@sealant/mend 0.36.0-next.658 → 0.36.0-next.663

package/dist/main.js

@@ -17,7 +17,6 @@ import {
   WORKTREE_REMOVAL_FORCE_HINT,
   agentIsLive,
   agentMemoryNameOf,
-  agentOutcome,
   agentStartingFacts,
   agentStartingLine,
   askYesNo,
@@ -48,6 +47,7 @@ import {
   normalizeRemoteUrl,
   parseLaunchArgs,
   pasteBytes,
+  redactCredentials,
   replaceConfirmLines,
   repositoryCloneUrlIssue,
   sameGrant,
@@ -68,7 +68,7 @@ import {
   workspaceRetirementLine,
   worktreeJoinLine,
   worktreeListsPeople
-} from "./chunk-GKRTZRV7.js";
+} from "./chunk-VOP6USOZ.js";
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
@@ -1962,13 +1962,71 @@ var COMMANDS = [
     name: "run",
     section: "sessions",
     summary: "run any command as a session",
-    synopsis: ["[--project <p>] -- <command...>"],
+    synopsis: [
+      "[--project <p>] [--name <n> | --worktree <n>] [--base <ref>] [--detach] [--json] -- <command...>"
+    ],
     description: [
-      "The same worktree, record, and review as mend codex, with a command of your own in place of a harness. Everything after -- is the command."
+      "The same worktree, record, and review as mend codex, with a command of your own in place of a harness. Everything after -- is the command.",
+      "The command's output is printed as the record has it, and mend run exits with the command's exit code. It runs in a terminal, so stdout and stderr arrive together, on stdout. What Mend says itself goes to stderr, so out=$(mend run -- git log -1) holds the command's output and nothing else. Ctrl+C stops watching and puts the terminal back; the command keeps running, and mend logs and mend wait pick it up again. A signal exits 128 + its number: 130 for SIGINT (Ctrl+C), 129 for SIGHUP, 143 for SIGTERM. A second signal exits at once, and an exit waits at most 5 seconds for a reader that takes nothing, then says the output may be incomplete.",
+      "Output this terminal could not be given in full (a read the server refused, a reader that went away) fails mend run with exit 1 even when the command succeeded, and the command's own code is said on stderr: a script never takes cut output for the whole of it.",
+      "The platform takes at most 64 words, none empty and none starting or ending with whitespace (a script that starts with a newline, for example). Such a command is refused before anything is created; trim the word and run it again.",
+      "With --detach, mend run returns once the command runs. With --json, stdout carries one JSON object in place of the output: the session id, the process id, the worktree, the branch, and the process's status and exit code as last observed, which is how it ended without --detach (and with it, when the command ended first).",
+      "Workspaces set PAGER=cat, so git log and friends print instead of waiting for a pager the image does not have. A project variable of the same name, or the pager in your own git config, wins."
     ],
-    options: [project()],
-    examples: [{ command: "mend run -- aider --model gpt-5", text: "" }],
-    see: ["codex"]
+    options: [
+      project(),
+      { flag: "--name <n>", text: "name the worktree; an existing name joins it" },
+      { flag: "--worktree <n>", text: "join an existing worktree only" },
+      { flag: "--base <ref>", text: "create the worktree from another git base" },
+      { flag: "--detach, -d", text: "return once the command runs" },
+      { flag: "--json", text: "print the session and process ids, and the end, as JSON" }
+    ],
+    examples: [
+      { command: "mend run -- pnpm test", text: "the test output here, exit code included" },
+      {
+        command: "id=$(mend run --detach --json -- make build | jq -r .sessionId)",
+        text: "start it, then mend wait $id"
+      }
+    ],
+    see: ["logs", "wait", "codex"]
+  },
+  {
+    name: "logs",
+    section: "sessions",
+    summary: "print a session's recorded terminal output",
+    synopsis: ["[session] [--follow] [--from <sequence>] [--process <id>]"],
+    description: [
+      "Prints what the session's command (or agent) wrote to its terminal, as the record holds it, on stdout. Settled sessions count: the record outlives the process and the workspace. --follow keeps printing until the process ends. The record is printed as it is, nothing taken out: anyone who can read the project can read it, so what a command printed, a password included, reaches them too. A signal stops it and puts the terminal back, exiting 128 + its number: 130 for SIGINT (Ctrl+C), 129 for SIGHUP, 143 for SIGTERM.",
+      "<session> is the session id, a prefix of it, or the worktree's name. With none, the one live session is taken. --process reads another process of the session, a shell or a Service attempt, by a prefix of its id."
+    ],
+    options: [
+      { flag: "--follow, -f", text: "keep printing until the process ends" },
+      { flag: "--from <sequence>", text: "start at a record sequence. Default: 0" },
+      { flag: "--process <id>", text: "another process of the session, by a prefix of its id" }
+    ],
+    examples: [{ command: "mend logs 3f2a --follow", text: "" }],
+    see: ["run", "wait", "service logs"]
+  },
+  {
+    name: "wait",
+    section: "sessions",
+    summary: "wait for a session's command to end",
+    synopsis: ["[session] [--timeout <seconds>] [--process <id>] [--json]"],
+    description: [
+      "Returns once the session's command (or agent) has ended, with its exit code: the code the platform reported, or 1 when it reported none. A command that already ended answers at once. While a launch or a resume is starting, the previous process's end does not count. --process waits for one process by its id, the processId mend run --json prints.",
+      "When --timeout passes first, mend wait exits 124, as timeout(1) does, and the command keeps running. Stopped by a signal, it exits 128 + its number (130 for Ctrl+C), and the command keeps running. The timeout covers everything: finding the session, every read and every retry. --json then prints the last state read, and nothing more is asked of the server.",
+      "<session> is the session id, a prefix of it, or the worktree's name. With none, the one live session is taken."
+    ],
+    options: [
+      { flag: "--timeout <seconds>", text: "give up after this long; exit 124" },
+      {
+        flag: "--process <id>",
+        text: "wait for this process of the session, by a prefix of its id"
+      },
+      { flag: "--json", text: "print the session, the process, the status and the exit code" }
+    ],
+    examples: [{ command: "mend wait 3f2a --timeout 600", text: "" }],
+    see: ["run", "logs"]
   },
   {
     name: "continue",
@@ -2074,8 +2132,13 @@ var COMMANDS = [
     name: "projects",
     section: "sessions",
     summary: "adopted projects and their live sessions",
-    synopsis: [],
-    description: ["One line per project, with the sessions running in it."],
+    synopsis: ["[--json]"],
+    description: [
+      "One line per project, with the sessions running in it.",
+      '--json prints them for scripts, stable like mend sessions --json: {"version": 1, "projects": [...]}, an empty list when there are none. Each project has id, name, originUrl (a string, or null), defaultBranch, storePath, liveSessions (a number) and current (true when the current directory is inside it).',
+      "A repository URL is printed without its credentials: https://oauth2:TOKEN@github.com/acme/repo.git reads as https://github.com/acme/repo.git, here and in every line, message and JSON the CLI prints itself; an ssh URL keeps its user and loses only the password. A command's recorded output (mend run, mend logs, mend service logs, mend attach) and a file's contents (mend memory show) are printed as they are, and a session's record is readable by anyone who can read the project."
