ragent-cli 1.5.2 → 1.6.0

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "ragent-cli",
-      version: "1.5.2",
+      version: "1.6.0",
       description: "CLI agent for rAgent Live \u2014 browser-first terminal control plane for AI coding agents",
       main: "dist/index.js",
       bin: {
@@ -257,15 +257,18 @@ async function maybeWarnUpdate() {
 }
 
 // src/commands/connect.ts
-var os8 = __toESM(require("os"));
+var os9 = __toESM(require("os"));
 
 // src/agent.ts
 var fs4 = __toESM(require("fs"));
-var os7 = __toESM(require("os"));
+var os8 = __toESM(require("os"));
 var path3 = __toESM(require("path"));
 var import_ws5 = __toESM(require("ws"));
 
 // src/auth.ts
+var os4 = __toESM(require("os"));
+
+// src/sessions.ts
 var os3 = __toESM(require("os"));
 
 // src/system.ts
@@ -357,6 +360,7 @@ async function installTmuxInteractively() {
 }
 
 // src/sessions.ts
+var isMac = os3.platform() === "darwin";
 async function collectTmuxSessions() {
   try {
     await execAsync("tmux -V");
@@ -467,7 +471,7 @@ async function collectZellijSessions() {
       let serverPids;
       try {
         const psOut = await execAsync(
-          `ps axo pid,args --no-headers | grep 'zellij.*--session ${sessionName}' | grep -v grep`
+          `ps axo pid,args | grep 'zellij.*--session ${sessionName}' | grep -v grep`
         );
         serverPids = psOut.split("\n").map((l) => Number(l.trim().split(/\s+/)[0])).filter((p) => p > 0);
       } catch {
@@ -502,6 +506,17 @@ async function collectZellijSessions() {
 }
 async function getProcessWorkingDir(pid) {
   try {
+    if (isMac) {
+      const raw = await execAsync(
+        `lsof -a -p ${pid} -d cwd -Fn 2>/dev/null`
+      );
+      for (const line of raw.split("\n")) {
+        if (line.startsWith("n/")) {
+          return line.slice(1).trim() || null;
+        }
+      }
+      return null;
+    }
     const cwd = await execAsync(`readlink -f /proc/${pid}/cwd`);
     return cwd.trim() || null;
   } catch {
@@ -510,12 +525,14 @@ async function getProcessWorkingDir(pid) {
 }
 async function collectBareAgentProcesses(excludePids) {
   try {
-    const raw = await execAsync("ps axo pid,ppid,stat,comm,args --no-headers");
+    const raw = await execAsync("ps axo pid,ppid,stat,comm,args");
     const sessions = [];
     const seen = /* @__PURE__ */ new Set();
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
+    const lines = raw.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const trimmed = lines[i].trim();
       if (!trimmed) continue;
+      if (i === 0 && /^\s*PID\b/i.test(lines[i])) continue;
       const parts = trimmed.split(/\s+/);
       if (parts.length < 5) continue;
       const pid = Number(parts[0]);
@@ -618,11 +635,16 @@ function sessionInventoryFingerprint(sessions) {
 }
 async function getChildAgentInfo(parentPid) {
   try {
-    const raw = await execAsync(`ps --ppid ${parentPid} -o pid,args --no-headers`);
+    const pgrepOut = await execAsync(`pgrep -P ${parentPid}`);
+    const pidList = pgrepOut.split("\n").map((l) => l.trim()).filter(Boolean).map(Number).filter((p) => p > 0);
+    if (pidList.length === 0) return null;
+    const raw = await execAsync(`ps -p ${pidList.join(",")} -o pid,args`);
     const childPids = [];
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
+    const lines = raw.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const trimmed = lines[i].trim();
       if (!trimmed) continue;
+      if (i === 0 && /^\s*PID\b/i.test(lines[i])) continue;
       const spaceIdx = trimmed.indexOf(" ");
       if (spaceIdx < 0) continue;
