@bigstrider/transcodes-cli 0.1.0 → 0.3.0

package/README.md

@@ -7,12 +7,12 @@ The plugins and their hooks authenticate to the Transcodes backend with a member
 ## Install
 
 ```bash
-# no install needed
-npx @bigstrider/transcodes-cli login <token>
+# no install needed — opens the dashboard
+npx @bigstrider/transcodes-cli
 
 # or global
 npm install -g @bigstrider/transcodes-cli
-transcodes login <token>
+transcodes
 ```
 
 Works the same on macOS, Linux, and Windows (Node ≥ 20).
@@ -21,10 +21,25 @@ Works the same on macOS, Linux, and Windows (Node ≥ 20).
 
 | Command | What it does |
 |---------|--------------|
-| `transcodes login <token>` | Validates the JWT and saves it to `~/.transcodes/config.json` (dir `0700`, file `0600`). |
-| `transcodes logout` | Deletes the saved token. |
+| `transcodes` | Opens the dashboard at `http://127.0.0.1:3847/` to paste, save, switch, label, or delete tokens (accepts `--port N` / `--no-open`). |
+| `transcodes set <token> -l <label>` | Validates the JWT and saves it (label required) to `~/.transcodes/config.json` (dir `0700`, file `0600`), making it active. |
+| `transcodes tokens` | Lists all saved tokens; the active one is marked with `*`. |
 | `transcodes status` | Shows the active token source (env vs file) and its expiry. |
-| `transcodes help` | Usage. |
+| `transcodes reset` | Deletes all saved tokens. |
+| `transcodes help` | Shows the full command list and usage. |
+
+### Dashboard
+
+```bash
+npx @bigstrider/transcodes-cli
+```
+
+Starts a small localhost server (127.0.0.1 only), opens your browser, and lets you save, switch, rename, or delete tokens without pasting them on the command line. Multiple tokens are kept in `~/.transcodes/config.json` under `token_list`, each with a label; the active one is stored as `token`.
+
+Options:
+
+- `--port N` — bind to a specific port (default `3847`; increments if busy)
+- `--no-open` — do not open the browser automatically
 
 ## Token precedence
 

package/dist/index.js

@@ -1,5 +1,12 @@
 #!/usr/bin/env node
 
+// src/dashboard.ts
+import {
+  createServer
+} from "http";
+import { spawn } from "child_process";
+import { createHash } from "crypto";
+
 // ../stepup-core/dist/jwt.js
 var REQUIRED_AUDIENCE = "transcodes-mcp";
 function isPlainObject(v) {
@@ -106,7 +113,7 @@ function transcodesConfigDir() {
 function transcodesConfigFile() {
   return path.join(transcodesConfigDir(), CONFIG_FILE_NAME);
 }
-function readTokenFromFile() {
+function readRawConfig() {
   let raw;
   try {
     raw = readFileSync(transcodesConfigFile(), "utf8");
@@ -122,29 +129,148 @@ function readTokenFromFile() {
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     return null;
   }
-  const token = parsed.token;
-  if (typeof token !== "string")
+  return parsed;
+}
+function writeRawConfig(config) {
+  const dir = transcodesConfigDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeFileSync(transcodesConfigFile(), JSON.stringify(config), {
+    mode: 384
+  });
+}
+function normalizeToken(v) {
+  if (typeof v !== "string")
     return null;
-  const trimmed = token.trim();
+  const trimmed = v.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function normalizeLabel(v) {
+  if (typeof v !== "string")
+    return null;
+  const trimmed = v.trim();
   return trimmed.length > 0 ? trimmed : null;
 }
-function writeTokenToFile(token) {
+function normalizeRecord(item) {
+  if (typeof item === "string") {
+    const token = normalizeToken(item);
+    return token ? { token, label: null } : null;
+  }
+  if (item && typeof item === "object" && !Array.isArray(item)) {
+    const obj = item;
+    const token = normalizeToken(obj.token);
+    if (!token)
+      return null;
+    return { token, label: normalizeLabel(obj.label) };
+  }
+  return null;
+}
+function readConfig() {
+  const obj = readRawConfig();
+  if (!obj) {
+    return { token: null, tokenList: [] };
+  }
+  const list = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (rec) => {
+    if (!rec)
+      return;
+    const existing = list.find((r) => r.token === rec.token);
+    if (existing) {
+      if (!existing.label && rec.label)
+        existing.label = rec.label;
+      return;
+    }
+    seen.add(rec.token);
+    list.push(rec);
+  };
+  if (Array.isArray(obj.token_list)) {
+    for (const item of obj.token_list)
+      push(normalizeRecord(item));
+  }
+  const active = normalizeToken(obj.token);
+  if (active)
+    push({ token: active, label: null });
+  return {
+    token: active ?? (list.length > 0 ? list[0].token : null),
+    tokenList: list
+  };
+}
+function writeConfig(config) {
+  const token_list = config.tokenList.map((r) => r.label ? { token: r.token, label: r.label } : { token: r.token });
+  writeRawConfig({
+    ...readRawConfig() ?? {},
+    token: config.token,
+    token_list
+  });
+}
+function readTokenFromFile() {
+  return readConfig().token;
+}
+function readTokenList() {
+  return readConfig().tokenList.map((r) => r.token);
+}
+function readTokenRecords() {
+  return readConfig().tokenList;
+}
+function writeTokenToFile(token, label) {
   const trimmed = token.trim();
   if (!trimmed) {
     throw new Error("token is empty");
   }
-  const dir = transcodesConfigDir();
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  writeFileSync(transcodesConfigFile(), JSON.stringify({ token: trimmed }), {
-    mode: 384
-  });
+  const nextLabel = normalizeLabel(label);
+  const current = readConfig();
+  const existing = current.tokenList.find((r) => r.token === trimmed);
+  if (!existing && !nextLabel) {
+    throw new Error("label is required");
+  }
+  const tokenList = existing ? current.tokenList.map((r) => r.token === trimmed ? { token: trimmed, label: nextLabel ?? r.label } : r) : [...current.tokenList, { token: trimmed, label: nextLabel }];
+  writeConfig({ token: trimmed, tokenList });
+}
+function setActiveToken(token) {
+  writeTokenToFile(token);
+}
+function setTokenLabel(token, label) {
+  const trimmed = token.trim();
+  const nextLabel = normalizeLabel(label);
+  if (!nextLabel) {
+    throw new Error("label is required");
+  }
+  const current = readConfig();
+  if (!current.tokenList.some((r) => r.token === trimmed)) {
+    throw new Error("token not found");
+  }
+  const tokenList = current.tokenList.map((r) => r.token === trimmed ? { token: r.token, label: nextLabel } : r);
+  writeConfig({ token: current.token, tokenList });
+}
+function removeTokenFromFile(token) {
+  const trimmed = token.trim();
+  const current = readConfig();
+  const tokenList = current.tokenList.filter((r) => r.token !== trimmed);
+  if (tokenList.length === 0) {
+    clearTokenFile();
+    return;
+  }
+  const active = current.token && tokenList.some((r) => r.token === current.token) ? current.token : tokenList[0].token;
+  writeConfig({ token: active, tokenList });
 }
 function clearTokenFile() {
+  const existing = readRawConfig();
   try {
+    if (existing && existing.enabled !== void 0) {
+      const { token: _token, token_list: _list, ...rest } = existing;
+      writeRawConfig(rest);
+      return;
+    }
     rmSync(transcodesConfigFile(), { force: true });
   } catch {
   }
 }
+function isTrackerEnabled() {
+  return readRawConfig()?.enabled !== false;
+}
+function setTrackerEnabled(enabled) {
