@drisp/cli 0.4.5 → 0.5.0

package/dist/{chunk-PJUDHH4R.js → chunk-K53YMYTG.js}

@@ -13,6 +13,10 @@ import {
   isValidHookEventEnvelope,
   resolveHookSocketPath
 } from "./chunk-BTKQ67RE.js";
+import {
+  createInstanceSocketClient,
+  writeAttachmentMirror
+} from "./chunk-ZVOGOZNT.js";
 import {
   TransportUnreachableError,
   createUdsClientTransport,
@@ -23,16 +27,46 @@ import {
   traceGatewayFrame,
   trackGatewayTransportReconnect,
   writeGatewayTrace
-} from "./chunk-4CRZXLIP.js";
+} from "./chunk-BTY7MYYT.js";
 import {
   compileWorkflowPlan,
   createWorkflowRunner,
+  installWorkflowFromSource,
   readConfig,
   readGlobalConfig,
   resolveActiveWorkflow,
   resolveWorkflow,
+  resolveWorkflowInstall,
   resolveWorkflowPlugins
-} from "./chunk-5VK2ZMVV.js";
+} from "./chunk-A54HGVML.js";
+
+// src/infra/daemon/stateDir.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+function daemonStatePaths(env = process.env) {
+  const xdg = env["XDG_STATE_HOME"];
+  const home = env["HOME"] ?? os.homedir();
+  const base = xdg && xdg.length > 0 ? xdg : path.join(home, ".local", "state");
+  const dir = path.join(base, "drisp");
+  return {
+    dir,
+    pidPath: path.join(dir, "dashboard-daemon.pid"),
+    logPath: path.join(dir, "dashboard-daemon.log"),
+    socketPath: path.join(dir, "dashboard-daemon.sock")
+  };
+}
+function ensureDaemonStateDir(env = process.env) {
+  const paths = daemonStatePaths(env);
+  fs.mkdirSync(paths.dir, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") {
+    try {
+      fs.chmodSync(paths.dir, 448);
+    } catch {
+    }
+  }
+  return paths;
+}
 
 // src/shared/utils/processRegistry.ts
 var ProcessRegistry = class {
@@ -146,12 +180,12 @@ var processRegistry = new ProcessRegistry();
 
 // src/harnesses/claude/runtime/server.ts
 import * as net from "net";
-import * as fs2 from "fs";
-import * as path2 from "path";
+import * as fs3 from "fs";
+import * as path3 from "path";
 
 // src/harnesses/claude/runtime/cleanupStaleSockets.ts
-import * as fs from "fs";
-import * as path from "path";
+import * as fs2 from "fs";
+import * as path2 from "path";
 var SOCK_PATTERN = /^ink-(\d+)\.sock$/;
 function isPidAlive(pid) {
   try {
@@ -165,7 +199,7 @@ function isPidAlive(pid) {
 function cleanupStaleSockets(sockDir) {
   let entries;
   try {
-    entries = fs.readdirSync(sockDir);
+    entries = fs2.readdirSync(sockDir);
   } catch {
     return [];
   }
@@ -176,7 +210,7 @@ function cleanupStaleSockets(sockDir) {
     const pid = parseInt(match[1], 10);
     if (isPidAlive(pid)) continue;
     try {
-      fs.unlinkSync(path.join(sockDir, entry));
+      fs2.unlinkSync(path2.join(sockDir, entry));
       removed.push(entry);
     } catch {
     }
@@ -355,7 +389,15 @@ var RULES = {
   },
   unknown: DEFAULT_HINTS
 };
-function getInteractionHints(kind) {
+var ASK_USER_QUESTION_HINTS = {
+  expectsDecision: true,
+  defaultTimeoutMs: null,
+  canBlock: true
+};
+function getInteractionHints(kind, toolName) {
+  if (kind === "tool.pre" && toolName === "AskUserQuestion") {
+    return ASK_USER_QUESTION_HINTS;
+  }
   const maybeRule = RULES[kind];
   return maybeRule ?? DEFAULT_HINTS;
 }
@@ -664,7 +706,7 @@ function mapEnvelopeToRuntimeEvent(envelope) {
     agentId: translated.agentId,
     agentType: translated.agentType,
     context,
-    interaction: getInteractionHints(translated.kind),
+    interaction: getInteractionHints(translated.kind, translated.toolName),
     payload: safePayload,
     display: buildClaudeDisplay(translated.kind, translated.data)
   };
@@ -754,6 +796,13 @@ var BoundedLineParser = class {
   }
 };
 
+// src/harnesses/claude/runtime/timeoutResolution.ts
+function resolveAdapterTimeoutMs(interaction, fallbackMs) {
+  const ms = interaction.defaultTimeoutMs;
+  if (ms === null) return null;
+  return ms ?? fallbackMs;
+}
+
 // src/harnesses/claude/runtime/streamJsonToolParser.ts
 function extractResultText(content) {
   if (typeof content === "string") return content;
@@ -943,7 +992,7 @@ function createServer2(opts) {
         return startPromise;
       }
       socketPath = resolveHookSocketPath(instanceId);
-      const socketDir = path2.dirname(socketPath);
+      const socketDir = path3.dirname(socketPath);
       lastError = null;
       const simulatedFailure = getSimulatedStartupFailure();
       if (simulatedFailure) {
@@ -969,7 +1018,7 @@ function createServer2(opts) {
         return Promise.resolve();
       }
       try {
-        fs2.mkdirSync(socketDir, { recursive: true });
+        fs3.mkdirSync(socketDir, { recursive: true });
       } catch (error) {
         status = "stopped";
         lastError = makeStartupError(
@@ -983,7 +1032,7 @@ function createServer2(opts) {
       }
       cleanupStaleSockets(socketDir);
       try {
-        fs2.unlinkSync(socketPath);
+        fs3.unlinkSync(socketPath);
       } catch {
       }
       server = net.createServer((socket) => {
@@ -1002,8 +1051,11 @@ function createServer2(opts) {
                 sessionId = envelope.session_id;
               }
               const runtimeEvent = mapEnvelopeToRuntimeEvent(envelope);
-              const timeoutMs = runtimeEvent.interaction.defaultTimeoutMs ?? PENDING_TTL_MS;
-              const timer = setTimeout(() => {
+              const timeoutMs = resolveAdapterTimeoutMs(
+                runtimeEvent.interaction,
+                PENDING_TTL_MS
+              );
+              const timer = timeoutMs === null ? void 0 : setTimeout(() => {
                 const timeoutDecision = {
                   type: "passthrough",
                   source: "timeout"
@@ -1068,7 +1120,7 @@ function createServer2(opts) {
         try {
           currentServer.listen(socketPath, () => {
             try {
-              fs2.chmodSync(socketPath, 384);
+              fs3.chmodSync(socketPath, 384);
             } catch {
             }
           });
@@ -1099,7 +1151,7 @@ function createServer2(opts) {
       status = "stopped";
       lastError = null;
       try {
-        fs2.unlinkSync(socketPath);
+        fs3.unlinkSync(socketPath);
       } catch {
       }
     },
@@ -1151,20 +1203,20 @@ function createClaudeHookRuntime(opts) {
 }
 
 // src/harnesses/claude/config/readSettingsModel.ts
-import fs3 from "fs";
-import os from "os";
-import path3 from "path";
+import fs4 from "fs";
+import os2 from "os";
+import path4 from "path";
 function readClaudeSettingsModel(projectDir) {
-  const home = os.homedir();
+  const home = os2.homedir();
   const paths = [
-    path3.join(projectDir, ".claude", "settings.local.json"),
-    path3.join(projectDir, ".claude", "settings.json"),
-    path3.join(home, ".claude", "settings.local.json"),
-    path3.join(home, ".claude", "settings.json")
+    path4.join(projectDir, ".claude", "settings.local.json"),
+    path4.join(projectDir, ".claude", "settings.json"),
+    path4.join(home, ".claude", "settings.local.json"),
+    path4.join(home, ".claude", "settings.json")
   ];
   for (const p of paths) {
     try {
-      const raw = JSON.parse(fs3.readFileSync(p, "utf-8"));
+      const raw = JSON.parse(fs4.readFileSync(p, "utf-8"));
       if (raw.model) return raw.model;
     } catch {
     }
@@ -1186,16 +1238,16 @@ function resolveClaudeModel({
 
 // src/harnesses/claude/system/verifyHarness.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import fs9 from "fs";
-import path8 from "path";
+import fs10 from "fs";
+import path9 from "path";
 
 // src/harnesses/claude/system/detectVersion.ts
 import { execFileSync } from "child_process";
 
 // src/harnesses/claude/system/resolveBinary.ts
-import * as fs4 from "fs";
-import * as os2 from "os";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as os3 from "os";
+import * as path5 from "path";
 var CLAUDE_BINARY_ENV_VARS = [
   "ATHENA_CLAUDE_PATH",
   "CLAUDE_BINARY",
@@ -1203,7 +1255,7 @@ var CLAUDE_BINARY_ENV_VARS = [
 ];
 function isExecutablePath(candidatePath) {
   try {
-    fs4.accessSync(candidatePath, fs4.constants.X_OK);
+    fs5.accessSync(candidatePath, fs5.constants.X_OK);
     return true;
   } catch {
     return false;
@@ -1211,7 +1263,7 @@ function isExecutablePath(candidatePath) {
 }
 function macosFallbacks(homeDir) {
   return [
-    path4.join(homeDir, ".local", "bin", "claude"),
+    path5.join(homeDir, ".local", "bin", "claude"),
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -1219,16 +1271,16 @@ function macosFallbacks(homeDir) {
 }
 function linuxFallbacks(homeDir) {
   return [
-    path4.join(homeDir, ".local", "bin", "claude"),
+    path5.join(homeDir, ".local", "bin", "claude"),
     "/usr/local/bin/claude",
     "/usr/bin/claude"
   ];
 }
 function collectCandidatePaths(pathValue, platform, homeDir) {
   const candidates = [];
-  for (const entry of (pathValue ?? "").split(path4.delimiter)) {
+  for (const entry of (pathValue ?? "").split(path5.delimiter)) {
     if (!entry) continue;
-    candidates.push(path4.join(entry, "claude"));
+    candidates.push(path5.join(entry, "claude"));
   }
   if (platform === "darwin") {
     candidates.push(...macosFallbacks(homeDir));
@@ -1240,7 +1292,7 @@ function collectCandidatePaths(pathValue, platform, homeDir) {
 function resolveClaudeBinary(options = {}) {
   const env = options.env ?? process.env;
   const platform = options.platform ?? process.platform;
-  const homeDir = options.homeDir ?? os2.homedir();
+  const homeDir = options.homeDir ?? os3.homedir();
   const pathValue = options.pathValue ?? env["PATH"];
   const isExecutable = options.isExecutable ?? isExecutablePath;
   for (const envVar of CLAUDE_BINARY_ENV_VARS) {
@@ -1278,9 +1330,9 @@ function detectClaudeVersion() {
 }
 
 // src/harnesses/claude/hooks/generateHookSettings.ts
-import * as fs5 from "fs";
-import * as path5 from "path";
-import * as os3 from "os";
+import * as fs6 from "fs";
+import * as path6 from "path";
+import * as os4 from "os";
 import { fileURLToPath } from "url";
 var TOOL_HOOK_EVENTS = [
   "PreToolUse",
@@ -1319,17 +1371,17 @@ function formatHookForwarderCommand(nodePath, scriptPath) {
   return `${quoteShellArg(nodePath)} ${quoteShellArg(scriptPath)}`;
 }
 function resolveHookForwarderPath(entryUrl) {
-  let currentDir = path5.dirname(fileURLToPath(entryUrl));
-  const siblingPath = path5.join(currentDir, "hook-forwarder.js");
-  if (fs5.existsSync(siblingPath)) {
+  let currentDir = path6.dirname(fileURLToPath(entryUrl));
+  const siblingPath = path6.join(currentDir, "hook-forwarder.js");
+  if (fs6.existsSync(siblingPath)) {
     return siblingPath;
   }
   for (; ; ) {
-    const candidatePath = path5.join(currentDir, "dist", "hook-forwarder.js");
-    if (fs5.existsSync(candidatePath)) {
+    const candidatePath = path6.join(currentDir, "dist", "hook-forwarder.js");
+    if (fs6.existsSync(candidatePath)) {
       return candidatePath;
     }
-    const parentDir = path5.dirname(currentDir);
+    const parentDir = path6.dirname(currentDir);
     if (parentDir === currentDir) {
       return null;
     }
@@ -1386,10 +1438,10 @@ function generateHookSettings(tempDir, authOverlay) {
   if (authOverlay?.apiKeyHelper) {
     settings.apiKeyHelper = authOverlay.apiKeyHelper;
   }
-  const dir = tempDir ?? os3.tmpdir();
+  const dir = tempDir ?? os4.tmpdir();
   const filename = `athena-hooks-${process.pid}-${Date.now()}.json`;
-  const settingsPath = path5.join(dir, filename);
-  fs5.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), {
+  const settingsPath = path6.join(dir, filename);
+  fs6.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), {
     encoding: "utf8",
     mode: 384
   });
@@ -1404,8 +1456,8 @@ function generateHookSettings(tempDir, authOverlay) {
     settingsPath,
     cleanup: () => {
       try {
-        if (fs5.existsSync(settingsPath)) {
-          fs5.unlinkSync(settingsPath);
+        if (fs6.existsSync(settingsPath)) {
+          fs6.unlinkSync(settingsPath);
         }
       } catch {
       }
@@ -1429,13 +1481,13 @@ function registerCleanupOnExit(cleanup) {
 }
 
