@panorama-ai/gateway 2.30.211 → 2.30.279

package/dist/index.js

@@ -315,12 +315,12 @@ function isGatewayHealthCheckType(value) {
 // dist/index.js
 import dotenv from "dotenv";
 import { execFile as execFile6 } from "node:child_process";
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import fsSync9 from "node:fs";
 import fs6 from "node:fs/promises";
 import os8 from "node:os";
-import path16 from "node:path";
-import process18 from "node:process";
+import path20 from "node:path";
+import process19 from "node:process";
 import { promisify as promisify6 } from "node:util";
 
 // dist/cli-args.js
@@ -712,8 +712,8 @@ async function showGatewayLogsCommand(options, dependencies) {
     return;
   let position = 0;
   try {
-    const stat = await fs.stat(logPath);
-    position = stat.size;
+    const stat2 = await fs.stat(logPath);
+    position = stat2.size;
   } catch {
     position = 0;
   }
@@ -721,16 +721,16 @@ async function showGatewayLogsCommand(options, dependencies) {
     if (event !== "change")
       return;
     try {
-      const stat = await fs.stat(logPath);
-      if (stat.size < position) {
+      const stat2 = await fs.stat(logPath);
+      if (stat2.size < position) {
         position = 0;
       }
       const handle = await fs.open(logPath, "r");
-      const length = stat.size - position;
+      const length = stat2.size - position;
       if (length > 0) {
         const buffer = Buffer.alloc(length);
         await handle.read(buffer, 0, length, position);
-        position = stat.size;
+        position = stat2.size;
         process2.stdout.write(buffer.toString("utf-8"));
       }
       await handle.close();
@@ -1515,11 +1515,11 @@ function isNotFoundError(error) {
 async function ensureOwnerOnlyDirectory(dirPath) {
   if (shouldEnforceOwnerOnlyPermissions()) {
     await fs2.mkdir(dirPath, { recursive: true, mode: OWNER_ONLY_DIRECTORY_MODE });
-    const stat = await fs2.stat(dirPath);
-    if (!stat.isDirectory()) {
+    const stat2 = await fs2.stat(dirPath);
+    if (!stat2.isDirectory()) {
       throw new Error(`Expected directory at ${dirPath}`);
     }
-    if (normalizeMode(stat.mode) !== OWNER_ONLY_DIRECTORY_MODE) {
+    if (normalizeMode(stat2.mode) !== OWNER_ONLY_DIRECTORY_MODE) {
       await fs2.chmod(dirPath, OWNER_ONLY_DIRECTORY_MODE);
     }
     return;
@@ -1529,18 +1529,18 @@ async function ensureOwnerOnlyDirectory(dirPath) {
 async function ensureOwnerOnlyFile(filePath) {
   if (!shouldEnforceOwnerOnlyPermissions())
     return;
-  let stat;
+  let stat2;
   try {
-    stat = await fs2.stat(filePath);
+    stat2 = await fs2.stat(filePath);
   } catch (error) {
     if (isNotFoundError(error))
       return;
     throw error;
   }
-  if (!stat.isFile()) {
+  if (!stat2.isFile()) {
     throw new Error(`Expected regular file at ${filePath}`);
   }
-  if (normalizeMode(stat.mode) !== OWNER_ONLY_FILE_MODE) {
+  if (normalizeMode(stat2.mode) !== OWNER_ONLY_FILE_MODE) {
     await fs2.chmod(filePath, OWNER_ONLY_FILE_MODE);
   }
 }
@@ -2824,8 +2824,8 @@ function expandHomePath(value, homeDir = os4.homedir()) {
 function extractClaudeWrapperTarget(commandPath, options = {}) {
   const { homeDir, maxClaudeWrapperBytes } = resolveOptions(options);
   try {
-    const stat = fsSync4.statSync(commandPath);
-    if (!stat.isFile() || stat.size > maxClaudeWrapperBytes)
+    const stat2 = fsSync4.statSync(commandPath);
+    if (!stat2.isFile() || stat2.size > maxClaudeWrapperBytes)
       return null;
     const raw = fsSync4.readFileSync(commandPath, "utf8");
     const match = raw.match(/exec\s+(?:"([^"]+)"|'([^']+)'|([^\s]+))/);
@@ -2849,8 +2849,8 @@ function isBrokenClaudeWrapper(commandPath, options = {}) {
 }
 function isExecutableCandidate(candidate, platform = process.platform) {
   try {
-    const stat = fsSync4.statSync(candidate);
-    if (!stat.isFile())
+    const stat2 = fsSync4.statSync(candidate);
+    if (!stat2.isFile())
       return false;
     if (platform === "win32")
       return true;
@@ -9170,10 +9170,10 @@ function resolveGatewayRestartProbePath(entryPath, modulePath) {
 }
 function readRestartProbeFingerprint(filePath) {
   try {
-    const stat = fsSync8.statSync(filePath);
-    if (!stat.isFile())
+    const stat2 = fsSync8.statSync(filePath);
+    if (!stat2.isFile())
       return null;
-    return `${Math.round(stat.mtimeMs)}:${stat.size}`;
+    return `${Math.round(stat2.mtimeMs)}:${stat2.size}`;
   } catch {
     return null;
   }
@@ -9861,9 +9861,27 @@ function createGatewayRuntimeState() {
 }
 
 // dist/managed-runtime.js
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { mkdir as mkdir4 } from "node:fs/promises";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
+// ../shared/dist/drive-transfer-policy.js
+var DRIVE_TRANSFER_POLICY = {
+  inlineContentMaxBytes: 10 * 1024 * 1024,
+  objectFileMaxBytes: 1024 * 1024 * 1024,
+  directUploadThresholdBytes: 8 * 1024 * 1024,
+  localBatchMaxChanges: 1e3,
+  localBatchInlineUploadMaxBytes: 50 * 1024 * 1024,
+  localSyncBatchUploadMaxBytes: 1024 * 1024 * 1024,
+  signedRequestValidMs: 10 * 60 * 1e3,
+  preparedUploadExpiresMs: 60 * 60 * 1e3,
+  networkRequestTimeoutMs: 6e4,
+  multipartUploadThresholdBytes: null
+};
+function getDriveLocalSyncFileTooLargeMessage(sizeBytes) {
+  return `Local drive sync file upload size ${sizeBytes} exceeds the ${DRIVE_TRANSFER_POLICY.objectFileMaxBytes} byte limit`;
+}
+
 // ../shared/dist/linux-host-control/contract.js
 var LINUX_HOST_CONTROL_ENDPOINT_PATH = "/functions/v1/linux-host-control";
 function buildLinuxHostControlUrl(baseUrl) {
@@ -9887,6 +9905,14 @@ var DEFAULT_EXEC_TIMEOUT_MS = 3e5;
 var DEFAULT_HEARTBEAT_INTERVAL_MS2 = 15e3;
 var DEFAULT_MAX_CONSECUTIVE_HEARTBEAT_FAILURES = 3;
 var DEFAULT_OUTPUT_CAPTURE_BYTES = 5e6;
+var DEFAULT_DRIVE_SYNC_ROOT = "/panorama/drives";
+var DEFAULT_DRIVE_SYNC_STATE_DIR = "/var/lib/panorama/drive-sync";
+var DEFAULT_DRIVE_SYNC_CHANGE_LIMIT = 50;
+var DEFAULT_DRIVE_SYNC_MAX_BATCHES_PER_TICK = 25;
+var DEFAULT_DRIVE_SYNC_DEBOUNCE_MS = 1e3;
+var DEFAULT_DRIVE_SYNC_POLL_INTERVAL_MS = 5e3;
+var DEFAULT_DRIVE_SYNC_LOCAL_AUDIT_INTERVAL_MS = 3e5;
+var DEFAULT_DRIVE_SYNC_NETWORK_TIMEOUT_MS = DRIVE_TRANSFER_POLICY.networkRequestTimeoutMs;
 function requireEnv(name, env = process16.env) {
   const value = env[name]?.trim();
   if (!value) {
@@ -9904,6 +9930,16 @@ function readPositiveInt(name, fallback, env = process16.env) {
   }
   return Math.floor(parsed);
 }
+function readBoolean(name, fallback, env = process16.env) {
+  const raw = env[name]?.trim().toLowerCase();
+  if (!raw)
+    return fallback;
+  if (["1", "true", "yes", "on"].includes(raw))
+    return true;
+  if (["0", "false", "no", "off"].includes(raw))
+    return false;
+  throw new Error(`${name} must be a boolean`);
+}
 function requirePositiveInt(name, env = process16.env) {
   const raw = requireEnv(name, env);
   const parsed = Number(raw);
@@ -9948,7 +9984,19 @@ function resolveManagedGatewayRuntimeConfig(env = process16.env) {
     execTimeoutMs: readPositiveInt("PANORAMA_AGENT_EXEC_TIMEOUT_MS", DEFAULT_EXEC_TIMEOUT_MS, env),
     outputCaptureBytes: readPositiveInt("PANORAMA_MANAGED_RUNTIME_OUTPUT_CAPTURE_BYTES", DEFAULT_OUTPUT_CAPTURE_BYTES, env),
     heartbeatIntervalMs: readPositiveInt("PANORAMA_MANAGED_RUNTIME_HEARTBEAT_INTERVAL_MS", DEFAULT_HEARTBEAT_INTERVAL_MS2, env),
-    maxConsecutiveHeartbeatFailures: readPositiveInt("PANORAMA_MANAGED_RUNTIME_MAX_CONSECUTIVE_HEARTBEAT_FAILURES", DEFAULT_MAX_CONSECUTIVE_HEARTBEAT_FAILURES, env)
+    maxConsecutiveHeartbeatFailures: readPositiveInt("PANORAMA_MANAGED_RUNTIME_MAX_CONSECUTIVE_HEARTBEAT_FAILURES", DEFAULT_MAX_CONSECUTIVE_HEARTBEAT_FAILURES, env),
+    driveSync: {
+      enabled: readBoolean("PANORAMA_DRIVE_SYNC_ENABLED", false, env),
+      rootDir: env.PANORAMA_DRIVE_SYNC_ROOT?.trim() || DEFAULT_DRIVE_SYNC_ROOT,
+      stateDir: env.PANORAMA_DRIVE_SYNC_STATE_DIR?.trim() || DEFAULT_DRIVE_SYNC_STATE_DIR,
+      clientKey: env.PANORAMA_DRIVE_SYNC_CLIENT_KEY?.trim() || null,
+      changeLimit: readPositiveInt("PANORAMA_DRIVE_SYNC_CHANGE_LIMIT", DEFAULT_DRIVE_SYNC_CHANGE_LIMIT, env),
+      maxBatchesPerTick: readPositiveInt("PANORAMA_DRIVE_SYNC_MAX_BATCHES_PER_TICK", DEFAULT_DRIVE_SYNC_MAX_BATCHES_PER_TICK, env),
+      debounceMs: readPositiveInt("PANORAMA_DRIVE_SYNC_DEBOUNCE_MS", DEFAULT_DRIVE_SYNC_DEBOUNCE_MS, env),
+      pollIntervalMs: readPositiveInt("PANORAMA_DRIVE_SYNC_POLL_INTERVAL_MS", DEFAULT_DRIVE_SYNC_POLL_INTERVAL_MS, env),
+      localAuditIntervalMs: readPositiveInt("PANORAMA_DRIVE_SYNC_LOCAL_AUDIT_INTERVAL_MS", DEFAULT_DRIVE_SYNC_LOCAL_AUDIT_INTERVAL_MS, env),
+      networkTimeoutMs: readPositiveInt("PANORAMA_DRIVE_SYNC_NETWORK_TIMEOUT_MS", DEFAULT_DRIVE_SYNC_NETWORK_TIMEOUT_MS, env)
+    }
   };
 }
 
@@ -10353,212 +10401,2977 @@ function startManagedRealtimeWakeLoop(params) {
   };
 }
 
-// ../shared/dist/control-signals.js
-var CONTROL_ACTIONS = /* @__PURE__ */ new Set(["continue", "pause", "stop"]);
-function parseControlSignalCandidate(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return null;
+// dist/managed-runtime/drive-sync.js
+import { createHash as createHash3, randomUUID as randomUUID6 } from "node:crypto";
+import { mkdir as mkdir3, rename as rename3, rm as rm2 } from "node:fs/promises";
+import { hostname as hostname2 } from "node:os";
