@cli-remote/local 0.0.6 → 0.3.0

package/dist/index.cjs

@@ -2265,7 +2265,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash } = require("crypto");
+    var { randomBytes: randomBytes3, createHash } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2803,7 +2803,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -9939,10 +9939,10 @@ var require_lib = __commonJS({
 });
 
 // src/index.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var import_node_child_process3 = require("node:child_process");
-var import_node_os6 = require("node:os");
-var import_node_path6 = require("node:path");
+var import_node_os7 = require("node:os");
+var import_node_path7 = require("node:path");
 var import_node_url = require("node:url");
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/wrapper.mjs
@@ -9959,9 +9959,9 @@ var wrapper_default = import_websocket.default;
 // src/client.ts
 var import_node_child_process2 = require("node:child_process");
 var import_node_readline = require("node:readline");
-var import_node_fs3 = require("node:fs");
-var import_node_os5 = require("node:os");
-var import_node_path5 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_os6 = require("node:os");
+var import_node_path6 = require("node:path");
 
 // ../shared/src/codec.ts
 var import_msgpack = __toESM(require_dist(), 1);
@@ -9981,6 +9981,7 @@ var ACCESS_TOKEN_TTL_MS = 60 * 6e4;
 var REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 6e4;
 var REFRESH_MARGIN_MS = 5 * 6e4;
 var OUTPUT_BUFFER_SIZE = 500;
+var AUDIT_RETENTION_DAYS = 14;
 var FILE_CHUNK_SIZE = 64 * 1024;
 var MAX_TRANSFER_BYTES = 500 * 1024 * 1024;
 var UPLOAD_DIR = "uploads";
@@ -9991,59 +9992,6 @@ var CONFIG_FILE = "config.json";
 var LOG_DIR = "logs";
 
 // ../shared/src/whitelist.ts
-var DEFAULT_WHITELIST = [
-  "ls",
-  "cd",
-  "pwd",
-  "cat",
-  "less",
-  "head",
-  "tail",
-  "mkdir",
-  "rmdir",
-  "rm",
-  "cp",
-  "mv",
-  "touch",
-  "find",
-  "stat",
-  "tree",
-  "grep",
-  "awk",
-  "sed",
-  "sort",
-  "uniq",
-  "wc",
-  "cut",
-  "tr",
-  "xargs",
-  "git",
-  "ps",
-  "top",
-  "htop",
-  "kill",
-  "df",
-  "du",
-  "free",
-  "uname",
-  "whoami",
-  "env",
-  "echo",
-  "node",
-  "npm",
-  "pnpm",
-  "yarn",
-  "python",
-  "python3",
-  "pip",
-  "go",
-  "cargo",
-  "make",
-  "docker",
-  "claude",
-  "codex",
-  "kimi-cli"
-];
 var DANGEROUS_PATTERNS = [
   /\brm\s+-[rfRF]+\s+\/(\s|$)/,
   /\bsudo\b/,
@@ -10054,6 +10002,9 @@ var DANGEROUS_PATTERNS = [
   /\bshutdown\b/,
   /\breboot\b/
 ];
+function findDangerousPattern(line) {
+  return DANGEROUS_PATTERNS.find((p) => p.test(line));
+}
 
 // src/pty-manager.ts
 var import_node_pty = require("node-pty");
@@ -10186,20 +10137,55 @@ var PtyManager = class {
 var import_node_fs = require("node:fs");
 var import_node_os2 = require("node:os");
 var import_node_path2 = require("node:path");
+function logRoot() {
+  return (0, import_node_path2.join)((0, import_node_os2.homedir)(), DEFAULT_CONFIG_DIR, LOG_DIR);
+}
 function todayDir() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
+function pruneAuditLogs(retentionDays) {
+  if (retentionDays <= 0) return 0;
+  const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 6e4).toISOString().slice(0, 10);
+  let removed = 0;
+  let entries;
+  try {
+    entries = (0, import_node_fs.readdirSync)(logRoot());
+  } catch {
+    return 0;
+  }
+  for (const name of entries) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(name)) continue;
+    if (name >= cutoff) continue;
+    try {
+      (0, import_node_fs.rmSync)((0, import_node_path2.join)(logRoot(), name), { recursive: true, force: true });
+      removed++;
+    } catch {
+    }
+  }
+  return removed;
+}
 var SessionLogger = class {
-  path;
-  closed = false;
-  constructor(sessionId, cmd) {
-    const dir = (0, import_node_path2.join)((0, import_node_os2.homedir)(), DEFAULT_CONFIG_DIR, LOG_DIR, todayDir());
-    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+  constructor(sessionId, cmd, mode = "full") {
+    this.mode = mode;
+    if (mode === "off") {
+      this.path = "";
+      return;
+    }
+    const dir = (0, import_node_path2.join)(logRoot(), todayDir());
+    (0, import_node_fs.mkdirSync)(dir, { recursive: true, mode: 448 });
+    try {
+      (0, import_node_fs.chmodSync)(dir, 448);
+    } catch {
+    }
     this.path = (0, import_node_path2.join)(dir, `${sessionId}.log`);
-    this.write({ ts: Date.now(), event: "spawn", cmd });
+    (0, import_node_fs.appendFileSync)(this.path, "", { mode: 384 });
+    (0, import_node_fs.chmodSync)(this.path, 384);
+    this.write({ ts: Date.now(), event: "spawn", cmd, mode });
   }
+  path;
+  closed = false;
   logInput(data) {
-    if (this.closed) return;
+    if (this.closed || this.mode === "off") return;
     this.write({
       ts: Date.now(),
       dir: "in",
@@ -10208,7 +10194,7 @@ var SessionLogger = class {
     });
   }
   logOutput(data) {
-    if (this.closed) return;
+    if (this.closed || this.mode !== "full") return;
     this.write({
       ts: Date.now(),
       dir: "out",
@@ -10217,119 +10203,40 @@ var SessionLogger = class {
     });
   }
   logRejected(cmd, reason, dangerous) {
-    if (this.closed) return;
+    if (this.closed || this.mode === "off") return;
     this.write({ ts: Date.now(), event: "rejected", cmd, reason, dangerous });
   }
   logForced(cmd) {
-    if (this.closed) return;
+    if (this.closed || this.mode === "off") return;
     this.write({ ts: Date.now(), event: "forced", cmd });
   }
   logExit(code) {
-    if (this.closed) return;
+    if (this.closed || this.mode === "off") return;
     this.write({ ts: Date.now(), event: "exit", code });
     this.closed = true;
   }
   write(record) {
+    if (!this.path) return;
     try {
-      (0, import_node_fs.appendFileSync)(this.path, JSON.stringify(record) + "\n", { encoding: "utf-8" });
+      (0, import_node_fs.appendFileSync)(this.path, JSON.stringify(record) + "\n", { encoding: "utf-8", mode: 384 });
     } catch {
     }
   }
 };
 
 // src/whitelist-checker.ts
-function splitCommands(line) {
-  const parts = [];
-  let current = "";
-  let inSingle = false;
-  let inDouble = false;
-  for (let i = 0; i < line.length; i++) {
-    const c = line[i];
-    if (c === "'" && !inDouble) {
-      inSingle = !inSingle;
-      current += c;
-      continue;
-    }
-    if (c === '"' && !inSingle) {
-      inDouble = !inDouble;
-      current += c;
-      continue;
-    }
-    if (!inSingle && !inDouble) {
-      const next = line[i + 1];
-      if (c === "&" && next === "&") {
-        parts.push(current);
-        current = "";
-        i++;
-        continue;
-      }
-      if (c === "|" && next === "|") {
-        parts.push(current);
-        current = "";
-        i++;
-        continue;
-      }
-      if (c === ";" || c === "|") {
-        parts.push(current);
-        current = "";
-        continue;
-      }
-    }
-    current += c;
-  }
-  if (current.trim()) parts.push(current);
-  return parts;
-}
-function firstToken(cmd) {
-  const trimmed = cmd.trim();
-  if (!trimmed) return null;
-  const tokens = trimmed.split(/\s+/);
-  for (const t of tokens) {
-    if (!t) continue;
-    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) continue;
-    return t;
-  }
-  return null;
-}
-function checkCommand(line, whitelist, dangerousPatterns = DANGEROUS_PATTERNS) {
+function checkCommand(line, dangerConfirm) {
   const trimmed = line.trim();
-  if (!trimmed) return { allowed: true };
-  if (line.includes("$(") || line.includes("`")) {
-    return {
-      allowed: false,
-      rejectedCmd: trimmed,
-      reason: "\u5305\u542B\u547D\u4EE4\u66FF\u6362 ($() \u6216 `)\uFF0C\u5DF2\u88AB\u7981\u6B62"
-    };
-  }
-  if (trimmed.startsWith("(")) {
+  if (!trimmed || !dangerConfirm) return { allowed: true };
+  const pattern = findDangerousPattern(trimmed);
+  if (pattern) {
     return {
       allowed: false,
       rejectedCmd: trimmed,
-      reason: "\u5305\u542B\u5B50 shell ( )\uFF0C\u5DF2\u88AB\u7981\u6B62"
+      reason: "\u5339\u914D\u5371\u9669\u547D\u4EE4\u6A21\u5F0F\uFF0C\u8BF7\u4E8C\u6B21\u786E\u8BA4",
+      dangerous: true
     };
   }
-  for (const p of dangerousPatterns) {
-    if (p.test(line)) {
-      return {
-        allowed: false,
-        rejectedCmd: trimmed,
-        reason: "\u5339\u914D\u5371\u9669\u547D\u4EE4\u6A21\u5F0F",
-        dangerous: true
-      };
-    }
-  }
-  const segments = splitCommands(line);
-  for (const seg of segments) {
-    const cmd = firstToken(seg);
-    if (!cmd) continue;
-    if (!whitelist.has(cmd)) {
-      return {
-        allowed: false,
-        rejectedCmd: cmd,
-        reason: `"${cmd}" \u4E0D\u5728\u767D\u540D\u5355`
-      };
-    }
-  }
   return { allowed: true };
 }
 
