ragent-cli 1.11.3 → 1.11.5

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "ragent-cli",
-      version: "1.11.3",
+      version: "1.11.5",
       description: "CLI agent for rAgent Live \u2014 browser-first terminal control plane for AI coding agents",
       main: "dist/index.js",
       bin: {
@@ -111,7 +111,7 @@ var require_package = __commonJS({
 });
 
 // src/index.ts
-var fs7 = __toESM(require("fs"));
+var fs8 = __toESM(require("fs"));
 var import_commander = require("commander");
 
 // src/constants.ts
@@ -311,12 +311,12 @@ async function maybeWarnUpdate() {
 }
 
 // src/commands/connect.ts
-var os9 = __toESM(require("os"));
+var os10 = __toESM(require("os"));
 
 // src/agent.ts
-var fs5 = __toESM(require("fs"));
-var os8 = __toESM(require("os"));
-var path4 = __toESM(require("path"));
+var fs6 = __toESM(require("fs"));
+var os9 = __toESM(require("os"));
+var path5 = __toESM(require("path"));
 var import_ws5 = __toESM(require("ws"));
 
 // src/auth.ts
@@ -1288,14 +1288,14 @@ function pathMatchesAgentTranscript(target, agentType) {
   if (agentType === "Gemini CLI") return isGeminiTranscript;
   return isClaudeTranscript || isCodexTranscript || isGeminiTranscript;
 }
-function getNewestPath(paths) {
+function getNewestPath(paths, options) {
   const ranked = paths.map((target) => {
     try {
       return { target, mtimeMs: fs2.statSync(target).mtimeMs };
     } catch {
       return null;
     }
-  }).filter((entry) => entry !== null).sort((a, b) => b.mtimeMs - a.mtimeMs);
+  }).filter((entry) => entry !== null).filter((entry) => options?.minMtimeMs === void 0 || entry.mtimeMs >= options.minMtimeMs).sort((a, b) => b.mtimeMs - a.mtimeMs);
   return ranked[0]?.target ?? null;
 }
 function discoverTranscriptForPid(pid, agentType) {
@@ -1327,6 +1327,79 @@ function listChildPids(pid) {
     return [];
   }
 }
+function getProcessCommand(pid) {
+  try {
+    return (0, import_child_process.execFileSync)("ps", ["-p", String(pid), "-o", "args="], {
+      encoding: "utf-8",
+      timeout: 3e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function commandMatchesAgent(command, agentType) {
+  if (!command || !agentType) return false;
+  const parts = command.toLowerCase().trim().split(/\s+/);
+  const binary = parts[0]?.split("/").pop() ?? "";
+  const scriptArg = parts[1]?.split("/").pop() ?? "";
+  if (agentType === "Claude Code") {
+    return binary === "claude" || binary === "claude-code" || command.includes("claude-code");
+  }
+  if (agentType === "Codex CLI") {
+    return binary === "codex" || scriptArg === "codex" || command.includes("codex-cli");
+  }
+  if (agentType === "Gemini CLI") {
+    return binary === "gemini" || scriptArg === "gemini";
+  }
+  return false;
+}
+function getProcessStartEpochMs(pid) {
+  try {
+    const stat = fs2.readFileSync(`/proc/${pid}/stat`, "utf8");
+    const closeParen = stat.lastIndexOf(")");
+    if (closeParen < 0) return null;
+    const rest = stat.slice(closeParen + 2).split(" ");
+    const startTicks = Number(rest[19]);
+    if (!Number.isFinite(startTicks) || startTicks < 0) return null;
+    const procStat = fs2.readFileSync("/proc/stat", "utf8");
+    const bootLine = procStat.split("\n").find((line) => line.startsWith("btime "));
+    const bootSeconds = Number(bootLine?.split(/\s+/)[1]);
+    if (!Number.isFinite(bootSeconds) || bootSeconds <= 0) return null;
+    const ticksPerSecond = Number((0, import_child_process.execFileSync)("getconf", ["CLK_TCK"], {
+      encoding: "utf-8",
+      timeout: 3e3
+    }).trim());
+    if (!Number.isFinite(ticksPerSecond) || ticksPerSecond <= 0) return null;
+    return (bootSeconds + startTicks / ticksPerSecond) * 1e3;
+  } catch {
+    return null;
+  }
+}
