@panorama-ai/gateway 2.28.50 → 2.30.176

package/README.md

@@ -1,10 +1,16 @@
 # Panorama Gateway
 
-Gateway service for connecting a team to CLI capabilities on this machine.
+Gateway service for connecting host-side runtime capabilities to Panorama.
+
+In local mode, a team can pair multiple gateways from different machines; each
+gateway instance is identified by its own `gateway_id`.
+
+In managed mode, Panorama provisions the host and starts the gateway with scoped
+managed-runtime credentials.
 
 ## Usage
 
-Pair the gateway with a team using a pairing code:
+Pair this gateway instance with a team using a pairing code:
 
 ```bash
 panorama-gateway pair <PAIRING_CODE>
@@ -24,13 +30,23 @@ SUPABASE_ANON_KEY="your-anon-key" \
 pnpm --filter @panorama-ai/gateway dev -- pair <PAIRING_CODE>
 ```
 
-Start the gateway and begin listening for jobs (foreground in dev, background for built CLI):
+Start this gateway and begin listening for jobs (foreground in dev, background for built CLI):
 
 ```bash
 pnpm --filter @panorama-ai/gateway dev -- start
 ```
 
-Force the gateway into the background (built binary only):
+Run as a Panorama-managed host runtime:
+
+```bash
+panorama-gateway start --mode managed
+```
+
+Managed mode is only intended for Panorama-provisioned hosts with the managed
+runtime environment contract described below. It is not a replacement for
+locally paired user gateways.
+
+Force this gateway into the background (built binary only):
 
 ```bash
 pnpm --filter @panorama-ai/gateway build
@@ -43,18 +59,27 @@ Run in the foreground (built binary):
 pnpm --filter @panorama-ai/gateway start -- --foreground
 ```
 
-Stop the gateway:
+Stop this gateway:
 
 ```bash
 pnpm --filter @panorama-ai/gateway dev -- stop
 ```
 
-Check gateway status:
+Check this gateway's status:
 
 ```bash
 pnpm --filter @panorama-ai/gateway dev -- status
 ```
 
+Manage host machine control on this host (the CLI command is still `full-control`
+for compatibility):
+
+```bash
+pnpm --filter @panorama-ai/gateway dev -- full-control status
+pnpm --filter @panorama-ai/gateway dev -- full-control enable
+pnpm --filter @panorama-ai/gateway dev -- full-control disable
+```
+
 Tail logs:
 
 ```bash
@@ -67,6 +92,7 @@ Optional flags:
 - `--verbose`, `-v` (show technical details like paths, IDs, and PIDs)
 - `--env local|dev|test|stage|prod`
 - `--env-file /path/to/.env`
+- `--mode local|managed` (`start` only; default `local`)
 - `--foreground` (run in the foreground)
 - `--daemon` (force background for built CLI)
 - `--config-dir /path/to/dir`
@@ -94,24 +120,114 @@ You can always point to a specific env file with `--env-file`.
 
 The gateway runs CLI providers using the current user environment (HOME, PATH, etc.) so it matches what you see when running the CLIs directly.
 
-## Execution and Security Model
+Managed mode is for Panorama-provisioned runtimes. It reads the managed Linux
+host environment contract:
+
+- `PANORAMA_AGENT_ID`
+- `PANORAMA_LINUX_HOST_ID`
+- `PANORAMA_LINUX_HOST_ATTEMPT_GENERATION`
+- `PANORAMA_SUPABASE_URL`
+- `PANORAMA_SUPABASE_ANON_KEY`
+- `PANORAMA_LINUX_HOST_CONTROL_URL`
+- `PANORAMA_LINUX_HOST_CONTROL_TOKEN`
+- `PANORAMA_TOOL_EXECUTION_URL`
+- `PANORAMA_TOOL_EXECUTION_TOKEN`
+- `PANORAMA_MANAGED_RUNTIME_ID` (optional)
+- `PANORAMA_MANAGED_RUNTIME_RETRY_BACKOFF_MS` (optional)
+- `PANORAMA_MANAGED_RUNTIME_CONTROL_TIMEOUT_MS` (optional, default `30000`)
+- `PANORAMA_MANAGED_RUNTIME_OUTPUT_CAPTURE_BYTES` (optional, default `5000000`)
+- `PANORAMA_MANAGED_RUNTIME_HEARTBEAT_INTERVAL_MS` (optional)
+- `PANORAMA_MANAGED_RUNTIME_MAX_CONSECUTIVE_HEARTBEAT_FAILURES` (optional)
+
+## Runtime Structure
+
+The gateway package is published to NPM as a single CLI, but internally it has
+separate runtime boundaries for local and managed execution.
