@slayzone/cli 0.36.0-beta.10 → 0.36.0-beta.11

package/dist/slay.js

@@ -7248,7 +7248,7 @@ var require_BufferList = __commonJS({
         this.head = this.tail = null;
         this.length = 0;
       };
-      BufferList.prototype.join = function join5(s) {
+      BufferList.prototype.join = function join7(s) {
         if (this.length === 0) return "";
         var p2 = this.head;
         var ret = "" + p2.data;
@@ -46794,9 +46794,13 @@ complete -c slay -n '__fish_use_subcommand' -a 'tags' -d 'Manage tags'
 complete -c slay -n '__fish_use_subcommand' -a 'templates' -d 'Manage task templates'
 complete -c slay -n '__fish_use_subcommand' -a 'automations' -d 'Manage automations'
 complete -c slay -n '__fish_use_subcommand' -a 'processes' -d 'Manage processes'
+complete -c slay -n '__fish_use_subcommand' -a 'hub' -d 'Run, list and target SlayZone hubs'
+complete -c slay -n '__fish_use_subcommand' -a 'runner' -d 'Run and manage SlayZone runners'
 complete -c slay -n '__fish_use_subcommand' -a 'completions' -d 'Print shell completions'
 complete -c slay -n '__fish_seen_subcommand_from tasks' -a 'list create view done update archive delete open search subtasks subtask-add tag'
 complete -c slay -n '__fish_seen_subcommand_from processes' -a 'list logs kill follow'
+complete -c slay -n '__fish_seen_subcommand_from hub' -a 'ls create start stop rm restart logs registered use current forget'
+complete -c slay -n '__fish_seen_subcommand_from runner' -a 'ls create start stop rm restart logs'
 complete -c slay -n '__fish_seen_subcommand_from projects' -a 'list create update'
 complete -c slay -n '__fish_seen_subcommand_from tags' -a 'list create delete'
 complete -c slay -n '__fish_seen_subcommand_from templates' -a 'list view create update delete'
@@ -46814,6 +46818,8 @@ _slay() {
     'templates:Manage task templates'
     'automations:Manage automations'
     'processes:Manage processes'
+    'hub:Run, list and target SlayZone hubs'
+    'runner:Run and manage SlayZone runners'
     'completions:Print shell completions'
   )
   local -a task_commands
@@ -46863,6 +46869,30 @@ _slay() {
     'run:Run automation manually'
     'runs:View execution history'
   )
+  local -a hub_commands
+  hub_commands=(
+    'ls:List running hubs'
+    'create:Create a hub here and keep it running'
+    'start:Start a stopped hub'
+    'stop:Stop a hub, keeping it registered'
+    'rm:Stop a hub and remove its registration'
+    'restart:Restart a hub'
+    'logs:Show a hub log'
+    'registered:List hubs registered with the OS service manager'
+    'use:Point this CLI at a hub'
+    'current:Show which hub this CLI targets'
+    'forget:Drop the stored hub target'
+  )
+  local -a runner_commands
+  runner_commands=(
+    'ls:List installed runners'
+    'create:Install a runner here and keep it running'
+    'start:Start a stopped runner'
+    'stop:Stop a runner, keeping it registered'
+    'rm:Stop a runner and remove its registration'
+    'restart:Restart a runner'
+    'logs:Show a runner log'
+  )
   case $words[2] in
     tasks)
       _describe 'task commands' task_commands
@@ -46882,6 +46912,12 @@ _slay() {
     automations)
       _describe 'automation commands' automation_commands
       ;;
+    hub)
+      _describe 'hub commands' hub_commands
+      ;;
+    runner)
+      _describe 'runner commands' runner_commands
+      ;;
     completions)
       _arguments ':shell:(fish zsh bash)'
       ;;
@@ -46899,7 +46935,7 @@ _slay_completions() {
   cur="\${COMP_WORDS[COMP_CWORD]}"
   prev="\${COMP_WORDS[COMP_CWORD-1]}"
   if [ $COMP_CWORD -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "tasks projects tags templates automations processes completions" -- "$cur") )
+    COMPREPLY=( $(compgen -W "tasks projects tags templates automations processes hub runner completions" -- "$cur") )
   elif [ $COMP_CWORD -eq 2 ]; then
     case "$prev" in
       tasks)
@@ -46920,6 +46956,12 @@ _slay_completions() {
       automations)
         COMPREPLY=( $(compgen -W "list view create update delete toggle run runs" -- "$cur") )
         ;;
+      hub)
+        COMPREPLY=( $(compgen -W "ls create start stop rm restart logs registered use current forget" -- "$cur") )
+        ;;
+      runner)
+        COMPREPLY=( $(compgen -W "ls create start stop rm restart logs" -- "$cur") )
+        ;;
       completions)
         COMPREPLY=( $(compgen -W "fish zsh bash" -- "$cur") )
         ;;
@@ -51987,25 +52029,45 @@ function panelsCommand() {
 }
 
 // src/commands/hub.ts
-var import_node_child_process2 = require("node:child_process");
-var import_node_module = require("node:module");
-var import_node_fs6 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs7 = require("node:fs");
+var import_node_path7 = require("node:path");
 
-// ../../shared/platform/src/hub-service.ts
+// ../../shared/platform/src/service-unit.ts
 var import_node_child_process = require("node:child_process");
 var import_node_fs5 = require("node:fs");
 var import_node_os = require("node:os");
 var import_node_path5 = require("node:path");
-var LABEL_PREFIX = "com.slayzone.hub.";
-var SYSTEMD_PREFIX = "slayzone-hub-";
-function isValidHubName(name) {
+var KINDS = {
+  hub: {
+    labelPrefix: "com.slayzone.hub.",
+    systemdPrefix: "slayzone-hub-",
+    description: "SlayZone hub",
+    /** launchd stdout/stderr basenames (systemd uses journald). */
+    outLog: "hub.out.log",
+    errLog: "hub.err.log",
+    /** The `slay … logs <name>` command, quoted in the systemd unit's comment. */
+    logsCommand: "slay hub logs",
+    /** How an operator picks a different name — quoted in the invalid-name error. */
+    renameHint: "Rename with `--name` or the config.json `hubName` key."
+  },
+  runner: {
+    labelPrefix: "com.slayzone.runner.",
+    systemdPrefix: "slayzone-runner-",
+    description: "SlayZone runner",
+    outLog: "runner.out.log",
+    errLog: "runner.err.log",
+    logsCommand: "slay runner logs",
+    renameHint: "Pick a different name for `slay runner create`."