+function findAgentProcessInfos(rootPid, agentType) {
+  const queue = [rootPid];
+  const visited = /* @__PURE__ */ new Set();
+  const infos = [];
+  while (queue.length > 0 && visited.size < 64) {
+    const pid = queue.shift();
+    if (!pid || visited.has(pid)) continue;
+    visited.add(pid);
+    const command = getProcessCommand(pid);
+    if (commandMatchesAgent(command, agentType)) {
+      let cwd = null;
+      try {
+        cwd = fs2.readlinkSync(`/proc/${pid}/cwd`);
+      } catch {
+        cwd = null;
+      }
+      infos.push({ pid, command, startEpochMs: getProcessStartEpochMs(pid), cwd });
+    }
+    for (const childPid of listChildPids(pid)) {
+      if (!visited.has(childPid)) queue.push(childPid);
+    }
+  }
+  return infos;
+}
 function discoverViaProc(rootPid, agentType) {
   const queue = [rootPid];
   const visited = /* @__PURE__ */ new Set();
@@ -1347,10 +1420,10 @@ function discoverViaProc(rootPid, agentType) {
   }
   return getNewestPath(candidates);
 }
-function discoverViaProcessCwd(pid) {
+function discoverViaProcessCwd(pid, minMtimeMs) {
   try {
     const processCwd = fs2.readlinkSync(`/proc/${pid}/cwd`);
-    return processCwd ? discoverViaCwd(processCwd, pid) : null;
+    return processCwd ? discoverViaCwd(processCwd, pid, minMtimeMs) : null;
   } catch {
     return null;
   }
@@ -1378,6 +1451,35 @@ function resolveUserHome(pid) {
     return null;
   }
 }
+function discoverCodexTranscriptFromHome(pid, minMtimeMs) {
+  const userHome = resolveUserHome(pid);
+  if (!userHome) return null;
+  const sessionsDir = path2.join(userHome, ".codex", "sessions");
+  if (!fs2.existsSync(sessionsDir)) return null;
+  const matches = [];
+  const stack = [sessionsDir];
+  let visited = 0;
+  while (stack.length > 0 && visited < 3e3) {
+    const current = stack.pop();
+    if (!current) continue;
+    visited++;
+    let entries;
+    try {
+      entries = fs2.readdirSync(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const fullPath = path2.join(current, entry.name);
+      if (entry.isDirectory()) {
+        stack.push(fullPath);
+      } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+        matches.push(fullPath);
+      }
+    }
+  }
+  return getNewestPath(matches, { minMtimeMs });
+}
 function discoverGeminiTranscriptFromHome(pid) {
   const userHome = resolveUserHome(pid);
   if (!userHome) return null;
@@ -1407,27 +1509,21 @@ function discoverGeminiTranscriptFromHome(pid) {
   }
   return getNewestPath(matches);
 }
-function discoverViaCwd(paneCwd, pid) {
+function discoverViaCwd(paneCwd, pid, minMtimeMs) {
   const userHome = resolveUserHome(pid);
   if (!userHome) return null;
   const claudeProjectsDir = path2.join(userHome, ".claude", "projects");
   if (!fs2.existsSync(claudeProjectsDir)) return null;
-  let resolvedCwd;
+  const possibleCwds = /* @__PURE__ */ new Set([paneCwd]);
   try {
-    resolvedCwd = fs2.realpathSync(paneCwd);
+    possibleCwds.add(fs2.realpathSync(paneCwd));
   } catch {
-    return null;
   }
-  const expectedDirName = resolvedCwd.replace(/\//g, "-");
-  const projectDir = path2.join(claudeProjectsDir, expectedDirName);
-  if (!fs2.existsSync(projectDir)) return null;
+  const projectDirs = Array.from(possibleCwds).map((cwd) => path2.join(claudeProjectsDir, cwd.replace(/\//g, "-"))).filter((projectDir, index, arr) => arr.indexOf(projectDir) === index).filter((projectDir) => fs2.existsSync(projectDir));
+  if (projectDirs.length === 0) return null;
   try {
-    const jsonlFiles = fs2.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).map((f) => {
-      const fullPath = path2.join(projectDir, f);
-      const stat = fs2.statSync(fullPath);
-      return { path: fullPath, mtime: stat.mtimeMs };
-    }).sort((a, b) => b.mtime - a.mtime);
