pi-harness-runtime 1.1.393 → 1.1.395

package/AGENTS.md

@@ -36,6 +36,56 @@ bd list --status pending
 
 **Why**: Agent often builds/commits without checking todos. This causes incomplete tasks to be forgotten.
 
+## Staged Validation & Test-Cost Discipline (CRITICAL)
+
+A task with a cheap tier and an expensive tier MUST use the cheap tier while the code is still changing. Repeating an expensive regression after every fix is the most common way an autonomous run burns an entire night.
+
+1. **Declare the tiers.** Put the plan in the todo metadata (`metadata.validationPlan`):
+
+   ```json
+   {
+     "metadata": {
+       "validationPlan": {
+         "fast": { "command": "bun test tests/fast", "expectedDurationMs": 18000, "datasetSize": 100 },
+         "full": { "command": "bun test tests/full", "expectedDurationMs": 2400000, "datasetSize": 10000 },
+         "budgetMinutes": 90,
+         "finalTierRequired": true
+       }
+     }
+   }
+   ```
+
+   The harness never guesses a tier from a command string. Without a declared plan the current behaviour is unchanged.
+
+2. **Iterate on the fast tier.** After every code edit, rerun the fast tier plus the focused unit/type checks the edit touches.
+
+3. **Run the full tier once.** Run the full tier as the final acceptance check, when the implementation and the fast tier are stable.
+
+4. **Do not repeat the full tier blindly.** Never rerun the full tier after an edit that cannot affect the behavior it covers. If it genuinely must be repeated, say why in one line.
+
+5. **Make the cost visible.** Report each validation run compactly: `[TEST] fast: bun test tests/fast - passed (18s, 100 records)`. A test that is not reported cannot be budgeted.
+
+6. **No false completion.** A todo whose `finalTierRequired` plan is set must not be marked completed while that tier is pending or failed. Pause instead and report what passed, what is pending, and why.
+
+7. **Respect the time budget.** `budgetMinutes` is a soft budget. When it is reached, stop at a safe boundary, report completed and skipped checks, and leave the work open. Never kill a destructive or non-interruptible test mid-run.
+
+8. **The fast tier must be representative.** A small fixture keeps the shape of the data (optional fields, relations, uniqueness, boundary values, aggregates under test), not just the row count. Use deterministic data with cleanup so repeated runs do not accumulate rows.
+
+9. **Record every tier run in the ledger.** The harness never runs the tests, so the run is recorded by whoever knows the result:
+
+   ```bash
+   bun scripts/validation-run.ts --item 12 --tier fast --status passed --duration 18s --dataset 100
+   bun scripts/validation-run.ts --item 12 --tier full --status passed --duration 41m -- "bun test tests/full"
+   ```
+
+   The ledger is plain NDJSON under `~/.pi-harness-runtime/logs/validation-runs.jsonl` (inspectable with `tail` or `jq`) and every record is mirrored into the central logging pipeline. The harness reads it to know which tier already passed, so an unreported run looks like a run that never happened.
+
+**What the harness does with the plan:**
+
+- The continuation message carries the plan, the recorded tier state and the remaining budget, so the agent never re-runs a tier that already passed.
+- When `budgetMinutes` is spent, the item pauses at a safe boundary: nothing is dispatched, the work stays open, and the reason is reported.
+- When a todo with `finalTierRequired` is marked complete while that tier is pending or failed, the completion report is suppressed and the item is named instead. A todo may not be reported as done on the strength of an unreported run.
+
 ## Versioning Convention
 
 **Only patch-level updates (`0.10.x`)** — no minor/major bumps until the app is fully functional.
@@ -502,6 +552,9 @@ bun run build && bun run start   # Server deployment
   mode (`*_ENV`, `*_ENVIRONMENT`, `*_MODE`, `*_STAGE`, e.g. `AMOS_ENV`), then
   any other environment shaped key - and only then an environment shaped key
   of the process env → development/production/test
+- The facts about the repository (only when NO variable names the environment
+  at all) → a published source repository without a runtime of its own is a
+  development checkout; a `develop`/`development` branch is the fallback
 - System RAM → Low RAM warning (<16GB total or <4GB available)
 - Running processes → dev/build server status
 
@@ -513,8 +566,26 @@ A value that is not provably harmless is masked (`<set>`): only the
 shown. A key that only looks like a branch (`BRANCH=production`) never
 decides the mode.
