@drisp/cli 0.6.6 → 0.6.7

package/dist/cli.js

@@ -2,12 +2,11 @@
 import "./chunk-HXBCZAP7.js";
 import {
   CREDENTIAL_SOURCES_TRIED,
+  ExecutionStore,
   HARNESS_PROCESS_PRESETS,
   IndexedTimeline,
   PORTABLE_PROVIDER_ENV_VARS,
   RUN_EXIT_CODE,
-  RunnerStartupError,
-  alreadyRunningMessage,
   attachRuntimeEventLoop,
   bootstrapRuntimeConfig,
   buildApiKeyHelperSettings,
@@ -18,19 +17,22 @@ import {
   classifyFailure,
   compactText,
   computeInputRows,
-  createDashboardDecisionInbox,
+  connectAlreadyConnectedSchema,
+  connectRedeemResponseSchema,
+  connectStartResponseSchema,
   createFeedMapper,
-  createPairedFeedPublisher,
+  createLocalFeedSink,
   createRuntime,
   createSessionStore,
   credentialHelperKey,
   cursorToVisualPosition,
-  dashboardClientConfigPath,
   detectClaudeVersion,
+  expandHome,
   extractFriendlyServerName,
   extractPermissionSnapshot,
   fit,
   fitAnsi,
+  forgetRunner,
   formatClock,
   formatProbeCommand,
   formatRunLabel,
@@ -45,6 +47,8 @@ import {
   getMostRecentAthenaSession,
   getSessionMeta,
   hintGlyphs,
+  hubHttpUrl,
+  identityHubOrigin,
   isBashToolResponse,
   isCommandPrefix,
   isScopedPermissionsRequest,
@@ -55,26 +59,22 @@ import {
   localAnswerDecision,
   lookupAllCredentials,
   lookupCredential,
+  machineInstallationId,
   makeSkippedProbe,
   mergeFeedItems,
   messageGlyphs,
-  normalizeDashboardUrl,
+  overriddenIdentityPath,
   parseFrontmatter,
   parseToolName,
+  platformRunnerServices,
   probeSkipReason,
   processRegistry,
   progressGlyphs,
-  readAttachmentMirror,
-  readDashboardClientConfig,
-  readPidLock,
-  readRunnerStatusFile,
-  refreshDashboardAccessToken,
   register,
   registerCleanupOnExit,
   releaseMcpAsset,
-  removeAttachmentMirror,
-  removeDashboardClientConfig,
   renderInputLines,
+  require_string_width,
   resolveClaudeBinary,
   resolveClaudeSettingsSurfacePaths,
   resolveEffectiveCapabilities,
@@ -84,28 +84,32 @@ import {
   resolveRuntimeAuthOverlay,
   resolveToolColumn,
   runClaudeAuthStatus,
+  runConfiguredRunner,
   runExec,
+  runMachineRunners,
   runProbe,
-  runnerStatePaths,
+  runnerConfigDirectory,
+  runnerConfigSchema,
+  runnerDisconnectResponseSchema,
+  runnerIdentities,
+  runnerServiceUnit,
+  runnerSoftwareVersion,
+  serviceInstallationId,
   sessionsDir,
   sliceAnsi,
   spaces,
   startDashboardDecisionDrain,
-  startRunnerProcess,
   startWorkflowExecution,
-  stringWidth,
-  stripAnsi,
   supportsSessionApproval,
+  teamIdentityPath,
   todoGlyphSet,
   visualPositionToOffset,
-  waitForShutdownSignal,
   wrapText,
-  writeAttachmentMirror,
-  writeDashboardClientConfig
-} from "./chunk-QGAGV2OI.js";
+  writeIdentityOnce
+} from "./chunk-7SNGX25Q.js";
 import {
   generateId as generateId2
-} from "./chunk-USK5VSQ7.js";
+} from "./chunk-PQIB66SG.js";
 import {
   McpOptionsStep,
   StepSelector,
@@ -144,17 +148,19 @@ import {
   wakesFreshAfterHandover,
   writeGlobalConfig,
   writeProjectConfig
-} from "./chunk-7FYAABQ4.js";
-import "./chunk-PZ5AY32C.js";
+} from "./chunk-CIPO2P2Q.js";
+import {
+  __toESM
+} from "./chunk-G3PMV62Z.js";
 
 // src/app/entry/cli.tsx
 import { render } from "ink";
 import meow from "meow";
-import fs8 from "fs";
-import { createRequire as createRequire2 } from "module";
-import os7 from "os";
-import path8 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import fs6 from "fs";
+import { createRequire } from "module";
+import os5 from "os";
+import path6 from "path";
+import { fileURLToPath } from "url";
 
 // src/app/shell/sessionUiState.ts
 var DEFAULT_STATIC_FLOOR = 0;
@@ -2175,7 +2181,7 @@ function useFeed(runtime, messages = [], initialAllowedTools, sessionStore, opti
   const feedEventsRef = useRef([]);
   const notifiedRuntimeErrorRef = useRef(null);
   const dashboardFeedPublisher = useMemo3(
-    () => options?.dashboardFeedPublisher ?? createPairedFeedPublisher(),
+    () => options?.dashboardFeedPublisher ?? createLocalFeedSink(),
     [options?.dashboardFeedPublisher]
   );
   const ownsFeedPublisher = !options?.dashboardFeedPublisher;
@@ -2214,10 +2220,7 @@ function useFeed(runtime, messages = [], initialAllowedTools, sessionStore, opti
   useEffect(() => {
     const athenaSessionId = resolveAthenaSessionId();
     if (!athenaSessionId) return;
-    if (!dashboardDecisionInboxRef.current) {
-      if (!readDashboardClientConfig()) return;
-      dashboardDecisionInboxRef.current = createDashboardDecisionInbox();
-    }
+    if (!dashboardDecisionInboxRef.current) return;
     const inbox = dashboardDecisionInboxRef.current;
     const drain = startDashboardDecisionDrain({
       runtime,
@@ -2749,7 +2752,7 @@ function useWorkflowSessionController(base, input) {
     }
     setIsRunning(false);
   }, [base, cancelCurrentRun]);
-  const spawn2 = useCallback6(
+  const spawn = useCallback6(
     async (prompt, continuation, _configOverride) => {
       await cancelCurrentRun();
       const latest = input.store?.getLatestRun();
@@ -2821,7 +2824,7 @@ function useWorkflowSessionController(base, input) {
   }, []);
   return {
     ...base,
-    startTurn: spawn2,
+    startTurn: spawn,
     isRunning,
     interrupt,
     kill,
@@ -3014,7 +3017,7 @@ import React2, {
 } from "react";
 import { Box as Box8, Text as Text11, useInput as useInput7 } from "ink";
 
-// node_modules/chalk/source/vendor/ansi-styles/index.js
+// ../../node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
 var wrapAnsi16 = (offset = 0) => (code) => `\x1B[${code + offset}m`;
 var wrapAnsi256 = (offset = 0) => (code) => `\x1B[${38 + offset};5;${code}m`;
@@ -3200,7 +3203,7 @@ function assembleStyles() {
 var ansiStyles = assembleStyles();
 var ansi_styles_default = ansiStyles;
 
-// node_modules/chalk/source/vendor/supports-color/index.js
+// ../../node_modules/chalk/source/vendor/supports-color/index.js
 import process3 from "process";
 import os from "os";
 import tty from "tty";
@@ -3332,7 +3335,7 @@ var supportsColor = {
 };
 var supports_color_default = supportsColor;
 
-// node_modules/chalk/source/utilities.js
+// ../../node_modules/chalk/source/utilities.js
 function stringReplaceAll(string, substring, replacer) {
   let index = string.indexOf(substring);
   if (index === -1) {
@@ -3362,7 +3365,7 @@ function stringEncaseCRLFWithFirstIndex(string, prefix, postfix, index) {
   return returnValue;
 }
 
-// node_modules/chalk/source/index.js
+// ../../node_modules/chalk/source/index.js
 var { stdout: stdoutColor, stderr: stderrColor } = supports_color_default;
 var GENERATOR = /* @__PURE__ */ Symbol("GENERATOR");
 var STYLER = /* @__PURE__ */ Symbol("STYLER");
@@ -4968,6 +4971,27 @@ import process5 from "process";
 import { useState as useState11, useCallback as useCallback12, useRef as useRef12, useEffect as useEffect10 } from "react";
 import { useInput as useInput11 } from "ink";
 
+// ../../node_modules/ansi-regex/index.js
+function ansiRegex({ onlyFirst = false } = {}) {
+  const ST = "(?:\\u0007|\\u001B\\u005C|\\u009C)";
+  const osc = `(?:(?:\\u001B\\]|\\u009D)[^\\u0007\\u001B\\u009C\\u009D]*${ST})`;
+  const csi = "[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]";
+  const pattern = `${osc}|${csi}`;
+  return new RegExp(pattern, onlyFirst ? void 0 : "g");
+}
+
+// ../../node_modules/strip-ansi/index.js
+var regex = ansiRegex();
+function stripAnsi(string) {
+  if (typeof string !== "string") {
+    throw new TypeError(`Expected a \`string\`, got \`${typeof string}\``);
+  }
+  if (!string.includes("\x1B") && !string.includes("\x9B")) {
+    return string;
+  }
+  return string.replace(regex, "");
+}
+
 // src/shared/utils/clipboard.ts
 import { execSync } from "child_process";
 function copyToClipboard(text) {
@@ -5254,14 +5278,14 @@ function extractWebSearch(_input, response) {
   return { type: "text", content: extractTextContent(response), maxLines: 10 };
 }
 function extractNotebookEdit(input, _response) {
-  const path9 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
+  const path7 = typeof input["notebook_path"] === "string" ? input["notebook_path"] : "";
   const mode = typeof input["edit_mode"] === "string" ? input["edit_mode"] : "replace";
   const source = typeof input["new_source"] === "string" ? input["new_source"] : "";
-  if (!source) return { type: "text", content: `${mode} cell in ${path9}` };
+  if (!source) return { type: "text", content: `${mode} cell in ${path7}` };
   return {
     type: "code",
     content: source,
-    language: detectLanguage(path9),
+    language: detectLanguage(path7),
     maxLines: 10
   };
 }
@@ -5355,6 +5379,7 @@ import { highlight } from "cli-highlight";
 // src/shared/markdown/renderMarkdown.ts
 import { Marked } from "marked";
 import { markedTerminal } from "marked-terminal";
+var import_string_width = __toESM(require_string_width(), 1);
 import Table from "cli-table3";
 
 // src/shared/utils/hyperlink.ts
@@ -5558,11 +5583,11 @@ function inferContinuationPrefix(line) {
     /^(\s*(?:(?:[•*-]|\d+\.)\s+)?(?:\[[ xX]\]\s+)?[^:\n]{1,40}:\s+)/
   );
   if (fieldMatch) {
-    return " ".repeat(stringWidth(fieldMatch[1]));
+    return " ".repeat((0, import_string_width.default)(fieldMatch[1]));
   }
   const listMatch = line.match(/^(\s*(?:[•*-]|\d+\.)\s+(?:\[[ xX]\]\s+)?)/);
   if (listMatch) {
-    return " ".repeat(stringWidth(listMatch[1]));
+    return " ".repeat((0, import_string_width.default)(listMatch[1]));
   }
   const indentMatch = line.match(/^(\s+)/);
   return indentMatch?.[1] ?? "";
@@ -5570,15 +5595,15 @@ function inferContinuationPrefix(line) {
 function wrapAnsiLine(line, maxWidth) {
   if (maxWidth <= 0) return [""];
   if (line.length === 0) return [""];
-  if (stringWidth(line) <= maxWidth) return [line];
+  if ((0, import_string_width.default)(line) <= maxWidth) return [line];
   const chunks = [];
   let remaining = line;
   let firstLine = true;
   const continuationPrefix = inferContinuationPrefix(line);
-  const continuationWidth = stringWidth(continuationPrefix);
+  const continuationWidth = (0, import_string_width.default)(continuationPrefix);
   while (remaining.length > 0) {
     const availableWidth = firstLine ? maxWidth : Math.max(1, maxWidth - continuationWidth);
-    if (stringWidth(remaining) <= availableWidth) {
+    if ((0, import_string_width.default)(remaining) <= availableWidth) {
       chunks.push(firstLine ? remaining : continuationPrefix + remaining);
       break;
     }
@@ -5589,7 +5614,7 @@ function wrapAnsiLine(line, maxWidth) {
       const wrapped = chunk.slice(0, breakAt);
       if (wrapped.trim().length > 0) {
         chunk = wrapped;
-        consumedWidth = Math.min(availableWidth, stringWidth(wrapped) + 1);
+        consumedWidth = Math.min(availableWidth, (0, import_string_width.default)(wrapped) + 1);
       }
     }
     chunks.push(firstLine ? chunk : continuationPrefix + chunk);
@@ -5658,13 +5683,14 @@ function renderMarkdown(options) {
 }
 