       const pid = Number(trimmed.slice(0, spaceIdx));
@@ -719,7 +741,7 @@ async function claimHost(params) {
       connectionToken: params.connectionToken,
       hostId: params.hostId,
       hostName: params.hostName,
-      environment: os3.platform(),
+      environment: os4.platform(),
       sessions,
       agentVersion: CURRENT_VERSION
     })
@@ -781,7 +803,7 @@ async function postHeartbeat(params) {
         Authorization: `Bearer ${params.agentToken}`
       },
       body: JSON.stringify({
-        environment: os3.platform(),
+        environment: os4.platform(),
         hostName: params.hostName,
         sessions,
         agentVersion: CURRENT_VERSION
@@ -845,6 +867,33 @@ var DRAIN_INTERVAL_MS = 50;
 function sanitizeForJson(str) {
   return str.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "\uFFFD");
 }
+var DANGEROUS_OSC_RE = /\x1b\](?:52|7|8);[^\x07\x1b]*(?:\x07|\x1b\\)/g;
+function stripDangerousEscapes(str) {
+  return str.replace(DANGEROUS_OSC_RE, "");
+}
+var SECRET_PATTERNS = [
+  /AKIA[0-9A-Z]{16}/g,
+  // AWS access key
+  /gh[ps]_[A-Za-z0-9_]{36,}/g,
+  // GitHub token
+  /sk_(?:live|test)_[A-Za-z0-9]{24,}/g,
+  // Stripe secret key
+  /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g
+  // JWT
+];
+var redactionEnabled = false;
+function setRedactionEnabled(enabled) {
+  redactionEnabled = enabled;
+}
+function redactSecrets(str) {
+  if (!redactionEnabled) return str;
+  let result = str;
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, "[REDACTED]");
+  }
+  return result;
+}
 var pendingQueue = [];
 var drainTimer = null;
 var drainWs = null;
@@ -909,7 +958,7 @@ function sanitizePayload(obj) {
   const result = {};
   for (const [key, value] of Object.entries(obj)) {
     if (typeof value === "string") {
-      result[key] = sanitizeForJson(value);
+      result[key] = redactSecrets(stripDangerousEscapes(sanitizeForJson(value)));
     } else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
       result[key] = sanitizePayload(value);
     } else {
@@ -927,6 +976,7 @@ var import_node_os = require("os");
 var import_node_string_decoder = require("string_decoder");
 var pty = __toESM(require("node-pty"));
 var STOP_DEBOUNCE_MS = 2e3;
+var MAX_SESSION_BUFFER_BYTES = 64 * 1024;
 function parsePaneTarget(sessionId) {
   if (!sessionId.startsWith("tmux:")) return null;
   const rest = sessionId.slice("tmux:".length);
@@ -982,6 +1032,13 @@ var SessionStreamer = class {
   pendingStops = /* @__PURE__ */ new Map();
   sendFn;
   onStreamStopped;
+  /**
+   * Per-session ring buffer for output captured while the WebSocket is disconnected.
+   * Each entry is a string chunk; oldest entries are evicted when the total byte
+   * size exceeds MAX_SESSION_BUFFER_BYTES.
+   */
+  disconnectBuffers = /* @__PURE__ */ new Map();
+  disconnectBufferBytes = /* @__PURE__ */ new Map();
   constructor(sendFn, onStreamStopped) {
     this.sendFn = sendFn;
     this.onStreamStopped = onStreamStopped;
@@ -1081,6 +1138,8 @@ var SessionStreamer = class {
       if (!s) return;
       this.cleanupStream(s);
       this.active.delete(sessionId);
+      this.disconnectBuffers.delete(sessionId);
+      this.disconnectBufferBytes.delete(sessionId);
       console.log(`[rAgent] Stopped streaming: ${sessionId}`);
     }, STOP_DEBOUNCE_MS);
     this.pendingStops.set(sessionId, timer);
@@ -1104,6 +1163,8 @@ var SessionStreamer = class {
       console.log(`[rAgent] Stopped streaming: ${id}`);
     }
     this.active.clear();
+    this.disconnectBuffers.clear();
+    this.disconnectBufferBytes.clear();
   }
   /**
    * Get the number of active streams.