+  }
+};
+function isValidServiceName(name) {
   return /^[A-Za-z0-9_][A-Za-z0-9._-]*$/.test(name);
 }
-function assertValidHubName(name) {
-  if (!isValidHubName(name)) {
+function assertValidServiceName(kind, name) {
+  if (!isValidServiceName(name)) {
     throw new Error(
-      `[slayzone] invalid hub name ${JSON.stringify(name)} \u2014 a name may contain only letters, digits, dot, dash and underscore (no slashes, spaces or newlines), and must not start with a dot. Rename with \`--name\` or the config.json \`hubName\` key.`
+      `[slayzone] invalid ${kind} name ${JSON.stringify(name)} \u2014 a name may contain only letters, digits, dot, dash and underscore (no slashes, spaces or newlines), and must not start with a dot. ${KINDS[kind].renameHint}`
     );
   }
 }
@@ -52031,41 +52093,44 @@ function detectBackend() {
     return "none";
   }
 }
-function hubUnitPath(name, backend, unitDir = defaultUnitDir(backend)) {
-  assertValidHubName(name);
-  return backend === "launchd" ? (0, import_node_path5.join)(unitDir, `${LABEL_PREFIX}${name}.plist`) : (0, import_node_path5.join)(unitDir, `${SYSTEMD_PREFIX}${name}.service`);
+function unitPath(kind, name, backend, unitDir = defaultUnitDir(backend)) {
+  assertValidServiceName(kind, name);
+  return backend === "launchd" ? (0, import_node_path5.join)(unitDir, `${KINDS[kind].labelPrefix}${name}.plist`) : (0, import_node_path5.join)(unitDir, `${KINDS[kind].systemdPrefix}${name}.service`);
 }
-function nameFromUnitFile(file2, backend) {
+function nameFromUnitFile(kind, file2, backend) {
   if (backend === "launchd") {
-    if (!file2.startsWith(LABEL_PREFIX) || !file2.endsWith(".plist")) return null;
-    return file2.slice(LABEL_PREFIX.length, -".plist".length) || null;
+    const prefix2 = KINDS[kind].labelPrefix;
+    if (!file2.startsWith(prefix2) || !file2.endsWith(".plist")) return null;
+    return file2.slice(prefix2.length, -".plist".length) || null;
   }
-  if (!file2.startsWith(SYSTEMD_PREFIX) || !file2.endsWith(".service")) return null;
-  return file2.slice(SYSTEMD_PREFIX.length, -".service".length) || null;
+  const prefix = KINDS[kind].systemdPrefix;
+  if (!file2.startsWith(prefix) || !file2.endsWith(".service")) return null;
+  return file2.slice(prefix.length, -".service".length) || null;
 }
 function xmlEscape(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-function hubEnv(spec) {
-  const merged = {
-    SLAYZONE_ROOT: spec.root,
-    SLAYZONE_HUB_NAME: spec.name
-  };
-  if (spec.port !== void 0) merged.SLAYZONE_HUB_ADDRESS = `127.0.0.1:${spec.port}`;
+function unitEnv(spec) {
+  const merged = { SLAYZONE_ROOT: spec.root };
+  if (spec.kind === "hub") {
+    merged.SLAYZONE_HUB_NAME = spec.name;
+    if (spec.port !== void 0) merged.SLAYZONE_HUB_ADDRESS = `127.0.0.1:${spec.port}`;
+  }
   Object.assign(merged, spec.env ?? {});
   return Object.entries(merged);
 }
 function renderLaunchdPlist(spec) {
-  assertValidHubName(spec.name);
+  assertValidServiceName(spec.kind, spec.name);
+  const kind = KINDS[spec.kind];
   const programArgs = [spec.command, ...spec.args].map((a) => `    <string>${xmlEscape(a)}</string>`).join("\n");
-  const envEntries = hubEnv(spec).map(([k, v2]) => `    <key>${xmlEscape(k)}</key>
+  const envEntries = unitEnv(spec).map(([k, v2]) => `    <key>${xmlEscape(k)}</key>
     <string>${xmlEscape(v2)}</string>`).join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${LABEL_PREFIX}${spec.name}</string>
+  <string>${kind.labelPrefix}${spec.name}</string>
   <key>ProgramArguments</key>
   <array>
 ${programArgs}
@@ -52084,9 +52149,9 @@ ${envEntries}
     <false/>
   </dict>
   <key>StandardOutPath</key>
-  <string>${xmlEscape((0, import_node_path5.join)(spec.logDir, "hub.out.log"))}</string>
+  <string>${xmlEscape((0, import_node_path5.join)(spec.logDir, kind.outLog))}</string>
   <key>StandardErrorPath</key>
-  <string>${xmlEscape((0, import_node_path5.join)(spec.logDir, "hub.err.log"))}</string>
+  <string>${xmlEscape((0, import_node_path5.join)(spec.logDir, kind.errLog))}</string>
   <key>ProcessType</key>
   <string>Background</string>
 </dict>
@@ -52094,11 +52159,12 @@ ${envEntries}
 `;
 }
 function renderSystemdUnit(spec) {
-  assertValidHubName(spec.name);
+  assertValidServiceName(spec.kind, spec.name);
+  const kind = KINDS[spec.kind];
   const exec = [spec.command, ...spec.args].join(" ");
-  const envLines = hubEnv(spec).map(([k, v2]) => `Environment=${k}=${v2}`).join("\n");
+  const envLines = unitEnv(spec).map(([k, v2]) => `Environment=${k}=${v2}`).join("\n");
   return `[Unit]
-Description=SlayZone hub (${spec.name})
+Description=${kind.description} (${spec.name})
 Documentation=https://github.com/debuglebowski/slayzone
 After=network.target
 
@@ -52109,7 +52175,7 @@ ${envLines}
 ExecStart=${exec}
 Restart=on-failure
 RestartSec=2
-# stdout/stderr go to journald; read them with \`slay hub logs ${spec.name}\`.
+# stdout/stderr go to journald; read them with \`${kind.logsCommand} ${spec.name}\`.
 StandardOutput=journal
 StandardError=journal
 
@@ -52117,20 +52183,20 @@ StandardError=journal
 WantedBy=default.target
 `;
 }
-function writeHubUnit(spec, backend, unitDir = defaultUnitDir(backend)) {
-  const path10 = hubUnitPath(spec.name, backend, unitDir);
+function writeUnit(spec, backend, unitDir = defaultUnitDir(backend)) {
+  const path10 = unitPath(spec.kind, spec.name, backend, unitDir);
   (0, import_node_fs5.mkdirSync)(unitDir, { recursive: true });
   const content = backend === "launchd" ? renderLaunchdPlist(spec) : renderSystemdUnit(spec);
   (0, import_node_fs5.writeFileSync)(path10, content, { mode: 420 });
   return path10;
 }
-function removeHubUnit(name, backend, unitDir = defaultUnitDir(backend)) {
-  const path10 = hubUnitPath(name, backend, unitDir);
+function removeUnit(kind, name, backend, unitDir = defaultUnitDir(backend)) {
+  const path10 = unitPath(kind, name, backend, unitDir);
   if (!(0, import_node_fs5.existsSync)(path10)) return false;
   (0, import_node_fs5.rmSync)(path10, { force: true });
   return true;
 }
-function listRegisteredHubs(backend, unitDir = defaultUnitDir(backend)) {
+function listRegisteredUnits(kind, backend, unitDir = defaultUnitDir(backend)) {
   let files;
   try {
     files = (0, import_node_fs5.readdirSync)(unitDir);
@@ -52139,15 +52205,15 @@ function listRegisteredHubs(backend, unitDir = defaultUnitDir(backend)) {
   }
   const out = [];
   for (const file2 of files) {
-    const name = nameFromUnitFile(file2, backend);
+    const name = nameFromUnitFile(kind, file2, backend);
     if (name) out.push({ name, unitPath: (0, import_node_path5.join)(unitDir, file2) });
   }
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
-function readHubUnitRoot(name, backend, unitDir = defaultUnitDir(backend)) {
+function readUnitRoot(kind, name, backend, unitDir = defaultUnitDir(backend)) {
   let text;
   try {
-    text = (0, import_node_fs5.readFileSync)(hubUnitPath(name, backend, unitDir), "utf8");
+    text = (0, import_node_fs5.readFileSync)(unitPath(kind, name, backend, unitDir), "utf8");
   } catch {
     return null;
   }
@@ -52156,75 +52222,55 @@ function readHubUnitRoot(name, backend, unitDir = defaultUnitDir(backend)) {
   if (!raw) return null;
   return backend === "launchd" ? raw.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&amp;/g, "&") : raw;
 }
-function systemdUnitName(name) {
-  assertValidHubName(name);
-  return `${SYSTEMD_PREFIX}${name}.service`;
+function serviceLogNames(kind) {
+  return { out: KINDS[kind].outLog, err: KINDS[kind].errLog };
+}
+function systemdUnitName(kind, name) {
+  assertValidServiceName(kind, name);
+  return `${KINDS[kind].systemdPrefix}${name}.service`;
 }
-function launchdLabel(name) {
-  assertValidHubName(name);
-  return `${LABEL_PREFIX}${name}`;
+function launchdLabel(kind, name) {
+  assertValidServiceName(kind, name);
+  return `${KINDS[kind].labelPrefix}${name}`;
 }
 
-// src/commands/hub.ts
-var HUB_PACKAGE = "@slayzone/hub";
-var CLI_VERSION = true ? "0.36.0-beta.10" : "";
+// src/service.ts
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs6 = require("node:fs");
+var import_node_module = require("node:module");
+var import_node_path6 = require("node:path");
+var CLI_VERSION = true ? "0.36.0-beta.11" : "";
 function fail(message) {
   console.error(message);
   process.exit(1);
 }
-function outOfBlockPorts() {
-  if (!hasLocalDatabase()) return [];
-  try {
-    const port = getServerPort();
-    return port ? [port] : [];
-  } catch {
-    return [];
-  }
-}
-function discoverAllHubs() {
-  return discoverHubs({ extraPorts: outOfBlockPorts() });
-}
-function findAnyHub(nameOrPort) {
-  return findHub(nameOrPort, { extraPorts: outOfBlockPorts() });
-}
-function formatUptime(ms) {
-  const s = Math.floor(ms / 1e3);
-  if (s < 60) return `${s}s`;
-  const m = Math.floor(s / 60);
-  if (m < 60) return `${m}m`;
-  const h = Math.floor(m / 60);
-  if (h < 24) return `${h}h ${m % 60}m`;
-  return `${Math.floor(h / 24)}d ${h % 24}h`;
-}
 function shortenPath(path10) {
   const home = process.env.HOME ?? "";
   return home && path10.startsWith(home) ? `~${path10.slice(home.length)}` : path10;
 }
-async function requireHub(nameOrPort) {
-  const hub = await findAnyHub(nameOrPort);
-  if (!hub) {
-    const running = await discoverAllHubs();
-    const hint = running.length > 0 ? `Running hubs: ${running.map((h) => `${h.name} (${h.port})`).join(", ")}` : "No hubs are running on this machine.";
-    fail(`No hub named or listening on "${nameOrPort}".