 // src/harnesses/claude/auth/runtimeAuth.ts
-import os6 from "os";
+import os7 from "os";
 
 // src/harnesses/claude/system/doctorProbes.ts
 import { spawn, spawnSync } from "child_process";
-import * as fs6 from "fs";
-import * as os4 from "os";
-import * as path6 from "path";
+import * as fs7 from "fs";
+import * as os5 from "os";
+import * as path7 from "path";
 var DOCTOR_PROMPT = "Reply with exactly: ATHENA_DOCTOR_OK";
 var DOCTOR_EXPECTED = "ATHENA_DOCTOR_OK";
 var DOCTOR_TIMEOUT_MS = 3e4;
@@ -1553,15 +1605,15 @@ function scanSettingsFiles(homeDir, cwd, env, platform, readFileFn) {
   } else if (platform === "win32") {
     const programFiles = env["PROGRAMFILES"] ?? "C:\\Program Files";
     candidates.push(
-      path6.join(programFiles, "ClaudeCode", "managed-settings.json")
+      path7.join(programFiles, "ClaudeCode", "managed-settings.json")
     );
   } else {
     candidates.push("/etc/claude-code/managed-settings.json");
   }
-  const configDir = env["CLAUDE_CONFIG_DIR"] ?? path6.join(homeDir, ".claude");
-  candidates.push(path6.join(configDir, "settings.json"));
-  candidates.push(path6.join(cwd, ".claude", "settings.json"));
-  candidates.push(path6.join(cwd, ".claude", "settings.local.json"));
+  const configDir = env["CLAUDE_CONFIG_DIR"] ?? path7.join(homeDir, ".claude");
+  candidates.push(path7.join(configDir, "settings.json"));
+  candidates.push(path7.join(cwd, ".claude", "settings.json"));
+  candidates.push(path7.join(cwd, ".claude", "settings.local.json"));
   const scan = {
     apiKeyHelper: null,
     envApiKey: null,
@@ -1642,9 +1694,9 @@ function lookupCredential(options = {}) {
 function lookupAllCredentials(options = {}) {
   const env = options.env ?? process.env;
   const platform = options.platform ?? process.platform;
-  const homeDir = options.homeDir ?? os4.homedir();
+  const homeDir = options.homeDir ?? os5.homedir();
   const cwd = options.cwd ?? process.cwd();
-  const readFileFn = options.readFileFn ?? ((p) => fs6.readFileSync(p, "utf8"));
+  const readFileFn = options.readFileFn ?? ((p) => fs7.readFileSync(p, "utf8"));
   const found = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (cred) => {
@@ -1713,9 +1765,9 @@ function lookupAllCredentials(options = {}) {
     }
   }
   const dotenvCandidates = [
-    { source: "dotenv:.env", path: path6.join(cwd, ".env") },
-    { source: "dotenv:.env.local", path: path6.join(cwd, ".env.local") },
-    { source: "dotenv:~/.env", path: path6.join(homeDir, ".env") }
+    { source: "dotenv:.env", path: path7.join(cwd, ".env") },
+    { source: "dotenv:.env.local", path: path7.join(cwd, ".env.local") },
+    { source: "dotenv:~/.env", path: path7.join(homeDir, ".env") }
   ];
   for (const candidate of dotenvCandidates) {
     try {
@@ -1788,8 +1840,8 @@ function lookupAllCredentials(options = {}) {
     const raw = lookup("Claude Code-credentials");
     if (raw) pushBlobCredentials("keychain:Claude Code-credentials", raw);
   } else {
-    const credentialsPath = path6.join(
-      env["CLAUDE_CONFIG_DIR"] ?? path6.join(homeDir, ".claude"),
+    const credentialsPath = path7.join(
+      env["CLAUDE_CONFIG_DIR"] ?? path7.join(homeDir, ".claude"),
       ".credentials.json"
     );
     try {
@@ -1802,7 +1854,7 @@ function lookupAllCredentials(options = {}) {
   }
   const configHome = env["CLAUDE_CONFIG_DIR"] ?? homeDir;
   try {
-    const raw = readFileFn(path6.join(configHome, ".claude.json"));
+    const raw = readFileFn(path7.join(configHome, ".claude.json"));
     if (raw.includes(SK_ANT_API_PREFIX)) {
       const apiKey2 = extractApiKeyFromParsed(safeJsonParse(raw));
       if (apiKey2) {
@@ -1816,19 +1868,19 @@ function lookupAllCredentials(options = {}) {
 function shellQuoteSingle(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-function buildApiKeyHelperSettings(value, tempDir = os4.tmpdir()) {
+function buildApiKeyHelperSettings(value, tempDir = os5.tmpdir()) {
   const filename = `athena-doctor-helper-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`;
-  const settingsPath = path6.join(tempDir, filename);
+  const settingsPath = path7.join(tempDir, filename);
   const settings = {
     apiKeyHelper: `printf %s ${shellQuoteSingle(value)}`
   };
-  fs6.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf8");
+  fs7.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf8");
   return {
     settingsPath,
     cleanup: () => {
       try {
-        if (fs6.existsSync(settingsPath)) {
-          fs6.unlinkSync(settingsPath);
+        if (fs7.existsSync(settingsPath)) {
+          fs7.unlinkSync(settingsPath);
         }
       } catch {
       }
@@ -1851,7 +1903,7 @@ function formatProbeCommand(probe, claudeBinary, aliases) {
       parts.push(`${key}=${shellQuoteArg(maskCredentialValue(value))}`);
     }
   }
-  parts.push(path6.basename(claudeBinary));
+  parts.push(path7.basename(claudeBinary));
   const aliasFor = (arg) => {
     if (!aliases) return null;
     for (const [name, fullPath] of aliases) {
@@ -2206,12 +2258,12 @@ function probeSkipReason(probe, opts) {
 }
 
 // src/harnesses/claude/auth/portableAuth.ts
-import fs8 from "fs";
-import os5 from "os";
+import fs9 from "fs";
+import os6 from "os";
 
 // src/harnesses/claude/auth/settingsSurfaces.ts
-import fs7 from "fs";
-import path7 from "path";
+import fs8 from "fs";
+import path8 from "path";
 var PORTABLE_PROVIDER_ENV_VARS = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_AUTH_TOKEN",
@@ -2230,7 +2282,7 @@ var PORTABLE_PROVIDER_ENV_VARS = [
   "CLAUDE_CODE_SKIP_FOUNDRY_AUTH"
 ];
 function resolveClaudeSettingsDir(homeDir, env) {
-  return env["CLAUDE_CONFIG_DIR"] ?? path7.join(homeDir, ".claude");
+  return env["CLAUDE_CONFIG_DIR"] ?? path8.join(homeDir, ".claude");
 }
 function managedSettingsDir(platform, env) {
   if (platform === "darwin") {
@@ -2238,27 +2290,27 @@ function managedSettingsDir(platform, env) {
   }
   if (platform === "win32") {
     const programFiles = env["PROGRAMFILES"] ?? "C:\\Program Files";
-    return path7.join(programFiles, "ClaudeCode");
+    return path8.join(programFiles, "ClaudeCode");
   }
   return "/etc/claude-code";
 }
-function listManagedSettingsPaths(platform, env, readdirSync2 = fs7.readdirSync) {
+function listManagedSettingsPaths(platform, env, readdirSync2 = fs8.readdirSync) {
   const baseDir = managedSettingsDir(platform, env);
-  const paths = [path7.join(baseDir, "managed-settings.json")];
-  const dropInDir = path7.join(baseDir, "managed-settings.d");
+  const paths = [path8.join(baseDir, "managed-settings.json")];
+  const dropInDir = path8.join(baseDir, "managed-settings.d");
   try {
-    const dropIns = readdirSync2(dropInDir).filter((name) => name.endsWith(".json")).sort().map((name) => path7.join(dropInDir, name));
+    const dropIns = readdirSync2(dropInDir).filter((name) => name.endsWith(".json")).sort().map((name) => path8.join(dropInDir, name));
     paths.push(...dropIns);
   } catch {
   }
   return paths;
 }
-function resolveClaudeSettingsSurfacePaths(homeDir, cwd, platform, env, readdirSync2 = fs7.readdirSync) {
+function resolveClaudeSettingsSurfacePaths(homeDir, cwd, platform, env, readdirSync2 = fs8.readdirSync) {
   return {
     managed: listManagedSettingsPaths(platform, env, readdirSync2),
-    user: path7.join(resolveClaudeSettingsDir(homeDir, env), "settings.json"),
-    project: path7.join(cwd, ".claude", "settings.json"),
-    local: path7.join(cwd, ".claude", "settings.local.json")
+    user: path8.join(resolveClaudeSettingsDir(homeDir, env), "settings.json"),
+    project: path8.join(cwd, ".claude", "settings.json"),
+    local: path8.join(cwd, ".claude", "settings.local.json")
   };
 }
 
@@ -2272,10 +2324,10 @@ function readJsonObject(filePath, readFileFn) {
 }
 function resolvePortableAuthSettings(options = {}) {
   const cwd = options.cwd ?? process.cwd();
-  const homeDir = options.homeDir ?? os5.homedir();
+  const homeDir = options.homeDir ?? os6.homedir();
   const platform = options.platform ?? process.platform;
   const env = options.env ?? process.env;
-  const readFileFn = options.readFileFn ?? ((filePath) => fs8.readFileSync(filePath, "utf8"));
+  const readFileFn = options.readFileFn ?? ((filePath) => fs9.readFileSync(filePath, "utf8"));
   const settingsPaths = resolveClaudeSettingsSurfacePaths(
     homeDir,
     cwd,
@@ -2335,7 +2387,7 @@ function resolveRuntimeAuthOverlay(options = {}) {
   const credential = lookupCredential({
     ...options,
     cwd: options.cwd ?? process.cwd(),
-    homeDir: options.homeDir ?? os6.homedir(),
+    homeDir: options.homeDir ?? os7.homedir(),
     platform: options.platform ?? process.platform,
     env: options.env ?? process.env
   });
@@ -2479,16 +2531,16 @@ function runClaudeAuthStatus(claudeBinary) {
 }
 function canExecute(candidatePath) {
   try {
-    fs9.accessSync(candidatePath, fs9.constants.X_OK);
+    fs10.accessSync(candidatePath, fs10.constants.X_OK);
     return true;
   } catch {
     return false;
   }
 }
 function resolveExecutableOnPath(commandName, pathValue, fileExists) {
-  for (const entry of pathValue.split(path8.delimiter)) {
+  for (const entry of pathValue.split(path9.delimiter)) {
     if (!entry) continue;
-    const candidate = path8.join(entry, commandName);
+    const candidate = path9.join(entry, commandName);
     if (fileExists(candidate)) {
       return candidate;
     }
@@ -2565,7 +2617,7 @@ function verifyClaudeHarness(options = {}) {
   }
   if (hookForwarder.source === "bundled") {
     const nodeOk = fileExists(hookForwarder.executable);
-    const scriptOk = !!hookForwarder.scriptPath && fs9.existsSync(hookForwarder.scriptPath);
+    const scriptOk = !!hookForwarder.scriptPath && fs10.existsSync(hookForwarder.scriptPath);
     checks.push({
       label: "Hook forwarder",
       status: nodeOk && scriptOk ? "pass" : "fail",
@@ -2730,8 +2782,8 @@ import { useCallback, useEffect, useRef, useState } from "react";
 
 // src/harnesses/claude/process/spawn.ts
 import { spawn as spawn2 } from "child_process";
-import fs10 from "fs";
-import path9 from "path";
+import fs11 from "fs";
+import path10 from "path";
 
 // src/harnesses/claude/config/isolation.ts
 var DISALLOWED_FIRST_PARTY_MCPS = [
@@ -2979,11 +3031,11 @@ function makePreflightError(failureCode, message) {
 }
 function resolveExecutableOnPath2(commandName) {
   const pathValue = process.env["PATH"] ?? "";
-  for (const entry of pathValue.split(path9.delimiter)) {
+  for (const entry of pathValue.split(path10.delimiter)) {
     if (!entry) continue;
-    const candidate = path9.join(entry, commandName);
+    const candidate = path10.join(entry, commandName);
     try {
-      fs10.accessSync(candidate, fs10.constants.X_OK);
+      fs11.accessSync(candidate, fs11.constants.X_OK);
       return candidate;
     } catch {
     }
@@ -3008,7 +3060,7 @@ function runSpawnPreflight(hookSocketPath) {
     );
   }
   const hookForwarder = resolveHookForwarderCommand();
-  if (hookForwarder.source === "bundled" && (!fs10.existsSync(hookForwarder.executable) || !hookForwarder.scriptPath || !fs10.existsSync(hookForwarder.scriptPath))) {
+  if (hookForwarder.source === "bundled" && (!fs11.existsSync(hookForwarder.executable) || !hookForwarder.scriptPath || !fs11.existsSync(hookForwarder.scriptPath))) {
     throw makePreflightError(
       "hook_forwarder_missing",
       "Athena hook forwarder bundle is missing. Rebuild or reinstall Athena before retrying."
@@ -5518,9 +5570,9 @@ function buildCodexPluginInstallMessage(plugins) {
 }
 
 // src/harnesses/codex/runtime/agentConfig.ts
-import fs11 from "fs";
-import path10 from "path";
-import os7 from "os";
+import fs12 from "fs";
+import path11 from "path";
+import os8 from "os";
 