@@ -10510,15 +10417,199 @@ async function exists(p) {
   }
 }
 
+// src/gateway-api.ts
+var import_node_http = require("node:http");
+var import_node_fs3 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path4 = require("node:path");
+var DEFAULT_API_PORT = 18790;
+function apiPortFromEnv() {
+  return Number(process.env.CLI_LOCAL_API_PORT) || DEFAULT_API_PORT;
+}
+function readConfiguredPort() {
+  if (process.env.CLI_LOCAL_API_PORT) return apiPortFromEnv();
+  try {
+    const cfg = JSON.parse(
+      (0, import_node_fs3.readFileSync)((0, import_node_path4.join)((0, import_node_os4.homedir)(), DEFAULT_CONFIG_DIR, "config.json"), "utf-8")
+    );
+    return Number(cfg.gateway?.apiPort) || DEFAULT_API_PORT;
+  } catch {
+    return DEFAULT_API_PORT;
+  }
+}
+function startControlApi(opts) {
+  const server = (0, import_node_http.createServer)((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const route = `${req.method} ${url.pathname}`;
+    const json = (code, body) => {
+      res.writeHead(code, { "content-type": "application/json" });
+      res.end(JSON.stringify(body));
+    };
+    if (route === "GET /healthz") return json(200, { ok: true });
+    if (route === "GET /status") return json(200, opts.getStatus());
+    if (route === "GET /sessions") {
+      return json(200, { sessions: opts.getStatus().sessions });
+    }
+    if (route === "GET /logs") {
+      const n = Math.min(500, Math.max(1, Number(url.searchParams.get("n")) || 200));
+      const lines = opts.getLogs().slice(-n);
+      return json(200, { lines });
+    }
+    if (route === "POST /stop") {
+      json(200, { ok: true });
+      opts.onStop();
+      return;
+    }
+    const killMatch = /^POST \/sessions\/([\w-]+)\/kill$/.exec(`${req.method} ${url.pathname}`);
+    if (killMatch) {
+      const ok = opts.killSession(killMatch[1]);
+      return json(ok ? 200 : 404, ok ? { ok: true } : { ok: false, error: "no such session" });
+    }
+    json(404, { error: "not found" });
+  });
+  server.listen(opts.port, "127.0.0.1");
+  return {
+    port: opts.port,
+    close: () => server.close()
+  };
+}
+async function apiGet(port, path, timeoutMs = 800) {
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+      signal: ctrl.signal
+    });
+    clearTimeout(timer);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function apiPost(port, path, timeoutMs = 800) {
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, {
+      method: "POST",
+      signal: ctrl.signal
+    });
+    clearTimeout(timer);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+// src/setup-callback.ts
+var import_node_http2 = require("node:http");
+var import_node_crypto = require("node:crypto");
+var BODY_LIMIT = 64 * 1024;
+function startSetupCallback(timeoutMs = 3 * 6e4) {
+  return new Promise((resolveStart, rejectStart) => {
+    const chan = (0, import_node_crypto.randomBytes)(8).toString("hex");
+    let timer = null;
+    let settled = false;
+    let server = null;
+    const cors = {
+      "access-control-allow-origin": "*",
+      "access-control-allow-methods": "POST, OPTIONS",
+      "access-control-allow-headers": "content-type",
+      "access-control-allow-private-network": "true",
+      "access-control-max-age": "600"
+    };
+    const done = new Promise((resolve2, reject) => {
+      timer = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        stop();
+        reject(new Error("\u7B49\u5F85\u7F51\u9875\u56DE\u8C03\u8D85\u65F6"));
+      }, timeoutMs);
+      function stop() {
+        if (timer) clearTimeout(timer);
+        server?.close();
+      }
+      function finish(fn) {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        server?.close();
+        fn();
+      }
+      const tryPort = (port) => {
+        if (port > 18802) {
+          rejectStart(new Error("no free port for the setup callback"));
+          return;
+        }
+        const s = (0, import_node_http2.createServer)((req, res) => {
+          const reply = (code, body) => {
+            res.writeHead(code, { "content-type": "application/json", ...cors });
+            res.end(JSON.stringify(body));
+          };
+          if (req.method === "OPTIONS") {
+            reply(204, {});
+            return;
+          }
+          if (req.method !== "POST" || !req.url?.startsWith("/setup")) {
+            reply(404, { ok: false, error: "not found" });
+            return;
+          }
+          let size = 0;
+          const chunks = [];
+          req.on("data", (c) => {
+            size += c.length;
+            if (size > BODY_LIMIT) {
+              req.destroy();
+              return;
+            }
+            chunks.push(c);
+          });
+          req.on("end", () => {
+            try {
+              const body = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+              if (body.chan !== chan || !body.registrationKey) {
+                reply(400, { ok: false, error: "bad request" });
+                return;
+              }
+              reply(200, { ok: true });
+              const key = body.registrationKey;
+              finish(() => resolve2(key));
+            } catch {
+              reply(400, { ok: false, error: "bad request" });
+            }
+          });
+        });
+        s.once("error", () => {
+          s.close();
+          tryPort(port + 1);
+        });
+        s.listen(port, "127.0.0.1", () => {
+          server = s;
+          resolveStart({
+            port,
+            chan,
+            done,
+            stop: () => {
+              finish(() => reject(new Error("callback stopped")));
+            }
+          });
+        });
+      };
+      tryPort(18793);
+    });
+  });
+}
+
 // src/auth.ts
 var import_node_child_process = require("node:child_process");
-var import_node_crypto = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 var import_promises2 = require("node:fs/promises");
-var import_node_os4 = require("node:os");
-var import_node_path4 = require("node:path");
+var import_node_os5 = require("node:os");
+var import_node_path5 = require("node:path");
 var import_qrcode = __toESM(require_lib(), 1);
 function credentialsPath() {
-  return (0, import_node_path4.join)((0, import_node_os4.homedir)(), DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
+  return (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
 }
 async function loadCredentials() {
   try {
@@ -10531,19 +10622,13 @@ async function loadCredentials() {
 }
 async function saveCredentials(creds) {
   const path = credentialsPath();
-  await (0, import_promises2.mkdir)((0, import_node_path4.join)(path, ".."), { recursive: true });
+  await (0, import_promises2.mkdir)((0, import_node_path5.join)(path, ".."), { recursive: true });
   await (0, import_promises2.writeFile)(path, JSON.stringify(creds, null, 2) + "\n", { mode: 384 });
   try {
     await (0, import_promises2.chmod)(path, 384);
   } catch {
   }
 }
-async function clearCredentials() {
-  try {
-    await (0, import_promises2.writeFile)(credentialsPath(), "");
-  } catch {
-  }
-}
 function baseUrlFromWsUrl(wsUrl) {
   const http = wsUrl.replace(/^ws/, "http");
   try {
@@ -10588,8 +10673,8 @@ async function loginAndFetchRegistrationKey(baseUrl, email, password) {
   return { registrationKey: data.registrationKey, user: data.user?.email ?? email };
 }
 async function mergeLocalConfig(patch) {
-  const dir = (0, import_node_path4.join)((0, import_node_os4.homedir)(), DEFAULT_CONFIG_DIR);
-  const path = (0, import_node_path4.join)(dir, CONFIG_FILE);
+  const dir = (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR);
+  const path = (0, import_node_path5.join)(dir, CONFIG_FILE);
   let existing = {};
   try {
     existing = JSON.parse(await (0, import_promises2.readFile)(path, "utf-8"));
@@ -10610,7 +10695,7 @@ async function deviceFlowAuthorize(baseUrl, registrationKey, deviceId) {
   const res = await postJson(`${baseUrl}/oauth/device_authorization`, {
     registrationKey,
     device_id: deviceId,
-    device_name: (0, import_node_os4.hostname)(),
+    device_name: (0, import_node_os5.hostname)(),
     platform: process.platform
   });
   if (res.status !== 200) {
@@ -10699,6 +10784,20 @@ async function ensureFreshAccessToken(baseUrl, creds) {
   }
   return refreshInFlight;
 }
+async function ensureMachineId() {
+  const path = (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR, CONFIG_FILE);
+  try {
+    const cfg = JSON.parse(await (0, import_promises2.readFile)(path, "utf-8"));
+    if (typeof cfg.machineId === "string" && cfg.machineId) return cfg.machineId;
+  } catch {
+  }
+  const machineId = "m_" + (0, import_node_crypto2.randomBytes)(16).toString("hex");
+  await mergeLocalConfig({ machineId });
+  return machineId;
+}
+async function stableDeviceId() {
+  return "dev_" + await ensureMachineId();
+}
 async function ensureCredentials(baseUrl, registrationKey) {
   const existing = await loadCredentials();
   if (existing) {
@@ -10708,23 +10807,31 @@ async function ensureCredentials(baseUrl, registrationKey) {
       console.error(`[local] ${e.message}\uFF0C\u91CD\u65B0\u8D70\u6388\u6743\u6D41\u7A0B`);
     }
   }
-  return deviceFlowAuthorize(baseUrl, registrationKey, "dev_" + (0, import_node_crypto.randomUUID)());
+  return deviceFlowAuthorize(baseUrl, registrationKey, await stableDeviceId());
 }
 