+
+Local runtime modules:
+
+- `src/gateway-local-runtime.ts` owns local startup orchestration: paired
+  session loading, provider validation, job controller wiring, signal handling,
+  and lifecycle coordination.
+- `src/local-runtime/heartbeat-supervisor.ts` owns local capability refreshes
+  and heartbeat reporting.
+- `src/local-runtime/restart-supervisor.ts` owns package/probe watching and
+  drain-before-restart behavior.
+- `src/local-runtime/shutdown-supervisor.ts` owns drain, termination, offline
+  heartbeat, and residual job cleanup behavior.
+
+Managed runtime modules:
+
+- `src/managed-runtime.ts` owns managed startup orchestration and dependency
+  wiring.
+- `src/managed-runtime/control-client.ts` owns managed host-control HTTP calls.
+- `src/managed-runtime/realtime.ts` owns Supabase session setup and wake-signal
+  subscription behavior.
+- `src/managed-runtime/execution-dispatcher.ts` owns managed shell execution
+  dispatch, result capture, and completion reporting.
+- `src/managed-runtime/heartbeat.ts`, `src/managed-runtime/host-state.ts`, and
+  `src/managed-runtime/wake-signal.ts` own managed heartbeat, host identity
+  derivation, and wake-signal parsing helpers.
+
+Shared runtime helpers:
+
+- `src/process-output-capture.ts` owns bounded stdout/stderr capture for shell
+  execution, provider streaming, and managed command execution.
+- `src/provider-runtime-utils.ts` owns provider environment construction and
+  command/result parsing helpers used by CLI provider adapters.
+- `src/subagent-adapters/output-format.ts` owns shared subagent output format
+  normalization.
+
+The key split is not "VM versus non-VM"; it is which control surface drives the
+host. Local mode is driven by a paired gateway session and user-delegated host
+capabilities. Managed mode is driven by Panorama-scoped runtime credentials and
+managed host control.
+
+## Execution Bridge and Trust Model
+
+The gateway has two runtime modes:
+
+- Local mode connects Panorama's control plane to a machine/account the team
+  controls.
+- Managed mode connects Panorama's control plane to a Panorama-provisioned host
+  using scoped runtime credentials.
+
+Local mode:
 
 - Gateway processes run as the logged-in user and are designed to behave like direct local CLI usage.
-- Provider child processes inherit user environment semantics, but gateway-internal secrets are scrubbed before launch.
-- Provider/runtime isolation relies on built-in provider controls (for example Codex read-only sandbox + tool flags), not heavyweight host isolation.
+- Gateway hosts are a **user-delegated host** trust zone. Treat gateway access
+  as equivalent to local CLI access for that user account.
+- Provider child processes inherit user environment semantics, but
+  gateway-internal secrets are scrubbed before launch.
+- Provider-side execution controls rely on built-in provider flags (for example
+  Codex read-only sandbox + tool flags), not heavyweight host isolation.
+- Machine-control capabilities are layered:
+  - host machine-control toggle (`panorama-gateway full-control enable`)
+  - team-level gateway machine-control toggle (Team Integrations UI / `set-gateway-full-control`)
+  - resource-level opt-in (`config.full_control=true` for gateway subagents, `metadata.full_control=true` for `remote_shell` resources)
 - Gateway state is stored locally under `~/.panorama/gateway` by default and includes pairing/session tokens needed for reconnects.