-${hint}`);
-  }
-  return hub;
+function resolveBackend() {
+  return process.env.SLZ_FORCE_NO_SERVICE === "1" ? "none" : detectBackend();
 }
-function refuseSupervised(hub, verb) {
-  if (hub.supervised) {
-    fail(
-      `Refusing to ${verb} "${hub.name}" \u2014 it is the hub inside the SlayZone desktop app, which manages its own lifecycle. Quit the app instead.`
-    );
+var PACKAGES = {
+  hub: { pkg: "@slayzone/hub", bin: "slayzone-hub", devDir: "hub", envOverride: "SLZ_HUB_BIN" },
+  runner: {
+    pkg: "@slayzone/runner",
+    bin: "slayzone-runner",
+    devDir: "runner",
+    envOverride: "SLZ_RUNNER_BIN"
   }
+};
+function servicePackage(kind) {
+  return PACKAGES[kind].pkg;
 }
-function readHubPkg(pkgJsonPath) {
+function readServicePkg(kind, pkgJsonPath) {
   let pkg;
   try {
     pkg = JSON.parse((0, import_node_fs6.readFileSync)(pkgJsonPath, "utf8"));
   } catch {
     return null;
   }
-  const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["slayzone-hub"];
+  const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.[PACKAGES[kind].bin];
   if (!binRel) return null;
   const binPath = (0, import_node_path6.join)((0, import_node_path6.dirname)(pkgJsonPath), binRel);
   if (!(0, import_node_fs6.existsSync)(binPath)) return null;
@@ -52256,8 +52302,9 @@ function interpreterFor(binPath, version2) {
   }
   return { command: process.execPath, args: [binPath], version: version2 };
 }
-function resolveHubBin() {
-  const override = process.env.SLZ_HUB_BIN;
+function resolveServiceBin(kind) {
+  const { pkg, devDir, envOverride } = PACKAGES[kind];
+  const override = process.env[envOverride];
   if (override) return { command: process.execPath, args: [override], version: "override" };
   const candidates = [
     // (1) Anchored on argv[1] (the slay script) — `import.meta` does not exist in
@@ -52265,30 +52312,30 @@ function resolveHubBin() {
     () => {
       try {
         return (0, import_node_module.createRequire)(process.argv[1] ?? (0, import_node_path6.join)(process.cwd(), "x")).resolve(
-          `${HUB_PACKAGE}/package.json`
+          `${pkg}/package.json`
         );
       } catch {
         return null;
       }
     },
-    // (2) Dev tree: <cli>/dist/slay.js → ../../hub/package.json
+    // (2) Dev tree: <cli>/dist/slay.js → ../../<kind>/package.json
     () => {
       const self2 = process.argv[1];
       if (!self2) return null;
-      const sibling = (0, import_node_path6.join)((0, import_node_path6.dirname)(self2), "..", "..", "hub", "package.json");
+      const sibling = (0, import_node_path6.join)((0, import_node_path6.dirname)(self2), "..", "..", devDir, "package.json");
       return (0, import_node_fs6.existsSync)(sibling) ? sibling : null;
     }
   ];
   for (const find of candidates) {
     const path10 = find();
     if (!path10) continue;
-    const found2 = readHubPkg(path10);
+    const found2 = readServicePkg(kind, path10);
     if (found2) return interpreterFor(found2.binPath, found2.version);
   }
-  const prefix = (0, import_node_path6.join)(getDataDir(), "hub-runtime");
-  const installed = (0, import_node_path6.join)(prefix, "node_modules", HUB_PACKAGE, "package.json");
-  const wanted = CLI_VERSION ? `${HUB_PACKAGE}@${CLI_VERSION}` : `${HUB_PACKAGE}@beta`;
-  if (!(0, import_node_fs6.existsSync)(installed) || CLI_VERSION && readHubPkg(installed)?.version !== CLI_VERSION) {
+  const prefix = (0, import_node_path6.join)(getDataDir(), `${kind}-runtime`);
+  const installed = (0, import_node_path6.join)(prefix, "node_modules", pkg, "package.json");
+  const wanted = CLI_VERSION ? `${pkg}@${CLI_VERSION}` : `${pkg}@beta`;
+  if (!(0, import_node_fs6.existsSync)(installed) || CLI_VERSION && readServicePkg(kind, installed)?.version !== CLI_VERSION) {
     console.log(`Installing ${wanted}\u2026`);
     (0, import_node_fs6.mkdirSync)(prefix, { recursive: true });
     try {
@@ -52304,20 +52351,232 @@ function resolveHubBin() {
       );
     }
   }
-  const found = readHubPkg(installed);
+  const found = readServicePkg(kind, installed);
   if (!found) {
     fail(
-      `Installed ${HUB_PACKAGE} but found no usable bin at ${installed}. Install it globally and retry:
-  npm install -g ${HUB_PACKAGE}`
+      `Installed ${pkg} but found no usable bin at ${installed}. Install it globally and retry:
+  npm install -g ${pkg}`
     );
   }
   return interpreterFor(found.binPath, found.version);
 }
-function ensureLogDir(root) {
-  const dir = (0, import_node_path6.join)(root, "storage", "logs");
+function ensureLogDir(kind, root) {
+  const dir = logDirFor(kind, root);
   (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
   return dir;
 }
+function logDirFor(kind, root) {
+  return kind === "hub" ? (0, import_node_path6.join)(root, "storage", "logs") : (0, import_node_path6.join)(root, "logs");
+}
+function serviceLogPaths(kind, root) {
+  const dir = logDirFor(kind, root);
+  const names = serviceLogNames(kind);
+  return { out: (0, import_node_path6.join)(dir, names.out), err: (0, import_node_path6.join)(dir, names.err) };
+}
+function failWithLog(kind, name, logPath, what) {
+  let detail = "";
+  try {
+    detail = (0, import_node_fs6.readFileSync)(logPath, "utf8").trim().split("\n").slice(-12).join("\n");
+  } catch {
+  }
+  const label = kind === "hub" ? "Hub" : "Runner";
+  fail(
+    `${label} "${name}" ${what}.
+` + (detail ? `
+Last output (${shortenPath(logPath)}):
+${detail}
+` : `
+No output was captured in ${shortenPath(logPath)}.
