perf(cli): narrow gateway dispatch startup

src/cli/gateway-dispatch-dotenv.ts

@@ -0,0 +1,21 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveStateDir } from "../config/paths.js";
+import { loadGlobalRuntimeDotEnvFiles } from "../infra/dotenv-global.js";
+
+export async function loadGatewayDispatchCliDotEnv(opts?: { quiet?: boolean }) {
+  const quiet = opts?.quiet ?? true;
+  const cwdEnvPath = path.join(process.cwd(), ".env");
+  if (fs.existsSync(cwdEnvPath)) {
+    const { loadCliDotEnv } = await import("./dotenv.js");
+    loadCliDotEnv({ quiet });
+    return;
+  }
+
+  // Agent dispatch only needs trusted runtime env for gateway credentials.
+  // Workspace .env still falls back to the full provider-aware loader above.
+  loadGlobalRuntimeDotEnvFiles({
+    quiet,
+    stateEnvPath: path.join(resolveStateDir(process.env), ".env"),
+  });
+}

src/cli/run-main.ts

@@ -111,6 +111,10 @@ function createGatewayCliMainStartupTrace(argv: string[]) {
   };
 }
 
+function isRemoteAgentDispatchInvocation(argv: string[], primary: string | null): boolean {
+  return primary === "agent" && !argv.includes("--local");
+}
+
 export function isGatewayRunFastPathArgv(argv: string[]): boolean {
   const invocation = resolveCliArgvInvocation(argv);
   if (invocation.hasHelpOrVersion) {
@@ -500,8 +504,13 @@ export async function runCli(argv: string[] = process.argv) {
 
   if (!isHelpOrVersionInvocation && shouldLoadCliDotEnv()) {
     await startupTrace.measure("dotenv", async () => {
-      const { loadCliDotEnv } = await import("./dotenv.js");
-      loadCliDotEnv({ quiet: true });
+      if (isRemoteAgentDispatchInvocation(normalizedArgv, normalizedInvocation.primary)) {
+        const { loadGatewayDispatchCliDotEnv } = await import("./gateway-dispatch-dotenv.js");
+        await loadGatewayDispatchCliDotEnv({ quiet: true });
+      } else {
+        const { loadCliDotEnv } = await import("./dotenv.js");
+        loadCliDotEnv({ quiet: true });
+      }
     });
   }
   normalizeEnv();