START_GUARD_MS2 = 2000;
 var RUNNER_KIND3 = "remote_sandbox_process";
@@ -8091,7 +8393,7 @@ class VercelProvider {
     const waitPromise = command.wait({ signal: abort.signal }).then((result) => ({ kind: "result", result }), (err) => ({ kind: "error", err }));
     const outcome = await Promise.race([
       waitPromise,
-      sleep3(DEFAULT_RUNNER_START_GUARD_MS2).then(() => ({
+      sleep5(DEFAULT_RUNNER_START_GUARD_MS2).then(() => ({
         kind: "timeout"
       }))
     ]);
@@ -8335,9 +8637,9 @@ function isVercelNotFoundError(err) {
   const message = err instanceof Error ? err.message : String(err);
   return /not[_ -]?found|404/i.test(message);
 }
-function sleep3(ms) {
-  return new Promise((resolve2) => {
-    const timer = setTimeout(resolve2, ms);
+function sleep5(ms) {
+  return new Promise((resolve3) => {
+    const timer = setTimeout(resolve3, ms);
     const maybeTimer = timer;
     maybeTimer.unref?.();
   });
@@ -8475,215 +8777,36 @@ function registrationKeyForProvider(provider) {
   return runtimeProviderRegistrationKey(provider.kind, backend);
 }
 
-// src/runtime-manager-runner-lifecycle.ts
-var log10 = childLogger({ subsystem: "runtime-manager" });
+// src/runtime-manager-session-lifecycle.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join8 } from "node:path";
+var log10 = childLogger2({ subsystem: "runtime-manager" });
 