+  writeRawConfig({ ...readRawConfig() ?? {}, enabled });
+}
 function resolveToken() {
   const envToken = process.env.TRANSCODES_TOKEN?.trim();
   if (envToken) {
@@ -157,18 +283,951 @@ function resolveToken() {
   return { token: null, source: "none" };
 }
 
+// src/logo.ts
+var LOGO_DATA_URI = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAQAElEQVR4AezdTXrbxrYFUH53Pu7ZE0ovGVDcy4SSngf0XnZk2JJMkQSBAqrqrPtdWOIPquqsAxNbIK387//8jwABAgQIECgn8L+L/xEgQIAAAQLFBC4XAaBcyxVMgAABAgQEAMcAAQIECBAoJ5CCXQGIgo0AAQIECBQTEACKNVy5BAgQIFBd4KV+AeDFwZ8ECBAgQKCUgABQqt2KJUCAAIHqAkv9AsAi4SsBAgQIECgkIAAUarZSCRAgQKC6wM/6BYCfFr4jQIAAAQJlBASAMq1WKAECBAhUF3hdvwDwWsP3BAgQIECgiIAAUKTRyiRAgACB6gJv6xcA3nq4RYAAAQIESggIACXarEgCBAgQqC7wvn4B4L2I2wQIECBAoICAAFCgyUokQIAAgeoCv9YvAPxq4h4CBAgQIDC9gAAwfYsVSIAAAQLVBa7VLwBcU3EfAQIECBCYXEAAmLzByiNAgACB6gLX6xcArru4lwABAgQITC0gAEzdXsURIECAQHWBj+oXAD6ScT8BAgQIEJhYQACYuLlKI0CAAIHqAh/XLwB8bOMRAgQIECAwrYAAMG1rFUaAAAEC1QVu1S8A3NLxGAECBAgQmFRAAJi0scoiQIAAgeoCt+sXAG77eJQAAQIECEwpIABM2VZFESBAgEB1gXv1CwD3hDxOgAABAgQmFBAAJmyqkggQIECgusD9+gWA+0aeQYAAAQIEphMQAKZrqYIIECBAoLrAI/ULAI8oeQ4BAgQIEJhMQACYrKHKIUCAAIHqAo/VLwA85uRZBAgQIEBgKgEBYKp2KoYAAQIEqgs8Wr8A8KiU5xEgQIAAgYkEBICJmqkUAgQIEKgu8Hj9AsDjVp5JgAABAgSmERAApmmlQggQIECgusCa+gWANVqeS4AAAQIEJhEQACZppDIIECBAoLrAuvoFgHVenk2AAAECBKYQEACmaKMiCBAgQKC6wNr6BYC1Yp5PgAABAgQmEBAAJmiiEggQIECgusD6+gWA9Wb2IECAAAECwwsIAMO3UAEECBAgUF3gmfoFgGfU7EOAAAECBAYXEAAGb6DlEyBAgEB1gefqFwCec7MXAQIECBAYWkAAGLp9Fk+AAAEC1QWerV8AeFbOfgQIECBAYGABAWDg5lk6AQIECFQXeL5+AeB5O3sSIECAAIFhBQSAYVtn4QQIECBQXWBL/QLAFj37EiBAgACBQQUEgEEbZ9kECBAgUF1gW/0CwDY/exMgQIAAgSEFBIAh22bRBAgQIFBdYGv9AsBWQfsTIECAAIEBBQSAAZtmyQQIECBQXWB7/QLAdkMjECBAgACB4QQEgOFaZsEECBAgUF1gj/oFgD0UjUGAAAECBAYTEAAGa5jlEiBAgEB1gX3qFwD2cTQKAQIECBAYSkAAGKpdFkuAAAEC1QX2ql8A2EvSOAQIECBAYCABAWCgZlkqAQIECFQX2K9+AWA/SyMRIECAAIFhBASAYVploQQIECBQXWDP+gWAPTWNRYAAAQIEBhEQAAZplGUSIECAQHWBfesXAPb1NBoBAgQIEBhCQAAYok0WSYAAAQLVBfauXwDYW9R4BAgQIEBgAAEBYIAmWSIBAgQIVBfYv34BYH9TIxIgQIAAge4FBIDuW2SBBAgQIFBdoEX9AkALVWMSIECAAIHOBQSAzhtkeQQIECBQXaBN/QJAG1ejEiBAgACBrgUEgK7bY3EECBAgUF2gVf0CQCtZ4xIgQIAAgY4FBICOm2NpBAgQIFBdoF39AkA7WyMTIECAAIFuBQSAbltjYQQIECBQXaBl/QJAS11jEyBAgACBTgUEgE4bY1kECBAgUF2gbf0CQFtfoxMgQIAAgS4FBIAu22JRBAgQIFBdoHX9AkBrYeMTIECAAIEOBQSADptiSQQIECBQXaB9/QJAe2MzECBAgACB7gQEgO5aYkEECBAgUF3giPoFgCOUzUGAAAECBDoTEAA6a4jlECBAgEB1gWPqFwCOcTYLAQIECBDoSkAA6KodFkOAAAEC1QWOql8AOEraPAQIECBAoCMBAaCjZlgKAQIECFQXOK5+AeA4azMRIECAAIFuBASAblphIQQIECBQXeDI+gWAI7XNRYAAAQIEOhEQADpphGUQIECAQHWBY+sXAI71NhsBAgQIEOhCQADoog0WQYAAAQLVBY6uXwA4Wtx8BAgQIECgAwEBoIMmWAIBAgQIVBc4vn4B4HhzMxIgQIAAgdMFBIDTW2ABBAgQIFBd4Iz6BYAz1M1JgAABAgROFhAATm6A6QkQIECgusA59QsA57iblQABAgQInCogAJzKb3ICBAgQqC5wVv0CwFny5iVAgAABAicKCAAn4puaAAECBKoLnFe/AHCevZkJECBAgMBpAgLAafQmJkCAAIHqAmfWLwCcqW9uAgQIECBwkoAAcBK8aQkQIECgusC59QsA5/qbnQABAgQInCIgAJzCvs+kf//998XGYOsxsM/RuM8ot2rZZwajEOhH4OyVCABnd2DF/Hlx/O233y6fPn36b8v3tt8uDLYZ5Hj6888/L9lWHI6bn5rjOVvmTQ+zjnz9aMvjr7c8L/suW8bavCgDECgkIAAM1Oy84HmRG6hhAy3169evl2ytj6+crHMc50Ser9menTdrzb7LlrGWcTNPtoFaYKnlBM4vWAA4vwcPrcCL2UNMnrRRICfTjUPc3T0n7rtP2vCEjJ86sr0OBLl/w7B2JTCdgAAwSEv/+eefQVZqmSMLzHiSTE0JA8sVgoTpbCP3ydrHF+ihAgGghy5YAwEChwkkDGTL1YEEgWyHTW4iAh0JCAAdNePWUvJTzK3HPUZgL4FKx1qCQLYlDOxlaBwCtwX6eFQA6KMPVkGAwMkCr4OAqwInN8P0hwgIAIcwm4QAgVEEEgSyuSowSsfGW2cvKxYAeumEdRAg0J2AINBdSyxoRwEBYEdMQxEgMKeAIDBnX8+pqp9ZBYB+emElBAh0LiAIdN4gy1slIACs4vJkAgQIXP77rYk+I+BIeEagp30EgJ66YS0ECAwl4IrAUO2y2HcCAsA7EDcJECCwViBBIP90sNLvUFhr5PkR6GsTAPrqh9UQIDCoQEJAft1wgsCgJVh2MQEBoFjDlUuAQFuBBAGfD2hrPOrova1bAOitI9ZDgMAUAgkCrgZM0cppixAApm2twggQOFsgIcDVgLO70Mv8/a1DAOivJ1ZEgMBkAgkCrgZM1tQJyhEAJmiiEggQ6F8gIcDVgP771GqFPY4rAPTYFWsiQGBagQQBVwOmbe9QhQkAg7Try5cvg6zUMgkQuCeQEJB/Muj3BtyTmuXxPusQAPrsi1URIDC5QE7+CQGuBkze6I7LEwA6bo6lESAwv0CuBggBc/e51+oEgF47Y10ECJQRSAjI1YBcFShTtEJPFxAATm+BBRAgQOByyck/IcDVgNmOhn7rEQD67Y2VESBQUCBXA4SAgo0/oWQB4AR0UxIgQOCWQEJArgbceo7HxhDoeZUCQM/dsTYCBMoKLG8JlAVQeHMBAaA5sQkIECDwnEBCQH57YL4+N4K9zhXoe3YBoO/+WB0BAgQueTvA5wIcCHsLCAB7ixqPAAECDQTyuQAhoAFswyF7H1oA6L1D1keAAIHvAkLAdwhfdhEQAHZhNAiBeQS839x3L4WAvvvzc3X9fycA9N8jKyRAgMAbgYSAfC7gzZ1uEFgpIACsBPN0AgQI9CCQKzVCQA+duL6GEe4VAEbokjUSIEDgioAQcAXFXQ8LCAAPU3kiAQIE+hMQAvrryeUyxpoEgDH6ZJUECBD4UEAI+JDGAzcEBIAbOB4iQIDAKAJCQD+dGmUlAsAonbJOAgQI3BEQAu4AefiNgADwhsMNAgQIjC0gBJzdv3HmFwDG6ZWVEiBA4CEBIeAhpvJPEgDKHwIACBCYUSAhwH874PjOjjSjADBSt6yVAAECKwTyGwOFgBVgxZ4qABRruHIJEKglIAQc2e+x5hIAxuqX1RIgQGC1QEJA3hJYvaMdphYQAKZur+IIECDwIpD/boAQ8GLR6s/RxhUARuuY9RIgQOBJgVwJeHJXu00oIABM2FQlESBA4JpArgDkSsC1x9y3VWC8/QWA8XpmxQQIEHhaICHAvwx4mm+qHQWAqdqpGAIECNwXyFsBQsB9pzXPGPG5AsAgXfv8+fMgK7VMAgRGEEgIyNWAEdZqjW0EBIA2rruP+uXLl93HNCABArUFEgJqC+xV/ZjjCACD9C0BINsgy7VMAgQGEMgVAG8FDNCoRksUABrBthj2r7/+uvz+++8XQaCFrjGPEMixm+2IuczxmECuAggBj1l99KxR7xcABuvcH3/8cUkQ+Pbt22WEbTDezcvNyS39yTZCf66tMcfYZogPBlh8Mm+MEmiz5f4PdnH3AQIJAbkacMBUpuhIQADoqBmWMrbAclLLySzb2NW0X32MEjayJQzEL1sCQbY83n4VZlgEEgKW731dIzDucwWAcXtn5R0J5ITV0XKGXkoCQbYlFMQ229BFDbD4XAHwVsAAjdpxiQLAjpiGqimQn1RzwqpZffuqY5vt9dWB9rPWnCFXARIEalb/XNUj7yUAjNw9aydQTCBBIFvCQK4QuDKw/wHgVwXvb9rriAJAr52xrmEE/JKmc1q1XHlJGEgQyO1zVjLfrN4KeLSnYz9PABi7f1ZPgMC/ArkqkCsC2RIG/r3L/zcIeCtgA95AuwoAAzXLUgkQuC2QqwAJA8tVgdvP9ugtgYSAW4977HIZ3UAAGL2D1k+AwFUBQeAqy8N35sOA2R7ewROHExAAhmuZBRMgsEZAEFij9fa5PhD41uPtrfFvCQDj91AFBAg8ICAIPIB05Sk+EHgFZZK7BIBJGqkMAgQeE0gQyAcF83mBx/ao/ax8FsBbAb8eAzPcIwDM0EU1ECCwSiAhwL8YeJwsIeDxZ3vmKAICwCidsk4CBHYXWILA7gNPNmCuAGSbrKwN5cyxqwAwRx9VQYDAkwJ5K8A/G7yP5wOB941Ge4YAMFrHrJcAgSYCuRqQzwY0GXySQV0FeGnkLH8KALN0Uh0ECGwWSAjIZwNyVWDzYBMO4LMAczVVAJirn6ohQGCjQE7+CQGuBvwKmSsA2X59pNI989QqAMzTS5UQILCjQK4GCAG/groK8KvJqPcIAKN2zroJEGguIAT8SpwrANl+faTGPTNVKQDM1E21ECCwu4AQ8CupqwC/mox4jwAwYtesmQCBQwWEgLfcuQKQ7e29FW7NVaMAMFc/VUOAQCMBIeAtrKsAbz1GvCUAjNg1ayZA4BQBIeAne64AZPt5z/zfzVahADBbR9VDgEBTASHgJ6+rAD8tRvxOABixa9ZMgMCpAkLAqfwnTT7ftALAfD1VEQECBwgkBOSXBh0wVbdT5C2AbN0u0MJuCggAN3k8SIAAgY8F/KKgy6XK2wAfHwXjPiIAjNs7KydA4GSBXAHIrw0+eRmnTu8KwKn8myYXADbx2ZkAgeoC4ZspHAAAEABJREFUCQHVrwTMHwLmPMoFgDn7qioCBA4UqP55AG8DHHiw7TiVALAjpqEIEKgrkLcCcjWgosDsVwBm7akAMGtn1UWAwOECld8KEAIOP9w2TygAbCY0AAECBF4EcgUg28utWn/O+zbAvH0UAObtrcoIEDhBIG8FnDCtKQmsFhAAVpPZgQABArcFKr4VMOtbALc7PfajAsDY/bP6DgSqXvLtgL7bJVT9VwFCQLeH5NWFCQBXWdxJgACBbQIVrwJsE+tx77nXJADM3V/VESBwkkCuDFULAT4IeNLB9uS0AsCTcHYjQIDAPYG8FXDvOR7vV2D2lQkAs3dYfQQInCpQ6V8F+AzAqYfa6skFgNVkdiBAgMDjAtXeCpgnBDze41GfKQCM2jnrJkBgGIG8FZArAdU+EzBMg4ouVAAo2nhlEyBwrECuBLwOArl97ArazpZ6srWd5bjRK8wkAFToshoJEOhGICfJJQh8+/bt8tGWKwbPbLnKsHVbM++y/mWf1NcNtoXcFBAAbvJ4kAABAucI5ET6zJZwsXVbM+85Oq1nrTG+AFCjz6okQIAAAQJvBASANxxuECBAgEB1gSr1CwBVOq1OAgQIECDwSkAAeIXhWwIECBCoLlCnfgGgTq9VSoAAAQIEfggIAD8ofEOAAAEC1QUq1S8AVOq2WgkQIECAwHcBAeA7hC8ECBAgUF2gVv0CQK1+q5YAAQIECPwnIAD8x+APAgQIEKguUK1+AaBax9VLgAABAgT+FRAA/kXwfwIECBCoLlCvfgGgXs9VTIAAAQIELgKAg4AAAQIEygtUBBAAKnZdzQQIECBQXkAAKH8IANgq8Pfff28dwv4ECJwqUHNyAaBm31VNgAABAsUFBIDiB4DyCRAgUF2gav0CQNXOq5sAAQIESgsIAKXbr3gCBAhUF6hbvwBQt/cq30ngn3/+2WkkwxAgQOA4AQHgOGszESBAgEBnApWXIwBU7r7aCRAgQKCsgABQtvUKJ0CAQHWB2vULALX7r3oCBAgQKCogABRtvLL3E/CbAPezNBKBIwWqzyUAVD8CGtf/5cuXxjMYngABAgSeERAAnlGzDwECBAgMLmD5AoBjgAABAgQIFBQQAAo2XckECBCoLqD+y0UAcBQQ2EHABwF3QDQEAQKHCggAh3KbjAABAgTOF7CCCAgAUbA1E/j8+XOzsQ1MgAABAs8LCADP29mTAAECBAYUsOQXAQHgxcGfBDYJ+AzAJj47EyBwgoAAcAJ6pSmr/CIg/0ngSke1WscWsPpFQABYJHwlQIAAAQKFBASAQs1WKgECBKoLqP+ngADw08J3DQSqvAXgMwANDh5DEiDQVEAAaMpr8AhUCQGp1UaAQM8C1vZaQAB4reF7AhsEXAXYgGdXAgQOFxAADic3IQECBAicIWDOtwICwFsPtxoI+G2ADVANSYAAgY0CAsBGQLvfF6jyGYCvX7/ex/AMAgROEjDtewEB4L2I2wQIECBAoICAAFCgyUo8RsCHAI9xNguBZwTs86uAAPCriXt2FqjyFkDYhIAo2AgQGEFAABihSxOssVIImKBdSiAwmYByrgkIANdU3Le7QJV/CeAKwO6HjgEJEGgkIAA0gjXsW4EqVwD8VwHf9t0tAj0IWMN1AQHguot7CRAgQIDA1AICwNTt7ae4KlcAvAXQzzFnJQReBPz5kYAA8JGM+3cXEAJ2JzUgAQIEnhYQAJ6ms+NaAR8EXCvm+QQIbBWw/8cCAsDHNh7ZWaDKFQAfBNz5wDEcAQJNBASAJqwGvSZQJQD4HMC17ruPwBkC5rwlIADc0vHY7gJCwO6kBiRAgMBTAgLAU2x2InBbwFWA2z4eJXCEgDluCwgAt308urPA77//vvOIfQ7ncwB99sWqCBD4KSAA/LTw3QEC3gI4ANkUBAhcLhcI9wQEgHtCHt9dQAjYndSABAgQWC0gAKwms8NWgSpvA2x1sj8BAs8L2PO+gABw38gzCDwl8PXr16f2sxMBAgSOEBAAjlA2xxuBvAWQ7c2dE97IvwTINmFpSiLQuYDlPSIgADyi5DkECBAgQGAyAQFgsoaOUk6VzwF4G2CUI9I6ZxJQy2MCAsBjTp61s0CFtwBC5i2AKNgIEOhRQADosStF1iQEFGm0MgkcKmCyRwUEgEelPG93AW8D7E5qQAIECDwsIAA8TOWJewvkCkC2vcftbTxvA/TWEeuZWUBtjwsIAI9beWYDgSpXAYSABgePIQkQ2CQgAGzis/NWgQpXAGLkXwNEwUagtYDx1wgIAGu0PLeJQIUQkCsA2ZoAGpQAAQJPCAgAT6DZZV+BKm8DuAqw73FjNALvBdxeJyAArPPy7AYCuQKQrcHQXQ3pCkBX7bAYAuUFBIDyh0AfAJ8/f+5jIY1XIQQ0Bj5p+PR12f7888/Lve233367jL6dRH1jWg+tFRAA1op5fhOBClcAAudtgCiMv+Vkv5zAP3369OZknh7f27L/yFuVwD7+kXq7AgHgto9HDxJIAMh20HSnTbO86J+2ABM/LZDe5aS/nPBzO9vTA9pxVwGDrRcQANab2aORgA8DNoI17CaBnORz4s+W7zcNNsHO+Xv6xx9/TFCJEgQAx0A3ArkCkK2bBTVaiJNII9gGw+a9fCf+BrC7D2nAZwQEgGfU7NNMID9dNBu8o4FzYuloOZbyTiAhLSf+vJf/7qHSN/P300//8xwCAsA8vZyiklwByDZFMTeKcGK5gXPyQwlnOfknBJy8FNM/KOBpzwkIAM+52auhQH7KaDh8N0PnRNPNYizkP4Gc+IWz/yiu/uGn/6ssw94pAAzbunkXnisA2eat8KUyJ5oXhx7+zE/7+XR/vvawnh7X0G8w71FrjDUJAGP0qdwqq7zYOOGcf2jnSkx+8j9/JX2vwE//fffnmdUJAM+o2ae5QK4AZGs+0ckTuApwXgMSvnLi14P7Peg5kN9fvWd8JCAAfCTj/tMFKrzo5CSU7XTsQguId0782fJ9odKfLtVP/0/Tdb2jANB1e2ovLlcAss2u4CfQ4zq8XO534n/cvO8g/ngdnvmrgADwq4l7OhKo8OKTk1FOTB2xT7eUGOcnfmFrfWv99L/ebJQ9BIBROlV0nbkCUCEE5MSUk1TRNjcrO6Y58WfL980mmnTg3v/uTcp+WFkCwGHUJnpWID+BJAg8u/8o+yUEjLLW3teZk31O+tnyfe/r7XV9+bvX69qsa7uAALDd0AgHCFT4SSQnqmwtOHMizNsM2VqM38uY8Uut2fJ9L+sacR39/50bUbWvNQsAffXDaj4QyBWAbB88PM3dra4C5MU8Y2fLL7xJEMg2A1xO9KkldTnx79PR/F3z0/8+lj2PIgD03B1reyOQk9ibOya8kZNZtr1Lywv6X3/99WPYBIFsOWnm5Jntx4ODfBOnnPCzpZZBlj3EMkf4uzYEZOeLFAA6b5Dl/RTISazCC1Ork9lHfpkvW8JATqa9hoGc8LNljctac/vnEeK7PQTydyzHyh5jGaNvAQGg7/5Y3TuBXJac/cUpJ7VWJ+F7fpl7CQM5yWYd2XL/u1YccjPzZv6c9Jct9x0yedFJcoz0X7oV7iEgAOyhaIxDBfITyqETnjBZTsKtTnRr/LKObDn5JhDka07I2fZcX8bKlnEzR7Zlvsyfx05oQ7kp1xwb5XAmLFgAmLCps5eUKwAVXqhy4mvRyy1+ORFnXdmWk3RO1Nlye9lyIr+2LY+//vp634ybObK1qN2YHwvk79QoP/1/XIVH1ggIAGu0PLcbgbxQ5UTWzYIaLCQnwZxEGwx9aeGX9S5bTuTXtuXx119b1GfM9QI5JtbvZY+RBQSAkbtXfO35iWV2gpxEc7JsUefrfxXQYnxjjiMw1t+lcVx7X6kA0HuHrO9DgVwBqPDClRDwIcLGB4SAjYAT7J6/Q376n6CRT5QgADyBZpd+BPLClSDQz4r2X0muALR6KyB2OQHsv2ojjiCQ3ufv0AhrXdbo634CAsB+lkY6SaDCT7G5CtAqBOQEkBPBSe0z7YkC6f2J05v6ZAEB4OQGmH4fgSohIFcD9hF7O0pOBELAW5PZb43Z79m7cmx9AsCx3mZrJFDlUnauBDQibPIvA1qt1bjbBHLyT+jbNoq9RxcQAEbvoPX/EMgLWl7Yftwx4Te5ApB/Q9+qtFxJSZhqNb5xzxfI35H8XTl/JetXYI99BQSAfT2NdrJAXthmP4ElBLT6PEDalxNEvtrmFMjfkTkrU9VaAQFgrZjndy+Qn2K7X+TGBeatgASBjcNc3T0BqoLh1eInv3Psvk7enBPKEwBOQDdle4EKL3Qt3woQAtofo0fPkCs76evR85qvXwEBoN/eWNkGgbzQ5QVvwxBD7CoEDNGm0xeZvwujX/o/HXHCBQgAEzZVSS8CecHLC9/LrTn/zNsAQsCcvd2rqvwdyN+FvcYzzjwCAsA8vVTJFYG88OUF8MpD09yVENDyQ4G5mlLhLZVpDohXhaR3+Tvw6q5Bv7XsFgICQAtVY3YlkBfA2UNAPhQoBHR12J2+mJz8BbfT29D1AgSArttjcXsJCAHbJZ1QthseOcJMJ/8j3SrNJQBU6nbxWoWA7QdAQsC3b98u+bp9NCO0EnDybyU717gCwFz9VM0dgSohIJ8LuEOx6eGcYISATYTNdp6vN82oyg8sAJQ/BOoBJATMfvLKvwxo+ZmAHDU50cz+2YrUOdKWnsx+bI/Uj97XKgD03iHrayJQ4YWy9QcD05iEKSEgEudvsx7T58vOuwIBYN7equyOQIUXzKNCQCzvcHu4oUD8/eTfEHjSoQWASRurrMcE8sI5+0+wR4SAnHzy4cDZLR87qo59Vo7h+B8761GzmaelgADQUtfYQwhUuIx9RAhIsytYps5eNif/Xjox5joEgDH7ZtU7C1Q4cQkBOx80Jw6Xn/hzxSVfT1xG86lN0FZAAGjra/SBBISA/ZoVy/x06i2B/UyXkXLSj+1y21cCzwoIAM/K2W9KgeXENWVx34s66kpATlTxFAK+w+/wJZZ1Tv47gBnipoAAcJPHgxUFcuKa/fJqQkB+V8AR/U0IiGdOXkfMN+sc8YvlrPWp63gBAeB4czMOIpCftPKiO8hyVy8zvy0wISBfV+/8xA45ec3s+QTJw7vELX4P7zDBE5XQXkAAaG9shoEF8qKbF9+BS7i59Jz8jw4BrgbcbMmbB3M1KkE0x+GbB9wgsIOAALADoiHmFsiL78whIN1LCGj9q4Mzz7JVMF1qffZrjrmc/BMCnh1j3P2s/AgBAeAIZXMML5AT1uw/ueZzAUeHgNlNnz3wc/LPMffs/vYj8IiAAPCIkucQ+C6QF+W8OH+/Od2XhIBcDTiysJgKAi/i+Wk/P/XH5OWemn+q+hgBAeAYZ7NMJJAX57xI58V6orJ+lJLPBXz69Oly5NWATB7XykEgwXLm4yo9tvUlIAD01Q+rGUQgJ/+8WOdFe5Alr15mrgYcHQKyyGpBYGCauoIAAAqTSURBVDmWUnfqtxE4SkAAOEraPFMK5EV79hBw9FsCy4ES29mvCOTYSZBMCFjq9pXAUQICwFHS5plWYPYT1VlvCSwHzGvfnDCX+0f+mhN+TvypbeQ6WqzdmMcJCADHWZtpcoG8mOdFfZaT1Pt2nfWWwLKO+GYb/apAjo8cJwkBS22+EjhDQAA4Q92c0wrkRT0nqbzIz1hkQsAZHxB8bxnjJQiMYp1jIyf+rP19PW4vAr4eKSAAHKltrjICeZFfTlAzFp0gcMYHBN9bxjlbz9bLiT8n/3z/vga3CZwlIACcJW/eEgI5OeWFf5SfUtc0JSGgh6sBy5pjnSCweJ99ss38WUu2fL+s09ePBTxyrIAAcKy32QoK5MU/J6cZQ0DamSDQw9WArCXb4p0TbwJB3LPlsSO2zJ+5s+X7I+Y0B4FnBASAZ9TsQ+AJgYSA5YT0xO5d75IQ0NPVgNdYcc8W+5yUEwZanJgzZsbPlu9fr8H3jwh4ztECAsDR4uYrL7CcjHIimg2j5yAQ65yY45+T9OtAkF7ksTznkS3PXbbXY+W+R/b3HAI9CAgAPXTBGkoK5ESUk1BOPrMBJAjkbYH8DoGea8sJO33ItpzI05PXW+7Pdu2+3J8xeq5xlLVZ5/ECAsDx5mYk8EYgJ5+cXBIEZjqZJATktwgmCLwpeLAb6Um2wZZtuQTuCggAd4k8gcAxAgkC+YkyW8LAMbO2nyVBoNfPB7Sv3gyPCXjWGQICwBnq5iRwQyA/bSYMLFcFbjx1qIcEgaHaZbEFBASAAk1W4rgCr4PALFcFBIFxj8dWKzfuOQICwDnuZiWwSiBBINtMVwUEgVWHgCcT2F1AANid1IAE2gosQWD5rEDeMmg7Y9vRBYG2vv2PboVnCQgAZ8mbl8BGgZz4EwYSBJYrAyO/TSAIbDwg7E5gpYAAsBLM0wn0KpAwkG30MCAI9HqEtVmXUc8TEADOszczgWYCCQLZEgZyhSBXBrI1m7DBwAkCo/8OgQYshiSwm4AAsBulgQj0KbC8VbAEgoSChIFseazPVb+sKiEgv0yo998o+LJaf64XsMeZAgLAmfrmJnCSQMJAtlwdSCDIlkCQLaEg2xlLy7zLlrUs2xlrMSeB2QUEgNk7rD4CDwokEGRLKMiWULBsub1sy0l5+bqcsF9/XR776Osy1vL12jxZS7Zl3AfL8LSBBCz1XAEB4Fx/sxMYQmA5CedrTsqvt+Uk/vrr68evfZ9xXm9DIFgkgckEBIDJGqocAgQIjCFglWcLCABnd8D8BAgQIEDgBAEB4AR0UxIgQKC6gPrPFxAAzu+BFRAgQIAAgcMFBIDDyU1IgACB6gLq70FAAOihC9ZAgAABAgQOFhAADgY3HQECBKoLqL8PAQGgjz5YBQECBAgQOFRAADiU22QECBCoLqD+XgQEgF46YR0ECBAgQOBAAQHgQGxTESBAoLqA+vsREAD66YWVECBAgACBwwQEgMOoTUSAAIHqAurvSUAA6Kkb1kKAAAECBA4SEAAOgjYNAQIEqguovy8BAaCvflgNAQIECBA4REAAOITZJAQIEKguoP7eBASA3jpiPQQIECBA4AABAeAAZFMQIECguoD6+xMQAPrriRURIECAAIHmAgJAc2ITECBAoLqA+nsUEAB67Io1ESBAgACBxgICQGNgwxMgQKC6gPr7FBAA+uyLVREgQIAAgaYCAkBTXoMTIECguoD6exUQAHrtjHURIECAAIGGAgJAQ1xDEyBAoLqA+vsVEAD67Y2VESBAgACBZgICQDNaAxMgQKC6gPp7FhAAeu6OtREgQIAAgUYCAkAjWMMSIECguoD6+xYQAPruj9URIECAAIEmAgJAE1aDEiBAoLqA+nsXEAB675D1ESBAgACBBgICQANUQxIgQKC6gPr7FxAA+u+RFRIgQIAAgd0FBIDdSQ1IgACB6gLqH0FAABihS9ZIgAABAgR2FhAAdgY1HAECBKoLqH8MAQFgjD5ZJQECBAgQ2FVAANiV02AECBCoLqD+UQQEgFE6ZZ0ECBAgQGBHAQFgR0xDESBAoLqA+scREADG6ZWVEiBAgACB3QQEgN0oDUSAAIHqAuofSUAAGKlb1kqAAAECBHYSEAB2gjQMAQIEqguofywBAWCsflktAQIECBDYRUAA2IXRIAQIEKguoP7RBASA0TpmvQQIECBAYAcBAWAHREMQIECguoD6xxMQAMbrmRUTIECAAIHNAgLAZkIDECBAoLqA+kcUEABG7Jo1EyBAgACBjQICwEZAuxMgQKC6gPrHFBAAxuybVRMgQIAAgU0CAsAmPjsTIECguoD6RxUQAEbtnHUTIECAAIENAgLABjy7EiBAoLqA+scVEADG7Z2VEyBAgACBpwUEgKfp7EiAAIHqAuofWUAAGLl71k6AAAECBJ4UEACehLMbAQIEqguof2wBAWDs/lk9AQIECBB4SkAAeIrNTgQIEKguoP7RBQSA0Tto/QQIECBA4AkBAeAJNLsQIECguoD6xxcQAMbvoQoIECBAgMBqAQFgNZkdCBAgUF1A/TMICAAzdFENBAgQIEBgpYAAsBLM0wkQIFBdQP1zCAgAc/RRFQQIECBAYJWAALCKy5MJECBQXUD9swgIALN0Uh0ECBAgQGCFgACwAstTCRAgUF1A/fMICADz9FIlBAgQIEDgYQEB4GEqTyRAgEB1AfXPJCAAzNRNtRAgQIAAgQcFBIAHoTyNAAEC1QXUP5eAADBXP1VDgAABAgQeEhAAHmLyJAIECFQXUP9sAgLAbB1VDwECBAgQeEBAAHgAyVMIECBQXUD98wkIAPP1VEUECBAgQOCugABwl8gTCBAgUF1A/TMKCAAzdlVNBAgQIEDgjoAAcAfIwwQIEKguoP45BQSAOfuqKgIECBAgcFNAALjJ40ECBAhUF1D/rAICwKydVRcBAgQIELghIADcwPEQAQIEqguof14BAWDe3qqMAAECBAh8KCAAfEjjAQIECFQXUP/MAgLAzN1VGwECBAgQ+EBAAPgAxt0ECBCoLqD+uQUEgLn7qzoCBAgQIHBVQAC4yuJOAgQIVBdQ/+wCAsDsHVYfAQIECBC4IiAAXEFxFwECBKoLqH9+AQFg/h6rkAABAgQI/CIgAPxC4g4CBAhUF1B/BQEBoEKX1UiAAAECBN4JCADvQNwkQIBAdQH11xAQAGr0WZUECBAgQOCNgADwhsMNAgQIVBdQfxUBAaBKp9VJgAABAgReCQgArzB8S4AAgeoC6q8jIADU6bVKCRAgQIDADwEB4AeFbwgQIFBdQP2VBASASt1WKwECBAgQ+C4gAHyH8IUAAQLVBdRfS0AAqNVv1RIgQIAAgf8EBID/GPxBgACB6gLqryYgAFTruHoJECBAgMC/AgLAvwj+T4AAgeoC6q8nIADU67mKCRAgQIDARQBwEBAgQKC8AICKAgJAxa6rmQABAgTKCwgA5Q8BAAQIVBdQf00BAaBm31VNgAABAsUFBIDiB4DyCRCoLqD+qgICQNXOq5sAAQIESgsIAKXbr3gCBKoLqL+ugABQt/cqJ0CAAIHCAgJA4eYrnQCB6gLqrywgAFTuvtoJECBAoKyAAFC29QonQKC6gPprC/w/AAAA//9uLmvsAAAABklEQVQDALZY4h56k6ktAAAAAElFTkSuQmCC";
