@panorama-ai/gateway 2.24.100

package/dist/index.js

@@ -0,0 +1,2288 @@
+import { createClient } from '@supabase/supabase-js';
+import { execFile, spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import dotenv from 'dotenv';
+import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { promisify } from 'node:util';
+import { DEFAULT_CLAUDE_SUPPORT, coerceClaudeSupport, parseClaudeSupport, toFlagRecord, } from './subagent-adapters/claude-support.js';
+import { getSubagentAdapter } from './subagent-adapters/registry.js';
+import { SUBAGENT_SCHEMA_VERSION, } from './subagent-adapters/types.js';
+import { listGatewayCliProviders, getGatewayCliProvider, inferGatewayProviderFromModel } from './cli-providers/registry.js';
+const execFileAsync = promisify(execFile);
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 30_000;
+const DEFAULT_CLAUDE_TIMEOUT_MS = 10_000;
+const DEFAULT_SUBAGENT_TIMEOUT_MS = 30 * 60_000;
+const DEFAULT_SUBAGENT_RETRY_MAX_ATTEMPTS = 3;
+const DEFAULT_SUBAGENT_RETRY_BACKOFF_MS = 2_000;
+const DEFAULT_SUBAGENT_RETRY_MAX_BACKOFF_MS = 15_000;
+const DEFAULT_MODEL_RUN_TIMEOUT_MS = 110_000;
+const DEFAULT_GATEWAY_CONCURRENCY = 10;
+const MAX_SUBAGENT_OUTPUT_BYTES = 5_000_000;
+const MAX_SUBAGENT_EVENT_PAYLOAD_BYTES = 200_000;
+const MAX_GATEWAY_LOG_BYTES = 200_000;
+const SUBAGENT_EVENT_BATCH_SIZE = 200;
+const SUBAGENT_CANCEL_KILL_TIMEOUT_MS = 5_000;
+const PROCESS_KILL_GRACE_MS = 2_000;
+const VALID_ENVIRONMENTS = new Set(['local', 'dev', 'test', 'stage', 'prod']);
+const CLAUDE_ENV_ALLOWLIST = [
+    'PATH',
+    'HOME',
+    'USER',
+    'LOGNAME',
+    'SHELL',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TERM',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'no_proxy',
+    'XDG_CONFIG_HOME',
+    'XDG_CACHE_HOME',
+    'XDG_DATA_HOME',
+    'SSH_AUTH_SOCK',
+    'SSH_AGENT_PID',
+];
+const CONFIG_DIR = process.env.PANORAMA_GATEWAY_CONFIG_DIR || path.join(os.homedir(), '.panorama');
+const SUBAGENT_WORKDIR_ROOT = path.join(CONFIG_DIR, 'subagents');
+const CLAUDE_GATEWAY_HOME = process.env.PANORAMA_CLAUDE_HOME || null;
+const CONFIG_PATH = process.env.PANORAMA_GATEWAY_CONFIG_PATH || path.join(CONFIG_DIR, 'gateway.json');
+const LOG_PATH = process.env.PANORAMA_GATEWAY_LOG_PATH || path.join(path.dirname(CONFIG_PATH), 'gateway.log');
+const PID_PATH = process.env.PANORAMA_GATEWAY_PID_PATH || path.join(path.dirname(CONFIG_PATH), 'gateway.pid');
+const DEFAULT_CLAUDE_PATH = path.join(os.homedir(), '.claude', 'local', 'claude');
+const CLAUDE_COMMAND = process.env.PANORAMA_CLAUDE_CLI ||
+    process.env.CLAUDE_CLI ||
+    (fsSync.existsSync(DEFAULT_CLAUDE_PATH) ? DEFAULT_CLAUDE_PATH : 'claude');
+const CODEX_COMMAND = process.env.PANORAMA_CODEX_CLI || process.env.CODEX_CLI || 'codex';
+const GEMINI_COMMAND = process.env.PANORAMA_GEMINI_CLI || process.env.GEMINI_CLI || 'gemini';
+let CLAUDE_SUPPORT = null;
+let PROVIDER_CAPABILITIES = null;
+const GATEWAY_CONCURRENCY = (() => {
+    const raw = process.env.PANORAMA_GATEWAY_CONCURRENCY;
+    if (!raw)
+        return DEFAULT_GATEWAY_CONCURRENCY;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return DEFAULT_GATEWAY_CONCURRENCY;
+    return parsed;
+})();
+const activeSubagentRuns = new Map();
+const pendingCancelByRunId = new Map();
+const pendingCancelBySubagentId = new Map();
+function parseArgs(argv) {
+    const positional = [];
+    const options = {};
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (!arg)
+            continue;
+        if (arg.startsWith('--')) {
+            const [flag, inlineValue] = arg.slice(2).split('=');
+            if (inlineValue !== undefined) {
+                options[flag] = inlineValue;
+                continue;
+            }
+            const next = argv[i + 1];
+            if (next && !next.startsWith('--')) {
+                options[flag] = next;
+                i += 1;
+            }
+            else {
+                options[flag] = true;
+            }
+            continue;
+        }
+        if (arg.startsWith('-') && arg.length > 1) {
+            options[arg.slice(1)] = true;
+            continue;
+        }
+        positional.push(arg);
+    }
+    const command = positional.shift() ?? null;
+    return { command, positional, options };
+}
+function printHelp() {
+    console.log(`\nPanorama Gateway\n\nUsage:\n  panorama-gateway pair <PAIRING_CODE> [--device-name \"My Mac\"] [--supabase-url URL] [--anon-key KEY]\n  panorama-gateway start [--device-name \"My Mac\"] [--daemon]\n  panorama-gateway stop\n  panorama-gateway logs [--lines 200] [--no-follow]\n\nEnvironment options:\n  --env <local|dev|test|stage|prod>  Load .env.<env> from repo root (defaults to .env)\n  --env-file <path>                 Load a specific env file\n  PANORAMA_ENV                      Same as --env\n  PANORAMA_ENV_FILE                 Same as --env-file\n\nEnvironment overrides:\n  PANORAMA_SUPABASE_URL or SUPABASE_URL\n  PANORAMA_SUPABASE_ANON_KEY or SUPABASE_ANON_KEY or SUPABASE_PUBLISHABLE_KEY\n  PANORAMA_GATEWAY_CONFIG_PATH to override config path\n  PANORAMA_GATEWAY_LOG_PATH to override log path\n  PANORAMA_GATEWAY_PID_PATH to override pid path\n  PANORAMA_CLAUDE_CLI or CLAUDE_CLI to override claude command\n`);
+}
+function getStringOption(options, key) {
+    const value = options[key];
+    if (typeof value === 'string')
+        return value;
+    return undefined;
+}
+function normalizeEnvName(raw) {
+    if (!raw)
+        return null;
+    const value = raw.trim().toLowerCase();
+    if (!value)
+        return null;
+    if (value === 'production')
+        return 'prod';
+    if (value === 'development')
+        return 'local';
+    if (VALID_ENVIRONMENTS.has(value))
+        return value;
+    return null;
+}
+function findRepoRoot(startDir) {
+    let current = startDir;
+    while (true) {
+        if (fsSync.existsSync(path.join(current, 'pnpm-workspace.yaml'))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+function loadEnvironment(options) {
+    const envFileOption = getStringOption(options, 'env-file') ||
+        process.env.PANORAMA_ENV_FILE ||
+        process.env.PANORAMA_ENV_PATH;
+    const envNameOption = getStringOption(options, 'env') || process.env.PANORAMA_ENV || process.env.ENVIRONMENT;
+    const envName = normalizeEnvName(envNameOption) ?? 'local';
+    const envPath = envFileOption
+        ? path.resolve(envFileOption)
+        : path.join(findRepoRoot(process.cwd()) ?? process.cwd(), envName === 'local' ? '.env' : `.env.${envName}`);
+    if (!fsSync.existsSync(envPath)) {
+        if (envFileOption || envNameOption) {
+            throw new Error(`Environment file not found: ${envPath}`);
+        }
+        return;
+    }
+    dotenv.config({ path: envPath });
+}
+function resolveSupabaseUrl(options, config) {
+    return (getStringOption(options, 'supabase-url') ||
+        process.env.PANORAMA_SUPABASE_URL ||
+        process.env.SUPABASE_URL ||
+        config?.supabaseUrl ||
+        '');
+}
+function resolveSupabaseAnonKey(options, config) {
+    return (getStringOption(options, 'anon-key') ||
+        process.env.PANORAMA_SUPABASE_ANON_KEY ||
+        process.env.SUPABASE_ANON_KEY ||
+        process.env.SUPABASE_PUBLISHABLE_KEY ||
+        config?.supabaseAnonKey ||
+        '');
+}
+async function loadConfig() {
+    const raw = await fs.readFile(CONFIG_PATH, 'utf-8');
+    return JSON.parse(raw);
+}
+async function saveConfig(config) {
+    await fs.mkdir(path.dirname(CONFIG_PATH), { recursive: true });
+    await fs.writeFile(CONFIG_PATH, JSON.stringify(config, null, 2));
+}
+function logInfo(message, data) {
+    if (data) {
+        console.log(`[gateway] ${message}`, data);
+    }
+    else {
+        console.log(`[gateway] ${message}`);
+    }
+}
+function logError(message, data) {
+    if (data) {
+        console.error(`[gateway] ${message}`, data);
+    }
+    else {
+        console.error(`[gateway] ${message}`);
+    }
+}
+function readPidFile() {
+    try {
+        const raw = fsSync.readFileSync(PID_PATH, 'utf-8').trim();
+        const pid = Number.parseInt(raw, 10);
+        return Number.isFinite(pid) ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function writePidFile(pid) {
+    await fs.mkdir(path.dirname(PID_PATH), { recursive: true });
+    await fs.writeFile(PID_PATH, `${pid}\n`);
+}
+async function removePidFile() {
+    try {
+        await fs.unlink(PID_PATH);
+    }
+    catch {
+        // ignore missing pid
+    }
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function safeJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
+async function pairGateway(code, options) {
+    const supabaseUrl = resolveSupabaseUrl(options);
+    const supabaseAnonKey = resolveSupabaseAnonKey(options);
+    if (!supabaseUrl || !supabaseAnonKey) {
+        throw new Error('Missing Supabase URL or anon key for pairing. Provide SUPABASE_URL/SUPABASE_ANON_KEY or use --env.');
+    }
+    const deviceName = getStringOption(options, 'device-name') || process.env.PANORAMA_GATEWAY_DEVICE_NAME || os.hostname();
+    const url = `${supabaseUrl.replace(/\/$/, '')}/functions/v1/exchange-gateway-pairing-code`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            apikey: supabaseAnonKey,
+            Authorization: `Bearer ${supabaseAnonKey}`,
+        },
+        body: JSON.stringify({
+            code: code.trim(),
+            device_name: deviceName,
+        }),
+    });
+    const body = await safeJson(response);
+    if (!response.ok || body?.success === false) {
+        const message = body?.error || `Pairing failed with status ${response.status}`;
+        throw new Error(message);
+    }
+    if (!body?.access_token || !body?.refresh_token || !body?.gateway_id || !body?.team_id) {
+        throw new Error('Pairing response missing required fields');
+    }
+    const config = {
+        supabaseUrl,
+        supabaseAnonKey,
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        gatewayId: body.gateway_id,
+        teamId: body.team_id,
+        deviceName,
+    };
+    await saveConfig(config);
+    logInfo('Gateway paired successfully', {
+        gatewayId: body.gateway_id,
+        teamId: body.team_id,
+        configPath: CONFIG_PATH,
+    });
+}
+async function execClaudeVersion() {
+    const start = Date.now();
+    try {
