@rubytech/create-realagent 1.0.614 → 1.0.616

package/payload/server/server.js

@@ -2898,7 +2898,7 @@ var serveStatic = (options = { root: "" }) => {
 // server/index.ts
 import { readFileSync as readFileSync26, existsSync as existsSync26, watchFile } from "fs";
 import { resolve as resolve27, join as join13, basename as basename6 } from "path";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 
 // app/lib/vnc-logger.ts
 import { appendFileSync, mkdirSync } from "fs";
@@ -4162,10 +4162,14 @@ function keyFilePath() {
 
 // app/lib/claude-agent.ts
 import Anthropic2 from "@anthropic-ai/sdk";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
 import { resolve as resolve6, join as join4 } from "path";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync2, unlinkSync, cpSync, rmSync } from "fs";
+import { platform as osPlatform } from "os";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync, cpSync, rmSync } from "fs";
+import { lookup as dnsLookup } from "dns/promises";
+import { createConnection as netConnect } from "net";
+import { StringDecoder } from "string_decoder";
 
 // ../lib/models/src/index.ts
 var OPUS_MODEL = "claude-opus-4-7";
@@ -4465,7 +4469,7 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
 import { spawn } from "child_process";
-import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5, openSync, readSync, closeSync, statSync as statSync2 } from "fs";
 import { resolve as resolve5 } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
 var driver = null;
@@ -5455,7 +5459,46 @@ Expertise: ${typeof profile.expertise === "string" ? profile.expertise : JSON.st
 var MAX_SESSION_TASKS = 20;
 var MAX_SESSION_REVIEW_ALERTS = 5;
 var MAX_SESSION_PROJECTS = 5;
-async function loadSessionContext(accountId) {
+var MAX_RECENT_TOOL_FAILURES = 3;
+var RECENT_FAILURES_TAIL_BYTES = 10 * 1024;
+function readRecentToolFailures(accountId, conversationId) {
+  try {
+    const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
+    const logDir = resolve5(platformRoot3, "..", "data/accounts", accountId, "logs");
+    const logPath2 = resolve5(logDir, `claude-agent-stream-${conversationId}.log`);
+    if (!existsSync5(logPath2)) {
+      console.error(`[review-tail-skip] path=${logPath2} reason=file-missing \u2014 first turn of conversation, subprocess not yet spawned, or log rotated`);
+      return [];
+    }
+    const st = statSync2(logPath2);
+    const size = st.size;
+    const readBytes = Math.min(size, RECENT_FAILURES_TAIL_BYTES);
+    const position = size - readBytes;
+    const fd = openSync(logPath2, "r");
+    try {
+      const buf = Buffer.alloc(readBytes);
+      readSync(fd, buf, 0, readBytes, position);
+      const text = buf.toString("utf-8");
+      const lines = text.split("\n");
+      const matches = [];
+      for (let i = lines.length - 1; i >= 0 && matches.length < MAX_RECENT_TOOL_FAILURES; i--) {
+        const line = lines[i];
+        if (line.includes("[tool-failure-diag]")) {
+          matches.push(line);
+        }
+      }
+      return matches.reverse();
+    } finally {
+      closeSync(fd);
+    }
+  } catch (err) {
+    console.error(
+      `[session-context] recent-tool-failures read failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return [];
+  }
+}
+async function loadSessionContext(accountId, conversationId) {
   const session = getSession();
   try {
     const digestResult = await session.run(
@@ -5625,9 +5668,21 @@ ${projectLines.join("\n")}`);
       sections.push(`## Active Review Alerts (${alertsResult.records.length})
 ${alertLines.join("\n")}`);
     }
+    let recentFailuresCount = 0;
+    if (conversationId) {
+      const failureLines = readRecentToolFailures(accountId, conversationId);
+      if (failureLines.length > 0) {
+        recentFailuresCount = failureLines.length;
+        const guidance = "These tool calls failed in the current conversation. Inspect the diagnostic fields before retrying the same tool against the same target \u2014 if you do retry, narrate explicitly why the diagnostic suggests a retry will now succeed. A second identical failure is evidence the path is broken, not evidence another attempt is warranted.";
+        sections.push(`## Recent Tool Failures (${failureLines.length})
+${guidance}
+
+${failureLines.map((l) => `- ${l.trim()}`).join("\n")}`);
+      }
+    }
     if (sections.length === 0) return null;
     console.error(
-      `[session-context] Loaded for ${accountId.slice(0, 8)}\u2026: digest=${digestResult.records.length > 0 ? "yes" : "no"}, tasks=${tasksResult.records.length}, projects=${projectsCount}, reviewAlerts=${alertsResult.records.length}, pendingActions=${pendingCount}`
+      `[session-context] Loaded for ${accountId.slice(0, 8)}\u2026: digest=${digestResult.records.length > 0 ? "yes" : "no"}, tasks=${tasksResult.records.length}, projects=${projectsCount}, reviewAlerts=${alertsResult.records.length}, pendingActions=${pendingCount}, recentFailures=${recentFailuresCount}`
     );
     return `<previous-context>
 ${sections.join("\n\n")}
@@ -5991,20 +6046,264 @@ var BROWSER_TOOL_PREFIXES = [
 function isBrowserTool(name) {
   return BROWSER_TOOL_PREFIXES.some((p) => name.startsWith(p));
 }
-function agentLogStream(name, accountDir) {
+var DIAG_HARD_CAP_MS = 5e3;
+var DIAG_DNS_TIMEOUT_MS = 2e3;
+var DIAG_TCP_TIMEOUT_MS = 3e3;
+var DIAG_HTTP_TIMEOUT_MS = 4e3;
+function quoteDiag(value) {
+  return JSON.stringify(value);
+}
+function extractUrl(toolName, input) {
+  if (input === null || typeof input !== "object") return void 0;
+  const obj = input;
+  if (toolName === "WebFetch" && typeof obj.url === "string") return obj.url;
+  if (isBrowserTool(toolName) && typeof obj.url === "string") return obj.url;
+  if (typeof obj.url === "string" && /^https?:\/\//.test(obj.url)) return obj.url;
+  return void 0;
+}
+var FULL_REDACT_ENV_VARS = /* @__PURE__ */ new Set(["HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY"]);
+function redactEnvField(name) {
+  const value = process.env[name];
+  if (!value) return `${name.toLowerCase()}=absent`;
+  if (FULL_REDACT_ENV_VARS.has(name)) {
+    return `${name.toLowerCase()}=present`;
+  }
+  const suffix = value.length > 40 ? value.slice(-40) : value;
+  return `${name.toLowerCase()}=present suffix=${quoteDiag(suffix)}`;
+}
+async function probeDns(host, family) {
+  const label = family === 4 ? "dns_a" : "dns_aaaa";
+  const start = Date.now();
+  let timer;
+  try {
+    const result = await Promise.race([
+      dnsLookup(host, { family, verbatim: true }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("timeout")), DIAG_DNS_TIMEOUT_MS);
+      })
+    ]);
+    if (timer) clearTimeout(timer);
+    const ms = Date.now() - start;
+    return `${label}=${result.address} ${label}_ms=${ms}`;
+  } catch (err) {
+    if (timer) clearTimeout(timer);
+    const ms = Date.now() - start;
+    const msg = err instanceof Error ? err.message : String(err);
+    return `${label}=err ${label}_err=${quoteDiag(msg.slice(0, 60))} ${label}_ms=${ms}`;
+  }
+}
+async function probeTcp(host, port2) {
+  const start = Date.now();
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    const sock = netConnect({ host, port: port2, family: 0 });
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      try {
+        sock.destroy();
+      } catch {
+      }
+      resolvePromise(result);
+    };
+    const timer = setTimeout(() => finish(`tcp=timeout tcp_ms=${Date.now() - start}`), DIAG_TCP_TIMEOUT_MS);
+    sock.once("connect", () => {
+      clearTimeout(timer);
+      finish(`tcp=ok tcp_ms=${Date.now() - start}`);
+    });
+    sock.once("error", (err) => {
+      clearTimeout(timer);
+      const msg = err instanceof Error ? err.message : String(err);
+      finish(`tcp=err tcp_err=${quoteDiag(msg.slice(0, 60))} tcp_ms=${Date.now() - start}`);
+    });
+  });
+}
+async function probeHttp(url2) {
+  const start = Date.now();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DIAG_HTTP_TIMEOUT_MS);
+  try {
+    const res = await fetch(url2, { method: "HEAD", redirect: "manual", signal: controller.signal });
+    clearTimeout(timer);
+    return `http_status=${res.status} http_ms=${Date.now() - start}`;
+  } catch (err) {
+    clearTimeout(timer);
+    const msg = err instanceof Error ? err.message : String(err);
+    return `http_status=err http_err=${quoteDiag(msg.slice(0, 60))} http_ms=${Date.now() - start}`;
+  }
+}
+async function runFailureDiagnostic(toolName, toolInput) {
+  const inputKeys = toolInput !== null && typeof toolInput === "object" ? Object.keys(toolInput).join(",") : "";
+  const envFields = [
+    redactEnvField("HTTPS_PROXY"),
+    redactEnvField("HTTP_PROXY"),
+    redactEnvField("NO_PROXY"),
+    redactEnvField("NODE_OPTIONS")
+  ].join(" ");
+  const url2 = extractUrl(toolName, toolInput);
+  if (!url2) {
+    return `diag_url=none input_keys=[${inputKeys}] ${envFields}`;
+  }
+  let host;
+  let port2;
+  try {
+    const parsed = new URL(url2);
+    host = parsed.hostname;
+    port2 = parsed.port ? Number(parsed.port) : parsed.protocol === "https:" ? 443 : 80;
+  } catch {
+    return `diag_url=unparseable input_keys=[${inputKeys}] ${envFields}`;
+  }
+  const probes = Promise.allSettled([
+    probeDns(host, 4),
+    probeDns(host, 6),
+    probeTcp(host, port2),
+    probeHttp(url2)
+  ]);
+  let capTimer;
+  const capped = await Promise.race([
+    probes,
+    new Promise((resolvePromise) => {
+      capTimer = setTimeout(() => resolvePromise("__diag_timeout__"), DIAG_HARD_CAP_MS);
+    })
+  ]);
+  if (capTimer) clearTimeout(capTimer);
+  if (capped === "__diag_timeout__") {
+    return `diag_host=${host} diag_port=${port2} diag_timeout=true input_keys=[${inputKeys}] ${envFields}`;
+  }
+  const fields = capped.map((r) => r.status === "fulfilled" ? r.value : `probe_err=${quoteDiag(String(r.reason).slice(0, 40))}`).join(" ");