 
+**Session variables of a desktop are not environment selectors.**
+`GNOME_SHELL_SESSION_MODE`, `XDG_*`, `DESKTOP_*`, `DBUS_*`, ... name the
+desktop session, never the environment of a workspace. Some of them end in
+`_MODE` or `_ENV`, so they are excluded from the candidates by NAMESPACE,
+not by value: their value ("ubuntu", "wayland") says nothing about the mode.
+
+**The repository tier (last resort, never production).** It runs only when
+no variable names the environment at all. A published package (a
+`package.json` with a name, a version and declared content - `files`,
+`bin` or `publishConfig`) without a deployment configuration (no Dockerfile,
+compose file, Procfile, fly.toml, render.yaml, railway.json, vercel.json,
+netlify.toml, serverless.yml, app.yaml, pm2 ecosystem file, no deploy
+workflow) and without a running server is SOURCE CODE that the user runs on
+their own machine → `DEVELOPMENT (source-only repository)`. A branch named
+`develop` or `development` is the fallback → `DEVELOPMENT (git branch
+develop)`. A production branch is NEVER a development checkout, and this
+tier never claims production.
+
 **This info is shown in UI and delivered to agent context:**
-```
+```text
 Workspace: ~/pi-harness-runtime | OS: Linux | mode: DEVELOPMENT (from AMOS_ENV in .env) | dev server: running | dev script: available | build script: available | RAM: 10/16
 ```
 
@@ -522,7 +593,8 @@ The mode words are exactly what the detector emits: `DEVELOPMENT`, `PRODUCTION`,
 `TEST` or `UNKNOWN` (with its reason, e.g.
 `UNKNOWN (no NODE_ENV or environment variable found)` or
 `UNKNOWN (AMOS_ENV in .env names no known mode)`). A known mode also
-names its source: `DEVELOPMENT (from AMOS_ENV in .env)`.
+names its source: `DEVELOPMENT (from AMOS_ENV in .env)` or
+`DEVELOPMENT (source-only repository)`.
 A dev/build script is a CAPABILITY, not a state: `dev script: available` means
 the script exists, not that a server runs. The server state is separate and
 never claims more than it knows: `running`, `not detected` (a check ran and
@@ -545,12 +617,15 @@ command to use.
 | `Dev server running` | Reuse it, don't restart |
 
 **Decision flow:**
-```
+```text
 Check process.env.NODE_ENV first (it decides, also when it names no known mode)
 Check the .env and .env.* files of the workspace second
   (NODE_ENV, then an environment shaped key whose value names a mode,
    then any other environment shaped key)
 Only then an environment shaped key of the process env (e.g. AMOS_ENV)
+Only then the facts about the repository
+  (a published source repository without a runtime of its own,
+   or a develop/development branch)
 Presence of dev script = capability, not proof of mode
 UNKNOWN requires investigation, not auto-build
 Production detection ≠ deployment authorization
@@ -561,3 +636,50 @@ Production detection ≠ deployment authorization
 ```
 ~/.pi-harness-runtime/workspace-env.sqlite
 ```
+
+## Centralized Application Logging
+
+All application logs can be shipped to **Cloudflare R2** (durable archive) and to the
+**unified webhook server** (live path). The pipeline lives in `packages/logging`
+(`@pi-harness/logging`); the harness uses the process-wide singleton from it.
+
+**Delivery order** (first success wins, the rest are skipped):
+
+```text
+producer -> redact -> sample -> buffer -> R2 -> webhook -> local spool (~/.pi-harness-runtime/logs/spool)
+```
+
+- The local spool is the fallback: if every transport fails the batch is written to
+  disk as NDJSON and re-shipped on the next successful flush. Nothing is lost, only delayed.
