@panorama-ai/gateway 2.29.14 → 2.30.181

package/dist/managed-runtime/heartbeat.js

@@ -0,0 +1,44 @@
+import { setTimeout as sleep } from 'node:timers/promises';
+import { asError, MANAGED_GATEWAY_LOG_PREFIX } from './runtime-utils.js';
+export function startHostHeartbeatLoop(params) {
+    let stopped = false;
+    let consecutiveFailures = 0;
+    const abortController = new AbortController();
+    const loop = async () => {
+        while (!stopped) {
+            try {
+                await sleep(params.intervalMs, undefined, { signal: abortController.signal });
+            }
+            catch (error) {
+                if (abortController.signal.aborted) {
+                    break;
+                }
+                throw error;
+            }
+            if (stopped) {
+                break;
+            }
+            try {
+                await params.heartbeatHost();
+                consecutiveFailures = 0;
+            }
+            catch (error) {
+                consecutiveFailures += 1;
+                console.error(`${MANAGED_GATEWAY_LOG_PREFIX} failed to heartbeat managed host`, {
+                    consecutiveFailures,
+                    error,
+                });
+                if (consecutiveFailures >= params.maxConsecutiveFailures) {
+                    params.onFatalFailure(asError(error));
+                    return;
+                }
+            }
+        }
+    };
+    void loop();
+    return () => {
+        stopped = true;
+        abortController.abort();
+    };
+}
+//# sourceMappingURL=heartbeat.js.map

package/dist/managed-runtime/heartbeat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat.js","sourceRoot":"","sources":["../../src/managed-runtime/heartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAA;AAExE,MAAM,UAAU,sBAAsB,CAAC,MAKtC;IACC,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAC3B,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAA;IAE7C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,OAAO,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnC,MAAK;gBACP,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAK;YACP,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,aAAa,EAAE,CAAA;gBAC5B,mBAAmB,GAAG,CAAC,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mBAAmB,IAAI,CAAC,CAAA;gBACxB,OAAO,CAAC,KAAK,CAAC,GAAG,0BAA0B,mCAAmC,EAAE;oBAC9E,mBAAmB;oBACnB,KAAK;iBACN,CAAC,CAAA;gBAEF,IAAI,mBAAmB,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;oBACzD,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;oBACrC,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,KAAK,IAAI,EAAE,CAAA;IAEX,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAA;QACd,eAAe,CAAC,KAAK,EAAE,CAAA;IACzB,CAAC,CAAA;AACH,CAAC"}

package/dist/managed-runtime/host-state.d.ts

@@ -0,0 +1,15 @@
+import type { LinuxHostControlHostEnvelope } from '@panorama/shared/linux-host-control/contract';
+export type LinuxHostObservedState = {
+    attemptGeneration: number | null;
+    allocationState: string | null;
+    desiredPowerState: string | null;
+    status: string | null;
+    runtimeState: string | null;
+    error: string | null;
+};
+export declare function readLinuxHostWakeState(row: Record<string, unknown>): string;
+export declare function readLinuxHostObservedState(value: Record<string, unknown> | (LinuxHostControlHostEnvelope & {
+    error?: string | null;
+})): LinuxHostObservedState;
+export declare function describeLinuxHostStopReason(state: LinuxHostObservedState, expectedAttemptGeneration: number): string | null;
+//# sourceMappingURL=host-state.d.ts.map

package/dist/managed-runtime/host-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-state.d.ts","sourceRoot":"","sources":["../../src/managed-runtime/host-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAA;AAEhG,MAAM,MAAM,sBAAsB,GAAG;IACnC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,CAAA;AAMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAe3E;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,GAC1F,sBAAsB,CAgBxB;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,sBAAsB,EAC7B,yBAAyB,EAAE,MAAM,GAChC,MAAM,GAAG,IAAI,CAsBf"}