 // src/ui/layout/renderDetailLines.ts
+var import_string_width2 = __toESM(require_string_width(), 1);
 var MAX_HIGHLIGHT_SIZE = 5e4;
 function wrapAnsiLine2(line, maxWidth) {
   if (maxWidth <= 0) return [""];
   if (line.length === 0) return [""];
-  if (stringWidth(line) <= maxWidth) return [line];
+  if ((0, import_string_width2.default)(line) <= maxWidth) return [line];
   const chunks = [];
-  const visualWidth = stringWidth(line);
+  const visualWidth = (0, import_string_width2.default)(line);
   for (let start = 0; start < visualWidth; start += maxWidth) {
     chunks.push(sliceAnsi(line, start, start + maxWidth));
   }
@@ -5785,10 +5811,10 @@ function extractToolSubject(toolName, toolInput) {
       const parts = [];
       const pattern = str(input, "pattern");
       const glob = str(input, "glob");
-      const path9 = str(input, "path");
+      const path7 = str(input, "path");
       if (pattern) parts.push(`"${pattern}"`);
       if (glob) parts.push(glob);
-      if (path9) parts.push(`in ${path9}`);
+      if (path7) parts.push(`in ${path7}`);
       return parts.length > 0 ? parts.join("  ") : void 0;
     }
     case "Skill":
@@ -8185,6 +8211,9 @@ function buildHeaderModel(input) {
   };
 }
 
+// src/ui/header/renderLines.ts
+var import_string_width3 = __toESM(require_string_width(), 1);
+
 // src/ui/header/contextBar.ts
 function formatTokenCount(value) {
   if (value === null) return "--";
@@ -8411,7 +8440,7 @@ function renderHeaderLines(model, width, hasColor, theme) {
   };
   const currentLeft = [...leftTokens];
   const totalTarget = Math.max(1, width - 1);
-  while (currentLeft.length > 1 && stringWidth(buildLine(currentLeft)) + MIN_GAP + stringWidth(ctxText) > totalTarget) {
+  while (currentLeft.length > 1 && (0, import_string_width3.default)(buildLine(currentLeft)) + MIN_GAP + (0, import_string_width3.default)(ctxText) > totalTarget) {
     let minIdx = 1;
     let minPri = currentLeft[1].priority;
     for (let i = 2; i < currentLeft.length; i++) {
@@ -8423,10 +8452,10 @@ function renderHeaderLines(model, width, hasColor, theme) {
     currentLeft.splice(minIdx, 1);
   }
   const left = buildLine(currentLeft);
-  const usedWidth = stringWidth(left) + stringWidth(ctxText);
+  const usedWidth = (0, import_string_width3.default)(left) + (0, import_string_width3.default)(ctxText);
   const gapWidth = Math.max(MIN_GAP, totalTarget - usedWidth);
   const line = `${left}${" ".repeat(gapWidth)}${ctxText}`;
-  const lineWidth = stringWidth(line);
+  const lineWidth = (0, import_string_width3.default)(line);
   const padded = lineWidth < totalTarget ? line + " ".repeat(totalTarget - lineWidth) : line;
   return [padded];
 }
@@ -12018,12 +12047,12 @@ function shouldShowSetup({
 }
 
 // src/app/entry/execCommand.ts
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 
 // src/app/entry/resumeResolution.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 function resolveResumeTarget(input) {
-  const createSessionId = input.createSessionId ?? crypto.randomUUID;
+  const createSessionId = input.createSessionId ?? crypto2.randomUUID;
   const getSessionMetaFn = input.getSessionMetaFn ?? getSessionMeta;
   const getMostRecentSessionFn = input.getMostRecentSessionFn ?? getMostRecentAthenaSession;
   const getLatestRunFn = input.getLatestRunFn ?? getLatestRunForSession;
@@ -12085,7 +12114,7 @@ function continueFlagToRequest(continueFlag) {
 }
 async function runExecCommand(input, deps = {}) {
   const logError = deps.logError ?? console.error;
-  const createSessionId = deps.createSessionId ?? crypto2.randomUUID;
+  const createSessionId = deps.createSessionId ?? crypto3.randomUUID;
   const now = deps.now ?? Date.now;
   const runExecFn = deps.runExecFn ?? runExec;
   const getMostRecentSessionFn = deps.getMostRecentSessionFn ?? getMostRecentAthenaSession;
@@ -12970,1564 +12999,518 @@ Default: ${DEFAULT_MARKETPLACE_SLUG3}`
   }
 }
 
-// src/app/entry/runnerCommand.ts
-import crypto3 from "crypto";
-import { spawn } from "child_process";
-import fs6 from "fs";
-import { createRequire } from "module";
-import os5 from "os";
-import path6 from "path";
-import { fileURLToPath } from "url";
+// src/app/entry/runnerCommandV2.ts
+import { existsSync } from "fs";
+import { join as join2 } from "path";
 
