@jmoyers/harness 0.1.9 → 0.1.11

package/scripts/codex-live-mux-runtime.ts

@@ -25,7 +25,7 @@ import {
 } from '../src/config/config-core.ts';
 import { resolveHarnessRuntimePath } from '../src/config/harness-paths.ts';
 import { migrateLegacyHarnessLayout } from '../src/config/harness-runtime-migration.ts';
-import { loadHarnessSecrets } from '../src/config/secrets-core.ts';
+import { loadHarnessSecrets, upsertHarnessSecret } from '../src/config/secrets-core.ts';
 import { detectMuxGlobalShortcut, resolveMuxShortcutBindings } from '../src/mux/input-shortcuts.ts';
 import { createMuxInputModeManager } from '../src/mux/terminal-input-modes.ts';
 import type { buildWorkspaceRailViewRows } from '../src/mux/workspace-rail-model.ts';
@@ -92,7 +92,9 @@ import {
 } from '../src/mux/live-mux/layout.ts';
 import {
   normalizeGitHubRemoteUrl,
+  resolveGitHubDefaultBranchForActions,
   repositoryNameFromGitHubRemoteUrl,
+  resolveGitHubTrackedBranchForActions,
   shouldShowGitHubPrActions,
 } from '../src/mux/live-mux/git-parsing.ts';
 import { readProcessUsageSample, runGitCommand } from '../src/mux/live-mux/git-snapshot.ts';
@@ -243,6 +245,7 @@ interface RuntimeCommandMenuContext {
   readonly leftNavSelectionKind: WorkspaceModel['leftNavSelection']['kind'];
   readonly profileRunning: boolean;
   readonly statusTimelineRunning: boolean;
+  readonly githubRepositoryId: string | null;
   readonly githubRepositoryUrl: string | null;
   readonly githubDefaultBranch: string | null;
   readonly githubTrackedBranch: string | null;
@@ -257,12 +260,26 @@ interface CommandMenuGitHubProjectPrState {
   readonly loading: boolean;
 }
 
+interface GitHubDebugAuthState {
+  enabled: boolean;
+  token: 'env' | 'gh' | 'none';
+  auth: 'ok' | 'no' | 'er' | 'na' | 'uk';
+  projectPr: 'ok' | 'er' | 'na';
+}
+
 interface ThemePickerSessionState {
   readonly initialThemeConfig: HarnessMuxThemeConfig | null;
   committed: boolean;
   previewActionId: string | null;
 }
 
+interface AllowedCommandMenuApiKey {
+  readonly actionIdSuffix: string;
+  readonly envVar: 'ANTHROPIC_API_KEY' | 'OPENAI_API_KEY';
+  readonly displayName: string;
+  readonly aliases: readonly string[];
+}
+
 const DEFAULT_RESIZE_MIN_INTERVAL_MS = 33;
 const DEFAULT_PTY_RESIZE_SETTLE_MS = 75;
 const DEFAULT_STARTUP_SETTLE_QUIET_MS = 300;
@@ -282,6 +299,21 @@ const REPOSITORY_COLLAPSE_ALL_CHORD_PREFIX = Buffer.from([0x0b]);
 const UNTRACKED_REPOSITORY_GROUP_ID = 'untracked';
 const THEME_PICKER_SCOPE = 'theme-select';
 const THEME_ACTION_ID_PREFIX = 'theme.set.';
+const API_KEY_ACTION_ID_PREFIX = 'api-key.set.';
+const COMMAND_MENU_ALLOWED_API_KEYS: readonly AllowedCommandMenuApiKey[] = [
+  {
+    actionIdSuffix: 'anthropic',
+    envVar: 'ANTHROPIC_API_KEY',
+    displayName: 'Anthropic API Key',
+    aliases: ['anthropic api key', 'claude api key'],
+  },
+  {
+    actionIdSuffix: 'openai',
+    envVar: 'OPENAI_API_KEY',
+    displayName: 'OpenAI API Key',
+    aliases: ['openai api key', 'codex api key'],
+  },
+];
 const GIT_SUMMARY_LOADING: GitSummary = {
   branch: '(loading)',
   changedFiles: 0,
@@ -331,6 +363,15 @@ function parseGitHubPrUrl(result: Record<string, unknown>): string | null {
   return typeof url === 'string' ? url : null;
 }
 
