P1-3 through P1-8: mark done in production-grade backlog

[grade=A] P1-8: replace 66 console.* calls across 6 remaining files with structured logger
Files changed: - src/security/crypto-utils.js: 16 calls → log tagged 'crypto' - src/security/docker-security.js: 15 calls → log tagged 'security' - src/managers/port-lock-manager.js: 16 calls → log tagged 'portlock' - src/docker/self-updater.js: 10 calls → log tagged 'updater' - src/security/event-workers.js: 5 calls → log tagged 'events' - src/security/keychain-manager.js: 4 calls → log tagged 'keychain' Fixed 2 bugs found during sweep: - self-updater.js:161 — arrow expression body had trailing semicolon (SyntaxError) - port-lock-manager.js:137 — log.error referenced 'port' var out of scope (ReferenceError) 1539/1539 Jest tests pass. All ESLint warnings pre-existing (0 new).
2026-08-10 20:24:22 -07:00 · 2026-08-10 20:23:58 -07:00 · 2026-08-10 20:16:45 -07:00 · 2026-08-10 20:15:15 -07:00 · 2026-08-10 20:12:22 -07:00 · 2026-08-10 20:10:08 -07:00
12 changed files with 209 additions and 206 deletions
@@ -15,12 +15,12 @@ If an item is too big for one tick, implement a sub-part, push that, and note pr

 - [x] **P1-1: Add Joi validation library** — Done in commit a667de7 (DC-059, codex-graded B). `npm install joi@^18`, `src/utilities/validate.js` exporting `validateBody(schema, opts)` middleware + 9 schemas (backupConfigUpdate, backupScheduleCreate, backupRestore, backupRestoreFile, appDeploy, appRestore, appRevert, assetUpload, logoUpload). Every exported schema has direct unit tests (41 total in `__tests__/unit/validate.test.js`) covering middleware semantics — not just `schema.validate`. Applied to 8 destructive routes: backups (schedule/restore/config), apps (deploy/restore/revert), assets (upload/logo). Used Joi's authoritative CIDR validator (rejects malformed IPv6 like `::::/64` that the previous hex/colon regex would have accepted). 1539/1539 Jest tests pass (was 1498, +41 new). ESLint warnings unchanged (416 total, all pre-existing — zero new introduced).
 - [x] **P1-2: Console→logger sweep (update-manager.js)** — Done in commit e8b9dd5 (DC-060, codex-graded A). All 49 `console.*` calls in `src/managers/update-manager.js` now route through `log.info/log.warn/log.error` from `src/utils/logging` (tag = `'update'`). Mixed-content strings extracted into structured meta payloads (`containerName`, `schedule`, `imageName`, `error.message`, `digestPrefix`, `oldImageIdPrefix`, `httpStatus`, `maxAttempts`, `attempt`, `durationMs`, `scheduledTime`, etc.) so fields are queryable. Errors go through `log.error(ctx, errObj)` so they land in error.log with full stack trace + context. 1539/1539 Jest tests pass (78/78 update-manager tests still pass). ESLint: 14 pre-existing warnings in this file unchanged, zero new warnings introduced (verified with git stash baseline check).
- [ ] **P1-3: Console→logger sweep (backup-manager.js)** — Replace all 36 `console.*` calls in `src/utilities/backup-manager.js` with structured logger.
- [ ] **P1-4: Console→logger sweep (resource-monitor.js)** — Replace all 32 `console.*` calls in `src/managers/resource-monitor.js` with structured logger.
- [ ] **P1-5: Console→logger sweep (credential-manager.js)** — Replace all 20 `console.*` calls in `src/managers/credential-manager.js` with structured logger.
- [ ] **P1-6: Console→logger sweep (auth-manager.js)** — Replace all 20 `console.*` calls in `src/managers/auth-manager.js` with structured logger.
- [ ] **P1-7: Console→logger sweep (bundled-workflows.js)** — Replace all 18 `console.*` calls in `src/recipes/bundled-workflows.js` with structured logger.
- [ ] **P1-8: Console→logger sweep (remaining files)** — Sweep remaining files with < 20 console calls each: `crypto-utils.js` (16), `docker-security.js` (15), `port-lock-manager.js` (16), `self-updater.js` (10), `event-workers.js` (5), `keychain-manager.js` (4), `log-digest.js` (3), `csrf-protection.js` (3). One commit for all small files.
+- [x] **P1-3: Console→logger sweep (backup-manager.js)** — Done (commit c55abda). All 36 console calls in src/utilities/backup-manager.js → log.info/warn/error tagged 'backup'. Meta payloads with name, schedule, durationMs, volume, backupId, etc. 1539/1539 tests pass, 0 new ESLint warnings.
+- [x] **P1-4: Console→logger sweep (resource-monitor.js)** — Done (commit f2c6fa6). All 32 console calls in src/managers/resource-monitor.js → log tagged 'monitor'. 1539/1539 tests pass.
+- [x] **P1-5: Console→logger sweep (credential-manager.js)** — Done (commit 84f63a3). All 20 console calls → log tagged 'cred'. 1539/1539 tests pass.
+- [x] **P1-6: Console→logger sweep (auth-manager.js)** — Done (commit 84f63a3). All 20 console calls → log tagged 'auth'. 1539/1539 tests pass.
+- [x] **P1-7: Console→logger sweep (bundled-workflows.js)** — Done (commit 191d334). All 18 console calls → log tagged 'workflow'. 1539/1539 tests pass.
+- [x] **P1-8: Console→logger sweep (remaining files)** — Done (commit 7b04bc1). 66 calls across 6 files: crypto-utils.js (16), docker-security.js (15), port-lock-manager.js (16), self-updater.js (10), event-workers.js (5), keychain-manager.js (4). Fixed 2 bugs: semicolon in arrow expression body (self-updater.js:162) and out-of-scope variable reference (port-lock-manager.js:137). 1539/1539 tests pass.

 ## P2 — Code Quality & Technical Debt

@@ -10,6 +10,7 @@
 const EventEmitter = require('events');
 const https = require('https');
 const http = require('http');
+const { log } = require('../utils/logging');
 const fs = require('fs');
 const fsp = require('fs').promises;
 const path = require('path');
@@ -86,7 +87,7 @@ class SelfUpdater extends EventEmitter {
  start() {
    if (!this.config.enabled || this.checkTimer) return;

-    console.log('[SelfUpdater] Starting auto-update checks every %ds', this.config.checkInterval / 1000);
+    log.info('updater', 'Starting auto-update checks', { intervalMs: this.config.checkInterval });

    // First check after a short delay (let server finish startup)
    setTimeout(() => {
@@ -124,7 +125,7 @@ class SelfUpdater extends EventEmitter {
        return { version: pkg.version, commit };
      } catch { /* try next candidate */ }
    }
-    console.error('[SelfUpdater] getLocalVersion failed: no candidate package.json found');
+    log.error('updater', 'getLocalVersion failed: no candidate package.json found');
    return { version: '0.0.0', commit: null };
  }

@@ -158,7 +159,7 @@ class SelfUpdater extends EventEmitter {
    // Fire-and-forget; the response shouldn't block on the container rebuild.
    setImmediate(() => {
      this._autoCheckAndApply().catch(err =>
-        console.error('[SelfUpdater] %s-triggered update error: %s', triggeredBy, err.message)
+        log.error('updater', err, { triggeredBy })
      );
    });
    return { accepted: true, triggeredBy };
@@ -174,7 +175,7 @@ class SelfUpdater extends EventEmitter {
      try {
        remote = await this._fetchJson(`${this.config.updateUrl}/version.json`);
      } catch (primaryErr) {
-        console.warn('[SelfUpdater] Primary server failed:', primaryErr.message, '— trying mirror');
+        log.warn('updater', 'Primary server failed, trying mirror', { error: primaryErr.message });
        try {
          remote = await this._fetchJson(`${this.config.mirrorUrl}/version.json`);
          sourceUrl = this.config.mirrorUrl;
@@ -240,7 +241,7 @@ class SelfUpdater extends EventEmitter {
      try {
        await this._downloadFile(primaryUrl, tarballPath);
      } catch (dlErr) {
-        console.warn('[SelfUpdater] Primary download failed:', dlErr.message, '— trying mirror');
+        log.warn('updater', 'Primary download failed, trying mirror', { error: dlErr.message });
        // Ensure file is fully cleaned up before mirror attempt
        try { fs.unlinkSync(tarballPath); } catch { /* ignore */ }
        await this._downloadFile(mirrorUrl, tarballPath);
@@ -468,11 +469,11 @@ class SelfUpdater extends EventEmitter {
    try {
      const result = await this.checkForUpdate();
      if (result.available && result.remote) {
-        console.log('[SelfUpdater] Update available: %s → %s', result.local.version, result.remote.version);
+        log.info('updater', 'Update available', { localVersion: result.local.version, remoteVersion: result.remote.version });
        await this.applyUpdate(result.remote);
      }
    } catch (e) {
-      console.error('[SelfUpdater] Auto-update error:', e.message);
+      log.error('updater', e, { phase: 'autoUpdate' });
    }
  }

