@drisp/cli 0.4.4 → 0.4.7

package/dist/cli.js

@@ -1,9 +1,5 @@
 #!/usr/bin/env node
 import "./chunk-HXBCZAP7.js";
-import {
-  channelSidecarDir,
-  rotateGatewayToken
-} from "./chunk-6TJHAUNB.js";
 import {
   CREDENTIAL_SOURCES_TRIED,
   EXEC_EXIT_CODE,
@@ -15,6 +11,8 @@ import {
   buildProbeConfigs,
   classifyFailure,
   connect,
+  createDashboardDecisionInbox,
+  createDashboardFeedPublisher,
   createFeedMapper,
   createRelayPermissionCallback,
   createRelayQuestionCallback,
@@ -51,7 +49,6 @@ import {
   processRegistry,
   progressGlyphs,
   readGatewayClientConfig,
-  readPidLock,
   register,
   registerCleanupOnExit,
   resolveClaudeBinary,
@@ -70,10 +67,19 @@ import {
   todoGlyphSet,
   writeGatewayClientConfig,
   wsClientOptionsForEndpoint
-} from "./chunk-JAPBSL7D.js";
+} from "./chunk-TQKNZNDP.js";
 import {
   generateId as generateId2
 } from "./chunk-BTKQ67RE.js";
+import {
+  rotateGatewayToken
+} from "./chunk-D4W7RB25.js";
+import {
+  readAttachmentMirror,
+  readPidLock,
+  removeAttachmentMirror,
+  writeAttachmentMirror
+} from "./chunk-ZVOGOZNT.js";
 import {
   dashboardClientConfigPath,
   disableTelemetry,
@@ -94,7 +100,7 @@ import {
   trackTelemetryOptedOut,
   writeDashboardClientConfig,
   writeGatewayTrace
-} from "./chunk-4CRZXLIP.js";
+} from "./chunk-WRHKXH5M.js";
 import {
   McpOptionsStep,
   StepSelector,
@@ -129,7 +135,7 @@ import {
   useWorkflowSessionController,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-5VK2ZMVV.js";
+} from "./chunk-A54HGVML.js";
 
 // src/app/entry/cli.tsx
 import { render } from "ink";
@@ -1739,14 +1745,65 @@ function useFeed(runtime, messages = [], initialAllowedTools, sessionStore, opti
   const abortRef = useRef(new AbortController());
   const feedEventsRef = useRef([]);
   const notifiedRuntimeErrorRef = useRef(null);
+  const dashboardFeedPublisher = useMemo3(
+    () => options?.dashboardFeedPublisher ?? createDashboardFeedPublisher(),
+    [options?.dashboardFeedPublisher]
+  );
+  const dashboardDecisionInboxRef = useRef(
+    options?.dashboardDecisionInbox ?? null
+  );
   rulesRef.current = rules;
   feedEventsRef.current = feedEvents;
   sessionStoreRef.current = sessionStore;
+  if (options?.dashboardDecisionInbox) {
+    dashboardDecisionInboxRef.current = options.dashboardDecisionInbox;
+  }
+  const resolveAthenaSessionId = useCallback5(
+    (fallback) => {
+      if (options?.athenaSessionId) return options.athenaSessionId;
+      try {
+        const sessionId = sessionStoreRef.current?.getAthenaSession().id;
+        if (sessionId) return sessionId;
+      } catch {
+      }
+      return fallback;
+    },
+    [options?.athenaSessionId]
+  );
   useEffect(() => {
     return () => {
       sessionStoreRef.current = void 0;
     };
   }, []);
+  useEffect(() => {
+    const athenaSessionId = resolveAthenaSessionId();
+    if (!athenaSessionId) return;
+    if (!dashboardDecisionInboxRef.current) {
+      if (!readDashboardClientConfig()) return;
+      dashboardDecisionInboxRef.current = createDashboardDecisionInbox();
+    }
+    const inbox = dashboardDecisionInboxRef.current;
+    const applyPending = () => {
+      const rows = inbox.pendingForSession({ athenaSessionId, limit: 25 });
+      for (const row of rows) {
+        runtime.sendDecision(row.requestId, row.decision);
+        inbox.markConsumed({ id: row.id });
+      }
+    };
+    applyPending();
+    const interval = setInterval(
+      applyPending,
+      options?.dashboardDecisionPollIntervalMs ?? 1e3
+    );
+    return () => {
+      clearInterval(interval);
+    };
+  }, [
+    runtime,
+    options?.dashboardDecisionInbox,
+    options?.dashboardDecisionPollIntervalMs,
+    resolveAthenaSessionId
+  ]);
   const resetSession = useCallback5(() => {
     const newMapper = createFeedMapper();
     mapperRef.current = newMapper;
@@ -1857,18 +1914,37 @@ function useFeed(runtime, messages = [], initialAllowedTools, sessionStore, opti
     },
     [runtime, dequeueQuestion]
   );
-  const emitNotification = useCallback5((message, title) => {
-    const mapper = mapperRef.current;
-    const syntheticRuntime = buildSyntheticNotificationEvent(
-      mapper,
-      message,
-      title
-    );
-    const newEvents = mapper.mapEvent(syntheticRuntime);
-    if (!abortRef.current.signal.aborted) {
-      feedStoreRef.current.pushEvents(newEvents);
-    }
-  }, []);
+  const publishDashboardFeedEvents = useCallback5(
+    (feedEventsToPublish, runtimeEvent) => {
+      if (feedEventsToPublish.length === 0) return;
+      const athenaSessionId = resolveAthenaSessionId(
+        feedEventsToPublish[0]?.session_id ?? runtimeEvent?.sessionId
+      );
+      if (!athenaSessionId) return;
+      dashboardFeedPublisher.publish({
+        origin: options?.dashboardOrigin ?? "local",
+        athenaSessionId,
+        feedEvents: feedEventsToPublish
+      });
+    },
+    [dashboardFeedPublisher, options?.dashboardOrigin, resolveAthenaSessionId]
+  );
+  const emitNotification = useCallback5(
+    (message, title) => {
+      const mapper = mapperRef.current;
+      const syntheticRuntime = buildSyntheticNotificationEvent(
+        mapper,
+        message,
+        title
+      );
+      const newEvents = mapper.mapEvent(syntheticRuntime);
+      if (!abortRef.current.signal.aborted) {
+        feedStoreRef.current.pushEvents(newEvents);
+        publishDashboardFeedEvents(newEvents, syntheticRuntime);
+      }
+    },
+    [publishDashboardFeedEvents]
+  );
   const refreshRuntimeStatus = useCallback5(
     (notify = false) => {
       const nextIsServerRunning = runtime.getStatus() === "running";
@@ -1953,6 +2029,7 @@ function useFeed(runtime, messages = [], initialAllowedTools, sessionStore, opti
             }
           }
           feedStoreRef.current.pushEvents(newFeedEvents);
+          publishDashboardFeedEvents(newFeedEvents, runtimeEvent);
         }
       } finally {
         doneCause();
@@ -1988,6 +2065,7 @@ function useFeed(runtime, messages = [], initialAllowedTools, sessionStore, opti
           });
           if (feedEvent) {
             feedStoreRef.current.pushEvents([feedEvent]);
+            publishDashboardFeedEvents([feedEvent]);
             if (feedEvent.kind === "permission.decision" && feedEvent.cause?.hook_request_id) {
               dequeuePermission(feedEvent.cause.hook_request_id);
             }
@@ -2011,7 +2089,8 @@ function useFeed(runtime, messages = [], initialAllowedTools, sessionStore, opti
     dequeueQuestion,
     refreshRuntimeStatus,
     options?.relayPermission,
-    options?.relayQuestion
+    options?.relayQuestion,
+    publishDashboardFeedEvents
   ]);
   const items = useMemo3(() => {
     const done = startPerfStage("state.derive", {
@@ -2108,6 +2187,7 @@ function HookProvider({
   runtimeFactory = createRuntime,
   allowedTools,
   athenaSessionId,
+  attachmentId,
   children
 }) {
   const runtime = useMemo4(
@@ -2155,6 +2235,7 @@ function HookProvider({
     void startSessionBridge({
       runtimeId: athenaSessionId,
       defaultAgentId: "main",
+      ...attachmentId !== void 0 ? { attachmentId } : {},
       signal: controller.signal
     }).then((bridge) => {
       if (!bridge) return;
@@ -2171,7 +2252,7 @@ function HookProvider({
         return null;
       });
     };
-  }, [athenaSessionId]);
+  }, [athenaSessionId, attachmentId]);
   useEffect2(() => {
     return () => {
       sessionStore.close();
@@ -10948,6 +11029,350 @@ function executeCommand(command, args, ctx) {
   }
 }
 
+// src/app/runner/assignmentHandler.ts
+function parseRunSpec(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const obj = value;
+  const prompt = obj["prompt"];
+  if (typeof prompt !== "string" || prompt.trim().length === 0) return null;
+  const env2 = obj["env"];
+  const workflow = obj["workflow"];
+  return {
+    prompt,
+    sessionId: typeof obj["sessionId"] === "string" && obj["sessionId"].length > 0 ? obj["sessionId"] : void 0,
+    projectDir: typeof obj["projectDir"] === "string" && obj["projectDir"].length > 0 ? obj["projectDir"] : void 0,
+    workflow: typeof workflow === "object" && workflow !== null && typeof workflow["ref"] === "string" ? { ref: workflow["ref"] } : void 0,
+    env: typeof env2 === "object" && env2 !== null ? Object.fromEntries(
+      Object.entries(env2).filter(
+        (entry) => typeof entry[1] === "string"
+      )
+    ) : void 0,
+    timeoutSec: typeof obj["timeoutSec"] === "number" && Number.isFinite(obj["timeoutSec"]) ? obj["timeoutSec"] : void 0
+  };
+}
+function workflowNameFromRef(ref) {
+  if (!ref) return void 0;
+  const [name] = ref.split("@", 1);
+  return name && name.length > 0 ? name : void 0;
+}
+function eventKindOf(event) {
+  if (event.type === "exec.completed") {
+    const data = event.data;
+    return data?.success === false ? "error" : "completion";
+  }
+  return typeof event.type === "string" && event.type.length > 0 ? event.type : "progress";
+}
+function eventPayloadOf(event) {
+  if (event.type === "exec.completed") {
+    const data = event.data;
+    if (data?.success === false) {
+      return {
+        ...typeof event.data === "object" && event.data !== null ? event.data : {},
+        message: typeof data.failure === "object" && data.failure !== null && typeof data.failure.message === "string" ? data.failure.message : "remote execution failed"
+      };
+    }
+  }
+  return event.data ?? null;
+}
+function withEnv(env2, fn) {
+  if (!env2 || Object.keys(env2).length === 0) return fn();
+  const previous = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(env2)) {
+    previous.set(key, process.env[key]);
+    process.env[key] = value;
+  }
+  return fn().finally(() => {
+    for (const [key, value] of previous) {
+      if (value === void 0) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  });
+}
+async function executeAssignment(input) {
+  const {
+    envelope,
+    bridge,
+    dispatchId,
+    location,
+    projectDir: fallbackProjectDir = process.cwd(),
+    runExecFn = runExec,
+    bootstrapRuntimeConfigFn = bootstrapRuntimeConfig,
+    now = Date.now,
+    abortSignal
+  } = input;
+  const runId = envelope.runId;
+  let seq = 0;
+  let terminalSent = false;
+  let deferredFailedCompletion = null;
+  let lastTerminalFailureMessage = null;
+  const nextSeq = () => {
+    seq += 1;
+    return seq;
+  };
+  const sendProgress = async (kind, payload, ts = now()) => {
+    await bridge.sendRunEvent({
+      location,
+      runId,
+      seq: nextSeq(),
+      ts,
+      kind,
+      payload
+    });
+  };
+  const sendTerminal = async (eventKind, payload, ts = now()) => {
+    if (terminalSent) return;
+    terminalSent = true;
+    const envelopeText = JSON.stringify({
+      kind: "run_event",
+      runId,
+      seq: nextSeq(),
+      ts,
+      eventKind,
+      payload
+    });
+    await bridge.completeTurn({
+      dispatchId,
+      location,
+      text: envelopeText,
