@mycadet/cli 0.12.9 → 0.12.10

package/src/commands/tunnel.ts

@@ -47,7 +47,7 @@ interface TunnelArgs {
   provider: TunnelProviderName;
   domain: string | null;
   clearDomain: boolean;
-  detach: boolean;
+  foreground: boolean;
 }
 
 const FLAGS_WITH_VALUES = ["--provider", "--domain"] as const;
@@ -57,7 +57,7 @@ function parseArgs(): TunnelArgs {
   let provider: TunnelProviderName | null = null;
   let domain: string | null = null;
   let clearDomain = false;
-  let detach = false;
+  let foreground = false;
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -112,19 +112,22 @@ function parseArgs(): TunnelArgs {
         "                                tunnel without one. Cannot be combined with --domain.",
       );
       console.log(
-        `  -d, --detach                  Run the tunnel in the background. Waits up to ${TUNNEL_BACKGROUND_START_TIMEOUT_MS / 1000}s for the`,
+        `  --foreground                  Stream the tunnel's logs to this terminal. By default the tunnel`,
       );
       console.log(
-        "                                initial established/failed status before returning; logs go to",
+        "                                runs in the background: the command returns after printing the public",
       );
       console.log(
-        "                                the CLI log directory. Stop it with `kill <pid>`, except when it",
+        `                                URL, and logs stream to tunnel.log in the CLI log directory. A background`,
       );
       console.log(
-        "                                adopted an already-running tunnel (started outside this",
+        "                                tunnel stops with `kill <pid>`, except when it adopted an already-running",
       );
       console.log(
-        "                                command): killing the supervisor then leaves that tunnel running.",
+        "                                tunnel (started outside this command): killing the supervisor then",
+      );
+      console.log(
+        "                                leaves that tunnel running.",
       );
       console.log("");
       console.log("Providers:");
@@ -151,9 +154,6 @@ function parseArgs(): TunnelArgs {
       }
       console.log("  $ cadet tunnel --provider cloudflare");
       console.log("  $ cadet tunnel my-assistant --provider tailscale");
-      console.log(
-        `  $ cadet tunnel --provider ${DEFAULT_TUNNEL_PROVIDER} --detach`,
-      );
       process.exit(0);
     } else if (arg === "--provider") {
       const next = args[i + 1];
@@ -188,8 +188,8 @@ function parseArgs(): TunnelArgs {
       i++;
     } else if (arg === "--clear-domain") {
       clearDomain = true;
-    } else if (arg === "-d" || arg === "--detach") {
-      detach = true;
+    } else if (arg === "--foreground") {
+      foreground = true;
     } else if (arg.startsWith("-")) {
       console.error(`Error: Unknown option '${arg}'.`);
       process.exit(1);
@@ -227,7 +227,7 @@ function parseArgs(): TunnelArgs {
     process.exit(1);
   }
 
-  return { assistantName, provider, domain, clearDomain, detach };
+  return { assistantName, provider, domain, clearDomain, foreground };
 }
 
 /** A tunnelable assistant plus the gateway port and workspace the edge fronts. */
@@ -345,31 +345,31 @@ const TUNNEL_BACKGROUND_START_TIMEOUT_MS = 35_000;
 const TUNNEL_ESTABLISHED_RE = /Tunnel established: (\S+)/;
 