+`)
+  );
+}
+function readServiceLogTail(kind, root, lines) {
+  const dir = logDirFor(kind, root);
+  let files;
+  try {
+    files = (0, import_node_fs6.readdirSync)(dir).filter((f) => f.endsWith(".log"));
+  } catch {
+    return "";
+  }
+  const chunks = [];
+  for (const f of files) {
+    try {
+      chunks.push((0, import_node_fs6.readFileSync)((0, import_node_path6.join)(dir, f), "utf8"));
+    } catch {
+    }
+  }
+  return chunks.join("\n").trim().split("\n").slice(-lines).join("\n");
+}
+function followServiceLog(args) {
+  const { kind, name, root, lines, follow, systemdUnit } = args;
+  if (systemdUnit) {
+    const jargs = ["--user", "-u", systemdUnitName(kind, name), "-n", String(lines)];
+    if (follow) jargs.push("-f");
+    const child2 = (0, import_node_child_process2.spawn)("journalctl", jargs, { stdio: "inherit" });
+    child2.on("exit", (code) => process.exit(code ?? 0));
+    return;
+  }
+  const dir = logDirFor(kind, root);
+  if (!(0, import_node_fs6.existsSync)(dir)) fail(`No log directory at ${shortenPath(dir)}.`);
+  const candidates = (0, import_node_fs6.readdirSync)(dir).filter((f) => f.endsWith(".log")).map((f) => ({ f, path: (0, import_node_path6.join)(dir, f), mtime: (0, import_node_fs6.statSync)((0, import_node_path6.join)(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+  if (candidates.length === 0) fail(`No log files in ${shortenPath(dir)}.`);
+  const target = candidates[0].path;
+  const targs = follow ? ["-f", "-n", String(lines), target] : ["-n", String(lines), target];
+  const child = (0, import_node_child_process2.spawn)("tail", targs, { stdio: "inherit" });
+  child.on("exit", (code) => process.exit(code ?? 0));
+}
+var SupervisorError = class extends Error {
+  constructor(command, output) {
+    super(`${command} failed`);
+    this.command = command;
+    this.output = output;
+  }
+};
+function run(file2, args) {
+  try {
+    (0, import_node_child_process2.execFileSync)(file2, args, { stdio: ["ignore", "inherit", "pipe"] });
+  } catch (e) {
+    const stderr = e.stderr;
+    throw new SupervisorError(
+      `${file2} ${args.join(" ")}`,
+      (typeof stderr === "string" ? stderr : stderr?.toString() ?? "").trim()
+    );
+  }
+}
+function launchdDomain() {
+  return `gui/${process.getuid?.() ?? ""}`;
+}
+function supervisorStart(kind, backend, name, unitFilePath) {
+  if (backend === "launchd") {
+    const label = launchdLabel(kind, name);
+    const domain2 = launchdDomain();
+    try {
+      (0, import_node_child_process2.execFileSync)("launchctl", ["bootout", `${domain2}/${label}`], { stdio: "ignore" });
+    } catch {
+    }
+    run("launchctl", ["bootstrap", domain2, unitFilePath]);
+    return;
+  }
+  const unit = systemdUnitName(kind, name);
+  run("systemctl", ["--user", "daemon-reload"]);
+  run("systemctl", ["--user", "enable", "--now", unit]);
+  try {
+    (0, import_node_child_process2.execFileSync)("loginctl", ["enable-linger", process.env.USER ?? ""], { stdio: "ignore" });
+  } catch {
+    console.log(
+      `Note: could not enable systemd lingering \u2014 the ${kind} will stop when you log out.`
+    );
+    console.log(`  Fix with: sudo loginctl enable-linger ${process.env.USER ?? "<user>"}`);
+  }
+}
+function supervisorStop(kind, backend, name) {
+  if (backend === "launchd") {
+    try {
+      (0, import_node_child_process2.execFileSync)("launchctl", ["bootout", `${launchdDomain()}/${launchdLabel(kind, name)}`], {
+        stdio: "ignore"
+      });
+    } catch {
+    }
+    return;
+  }
+  try {
+    (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "disable", "--now", systemdUnitName(kind, name)], {
+      stdio: "ignore"
+    });
+  } catch {
+  }
+}
+function supervisorStopQuiet(kind, backend, name) {
+  try {
+    supervisorStop(kind, backend, name);
+  } catch {
+  }
+}
+function supervisorStatus(kind, backend, name) {
+  const none = { running: false, pid: null, lastExit: null };
+  if (backend === "none") return none;
+  if (backend === "launchd") {
+    let out2;
+    try {
+      out2 = (0, import_node_child_process2.execFileSync)("launchctl", ["list", launchdLabel(kind, name)], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+    } catch {
+      return none;
+    }
+    const pid = /"PID"\s*=\s*(\d+)/.exec(out2)?.[1];
+    const exit2 = /"LastExitStatus"\s*=\s*(-?\d+)/.exec(out2)?.[1];
+    return {
+      running: pid !== void 0,
+      pid: pid === void 0 ? null : Number(pid),
+      lastExit: exit2 === void 0 ? null : Number(exit2)
+    };
+  }
+  let out;
+  try {
+    out = (0, import_node_child_process2.execFileSync)(
+      "systemctl",
+      ["--user", "show", systemdUnitName(kind, name), "-p", "ActiveState", "-p", "MainPID", "-p", "ExecMainStatus"],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+    );
+  } catch {
+    return none;
+  }
+  const field = (key) => new RegExp(`^${key}=(.*)$`, "m").exec(out)?.[1]?.trim();
+  const mainPid = Number(field("MainPID") ?? "0");
+  const exit = field("ExecMainStatus");
+  return {
+    running: field("ActiveState") === "active" && mainPid > 0,
+    // MainPID is 0 for an inactive unit — report absence, not pid 0.
+    pid: mainPid > 0 ? mainPid : null,
+    lastExit: exit === void 0 || exit === "" ? null : Number(exit)
+  };
+}
+
+// src/commands/hub.ts
+var HUB_PACKAGE = servicePackage("hub");
+function outOfBlockPorts() {
+  if (!hasLocalDatabase()) return [];
+  try {
+    const port = getServerPort();
+    return port ? [port] : [];
+  } catch {
+    return [];
+  }
+}
+function discoverAllHubs() {
+  return discoverHubs({ extraPorts: outOfBlockPorts() });
+}
+function findAnyHub(nameOrPort) {
+  return findHub(nameOrPort, { extraPorts: outOfBlockPorts() });
+}
+function formatUptime(ms) {
+  const s = Math.floor(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.floor(m / 60);
+  if (h < 24) return `${h}h ${m % 60}m`;
+  return `${Math.floor(h / 24)}d ${h % 24}h`;
+}
+async function requireHub(nameOrPort) {
+  const hub = await findAnyHub(nameOrPort);
+  if (!hub) {
+    const running = await discoverAllHubs();
+    const hint = running.length > 0 ? `Running hubs: ${running.map((h) => `${h.name} (${h.port})`).join(", ")}` : "No hubs are running on this machine.";
+    fail(`No hub named or listening on "${nameOrPort}".
+${hint}`);
+  }
+  return hub;
+}
+function refuseSupervised(hub, verb) {
+  if (hub.supervised) {
+    fail(
+      `Refusing to ${verb} "${hub.name}" \u2014 it is the hub inside the SlayZone desktop app, which manages its own lifecycle. Quit the app instead.`
+    );
+  }
+}
 async function waitForHub(predicate, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   for (; ; ) {
@@ -52335,17 +52594,15 @@ async function waitForHubGone(port, timeoutMs) {
     await new Promise((r) => setTimeout(r, 200));
   }
 }
-function resolveBackend() {
-  return process.env.SLZ_FORCE_NO_SERVICE === "1" ? "none" : detectBackend();
-}
 async function launchHub(args) {
   const { name, root, port, backend, creating } = args;
-  const bin = resolveHubBin();
-  const logDir = ensureLogDir(root);
+  const bin = resolveServiceBin("hub");
+  const logDir = ensureLogDir("hub", root);
+  const logs = serviceLogPaths("hub", root);
   const findIt = () => port === void 0 ? findAnyHub(name) : findHub(String(port));
   if (backend === "none") {
-    const out = (0, import_node_fs6.openSync)((0, import_node_path6.join)(logDir, "hub.out.log"), "a");
-    const child = (0, import_node_child_process2.spawn)(bin.command, bin.args, {
+    const out = (0, import_node_fs7.openSync)(logs.out, "a");
+    const child = (0, import_node_child_process3.spawn)(bin.command, bin.args, {
       cwd: root,
       detached: true,
       stdio: ["ignore", out, out],
@@ -52361,7 +52618,7 @@ async function launchHub(args) {
     });
     child.unref();
     const started2 = await waitForHub(findIt, 2e4);
-    if (!started2) failWithLog(name, (0, import_node_path6.join)(logDir, "hub.out.log"), "did not come up within 20s");
+    if (!started2) failWithLog("hub", name, logs.out, "did not come up within 20s");
     console.log(`Hub "${started2.name}" started on port ${started2.port} (pid ${started2.pid}).`);
     console.log(`  Root:  ${shortenPath(root)}`);
     console.log(`  Logs:  ${shortenPath(logDir)}`);
@@ -52370,8 +52627,9 @@ async function launchHub(args) {
     );
     return;
   }
-  const unitPath = writeHubUnit(
+  const writtenUnitPath = writeUnit(
     {
+      kind: "hub",
       name,
       root,
       command: bin.command,
@@ -52382,12 +52640,12 @@ async function launchHub(args) {
     },
     backend
   );
-  if (creating) console.log(`Registered ${unitPath}`);
+  if (creating) console.log(`Registered ${writtenUnitPath}`);
   console.log(`Starting hub "${name}" (${HUB_PACKAGE}@${bin.version})\u2026`);
   try {
-    supervisorStart(backend, name, unitPath);
+    supervisorStart("hub", backend, name, writtenUnitPath);
   } catch (e) {
-    if (creating) removeHubUnit(name, backend);
+    if (creating) removeUnit("hub", name, backend);
     if (!(e instanceof SupervisorError)) throw e;
     const noBus = /Failed to connect to bus|No medium found/i.test(e.output);
     fail(
@@ -52406,28 +52664,29 @@ then log out and back in, and retry. If this account is not meant to have one (a
   const started = await waitForHub(findIt, 2e4);
   if (!started) {
     if (creating) {
-      supervisorStop(backend, name);
-      removeHubUnit(name, backend);
+      supervisorStop("hub", backend, name);
+      removeUnit("hub", name, backend);
     } else {
-      supervisorStop(backend, name);
+      supervisorStop("hub", backend, name);
     }
     failWithLog(
+      "hub",
       name,
-      (0, import_node_path6.join)(logDir, "hub.err.log"),
+      logs.err,
       creating ? "failed to start, so it was unregistered again" : "failed to start (its registration was left in place)"
     );
   }
   console.log(`Hub "${started.name}" running on port ${started.port} (pid ${started.pid}).`);
   console.log(`  Root:  ${shortenPath(root)}`);
   console.log(`  Logs:  ${shortenPath(logDir)}`);
-  console.log(`  Unit:  ${unitPath}`);
+  console.log(`  Unit:  ${writtenUnitPath}`);
   console.log(`  Hub:   ${HUB_PACKAGE}@${bin.version}`);
   console.log("Restarts automatically if it crashes, and starts again when you log in.");
 }
 async function haltHub(hub, backend, opts) {
-  if (backend !== "none" && (0, import_node_fs6.existsSync)(hubUnitPath(hub.name, backend))) {
-    supervisorStop(backend, hub.name);
-    if (opts.unregister) removeHubUnit(hub.name, backend);
+  if (backend !== "none" && (0, import_node_fs7.existsSync)(unitPath("hub", hub.name, backend))) {
+    supervisorStop("hub", backend, hub.name);
+    if (opts.unregister) removeUnit("hub", hub.name, backend);
   } else {
     try {
       process.kill(hub.pid, "SIGTERM");
@@ -52442,83 +52701,6 @@ async function haltHub(hub, backend, opts) {
     );
   }
 }
-var SupervisorError = class extends Error {
-  constructor(command, output) {
-    super(`${command} failed`);
-    this.command = command;
-    this.output = output;
-  }
-};
-function run(file2, args) {
-  try {
-    (0, import_node_child_process2.execFileSync)(file2, args, { stdio: ["ignore", "inherit", "pipe"] });
-  } catch (e) {
-    const stderr = e.stderr;
-    throw new SupervisorError(
-      `${file2} ${args.join(" ")}`,
-      (typeof stderr === "string" ? stderr : stderr?.toString() ?? "").trim()
-    );
-  }
-}
-function failWithLog(name, logPath, what) {
-  let detail = "";
-  try {
-    detail = (0, import_node_fs6.readFileSync)(logPath, "utf8").trim().split("\n").slice(-12).join("\n");
-  } catch {
-  }
-  fail(
-    `Hub "${name}" ${what}.