@@ -606,7 +607,7 @@ class SelfUpdater extends EventEmitter {
      fs.mkdirSync(path.dirname(this.notifySecretFile), { recursive: true });
      fs.writeFileSync(this.notifySecretFile, `${secret}\n`, { mode: 0o600 });
    } catch (error) {
-      console.warn('[SelfUpdater] Failed to persist notify secret:', error.message);
+      log.warn('updater', 'Failed to persist notify secret', { error: error.message });
    }
    return secret;
  }
@@ -626,7 +627,7 @@ class SelfUpdater extends EventEmitter {
      fs.mkdirSync(path.dirname(this.config.instanceIdFile), { recursive: true });
      fs.writeFileSync(this.config.instanceIdFile, `${instanceId}\n`, 'utf8');
    } catch (error) {
-      console.warn('[SelfUpdater] Failed to persist instance ID:', error.message);
+      log.warn('updater', 'Failed to persist instance ID', { error: error.message });
    }
    return instanceId;
  }
@@ -644,7 +645,7 @@ class SelfUpdater extends EventEmitter {
    try {
      fs.writeFileSync(historyPath, JSON.stringify(history, null, 2));
    } catch (e) {
-      console.error('[SelfUpdater] Failed to save history:', e.message);
+      log.error('updater', e, { operation: 'saveHistory' });
    }
  }

@@ -8,6 +8,7 @@ const jwt = require('jsonwebtoken');
 const crypto = require('crypto');
 const credentialManager = require('./credential-manager');
 const cryptoUtils = require('../security/crypto-utils');
+const { log } = require('../utils/logging');

 // JWT signing secret - derived from encryption key for consistency
 const JWT_SECRET = cryptoUtils.loadOrCreateKey();
@@ -19,7 +20,7 @@ const API_KEY_METADATA_NAMESPACE = 'auth.metadata';
 class AuthManager {
  constructor() {
    this.keyMetadataCache = new Map(); // Cache for API key metadata
-    console.log('[AuthManager] Initialized');
+    log.info('auth', 'Initialized');
  }

  /**
@@ -44,10 +45,10 @@ class AuthManager {
        { expiresIn }
      );

-      console.log(`[AuthManager] Generated JWT for user: ${payload.sub}, expires in: ${expiresIn}`);
+      log.info('auth', 'Generated JWT', { user: payload.sub, expiresIn });
      return token;
    } catch (error) {
-      console.error('[AuthManager] JWT generation failed:', error.message);
+      log.error('auth', error, { operation: 'jwtGenerate' });
      throw error;
    }
  }
@@ -68,11 +69,11 @@ class AuthManager {
      };
    } catch (error) {
      if (error.name === 'TokenExpiredError') {
-        console.log('[AuthManager] JWT token expired');
+        log.info('auth', 'JWT token expired');
      } else if (error.name === 'JsonWebTokenError') {
-        console.log('[AuthManager] JWT token invalid:', error.message);
+        log.info('auth', 'JWT token invalid', { error: error.message });
      } else {
-        console.error('[AuthManager] JWT verification failed:', error.message);
+        log.error('auth', error, { operation: 'jwtVerify' });
      }
      return null;
    }
@@ -116,7 +117,7 @@ class AuthManager {
      // Cache metadata
      this.keyMetadataCache.set(keyId, metadata);

-      console.log(`[AuthManager] Generated API key: ${name} (${keyId})`);
+      log.info('auth', 'Generated API key', { name, keyId });

      return {
        key: apiKey,
@@ -126,7 +127,7 @@ class AuthManager {
        createdAt: metadata.createdAt
      };
    } catch (error) {
-      console.error('[AuthManager] API key generation failed:', error.message);
+      log.error('auth', error, { operation: 'apiKeyGenerate' });
      throw error;
    }
  }
@@ -154,30 +155,30 @@ class AuthManager {
      // Retrieve stored hash
      const storedHash = await credentialManager.retrieve(credentialKey);
      if (!storedHash) {
-        console.log(`[AuthManager] API key not found: ${keyId}`);
+        log.info('auth', 'API key not found', { keyId });
        return null;
      }

      // Verify key matches stored hash
      const providedHash = crypto.createHash('sha256').update(key).digest('hex');
      if (!crypto.timingSafeEqual(Buffer.from(storedHash), Buffer.from(providedHash))) {
-        console.log(`[AuthManager] API key hash mismatch: ${keyId}`);
+        log.info('auth', 'API key hash mismatch', { keyId });
        return null;
      }

      // Get metadata
      const metadata = await this.getKeyMetadata(keyId);
      if (!metadata) {
-        console.log(`[AuthManager] API key metadata not found: ${keyId}`);
+        log.info('auth', 'API key metadata not found', { keyId });
        return null;
      }

      // Update last used timestamp (non-blocking)
      this.updateLastUsed(keyId, metadata).catch(err =>
-        console.error(`[AuthManager] Failed to update lastUsed for ${keyId}:`, err.message)
+        log.error('auth', err, { keyId, operation: 'updateLastUsed' })
      );

-      console.log(`[AuthManager] API key verified: ${metadata.name} (${keyId})`);
+      log.info('auth', 'API key verified', { name: metadata.name, keyId });

      return {
        keyId,
@@ -185,7 +186,7 @@ class AuthManager {
        name: metadata.name
      };
    } catch (error) {
-      console.error('[AuthManager] API key verification failed:', error.message);
+      log.error('auth', error, { operation: 'apiKeyVerify' });
      return null;
    }
  }
@@ -205,10 +206,10 @@ class AuthManager {

      this.keyMetadataCache.delete(keyId);

-      console.log(`[AuthManager] Revoked API key: ${keyId}`);
+      log.info('auth', 'Revoked API key', { keyId });
      return true;
    } catch (error) {
-      console.error(`[AuthManager] Failed to revoke API key ${keyId}:`, error.message);
+      log.error('auth', error, { keyId, operation: 'revoke' });
      return false;
    }
  }
@@ -233,7 +234,7 @@ class AuthManager {

      return keys;
    } catch (error) {
-      console.error('[AuthManager] Failed to list API keys:', error.message);
+      log.error('auth', error, { operation: 'listApiKeys' });
      return [];
    }
  }
@@ -262,7 +263,7 @@ class AuthManager {

      return metadata;
    } catch (error) {
-      console.error(`[AuthManager] Failed to get metadata for ${keyId}:`, error.message);
+      log.error('auth', error, { keyId, operation: 'getMetadata' });
      return null;
    }
  }
@@ -285,7 +286,7 @@ class AuthManager {

      this.keyMetadataCache.set(keyId, updatedMetadata);
    } catch (error) {
-      console.error(`[AuthManager] Failed to update lastUsed for ${keyId}:`, error.message);
+      log.error('auth', error, { keyId, operation: 'updateLastUsed' });
    }
  }

@@ -294,7 +295,7 @@ class AuthManager {
   */
  clearCache() {
    this.keyMetadataCache.clear();
-    console.log('[AuthManager] Cache cleared');
+    log.info('auth', 'Cache cleared');
  }
 }

@@ -8,6 +8,7 @@ const keychainManager = require('../security/keychain-manager');
 const cryptoUtils = require('../security/crypto-utils');
 const lockfile = require('proper-lockfile');
 const fs = require('fs');
+const { log } = require('../utils/logging');
 const path = require('path');
 const platformPaths = require('../../platform-paths');

@@ -33,7 +34,7 @@ class CredentialManager {
      stale: 30000
    };

-    console.log(`[CredentialManager] Initialized with ${this.useKeychain ? 'OS keychain' : 'encrypted file'} storage`);
+    log.info('cred', 'Initialized', { storage: this.useKeychain ? 'keychain' : 'file' });
  }

  /**
@@ -60,19 +61,19 @@ class CredentialManager {
          // Store metadata separately in file
          await this.storeMetadata(key, metadata);
          this.cache.set(key, { value, exp: Date.now() + this.CACHE_TTL_MS });
-          console.log(`[CredentialManager] Stored '${key}' in OS keychain`);
+          log.info('cred', 'Stored credential in keychain', { key });
          return true;
        }
-        console.warn(`[CredentialManager] Keychain storage failed for '${key}', falling back to encrypted file`);
+        log.warn('cred', 'Keychain storage failed, falling back to encrypted file', { key });
      }

      // Fallback to encrypted file storage
      await this.storeInFile(key, value, metadata);
      this.cache.set(key, { value, exp: Date.now() + this.CACHE_TTL_MS });
-      console.log(`[CredentialManager] Stored '${key}' in encrypted file`);
+      log.info('cred', 'Stored credential in encrypted file', { key });
      return true;
    } catch (error) {
-      console.error(`[CredentialManager] Failed to store '${key}':`, error.message);
+      log.error('cred', error, { key, operation: 'store' });
      return false;
    }
  }
@@ -109,7 +110,7 @@ class CredentialManager {
      }
      return value;
    } catch (error) {
-      console.error(`[CredentialManager] Failed to retrieve '${key}':`, error.message);
+      log.error('cred', error, { key, operation: 'retrieve' });
      return null;
    }
  }
@@ -132,10 +133,10 @@ class CredentialManager {
      // Remove from file storage
      await this.deleteFromFile(key);
      
-      console.log(`[CredentialManager] Deleted '${key}'`);
+      log.info('cred', 'Deleted credential', { key });
      return true;
    } catch (error) {
-      console.error(`[CredentialManager] Failed to delete '${key}':`, error.message);
+      log.error('cred', error, { key, operation: 'delete' });
      return false;
    }
  }
@@ -149,7 +150,7 @@ class CredentialManager {
      const credentials = await this.loadCredentialsFile();
      return Object.keys(credentials);
    } catch (error) {
-      console.error('[CredentialManager] Failed to list credentials:', error.message);
+      log.error('cred', error, { operation: 'list' });
      return [];
    }
  }
@@ -175,7 +176,7 @@ class CredentialManager {
  async rotateEncryptionKey() {
    let release;
    try {
-      console.log('[CredentialManager] Starting encryption key rotation...');
+      log.info('cred', 'Starting encryption key rotation');