+  return `diag_host=${host} diag_port=${port2} ${fields} input_keys=[${inputKeys}] ${envFields}`;
+}
+function agentLogStream(name, accountDir, conversationId) {
+  if (!conversationId) {
+    throw new Error(`agentLogStream: conversationId is required (name=${name}) \u2014 use preConversationLogStream for pre-session events`);
+  }
+  const logDir = resolve6(accountDir, "logs");
+  mkdirSync4(logDir, { recursive: true });
+  purgeOldLogs(logDir, `${name}-`);
+  return createWriteStream(resolve6(logDir, `${name}-${conversationId}.log`), { flags: "a" });
+}
+function preConversationLogStream(name, accountDir) {
   const logDir = resolve6(accountDir, "logs");
   mkdirSync4(logDir, { recursive: true });
   const date5 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  purgeOldLogs(logDir, `preconversation-${name}-`);
+  return createWriteStream(resolve6(logDir, `preconversation-${name}-${date5}.log`), { flags: "a" });
+}
+function purgeOldLogs(logDir, prefix) {
   const cutoff = Date.now() - LOG_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+  let entries;
   try {
-    for (const file2 of readdirSync2(logDir)) {
-      if (!file2.startsWith(`${name}-`)) continue;
-      const filePath = resolve6(logDir, file2);
-      if (statSync2(filePath).mtimeMs < cutoff) unlinkSync(filePath);
+    entries = readdirSync2(logDir);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[log-purge-err] readdir dir=${logDir} prefix=${prefix} reason=${msg}`);
+    return;
+  }
+  for (const file2 of entries) {
+    if (!file2.startsWith(prefix)) continue;
+    const filePath = resolve6(logDir, file2);
+    try {
+      if (statSync3(filePath).mtimeMs < cutoff) unlinkSync(filePath);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`[log-purge-err] file=${file2} reason=${msg}`);
     }
-  } catch {
   }
-  return createWriteStream(resolve6(logDir, `${name}-${date5}.log`), { flags: "a" });
+}
+function teeProcStderrToStreamLog(proc, streamLog) {
+  if (!proc.stderr) {
+    streamLog.write(`[${isoTs()}] [subproc-stderr-skip] reason=no-stderr
+`);
+    return;
+  }
+  const utf8 = new StringDecoder("utf8");
+  let buffer = "";
+  proc.stderr.on("data", (chunk) => {
+    const text = typeof chunk === "string" ? chunk : utf8.write(chunk);
+    buffer += text;
+    let idx;
+    while ((idx = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, idx);
+      buffer = buffer.slice(idx + 1);
+      if (line.length === 0) continue;
+      if (streamLog.destroyed || streamLog.writableEnded) continue;
+      streamLog.write(`[${isoTs()}] [subproc-stderr] ${line}
+`);
+    }
+  });
+  proc.stderr.on("end", () => {
+    const tail = (buffer + utf8.end()).trim();
+    if (tail.length > 0 && !streamLog.destroyed && !streamLog.writableEnded) {
+      streamLog.write(`[${isoTs()}] [subproc-stderr] ${tail}
+`);
+    }
+    buffer = "";
+  });
+}
+function sampleProcState(pid) {
+  try {
+    if (osPlatform() === "linux") {
+      const fdDir = `/proc/${pid}/fd`;
+      let openFds2 = 0;
+      try {
+        openFds2 = readdirSync2(fdDir).length;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return `proc_err=${JSON.stringify(msg.slice(0, 60))}`;
+      }
+      let established2 = 0;
+      let connecting2 = 0;
+      let sockets2 = 0;
+      for (const tcpFile of ["/proc/" + pid + "/net/tcp", "/proc/" + pid + "/net/tcp6"]) {
+        try {
+          const raw2 = readFileSync7(tcpFile, "utf-8");
+          const lines2 = raw2.split("\n");
+          for (let i = 1; i < lines2.length; i++) {
+            const line = lines2[i].trim();
+            if (!line) continue;
+            const parts = line.split(/\s+/);
+            const state = parts[3];
+            sockets2 += 1;
+            if (state === "01") established2 += 1;
+            else if (state === "02" || state === "03") connecting2 += 1;
+          }
+        } catch {
+        }
+      }
+      let rssMb = 0;
+      try {
+        const statm = readFileSync7(`/proc/${pid}/statm`, "utf-8").trim().split(/\s+/);
+        const rssPages = parseInt(statm[1] ?? "0", 10);
+        if (Number.isFinite(rssPages)) rssMb = Math.round(rssPages * 4096 / (1024 * 1024));
+      } catch {
+      }
+      return `open_fds=${openFds2} socket_count=${sockets2} tcp_established=${established2} tcp_connecting=${connecting2} rss_mb=${rssMb}`;
+    }
+    const result = spawnSync2("lsof", ["-p", String(pid), "-nP"], { timeout: 500, encoding: "utf-8" });
+    if (result.error || result.status !== 0) {
+      const reason = result.error instanceof Error ? result.error.message : `exit=${result.status}`;
+      return `proc_err=${JSON.stringify(reason.slice(0, 60))}`;
+    }
+    const lines = result.stdout.split("\n");
+    let openFds = 0;
+    let sockets = 0;
+    let established = 0;
+    let connecting = 0;
+    for (let i = 1; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      openFds += 1;
+      if (line.includes("IPv4") || line.includes("IPv6") || line.includes("TCP")) {
+        sockets += 1;
+        if (/ESTABLISHED/.test(line)) established += 1;
+        else if (/SYN_SENT|SYN_RCVD/.test(line)) connecting += 1;
+      }
+    }
+    return `open_fds=${openFds} socket_count=${sockets} tcp_established=${established} tcp_connecting=${connecting} rss_mb=unknown`;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return `proc_err=${JSON.stringify(msg.slice(0, 60))}`;
+  }
 }
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
 var ACCOUNTS_DIR = resolve6(PLATFORM_ROOT4, "..", "data/accounts");
@@ -6182,8 +6481,8 @@ function resolveAgentConfig(accountDir, agentName) {
   const hasKnowledge = existsSync6(knowledgePath);
   const hasSummary = existsSync6(summaryPath);
   if (hasKnowledge && hasSummary) {
-    const knowledgeMtime = statSync2(knowledgePath).mtimeMs;
-    const summaryMtime = statSync2(summaryPath).mtimeMs;
+    const knowledgeMtime = statSync3(knowledgePath).mtimeMs;
+    const summaryMtime = statSync3(summaryPath).mtimeMs;
     if (summaryMtime >= knowledgeMtime) {
       knowledge = readFileSync7(summaryPath, "utf-8");
     } else {
@@ -6862,7 +7161,7 @@ ${specialist}: ${plugins.join(", ")}`);
           for (const entry of readdirSync2(current)) {
             const full = resolve6(current, entry);
             try {
-              const stat4 = statSync2(full);
+              const stat4 = statSync3(full);
               if (stat4.isDirectory()) {
                 walk(full, `${rel}${entry}/`);
               } else if (entry.endsWith(".md")) {
@@ -6993,6 +7292,15 @@ function resolveUserAccounts(userId) {
 var sessionStore = /* @__PURE__ */ new Map();
 setSessionStoreRef(sessionStore);
 function registerSession(sessionKey, agentType, accountId, agentName, userId, userName) {
+  const existing = sessionStore.get(sessionKey);
+  if (existing) {
+    existing.agentType = agentType;
+    existing.accountId = accountId;
+    existing.agentName = agentName ?? existing.agentName;
+    existing.userId = userId ?? existing.userId;
+    existing.userName = userName ?? existing.userName;
+    return;
+  }
   sessionStore.set(sessionKey, { createdAt: Date.now(), agentType, accountId, agentName, userId, userName });
 }
 function registerResumedSession(sessionKey, accountId, agentName, conversationId, messages) {
@@ -7057,6 +7365,9 @@ function storeAgentSessionId(sessionKey, agentSessionId) {
   const session = sessionStore.get(sessionKey);
   if (session) {
     session.agentSessionId = agentSessionId;
+    console.error(`[session-store] storeAgentSessionId sessionKey=${sessionKey.slice(0, 12)}\u2026 sessionId=${agentSessionId.slice(0, 8)}\u2026`);
+  } else {
+    console.error(`[session-store] storeAgentSessionId SKIPPED \u2014 no session entry sessionKey=${sessionKey.slice(0, 12)}\u2026 sessionId=${agentSessionId.slice(0, 8)}\u2026`);
   }
 }
 function getAgentSessionId(sessionKey) {
@@ -7186,43 +7497,48 @@ function consumeStalledSubagents(sessionKey) {
   delete session.stalledSubagents;
   return stalls && stalls.length > 0 ? stalls : void 0;
 }
-function getMcpServers(accountId, userId, enabledPlugins) {
+function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
+  if (!conversationId) {
+    throw new Error(`getMcpServers: conversationId is required (accountId=${accountId.slice(0, 8)})`);
+  }
   const LOG_DIR2 = resolve6(ACCOUNTS_DIR, accountId, "logs");
+  const STREAM_LOG_PATH = resolve6(LOG_DIR2, `claude-agent-stream-${conversationId}.log`);
+  const baseEnv = { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, STREAM_LOG_PATH };
   const servers = {
     "memory": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, ...userId ? { USER_ID: userId } : {} }
+      env: { ...baseEnv, ...userId ? { USER_ID: userId } : {} }
     },
     "contacts": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/contacts/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     "whatsapp": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/whatsapp/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, PLATFORM_PORT: process.env.PORT ?? "19200" }
+      env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
     },
     "admin": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/admin/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, PLATFORM_PORT: process.env.PORT ?? "19200", ...userId ? { USER_ID: userId } : {} }
+      env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200", ...userId ? { USER_ID: userId } : {} }
     },
     "scheduling": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/scheduling/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     "tasks": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/tasks/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     "email": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/email/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     // Playwright MCP server — browser automation for browser-specialist.