+import path18 from "node:path";
+import process17 from "node:process";
+
+// dist/managed-runtime/drive-sync-filesystem.js
+import { createHash, randomUUID as randomUUID4 } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { copyFile, lstat, mkdir, readdir, readlink, rename, stat } from "node:fs/promises";
+import path16 from "node:path";
+var DRIVE_SYNC_MAX_LOCAL_FILE_BYTES = DRIVE_TRANSFER_POLICY.objectFileMaxBytes;
+var UnstableLocalFileError = class extends Error {
+  drivePath;
+  constructor(drivePath) {
+    super(`Local drive file changed while it was being read; deferring sync for ${drivePath}`);
+    this.drivePath = drivePath;
+    this.name = "UnstableLocalFileError";
   }
-  const rawNextAction = value.nextAction;
-  if (typeof rawNextAction !== "string" || !CONTROL_ACTIONS.has(rawNextAction)) {
+};
+function resolveDriveLocalRoot(rootDir, driveId) {
+  if (!/^[0-9a-f-]{36}$/i.test(driveId)) {
+    throw new Error(`Invalid drive id "${driveId}"`);
+  }
+  return path16.join(rootDir, driveId);
+}
+async function parkStaleDriveLocalFolder(rootDir, driveId) {
+  const sourcePath = resolveDriveLocalRoot(rootDir, driveId);
+  try {
+    await lstat(sourcePath);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+  const staleRoot = path16.join(path16.resolve(rootDir), ".stale");
+  await mkdir(staleRoot, { recursive: true });
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const targetPath = path16.join(staleRoot, `${driveId}-${timestamp}-${randomUUID4()}`);
+  await rename(sourcePath, targetPath);
+  return targetPath;
+}
+function resolveDriveLocalPath(driveRoot, drivePath) {
+  const normalizedDrivePath = normalizeDrivePath(drivePath);
+  const resolvedRoot = path16.resolve(driveRoot);
+  if (normalizedDrivePath === "/") {
+    return resolvedRoot;
+  }
+  const resolvedPath = path16.resolve(resolvedRoot, normalizedDrivePath.slice(1));
+  if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(`${resolvedRoot}${path16.sep}`)) {
+    throw new Error(`Drive path escapes drive root: ${drivePath}`);
+  }
+  return resolvedPath;
+}
+function resolveDirtyDrivePathsForDrive(driveRoot, dirtyLocalPaths) {
+  if (!dirtyLocalPaths) {
     return null;
   }
-  const pauseDurationValue = value.pauseDuration ?? value.seconds;
-  const pauseDuration = typeof pauseDurationValue === "number" && Number.isFinite(pauseDurationValue) && pauseDurationValue > 0 ? pauseDurationValue : void 0;
-  return {
-    nextAction: rawNextAction,
-    pauseDuration
-  };
+  const resolvedRoot = path16.resolve(driveRoot);
+  const dirtyDrivePaths = /* @__PURE__ */ new Set();
+  for (const dirtyLocalPath of dirtyLocalPaths) {
+    const resolvedDirtyPath = path16.resolve(dirtyLocalPath);
+    const relativePath = path16.relative(resolvedRoot, resolvedDirtyPath);
+    if (!relativePath) {
+      return null;
+    }
+    if (relativePath.startsWith("..") || path16.isAbsolute(relativePath)) {
+      continue;
+    }
+    dirtyDrivePaths.add(normalizeDrivePath(`/${relativePath.split(path16.sep).join("/")}`));
+  }
+  return dirtyDrivePaths;
 }
-
-// dist/managed-runtime/shell-execution.js
-import { spawn as spawn4 } from "node:child_process";
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { readFile, unlink } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-var DEFAULT_SIGTERM_GRACE_MS = 5e3;
-var DEFAULT_OUTPUT_CAPTURE_BYTES2 = 5e6;
-var CONTROL_SIGNAL_PATH_ENV = "PANORAMA_CONTROL_SIGNAL_PATH";
-async function executeCommand(command, timeoutMs, options = {}) {
-  const startedAt = Date.now();
-  const outputCaptureBytes = options.outputCaptureBytes ?? DEFAULT_OUTPUT_CAPTURE_BYTES2;
-  return await new Promise((resolve) => {
-    const child = spawn4("bash", ["-lc", command], {
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: true,
-      env: options.env
+async function readLocalDriveEntryAtPath(params) {
+  const absolutePath = resolveDriveLocalPath(params.driveRoot, params.drivePath);
+  let localStat;
+  try {
+    localStat = await lstat(absolutePath);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+  if (localStat.isDirectory()) {
+    return {
+      driveId: params.driveId,
+      path: normalizeDrivePath(params.drivePath),
+      entryType: "directory",
+      contentSha256: null,
+      sizeBytes: null,
+      mimeType: null,
+      absolutePath
+    };
+  }
+  if (localStat.isFile()) {
+    return await readStableLocalFileEntry({
+      driveId: params.driveId,
+      drivePath: normalizeDrivePath(params.drivePath),
+      absolutePath,
+      initialStat: localStat
     });
-    const stdoutOutput = new BoundedOutputCapture(outputCaptureBytes);
-    const stderrOutput = new BoundedOutputCapture(outputCaptureBytes);
-    let resolved = false;
-    let timedOut = false;
-    let spawnError = null;
-    let interrupted = false;
-    let forceKillHandle = null;
-    const finish = (result) => {
-      if (resolved)
-        return;
-      resolved = true;
-      clearTimeout(timeoutHandle);
-      if (forceKillHandle) {
-        clearTimeout(forceKillHandle);
-        forceKillHandle = null;
-      }
-      options.registerCancellation?.(null);
-      resolve(result);
+  }
+  if (localStat.isSymbolicLink()) {
+    const linkTarget = await readlink(absolutePath).catch(() => "");
+    return {
+      driveId: params.driveId,
+      path: normalizeDrivePath(params.drivePath),
+      entryType: "symlink",
+      contentSha256: sha256Hex2(Buffer.from(linkTarget)),
+      sizeBytes: Buffer.byteLength(linkTarget),
+      mimeType: null,
+      absolutePath,
+      unsupportedReason: "symlink_entry_unsupported"
     };
-    const killProcessGroup = (signal) => {
-      if (!child.pid)
-        return;
+  }
+  return {
+    driveId: params.driveId,
+    path: normalizeDrivePath(params.drivePath),
+    entryType: "unsupported",
+    contentSha256: null,
+    sizeBytes: null,
+    mimeType: null,
+    absolutePath,
+    unsupportedReason: describeUnsupportedLocalEntry(localStat)
+  };
+}
+async function scanLocalDriveEntries(params) {
+  const entries = /* @__PURE__ */ new Map();
+  const deferredPaths = /* @__PURE__ */ new Set();
+  const visitedDirectories = /* @__PURE__ */ new Set();
+  let deferredFileCount = 0;
+  async function addAncestorDirectories(drivePath) {
+    const normalizedPath = normalizeDrivePath(drivePath);
+    const segments = normalizedPath.split("/").filter(Boolean);
+    for (let index = 1; index < segments.length; index += 1) {
+      const ancestorPath = normalizeDrivePath(`/${segments.slice(0, index).join("/")}`);
+      if (entries.has(ancestorPath)) {
+        continue;
+      }
+      const absolutePath = resolveDriveLocalPath(params.driveRoot, ancestorPath);
       try {
-        process.kill(-child.pid, signal);
-      } catch {
-        try {
-          child.kill(signal);
-        } catch {
+        const ancestorStat = await lstat(absolutePath);
+        if (ancestorStat.isDirectory()) {
+          entries.set(ancestorPath, {
+            driveId: params.driveId,
+            path: ancestorPath,
+            entryType: "directory",
+            contentSha256: null,
+            sizeBytes: null,
+            mimeType: null,
+            absolutePath
+          });
         }
+      } catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+          return;
+        }
+        throw error;
       }
-    };
-    const scheduleForceKill = () => {
-      if (forceKillHandle)
-        return;
-      forceKillHandle = setTimeout(() => {
-        forceKillHandle = null;
-        killProcessGroup("SIGKILL");
-      }, DEFAULT_SIGTERM_GRACE_MS);
-      forceKillHandle.unref();
-    };
-    const timeoutHandle = setTimeout(() => {
-      if (resolved)
-        return;
-      timedOut = true;
-      killProcessGroup("SIGTERM");
-      scheduleForceKill();
-    }, timeoutMs);
-    options.registerCancellation?.(() => {
-      if (resolved || interrupted)
-        return;
-      interrupted = true;
-      killProcessGroup("SIGTERM");
-      scheduleForceKill();
-    });
-    child.stdout?.on("data", (chunk) => {
-      stdoutOutput.append(chunk);
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderrOutput.append(chunk);
-    });
-    child.on("error", (error) => {
-      spawnError = error.message;
-    });
-    child.on("close", (code) => {
-      const stdout = stdoutOutput.readText();
-      const stderr = stderrOutput.readText();
-      const durationMs = Date.now() - startedAt;
-      const commonResult = {
-        stdout,
-        stderr,
-        stdoutObservedBytes: stdoutOutput.observedBytes,
-        stderrObservedBytes: stderrOutput.observedBytes,
-        stdoutCapturedBytes: stdoutOutput.capturedBytes,
-        stderrCapturedBytes: stderrOutput.capturedBytes,
-        stdoutTruncated: stdoutOutput.truncated,
-        stderrTruncated: stderrOutput.truncated,
-        outputCaptureBytes,
-        exitCode: code,
-        durationMs
-      };
-      if (timedOut) {
-        finish({
-          ...commonResult,
-          status: "timed_out",
-          error: `Command timed out after ${timeoutMs}ms`
-        });
-        return;
-      }
-      if (interrupted) {
-        finish({
-          ...commonResult,
-          status: "cancelled",
-          error: "Command was interrupted because the managed gateway host was stopping."