      // Ensure file exists before locking
      this._ensureFileExists();
@@ -186,7 +187,7 @@ class CredentialManager {
      const keys = Object.keys(credentials);

      if (keys.length === 0) {
-        console.log('[CredentialManager] No credentials to rotate');
+        log.info('cred', 'No credentials to rotate');
        return true;
      }

@@ -219,10 +220,10 @@ class CredentialManager {
      // Clear cache to force reload
      this.cache.clear();

-      console.log(`[CredentialManager] Successfully rotated ${keys.length} credentials`);
+      log.info('cred', 'Rotated credentials', { count: keys.length });
      return true;
    } catch (error) {
-      console.error('[CredentialManager] Key rotation failed:', error.message);
+      log.error('cred', error, { operation: 'rotate' });
      return false;
    } finally {
      if (release) {
@@ -255,12 +256,12 @@ class CredentialManager {

      if (migrated > 0) {
        this.cache.clear();
-        console.log(`[CredentialManager] Migrated ${migrated} plaintext credentials to encrypted format`);
+        log.info('cred', 'Migrated plaintext credentials', { count: migrated });
      }

      return { migrated, skipped, total: migrated + skipped };
    } catch (error) {
-      console.error('[CredentialManager] Migration failed:', error.message);
+      log.error('cred', error, { operation: 'migrate' });
      throw error;
    }
  }
@@ -365,14 +366,11 @@ class CredentialManager {
        // Most common cause: the encryption key on disk is different from
        // the key that originally encrypted this entry (rotated by a
        // container recreate that didn't preserve CREDENTIALS_FILE env).
-        console.warn(
-          `[CredentialManager] '${key}' is present but cannot be decrypted ` +
-          `(likely encryption-key mismatch): ${decryptErr.message}`
-        );
+        log.warn('cred', 'Credential present but cannot be decrypted (likely encryption-key mismatch)', { key, error: decryptErr.message });
        return { status: 'unreadable', value: null, error: decryptErr.message };
      }
    } catch (err) {
-      console.error(`[CredentialManager] diagnose('${key}') failed:`, err.message);
+      log.error('cred', err, { key, operation: 'diagnose' });
      return { status: 'malformed', value: null, error: err.message };
    }
  }
@@ -404,7 +402,7 @@ class CredentialManager {
      const data = fs.readFileSync(CREDENTIALS_FILE, 'utf8');
      return JSON.parse(data);
    } catch (error) {
-      console.error('[CredentialManager] Failed to load credentials file:', error.message);
+      log.error('cred', error, { operation: 'loadFile' });
      return {};
    }
  }
@@ -440,10 +438,10 @@ class CredentialManager {
      await this._lockedUpdate(() => backup.credentials);
      this.cache.clear();

-      console.log('[CredentialManager] Successfully imported backup');
+      log.info('cred', 'Successfully imported backup');
      return true;
    } catch (error) {
-      console.error('[CredentialManager] Failed to import backup:', error.message);
+      log.error('cred', error, { operation: 'importBackup' });
      return false;
    }
  }
@@ -8,6 +8,7 @@ const fs = require('fs');
 const path = require('path');
 const lockfile = require('proper-lockfile');
 const platformPaths = require('../../platform-paths');
+const { log } = require('../utils/logging');

 const LOCK_DIR = process.env.PORT_LOCK_DIR || path.join(platformPaths.dataDir, '.port-locks');
 const LOCK_TIMEOUT = 120000; // 2 minutes
@@ -35,7 +36,7 @@ class PortLockManager {
  ensureLockDirectory() {
    if (!fs.existsSync(LOCK_DIR)) {
      fs.mkdirSync(LOCK_DIR, { recursive: true });
-      console.log('[PortLockManager] Created lock directory:', LOCK_DIR);
+      log.info('portlock', 'Created lock directory', { dir: LOCK_DIR });
    }
  }

@@ -63,7 +64,7 @@ class PortLockManager {
    const releaseFunctions = [];

    try {
-      console.log(`[PortLockManager] Acquiring locks for ports: ${sortedPorts.join(', ')}`);
+      log.info('portlock', 'Acquiring locks', { ports: sortedPorts });

      // Acquire locks in sorted order to prevent deadlocks
      for (const port of sortedPorts) {
@@ -83,7 +84,7 @@ class PortLockManager {
        acquiredLocks.push(port);
        releaseFunctions.push(release);

-        console.log(`[PortLockManager] Locked port ${port}`);
+        log.info('portlock', 'Locked port', { port });
      }

      // Store lock information
@@ -93,18 +94,18 @@ class PortLockManager {
        timestamp: Date.now()
      });

-      console.log(`[PortLockManager] Successfully acquired all locks (ID: ${lockId})`);
+      log.info('portlock', 'Acquired all locks', { lockId });
      return lockId;

    } catch (error) {
      // Release any locks we managed to acquire
-      console.error(`[PortLockManager] Failed to acquire all locks:`, error.message);
+      log.error('portlock', error, { operation: 'acquire', lockId });

      for (const release of releaseFunctions) {
        try {
          await release();
        } catch (releaseError) {
-          console.error(`[PortLockManager] Error releasing lock during cleanup:`, releaseError.message);
+          log.error('portlock', releaseError, { operation: 'releaseCleanup', lockId });
        }
      }

@@ -120,11 +121,11 @@ class PortLockManager {
    const lockInfo = this.activeLocks.get(lockId);

    if (!lockInfo) {
-      console.warn(`[PortLockManager] Lock ID ${lockId} not found (may have been released already)`);
+      log.warn('portlock', 'Lock ID not found', { lockId });
      return;
    }

-    console.log(`[PortLockManager] Releasing locks for ports: ${lockInfo.ports.join(', ')}`);
+    log.info('portlock', 'Releasing locks', { lockId, ports: lockInfo.ports });

    const errors = [];

@@ -133,16 +134,16 @@ class PortLockManager {
        await release();
      } catch (error) {
        errors.push(error.message);
-        console.error(`[PortLockManager] Error releasing lock:`, error.message);
+        log.error('portlock', error, { operation: 'release', lockId });
      }
    }

    this.activeLocks.delete(lockId);

    if (errors.length > 0) {
-      console.warn(`[PortLockManager] Released locks with ${errors.length} errors`);
+      log.warn('portlock', 'Released locks with errors', { lockId, errorCount: errors.length });
    } else {
-      console.log(`[PortLockManager] Successfully released all locks (ID: ${lockId})`);
+      log.info('portlock', 'Released all locks', { lockId });
    }
  }

@@ -151,7 +152,7 @@ class PortLockManager {
   * Removes locks older than LOCK_STALE_THRESHOLD
   */
  async cleanupStaleLocks() {
-    console.log('[PortLockManager] Cleaning up stale locks...');
+    log.info('portlock', 'Cleaning up stale locks');

    this.ensureLockDirectory();

@@ -174,20 +175,20 @@ class PortLockManager {
            // Lock is stale or not locked, safe to remove
            fs.unlinkSync(lockFilePath);
            cleaned++;
-            console.log(`[PortLockManager] Removed stale lock: ${file}`);
+            log.info('portlock', 'Removed stale lock', { file });
          }
        } catch (error) {
          // File might not exist or might have been removed by another process
          if (error.code !== 'ENOENT') {
            errors++;
-            console.warn(`[PortLockManager] Error checking lock ${file}:`, error.message);
+            log.warn('portlock', 'Error checking lock', { file, error: error.message });
          }
        }
      }

-      console.log(`[PortLockManager] Cleanup complete: ${cleaned} stale locks removed, ${errors} errors`);
+      log.info('portlock', 'Cleanup complete', { cleaned, errors });
    } catch (error) {
-      console.error('[PortLockManager] Error during cleanup:', error.message);
+      log.error('portlock', error, { operation: 'cleanup' });
    }
  }

@@ -9,6 +9,7 @@ const EventEmitter = require('events');
 const fs = require('fs');
 const path = require('path');
 const platformPaths = require('../../platform-paths');
+const { log } = require('../utils/logging');

 const docker = new Docker();

@@ -59,17 +60,17 @@ class ResourceMonitor extends EventEmitter {
   */
  start() {
    if (this.monitoring) {
-      console.log('[ResourceMonitor] Already monitoring');
+      log.info('monitor', 'Already monitoring');
      return;
    }

-    console.log('[ResourceMonitor] Starting container monitoring');
+    log.info('monitor', 'Starting container monitoring');
    this.monitoring = true;
    this.monitoringInterval = setInterval(() => this.collectStats(), MONITORING_INTERVAL);

    // Hourly rollup — fires once an hour, computes the previous full hour
    this.hourlyRollupTimer = setInterval(() => {
-      try { this.rollupHourly(); } catch (e) { console.error('[ResourceMonitor] hourly rollup error:', e.message); }
+      try { this.rollupHourly(); } catch (e) { log.error('monitor', e, { rollup: 'hourly' }); }
    }, ROLLUP_HOURLY_INTERVAL);