 /**
- * Re-invoke `cadet tunnel` (without `-d`/`--detach`) as a detached background
- * process via `relaunchDetached`, waiting for the child to either print its
- * "Tunnel established" or adopted-tunnel line (readiness) or
- * exit early (failure), so a misconfigured provider still fails loudly in
- * the terminal that ran `-d`.
+ * Re-invoke `cadet tunnel --foreground` as a detached background process via
+ * `relaunchDetached`, waiting for the child to either print its
+ * "Tunnel established" or adopted-tunnel line (readiness) or exit early
+ * (failure), so a misconfigured provider still fails loudly in the terminal
+ * that ran `cadet tunnel`.
  *
- * The log filename is scoped to this (parent) process's pid so concurrent
- * `-d` runs (e.g. tunneling two different local assistants at once) don't
- * truncate and read each other's readiness output.
+ * The log file is the fixed `tunnel.log` so there is one stable path to tail;
+ * concurrent tunnel runs share (and truncate) it.
  */
 async function spawnDetachedTunnel(): Promise<void> {
   const childArgs: string[] = ["tunnel"];
   for (const arg of process.argv.slice(3)) {
-    if (arg === "-d" || arg === "--detach") {
+    if (arg === "--foreground") {
       continue;
     }
     childArgs.push(arg);
   }
+  childArgs.push("--foreground");
 
   let publicUrl: string | undefined;
   let adopted = false;
 
   const { child, logPath, ready, exitCode } = await relaunchDetached({
     args: childArgs,
-    logFile: `tunnel-${process.pid}.log`,
+    logFile: "tunnel.log",
     timeoutMs: TUNNEL_BACKGROUND_START_TIMEOUT_MS,
     isReady: (logPath) => {
       let logText = "";
@@ -417,10 +417,10 @@ async function spawnDetachedTunnel(): Promise<void> {
 
 export const tunnel = Object.assign(
   async function tunnel(): Promise<void> {
-    const { assistantName, provider, domain, clearDomain, detach } =
+    const { assistantName, provider, domain, clearDomain, foreground } =
       parseArgs();
 
-    if (detach) {
+    if (!foreground) {
       await spawnDetachedTunnel();
       return;
     }

package/src/commands/uninstall.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, renameSync, rmSync, unlinkSync } from "fs";
-import { basename, dirname, join } from "path";
+import { basename, dirname, join, sep } from "path";
 import { fileURLToPath } from "url";
 
 import {
@@ -14,8 +14,8 @@ import {
 import { retireDocker } from "../lib/docker.js";
 import {
   getConfigDirs,
-  getInputHistoryPath,
   getLogDir,
+  getSharedStateDir,
   getStateDir,
 } from "../lib/environments/paths.js";
 import { getCurrentEnvironment } from "../lib/environments/resolve.js";
@@ -98,62 +98,84 @@ function findInstalledPackageRoot(startDir: string): string | null {
   return null;
 }
 