+        const { stdout, stderr } = await execFileAsync(CLAUDE_COMMAND, ['--version'], {
+            timeout: DEFAULT_CLAUDE_TIMEOUT_MS,
+        });
+        const durationMs = Date.now() - start;
+        const trimmed = stdout.trim();
+        return {
+            ok: true,
+            stdout,
+            stderr,
+            exitCode: 0,
+            durationMs,
+            version: trimmed || undefined,
+        };
+    }
+    catch (error) {
+        const durationMs = Date.now() - start;
+        const err = error;
+        return {
+            ok: false,
+            stdout: err.stdout ? String(err.stdout) : '',
+            stderr: err.stderr ? String(err.stderr) : '',
+            exitCode: typeof err.code === 'number' ? err.code : null,
+            durationMs,
+            error: err.message,
+        };
+    }
+}
+async function execClaudeHelp() {
+    const start = Date.now();
+    try {
+        const { stdout, stderr } = await execFileAsync(CLAUDE_COMMAND, ['--help'], {
+            timeout: DEFAULT_CLAUDE_TIMEOUT_MS,
+        });
+        const durationMs = Date.now() - start;
+        return {
+            ok: true,
+            stdout,
+            stderr,
+            exitCode: 0,
+            durationMs,
+        };
+    }
+    catch (error) {
+        const durationMs = Date.now() - start;
+        const err = error;
+        return {
+            ok: false,
+            stdout: err.stdout ? String(err.stdout) : '',
+            stderr: err.stderr ? String(err.stderr) : '',
+            exitCode: typeof err.code === 'number' ? err.code : null,
+            durationMs,
+            error: err.message,
+        };
+    }
+}
+async function detectClaudeSupport() {
+    const help = await execClaudeHelp();
+    if (!help.ok) {
+        return DEFAULT_CLAUDE_SUPPORT;
+    }
+    return parseClaudeSupport(`${help.stdout}\n${help.stderr}`);
+}
+async function buildCapabilities() {
+    const providers = listGatewayCliProviders();
+    const entries = await Promise.all(providers.map(async (provider) => {
+        try {
+            const capability = await provider.detectCapabilities();
+            return [provider.id, capability];
+        }
+        catch (error) {
+            return [
+                provider.id,
+                {
+                    available: false,
+                    error: error instanceof Error ? error.message : String(error),
+                    supports: { output_schema: false, stream_json: false, tool_disable: false },
+                },
+            ];
+        }
+    }));
+    const providerCapabilities = entries.reduce((acc, [id, capability]) => {
+        acc[id] = capability;
+        return acc;
+    }, {});
+    PROVIDER_CAPABILITIES = providerCapabilities;
+    const claudeCapabilities = providerCapabilities.claude_code;
+    if (claudeCapabilities?.supported_flags) {
+        CLAUDE_SUPPORT = coerceClaudeSupport(claudeCapabilities.supported_flags);
+    }
+    const claudeCliLegacy = claudeCapabilities
+        ? {
+            available: claudeCapabilities.available,
+            version: claudeCapabilities.version,
+            error: claudeCapabilities.error,
+            command: `${CLAUDE_COMMAND} --version`,
+            supported_flags: claudeCapabilities.supported_flags,
+        }
+        : {
+            available: false,
+            error: 'Claude CLI not detected',
+            supported_flags: DEFAULT_CLAUDE_SUPPORT,
+        };
+    return {
+        providers: providerCapabilities,
+        claude_cli: claudeCliLegacy,
+        platform: process.platform,
+        arch: process.arch,
+        node_version: process.version,
+    };
+}
+function appendClaudeIsolationArgs(args, support) {
+    if (support.settingSourcesFlag) {
+        args.push('--setting-sources', 'local');
+    }
+    if (support.disableSlashCommandsFlag) {
+        args.push('--disable-slash-commands');
+    }
+}
+async function ensureClaudeGatewayHome() {
+    if (!CLAUDE_GATEWAY_HOME)
+        return;
+    await fs.mkdir(CLAUDE_GATEWAY_HOME, { recursive: true });
+    await fs.mkdir(path.join(CLAUDE_GATEWAY_HOME, 'xdg', 'config'), { recursive: true });
+    await fs.mkdir(path.join(CLAUDE_GATEWAY_HOME, 'xdg', 'cache'), { recursive: true });
+    await fs.mkdir(path.join(CLAUDE_GATEWAY_HOME, 'xdg', 'data'), { recursive: true });
+    const sourceSessionEnv = path.join(os.homedir(), '.claude', 'session-env');
+    const destSessionEnv = path.join(CLAUDE_GATEWAY_HOME, 'session-env');
+    try {
+        const srcStat = await fs.stat(sourceSessionEnv);
+        if (srcStat.isDirectory()) {
+            try {
+                await fs.stat(destSessionEnv);
+            }
+            catch {
+                await fs.cp(sourceSessionEnv, destSessionEnv, { recursive: true });
+            }
+        }
+    }
+    catch {
+        // If there's no session env yet, leave it empty; Claude will prompt if needed.
+    }
+}
+function buildClaudeEnv() {
+    const env = {};
+    for (const key of CLAUDE_ENV_ALLOWLIST) {
+        const value = process.env[key];
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    if (CLAUDE_GATEWAY_HOME) {
+        env.HOME = CLAUDE_GATEWAY_HOME;
+        env.XDG_CONFIG_HOME = path.join(CLAUDE_GATEWAY_HOME, 'xdg', 'config');
+        env.XDG_CACHE_HOME = path.join(CLAUDE_GATEWAY_HOME, 'xdg', 'cache');
+        env.XDG_DATA_HOME = path.join(CLAUDE_GATEWAY_HOME, 'xdg', 'data');
+    }
+    return env;
+}
+async function runSubagentCommand(command, args, options) {
+    const start = Date.now();
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SUBAGENT_TIMEOUT_MS;
+    return await new Promise((resolve) => {
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let stdoutTruncated = false;
+        let stderrTruncated = false;
+        let timedOut = false;
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            env: options.env ?? buildClaudeEnv(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        options.onStart?.(child);
+        child.stdout?.on('data', (chunk) => {
+            if (stdoutBytes >= MAX_SUBAGENT_OUTPUT_BYTES) {
+                stdoutTruncated = true;
+                return;
+            }
+            const remaining = MAX_SUBAGENT_OUTPUT_BYTES - stdoutBytes;
+            if (chunk.length > remaining) {
+                stdoutChunks.push(chunk.slice(0, remaining));
+                stdoutBytes = MAX_SUBAGENT_OUTPUT_BYTES;
+                stdoutTruncated = true;
+                return;
+            }
+            stdoutChunks.push(chunk);
+            stdoutBytes += chunk.length;
+        });
+        child.stderr?.on('data', (chunk) => {
+            if (stderrBytes >= MAX_SUBAGENT_OUTPUT_BYTES) {
+                stderrTruncated = true;
+                return;
+            }
+            const remaining = MAX_SUBAGENT_OUTPUT_BYTES - stderrBytes;
+            if (chunk.length > remaining) {
+                stderrChunks.push(chunk.slice(0, remaining));
+                stderrBytes = MAX_SUBAGENT_OUTPUT_BYTES;
+                stderrTruncated = true;
+                return;
+            }
+            stderrChunks.push(chunk);
+            stderrBytes += chunk.length;
+        });
+        const timer = timeoutMs && Number.isFinite(timeoutMs)
+            ? setTimeout(() => {
+                timedOut = true;
+                if (!child.killed) {
+                    child.kill('SIGTERM');
+                    setTimeout(() => {
+                        if (!child.killed) {
+                            child.kill('SIGKILL');
+                        }
+                    }, PROCESS_KILL_GRACE_MS);
+                }
+            }, timeoutMs)
+            : null;
+        const finalize = (exitCode, error) => {
+            if (timer)
+                clearTimeout(timer);
+            const durationMs = Date.now() - start;
+            const stdout = Buffer.concat(stdoutChunks).toString('utf-8');
+            const stderr = Buffer.concat(stderrChunks).toString('utf-8');
+            const ok = !timedOut && exitCode === 0 && !error;
+            resolve({
+                ok,
+                stdout,
+                stderr,
+                exitCode,
+                durationMs,
+                timedOut,
+                stdoutTruncated,
+                stderrTruncated,
+                error,
+            });
+        };
+        child.on('error', (error) => {
+            finalize(null, error.message);
+        });
+        child.on('close', (code) => {
+            finalize(code ?? null);
+        });
+    });
+}
+async function runSubagentCommandStreaming(command, args, options) {
+    const start = Date.now();
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SUBAGENT_TIMEOUT_MS;
+    return await new Promise((resolve) => {
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        const events = [];
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let stdoutTruncated = false;
+        let stderrTruncated = false;
+        let timedOut = false;
+        let buffer = '';
+        let sequence = 0;
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            env: options.env ?? buildClaudeEnv(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        options.onStart?.(child);
+        const captureStdout = (chunk) => {
+            if (stdoutBytes >= MAX_SUBAGENT_OUTPUT_BYTES) {
+                stdoutTruncated = true;
+                return;
+            }
+            const remaining = MAX_SUBAGENT_OUTPUT_BYTES - stdoutBytes;
+            if (chunk.length > remaining) {
+                stdoutChunks.push(chunk.slice(0, remaining));
+                stdoutBytes = MAX_SUBAGENT_OUTPUT_BYTES;
+                stdoutTruncated = true;
+                return;
+            }
+            stdoutChunks.push(chunk);
+            stdoutBytes += chunk.length;
+        };
+        const parseLine = (line) => {
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            let event = null;
+            try {
+                event = JSON.parse(trimmed);
+            }
+            catch {
+                event = null;
+            }
+            events.push({
+                sequence,
+                raw: trimmed,
+                event,
+            });
+            sequence += 1;
+        };
+        child.stdout?.on('data', (chunk) => {
+            captureStdout(chunk);