     // Key matches Claude Code's plugin naming: plugin_{plugin}_{server} so tools
@@ -7241,7 +7557,7 @@ function getMcpServers(accountId, userId, enabledPlugins) {
     servers["telegram"] = {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/telegram/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, TELEGRAM_BOT_TOKEN: tgBotToken }
+      env: { ...baseEnv, TELEGRAM_BOT_TOKEN: tgBotToken }
     };
   } else {
     console.error("[plugins] telegram MCP: skipped (no bot token in account.json telegram config)");
@@ -7249,7 +7565,7 @@ function getMcpServers(accountId, userId, enabledPlugins) {
   servers["cloudflare"] = {
     command: "node",
     args: [resolve6(PLATFORM_ROOT4, "plugins/cloudflare/mcp/dist/index.js")],
-    env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, PLATFORM_PORT: process.env.PORT ?? "19200" }
+    env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
   };
   if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
     const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
@@ -7280,7 +7596,7 @@ function getMcpServers(accountId, userId, enabledPlugins) {
       servers[dir] = {
         command: "node",
         args: [mcpEntry],
-        env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+        env: { ...baseEnv }
       };
       console.log(`[plugins] optional MCP server started: ${dir}`);
     }
@@ -7355,13 +7671,13 @@ var ADMIN_CORE_TOOLS = [
   "mcp__admin__action-reject",
   "mcp__admin__action-edit",
   "mcp__cloudflare__cloudflare-setup",
-  "mcp__cloudflare__cf-set-token",
   "mcp__cloudflare__cf-add-zone",
   "mcp__cloudflare__cf-zone-status",
+  "mcp__cloudflare__cf-verify",
+  "mcp__cloudflare__cf-rebuild",
   "mcp__cloudflare__tunnel-status",
   "mcp__cloudflare__tunnel-install",
   "mcp__cloudflare__tunnel-login",
-  "mcp__cloudflare__tunnel-create",
   "mcp__cloudflare__tunnel-enable",
   "mcp__cloudflare__tunnel-disable",
   "mcp__cloudflare__tunnel-add-hostname",
@@ -7932,10 +8248,10 @@ var COMPACTION_PROMPT = `You are about to reach your context limit. Call session
 
 Then respond with only: [COMPACTED]`;
 var COMPACTION_TIMEOUT_MS = 45e3;
-async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSessionId, adminModel, enabledPlugins) {
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, void 0, enabledPlugins) });
+async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSessionId, adminModel, conversationId, enabledPlugins) {
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, conversationId, void 0, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir, conversationId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
     "--print",
@@ -7964,15 +8280,23 @@ async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSes
   const proc = spawn2("claude", args, {
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, PLATFORM_ROOT: PLATFORM_ROOT4, ACCOUNT_DIR: accountDir }
+    env: {
+      ...process.env,
+      PLATFORM_ROOT: PLATFORM_ROOT4,
+      ACCOUNT_DIR: accountDir,
+      // Task 532: network traces on the compaction subprocess too — its tool
+      // calls are part of the same conversation's record.
+      NODE_DEBUG: "http,http2,net,tls,undici,dns"
+    }
   });
-  const stderrLog = agentLogStream("claude-agent-compaction-stderr", accountDir);
+  const stderrLog = agentLogStream("claude-agent-compaction-stderr", accountDir, conversationId);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
-  const streamLog = agentLogStream("claude-agent-compaction-stream", accountDir);
+  const streamLog = agentLogStream("claude-agent-compaction-stream", accountDir, conversationId);
   streamLog.on("error", () => {
   });
+  teeProcStderrToStreamLog(proc, streamLog);
   streamLog.write(`[${isoTs()}] [compaction-start] resumeSessionId=${resumeSessionId}
 `);
   proc.on("error", (err) => {
@@ -8033,14 +8357,19 @@ async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSes
   streamLog.end();
   return { ok: capturedSummary !== void 0 && !timedOut, summary: capturedSummary };
 }
-function clearAgentSessionId(sessionKey) {
+function clearAgentSessionId(sessionKey, reason) {
   const session = sessionStore.get(sessionKey);
   if (session) {
     session.agentSessionId = void 0;
+    console.error(`[session-store] clearAgentSessionId sessionKey=${sessionKey.slice(0, 12)}\u2026 reason=${reason}`);
+  } else {
+    console.error(`[session-store] clearAgentSessionId SKIPPED \u2014 no session entry sessionKey=${sessionKey.slice(0, 12)}\u2026 reason=${reason}`);
   }
 }
-async function* parseClaudeStream(proc, streamLog, adminModel) {
+async function* parseClaudeStream(proc, streamLog, adminModel, conversationId) {
   const toolIdToName = /* @__PURE__ */ new Map();
+  const toolIdToInput = /* @__PURE__ */ new Map();
+  const convIdTag = conversationId ? ` conversationId=${conversationId.slice(0, 8)}` : "";
   let emittedDone = false;
   let buffer = "";
   const modelCtxWindow = contextWindow(adminModel);
@@ -8075,6 +8404,83 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
       apiWaitTimer = void 0;
     }
   }
+  const inflightTools = /* @__PURE__ */ new Map();
+  const TOOL_WAIT_TICK_MS = 5e3;
+  const TOOL_WAIT_DIAG_THRESHOLDS_SEC = [15, 30, 45, 60];
+  const TOOL_WAIT_PROC_SEC = 30;
+  const procPid = proc.pid;
+  const toolWaitTimer = setInterval(() => {
+    if (streamLog.destroyed) return;
+    const now = Date.now();
+    for (const [toolUseId, info] of inflightTools) {
+      const elapsedSec = Math.round((now - info.startedAt) / 1e3);
+      streamLog.write(`[${isoTs()}] [tool-wait]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s
+`);
+      let nextThreshold = 0;
+      for (const t of TOOL_WAIT_DIAG_THRESHOLDS_SEC) {
+        if (elapsedSec >= t && t > info.lastProbeThresholdSec) nextThreshold = t;
+      }
+      if (nextThreshold > 0) {
+        if (info.probeInFlight) {
+          streamLog.write(`[${isoTs()}] [tool-wait-diag-skip]${convIdTag} tool_use_id=${toolUseId} reason=probe-in-flight threshold=${nextThreshold}s
+`);
+        } else {
+          info.lastProbeThresholdSec = nextThreshold;
+          info.probeInFlight = true;
+          const toolInput = toolIdToInput.get(toolUseId);
+          runFailureDiagnostic(info.name, toolInput).then((diag) => {
+            if (!streamLog.destroyed && !streamLog.writableEnded) {
+              streamLog.write(`[${isoTs()}] [tool-wait-diag]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s ${diag}
+`);
+            }
+          }).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (!streamLog.destroyed && !streamLog.writableEnded) {
+              streamLog.write(`[${isoTs()}] [tool-wait-diag]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s diag_err=${JSON.stringify(msg.slice(0, 80))}
+`);
+            }
+          }).finally(() => {
+            const current = inflightTools.get(toolUseId);
+            if (current) current.probeInFlight = false;
+          });
+        }
+      }
+      if (!info.procSampleEmitted && elapsedSec >= TOOL_WAIT_PROC_SEC) {
+        info.procSampleEmitted = true;
+        if (!procPid) {
+          streamLog.write(`[${isoTs()}] [tool-wait-proc-skip]${convIdTag} tool_use_id=${toolUseId} reason=no-pid
+`);
+        } else {
+          const procLine = sampleProcState(procPid);
+          streamLog.write(`[${isoTs()}] [tool-wait-proc]${convIdTag} name=${info.name} pid=${procPid} tool_use_id=${toolUseId} elapsed=${elapsedSec}s ${procLine}
+`);
+        }
+      }
+    }
+  }, TOOL_WAIT_TICK_MS);
+  function trackToolUse(toolUseId, toolName) {
+    if (!toolUseId) {
+      streamLog.write(`[${isoTs()}] [tool-use-no-id]${convIdTag} name=${toolName} reason=missing-tool-use-id-cannot-track-wait