-class RunnerLifecycle {
+class SessionLifecycle {
   m;
   constructor(m) {
     this.m = m;
   }
-  onRunnerHello(info) {
-    const session = this.m.sessionsById.get(info.sessionId);
-    if (!session) {
-      log10.warn({ session_id: info.sessionId }, "runner.hello for unknown session");
-      return;
-    }
-    session.runnerCapabilities = [...info.runnerCapabilities ?? []];
-    session.terminalSupported = runnerSupportsTerminal(session.runnerCapabilities);
-    if (!session.terminalSupported) {
-      log10.warn({
-        session_id: info.sessionId,
-        runner_version: info.runnerVersion
-      }, "runner does not advertise terminal capability \u2014 outdated runner, republish template; terminal sessions will be refused");
-    }
-    if (session.respawnTimer) {
-      clearTimeout(session.respawnTimer);
-      session.respawnTimer = null;
-      log10.info({ session_id: info.sessionId }, "runner reconnected within window \u2014 cancelled pending respawn");
-    }
-    if (session.provisioned) {
-      session.provisioned = {
-        ...session.provisioned,
-        providerRuntimeId: session.providerKind === "local_process" ? String(info.pid) : session.provisioned.providerRuntimeId,
-        runnerKind: info.runnerKind
+  buildProviderAnnounce() {
+    const runnerLinkPublicUrl = this.m.opts.runnerLinkPublicUrl;
+    const entries = [];
+    for (const provider of this.m.providers.values()) {
+      const backend = provider.kind === "remote_sandbox" ? provider.config?.remote_sandbox_backend ?? REMOTE_SANDBOX_DEFAULT_BACKEND : null;
+      const registrationKey = runtimeProviderRegistrationKey(provider.kind, backend);
+      const config = {
+        ...provider.config ?? {},
+        ...backend ? { remote_sandbox_backend: backend } : {},
+        ...runnerLinkPublicUrl ? { runner_link_public_url: runnerLinkPublicUrl } : {}
       };
-    }
-  }
-  onRunnerReady(sessionId) {
-    const session = this.m.sessionsById.get(sessionId);
-    if (!session) {
-      log10.warn({ session_id: sessionId }, "runner.ready for unknown session");
-      return;
-    }
-    const isFirstReady = !session.ready;
-    session.ready = true;
-    session.runnerReadyOnce = true;
-    this.clearRunnerBootTimer(session);
-    this.m.emitRunnerState(session, "ready");
-    this.m.cleanupSessionReposFile(session, "runner_ready");
-    const pending = session.pending.splice(0);
-    if (isFirstReady && pending.length > 0) {
-      this.m.emitSessionState(session, "active");
-    }
-    log10.info({
-      session_id: sessionId,
-      flushed: pending.length,
-      first_ready: isFirstReady
-    }, "runner ready \u2014 flushing queued turns");
-    if (session.taskId && pending.length > 0) {
-      this.m.flushPendingTurnsAfterProjection(session, pending).catch((err) => {
-        const detail = err instanceof Error ? err.message : String(err);
-        log10.error({ err, session_id: session.sessionId }, "task projection failed before queued turns flushed");
-        this.m.failTrackedTurns(session, detail);
+      entries.push({
+        provider_kind: provider.kind,
+        status: this.m.disabledProviderKeys.has(registrationKey) ? "disabled" : "active",
+        capacity_policy: provider.capacityPolicy ?? {},
+        config
       });
-      return;
     }
-    this.m.flushPendingTurns(session, pending);
-  }
-  onRunnerClosed(sessionId) {
-    const session = this.m.sessionsById.get(sessionId);
-    if (!session)
-      return;
-    if (this.m.stopped)
-      return;
-    session.ready = false;
-    this.clearRunnerBootTimer(session);
-    log10.warn({ session_id: sessionId }, "runner socket closed unexpectedly");
-    this.m.logProviderDiagnostics(session, "runner_socket_closed");
-    if (!session.runnerReadyOnce) {
-      const detail = "runner closed before becoming ready";
-      this.m.failTrackedTurns(session, detail);
-      this.m.emitRunnerStateFailed(session, detail);
-      this.m.emitSessionStateFailed(session, detail);
-      return;
-    }
-    this.m.emitRunnerState(session, "disconnected");
-    if (session.respawnTimer) {
-      clearTimeout(session.respawnTimer);
-    }
-    session.respawnTimer = setTimeout(() => {
-      session.respawnTimer = null;
-      if (this.m.stopped)
-        return;
-      if (this.m.runnerLink.hasRunner(sessionId)) {
-        log10.info({ session_id: sessionId }, "respawn timer fired but runner already connected \u2014 skipping");
-        return;
-      }
-      const detail = "runner crashed mid-turn";
-      if (this.m.retryCrashedRunnerTurns(session, detail)) {
-        return;
-      }
-      this.m.failTrackedTurns(session, detail);
-      this.maybeRespawnDisconnectedSession(session, "reconnect_window_expired");
-    }, this.m.runnerReconnectWindowMs);
-  }
-  onRunnerBootFailed(sessionId, lastError) {
-    const session = this.m.sessionsById.get(sessionId);
-    if (!session) {
-      log10.warn({ session_id: sessionId }, "runner.boot_failed for unknown session");
-      return;
-    }
-    if (session.respawnTimer) {
-      clearTimeout(session.respawnTimer);
-      session.respawnTimer = null;
-    }
-    this.clearRunnerBootTimer(session);
-    this.m.cleanupSessionReposFile(session, "runner_boot_failed");
-    session.ready = false;
-    session.pendingRespawnRepos = null;
-    log10.error({ session_id: sessionId, last_error: lastError }, "runner reported boot failure \u2014 marking session failed");
-    this.m.logProviderDiagnostics(session, "runner_boot_failed");
-    this.m.failTrackedTurns(session, lastError);
-    this.m.emitRunnerStateFailed(session, lastError);
-    this.m.emitSessionStateFailed(session, lastError);
-  }
-  maybeRespawnDisconnectedSession(session, reason) {
-    if (this.m.stopped)
-      return;
-    if (!session.provisioned)
-      return;
-    if (session.respawnTimer)
-      return;
-    if (this.m.runnerLink.hasRunner(session.sessionId))
-      return;
-    if (!session.runnerReadyOnce)
-      return;
-    if (session.lastStatus === "starting")
-      return;
-    if (session.repoRequiresGitAuth && !session.pendingRespawnRepos) {
-      log10.info({ session_id: session.sessionId, reason }, "deferring private-repo runner respawn until a dispatch provides fresh git auth");
-      return;
-    }
-    this.m.respawnRunner(session);
-  }
-  scheduleRunnerBootTimeout(session) {
-    this.clearRunnerBootTimer(session);
-    if (this.m.runnerBootTimeoutMs <= 0)
-      return;
-    const timer = setTimeout(() => {
-      this.onRunnerBootTimeout(session.sessionId);
-    }, this.m.runnerBootTimeoutMs);
-    unrefTimer(timer);
-    session.runnerBootTimer = timer;
-  }
-  clearRunnerBootTimer(session) {
-    if (!session.runnerBootTimer)
-      return;
-    clearTimeout(session.runnerBootTimer);
-    session.runnerBootTimer = null;
-  }
-  onRunnerBootTimeout(sessionId) {
-    const session = this.m.sessionsById.get(sessionId);
-    if (!session || this.m.stopped || session.ready)
-      return;
-    session.runnerBootTimer = null;
-    const detail = `runner did not become ready within ${Math.ceil(this.m.runnerBootTimeoutMs / 1000)} seconds`;
-    log10.error({
-      session_id: sessionId,
-      provider: session.providerKind,
-      provider_key: session.providerKey,
-      provider_runtime_id: session.provisioned?.providerRuntimeId ?? null,
-      pending_turns: session.pending.length
-    }, "runner boot timeout \u2014 marking session failed");
-    this.m.cleanupSessionReposFile(session, "runner_boot_timeout");
-    this.m.logProviderDiagnostics(session, "runner_boot_timeout");
-    this.m.failTrackedTurns(session, detail);
-    this.m.emitRunnerStateFailed(session, detail);
-    this.m.emitSessionStateFailed(session, detail);
-  }
-}
-
-// src/runtime-manager-session-lifecycle.ts
-import { randomUUID as randomUUID4 } from "crypto";
-import { tmpdir as tmpdir4 } from "os";
-import { join as join7 } from "path";
-var log11 = childLogger({ subsystem: "runtime-manager" });
-
-class SessionLifecycle {
-  m;
-  constructor(m) {
-    this.m = m;
-  }
-  buildProviderAnnounce() {
-    const runnerLinkPublicUrl = this.m.opts.runnerLinkPublicUrl;
-    const entries = [];
-    for (const provider of this.m.providers.values()) {
-      const backend = provider.kind === "remote_sandbox" ? provider.config?.remote_sandbox_backend ?? REMOTE_SANDBOX_DEFAULT_BACKEND : null;
-      const registrationKey = runtimeProviderRegistrationKey(provider.kind, backend);
-      const config = {
-        ...provider.config ?? {},
-        ...backend ? { remote_sandbox_backend: backend } : {},
-        ...runnerLinkPublicUrl ? { runner_link_public_url: runnerLinkPublicUrl } : {}
-      };
-      entries.push({
-        provider_kind: provider.kind,
-        status: this.m.disabledProviderKeys.has(registrationKey) ? "disabled" : "active",
-        capacity_policy: provider.capacityPolicy ?? {},
-        config
-      });
-    }
-    return entries;
+    return entries;
   }
   handleProvidersRegistered(info) {
     const { providerIdByRegKey, providerConfigByRegKey } = info;
@@ -8697,7 +8820,7 @@ class SessionLifecycle {
       const providerConfig = providerConfigByRegKey.get(regKey);
       if (!id) {
         const available = Array.from(providerIdByRegKey.keys());
-        log11.error({
+        log10.error({
           provider: provider.kind,
           registration_key: regKey,
           available_keys: available
@@ -8747,21 +8870,21 @@ class SessionLifecycle {
   async handleServerSessionRelease(payload) {
     const session = this.m.sessionsById.get(payload.session_id);
     if (!session) {
-      log11.warn({ session_id: payload.session_id }, "session.release for unknown session \u2014 dropping");
+      log10.warn({ session_id: payload.session_id }, "session.release for unknown session — dropping");
       return;
     }
     const key = sessionKey(session.channelId);
-    log11.info({
+    log10.info({
       session_id: payload.session_id,
       reason: payload.reason,
       force: payload.force
-    }, "session.release received \u2014 tearing down session");
+    }, "session.release received — tearing down session");
     if (session.terminalRefs.size > 0) {
       if (!payload.force) {
-        log11.info({
+        log10.info({
           session_id: payload.session_id,
           terminal_count: session.terminalRefs.size
-        }, "session.release ignored \u2014 terminals attached (keep-alive); re-asserting active");
+        }, "session.release ignored — terminals attached (keep-alive); re-asserting active");
         this.m.emitSessionState(session, "active");
         return;
       }
@@ -8791,7 +8914,7 @@ class SessionLifecycle {
   async dirtyProbeHoldsRelease(session) {
     const report = await this.probeDirtyReport(session);
     if (report.repo_present && report.dirty) {
-      log11.info({ session_id: session.sessionId, files: report.dirty_files }, "workspace dirty \u2014 holding as idle_dirty, NOT destroying");
+      log10.info({ session_id: session.sessionId, files: report.dirty_files }, "workspace dirty — holding as idle_dirty, NOT destroying");
       this.m.emitSessionState(session, "idle_dirty");
       return true;
     }
@@ -8804,7 +8927,7 @@ class SessionLifecycle {
       await providerForSession(this.m, session).releaseSession(session.provisioned);
       this.finalizeReleasedSession(session, key, sessionId);
     } catch (err) {
-      log11.warn({ err, session_id: sessionId }, "session.release provider teardown failed \u2014 marking failed");
+      log10.warn({ err, session_id: sessionId }, "session.release provider teardown failed — marking failed");
       const detail = err instanceof Error ? err.message : String(err);
       for (const agentSession of session.agentSessions.values()) {
         this.m.emitAgentSessionStateFailed(session, agentSession, detail);
@@ -8814,7 +8937,7 @@ class SessionLifecycle {
     }
   }
   probeDirtyReport(session) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const conservativeDirty = {
         session_id: session.sessionId,
         repo_present: true,
@@ -8822,8 +8945,8 @@ class SessionLifecycle {
         dirty_files: 0
       };
       if (!this.m.runnerLink.hasRunner(session.sessionId)) {
-        log11.info({ session_id: session.sessionId }, "no runner connected \u2014 skipping dirty probe, treating workspace as clean");
-        resolve2({
+        log10.info({ session_id: session.sessionId }, "no runner connected — skipping dirty probe, treating workspace as clean");
+        resolve3({
           session_id: session.sessionId,
           repo_present: false,
           dirty: false,
@@ -8835,12 +8958,12 @@ class SessionLifecycle {
         const idx = session.dirtyWaiters.indexOf(handler);
         if (idx !== -1)
           session.dirtyWaiters.splice(idx, 1);
-        log11.warn({ session_id: session.sessionId, timeout_ms: DIRTY_PROBE_TIMEOUT_MS }, "dirty probe timed out \u2014 treating as dirty (conservative)");
-        resolve2(conservativeDirty);
+        log10.warn({ session_id: session.sessionId, timeout_ms: DIRTY_PROBE_TIMEOUT_MS }, "dirty probe timed out — treating as dirty (conservative)");
+        resolve3(conservativeDirty);
       }, DIRTY_PROBE_TIMEOUT_MS);
       const handler = (report) => {
         clearTimeout(timer);
-        resolve2(report);
+        resolve3(report);
       };
       session.dirtyWaiters.push(handler);
       this.m.runnerLink.sendToRunner(session.sessionId, {
@@ -8855,14 +8978,14 @@ class SessionLifecycle {
       return;
     const waiter = session.dirtyWaiters.shift();
     if (!waiter) {
-      log11.warn({ session_id: payload.session_id }, "dirty_report with no waiter \u2014 dropping");
+      log10.warn({ session_id: payload.session_id }, "dirty_report with no waiter — dropping");
       return;
     }
     waiter(payload);
   }
   async ensureSession(dispatch) {
     if (this.m.stopped) {
-      return Promise.reject(new Error("runtime-manager stopped \u2014 refusing turn.dispatch during shutdown"));
+      return Promise.reject(new Error("runtime-manager stopped — refusing turn.dispatch during shutdown"));
     }
     const resolved = providerForDispatch(this.m, dispatch);
     const key = sessionKey(dispatch.channel_id);
@@ -8882,7 +9005,7 @@ class SessionLifecycle {
   }
   async ensureTerminalSession(payload) {
     if (this.m.stopped) {
-      return Promise.reject(new Error("runtime-manager stopped \u2014 refusing session.ensure during shutdown"));
+      return Promise.reject(new Error("runtime-manager stopped — refusing session.ensure during shutdown"));
     }
     const key = sessionKey(payload.channel_id);
     const existing = this.m.sessions.get(key);
@@ -8951,13 +9074,13 @@ class SessionLifecycle {
     try {
       await providerForSession(this.m, session).releaseSession(session.provisioned);
     } catch (err) {
-      log11.warn({ err, session_id: session.sessionId, reason }, "failed to release terminal session before replacement");
+      log10.warn({ err, session_id: session.sessionId, reason }, "failed to release terminal session before replacement");
     }
   }
   async provisionSession(spec, key, resolved, onProvisionFailed) {
     try {
       if (!this.m.managerWsUrl) {
-        throw new Error("runtime-manager not started \u2014 no runner-link URL");
+        throw new Error("runtime-manager not started — no runner-link URL");
       }
       const ctx = this.buildProvisioningContext(spec);
       const session = this.buildPendingSession(spec, resolved, ctx);
@@ -8990,7 +9113,7 @@ class SessionLifecycle {
   }
   async runProviderCreateSession(spec, resolved, ctx) {
     if (!this.m.managerWsUrl) {
-      throw new Error("runtime-manager not started \u2014 no runner-link URL");
+      throw new Error("runtime-manager not started — no runner-link URL");
     }
     const resourceOwner = this.resourceOwnerForProvider(spec.organization_id, resolved.providerKey, ctx.sessionId);
     return resolved.provider.createSession({
@@ -9006,7 +9129,7 @@ class SessionLifecycle {
     const runtimeManagerId = this.m.serverClient.registeredManagerId;
     const runtimeProviderId = this.m.providerDbIds.get(providerKey);
     if (!runtimeManagerId || !runtimeProviderId) {
-      log11.warn({
+      log10.warn({
         session_id: sessionId,
         provider_key: providerKey,
         manager_registered: Boolean(runtimeManagerId),
@@ -9025,7 +9148,7 @@ class SessionLifecycle {
       this.m.emitRunnerState(session, "starting");
       this.m.scheduleRunnerBootTimeout(session);
     }
-    log11.info({
+    log10.info({
       session_id: ctx.sessionId,
       channel_id: session.channelId,
       cwd: ctx.workspaceRoot,
@@ -9033,17 +9156,17 @@ class SessionLifecycle {
       provider_key: session.providerKey,
       provider_runtime_id: provisioned.providerRuntimeId,
       auth_mount_count: provisioned.authMounts.length
-    }, "runtime session created \u2014 runner provisioned");
+    }, "runtime session created — runner provisioned");
   }
   buildProvisioningContext(spec) {
     const sessionId = randomUUID4();
     const sessionToken = randomUUID4();
     const runnerId = randomUUID4();
-    const workspaceRoot = join7(tmpdir4(), "vine-runtime-manager", sessionId);
+    const workspaceRoot = join8(tmpdir4(), "vine-runtime-manager", sessionId);
     const repos = spec.repositories.map((r) => ({
       repositoryId: r.repository_id,
       repoSlug: r.repo_slug,
-      repoPath: join7(workspaceRoot, "repos", r.repo_slug),
+      repoPath: join8(workspaceRoot, "repos", r.repo_slug),
       repoRemote: r.remote_url,
       repoBranch: r.default_branch,
       setupScript: r.setup_script,
@@ -9108,7 +9231,7 @@ class SessionLifecycle {
       const remoteRoot = provisioned.workspaceRoot;
       session.repos = session.repos.map((r) => ({
         ...r,
-        repoPath: join7(remoteRoot, "repos", r.repoSlug)
+        repoPath: join8(remoteRoot, "repos", r.repoSlug)
       }));
       const remotePrimary = session.repos.length === 1 ? session.repos[0] : null;
       session.cwd = remotePrimary ? remotePrimary.repoPath : remoteRoot;
@@ -9124,7 +9247,7 @@ class SessionLifecycle {
     };
     this.m.emitSessionStateFailed(failed, err instanceof Error ? err.message : String(err));
     onProvisionFailed?.(err);
-    log11.error({ err, session_id: session.sessionId, channel_id: session.channelId }, "session provisioning failed \u2014 rolled back");
+    log10.error({ err, session_id: session.sessionId, channel_id: session.channelId }, "session provisioning failed — rolled back");
   }
   async respawnRunner(session) {
     if (this.m.stopped)
@@ -9133,7 +9256,7 @@ class SessionLifecycle {
       return;
     const provider = providerForSession(this.m, session);
     if (!provider.respawnRunner) {
-      log11.warn({ session_id: session.sessionId, provider: session.providerKind }, "provider does not support respawn \u2014 session remains disconnected");
+      log10.warn({ session_id: session.sessionId, provider: session.providerKind }, "provider does not support respawn — session remains disconnected");
       return;
     }
     if (!this.m.managerWsUrl)
@@ -9143,7 +9266,7 @@ class SessionLifecycle {
     try {
       const respawnRepos = session.pendingRespawnRepos ?? session.repos.map((r) => ({ ...r, gitAuth: null }));
       session.pendingRespawnRepos = null;
-      const respawnWorkspaceRoot = session.provisioned.workspaceRoot ?? (session.repos.length === 1 ? join7(session.cwd, "..", "..") : session.cwd);
+      const respawnWorkspaceRoot = session.provisioned.workspaceRoot ?? (session.repos.length === 1 ? join8(session.cwd, "..", "..") : session.cwd);
       const resourceOwner = this.resourceOwnerForProvider(session.organizationId, session.providerKey, session.sessionId);
       const next = await provider.respawnRunner(session.provisioned, {
         sessionId: session.sessionId,
@@ -9155,12 +9278,12 @@ class SessionLifecycle {
       });
       session.provisioned = next;
       this.m.scheduleRunnerBootTimeout(session);
-      log11.info({
+      log10.info({
         session_id: session.sessionId,
         provider_runtime_id: next.providerRuntimeId
-      }, "runner respawn succeeded \u2014 awaiting hello/ready");
+      }, "runner respawn succeeded — awaiting hello/ready");
     } catch (err) {
-      log11.error({ err, session_id: session.sessionId }, "runner respawn failed \u2014 marking failed");
+      log10.error({ err, session_id: session.sessionId }, "runner respawn failed — marking failed");
       this.logProviderDiagnostics(session, "runner_respawn_failed");
       const detail = err instanceof Error ? err.message : String(err);
       this.m.failTrackedTurns(session, detail);
@@ -9176,7 +9299,7 @@ class SessionLifecycle {
       return;
     try {
       const logs = await provider.getLogs(session.provisioned);
-      log11.warn({
+      log10.warn({
         session_id: session.sessionId,
         provider: session.providerKind,
         provider_runtime_id: session.provisioned.providerRuntimeId,
@@ -9185,7 +9308,7 @@ class SessionLifecycle {
         provider_log_tail: logs.slice(-PROVIDER_LOG_TAIL_SIZE).map(providerLogTailEntry)
       }, "runtime provider diagnostics fetched");
     } catch (err) {
-      log11.warn({
+      log10.warn({
         err,
         session_id: session.sessionId,
         provider: session.providerKind,
@@ -9203,7 +9326,7 @@ class SessionLifecycle {
     try {
       provider.cleanupSessionReposFile(session.provisioned);
     } catch (err) {
-      log11.warn({
+      log10.warn({
         err,
         session_id: session.sessionId,
         provider: session.providerKind,
@@ -9215,7 +9338,7 @@ class SessionLifecycle {
 }
 
 // src/runtime-manager-state-emitter.ts
-var log12 = childLogger({ subsystem: "runtime-manager" });
+var log11 = childLogger2({ subsystem: "runtime-manager" });
 
 class StateEmitter {
   m;
@@ -9227,12 +9350,12 @@ class StateEmitter {
     if (!managerId)
       return;
     if (!this.m.providerDbIds.has(session.providerKey)) {
-      log12.warn({
+      log11.warn({
         session_id: session.sessionId,
         provider_key: session.providerKey,
         available_keys: Array.from(this.m.providerDbIds.keys()),
         status
-      }, "emitSessionState dropped \u2014 provider db id missing for session key");
+      }, "emitSessionState dropped — provider db id missing for session key");
       return;
     }
     const providerDbId = providerIdForSession(this.m, session);
@@ -9260,12 +9383,12 @@ class StateEmitter {
     if (!managerId)
       return;
     if (!this.m.providerDbIds.has(session.providerKey)) {
-      log12.warn({
+      log11.warn({
         session_id: session.sessionId,
         provider_key: session.providerKey,
         available_keys: Array.from(this.m.providerDbIds.keys()),
         last_error: lastError
-      }, "emitSessionStateFailed dropped \u2014 provider db id missing for session key");
+      }, "emitSessionStateFailed dropped — provider db id missing for session key");
       return;
     }
     const providerDbId = providerIdForSession(this.m, session);
@@ -9362,7 +9485,7 @@ class StateEmitter {
   replayActiveStates() {
     if (this.m.sessions.size === 0)
       return;
-    log12.info({ count: this.m.sessions.size }, "boot recovery \u2014 replaying active session states");
+    log11.info({ count: this.m.sessions.size }, "boot recovery — replaying active session states");
     for (const session of this.m.sessions.values()) {
       const status = session.lastStatus ?? "starting";
       if (status === "failed") {
@@ -9381,7 +9504,7 @@ class StateEmitter {
 }
 
