ragent-cli 1.11.13 → 1.11.15

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "ragent-cli",
-      version: "1.11.13",
+      version: "1.11.15",
       description: "CLI agent for rAgent Live \u2014 browser-first terminal control plane for AI coding agents",
       main: "dist/index.js",
       bin: {
@@ -9692,6 +9692,7 @@ function resolveRuntimeTranscriptSource(sessionId) {
 }
 
 // src/sessions.ts
+var log15 = createLogger("sessions");
 var isMac = os5.platform() === "darwin";
 var MARKDOWN_AGENT_TYPES = /* @__PURE__ */ new Set(["Claude Code", "Codex CLI", "Gemini CLI", "Antigravity CLI"]);
 var isTmuxAvailable = null;
@@ -10089,18 +10090,15 @@ function transcriptSourceForSession(agentType, sessionId) {
 }
 async function collectBareAgentProcesses(excludePids, processList, processByPid) {
   try {
-    const tStart = performance.now();
     if (!processList || !processByPid) {
       const list = await getProcessTable();
       processList = list;
       processByPid = new Map(list.map((p) => [p.pid, p]));
     }
-    const tInit = performance.now();
     const sessions = [];
     const seen = /* @__PURE__ */ new Set();
     const excluded = excludePids ?? /* @__PURE__ */ new Set();
     const parentByPid = new Map(processList.map((row) => [row.pid, row.ppid]));
-    const tParentMap = performance.now();
     const hasTrackedAncestor = (pid, tracked) => {
       const visited = /* @__PURE__ */ new Set();
       let current = parentByPid.get(pid) ?? 0;
@@ -10111,7 +10109,6 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
       }
       return false;
     };
-    const tFilterStart = performance.now();
     const candidates = processList.filter((row) => {
       const { pid, tty, stat, args } = row;
       if (!hasControllingTty(tty)) return false;
@@ -10122,8 +10119,6 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
       if (!hasKeyword) return false;
       return true;
     });
-    const tFilterEnd = performance.now();
-    const tCwdsStart = performance.now();
     const cwds = await Promise.all(
       candidates.map(async (row) => {
         const cwd = await getProcessWorkingDir(row.pid);
@@ -10131,40 +10126,22 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
       })
     );
     const cwdByPid = new Map(cwds.map((c) => [c.pid, c.cwd]));
-    const tCwdsEnd = performance.now();
-    let tLoopAncestor = 0;
-    let tLoopClassify = 0;
-    let tLoopVscode = 0;
-    let tLoopMarkdown = 0;
-    let tLoopStartTimes = 0;
-    const tLoopStart = performance.now();
     for (const row of candidates) {
       const { pid, args } = row;
-      const t0 = performance.now();
-      const skip = seen.has(pid) || hasTrackedAncestor(pid, seen);
-      tLoopAncestor += performance.now() - t0;
-      if (skip) continue;
+      if (seen.has(pid) || hasTrackedAncestor(pid, seen)) continue;
       const workingDir = cwdByPid.get(pid) || null;
-      const t1 = performance.now();
       let classification = classifyAgent(args);
       if (!classification) {
         classification = classifyAgent(args, { workingDir: workingDir ?? void 0 });
       }
-      tLoopClassify += performance.now() - t1;
       if (!classification) continue;
       seen.add(pid);
       const dirName = workingDir ? workingDir.split("/").pop() : null;
       const displayName = dirName && dirName !== "/" && dirName !== "" ? `${classification.agentType} (${dirName})` : `${classification.agentType} (pid ${pid})`;
-      const t2 = performance.now();
       const vscodeDetected = await detectVscodeEnvironment(pid, processByPid);
-      tLoopVscode += performance.now() - t2;
       const id = `process:${pid}`;
-      const t3 = performance.now();
       const mdAvail = markdownAvailableForSession(id, classification.agentType);
-      tLoopMarkdown += performance.now() - t3;
-      const t4 = performance.now();
       const startTimes = collectStartTimes([pid]);
-      tLoopStartTimes += performance.now() - t4;
       sessions.push({
         id,
         type: "process",
@@ -10182,20 +10159,11 @@ async function collectBareAgentProcesses(excludePids, processList, processByPid)
         startTimes
       });
     }
-    const tLoopEnd = performance.now();
-    console.log(`[PROFILE-BARE] Init took ${(tInit - tStart).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] Parent map took ${(tParentMap - tInit).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] Filtering took ${(tFilterEnd - tFilterStart).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] CWDs took ${(tCwdsEnd - tCwdsStart).toFixed(2)} ms`);
-    console.log(`[PROFILE-BARE] Loop total took ${(tLoopEnd - tLoopStart).toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Ancestor checks: ${tLoopAncestor.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Classify: ${tLoopClassify.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] VS Code env: ${tLoopVscode.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Markdown check: ${tLoopMarkdown.toFixed(2)} ms`);
-    console.log(`  [PROFILE-BARE-LOOP] Start times: ${tLoopStartTimes.toFixed(2)} ms`);
     return sessions;
   } catch (err) {
-    console.error("[PROFILE-BARE] Error:", err);
+    log15.error("collectBareAgentProcesses failed", {
+      error: err instanceof Error ? err.stack || err.message : String(err)
+    });
     return [];
   }
 }
@@ -10361,7 +10329,7 @@ async function getChildAgentInfo(parentPid, childrenByPpid, visited = /* @__PURE
 }
 