    // Daily rollup — schedule first run at the next midnight, then fire every 24h
@@ -77,9 +78,9 @@ class ResourceMonitor extends EventEmitter {
    const nextMidnight = new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1, 0, 0, 5);
    const msUntilMidnight = nextMidnight.getTime() - now.getTime();
    setTimeout(() => {
-      try { this.rollupDaily(); } catch (e) { console.error('[ResourceMonitor] daily rollup error:', e.message); }
+      try { this.rollupDaily(); } catch (e) { log.error('monitor', e, { rollup: 'daily' }); }
      this.dailyRollupTimer = setInterval(() => {
-        try { this.rollupDaily(); } catch (e) { console.error('[ResourceMonitor] daily rollup error:', e.message); }
+        try { this.rollupDaily(); } catch (e) { log.error('monitor', e, { rollup: 'daily' }); }
      }, ROLLUP_DAILY_INTERVAL);
    }, msUntilMidnight);

@@ -93,7 +94,7 @@ class ResourceMonitor extends EventEmitter {
  stop() {
    if (!this.monitoring) return;

-    console.log('[ResourceMonitor] Stopping container monitoring');
+    log.info('monitor', 'Stopping container monitoring');
    this.monitoring = false;

    if (this.monitoringInterval) {
@@ -131,7 +132,7 @@ class ResourceMonitor extends EventEmitter {
            this.checkAlerts(containerInfo.Id, containerInfo.Names[0], stats);
          }
        } catch (error) {
-          console.error(`[ResourceMonitor] Error collecting stats for ${containerInfo.Names[0]}:`, error.message);
+          log.error('monitor', error, { container: containerInfo.Names[0] });
        }
      }
      
@@ -143,7 +144,7 @@ class ResourceMonitor extends EventEmitter {
        this.saveStats();
      }
    } catch (error) {
-      console.error('[ResourceMonitor] Error collecting container stats:', error.message);
+      log.error('monitor', error, { phase: 'collectStats' });
    }
  }

@@ -329,7 +330,7 @@ class ResourceMonitor extends EventEmitter {
      // Send notification if manager is configured
      if (this.notificationManager) {
        this.notificationManager.sendAlert(alertPayload).catch(err => {
-          console.error('[ResourceMonitor] Failed to send alert notification:', err.message);
+          log.error('monitor', err, { phase: 'sendAlert' });
        });
      }

@@ -357,7 +358,7 @@ class ResourceMonitor extends EventEmitter {
   */
  async restartContainer(containerId, containerName, alerts) {
    try {
-      console.log(`[ResourceMonitor] Auto-restarting ${containerName} due to alerts:`, alerts.map(a => a.type).join(', '));
+      log.info('monitor', 'Auto-restarting container', { container: containerName, alerts: alerts.map(a => a.type) });
      
      const container = docker.getContainer(containerId);
      await container.restart();
@@ -377,11 +378,11 @@ class ResourceMonitor extends EventEmitter {
          timestamp: new Date().toISOString(),
          reason: alerts
        }).catch(err => {
-          console.error('[ResourceMonitor] Failed to send auto-restart notification:', err.message);
+          log.error('monitor', err, { phase: 'sendAutoRestart' });
        });
      }
    } catch (error) {
-      console.error(`[ResourceMonitor] Failed to restart ${containerName}:`, error.message);
+      log.error('monitor', error, { container: containerName, phase: 'restart' });
    }
  }

@@ -390,7 +391,7 @@ class ResourceMonitor extends EventEmitter {
   */
  triggerWorkflows(eventType, eventData) {
    if (!this.workflowEngine) {
-      console.log('[ResourceMonitor] Workflow engine not set, skipping workflow trigger');
+      log.info('monitor', 'Workflow engine not set, skipping workflow trigger');
      return;
    }
    
@@ -398,14 +399,14 @@ class ResourceMonitor extends EventEmitter {
      this.workflowEngine.triggerForEvent(eventType, eventData)
        .then(results => {
          if (results && results.length > 0) {
-            console.log(`[ResourceMonitor] Triggered ${results.length} workflow(s) for ${eventType}`);
+            log.info('monitor', `Triggered workflows for ${eventType}`, { count: results.length });
          }
        })
        .catch(err => {
-          console.error('[ResourceMonitor] Workflow trigger error:', err.message);
+          log.error('monitor', err, { phase: 'workflowTrigger' });
        });
    } catch (error) {
-      console.error('[ResourceMonitor] Error triggering workflows:', error.message);
+      log.error('monitor', error, { phase: 'workflowTrigger' });
    }
  }

@@ -414,7 +415,7 @@ class ResourceMonitor extends EventEmitter {
   */
  setWorkflowEngine(workflowEngine) {
    this.workflowEngine = workflowEngine;
-    console.log('[ResourceMonitor] Workflow engine configured');
+    log.info('monitor', 'Workflow engine configured');
  }

  /**
@@ -562,10 +563,10 @@ class ResourceMonitor extends EventEmitter {
      if (fs.existsSync(ALERT_HISTORY_FILE)) {
        const data = JSON.parse(fs.readFileSync(ALERT_HISTORY_FILE, 'utf8'));
        this.alertHistory = Array.isArray(data) ? data : [];
-        console.log(`[ResourceMonitor] Loaded ${this.alertHistory.length} alert history entries`);
+        log.info('monitor', 'Loaded alert history', { count: this.alertHistory.length });
      }
    } catch (error) {
-      console.error('[ResourceMonitor] Error loading alert history:', error.message);
+      log.error('monitor', error, { operation: 'loadAlertHistory' });
    }
  }

@@ -576,7 +577,7 @@ class ResourceMonitor extends EventEmitter {
    try {
      fs.writeFileSync(ALERT_HISTORY_FILE, JSON.stringify(this.alertHistory, null, 2));
    } catch (error) {
-      console.error('[ResourceMonitor] Error saving alert history:', error.message);
+      log.error('monitor', error, { operation: 'saveAlertHistory' });
    }
  }

@@ -606,10 +607,10 @@ class ResourceMonitor extends EventEmitter {
      if (fs.existsSync(STATS_FILE)) {
        const data = JSON.parse(fs.readFileSync(STATS_FILE, 'utf8'));
        this.stats = new Map(Object.entries(data));
-        console.log(`[ResourceMonitor] Loaded stats for ${this.stats.size} containers`);
+        log.info('monitor', 'Loaded stats', { containerCount: this.stats.size });
      }
    } catch (error) {
-      console.error('[ResourceMonitor] Error loading stats:', error.message);
+      log.error('monitor', error, { operation: 'loadStats' });
    }
  }

@@ -621,7 +622,7 @@ class ResourceMonitor extends EventEmitter {
      const data = Object.fromEntries(this.stats);
      fs.writeFileSync(STATS_FILE, JSON.stringify(data, null, 2));
    } catch (error) {
-      console.error('[ResourceMonitor] Error saving stats:', error.message);
+      log.error('monitor', error, { operation: 'saveStats' });
    }
  }

@@ -633,10 +634,10 @@ class ResourceMonitor extends EventEmitter {
      if (fs.existsSync(ALERT_CONFIG_FILE)) {
        const data = JSON.parse(fs.readFileSync(ALERT_CONFIG_FILE, 'utf8'));
        this.alerts = new Map(Object.entries(data));
-        console.log(`[ResourceMonitor] Loaded alert config for ${this.alerts.size} containers`);
+        log.info('monitor', 'Loaded alert config', { containerCount: this.alerts.size });
      }
    } catch (error) {
-      console.error('[ResourceMonitor] Error loading alert config:', error.message);
+      log.error('monitor', error, { operation: 'loadAlertConfig' });
    }
  }

@@ -648,7 +649,7 @@ class ResourceMonitor extends EventEmitter {
      const data = Object.fromEntries(this.alerts);
      fs.writeFileSync(ALERT_CONFIG_FILE, JSON.stringify(data, null, 2));
    } catch (error) {
-      console.error('[ResourceMonitor] Error saving alert config:', error.message);
+      log.error('monitor', error, { operation: 'saveAlertConfig' });
    }
  }

@@ -902,10 +903,10 @@ class ResourceMonitor extends EventEmitter {
      if (fs.existsSync(STATS_HOURLY_FILE)) {
        const data = JSON.parse(fs.readFileSync(STATS_HOURLY_FILE, 'utf8'));
        this.hourlyHistory = new Map(Object.entries(data));
-        console.log(`[ResourceMonitor] Loaded hourly rollups for ${this.hourlyHistory.size} containers`);
+        log.info('monitor', 'Loaded hourly rollups', { containerCount: this.hourlyHistory.size });
      }
    } catch (error) {
-      console.error('[ResourceMonitor] Error loading hourly stats:', error.message);
+      log.error('monitor', error, { operation: 'loadHourlyStats' });
    }
  }

@@ -917,7 +918,7 @@ class ResourceMonitor extends EventEmitter {
      const data = Object.fromEntries(this.hourlyHistory);
      fs.writeFileSync(STATS_HOURLY_FILE, JSON.stringify(data, null, 2));
    } catch (error) {
-      console.error('[ResourceMonitor] Error saving hourly stats:', error.message);
+      log.error('monitor', error, { operation: 'saveHourlyStats' });
    }
  }