 // src/shared/utils/yamlFrontmatter.ts
 function parseSimpleYaml(lines) {
@@ -5679,7 +5731,7 @@ function discoverAgents(agentRoots) {
   for (const root of agentRoots) {
     let entries;
     try {
-      entries = fs11.readdirSync(root, { withFileTypes: true });
+      entries = fs12.readdirSync(root, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -5687,9 +5739,9 @@ function discoverAgents(agentRoots) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) {
         continue;
       }
-      const filePath = path10.join(root, entry.name);
+      const filePath = path11.join(root, entry.name);
       try {
-        const content = fs11.readFileSync(filePath, "utf-8");
+        const content = fs12.readFileSync(filePath, "utf-8");
         const agent = parseAgentMd(filePath, content);
         agents.push({ filePath, agent });
       } catch (err) {
@@ -5745,8 +5797,8 @@ function resolveCodexAgentConfig(input) {
       errors: allErrors
     };
   }
-  const tempDir = path10.join(os7.tmpdir(), `athena-agents-${sessionId}`);
-  fs11.mkdirSync(tempDir, { recursive: true });
+  const tempDir = path11.join(os8.tmpdir(), `athena-agents-${sessionId}`);
+  fs12.mkdirSync(tempDir, { recursive: true });
   const edits = [
     {
       keyPath: "features.multi_agent",
@@ -5767,8 +5819,8 @@ function resolveCodexAgentConfig(input) {
   const agentNames = [];
   for (const { agent } of uniqueAgents) {
     const toml = generateAgentToml(agent);
-    const tomlPath = path10.join(tempDir, `${agent.name}.toml`);
-    fs11.writeFileSync(tomlPath, toml, "utf-8");
+    const tomlPath = path11.join(tempDir, `${agent.name}.toml`);
+    fs12.writeFileSync(tomlPath, toml, "utf-8");
     edits.push({
       keyPath: `agents.${agent.name}`,
       value: {
@@ -5807,7 +5859,7 @@ function cleanupAgentConfig(tempDir) {
     return;
   }
   try {
-    fs11.rmSync(tempDir, { recursive: true, force: true });
+    fs12.rmSync(tempDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -6422,7 +6474,7 @@ function createCodexRuntime(opts) {
 }
 
 // src/harnesses/codex/session/sessionAssets.ts
-import fs12 from "fs";
+import fs13 from "fs";
 function asRecord4(value) {
   if (typeof value === "object" && value !== null) {
     return value;
@@ -6491,7 +6543,7 @@ function readMcpServers(configPath) {
   }
   let raw;
   try {
-    raw = fs12.readFileSync(configPath, "utf-8");
+    raw = fs13.readFileSync(configPath, "utf-8");
   } catch {
     return {};
   }
@@ -6985,9 +7037,9 @@ function listHarnessCapabilities() {
 }
 
 // src/infra/plugins/register.ts
-import fs14 from "fs";
-import os8 from "os";
-import path12 from "path";
+import fs15 from "fs";
+import os9 from "os";
+import path13 from "path";
 
 // src/app/commands/registry.ts
 var commands = /* @__PURE__ */ new Map();
@@ -7018,8 +7070,8 @@ function getAll() {
 }
 
 // src/infra/plugins/loader.ts
-import fs13 from "fs";
-import path11 from "path";
+import fs14 from "fs";
+import path12 from "path";
 
 // src/infra/plugins/frontmatter.ts
 function parseFrontmatter(content) {
@@ -7036,27 +7088,27 @@ function parseFrontmatter(content) {
 
 // src/infra/plugins/loader.ts
 function loadPlugin(pluginDir) {
-  if (!fs13.existsSync(pluginDir)) {
+  if (!fs14.existsSync(pluginDir)) {
     throw new Error(`Plugin directory not found: ${pluginDir}`);
   }
-  const manifestPath = path11.join(pluginDir, ".claude-plugin", "plugin.json");
-  if (!fs13.existsSync(manifestPath)) {
+  const manifestPath = path12.join(pluginDir, ".claude-plugin", "plugin.json");
+  if (!fs14.existsSync(manifestPath)) {
     throw new Error(`Plugin manifest not found: ${manifestPath}`);
   }
-  JSON.parse(fs13.readFileSync(manifestPath, "utf-8"));
-  const skillsDir = path11.join(pluginDir, "skills");
-  if (!fs13.existsSync(skillsDir)) {
+  JSON.parse(fs14.readFileSync(manifestPath, "utf-8"));
+  const skillsDir = path12.join(pluginDir, "skills");
+  if (!fs14.existsSync(skillsDir)) {
     return [];
   }
-  const mcpConfigPath = path11.join(pluginDir, ".mcp.json");
-  const hasMcpConfig = fs13.existsSync(mcpConfigPath);
-  const entries = fs13.readdirSync(skillsDir, { withFileTypes: true });
+  const mcpConfigPath = path12.join(pluginDir, ".mcp.json");
+  const hasMcpConfig = fs14.existsSync(mcpConfigPath);
+  const entries = fs14.readdirSync(skillsDir, { withFileTypes: true });
   const commands2 = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const skillPath = path11.join(skillsDir, entry.name, "SKILL.md");
-    if (!fs13.existsSync(skillPath)) continue;
-    const content = fs13.readFileSync(skillPath, "utf-8");
+    const skillPath = path12.join(skillsDir, entry.name, "SKILL.md");
+    if (!fs14.existsSync(skillPath)) continue;
+    const content = fs14.readFileSync(skillPath, "utf-8");
     const parsed = parseFrontmatter(content);
     if (!parsed.frontmatter["user-invocable"]) continue;
     commands2.push(
@@ -7095,11 +7147,11 @@ function skillToCommand(frontmatter, body, mcpConfigPath) {
 function buildPluginMcpConfig(pluginDirs, mcpServerOptions) {
   const mergedServers = {};
   for (const dir of pluginDirs) {
-    const mcpPath = path12.join(dir, ".mcp.json");
-    if (!fs14.existsSync(mcpPath)) {
+    const mcpPath = path13.join(dir, ".mcp.json");
+    if (!fs15.existsSync(mcpPath)) {
       continue;
     }
-    const config = JSON.parse(fs14.readFileSync(mcpPath, "utf-8"));
+    const config = JSON.parse(fs15.readFileSync(mcpPath, "utf-8"));
     for (const [serverName, serverConfig] of Object.entries(
       config.mcpServers ?? {}
     )) {
@@ -7122,8 +7174,8 @@ function buildPluginMcpConfig(pluginDirs, mcpServerOptions) {
   if (Object.keys(mergedServers).length === 0) {
     return void 0;
   }
-  const mcpConfig = path12.join(os8.tmpdir(), `athena-mcp-${process.pid}.json`);
-  fs14.writeFileSync(mcpConfig, JSON.stringify({ mcpServers: mergedServers }));
+  const mcpConfig = path13.join(os9.tmpdir(), `athena-mcp-${process.pid}.json`);
+  fs15.writeFileSync(mcpConfig, JSON.stringify({ mcpServers: mergedServers }));
   return mcpConfig;
 }
 function registerPlugins(pluginDirs, mcpServerOptions, includeMcpConfig = true) {
@@ -7295,7 +7347,7 @@ var EXEC_EXIT_CODE = {
 
 // src/app/exec/runner.ts
 import crypto2 from "crypto";
-import path17 from "path";
+import path18 from "path";
 
 // src/core/feed/todo.ts
 function isSubagentTool(toolName) {
@@ -7657,27 +7709,27 @@ function generateNeutralTitle(event, g) {
 }
 
 // src/core/feed/transcript.ts
-import * as fs15 from "fs";
+import * as fs16 from "fs";
 function createTranscriptReader() {
   const offsets = /* @__PURE__ */ new Map();
   function readNewAssistantMessages(transcriptPath) {
     const offset = offsets.get(transcriptPath) ?? 0;
     let fileSize;
     try {
-      fileSize = fs15.statSync(transcriptPath).size;
+      fileSize = fs16.statSync(transcriptPath).size;
       if (fileSize <= offset) return [];
     } catch {
       return [];
     }
     let fd;
     try {
-      fd = fs15.openSync(transcriptPath, "r");
+      fd = fs16.openSync(transcriptPath, "r");
     } catch {
       return [];
     }
     try {
       const buf = Buffer.alloc(fileSize - offset);
-      const bytesRead = fs15.readSync(fd, buf, 0, buf.length, offset);
+      const bytesRead = fs16.readSync(fd, buf, 0, buf.length, offset);
       let lastNewline = -1;
       for (let i = bytesRead - 1; i >= 0; i--) {
         if (buf[i] === 10) {
@@ -7721,7 +7773,7 @@ function createTranscriptReader() {
       }
       return messages;
     } finally {
-      fs15.closeSync(fd);
+      fs16.closeSync(fd);
     }
   }
   function getOffset(transcriptPath) {
@@ -9461,8 +9513,8 @@ function persistOrDegrade(store, action, label, onFailure) {
 }
 
 // src/infra/sessions/store.ts
-import fs16 from "fs";
-import path13 from "path";
+import fs17 from "fs";
+import path14 from "path";
 import Database from "better-sqlite3";
 
 // src/infra/sessions/schema.ts
@@ -9731,7 +9783,7 @@ function rowToAthenaSession(row, adapterSessionIds, firstPrompt) {
 // src/infra/sessions/store.ts
 function createSessionStore(opts) {
   if (opts.dbPath !== ":memory:") {
-    fs16.mkdirSync(path13.dirname(opts.dbPath), { recursive: true });
+    fs17.mkdirSync(path14.dirname(opts.dbPath), { recursive: true });
   }
   const db = new Database(opts.dbPath);
   initSchema(db);
@@ -10006,18 +10058,18 @@ function createSessionStore(opts) {
 }
 
 // src/infra/sessions/registry.ts
-import fs17 from "fs";
-import os9 from "os";
-import path14 from "path";
+import fs18 from "fs";
+import os10 from "os";
+import path15 from "path";
 import Database2 from "better-sqlite3";
 function sessionsDir() {
-  return path14.join(os9.homedir(), ".config", "athena", "sessions");
+  return path15.join(os10.homedir(), ".config", "athena", "sessions");
 }
 function sessionDbPath(sessionId) {
-  return path14.join(sessionsDir(), sessionId, "session.db");
+  return path15.join(sessionsDir(), sessionId, "session.db");
 }
 function readSessionFromDb(dbPath) {
-  if (!fs17.existsSync(dbPath)) return null;
+  if (!fs18.existsSync(dbPath)) return null;
   let db;
   try {
     db = new Database2(dbPath, { readonly: true });
@@ -10050,12 +10102,12 @@ function readSessionFromDb(dbPath) {
 }
 function listSessions(projectDir) {
   const dir = sessionsDir();
-  if (!fs17.existsSync(dir)) return [];
-  const entries = fs17.readdirSync(dir, { withFileTypes: true });
+  if (!fs18.existsSync(dir)) return [];
+  const entries = fs18.readdirSync(dir, { withFileTypes: true });
   const sessions = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dbPath = path14.join(dir, entry.name, "session.db");
+    const dbPath = path15.join(dir, entry.name, "session.db");
     const session = readSessionFromDb(dbPath);
     if (session && (session.eventCount ?? 0) > 0) {
       if (!projectDir || session.projectDir === projectDir) {
@@ -10502,9 +10554,9 @@ function defaultLoadToken(tokenPath) {
 }
 
 // src/infra/config/gatewayClient.ts
-import fs18 from "fs";
-import os10 from "os";
-import path15 from "path";
+import fs19 from "fs";
+import os11 from "os";
+import path16 from "path";
 
 // src/shared/gateway-protocol/endpoint.ts
 function parseRuntimeEndpoint(value) {
@@ -10559,17 +10611,17 @@ function isRecord(value) {
 
