@ai-support-agent/cli 0.1.35 → 0.2.0-beta.0

package/dist/ecs/ecs-launcher.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * Launcher-side handlers for the `ecs_launch` / `ecs_stop` commands.
+ *
+ * A resident agent with local AWS credentials acts as the "launcher": it
+ * receives `ecs_launch` via the normal dispatch path (AppSync) and starts a
+ * oneshot ECS task with RunTask, injecting the per-run environment
+ * (COMMAND_ID, oneshot token, ...) through containerOverrides.
+ *
+ * SECURITY: the containerEnv payload contains AGENT_ONESHOT_TOKEN. Its
+ * values must never be logged — only log resource identifiers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ecsLaunch = ecsLaunch;
+exports.ecsStop = ecsStop;
+const client_ecs_1 = require("@aws-sdk/client-ecs");
+const aws_arn_1 = require("./aws-arn");
+const constants_1 = require("../constants");
+const logger_1 = require("../logger");
+const types_1 = require("../types");
+const utils_1 = require("../utils");
+function parseStringArray(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return null;
+    if (!value.every((v) => typeof v === 'string' && v.length > 0))
+        return null;
+    return value;
+}
+function validateLaunchPayload(p) {
+    const taskDefinitionArn = typeof p.taskDefinitionArn === 'string' && p.taskDefinitionArn ? p.taskDefinitionArn : null;
+    if (!taskDefinitionArn)
+        return 'taskDefinitionArn is required for ecs_launch';
+    const clusterArn = typeof p.clusterArn === 'string' && p.clusterArn ? p.clusterArn : null;
+    if (!clusterArn)
+        return 'clusterArn is required for ecs_launch';
+    const subnetIds = parseStringArray(p.subnetIds);
+    if (!subnetIds)
+        return 'subnetIds (non-empty string array) is required for ecs_launch';
+    const securityGroupIds = parseStringArray(p.securityGroupIds);
+    if (!securityGroupIds)
+        return 'securityGroupIds (non-empty string array) is required for ecs_launch';
+    const rawEnv = p.containerEnv;
+    if (typeof rawEnv !== 'object' || rawEnv === null || Array.isArray(rawEnv)) {
+        return 'containerEnv (object) is required for ecs_launch';
+    }
+    const containerEnv = {};
+    for (const [key, value] of Object.entries(rawEnv)) {
+        if (typeof value !== 'string') {
+            return `containerEnv.${key} must be a string`;
+        }
+        containerEnv[key] = value;
+    }
+    return {
+        taskDefinitionArn,
+        clusterArn,
+        subnetIds,
+        securityGroupIds,
+        assignPublicIp: p.assignPublicIp === true,
+        containerEnv,
+    };
+}
+/**
+ * Handle the `ecs_launch` command: RunTask (FARGATE, awsvpc) with the
+ * payload's containerEnv injected via containerOverrides.
+ * Returns `{ taskArn }` on success, or a failed result carrying RunTask
+ * `failures` details so the API can mark the work command/task as failed.
+ */
+async function ecsLaunch(p) {
+    const validated = validateLaunchPayload(p);
+    if (typeof validated === 'string') {
+        return (0, types_1.errorResult)(validated);
+    }
+    const region = (0, aws_arn_1.regionFromArn)(validated.clusterArn);
+    if (!region) {
+        return (0, types_1.errorResult)(`Could not determine region from clusterArn: ${validated.clusterArn}`);
+    }
+    // Do NOT log containerEnv — it carries AGENT_ONESHOT_TOKEN.
+    logger_1.logger.info(`[ecs] RunTask: taskDefinition=${validated.taskDefinitionArn} cluster=${validated.clusterArn}`);
+    try {
+        const client = new client_ecs_1.ECSClient({ region });
+        const response = await client.send(new client_ecs_1.RunTaskCommand({
+            cluster: validated.clusterArn,
+            taskDefinition: validated.taskDefinitionArn,
+            launchType: 'FARGATE',
+            count: 1,
+            networkConfiguration: {
+                awsvpcConfiguration: {
+                    subnets: validated.subnetIds,
+                    securityGroups: validated.securityGroupIds,
+                    assignPublicIp: validated.assignPublicIp ? 'ENABLED' : 'DISABLED',
+                },
+            },
+            overrides: {
+                containerOverrides: [
+                    {
+                        name: constants_1.ECS_AGENT_CONTAINER_NAME,
+                        environment: Object.entries(validated.containerEnv).map(([name, value]) => ({ name, value })),
+                    },
+                ],
+            },
+        }));
+        if (response.failures && response.failures.length > 0) {
+            const reasons = response.failures
+                .map((f) => `${f.reason ?? 'unknown'}${f.detail ? ` (${f.detail})` : ''}`)
+                .join('; ');
+            logger_1.logger.error(`[ecs] RunTask failed: ${reasons}`);
+            return (0, types_1.errorResult)(`ECS RunTask failed: ${reasons}`, { failures: response.failures });
+        }
+        const taskArn = response.tasks?.[0]?.taskArn;
+        if (!taskArn) {
+            return (0, types_1.errorResult)('ECS RunTask returned no task');
+        }
+        logger_1.logger.success(`[ecs] Task started: ${taskArn}`);
+        return (0, types_1.successResult)({ taskArn });
+    }
+    catch (error) {
+        const message = (0, utils_1.getErrorMessage)(error);
+        logger_1.logger.error(`[ecs] RunTask error: ${message}`);
+        return (0, types_1.errorResult)(`ECS RunTask error: ${message}`);
+    }
+}
+/**
+ * Handle the `ecs_stop` command: best-effort StopTask (used by the API's
+ * timeout sweep to reclaim timed-out oneshot containers).
+ */
+async function ecsStop(p) {
+    const clusterArn = typeof p.clusterArn === 'string' && p.clusterArn ? p.clusterArn : null;
+    if (!clusterArn)
+        return (0, types_1.errorResult)('clusterArn is required for ecs_stop');
+    const taskArn = typeof p.taskArn === 'string' && p.taskArn ? p.taskArn : null;
+    if (!taskArn)
+        return (0, types_1.errorResult)('taskArn is required for ecs_stop');
+    const region = (0, aws_arn_1.regionFromArn)(clusterArn);
+    if (!region) {
+        return (0, types_1.errorResult)(`Could not determine region from clusterArn: ${clusterArn}`);
+    }
+    logger_1.logger.info(`[ecs] StopTask: ${taskArn}`);
+    try {
+        const client = new client_ecs_1.ECSClient({ region });
+        const response = await client.send(new client_ecs_1.StopTaskCommand({
+            cluster: clusterArn,
+            task: taskArn,
+            reason: 'Stopped by ai-support-agent launcher (timeout or cancel)',
+        }));
+        return (0, types_1.successResult)({
+            stopped: true,
+            taskArn,
+            lastStatus: response.task?.lastStatus,
+        });
+    }
+    catch (error) {
+        const message = (0, utils_1.getErrorMessage)(error);
+        logger_1.logger.warn(`[ecs] StopTask failed (best-effort): ${message}`);
+        return (0, types_1.errorResult)(`ECS StopTask failed: ${message}`, { stopped: false, taskArn });
+    }
+}
+//# sourceMappingURL=ecs-launcher.js.map