+`);
+      return;
+    }
+    inflightTools.set(toolUseId, {
+      name: toolName,
+      startedAt: Date.now(),
+      lastProbeThresholdSec: 0,
+      probeInFlight: false,
+      procSampleEmitted: false
+    });
+  }
+  function untrackToolUse(toolUseId, reason) {
+    if (!toolUseId) return;
+    if (!inflightTools.delete(toolUseId)) {
+      if (reason === "result") {
+        streamLog.write(`[${isoTs()}] [tool-wait-late]${convIdTag} tool_use_id=${toolUseId} reason=result-without-matching-tool-use
+`);
+      }
+    }
+  }
   const readLines = async function* () {
     for await (const chunk of proc.stdout) {
       buffer += chunk.toString();
@@ -8236,20 +8642,24 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
                   yield { type: "session_resume", conversationId: resumeConversationId };
                 }
               } else {
-                if (block.id) toolIdToName.set(block.id, block.name);
+                if (block.id) {
+                  toolIdToName.set(block.id, block.name);
+                  toolIdToInput.set(block.id, block.input ?? {});
+                }
                 const inputPreview = JSON.stringify(block.input ?? {}).slice(0, 200);
                 if (block.name === "Agent") {
                   const subType = block.input?.subagent_type ?? "general-purpose";
                   const desc = block.input?.description ?? "";
-                  streamLog.write(`[${isoTs()}] [agent-dispatch] subagent_type=${JSON.stringify(subType)} description=${JSON.stringify(desc)} input=${inputPreview}
+                  streamLog.write(`[${isoTs()}] [agent-dispatch]${convIdTag} subagent_type=${JSON.stringify(subType)} description=${JSON.stringify(desc)} input=${inputPreview}
 `);
                 } else {
-                  streamLog.write(`[${isoTs()}] [tool-use] name=${block.name} input=${inputPreview}
+                  streamLog.write(`[${isoTs()}] [tool-use]${convIdTag} name=${block.name} input=${inputPreview}
 `);
                   if (isBrowserTool(block.name)) {
                     vncLog("mcp-tool", { name: block.name, input_preview: inputPreview });
                   }
                 }
+                trackToolUse(block.id, block.name);
                 yield { type: "tool_use", name: block.name, input: block.input ?? {}, toolUseId: block.id };
               }
             }
@@ -8276,10 +8686,10 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
               }
               const outputPreview = output.slice(0, 300);
               if (name === "Agent") {
-                streamLog.write(`[${isoTs()}] [agent-return] error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
+                streamLog.write(`[${isoTs()}] [agent-return]${convIdTag} error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
 `);
               } else {
-                streamLog.write(`[${isoTs()}] [tool-result] name=${name} error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
+                streamLog.write(`[${isoTs()}] [tool-result]${convIdTag} name=${name} error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
 `);
                 if (isBrowserTool(name)) {
                   vncLog("mcp-tool-result", {
@@ -8288,7 +8698,28 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
                     output_preview: outputPreview
                   });
                 }
+                if (block.is_error && block.tool_use_id) {
+                  const toolInput = toolIdToInput.get(block.tool_use_id);
+                  try {
+                    const diag = await runFailureDiagnostic(name, toolInput);
+                    if (!streamLog.destroyed) {
+                      streamLog.write(`[${isoTs()}] [tool-failure-diag]${convIdTag} name=${name} ${diag}
+`);
+                    }
+                  } catch (err) {
+                    if (!streamLog.destroyed) {
+                      const msg2 = err instanceof Error ? err.message : String(err);
+                      streamLog.write(`[${isoTs()}] [tool-failure-diag]${convIdTag} name=${name} diag_err=${JSON.stringify(msg2.slice(0, 80))}
+`);
+                    }
+                  }
+                } else if (block.is_error && !block.tool_use_id) {
+                  streamLog.write(`[${isoTs()}] [tool-failure-diag-skip]${convIdTag} name=${name} reason=no-tool-use-id-cannot-lookup-input
+`);
+                }
               }
+              if (block.tool_use_id) toolIdToInput.delete(block.tool_use_id);
+              untrackToolUse(block.tool_use_id, "result");
               const renderDirectiveRe = /^__RENDER__(\{.+\})$/gm;
               let renderMatch;
               while ((renderMatch = renderDirectiveRe.exec(output)) !== null) {
@@ -8420,6 +8851,19 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
     }
   } finally {
     endApiWait();
+    clearInterval(toolWaitTimer);
+    for (const [toolUseId, info] of inflightTools) {
+      const elapsedSec = Math.round((Date.now() - info.startedAt) / 1e3);
+      if (!streamLog.destroyed && !streamLog.writableEnded) {
+        streamLog.write(`[${isoTs()}] [tool-wait-late]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s reason=stream-ended-without-tool-result
+`);
+      }
+    }
+    inflightTools.clear();
+    if (buffer.length > 0 && !streamLog.destroyed && !streamLog.writableEnded) {
+      streamLog.write(`[${isoTs()}] [stream-buffer-flush]${convIdTag} bytes=${buffer.length} reason=process-exit preview=${JSON.stringify(buffer.slice(0, 120))}
+`);
+    }
   }
   if (!emittedDone) {
   }
@@ -8679,17 +9123,21 @@ function buildAttachmentMetaText(attachments) {
 async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, adminModel, sessionKey, maxTurns = 20, attachments = [], retryCount = 0, enabledPlugins, clientTimestamp) {
   const userTimestamp = clientTimestamp ?? (/* @__PURE__ */ new Date()).toISOString();
   const resumeSessionId = sessionKey ? getAgentSessionId(sessionKey) : void 0;
+  const spawnConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
+  if (!spawnConvId) {
+    throw new Error(`invokeAdminAgent: conversationId missing for sessionKey=${sessionKey?.slice(0, 8) ?? "none"} \u2014 ensureConversation must run before invoking the agent`);
+  }
   const cdpOk = await ensureCdp();
   if (!cdpOk) {
-    const cdpLog = agentLogStream("claude-agent-stream", accountDir);
+    const cdpLog = agentLogStream("claude-agent-stream", accountDir, spawnConvId);
     cdpLog.write(`[${isoTs()}] [warn] ensureCdp failed \u2014 browser-specialist degraded
 `);
     cdpLog.end();
   }
   const ccUserId = sessionKey ? getUserIdForSession(sessionKey) : void 0;
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, ccUserId, enabledPlugins) });
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, spawnConvId, ccUserId, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-stream", accountDir).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-stream", accountDir, spawnConvId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
     "--print",
@@ -8719,15 +9167,24 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
   const proc = spawn2("claude", args, {
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, PLATFORM_ROOT: PLATFORM_ROOT4, ACCOUNT_DIR: accountDir }
+    env: {
+      ...process.env,
+      PLATFORM_ROOT: PLATFORM_ROOT4,
+      ACCOUNT_DIR: accountDir,
+      // Task 532: tee subprocess network activity into the per-conversation
+      // stream log via the existing stderr pipe. Closes the Claude Code
+      // "what was the tool actually doing?" black box during tool waits.