+- The local log files (`~/.pi-harness-runtime/logs/*.jsonl`, `harness/*.log`) stay the
+  source of truth. The centralized pipeline is a copy for the archive.
+
+**Configuration** (environment first, then `~/.pi-harness-runtime/keys/`):
+
+| Variable | Meaning | Default |
+|----------|---------|---------|
+| `PI_LOG_SINK` | `off` \| `auto` \| `r2` \| `webhook` \| `r2+webhook` | `auto` |
+| `PI_LOG_LEVEL` | Minimum level that is shipped | `info` |
+| `PI_LOG_SAMPLE_RATE` | Share of `debug` records kept (0..1) | `0.1` |
+| `PI_LOG_RATE_LIMIT` | Max records per source+event per minute | `60` |
+| `PI_LOG_BATCH_SIZE` | Records per batch | `100` |
+| `PI_LOG_BUFFER_SIZE` | Records held in memory | `1000` |
+| `PI_LOG_FLUSH_INTERVAL_MS` | Automatic flush interval | `15000` |
+| `PI_LOG_WEBHOOK_URL` | Ingest URL of the webhook server | unset |
+| `PI_LOG_WEBHOOK_TOKEN` | Bearer token for the ingest endpoint | unset |
+| `PI_LOG_R2_BUCKET` / `PI_LOG_R2_ENDPOINT` / `PI_LOG_R2_ACCESS_KEY_ID` / `PI_LOG_R2_SECRET_ACCESS_KEY` | R2 credentials | key files |
+| `PI_LOG_SPOOL_DIR` | Local spool directory | `~/.pi-harness-runtime/logs/spool` |
+
+R2 credentials are read from the key files `r2-bucket-name.txt`, `r2-endpoint.txt`,
+`r2-access-key-id.txt`, `r2-secret-access-key.txt` and `r2-account-id.txt`.
+
+**Rules for producers:**
+
+- Emit through the singleton: `centralInfo/centralWarn/centralError(source, event, message?, fields?)`.
+  The `source` identifies the component, the `event` is a dotted name.
+- Redaction is automatic (key names, credential patterns, truncation), but producers must
+  not pass user content: prompts, raw model output and message bodies are dropped by the
+  redactor, so shipping them is pointless.
+- Never put a credential in a log message. The redactor is a safety net, not a licence.
+- The webhook server exposes `POST /api/logs` for the ingest path. Set `LOG_INGEST_TOKEN`
+  to require a bearer token; the server re-redacts every batch and relays it to R2.

package/harness/console-guard.ts

@@ -0,0 +1,73 @@
+/**
+ * Console guard - keep a TUI's terminal clean.
+ *
+ * A TUI owns the terminal: a stray `console.log` from a library lands in the
+ * prompt input field ("[RelayClient] Connected ..."). While the TUI runs, the
+ * harness redirects the console into its log file.
+ *
+ * The guard is deliberately dumb: it never writes to the terminal and a
+ * failing sink can never break the caller.
+ */
+
+export type ConsoleLevel = "log" | "info" | "warn" | "error" | "debug";
+
+export interface ConsoleGuardOptions {
+	/** Receives every console call. Exceptions are swallowed. */
+	sink: (level: ConsoleLevel, message: string) => void;
+}
+
+const LEVELS: ConsoleLevel[] = ["log", "info", "warn", "error", "debug"];
+
+/** Flatten the console arguments into a single line. */
+export function formatConsoleArgs(args: unknown[]): string {
+	return args
+		.map((arg) => {
+			if (typeof arg === "string") return arg;
+			// The stack matters: pi's fatal path prints the error object.
+			if (arg instanceof Error) return arg.stack ?? arg.message;
+			try {
+				const json = JSON.stringify(arg);
+				return json === undefined ? String(arg) : json;
+			} catch {
+				return String(arg);
+			}
+		})
+		.join(" ");
+}
+
+/**
+ * Replace the console methods with a sink.