package/dist/managed-runtime/host-state.js

@@ -0,0 +1,50 @@
+function readNullableString(value) {
+    return typeof value === 'string' ? value : null;
+}
+export function readLinuxHostWakeState(row) {
+    return JSON.stringify({
+        attempt_generation: typeof row.attempt_generation === 'number' ? row.attempt_generation : row.attempt_generation ?? null,
+        allocation_state: typeof row.allocation_state === 'string' ? row.allocation_state : row.allocation_state ?? null,
+        desired_power_state: typeof row.desired_power_state === 'string'
+            ? row.desired_power_state
+            : row.desired_power_state ?? null,
+        status: typeof row.status === 'string' ? row.status : row.status ?? null,
+        runtime_state: typeof row.runtime_state === 'string' ? row.runtime_state : row.runtime_state ?? null,
+        error: typeof row.error === 'string' ? row.error : row.error ?? null,
+    });
+}
+export function readLinuxHostObservedState(value) {
+    return {
+        attemptGeneration: typeof value.attempt_generation === 'number'
+            ? value.attempt_generation
+            : value.attempt_generation === null || value.attempt_generation === undefined
+                ? null
+                : Number.isFinite(Number(value.attempt_generation))
+                    ? Number(value.attempt_generation)
+                    : null,
+        allocationState: readNullableString(value.allocation_state),
+        desiredPowerState: readNullableString(value.desired_power_state),
+        status: readNullableString(value.status),
+        runtimeState: readNullableString(value.runtime_state),
+        error: readNullableString(value.error),
+    };
+}
+export function describeLinuxHostStopReason(state, expectedAttemptGeneration) {
+    if (state.attemptGeneration !== null && state.attemptGeneration !== expectedAttemptGeneration) {
+        return `host attempt rotated to ${state.attemptGeneration}`;
+    }
+    if (state.allocationState !== null && state.allocationState !== 'warm') {
+        return `host allocation is ${state.allocationState}`;
+    }
+    if (state.desiredPowerState !== null && state.desiredPowerState !== 'running') {
+        return `desired power state is ${state.desiredPowerState}`;
+    }
+    if (state.status === 'stopping' || state.status === 'stopped') {
+        return `host status is ${state.status}`;
+    }
+    if (state.runtimeState === 'stopping' || state.runtimeState === 'stopped') {
+        return `host runtime_state is ${state.runtimeState}`;
+    }
+    return null;
+}
+//# sourceMappingURL=host-state.js.map

package/dist/managed-runtime/host-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-state.js","sourceRoot":"","sources":["../../src/managed-runtime/host-state.ts"],"names":[],"mappings":"AAWA,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAA4B;IACjE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAChB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI;QACtG,gBAAgB,EACd,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAChG,mBAAmB,EACjB,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ;YACzC,CAAC,CAAC,GAAG,CAAC,mBAAmB;YACzB,CAAC,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI;QACrC,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI;QACxE,aAAa,EACX,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI;QACvF,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI;KACrE,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAA2F;IAE3F,OAAO;QACL,iBAAiB,EACf,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,kBAAkB;YAC1B,CAAC,CAAC,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;gBAC3E,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;oBACjD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC;oBAClC,CAAC,CAAC,IAAI;QACd,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC3D,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAChE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC;QACxC,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QACrD,KAAK,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;KACvC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAA6B,EAC7B,yBAAiC;IAEjC,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,yBAAyB,EAAE,CAAC;QAC9F,OAAO,2BAA2B,KAAK,CAAC,iBAAiB,EAAE,CAAA;IAC7D,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;QACvE,OAAO,sBAAsB,KAAK,CAAC,eAAe,EAAE,CAAA;IACtD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,0BAA0B,KAAK,CAAC,iBAAiB,EAAE,CAAA;IAC5D,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9D,OAAO,kBAAkB,KAAK,CAAC,MAAM,EAAE,CAAA;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1E,OAAO,yBAAyB,KAAK,CAAC,YAAY,EAAE,CAAA;IACtD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/managed-runtime/realtime.d.ts

@@ -0,0 +1,25 @@
+import { type LinuxHostObservedState } from './host-state.js';
+import { type ManagedGatewaySupabaseClient } from './runtime-utils.js';
+export declare function createManagedRealtimeClient(params: {
+    supabaseUrl: string;
+    supabaseAnonKey: string;
+    hostControlToken: string;
+    agentId: string;
+    hostId: string;
+    hostAttemptGeneration: number;
+    controlTimeoutMs: number;
+}): Promise<{
+    supabase: ManagedGatewaySupabaseClient;
+    unsubscribeAuthStateChange: () => void;
+}>;
+export declare function startManagedRealtimeWakeLoop(params: {
+    supabase: ManagedGatewaySupabaseClient;
+    hostId: string;
+    hostAttemptGeneration: number;
+    retryBackoffMs: number;
+    onReconnectRequired: () => void;
+    onHostStateObserved: (state: LinuxHostObservedState, source: string) => void;
+    requestWake: (reason: string) => void;
+    shouldStop: () => boolean;
+}): () => Promise<void>;
+//# sourceMappingURL=realtime.d.ts.map

package/dist/managed-runtime/realtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realtime.d.ts","sourceRoot":"","sources":["../../src/managed-runtime/realtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,oBAAoB,CAAA;AAI3B,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,qBAAqB,EAAE,MAAM,CAAA;IAC7B,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,4BAA4B,CAAA;IACtC,0BAA0B,EAAE,MAAM,IAAI,CAAA;CACvC,CAAC,CAoED;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,QAAQ,EAAE,4BAA4B,CAAA;IACtC,MAAM,EAAE,MAAM,CAAA;IACd,qBAAqB,EAAE,MAAM,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAA;IACtB,mBAAmB,EAAE,MAAM,IAAI,CAAA;IAC/B,mBAAmB,EAAE,CAAC,KAAK,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5E,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,UAAU,EAAE,MAAM,OAAO,CAAA;CAC1B,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAiKtB"}