 // src/client.ts
+function isPermanentAuthFailure(e) {
+  return e instanceof AuthError && e.message.includes("invalid_grant");
+}
 async function loadConfig() {
-  const path = (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR, CONFIG_FILE);
+  const path = (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, CONFIG_FILE);
   try {
-    return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf-8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf-8"));
   } catch {
     return {};
   }
 }
-function buildWhitelist(cfg) {
-  const set = new Set(DEFAULT_WHITELIST);
-  cfg.whitelist?.add?.forEach((c) => set.add(c));
-  cfg.whitelist?.remove?.forEach((c) => set.delete(c));
-  return set;
+function applyConfigDeprecations(cfg) {
+  if (cfg.whitelist) {
+    console.log(
+      '[local] config "whitelist" \u5DF2\u5E9F\u5F03\uFF08v0.4\uFF09\uFF1Abash \u5168\u900F\u4F20\uFF0C\u4E0D\u518D\u6709\u767D\u540D\u5355\u3002\u5982\u9700\u5371\u9669\u547D\u4EE4\u4E8C\u6B21\u786E\u8BA4\uFF0C\u8BBE\u7F6E dangerConfirm: true'
+    );
+  }
+  if (cfg.auditMode && !["full", "commands", "off"].includes(cfg.auditMode)) {
+    console.log(`[local] \u65E0\u6548\u7684 auditMode "${cfg.auditMode}"\uFF0C\u56DE\u9000 full`);
+    cfg.auditMode = "full";
+  }
 }
 function isTTY() {
   return process.stdin.isTTY === true;
@@ -10794,19 +10901,18 @@ async function setupWizard(config, opts) {
       console.log("[local] \u5F53\u524D\u975E\u4EA4\u4E92\u7EC8\u7AEF\uFF1A\u62FF\u5230 key \u540E\u5199\u5165 ~/.cli-remote/config.json \u518D\u8FD0\u884C\u3002");
       return null;
     }
-    console.log("  1) \u767B\u5F55\u8D26\u53F7\u81EA\u52A8\u83B7\u53D6\uFF08\u63A8\u8350\uFF09");
-    console.log("  2) \u4ECE\u7F51\u9875\u300C\u63A7\u5236\u9762\u677F\u300D\u590D\u5236\u7C98\u8D34");
+    console.log("  1) \u901A\u8FC7\u7F51\u9875\u767B\u5F55\u83B7\u53D6\uFF08\u63A8\u8350\uFF0C\u81EA\u52A8\u5B8C\u6210\uFF0C\u65E0\u9700\u590D\u5236\u7C98\u8D34\uFF09");
+    console.log("  2) \u76F4\u63A5\u8F93\u5165 registrationKey");
+    console.log("  3) \u5728\u6B64\u8F93\u5165\u8D26\u53F7\u5BC6\u7801\u83B7\u53D6");
     const mode = (await readInput("\u9009\u62E9 [1]: ")).trim();
     if (mode === "2") {
-      openBrowser(base);
-      console.log(`[local] \u5DF2\u6253\u5F00\u6D4F\u89C8\u5668\uFF0C\u8BF7\u767B\u5F55 ${base} \u5E76\u5728\u300C\u63A7\u5236\u9762\u677F\u300D\u9875\u590D\u5236 registrationKey`);
       const ans = (await readInput("\u7C98\u8D34 registrationKey: ")).trim();
       if (!ans) {
         console.log("[local] \u672A\u63D0\u4F9B registrationKey\uFF0C\u9000\u51FA\u3002");
         return null;
       }
       registrationKey = ans;
-    } else {
+    } else if (mode === "3") {
       for (; ; ) {
         const email = (await readInput("\u90AE\u7BB1: ")).trim();
         const password = (await readInput("\u5BC6\u7801: ")).trim();
@@ -10824,6 +10930,26 @@ async function setupWizard(config, opts) {
           console.log("[local] \u91CD\u8BD5\uFF08\u6216 Ctrl+C \u9000\u51FA\uFF09\u3002");
         }
       }
+    } else {
+      const cb = await startSetupCallback();
+      const setupUrl = `${base}/local-setup?port=${cb.port}&chan=${cb.chan}`;
+      console.log(`[local] \u5DF2\u6253\u5F00\u6D4F\u89C8\u5668\uFF1A${setupUrl}`);
+      console.log("[local] \u672A\u767B\u5F55\u65F6\u4F1A\u5148\u8FDB\u5165\u767B\u5F55\u9875\uFF0C\u767B\u5F55\u540E\u81EA\u52A8\u7EE7\u7EED\uFF0C\u65E0\u9700\u56DE\u5230\u7EC8\u7AEF");
+      openBrowser(setupUrl);
+      try {
+        registrationKey = await cb.done;
+        console.log("[local] \u5DF2\u4ECE\u7F51\u9875\u83B7\u53D6 registrationKey");
+      } catch {
+        console.log("[local] \u672A\u6536\u5230\u7F51\u9875\u56DE\u8C03\uFF0C\u53EF\u624B\u52A8\u7C98\u8D34 registrationKey\uFF08\u56DE\u8F66\u8DF3\u8FC7\u9000\u51FA\uFF09\uFF1A");
+        const ans = (await readInput("registrationKey: ")).trim();
+        if (!ans) {
+          cb.stop();
+          console.log("[local] \u672A\u63D0\u4F9B registrationKey\uFF0C\u9000\u51FA\u3002");
+          return null;
+        }
+        registrationKey = ans;
+      }
+      cb.stop();
     }
     changed = true;
   }
@@ -10844,7 +10970,10 @@ async function startLocal(opts = {}) {
     registrationKey = setup.registrationKey;
   }
   const baseUrl = baseUrlFromWsUrl(url);
-  const whitelist = buildWhitelist(config);
+  applyConfigDeprecations(config);
+  const dangerConfirm = config.dangerConfirm === true;
+  const auditMode = config.auditMode ?? "full";
+  const retentionDays = config.auditRetentionDays ?? AUDIT_RETENTION_DAYS;
   const pty = new PtyManager();
   const loggers = /* @__PURE__ */ new Map();
   const lineBuffers = /* @__PURE__ */ new Map();
@@ -10852,17 +10981,130 @@ async function startLocal(opts = {}) {
     (data) => safeSend(data),
     (msg) => console.log(`[local] ${msg}`)
   );
-  let credentials = await ensureCredentials(baseUrl, registrationKey);
+  const other = acquireSingleInstanceLock();
+  if (other !== null) {
+    console.error(`[local] \u53E6\u4E00\u4E2A cli-local \u6B63\u5728\u8FD0\u884C (pid ${other})\uFF0C\u62D2\u7EDD\u53CC\u5F00\u3002`);
+    console.error("[local] \u53CC\u5F00\u4F1A\u4E92\u76F8\u5237\u65B0 token \u5BFC\u81F4\u8BBE\u5907\u88AB\u670D\u52A1\u7AEF\u540A\u9500\u3002");
+    console.error("[local] \u540E\u53F0\u5E38\u9A7B\u8BF7\u7528: cli-local gateway start / restart / status");
+    process.exit(1);
+  }
+  const startedAt = Date.now();
+  const logRing = [];
+  if (opts.daemon) {
+    writeGatewayPid();
+    patchConsoleIntoRing(logRing);
+  }
+  let credentials;
+  if (opts.daemon) {
+    const existing = await loadCredentials();
+    if (!existing) {
+      credentials = {
+        deviceId: "",
+        accessToken: "",
+        refreshToken: "",
+        accessTokenExpiresAt: 0
+      };
+    } else {
+      credentials = existing;
+      try {
+        credentials = await ensureFreshAccessToken(baseUrl, existing);
+      } catch {
+      }
+    }
+  } else {
+    credentials = await ensureCredentials(baseUrl, registrationKey);
+  }
   const commands = detectCommands();
-  if (opts.daemon) writeGatewayPid();
   console.log(`[local] connecting to ${url}`);
-  console.log(`[local] deviceId=${credentials.deviceId}`);
-  console.log(`[local] whitelist: ${whitelist.size} commands`);
+  console.log(`[local] deviceId=${credentials.deviceId || "(\u672A\u6388\u6743)"}`);
+  console.log(`[local] bash: passthrough (audit: ${auditMode}, retention: ${retentionDays === 0 ? "forever" : retentionDays + "d"}${dangerConfirm ? ", dangerConfirm: on" : ""})`);
   console.log(`[local] available CLIs: ${commands.join(", ")}`);
+  const pruned = pruneAuditLogs(retentionDays);
+  if (pruned > 0) console.log(`[local] pruned ${pruned} expired audit log dir(s)`);
+  const pruneTimer = setInterval(() => {
+    const n = pruneAuditLogs(retentionDays);
+    if (n > 0) console.log(`[local] pruned ${n} expired audit log dir(s)`);
+  }, 24 * 60 * 6e4);
+  pruneTimer.unref?.();
+  let phase = "starting";
+  let phaseReason = "";
+  let reconnectAttempts = 0;
+  const getStatus = () => ({
+    phase,
+    ...phaseReason ? { reason: phaseReason } : {},
+    deviceId: credentials.deviceId || null,
+    hubUrl: url,
+    uptimeMs: Date.now() - startedAt,
+    reconnectAttempts,
+    accessTokenExpiresAt: credentials.accessTokenExpiresAt || null,
+    sessions: pty.list().map((s) => ({
+      sessionId: s.id,
+      cmd: s.cmd,
+      startedAt: s.startedAt
+    }))
+  });
+  function setPhase(p, reason = "") {
+    phase = p;
+    phaseReason = reason;
+  }
+  let pairingTimer = null;
+  let pairingCredMtime = 0;
+  function enterNeedsPairing(reason) {
+    setPhase("needs-pairing", reason);
+    console.error(`[local] \u9700\u8981\u91CD\u65B0\u6388\u6743: ${reason}`);
+    console.error("[local] \u5728\u4EFB\u610F\u7EC8\u7AEF\u8FD0\u884C: cli-local pair");
+    console.error("[local] \uFF08\u672C\u8FDB\u7A0B\u4FDD\u6301\u8FD0\u884C\uFF0CPTY \u4F1A\u8BDD\u4FDD\u6D3B\uFF1B\u914D\u5BF9\u5B8C\u6210\u540E\u81EA\u52A8\u91CD\u8FDE\uFF09");
+    if (pairingTimer) return;
+    try {
+      pairingCredMtime = (0, import_node_fs4.statSync)(credentialsPathOf()).mtimeMs;
+    } catch {
+      pairingCredMtime = 0;
+    }
+    pairingTimer = setInterval(async () => {
+      let mtime;
+      try {
+        mtime = (0, import_node_fs4.statSync)(credentialsPathOf()).mtimeMs;
+      } catch {
+        return;
+      }
+      if (mtime <= pairingCredMtime) return;
+      const fresh = await loadCredentials();
+      if (!fresh?.deviceId || !fresh?.refreshToken) return;
+      pairingCredMtime = mtime;
+      credentials = fresh;
+      console.log("[local] \u68C0\u6D4B\u5230\u65B0\u51ED\u8BC1\uFF0C\u91CD\u8FDE\u4E2D\u2026");
+      if (pairingTimer) clearInterval(pairingTimer);
+      pairingTimer = null;
+      reconnectAttempts = 0;
+      setPhase("connecting");
+      connect();
+    }, 2e3);
+  }
+  let controlApi = null;
+  if (opts.daemon) {
+    const port = readConfiguredPort();
+    controlApi = startControlApi({
+      port,
+      getStatus,
+      getLogs: () => [...logRing],
+      onStop: () => {
+        console.log("[local] \u6536\u5230\u505C\u6B62\u6307\u4EE4\uFF08\u63A7\u5236 API\uFF09");
+        exitProcess(0);
+      },
+      killSession: (id) => {
+        try {
+          pty.kill(id);
+          return true;
+        } catch {
+          return false;
+        }
+      }
+    });
+    console.log(`[local] control api: http://127.0.0.1:${port} (\u4EC5\u672C\u673A)`);
+  }
   let ws = null;
   let heartbeatTimer = null;
   let reconnectTimer = null;
-  let reconnectAttempts = 0;
   let userExitCode = null;
   function stopHeartbeat() {
     if (heartbeatTimer) clearInterval(heartbeatTimer);
@@ -10885,6 +11127,7 @@ async function startLocal(opts = {}) {
     ws = sock;
     sock.on("open", () => {
       console.log("[local] connected");
+      if (phase !== "needs-pairing") setPhase("connecting");
       sendAuth();
       stopHeartbeat();
       heartbeatTimer = setInterval(() => {
@@ -10901,6 +11144,7 @@ async function startLocal(opts = {}) {
         process.exit(userExitCode);
       }
       console.log("[local] disconnected; PTY sessions kept alive, reconnecting\u2026");
+      if (phase !== "needs-pairing") setPhase("reconnecting");
       scheduleReconnect();
     });
     sock.on("error", (err) => {
@@ -10909,6 +11153,7 @@ async function startLocal(opts = {}) {
   }
   async function scheduleReconnect() {
     if (reconnectTimer || userExitCode !== null) return;
+    if (phase === "needs-pairing") return;
     const idx = Math.min(reconnectAttempts, RECONNECT_DELAYS_MS.length - 1);
     const delay = RECONNECT_DELAYS_MS[idx];
     reconnectAttempts++;
@@ -10918,11 +11163,13 @@ async function startLocal(opts = {}) {
       ensureFreshAccessToken(baseUrl, credentials).then((creds) => {
         credentials = creds;
         connect();
-      }).catch(async (e) => {
-        await clearCredentials();
-        console.error(`[local] ${e.message}`);
-        console.error("[local] \u51ED\u8BC1\u5DF2\u5931\u6548\u5E76\u6E05\u9664\uFF1B\u8BF7\u91CD\u65B0\u8FD0\u884C cli-local \u5B8C\u6210\u6388\u6743");
-        exitProcess(1);
+      }).catch((e) => {
+        if (isPermanentAuthFailure(e)) {
+          enterNeedsPairing(e.message);
+          return;
+        }
+        console.error(`[local] token \u5237\u65B0\u6682\u65F6\u5931\u8D25: ${e.message}`);
+        scheduleReconnect();
       });
     }, delay);
   }
@@ -10930,6 +11177,9 @@ async function startLocal(opts = {}) {
     userExitCode = code;
     if (reconnectTimer) clearTimeout(reconnectTimer);
     reconnectTimer = null;
+    if (pairingTimer) clearInterval(pairingTimer);
+    pairingTimer = null;
+    controlApi?.close();
     if (opts.daemon) removeGatewayPid();
     transfers.abortAll();
     pty.killAll();
@@ -10959,6 +11209,7 @@ async function startLocal(opts = {}) {
           console.log(`[local] reconnected after ${reconnectAttempts} attempt(s); ${pty.list().length} PTY session(s) alive`);
         }
         reconnectAttempts = 0;
+        setPhase("connected");
         console.log(`[local] auth ok, deviceId=${frame.channelId}`);
         break;
       case "auth-err":
@@ -11001,25 +11252,31 @@ async function startLocal(opts = {}) {
     }
   }
   async function handleAuthErr(reason) {
-    if (reason === "access token expired") {
+    if (reason === "access token expired" || reason === "invalid access token") {
       try {
         credentials = await ensureFreshAccessToken(baseUrl, credentials);
         console.log("[local] token refreshed, retrying auth");
         sendAuth();
         return;
       } catch (e) {
-        console.error(`[local] ${e.message}`);
+        if (isPermanentAuthFailure(e)) {
+          enterNeedsPairing(e.message);
+          return;
+        }
+        console.error(`[local] token \u5237\u65B0\u6682\u65F6\u5931\u8D25\uFF08${e.message}\uFF09\uFF0C\u8F6C\u5165\u91CD\u8FDE`);
+        try {
+          ws?.close();
+        } catch {
+        }
+        return;
       }
     }
-    await clearCredentials();
-    console.error("[local] auth failed:", reason);
-    console.error("[local] \u51ED\u8BC1\u5DF2\u6E05\u9664\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C cli-local \u5B8C\u6210\u6388\u6743");
-    exitProcess(1);
+    enterNeedsPairing(reason);
   }
   function handleSpawn(frame) {
     const sessionId = frame.sessionId;
     try {
-      const logger = new SessionLogger(sessionId, frame.cmd);
+      const logger = new SessionLogger(sessionId, frame.cmd, auditMode);
       pty.spawn(
         sessionId,
         { cmd: frame.cmd, cols: frame.cols, rows: frame.rows, cwd: frame.cwd },
@@ -11097,7 +11354,7 @@ async function startLocal(opts = {}) {
       if (char === "\r" || char === "\n") {
         const line = buf;
         buf = "";
-        const result = checkCommand(line, whitelist);
+        const result = checkCommand(line, dangerConfirm);
         if (result.allowed) {
           ptyWriteChar(sessionId, "\r");
           logger.logInput(new TextEncoder().encode(line + "\r"));
@@ -11160,7 +11417,57 @@ async function startLocal(opts = {}) {
   }
   process.on("SIGINT", () => cleanup(0));
   process.on("SIGTERM", () => cleanup(0));
-  connect();
+  if (credentials.deviceId) {
+    setPhase("connecting");
+    connect();
+  } else {
+    enterNeedsPairing("\u65E0\u51ED\u8BC1\uFF08credentials.json \u7F3A\u5931\u6216\u4E3A\u7A7A\uFF09");
+  }
+}
+function credentialsPathOf() {
+  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "credentials.json");
+}
+function instanceLockPath() {
+  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "instance.lock");
+}
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function acquireSingleInstanceLock() {
+  const path = instanceLockPath();
+  try {
+    const pid = Number((0, import_node_fs4.readFileSync)(path, "utf-8").trim());
+    if (Number.isFinite(pid) && pid !== process.pid && processAlive(pid)) {
+      return pid;
+    }
+  } catch {
+  }
+  try {
+    (0, import_node_fs4.mkdirSync)((0, import_node_path6.join)(path, ".."), { recursive: true });
+    (0, import_node_fs4.writeFileSync)(path, String(process.pid));
+  } catch {
+  }
+  return null;
+}
+function patchConsoleIntoRing(ring) {
+  const CAP = 500;
+  const push = (line) => {
+    ring.push(line);
+    if (ring.length > CAP) ring.splice(0, ring.length - CAP);
+  };
+  const wrap = (orig) => {
+    return (...args) => {
+      push(args.map((a) => typeof a === "string" ? a : String(a)).join(" "));
+      orig(...args);
+    };
+  };
+  console.log = wrap(console.log.bind(console));
+  console.error = wrap(console.error.bind(console));
 }
 function toUint8(raw) {
   if (raw instanceof Buffer) return new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength);
@@ -11171,21 +11478,21 @@ function toUint8(raw) {
   throw new Error("unexpected raw type");
 }
 function gatewayPidFile() {
-  return (0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid");
+  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid");
 }
 function writeGatewayPid() {
-  (0, import_node_fs3.mkdirSync)((0, import_node_path5.join)((0, import_node_os5.homedir)(), DEFAULT_CONFIG_DIR), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(gatewayPidFile(), String(process.pid));
+  (0, import_node_fs4.mkdirSync)((0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR), { recursive: true });
+  (0, import_node_fs4.writeFileSync)(gatewayPidFile(), String(process.pid));
 }
 function removeGatewayPid() {
   try {
-    (0, import_node_fs3.rmSync)(gatewayPidFile());
+    (0, import_node_fs4.rmSync)(gatewayPidFile());
   } catch {
   }
 }
 function gatewayPid() {
   try {
-    const pid = Number((0, import_node_fs3.readFileSync)(gatewayPidFile(), "utf-8").trim());
+    const pid = Number((0, import_node_fs4.readFileSync)(gatewayPidFile(), "utf-8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
@@ -11219,15 +11526,15 @@ function resolveHere() {
     if (DEBUG) console.error("[debug] cannot resolve script path");
     return;
   }
-  const hereDir = (0, import_node_path6.dirname)(here);
+  const hereDir = (0, import_node_path7.dirname)(here);
   const candidates = [
-    (0, import_node_path6.join)(hereDir, "..", "node_modules", "node-pty", "prebuilds"),
-    (0, import_node_path6.join)(hereDir, "..", "..", "node-pty", "prebuilds"),
-    (0, import_node_path6.join)(hereDir, "..", "..", "..", "node_modules", "node-pty", "prebuilds")
+    (0, import_node_path7.join)(hereDir, "..", "node_modules", "node-pty", "prebuilds"),
+    (0, import_node_path7.join)(hereDir, "..", "..", "node-pty", "prebuilds"),
+    (0, import_node_path7.join)(hereDir, "..", "..", "..", "node_modules", "node-pty", "prebuilds")
   ];
   let prebuildsDir = null;
   for (const c of candidates) {
-    if ((0, import_node_fs4.existsSync)(c)) {
+    if ((0, import_node_fs5.existsSync)(c)) {
       prebuildsDir = c;
       break;
     }
@@ -11237,11 +11544,11 @@ function resolveHere() {
     return;
   }
   let n = 0;
-  for (const sub of (0, import_node_fs4.readdirSync)(prebuildsDir)) {
-    const helper = (0, import_node_path6.join)(prebuildsDir, sub, "spawn-helper");
-    if ((0, import_node_fs4.existsSync)(helper)) {
+  for (const sub of (0, import_node_fs5.readdirSync)(prebuildsDir)) {
+    const helper = (0, import_node_path7.join)(prebuildsDir, sub, "spawn-helper");
+    if ((0, import_node_fs5.existsSync)(helper)) {
       try {
-        (0, import_node_fs4.chmodSync)(helper, 493);
+        (0, import_node_fs5.chmodSync)(helper, 493);
         n++;
       } catch {
       }
@@ -11252,49 +11559,56 @@ function resolveHere() {
 var argUrl = process.argv[2];
 var argMatch = argUrl && (argUrl.startsWith("ws://") || argUrl.startsWith("wss://"));
 if (argUrl && !argMatch && (argUrl === "-h" || argUrl === "--help" || argUrl === "help")) {
-  console.log(`cli-local \u2014 local PTY agent for cli-remote
+  console.log(`cli-local \u2014 local PTY agent for cli-remote (gateway \u5E38\u9A7B\u670D\u52A1)
 
