@rubytech/create-realagent 1.0.615 → 1.0.616

package/payload/server/server.js

@@ -2898,7 +2898,7 @@ var serveStatic = (options = { root: "" }) => {
 // server/index.ts
 import { readFileSync as readFileSync26, existsSync as existsSync26, watchFile } from "fs";
 import { resolve as resolve27, join as join13, basename as basename6 } from "path";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 
 // app/lib/vnc-logger.ts
 import { appendFileSync, mkdirSync } from "fs";
@@ -4162,12 +4162,14 @@ function keyFilePath() {
 
 // app/lib/claude-agent.ts
 import Anthropic2 from "@anthropic-ai/sdk";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
 import { resolve as resolve6, join as join4 } from "path";
+import { platform as osPlatform } from "os";
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync, cpSync, rmSync } from "fs";
 import { lookup as dnsLookup } from "dns/promises";
 import { createConnection as netConnect } from "net";
+import { StringDecoder } from "string_decoder";
 
 // ../lib/models/src/index.ts
 var OPUS_MODEL = "claude-opus-4-7";
@@ -5463,9 +5465,11 @@ function readRecentToolFailures(accountId, conversationId) {
   try {
     const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
     const logDir = resolve5(platformRoot3, "..", "data/accounts", accountId, "logs");
-    const date5 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const logPath2 = resolve5(logDir, `claude-agent-stream-${date5}.log`);
-    if (!existsSync5(logPath2)) return [];
+    const logPath2 = resolve5(logDir, `claude-agent-stream-${conversationId}.log`);
+    if (!existsSync5(logPath2)) {
+      console.error(`[review-tail-skip] path=${logPath2} reason=file-missing \u2014 first turn of conversation, subprocess not yet spawned, or log rotated`);
+      return [];
+    }
     const st = statSync2(logPath2);
     const size = st.size;
     const readBytes = Math.min(size, RECENT_FAILURES_TAIL_BYTES);
@@ -5475,12 +5479,11 @@ function readRecentToolFailures(accountId, conversationId) {
       const buf = Buffer.alloc(readBytes);
       readSync(fd, buf, 0, readBytes, position);
       const text = buf.toString("utf-8");
-      const convPrefix = conversationId.slice(0, 8);
       const lines = text.split("\n");
       const matches = [];
       for (let i = lines.length - 1; i >= 0 && matches.length < MAX_RECENT_TOOL_FAILURES; i--) {
         const line = lines[i];
-        if (line.includes("[tool-failure-diag]") && line.includes(`conversationId=${convPrefix}`)) {
+        if (line.includes("[tool-failure-diag]")) {
           matches.push(line);
         }
       }
@@ -6170,20 +6173,137 @@ async function runFailureDiagnostic(toolName, toolInput) {
   const fields = capped.map((r) => r.status === "fulfilled" ? r.value : `probe_err=${quoteDiag(String(r.reason).slice(0, 40))}`).join(" ");
   return `diag_host=${host} diag_port=${port2} ${fields} input_keys=[${inputKeys}] ${envFields}`;
 }
-function agentLogStream(name, accountDir) {
+function agentLogStream(name, accountDir, conversationId) {
+  if (!conversationId) {
+    throw new Error(`agentLogStream: conversationId is required (name=${name}) \u2014 use preConversationLogStream for pre-session events`);
+  }
+  const logDir = resolve6(accountDir, "logs");
+  mkdirSync4(logDir, { recursive: true });
+  purgeOldLogs(logDir, `${name}-`);
+  return createWriteStream(resolve6(logDir, `${name}-${conversationId}.log`), { flags: "a" });
+}
+function preConversationLogStream(name, accountDir) {
   const logDir = resolve6(accountDir, "logs");
   mkdirSync4(logDir, { recursive: true });
   const date5 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  purgeOldLogs(logDir, `preconversation-${name}-`);
+  return createWriteStream(resolve6(logDir, `preconversation-${name}-${date5}.log`), { flags: "a" });
+}
+function purgeOldLogs(logDir, prefix) {
   const cutoff = Date.now() - LOG_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+  let entries;
   try {
-    for (const file2 of readdirSync2(logDir)) {
-      if (!file2.startsWith(`${name}-`)) continue;
-      const filePath = resolve6(logDir, file2);
+    entries = readdirSync2(logDir);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[log-purge-err] readdir dir=${logDir} prefix=${prefix} reason=${msg}`);
+    return;
+  }
+  for (const file2 of entries) {
+    if (!file2.startsWith(prefix)) continue;
+    const filePath = resolve6(logDir, file2);
+    try {
       if (statSync3(filePath).mtimeMs < cutoff) unlinkSync(filePath);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`[log-purge-err] file=${file2} reason=${msg}`);
     }
-  } catch {
   }
-  return createWriteStream(resolve6(logDir, `${name}-${date5}.log`), { flags: "a" });
+}
+function teeProcStderrToStreamLog(proc, streamLog) {
+  if (!proc.stderr) {
+    streamLog.write(`[${isoTs()}] [subproc-stderr-skip] reason=no-stderr
+`);
+    return;
+  }
+  const utf8 = new StringDecoder("utf8");
+  let buffer = "";
+  proc.stderr.on("data", (chunk) => {
+    const text = typeof chunk === "string" ? chunk : utf8.write(chunk);
+    buffer += text;
+    let idx;
+    while ((idx = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, idx);
+      buffer = buffer.slice(idx + 1);