package/dist/managed-runtime/realtime.js

@@ -0,0 +1,189 @@
+import { createClient } from '@supabase/supabase-js';
+import { exchangeLinuxHostSession } from './control-client.js';
+import { readLinuxHostObservedState, readLinuxHostWakeState, } from './host-state.js';
+import { MANAGED_GATEWAY_LOG_PREFIX, normalizeRecord, } from './runtime-utils.js';
+const DEFAULT_REALTIME_EVENTS_PER_SECOND = 10;
+export async function createManagedRealtimeClient(params) {
+    const sessionExchange = await exchangeLinuxHostSession({
+        supabaseUrl: params.supabaseUrl,
+        supabaseAnonKey: params.supabaseAnonKey,
+        hostControlToken: params.hostControlToken,
+        timeoutMs: params.controlTimeoutMs,
+    });
+    if (!sessionExchange.success) {
+        throw new Error('Linux host session exchange returned an unsuccessful response.');
+    }
+    if (sessionExchange.agent_id !== params.agentId) {
+        throw new Error(`Linux host session exchange returned agent ${sessionExchange.agent_id}, expected ${params.agentId}`);
+    }
+    if (sessionExchange.host_id !== params.hostId) {
+        throw new Error(`Linux host session exchange returned host ${sessionExchange.host_id}, expected ${params.hostId}`);
+    }
+    if (sessionExchange.attempt_generation !== params.hostAttemptGeneration) {
+        throw new Error(`Linux host session exchange returned attempt generation ${sessionExchange.attempt_generation}, expected ${params.hostAttemptGeneration}`);
+    }
+    const supabase = createClient(params.supabaseUrl, params.supabaseAnonKey, {
+        auth: {
+            persistSession: false,
+            autoRefreshToken: true,
+            detectSessionInUrl: false,
+        },
+        realtime: {
+            params: {
+                eventsPerSecond: DEFAULT_REALTIME_EVENTS_PER_SECOND,
+            },
+        },
+    });
+    const { data: sessionData, error: sessionError } = await supabase.auth.setSession({
+        access_token: sessionExchange.access_token,
+        refresh_token: sessionExchange.refresh_token,
+    });
+    if (sessionError || !sessionData?.session) {
+        throw new Error(sessionError?.message || 'Linux host session exchange did not return a session.');
+    }
+    const authStateSubscription = supabase.auth.onAuthStateChange((event, session) => {
+        if (!session) {
+            return;
+        }
+        if (event === 'TOKEN_REFRESHED' || event === 'SIGNED_IN') {
+            console.log(`${MANAGED_GATEWAY_LOG_PREFIX} refreshed managed runtime session`, {
+                event,
+                expiresAt: session.expires_at ?? null,
+            });
+        }
+    });
+    return {
+        supabase,
+        unsubscribeAuthStateChange() {
+            authStateSubscription.data.subscription.unsubscribe();
+        },
+    };
+}
+export function startManagedRealtimeWakeLoop(params) {
+    let activeChannel = null;
+    let reconnectTimer = null;
+    let lastHostWakeState = null;
+    const syncHostWakeState = async () => {
+        const { data, error } = await params.supabase
+            .from('linux_agent_hosts')
+            .select('attempt_generation, allocation_state, desired_power_state, status, runtime_state, error')
+            .eq('id', params.hostId)
+            .maybeSingle();
+        if (error) {
+            console.warn(`${MANAGED_GATEWAY_LOG_PREFIX} failed to seed managed host realtime baseline`, {
+                hostId: params.hostId,
+                error: error.message,
+            });
+            return;
+        }
+        if (data) {
+            const normalized = normalizeRecord(data);
+            lastHostWakeState = readLinuxHostWakeState(normalized);
+            params.onHostStateObserved(readLinuxHostObservedState(normalized), 'baseline');
+        }
+    };
+    const scheduleReconnect = (reason) => {
+        if (params.shouldStop() || reconnectTimer) {
+            return;
+        }
+        reconnectTimer = setTimeout(() => {
+            reconnectTimer = null;