+            buffer += chunk.toString('utf-8');
+            let newlineIndex = buffer.indexOf('\n');
+            while (newlineIndex >= 0) {
+                const line = buffer.slice(0, newlineIndex);
+                buffer = buffer.slice(newlineIndex + 1);
+                parseLine(line);
+                newlineIndex = buffer.indexOf('\n');
+            }
+        });
+        child.stderr?.on('data', (chunk) => {
+            if (stderrBytes >= MAX_SUBAGENT_OUTPUT_BYTES) {
+                stderrTruncated = true;
+                return;
+            }
+            const remaining = MAX_SUBAGENT_OUTPUT_BYTES - stderrBytes;
+            if (chunk.length > remaining) {
+                stderrChunks.push(chunk.slice(0, remaining));
+                stderrBytes = MAX_SUBAGENT_OUTPUT_BYTES;
+                stderrTruncated = true;
+                return;
+            }
+            stderrChunks.push(chunk);
+            stderrBytes += chunk.length;
+        });
+        const timer = timeoutMs && Number.isFinite(timeoutMs)
+            ? setTimeout(() => {
+                timedOut = true;
+                if (!child.killed) {
+                    child.kill('SIGTERM');
+                    setTimeout(() => {
+                        if (!child.killed) {
+                            child.kill('SIGKILL');
+                        }
+                    }, PROCESS_KILL_GRACE_MS);
+                }
+            }, timeoutMs)
+            : null;
+        const finalize = (exitCode, error) => {
+            if (timer)
+                clearTimeout(timer);
+            if (buffer.trim().length > 0) {
+                parseLine(buffer);
+            }
+            const durationMs = Date.now() - start;
+            const stdout = Buffer.concat(stdoutChunks).toString('utf-8');
+            const stderr = Buffer.concat(stderrChunks).toString('utf-8');
+            const ok = !timedOut && exitCode === 0 && !error;
+            resolve({
+                ok,
+                stdout,
+                stderr,
+                exitCode,
+                durationMs,
+                timedOut,
+                stdoutTruncated,
+                stderrTruncated,
+                events,
+                error,
+            });
+        };
+        child.on('error', (error) => {
+            finalize(null, error.message);
+        });
+        child.on('close', (code) => {
+            finalize(code ?? null);
+        });
+    });
+}
+function extractSubagentPrompt(input) {
+    if (!input)
+        return null;
+    const raw = (typeof input.prompt === 'string' && input.prompt) ||
+        (typeof input.query === 'string' && input.query) ||
+        (typeof input.task === 'string' && input.task);
+    if (!raw)
+        return null;
+    const trimmed = raw.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function isUuid(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+async function ensureSubagentWorkDir(subagentId) {
+    const dir = path.join(SUBAGENT_WORKDIR_ROOT, subagentId);
+    await fs.mkdir(dir, { recursive: true });
+    return dir;
+}
+function trimEventPayload(event) {
+    try {
+        const raw = JSON.stringify(event);
+        if (raw.length <= MAX_SUBAGENT_EVENT_PAYLOAD_BYTES)
+            return event;
+        return {
+            truncated: true,
+            original_bytes: raw.length,
+            preview: raw.slice(0, MAX_SUBAGENT_EVENT_PAYLOAD_BYTES),
+        };
+    }
+    catch {
+        return event;
+    }
+}
+function truncateLog(value) {
+    if (!value) {
+        return { value: '', truncated: false, originalBytes: 0 };
+    }
+    if (value.length <= MAX_GATEWAY_LOG_BYTES) {
+        return { value, truncated: false, originalBytes: value.length };
+    }
+    return {
+        value: value.slice(0, MAX_GATEWAY_LOG_BYTES),
+        truncated: true,
+        originalBytes: value.length,
+    };
+}
+function extractFirstJsonObject(text) {
+    let inString = false;
+    let escape = false;
+    for (let i = 0; i < text.length; i += 1) {
+        const char = text[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (char === '\\\\') {
+            if (inString)
+                escape = true;
+            continue;
+        }
+        if (char === '"') {
+            inString = !inString;
+            continue;
+        }
+        if (inString)
+            continue;
+        if (char !== '{')
+            continue;
+        let depth = 0;
+        let innerInString = false;
+        let innerEscape = false;
+        for (let j = i; j < text.length; j += 1) {
+            const inner = text[j];
+            if (innerEscape) {
+                innerEscape = false;
+                continue;
+            }
+            if (inner === '\\\\') {
+                if (innerInString)
+                    innerEscape = true;
+                continue;
+            }
+            if (inner === '"') {
+                innerInString = !innerInString;
+                continue;
+            }
+            if (innerInString)
+                continue;
+            if (inner === '{')
+                depth += 1;
+            if (inner === '}') {
+                depth -= 1;
+                if (depth === 0) {
+                    const candidate = text.slice(i, j + 1);
+                    try {
+                        return JSON.parse(candidate);
+                    }
+                    catch {
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    return null;
+}
+function extractGatewayErrorSummary(stderr) {
+    if (!stderr)
+        return null;
+    const parsed = extractFirstJsonObject(stderr);
+    if (!parsed)
+        return null;
+    const error = parsed.error;
+    if (error && typeof error === 'object') {
+        return {
+            message: typeof error.message === 'string' ? error.message : undefined,
+            type: typeof error.type === 'string' ? error.type : undefined,
+            code: typeof error.code === 'string' ? error.code : undefined,
+            param: typeof error.param === 'string' ? error.param : undefined,
+        };
+    }
+    return {
+        message: typeof parsed.message === 'string' ? parsed.message : undefined,
+        type: typeof parsed.type === 'string' ? String(parsed.type) : undefined,
+        code: typeof parsed.code === 'string' ? String(parsed.code) : undefined,
+    };
+}
+function describeGatewayJob(job) {
+    if (job.job_type === 'model_run') {
+        const payload = job.payload ?? {};
+        const model = typeof payload.model === 'string' ? payload.model : null;
+        const provider = typeof payload.provider === 'string'
+            ? payload.provider
+            : model
+                ? inferGatewayProviderFromModel(model)
+                : null;
+        return { job_kind: 'cycle', provider, model };
+    }
+    if (job.job_type === 'subagent_run') {
+        const payload = job.payload ?? {};
+        const subagentType = typeof payload.subagent_type === 'string' ? payload.subagent_type : null;
+        const provider = inferProviderFromSubagentType(subagentType);
+        return { job_kind: 'subagent', provider, subagent_type: subagentType };
+    }
+    if (job.job_type === 'subagent_cancel') {
+        return { job_kind: 'subagent_cancel' };
+    }
+    return { job_kind: job.job_type };
+}
+function inferProviderFromSubagentType(subagentType) {
+    if (!subagentType)
+        return null;
+    const lowered = subagentType.toLowerCase();
+    if (lowered.includes('claude'))
+        return 'claude_code';
+    if (lowered.includes('codex'))
+        return 'codex';
+    if (lowered.includes('gemini'))
+        return 'gemini';
+    return null;
+}
+function resolveSubagentRetryConfig(config) {
+    const rawMaxAttempts = typeof config.max_attempts === 'number' ? config.max_attempts : null;
+    const rawBackoffMs = typeof config.retry_backoff_ms === 'number' ? config.retry_backoff_ms : null;
+    const rawMaxBackoffMs = typeof config.retry_max_backoff_ms === 'number' ? config.retry_max_backoff_ms : null;
+    const maxAttempts = rawMaxAttempts && Number.isFinite(rawMaxAttempts) && rawMaxAttempts > 0
+        ? Math.floor(rawMaxAttempts)
+        : DEFAULT_SUBAGENT_RETRY_MAX_ATTEMPTS;
+    const backoffMs = rawBackoffMs && Number.isFinite(rawBackoffMs) && rawBackoffMs > 0
+        ? rawBackoffMs
+        : DEFAULT_SUBAGENT_RETRY_BACKOFF_MS;
+    const maxBackoffMs = rawMaxBackoffMs && Number.isFinite(rawMaxBackoffMs) && rawMaxBackoffMs > 0
+        ? rawMaxBackoffMs
+        : DEFAULT_SUBAGENT_RETRY_MAX_BACKOFF_MS;
+    return {
+        maxAttempts,
+        backoffMs,
+        maxBackoffMs,
+        retryOnCapacity: config.retry_on_capacity !== false,
+        retryOnTimeout: config.retry_on_timeout !== false,
+        retryOnNetwork: config.retry_on_network !== false,
+        retryOnParse: config.retry_on_parse !== false,
+    };
+}
+function computeRetryDelayMs(attempt, baseMs, maxMs) {
+    const exponent = Math.max(0, attempt - 1);
+    const raw = Math.min(maxMs, baseMs * Math.pow(2, exponent));
+    const jitter = 0.7 + Math.random() * 0.6;
+    return Math.round(raw * jitter);
+}
+async function sleep(ms) {
+    if (!ms || ms <= 0)
+        return;
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+function classifySubagentRetryable(params) {
+    const { result, parseError, parseStrict, config } = params;
+    if (parseStrict && parseError && config.retryOnParse) {
+        return { retryable: true, reason: 'parse_error' };
+    }
+    if (!result.ok) {
+        if (result.timedOut && config.retryOnTimeout) {
+            return { retryable: true, reason: 'timeout' };
+        }
+        const message = `${result.error ?? ''}\n${result.stderr ?? ''}`.toLowerCase();
+        if (config.retryOnCapacity) {
+            if (message.includes('resource_exhausted') ||
+                message.includes('capacity') ||
+                message.includes('rate limit') ||
+                message.includes('too many requests') ||
+                message.includes('429')) {
+                return { retryable: true, reason: 'capacity' };
+            }
+        }
+        if (config.retryOnNetwork) {
+            if (message.includes('econnreset') ||
+                message.includes('etimedout') ||
+                message.includes('enotfound') ||
+                message.includes('eai_again') ||