-    return jsonlFiles.length > 0 ? jsonlFiles[0].path : null;
+    const jsonlFiles = projectDirs.flatMap((projectDir) => fs2.readdirSync(projectDir).filter((f) => f.endsWith(".jsonl")).map((f) => path2.join(projectDir, f)));
+    return getNewestPath(jsonlFiles, { minMtimeMs });
   } catch {
     return null;
   }
@@ -1438,9 +1534,18 @@ function discoverTranscriptFile(sessionId, agentType) {
     const procResult = discoverViaProc(processPid, agentType);
     if (procResult) return procResult;
     if (agentType === "Claude Code") {
-      const cwdResult = discoverViaProcessCwd(processPid);
+      const startMs = getProcessStartEpochMs(processPid);
+      const cwdResult = discoverViaProcessCwd(processPid, startMs ? startMs - 6e4 : void 0);
       if (cwdResult) return cwdResult;
     }
+    if (agentType === "Codex CLI") {
+      const startMs = getProcessStartEpochMs(processPid);
+      const command = getProcessCommand(processPid);
+      if (commandMatchesAgent(command, agentType)) {
+        const codexResult = discoverCodexTranscriptFromHome(processPid, startMs ? startMs - 6e4 : void 0);
+        if (codexResult) return codexResult;
+      }
+    }
     if (agentType === "Gemini CLI") {
       const geminiResult = discoverGeminiTranscriptFromHome(processPid);
       if (geminiResult) return geminiResult;
@@ -1469,6 +1574,16 @@ function discoverTranscriptFile(sessionId, agentType) {
     } catch {
     }
     if (agentType === "Claude Code") {
+      const agentInfos = panePid ? findAgentProcessInfos(panePid, agentType) : [];
+      for (const info of agentInfos) {
+        if (!info.cwd) continue;
+        const cwdResult = discoverViaCwd(
+          info.cwd,
+          info.pid,
+          info.startEpochMs ? info.startEpochMs - 6e4 : void 0
+        );
+        if (cwdResult) return cwdResult;
+      }
       try {
         const paneCwd = (0, import_child_process.execFileSync)(
           "tmux",
@@ -1479,6 +1594,16 @@ function discoverTranscriptFile(sessionId, agentType) {
       } catch {
       }
     }
+    if (agentType === "Codex CLI") {
+      const agentInfos = panePid ? findAgentProcessInfos(panePid, agentType) : [];
+      const newestForAgent = getNewestPath(
+        agentInfos.map((info) => discoverCodexTranscriptFromHome(
+          info.pid,
+          info.startEpochMs ? info.startEpochMs - 6e4 : void 0
+        )).filter((value) => Boolean(value))
+      );
+      if (newestForAgent) return newestForAgent;
+    }
     if (agentType === "Gemini CLI") {
       return discoverGeminiTranscriptFromHome(panePid ?? void 0);
     }
@@ -1742,10 +1867,25 @@ var TranscriptWatcherManager = class {
   }
   /** Enable markdown streaming for a session. */
   enableMarkdown(sessionId, agentType) {
+    const requestedAgentType = agentType ?? "";
     const existing = this.active.get(sessionId);
     if (existing) {
-      existing.watcher.addSubscriber();
-      return { ok: true };
+      const newPath = discoverTranscriptFile(sessionId, agentType);
+      const agentChanged = existing.agentType !== requestedAgentType;
+      const pathChanged = Boolean(newPath && newPath !== existing.filePath);
+      const existingPathGone = !fs2.existsSync(existing.filePath);
+      if (!agentChanged && !pathChanged && !existingPathGone) {
+        existing.watcher.addSubscriber();
+        return { ok: true };
+      }
+      existing.watcher.stop();
+      this.active.delete(sessionId);
+      this.stopRediscovery(sessionId);
+      this.clearTranscriptState(sessionId);
+      if (!newPath) {
+        log5.info("no replacement transcript file found", { sessionId, agentType });
+        return { ok: false, reason: "no_transcript" };
+      }
     }
     const parser = getParser(agentType);