+function parseGitHubUrl(result: Record<string, unknown>): string | null {
+  const url = result['url'];
+  if (typeof url !== 'string') {
+    return null;
+  }
+  const trimmed = url.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
 function commandMenuProjectPathTail(path: string): string {
   const normalized = path.trim().replaceAll('\\', '/').replace(/\/+$/u, '');
   if (normalized.length === 0) {
@@ -404,6 +445,28 @@ function commandExistsOnPath(command: string): boolean {
   }
 }
 
+function readGhAuthTokenForDebug(): string | null {
+  try {
+    const stdout = execFileSync('gh', ['auth', 'token'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 2000,
+      windowsHide: true,
+    });
+    const token = stdout.trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+function formatGitHubDebugTokens(state: GitHubDebugAuthState): string {
+  if (!state.enabled) {
+    return '[gh:off tk:na au:na pr:na]';
+  }
+  return `[gh:on tk:${state.token} au:${state.auth} pr:${state.projectPr}]`;
+}
+
 async function main(): Promise<number> {
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     process.stderr.write('codex:live:mux requires a TTY stdin/stdout\n');
@@ -502,6 +565,26 @@ async function main(): Promise<number> {
   const resolvedMuxTheme = resolveAndApplyRuntimeTheme(runtimeThemeConfig, true);
   let currentModalTheme = resolvedMuxTheme.theme.modalTheme;
   const configuredMuxGit = loadedConfig.config.mux.git;
+  const githubTokenEnvVar = loadedConfig.config.github.tokenEnvVar;
+  const envGitHubTokenRaw = process.env[githubTokenEnvVar];
+  const hasEnvGitHubToken =
+    typeof envGitHubTokenRaw === 'string' && envGitHubTokenRaw.trim().length > 0;
+  const githubDebugAuthState: GitHubDebugAuthState = {
+    enabled: loadedConfig.config.github.enabled,
+    token: hasEnvGitHubToken ? 'env' : 'none',
+    auth: loadedConfig.config.github.enabled ? (hasEnvGitHubToken ? 'ok' : 'uk') : 'na',
+    projectPr: 'na',
+  };
+  if (githubDebugAuthState.enabled && !hasEnvGitHubToken) {
+    const ghToken = commandExistsOnPath('gh') ? readGhAuthTokenForDebug() : null;
+    if (ghToken !== null) {
+      githubDebugAuthState.token = 'gh';
+      githubDebugAuthState.auth = 'ok';
+    } else {
+      githubDebugAuthState.token = 'none';
+      githubDebugAuthState.auth = 'no';
+    }
+  }
   const configuredCodexLaunch = loadedConfig.config.codex.launch;
   const configuredCritique = loadedConfig.config.critique;
   const codexLaunchModeByDirectoryPath: Record<string, 'yolo' | 'standard'> = {};
@@ -635,7 +718,7 @@ async function main(): Promise<number> {
       await startControlPlaneStreamServer({
         stateStorePath: resolveHarnessRuntimePath(
           options.invocationDirectory,
-          process.env.HARNESS_CONTROL_PLANE_DB_PATH ?? '.harness/control-plane.sqlite',
+          '.harness/control-plane.sqlite',
         ),
         codexTelemetry: loadedConfig.config.codex.telemetry,
         codexHistory: loadedConfig.config.codex.history,
@@ -743,7 +826,7 @@ async function main(): Promise<number> {
   workspace.taskPaneRepositoryEditClickState = null;
   workspace.homePaneDragState = null;
 