 - On POSIX platforms, gateway state directories/files are enforced as owner-only (`0700` for dirs, `0600` for files).
 
+Managed mode:
+
+- Gateway processes run as Panorama-managed runtime participants.
+- Managed hosts use scoped control and tool execution tokens.
+- Shell child processes receive the tool execution token, not the host control
+  token.
+- Managed mode does not use paired-user gateway session material.
+
 Recommended deployment model:
 
-- Use a machine/account you control (for example a dedicated cloud VM user) for running gateways.
+- Use a machine/account you control (for example a dedicated cloud VM user) for each gateway instance.
+- A team can pair multiple gateways (e.g. different developer machines, CI hosts, or VMs). Each gateway gets its own `gateway_id` and reports status independently.
 - Treat gateway host access as equivalent to local CLI access for that user account.
+- For Panorama-managed VM guest images, start from `packages/gateway/vm-template/Dockerfile` and keep the guest gateway bridge scoped to its linked VM identity.
 
 If you hit a permission hardening error, fix ownership/permissions on the gateway state path and re-run `pair` or `start`.
 
 ## Auto-Restart on Upgrade
 
-The built gateway CLI watches its installed package version and restarts itself when the version changes.
+Each gateway CLI instance watches its installed package version and restarts itself when the version changes.
 It drains in-flight jobs first and then respawns using the same CLI arguments.
 
 Defaults:
@@ -127,10 +243,70 @@ Environment overrides:
 
 ## Job Handling
 
-The initial implementation processes `diagnostic` jobs by running `claude --version` on this machine and storing the output in the job result.
+Gateway currently handles:
+
+- `diagnostic` jobs for host/provider validation
+- `model_run` jobs for provider model execution
+- `subagent_run` and `subagent_cancel` jobs for delegated provider harnesses on
+  gateway hosts
+- `shell_exec` jobs for remote shell execution via remote shell resources
 
 For JSON model runs, the worker prefers providers that support explicit output schema mode. JSON streaming support is optional and used as a compatibility path when schema mode is unavailable.
 
+Existing capability names map to these product surfaces:
+
+- `model_execution` means the gateway can run local Claude/Codex/Gemini model
+  calls and gateway subagents. Gateway subagents default to restricted provider
+  sandboxes unless `config.full_control=true` explicitly requests elevated
+  provider mode.
+- `remote_shell` means the gateway can receive `shell_exec` jobs through a
+  `remote_shell` resource.
+- `machine_control` means direct host-control authority is available for
+  elevated gateway subagents and remote shell command execution.
+- `linux_agent_executions` is separate from gateway jobs; it is the
+  embodied/Linux-agent command-execution queue used by Linux-runtime agents.
+
+Remote shell execution contract:
+
+- `shell_exec` runs one foreground shell command through the host shell with
+  `-lc`.
+- Commands start from `/`; callers must include `cd /path && ...` when they
+  want another working directory.
+- The default timeout is 30 seconds and the maximum accepted timeout is 10
+  minutes.
+- Stdout/stderr are returned inline with truncation flags. Remote shell exec
+  does not create overflow artifacts.
+- The gateway does not track background processes after the foreground command
+  exits. Callers may start background work intentionally, but they must manage
+  it with later shell commands.
+
 ## CLI Provider Notes
 
 See `packages/gateway/CLI_PROVIDERS.md` for current findings on Claude Code, Codex CLI, and Gemini CLI usage patterns.
+
+## Packaging and Smoke Checks
+
+The gateway is expected to remain publishable to NPM. The package publishes
+only the built `dist` output and this README; source files are not part of the
+runtime package.