+      NODE_DEBUG: "http,http2,net,tls,undici,dns"
+    }
   });
-  const stderrLog = agentLogStream("claude-agent-stderr", accountDir);
+  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, spawnConvId);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
-  const streamLog = agentLogStream("claude-agent-stream", accountDir);
+  const streamLog = agentLogStream("claude-agent-stream", accountDir, spawnConvId);
   streamLog.on("error", () => {
   });
+  teeProcStderrToStreamLog(proc, streamLog);
   if (sessionKey) {
     const prev = activeProcesses.get(sessionKey);
     if (prev) {
@@ -8736,8 +9193,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     }
     activeProcesses.set(sessionKey, { pid: proc.pid, spawnedAt: Date.now() });
   }
-  const spawnConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
-  streamLog.write(`[${isoTs()}] [spawn] pid=${proc.pid} resume=${resumeSessionId ?? "none"} sessionKey=${sessionKey ?? "none"} conversationId=${spawnConvId ?? "none"} pluginDir=${specialistsDir}
+  streamLog.write(`[${isoTs()}] [spawn] pid=${proc.pid} resume=${resumeSessionId ?? "none"} sessionKey=${sessionKey ?? "none"} conversationId=${spawnConvId} pluginDir=${specialistsDir}
 `);
   streamLog.write(`[${isoTs()}] [stdin] len=${fullMessage.length} preview=${JSON.stringify(fullMessage.slice(0, 80))}
 `);
@@ -8758,7 +9214,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
   const toolCalls = [];
   const pendingToolCalls = /* @__PURE__ */ new Map();
   let capturedTokens;
-  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel), streamLog)) {
+  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel, spawnConvId), streamLog)) {
     if (event.type === "session_init") {
       currentAgentSessionId = event.sessionId;
       if (sessionKey) storeAgentSessionId(sessionKey, event.sessionId);
@@ -8810,7 +9266,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     if (event.type === "usage" && sessionKey && currentAgentSessionId) {
       const peakReqPct = event.peak_request_pct ?? 0;
       if (peakReqPct >= COMPACTION_THRESHOLD) {
-        const compactionIter = runCompactionTurn(accountDir, accountId, systemPrompt, currentAgentSessionId, adminModel, enabledPlugins);
+        const compactionIter = runCompactionTurn(accountDir, accountId, systemPrompt, currentAgentSessionId, adminModel, spawnConvId, enabledPlugins);
         let step = await compactionIter.next();
         while (!step.done) {
           yield { type: "status", message: step.value };
@@ -8826,7 +9282,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
             console.error(`[profile-reflection] Unhandled error: ${err instanceof Error ? err.message : String(err)}`);
           });
         }
-        clearAgentSessionId(sessionKey);
+        clearAgentSessionId(sessionKey, "compaction-complete");
         const convId = sessionStore.get(sessionKey)?.conversationId;
         if (convId) {
           yield { type: "status", message: "Recovering context..." };
@@ -8890,7 +9346,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     } else if (event.type === "subagent_stalled") {
       if (sessionKey) {
         storeStalledSubagent(sessionKey, { name: event.name, task: event.task, prompt: event.prompt, elapsed_ms: event.elapsed_ms, tool_uses: event.tool_uses, total_tokens: event.total_tokens, last_tool_name: event.last_tool_name });
-        clearAgentSessionId(sessionKey);
+        clearAgentSessionId(sessionKey, "subagent-stalled");
       }
       const taskPreview = (event.task || "").length > 120 ? event.task.slice(0, 120) + "\u2026" : event.task || "";
       streamLog.write(`[${isoTs()}] [stall-recovery] name=${event.name} task=${JSON.stringify(taskPreview)} \u2014 informing user and closing stream
@@ -8905,7 +9361,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
       streamLog.write(`[${isoTs()}] [main-stream-stall-recovery] elapsed=${elapsedSec}s last_event=${event.last_event_type} \u2014 killing process and closing stream
 `);
       proc.kill("SIGTERM");
-      if (sessionKey) clearAgentSessionId(sessionKey);
+      if (sessionKey) clearAgentSessionId(sessionKey, "main-stream-stalled");
       yield { type: "text", content: `The response stalled after ${elapsedSec} seconds of silence. Tap Retry to try again.` };
       yield { type: "component", name: "action-buttons", data: { buttons: [{ label: "Retry", value: "Please retry my last request." }] } };
       gotDone = true;
@@ -8915,7 +9371,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
       if (event.subtype === "error_max_turns" && event.stop_reason === "tool_use") {
         streamLog.write(`[${isoTs()}] [max-turns-interrupted] subtype=${event.subtype} stop_reason=${event.stop_reason} \u2014 entering recovery
 `);
-        if (sessionKey) clearAgentSessionId(sessionKey);
+        if (sessionKey) clearAgentSessionId(sessionKey, "max-turns-interrupted");
       } else {
         gotDone = true;
         if (!sessionWasReset) {
@@ -8951,7 +9407,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     yield event;
   }
   if (!gotDone) {
-    if (sessionKey) clearAgentSessionId(sessionKey);
+    if (sessionKey) clearAgentSessionId(sessionKey, "context-overflow-recovery");
     const hasWork = responseText.length > 0 || toolCalls.length > 0;
     if (hasWork && retryCount === 0 && sessionKey) {
       streamLog.write(`[${isoTs()}] [context-overflow-recovery] detected sessionKey=${sessionKey.slice(0, 8)}\u2026 responseTextLen=${responseText.length} toolCallCount=${toolCalls.length}
@@ -8981,6 +9437,10 @@ ${summary}`;
 }
 async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accountId, adminModel, sessionKey, maxTurns = 20, attachments = [], retryCount = 0, enabledPlugins, clientTimestamp) {
   const userTimestamp = clientTimestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+  const managedConvId = getConversationIdForSession(sessionKey);
+  if (!managedConvId) {
+    throw new Error(`invokeManagedAdminAgent: conversationId missing for sessionKey=${sessionKey.slice(0, 8)} \u2014 ensureConversation must run first`);
+  }
   const pendingTrimmed = consumePendingTrimmedMessages(sessionKey);
   if (pendingTrimmed && pendingTrimmed.length > 0) {
     const ok = await compactTrimmedMessages(accountId, pendingTrimmed);
@@ -8988,7 +9448,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
       storePendingTrimmedMessages(sessionKey, pendingTrimmed);
     }
   }
-  const streamLog = agentLogStream("claude-agent-stream", accountDir);
+  const streamLog = agentLogStream("claude-agent-stream", accountDir, managedConvId);
   streamLog.on("error", () => {
   });
   const systemPromptTokens = estimateTokens(systemPrompt);
@@ -9019,7 +9479,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   if (!cdpOk) streamLog.write(`[${isoTs()}] [warn] ensureCdp failed \u2014 browser-specialist degraded
 `);
   const managedUserId = getUserIdForSession(sessionKey);
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedUserId, enabledPlugins) });
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedConvId, managedUserId, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
   if (!existsSync6(specialistsDir)) streamLog.write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
@@ -9049,12 +9509,20 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   const proc = spawn2("claude", args, {
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, PLATFORM_ROOT: PLATFORM_ROOT4, ACCOUNT_DIR: accountDir }
+    env: {
+      ...process.env,
+      PLATFORM_ROOT: PLATFORM_ROOT4,
+      ACCOUNT_DIR: accountDir,
+      // Task 532: tee subprocess network traces into the per-conversation
+      // stream log via the stderr pipe + dual-consume listener.
