@proagentstore/cli 0.2.3 → 0.2.5

package/dist/browser-runner/coding/headless.js

@@ -15,18 +15,22 @@ export class HeadlessSession {
     cmdBin;
     cmdArgs;
     binName;
-    /** Wall-clock of the last stdout byte — drives the raw-mode idle heuristic. */
+    /** Wall-clock of the last stdout/stderr byte — drives the raw-mode idle heuristic. */
     lastOutputAt = 0;
+    /** Raw-mode: has any output arrived since the current turn's input? */
+    sawOutputSinceInput = false;
+    /** Raw-mode: when the current turn started (absolute idle backstop). */
+    turnStartedAt = 0;
     constructor(config) {
         this.config = config;
         this.sessionName = `pags-${config.clientType}-${config.id}`;
         this.claudeSessionId = readState(config.statePath, config.id);
         // Claude is the structured engine; everything else is a raw CLI.
         this.mode = config.clientType === "claude" ? "stream-json" : "raw";
-        const tokens = config.command?.trim() ? config.command.trim().split(/\s+/) : [];
-        // A test/override bin wins; else the command's first word; else `claude`.
-        this.cmdBin = config.bin ?? tokens[0] ?? "claude";
-        this.cmdArgs = config.bin ? [] : tokens.slice(1);
+        const { bin, args } = parseCommand(config.command);
+        // A test/override bin wins for the binary only; the command's args are kept.
+        this.cmdBin = config.bin ?? (bin || "claude");
+        this.cmdArgs = args;
         this.binName = (this.cmdBin.split("/").pop() || this.cmdBin) || "cli";
     }
     /** True while the agent process is running. */
@@ -40,10 +44,23 @@ export class HeadlessSession {
     runState() {
         if (!this.alive)
             return "idle";
-        // Raw engines have no "turn over" event, so settle to idle once stdout has
-        // been quiet for a beat after a turn started.
-        if (this.mode === "raw" && this.run === "thinking" && Date.now() - this.lastOutputAt > 1500) {
-            this.run = "idle";
+        // Raw engines have no "turn over" event, so we INFER idle. Three rules, in order:
+        //  1. produced output, then went quiet for 1.5s → settled (the common case).
+        //  2. NEVER produced output but 8s elapsed → a silent turn (just a prompt) is done.
+        //  3. absolute 15-min backstop → never wedge "thinking" forever (e.g. a heartbeat
+        //     that keeps refreshing lastOutputAt). The user can also Restart from diagnostics.
+        // Rule 1 deliberately waits for first output so a slow first token can't flip us
+        // to idle mid-turn (which would make the brain proceed against a half-done turn).
+        if (this.mode === "raw" && this.run === "thinking") {
+            const now = Date.now();
+            const quiet = now - this.lastOutputAt;
+            const elapsed = now - this.turnStartedAt;
+            if (this.sawOutputSinceInput && quiet > 1500)
+                this.run = "idle";
+            else if (!this.sawOutputSinceInput && elapsed > 8000)
+                this.run = "idle";
+            else if (elapsed > 15 * 60 * 1000)
+                this.run = "idle";
         }
         return this.run === "thinking" ? "thinking" : "idle";
     }
@@ -55,24 +72,10 @@ export class HeadlessSession {
     start() {
         if (this.alive)
             return;
-        let args;
-        if (this.mode === "stream-json") {
-            // Claude: the structured persistent-agent protocol. We own the stream-json
-            // flags; the user's command may add others (e.g. --model, a key via env).
-            args = ["-p", "--input-format", "stream-json", "--output-format", "stream-json", "--verbose"];
-            for (const a of this.cmdArgs)
-                if (!args.includes(a))
-                    args.push(a);
-            if (!args.includes("--dangerously-skip-permissions"))
-                args.push("--dangerously-skip-permissions");
-            // Continue the prior conversation after a runner restart (state in ~/.claude).
-            if (this.claudeSessionId)
-                args.push("--resume", this.claudeSessionId);
-        }
-        else {
-            // Any other engine: run exactly what the user configured; capture stdout.
-            args = [...this.cmdArgs];
-        }
+        // stream-json: we own the structural flags + --resume; merge the user's extras
+        // (e.g. --model) without letting them clobber or orphan-value our flags. raw:
+        // run exactly what the user configured and capture stdout.