+ *
+ * @returns a restore function that puts the original console back.
+ */
+export function installConsoleGuard(options: ConsoleGuardOptions): () => void {
+	// SAFETY: the console methods are own, writable properties of the global
+	// console object; TypeScript cannot express that index signature.
+	const target = globalThis.console as unknown as Record<string, unknown>;
+	const originals = new Map<string, unknown>();
+
+	for (const level of LEVELS) {
+		originals.set(level, target[level]);
+		target[level] = (...args: unknown[]): void => {
+			try {
+				options.sink(level, formatConsoleArgs(args));
+			} catch {
+				// A failing sink must never break the caller.
+			}
+		};
+	}
+
+	return () => {
+		for (const level of LEVELS) {
+			// The presence test must not depend on the value: a level that was
+			// absent before must be removed again.
+			if (!originals.has(level)) continue;
+			const original = originals.get(level);
+			if (original === undefined) {
+				delete target[level];
+			} else {
+				target[level] = original;
+			}
+		}
+	};
+}

package/harness/glm-quota-logger.ts

@@ -15,6 +15,8 @@
 import { appendFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+// Centralized pipeline (R2 / webhook) - a copy of the local log.
+import { centralError, centralInfo, centralWarn } from "../packages/logging/dist/index.js";
 
 export type LogLevel = "INFO" | "WARN" | "ERROR";
 
@@ -55,6 +57,21 @@ function writeLog(
 		// Non-fatal - just log to console
 		console.error(`[GLMQuotaLogger] Failed to write log: ${message}`);
 	}
+
+	// Ship a copy to the centralized pipeline. The job id is an identifier,
+	// not content, so it is safe to include.
+	try {
+		const fields = { jobId: jobId ?? "system" };
+		if (level === "ERROR") {
+			centralError("harness.glm-quota", "quota", message, fields);
+		} else if (level === "WARN") {
+			centralWarn("harness.glm-quota", "quota", message, fields);
+		} else {
+			centralInfo("harness.glm-quota", "quota", message, fields);
+		}
+	} catch {
+		// Logging must never break the quota flow
+	}
 }
 
 // --- Public API ---

package/harness/langchain/planner-logger.ts

@@ -14,6 +14,8 @@
 import { mkdirSync, appendFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+// Centralized pipeline (R2 / webhook) - a copy of the local log.
+import { centralInfo } from "../../packages/logging/dist/index.js";
 
 export interface PlannerDecision {
 	timestamp: string;
@@ -179,6 +181,19 @@ export async function logPlannerDecision(decision: PlannerLogEntry): Promise<voi
 	appendFileSync(LOG_FILE, fileLog);
 	console.log(fileLog);
 
+	// Ship a copy to the centralized pipeline. Only the decision itself is
+	// shipped - the request and the raw planner output stay local.
+	try {
+		centralInfo("harness.planner", "decision", undefined, {
+			provider: decision.provider,
+			escalate: decision.escalate,
+			escalateReason: decision.escalateReason,
+			userInputType: decision.userInput?.type ?? null,
+		});
+	} catch {
+		// Logging must never break the planner flow
+	}
+
 	// Send to Telegram (async, non-blocking for main flow)
 	const telegramMsg = formatTelegramMessage(decision);
 	// Fire-and-forget: don't await, let it run in background

package/harness/service-diagnostics.ts

@@ -8,6 +8,9 @@
 import { appendFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+// Centralized pipeline (R2 / webhook). The local JSONL file stays the
+// source of truth; the shipper is a copy for the archive.
+import { centralError, centralInfo, centralWarn } from "../packages/logging/dist/index.js";
 
 export type ServiceLevel = "info" | "warn" | "error" | "debug";
 export type ServiceName = "jev" | "honcho" | "qdrant";
@@ -41,16 +44,44 @@ function ensureLogDir(): void {
  * Sensitive fields (keys, tokens, full content) are never logged.