package/dist/ecs/ecs-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecs-launcher.js","sourceRoot":"","sources":["../../src/ecs/ecs-launcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AA+DH,8BAyDC;AAMD,0BA6BC;AAzJD,oDAAgF;AAEhF,uCAAyC;AACzC,4CAAuD;AACvD,sCAAkC;AAClC,oCAAyE;AACzE,oCAA0C;AAW1C,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,KAAiB,CAAA;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,CAA0B;IACvD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAA;IACrH,IAAI,CAAC,iBAAiB;QAAE,OAAO,8CAA8C,CAAA;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;IACzF,IAAI,CAAC,UAAU;QAAE,OAAO,uCAAuC,CAAA;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,+DAA+D,CAAA;IACtF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,IAAI,CAAC,gBAAgB;QAAE,OAAO,sEAAsE,CAAA;IAEpG,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAA;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,kDAAkD,CAAA;IAC3D,CAAC;IACD,MAAM,YAAY,GAA2B,EAAE,CAAA;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,gBAAgB,GAAG,mBAAmB,CAAA;QAC/C,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,iBAAiB;QACjB,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,cAAc,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI;QACzC,YAAY;KACb,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,SAAS,CAAC,CAA0B;IACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAC1C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAA,mBAAW,EAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAA,mBAAW,EAAC,+CAA+C,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,4DAA4D;IAC5D,eAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,iBAAiB,YAAY,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;IAE3G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,2BAAc,CAAC;YACpD,OAAO,EAAE,SAAS,CAAC,UAAU;YAC7B,cAAc,EAAE,SAAS,CAAC,iBAAiB;YAC3C,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE,CAAC;YACR,oBAAoB,EAAE;gBACpB,mBAAmB,EAAE;oBACnB,OAAO,EAAE,SAAS,CAAC,SAAS;oBAC5B,cAAc,EAAE,SAAS,CAAC,gBAAgB;oBAC1C,cAAc,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;iBAClE;aACF;YACD,SAAS,EAAE;gBACT,kBAAkB,EAAE;oBAClB;wBACE,IAAI,EAAE,oCAAwB;wBAC9B,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;qBAC9F;iBACF;aACF;SACF,CAAC,CAAC,CAAA;QAEH,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;iBACzE,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,eAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAChD,OAAO,IAAA,mBAAW,EAAC,uBAAuB,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAA;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAA,mBAAW,EAAC,8BAA8B,CAAC,CAAA;QACpD,CAAC;QACD,eAAM,CAAC,OAAO,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAA;QAChD,OAAO,IAAA,qBAAa,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAA;QACtC,eAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAA;QAC/C,OAAO,IAAA,mBAAW,EAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,OAAO,CAAC,CAA0B;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;IACzF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAA,mBAAW,EAAC,qCAAqC,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,mBAAW,EAAC,kCAAkC,CAAC,CAAA;IAEpE,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,UAAU,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAA,mBAAW,EAAC,+CAA+C,UAAU,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,4BAAe,CAAC;YACrD,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,0DAA0D;SACnE,CAAC,CAAC,CAAA;QACH,OAAO,IAAA,qBAAa,EAAC;YACnB,OAAO,EAAE,IAAI;YACb,OAAO;YACP,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU;SACtC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAA;QACtC,eAAM,CAAC,IAAI,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAA;QAC9D,OAAO,IAAA,mBAAW,EAAC,wBAAwB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACpF,CAAC;AACH,CAAC"}

package/dist/ecs/launcher-capability.d.ts

@@ -0,0 +1,26 @@
+/**
+ * ecs_launch capability detection.
+ *
+ * A resident agent should only advertise the `ecs_launch` capability when it
+ * can actually perform ECS RunTask/StopTask — i.e. when AWS credentials are
+ * resolvable through the default provider chain (env vars, shared
+ * config/credentials files, SSO cache, IMDS/ECS metadata, ...). Advertising
+ * it unconditionally would let the API's automatic launcher selection pick an
+ * agent that cannot launch anything, making ECS dispatch fail unpredictably.
+ *
+ * Override (checked before detection):
+ *   AI_SUPPORT_AGENT_ECS_LAUNCHER=true   force-enable, skip detection
+ *   AI_SUPPORT_AGENT_ECS_LAUNCHER=false  force-disable, skip detection
+ *
+ * The detection result is cached for the process lifetime so the register
+ * retry loop does not re-probe the credential chain (IMDS/STS) on every
+ * attempt.
+ */
+/** Reset the positive-detection cache (tests only). */
+export declare function resetEcsLauncherCapabilityCache(): void;
+/**
+ * Decide whether this agent should advertise the `ecs_launch` capability.
+ * Returns true when credentials are resolvable or force-enabled via env.
+ */
+export declare function detectEcsLauncherCapability(env?: NodeJS.ProcessEnv, timeoutMs?: number): Promise<boolean>;
+//# sourceMappingURL=launcher-capability.d.ts.map