+        const args = this.mode === "stream-json" ? buildClaudeArgs(this.cmdArgs, this.claudeSessionId) : [...this.cmdArgs];
         this.proc = spawn(this.cmdBin, args, {
             cwd: this.config.workDir,
             env: { ...process.env, ...this.config.env },
@@ -92,6 +95,7 @@ export class HeadlessSession {
         this.proc.stdout?.on("data", (d) => this.onStdout(d.toString("utf8")));
         this.proc.stderr?.on("data", (d) => {
             this.lastOutputAt = Date.now();
+            this.sawOutputSinceInput = true;
             const text = d.toString("utf8").trim();
             if (text)
                 this.push(`[${this.binName}] ${stripAnsi(text)}`);
@@ -114,7 +118,10 @@ export class HeadlessSession {
             this.start();
         this.push(`\n❯ [${stamp()}] ${text}`); // ❯ — your turn, timestamped
         this.run = "thinking";
-        this.lastOutputAt = Date.now();
+        const now = Date.now();
+        this.lastOutputAt = now;
+        this.turnStartedAt = now;
+        this.sawOutputSinceInput = false; // arm the raw idle heuristic for THIS turn
         try {
             if (this.mode === "stream-json") {
                 const msg = JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text }] } });
@@ -142,6 +149,7 @@ export class HeadlessSession {
             /* ignore */
         }
         this.run = "idle";
+        this.lastOutputAt = Date.now();
     }
     /** Tear the process down. */
     stop() {
@@ -157,6 +165,7 @@ export class HeadlessSession {
     // ── internals ────────────────────────────────────────────────────────────
     onStdout(chunk) {
         this.lastOutputAt = Date.now();
+        this.sawOutputSinceInput = true; // a slow first token must NOT count as idle
         this.buf += chunk;
         let nl;
         // biome-ignore lint/suspicious/noAssignInExpressions: standard line-buffer drain
@@ -170,6 +179,13 @@ export class HeadlessSession {
             else
                 this.pushRaw(line); // raw engine — the line IS the terminal output
         }
+        // A TUI/raw engine may render without newlines; don't let `buf` grow unbounded
+        // (and surface the partial output so the pane isn't blank). 16KB is generous.
+        if (this.buf.length > 16 * 1024) {
+            if (this.mode === "raw")
+                this.pushRaw(this.buf);
+            this.buf = "";
+        }
     }
     /** Raw-engine stdout: strip ANSI control codes and append to the transcript. */
     pushRaw(line) {
@@ -230,6 +246,44 @@ export class HeadlessSession {
 function stamp() {
     return new Date().toTimeString().slice(0, 8);
 }
+/** Split a launch command into bin + args, respecting single/double quotes. */
+export function parseCommand(command) {
+    const tokens = [];
+    const re = /"([^"]*)"|'([^']*)'|(\S+)/g;
+    let m;
+    // biome-ignore lint/suspicious/noAssignInExpressions: tokenizer drain
+    while ((m = re.exec(command ?? "")) !== null)
+        tokens.push(m[1] ?? m[2] ?? m[3] ?? "");
+    return { bin: tokens[0] ?? "", args: tokens.slice(1) };
+}
+/** Structural flags PAGS owns for the Claude stream-json engine — a user command
+ *  must not override or duplicate these (and must not orphan their values). */
+const RESERVED_CLAUDE_FLAGS = new Set(["-p", "--print", "--input-format", "--output-format", "--verbose", "--resume"]);
+/**
+ * Build Claude's argv: our structural stream-json flags + the user's extra args
+ * (e.g. `--model`), with reserved flags (and their values) stripped so the user
+ * can't clobber the protocol or leave an orphaned positional. `--resume` is added
+ * last from our persisted session id, never from the user's command.