-        });
-        return;
-      }
-      if (spawnError) {
-        finish({
-          ...commonResult,
-          status: "failed",
-          error: spawnError
-        });
-        return;
+    }
+  }
+  async function addPathEntry(absolutePath, drivePath, childStat) {
+    await addAncestorDirectories(drivePath);
+    if (childStat.isDirectory()) {
+      entries.set(drivePath, {
+        driveId: params.driveId,
+        path: drivePath,
+        entryType: "directory",
+        contentSha256: null,
+        sizeBytes: null,
+        mimeType: null,
+        absolutePath
+      });
+      await visitDirectory(absolutePath, drivePath);
+      return;
+    }
+    if (childStat.isFile()) {
+      try {
+        entries.set(drivePath, await readStableLocalFileEntry({
+          driveId: params.driveId,
+          drivePath,
+          absolutePath,
+          initialStat: childStat
+        }));
+      } catch (error) {
+        if (error instanceof UnstableLocalFileError) {
+          deferredPaths.add(drivePath);
+          deferredFileCount += 1;
+          return;
+        }
+        throw error;
       }
-      finish({
-        ...commonResult,
-        status: code === 0 ? "succeeded" : "failed",
-        error: code === 0 ? null : `Command exited with code ${code ?? "unknown"}`
+      return;
+    }
+    if (childStat.isSymbolicLink()) {
+      const linkTarget = await readlink(absolutePath).catch(() => "");
+      entries.set(drivePath, {
+        driveId: params.driveId,
+        path: drivePath,
+        entryType: "symlink",
+        contentSha256: sha256Hex2(Buffer.from(linkTarget)),
+        sizeBytes: Buffer.byteLength(linkTarget),
+        mimeType: null,
+        absolutePath,
+        unsupportedReason: "symlink_entry_unsupported"
       });
+      return;
+    }
+    entries.set(drivePath, {
+      driveId: params.driveId,
+      path: drivePath,
+      entryType: "unsupported",
+      contentSha256: null,
+      sizeBytes: null,
+      mimeType: null,
+      absolutePath,
+      unsupportedReason: describeUnsupportedLocalEntry(childStat)
     });
-  });
-}
-function buildManagedShellExecutionEnv(params) {
-  const safeEnv = {};
-  const passthroughKeys = [
-    "HOME",
-    "HOSTNAME",
-    "LANG",
-    "LC_ALL",
-    "LOGNAME",
-    "PATH",
-    "PWD",
-    "SHELL",
-    "SHLVL",
-    "TERM",
-    "TMPDIR",
-    "USER"
-  ];
-  for (const key of passthroughKeys) {
-    const value = params.baseEnv[key];
-    if (typeof value === "string" && value.length > 0) {
-      safeEnv[key] = value;
+  }
+  async function visitDirectory(absoluteDirectoryPath, driveDirectoryPath) {
+    const resolvedDirectoryPath = path16.resolve(absoluteDirectoryPath);
+    if (visitedDirectories.has(resolvedDirectoryPath)) {
+      return;
+    }
+    visitedDirectories.add(resolvedDirectoryPath);
+    const children = await readdir(absoluteDirectoryPath, { withFileTypes: true });
+    for (const child of children) {
+      const childAbsolutePath = path16.join(absoluteDirectoryPath, child.name);
+      const childDrivePath = normalizeDrivePath(driveDirectoryPath === "/" ? `/${child.name}` : `${driveDirectoryPath}/${child.name}`);
+      let childStat;
+      try {
+        childStat = await lstat(childAbsolutePath);
+      } catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+          continue;
+        }
+        throw error;
+      }
+      await addPathEntry(childAbsolutePath, childDrivePath, childStat);
     }
   }
-  safeEnv.PANORAMA_AGENT_ID = params.agentId;
-  safeEnv.PANORAMA_TOOL_EXECUTION_URL = params.toolExecutionUrl;
-  safeEnv.PANORAMA_TOOL_EXECUTION_TOKEN = params.toolExecutionToken;
-  safeEnv[CONTROL_SIGNAL_PATH_ENV] = params.controlSignalPath;
-  if (params.cycleId) {
-    safeEnv.PANORAMA_AGENT_CYCLE_ID = params.cycleId;
+  const rootDrivePaths = params.rootDrivePaths;
+  if (!rootDrivePaths) {
+    await visitDirectory(path16.resolve(params.driveRoot), "/");
+    return { entries, deferredPaths, deferredFileCount };
   }
-  return safeEnv;
-}
-function buildControlSignalPath(executionId) {
-  return join(tmpdir(), `panorama-control-${executionId}-${randomUUID4()}.json`);
-}
-async function readCommandControlSignal(path17) {
-  try {
-    const raw = await readFile(path17, "utf8");
-    return parseControlSignalCandidate(JSON.parse(raw));
-  } catch {
-    return null;
-  } finally {
+  for (const dirtyPath of rootDrivePaths) {
+    const normalizedDirtyPath = normalizeDrivePath(dirtyPath);
+    if (normalizedDirtyPath === "/") {
+      await visitDirectory(path16.resolve(params.driveRoot), "/");
+      return { entries, deferredPaths, deferredFileCount };
+    }
+    const absolutePath = resolveDriveLocalPath(params.driveRoot, normalizedDirtyPath);
     try {
-      await unlink(path17);
-    } catch {
+      const childStat = await lstat(absolutePath);
+      await addPathEntry(absolutePath, normalizedDirtyPath, childStat);
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        await addAncestorDirectories(normalizedDirtyPath);
+        continue;
+      }
+      throw error;
     }
   }
+  return { entries, deferredPaths, deferredFileCount };
 }
-
-// dist/managed-runtime/dependencies.js
-var defaultManagedGatewayRuntimeDependencies = {
-  heartbeatLinuxHost,
-  dispatchLinuxExecution,
-  startLinuxExecution,
+async function writeLocalConflictCopy(params) {
+  if (params.source.entryType !== "file") {
+    throw new Error(`Cannot preserve non-file local conflict candidate: ${params.source.path}`);
+  }
+  const conflictDrivePath = await resolveAvailableConflictDrivePath({
+    driveRoot: params.driveRoot,
+    sourcePath: params.source.path,
+    sourceRootPath: params.sourceRootPath,
+    conflictRootPath: params.conflictRootPath
+  });
+  const conflictLocalPath = resolveDriveLocalPath(params.driveRoot, conflictDrivePath);
+  await assertNoSymlinkInExistingPath(params.driveRoot, path16.dirname(conflictLocalPath));
+  await mkdir(path16.dirname(conflictLocalPath), { recursive: true });
+  await copyFile(params.source.absolutePath, conflictLocalPath);
+  return conflictDrivePath;
+}
+async function resolveAvailableConflictDrivePath(params) {
+  const parsed = path16.posix.parse(normalizeDrivePath(params.sourcePath));
+  const conflictRoot = normalizeDrivePath(params.conflictRootPath);
+  const sourceRoot = normalizeDrivePath(params.sourceRootPath);
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+  const baseName = `${parsed.name} (Panorama conflict ${timestamp})`;
+  const targetDirectory = sourceRoot === params.sourcePath ? parsed.dir || "/" : path16.posix.join(conflictRoot, path16.posix.relative(sourceRoot, parsed.dir || "/"));
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    const suffix = attempt === 0 ? "" : ` ${attempt + 1}`;
+    const candidate = normalizeDrivePath(path16.posix.join(targetDirectory, `${baseName}${suffix}${parsed.ext}`));
+    try {
+      await lstat(resolveDriveLocalPath(params.driveRoot, candidate));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        return candidate;
+      }
+      throw error;
+    }
+  }
+  throw new Error(`Could not allocate a local conflict path for ${params.sourcePath}`);
+}
+function buildSubtreeConflictRootPath(deletedSubtreePath) {
+  const parsed = path16.posix.parse(normalizeDrivePath(deletedSubtreePath));
+  return normalizeDrivePath(path16.posix.join(parsed.dir || "/", `${parsed.base} (Panorama conflicts)`));
+}
+async function assertPathExists(filePath, errorMessage) {
+  try {
+    await stat(filePath);
+  } catch {
+    throw new Error(errorMessage);
+  }
+}
+async function assertLocalPathIsNotSymlink(filePath, errorMessage) {
+  try {
+    const current = await lstat(filePath);
+    if (current.isSymbolicLink()) {
+      throw new Error(errorMessage);
+    }
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+}
+async function assertNoSymlinkInExistingPath(driveRoot, targetPath) {
+  const resolvedRoot = path16.resolve(driveRoot);
+  const resolvedTarget = path16.resolve(targetPath);
+  const relativePath = path16.relative(resolvedRoot, resolvedTarget);
+  if (relativePath.startsWith("..") || path16.isAbsolute(relativePath)) {
+    throw new Error(`Local drive path escapes drive root: ${targetPath}`);
+  }
+  if (!relativePath) {
+    return;
+  }
+  let currentPath = resolvedRoot;
+  for (const segment of relativePath.split(path16.sep).filter(Boolean)) {
+    currentPath = path16.join(currentPath, segment);
+    try {
+      const current = await lstat(currentPath);
+      if (current.isSymbolicLink()) {
+        throw new Error(`Local drive path contains a symlink: ${currentPath}`);
+      }
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        return;
+      }
+      throw error;
+    }
+  }
+}
+function normalizeDrivePath(input) {
+  if (!input.startsWith("/")) {
+    throw new Error(`Drive path must be absolute: ${input}`);
+  }
+  const segments = input.split("/").filter(Boolean);