+      if (line.length === 0) continue;
+      if (streamLog.destroyed || streamLog.writableEnded) continue;
+      streamLog.write(`[${isoTs()}] [subproc-stderr] ${line}
+`);
+    }
+  });
+  proc.stderr.on("end", () => {
+    const tail = (buffer + utf8.end()).trim();
+    if (tail.length > 0 && !streamLog.destroyed && !streamLog.writableEnded) {
+      streamLog.write(`[${isoTs()}] [subproc-stderr] ${tail}
+`);
+    }
+    buffer = "";
+  });
+}
+function sampleProcState(pid) {
+  try {
+    if (osPlatform() === "linux") {
+      const fdDir = `/proc/${pid}/fd`;
+      let openFds2 = 0;
+      try {
+        openFds2 = readdirSync2(fdDir).length;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return `proc_err=${JSON.stringify(msg.slice(0, 60))}`;
+      }
+      let established2 = 0;
+      let connecting2 = 0;
+      let sockets2 = 0;
+      for (const tcpFile of ["/proc/" + pid + "/net/tcp", "/proc/" + pid + "/net/tcp6"]) {
+        try {
+          const raw2 = readFileSync7(tcpFile, "utf-8");
+          const lines2 = raw2.split("\n");
+          for (let i = 1; i < lines2.length; i++) {
+            const line = lines2[i].trim();
+            if (!line) continue;
+            const parts = line.split(/\s+/);
+            const state = parts[3];
+            sockets2 += 1;
+            if (state === "01") established2 += 1;
+            else if (state === "02" || state === "03") connecting2 += 1;
+          }
+        } catch {
+        }
+      }
+      let rssMb = 0;
+      try {
+        const statm = readFileSync7(`/proc/${pid}/statm`, "utf-8").trim().split(/\s+/);
+        const rssPages = parseInt(statm[1] ?? "0", 10);
+        if (Number.isFinite(rssPages)) rssMb = Math.round(rssPages * 4096 / (1024 * 1024));
+      } catch {
+      }
+      return `open_fds=${openFds2} socket_count=${sockets2} tcp_established=${established2} tcp_connecting=${connecting2} rss_mb=${rssMb}`;
+    }
+    const result = spawnSync2("lsof", ["-p", String(pid), "-nP"], { timeout: 500, encoding: "utf-8" });
+    if (result.error || result.status !== 0) {
+      const reason = result.error instanceof Error ? result.error.message : `exit=${result.status}`;
+      return `proc_err=${JSON.stringify(reason.slice(0, 60))}`;
+    }
+    const lines = result.stdout.split("\n");
+    let openFds = 0;
+    let sockets = 0;
+    let established = 0;
+    let connecting = 0;
+    for (let i = 1; i < lines.length; i++) {
+      const line = lines[i];
+      if (!line) continue;
+      openFds += 1;
+      if (line.includes("IPv4") || line.includes("IPv6") || line.includes("TCP")) {
+        sockets += 1;
+        if (/ESTABLISHED/.test(line)) established += 1;
+        else if (/SYN_SENT|SYN_RCVD/.test(line)) connecting += 1;
+      }
+    }
+    return `open_fds=${openFds} socket_count=${sockets} tcp_established=${established} tcp_connecting=${connecting} rss_mb=unknown`;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return `proc_err=${JSON.stringify(msg.slice(0, 60))}`;
+  }
 }
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
 var ACCOUNTS_DIR = resolve6(PLATFORM_ROOT4, "..", "data/accounts");
@@ -7377,43 +7497,48 @@ function consumeStalledSubagents(sessionKey) {
   delete session.stalledSubagents;
   return stalls && stalls.length > 0 ? stalls : void 0;
 }
-function getMcpServers(accountId, userId, enabledPlugins) {
+function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
+  if (!conversationId) {
+    throw new Error(`getMcpServers: conversationId is required (accountId=${accountId.slice(0, 8)})`);
+  }
   const LOG_DIR2 = resolve6(ACCOUNTS_DIR, accountId, "logs");
+  const STREAM_LOG_PATH = resolve6(LOG_DIR2, `claude-agent-stream-${conversationId}.log`);
+  const baseEnv = { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, STREAM_LOG_PATH };
   const servers = {
     "memory": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, ...userId ? { USER_ID: userId } : {} }
+      env: { ...baseEnv, ...userId ? { USER_ID: userId } : {} }
     },
     "contacts": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/contacts/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     "whatsapp": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/whatsapp/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, PLATFORM_PORT: process.env.PORT ?? "19200" }
+      env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
     },
     "admin": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/admin/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, PLATFORM_PORT: process.env.PORT ?? "19200", ...userId ? { USER_ID: userId } : {} }
+      env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200", ...userId ? { USER_ID: userId } : {} }
     },
     "scheduling": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/scheduling/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     "tasks": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/tasks/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     "email": {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/email/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+      env: { ...baseEnv }
     },
     // Playwright MCP server — browser automation for browser-specialist.
