ragent-cli 1.11.12 → 1.11.14

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "ragent-cli",
-      version: "1.11.12",
+      version: "1.11.14",
       description: "CLI agent for rAgent Live \u2014 browser-first terminal control plane for AI coding agents",
       main: "dist/index.js",
       bin: {
@@ -3538,6 +3538,7 @@ function discoverTranscriptFileImpl(sessionId, agentType) {
 var MAX_PARTIAL_BUFFER = 256 * 1024;
 var MAX_REPLAY_TURNS = 1e3;
 var POLL_INTERVAL_MS = 800;
+var DOC_READ_DEBOUNCE_MS = 200;
 var REDISCOVERY_INTERVAL_MS = 5e3;
 var ENABLE_RETRY_DELAYS_MS = [1e3, 2e3, 5e3];
 var TranscriptWatcher = class {
@@ -3554,6 +3555,7 @@ var TranscriptWatcher = class {
   snapshot;
   watcher = null;
   pollTimer = null;
+  docReadDebounceTimer = null;
   stopped = false;
   subscriberCount = 0;
   documentFingerprint = "";
@@ -3608,6 +3610,10 @@ var TranscriptWatcher = class {
       clearInterval(this.pollTimer);
       this.pollTimer = null;
     }
+    if (this.docReadDebounceTimer) {
+      clearTimeout(this.docReadDebounceTimer);
+      this.docReadDebounceTimer = null;
+    }
   }
   /** Get accumulated turns for replay (up to MAX_REPLAY_TURNS). */
   getReplayTurns(fromSeq) {
@@ -3666,7 +3672,16 @@ var TranscriptWatcher = class {
   startWatching() {
     try {
       this.watcher = fs2.watch(this.filePath, () => {
-        if (!this.stopped) this.readNewData();
+        if (this.stopped) return;
+        if (this.parser.parseDocument) {
+          if (this.docReadDebounceTimer) return;
+          this.docReadDebounceTimer = setTimeout(() => {
+            this.docReadDebounceTimer = null;
+            if (!this.stopped) this.readNewData();
+          }, DOC_READ_DEBOUNCE_MS);
+          return;
+        }
+        this.readNewData();
       });
       this.watcher.on("error", () => {
         this.watcher?.close();
@@ -3721,16 +3736,20 @@ var TranscriptWatcher = class {
     }
   }
   readDocument(force) {
-    let content;
     let stat;
     try {
       stat = fs2.statSync(this.filePath);
-      content = fs2.readFileSync(this.filePath, "utf-8");
     } catch {
       return;
     }
     const fingerprint = `${stat.mtimeMs}:${stat.size}`;
     if (!force && fingerprint === this.documentFingerprint) return;
+    let content;
+    try {
+      content = fs2.readFileSync(this.filePath, "utf-8");
+    } catch {
+      return;
+    }
     this.documentFingerprint = fingerprint;
     const parsedTurns = this.parser.parseDocument?.(content) ?? [];
     this.seq++;
@@ -9673,6 +9692,7 @@ function resolveRuntimeTranscriptSource(sessionId) {
 }
 
 // src/sessions.ts
+var log15 = createLogger("sessions");
 var isMac = os5.platform() === "darwin";
 var MARKDOWN_AGENT_TYPES = /* @__PURE__ */ new Set(["Claude Code", "Codex CLI", "Gemini CLI", "Antigravity CLI"]);
 var isTmuxAvailable = null;
@@ -10070,18 +10090,15 @@ function transcriptSourceForSession(agentType, sessionId) {
 }
 async function collectBareAgentProcesses(excludePids, processList, processByPid) {
   try {
-    const tStart = performance.now();
     if (!processList || !processByPid) {
       const list = await getProcessTable();
       processList = list;
       processByPid = new Map(list.map((p) => [p.pid, p]));
     }
-    const tInit = performance.now();
     const sessions = [];
     const seen = /* @__PURE__ */ new Set();
     const excluded = excludePids ?? /* @__PURE__ */ new Set();
     const parentByPid = new Map(processList.map((row) => [row.pid, row.ppid]));
-    const tParentMap = performance.now();
     const hasTrackedAncestor = (pid, tracked) => {
       const visited = /* @__PURE__ */ new Set();
       let current = parentByPid.get(pid) ?? 0;
@@ -10092,7 +10109,6 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
       }
       return false;
     };
-    const tFilterStart = performance.now();
     const candidates = processList.filter((row) => {
       const { pid, tty, stat, args } = row;
       if (!hasControllingTty(tty)) return false;
@@ -10103,8 +10119,6 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
       if (!hasKeyword) return false;
       return true;
     });
-    const tFilterEnd = performance.now();
-    const tCwdsStart = performance.now();
     const cwds = await Promise.all(
       candidates.map(async (row) => {
         const cwd = await getProcessWorkingDir(row.pid);
@@ -10112,40 +10126,22 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
       })
     );
     const cwdByPid = new Map(cwds.map((c) => [c.pid, c.cwd]));
-    const tCwdsEnd = performance.now();
-    let tLoopAncestor = 0;
-    let tLoopClassify = 0;
-    let tLoopVscode = 0;
-    let tLoopMarkdown = 0;
-    let tLoopStartTimes = 0;
-    const tLoopStart = performance.now();
     for (const row of candidates) {
       const { pid, args } = row;
-      const t0 = performance.now();
-      const skip = seen.has(pid) || hasTrackedAncestor(pid, seen);
-      tLoopAncestor += performance.now() - t0;
-      if (skip) continue;
+      if (seen.has(pid) || hasTrackedAncestor(pid, seen)) continue;
       const workingDir = cwdByPid.get(pid) || null;
-      const t1 = performance.now();
       let classification = classifyAgent(args);
       if (!classification) {
         classification = classifyAgent(args, { workingDir: workingDir ?? void 0 });
       }
-      tLoopClassify += performance.now() - t1;
       if (!classification) continue;
       seen.add(pid);
       const dirName = workingDir ? workingDir.split("/").pop() : null;
       const displayName = dirName && dirName !== "/" && dirName !== "" ? `${classification.agentType} (${dirName})` : `${classification.agentType} (pid ${pid})`;
-      const t2 = performance.now();
       const vscodeDetected = await detectVscodeEnvironment(pid, processByPid);
-      tLoopVscode += performance.now() - t2;
       const id = `process:${pid}`;
-      const t3 = performance.now();
       const mdAvail = markdownAvailableForSession(id, classification.agentType);
-      tLoopMarkdown += performance.now() - t3;
-      const t4 = performance.now();
       const startTimes = collectStartTimes([pid]);
-      tLoopStartTimes += performance.now() - t4;
       sessions.push({
         id,
         type: "process",
@@ -10163,20 +10159,11 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
         startTimes
       });
     }
-    const tLoopEnd = performance.now();
-    console.log(`[PROFILE-BARE] Init took ${(tInit - tStart).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] Parent map took ${(tParentMap - tInit).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] Filtering took ${(tFilterEnd - tFilterStart).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] CWDs took ${(tCwdsEnd - tCwdsStart).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] Loop total took ${(tLoopEnd - tLoopStart).toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Ancestor checks: ${tLoopAncestor.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Classify: ${tLoopClassify.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] VS Code env: ${tLoopVscode.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Markdown check: ${tLoopMarkdown.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Start times: ${tLoopStartTimes.toFixed(2)} ms`);
     return sessions;
   } catch (err) {
-    console.error("[PROFILE-BARE] Error:", err);
+    log15.error("collectBareAgentProcesses failed", {
+      error: err instanceof Error ? err.stack || err.message : String(err)
+    });
     return [];
   }
 }
@@ -10342,7 +10329,7 @@ async function getChildAgentInfo(parentPid, childrenByPpid, visited = /* @__PURE
 }
 