+  if (segments.some((segment) => segment === "." || segment === "..")) {
+    throw new Error(`Drive path must not contain traversal segments: ${input}`);
+  }
+  return input === "/" ? "/" : `/${segments.join("/")}`;
+}
+async function readStableLocalFileEntry(params) {
+  const initialSizeBytes = Number(params.initialStat.size);
+  const initialMtimeMs = Number(params.initialStat.mtimeMs);
+  const initialCtimeMs = Number(params.initialStat.ctimeMs);
+  if (initialSizeBytes > DRIVE_SYNC_MAX_LOCAL_FILE_BYTES) {
+    return {
+      driveId: params.driveId,
+      path: params.drivePath,
+      entryType: "unsupported",
+      contentSha256: null,
+      sizeBytes: initialSizeBytes,
+      mimeType: null,
+      absolutePath: params.absolutePath,
+      mtimeMs: initialMtimeMs,
+      ctimeMs: initialCtimeMs,
+      unsupportedReason: `file_size_${initialSizeBytes}_exceeds_${DRIVE_SYNC_MAX_LOCAL_FILE_BYTES}_byte_limit`
+    };
+  }
+  const contentSha256 = await sha256File(params.absolutePath);
+  const finalStat = await lstat(params.absolutePath);
+  if (!finalStat.isFile() || Number(finalStat.size) !== initialSizeBytes || Number(finalStat.mtimeMs) !== initialMtimeMs || Number(finalStat.ctimeMs) !== initialCtimeMs) {
+    throw new UnstableLocalFileError(params.drivePath);
+  }
+  return {
+    driveId: params.driveId,
+    path: params.drivePath,
+    entryType: "file",
+    contentSha256,
+    sizeBytes: Number(finalStat.size),
+    mimeType: null,
+    absolutePath: params.absolutePath,
+    mtimeMs: Number(finalStat.mtimeMs),
+    ctimeMs: Number(finalStat.ctimeMs)
+  };
+}
+async function sha256File(filePath) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(filePath)) {
+    hash.update(chunk);
+  }
+  return hash.digest("hex");
+}
+function describeUnsupportedLocalEntry(entry) {
+  if (entry.isBlockDevice())
+    return "block_device_unsupported";
+  if (entry.isCharacterDevice())
+    return "character_device_unsupported";
+  if (entry.isFIFO())
+    return "fifo_unsupported";
+  if (entry.isSocket())
+    return "socket_unsupported";
+  return "unsupported_entry_type";
+}
+function sha256Hex2(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+// dist/managed-runtime/drive-sync-planner.js
+function planLocalDriveSync(params) {
+  const conflictPlan = planLocalConflictActions(params);
+  return {
+    mutations: buildLocalDriveMutationsFromPlanState({
+      ...params,
+      conflicts: conflictPlan.effectiveConflicts
+    }),
+    conflictActions: conflictPlan.actions
+  };
+}
+function buildLocalDriveMutationsFromPlanState(params) {
+  const mutations = [];
+  const deletedDirectoryPaths = /* @__PURE__ */ new Set();
+  const { moveByNewPath, movedBaselinePaths } = detectLocalFileMoves(params);
+  const absentDeletedDirectoryRoots = /* @__PURE__ */ new Set();
+  const localPaths = [...params.local.keys()].sort(compareDrivePathsForCreate);
+  for (const drivePath of localPaths) {
+    const localEntry = params.local.get(drivePath);
+    const baselineEntry = params.baseline.get(drivePath) ?? null;
+    const conflict = params.conflicts.get(drivePath) ?? null;
+    if (baselineEntry && localEntryMatchesBaseline(localEntry, baselineEntry)) {
+      continue;
+    }
+    if (conflict && localEntryMatchesConflict(localEntry, conflict)) {
+      continue;
+    }
+    const movedFromEntry = moveByNewPath.get(drivePath) ?? null;
+    if (!baselineEntry && movedFromEntry) {
+      mutations.push(buildMoveMutation(movedFromEntry, localEntry));
+      continue;
+    }
+    if (baselineEntry && baselineEntry.entryType !== localEntry.entryType) {
+      mutations.push(buildDeleteMutation(baselineEntry));
+      if (baselineEntry.entryType === "directory") {
+        deletedDirectoryPaths.add(baselineEntry.path);
+      }
+    }
+    mutations.push(buildUpsertMutation(localEntry, baselineEntry));
+  }
+  for (const [drivePath, baselineEntry] of [...params.baseline].sort(([left], [right]) => compareDrivePathsForCreate(left, right))) {
+    if (baselineEntry.entryType !== "directory") {
+      continue;
+    }
+    if (params.local.has(drivePath)) {
+      continue;
+    }
+    if (params.deferredPaths.has(drivePath)) {
+      continue;
+    }
+    if (params.conflicts.has(drivePath)) {
+      continue;
+    }
+    if (hasConflictInSubtree(drivePath, params.conflicts)) {
+      continue;
+    }
+    if (movedBaselinePaths.has(drivePath)) {
+      continue;
+    }
+    if (hasDeletedAncestor(drivePath, absentDeletedDirectoryRoots)) {
+      continue;
+    }
+    absentDeletedDirectoryRoots.add(drivePath);
+  }
+  const baselinePaths = [...params.baseline.keys()].sort(compareDrivePathsForDelete);
+  for (const drivePath of baselinePaths) {
+    if (params.local.has(drivePath)) {
+      continue;
+    }
+    if (params.deferredPaths.has(drivePath)) {
+      continue;
+    }
+    if (params.conflicts.has(drivePath)) {
+      continue;
+    }
+    if (movedBaselinePaths.has(drivePath)) {
+      continue;
+    }
+    if (hasDeletedAncestor(drivePath, absentDeletedDirectoryRoots)) {
+      continue;
+    }
+    if (hasDeletedAncestor(drivePath, deletedDirectoryPaths)) {
+      continue;
+    }
+    const baselineEntry = params.baseline.get(drivePath);
+    if (baselineEntry.entryType === "directory" && hasConflictInSubtree(drivePath, params.conflicts)) {
+      continue;
+    }
+    mutations.push(buildDeleteMutation(baselineEntry));
+    if (baselineEntry.entryType === "directory") {
+      deletedDirectoryPaths.add(baselineEntry.path);
+    }
+  }
+  return mutations;
+}
+function planLocalConflictActions(params) {
+  const actions = [];
+  const effectiveConflicts = new Map(params.conflicts);
+  for (const conflict of [...params.conflicts.values()].sort((left, right) => left.path.localeCompare(right.path))) {
+    const baselineEntry = params.baseline.get(conflict.path) ?? null;
+    const canonicalEntry = params.local.get(conflict.path) ?? null;
+    const candidateEntry = conflict.conflictPath ? params.local.get(conflict.conflictPath) ?? null : null;
+    const canonicalMatchesSynced = baselineEntry !== null && canonicalEntry !== null && localEntryMatchesBaseline(canonicalEntry, baselineEntry);
+    if (canonicalMatchesSynced && candidateEntry !== null && conflict.conflictPath) {
+      const candidateBaselineEntry = params.baseline.get(conflict.conflictPath) ?? null;
+      if (candidateBaselineEntry !== null && localEntryMatchesBaseline(candidateEntry, candidateBaselineEntry)) {
+        actions.push({
+          type: "clear_conflict",
+          driveId: conflict.driveId,
+          path: conflict.path,
+          reason: "candidate_preserved"
+        });
+        effectiveConflicts.delete(conflict.path);
+        continue;
+      }
+    }
+    if (candidateEntry !== null) {
+      continue;
+    }
+    const movedCandidatePath = canonicalMatchesSynced ? findUniqueMovedConflictCandidatePath(params, conflict) : null;
+    if (movedCandidatePath) {
+      actions.push({
+        type: "update_conflict_path",
+        driveId: conflict.driveId,
+        path: conflict.path,
+        conflictPath: movedCandidatePath,
+        reason: "candidate_moved"
+      });
+      effectiveConflicts.set(conflict.path, {
+        ...conflict,
+        conflictPath: movedCandidatePath
+      });
+      continue;
+    }
+    if (canonicalMatchesSynced || baselineEntry === null && canonicalEntry === null) {
+      actions.push({
+        type: "clear_conflict",
+        driveId: conflict.driveId,
+        path: conflict.path,
+        reason: "candidate_removed"
+      });
+      effectiveConflicts.delete(conflict.path);
+    }
+  }
+  return { actions, effectiveConflicts };
+}
+function findUniqueMovedConflictCandidatePath(params, conflict) {
+  const key = conflictCandidateMoveKey(conflict);
+  if (!key) {
+    return null;
+  }
+  let matchedPath = null;
+  for (const [drivePath, localEntry] of params.local) {
+    if (drivePath === conflict.path || drivePath === conflict.conflictPath) {
+      continue;
+    }
+    if (params.baseline.has(drivePath) || params.conflicts.has(drivePath)) {
+      continue;
+    }
+    if (localFileMoveKey(localEntry) !== key) {
+      continue;
+    }
+    if (matchedPath !== null) {
+      return null;
+    }
+    matchedPath = drivePath;
+  }
+  return matchedPath;
+}
+function conflictCandidateMoveKey(conflict) {
+  if (!conflict.localContentSha256 || conflict.localSizeBytes === null) {
+    return null;
+  }
+  return `${conflict.localContentSha256}:${conflict.localSizeBytes}`;
+}
+function detectLocalFileMoves(params) {
+  const deletedBaselineByKey = /* @__PURE__ */ new Map();
+  const newLocalByKey = /* @__PURE__ */ new Map();
+  for (const [drivePath, baselineEntry] of params.baseline) {
+    if (params.local.has(drivePath) || params.deferredPaths.has(drivePath) || params.conflicts.has(drivePath)) {
+      continue;
+    }
+    const key = localFileMoveKey(baselineEntry);
+    if (!key) {
+      continue;