     if (!parser) {
@@ -1791,6 +1931,12 @@ var TranscriptWatcherManager = class {
     this.startRediscovery(sessionId, agentType);
     return { ok: true };
   }
+  clearTranscriptState(sessionId) {
+    this.sendSnapshotFn(sessionId, [], 0);
+    if (this.sendV2SnapshotFn) {
+      this.sendV2SnapshotFn(sessionId, createEmptySnapshot(sessionId), 0);
+    }
+  }
   /** Disable markdown streaming for a session. */
   disableMarkdown(sessionId) {
     const session = this.active.get(sessionId);
@@ -3120,26 +3266,23 @@ var SessionStreamer = class {
         alternateScreen = altFlag === "1";
       } catch {
       }
-      if (alternateScreen) {
-        this.sendFn(sessionId, "\x1B[?1049h\x1B[0m\x1B[2J\x1B[H");
-      } else {
-        try {
-          const scrollback = (0, import_node_child_process2.execFileSync)(
-            "tmux",
-            ["capture-pane", "-t", paneTarget, "-p", "-e", "-S", "-5000", "-E", "-1"],
-            { env: cleanEnv, timeout: 1e4, encoding: "utf-8" }
-          );
-          if (scrollback && scrollback.length > 0) {
-            this.sendFn(sessionId, scrollback.replace(/\n/g, "\r\n"));
-          }
-        } catch {
+      try {
+        const scrollback = (0, import_node_child_process2.execFileSync)(
+          "tmux",
+          ["capture-pane", "-t", paneTarget, "-p", "-e", "-S", "-5000", "-E", "-1"],
+          { env: cleanEnv, timeout: 1e4, encoding: "utf-8" }
+        );
+        if (scrollback && scrollback.length > 0) {
+          this.sendFn(sessionId, scrollback.replace(/\n/g, "\r\n"));
         }
-        this.sendFn(sessionId, "\x1B[?1049l\x1B[0m\x1B[2J\x1B[H");
+      } catch {
       }
+      this.sendFn(sessionId, "\x1B[?1049l\x1B[0m\x1B[2J\x1B[H");
       try {
+        const captureArgs = alternateScreen ? ["capture-pane", "-a", "-t", paneTarget, "-p", "-e"] : ["capture-pane", "-t", paneTarget, "-p", "-e"];
         const initial = (0, import_node_child_process2.execFileSync)(
           "tmux",
-          ["capture-pane", "-t", paneTarget, "-p", "-e"],
+          captureArgs,
           { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
         );
         if (initial) {
@@ -3261,26 +3404,23 @@ var SessionStreamer = class {
       } catch {
       }
       stream.alternateScreen = alternateScreen;
-      if (alternateScreen) {
-        this.sendFn(sessionId, "\x1B[?1049h\x1B[0m\x1B[2J\x1B[H");
-      } else {
-        try {
-          const scrollback = (0, import_node_child_process2.execFileSync)(
-            "tmux",
-            ["capture-pane", "-t", paneTarget, "-p", "-e", "-S", "-5000", "-E", "-1"],
-            { env: cleanEnv, timeout: 1e4, encoding: "utf-8" }
-          );
-          if (scrollback && scrollback.length > 0) {
-            this.sendFn(sessionId, scrollback.replace(/\n/g, "\r\n"));
-          }
-        } catch {
+      try {
+        const scrollback = (0, import_node_child_process2.execFileSync)(
+          "tmux",
+          ["capture-pane", "-t", paneTarget, "-p", "-e", "-S", "-5000", "-E", "-1"],
+          { env: cleanEnv, timeout: 1e4, encoding: "utf-8" }
+        );
+        if (scrollback && scrollback.length > 0) {
+          this.sendFn(sessionId, scrollback.replace(/\n/g, "\r\n"));
         }
-        this.sendFn(sessionId, "\x1B[?1049l\x1B[0m\x1B[2J\x1B[H");
+      } catch {
       }
+      this.sendFn(sessionId, "\x1B[?1049l\x1B[0m\x1B[2J\x1B[H");
       try {
+        const captureArgs = alternateScreen ? ["capture-pane", "-a", "-t", paneTarget, "-p", "-e"] : ["capture-pane", "-t", paneTarget, "-p", "-e"];
         const initial = (0, import_node_child_process2.execFileSync)(
           "tmux",
-          ["capture-pane", "-t", paneTarget, "-p", "-e"],
+          captureArgs,