 // src/runtime-manager-task-projection-bridge.ts
-var log13 = childLogger({ subsystem: "runtime-manager" });
+var log12 = childLogger2({ subsystem: "runtime-manager" });
 
 class TaskProjectionBridge {
   m;
@@ -9473,10 +9596,10 @@ class TaskProjectionBridge {
         }
         session.pending.push(...pending.slice(i));
         this.m.emitRunnerState(session, "disconnected");
-        log13.warn({
+        log12.warn({
           agent_turn_id: turnStart.turn_id,
           session_id: session.sessionId
-        }, "runner missing while flushing pending turns \u2014 re-parked batch and requesting respawn");
+        }, "runner missing while flushing pending turns — re-parked batch and requesting respawn");
         this.m.maybeRespawnDisconnectedSession(session, "turn_dispatch");
         return;
       }
@@ -9490,7 +9613,7 @@ class TaskProjectionBridge {
 }
 
 // src/runtime-manager-terminal-relay.ts
-var log14 = childLogger({ subsystem: "runtime-manager" });
+var log13 = childLogger2({ subsystem: "runtime-manager" });
 
 class TerminalRelay {
   m;
@@ -9501,12 +9624,12 @@ class TerminalRelay {
     const { session_id, terminal_session_id } = payload;
     const session = this.m.sessionsById.get(session_id);
     if (!session || session.organizationId !== payload.organization_id || session.channelId !== payload.channel_id || session.lastStatus !== null && TERMINAL_SESSION_STATUSES.has(session.lastStatus) || !this.m.runnerLink.hasRunner(session_id)) {
-      log14.warn({
+      log13.warn({
         session_id,
         terminal_session_id,
         channel_id: payload.channel_id,
         has_session: Boolean(session)
-      }, "terminal.open rejected \u2014 session unavailable");
+      }, "terminal.open rejected — session unavailable");
       this.sendCloseToServer({
         organizationId: payload.organization_id,
         channelId: payload.channel_id,
@@ -9515,12 +9638,12 @@ class TerminalRelay {
       return;
     }
     if (!session.terminalSupported) {
-      log14.warn({ session_id, terminal_session_id }, "terminal.open refused \u2014 runner does not support terminal frames (outdated runner)");
+      log13.warn({ session_id, terminal_session_id }, "terminal.open refused — runner does not support terminal frames (outdated runner)");
       this.sendCloseToServer(session, terminal_session_id, "runner_unsupported");
       return;
     }
     if (session.terminalRefs.has(terminal_session_id)) {
-      log14.warn({ session_id, terminal_session_id }, "duplicate terminal.open \u2014 keeping existing route, dropping new open");
+      log13.warn({ session_id, terminal_session_id }, "duplicate terminal.open — keeping existing route, dropping new open");
       return;
     }
     session.terminalRefs.add(terminal_session_id);
@@ -9538,7 +9661,7 @@ class TerminalRelay {
     });
     if (!sent) {
       session.terminalRefs.delete(terminal_session_id);
-      log14.warn({ session_id, terminal_session_id }, "terminal.open relay to runner failed \u2014 closing terminal");
+      log13.warn({ session_id, terminal_session_id }, "terminal.open relay to runner failed — closing terminal");
       this.sendCloseToServer(session, terminal_session_id, "session_unavailable");
       this.recoverIdleAfterDetach(session);
     }
@@ -9587,17 +9710,17 @@ class TerminalRelay {
   onRunnerTerminalData(payload) {
     const session = this.m.sessionsById.get(payload.session_id);
     if (!session) {
-      log14.warn({
+      log13.warn({
         session_id: payload.session_id,
         terminal_session_id: payload.terminal_session_id
-      }, "terminal.data for unknown session \u2014 dropping");
+      }, "terminal.data for unknown session — dropping");
       return;
     }
     if (!session.terminalRefs.has(payload.terminal_session_id)) {
-      log14.warn({
+      log13.warn({
         session_id: payload.session_id,
         terminal_session_id: payload.terminal_session_id
-      }, "terminal.data for untracked terminal \u2014 dropping");
+      }, "terminal.data for untracked terminal — dropping");
       return;
     }
     this.m.serverClient.send({
@@ -9615,17 +9738,17 @@ class TerminalRelay {
   onRunnerTerminalCloseReport(payload) {
     const session = this.m.sessionsById.get(payload.session_id);
     if (!session) {
-      log14.warn({
+      log13.warn({
         session_id: payload.session_id,
         terminal_session_id: payload.terminal_session_id
-      }, "terminal.close (pty exit) for unknown session \u2014 dropping");
+      }, "terminal.close (pty exit) for unknown session — dropping");
       return;
     }
     if (!session.terminalRefs.delete(payload.terminal_session_id)) {
-      log14.warn({
+      log13.warn({
         session_id: payload.session_id,
         terminal_session_id: payload.terminal_session_id
-      }, "terminal.close (pty exit) for untracked terminal \u2014 dropping");
+      }, "terminal.close (pty exit) for untracked terminal — dropping");
       return;
     }
     this.sendCloseToServer(session, payload.terminal_session_id, payload.reason, {
@@ -9712,13 +9835,13 @@ class TerminalRelay {
 }
 
 // src/runtime-manager-turn-router.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 
 // src/turn/constants.ts
 var MAX_DISPATCH_ATTEMPTS = 3;
 
 // src/runtime-manager-turn-router.ts
-var log15 = childLogger({ subsystem: "runtime-manager" });
+var log14 = childLogger2({ subsystem: "runtime-manager" });
 