+    ],
+    options: [{ flag: "--json", text: "the projects as JSON" }],
     see: ["adopt", "sessions"]
   },
   {
@@ -2156,14 +2219,19 @@ var COMMANDS = [
     section: "services",
     summary: "start and supervise a server in the session's workspace",
     synopsis: [
-      "[session] --port <port> [--name <n>] [--udp] [--http|--https] [--no-connect] -- <command...>",
-      "[session] <name> [--no-connect]"
+      "[session] --port <port> [--name <n>] [--udp] [--http|--https] [--wait] [--no-connect] -- <command...>",
+      "[session] <name> [--wait] [--no-connect]"
     ],
     description: [
       "With --, the command after it is started in the workspace and supervised: its output is recorded, and mend service restart re-runs it. Without --, the name is a Service declared in the worktree's mend.toml. mend service <name> is the shorthand for that.",
+      "Mend waits up to a minute for the port to answer before it returns. --wait makes the exit status say how that ended: 0 once the port answered, 1 when it did not, and 124 when the server gave no answer within 90 seconds. The Service keeps running in every case. A waited start returns and opens no tunnel; mend service connect reaches the port. UDP has no probe, and a recipe that declares only a port is adopted with one probe, so --wait takes neither.",
       "The port is tunnelled to this machine's loopback as soon as it listens, unless --no-connect."
     ],
     options: [
+      {
+        flag: "--wait",
+        text: "exit 1 when the port did not answer, 124 with no answer in 90 s; no tunnel"
+      },
       { flag: "--port <port>", text: "the port the command listens on inside the workspace" },
       { flag: "--name <n>", text: "the service's name. Default: the command" },
       { flag: "--udp", text: "a UDP port" },
@@ -2216,7 +2284,10 @@ var COMMANDS = [
     section: "services",
     summary: "follow a supervised service's output",
     synopsis: ["<name-or-id> [--from <sequence>]"],
-    description: ["Replays the recorded output, then follows it live. Ctrl-C stops following."],
+    description: [
+      "Replays the recorded output, then follows it live. Ctrl-C stops following.",
+      "The record is printed as it is, nothing taken out, and anyone who can read the project can read it: what the Service printed, a password included, reaches them too."
+    ],
     options: [{ flag: "--from <sequence>", text: "start the replay at a record sequence" }],
     see: ["service run"]
   },
@@ -3998,8 +4069,10 @@ var doctorCommand = async (config, localCredential2, claudeGrant2) => {
     onPath,
     dockerShutdown: observeHostShutdownTimeout
   });
-  for (const check of checks) process.stdout.write(`${formatCheck(check, paintMark)}
+  for (const check of checks) {
+    process.stdout.write(`${redactCredentials(formatCheck(check, paintMark))}
 `);
+  }
   if (checks.some((check) => check.state === "failed")) process.exitCode = 1;
 };
 
@@ -4197,10 +4270,10 @@ var paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text
 var dim = paint("2");
 var green = paint("32");
 var amber = paint("33");
-var say = (line) => process.stdout.write(`${line}
+var say = (line) => process.stdout.write(`${redactCredentials(line)}
 `);
 var fail = (message) => {
-  process.stderr.write(`mend: ${message}
+  process.stderr.write(`mend: ${redactCredentials(message)}
 `);
   process.exit(1);
 };
@@ -4667,10 +4740,10 @@ import * as os7 from "node:os";
 var paint2 = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${text}\x1B[0m` : text;
 var dim2 = paint2("2");
 var green2 = paint2("32");
-var say2 = (line) => process.stdout.write(`${line}
+var say2 = (line) => process.stdout.write(`${redactCredentials(line)}
 `);
 var fail2 = (message) => {
-  process.stderr.write(`mend: ${message}
+  process.stderr.write(`mend: ${redactCredentials(message)}
 `);
   process.exit(1);
 };
@@ -4761,10 +4834,10 @@ var paint3 = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m$
 var dim3 = paint3("2");
 var green3 = paint3("32");
 var cobalt = paint3("34");
-var say3 = (line) => process.stdout.write(`${line}
+var say3 = (line) => process.stdout.write(`${redactCredentials(line)}
 `);
 var fail3 = (message) => {
-  process.stderr.write(`mend: ${message}
+  process.stderr.write(`mend: ${redactCredentials(message)}
 `);
   process.exit(1);
 };
@@ -4942,10 +5015,10 @@ import * as path12 from "node:path";
 var paint4 = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim4 = paint4("2");
 var green4 = paint4("32");
-var say4 = (line) => process.stdout.write(`${line}
+var say4 = (line) => process.stdout.write(`${redactCredentials(line)}
 `);
 var fail4 = (message) => {
-  process.stderr.write(`mend: ${message}
+  process.stderr.write(`mend: ${redactCredentials(message)}
 `);
   process.exit(1);
 };
@@ -5569,6 +5642,208 @@ var piProfileLines = (scan) => {
   ];
 };
 
+// src/run-scripts.ts
+var RUN_ARGV_MAX = 64;
+var whitespaceName = (character) => character === "\n" || character === "\r" ? "a newline" : character === "	" ? "a tab" : character === " " ? "a space" : "whitespace";
+var runArgvIssue = (argv) => {
+  if (argv.length > RUN_ARGV_MAX) {
+    return `the command has ${argv.length} words and the platform takes at most ${RUN_ARGV_MAX} \xB7 put them in a script and run that`;
+  }
+  for (const [index, word] of argv.entries()) {
+    const which = index === 0 ? "the program" : `argument ${index}`;
+    if (word === "") {
+      return `${which} is empty \xB7 the platform refuses empty arguments`;
+    }
+    if (word.trim() !== word) {
+      const leading = word.trimStart() !== word;
+      const edge = leading ? word.charAt(0) : word.charAt(word.length - 1);
+      return `${which} ${leading ? "starts" : "ends"} with ${whitespaceName(edge)} \xB7 the platform refuses arguments with leading or trailing whitespace \xB7 trim it and run again`;
+    }
+  }
+  return null;
+};
+var pickProcess = (detail, prefix) => {
+  const processes = detail.processes ?? [];
+  if (prefix !== null) {
+    const matches = processes.filter((candidate) => candidate.id?.startsWith(prefix) === true);
+    const [only] = matches;
+    if (matches.length > 1) {
+      return { error: `"${prefix}" matches ${matches.length} processes; type more of the id` };
+    }
+    if (only === void 0) return { error: `no process of this session matches "${prefix}"` };
+    return { process: only };
+  }
+  const chosen = detail.currentAgent ?? processes.at(-1);
+  if (chosen === void 0) return { error: "this session has run nothing yet" };
+  return { process: chosen };
+};
+var SETTLED2 = /* @__PURE__ */ new Set(["completed", "failed", "stopped"]);