 // src/auth.ts
-var log15 = createLogger("auth");
+var log16 = createLogger("auth");
 var AuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -10360,7 +10347,7 @@ function decodeJwtExp(token) {
   }
 }
 async function startSessionWithMachineSecret(params) {
-  log15.info("attempting session recovery with machine credential");
+  log16.info("attempting session recovery with machine credential");
   const response = await fetch(`${params.portal}/api/agent/session/start`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -10393,7 +10380,7 @@ async function startSessionWithMachineSecret(params) {
     patch.refreshExpiresAt = data.refreshExpiresAt || "";
   }
   saveConfigPatch(patch);
-  log15.info("session recovered via machine credential");
+  log16.info("session recovered via machine credential");
   return data.agentToken;
 }
 async function refreshTokenIfNeeded(params) {
@@ -10404,7 +10391,7 @@ async function refreshTokenIfNeeded(params) {
   const remainingSeconds = exp - Math.floor(Date.now() / 1e3);
   const threshold2 = remainingSeconds < 3600 ? 120 : 3600;
   if (remainingSeconds > threshold2) return params.agentToken;
-  log15.info("token expiring \u2014 refreshing", { minutesRemaining: Math.round(remainingSeconds / 60) });
+  log16.info("token expiring \u2014 refreshing", { minutesRemaining: Math.round(remainingSeconds / 60) });
   try {
     const headers = { "Content-Type": "application/json" };
     let body = {};
@@ -10420,7 +10407,7 @@ async function refreshTokenIfNeeded(params) {
     });
     if (!response.ok) {
       const errorData = await response.json().catch(() => ({}));
-      log15.warn("token refresh failed", { error: errorData.error || response.status });
+      log16.warn("token refresh failed", { error: errorData.error || response.status });
       if (config.machineSecret && config.hostId) {
         try {
           return await startSessionWithMachineSecret({
@@ -10431,7 +10418,7 @@ async function refreshTokenIfNeeded(params) {
         } catch (mcError) {
           if (mcError instanceof AuthError) throw mcError;
           const mcMessage = mcError instanceof Error ? mcError.message : String(mcError);
-          log15.warn("machine credential recovery failed", { error: mcMessage });
+          log16.warn("machine credential recovery failed", { error: mcMessage });
         }
       }
       return params.agentToken;
@@ -10450,12 +10437,12 @@ async function refreshTokenIfNeeded(params) {
       patch.machineSecret = data.machineSecret;
     }
     saveConfigPatch(patch);
-    log15.info("token refreshed successfully");
+    log16.info("token refreshed successfully");
     return data.agentToken;
   } catch (error) {
     if (error instanceof AuthError) throw error;
     const message = error instanceof Error ? error.message : String(error);
-    log15.warn("token refresh error", { error: message });
+    log16.warn("token refresh error", { error: message });
     return params.agentToken;
   }
 }
@@ -10518,7 +10505,7 @@ async function deregisterHost(params) {
     body: JSON.stringify({})
   });
   if (response.status === 401 || response.status === 403) {
-    log15.warn("token expired \u2014 could not deregister from server. Host may remain visible in dashboard until manually removed");
+    log16.warn("token expired \u2014 could not deregister from server. Host may remain visible in dashboard until manually removed");
     return false;
   }
   return response.ok;
@@ -10658,6 +10645,9 @@ function getQueuePressure() {
   else if (level < PRESSURE_LOW) pressureIsHigh = false;
   return { level, isHigh: pressureIsHigh };
 }
+function getDroppedFrameCount() {
+  return droppedFrames;
+}
 function drainQueue() {
   if (!drainWs || drainWs.readyState !== import_ws.default.OPEN) {
     stopDrainTimer();
@@ -10741,7 +10731,7 @@ var import_node_path = require("path");
 var import_node_os = require("os");
 var import_node_string_decoder = require("string_decoder");
 var pty = __toESM(require("node-pty"));
-var log16 = createLogger("session-streamer");
+var log17 = createLogger("session-streamer");
 var BACKPRESSURE_RESUME_CHECK_MS = 100;
 var STOP_DEBOUNCE_MS = 2e3;
 var MAX_CONCURRENT_STREAMS = 20;
@@ -10843,6 +10833,10 @@ var SessionStreamer = class {
   disconnectBufferBytes = /* @__PURE__ */ new Map();
   /** Timer that resumes paused PTYs once the WS queue drains. See #332. */
   backpressureResumeTimer = null;
+  /** Dropped-frame count at the last resume-timer check. */
+  lastSeenDroppedFrames = 0;
+  /** Sessions whose viewers need a capture-pane resync after frame drops. */
+  pendingDropResync = /* @__PURE__ */ new Set();
   constructor(sendFn, onStreamStopped) {
     this.sendFn = sendFn;
     this.onStreamStopped = onStreamStopped;
@@ -10853,6 +10847,14 @@ var SessionStreamer = class {
    * When the WS queue is saturated, PTY onData stops firing after we call
    * ptyProc.pause(). We need an independent loop to check pressure and
    * resume each paused PTY once the queue drains. See #332.
+   *
+   * The same loop heals tmux-pipe streams after frame drops: tmux pipes
+   * have no pause primitive, so under sustained pressure the send queue
+   * overflows and drops frames — severing ANSI sequences and leaving
+   * every viewer garbled until the next full repaint. Once pressure
+   * clears, any drop since the last check triggers a capture-pane resync
+   * (one stream per tick, so the resyncs themselves don't re-saturate
+   * the queue).
    */
   startBackpressureResumeTimer() {
     if (this.backpressureResumeTimer) return;
@@ -10864,11 +10866,32 @@ var SessionStreamer = class {
           try {
             stream.ptyProc.resume();
             stream.ptyPaused = false;
-            log16.info("pty-attach resumed after WS queue drained", { sessionId: stream.sessionId });
+            log17.info("pty-attach resumed after WS queue drained", { sessionId: stream.sessionId });
           } catch {
           }
         }
       }
+      const dropped = getDroppedFrameCount();
+      if (dropped > this.lastSeenDroppedFrames) {
+        for (const stream of this.active.values()) {
+          if (stream.streamType === "tmux-pipe" && !stream.stopped && !stream.initializing) {
+            this.pendingDropResync.add(stream.sessionId);
+          }
+        }
+        this.lastSeenDroppedFrames = dropped;
+        log17.warn("frames dropped under backpressure; scheduling stream resyncs", {
+          droppedTotal: dropped,
+          streams: this.pendingDropResync.size
+        });
+      }
+      const next = this.pendingDropResync.values().next();
+      if (!next.done) {
+        this.pendingDropResync.delete(next.value);
+        const stream = this.active.get(next.value);
+        if (stream && !stream.stopped) {
+          this.resyncStream(next.value);
+        }
+      }
     }, BACKPRESSURE_RESUME_CHECK_MS);
   }
   /**
@@ -10883,7 +10906,7 @@ var SessionStreamer = class {
     try {
       stream.ptyProc.pause();
       stream.ptyPaused = true;
-      log16.warn("pty-attach paused under WS backpressure", {
+      log17.warn("pty-attach paused under WS backpressure", {
         sessionId: stream.sessionId,
         queueLevel: pressure.level.toFixed(2)
       });
@@ -10907,7 +10930,7 @@ var SessionStreamer = class {
         }
       }
       if (entries.some((e) => e.startsWith("s-"))) {
-        log16.info("cleaned up stale stream directories from previous run");
+        log17.info("cleaned up stale stream directories from previous run");
       }
     } catch {
     }
@@ -10925,7 +10948,7 @@ var SessionStreamer = class {
         if (viewerKey) {
           this.active.get(sessionId)?.viewerIds.add(viewerKey);
         }
-        log16.info("cancelled pending stop (re-mounted)", { sessionId });
+        log17.info("cancelled pending stop (re-mounted)", { sessionId });
         return true;
       }
     }
@@ -10936,7 +10959,7 @@ var SessionStreamer = class {
       return true;
     }
     if (this.active.size >= MAX_CONCURRENT_STREAMS) {
-      log16.warn("stream limit reached; rejecting", {
+      log17.warn("stream limit reached; rejecting", {
         limit: MAX_CONCURRENT_STREAMS,
         sessionId
       });
@@ -10967,7 +10990,7 @@ var SessionStreamer = class {
       stream.ptyProc.write(data);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to write input", { sessionId, error: message });
+      log17.warn("failed to write input", { sessionId, error: message });
     }
   }
   /**
@@ -10981,7 +11004,7 @@ var SessionStreamer = class {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       if (!message.includes("EBADF")) {
-        log16.warn("resize failed", { sessionId, error: message });
+        log17.warn("resize failed", { sessionId, error: message });
       }
     }
   }
@@ -11007,7 +11030,7 @@ var SessionStreamer = class {
       this.active.delete(sessionId);
       this.disconnectBuffers.delete(sessionId);
       this.disconnectBufferBytes.delete(sessionId);
-      log16.info("stopped streaming", { sessionId });
+      log17.info("stopped streaming", { sessionId });
     }, STOP_DEBOUNCE_MS);
     this.pendingStops.set(sessionId, timer);
   }
@@ -11032,7 +11055,7 @@ var SessionStreamer = class {
     this.pendingStops.clear();
     for (const [id, stream] of this.active) {
       this.cleanupStream(stream);
-      log16.info("stopped streaming", { sessionId: id });
+      log17.info("stopped streaming", { sessionId: id });
     }
     this.active.clear();
     this.disconnectBuffers.clear();
@@ -11170,13 +11193,13 @@ var SessionStreamer = class {
       }
       stream.initializing = false;
       stream.initBuffer = [];
-      log16.info("resync capture", { sessionId });
+      log17.info("resync capture", { sessionId });
       return true;
     } catch (error) {
       stream.initializing = false;
       stream.initBuffer = [];
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to resync stream", { sessionId, error: message });
+      log17.warn("failed to resync stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11230,7 +11253,7 @@ var SessionStreamer = class {
       } catch (error) {
         this.cleanupStream(stream);
         const message = error instanceof Error ? error.message : String(error);
-        log16.warn("failed pipe-pane", { sessionId, error: message });
+        log17.warn("failed pipe-pane", { sessionId, error: message });
         return false;
       }
       const catProc = (0, import_node_child_process2.spawn)("cat", [fifoPath], { env: cleanEnv, stdio: ["ignore", "pipe", "ignore"] });
@@ -11258,7 +11281,7 @@ var SessionStreamer = class {
           this.cleanupStream(stream);
           this.active.delete(sessionId);
           this.pendingStops.delete(sessionId);
-          log16.info("session stream ended", { sessionId });
+          log17.info("session stream ended", { sessionId });
           this.onStreamStopped?.(sessionId);
         }
       });
@@ -11315,11 +11338,11 @@ var SessionStreamer = class {
       }
       stream.initializing = false;
       stream.initBuffer = [];
-      log16.info("started streaming (tmux)", { sessionId, pane: paneTarget });
+      log17.info("started streaming (tmux)", { sessionId, pane: paneTarget });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start stream", { sessionId, error: message });
+      log17.warn("failed to start stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11365,15 +11388,15 @@ var SessionStreamer = class {
           stream.stopped = true;
           this.active.delete(sessionId);
           this.pendingStops.delete(sessionId);
-          log16.info("session stream ended", { sessionId });
+          log17.info("session stream ended", { sessionId });
           this.onStreamStopped?.(sessionId);
         }
       });
-      log16.info("started streaming (screen)", { sessionId, screen: sessionName });
+      log17.info("started streaming (screen)", { sessionId, screen: sessionName });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start screen stream", { sessionId, error: message });
+      log17.warn("failed to start screen stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11419,15 +11442,15 @@ var SessionStreamer = class {
           stream.stopped = true;
           this.active.delete(sessionId);
           this.pendingStops.delete(sessionId);
-          log16.info("session stream ended", { sessionId });
+          log17.info("session stream ended", { sessionId });
           this.onStreamStopped?.(sessionId);
         }
       });
-      log16.info("started streaming (zellij)", { sessionId, zellij: sessionName });
+      log17.info("started streaming (zellij)", { sessionId, zellij: sessionName });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start zellij stream", { sessionId, error: message });
+      log17.warn("failed to start zellij stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11438,14 +11461,14 @@ var SessionStreamer = class {
     const pid = parseProcessPid2(sessionId);
     if (!pid) return false;
     if (!(0, import_node_fs.existsSync)(`/proc/${pid}`)) {
-      log16.warn("process does not exist (no /proc entry)", { pid });
+      log17.warn("process does not exist (no /proc entry)", { pid });
       this.sendFn(sessionId, "\r\n[rAgent] Process is no longer running. It will be removed on next sync.\r\n");
       return false;
     }
     try {
       const stat = (0, import_node_fs.readFileSync)(`/proc/${pid}/stat`, "utf8");
       if (stat.includes(") Z")) {
-        log16.warn("process is a zombie", { pid });
+        log17.warn("process is a zombie", { pid });
         this.sendFn(sessionId, "\r\n[rAgent] Process has exited (zombie). It will be removed on next sync.\r\n");
         return false;
       }
@@ -11519,14 +11542,14 @@ var SessionStreamer = class {
         stream.stopped = true;
         this.active.delete(sessionId);
         this.pendingStops.delete(sessionId);
-        log16.info("session stream ended", { sessionId });
+        log17.info("session stream ended", { sessionId });
         this.onStreamStopped?.(sessionId);
       });
-      log16.info("started streaming (process trace)", { sessionId, pid });
+      log17.info("started streaming (process trace)", { sessionId, pid });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start process stream", { sessionId, error: message });
+      log17.warn("failed to start process stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11577,7 +11600,7 @@ var SessionStreamer = class {
 