 class TurnRouter {
   m;
@@ -9751,7 +9874,7 @@ class TurnRouter {
       return;
     }
     if (payload.status === "failed") {
-      log15.warn({
+      log14.warn({
         session_id: payload.session_id,
         agent_turn_id: payload.turn_id,
         exit_code: payload.exit_code,
@@ -9779,7 +9902,7 @@ class TurnRouter {
     if (this.m.disabledProviderKeys.has(input.registrationKey))
       return false;
     this.m.disabledProviderKeys.add(input.registrationKey);
-    log15.error({
+    log14.error({
       ...input.err === undefined ? {} : { err: input.err },
       registration_key: input.registrationKey,
       provider_kind: input.provider.kind,
@@ -9792,7 +9915,7 @@ class TurnRouter {
     const drained = this.m.pendingDispatch.splice(0);
     if (drained.length === 0)
       return;
-    log15.info({ count: drained.length }, "providers registered \u2014 draining queued dispatches");
+    log14.info({ count: drained.length }, "providers registered — draining queued dispatches");
     for (const dispatch of drained) {
       this.m.onTurnDispatch(dispatch).catch((err) => {
         this.reportDispatchFailure(dispatch, err);
@@ -9803,7 +9926,7 @@ class TurnRouter {
     if (this.m.reportedDispatchFailures.has(dispatch.agent_turn_id))
       return;
     this.m.reportedDispatchFailures.add(dispatch.agent_turn_id);
-    log15.error({ err, agent_turn_id: dispatch.agent_turn_id }, "turn.dispatch handling failed \u2014 reporting turn failure");
+    log14.error({ err, agent_turn_id: dispatch.agent_turn_id }, "turn.dispatch handling failed — reporting turn failure");
     this.m.dispatchAttempts.delete(dispatch.agent_turn_id);
     const failureCode = isAppError(err) ? err.code : null;
     this.m.serverClient.send({
@@ -9829,11 +9952,11 @@ class TurnRouter {
     const inFlight = Array.from(session.turnToAgentKey.keys());
     if (inFlight.length === 0)
       return;
-    log15.info({ session_id: session.sessionId, turn_count: inFlight.length, reason }, "cancelling in-flight turns before release");
+    log14.info({ session_id: session.sessionId, turn_count: inFlight.length, reason }, "cancelling in-flight turns before release");
     await Promise.all(inFlight.map((turnId) => this.cancelOneTurn(session, turnId, reason)));
   }
   cancelOneTurn(session, turnId, reason) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let settled = false;
       const finish = () => {
         if (settled)
@@ -9841,7 +9964,7 @@ class TurnRouter {
         settled = true;
         session.cancelWaiters.delete(turnId);
         clearTimeout(timer);
-        resolve2();
+        resolve3();
       };
       session.cancelWaiters.set(turnId, finish);
       this.m.runnerLink.sendToRunner(session.sessionId, {
@@ -9855,11 +9978,11 @@ class TurnRouter {
       const timer = setTimeout(() => {
         if (settled)
           return;
-        log15.warn({
+        log14.warn({
           session_id: session.sessionId,
           turn_id: turnId,
           timeout_ms: TURN_CANCEL_TIMEOUT_MS
-        }, "turn.cancel ack timed out \u2014 quarantining runner + synthesising cancelled terminal");
+        }, "turn.cancel ack timed out — quarantining runner + synthesising cancelled terminal");
         this.quarantineRunnerAfterCancelTimeout(session, reason);
         this.m.serverClient.send({
           type: "turn.finished",
@@ -9901,24 +10024,24 @@ class TurnRouter {
   handleServerTurnCancel(payload) {
     const reason = payload.reason ?? "cancelled by server";
     if (this.removePendingDispatch(payload.agent_turn_id)) {
-      log15.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel removed queued server dispatch");
+      log14.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel removed queued server dispatch");
       return;
     }
     for (const session of this.m.sessionsById.values()) {
       if (session.organizationId !== payload.organization_id)
         continue;
       if (this.cancelQueuedTurn(session, payload.agent_turn_id, reason)) {
-        log15.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel removed serial-queued turn (not sent to runner)");
+        log14.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel removed serial-queued turn (not sent to runner)");
         return;
       }
       if (this.cancelPreStartTurn(session, payload.agent_turn_id, reason)) {
-        log15.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel removed pre-start turn (not sent to runner)");
+        log14.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel removed pre-start turn (not sent to runner)");
         return;
       }
       if (!session.turnToAgentKey.has(payload.agent_turn_id))
         continue;
       this.cancelServerOwnedTurn(session, payload.agent_turn_id, reason).catch((err) => {
-        log15.warn({
+        log14.warn({
           err,
           session_id: session.sessionId,
           turn_id: payload.agent_turn_id
@@ -9926,7 +10049,7 @@ class TurnRouter {
       });
       return;
     }
-    log15.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel for unknown turn \u2014 no-op");
+    log14.info({ agent_turn_id: payload.agent_turn_id }, "turn.cancel for unknown turn — no-op");
   }
   cancelQueuedTurn(session, turnId, reason) {
     const agentKey = session.queuedTurnAgentKeys.get(turnId);
@@ -9976,13 +10099,13 @@ class TurnRouter {
   }
   async acceptDispatch(dispatch) {
     if (this.m.recentlyCancelledTurnIds.has(dispatch.agent_turn_id)) {
-      log15.info({ agent_turn_id: dispatch.agent_turn_id }, "dropping dispatch for a turn already finalized as cancelled (raced resume retry)");
+      log14.info({ agent_turn_id: dispatch.agent_turn_id }, "dropping dispatch for a turn already finalized as cancelled (raced resume retry)");
       return;
     }
     if (this.tryAcceptRebuiltActiveDispatch(dispatch))
       return;
     if (!this.m.providersRegistered && this.m.providerDbIds.size === 0 || !this.m.serverClient.isRegistered) {
-      log15.info({ agent_turn_id: dispatch.agent_turn_id }, "queuing dispatch \u2014 providers not yet registered");
+      log14.info({ agent_turn_id: dispatch.agent_turn_id }, "queuing dispatch — providers not yet registered");
       this.m.pendingDispatch.push(dispatch);
       return;
     }
@@ -9996,7 +10119,7 @@ class TurnRouter {
     if (!session)
       return false;
     if (session.cancelWaiters.has(dispatch.agent_turn_id)) {
-      log15.info({ turn_id: dispatch.agent_turn_id, session_id: session.sessionId }, "dropping server-rebuilt resume retry \u2014 turn is mid-cancel");
+      log14.info({ turn_id: dispatch.agent_turn_id, session_id: session.sessionId }, "dropping server-rebuilt resume retry — turn is mid-cancel");
       return true;
     }
     attempt.dispatch = dispatchWithoutBootstrapSecrets(dispatch);
@@ -10030,8 +10153,8 @@ class TurnRouter {
   async executeQueuedTurn(session, dispatch, agentSession, agentKey, turnStart) {
     if (!session.queuedTurnAgentKeys.delete(dispatch.agent_turn_id))
       return;
-    const completion = new Promise((resolve2) => {
-      session.turnCompletionWaiters.set(dispatch.agent_turn_id, resolve2);
+    const completion = new Promise((resolve3) => {
+      session.turnCompletionWaiters.set(dispatch.agent_turn_id, resolve3);
     });
     const turnRespawnRepos = reposWithDispatchGitAuth(session, dispatch);
     if (turnRespawnRepos) {
@@ -10049,10 +10172,10 @@ class TurnRouter {
       } else {
         session.preStartTurnAgentKeys.set(dispatch.agent_turn_id, agentKey);
         session.pending.push(turnStart);
-        log15.info({
+        log14.info({
           agent_turn_id: dispatch.agent_turn_id,
           session_id: session.sessionId
-        }, "turn queued \u2014 runner not ready yet");
+        }, "turn queued — runner not ready yet");
         this.m.maybeRespawnDisconnectedSession(session, "turn_dispatch");
       }
     } catch (err) {
@@ -10110,11 +10233,11 @@ class TurnRouter {
         session.pendingRespawnRepos = respawnRepos;
       }
       this.clearStaleAgentSessionId(session, turnId);
-      log15.warn({
+      log14.warn({
         session_id: session.sessionId,
         turn_id: turnId,
         next_attempt: attempt.attemptCount + 1
-      }, "runner crashed mid-turn \u2014 re-dispatching after respawn");
+      }, "runner crashed mid-turn — re-dispatching after respawn");
       this.redispatchWithFreshSession(session, {
         agent_turn_id: turnId,
         attempted_external_session_id: null,
@@ -10159,15 +10282,15 @@ class TurnRouter {
       }
       session.pending.push(turnStart);
       this.m.emitRunnerState(session, "disconnected");
-      log15.warn({
+      log14.warn({
         agent_turn_id: dispatch.agent_turn_id,
         session_id: session.sessionId
-      }, "runner missing for ready session \u2014 queued turn and requesting respawn");
+      }, "runner missing for ready session — queued turn and requesting respawn");
       this.m.maybeRespawnDisconnectedSession(session, "turn_dispatch");
       return;
     }
     this.m.emitAgentSessionState(session, agentSession, "active");
-    log15.info({
+    log14.info({
       agent_turn_id: dispatch.agent_turn_id,
       session_id: session.sessionId
     }, "turn.start sent to runner");
@@ -10202,7 +10325,7 @@ class TurnRouter {
     if (session.projectId === nextProjectId && session.taskId === nextTaskId) {
       return;
     }
-    log15.info({
+    log14.info({
       session_id: session.sessionId,
       project_id: nextProjectId,
       task_id: nextTaskId,
@@ -10262,7 +10385,7 @@ class TurnRouter {
   handleResumeFailed(sessionId, info) {
     const session = this.m.sessionsById.get(sessionId);
     if (!session) {
-      log15.warn({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed for unknown session \u2014 dropping");
+      log14.warn({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed for unknown session — dropping");
       return;
     }
     const attempt = this.m.dispatchAttempts.get(info.agent_turn_id);
@@ -10271,7 +10394,7 @@ class TurnRouter {
     const retryViaServerRebuild = hasRetryBudget && serverCanRebuild;
     const markerSent = this.emitStaleSessionMarker(info, retryViaServerRebuild);
     if (!attempt) {
-      log15.warn({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed without recorded dispatch attempt \u2014 forwarding as failed (stale marker already sent above)");
+      log14.warn({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed without recorded dispatch attempt — forwarding as failed (stale marker already sent above)");
       this.forwardResumeFailedAsFinal(session, info, "no attempt record");
       return;
     }
@@ -10280,12 +10403,12 @@ class TurnRouter {
         attempt.attemptedExternalSessionIds.push(info.attempted_external_session_id);
       }
       this.clearStaleAgentSessionId(session, info.agent_turn_id);
-      log15.info({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed \u2014 server lacks rebuilt-retry support; local fresh-session retry");
+      log14.info({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed — server lacks rebuilt-retry support; local fresh-session retry");
       this.redispatchWithFreshSession(session, info, attempt, "resume_failed");
       return;
     }
     if (retryViaServerRebuild && !markerSent) {
-      log15.warn({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed stale marker undeliverable (server socket down) \u2014 cannot safely rebuild or local-retry a deduped prompt; failing");
+      log14.warn({ session_id: sessionId, turn_id: info.agent_turn_id }, "resume_failed stale marker undeliverable (server socket down) — cannot safely rebuild or local-retry a deduped prompt; failing");
       this.forwardResumeFailedAsFinal(session, info, "server unreachable for resume rebuild");
       return;
     }
@@ -10294,19 +10417,19 @@ class TurnRouter {
     }
     this.clearStaleAgentSessionId(session, info.agent_turn_id);
     if (!hasRetryBudget) {
-      log15.warn({
+      log14.warn({
         turn_id: info.agent_turn_id,
         attempts: attempt.attemptCount,
         attempted_external_session_ids: attempt.attemptedExternalSessionIds
-      }, "resume_failed but dispatch attempt budget exhausted \u2014 final fail");
+      }, "resume_failed but dispatch attempt budget exhausted — final fail");
       this.forwardResumeFailedAsFinal(session, info, "resume + fresh attempts exhausted");
       return;
     }
-    log15.info({
+    log14.info({
       turn_id: info.agent_turn_id,
       attempts: attempt.attemptCount,
       attempted_external_session_ids: attempt.attemptedExternalSessionIds
-    }, "resume_failed \u2014 requested server rebuilt fresh-session retry");
+    }, "resume_failed — requested server rebuilt fresh-session retry");
   }
   emitStaleSessionMarker(info, retryRequested = false) {
     if (info.attempted_external_session_id) {
@@ -10319,7 +10442,7 @@ class TurnRouter {
         }
       });
     }
-    log15.warn({ turn_id: info.agent_turn_id }, "resume_failed without attempted_external_session_id \u2014 no stale marker emitted");
+    log14.warn({ turn_id: info.agent_turn_id }, "resume_failed without attempted_external_session_id — no stale marker emitted");
     return false;
   }
   clearStaleAgentSessionId(session, agentTurnId) {
@@ -10331,11 +10454,11 @@ class TurnRouter {
   }
   redispatchWithFreshSession(session, info, attempt, reason = "resume_failed") {
     attempt.attemptCount += 1;
-    log15.info({
+    log14.info({
       turn_id: info.agent_turn_id,
       attempt: attempt.attemptCount,
       attempted: info.attempted_external_session_id
-    }, reason === "runner_crash" ? "runner crash \u2014 re-dispatching with fresh session" : "resume_failed \u2014 sending server-rebuilt held-slot retry");
+    }, reason === "runner_crash" ? "runner crash — re-dispatching with fresh session" : "resume_failed — sending server-rebuilt held-slot retry");
     const retryDispatch = {
       ...attempt.dispatch,
       external_session_id: null
@@ -10358,7 +10481,7 @@ class TurnRouter {
           this.m.maybeRespawnDisconnectedSession(session, "resume_retry");
         }
       } catch (err) {
-        log15.error({ err, turn_id: info.agent_turn_id }, "resume_failed server-rebuilt retry dispatch failed");
+        log14.error({ err, turn_id: info.agent_turn_id }, "resume_failed server-rebuilt retry dispatch failed");
         this.graduatePreStartTurn(session, retryDispatch.agent_turn_id);
         this.forwardResumeFailedAsFinal(session, info, err instanceof Error ? err.message : String(err), err);
       }
@@ -10431,7 +10554,7 @@ class TurnRouter {
         this.m.emitAgentSessionState(session, agentSession, "idle");
       }
     } else {
-      log15.warn({ session_id: sessionId, turn_id: turnId }, "turn.finished without recorded agent_session \u2014 agent_session.state not updated");
+      log14.warn({ session_id: sessionId, turn_id: turnId }, "turn.finished without recorded agent_session — agent_session.state not updated");
     }
     if (session.turnToAgentKey.size === 0 && session.queuedTurnAgentKeys.size === 0 && session.preStartTurnAgentKeys.size === 0 && session.terminalRefs.size === 0) {
       this.m.emitSessionState(session, "idle_clean");
@@ -10440,9 +10563,10 @@ class TurnRouter {
 }
 