-` + (detail ? `
-Last output (${shortenPath(logPath)}):
-${detail}
-` : `
-No output was captured in ${shortenPath(logPath)}.
-`)
-  );
-}
-function supervisorStart(backend, name, unitPath) {
-  if (backend === "launchd") {
-    const label = launchdLabel(name);
-    const domain2 = `gui/${process.getuid?.() ?? ""}`;
-    try {
-      (0, import_node_child_process2.execFileSync)("launchctl", ["bootout", `${domain2}/${label}`], { stdio: "ignore" });
-    } catch {
-    }
-    run("launchctl", ["bootstrap", domain2, unitPath]);
-    return;
-  }
-  const unit = systemdUnitName(name);
-  run("systemctl", ["--user", "daemon-reload"]);
-  run("systemctl", ["--user", "enable", "--now", unit]);
-  try {
-    (0, import_node_child_process2.execFileSync)("loginctl", ["enable-linger", process.env.USER ?? ""], { stdio: "ignore" });
-  } catch {
-    console.log("Note: could not enable systemd lingering \u2014 the hub will stop when you log out.");
-    console.log(`  Fix with: sudo loginctl enable-linger ${process.env.USER ?? "<user>"}`);
-  }
-}
-function supervisorStopQuiet(backend, name) {
-  try {
-    supervisorStop(backend, name);
-  } catch {
-  }
-}
-function supervisorStop(backend, name) {
-  if (backend === "launchd") {
-    const domain2 = `gui/${process.getuid?.() ?? ""}`;
-    try {
-      (0, import_node_child_process2.execFileSync)("launchctl", ["bootout", `${domain2}/${launchdLabel(name)}`], { stdio: "ignore" });
-    } catch {
-    }
-    return;
-  }
-  try {
-    (0, import_node_child_process2.execFileSync)("systemctl", ["--user", "disable", "--now", systemdUnitName(name)], {
-      stdio: "ignore"
-    });
-  } catch {
-  }
-}
 function hubCommand() {
   const cmd = new Command("hub").description("Run, list and target SlayZone hubs").showSuggestionAfterError(true).showHelpAfterError(true);
   cmd.command("ls").description("List the hubs running on this machine").option("--json", "Output as JSON").action(async (opts) => {
@@ -52550,14 +52732,14 @@ function hubCommand() {
     }
   });
   cmd.command("create <name>").description("Create a hub here and keep it running (crash-restart + start at login)").option("--root <dir>", "Hub root \u2014 its config, storage and logs (default: cwd)").option("--port <port>", "Bind a specific port (default: first free hub port)").action(async (name, opts) => {
-    const root = (0, import_node_path6.resolve)(opts.root ?? process.cwd());
+    const root = (0, import_node_path7.resolve)(opts.root ?? process.cwd());
     const port = opts.port === void 0 ? void 0 : Number(opts.port);
     if (port !== void 0 && (!Number.isInteger(port) || port < 1 || port > 65535)) {
       fail(`Invalid --port ${opts.port} \u2014 expected an integer 1-65535.`);
     }
     const backend = resolveBackend();
-    if (backend !== "none" && (0, import_node_fs6.existsSync)(hubUnitPath(name, backend))) {
-      const existingRoot = readHubUnitRoot(name, backend);
+    if (backend !== "none" && (0, import_node_fs7.existsSync)(unitPath("hub", name, backend))) {
+      const existingRoot = readUnitRoot("hub", name, backend);
       fail(
         `A hub named "${name}" already exists${existingRoot ? ` (root ${shortenPath(existingRoot)})` : ""}.
 Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name}\`.`
@@ -52592,12 +52774,12 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
         `This platform has no user service manager, so hubs are not registered and \`start\` has nothing to act on. Use \`slay hub create ${name}\`.`
       );
     }
-    if (!(0, import_node_fs6.existsSync)(hubUnitPath(name, backend))) {
+    if (!(0, import_node_fs7.existsSync)(unitPath("hub", name, backend))) {
       fail(
         `No hub named "${name}". Create it with \`slay hub create ${name}\`, or list what exists with \`slay hub registered\`.`
       );
     }
-    const root = readHubUnitRoot(name, backend);
+    const root = readUnitRoot("hub", name, backend);
     if (!root) {
       fail(
         `The unit for "${name}" does not record a root \u2014 it may be hand-edited. Remove it with \`slay hub rm ${name}\` and create it again.`
@@ -52609,7 +52791,7 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
     const hub = await requireHub(nameOrPort);
     refuseSupervised(hub, "stop");
     const backend = resolveBackend();
-    const registered = backend !== "none" && (0, import_node_fs6.existsSync)(hubUnitPath(hub.name, backend));
+    const registered = backend !== "none" && (0, import_node_fs7.existsSync)(unitPath("hub", hub.name, backend));
     await haltHub(hub, backend, { unregister: false });
     console.log(
       registered ? `Stopped "${hub.name}". Start it again with \`slay hub start ${hub.name}\`.` : `Stopped "${hub.name}" (pid ${hub.pid}). It was not registered by slay.`
@@ -52619,10 +52801,10 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
     const backend = resolveBackend();
     const hub = await findAnyHub(nameOrPort);
     if (!hub) {
-      if (backend !== "none" && (0, import_node_fs6.existsSync)(hubUnitPath(nameOrPort, backend))) {
-        const root = readHubUnitRoot(nameOrPort, backend);
-        supervisorStopQuiet(backend, nameOrPort);
-        removeHubUnit(nameOrPort, backend);
+      if (backend !== "none" && (0, import_node_fs7.existsSync)(unitPath("hub", nameOrPort, backend))) {
+        const root = readUnitRoot("hub", nameOrPort, backend);
+        supervisorStopQuiet("hub", backend, nameOrPort);
+        removeUnit("hub", nameOrPort, backend);
         console.log(
           `Removed "${nameOrPort}" (it was not running).` + (root ? ` Its data is still in ${shortenPath(root)}.` : "")
         );
@@ -52639,17 +52821,18 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
     const hub = await requireHub(nameOrPort);
     refuseSupervised(hub, "restart");
     const backend = resolveBackend();
-    if (backend === "none" || !(0, import_node_fs6.existsSync)(hubUnitPath(hub.name, backend))) {
+    if (backend === "none" || !(0, import_node_fs7.existsSync)(unitPath("hub", hub.name, backend))) {
       fail(
         `"${hub.name}" is not managed by slay, so it cannot be restarted from here. Stop it where it was started, then \`slay hub create ${hub.name}\`.`
       );
     }
     const { name, root } = hub;
-    const logDir = ensureLogDir(root);
+    const logDir = ensureLogDir("hub", root);
     if (opts.upgrade) {
-      const bin = resolveHubBin();
-      writeHubUnit(
+      const bin = resolveServiceBin("hub");
+      writeUnit(
         {
+          kind: "hub",
           name,
           root,
           command: bin.command,
@@ -52663,9 +52846,9 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
       );
       console.log(`Unit updated to ${HUB_PACKAGE}@${bin.version}.`);
     }
-    supervisorStop(backend, name);
+    supervisorStop("hub", backend, name);
     await waitForHubGone(hub.port, 15e3);
-    supervisorStart(backend, name, hubUnitPath(name, backend));
+    supervisorStart("hub", backend, name, unitPath("hub", name, backend));
     const back = await waitForHub(() => findHub(name), 2e4);
     if (!back) fail(`Hub "${name}" did not come back within 20s. Check ${shortenPath(logDir)}.`);
     console.log(`Hub "${back.name}" restarted on port ${back.port} (pid ${back.pid}).`);
@@ -52675,21 +52858,14 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
     const lines = Number(opts.lines);
     if (!Number.isInteger(lines) || lines < 1) fail(`Invalid --lines ${opts.lines}.`);
     const backend = detectBackend();
-    if (backend === "systemd" && (0, import_node_fs6.existsSync)(hubUnitPath(hub.name, backend))) {