+
+// src/dashboard.ts
+var DEFAULT_PORT = 3847;
+var HOST = "127.0.0.1";
+function fingerprint(token) {
+  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+}
+function readJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      if (!raw.trim()) {
+        resolve({});
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        reject(new Error("invalid JSON body"));
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function buildStatus() {
+  const configPath = transcodesConfigFile();
+  const records = readTokenRecords();
+  const active = readTokenFromFile();
+  const envOverridesFile = Boolean(
+    process.env.TRANSCODES_TOKEN?.trim() && active
+  );
+  const tokens = records.map(({ token, label }) => {
+    const entry = {
+      id: fingerprint(token),
+      active: token === active
+    };
+    if (label) entry.label = label;
+    try {
+      const parsed = parseMemberAccessToken(token);
+      entry.projectId = parsed.claims.projectId;
+      entry.organizationId = parsed.claims.organizationId;
+      entry.expiresAt = new Date(parsed.claims.exp * 1e3).toISOString();
+      if (parsed.warnings.length > 0) entry.warnings = [...parsed.warnings];
+    } catch (err) {
+      entry.warnings = [err instanceof Error ? err.message : String(err)];
+    }
+    return entry;
+  });
+  return { configPath, envOverridesFile, tokens };
+}
+function tokenById(id) {
+  return readTokenList().find((t) => fingerprint(t) === id);
+}
+function sendJson(res, status, body) {
+  res.writeHead(status, {
+    "Content-Type": "application/json; charset=utf-8",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(body));
+}
+function dashboardHtml() {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Transcodes \u2014 Token</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; }
+    :root {
+      --bg: #f4f4f6;
+      --card: #ffffff;
+      --line: #ececf0;
+      --ink: #16161a;
+      --muted: #8a8a94;
+      --accent: #5b54e6;
+      --accent-soft: #eeedfb;
+    }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      background: var(--bg);
+      color: var(--ink);
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 32px;
+      -webkit-font-smoothing: antialiased;
+    }
+    .card {
+      width: 100%;
+      max-width: 460px;
+      background: var(--card);
+      border-radius: 24px;
+      padding: 34px;
+      box-shadow: 0 1px 2px rgba(16, 16, 26, 0.04), 0 12px 40px rgba(16, 16, 26, 0.06);
+    }
+    .header {
+      display: flex;
+      align-items: center;
+      gap: 16px;
+      padding-bottom: 24px;
+      border-bottom: 1px solid var(--line);
+    }
+    .avatar {
+      width: 56px;
+      height: 56px;
+      border-radius: 14px;
+      flex-shrink: 0;
+      object-fit: contain;
+      background: #f4f4f6;
+      padding: 8px;
+    }
+    .header h1 {
+      margin: 0;
+      font-size: 21px;
+      font-weight: 700;
+      letter-spacing: -0.02em;
+    }
+    .header p {
+      margin: 5px 0 0;
+      font-size: 14px;
+      color: var(--muted);
+    }
+    .tabs {
+      display: flex;
+      gap: 4px;
+      margin-top: 22px;
+      padding: 4px;
+      background: #f4f4f6;
+      border-radius: 13px;
+    }
+    .tab {
+      flex: 1;
+      padding: 9px 12px;
+      font-size: 13.5px;
+      font-weight: 600;
+      color: var(--muted);
+      background: transparent;
+      border: none;
+      border-radius: 9px;
+      cursor: pointer;
+      transition: background 0.15s, color 0.15s;
+    }
+    .tab:hover { color: var(--ink); }
+    .tab.active {
+      background: #fff;
+      color: var(--ink);
+      box-shadow: 0 1px 2px rgba(16, 16, 26, 0.08);
+    }
+    .panel { display: none; padding-top: 26px; }
+    .panel.active { display: block; }
+    .section-title {
+      font-size: 17px;
+      font-weight: 700;
+      margin: 0 0 4px;
+      letter-spacing: -0.01em;
+    }
+    .section-sub {
+      font-size: 14px;
+      color: var(--muted);
+      margin: 0 0 20px;
+    }
+    textarea {
+      width: 100%;
+      min-height: 92px;
+      padding: 14px 16px;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 12.5px;
+      line-height: 1.5;
+      color: var(--ink);
+      background: #fbfbfc;
+      border: 1px solid var(--line);
+      border-radius: 14px;
+      resize: vertical;
+      outline: none;
+      transition: border-color 0.15s, box-shadow 0.15s, background 0.15s;
+    }
+    textarea:focus {
+      background: #fff;
+      border-color: var(--accent);
+      box-shadow: 0 0 0 4px rgba(91, 84, 230, 0.12);
+    }
+    textarea::placeholder { color: #b9b9c2; }
+    .label-input {
+      width: 100%;
+      margin-top: 12px;
+      padding: 12px 16px;
+      font-size: 13.5px;
+      color: var(--ink);
+      background: #fbfbfc;
+      border: 1px solid var(--line);
+      border-radius: 14px;
+      outline: none;
+      transition: border-color 0.15s, box-shadow 0.15s, background 0.15s;
+    }
+    .label-input:focus {
+      background: #fff;
+      border-color: var(--accent);
+      box-shadow: 0 0 0 4px rgba(91, 84, 230, 0.12);
+    }
+    .label-input::placeholder { color: #b9b9c2; }
+    .actions {
+      display: flex;
+      gap: 12px;
+      margin-top: 18px;
+    }
+    .actions button {
+      flex: 1;
+      padding: 13px 18px;
+      font-size: 15px;
+      font-weight: 600;
+      border-radius: 14px;
+      border: none;
+      cursor: pointer;
+      transition: background 0.15s, opacity 0.15s, transform 0.05s;
+    }
+    .actions button:active:not(:disabled) { transform: translateY(1px); }
+    .actions button:disabled { opacity: 0.5; cursor: not-allowed; }
+    .btn-primary { background: var(--accent); color: #fff; }
+    .btn-primary:hover:not(:disabled) { background: #4a43d4; }
+    .btn-secondary {
+      background: #f4f4f6;
+      color: #5a5a64;
+    }
+    .btn-secondary:hover:not(:disabled) { background: #ececf0; }
+    .list-label {
+      margin: 26px 0 10px;
+      font-size: 13px;
+      font-weight: 600;
+      color: var(--muted);
+      letter-spacing: 0.01em;
+    }
+    .token-list { display: flex; flex-direction: column; gap: 10px; }
+    .token-empty {
+      padding: 16px 18px;
+      background: #fbfbfc;
+      border: 1px dashed var(--line);
+      border-radius: 16px;
+      font-size: 13.5px;
+      color: var(--muted);
+      text-align: center;
+    }
+    .token-row {
+      display: flex;
+      flex-direction: column;
+      gap: 14px;
+      padding: 16px;
+      background: #fbfbfc;
+      border: 1px solid var(--line);
+      border-radius: 16px;
+      transition: border-color 0.15s, background 0.15s;
+    }
+    .token-row.active {
+      border-color: var(--accent);
+      background: var(--accent-soft);
+    }
+    .token-top { display: flex; align-items: center; gap: 14px; }
+    .radio {
+      width: 18px;
+      height: 18px;
+      border-radius: 50%;
+      border: 2px solid #d0d0d8;