+      NODE_DEBUG: "http,http2,net,tls,undici,dns"
+    }
   });
-  const stderrLog = agentLogStream("claude-agent-stderr", accountDir);
+  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, managedConvId);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
+  teeProcStderrToStreamLog(proc, streamLog);
   if (sessionKey) {
     const prev = activeProcesses.get(sessionKey);
     if (prev) {
@@ -9063,14 +9531,13 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
     }
     activeProcesses.set(sessionKey, { pid: proc.pid, spawnedAt: Date.now() });
   }
-  const managedConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
-  streamLog.write(`[${isoTs()}] [managed-spawn] pid=${proc.pid} sessionKey=${sessionKey} conversationId=${managedConvId ?? "none"} historyMessages=${history.length} pluginDir=${specialistsDir}
+  streamLog.write(`[${isoTs()}] [managed-spawn] pid=${proc.pid} sessionKey=${sessionKey} conversationId=${managedConvId} historyMessages=${history.length} pluginDir=${specialistsDir}
 `);
   streamLog.write(`[${isoTs()}] [stdin] len=${fullMessage.length} preview=${JSON.stringify(fullMessage.slice(0, 80))}
 `);
   proc.on("exit", (code, signal) => {
-    console.log(`[process-exit] pid=${proc.pid} code=${code} signal=${signal} sessionKey=${sessionKey ?? "none"} conversationId=${managedConvId ?? "none"}`);
-    if (!streamLog.destroyed && !streamLog.writableEnded) streamLog.write(`[${isoTs()}] [process-exit] pid=${proc.pid} code=${code} signal=${signal} conversationId=${managedConvId ?? "none"}
+    console.log(`[process-exit] pid=${proc.pid} code=${code} signal=${signal} sessionKey=${sessionKey ?? "none"} conversationId=${managedConvId}`);
+    if (!streamLog.destroyed && !streamLog.writableEnded) streamLog.write(`[${isoTs()}] [process-exit] pid=${proc.pid} code=${code} signal=${signal} conversationId=${managedConvId}
 `);
     if (sessionKey) activeProcesses.delete(sessionKey);
   });
@@ -9086,7 +9553,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   const pendingToolCalls = /* @__PURE__ */ new Map();
   const renderedComponents = [];
   let capturedTokens;
-  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel), streamLog)) {
+  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel, managedConvId), streamLog)) {
     if (event.type === "text") {
       responseText += event.content;
     } else if (event.type === "usage") {
@@ -9291,7 +9758,11 @@ async function* invokePublicAgent(message, systemPrompt, accountId, accountDir,
     yield { type: "done" };
     return;
   }
-  const streamLog = agentLogStream("public-agent-stream", accountDir);
+  const publicConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
+  if (!publicConvId) {
+    throw new Error(`invokePublicAgent: conversationId missing for sessionKey=${sessionKey?.slice(0, 8) ?? "none"} \u2014 ensureConversation must run first`);
+  }
+  const streamLog = agentLogStream("public-agent-stream", accountDir, publicConvId);
   streamLog.write(`[${isoTs()}] [public-user-message] ${JSON.stringify(message)}
 `);
   if (sessionKey) {
@@ -9564,6 +10035,8 @@ async function* compactSession(sessionKey) {
   }
   const currentSessionId = getAgentSessionId(sessionKey);
   if (!currentSessionId) return { ok: false, reason: "no-session" };
+  const compactionConvId = getConversationIdForSession(sessionKey);
+  if (!compactionConvId) return { ok: false, reason: "no-conversation" };
   const identity = readIdentity(account.accountDir, "admin");
   const defaultSystemPrompt = "You are an admin agent. Full access. Professional, concise. British English. Be proactive \u2014 tell the user what needs doing and do it.";
   const baseSystemPrompt = identity ?? defaultSystemPrompt;
@@ -9571,7 +10044,7 @@ async function* compactSession(sessionKey) {
   const systemPrompt = outputStyle === "explanatory" ? `${baseSystemPrompt}
 
 ${EXPLANATORY_STYLE_INSTRUCTIONS}` : baseSystemPrompt;
-  const compactionIter = runCompactionTurn(account.accountDir, account.accountId, systemPrompt, currentSessionId, account.config.adminModel, account.config.enabledPlugins);
+  const compactionIter = runCompactionTurn(account.accountDir, account.accountId, systemPrompt, currentSessionId, account.config.adminModel, compactionConvId, account.config.enabledPlugins);
   let step = await compactionIter.next();
   while (!step.done) {
     yield step.value;
@@ -9588,7 +10061,7 @@ ${EXPLANATORY_STYLE_INSTRUCTIONS}` : baseSystemPrompt;
       console.error(`[profile-reflection] Unhandled error: ${err instanceof Error ? err.message : String(err)}`);
     });
   }
-  clearAgentSessionId(sessionKey);
+  clearAgentSessionId(sessionKey, "session-compact-complete");
   return { ok: step.value.ok };
 }
 async function* invokeAgent(config2, message, sessionKey, attachments = [], userTimestamp, gatewayResult) {
@@ -9658,8 +10131,9 @@ $ACCOUNT_DIR is ${account.accountDir}
 ${profileSummary}`;
       }
     }
+    const invokeConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
     const [sessionContext, onboardingStep] = await Promise.all([
-      loadSessionContext(accountId),
+      loadSessionContext(accountId, invokeConvId),
       loadOnboardingStep(accountId)
     ]);
     if (sessionContext) {
@@ -9874,7 +10348,7 @@ ${block}`;
 import { basename as basename2 } from "path";
 
 // app/lib/review-detector/rules.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, statSync as statSync3, mkdirSync as mkdirSync5, renameSync } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, statSync as statSync4, mkdirSync as mkdirSync5, renameSync } from "fs";
 import { resolve as resolve7, dirname as dirname2 } from "path";
 var DEFAULT_SCAN_INTERVAL_MS = 5e3;
 var RATE_LIMIT_PATTERN = "rate[- ]?limit(?:ed| reached| hit)|(?:HTTP|status)[^a-z]{0,3}429|too many requests";
@@ -9898,6 +10372,7 @@ var VALID_SOURCES = /* @__PURE__ */ new Set([
   "mcp",
   "config-dir"
 ]);
+var VALID_SCOPES = /* @__PURE__ */ new Set(["global", "session"]);
 function defaultRules() {
   return [
     {
@@ -9972,6 +10447,52 @@ function defaultRules() {
       thresholdCount: 0,
       thresholdWindowMinutes: 0,
       suggestedAction: "An external-facing tool executed with auto-executed approval state. Check account.json approvalPolicy \u2014 if this tool should require review, the gating hook may have been bypassed or the policy was changed."
+    },
+    {
+      // Task 530: catches the bridgeai-style class where a single conversation
+      // sees the same tool error repeatedly and the agent silently falls back.
+      // Session-scoped so cross-conversation coincidence doesn't trigger it.
+      id: "tool-result-recurring-errors",
+      name: "Tool result errors recurring in a conversation",
+      type: "repeated-error",
+      logSource: "system",
+      pattern: "\\[tool-result\\].*error=true",
+      thresholdCount: 2,
+      thresholdWindowMinutes: 5,
+      scope: "session",
+      suggestedAction: 'The same conversation has logged multiple tool failures. Use the admin `logs-read` MCP tool with `type: "system"` (or the `logs-read.sh` script with the conversationId) to retrieve the adjacent [tool-failure-diag] lines and identify whether the cause is DNS, TCP, HTTP, or the tool\'s internal pipeline \u2014 then adapt the next attempt to match. Never retry the same tool against the same target without diagnostic-grounded reasoning.'
+    },
+    {
+      // Task 532: closes the "60-second black-box tool wait" class. Fires when
+      // a tool hits the 30-second mark of the mid-flight heartbeat. The
+      // pattern anchors on elapsed=30s specifically (the tool-wait tick emits
+      // one line per 5s per tool, so matching every tick would be noisy) and
+      // excludes tools whose long runtime is expected: `Task`/`Agent` subagent
+      // dispatch, `Bash` with explicit long timeouts.
+      id: "tool-wait-long-stall",
+      name: "Tool wait exceeds 30 seconds (possible stall)",
+      type: "repeated-error",
+      logSource: "system",
+      pattern: "\\[tool-wait\\][^\\n]*name=(?!Task\\b|Agent\\b|Bash\\b)[A-Za-z0-9_]+[^\\n]*elapsed=30s",
+      thresholdCount: 0,
+      thresholdWindowMinutes: 0,
+      scope: "session",
+      suggestedAction: "A tool call has been pending for 30 seconds without a result. Read the adjacent [tool-wait-diag] and [tool-wait-proc] lines in the conversation's stream log to determine whether the network remained healthy, the subprocess held active sockets, and the HTTP request reached the wire. If diag shows a healthy network but the subprocess has no [subproc-stderr] UNDICI/HTTP activity during the wait window, the tool's internal pipeline is stalled \u2014 do not retry the same request against the same target without a change in approach."
+    },
+    {
+      // Task 533: surface every Cloudflare-plugin refusal. The plugin emits
+      // exactly one [cloudflare:refuse] line per refusal with a structured
+      // reason field; any single occurrence on a previously-clean device
+      // means scope, account-binding, or post-flight FQDN drift — the
+      // operator should run cf-verify before acting.
+      id: "cloudflare-refuse",
+      name: "Cloudflare plugin refusal",
+      type: "silent-catch",
+      logSource: "any",
+      pattern: "\\[cloudflare:refuse\\]|\\[cloudflare:post-flight-mismatch\\]",
+      thresholdCount: 0,
+      thresholdWindowMinutes: 0,
+      suggestedAction: "The Cloudflare plugin refused an operation or detected a post-flight FQDN mismatch. Run `cf-verify` to inspect current device state. If the reason is `account-drift` or `unbound-device`, run `tunnel-login force=true` to clear cert + binding and re-authenticate. If the reason is `scope-mismatch`, the requested hostname is outside the brand's declared zones \u2014 fix at brand.json + republish. If `post-flight-fqdn-mismatch`, run `cf-rebuild` to reconcile."