-  const sessionEnv = {
+  const sessionEnv: Record<string, string> = {
     ...sanitizeProcessEnv(),
     TERM: process.env.TERM ?? 'xterm-256color',
   };
@@ -1408,12 +1491,47 @@ async function main(): Promise<number> {
       activeDirectoryId === null
         ? null
         : (directoryRepositorySnapshotByDirectoryId.get(activeDirectoryId) ?? null);
+    let githubRepositoryId =
+      activeDirectoryId === null
+        ? null
+        : (repositoryAssociationByDirectoryId.get(activeDirectoryId) ?? null);
+    if (githubRepositoryId !== null) {
+      const associatedRepository = repositories.get(githubRepositoryId);
+      if (associatedRepository === undefined || associatedRepository.archivedAt !== null) {
+        githubRepositoryId = null;
+      }
+    }
+    const snapshotRemoteUrl = activeDirectoryRepositorySnapshot?.normalizedRemoteUrl ?? null;
+    if (githubRepositoryId === null && snapshotRemoteUrl !== null) {
+      const snapshotRemote = normalizeGitHubRemoteUrl(snapshotRemoteUrl);
+      if (snapshotRemote !== null) {
+        for (const repository of repositories.values()) {
+          if (repository.archivedAt !== null) {
+            continue;
+          }
+          if (normalizeGitHubRemoteUrl(repository.remoteUrl) === snapshotRemote) {
+            githubRepositoryId = repository.repositoryId;
+            break;
+          }
+        }
+      }
+    }
+    const githubRepositoryRecord =
+      githubRepositoryId === null ? null : (repositories.get(githubRepositoryId) ?? null);
     const githubProjectPrState =
       activeDirectoryId !== null &&
       commandMenuGitHubProjectPrState !== null &&
       commandMenuGitHubProjectPrState.directoryId === activeDirectoryId
         ? commandMenuGitHubProjectPrState
         : null;
+    const currentBranchForActions =
+      activeDirectoryId === null
+        ? null
+        : (gitSummaryByDirectoryId.get(activeDirectoryId)?.branch ?? null);
+    const trackedBranchForActions = resolveGitHubTrackedBranchForActions({
+      projectTrackedBranch: githubProjectPrState?.branchName ?? null,
+      currentBranch: currentBranchForActions,
+    });
     const selectedText =
       workspace.selection === null
         ? ''
@@ -1433,9 +1551,13 @@ async function main(): Promise<number> {
       statusTimelineRunning: existsSync(
         resolveStatusTimelineStatePath(options.invocationDirectory, muxSessionName),
       ),
+      githubRepositoryId,
       githubRepositoryUrl: activeDirectoryRepositorySnapshot?.normalizedRemoteUrl ?? null,
-      githubDefaultBranch: activeDirectoryRepositorySnapshot?.defaultBranch ?? null,
-      githubTrackedBranch: githubProjectPrState?.branchName ?? null,
+      githubDefaultBranch: resolveGitHubDefaultBranchForActions({
+        repositoryDefaultBranch: githubRepositoryRecord?.defaultBranch ?? null,
+        snapshotDefaultBranch: activeDirectoryRepositorySnapshot?.defaultBranch ?? null,
+      }),
+      githubTrackedBranch: trackedBranchForActions,
       githubOpenPrUrl: githubProjectPrState?.openPrUrl ?? null,
       githubProjectPrLoading: githubProjectPrState?.loading ?? false,
     };
@@ -1502,6 +1624,7 @@ async function main(): Promise<number> {
       resolveCommandMenuActions,
       getNewThreadPrompt: () => workspace.newThreadPrompt,
       getAddDirectoryPrompt: () => workspace.addDirectoryPrompt,
+      getApiKeyPrompt: () => workspace.apiKeyPrompt,
       getTaskEditorPrompt: () => workspace.taskEditorPrompt,
       getRepositoryPrompt: () => workspace.repositoryPrompt,
       getConversationTitleEdit: () => workspace.conversationTitleEdit,
@@ -1707,6 +1830,13 @@ async function main(): Promise<number> {
   };
   const githubAuthHintNotice =
     'GitHub PR actions become available after auth (`gh auth login` or `GITHUB_TOKEN`).';
+  const setGitHubDebugAuthState = (
+    update: Partial<Pick<GitHubDebugAuthState, 'token' | 'auth' | 'projectPr'>>,
+  ): void => {
+    githubDebugAuthState.token = update.token ?? githubDebugAuthState.token;
+    githubDebugAuthState.auth = update.auth ?? githubDebugAuthState.auth;
+    githubDebugAuthState.projectPr = update.projectPr ?? githubDebugAuthState.projectPr;
+  };
   const isGitHubAuthUnavailableError = (error: unknown): boolean => {
     const message = formatErrorMessage(error).toLowerCase();
     return (
@@ -1729,7 +1859,14 @@ async function main(): Promise<number> {
           directoryId,
         });
         commandMenuGitHubProjectPrState = parseGitHubProjectPrState(directoryId, result);
-      } catch {
+        setGitHubDebugAuthState({
+          projectPr: 'ok',
+        });
+      } catch (error: unknown) {
+        setGitHubDebugAuthState({
+          projectPr: 'er',
+          auth: isGitHubAuthUnavailableError(error) ? 'no' : githubDebugAuthState.auth,
+        });
         commandMenuGitHubProjectPrState = {
           directoryId,
           branchName: null,
@@ -2306,6 +2443,7 @@ async function main(): Promise<number> {
     }
     workspace.newThreadPrompt = null;
     workspace.addDirectoryPrompt = null;
+    workspace.apiKeyPrompt = null;
     workspace.taskEditorPrompt = null;
     workspace.repositoryPrompt = null;
     if (workspace.conversationTitleEdit !== null) {
@@ -2517,6 +2655,12 @@ async function main(): Promise<number> {
         },
       });
     },
+    listConversationIdsForTitleRefresh: () => conversationManager.orderedIds(),
+    conversationAgentTypeForTitleRefresh: (sessionId) =>
+      conversationManager.get(sessionId)?.agentType ?? null,
+    refreshConversationTitle: async (sessionId) => {
+      return await controlPlaneService.refreshConversationTitle(sessionId);
+    },
   });
   const runtimeWorkspaceActions = new RuntimeWorkspaceActions({
     conversationActions: conversationLifecycle,
@@ -2539,6 +2683,7 @@ async function main(): Promise<number> {
     }
     workspace.newThreadPrompt = null;
     workspace.addDirectoryPrompt = null;
+    workspace.apiKeyPrompt = null;
     workspace.taskEditorPrompt = null;
     workspace.repositoryPrompt = null;
     if (workspace.conversationTitleEdit !== null) {
@@ -2558,6 +2703,39 @@ async function main(): Promise<number> {
     markDirty();
   };
 