+            void connectChannel(`reconnect:${reason}`);
+        }, params.retryBackoffMs);
+    };
+    const handleHostPayload = (payload) => {
+        const nextRow = normalizeRecord(payload.new);
+        params.onHostStateObserved(readLinuxHostObservedState(nextRow), `realtime_${payload.eventType.toLowerCase()}`);
+        const nextWakeState = readLinuxHostWakeState(nextRow);
+        if (nextWakeState === lastHostWakeState) {
+            return;
+        }
+        lastHostWakeState = nextWakeState;
+        params.onReconnectRequired();
+        params.requestWake(`host_${payload.eventType.toLowerCase()}`);
+    };
+    const handleExecutionPayload = (payload) => {
+        const nextRow = normalizeRecord(payload.new);
+        const nextStatus = typeof nextRow.status === 'string' ? nextRow.status : null;
+        if (payload.eventType === 'INSERT' || nextStatus === 'queued') {
+            params.requestWake(`execution_${payload.eventType.toLowerCase()}`);
+        }
+    };
+    const connectChannel = async (reason) => {
+        if (params.shouldStop()) {
+            return;
+        }
+        const previousChannel = activeChannel;
+        activeChannel = null;
+        if (previousChannel) {
+            try {
+                await previousChannel.unsubscribe();
+            }
+            catch {
+                // ignore unsubscribe failures during reconnect
+            }
+        }
+        const nextChannel = params.supabase
+            .channel(`managed_gateway_runtime_${params.hostId}_${params.hostAttemptGeneration}`)
+            .on('postgres_changes', {
+            event: 'UPDATE',
+            schema: 'public',
+            table: 'linux_agent_hosts',
+            filter: `id=eq.${params.hostId}`,
+        }, handleHostPayload)
+            .on('postgres_changes', {
+            event: 'INSERT',
+            schema: 'public',
+            table: 'linux_agent_executions',
+            filter: `host_id=eq.${params.hostId}`,
+        }, handleExecutionPayload)
+            .on('postgres_changes', {
+            event: 'UPDATE',
+            schema: 'public',
+            table: 'linux_agent_executions',
+            filter: `host_id=eq.${params.hostId}`,
+        }, handleExecutionPayload);
+        activeChannel = nextChannel;
+        nextChannel.subscribe((status, error) => {
+            if (activeChannel !== nextChannel || params.shouldStop()) {
+                return;
+            }
+            if (status === 'SUBSCRIBED') {
+                void (async () => {
+                    await syncHostWakeState();
+                    console.log(`${MANAGED_GATEWAY_LOG_PREFIX} subscribed to managed host realtime channel`, {
+                        hostId: params.hostId,
+                        attemptGeneration: params.hostAttemptGeneration,
+                        reason,
+                    });
+                    params.onReconnectRequired();
+                    params.requestWake(`realtime_subscribed:${reason}`);
+                })();
+                return;
+            }
+            if (status === 'CHANNEL_ERROR' || status === 'TIMED_OUT' || status === 'CLOSED') {
+                console.error(`${MANAGED_GATEWAY_LOG_PREFIX} managed host realtime channel unavailable`, {
+                    status,
+                    reason,
+                    error: error?.message ?? null,
+                });
+                params.onReconnectRequired();
+                scheduleReconnect(status.toLowerCase());
+            }
+        });
+    };
+    void connectChannel('startup');
+    return async () => {
+        if (reconnectTimer) {
+            clearTimeout(reconnectTimer);
+            reconnectTimer = null;
+        }
+        const channelToClose = activeChannel;
+        activeChannel = null;
+        if (channelToClose) {
+            await channelToClose.unsubscribe().catch(() => undefined);
+        }
+        await params.supabase.removeAllChannels().catch(() => undefined);
+    };
+}
+//# sourceMappingURL=realtime.js.map