 // src/auth.ts
-var log15 = createLogger("auth");
+var log16 = createLogger("auth");
 var AuthError = class extends Error {
   constructor(message) {
     super(message);
@@ -10379,7 +10347,7 @@ function decodeJwtExp(token) {
   }
 }
 async function startSessionWithMachineSecret(params) {
-  log15.info("attempting session recovery with machine credential");
+  log16.info("attempting session recovery with machine credential");
   const response = await fetch(`${params.portal}/api/agent/session/start`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -10412,7 +10380,7 @@ async function startSessionWithMachineSecret(params) {
     patch.refreshExpiresAt = data.refreshExpiresAt || "";
   }
   saveConfigPatch(patch);
-  log15.info("session recovered via machine credential");
+  log16.info("session recovered via machine credential");
   return data.agentToken;
 }
 async function refreshTokenIfNeeded(params) {
@@ -10423,7 +10391,7 @@ async function refreshTokenIfNeeded(params) {
   const remainingSeconds = exp - Math.floor(Date.now() / 1e3);
   const threshold2 = remainingSeconds < 3600 ? 120 : 3600;
   if (remainingSeconds > threshold2) return params.agentToken;
-  log15.info("token expiring \u2014 refreshing", { minutesRemaining: Math.round(remainingSeconds / 60) });
+  log16.info("token expiring \u2014 refreshing", { minutesRemaining: Math.round(remainingSeconds / 60) });
   try {
     const headers = { "Content-Type": "application/json" };
     let body = {};
@@ -10439,7 +10407,7 @@ async function refreshTokenIfNeeded(params) {
     });
     if (!response.ok) {
       const errorData = await response.json().catch(() => ({}));
-      log15.warn("token refresh failed", { error: errorData.error || response.status });
+      log16.warn("token refresh failed", { error: errorData.error || response.status });
       if (config.machineSecret && config.hostId) {
         try {
           return await startSessionWithMachineSecret({
@@ -10450,7 +10418,7 @@ async function refreshTokenIfNeeded(params) {
         } catch (mcError) {
           if (mcError instanceof AuthError) throw mcError;
           const mcMessage = mcError instanceof Error ? mcError.message : String(mcError);
-          log15.warn("machine credential recovery failed", { error: mcMessage });
+          log16.warn("machine credential recovery failed", { error: mcMessage });
         }
       }
       return params.agentToken;
@@ -10469,12 +10437,12 @@ async function refreshTokenIfNeeded(params) {
       patch.machineSecret = data.machineSecret;
     }
     saveConfigPatch(patch);
-    log15.info("token refreshed successfully");
+    log16.info("token refreshed successfully");
     return data.agentToken;
   } catch (error) {
     if (error instanceof AuthError) throw error;
     const message = error instanceof Error ? error.message : String(error);
-    log15.warn("token refresh error", { error: message });
+    log16.warn("token refresh error", { error: message });
     return params.agentToken;
   }
 }
@@ -10537,7 +10505,7 @@ async function deregisterHost(params) {
     body: JSON.stringify({})
   });
   if (response.status === 401 || response.status === 403) {
-    log15.warn("token expired \u2014 could not deregister from server. Host may remain visible in dashboard until manually removed");
+    log16.warn("token expired \u2014 could not deregister from server. Host may remain visible in dashboard until manually removed");
     return false;
   }
   return response.ok;
@@ -10677,6 +10645,9 @@ function getQueuePressure() {
   else if (level < PRESSURE_LOW) pressureIsHigh = false;
   return { level, isHigh: pressureIsHigh };
 }
+function getDroppedFrameCount() {
+  return droppedFrames;
+}
 function drainQueue() {
   if (!drainWs || drainWs.readyState !== import_ws.default.OPEN) {
     stopDrainTimer();
@@ -10760,20 +10731,21 @@ var import_node_path = require("path");
 var import_node_os = require("os");
 var import_node_string_decoder = require("string_decoder");
 var pty = __toESM(require("node-pty"));
-var log16 = createLogger("session-streamer");
+var log17 = createLogger("session-streamer");
 var BACKPRESSURE_RESUME_CHECK_MS = 100;
 var STOP_DEBOUNCE_MS = 2e3;
 var MAX_CONCURRENT_STREAMS = 20;
 var MAX_SESSION_BUFFER_BYTES = 64 * 1024;
 var PRIVATE_MODE_SEQUENCE_RE = /\x1b\[\?([0-9;]*)([hl])/g;
 var ALT_SCREEN_PARAMS = /* @__PURE__ */ new Set(["47", "1047", "1048", "1049"]);
+var MOUSE_MODE_PARAMS = /* @__PURE__ */ new Set(["9", "1000", "1002", "1003", "1005", "1006", "1015", "1016"]);
 function stripAlternateScreenModeSwitches(data) {
   return data.replace(
     PRIVATE_MODE_SEQUENCE_RE,
     (full, params, action) => {
       if (!params) return full;
       const parts = params.split(";");
-      const filtered = parts.filter((p) => !ALT_SCREEN_PARAMS.has(p));
+      const filtered = parts.filter((p) => !ALT_SCREEN_PARAMS.has(p) && !MOUSE_MODE_PARAMS.has(p));
       if (filtered.length === parts.length) return full;
       if (filtered.length === 0) return "";
       return `\x1B[?${filtered.join(";")}${action}`;
@@ -10798,6 +10770,18 @@ var AlternateScreenModeStripper = class {
     return stripAlternateScreenModeSwitches(pending);
   }
 };
+function buildRelativeCursorSync(lineCount, x, y) {
+  if (lineCount <= 0) return "";
+  let seq = "";
+  if (y <= lineCount - 1) {
+    const up = lineCount - 1 - y;
+    if (up > 0) seq += `\x1B[${up}A`;
+  } else {
+    seq += "\r\n".repeat(y - (lineCount - 1));
+  }
+  seq += `\x1B[${x + 1}G`;
+  return seq;
+}
 function parsePaneTarget(sessionId) {
   if (!sessionId.startsWith("tmux:")) return null;
   const rest = sessionId.slice("tmux:".length);
@@ -10853,6 +10837,7 @@ var SessionStreamer = class {
   pendingStops = /* @__PURE__ */ new Map();
   sendFn;
   onStreamStopped;
+  sendResetFn;
   /**
    * Per-session ring buffer for output captured while the WebSocket is disconnected.
    * Each entry is a string chunk; oldest entries are evicted when the total byte
@@ -10862,9 +10847,14 @@ var SessionStreamer = class {
   disconnectBufferBytes = /* @__PURE__ */ new Map();
   /** Timer that resumes paused PTYs once the WS queue drains. See #332. */
   backpressureResumeTimer = null;
-  constructor(sendFn, onStreamStopped) {
+  /** Dropped-frame count at the last resume-timer check. */
+  lastSeenDroppedFrames = 0;
+  /** Sessions whose viewers need a capture-pane resync after frame drops. */
+  pendingDropResync = /* @__PURE__ */ new Set();
+  constructor(sendFn, onStreamStopped, sendResetFn) {
     this.sendFn = sendFn;
     this.onStreamStopped = onStreamStopped;
+    this.sendResetFn = sendResetFn;
     this.cleanupStaleStreams();
     this.startBackpressureResumeTimer();
   }
@@ -10872,6 +10862,14 @@ var SessionStreamer = class {
    * When the WS queue is saturated, PTY onData stops firing after we call
    * ptyProc.pause(). We need an independent loop to check pressure and
    * resume each paused PTY once the queue drains. See #332.
+   *
+   * The same loop heals tmux-pipe streams after frame drops: tmux pipes
+   * have no pause primitive, so under sustained pressure the send queue
+   * overflows and drops frames — severing ANSI sequences and leaving
+   * every viewer garbled until the next full repaint. Once pressure
+   * clears, any drop since the last check triggers a capture-pane resync
+   * (one stream per tick, so the resyncs themselves don't re-saturate
+   * the queue).
    */
   startBackpressureResumeTimer() {
     if (this.backpressureResumeTimer) return;
@@ -10883,11 +10881,32 @@ var SessionStreamer = class {
           try {
             stream.ptyProc.resume();
             stream.ptyPaused = false;
-            log16.info("pty-attach resumed after WS queue drained", { sessionId: stream.sessionId });
+            log17.info("pty-attach resumed after WS queue drained", { sessionId: stream.sessionId });
           } catch {
           }
         }
       }
+      const dropped = getDroppedFrameCount();
+      if (dropped > this.lastSeenDroppedFrames) {
+        for (const stream of this.active.values()) {
+          if (stream.streamType === "tmux-pipe" && !stream.stopped && !stream.initializing) {
+            this.pendingDropResync.add(stream.sessionId);
+          }
+        }
+        this.lastSeenDroppedFrames = dropped;
+        log17.warn("frames dropped under backpressure; scheduling stream resyncs", {
+          droppedTotal: dropped,
+          streams: this.pendingDropResync.size
+        });
+      }
+      const next = this.pendingDropResync.values().next();
+      if (!next.done) {
+        this.pendingDropResync.delete(next.value);
+        const stream = this.active.get(next.value);
+        if (stream && !stream.stopped) {
+          this.resyncStream(next.value);
+        }
+      }
     }, BACKPRESSURE_RESUME_CHECK_MS);
   }
   /**
@@ -10902,7 +10921,7 @@ var SessionStreamer = class {
     try {
       stream.ptyProc.pause();
       stream.ptyPaused = true;
-      log16.warn("pty-attach paused under WS backpressure", {
+      log17.warn("pty-attach paused under WS backpressure", {
         sessionId: stream.sessionId,
         queueLevel: pressure.level.toFixed(2)
       });
@@ -10926,7 +10945,7 @@ var SessionStreamer = class {
         }
       }
       if (entries.some((e) => e.startsWith("s-"))) {
-        log16.info("cleaned up stale stream directories from previous run");
+        log17.info("cleaned up stale stream directories from previous run");
       }
     } catch {
     }
@@ -10944,7 +10963,7 @@ var SessionStreamer = class {
         if (viewerKey) {
           this.active.get(sessionId)?.viewerIds.add(viewerKey);
         }
-        log16.info("cancelled pending stop (re-mounted)", { sessionId });
+        log17.info("cancelled pending stop (re-mounted)", { sessionId });
         return true;
       }
     }
@@ -10955,7 +10974,7 @@ var SessionStreamer = class {
       return true;
     }
     if (this.active.size >= MAX_CONCURRENT_STREAMS) {
-      log16.warn("stream limit reached; rejecting", {
+      log17.warn("stream limit reached; rejecting", {
         limit: MAX_CONCURRENT_STREAMS,
         sessionId
       });
@@ -10986,7 +11005,7 @@ var SessionStreamer = class {
       stream.ptyProc.write(data);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to write input", { sessionId, error: message });
+      log17.warn("failed to write input", { sessionId, error: message });
     }
   }
   /**
@@ -11000,7 +11019,7 @@ var SessionStreamer = class {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       if (!message.includes("EBADF")) {
-        log16.warn("resize failed", { sessionId, error: message });
+        log17.warn("resize failed", { sessionId, error: message });
       }
     }
   }
@@ -11026,7 +11045,7 @@ var SessionStreamer = class {
       this.active.delete(sessionId);
       this.disconnectBuffers.delete(sessionId);
       this.disconnectBufferBytes.delete(sessionId);
-      log16.info("stopped streaming", { sessionId });
+      log17.info("stopped streaming", { sessionId });
     }, STOP_DEBOUNCE_MS);
     this.pendingStops.set(sessionId, timer);
   }
@@ -11051,7 +11070,7 @@ var SessionStreamer = class {
     this.pendingStops.clear();
     for (const [id, stream] of this.active) {
       this.cleanupStream(stream);
-      log16.info("stopped streaming", { sessionId: id });
+      log17.info("stopped streaming", { sessionId: id });
     }
     this.active.clear();
     this.disconnectBuffers.clear();
@@ -11119,84 +11138,141 @@ var SessionStreamer = class {
   }
   /**
    * Re-send capture-pane data for an already-active tmux stream.
-   * Used when a viewer missed the initial burst (e.g. joinGroup race)
-   * or reconnected ("Retry stream"). Does NOT restart pipe-pane.
+   * Used when a viewer missed the initial burst (e.g. joinGroup race),
+   * reconnected, resized, or after backpressure frame drops corrupted the
+   * stream. Does NOT restart pipe-pane.
+   *
+   * Default is a LEAN repaint: visible pane + cursor only. Replaying
+   * scrollback mid-session shoved thousands of lines of old output into
+   * live viewers ("ghost text") on every resize/heal. Pass
+   * `{ scrollback: true }` only for viewer (re)attach, where the replay is
+   * prefixed with ED3 (`\x1b[3J`) so the viewer's existing scrollback is
+   * cleared first instead of duplicated.
    */
-  resyncStream(sessionId, viewerId) {
+  resyncStream(sessionId, viewerId, opts) {
     const stream = this.active.get(sessionId);
     if (!stream || stream.stopped || stream.streamType !== "tmux-pipe") return false;
     const { paneTarget, cleanEnv } = stream;
     if (!paneTarget || !cleanEnv) return false;
     const targetViewerId = viewerId?.trim() || void 0;
-    const send = (data) => {
-      if (targetViewerId) {
-        this.sendFn(sessionId, data, targetViewerId);
-      } else {
-        this.sendFn(sessionId, data);
-      }
-    };
+    const withScrollback = opts?.scrollback === true;
+    if (stream.initializing) {
+      const pending = stream.pendingResyncs ??= [];
+      const duplicate = pending.some(
+        (p) => p.viewerId === targetViewerId && p.scrollback === withScrollback
+      );
+      if (!duplicate) pending.push({ viewerId: targetViewerId, scrollback: withScrollback });
+      return true;
+    }
+    stream.initBuffer = [];
     stream.initializing = true;
-    try {
-      let alternateScreen = false;
-      try {
-        const altFlag = (0, import_node_child_process2.execFileSync)(
-          "tmux",
-          ["display-message", "-t", paneTarget, "-p", "#{alternate_on}"],
-          { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
-        ).trim();
-        alternateScreen = altFlag === "1";
-      } catch {
+    setImmediate(() => {
+      if (stream.stopped) {
+        stream.initializing = false;
+        stream.initBuffer = [];
+        return;
       }
+      const send = (data) => {
+        if (targetViewerId) {
+          this.sendFn(sessionId, data, targetViewerId);
+        } else {
+          this.sendFn(sessionId, data);
+        }
+      };
       try {
-        const scrollback = (0, import_node_child_process2.execFileSync)(
-          "tmux",
-          ["capture-pane", "-t", paneTarget, "-p", "-e", "-S", "-5000", "-E", "-1"],
-          { env: cleanEnv, timeout: 1e4, encoding: "utf-8" }
-        );
-        if (scrollback && scrollback.length > 0) {
-          send(scrollback.replace(/\n/g, "\r\n"));
+        this.sendResetFn?.(sessionId, withScrollback ? "full" : "repaint", targetViewerId);
+        const alternateScreen = this.detectAlternateScreen(paneTarget, cleanEnv);
+        if (withScrollback) {
+          send("\x1B[3J");
+          try {
+            const scrollback = (0, import_node_child_process2.execFileSync)(
+              "tmux",
+              ["capture-pane", "-t", paneTarget, "-p", "-e", "-S", "-5000", "-E", "-1"],
+              { env: cleanEnv, timeout: 1e4, encoding: "utf-8" }
+            );
+            if (scrollback && scrollback.length > 0) {
+              send(scrollback.replace(/\n/g, "\r\n"));
+            }
+          } catch {
+          }
+        }
+        send("\x1B[?1049l\x1B[0m\x1B[2J\x1B[H");
+        const lineCount = this.sendVisiblePane(send, paneTarget, cleanEnv, alternateScreen);
+        this.sendCursorSync(send, paneTarget, cleanEnv, lineCount);
+        log17.info("resync capture", { sessionId, mode: withScrollback ? "full" : "repaint" });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        log17.warn("failed to resync stream", { sessionId, error: message });
+      } finally {
+        stream.initializing = false;
+        stream.initBuffer = [];
+        const next = stream.pendingResyncs?.shift();
+        if (next && !stream.stopped) {
+          this.resyncStream(sessionId, next.viewerId, { scrollback: next.scrollback });
         }
-      } catch {
       }
-      send("\x1B[?1049l\x1B[0m\x1B[2J\x1B[H");
-      try {
-        const captureArgs = alternateScreen ? ["capture-pane", "-a", "-t", paneTarget, "-p", "-e"] : ["capture-pane", "-t", paneTarget, "-p", "-e"];
-        const initial = (0, import_node_child_process2.execFileSync)(
-          "tmux",
-          captureArgs,
-          { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
+    });
+    return true;
+  }
+  /** Detect whether the pane is using the alternate screen buffer. */
+  detectAlternateScreen(paneTarget, cleanEnv) {
+    try {
+      const altFlag = (0, import_node_child_process2.execFileSync)(
+        "tmux",
+        ["display-message", "-t", paneTarget, "-p", "#{alternate_on}"],
+        { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
+      ).trim();
+      return altFlag === "1";
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Capture and send the visible pane content. Converts bare \n to \r\n for
+   * xterm.js and strips the trailing \r\n to prevent an extra scroll that
+   * would shift the viewport by 1 row. Returns the number of lines sent
+   * (0 when the capture failed or was empty) for relative cursor sync.
+   */
+  sendVisiblePane(send, paneTarget, cleanEnv, alternateScreen) {
+    try {
+      const captureArgs = alternateScreen ? ["capture-pane", "-a", "-t", paneTarget, "-p", "-e"] : ["capture-pane", "-t", paneTarget, "-p", "-e"];
+      const initial = (0, import_node_child_process2.execFileSync)(
+        "tmux",
+        captureArgs,
+        { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
+      );
+      if (initial) {
+        const converted = stripAlternateScreenModeSwitches(
+          initial.replace(/\n/g, "\r\n").replace(/\r\n$/, "")
         );
-        if (initial) {
-          send(stripAlternateScreenModeSwitches(initial.replace(/\n/g, "\r\n").replace(/\r\n$/, "")));
+        if (converted) {
+          send(converted);
+          return converted.split("\r\n").length;
         }
-      } catch {
       }
-      try {
-        const cursorInfo = (0, import_node_child_process2.execFileSync)(
-          "tmux",
-          ["display-message", "-t", paneTarget, "-p", "#{cursor_x} #{cursor_y}"],
-          { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
-        ).trim();
-        const parts = cursorInfo.split(" ");
-        if (parts.length === 2) {
-          const x = parseInt(parts[0], 10);
-          const y = parseInt(parts[1], 10);
-          if (!isNaN(x) && !isNaN(y)) {
-            send(`\x1B[${y + 1};${x + 1}H`);
-          }
+    } catch {
+    }
+    return 0;
+  }
+  /** Query the tmux cursor position and send a relative cursor sync. */
+  sendCursorSync(send, paneTarget, cleanEnv, lineCount) {
+    if (lineCount <= 0) return;
+    try {
+      const cursorInfo = (0, import_node_child_process2.execFileSync)(
+        "tmux",
+        ["display-message", "-t", paneTarget, "-p", "#{cursor_x} #{cursor_y}"],
+        { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
+      ).trim();
+      const parts = cursorInfo.split(" ");
+      if (parts.length === 2) {
+        const x = parseInt(parts[0], 10);
+        const y = parseInt(parts[1], 10);
+        if (!isNaN(x) && !isNaN(y)) {
+          const seq = buildRelativeCursorSync(lineCount, x, y);
+          if (seq) send(seq);
         }
-      } catch {
       }
-      stream.initializing = false;
-      stream.initBuffer = [];
-      log16.info("resync capture", { sessionId });
-      return true;
-    } catch (error) {
-      stream.initializing = false;
-      stream.initBuffer = [];
-      const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to resync stream", { sessionId, error: message });
-      return false;
+    } catch {
     }
   }
   // ---------------------------------------------------------------------------
@@ -11249,7 +11325,7 @@ var SessionStreamer = class {
       } catch (error) {
         this.cleanupStream(stream);
         const message = error instanceof Error ? error.message : String(error);
-        log16.warn("failed pipe-pane", { sessionId, error: message });
+        log17.warn("failed pipe-pane", { sessionId, error: message });
         return false;
       }
       const catProc = (0, import_node_child_process2.spawn)("cat", [fifoPath], { env: cleanEnv, stdio: ["ignore", "pipe", "ignore"] });
@@ -11277,21 +11353,14 @@ var SessionStreamer = class {
           this.cleanupStream(stream);
           this.active.delete(sessionId);
           this.pendingStops.delete(sessionId);
-          log16.info("session stream ended", { sessionId });
+          log17.info("session stream ended", { sessionId });
           this.onStreamStopped?.(sessionId);
         }
       });
-      let alternateScreen = false;
-      try {
-        const altFlag = (0, import_node_child_process2.execFileSync)(
-          "tmux",
-          ["display-message", "-t", paneTarget, "-p", "#{alternate_on}"],
-          { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
-        ).trim();
-        alternateScreen = altFlag === "1";
-      } catch {
-      }
+      this.sendResetFn?.(sessionId, "full");
+      const alternateScreen = this.detectAlternateScreen(paneTarget, cleanEnv);
       stream.alternateScreen = alternateScreen;
+      this.sendFn(sessionId, "\x1B[3J");
       try {
         const scrollback = (0, import_node_child_process2.execFileSync)(
           "tmux",
@@ -11304,41 +11373,16 @@ var SessionStreamer = class {
       } catch {
       }
       this.sendFn(sessionId, "\x1B[?1049l\x1B[0m\x1B[2J\x1B[H");
-      try {
-        const captureArgs = alternateScreen ? ["capture-pane", "-a", "-t", paneTarget, "-p", "-e"] : ["capture-pane", "-t", paneTarget, "-p", "-e"];
-        const initial = (0, import_node_child_process2.execFileSync)(
-          "tmux",
-          captureArgs,
-          { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
-        );
-        if (initial) {
-          this.sendFn(sessionId, stripAlternateScreenModeSwitches(initial.replace(/\n/g, "\r\n").replace(/\r\n$/, "")));
-        }
-      } catch {
-      }
-      try {
-        const cursorInfo = (0, import_node_child_process2.execFileSync)(
-          "tmux",
-          ["display-message", "-t", paneTarget, "-p", "#{cursor_x} #{cursor_y}"],
-          { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
-        ).trim();
-        const parts = cursorInfo.split(" ");
-        if (parts.length === 2) {
-          const x = parseInt(parts[0], 10);
-          const y = parseInt(parts[1], 10);
-          if (!isNaN(x) && !isNaN(y)) {
-            this.sendFn(sessionId, `\x1B[${y + 1};${x + 1}H`);
-          }
-        }
-      } catch {
-      }
+      const sendBroadcast = (data) => this.sendFn(sessionId, data);
+      const lineCount = this.sendVisiblePane(sendBroadcast, paneTarget, cleanEnv, alternateScreen);
+      this.sendCursorSync(sendBroadcast, paneTarget, cleanEnv, lineCount);
       stream.initializing = false;
       stream.initBuffer = [];
-      log16.info("started streaming (tmux)", { sessionId, pane: paneTarget });
+      log17.info("started streaming (tmux)", { sessionId, pane: paneTarget });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start stream", { sessionId, error: message });
+      log17.warn("failed to start stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11384,15 +11428,15 @@ var SessionStreamer = class {
           stream.stopped = true;
           this.active.delete(sessionId);
           this.pendingStops.delete(sessionId);
-          log16.info("session stream ended", { sessionId });
+          log17.info("session stream ended", { sessionId });
           this.onStreamStopped?.(sessionId);
         }
       });
-      log16.info("started streaming (screen)", { sessionId, screen: sessionName });
+      log17.info("started streaming (screen)", { sessionId, screen: sessionName });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start screen stream", { sessionId, error: message });
+      log17.warn("failed to start screen stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11438,15 +11482,15 @@ var SessionStreamer = class {
           stream.stopped = true;
           this.active.delete(sessionId);
           this.pendingStops.delete(sessionId);
-          log16.info("session stream ended", { sessionId });
+          log17.info("session stream ended", { sessionId });
           this.onStreamStopped?.(sessionId);
         }
       });
-      log16.info("started streaming (zellij)", { sessionId, zellij: sessionName });
+      log17.info("started streaming (zellij)", { sessionId, zellij: sessionName });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start zellij stream", { sessionId, error: message });
+      log17.warn("failed to start zellij stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11457,14 +11501,14 @@ var SessionStreamer = class {
     const pid = parseProcessPid2(sessionId);
     if (!pid) return false;
     if (!(0, import_node_fs.existsSync)(`/proc/${pid}`)) {
-      log16.warn("process does not exist (no /proc entry)", { pid });
+      log17.warn("process does not exist (no /proc entry)", { pid });
       this.sendFn(sessionId, "\r\n[rAgent] Process is no longer running. It will be removed on next sync.\r\n");
       return false;
     }
     try {
       const stat = (0, import_node_fs.readFileSync)(`/proc/${pid}/stat`, "utf8");
       if (stat.includes(") Z")) {
-        log16.warn("process is a zombie", { pid });
+        log17.warn("process is a zombie", { pid });
         this.sendFn(sessionId, "\r\n[rAgent] Process has exited (zombie). It will be removed on next sync.\r\n");
         return false;
       }
@@ -11538,14 +11582,14 @@ var SessionStreamer = class {
         stream.stopped = true;
         this.active.delete(sessionId);
         this.pendingStops.delete(sessionId);
-        log16.info("session stream ended", { sessionId });
+        log17.info("session stream ended", { sessionId });
         this.onStreamStopped?.(sessionId);
       });
-      log16.info("started streaming (process trace)", { sessionId, pid });
+      log17.info("started streaming (process trace)", { sessionId, pid });
       return true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log16.warn("failed to start process stream", { sessionId, error: message });
+      log17.warn("failed to start process stream", { sessionId, error: message });
       return false;
     }
   }
@@ -11596,7 +11640,7 @@ var SessionStreamer = class {
 