+  const openApiKeyPrompt = (apiKey: AllowedCommandMenuApiKey): void => {
+    workspace.newThreadPrompt = null;
+    workspace.addDirectoryPrompt = null;
+    workspace.taskEditorPrompt = null;
+    workspace.repositoryPrompt = null;
+    if (workspace.conversationTitleEdit !== null) {
+      stopConversationTitleEdit(true);
+    }
+    workspace.conversationTitleEditClickState = null;
+    const existingRaw = sessionEnv[apiKey.envVar] ?? process.env[apiKey.envVar];
+    const hasExistingValue = typeof existingRaw === 'string' && existingRaw.trim().length > 0;
+    workspace.apiKeyPrompt = {
+      keyName: apiKey.envVar,
+      displayName: apiKey.displayName,
+      value: '',
+      error: null,
+      hasExistingValue,
+    };
+    markDirty();
+  };
+
+  const persistApiKey = (keyName: string, value: string): void => {
+    const result = upsertHarnessSecret({
+      cwd: options.invocationDirectory,
+      key: keyName,
+      value,
+    });
+    sessionEnv[keyName] = value;
+    process.env[keyName] = value;
+    const action = result.replacedExisting ? 'updated' : 'saved';
+    setCommandNotice(`${keyName} ${action}`);
+  };
+
   const startThreadFromCommandMenu = (
     directoryId: string,
     agentType: ReturnType<typeof normalizeThreadAgentType>,
@@ -2661,7 +2839,7 @@ async function main(): Promise<number> {
     return [
       {
         id: 'critique.review.unstaged',
-        title: 'Critique AI Review: Unstaged Changes',
+        title: 'Critique AI Review: Unstaged Changes (git)',
         aliases: ['critique unstaged review', 'review unstaged diff', 'ai review unstaged'],
         keywords: ['critique', 'review', 'unstaged', 'diff', 'ai'],
         detail: 'runs critique review',
@@ -2671,7 +2849,7 @@ async function main(): Promise<number> {
       },
       {
         id: 'critique.review.staged',
-        title: 'Critique AI Review: Staged Changes',
+        title: 'Critique AI Review: Staged Changes (git)',
         aliases: ['critique staged review', 'review staged diff', 'ai review staged'],
         keywords: ['critique', 'review', 'staged', 'diff', 'ai'],
         detail: 'runs critique review --staged',
@@ -2681,7 +2859,7 @@ async function main(): Promise<number> {
       },
       {
         id: 'critique.review.base-branch',
-        title: 'Critique AI Review: Current Branch vs Base',
+        title: 'Critique AI Review: Current Branch vs Base (git)',
         aliases: ['critique base review', 'review against base branch', 'ai review base'],
         keywords: ['critique', 'review', 'base', 'branch', 'diff', 'ai'],
         detail: 'runs critique review <base> HEAD',
@@ -2824,6 +3002,21 @@ async function main(): Promise<number> {
     },
   });
 