+      flex-shrink: 0;
+      position: relative;
+      transition: border-color 0.15s;
+    }
+    .token-row.active .radio { border-color: var(--accent); }
+    .token-row.active .radio::after {
+      content: "";
+      position: absolute;
+      inset: 3px;
+      border-radius: 50%;
+      background: var(--accent);
+    }
+    .token-info { flex: 1; min-width: 0; line-height: 1.45; }
+    .token-info .label {
+      font-size: 14.5px;
+      font-weight: 700;
+      color: var(--ink);
+      margin-bottom: 4px;
+    }
+    .token-info .field { font-size: 13px; color: #4a4a52; }
+    .token-info .field .k { color: var(--muted); }
+    .token-info .field code {
+      font-size: 12px;
+      color: var(--ink);
+      background: #fff;
+      border: 1px solid var(--line);
+      padding: 1px 7px;
+      border-radius: 6px;
+    }
+    .token-row.active .token-info .field code { background: #fff; }
+    .token-info .warn { font-size: 12px; color: #c0392f; margin-top: 2px; }
+    .token-actions {
+      display: flex;
+      gap: 8px;
+      padding-top: 12px;
+      border-top: 1px solid var(--line);
+    }
+    .token-row.active .token-actions { border-top-color: rgba(91, 84, 230, 0.18); }
+    .token-actions button {
+      flex: 1;
+      padding: 9px 12px;
+      font-size: 12px;
+      font-weight: 600;
+      letter-spacing: 0.03em;
+      border-radius: 10px;
+      border: 1px solid var(--line);
+      background: #fff;
+      cursor: pointer;
+      transition: background 0.15s, color 0.15s, border-color 0.15s, opacity 0.15s;
+    }
+    .btn-set { color: var(--accent); }
+    .btn-set:hover:not(:disabled) { background: var(--accent); color: #fff; border-color: var(--accent); }
+    .btn-set:disabled { opacity: 0.45; cursor: default; }
+    .btn-del { color: #c0392f; }
+    .btn-del:hover { background: #c0392f; color: #fff; border-color: #c0392f; }
+    .btn-edit, .btn-cancel { color: #5a5a64; }
+    .btn-edit:hover, .btn-cancel:hover { background: #ececf0; color: var(--ink); border-color: #dcdce2; }
+    .label-edit {
+      width: 100%;
+      padding: 9px 12px;
+      font-size: 13.5px;
+      font-weight: 600;
+      color: var(--ink);
+      background: #fff;
+      border: 1px solid var(--accent);
+      border-radius: 9px;
+      outline: none;
+      box-shadow: 0 0 0 4px rgba(91, 84, 230, 0.12);
+    }
+    .cmd-list { display: flex; flex-direction: column; gap: 10px; }
+    .cmd {
+      padding: 14px 16px;
+      background: #fbfbfc;
+      border: 1px solid var(--line);
+      border-radius: 14px;
+    }
+    .cmd code {
+      display: inline-block;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 12.5px;
+      color: var(--accent);
+      background: var(--accent-soft);
+      padding: 3px 9px;
+      border-radius: 7px;
+    }
+    .cmd .cmd-desc {
+      display: block;
+      margin-top: 8px;
+      font-size: 13px;
+      color: var(--muted);
+      line-height: 1.5;
+    }
+    .settings-list { display: flex; flex-direction: column; gap: 10px; }
+    .setting-row {
+      display: flex;
+      align-items: flex-start;
+      justify-content: space-between;
+      gap: 16px;
+      padding: 14px 16px;
+      background: #fbfbfc;
+      border: 1px solid var(--line);
+      border-radius: 14px;
+    }
+    .setting-info { flex: 1; min-width: 0; }
+    .setting-label {
+      display: block;
+      font-size: 14.5px;
+      font-weight: 600;
+      color: var(--ink);
+      letter-spacing: -0.01em;
+    }
+    .setting-desc {
+      margin: 8px 0 0;
+      font-size: 13px;
+      color: var(--muted);
+      line-height: 1.5;
+    }
+    .toggle {
+      position: relative;
+      width: 44px;
+      height: 26px;
+      flex: none;
+      flex-shrink: 0;
+      margin-top: 2px;
+      border: none;
+      border-radius: 999px;
+      background: #d8d8de;
+      cursor: pointer;
+      padding: 0;
+      transition: background 0.2s;
+    }
+    .toggle::after {
+      content: "";
+      position: absolute;
+      top: 3px;
+      left: 3px;
+      width: 20px;
+      height: 20px;
+      border-radius: 50%;
+      background: #fff;
+      box-shadow: 0 1px 3px rgba(16, 16, 26, 0.18);
+      transition: transform 0.2s;
+    }
+    .toggle.on { background: var(--accent); }
+    .toggle.on::after { transform: translateX(18px); }
+    .toggle:disabled { opacity: 0.5; cursor: not-allowed; }
+    .toast {
+      margin-top: 14px;
+      padding: 12px 16px;
+      border-radius: 12px;
+      font-size: 13.5px;
+      font-weight: 500;
+      display: none;
+    }
+    .toast.show { display: block; }
+    .toast.success { background: #effaf2; color: #1a7f45; }
+    .toast.error { background: #fdf0f0; color: #c0392f; }
+    .hint {
+      margin: 18px 0 0;
+      font-size: 12.5px;
+      color: #b9b9c2;
+      text-align: center;
+      line-height: 1.6;
+    }
+    .hint code {
+      font-size: 11.5px;
+      background: #f4f4f6;
+      padding: 2px 7px;
+      border-radius: 6px;
+      color: #8a8a94;
+    }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="header">
+      <img class="avatar" src="${LOGO_DATA_URI}" alt="Transcodes" />
+      <div>
+        <h1>Transcodes</h1>
+        <p>CLI Dashboard</p>
+      </div>
+    </div>
+    <div class="tabs">
+      <button type="button" class="tab active" data-tab="tokens">Tokens</button>
+      <button type="button" class="tab" data-tab="settings">Settings</button>
+      <button type="button" class="tab" data-tab="cli">CLI Commands</button>
+    </div>
+
+    <div class="panel active" id="panel-tokens">
+      <p class="section-title">MCP Agent Token</p>
+      <p class="section-sub">Paste the token from your Transcodes console member detail page</p>
+      <textarea id="token" placeholder="eyJhbGciOi\u2026" spellcheck="false" autocomplete="off"></textarea>
+      <input type="text" id="label" class="label-input" placeholder="Label (required) \u2014 e.g. transcodes-{project_name}-{env}" autocomplete="off" required />
+      <div class="actions">
+        <button type="button" class="btn-primary" id="save">Save</button>
+        <button type="button" class="btn-secondary" id="clear">Clear</button>
+      </div>
+      <div id="toast" class="toast"></div>
+      <p class="list-label">Saved tokens</p>
+      <div class="token-list" id="token-list"></div>
+      <p class="hint">Saved to <code>{{HOME_DIR}}/.transcodes/config.json</code><br />Press Ctrl+C in the terminal to stop</p>
+    </div>
+
+    <div class="panel" id="panel-cli">
+      <p class="section-title">CLI Commands</p>
+      <p class="section-sub">Run these from your terminal \u2014 the dashboard wraps the same actions</p>
+      <div class="cmd-list">
+        <div class="cmd"><code>transcodes</code><span class="cmd-desc">Open this dashboard (default, same as transcodes dashboard)</span></div>
+        <div class="cmd"><code>transcodes set &lt;token&gt; -l &lt;label&gt;</code><span class="cmd-desc">Validate and save a token with a label, then make it active</span></div>
+        <div class="cmd"><code>transcodes tokens</code><span class="cmd-desc">List all saved tokens (active one marked with *)</span></div>
+        <div class="cmd"><code>transcodes reset</code><span class="cmd-desc">Remove all saved tokens</span></div>