 usage:
-  cli-local [HUB_URL]
-  cli-local install [HUB_URL]      \u5B89\u88C5 macOS launchd \u5E38\u9A7B\u670D\u52A1\uFF08\u5F00\u673A\u81EA\u542F + \u65AD\u7EBF\u81EA\u52A8\u91CD\u8FDE\uFF09
-  cli-local uninstall              \u5378\u8F7D launchd \u5E38\u9A7B\u670D\u52A1
+  cli-local                      \u65E0 gateway \u4E14\u5DF2\u914D\u7F6E\u65F6\u524D\u53F0\u8FD0\u884C\uFF1B\u5426\u5219\u663E\u793A\u72B6\u6001
+  cli-local pair                 \u91CD\u65B0\u6388\u6743\uFF08\u540A\u9500/\u8FC7\u671F\u540E\u91CD\u914D\u5BF9\uFF1Bgateway \u70ED\u52A0\u8F7D\uFF09
+  cli-local gateway start        \u540E\u53F0\u542F\u52A8\u5E38\u9A7B gateway\uFF08\u63A8\u8350\uFF09
+  cli-local gateway stop|restart|status|logs [-f] [-n N]
+  cli-local install [HUB_URL]    \u5B89\u88C5 macOS launchd \u5E38\u9A7B\u670D\u52A1
+  cli-local uninstall            \u5378\u8F7D launchd \u5E38\u9A7B\u670D\u52A1
+
+\u9996\u6B21\u8FD0\u884C\uFF08\u65E0\u914D\u7F6E\uFF09\u4F1A\u8FDB\u5165\u5F15\u5BFC\uFF1Ahub \u5730\u5740 \u2192 registrationKey \u2192 Device Flow \u6388\u6743\u3002
+\u6388\u6743\u540E\u5EFA\u8BAE\u7528 cli-local gateway start \u5E38\u9A7B\uFF08\u65AD\u7EBF\u81EA\u52A8\u91CD\u8FDE\u3001PTY \u4FDD\u6D3B\uFF09\u3002
 