@@ -1111,6 +1172,54 @@ var SessionStreamer = class {
   get activeCount() {
     return this.active.size;
   }
+  /**
+   * Return an iterator over active stream entries (sessionId -> ActiveStream).
+   * Used by the agent to replay disconnect-buffered output on reconnect.
+   */
+  activeStreams() {
+    return this.active.entries();
+  }
+  // ---------------------------------------------------------------------------
+  // Disconnect buffering — captures output when WebSocket is down
+  // ---------------------------------------------------------------------------
+  /**
+   * Append a chunk of output to the per-session disconnect buffer.
+   * Oldest entries are evicted when the buffer exceeds MAX_SESSION_BUFFER_BYTES.
+   */
+  bufferOutput(sessionId, data) {
+    let chunks = this.disconnectBuffers.get(sessionId);
+    if (!chunks) {
+      chunks = [];
+      this.disconnectBuffers.set(sessionId, chunks);
+      this.disconnectBufferBytes.set(sessionId, 0);
+    }
+    const dataBytes = Buffer.byteLength(data, "utf8");
+    let currentBytes = this.disconnectBufferBytes.get(sessionId) ?? 0;
+    while (chunks.length > 0 && currentBytes + dataBytes > MAX_SESSION_BUFFER_BYTES) {
+      const evicted = chunks.shift();
+      currentBytes -= Buffer.byteLength(evicted, "utf8");
+    }
+    if (dataBytes > MAX_SESSION_BUFFER_BYTES) {
+      const tail = data.slice(data.length - MAX_SESSION_BUFFER_BYTES);
+      chunks.push(tail);
+      this.disconnectBufferBytes.set(sessionId, Buffer.byteLength(tail, "utf8"));
+      return;
+    }
+    chunks.push(data);
+    this.disconnectBufferBytes.set(sessionId, currentBytes + dataBytes);
+  }
+  /**
+   * Drain the disconnect buffer for a session, returning all buffered chunks
+   * and clearing the buffer. Returns an empty array if nothing was buffered.
+   */
+  drainBuffer(sessionId) {
+    const chunks = this.disconnectBuffers.get(sessionId);
+    if (!chunks || chunks.length === 0) return [];
+    const result = [...chunks];
+    this.disconnectBuffers.delete(sessionId);
+    this.disconnectBufferBytes.delete(sessionId);
+    return result;
+  }
   /**
    * Re-send capture-pane data for an already-active tmux stream.
    * Used when a viewer missed the initial burst (e.g. joinGroup race)
@@ -1707,7 +1816,7 @@ var ShellManager = class {
 };
 
 // src/inventory-manager.ts
-var os4 = __toESM(require("os"));
+var os5 = __toESM(require("os"));
 var import_child_process = require("child_process");
 var import_ws2 = __toESM(require("ws"));
 var InventoryManager = class {
@@ -1731,7 +1840,7 @@ var InventoryManager = class {
       type,
       hostId: this.options.hostId,
       hostName: this.options.hostName,
-      environment: os4.hostname(),
+      environment: os5.hostname(),
       sessions,
       vitals,
       agentVersion: CURRENT_VERSION,
@@ -1774,8 +1883,8 @@ var InventoryManager = class {
       cpuUsage = totalDelta > 0 ? Math.round((totalDelta - idleDelta) / totalDelta * 100) : 0;
     }
     this.prevCpuSnapshot = currentSnapshot;
-    const totalMem = os4.totalmem();
-    const freeMem = os4.freemem();
+    const totalMem = os5.totalmem();
+    const freeMem = os5.freemem();
     const memUsedPct = totalMem > 0 ? Math.round((totalMem - freeMem) / totalMem * 100) : 0;
     let diskUsedPct = 0;
     try {
@@ -1789,7 +1898,7 @@ var InventoryManager = class {
     return { cpu: cpuUsage, memUsedPct, diskUsedPct };
   }
   takeCpuSnapshot() {
-    const cpus2 = os4.cpus();
+    const cpus2 = os5.cpus();
     let idle = 0;
     let total = 0;
     for (const cpu of cpus2) {