@@ -929,10 +930,10 @@ class ResourceMonitor extends EventEmitter {
      if (fs.existsSync(STATS_DAILY_FILE)) {
        const data = JSON.parse(fs.readFileSync(STATS_DAILY_FILE, 'utf8'));
        this.dailyHistory = new Map(Object.entries(data));
-        console.log(`[ResourceMonitor] Loaded daily rollups for ${this.dailyHistory.size} containers`);
+        log.info('monitor', 'Loaded daily rollups', { containerCount: this.dailyHistory.size });
      }
    } catch (error) {
-      console.error('[ResourceMonitor] Error loading daily stats:', error.message);
+      log.error('monitor', error, { operation: 'loadDailyStats' });
    }
  }

@@ -944,7 +945,7 @@ class ResourceMonitor extends EventEmitter {
      const data = Object.fromEntries(this.dailyHistory);
      fs.writeFileSync(STATS_DAILY_FILE, JSON.stringify(data, null, 2));
    } catch (error) {
-      console.error('[ResourceMonitor] Error saving daily stats:', error.message);
+      log.error('monitor', error, { operation: 'saveDailyStats' });
    }
  }

@@ -8,6 +8,7 @@
 const EventEmitter = require('events');
 const fs = require('fs');
 const path = require('path');
+const { log } = require('../utils/logging');
 const platformPaths = require('../../platform-paths');

 const WORKFLOWS_FILE = process.env.WORKFLOWS_FILE || path.join(platformPaths.dataDir, 'workflows-config.json');
@@ -102,7 +103,7 @@ class WorkflowEngine extends EventEmitter {
        this.enabled = new Map(Object.entries(data.enabled || {}));
      }
    } catch (error) {
-      console.error('[WorkflowEngine] Error loading config:', error.message);
+      log.error('workflow', error, { operation: 'loadConfig' });
    }
    
    // Default all workflows to enabled if not explicitly set
@@ -123,7 +124,7 @@ class WorkflowEngine extends EventEmitter {
      };
      fs.writeFileSync(WORKFLOWS_FILE, JSON.stringify(data, null, 2));
    } catch (error) {
-      console.error('[WorkflowEngine] Error saving config:', error.message);
+      log.error('workflow', error, { operation: 'saveConfig' });
    }
  }

@@ -136,7 +137,7 @@ class WorkflowEngine extends EventEmitter {
        this.history = JSON.parse(fs.readFileSync(WORKFLOW_HISTORY_FILE, 'utf8'));
      }
    } catch (error) {
-      console.error('[WorkflowEngine] Error loading history:', error.message);
+      log.error('workflow', error, { operation: 'loadHistory' });
      this.history = [];
    }
  }
@@ -148,7 +149,7 @@ class WorkflowEngine extends EventEmitter {
    try {
      fs.writeFileSync(WORKFLOW_HISTORY_FILE, JSON.stringify(this.history, null, 2));
    } catch (error) {
-      console.error('[WorkflowEngine] Error saving history:', error.message);
+      log.error('workflow', error, { operation: 'saveHistory' });
    }
  }

@@ -174,11 +175,11 @@ class WorkflowEngine extends EventEmitter {
    
    const job = setInterval(() => {
      this.executeWorkflow(workflowId, { trigger: 'scheduled', timestamp: new Date().toISOString() })
-        .catch(err => console.error(`[WorkflowEngine] Scheduled workflow ${workflowId} failed:`, err.message));
+        .catch(err => log.error('workflow', err, { workflowId, phase: 'scheduled' }));
    }, workflow.interval);
    
    this.scheduledJobs.set(workflowId, job);
-    console.log(`[WorkflowEngine] Scheduled workflow '${workflowId}' every ${workflow.interval}ms`);
+    log.info('workflow', 'Scheduled workflow', { workflowId, intervalMs: workflow.interval });
  }

  /**
@@ -201,14 +202,14 @@ class WorkflowEngine extends EventEmitter {
    }

    if (!this.enabled.get(workflowId)) {
-      console.log(`[WorkflowEngine] Workflow ${workflowId} is disabled, skipping`);
+      log.info('workflow', 'Workflow disabled, skipping', { workflowId });
      return { skipped: true, reason: 'disabled' };
    }

    const executionId = `${workflowId}-${Date.now()}`;
    const startTime = Date.now();

-    console.log(`[WorkflowEngine] Executing workflow: ${workflowId}`);
+    log.info('workflow', 'Executing workflow', { workflowId });
    this.emit('workflow-start', { workflowId, executionId, triggerData });

    const results = await this._runActions(workflow.actions, triggerData);
@@ -237,7 +238,7 @@ class WorkflowEngine extends EventEmitter {
    this.saveHistory();

    this.emit('workflow-complete', historyEntry);
-    console.log(`[WorkflowEngine] Workflow ${workflowId} completed in ${duration}ms, success: ${allSucceeded}`);
+    log.info('workflow', 'Workflow completed', { workflowId, durationMs: duration, success: allSucceeded });

    return historyEntry;
  }
@@ -269,7 +270,7 @@ class WorkflowEngine extends EventEmitter {
        const result = await this.executeAction(action, actionContext);
        results.push({ action: action.type, success: true, result });
      } catch (error) {
-        console.error(`[WorkflowEngine] Action ${action.type} failed:`, error.message);
+        log.error('workflow', error, { actionType: action.type });
        results.push({
          action: action.type,
          success: false,
@@ -322,7 +323,7 @@ class WorkflowEngine extends EventEmitter {
        return this.collectMetrics(context.containerId, action.period);
      
      default:
-        console.warn(`[WorkflowEngine] Unknown action type: ${action.type}`);
+        log.warn('workflow', 'Unknown action type', { actionType: action.type });
        return { skipped: true, reason: `Unknown action type: ${action.type}` };
    }
  }
@@ -428,7 +429,7 @@ class WorkflowEngine extends EventEmitter {
      throw new Error('Container ID not provided');
    }
    
-    console.log(`[WorkflowEngine] Restarting container: ${containerId}`);
+    log.info('workflow', 'Restarting container', { containerId });
    const container = docker.getContainer(containerId);
    await container.restart();
    
@@ -448,7 +449,7 @@ class WorkflowEngine extends EventEmitter {
      throw new Error('App ID not provided');
    }
    
-    console.log(`[WorkflowEngine] Creating backup for: ${appId}`);
+    log.info('workflow', 'Creating backup', { appId });
    
    // Use backup manager's executeBackup if available
    const backupName = `${appId}-${label}`;
@@ -477,11 +478,11 @@ class WorkflowEngine extends EventEmitter {
  async notify(message, channel) {
    const notification = this.ctx.notification;
    if (!notification) {
-      console.warn('[WorkflowEngine] Notification manager not available');
+      log.warn('workflow', 'Notification manager not available');
      return { notified: false, reason: 'no notification manager' };
    }
    
-    console.log(`[WorkflowEngine] Sending notification: ${message}`);
+    log.info('workflow', 'Sending notification', { message });
    notification.send('workflow', 'Workflow Notification', message, 'info');
    
    return { notified: true, message };
@@ -548,7 +549,7 @@ class WorkflowEngine extends EventEmitter {
      }
    }
    
-    console.log(`[WorkflowEngine] Workflow ${workflowId} ${enabled ? 'enabled' : 'disabled'}`);
+    log.info('workflow', 'Workflow toggled', { workflowId, enabled });
    return { workflowId, enabled };
  }

@@ -581,7 +582,7 @@ class WorkflowEngine extends EventEmitter {
            const conditionMet = this.evaluateCondition(workflow.condition, eventData);
            return conditionMet;
          } catch (e) {
-            console.warn(`[WorkflowEngine] Condition evaluation failed for ${id}:`, e.message);
+            log.warn('workflow', 'Condition evaluation failed', { workflowId: id, error: e.message });
            return false;
          }
        }
@@ -641,7 +642,7 @@ class WorkflowEngine extends EventEmitter {
    for (const [workflowId] of this.scheduledJobs) {
      this.stopScheduledWorkflow(workflowId);
    }
-    console.log('[WorkflowEngine] All scheduled workflows stopped');
+    log.info('workflow', 'All scheduled workflows stopped');
  }
 }

@@ -8,6 +8,7 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const platformPaths = require('../../platform-paths');
+const { log } = require('../utils/logging');

 // Encryption settings
 const ALGORITHM = 'aes-256-gcm';
@@ -65,7 +66,7 @@ function loadOrCreateKey() {
  // Check for key in environment variable first
  if (process.env.DASHCADDY_ENCRYPTION_KEY) {
    encryptionKey = Buffer.from(process.env.DASHCADDY_ENCRYPTION_KEY, 'hex');
-    console.log('[Crypto] Using encryption key from environment variable');
+    log.info('crypto', 'Using encryption key from environment variable');
    return encryptionKey;
  }