+    }
+    deletedBaselineByKey.set(key, deletedBaselineByKey.has(key) ? null : baselineEntry);
+  }
+  for (const [drivePath, localEntry] of params.local) {
+    if (params.baseline.has(drivePath) || params.conflicts.has(drivePath)) {
+      continue;
+    }
+    const key = localFileMoveKey(localEntry);
+    if (!key) {
+      continue;
+    }
+    newLocalByKey.set(key, newLocalByKey.has(key) ? null : localEntry);
+  }
+  const moveByNewPath = /* @__PURE__ */ new Map();
+  const movedBaselinePaths = /* @__PURE__ */ new Set();
+  for (const [key, baselineEntry] of deletedBaselineByKey) {
+    const localEntry = newLocalByKey.get(key) ?? null;
+    if (!baselineEntry || !localEntry) {
+      continue;
+    }
+    moveByNewPath.set(localEntry.path, baselineEntry);
+    movedBaselinePaths.add(baselineEntry.path);
+  }
+  return { moveByNewPath, movedBaselinePaths };
+}
+function localFileMoveKey(entry) {
+  if (entry.entryType !== "file" || !entry.contentSha256 || entry.sizeBytes === null) {
+    return null;
+  }
+  return `${entry.contentSha256}:${entry.sizeBytes}`;
+}
+function buildUpsertMutation(localEntry, baselineEntry) {
+  if (localEntry.entryType === "directory") {
+    return {
+      request: {
+        type: "mkdir",
+        path: localEntry.path
+      },
+      stateEntry: toStateEntry(localEntry, null),
+      uploadBytes: 0
+    };
+  }
+  if (localEntry.entryType === "file") {
+    if (!localEntry.contentSha256 || localEntry.sizeBytes === null) {
+      throw new Error(`Local drive file scan is missing content metadata: ${localEntry.path}`);
+    }
+    return {
+      request: {
+        type: "write_file",
+        path: localEntry.path,
+        content_sha256: localEntry.contentSha256,
+        size_bytes: localEntry.sizeBytes,
+        mime_type: localEntry.mimeType,
+        base_version_id: baselineEntry?.entryType === "file" ? baselineEntry.versionId : null
+      },
+      stateEntry: toStateEntry(localEntry, baselineEntry?.entryType === "file" ? baselineEntry.versionId : null),
+      uploadBytes: localEntry.sizeBytes ?? 0,
+      localFilePath: localEntry.absolutePath,
+      localFingerprint: localEntry.mtimeMs === void 0 || localEntry.ctimeMs === void 0 ? void 0 : {
+        sizeBytes: localEntry.sizeBytes,
+        mtimeMs: localEntry.mtimeMs,
+        ctimeMs: localEntry.ctimeMs
+      }
+    };
+  }
+  return {
+    request: {
+      type: localEntry.entryType === "symlink" ? "symlink" : "unsupported",
+      path: localEntry.path,
+      entry_type: localEntry.entryType,
+      reason: localEntry.unsupportedReason ?? "unsupported_entry_type"
+    },
+    stateEntry: toStateEntry(localEntry, baselineEntry?.versionId ?? null),
+    uploadBytes: 0
+  };
+}
+function buildMoveMutation(fromEntry, toEntry) {
+  return {
+    request: {
+      type: "move",
+      from_path: fromEntry.path,
+      to_path: toEntry.path,
+      base_version_id: fromEntry.entryType === "file" ? fromEntry.versionId : null
+    },
+    stateEntry: toStateEntry(toEntry, fromEntry.versionId),
+    uploadBytes: 0
+  };
+}
+function buildDeleteMutation(entry) {
+  return {
+    request: {
+      type: "delete",
+      path: entry.path,
+      base_version_id: entry.entryType === "file" ? entry.versionId : null
+    },
+    stateEntry: entry,
+    uploadBytes: 0
+  };
+}
+function toStateEntry(localEntry, versionId) {
+  return {
+    driveId: localEntry.driveId,
+    path: localEntry.path,
+    entryType: localEntry.entryType,
+    versionId,
+    contentSha256: localEntry.contentSha256,
+    sizeBytes: localEntry.sizeBytes,
+    mimeType: localEntry.mimeType
+  };
+}
+function localEntryMatchesBaseline(localEntry, baselineEntry) {
+  return localEntry.entryType === baselineEntry.entryType && localEntry.contentSha256 === baselineEntry.contentSha256 && localEntry.sizeBytes === baselineEntry.sizeBytes;
+}
+function localEntryMatchesConflict(localEntry, conflict) {
+  return localEntry.contentSha256 === conflict.localContentSha256 && localEntry.sizeBytes === conflict.localSizeBytes;
+}
+function compareDrivePathsForCreate(left, right) {
+  const leftDepth = drivePathDepth(left);
+  const rightDepth = drivePathDepth(right);
+  if (leftDepth !== rightDepth) {
+    return leftDepth - rightDepth;
+  }
+  return left.localeCompare(right);
+}
+function compareDrivePathsForDelete(left, right) {
+  const leftDepth = drivePathDepth(left);
+  const rightDepth = drivePathDepth(right);
+  if (leftDepth !== rightDepth) {
+    return rightDepth - leftDepth;
+  }
+  return right.localeCompare(left);
+}
+function drivePathDepth(drivePath) {
+  return drivePath.split("/").filter(Boolean).length;
+}
+function hasDeletedAncestor(drivePath, deletedDirectoryPaths) {
+  for (const deletedDirectoryPath of deletedDirectoryPaths) {
+    if (deletedDirectoryPath === "/") {
+      return true;
+    }
+    if (drivePath.startsWith(`${deletedDirectoryPath}/`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function hasConflictInSubtree(drivePath, conflicts) {
+  for (const conflictPath of conflicts.keys()) {
+    if (drivePathIsInSubtree(conflictPath, drivePath)) {
+      return true;
+    }
+  }
+  return false;
+}
+function drivePathIsInSubtree(drivePath, subtreeRoot) {
+  if (subtreeRoot === "/") {
+    return true;
+  }
+  return drivePath === subtreeRoot || drivePath.startsWith(`${subtreeRoot}/`);
+}
+
+// dist/managed-runtime/drive-sync-remote-planner.js
+function planRemoteDriveBatch(batch) {
+  const operations = [];
+  for (const change of batch.paths.filter((pathChange) => pathChange.change_type === "moved_to")) {
+    if (!change.from_path || !change.to_path) {
+      throw new Error(`Drive move batch ${batch.id} is missing from_path or to_path`);
+    }
+    operations.push({
+      type: "move",
+      change,
+      fromPath: change.from_path,
+      toPath: change.to_path,
+      preserve: [
+        {
+          type: "path_conflict_candidate",
+          path: change.from_path,
+          reason: "remote_move_source_conflict"
+        },
+        {
+          type: "overwrite_candidates",
+          path: change.to_path,
+          reason: "remote_move_target_conflict"
+        }
+      ]
+    });
+  }
+  for (const change of batch.paths) {
+    if (change.change_type === "moved_from" || change.change_type === "moved_to") {
+      continue;
+    }
+    if (change.change_type === "unsupported" || change.change_type === "conflicted") {
+      continue;
+    }
+    if (change.change_type === "deleted") {
+      operations.push({
+        type: "delete",
+        change,
+        path: change.path,
+        preserve: [
+          {
+            type: "overwrite_candidates",
+            path: change.path,
+            reason: "remote_delete_conflict",
+            subtreeReason: "remote_delete_subtree_conflict"
+          }
+        ]
+      });
+      continue;
+    }
+    if (change.entry_type === "directory") {
+      operations.push({
+        type: "mkdir",
+        change,
+        path: change.path
+      });
+      continue;
+    }
+    if (change.entry_type !== "file" || !change.version_id) {
+      throw new Error(`Drive file change ${change.id} is missing a file version`);
+    }
+    operations.push({
+      type: "write_file",
+      change,
+      path: change.path,
+      versionId: change.version_id,
+      preserve: [
+        {
+          type: "overwrite_candidates",
+          path: change.path,
+          reason: "remote_write_conflict",
+          subtreeReason: "remote_write_directory_target_conflict"
+        }
+      ]
+    });
+  }
+  return operations;
+}
+
+// dist/managed-runtime/drive-sync-state-applier.js
+function applyLocalDriveConflictActions(params) {
+  for (const action of params.actions) {
+    if (action.type === "clear_conflict") {
+      params.stateStore.deleteConflict?.(action.driveId, action.path);
+      continue;
+    }
+    const existingConflict = params.stateStore.getConflict?.(action.driveId, action.path) ?? null;
+    if (!existingConflict) {
+      continue;
+    }
+    params.stateStore.upsertConflict?.({
+      ...existingConflict,
+      conflictPath: action.conflictPath
+    });
+  }
+}
+function applyAppliedLocalDriveMutationState(params) {
+  if (params.mutation.request.type === "move") {
+    const fromPath = readMutationPath(params.mutation.request, "from_path");
+    const toPath = readMutationPath(params.mutation.request, "to_path");
+    params.stateStore.moveEntryTree(params.driveId, fromPath, toPath);
+    params.stateStore.deleteConflictTree?.(params.driveId, fromPath);
+    params.stateStore.deleteConflictTree?.(params.driveId, toPath);
+    return;
+  }
+  if (params.mutation.request.type === "delete") {
+    const drivePath = readMutationPath(params.mutation.request, "path");
+    params.stateStore.deleteEntryTree(params.driveId, drivePath);
+    params.stateStore.deleteConflictTree?.(params.driveId, drivePath);
+    return;
+  }
+  if (!params.mutation.stateEntry) {