+      idempotencyKey: `run_event:${runId}:terminal`
+    });
+  };
+  await sendProgress("progress", { message: "assignment received" });
+  const spec = parseRunSpec(envelope.runSpec);
+  if (!spec) {
+    await sendTerminal("error", { message: "remote assignment missing prompt" });
+    return;
+  }
+  const projectDir = spec.projectDir ?? fallbackProjectDir;
+  let runtimeConfig;
+  try {
+    runtimeConfig = bootstrapRuntimeConfigFn({
+      projectDir,
+      showSetup: false,
+      isolationPreset: "minimal",
+      workflowOverride: workflowNameFromRef(spec.workflow?.ref)
+    });
+  } catch (err) {
+    await sendTerminal("error", {
+      message: err instanceof Error ? err.message : String(err)
+    });
+    return;
+  }
+  for (const warning of runtimeConfig.warnings) {
+    await sendProgress("warning", { message: warning });
+  }
+  let buffered = "";
+  const pendingProgress = [];
+  const stdout = {
+    write(chunk) {
+      buffered += chunk;
+      let newline = buffered.indexOf("\n");
+      while (newline >= 0) {
+        const line = buffered.slice(0, newline).trim();
+        buffered = buffered.slice(newline + 1);
+        if (line.length > 0) {
+          try {
+            const event = JSON.parse(line);
+            const data = event.data;
+            if (event.type === "exec.completed" && data?.success === false) {
+              deferredFailedCompletion = event;
+            } else if (event.type === "exec.completed") {
+              deferredFailedCompletion = event;
+            } else {
+              pendingProgress.push(
+                sendProgress(eventKindOf(event), eventPayloadOf(event), now())
+              );
+            }
+          } catch {
+            pendingProgress.push(sendProgress("progress", { line }));
+          }
+        }
+        newline = buffered.indexOf("\n");
+      }
+      return true;
+    }
+  };
+  const stderr = {
+    write(chunk) {
+      const text = chunk.trim();
+      if (text.length > 0) pendingProgress.push(sendProgress("stderr", { text }));
+      return true;
+    }
+  };
+  try {
+    await withEnv(spec.env, async () => {
+      const result = await runExecFn({
+        prompt: spec.prompt,
+        projectDir,
+        harness: runtimeConfig.harness,
+        athenaSessionId: spec.sessionId ?? `athena-${runId}`,
+        isolationConfig: runtimeConfig.isolationConfig,
+        pluginMcpConfig: runtimeConfig.pluginMcpConfig,
+        workflow: runtimeConfig.workflow,
+        workflowPlan: runtimeConfig.workflowPlan,
+        json: true,
+        verbose: false,
+        ephemeral: false,
+        timeoutMs: spec.timeoutSec ? spec.timeoutSec * 1e3 : void 0,
+        signal: abortSignal,
+        stdout,
+        stderr
+      });
+      await Promise.all(pendingProgress);
+      if (deferredFailedCompletion) {
+        const data = typeof deferredFailedCompletion.data === "object" && deferredFailedCompletion.data !== null ? deferredFailedCompletion.data : {};
+        const ts = typeof deferredFailedCompletion.ts === "number" ? deferredFailedCompletion.ts : now();
+        const success = data.success !== false;
+        const eventKind = success ? "completion" : "error";
+        const message = !success ? result.failure?.message ?? eventPayloadOf(deferredFailedCompletion).message ?? "remote execution failed" : void 0;
+        if (message) lastTerminalFailureMessage = message;
+        await sendTerminal(
+          eventKind,
+          success ? {
+            ...data,
+            exitCode: result.exitCode,
+            athenaSessionId: result.athenaSessionId,
+            adapterSessionId: result.adapterSessionId,
+            finalMessage: result.finalMessage,
+            tokens: result.tokens,
+            durationMs: result.durationMs,
+            success: true
+          } : {
+            ...data,
+            success: result.success,
+            exitCode: result.exitCode,
+            athenaSessionId: result.athenaSessionId,
+            adapterSessionId: result.adapterSessionId,
+            finalMessage: result.finalMessage,
+            tokens: result.tokens,
+            durationMs: result.durationMs,
+            message
+          },
+          ts
+        );
+        return;
+      }
+      if (result.failure && result.failure.message !== lastTerminalFailureMessage) {
+        await sendTerminal("error", {
+          success: result.success,
+          exitCode: result.exitCode,
+          athenaSessionId: result.athenaSessionId,
+          adapterSessionId: result.adapterSessionId,
+          finalMessage: result.finalMessage,
+          tokens: result.tokens,
+          durationMs: result.durationMs,
+          message: result.failure.message
+        });
+        return;
+      }
+      await sendTerminal("completion", {
+        success: result.success,
+        exitCode: result.exitCode,
+        athenaSessionId: result.athenaSessionId,
+        adapterSessionId: result.adapterSessionId,
+        finalMessage: result.finalMessage,
+        tokens: result.tokens,
+        durationMs: result.durationMs
+      });
+    });
+  } catch (err) {
+    await Promise.all(pendingProgress);
+    await sendTerminal("error", {
+      message: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+
+// src/app/runner/envelope.ts
+function parseRunnerEnvelope(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof value !== "object" || value === null) return null;
+  const obj = value;
+  const runId = obj["runId"];
+  if (typeof runId !== "string" || runId.length === 0) return null;
+  const kind = obj["kind"];
+  if (kind === "job_assignment") {
+    return { kind, runId, runSpec: obj["runSpec"] };
+  }
+  if (kind === "cancel") {
+    return { kind, runId };
+  }
+  return null;
+}
+
+// src/app/runner/runnerSession.ts
+function createRunnerSession(opts) {
+  const {
+    bridge,
+    projectDir,
+    runExecFn = runExec,
+    bootstrapRuntimeConfigFn = bootstrapRuntimeConfig,
+    now = Date.now
+  } = opts;
+  const inflight = /* @__PURE__ */ new Map();
+  function startAssignment(envelope, dispatchId, location) {
+    const controller = new AbortController();
+    inflight.set(envelope.runId, controller);
+    return executeAssignment({
+      envelope,
+      bridge,
+      dispatchId,
+      location,
+      projectDir,
+      runExecFn,
+      bootstrapRuntimeConfigFn,
+      now,
+      abortSignal: controller.signal
+    }).finally(() => {
+      if (inflight.get(envelope.runId) === controller) {
+        inflight.delete(envelope.runId);
+      }
+    });
+  }
+  return {
+    handleDispatch(input) {
+      const envelope = parseRunnerEnvelope(input.text);
+      if (!envelope) {
+        return { recognised: false, completed: Promise.resolve() };
+      }
+      if (envelope.kind === "job_assignment") {
+        const completed = startAssignment(
+          envelope,
+          input.dispatchId,
+          input.location
+        );
+        return { recognised: true, completed };
+      }
+      const controller = inflight.get(envelope.runId);
+      if (controller) controller.abort();
+      return { recognised: true, completed: Promise.resolve() };
+    }
+  };
+}
+
+// src/app/runner/dispatchRouter.ts
+function makeDispatchRouter(opts) {
+  return (payload) => {
+    if (opts.runnerSession) {
+      const result = opts.runnerSession.handleDispatch({
+        text: payload.inbound.text,
+        dispatchId: payload.dispatchId,
+        location: payload.inbound.location
+      });
+      if (result.recognised) return;
+    }
+    opts.fallback(payload);
+  };
+}
+
 // src/ui/components/SessionPicker.tsx
 import { useState as useState11 } from "react";
 import { Box as Box11, Text as Text17, useInput as useInput12, useStdout as useStdout5 } from "ink";
@@ -13318,17 +13743,25 @@ function AppContent({
     [addMessage, currentSessionId, feedEvents.length, spawnHarness]
   );
   submitDispatchAsTurnRef.current = submitDispatchAsTurn;
+  const runnerSession = useMemo17(
+    () => sessionBridge ? createRunnerSession({ bridge: sessionBridge, projectDir }) : null,
+    [sessionBridge, projectDir]
+  );
   useEffect14(() => {
     if (!sessionBridge) return;
-    const off = sessionBridge.onTurnDispatch((payload) => {
-      if (isHarnessRunningRef.current || pendingDispatchRef.current) {
-        queuedDispatchRef.current = payload;
-        return;
+    const router = makeDispatchRouter({
+      runnerSession,
+      fallback: (payload) => {
+        if (isHarnessRunningRef.current || pendingDispatchRef.current) {
+          queuedDispatchRef.current = payload;
+          return;
+        }
+        submitDispatchAsTurnRef.current?.(payload);
       }
-      submitDispatchAsTurnRef.current?.(payload);
     });
+    const off = sessionBridge.onTurnDispatch(router);
     return off;
-  }, [sessionBridge]);
+  }, [sessionBridge, runnerSession]);
   useEffect14(() => {
     if (isHarnessRunning) return;
     if (pendingDispatchRef.current) return;
@@ -14363,6 +14796,7 @@ function App({
   isolationPreset,
   ascii,
   athenaSessionId: initialAthenaSessionId,
+  attachmentId,
   initialTelemetryDiagnosticsConsent
 }) {
   const [clearCount, setClearCount] = useState18(0);
@@ -14578,6 +15012,7 @@ function App({
         runtimeState.isolation?.allowedTools
       ),
       athenaSessionId,
+      ...attachmentId !== void 0 ? { attachmentId } : {},
       children: /* @__PURE__ */ jsx24(
         AppContent,
         {
@@ -15414,744 +15849,385 @@ function runChannelCommand(input, deps = {}) {
 
 // src/app/entry/dashboardCommand.ts
 import crypto3 from "crypto";
-import { spawn as spawn2 } from "child_process";
-import fs7 from "fs";
+import { spawn } from "child_process";
+import fs6 from "fs";
 import { createRequire } from "module";
 import os5 from "os";
-import path7 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import path6 from "path";
+import { fileURLToPath } from "url";
 
-// src/app/entry/gatewayCommand.ts
-import { spawn } from "child_process";
+// src/infra/daemon/serviceUnit.ts
 import fs5 from "fs";
+import os4 from "os";
 import path5 from "path";
-import { fileURLToPath } from "url";
-var USAGE4 = `Usage: athena-flow gateway <subcommand> [--json]
-
-Subcommands:
-  start     Run the gateway daemon in foreground (only mode in this build).
-            Options: [--bind <host:port>] [--insecure]
-                     [--tls-cert <path>] [--tls-key <path>]
-                     [--grace-period-ms <n>]
-  status    Print daemon pid, uptime, and version.
-  probe     Send a ping RPC and report reachability + latency.
-  link      Store a remote WS/WSS gateway endpoint for this user.
-  unlink    Restore local UDS gateway mode for this user.
-  rotate-token  Regenerate the gateway token file (server-side).
-                Restart the daemon to drop existing connections; clients
-                must re-run "athena gateway link --token <new>".
-  reload-channels  Reload channel sidecars without restarting the daemon.