 // src/server-link/server-client.ts
-import { randomUUID as randomUUID6 } from "crypto";
-import { hostname } from "os";
-var log16 = childLogger({ subsystem: "server-link" });
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { hostname } from "node:os";
+import WebSocket2 from "ws";
+var log15 = childLogger2({ subsystem: "server-link" });
 var MANAGER_VERSION = "0.1.0-slice4";
 var HEARTBEAT_INTERVAL_MS = 30000;
 var RECONNECT_BASE_MS = 1000;
@@ -10502,31 +10626,31 @@ class ServerClient {
     if (this.stopped)
       return;
     const url = this.buildUrl();
-    log16.info({ url }, "server ws connect");
+    log15.info({ url }, "server ws connect");
     let ws;
     try {
-      ws = new WebSocket(url);
+      ws = new WebSocket2(url);
     } catch (err) {
-      log16.error({ err: asAppError(err) }, "server ws constructor failed");
+      log15.error({ err: asAppError(err) }, "server ws constructor failed");
       this.scheduleReconnect();
       return;
     }
     this.ws = ws;
-    ws.addEventListener("open", () => {
-      log16.info("server ws open");
+    ws.on("open", () => {
+      log15.info("server ws open");
       this.reconnectAttempt = 0;
       this.sendHello();
       this.startHeartbeat();
     });
-    ws.addEventListener("message", (ev) => {
-      if (typeof ev.data !== "string") {
-        log16.warn({ kind: typeof ev.data }, "server ws non-text frame dropped");
+    ws.on("message", (data, isBinary) => {
+      if (isBinary) {
+        log15.warn({ kind: "binary" }, "server ws non-text frame dropped");
         return;
       }
-      this.onMessage(ev.data);
+      this.onMessage(rawDataToText2(data));
     });
-    ws.addEventListener("close", (ev) => {
-      log16.warn({ code: ev.code, reason: ev.reason }, "server ws closed");
+    ws.on("close", (code, reason) => {
+      log15.warn({ code, reason: reason.toString() }, "server ws closed");
       this.ws = null;
       this.organizationId = null;
       this.managerId = null;
@@ -10536,8 +10660,8 @@ class ServerClient {
       this.opts.onServerDisconnected?.();
       this.scheduleReconnect();
     });
-    ws.addEventListener("error", () => {
-      log16.warn("server ws error event");
+    ws.on("error", (err) => {
+      log15.warn({ err: asAppError(err) }, "server ws error event");
     });
   }
   scheduleReconnect() {
@@ -10545,7 +10669,7 @@ class ServerClient {
       return;
     const delay = Math.min(RECONNECT_BASE_MS * 2 ** this.reconnectAttempt, RECONNECT_MAX_MS);
     this.reconnectAttempt += 1;
-    log16.info({ delay_ms: delay, attempt: this.reconnectAttempt }, "reconnect");
+    log15.info({ delay_ms: delay, attempt: this.reconnectAttempt }, "reconnect");
     this.reconnectTimer = setTimeout(() => {
       this.reconnectTimer = null;
       this.connect();
@@ -10568,7 +10692,7 @@ class ServerClient {
         }
       }
     });
-    log16.info({ name: this.opts.managerName }, "manager.hello sent");
+    log15.info({ name: this.opts.managerName }, "manager.hello sent");
   }
   announceProviders() {
     const providers = Array.isArray(this.opts.providers) ? this.opts.providers : this.opts.providers();
@@ -10578,7 +10702,7 @@ class ServerClient {
       type: "provider.announce",
       payload: { providers }
     });
-    log16.info({ providers: providers.map((p) => p.provider_kind) }, "provider.announce sent");
+    log15.info({ providers: providers.map((p) => p.provider_kind) }, "provider.announce sent");
   }
   startHeartbeat() {
     this.clearHeartbeat();
@@ -10609,7 +10733,7 @@ class ServerClient {
     try {
       parsed = ServerToManagerMessage.parse(JSON.parse(data));
     } catch (err) {
-      log16.error({ err: asAppError(err) }, "server frame rejected");
+      log15.error({ err: asAppError(err) }, "server frame rejected");
       return;
     }
     switch (parsed.type) {
@@ -10617,10 +10741,10 @@ class ServerClient {
         this.organizationId = parsed.payload.organization_id;
         this.managerId = parsed.payload.runtime_manager_id;
         this.serverSupportsRebuiltResumeRetry_ = parsed.payload.server_capabilities?.supports_server_rebuilt_resume_retry === true;
-        log16.info({
+        log15.info({
           organization_id: this.organizationId,
           manager_id: this.managerId
-        }, "manager.hello.ack received \u2014 registration complete");
+        }, "manager.hello.ack received — registration complete");
         this.announceProviders();
         this.opts.onRegistered?.({
           organizationId: this.organizationId,
@@ -10642,7 +10766,7 @@ class ServerClient {
           byRegKey.set(regKey, entry.runtime_provider_id);
           configByRegKey.set(regKey, entry);
         }
-        log16.info({ providers: Array.from(byRegKey.entries()) }, "provider.announce.ack received");
+        log15.info({ providers: Array.from(byRegKey.entries()) }, "provider.announce.ack received");
         this.opts.onProvidersRegistered?.({
           providerIdByRegKey: byRegKey,
           providerConfigByRegKey: configByRegKey
@@ -10650,7 +10774,7 @@ class ServerClient {
         return;
       }
       case "turn.dispatch": {
-        log16.info({
+        log15.info({
           agent_turn_id: parsed.payload.agent_turn_id,
           channel_id: parsed.payload.channel_id
         }, "turn.dispatch received");
@@ -10658,7 +10782,7 @@ class ServerClient {
         return;
       }
       case "turn.cancel": {
-        log16.info({
+        log15.info({
           agent_turn_id: parsed.payload.agent_turn_id,
           organization_id: parsed.payload.organization_id
         }, "turn.cancel received");
@@ -10666,7 +10790,7 @@ class ServerClient {
         return;
       }
       case "session.release": {
-        log16.info({
+        log15.info({
           session_id: parsed.payload.session_id,
           reason: parsed.payload.reason,
           force: parsed.payload.force
@@ -10691,14 +10815,14 @@ class ServerClient {
         return;
       }
       case "session.create": {
-        log16.debug({ type: parsed.type }, "server-initiated session.create received \u2014 slice 5 wiring pending");
+        log15.debug({ type: parsed.type }, "server-initiated session.create received — slice 5 wiring pending");
         return;
       }
       case "session.ensure": {
-        log16.info({
+        log15.info({
           request_id: parsed.payload.request_id,
           channel_id: parsed.payload.channel_id
-        }, "session.ensure received \u2014 provisioning terminal session");
+        }, "session.ensure received — provisioning terminal session");
         this.opts.onSessionEnsure?.(parsed.payload);
         return;
       }
@@ -10721,8 +10845,8 @@ class ServerClient {
     }
   }
   send(msg) {
-    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
-      log16.warn({ type: msg.type }, "send dropped \u2014 server socket not open");
+    if (!this.ws || this.ws.readyState !== WebSocket2.OPEN) {
+      log15.warn({ type: msg.type }, "send dropped — server socket not open");
       return false;
     }
     this.ws.send(JSON.stringify(msg));
@@ -10759,13 +10883,13 @@ class ServerClient {
     if (pending.has(requestId)) {
       return Promise.reject(new Error(`duplicate task request id: ${requestId}`));
     }
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
         reject(new Error(`task request timed out: ${requestId}`));
       }, this.opts.taskRequestTimeoutMs ?? TASK_REQUEST_TIMEOUT_MS);
-      unrefTimer2(timer);
-      pending.set(requestId, { timer, resolve: resolve2, reject });
+      unrefTimer(timer);
+      pending.set(requestId, { timer, resolve: resolve3, reject });
       const sent = sendFrame();
       if (!sent) {
         clearTimeout(timer);
@@ -10786,7 +10910,7 @@ class ServerClient {
   settleTaskRequest(pending, requestId, payload) {
     const request = pending.get(requestId);
     if (!request) {
-      log16.warn({ request_id: requestId }, "task response without pending request");
+      log15.warn({ request_id: requestId }, "task response without pending request");
       return;
     }
     pending.delete(requestId);
@@ -10816,13 +10940,21 @@ class ServerClient {
     return this.send({ type: "agent_session.state", payload });
   }
 }
-function unrefTimer2(timer) {
+function unrefTimer(timer) {
   const maybeTimer = timer;
   maybeTimer.unref?.();
 }
+function rawDataToText2(raw) {
+  if (Array.isArray(raw))
+    return Buffer.concat(raw).toString("utf8");
+  if (raw instanceof ArrayBuffer) {
+    return Buffer.from(new Uint8Array(raw)).toString("utf8");
+  }
+  return Buffer.from(raw).toString("utf8");
+}
 
 // src/runtime-manager.ts
-var log17 = childLogger({ subsystem: "runtime-manager" });
+var log16 = childLogger2({ subsystem: "runtime-manager" });
 