package/dist/managed-runtime/realtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realtime.js","sourceRoot":"","sources":["../../src/managed-runtime/realtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6D,MAAM,uBAAuB,CAAA;AAC/G,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAEvB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,0BAA0B,EAC1B,eAAe,GAEhB,MAAM,oBAAoB,CAAA;AAE3B,MAAM,kCAAkC,GAAG,EAAE,CAAA;AAE7C,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MAQjD;IAIC,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC;QACrD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,gBAAgB;KACnC,CAAC,CAAA;IAEF,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,eAAe,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,8CAA8C,eAAe,CAAC,QAAQ,cAAc,MAAM,CAAC,OAAO,EAAE,CACrG,CAAA;IACH,CAAC;IACD,IAAI,eAAe,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,6CAA6C,eAAe,CAAC,OAAO,cAAc,MAAM,CAAC,MAAM,EAAE,CAClG,CAAA;IACH,CAAC;IACD,IAAI,eAAe,CAAC,kBAAkB,KAAK,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,2DAA2D,eAAe,CAAC,kBAAkB,cAAc,MAAM,CAAC,qBAAqB,EAAE,CAC1I,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,eAAe,EAAE;QACxE,IAAI,EAAE;YACJ,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,IAAI;YACtB,kBAAkB,EAAE,KAAK;SAC1B;QACD,QAAQ,EAAE;YACR,MAAM,EAAE;gBACN,eAAe,EAAE,kCAAkC;aACpD;SACF;KACF,CAAiC,CAAA;IAElC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAChF,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,aAAa,EAAE,eAAe,CAAC,aAAa;KAC7C,CAAC,CAAA;IAEF,IAAI,YAAY,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,OAAO,IAAI,uDAAuD,CAAC,CAAA;IACnG,CAAC;IAED,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAM;QACR,CAAC;QAED,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,oCAAoC,EAAE;gBAC7E,KAAK;gBACL,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;aACtC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,QAAQ;QACR,0BAA0B;YACxB,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAA;QACvD,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAS5C;IACC,IAAI,aAAa,GAA2B,IAAI,CAAA;IAChD,IAAI,cAAc,GAA0B,IAAI,CAAA;IAChD,IAAI,iBAAiB,GAAkB,IAAI,CAAA;IAE3C,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE;QACnC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ;aAC1C,IAAI,CAAC,mBAAmB,CAAC;aACzB,MAAM,CAAC,yFAAyF,CAAC;aACjG,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;aACvB,WAAW,EAAE,CAAA;QAEhB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,GAAG,0BAA0B,gDAAgD,EAAE;gBAC1F,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,KAAK,CAAC,OAAO;aACrB,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;YACxC,iBAAiB,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAA;YACtD,MAAM,CAAC,mBAAmB,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;QAChF,CAAC;IACH,CAAC,CAAA;IAED,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,EAAE;QAC3C,IAAI,MAAM,CAAC,UAAU,EAAE,IAAI,cAAc,EAAE,CAAC;YAC1C,OAAM;QACR,CAAC;QAED,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,cAAc,GAAG,IAAI,CAAA;YACrB,KAAK,cAAc,CAAC,aAAa,MAAM,EAAE,CAAC,CAAA;QAC5C,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAA;IAC3B,CAAC,CAAA;IAED,MAAM,iBAAiB,GAAG,CAAC,OAAgE,EAAE,EAAE;QAC7F,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,mBAAmB,CACxB,0BAA0B,CAAC,OAAO,CAAC,EACnC,YAAY,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAC9C,CAAA;QACD,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QACrD,IAAI,aAAa,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAM;QACR,CAAC;QACD,iBAAiB,GAAG,aAAa,CAAA;QAEjC,MAAM,CAAC,mBAAmB,EAAE,CAAA;QAC5B,MAAM,CAAC,WAAW,CAAC,QAAQ,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAA;IAED,MAAM,sBAAsB,GAAG,CAC7B,OAAgE,EAChE,EAAE;QACF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7E,IAAI,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,CAAC,WAAW,CAAC,aAAa,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACpE,CAAC;IACH,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QAC9C,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YACxB,OAAM;QACR,CAAC;QAED,MAAM,eAAe,GAAG,aAAa,CAAA;QACrC,aAAa,GAAG,IAAI,CAAA;QACpB,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,WAAW,EAAE,CAAA;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,+CAA+C;YACjD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ;aAChC,OAAO,CAAC,2BAA2B,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;aACnF,EAAE,CACD,kBAAkB,EAClB;YACE,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE;SACjC,EACD,iBAAiB,CAClB;aACA,EAAE,CACD,kBAAkB,EAClB;YACE,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,cAAc,MAAM,CAAC,MAAM,EAAE;SACtC,EACD,sBAAsB,CACvB;aACA,EAAE,CACD,kBAAkB,EAClB;YACE,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,cAAc,MAAM,CAAC,MAAM,EAAE;SACtC,EACD,sBAAsB,CACvB,CAAA;QAEH,aAAa,GAAG,WAAW,CAAA;QAE3B,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACtC,IAAI,aAAa,KAAK,WAAW,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBACzD,OAAM;YACR,CAAC;YAED,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,MAAM,iBAAiB,EAAE,CAAA;oBACzB,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,8CAA8C,EAAE;wBACvF,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,iBAAiB,EAAE,MAAM,CAAC,qBAAqB;wBAC/C,MAAM;qBACP,CAAC,CAAA;oBACF,MAAM,CAAC,mBAAmB,EAAE,CAAA;oBAC5B,MAAM,CAAC,WAAW,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAA;gBACrD,CAAC,CAAC,EAAE,CAAA;gBACJ,OAAM;YACR,CAAC;YAED,IAAI,MAAM,KAAK,eAAe,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChF,OAAO,CAAC,KAAK,CAAC,GAAG,0BAA0B,4CAA4C,EAAE;oBACvF,MAAM;oBACN,MAAM;oBACN,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI;iBAC9B,CAAC,CAAA;gBACF,MAAM,CAAC,mBAAmB,EAAE,CAAA;gBAC5B,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YACzC,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,KAAK,cAAc,CAAC,SAAS,CAAC,CAAA;IAE9B,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,cAAc,EAAE,CAAC;YACnB,YAAY,CAAC,cAAc,CAAC,CAAA;YAC5B,cAAc,GAAG,IAAI,CAAA;QACvB,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAA;QACpC,aAAa,GAAG,IAAI,CAAA;QACpB,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC,CAAA;AACH,CAAC"}