+        <div class="cmd"><code>transcodes help</code><span class="cmd-desc">Show the full command list and how to use each one</span></div>
+      </div>
+    </div>
+
+    <div class="panel" id="panel-settings">
+      <p class="section-title">Settings</p>
+      <p class="section-sub">Manage your local MCP Agent settings</p>
+      <div class="settings-list">
+        <div class="setting-row">
+          <div class="setting-info">
+            <span class="setting-label">Step-up Authentication</span>
+            <p class="setting-desc">When off, all features except Transcodes essentials are skipped</p>
+          </div>
+          <button type="button" class="toggle" id="stepup-toggle" aria-label="Step-up Authentication"></button>
+        </div>
+      </div>
+      <div id="settings-toast" class="toast"></div>
+    </div>
+  </div>
+  <script>
+    const tokenEl = document.getElementById("token");
+    const labelEl = document.getElementById("label");
+    const toastEl = document.getElementById("toast");
+    const listEl = document.getElementById("token-list");
+    const saveBtn = document.getElementById("save");
+    const clearBtn = document.getElementById("clear");
+
+    document.querySelectorAll(".tab").forEach((tab) => {
+      tab.addEventListener("click", () => {
+        const name = tab.getAttribute("data-tab");
+        document.querySelectorAll(".tab").forEach((t) =>
+          t.classList.toggle("active", t === tab));
+        document.querySelectorAll(".panel").forEach((p) =>
+          p.classList.toggle("active", p.id === "panel-" + name));
+        if (name === "settings") loadSettings();
+      });
+    });
+
+    function showToast(msg, kind) {
+      toastEl.textContent = msg;
+      toastEl.className = "toast show " + (kind || "success");
+      setTimeout(() => toastEl.classList.remove("show"), 4000);
+    }
+
+    function esc(s) {
+      return String(s).replace(/[&<>"]/g, (c) =>
+        ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c]));
+    }
+
+    let lastStatus = { tokens: [] };
+    let editingId = null;
+
+    function renderTokens(s) {
+      if (!s.tokens || s.tokens.length === 0) {
+        listEl.innerHTML = '<div class="token-empty">No tokens saved yet \u2014 paste one above and press Save</div>';
+        return;
+      }
+
+      listEl.innerHTML = s.tokens.map((t) => {
+        const editing = t.id === editingId;
+        const project = t.projectId
+          ? '<div class="field"><span class="k">Project Id</span> <code>' + esc(t.projectId) + '</code></div>'
+          : '';
+        const org = t.organizationId
+          ? '<div class="field"><span class="k">Organization Id</span> <code>' + esc(t.organizationId) + '</code></div>'
+          : '';
+        const warn = t.warnings && t.warnings.length
+          ? '<div class="warn">' + esc(t.warnings.join("; ")) + '</div>'
+          : '';
+        const labelBlock = editing
+          ? '<input type="text" class="label-edit" data-edit-input="' + t.id + '" value="' + esc(t.label || "") + '" placeholder="Label" />'
+          : (t.label ? '<div class="label">' + esc(t.label) + '</div>' : '');
+        const actions = editing
+          ? '<button type="button" class="btn-set" data-save-label="' + t.id + '">SAVE</button>' +
+            '<button type="button" class="btn-cancel" data-cancel-edit="1">CANCEL</button>'
+          : '<button type="button" class="btn-edit" data-edit="' + t.id + '">EDIT</button>' +
+            '<button type="button" class="btn-set" data-set="' + t.id + '"' + (t.active ? " disabled" : "") + '>' +
+              (t.active ? "DEFAULT" : "SET DEFAULT") +
+            '</button>' +
+            '<button type="button" class="btn-del" data-del="' + t.id + '">DELETE</button>';
+        return (
+          '<div class="token-row' + (t.active ? " active" : "") + '" data-id="' + t.id + '">' +
+            '<div class="token-top">' +
+              '<span class="radio"></span>' +
+              '<div class="token-info">' + labelBlock + org + project + warn + '</div>' +
+            '</div>' +
+            '<div class="token-actions">' + actions + '</div>' +
+          '</div>'
+        );
+      }).join("");
+
+      if (editingId) {
+        const el = listEl.querySelector('[data-edit-input="' + editingId + '"]');
+        if (el) { el.focus(); el.select(); }
+      }
+    }
+
+    async function refresh() {
+      const res = await fetch("/api/status");
+      lastStatus = await res.json();
+      renderTokens(lastStatus);
+    }
+
+    async function saveLabel(id) {
+      const input = listEl.querySelector('[data-edit-input="' + id + '"]');
+      const label = input ? input.value.trim() : "";
+      if (!label) {
+        showToast("Label cannot be empty", "error");
+        return;
+      }
+      try {
+        const res = await fetch("/api/label", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ id, label }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Rename failed");
+        editingId = null;
+        showToast("Label updated", "success");
+        refresh();
+      } catch (e) {
+        showToast(e.message || "Rename failed", "error");
+      }
+    }
+
+    async function setDefault(id) {
+      try {
+        const res = await fetch("/api/select", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ id }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Set default failed");
+        showToast("Default token updated", "success");
+        refresh();
+      } catch (e) {
+        showToast(e.message || "Set default failed", "error");
+      }
+    }
+
+    async function removeToken(id) {
+      if (!confirm("Delete this token from the saved list?")) return;
+      try {
+        const res = await fetch("/api/token", {
+          method: "DELETE",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ id }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Delete failed");
+        showToast("Token deleted", "success");
+        refresh();
+      } catch (e) {
+        showToast(e.message || "Delete failed", "error");
+      }
+    }
+
+    listEl.addEventListener("click", (e) => {
+      const editId = e.target.getAttribute("data-edit");
+      if (editId) { editingId = editId; renderTokens(lastStatus); return; }
+      const saveId = e.target.getAttribute("data-save-label");
+      if (saveId) { saveLabel(saveId); return; }
+      if (e.target.getAttribute("data-cancel-edit")) {
+        editingId = null; renderTokens(lastStatus); return;
+      }
+      const setId = e.target.getAttribute("data-set");
+      if (setId) { setDefault(setId); return; }
+      const delId = e.target.getAttribute("data-del");
+      if (delId) { removeToken(delId); return; }
+    });
+
+    listEl.addEventListener("keydown", (e) => {
+      const input = e.target.closest(".label-edit");
+      if (!input) return;
+      if (e.key === "Enter") { e.preventDefault(); saveLabel(editingId); }
+      else if (e.key === "Escape") { editingId = null; renderTokens(lastStatus); }
+    });
+
+    saveBtn.addEventListener("click", async () => {
+      const token = tokenEl.value.trim();
+      const label = labelEl.value.trim();
+      if (!token) {
+        showToast("Paste a token first", "error");
+        return;
+      }
+      if (!label) {