package/dist/ecs/launcher-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher-capability.d.ts","sourceRoot":"","sources":["../../src/ecs/launcher-capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAeH,uDAAuD;AACvD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAuBD;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,MAAuC,GACjD,OAAO,CAAC,OAAO,CAAC,CAyBlB"}

package/dist/ecs/launcher-capability.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * ecs_launch capability detection.
+ *
+ * A resident agent should only advertise the `ecs_launch` capability when it
+ * can actually perform ECS RunTask/StopTask — i.e. when AWS credentials are
+ * resolvable through the default provider chain (env vars, shared
+ * config/credentials files, SSO cache, IMDS/ECS metadata, ...). Advertising
+ * it unconditionally would let the API's automatic launcher selection pick an
+ * agent that cannot launch anything, making ECS dispatch fail unpredictably.
+ *
+ * Override (checked before detection):
+ *   AI_SUPPORT_AGENT_ECS_LAUNCHER=true   force-enable, skip detection
+ *   AI_SUPPORT_AGENT_ECS_LAUNCHER=false  force-disable, skip detection
+ *
+ * The detection result is cached for the process lifetime so the register
+ * retry loop does not re-probe the credential chain (IMDS/STS) on every
+ * attempt.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetEcsLauncherCapabilityCache = resetEcsLauncherCapabilityCache;
+exports.detectEcsLauncherCapability = detectEcsLauncherCapability;
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const constants_1 = require("../constants");
+const logger_1 = require("../logger");
+const utils_1 = require("../utils");
+// Only a POSITIVE detection is cached for the process lifetime. A negative
+// result (e.g. a transient 3s IMDS timeout during cold start) must NOT be
+// sticky, or credentials that become available later would never be picked
+// up. Re-detection on subsequent register attempts is safe because the
+// register loop is backoff-based, so this cannot spam STS/IMDS.
+let credentialsConfirmed = false;
+/** Reset the positive-detection cache (tests only). */
+function resetEcsLauncherCapabilityCache() {
+    credentialsConfirmed = false;
+}
+async function credentialsResolvable(timeoutMs) {
+    let timer;
+    try {
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`credential resolution timed out after ${timeoutMs}ms`)), timeoutMs);
+            timer.unref?.();
+        });
+        const credentials = await Promise.race([(0, credential_providers_1.fromNodeProviderChain)()(), timeout]);
+        // Never log the credential values — only whether resolution succeeded.
+        return Boolean(credentials?.accessKeyId);
+    }
+    catch (error) {
+        logger_1.logger.info(`[ecs] AWS credentials not resolvable: ${(0, utils_1.getErrorMessage)(error)}`);
+        return false;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/**
+ * Decide whether this agent should advertise the `ecs_launch` capability.
+ * Returns true when credentials are resolvable or force-enabled via env.
+ */
+async function detectEcsLauncherCapability(env = process.env, timeoutMs = constants_1.ECS_LAUNCHER_DETECT_TIMEOUT_MS) {
+    const override = env[constants_1.ENV_VARS.ECS_LAUNCHER];
+    if (override === 'false') {
+        logger_1.logger.info(`[ecs] ecs_launch capability disabled (${constants_1.ENV_VARS.ECS_LAUNCHER}=false)`);
+        return false;
+    }
+    if (override === 'true') {
+        logger_1.logger.info(`[ecs] ecs_launch capability force-enabled (${constants_1.ENV_VARS.ECS_LAUNCHER}=true, credential detection skipped)`);
+        return true;
+    }
+    // A confirmed positive is sticky; a previous negative falls through to a
+    // fresh probe on the next call.
+    if (credentialsConfirmed) {
+        return true;
+    }
+    const resolved = await credentialsResolvable(timeoutMs);
+    if (resolved) {
+        credentialsConfirmed = true;
+        logger_1.logger.info('[ecs] AWS credentials resolved; advertising ecs_launch capability');
+    }
+    else {
+        logger_1.logger.info('[ecs] ecs_launch capability not advertised (no resolvable AWS credentials; will re-check on next registration)');
+    }
+    return resolved;
+}
+//# sourceMappingURL=launcher-capability.js.map

package/dist/ecs/launcher-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher-capability.js","sourceRoot":"","sources":["../../src/ecs/launcher-capability.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAgBH,0EAEC;AA2BD,kEA4BC;AAvED,wEAAqE;AAErE,4CAAuE;AACvE,sCAAkC;AAClC,oCAA0C;AAE1C,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,gEAAgE;AAChE,IAAI,oBAAoB,GAAG,KAAK,CAAA;AAEhC,uDAAuD;AACvD,SAAgB,+BAA+B;IAC7C,oBAAoB,GAAG,KAAK,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IACpD,IAAI,KAAiC,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,SAAS,IAAI,CAAC,CAAC,EAC/E,SAAS,CACV,CAAA;YACD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACjB,CAAC,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAA,4CAAqB,GAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5E,uEAAuE;QACvE,OAAO,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,IAAI,CAAC,yCAAyC,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,2BAA2B,CAC/C,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAoB,0CAA8B;IAElD,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAQ,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,eAAM,CAAC,IAAI,CAAC,yCAAyC,oBAAQ,CAAC,YAAY,SAAS,CAAC,CAAA;QACpF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,eAAM,CAAC,IAAI,CAAC,8CAA8C,oBAAQ,CAAC,YAAY,sCAAsC,CAAC,CAAA;QACtH,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yEAAyE;IACzE,gCAAgC;IAChC,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,oBAAoB,GAAG,IAAI,CAAA;QAC3B,eAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,eAAM,CAAC,IAAI,CAAC,gHAAgH,CAAC,CAAA;IAC/H,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/ecs/task-definition-registrar.d.ts