-`;
-function defaultResolveDaemonEntry() {
-  const here = path5.dirname(fileURLToPath(import.meta.url));
-  return path5.resolve(here, "athena-gateway.js");
+function installServiceUnit(options) {
+  const platform = options.platform ?? process.platform;
+  const env2 = options.env ?? process.env;
+  const home = env2["HOME"] ?? os4.homedir();
+  if (platform === "darwin") {
+    const target = options.targetPath ?? path5.join(home, "Library", "LaunchAgents", "ai.drisp.daemon.plist");
+    const paths = daemonStatePaths(env2);
+    const plist = renderLaunchdPlist({
+      label: "ai.drisp.daemon",
+      nodeBinary: options.nodeBinary,
+      daemonEntry: options.daemonEntry,
+      workingDirectory: home,
+      stdoutPath: paths.logPath,
+      stderrPath: paths.logPath
+    });
+    writeIfChanged(target, plist);
+    return {
+      ok: true,
+      platform: "darwin",
+      path: target,
+      loadCommand: `launchctl load -w ${target}`,
+      startCommand: "launchctl start ai.drisp.daemon"
+    };
+  }
+  if (platform === "linux") {
+    const target = options.targetPath ?? path5.join(home, ".config", "systemd", "user", "drisp-daemon.service");
+    const unit = renderSystemdUnit({
+      description: "Drisp dashboard runtime daemon",
+      nodeBinary: options.nodeBinary,
+      daemonEntry: options.daemonEntry
+    });
+    writeIfChanged(target, unit);
+    return {
+      ok: true,
+      platform: "linux",
+      path: target,
+      loadCommand: "systemctl --user daemon-reload",
+      startCommand: "systemctl --user enable --now drisp-daemon.service"
+    };
+  }
+  return {
+    ok: false,
+    platform: "unsupported",
+    message: `service install not supported on ${platform}`
+  };
 }
-function readToken(tokenPath) {
+function writeIfChanged(target, content) {
+  const dir = path5.dirname(target);
+  fs5.mkdirSync(dir, { recursive: true, mode: 448 });
+  let existing = null;
   try {
-    return fs5.readFileSync(tokenPath, "utf-8").trim();
+    existing = fs5.readFileSync(target, "utf-8");
   } catch (err) {
-    const code = err.code;
-    if (code === "ENOENT") {
-      throw new Error(
-        `gateway token missing at ${tokenPath}. Start the daemon with "athena gateway start" first.`
-      );
-    }
-    throw err;
+    if (err.code !== "ENOENT") throw err;
   }
+  if (existing === content) return;
+  fs5.writeFileSync(target, content, { mode: 384 });
 }
-function flagJson(args) {
-  return args.includes("--json");
-}
-async function runGatewayCommand(input, deps = {}) {
-  const logOut = deps.logOut ?? ((m) => process.stdout.write(m + "\n"));
-  const logError = deps.logError ?? ((m) => process.stderr.write(m + "\n"));
-  const resolveDaemonEntry2 = deps.resolveDaemonEntry ?? defaultResolveDaemonEntry;
-  const resolveSocketPath = deps.resolveSocketPath ?? (() => resolveGatewayPaths().socketPath);
-  const resolveTokenPath = deps.resolveTokenPath ?? (() => resolveGatewayPaths().tokenPath);
-  const readClientConfig = deps.readClientConfig ?? readGatewayClientConfig;
-  const writeClientConfig = deps.writeClientConfig ?? ((config) => writeGatewayClientConfig(config));
-  const connectGateway = deps.connectGateway ?? defaultConnectGateway;
-  const spawnDaemon = deps.spawnDaemon ?? ((entry, args) => spawn(process.execPath, [entry, ...args], { stdio: "inherit" }));
-  const { subcommand, subcommandArgs } = input;
-  if (!subcommand || subcommand === "help" || subcommand === "--help") {
-    logOut(USAGE4);
-    return 0;
-  }
-  if (subcommand === "start") {
-    const entry = resolveDaemonEntry2();
-    const child = spawnDaemon(entry, subcommandArgs);
-    return await new Promise((resolve) => {
-      child.once("exit", (code) => resolve(code ?? 0));
-      child.once("error", (err) => {
-        logError(`gateway start: failed to spawn daemon: ${err.message}`);
-        resolve(1);
-      });
-    });
-  }
-  if (subcommand === "link") {
-    const parsed = parseLinkArgs(subcommandArgs);
-    if (!parsed.ok) {
-      logError(parsed.message);
-      return 2;
+function renderLaunchdPlist(input) {
+  const argv = [input.nodeBinary, input.daemonEntry].map((s) => `		<string>${escapeXml(s)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>${escapeXml(input.label)}</string>
+	<key>ProgramArguments</key>
+	<array>
+${argv}
+	</array>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<dict>
+		<key>SuccessfulExit</key>
+		<false/>
+	</dict>
+	<key>WorkingDirectory</key>
+	<string>${escapeXml(input.workingDirectory)}</string>
+	<key>StandardOutPath</key>
+	<string>${escapeXml(input.stdoutPath)}</string>
+	<key>StandardErrorPath</key>
+	<string>${escapeXml(input.stderrPath)}</string>
+	<key>ProcessType</key>
+	<string>Background</string>
+</dict>
+</plist>
+`;
+}
+function renderSystemdUnit(input) {
+  return `[Unit]
+Description=${input.description}
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${input.nodeBinary} ${input.daemonEntry}
+Restart=always
+RestartSec=5
+SuccessExitStatus=0
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target
+`;
+}
+function escapeXml(input) {
+  return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+// src/app/entry/dashboardCommand.ts
+var USAGE4 = `Usage: athena dashboard <subcommand> [options]
+
+Subcommands:
+  pair <token> --url <dashboard-origin> [--name <machine-name>]
+            Pair this machine with the dashboard, install the runtime
+            daemon, and verify it reaches the dashboard socket.
+  status    Show pairing, runner binding, daemon process state, socket
+            health, and token freshness. Non-zero on any unhealthy axis.
+  logs [--tail N] [--follow]
+            Tail the daemon log file at
+            ~/.local/state/drisp/dashboard-daemon.log.
+  runs [--active] [--limit N]
+            List runs the daemon has handled (in-memory ring, last 100).
+  refresh   Mint a short-lived access token (rotates the refresh token).
+  daemon foreground
+            Run the daemon in the foreground (process supervisors,
+            debugging).
+  daemon start|stop|restart|reload
+            Local IPC against the daemon UDS.
+  daemon install
+            Generate a launchd plist (macOS) or systemd user unit (linux)
+            so the daemon starts automatically on login.
+  doctor    Verify pairing health. With --runner <id>, also confirms the
+            runner is bound to this instance.
+  list      Print the local attachment mirror (the runners the dashboard
+            reported as bound to this instance at the last pair/refresh).
+  connect   Deprecated alias for "daemon foreground".
+  unpair    Stop the daemon, revoke the refresh token, and remove the
+            local config.
+
+Options:
+  --url <origin>      Dashboard origin (required for pair)
+  --runner <id>       Runner id (optional for "doctor")
+  --name <name>       Friendly machine name (optional, defaults to hostname)
+  --tail N            Number of trailing log lines (default 20)
+  --follow            Stream new log lines until interrupted
+  --active            Show only active runs
+  --limit N           Cap the number of runs returned
+  --json              Emit machine-readable JSON output
+`;
+var require_ = createRequire(import.meta.url);
+var cachedVersion = null;
+function readPackageVersion() {
+  if (cachedVersion !== null) return cachedVersion;
+  try {
+    const injected = "0.4.7";
+    if (typeof injected === "string" && injected.length > 0) {
+      cachedVersion = injected;
+      return cachedVersion;
     }
-    writeClientConfig({
-      mode: "remote",
-      url: parsed.url,
-      token: parsed.token,
-      ...parsed.tlsCaPath !== void 0 ? { tlsCaPath: parsed.tlsCaPath } : {}
-    });
-    logOut(`gateway: linked remote endpoint ${parsed.url}`);
+  } catch {
+  }
+  try {
+    const pkg = require_("../../../package.json");
+    cachedVersion = pkg.version ?? "0.0.0";
+  } catch {
+    cachedVersion = "0.0.0";
+  }
+  return cachedVersion;
+}
+function defaultFingerprint() {
+  const seed = [
+    os5.hostname(),
+    os5.userInfo().username,
+    os5.platform(),
+    os5.arch()
+  ].join("\0");
+  return crypto3.createHash("sha256").update(seed).digest("hex");
+}
+function defaultHostInfo(name) {
+  return {
+    hostname: os5.hostname(),
+    user: os5.userInfo().username,
+    platform: os5.platform(),
+    arch: os5.arch(),
+    name: name ?? os5.hostname()
+  };
+}
+async function runDashboardCommand(input, deps = {}) {
+  const logOut = deps.logOut ?? ((m) => process.stdout.write(m + "\n"));
+  const logError = deps.logError ?? ((m) => process.stderr.write(m + "\n"));
+  const fetchImpl = deps.fetch ?? fetch;
+  const now = deps.now ?? (() => Date.now());
+  const fingerprint = deps.fingerprint ?? defaultFingerprint;
+  const readConfig2 = deps.readConfig ?? (() => readDashboardClientConfig());
+  const writeConfig = deps.writeConfig ?? ((c2) => writeDashboardClientConfig(c2));
+  const removeConfig = deps.removeConfig ?? (() => removeDashboardClientConfig());
+  const configPath = deps.configPath ?? (() => dashboardClientConfigPath());
+  const readMirror = deps.readMirror ?? (() => readAttachmentMirror());
+  const writeMirror = deps.writeMirror ?? ((m) => writeAttachmentMirror(m));
+  const removeMirror = deps.removeMirror ?? (() => removeAttachmentMirror());
+  const packageVersion = deps.packageVersion ?? readPackageVersion();
+  const { subcommand, subcommandArgs, flags } = input;
+  if (!subcommand || subcommand === "help" || subcommand === "--help") {
+    logOut(USAGE4);
     return 0;
   }
-  if (subcommand === "rotate-token") {
-    const json = flagJson(subcommandArgs);
-    const extras = subcommandArgs.filter((a) => a !== "--json");
-    if (extras.length > 0) {
-      logError(`gateway rotate-token: unexpected argument ${extras[0]}`);
+  if (subcommand === "pair") {
+    const token = subcommandArgs[0];
+    if (!token) {
+      logError("dashboard pair: missing pairing token");
+      logError(USAGE4);
       return 2;
     }
-    const tokenPath = resolveTokenPath();
+    if (subcommandArgs.length > 1) {
+      logError(`dashboard pair: unexpected argument ${subcommandArgs[1]}`);
+      return 2;
+    }
+    if (!flags.url) {
+      logError("dashboard pair: --url <dashboard-origin> is required");
+      return 2;
+    }
+    let origin;
     try {
-      const newToken = rotateGatewayToken(tokenPath);
-      if (json) {
-        logOut(JSON.stringify({ ok: true, token: newToken, tokenPath }));
-      } else {
-        logOut(newToken);
-        logOut(
-          `gateway: rotated token at ${tokenPath}. Restart the daemon to drop existing connections, then re-run "athena gateway link --token <new>" on each client.`
-        );
-      }
-      return 0;
+      origin = normalizeDashboardUrl(flags.url);
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (json) {
-        logOut(JSON.stringify({ ok: false, message }));
-      } else {
-        logError(`gateway rotate-token: ${message}`);
-      }
-      return 1;
-    }
-  }
-  if (subcommand === "unlink") {
-    if (subcommandArgs.length > 0) {
-      logError("gateway unlink does not accept arguments");
+      logError(
+        `dashboard pair: ${err instanceof Error ? err.message : String(err)}`
+      );
       return 2;
     }
-    writeClientConfig({ mode: "local" });
-    logOut("gateway: using local gateway endpoint");
-    return 0;
-  }
-  if (subcommand === "probe") {
-    const json = flagJson(subcommandArgs);
-    const socketPath = resolveSocketPath();
-    const tokenPath = resolveTokenPath();
-    const endpoint = readClientConfig();
-    const startedAt = Date.now();
+    const fp = fingerprint();
+    const body = {
+      token,
+      fingerprint: fp,
+      hostInfo: (deps.hostInfo ?? (() => defaultHostInfo(flags.name)))(),
+      capabilities: {
+        instanceSocket: true,
+        runtimeDaemon: true,
+        cliVersion: packageVersion,
+        // Legacy field — older dashboards read `version`. Drop in a
+        // follow-up release once the dashboard accepts only `cliVersion`.
+        version: packageVersion
+      }
+    };
+    let response;
     try {
-      const client = await connectGateway({
-        endpoint,
-        socketPath,
-        tokenPath,
-        timeoutMs: 3e3
+      response = await fetchImpl(`${origin}/api/instances/pair`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
       });
-      const res = await client.request("ping", {});
-      client.close();
-      const latencyMs = Date.now() - startedAt;
-      if (json) {
-        logOut(
-          JSON.stringify({
-            ok: true,
-            reachable: true,
-            latency_ms: latencyMs,
-            daemon_pid: res.daemonPid,
-            daemon_uptime_ms: res.uptimeMs
-          })
-        );
-      } else {
-        logOut(
-          `gateway: reachable pid=${res.daemonPid} uptime=${res.uptimeMs}ms latency=${latencyMs}ms`
-        );
-      }
-      return 0;
     } catch (err) {
-      return reportProbeFailure(err, json, logOut, logError);
+      logError(
+        `dashboard pair: failed to reach ${origin}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return 1;
     }
-  }
-  if (subcommand === "reload-channels") {
-    const json = flagJson(subcommandArgs);
-    const extras = subcommandArgs.filter((a) => a !== "--json");
-    if (extras.length > 0) {
-      logError(`gateway reload-channels: unexpected argument ${extras[0]}`);
-      return 2;
+    if (!response.ok) {
+      const message = await safeReadError(response);
+      logError(
+        `dashboard pair: ${origin} returned ${response.status}${message ? ` \u2014 ${message}` : ""}`
+      );
+      return 1;
     }
-    const socketPath = resolveSocketPath();
-    const tokenPath = resolveTokenPath();
-    const endpoint = readClientConfig();
+    let parsed;
     try {
-      const client = await connectGateway({
-        endpoint,
-        socketPath,
-        tokenPath,
-        timeoutMs: 3e3
-      });
-      const res = await client.request("channels.reload", {});
-      client.close();
-      if (json) {
-        logOut(JSON.stringify({ ok: true, ...res }));
-      } else if (res.results.length === 0) {
-        logOut("gateway: channels reloaded (no channel sidecars found)");
-      } else {
-        logOut("gateway: channels reloaded");
-        for (const result of res.results) {
-          logOut(formatChannelReloadResult(result));
-        }
-      }
-      return 0;
+      parsed = parsePairResponse(await response.json());
     } catch (err) {
-      return reportProbeFailure(err, json, logOut, logError);
+      logError(
+        `dashboard pair: invalid response from ${origin}: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return 1;
     }
-  }
-  if (subcommand === "status") {
-    const json = flagJson(subcommandArgs);
-    const socketPath = resolveSocketPath();
-    const tokenPath = resolveTokenPath();
-    const endpoint = readClientConfig();
+    if (parsed.requiredCliVersion && compareSemver(packageVersion, parsed.requiredCliVersion) < 0) {
+      logError(
+        `dashboard pair: cli version ${packageVersion} is older than the dashboard's required >=${parsed.requiredCliVersion}.`
+      );
+      logError(
+        "dashboard pair: upgrade with `npm i -g @drisp/cli` then re-run pair."