 // src/infra/config/gatewayClient.ts
 function resolveGatewayClientConfigPath(env = process.env) {
-  const home = env["HOME"] ?? os10.homedir();
-  return path15.join(home, ".config", "athena", "gateway.json");
+  const home = env["HOME"] ?? os11.homedir();
+  return path16.join(home, ".config", "athena", "gateway.json");
 }
 function readGatewayClientConfig(env = process.env) {
   const configPath = resolveGatewayClientConfigPath(env);
-  if (!fs18.existsSync(configPath)) {
+  if (!fs19.existsSync(configPath)) {
     return { mode: "local" };
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs18.readFileSync(configPath, "utf-8"));
+    parsed = JSON.parse(fs19.readFileSync(configPath, "utf-8"));
   } catch (err) {
     throw new Error(
       `gateway client config ${configPath} is invalid JSON: ${err instanceof Error ? err.message : String(err)}`
@@ -10586,16 +10638,16 @@ function readGatewayClientConfig(env = process.env) {
 function writeGatewayClientConfig(config, env = process.env) {
   const parsed = parseRuntimeEndpoint(config);
   const configPath = resolveGatewayClientConfigPath(env);
-  const dir = path15.dirname(configPath);
-  fs18.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs18.writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n", {
+  const dir = path16.dirname(configPath);
+  fs19.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs19.writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
   if (process.platform !== "win32") {
     try {
-      fs18.chmodSync(dir, 448);
-      fs18.chmodSync(configPath, 384);
+      fs19.chmodSync(dir, 448);
+      fs19.chmodSync(configPath, 384);
     } catch {
     }
   }
@@ -10731,6 +10783,19 @@ var SessionBridge = class {
     );
     return res;
   }
+  async sendRunEvent(event) {
+    const client = await this.requireConnectedClient();
+    const req = {
+      runtimeId: this.opts.runtimeId,
+      location: event.location,
+      runId: event.runId,
+      seq: event.seq,
+      ts: event.ts,
+      kind: event.kind,
+      ...event.payload !== void 0 ? { payload: event.payload } : {}
+    };
+    return client.request("session.run.event", req);
+  }
   async relayPermission(req) {
     writeGatewayTrace(
       `sessionBridge relayPermission tool=${req.toolName} runtimeId=${this.opts.runtimeId}`
@@ -10743,7 +10808,7 @@ var SessionBridge = class {
       inputPreview: req.inputPreview,
       ...req.ttlMs !== void 0 ? { ttlMs: req.ttlMs } : {}
     };
-    const overallTimeoutMs = req.ttlMs ?? RELAY_REQUEST_TIMEOUT_MS;
+    const overallTimeoutMs = req.ttlMs === null ? null : req.ttlMs ?? RELAY_REQUEST_TIMEOUT_MS;
     return this.requestWithReconnect("relay.permission.request", payload, overallTimeoutMs);
   }
   async relayQuestion(req) {
@@ -10754,7 +10819,7 @@ var SessionBridge = class {
       questions: req.questions,
       ...req.ttlMs !== void 0 ? { ttlMs: req.ttlMs } : {}
     };
-    const overallTimeoutMs = req.ttlMs ?? RELAY_REQUEST_TIMEOUT_MS;
+    const overallTimeoutMs = req.ttlMs === null ? null : req.ttlMs ?? RELAY_REQUEST_TIMEOUT_MS;
     return this.requestWithReconnect("relay.question.request", payload, overallTimeoutMs);
   }
   /**
@@ -10766,19 +10831,21 @@ var SessionBridge = class {
    * caller-provided overall timeout so a long outage still surfaces.
    */
   async requestWithReconnect(kind, payload, overallTimeoutMs) {
-    const deadline = Date.now() + overallTimeoutMs;
+    const deadline = overallTimeoutMs === null ? null : Date.now() + overallTimeoutMs;
     while (true) {
       const client = await this.requireConnectedClient();
-      const remaining = deadline - Date.now();
-      if (remaining <= 0) {
+      const remaining = deadline === null ? null : deadline - Date.now();
+      if (remaining !== null && remaining <= 0) {
         throw new GatewayProtocolError(`request ${kind} timed out`);
       }
       try {
         return await client.request(kind, payload, {
-          timeoutMs: remaining
+          // When unbounded, pass the largest safe setTimeout value so the
+          // inner request never self-cancels in any human time scale.
+          timeoutMs: remaining ?? 2147483647
         });
       } catch (err) {
-        if (err instanceof GatewayProtocolError && err.code === "connection_closed" && !this.stopped && Date.now() < deadline) {
+        if (err instanceof GatewayProtocolError && err.code === "connection_closed" && !this.stopped && (deadline === null || Date.now() < deadline)) {
           writeGatewayTrace(
             `sessionBridge relay retry kind=${kind} runtimeId=${this.opts.runtimeId}`
           );
@@ -10913,7 +10980,8 @@ var SessionBridge = class {
     const req = {
       runtimeId: this.opts.runtimeId,
       defaultAgentId: this.opts.defaultAgentId,
-      pid: this.opts.pid ?? process.pid
+      pid: this.opts.pid ?? process.pid,
+      ...this.opts.attachmentId !== void 0 ? { attachmentId: this.opts.attachmentId } : {}
     };
     try {
       return await client.request("session.register", req);
@@ -10967,7 +11035,8 @@ async function startSessionBridge(opts) {
     if (signal?.aborted) return null;
     const bridge = new SessionBridge({
       runtimeId: opts.runtimeId,
-      defaultAgentId: opts.defaultAgentId
+      defaultAgentId: opts.defaultAgentId,
+      ...opts.attachmentId !== void 0 ? { attachmentId: opts.attachmentId } : {}
     });
     writeGatewayTrace(`startSessionBridge attempt runtimeId=${opts.runtimeId}`);
     try {
@@ -11007,6 +11076,194 @@ function sleepOrAbort(ms, signal) {
   });
 }
 
+// src/app/dashboard/dashboardFeedPublisher.ts
+import Database3 from "better-sqlite3";
+function dashboardFeedOutboxPath() {
+  return `${ensureDaemonStateDir().dir}/dashboard-feed-outbox.db`;
+}
+function initOutboxSchema(db) {
+  db.exec(`
+		PRAGMA journal_mode = WAL;
+
+		CREATE TABLE IF NOT EXISTS dashboard_feed_outbox (
+			delivery_seq INTEGER PRIMARY KEY AUTOINCREMENT,
+			instance_id TEXT NOT NULL,
+			athena_session_id TEXT NOT NULL,
+			run_id TEXT NOT NULL,
+			origin TEXT NOT NULL CHECK(origin IN ('local', 'dashboard')),
+			event_id TEXT NOT NULL,
+			emitted_at INTEGER NOT NULL,
+			feed_event_json TEXT NOT NULL,
+			attempt INTEGER NOT NULL DEFAULT 0,
+			next_attempt_at INTEGER NOT NULL,
+			last_error TEXT,
+			acked_at INTEGER,
+			UNIQUE(instance_id, event_id)
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_dashboard_feed_outbox_pending
+			ON dashboard_feed_outbox(acked_at, next_attempt_at, delivery_seq);
+	`);
+}
+function makeEnvelope(input) {
+  return {
+    instanceId: input.instanceId,
+    athenaSessionId: input.athenaSessionId,
+    runId: input.feedEvent.run_id,
+    origin: input.origin,
+    eventId: `${input.athenaSessionId}:${input.feedEvent.event_id}`,
+    feedSeq: input.deliverySeq,
+    emittedAt: input.emittedAt,
+    feedEvent: input.feedEvent
+  };
+}
+function createDashboardFeedOutbox(options = {}) {
+  const db = new Database3(options.dbPath ?? dashboardFeedOutboxPath());
+  initOutboxSchema(db);
+  const insert = db.prepare(`
+		INSERT OR IGNORE INTO dashboard_feed_outbox (
+			instance_id,
+			athena_session_id,
+			run_id,
+			origin,
+			event_id,
+			emitted_at,
+			feed_event_json,
+			next_attempt_at
+		)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+	`);
+  const selectPending = db.prepare(`
+		SELECT
+			delivery_seq,
+			instance_id,
+			athena_session_id,
+			run_id,
+			origin,
+			event_id,
+			emitted_at,
+			feed_event_json,
+			attempt,
+			next_attempt_at,
+			last_error
+		FROM dashboard_feed_outbox
+		WHERE acked_at IS NULL AND next_attempt_at <= ?
+		ORDER BY delivery_seq ASC
+		LIMIT ?
+	`);
+  const updateAttempt = db.prepare(`
+		UPDATE dashboard_feed_outbox
+		SET attempt = attempt + 1,
+			next_attempt_at = ?,
+			last_error = ?
+		WHERE delivery_seq = ?
+	`);
+  const ackBySeq = db.prepare(`
+		UPDATE dashboard_feed_outbox
+		SET acked_at = ?
+		WHERE delivery_seq = ?
+	`);
+  const ackByEventId = db.prepare(`
+		UPDATE dashboard_feed_outbox
+		SET acked_at = ?
+		WHERE event_id = ?
+	`);
+  const enqueueTx = db.transaction(
+    (input) => {
+      for (const feedEvent of input.feedEvents) {
+        const eventId = `${input.athenaSessionId}:${feedEvent.event_id}`;
+        insert.run(
+          input.instanceId,
+          input.athenaSessionId,
+          feedEvent.run_id,
+          input.origin,
+          eventId,
+          input.emittedAt,
+          JSON.stringify(feedEvent),
+          input.emittedAt
+        );
+      }
+    }
+  );
+  return {
+    enqueue(input) {
+      if (input.feedEvents.length === 0) return;
+      enqueueTx(input);
+    },
+    pendingBatch(input) {
+      const rows = selectPending.all(input.now, input.limit);
+      return rows.map((row) => {
+        const feedEvent = JSON.parse(row.feed_event_json);
+        return {
+          deliverySeq: row.delivery_seq,
+          envelope: makeEnvelope({
+            instanceId: row.instance_id,
+            athenaSessionId: row.athena_session_id,
+            origin: row.origin,
+            feedEvent,
+            deliverySeq: row.delivery_seq,
+            emittedAt: row.emitted_at
+          }),
+          attempt: row.attempt,
+          nextAttemptAt: row.next_attempt_at,
+          ...row.last_error ? { lastError: row.last_error } : {}
+        };
+      });
+    },
+    markAttempted(input) {
+      updateAttempt.run(
+        input.nextAttemptAt,
+        input.lastError ?? null,
+        input.deliverySeq
+      );
+    },
+    markAcked(input) {
+      const now = Date.now();
+      if (typeof input.deliverySeq === "number") {
+        ackBySeq.run(now, input.deliverySeq);
+      }
+      if (input.eventId) {
+        ackByEventId.run(now, input.eventId);
+      }
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+function createDashboardFeedPublisher(options = {}) {
+  const readConfig2 = options.readConfig ?? (() => readDashboardClientConfig());
+  const now = options.now ?? (() => Date.now());
+  const onError = options.onError ?? (() => {
+  });
+  let ownedOutbox = null;
+  function getOutbox() {
+    if (options.outbox) return options.outbox;
+    ownedOutbox ??= createDashboardFeedOutbox();
+    return ownedOutbox;
+  }
+  return {
+    publish(input) {
+      if (input.feedEvents.length === 0) return;
+      try {
+        const config = readConfig2();
+        if (!config) return;
+        getOutbox().enqueue({
+          instanceId: config.instanceId,
+          athenaSessionId: input.athenaSessionId,
+          origin: input.origin,
+          feedEvents: input.feedEvents,
+          emittedAt: now()
+        });
+      } catch (err) {
+        onError(
+          `dashboard feed publish failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  };
+}
+
 // src/app/exec/finalMessage.ts
 function findLastMappedAgentMessage(feedEvents) {
   for (let i = feedEvents.length - 1; i >= 0; i--) {
@@ -11057,8 +11314,8 @@ function exitCodeFromFailure(failure) {
 }
 
 // src/app/exec/output.ts
-import fs19 from "fs/promises";
-import path16 from "path";
+import fs20 from "fs/promises";
+import path17 from "path";
 
 // src/app/exec/jsonl.ts
 function createExecJsonlEvent(type, data, ts = Date.now()) {
@@ -11097,9 +11354,9 @@ function createExecOutputWriter(options) {
       writeLine(options.stdout, message);
     },
     async writeLastMessage(filePath, message) {
-      const absPath = path16.resolve(filePath);
-      await fs19.mkdir(path16.dirname(absPath), { recursive: true });
-      await fs19.writeFile(absPath, message, "utf-8");
+      const absPath = path17.resolve(filePath);
+      await fs20.mkdir(path17.dirname(absPath), { recursive: true });
+      await fs20.writeFile(absPath, message, "utf-8");
     }
   };
 }
@@ -11155,6 +11412,8 @@ async function runExec(options) {
   const runtimeFactory = options.runtimeFactory ?? createRuntime;
   const sessionStoreFactory = options.sessionStoreFactory ?? createSessionStore;
   const athenaSessionId = options.athenaSessionId ?? crypto2.randomUUID();
+  const dashboardFeedPublisher = options.dashboardFeedPublisher ?? createDashboardFeedPublisher();
+  const dashboardOrigin = options.dashboardOrigin ?? "local";
   const output = createExecOutputWriter({
     json,
     verbose,
@@ -11174,7 +11433,7 @@ async function runExec(options) {
     store = sessionStoreFactory({
       sessionId: athenaSessionId,
       projectDir: options.projectDir,
-      dbPath: options.ephemeral ? ":memory:" : path17.join(sessionsDir(), athenaSessionId, "session.db")
+      dbPath: options.ephemeral ? ":memory:" : path18.join(sessionsDir(), athenaSessionId, "session.db")
     });
   } catch (error) {
     const message = `Failed to initialize session store: ${error instanceof Error ? error.message : String(error)}`;
@@ -11264,7 +11523,33 @@ async function runExec(options) {
     } : {},
     ...options.signal ? { signal: options.signal } : {}
   };
+  const dashboardDecisionInbox = options.dashboardDecisionInbox;
+  const applyPendingDashboardDecisions = () => {
+    if (!dashboardDecisionInbox) return;
+    const rows = dashboardDecisionInbox.pendingForSession({
+      athenaSessionId,
+      limit: 25
+    });
+    for (const row of rows) {
+      try {
+        runtime.sendDecision(row.requestId, row.decision);
+        dashboardDecisionInbox.markConsumed({ id: row.id });
+      } catch (error) {
+        output.warn(
+          `dashboard decision failed: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  };
   const linkedAdapterSessions = /* @__PURE__ */ new Set();
+  function publishFeedEvents(feedEvents) {
+    if (feedEvents.length === 0) return;
+    dashboardFeedPublisher.publish({
+      origin: dashboardOrigin,
+      athenaSessionId,
+      feedEvents
+    });
+  }
   const unsubscribeEvent = runtime.onEvent((runtimeEvent) => {
     adapterSessionId = runtimeEvent.sessionId;
     if (runtimeEvent.sessionId && activeRunId && !linkedAdapterSessions.has(runtimeEvent.sessionId)) {
@@ -11299,6 +11584,7 @@ async function runExec(options) {
         mappedFinalMessage = event.data.message;
       }
     }
+    publishFeedEvents(feedEvents);
   });
   const unsubscribeDecision = runtime.onDecision(
     (eventId, decision) => {
@@ -11306,14 +11592,18 @@ async function runExec(options) {
         eventId,
         decision
       });
-      ingestRuntimeDecision(eventId, decision, {
+      const feedEvent = ingestRuntimeDecision(eventId, decision, {
         mapper,
         store,
         onPersistFailure: (message) => output.warn(message)
       });
+      if (feedEvent) {
+        publishFeedEvents([feedEvent]);
+      }
     }
   );
   let timeoutTimer;
+  let dashboardDecisionTimer;
   if (typeof options.timeoutMs === "number" && options.timeoutMs > 0) {
     timeoutTimer = setTimeout(() => {
       latch.register({
@@ -11333,6 +11623,14 @@ async function runExec(options) {
     output.emitJsonEvent("runtime.started", {
       status: runtime.getStatus()
     });
+    if (dashboardDecisionInbox) {
+      applyPendingDashboardDecisions();
+      dashboardDecisionTimer = setInterval(
+        applyPendingDashboardDecisions,
+        options.dashboardDecisionPollIntervalMs ?? 1e3
+      );
+      dashboardDecisionTimer.unref();
+    }
     const workflow = options.workflow;
     output.emitJsonEvent("run.started", {
       workflow: workflow?.name ?? null,
@@ -11418,6 +11716,9 @@ async function runExec(options) {
     if (timeoutTimer) {
       clearTimeout(timeoutTimer);
     }
+    if (dashboardDecisionTimer) {
+      clearInterval(dashboardDecisionTimer);
+    }
     await sessionController.kill();
     unsubscribeEvent();
     unsubscribeDecision();
@@ -11480,254 +11781,92 @@ async function runExec(options) {
   return result;
 }
 