     // Key matches Claude Code's plugin naming: plugin_{plugin}_{server} so tools
@@ -7432,7 +7557,7 @@ function getMcpServers(accountId, userId, enabledPlugins) {
     servers["telegram"] = {
       command: "node",
       args: [resolve6(PLATFORM_ROOT4, "plugins/telegram/mcp/dist/index.js")],
-      env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, TELEGRAM_BOT_TOKEN: tgBotToken }
+      env: { ...baseEnv, TELEGRAM_BOT_TOKEN: tgBotToken }
     };
   } else {
     console.error("[plugins] telegram MCP: skipped (no bot token in account.json telegram config)");
@@ -7440,7 +7565,7 @@ function getMcpServers(accountId, userId, enabledPlugins) {
   servers["cloudflare"] = {
     command: "node",
     args: [resolve6(PLATFORM_ROOT4, "plugins/cloudflare/mcp/dist/index.js")],
-    env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, PLATFORM_PORT: process.env.PORT ?? "19200" }
+    env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
   };
   if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
     const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
@@ -7471,7 +7596,7 @@ function getMcpServers(accountId, userId, enabledPlugins) {
       servers[dir] = {
         command: "node",
         args: [mcpEntry],
-        env: { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2 }
+        env: { ...baseEnv }
       };
       console.log(`[plugins] optional MCP server started: ${dir}`);
     }
@@ -7546,13 +7671,13 @@ var ADMIN_CORE_TOOLS = [
   "mcp__admin__action-reject",
   "mcp__admin__action-edit",
   "mcp__cloudflare__cloudflare-setup",
-  "mcp__cloudflare__cf-set-token",
   "mcp__cloudflare__cf-add-zone",
   "mcp__cloudflare__cf-zone-status",
+  "mcp__cloudflare__cf-verify",
+  "mcp__cloudflare__cf-rebuild",
   "mcp__cloudflare__tunnel-status",
   "mcp__cloudflare__tunnel-install",
   "mcp__cloudflare__tunnel-login",
-  "mcp__cloudflare__tunnel-create",
   "mcp__cloudflare__tunnel-enable",
   "mcp__cloudflare__tunnel-disable",
   "mcp__cloudflare__tunnel-add-hostname",
@@ -8123,10 +8248,10 @@ var COMPACTION_PROMPT = `You are about to reach your context limit. Call session
 
 Then respond with only: [COMPACTED]`;
 var COMPACTION_TIMEOUT_MS = 45e3;
-async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSessionId, adminModel, enabledPlugins) {
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, void 0, enabledPlugins) });
+async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSessionId, adminModel, conversationId, enabledPlugins) {
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, conversationId, void 0, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir, conversationId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
     "--print",
@@ -8155,15 +8280,23 @@ async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSes
   const proc = spawn2("claude", args, {
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, PLATFORM_ROOT: PLATFORM_ROOT4, ACCOUNT_DIR: accountDir }
+    env: {
+      ...process.env,
+      PLATFORM_ROOT: PLATFORM_ROOT4,
+      ACCOUNT_DIR: accountDir,
+      // Task 532: network traces on the compaction subprocess too — its tool
+      // calls are part of the same conversation's record.
+      NODE_DEBUG: "http,http2,net,tls,undici,dns"
+    }
   });
-  const stderrLog = agentLogStream("claude-agent-compaction-stderr", accountDir);
+  const stderrLog = agentLogStream("claude-agent-compaction-stderr", accountDir, conversationId);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
-  const streamLog = agentLogStream("claude-agent-compaction-stream", accountDir);
+  const streamLog = agentLogStream("claude-agent-compaction-stream", accountDir, conversationId);
   streamLog.on("error", () => {
   });
+  teeProcStderrToStreamLog(proc, streamLog);
   streamLog.write(`[${isoTs()}] [compaction-start] resumeSessionId=${resumeSessionId}
 `);
   proc.on("error", (err) => {
@@ -8271,6 +8404,83 @@ async function* parseClaudeStream(proc, streamLog, adminModel, conversationId) {
       apiWaitTimer = void 0;
     }
   }
+  const inflightTools = /* @__PURE__ */ new Map();
+  const TOOL_WAIT_TICK_MS = 5e3;
+  const TOOL_WAIT_DIAG_THRESHOLDS_SEC = [15, 30, 45, 60];
+  const TOOL_WAIT_PROC_SEC = 30;
+  const procPid = proc.pid;
+  const toolWaitTimer = setInterval(() => {
+    if (streamLog.destroyed) return;
+    const now = Date.now();
+    for (const [toolUseId, info] of inflightTools) {
+      const elapsedSec = Math.round((now - info.startedAt) / 1e3);
+      streamLog.write(`[${isoTs()}] [tool-wait]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s
+`);
+      let nextThreshold = 0;
+      for (const t of TOOL_WAIT_DIAG_THRESHOLDS_SEC) {
+        if (elapsedSec >= t && t > info.lastProbeThresholdSec) nextThreshold = t;
+      }
+      if (nextThreshold > 0) {
+        if (info.probeInFlight) {
+          streamLog.write(`[${isoTs()}] [tool-wait-diag-skip]${convIdTag} tool_use_id=${toolUseId} reason=probe-in-flight threshold=${nextThreshold}s
+`);
+        } else {
+          info.lastProbeThresholdSec = nextThreshold;
+          info.probeInFlight = true;
+          const toolInput = toolIdToInput.get(toolUseId);
+          runFailureDiagnostic(info.name, toolInput).then((diag) => {