+      );
+      return 1;
+    }
+    const config = {
+      dashboardUrl: origin,
+      instanceId: parsed.instanceId,
+      refreshToken: parsed.refreshToken,
+      fingerprint: fp,
+      pairedAt: now()
+    };
+    writeConfig(config);
     try {
-      const client = await connectGateway({
-        endpoint,
-        socketPath,
-        tokenPath,
-        timeoutMs: 3e3
+      writeMirror({
+        instanceId: parsed.instanceId,
+        fetchedAt: now(),
+        attachments: (parsed.runners ?? []).map((r) => ({
+          runnerId: r.runnerId,
+          ...r.name !== void 0 ? { name: r.name } : {},
+          ...r.executionTarget !== void 0 ? { executionTarget: r.executionTarget } : {},
+          ...r.remoteInstanceId !== void 0 ? { remoteInstanceId: r.remoteInstanceId } : {}
+        }))
       });
-      const res = await client.request("status", {});
-      client.close();
-      if (json) {
-        logOut(JSON.stringify(res));
-      } else {
-        const listenerSummary = formatListenerSummary(res.listener);
-        const channelSummary = formatChannelSummary(res.channels);
-        const runtimeSummary = formatRuntimeSummary(res.runtimes[0]);
-        logOut(
-          `gateway: running pid=${res.daemonPid} uptime=${res.uptimeMs}ms version=${res.version} ${listenerSummary}${channelSummary}${runtimeSummary}`
-        );
-      }
-      return 0;
     } catch (err) {
-      return reportProbeFailure(err, json, logOut, logError);
+      logError(
+        `dashboard pair: failed to write attachment mirror: ${err instanceof Error ? err.message : String(err)}`
+      );
     }
-  }
-  logError(`Unknown gateway subcommand: ${subcommand}`);
-  logError(USAGE4);
-  return 2;
-}
-async function defaultConnectGateway(opts) {
-  if (opts.endpoint.mode === "remote") {
-    return connect({
-      socketPath: opts.socketPath,
-      token: opts.endpoint.token,
-      timeoutMs: opts.timeoutMs,
-      transport: createWsClientTransport(
-        wsClientOptionsForEndpoint({
-          url: opts.endpoint.url,
-          timeoutMs: opts.timeoutMs,
-          tlsCaPath: opts.endpoint.tlsCaPath
-        })
-      )
+    const daemonStart = await (deps.startRuntimeDaemon ?? defaultStartRuntimeDaemon)({
+      log: (msg) => logOut(msg)
     });
-  }
-  return connect({
-    socketPath: opts.socketPath,
-    token: readToken(opts.tokenPath),
-    timeoutMs: opts.timeoutMs
-  });
-}
-function parseLinkArgs(args) {
-  const positional = [];
-  let token;
-  let tlsCaPath;
-  for (let i = 0; i < args.length; i += 1) {
-    const arg = args[i];
-    if (arg === "--token") {
-      const v = args[i + 1];
-      if (!v || v.startsWith("--")) {
-        return { ok: false, message: "gateway link --token requires a value" };
-      }
-      token = v;
-      i += 1;
-      continue;
-    }
-    if (arg === "--tls-ca") {
-      const v = args[i + 1];
-      if (!v || v.startsWith("--")) {
-        return { ok: false, message: "gateway link --tls-ca requires a path" };
-      }
-      tlsCaPath = v;
-      i += 1;
-      continue;
-    }
-    if (arg.startsWith("--token=")) {
-      token = arg.slice("--token=".length);
-      continue;
-    }
-    if (arg.startsWith("--tls-ca=")) {
-      tlsCaPath = arg.slice("--tls-ca=".length);
-      continue;
-    }
-    if (arg.startsWith("--")) {
-      return { ok: false, message: `gateway link: unknown option ${arg}` };
-    }
-    positional.push(arg);
-  }
-  const url = positional[0];
-  if (!url) {
-    return { ok: false, message: "gateway link requires a ws:// or wss:// URL" };
-  }
-  if (positional.length > 1) {
-    return { ok: false, message: "gateway link accepts exactly one URL" };
-  }
-  if (!isSupportedGatewayUrl(url)) {
-    return { ok: false, message: "gateway link URL must use ws:// or wss://" };
-  }
-  if (!token) {
-    return { ok: false, message: "gateway link requires --token <token>" };
-  }
-  if (tlsCaPath !== void 0 && tlsCaPath.length === 0) {
-    return { ok: false, message: "gateway link --tls-ca requires a path" };
-  }
-  return {
-    ok: true,
-    url,
-    token,
-    ...tlsCaPath !== void 0 ? { tlsCaPath } : {}
-  };
-}
-function reportProbeFailure(err, json, logOut, logError) {
-  const message = err instanceof Error ? err.message : String(err);
-  if (err instanceof GatewayUnreachableError) {
-    if (json) {
+    if (flags.json) {
       logOut(
         JSON.stringify({
-          ok: false,
-          reachable: false,
-          reason: "unreachable",
-          message
+          ok: true,
+          instanceId: parsed.instanceId,
+          dashboardUrl: origin,
+          configPath: configPath(),
+          daemon: daemonStart,
+          ...parsed.runners ? { runners: parsed.runners } : {},
+          ...parsed.capabilityAck ? { capabilityAck: parsed.capabilityAck } : {},
+          ...parsed.requiredCliVersion ? { requiredCliVersion: parsed.requiredCliVersion } : {}
         })
       );
     } else {
-      logError(`gateway: not reachable \u2014 ${message}`);
+      logOut(`dashboard: paired to ${origin} as ${parsed.instanceId}`);
+      if (parsed.runners && parsed.runners.length > 0) {
+        for (const runner of parsed.runners) {
+          logOut(
+            `dashboard: bound runner ${runner.name ?? runner.runnerId} (${runner.runnerId})`
+          );
+        }
+      } else {
+        logOut("dashboard: no runner bound to this pairing token.");
+        logOut(
+          "dashboard: bind a runner from runner settings, then this machine will receive its runs."
+        );
+      }
+      if (parsed.capabilityAck === void 0) {
+        logOut(
+          "dashboard: dashboard did not echo capabilityAck (older server). Continuing."
+        );
+      }
+      if (daemonStart.ok) {
+        const status = daemonStart.alreadyRunning ? "runtime daemon already running, restarted with new token" : daemonStart.connected ? "runtime daemon connected (verified socket open)" : "runtime daemon started but did not reach the socket within 10s";
+        logOut(`dashboard: ${status}`);
+        if (!daemonStart.connected && !daemonStart.alreadyRunning) {
+          logOut(
+            "dashboard pair: pairing succeeded; tail logs with `drisp dashboard logs --follow`."
+          );
+        }
+      } else {
+        logError(
+          `dashboard: runtime daemon did not start${daemonStart.message ? ` \u2014 ${daemonStart.message}` : ""}`
+        );
+        logOut(
+          "dashboard pair: pairing succeeded; start the daemon with `drisp dashboard daemon start`."
+        );
+      }
+      logOut("dashboard: ready. Click Run in the dashboard.");
     }
-    return 1;
+    return 0;
   }
-  if (err instanceof GatewayUnauthorizedError) {
-    if (json) {
-      logOut(
-        JSON.stringify({
-          ok: false,
-          reachable: true,
-          reason: "unauthorized",
-          message
-        })
-      );
-    } else {
-      logError(`gateway: unauthorized \u2014 ${message}`);
-    }
-    return 1;
-  }
-  if (json) {
-    logOut(JSON.stringify({ ok: false, reason: "error", message }));
-  } else {
-    logError(`gateway: ${message}`);
-  }
-  return 1;
-}
-function formatRuntimeSummary(r) {
-  if (!r) return " runtime=<none>";
-  const lastRebindAt = r.binding.state !== "none" ? r.binding.lastRebindAt : void 0;
-  const rebind = lastRebindAt !== void 0 ? ` rebound=${formatElapsed(Date.now() - lastRebindAt)}` : "";
-  return ` runtime=${r.runtimeId} binding=${r.binding.state} pid=${r.pid}${rebind}`;
-}
-function formatChannelReloadResult(result) {
-  const suffix = result.reason ? `: ${result.reason}` : "";
-  return `  ${result.id} ${result.action}${suffix}`;
-}
-function formatChannelSummary(channels) {
-  if (channels.length === 0) return " channels=<none>";
-  const parts = channels.map((channel) => {
-    const note = channel.note ? `(${channel.note})` : "";
-    return `${channel.id}:${channel.state}${note}`;
-  });
-  return ` channels=${parts.join(",")}`;
-}
-function formatListenerSummary(listener) {
-  if (listener.kind === "uds") {
-    return `listener=uds:${listener.socketPath}`;
-  }
-  const flags = [];
-  if (listener.tls) flags.push("tls");
-  if (listener.insecure) flags.push("insecure");
-  const suffix = flags.length > 0 ? ` (${flags.join(",")})` : "";
-  return `listener=${listener.url}${suffix}`;
-}
-
-// src/infra/daemon/serviceUnit.ts
-import fs6 from "fs";
-import os4 from "os";
-import path6 from "path";
-function installServiceUnit(options) {
-  const platform = options.platform ?? process.platform;
-  const env2 = options.env ?? process.env;
-  const home = env2["HOME"] ?? os4.homedir();
-  if (platform === "darwin") {
-    const target = options.targetPath ?? path6.join(home, "Library", "LaunchAgents", "ai.drisp.daemon.plist");
-    const paths = daemonStatePaths(env2);
-    const plist = renderLaunchdPlist({
-      label: "ai.drisp.daemon",
-      nodeBinary: options.nodeBinary,
-      daemonEntry: options.daemonEntry,
-      workingDirectory: home,
-      stdoutPath: paths.logPath,
-      stderrPath: paths.logPath
-    });
-    writeIfChanged(target, plist);
-    return {
-      ok: true,
-      platform: "darwin",
-      path: target,
-      loadCommand: `launchctl load -w ${target}`,
-      startCommand: "launchctl start ai.drisp.daemon"
-    };
-  }
-  if (platform === "linux") {
-    const target = options.targetPath ?? path6.join(home, ".config", "systemd", "user", "drisp-daemon.service");
-    const unit = renderSystemdUnit({
-      description: "Drisp dashboard runtime daemon",
-      nodeBinary: options.nodeBinary,
-      daemonEntry: options.daemonEntry
-    });
-    writeIfChanged(target, unit);
-    return {
-      ok: true,
-      platform: "linux",
-      path: target,
-      loadCommand: "systemctl --user daemon-reload",
-      startCommand: "systemctl --user enable --now drisp-daemon.service"
-    };
-  }
-  return {
-    ok: false,
-    platform: "unsupported",
-    message: `service install not supported on ${platform}`
-  };
-}
-function writeIfChanged(target, content) {
-  const dir = path6.dirname(target);
-  fs6.mkdirSync(dir, { recursive: true, mode: 448 });
-  let existing = null;
-  try {
-    existing = fs6.readFileSync(target, "utf-8");
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-  }
-  if (existing === content) return;
-  fs6.writeFileSync(target, content, { mode: 384 });
-}
-function renderLaunchdPlist(input) {
-  const argv = [input.nodeBinary, input.daemonEntry].map((s) => `		<string>${escapeXml(s)}</string>`).join("\n");
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>Label</key>
-	<string>${escapeXml(input.label)}</string>
-	<key>ProgramArguments</key>
-	<array>
-${argv}
-	</array>
-	<key>RunAtLoad</key>
-	<true/>
-	<key>KeepAlive</key>
-	<dict>
-		<key>SuccessfulExit</key>
-		<false/>
-	</dict>
-	<key>WorkingDirectory</key>
-	<string>${escapeXml(input.workingDirectory)}</string>
-	<key>StandardOutPath</key>
-	<string>${escapeXml(input.stdoutPath)}</string>
-	<key>StandardErrorPath</key>
-	<string>${escapeXml(input.stderrPath)}</string>
-	<key>ProcessType</key>
-	<string>Background</string>
-</dict>
-</plist>
-`;
-}
-function renderSystemdUnit(input) {
-  return `[Unit]
-Description=${input.description}
-After=network-online.target
-
-[Service]
-Type=simple
-ExecStart=${input.nodeBinary} ${input.daemonEntry}
-Restart=always
-RestartSec=5
-SuccessExitStatus=0
-StandardOutput=journal
-StandardError=journal
-
-[Install]
-WantedBy=default.target
-`;
-}
-function escapeXml(input) {
-  return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-
-// src/app/entry/dashboardCommand.ts
-var USAGE5 = `Usage: athena dashboard <subcommand> [options]
-
-Subcommands:
-  pair <token> --url <dashboard-origin> [--name <machine-name>]
-            Pair this machine with the dashboard, install the runtime
-            daemon, and verify it reaches the dashboard socket.