+var processRowOf = (detail, processId) => {
+  const rows = [
+    ...detail.currentAgent === null ? [] : [detail.currentAgent],
+    ...detail.processes ?? []
+  ].filter((row) => row.id === processId);
+  return rows.find((row) => row.exitedAt !== null) ?? rows[0];
+};
+var commandEndOf = (detail, processId = null) => {
+  const settled = SETTLED2.has(detail.session.status);
+  if (processId !== null) {
+    const target = processRowOf(detail, processId);
+    if (target !== void 0 && target.exitedAt !== null) {
+      return { processId, status: target.status, exitCode: target.exitCode };
+    }
+    if (settled) {
+      return { processId, status: detail.session.status, exitCode: target?.exitCode ?? null };
+    }
+    return null;
+  }
+  if (detail.session.status === "starting") return null;
+  const agent = detail.currentAgent;
+  if (agent !== null && agent.exitedAt !== null) {
+    return { processId: agent.id ?? null, status: agent.status, exitCode: agent.exitCode };
+  }
+  if (settled) {
+    return {
+      processId: agent?.id ?? null,
+      status: detail.session.status,
+      exitCode: agent?.exitCode ?? null
+    };
+  }
+  return null;
+};
+var exitStatusOf = (end) => end.exitCode !== null && Number.isInteger(end.exitCode) && end.exitCode >= 0 && end.exitCode <= 255 ? end.exitCode : 1;
+var endLine = (end) => `${end.status} \xB7 ${end.exitCode === null ? "no exit code reported" : `code ${end.exitCode}`}`;
+var isRefusal = (error) => error instanceof MendRequestError && error.kind === "http" && (error.status === null || !GATEWAY_STATUSES.has(error.status));
+var beforeDeadline = async (work, clock2, deadline) => {
+  if (deadline === null) return { done: true, value: await work };
+  const left = deadline - clock2.now();
+  if (left <= 0) {
+    work.catch(() => void 0);
+    return { done: false };
+  }
+  const timer = new AbortController();
+  try {
+    return await Promise.race([
+      work.then((value) => ({ done: true, value })),
+      clock2.sleep(left, timer.signal).then(() => ({ done: false }))
+    ]);
+  } finally {
+    timer.abort();
+  }
+};
+var readThrough = async (read, clock2, deadline) => {
+  const unreachableAfterMs = clock2.unreachableAfterMs ?? 6e4;
+  const since = clock2.now();
+  for (; ; ) {
+    try {
+      return await beforeDeadline(read(), clock2, deadline);
+    } catch (error) {
+      if (isRefusal(error) || clock2.now() - since >= unreachableAfterMs) throw error;
+      const pause2 = deadline === null ? clock2.pollMs ?? 1e3 : Math.min(clock2.pollMs ?? 1e3, deadline - clock2.now());
+      if (pause2 <= 0) return { done: false };
+      await clock2.sleep(pause2);
+    }
+  }
+};
+var unbounded = async (read, clock2) => {
+  const got = await readThrough(read, clock2, null);
+  if (!got.done) throw new Error("a read with no deadline timed out");
+  return got.value;
+};
+var followLogs = async (options) => {
+  const pollMs = options.pollMs ?? 250;
+  const quietReadsAfterEnd = options.quietReadsAfterEnd ?? 2;
+  let cursor = options.from;
+  let quiet = 0;
+  for (; ; ) {
+    const from = cursor;
+    const page = await unbounded(() => options.read(from), options);
+    for (const chunk of page.chunks) await options.write(Buffer.from(chunk.dataBase64, "base64"));
+    const advanced = page.nextFrom !== cursor;
+    cursor = page.nextFrom;
+    if (advanced) {
+      quiet = 0;
+      continue;
+    }
+    if (!options.follow) return { next: cursor, status: page.status };
+    if (page.status === "exited" || page.status === "failed") {
+      quiet += 1;
+      if (quiet >= quietReadsAfterEnd) return { next: cursor, status: page.status };
+    }
+    await options.sleep(pollMs);
+  }
+};
+var waitForCommand = async (options) => {
+  const pollMs = options.pollMs ?? 1e3;
+  let last = null;
+  for (; ; ) {
+    const got = await readThrough(options.read, options, options.deadline);
+    if (!got.done) return { kind: "timeout", last };
+    last = got.value;
+    const end = commandEndOf(got.value, options.processId);
+    if (end !== null) return { kind: "ended", end };
+    const left = options.deadline === null ? pollMs : Math.min(pollMs, options.deadline - options.now());
+    if (left <= 0) return { kind: "timeout", last };
+    await options.sleep(left);
+  }
+};
+var splitArgs = (args, valued, switches) => {
+  const values = /* @__PURE__ */ new Map();
+  const on = /* @__PURE__ */ new Set();
+  let session = null;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (valued.includes(arg)) {
+      const value = args[index + 1];
+      if (value === void 0) return { error: `${arg} needs a value` };
+      values.set(arg, value);
+      index += 1;
+    } else if (switches.includes(arg)) {
+      on.add(arg);
+    } else if (arg.startsWith("-")) {
+      return { error: `unknown flag ${arg}` };
+    } else if (session !== null) {
+      return { error: `one session only; "${arg}" is extra` };
+    } else {
+      session = arg;
+    }
+  }
+  return { values, on, session };
+};
+var parseLogsArgs = (args) => {
+  const split = splitArgs(args, ["--from", "--process"], ["--follow", "-f"]);
+  if ("error" in split) return split;
+  const from = split.values.get("--from") ?? "0";
+  if (!/^(0|[1-9]\d*)$/u.test(from)) return { error: "--from takes a record sequence, e.g. 0" };
+  return {
+    args: {
+      session: split.session,
+      follow: split.on.has("--follow") || split.on.has("-f"),
+      from,
+      process: split.values.get("--process") ?? null
+    }
+  };
+};
+var parseWaitArgs = (args) => {
+  const split = splitArgs(args, ["--timeout", "--process"], ["--json"]);
+  if ("error" in split) return split;
+  const timeout = split.values.get("--timeout");
+  const seconds2 = timeout === void 0 ? null : Number(timeout);
+  if (seconds2 !== null && !(Number.isFinite(seconds2) && seconds2 > 0)) {
+    return { error: "--timeout takes a number of seconds above 0" };
+  }
+  return {
+    args: {
+      session: split.session,
+      process: split.values.get("--process") ?? null,
+      timeoutMs: seconds2 === null ? null : Math.ceil(seconds2 * 1e3),
+      json: split.on.has("--json")
+    }
+  };
+};
+var WAIT_TIMED_OUT = 124;
+var isSessionId = (word) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(word);
+
 // src/secret-files.ts
 import * as path14 from "node:path";
 var secretFilePathOf = (input, home) => {
@@ -8337,7 +8612,7 @@ var nodeServerRuntime = () => {
     },
     randomBytes,
     sleep: (milliseconds) => new Promise((resolve8) => setTimeout(resolve8, milliseconds)),
-    writeLine: (line) => process.stdout.write(`${line}
+    writeLine: (line) => process.stdout.write(`${redactCredentials(line)}
 `),