+            if (!streamLog.destroyed && !streamLog.writableEnded) {
+              streamLog.write(`[${isoTs()}] [tool-wait-diag]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s ${diag}
+`);
+            }
+          }).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (!streamLog.destroyed && !streamLog.writableEnded) {
+              streamLog.write(`[${isoTs()}] [tool-wait-diag]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s diag_err=${JSON.stringify(msg.slice(0, 80))}
+`);
+            }
+          }).finally(() => {
+            const current = inflightTools.get(toolUseId);
+            if (current) current.probeInFlight = false;
+          });
+        }
+      }
+      if (!info.procSampleEmitted && elapsedSec >= TOOL_WAIT_PROC_SEC) {
+        info.procSampleEmitted = true;
+        if (!procPid) {
+          streamLog.write(`[${isoTs()}] [tool-wait-proc-skip]${convIdTag} tool_use_id=${toolUseId} reason=no-pid
+`);
+        } else {
+          const procLine = sampleProcState(procPid);
+          streamLog.write(`[${isoTs()}] [tool-wait-proc]${convIdTag} name=${info.name} pid=${procPid} tool_use_id=${toolUseId} elapsed=${elapsedSec}s ${procLine}
+`);
+        }
+      }
+    }
+  }, TOOL_WAIT_TICK_MS);
+  function trackToolUse(toolUseId, toolName) {
+    if (!toolUseId) {
+      streamLog.write(`[${isoTs()}] [tool-use-no-id]${convIdTag} name=${toolName} reason=missing-tool-use-id-cannot-track-wait
+`);
+      return;
+    }
+    inflightTools.set(toolUseId, {
+      name: toolName,
+      startedAt: Date.now(),
+      lastProbeThresholdSec: 0,
+      probeInFlight: false,
+      procSampleEmitted: false
+    });
+  }
+  function untrackToolUse(toolUseId, reason) {
+    if (!toolUseId) return;
+    if (!inflightTools.delete(toolUseId)) {
+      if (reason === "result") {
+        streamLog.write(`[${isoTs()}] [tool-wait-late]${convIdTag} tool_use_id=${toolUseId} reason=result-without-matching-tool-use
+`);
+      }
+    }
+  }
   const readLines = async function* () {
     for await (const chunk of proc.stdout) {
       buffer += chunk.toString();
@@ -8449,6 +8659,7 @@ async function* parseClaudeStream(proc, streamLog, adminModel, conversationId) {
                     vncLog("mcp-tool", { name: block.name, input_preview: inputPreview });
                   }
                 }
+                trackToolUse(block.id, block.name);
                 yield { type: "tool_use", name: block.name, input: block.input ?? {}, toolUseId: block.id };
               }
             }
@@ -8502,9 +8713,13 @@ async function* parseClaudeStream(proc, streamLog, adminModel, conversationId) {
 `);
                     }
                   }
+                } else if (block.is_error && !block.tool_use_id) {
+                  streamLog.write(`[${isoTs()}] [tool-failure-diag-skip]${convIdTag} name=${name} reason=no-tool-use-id-cannot-lookup-input
+`);
                 }
               }
               if (block.tool_use_id) toolIdToInput.delete(block.tool_use_id);
+              untrackToolUse(block.tool_use_id, "result");
               const renderDirectiveRe = /^__RENDER__(\{.+\})$/gm;
               let renderMatch;
               while ((renderMatch = renderDirectiveRe.exec(output)) !== null) {
@@ -8636,6 +8851,19 @@ async function* parseClaudeStream(proc, streamLog, adminModel, conversationId) {
     }
   } finally {
     endApiWait();
+    clearInterval(toolWaitTimer);
+    for (const [toolUseId, info] of inflightTools) {
+      const elapsedSec = Math.round((Date.now() - info.startedAt) / 1e3);
+      if (!streamLog.destroyed && !streamLog.writableEnded) {
+        streamLog.write(`[${isoTs()}] [tool-wait-late]${convIdTag} name=${info.name} tool_use_id=${toolUseId} elapsed=${elapsedSec}s reason=stream-ended-without-tool-result
+`);
+      }
+    }
+    inflightTools.clear();
+    if (buffer.length > 0 && !streamLog.destroyed && !streamLog.writableEnded) {
+      streamLog.write(`[${isoTs()}] [stream-buffer-flush]${convIdTag} bytes=${buffer.length} reason=process-exit preview=${JSON.stringify(buffer.slice(0, 120))}
+`);
+    }
   }
   if (!emittedDone) {
   }
@@ -8895,17 +9123,21 @@ function buildAttachmentMetaText(attachments) {
 async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, adminModel, sessionKey, maxTurns = 20, attachments = [], retryCount = 0, enabledPlugins, clientTimestamp) {
   const userTimestamp = clientTimestamp ?? (/* @__PURE__ */ new Date()).toISOString();
   const resumeSessionId = sessionKey ? getAgentSessionId(sessionKey) : void 0;
+  const spawnConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
+  if (!spawnConvId) {
+    throw new Error(`invokeAdminAgent: conversationId missing for sessionKey=${sessionKey?.slice(0, 8) ?? "none"} \u2014 ensureConversation must run before invoking the agent`);
+  }
   const cdpOk = await ensureCdp();
   if (!cdpOk) {
-    const cdpLog = agentLogStream("claude-agent-stream", accountDir);
+    const cdpLog = agentLogStream("claude-agent-stream", accountDir, spawnConvId);
     cdpLog.write(`[${isoTs()}] [warn] ensureCdp failed \u2014 browser-specialist degraded
 `);
     cdpLog.end();
   }
   const ccUserId = sessionKey ? getUserIdForSession(sessionKey) : void 0;