-// src/app/dashboard/instanceSocketClient.ts
+// src/app/bootstrap/harnessOverride.ts
+function normalizeHarnessOverride(value) {
+  switch (value) {
+    case "claude":
+    case "claude-code":
+      return "claude-code";
+    case "codex":
+    case "openai-codex":
+      return "openai-codex";
+    case "opencode":
+      return "opencode";
+    default:
+      return void 0;
+  }
+}
+
+// src/app/dashboard/runStreamClient.ts
 import { WebSocket as WebSocket2 } from "ws";
+var DEFAULT_RECONNECT_DELAYS_MS = [250, 1e3, 2e3, 5e3, 15e3];
 var DEFAULT_HEARTBEAT_MS = 3e4;
-var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
-function instanceSocketUrl(dashboardUrl, instanceId) {
-  const url = new URL(dashboardUrl);
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  url.pathname = `/api/instances/${encodeURIComponent(instanceId)}/socket`;
-  url.search = "";
-  url.hash = "";
-  return url.toString();
-}
-function createInstanceSocketClient(opts) {
-  const heartbeatMs = opts.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_MS;
-  const connectTimeoutMs = opts.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+var DEFAULT_WATCHDOG_MS = 9e4;
+var DEFAULT_MAX_QUEUE_SIZE = 5e3;
+function createRunStreamClient(opts) {
   const log = opts.log ?? (() => {
   });
   const now = opts.now ?? (() => Date.now());
-  const makeWebSocket = opts.makeWebSocket ?? ((url, accessToken) => new WebSocket2(url, [accessToken]));
-  const frameHandlers = /* @__PURE__ */ new Set();
-  const closeHandlers = /* @__PURE__ */ new Set();
+  const reconnectDelays = opts.reconnectDelaysMs ?? DEFAULT_RECONNECT_DELAYS_MS;
+  const heartbeatMs = opts.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_MS;
+  const watchdogMs = opts.watchdogTimeoutMs ?? DEFAULT_WATCHDOG_MS;
+  const maxQueueSize = opts.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE;
+  const makeWebSocket = opts.makeWebSocket ?? ((url) => new WebSocket2(url));
+  const setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+  const clearTimer = opts.clearTimer ?? ((t) => clearTimeout(t));
+  let nextSeq = 1;
+  const queue = [];
   let ws = null;
-  let heartbeat = null;
-  let droppedSinceClose = 0;
-  function send(frame) {
-    if (!ws || ws.readyState !== ws.OPEN) {
-      droppedSinceClose += 1;
-      if (droppedSinceClose === 1) {
-        log(
-          "warn",
-          `instance socket dropped frame (socket not open): type=${frame.type}`
-        );
-      }
-      return;
-    }
-    droppedSinceClose = 0;
-    try {
-      ws.send(JSON.stringify(frame));
-    } catch (err) {
-      log(
-        "warn",
-        `instance socket send failed: ${err instanceof Error ? err.message : String(err)}`
-      );
+  let connectAttempt = 0;
+  let stopped = false;
+  let serverTerminated = false;
+  let heartbeatTimer = null;
+  let watchdogTimer = null;
+  let reconnectTimer = null;
+  let resumeResolved = false;
+  let firstConnect = null;
+  const terminationWaiters = [];
+  function trimQueueUpTo(lastAckedSeq) {
+    while (queue.length > 0 && queue[0].seq <= lastAckedSeq) {
+      queue.shift();
     }
   }
-  function startHeartbeat() {
-    stopHeartbeat();
-    const interval = setInterval(() => {
-      send({ type: "ping", ts: now() });
-    }, heartbeatMs);
-    interval.unref();
-    heartbeat = interval;
-  }
-  function stopHeartbeat() {
-    if (heartbeat) {
-      clearInterval(heartbeat);
-      heartbeat = null;
-    }
-  }
-  function emitClose(reason) {
-    stopHeartbeat();
-    for (const handler of [...closeHandlers]) {
-      try {
-        handler(reason);
-      } catch {
-      }
+  function trimQueueUpToExclusive(expectedSeq) {
+    while (queue.length > 0 && queue[0].seq < expectedSeq) {
+      queue.shift();
     }
   }
-  function handleFrame(parsed) {
-    if (parsed.type === "job_assignment") {
-      send({ type: "assignment_accepted", runId: parsed.runId });
-      log("info", `instance socket: assignment accepted runId=${parsed.runId}`);
+  function clearTimers() {
+    if (heartbeatTimer) {
+      clearTimer(heartbeatTimer);
+      heartbeatTimer = null;
+    }
+    if (watchdogTimer) {
+      clearTimer(watchdogTimer);
+      watchdogTimer = null;
+    }
+    if (reconnectTimer) {
+      clearTimer(reconnectTimer);
+      reconnectTimer = null;
     }
-    for (const handler of [...frameHandlers]) {
+  }
+  function startHeartbeat() {
+    if (heartbeatMs <= 0) return;
+    const tick = () => {
+      if (!ws || ws.readyState !== ws.OPEN) return;
       try {
-        handler(parsed);
+        ws.send(JSON.stringify({ type: "ping", ts: now() }));
       } catch (err) {
         log(
           "warn",
-          `instance socket frame handler threw: ${err instanceof Error ? err.message : String(err)}`
+          `run-stream ping failed: ${err instanceof Error ? err.message : String(err)}`
         );
       }
-    }
-  }
-  async function connect2() {
-    if (ws) throw new Error("instance socket already connected");
-    const url = instanceSocketUrl(opts.dashboardUrl, opts.instanceId);
-    const next = makeWebSocket(url, opts.accessToken);
-    try {
-      await new Promise((resolve, reject) => {
-        let settled = false;
-        const cleanup = () => {
-          next.off("open", onOpen);
-          next.off("error", onError);
-          clearTimeout(timer);
-        };
-        const onOpen = () => {
-          if (settled) return;
-          settled = true;
-          cleanup();
-          resolve();
-        };
-        const onError = (err) => {
-          if (settled) return;
-          settled = true;
-          cleanup();
-          reject(new Error(`instance socket connect failed: ${err.message}`));
-        };
-        const timer = setTimeout(() => {
-          if (settled) return;
-          settled = true;
-          cleanup();
-          reject(
-            new Error(
-              `instance socket connect failed: timed out after ${connectTimeoutMs}ms`
-            )
-          );
-        }, connectTimeoutMs);
-        next.once("open", onOpen);
-        next.once("error", onError);
-      });
-    } catch (err) {
-      next.on("error", () => {
-      });
-      try {
-        next.terminate();
-      } catch {
-      }
-      throw err;
-    }
-    ws = next;
-    startHeartbeat();
-    next.on("message", (data) => {
-      let parsed;
-      try {
-        parsed = JSON.parse(String(data));
-      } catch (err) {
-        log(
-          "warn",
-          `instance socket frame parse failed: ${err instanceof Error ? err.message : String(err)}`
-        );
-        return;
-      }
-      handleFrame(parsed);
-    });
-    next.on("close", (_code, reasonBuf) => {
-      if (next !== ws) return;
-      ws = null;
-      const reason = reasonBuf.toString() || "closed";
-      emitClose(reason);
-    });
-    next.on("error", (err) => {
-      log("warn", `instance socket error: ${err.message}`);
-    });
-  }
-  function close(reason) {
-    stopHeartbeat();
-    if (ws) {
-      try {
-        ws.close(1e3, reason ?? "client closed");
-      } catch {
-        ws.terminate();
-      }
-    }
-    ws = null;
-  }
-  function onFrame(handler) {
-    frameHandlers.add(handler);
-  }
-  function onClose(handler) {
-    closeHandlers.add(handler);
-  }
-  function sendRunEvent(event) {
-    send({ type: "run_event", ...event });
-  }
-  return { connect: connect2, close, onFrame, onClose, sendRunEvent };
-}
-
-// src/app/dashboard/runStreamClient.ts
-import { WebSocket as WebSocket3 } from "ws";
-var DEFAULT_RECONNECT_DELAYS_MS = [250, 1e3, 2e3, 5e3, 15e3];
-var DEFAULT_HEARTBEAT_MS2 = 3e4;
-var DEFAULT_WATCHDOG_MS = 9e4;
-var DEFAULT_MAX_QUEUE_SIZE = 5e3;
-function createRunStreamClient(opts) {
-  const log = opts.log ?? (() => {
-  });
-  const now = opts.now ?? (() => Date.now());
-  const reconnectDelays = opts.reconnectDelaysMs ?? DEFAULT_RECONNECT_DELAYS_MS;
-  const heartbeatMs = opts.heartbeatIntervalMs ?? DEFAULT_HEARTBEAT_MS2;
-  const watchdogMs = opts.watchdogTimeoutMs ?? DEFAULT_WATCHDOG_MS;
-  const maxQueueSize = opts.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE;
-  const makeWebSocket = opts.makeWebSocket ?? ((url) => new WebSocket3(url));
-  const setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
-  const clearTimer = opts.clearTimer ?? ((t) => clearTimeout(t));
-  let nextSeq = 1;
-  const queue = [];
-  let ws = null;
-  let connectAttempt = 0;
-  let stopped = false;
-  let serverTerminated = false;
-  let heartbeatTimer = null;
-  let watchdogTimer = null;
-  let reconnectTimer = null;
-  let resumeResolved = false;
-  let firstConnect = null;
-  const terminationWaiters = [];
-  function trimQueueUpTo(lastAckedSeq) {
-    while (queue.length > 0 && queue[0].seq <= lastAckedSeq) {
-      queue.shift();
-    }
-  }
-  function trimQueueUpToExclusive(expectedSeq) {
-    while (queue.length > 0 && queue[0].seq < expectedSeq) {
-      queue.shift();
-    }
-  }
-  function clearTimers() {
-    if (heartbeatTimer) {
-      clearTimer(heartbeatTimer);
-      heartbeatTimer = null;
-    }
-    if (watchdogTimer) {
-      clearTimer(watchdogTimer);
-      watchdogTimer = null;
-    }
-    if (reconnectTimer) {
-      clearTimer(reconnectTimer);
-      reconnectTimer = null;
-    }
-  }
-  function startHeartbeat() {
-    if (heartbeatMs <= 0) return;
-    const tick = () => {
-      if (!ws || ws.readyState !== ws.OPEN) return;
-      try {
-        ws.send(JSON.stringify({ type: "ping", ts: now() }));
-      } catch (err) {
-        log(
-          "warn",
-          `run-stream ping failed: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-      heartbeatTimer = setTimer(tick, heartbeatMs);
-      heartbeatTimer.unref?.();
-    };
-    heartbeatTimer = setTimer(tick, heartbeatMs);
-    heartbeatTimer.unref?.();
+      heartbeatTimer = setTimer(tick, heartbeatMs);
+      heartbeatTimer.unref();
+    };
+    heartbeatTimer = setTimer(tick, heartbeatMs);
+    heartbeatTimer.unref();
   }
   function bumpWatchdog() {
     if (watchdogMs <= 0) return;
@@ -11742,7 +11881,7 @@ function createRunStreamClient(opts) {
       } catch {
       }
     }, watchdogMs);
-    watchdogTimer.unref?.();
+    watchdogTimer.unref();
   }
   function flushQueue() {
     if (!ws || ws.readyState !== ws.OPEN || !resumeResolved) return;
@@ -11829,7 +11968,7 @@ function createRunStreamClient(opts) {
       reconnectTimer = null;
       void openSocket();
     }, delayMs);
-    reconnectTimer.unref?.();
+    reconnectTimer.unref();
   }
   async function openSocket() {
     if (stopped || serverTerminated) return;
@@ -11855,7 +11994,7 @@ function createRunStreamClient(opts) {
       if (next !== ws) return;
       ws = null;
       clearTimers();
-      const reason = reasonBuf?.toString?.() || "closed";
+      const reason = reasonBuf.toString() || "closed";
       if (code === 1e3 && reason === "run_terminated") {
         notifyTerminated();
         return;
@@ -11940,6 +12079,7 @@ function createRunStreamClient(opts) {
 }
 