           { env: cleanEnv, timeout: 5e3, encoding: "utf-8" }
         );
         if (initial) {
@@ -3642,6 +3782,105 @@ var SequenceTracker = class {
 var import_node_child_process3 = require("child_process");
 var pty2 = __toESM(require("node-pty"));
 var log9 = createLogger("pty");
+var ANSI_KEY_SEQUENCES = /* @__PURE__ */ new Map([
+  ["\x1B[A", "Up"],
+  ["\x1B[B", "Down"],
+  ["\x1B[C", "Right"],
+  ["\x1B[D", "Left"],
+  ["\x1B[H", "Home"],
+  ["\x1B[F", "End"],
+  ["\x1BOH", "Home"],
+  ["\x1BOF", "End"],
+  ["\x1B[1~", "Home"],
+  ["\x1B[4~", "End"],
+  ["\x1B[3~", "Delete"],
+  ["\x1B[5~", "PageUp"],
+  ["\x1B[6~", "PageDown"]
+]);
+function controlKeyName(charCode) {
+  if (charCode >= 1 && charCode <= 26) {
+    return `C-${String.fromCharCode(charCode + 96)}`;
+  }
+  switch (charCode) {
+    case 0:
+      return "C-Space";
+    case 27:
+      return "Escape";
+    case 28:
+      return "C-\\";
+    case 29:
+      return "C-]";
+    case 30:
+      return "C-^";
+    case 31:
+      return "C-_";
+    default:
+      return null;
+  }
+}
+function appendLiteralSegment(segments, value) {
+  if (!value) return;
+  const previous = segments[segments.length - 1];
+  if (previous?.kind === "literal") {
+    previous.value += value;
+  } else {
+    segments.push({ kind: "literal", value });
+  }
+}
+function encodeTmuxInput(data) {
+  const segments = [];
+  let literal = "";
+  const flushLiteral = () => {
+    appendLiteralSegment(segments, literal);
+    literal = "";
+  };
+  for (let i = 0; i < data.length; i++) {
+    const remaining = data.slice(i);
+    const matchedSequence = Array.from(ANSI_KEY_SEQUENCES.entries()).find(([sequence]) => remaining.startsWith(sequence));
+    if (matchedSequence) {
+      flushLiteral();
+      const [sequence, key] = matchedSequence;
+      segments.push({ kind: "key", value: key });
+      i += sequence.length - 1;
+      continue;
+    }
+    const charCode = data.charCodeAt(i);
+    if (data[i] === "\r" || data[i] === "\n") {
+      flushLiteral();
+      segments.push({ kind: "key", value: "Enter" });
+      continue;
+    }
+    if (data[i] === "	") {
+      flushLiteral();
+      segments.push({ kind: "key", value: "Tab" });
+      continue;
+    }
+    if (data[i] === "\x7F" || data[i] === "\b") {
+      flushLiteral();
+      segments.push({ kind: "key", value: "BSpace" });
+      continue;
+    }
+    if (charCode < 32) {
+      const keyName = controlKeyName(charCode);
+      if (keyName) {
+        flushLiteral();
+        segments.push({ kind: "key", value: keyName });
+        continue;
+      }
+    }
+    literal += data[i];
+  }
+  flushLiteral();
+  return segments;
+}
+function execTmuxSendKeys(args) {
+  return new Promise((resolve, reject) => {
+    (0, import_node_child_process3.execFile)("tmux", args, { timeout: 5e3 }, (err) => {
+      if (err) reject(err);
+      else resolve();
+    });
+  });
+}
 function isInteractiveShell(command) {
   const trimmed = String(command).trim();
   return ["bash", "sh", "zsh", "fish"].includes(trimmed);
@@ -3678,12 +3917,13 @@ async function sendInputToTmux(sessionId, data) {
     return;
   }
   try {
-    await new Promise((resolve, reject) => {
-      (0, import_node_child_process3.execFile)("tmux", ["send-keys", "-t", target, "-l", "--", data], { timeout: 5e3 }, (err) => {
-        if (err) reject(err);
-        else resolve();
-      });
-    });
+    for (const segment of encodeTmuxInput(data)) {
+      if (segment.kind === "literal") {
+        await execTmuxSendKeys(["send-keys", "-t", target, "-l", "--", segment.value]);
+      } else {
+        await execTmuxSendKeys(["send-keys", "-t", target, "--", segment.value]);
+      }