package/dist/managed-runtime/runtime-utils.d.ts

@@ -0,0 +1,8 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { Database } from '../database.types.js';
+export declare const MANAGED_GATEWAY_LOG_PREFIX = "[panorama-gateway managed]";
+export type ManagedGatewaySupabaseClient = SupabaseClient<Database>;
+export declare function asError(error: unknown): Error;
+export declare function withAbortTimeout<T>(timeoutMs: number, timeoutMessage: string, operation: (signal: AbortSignal) => Promise<T>, externalSignal?: AbortSignal): Promise<T>;
+export declare function normalizeRecord(value: unknown): Record<string, unknown>;
+//# sourceMappingURL=runtime-utils.d.ts.map

package/dist/managed-runtime/runtime-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-utils.d.ts","sourceRoot":"","sources":["../../src/managed-runtime/runtime-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAEpD,eAAO,MAAM,0BAA0B,+BAA+B,CAAA;AAEtE,MAAM,MAAM,4BAA4B,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;AAEnE,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAE7C;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAC9C,cAAc,CAAC,EAAE,WAAW,GAC3B,OAAO,CAAC,CAAC,CAAC,CA0BZ;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMvE"}

package/dist/managed-runtime/runtime-utils.js

@@ -0,0 +1,39 @@
+export const MANAGED_GATEWAY_LOG_PREFIX = '[panorama-gateway managed]';
+export function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+export async function withAbortTimeout(timeoutMs, timeoutMessage, operation, externalSignal) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeoutHandle = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, timeoutMs);
+    const abortFromExternalSignal = () => controller.abort();
+    if (externalSignal?.aborted) {
+        controller.abort();
+    }
+    else {
+        externalSignal?.addEventListener('abort', abortFromExternalSignal, { once: true });
+    }
+    try {
+        return await operation(controller.signal);
+    }
+    catch (error) {
+        if (timedOut) {
+            throw new Error(timeoutMessage);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+        externalSignal?.removeEventListener('abort', abortFromExternalSignal);
+    }
+}
+export function normalizeRecord(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return {};
+}
+//# sourceMappingURL=runtime-utils.js.map

package/dist/managed-runtime/runtime-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-utils.js","sourceRoot":"","sources":["../../src/managed-runtime/runtime-utils.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAA;AAItE,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,cAAsB,EACtB,SAA8C,EAC9C,cAA4B;IAE5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QACpC,QAAQ,GAAG,IAAI,CAAA;QACf,UAAU,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC,EAAE,SAAS,CAAC,CAAA;IACb,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;IAExD,IAAI,cAAc,EAAE,OAAO,EAAE,CAAC;QAC5B,UAAU,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;SAAM,CAAC;QACN,cAAc,EAAE,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,aAAa,CAAC,CAAA;QAC3B,cAAc,EAAE,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAA;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAgC,CAAA;IACzC,CAAC;IAED,OAAO,EAAE,CAAA;AACX,CAAC"}

package/dist/managed-runtime/shell-execution.d.ts

@@ -0,0 +1,33 @@
+import { type ControlSignal } from '@panorama/shared/control-signals';
+export type CommandExecutionResult = {
+    status: 'succeeded' | 'failed' | 'timed_out' | 'cancelled';
+    stdout: string;
+    stderr: string;
+    stdoutObservedBytes: number;
+    stderrObservedBytes: number;
+    stdoutCapturedBytes: number;
+    stderrCapturedBytes: number;
+    stdoutTruncated: boolean;
+    stderrTruncated: boolean;
+    outputCaptureBytes: number;
+    exitCode: number | null;
+    durationMs: number;
+    error: string | null;
+};
+export type ExecuteCommandOptions = {
+    registerCancellation?: (cancel: (() => void) | null) => void;
+    env?: NodeJS.ProcessEnv;
+    outputCaptureBytes?: number;
+};
+export declare function executeCommand(command: string, timeoutMs: number, options?: ExecuteCommandOptions): Promise<CommandExecutionResult>;
+export declare function buildManagedShellExecutionEnv(params: {
+    baseEnv: NodeJS.ProcessEnv;
+    agentId: string;
+    cycleId: string | null;
+    toolExecutionUrl: string;
+    toolExecutionToken: string;
+    controlSignalPath: string;
+}): NodeJS.ProcessEnv;
+export declare function buildControlSignalPath(executionId: string): string;
+export declare function readCommandControlSignal(path: string): Promise<ControlSignal | null>;
+//# sourceMappingURL=shell-execution.d.ts.map

package/dist/managed-runtime/shell-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-execution.d.ts","sourceRoot":"","sources":["../../src/managed-runtime/shell-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAYlG,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAA;IAC1D,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,eAAe,EAAE,OAAO,CAAA;IACxB,eAAe,EAAE,OAAO,CAAA;IACxB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,CAAA;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAmIjC;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC,UAAU,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gBAAgB,EAAE,MAAM,CAAA;IACxB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,MAAM,CAAC,UAAU,CAkCpB;AAED,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAa1F"}