-  status    Show pairing, runner binding, daemon process state, socket
-            health, and token freshness. Non-zero on any unhealthy axis.
-  logs [--tail N] [--follow]
-            Tail the daemon log file at
-            ~/.local/state/drisp/dashboard-daemon.log.
-  runs [--active] [--limit N]
-            List runs the daemon has handled (in-memory ring, last 100).
-  refresh   Mint a short-lived access token (rotates the refresh token).
-  daemon foreground
-            Run the daemon in the foreground (process supervisors,
-            debugging).
-  daemon start|stop|restart|reload
-            Local IPC against the daemon UDS.
-  daemon install
-            Generate a launchd plist (macOS) or systemd user unit (linux)
-            so the daemon starts automatically on login.
-  doctor    Verify pairing health. With --runner <id>, also confirms the
-            runner is bound to this instance.
-  console enable <runnerId>
-            Configure the console channel for a runner (opinionated;
-            writes the sidecar and reloads the gateway).
-  console link <runnerId>
-            Primitive: write ~/.config/athena/channels/console.json for
-            the given runner. Prefer "console enable".
-  connect   Deprecated alias for "daemon foreground".
-  unpair    Stop the daemon, revoke the refresh token, and remove the
-            local config.
-
-Options:
-  --url <origin>      Dashboard origin (required for pair)
-  --runner <id>       Runner id (required for "console enable"/"console
-                      link", optional for "doctor")
-  --name <name>       Friendly machine name (optional, defaults to hostname)
-  --tail N            Number of trailing log lines (default 20)
-  --follow            Stream new log lines until interrupted
-  --active            Show only active runs
-  --limit N           Cap the number of runs returned
-  --json              Emit machine-readable JSON output
-`;
-var require_ = createRequire(import.meta.url);
-var cachedVersion = null;
-function readPackageVersion() {
-  if (cachedVersion !== null) return cachedVersion;
-  try {
-    const injected = "0.4.4";
-    if (typeof injected === "string" && injected.length > 0) {
-      cachedVersion = injected;
-      return cachedVersion;
-    }
-  } catch {
-  }
-  try {
-    const pkg = require_("../../../package.json");
-    cachedVersion = pkg.version ?? "0.0.0";
-  } catch {
-    cachedVersion = "0.0.0";
-  }
-  return cachedVersion;
-}
-function defaultFingerprint() {
-  const seed = [
-    os5.hostname(),
-    os5.userInfo().username,
-    os5.platform(),
-    os5.arch()
-  ].join("\0");
-  return crypto3.createHash("sha256").update(seed).digest("hex");
-}
-function defaultHostInfo(name) {
-  return {
-    hostname: os5.hostname(),
-    user: os5.userInfo().username,
-    platform: os5.platform(),
-    arch: os5.arch(),
-    name: name ?? os5.hostname()
-  };
-}
-async function runDashboardCommand(input, deps = {}) {
-  const logOut = deps.logOut ?? ((m) => process.stdout.write(m + "\n"));
-  const logError = deps.logError ?? ((m) => process.stderr.write(m + "\n"));
-  const fetchImpl = deps.fetch ?? fetch;
-  const now = deps.now ?? (() => Date.now());
-  const fingerprint = deps.fingerprint ?? defaultFingerprint;
-  const readConfig2 = deps.readConfig ?? (() => readDashboardClientConfig());
-  const writeConfig = deps.writeConfig ?? ((c2) => writeDashboardClientConfig(c2));
-  const removeConfig = deps.removeConfig ?? (() => removeDashboardClientConfig());
-  const configPath = deps.configPath ?? (() => dashboardClientConfigPath());
-  const packageVersion = deps.packageVersion ?? readPackageVersion();
-  const { subcommand, subcommandArgs, flags } = input;
-  if (!subcommand || subcommand === "help" || subcommand === "--help") {
-    logOut(USAGE5);
-    return 0;
-  }
-  if (subcommand === "pair") {
-    const token = subcommandArgs[0];
-    if (!token) {
-      logError("dashboard pair: missing pairing token");
-      logError(USAGE5);
-      return 2;
-    }
-    if (subcommandArgs.length > 1) {
-      logError(`dashboard pair: unexpected argument ${subcommandArgs[1]}`);
-      return 2;
-    }
-    if (!flags.url) {
-      logError("dashboard pair: --url <dashboard-origin> is required");
-      return 2;
-    }
-    let origin;
-    try {
-      origin = normalizeDashboardUrl(flags.url);
-    } catch (err) {
-      logError(
-        `dashboard pair: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 2;
-    }
-    const fp = fingerprint();
-    const body = {
-      token,
-      fingerprint: fp,
-      hostInfo: (deps.hostInfo ?? (() => defaultHostInfo(flags.name)))(),
-      capabilities: {
-        instanceSocket: true,
-        consoleAdapter: true,
-        runtimeDaemon: true,
-        cliVersion: packageVersion,
-        // Legacy field — older dashboards read `version`. Drop in a
-        // follow-up release once the dashboard accepts only `cliVersion`.
-        version: packageVersion
-      }
-    };
-    let response;
-    try {
-      response = await fetchImpl(`${origin}/api/instances/pair`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      logError(
-        `dashboard pair: failed to reach ${origin}: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 1;
-    }
-    if (!response.ok) {
-      const message = await safeReadError(response);
-      logError(
-        `dashboard pair: ${origin} returned ${response.status}${message ? ` \u2014 ${message}` : ""}`
-      );
-      return 1;
-    }
-    let parsed;
-    try {
-      parsed = parsePairResponse(await response.json());
-    } catch (err) {
-      logError(
-        `dashboard pair: invalid response from ${origin}: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 1;
-    }
-    if (parsed.requiredCliVersion && compareSemver(packageVersion, parsed.requiredCliVersion) < 0) {
-      logError(
-        `dashboard pair: cli version ${packageVersion} is older than the dashboard's required >=${parsed.requiredCliVersion}.`
-      );
-      logError(
-        "dashboard pair: upgrade with `npm i -g @drisp/cli` then re-run pair."
-      );
-      return 1;
-    }
-    const config = {
-      dashboardUrl: origin,
-      instanceId: parsed.instanceId,
-      refreshToken: parsed.refreshToken,
-      fingerprint: fp,
-      pairedAt: now()
-    };
-    writeConfig(config);
-    const daemonStart = await (deps.startRuntimeDaemon ?? defaultStartRuntimeDaemon)({
-      log: (msg) => logOut(msg)
-    });
-    if (flags.json) {
-      logOut(
-        JSON.stringify({
-          ok: true,
-          instanceId: parsed.instanceId,
-          dashboardUrl: origin,
-          configPath: configPath(),
-          daemon: daemonStart,
-          ...parsed.runners ? { runners: parsed.runners } : {},
-          ...parsed.capabilityAck ? { capabilityAck: parsed.capabilityAck } : {},
-          ...parsed.requiredCliVersion ? { requiredCliVersion: parsed.requiredCliVersion } : {}
-        })
-      );
-    } else {
-      logOut(`dashboard: paired to ${origin} as ${parsed.instanceId}`);
-      if (parsed.runners && parsed.runners.length > 0) {
-        for (const runner of parsed.runners) {
-          logOut(
-            `dashboard: bound runner ${runner.name ?? runner.runnerId} (${runner.runnerId})`
-          );
-        }
-      } else {
-        logOut("dashboard: no runner bound to this pairing token.");
-        logOut(
-          "dashboard: bind a runner from runner settings, then this machine will receive its runs."
-        );
-      }
-      if (parsed.capabilityAck === void 0) {
-        logOut(
-          "dashboard: dashboard did not echo capabilityAck (older server). Continuing."
-        );
-      }
-      if (daemonStart.ok) {
-        const status = daemonStart.alreadyRunning ? "runtime daemon already running, restarted with new token" : daemonStart.connected ? "runtime daemon connected (verified socket open)" : "runtime daemon started but did not reach the socket within 10s";
-        logOut(`dashboard: ${status}`);
-        if (!daemonStart.connected && !daemonStart.alreadyRunning) {
-          logOut(
-            "dashboard pair: pairing succeeded; tail logs with `drisp dashboard logs --follow`."
-          );
-        }
-      } else {
-        logError(
-          `dashboard: runtime daemon did not start${daemonStart.message ? ` \u2014 ${daemonStart.message}` : ""}`
-        );
-        logOut(
-          "dashboard pair: pairing succeeded; start the daemon with `drisp dashboard daemon start`."
-        );
-      }
-      logOut("dashboard: ready. Click Run in the dashboard.");
-    }
-    return 0;
-  }
-  if (subcommand === "status") {
-    if (subcommandArgs.length > 0) {
-      logError(`dashboard status: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
+  if (subcommand === "status") {
+    if (subcommandArgs.length > 0) {
+      logError(`dashboard status: unexpected argument ${subcommandArgs[0]}`);
+      return 2;
     }
     const config = readConfig2();
     if (!config) {
@@ -16738,149 +16814,79 @@ async function runDashboardCommand(input, deps = {}) {
     return reportDoctor2(runnerOk);
   }
   if (subcommand === "console") {
-    const sub = subcommandArgs[0];
-    if (sub === "enable") {
-      const runnerId = subcommandArgs[1];
-      if (!runnerId) {
-        logError("dashboard console enable: missing <runnerId>");
-        return 2;
-      }
-      if (subcommandArgs.length > 2) {
-        logError(
-          `dashboard console enable: unexpected argument ${subcommandArgs[2]}`
-        );
-        return 2;
-      }
-      const config = readConfig2();
-      if (!config) {
-        logError(
-          'dashboard console enable: not paired. Run "drisp dashboard pair" first.'
-        );
-        return 1;
-      }
-      const refreshResult = await tryRefresh("refresh");
-      if (!refreshResult.ok) return refreshResult.code;
-      const health = await fetchRunnerHealth(
-        fetchImpl,
-        config.dashboardUrl,
-        runnerId,
-        refreshResult.token
-      );
-      if (!health.matches) {
-        logError(
-          `dashboard console enable: runner ${runnerId} is not bound to this instance${health.error ? ` (${health.error})` : ""}`
-        );
-        return 1;
-      }
-      return await runDashboardCommand(
-        {
-          subcommand: "console",
-          subcommandArgs: ["link", runnerId],
-          flags: input.flags
-        },
-        deps
-      );
+    const message = "dashboard console is deprecated; paired dashboard feed sync now routes dashboard UI and channel decisions.";
+    if (flags.json) {
+      logOut(JSON.stringify({ ok: false, deprecated: true, message }));
+    } else {
+      logError(message);
     }
-    if (sub === "link") {
-      const runnerId = subcommandArgs[1];
-      if (!runnerId) {
-        logError("dashboard console link: missing <runnerId>");
-        return 2;
-      }
-      if (subcommandArgs.length > 2) {
-        logError(
-          `dashboard console link: unexpected argument ${subcommandArgs[2]}`
-        );
-        return 2;
-      }
-      const config = readConfig2();
-      if (!config) {
-        logError(
-          'dashboard console link: not paired. Run "drisp dashboard pair" first.'
-        );
-        return 1;
-      }
-      let brokerUrl;
-      try {
-        brokerUrl = consoleBrokerUrl(config.dashboardUrl, runnerId);
-      } catch (err) {
-        logError(
-          `dashboard console link: ${err instanceof Error ? err.message : String(err)}`
-        );
-        return 1;
-      }
-      const dir = (deps.channelDir ?? channelSidecarDir)();
-      let previousBroker;
-      const target = path7.join(dir, "console.json");
-      try {
-        const existing = JSON.parse(fs7.readFileSync(target, "utf-8"));
-        if (typeof existing.broker_url === "string") {
-          previousBroker = existing.broker_url;
-        }
-      } catch {
-      }
-      try {
-        fs7.mkdirSync(dir, { recursive: true, mode: 448 });
-      } catch (err) {
-        logError(
-          `dashboard console link: failed to create ${dir}: ${err instanceof Error ? err.message : String(err)}`
-        );
-        return 1;
-      }
-      const payload = {
-        broker_url: brokerUrl,
-        runner_id: runnerId,
-        dashboard_config: true
-      };
-      const tmp = `${target}.tmp`;
-      try {
-        fs7.writeFileSync(tmp, JSON.stringify(payload, null, 2) + "\n", {
-          mode: 384
-        });
-        fs7.renameSync(tmp, target);
-      } catch (err) {
-        try {
-          fs7.unlinkSync(tmp);
-        } catch {
-        }
+    return 1;
+  }
+  if (subcommand === "list") {
+    if (subcommandArgs.length > 0) {
+      logError(`dashboard list: unexpected argument ${subcommandArgs[0]}`);
+      return 2;
+    }
+    const config = readConfig2();
+    if (!config) {
+      if (flags.json) {
+        logOut(JSON.stringify({ ok: false, paired: false }));
+      } else {
         logError(
-          `dashboard console link: failed to write ${target}: ${err instanceof Error ? err.message : String(err)}`
+          'dashboard list: not paired. Run "drisp dashboard pair" first.'