+                message.includes('socket hang up') ||
+                message.includes('network')) {
+                return { retryable: true, reason: 'network' };
+            }
+        }
+    }
+    return null;
+}
+async function getNextRunSequence(supabase, subagentId) {
+    const { data } = await supabase
+        .from('subagent_runs')
+        .select('run_sequence')
+        .eq('subagent_id', subagentId)
+        .order('run_sequence', { ascending: false })
+        .limit(1)
+        .maybeSingle();
+    const lastSequence = data && typeof data.run_sequence === 'number' ? data.run_sequence : 0;
+    return lastSequence + 1;
+}
+function mergeMetadata(base, update) {
+    return {
+        ...(base ?? {}),
+        ...update,
+    };
+}
+function asJson(value) {
+    return value;
+}
+function requestSubagentCancel(subagentId, runId, reason) {
+    const activeRun = activeSubagentRuns.get(subagentId);
+    if (activeRun && (!runId || activeRun.runId === runId)) {
+        activeRun.cancelled = true;
+        activeRun.cancelReason = reason;
+        if (activeRun.child) {
+            activeRun.child.kill('SIGTERM');
+            setTimeout(() => {
+                if (!activeRun.child?.killed) {
+                    activeRun.child?.kill('SIGKILL');
+                }
+            }, SUBAGENT_CANCEL_KILL_TIMEOUT_MS);
+        }
+        return { active: true };
+    }
+    if (runId) {
+        pendingCancelByRunId.set(runId, { reason });
+    }
+    else {
+        pendingCancelBySubagentId.set(subagentId, { reason });
+    }
+    return { active: false };
+}
+function resolvePendingCancel(subagentId, runId, metadata) {
+    const cancelRunId = typeof metadata.cancel_run_id === 'string' ? metadata.cancel_run_id : null;
+    if (cancelRunId && cancelRunId === runId) {
+        return typeof metadata.cancel_reason === 'string'
+            ? metadata.cancel_reason
+            : 'Cancelled';
+    }
+    const pendingByRun = pendingCancelByRunId.get(runId);
+    if (pendingByRun)
+        return pendingByRun.reason;
+    const pendingBySubagent = pendingCancelBySubagentId.get(subagentId);
+    if (pendingBySubagent)
+        return pendingBySubagent.reason;
+    return null;
+}
+function clearPendingCancel(subagentId, runId) {
+    pendingCancelByRunId.delete(runId);
+    pendingCancelBySubagentId.delete(subagentId);
+}
+function buildErrorOutput(message) {
+    return {
+        schema_version: SUBAGENT_SCHEMA_VERSION,
+        content: message,
+        content_type: 'text',
+        errors: [message],
+    };
+}
+function isJobTargeted(job, gatewayId) {
+    return !job.gateway_id || job.gateway_id === gatewayId;
+}
+async function sendHeartbeat(supabase, status, capabilities, deviceName) {
+    const { error } = await supabase.functions.invoke('gateway-heartbeat', {
+        body: {
+            status,
+            capabilities,
+            device_name: deviceName,
+        },
+    });
+    if (error) {
+        logError('Failed to send gateway heartbeat', { error: error.message });
+    }
+}
+async function claimJob(supabase, config, job) {
+    if (!isJobTargeted(job, config.gatewayId)) {
+        return null;
+    }
+    const { data, error } = await supabase
+        .from('gateway_jobs')
+        .update({
+        status: 'running',
+        gateway_id: config.gatewayId,
+        started_at: new Date().toISOString(),
+    })
+        .eq('id', job.id)
+        .eq('status', 'queued')
+        .or(`gateway_id.is.null,gateway_id.eq.${config.gatewayId}`)
+        .select('*')
+        .maybeSingle();
+    if (error) {
+        logError('Failed to claim gateway job', { error: error.message, jobId: job.id });
+        return null;
+    }
+    if (!data) {
+        return null;
+    }
+    return data;
+}
+async function completeJob(supabase, jobId, status, result, errorMessage) {
+    const updates = {
+        status,
+        result: result ? asJson(result) : null,
+        error: errorMessage || null,
+        completed_at: new Date().toISOString(),
+    };
+    const { error } = await supabase
+        .from('gateway_jobs')
+        .update(updates)
+        .eq('id', jobId)
+        .eq('status', 'running');
+    if (error) {
+        logError('Failed to update gateway job result', { error: error.message, jobId });
+    }
+}
+async function updateJobDebug(supabase, jobId, debug) {
+    const { error } = await supabase
+        .from('gateway_jobs')
+        .update({ debug: asJson(debug) })
+        .eq('id', jobId);
+    if (error) {
+        logError('Failed to update gateway job debug info', { error: error.message, jobId });
+    }
+}
+async function handleDiagnosticJob() {
+    const output = await execClaudeVersion();
+    if (!output.ok) {
+        return {
+            ok: false,
+            result: {
+                command: `${CLAUDE_COMMAND} --version`,
+                stdout: output.stdout,
+                stderr: output.stderr,
+                exit_code: output.exitCode,
+                duration_ms: output.durationMs,
+                error: output.error,
+            },
+            error: output.error || 'Claude CLI check failed',
+        };
+    }
+    return {
+        ok: true,
+        result: {
+            command: `${CLAUDE_COMMAND} --version`,
+            stdout: output.stdout,
+            stderr: output.stderr,
+            exit_code: output.exitCode,
+            duration_ms: output.durationMs,
+            version: output.version,
+        },
+    };
+}
+async function handleSubagentCancelJob(supabase, job) {
+    const payload = job.payload ?? {};
+    const subagentId = typeof payload.subagent_id === 'string'
+        ? payload.subagent_id
+        : typeof payload.subagentId === 'string'
+            ? payload.subagentId
+            : null;
+    if (!subagentId) {
+        return {
+            ok: false,
+            result: { message: 'Missing subagent_id in payload' },
+            error: 'Missing subagent_id in payload',
+        };
+    }
+    const runId = typeof payload.run_id === 'string'
+        ? payload.run_id
+        : typeof payload.runId === 'string'
+            ? payload.runId
+            : null;
+    const reason = typeof payload.reason === 'string' && payload.reason.trim().length > 0
+        ? payload.reason.trim()
+        : 'Cancelled';
+    const { data: subagent } = await supabase
+        .from('subagents')
+        .select('status, metadata, input')
+        .eq('id', subagentId)
+        .maybeSingle();
+    if (!subagent || subagent.status !== 'running') {
+        return {
+            ok: true,
+            result: {
+                subagent_id: subagentId,
+                run_id: runId,
+                cancelled_active_run: false,
+                reason,
+                message: 'Subagent not running',
+            },
+        };
+    }
+    const metadata = (subagent.metadata ?? {});
+    const input = (subagent.input ?? {});
+    const resolvedRunId = runId ||
+        (typeof metadata.current_run_id === 'string' ? metadata.current_run_id : null) ||
+        (typeof input.run_id === 'string' ? input.run_id : null);
+    const { active } = requestSubagentCancel(subagentId, resolvedRunId, reason);
+    if (resolvedRunId) {
+        const nowIso = new Date().toISOString();
+        const cancelledOutput = buildErrorOutput(reason);
+        const { data: runningRun, error: runningRunError } = await supabase
+            .from('subagent_runs')
+            .select('id, status')
+            .eq('id', resolvedRunId)
+            .eq('status', 'running')
+            .maybeSingle();
+        if (runningRunError) {
+            logError('Failed to fetch running subagent run for cancel', {
+                error: runningRunError.message,
+                subagentId,
+                runId: resolvedRunId,
+            });
+        }
+        if (runningRun?.id) {
+            const { error: runUpdateError } = await supabase
+                .from('subagent_runs')
+                .update({
+                status: 'cancelled',
+                output: asJson(cancelledOutput),
+                error: reason,
+                completed_at: nowIso,
+            })
+                .eq('id', resolvedRunId);
+            if (runUpdateError) {
+                logError('Failed to mark subagent run as cancelled', {
+                    error: runUpdateError.message,
+                    subagentId,
+                    runId: resolvedRunId,
+                });
+            }
+            const { error: subagentUpdateError } = await supabase
+                .from('subagents')
+                .update({
+                status: 'failed',
+                output: asJson(cancelledOutput),
+                error: reason,
+                completed_at: nowIso,
+                metadata: asJson(mergeMetadata(metadata, {
+                    cancel_run_id: resolvedRunId,
+                    cancel_requested_at: nowIso,
+                    cancel_reason: reason,
+                })),
+            })
+                .eq('id', subagentId);
+            if (subagentUpdateError) {
+                logError('Failed to mark subagent as cancelled', {
+                    error: subagentUpdateError.message,
+                    subagentId,
+                    runId: resolvedRunId,
+                });
+            }
+        }
+    }
+    return {
+        ok: true,
+        result: {
+            subagent_id: subagentId,
+            run_id: resolvedRunId,
+            cancelled_active_run: active,
+            reason,
+        },
+    };
+}
+async function handleSubagentRunJob(supabase, job) {
+    const payload = job.payload ?? {};
+    const subagentId = typeof payload.subagent_id === 'string'
+        ? payload.subagent_id
+        : typeof payload.subagentId === 'string'
+            ? payload.subagentId
+            : null;
+    if (!subagentId) {
+        return {
+            ok: false,
+            result: { message: 'Missing subagent_id in payload' },
+            error: 'Missing subagent_id in payload',
+        };
+    }
+    const { data: subagent, error: subagentError } = await supabase
+        .from('subagents')
+        .select('id, team_id, gateway_id, subagent_type, status, config, input, metadata')
+        .eq('id', subagentId)
+        .maybeSingle();