+/** The CLI's own install location, when it can be deleted. */
+interface SelfDeleteTarget {
+  path: string;
+  description: string;
+}
+
 /**
- * Remove the running CLI. Handles the two real install shapes:
- *   - the compiled `cadet` binary (process.execPath IS the install)
- *   - a global package install (bun install -g mycadet / npm install -g)
- * Under a source checkout or a bare runtime (bun/node), nothing is deleted —
- * the runtime binary must never be a deletion target.
+ * Where this CLI is running from, when that is an INSTALL we can remove:
+ * the compiled `cadet` binary (process.execPath IS the install) or a global
+ * package install (bun install -g mycadet / npm install -g mycadet). Under
+ * a source checkout or a bare runtime (bun/node), null — the runtime binary
+ * must never be a deletion target. The uninstall prompt lists the same
+ * target it later deletes, so both share this resolver.
  */
-function selfDelete(): void {
+function resolveSelfDeleteTarget(): SelfDeleteTarget | null {
   const execPath = process.execPath;
   const execBase = basename(execPath);
   if (execBase === "cadet" || execBase === "cadet.exe") {
+    return { path: execPath, description: "the Cadet executable" };
+  }
+  const runningFile = fileURLToPath(import.meta.url);
+  const pkgRoot = findInstalledPackageRoot(dirname(runningFile));
+  if (pkgRoot) {
+    return { path: pkgRoot, description: "the installed Cadet CLI package" };
+  }
+  return null;
+}
+
+/**
+ * Delete the install {@link resolveSelfDeleteTarget} found. The two shapes
+ * delete differently — the running binary needs the win32 rename dance, a
+ * package dir is a plain recursive delete — and the bin symlinks the
+ * package manager planted (e.g. ~/.bun/bin/cadet, the npm global bin) are
+ * left dangling — say so.
+ */
+function selfDelete(): void {
+  const target = resolveSelfDeleteTarget();
+  if (!target) {
+    console.log(
+      "Cadet is running from a source checkout — skipping self-removal.",
+    );
+    console.log(
+      "Remove the installed copy with `bun remove -g mycadet` or `npm uninstall -g mycadet`.",
+    );
+    return;
+  }
+  const execBase = basename(target.path);
+  const isCompiledBinary = execBase === "cadet" || execBase === "cadet.exe";
+  if (isCompiledBinary) {
     try {
       if (process.platform === "win32") {
         // Windows refuses to unlink a running executable — stage it under a
         // junk name and delete that.
-        const stale = `${execPath}.uninstalled`;
-        renameSync(execPath, stale);
+        const stale = `${target.path}.uninstalled`;
+        renameSync(target.path, stale);
         rmSync(stale, { force: true, recursive: true });
       } else {
-        unlinkSync(execPath);
+        unlinkSync(target.path);
       }
-      console.log(`Removed ${execPath}.`);
-      return;
+      console.log(`Removed ${target.path}.`);
     } catch (err) {
       console.warn(
-        `⚠️  Could not remove ${execPath}: ${
+        `⚠️  Could not remove ${target.path}: ${
           err instanceof Error ? err.message : String(err)
         } — remove it by hand.`,
       );
-      return;
     }
-  }
-
-  // Package-manager install: remove the package directory we are running
-  // from, best-effort. Bin symlinks the package manager planted (e.g.
-  // ~/.bun/bin/cadet, the npm global bin) are left dangling — say so.
-  const runningFile = fileURLToPath(import.meta.url);
-  const pkgRoot = findInstalledPackageRoot(dirname(runningFile));
-  if (!pkgRoot) {
-    console.log(
-      "Cadet is running from a source checkout — skipping self-removal.",
-    );
-    console.log(
-      "Remove the installed copy with `bun remove -g mycadet` or `npm uninstall -g mycadet`.",
-    );
     return;
   }
   try {
-    rmSync(pkgRoot, { recursive: true, force: true });
-    console.log(`Removed ${pkgRoot}.`);
+    rmSync(target.path, { recursive: true, force: true });
+    console.log(`Removed ${target.path}.`);
     console.log(
       "The `cadet` command on your PATH is now stale — remove it if your package manager didn't (`bun remove -g mycadet` or `npm uninstall -g mycadet`).",
     );
   } catch (err) {
     console.warn(
-      `⚠️  Could not remove ${pkgRoot}: ${
+      `⚠️  Could not remove ${target.path}: ${
         err instanceof Error ? err.message : String(err)
       } — remove it with \`bun remove -g mycadet\` (or \`npm uninstall -g mycadet\`).`,
     );
@@ -173,10 +195,24 @@ function collectDeleteTargets(env = getCurrentEnvironment()): DeleteTarget[] {
     { path: getLogDir(env), description: "logs" },
     // Not environment-scoped: deleting it affects every cadet CLI on the
     // machine — called out in the prompt, not hidden.
-    { path: getInputHistoryPath(), description: "shared terminal input history" },
+    {
+      path: getSharedStateDir(),
+      description: "shared state, including the terminal input history",
+    },
   ];
   // Only targets that exist — the prompt lists what will actually go.
-  return targets.filter((t) => existsSync(t.path));
+  const existing = targets.filter((t) => existsSync(t.path));
+  // The log dir lives INSIDE a listed target (the config dir on
+  // macOS/Linux, the state dir on Windows) and goes with its parent's
+  // recursive delete — never list a path twice.
+  const deduped: DeleteTarget[] = [];
+  for (const t of existing) {
+    const covered = deduped.some(
+      (k) => t.path === k.path || t.path.startsWith(k.path + sep),
+    );
+    if (!covered) deduped.push(t);
+  }
+  return deduped;
 }
 