-// src/infra/daemon/serviceUnit.ts
-import fs5 from "fs";
-import os4 from "os";
-import path5 from "path";
-function installServiceUnit(options) {
-  const platform = options.platform ?? process.platform;
-  const env2 = options.env ?? process.env;
-  const home = env2["HOME"] ?? os4.homedir();
-  if (platform === "darwin") {
-    const target = options.targetPath ?? path5.join(home, "Library", "LaunchAgents", "ai.drisp.daemon.plist");
-    const paths = runnerStatePaths(env2);
-    const plist = renderLaunchdPlist({
-      label: "ai.drisp.daemon",
-      nodeBinary: options.nodeBinary,
-      daemonEntry: options.runnerEntry,
-      workingDirectory: home,
-      stdoutPath: paths.logPath,
-      stderrPath: paths.logPath
-    });
-    writeIfChanged(target, plist);
-    return {
-      ok: true,
-      platform: "darwin",
-      path: target,
-      loadCommand: `launchctl load -w ${target}`,
-      startCommand: "launchctl start ai.drisp.daemon"
-    };
-  }
-  if (platform === "linux") {
-    const target = options.targetPath ?? path5.join(home, ".config", "systemd", "user", "drisp-daemon.service");
-    const unit = renderSystemdUnit({
-      description: "Drisp runner",
-      nodeBinary: options.nodeBinary,
-      daemonEntry: options.runnerEntry
-    });
-    writeIfChanged(target, unit);
-    return {
-      ok: true,
-      platform: "linux",
-      path: target,
-      loadCommand: "systemctl --user daemon-reload",
-      startCommand: "systemctl --user enable --now drisp-daemon.service"
-    };
-  }
-  return {
-    ok: false,
-    platform: "unsupported",
-    message: `service install not supported on ${platform}`
-  };
-}
-function writeIfChanged(target, content) {
-  const dir = path5.dirname(target);
-  fs5.mkdirSync(dir, { recursive: true, mode: 448 });
-  let existing = null;
-  try {
-    existing = fs5.readFileSync(target, "utf-8");
-  } catch (err) {
-    if (err.code !== "ENOENT") throw err;
-  }
-  if (existing === content) return;
-  fs5.writeFileSync(target, content, { mode: 384 });
-}
-function renderLaunchdPlist(input) {
-  const argv = [input.nodeBinary, input.daemonEntry].map((s) => `		<string>${escapeXml(s)}</string>`).join("\n");
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>Label</key>
-	<string>${escapeXml(input.label)}</string>
-	<key>ProgramArguments</key>
-	<array>
-${argv}
-	</array>
-	<key>RunAtLoad</key>
-	<true/>
-	<key>KeepAlive</key>
-	<dict>
-		<key>SuccessfulExit</key>
-		<false/>
-	</dict>
-	<key>WorkingDirectory</key>
-	<string>${escapeXml(input.workingDirectory)}</string>
-	<key>StandardOutPath</key>
-	<string>${escapeXml(input.stdoutPath)}</string>
-	<key>StandardErrorPath</key>
-	<string>${escapeXml(input.stderrPath)}</string>
-	<key>ProcessType</key>
-	<string>Background</string>
-</dict>
-</plist>
-`;
-}
-function renderSystemdUnit(input) {
-  return `[Unit]
-Description=${input.description}
-After=network-online.target
-
-[Service]
-Type=simple
-ExecStart=${input.nodeBinary} ${input.daemonEntry}
-Restart=always
-RestartSec=5
-SuccessExitStatus=0
-StandardOutput=journal
-StandardError=journal
-
-[Install]
-WantedBy=default.target
-`;
-}
-function escapeXml(input) {
-  return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-
-// src/app/entry/runnerCommand.ts
-var USAGE3 = `Usage: drisp runner [subcommand] [options]
-
-The runner is the one long-lived process that pairs this machine with the
-hub, receives its Runs over the instance socket, and executes them. Its
-state lives in ~/.local/state/drisp/ (runner.pid, runner.db, runner.log,
-runner.status.json).
-
-Subcommands:
-  (none)    Run the runner in the foreground. Exits non-zero with
-            "already running (pid N)" when another runner holds the pid file.
-  --detach  Start the runner in the background and verify it reaches the
-            hub's socket.
-  stop      Stop the background runner (SIGTERM to the pid in runner.pid).
-  restart   Stop, then start detached.
-  status    Show pairing, the runner process (from runner.pid and
-            runner.status.json), socket health, and token freshness.
-            Non-zero on any unhealthy axis. --runner <id> also checks the
-            hub-side runner binding.
-  logs [--tail N] [--follow]
-            Tail the runner log at ~/.local/state/drisp/runner.log.
-  runs [--active] [--limit N]
-            List runs the runner has handled (last 100, from the status file).
-  install   Generate a launchd plist (macOS) or systemd user unit (linux)
-            so the runner starts automatically on login.
-  pair <token> --url <dashboard-origin> [--name <machine-name>]
-            Pair this machine with the hub and start the runner.
-  unpair    Stop the runner, revoke the refresh token, and remove the
-            local config.
-  refresh   Mint a short-lived access token (rotates the refresh token).
-  doctor    Verify pairing health. With --runner <id>, also confirms the
-            hub-side runner is bound to this instance.
-  list      Print the local attachment mirror (the hub-side runners bound
-            to this instance at the last pair/refresh).
-
-Options:
-  --detach            Run in the background (no subcommand)
-  --url <origin>      Dashboard origin (required for pair)
-  --runner <id>       Hub-side runner id (optional for "doctor" / "status")
-  --name <name>       Friendly machine name (optional, defaults to hostname)
-  --tail N            Number of trailing log lines (default 20)
-  --follow            Stream new log lines until interrupted
-  --active            Show only active runs
-  --limit N           Cap the number of runs returned
-  --json              Emit machine-readable JSON output
-
-"drisp dashboard <subcommand>" is a deprecated alias of this command and is
-removed in 0.7.0.
-`;
-var require_ = createRequire(import.meta.url);
-var cachedVersion = null;
-function readPackageVersion() {
-  if (cachedVersion !== null) return cachedVersion;
+// ../../modules/runtime/src/connect.ts
+import { readFile, rename } from "fs/promises";
+import { hostname, platform, release } from "os";
+import { setTimeout as sleep } from "timers/promises";
+var LOOPBACK = ["localhost", "127.0.0.1", "[::1]"];
+function hubOrigin(value) {
+  let url;
   try {
-    const injected = "0.6.6";
-    if (typeof injected === "string" && injected.length > 0) {
-      cachedVersion = injected;
-      return cachedVersion;
-    }
+    url = new URL(value);
   } catch {
+    throw new Error(`${value} is not a Hub URL.`);
+  }
+  if (url.username || url.password || url.search || url.hash)
+    throw new Error("The Hub URL must not carry credentials, a query or a fragment.");
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && LOOPBACK.includes(url.hostname)))
+    throw new Error("The Hub URL must use https (http is allowed only on this machine).");
+  return new URL(url.origin);
+}
+var refusals = {
+  connect_code_invalid: "This Connect code is unknown, already used or expired. Get a new one in Settings \u2192 Runners.",
+  rate_limited: "Too many Connect attempts from this address. Wait ten minutes and try again.",
+  unauthorized: "The member who created this code is no longer in the Team."
+};
+var requestRefusals = {
+  authorization_expired: "The code expired before anyone approved it. Run drisp runner connect again for a new one.",
+  access_denied: "The request to connect this machine was denied.",
+  rate_limited: "Too many Connect requests from this address. Wait a few minutes and try again.",
+  unauthorized: "The member who approved this machine is no longer in the Team."
+};
+var thisMachine = (installationId) => ({
+  installationId,
+  hostname: hostname().slice(0, 255) || "machine",
+  os: `${platform()} ${release()}`.slice(0, 64),
+  softwareVersion: runnerSoftwareVersion
+});
+var post = (origin, path7, body) => fetch(new URL(path7, origin), {
+  method: "POST",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify(body)
+});
+async function connectTarget(origin, configPath, directory) {
+  const single = configPath === void 0 ? void 0 : expandHome(configPath);
+  if (single !== void 0) await refuseExisting(single);
+  const presented = single === void 0 ? await machineInstallationId(directory) : crypto.randomUUID();
+  const held = single === void 0 ? await runnerIdentities(directory) : [];
+  const forTeam = (orgId) => held.filter(({ config }) => config.orgId === orgId && identityHubOrigin(config) === origin.origin);
+  const ownIdentity = ({ orgId, runnerId }) => forTeam(orgId).find(({ config }) => config.runnerId === runnerId);
+  return { single, presented, forTeam, ownIdentity };
+}
+async function alreadyConnected(existing, { forTeam, ownIdentity }) {
+  const own = ownIdentity(existing);
+  const problem = own ? await credentialAccepted(own.config) ? void 0 : "lapsed" : forTeam(existing.orgId).length ? "other_runner" : "missing";
+  const runner = { orgId: existing.orgId, runnerId: existing.runnerId, name: existing.name };
+  if (own && problem === void 0) return { status: "already_connected", ...runner, path: own.path };
+  const path7 = (own ?? forTeam(existing.orgId)[0])?.path;
+  return { status: "identity_unusable", ...runner, problem, ...path7 ? { path: path7 } : {} };
+}
+async function connectWithCode({
+  code,
+  hub,
+  replace = false,
+  configPath = overriddenIdentityPath(),
+  directory = runnerConfigDirectory()
+}) {
+  const origin = hubOrigin(hub);
+  const target = await connectTarget(origin, configPath, directory);
+  const { presented, forTeam, ownIdentity } = target;
+  let redemption = await redeem(origin, code, presented);
+  if (redemption.status === "already_connected" && !ownIdentity(redemption.existing)) {
+    const replacedEarlier = forTeam(redemption.existing.orgId).find(
+      ({ config }) => config.installationId !== presented
+    );
+    if (replacedEarlier) redemption = await redeem(origin, code, replacedEarlier.config.installationId);
+  }
+  if (redemption.status === "already_connected") {
+    const outcome = await alreadyConnected(redemption.existing, target);
+    if (outcome.status === "already_connected" || !replace) return outcome;
+    redemption = await redeem(origin, code, crypto.randomUUID());
+    if (redemption.status === "already_connected")
+      throw new Error("The Hub refused a new installation identity as already connected; try again.");
+  }
+  return saveIdentity(origin, redemption.credential, target, directory);
+}
+async function connectByApproval({
+  hub,
+  onCode,
+  signal,
+  configPath = overriddenIdentityPath(),
+  directory = runnerConfigDirectory()
+}) {
+  const origin = hubOrigin(hub);
+  const target = await connectTarget(origin, configPath, directory);
+  const refused = (body, status) => new Error(requestRefusals[body.error ?? ""] ?? `The Hub refused to connect this machine (${body.error ?? status}).`);
+  const started = await post(origin, "/v2/runners/connect/start", thisMachine(target.presented));
+  const startBody = await started.json().catch(() => ({}));
+  if (!started.ok) throw refused(startBody, started.status);
+  const { deviceCode, code, verificationUrl, expiresAt, intervalSec } = connectStartResponseSchema.parse(startBody);
+  onCode({ code, verificationUrl, expiresAt });
+  for (; ; ) {
+    await sleep(intervalSec * 1e3, void 0, { signal });
+    const polled = await post(origin, "/v2/runners/connect/poll", { deviceCode }).catch(() => void 0);
+    const body = await polled?.json().catch(() => ({})) ?? {};
+    if (polled?.ok) return saveIdentity(origin, connectRedeemResponseSchema.parse(body), target, directory);
+    if (polled?.status === 409 && body.error === "runner_already_connected")
+      return alreadyConnected(connectAlreadyConnectedSchema.parse(body), target);
+    if (polled && polled.status < 500 && body.error !== "authorization_pending") throw refused(body, polled.status);
+    if (Date.now() >= expiresAt && body.error !== "authorization_pending")
+      throw refused({ error: "authorization_expired" }, 409);
+  }
+}
+async function saveIdentity(origin, credential, { single, forTeam }, directory) {
+  const endpoint = new URL(`/v2/orgs/${encodeURIComponent(credential.orgId)}/connect`, origin);
+  endpoint.protocol = endpoint.protocol === "https:" ? "wss:" : "ws:";
+  const config = runnerConfigSchema.parse({
+    endpoint: endpoint.href,
+    token: credential.token,
+    orgId: credential.orgId,
+    runnerId: credential.runnerId,
+    installationId: credential.installationId,
+    hubEpoch: credential.hubEpoch,
+    capacity: 1,
+    // Each Runner keeps its own store: the store pins its Runner and Hub epoch, and one installation identity can
+    // be several Runners (one per Team, and a new one when the Hub enrols this machine again).
+    dataDirectory: `~/.local/share/drisp/${pathSegment(credential.installationId)}/${pathSegment(credential.runnerId)}`,
+    name: credential.name
+  });
+  const replaced = [];
+  for (const { path: path8 } of forTeam(credential.orgId)) {
+    const aside = `${path8}.replaced-${Date.now()}`;
+    await rename(path8, aside);
+    replaced.push(aside);
   }
+  const path7 = single ?? teamIdentityPath(origin, credential.orgId, directory);
+  try {
+    await writeIdentityOnce(path7, JSON.stringify(config, null, 2) + "\n");
+  } catch (error) {
+    if (error.code === "EEXIST")
+      throw new Error(`Another Connect wrote a Runner identity for this Team at ${path7} meanwhile; it was left unchanged.`);
+    throw error;
+  }
+  return { status: "connected", config, path: path7, replaced };
+}
+function pathSegment(value) {
+  const segment = encodeURIComponent(value);
+  if (segment === "." || segment === "..") throw new Error(`The Hub returned an unusable identifier (${value}).`);
+  return segment;
+}
+async function redeem(origin, code, installationId) {
+  const response = await post(origin, "/v2/runners/connect", { code, ...thisMachine(installationId) });
+  const body = await response.json().catch(() => ({}));
+  if (response.status === 409 && body.error === "runner_already_connected")
+    return { status: "already_connected", existing: connectAlreadyConnectedSchema.parse(body) };
+  if (!response.ok)
+    throw new Error(refusals[body.error ?? ""] ?? `The Hub refused the Connect code (${body.error ?? response.status}).`);
+  return { status: "connected", credential: connectRedeemResponseSchema.parse(body) };
+}
+async function credentialAccepted(config) {
+  const url = hubHttpUrl(config.endpoint, "/credentials/renew");
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${config.token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ hubEpoch: config.hubEpoch }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (response.ok) return true;
+  const { error } = await response.json().catch(() => ({}));
+  if (response.status === 401 || error === "recovery_required") return false;
+  throw new Error(`The Hub could not check this machine's credential for the Team (${error ?? response.status}).`);
+}
+async function refuseExisting(target) {
+  const existing = await readFile(target, "utf8").then((text) => text, () => void 0);
+  if (existing === void 0) return;
+  let name;
   try {
-    const pkg = require_("../../../package.json");
-    cachedVersion = pkg.version ?? "0.0.0";
+    name = runnerConfigSchema.safeParse(JSON.parse(existing)).data?.name;
   } catch {
-    cachedVersion = "0.0.0";
   }
-  return cachedVersion;
+  throw new Error(`This machine already has a Runner${name ? ` (${name})` : ""} configured at ${target}.`);
+}
+async function disconnectRunner({
+  identity: { path: path7, config },
+  serviceManager,
+  othersRemain
+}) {
+  const name = config.name ?? config.runnerId;
+  const wasRunning = serviceManager ? (await serviceManager.status()).running : false;
+  const restore = async () => {
+    if (wasRunning) await serviceManager?.start();
+  };
+  await serviceManager?.stop();
+  const url = hubHttpUrl(config.endpoint, "/runner/disconnect");
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${config.token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ hubEpoch: config.hubEpoch }),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (error) {
+    await restore();
+    throw new Error(`The Hub could not be reached, so ${name} is still connected: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const body = await response.json().catch(() => ({}));
+  let result;
+  if (response.ok) result = { name, stoppedRuns: runnerDisconnectResponseSchema.parse(body).stoppedRuns };
+  else if (response.status === 410) result = { name, note: "The Hub had already disconnected it." };
+  else if (response.status === 401)
+    result = { name, note: "The Hub no longer accepts its credential: it lapsed after 30 days without contact, or was revoked." };
+  else {
+    await restore();
+    throw new Error(`The Hub refused to disconnect ${name} (${body.error ?? response.status}); it is still connected.`);
+  }
+  await forgetRunner(path7);
+  if (othersRemain) await restore();
+  else await serviceManager?.remove();
+  return result;
 }
-function defaultFingerprint() {
-  const seed = [
-    os5.hostname(),
-    os5.userInfo().username,
-    os5.platform(),
-    os5.arch()
-  ].join("\0");
-  return crypto3.createHash("sha256").update(seed).digest("hex");
+
+// src/app/entry/runnerCommandV2.ts
+var usage = `Usage: drisp runner [connect [<code>] --hub <url> [--foreground] [--replace] | disconnect [<team>] | status | recover | help]
+
+Connect this machine from Settings \u2192 Runners in the web console, which shows the
+command to paste here:
+  drisp runner connect K7QF-M2PX --hub https://hub.example
+Or start from this machine: without a code, connect prints one to approve in the
+web console, where you choose the Team, and waits for the approval:
+  drisp runner connect --hub https://hub.example
+
+A machine is one Runner per Team. Connect writes that Team's Runner identity and
+credential to ~/.config/drisp/runners/<hub>/<team>.json, readable only by you, then
+installs and starts a background service (launchd on macOS, systemd --user on Linux)
+that runs this machine's Runner for every Team it serves, at login. Connecting again to
+the same Team reports the Runner the machine already is and changes nothing. When this
+machine can no longer serve that Runner (its credential is gone or has lapsed), Connect
+says so without using the code, and --replace connects a new Runner in its place.
+drisp runner status lists the Teams and the service's state. --foreground skips the
+service and runs the Runner in this terminal, for containers and CI; drisp runner runs