+    if (subagentError || !subagent) {
+        return {
+            ok: false,
+            result: { message: 'Subagent not found', subagent_id: subagentId },
+            error: subagentError?.message ?? 'Subagent not found',
+        };
+    }
+    const subagentType = subagent.subagent_type;
+    const adapter = getSubagentAdapter(subagentType);
+    if (!adapter) {
+        return {
+            ok: false,
+            result: { message: 'Unsupported subagent type', subagent_type: subagentType },
+            error: `Unsupported subagent type: ${subagentType}`,
+        };
+    }
+    logInfo('Processing subagent run', {
+        jobId: job.id,
+        subagentId: subagentId,
+        subagentType,
+        provider: inferProviderFromSubagentType(subagentType),
+    });
+    const prompt = extractSubagentPrompt((subagent.input ?? {}));
+    if (!prompt) {
+        return {
+            ok: false,
+            result: { message: 'Missing prompt in subagent input', subagent_id: subagentId },
+            error: 'Missing prompt in subagent input',
+        };
+    }
+    const configPayload = (subagent.config ?? {});
+    const metadata = (subagent.metadata ?? {});
+    const inputPayload = (subagent.input ?? {});
+    const inputRunId = typeof inputPayload.run_id === 'string' ? inputPayload.run_id.trim() : null;
+    const rawRunSequence = typeof inputPayload.run_sequence === 'number'
+        ? inputPayload.run_sequence
+        : typeof inputPayload.runSequence === 'number'
+            ? inputPayload.runSequence
+            : typeof inputPayload.run_sequence === 'string'
+                ? Number.parseInt(inputPayload.run_sequence, 10)
+                : typeof inputPayload.runSequence === 'string'
+                    ? Number.parseInt(inputPayload.runSequence, 10)
+                    : NaN;
+    const inputRunSequence = Number.isFinite(rawRunSequence) ? rawRunSequence : null;
+    const resumeSessionId = typeof metadata.session_id === 'string' ? metadata.session_id.trim() : null;
+    const retryConfig = resolveSubagentRetryConfig(configPayload);
+    const retryReasons = [];
+    if (resumeSessionId && !adapter.supportsContinuation) {
+        return {
+            ok: false,
+            result: { message: 'Subagent does not support continuation', subagent_id: subagentId },
+            error: 'Subagent provider does not support continuation',
+        };
+    }
+    const resolvedRunId = inputRunId && isUuid(inputRunId) ? inputRunId : randomUUID();
+    const nowIso = new Date().toISOString();
+    const runSequence = inputRunSequence ?? (await getNextRunSequence(supabase, subagentId));
+    const runMetadata = {
+        schema_version: SUBAGENT_SCHEMA_VERSION,
+        runner: 'gateway',
+        adapter_id: adapter.id,
+        subagent_type: subagentType,
+        run_id: resolvedRunId,
+        run_sequence: runSequence,
+    };
+    const pendingCancelReason = resolvePendingCancel(subagentId, resolvedRunId, metadata);
+    if (pendingCancelReason) {
+        clearPendingCancel(subagentId, resolvedRunId);
+        const nowIso = new Date().toISOString();
+        const cancelledOutput = buildErrorOutput(pendingCancelReason);
+        const { error: cancelInsertError } = await supabase.from('subagent_runs').insert({
+            id: resolvedRunId,
+            subagent_id: subagentId,
+            team_id: subagent.team_id,
+            gateway_id: subagent.gateway_id,
+            run_sequence: runSequence,
+            status: 'cancelled',
+            prompt,
+            output: asJson(cancelledOutput),
+            error: pendingCancelReason,
+            started_at: nowIso,
+            completed_at: nowIso,
+            metadata: asJson({
+                ...runMetadata,
+                cancel_reason: pendingCancelReason,
+            }),
+        });
+        if (cancelInsertError) {
+            return {
+                ok: false,
+                result: { message: 'Failed to record cancelled run', subagent_id: subagentId },
+                error: cancelInsertError.message,
+            };
+        }
+        return {
+            ok: true,
+            result: {
+                subagent_id: subagentId,
+                status: 'cancelled',
+                output: cancelledOutput,
+                error: pendingCancelReason,
+            },
+        };
+    }
+    const { error: runInsertError } = await supabase.from('subagent_runs').insert({
+        id: resolvedRunId,
+        subagent_id: subagentId,
+        team_id: subagent.team_id,
+        gateway_id: subagent.gateway_id,
+        run_sequence: runSequence,
+        status: 'running',
+        prompt,
+        started_at: nowIso,
+        metadata: asJson(runMetadata),
+    });
+    if (runInsertError) {
+        return {
+            ok: false,
+            result: { message: 'Failed to create subagent run', subagent_id: subagentId },
+            error: runInsertError.message,
+        };
+    }
+    const activeRun = {
+        runId: resolvedRunId,
+        cancelled: false,
+    };
+    activeSubagentRuns.set(subagentId, activeRun);
+    await supabase
+        .from('subagents')
+        .update({
+        status: 'running',
+        started_at: nowIso,
+        metadata: asJson(mergeMetadata(metadata, {
+            current_run_id: resolvedRunId,
+            current_run_sequence: runSequence,
+        })),
+    })
+        .eq('id', subagentId);
+    const failRun = async (message) => {
+        const failureOutput = buildErrorOutput(message);
+        const completedAt = new Date().toISOString();
+        await supabase
+            .from('subagent_runs')
+            .update({
+            status: 'failed',
+            output: asJson(failureOutput),
+            error: message,
+            completed_at: completedAt,
+        })
+            .eq('id', resolvedRunId);
+        await supabase
+            .from('subagents')
+            .update({
+            status: 'failed',
+            output: asJson(failureOutput),
+            error: message,
+            completed_at: completedAt,
+        })
+            .eq('id', subagentId);
+        activeSubagentRuns.delete(subagentId);
+        return {
+            ok: false,
+            result: { message, subagent_id: subagentId },
+            error: message,
+        };
+    };
+    let runPlan;
+    try {
+        const adapterId = adapter.id;
+        const providerSupport = PROVIDER_CAPABILITIES?.[adapterId]?.supported_flags ??
+            (adapterId === 'claude_code'
+                ? toFlagRecord(CLAUDE_SUPPORT ?? DEFAULT_CLAUDE_SUPPORT)
+                : {});
+        const command = adapterId === 'codex'
+            ? CODEX_COMMAND
+            : adapterId === 'gemini'
+                ? GEMINI_COMMAND
+                : CLAUDE_COMMAND;
+        runPlan = adapter.buildRunPlan({
+            prompt,
+            config: configPayload,
+            command,
+            support: providerSupport,
+            resumeSessionId,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Failed to build subagent run plan';
+        return await failRun(message);
+    }
+    if (runPlan.outputFormat === 'stream-json') {
+        if (!adapter.normalizeStreamingResult || !adapter.normalizeStreamEvents) {
+            return await failRun('Subagent adapter does not support normalized streaming output');
+        }
+    }
+    const workDir = await ensureSubagentWorkDir(subagentId);
+    if (runPlan.files && runPlan.files.length > 0) {
+        for (const file of runPlan.files) {
+            const filePath = path.join(workDir, file.path);
+            await fs.mkdir(path.dirname(filePath), { recursive: true });
+            await fs.writeFile(filePath, file.contents, 'utf-8');
+        }
+    }
+    const resolvedEnv = runPlan.env
+        ? Object.fromEntries(Object.entries(runPlan.env).map(([key, value]) => {
+            if (typeof value === 'string' && value.includes('{WORKDIR}')) {
+                return [key, value.replace(/\{WORKDIR\}/g, workDir)];
+            }
+            return [key, value];
+        }))
+        : undefined;
+    let runResult = null;
+    let streamResult = null;
+    let activeResult = null;
+    let normalized = null;
+    let attempt = 0;
+    while (attempt < retryConfig.maxAttempts) {
+        attempt += 1;
+        runResult = null;
+        streamResult = null;
+        activeResult = null;
+        normalized = null;
+        let executionError = null;
+        try {
+            if (runPlan.outputFormat === 'stream-json') {
+                streamResult = await runSubagentCommandStreaming(runPlan.command, runPlan.args, {
+                    timeoutMs: runPlan.timeoutMs ?? DEFAULT_SUBAGENT_TIMEOUT_MS,
+                    cwd: workDir,
+                    env: resolvedEnv,
+                    onStart: (child) => {
+                        activeRun.child = child;
+                        if (activeRun.cancelled) {
+                            child.kill('SIGTERM');
+                            setTimeout(() => {
+                                if (!child.killed) {
+                                    child.kill('SIGKILL');
+                                }
+                            }, SUBAGENT_CANCEL_KILL_TIMEOUT_MS);
+                        }
+                    },
+                });
+            }
+            else {
+                runResult = await runSubagentCommand(runPlan.command, runPlan.args, {
+                    timeoutMs: runPlan.timeoutMs ?? DEFAULT_SUBAGENT_TIMEOUT_MS,
+                    cwd: workDir,
+                    env: resolvedEnv,
+                    onStart: (child) => {
+                        activeRun.child = child;
+                        if (activeRun.cancelled) {
+                            child.kill('SIGTERM');
+                            setTimeout(() => {
+                                if (!child.killed) {
+                                    child.kill('SIGKILL');
+                                }
+                            }, SUBAGENT_CANCEL_KILL_TIMEOUT_MS);
+                        }
+                    },
+                });
+            }
+        }
+        catch (error) {
+            executionError = error instanceof Error ? error.message : 'Subagent run failed';
+        }
+        activeResult =
+            streamResult ??