 function rmrf(target: string): void {
@@ -190,63 +226,48 @@ export const uninstall = Object.assign(
       console.log("Usage: cadet uninstall [--yes]");
       console.log("");
       console.log(
-        "Remove Cadet entirely: delete every location it uses for this environment (assistant state, retired archives, config, logs) and then delete the executable itself.",
+        "Remove Cadet entirely: retire any remaining assistants, delete every location it uses for this environment (assistant state, retired archives, config, logs), and remove the Cadet installation itself.",
       );
       process.exit(0);
     }
     const yes = args.includes("--yes");
 
-    // Assistants still on the rack are retired — with their data deleted —
-    // as part of the uninstall. Uninstall deletes every location cadet uses
-    // INCLUDING the retired archives, so retiring first (which archives)
-    // only matters for the teardown it performs: docker assistants keep
-    // containers, volumes, and a network in docker that the filesystem
-    // sweep below never reaches. A warning, not a refusal (v0.0.10 run
-    // feedback: the hard error just blocked the uninstall).
+    const env = getCurrentEnvironment();
+    const envLabel = env.name ?? "production";
     const existing = loadAllAssistants();
+    const targets = collectDeleteTargets(env);
+    const selfTarget = resolveSelfDeleteTarget();
+
+    console.log(
+      `This removes Cadet entirely for the '${envLabel}' environment and cannot be undone.`,
+    );
+
+    // Assistants still on the rack are retired — with their data deleted —
+    // as part of the uninstall, and retiring happens only AFTER the
+    // confirmation below: it is part of what the prompt describes, never a
+    // side effect of running the command. Uninstall deletes every location
+    // cadet uses INCLUDING the retired archives, so retiring first (which
+    // archives) only matters for the teardown it performs: docker
+    // assistants keep containers, volumes, and a network in docker that
+    // the filesystem sweep below never reaches. A warning, not a refusal
+    // (v0.0.10 run feedback: the hard error just blocked the uninstall).
     if (existing.length > 0) {
       console.warn(
         `\n⚠️  ${existing.length} ${existing.length === 1 ? "assistant still exists" : "assistants still exist"}: ${existing.map((a) => a.assistantId).join(", ")}`,
       );
       console.warn(
-        "   They will be retired now — their data (and any retired archives) will be permanently deleted by this uninstall.",
+        "   They will be retired as part of this uninstall — their data (and any retired archives) will be permanently deleted.",
       );
-      for (const entry of existing) {
-        if (entry.cloud === "apple-container" || entry.cloud === "paired") {
-          console.log(`   Skipping '${entry.assistantId}' on ${entry.cloud} — its lifecycle is managed elsewhere.`);
-          continue;
-        }
-        try {
-          await retireAssistantData(entry);
-        } catch (err) {
-          console.error(
-            `   Warning: could not fully retire '${entry.assistantId}': ${err instanceof Error ? err.message : String(err)}`,
-          );
-        }
-      }
     }
 
-    const env = getCurrentEnvironment();
-    const envLabel = env.name ?? "production";
-    const targets = collectDeleteTargets(env);
-    const execPath = process.execPath;
-
-    console.log(
-      `This removes Cadet entirely for the '${envLabel}' environment and cannot be undone.`,
-    );
-    if (targets.length === 0) {
+    if (targets.length === 0 && selfTarget === null) {
       console.log("No Cadet data directories found to delete.");
     } else {
       console.log("It will permanently delete:");
-      for (const t of targets) {
+      for (const t of selfTarget ? [...targets, selfTarget] : targets) {
         console.log(`  - ${t.path}  — ${t.description}`);
       }
     }
-    const execBase = basename(execPath);
-    const isCompiledBinary = execBase === "cadet" || execBase === "cadet.exe";
-    if (isCompiledBinary) {
-      console.log(`It will then remove the Cadet executable at ${execPath}.`);
-    }
 
     if (!yes) {
       if (!canPromptForConfirmation()) {
@@ -265,6 +286,20 @@ export const uninstall = Object.assign(
       }
     }
 