+every Team's Runner there again later. DRISP_HUB_URL may stand in for --hub, and
+DRISP_RUNNER_CONFIG selects one identity file of a separate installation instead, which
+gets its own service.
+drisp runner disconnect takes this machine out of a Team: the Hub stops the Runs on
+its Runner there, and this machine deletes that Team's credential, removing the
+service when no Team is left. Name the Team (its id or Runner name from status) when
+the machine serves several. A Runner disconnected from Settings does the same by
+itself the next time it reaches the Hub.
+For an uncertain crash, stop the service and every harness first, then:
+  drisp runner recover <run-id> confirmed-stopped
+This records an explicit failed outcome; it never retries execution.
+`;
+function printApprovalRequest({
+  code,
+  verificationUrl,
+  expiresAt
+}) {
+  const minutes = Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+  process.stdout.write(
+    `To connect this machine, approve code ${code.slice(0, 4)}-${code.slice(4)} in the web console:
+  ${verificationUrl}
+The code works once and expires in ${minutes} minutes. Waiting for approval\u2026
+`
+  );
 }
-function defaultHostInfo(name) {
+var serviceStarted = (service) => `The Runner runs as a background service (${service.kind} ${service.name}) and starts again at login.`;
+var servicesFor = (options) => options.services === void 0 ? platformRunnerServices() : options.services;
+async function serviceInstallation(config) {
+  const single = overriddenIdentityPath();
   return {
-    hostname: os5.hostname(),
-    user: os5.userInfo().username,
-    platform: os5.platform(),
-    arch: os5.arch(),
-    name: name ?? os5.hostname()
+    installationId: await serviceInstallationId(config),
+    ...single ? { configPath: single } : {}
   };
 }
-async function runRunnerCommand(input, deps = {}) {
-  const logOut = deps.logOut ?? ((m) => process.stdout.write(m + "\n"));
-  const logError = deps.logError ?? ((m) => process.stderr.write(m + "\n"));
-  const fetchImpl = deps.fetch ?? fetch;
-  const now = deps.now ?? (() => Date.now());
-  const fingerprint = deps.fingerprint ?? defaultFingerprint;
-  const readConfig2 = deps.readConfig ?? (() => readDashboardClientConfig());
-  const writeConfig = deps.writeConfig ?? ((c2) => writeDashboardClientConfig(c2));
-  const removeConfig = deps.removeConfig ?? (() => removeDashboardClientConfig());
-  const configPath = deps.configPath ?? (() => dashboardClientConfigPath());
-  const readMirror = deps.readMirror ?? (() => readAttachmentMirror());
-  const writeMirror = deps.writeMirror ?? ((m) => writeAttachmentMirror(m));
-  const removeMirror = deps.removeMirror ?? (() => removeAttachmentMirror());
-  const packageVersion = deps.packageVersion ?? readPackageVersion();
-  const { subcommand, subcommandArgs, flags } = input;
-  if (subcommand === "help" || subcommand === "--help") {
-    logOut(USAGE3);
-    return 0;
+async function ensureService(services, config, identityPath) {
+  let service;
+  let installed = false;
+  try {
+    const { installationId, configPath } = await serviceInstallation(config);
+    service = services(installationId);
+    await service.install(runnerServiceUnit(configPath));
+    installed = true;
+    if ((await service.status()).running) await service.stop();
+    await service.start();
+    return service;
+  } catch (error) {
+    throw new Error(
+      [
+        `Connected, but the background service did not start: ${error instanceof Error ? error.message : String(error)}`,
+        `The identity is saved to ${identityPath}: run drisp runner to run the Runner in the foreground.`,
+        // launchd loads an installed LaunchAgent at the next login and RunAtLoad starts it. A systemd unit
+        // is enabled only by the start that just failed, so it has no such fallback.
+        ...installed && service?.kind === "launchd" ? [
+          `The LaunchAgent ${service.name} is installed, so launchd starts the Runner at your next login.`
+        ] : []
+      ].join("\n")
+    );
   }
-  if (subcommand === "pair") {
-    const token = subcommandArgs[0];
-    if (!token) {
-      logError("runner pair: missing pairing token");
-      logError(USAGE3);
-      return 2;
-    }
-    if (subcommandArgs.length > 1) {
-      logError(`runner pair: unexpected argument ${subcommandArgs[1]}`);
-      return 2;
-    }
-    if (!flags.url) {
-      logError("runner pair: --url <dashboard-origin> is required");
-      return 2;
-    }
-    let origin;
-    try {
-      origin = normalizeDashboardUrl(flags.url);
-    } catch (err) {
-      logError(
-        `runner pair: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 2;
-    }
-    const fp = fingerprint();
-    const body = {
-      token,
-      fingerprint: fp,
-      hostInfo: (deps.hostInfo ?? (() => defaultHostInfo(flags.name)))(),
-      capabilities: {
-        instanceSocket: true,
-        runtimeDaemon: true,
-        cliVersion: packageVersion,
-        // Legacy field — older dashboards read `version`. Drop in a
-        // follow-up release once the dashboard accepts only `cliVersion`.
-        version: packageVersion
-      }
-    };
-    let response;
-    try {
-      response = await fetchImpl(`${origin}/api/instances/pair`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(body)
-      });
-    } catch (err) {
-      logError(
-        `runner pair: failed to reach ${origin}: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 1;
-    }
-    if (!response.ok) {
-      const message = await safeReadError(response);
-      logError(
-        `runner pair: ${origin} returned ${response.status}${message ? ` \u2014 ${message}` : ""}`
-      );
-      return 1;
-    }
-    let parsed;
-    try {
-      parsed = parsePairResponse(await response.json());
-    } catch (err) {
-      logError(
-        `runner pair: invalid response from ${origin}: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 1;
-    }
-    if (parsed.requiredCliVersion && compareSemver(packageVersion, parsed.requiredCliVersion) < 0) {
-      logError(
-        `runner pair: cli version ${packageVersion} is older than the dashboard's required >=${parsed.requiredCliVersion}.`
-      );
-      logError(
-        "runner pair: upgrade with `npm i -g @drisp/cli` then re-run pair."
-      );
-      return 1;
-    }
-    const config = {
-      dashboardUrl: origin,
-      instanceId: parsed.instanceId,
-      refreshToken: parsed.refreshToken,
-      fingerprint: fp,
-      pairedAt: now()
-    };
-    writeConfig(config);
-    try {
-      writeMirror({
-        instanceId: parsed.instanceId,
-        fetchedAt: now(),
-        attachments: (parsed.runners ?? []).map((r) => ({
-          runnerId: r.runnerId,
-          ...r.name !== void 0 ? { name: r.name } : {},
-          ...r.executionTarget !== void 0 ? { executionTarget: r.executionTarget } : {},
-          ...r.remoteInstanceId !== void 0 ? { remoteInstanceId: r.remoteInstanceId } : {}
-        }))
-      });
-    } catch (err) {
-      logError(
-        `runner pair: failed to write attachment mirror: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-    const priorStop = await (deps.stopRunner ?? defaultStopRunner)({});
-    const started = await (deps.startDetachedRunner ?? defaultStartDetachedRunner)({
-      log: (msg) => logOut(msg)
-    });
-    const daemonStart = {
-      ...started,
-      ...priorStop.wasRunning ? { restarted: true } : {}
-    };
-    if (flags.json) {
-      logOut(
-        JSON.stringify({
-          ok: true,
-          instanceId: parsed.instanceId,
-          dashboardUrl: origin,
-          configPath: configPath(),
-          runner: daemonStart,
-          ...parsed.runners ? { runners: parsed.runners } : {},
-          ...parsed.capabilityAck ? { capabilityAck: parsed.capabilityAck } : {},
-          ...parsed.requiredCliVersion ? { requiredCliVersion: parsed.requiredCliVersion } : {}
-        })
+}
+async function runRunnerCommandV2(input, options = {}) {
+  try {
+    if (input.flags.detach)
+      throw new Error(
+        "v1 --detach is unavailable: drisp runner connect installs the Runner as a background service."
       );
-    } else {
-      logOut(`runner: paired to ${origin} as ${parsed.instanceId}`);
-      if (parsed.runners && parsed.runners.length > 0) {
-        for (const runner of parsed.runners) {
-          logOut(
-            `runner: bound runner ${runner.name ?? runner.runnerId} (${runner.runnerId})`
+    switch (input.subcommand) {
+      case "connect": {
+        const [code, extra] = input.subcommandArgs;
+        if (extra) throw new Error(`Unexpected argument ${extra}.`);
+        const hub = input.flags.hub ?? process.env["DRISP_HUB_URL"];
+        if (!hub)
+          throw new Error(
+            "Pass --hub <url>, the Hub shown with the code in Settings \u2192 Runners."
+          );
+        const services = input.flags.foreground ? null : servicesFor(options);
+        const outcome = code ? await connectWithCode({
+          code,
+          hub,
+          replace: Boolean(input.flags.replace)
+        }) : await connectByApproval({
+          hub,
+          onCode: printApprovalRequest,
+          signal: options.signal
+        });
+        if (outcome.status === "already_connected") {
+          process.stdout.write(
+            `This machine is already connected to this Team as ${outcome.name}. Its identity in ${outcome.path} is unchanged; start it with drisp runner.
+`
           );
+          return 0;
         }
-      } else {
-        logOut("runner: no runner bound to this pairing token.");
-        logOut(
-          "runner: bind a runner from runner settings, then this machine will receive its runs."
-        );
-      }
-      if (parsed.capabilityAck === void 0) {
-        logOut(
-          "runner: dashboard did not echo capabilityAck (older server). Continuing."
-        );
-      }
-      if (daemonStart.ok) {
-        const status = daemonStart.connected ? `runner connected (verified socket open${daemonStart.restarted ? ", restarted with the new token" : ""})` : "runner started but did not reach the socket within 10s";
-        logOut(`runner: ${status}`);
-        if (!daemonStart.connected) {
-          logOut(
-            "runner pair: pairing succeeded; tail logs with `drisp runner logs --follow`."
+        if (outcome.status === "identity_unusable") {
+          const why = {
+            missing: "it no longer holds that Runner's credential",
+            other_runner: `its identity in ${outcome.path} belongs to another Runner`,
+            lapsed: `the Hub no longer accepts the credential in ${outcome.path} (it expired or was revoked)`
+          }[outcome.problem];
+          const retry = [
+            "drisp runner connect",
+            code ?? "<code>",
+            "--hub",
+            hub,
+            ...input.flags.foreground ? ["--foreground"] : [],
+            "--replace"
+          ].join(" ");
+          throw new Error(
+            `This machine is already connected to this Team as ${outcome.name}, but ${why}. ` + (code ? `The code was not used: connect a new Runner in its place with ${retry}. ` : `Connect a new Runner in its place with a Connect code from Settings \u2192 Runners: ${retry}. `) + `The old ${outcome.name} stays listed in Settings \u2192 Runners, offline.`
           );
         }
-      } else {
-        logError(
-          `runner: runner did not start${daemonStart.message ? ` \u2014 ${daemonStart.message}` : ""}`
-        );
-        logOut(
-          "runner pair: pairing succeeded; start the runner with `drisp runner --detach`."
+        const { config, path: path7, replaced } = outcome;
+        for (const aside of replaced)
+          process.stdout.write(
+            `The Hub no longer recognised this machine's earlier identity for this Team; it was moved aside to ${aside}.
+`
+          );
+        process.stdout.write(
+          `Connected as ${config.name ?? config.runnerId}. Identity saved to ${path7}.
+`
         );
+        if (services) {
+          const service = await ensureService(services, config, path7);
+          process.stdout.write(`${serviceStarted(service)}
+`);
+          return 0;
+        }
+        if (!input.flags.foreground)
+          process.stdout.write(
+            "No launchd or systemd here to run the Runner as a background service; running it in the foreground instead.\n"
+          );
+        await runConfiguredRunner(path7, options.signal);
+        return 0;
       }
-      logOut("runner: ready. Click Run in the dashboard.");
-    }
-    return 0;
-  }
-  if (subcommand === "status") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner status: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const config = readConfig2();
-    if (!config) {
-      if (flags.json) {
-        logOut(JSON.stringify({ ok: false, paired: false }));
-      } else {
-        logOut("runner: not paired");
-      }
-      return 1;
-    }
-    const readStatus = deps.readRunnerStatus ?? defaultReadRunnerStatus;
-    let report;
-    try {
-      report = readStatus();
-    } catch (err) {
-      report = {
-        running: false,
-        error: err instanceof Error ? err.message : String(err)
-      };
-    }
-    let runnerHealth;
-    if (flags.runner) {
-      const refreshResult = await tryRefresh("refresh");
-      if (refreshResult.ok) {
-        runnerHealth = await fetchRunnerHealth(
-          fetchImpl,
-          config.dashboardUrl,
-          flags.runner,
-          refreshResult.token
+      case "disconnect": {
+        const [team, extra] = input.subcommandArgs;
+        if (extra) throw new Error(`Unexpected argument ${extra}.`);
+        const identities = await runnerIdentities();
+        if (!identities.length)
+          throw new Error("This machine has no Runner to disconnect.");
+        const matching = team ? identities.filter(
+          ({ config }) => config.orgId === team || config.name === team
+        ) : identities;
+        if (matching.length !== 1)
+          throw new Error(
+            (team ? `No single Runner on this machine matches ${team}.` : "This machine serves several Teams: name the one to leave.") + ` Its Teams: ${identities.map(({ config }) => `${config.orgId} (${config.name ?? config.runnerId})`).join(", ")}.`
+          );
+        const identity = matching[0];
+        const services = servicesFor(options);
+        const { name, stoppedRuns, note } = await disconnectRunner({
+          identity,
+          serviceManager: services ? services(await serviceInstallationId(identity.config)) : null,
+          othersRemain: identities.length > 1
+        });
+        process.stdout.write(
+          `Disconnected ${name}.${stoppedRuns ? ` ${stoppedRuns === 1 ? "1 Run on it was" : `${stoppedRuns} Runs on it were`} stopped.` : ""}${note ? ` ${note}` : ""} Its credential was deleted${identities.length > 1 ? "; the service runs on for the other Teams" : " and its service removed"}.
+`
         );
-      } else {
-        runnerHealth = {
-          id: flags.runner,
-          matches: false,
-          error: "could not refresh access token"
-        };
+        return 0;
       }
-    }
-    const socketHealthy = report.running && report.status.socketConnected;
-    const runnerOk = !runnerHealth || runnerHealth.matches;
-    const ok = report.running && socketHealthy && runnerOk;
-    if (flags.json) {
-      logOut(
-        JSON.stringify({
-          ok,
-          paired: true,
-          instanceId: config.instanceId,
-          dashboardUrl: config.dashboardUrl,
-          pairedAt: config.pairedAt,
-          ...config.lastRefreshAt !== void 0 ? { lastRefreshAt: config.lastRefreshAt } : {},
-          configPath: configPath(),
-          runner: report.running ? {
-            running: true,
-            pid: report.status.pid,
-            startedAt: report.status.startedAt,
-            updatedAt: report.status.updatedAt,
-            socketConnected: report.status.socketConnected,
-            ...report.status.wireMode !== void 0 ? { wireMode: report.status.wireMode } : {},
-            ...report.status.lastFrameAt !== void 0 ? { lastFrameAt: report.status.lastFrameAt } : {},
-            activeRuns: report.status.activeRuns,
-            completedRuns: report.status.completedRuns,
-            ...report.status.refreshState ? { refreshState: report.status.refreshState } : {}
-          } : {
-            running: false,
-            ...report.error ? { error: report.error } : {}
-          },
-          ...runnerHealth ? { binding: runnerHealth } : {}
-        })
-      );
-    } else {
-      logOut(
-        `runner: paired to ${config.dashboardUrl} as ${config.instanceId}`
-      );
-      if (runnerHealth) {
-        if (runnerHealth.matches) {
-          logOut(
-            `binding:   ${runnerHealth.id} bound to this instance (executionTarget=remote)`
-          );
-        } else {
-          logError(
-            `binding:   ${runnerHealth.id} ${runnerHealth.error ?? "not bound"}`
+      case "recover": {
+        const [runId, confirmation] = input.subcommandArgs;
+        if (!runId || confirmation !== "confirmed-stopped")
+          throw new Error(
+            "Stop the service and verify every harness is stopped, then use recover <run-id> confirmed-stopped."
           );
-        }
-      }
-      if (report.running) {
-        const r = report.status;
-        const uptimeSec = Math.max(
-          0,
-          Math.floor((now() - r.startedAt) / 1e3)
-        );
-        logOut(
-          `runner:    running (pid ${r.pid}, uptime ${formatDuration2(uptimeSec)}, ${r.completedRuns} runs completed, ${r.activeRuns} active)`
-        );
-        logOut(
-          `socket:    ${r.socketConnected ? "connected" : "disconnected"}${r.wireMode ? ` (${r.wireMode} frame names)` : ""}${r.lastFrameAt !== void 0 ? ` (last frame ${formatDuration2(
-            Math.max(0, Math.floor((now() - r.lastFrameAt) / 1e3))
-          )} ago)` : ""}`
+        const config = await recoveryIdentity(runId);
+        const store = new ExecutionStore(
+          join2(config.dataDirectory, "execution.sqlite"),
+          {
+            orgId: config.orgId,
+            runnerId: config.runnerId,
+            installationId: config.installationId,
+            hubEpoch: config.hubEpoch
+          },
+          config.capacity
         );
-        if (r.refreshState) {
-          if (r.refreshState.cooldownUntilMs !== void 0 && r.refreshState.cooldownUntilMs > now()) {