-      const args2 = ["--user", "-u", systemdUnitName(hub.name), "-n", String(lines)];
-      if (opts.follow) args2.push("-f");
-      const child2 = (0, import_node_child_process2.spawn)("journalctl", args2, { stdio: "inherit" });
-      child2.on("exit", (code) => process.exit(code ?? 0));
-      return;
-    }
-    const logDir = (0, import_node_path6.join)(hub.root, "storage", "logs");
-    if (!(0, import_node_fs6.existsSync)(logDir)) fail(`No log directory at ${shortenPath(logDir)}.`);
-    const candidates = (0, import_node_fs6.readdirSync)(logDir).filter((f) => f.endsWith(".log")).map((f) => ({ f, path: (0, import_node_path6.join)(logDir, f), mtime: (0, import_node_fs6.statSync)((0, import_node_path6.join)(logDir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
-    if (candidates.length === 0) fail(`No log files in ${shortenPath(logDir)}.`);
-    const target = candidates[0].path;
-    const args = opts.follow ? ["-f", "-n", String(lines), target] : ["-n", String(lines), target];
-    const child = (0, import_node_child_process2.spawn)("tail", args, { stdio: "inherit" });
-    child.on("exit", (code) => process.exit(code ?? 0));
+    followServiceLog({
+      kind: "hub",
+      name: hub.name,
+      root: hub.root,
+      lines,
+      follow: opts.follow === true,
+      systemdUnit: backend === "systemd" && (0, import_node_fs7.existsSync)(unitPath("hub", hub.name, backend))
+    });
   });
   cmd.command("use <name|url>").description("Point this CLI at a hub \u2014 a name from `hub ls`, or a full URL").option("--token <token>", "Bearer token sent as Authorization header").action(async (target, opts) => {
     const looksLikeUrl = target.includes("://");
@@ -52742,7 +52918,7 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
       console.log("This platform has no user service manager \u2014 no hubs can be registered.");
       return;
     }
-    const units = listRegisteredHubs(backend);
+    const units = listRegisteredUnits("hub", backend);
     if (units.length === 0) {
       console.log("No registered hubs.");
       return;
@@ -52752,7 +52928,7 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
       const running = live.has(u.name);
       console.log(`${u.name}${running ? "  (running)" : "  (stopped)"}`);
       console.log(`  ${u.unitPath}`);
-      const root = readHubUnitRoot(u.name, backend);
+      const root = readUnitRoot("hub", u.name, backend);
       if (root) console.log(`  root: ${shortenPath(root)}`);
       if (!running) console.log(`  start: slay hub start ${u.name}`);
     }
@@ -52760,13 +52936,461 @@ Start it with \`slay hub start ${name}\`, or remove it with \`slay hub rm ${name
   return cmd;
 }
 
+// src/commands/runner.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_fs9 = require("node:fs");
+var import_node_path9 = require("node:path");
+
+// ../../shared/platform/src/join-token.ts
+var JOIN_TOKEN_PREFIX = "szjt1";
+function decodeJoinToken(token) {
+  const dot = token.indexOf(".");
+  if (dot === -1 || token.slice(0, dot) !== JOIN_TOKEN_PREFIX) return null;
+  const body = token.slice(dot + 1);
+  if (!body) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const { hubUrl, certFingerprint, secret } = parsed;
+    if (typeof hubUrl !== "string" || typeof certFingerprint !== "string" || typeof secret !== "string") {
+      return null;
+    }
+    return { hubUrl, certFingerprint, secret };
+  } catch {
+    return null;
+  }
+}
+
+// ../../shared/platform/src/slayzone-config.ts
+var import_node_fs8 = require("node:fs");
+var import_node_path8 = require("node:path");
+var DEFAULT_LOCAL_RUNNER_NAME = "local-runner";
+function getSlayzoneConfigPath() {
+  return (0, import_node_path8.join)(getSlayzoneHomeDir(), "config.json");
+}
+function coerce(raw) {
+  const cfg = {};
+  if (typeof raw.runnerTransportSecret === "string" && raw.runnerTransportSecret.length > 0)
+    cfg.runnerTransportSecret = raw.runnerTransportSecret;
+  if (typeof raw.address === "string" && raw.address.length > 0) cfg.address = raw.address;
+  if (typeof raw.publicAddress === "string" && raw.publicAddress.length > 0)
+    cfg.publicAddress = raw.publicAddress;
+  if (typeof raw.hubName === "string" && raw.hubName.trim().length > 0)
+    cfg.hubName = raw.hubName.trim();
+  if (typeof raw.port === "number" && Number.isInteger(raw.port)) cfg.port = raw.port;
+  if (typeof raw.publicUrl === "string" && raw.publicUrl.length > 0) cfg.publicUrl = raw.publicUrl;
+  if (typeof raw.joinToken === "string" && raw.joinToken.length > 0) cfg.joinToken = raw.joinToken;
+  if (typeof raw.runnerName === "string" && raw.runnerName.length > 0)
+    cfg.runnerName = raw.runnerName;
+  if (typeof raw.hubUrl === "string" && raw.hubUrl.length > 0) cfg.hubUrl = raw.hubUrl;
+  if (Array.isArray(raw.allowedRoots)) {
+    const roots = raw.allowedRoots.filter(
+      (r) => typeof r === "string" && r.length > 0
+    );
+    if (roots.length > 0) cfg.allowedRoots = roots;
+  }
+  if (typeof raw.pinnedCertSha256 === "string" && raw.pinnedCertSha256.length > 0)
+    cfg.pinnedCertSha256 = raw.pinnedCertSha256;
+  return cfg;
+}
+function loadSlayzoneConfig(configPath = getSlayzoneConfigPath()) {
+  let raw;
+  try {
+    raw = (0, import_node_fs8.readFileSync)(configPath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    process.stderr.write(
+      `[slayzone-config] cannot read ${configPath}: ${err instanceof Error ? err.message : String(err)} \u2014 using empty config
+`
+    );
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    process.stderr.write(
+      `[slayzone-config] ${configPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)} \u2014 using empty config
+`
+    );
+    return {};
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    process.stderr.write(`[slayzone-config] ${configPath} is not a JSON object \u2014 using empty config
+`);
+    return {};
+  }
+  return coerce(parsed);
+}
+function saveSlayzoneConfig(cfg, configPath = getSlayzoneConfigPath()) {
+  const dir = (0, import_node_path8.dirname)(configPath);
+  (0, import_node_fs8.mkdirSync)(dir, { recursive: true, mode: 448 });
+  const tmpPath = `${configPath}.tmp-${process.pid}-${Date.now()}`;
+  (0, import_node_fs8.writeFileSync)(tmpPath, `${JSON.stringify(cfg, null, 2)}
+`, { mode: 384 });
+  try {
+    (0, import_node_fs8.renameSync)(tmpPath, configPath);
+  } catch (err) {
+    (0, import_node_fs8.rmSync)(tmpPath, { force: true });
+    throw err;
+  }
+}
+function updateSlayzoneConfig(patch, configPath = getSlayzoneConfigPath()) {
+  const current = loadSlayzoneConfig(configPath);
+  const merged = { ...current };
+  for (const [k, v2] of Object.entries(patch)) {
+    if (v2 !== void 0) merged[k] = v2;
+  }
+  saveSlayzoneConfig(merged, configPath);
+  return merged;
+}
+
+// src/commands/runner.ts
+var RUNNER_PACKAGE = servicePackage("runner");
+var ENROLL_TIMEOUT_MS = 3e4;
+var CONNECTED_RE = /"mode":"(enroll|hello)"/;
+function configPathFor(root) {
+  return (0, import_node_path9.join)(root, "config.json");
+}
+function isEnrolled(root) {
+  try {
+    return (0, import_node_fs9.readdirSync)((0, import_node_path9.join)(root, "runners")).some((f) => f.endsWith(".json"));
+  } catch {
+    return false;
+  }
+}
+function requireRegistered(name, backend) {
+  if (backend === "none") {
+    fail(
+      `This platform has no user service manager, so runners cannot be registered here. Run one in the foreground instead:
+  npx ${RUNNER_PACKAGE}`
+    );
+  }
+  if (!(0, import_node_fs9.existsSync)(unitPath("runner", name, backend))) {
+    const known = listRegisteredUnits("runner", backend).map((u) => u.name);
+    fail(
+      `No runner named "${name}" on this machine.