 // src/app/dashboard/remoteRunExecutor.ts
+var DEFAULT_MARKETPLACE_SLUG = "lespaceman/athena-workflow-marketplace";
 function parseRunSpec(value) {
   if (typeof value !== "object" || value === null) return null;
   const obj = value;
@@ -11949,11 +12089,19 @@ function parseRunSpec(value) {
   const workflow = obj["workflow"];
   const callbackWsUrl = obj["callbackWsUrl"];
   const callbackToken = obj["callbackToken"];
+  const workflowObj = typeof workflow === "object" && workflow !== null ? workflow : null;
   return {
     prompt,
+    athenaSessionId: typeof obj["athenaSessionId"] === "string" && obj["athenaSessionId"].length > 0 ? obj["athenaSessionId"] : void 0,
+    adapterResumeSessionId: typeof obj["adapterResumeSessionId"] === "string" && obj["adapterResumeSessionId"].length > 0 ? obj["adapterResumeSessionId"] : void 0,
     sessionId: typeof obj["sessionId"] === "string" && obj["sessionId"].length > 0 ? obj["sessionId"] : void 0,
     projectDir: typeof obj["projectDir"] === "string" && obj["projectDir"].length > 0 ? obj["projectDir"] : void 0,
-    workflow: typeof workflow === "object" && workflow !== null && typeof workflow["ref"] === "string" ? { ref: workflow["ref"] } : void 0,
+    workflow: workflowObj && typeof workflowObj["ref"] === "string" ? {
+      ref: workflowObj["ref"],
+      ...typeof workflowObj["source"] === "string" ? { source: workflowObj["source"] } : {},
+      ...typeof workflowObj["version"] === "string" ? { version: workflowObj["version"] } : {}
+    } : void 0,
+    harness: normalizeHarnessOverride(obj["harness"]),
     env: typeof env === "object" && env !== null ? Object.fromEntries(
       Object.entries(env).filter(
         (entry) => typeof entry[1] === "string"
@@ -11969,6 +12117,47 @@ function workflowNameFromRef(ref) {
   const [name] = ref.split("@", 1);
   return name && name.length > 0 ? name : void 0;
 }
+function isMissingWorkflowError(err, workflowName) {
+  return err instanceof Error && err.message.includes(`Workflow "${workflowName}" not found`);
+}
+function configuredWorkflowSources(readGlobalConfigFn) {
+  const sources = readGlobalConfigFn().workflowMarketplaceSources;
+  return sources && sources.length > 0 ? sources : [DEFAULT_MARKETPLACE_SLUG];
+}
+function workflowInstallRef(spec) {
+  const ref = spec.workflow?.ref;
+  if (!ref) return void 0;
+  const version = spec.workflow?.version;
+  if (version && !ref.includes("@")) {
+    return `${ref}@${version}`;
+  }
+  return ref;
+}
+function workflowInstallSources(spec, readGlobalConfigFn) {
+  const source = spec.workflow?.source?.trim();
+  if (source && source !== "marketplace") {
+    return [source];
+  }
+  return configuredWorkflowSources(readGlobalConfigFn);
+}
+function ensureRemoteWorkflowInstalled(input) {
+  const ref = workflowInstallRef(input.spec);
+  const workflowName = workflowNameFromRef(ref);
+  if (!workflowName) return void 0;
+  try {
+    input.resolveWorkflowFn(workflowName);
+    return workflowName;
+  } catch (err) {
+    if (!isMissingWorkflowError(err, workflowName)) {
+      throw err;
+    }
+  }
+  const resolved = input.resolveWorkflowInstallFn(
+    ref,
+    workflowInstallSources(input.spec, input.readGlobalConfigFn)
+  );
+  return input.installWorkflowFromSourceFn(resolved);
+}
 function eventKind(event) {
   if (event.type === "exec.completed") {
     const data = event.data;
@@ -11988,22 +12177,18 @@ function eventPayload(event) {
   }
   return event.data ?? null;
 }
-function withEnv(env, fn) {
-  if (!env || Object.keys(env).length === 0) return fn();
-  const previous = /* @__PURE__ */ new Map();
-  for (const [key, value] of Object.entries(env)) {
-    previous.set(key, process.env[key]);
-    process.env[key] = value;
-  }
-  return fn().finally(() => {
-    for (const [key, value] of previous) {
-      if (value === void 0) {
-        delete process.env[key];
-      } else {
-        process.env[key] = value;
-      }
-    }
-  });
+function mergeRunSpecEnvIntoWorkflow(workflow, env) {
+  if (!env || Object.keys(env).length === 0) return workflow;
+  const mergedEnv = { ...workflow?.env ?? {}, ...env };
+  if (workflow) {
+    return { ...workflow, env: mergedEnv };
+  }
+  return {
+    name: "dashboard-remote",
+    plugins: [],
+    promptTemplate: "{input}",
+    env: mergedEnv
+  };
 }
 async function executeRemoteAssignment({
   frame,
@@ -12012,14 +12197,21 @@ async function executeRemoteAssignment({
   log = () => {
   },
   runExecFn = runExec,
+  decisionInbox,
   bootstrapRuntimeConfigFn = bootstrapRuntimeConfig,
   now = Date.now,
   abortSignal,
   createRunStreamClientFn = createRunStreamClient,
+  resolveWorkflowFn = resolveWorkflow,
+  resolveWorkflowInstallFn = resolveWorkflowInstall,
+  installWorkflowFromSourceFn = installWorkflowFromSource,
+  readGlobalConfigFn = readGlobalConfig,
   runStreamConnectTimeoutMs = 5e3
 }) {
-  let lastTerminalFailureMessage = null;
-  let deferredFailedCompletion = null;
+  const lastTerminalFailureMessage = { current: null };
+  const deferredFailedCompletion = {
+    current: null
+  };
   const spec = parseRunSpec(frame.runSpec);
   let runStream = null;
   if (spec?.callbackWsUrl && spec.callbackToken) {
@@ -12031,7 +12223,7 @@ async function executeRemoteAssignment({
     });
     const timeoutPromise = new Promise((resolve) => {
       const t = setTimeout(() => resolve("timeout"), runStreamConnectTimeoutMs);
-      t.unref?.();
+      t.unref();
     });
     try {
       const result = await Promise.race([
@@ -12057,7 +12249,7 @@ async function executeRemoteAssignment({
   let legacySeq = 0;
   const send = (kind, payload, ts = now()) => {
     if (kind === "error" && typeof payload === "object" && payload !== null && typeof payload.message === "string") {
-      lastTerminalFailureMessage = payload.message;
+      lastTerminalFailureMessage.current = payload.message;
     }
     if (runStream) {
       runStream.sendEvent({ ts, kind, payload });
@@ -12081,11 +12273,19 @@ async function executeRemoteAssignment({
     const projectDir = spec.projectDir ?? fallbackProjectDir;
     let runtimeConfig;
     try {
+      const workflowOverride = ensureRemoteWorkflowInstalled({
+        spec,
+        resolveWorkflowFn,
+        resolveWorkflowInstallFn,
+        installWorkflowFromSourceFn,
+        readGlobalConfigFn
+      });
       runtimeConfig = bootstrapRuntimeConfigFn({
         projectDir,
         showSetup: false,
         isolationPreset: "minimal",
-        workflowOverride: workflowNameFromRef(spec.workflow?.ref)
+        harnessOverride: spec.harness,
+        workflowOverride
       });
     } catch (err) {
       send("error", {
@@ -12109,7 +12309,7 @@ async function executeRemoteAssignment({
               const event = JSON.parse(line);
               const data = event.data;
               if (event.type === "exec.completed" && data?.success === false) {
-                deferredFailedCompletion = event;
+                deferredFailedCompletion.current = event;
                 continue;
               }
               send(eventKind(event), eventPayload(event), now());
@@ -12134,45 +12334,37 @@ async function executeRemoteAssignment({
       }
     };
     try {
-      await withEnv(spec.env, async () => {
-        const result = await runExecFn({
-          prompt: spec.prompt,
-          projectDir,
-          harness: runtimeConfig.harness,
-          athenaSessionId: spec.sessionId ?? `athena-${frame.runId}`,
-          isolationConfig: runtimeConfig.isolationConfig,
-          pluginMcpConfig: runtimeConfig.pluginMcpConfig,
-          workflow: runtimeConfig.workflow,
-          workflowPlan: runtimeConfig.workflowPlan,
-          json: true,
-          verbose: false,
-          ephemeral: false,
-          timeoutMs: spec.timeoutSec ? spec.timeoutSec * 1e3 : void 0,
-          signal: abortSignal,
-          stdout,
-          stderr
-        });
-        if (deferredFailedCompletion) {
-          const data = typeof deferredFailedCompletion.data === "object" && deferredFailedCompletion.data !== null ? deferredFailedCompletion.data : {};
-          send(
-            "error",
-            {
-              ...data,
-              success: result.success,
-              exitCode: result.exitCode,
-              athenaSessionId: result.athenaSessionId,
-              adapterSessionId: result.adapterSessionId,
-              finalMessage: result.finalMessage,
-              tokens: result.tokens,
-              durationMs: result.durationMs,
-              message: result.failure?.message ?? eventPayload(deferredFailedCompletion).message ?? "remote execution failed"
-            },
-            typeof deferredFailedCompletion.ts === "number" ? deferredFailedCompletion.ts : now()
-          );
-          return;
-        }
-        if (result.failure && result.failure.message !== lastTerminalFailureMessage) {
-          send("error", {
+      const workflow = mergeRunSpecEnvIntoWorkflow(
+        runtimeConfig.workflow,
+        spec.env
+      );
+      const result = await runExecFn({
+        prompt: spec.prompt,
+        projectDir,
+        harness: runtimeConfig.harness,
+        athenaSessionId: spec.athenaSessionId ?? spec.sessionId ?? `athena-${frame.runId}`,
+        adapterResumeSessionId: spec.adapterResumeSessionId,
+        isolationConfig: runtimeConfig.isolationConfig,
+        pluginMcpConfig: runtimeConfig.pluginMcpConfig,
+        workflow,
+        workflowPlan: runtimeConfig.workflowPlan,
+        dashboardOrigin: "dashboard",
+        json: true,
+        verbose: false,
+        ephemeral: false,
+        timeoutMs: spec.timeoutSec ? spec.timeoutSec * 1e3 : void 0,
+        signal: abortSignal,
+        stdout,
+        stderr,
+        ...decisionInbox ? { dashboardDecisionInbox: decisionInbox } : {}
+      });
+      const failedCompletion = deferredFailedCompletion.current;
+      if (failedCompletion) {
+        const data = typeof failedCompletion.data === "object" && failedCompletion.data !== null ? failedCompletion.data : {};
+        send(
+          "error",
+          {
+            ...data,
             success: result.success,
             exitCode: result.exitCode,
             athenaSessionId: result.athenaSessionId,
@@ -12180,10 +12372,24 @@ async function executeRemoteAssignment({
             finalMessage: result.finalMessage,
             tokens: result.tokens,
             durationMs: result.durationMs,
-            message: result.failure.message
-          });
-        }
-      });
+            message: result.failure?.message ?? eventPayload(failedCompletion).message ?? "remote execution failed"
+          },
+          typeof failedCompletion.ts === "number" ? failedCompletion.ts : now()
+        );
+        return;
+      }
+      if (result.failure && result.failure.message !== lastTerminalFailureMessage.current) {
+        send("error", {
+          success: result.success,
+          exitCode: result.exitCode,
+          athenaSessionId: result.athenaSessionId,
+          adapterSessionId: result.adapterSessionId,
+          finalMessage: result.finalMessage,
+          tokens: result.tokens,
+          durationMs: result.durationMs,
+          message: result.failure.message
+        });
+      }
     } catch (err) {
       send("error", {
         message: err instanceof Error ? err.message : String(err)
@@ -12193,7 +12399,7 @@ async function executeRemoteAssignment({
     if (runStream) {
       const drainTimeout = new Promise((resolve) => {
         const t = setTimeout(() => resolve(), 1e4);
-        t.unref?.();
+        t.unref();
       });
       await Promise.race([runStream.whenTerminated(), drainTimeout]);
       await runStream.close("done");
@@ -12201,131 +12407,304 @@ async function executeRemoteAssignment({
   }
 }
 