+ */
+export function buildClaudeArgs(userArgs, resumeId) {
+    const args = ["-p", "--input-format", "stream-json", "--output-format", "stream-json", "--verbose"];
+    for (let i = 0; i < userArgs.length; i++) {
+        const a = userArgs[i];
+        if (RESERVED_CLAUDE_FLAGS.has(a)) {
+            // drop the flag AND its value (when the next token isn't itself a flag)
+            if (i + 1 < userArgs.length && !userArgs[i + 1].startsWith("-"))
+                i++;
+            continue;
+        }
+        if (!args.includes(a))
+            args.push(a);
+    }
+    if (!args.includes("--dangerously-skip-permissions"))
+        args.push("--dangerously-skip-permissions");
+    if (resumeId)
+        args.push("--resume", resumeId);
+    return args;
+}
 /** Strip ANSI/VT escape sequences so a raw CLI's coloured output reads as plain text. */
 // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping terminal escape codes
 function stripAnsi(s) {

package/dist/browser-runner/coding/runtime.js

@@ -98,6 +98,20 @@ export class CodingRuntime {
             tmuxSession: s.sessionName,
         }));
     }
+    /** Rich diagnostics for every tracked session — the console's transparency view. */
+    diagnostics() {
+        return [...this.sessions.entries()].map(([sessionId, s]) => ({
+            sessionId,
+            tmuxSession: s.sessionName,
+            alive: s.alive,
+            runState: s.alive ? s.runState() : "idle",
+            ready: s.alive ? s.ready : false,
+            paneLines: s.alive ? (s.snapshot().split("\n").length) : 0,
+            clientType: s.config.clientType,
+            workDir: s.config.workDir,
+            takeover: this.takeovers.has(sessionId),
+        }));
+    }
     // ── Human takeover (the "stuck" handoff) ────────────────────────────────
     // A text-frame equivalent of the browser takeover: the console shows the live
     // pane and forwards the human's keystrokes until they Resume.

package/dist/browser-runner/server.js

@@ -161,6 +161,20 @@ async function route(runner, req, res) {
     if (req.method === "GET" && path === "/coding/sessions") {
         return json(res, 200, { sessions: runner.coding.list() });
     }
+    if (req.method === "GET" && path === "/coding/diagnostics") {
+        const { listSessions: tmuxList } = await import("./coding/tmux.js");
+        const allTmux = tmuxList();
+        const pagsTmux = allTmux.filter((n) => n.startsWith("pags-"));
+        const tracked = runner.coding.diagnostics();
+        const trackedNames = new Set(tracked.map((s) => s.tmuxSession));
+        const orphanedTmux = pagsTmux.filter((n) => !trackedNames.has(n));
+        return json(res, 200, {
+            tracked,
+            orphanedTmux,
+            tmuxTotal: allTmux.length,
+            pagsTmuxTotal: pagsTmux.length,
+        });
+    }
     if (req.method === "POST" && path === "/coding/event") {
         // Brain progress events — recorded by PAGS, ignored locally. Accept + ack.
         return json(res, 200, { ok: true });

package/dist/index.js

@@ -905,6 +905,98 @@ function responseErrorMessage(data, text, statusText) {
 function collectCapability(value, previous = []) {
   return [...previous, value];
 }
+async function connectViaRelay(instanceIds, localUrl, runnerToken, opts) {
+  const apiBase = pagsApiBase(opts.apiBase).replace(/^http/, "ws");
+  const pagsToken = clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+  if (!pagsToken) throw new Error("PAGS token required for WebSocket relay");
+  const capabilities = await requestRunner("GET", "/capabilities", { url: localUrl, token: runnerToken, instanceId: instanceIds[0] });
+  const caps = Array.isArray(capabilities.capabilities) ? capabilities.capabilities.filter((item) => typeof item === "string") : [];
+  for (const id of instanceIds) {
+    await requestPags("POST", `/v1/instances/${apiPathSegment(id)}/runtime`, opts, {
+      endpointUrl: localUrl,
+      token: runnerToken,
+      placement: "local",
+      capabilities: caps,
+      runnerVersion: ""
+    }).catch((e) => writeError(`register ${id.slice(0, 8)}\u2026 failed: ${e instanceof Error ? e.message : String(e)}`));
+  }
+  for (const id of instanceIds) {
+    openRelaySocket(id, apiBase, pagsToken, localUrl, runnerToken);
+  }
+  writeLine("Runtime registered with PAGS \u2713");
+  writeLine("");
+  writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  writeLine("  \u2705 CONNECTED \u2014 WebSocket relay (no tunnel)");