+                runResult ?? {
+                ok: false,
+                stdout: '',
+                stderr: executionError ?? '',
+                exitCode: null,
+                durationMs: 0,
+                timedOut: false,
+                stdoutTruncated: false,
+                stderrTruncated: false,
+                error: executionError ?? 'Subagent run failed',
+            };
+        if (streamResult || runResult) {
+            normalized =
+                runPlan.outputFormat === 'stream-json' && adapter.normalizeStreamingResult
+                    ? adapter.normalizeStreamingResult({
+                        events: streamResult?.events ?? [],
+                        rawOutput: streamResult?.stdout ?? '',
+                    })
+                    : adapter.normalizeRunResult({
+                        stdout: runResult?.stdout ?? '',
+                        outputFormat: runPlan.outputFormat === 'stream-json' ? 'json' : runPlan.outputFormat,
+                    });
+        }
+        else {
+            normalized = {
+                output: buildErrorOutput(executionError ?? 'Subagent run failed'),
+                metadata: {},
+                parseError: null,
+            };
+        }
+        const parseStrict = runPlan.outputFormat === 'json';
+        const parseError = normalized.parseError ?? null;
+        const retryDecision = classifySubagentRetryable({
+            result: {
+                ok: activeResult.ok,
+                timedOut: activeResult.timedOut,
+                exitCode: activeResult.exitCode,
+                error: activeResult.error,
+                stderr: activeResult.stderr,
+                stdoutTruncated: activeResult.stdoutTruncated,
+                stderrTruncated: activeResult.stderrTruncated,
+            },
+            parseError,
+            parseStrict,
+            config: retryConfig,
+        });
+        if (retryDecision &&
+            attempt < retryConfig.maxAttempts &&
+            !activeRun.cancelled) {
+            retryReasons.push(retryDecision.reason);
+            const delayMs = computeRetryDelayMs(attempt, retryConfig.backoffMs, retryConfig.maxBackoffMs);
+            logInfo('Retrying subagent run', {
+                subagentId,
+                runId: resolvedRunId,
+                attempt,
+                maxAttempts: retryConfig.maxAttempts,
+                reason: retryDecision.reason,
+                delay_ms: delayMs,
+            });
+            await sleep(delayMs);
+            continue;
+        }
+        break;
+    }
+    if (!activeResult || !normalized) {
+        return await failRun('Subagent run failed');
+    }
+    const normalizedResult = normalized;
+    const { data: cancellationRow, error: cancellationError } = await supabase
+        .from('subagent_runs')
+        .select('status')
+        .eq('id', resolvedRunId)
+        .maybeSingle();
+    if (cancellationError) {
+        logError('Failed to check subagent run cancellation', {
+            error: cancellationError.message,
+            subagentId,
+            runId: resolvedRunId,
+        });
+    }
+    const dbCancelled = cancellationRow?.status === 'cancelled';
+    const wasCancelled = activeRun.cancelled || dbCancelled;
+    const cancelReason = activeRun.cancelReason && activeRun.cancelReason.trim().length > 0
+        ? activeRun.cancelReason
+        : 'Cancelled';
+    const output = normalizedResult.output;
+    const parseError = normalizedResult.parseError ?? null;
+    const retryCount = Math.max(0, attempt - 1);
+    const completedAt = new Date().toISOString();
+    const parseStrict = runPlan.outputFormat === 'json';
+    const shouldFail = !activeResult.ok || (parseStrict && !!parseError);
+    const stderrMessage = activeResult.stderr && activeResult.stderr.trim().length > 0
+        ? activeResult.stderr.trim()
+        : null;
+    const exitCodeMessage = activeResult.exitCode === null
+        ? 'Subagent process did not exit cleanly'
+        : `Subagent exited with code ${activeResult.exitCode}`;
+    const errorMessage = !activeResult.ok
+        ? (activeResult.error ?? stderrMessage ?? exitCodeMessage)
+        : parseError ?? null;
+    const failureOutput = buildErrorOutput(wasCancelled ? cancelReason : errorMessage ?? 'Subagent run failed');
+    const metadataUpdate = {
+        schema_version: SUBAGENT_SCHEMA_VERSION,
+        runner: 'gateway',
+        adapter_id: adapter.id,
+        subagent_type: subagentType,
+        run_id: resolvedRunId,
+        run_sequence: runSequence,
+        last_run_at: completedAt,
+        command: `${runPlan.command} ${runPlan.args.join(' ')}`,
+        exit_code: activeResult.exitCode,
+        duration_ms: activeResult.durationMs,
+        timed_out: activeResult.timedOut,
+        stdout_truncated: activeResult.stdoutTruncated,
+        stderr_truncated: activeResult.stderrTruncated,
+        output_format: runPlan.outputFormat,
+        parse_error: parseError,
+        retry_count: retryCount,
+        retry_reasons: retryReasons,
+        retry_max_attempts: retryConfig.maxAttempts,
+        cancel_run_id: null,
+        cancel_requested_at: null,
+        cancel_reason: wasCancelled ? cancelReason : null,
+        cancelled: wasCancelled,
+    };
+    if (activeResult.stderr) {
+        metadataUpdate.stderr = activeResult.stderr;
+    }
+    const mergedMetadata = mergeMetadata(mergeMetadata((subagent.metadata ?? {}), normalized.metadata), metadataUpdate);
+    const runMetadataUpdate = mergeMetadata(mergeMetadata(runMetadata, normalized.metadata), metadataUpdate);
+    if (streamResult?.events?.length && adapter.normalizeStreamEvents) {
+        const normalizedEvents = adapter.normalizeStreamEvents(streamResult.events);
+        const eventRows = normalizedEvents.map((entry, index) => ({
+            run_id: resolvedRunId,
+            subagent_id: subagentId,
+            team_id: subagent.team_id,
+            gateway_id: subagent.gateway_id,
+            sequence: index,
+            event_type: entry.event_type,
+            payload: asJson(trimEventPayload(entry.payload)),
+        }));
+        for (let i = 0; i < eventRows.length; i += SUBAGENT_EVENT_BATCH_SIZE) {
+            const chunk = eventRows.slice(i, i + SUBAGENT_EVENT_BATCH_SIZE);
+            const { error: eventsError } = await supabase
+                .from('subagent_run_events')
+                .insert(chunk);
+            if (eventsError) {
+                logError('Failed to insert subagent run events', {
+                    error: eventsError.message,
+                    subagentId,
+                    runId: resolvedRunId,
+                });
+            }
+        }
+    }
+    await supabase
+        .from('subagent_runs')
+        .update({
+        status: wasCancelled ? 'cancelled' : shouldFail ? 'failed' : 'completed',
+        output: asJson(wasCancelled ? failureOutput : shouldFail ? failureOutput : output),
+        error: wasCancelled ? cancelReason : shouldFail ? errorMessage : null,
+        completed_at: completedAt,
+        metadata: asJson(runMetadataUpdate),
+    })
+        .eq('id', resolvedRunId);
+    const { error: subagentUpdateError } = await supabase
+        .from('subagents')
+        .update({
+        status: wasCancelled ? 'failed' : shouldFail ? 'failed' : 'completed',
+        output: asJson(wasCancelled ? failureOutput : shouldFail ? failureOutput : output),
+        error: wasCancelled ? cancelReason : shouldFail ? errorMessage : null,
+        completed_at: completedAt,
+        metadata: asJson(mergedMetadata),
+    })
+        .eq('id', subagentId);
+    if (subagentUpdateError) {
+        logError('Failed to update subagent after run', {
+            error: subagentUpdateError.message,
+            subagentId,
+            runId: resolvedRunId,
+        });
+    }
+    activeSubagentRuns.delete(subagentId);
+    return {
+        ok: !shouldFail,
+        result: {
+            subagent_id: subagentId,
+            status: shouldFail ? 'failed' : 'completed',
+            output: shouldFail ? null : output,
+            error: shouldFail ? errorMessage : null,
+        },
+        error: shouldFail ? errorMessage ?? 'Subagent run failed' : undefined,
+    };
+}
+async function handleModelRunJob(_supabase, job) {
+    const payload = job.payload ?? {};
+    const prompt = typeof payload.prompt === 'string' ? payload.prompt : null;
+    const model = typeof payload.model === 'string' ? payload.model : null;
+    const jsonSchema = payload.json_schema && typeof payload.json_schema === 'object'
+        ? payload.json_schema
+        : null;
+    const appendSystemPrompt = typeof payload.append_system_prompt === 'string' ? payload.append_system_prompt : null;
+    const timeoutMs = typeof payload.timeout_ms === 'number' && payload.timeout_ms > 0
+        ? payload.timeout_ms
+        : DEFAULT_MODEL_RUN_TIMEOUT_MS;
+    if (!prompt || !model) {
+        return {
+            ok: false,
+            result: { message: 'Missing prompt or model for gateway model run' },
+            error: 'Missing prompt or model',
+        };
+    }
+    if (!jsonSchema) {
+        return {
+            ok: false,
+            result: { message: 'Missing json_schema for gateway model run' },
+            error: 'Missing json_schema',
+        };
+    }
+    const providerFromPayload = typeof payload.provider === 'string' ? payload.provider : null;
+    const providerId = (providerFromPayload === 'claude_code' || providerFromPayload === 'codex' || providerFromPayload === 'gemini')
+        ? providerFromPayload
+        : inferGatewayProviderFromModel(model);
+    const provider = getGatewayCliProvider(providerId);
+    let normalizedPrompt = prompt;
+    let normalizedSchema = jsonSchema;
+    if (provider.normalizeSchema) {
+        const normalized = provider.normalizeSchema(jsonSchema);
+        normalizedSchema = normalized.schema;
+        if (normalized.promptSuffix) {
+            normalizedPrompt = `${normalizedPrompt}\n\n${normalized.promptSuffix}`;
+        }
+    }
+    const runPlan = provider.buildModelRunPlan({
+        model,
+        prompt: normalizedPrompt,
+        jsonSchema: normalizedSchema,
+        appendSystemPrompt: appendSystemPrompt ?? undefined,
+        timeoutMs,
+    });
+    const workDir = await ensureSubagentWorkDir(job.id);
+    if (runPlan.files && runPlan.files.length > 0) {
+        for (const file of runPlan.files) {
+            const filePath = path.join(workDir, file.path);
+            await fs.mkdir(path.dirname(filePath), { recursive: true });
+            await fs.writeFile(filePath, file.contents, 'utf-8');
+        }
+    }
+    const resolvedEnv = runPlan.env
+        ? Object.fromEntries(Object.entries(runPlan.env).map(([key, value]) => {