 // src/crypto-channel.ts
 var import_node_crypto = require("crypto");
-var log17 = createLogger("crypto-channel");
+var log18 = createLogger("crypto-channel");
 var AAD_BYTES = 4;
 function deriveAesKey(sessionKey) {
   return Buffer.from(sessionKey.slice(0, 64), "hex");
@@ -11638,7 +11682,7 @@ function decryptPayload(enc, iv, sessionKey, seq) {
     return decrypted.toString("utf-8");
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    log17.warn("decrypt failed", { seq, encBytes: enc.length, error: message });
+    log18.warn("decrypt failed", { seq, encBytes: enc.length, error: message });
     return null;
   }
 }
@@ -11672,7 +11716,7 @@ var SequenceTracker = class {
 // src/pty.ts
 var import_node_child_process3 = require("child_process");
 var pty2 = __toESM(require("node-pty"));
-var log18 = createLogger("pty");
+var log19 = createLogger("pty");
 var MIN_TMUX_COLS = 20;
 var MAX_TMUX_COLS = 500;
 var MIN_TMUX_ROWS = 5;
@@ -11693,6 +11737,11 @@ var ANSI_KEY_SEQUENCES = /* @__PURE__ */ new Map([
   ["\x1B[6~", "PageDown"]
 ]);
 var ANSI_KEY_ENTRIES = Array.from(ANSI_KEY_SEQUENCES.entries());
+var MOUSE_OR_FOCUS_REPORT_RE = /\x1b\[(?:<\d+;\d+;\d+[Mm]|\d+;\d+;\d+M|M[\x20-\xFF]{3}|[IO])/g;
+function sanitizeRemoteInput(data) {
+  if (!data.includes("\x1B[")) return data;
+  return data.replace(MOUSE_OR_FOCUS_REPORT_RE, "");
+}
 function controlKeyName(charCode) {
   if (charCode >= 1 && charCode <= 26) {
     return `C-${String.fromCharCode(charCode + 96)}`;
@@ -11723,7 +11772,8 @@ function appendLiteralSegment(segments, value) {
     segments.push({ kind: "literal", value });
   }
 }
-function encodeTmuxInput(data) {
+function encodeTmuxInput(rawData) {
+  const data = sanitizeRemoteInput(rawData);
   const segments = [];
   let literal = "";
   const flushLiteral = () => {
@@ -11820,7 +11870,7 @@ async function sendInputToTmux(sessionId, data) {
   if (!target) return;
   if (!isValidTmuxSessionName(target)) {
     const sessionName = target.split(":")[0].split(".")[0];
-    log18.warn("invalid tmux session name", { sessionName });
+    log19.warn("invalid tmux session name", { sessionName });
     return;
   }
   try {
@@ -11851,7 +11901,7 @@ async function sendInputToTmux(sessionId, data) {
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    log18.warn("failed to send input", { sessionId, error: message });
+    log19.warn("failed to send input", { sessionId, error: message });
   }
 }
 async function resizeTmuxPaneBySessionId(sessionId, cols, rows) {
@@ -11860,7 +11910,7 @@ async function resizeTmuxPaneBySessionId(sessionId, cols, rows) {
   if (!target) return false;
   if (!isValidTmuxSessionName(target)) {
     const sessionName = target.split(":")[0].split(".")[0];
-    log18.warn("invalid tmux session name", { sessionName });
+    log19.warn("invalid tmux session name", { sessionName });
     return false;
   }
   if (!Number.isFinite(cols) || !Number.isFinite(rows)) return false;
@@ -11874,7 +11924,7 @@ async function resizeTmuxPaneBySessionId(sessionId, cols, rows) {
       (err) => {
         if (err) {
           const message = err instanceof Error ? err.message : String(err);
-          log18.warn("failed to resize tmux pane", { sessionId, error: message });
+          log19.warn("failed to resize tmux pane", { sessionId, error: message });
           resolve(false);
           return;
         }
@@ -11908,7 +11958,7 @@ async function stopAllDetachedTmuxSessions() {
 }
 