  */
 export function logServiceEvent(event: ServiceEvent): void {
+	let safeEvent: Record<string, unknown> = { ...event };
 	try {
 		ensureLogDir();
 
 		// Redact sensitive fields
-		const safeEvent = redactSensitive(event);
+		safeEvent = redactSensitive(event);
 
 		appendFileSync(LOG_FILE, JSON.stringify(safeEvent) + "\n");
 	} catch {
 		// Silently fail if logging fails - don't crash the service
 	}
+
+	shipServiceEvent(safeEvent);
+}
+
+/**
+ * Send a service event to the centralized pipeline.
+ *
+ * The event was already redacted above; the shipper redacts again, which
+ * is cheap and keeps the guarantee local to one place.
+ */
+function shipServiceEvent(event: Record<string, unknown>): void {
+	try {
+		const level = typeof event.level === "string" ? event.level : "info";
+		const fields: Record<string, unknown> = { ...event };
+		delete fields.level;
+		delete fields.ts;
+
+		if (level === "error") {
+			centralError("harness.service-diagnostics", String(event.operation ?? "event"), undefined, fields);
+		} else if (level === "warn") {
+			centralWarn("harness.service-diagnostics", String(event.operation ?? "event"), undefined, fields);
+		} else {
+			centralInfo("harness.service-diagnostics", String(event.operation ?? "event"), undefined, fields);
+		}
+	} catch {
+		// Never let shipping break the service
+	}
 }
 
 /**

package/index.ts

@@ -30,6 +30,7 @@ import {
 import { renderDetailLines } from "./harness/startup-lines.ts";
 import { describeInboundAccess, getAllowedUserIds } from "./harness/telegram-auth.ts";
 import { buildTelegramCallbackUpdate, buildTelegramMessageUpdate } from "./harness/telegram-update.ts";
+import { installConsoleGuard } from "./harness/console-guard.ts";
 import {
 	jevMissingKeyReport,
 	lineConfigurationReport,
@@ -99,6 +100,10 @@ import {
 	hasPaperclipConfig,
 	PaperclipWatcher,
 } from "./packages/paperclip-integration/dist/index.js";
+// Centralized application logging: R2 (durable archive) + webhook (live),
+// with a local spool as the fallback. Optional - without credentials the
+// logs simply stay local.
+import { centralInfo, initCentralLogging } from "./packages/logging/dist/index.js";
 
 // --- Jev Auto-Continue: Agent autonomous decision-making --------------------
 // Lazy import - only loads when packages/jev-judge exists and API key available
@@ -345,6 +350,7 @@ async function initAutoContinue(pi: ExtensionAPI): Promise<void> {
 			if (ctx.hasUI && ctx.ui) {
 				_setAutoContinueStatus = ctx.ui.setStatus.bind(ctx.ui, "harness-auto-continue");
 			}
+
 		});
 
 		// Clear status and cancel background work on session shutdown
@@ -640,12 +646,29 @@ async function initAutoContinue(pi: ExtensionAPI): Promise<void> {
 
 				// Get task context from local todo controller (not bd)
 				const snapshot = await (todoContinuationController?.getSnapshot() ?? Promise.resolve({ items: [] }));
+				// An item whose final tier is still pending is NOT done, even when
+				// it is already marked completed. The judge must see it as
+				// remaining work, otherwise the session ends on a false
+				// completion.