@@ -0,0 +1,39 @@
+/**
+ * ECS task definition registrar for `ecs publish`.
+ *
+ * Registers a Fargate task definition for the ECS execution agent:
+ * - image pinned by digest (`<repo>@sha256:...`)
+ * - awslogs log driver (log group created when missing)
+ * - NO environment variables in the task definition — COMMAND_ID, the
+ *   oneshot token, etc. are injected per run via containerOverrides.
+ */
+import { CloudWatchLogsClient } from '@aws-sdk/client-cloudwatch-logs';
+export interface RegisterEcsTaskDefinitionOptions {
+    /** Task definition family: ai-support-ecs-agent-{tenantCode}-{agentId} */
+    family: string;
+    /** Digest-pinned image URI */
+    imageUri: string;
+    cpu: number;
+    memory: number;
+    region: string;
+    logGroupName: string;
+    /** Task execution role (required by Fargate for ECR pull / awslogs) */
+    executionRoleArn?: string;
+    /** Task role assumed by the container itself */
+    taskRoleArn?: string;
+}
+export interface RegisteredTaskDefinition {
+    taskDefinitionArn: string;
+    family: string;
+    revision: number;
+}
+/**
+ * Create the awslogs log group when it does not exist.
+ * ResourceAlreadyExistsException is tolerated (idempotent).
+ */
+export declare function ensureLogGroup(client: CloudWatchLogsClient, logGroupName: string): Promise<void>;
+/**
+ * Register the Fargate task definition and return its ARN.
+ */
+export declare function registerTaskDefinition(options: RegisterEcsTaskDefinitionOptions): Promise<RegisteredTaskDefinition>;
+//# sourceMappingURL=task-definition-registrar.d.ts.map

package/dist/ecs/task-definition-registrar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-definition-registrar.d.ts","sourceRoot":"","sources":["../../src/ecs/task-definition-registrar.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,oBAAoB,EAErB,MAAM,iCAAiC,CAAA;AAMxC,MAAM,WAAW,gCAAgC;IAC/C,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,EAAE,MAAM,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,EAC5B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,wBAAwB,CAAC,CA0CnC"}

package/dist/ecs/task-definition-registrar.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * ECS task definition registrar for `ecs publish`.
+ *
+ * Registers a Fargate task definition for the ECS execution agent:
+ * - image pinned by digest (`<repo>@sha256:...`)
+ * - awslogs log driver (log group created when missing)
+ * - NO environment variables in the task definition — COMMAND_ID, the
+ *   oneshot token, etc. are injected per run via containerOverrides.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureLogGroup = ensureLogGroup;
+exports.registerTaskDefinition = registerTaskDefinition;
+const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
+const client_ecs_1 = require("@aws-sdk/client-ecs");
+const constants_1 = require("../constants");
+const logger_1 = require("../logger");
+/**
+ * Create the awslogs log group when it does not exist.
+ * ResourceAlreadyExistsException is tolerated (idempotent).
+ */
+async function ensureLogGroup(client, logGroupName) {
+    try {
+        await client.send(new client_cloudwatch_logs_1.CreateLogGroupCommand({ logGroupName }));
+        logger_1.logger.info(`[ecs] Created log group: ${logGroupName}`);
+    }
+    catch (error) {
+        const name = error.name;
+        if (name === 'ResourceAlreadyExistsException') {
+            logger_1.logger.debug(`[ecs] Log group already exists: ${logGroupName}`);
+            return;
+        }
+        throw error;
+    }
+}
+/**
+ * Register the Fargate task definition and return its ARN.
+ */
+async function registerTaskDefinition(options) {
+    const logsClient = new client_cloudwatch_logs_1.CloudWatchLogsClient({ region: options.region });
+    await ensureLogGroup(logsClient, options.logGroupName);
+    const ecsClient = new client_ecs_1.ECSClient({ region: options.region });
+    const response = await ecsClient.send(new client_ecs_1.RegisterTaskDefinitionCommand({
+        family: options.family,
+        requiresCompatibilities: ['FARGATE'],
+        networkMode: 'awsvpc',
+        cpu: String(options.cpu),
+        memory: String(options.memory),
+        ...(options.executionRoleArn && { executionRoleArn: options.executionRoleArn }),
+        ...(options.taskRoleArn && { taskRoleArn: options.taskRoleArn }),
+        containerDefinitions: [
+            {
+                name: constants_1.ECS_AGENT_CONTAINER_NAME,
+                image: options.imageUri,
+                essential: true,
+                // No environment variables here: they are injected at RunTask time
+                // via containerOverrides so secrets never persist in the definition.
+                logConfiguration: {
+                    logDriver: 'awslogs',
+                    options: {
+                        'awslogs-group': options.logGroupName,
+                        'awslogs-region': options.region,
+                        'awslogs-stream-prefix': 'ecs-agent',
+                    },
+                },
+            },
+        ],
+    }));
+    const taskDefinition = response.taskDefinition;
+    if (!taskDefinition?.taskDefinitionArn) {
+        throw new Error('ECS RegisterTaskDefinition returned no task definition ARN');
+    }
+    logger_1.logger.success(`[ecs] Registered task definition: ${taskDefinition.taskDefinitionArn}`);
+    return {
+        taskDefinitionArn: taskDefinition.taskDefinitionArn,
+        family: taskDefinition.family ?? options.family,
+        revision: taskDefinition.revision ?? 0,
+    };
+}
+//# sourceMappingURL=task-definition-registrar.js.map