+  writeLine(`  Agents:   ${instanceIds.length} instance${instanceIds.length === 1 ? "" : "s"}`);
+  writeLine("  No cloudflared needed. Ctrl+C to disconnect.");
+  writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+  let stopped = false;
+  const heartbeatLoop = async () => {
+    while (!stopped) {
+      await new Promise((r) => setTimeout(r, 3e4));
+      if (stopped) break;
+      for (const id of instanceIds) {
+        await requestPags("POST", `/v1/instances/${apiPathSegment(id)}/runtime/heartbeat`, opts, {}).catch(() => void 0);
+      }
+    }
+  };
+  void heartbeatLoop();
+  process.once("beforeExit", () => {
+    stopped = true;
+  });
+}
+function openRelaySocket(instanceId, wsBase, pagsToken, localUrl, runnerToken) {
+  let backoffMs = 1e3;
+  let reconnecting = false;
+  const connect = () => {
+    const url = `${wsBase}/v1/relay/${encodeURIComponent(instanceId)}/connect?token=${encodeURIComponent(pagsToken)}`;
+    const ws = new WebSocket(url);
+    ws.onopen = () => {
+      backoffMs = 1e3;
+      writeLine(`Relay connected: ${instanceId.slice(0, 8)}\u2026`);
+    };
+    ws.onmessage = async (event) => {
+      const text = typeof event.data === "string" ? event.data : String(event.data);
+      let cmd;
+      try {
+        cmd = JSON.parse(text);
+      } catch {
+        return;
+      }
+      if (!cmd.id || !cmd.path) return;
+      const method = (cmd.method || "POST").toUpperCase();
+      const hasBody = method !== "GET" && method !== "HEAD" && cmd.body !== void 0;
+      try {
+        const headers = {};
+        if (hasBody) headers["Content-Type"] = "application/json";
+        if (runnerToken) headers.Authorization = `Bearer ${runnerToken}`;
+        headers["X-PAGS-Instance-Id"] = instanceId;
+        const res = await fetch(`${localUrl}${cmd.path}`, {
+          method,
+          headers,
+          body: hasBody ? JSON.stringify(cmd.body) : void 0
+        });
+        const result = await res.json().catch(() => ({}));
+        ws.send(JSON.stringify({ id: cmd.id, status: res.status, result }));
+      } catch (err) {
+        ws.send(JSON.stringify({ id: cmd.id, status: 500, error: err instanceof Error ? err.message : String(err) }));
+      }
+    };
+    ws.onclose = () => {
+      if (reconnecting) return;
+      reconnecting = true;
+      writeLine(`Relay disconnected: ${instanceId.slice(0, 8)}\u2026 \u2014 reconnecting in ${Math.round(backoffMs / 1e3)}s`);
+      setTimeout(() => {
+        reconnecting = false;
+        connect();
+      }, backoffMs);
+      backoffMs = Math.min(backoffMs * 2, 3e4);
+    };
+    ws.onerror = () => {
+    };
+  };
+  connect();
+}
 function createRunnerCommand() {
   const command = new Command6("runner").description(
     "Manage the local FAGS browser runtime for ProAgentStore agents"
@@ -912,7 +1004,7 @@ function createRunnerCommand() {
   command.command("start").description("Start the local FAGS browser runtime in the foreground").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Require this bearer token").option("--instance-id <id>", "Bind runner requests to a PAGS instance id").option("--headless", "Run Playwright headless").action(async (opts) => {
     await startRunnerForeground(opts);
   });
-  command.command("connect <instanceIds...>").description("Start ONE local runtime, open a Cloudflare quick tunnel, and register it for every given PAGS instance").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--cloudflared <path>", "cloudflared executable").option("--runner-version <version>", "Runner version").option("--skip-probe", "Skip PAGS FAGS-runtime probe after registration").action(async (instanceIds, opts) => {
+  command.command("connect <instanceIds...>").description("Start ONE local runtime, open a Cloudflare quick tunnel, and register it for every given PAGS instance").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind", "49171").option("--data-dir <path>", "Runner data directory").option("--token <token>", "Runner bearer token. Defaults to PAGS_RUNNER_TOKEN or a generated token").option("--headless", "Run Playwright headless").option("--api-base <url>", "PAGS API base URL").option("--pags-token <token>", "PAGS session token. Defaults to PAGS_TOKEN").option("--cloudflared <path>", "cloudflared executable").option("--runner-version <version>", "Runner version").option("--skip-probe", "Skip PAGS FAGS-runtime probe after registration").option("--tunnel <mode>", "Tunnel mode: 'ws' (WebSocket relay), 'named' (production), or 'quick' (default)", "quick").action(async (instanceIds, opts) => {