-            const remainingSec = Math.ceil(
-              (r.refreshState.cooldownUntilMs - now()) / 1e3
-            );
-            if (r.refreshState.hubUnreachable) {
-              logError(
-                `refresh:   circuit-broken \u2014 hub unreachable; probing it and reconnecting as soon as it answers (retries anyway in ${formatDuration2(
-                  remainingSec
-                )})`
-              );
-            } else {
-              logError(
-                `refresh:   circuit-broken \u2014 sleeping for ${formatDuration2(
-                  remainingSec
-                )} before retry. Re-pair if this persists.`
-              );
-            }
-          } else {
-            logOut(
-              `refresh:   ${r.refreshState.recentFailures} recent failure(s); next reconnect will retry`
-            );
-          }
+        try {
+          store.resolveRecovery(runId);
+          if (config.portableCheckpoints)
+            store.queueCheckpoint(runId, crypto.randomUUID());
+        } finally {
+          store.close();
         }
-      } else {
-        logOut(
-          `runner:    NOT running${report.error ? ` (${report.error})` : ""}. Start it with \`drisp runner --detach\`.`
+        process.stdout.write(
+          "Recovery outcome recorded. Start the runner to publish it.\n"
         );
+        return 0;
       }
-      if (config.lastRefreshAt !== void 0) {
-        logOut(
-          `token:     last refreshed ${formatDuration2(
-            Math.max(0, Math.floor((now() - config.lastRefreshAt) / 1e3))
-          )} ago`
+      case "status": {
+        const identities = await runnerIdentities();
+        if (!identities.length)
+          throw new Error(
+            "This machine is not connected to a Team. Settings \u2192 Runners shows the command to connect it."
+          );
+        const services = servicesFor(options);
+        const service = services ? services(
+          (await serviceInstallation(identities[0].config)).installationId
+        ) : void 0;
+        process.stdout.write(
+          JSON.stringify(
+            {
+              configured: true,
+              // One entry per Team this machine serves; credentials are never printed.
+              teams: identities.map(
+                ({ path: path7, config: { token: _token, ...config } }) => ({
+                  ...config,
+                  path: path7
+                })
+              ),
+              service: service ? {
+                manager: service.kind,
+                name: service.name,
+                ...await service.status()
+              } : { manager: null, installed: false, running: false },
+              note: "Connection and execution state are visible in the Hub."
+            },
+            null,
+            2
+          ) + "\n"
         );
+        return 0;
       }
+      case "":
+        await runMachineRunners(options.signal, {
+          services: servicesFor(options)
+        });
+        return 0;
+      case "help":
+      case "--help":
+        process.stdout.write(usage);
+        return 0;
+      default:
+        throw new Error(
+          `Unsupported v2 runner command: ${input.subcommand}.
+${usage}`
+        );
     }
-    return ok ? 0 : 1;
-  }
-  if (subcommand === "logs") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner logs: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const tail = flags.tail ?? 20;
-    const follow = flags.follow ?? false;
-    try {
-      const tailFn = deps.tailRunnerLog ?? defaultTailRunnerLog;
-      return await tailFn({ tail, follow });
-    } catch (err) {
-      logError(
-        `runner logs: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 1;
-    }
-  }
-  if (subcommand === "runs") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner runs: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const readStatus = deps.readRunnerStatus ?? defaultReadRunnerStatus;
-    let report;
-    try {
-      report = readStatus();
-    } catch (err) {
-      logError(
-        `runner runs: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return 1;
-    }
-    if (!report.running) {
-      logError(`runner runs: ${report.error ?? "runner not running"}`);
-      return 1;
-    }
-    let runs = report.status.runs;
-    if (typeof flags.limit === "number" && flags.limit > 0) {
-      runs = runs.slice(-flags.limit);
-    }
-    if (flags.active) {
-      runs = runs.filter((run) => run.status === "running");
-    }
-    if (flags.json) {
-      logOut(JSON.stringify({ ok: true, runs }));
-      return 0;
-    }
-    if (runs.length === 0) {
-      logOut("runner: no runs recorded");
-      return 0;
-    }
-    logOut(["runId", "started", "duration", "status"].join("	"));
-    for (const run of runs) {
-      const duration = run.endedAt ? formatDuration2(
-        Math.max(0, Math.floor((run.endedAt - run.startedAt) / 1e3))
-      ) : "\u2014";
-      logOut(
-        [
-          run.runId,
-          formatDuration2(
-            Math.max(0, Math.floor((now() - run.startedAt) / 1e3))
-          ) + " ago",
-          duration,
-          run.status
-        ].join("	")
-      );
-    }
-    return 0;
+  } catch (error) {
+    process.stderr.write(
+      `drisp runner: ${error instanceof Error ? error.message : String(error)}
+`
+    );
+    return 1;
   }
-  const performRefreshImpl = deps.performRefresh ?? (async (_label) => refreshDashboardAccessToken({ fetch: fetchImpl, now }));
-  async function tryRefresh(label) {
+}
+async function recoveryIdentity(runId) {
+  const identities = await runnerIdentities();
+  if (!identities.length)
+    throw new Error("This machine is not connected to a Team.");
+  for (const { config } of identities) {
+    const file = join2(config.dataDirectory, "execution.sqlite");
+    if (!existsSync(file)) continue;
+    const store = new ExecutionStore(
+      file,
+      {
+        orgId: config.orgId,
+        runnerId: config.runnerId,
+        installationId: config.installationId,
+        hubEpoch: config.hubEpoch
+      },
+      config.capacity
+    );
     try {
-      const token = await performRefreshImpl(label);
-      return { ok: true, token };
-    } catch (err) {
-      logError(
-        `dashboard ${label}: ${err instanceof Error ? err.message : String(err)}`
-      );
-      return { ok: false, code: 1 };
+      store.run(runId);
+      return config;
+    } catch {
+    } finally {
+      store.close();
     }
   }
-  if (subcommand === "refresh") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner refresh: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    if (!readConfig2()) {
-      logError('runner refresh: not paired. Run "drisp runner pair" first.');
-      return 1;
-    }
-    const result = await tryRefresh("refresh");
-    if (!result.ok) return result.code;
-    const { token } = result;
-    if (flags.json) {
-      const rotated = readConfig2();
-      logOut(
-        JSON.stringify({
-          ok: true,
-          instanceId: token.instanceId,
-          accessToken: token.accessToken,
-          refreshToken: rotated?.refreshToken,
-          expiresInSec: token.expiresInSec
-        })
-      );
-    } else {
-      logOut(`runner: refreshed access token for instance ${token.instanceId}`);
-    }
-    return 0;
-  }
-  if (subcommand === "") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    if (!readConfig2()) {
-      logError('runner: not paired. Run "drisp runner pair" first.');
-      return 1;
-    }
-    if (flags.detach) {
-      const result = await (deps.startDetachedRunner ?? defaultStartDetachedRunner)({ log: (msg) => logOut(msg) });
-      if (flags.json) {
-        logOut(JSON.stringify(result));
-      } else if (result.ok) {
-        logOut(
-          result.connected ? "runner: started and connected" : "runner: started; socket not yet verified (tail logs)"
-        );
-      } else {
-        logError(`runner: ${result.message ?? "unknown failure"}`);
-      }
-      return result.ok ? 0 : 1;
-    }
-    let runner;
-    try {
-      runner = await startRunnerProcess({
-        readConfig: readConfig2,
-        refreshAccessToken: async () => performRefreshImpl("connect"),
-        ...deps.makeInstanceSocketClient ? { makeInstanceSocketClient: deps.makeInstanceSocketClient } : {},
-        ...deps.executeRemoteAssignment ? { executeRemoteAssignment: deps.executeRemoteAssignment } : {},
-        ...deps.fetchAttachments ? { fetchAttachments: deps.fetchAttachments } : {},
-        ...deps.statePaths ? { statePaths: deps.statePaths() } : {},
-        writeMirror,
-        retryInitialConnect: false,
-        cliVersion: readPackageVersion(),
-        log: (level, message) => {
-          if (level === "error" || level === "warn") {
-            logError(`runner: ${message}`);
-          } else {
-            logOut(`runner: ${message}`);
-          }
-        }
-      });
-    } catch (err) {
-      logError(`runner: ${err instanceof Error ? err.message : String(err)}`);
-      return err instanceof RunnerStartupError ? err.exitCode : 1;
-    }
-    logOut(`runner: foreground runtime connected (pid ${runner.pid})`);
-    const wait = deps.waitForShutdown ?? waitForShutdownSignal;
-    const reason = await wait();
-    await runner.stop(reason);
-    logOut(`runner: stopped (${reason})`);
-    return 0;
-  }
-  if (subcommand === "stop") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner stop: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const result = await (deps.stopRunner ?? defaultStopRunner)({});
-    if (flags.json) {
-      logOut(JSON.stringify(result));
-    } else if (!result.wasRunning) {
-      logOut("runner: not running");
-    } else if (result.ok) {
-      logOut("runner: stopped");
-    } else {
-      logError(`runner stop: ${result.message ?? "unknown failure"}`);
-    }
-    return result.ok ? 0 : 1;
-  }
-  if (subcommand === "restart") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner restart: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const stopResult = await (deps.stopRunner ?? defaultStopRunner)({});
-    if (stopResult.wasRunning && !stopResult.ok) {
-      logError(
-        `runner restart: stop failed: ${stopResult.message ?? "unknown"}`
-      );
-      return 1;
-    }
-    const startResult = await (deps.startDetachedRunner ?? defaultStartDetachedRunner)({ log: (msg) => logOut(msg) });
-    if (flags.json) {
-      logOut(JSON.stringify({ restart: true, ...startResult }));
-    } else if (startResult.ok) {
-      logOut(
-        startResult.connected ? "runner: restarted and connected" : "runner: restarted; socket not yet verified"
-      );
-    } else {
-      logError(`runner restart: ${startResult.message ?? "unknown"}`);
-    }
-    return startResult.ok ? 0 : 1;
-  }
-  if (subcommand === "install") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner install: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const installer = deps.installServiceUnit ?? defaultInstallServiceUnit;
-    const result = installer();
-    if (flags.json) {
-      logOut(JSON.stringify(result));
-    } else if (result.ok) {
-      logOut(`runner: wrote service unit at ${result.path}`);
-      logOut(`runner: load with: ${result.loadCommand}`);
-      logOut(`runner: start with: ${result.startCommand}`);
-    } else {
-      logError(`runner install: ${result.message ?? "unsupported platform"}`);
-    }
-    return result.ok ? 0 : 1;
-  }
-  if (subcommand === "doctor") {
-    let reportDoctor2 = function(ok) {
-      if (flags.json) {
-        logOut(
-          JSON.stringify({
-            ok,
-            paired: true,
-            instanceId: config.instanceId,
-            dashboardUrl: config.dashboardUrl,
-            pairedAt: config.pairedAt,
-            ...refreshed?.lastRefreshAt !== void 0 ? { lastRefreshAt: refreshed.lastRefreshAt } : {},
-            configPath: configPath(),
-            ...runnerReport ? { runner: runnerReport } : {}
-          })
-        );
-      } else {
-        logOut(
-          `runner: paired to ${config.dashboardUrl} as ${config.instanceId}`
-        );
-        if (token) {
-          logOut(`runner: refresh token rotated, access token minted`);
-        }
-        if (runnerReport) {
-          if (runnerReport.matches) {
-            logOut(
-              `runner: runner ${runnerReport.id} bound to this instance (executionTarget=remote, remoteInstanceId=${runnerReport.remoteInstanceId})`
-            );
-          } else {
-            logError(
-              `runner doctor: runner ${runnerReport.id} not bound \u2014 ${runnerReport.error ?? "unknown reason"}`
-            );
-          }
-        }
-      }
-      return ok ? 0 : 1;
-    };
-    var reportDoctor = reportDoctor2;
-    if (subcommandArgs.length > 0) {
-      logError(`runner doctor: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const config = readConfig2();
-    if (!config) {
-      if (flags.json) {
-        logOut(JSON.stringify({ ok: false, paired: false }));
-      } else {
-        logOut("runner: not paired");
-        logOut('runner doctor: run "drisp runner pair" before using doctor.');
-      }
-      return 1;
-    }
-    let token = null;
-    if (flags.runner) {
-      const refreshResult = await tryRefresh("refresh");
-      if (!refreshResult.ok) return refreshResult.code;
-      token = refreshResult.token;
-    }
-    const refreshed = readConfig2();
-    let runnerReport;
-    let runnerOk = !flags.runner;
-    if (flags.runner && token) {
-      const runnerId = flags.runner;
-      const accessToken = token.accessToken;
-      const expectedInstanceId = token.instanceId;
-      const url = new URL(
-        `/api/runners/${encodeURIComponent(runnerId)}`,
-        config.dashboardUrl
-      ).toString();
-      let response;
-      try {
-        response = await fetchImpl(url, {
-          method: "GET",
-          headers: {
-            authorization: `Bearer ${accessToken}`,
-            accept: "application/json"
-          }
-        });
-      } catch (err) {
-        runnerOk = false;
-        runnerReport = {
-          id: runnerId,
-          matches: false,
-          error: `request failed: ${err instanceof Error ? err.message : String(err)}`
-        };
-        return reportDoctor2(false);
-      }
-      if (response.status === 404) {
-        runnerOk = false;
-        runnerReport = {
-          id: runnerId,
-          matches: false,
-          error: "runner not found"
-        };
-      } else if (response.status === 405 || response.status === 501) {
-        runnerOk = false;
-        runnerReport = {
-          id: runnerId,
-          matches: false,
-          error: "runner check unavailable: dashboard endpoint missing (GET /api/runners/<id>)"
-        };
-      } else if (!response.ok) {
-        runnerOk = false;
-        const message = await safeReadError(response);
-        runnerReport = {
-          id: runnerId,
-          matches: false,
-          error: `dashboard returned ${response.status}${message ? ` \u2014 ${message}` : ""}`
-        };
-      } else {
-        let body;
-        try {
-          body = await response.json();
-        } catch (err) {
-          runnerOk = false;
-          runnerReport = {
-            id: runnerId,
-            matches: false,
-            error: `invalid response body: ${err instanceof Error ? err.message : String(err)}`
-          };
-          return reportDoctor2(false);
-        }
-        const obj = typeof body === "object" && body !== null ? body : {};
-        const executionTarget = typeof obj["executionTarget"] === "string" ? obj["executionTarget"] : void 0;
-        const remoteInstanceId = typeof obj["remoteInstanceId"] === "string" ? obj["remoteInstanceId"] : void 0;
-        const matchesTarget = executionTarget === "remote";
-        const matchesInstance = remoteInstanceId === expectedInstanceId;
-        const matches = matchesTarget && matchesInstance;
-        runnerOk = matches;
-        const reasons = [];
-        if (!matchesTarget) {
-          reasons.push(
-            `executionTarget is "${executionTarget ?? "unset"}" (expected "remote")`
-          );
-        }
-        if (!matchesInstance) {
-          reasons.push(
-            `remoteInstanceId is "${remoteInstanceId ?? "unset"}" (expected "${expectedInstanceId}")`
-          );
-        }
-        runnerReport = {
-          id: runnerId,
-          executionTarget,
-          remoteInstanceId,
-          matches,
-          error: reasons.length > 0 ? reasons.join("; ") : void 0
-        };
-      }
-    }
-    return reportDoctor2(runnerOk);
-  }
-  if (subcommand === "console") {
-    const message = "dashboard console is deprecated; paired dashboard feed sync now routes dashboard UI and channel decisions.";
-    if (flags.json) {
-      logOut(JSON.stringify({ ok: false, deprecated: true, message }));
-    } else {
-      logError(message);
-    }
-    return 1;
-  }
-  if (subcommand === "list") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner list: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const config = readConfig2();
-    if (!config) {
-      if (flags.json) {
-        logOut(JSON.stringify({ ok: false, paired: false }));
-      } else {
-        logError('runner list: not paired. Run "drisp runner pair" first.');
-      }
-      return 1;
-    }
-    const mirror = readMirror();
-    if (!mirror) {
-      if (flags.json) {
-        logOut(
-          JSON.stringify({
-            ok: true,
-            paired: true,
-            instanceId: config.instanceId,
-            attachments: [],
-            mirror: null
-          })
-        );
-      } else {
-        logOut(
-          `runner list: paired as ${config.instanceId}, no attachment mirror on disk.`
-        );
-        logOut(
-          "runner list: re-run `drisp runner pair` to refresh the mirror."
-        );
-      }
-      return 0;
-    }
-    if (flags.json) {
-      logOut(
-        JSON.stringify({
-          ok: true,
-          paired: true,
-          instanceId: mirror.instanceId,
-          fetchedAt: mirror.fetchedAt,
-          attachments: mirror.attachments
-        })
-      );
-    } else {
-      logOut(`runner: instance ${mirror.instanceId}`);
-      logOut(
-        `runner: mirror fetched ${new Date(mirror.fetchedAt).toISOString()}`
-      );
-      if (mirror.attachments.length === 0) {
-        logOut("runner: no runners attached.");
-      } else {
-        logOut(`runner: ${mirror.attachments.length} runner(s) attached:`);