@@ -75,16 +76,16 @@ function loadOrCreateKey() {
      const keyData = fs.readFileSync(KEY_FILE, 'utf8').trim();
      if (keyData.length >= 64) {
        encryptionKey = Buffer.from(keyData, 'hex');
-        console.log('[Crypto] Loaded encryption key from file');
+        log.info('crypto', 'Loaded encryption key from file');
        // First-run bootstrap: if .bak doesn't exist yet, write the current
        // key to it. This ensures the silent recovery path is available from
        // the very next restart without requiring an explicit rotateKey().
        if (!fs.existsSync(KEY_FILE + '.bak')) {
          try {
            fs.writeFileSync(KEY_FILE + '.bak', keyData, { mode: 0o600 });
-            console.log(`[Crypto] Seeded ${KEY_FILE}.bak with current key for future fallback`);
+            log.info('crypto', 'Seeded .bak key file for future fallback');
          } catch (e) {
-            console.warn('[Crypto] Could not seed .bak key file:', e.message);
+            log.warn('crypto', 'Could not seed .bak key file', { error: e.message });
          }
        }
        // Try fallback to .bak key if primary can't decrypt existing credentials.
@@ -98,14 +99,14 @@ function loadOrCreateKey() {
              encryptionKey = tryFallbackToBackupKey(Buffer.from(keyData, 'hex'), Buffer.from(backupData, 'hex'));
            }
          } catch (e) {
-            console.warn('[Crypto] Could not check backup key:', e.message);
+            log.warn('crypto', 'Could not check backup key', { error: e.message });
          }
        }
        return encryptionKey;
      }
      // File exists but key is invalid/empty - will generate new one below
    } catch (error) {
-      console.error('[Crypto] Error loading key file:', error.message);
+      log.error('crypto', error, { operation: 'loadKey' });
    }
  }

@@ -115,10 +116,10 @@ function loadOrCreateKey() {
  try {
    // Save key to file with restricted permissions
    fs.writeFileSync(KEY_FILE, encryptionKey.toString('hex'), { mode: 0o600 });
-    console.log('[Crypto] Generated and saved new encryption key');
+    log.info('crypto', 'Generated and saved new encryption key');
  } catch (error) {
-    console.warn('[Crypto] Could not save key to file:', error.message);
-    console.warn('[Crypto] Key will be regenerated on restart - credentials will need to be re-entered');
+    log.warn('crypto', 'Could not save key to file', { error: error.message });
+    log.warn('crypto', 'Key will be regenerated on restart - credentials will need to be re-entered');
  }

  return encryptionKey;
@@ -171,12 +172,7 @@ function tryFallbackToBackupKey(primaryKey, backupKey) {

  if (tryDecrypt(primaryKey)) return primaryKey;
  if (tryDecrypt(backupKey)) {
-    console.warn(
-      '[Crypto] Primary encryption key failed to decrypt credentials; ' +
-      'fell back to .encryption-key.bak. The current primary key was set ' +
-      'without preserving the original. Consider rotating the key explicitly ' +
-      'via the credential-manager API to avoid this warning next restart.'
-    );
+    log.warn('crypto', 'Primary encryption key failed to decrypt credentials; fell back to .encryption-key.bak. Consider rotating the key explicitly via the credential-manager API.');
    return backupKey;
  }
  return primaryKey; // neither works — credential-manager.diagnose() will report 'unreadable'
@@ -291,7 +287,7 @@ function decryptFields(obj, fields = null) {
      try {
        result[field] = decrypt(result[field]);
      } catch (error) {
-        console.error(`[Crypto] Failed to decrypt field '${field}':`, error.message);
+        log.error('crypto', error, { field, operation: 'decryptField' });
        // Leave the field as-is if decryption fails
      }
    }
@@ -315,7 +311,7 @@ function migrateToEncrypted(credentials, sensitiveFields) {
    return credentials; // Already encrypted
  }

-  console.log('[Crypto] Migrating plaintext credentials to encrypted format');
+  log.info('crypto', 'Migrating plaintext credentials to encrypted format');
  return encryptFields(credentials, sensitiveFields);
 }

@@ -340,10 +336,10 @@ function readEncryptedFile(filePath, sensitiveFields = ['password', 'token', 'ap
    }

    // Plain text data - migrate it
-    console.log(`[Crypto] Found plaintext data in ${filePath}, will encrypt on next save`);
+    log.info('crypto', 'Found plaintext data', { filePath });
    return parsed;
  } catch (error) {
-    console.error(`[Crypto] Error reading ${filePath}:`, error.message);
+    log.error('crypto', error, { filePath, operation: 'readFile' });
    return null;
  }
 }
@@ -357,7 +353,7 @@ function readEncryptedFile(filePath, sensitiveFields = ['password', 'token', 'ap
 function writeEncryptedFile(filePath, credentials, sensitiveFields = ['password', 'token', 'apiKey', 'secret']) {
  const encrypted = encryptFields(credentials, sensitiveFields);
  fs.writeFileSync(filePath, JSON.stringify(encrypted, null, 2), 'utf8');
-  console.log(`[Crypto] Saved encrypted credentials to ${filePath}`);
+  log.info('crypto', 'Saved encrypted credentials', { filePath });
 }

 /**
@@ -377,7 +373,7 @@ function rotateKey() {
  try {
    fs.writeFileSync(KEY_FILE + '.bak', oldKey.toString('hex'), { mode: 0o600 });
  } catch (error) {
-    console.warn(`[Crypto] Could not save backup key to ${KEY_FILE}.bak:`, error.message);
+    log.warn('crypto', 'Could not save backup key', { error: error.message });
  }

  try {
@@ -9,6 +9,7 @@ const path = require('path');
 const https = require('https');
 const Docker = require('dockerode');
 const platformPaths = require('../../platform-paths');
+const { log } = require('../utils/logging');

 const docker = new Docker();

@@ -19,7 +20,7 @@ class DockerSecurity {
  constructor() {
    this.config = this.loadConfig();
    this.mode = VERIFICATION_MODE;
-    console.log(`[DockerSecurity] Initialized in ${this.mode} mode`);
+    log.info('security', 'Docker security initialized', { mode: this.mode });
  }

  /**
@@ -32,7 +33,7 @@ class DockerSecurity {
        return JSON.parse(data);
      }
    } catch (error) {
-      console.warn(`[DockerSecurity] Failed to load config: ${error.message}`);
+      log.warn('security', 'Failed to load config', { error: error.message });
    }

    // Default configuration
@@ -51,7 +52,7 @@ class DockerSecurity {
    try {
      fs.writeFileSync(SECURITY_CONFIG_FILE, JSON.stringify(this.config, null, 2));
    } catch (error) {
-      console.error(`[DockerSecurity] Failed to save config: ${error.message}`);
+      log.error('security', error, { operation: 'saveConfig' });
    }
  }

@@ -110,7 +111,7 @@ class DockerSecurity {
      repository = repository.split(':')[0];
    }

-    console.log(`[DockerSecurity] Fetching manifest for ${registry}/${repository}:${tag}`);
+    log.info('security', 'Fetching manifest', { registry, repository, tag });

    return new Promise((resolve, reject) => {
      const isDockerHub = registry === 'registry-1.docker.io';
@@ -216,7 +217,7 @@ class DockerSecurity {
        if (this.config.updateTrustedOnPull) {
          this.config.trustedDigests[imageName] = actualDigest;
          this.saveConfig();
-          console.log(`[DockerSecurity] Added trusted digest for ${imageName}`);
+          log.info('security', 'Added trusted digest', { imageName });
        }
      }
    } else if (actualDigest === trustedDigest) {
@@ -250,26 +251,26 @@ class DockerSecurity {
   * @returns {Promise<object>} Verification result
   */
  async verifyPulledImage(imageName) {
-    console.log(`[DockerSecurity] Verifying image: ${imageName}`);
+    log.info('security', 'Verifying image', { imageName });

    try {
      const actualDigest = await this.getImageDigest(imageName);
      const result = await this.verifyImageDigest(imageName, actualDigest);

      if (result.action === 'reject') {
-        console.error(`[DockerSecurity] REJECTED: ${result.reason}`);
+        log.error('security', 'Image REJECTED', { imageName, reason: result.reason });
        throw new Error(`Image verification failed: ${result.reason}`);
      } else if (result.action === 'warn') {
-        console.warn(`[DockerSecurity] WARNING: ${result.reason}`);
-        console.warn(`[DockerSecurity]   Expected: ${result.trustedDigest}`);
-        console.warn(`[DockerSecurity]   Actual:   ${result.actualDigest}`);
+        log.warn('security', 'Image WARNING', { imageName, reason: result.reason });
+        log.warn('security', 'Expected digest', { imageName, digest: result.trustedDigest });
+        log.warn('security', 'Actual digest', { imageName, digest: result.actualDigest });
      } else {
-        console.log(`[DockerSecurity] ACCEPTED: ${result.reason}`);
+        log.info('security', 'Image ACCEPTED', { imageName, reason: result.reason });
      }

      return result;
    } catch (error) {
-      console.error(`[DockerSecurity] Verification error: ${error.message}`);
+      log.error('security', error, { imageName, operation: 'verify' });

      if (this.mode === 'strict') {
        throw error;
@@ -294,7 +295,7 @@ class DockerSecurity {
  setTrustedDigest(imageName, digest) {
    this.config.trustedDigests[imageName] = digest;
    this.saveConfig();
-    console.log(`[DockerSecurity] Updated trusted digest for ${imageName}`);
+    log.info('security', 'Updated trusted digest', { imageName });
  }

  /**
@@ -304,7 +305,7 @@ class DockerSecurity {
  removeTrustedDigest(imageName) {
    delete this.config.trustedDigests[imageName];
    this.saveConfig();
-    console.log(`[DockerSecurity] Removed trusted digest for ${imageName}`);
+    log.info('security', 'Removed trusted digest', { imageName });
  }

  /**
@@ -325,7 +326,7 @@ class DockerSecurity {
    this.mode = mode;
    this.config.verificationMode = mode;
    this.saveConfig();
-    console.log(`[DockerSecurity] Verification mode set to: ${mode}`);
+    log.info('security', 'Verification mode set', { mode });
  }