+        showToast("Add a label first", "error");
+        labelEl.focus();
+        return;
+      }
+      saveBtn.disabled = true;
+      try {
+        const res = await fetch("/api/token", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ token, label }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Save failed");
+        tokenEl.value = "";
+        labelEl.value = "";
+        showToast("Token saved", "success");
+        refresh();
+      } catch (e) {
+        showToast(e.message || "Save failed", "error");
+      } finally {
+        saveBtn.disabled = false;
+      }
+    });
+
+    clearBtn.addEventListener("click", () => {
+      tokenEl.value = "";
+      labelEl.value = "";
+      tokenEl.focus();
+    });
+
+    const stepupToggleEl = document.getElementById("stepup-toggle");
+    const settingsToastEl = document.getElementById("settings-toast");
+
+    function showSettingsToast(msg, kind) {
+      settingsToastEl.textContent = msg;
+      settingsToastEl.className = "toast show " + (kind || "success");
+      setTimeout(() => settingsToastEl.classList.remove("show"), 4000);
+    }
+
+    function renderStepupToggle(enabled) {
+      stepupToggleEl.classList.toggle("on", enabled);
+      stepupToggleEl.setAttribute("aria-checked", enabled ? "true" : "false");
+    }
+
+    async function loadSettings() {
+      const res = await fetch("/api/settings");
+      const s = await res.json();
+      renderStepupToggle(s.enabled !== false);
+    }
+
+    stepupToggleEl.addEventListener("click", async () => {
+      const next = !stepupToggleEl.classList.contains("on");
+      stepupToggleEl.disabled = true;
+      try {
+        const res = await fetch("/api/settings", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ enabled: next }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Save failed");
+        renderStepupToggle(next);
+        showSettingsToast(
+          next ? "Step-up Authentication enabled" : "Step-up Authentication disabled",
+          "success"
+        );
+      } catch (e) {
+        showSettingsToast(e.message || "Save failed", "error");
+      } finally {
+        stepupToggleEl.disabled = false;
+      }
+    });
+
+    refresh();
+    loadSettings();
+  </script>
+</body>
+</html>`;
+}
+function openBrowser(url) {
+  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(opener, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function listen(port) {
+  return new Promise((resolve, reject) => {
+    const server = createServer(async (req, res) => {
+      const url = req.url ?? "/";
+      const method = req.method ?? "GET";
+      const hostName = (req.headers.host ?? "").split(":")[0];
+      if (hostName !== "127.0.0.1" && hostName !== "localhost") {
+        res.writeHead(403, { "Content-Type": "text/plain" });
+        res.end("forbidden host");
+        return;
+      }
+      try {
+        if (method === "GET" && (url === "/" || url === "/index.html")) {
+          res.writeHead(200, {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store"
+          });
+          res.end(dashboardHtml());
+          return;
+        }
+        if (method === "GET" && url === "/api/status") {
+          sendJson(res, 200, buildStatus());
+          return;
+        }
+        if (method === "POST" && url === "/api/token") {
+          const body = await readJsonBody(req);
+          const token = typeof body.token === "string" ? body.token.trim() : "";
+          const label = typeof body.label === "string" ? body.label.trim() : "";
+          if (!token) {
+            sendJson(res, 400, { error: "token is required" });
+            return;
+          }
+          if (!label) {
+            sendJson(res, 400, { error: "label is required" });
+            return;
+          }
+          try {
+            parseMemberAccessToken(token);
+          } catch (err) {
+            sendJson(res, 400, {
+              error: err instanceof Error ? err.message : String(err)
+            });
+            return;
+          }
+          writeTokenToFile(token, label);
+          sendJson(res, 200, { ok: true, ...buildStatus() });
+          return;
+        }
+        if (method === "POST" && url === "/api/label") {
+          const body = await readJsonBody(req);
+          const id = typeof body.id === "string" ? body.id : "";
+          const label = typeof body.label === "string" ? body.label.trim() : "";
+          const token = id ? tokenById(id) : void 0;
+          if (!token) {
+            sendJson(res, 404, { error: "token not found" });
+            return;
+          }
+          if (!label) {
+            sendJson(res, 400, { error: "label is required" });
+            return;
+          }
+          setTokenLabel(token, label);
+          sendJson(res, 200, { ok: true, ...buildStatus() });
+          return;
+        }
+        if (method === "POST" && url === "/api/select") {
+          const body = await readJsonBody(req);
+          const id = typeof body.id === "string" ? body.id : "";
+          const token = id ? tokenById(id) : void 0;
+          if (!token) {
+            sendJson(res, 404, { error: "token not found" });
+            return;
+          }
+          setActiveToken(token);
+          sendJson(res, 200, { ok: true, ...buildStatus() });
+          return;
+        }
+        if (method === "DELETE" && url === "/api/token") {
+          const body = await readJsonBody(req);
+          const id = typeof body.id === "string" ? body.id : "";
+          const token = id ? tokenById(id) : void 0;
+          if (!token) {
+            sendJson(res, 404, { error: "token not found" });
+            return;
+          }
+          removeTokenFromFile(token);
+          sendJson(res, 200, { ok: true, ...buildStatus() });
+          return;
+        }
+        if (method === "GET" && url === "/api/settings") {
+          sendJson(res, 200, {
+            enabled: isTrackerEnabled()
+          });
+          return;
+        }
+        if (method === "POST" && url === "/api/settings") {
+          const body = await readJsonBody(req);
+          if (typeof body.enabled !== "boolean") {
+            sendJson(res, 400, {
+              error: "enabled must be a boolean"
+            });
+            return;
+          }
+          setTrackerEnabled(body.enabled);
+          sendJson(res, 200, {
+            ok: true,
+            enabled: isTrackerEnabled()
+          });
+          return;
+        }
+        sendJson(res, 404, { error: "not found" });
+      } catch (err) {
+        sendJson(res, 500, {
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    });
+    server.on("error", reject);
+    server.listen(port, HOST, () => resolve(server));
+  });
+}
+async function runDashboard(options) {
+  const preferred = options.port ?? DEFAULT_PORT;
+  let server;
+  let port = preferred;
+  for (let attempt = 0; attempt < 10; attempt++) {
+    try {
+      server = await listen(port);
+      break;
+    } catch (err) {
+      const code = err.code;
+      if (code === "EADDRINUSE") {
+        port += 1;
+        continue;
+      }
+      throw err;
+    }
+  }
+  if (!server) {
+    const last = preferred + 9;
+    throw new Error(
+      `could not find a free port in ${preferred}-${last} (all in use).