+  commandMenuRegistry.registerProvider('api-key.set', () => {
+    return COMMAND_MENU_ALLOWED_API_KEYS.map(
+      (apiKey): RegisteredCommandMenuAction<RuntimeCommandMenuContext> => ({
+        id: `${API_KEY_ACTION_ID_PREFIX}${apiKey.actionIdSuffix}`,
+        title: `Set ${apiKey.displayName}`,
+        aliases: [...apiKey.aliases],
+        keywords: ['api', 'key', 'set', apiKey.envVar.toLowerCase()],
+        detail: apiKey.envVar,
+        run: () => {
+          openApiKeyPrompt(apiKey);
+        },
+      }),
+    );
+  });
+
   commandMenuRegistry.registerProvider('theme.set', () => {
     const selectedThemeName = getActiveMuxTheme().name;
     return muxThemePresetNames().map(
@@ -2873,10 +3066,10 @@ async function main(): Promise<number> {
     if (repositoryUrl === null) {
       return [];
     }
-    return [
+    const actions: RegisteredCommandMenuAction<RuntimeCommandMenuContext>[] = [
       {
         id: 'github.repo.open',
-        title: 'Open GitHub for This Repo',
+        title: 'Open GitHub for This Repo (git)',
         aliases: ['open github for this repo', 'open github repo', 'open repository on github'],
         keywords: ['github', 'repository', 'repo', 'open'],
         detail: repositoryUrl,
@@ -2890,6 +3083,41 @@ async function main(): Promise<number> {
         },
       },
     ];
+    if (context.githubRepositoryId !== null) {
+      const repositoryId = context.githubRepositoryId;
+      actions.push({
+        id: 'github.repo.my-prs.open',
+        title: 'Show My Open Pull Requests (git)',
+        aliases: ['show my open pull requests', 'my open pull requests', 'show my prs', 'my prs'],
+        keywords: ['github', 'pr', 'pull-request', 'open', 'my'],
+        detail: repositoryUrl,
+        run: async () => {
+          queueControlPlaneOp(async () => {
+            const result = await streamClient.sendCommand({
+              type: 'github.repo-my-prs-url',
+              repositoryId,
+            });
+            const parsedResult = asRecord(result);
+            if (parsedResult === null) {
+              setCommandNotice('github my open pull requests url unavailable');
+              return;
+            }
+            const myPrsUrl = parseGitHubUrl(parsedResult);
+            if (myPrsUrl === null) {
+              setCommandNotice('github my open pull requests url unavailable');
+              return;
+            }
+            const opened = openUrlInBrowser(myPrsUrl);
+            setCommandNotice(
+              opened
+                ? 'opened my open pull requests in browser'
+                : `open pull requests: ${myPrsUrl}`,
+            );
+          }, 'command-menu-open-my-open-prs');
+        },
+      });
+    }
+    return actions;
   });
 