 // src/shell-manager.ts
-var log19 = createLogger("shell");
+var log20 = createLogger("shell");
 var ShellManager = class {
   ptyProcess = null;
   suppressNextRespawn = false;
@@ -11949,7 +11999,7 @@ var ShellManager = class {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       if (!message.includes("EBADF")) {
-        log19.warn("resize failed", { error: message });
+        log20.warn("resize failed", { error: message });
       }
     }
   }
@@ -11965,7 +12015,7 @@ var ShellManager = class {
         return;
       }
       if (!this.shouldRun) return;
-      log19.warn("shell exited; restarting shell process");
+      log20.warn("shell exited; restarting shell process");
       setTimeout(() => {
         if (this.shouldRun) this.spawnOrRespawn();
       }, 200);
@@ -12071,7 +12121,7 @@ var InventoryManager = class {
 
 // src/connection-manager.ts
 var import_ws3 = __toESM(require("ws"));
-var log20 = createLogger("connection");
+var log21 = createLogger("connection");
 var OPPORTUNISTIC_INVENTORY_SYNC_MS = 1200;
 var MIN_INVENTORY_SYNC_GAP_MS = 1500;
 var ConnectionManager = class {
@@ -12103,7 +12153,7 @@ var ConnectionManager = class {
       tracker = new SequenceTracker();
       this.rxSeqByViewer.set(key, tracker);
       if (!isValid) {
-        log20.warn("rxSeq fell back to _legacy bucket \u2014 portal sent empty viewerId", { typeofViewerId: typeof viewerId });
+        log21.warn("rxSeq fell back to _legacy bucket \u2014 portal sent empty viewerId", { typeofViewerId: typeof viewerId });
       }
     }
     return tracker;
@@ -12189,14 +12239,14 @@ var ConnectionManager = class {
       try {
         this.activeSocket.send(JSON.stringify({ type: "ping" }));
       } catch (err) {
-        log20.error("failed to send JSON ping", { error: err.message });
+        log21.error("failed to send JSON ping", { error: err.message });
       }
       try {
         this.activeSocket.ping();
       } catch {
       }
       this.wsPongTimeout = setTimeout(() => {
-        log20.warn("no pong received within 10s; closing stale connection");
+        log21.warn("no pong received within 10s; closing stale connection");
         try {
           this.activeSocket?.terminate();
         } catch {
@@ -12266,7 +12316,7 @@ var ConnectionManager = class {
   replayBufferedOutput(sendChunk) {
     const buffered = this.outputBuffer.drain();
     if (buffered.length > 0) {
-      log20.info("replaying buffered output chunks", {
+      log21.info("replaying buffered output chunks", {
         chunks: buffered.length,
         bytes: buffered.reduce((sum, c) => sum + Buffer.byteLength(c, "utf8"), 0)
       });
@@ -12308,7 +12358,7 @@ var import_child_process6 = require("child_process");
 var fs5 = __toESM(require("fs"));
 var os8 = __toESM(require("os"));
 var path4 = __toESM(require("path"));
-var log21 = createLogger("service");
+var log22 = createLogger("service");
 function assertConfiguredAgentToken() {
   const config = loadConfig();
   if (!config.agentToken) {
@@ -12374,7 +12424,7 @@ async function installSystemdService(opts = {}) {
     await runSystemctlUser(["restart", SERVICE_NAME]);
   }
   saveConfigPatch({ serviceBackend: "systemd" });
-  log21.info("installed systemd user service", { path: SERVICE_FILE });
+  log22.info("installed systemd user service", { path: SERVICE_FILE });
 }
 function readFallbackPid() {
   try {
@@ -12413,7 +12463,7 @@ async function startPidfileService() {
   assertConfiguredAgentToken();
   const existingPid = readFallbackPid();
   if (existingPid && isProcessRunning(existingPid)) {
-    log21.info("service already running", { pid: existingPid });
+    log22.info("service already running", { pid: existingPid });
     return;
   }
   ensureConfigDir();
@@ -12430,8 +12480,8 @@ async function startPidfileService() {
   fs5.writeFileSync(FALLBACK_PID_FILE, `${child.pid}
 `, "utf8");
   saveConfigPatch({ serviceBackend: "pidfile" });
-  log21.info("started fallback background service", { pid: child.pid });
-  log21.info("logs", { path: FALLBACK_LOG_FILE });
+  log22.info("started fallback background service", { pid: child.pid });
+  log22.info("logs", { path: FALLBACK_LOG_FILE });
 }
 async function stopPidfileService() {
   const pid = readFallbackPid();
@@ -12440,7 +12490,7 @@ async function stopPidfileService() {
       fs5.unlinkSync(FALLBACK_PID_FILE);
     } catch {
     }
-    log21.info("service is not running");
+    log22.info("service is not running");
     return;
   }
   process.kill(pid, "SIGTERM");
@@ -12455,7 +12505,7 @@ async function stopPidfileService() {
     fs5.unlinkSync(FALLBACK_PID_FILE);
   } catch {
   }
-  log21.info("stopped fallback background service", { pid });
+  log22.info("stopped fallback background service", { pid });
 }
 async function ensureServiceInstalled(opts = {}) {
   const wantsSystemd = await canUseSystemdUser();
@@ -12467,7 +12517,7 @@ async function ensureServiceInstalled(opts = {}) {
   if (opts.start) {
     await startPidfileService();
   } else {
-    log21.info("systemd user manager unavailable; using fallback pidfile backend");
+    log22.info("systemd user manager unavailable; using fallback pidfile backend");
   }
   return "pidfile";
 }
@@ -12475,7 +12525,7 @@ async function startService() {
   const backend = getConfiguredServiceBackend();
   if (backend === "systemd") {
     await runSystemctlUser(["start", SERVICE_NAME]);
-    log21.info("started service via systemd");
+    log22.info("started service via systemd");
     return;
   }
   if (backend === "pidfile") {
@@ -12488,7 +12538,7 @@ async function stopService() {
   const backend = getConfiguredServiceBackend();
   if (backend === "systemd") {
     await runSystemctlUser(["stop", SERVICE_NAME]);
-    log21.info("stopped service via systemd");
+    log22.info("stopped service via systemd");
     return;
   }
   await stopPidfileService();
@@ -12506,7 +12556,7 @@ function killStaleAgentProcesses() {
         try {
           process.kill(pid, 0);
           process.kill(pid, "SIGTERM");
-          log21.info("stopped stale agent process", { pid });
+          log22.info("stopped stale agent process", { pid });
         } catch {
         }
         fs5.unlinkSync(pidPath);
@@ -12521,7 +12571,7 @@ async function restartService() {
   killStaleAgentProcesses();
   if (backend === "systemd") {
     await runSystemctlUser(["restart", SERVICE_NAME]);
-    log21.info("restarted service via systemd");
+    log22.info("restarted service via systemd");
     return;
   }
   await stopPidfileService();
@@ -12537,17 +12587,17 @@ async function printServiceStatus() {
     if (status) {
       process.stdout.write(status);
     } else {
-      log21.info("systemd service is not installed or has no status");
+      log22.info("systemd service is not installed or has no status");
     }
     return;
   }
   const pid = readFallbackPid();
   if (pid && isProcessRunning(pid)) {
-    log21.info("fallback service running", { pid });
-    log21.info("logs", { path: FALLBACK_LOG_FILE });
+    log22.info("fallback service running", { pid });
+    log22.info("logs", { path: FALLBACK_LOG_FILE });
     return;
   }
-  log21.info("service is not running");
+  log22.info("service is not running");
 }
 async function printServiceLogs(opts) {
   const lines = Number.parseInt(String(opts.lines || 100), 10) || 100;
@@ -12573,7 +12623,7 @@ async function printServiceLogs(opts) {
     return;
   }
   if (!fs5.existsSync(FALLBACK_LOG_FILE)) {
-    log21.info("no log file found", { path: FALLBACK_LOG_FILE });
+    log22.info("no log file found", { path: FALLBACK_LOG_FILE });
     return;
   }
   if (follow) {
@@ -12605,7 +12655,7 @@ async function uninstallService() {
   const config = loadConfig();
   delete config.serviceBackend;
   saveConfig(config);
-  log21.info("service uninstalled");
+  log22.info("service uninstalled");
 }
 function requestStopSelfService() {
   const backend = getConfiguredServiceBackend();
@@ -12956,7 +13006,7 @@ async function installLatestCliFromNpm() {
 }
 