+    return;
+  }
+  params.stateStore.upsertEntry({
+    ...params.mutation.stateEntry,
+    versionId: typeof params.result.version_id === "string" ? params.result.version_id : params.mutation.stateEntry.versionId
+  });
+  params.stateStore.deleteConflict?.(params.driveId, params.mutation.stateEntry.path);
+}
+function applyUnsupportedLocalDriveMutationState(params) {
+  if (!params.mutation.stateEntry) {
+    return;
+  }
+  params.stateStore.upsertEntry(params.mutation.stateEntry);
+  params.stateStore.deleteConflict?.(params.driveId, params.mutation.stateEntry.path);
+}
+function recordLocalUploadConflict(params) {
+  params.stateStore.upsertConflict?.({
+    driveId: params.driveId,
+    path: params.conflictPath,
+    conflictType: "local_upload",
+    reason: params.result.reason ?? null,
+    localContentSha256: params.mutation.stateEntry?.contentSha256 ?? null,
+    localSizeBytes: params.mutation.stateEntry?.sizeBytes ?? null,
+    localVersionId: typeof params.result.version_id === "string" ? params.result.version_id : params.mutation.stateEntry?.versionId ?? null,
+    conflictId: typeof params.result.conflict_id === "string" ? params.result.conflict_id : null,
+    conflictPath: params.localConflictPath,
+    remoteBatchId: null,
+    remoteSequence: null
+  });
+}
+function applyRemoteDriveMoveState(params) {
+  params.stateStore.moveEntryTree(params.driveId, normalizeDrivePath2(params.fromPath), normalizeDrivePath2(params.toPath));
+}
+function applyRemoteDriveDeleteState(params) {
+  params.stateStore.deleteEntryTree(params.driveId, normalizeDrivePath2(params.path));
+}
+function applyRemoteDriveDirectoryState(params) {
+  params.stateStore.upsertEntry({
+    driveId: params.driveId,
+    path: normalizeDrivePath2(params.path),
+    entryType: "directory",
+    versionId: null,
+    contentSha256: null,
+    sizeBytes: null,
+    mimeType: null
+  });
+}
+function applyRemoteDriveFileState(params) {
+  params.stateStore.upsertEntry({
+    driveId: params.driveId,
+    path: normalizeDrivePath2(params.path),
+    entryType: "file",
+    versionId: params.versionId,
+    contentSha256: params.version?.content_sha256 ?? null,
+    sizeBytes: params.version?.size_bytes ?? params.downloadedSizeBytes,
+    mimeType: params.version?.mime_type ?? null
+  });
+}
+function recordRemoteApplyConflict(params) {
+  const conflict = {
+    driveId: params.driveId,
+    path: normalizeDrivePath2(params.path),
+    conflictType: "remote_apply",
+    reason: params.reason,
+    localContentSha256: params.localEntry?.contentSha256 ?? null,
+    localSizeBytes: params.localEntry?.sizeBytes ?? null,
+    localVersionId: params.baselineEntry?.versionId ?? null,
+    conflictId: null,
+    conflictPath: params.conflictPath,
+    remoteBatchId: params.remoteBatchId,
+    remoteSequence: params.remoteSequence
+  };
+  params.stateStore.upsertConflict?.(conflict);
+  return conflict;
+}
+function resolveLocalMutationResultPath(result, mutation) {
+  if (typeof result.path === "string") {
+    return normalizeDrivePath2(result.path);
+  }
+  if (typeof result.to_path === "string") {
+    return normalizeDrivePath2(result.to_path);
+  }
+  if (typeof result.from_path === "string") {
+    return normalizeDrivePath2(result.from_path);
+  }
+  if (mutation.stateEntry) {
+    return mutation.stateEntry.path;
+  }
+  if (typeof mutation.request.path === "string") {
+    return normalizeDrivePath2(mutation.request.path);
+  }
+  if (typeof mutation.request.to_path === "string") {
+    return normalizeDrivePath2(mutation.request.to_path);
+  }
+  if (typeof mutation.request.from_path === "string") {
+    return normalizeDrivePath2(mutation.request.from_path);
+  }
+  throw new Error("Local drive sync mutation result did not include a path");
+}
+function readMutationPath(request, key) {
+  const value = request[key];
+  if (typeof value !== "string") {
+    throw new Error(`Local drive sync mutation is missing ${key}`);
+  }
+  return normalizeDrivePath2(value);
+}
+function normalizeDrivePath2(input) {
+  if (!input.startsWith("/")) {
+    throw new Error(`Drive path must be absolute: ${input}`);
+  }
+  const segments = input.split("/").filter(Boolean);
+  if (segments.some((segment) => segment === "." || segment === "..")) {
+    throw new Error(`Drive path must not contain traversal segments: ${input}`);
+  }
+  return input === "/" ? "/" : `/${segments.join("/")}`;
+}
+
+// dist/managed-runtime/drive-sync-transfer.js
+import { createHash as createHash2, randomUUID as randomUUID5 } from "node:crypto";
+import { createReadStream as createReadStream2, createWriteStream } from "node:fs";
+import { lstat as lstat2, mkdir as mkdir2, rename as rename2, rm, writeFile } from "node:fs/promises";
+import path17 from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+var DEFAULT_DRIVE_SYNC_TRANSFER_TIMEOUT_MS = DRIVE_TRANSFER_POLICY.networkRequestTimeoutMs;
+var LocalDriveFileDeferredError = class extends Error {
+  drivePath;
+  constructor(drivePath, message) {
+    super(message ?? `Local drive file changed while it was being read; deferring sync for ${drivePath}`);
+    this.name = "LocalDriveFileDeferredError";
+    this.drivePath = drivePath;
+  }
+};
+function isLocalDriveFileDeferredError(error) {
+  return error instanceof LocalDriveFileDeferredError;
+}
+async function prepareLocalMutationUploads(params) {
+  const preparedMutations = [];
+  const deferredPaths = [];
+  const requiresUploadApi = params.mutations.some((mutation) => mutation.request.type === "write_file" && mutation.localFilePath && typeof mutation.request.storage_key !== "string");
+  if (requiresUploadApi && !params.api.prepareFileUpload) {
+    throw new Error("Drive sync direct upload API is not configured");
+  }
+  for (const mutation of params.mutations) {
+    const localFilePath = mutation.localFilePath;
+    if (mutation.request.type !== "write_file" || !localFilePath) {
+      preparedMutations.push(mutation);
+      continue;
+    }
+    if (typeof mutation.request.storage_key === "string") {
+      preparedMutations.push(mutation);
+      continue;
+    }
+    const drivePath = readMutationString(mutation.request, "path");
+    try {
+      const contentSha256 = readMutationString(mutation.request, "content_sha256");
+      const sizeBytes = readMutationNumber(mutation.request, "size_bytes");
+      const versionId = buildDeterministicDriveVersionId({
+        driveId: params.driveId,
+        path: drivePath,
+        contentSha256,
+        sizeBytes,
+        baseVersionId: typeof mutation.request.base_version_id === "string" ? mutation.request.base_version_id : null
+      });
+      await assertLocalFileFingerprint(mutation);
+      const prepared = await params.api.prepareFileUpload({
+        sync_client_id: params.syncClientId,
+        drive_id: params.driveId,
+        path: drivePath,
+        version_id: versionId,
+        content_sha256: contentSha256,
+        size_bytes: sizeBytes,
+        mime_type: typeof mutation.request.mime_type === "string" ? mutation.request.mime_type : null
+      });
+      if (prepared.upload_request) {
+        await uploadLocalFileToSignedRequest({
+          filePath: localFilePath,
+          sizeBytes,
+          signedRequest: prepared.upload_request
+        });
+      } else if (prepared.upload_status !== "committed") {
+        throw new Error("Prepared drive upload did not include an upload request");
+      }
+      await assertLocalFileFingerprint(mutation);
+      mutation.request.version_id = prepared.version_id;
+      mutation.request.storage_key = prepared.storage_key;
+      preparedMutations.push(mutation);
+    } catch (error) {
+      if (!isLocalDriveFileDeferredError(error)) {
+        throw error;
+      }
+      deferredPaths.push(error.drivePath);
+    }
+  }
+  return { preparedMutations, deferredPaths };
+}
+async function downloadDriveVersionToLocalFile(params) {
+  const response = await params.api.downloadFileVersion({
+    sync_client_id: params.syncClientId,
+    drive_id: params.driveId,
+    version_id: params.versionId,
+    format: "base64",
+    transfer_mode: "direct"
+  });
+  if (response.file.transfer_mode === "direct" && response.file.download_request) {
+    return await downloadSignedRequestToFile({
+      signedRequest: response.file.download_request,
+      targetPath: params.targetPath,
+      expectedSizeBytes: params.expectedSizeBytes,
+      expectedSha256: params.expectedSha256
+    });
+  }
+  if (response.file.content_format !== "base64" || !response.file.content_base64) {
+    throw new Error(`Drive file version ${params.versionId} was not returned as base64`);
+  }
+  const bytes = Buffer.from(response.file.content_base64, "base64");
+  const contentSha256 = sha256Hex3(bytes);
+  if (params.expectedSizeBytes !== null && bytes.byteLength !== params.expectedSizeBytes) {
+    throw new Error(`Downloaded drive file size mismatch for ${params.versionId}`);
+  }