     dockerDaemonFacts: hostDockerDaemonFacts,
     readLogin: (configDir) => savedLogin(configDir, environment)
@@ -9317,7 +9592,7 @@ var ansi = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${t
 var dim5 = ansi("2");
 var green5 = ansi("32");
 var warn = ansi("33");
-var say5 = (line) => console.log(line);
+var say5 = (line) => console.log(redactCredentials(line));
 var sshConfigPath = () => path19.join(os12.homedir(), ".ssh", "config");
 var flagValue2 = (args, flag) => {
   const index = args.indexOf(flag);
@@ -9757,10 +10032,10 @@ var upgradeUrl = async (input) => {
 var paint5 = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${text}\x1B[0m` : text;
 var dim6 = paint5("2");
 var green6 = paint5("32");
-var say6 = (line) => process.stdout.write(`${line}
+var say6 = (line) => process.stdout.write(`${redactCredentials(line)}
 `);
 var fail6 = (message) => {
-  process.stderr.write(`mend: ${message}
+  process.stderr.write(`mend: ${redactCredentials(message)}
 `);
   process.exit(1);
 };
@@ -9922,7 +10197,7 @@ var loadConfig = () => {
   };
 };
 var fail7 = (message) => {
-  process.stderr.write(`mend: ${message}
+  process.stderr.write(`mend: ${redactCredentials(message)}
 `);
   process.exit(1);
 };
@@ -9933,12 +10208,16 @@ var parseMendUrl = (value) => {
     return fail7(`"${value}" is not a valid Mend URL`);
   }
 };
-var paint6 = (code) => (text) => process.stdout.isTTY ? `\x1B[${code}m${text}\x1B[0m` : text;
+var chrome = process.stdout;
+var chromeToStderr = () => {
+  chrome = process.stderr;
+};
+var paint6 = (code) => (text) => chrome.isTTY ? `\x1B[${code}m${text}\x1B[0m` : text;
 var dim7 = paint6("2");
 var green7 = paint6("32");
 var amber2 = paint6("33");
 var cobalt2 = paint6("34");
-var say7 = (line) => process.stdout.write(`${line}
+var say7 = (line) => chrome.write(`${redactCredentials(line)}
 `);
 var detachKeyEnabled = process.env["MEND_DETACH_KEY"] !== "none";
 var detachHint = () => detachKeyEnabled ? ` \xB7 detach: ${dim7("Ctrl+]")}` : "";
@@ -10077,15 +10356,15 @@ var socketUrl = (config, target, params, extra, signal) => upgradeUrl({
 });
 var boundApi = (config) => (method, route, body) => api(config, method, route, body);
 var withSpinner = async (label, work) => {
-  if (process.stdout.isTTY !== true) return work;
+  if (chrome.isTTY !== true) return work;
   const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
   const started = Date.now();
   let frame = 0;
   const timer = setInterval(() => {
     const seconds2 = Math.round((Date.now() - started) / 1e3);
     const text = typeof label === "string" ? label : label();
-    process.stdout.write(
-      `\r\x1B[2K  ${frames[frame % frames.length]} ${text} ${dim7(`${seconds2}s`)} `
+    chrome.write(
+      `\r\x1B[2K  ${frames[frame % frames.length]} ${redactCredentials(text)} ${dim7(`${seconds2}s`)} `
     );
     frame += 1;
   }, 120);
@@ -10093,7 +10372,7 @@ var withSpinner = async (label, work) => {
     return await work;
   } finally {
     clearInterval(timer);
-    process.stdout.write("\r\x1B[2K");
+    chrome.write("\r\x1B[2K");
   }
 };
 var followStarting = async (config, sessionId, label, start) => {
@@ -10114,7 +10393,7 @@ var followStarting = async (config, sessionId, label, start) => {
         read: () => request(config, "GET", `/sessions/${sessionId}`),
         onLine: (next) => {
           line = next === "starting" ? label : next;
-          if (process.stdout.isTTY !== true) say7(dim7(`  ${next}`));
+          if (chrome.isTTY !== true) say7(dim7(`  ${next}`));
         },
         sleep: sleep3,
         now: Date.now
@@ -10301,8 +10580,12 @@ var workspaceLinesOf = async (config, sessions) => {
   );
 };
 var launch = async (config, harness, args) => {
+  if (harness === "run") chromeToStderr();
   const parsed = parseLaunchArgs(args);
   if (parsed.error !== null) return fail7(parsed.error);
+  if (harness !== "run" && parsed.json) {
+    return fail7(`mend ${harness} takes no --json \xB7 mend run --json prints what it started`);
+  }
   const structured = parsed.prompt !== null || parsed.model !== null || parsed.effort !== null || parsed.ask || parsed.fast;
   if (harness === "run" && structured) {
     return fail7(`mend run takes no prompt or harness flags \xB7 ${usageOf("run")}`);
@@ -10312,15 +10595,17 @@ var launch = async (config, harness, args) => {
       "mend run takes no landing flags \u2014 a command has no turns to land after; land it with mend land"
     );
   }
-  if (harness === "run" && (parsed.detach || parsed.foreground)) {
+  if (harness === "run" && parsed.foreground) {
     return fail7(
-      "mend run takes no lifecycle flags \u2014 it tails the record; Ctrl+C stops watching, not the command"
+      "mend run takes no --foreground \u2014 Ctrl+C stops watching, not the command; mend stop ends it"
     );
   }
   const argv = harness === "run" ? parsed.custom : HARNESS_COMMANDS[harness] ?? [];
   if (argv.length === 0) {
     return fail7(harness === "run" ? usageOf("run") : `unknown harness ${harness}`);
   }
+  const argvIssue = harness === "run" ? runArgvIssue(argv) : null;
+  if (argvIssue !== null) return fail7(`${argvIssue} \xB7 nothing was created`);
   const project2 = await findProject(config, parsed.project, true);
   say7(
     `${green7("\u2713")} project ${project2.name} ${dim7(`\xB7 ${project2.defaultBranch}${parsed.project === null ? " \xB7 from cwd" : ""}`)}`
@@ -10392,7 +10677,7 @@ var launch = async (config, harness, args) => {
   );
   say7(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${session.id}`);
   if (harness === "run") {
-    return supervisedRun(config, session, argv);
+    return supervisedRun(config, session, argv, { detach: parsed.detach, json: parsed.json });
   }
   const launchBody = {
     ...parsed.prompt === null ? {} : { prompt: parsed.prompt },
@@ -10622,7 +10907,7 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
       watching = true;
       const members = await request(config, "GET", "/organization/members").catch(() => []);
       process.stdout.write(
-        `\r\x1B[2K${dim7(watchNotice(ownerNameOf(detail?.session.ownerUserId, members)))}\r
+        `\r\x1B[2K${dim7(redactCredentials(watchNotice(ownerNameOf(detail?.session.ownerUserId, members))))}\r
 ${dim7(`read-only \xB7 ${detachKeyEnabled ? "Ctrl+] or " : ""}Ctrl+C detaches`)}\r
 \r
 `
@@ -10668,10 +10953,7 @@ ${dim7(`read-only \xB7 ${detachKeyEnabled ? "Ctrl+] or " : ""}Ctrl+C detaches`)}
     ws?.removeEventListener("message", onTtyFrame);
     if (rawModeEnabled) process.stdin.setRawMode(false);
     if (interactive && ws !== null && process.stdout.isTTY === true) {
-      process.stdout.write(