@@ -1920,7 +2029,7 @@ var import_ws4 = __toESM(require("ws"));
 // src/service.ts
 var import_child_process2 = require("child_process");
 var fs2 = __toESM(require("fs"));
-var os5 = __toESM(require("os"));
+var os6 = __toESM(require("os"));
 function assertConfiguredAgentToken() {
   const config = loadConfig();
   if (!config.agentToken) {
@@ -1937,7 +2046,7 @@ function getConfiguredServiceBackend() {
   return null;
 }
 async function canUseSystemdUser() {
-  if (os5.platform() !== "linux") return false;
+  if (os6.platform() !== "linux") return false;
   try {
     await execAsync("systemctl --user --version", { timeout: 4e3 });
     await execAsync("systemctl --user show-environment", { timeout: 4e3 });
@@ -1960,7 +2069,9 @@ Wants=network-online.target
 Type=simple
 ExecStart=${process.execPath} ${__filename} run
 Restart=always
-RestartSec=3
+RestartSec=5
+StartLimitBurst=5
+StartLimitIntervalSec=300
 Environment=NODE_ENV=production
 NoNewPrivileges=true
 PrivateTmp=true
@@ -2004,6 +2115,21 @@ function isProcessRunning(pid) {
     return false;
   }
 }
+var LOG_ROTATION_MAX_BYTES = 10 * 1024 * 1024;
+function rotateLogIfNeeded() {
+  try {
+    const stat = fs2.statSync(FALLBACK_LOG_FILE);
+    if (stat.size > LOG_ROTATION_MAX_BYTES) {
+      const rotated = `${FALLBACK_LOG_FILE}.1`;
+      try {
+        fs2.unlinkSync(rotated);
+      } catch {
+      }
+      fs2.renameSync(FALLBACK_LOG_FILE, rotated);
+    }
+  } catch {
+  }
+}
 async function startPidfileService() {
   assertConfiguredAgentToken();
   const existingPid = readFallbackPid();
@@ -2012,11 +2138,12 @@ async function startPidfileService() {
     return;
   }
   ensureConfigDir();
+  rotateLogIfNeeded();
   const logFd = fs2.openSync(FALLBACK_LOG_FILE, "a");
   const child = (0, import_child_process2.spawn)(process.execPath, [__filename, "run"], {
     detached: true,
     stdio: ["ignore", logFd, logFd],
-    cwd: os5.homedir(),
+    cwd: os6.homedir(),
     env: process.env
   });
   child.unref();
@@ -2716,7 +2843,7 @@ var ControlDispatcher = class {
 // src/transcript-watcher.ts
 var fs3 = __toESM(require("fs"));
 var path2 = __toESM(require("path"));
-var os6 = __toESM(require("os"));
+var os7 = __toESM(require("os"));
 var import_child_process5 = require("child_process");
 var ClaudeCodeParser = class {
   name = "claude-code";
@@ -2889,7 +3016,7 @@ function discoverViaProc(panePid) {
   return null;
 }
 function discoverViaCwd(paneCwd) {
-  const claudeProjectsDir = path2.join(os6.homedir(), ".claude", "projects");
+  const claudeProjectsDir = path2.join(os7.homedir(), ".claude", "projects");
   if (!fs3.existsSync(claudeProjectsDir)) return null;
   const resolvedCwd = fs3.realpathSync(paneCwd);
   const expectedDirName = resolvedCwd.replace(/\//g, "-");
@@ -2907,7 +3034,7 @@ function discoverViaCwd(paneCwd) {
   }
 }
 function discoverCodexTranscript() {
-  const codexSessionsDir = path2.join(os6.homedir(), ".codex", "sessions");
+  const codexSessionsDir = path2.join(os7.homedir(), ".codex", "sessions");
   if (!fs3.existsSync(codexSessionsDir)) return null;
   try {
     const dateDirs = fs3.readdirSync(codexSessionsDir).filter((d) => /^\d{4}-\d{2}-\d{2}/.test(d)).sort().reverse();
@@ -2962,6 +3089,7 @@ function discoverTranscriptFile(sessionId, agentType) {
 var MAX_PARTIAL_BUFFER = 256 * 1024;
 var MAX_REPLAY_TURNS = 200;
 var POLL_INTERVAL_MS = 800;
+var REDISCOVERY_INTERVAL_MS = 5e3;
 var TranscriptWatcher = class {
   filePath;
   parser;
@@ -3132,6 +3260,7 @@ function getParser(agentType) {
 }
 var TranscriptWatcherManager = class {
   active = /* @__PURE__ */ new Map();