 // src/crypto-channel.ts
 var import_node_crypto = require("crypto");
-var log17 = createLogger("crypto-channel");
+var log18 = createLogger("crypto-channel");
 var AAD_BYTES = 4;
 function deriveAesKey(sessionKey) {
   return Buffer.from(sessionKey.slice(0, 64), "hex");
@@ -11619,7 +11642,7 @@ function decryptPayload(enc, iv, sessionKey, seq) {
     return decrypted.toString("utf-8");
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    log17.warn("decrypt failed", { seq, encBytes: enc.length, error: message });
+    log18.warn("decrypt failed", { seq, encBytes: enc.length, error: message });
     return null;
   }
 }
@@ -11653,7 +11676,7 @@ var SequenceTracker = class {
 // src/pty.ts
 var import_node_child_process3 = require("child_process");
 var pty2 = __toESM(require("node-pty"));
-var log18 = createLogger("pty");
+var log19 = createLogger("pty");
 var MIN_TMUX_COLS = 20;
 var MAX_TMUX_COLS = 500;
 var MIN_TMUX_ROWS = 5;
@@ -11801,7 +11824,7 @@ async function sendInputToTmux(sessionId, data) {
   if (!target) return;
   if (!isValidTmuxSessionName(target)) {
     const sessionName = target.split(":")[0].split(".")[0];
-    log18.warn("invalid tmux session name", { sessionName });
+    log19.warn("invalid tmux session name", { sessionName });
     return;
   }
   try {
@@ -11832,7 +11855,7 @@ async function sendInputToTmux(sessionId, data) {
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    log18.warn("failed to send input", { sessionId, error: message });
+    log19.warn("failed to send input", { sessionId, error: message });
   }
 }
 async function resizeTmuxPaneBySessionId(sessionId, cols, rows) {
@@ -11841,7 +11864,7 @@ async function resizeTmuxPaneBySessionId(sessionId, cols, rows) {
   if (!target) return false;
   if (!isValidTmuxSessionName(target)) {
     const sessionName = target.split(":")[0].split(".")[0];
-    log18.warn("invalid tmux session name", { sessionName });
+    log19.warn("invalid tmux session name", { sessionName });
     return false;
   }
   if (!Number.isFinite(cols) || !Number.isFinite(rows)) return false;
@@ -11855,7 +11878,7 @@ async function resizeTmuxPaneBySessionId(sessionId, cols, rows) {
       (err) => {
         if (err) {
           const message = err instanceof Error ? err.message : String(err);
-          log18.warn("failed to resize tmux pane", { sessionId, error: message });
+          log19.warn("failed to resize tmux pane", { sessionId, error: message });
           resolve(false);
           return;
         }
@@ -11889,7 +11912,7 @@ async function stopAllDetachedTmuxSessions() {
 }
 
 // src/shell-manager.ts
-var log19 = createLogger("shell");
+var log20 = createLogger("shell");
 var ShellManager = class {
   ptyProcess = null;
   suppressNextRespawn = false;
@@ -11930,7 +11953,7 @@ var ShellManager = class {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       if (!message.includes("EBADF")) {
-        log19.warn("resize failed", { error: message });
+        log20.warn("resize failed", { error: message });
       }
     }
   }
@@ -11946,7 +11969,7 @@ var ShellManager = class {
         return;
       }
       if (!this.shouldRun) return;
-      log19.warn("shell exited; restarting shell process");
+      log20.warn("shell exited; restarting shell process");
       setTimeout(() => {
         if (this.shouldRun) this.spawnOrRespawn();
       }, 200);
@@ -12052,7 +12075,7 @@ var InventoryManager = class {
 