         );
-        return 1;
       }
-      const reload = await (deps.reloadGatewayChannels ?? defaultReloadGatewayChannels)();
+      return 1;
+    }
+    const mirror = readMirror();
+    if (!mirror) {
       if (flags.json) {
         logOut(
           JSON.stringify({
             ok: true,
-            runnerId,
-            brokerUrl,
-            path: target,
-            ...previousBroker ? { previousBrokerUrl: previousBroker } : {},
-            gatewayReload: reload
+            paired: true,
+            instanceId: config.instanceId,
+            attachments: [],
+            mirror: null
           })
         );
       } else {
-        if (previousBroker && previousBroker !== brokerUrl) {
-          logOut(`console: replaced existing config (was: ${previousBroker})`);
-        }
-        logOut(`console: linked runner ${runnerId} at ${brokerUrl}`);
-        logOut(`console: wrote ${target}`);
-        if (reload.ok) {
-          logOut(`console: gateway channels reloaded (${reload.message})`);
-        } else {
-          logError(`console: gateway reload skipped: ${reload.message}`);
-          logOut(
-            "console: start or reload the gateway before using the Console tab."
-          );
-        }
+        logOut(
+          `dashboard list: paired as ${config.instanceId}, no attachment mirror on disk.`
+        );
+        logOut(
+          "dashboard list: re-run `drisp dashboard pair` to refresh the mirror."
+        );
       }
       return 0;
     }
-    logError(
-      `dashboard console: unknown subcommand ${sub ? sub : "(missing)"}. Expected "enable <runnerId>" or "link <runnerId>".`
-    );
-    return 2;
+    if (flags.json) {
+      logOut(
+        JSON.stringify({
+          ok: true,
+          paired: true,
+          instanceId: mirror.instanceId,
+          fetchedAt: mirror.fetchedAt,
+          attachments: mirror.attachments
+        })
+      );
+    } else {
+      logOut(`dashboard: instance ${mirror.instanceId}`);
+      logOut(
+        `dashboard: mirror fetched ${new Date(mirror.fetchedAt).toISOString()}`
+      );
+      if (mirror.attachments.length === 0) {
+        logOut("dashboard: no runners attached.");
+      } else {
+        logOut(`dashboard: ${mirror.attachments.length} runner(s) attached:`);
+        for (const a of mirror.attachments) {
+          const label = a.name ? `${a.name} (${a.runnerId})` : a.runnerId;
+          const target = a.executionTarget ? ` [${a.executionTarget}]` : "";
+          logOut(`  - ${label}${target}`);
+        }
+      }
+    }
+    return 0;
   }
   if (subcommand === "unpair") {
     if (subcommandArgs.length > 0) {
@@ -16953,6 +16959,7 @@ async function runDashboardCommand(input, deps = {}) {
       }
     }
     removeConfig();
+    removeMirror();
     if (flags.json) {
       logOut(
         JSON.stringify({
@@ -16972,7 +16979,7 @@ async function runDashboardCommand(input, deps = {}) {
     return 0;
   }
   logError(`Unknown dashboard subcommand: ${subcommand}`);
-  logError(USAGE5);
+  logError(USAGE4);
   return 2;
 }
 function defaultWaitForShutdown() {
@@ -16984,36 +16991,21 @@ function defaultWaitForShutdown() {
     };
     process.once("SIGINT", onSignal);
     process.once("SIGTERM", onSignal);
-  });
-}
-async function defaultReloadGatewayChannels() {
-  const out = [];
-  const err = [];
-  const code = await runGatewayCommand(
-    { subcommand: "reload-channels", subcommandArgs: [] },
-    {
-      logOut: (m) => out.push(m),
-      logError: (m) => err.push(m)
-    }
-  );
-  return {
-    ok: code === 0,
-    message: (code === 0 ? out.join("\n") : err.join("\n")) || (code === 0 ? "gateway channels reloaded" : "gateway not reachable")
-  };
+  });
 }
 function resolveDaemonEntry() {
   let here;
   try {
-    here = fileURLToPath2(import.meta.url);
+    here = fileURLToPath(import.meta.url);
   } catch {
     return null;
   }
   const candidates = [
-    path7.join(path7.dirname(here), "dashboard-daemon.js"),
+    path6.join(path6.dirname(here), "dashboard-daemon.js"),
     // When invoked via `npm run start`, `here` may be the unbundled source
     // path. Walk up until we hit a `dist/` sibling.
-    path7.join(
-      path7.dirname(here),
+    path6.join(
+      path6.dirname(here),
       "..",
       "..",
       "..",
@@ -17023,7 +17015,7 @@ function resolveDaemonEntry() {
   ];
   for (const candidate of candidates) {
     try {
-      fs7.accessSync(candidate, fs7.constants.R_OK);
+      fs6.accessSync(candidate, fs6.constants.R_OK);
       return candidate;
     } catch {
     }
@@ -17081,7 +17073,7 @@ async function defaultStartRuntimeDaemon(opts) {
   }
   let child;
   try {
-    child = spawn2(process.execPath, [entry], {
+    child = spawn(process.execPath, [entry], {
       detached: true,
       stdio: "ignore",
       env: buildDaemonEnv(process.env)
@@ -17208,14 +17200,14 @@ async function defaultTailDaemonLog(opts) {
   let stream2 = null;
   let watcher = null;
   try {
-    const stat = fs7.statSync(paths.logPath);
+    const stat = fs6.statSync(paths.logPath);
     const size = stat.size;
     const buf = Buffer.alloc(Math.min(size, opts.tail * 1024));
-    const fd = fs7.openSync(paths.logPath, "r");
+    const fd = fs6.openSync(paths.logPath, "r");
     try {
-      fs7.readSync(fd, buf, 0, buf.length, Math.max(0, size - buf.length));
+      fs6.readSync(fd, buf, 0, buf.length, Math.max(0, size - buf.length));
     } finally {
-      fs7.closeSync(fd);
+      fs6.closeSync(fd);
     }
     const lines = buf.toString("utf-8").split("\n").filter((l) => l.length > 0);
     const tail = lines.slice(-opts.tail);
@@ -17229,253 +17221,612 @@ async function defaultTailDaemonLog(opts) {
         `dashboard logs: log file ${paths.logPath} does not exist yet
 `
       );
-      return opts.follow ? 0 : 1;
+      return opts.follow ? 0 : 1;
+    }
+    throw err;
+  }
+  let position = fs6.statSync(paths.logPath).size;
+  return await new Promise((resolve) => {
+    let pollTimer = null;
+    const drain = () => {
+      try {
+        const stat = fs6.statSync(paths.logPath);
+        if (stat.size < position) {
+          position = 0;
+        }
+        if (stat.size > position) {
+          const fd = fs6.openSync(paths.logPath, "r");
+          const buf = Buffer.alloc(stat.size - position);
+          try {
+            fs6.readSync(fd, buf, 0, buf.length, position);
+          } finally {
+            fs6.closeSync(fd);
+          }
+          position = stat.size;
+          process.stdout.write(buf);
+        }
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          process.stderr.write(
+            `dashboard logs: tail error: ${err instanceof Error ? err.message : String(err)}
+`
+          );
+        }
+      }
+    };
+    try {
+      watcher = fs6.watch(paths.logPath, { persistent: true }, () => {
+        drain();
+      });
+    } catch {
+      pollTimer = setInterval(drain, 500);
+      pollTimer.unref();
+    }
+    const onSignal = () => {
+      if (watcher) {
+        watcher.close();
+        watcher = null;
+      }
+      if (pollTimer) {
+        clearInterval(pollTimer);
+        pollTimer = null;
+      }
+      if (stream2) {
+        stream2.close();
+        stream2 = null;
+      }
+      resolve(0);
+    };
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+  });
+}
+function formatDuration2(seconds) {
+  if (!Number.isFinite(seconds) || seconds < 0) return "?";
+  if (seconds < 60) return `${seconds}s`;
+  if (seconds < 3600) {
+    const m = Math.floor(seconds / 60);
+    const s = seconds % 60;
+    return s > 0 ? `${m}m${s}s` : `${m}m`;
+  }
+  if (seconds < 86400) {
+    const h2 = Math.floor(seconds / 3600);
+    const m = Math.floor(seconds % 3600 / 60);
+    return m > 0 ? `${h2}h${m}m` : `${h2}h`;
+  }
+  const d = Math.floor(seconds / 86400);
+  const h = Math.floor(seconds % 86400 / 3600);
+  return h > 0 ? `${d}d${h}h` : `${d}d`;
+}
+async function fetchRunnerHealth(fetchImpl, dashboardUrl, runnerId, token) {
+  const url = new URL(
+    `/api/runners/${encodeURIComponent(runnerId)}`,
+    dashboardUrl
+  ).toString();
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        authorization: `Bearer ${token.accessToken}`,
+        accept: "application/json"
+      }
+    });
+  } catch (err) {
+    return {
+      id: runnerId,
+      matches: false,
+      error: `request failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!response.ok) {
+    return {
+      id: runnerId,
+      matches: false,
+      error: `dashboard returned ${response.status}`
+    };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    return {
+      id: runnerId,
+      matches: false,
+      error: `invalid response body: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const obj = typeof body === "object" && body !== null ? body : {};
+  const executionTarget = typeof obj["executionTarget"] === "string" ? obj["executionTarget"] : void 0;
+  const remoteInstanceId = typeof obj["remoteInstanceId"] === "string" ? obj["remoteInstanceId"] : void 0;
+  const matches = executionTarget === "remote" && remoteInstanceId === token.instanceId;
+  const reasons = [];
+  if (executionTarget !== "remote") {
+    reasons.push(
+      `executionTarget=${executionTarget ?? "unset"} (expected "remote")`
+    );
+  }
+  if (remoteInstanceId !== token.instanceId) {
+    reasons.push(
+      `remoteInstanceId=${remoteInstanceId ?? "unset"} (expected "${token.instanceId}")`
+    );
+  }
+  return {
+    id: runnerId,
+    matches,
+    ...executionTarget !== void 0 ? { executionTarget } : {},
+    ...remoteInstanceId !== void 0 ? { remoteInstanceId } : {},
+    ...reasons.length > 0 ? { error: reasons.join("; ") } : {}
+  };
+}
+function defaultInstallServiceUnit() {
+  const entry = resolveDaemonEntry();
+  if (!entry) {
+    return {
+      ok: false,
+      platform: "unsupported",
+      message: "cannot resolve dashboard-daemon.js entry path"
+    };
+  }
+  return installServiceUnit({
+    daemonEntry: entry,
+    nodeBinary: process.execPath
+  });
+}
+function compareSemver(a, b) {
+  const parseN = (s) => {
+    const parts = s.replace(/^v/, "").split("-")[0].split(".");
+    return [
+      Number.parseInt(parts[0] ?? "0", 10) || 0,
+      Number.parseInt(parts[1] ?? "0", 10) || 0,
+      Number.parseInt(parts[2] ?? "0", 10) || 0
+    ];
+  };
+  const av = parseN(a);
+  const bv = parseN(b);
+  for (let i = 0; i < 3; i += 1) {
+    if (av[i] < bv[i]) return -1;
+    if (av[i] > bv[i]) return 1;
+  }
+  return 0;
+}
+async function safeReadError(response) {
+  try {
+    const text = await response.text();
+    if (text.length === 0) return "";
+    try {
+      const parsed = JSON.parse(text);
+      if (typeof parsed === "object" && parsed !== null && typeof parsed["error"] === "string") {
+        return parsed["error"];
+      }
+    } catch {
+    }
+    return text.length > 200 ? text.slice(0, 200) + "\u2026" : text;
+  } catch {
+    return "";
+  }
+}
+function parsePairResponse(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error("expected object");
+  }
+  const obj = raw;
+  const instanceId = obj["instanceId"];
+  const refreshToken = obj["refreshToken"];
+  if (typeof instanceId !== "string" || instanceId.length === 0) {
+    throw new Error("missing instanceId");
+  }
+  if (typeof refreshToken !== "string" || refreshToken.length === 0) {
+    throw new Error("missing refreshToken");
+  }
+  return {
+    instanceId,
+    refreshToken,
+    ...typeof obj["jti"] === "string" ? { jti: obj["jti"] } : {},
+    ...typeof obj["accessToken"] === "string" ? { accessToken: obj["accessToken"] } : {},
+    ...typeof obj["expiresInSec"] === "number" ? { expiresInSec: obj["expiresInSec"] } : {},
+    ...Array.isArray(obj["runners"]) ? {
+      runners: obj["runners"].map(parsePairedRunner).filter((runner) => runner !== null)
+    } : {},
+    ...typeof obj["requiredCliVersion"] === "string" ? { requiredCliVersion: obj["requiredCliVersion"] } : {},
+    ...typeof obj["capabilityAck"] === "object" && obj["capabilityAck"] !== null ? { capabilityAck: parseCapabilityAck(obj["capabilityAck"]) } : {}
+  };
+}
+function parseCapabilityAck(raw) {
+  if (typeof raw !== "object" || raw === null) return {};
+  const obj = raw;
+  const ack = {};
+  if (typeof obj["runtimeDaemon"] === "boolean") {
+    ack.runtimeDaemon = obj["runtimeDaemon"];
+  }
+  if (typeof obj["instanceSocket"] === "boolean") {
+    ack.instanceSocket = obj["instanceSocket"];
+  }
+  return ack;
+}
+function parsePairedRunner(raw) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const obj = raw;
+  const runnerId = obj["runnerId"];
+  if (typeof runnerId !== "string" || runnerId.length === 0) return null;
+  return {
+    runnerId,
+    ...typeof obj["name"] === "string" ? { name: obj["name"] } : {},
+    ...typeof obj["executionTarget"] === "string" ? { executionTarget: obj["executionTarget"] } : {},
+    ...typeof obj["remoteInstanceId"] === "string" ? { remoteInstanceId: obj["remoteInstanceId"] } : {}
+  };
+}
+
+// src/app/entry/gatewayCommand.ts
+import { spawn as spawn2 } from "child_process";
+import fs7 from "fs";
+import path7 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var USAGE5 = `Usage: athena-flow gateway <subcommand> [--json]
+
+Subcommands:
+  start     Run the gateway daemon in foreground (only mode in this build).