+            if (typeof value === 'string' && value.includes('{WORKDIR}')) {
+                return [key, value.replace(/\{WORKDIR\}/g, workDir)];
+            }
+            return [key, value];
+        }))
+        : undefined;
+    const commandLine = [runPlan.command, ...runPlan.args].join(' ');
+    const debugInfo = {
+        provider_id: providerId,
+        command: runPlan.command,
+        args: runPlan.args,
+        command_line: commandLine,
+        work_dir: workDir,
+        prompt_chars: prompt.length,
+        json_schema_chars: JSON.stringify(normalizedSchema).length,
+        timeout_ms: timeoutMs,
+        output_mode: runPlan.outputMode,
+        output_path: runPlan.outputPath ?? null,
+    };
+    if (runPlan.files && runPlan.files.length > 0) {
+        debugInfo.files = runPlan.files.map((file) => file.path);
+    }
+    await updateJobDebug(_supabase, job.id, debugInfo);
+    const runResult = await runSubagentCommand(runPlan.command, runPlan.args, {
+        timeoutMs: runPlan.timeoutMs ?? DEFAULT_MODEL_RUN_TIMEOUT_MS,
+        cwd: workDir,
+        env: resolvedEnv,
+    });
+    const stdoutInfo = truncateLog(runResult.stdout);
+    const stderrInfo = truncateLog(runResult.stderr);
+    const errorSummary = extractGatewayErrorSummary(stderrInfo.value);
+    debugInfo.stdout = stdoutInfo.value;
+    debugInfo.stdout_truncated = stdoutInfo.truncated;
+    debugInfo.stdout_bytes = stdoutInfo.originalBytes;
+    debugInfo.stderr = stderrInfo.value;
+    debugInfo.stderr_truncated = stderrInfo.truncated;
+    debugInfo.stderr_bytes = stderrInfo.originalBytes;
+    debugInfo.exit_code = runResult.exitCode;
+    debugInfo.duration_ms = runResult.durationMs;
+    debugInfo.timed_out = runResult.timedOut;
+    if (errorSummary) {
+        debugInfo.error_summary = errorSummary;
+    }
+    await updateJobDebug(_supabase, job.id, debugInfo);
+    if (!runResult.ok) {
+        return {
+            ok: false,
+            result: {
+                message: 'Gateway CLI failed for model run',
+                exit_code: runResult.exitCode,
+                stderr: stderrInfo.value,
+                stdout: stdoutInfo.value,
+                command: commandLine,
+                error_summary: errorSummary ?? null,
+            },
+            error: runResult.error ?? 'Gateway model run failed',
+        };
+    }
+    let normalized;
+    try {
+        normalized = provider.normalizeModelRunResult({
+            stdout: runResult.stdout,
+            outputFormat: runPlan.outputFormat,
+            outputMode: runPlan.outputMode,
+            outputPath: runPlan.outputPath,
+            workDir,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Failed to normalize gateway output';
+        return {
+            ok: false,
+            result: { message, stdout: stdoutInfo.value, stderr: stderrInfo.value, command: commandLine },
+            error: message,
+        };
+    }
+    return {
+        ok: true,
+        result: {
+            output: normalized.output,
+            raw: normalized.raw,
+            usage: normalized.usage,
+            model: normalized.model,
+            duration_ms: runResult.durationMs,
+            exit_code: runResult.exitCode,
+            stdout_truncated: runResult.stdoutTruncated,
+            stderr_truncated: runResult.stderrTruncated,
+            command: commandLine,
+        },
+    };
+}
+async function failSubagentRun(supabase, job, errorMessage) {
+    const payload = job.payload ?? {};
+    const subagentId = typeof payload.subagent_id === 'string'
+        ? payload.subagent_id
+        : typeof payload.subagentId === 'string'
+            ? payload.subagentId
+            : null;
+    if (!subagentId)
+        return;
+    const { data: subagent } = await supabase
+        .from('subagents')
+        .select('id, status, subagent_type, metadata, team_id, gateway_id')
+        .eq('id', subagentId)
+        .maybeSingle();
+    if (!subagent)
+        return;
+    if (subagent.status !== 'running')
+        return;
+    const nowIso = new Date().toISOString();
+    const metadataUpdate = {
+        schema_version: SUBAGENT_SCHEMA_VERSION,
+        runner: 'gateway',
+        subagent_type: subagent.subagent_type,
+        last_run_at: nowIso,
+        gateway_error: errorMessage,
+    };
+    const mergedMetadata = mergeMetadata((subagent.metadata ?? {}), metadataUpdate);
+    const failureOutput = buildErrorOutput(errorMessage);
+    const { data: runningRun } = await supabase
+        .from('subagent_runs')
+        .select('id, run_sequence')
+        .eq('subagent_id', subagent.id)
+        .eq('status', 'running')
+        .order('run_sequence', { ascending: false })
+        .limit(1)
+        .maybeSingle();
+    if (runningRun?.id) {
+        const { data: lastEvent } = await supabase
+            .from('subagent_run_events')
+            .select('sequence')
+            .eq('run_id', runningRun.id)
+            .order('sequence', { ascending: false })
+            .limit(1)
+            .maybeSingle();
+        const nextSequence = lastEvent && typeof lastEvent.sequence === 'number' ? lastEvent.sequence + 1 : 0;
+        await supabase
+            .from('subagent_runs')
+            .update({
+            status: 'failed',
+            error: errorMessage,
+            output: asJson(failureOutput),
+            completed_at: nowIso,
+            metadata: asJson(mergedMetadata),
+        })
+            .eq('id', runningRun.id);
+        if (subagent.gateway_id) {
+            await supabase.from('subagent_run_events').insert({
+                run_id: runningRun.id,
+                subagent_id: subagent.id,
+                team_id: subagent.team_id,
+                gateway_id: subagent.gateway_id,
+                sequence: nextSequence,
+                event_type: 'run_failed',
+                payload: asJson({ error: errorMessage }),
+            });
+        }
+    }
+    const { error } = await supabase
+        .from('subagents')
+        .update({
+        status: 'failed',
+        error: errorMessage,
+        completed_at: nowIso,
+        output: asJson(failureOutput),
+        metadata: asJson(mergedMetadata),
+    })
+        .eq('id', subagent.id);
+    if (error) {
+        logError('Failed to mark subagent as failed after gateway error', {
+            subagentId,
+            error: error.message,
+        });
+    }
+}
+async function processJob(supabase, config, job) {
+    const claimed = await claimJob(supabase, config, job);
+    if (!claimed) {
+        return;
+    }
+    const jobDetails = describeGatewayJob(claimed);
+    logInfo('Processing gateway job', {
+        jobId: claimed.id,
+        jobType: claimed.job_type,
+        jobKind: jobDetails.job_kind,
+        provider: jobDetails.provider ?? undefined,
+        model: jobDetails.model ?? undefined,
+        subagentType: jobDetails.subagent_type ?? undefined,
+    });
+    if (claimed.job_type === 'diagnostic') {
+        const diagnostic = await handleDiagnosticJob();
+        if (diagnostic.ok) {
+            await completeJob(supabase, claimed.id, 'completed', diagnostic.result);
+        }
+        else {
+            await completeJob(supabase, claimed.id, 'failed', diagnostic.result, diagnostic.error);
+        }
+        return;
+    }
+    if (claimed.job_type === 'subagent_run') {
+        const result = await handleSubagentRunJob(supabase, claimed);
+        if (result.ok) {
+            await completeJob(supabase, claimed.id, 'completed', result.result);
+        }
+        else {
+            await completeJob(supabase, claimed.id, 'failed', result.result, result.error);
+        }
+        return;
+    }
+    if (claimed.job_type === 'model_run') {
+        const result = await handleModelRunJob(supabase, claimed);
+        if (result.ok) {
+            await completeJob(supabase, claimed.id, 'completed', result.result);
+        }
+        else {
+            await completeJob(supabase, claimed.id, 'failed', result.result, result.error);
+        }
+        return;
+    }
+    if (claimed.job_type === 'subagent_cancel') {
+        const result = await handleSubagentCancelJob(supabase, claimed);
+        if (result.ok) {
+            await completeJob(supabase, claimed.id, 'completed', result.result);
+        }
+        else {
+            await completeJob(supabase, claimed.id, 'failed', result.result, result.error);
+        }
+        return;
+    }
+    await completeJob(supabase, claimed.id, 'failed', {
+        message: 'Unsupported job type',
+        job_type: claimed.job_type,
+    }, `Unsupported job type: ${claimed.job_type}`);
+}
+async function startGateway(options) {
+    const daemonRequested = options.daemon === true || options.background === true;
+    const foregroundRequested = options.foreground === true;
+    if (daemonRequested && !foregroundRequested) {
+        const existingPid = readPidFile();
+        if (existingPid && isProcessAlive(existingPid)) {
+            logInfo('Gateway already running', { pid: existingPid });
+            return;
+        }
+        const entryPath = process.argv[1] || '';
+        if (entryPath.endsWith('.ts')) {
+            throw new Error('Daemon mode requires the built gateway. Run "pnpm gateway:start -- --daemon".');
+        }
+        await fs.mkdir(path.dirname(LOG_PATH), { recursive: true });
+        const logHandle = await fs.open(LOG_PATH, 'a');
+        const childArgs = [entryPath, 'start', '--foreground'];
+        const deviceName = getStringOption(options, 'device-name') || process.env.PANORAMA_GATEWAY_DEVICE_NAME;
+        if (deviceName) {
+            childArgs.push('--device-name', deviceName);
+        }
+        const child = spawn(process.execPath, childArgs, {
+            detached: true,
+            stdio: ['ignore', logHandle.fd, logHandle.fd],
+            env: {
+                ...process.env,
+                PANORAMA_GATEWAY_LOG_PATH: LOG_PATH,
+                PANORAMA_GATEWAY_PID_PATH: PID_PATH,
+            },
+        });
+        child.unref();
+        await logHandle.close();
+        if (!child.pid) {
+            throw new Error('Failed to determine gateway process id');
+        }
+        await writePidFile(child.pid);
+        logInfo('Gateway started in background', { pid: child.pid, logPath: LOG_PATH });
+        return;
+    }
+    let config;
+    try {
+        config = await loadConfig();
+    }
+    catch (error) {
+        throw new Error(`Gateway config not found. Run "pair" first or set PANORAMA_GATEWAY_CONFIG_PATH. (${String(error)})`);
+    }
+    const supabaseUrl = resolveSupabaseUrl(options, config);
+    const supabaseAnonKey = resolveSupabaseAnonKey(options, config);
+    if (!supabaseUrl || !supabaseAnonKey) {