package/dist/ecs/task-definition-registrar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-definition-registrar.js","sourceRoot":"","sources":["../../src/ecs/task-definition-registrar.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAoCH,wCAeC;AAKD,wDA4CC;AAlGD,4EAGwC;AACxC,oDAA8E;AAE9E,4CAAuD;AACvD,sCAAkC;AAuBlC;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,MAA4B,EAC5B,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;QAC9D,eAAM,CAAC,IAAI,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,IAAI,KAAK,gCAAgC,EAAE,CAAC;YAC9C,eAAM,CAAC,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,sBAAsB,CAC1C,OAAyC;IAEzC,MAAM,UAAU,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,MAAM,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAEtD,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,0CAA6B,CAAC;QACtE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,uBAAuB,EAAE,CAAC,SAAS,CAAC;QACpC,WAAW,EAAE,QAAQ;QACrB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAChE,oBAAoB,EAAE;YACpB;gBACE,IAAI,EAAE,oCAAwB;gBAC9B,KAAK,EAAE,OAAO,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI;gBACf,mEAAmE;gBACnE,qEAAqE;gBACrE,gBAAgB,EAAE;oBAChB,SAAS,EAAE,SAAS;oBACpB,OAAO,EAAE;wBACP,eAAe,EAAE,OAAO,CAAC,YAAY;wBACrC,gBAAgB,EAAE,OAAO,CAAC,MAAM;wBAChC,uBAAuB,EAAE,WAAW;qBACrC;iBACF;aACF;SACF;KACF,CAAC,CAAC,CAAA;IAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAA;IAC9C,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,eAAM,CAAC,OAAO,CAAC,qCAAqC,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACvF,OAAO;QACL,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;QACnD,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;QAC/C,QAAQ,EAAE,cAAc,CAAC,QAAQ,IAAI,CAAC;KACvC,CAAA;AACH,CAAC"}