+            Options: [--bind <host:port>] [--insecure]
+                     [--tls-cert <path>] [--tls-key <path>]
+                     [--grace-period-ms <n>]
+  status    Print daemon pid, uptime, and version.
+  probe     Send a ping RPC and report reachability + latency.
+  link      Store a remote WS/WSS gateway endpoint for this user.
+  unlink    Restore local UDS gateway mode for this user.
+  rotate-token  Regenerate the gateway token file (server-side).
+                Restart the daemon to drop existing connections; clients
+                must re-run "athena gateway link --token <new>".
+  reload-channels  Reload channel sidecars without restarting the daemon.
+`;
+function defaultResolveDaemonEntry() {
+  const here = path7.dirname(fileURLToPath2(import.meta.url));
+  return path7.resolve(here, "athena-gateway.js");
+}
+function readToken(tokenPath) {
+  try {
+    return fs7.readFileSync(tokenPath, "utf-8").trim();
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      throw new Error(
+        `gateway token missing at ${tokenPath}. Start the daemon with "athena gateway start" first.`
+      );
     }
     throw err;
   }
-  let position = fs7.statSync(paths.logPath).size;
-  return await new Promise((resolve) => {
-    let pollTimer = null;
-    const drain = () => {
-      try {
-        const stat = fs7.statSync(paths.logPath);
-        if (stat.size < position) {
-          position = 0;
-        }
-        if (stat.size > position) {
-          const fd = fs7.openSync(paths.logPath, "r");
-          const buf = Buffer.alloc(stat.size - position);
-          try {
-            fs7.readSync(fd, buf, 0, buf.length, position);
-          } finally {
-            fs7.closeSync(fd);
-          }
-          position = stat.size;
-          process.stdout.write(buf);
-        }
-      } catch (err) {
-        if (err.code !== "ENOENT") {
-          process.stderr.write(
-            `dashboard logs: tail error: ${err instanceof Error ? err.message : String(err)}
-`
-          );
-        }
-      }
-    };
-    try {
-      watcher = fs7.watch(paths.logPath, { persistent: true }, () => {
-        drain();
-      });
-    } catch {
-      pollTimer = setInterval(drain, 500);
-      pollTimer.unref?.();
-    }
-    const onSignal = () => {
-      if (watcher) {
-        watcher.close();
-        watcher = null;
-      }
-      if (pollTimer) {
-        clearInterval(pollTimer);
-        pollTimer = null;
-      }
-      if (stream2) {
-        stream2.close();
-        stream2 = null;
-      }
-      resolve(0);
-    };
-    process.once("SIGINT", onSignal);
-    process.once("SIGTERM", onSignal);
-  });
 }
-function formatDuration2(seconds) {
-  if (!Number.isFinite(seconds) || seconds < 0) return "?";
-  if (seconds < 60) return `${seconds}s`;
-  if (seconds < 3600) {
-    const m = Math.floor(seconds / 60);
-    const s = seconds % 60;
-    return s > 0 ? `${m}m${s}s` : `${m}m`;
+function flagJson(args) {
+  return args.includes("--json");
+}
+async function runGatewayCommand(input, deps = {}) {
+  const logOut = deps.logOut ?? ((m) => process.stdout.write(m + "\n"));
+  const logError = deps.logError ?? ((m) => process.stderr.write(m + "\n"));
+  const resolveDaemonEntry2 = deps.resolveDaemonEntry ?? defaultResolveDaemonEntry;
+  const resolveSocketPath = deps.resolveSocketPath ?? (() => resolveGatewayPaths().socketPath);
+  const resolveTokenPath = deps.resolveTokenPath ?? (() => resolveGatewayPaths().tokenPath);
+  const readClientConfig = deps.readClientConfig ?? readGatewayClientConfig;
+  const writeClientConfig = deps.writeClientConfig ?? ((config) => writeGatewayClientConfig(config));
+  const connectGateway = deps.connectGateway ?? defaultConnectGateway;
+  const spawnDaemon = deps.spawnDaemon ?? ((entry, args) => spawn2(process.execPath, [entry, ...args], { stdio: "inherit" }));
+  const { subcommand, subcommandArgs } = input;
+  if (!subcommand || subcommand === "help" || subcommand === "--help") {
+    logOut(USAGE5);
+    return 0;
   }
-  if (seconds < 86400) {
-    const h2 = Math.floor(seconds / 3600);
-    const m = Math.floor(seconds % 3600 / 60);
-    return m > 0 ? `${h2}h${m}m` : `${h2}h`;
+  if (subcommand === "start") {
+    const entry = resolveDaemonEntry2();
+    const child = spawnDaemon(entry, subcommandArgs);
+    return await new Promise((resolve) => {
+      child.once("exit", (code) => resolve(code ?? 0));
+      child.once("error", (err) => {
+        logError(`gateway start: failed to spawn daemon: ${err.message}`);
+        resolve(1);
+      });
+    });
   }
-  const d = Math.floor(seconds / 86400);
-  const h = Math.floor(seconds % 86400 / 3600);
-  return h > 0 ? `${d}d${h}h` : `${d}d`;
-}
-async function fetchRunnerHealth(fetchImpl, dashboardUrl, runnerId, token) {
-  const url = new URL(
-    `/api/runners/${encodeURIComponent(runnerId)}`,
-    dashboardUrl
-  ).toString();
-  let response;
-  try {
-    response = await fetchImpl(url, {
-      method: "GET",
-      headers: {
-        authorization: `Bearer ${token.accessToken}`,
-        accept: "application/json"
-      }
+  if (subcommand === "link") {
+    const parsed = parseLinkArgs(subcommandArgs);
+    if (!parsed.ok) {
+      logError(parsed.message);
+      return 2;
+    }
+    writeClientConfig({
+      mode: "remote",
+      url: parsed.url,
+      token: parsed.token,
+      ...parsed.tlsCaPath !== void 0 ? { tlsCaPath: parsed.tlsCaPath } : {}
     });
-  } catch (err) {
-    return {
-      id: runnerId,
-      matches: false,
-      error: `request failed: ${err instanceof Error ? err.message : String(err)}`
-    };
+    logOut(`gateway: linked remote endpoint ${parsed.url}`);
+    return 0;
   }
-  if (!response.ok) {
-    return {
-      id: runnerId,
-      matches: false,
-      error: `dashboard returned ${response.status}`
-    };
+  if (subcommand === "rotate-token") {
+    const json = flagJson(subcommandArgs);
+    const extras = subcommandArgs.filter((a) => a !== "--json");
+    if (extras.length > 0) {
+      logError(`gateway rotate-token: unexpected argument ${extras[0]}`);
+      return 2;
+    }
+    const tokenPath = resolveTokenPath();
+    try {
+      const newToken = rotateGatewayToken(tokenPath);
+      if (json) {
+        logOut(JSON.stringify({ ok: true, token: newToken, tokenPath }));
+      } else {
+        logOut(newToken);
+        logOut(
+          `gateway: rotated token at ${tokenPath}. Restart the daemon to drop existing connections, then re-run "athena gateway link --token <new>" on each client.`
+        );
+      }
+      return 0;
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (json) {
+        logOut(JSON.stringify({ ok: false, message }));
+      } else {
+        logError(`gateway rotate-token: ${message}`);
+      }
+      return 1;
+    }
   }
-  let body;
-  try {
-    body = await response.json();
-  } catch (err) {
-    return {
-      id: runnerId,
-      matches: false,
-      error: `invalid response body: ${err instanceof Error ? err.message : String(err)}`
-    };
+  if (subcommand === "unlink") {
+    if (subcommandArgs.length > 0) {
+      logError("gateway unlink does not accept arguments");
+      return 2;
+    }
+    writeClientConfig({ mode: "local" });
+    logOut("gateway: using local gateway endpoint");
+    return 0;
   }
-  const obj = typeof body === "object" && body !== null ? body : {};
-  const executionTarget = typeof obj["executionTarget"] === "string" ? obj["executionTarget"] : void 0;
-  const remoteInstanceId = typeof obj["remoteInstanceId"] === "string" ? obj["remoteInstanceId"] : void 0;
-  const matches = executionTarget === "remote" && remoteInstanceId === token.instanceId;
-  const reasons = [];
-  if (executionTarget !== "remote") {
-    reasons.push(
-      `executionTarget=${executionTarget ?? "unset"} (expected "remote")`
-    );
+  if (subcommand === "probe") {
+    const json = flagJson(subcommandArgs);
+    const socketPath = resolveSocketPath();
+    const tokenPath = resolveTokenPath();
+    const endpoint = readClientConfig();
+    const startedAt = Date.now();
+    try {
+      const client = await connectGateway({
+        endpoint,
+        socketPath,
+        tokenPath,
+        timeoutMs: 3e3
+      });
+      const res = await client.request("ping", {});
+      client.close();
+      const latencyMs = Date.now() - startedAt;
+      if (json) {
+        logOut(
+          JSON.stringify({
+            ok: true,
+            reachable: true,
+            latency_ms: latencyMs,
+            daemon_pid: res.daemonPid,
+            daemon_uptime_ms: res.uptimeMs
+          })
+        );
+      } else {
+        logOut(
+          `gateway: reachable pid=${res.daemonPid} uptime=${res.uptimeMs}ms latency=${latencyMs}ms`
+        );
+      }
+      return 0;
+    } catch (err) {
+      return reportProbeFailure(err, json, logOut, logError);
+    }
   }
-  if (remoteInstanceId !== token.instanceId) {
-    reasons.push(
-      `remoteInstanceId=${remoteInstanceId ?? "unset"} (expected "${token.instanceId}")`
-    );
+  if (subcommand === "reload-channels") {
+    const json = flagJson(subcommandArgs);
+    const extras = subcommandArgs.filter((a) => a !== "--json");
+    if (extras.length > 0) {
+      logError(`gateway reload-channels: unexpected argument ${extras[0]}`);
+      return 2;
+    }
+    const socketPath = resolveSocketPath();
+    const tokenPath = resolveTokenPath();
+    const endpoint = readClientConfig();
+    try {
+      const client = await connectGateway({
+        endpoint,
+        socketPath,
+        tokenPath,
+        timeoutMs: 3e3
+      });
+      const res = await client.request("channels.reload", {});
+      client.close();
+      if (json) {
+        logOut(JSON.stringify({ ok: true, ...res }));
+      } else if (res.results.length === 0) {
+        logOut("gateway: channels reloaded (no channel sidecars found)");
+      } else {
+        logOut("gateway: channels reloaded");
+        for (const result of res.results) {
+          logOut(formatChannelReloadResult(result));
+        }
+      }
+      return 0;
+    } catch (err) {
+      return reportProbeFailure(err, json, logOut, logError);
+    }
   }
-  return {
-    id: runnerId,
-    matches,
-    ...executionTarget !== void 0 ? { executionTarget } : {},
-    ...remoteInstanceId !== void 0 ? { remoteInstanceId } : {},
-    ...reasons.length > 0 ? { error: reasons.join("; ") } : {}
-  };
-}
-function defaultInstallServiceUnit() {
-  const entry = resolveDaemonEntry();
-  if (!entry) {
-    return {
-      ok: false,
-      platform: "unsupported",
-      message: "cannot resolve dashboard-daemon.js entry path"
-    };
+  if (subcommand === "status") {
+    const json = flagJson(subcommandArgs);
+    const socketPath = resolveSocketPath();
+    const tokenPath = resolveTokenPath();
+    const endpoint = readClientConfig();
+    try {
+      const client = await connectGateway({
+        endpoint,
+        socketPath,
+        tokenPath,
+        timeoutMs: 3e3
+      });
+      const res = await client.request("status", {});