 class ChannelSerialQueue {
   taskTimeoutMs;
@@ -10837,7 +10969,7 @@ class ChannelSerialQueue {
       try {
         await this.withTimeout(task());
       } catch (err) {
-        log17.error({ err }, "channel serial queue task failed");
+        log16.error({ err }, "channel serial queue task failed");
       } finally {
         this.depth -= 1;
       }
@@ -10848,22 +10980,22 @@ class ChannelSerialQueue {
   withTimeout(work) {
     if (this.taskTimeoutMs <= 0)
       return work;
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       let settled = false;
       const timer = setTimeout(() => {
         if (settled)
           return;
         settled = true;
-        log17.warn({ task_timeout_ms: this.taskTimeoutMs }, "channel serial queue task exceeded timeout \u2014 advancing to next turn");
-        resolve2();
+        log16.warn({ task_timeout_ms: this.taskTimeoutMs }, "channel serial queue task exceeded timeout — advancing to next turn");
+        resolve3();
       }, this.taskTimeoutMs);
-      unrefTimer(timer);
+      unrefTimer2(timer);
       work.finally(() => {
         if (settled)
           return;
         settled = true;
         clearTimeout(timer);
-        resolve2();
+        resolve3();
       }).catch(() => {});
     });
   }
@@ -11002,12 +11134,12 @@ function resolveProviderSpecs(specs, requestedDefaultProviderKey) {
       providers.set(spec.key, provider);
     } catch (err) {
       skippedKeys.push(spec.key);
-      log17.error({
+      log16.error({
         err,
         registration_key: spec.key,
         provider_kind: spec.kind,
         remote_sandbox_backend: spec.remoteSandboxBackend
-      }, "runtime provider construction failed \u2014 skipping provider");
+      }, "runtime provider construction failed — skipping provider");
     }
   }
   return finalizeProviderBootstrap({
@@ -11070,7 +11202,7 @@ function rejectDuplicateProviderKeys(keys, label) {
     seen.add(key);
   }
 }
-function unrefTimer(timer) {
+function unrefTimer2(timer) {
   const maybeTimer = timer;
   maybeTimer.unref?.();
 }
@@ -11153,7 +11285,7 @@ class RuntimeManager {
       this.providers.set(key, provider);
     }
     this.defaultProviderKey = providerBootstrap.defaultProviderKey;
-    log17.info({
+    log16.info({
       requested_provider_keys: providerBootstrap.requestedKeys,
       hosted_provider_keys: providerBootstrap.hostedKeys,
       skipped_provider_keys: providerBootstrap.skippedKeys,
@@ -11207,12 +11339,12 @@ class RuntimeManager {
   }
   handleServerSessionReleaseSafe(payload) {
     this.handleServerSessionRelease(payload).catch((err) => {
-      log17.error({ err, session_id: payload.session_id }, "session.release handling failed");
+      log16.error({ err, session_id: payload.session_id }, "session.release handling failed");
     });
   }
   handleSessionEnsureSafe(payload) {
     this.ensureTerminalSession(payload).catch((err) => {
-      log17.error({
+      log16.error({
         err,
         request_id: payload.request_id,
         channel_id: payload.channel_id
@@ -11221,7 +11353,7 @@ class RuntimeManager {
   }
   handleTaskChangedSafe(payload) {
     this.handleTaskChanged(payload).catch((err) => {
-      log17.warn({ err, task_id: payload.task_id, version: payload.version }, "task.changed projection refresh failed");
+      log16.warn({ err, task_id: payload.task_id, version: payload.version }, "task.changed projection refresh failed");
     });
   }
   buildCliDispatcher() {
@@ -11271,11 +11403,859 @@ class RuntimeManager {
   handleProvidersRegistered(info) {
     this.sessionLifecycle.handleProvidersRegistered(info);
   }
-  start() {
-    const localRunnerWsUrl = this.runnerLink.start();
+  async start() {
+    const localRunnerWsUrl = await this.runnerLink.start();
     this.managerWsUrl = this.opts.runnerLinkPublicUrl ?? localRunnerWsUrl;
     this.serverClient.start();
-    log17.info({
+    log16.info({
+      manager_ws: this.managerWsUrl,
+      local_runner_ws: localRunnerWsUrl,
+      server: this.opts.serverUrl,
+      provider_keys: Array.from(this.providers.keys())
+    }, "runtime-manager started");
+  }
+  async stop() {
+    if (this.stopped)
+      return;
+    this.stopped = true;
+    while (this.provisioning.size > 0) {
+      const inFlight = [...this.provisioning.values()];
+      log16.info({ in_flight: inFlight.length }, "awaiting in-flight provisioning before teardown");
+      await Promise.allSettled(inFlight);
+    }
+    const sessions = Array.from(this.sessions.values());
+    for (const session of sessions) {
+      if (session.respawnTimer) {
+        clearTimeout(session.respawnTimer);
+        session.respawnTimer = null;
+      }
+      this.clearRunnerBootTimer(session);
+    }
+    this.runnerLink.stop();
+    const releases = sessions.map(async (session) => {
+      if (!session.provisioned) {
+        this.emitReleasedState(session);
+        return;
+      }
+      try {
+        await providerForSession(this, session).releaseSession(session.provisioned);
+        this.emitReleasedState(session);
+      } catch (err) {
+        log16.warn({ err, session_id: session.sessionId }, "session release failed during shutdown — marking failed");
+        const detail = err instanceof Error ? err.message : String(err);
+        for (const agentSession of session.agentSessions.values()) {
+          this.emitAgentSessionStateFailed(session, agentSession, detail);
+        }
+        this.emitRunnerStateFailed(session, detail);
+        this.emitSessionStateFailed(session, detail);
+      }
+    });
+    this.sessions.clear();
+    this.sessionsById.clear();
+    await Promise.allSettled(releases);
+    log16.info({ released: releases.length }, "all sessions released");
+    this.serverClient.stop();
+  }
+  emitReleasedState(session) {
+    this.stateEmitter.emitReleasedState(session);
+  }
+  disableProviderForDispatch(input) {
+    return this.turnRouter.disableProviderForDispatch(input);
+  }
+  drainPendingDispatch() {
+    this.turnRouter.drainPendingDispatch();
+  }
+  reportDispatchFailure(dispatch, err) {
+    this.turnRouter.reportDispatchFailure(dispatch, err);
+  }
+  handleServerSessionRelease(payload) {
+    return this.sessionLifecycle.handleServerSessionRelease(payload);
+  }
+  finalizeReleasedSession(session, key, sessionId) {
+    this.sessionLifecycle.finalizeReleasedSession(session, key, sessionId);
+  }
+  dirtyProbeHoldsRelease(session) {
+    return this.sessionLifecycle.dirtyProbeHoldsRelease(session);
+  }
+  runProviderRelease(session, key, sessionId) {
+    return this.sessionLifecycle.runProviderRelease(session, key, sessionId);
+  }
+  probeDirtyReport(session) {
+    return this.sessionLifecycle.probeDirtyReport(session);
+  }
+  onDirtyReport(payload) {
+    this.sessionLifecycle.onDirtyReport(payload);
+  }
+  cancelInFlightTurns(session, reason) {
+    return this.turnRouter.cancelInFlightTurns(session, reason);
+  }
+  cancelOneTurn(session, turnId, reason) {
+    return this.turnRouter.cancelOneTurn(session, turnId, reason);
+  }
+  removePendingDispatch(turnId) {
+    return this.turnRouter.removePendingDispatch(turnId);
+  }
+  handleServerTurnCancel(payload) {
+    this.turnRouter.handleServerTurnCancel(payload);
+  }
+  cancelServerOwnedTurn(session, turnId, reason) {
+    return this.turnRouter.cancelServerOwnedTurn(session, turnId, reason);
+  }
+  acceptDispatch(dispatch) {
+    return this.turnRouter.acceptDispatch(dispatch);
+  }
+  onTurnDispatch(dispatch) {
+    return this.turnRouter.onTurnDispatch(dispatch);
+  }
+  recordInitialDispatchAttempt(dispatch) {
+    this.turnRouter.recordInitialDispatchAttempt(dispatch);
+  }
+  buildTurnStartPayload(session, dispatch) {
+    return this.turnRouter.buildTurnStartPayload(session, dispatch);
+  }
+  dispatchTurnToReadyRunner(session, dispatch, agentSession, turnStart) {
+    return this.turnRouter.dispatchTurnToReadyRunner(session, dispatch, agentSession, turnStart);
+  }
+  getOrCreateAgentSession(session, dispatch) {
+    return this.turnRouter.getOrCreateAgentSession(session, dispatch);
+  }
+  bindSessionTaskFromDispatch(session, dispatch) {
+    this.turnRouter.bindSessionTaskFromDispatch(session, dispatch);
+  }
+  ensureSession(dispatch) {
+    return this.sessionLifecycle.ensureSession(dispatch);
+  }
+  ensureTerminalSession(payload) {
+    return this.sessionLifecycle.ensureTerminalSession(payload);
+  }
+  reuseOrRetireExistingSession(key, existing, resolved, dispatch) {
+    return this.sessionLifecycle.reuseOrRetireExistingSession(key, existing, resolved, dispatch);
+  }
+  joinInFlightSession(key, inFlight, resolved, dispatch) {
+    return this.sessionLifecycle.joinInFlightSession(key, inFlight, resolved, dispatch);
+  }
+  retireSessionForReplacement(key, session, reason) {
+    return this.sessionLifecycle.retireSessionForReplacement(key, session, reason);
+  }
+  registerProvisioningSession(session, ctx) {
+    this.sessionLifecycle.registerProvisioningSession(session, ctx);
+  }
+  runProviderCreateSession(dispatch, resolved, ctx) {
+    return this.sessionLifecycle.runProviderCreateSession(dispatch, resolved, ctx);
+  }
+  emitProvisioningCompletion(session, provisioned, ctx) {
+    this.sessionLifecycle.emitProvisioningCompletion(session, provisioned, ctx);
+  }
+  buildProvisioningContext(dispatch) {
+    return this.sessionLifecycle.buildProvisioningContext(dispatch);
+  }
+  buildPendingSession(dispatch, resolved, ctx) {
+    return this.sessionLifecycle.buildPendingSession(dispatch, resolved, ctx);
+  }
+  applyProvisionedToSession(session, provisioned, originalWorkspaceRoot) {
+    this.sessionLifecycle.applyProvisionedToSession(session, provisioned, originalWorkspaceRoot);
+  }
+  rollbackFailedProvision(key, session, err, onProvisionFailed) {
+    this.sessionLifecycle.rollbackFailedProvision(key, session, err, onProvisionFailed);
+  }
+  onRunnerHello(info) {
+    this.runnerLifecycle.onRunnerHello(info);
+  }
+  onRunnerReady(sessionId) {
+    this.runnerLifecycle.onRunnerReady(sessionId);
+  }
+  flushPendingTurnsAfterProjection(session, pending) {
+    return this.taskProjectionBridge.flushPendingTurnsAfterProjection(session, pending);
+  }
+  flushPendingTurns(session, pending) {
+    this.taskProjectionBridge.flushPendingTurns(session, pending);
+  }
+  async handleCliRequest(sessionId, payload) {
+    const response = await this.cliDispatcher.handle({
+      sessionId,
+      request: payload
+    });
+    this.sendCliResponse(sessionId, response);
+  }
+  sendCliResponse(sessionId, payload) {
+    const sent = this.runnerLink.sendToRunner(sessionId, {
+      type: "cli.response",
+      payload
+    });
+    if (!sent) {
+      log16.warn({ session_id: sessionId, request_id: payload.request_id }, "cli.response dropped — runner disconnected");
+    }
+  }
+  ensureTaskProjection(session) {
+    return this.taskProjectionBridge.ensureTaskProjection(session);
+  }
+  fetchTaskSnapshot(taskId) {
+    return this.taskProjectionBridge.fetchTaskSnapshot(taskId);
+  }
+  pushTaskProjection(session, snapshot) {
+    return this.taskProjectionBridge.pushTaskProjection(session, snapshot);
+  }
+  handleTaskChanged(payload) {
+    return this.taskProjectionBridge.handleTaskChanged(payload);
+  }
+  onRunnerClosed(sessionId) {
+    this.terminalRelay.onRunnerClosed(sessionId);
+    this.runnerLifecycle.onRunnerClosed(sessionId);
+  }
+  closeTerminalsForRelease(session, reason) {
+    this.terminalRelay.closeAllForRelease(session, reason);
+  }
+  onRunnerBootFailed(sessionId, lastError) {
+    this.runnerLifecycle.onRunnerBootFailed(sessionId, lastError);
+  }
+  maybeRespawnDisconnectedSession(session, reason) {
+    this.runnerLifecycle.maybeRespawnDisconnectedSession(session, reason);
+  }
+  respawnRunner(session) {
+    return this.sessionLifecycle.respawnRunner(session);
+  }
+  scheduleRunnerBootTimeout(session) {
+    this.runnerLifecycle.scheduleRunnerBootTimeout(session);
+  }
+  clearRunnerBootTimer(session) {
+    this.runnerLifecycle.clearRunnerBootTimer(session);
+  }
+  onRunnerBootTimeout(sessionId) {
+    this.runnerLifecycle.onRunnerBootTimeout(sessionId);
+  }
+  failTrackedTurns(session, detail) {
+    this.turnRouter.failTrackedTurns(session, detail);
+  }
+  retryCrashedRunnerTurns(session, detail) {
+    return this.turnRouter.retryCrashedRunnerTurns(session, detail);
+  }
+  logProviderDiagnostics(session, reason) {
+    return this.sessionLifecycle.logProviderDiagnostics(session, reason);
+  }
+  cleanupSessionReposFile(session, reason) {
+    this.sessionLifecycle.cleanupSessionReposFile(session, reason);
+  }
+  replayActiveStates() {
+    this.stateEmitter.replayActiveStates();
+  }
+  handleResumeFailed(sessionId, info) {
+    this.turnRouter.handleResumeFailed(sessionId, info);
+  }
+  emitStaleSessionMarker(info, retryRequested = false) {
+    return this.turnRouter.emitStaleSessionMarker(info, retryRequested);
+  }
+  clearStaleAgentSessionId(session, agentTurnId) {
+    this.turnRouter.clearStaleAgentSessionId(session, agentTurnId);
+  }
+  redispatchWithFreshSession(session, info, attempt) {
+    this.turnRouter.redispatchWithFreshSession(session, info, attempt);
+  }
+  forwardResumeFailedAsFinal(session, info, reason, err) {
+    this.turnRouter.forwardResumeFailedAsFinal(session, info, reason, err);
+  }
+  onTurnFinished(sessionId, turnId, status, externalSessionId, failureDetail) {
+    this.turnRouter.onTurnFinished(sessionId, turnId, status, externalSessionId, failureDetail);
+  }
+  emitSessionState(session, status) {
+    this.stateEmitter.emitSessionState(session, status);
+  }
+  emitSessionStateFailed(session, lastError) {
+    this.stateEmitter.emitSessionStateFailed(session, lastError);
+  }
+  emitRunnerState(session, status) {
+    this.stateEmitter.emitRunnerState(session, status);
+  }
+  emitRunnerStateFailed(session, lastError) {
+    this.stateEmitter.emitRunnerStateFailed(session, lastError);
+  }
+  emitAgentSessionState(session, agentSession, status) {
+    this.stateEmitter.emitAgentSessionState(session, agentSession, status);
+  }
+  emitAgentSessionStateFailed(session, agentSession, lastError) {
+    this.stateEmitter.emitAgentSessionStateFailed(session, agentSession, lastError);
+  }
+}
+
+// src/runtime-manager-runner-lifecycle.ts
+var log17 = childLogger2({ subsystem: "runtime-manager" });
+
+class RunnerLifecycle {
+  m;
+  constructor(m) {
+    this.m = m;
+  }
+  onRunnerHello(info) {
+    const session = this.m.sessionsById.get(info.sessionId);
+    if (!session) {
+      log17.warn({ session_id: info.sessionId }, "runner.hello for unknown session");
+      return;
+    }
+    session.runnerCapabilities = [...info.runnerCapabilities ?? []];
+    session.terminalSupported = runnerSupportsTerminal(session.runnerCapabilities);
+    if (!session.terminalSupported) {
+      log17.warn({
+        session_id: info.sessionId,
+        runner_version: info.runnerVersion
+      }, "runner does not advertise terminal capability — outdated runner, republish template; terminal sessions will be refused");
+    }
+    if (session.respawnTimer) {
+      clearTimeout(session.respawnTimer);
+      session.respawnTimer = null;
+      log17.info({ session_id: info.sessionId }, "runner reconnected within window — cancelled pending respawn");
+    }
+    if (session.provisioned) {
+      session.provisioned = {
+        ...session.provisioned,
+        providerRuntimeId: session.providerKind === "local_process" ? String(info.pid) : session.provisioned.providerRuntimeId,
+        runnerKind: info.runnerKind
+      };
+    }
+  }
+  onRunnerReady(sessionId) {
+    const session = this.m.sessionsById.get(sessionId);
+    if (!session) {
+      log17.warn({ session_id: sessionId }, "runner.ready for unknown session");
+      return;
+    }
+    const isFirstReady = !session.ready;
+    session.ready = true;
+    session.runnerReadyOnce = true;
+    this.clearRunnerBootTimer(session);
+    this.m.emitRunnerState(session, "ready");
+    this.m.cleanupSessionReposFile(session, "runner_ready");
+    const pending = session.pending.splice(0);
+    if (isFirstReady && pending.length > 0) {
+      this.m.emitSessionState(session, "active");
+    }
+    log17.info({
+      session_id: sessionId,
+      flushed: pending.length,
+      first_ready: isFirstReady
+    }, "runner ready — flushing queued turns");
+    if (session.taskId && pending.length > 0) {
+      this.m.flushPendingTurnsAfterProjection(session, pending).catch((err) => {
+        const detail = err instanceof Error ? err.message : String(err);
+        log17.error({ err, session_id: session.sessionId }, "task projection failed before queued turns flushed");
+        this.m.failTrackedTurns(session, detail);
+      });
+      return;
+    }
+    this.m.flushPendingTurns(session, pending);
+  }
+  onRunnerClosed(sessionId) {
+    const session = this.m.sessionsById.get(sessionId);
+    if (!session)
+      return;
+    if (this.m.stopped)
+      return;
+    session.ready = false;
+    this.clearRunnerBootTimer(session);
+    log17.warn({ session_id: sessionId }, "runner socket closed unexpectedly");
+    this.m.logProviderDiagnostics(session, "runner_socket_closed");
+    if (!session.runnerReadyOnce) {
+      const detail = "runner closed before becoming ready";
+      this.m.failTrackedTurns(session, detail);
+      this.m.emitRunnerStateFailed(session, detail);
+      this.m.emitSessionStateFailed(session, detail);
+      return;
+    }
+    this.m.emitRunnerState(session, "disconnected");
+    if (session.respawnTimer) {
+      clearTimeout(session.respawnTimer);
+    }
+    session.respawnTimer = setTimeout(() => {
+      session.respawnTimer = null;
+      if (this.m.stopped)
+        return;
+      if (this.m.runnerLink.hasRunner(sessionId)) {
+        log17.info({ session_id: sessionId }, "respawn timer fired but runner already connected — skipping");
+        return;
+      }
+      const detail = "runner crashed mid-turn";
+      if (this.m.retryCrashedRunnerTurns(session, detail)) {
+        return;
+      }
+      this.m.failTrackedTurns(session, detail);
+      this.maybeRespawnDisconnectedSession(session, "reconnect_window_expired");
+    }, this.m.runnerReconnectWindowMs);
+  }
+  onRunnerBootFailed(sessionId, lastError) {
+    const session = this.m.sessionsById.get(sessionId);
+    if (!session) {
+      log17.warn({ session_id: sessionId }, "runner.boot_failed for unknown session");
+      return;
+    }
+    if (session.respawnTimer) {
+      clearTimeout(session.respawnTimer);
+      session.respawnTimer = null;
+    }
+    this.clearRunnerBootTimer(session);
+    this.m.cleanupSessionReposFile(session, "runner_boot_failed");
+    session.ready = false;
+    session.pendingRespawnRepos = null;
+    log17.error({ session_id: sessionId, last_error: lastError }, "runner reported boot failure — marking session failed");
+    this.m.logProviderDiagnostics(session, "runner_boot_failed");
+    this.m.failTrackedTurns(session, lastError);
+    this.m.emitRunnerStateFailed(session, lastError);
+    this.m.emitSessionStateFailed(session, lastError);
+  }
+  maybeRespawnDisconnectedSession(session, reason) {