   commandMenuRegistry.registerProvider('github.project-pr', (context) => {
@@ -2908,7 +3136,7 @@ async function main(): Promise<number> {
       return [
         {
           id: 'github.pr.open',
-          title: 'Open PR',
+          title: 'Open PR (git)',
           aliases: ['open pull request', 'open pr'],
           keywords: ['github', 'pr', 'open', 'pull-request'],
           detail: context.githubTrackedBranch ?? 'current project',
@@ -2922,9 +3150,17 @@ async function main(): Promise<number> {
                 });
               } catch (error: unknown) {
                 if (isGitHubAuthUnavailableError(error)) {
+                  setGitHubDebugAuthState({
+                    auth: 'no',
+                    projectPr: 'er',
+                  });
                   setCommandNotice(githubAuthHintNotice);
                   return;
                 }
+                setGitHubDebugAuthState({
+                  auth: 'er',
+                  projectPr: 'er',
+                });
                 throw error;
               }
               const parsedResult = asRecord(result);
@@ -2933,6 +3169,9 @@ async function main(): Promise<number> {
                 return;
               }
               const state = parseGitHubProjectPrState(directoryId, parsedResult);
+              setGitHubDebugAuthState({
+                projectPr: 'ok',
+              });
               commandMenuGitHubProjectPrState = state;
               if (state.openPrUrl === null) {
                 setCommandNotice('no open pull request for tracked branch');
@@ -2951,7 +3190,7 @@ async function main(): Promise<number> {
       return [
         {
           id: 'github.pr.create',
-          title: 'Create PR',
+          title: 'Create PR (git)',
           aliases: ['create pull request', 'new pr'],
           keywords: ['github', 'pr', 'create', 'pull-request'],
           detail: context.githubTrackedBranch,
@@ -2965,9 +3204,15 @@ async function main(): Promise<number> {
                 });
               } catch (error: unknown) {
                 if (isGitHubAuthUnavailableError(error)) {
+                  setGitHubDebugAuthState({
+                    auth: 'no',
+                  });
                   setCommandNotice(githubAuthHintNotice);
                   return;
                 }
+                setGitHubDebugAuthState({
+                  auth: 'er',
+                });
                 throw error;
               }
               const parsedResult = asRecord(result);
@@ -2979,6 +3224,10 @@ async function main(): Promise<number> {
               if (prUrl === null) {
                 throw new Error('github.pr-create returned malformed pr url');
               }
+              setGitHubDebugAuthState({
+                auth: 'ok',
+                projectPr: 'ok',
+              });
               refreshCommandMenuGitHubProjectPrState(directoryId);
               const opened = openUrlInBrowser(prUrl);
               setCommandNotice(
@@ -3087,7 +3336,8 @@ async function main(): Promise<number> {
   >({
     renderFlush: {
       perfNowNs,
-      statusFooterForConversation: (conversation) => debugFooterForConversation(conversation),
+      statusFooterForConversation: (conversation) =>
+        `${formatGitHubDebugTokens(githubDebugAuthState)} ${debugFooterForConversation(conversation)}`,
       currentStatusNotice: () => debugFooterNotice.current(),
       currentStatusRow: () => outputLoadSampler.currentStatusRow(),
       onStatusLineComposed: (input) => {
@@ -3394,6 +3644,7 @@ async function main(): Promise<number> {
     scheduleConversationTitlePersist,
     resolveCommandMenuActions,
     executeCommandMenuAction,
+    persistApiKey,
     requestStop,
     resolveDirectoryForAction,
     openNewThreadPrompt,

package/scripts/control-plane-daemon.ts

@@ -1,8 +1,11 @@
 import { resolve } from 'node:path';
 import { startCodexLiveSession } from '../src/codex/live-session.ts';
 import { startControlPlaneStreamServer } from '../src/control-plane/stream-server.ts';
-import { loadHarnessConfig } from '../src/config/config-core.ts';
-import { resolveHarnessRuntimePath } from '../src/config/harness-paths.ts';
+import { loadHarnessConfig, resolveHarnessConfigPath } from '../src/config/config-core.ts';
+import {
+  resolveHarnessRuntimePath,
+  resolveHarnessWorkspaceDirectory,
+} from '../src/config/harness-paths.ts';
 import { migrateLegacyHarnessLayout } from '../src/config/harness-runtime-migration.ts';
 import { loadHarnessSecrets } from '../src/config/secrets-core.ts';
 import {
@@ -69,7 +72,7 @@ function parseArgs(argv: string[], invocationDirectory: string): DaemonOptions {
   const defaultAuthToken = process.env.HARNESS_CONTROL_PLANE_AUTH_TOKEN ?? null;
   const defaultStateDbPath = resolveHarnessRuntimePath(
     invocationDirectory,
-    process.env.HARNESS_CONTROL_PLANE_DB_PATH ?? '.harness/control-plane.sqlite',
+    '.harness/control-plane.sqlite',
   );
 