     const runnerToken = clean(opts.token) || clean(process.env.PAGS_RUNNER_TOKEN) || `pags_runner_${randomUUID()}`;
     const host = clean(opts.host) || "127.0.0.1";
     const port = clean(opts.port) || String(await findFreePort2(49171));
@@ -951,6 +1043,77 @@ function createRunnerCommand() {
     try {
       await waitForLocalRunner({ url: localUrl, token: runnerToken, instanceId: primary });
       writeLine(`Local FAGS runtime healthy at ${localUrl}`);
+      if (opts.tunnel === "ws") {
+        await connectViaRelay(instanceIds, localUrl, runnerToken, opts);
+        await new Promise((resolvePromise) => {
+          runner.on("exit", () => resolvePromise());
+        });
+        return;
+      }
+      if (opts.tunnel === "named") {
+        writeLine("Provisioning named tunnel\u2026");
+        const provRes = await requestPags("POST", "/v1/tunnel/provision", opts, {});
+        const prov = provRes;
+        if (!prov.connectorToken) {
+          writeError(`Named tunnel provisioning failed: ${prov.error || "no token returned"}. Falling back to quick tunnel.`);
+        } else {
+          const tunnelUrl2 = prov.endpointUrl || `https://${prov.hostname}`;
+          writeLine(`Named tunnel: ${tunnelUrl2}`);
+          const cloudflaredPath2 = await resolveCloudflaredCommand(opts.cloudflared);
+          const tunnelProc = spawn2(cloudflaredPath2, ["tunnel", "run", "--token", prov.connectorToken], {
+            stdio: ["ignore", "pipe", "pipe"],
+            shell: process.platform === "win32"
+          });
+          tunnel = tunnelProc;
+          tunnelProc.stdout?.on("data", (d2) => {
+            const t = d2.toString("utf-8");
+            if (/registered/.test(t) || /CONNECTED/.test(t)) writeLine("Named tunnel connected \u2713");
+          });
+          tunnelProc.stderr?.on("data", (d2) => {
+            const t = d2.toString("utf-8");
+            if (/registered/.test(t) || /CONNECTED/.test(t)) writeLine("Named tunnel connected \u2713");
+          });
+          await new Promise((r) => setTimeout(r, 4e3));
+          const capabilities = await requestRunner("GET", "/capabilities", { url: localUrl, token: runnerToken, instanceId: primary });
+          const caps = Array.isArray(capabilities.capabilities) ? capabilities.capabilities.filter((item) => typeof item === "string") : [];
+          for (const id of instanceIds) {
+            try {
+              await requestPags("POST", `/v1/instances/${apiPathSegment(id)}/runtime`, opts, {
+                endpointUrl: tunnelUrl2,
+                token: runnerToken,
+                placement: "local",
+                capabilities: caps,
+                runnerVersion: clean(opts.runnerVersion) || ""
+              });
+            } catch (error) {
+              writeError(`register ${id.slice(0, 8)}\u2026 failed (${error instanceof Error ? error.message : String(error)})`);
+            }
+          }
+          writeLine("Runtime registered with PAGS \u2713");
+          writeLine("");
+          writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+          writeLine("  \u2705 CONNECTED \u2014 named tunnel (production)");
+          writeLine(`  Agents:   ${instanceIds.length} instance${instanceIds.length === 1 ? "" : "s"}`);
+          writeLine(`  Endpoint: ${tunnelUrl2}`);
+          writeLine("  Stable URL \u2014 no reconnect churn. Ctrl+C to disconnect.");
+          writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+          let stopped2 = false;
+          void (async () => {
+            while (!stopped2) {
+              await new Promise((r) => setTimeout(r, 3e4));
+              if (stopped2) break;
+              for (const id of instanceIds) {
+                await requestPags("POST", `/v1/instances/${apiPathSegment(id)}/runtime/heartbeat`, opts, {}).catch(() => void 0);
+              }
+            }
+          })();
+          await new Promise((resolvePromise) => {
+            runner.on("exit", () => resolvePromise());
+          });
+          stopped2 = true;
+          return;
+        }
+      }
       const cloudflaredPath = await resolveCloudflaredCommand(opts.cloudflared);
       const openTunnel = () => new Promise((resolveTunnel, reject) => {
         let output = "";
@@ -1000,11 +1163,15 @@ function createRunnerCommand() {
       writeLine("  Auto-reconnect is on \u2014 keep this terminal open. Ctrl+C to disconnect.");
       writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
       let stopped = false;