+    for (const entry of existing) {
+      if (entry.cloud === "apple-container" || entry.cloud === "paired") {
+        console.log(`   Skipping '${entry.assistantId}' on ${entry.cloud} — its lifecycle is managed elsewhere.`);
+        continue;
+      }
+      try {
+        await retireAssistantData(entry);
+      } catch (err) {
+        console.error(
+          `   Warning: could not fully retire '${entry.assistantId}': ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+    }
+
     for (const t of targets) {
       rmrf(t.path);
       console.log(`Deleted ${t.path}.`);

package/src/lib/__tests__/local-gateway-cli.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from "bun:test";
+
+import type { LocalInstanceResources } from "../assistant-config.js";
+import { gatewayCliInvocation } from "../local.js";
+
+function fakeResources(instanceDir: string): LocalInstanceResources {
+  // gatewayCliInvocation only reads instanceDir; the rest of the resources
+  // shape is irrelevant here.
+  return { instanceDir } as unknown as LocalInstanceResources;
+}
+
+describe("gatewayCliInvocation", () => {
+  test("runs the gateway package's CLI entry through bun", () => {
+    const invocation = gatewayCliInvocation();
+    expect(invocation.args[0]).toBe("run");
+    expect(invocation.args[1]).toMatch(/gateway\/src\/cli\/index\.ts$/);
+  });
+
+  test("pins CADET_WORKSPACE_DIR to the instance dir for named instances", () => {
+    const invocation = gatewayCliInvocation(
+      fakeResources("/data/assistants/testy"),
+    );
+    expect(invocation.env.CADET_WORKSPACE_DIR).toBe(
+      "/data/assistants/testy/workspace",
+    );
+  });
+
+  test("pins GATEWAY_SECURITY_DIR to the instance dir for named instances", () => {
+    const invocation = gatewayCliInvocation(
+      fakeResources("/data/assistants/testy"),
+    );
+    expect(invocation.env.GATEWAY_SECURITY_DIR).toBe(
+      "/data/assistants/testy/gateway-security",
+    );
+  });
+
+  test("leaves the workspace resolution untouched for the default instance", () => {
+    delete process.env.CADET_WORKSPACE_DIR;
+    const invocation = gatewayCliInvocation();
+    expect(invocation.env.CADET_WORKSPACE_DIR).toBeUndefined();
+  });
+});

package/src/lib/cloud-client.ts

@@ -604,7 +604,6 @@ export interface CredentialInjectionParams {
   bearerToken?: string;
   assistantApiKey?: string | null;
   cloudAssistantId: string;
-  cloudBaseUrl: string;
   organizationId: string;
   userId?: string;
   webhookSecret?: string | null;
@@ -631,8 +630,6 @@ export async function injectCredentialsIntoAssistant(
     promises.push(inject("cadet:assistant_api_key", params.assistantApiKey));
   }
 
-  promises.push(inject("cadet:platform_base_url", params.cloudBaseUrl));
-
   if (params.webhookSecret) {
     promises.push(inject("cadet:webhook_secret", params.webhookSecret));
   }

package/src/lib/cloud-login.ts

@@ -409,7 +409,6 @@ export async function registerLocalAssistantWithPlatform(
     bearerToken: options.bearerToken ?? entry.bearerToken,
     assistantApiKey,
     cloudAssistantId: registration.assistant.id,
-    cloudBaseUrl: cloudUrl,
     organizationId: orgId,
     userId: user.id,
     webhookSecret: registration.webhook_secret,