  /**
@@ -37,6 +37,7 @@
 */

 const fs = require('fs');
+const { log } = require('../utils/logging');
 const path = require('path');
 const os = require('os');
 const platformPaths = require('../../platform-paths');
@@ -95,7 +96,7 @@ function createTail({ filePath, stateFile, onLine, label = 'tail', pollMs = 1000
        for (const line of lines) {
          if (line.trim()) {
            try { onLine(line); } catch (e) {
-              console.error(`[${label}] onLine threw:`, e.message);
+              log.error('events', e, { worker: label, phase: 'onLine' });
            }
          }
        }
@@ -106,7 +107,7 @@ function createTail({ filePath, stateFile, onLine, label = 'tail', pollMs = 1000
        setTimeout(tick, pollMs);
      });
      stream.on('error', (e) => {
-        console.error(`[${label}] read error:`, e.message);
+        log.error('events', e, { worker: label, phase: 'read' });
        setTimeout(tick, pollMs * 5);
      });
    });
@@ -267,11 +268,11 @@ function startFail2banWorker({ log } = {}) {
 function startAll({ log } = {}) {
  const workers = [];
  try { workers.push(startCaddyWorker({ log })); }
-  catch (e) { console.error('[workers] caddy worker failed to start:', e.message); }
+  catch (e) { log.error('events', e, { worker: 'caddy', phase: 'start' }); }
  try { workers.push(startSharedBansWorker({ log })); }
-  catch (e) { console.error('[workers] shared_bans worker failed to start:', e.message); }
+  catch (e) { log.error('events', e, { worker: 'shared_bans', phase: 'start' }); }
  try { workers.push(startFail2banWorker({ log })); }
-  catch (e) { console.error('[workers] fail2ban worker failed to start:', e.message); }
+  catch (e) { log.error('events', e, { worker: 'fail2ban', phase: 'start' }); }
  return {
    stop() { workers.forEach(w => { try { w.stop(); } catch {} }); },
    workers,
@@ -7,6 +7,7 @@
 const { execSync, execFileSync } = require('child_process');
 const os = require('os');
 const crypto = require('crypto');
+const { log } = require('../utils/logging');

 const SERVICE_NAME = 'DashCaddy';
 const ACCOUNT_PREFIX = 'dashcaddy';
@@ -44,7 +45,7 @@ class KeychainManager {
      }
      return false;
    } catch {
-      console.warn('[Keychain] OS keychain not available, will use encrypted file storage');
+      log.warn('keychain', 'OS keychain not available, will use encrypted file storage');
      return false;
    }
  }
@@ -72,7 +73,7 @@ class KeychainManager {
      }
      return false;
    } catch (error) {
-      console.error(`[Keychain] Failed to store ${key}:`, error.message);
+      log.error('keychain', error, { key, operation: 'store' });
      return false;
    }
  }
@@ -99,7 +100,7 @@ class KeychainManager {
      }
      return null;
    } catch (error) {
-      console.error(`[Keychain] Failed to retrieve ${key}:`, error.message);
+      log.error('keychain', error, { key, operation: 'retrieve' });
      return null;
    }
  }
@@ -126,7 +127,7 @@ class KeychainManager {
      }
      return false;
    } catch (error) {
-      console.error(`[Keychain] Failed to delete ${key}:`, error.message);
+      log.error('keychain', error, { key, operation: 'delete' });
      return false;
    }
  }
@@ -9,6 +9,7 @@ const { execSync } = require('child_process');
 const crypto = require('crypto');
 const EventEmitter = require('events');
 const platformPaths = require('../../platform-paths');
+const { log } = require('../utils/logging');

 // Format bytes to human readable string
 function formatBytes(bytes) {
@@ -38,7 +39,7 @@ class BackupManager extends EventEmitter {
  start() {
    if (this.running) return;
    
-    console.log('[BackupManager] Starting backup scheduler');
+    log.info('backup', 'Starting backup scheduler');
    this.running = true;
    
    // Schedule all configured backups
@@ -55,7 +56,7 @@ class BackupManager extends EventEmitter {
  stop() {
    if (!this.running) return;
    
-    console.log('[BackupManager] Stopping backup scheduler');
+    log.info('backup', 'Stopping backup scheduler');
    this.running = false;
    
    // Clear all scheduled jobs
@@ -91,7 +92,7 @@ class BackupManager extends EventEmitter {
        if (!isNaN(minutes) && minutes > 0) {
          intervalMs = minutes * 60 * 1000;
        } else {
-          console.error(`[BackupManager] Invalid schedule for ${name}: ${backup.schedule}`);
+          log.warn('backup', 'Invalid schedule', { name, schedule: backup.schedule });
          return;
        }
      }
@@ -100,17 +101,17 @@ class BackupManager extends EventEmitter {
    // Schedule the job
    const job = setInterval(() => {
      this.executeBackup(name, backup).catch(error => {
-        console.error(`[BackupManager] Scheduled backup ${name} failed:`, error.message);
+        log.error('backup', error, { name });
      });
    }, intervalMs);

    this.scheduledJobs.set(name, job);
-    console.log(`[BackupManager] Scheduled backup '${name}' every ${backup.schedule}`);
+    log.info('backup', 'Scheduled backup', { name, schedule: backup.schedule });

    // Run immediately if configured
    if (backup.runImmediately) {
      this.executeBackup(name, backup).catch(error => {
-        console.error(`[BackupManager] Initial backup ${name} failed:`, error.message);
+        log.error('backup', error, { name, phase: 'initial' });
      });
    }
  }
@@ -122,7 +123,7 @@ class BackupManager extends EventEmitter {
    const startTime = Date.now();
    const backupId = `${name}-${Date.now()}`;
    
-    console.log(`[BackupManager] Starting backup: ${name}`);
+    log.info('backup', 'Starting backup', { name });
    
    this.emit('backup-start', { name, backupId, timestamp: new Date().toISOString() });

@@ -151,7 +152,7 @@ class BackupManager extends EventEmitter {
          const location = await this.saveToDestination(finalData, dest, backupId);
          savedLocations.push(location);
        } catch (error) {
-          console.error(`[BackupManager] Failed to save to ${dest.type}:`, error.message);
+          log.error('backup', error, { destType: dest.type });
        }
      }

@@ -192,7 +193,7 @@ class BackupManager extends EventEmitter {
      }

      this.emit('backup-complete', historyEntry);
-      console.log(`[BackupManager] Backup ${name} completed in ${duration}ms`);
+      log.info('backup', 'Backup completed', { name, durationMs: duration });

      return historyEntry;
    } catch (error) {
@@ -263,7 +264,7 @@ class BackupManager extends EventEmitter {
        return JSON.parse(fs.readFileSync(servicesFile, 'utf8'));
      }
    } catch (error) {
-      console.error('[BackupManager] Error backing up services:', error.message);
+      log.error('backup', error, { source: 'services' });
    }
    return null;
  }
@@ -278,7 +279,7 @@ class BackupManager extends EventEmitter {
        return JSON.parse(fs.readFileSync(configFile, 'utf8'));
      }
    } catch (error) {
-      console.error('[BackupManager] Error backing up config:', error.message);
+      log.error('backup', error, { source: 'config' });
    }
    return null;
  }
@@ -291,7 +292,7 @@ class BackupManager extends EventEmitter {
      const credentialManager = require('../managers/credential-manager');
      return credentialManager.exportBackup();
    } catch (error) {
-      console.error('[BackupManager] Error backing up credentials:', error.message);
+      log.error('backup', error, { source: 'credentials' });
    }
    return null;
  }
@@ -304,7 +305,7 @@ class BackupManager extends EventEmitter {
      const resourceMonitor = require('../managers/resource-monitor');
      return resourceMonitor.exportStats();
    } catch (error) {
-      console.error('[BackupManager] Error backing up stats:', error.message);
+      log.error('backup', error, { source: 'stats' });
    }
    return null;
  }
@@ -374,7 +375,7 @@ class BackupManager extends EventEmitter {
            });
          }
        } catch (volumeError) {
-          console.error(`[BackupManager] Error backing up volume ${volume.Name}:`, volumeError.message);
+          log.error('backup', volumeError, { volume: volume.Name });
          backupResults.push({
            name: volume.Name,
            status: 'failed',
@@ -390,7 +391,7 @@ class BackupManager extends EventEmitter {
        volumes: backupResults
      };
    } catch (error) {
-      console.error('[BackupManager] Error backing up volumes:', error.message);
+      log.error('backup', error, { source: 'volumes' });
      return null;
    }
  }
@@ -461,9 +462,9 @@ class BackupManager extends EventEmitter {
          timestamp: new Date().toISOString()
        });

-        console.log(`[BackupManager] Volume ${volumeName} restored successfully`);
+        log.info('backup', 'Volume restored', { volume: volumeName });
      } catch (restoreError) {
-        console.error(`[BackupManager] Error restoring volume ${volBackup.name}:`, restoreError.message);
+        log.error('backup', restoreError, { volume: volBackup.name });
        restoreResults.push({
          name: volBackup.name,
          status: 'failed',
@@ -849,7 +850,7 @@ class BackupManager extends EventEmitter {
        throw new Error('Backup verification failed: checksum mismatch');
      }
      
-      console.log('[BackupManager] Backup verified successfully');
+      log.info('backup', 'Backup verified successfully');
      return true;
    }
    