-        for (const a of mirror.attachments) {
-          const label = a.name ? `${a.name} (${a.runnerId})` : a.runnerId;
-          const target = a.executionTarget ? ` [${a.executionTarget}]` : "";
-          logOut(`  - ${label}${target}`);
-        }
-      }
-    }
-    return 0;
-  }
-  if (subcommand === "unpair") {
-    if (subcommandArgs.length > 0) {
-      logError(`runner unpair: unexpected argument ${subcommandArgs[0]}`);
-      return 2;
-    }
-    const config = readConfig2();
-    if (!config) {
-      if (flags.json) {
-        logOut(JSON.stringify({ ok: true, paired: false }));
-      } else {
-        logOut("runner unpair: not paired (nothing to do)");
-      }
-      return 0;
-    }
-    const stopResult = await (deps.stopRunner ?? defaultStopRunner)({});
-    if (!flags.json) {
-      if (stopResult.wasRunning) {
-        if (stopResult.ok) {
-          logOut("runner: stopped");
-        } else {
-          logError(`runner: stop failed: ${stopResult.message ?? "unknown"}`);
-        }
-      } else {
-        logOut("runner: not running (skipping stop)");
-      }
-    }
-    let revokeOk = false;
-    let revokeMessage;
-    try {
-      const refreshResult = await tryRefresh("refresh");
-      if (refreshResult.ok) {
-        const url = new URL(
-          `/api/instances/${encodeURIComponent(config.instanceId)}/revoke`,
-          config.dashboardUrl
-        ).toString();
-        const response = await fetchImpl(url, {
-          method: "POST",
-          headers: {
-            authorization: `Bearer ${refreshResult.token.accessToken}`,
-            "content-type": "application/json"
-          },
-          body: JSON.stringify({})
-        });
-        if (response.ok || response.status === 404) {
-          revokeOk = true;
-        } else {
-          const detail = await safeReadError(response);
-          revokeMessage = `dashboard returned ${response.status}${detail ? ` \u2014 ${detail}` : ""}`;
-        }
-      } else {
-        revokeMessage = "could not refresh access token";
-      }
-    } catch (err) {
-      revokeMessage = err instanceof Error ? err.message : String(err);
-    }
-    if (!flags.json) {
-      if (revokeOk) {
-        logOut(`runner: revoking refresh token at ${config.dashboardUrl}`);
-        logOut("runner: refresh token revoked");
-      } else {
-        logError(
-          `runner: revoke failed${revokeMessage ? `: ${revokeMessage}` : ""}`
-        );
-        logOut(
-          "runner: WARNING \u2014 refresh token may still be valid until you revoke it from the dashboard UI."
-        );
-      }
-    }
-    removeConfig();
-    removeMirror();
-    if (flags.json) {
-      logOut(
-        JSON.stringify({
-          ok: true,
-          runner: stopResult,
-          revoke: {
-            ok: revokeOk,
-            ...revokeMessage ? { message: revokeMessage } : {}
-          }
-        })
-      );
-    } else {
-      logOut(
-        `runner: unpaired (credentials removed${stopResult.wasRunning ? ", runner stopped" : ""})`
-      );
-    }
-    return 0;
-  }
-  logError(`Unknown runner subcommand: ${subcommand}`);
-  logError(USAGE3);
-  return 2;
-}
-function resolveRunnerEntry() {
-  let here;
-  try {
-    here = fileURLToPath(import.meta.url);
-  } catch {
-    return null;
-  }
-  const candidates = [
-    path6.join(path6.dirname(here), "runner.js"),
-    // When invoked via `npm run start`, `here` may be the unbundled source
-    // path. Walk up until we hit a `dist/` sibling.
-    path6.join(path6.dirname(here), "..", "..", "..", "dist", "runner.js")
-  ];
-  for (const candidate of candidates) {
-    try {
-      fs6.accessSync(candidate, fs6.constants.R_OK);
-      return candidate;
-    } catch {
-    }
-  }
-  return null;
-}
-var RUNNER_ENV_ALLOWLIST = [
-  "HOME",
-  "PATH",
-  "LANG",
-  "LC_ALL",
-  "ATHENA_DASHBOARD_ORIGIN"
-];
-function buildRunnerEnv(env2) {
-  const out = {};
-  for (const key of RUNNER_ENV_ALLOWLIST) {
-    if (env2[key] !== void 0) out[key] = env2[key];
-  }
-  for (const [key, value] of Object.entries(env2)) {
-    if (key.startsWith("XDG_") && value !== void 0) {
-      out[key] = value;
-    }
-  }
-  return out;
-}
-function readRunnerPid(paths) {
-  const current = readPidLock(paths.pidPath);
-  if (current.state === "held") return { ...current, pidPath: paths.pidPath };
-  const legacy = readPidLock(paths.legacyPidPath);
-  if (legacy.state === "held") return { ...legacy, pidPath: paths.legacyPidPath };
-  return { ...current, pidPath: paths.pidPath };
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
-}
-var SOCKET_PROBE_TIMEOUT_MS = 1e4;
-var SOCKET_PROBE_INTERVAL_MS = 200;
-async function defaultStartDetachedRunner(opts) {
-  const paths = runnerStatePaths();
-  const existing = readRunnerPid(paths);
-  if (existing.state === "held") {
-    return {
-      ok: false,
-      pid: existing.pid,
-      message: alreadyRunningMessage(existing.pid, existing.pidPath)
-    };
-  }
-  const entry = resolveRunnerEntry();
-  if (!entry) {
-    return { ok: false, message: "cannot resolve runner.js entry path" };
-  }
-  let child;
-  try {
-    child = spawn(process.execPath, [entry], {
-      detached: true,
-      stdio: "ignore",
-      env: buildRunnerEnv(process.env)
-    });
-  } catch (err) {
-    return {
-      ok: false,
-      message: err instanceof Error ? err.message : String(err)
-    };
-  }
-  child.unref();
-  let earlyExit;
-  let spawnError;
-  const onError = (err) => {
-    spawnError = err.message;
-  };
-  const onExit = (code, signal) => {
-    earlyExit = `runner exited early (code=${code ?? "null"}, signal=${signal ?? "null"})`;
-  };
-  child.once("error", onError);
-  child.once("exit", onExit);
-  const probeDeadline = Date.now() + SOCKET_PROBE_TIMEOUT_MS;
-  let connected = false;
-  let everReached = false;
-  let pid;
-  while (Date.now() < probeDeadline) {
-    if (spawnError) break;
-    if (earlyExit) break;
-    const report = defaultReadRunnerStatus();
-    if (report.running) {
-      everReached = true;
-      pid = report.status.pid;
-      if (report.status.socketConnected) {
-        connected = true;
-        break;
-      }
-    }
-    await new Promise((r) => setTimeout(r, SOCKET_PROBE_INTERVAL_MS));
-  }
-  child.off("error", onError);
-  child.off("exit", onExit);
-  if (spawnError) {
-    return { ok: false, message: `runner failed to start: ${spawnError}` };
-  }
-  if (earlyExit && !connected) {
-    return { ok: false, message: earlyExit };
-  }
-  if (!connected && !everReached) {
-    return {
-      ok: false,
-      message: `runner did not report status within ${SOCKET_PROBE_TIMEOUT_MS}ms (see ${paths.logPath})`
-    };
-  }
-  opts.log(
-    connected ? `runner: socket verified${pid !== void 0 ? ` (pid ${pid})` : ""}` : "runner: started but socket not yet connected"
-  );
-  return {
-    ok: true,
-    connected,
-    ...pid !== void 0 ? { pid } : {},
-    message: connected ? "started, socket verified" : "started, socket not yet verified"
-  };
-}
-async function defaultStopRunner(opts = {}) {
-  const paths = runnerStatePaths();
-  const existing = readRunnerPid(paths);
-  if (existing.state !== "held") {
-    return { ok: true, wasRunning: false, message: "runner not running" };
-  }
-  try {
-    process.kill(existing.pid, "SIGTERM");
-  } catch (err) {
-    if (err.code === "ESRCH") {
-      return { ok: true, wasRunning: false, message: "runner not running" };
-    }
-    return {
-      ok: false,
-      wasRunning: true,
-      message: err instanceof Error ? err.message : String(err)
-    };
-  }
-  const deadline = Date.now() + (opts.timeoutMs ?? 5e3);
-  while (Date.now() < deadline) {
-    const after = readPidLock(existing.pidPath);
-    if (after.state !== "held" || after.pid !== existing.pid) {
-      return { ok: true, wasRunning: true };
-    }
-    await new Promise((r) => setTimeout(r, 100));
-  }
-  return { ok: false, wasRunning: true, message: "runner did not exit in time" };
-}
-function defaultReadRunnerStatus() {
-  const paths = runnerStatePaths();
-  const existing = readRunnerPid(paths);
-  if (existing.state !== "held") {
-    return { running: false, error: "runner not running" };
-  }
-  const status = readRunnerStatusFile(paths.statusPath);
-  if (!status || status.pid !== existing.pid || !isProcessAlive(status.pid)) {
-    return {
-      running: false,
-      error: `runner pid ${existing.pid} is alive but has not written ${paths.statusPath} yet`
-    };
-  }
-  return { running: true, status };
-}
-async function defaultTailRunnerLog(opts) {
-  const paths = runnerStatePaths();
-  let stream2 = null;
-  let watcher = null;
-  try {
-    const stat = fs6.statSync(paths.logPath);
-    const size = stat.size;
-    const buf = Buffer.alloc(Math.min(size, opts.tail * 1024));
-    const fd = fs6.openSync(paths.logPath, "r");
-    try {
-      fs6.readSync(fd, buf, 0, buf.length, Math.max(0, size - buf.length));
-    } finally {
-      fs6.closeSync(fd);
-    }
-    const lines = buf.toString("utf-8").split("\n").filter((l) => l.length > 0);
-    const tail = lines.slice(-opts.tail);
-    for (const line of tail) {
-      process.stdout.write(line + "\n");
-    }
-    if (!opts.follow) return 0;
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      process.stderr.write(
-        `runner logs: log file ${paths.logPath} does not exist yet
-`
-      );
-      return opts.follow ? 0 : 1;
-    }
-    throw err;
-  }
-  let position = fs6.statSync(paths.logPath).size;
-  return await new Promise((resolve) => {
-    let pollTimer = null;
-    const drain = () => {
-      try {
-        const stat = fs6.statSync(paths.logPath);
-        if (stat.size < position) {
-          position = 0;
-        }
-        if (stat.size > position) {
-          const fd = fs6.openSync(paths.logPath, "r");
-          const buf = Buffer.alloc(stat.size - position);
-          try {
-            fs6.readSync(fd, buf, 0, buf.length, position);
-          } finally {
-            fs6.closeSync(fd);
-          }
-          position = stat.size;
-          process.stdout.write(buf);
-        }
-      } catch (err) {
-        if (err.code !== "ENOENT") {
-          process.stderr.write(
-            `runner logs: tail error: ${err instanceof Error ? err.message : String(err)}
-`
-          );
-        }
-      }
-    };
-    try {
-      watcher = fs6.watch(paths.logPath, { persistent: true }, () => {
-        drain();
-      });
-    } catch {
-      pollTimer = setInterval(drain, 500);
-      pollTimer.unref();
-    }
-    const onSignal = () => {
-      if (watcher) {
-        watcher.close();
-        watcher = null;
-      }
-      if (pollTimer) {
-        clearInterval(pollTimer);
-        pollTimer = null;
-      }
-      if (stream2) {
-        stream2.close();
-        stream2 = null;
-      }
-      resolve(0);
-    };
-    process.once("SIGINT", onSignal);
-    process.once("SIGTERM", onSignal);
-  });
-}
-function formatDuration2(seconds) {
-  if (!Number.isFinite(seconds) || seconds < 0) return "?";
-  if (seconds < 60) return `${seconds}s`;
-  if (seconds < 3600) {
-    const m = Math.floor(seconds / 60);
-    const s = seconds % 60;
-    return s > 0 ? `${m}m${s}s` : `${m}m`;
-  }
-  if (seconds < 86400) {
-    const h2 = Math.floor(seconds / 3600);
-    const m = Math.floor(seconds % 3600 / 60);
-    return m > 0 ? `${h2}h${m}m` : `${h2}h`;
-  }
-  const d = Math.floor(seconds / 86400);
-  const h = Math.floor(seconds % 86400 / 3600);
-  return h > 0 ? `${d}d${h}h` : `${d}d`;
-}
-async function fetchRunnerHealth(fetchImpl, dashboardUrl, runnerId, token) {
-  const url = new URL(
-    `/api/runners/${encodeURIComponent(runnerId)}`,
-    dashboardUrl
-  ).toString();
-  let response;
-  try {
-    response = await fetchImpl(url, {
-      method: "GET",
-      headers: {
-        authorization: `Bearer ${token.accessToken}`,
-        accept: "application/json"
-      }
-    });
-  } catch (err) {
-    return {
-      id: runnerId,
-      matches: false,
-      error: `request failed: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  if (!response.ok) {
-    return {
-      id: runnerId,
-      matches: false,
-      error: `dashboard returned ${response.status}`
-    };
-  }
-  let body;
-  try {
-    body = await response.json();
-  } catch (err) {
-    return {
-      id: runnerId,
-      matches: false,
-      error: `invalid response body: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  const obj = typeof body === "object" && body !== null ? body : {};
-  const executionTarget = typeof obj["executionTarget"] === "string" ? obj["executionTarget"] : void 0;
-  const remoteInstanceId = typeof obj["remoteInstanceId"] === "string" ? obj["remoteInstanceId"] : void 0;
-  const matches = executionTarget === "remote" && remoteInstanceId === token.instanceId;
-  const reasons = [];
-  if (executionTarget !== "remote") {
-    reasons.push(
-      `executionTarget=${executionTarget ?? "unset"} (expected "remote")`
-    );
-  }
-  if (remoteInstanceId !== token.instanceId) {
-    reasons.push(
-      `remoteInstanceId=${remoteInstanceId ?? "unset"} (expected "${token.instanceId}")`
-    );
-  }
-  return {
-    id: runnerId,
-    matches,
-    ...executionTarget !== void 0 ? { executionTarget } : {},
-    ...remoteInstanceId !== void 0 ? { remoteInstanceId } : {},
-    ...reasons.length > 0 ? { error: reasons.join("; ") } : {}
-  };
-}
-function defaultInstallServiceUnit() {
-  const entry = resolveRunnerEntry();
-  if (!entry) {
-    return {
-      ok: false,
-      platform: "unsupported",
-      message: "cannot resolve runner.js entry path"
-    };
-  }
-  return installServiceUnit({
-    runnerEntry: entry,
-    nodeBinary: process.execPath
-  });
-}
-function compareSemver(a, b) {
-  const parseN = (s) => {
-    const parts = s.replace(/^v/, "").split("-")[0].split(".");
-    return [
-      Number.parseInt(parts[0] ?? "0", 10) || 0,
-      Number.parseInt(parts[1] ?? "0", 10) || 0,
-      Number.parseInt(parts[2] ?? "0", 10) || 0
-    ];
-  };
-  const av = parseN(a);
-  const bv = parseN(b);
-  for (let i = 0; i < 3; i += 1) {
-    if (av[i] < bv[i]) return -1;
-    if (av[i] > bv[i]) return 1;
-  }
-  return 0;
-}
-async function safeReadError(response) {
-  try {
-    const text = await response.text();
-    if (text.length === 0) return "";
-    try {
-      const parsed = JSON.parse(text);
-      if (typeof parsed === "object" && parsed !== null && typeof parsed["error"] === "string") {
-        return parsed["error"];
-      }
-    } catch {
-    }
-    return text.length > 200 ? text.slice(0, 200) + "\u2026" : text;
-  } catch {
-    return "";
-  }
-}
-function parsePairResponse(raw) {
-  if (typeof raw !== "object" || raw === null) {
-    throw new Error("expected object");
-  }
-  const obj = raw;
-  const instanceId = obj["instanceId"];
-  const refreshToken = obj["refreshToken"];
-  if (typeof instanceId !== "string" || instanceId.length === 0) {
-    throw new Error("missing instanceId");
-  }
-  if (typeof refreshToken !== "string" || refreshToken.length === 0) {
-    throw new Error("missing refreshToken");
-  }
-  return {
-    instanceId,
-    refreshToken,
-    ...typeof obj["jti"] === "string" ? { jti: obj["jti"] } : {},
-    ...typeof obj["accessToken"] === "string" ? { accessToken: obj["accessToken"] } : {},
-    ...typeof obj["expiresInSec"] === "number" ? { expiresInSec: obj["expiresInSec"] } : {},
-    ...Array.isArray(obj["runners"]) ? {
-      runners: obj["runners"].map(parsePairedRunner).filter((runner) => runner !== null)
-    } : {},
-    ...typeof obj["requiredCliVersion"] === "string" ? { requiredCliVersion: obj["requiredCliVersion"] } : {},
-    ...typeof obj["capabilityAck"] === "object" && obj["capabilityAck"] !== null ? { capabilityAck: parseCapabilityAck(obj["capabilityAck"]) } : {}
-  };
-}
-function parseCapabilityAck(raw) {
-  if (typeof raw !== "object" || raw === null) return {};
-  const obj = raw;
-  const ack = {};
-  if (typeof obj["runtimeDaemon"] === "boolean") {
-    ack.runtimeDaemon = obj["runtimeDaemon"];
-  }
-  if (typeof obj["instanceSocket"] === "boolean") {
-    ack.instanceSocket = obj["instanceSocket"];
-  }
-  return ack;
-}
-function parsePairedRunner(raw) {
-  if (typeof raw !== "object" || raw === null) return null;
-  const obj = raw;
-  const runnerId = obj["runnerId"];
-  if (typeof runnerId !== "string" || runnerId.length === 0) return null;
-  return {
-    runnerId,
-    ...typeof obj["name"] === "string" ? { name: obj["name"] } : {},
-    ...typeof obj["executionTarget"] === "string" ? { executionTarget: obj["executionTarget"] } : {},
-    ...typeof obj["remoteInstanceId"] === "string" ? { remoteInstanceId: obj["remoteInstanceId"] } : {}
-  };
-}
-
-// src/app/entry/dashboardCommand.ts
-var DASHBOARD_DEPRECATION_NOTICE = "drisp dashboard is deprecated and is removed in 0.7.0; use drisp runner instead.";
-function mapDashboardToRunner(input) {
-  const { subcommand, subcommandArgs, flags } = input;
-  const runner = (next, args = [], extraFlags = {}) => ({
-    kind: "runner",
-    input: {
-      subcommand: next,
-      subcommandArgs: args,
-      flags: { ...flags, ...extraFlags }
-    }
-  });
-  if (subcommand === "" || subcommand === "help" || subcommand === "--help") {
-    return runner("help");
-  }
-  if (subcommand === "connect") return runner("", subcommandArgs);
-  if (subcommand === "daemon") {
-    const [mode, ...rest] = subcommandArgs;
-    switch (mode) {
-      case "foreground":
-        return runner("", rest);
-      case "start":
-        return runner("", rest, { detach: true });
-      case "stop":
-      case "restart":
-      case "install":
-        return runner(mode, rest);
-      case "reload":
-        return {
-          kind: "noop",
-          message: 'runner: reload is a no-op (the runner re-reads its pairing on every reconnect); use "drisp runner restart" to cycle it.'
-        };
-      default:
-        return runner("daemon", subcommandArgs);
-    }
-  }
-  return runner(subcommand, subcommandArgs);
-}
-async function runDashboardCommand(input, deps = {}) {
-  const logOut = deps.logOut ?? ((m) => process.stdout.write(m + "\n"));
-  const logError = deps.logError ?? ((m) => process.stderr.write(m + "\n"));
-  logError(DASHBOARD_DEPRECATION_NOTICE);
-  const mapped = mapDashboardToRunner(input);
-  if (mapped.kind === "noop") {
-    logOut(mapped.message);
-    return 0;
-  }
-  return runRunnerCommand(mapped.input, deps);
+  throw new Error(`No Runner on this machine holds Run ${runId}.`);
 }
 