-\u9996\u6B21\u8FD0\u884C\uFF08\u65E0\u914D\u7F6E\uFF09\u4F1A\u8FDB\u5165\u5F15\u5BFC\uFF1A
-  1. \u63D0\u793A hub \u5730\u5740\uFF08\u56DE\u8F66\u7528\u9ED8\u8BA4\uFF09
-  2. \u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668 \u2192 \u767B\u5F55 hub\uFF0C\u4ECE\u300C\u6211\u7684\u8BBE\u5907\u300D\u9875\u590D\u5236 registrationKey
-  3. \u56DE\u5230\u7EC8\u7AEF\u7C98\u8D34 key \u2192 \u81EA\u52A8\u5199\u5165 ~/.cli-remote/config.json
-  4. \u968F\u540E\u8D70 OAuth Device Flow\uFF08RFC 8628\uFF09\uFF1A\u81EA\u52A8\u6253\u5F00\u6388\u6743\u9875 \u2192 \u6279\u51C6\u672C\u8BBE\u5907
-  5. \u51ED\u8BC1\u5B58\u5165 ~/.cli-remote/credentials.json\uFF080600\uFF09\uFF0C\u4E4B\u540E\u81EA\u52A8\u7EED\u671F
+\u88AB\u540A\u9500/\u51ED\u8BC1\u8FC7\u671F\u65F6 gateway \u4E0D\u4F1A\u9000\u51FA\uFF0C\u800C\u662F\u8FDB\u5165 needs-pairing \u7B49\u5F85\uFF1B
+\u53E6\u5F00\u7EC8\u7AEF\u8DD1 cli-local pair \u5199\u5165\u65B0\u51ED\u8BC1\u540E\u81EA\u52A8\u91CD\u8FDE\uFF08\u65E0\u9700\u91CD\u542F gateway\uFF09\u3002
 