+      let consecutiveFailures = 0;
+      let respawnBackoffMs = 3e4;
+      const PROBE_FAIL_THRESHOLD = 3;
+      const MAX_BACKOFF_MS = 5 * 6e4;
       const probeTunnel = async (url) => {
         try {
           const res = await fetch(`${url.replace(/\/$/, "")}/health`, {
             headers: { Authorization: `Bearer ${runnerToken}`, "X-PAGS-Instance-Id": primary },
-            signal: AbortSignal.timeout(8e3)
+            signal: AbortSignal.timeout(1e4)
           });
           return res.ok;
         } catch {
@@ -1024,13 +1191,21 @@ function createRunnerCommand() {
           await new Promise((r) => setTimeout(r, 3e4));
           if (stopped) break;
           if (await probeTunnel(tunnelUrl)) {
+            consecutiveFailures = 0;
+            respawnBackoffMs = 3e4;
             const beat = await heartbeatAll();
             if (!beat) {
               await registerRuntime(tunnelUrl).then(() => writeLine("\u2705 Re-registered with PAGS")).catch(() => void 0);
             }
             continue;
           }
+          consecutiveFailures++;
+          if (consecutiveFailures < PROBE_FAIL_THRESHOLD) {
+            writeLine(`\u26A0 Tunnel probe failed (${consecutiveFailures}/${PROBE_FAIL_THRESHOLD}) \u2014 will retry`);
+            continue;
+          }
           writeLine("\u26A0 Tunnel unreachable \u2014 reconnecting\u2026");
+          consecutiveFailures = 0;
           try {
             if (tunnel && !tunnel.killed) tunnel.kill("SIGTERM");
           } catch {
@@ -1040,9 +1215,12 @@ function createRunnerCommand() {
             tunnel = next.proc;
             tunnelUrl = next.url;
             await registerRuntime(tunnelUrl);
+            respawnBackoffMs = 3e4;
             writeLine(`\u2705 Reconnected: ${tunnelUrl}`);
           } catch (error) {
-            writeError(`reconnect failed (${error instanceof Error ? error.message : String(error)}); retrying in 30s`);
+            writeError(`reconnect failed (${error instanceof Error ? error.message : String(error)}); retrying in ${Math.round(respawnBackoffMs / 1e3)}s`);
+            await new Promise((r) => setTimeout(r, respawnBackoffMs));
+            respawnBackoffMs = Math.min(respawnBackoffMs * 2, MAX_BACKOFF_MS);
           }
         }
       })();
@@ -1291,7 +1469,7 @@ async function stopRunnerProcesses() {
   }
   return stopped;
 }
-var upCommand = new Command7("up").description("Start the browser runner for all your agent instances").option("--headless", "Run browser in headless mode").option("--instance <id>", "Connect to a specific instance only").action(async (opts) => {
+var upCommand = new Command7("up").description("Start the browser runner for all your agent instances").option("--headless", "Run browser in headless mode").option("--instance <id>", "Connect to a specific instance only").option("--tunnel <mode>", "Tunnel mode: 'ws' (WebSocket relay, recommended), 'named' (production, stable), or 'quick' (default, trycloudflare.com)", "quick").action(async (opts) => {
   const session = requireSession();
   const state = {
     user: session.user.login,
@@ -1338,6 +1516,8 @@ var upCommand = new Command7("up").description("Start the browser runner for all
   const cliPath = process.argv[1];
   const args = [cliPath, "runner", "connect", ...instances.map((i) => i.id)];
   if (opts.headless) args.push("--headless");
+  if (opts.tunnel === "named") args.push("--tunnel", "named");
+  if (opts.tunnel === "ws") args.push("--tunnel", "ws");
   const child = spawn3(process.execPath, args, {
     stdio: ["ignore", "pipe", "pipe"],
     env: { ...process.env, PAGS_TOKEN: session.token }
@@ -1358,6 +1538,21 @@ var upCommand = new Command7("up").description("Start the browser runner for all
         printStatus(state);
         continue;
       }
+      if (trimmed.includes("Relay connected:")) {
+        state.tunnel = "online";
+        state.tunnelUrl = "WebSocket relay";
+        state.lastEvent = "Relay connected";
+        printStatus(state);
+        continue;
+      }
+      if (trimmed.includes("WebSocket relay (no tunnel)")) {
+        state.tunnel = "online";
+        state.tunnelUrl = "WebSocket relay";
+        state.registration = "registered";
+        state.lastEvent = "Connected via WebSocket relay";
+        printStatus(state);
+        continue;
+      }
       if (trimmed.includes("FAGS browser runtime listening")) {
         state.runner = "online";
         state.lastEvent = "Runner started";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",