 // src/app/entry/doctorCommand.ts
@@ -14535,9 +13518,9 @@ import process7 from "process";
 
 // src/harnesses/claude/system/doctorEnvironment.ts
 import { execFileSync } from "child_process";
-import * as fs7 from "fs";
-import * as os6 from "os";
-import * as path7 from "path";
+import * as fs5 from "fs";
+import * as os4 from "os";
+import * as path5 from "path";
 var MANAGED_POLICY_KEYS = [
   "forceLoginMethod",
   "forceLoginOrgUUID",
@@ -14633,20 +13616,20 @@ function tryRichAuth(claudeBinary) {
   }
 }
 function collectEnvironment(options = {}) {
-  const platform = options.platform ?? process.platform;
+  const platform2 = options.platform ?? process.platform;
   const env2 = options.env ?? process.env;
-  const homeDir = options.homeDir ?? os6.homedir();
+  const homeDir = options.homeDir ?? os4.homedir();
   const cwd = options.cwd ?? process.cwd();
   const resolveBinary = options.resolveClaudeBinaryFn ?? resolveClaudeBinary;
   const detectVersion = options.detectClaudeVersionFn ?? detectClaudeVersion;
   const runAuthStatus = options.runClaudeAuthStatusFn ?? runClaudeAuthStatus;
   const resolveForwarder = options.resolveHookForwarderCommandFn ?? resolveHookForwarderCommand;
-  const statFn = options.statFn ?? ((p) => fs7.statSync(p));
-  const readFileFn = options.readFileFn ?? ((p) => fs7.readFileSync(p, "utf8"));
+  const statFn = options.statFn ?? ((p) => fs5.statSync(p));
+  const readFileFn = options.readFileFn ?? ((p) => fs5.readFileSync(p, "utf8"));
   const settingsPaths = resolveClaudeSettingsSurfacePaths(
     homeDir,
     cwd,
-    platform,
+    platform2,
     env2
   );
   const claudeBinary = resolveBinary();
@@ -14687,14 +13670,14 @@ function collectEnvironment(options = {}) {
   });
   let globalConfigPresent = false;
   try {
-    statFn(path7.join(homeDir, ".claude.json"));
+    statFn(path5.join(homeDir, ".claude.json"));
     globalConfigPresent = true;
   } catch {
     globalConfigPresent = false;
   }
   const hookForwarder = resolveForwarder();
   return {
-    platform,
+    platform: platform2,
     cwd,
     claudeBinary,
     claudeVersion,
@@ -15167,20 +14150,20 @@ function runRunsCommand(input) {
 // src/app/entry/cli.tsx
 import { jsx as jsx24 } from "react/jsx-runtime";
 function resolvePackageJsonPath(entryUrl) {
-  let currentDir = path8.dirname(fileURLToPath2(entryUrl));
+  let currentDir = path6.dirname(fileURLToPath(entryUrl));
   for (; ; ) {
-    const candidatePath = path8.join(currentDir, "package.json");
-    if (fs8.existsSync(candidatePath)) {
+    const candidatePath = path6.join(currentDir, "package.json");
+    if (fs6.existsSync(candidatePath)) {
       return candidatePath;
     }
-    const parentDir = path8.dirname(currentDir);
+    const parentDir = path6.dirname(currentDir);
     if (parentDir === currentDir) {
       throw new Error("Could not locate package.json for CLI metadata.");
     }
     currentDir = parentDir;
   }
 }
-var require2 = createRequire2(import.meta.url);
+var require2 = createRequire(import.meta.url);
 var { version } = require2(resolvePackageJsonPath(import.meta.url));
 var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "setup",
@@ -15221,7 +14204,7 @@ async function flushTelemetryOptOut(config) {
     deviceId: deviceId2,
     telemetryEnabled: config.telemetry,
     appVersion: version,
-    os: `${os7.platform()}-${os7.arch()}`
+    os: `${os5.platform()}-${os5.arch()}`
   });
   trackTelemetryOptedOut();
   await shutdownTelemetry();
@@ -15339,9 +14322,8 @@ var cli = meow(
 			mcp <sub>             Manage personal MCP servers (add, remove, list)
 			skill <sub>           Manage personal skills (install, remove, list)
 			marketplace <sub>     Manage marketplace sources (add, refresh, remove, list)
-			runner [sub]          Run the runner that pairs this machine with the hub and executes its Runs
-			                      (no subcommand: foreground; --detach: background; status, stop, restart,
-			                      logs, runs, install, pair, unpair, refresh, doctor, list)
+			runner [sub]          Run the runner that connects this machine to a Team and executes its Runs
+			                      (no subcommand: foreground; connect [code] --hub <url> [--replace], disconnect [team], status, recover, help)
 			telemetry [action]    Manage anonymous telemetry (enable/disable/status)
 			doctor                Diagnose Claude headless setup (use with --harness=claude)
 