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, ccUserId, enabledPlugins) });
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, spawnConvId, ccUserId, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-stream", accountDir).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-stream", accountDir, spawnConvId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
     "--print",
@@ -8935,15 +9167,24 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
   const proc = spawn2("claude", args, {
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, PLATFORM_ROOT: PLATFORM_ROOT4, ACCOUNT_DIR: accountDir }
+    env: {
+      ...process.env,
+      PLATFORM_ROOT: PLATFORM_ROOT4,
+      ACCOUNT_DIR: accountDir,
+      // Task 532: tee subprocess network activity into the per-conversation
+      // stream log via the existing stderr pipe. Closes the Claude Code
+      // "what was the tool actually doing?" black box during tool waits.
+      NODE_DEBUG: "http,http2,net,tls,undici,dns"
+    }
   });
-  const stderrLog = agentLogStream("claude-agent-stderr", accountDir);
+  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, spawnConvId);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
-  const streamLog = agentLogStream("claude-agent-stream", accountDir);
+  const streamLog = agentLogStream("claude-agent-stream", accountDir, spawnConvId);
   streamLog.on("error", () => {
   });
+  teeProcStderrToStreamLog(proc, streamLog);
   if (sessionKey) {
     const prev = activeProcesses.get(sessionKey);
     if (prev) {
@@ -8952,8 +9193,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     }
     activeProcesses.set(sessionKey, { pid: proc.pid, spawnedAt: Date.now() });
   }
-  const spawnConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
-  streamLog.write(`[${isoTs()}] [spawn] pid=${proc.pid} resume=${resumeSessionId ?? "none"} sessionKey=${sessionKey ?? "none"} conversationId=${spawnConvId ?? "none"} pluginDir=${specialistsDir}
+  streamLog.write(`[${isoTs()}] [spawn] pid=${proc.pid} resume=${resumeSessionId ?? "none"} sessionKey=${sessionKey ?? "none"} conversationId=${spawnConvId} pluginDir=${specialistsDir}
 `);
   streamLog.write(`[${isoTs()}] [stdin] len=${fullMessage.length} preview=${JSON.stringify(fullMessage.slice(0, 80))}
 `);
@@ -9026,7 +9266,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     if (event.type === "usage" && sessionKey && currentAgentSessionId) {
       const peakReqPct = event.peak_request_pct ?? 0;
       if (peakReqPct >= COMPACTION_THRESHOLD) {
-        const compactionIter = runCompactionTurn(accountDir, accountId, systemPrompt, currentAgentSessionId, adminModel, enabledPlugins);
+        const compactionIter = runCompactionTurn(accountDir, accountId, systemPrompt, currentAgentSessionId, adminModel, spawnConvId, enabledPlugins);
         let step = await compactionIter.next();
         while (!step.done) {
           yield { type: "status", message: step.value };
@@ -9197,6 +9437,10 @@ ${summary}`;
 }
 async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accountId, adminModel, sessionKey, maxTurns = 20, attachments = [], retryCount = 0, enabledPlugins, clientTimestamp) {
   const userTimestamp = clientTimestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+  const managedConvId = getConversationIdForSession(sessionKey);
+  if (!managedConvId) {
+    throw new Error(`invokeManagedAdminAgent: conversationId missing for sessionKey=${sessionKey.slice(0, 8)} \u2014 ensureConversation must run first`);
+  }
   const pendingTrimmed = consumePendingTrimmedMessages(sessionKey);
   if (pendingTrimmed && pendingTrimmed.length > 0) {
     const ok = await compactTrimmedMessages(accountId, pendingTrimmed);
@@ -9204,7 +9448,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
       storePendingTrimmedMessages(sessionKey, pendingTrimmed);
     }
   }
-  const streamLog = agentLogStream("claude-agent-stream", accountDir);
+  const streamLog = agentLogStream("claude-agent-stream", accountDir, managedConvId);
   streamLog.on("error", () => {
   });
   const systemPromptTokens = estimateTokens(systemPrompt);
@@ -9235,7 +9479,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   if (!cdpOk) streamLog.write(`[${isoTs()}] [warn] ensureCdp failed \u2014 browser-specialist degraded
 `);
   const managedUserId = getUserIdForSession(sessionKey);
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedUserId, enabledPlugins) });
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedConvId, managedUserId, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
   if (!existsSync6(specialistsDir)) streamLog.write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
@@ -9265,12 +9509,20 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   const proc = spawn2("claude", args, {
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
-    env: { ...process.env, PLATFORM_ROOT: PLATFORM_ROOT4, ACCOUNT_DIR: accountDir }
+    env: {
+      ...process.env,
+      PLATFORM_ROOT: PLATFORM_ROOT4,
+      ACCOUNT_DIR: accountDir,
+      // Task 532: tee subprocess network traces into the per-conversation
+      // stream log via the stderr pipe + dual-consume listener.