+  if (params.expectedSha256 && contentSha256 !== params.expectedSha256) {
+    throw new Error(`Downloaded drive file hash mismatch for ${params.versionId}`);
+  }
+  await mkdir2(path17.dirname(params.targetPath), { recursive: true });
+  await writeFile(params.targetPath, bytes);
+  return { sizeBytes: bytes.byteLength, contentSha256 };
+}
+async function assertLocalFileFingerprint(mutation) {
+  if (!mutation.localFilePath || !mutation.localFingerprint) {
+    return;
+  }
+  const current = await lstat2(mutation.localFilePath);
+  if (!current.isFile() || current.size !== mutation.localFingerprint.sizeBytes || current.mtimeMs !== mutation.localFingerprint.mtimeMs || current.ctimeMs !== mutation.localFingerprint.ctimeMs) {
+    const drivePath = readMutationString(mutation.request, "path");
+    throw new LocalDriveFileDeferredError(drivePath);
+  }
+}
+async function uploadLocalFileToSignedRequest(params) {
+  const headers = new Headers(params.signedRequest.headers);
+  headers.set("content-length", String(params.sizeBytes));
+  const response = await fetchWithTimeout(params.signedRequest.url, {
+    method: params.signedRequest.method,
+    headers,
+    body: createReadStream2(params.filePath),
+    duplex: "half"
+  }, {
+    timeoutMs: DEFAULT_DRIVE_SYNC_TRANSFER_TIMEOUT_MS,
+    label: "Drive object upload"
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new Error(`Drive object upload failed with status ${response.status}${body ? ` body=${body.slice(0, 500)}` : ""}`);
+  }
+}
+async function downloadSignedRequestToFile(params) {
+  const response = await fetchWithTimeout(params.signedRequest.url, {
+    method: params.signedRequest.method,
+    headers: params.signedRequest.headers
+  }, {
+    timeoutMs: DEFAULT_DRIVE_SYNC_TRANSFER_TIMEOUT_MS,
+    label: "Drive object download"
+  });
+  if (!response.ok || !response.body) {
+    const body = await response.text().catch(() => "");
+    throw new Error(`Drive object download failed with status ${response.status}${body ? ` body=${body.slice(0, 500)}` : ""}`);
+  }
+  await mkdir2(path17.dirname(params.targetPath), { recursive: true });
+  const tempPath = `${params.targetPath}.panorama-download-${randomUUID5()}.tmp`;
+  const hash = createHash2("sha256");
+  let sizeBytes = 0;
+  try {
+    const source = Readable.fromWeb(response.body);
+    await pipeline(source, async function* hashChunks(chunks) {
+      for await (const chunk of chunks) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        sizeBytes += buffer.byteLength;
+        hash.update(buffer);
+        yield buffer;
+      }
+    }, createWriteStream(tempPath));
+    const contentSha256 = hash.digest("hex");
+    if (params.expectedSizeBytes !== null && sizeBytes !== params.expectedSizeBytes) {
+      throw new Error(`Downloaded drive file size mismatch for ${params.targetPath}`);
+    }
+    if (params.expectedSha256 && contentSha256 !== params.expectedSha256) {
+      throw new Error(`Downloaded drive file hash mismatch for ${params.targetPath}`);
+    }
+    await rename2(tempPath, params.targetPath);
+    return { sizeBytes, contentSha256 };
+  } catch (error) {
+    await rm(tempPath, { force: true }).catch(() => void 0);
+    throw error;
+  }
+}
+async function fetchWithTimeout(input, init, options) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, options.timeoutMs);
+  timer.unref?.();
+  try {
+    return await fetch(input, {
+      ...init,
+      signal: init.signal ?? controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) {
+      throw new Error(`${options.label} timed out after ${options.timeoutMs}ms`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function buildDeterministicDriveVersionId(params) {
+  const hash = createHash2("sha256").update([
+    "panorama-drive-version-v1",
+    params.driveId,
+    normalizeDrivePath(params.path),
+    params.contentSha256,
+    String(params.sizeBytes),
+    params.baseVersionId ?? ""
+  ].join("\0")).digest();
+  const bytes = Buffer.from(hash.subarray(0, 16));
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function readMutationString(request, key) {
+  const value = request[key];
+  if (typeof value !== "string") {
+    throw new Error(`Local drive sync mutation is missing ${key}`);
+  }
+  return value;
+}
+function readMutationNumber(request, key) {
+  const value = request[key];
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`Local drive sync mutation is missing numeric ${key}`);
+  }
+  return value;
+}
+function sha256Hex3(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+
+// dist/managed-runtime/drive-sync.js
+var MAX_LOCAL_BATCH_CHANGES = DRIVE_TRANSFER_POLICY.localBatchMaxChanges;
+var MAX_LOCAL_BATCH_UPLOAD_BYTES = DRIVE_TRANSFER_POLICY.localSyncBatchUploadMaxBytes;
+var MAX_LOCAL_FILE_UPLOAD_BYTES = DRIVE_TRANSFER_POLICY.objectFileMaxBytes;
+var DEFAULT_DRIVE_SYNC_NETWORK_TIMEOUT_MS2 = DRIVE_TRANSFER_POLICY.networkRequestTimeoutMs;
+var DRIVE_SYNC_STATUS_CONFLICT_SAMPLE_LIMIT = 10;
+function isRecord2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function mapDriveSyncEntryRow(row) {
+  return {
+    driveId: row.drive_id,
+    path: row.path,
+    entryType: row.entry_type,
+    versionId: row.version_id,
+    contentSha256: row.content_sha256,
+    sizeBytes: row.size_bytes,
+    mimeType: row.mime_type
+  };
+}
+function mapDriveSyncConflictRow(row) {
+  return {
+    driveId: row.drive_id,
+    path: row.path,
+    conflictType: row.conflict_type,
+    reason: row.reason,
+    localContentSha256: row.local_content_sha256,
+    localSizeBytes: row.local_size_bytes,
+    localVersionId: row.local_version_id,
+    conflictId: row.conflict_id,
+    conflictPath: row.conflict_path,
+    remoteBatchId: row.remote_batch_id,
+    remoteSequence: row.remote_sequence
+  };
+}
+var DriveSyncStateStore = class _DriveSyncStateStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  static async open(stateDir) {
+    await mkdir3(stateDir, { recursive: true });
+    const sqlite = await import("node:sqlite");
+    const db = new sqlite.DatabaseSync(path18.join(stateDir, "drive-sync.sqlite"));
+    const store = new _DriveSyncStateStore(db);
+    store.ensureSchema();
+    return store;
+  }
+  close() {
+    this.db.close();
+  }
+  getOrCreateClientKey(prefix) {
+    const key = "client_instance_id";
+    const rows = this.db.prepare("SELECT value FROM drive_sync_metadata WHERE key = ?").all(key);
+    const existing = rows[0]?.value;
+    if (existing) {
+      return `${prefix}:${existing}`;
+    }
+    const clientInstanceId = randomUUID6();
+    this.db.prepare(`
+        INSERT INTO drive_sync_metadata (key, value, updated_at)
+        VALUES (?, ?, datetime('now'))
+        ON CONFLICT(key) DO UPDATE SET
+          value = excluded.value,
+          updated_at = excluded.updated_at
+        `).run(key, clientInstanceId);
+    return `${prefix}:${clientInstanceId}`;
+  }
+  getEntry(driveId, drivePath) {
+    const normalizedPath = normalizeDrivePath(drivePath);
+    const rows = this.db.prepare(`
+        SELECT drive_id, path, entry_type, version_id, content_sha256, size_bytes, mime_type
+        FROM drive_sync_entries
+        WHERE drive_id = ? AND path = ?
+        `).all(driveId, normalizedPath);
+    return rows[0] ? mapDriveSyncEntryRow(rows[0]) : null;
+  }
+  listEntries(driveId) {
+    const rows = this.db.prepare(`
+        SELECT drive_id, path, entry_type, version_id, content_sha256, size_bytes, mime_type
+        FROM drive_sync_entries
+        WHERE drive_id = ?
+        ORDER BY path ASC
+        `).all(driveId);
+    return rows.map(mapDriveSyncEntryRow);
+  }
+  listDrives() {
+    const rows = this.db.prepare(`
+        SELECT drive_id, title, root_path
+        FROM drive_sync_drives
+        ORDER BY drive_id ASC
+        `).all();
+    return rows.map((row) => ({
+      id: row.drive_id,
+      title: row.title,
+      rootPath: row.root_path
+    }));
+  }
+  getConflict(driveId, drivePath) {
+    const normalizedPath = normalizeDrivePath(drivePath);
+    const rows = this.db.prepare(`
+        SELECT
+          drive_id,
+          path,
+          conflict_type,
+          reason,
+          local_content_sha256,
+          local_size_bytes,
+          local_version_id,
+          conflict_id,
+          conflict_path,
+          remote_batch_id,
+          remote_sequence
+        FROM drive_sync_conflicts
+        WHERE drive_id = ? AND path = ?
+        `).all(driveId, normalizedPath);
+    return rows[0] ? mapDriveSyncConflictRow(rows[0]) : null;
+  }
+  listConflicts(driveId) {
+    const rows = this.db.prepare(`
+        SELECT
+          drive_id,
+          path,
+          conflict_type,
+          reason,
+          local_content_sha256,
+          local_size_bytes,
+          local_version_id,
+          conflict_id,
+          conflict_path,
+          remote_batch_id,
+          remote_sequence
+        FROM drive_sync_conflicts
+        WHERE drive_id = ?