@@ -15369,9 +14351,6 @@ var cli = meow(
 			--ephemeral     Do not persist Athena session data (run mode)
 			--timeout-ms    Hard timeout for the run in milliseconds
 			--workflow      Override the active workflow for this run only (no config change)
-			--detach        Start the runner in the background (runner)
-			--url           Dashboard origin (runner pair)
-			--name          Friendly machine name (runner pair)
 			--dry-run       Print resolved bootstrap (workflow, isolation, plugins, harness) and exit (run mode)
 			--project       Scope workflow command to project config (workflow use)
 			--global        Scope workflow command to global config (workflow use, default)
@@ -15466,33 +14445,21 @@ var cli = meow(
       workflow: {
         type: "string"
       },
-      url: {
-        type: "string"
-      },
-      name: {
-        type: "string"
-      },
-      runner: {
+      hub: {
         type: "string"
       },
-      tail: {
-        type: "number"
-      },
-      follow: {
+      foreground: {
         type: "boolean",
         default: false
       },
-      detach: {
+      replace: {
         type: "boolean",
         default: false
       },
-      active: {
+      detach: {
         type: "boolean",
         default: false
       },
-      limit: {
-        type: "number"
-      },
       dryRun: {
         type: "boolean",
         default: false
@@ -15520,7 +14487,7 @@ var cli = meow(
   }
 );
 async function main() {
-  const projectDir = path8.resolve(cli.flags.projectDir);
+  const projectDir = path6.resolve(cli.flags.projectDir);
   const [command, ...commandArgs] = cli.input;
   const isRunCommand = command === "run" || command === "exec";
   if (command && !KNOWN_COMMANDS.has(command)) {
@@ -15570,7 +14537,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
         await exitWith(1);
         return;
       }
-      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-R76OV74M.js");
+      const { default: WorkflowInstallWizard } = await import("./WorkflowInstallWizard-TQ4SF5KB.js");
       const { waitUntilExit } = render(
         /* @__PURE__ */ jsx24(
           WorkflowInstallWizard,
@@ -15632,23 +14599,18 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
   }
   if (command === "runner" || command === "dashboard") {
     const [subcommand = "", ...subcommandArgs] = commandArgs;
-    const input = {
-      subcommand,
-      subcommandArgs,
-      flags: {
-        url: typeof cli.flags.url === "string" ? cli.flags.url : void 0,
-        name: typeof cli.flags.name === "string" ? cli.flags.name : void 0,
-        runner: typeof cli.flags.runner === "string" ? cli.flags.runner : void 0,
-        json: Boolean(cli.flags.json),
-        ...cli.flags.detach ? { detach: true } : {},
-        ...typeof cli.flags.tail === "number" ? { tail: cli.flags.tail } : {},
-        ...cli.flags.follow ? { follow: true } : {},
-        ...cli.flags.active ? { active: true } : {},
-        ...typeof cli.flags.limit === "number" ? { limit: cli.flags.limit } : {}
-      }
-    };
     await exitWith(
-      command === "runner" ? await runRunnerCommand(input) : await runDashboardCommand(input)
+      await runRunnerCommandV2({
+        subcommand,
+        subcommandArgs,
+        flags: {
+          json: Boolean(cli.flags.json),
+          ...cli.flags.detach ? { detach: true } : {},
+          ...typeof cli.flags.hub === "string" ? { hub: cli.flags.hub } : {},
+          ...cli.flags.foreground ? { foreground: true } : {},
+          ...cli.flags.replace ? { replace: true } : {}
+        }
+      })
     );
     return;
   }
@@ -15725,8 +14687,8 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
   const showSetup = isRunCommand ? false : shouldShowSetup({
     cliInput: cli.input,
     setupComplete: globalConfig.setupComplete,
-    globalConfigExists: fs8.existsSync(
-      path8.join(os7.homedir(), ".config", "athena", "config.json")
+    globalConfigExists: fs6.existsSync(
+      path6.join(os5.homedir(), ".config", "athena", "config.json")
     )
   });
   let runtimeConfig;
@@ -15783,7 +14745,7 @@ Available commands: ${[...KNOWN_COMMANDS].join(", ")}`
     deviceId: resolvedDeviceId,
     telemetryEnabled: globalConfig.telemetry,
     appVersion: version,
-    os: `${os7.platform()}-${os7.arch()}`
+    os: `${os5.platform()}-${os5.arch()}`
   });
   trackAppLaunched({ version, harness: runtimeConfig.harness });
   if (!isRunCommand && isFirstRun && globalConfig.telemetry !== false) {