package/dist/index.js

@@ -37,6 +37,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const commander_1 = require("commander");
 const agent_runner_1 = require("./agent-runner");
 const auth_commands_1 = require("./cli/auth-commands");
+const ecs_publish_command_1 = require("./cli/ecs-publish-command");
 const log_rotate_command_1 = require("./cli/log-rotate-command");
 const service_command_1 = require("./cli/service-command");
 const status_command_1 = require("./cli/status-command");
@@ -194,5 +195,20 @@ program
 (0, service_command_1.registerServiceCommands)(program);
 (0, set_project_dir_1.registerSetProjectDirCommand)(program);
 (0, log_rotate_command_1.registerLogRotateCommand)(program);
-program.parse();
+(0, ecs_publish_command_1.registerEcsCommands)(program);
+// ECS container mode: AGENT_MODE=oneshot (injected via RunTask
+// containerOverrides) bypasses the CLI entirely and runs exactly one command
+// (getCommand -> execute -> submitResult -> exit). See src/oneshot-runner.ts.
+if (process.env[constants_1.ONESHOT_ENV_VARS.AGENT_MODE] === constants_1.AGENT_MODE_ONESHOT) {
+    // A rejection escaping here (e.g. the dynamic import itself failing) would
+    // otherwise leave the ECS container hanging with no exit — always exit 1.
+    Promise.resolve().then(() => __importStar(require('./oneshot-runner'))).then(({ runOneshotFromEnv }) => runOneshotFromEnv())
+        .catch((error) => {
+        logger_1.logger.error(`[oneshot] Fatal startup error: ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
+    });
+}
+else {
+    program.parse();
+}
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,yCAAmC;AAEnC,iDAA2C;AAC3C,uDAA0D;AAC1D,iEAAmE;AACnE,2DAA+D;AAC/D,yDAA4D;AAC5D,gEAAyE;AACzE,gEAAmE;AACnE,+CAAiE;AACjE,iDAA6E;AAC7E,2CAMoB;AAEpB,uCAAwB;AAExB,qDAIyB;AACzB,iCAAoC;AACpC,qCAAiC;AAEjC,IAAA,eAAQ,GAAE,CAAA;AAEV,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAA;AAE7B,OAAO;KACJ,IAAI,CAAC,kBAAkB,CAAC;KACxB,WAAW,CAAC,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KACjC,OAAO,CAAC,yBAAa,CAAC;KACtB,MAAM,CAAC,eAAe,EAAE,IAAA,QAAC,EAAC,UAAU,CAAC,CAAC,CAAA;AAEzC,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,IAAA,QAAC,EAAC,WAAW,CAAC,CAAC;KAC3B,MAAM,CAAC,iBAAiB,EAAE,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,IAAA,QAAC,EAAC,kBAAkB,CAAC,CAAC;KAChD,MAAM,CAAC,sBAAsB,EAAE,GAAG,IAAA,QAAC,EAAC,wBAAwB,CAAC,eAAe,EAAE,MAAM,CAAC;KACrF,MAAM,CAAC,2BAA2B,EAAE,IAAA,QAAC,EAAC,6BAA6B,CAAC,EAAE,OAAO,CAAC;KAC9E,MAAM,CAAC,4BAAgB,EAAE,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KAChD,MAAM,CAAC,mCAAuB,EAAE,IAAA,QAAC,EAAC,wBAAwB,CAAC,CAAC;KAC5D,MAAM,CAAC,4BAA4B,EAAE,IAAA,QAAC,EAAC,yBAAyB,CAAC,CAAC;KAClE,MAAM,CAAC,8BAAkB,EAAE,IAAA,QAAC,EAAC,oBAAoB,CAAC,CAAC;KACnD,MAAM,CAAC,qBAAqB,EAAE,IAAA,QAAC,EAAC,sBAAsB,CAAC,CAAC;KACxD,MAAM,CAAC,uCAA2B,EAAE,IAAA,QAAC,EAAC,4BAA4B,CAAC,CAAC;KACpE,MAAM,CAAC,oCAAoC,EAAE,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,IAYd,EAAE,EAAE;IACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAA;QAC9D,WAAW,CAAC;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC;YACrE,iBAAiB,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;YACpF,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,kCAAqB,EAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC/D,MAAM,IAAA,yBAAU,EAAC;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC;QACrE,iBAAiB,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;QACpF,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa,EAAE,aAA2C;QAC1D,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,IAAA,QAAC,EAAC,UAAU,CAAC,CAAC;KAC1B,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,uBAAuB,GAAC,CAAA;IAC3D,MAAM,SAAS,EAAE,CAAA;AACnB,CAAC,CAAC,CAAA;AAEJ,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAA;AAE7B,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KACnC,QAAQ,CAAC,eAAe,EAAE,IAAA,QAAC,EAAC,uBAAuB,CAAC,CAAC;KACrD,MAAM,CAAC,CAAC,WAAmB,EAAE,EAAE;IAC9B,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAA,2BAAU,GAAE,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAA;IAC5E,IAAI,OAAO,EAAE,UAAU,IAAI,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAA,+BAAiB,EAClC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,EACrH,MAAM,EAAE,iBAAiB,CAC1B,CAAA;YACD,MAAM,WAAW,GAAG,IAAA,4BAAc,EAAC,UAAU,CAAC,CAAA;YAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;YACvD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,8BAAa,EAAC,WAAW,CAAC,CAAA;IAC1C,IAAI,OAAO,EAAE,CAAC;QACZ,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,iBAAiB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KACjC,QAAQ,CAAC,QAAQ,EAAE,IAAA,QAAC,EAAC,qBAAqB,CAAC,CAAC;KAC5C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,IAAA,2BAAU,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACnD,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KACnC,MAAM,CAAC,UAAU,EAAE,IAAA,QAAC,EAAC,0BAA0B,CAAC,CAAC;KACjD,MAAM,CAAC,WAAW,EAAE,IAAA,QAAC,EAAC,2BAA2B,CAAC,CAAC;KACnD,MAAM,CAAC,qBAAqB,EAAE,IAAA,QAAC,EAAC,2BAA2B,CAAC,CAAC;KAC7D,MAAM,CAAC,CAAC,IAA+D,EAAE,EAAE;IAC1E,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACnD,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,sBAAsB,CAAC,CAAC,CAAA;QACtC,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,2BAAU,GAAE,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,EAAE,UAAU,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,QAA0B,EAAE,CAAA;IAE/G,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,0BAA0B,CAAC,CAAC,CAAA;QAC1C,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,kCAAqB,EAAC,IAAI,CAAC,OAAO,CAA+B,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5G,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAA;IAED,IAAA,2BAAU,EAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAEnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,qBAAqB,CAAC,CAAC,CAAA;IAC1C,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACzD,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