-        "\x1B[<u\x1B[=0;1u\x1B[?2004l\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1006l\x1B[?1049l\x1B[?25h"
-        // show the cursor
-      );
+      process.stdout.write(TERMINAL_MODES_RESET);
     }
     process.stdin.pause();
     if (ws !== null && (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING))
@@ -10679,6 +10961,7 @@ ${dim7(`read-only \xB7 ${detachKeyEnabled ? "Ctrl+] or " : ""}Ctrl+C detaches`)}
     stopHerdrHint();
   }
 };
+var TERMINAL_MODES_RESET = "\x1B[<u\x1B[=0;1u\x1B[?2004l\x1B[?1000l\x1B[?1002l\x1B[?1003l\x1B[?1006l\x1B[?1049l\x1B[?25h";
 var stopSessionQuickly = async (config, sessionId) => {
   const headers = { "content-type": "application/json" };
   if (config.token !== null) headers["authorization"] = `Bearer ${config.token}`;
@@ -11121,19 +11404,48 @@ var autoConnect = async (config, service) => {
   say7(dim7("  remote server \u2014 tunneling the port here \xB7 Ctrl-C stops the tunnel, not the Service"));
   await tunnelServices(config, [service], null);
 };
+var SERVICE_WAIT_MS = (() => {
+  const configured = Number(process.env["MEND_SERVICE_WAIT_MS"]);
+  return Number.isFinite(configured) && configured > 0 ? configured : 9e4;
+})();
+var withinServiceWait = async (work, deadline) => {
+  const bounded = await beforeDeadline(work, clock, deadline);
+  if (bounded.done) return bounded.value;
+  process.stderr.write(
+    `mend: no answer within ${Math.round(SERVICE_WAIT_MS / 1e3)} s \xB7 the Service may still be starting \xB7 mend service list
+`
+  );
+  return exitFlushed(WAIT_TIMED_OUT);
+};
+var failUnlessAnswered = (config, service, wait) => {
+  if (!wait) return;
+  const name = service.label ?? service.id.slice(0, 8);
+  if (service.status !== "reachable") {
+    fail7(
+      `nothing answered on :${service.workspacePort} \xB7 ${service.status} \xB7 the Service keeps running \xB7 mend service logs ${name}`
+    );
+  }
+  if (willAutoConnect(config, service, false)) {
+    say7(dim7(`  connect: mend service connect ${name}`));
+  }
+};
 var serviceRun = async (config, args) => {
   const dashdash = args.indexOf("--");
   const usage2 = usageOf("service run");
+  const wait = (dashdash === -1 ? args : args.slice(0, dashdash)).includes("--wait");
+  const deadline = wait ? clock.now() + SERVICE_WAIT_MS : null;
   if (dashdash === -1) {
     const positionals = args.filter((a) => !a.startsWith("--"));
     const name2 = positionals.at(-1);
     if (name2 === void 0) return fail7(usage2);
     const prefix2 = positionals.length > 1 ? positionals[0] : void 0;
-    const session2 = await resolveLiveSession(config, prefix2, "service run");
-    const recipes = await api(
-      config,
-      "GET",
-      `/sessions/${session2.id}/recipes`
+    const session2 = await withinServiceWait(
+      resolveLiveSession(config, prefix2, "service run"),
+      deadline
+    );
+    const recipes = await withinServiceWait(
+      api(config, "GET", `/sessions/${session2.id}/recipes`),
+      deadline
     );
     const recipe = recipes.find((entry) => entry.name === name2);
     if (recipe === void 0) {
@@ -11142,16 +11454,28 @@ var serviceRun = async (config, args) => {
         recipes.length === 0 ? `no mend.toml recipes in this worktree \u2014 declare [service.${name2}] first` : `no recipe named "${name2}" \u2014 declared: ${known}`
       );
     }
+    if (wait && recipe.protocol === "udp") {
+      return fail7(`--wait needs a TCP port: ${recipe.name} is UDP, which has no probe`);
+    }
+    if (wait && recipe.command === null) {
+      return fail7(
+        `--wait needs a command Mend starts: ${recipe.name} declares only a port, which Mend adopts with one probe \xB7 run it without --wait, or give the recipe a command`
+      );
+    }
     const service2 = await withSpinner(
       recipe.command === null ? `adopting ${recipe.name} on :${recipe.port}\u2026` : recipe.protocol === "udp" ? `starting ${recipe.name} (udp :${recipe.port})\u2026` : `starting ${recipe.name} \u2014 waiting for :${recipe.port} to answer\u2026`,
-      mutateService(config, "POST", `/sessions/${session2.id}/services/recipe`, {
-        name: recipe.name
-      })
+      withinServiceWait(
+        mutateService(config, "POST", `/sessions/${session2.id}/services/recipe`, {
+          name: recipe.name
+        }),
+        deadline
+      )
     );
-    const tunneling2 = willAutoConnect(config, service2, args.includes("--no-connect"));
+    const tunneling2 = willAutoConnect(config, service2, args.includes("--no-connect") || wait);
     say7(`${green7("\u2713")} Service ${service2.label ?? ""} \xB7 ${service2.status}`);
     printServiceEndpoint(config, service2, tunneling2);
     say7(dim7(`  logs: mend service logs ${service2.label ?? service2.id.slice(0, 8)}`));
+    failUnlessAnswered(config, service2, wait);
     if (tunneling2) await autoConnect(config, service2);
     return;
   }
@@ -11169,24 +11493,34 @@ var serviceRun = async (config, args) => {
   if (http && https) return fail7(usage2);
   const browserScheme = https ? "https" : http ? "http" : null;
   if (protocol === "udp" && browserScheme !== null) return fail7(usage2);
+  if (protocol === "udp" && wait) {
+    return fail7("--wait needs a TCP port: UDP has no probe, so nothing could be waited for");
+  }
   const prefix = head.find(
-    (a, i) => !a.startsWith("--") && i !== portFlag + 1 && i !== nameFlag + 1
+    (a, i) => !a.startsWith("--") && (portFlag === -1 || i !== portFlag + 1) && (nameFlag === -1 || i !== nameFlag + 1)
+  );
+  const session = await withinServiceWait(
+    resolveLiveSession(config, prefix, "service run"),
+    deadline
   );
-  const session = await resolveLiveSession(config, prefix, "service run");
   const service = await withSpinner(
     protocol === "udp" ? `starting ${name ?? argv[0]} (udp :${port})\u2026` : `starting ${name ?? argv[0]} \u2014 waiting for :${port} to answer\u2026`,
-    mutateService(config, "POST", `/sessions/${session.id}/services/run`, {
-      argv,
-      port,
-      name,
-      protocol,
-      browserScheme
-    })
+    withinServiceWait(
+      mutateService(config, "POST", `/sessions/${session.id}/services/run`, {
+        argv,
+        port,
+        name,
+        protocol,
+        browserScheme
+      }),
+      deadline
+    )
   );
-  const tunneling = willAutoConnect(config, service, head.includes("--no-connect"));
+  const tunneling = willAutoConnect(config, service, head.includes("--no-connect") || wait);
   say7(`${green7("\u2713")} Service ${service.label ?? ""} \xB7 ${service.status}`);
   printServiceEndpoint(config, service, tunneling);
   say7(dim7(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+  failUnlessAnswered(config, service, wait);