+` + (known.length > 0 ? `Registered runners: ${known.join(", ")}` : "No runners are registered. Create one with `slay runner create <name> --token <token>`.")
+    );
+  }
+  const root = readUnitRoot("runner", name, backend);
+  if (!root) {
+    fail(
+      `The unit for "${name}" does not record a root \u2014 it may be hand-edited. Remove it with \`slay runner rm ${name}\` and create it again.`
+    );
+  }
+  return { root };
+}
+async function waitForConnected(root, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (CONNECTED_RE.test(readServiceLogTail("runner", root, 200))) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r) => setTimeout(r, 300));
+  }
+}
+async function launchRunner(args) {
+  const { name, root, backend, creating } = args;
+  const bin = resolveServiceBin("runner");
+  const logDir = ensureLogDir("runner", root);
+  const logs = serviceLogPaths("runner", root);
+  if (backend === "none") {
+    const out = (0, import_node_fs9.openSync)(logs.out, "a");
+    const child = (0, import_node_child_process4.spawn)(bin.command, bin.args, {
+      cwd: root,
+      detached: true,
+      stdio: ["ignore", out, out],
+      env: {
+        ...process.env,
+        SLAYZONE_ROOT: root,
+        // A detached runner has no TTY, but be explicit: the first-run prompt must
+        // never block a spawn nobody is watching.
+        SLAYZONE_NONINTERACTIVE: "1",
+        // Same interpreter requirement as the unit path: a dev-tree runner needs
+        // ELECTRON_RUN_AS_NODE or its Electron-ABI natives fail to load.
+        ...bin.env ?? {}
+      }
+    });
+    child.unref();
+    if (!await waitForConnected(root, ENROLL_TIMEOUT_MS)) {
+      failWithLog("runner", name, logs.out, `did not reach its hub within ${ENROLL_TIMEOUT_MS / 1e3}s`);
+    }
+    console.log(`Runner "${name}" started (pid ${child.pid ?? "?"}) and reached its hub.`);
+    console.log(`  Root:  ${shortenPath(root)}`);
+    console.log(`  Logs:  ${shortenPath(logDir)}`);
+    console.log(
+      "Note: this platform has no user service manager, so the runner will NOT restart if it crashes, and will not come back after a reboot."
+    );
+    return;
+  }
+  const writtenUnitPath = writeUnit(
+    {
+      kind: "runner",
+      name,
+      root,
+      command: bin.command,
+      args: bin.args,
+      logDir,
+      ...bin.env ? { env: bin.env } : {}
+    },
+    backend
+  );
+  if (creating) console.log(`Registered ${writtenUnitPath}`);
+  console.log(`Starting runner "${name}" (${RUNNER_PACKAGE}@${bin.version})\u2026`);
+  try {
+    supervisorStart("runner", backend, name, writtenUnitPath);
+  } catch (e) {
+    if (creating) removeUnit("runner", name, backend);
+    if (!(e instanceof SupervisorError)) throw e;
+    const noBus = /Failed to connect to bus|No medium found/i.test(e.output);
+    fail(
+      `Could not register runner "${name}" with ${backend}.
+
+  ${e.command}
+  ${e.output || "(no output)"}
+
+` + (noBus ? `systemd has no user session bus for this account, so \`systemctl --user\` cannot work. Enable a persistent user manager:
+  sudo loginctl enable-linger ${process.env.USER ?? "<user>"}
+then log out and back in, and retry. If this account is not meant to have one (a container, or a root-only box), run the runner under the system manager or in the foreground instead:
+  npx ${RUNNER_PACKAGE}
+` : "")
+    );
+  }
+  if (!await waitForConnected(root, ENROLL_TIMEOUT_MS)) {
+    if (creating) {
+      supervisorStop("runner", backend, name);
+      removeUnit("runner", name, backend);
+    } else {
+      supervisorStop("runner", backend, name);
+    }
+    failWithLog(
+      "runner",
+      name,
+      logs.err,
+      creating ? `did not reach its hub within ${ENROLL_TIMEOUT_MS / 1e3}s, so it was unregistered again` : `did not reach its hub within ${ENROLL_TIMEOUT_MS / 1e3}s (its registration was left in place)`
+    );
+  }
+  const status = supervisorStatus("runner", backend, name);
+  console.log(
+    `Runner "${name}" running${status.pid ? ` (pid ${status.pid})` : ""} and connected to its hub.`
+  );
+  console.log(`  Root:  ${shortenPath(root)}`);
+  console.log(`  Logs:  ${shortenPath(logDir)}`);
+  console.log(`  Unit:  ${writtenUnitPath}`);
+  console.log(`  Runner: ${RUNNER_PACKAGE}@${bin.version}`);
+  console.log("Restarts automatically if it crashes, and starts again when you log in.");
+}
+async function waitForStopped(name, backend, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (!supervisorStatus("runner", backend, name).running) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r) => setTimeout(r, 250));
+  }
+}
+function runnerCommand() {
+  const cmd = new Command("runner").description("Run and manage SlayZone runners on this machine").showSuggestionAfterError(true).showHelpAfterError(true);
+  cmd.command("ls").description("List the runners installed on this machine").option("--json", "Output as JSON").action((opts) => {
+    const backend = detectBackend();
+    if (backend === "none") {
+      console.log("This platform has no user service manager \u2014 no runners can be registered.");
+      return;
+    }
+    const units = listRegisteredUnits("runner", backend);
+    const rows = units.map((u) => {
+      const root = readUnitRoot("runner", u.name, backend);
+      const status = supervisorStatus("runner", backend, u.name);
+      const hubUrl = root ? loadSlayzoneConfig(configPathFor(root)).hubUrl ?? null : null;
+      return {
+        name: u.name,
+        unitPath: u.unitPath,
+        root,
+        running: status.running,
+        pid: status.pid,
+        lastExit: status.lastExit,
+        hubUrl,
+        enrolled: root ? isEnrolled(root) : false
+      };
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(rows, null, 2));
+      return;
+    }
+    if (rows.length === 0) {
+      console.log(
+        "No runners installed. Create one with `slay runner create <name> --token <token>`."
+      );
+      return;
+    }
+    const nameW = Math.max(4, ...rows.map((r) => r.name.length));
+    const rootW = Math.max(4, ...rows.map((r) => r.root ? shortenPath(r.root).length : 1));
+    const hubW = Math.max(3, ...rows.map((r) => (r.hubUrl ?? "-").length));
+    console.log(
+      `${"NAME".padEnd(nameW)}  ${"STATE".padEnd(7)}  ${"PID".padEnd(7)}  ${"ROOT".padEnd(rootW)}  ${"HUB".padEnd(hubW)}  ENROLLED`
+    );
+    console.log(
+      `${"-".repeat(nameW)}  ${"-".repeat(7)}  ${"-".repeat(7)}  ${"-".repeat(rootW)}  ${"-".repeat(hubW)}  ${"-".repeat(8)}`
+    );
+    for (const r of rows) {
+      console.log(
+        `${r.name.padEnd(nameW)}  ${(r.running ? "running" : "stopped").padEnd(7)}  ${String(r.pid ?? "-").padEnd(7)}  ${(r.root ? shortenPath(r.root) : "?").padEnd(rootW)}  ${(r.hubUrl ?? "-").padEnd(hubW)}  ${r.enrolled ? "yes" : "no"}`
+      );
+    }
+    for (const r of rows.filter((x2) => !x2.enrolled)) {
+      console.log(
+        `
+Runner "${r.name}" has never reached a hub` + (r.lastExit !== null && r.lastExit !== 0 ? ` (last exit ${r.lastExit})` : "") + `. Check \`slay runner logs ${r.name}\`.`
+      );
+    }
+    for (const r of rows.filter((x2) => !x2.running)) {
+      console.log(`
+Runner "${r.name}" is stopped. Start it: slay runner start ${r.name}`);
+    }
+  });
+  cmd.command("create <name>").description("Install a runner here and keep it running (crash-restart + start at login)").requiredOption("--token <token>", "Join token minted on the hub (szjt1.\u2026)").option("--root <dir>", "Runner root \u2014 its config, credentials and logs (default: cwd)").option(
+    "--allow <dir>",
+    "Filesystem root the runner may operate under (repeatable; default: the runner root)",
+    (value, previous = []) => [...previous, value]
+  ).action(async (name, opts) => {
+    const root = (0, import_node_path9.resolve)(opts.root ?? process.cwd());
+    const backend = resolveBackend();
+    const decoded = decodeJoinToken(opts.token);
+    if (!decoded) {
+      fail(
+        `--token is not a valid SlayZone join token (expected \`szjt1.<payload>\`).