+  rediscoveryTimers = /* @__PURE__ */ new Map();
   sendFn;
   sendSnapshotFn;
   constructor(sendFn, sendSnapshotFn) {
@@ -3170,6 +3299,7 @@ var TranscriptWatcherManager = class {
     }
     this.active.set(sessionId, { watcher, filePath, agentType: agentType ?? "" });
     watcher.replayFromStart();
+    this.startRediscovery(sessionId, agentType);
     return true;
   }
   /** Disable markdown streaming for a session. */
@@ -3178,8 +3308,50 @@ var TranscriptWatcherManager = class {
     if (!session) return;
     session.watcher.removeSubscriber();
     this.active.delete(sessionId);
+    this.stopRediscovery(sessionId);
     console.log(`[rAgent] Stopped watching transcript for ${sessionId}`);
   }
+  /** Periodically check if the transcript file has changed (new conversation). */
+  startRediscovery(sessionId, agentType) {
+    this.stopRediscovery(sessionId);
+    const timer = setInterval(() => {
+      const session = this.active.get(sessionId);
+      if (!session) {
+        this.stopRediscovery(sessionId);
+        return;
+      }
+      const newPath = discoverTranscriptFile(sessionId, agentType);
+      if (!newPath || newPath === session.filePath) return;
+      console.log(`[rAgent] Transcript file changed for ${sessionId}: ${newPath}`);
+      session.watcher.stop();
+      const parser = getParser(agentType);
+      if (!parser) return;
+      const newWatcher = new TranscriptWatcher(newPath, parser, {
+        onTurn: (turn, seq) => {
+          this.sendFn(sessionId, turn, seq);
+        },
+        onError: (error) => {
+          console.warn(`[rAgent] Transcript watcher error (${sessionId}): ${error}`);
+        }
+      });
+      if (!newWatcher.start()) {
+        console.warn(`[rAgent] Failed to start watching new transcript ${newPath}`);
+        return;
+      }
+      this.sendSnapshotFn(sessionId, [], 0);
+      newWatcher.replayFromStart();
+      this.active.set(sessionId, { watcher: newWatcher, filePath: newPath, agentType: agentType ?? "" });
+    }, REDISCOVERY_INTERVAL_MS);
+    this.rediscoveryTimers.set(sessionId, timer);
+  }
+  /** Stop the re-discovery timer for a session. */
+  stopRediscovery(sessionId) {
+    const timer = this.rediscoveryTimers.get(sessionId);
+    if (timer) {
+      clearInterval(timer);
+      this.rediscoveryTimers.delete(sessionId);
+    }
+  }
   /** Handle sync-markdown request — send replay snapshot. */
   handleSyncRequest(sessionId, fromSeq) {
     const session = this.active.get(sessionId);
@@ -3191,9 +3363,11 @@ var TranscriptWatcherManager = class {
   stopAll() {
     for (const [sessionId, session] of this.active) {
       session.watcher.stop();
+      this.stopRediscovery(sessionId);
       console.log(`[rAgent] Stopped transcript watcher for ${sessionId}`);
     }
     this.active.clear();
+    this.rediscoveryTimers.clear();
   }
   /** Check if a session has an active watcher. */
   isWatching(sessionId) {
@@ -3249,7 +3423,7 @@ function resolveRunOptions(commandOptions) {
   const config = loadConfig();
   const portal = commandOptions.portal || config.portal || DEFAULT_PORTAL;
   const hostId = sanitizeHostId(commandOptions.id || config.hostId || inferHostId());
-  const hostName = commandOptions.name || config.hostName || os7.hostname();
+  const hostName = commandOptions.name || config.hostName || os8.hostname();
   const command = commandOptions.command || config.command || "bash";
   const agentToken = commandOptions.agentToken || config.agentToken || "";
   return { portal, hostId, hostName, command, agentToken };
@@ -3260,6 +3434,11 @@ async function runAgent(rawOptions) {