+  A previous dashboard is probably still running.
+  Tip: if you stopped one with Ctrl+Z it is only suspended (still alive) \u2014 use Ctrl+C to stop it.
+  Free the ports and retry:
+    macOS/Linux:  lsof -ti tcp:${preferred}-${last} | xargs kill -9
+    any platform: npx kill-port ${preferred} ${preferred + 1}  # repeat per port
+  Or choose another port:  transcodes --port <N>`
+    );
+  }
+  const url = `http://${HOST}:${port}/`;
+  process.stdout.write(
+    `Transcodes dashboard running at ${url}
+  Config file: ${transcodesConfigFile()}
+  Press Ctrl+C to stop
+`
+  );
+  if (options.open !== false) {
+    openBrowser(url);
+  }
+  await new Promise((resolve) => {
+    const onSignal = () => {
+      server.close(() => resolve());
+    };
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+  });
+}
+
 // src/index.ts
 var USAGE = `transcodes \u2014 ai-action-tracker token manager
 
 Usage:
-  transcodes login <token>   Save your Transcodes member token to ${transcodesConfigFile()}
-  transcodes logout          Remove the saved token
-  transcodes status          Show where the active token comes from
-  transcodes help            Show this message
+  transcodes                      Open the dashboard at http://127.0.0.1:3847/ (add --port N or --no-open)
+  transcodes set <token> -l <label>  Save your Transcodes member token (label required) to ${transcodesConfigFile()}
+  transcodes reset                Remove all saved tokens
+  transcodes enable               Turn the ai-action-tracker step-up gate ON
+  transcodes disable              Turn the gate OFF (stops blocking Bash + MCP across all hosts)
+  transcodes status               Show the active token source, expiry, and gate state
+  transcodes tokens               List all saved tokens (active one marked with *)
+  transcodes help                 Show this message
 
 The token is read by the ai-action-tracker plugins/hooks with precedence:
   1. TRANSCODES_TOKEN environment variable (overrides everything)
   2. ${transcodesConfigFile()}
+
+enable/disable flips the \`enabled\` flag in the same file; it takes effect on
+the next hook invocation (no restart needed) and applies to every host.
 `;
 function fail(message) {
   process.stderr.write(`transcodes: ${message}
@@ -185,11 +1244,27 @@ function expiryLine(token) {
     return `unable to decode token: ${err instanceof Error ? err.message : String(err)}`;
   }
 }
-function cmdLogin(token) {
+function cmdSet(args) {
+  let token;
+  let label;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "-l" || arg === "--label") {
+      label = args[++i];
+    } else if (token === void 0) {
+      token = arg;
+    } else {
+      fail(`unexpected argument "${arg}". Usage: transcodes set <token> -l <label>`);
+    }
+  }
   if (!token || !token.trim()) {
-    fail("missing token. Usage: transcodes login <token>");
+    fail("missing token. Usage: transcodes set <token> -l <label>");
+  }
+  if (!label || !label.trim()) {
+    fail("missing label. Usage: transcodes set <token> -l <label>");
   }
   const trimmed = token.trim();
+  const trimmedLabel = label.trim();
   try {
     parseMemberAccessToken(trimmed);
   } catch (err) {
@@ -198,7 +1273,7 @@ function cmdLogin(token) {
     );
   }
   try {
-    writeTokenToFile(trimmed);
+    writeTokenToFile(trimmed, trimmedLabel);
   } catch (err) {
     fail(
       `could not write token file: ${err instanceof Error ? err.message : String(err)}`
@@ -206,20 +1281,36 @@ function cmdLogin(token) {
   }
   process.stdout.write(
     `Saved to ${transcodesConfigFile()}
-  ${expiryLine(trimmed)}
+  label=${trimmedLabel} ${expiryLine(trimmed)}
 `
   );
 }
-function cmdLogout() {
+function cmdReset() {
   clearTokenFile();
-  process.stdout.write(`Removed ${transcodesConfigFile()}
+  process.stdout.write(`Removed all saved tokens (${transcodesConfigFile()})
 `);
 }
+function cmdSetEnabled(enabled) {
+  try {
+    setTrackerEnabled(enabled);
+  } catch (err) {
+    fail(
+      `could not update gate state: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  process.stdout.write(
+    enabled ? "ai-action-tracker gate ENABLED \u2014 danger commands require step-up MFA again.\n" : "ai-action-tracker gate DISABLED \u2014 Bash + MCP tool calls pass without step-up until `transcodes enable`.\n"
+  );
+}
 function cmdStatus() {
+  process.stdout.write(
+    `Gate: ${isTrackerEnabled() ? "enabled" : "DISABLED"}
+`
+  );
   const { token, source } = resolveToken();
   if (source === "none" || !token) {
     process.stdout.write(
-      "No token configured. Run `transcodes login <token>` to set one.\n"
+      "No token configured. Run `transcodes set <token> -l <label>` or `transcodes` to set one.\n"
     );
     return;
   }
@@ -228,25 +1319,88 @@ function cmdStatus() {
   ${expiryLine(token)}
 `);
 }
+function cmdTokens() {
+  const records = readTokenRecords();
+  if (records.length === 0) {
+    process.stdout.write(
+      "No tokens saved. Run `transcodes set <token> -l <label>` or `transcodes` to add one.\n"
+    );
+    return;
+  }
+  const active = readTokenFromFile();
+  process.stdout.write(`Saved tokens (${transcodesConfigFile()}):
+`);
+  for (const { token, label } of records) {
+    const marker = token === active ? "*" : " ";
+    process.stdout.write(`  ${marker} ${label ?? "(no label)"}
+`);
+    process.stdout.write(`      ${expiryLine(token)}
+`);
+  }
+  const envToken = process.env.TRANSCODES_TOKEN?.trim();
+  if (envToken) {
+    process.stdout.write(
+      "\nNote: TRANSCODES_TOKEN is set and overrides the active selection above.\n"
+    );
+  } else {
+    process.stdout.write("\n* = active token used by the plugins/hooks.\n");
+  }
+}
+async function cmdDashboard(args) {
+  let port;
+  let open = true;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--port" && args[i + 1]) {
+      port = Number(args[++i]);
+      if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        fail("--port must be an integer between 1 and 65535");
+      }
+    } else if (args[i] === "--no-open") {
+      open = false;
+    } else {
+      fail(`unknown flag "${args[i]}". Usage: transcodes [--port N] [--no-open]`);
+    }
+  }
+  try {
+    await runDashboard({ port, open });
+  } catch (err) {
+    fail(err instanceof Error ? err.message : String(err));
+  }
+}
 function main() {
   const [command, ...rest] = process.argv.slice(2);
   switch (command) {
-    case "login":
-      cmdLogin(rest[0]);
+    case "set":
+      cmdSet(rest);
+      break;
+    case "reset":
+      cmdReset();
+      break;
+    case "enable":
+      cmdSetEnabled(true);
       break;
-    case "logout":
-      cmdLogout();
+    case "disable":
+      cmdSetEnabled(false);
       break;
     case "status":
       cmdStatus();
       break;
+    case "tokens":
+      cmdTokens();
+      break;
     case "help":
     case "--help":
     case "-h":
-    case void 0:
       process.stdout.write(USAGE);
       break;
+    case void 0:
+      void cmdDashboard([]);
+      break;
     default:
+      if (command.startsWith("-")) {
+        void cmdDashboard([command, ...rest]);
+        break;
+      }
       fail(`unknown command "${command}". Run \`transcodes help\`.`);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bigstrider/transcodes-cli",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Transcodes CLI — manage the ai-action-tracker member token (login/logout/status).",
   "type": "module",
   "bin": {