 // src/connection-manager.ts
 var import_ws3 = __toESM(require("ws"));
-var log20 = createLogger("connection");
+var log21 = createLogger("connection");
 var OPPORTUNISTIC_INVENTORY_SYNC_MS = 1200;
 var MIN_INVENTORY_SYNC_GAP_MS = 1500;
 var ConnectionManager = class {
@@ -12084,7 +12107,7 @@ var ConnectionManager = class {
       tracker = new SequenceTracker();
       this.rxSeqByViewer.set(key, tracker);
       if (!isValid) {
-        log20.warn("rxSeq fell back to _legacy bucket \u2014 portal sent empty viewerId", { typeofViewerId: typeof viewerId });
+        log21.warn("rxSeq fell back to _legacy bucket \u2014 portal sent empty viewerId", { typeofViewerId: typeof viewerId });
       }
     }
     return tracker;
@@ -12170,14 +12193,14 @@ var ConnectionManager = class {
       try {
         this.activeSocket.send(JSON.stringify({ type: "ping" }));
       } catch (err) {
-        log20.error("failed to send JSON ping", { error: err.message });
+        log21.error("failed to send JSON ping", { error: err.message });
       }
       try {
         this.activeSocket.ping();
       } catch {
       }
       this.wsPongTimeout = setTimeout(() => {
-        log20.warn("no pong received within 10s; closing stale connection");
+        log21.warn("no pong received within 10s; closing stale connection");
         try {
           this.activeSocket?.terminate();
         } catch {
@@ -12247,7 +12270,7 @@ var ConnectionManager = class {
   replayBufferedOutput(sendChunk) {
     const buffered = this.outputBuffer.drain();
     if (buffered.length > 0) {
-      log20.info("replaying buffered output chunks", {
+      log21.info("replaying buffered output chunks", {
         chunks: buffered.length,
         bytes: buffered.reduce((sum, c) => sum + Buffer.byteLength(c, "utf8"), 0)
       });
@@ -12289,7 +12312,7 @@ var import_child_process6 = require("child_process");
 var fs5 = __toESM(require("fs"));
 var os8 = __toESM(require("os"));
 var path4 = __toESM(require("path"));
-var log21 = createLogger("service");
+var log22 = createLogger("service");
 function assertConfiguredAgentToken() {
   const config = loadConfig();
   if (!config.agentToken) {
@@ -12355,7 +12378,7 @@ async function installSystemdService(opts = {}) {
     await runSystemctlUser(["restart", SERVICE_NAME]);
   }
   saveConfigPatch({ serviceBackend: "systemd" });
-  log21.info("installed systemd user service", { path: SERVICE_FILE });
+  log22.info("installed systemd user service", { path: SERVICE_FILE });
 }
 function readFallbackPid() {
   try {
@@ -12394,7 +12417,7 @@ async function startPidfileService() {
   assertConfiguredAgentToken();
   const existingPid = readFallbackPid();
   if (existingPid && isProcessRunning(existingPid)) {
-    log21.info("service already running", { pid: existingPid });
+    log22.info("service already running", { pid: existingPid });
     return;
   }
   ensureConfigDir();
@@ -12411,8 +12434,8 @@ async function startPidfileService() {
   fs5.writeFileSync(FALLBACK_PID_FILE, `${child.pid}
 `, "utf8");
   saveConfigPatch({ serviceBackend: "pidfile" });
-  log21.info("started fallback background service", { pid: child.pid });
-  log21.info("logs", { path: FALLBACK_LOG_FILE });
+  log22.info("started fallback background service", { pid: child.pid });
+  log22.info("logs", { path: FALLBACK_LOG_FILE });
 }
 async function stopPidfileService() {
   const pid = readFallbackPid();
@@ -12421,7 +12444,7 @@ async function stopPidfileService() {
       fs5.unlinkSync(FALLBACK_PID_FILE);
     } catch {
     }
-    log21.info("service is not running");
+    log22.info("service is not running");
     return;
   }
   process.kill(pid, "SIGTERM");
@@ -12436,7 +12459,7 @@ async function stopPidfileService() {
     fs5.unlinkSync(FALLBACK_PID_FILE);
   } catch {
   }
-  log21.info("stopped fallback background service", { pid });
+  log22.info("stopped fallback background service", { pid });
 }
 async function ensureServiceInstalled(opts = {}) {
   const wantsSystemd = await canUseSystemdUser();
@@ -12448,7 +12471,7 @@ async function ensureServiceInstalled(opts = {}) {
   if (opts.start) {
     await startPidfileService();
   } else {
-    log21.info("systemd user manager unavailable; using fallback pidfile backend");
+    log22.info("systemd user manager unavailable; using fallback pidfile backend");
   }
   return "pidfile";
 }
@@ -12456,7 +12479,7 @@ async function startService() {
   const backend = getConfiguredServiceBackend();
   if (backend === "systemd") {
     await runSystemctlUser(["start", SERVICE_NAME]);
-    log21.info("started service via systemd");
+    log22.info("started service via systemd");
     return;
   }
   if (backend === "pidfile") {
@@ -12469,7 +12492,7 @@ async function stopService() {
   const backend = getConfiguredServiceBackend();
   if (backend === "systemd") {
     await runSystemctlUser(["stop", SERVICE_NAME]);
-    log21.info("stopped service via systemd");
+    log22.info("stopped service via systemd");
     return;
   }
   await stopPidfileService();
@@ -12487,7 +12510,7 @@ function killStaleAgentProcesses() {
         try {
           process.kill(pid, 0);
           process.kill(pid, "SIGTERM");
-          log21.info("stopped stale agent process", { pid });
+          log22.info("stopped stale agent process", { pid });
         } catch {
         }
         fs5.unlinkSync(pidPath);
@@ -12502,7 +12525,7 @@ async function restartService() {
   killStaleAgentProcesses();
   if (backend === "systemd") {
     await runSystemctlUser(["restart", SERVICE_NAME]);
-    log21.info("restarted service via systemd");
+    log22.info("restarted service via systemd");
     return;
   }
   await stopPidfileService();
@@ -12518,17 +12541,17 @@ async function printServiceStatus() {
     if (status) {
       process.stdout.write(status);
     } else {
-      log21.info("systemd service is not installed or has no status");
+      log22.info("systemd service is not installed or has no status");
     }
     return;
   }
   const pid = readFallbackPid();
   if (pid && isProcessRunning(pid)) {
-    log21.info("fallback service running", { pid });
-    log21.info("logs", { path: FALLBACK_LOG_FILE });
+    log22.info("fallback service running", { pid });
+    log22.info("logs", { path: FALLBACK_LOG_FILE });
     return;
   }
-  log21.info("service is not running");
+  log22.info("service is not running");
 }
 async function printServiceLogs(opts) {
   const lines = Number.parseInt(String(opts.lines || 100), 10) || 100;
@@ -12554,7 +12577,7 @@ async function printServiceLogs(opts) {
     return;
   }
   if (!fs5.existsSync(FALLBACK_LOG_FILE)) {
-    log21.info("no log file found", { path: FALLBACK_LOG_FILE });
+    log22.info("no log file found", { path: FALLBACK_LOG_FILE });
     return;
   }
   if (follow) {
@@ -12586,7 +12609,7 @@ async function uninstallService() {
   const config = loadConfig();
   delete config.serviceBackend;
   saveConfig(config);
-  log21.info("service uninstalled");
+  log22.info("service uninstalled");
 }
 function requestStopSelfService() {
   const backend = getConfiguredServiceBackend();
@@ -12937,7 +12960,7 @@ async function installLatestCliFromNpm() {
 }
 