+    if (this.m.stopped)
+      return;
+    if (!session.provisioned)
+      return;
+    if (session.respawnTimer)
+      return;
+    if (this.m.runnerLink.hasRunner(session.sessionId))
+      return;
+    if (!session.runnerReadyOnce)
+      return;
+    if (session.lastStatus === "starting")
+      return;
+    if (session.repoRequiresGitAuth && !session.pendingRespawnRepos) {
+      log17.info({ session_id: session.sessionId, reason }, "deferring private-repo runner respawn until a dispatch provides fresh git auth");
+      return;
+    }
+    this.m.respawnRunner(session);
+  }
+  scheduleRunnerBootTimeout(session) {
+    this.clearRunnerBootTimer(session);
+    if (this.m.runnerBootTimeoutMs <= 0)
+      return;
+    const timer = setTimeout(() => {
+      this.onRunnerBootTimeout(session.sessionId);
+    }, this.m.runnerBootTimeoutMs);
+    unrefTimer2(timer);
+    session.runnerBootTimer = timer;
+  }
+  clearRunnerBootTimer(session) {
+    if (!session.runnerBootTimer)
+      return;
+    clearTimeout(session.runnerBootTimer);
+    session.runnerBootTimer = null;
+  }
+  onRunnerBootTimeout(sessionId) {
+    const session = this.m.sessionsById.get(sessionId);
+    if (!session || this.m.stopped || session.ready)
+      return;
+    session.runnerBootTimer = null;
+    const detail = `runner did not become ready within ${Math.ceil(this.m.runnerBootTimeoutMs / 1000)} seconds`;
+    log17.error({
+      session_id: sessionId,
+      provider: session.providerKind,
+      provider_key: session.providerKey,
+      provider_runtime_id: session.provisioned?.providerRuntimeId ?? null,
+      pending_turns: session.pending.length
+    }, "runner boot timeout — marking session failed");
+    this.m.cleanupSessionReposFile(session, "runner_boot_timeout");
+    this.m.logProviderDiagnostics(session, "runner_boot_timeout");
+    this.m.failTrackedTurns(session, detail);
+    this.m.emitRunnerStateFailed(session, detail);
+    this.m.emitSessionStateFailed(session, detail);
+  }
+}
+
+// src/runtime-manager.ts
+var log18 = childLogger2({ subsystem: "runtime-manager" });
+
+class ChannelSerialQueue2 {
+  taskTimeoutMs;
+  tail = Promise.resolve();
+  depth = 0;
+  constructor(taskTimeoutMs) {
+    this.taskTimeoutMs = taskTimeoutMs;
+  }
+  run(task) {
+    this.depth += 1;
+    const gated = this.tail.then(async () => {
+      try {
+        await this.withTimeout(task());
+      } catch (err) {
+        log18.error({ err }, "channel serial queue task failed");
+      } finally {
+        this.depth -= 1;
+      }
+    });
+    this.tail = gated;
+    return gated;
+  }
+  withTimeout(work) {
+    if (this.taskTimeoutMs <= 0)
+      return work;
+    return new Promise((resolve3) => {
+      let settled = false;
+      const timer = setTimeout(() => {
+        if (settled)
+          return;
+        settled = true;
+        log18.warn({ task_timeout_ms: this.taskTimeoutMs }, "channel serial queue task exceeded timeout — advancing to next turn");
+        resolve3();
+      }, this.taskTimeoutMs);
+      unrefTimer3(timer);
+      work.finally(() => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        resolve3();
+      }).catch(() => {});
+    });
+  }
+}
+var CHANNEL_SERIAL_TURN_TIMEOUT_MS2 = 30 * 60000;
+var RUNNER_RECONNECT_WINDOW_MS2 = 8000;
+var DEFAULT_RUNNER_BOOT_TIMEOUT_MS2 = 5 * 60000;
+var IDLE_STATUSES2 = new Set([
+  "idle_clean",
+  "idle_checkpointed",
+  "idle_dirty"
+]);
+var TERMINAL_SESSION_STATUSES2 = new Set(["failed", "released", "cancelled"]);
+function makeProvider2(spec) {
+  switch (spec.kind) {
+    case "local_process":
+      return new LocalProvider;
+    case "local_docker":
+      return new DockerProvider;
+    case "remote_sandbox": {
+      const backend = spec.remoteSandboxBackend ?? REMOTE_SANDBOX_DEFAULT_BACKEND;
+      const descriptor = remoteSandboxProviderDescriptor(backend);
+      if (!descriptor.implemented) {
+        throw new Error(`remote_sandbox backend is not implemented: ${backend}`);
+      }
+      switch (backend) {
+        case "runloop":
+          return new RunloopProvider;
+        case "e2b":
+          return new E2BProvider;
+        case "vercel":
+          return new VercelProvider;
+      }
+      throw new Error(`remote_sandbox backend is not implemented: ${backend}`);
+    }
+    default:
+      throw new Error(`runtime provider kind is not implemented: ${spec.kind}`);
+  }
+}
+function legacyProviderSpecFromKind2(kind) {
+  const backend = kind === "remote_sandbox" ? remoteSandboxBackendFromEnv2() : null;
+  return {
+    key: runtimeProviderRegistrationKey(kind, backend),
+    kind,
+    remoteSandboxBackend: backend,
+    source: "legacy"
+  };
+}
+function remoteSandboxBackendFromEnv2() {
+  const configured = nonEmpty3(process.env.VINE_REMOTE_SANDBOX_PROVIDER) ?? REMOTE_SANDBOX_DEFAULT_BACKEND;
+  const parsed = RuntimeRemoteSandboxBackend.safeParse(configured);
+  if (!parsed.success) {
+    throw new Error(`remote_sandbox backend is not known: ${configured}`);
+  }
+  return parsed.data;
+}
+function nonEmpty3(value) {
+  return value && value.length > 0 ? value : undefined;
+}
+function optionalPositiveInteger3(value) {
+  if (!value)
+    return;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+function resolveProviderBootstrap2(opts) {
+  if (opts.providerBootstrap && (opts.provider || opts.providerKind)) {
+    throw new Error("providerBootstrap cannot be combined with provider or providerKind");
+  }
+  if (opts.providerBootstrap) {
+    return resolveExplicitProviderBootstrap2(opts.providerBootstrap);
+  }
+  const provider = opts.provider ?? makeProvider2(legacyProviderSpecFromKind2(opts.providerKind ?? "local_process"));
+  const key = registrationKeyForProvider(provider);
+  return {
+    requestedKeys: [key],
+    hostedKeys: [key],
+    skippedKeys: [],
+    providers: new Map([[key, provider]]),
+    defaultProviderKey: key
+  };
+}
+function resolveExplicitProviderBootstrap2(bootstrap) {
+  if (bootstrap.mode === "instances") {
+    return resolveProviderInstances2(bootstrap.providers, bootstrap.requestedDefaultProviderKey ?? null);
+  }
+  return resolveProviderSpecs2(bootstrap.specs, bootstrap.requestedDefaultProviderKey ?? null);
+}
+function resolveProviderSpecs2(specs, requestedDefaultProviderKey) {
+  if (specs.length === 0) {
+    throw new Error("providerBootstrap.specs must contain at least one provider");
+  }
+  rejectDuplicateProviderKeys2(specs.map((spec) => spec.key), "providerBootstrap.specs");
+  const providers = new Map;
+  const skippedKeys = [];
+  for (const spec of specs) {
+    try {
+      const provider = makeProvider2(spec);
+      const actualKey = registrationKeyForProvider(provider);
+      if (actualKey !== spec.key) {
+        throw new Error(`provider constructed with registration key ${actualKey}, expected ${spec.key}`);
+      }
+      providers.set(spec.key, provider);
+    } catch (err) {
+      skippedKeys.push(spec.key);
+      log18.error({
+        err,
+        registration_key: spec.key,
+        provider_kind: spec.kind,
+        remote_sandbox_backend: spec.remoteSandboxBackend
+      }, "runtime provider construction failed — skipping provider");
+    }
+  }
+  return finalizeProviderBootstrap2({
+    requestedKeys: specs.map((spec) => spec.key),
+    providers,
+    skippedKeys,
+    requestedDefaultProviderKey
+  });
+}
+function resolveProviderInstances2(instances, requestedDefaultProviderKey) {
+  if (instances.length === 0) {
+    throw new Error("providerBootstrap.providers must contain at least one provider");
+  }
+  rejectDuplicateProviderKeys2(instances.map((entry) => entry.key), "providerBootstrap.providers");
+  const providers = new Map;
+  for (const entry of instances) {
+    const actualKey = registrationKeyForProvider(entry.provider);
+    if (actualKey !== entry.key) {
+      throw new Error(`provider instance key ${entry.key} does not match provider registration key ${actualKey}`);
+    }
+    providers.set(entry.key, entry.provider);
+  }
+  return finalizeProviderBootstrap2({
+    requestedKeys: instances.map((entry) => entry.key),
+    providers,
+    skippedKeys: [],
+    requestedDefaultProviderKey
+  });
+}
+function finalizeProviderBootstrap2(args) {
+  if (args.providers.size === 0) {
+    throw new Error("all configured runtime providers failed to construct");
+  }
+  let defaultProviderKey;
+  if (args.requestedDefaultProviderKey !== null) {
+    if (!args.providers.has(args.requestedDefaultProviderKey)) {
+      throw new Error(`requested default provider failed to construct: ${args.requestedDefaultProviderKey}`);
+    }
+    defaultProviderKey = args.requestedDefaultProviderKey;
+  } else {
+    defaultProviderKey = args.requestedKeys.find((key) => args.providers.has(key));
+  }
+  if (!defaultProviderKey) {
+    throw new Error("no default runtime provider could be selected");
+  }
+  return {
+    requestedKeys: args.requestedKeys,
+    hostedKeys: Array.from(args.providers.keys()),
+    skippedKeys: args.skippedKeys,
+    providers: args.providers,
+    defaultProviderKey
+  };
+}
+function rejectDuplicateProviderKeys2(keys, label) {
+  const seen = new Set;
+  for (const key of keys) {
+    if (seen.has(key)) {
+      throw new Error(`${label} contains duplicate provider key: ${key}`);
+    }
+    seen.add(key);
+  }
+}
+function unrefTimer3(timer) {
+  const maybeTimer = timer;
+  maybeTimer.unref?.();
+}
+class RuntimeManager2 {
+  opts;
+  runnerLink;
+  serverClient;
+  taskCache = new TaskContentCache;
+  cliDispatcher;
+  stateEmitter;
+  taskProjectionBridge;
+  runnerLifecycle;
+  turnRouter;
+  sessionLifecycle;
+  terminalRelay;
+  providers = new Map;
+  providerDbIds = new Map;
+  disabledProviderKeys = new Set;
+  defaultProviderKey;
+  sessions = new Map;
+  sessionsById = new Map;
+  provisioning = new Map;
+  pendingDispatch = [];
+  providersRegistered = false;
+  dispatchAttempts = new Map;
+  reportedDispatchFailures = new Set;
+  recentlyCancelledTurnIds = new Set;
+  static RECENTLY_CANCELLED_CAP = 512;
+  recordCancelledTurn(turnId) {
+    this.recentlyCancelledTurnIds.add(turnId);
+    if (this.recentlyCancelledTurnIds.size > RuntimeManager2.RECENTLY_CANCELLED_CAP) {
+      const oldest = this.recentlyCancelledTurnIds.values().next().value;
+      if (oldest !== undefined)
+        this.recentlyCancelledTurnIds.delete(oldest);
+    }
+  }
+  managerWsUrl = null;
+  stopped = false;
+  runnerBootTimeoutMs;
+  runnerReconnectWindowMs;
+  constructor(opts) {
+    this.opts = opts;
+    this.runnerBootTimeoutMs = opts.runnerBootTimeoutMs ?? optionalPositiveInteger3(process.env.VINE_RUNNER_BOOT_TIMEOUT_MS) ?? DEFAULT_RUNNER_BOOT_TIMEOUT_MS2;
+    this.runnerReconnectWindowMs = opts.runnerReconnectWindowMs ?? RUNNER_RECONNECT_WINDOW_MS2;
+    this.bootstrapProviders();
+    this.runnerLink = this.buildRunnerLink();
+    this.serverClient = this.buildServerClient();
+    this.cliDispatcher = this.buildCliDispatcher();
+    this.stateEmitter = new StateEmitter(this);
+    this.taskProjectionBridge = new TaskProjectionBridge(this);
+    this.runnerLifecycle = new RunnerLifecycle(this);
+    this.turnRouter = new TurnRouter(this);
+    this.sessionLifecycle = new SessionLifecycle(this);
+    this.terminalRelay = new TerminalRelay(this);
+  }
+  bootstrapProviders() {
+    const providerBootstrap = resolveProviderBootstrap2(this.opts);
+    for (const [key, provider] of providerBootstrap.providers) {
+      this.providers.set(key, provider);
+    }
+    this.defaultProviderKey = providerBootstrap.defaultProviderKey;
+    log18.info({
+      requested_provider_keys: providerBootstrap.requestedKeys,
+      hosted_provider_keys: providerBootstrap.hostedKeys,
+      skipped_provider_keys: providerBootstrap.skippedKeys,
+      default_provider_key: this.defaultProviderKey
+    }, "runtime providers bootstrapped");
+  }
+  buildRunnerLink() {
+    const { opts } = this;
+    return new RunnerLinkServer({
+      ...opts.runnerLinkHost ? { host: opts.runnerLinkHost } : {},
+      ...opts.runnerLinkPort !== undefined ? { port: opts.runnerLinkPort } : {},
+      onRunnerHello: (info) => this.onRunnerHello(info),
+      onRunnerReady: (sessionId) => this.onRunnerReady(sessionId),
+      onRunnerClosed: (sessionId) => this.onRunnerClosed(sessionId),
+      onDirtyReport: (payload) => this.onDirtyReport(payload),
+      onBootFailed: (payload) => this.onRunnerBootFailed(payload.session_id, payload.last_error),
+      onCliRequest: (sessionId, payload) => {
+        this.handleCliRequest(sessionId, payload);
+      },
+      onTaskRefsSnapshot: (payload) => this.forwardTaskRefsSnapshot(payload),
+      onTurnEvent: (payload) => this.forwardRunnerTurnEvent(payload),
+      onTurnFinished: (payload) => this.forwardRunnerTurnFinished(payload),
+      onTerminalData: (payload) => this.terminalRelay.onRunnerTerminalData(payload),
+      onTerminalCloseReport: (payload) => this.terminalRelay.onRunnerTerminalCloseReport(payload)
+    });
+  }
+  buildServerClient() {
+    const { opts } = this;
+    return new ServerClient({
+      serverUrl: opts.serverUrl,
+      managerName: opts.managerName,
+      providerKinds: Array.from(new Set(Array.from(this.providers.values()).map((p) => p.kind))),
+      registrationToken: opts.registrationToken,
+      providers: () => this.buildProviderAnnounce(),
+      onTurnDispatch: (payload) => this.acceptOrReportDispatch(payload),
+      onTurnCancel: (payload) => this.handleServerTurnCancel(payload),
+      onProvidersRegistered: (info) => this.handleProvidersRegistered(info),
+      onSessionRelease: (payload) => this.handleServerSessionReleaseSafe(payload),
+      onSessionEnsure: (payload) => this.handleSessionEnsureSafe(payload),
+      onTaskChanged: (payload) => this.handleTaskChangedSafe(payload),
+      onTerminalOpen: (payload) => this.terminalRelay.onTerminalOpen(payload),
+      onTerminalInput: (payload) => this.terminalRelay.onTerminalInput(payload),
+      onTerminalResize: (payload) => this.terminalRelay.onTerminalResize(payload),
+      onTerminalClose: (payload) => this.terminalRelay.onTerminalClose(payload),
+      onServerDisconnected: () => this.terminalRelay.onServerDisconnected(),
+      activeSessionCount: () => this.sessions.size
+    });
+  }
+  acceptOrReportDispatch(payload) {
+    this.turnRouter.acceptOrReportDispatch(payload);
+  }
+  handleServerSessionReleaseSafe(payload) {
+    this.handleServerSessionRelease(payload).catch((err) => {
+      log18.error({ err, session_id: payload.session_id }, "session.release handling failed");
+    });
+  }
+  handleSessionEnsureSafe(payload) {
+    this.ensureTerminalSession(payload).catch((err) => {
+      log18.error({
+        err,
+        request_id: payload.request_id,
+        channel_id: payload.channel_id
+      }, "session.ensure handling failed");
+    });
+  }
+  handleTaskChangedSafe(payload) {
+    this.handleTaskChanged(payload).catch((err) => {
+      log18.warn({ err, task_id: payload.task_id, version: payload.version }, "task.changed projection refresh failed");
+    });
+  }
+  buildCliDispatcher() {
+    return createCliDispatcher({
+      cache: this.taskCache,
+      sessionBinding: (sessionId) => {
+        const session = this.sessionsById.get(sessionId);
+        return session ? { sessionId: session.sessionId, taskId: session.taskId } : null;
+      },
+      taskClient: {
+        updateTaskFromCli: (payload) => this.serverClient.requestTaskCliUpdate(payload)
+      },
+      questionClient: {
+        createQuestion: (payload) => this.serverClient.requestQuestionCreate(payload)
+      },
+      resolveActiveTurn: (sessionId) => {
+        const session = this.sessionsById.get(sessionId);
+        if (!session) {
+          return { ok: false, code: "ASK_NOT_IN_ACTIVE_TURN" };
+        }
+        const turnIds = Array.from(session.turnToAgentKey.keys());
+        if (turnIds.length === 0) {
+          return { ok: false, code: "ASK_NOT_IN_ACTIVE_TURN" };
+        }
+        if (turnIds.length > 1) {
+          return { ok: false, code: "ASK_AMBIGUOUS_ACTIVE_TURN" };
+        }
+        return { ok: true, turnId: turnIds[0] };
+      }
+    });
+  }
+  buildProviderAnnounce() {
+    return this.sessionLifecycle.buildProviderAnnounce();
+  }
+  forwardRunnerTurnEvent(payload) {
+    this.turnRouter.forwardRunnerTurnEvent(payload);
+  }
+  forwardRunnerTurnFinished(payload) {
+    this.turnRouter.forwardRunnerTurnFinished(payload);
+  }
+  forwardTaskRefsSnapshot(payload) {
+    this.serverClient.send({
+      type: "task.refs_snapshot",
+      payload
+    });
+  }
+  handleProvidersRegistered(info) {
+    this.sessionLifecycle.handleProvidersRegistered(info);
+  }
+  async start() {
+    const localRunnerWsUrl = await this.runnerLink.start();
+    this.managerWsUrl = this.opts.runnerLinkPublicUrl ?? localRunnerWsUrl;
+    this.serverClient.start();
+    log18.info({
       manager_ws: this.managerWsUrl,
       local_runner_ws: localRunnerWsUrl,
       server: this.opts.serverUrl,
@@ -11288,7 +12268,7 @@ class RuntimeManager {
     this.stopped = true;
     while (this.provisioning.size > 0) {
       const inFlight = [...this.provisioning.values()];
-      log17.info({ in_flight: inFlight.length }, "awaiting in-flight provisioning before teardown");
+      log18.info({ in_flight: inFlight.length }, "awaiting in-flight provisioning before teardown");
       await Promise.allSettled(inFlight);
     }
     const sessions = Array.from(this.sessions.values());
@@ -11309,7 +12289,7 @@ class RuntimeManager {
         await providerForSession(this, session).releaseSession(session.provisioned);
         this.emitReleasedState(session);
       } catch (err) {
-        log17.warn({ err, session_id: session.sessionId }, "session release failed during shutdown \u2014 marking failed");
+        log18.warn({ err, session_id: session.sessionId }, "session release failed during shutdown — marking failed");
         const detail = err instanceof Error ? err.message : String(err);
         for (const agentSession of session.agentSessions.values()) {
           this.emitAgentSessionStateFailed(session, agentSession, detail);
@@ -11321,7 +12301,7 @@ class RuntimeManager {
     this.sessions.clear();
     this.sessionsById.clear();
     await Promise.allSettled(releases);
-    log17.info({ released: releases.length }, "all sessions released");
+    log18.info({ released: releases.length }, "all sessions released");
     this.serverClient.stop();
   }
   emitReleasedState(session) {
@@ -11451,7 +12431,7 @@ class RuntimeManager {
       payload
     });
     if (!sent) {
-      log17.warn({ session_id: sessionId, request_id: payload.request_id }, "cli.response dropped \u2014 runner disconnected");
+      log18.warn({ session_id: sessionId, request_id: payload.request_id }, "cli.response dropped — runner disconnected");
     }
   }
   ensureTaskProjection(session) {
@@ -11549,7 +12529,7 @@ configureLogger({
   serviceName: "runtime-manager",
   pretty: false
 });
-var log18 = childLogger({ subsystem: "cli" });
+var log19 = childLogger({ subsystem: "cli" });
 var HELP_TEXT = `runtime-manager \u2014 vine runtime manager
 