+    }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     log9.warn("failed to send input", { sessionId, error: message });
@@ -4081,6 +4321,9 @@ var ConnectionManager = class {
 // src/control-dispatcher.ts
 var crypto2 = __toESM(require("crypto"));
 var import_child_process5 = require("child_process");
+var fs5 = __toESM(require("fs"));
+var os8 = __toESM(require("os"));
+var path4 = __toESM(require("path"));
 var import_ws4 = __toESM(require("ws"));
 
 // src/service.ts
@@ -4738,6 +4981,10 @@ function isProcessAlive(pid) {
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function safeAttachmentName(name) {
+  const base = path4.basename(name || "attachment").replace(/[^a-zA-Z0-9._-]/g, "_");
+  return base.slice(0, 120) || "attachment";
+}
 var ControlDispatcher = class {
   shell;
   streamer;
@@ -4816,9 +5063,10 @@ var ControlDispatcher = class {
       "disconnect",
       "kill-process",
       "start-agent",
-      "provision"
+      "provision",
+      "upload-file"
     ]);
-    if (dangerousActions.has(action) && this.connection.sessionKey) {
+    if (dangerousActions.has(action) && this.connection.sessionKey && payload._verifiedEncrypted !== true) {
       if (!this.verifyMessageHmac(payload)) {
         log13.warn("rejecting control action \u2014 HMAC verification failed", { action });
         return;
@@ -4950,9 +5198,42 @@ var ControlDispatcher = class {
           this.transcriptWatcher.handleSyncRequest(sessionId, fromSeq);
         }
         return;
+      case "upload-file":
+        this.handleUploadFile(sessionId, payload);
+        return;
       default:
     }
   }
+  handleUploadFile(sessionId, payload) {
+    if (!sessionId) return;
+    const fileName = typeof payload.fileName === "string" ? payload.fileName : "attachment";
+    const contentBase64 = typeof payload.contentBase64 === "string" ? payload.contentBase64 : "";
+    if (!contentBase64 || contentBase64.length > 8 * 1024 * 1024) {
+      log13.warn("rejecting attachment upload \u2014 invalid size", { sessionId, fileName });
+      return;
+    }
+    let content;
+    try {
+      content = Buffer.from(contentBase64, "base64");
+    } catch {
+      log13.warn("rejecting attachment upload \u2014 invalid base64", { sessionId, fileName });
+      return;
+    }
+    if (content.length === 0 || content.length > 6 * 1024 * 1024) {
+      log13.warn("rejecting attachment upload \u2014 decoded size out of bounds", {
+        sessionId,
+        fileName,
+        bytes: content.length
+      });
+      return;
+    }
+    const uploadDir = path4.join(os8.homedir(), ".cache", "ragent", "attachments");
+    fs5.mkdirSync(uploadDir, { recursive: true, mode: 448 });
+    const writtenPath = path4.join(uploadDir, `${Date.now()}-${safeAttachmentName(fileName)}`);
+    fs5.writeFileSync(writtenPath, content, { mode: 384 });
+    log13.info("attachment uploaded", { sessionId, path: writtenPath, bytes: content.length });
+    this.handleInput(writtenPath, sessionId);
+  }
   /** Handle input routing to the correct target. */
   handleInput(data, sessionId) {
     this.connection.requestInventorySync(800);
@@ -5530,11 +5811,11 @@ var ApprovalEnforcer = class {
 var log15 = createLogger("agent");
 var MAX_TRANSPORT_CHUNK_BYTES = 24 * 1024;
 function pidFilePath(hostId) {
-  return path4.join(CONFIG_DIR, `agent-${hostId}.pid`);
+  return path5.join(CONFIG_DIR, `agent-${hostId}.pid`);
 }
 function readPidFile(filePath) {
   try {
-    const raw = fs5.readFileSync(filePath, "utf8").trim();
+    const raw = fs6.readFileSync(filePath, "utf8").trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -5559,7 +5840,7 @@ function acquirePidLock(hostId) {
 Stop it first with: kill ${existingPid}  \u2014 or: ragent service stop`
     );
   }