+      NODE_DEBUG: "http,http2,net,tls,undici,dns"
+    }
   });
-  const stderrLog = agentLogStream("claude-agent-stderr", accountDir);
+  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, managedConvId);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
+  teeProcStderrToStreamLog(proc, streamLog);
   if (sessionKey) {
     const prev = activeProcesses.get(sessionKey);
     if (prev) {
@@ -9279,14 +9531,13 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
     }
     activeProcesses.set(sessionKey, { pid: proc.pid, spawnedAt: Date.now() });
   }
-  const managedConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
-  streamLog.write(`[${isoTs()}] [managed-spawn] pid=${proc.pid} sessionKey=${sessionKey} conversationId=${managedConvId ?? "none"} historyMessages=${history.length} pluginDir=${specialistsDir}
+  streamLog.write(`[${isoTs()}] [managed-spawn] pid=${proc.pid} sessionKey=${sessionKey} conversationId=${managedConvId} historyMessages=${history.length} pluginDir=${specialistsDir}
 `);
   streamLog.write(`[${isoTs()}] [stdin] len=${fullMessage.length} preview=${JSON.stringify(fullMessage.slice(0, 80))}
 `);
   proc.on("exit", (code, signal) => {
-    console.log(`[process-exit] pid=${proc.pid} code=${code} signal=${signal} sessionKey=${sessionKey ?? "none"} conversationId=${managedConvId ?? "none"}`);
-    if (!streamLog.destroyed && !streamLog.writableEnded) streamLog.write(`[${isoTs()}] [process-exit] pid=${proc.pid} code=${code} signal=${signal} conversationId=${managedConvId ?? "none"}
+    console.log(`[process-exit] pid=${proc.pid} code=${code} signal=${signal} sessionKey=${sessionKey ?? "none"} conversationId=${managedConvId}`);
+    if (!streamLog.destroyed && !streamLog.writableEnded) streamLog.write(`[${isoTs()}] [process-exit] pid=${proc.pid} code=${code} signal=${signal} conversationId=${managedConvId}
 `);
     if (sessionKey) activeProcesses.delete(sessionKey);
   });
@@ -9507,7 +9758,11 @@ async function* invokePublicAgent(message, systemPrompt, accountId, accountDir,
     yield { type: "done" };
     return;
   }
-  const streamLog = agentLogStream("public-agent-stream", accountDir);
+  const publicConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
+  if (!publicConvId) {
+    throw new Error(`invokePublicAgent: conversationId missing for sessionKey=${sessionKey?.slice(0, 8) ?? "none"} \u2014 ensureConversation must run first`);
+  }
+  const streamLog = agentLogStream("public-agent-stream", accountDir, publicConvId);
   streamLog.write(`[${isoTs()}] [public-user-message] ${JSON.stringify(message)}
 `);
   if (sessionKey) {
@@ -9780,6 +10035,8 @@ async function* compactSession(sessionKey) {
   }
   const currentSessionId = getAgentSessionId(sessionKey);
   if (!currentSessionId) return { ok: false, reason: "no-session" };
+  const compactionConvId = getConversationIdForSession(sessionKey);
+  if (!compactionConvId) return { ok: false, reason: "no-conversation" };
   const identity = readIdentity(account.accountDir, "admin");
   const defaultSystemPrompt = "You are an admin agent. Full access. Professional, concise. British English. Be proactive \u2014 tell the user what needs doing and do it.";
   const baseSystemPrompt = identity ?? defaultSystemPrompt;
@@ -9787,7 +10044,7 @@ async function* compactSession(sessionKey) {
   const systemPrompt = outputStyle === "explanatory" ? `${baseSystemPrompt}
 
 ${EXPLANATORY_STYLE_INSTRUCTIONS}` : baseSystemPrompt;
-  const compactionIter = runCompactionTurn(account.accountDir, account.accountId, systemPrompt, currentSessionId, account.config.adminModel, account.config.enabledPlugins);
+  const compactionIter = runCompactionTurn(account.accountDir, account.accountId, systemPrompt, currentSessionId, account.config.adminModel, compactionConvId, account.config.enabledPlugins);
   let step = await compactionIter.next();
   while (!step.done) {
     yield step.value;
@@ -10204,6 +10461,38 @@ function defaultRules() {
       thresholdWindowMinutes: 5,
       scope: "session",
       suggestedAction: 'The same conversation has logged multiple tool failures. Use the admin `logs-read` MCP tool with `type: "system"` (or the `logs-read.sh` script with the conversationId) to retrieve the adjacent [tool-failure-diag] lines and identify whether the cause is DNS, TCP, HTTP, or the tool\'s internal pipeline \u2014 then adapt the next attempt to match. Never retry the same tool against the same target without diagnostic-grounded reasoning.'