 // src/control-dispatcher.ts
-var log22 = createLogger("control");
+var log23 = createLogger("control");
 var TMUX_RESYNC_DEBOUNCE_MS = 150;
 var TMUX_INPUT_COALESCE_MS = 4;
 function collectProcessTreePids(rootPid, visited = /* @__PURE__ */ new Set()) {
@@ -13009,7 +13032,7 @@ var ControlDispatcher = class {
   /** Arrow form so callers can pass it directly without `.bind(this)`. */
   emitNativeOps = (sessionId, ops, seq) => {
     if (!this.sendNativeOps) {
-      log22.warn("native-stream ops produced but no transport sink installed", {
+      log23.warn("native-stream ops produced but no transport sink installed", {
         sessionId,
         opCount: ops.length
       });
@@ -13078,11 +13101,11 @@ var ControlDispatcher = class {
     if (!sessionKey) return true;
     const receivedHmac = payload.hmac;
     if (typeof receivedHmac !== "string") {
-      log22.warn("control message missing HMAC signature");
+      log23.warn("control message missing HMAC signature");
       return false;
     }
     if (!/^[0-9a-f]{64}$/i.test(receivedHmac)) {
-      log22.warn("control message has malformed HMAC signature");
+      log23.warn("control message has malformed HMAC signature");
       return false;
     }
     const { hmac: _, ...payloadWithoutHmac } = payload;
@@ -13110,7 +13133,7 @@ var ControlDispatcher = class {
     ]);
     if (dangerousActions.has(action) && this.connection.sessionKey && payload._verifiedEncrypted !== true) {
       if (!this.verifyMessageHmac(payload)) {
-        log22.warn("rejecting control action \u2014 HMAC verification failed", { action });
+        log23.warn("rejecting control action \u2014 HMAC verification failed", { action });
         return;
       }
     }
@@ -13156,10 +13179,10 @@ var ControlDispatcher = class {
           this.transcriptWatcher?.disableMarkdown(sessionId);
           try {
             await stopTmuxPaneBySessionId(sessionId);
-            log22.info("closed remote session", { sessionId });
+            log23.info("closed remote session", { sessionId });
           } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            log22.warn("failed to close session", { sessionId, error: message });
+            log23.warn("failed to close session", { sessionId, error: message });
           }
           await delay(300);
           await this.syncInventory(true);
@@ -13170,7 +13193,7 @@ var ControlDispatcher = class {
         {
           const pid = parseProcessPid2(sessionId);
           if (pid === null) {
-            log22.warn("kill-process: could not parse PID", { sessionId });
+            log23.warn("kill-process: could not parse PID", { sessionId });
             return;
           }
           this.transcriptWatcher?.disableMarkdown(sessionId);
@@ -13186,11 +13209,11 @@ var ControlDispatcher = class {
                 const code = error.code;
                 if (code !== "ESRCH") {
                   const message = error instanceof Error ? error.message : String(error);
-                  log22.warn("failed to send SIGTERM", { pid: targetPid, error: message });
+                  log23.warn("failed to send SIGTERM", { pid: targetPid, error: message });
                 }
               }
             }
-            log22.info("sent SIGTERM to processes", { signaled, sessionId });
+            log23.info("sent SIGTERM to processes", { signaled, sessionId });
             await new Promise((resolve) => setTimeout(resolve, 1500));
             for (const targetPid of processTree) {
               if (!isProcessAlive(targetPid)) continue;
@@ -13200,13 +13223,13 @@ var ControlDispatcher = class {
                 const code = error.code;
                 if (code !== "ESRCH") {
                   const message = error instanceof Error ? error.message : String(error);
-                  log22.warn("failed to send SIGKILL", { pid: targetPid, error: message });
+                  log23.warn("failed to send SIGKILL", { pid: targetPid, error: message });
                 }
               }
             }
           } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            log22.warn("failed to kill session", { sessionId, error: message });
+            log23.warn("failed to kill session", { sessionId, error: message });
           }
           await this.syncInventory(true);
         }
@@ -13221,7 +13244,7 @@ var ControlDispatcher = class {
           }
         }
         const killed = await stopAllDetachedTmuxSessions();
-        log22.info("killed detached tmux sessions", { count: killed });
+        log23.info("killed detached tmux sessions", { count: killed });
         await delay(300);
         await this.syncInventory(true);
         return;
@@ -13261,18 +13284,18 @@ var ControlDispatcher = class {
     const fileName = typeof payload.fileName === "string" ? payload.fileName : "attachment";
     const contentBase64 = typeof payload.contentBase64 === "string" ? payload.contentBase64 : "";
     if (!contentBase64 || contentBase64.length > 8 * 1024 * 1024) {
-      log22.warn("rejecting attachment upload \u2014 invalid size", { sessionId, fileName });
+      log23.warn("rejecting attachment upload \u2014 invalid size", { sessionId, fileName });
       return;
     }
     let content;
     try {
       content = Buffer.from(contentBase64, "base64");
     } catch {
-      log22.warn("rejecting attachment upload \u2014 invalid base64", { sessionId, fileName });
+      log23.warn("rejecting attachment upload \u2014 invalid base64", { sessionId, fileName });
       return;
     }
     if (content.length === 0 || content.length > 6 * 1024 * 1024) {
-      log22.warn("rejecting attachment upload \u2014 decoded size out of bounds", {
+      log23.warn("rejecting attachment upload \u2014 decoded size out of bounds", {
         sessionId,
         fileName,
         bytes: content.length
@@ -13283,7 +13306,7 @@ var ControlDispatcher = class {
     fs6.mkdirSync(uploadDir, { recursive: true, mode: 448 });
     const writtenPath = path5.join(uploadDir, `${Date.now()}-${safeAttachmentName(fileName)}`);
     fs6.writeFileSync(writtenPath, content, { mode: 384 });
-    log22.info("attachment uploaded", { sessionId, path: writtenPath, bytes: content.length });
+    log23.info("attachment uploaded", { sessionId, path: writtenPath, bytes: content.length });
     this.handleInput(writtenPath, sessionId);
   }
   /** Handle input routing to the correct target. */
@@ -13346,7 +13369,7 @@ var ControlDispatcher = class {
           this.tmuxResizeState.delete(sessionId);
         }
         const message = error instanceof Error ? error.message : String(error);
-        log22.warn("tmux resize failed", { sessionId, error: message });
+        log23.warn("tmux resize failed", { sessionId, error: message });
       });
     } else if (sessionId.startsWith("screen:") || sessionId.startsWith("zellij:")) {
       this.streamer.resize(sessionId, cols, rows);
@@ -13354,30 +13377,30 @@ var ControlDispatcher = class {
   }
   /** Update the installed connector package, then restart when a service backend exists. */
   async updateAgentFromNpm() {
-    log22.info("updating ragent CLI", { current: CURRENT_VERSION });
+    log23.info("updating ragent CLI", { current: CURRENT_VERSION });
     try {
       await installLatestCliFromNpm();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log22.error("failed to update ragent CLI", { error: message });
+      log23.error("failed to update ragent CLI", { error: message });
       return;
     }
     const backend = getConfiguredServiceBackend();
     if (!backend) {
-      log22.warn("ragent CLI updated, but no service backend is configured; restart the connector manually to use the new version");
+      log23.warn("ragent CLI updated, but no service backend is configured; restart the connector manually to use the new version");
       return;
     }
-    log22.info("ragent CLI updated; restarting connector service", { backend });
+    log23.info("ragent CLI updated; restarting connector service", { backend });
     requestRestartSelfService();
   }
   /** Handle provision request from dashboard. */
   async handleProvision(payload) {
     const provReq = validateProvisionRequest(payload);
     if (!provReq) {
-      log22.warn("rejecting provision request \u2014 malformed payload");
+      log23.warn("rejecting provision request \u2014 malformed payload");
       return;
     }
-    log22.info("provision request", { name: provReq.manifest.name, provisionId: provReq.provisionId });
+    log23.info("provision request", { name: provReq.manifest.name, provisionId: provReq.provisionId });
     const sendProgress = (progress) => {
       const ws = this.connection.activeSocket;
       if (ws && ws.readyState === import_ws4.default.OPEN && this.connection.activeGroups.registryGroup) {
@@ -13425,7 +13448,7 @@ var ControlDispatcher = class {
           status: "unavailable",
           reason: result.reason
         });
-        log22.info("could not enable markdown", { sessionId, reason: result.reason });
+        log23.info("could not enable markdown", { sessionId, reason: result.reason });
       } else {
         this.sendMarkdownStatus({
           type: "markdown",
@@ -13459,24 +13482,24 @@ var ControlDispatcher = class {
     const sessionName = typeof payload?.sessionName === "string" && payload.sessionName.trim().length > 0 ? payload.sessionName.trim() : `agent-${Date.now().toString(36)}`;
     const cmd = typeof payload?.command === "string" && payload.command.trim().length > 0 ? payload.command.trim() : null;
     if (!cmd) {
-      log22.warn("start-agent: no command provided, ignoring");
+      log23.warn("start-agent: no command provided, ignoring");
       return;
     }
     if (sessionName.length > 128 || !/^[a-zA-Z0-9_-]+$/.test(sessionName)) {
-      log22.warn("start-agent: invalid session name, ignoring");
+      log23.warn("start-agent: invalid session name, ignoring");
       return;
     }
     const danger = detectDangerousCommand(cmd);
     if (danger) {
       if (!this._approvalEnforcer) {
-        log22.warn("start-agent: rejected dangerous command (no approval enforcer)", {
+        log23.warn("start-agent: rejected dangerous command (no approval enforcer)", {
           category: danger.category,
           pattern: danger.pattern,
           command: cmd
         });
         return;
       }
-      log22.info("start-agent: dangerous command \u2014 awaiting approval", {
+      log23.info("start-agent: dangerous command \u2014 awaiting approval", {
         category: danger.category,
         pattern: danger.pattern,
         sessionName
@@ -13487,28 +13510,28 @@ var ControlDispatcher = class {
         sessionName
       );
       if (response === null) {
-        log22.warn("start-agent: dangerous command not covered by approval policy, rejecting", {
+        log23.warn("start-agent: dangerous command not covered by approval policy, rejecting", {
           category: danger.category,
           command: cmd
         });
         return;
       }
       if (response.type !== "approved") {
-        log22.warn("start-agent: dangerous command denied or timed out", {
+        log23.warn("start-agent: dangerous command denied or timed out", {
           category: danger.category,
           sessionName,
           responseType: response.type
         });
         return;
       }
-      log22.info("start-agent: dangerous command approved", {
+      log23.info("start-agent: dangerous command approved", {
         category: danger.category,
         sessionName
       });
     }
     const rawWorkingDir = typeof payload?.workingDir === "string" && payload.workingDir.trim().length > 0 ? payload.workingDir.trim() : void 0;
     if (rawWorkingDir !== void 0 && !isSafeWorkingDir(rawWorkingDir)) {
-      log22.warn("start-agent: rejected unsafe workingDir", { workingDir: rawWorkingDir });
+      log23.warn("start-agent: rejected unsafe workingDir", { workingDir: rawWorkingDir });
       return;
     }
     const workingDir = rawWorkingDir;
@@ -13557,7 +13580,7 @@ var ControlDispatcher = class {
       }
       if (outcome) {
         if (outcome.ok) {
-          log22.info("start-agent: launched native-stream", {
+          log23.info("start-agent: launched native-stream", {
             sessionId: outcome.sessionId,
             kind: outcome.kind,
             source: outcome.transcriptSource
@@ -13565,7 +13588,7 @@ var ControlDispatcher = class {
           await this.syncInventory(true);
           return;
         }
-        log22.info(
+        log23.info(
           "start-agent: native-stream unavailable; falling through to tmux file-watch",
           { reason: outcome.reason, kind: outcome.kind }
         );
@@ -13585,11 +13608,11 @@ var ControlDispatcher = class {
     let tmuxLaunchOk = false;
     try {
       (0, import_child_process8.execFileSync)("tmux", tmuxArgs, { stdio: "ignore" });
-      log22.info("started agent session", { sessionName, command: cmd });
+      log23.info("started agent session", { sessionName, command: cmd });
       tmuxLaunchOk = true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log22.error("failed to start agent session", { sessionName, error: message });
+      log23.error("failed to start agent session", { sessionName, error: message });
     }
     if (tmuxLaunchOk && pendingFallbackOutcome && pendingFallbackOutcome.userMessage) {
       const tmuxSessionId = this.discoverNewlyCreatedPaneId(sessionName);
@@ -13628,7 +13651,7 @@ var ControlDispatcher = class {
         return `tmux:${sessionName}:${info}`;
       }
     } catch (err) {
-      log22.warn("display-message failed; status block target may not bind", {
+      log23.warn("display-message failed; status block target may not bind", {
         sessionName,
         err: err instanceof Error ? err.message : String(err)
       });
@@ -13896,7 +13919,7 @@ function isGrantExpired(grant) {
 }
 