package/src/lib/color.ts

@@ -14,3 +14,7 @@ export function red(text: string, stream?: NodeJS.WriteStream): string {
 export function yellow(text: string, stream?: NodeJS.WriteStream): string {
   return colorize("\x1b[33m", text, stream);
 }
+
+export function green(text: string, stream?: NodeJS.WriteStream): string {
+  return colorize("\x1b[32m", text, stream);
+}

package/src/lib/docker.ts

@@ -27,6 +27,7 @@ import {
   ASSISTANT_INTERNAL_PORT,
   getDefaultPorts,
 } from "./environments/paths.js";
+import { green, yellow } from "./color.js";
 import { getCurrentEnvironment } from "./environments/resolve.js";
 import { leaseGuardianToken } from "./guardian-token";
 import { logHatchNextSteps } from "./hatch-next-steps.js";
@@ -42,7 +43,6 @@ import { isDevVersion } from "./version-compat.js";
 import {
   collectProviderApiKey,
   configureHatchProviderApiKey,
-  formatProviderName,
   promptProviderChoice,
   resolveHatchProvider,
   shouldPromptForHatchProvider,
@@ -1544,7 +1544,7 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
           }
         }
       }
-      log("✅ Docker images acquired");
+      log(green("✅ Docker images acquired", process.stdout));
     }
 
     const res = dockerResourceNames(instanceName);
@@ -1745,18 +1745,16 @@ export async function hatchDocker(params: HatchDockerParams): Promise<void> {
         );
       } else if (providerSetupAction === "missing-token" && provider !== null) {
         log(
-          `⚠️  Provider credential setup skipped because the guardian token was not leased.\n` +
-            `   The assistant is still hatched. Run \`cadet setup --provider ${provider}\` after fixing the connection.`,
+          yellow(
+            `⚠️  Provider credential setup skipped because the guardian token was not leased.\n` +
+              `   The assistant is still hatched. Run \`cadet setup --provider ${provider}\` after fixing the connection.`,
+            process.stdout,
+          ),
         );
       } else if (
         providerSetupAction === "configure" &&
         provider !== undefined
       ) {
-        log(
-          provider === null
-            ? "Checking provider credentials..."
-            : `Checking ${formatProviderName(provider)} credentials...`,
-        );
         await configureHatchProviderApiKey({
           gatewayUrl: runtimeUrl,
           provider,
@@ -1855,25 +1853,12 @@ async function waitForGatewayAndLease(opts: {
   };
 
   if (detached) {
-    log("\n✅ Docker assistant hatched!\n");
-    log("Instance details:");
-    printInstanceDetails(
-      {
-        name: instanceName,
-        runtime: runtimeUrl,
-        container: containerName,
-      },
-      log,
-    );
-    log("");
-    log(`Stop with: cadet retire ${instanceName}`);
-
-    // Lease a guardian token even in detached mode so that `cadet ps`,
-    // `cadet exec`, and other CLI commands can authenticate to the
-    // gateway. Skip the /readyz readiness poll (the caller asked to detach
-    // and not block) but retry the lease itself since the gateway may need
-    // a moment to accept connections after the container starts.
-    const leaseStart = Date.now();
+    // Lease a guardian token BEFORE declaring the assistant hatched so the
+    // banner means `cadet ps`, `cadet exec`, and other CLI commands can
+    // already authenticate. Skip the /readyz readiness poll (the caller
+    // asked to detach and not block) but retry the lease silently since
+    // the gateway may need a moment to accept connections after the
+    // container starts; only a final failure surfaces to the user.
     const leaseDeadline = containersUpAt + DOCKER_READY_TIMEOUT_MS;
     let guardianAccessToken: string | undefined;
     while (Date.now() < leaseDeadline) {
@@ -1884,27 +1869,33 @@ async function waitForGatewayAndLease(opts: {
           bootstrapSecret,
         );
         guardianAccessToken = tokenData.accessToken;
-        const leaseElapsed = ((Date.now() - leaseStart) / 1000).toFixed(1);
-        log(
-          `Guardian token lease: success after ${leaseElapsed}s (principalId=${tokenData.guardianPrincipalId})`,
-        );
         break;
-      } catch (err) {
-        const elapsed = ((Date.now() - leaseStart) / 1000).toFixed(0);
-        const msg = err instanceof Error ? err.message : String(err);
-        log(
-          `Guardian token lease: attempt failed after ${elapsed}s (${msg.split("\n")[0]}), retrying...`,
-        );
+      } catch {
         await new Promise((r) => setTimeout(r, 2000));
       }
     }
     if (!guardianAccessToken) {
       log(
-        `⚠️  Guardian token lease failed after ${DOCKER_READY_TIMEOUT_MS / 1000}s.\n` +
-          `   The assistant is running but CLI commands (cadet ps, cadet exec) will not authenticate.\n` +
-          `   Re-hatch or run \`cadet setup\` to recover.`,
+        yellow(
+          `⚠️  Guardian token lease failed after ${DOCKER_READY_TIMEOUT_MS / 1000}s.\n` +
+            `   The assistant is running but CLI commands (cadet ps, cadet exec) will not authenticate.\n` +
+            `   Re-hatch or run \`cadet setup\` to recover.`,
+          process.stdout,
+        ),
       );
     }
+
+    log(`\n${green("✅ Docker assistant hatched!", process.stdout)}\n`);
+    log("Instance details:");
+    printInstanceDetails(
+      {
+        name: instanceName,
+        runtime: runtimeUrl,
+        container: containerName,
+      },
+      log,
+    );
+    log("");
     return { ready: true, guardianAccessToken };
   }
 