+				const pendingFinalTier = validationLedger
+					? snapshot.items.filter((item) => validationLedger?.isFinalTierPending(item))
+					: [];
+				const pendingFinalTierIds = new Set(pendingFinalTier.map((item) => item.id));
+				if (pendingFinalTier.length > 0) {
+					logToFile(
+						"[auto-continue]",
+						"Final tier still pending for:",
+						pendingFinalTier.map((item) => `${item.id}:${item.subject}`).join(", "),
+					);
+				}
 				const taskContext = {
 					completed: snapshot.items
-					.filter((item: { status?: string; subject?: string }) => item.status === "completed")
+					.filter((item: { id?: number; status?: string; subject?: string }) =>
+						item.status === "completed" && !(item.id !== undefined && pendingFinalTierIds.has(item.id)))
 					.map((item: { status?: string; subject?: string }) => item.subject ?? ""),
 					remaining: snapshot.items
-					.filter((item: { status?: string; subject?: string }) => item.status !== "completed")
+					.filter((item: { id?: number; status?: string; subject?: string }) =>
+						item.status !== "completed" || (item.id !== undefined && pendingFinalTierIds.has(item.id)))
 					.map((item: { status?: string; subject?: string }) => item.subject ?? ""),
 					total: snapshot.items.length,
 				};
@@ -727,11 +750,35 @@ async function initAutoContinue(pi: ExtensionAPI): Promise<void> {
 
 		// --- todo continuation: Retain one controller per session ----------
 		let todoContinuationController: import("./packages/jev-judge/dist/continuation-controller.js").TodoContinuationController | null = null;
+		// Ledger of the validation runs: it is the only mechanical source for
+		// "did the final tier pass?" and therefore guards the completion report.
+		let validationLedger: import("./packages/jev-judge/dist/validation-ledger.js").ValidationLedger | null = null;
 
 		// Create controller on session_start with proper dispatch callback
 		pi.on("session_start", async (_event, ctx) => {
 			try {
 				const { TodoContinuationController } = await import("./packages/jev-judge/dist/continuation-controller.js");
+				const { ValidationLedger } = await import("./packages/jev-judge/dist/validation-ledger.js");
+				// The ledger records which validation tier ran. The controller
+				// uses it to tell the agent what already passed and whether the
+				// final tier is still pending.
+				validationLedger = new ValidationLedger({
+					onRecord: (record) => {
+						centralInfo(
+							"validation",
+							"tier.run",
+							`${record.tier} tier ${record.status}`,
+							{
+								itemId: record.itemId,
+								tier: record.tier,
+								status: record.status,
+								durationMs: record.durationMs,
+								datasetSize: record.datasetSize,
+								command: record.command,
+							},
+						);
+					},
+				});
 				// SAFETY: ctx is ExtensionContext with sessionManager, isIdle, hasPendingMessages
 				// dispatch uses pi.sendUserMessage for actual message delivery
 				todoContinuationController = new TodoContinuationController(
@@ -740,6 +787,7 @@ async function initAutoContinue(pi: ExtensionAPI): Promise<void> {
 						dispatch: async (content: string) => {
 							await pi.sendUserMessage(content, { deliverAs: "steer" });
 						},
+						validationLedger,
 					}
 				);
 				logToFile("[auto-continue]", "Todo continuation controller initialized");
@@ -986,6 +1034,26 @@ async function initAutoContinue(pi: ExtensionAPI): Promise<void> {
 						const isNoPendingTasks = reason === "No pending tasks";
 
 						if (isNoPendingTasks) {
+							// A todo whose final tier is still pending must not be
+							// reported as complete. The item may already be marked
+							// completed by the agent - the ledger is the check that
+							// catches it.
+							const snapshot = await todoContinuationController.getSnapshot();
+							const pendingFinalTier = validationLedger
+								? snapshot.items.filter((item) => validationLedger?.isFinalTierPending(item))
+								: [];
+							if (pendingFinalTier.length > 0) {
+								const details = pendingFinalTier
+									.map((item) => `${item.id}:${item.subject}`)
+									.join(", ");
+								logToFile(
+									"[auto-continue]",
+									"Completion suppressed - final tier still pending for:",
+									details,
+								);
+								updateAutoContinueStatus("ERROR", "final tier pending");
+								return;
+							}
 							// Check if there's a pending question - suppress completion if so
 							if (pqController.hasPendingQuestion()) {
 								logToFile("[auto-continue]", "Suppressing completion - pending question exists");
@@ -1003,7 +1071,6 @@ async function initAutoContinue(pi: ExtensionAPI): Promise<void> {
 							_completedNotifiedFor = completionKey;
 
 							// Get full todo list for notification
-							const snapshot = await todoContinuationController.getSnapshot();
 							const todoList = snapshot.items
 								.map((item) => {
 									const status = item.status === "completed" ? "[DONE]" : "[PENDING]";
@@ -2044,6 +2111,14 @@ async function initRelayStream(): Promise<void> {
 					]);
 				}
 			},
+		},
+		{
+			// A TUI owns the terminal: the relay diagnostics belong in the log
+			// file. A console write would land in the prompt input field
+			// ("[RelayClient] Connected ...").