 // src/approval-enforcer.ts
-var log23 = createLogger("approval");
+var log24 = createLogger("approval");
 var ApprovalEnforcer = class {
   policy;
   secret;
@@ -13920,7 +13943,7 @@ var ApprovalEnforcer = class {
   async checkCommand(command, hostId, sessionId) {
     const request = matchPolicy(command, this.policy, hostId, sessionId);
     if (!request) return null;
-    log23.info("approval pending", {
+    log24.info("approval pending", {
       action: request.action,
       severity: request.severity,
       requestId: request.requestId
@@ -13929,7 +13952,7 @@ var ApprovalEnforcer = class {
       const timer = setTimeout(() => {
         this.pendingRequests.delete(request.requestId);
         const response = { type: "timeout" };
-        log23.info("approval timeout", {
+        log24.info("approval timeout", {
           action: request.action,
           severity: request.severity,
           requestId: request.requestId
@@ -13951,7 +13974,7 @@ var ApprovalEnforcer = class {
    * {@link handleResponse}.
    */
   async requestApproval(request) {
-    log23.info("approval pending (direct)", {
+    log24.info("approval pending (direct)", {
       action: request.action,
       severity: request.severity,
       requestId: request.requestId
@@ -13960,7 +13983,7 @@ var ApprovalEnforcer = class {
       const timer = setTimeout(() => {
         this.pendingRequests.delete(request.requestId);
         const response = { type: "timeout" };
-        log23.info("approval timeout (direct)", {
+        log24.info("approval timeout (direct)", {
           action: request.action,
           severity: request.severity,
           requestId: request.requestId
@@ -13980,7 +14003,7 @@ var ApprovalEnforcer = class {
     if (!requestId) return;
     const pending = this.pendingRequests.get(requestId);
     if (!pending) {
-      log23.warn("received response for unknown approval request", { requestId });
+      log24.warn("received response for unknown approval request", { requestId });
       return;
     }
     if (response.type === "approved") {
@@ -13989,7 +14012,7 @@ var ApprovalEnforcer = class {
         pending.request
       );
       if (bindingMismatch) {
-        log23.info("approval rejected (grant binding mismatch)", {
+        log24.info("approval rejected (grant binding mismatch)", {
           action: pending.request.action,
           severity: pending.request.severity,
           requestId,
@@ -14009,7 +14032,7 @@ var ApprovalEnforcer = class {
         return;
       }
       if (!this.acceptGrant(response.grant)) {
-        log23.info("approval rejected (invalid grant)", {
+        log24.info("approval rejected (invalid grant)", {
           action: pending.request.action,
           severity: pending.request.severity,
           requestId
@@ -14019,13 +14042,13 @@ var ApprovalEnforcer = class {
         pending.resolve({ type: "denied", denial: { requestId, deniedBy: "system", deniedAt: (/* @__PURE__ */ new Date()).toISOString(), reason: "Invalid or expired grant" } });
         return;
       }
-      log23.info("approval approved", {
+      log24.info("approval approved", {
         action: pending.request.action,
         severity: pending.request.severity,
         requestId
       });
     } else if (response.type === "denied") {
-      log23.info("approval denied", {
+      log24.info("approval denied", {
         action: pending.request.action,
         severity: pending.request.severity,
         requestId,
@@ -14066,7 +14089,7 @@ var ApprovalEnforcer = class {
     for (const [id, entry] of this.pendingRequests) {
       clearTimeout(entry.timer);
       this.pendingRequests.delete(id);
-      log23.info("approval stopped", {
+      log24.info("approval stopped", {
         action: entry.request.action,
         severity: entry.request.severity,
         requestId: id
@@ -14102,7 +14125,7 @@ var ApprovalEnforcer = class {
       if (entry.request.sessionId !== sessionId) continue;
       clearTimeout(entry.timer);
       this.pendingRequests.delete(id);
-      log23.info("approval cancelled (session torn down)", {
+      log24.info("approval cancelled (session torn down)", {
         action: entry.request.action,
         severity: entry.request.severity,
         requestId: id,
@@ -14157,7 +14180,7 @@ var ApprovalEnforcer = class {
 };
 
