fix: enforce gateway single instance

src/cli/program.ts

@@ -10,6 +10,7 @@ import { statusCommand } from "../commands/status.js";
 import { callGateway, randomIdempotencyKey } from "../gateway/call.js";
 import { startGatewayServer } from "../gateway/server.js";
 import { danger, info, setVerbose } from "../globals.js";
+import { GatewayLockError } from "../infra/gateway-lock.js";
 import { loginWeb, logoutWeb } from "../provider-web.js";
 import { runRpcLoop } from "../rpc/loop.js";
 import { defaultRuntime } from "../runtime.js";
@@ -325,6 +326,11 @@ Examples:
       try {
         await startGatewayServer(port);
       } catch (err) {
+        if (err instanceof GatewayLockError) {
+          defaultRuntime.error(`Gateway failed to start: ${err.message}`);
+          defaultRuntime.exit(1);
+          return;
+        }
         defaultRuntime.error(`Gateway failed to start: ${String(err)}`);
         defaultRuntime.exit(1);
       }

src/gateway/server.ts

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import os from "node:os";
 import { type WebSocket, WebSocketServer } from "ws";
+import { GatewayLockError, acquireGatewayLock } from "../infra/gateway-lock.js";
 import { createDefaultDeps } from "../cli/deps.js";
 import { agentCommand } from "../commands/agent.js";
 import { getHealthSnapshot } from "../commands/health.js";
@@ -102,6 +103,12 @@ function formatError(err: unknown): string {
 }
 
 export async function startGatewayServer(port = 18789): Promise<GatewayServer> {
+  const releaseLock = await acquireGatewayLock().catch((err) => {
+    // Bubble known lock errors so callers can present a nice message.
+    if (err instanceof GatewayLockError) throw err;
+    throw new GatewayLockError(String(err));
+  });
+
   const wss = new WebSocketServer({
     port,
     host: "127.0.0.1",
@@ -623,6 +630,7 @@ export async function startGatewayServer(port = 18789): Promise<GatewayServer> {
 
   return {
     close: async () => {
+      await releaseLock();
       providerAbort.abort();
       broadcast("shutdown", {
         reason: "gateway stopping",