package/dist/managed-runtime/shell-execution.js

@@ -0,0 +1,186 @@
+import { parseControlSignalCandidate } from '@panorama/shared/control-signals';
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { readFile, unlink } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { BoundedOutputCapture } from '../process-output-capture.js';
+const DEFAULT_SIGTERM_GRACE_MS = 5_000;
+const DEFAULT_OUTPUT_CAPTURE_BYTES = 5_000_000;
+const CONTROL_SIGNAL_PATH_ENV = 'PANORAMA_CONTROL_SIGNAL_PATH';
+export async function executeCommand(command, timeoutMs, options = {}) {
+    const startedAt = Date.now();
+    const outputCaptureBytes = options.outputCaptureBytes ?? DEFAULT_OUTPUT_CAPTURE_BYTES;
+    return await new Promise((resolve) => {
+        const child = spawn('bash', ['-lc', command], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: true,
+            env: options.env,
+        });
+        const stdoutOutput = new BoundedOutputCapture(outputCaptureBytes);
+        const stderrOutput = new BoundedOutputCapture(outputCaptureBytes);
+        let resolved = false;
+        let timedOut = false;
+        let spawnError = null;
+        let interrupted = false;
+        let forceKillHandle = null;
+        const finish = (result) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timeoutHandle);
+            if (forceKillHandle) {
+                clearTimeout(forceKillHandle);
+                forceKillHandle = null;
+            }
+            options.registerCancellation?.(null);
+            resolve(result);
+        };
+        const killProcessGroup = (signal) => {
+            if (!child.pid)
+                return;
+            try {
+                process.kill(-child.pid, signal);
+            }
+            catch {
+                try {
+                    child.kill(signal);
+                }
+                catch {
+                    // ignore best-effort kill failures
+                }
+            }
+        };
+        const scheduleForceKill = () => {
+            if (forceKillHandle)
+                return;
+            forceKillHandle = setTimeout(() => {
+                forceKillHandle = null;
+                killProcessGroup('SIGKILL');
+            }, DEFAULT_SIGTERM_GRACE_MS);
+            forceKillHandle.unref();
+        };
+        const timeoutHandle = setTimeout(() => {
+            if (resolved)
+                return;
+            timedOut = true;
+            killProcessGroup('SIGTERM');
+            scheduleForceKill();
+        }, timeoutMs);
+        options.registerCancellation?.(() => {
+            if (resolved || interrupted)
+                return;
+            interrupted = true;
+            killProcessGroup('SIGTERM');
+            scheduleForceKill();
+        });
+        child.stdout?.on('data', (chunk) => {
+            stdoutOutput.append(chunk);
+        });
+        child.stderr?.on('data', (chunk) => {
+            stderrOutput.append(chunk);
+        });
+        child.on('error', (error) => {
+            spawnError = error.message;
+        });
+        child.on('close', (code) => {
+            const stdout = stdoutOutput.readText();
+            const stderr = stderrOutput.readText();
+            const durationMs = Date.now() - startedAt;
+            const commonResult = {
+                stdout,
+                stderr,
+                stdoutObservedBytes: stdoutOutput.observedBytes,
+                stderrObservedBytes: stderrOutput.observedBytes,
+                stdoutCapturedBytes: stdoutOutput.capturedBytes,
+                stderrCapturedBytes: stderrOutput.capturedBytes,
+                stdoutTruncated: stdoutOutput.truncated,
+                stderrTruncated: stderrOutput.truncated,
+                outputCaptureBytes,
+                exitCode: code,
+                durationMs,
+            };
+            if (timedOut) {
+                finish({
+                    ...commonResult,
+                    status: 'timed_out',
+                    error: `Command timed out after ${timeoutMs}ms`,
+                });
+                return;
+            }
+            if (interrupted) {
+                finish({
+                    ...commonResult,
+                    status: 'cancelled',
+                    error: 'Command was interrupted because the managed gateway host was stopping.',
+                });
+                return;
+            }
+            if (spawnError) {
+                finish({
+                    ...commonResult,
+                    status: 'failed',
+                    error: spawnError,
+                });
+                return;
+            }
+            finish({
+                ...commonResult,
+                status: code === 0 ? 'succeeded' : 'failed',
+                error: code === 0 ? null : `Command exited with code ${code ?? 'unknown'}`,
+            });
+        });
+    });
+}
+export function buildManagedShellExecutionEnv(params) {
+    const safeEnv = {};
+    const passthroughKeys = [
+        'HOME',
+        'HOSTNAME',
+        'LANG',
+        'LC_ALL',
+        'LOGNAME',
+        'PATH',
+        'PWD',
+        'SHELL',
+        'SHLVL',
+        'TERM',
+        'TMPDIR',
+        'USER',
+    ];
+    for (const key of passthroughKeys) {
+        const value = params.baseEnv[key];
+        if (typeof value === 'string' && value.length > 0) {
+            safeEnv[key] = value;
+        }
+    }
+    safeEnv.PANORAMA_AGENT_ID = params.agentId;
+    safeEnv.PANORAMA_TOOL_EXECUTION_URL = params.toolExecutionUrl;
+    safeEnv.PANORAMA_TOOL_EXECUTION_TOKEN = params.toolExecutionToken;
+    safeEnv[CONTROL_SIGNAL_PATH_ENV] = params.controlSignalPath;
+    if (params.cycleId) {
+        safeEnv.PANORAMA_AGENT_CYCLE_ID = params.cycleId;
+    }
+    return safeEnv;
+}
+export function buildControlSignalPath(executionId) {
+    return join(tmpdir(), `panorama-control-${executionId}-${randomUUID()}.json`);
+}
+export async function readCommandControlSignal(path) {
+    try {
+        const raw = await readFile(path, 'utf8');
+        return parseControlSignalCandidate(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            await unlink(path);
+        }
+        catch {
+            // best-effort cleanup
+        }
+    }
+}
+//# sourceMappingURL=shell-execution.js.map