 // src/agent.ts
-var log24 = createLogger("agent");
+var log25 = createLogger("agent");
 var MAX_TRANSPORT_CHUNK_BYTES = 24 * 1024;
 function pidFilePath(hostId) {
   return path6.join(CONFIG_DIR, `agent-${hostId}.pid`);
@@ -14242,15 +14265,15 @@ async function runAgent(rawOptions) {
   const config = loadConfig();
   if (config.redaction?.enabled === false || rawOptions.redact === false) {
     setRedactionEnabled(false);
-    log24.info("secret redaction disabled");
+    log25.info("secret redaction disabled");
   }
-  log24.info("connector started", { hostName: options.hostName, hostId: options.hostId });
-  log24.info("portal", { portal: options.portal });
+  log25.info("connector started", { hostName: options.hostName, hostId: options.hostId });
+  log25.info("portal", { portal: options.portal });
   try {
     const existingSessions = await collectSessionInventory(options.hostId, options.command);
     const tmuxCount = existingSessions.filter((s) => s.type === "tmux").length;
     if (tmuxCount > 0) {
-      log24.info("found existing tmux sessions", { count: tmuxCount });
+      log25.info("found existing tmux sessions", { count: tmuxCount });
     }
   } catch {
   }
@@ -14484,7 +14507,7 @@ async function runAgent(rawOptions) {
             dispatcher.setApprovalEnforcer(null);
           }
           ws.on("open", async () => {
-            log24.info("connector connected to relay");
+            log25.info("connector connected to relay");
             conn.resetReconnectDelay();
             ws.send(JSON.stringify({ type: "joinGroup", group: groups.privateGroup }));
             ws.send(JSON.stringify({ type: "joinGroup", group: groups.registryGroup }));
@@ -14552,9 +14575,9 @@ async function runAgent(rawOptions) {
                   const inSeq = typeof payload.seq === "number" ? payload.seq : null;
                   const rxSeq = conn.getRxSeqForViewer(payload.viewerId);
                   if (inSeq === null) {
-                    log24.warn("rejecting encrypted input frame without seq (#310)");
+                    log25.warn("rejecting encrypted input frame without seq (#310)");
                   } else if (!rxSeq.accept(inSeq)) {
-                    log24.warn("rejecting replayed/out-of-order input", {
+                    log25.warn("rejecting replayed/out-of-order input", {
                       seq: inSeq,
                       lastSeen: rxSeq.lastSeq,
                       viewerId: typeof payload.viewerId === "string" ? payload.viewerId : "_legacy"
@@ -14567,13 +14590,13 @@ async function runAgent(rawOptions) {
                       inSeq
                     );
                     if (inputData === null) {
-                      log24.warn("failed to decrypt input \u2014 ignoring");
+                      log25.warn("failed to decrypt input \u2014 ignoring");
                     }
                   }
                 } else if (typeof payload.data === "string" && !conn.sessionKey) {
                   inputData = payload.data;
                 } else if (conn.sessionKey) {
-                  log24.warn("rejecting plaintext input frame while encrypted channel is active");
+                  log25.warn("rejecting plaintext input frame while encrypted channel is active");
                 }
                 if (inputData !== null) {
                   const sid = typeof payload.sessionId === "string" ? payload.sessionId.trim() : "";
@@ -14581,7 +14604,7 @@ async function runAgent(rawOptions) {
                 }
               } else if (payload.type === "resize" && Number.isInteger(payload.cols) && Number.isInteger(payload.rows)) {
                 if (conn.sessionKey && !dispatcher.verifyMessageHmac(payload)) {
-                  log24.warn("rejecting resize frame \u2014 HMAC verification failed");
+                  log25.warn("rejecting resize frame \u2014 HMAC verification failed");
                   return;
                 }
                 const sid = typeof payload.sessionId === "string" ? payload.sessionId.trim() : "";
@@ -14593,11 +14616,11 @@ async function runAgent(rawOptions) {
                   const inSeq = typeof payload.seq === "number" ? payload.seq : null;
                   const rxSeq = conn.getRxSeqForViewer(payload.viewerId);
                   if (inSeq === null) {
-                    log24.warn("rejecting encrypted control frame without seq");
+                    log25.warn("rejecting encrypted control frame without seq");
                     return;
                   }
                   if (!rxSeq.accept(inSeq)) {
-                    log24.warn("rejecting replayed/out-of-order control", {
+                    log25.warn("rejecting replayed/out-of-order control", {
                       seq: inSeq,
                       lastSeen: rxSeq.lastSeq,
                       viewerId: typeof payload.viewerId === "string" ? payload.viewerId : "_legacy"
@@ -14611,7 +14634,7 @@ async function runAgent(rawOptions) {
                     inSeq
                   );
                   if (decrypted === null) {
-                    log24.warn("failed to decrypt control \u2014 ignoring");
+                    log25.warn("failed to decrypt control \u2014 ignoring");
                     return;
                   }
                   try {
@@ -14620,11 +14643,11 @@ async function runAgent(rawOptions) {
                       _verifiedEncrypted: true
                     };
                   } catch {
-                    log24.warn("failed to parse encrypted control payload");
+                    log25.warn("failed to parse encrypted control payload");
                     return;
                   }
                 } else if (conn.sessionKey && payload.action === "upload-file") {
-                  log24.warn("rejecting plaintext attachment upload while encrypted channel is active");
+                  log25.warn("rejecting plaintext attachment upload while encrypted channel is active");
                   return;
                 }
                 await dispatcher.handleControlAction(controlPayload);
@@ -14644,13 +14667,13 @@ async function runAgent(rawOptions) {
             }
           });
           ws.on("error", (error) => {
-            log24.error("websocket error", { error: error.message });
+            log25.error("websocket error", { error: error.message });
           });
           ws.on("close", (code, reason) => {
             const fields = {};
             if (code) fields.code = code;
             if (reason.length > 0) fields.reason = reason.toString();
-            log24.info("relay disconnected; output will be buffered until reconnect", fields);
+            log25.info("relay disconnected; output will be buffered until reconnect", fields);
             conn.cleanup();
             resolve();
           });
@@ -14667,35 +14690,35 @@ async function runAgent(rawOptions) {
               });
               inventory.updateOptions(options);
               dispatcher.updateOptions(options);
-              log24.info("recovered from auth failure via machine credential; reconnecting");
+              log25.info("recovered from auth failure via machine credential; reconnecting");
               continue;
             } catch (mcError) {
               if (mcError instanceof AuthError) {
-                log24.error("auth recovery failed", { error: mcError.message });
+                log25.error("auth recovery failed", { error: mcError.message });
               } else {
                 const mcMsg = mcError instanceof Error ? mcError.message : String(mcError);
-                log24.error("machine credential recovery failed", { error: mcMsg });
+                log25.error("machine credential recovery failed", { error: mcMsg });
               }
             }
           }
-          log24.error("auth error", { error: error.message });
-          log24.error(
+          log25.error("auth error", { error: error.message });
+          log25.error(
             "connector token is invalid or revoked. Stopping. Re-connect with: ragent connect --token <token>"
           );
           dispatcher.shouldRun = false;
           break;
         }
         const message = error instanceof Error ? error.message : String(error);
-        log24.error("relay connect failed", { error: message });
+        log25.error("relay connect failed", { error: message });
       }
       if (!dispatcher.shouldRun) break;
       if (dispatcher.reconnectRequested) {
-        log24.info("reconnecting to relay");
+        log25.info("reconnecting to relay");
         await wait(300);
         continue;
       }
       const jitteredDelay = conn.reconnectDelay * (0.5 + Math.random());
-      log24.info("disconnected; reconnecting", { seconds: Math.round(jitteredDelay / 1e3) });
+      log25.info("disconnected; reconnecting", { seconds: Math.round(jitteredDelay / 1e3) });
       await wait(jitteredDelay);
       conn.reconnectDelay = Math.min(conn.reconnectDelay * 1.5, MAX_RECONNECT_DELAY_MS);
     }
@@ -14795,7 +14818,7 @@ function printCommandArt(title, subtitle = "remote agent control") {
 }
 
 // src/commands/connect.ts
-var log25 = createLogger("connect");
+var log26 = createLogger("connect");
 async function connectMachine(opts) {
   const portal = opts.portal || DEFAULT_PORTAL;
   const hostId = sanitizeHostId(opts.id || inferHostId());
@@ -14827,12 +14850,12 @@ async function connectMachine(opts) {
     nextConfig.refreshExpiresAt = claimed.refreshExpiresAt;
   }
   saveConfig(nextConfig);
-  log25.info("machine connected", { hostName, hostId });
-  log25.info("machine name (override with --name <friendly-name>)", { hostName });
-  log25.info("config saved", { path: CONFIG_FILE });
+  log26.info("machine connected", { hostName, hostId });
+  log26.info("machine name (override with --name <friendly-name>)", { hostName });
+  log26.info("config saved", { path: CONFIG_FILE });
   if (opts.asService) {
     await ensureServiceInstalled({ enable: true, start: true });
-    log25.info("service mode enabled");
+    log26.info("service mode enabled");
     return;
   }
   if (opts.run !== false) {
@@ -14852,14 +14875,14 @@ function registerConnectCommand(program2) {
       await connectMachine(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log25.error("connect failed", { error: message });
+      log26.error("connect failed", { error: message });
       process.exit(1);
     }
   });
 }
 
 // src/commands/run.ts
-var log26 = createLogger("run");
+var log27 = createLogger("run");
 function registerRunCommand(program2) {
   program2.command("run").description("Run connector for a connected machine").option("--portal <url>", "Portal base URL").option("--agent-token <token>", "Connector token").option("-i, --id <id>", "Machine ID").option("-n, --name <name>", "Machine name").option("-c, --command <command>", "CLI command to run").option("--no-redact", "Disable secret redaction in terminal output").action(async (opts) => {
     try {
@@ -14867,7 +14890,7 @@ function registerRunCommand(program2) {
       await runAgent(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log26.error("run failed", { error: message });
+      log27.error("run failed", { error: message });
       process.exit(1);
     }
   });
@@ -14875,7 +14898,7 @@ function registerRunCommand(program2) {
 