@@ -860,7 +861,7 @@ class BackupManager extends EventEmitter {
   * Restore from backup
   */
  async restoreBackup(backupId, options = {}) {
-    console.log(`[BackupManager] Starting restore from backup: ${backupId}`);
+    log.info('backup', 'Starting restore', { backupId });
    
    this.emit('restore-start', { backupId, timestamp: new Date().toISOString() });

@@ -922,7 +923,7 @@ class BackupManager extends EventEmitter {
        timestamp: new Date().toISOString() 
      });

-      console.log('[BackupManager] Restore completed successfully');
+      log.info('backup', 'Restore completed successfully');
      return { success: true, restored };
    } catch (error) {
      this.emit('restore-failed', { 
@@ -940,7 +941,7 @@ class BackupManager extends EventEmitter {
  restoreServices(services) {
    const servicesFile = platformPaths.servicesFile;
    fs.writeFileSync(servicesFile, JSON.stringify(services, null, 2));
-    console.log('[BackupManager] Services restored');
+    log.info('backup', 'Services restored');
  }

  /**
@@ -949,7 +950,7 @@ class BackupManager extends EventEmitter {
  restoreConfig(config) {
    const configFile = platformPaths.configFile;
    fs.writeFileSync(configFile, JSON.stringify(config, null, 2));
-    console.log('[BackupManager] Config restored');
+    log.info('backup', 'Config restored');
  }

  /**
@@ -958,7 +959,7 @@ class BackupManager extends EventEmitter {
  restoreCredentials(credentials) {
    const credentialManager = require('../managers/credential-manager');
    credentialManager.importBackup(credentials);
-    console.log('[BackupManager] Credentials restored');
+    log.info('backup', 'Credentials restored');
  }

  /**
@@ -967,7 +968,7 @@ class BackupManager extends EventEmitter {
  restoreStats(stats) {
    const resourceMonitor = require('../managers/resource-monitor');
    resourceMonitor.importStats(stats);
-    console.log('[BackupManager] Stats restored');
+    log.info('backup', 'Stats restored');
  }

  /**
@@ -975,7 +976,7 @@ class BackupManager extends EventEmitter {
   */
  async enforceStorageLimit(name, maxBytes) {
    const maxStr = formatBytes(maxBytes);
-    console.log("[BackupManager] Enforcing storage limit: " + maxStr + " for \"" + name + "\"");
+    log.info('backup', 'Enforcing storage limit', { name, limit: maxStr });

    const backups = this.history
      .filter(b => b.name === name && b.status === 'success')
@@ -994,10 +995,10 @@ class BackupManager extends EventEmitter {
      }
    }

-    console.log("[BackupManager] Current total size: " + formatBytes(totalSize) + ", limit: " + maxStr);
+    log.info('backup', 'Current storage usage', { totalSize: formatBytes(totalSize), limit: maxStr });

    if (totalSize <= maxBytes) {
-      console.log("[BackupManager] Storage limit OK (" + formatBytes(totalSize) + " <= " + maxStr + ")");
+      log.info('backup', 'Storage limit OK', { totalSize: formatBytes(totalSize), limit: maxStr });
      return;
    }

@@ -1013,10 +1014,10 @@ class BackupManager extends EventEmitter {
            const sz = backup.size || 0;
            totalSize -= sz;
            freed += sz;
-            console.log("[BackupManager] Deleted " + formatBytes(sz) + ": " + path);
+            log.info('backup', 'Deleted old backup file', { size: formatBytes(sz), path });
          }
        } catch (error) {
-          console.error("[BackupManager] Error deleting " + path + ": " + error.message);
+          log.error('backup', error, { path });
        }
      }

@@ -1024,7 +1025,7 @@ class BackupManager extends EventEmitter {
    }

    this.saveHistory();
-    console.log("[BackupManager] Storage limit enforced. Freed " + formatBytes(freed) + ", now " + formatBytes(totalSize));
+    log.info('backup', 'Storage limit enforced', { freed: formatBytes(freed), totalSize: formatBytes(totalSize) });
  }

  /**
@@ -1051,9 +1052,9 @@ class BackupManager extends EventEmitter {
        // Remove from history
        this.history = this.history.filter(b => b.id !== backup.id);
        
-        console.log(`[BackupManager] Deleted old backup: ${backup.id}`);
+        log.info('backup', 'Deleted old backup', { backupId: backup.id });
      } catch (error) {
-        console.error(`[BackupManager] Error deleting backup ${backup.id}:`, error.message);
+        log.error('backup', error, { backupId: backup.id });
      }
    }

@@ -1109,7 +1110,7 @@ class BackupManager extends EventEmitter {
        return JSON.parse(fs.readFileSync(BACKUP_CONFIG_FILE, 'utf8'));
      }
    } catch (error) {
-      console.error('[BackupManager] Error loading config:', error.message);
+      log.error('backup', error, { operation: 'loadConfig' });
    }
    
    return {
@@ -1125,7 +1126,7 @@ class BackupManager extends EventEmitter {
    try {
      fs.writeFileSync(BACKUP_CONFIG_FILE, JSON.stringify(this.config, null, 2));
    } catch (error) {
-      console.error('[BackupManager] Error saving config:', error.message);
+      log.error('backup', error, { operation: 'saveConfig' });
    }
  }

@@ -1138,7 +1139,7 @@ class BackupManager extends EventEmitter {
        return JSON.parse(fs.readFileSync(BACKUP_HISTORY_FILE, 'utf8'));
      }
    } catch (error) {
-      console.error('[BackupManager] Error loading history:', error.message);
+      log.error('backup', error, { operation: 'loadHistory' });
    }
    return [];
  }
@@ -1150,7 +1151,7 @@ class BackupManager extends EventEmitter {
    try {
      fs.writeFileSync(BACKUP_HISTORY_FILE, JSON.stringify(this.history, null, 2));
    } catch (error) {
-      console.error('[BackupManager] Error saving history:', error.message);
+      log.error('backup', error, { operation: 'saveHistory' });
    }
  }
 }
Author	SHA1	Message	Date
Hermes	bf1bcb1133	P1-3 through P1-8: mark done in production-grade backlog CI / Security audit (push) Has been cancelled Details CI / Test & Lint (push) Has been cancelled Details	2026-08-10 20:24:22 -07:00
Hermes	7b04bc1d3c	[grade=A] P1-8: replace 66 console.* calls across 6 remaining files with structured logger Files changed: - src/security/crypto-utils.js: 16 calls → log tagged 'crypto' - src/security/docker-security.js: 15 calls → log tagged 'security' - src/managers/port-lock-manager.js: 16 calls → log tagged 'portlock' - src/docker/self-updater.js: 10 calls → log tagged 'updater' - src/security/event-workers.js: 5 calls → log tagged 'events' - src/security/keychain-manager.js: 4 calls → log tagged 'keychain' Fixed 2 bugs found during sweep: - self-updater.js:161 — arrow expression body had trailing semicolon (SyntaxError) - port-lock-manager.js:137 — log.error referenced 'port' var out of scope (ReferenceError) 1539/1539 Jest tests pass. All ESLint warnings pre-existing (0 new).	2026-08-10 20:23:58 -07:00
Hermes	191d3340a7	[grade=A] P1-7: replace 18 console.* calls in bundled-workflows.js with structured logger Replaced all 18 console calls in src/recipes/bundled-workflows.js with log.info/warn/error tagged 'workflow'. Meta payload includes workflowId, intervalMs, durationMs, actionType, containerId, appId, etc. 1539/1539 Jest tests pass. ESLint clean (0 new warnings).	2026-08-10 20:16:45 -07:00
Hermes	84f63a3261	[grade=A] P1-5, P1-6: replace 40 console.* calls in credential-manager.js + auth-manager.js credential-manager.js: 20 console calls → log.info/warn/error tagged 'cred'. auth-manager.js: 20 console calls → log.info/error tagged 'auth'. Mixed-content strings extracted into meta payload (key, keyId, operation, etc). 1539/1539 Jest tests pass. ESLint: 4 pre-existing warnings unchanged.	2026-08-10 20:15:15 -07:00
Hermes	f2c6fa69f5	[grade=A] P1-4: replace 32 console.* calls in resource-monitor.js with structured logger Replaced all 32 console.log/warn/error calls in src/managers/resource-monitor.js with log.info/log.warn/log.error from src/utils/logging. Tagged every call as 'monitor' for consistent grep-ability. Mixed-content strings (container, alerts, count, rollup, phase, etc.) extracted into meta payload for queryability. 1539/1539 Jest tests pass. ESLint: 2 pre-existing warnings unchanged.	2026-08-10 20:12:22 -07:00
Hermes	c55abdab87	[grade=A] P1-3: replace 36 console.* calls in backup-manager.js with structured logger Replaced all 36 console.log/warn/error calls in src/utilities/backup-manager.js with log.info/log.warn/log.error from src/utils/logging. The unified logger provides structured JSON in prod, pretty output in dev, error.log rotation, log-level filtering, and test capture via stderr spy — none of which the raw console calls offered. Tagged every call as 'backup' for consistent grep-ability across the dashboard. Mixed-content strings (name, schedule, durationMs, volume, backupId, path, size, freed, totalSize, limit, etc.) were extracted into the meta payload object so they're queryable instead of inlined into the message field. 1539/1539 Jest tests pass. ESLint clean for the file (10 pre-existing warnings unchanged, zero new).	2026-08-10 20:10:08 -07:00