+        throw new Error('Missing Supabase URL or anon key for gateway start');
+    }
+    const deviceName = getStringOption(options, 'device-name') ||
+        config.deviceName ||
+        process.env.PANORAMA_GATEWAY_DEVICE_NAME ||
+        os.hostname();
+    config = {
+        ...config,
+        supabaseUrl,
+        supabaseAnonKey,
+        deviceName,
+    };
+    await saveConfig(config);
+    const supabase = createClient(supabaseUrl, supabaseAnonKey, {
+        auth: {
+            persistSession: false,
+            autoRefreshToken: true,
+            detectSessionInUrl: false,
+        },
+        realtime: {
+            params: {
+                eventsPerSecond: 10,
+            },
+        },
+    });
+    const { data: sessionData, error: sessionError } = await supabase.auth.setSession({
+        access_token: config.accessToken,
+        refresh_token: config.refreshToken,
+    });
+    if (sessionError || !sessionData?.session) {
+        throw new Error(`Failed to authenticate gateway session: ${sessionError?.message}`);
+    }
+    config.accessToken = sessionData.session.access_token;
+    config.refreshToken = sessionData.session.refresh_token;
+    await saveConfig(config);
+    supabase.auth.onAuthStateChange((event, session) => {
+        if (!session)
+            return;
+        if (event === 'TOKEN_REFRESHED' || event === 'SIGNED_IN') {
+            config.accessToken = session.access_token;
+            config.refreshToken = session.refresh_token;
+            void saveConfig(config)
+                .then(() => logInfo('Gateway session refreshed'))
+                .catch((error) => {
+                logError('Failed to persist refreshed gateway session', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            });
+        }
+    });
+    await ensureClaudeGatewayHome();
+    const capabilities = await buildCapabilities();
+    const providerStatus = (capabilities.providers ?? {});
+    const anyProviderReady = Object.values(providerStatus).some((entry) => entry?.available === true);
+    const initialStatus = anyProviderReady ? 'ready' : 'error';
+    logInfo('Gateway capabilities loaded', {
+        providers: Object.fromEntries(Object.entries(providerStatus).map(([id, entry]) => [
+            id,
+            {
+                available: entry.available,
+                version: entry.version ?? null,
+            },
+        ])),
+        concurrency: GATEWAY_CONCURRENCY,
+    });
+    await sendHeartbeat(supabase, initialStatus, capabilities, deviceName);
+    let heartbeatStatus = initialStatus;
+    await writePidFile(process.pid);
+    const heartbeatTimer = setInterval(() => {
+        void sendHeartbeat(supabase, heartbeatStatus, capabilities, deviceName);
+    }, DEFAULT_HEARTBEAT_INTERVAL_MS);
+    const pendingJobs = [];
+    const queuedJobIds = new Set();
+    const activeJobIds = new Set();
+    const processCancelJob = async (job) => {
+        const claimed = await claimJob(supabase, config, job);
+        if (!claimed)
+            return;
+        const result = await handleSubagentCancelJob(supabase, claimed);
+        if (result.ok) {
+            await completeJob(supabase, claimed.id, 'completed', result.result);
+        }
+        else {
+            await completeJob(supabase, claimed.id, 'failed', result.result, result.error);
+        }
+    };
+    const processJobWithHandling = async (nextJob) => {
+        try {
+            await processJob(supabase, config, nextJob);
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logError('Gateway job processing failed', {
+                jobId: nextJob.id,
+                error: errorMessage,
+            });
+            await completeJob(supabase, nextJob.id, 'failed', { message: 'Gateway job processing failed', job_type: nextJob.job_type }, errorMessage);
+            if (nextJob.job_type === 'subagent_run') {
+                await failSubagentRun(supabase, nextJob, errorMessage);
+            }
+        }
+        finally {
+            activeJobIds.delete(nextJob.id);
+            void processQueue();
+        }
+    };
+    const processQueue = async () => {
+        while (activeJobIds.size < GATEWAY_CONCURRENCY && pendingJobs.length > 0) {
+            const nextJob = pendingJobs.shift();
+            if (!nextJob)
+                break;
+            queuedJobIds.delete(nextJob.id);
+            if (activeJobIds.has(nextJob.id))
+                continue;
+            activeJobIds.add(nextJob.id);
+            void processJobWithHandling(nextJob);
+        }
+    };
+    const enqueueJob = (job) => {
+        if (!isJobTargeted(job, config.gatewayId))
+            return;
+        if (job.job_type === 'subagent_cancel') {
+            void processCancelJob(job);
+            return;
+        }
+        if (queuedJobIds.has(job.id) || activeJobIds.has(job.id)) {
+            return;
+        }
+        pendingJobs.push(job);
+        queuedJobIds.add(job.id);
+        void processQueue();
+    };
+    const { data: backlog, error: backlogError } = await supabase
+        .from('gateway_jobs')
+        .select('*')
+        .eq('team_id', config.teamId)
+        .eq('status', 'queued')
+        .or(`gateway_id.is.null,gateway_id.eq.${config.gatewayId}`)
+        .order('created_at', { ascending: true });
+    if (backlogError) {
+        logError('Failed to fetch queued gateway jobs', { error: backlogError.message });
+    }
+    else if (backlog && backlog.length > 0) {
+        backlog.forEach((job) => enqueueJob(job));
+    }
+    const channel = supabase
+        .channel(`gateway_jobs_${config.gatewayId}`)
+        .on('postgres_changes', {
+        event: 'INSERT',
+        schema: 'public',
+        table: 'gateway_jobs',
+        filter: `team_id=eq.${config.teamId}`,
+    }, (payload) => {
+        const job = payload.new;
+        if (job.status !== 'queued')
+            return;
+        enqueueJob(job);
+    })
+        .subscribe((status) => {
+        if (status === 'SUBSCRIBED') {
+            logInfo('Gateway subscribed to job queue');
+        }
+        if (status === 'CHANNEL_ERROR') {
+            logError('Gateway realtime channel error');
+            heartbeatStatus = 'error';
+        }
+    });
+    const shutdown = async (signal) => {
+        logInfo('Gateway shutting down', { signal });
+        clearInterval(heartbeatTimer);
+        heartbeatStatus = 'offline';
+        await sendHeartbeat(supabase, 'offline', capabilities, deviceName);
+        await channel.unsubscribe();
+        await removePidFile();
+        process.exit(0);
+    };
+    process.on('SIGINT', () => void shutdown('SIGINT'));
+    process.on('SIGTERM', () => void shutdown('SIGTERM'));
+    logInfo('Gateway running', {
+        gatewayId: config.gatewayId,
+        teamId: config.teamId,
+        deviceName,
+        heartbeatIntervalMs: DEFAULT_HEARTBEAT_INTERVAL_MS,
+        concurrency: GATEWAY_CONCURRENCY,
+    });
+}
+async function stopGateway() {
+    const pid = readPidFile();
+    if (!pid) {
+        logInfo('No gateway pid file found', { pidPath: PID_PATH });
+        return;
+    }
+    if (!isProcessAlive(pid)) {
+        logInfo('Gateway not running, removing stale pid file', { pid });
+        await removePidFile();
+        return;
+    }
+    try {
+        process.kill(pid, 'SIGTERM');
+        logInfo('Sent SIGTERM to gateway process', { pid });
+    }
+    catch (error) {
+        logError('Failed to stop gateway process', {
+            pid,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    const timeoutMs = 5000;
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+        if (!isProcessAlive(pid)) {
+            await removePidFile();
+            logInfo('Gateway stopped', { pid });
+            return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 200));
+    }
+    logInfo('Gateway stop timed out; process may still be running', { pid });
+}
+async function showLogs(options) {
+    const linesRaw = getStringOption(options, 'lines');
+    const lines = linesRaw ? Number.parseInt(linesRaw, 10) : 200;
+    const follow = options['no-follow'] !== true;
+    try {
+        const content = await fs.readFile(LOG_PATH, 'utf-8');
+        const allLines = content.split(/\r?\n/);
+        const tail = Number.isFinite(lines) && lines > 0 ? allLines.slice(-lines) : allLines;
+        process.stdout.write(`${tail.join('\n')}\n`);
+    }
+    catch (error) {
+        logError('Unable to read gateway log file', {
+            logPath: LOG_PATH,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    if (!follow)
+        return;
+    let position = 0;
+    try {
+        const stat = await fs.stat(LOG_PATH);
+        position = stat.size;
+    }
+    catch {
+        position = 0;
+    }
+    logInfo('Tailing gateway logs', { logPath: LOG_PATH });
+    fsSync.watch(LOG_PATH, { persistent: true }, async (event) => {
+        if (event !== 'change')
+            return;
+        try {
+            const stat = await fs.stat(LOG_PATH);
+            if (stat.size < position) {
+                position = 0;
+            }
+            const handle = await fs.open(LOG_PATH, 'r');
+            const length = stat.size - position;
+            if (length > 0) {
+                const buffer = Buffer.alloc(length);
+                await handle.read(buffer, 0, length, position);
+                position = stat.size;
+                process.stdout.write(buffer.toString('utf-8'));
+            }
+            await handle.close();
+        }
+        catch (error) {
+            logError('Failed to tail gateway logs', {
+                logPath: LOG_PATH,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    });
+    await new Promise(() => undefined);
+}
+async function run() {
+    const parsed = parseArgs(process.argv.slice(2));
+    if (parsed.options.h || parsed.options.help || parsed.command === null) {
+        printHelp();
+        return;
+    }
+    if (parsed.command === 'pair') {
+        loadEnvironment(parsed.options);
+        const code = getStringOption(parsed.options, 'code') || parsed.positional[0];
+        if (!code) {
+            throw new Error('Pairing code is required');
+        }
+        await pairGateway(code, parsed.options);
+        return;
+    }
+    if (parsed.command === 'start') {
+        loadEnvironment(parsed.options);
+        await startGateway(parsed.options);
+        return;
+    }
+    if (parsed.command === 'stop') {
+        await stopGateway();
+        return;
+    }
+    if (parsed.command === 'logs') {
+        await showLogs(parsed.options);
+        return;
+    }
+    printHelp();
+    process.exitCode = 1;
+}
+run().catch((error) => {
+    logError('Gateway failed', { error: error instanceof Error ? error.message : String(error) });
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map