-// src/infra/config/attachmentMirror.ts
-import crypto3 from "crypto";
-import fs20 from "fs";
-import os11 from "os";
-import path18 from "path";
-function attachmentMirrorPath(env = process.env) {
-  const home = env["HOME"] ?? os11.homedir();
-  return path18.join(home, ".config", "athena", "attachments.json");
+// src/app/dashboard/dashboardDecisionInbox.ts
+import Database4 from "better-sqlite3";
+function dashboardDecisionInboxPath() {
+  return `${ensureDaemonStateDir().dir}/dashboard-decision-inbox.db`;
 }
-function readAttachmentMirror(env = process.env) {
-  const file = attachmentMirrorPath(env);
-  let raw;
-  try {
-    raw = fs20.readFileSync(file, "utf-8");
-  } catch (err) {
-    if (err.code === "ENOENT") return null;
-    throw err;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(
-      `attachment mirror ${file} is invalid JSON: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  try {
-    return parseAttachmentMirror(parsed);
-  } catch (err) {
-    throw new Error(
-      `attachment mirror ${file} is invalid: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
+function hasLegacyUniqueConstraint(db) {
+  const rows = db.prepare(`PRAGMA index_list('dashboard_decision_inbox')`).all();
+  return rows.some((row) => row.unique === 1 && row.origin === "u");
 }
-function writeAttachmentMirror(mirror, env = process.env) {
-  const validated = parseAttachmentMirror(mirror);
-  const file = attachmentMirrorPath(env);
-  const dir = path18.dirname(file);
-  fs20.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${file}.${process.pid}.${crypto3.randomBytes(4).toString("hex")}.tmp`;
-  const fd = fs20.openSync(tmp, "w", 384);
-  try {
-    fs20.writeSync(fd, JSON.stringify(validated, null, 2) + "\n");
-    fs20.fsyncSync(fd);
-  } finally {
-    fs20.closeSync(fd);
-  }
-  try {
-    fs20.renameSync(tmp, file);
-  } catch (err) {
-    try {
-      fs20.unlinkSync(tmp);
-    } catch {
+function migrateLegacyUniqueConstraint(db) {
+  if (!hasLegacyUniqueConstraint(db)) return;
+  db.exec(`
+		ALTER TABLE dashboard_decision_inbox
+			RENAME TO dashboard_decision_inbox_legacy;
+
+		CREATE TABLE dashboard_decision_inbox (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			athena_session_id TEXT NOT NULL,
+			request_id TEXT NOT NULL,
+			decision_json TEXT NOT NULL,
+			received_at INTEGER NOT NULL,
+			consumed_at INTEGER
+		);
+
+		INSERT INTO dashboard_decision_inbox (
+			id,
+			athena_session_id,
+			request_id,
+			decision_json,
+			received_at,
+			consumed_at
+		)
+		SELECT
+			id,
+			athena_session_id,
+			request_id,
+			decision_json,
+			received_at,
+			consumed_at
+		FROM dashboard_decision_inbox_legacy;
+
+		DROP TABLE dashboard_decision_inbox_legacy;
+	`);
+}
+function initInboxSchema(db) {
+  db.exec(`
+		PRAGMA journal_mode = WAL;
+
+		CREATE TABLE IF NOT EXISTS dashboard_decision_inbox (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			athena_session_id TEXT NOT NULL,
+			request_id TEXT NOT NULL,
+			decision_json TEXT NOT NULL,
+			received_at INTEGER NOT NULL,
+			consumed_at INTEGER
+		);
+	`);
+  migrateLegacyUniqueConstraint(db);
+  db.exec(`
+
+		CREATE UNIQUE INDEX IF NOT EXISTS idx_dashboard_decision_unconsumed
+			ON dashboard_decision_inbox(athena_session_id, request_id)
+			WHERE consumed_at IS NULL;
+
+		CREATE INDEX IF NOT EXISTS idx_dashboard_decision_pending
+			ON dashboard_decision_inbox(athena_session_id, consumed_at, id);
+	`);
+}
+function createDashboardDecisionInbox(options = {}) {
+  const db = new Database4(options.dbPath ?? dashboardDecisionInboxPath());
+  initInboxSchema(db);
+  const upsertUnconsumed = db.prepare(`
+		INSERT INTO dashboard_decision_inbox (
+			athena_session_id,
+			request_id,
+			decision_json,
+			received_at
+		)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT(athena_session_id, request_id) WHERE consumed_at IS NULL
+		DO UPDATE SET
+			decision_json = excluded.decision_json,
+			received_at = excluded.received_at
+	`);
+  const selectPending = db.prepare(`
+		SELECT id, athena_session_id, request_id, decision_json, received_at
+		FROM dashboard_decision_inbox
+		WHERE athena_session_id = ? AND consumed_at IS NULL
+		ORDER BY id ASC
+		LIMIT ?
+	`);
+  const consume = db.prepare(`
+		UPDATE dashboard_decision_inbox
+		SET consumed_at = ?
+		WHERE id = ?
+	`);
+  return {
+    enqueue(input) {
+      upsertUnconsumed.run(
+        input.athenaSessionId,
+        input.requestId,
+        JSON.stringify(input.decision),
+        input.receivedAt
+      );
+    },
+    pendingForSession(input) {
+      const rows = selectPending.all(
+        input.athenaSessionId,
+        input.limit
+      );
+      return rows.map((row) => ({
+        id: row.id,
+        athenaSessionId: row.athena_session_id,
+        requestId: row.request_id,
+        decision: JSON.parse(row.decision_json),
+        receivedAt: row.received_at
+      }));
+    },
+    markConsumed(input) {
+      consume.run(Date.now(), input.id);
+    },
+    close() {
+      db.close();
+    }
+  };
+}
+
+// src/app/dashboard/dashboardPairedExecution.ts
+var DEFAULT_MAX_CONCURRENT_RUNS = 1;
+var DEFAULT_RUN_HISTORY_LIMIT = 100;
+function createDashboardPairedExecution(options) {
+  const client = options.client;
+  const executor = options.executor;
+  const projectDir = options.projectDir;
+  const decisionInbox = options.decisionInbox;
+  const log = options.log ?? (() => {
+  });
+  const maxConcurrentRuns = options.maxConcurrentRuns ?? DEFAULT_MAX_CONCURRENT_RUNS;
+  const runHistoryLimit = options.runHistoryLimit ?? DEFAULT_RUN_HISTORY_LIMIT;
+  const now = options.now ?? (() => Date.now());
+  let completedRuns = 0;
+  const active = /* @__PURE__ */ new Map();
+  const activeByRunner = /* @__PURE__ */ new Map();
+  const runHistory = [];
+  function recordRun(record) {
+    runHistory.push(record);
+    while (runHistory.length > runHistoryLimit) {
+      runHistory.shift();
     }
-    throw err;
   }
-  if (process.platform !== "win32") {
+  function rejectAssignment(runId, reason) {
     try {
-      fs20.chmodSync(dir, 448);
-      fs20.chmodSync(file, 384);
-    } catch {
+      client.sendRunEvent({
+        runId,
+        seq: 0,
+        ts: now(),
+        kind: "rejected",
+        payload: { reason }
+      });
+    } catch (err) {
+      log(
+        "warn",
+        `runtime daemon: failed to send rejected for ${runId}: ${err instanceof Error ? err.message : String(err)}`
+      );
     }
+    recordRun({
+      runId,
+      startedAt: now(),
+      endedAt: now(),
+      status: "rejected",
+      error: reason
+    });
+    log("warn", `run ${runId} rejected: ${reason}`);
   }
-}
-function removeAttachmentMirror(env = process.env) {
-  const file = attachmentMirrorPath(env);
-  try {
-    fs20.unlinkSync(file);
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-  }
-}
-function parseAttachmentMirror(raw) {
-  if (typeof raw !== "object" || raw === null) {
-    throw new Error("root must be an object");
-  }
-  const obj = raw;
-  if (typeof obj["instanceId"] !== "string" || obj["instanceId"].length === 0) {
-    throw new Error("instanceId must be a non-empty string");
-  }
-  if (typeof obj["fetchedAt"] !== "number") {
-    throw new Error("fetchedAt must be a number");
-  }
-  if (!Array.isArray(obj["attachments"])) {
-    throw new Error("attachments must be an array");
+  function handleDecision(frame) {
+    decisionInbox.enqueue({
+      athenaSessionId: frame.athenaSessionId,
+      requestId: frame.requestId,
+      decision: frame.decision,
+      receivedAt: now()
+    });
   }
-  const attachments = obj["attachments"].map((entry, idx) => {
-    if (typeof entry !== "object" || entry === null) {
-      throw new Error(`attachments[${idx}] must be an object`);
-    }
-    const e = entry;
-    if (typeof e["runnerId"] !== "string" || e["runnerId"].length === 0) {
-      throw new Error(
-        `attachments[${idx}].runnerId must be a non-empty string`
+  function handleCancel(frame) {
+    const entry = active.get(frame.runId);
+    if (!entry) return;
+    entry.record.status = "cancelled";
+    entry.controller.abort();
+  }
+  function handleAssignment(frame) {
+    if (active.has(frame.runId)) {
+      rejectAssignment(
+        frame.runId,
+        `duplicate active assignment ${frame.runId}`
       );
+      return;
     }
-    const out = { runnerId: e["runnerId"] };
-    if (typeof e["name"] === "string") out.name = e["name"];
-    if (typeof e["executionTarget"] === "string") {
-      out.executionTarget = e["executionTarget"];
-    }
-    if (typeof e["remoteInstanceId"] === "string") {
-      out.remoteInstanceId = e["remoteInstanceId"];
+    const runnerKey = frame.runnerId;
+    const bucket = activeByRunner.get(runnerKey) ?? /* @__PURE__ */ new Set();
+    if (bucket.size >= maxConcurrentRuns) {
+      rejectAssignment(
+        frame.runId,
+        `runtime daemon at concurrency cap (${maxConcurrentRuns}) for runner ${runnerKey ?? "<legacy>"}`
+      );
+      return;
     }
-    return out;
-  });
+    const controller = new AbortController();
+    const record = {
+      runId: frame.runId,
+      startedAt: now(),
+      status: "running"
+    };
+    recordRun(record);
+    bucket.add(frame.runId);
+    activeByRunner.set(runnerKey, bucket);
+    const promise = executor({
+      frame,
+      client,
+      projectDir,
+      log,
+      abortSignal: controller.signal,
+      decisionInbox
+    }).then(() => {
+      if (record.status === "running") record.status = "completed";
+    }).catch((err) => {
+      if (record.status === "running") {
+        record.status = "failed";
+      }
+      record.error = err instanceof Error ? err.message : String(err);
+      log(
+        "error",
+        `run ${frame.runId} failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }).finally(() => {
+      record.endedAt = now();
+      completedRuns += 1;
+      active.delete(frame.runId);
+      const remaining = activeByRunner.get(runnerKey);
+      if (remaining) {
+        remaining.delete(frame.runId);
+        if (remaining.size === 0) activeByRunner.delete(runnerKey);
+      }
+    });
+    active.set(frame.runId, { controller, promise, record, runnerKey });
+  }
   return {
-    instanceId: obj["instanceId"],
-    fetchedAt: obj["fetchedAt"],
-    attachments
+    handleFrame(frame) {
+      if (frame.type === "dashboard_decision") {
+        handleDecision(frame);
+        return true;
+      }
+      if (frame.type === "cancel") {
+        handleCancel(frame);
+        return true;
+      }
+      if (frame.type === "job_assignment") {
+        handleAssignment(frame);
+        return true;
+      }
+      return false;
+    },
+    snapshot() {
+      return {
+        activeRuns: active.size,
+        completedRuns
+      };
+    },
+    listRuns(opts = {}) {
+      let out = runHistory.slice();
+      if (typeof opts.limit === "number" && opts.limit > 0) {
+        out = out.slice(-opts.limit);
+      }
+      if (opts.active) {
+        out = out.filter((r) => r.status === "running");
+      }
+      return out;
+    },
+    async stop() {
+      for (const run of active.values()) {
+        run.controller.abort();
+      }
+      await Promise.allSettled([...active.values()].map((run) => run.promise));
+    }
   };
 }
 