+    },
+    {
+      // Task 532: closes the "60-second black-box tool wait" class. Fires when
+      // a tool hits the 30-second mark of the mid-flight heartbeat. The
+      // pattern anchors on elapsed=30s specifically (the tool-wait tick emits
+      // one line per 5s per tool, so matching every tick would be noisy) and
+      // excludes tools whose long runtime is expected: `Task`/`Agent` subagent
+      // dispatch, `Bash` with explicit long timeouts.
+      id: "tool-wait-long-stall",
+      name: "Tool wait exceeds 30 seconds (possible stall)",
+      type: "repeated-error",
+      logSource: "system",
+      pattern: "\\[tool-wait\\][^\\n]*name=(?!Task\\b|Agent\\b|Bash\\b)[A-Za-z0-9_]+[^\\n]*elapsed=30s",
+      thresholdCount: 0,
+      thresholdWindowMinutes: 0,
+      scope: "session",
+      suggestedAction: "A tool call has been pending for 30 seconds without a result. Read the adjacent [tool-wait-diag] and [tool-wait-proc] lines in the conversation's stream log to determine whether the network remained healthy, the subprocess held active sockets, and the HTTP request reached the wire. If diag shows a healthy network but the subprocess has no [subproc-stderr] UNDICI/HTTP activity during the wait window, the tool's internal pipeline is stalled \u2014 do not retry the same request against the same target without a change in approach."
+    },
+    {
+      // Task 533: surface every Cloudflare-plugin refusal. The plugin emits
+      // exactly one [cloudflare:refuse] line per refusal with a structured
+      // reason field; any single occurrence on a previously-clean device
+      // means scope, account-binding, or post-flight FQDN drift — the
+      // operator should run cf-verify before acting.
+      id: "cloudflare-refuse",
+      name: "Cloudflare plugin refusal",
+      type: "silent-catch",
+      logSource: "any",
+      pattern: "\\[cloudflare:refuse\\]|\\[cloudflare:post-flight-mismatch\\]",
+      thresholdCount: 0,
+      thresholdWindowMinutes: 0,
+      suggestedAction: "The Cloudflare plugin refused an operation or detected a post-flight FQDN mismatch. Run `cf-verify` to inspect current device state. If the reason is `account-drift` or `unbound-device`, run `tunnel-login force=true` to clear cert + binding and re-authenticate. If the reason is `scope-mismatch`, the requested hostname is outside the brand's declared zones \u2014 fix at brand.json + republish. If `post-flight-fqdn-mismatch`, run `cf-rebuild` to reconcile."
     }
   ];
 }
@@ -10419,12 +10708,31 @@ function discoverSourceFiles(configDir2, accountLogDir2, logicalSource) {
   }[logicalSource];
   if (!existsSync8(accountLogDir2)) return [];
   const files = [];
+  let scanned = 0;
+  let skippedPrefixMismatch = 0;
+  let skippedNotLog = 0;
   for (const entry of readdirSync3(accountLogDir2)) {
-    if (entry.startsWith(prefix) && entry.endsWith(".log")) {
+    scanned += 1;
+    const matchesPrefix = entry.startsWith(prefix);
+    const isLog = entry.endsWith(".log");
+    if (matchesPrefix && isLog) {
       files.push({ logicalSource, filepath: join5(accountLogDir2, entry) });
+    } else if (!matchesPrefix) {
+      skippedPrefixMismatch += 1;
+    } else {
+      skippedNotLog += 1;
     }
   }
-  files.sort((a, b) => a.filepath.localeCompare(b.filepath));
+  files.sort((a, b) => {
+    try {
+      return statSync5(b.filepath).mtimeMs - statSync5(a.filepath).mtimeMs;
+    } catch {
+      return a.filepath.localeCompare(b.filepath);
+    }
+  });
+  if (skippedPrefixMismatch > 0 || skippedNotLog > 0) {
+    console.error(`[review-scan-skip] dir=${accountLogDir2} source=${logicalSource} prefix=${prefix} scanned=${scanned} matched=${files.length} skipped_prefix=${skippedPrefixMismatch} skipped_non_log=${skippedNotLog}`);
+  }
   return files;
 }
 function discoverAllSources(configDir2, accountLogDir2) {
@@ -28308,8 +28616,9 @@ async function POST2(req) {
       { status: 500, headers: { "Content-Type": "application/json" } }
     );
   }
-  const sseLog = agentLogStream("sse-events", account.accountDir);
-  const sk = getConversationIdForSession(session_key)?.slice(0, 8) ?? session_key.slice(0, 8);
+  const publicSseConvId = getConversationIdForSession(session_key);
+  const sseLog = publicSseConvId ? agentLogStream("sse-events", account.accountDir, publicSseConvId) : preConversationLogStream("sse-events", account.accountDir);
+  const sk = publicSseConvId?.slice(0, 8) ?? session_key.slice(0, 8);
   const agentName = getAgentNameForSession(session_key);
   if (!agentName) {
     console.log(`[chat] no agent for session=${sk} \u2014 session expired or server restarted`);
@@ -30684,7 +30993,8 @@ async function POST21(req) {
   try {
     const parsed = JSON.parse(message);
