Summary

• Problem: src/node-host/runner.ts and src/infra/tailscale.ts use raw console.log/console.error calls that bypass structured logging, leak PATH env info, and can't be filtered by log level
• Why it matters: Raw console output in production code bypasses log level controls and may expose sensitive environment details (full PATH variable)
• What changed: Migrated remaining console calls to createSubsystemLogger() in node-host runner and tailscale modules, continuing the migration started in PRs refactor(logging): migrate non-agent internal console calls to subsystem logger #22964 and refactor(agents): migrate console.warn/error/info to subsystem logger #22906
• What did NOT change: User-facing CLI output via runtime.error() calls is preserved unchanged

Change Type

• Refactor

Scope

• Gateway / orchestration

Security Impact

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No

Risks and Mitigations

• Risk: Some debug output may no longer appear at default log level
  • Mitigation: This is intentional — PATH info should be behind verbose/debug level

🤖 Generated with Claude Code

Greptile Summary

Migrates the last remaining raw console.log/console.error calls in src/node-host/runner.ts and src/infra/tailscale.ts to the structured createSubsystemLogger() system, continuing the pattern established in PRs #22964 and #22906.

• src/node-host/runner.ts: Three console.log/console.error calls (with eslint-disable comments) replaced with log.info() and log.warn() calls via a "node-host" subsystem logger. PATH info is now structured metadata instead of a raw string, and connection error/close messages use warn level.
• src/infra/tailscale.ts: One console.log replaced with log.info() via a "tailscale" subsystem logger. Four console.error calls in the error path of ensureFunnel correctly migrated to runtime.error() (user-facing CLI output), preserving the existing runtime parameter available in that function's signature.
• Both files now have zero raw console calls, and all new patterns are consistent with the established subsystem logger usage across the codebase.

Confidence Score: 5/5

• This PR is safe to merge — it's a straightforward mechanical refactor with no behavioral changes to user-facing output.
• Score of 5 reflects: (1) minimal, mechanical changes replacing raw console calls with established subsystem logger patterns, (2) consistent with existing codebase conventions, (3) user-facing CLI output via runtime.error() is preserved unchanged, (4) no remaining raw console calls in either file, (5) existing tests for ensureFunnel use mocked runtime objects that will work correctly with the new runtime.error() calls.
• No files require special attention.

_{Last reviewed commit: 7b16206}

_{(5/5) You can turn off certain types of comments like style here!}