 // src/control-dispatcher.ts
-var log22 = createLogger("control");
+var log23 = createLogger("control");
 var TMUX_RESYNC_DEBOUNCE_MS = 150;
 var TMUX_INPUT_COALESCE_MS = 4;
 function collectProcessTreePids(rootPid, visited = /* @__PURE__ */ new Set()) {
@@ -13028,7 +13078,7 @@ var ControlDispatcher = class {
   /** Arrow form so callers can pass it directly without `.bind(this)`. */
   emitNativeOps = (sessionId, ops, seq) => {
     if (!this.sendNativeOps) {
-      log22.warn("native-stream ops produced but no transport sink installed", {
+      log23.warn("native-stream ops produced but no transport sink installed", {
         sessionId,
         opCount: ops.length
       });
@@ -13097,11 +13147,11 @@ var ControlDispatcher = class {
     if (!sessionKey) return true;
     const receivedHmac = payload.hmac;
     if (typeof receivedHmac !== "string") {
-      log22.warn("control message missing HMAC signature");
+      log23.warn("control message missing HMAC signature");
       return false;
     }
     if (!/^[0-9a-f]{64}$/i.test(receivedHmac)) {
-      log22.warn("control message has malformed HMAC signature");
+      log23.warn("control message has malformed HMAC signature");
       return false;
     }
     const { hmac: _, ...payloadWithoutHmac } = payload;
@@ -13129,7 +13179,7 @@ var ControlDispatcher = class {
     ]);
     if (dangerousActions.has(action) && this.connection.sessionKey && payload._verifiedEncrypted !== true) {
       if (!this.verifyMessageHmac(payload)) {
-        log22.warn("rejecting control action \u2014 HMAC verification failed", { action });
+        log23.warn("rejecting control action \u2014 HMAC verification failed", { action });
         return;
       }
     }
@@ -13175,10 +13225,10 @@ var ControlDispatcher = class {
           this.transcriptWatcher?.disableMarkdown(sessionId);
           try {
             await stopTmuxPaneBySessionId(sessionId);
-            log22.info("closed remote session", { sessionId });
+            log23.info("closed remote session", { sessionId });
           } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            log22.warn("failed to close session", { sessionId, error: message });
+            log23.warn("failed to close session", { sessionId, error: message });
           }
           await delay(300);
           await this.syncInventory(true);
@@ -13189,7 +13239,7 @@ var ControlDispatcher = class {
         {
           const pid = parseProcessPid2(sessionId);
           if (pid === null) {
-            log22.warn("kill-process: could not parse PID", { sessionId });
+            log23.warn("kill-process: could not parse PID", { sessionId });
             return;
           }
           this.transcriptWatcher?.disableMarkdown(sessionId);
@@ -13205,11 +13255,11 @@ var ControlDispatcher = class {
                 const code = error.code;
                 if (code !== "ESRCH") {
                   const message = error instanceof Error ? error.message : String(error);
-                  log22.warn("failed to send SIGTERM", { pid: targetPid, error: message });
+                  log23.warn("failed to send SIGTERM", { pid: targetPid, error: message });
                 }
               }
             }
-            log22.info("sent SIGTERM to processes", { signaled, sessionId });
+            log23.info("sent SIGTERM to processes", { signaled, sessionId });
             await new Promise((resolve) => setTimeout(resolve, 1500));
             for (const targetPid of processTree) {
               if (!isProcessAlive(targetPid)) continue;
@@ -13219,13 +13269,13 @@ var ControlDispatcher = class {
                 const code = error.code;
                 if (code !== "ESRCH") {
                   const message = error instanceof Error ? error.message : String(error);
-                  log22.warn("failed to send SIGKILL", { pid: targetPid, error: message });
+                  log23.warn("failed to send SIGKILL", { pid: targetPid, error: message });
                 }
               }
             }
           } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            log22.warn("failed to kill session", { sessionId, error: message });
+            log23.warn("failed to kill session", { sessionId, error: message });
           }
           await this.syncInventory(true);
         }
@@ -13240,7 +13290,7 @@ var ControlDispatcher = class {
           }
         }
         const killed = await stopAllDetachedTmuxSessions();
-        log22.info("killed detached tmux sessions", { count: killed });
+        log23.info("killed detached tmux sessions", { count: killed });
         await delay(300);
         await this.syncInventory(true);
         return;
@@ -13280,18 +13330,18 @@ var ControlDispatcher = class {
     const fileName = typeof payload.fileName === "string" ? payload.fileName : "attachment";
     const contentBase64 = typeof payload.contentBase64 === "string" ? payload.contentBase64 : "";
     if (!contentBase64 || contentBase64.length > 8 * 1024 * 1024) {
-      log22.warn("rejecting attachment upload \u2014 invalid size", { sessionId, fileName });
+      log23.warn("rejecting attachment upload \u2014 invalid size", { sessionId, fileName });
       return;
     }
     let content;
     try {
       content = Buffer.from(contentBase64, "base64");
     } catch {
-      log22.warn("rejecting attachment upload \u2014 invalid base64", { sessionId, fileName });
+      log23.warn("rejecting attachment upload \u2014 invalid base64", { sessionId, fileName });
       return;
     }
     if (content.length === 0 || content.length > 6 * 1024 * 1024) {
-      log22.warn("rejecting attachment upload \u2014 decoded size out of bounds", {
+      log23.warn("rejecting attachment upload \u2014 decoded size out of bounds", {
         sessionId,
         fileName,
         bytes: content.length
@@ -13302,11 +13352,13 @@ var ControlDispatcher = class {
     fs6.mkdirSync(uploadDir, { recursive: true, mode: 448 });
     const writtenPath = path5.join(uploadDir, `${Date.now()}-${safeAttachmentName(fileName)}`);
     fs6.writeFileSync(writtenPath, content, { mode: 384 });
-    log22.info("attachment uploaded", { sessionId, path: writtenPath, bytes: content.length });
+    log23.info("attachment uploaded", { sessionId, path: writtenPath, bytes: content.length });
     this.handleInput(writtenPath, sessionId);
   }
   /** Handle input routing to the correct target. */
-  handleInput(data, sessionId) {
+  handleInput(rawData, sessionId) {
+    const data = sanitizeRemoteInput(rawData);
+    if (!data) return;
     if (!sessionId || sessionId.startsWith("pty:")) {
       this.shell.write(data);
     } else if (sessionId.startsWith("tmux:")) {
@@ -13365,7 +13417,7 @@ var ControlDispatcher = class {
           this.tmuxResizeState.delete(sessionId);
         }
         const message = error instanceof Error ? error.message : String(error);
-        log22.warn("tmux resize failed", { sessionId, error: message });
+        log23.warn("tmux resize failed", { sessionId, error: message });
       });
     } else if (sessionId.startsWith("screen:") || sessionId.startsWith("zellij:")) {
       this.streamer.resize(sessionId, cols, rows);
@@ -13373,30 +13425,30 @@ var ControlDispatcher = class {
   }
   /** Update the installed connector package, then restart when a service backend exists. */
   async updateAgentFromNpm() {
-    log22.info("updating ragent CLI", { current: CURRENT_VERSION });
+    log23.info("updating ragent CLI", { current: CURRENT_VERSION });
     try {
       await installLatestCliFromNpm();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log22.error("failed to update ragent CLI", { error: message });
+      log23.error("failed to update ragent CLI", { error: message });
       return;
     }
     const backend = getConfiguredServiceBackend();
     if (!backend) {
-      log22.warn("ragent CLI updated, but no service backend is configured; restart the connector manually to use the new version");
+      log23.warn("ragent CLI updated, but no service backend is configured; restart the connector manually to use the new version");
       return;
     }
-    log22.info("ragent CLI updated; restarting connector service", { backend });
+    log23.info("ragent CLI updated; restarting connector service", { backend });
     requestRestartSelfService();
   }
   /** Handle provision request from dashboard. */
   async handleProvision(payload) {
     const provReq = validateProvisionRequest(payload);
     if (!provReq) {
-      log22.warn("rejecting provision request \u2014 malformed payload");
+      log23.warn("rejecting provision request \u2014 malformed payload");
       return;
     }
-    log22.info("provision request", { name: provReq.manifest.name, provisionId: provReq.provisionId });
+    log23.info("provision request", { name: provReq.manifest.name, provisionId: provReq.provisionId });
     const sendProgress = (progress) => {
       const ws = this.connection.activeSocket;
       if (ws && ws.readyState === import_ws4.default.OPEN && this.connection.activeGroups.registryGroup) {
@@ -13444,7 +13496,7 @@ var ControlDispatcher = class {
           status: "unavailable",
           reason: result.reason
         });
-        log22.info("could not enable markdown", { sessionId, reason: result.reason });
+        log23.info("could not enable markdown", { sessionId, reason: result.reason });
       } else {
         this.sendMarkdownStatus({
           type: "markdown",
@@ -13478,24 +13530,24 @@ var ControlDispatcher = class {
     const sessionName = typeof payload?.sessionName === "string" && payload.sessionName.trim().length > 0 ? payload.sessionName.trim() : `agent-${Date.now().toString(36)}`;
     const cmd = typeof payload?.command === "string" && payload.command.trim().length > 0 ? payload.command.trim() : null;
     if (!cmd) {
-      log22.warn("start-agent: no command provided, ignoring");
+      log23.warn("start-agent: no command provided, ignoring");
       return;
     }
     if (sessionName.length > 128 || !/^[a-zA-Z0-9_-]+$/.test(sessionName)) {
-      log22.warn("start-agent: invalid session name, ignoring");
+      log23.warn("start-agent: invalid session name, ignoring");
       return;
     }
     const danger = detectDangerousCommand(cmd);
     if (danger) {
       if (!this._approvalEnforcer) {
-        log22.warn("start-agent: rejected dangerous command (no approval enforcer)", {
+        log23.warn("start-agent: rejected dangerous command (no approval enforcer)", {
           category: danger.category,
           pattern: danger.pattern,
           command: cmd
         });
         return;
       }
-      log22.info("start-agent: dangerous command \u2014 awaiting approval", {
+      log23.info("start-agent: dangerous command \u2014 awaiting approval", {
         category: danger.category,
         pattern: danger.pattern,
         sessionName
@@ -13506,28 +13558,28 @@ var ControlDispatcher = class {
         sessionName
       );
       if (response === null) {
-        log22.warn("start-agent: dangerous command not covered by approval policy, rejecting", {
+        log23.warn("start-agent: dangerous command not covered by approval policy, rejecting", {
           category: danger.category,
           command: cmd
         });
         return;
       }
       if (response.type !== "approved") {
-        log22.warn("start-agent: dangerous command denied or timed out", {
+        log23.warn("start-agent: dangerous command denied or timed out", {
           category: danger.category,
           sessionName,
           responseType: response.type
         });
         return;
       }
-      log22.info("start-agent: dangerous command approved", {
+      log23.info("start-agent: dangerous command approved", {
         category: danger.category,
         sessionName
       });
     }
     const rawWorkingDir = typeof payload?.workingDir === "string" && payload.workingDir.trim().length > 0 ? payload.workingDir.trim() : void 0;
     if (rawWorkingDir !== void 0 && !isSafeWorkingDir(rawWorkingDir)) {
-      log22.warn("start-agent: rejected unsafe workingDir", { workingDir: rawWorkingDir });
+      log23.warn("start-agent: rejected unsafe workingDir", { workingDir: rawWorkingDir });
       return;
     }
     const workingDir = rawWorkingDir;
@@ -13576,7 +13628,7 @@ var ControlDispatcher = class {
       }
       if (outcome) {
         if (outcome.ok) {
-          log22.info("start-agent: launched native-stream", {
+          log23.info("start-agent: launched native-stream", {
             sessionId: outcome.sessionId,
             kind: outcome.kind,
             source: outcome.transcriptSource
@@ -13584,7 +13636,7 @@ var ControlDispatcher = class {
           await this.syncInventory(true);
           return;
         }
-        log22.info(
+        log23.info(
           "start-agent: native-stream unavailable; falling through to tmux file-watch",
           { reason: outcome.reason, kind: outcome.kind }
         );
@@ -13604,11 +13656,11 @@ var ControlDispatcher = class {
     let tmuxLaunchOk = false;
     try {
       (0, import_child_process8.execFileSync)("tmux", tmuxArgs, { stdio: "ignore" });
-      log22.info("started agent session", { sessionName, command: cmd });
+      log23.info("started agent session", { sessionName, command: cmd });
       tmuxLaunchOk = true;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log22.error("failed to start agent session", { sessionName, error: message });
+      log23.error("failed to start agent session", { sessionName, error: message });
     }
     if (tmuxLaunchOk && pendingFallbackOutcome && pendingFallbackOutcome.userMessage) {
       const tmuxSessionId = this.discoverNewlyCreatedPaneId(sessionName);
@@ -13647,7 +13699,7 @@ var ControlDispatcher = class {
         return `tmux:${sessionName}:${info}`;
       }
     } catch (err) {
-      log22.warn("display-message failed; status block target may not bind", {
+      log23.warn("display-message failed; status block target may not bind", {
         sessionName,
         err: err instanceof Error ? err.message : String(err)
       });
@@ -13685,12 +13737,11 @@ var ControlDispatcher = class {
     const viewerKey = viewerId?.trim() || "";
     if (sessionId.startsWith("tmux:") || sessionId.startsWith("screen:") || sessionId.startsWith("zellij:") || sessionId.startsWith("process:")) {
       const alreadyStreaming = this.streamer.isStreaming(sessionId);
-      const viewerAlreadyAttached = alreadyStreaming && this.streamer.hasViewer(sessionId, viewerKey);
       const started = this.streamer.startStream(sessionId, viewerId ?? void 0);
       if (ws && ws.readyState === import_ws4.default.OPEN && group) {
         if (started) {
-          if (alreadyStreaming && !viewerAlreadyAttached) {
-            this.streamer.resyncStream(sessionId, viewerKey);
+          if (alreadyStreaming) {
+            this.streamer.resyncStream(sessionId, viewerKey, { scrollback: true });
           }
           const dims = this.queryPaneDimensions(sessionId);
           sendToGroup(ws, group, { type: "stream-started", sessionId, ...dims });
@@ -13915,7 +13966,7 @@ function isGrantExpired(grant) {
 }
 