 // src/app/dashboard/runtimeDaemon.ts
 var DEFAULT_RECONNECT_DELAYS_MS2 = [1e3, 2e3, 5e3, 1e4, 3e4];
-var DEFAULT_MAX_CONCURRENT_RUNS = 1;
+var DEFAULT_MAX_CONCURRENT_RUNS2 = 1;
 var DEFAULT_REFRESH_LEAD_SEC = 60;
 var DEFAULT_REFRESH_FAILURE_LIMIT = 5;
 var DEFAULT_REFRESH_FAILURE_WINDOW_MS = 5 * 6e4;
 var DEFAULT_REFRESH_COOLDOWN_MS = 5 * 6e4;
-var DEFAULT_RUN_HISTORY_LIMIT = 100;
+var DEFAULT_RUN_HISTORY_LIMIT2 = 100;
+var DEFAULT_FEED_DRAIN_INTERVAL_MS = 1e3;
 function delay(ms) {
   return new Promise((resolve) => {
     const timer = setTimeout(resolve, ms);
-    timer.unref?.();
+    timer.unref();
   });
 }
 async function runDashboardRuntimeDaemon(options = {}) {
@@ -12342,33 +12721,52 @@ async function runDashboardRuntimeDaemon(options = {}) {
   const log = options.log ?? (() => {
   });
   const reconnectDelays = options.reconnectDelaysMs ?? DEFAULT_RECONNECT_DELAYS_MS2;
-  const maxConcurrentRuns = options.maxConcurrentRuns ?? DEFAULT_MAX_CONCURRENT_RUNS;
+  const maxConcurrentRuns = options.maxConcurrentRuns ?? DEFAULT_MAX_CONCURRENT_RUNS2;
   const refreshLeadSec = options.refreshLeadSec ?? DEFAULT_REFRESH_LEAD_SEC;
   const refreshFailureLimit = options.refreshFailureLimit ?? DEFAULT_REFRESH_FAILURE_LIMIT;
   const refreshFailureWindowMs = options.refreshFailureWindowMs ?? DEFAULT_REFRESH_FAILURE_WINDOW_MS;
   const refreshCooldownMs = options.refreshCooldownMs ?? DEFAULT_REFRESH_COOLDOWN_MS;
-  const runHistoryLimit = options.runHistoryLimit ?? DEFAULT_RUN_HISTORY_LIMIT;
+  const runHistoryLimit = options.runHistoryLimit ?? DEFAULT_RUN_HISTORY_LIMIT2;
   const now = options.now ?? (() => Date.now());
   const writeMirror = options.writeMirror ?? writeAttachmentMirror;
+  const feedOutbox = options.feedOutbox ?? createDashboardFeedOutbox();
+  const decisionInbox = options.decisionInbox ?? createDashboardDecisionInbox();
+  const feedDrainIntervalMs = options.feedDrainIntervalMs ?? DEFAULT_FEED_DRAIN_INTERVAL_MS;
   const startedAt = now();
   let stopped = false;
   let reconnectAttempt = 0;
   let client = null;
+  let lastSocketClient = null;
   let currentInstanceId;
   let currentDashboardUrl;
   let lastFrameAt;
-  let completedRuns = 0;
   let refreshTimer = null;
+  let feedDrainTimer = null;
   const refreshFailures = [];
   let cooldownUntil = 0;
-  const active = /* @__PURE__ */ new Map();
-  const runHistory = [];
-  function recordRun(record) {
-    runHistory.push(record);
-    while (runHistory.length > runHistoryLimit) {
-      runHistory.shift();
+  const executionClient = {
+    sendRunEvent(event) {
+      const current = client ?? lastSocketClient;
+      if (!current) {
+        log(
+          "warn",
+          `instance socket dropped run_event (socket not connected): runId=${event.runId} kind=${event.kind}`
+        );
+        return;
+      }
+      current.sendRunEvent(event);
     }
-  }
+  };
+  const pairedExecution = createDashboardPairedExecution({
+    client: executionClient,
+    executor,
+    projectDir,
+    decisionInbox,
+    log,
+    maxConcurrentRuns,
+    now,
+    runHistoryLimit
+  });
   function nextReconnectDelay() {
     if (reconnectDelays.length === 0) return 0;
     const delayMs = reconnectDelays[Math.min(reconnectAttempt, reconnectDelays.length - 1)] ?? 0;
@@ -12381,6 +12779,35 @@ async function runDashboardRuntimeDaemon(options = {}) {
       refreshTimer = null;
     }
   }
+  function clearFeedDrainTimer() {
+    if (feedDrainTimer) {
+      clearInterval(feedDrainTimer);
+      feedDrainTimer = null;
+    }
+  }
+  function drainFeedOutbox() {
+    const current = client;
+    if (!current) return;
+    const rows = feedOutbox.pendingBatch({ limit: 100, now: now() });
+    for (const row of rows) {
+      current.sendFeedEvent({
+        deliverySeq: row.deliverySeq,
+        envelope: row.envelope
+      });
+      const retryDelayMs = Math.min(3e4, (row.attempt + 1) * 1e3);
+      feedOutbox.markAttempted({
+        deliverySeq: row.deliverySeq,
+        nextAttemptAt: now() + retryDelayMs
+      });
+    }
+  }
+  function startFeedDrainTimer() {
+    clearFeedDrainTimer();
+    const timer = setInterval(drainFeedOutbox, feedDrainIntervalMs);
+    timer.unref();
+    feedDrainTimer = timer;
+    drainFeedOutbox();
+  }
   function scheduleRefresh(expiresInSec) {
     clearRefreshTimer();
     if (!Number.isFinite(expiresInSec) || expiresInSec <= refreshLeadSec) {
@@ -12390,7 +12817,7 @@ async function runDashboardRuntimeDaemon(options = {}) {
     const timer = setTimeout(() => {
       void proactiveRefresh();
     }, ms);
-    timer.unref?.();
+    timer.unref();
     refreshTimer = timer;
   }
   async function proactiveRefresh() {
@@ -12425,30 +12852,6 @@ async function runDashboardRuntimeDaemon(options = {}) {
       );
     }
   }
-  function rejectAssignment(client_, runId, reason) {
-    try {
-      client_.sendRunEvent({
-        runId,
-        seq: 0,
-        ts: now(),
-        kind: "rejected",
-        payload: { reason }
-      });
-    } catch (err) {
-      log(
-        "warn",
-        `runtime daemon: failed to send rejected for ${runId}: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-    recordRun({
-      runId,
-      startedAt: now(),
-      endedAt: now(),
-      status: "rejected",
-      error: reason
-    });
-    log("warn", `run ${runId} rejected: ${reason}`);
-  }
   async function connectOnce() {
     const config = readConfig2();
     if (!config) {
@@ -12503,54 +12906,14 @@ async function runDashboardRuntimeDaemon(options = {}) {
         }
         return;
       }
-      if (frame.type === "cancel") {
-        const entry = active.get(frame.runId);
-        if (entry) {
-          entry.record.status = "cancelled";
-          entry.controller.abort();
-        }
-        return;
-      }
-      if (frame.type !== "job_assignment") return;
-      if (active.has(frame.runId)) return;
-      if (active.size >= maxConcurrentRuns) {
-        rejectAssignment(
-          next,
-          frame.runId,
-          `runtime daemon at concurrency cap (${maxConcurrentRuns})`
-        );
+      if (frame.type === "feed_ack") {
+        feedOutbox.markAcked({
+          ...typeof frame.deliverySeq === "number" ? { deliverySeq: frame.deliverySeq } : {},
+          ...typeof frame.eventId === "string" ? { eventId: frame.eventId } : {}
+        });
         return;
       }
-      const controller = new AbortController();
-      const record = {
-        runId: frame.runId,
-        startedAt: now(),
-        status: "running"
-      };
-      recordRun(record);
-      const promise = executor({
-        frame,
-        client: next,
-        projectDir,
-        log,
-        abortSignal: controller.signal
-      }).then(() => {
-        if (record.status === "running") record.status = "completed";
-      }).catch((err) => {
-        if (record.status === "running") {
-          record.status = "failed";
-        }
-        record.error = err instanceof Error ? err.message : String(err);
-        log(
-          "error",
-          `run ${frame.runId} failed: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }).finally(() => {
-        record.endedAt = now();
-        completedRuns += 1;
-        active.delete(frame.runId);
-      });
-      active.set(frame.runId, { controller, promise, record });
+      pairedExecution.handleFrame(frame);
     });
     next.onClose((reason) => {
       if (stopped || client !== next) return;
@@ -12558,14 +12921,17 @@ async function runDashboardRuntimeDaemon(options = {}) {
       client = null;
       currentInstanceId = void 0;
       clearRefreshTimer();
+      clearFeedDrainTimer();
       void reconnectLoop();
     });
     await next.connect();
     client = next;
+    lastSocketClient = next;
     currentInstanceId = token.instanceId;
     currentDashboardUrl = config.dashboardUrl;
     reconnectAttempt = 0;
     scheduleRefresh(token.expiresInSec);
+    startFeedDrainTimer();
     log("info", `dashboard runtime daemon connected as ${token.instanceId}`);
   }
   async function reconnectLoop() {
@@ -12587,6 +12953,7 @@ async function runDashboardRuntimeDaemon(options = {}) {
   await connectOnce();
   return {
     snapshot() {
+      const executionSnapshot = pairedExecution.snapshot();
       const refreshState = refreshFailures.length > 0 || cooldownUntil > now() ? {
         recentFailures: refreshFailures.length,
         ...cooldownUntil > now() ? { cooldownUntilMs: cooldownUntil } : {}
@@ -12595,158 +12962,30 @@ async function runDashboardRuntimeDaemon(options = {}) {
         startedAt,
         socketConnected: client !== null,
         ...lastFrameAt !== void 0 ? { lastFrameAt } : {},
-        activeRuns: active.size,
-        completedRuns,
+        activeRuns: executionSnapshot.activeRuns,
+        completedRuns: executionSnapshot.completedRuns,
         ...currentInstanceId ? { instanceId: currentInstanceId } : {},
         ...currentDashboardUrl ? { dashboardUrl: currentDashboardUrl } : {},
         ...refreshState ? { refreshState } : {}
       };
     },
     listRuns(opts = {}) {
-      let out = runHistory.slice();
-      if (typeof opts.limit === "number" && opts.limit > 0) {
-        out = out.slice(-opts.limit);
-      }
-      if (opts.active) {
-        out = out.filter((r) => r.status === "running");
-      }
-      return out;
+      return pairedExecution.listRuns(opts);
     },
     async stop(reason = "stopped") {
       stopped = true;
       clearRefreshTimer();
-      for (const run of active.values()) {
-        run.controller.abort();
-      }
+      clearFeedDrainTimer();
       const current = client;
       client = null;
       current?.close(reason);
-      await Promise.allSettled([...active.values()].map((run) => run.promise));
+      await pairedExecution.stop();
     }
   };
 }
 
-// src/infra/daemon/stateDir.ts
-import fs21 from "fs";
-import os12 from "os";
-import path19 from "path";
-function daemonStatePaths(env = process.env) {
-  const xdg = env["XDG_STATE_HOME"];
-  const home = env["HOME"] ?? os12.homedir();
-  const base = xdg && xdg.length > 0 ? xdg : path19.join(home, ".local", "state");
-  const dir = path19.join(base, "drisp");
-  return {
-    dir,
-    pidPath: path19.join(dir, "dashboard-daemon.pid"),
-    logPath: path19.join(dir, "dashboard-daemon.log"),
-    socketPath: path19.join(dir, "dashboard-daemon.sock")
-  };
-}
-function ensureDaemonStateDir(env = process.env) {
-  const paths = daemonStatePaths(env);
-  fs21.mkdirSync(paths.dir, { recursive: true, mode: 448 });
-  if (process.platform !== "win32") {
-    try {
-      fs21.chmodSync(paths.dir, 448);
-    } catch {
-    }
-  }
-  return paths;
-}
-
-// src/infra/daemon/pidLock.ts
-import fs22 from "fs";
-function acquirePidLock(pidPath) {
-  const ownPid = process.pid;
-  for (let attempt = 0; attempt < 2; attempt += 1) {
-    try {
-      const fd = fs22.openSync(pidPath, "wx", 384);
-      try {
-        fs22.writeSync(fd, `${ownPid}
-`);
-        fs22.fsyncSync(fd);
-      } finally {
-        fs22.closeSync(fd);
-      }
-      return makeHandle(pidPath, ownPid);
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-    }
-    const existing = readPidLock(pidPath);
-    if (existing.state === "held") {
-      throw new Error(
-        `dashboard daemon is already running as pid ${existing.pid} (lock at ${pidPath}). Use "drisp dashboard daemon stop" to terminate it.`
-      );
-    }
-    if (existing.state === "stale") {
-      try {
-        fs22.unlinkSync(pidPath);
-      } catch (err) {
-        if (err.code !== "ENOENT") throw err;
-      }
-      continue;
-    }
-  }
-  throw new Error(
-    `dashboard daemon: failed to acquire pid lock at ${pidPath} after retry`
-  );
-}
-function readPidLock(pidPath) {
-  let raw;
-  try {
-    raw = fs22.readFileSync(pidPath, "utf-8");
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return { state: "absent" };
-    }
-    throw err;
-  }
-  const pid = Number.parseInt(raw.trim(), 10);
-  if (!Number.isFinite(pid) || pid <= 0) {
-    return { state: "stale", pid: 0 };
-  }
-  if (!isProcessAlive(pid)) {
-    return { state: "stale", pid };
-  }
-  return { state: "held", pid };
-}
-function makeHandle(pidPath, pid) {
-  let released = false;
-  return {
-    pid,
-    release() {
-      if (released) return;
-      released = true;
-      try {
-        const raw = fs22.readFileSync(pidPath, "utf-8").trim();
-        if (raw === String(pid)) {
-          fs22.unlinkSync(pidPath);
-        }
-      } catch (err) {
-        if (err.code !== "ENOENT") {
-        }
-      }
-    }
-  };
-}
-function isProcessAlive(pid) {
-  if (process.platform === "win32") {
-    return true;
-  }
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    const code = err.code;
-    if (code === "EPERM") {
-      return true;
-    }
-    return false;
-  }
-}
-
 // src/infra/daemon/udsIpc.ts
-import fs23 from "fs";
+import fs21 from "fs";
 import net2 from "net";
 
 // src/infra/daemon/udsFrameCodec.ts
@@ -12791,7 +13030,7 @@ async function startUdsServer(socketPath, handler, log) {
   });
   if (process.platform !== "win32") {
     try {
-      fs23.chmodSync(socketPath, 384);
+      fs21.chmodSync(socketPath, 384);
     } catch {
     }
   }
@@ -12801,7 +13040,7 @@ async function startUdsServer(socketPath, handler, log) {
         server.close(() => resolve());
       });
       try {
-        fs23.unlinkSync(socketPath);
+        fs21.unlinkSync(socketPath);
       } catch (err) {
         if (err.code !== "ENOENT") {
         }
@@ -12867,7 +13106,7 @@ async function sendUdsRequest(socketPath, request, options = {}) {
       socket.destroy();
       reject(new Error(`uds request timed out after ${timeoutMs}ms`));
     }, timeoutMs);
-    timer.unref?.();
+    timer.unref();
     const finish = (action) => {
       if (settled) return;
       settled = true;
@@ -12919,7 +13158,7 @@ async function sendUdsRequest(socketPath, request, options = {}) {
 async function unlinkStaleSocket(socketPath) {
   let stat;
   try {
-    stat = fs23.statSync(socketPath);
+    stat = fs21.statSync(socketPath);
   } catch (err) {
     if (err.code === "ENOENT") return;
     throw err;
@@ -12946,7 +13185,7 @@ async function unlinkStaleSocket(socketPath) {
       `uds path ${socketPath} is in use by another process; aborting`
     );
   }
-  fs23.unlinkSync(socketPath);
+  fs21.unlinkSync(socketPath);
 }
 
 export {
@@ -12964,6 +13203,10 @@ export {
   ingestRuntimeEvent,
   ingestRuntimeDecision,
   generateId,
+  daemonStatePaths,
+  ensureDaemonStateDir,
+  createDashboardFeedPublisher,
+  createDashboardDecisionInbox,
   createSessionStore,
   sessionsDir,
   listSessions,
@@ -13011,15 +13254,9 @@ export {
   bootstrapRuntimeConfig,
   EXEC_EXIT_CODE,
   runExec,
-  readAttachmentMirror,
-  writeAttachmentMirror,
-  removeAttachmentMirror,
+  normalizeHarnessOverride,
   runDashboardRuntimeDaemon,
-  daemonStatePaths,
-  ensureDaemonStateDir,
-  acquirePidLock,
-  readPidLock,
   startUdsServer,
   sendUdsRequest
 };
-//# sourceMappingURL=chunk-PJUDHH4R.js.map
+//# sourceMappingURL=chunk-K53YMYTG.js.map