-  fs5.writeFileSync(lockPath, `${process.pid}
+  fs6.writeFileSync(lockPath, `${process.pid}
 `, "utf8");
   return lockPath;
 }
@@ -5567,7 +5848,7 @@ function releasePidLock(lockPath) {
   try {
     const currentPid = readPidFile(lockPath);
     if (currentPid === process.pid) {
-      fs5.unlinkSync(lockPath);
+      fs6.unlinkSync(lockPath);
     }
   } catch {
   }
@@ -5576,7 +5857,7 @@ function resolveRunOptions(commandOptions) {
   const config = loadConfig();
   const portal = commandOptions.portal || config.portal || DEFAULT_PORTAL;
   const hostId = sanitizeHostId(commandOptions.id || config.hostId || inferHostId());
-  const hostName = commandOptions.name || config.hostName || os8.hostname();
+  const hostName = commandOptions.name || config.hostName || os9.hostname();
   const command = commandOptions.command || config.command || "bash";
   const agentToken = commandOptions.agentToken || config.agentToken || "";
   return { portal, hostId, hostName, command, agentToken };
@@ -5812,7 +6093,7 @@ async function runAgent(rawOptions) {
             sendToGroup(ws, groups.privateGroup, {
               type: "register",
               hostName: options.hostName,
-              environment: os8.platform()
+              environment: os9.platform()
             });
             conn.replayBufferedOutput((chunk) => {
               for (const outputChunk of splitTransportChunks(chunk)) {
@@ -5904,7 +6185,46 @@ async function runAgent(rawOptions) {
                 const sid = typeof payload.sessionId === "string" ? payload.sessionId.trim() : "";
                 dispatcher.handleResize(payload.cols, payload.rows, sid);
               } else if (payload.type === "control" && typeof payload.action === "string") {
-                await dispatcher.handleControlAction(payload);
+                let controlPayload = payload;
+                if (typeof payload.enc === "string" && typeof payload.iv === "string" && conn.sessionKey) {
+                  const inSeq = typeof payload.seq === "number" ? payload.seq : null;
+                  const rxSeq = conn.getRxSeqForViewer(payload.viewerId);
+                  if (inSeq === null) {
+                    log15.warn("rejecting encrypted control frame without seq");
+                    return;
+                  }
+                  if (!rxSeq.accept(inSeq)) {
+                    log15.warn("rejecting replayed/out-of-order control", {
+                      seq: inSeq,
+                      lastSeen: rxSeq.lastSeq,
+                      viewerId: typeof payload.viewerId === "string" ? payload.viewerId : "_legacy"
+                    });
+                    return;
+                  }
+                  const decrypted = decryptPayload(
+                    payload.enc,
+                    payload.iv,
+                    conn.sessionKey,
+                    inSeq
+                  );
+                  if (decrypted === null) {
+                    log15.warn("failed to decrypt control \u2014 ignoring");
+                    return;
+                  }
+                  try {
+                    controlPayload = {
+                      ...JSON.parse(decrypted),
+                      _verifiedEncrypted: true
+                    };
+                  } catch {
+                    log15.warn("failed to parse encrypted control payload");
+                    return;
+                  }
+                } else if (conn.sessionKey && payload.action === "upload-file") {
+                  log15.warn("rejecting plaintext attachment upload while encrypted channel is active");
+                  return;
+                }
+                await dispatcher.handleControlAction(controlPayload);
               } else if (payload.type === "start-agent") {