 // src/approval-enforcer.ts
-var log23 = createLogger("approval");
+var log24 = createLogger("approval");
 var ApprovalEnforcer = class {
   policy;
   secret;
@@ -13939,7 +13990,7 @@ var ApprovalEnforcer = class {
   async checkCommand(command, hostId, sessionId) {
     const request = matchPolicy(command, this.policy, hostId, sessionId);
     if (!request) return null;
-    log23.info("approval pending", {
+    log24.info("approval pending", {
       action: request.action,
       severity: request.severity,
       requestId: request.requestId
@@ -13948,7 +13999,7 @@ var ApprovalEnforcer = class {
       const timer = setTimeout(() => {
         this.pendingRequests.delete(request.requestId);
         const response = { type: "timeout" };
-        log23.info("approval timeout", {
+        log24.info("approval timeout", {
           action: request.action,
           severity: request.severity,
           requestId: request.requestId
@@ -13970,7 +14021,7 @@ var ApprovalEnforcer = class {
    * {@link handleResponse}.
    */
   async requestApproval(request) {
-    log23.info("approval pending (direct)", {
+    log24.info("approval pending (direct)", {
       action: request.action,
       severity: request.severity,
       requestId: request.requestId
@@ -13979,7 +14030,7 @@ var ApprovalEnforcer = class {
       const timer = setTimeout(() => {
         this.pendingRequests.delete(request.requestId);
         const response = { type: "timeout" };
-        log23.info("approval timeout (direct)", {
+        log24.info("approval timeout (direct)", {
           action: request.action,
           severity: request.severity,
           requestId: request.requestId
@@ -13999,7 +14050,7 @@ var ApprovalEnforcer = class {
     if (!requestId) return;
     const pending = this.pendingRequests.get(requestId);
     if (!pending) {
-      log23.warn("received response for unknown approval request", { requestId });
+      log24.warn("received response for unknown approval request", { requestId });
       return;
     }
     if (response.type === "approved") {
@@ -14008,7 +14059,7 @@ var ApprovalEnforcer = class {
         pending.request
       );
       if (bindingMismatch) {
-        log23.info("approval rejected (grant binding mismatch)", {
+        log24.info("approval rejected (grant binding mismatch)", {
           action: pending.request.action,
           severity: pending.request.severity,
           requestId,
@@ -14028,7 +14079,7 @@ var ApprovalEnforcer = class {
         return;
       }
       if (!this.acceptGrant(response.grant)) {
-        log23.info("approval rejected (invalid grant)", {
+        log24.info("approval rejected (invalid grant)", {
           action: pending.request.action,
           severity: pending.request.severity,
           requestId
@@ -14038,13 +14089,13 @@ var ApprovalEnforcer = class {
         pending.resolve({ type: "denied", denial: { requestId, deniedBy: "system", deniedAt: (/* @__PURE__ */ new Date()).toISOString(), reason: "Invalid or expired grant" } });
         return;
       }
-      log23.info("approval approved", {
+      log24.info("approval approved", {
         action: pending.request.action,
         severity: pending.request.severity,
         requestId
       });
     } else if (response.type === "denied") {
-      log23.info("approval denied", {
+      log24.info("approval denied", {
         action: pending.request.action,
         severity: pending.request.severity,
         requestId,
@@ -14085,7 +14136,7 @@ var ApprovalEnforcer = class {
     for (const [id, entry] of this.pendingRequests) {
       clearTimeout(entry.timer);
       this.pendingRequests.delete(id);
-      log23.info("approval stopped", {
+      log24.info("approval stopped", {
         action: entry.request.action,
         severity: entry.request.severity,
         requestId: id
@@ -14121,7 +14172,7 @@ var ApprovalEnforcer = class {
       if (entry.request.sessionId !== sessionId) continue;
       clearTimeout(entry.timer);
       this.pendingRequests.delete(id);
-      log23.info("approval cancelled (session torn down)", {
+      log24.info("approval cancelled (session torn down)", {
         action: entry.request.action,
         severity: entry.request.severity,
         requestId: id,
@@ -14176,7 +14227,7 @@ var ApprovalEnforcer = class {
 };
 