KACjC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAA;IAC9D,WAAW,EAAE,CAAA;AACf,CAAC,CAAC,CAAA;AAEJ,IAAA,wCAAsB,EAAC,OAAO,CAAC,CAAA;AAE/B,IAAA,sCAAqB,EAAC,OAAO,CAAC,CAAA;AAC9B,IAAA,yCAAuB,EAAC,OAAO,CAAC,CAAA;AAChC,IAAA,8CAA4B,EAAC,OAAO,CAAC,CAAA;AACrC,IAAA,6CAAwB,EAAC,OAAO,CAAC,CAAA;AAEjC,OAAO,CAAC,KAAK,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,yCAAmC;AAEnC,iDAA2C;AAC3C,uDAA0D;AAC1D,mEAA+D;AAC/D,iEAAmE;AACnE,2DAA+D;AAC/D,yDAA4D;AAC5D,gEAAyE;AACzE,gEAAmE;AACnE,+CAAiE;AACjE,iDAA6E;AAC7E,2CAQoB;AAEpB,uCAAwB;AAExB,qDAIyB;AACzB,iCAAoC;AACpC,qCAAiC;AAEjC,IAAA,eAAQ,GAAE,CAAA;AAEV,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAA;AAE7B,OAAO;KACJ,IAAI,CAAC,kBAAkB,CAAC;KACxB,WAAW,CAAC,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KACjC,OAAO,CAAC,yBAAa,CAAC;KACtB,MAAM,CAAC,eAAe,EAAE,IAAA,QAAC,EAAC,UAAU,CAAC,CAAC,CAAA;AAEzC,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,IAAA,QAAC,EAAC,WAAW,CAAC,CAAC;KAC3B,MAAM,CAAC,iBAAiB,EAAE,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,IAAA,QAAC,EAAC,kBAAkB,CAAC,CAAC;KAChD,MAAM,CAAC,sBAAsB,EAAE,GAAG,IAAA,QAAC,EAAC,wBAAwB,CAAC,eAAe,EAAE,MAAM,CAAC;KACrF,MAAM,CAAC,2BAA2B,EAAE,IAAA,QAAC,EAAC,6BAA6B,CAAC,EAAE,OAAO,CAAC;KAC9E,MAAM,CAAC,4BAAgB,EAAE,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KAChD,MAAM,CAAC,mCAAuB,EAAE,IAAA,QAAC,EAAC,wBAAwB,CAAC,CAAC;KAC5D,MAAM,CAAC,4BAA4B,EAAE,IAAA,QAAC,EAAC,yBAAyB,CAAC,CAAC;KAClE,MAAM,CAAC,8BAAkB,EAAE,IAAA,QAAC,EAAC,oBAAoB,CAAC,CAAC;KACnD,MAAM,CAAC,qBAAqB,EAAE,IAAA,QAAC,EAAC,sBAAsB,CAAC,CAAC;KACxD,MAAM,CAAC,uCAA2B,EAAE,IAAA,QAAC,EAAC,4BAA4B,CAAC,CAAC;KACpE,MAAM,CAAC,oCAAoC,EAAE,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KACpE,MAAM,CAAC,KAAK,EAAE,IAYd,EAAE,EAAE;IACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAA;QAC9D,WAAW,CAAC;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC;YACrE,iBAAiB,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;YACpF,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,kCAAqB,EAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC/D,MAAM,IAAA,yBAAU,EAAC;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC;QACrE,iBAAiB,EAAE,IAAA,gCAAmB,EAAC,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;QACpF,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa,EAAE,aAA2C;QAC1D,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,IAAA,QAAC,EAAC,UAAU,CAAC,CAAC;KAC1B,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,uBAAuB,GAAC,CAAA;IAC3D,MAAM,SAAS,EAAE,CAAA;AACnB,CAAC,CAAC,CAAA;AAEJ,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAA;AAE7B,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KACnC,QAAQ,CAAC,eAAe,EAAE,IAAA,QAAC,EAAC,uBAAuB,CAAC,CAAC;KACrD,MAAM,CAAC,CAAC,WAAmB,EAAE,EAAE;IAC9B,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAA,2BAAU,GAAE,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAA;IAC5E,IAAI,OAAO,EAAE,UAAU,IAAI,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAA,+BAAiB,EAClC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,EACrH,MAAM,EAAE,iBAAiB,CAC1B,CAAA;YACD,MAAM,WAAW,GAAG,IAAA,4BAAc,EAAC,UAAU,CAAC,CAAA;YAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3C,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,oBAAoB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;YACvD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,8BAAa,EAAC,WAAW,CAAC,CAAA;IAC1C,IAAI,OAAO,EAAE,CAAC;QACZ,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,iBAAiB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,kBAAkB,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KACjC,QAAQ,CAAC,QAAQ,EAAE,IAAA,QAAC,EAAC,qBAAqB,CAAC,CAAC;KAC5C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;IACvB,IAAA,2BAAU,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;AACnD,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,IAAA,QAAC,EAAC,mBAAmB,CAAC,CAAC;KACnC,MAAM,CAAC,UAAU,EAAE,IAAA,QAAC,EAAC,0BAA0B,CAAC,CAAC;KACjD,MAAM,CAAC,WAAW,EAAE,IAAA,QAAC,EAAC,2BAA2B,CAAC,CAAC;KACnD,MAAM,CAAC,qBAAqB,EAAE,IAAA,QAAC,EAAC,2BAA2B,CAAC,CAAC;KAC7D,MAAM,CAAC,CAAC,IAA+D,EAAE,EAAE;IAC1E,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACnD,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,sBAAsB,CAAC,CAAC,CAAA;QACtC,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,2BAAU,GAAE,CAAA;IAC3B,MAAM,OAAO,GAAG,MAAM,EAAE,UAAU,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,QAA0B,EAAE,CAAA;IAE/G,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,eAAM,CAAC,IAAI,CAAC,IAAA,QAAC,EAAC,0BAA0B,CAAC,CAAC,CAAA;QAC1C,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,kCAAqB,EAAC,IAAI,CAAC,OAAO,CAA+B,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5G,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAA;IAED,IAAA,2BAAU,EAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAEnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,qBAAqB,CAAC,CAAC,CAAA;IAC1C,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,eAAM,CAAC,OAAO,CAAC,IAAA,QAAC,EAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACzD,CAAC;AACH,CAAC,CAAC,CAAA;AAEJ,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,IAAA,QAAC,EAAC,iBAAiB,CAAC,CAAC;KACjC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,wBAAwB,GAAC,CAAA;IAC9D,WAAW,EAAE,CAAA;AACf,CAAC,CAAC,CAAA;AAEJ,IAAA,wCAAsB,EAAC,OAAO,CAAC,CAAA;AAE/B,IAAA,sCAAqB,EAAC,OAAO,CAAC,CAAA;AAC9B,IAAA,yCAAuB,EAAC,OAAO,CAAC,CAAA;AAChC,IAAA,8CAA4B,EAAC,OAAO,CAAC,CAAA;AACrC,IAAA,6CAAwB,EAAC,OAAO,CAAC,CAAA;AACjC,IAAA,yCAAmB,EAAC,OAAO,CAAC,CAAA;AAE5B,+DAA+D;AAC/D,6EAA6E;AAC7E,8EAA8E;AAC9E,IAAI,OAAO,CAAC,GAAG,CAAC,4BAAgB,CAAC,UAAU,CAAC,KAAK,8BAAkB,EAAE,CAAC;IACpE,2EAA2E;IAC3E,0EAA0E;IAC1E,kDAAO,kBAAkB,IACtB,IAAI,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,iBAAiB,EAAE,CAAC;SACpD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,eAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACN,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,KAAK,EAAE,CAAA;AACjB,CAAC"}