     if (parsed._lifecycle) {
-      const lifecycleLog = agentLogStream("component-lifecycle", account.accountDir);
+      const lifecycleConvId = getConversationIdForSession(session_key);
+      const lifecycleLog = lifecycleConvId ? agentLogStream("component-lifecycle", account.accountDir, lifecycleConvId) : preConversationLogStream("component-lifecycle", account.accountDir);
       const ts = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
       const detail = parsed.filePath ? ` filePath=${parsed.filePath}` : "";
       lifecycleLog.write(`[${ts}] [component:${parsed.component ?? "unknown"}] ${parsed.event ?? "unknown"}${detail}
@@ -30708,7 +31018,8 @@ async function POST21(req) {
   try {
     const parsed = JSON.parse(message);
     if (isComponentDone(parsed)) {
-      const componentLog = agentLogStream("component-lifecycle", account.accountDir);
+      const componentConvId = getConversationIdForSession(session_key);
+      const componentLog = componentConvId ? agentLogStream("component-lifecycle", account.accountDir, componentConvId) : preConversationLogStream("component-lifecycle", account.accountDir);
       const ts = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
       message = transformComponentDone(parsed);
       componentLog.write(`[${ts}] [component:${parsed.component}] componentDone \u2192 transformed
@@ -30736,8 +31047,9 @@ async function POST21(req) {
     gatewayResult = await processInbound(message, "web-admin");
   }
   const encoder = new TextEncoder();
-  const sseLog = agentLogStream("sse-events", account.accountDir);
-  const sk = getConversationIdForSession(session_key)?.slice(0, 8) ?? session_key.slice(0, 8);
+  const sseConvId = getConversationIdForSession(session_key);
+  const sseLog = sseConvId ? agentLogStream("sse-events", account.accountDir, sseConvId) : preConversationLogStream("sse-events", account.accountDir);
+  const sk = sseConvId?.slice(0, 8) ?? session_key.slice(0, 8);
   const readable = new ReadableStream({
     async start(controller) {
       try {
@@ -30853,6 +31165,7 @@ async function GET9(request) {
   const { searchParams } = new URL(request.url);
   const fileParam = searchParams.get("file");
   const typeParam = searchParams.get("type");
+  const conversationIdParam = searchParams.get("conversationId");
   const download = searchParams.get("download") === "1";
   const account = resolveAccount();
   const accountLogDir2 = account ? resolve19(account.accountDir, "logs") : null;
@@ -30872,18 +31185,21 @@ async function GET9(request) {
     return Response.json({ error: `File not found: ${safe}` }, { status: 404 });
   }
   if (typeParam) {
-    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const typeMap = {
-      stream: `claude-agent-stream-${today}.log`,
-      error: `claude-agent-stderr-${today}.log`,
-      session: `sse-events-${today}.log`,
-      sse: `sse-events-${today}.log`,
-      public: `public-agent-stream-${today}.log`
+    const prefixMap = {
+      stream: "claude-agent-stream",
+      error: "claude-agent-stderr",
+      session: "sse-events",
+      sse: "sse-events",
+      public: "public-agent-stream"
     };
-    const fileName = typeMap[typeParam];
-    if (!fileName) {
+    const prefix = prefixMap[typeParam];
+    if (!prefix) {
       return Response.json({ error: `Unknown type: ${typeParam}. Valid: stream, error, session, sse, public` }, { status: 400 });
     }
+    if (!conversationIdParam) {
+      return Response.json({ error: `type=${typeParam} requires conversationId (per-conversation log files, no daily fallback)` }, { status: 400 });
+    }
+    const fileName = `${prefix}-${conversationIdParam}.log`;
     for (const dir of [accountLogDir2, LOG_DIR]) {
       if (!dir) continue;
       const filePath = resolve19(dir, fileName);
@@ -31589,7 +31905,7 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join13(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join13(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync26(ALIAS_DOMAINS_PATH)) return null;
@@ -32082,7 +32398,7 @@ function cachedHtml(file2) {
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join13(homedir3(), BRAND.configDir);
+  const configDir2 = join13(homedir4(), BRAND.configDir);
   try {
     const accountJsonPath = join13(configDir2, "account.json");
     if (!existsSync26(accountJsonPath)) return null;
@@ -32098,7 +32414,7 @@ function loadBrandingCache(agentSlug) {
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join13(homedir3(), BRAND.configDir);
+    const configDir2 = join13(homedir4(), BRAND.configDir);
     const accountJsonPath = join13(configDir2, "account.json");
     if (!existsSync26(accountJsonPath)) return null;
     const account = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));