+Mint one on the hub:
+  curl -X POST http://127.0.0.1:<hub-port>/api/runners/join-token \\
+    -H 'content-type: application/json' -d '{"label":"${name}"}'`
+      );
+    }
+    if (name === DEFAULT_LOCAL_RUNNER_NAME) {
+      fail(
+        `"${DEFAULT_LOCAL_RUNNER_NAME}" is reserved for the runner inside the SlayZone desktop app \u2014 a second runner using it would collide with that one on the hub. Choose another name.`
+      );
+    }
+    if (backend !== "none" && (0, import_node_fs9.existsSync)(unitPath("runner", name, backend))) {
+      const existingRoot = readUnitRoot("runner", name, backend);
+      fail(
+        `A runner named "${name}" already exists${existingRoot ? ` (root ${shortenPath(existingRoot)})` : ""}.
+Start it with \`slay runner start ${name}\`, or remove it with \`slay runner rm ${name}\`.`
+      );
+    }
+    const occupant = loadSlayzoneConfig(configPathFor(root)).runnerName;
+    if (occupant !== void 0) {
+      fail(
+        `A runner is already installed in ${shortenPath(root)} \u2014 "${occupant}".
+` + (occupant === name ? `Start it with \`slay runner start ${name}\`, or remove it with \`slay runner rm ${name}\`.` : `Give this runner its own directory with \`--root <dir>\`, or remove "${occupant}" first with \`slay runner rm ${occupant}\`.`)
+      );
+    }
+    const allowedRoots = opts.allow && opts.allow.length > 0 ? opts.allow.map((d) => (0, import_node_path9.resolve)(d)) : [root];
+    updateSlayzoneConfig(
+      {
+        joinToken: opts.token,
+        hubUrl: decoded.hubUrl,
+        runnerName: name,
+        allowedRoots
+      },
+      configPathFor(root)
+    );
+    console.log(`Hub:   ${decoded.hubUrl}`);
+    console.log(`Allow: ${allowedRoots.map((d) => shortenPath(d)).join(", ")}`);
+    await launchRunner({ name, root, backend, creating: true });
+  });
+  cmd.command("start <name>").description("Start an existing runner that is stopped").action(async (name) => {
+    const backend = resolveBackend();
+    const { root } = requireRegistered(name, backend);
+    if (backend !== "none" && supervisorStatus("runner", backend, name).running) {
+      const status = supervisorStatus("runner", backend, name);
+      console.log(
+        `Runner "${name}" is already running${status.pid ? ` (pid ${status.pid})` : ""}.`
+      );
+      return;
+    }
+    await launchRunner({ name, root, backend, creating: false });
+  });
+  cmd.command("stop <name>").description("Stop a runner, keeping it registered so `start` can bring it back").action(async (name) => {
+    const backend = resolveBackend();
+    requireRegistered(name, backend);
+    if (backend === "none") return;
+    supervisorStop("runner", backend, name);
+    if (!await waitForStopped(name, backend, 15e3)) {
+      fail(
+        `Runner "${name}" is still running after 15s according to ${backend}. It may be managed elsewhere (docker, a system unit).`
+      );
+    }
+    console.log(`Stopped "${name}". Start it again with \`slay runner start ${name}\`.`);
+  });
+  cmd.command("rm <name>").description("Stop a runner and remove its registration").action((name) => {
+    const backend = resolveBackend();
+    const { root } = requireRegistered(name, backend);
+    if (backend === "none") return;
+    supervisorStopQuiet("runner", backend, name);
+    removeUnit("runner", name, backend);
+    console.log(`Removed "${name}". Its config and credentials are still in ${shortenPath(root)}.`);
+    console.log(
+      `It is still enrolled on its hub \u2014 revoke it there if this machine is going away.`
+    );
+  });
+  cmd.command("restart <name>").description("Restart a runner").option("--upgrade", `Re-resolve ${RUNNER_PACKAGE} first (picks up a newer version)`).action(async (name, opts) => {
+    const backend = resolveBackend();
+    const { root } = requireRegistered(name, backend);
+    if (backend === "none") return;
+    const logDir = ensureLogDir("runner", root);
+    if (opts.upgrade) {
+      const bin = resolveServiceBin("runner");
+      writeUnit(
+        {
+          kind: "runner",
+          name,
+          root,
+          command: bin.command,
+          args: bin.args,
+          logDir,
+          // Must carry the interpreter env: dropping it here would rewrite a
+          // working unit into one that crash-loops on Electron-ABI natives.
+          ...bin.env ? { env: bin.env } : {}
+        },
+        backend
+      );
+      console.log(`Unit updated to ${RUNNER_PACKAGE}@${bin.version}.`);
+    }
+    supervisorStop("runner", backend, name);
+    await waitForStopped(name, backend, 15e3);
+    supervisorStart("runner", backend, name, unitPath("runner", name, backend));
+    if (!await waitForConnected(root, ENROLL_TIMEOUT_MS)) {
+      fail(
+        `Runner "${name}" did not reconnect within ${ENROLL_TIMEOUT_MS / 1e3}s. Check \`slay runner logs ${name}\`.`
+      );
+    }
+    const status = supervisorStatus("runner", backend, name);
+    console.log(
+      `Runner "${name}" restarted${status.pid ? ` (pid ${status.pid})` : ""} and reconnected.`
+    );
+  });
+  cmd.command("logs <name>").description("Show a runner's log output").option("-n, --lines <n>", "Last N lines", "50").option("-f, --follow", "Follow the log").action((name, opts) => {
+    const backend = detectBackend();
+    const { root } = requireRegistered(name, backend);
+    const lines = Number(opts.lines);
+    if (!Number.isInteger(lines) || lines < 1) fail(`Invalid --lines ${opts.lines}.`);
+    followServiceLog({
+      kind: "runner",
+      name,
+      root,
+      lines,
+      follow: opts.follow === true,
+      systemdUnit: backend === "systemd" && (0, import_node_fs9.existsSync)(unitPath("runner", name, backend))
+    });
+  });
+  return cmd;
+}
+
 // src/index.ts
 process.removeAllListeners("warning");
 process.on("warning", (warning) => {
   if (warning.name === "ExperimentalWarning" && /SQLite/i.test(warning.message)) return;
   console.warn(`${warning.name}: ${warning.message}`);
 });
-var program2 = new Command().name("slay").description("SlayZone CLI").version("0.36.0-beta.10").option("--dev", "Use development database (slayzone.dev.sqlite)").option("--hub <name|port>", "Target a specific hub on this machine (see `slay hub ls`)").showSuggestionAfterError(true).showHelpAfterError(true).hook("preAction", async (thisCommand) => {
+var program2 = new Command().name("slay").description("SlayZone CLI").version("0.36.0-beta.11").option("--dev", "Use development database (slayzone.dev.sqlite)").option("--hub <name|port>", "Target a specific hub on this machine (see `slay hub ls`)").showSuggestionAfterError(true).showHelpAfterError(true).hook("preAction", async (thisCommand) => {
   const root = thisCommand.parent ?? thisCommand;
   const opts = root.opts();
   if (opts.dev) process.env.SLAYZONE_DEV = "1";
@@ -52803,6 +53427,7 @@ program2.addCommand(completionsCommand());
 program2.addCommand(initCommand());
 program2.addCommand(ptyCommand());
 program2.addCommand(hubCommand());
+program2.addCommand(runnerCommand());
 program2.parseAsync(process.argv).catch((err) => {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);