package/dist/locales/en.json

@@ -61,6 +61,24 @@
   "config.migrated": "Config migrated successfully.",
 
   "cmd.stop": "Stop the running agent",
+  "cmd.ecs": "ECS execution agent commands (launcher-agent architecture)",
+  "cmd.ecsPublish": "Build/push an image to ECR, register a task definition, and register the ECS execution agent with the API",
+  "cmd.ecsPublish.repositoryUri": "ECR repository URI to push the image to (required)",
+  "cmd.ecsPublish.tag": "Image tag (required)",
+  "cmd.ecsPublish.cluster": "Target ECS cluster ARN (required)",
+  "cmd.ecsPublish.subnets": "Subnet IDs for the awsvpc network configuration (required)",
+  "cmd.ecsPublish.securityGroups": "Security group IDs for the awsvpc network configuration (required)",
+  "cmd.ecsPublish.dockerfile": "Dockerfile used for the build",
+  "cmd.ecsPublish.image": "Use a pre-built local image (skips the build)",
+  "cmd.ecsPublish.cpu": "ECS task CPU units (default: 1024)",
+  "cmd.ecsPublish.memory": "ECS task memory in MiB (default: 2048)",
+  "cmd.ecsPublish.name": "Display name shown in the agent list",
+  "cmd.ecsPublish.assignPublicIp": "Assign a public IP to the task",
+  "cmd.ecsPublish.logGroup": "awslogs log group name (created when missing)",
+  "cmd.ecsPublish.executionRole": "ECS task execution role ARN (used for ECR pull / awslogs)",
+  "cmd.ecsPublish.taskRole": "ECS task role ARN assumed by the container",
+  "cmd.ecsPublish.launcherAgentId": "Resident agent id in charge of RunTask (auto-selected when omitted)",
+  "cmd.ecsPublish.project": "Target project (tenantCode/projectCode); optional when only one project is registered",
   "stop.stopping": "Sending stop signal to agent (PID: {{pid}})...",
   "stop.stopped": "Agent stopped.",
   "stop.notRunning": "No running agent found (pid file not found: {{path}})",

package/dist/locales/ja.json

@@ -61,6 +61,24 @@
   "config.migrated": "設定の移行が完了しました。",
 
   "cmd.stop": "実行中のエージェントを停止",
+  "cmd.ecs": "ECS実行エージェント関連コマンド（ランチャーエージェント方式）",
+  "cmd.ecsPublish": "イメージをECRへビルド/プッシュし、タスク定義を登録してECS実行エージェントをAPIに登録",
+  "cmd.ecsPublish.repositoryUri": "イメージのプッシュ先ECRリポジトリURI（必須）",
+  "cmd.ecsPublish.tag": "イメージタグ（必須）",
+  "cmd.ecsPublish.cluster": "実行先ECSクラスターARN（必須）",
+  "cmd.ecsPublish.subnets": "awsvpcネットワーク設定のサブネットID（必須）",
+  "cmd.ecsPublish.securityGroups": "awsvpcネットワーク設定のセキュリティグループID（必須）",
+  "cmd.ecsPublish.dockerfile": "ビルドに使うDockerfile",
+  "cmd.ecsPublish.image": "ビルド済みローカルイメージを使用（ビルドをスキップ）",
+  "cmd.ecsPublish.cpu": "ECSタスクのCPUユニット（デフォルト: 1024）",
+  "cmd.ecsPublish.memory": "ECSタスクのメモリ(MiB)（デフォルト: 2048）",
+  "cmd.ecsPublish.name": "エージェント一覧に表示する名前",
+  "cmd.ecsPublish.assignPublicIp": "タスクにパブリックIPを割り当てる",
+  "cmd.ecsPublish.logGroup": "awslogsロググループ名（無ければ作成）",
+  "cmd.ecsPublish.executionRole": "ECSタスク実行ロールARN（ECR pull / awslogs用）",
+  "cmd.ecsPublish.taskRole": "コンテナが引き受けるECSタスクロールARN",
+  "cmd.ecsPublish.launcherAgentId": "RunTaskを担当する常駐エージェントID（省略時は自動選択）",
+  "cmd.ecsPublish.project": "対象プロジェクト（tenantCode/projectCode）。登録プロジェクトが1件の場合は省略可",
   "stop.stopping": "エージェントに停止シグナルを送信中 (PID: {{pid}})...",
   "stop.stopped": "エージェントを停止しました。",
   "stop.notRunning": "実行中のエージェントが見つかりません（pidファイルが存在しません: {{path}}）",

package/dist/oneshot-runner.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Oneshot runner (ECS container mode).
+ *
+ * When the CLI starts with AGENT_MODE=oneshot (set via containerOverrides at
+ * ECS RunTask time), it does NOT run the resident agent flow. Instead it:
+ *   getCommand(COMMAND_ID) -> executeCommand -> submitResult -> exit
+ *
+ * There is no AppSync subscription, no heartbeat, and no register call.
+ * Authentication uses the short-lived oneshot token (AGENT_ONESHOT_TOKEN)
+ * scoped to the single COMMAND_ID. The token value is never logged.
+ */
+interface OneshotEnv {
+    commandId: string;
+    agentId: string;
+    tenantCode: string;
+    projectCode: string;
+    apiBaseUrl: string;
+    token: string;
+}
+/**
+ * Read and validate the oneshot environment.
+ * Missing variables are a clear fatal error (no fallback).
+ */
+export declare function readOneshotEnv(env?: NodeJS.ProcessEnv): OneshotEnv;
+/**
+ * Run exactly one command and return the process exit code
+ * (0 = executed and submitted successfully, 1 = any failure).
+ */
+export declare function runOneshot(env?: NodeJS.ProcessEnv): Promise<number>;
+/**
+ * Entry-point wrapper used by src/index.ts: runs the oneshot flow and exits
+ * the process with the resulting code. Any unexpected rejection is converted
+ * into exit code 1 — a container that never exits would only be reclaimed by
+ * the slow timeout sweep. The runner is injectable for tests.
+ */
+export declare function runOneshotFromEnv(runner?: () => Promise<number>): Promise<void>;
+export {};
+//# sourceMappingURL=oneshot-runner.d.ts.map

package/dist/oneshot-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oneshot-runner.d.ts","sourceRoot":"","sources":["../src/oneshot-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqCH,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAa/E;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFtF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,GAAE,MAAM,OAAO,CAAC,MAAM,CAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CASjG"}