+      client.close();
+      if (json) {
+        logOut(JSON.stringify(res));
+      } else {
+        const listenerSummary = formatListenerSummary(res.listener);
+        const channelSummary = formatChannelSummary(res.channels);
+        const runtimeSummary = formatRuntimeSummary(res.runtimes[0]);
+        logOut(
+          `gateway: running pid=${res.daemonPid} uptime=${res.uptimeMs}ms version=${res.version} ${listenerSummary}${channelSummary}${runtimeSummary}`
+        );
+      }
+      return 0;
+    } catch (err) {
+      return reportProbeFailure(err, json, logOut, logError);
+    }
   }
-  return installServiceUnit({
-    daemonEntry: entry,
-    nodeBinary: process.execPath
-  });
+  logError(`Unknown gateway subcommand: ${subcommand}`);
+  logError(USAGE5);
+  return 2;
 }
-function compareSemver(a, b) {
-  const parseN = (s) => {
-    const parts = s.replace(/^v/, "").split("-")[0].split(".");
-    return [
-      Number.parseInt(parts[0] ?? "0", 10) || 0,
-      Number.parseInt(parts[1] ?? "0", 10) || 0,
-      Number.parseInt(parts[2] ?? "0", 10) || 0
-    ];
-  };
-  const av = parseN(a);
-  const bv = parseN(b);
-  for (let i = 0; i < 3; i += 1) {
-    if (av[i] < bv[i]) return -1;
-    if (av[i] > bv[i]) return 1;
+async function defaultConnectGateway(opts) {
+  if (opts.endpoint.mode === "remote") {
+    return connect({
+      socketPath: opts.socketPath,
+      token: opts.endpoint.token,
+      timeoutMs: opts.timeoutMs,
+      transport: createWsClientTransport(
+        wsClientOptionsForEndpoint({
+          url: opts.endpoint.url,
+          timeoutMs: opts.timeoutMs,
+          tlsCaPath: opts.endpoint.tlsCaPath
+        })
+      )
+    });
   }
-  return 0;
-}
-function consoleBrokerUrl(dashboardUrl, runnerId) {
-  const url = new URL(dashboardUrl);
-  if (url.protocol === "https:") url.protocol = "wss:";
-  else if (url.protocol === "http:") url.protocol = "ws:";
-  else throw new Error(`unsupported dashboard protocol: ${url.protocol}`);
-  url.pathname = `/api/runners/${encodeURIComponent(runnerId)}/console/adapter`;
-  url.search = "";
-  url.hash = "";
-  return url.toString();
+  return connect({
+    socketPath: opts.socketPath,
+    token: readToken(opts.tokenPath),
+    timeoutMs: opts.timeoutMs
+  });
 }
-async function safeReadError(response) {
-  try {
-    const text = await response.text();
-    if (text.length === 0) return "";
-    try {
-      const parsed = JSON.parse(text);
-      if (typeof parsed === "object" && parsed !== null && typeof parsed["error"] === "string") {
-        return parsed["error"];
+function parseLinkArgs(args) {
+  const positional = [];
+  let token;
+  let tlsCaPath;
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--token") {
+      const v = args[i + 1];
+      if (!v || v.startsWith("--")) {
+        return { ok: false, message: "gateway link --token requires a value" };
       }
-    } catch {
+      token = v;
+      i += 1;
+      continue;
     }
-    return text.length > 200 ? text.slice(0, 200) + "\u2026" : text;
-  } catch {
-    return "";
+    if (arg === "--tls-ca") {
+      const v = args[i + 1];
+      if (!v || v.startsWith("--")) {
+        return { ok: false, message: "gateway link --tls-ca requires a path" };
+      }
+      tlsCaPath = v;
+      i += 1;
+      continue;
+    }
+    if (arg.startsWith("--token=")) {
+      token = arg.slice("--token=".length);
+      continue;
+    }
+    if (arg.startsWith("--tls-ca=")) {
+      tlsCaPath = arg.slice("--tls-ca=".length);
+      continue;
+    }
+    if (arg.startsWith("--")) {
+      return { ok: false, message: `gateway link: unknown option ${arg}` };
+    }
+    positional.push(arg);
   }
-}
-function parsePairResponse(raw) {
-  if (typeof raw !== "object" || raw === null) {
-    throw new Error("expected object");
+  const url = positional[0];
+  if (!url) {
+    return { ok: false, message: "gateway link requires a ws:// or wss:// URL" };
   }
-  const obj = raw;
-  const instanceId = obj["instanceId"];
-  const refreshToken = obj["refreshToken"];
-  if (typeof instanceId !== "string" || instanceId.length === 0) {
-    throw new Error("missing instanceId");
+  if (positional.length > 1) {
+    return { ok: false, message: "gateway link accepts exactly one URL" };
   }
-  if (typeof refreshToken !== "string" || refreshToken.length === 0) {
-    throw new Error("missing refreshToken");
+  if (!isSupportedGatewayUrl(url)) {
+    return { ok: false, message: "gateway link URL must use ws:// or wss://" };
+  }
+  if (!token) {
+    return { ok: false, message: "gateway link requires --token <token>" };
+  }
+  if (tlsCaPath !== void 0 && tlsCaPath.length === 0) {
+    return { ok: false, message: "gateway link --tls-ca requires a path" };
   }
   return {
-    instanceId,
-    refreshToken,
-    ...typeof obj["jti"] === "string" ? { jti: obj["jti"] } : {},
-    ...typeof obj["accessToken"] === "string" ? { accessToken: obj["accessToken"] } : {},
-    ...typeof obj["expiresInSec"] === "number" ? { expiresInSec: obj["expiresInSec"] } : {},
-    ...Array.isArray(obj["runners"]) ? {
-      runners: obj["runners"].map(parsePairedRunner).filter((runner) => runner !== null)
-    } : {},
-    ...typeof obj["requiredCliVersion"] === "string" ? { requiredCliVersion: obj["requiredCliVersion"] } : {},
-    ...typeof obj["capabilityAck"] === "object" && obj["capabilityAck"] !== null ? { capabilityAck: parseCapabilityAck(obj["capabilityAck"]) } : {}
+    ok: true,
+    url,
+    token,
+    ...tlsCaPath !== void 0 ? { tlsCaPath } : {}
   };
 }
-function parseCapabilityAck(raw) {
-  if (typeof raw !== "object" || raw === null) return {};
-  const obj = raw;
-  const ack = {};
-  if (typeof obj["runtimeDaemon"] === "boolean") {
-    ack.runtimeDaemon = obj["runtimeDaemon"];
+function reportProbeFailure(err, json, logOut, logError) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (err instanceof GatewayUnreachableError) {
+    if (json) {
+      logOut(
+        JSON.stringify({
+          ok: false,
+          reachable: false,
+          reason: "unreachable",
+          message
+        })
+      );
+    } else {
+      logError(`gateway: not reachable \u2014 ${message}`);
+    }
+    return 1;
   }
-  if (typeof obj["consoleAdapter"] === "boolean") {
-    ack.consoleAdapter = obj["consoleAdapter"];
+  if (err instanceof GatewayUnauthorizedError) {
+    if (json) {
+      logOut(
+        JSON.stringify({
+          ok: false,
+          reachable: true,
+          reason: "unauthorized",
+          message
+        })
+      );
+    } else {
+      logError(`gateway: unauthorized \u2014 ${message}`);
+    }
+    return 1;
   }
-  if (typeof obj["instanceSocket"] === "boolean") {
-    ack.instanceSocket = obj["instanceSocket"];
+  if (json) {
+    logOut(JSON.stringify({ ok: false, reason: "error", message }));
+  } else {
+    logError(`gateway: ${message}`);
   }
-  return ack;
+  return 1;
 }
-function parsePairedRunner(raw) {
-  if (typeof raw !== "object" || raw === null) return null;
-  const obj = raw;
-  const runnerId = obj["runnerId"];
-  if (typeof runnerId !== "string" || runnerId.length === 0) return null;
-  return {
-    runnerId,
-    ...typeof obj["name"] === "string" ? { name: obj["name"] } : {},
-    ...typeof obj["executionTarget"] === "string" ? { executionTarget: obj["executionTarget"] } : {},
-    ...typeof obj["remoteInstanceId"] === "string" ? { remoteInstanceId: obj["remoteInstanceId"] } : {}
-  };
+function formatRuntimeSummary(r) {
+  if (!r) return " runtime=<none>";
+  const lastRebindAt = r.binding.state !== "none" ? r.binding.lastRebindAt : void 0;
+  const rebind = lastRebindAt !== void 0 ? ` rebound=${formatElapsed(Date.now() - lastRebindAt)}` : "";
+  return ` runtime=${r.runtimeId} binding=${r.binding.state} pid=${r.pid}${rebind}`;
+}
+function formatChannelReloadResult(result) {
+  const suffix = result.reason ? `: ${result.reason}` : "";
+  return `  ${result.id} ${result.action}${suffix}`;
+}
+function formatChannelSummary(channels) {
+  if (channels.length === 0) return " channels=<none>";
+  const parts = channels.map((channel) => {
+    const note = channel.note ? `(${channel.note})` : "";
+    return `${channel.id}:${channel.state}${note}`;
+  });
+  return ` channels=${parts.join(",")}`;
+}
+function formatListenerSummary(listener) {
+  if (listener.kind === "uds") {
+    return `listener=uds:${listener.socketPath}`;
+  }
+  const flags = [];
+  if (listener.tls) flags.push("tls");
+  if (listener.insecure) flags.push("insecure");
+  const suffix = flags.length > 0 ? ` (${flags.join(",")})` : "";
+  return `listener=${listener.url}${suffix}`;
 }
 
 // src/app/entry/doctorCommand.ts
@@ -18175,7 +18526,7 @@ var cli = meow(
 			workflow <sub>        Manage workflows (install, list, search, remove, upgrade, use)
 			marketplace <sub>     Manage marketplace sources (add, remove, list)
 			channel <sub>         Manage external channels
-			dashboard <sub>       Manage dashboard remote-instance pairing (pair, status, refresh, connect, unpair)
+			dashboard <sub>       Manage dashboard pairing and runtime daemon (pair, status, daemon, unpair)
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
 
@@ -18200,15 +18551,8 @@ var cli = meow(
 			--bot-token     Telegram bot token (channel telegram configure)
 			--user-id       Telegram allowed user id (channel telegram configure)
 			--chat-id       Telegram destination chat id (defaults to --user-id)
-			--token         Gateway link token (gateway link)
 			--url           Dashboard origin (dashboard pair)
 			--name          Friendly machine name (dashboard pair)
-			--tls-ca        Gateway custom CA path (gateway link)
-			--tls-cert      Gateway TLS certificate path (gateway start)
-			--tls-key       Gateway TLS private key path (gateway start)
-			--bind          Gateway listen address host:port (gateway start)
-			--insecure      Allow plain WS on non-loopback trusted tunnels (gateway start)
-			--grace-period-ms Gateway reconnect grace period in milliseconds (gateway start)
 			--dry-run       Print resolved bootstrap (workflow, isolation, plugins, harness) and exit (exec mode)
 			--project       Scope workflow command to project config (workflow use)
 			--global        Scope workflow command to global config (workflow use, default)
@@ -18368,6 +18712,9 @@ var cli = meow(
       },
       apiKey: {
         type: "string"
+      },
+      attachmentId: {
+        type: "string"
       }
     }
   }
@@ -18417,7 +18764,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-2MC5A7W4.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-X754ND4V.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx25(
           WorkflowInstallWizard,
@@ -18680,6 +19027,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         isolationPreset,
         ascii: cli.flags.ascii,
         showSetup,
+        ...cli.flags.attachmentId !== void 0 ? { attachmentId: cli.flags.attachmentId } : {},
         initialTelemetryDiagnosticsConsent: globalConfig.telemetryDiagnostics
       }
     ),