   if (tunneling) await autoConnect(config, service);
 };
 var serviceLogs = async (config, args) => {
@@ -11308,7 +11642,7 @@ var serviceInit = async (args) => {
   const toml = renderMendToml(proposals);
   say7(dim7(`proposed ${target}:`));
   say7("");
-  process.stdout.write(toml);
+  process.stdout.write(redactCredentials(toml));
   say7("");
   if (!args.includes("--yes")) {
     if (process.stdin.isTTY !== true) {
@@ -11355,7 +11689,7 @@ var attachTunnels = (config, optOut) => {
       return;
     }
     const rows = process.stdout.rows ?? 24;
-    process.stdout.write(`\x1B7\x1B[${rows};1H\x1B[2K${line}\x1B8`);
+    process.stdout.write(`\x1B7\x1B[${rows};1H\x1B[2K${redactCredentials(line)}\x1B8`);
   };
   const tunnels = createServiceTunnels({
     listServices: () => fetchServices(config),
@@ -11634,7 +11968,7 @@ var accountsCommand = async (config) => {
   } catch (error) {
     return fail7(error instanceof Error ? error.message : String(error));
   }
-  for (const line of lines) process.stdout.write(`${line}
+  for (const line of lines) process.stdout.write(`${redactCredentials(line)}
 `);
 };
 var claudeGrantSecret = () => {
@@ -11645,7 +11979,7 @@ var doctorBundle = (config, args) => doctorBundleCommand(args, {
   defaultDir: path21.join(mendCliHome(), "bundles"),
   now: () => /* @__PURE__ */ new Date(),
   say: say7,
-  warn: (line) => process.stderr.write(`${line}
+  warn: (line) => process.stderr.write(`${redactCredentials(line)}
 `),
   collectors: (tail) => bundleCollectors({
     cliVersion: cliVersion(),
@@ -11833,7 +12167,7 @@ var connectCommand = async (config, args) => {
       secret: narrowed.secret
     })
   );
-  process.stdout.write(`${accountLine(account)}
+  process.stdout.write(`${redactCredentials(accountLine(account))}
 `);
   const facts = claudeGrantFacts(narrowed.secret);
   if (facts !== null) {
@@ -12443,6 +12777,7 @@ _mend() {
     'adopt:adopt a repository into the store'
     'codex:new session + codex' 'claude:new session + claude' 'opencode:new session + opencode' 'pi:new session + pi'
     'run:new session + arbitrary command'
+    'logs:recorded terminal output of a session' 'wait:wait for the command of a session to end'
     'attach:reattach to a running session' 'stop:stop the agent \u2014 record and review remain'
     'shell:open a shell in a live session workspace'
     'service:reachable ports \u2014 add, list, stop'
@@ -12479,7 +12814,7 @@ _mend() {
         esac
       fi
       ;;
-    shell|attach|stop|continue|resume|rejoin|land|pull)
+    shell|attach|stop|continue|resume|rejoin|land|pull|logs|wait)
       local -a sessions
       sessions=(\${(f)"$(command mend __complete session 2>/dev/null | tr '\\t' ':')"})
       (( \${#sessions} )) && _describe 'session' sessions
@@ -12491,7 +12826,7 @@ _mend "$@"
 var BASH_COMPLETIONS = `_mend() {
   local cur=\${COMP_WORDS[COMP_CWORD]}
   if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "adopt codex claude opencode pi run attach stop shell service server uninstall keys git-author skills memory connect pair doctor continue resume rejoin land pull refresh projects sessions status ui help" -- "$cur") )
+    COMPREPLY=( $(compgen -W "adopt codex claude opencode pi run logs wait attach stop shell service server uninstall keys git-author skills memory connect pair doctor continue resume rejoin land pull refresh projects sessions status ui help" -- "$cur") )
     return
   fi
   case \${COMP_WORDS[1]} in
@@ -12509,7 +12844,7 @@ var BASH_COMPLETIONS = `_mend() {
       fi
       COMPREPLY=( $(compgen -W "$options" -- "$cur") )
       ;;
-    shell|attach|stop|continue|resume|rejoin|land|pull)
+    shell|attach|stop|continue|resume|rejoin|land|pull|logs|wait)
       COMPREPLY=( $(compgen -W "$(command mend __complete session 2>/dev/null | cut -f1)" -- "$cur") )
       ;;
   esac
@@ -12528,57 +12863,292 @@ var completionsCommand = (args) => {
       return fail7(`${usageOf("completions")} \xB7 e.g. mend completions zsh > "$fpath[1]/_mend"`);
   }
 };
-var supervisedRun = async (config, session, argv) => {
-  const launched = await startAndFollow(
+var pause = (ms, signal) => {
+  const { promise, resolve: resolve8 } = Promise.withResolvers();
+  const timer = setTimeout(resolve8, ms);
+  signal?.addEventListener(
+    "abort",
+    () => {
+      clearTimeout(timer);
+      resolve8();
+    },
+    { once: true }
+  );
+  return promise;
+};
+var clock = { sleep: pause, now: Date.now };
+var printJson = (value) => {
+  process.stdout.write(`${redactCredentials(JSON.stringify(value, null, 2))}
+`);
+};
+var outputOnTerminal = false;
+var stdoutErrorsHandled = false;
+var outputStopped = false;
+var restoreTerminal = () => {
+  if (!outputOnTerminal || process.stdout.isTTY !== true) return;
+  outputOnTerminal = false;
+  process.stdout.write(`${TERMINAL_MODES_RESET}\x1B[0m`);
+};
+process.once("exit", restoreTerminal);
+var writeOutput = (bytes) => {
+  if (outputStopped) return Promise.reject(new Error("stopped by a signal"));
+  if (process.stdout.isTTY === true) outputOnTerminal = true;
+  if (!stdoutErrorsHandled) {
+    stdoutErrorsHandled = true;
+    process.stdout.on("error", () => void 0);
+  }
+  return new Promise((resolve8, reject) => {
+    process.stdout.write(bytes, (error) => {
+      if (error === null || error === void 0) resolve8();
+      else reject(error);
+    });
+  });
+};
+var flushed = (stream) => new Promise((resolve8) => {
+  if (stream.destroyed || !stream.writable) resolve8();
+  else stream.write("", () => resolve8());
+});
+var EXIT_FLUSH_GRACE_MS = 5e3;
+var exitFlushed = async (code) => {
+  restoreTerminal();
+  const flush = await beforeDeadline(
+    Promise.all([flushed(process.stdout), flushed(process.stderr)]),
+    clock,
+    clock.now() + EXIT_FLUSH_GRACE_MS
+  );
+  if (!flush.done) {
+    process.stderr.write(
+      `mend: output may be incomplete \xB7 the reader took none of it for ${EXIT_FLUSH_GRACE_MS / 1e3} s
+`
+    );
+    process.exit(code === 0 ? 1 : code);
+  }
+  process.exit(code);
+};
+var failFlushed = (message) => {
+  process.stderr.write(`mend: ${redactCredentials(message)}
+`);
+  return exitFlushed(1);
+};
+var stopOutputOnSignal = (line) => {
+  const signals = [
+    ["SIGHUP", 129],
+    ["SIGINT", 130],
+    ["SIGTERM", 143]
+  ];
+  const handlers = signals.map(([signal, code]) => {
+    const handler = () => {
+      if (outputStopped) {
+        restoreTerminal();
+        process.exit(code);
+      }
+      outputStopped = true;
+      say7("");
+      say7(`${amber2("\xB7")} ${line}`);
+      void exitFlushed(code);
+    };
+    process.on(signal, handler);