 // src/commands/doctor.ts
 var os12 = __toESM(require("os"));
-var log27 = createLogger("doctor");
+var log28 = createLogger("doctor");
 async function runDoctor(opts) {
   const options = resolveRunOptions(opts);
   const checks = [];
@@ -14911,27 +14934,27 @@ async function runDoctor(opts) {
     console.log(`${check.ok ? "PASS" : "FAIL"}  ${check.name}: ${check.detail}`);
   });
   if (!platformOk) {
-    log27.info("Linux is required for the connector");
+    log28.info("Linux is required for the connector");
   }
   if (!tmuxOk) {
     const recipe = await chooseTmuxInstallCommand();
     if (recipe) {
-      log27.info("tmux install suggestion", { command: recipe.command });
+      log28.info("tmux install suggestion", { command: recipe.command });
     }
     if (opts.fix) {
       try {
         const installed = await installTmuxInteractively();
         if (installed) {
-          log27.info("tmux installation complete");
+          log28.info("tmux installation complete");
         } else {
-          log27.info("tmux installation skipped or incomplete");
+          log28.info("tmux installation skipped or incomplete");
         }
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        log27.error("failed to install tmux", { error: message });
+        log28.error("failed to install tmux", { error: message });
       }
     } else {
-      log27.info("run `ragent doctor --fix` to install missing dependencies interactively");
+      log28.info("run `ragent doctor --fix` to install missing dependencies interactively");
     }
   }
 }
@@ -14943,30 +14966,30 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/update.ts
-var log28 = createLogger("update");
+var log29 = createLogger("update");
 function registerUpdateCommand(program2) {
   program2.command("update").description("Update ragent CLI from npm").option("--check", "Check for updates only; do not install").option("--no-restart", "Do not restart the service after updating").action(async (opts) => {
     printCommandArt("Update", "checking npm registry for newer ragent-cli versions");
     const latestVersion = await checkForUpdate({ force: true });
     if (!latestVersion) {
-      log28.info("you are up to date", { version: CURRENT_VERSION });
+      log29.info("you are up to date", { version: CURRENT_VERSION });
       return;
     }
-    log28.info("update available", { current: CURRENT_VERSION, latest: latestVersion });
+    log29.info("update available", { current: CURRENT_VERSION, latest: latestVersion });
     if (opts.check) return;
     await installLatestCliFromNpm();
-    log28.info("updated", { version: latestVersion });
+    log29.info("updated", { version: latestVersion });
     const backend = getConfiguredServiceBackend();
     if (backend && opts.restart) {
-      log28.info("restarting service", { backend });
+      log29.info("restarting service", { backend });
       try {
         await restartService();
       } catch (err) {
-        log28.error("failed to restart service", { error: err instanceof Error ? err.message : String(err) });
-        log28.info("please restart manually: ragent service restart");
+        log29.error("failed to restart service", { error: err instanceof Error ? err.message : String(err) });
+        log29.info("please restart manually: ragent service restart");
       }
     } else if (!backend) {
-      log28.info("no service backend detected. If ragent is running manually, restart it to use the new version");
+      log29.info("no service backend detected. If ragent is running manually, restart it to use the new version");
     }
   });
 }
@@ -14990,7 +15013,7 @@ function registerSessionsCommand(program2) {
 }
 
 // src/commands/service.ts
-var log29 = createLogger("service-cmd");
+var log30 = createLogger("service-cmd");
 function registerServiceCommand(program2) {
   const service = program2.command("service").description("Manage background connector service");
   service.command("install").description("Install service (systemd user unit when available)").option("--start", "Start service immediately").option("--no-enable", "Do not enable autostart in systemd").action(async (opts) => {
@@ -15001,7 +15024,7 @@ function registerServiceCommand(program2) {
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service install failed", { error: message });
+      log30.error("service install failed", { error: message });
       process.exit(1);
     }
   });
@@ -15010,7 +15033,7 @@ function registerServiceCommand(program2) {
       await startService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service start failed", { error: message });
+      log30.error("service start failed", { error: message });
       process.exit(1);
     }
   });
@@ -15019,7 +15042,7 @@ function registerServiceCommand(program2) {
       await stopService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service stop failed", { error: message });
+      log30.error("service stop failed", { error: message });
       process.exit(1);
     }
   });
@@ -15028,7 +15051,7 @@ function registerServiceCommand(program2) {
       await restartService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service restart failed", { error: message });
+      log30.error("service restart failed", { error: message });
       process.exit(1);
     }
   });
@@ -15037,7 +15060,7 @@ function registerServiceCommand(program2) {
       await printServiceStatus();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service status failed", { error: message });
+      log30.error("service status failed", { error: message });
       process.exit(1);
     }
   });
@@ -15046,7 +15069,7 @@ function registerServiceCommand(program2) {
       await printServiceLogs(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service logs failed", { error: message });
+      log30.error("service logs failed", { error: message });
       process.exit(1);
     }
   });
@@ -15055,7 +15078,7 @@ function registerServiceCommand(program2) {
       await uninstallService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service uninstall failed", { error: message });
+      log30.error("service uninstall failed", { error: message });
       process.exit(1);
     }
   });
@@ -15063,7 +15086,7 @@ function registerServiceCommand(program2) {
 
 // src/commands/uninstall.ts
 var fs8 = __toESM(require("fs"));
-var log30 = createLogger("uninstall");
+var log31 = createLogger("uninstall");
 async function uninstallAgent(opts) {
   const config = loadConfig();
   const hostName = config.hostName || config.hostId || "this machine";
@@ -15073,12 +15096,12 @@ async function uninstallAgent(opts) {
       false
     );
     if (!confirmed) {
-      log30.info("uninstall cancelled");
+      log31.info("uninstall cancelled");
       return;
     }
   }
   if (config.portal && config.agentToken) {
-    log30.info("deregistering from server");
+    log31.info("deregistering from server");
     try {
       const token = await refreshTokenIfNeeded({
         portal: config.portal,
@@ -15086,24 +15109,24 @@ async function uninstallAgent(opts) {
       });
       const ok = await deregisterHost({ portal: config.portal, agentToken: token });
       if (ok) {
-        log30.info("host removed from server");
+        log31.info("host removed from server");
       }
     } catch {
-      log30.warn("could not reach server \u2014 host may need manual removal from dashboard");
+      log31.warn("could not reach server \u2014 host may need manual removal from dashboard");
     }
   }
-  log30.info("stopping and removing service");
+  log31.info("stopping and removing service");
   await uninstallService().catch(() => void 0);
   if (fs8.existsSync(CONFIG_DIR)) {
     fs8.rmSync(CONFIG_DIR, { recursive: true, force: true });
-    log30.info("removed config directory", { path: CONFIG_DIR });
+    log31.info("removed config directory", { path: CONFIG_DIR });
   }
   try {
     await execAsync(`npm unlink -g ${PACKAGE_NAME}`, { timeout: 15e3 });
-    log30.info("unlinked global package", { package: PACKAGE_NAME });
+    log31.info("unlinked global package", { package: PACKAGE_NAME });
   } catch {
   }
-  log30.info("uninstall complete. rAgent has been removed from this machine");
+  log31.info("uninstall complete. rAgent has been removed from this machine");
 }
 function registerUninstallCommand(parent) {
   parent.command("uninstall").description("Remove rAgent from this machine (stops service, deletes config, unlinks CLI)").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
@@ -15112,7 +15135,7 @@ function registerUninstallCommand(parent) {
       await uninstallAgent(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log30.error("uninstall failed", { error: message });
+      log31.error("uninstall failed", { error: message });
       process.exit(1);
     }
   });
@@ -15171,10 +15194,10 @@ function registerDiscoverCommand(program2) {
 }
 
 // src/index.ts
-var log31 = createLogger("cli");
+var log32 = createLogger("cli");
 process.on("unhandledRejection", (reason) => {
   const message = reason instanceof Error ? reason.stack || reason.message : String(reason);
-  log31.error("unhandled promise rejection", { error: message });
+  log32.error("unhandled promise rejection", { error: message });
 });
 import_commander.program.name("ragent").description("Connect machines to rAgent Live").version(CURRENT_VERSION);
 registerConnectCommand(import_commander.program);