package/dist/managed-runtime/shell-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-execution.js","sourceRoot":"","sources":["../../src/managed-runtime/shell-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAsB,MAAM,kCAAkC,CAAA;AAClG,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAEnE,MAAM,wBAAwB,GAAG,KAAK,CAAA;AACtC,MAAM,4BAA4B,GAAG,SAAS,CAAA;AAC9C,MAAM,uBAAuB,GAAG,8BAA8B,CAAA;AAwB9D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,SAAiB,EACjB,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,4BAA4B,CAAA;IAErF,OAAO,MAAM,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;YAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,IAAI;YACd,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;QACjE,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,CAAA;QACjE,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,UAAU,GAAkB,IAAI,CAAA;QACpC,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,IAAI,eAAe,GAA0B,IAAI,CAAA;QAEjD,MAAM,MAAM,GAAG,CAAC,MAA8B,EAAE,EAAE;YAChD,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,YAAY,CAAC,aAAa,CAAC,CAAA;YAC3B,IAAI,eAAe,EAAE,CAAC;gBACpB,YAAY,CAAC,eAAe,CAAC,CAAA;gBAC7B,eAAe,GAAG,IAAI,CAAA;YACxB,CAAC;YACD,OAAO,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAA;QAED,MAAM,gBAAgB,GAAG,CAAC,MAAsB,EAAE,EAAE;YAClD,IAAI,CAAC,KAAK,CAAC,GAAG;gBAAE,OAAM;YACtB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC,CAAA;QAED,MAAM,iBAAiB,GAAG,GAAG,EAAE;YAC7B,IAAI,eAAe;gBAAE,OAAM;YAC3B,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,eAAe,GAAG,IAAI,CAAA;gBACtB,gBAAgB,CAAC,SAAS,CAAC,CAAA;YAC7B,CAAC,EAAE,wBAAwB,CAAC,CAAA;YAC5B,eAAe,CAAC,KAAK,EAAE,CAAA;QACzB,CAAC,CAAA;QAED,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,gBAAgB,CAAC,SAAS,CAAC,CAAA;YAC3B,iBAAiB,EAAE,CAAA;QACrB,CAAC,EAAE,SAAS,CAAC,CAAA;QAEb,OAAO,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE;YAClC,IAAI,QAAQ,IAAI,WAAW;gBAAE,OAAM;YACnC,WAAW,GAAG,IAAI,CAAA;YAClB,gBAAgB,CAAC,SAAS,CAAC,CAAA;YAC3B,iBAAiB,EAAE,CAAA;QACrB,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,UAAU,GAAG,KAAK,CAAC,OAAO,CAAA;QAC5B,CAAC,CAAC,CAAA;QAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAA;YACtC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAA;YACtC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;YACzC,MAAM,YAAY,GAAG;gBACnB,MAAM;gBACN,MAAM;gBACN,mBAAmB,EAAE,YAAY,CAAC,aAAa;gBAC/C,mBAAmB,EAAE,YAAY,CAAC,aAAa;gBAC/C,mBAAmB,EAAE,YAAY,CAAC,aAAa;gBAC/C,mBAAmB,EAAE,YAAY,CAAC,aAAa;gBAC/C,eAAe,EAAE,YAAY,CAAC,SAAS;gBACvC,eAAe,EAAE,YAAY,CAAC,SAAS;gBACvC,kBAAkB;gBAClB,QAAQ,EAAE,IAAI;gBACd,UAAU;aACX,CAAA;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC;oBACL,GAAG,YAAY;oBACf,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,2BAA2B,SAAS,IAAI;iBAChD,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,CAAC;oBACL,GAAG,YAAY;oBACf,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,wEAAwE;iBAChF,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC;oBACL,GAAG,YAAY;oBACf,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,UAAU;iBAClB,CAAC,CAAA;gBACF,OAAM;YACR,CAAC;YAED,MAAM,CAAC;gBACL,GAAG,YAAY;gBACf,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;gBAC3C,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B,IAAI,IAAI,SAAS,EAAE;aAC3E,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAO7C;IACC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,MAAM,eAAe,GAAG;QACtB,MAAM;QACN,UAAU;QACV,MAAM;QACN,QAAQ;QACR,SAAS;QACT,MAAM;QACN,KAAK;QACL,OAAO;QACP,OAAO;QACP,MAAM;QACN,QAAQ;QACR,MAAM;KACP,CAAA;IAED,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACtB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAA;IAC1C,OAAO,CAAC,2BAA2B,GAAG,MAAM,CAAC,gBAAgB,CAAA;IAC7D,OAAO,CAAC,6BAA6B,GAAG,MAAM,CAAC,kBAAkB,CAAA;IACjE,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAA;IAE3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,uBAAuB,GAAG,MAAM,CAAC,OAAO,CAAA;IAClD,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,WAAW,IAAI,UAAU,EAAE,OAAO,CAAC,CAAA;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC"}