                 await dispatcher.handleControlAction({ ...payload, action: "start-agent" });
               } else if (payload.type === "provision") {
@@ -6075,7 +6395,7 @@ var log16 = createLogger("connect");
 async function connectMachine(opts) {
   const portal = opts.portal || DEFAULT_PORTAL;
   const hostId = sanitizeHostId(opts.id || inferHostId());
-  const hostName = opts.name || os9.hostname();
+  const hostName = opts.name || os10.hostname();
   const command = opts.command || "bash";
   if (!opts.token) {
     throw new Error("Connection token is required.");
@@ -6150,13 +6470,13 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/doctor.ts
-var os10 = __toESM(require("os"));
+var os11 = __toESM(require("os"));
 var log18 = createLogger("doctor");
 async function runDoctor(opts) {
   const options = resolveRunOptions(opts);
   const checks = [];
-  const platformOk = os10.platform() === "linux";
-  checks.push({ name: "platform", ok: platformOk, detail: os10.platform() });
+  const platformOk = os11.platform() === "linux";
+  checks.push({ name: "platform", ok: platformOk, detail: os11.platform() });
   checks.push({
     name: "node",
     ok: Number(process.versions.node.split(".")[0]) >= 20,
@@ -6341,7 +6661,7 @@ function registerServiceCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var fs6 = __toESM(require("fs"));
+var fs7 = __toESM(require("fs"));
 var log21 = createLogger("uninstall");
 async function uninstallAgent(opts) {
   const config = loadConfig();
@@ -6373,8 +6693,8 @@ async function uninstallAgent(opts) {
   }
   log21.info("stopping and removing service");
   await uninstallService().catch(() => void 0);
-  if (fs6.existsSync(CONFIG_DIR)) {
-    fs6.rmSync(CONFIG_DIR, { recursive: true, force: true });
+  if (fs7.existsSync(CONFIG_DIR)) {
+    fs7.rmSync(CONFIG_DIR, { recursive: true, force: true });
     log21.info("removed config directory", { path: CONFIG_DIR });
   }
   try {
@@ -6477,7 +6797,7 @@ function showStatus() {
   ragent v${CURRENT_VERSION}
 `);
   try {
-    const raw = fs7.readFileSync(CONFIG_FILE, "utf8");
+    const raw = fs8.readFileSync(CONFIG_FILE, "utf8");
     const config = JSON.parse(raw);
     if (config.portal && config.agentToken) {
       console.log(`  Status:   Connected`);

package/dist/sbom.json

@@ -1166,8 +1166,8 @@
     {
       "type": "library",
       "name": "ragent-cli",
-      "version": "1.11.3",
-      "bom-ref": "ragent-live|ragent-cli@1.11.3",
+      "version": "1.11.5",
+      "bom-ref": "ragent-live|ragent-cli@1.11.5",
       "author": "Intellimetrics",
       "description": "CLI agent for rAgent Live — browser-first terminal control plane for AI coding agents",
       "licenses": [
@@ -1178,7 +1178,7 @@
           }
         }
       ],
-      "purl": "pkg:npm/ragent-cli@1.11.3",
+      "purl": "pkg:npm/ragent-cli@1.11.5",
       "externalReferences": [
         {
           "url": "https://github.com/chadlindell/ragent-live/issues",
@@ -1303,7 +1303,7 @@
         "ragent-live|@emnapi/wasi-threads@1.2.1",
         "ragent-live|@pkgjs/parseargs@0.11.0",
         "ragent-live|@tybys/wasm-util@0.10.1",
-        "ragent-live|ragent-cli@1.11.3"
+        "ragent-live|ragent-cli@1.11.5"
       ]
     },
     {
@@ -1436,7 +1436,7 @@
       ]
     },
     {
-      "ref": "ragent-live|ragent-cli@1.11.3",
+      "ref": "ragent-live|ragent-cli@1.11.5",
       "dependsOn": [
         "ragent-live|@azure/web-pubsub-client@1.0.4",
         "ragent-live|commander@14.0.3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ragent-cli",
-  "version": "1.11.3",
+  "version": "1.11.5",
   "description": "CLI agent for rAgent Live — browser-first terminal control plane for AI coding agents",
   "main": "dist/index.js",
   "bin": {