@@ -1985,7 +1976,6 @@ async function waitForGatewayAndLease(opts: {
   // Lease guardian token. The /readyz check confirms both gateway and
   // assistant are reachable. Retry with backoff in case there is a brief
   // window where readiness passes but the guardian endpoint is not yet ready.
-  log(`Guardian token lease: starting for ${instanceName} at ${runtimeUrl}`);
   const leaseStart = Date.now();
   const leaseDeadline = start + DOCKER_READY_TIMEOUT_MS;
   let leaseSuccess = false;
@@ -1999,38 +1989,30 @@ async function waitForGatewayAndLease(opts: {
         instanceName,
         bootstrapSecret,
       );
-      const leaseElapsed = ((Date.now() - leaseStart) / 1000).toFixed(1);
-      log(
-        `Guardian token lease: success after ${leaseElapsed}s (principalId=${tokenData.guardianPrincipalId}, expiresAt=${tokenData.accessTokenExpiresAt})`,
-      );
       guardianAccessToken = tokenData.accessToken;
       leaseSuccess = true;
       break;
     } catch (err) {
       lastLeaseError =
         err instanceof Error ? (err.stack ?? err.message) : String(err);
-      // Log periodically so the user knows we're still trying
-      const elapsed = ((Date.now() - leaseStart) / 1000).toFixed(0);
-      log(
-        `Guardian token lease: attempt failed after ${elapsed}s (${
-          lastLeaseError.split("\n")[0]
-        }), retrying...`,
-      );
     }
     await new Promise((r) => setTimeout(r, 2000));
   }
 
   if (!leaseSuccess) {
     log(
-      `\u26a0\ufe0f  Guardian token lease: FAILED after ${(
-        (Date.now() - leaseStart) /
-        1000
-      ).toFixed(1)}s — ${lastLeaseError ?? "unknown error"}`,
+      yellow(
+        `\u26a0\ufe0f  Guardian token lease: FAILED after ${(
+          (Date.now() - leaseStart) /
+          1000
+        ).toFixed(1)}s — ${lastLeaseError ?? "unknown error"}`,
+        process.stdout,
+      ),
     );
   }
 
   log("");
-  log(`\u2705 Docker containers are up and running!`);
+  log(green(`\u2705 Docker containers are up and running!`, process.stdout));
   log(`   Name: ${instanceName}`);
   log(`   Runtime: ${runtimeUrl}`);
   log("");