     }
   ];
 }
@@ -10006,7 +10527,7 @@ function loadRules(configDir2) {
 function rulesFileMtime(configDir2) {
   const path2 = rulesFilePath(configDir2);
   try {
-    return statSync3(path2).mtimeMs;
+    return statSync4(path2).mtimeMs;
   } catch {
     return null;
   }
@@ -10117,6 +10638,12 @@ function validateRule(input, label, seenIds) {
   if (typeof r.watchPath === "string") rule.watchPath = r.watchPath;
   if (typeof r.staleHours === "number") rule.staleHours = r.staleHours;
   if (typeof r.suppressedUntil === "string") rule.suppressedUntil = r.suppressedUntil;
+  if (r.scope !== void 0) {
+    if (typeof r.scope !== "string" || !VALID_SCOPES.has(r.scope)) {
+      throw new Error(`${label}: scope must be one of ${[...VALID_SCOPES].join(", ")}`);
+    }
+    rule.scope = r.scope;
+  }
   if (rule.type === "file-write-storm" || rule.type === "stale-log") {
     if (!rule.watchPath) {
       throw new Error(`${label}: ${rule.type} rules require watchPath`);
@@ -10131,7 +10658,7 @@ function validateRule(input, label, seenIds) {
 }
 
 // app/lib/review-detector/sources.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync6, openSync, readSync, closeSync, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve8, join as join5, basename, dirname as dirname3 } from "path";
 function tailStatePath(configDir2) {
   return resolve8(configDir2, "review-state.json");
@@ -10181,12 +10708,31 @@ function discoverSourceFiles(configDir2, accountLogDir2, logicalSource) {
   }[logicalSource];
   if (!existsSync8(accountLogDir2)) return [];
   const files = [];
+  let scanned = 0;
+  let skippedPrefixMismatch = 0;
+  let skippedNotLog = 0;
   for (const entry of readdirSync3(accountLogDir2)) {
-    if (entry.startsWith(prefix) && entry.endsWith(".log")) {
+    scanned += 1;
+    const matchesPrefix = entry.startsWith(prefix);
+    const isLog = entry.endsWith(".log");
+    if (matchesPrefix && isLog) {
       files.push({ logicalSource, filepath: join5(accountLogDir2, entry) });
+    } else if (!matchesPrefix) {
+      skippedPrefixMismatch += 1;
+    } else {
+      skippedNotLog += 1;
+    }
+  }
+  files.sort((a, b) => {
+    try {
+      return statSync5(b.filepath).mtimeMs - statSync5(a.filepath).mtimeMs;
+    } catch {
+      return a.filepath.localeCompare(b.filepath);
     }
+  });
+  if (skippedPrefixMismatch > 0 || skippedNotLog > 0) {
+    console.error(`[review-scan-skip] dir=${accountLogDir2} source=${logicalSource} prefix=${prefix} scanned=${scanned} matched=${files.length} skipped_prefix=${skippedPrefixMismatch} skipped_non_log=${skippedNotLog}`);
   }
-  files.sort((a, b) => a.filepath.localeCompare(b.filepath));
   return files;
 }
 function discoverAllSources(configDir2, accountLogDir2) {
@@ -10202,7 +10748,7 @@ function discoverAllSources(configDir2, accountLogDir2) {
 }
 function readNewLines(filepath, prev) {
   if (!existsSync8(filepath)) return null;
-  const stat4 = statSync4(filepath);
+  const stat4 = statSync5(filepath);
   const size = stat4.size;
   const inode = stat4.ino;
   let startOffset = 0;
@@ -10227,12 +10773,12 @@ function readNewLines(filepath, prev) {
       truncated
     };
   }
-  const fd = openSync(filepath, "r");
+  const fd = openSync2(filepath, "r");
   try {
     const bufSize = Math.max(0, size - startOffset);
     const buf = Buffer.alloc(bufSize);
     if (bufSize > 0) {
-      readSync(fd, buf, 0, bufSize, startOffset);
+      readSync2(fd, buf, 0, bufSize, startOffset);
     }
     const text = buf.toString("utf-8");
     const lines = text.length > 0 ? text.split("\n") : [];
@@ -10250,7 +10796,7 @@ function readNewLines(filepath, prev) {
       truncated
     };
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 }
 function countRecentWrites(dir, sinceMs) {
@@ -10259,7 +10805,7 @@ function countRecentWrites(dir, sinceMs) {
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (!entry.isFile()) continue;
     try {
-      const st = statSync4(join5(dir, entry.name));
+      const st = statSync5(join5(dir, entry.name));
       if (st.mtimeMs >= sinceMs) count += 1;
     } catch {
     }
@@ -10269,7 +10815,7 @@ function countRecentWrites(dir, sinceMs) {
 function fileLastWriteMs(path2) {
   if (!existsSync8(path2)) return null;
   try {
-    return statSync4(path2).mtimeMs;
+    return statSync5(path2).mtimeMs;
   } catch {
     return null;
   }
@@ -10282,7 +10828,7 @@ function sourceKey(file2) {
 }
 
 // app/lib/review-detector/writer.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync5 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync6 } from "fs";
 import { resolve as resolve9, dirname as dirname4 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function reviewLogPath(configDir2) {
@@ -10548,6 +11094,12 @@ import { resolve as resolve10 } from "path";
 
 // app/lib/review-detector/evaluator.ts
 var SAMPLE_MAX_CHARS = 500;
+var CONV_ID_REGEX = /conversationId=([a-f0-9]{8})/;
+function scopeKeyFor(rule, line) {
+  if (rule.scope !== "session") return "";
+  const m = CONV_ID_REGEX.exec(line);
+  return m ? m[1] : "";
+}
 var compiledRegexCache = /* @__PURE__ */ new Map();
 function compileRegex(pattern) {
   let re = compiledRegexCache.get(pattern);
@@ -10568,31 +11120,60 @@ function toSample(line) {
   return line.slice(0, SAMPLE_MAX_CHARS) + "\u2026";
 }
 function newRuleState() {
-  return { matchTimestamps: [], lastAlertAt: null, cumulativeSinceLastAlert: 0, lastSeenAt: null };
+  return {
+    matchTimestamps: [],
+    matchTimestampsByScope: /* @__PURE__ */ new Map(),
+    lastAlertAt: null,
+    cumulativeSinceLastAlert: 0,
+    lastSeenAt: null
+  };
 }
 function evaluateTextRule(rule, lines, state, nowMs) {
   if (isSuppressed(rule, nowMs)) return { match: null, state };
   if (rule.pattern.length === 0) return { match: null, state };
   const regex = compileRegex(rule.pattern);
-  let sample = null;
-  let matchCount = 0;
+  const matchesByScope = /* @__PURE__ */ new Map();
+  let firstSample = null;
   for (const line of lines) {
-    if (regex.test(line)) {
-      matchCount += 1;
-      if (!sample) sample = line;
-    }
-  }
-  if (matchCount === 0) return { match: null, state };
+    if (!regex.test(line)) continue;
+    if (!firstSample) firstSample = line;
+    const key = scopeKeyFor(rule, line);
+    const existing = matchesByScope.get(key) ?? [];
+    existing.push(line);
+    matchesByScope.set(key, existing);
+  }
+  if (matchesByScope.size === 0) return { match: null, state };
+  const windowStart = rule.thresholdWindowMinutes > 0 ? nowMs - rule.thresholdWindowMinutes * 6e4 : -Infinity;
   const updated = {
     ...state,
-    matchTimestamps: [...state.matchTimestamps]
-  };
-  for (let i = 0; i < matchCount; i++) updated.matchTimestamps.push(nowMs);
-  if (rule.thresholdWindowMinutes > 0) {
-    const windowStart = nowMs - rule.thresholdWindowMinutes * 6e4;
+    matchTimestamps: [...state.matchTimestamps],
+    matchTimestampsByScope: new Map(state.matchTimestampsByScope ?? [])
+  };
+  let firingSample = null;
+  let fires = false;
+  const isCountZero = rule.thresholdCount === 0;
+  if (rule.scope === "session") {
+    for (const [key, hits] of matchesByScope) {
+      const prior = updated.matchTimestampsByScope.get(key) ?? [];
+      const merged = [...prior, ...hits.map(() => nowMs)].filter((t) => t >= windowStart);
+      if (merged.length === 0) {
+        updated.matchTimestampsByScope.delete(key);
+      } else {
+        updated.matchTimestampsByScope.set(key, merged);
+      }
+      if (!fires && (isCountZero || merged.length >= rule.thresholdCount)) {
+        fires = true;
+        firingSample = hits[0];
+      }
+    }
+  } else {
+    for (const hits of matchesByScope.values()) {
+      for (const _ of hits) updated.matchTimestamps.push(nowMs);
+    }
     updated.matchTimestamps = updated.matchTimestamps.filter((t) => t >= windowStart);
+    fires = isCountZero || updated.matchTimestamps.length >= rule.thresholdCount;
+    if (fires) firingSample = firstSample;
   }
-  const fires = rule.thresholdCount === 0 ? true : updated.matchTimestamps.length >= rule.thresholdCount;
   if (!fires) {
     return { match: null, state: updated };
   }
@@ -10600,7 +11181,7 @@ function evaluateTextRule(rule, lines, state, nowMs) {
     ruleId: rule.id,
     ruleName: rule.name,
     matchedAt: nowMs,
-    sampleEvidence: toSample(sample ?? lines[0] ?? ""),
+    sampleEvidence: toSample(firingSample ?? firstSample ?? lines[0] ?? ""),
     suggestedAction: rule.suggestedAction
   };
   return { match: match2, state: updated };
@@ -28035,8 +28616,9 @@ async function POST2(req) {
       { status: 500, headers: { "Content-Type": "application/json" } }
     );
   }
-  const sseLog = agentLogStream("sse-events", account.accountDir);
-  const sk = getConversationIdForSession(session_key)?.slice(0, 8) ?? session_key.slice(0, 8);