+			log: (message) => logToFile("[RelayStream]", `log: ${message}`),
+			warn: (message) => logToFile("[RelayStream]", `warn: ${message}`),
+			error: (message) => logToFile("[RelayStream]", `error: ${message}`),
 		}
 	);
 
@@ -2055,6 +2130,50 @@ async function initRelayStream(): Promise<void> {
 	}
 }
 
+/**
+ * Console guard - the TUI owns the terminal.
+ *
+ * A library that writes to the console puts its text into the prompt input
+ * field ("[RelayClient] Connected ..."). In TUI mode every console call goes
+ * to the harness log instead. An error is also surfaced as a harness message,
+ * so a crash is never invisible.
+ */
+function initConsoleGuard(pi: ExtensionAPI): void {
+	let restore: (() => void) | null = null;
+	// A reload emits session_start BEFORE the previous session_shutdown:
+	// the guard must stay installed for the new session. The console is only
+	// given back when every started session has been shut down.
+	let starts = 0;
+	let shutdowns = 0;
+	const recentErrors = new Map<string, number>();
+
+	pi.on("session_start", (_event, ctx) => {
+		starts++;
+		if (ctx.mode !== "tui" || restore) return;
+		restore = installConsoleGuard({
+			sink: (level, message) => {
+				logToFile("[Console]", `${level}: ${message}`);
+				if (level !== "error") return;
+				// One message per 30s: a crash must be visible, a loop must not flood.
+				const now = Date.now();
+				if (now - (recentErrors.get(message) ?? 0) < 30_000) return;
+				recentErrors.set(message, now);
+				const text = message.length > 200 ? `${message.slice(0, 200)}...` : message;
+				addHarnessMessage("Console", text, "err");
+			},
+		});
+		logToFile("[Console]", "Console redirected to the log file (TUI mode)");
+	});
+
+	pi.on("session_shutdown", () => {
+		shutdowns++;
+		// Only the last session may take the console back.
+		if (!restore || shutdowns < starts) return;
+		restore();
+		restore = null;
+	});
+}
+
 // --- honcho-memory: Honcho MCP for peer/user memory via https://mcp.honcho.dev ------
 // Registers Honcho MCP server and implements automatic memory lifecycle:
 // - Ingest sanitized messages on completed turns
@@ -2765,7 +2884,7 @@ function processCompletionFile(filePath: string, pi: ExtensionAPI): void {
 // --- Debug logging (file only, no console override) ---------------
 // Logs written to file only. Real console output preserved for pi's TUI.
 import { homedir } from "node:os";
-import { existsSync, mkdirSync, readFileSync, readdirSync, symlinkSync, appendFileSync, realpathSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, symlinkSync, appendFileSync, realpathSync, statSync, chmodSync, openSync, closeSync, renameSync } from "node:fs";
 import { truncateToWidth } from "@earendil-works/pi-tui";
 import { join, dirname } from "node:path";
 
@@ -2775,6 +2894,11 @@ const HARNESS_ROOT_DIR = join(homedir(), ".pi-harness-runtime");
 /** Startup messages collected during init — shown on session_start via ctx.ui.notify */
 const startupMessages: string[] = [];
 const HARNESS_LOG_FILE = "/tmp/pi-harness.log";
+// The log can contain urls and session ids: owner only, no rotation while it
+// is small, and a bounded size so a chatty dependency cannot fill the disk.