   let host = defaultHost;
@@ -114,7 +117,7 @@ function parseArgs(argv: string[], invocationDirectory: string): DaemonOptions {
       if (value === undefined) {
         throw new Error('missing value for --state-db-path');
       }
-      stateDbPath = value;
+      stateDbPath = resolveHarnessRuntimePath(invocationDirectory, value);
       idx += 1;
       continue;
     }
@@ -129,6 +132,17 @@ function parseArgs(argv: string[], invocationDirectory: string): DaemonOptions {
   if (!loopbackHosts.has(host) && authToken === null) {
     throw new Error('non-loopback hosts require --auth-token or HARNESS_CONTROL_PLANE_AUTH_TOKEN');
   }
+  const workspaceRuntimeRoot = resolveHarnessWorkspaceDirectory(invocationDirectory, process.env);
+  const normalizedRuntimeRoot = resolve(workspaceRuntimeRoot);
+  const normalizedStateDbPath = resolve(stateDbPath);
+  if (
+    normalizedStateDbPath !== normalizedRuntimeRoot &&
+    !normalizedStateDbPath.startsWith(`${normalizedRuntimeRoot}/`)
+  ) {
+    throw new Error(
+      `invalid --state-db-path: ${stateDbPath}. state db path must be under workspace runtime root ${workspaceRuntimeRoot}`,
+    );
+  }
 
   return {
     host,
@@ -140,6 +154,11 @@ function parseArgs(argv: string[], invocationDirectory: string): DaemonOptions {
 
 async function main(): Promise<number> {
   const invocationDirectory = resolveInvocationDirectory();
+  const gatewayRunIdRaw = process.env.HARNESS_GATEWAY_RUN_ID;
+  const gatewayRunId =
+    typeof gatewayRunIdRaw === 'string' && gatewayRunIdRaw.trim().length > 0
+      ? gatewayRunIdRaw.trim()
+      : `gateway-run-${process.pid}`;
   migrateLegacyHarnessLayout(invocationDirectory, process.env);
   loadHarnessSecrets({ cwd: invocationDirectory });
   configureProcessPerf(invocationDirectory);
@@ -159,14 +178,22 @@ async function main(): Promise<number> {
   }
   const startupSpan = startPerfSpan('daemon.startup.total', {
     process: 'daemon',
+    gatewayRunId,
   });
   recordPerfEvent('daemon.startup.begin', {
     process: 'daemon',
+    gatewayRunId,
   });
   const options = parseArgs(process.argv.slice(2), invocationDirectory);
+  const workspaceRuntimeRoot = resolveHarnessWorkspaceDirectory(invocationDirectory, process.env);
+  const configPath = resolveHarnessConfigPath(invocationDirectory, process.env);
+  process.stdout.write(
+    `[control-plane] boot runId=${gatewayRunId} pid=${String(process.pid)} ppid=${String(process.ppid)} workspaceRoot=${invocationDirectory} runtimeRoot=${workspaceRuntimeRoot} config=${configPath} db=${options.stateDbPath}\n`,
+  );
 
   const listenSpan = startPerfSpan('daemon.startup.listen', {
     process: 'daemon',
+    gatewayRunId,
   });
   const serverOptions: Parameters<typeof startControlPlaneStreamServer>[0] = {
     host: options.host,
@@ -251,13 +278,14 @@ async function main(): Promise<number> {
   const address = server.address();
   recordPerfEvent('daemon.startup.listening', {
     process: 'daemon',
+    gatewayRunId,
     host: address.address,
     port: address.port,
     auth: options.authToken === null ? 'off' : 'on',
   });
   startupSpan.end({ listening: true });
   process.stdout.write(
-    `[control-plane] listening host=${address.address} port=${String(address.port)} auth=${options.authToken === null ? 'off' : 'on'} db=${options.stateDbPath}\n`,
+    `[control-plane] listening host=${address.address} port=${String(address.port)} auth=${options.authToken === null ? 'off' : 'on'} db=${options.stateDbPath} runId=${gatewayRunId}\n`,
   );
 
   let stopRequested = false;