 // src/agent.ts
-var log24 = createLogger("agent");
+var log25 = createLogger("agent");
 var MAX_TRANSPORT_CHUNK_BYTES = 24 * 1024;
 function pidFilePath(hostId) {
   return path6.join(CONFIG_DIR, `agent-${hostId}.pid`);
@@ -14261,15 +14312,15 @@ async function runAgent(rawOptions) {
   const config = loadConfig();
   if (config.redaction?.enabled === false || rawOptions.redact === false) {
     setRedactionEnabled(false);
-    log24.info("secret redaction disabled");
+    log25.info("secret redaction disabled");
   }
-  log24.info("connector started", { hostName: options.hostName, hostId: options.hostId });
-  log24.info("portal", { portal: options.portal });
+  log25.info("connector started", { hostName: options.hostName, hostId: options.hostId });
+  log25.info("portal", { portal: options.portal });
   try {
     const existingSessions = await collectSessionInventory(options.hostId, options.command);
     const tmuxCount = existingSessions.filter((s) => s.type === "tmux").length;
     if (tmuxCount > 0) {
-      log24.info("found existing tmux sessions", { count: tmuxCount });
+      log25.info("found existing tmux sessions", { count: tmuxCount });
     }
   } catch {
   }
@@ -14304,6 +14355,24 @@ async function runAgent(rawOptions) {
       }
       if (!conn.isReady()) return;
       sendToGroup(conn.activeSocket, conn.activeGroups.privateGroup, { type: "stream-stopped", sessionId });
+    },
+    (sessionId, mode, viewerId) => {
+      if (!conn.isReady()) return;
+      const tail = flushStreamingRedaction(sessionId);
+      if (tail) {
+        if (conn.sessionKey) {
+          const { enc, iv, seq } = encryptPayload(tail, conn.sessionKey, conn.txSeq.next());
+          sendToGroup(conn.activeSocket, conn.activeGroups.privateGroup, { type: "output", enc, iv, seq, sessionId });
+        } else {
+          sendToGroup(conn.activeSocket, conn.activeGroups.privateGroup, { type: "output", data: tail, sessionId });
+        }
+      }
+      sendToGroup(conn.activeSocket, conn.activeGroups.privateGroup, {
+        type: "stream-reset",
+        sessionId,
+        mode,
+        ...viewerId ? { viewerId } : {}
+      });
     }
   );
   const conn = new ConnectionManager(sessionStreamer, outputBuffer);
@@ -14503,7 +14572,7 @@ async function runAgent(rawOptions) {
             dispatcher.setApprovalEnforcer(null);
           }
           ws.on("open", async () => {
-            log24.info("connector connected to relay");
+            log25.info("connector connected to relay");
             conn.resetReconnectDelay();
             ws.send(JSON.stringify({ type: "joinGroup", group: groups.privateGroup }));
             ws.send(JSON.stringify({ type: "joinGroup", group: groups.registryGroup }));
@@ -14571,9 +14640,9 @@ async function runAgent(rawOptions) {
                   const inSeq = typeof payload.seq === "number" ? payload.seq : null;
                   const rxSeq = conn.getRxSeqForViewer(payload.viewerId);
                   if (inSeq === null) {
-                    log24.warn("rejecting encrypted input frame without seq (#310)");
+                    log25.warn("rejecting encrypted input frame without seq (#310)");
                   } else if (!rxSeq.accept(inSeq)) {
-                    log24.warn("rejecting replayed/out-of-order input", {
+                    log25.warn("rejecting replayed/out-of-order input", {
                       seq: inSeq,
                       lastSeen: rxSeq.lastSeq,
                       viewerId: typeof payload.viewerId === "string" ? payload.viewerId : "_legacy"
@@ -14586,13 +14655,13 @@ async function runAgent(rawOptions) {
                       inSeq
                     );
                     if (inputData === null) {
-                      log24.warn("failed to decrypt input \u2014 ignoring");
+                      log25.warn("failed to decrypt input \u2014 ignoring");
                     }
                   }
                 } else if (typeof payload.data === "string" && !conn.sessionKey) {
                   inputData = payload.data;
                 } else if (conn.sessionKey) {
-                  log24.warn("rejecting plaintext input frame while encrypted channel is active");
+                  log25.warn("rejecting plaintext input frame while encrypted channel is active");
                 }
                 if (inputData !== null) {
                   const sid = typeof payload.sessionId === "string" ? payload.sessionId.trim() : "";
@@ -14600,7 +14669,7 @@ async function runAgent(rawOptions) {
                 }
               } else if (payload.type === "resize" && Number.isInteger(payload.cols) && Number.isInteger(payload.rows)) {
                 if (conn.sessionKey && !dispatcher.verifyMessageHmac(payload)) {
-                  log24.warn("rejecting resize frame \u2014 HMAC verification failed");
+                  log25.warn("rejecting resize frame \u2014 HMAC verification failed");
                   return;
                 }
                 const sid = typeof payload.sessionId === "string" ? payload.sessionId.trim() : "";
@@ -14612,11 +14681,11 @@ async function runAgent(rawOptions) {
                   const inSeq = typeof payload.seq === "number" ? payload.seq : null;
                   const rxSeq = conn.getRxSeqForViewer(payload.viewerId);
                   if (inSeq === null) {
-                    log24.warn("rejecting encrypted control frame without seq");
+                    log25.warn("rejecting encrypted control frame without seq");
                     return;
                   }
                   if (!rxSeq.accept(inSeq)) {
-                    log24.warn("rejecting replayed/out-of-order control", {
+                    log25.warn("rejecting replayed/out-of-order control", {
                       seq: inSeq,
                       lastSeen: rxSeq.lastSeq,
                       viewerId: typeof payload.viewerId === "string" ? payload.viewerId : "_legacy"
@@ -14630,7 +14699,7 @@ async function runAgent(rawOptions) {
                     inSeq
                   );
                   if (decrypted === null) {
-                    log24.warn("failed to decrypt control \u2014 ignoring");
+                    log25.warn("failed to decrypt control \u2014 ignoring");
                     return;
                   }
                   try {
@@ -14639,11 +14708,11 @@ async function runAgent(rawOptions) {
                       _verifiedEncrypted: true
                     };
                   } catch {
-                    log24.warn("failed to parse encrypted control payload");
+                    log25.warn("failed to parse encrypted control payload");
                     return;
                   }
                 } else if (conn.sessionKey && payload.action === "upload-file") {
-                  log24.warn("rejecting plaintext attachment upload while encrypted channel is active");
+                  log25.warn("rejecting plaintext attachment upload while encrypted channel is active");
                   return;
                 }
                 await dispatcher.handleControlAction(controlPayload);
@@ -14663,13 +14732,13 @@ async function runAgent(rawOptions) {
             }
           });
           ws.on("error", (error) => {
-            log24.error("websocket error", { error: error.message });
+            log25.error("websocket error", { error: error.message });
           });
           ws.on("close", (code, reason) => {
             const fields = {};
             if (code) fields.code = code;
             if (reason.length > 0) fields.reason = reason.toString();
-            log24.info("relay disconnected; output will be buffered until reconnect", fields);
+            log25.info("relay disconnected; output will be buffered until reconnect", fields);
             conn.cleanup();
             resolve();
           });
@@ -14686,35 +14755,35 @@ async function runAgent(rawOptions) {
               });
               inventory.updateOptions(options);
               dispatcher.updateOptions(options);
-              log24.info("recovered from auth failure via machine credential; reconnecting");
+              log25.info("recovered from auth failure via machine credential; reconnecting");
               continue;
             } catch (mcError) {
               if (mcError instanceof AuthError) {
-                log24.error("auth recovery failed", { error: mcError.message });
+                log25.error("auth recovery failed", { error: mcError.message });
               } else {
                 const mcMsg = mcError instanceof Error ? mcError.message : String(mcError);
-                log24.error("machine credential recovery failed", { error: mcMsg });
+                log25.error("machine credential recovery failed", { error: mcMsg });
               }
             }
           }
-          log24.error("auth error", { error: error.message });
-          log24.error(
+          log25.error("auth error", { error: error.message });
+          log25.error(
             "connector token is invalid or revoked. Stopping. Re-connect with: ragent connect --token <token>"
           );
           dispatcher.shouldRun = false;
           break;
         }
         const message = error instanceof Error ? error.message : String(error);
-        log24.error("relay connect failed", { error: message });
+        log25.error("relay connect failed", { error: message });
       }
       if (!dispatcher.shouldRun) break;
       if (dispatcher.reconnectRequested) {
-        log24.info("reconnecting to relay");
+        log25.info("reconnecting to relay");
         await wait(300);
         continue;
       }
       const jitteredDelay = conn.reconnectDelay * (0.5 + Math.random());
-      log24.info("disconnected; reconnecting", { seconds: Math.round(jitteredDelay / 1e3) });
+      log25.info("disconnected; reconnecting", { seconds: Math.round(jitteredDelay / 1e3) });
       await wait(jitteredDelay);
       conn.reconnectDelay = Math.min(conn.reconnectDelay * 1.5, MAX_RECONNECT_DELAY_MS);
     }
@@ -14814,7 +14883,7 @@ function printCommandArt(title, subtitle = "remote agent control") {
 }
 