+
+Run these checks before shipping gateway runtime changes:
+
+```bash
+pnpm --filter @panorama-ai/gateway test
+pnpm --filter @panorama-ai/gateway build
+pnpm --filter @panorama-ai/gateway verify:packaged-cli
+```
+
+Use targeted smoke tests when changing one runtime surface:
+
+```bash
+pnpm --filter @panorama-ai/gateway exec tsx --test test/gateway-start-command.test.ts test/gateway-local-runtime.test.ts test/local-runtime-heartbeat-supervisor.test.ts test/local-runtime-restart-supervisor.test.ts test/local-runtime-shutdown-supervisor.test.ts
+pnpm --filter @panorama-ai/gateway exec tsx --test test/managed-runtime.test.ts test/managed-runtime-helpers.test.ts
+```
+
+`panorama-gateway start` requires paired local gateway state. `panorama-gateway
+start --mode managed` requires Panorama-managed runtime credentials. Prefer the
+packaged CLI check plus targeted runtime tests for local development smoke
+validation unless you are intentionally testing against a live paired gateway or
+managed host.

package/dist/child-process-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"child-process-env.d.ts","sourceRoot":"","sources":["../src/child-process-env.ts"],"names":[],"mappings":"AAoBA,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,MAAM,CAAC,UAAwB,GACvC,MAAM,CAAC,UAAU,CAQnB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAC9B,GAAG,MAAM,CAAC,UAAU,CAoBpB"}
+{"version":3,"file":"child-process-env.d.ts","sourceRoot":"","sources":["../src/child-process-env.ts"],"names":[],"mappings":"AAqBA,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,MAAM,CAAC,UAAwB,GACvC,MAAM,CAAC,UAAU,CAQnB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,CAAC,EAAE;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAC9B,GAAG,MAAM,CAAC,UAAU,CAoBpB"}

package/dist/child-process-env.js

@@ -6,6 +6,7 @@ const GATEWAY_CHILD_ENV_BLOCKED_KEYS = new Set([
     'SUPABASE_ANON_KEY',
     'SUPABASE_PUBLISHABLE_KEY',
     'SUPABASE_SERVICE_ROLE_KEY',
+    'SUPABASE_SECRET_KEY',
     'PANORAMA_SUPABASE_URL',
     'PANORAMA_SUPABASE_ANON_KEY',
     'PANORAMA_ENV',

package/dist/child-process-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"child-process-env.js","sourceRoot":"","sources":["../src/child-process-env.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAA;AAElC,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,mBAAmB;IACnB,0BAA0B;IAC1B,2BAA2B;IAC3B,uBAAuB;IACvB,4BAA4B;IAC5B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;CACvB,CAAC,CAAA;AAEF,MAAM,kCAAkC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AAEhE,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,IAAI,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,OAAO,kCAAkC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAA6B,OAAO,CAAC,GAAG;IAExC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,uBAAuB,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAI3C;IACC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAA;IAC9C,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;IAC7B,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;QACnB,GAAG,CAAC,GAAG,GAAG,MAAM,CAAA;QAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAA;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAA;IACnC,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;YACjB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"child-process-env.js","sourceRoot":"","sources":["../src/child-process-env.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAA;AAElC,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,mBAAmB;IACnB,0BAA0B;IAC1B,2BAA2B;IAC3B,qBAAqB;IACrB,uBAAuB;IACvB,4BAA4B;IAC5B,cAAc;IACd,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,sBAAsB;CACvB,CAAC,CAAA;AAEF,MAAM,kCAAkC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AAEhE,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,IAAI,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxD,OAAO,kCAAkC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAA6B,OAAO,CAAC,GAAG;IAExC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,uBAAuB,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAI3C;IACC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAA;IAC9C,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;IAC7B,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;QACnB,GAAG,CAAC,GAAG,GAAG,MAAM,CAAA;QAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAA;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAA;IACnC,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAA;YACjB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/child-process-startup.d.ts

@@ -0,0 +1,4 @@
+import type { ChildProcess } from 'node:child_process';
+export declare function waitForChildSpawn(child: ChildProcess): Promise<void>;
+export declare function waitForChildStartup(child: ChildProcess): Promise<void>;
+//# sourceMappingURL=child-process-startup.d.ts.map