-\u65AD\u7EBF\u81EA\u52A8\u91CD\u8FDE\uFF1Ahub \u91CD\u542F/\u7F51\u7EDC\u95EA\u65AD\u540E\u8FDB\u7A0B\u4E0D\u9000\u51FA\uFF0CPTY \u4F1A\u8BDD\u4FDD\u6D3B\u5E76\u81EA\u52A8\u91CD\u8FDE\u3002
+\u672C\u5730\u63A7\u5236 API\uFF08\u4EC5 127.0.0.1\uFF0Cgateway \u8FD0\u884C\u65F6\uFF09\uFF1A
+  GET /status /healthz /logs /sessions   POST /stop
+  \u7AEF\u53E3\u9ED8\u8BA4 18790\uFF0Cconfig.json gateway.apiPort \u6216 CLI_LOCAL_API_PORT \u53EF\u6539
 
 environment:
   RELAY_URL                 hub ws url (overrides argv and config)
   REGISTRATION_KEY          registration key (fallback of config.json)
   CLI_LOCAL_NO_BROWSER=1    \u4E0D\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\uFF08\u53EA\u6253\u5370\u94FE\u63A5\uFF09
+  CLI_LOCAL_API_PORT        gateway \u63A7\u5236API\u7AEF\u53E3
   HOME                      where ~/.cli-remote/ lives
 
 config (~/.cli-remote/config.json):
   {
     "relayUrl":        "wss://your-hub/ws",
     "registrationKey": "from-the-web-devices-page",
+    "gateway":         { "apiPort": 18790 },
     "whitelist":       { "add": [], "remove": [] }
   }
 