+    return () => process.off(signal, handler);
+  });
+  return () => {
+    for (const undo of handlers) undo();
+  };
+};
+var readLogPage = (config, processId, from) => request(
+  config,
+  "GET",
+  `/processes/${processId}/logs?from=${encodeURIComponent(from)}&limit=256`
+);
+var writeProcessLogs = (config, processId, from, follow) => followLogs({
+  from,
+  follow,
+  read: (cursor) => readLogPage(config, processId, cursor),
+  write: writeOutput,
+  ...clock
+});
+var waitForSessionCommand = (config, sessionId, processId, deadline) => waitForCommand({
+  read: () => request(config, "GET", `/sessions/${sessionId}`),
+  processId,
+  deadline,
+  ...clock
+});
+var runJsonOf = (config, session, processId, state) => ({
+  version: 1,
+  sessionId: session.id,
+  processId,
+  worktree: session.worktree,
+  branch: session.branch,
+  url: `${config.url}/sessions/${session.id}`,
+  status: state.status,
+  exitCode: state.exitCode
+});
+var observedState = (detail, processId, fallback) => {
+  if (detail === null) return { status: fallback, exitCode: null };
+  const row = (processId === null ? void 0 : processRowOf(detail, processId)) ?? detail.currentAgent;
+  return row === null ? { status: detail.session.status, exitCode: null } : { status: row.status, exitCode: row.exitCode };
+};
+var exitWithCommandEnd = (config, session, end, json2, undelivered = null) => {
+  const commandCode = exitStatusOf(end);
+  const code = undelivered !== null && commandCode === 0 ? 1 : commandCode;
+  say7(`${commandCode === 0 ? green7("\u2713") : amber2("\xB7")} ${endLine(end)} \xB7 recorded`);
+  if (undelivered !== null) {
+    say7(
+      `${amber2("\xB7")} output not delivered \xB7 ${undelivered} \xB7 read it with mend logs ${session.id.slice(0, 8)}`
+    );
+  }
+  say7(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${session.id}`);
+  if (json2) printJson(runJsonOf(config, session, end.processId, end));
+  return exitFlushed(code);
+};
+var supervisedRun = async (config, session, argv, options) => {
+  const outcome = await followStarting(
     config,
     session.id,
     "provisioning workspace \u2014 a first launch builds the harness image (can take minutes)\u2026",
     request(config, "POST", `/sessions/${session.id}/launch`, { argv })
   );
+  const ranAndEnded = outcome.kind === "settled" ? await request(config, "GET", `/sessions/${session.id}`).catch(() => null) : null;
+  if (outcome.kind !== "live" && ranAndEnded?.currentAgent?.id === void 0) {
+    startedOrExit(config, session.id, outcome);
+    return;
+  }
+  const detail = ranAndEnded ?? await api(config, "GET", `/sessions/${session.id}`);
+  const processId = detail.currentAgent?.id ?? null;
+  const id8 = session.id.slice(0, 8);
+  if (options.detach) {
+    const ended = commandEndOf(detail, processId);
+    if (ended === null) {
+      say7(`${green7("\u2713 recording")} \xB7 running detached \xB7 session ${dim7(id8)}`);
+      say7(`${cobalt2("  output")} \xB7 mend logs ${id8} --follow`);
+      say7(`${cobalt2("  wait")} \xB7 mend wait ${id8}`);
+    } else {
+      say7(`${amber2("\xB7")} ended before detaching \xB7 ${endLine(ended)} \xB7 session ${dim7(id8)}`);
+      say7(`${cobalt2("  output")} \xB7 mend logs ${id8}`);
+    }
+    if (options.json) {
+      printJson(
+        runJsonOf(
+          config,
+          session,
+          processId,
+          ended ?? observedState(detail, processId, detail.session.status)
+        )
+      );
+    }
+    return;
+  }
   say7(
-    `${green7("\u2713 recording")} \xB7 run ${dim7(launched.id.slice(0, 8))} \xB7 workspace mounts the worktree`
+    `${green7("\u2713 recording")} \xB7 ${argv[0] ?? "command"} \xB7 workspace mounts the worktree \xB7 Ctrl+C stops watching, not the command`
   );
-  say7(dim7(`  ${argv.join(" ")} \u2014 live record:`));
   say7("");
-  const headers = {};
-  if (config.token !== null) headers["authorization"] = `Bearer ${config.token}`;
-  const response = await fetch(`${config.url}/api/events`, { headers });
-  if (response.body === null) return fail7("event stream unavailable");
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  let settled = null;
-  while (settled === null) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    buffer += decoder.decode(value, { stream: true });
-    const parts = buffer.split("\n\n");
-    buffer = parts.pop() ?? "";
-    for (const part of parts) {
-      const data = part.split("\n").filter((line) => line.startsWith("data: ")).map((line) => line.slice(6)).join("");
-      if (data === "") continue;
-      let event;
-      try {
-        event = JSON.parse(data);
-      } catch {
-        continue;
-      }
-      if (event.sessionId !== session.id) continue;
-      if (event.type === "session-progress" && event.line !== void 0) {
-        say7(dim7(`  ${event.line}`));
-      }
-      if (event.type === "session") {
-        const detail = await api(config, "GET", `/sessions/${session.id}`);
-        const ended = agentOutcome(detail.currentAgent) ?? (["completed", "failed", "stopped"].includes(detail.session.status) ? detail.session.status : null);
-        if (ended !== null) settled = ended;
-      }
+  let undelivered = null;
+  if (!options.json) {
+    stopOutputOnSignal(`stopped watching \xB7 the command keeps running \xB7 mend logs ${id8} --follow`);
+  }
+  if (processId !== null && !options.json) {
+    try {
+      await writeProcessLogs(config, processId, "0", true);
+    } catch (error) {
+      undelivered = error instanceof Error ? error.message : String(error);
     }
   }
-  await reader.cancel().catch(() => void 0);
+  const waited = await waitForSessionCommand(config, session.id, processId, null).catch(
+    (error) => failFlushed(error instanceof Error ? error.message : String(error))
+  );
+  if (waited.kind === "timeout") return failFlushed("the wait ended without a timeout");
   say7("");
-  say7(`${green7("\u2713")} session ${settled ?? "settled"} \xB7 recorded \xB7 checkpoint taken`);
-  say7(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${session.id}`);
-  process.exit(settled === "failed" ? 1 : 0);
+  await exitWithCommandEnd(config, session, waited.end, options.json, undelivered);
+};
+var resolveAnySession = async (config, word) => {
+  if (isSessionId(word)) {
+    return (await api(config, "GET", `/sessions/${word}`)).session;
+  }
+  const projects = await api(config, "GET", "/projects");
+  const details = await Promise.all(
+    projects.map(
+      (project2) => api(config, "GET", `/projects/${project2.id}?deadEnds=include`)
+    )
+  );
+  const picked = pickSession(
+    details.flatMap((detail) => detail.sessions),
+    word