+const HARNESS_LOG_MAX_BYTES = 5 * 1024 * 1024;
+let harnessLogFileSecured = false;
+let harnessLogWrites = 0;
 
 /** Log a harness message to file (not stderr - bypasses Pi's cursor tracking) */
 function logToFile(...parts: string[]): void {
@@ -2782,10 +2906,56 @@ function logToFile(...parts: string[]): void {
 	// A timestamp makes the log usable for latency measurements.
 	const stamp = new Date().toISOString();
 	try {
+		if (!harnessLogFileSecured) {
+			try {
+				// Create the file with the owner-only mode BEFORE the first
+				// write: there must be no world-readable window.
+				const fd = openSync(HARNESS_LOG_FILE, "a", 0o600);
+				closeSync(fd);
+				chmodSync(HARNESS_LOG_FILE, 0o600);
+				// Only a successful attempt stops the retries.
+				harnessLogFileSecured = true;
+			} catch {
+				// Ignore permission errors (e.g. a mounted /tmp) and retry
+				// on the next write.
+			}
+		}
+
+		// Keep the log bounded: rotate it when it grew too large.
+		harnessLogWrites++;
+		if (harnessLogWrites % 200 === 0) {
+			try {
+				if (statSync(HARNESS_LOG_FILE).size > HARNESS_LOG_MAX_BYTES) {
+					renameSync(HARNESS_LOG_FILE, `${HARNESS_LOG_FILE}.1`);
+					chmodSync(`${HARNESS_LOG_FILE}.1`, 0o600);
+					// Secure the fresh file right away: the write that
+					// follows must not land in a 0644 file.
+					try {
+						const fd = openSync(HARNESS_LOG_FILE, "a", 0o600);
+						closeSync(fd);
+						chmodSync(HARNESS_LOG_FILE, 0o600);
+						harnessLogFileSecured = true;
+					} catch {
+						harnessLogFileSecured = false;
+					}
+				}
+			} catch {
+				// Ignore rotation errors
+			}
+		}
+
 		appendFileSync(HARNESS_LOG_FILE, `[${stamp}] ${msg}\n`);
 	} catch {
 		// Ignore file write errors
 	}
+
+	// Mirror the line into the centralized pipeline. The sampler keeps the
+	// volume bounded; the local file above stays the source of truth.
+	try {
+		centralInfo("harness", "log", msg);
+	} catch {
+		// Logging must never break the caller.
+	}
 }
 
 /** Log a harness startup message to file and track for UI */
@@ -3233,6 +3403,22 @@ export default async function (pi: ExtensionAPI) {
 	const mirrorStore = new MirrorStore();
 	ensureHarnessDir();
 
+	// --- central-logging: ship structured logs to R2 / the webhook server ---
+	// The pipeline is opt-in by configuration, never by code: without R2
+	// credentials and without a webhook URL nothing leaves the machine.
+	try {
+		const logConfig = initCentralLogging();
+		if (logConfig?.enabled) {
+			logToFile(
+				"[CentralLogging]",
+				"enabled -",
+				logConfig.notes.length > 0 ? logConfig.notes.join("; ") : "no transport configured",
+			);
+		}
+	} catch (e) {
+		logToFile("[CentralLogging]", "init failed:", String(e));
+	}
+
 	// Collect async init promises so we can wait for them before showing startup notification
 	const asyncInitPromises: Promise<unknown>[] = [];
 
@@ -3294,6 +3480,11 @@ export default async function (pi: ExtensionAPI) {
 	// Telegram is not configured at all - that is the fresh-install case.
 	reportRelayConfiguration();
 
+	// --- console-guard: keep the TUI prompt input field clean ----
+	// A library that writes to the console would put its text into the
+	// prompt input field. The guard sends it to the harness log instead.
+	initConsoleGuard(pi);
+
 	// --- line-voice-queue: Watch for LINE voice commands ----
 	void initLineVoiceQueue(pi);