 example:
-  cli-local wss://cli-remote.mkjs.net/ws
-  cli-local install                # \u914D\u7F6E\u5E76\u6388\u6743\u540E\uFF0C\u5B89\u88C5\u5E38\u9A7B\u670D\u52A1`);
+  cli-local pair                 # \u9996\u6B21/\u91CD\u65B0\u6388\u6743
+  cli-local gateway start        # \u540E\u53F0\u5E38\u9A7B
+  cli-local gateway status       # \u67E5\u770B\u8FDE\u63A5\u72B6\u6001`);
   process.exit(0);
 }
 var LAUNCHD_LABEL = "net.cli-remote.local";
 function launchdPlistPath() {
-  return (0, import_node_path6.join)((0, import_node_os6.homedir)(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+  return (0, import_node_path7.join)((0, import_node_os7.homedir)(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
 }
 function entryScript() {
   const a1 = process.argv[1];
   if (!a1 || a1.endsWith(".ts")) return null;
   try {
-    return (0, import_node_fs4.realpathSync)(a1);
+    return (0, import_node_fs5.realpathSync)(a1);
   } catch {
     return a1;
   }
@@ -11312,7 +11626,7 @@ function launchdInstall(urlArg) {
     console.error(`[local] launchd \u5E38\u9A7B\u4EC5\u652F\u6301 macOS\uFF08\u5F53\u524D ${process.platform}\uFF09\uFF1BLinux \u8BF7\u7528 systemd --user \u81EA\u884C\u6258\u7BA1`);
     process.exit(1);
   }
-  const home = (0, import_node_os6.homedir)();
+  const home = (0, import_node_os7.homedir)();
   const entry = entryScript();
   if (!entry) {
     console.error("[local] \u5F53\u524D\u4EE5\u6E90\u7801\uFF08tsx\uFF09\u6A21\u5F0F\u8FD0\u884C\uFF0C\u65E0\u6CD5\u5B89\u88C5\u5E38\u9A7B\u670D\u52A1\u3002");
@@ -11320,28 +11634,28 @@ function launchdInstall(urlArg) {
     process.exit(1);
   }
   if (urlArg) {
-    const cfgDir = (0, import_node_path6.join)(home, DEFAULT_CONFIG_DIR);
-    (0, import_node_fs4.mkdirSync)(cfgDir, { recursive: true });
-    const cfgPath = (0, import_node_path6.join)(cfgDir, "config.json");
+    const cfgDir = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR);
+    (0, import_node_fs5.mkdirSync)(cfgDir, { recursive: true });
+    const cfgPath = (0, import_node_path7.join)(cfgDir, "config.json");
     let cfg = {};
     try {
-      cfg = JSON.parse((0, import_node_fs4.readFileSync)(cfgPath, "utf-8"));
+      cfg = JSON.parse((0, import_node_fs5.readFileSync)(cfgPath, "utf-8"));
     } catch {
     }
     cfg.relayUrl = urlArg;
-    (0, import_node_fs4.writeFileSync)(cfgPath, JSON.stringify(cfg, null, 2) + "\n");
+    (0, import_node_fs5.writeFileSync)(cfgPath, JSON.stringify(cfg, null, 2) + "\n");
     console.log(`[local] relayUrl \u5DF2\u5199\u5165 ${cfgPath}`);
   }
-  const credPath = (0, import_node_path6.join)(home, DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
-  if (!(0, import_node_fs4.existsSync)(credPath)) {
+  const credPath = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR, CREDENTIALS_FILE);
+  if (!(0, import_node_fs5.existsSync)(credPath)) {
     console.error("[local] \u5C1A\u672A\u6388\u6743\uFF08\u627E\u4E0D\u5230 credentials.json\uFF09\u3002");
     console.error("[local] \u8BF7\u5148\u4EA4\u4E92\u5F0F\u8FD0\u884C\u4E00\u6B21 cli-local \u5B8C\u6210\u914D\u7F6E\u4E0E\u6388\u6743\uFF0C\u518D\u5B89\u88C5\u5E38\u9A7B\u670D\u52A1\u3002");
     process.exit(1);
   }
   const plist = launchdPlistPath();
-  const logDir = (0, import_node_path6.join)(home, DEFAULT_CONFIG_DIR, "logs");
-  (0, import_node_fs4.mkdirSync)((0, import_node_path6.dirname)(plist), { recursive: true });
-  (0, import_node_fs4.mkdirSync)(logDir, { recursive: true });
+  const logDir = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR, "logs");
+  (0, import_node_fs5.mkdirSync)((0, import_node_path7.dirname)(plist), { recursive: true });
+  (0, import_node_fs5.mkdirSync)(logDir, { recursive: true });
   const xml = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -11355,12 +11669,12 @@ function launchdInstall(urlArg) {
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
   <key>ThrottleInterval</key><integer>30</integer>
-  <key>StandardOutPath</key><string>${(0, import_node_path6.join)(logDir, "daemon.out.log")}</string>
-  <key>StandardErrorPath</key><string>${(0, import_node_path6.join)(logDir, "daemon.err.log")}</string>
+  <key>StandardOutPath</key><string>${(0, import_node_path7.join)(logDir, "daemon.out.log")}</string>
+  <key>StandardErrorPath</key><string>${(0, import_node_path7.join)(logDir, "daemon.err.log")}</string>
 </dict>
 </plist>
 `;
-  (0, import_node_fs4.writeFileSync)(plist, xml);
+  (0, import_node_fs5.writeFileSync)(plist, xml);
   const uid = process.getuid?.();
   if (uid === void 0) {
     console.error("[local] \u65E0\u6CD5\u786E\u5B9A uid\uFF0Claunchd \u5B89\u88C5\u5931\u8D25");
@@ -11378,7 +11692,7 @@ function launchdInstall(urlArg) {
 }
 function launchdUninstall() {
   const plist = launchdPlistPath();
-  if (!(0, import_node_fs4.existsSync)(plist)) {
+  if (!(0, import_node_fs5.existsSync)(plist)) {
     console.log("[local] \u672A\u627E\u5230\u5DF2\u5B89\u88C5\u7684\u5E38\u9A7B\u670D\u52A1\uFF08nothing to uninstall\uFF09");
     process.exit(0);
   }
@@ -11386,7 +11700,7 @@ function launchdUninstall() {
   const guiDomain = `gui/${uid ?? 0}`;
   run("launchctl", ["bootout", guiDomain, plist], true);
   run("launchctl", ["unload", "-w", plist], true);
-  (0, import_node_fs4.rmSync)(plist);
+  (0, import_node_fs5.rmSync)(plist);
   console.log(`[local] launchd \u670D\u52A1\u5DF2\u505C\u6B62\u5E76\u5378\u8F7D\uFF1A${LAUNCHD_LABEL}`);
 }
 if (argUrl && !argMatch && argUrl === "install") {
@@ -11397,70 +11711,70 @@ if (argUrl && !argMatch && argUrl === "uninstall") {
   launchdUninstall();
   process.exit(0);
 }
-if (argUrl === "gateway") {
-  let gatewayLogFile = function() {
-    return (0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "logs", "gateway.log");
-  }, stopWorker = function() {
-    const pid = gatewayPid();
-    if (pid === null || !gatewayAlive()) {
-      (0, import_node_fs4.rmSync)((0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
-      return;
-    }
+if (argUrl === "pair") {
+  void (async () => {
+    const home = (0, import_node_os7.homedir)();
+    const cfgPath = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR, "config.json");
+    let cfg = {};
     try {
-      process.kill(pid, "SIGTERM");
+      cfg = JSON.parse((0, import_node_fs5.readFileSync)(cfgPath, "utf-8"));
     } catch {
     }
-    const t0 = Date.now();
-    while (Date.now() - t0 < 5e3 && gatewayAlive()) {
-      const end = Date.now() + 150;
-      while (Date.now() < end) {
-      }
+    const url = process.argv[4] ?? process.env.RELAY_URL ?? cfg.relayUrl;
+    if (!url) {
+      console.error("[pair] \u7F3A\u5C11 hub \u5730\u5740\uFF1A\u5148\u8FD0\u884C\u4E00\u6B21 cli-local \u5B8C\u6210\u914D\u7F6E\uFF0C\u6216 cli-local pair wss://your-hub/ws");
+      process.exit(1);
     }
-    (0, import_node_fs4.rmSync)((0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
-  }, gatewayStop = function() {
-    const pid = gatewayPid();
-    const wasRunning = gatewayAlive();
-    stopWorker();
-    console.log(wasRunning ? `[gateway] stopped (pid ${pid ?? "?"})` : "[gateway] not running");
-    process.exit(0);
-  }, gatewayStatus = function() {
-    if (!gatewayAlive()) {
-      console.log("[gateway] stopped");
+    if (!cfg.registrationKey && !process.env.REGISTRATION_KEY) {
+      console.error("[pair] \u7F3A\u5C11 registrationKey\uFF1A\u5199\u5165 ~/.cli-remote/config.json \u6216\u8BBE\u7F6E REGISTRATION_KEY");
       process.exit(1);
     }
-    const pid = gatewayPid();
-    let hub = "(\u672A\u914D\u7F6E)";
-    try {
-      const cfg = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path6.join)((0, import_node_os6.homedir)(), DEFAULT_CONFIG_DIR, "config.json"), "utf-8"));
-      hub = cfg.relayUrl ?? hub;
-    } catch {
+    const prev = await loadCredentials();
+    const deviceId = prev?.deviceId || await stableDeviceId();
+    console.log(`[pair] hub: ${url}\uFF08\u8BBE\u5907 ${deviceId}${prev ? "\uFF0C\u590D\u7528" : "\uFF0C\u7531\u673A\u5668\u7801\u6D3E\u751F"}\uFF09`);
+    const creds = await deviceFlowAuthorize(
+      baseUrlFromWsUrl(url),
+      cfg.registrationKey ?? process.env.REGISTRATION_KEY,
+      deviceId
+    );
+    console.log(`[pair] \u6388\u6743\u5B8C\u6210 deviceId=${creds.deviceId}`);
+    const port = readConfiguredPort();
+    const health = await apiGet(port, "/healthz");
+    if (health?.ok) {
+      console.log("[pair] gateway \u5728\u8FD0\u884C\uFF0C\u65B0\u51ED\u8BC1\u5DF2\u5199\u5165 \u2014 \u6570\u79D2\u5185\u81EA\u52A8\u91CD\u8FDE\uFF08\u65E0\u9700\u91CD\u542F\uFF09");
+    } else {
+      console.log("[pair] gateway \u672A\u8FD0\u884C\uFF1Acli-local gateway start \u542F\u52A8\u5E38\u9A7B\u670D\u52A1");
     }
-    console.log(`[gateway] running (pid ${pid})`);
-    console.log(`[gateway] hub: ${hub}`);
-    console.log(`[gateway] \u65E5\u5FD7: ${gatewayLogFile()}`);
-    process.exit(0);
+  })().catch((e) => {
+    console.error(`[pair] ${e.message}`);
+    process.exit(1);
+  });
+}
+if (argUrl === "gateway") {
+  let gatewayLogFile = function() {
+    return (0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "logs", "gateway.log");
   }, gatewayLogs = function() {
     const follow = rest.includes("-f") || rest.includes("--follow");
     const li = rest.findIndex((a) => a === "-n" || a === "--lines");
     const lines = li >= 0 ? Number(rest[li + 1]) || 50 : 50;
     const file = gatewayLogFile();
-    if (!(0, import_node_fs4.existsSync)(file)) {
+    if (!(0, import_node_fs5.existsSync)(file)) {
       console.log(`[gateway] \u6682\u65E0\u65E5\u5FD7\uFF08${file} \u4E0D\u5B58\u5728\uFF09`);
       process.exit(0);
     }
-    const tail = (0, import_node_fs4.readFileSync)(file, "utf-8").trimEnd().split("\n").slice(-lines);
+    const tail = (0, import_node_fs5.readFileSync)(file, "utf-8").trimEnd().split("\n").slice(-lines);
     console.log(tail.join("\n"));
     if (!follow) process.exit(0);
-    let size = (0, import_node_fs4.statSync)(file).size;
+    let size = (0, import_node_fs5.statSync)(file).size;
     console.log("--- following (Ctrl+C \u9000\u51FA) ---");
     setInterval(() => {
       try {
-        const st = (0, import_node_fs4.statSync)(file);
+        const st = (0, import_node_fs5.statSync)(file);
         if (st.size > size) {
-          const fd = (0, import_node_fs4.openSync)(file, "r");
+          const fd = (0, import_node_fs5.openSync)(file, "r");
           const buf = Buffer.alloc(st.size - size);
-          (0, import_node_fs4.readSync)(fd, buf, 0, buf.length, size);
-          (0, import_node_fs4.closeSync)(fd);
+          (0, import_node_fs5.readSync)(fd, buf, 0, buf.length, size);
+          (0, import_node_fs5.closeSync)(fd);
           size = st.size;
           process.stdout.write(buf.toString("utf-8"));
         } else if (st.size < size) {
@@ -11470,7 +11784,7 @@ if (argUrl === "gateway") {
       }
     }, 1e3);
   };
-  gatewayLogFile2 = gatewayLogFile, stopWorker2 = stopWorker, gatewayStop2 = gatewayStop, gatewayStatus2 = gatewayStatus, gatewayLogs2 = gatewayLogs;
+  gatewayLogFile2 = gatewayLogFile, gatewayLogs2 = gatewayLogs;
   const action = process.argv[3] ?? "";
   const rest = process.argv.slice(4);
   const hubArg = (() => {
@@ -11482,22 +11796,22 @@ if (argUrl === "gateway") {
       console.log(`[gateway] already running (pid ${gatewayPid()})`);
       process.exit(0);
     }
-    const home = (0, import_node_os6.homedir)();
+    const home = (0, import_node_os7.homedir)();
     const entry = entryScript();
-    const cfgDir = (0, import_node_path6.join)(home, DEFAULT_CONFIG_DIR);
-    const credPath = (0, import_node_path6.join)(cfgDir, CREDENTIALS_FILE);
-    const cfgPath = (0, import_node_path6.join)(cfgDir, "config.json");
-    const hasCfg = (0, import_node_fs4.existsSync)(cfgPath);
+    const cfgDir = (0, import_node_path7.join)(home, DEFAULT_CONFIG_DIR);
+    const cfgPath = (0, import_node_path7.join)(cfgDir, "config.json");
+    const hasCfg = (0, import_node_fs5.existsSync)(cfgPath);
     if (!entry) {
       console.error("[gateway] \u6E90\u7801\uFF08tsx\uFF09\u6A21\u5F0F\u4E0D\u652F\u6301\u540E\u53F0\u8FD0\u884C\uFF1B\u8BF7\u7528 npm \u5B89\u88C5\u7248\uFF1Anpm i -g @cli-remote/local");
       process.exit(1);
     }
-    if (!hasCfg || !(0, import_node_fs4.existsSync)(credPath)) {
-      console.error("[gateway] \u5C1A\u672A\u914D\u7F6E/\u6388\u6743\u3002\u8BF7\u5148\u4EA4\u4E92\u5F0F\u8FD0\u884C\u4E00\u6B21 cli-local \u5B8C\u6210\u767B\u5F55\u4E0E\u8BBE\u5907\u6388\u6743\u3002");
+    if (!hasCfg) {
+      console.error("[gateway] \u5C1A\u672A\u914D\u7F6E hub \u5730\u5740\u3002\u8BF7\u5148\u4EA4\u4E92\u5F0F\u8FD0\u884C\u4E00\u6B21 cli-local \u5B8C\u6210\u521D\u59CB\u914D\u7F6E\u3002");
+      console.error("[gateway] \uFF08\u65E0\u51ED\u8BC1\u4E5F\u53EF\u4EE5\u542F\u52A8\uFF1Agateway \u4F1A\u8FDB\u5165 needs-pairing\uFF0C\u7B49 cli-local pair\uFF09");
       process.exit(1);
     }
-    (0, import_node_fs4.mkdirSync)((0, import_node_path6.dirname)(gatewayLogFile()), { recursive: true });
-    const out = (0, import_node_fs4.openSync)(gatewayLogFile(), "a");
+    (0, import_node_fs5.mkdirSync)((0, import_node_path7.dirname)(gatewayLogFile()), { recursive: true });
+    const out = (0, import_node_fs5.openSync)(gatewayLogFile(), "a");
     const env = {};
     for (const [k, v] of Object.entries(process.env)) if (v !== void 0) env[k] = v;
     const args = [entry, "gateway", "run"];
@@ -11509,41 +11823,124 @@ if (argUrl === "gateway") {
     });
     child.unref();
     console.log(`[gateway] started (pid ${child.pid})`);
+    const port = readConfiguredPort();
+    for (let i = 0; i < 20; i++) {
+      await new Promise((res) => setTimeout(res, 250));
+      const h = await apiGet(port, "/healthz", 400);
+      if (h?.ok) {
+        console.log(`[gateway] \u63A7\u5236API\u5C31\u7EEA: http://127.0.0.1:${port}\uFF08\u4EC5\u672C\u673A\uFF09`);
+        break;
+      }
+    }
     console.log(`[gateway] \u65E5\u5FD7: ${gatewayLogFile()}`);
     console.log("[gateway] \u72B6\u6001: cli-local gateway status");
   }
-  switch (action) {
-    case "start":
-      gatewayStart().then(() => process.exit(0)).catch((e) => {
-        console.error(`[gateway] ${e.message}`);
-        process.exit(1);
-      });
-      break;
-    case "stop":
-      gatewayStop();
-      break;
-    case "restart":
-      stopWorker();
-      gatewayStart().then(() => process.exit(0)).catch((e) => {
-        console.error(`[gateway] ${e.message}`);
-        process.exit(1);
-      });
-      break;
-    case "status":
-      gatewayStatus();
-      break;
-    case "logs":
-      gatewayLogs();
-      break;
-    case "run":
-      startLocal({ url: hubArg, daemon: true }).catch((err) => {
-        if (err instanceof AuthError) console.error(`[local] ${err.message}`);
-        else console.error("[local] fatal:", err);
-        process.exit(1);
-      });
-      break;
-    default:
-      console.log(`cli-local gateway \u2014 \u540E\u53F0\u8FD0\u884C\u7BA1\u7406
+  async function stopWorker() {
+    const port = readConfiguredPort();
+    if (await apiPost(port, "/stop", 1500)) {
+      const t02 = Date.now();
+      while (Date.now() - t02 < 5e3 && gatewayAlive()) {
+        await new Promise((res) => setTimeout(res, 150));
+      }
+      (0, import_node_fs5.rmSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
+      return;
+    }
+    const pid = gatewayPid();
+    if (pid === null || !gatewayAlive()) {
+      (0, import_node_fs5.rmSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
+      return;
+    }
+    try {
+      process.kill(pid, "SIGTERM");
+    } catch {
+    }
+    const t0 = Date.now();
+    while (Date.now() - t0 < 5e3 && gatewayAlive()) {
+      await new Promise((res) => setTimeout(res, 150));
+    }
+    (0, import_node_fs5.rmSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "gateway.pid"), { force: true });
+  }
+  async function gatewayStop() {
+    const pid = gatewayPid();
+    const wasRunning = gatewayAlive();
+    await stopWorker();
+    console.log(wasRunning ? `[gateway] stopped (pid ${pid ?? "?"})` : "[gateway] not running");
+    process.exit(0);
+  }
+  async function gatewayStatus() {
+    const port = readConfiguredPort();
+    const st = await apiGet(port, "/status", 600);
+    if (st) {
+      const phaseLabel = {
+        starting: "\u542F\u52A8\u4E2D",
+        connecting: "\u8FDE\u63A5\u4E2D",
+        connected: "\u5DF2\u8FDE\u63A5",
+        reconnecting: "\u91CD\u8FDE\u4E2D",
+        "needs-pairing": "\u9700\u8981\u91CD\u65B0\u6388\u6743"
+      };
+      const up = Math.floor(st.uptimeMs / 1e3);
+      const upStr = up > 3600 ? `${Math.floor(up / 3600)}h${Math.floor(up % 3600 / 60)}m` : up > 60 ? `${Math.floor(up / 60)}m${up % 60}s` : `${up}s`;
+      const exp = st.accessTokenExpiresAt ? new Date(st.accessTokenExpiresAt).toLocaleTimeString() : "\u2014";
+      console.log(`[gateway] running (pid ${gatewayPid() ?? "?"}, api :${port})`);
+      console.log(`[gateway] \u72B6\u6001: ${phaseLabel[st.phase] ?? st.phase}${st.reason ? ` (${st.reason})` : ""}`);
+      console.log(`[gateway] hub: ${st.hubUrl}`);
+      console.log(`[gateway] deviceId: ${st.deviceId ?? "\u2014"}`);
+      console.log(`[gateway] uptime: ${upStr}, token \u5230\u671F: ${exp}`);
+      console.log(`[gateway] PTY \u4F1A\u8BDD: ${st.sessions.length} \u4E2A${st.sessions.length ? ` (${st.sessions.map((s) => s.cmd).join(", ")})` : ""}`);
+      if (st.phase === "needs-pairing") {
+        console.log("[gateway] \u26A0 \u8FD0\u884C cli-local pair \u91CD\u65B0\u6388\u6743\uFF08\u5B8C\u6210\u540E\u81EA\u52A8\u91CD\u8FDE\uFF09");
+      }
+      process.exit(0);
+    }
+    if (!gatewayAlive()) {
+      console.log("[gateway] stopped");
+      process.exit(1);
+    }
+    const pid = gatewayPid();
+    let hub = "(\u672A\u914D\u7F6E)";
+    try {
+      const cfg = JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path7.join)((0, import_node_os7.homedir)(), DEFAULT_CONFIG_DIR, "config.json"), "utf-8"));
+      hub = cfg.relayUrl ?? hub;
+    } catch {
+    }
+    console.log(`[gateway] running (pid ${pid}) \u2014 \u63A7\u5236API\u672A\u54CD\u5E94\uFF08\u65E7\u7248\u672C\uFF1F\uFF09`);
+    console.log(`[gateway] hub: ${hub}`);
+    console.log(`[gateway] \u65E5\u5FD7: ${gatewayLogFile()}`);
+    process.exit(0);
+  }
+  void (async () => {
+    switch (action) {
+      case "start":
+        gatewayStart().then(() => process.exit(0)).catch((e) => {
+          console.error(`[gateway] ${e.message}`);
+          process.exit(1);
+        });
+        break;
+      case "stop":
+        gatewayStop();
+        break;
+      case "restart":
+        await stopWorker();
+        gatewayStart().then(() => process.exit(0)).catch((e) => {
+          console.error(`[gateway] ${e.message}`);
+          process.exit(1);
+        });
+        break;
+      case "status":
+        void gatewayStatus();
+        break;
+      case "logs":
+        gatewayLogs();
+        break;
+      case "run":
+        startLocal({ url: hubArg, daemon: true }).catch((err) => {
+          if (err instanceof AuthError) console.error(`[local] ${err.message}`);
+          else console.error("[local] fatal:", err);
+          process.exit(1);
+        });
+        break;
+      default:
+        console.log(`cli-local gateway \u2014 \u540E\u53F0\u8FD0\u884C\u7BA1\u7406
 