 // src/commands/connect.ts
-var log25 = createLogger("connect");
+var log26 = createLogger("connect");
 async function connectMachine(opts) {
   const portal = opts.portal || DEFAULT_PORTAL;
   const hostId = sanitizeHostId(opts.id || inferHostId());
@@ -14846,12 +14915,12 @@ async function connectMachine(opts) {
     nextConfig.refreshExpiresAt = claimed.refreshExpiresAt;
   }
   saveConfig(nextConfig);
-  log25.info("machine connected", { hostName, hostId });
-  log25.info("machine name (override with --name <friendly-name>)", { hostName });
-  log25.info("config saved", { path: CONFIG_FILE });
+  log26.info("machine connected", { hostName, hostId });
+  log26.info("machine name (override with --name <friendly-name>)", { hostName });
+  log26.info("config saved", { path: CONFIG_FILE });
   if (opts.asService) {
     await ensureServiceInstalled({ enable: true, start: true });
-    log25.info("service mode enabled");
+    log26.info("service mode enabled");
     return;
   }
   if (opts.run !== false) {
@@ -14871,14 +14940,14 @@ function registerConnectCommand(program2) {
       await connectMachine(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log25.error("connect failed", { error: message });
+      log26.error("connect failed", { error: message });
       process.exit(1);
     }
   });
 }
 
 // src/commands/run.ts
-var log26 = createLogger("run");
+var log27 = createLogger("run");
 function registerRunCommand(program2) {
   program2.command("run").description("Run connector for a connected machine").option("--portal <url>", "Portal base URL").option("--agent-token <token>", "Connector token").option("-i, --id <id>", "Machine ID").option("-n, --name <name>", "Machine name").option("-c, --command <command>", "CLI command to run").option("--no-redact", "Disable secret redaction in terminal output").action(async (opts) => {
     try {
@@ -14886,7 +14955,7 @@ function registerRunCommand(program2) {
       await runAgent(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log26.error("run failed", { error: message });
+      log27.error("run failed", { error: message });
       process.exit(1);
     }
   });
@@ -14894,7 +14963,7 @@ function registerRunCommand(program2) {
 
 // src/commands/doctor.ts
 var os12 = __toESM(require("os"));
-var log27 = createLogger("doctor");
+var log28 = createLogger("doctor");
 async function runDoctor(opts) {
   const options = resolveRunOptions(opts);
   const checks = [];
@@ -14930,27 +14999,27 @@ async function runDoctor(opts) {
     console.log(`${check.ok ? "PASS" : "FAIL"}  ${check.name}: ${check.detail}`);
   });
   if (!platformOk) {
-    log27.info("Linux is required for the connector");
+    log28.info("Linux is required for the connector");
   }
   if (!tmuxOk) {
     const recipe = await chooseTmuxInstallCommand();
     if (recipe) {
-      log27.info("tmux install suggestion", { command: recipe.command });
+      log28.info("tmux install suggestion", { command: recipe.command });
     }
     if (opts.fix) {
       try {
         const installed = await installTmuxInteractively();
         if (installed) {
-          log27.info("tmux installation complete");
+          log28.info("tmux installation complete");
         } else {
-          log27.info("tmux installation skipped or incomplete");
+          log28.info("tmux installation skipped or incomplete");
         }
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        log27.error("failed to install tmux", { error: message });
+        log28.error("failed to install tmux", { error: message });
       }
     } else {
-      log27.info("run `ragent doctor --fix` to install missing dependencies interactively");
+      log28.info("run `ragent doctor --fix` to install missing dependencies interactively");
     }
   }
 }
@@ -14962,30 +15031,30 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/update.ts
-var log28 = createLogger("update");
+var log29 = createLogger("update");
 function registerUpdateCommand(program2) {
   program2.command("update").description("Update ragent CLI from npm").option("--check", "Check for updates only; do not install").option("--no-restart", "Do not restart the service after updating").action(async (opts) => {
     printCommandArt("Update", "checking npm registry for newer ragent-cli versions");
     const latestVersion = await checkForUpdate({ force: true });
     if (!latestVersion) {
-      log28.info("you are up to date", { version: CURRENT_VERSION });
+      log29.info("you are up to date", { version: CURRENT_VERSION });
       return;
     }
-    log28.info("update available", { current: CURRENT_VERSION, latest: latestVersion });
+    log29.info("update available", { current: CURRENT_VERSION, latest: latestVersion });
     if (opts.check) return;
     await installLatestCliFromNpm();
-    log28.info("updated", { version: latestVersion });
+    log29.info("updated", { version: latestVersion });
     const backend = getConfiguredServiceBackend();
     if (backend && opts.restart) {
-      log28.info("restarting service", { backend });
+      log29.info("restarting service", { backend });
       try {
         await restartService();
       } catch (err) {
-        log28.error("failed to restart service", { error: err instanceof Error ? err.message : String(err) });
-        log28.info("please restart manually: ragent service restart");
+        log29.error("failed to restart service", { error: err instanceof Error ? err.message : String(err) });
+        log29.info("please restart manually: ragent service restart");
       }
     } else if (!backend) {
-      log28.info("no service backend detected. If ragent is running manually, restart it to use the new version");
+      log29.info("no service backend detected. If ragent is running manually, restart it to use the new version");
     }
   });
 }
@@ -15009,7 +15078,7 @@ function registerSessionsCommand(program2) {
 }
 
 // src/commands/service.ts
-var log29 = createLogger("service-cmd");
+var log30 = createLogger("service-cmd");
 function registerServiceCommand(program2) {
   const service = program2.command("service").description("Manage background connector service");
   service.command("install").description("Install service (systemd user unit when available)").option("--start", "Start service immediately").option("--no-enable", "Do not enable autostart in systemd").action(async (opts) => {
@@ -15020,7 +15089,7 @@ function registerServiceCommand(program2) {
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service install failed", { error: message });
+      log30.error("service install failed", { error: message });
       process.exit(1);
     }
   });
@@ -15029,7 +15098,7 @@ function registerServiceCommand(program2) {
       await startService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service start failed", { error: message });
+      log30.error("service start failed", { error: message });
       process.exit(1);
     }
   });
@@ -15038,7 +15107,7 @@ function registerServiceCommand(program2) {
       await stopService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service stop failed", { error: message });
+      log30.error("service stop failed", { error: message });
       process.exit(1);
     }
   });
@@ -15047,7 +15116,7 @@ function registerServiceCommand(program2) {
       await restartService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service restart failed", { error: message });
+      log30.error("service restart failed", { error: message });
       process.exit(1);
     }
   });
@@ -15056,7 +15125,7 @@ function registerServiceCommand(program2) {
       await printServiceStatus();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service status failed", { error: message });
+      log30.error("service status failed", { error: message });
       process.exit(1);
     }
   });
@@ -15065,7 +15134,7 @@ function registerServiceCommand(program2) {
       await printServiceLogs(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service logs failed", { error: message });
+      log30.error("service logs failed", { error: message });
       process.exit(1);
     }
   });
@@ -15074,7 +15143,7 @@ function registerServiceCommand(program2) {
       await uninstallService();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log29.error("service uninstall failed", { error: message });
+      log30.error("service uninstall failed", { error: message });
       process.exit(1);
     }
   });
@@ -15082,7 +15151,7 @@ function registerServiceCommand(program2) {
 
 // src/commands/uninstall.ts
 var fs8 = __toESM(require("fs"));
-var log30 = createLogger("uninstall");
+var log31 = createLogger("uninstall");
 async function uninstallAgent(opts) {
   const config = loadConfig();
   const hostName = config.hostName || config.hostId || "this machine";
@@ -15092,12 +15161,12 @@ async function uninstallAgent(opts) {
       false
     );
     if (!confirmed) {
-      log30.info("uninstall cancelled");
+      log31.info("uninstall cancelled");
       return;
     }
   }
   if (config.portal && config.agentToken) {
-    log30.info("deregistering from server");
+    log31.info("deregistering from server");
     try {
       const token = await refreshTokenIfNeeded({
         portal: config.portal,
@@ -15105,24 +15174,24 @@ async function uninstallAgent(opts) {
       });
       const ok = await deregisterHost({ portal: config.portal, agentToken: token });
       if (ok) {
-        log30.info("host removed from server");
+        log31.info("host removed from server");
       }
     } catch {
-      log30.warn("could not reach server \u2014 host may need manual removal from dashboard");
+      log31.warn("could not reach server \u2014 host may need manual removal from dashboard");
     }
   }
-  log30.info("stopping and removing service");
+  log31.info("stopping and removing service");
   await uninstallService().catch(() => void 0);
   if (fs8.existsSync(CONFIG_DIR)) {
     fs8.rmSync(CONFIG_DIR, { recursive: true, force: true });
-    log30.info("removed config directory", { path: CONFIG_DIR });
+    log31.info("removed config directory", { path: CONFIG_DIR });
   }
   try {
     await execAsync(`npm unlink -g ${PACKAGE_NAME}`, { timeout: 15e3 });
-    log30.info("unlinked global package", { package: PACKAGE_NAME });
+    log31.info("unlinked global package", { package: PACKAGE_NAME });
   } catch {
   }
-  log30.info("uninstall complete. rAgent has been removed from this machine");
+  log31.info("uninstall complete. rAgent has been removed from this machine");
 }
 function registerUninstallCommand(parent) {
   parent.command("uninstall").description("Remove rAgent from this machine (stops service, deletes config, unlinks CLI)").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
@@ -15131,7 +15200,7 @@ function registerUninstallCommand(parent) {
       await uninstallAgent(opts);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      log30.error("uninstall failed", { error: message });
+      log31.error("uninstall failed", { error: message });
       process.exit(1);
     }
   });
@@ -15190,10 +15259,10 @@ function registerDiscoverCommand(program2) {
 }
 
 // src/index.ts
-var log31 = createLogger("cli");
+var log32 = createLogger("cli");
 process.on("unhandledRejection", (reason) => {
   const message = reason instanceof Error ? reason.stack || reason.message : String(reason);
-  log31.error("unhandled promise rejection", { error: message });
+  log32.error("unhandled promise rejection", { error: message });
 });
 import_commander.program.name("ragent").description("Connect machines to rAgent Live").version(CURRENT_VERSION);
 registerConnectCommand(import_commander.program);