+  );
+  if ("error" in picked) return fail7(picked.error);
+  return picked.session;
+};
+var logsCommand = async (config, args) => {
+  chromeToStderr();
+  const parsed = parseLogsArgs(args);
+  if ("error" in parsed) return fail7(`${parsed.error} \xB7 ${usageOf("logs")}`);
+  const { session: word, follow, from, process: processPrefix } = parsed.args;
+  const session = word === null ? await resolveLiveSession(config, void 0, "logs") : await resolveAnySession(config, word);
+  const detail = await api(config, "GET", `/sessions/${session.id}`);
+  const picked = pickProcess(detail, processPrefix);
+  if ("error" in picked) return fail7(`session ${session.id.slice(0, 8)} \xB7 ${picked.error}`);
+  const target = picked.process;
+  if (target.id === void 0 || target.sealantSessionId === null) {
+    return fail7(
+      `session ${session.id.slice(0, 8)} \xB7 this process has no recorded terminal (an adopted port, or a server older than process ids)`
+    );
+  }
+  stopOutputOnSignal(
+    follow ? `stopped watching \xB7 the process keeps running \xB7 mend logs ${session.id.slice(0, 8)} --follow` : "stopped reading the record"
+  );
+  try {
+    const last = await writeProcessLogs(config, target.id, from, follow);
+    restoreTerminal();
+    if (follow) say7(dim7(`
+record ended \xB7 ${last.status} \xB7 next sequence ${last.next}`));
+  } catch (error) {
+    return failFlushed(
+      `output not delivered \xB7 ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  await exitFlushed(0);
+};
+var waitCommand = async (config, args) => {
+  chromeToStderr();
+  const parsed = parseWaitArgs(args);
+  if ("error" in parsed) return fail7(`${parsed.error} \xB7 ${usageOf("wait")}`);
+  const { session: word, timeoutMs, json: json2, process: processPrefix } = parsed.args;
+  const deadline = timeoutMs === null ? null : clock.now() + timeoutMs;
+  const after = `${Math.round((timeoutMs ?? 0) / 1e3)} s`;
+  const timedOut = async (session2, processId2, last) => {
+    say7(
+      session2 === null ? `${amber2("\xB7")} no session found within ${after}` : `${amber2("\xB7")} session ${session2.id.slice(0, 8)} \xB7 still running after ${after} \xB7 the command keeps running`
+    );
+    if (json2 && session2 !== null) {
+      const observed = processId2 ?? last?.currentAgent?.id ?? null;
+      printJson(
+        runJsonOf(config, session2, observed, observedState(last, observed, session2.status))
+      );
+    }
+    return exitFlushed(WAIT_TIMED_OUT);
+  };
+  const resolved = await beforeDeadline(
+    word === null ? resolveLiveSession(config, void 0, "wait") : resolveAnySession(config, word),
+    clock,
+    deadline
+  );
+  if (!resolved.done) return timedOut(null, null, null);
+  const session = resolved.value;
+  let processId = null;
+  if (processPrefix !== null) {
+    const read = await beforeDeadline(
+      api(config, "GET", `/sessions/${session.id}`),
+      clock,
+      deadline
+    );
+    if (!read.done) return timedOut(session, null, null);
+    const picked = pickProcess(read.value, processPrefix);
+    if ("error" in picked) return fail7(`session ${session.id.slice(0, 8)} \xB7 ${picked.error}`);
+    processId = picked.process.id ?? null;
+  }
+  const waited = await waitForSessionCommand(config, session.id, processId, deadline).catch(
+    (error) => failFlushed(error instanceof Error ? error.message : String(error))
+  );
+  if (waited.kind === "timeout") return timedOut(session, processId, waited.last);
+  await exitWithCommandEnd(config, session, waited.end, json2);
 };
 var continueSession = async (config, args) => {
   const explicitSession = args.find((a) => !a.startsWith("--")) ?? null;
@@ -12769,22 +13339,39 @@ var rejoinCommand = async (config, args) => {
   await finishAttach(config, session.id, outcome);
   exitAfterSessionEnd(config, session.id);
 };
-var projectsCommand = async (config) => {
+var projectsCommand = async (config, args) => {
+  const unknown = args.find((arg) => arg !== "--json");
+  if (unknown !== void 0) return fail7(`unknown argument ${unknown} \xB7 ${usageOf("projects")}`);
   const [projects, active] = await Promise.all([
     api(config, "GET", "/projects"),
     api(config, "GET", "/sessions")
   ]);
-  if (projects.length === 0) {
-    say7(dim7("no adopted projects \u2014 mend adopt brings one in"));
-    return;
-  }
   const liveByProject = /* @__PURE__ */ new Map();
   for (const session of active) {
     liveByProject.set(session.projectId, (liveByProject.get(session.projectId) ?? 0) + 1);
   }
+  const here = matchProjectByCwd(projects, cwdFacts(process.cwd()));
+  if (args.includes("--json")) {
+    printJson({
+      version: 1,
+      projects: projects.map((project2) => ({
+        id: project2.id,
+        name: project2.name,
+        originUrl: project2.originUrl,
+        defaultBranch: project2.defaultBranch,
+        storePath: project2.storePath,
+        liveSessions: liveByProject.get(project2.id) ?? 0,
+        current: project2.id === here?.id
+      }))
+    });
+    return;
+  }
+  if (projects.length === 0) {
+    say7(dim7("no adopted projects \u2014 mend adopt brings one in"));
+    return;
+  }
   const nameWidth = Math.max(...projects.map((p) => p.name.length));
   const branchWidth = Math.max(...projects.map((p) => p.defaultBranch.length));
-  const here = matchProjectByCwd(projects, cwdFacts(process.cwd()));
   for (const project2 of projects) {
     const live = liveByProject.get(project2.id) ?? 0;
     const liveLabel = live > 0 ? green7(`${live} live`) : dim7("\u2014");
@@ -13087,7 +13674,7 @@ var dashboard = async (config, options = {}) => {
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-IBHSVQ5S.js");
+  const { runDashboard } = await import("./dashboard-CEJN6IOO.js");
   const agentShare = await startShareIfBridge(config);
   const tunnels = options.noTunnel === true || serverIsLocal(config) ? null : createServiceTunnels({
     listServices: () => fetchServices(config),
@@ -13191,6 +13778,10 @@ var main = async () => {
     case "pi":
     case "run":
       return withAgentShare(config, () => launch(config, command, rest));
+    case "logs":
+      return logsCommand(config, rest);
+    case "wait":
+      return waitCommand(config, rest);
     case "attach":
       return withAgentShare(config, () => attach(config, rest));
     case "stop":
@@ -13266,7 +13857,7 @@ var main = async () => {
     case "rejoin":
       return withAgentShare(config, () => rejoinCommand(config, rest));
     case "projects":
-      return projectsCommand(config);
+      return projectsCommand(config, rest);
     case "refresh":
       return refreshCommand(config, rest);
     case "land":