package/dist/child-process-startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process-startup.d.ts","sourceRoot":"","sources":["../src/child-process-startup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1E;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAe5E"}

package/dist/child-process-startup.js

@@ -0,0 +1,33 @@
+export async function waitForChildSpawn(child) {
+    await new Promise((resolve, reject) => {
+        const cleanup = () => {
+            child.off('spawn', handleSpawn);
+            child.off('error', handleError);
+        };
+        const handleSpawn = () => {
+            cleanup();
+            resolve();
+        };
+        const handleError = (error) => {
+            cleanup();
+            reject(error);
+        };
+        child.once('spawn', handleSpawn);
+        child.once('error', handleError);
+    });
+}
+export async function waitForChildStartup(child) {
+    await waitForChildSpawn(child);
+    await new Promise((resolve) => {
+        setImmediate(resolve);
+    });
+    if (child.exitCode !== null || child.signalCode !== null) {
+        const detail = child.exitCode !== null
+            ? `code ${child.exitCode}`
+            : child.signalCode
+                ? `signal ${child.signalCode}`
+                : 'unknown reason';
+        throw new Error(`Process exited during startup (${detail})`);
+    }
+}
+//# sourceMappingURL=child-process-startup.js.map

package/dist/child-process-startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process-startup.js","sourceRoot":"","sources":["../src/child-process-startup.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAmB;IACzD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YAC/B,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACjC,CAAC,CAAA;QAED,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,OAAO,EAAE,CAAA;YACT,OAAO,EAAE,CAAA;QACX,CAAC,CAAA;QAED,MAAM,WAAW,GAAG,CAAC,KAAY,EAAE,EAAE;YACnC,OAAO,EAAE,CAAA;YACT,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC,CAAA;QAED,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAChC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAmB;IAC3D,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,YAAY,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,MAAM,GACV,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,QAAQ,KAAK,CAAC,QAAQ,EAAE;YAC1B,CAAC,CAAC,KAAK,CAAC,UAAU;gBAChB,CAAC,CAAC,UAAU,KAAK,CAAC,UAAU,EAAE;gBAC9B,CAAC,CAAC,gBAAgB,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,GAAG,CAAC,CAAA;IAC9D,CAAC;AACH,CAAC"}

package/dist/cli-args.d.ts

@@ -0,0 +1,11 @@
+export interface ParsedArgs {
+    command: string | null;
+    positional: string[];
+    options: Record<string, string | boolean>;
+}
+export type GatewayRuntimeMode = 'local' | 'managed';
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export declare function getStringOption(options: ParsedArgs['options'], key: string): string | undefined;
+export declare function resolveGatewayRuntimeMode(options: ParsedArgs['options'], env?: NodeJS.ProcessEnv): GatewayRuntimeMode;
+export declare function parseBooleanInput(value: unknown): boolean | null;
+//# sourceMappingURL=cli-args.d.ts.map

package/dist/cli-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.d.ts","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAA;CAC1C;AAED,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,CAAA;AAEpD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAyCpD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI/F;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,kBAAkB,CAOpB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAsBhE"}

package/dist/cli-args.js

@@ -0,0 +1,72 @@
+export function parseArgs(argv) {
+    const normalizedArgv = argv[0] === '--' ? argv.slice(1) : argv;
+    const positional = [];
+    const options = {};
+    for (let i = 0; i < normalizedArgv.length; i += 1) {
+        const arg = normalizedArgv[i];
+        if (!arg)
+            continue;
+        if (arg === '--') {
+            positional.push(...normalizedArgv.slice(i + 1));
+            break;
+        }
+        if (arg.startsWith('--')) {
+            const [flag, inlineValue] = arg.slice(2).split('=');
+            if (inlineValue !== undefined) {
+                options[flag] = inlineValue;
+                continue;
+            }
+            const next = normalizedArgv[i + 1];
+            if (next && !next.startsWith('--')) {
+                options[flag] = next;
+                i += 1;
+            }
+            else {
+                options[flag] = true;
+            }
+            continue;
+        }
+        if (arg.startsWith('-') && arg.length > 1) {
+            options[arg.slice(1)] = true;
+            continue;
+        }
+        positional.push(arg);
+    }