     throw new Error("No agent token found. Run `ragent connect` first.");
   }
   const lockPath = acquirePidLock(options.hostId);
+  const config = loadConfig();
+  if (config.redaction?.enabled) {
+    setRedactionEnabled(true);
+    console.log("[rAgent] Secret redaction enabled.");
+  }
   console.log(`[rAgent] Connector started for ${options.hostName} (${options.hostId})`);
   console.log(`[rAgent] Portal: ${options.portal}`);
   try {
@@ -3274,7 +3453,10 @@ async function runAgent(rawOptions) {
   const ptySessionId = `pty:${options.hostId}`;
   const sessionStreamer = new SessionStreamer(
     (sessionId, data) => {
-      if (!conn.isReady()) return;
+      if (!conn.isReady()) {
+        sessionStreamer.bufferOutput(sessionId, data);
+        return;
+      }
       if (conn.sessionKey) {
         const { enc, iv } = encryptPayload(data, conn.sessionKey);
         sendToGroup(conn.activeSocket, conn.activeGroups.privateGroup, { type: "output", enc, iv, sessionId });
@@ -3382,7 +3564,7 @@ async function runAgent(rawOptions) {
             sendToGroup(ws, groups.privateGroup, {
               type: "register",
               hostName: options.hostName,
-              environment: os7.platform()
+              environment: os8.platform()
             });
             conn.replayBufferedOutput((chunk) => {
               sendToGroup(ws, groups.privateGroup, {
@@ -3391,6 +3573,17 @@ async function runAgent(rawOptions) {
                 sessionId: ptySessionId
               });
             });
+            for (const [sessionId] of sessionStreamer.activeStreams()) {
+              const buffered = sessionStreamer.drainBuffer(sessionId);
+              for (const chunk of buffered) {
+                if (conn.sessionKey) {
+                  const { enc, iv } = encryptPayload(chunk, conn.sessionKey);
+                  sendToGroup(ws, groups.privateGroup, { type: "output", enc, iv, sessionId });
+                } else {
+                  sendToGroup(ws, groups.privateGroup, { type: "output", data: chunk, sessionId });
+                }
+              }
+            }
             await inventory.syncInventory(ws, groups, true);
             conn.startTimers(
               () => inventory.announceToRegistry(ws, groups.registryGroup, "heartbeat"),
@@ -3569,7 +3762,7 @@ function printCommandArt(title, subtitle = "remote agent control") {
 async function connectMachine(opts) {
   const portal = opts.portal || DEFAULT_PORTAL;
   const hostId = sanitizeHostId(opts.id || inferHostId());
-  const hostName = opts.name || os8.hostname();
+  const hostName = opts.name || os9.hostname();
   const command = opts.command || "bash";
   if (!opts.token) {
     throw new Error("Connection token is required.");
@@ -3643,12 +3836,12 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/doctor.ts
-var os9 = __toESM(require("os"));
+var os10 = __toESM(require("os"));
 async function runDoctor(opts) {
   const options = resolveRunOptions(opts);
   const checks = [];
-  const platformOk = os9.platform() === "linux";
-  checks.push({ name: "platform", ok: platformOk, detail: os9.platform() });
+  const platformOk = os10.platform() === "linux";
+  checks.push({ name: "platform", ok: platformOk, detail: os10.platform() });
   checks.push({
     name: "node",
     ok: Number(process.versions.node.split(".")[0]) >= 20,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ragent-cli",
-  "version": "1.5.2",
+  "version": "1.6.0",
   "description": "CLI agent for rAgent Live — browser-first terminal control plane for AI coding agents",
   "main": "dist/index.js",
   "bin": {