+  const publicSseConvId = getConversationIdForSession(session_key);
+  const sseLog = publicSseConvId ? agentLogStream("sse-events", account.accountDir, publicSseConvId) : preConversationLogStream("sse-events", account.accountDir);
+  const sk = publicSseConvId?.slice(0, 8) ?? session_key.slice(0, 8);
   const agentName = getAgentNameForSession(session_key);
   if (!agentName) {
     console.log(`[chat] no agent for session=${sk} \u2014 session expired or server restarted`);
@@ -29925,7 +30507,7 @@ async function POST16(req) {
 
 // app/api/onboarding/claude-auth/route.ts
 import { spawn as spawn3, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync12, writeSync } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync12, writeSync } from "fs";
 function checkAuthStatus() {
   try {
     execFileSync2("claude", ["auth", "status"], { encoding: "utf-8", timeout: 5e3 });
@@ -29996,7 +30578,7 @@ async function POST17(req, remoteAddress) {
   const chromiumWrapper = writeChromiumWrapper();
   const x11Env = buildX11Env(chromiumWrapper, transport);
   vncLog("claude-auth", { action: "start", transport });
-  const claudeAuthLogFd = openSync2(logPath("claude-auth"), "a");
+  const claudeAuthLogFd = openSync3(logPath("claude-auth"), "a");
   const claudeProc = spawn3("claude", ["auth", "login"], {
     env: x11Env,
     stdio: ["ignore", "pipe", "pipe"]
@@ -30005,7 +30587,7 @@ async function POST17(req, remoteAddress) {
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   claudeProc.stdout?.on("data", onClaudeOutput);
   claudeProc.stderr?.on("data", onClaudeOutput);
-  claudeProc.once("close", () => closeSync2(claudeAuthLogFd));
+  claudeProc.once("close", () => closeSync3(claudeAuthLogFd));
   await waitForAuthPage(2e4);
   return Response.json({ started: true, transport });
 }
@@ -30411,7 +30993,8 @@ async function POST21(req) {
   try {
     const parsed = JSON.parse(message);
     if (parsed._lifecycle) {
-      const lifecycleLog = agentLogStream("component-lifecycle", account.accountDir);
+      const lifecycleConvId = getConversationIdForSession(session_key);
+      const lifecycleLog = lifecycleConvId ? agentLogStream("component-lifecycle", account.accountDir, lifecycleConvId) : preConversationLogStream("component-lifecycle", account.accountDir);
       const ts = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
       const detail = parsed.filePath ? ` filePath=${parsed.filePath}` : "";
       lifecycleLog.write(`[${ts}] [component:${parsed.component ?? "unknown"}] ${parsed.event ?? "unknown"}${detail}
@@ -30435,7 +31018,8 @@ async function POST21(req) {
   try {
     const parsed = JSON.parse(message);
     if (isComponentDone(parsed)) {
-      const componentLog = agentLogStream("component-lifecycle", account.accountDir);
+      const componentConvId = getConversationIdForSession(session_key);
+      const componentLog = componentConvId ? agentLogStream("component-lifecycle", account.accountDir, componentConvId) : preConversationLogStream("component-lifecycle", account.accountDir);
       const ts = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
       message = transformComponentDone(parsed);
       componentLog.write(`[${ts}] [component:${parsed.component}] componentDone \u2192 transformed
@@ -30463,8 +31047,9 @@ async function POST21(req) {
     gatewayResult = await processInbound(message, "web-admin");
   }
   const encoder = new TextEncoder();
-  const sseLog = agentLogStream("sse-events", account.accountDir);
-  const sk = getConversationIdForSession(session_key)?.slice(0, 8) ?? session_key.slice(0, 8);
+  const sseConvId = getConversationIdForSession(session_key);
+  const sseLog = sseConvId ? agentLogStream("sse-events", account.accountDir, sseConvId) : preConversationLogStream("sse-events", account.accountDir);
+  const sk = sseConvId?.slice(0, 8) ?? session_key.slice(0, 8);
   const readable = new ReadableStream({
     async start(controller) {
       try {
@@ -30573,13 +31158,14 @@ async function POST22(req) {
 }
 
 // app/api/admin/logs/route.ts
-import { existsSync as existsSync19, readdirSync as readdirSync5, readFileSync as readFileSync20, statSync as statSync6 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync5, readFileSync as readFileSync20, statSync as statSync7 } from "fs";
 import { resolve as resolve19, basename as basename5 } from "path";
 var TAIL_BYTES = 8192;
 async function GET9(request) {
   const { searchParams } = new URL(request.url);
   const fileParam = searchParams.get("file");
   const typeParam = searchParams.get("type");
+  const conversationIdParam = searchParams.get("conversationId");
   const download = searchParams.get("download") === "1";
   const account = resolveAccount();
   const accountLogDir2 = account ? resolve19(account.accountDir, "logs") : null;
@@ -30599,18 +31185,21 @@ async function GET9(request) {
     return Response.json({ error: `File not found: ${safe}` }, { status: 404 });
   }
   if (typeParam) {
-    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const typeMap = {
-      stream: `claude-agent-stream-${today}.log`,
-      error: `claude-agent-stderr-${today}.log`,
-      session: `sse-events-${today}.log`,
-      sse: `sse-events-${today}.log`,
-      public: `public-agent-stream-${today}.log`
+    const prefixMap = {
+      stream: "claude-agent-stream",
+      error: "claude-agent-stderr",
+      session: "sse-events",
+      sse: "sse-events",
+      public: "public-agent-stream"
     };
-    const fileName = typeMap[typeParam];
-    if (!fileName) {
+    const prefix = prefixMap[typeParam];
+    if (!prefix) {
       return Response.json({ error: `Unknown type: ${typeParam}. Valid: stream, error, session, sse, public` }, { status: 400 });
     }
+    if (!conversationIdParam) {
+      return Response.json({ error: `type=${typeParam} requires conversationId (per-conversation log files, no daily fallback)` }, { status: 400 });
+    }
+    const fileName = `${prefix}-${conversationIdParam}.log`;
     for (const dir of [accountLogDir2, LOG_DIR]) {
       if (!dir) continue;
       const filePath = resolve19(dir, fileName);
@@ -30634,7 +31223,7 @@ async function GET9(request) {
     } catch {
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync6(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
         const content = readFileSync20(resolve19(dir, name));
@@ -30894,7 +31483,7 @@ async function GET13() {
 
 // app/api/admin/version/upgrade/route.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync24, statSync as statSync7, writeFileSync as writeFileSync16, readFileSync as readFileSync24, openSync as openSync3, closeSync as closeSync3 } from "fs";
+import { existsSync as existsSync24, statSync as statSync8, writeFileSync as writeFileSync16, readFileSync as readFileSync24, openSync as openSync4, closeSync as closeSync4 } from "fs";
 import { resolve as resolve25, join as join11 } from "path";
 var PLATFORM_ROOT10 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
 var upgradePkg = "@rubytech/create-maxy";
@@ -30914,7 +31503,7 @@ var LOCK_MAX_AGE_MS = 20 * 60 * 1e3;
 function isLockFresh() {
   if (!existsSync24(LOCK_FILE)) return false;
   try {
-    const stat4 = statSync7(LOCK_FILE);
+    const stat4 = statSync8(LOCK_FILE);
     return Date.now() - stat4.mtimeMs < LOCK_MAX_AGE_MS;
   } catch {
     return false;
@@ -30943,7 +31532,7 @@ async function POST23(req) {
     console.error("[admin/version/upgrade] failed to write lock file:", err);
   }
   try {
-    const logFd = openSync3(LOG_FILE, "w");
+    const logFd = openSync4(LOG_FILE, "w");
     const child = spawn4("systemd-run", [
       "--user",
       "--scope",
@@ -30959,7 +31548,7 @@ async function POST23(req) {
       cwd: resolve25(process.cwd(), "..")
     });
     child.unref();
-    closeSync3(logFd);
+    closeSync4(logFd);
     console.log(`[admin/version/upgrade] spawned upgrade process (pid ${child.pid})`);
     return Response.json({ ok: true, started: true });
   } catch (err) {
@@ -31316,7 +31905,7 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join13(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join13(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync26(ALIAS_DOMAINS_PATH)) return null;
@@ -31809,7 +32398,7 @@ function cachedHtml(file2) {
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join13(homedir3(), BRAND.configDir);
+  const configDir2 = join13(homedir4(), BRAND.configDir);
   try {
     const accountJsonPath = join13(configDir2, "account.json");
     if (!existsSync26(accountJsonPath)) return null;
@@ -31825,7 +32414,7 @@ function loadBrandingCache(agentSlug) {
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join13(homedir3(), BRAND.configDir);
+    const configDir2 = join13(homedir4(), BRAND.configDir);
     const accountJsonPath = join13(configDir2, "account.json");
     if (!existsSync26(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));