+    const command = positional.shift() ?? null;
+    return { command, positional, options };
+}
+export function getStringOption(options, key) {
+    const value = options[key];
+    if (typeof value === 'string')
+        return value;
+    return undefined;
+}
+export function resolveGatewayRuntimeMode(options, env = process.env) {
+    const rawMode = getStringOption(options, 'mode') || env.PANORAMA_GATEWAY_MODE || 'local';
+    const mode = rawMode.trim().toLowerCase();
+    if (mode === 'local' || mode === 'managed') {
+        return mode;
+    }
+    throw new Error(`Unsupported gateway mode: ${rawMode}`);
+}
+export function parseBooleanInput(value) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'string') {
+        const normalized = value.trim().toLowerCase();
+        if (normalized === 'true' ||
+            normalized === '1' ||
+            normalized === 'yes' ||
+            normalized === 'on') {
+            return true;
+        }
+        if (normalized === 'false' ||
+            normalized === '0' ||
+            normalized === 'no' ||
+            normalized === 'off') {
+            return false;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=cli-args.js.map

package/dist/cli-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-args.js","sourceRoot":"","sources":["../src/cli-args.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAqC,EAAE,CAAA;IAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,GAAG;YAAE,SAAQ;QAElB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC/C,MAAK;QACP,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACnD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAA;gBAC3B,SAAQ;YACV,CAAC;YAED,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAClC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;gBACpB,CAAC,IAAI,CAAC,CAAA;YACR,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;YACtB,CAAC;YACD,SAAQ;QACV,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;YAC5B,SAAQ;QACV,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,IAAI,CAAA;IAC1C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA8B,EAAE,GAAW;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAA;IACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC7C,IACE,UAAU,KAAK,MAAM;YACrB,UAAU,KAAK,GAAG;YAClB,UAAU,KAAK,KAAK;YACpB,UAAU,KAAK,IAAI,EACnB,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IACE,UAAU,KAAK,OAAO;YACtB,UAAU,KAAK,GAAG;YAClB,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,KAAK,EACpB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/cli-command-discovery.d.ts

@@ -0,0 +1,17 @@
+export interface CommandDiscoveryOptions {
+    env?: NodeJS.ProcessEnv;
+    homeDir?: string;
+    platform?: NodeJS.Platform;
+    maxClaudeWrapperBytes?: number;
+}
+export declare function expandHomePath(value: string, homeDir?: string): string;
+export declare function extractClaudeWrapperTarget(commandPath: string, options?: CommandDiscoveryOptions): string | null;
+export declare function isBrokenClaudeWrapper(commandPath: string, options?: CommandDiscoveryOptions): boolean;
+export declare function isExecutableCandidate(candidate: string, platform?: NodeJS.Platform): boolean;
+export declare function collectBinDirs(options?: CommandDiscoveryOptions): string[];
+export declare function expandCommandExtensions(command: string, options?: Pick<CommandDiscoveryOptions, 'env' | 'platform'>): string[];
+export declare function collectCommandCandidates(command: string, extraCandidates: string[], options?: CommandDiscoveryOptions): string[];
+export declare function resolveClaudeFallbackCommand(commandPath: string, options?: CommandDiscoveryOptions): string | null;
+export declare function extractVersion(text: string): string | null;
+export declare function compareVersions(a: string, b: string): number;
+//# sourceMappingURL=cli-command-discovery.d.ts.map

package/dist/cli-command-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-command-discovery.d.ts","sourceRoot":"","sources":["../src/cli-command-discovery.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC/B;AAWD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,MAAqB,GAAG,MAAM,CAKpF;AAED,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,uBAA4B,GACpC,MAAM,GAAG,IAAI,CAaf;AAED,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAQT;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAUT;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,uBAA4B,GAAG,MAAM,EAAE,CAyD9E;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,GAAG,UAAU,CAAM,GAC9D,MAAM,EAAE,CASV;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,GAAE,uBAA4B,GACpC,MAAM,EAAE,CA0BV;AAED,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,uBAA4B,GACpC,MAAM,GAAG,IAAI,CAiCf;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ1D;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA4B5D"}