 usage:
   cli-local gateway start [--hub URL]   \u540E\u53F0\u542F\u52A8\uFF08\u81EA\u52A8\u91CD\u8FDE\uFF09
@@ -11553,24 +11950,55 @@ usage:
   cli-local gateway logs [-f] [-n N]    \u67E5\u770B\u65E5\u5FD7\uFF08-f \u8DDF\u968F\uFF09
   cli-local gateway run [--hub URL]     \u524D\u53F0\u8FD0\u884C\uFF08\u4F9B start \u62C9\u8D77\uFF09
 
-\u8BF4\u660E\uFF1A\u540E\u53F0\u8FDB\u7A0B\u7531 pid \u6587\u4EF6\u7BA1\u7406\uFF08~/.cli-remote/gateway.pid\uFF09\uFF0C\u65E5\u5FD7\u5728
-~/.cli-remote/logs/gateway.log\u3002\u9996\u6B21\u4F7F\u7528\u8BF7\u5148\u4EA4\u4E92\u5F0F\u8FD0\u884C cli-local
-\u5B8C\u6210\u767B\u5F55\u4E0E\u8BBE\u5907\u6388\u6743\u3002macOS \u60F3\u5F00\u673A\u81EA\u542F\u7528 launchd\uFF1Acli-local install\u3002`);
-      process.exit(action ? 1 : 0);
-  }
+\u8BF4\u660E\uFF1A\u540E\u53F0\u8FDB\u7A0B\u7531 pid \u6587\u4EF6\u7BA1\u7406\uFF08~/.cli-remote/gateway.pid\uFF09\uFF0C\u672C\u5730\u63A7\u5236API
+\u4EC5 127.0.0.1\uFF08\u9ED8\u8BA4 18790\uFF0Cconfig.json gateway.apiPort \u53EF\u6539\uFF09\uFF0C\u65E5\u5FD7\u5728
+~/.cli-remote/logs/gateway.log\u3002\u65E0\u51ED\u8BC1\u4E5F\u80FD\u542F\u52A8\uFF08\u8FDB\u5165 needs-pairing \u7B49
+cli-local pair\uFF09\u3002macOS \u60F3\u5F00\u673A\u81EA\u542F\u7528 launchd\uFF1Acli-local install\u3002`);
+        process.exit(action ? 1 : 0);
+    }
+  })().catch((e) => {
+    console.error(`[gateway] ${e.message}`);
+    process.exit(1);
+  });
 }
 var gatewayLogFile2;
-var stopWorker2;
-var gatewayStop2;
-var gatewayStatus2;
 var gatewayLogs2;
-startLocal(argMatch ? { url: argUrl } : {}).catch((err) => {
-  if (err instanceof AuthError) {
-    console.error(`[local] ${err.message}`);
+if (!argUrl || argMatch) {
+  if (!argUrl) {
+    void (async () => {
+      const port = readConfiguredPort();
+      const health = await apiGet(port, "/healthz", 400);
+      if (health?.ok) {
+        console.log("[local] gateway \u5E38\u9A7B\u670D\u52A1\u8FD0\u884C\u4E2D\u3002\u5B9E\u65F6\u72B6\u6001:");
+        const entry = process.argv[1];
+        if (entry && !entry.endsWith(".ts")) {
+          const { execFileSync: ex } = await import("node:child_process");
+          try {
+            ex(process.execPath, [entry, "gateway", "status"], { stdio: "inherit" });
+          } catch {
+            console.log(`[local]   \u63A7\u5236API: http://127.0.0.1:${port}/status`);
+          }
+        } else {
+          console.log(`[local]   \u63A7\u5236API: http://127.0.0.1:${port}/status`);
+        }
+        process.exit(0);
+      }
+      await startLocal({});
+    })().catch((err) => {
+      if (err instanceof AuthError) console.error(`[local] ${err.message}`);
+      else console.error("[local] fatal:", err);
+      process.exit(1);
+    });
   } else {
-    console.error("[local] fatal:", err);
+    startLocal({ url: argUrl }).catch((err) => {
+      if (err instanceof AuthError) {
+        console.error(`[local] ${err.message}`);
+      } else {
+        console.error("[local] fatal:", err);
+      }
+      process.exit(1);
+    });
   }
-  process.exit(1);
-});
+}
 process.on("SIGINT", () => process.exit(0));
 process.on("SIGTERM", () => process.exit(0));