 Usage:
@@ -11583,7 +12563,7 @@ Runloop base URL, Blueprint/Snapshot, runner command, resource size, and TTL are
 formal runtime_provider_profile DB config. Env fallbacks are kept only for
 local smoke / migration compatibility.
 `;
-function runServe() {
+async function runServe() {
   const serverUrl = process.env.VINE_SERVER_URL ?? "ws://127.0.0.1:3000";
   const managerName = process.env.VINE_MANAGER_NAME ?? `local-${hostname2()}`;
   const providerBootstrap = parseRuntimeProviderBootstrapEnv(process.env);
@@ -11604,7 +12584,7 @@ function runServe() {
     registrationToken
   };
   if (providerBootstrap.legacyProviderIgnored) {
-    log18.warn("VINE_PROVIDER ignored because VINE_PROVIDERS is configured");
+    log19.warn("VINE_PROVIDER ignored because VINE_PROVIDERS is configured");
   }
   const runnerLinkHost = optionalNonEmpty(process.env.VINE_RUNNER_LINK_HOST);
   const runnerLinkPort = optionalPort(process.env.VINE_RUNNER_LINK_PORT);
@@ -11616,18 +12596,18 @@ function runServe() {
   if (runnerLinkPublicUrl !== undefined) {
     managerOptions.runnerLinkPublicUrl = runnerLinkPublicUrl;
   }
-  const manager = new RuntimeManager(managerOptions);
-  manager.start();
-  return new Promise((resolve2) => {
+  const manager = new RuntimeManager2(managerOptions);
+  await manager.start();
+  return new Promise((resolve3) => {
     let shuttingDown = false;
     const shutdown = (signal) => () => {
       if (shuttingDown)
         return;
       shuttingDown = true;
-      log18.info({ signal }, "shutdown signal received");
-      manager.stop().then(() => resolve2(0), (err) => {
-        log18.error({ err }, "shutdown failed");
-        resolve2(1);
+      log19.info({ signal }, "shutdown signal received");
+      manager.stop().then(() => resolve3(0), (err) => {
+        log19.error({ err }, "shutdown failed");
+        resolve3(1);
       });
     };
     process.on("SIGINT", shutdown("SIGINT"));
@@ -11669,7 +12649,7 @@ main().then((code) => {
   flushLogger();
   process.exit(code);
 }).catch((err) => {
-  log18.error({ err }, "runtime-manager crashed");
+  log19.error({ err }, "runtime-manager crashed");
   flushLogger();
   process.exit(1);
 });