+        ORDER BY path ASC
+        `).all(driveId);
+    return rows.map(mapDriveSyncConflictRow);
+  }
+  setSyncClient(client) {
+    this.db.prepare(`
+        INSERT INTO drive_sync_clients (id, team_id, agent_id, host_id, display_name, status, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, datetime('now'))
+        ON CONFLICT(id) DO UPDATE SET
+          team_id = excluded.team_id,
+          agent_id = excluded.agent_id,
+          host_id = excluded.host_id,
+          display_name = excluded.display_name,
+          status = excluded.status,
+          updated_at = excluded.updated_at
+        `).run(client.id, client.team_id, client.agent_id, client.host_id, client.display_name, client.status);
+  }
+  upsertDrive(drive) {
+    this.db.prepare(`
+        INSERT INTO drive_sync_drives (drive_id, title, root_path, updated_at)
+        VALUES (?, ?, ?, datetime('now'))
+        ON CONFLICT(drive_id) DO UPDATE SET
+          title = excluded.title,
+          root_path = excluded.root_path,
+          updated_at = excluded.updated_at
+        `).run(drive.id, drive.title, drive.rootPath);
+  }
+  removeDrive(driveId) {
+    this.db.prepare("DELETE FROM drive_sync_conflicts WHERE drive_id = ?").run(driveId);
+    this.db.prepare("DELETE FROM drive_sync_entries WHERE drive_id = ?").run(driveId);
+    this.db.prepare("DELETE FROM drive_sync_cursors WHERE drive_id = ?").run(driveId);
+    this.db.prepare("DELETE FROM drive_sync_drives WHERE drive_id = ?").run(driveId);
+  }
+  setCursor(driveId, lastBatchSequence) {
+    this.db.prepare(`
+        INSERT INTO drive_sync_cursors (drive_id, last_batch_sequence, updated_at)
+        VALUES (?, ?, datetime('now'))
+        ON CONFLICT(drive_id) DO UPDATE SET
+          last_batch_sequence = excluded.last_batch_sequence,
+          updated_at = excluded.updated_at
+        `).run(driveId, lastBatchSequence);
+  }
+  upsertEntry(entry) {
+    this.db.prepare(`
+        INSERT INTO drive_sync_entries (
+          drive_id,
+          path,
+          entry_type,
+          version_id,
+          content_sha256,
+          size_bytes,
+          mime_type,
+          updated_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, datetime('now'))
+        ON CONFLICT(drive_id, path) DO UPDATE SET
+          entry_type = excluded.entry_type,
+          version_id = excluded.version_id,
+          content_sha256 = excluded.content_sha256,
+          size_bytes = excluded.size_bytes,
+          mime_type = excluded.mime_type,
+          updated_at = excluded.updated_at
+        `).run(entry.driveId, entry.path, entry.entryType, entry.versionId, entry.contentSha256, entry.sizeBytes, entry.mimeType);
+  }
+  upsertConflict(conflict) {
+    this.db.prepare(`
+        INSERT INTO drive_sync_conflicts (
+          drive_id,
+          path,
+          conflict_type,
+          reason,
+          local_content_sha256,
+          local_size_bytes,
+          local_version_id,
+          conflict_id,
+          conflict_path,
+          remote_batch_id,
+          remote_sequence,
+          updated_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
+        ON CONFLICT(drive_id, path) DO UPDATE SET
+          conflict_type = excluded.conflict_type,
+          reason = excluded.reason,
+          local_content_sha256 = excluded.local_content_sha256,
+          local_size_bytes = excluded.local_size_bytes,
+          local_version_id = excluded.local_version_id,
+          conflict_id = excluded.conflict_id,
+          conflict_path = excluded.conflict_path,
+          remote_batch_id = excluded.remote_batch_id,
+          remote_sequence = excluded.remote_sequence,
+          updated_at = excluded.updated_at
+        `).run(conflict.driveId, conflict.path, conflict.conflictType, conflict.reason, conflict.localContentSha256, conflict.localSizeBytes, conflict.localVersionId, conflict.conflictId, conflict.conflictPath, conflict.remoteBatchId, conflict.remoteSequence);
+  }
+  deleteConflict(driveId, drivePath) {
+    this.db.prepare("DELETE FROM drive_sync_conflicts WHERE drive_id = ? AND path = ?").run(driveId, normalizeDrivePath(drivePath));
+  }
+  deleteConflictTree(driveId, drivePath) {
+    const normalizedPath = normalizeDrivePath(drivePath);
+    if (normalizedPath === "/") {
+      this.db.prepare("DELETE FROM drive_sync_conflicts WHERE drive_id = ?").run(driveId);
+      return;
+    }
+    const prefix = `${normalizedPath}/`;
+    this.db.prepare(`
+        DELETE FROM drive_sync_conflicts
+        WHERE drive_id = ?
+          AND (path = ? OR substr(path, 1, ?) = ?)
+        `).run(driveId, normalizedPath, prefix.length, prefix);
+  }
+  deleteEntryTree(driveId, drivePath) {
+    const normalizedPath = normalizeDrivePath(drivePath);
+    if (normalizedPath === "/") {
+      this.db.prepare("DELETE FROM drive_sync_entries WHERE drive_id = ?").run(driveId);
+      return;
+    }
+    const prefix = `${normalizedPath}/`;
+    this.db.prepare(`
+        DELETE FROM drive_sync_entries
+        WHERE drive_id = ?
+          AND (path = ? OR substr(path, 1, ?) = ?)
+        `).run(driveId, normalizedPath, prefix.length, prefix);
+  }
+  moveEntryTree(driveId, fromPath, toPath) {
+    const normalizedFromPath = normalizeDrivePath(fromPath);
+    const normalizedToPath = normalizeDrivePath(toPath);
+    const prefix = normalizedFromPath === "/" ? "/" : `${normalizedFromPath}/`;
+    const rows = this.db.prepare(`
+        SELECT path, entry_type, version_id, content_sha256, size_bytes, mime_type
+        FROM drive_sync_entries
+        WHERE drive_id = ?
+          AND (path = ? OR substr(path, 1, ?) = ?)
+        `).all(driveId, normalizedFromPath, prefix.length, prefix);
+    this.deleteEntryTree(driveId, normalizedFromPath);
+    for (const row of rows) {
+      const suffix = row.path === normalizedFromPath ? "" : row.path.slice(normalizedFromPath.length);
+      this.upsertEntry({
+        driveId,
+        path: `${normalizedToPath}${suffix}`,
+        entryType: row.entry_type,
+        versionId: row.version_id,
+        contentSha256: row.content_sha256,
+        sizeBytes: row.size_bytes,
+        mimeType: row.mime_type
+      });
+    }
+  }
+  ensureSchema() {
+    this.db.exec(`
+      PRAGMA journal_mode = WAL;
+      CREATE TABLE IF NOT EXISTS drive_sync_metadata (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS drive_sync_clients (
+        id TEXT PRIMARY KEY,
+        team_id TEXT NOT NULL,
+        agent_id TEXT,
+        host_id TEXT,
+        display_name TEXT,
+        status TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS drive_sync_drives (
+        drive_id TEXT PRIMARY KEY,
+        title TEXT,
+        root_path TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS drive_sync_cursors (
+        drive_id TEXT PRIMARY KEY,
+        last_batch_sequence INTEGER NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS drive_sync_entries (
+        drive_id TEXT NOT NULL,
+        path TEXT NOT NULL,
+        entry_type TEXT NOT NULL,
+        version_id TEXT,
+        content_sha256 TEXT,
+        size_bytes INTEGER,
+        mime_type TEXT,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (drive_id, path)
+      );
+      CREATE TABLE IF NOT EXISTS drive_sync_conflicts (
+        drive_id TEXT NOT NULL,
+        path TEXT NOT NULL,
+        conflict_type TEXT NOT NULL,
+        reason TEXT,
+        local_content_sha256 TEXT,
+        local_size_bytes INTEGER,
+        local_version_id TEXT,
+        conflict_id TEXT,
+        conflict_path TEXT,
+        remote_batch_id TEXT,
+        remote_sequence INTEGER,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (drive_id, path)
+      );
+    `);
+  }
+};
+async function createManagedDriveSyncService(params) {
+  const stateStore = params.stateStore ?? await DriveSyncStateStore.open(params.config.driveSync.stateDir);
+  const api = params.api ?? createSupabaseDriveSyncApi(params.supabase, {
+    timeoutMs: params.config.driveSync.networkTimeoutMs
+  });
+  const service = new ManagedDrivePullSyncService({
+    config: params.config,
+    api,
+    stateStore
+  });
+  await mkdir3(params.config.driveSync.rootDir, { recursive: true });
+  return service;
+}
+function createSupabaseDriveSyncApi(supabase, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_DRIVE_SYNC_NETWORK_TIMEOUT_MS2;
+  return {
+    registerClient: (body) => invokeDriveSyncFunction(supabase, "register-drive-sync-client", body, timeoutMs),
+    listDrives: (body) => invokeDriveSyncFunction(supabase, "list-sync-drives", body, timeoutMs),
+    getChanges: (body) => invokeDriveSyncFunction(supabase, "get-drive-changes", body, timeoutMs),
+    downloadFileVersion: (body) => invokeDriveSyncFunction(supabase, "download-drive-file-version", body, timeoutMs),
+    prepareFileUpload: (body) => invokeDriveSyncFunction(supabase, "prepare-drive-file-upload", body, timeoutMs),
+    ackChanges: (body) => invokeDriveSyncFunction(supabase, "ack-drive-changes", body, timeoutMs),
+    applyLocalChangeBatch: (body) => invokeDriveSyncFunction(supabase, "apply-local-drive-change-batch", body, timeoutMs),
+    applyConflictActions: (body) => invokeDriveSyncFunction(supabase, "apply-drive-conflict-actions", body, timeoutMs),
+    reportStatus: (body) => invokeDriveSyncFunction(supabase, "report-drive-sync-status", body, timeoutMs)
+  };
+}
+async function applyDriveChangeBatchToLocalFilesystem(params) {
+  let appliedPathCount = 0;
+  let remoteConflictCount = 0;
+  const remoteConflicts = [];
+  const operations = planRemoteDriveBatch(params.batch);
+  for (const operation of operations) {
+    if (operation.type === "move") {
+      const sourcePath = resolveDriveLocalPath(params.driveRoot, operation.fromPath);
+      const targetPath = resolveDriveLocalPath(params.driveRoot, operation.toPath);
+      await assertNoSymlinkInExistingPath(params.driveRoot, path18.dirname(sourcePath));
+      const alreadyAppliedMove = await classifyRemoteMoveAlreadyApplied({
+        driveId: params.batch.drive_id,
+        driveRoot: params.driveRoot,
+        stateStore: params.stateStore,
+        fromPath: operation.fromPath,
+        toPath: operation.toPath
+      });
+      if (alreadyAppliedMove) {
+        if (alreadyAppliedMove === "advance_state") {
+          applyRemoteDriveMoveState({
+            stateStore: params.stateStore,
+            driveId: params.batch.drive_id,
+            fromPath: operation.fromPath,
+            toPath: operation.toPath
+          });
+        }
+        appliedPathCount += 1;
+        continue;
+      }
+      const preserved2 = await preserveRemoteApplySteps({
+        driveId: params.batch.drive_id,
+        driveRoot: params.driveRoot,
+        stateStore: params.stateStore,
+        batch: params.batch,
+        steps: operation.preserve
+      });
+      remoteConflictCount += preserved2.conflictCount;
+      remoteConflicts.push(...preserved2.conflicts);
+      await assertPathExists(sourcePath, `Drive move source is missing: ${operation.fromPath}`);
+      await assertLocalPathIsNotSymlink(sourcePath, `Drive move source is a symlink: ${operation.fromPath}`);
+      await assertNoSymlinkInExistingPath(params.driveRoot, path18.dirname(targetPath));
+      await mkdir3(path18.dirname(targetPath), { recursive: true });
+      await rm2(targetPath, { recursive: true, force: true });
+      await rename3(sourcePath, targetPath);
+      applyRemoteDriveMoveState({
+        stateStore: params.stateStore,
+        driveId: params.batch.drive_id,
+        fromPath: operation.fromPath,
+        toPath: operation.toPath
+      });
+      appliedPathCount += 1;
+      continue;
+    }
+    const localPath = resolveDriveLocalPath(params.driveRoot, operation.path);
+    if (operation.type === "delete") {
+      if (await remoteDeleteAlreadyApplied({
+        driveId: params.batch.drive_id,
+        driveRoot: params.driveRoot,
+        path: operation.path
+      })) {
+        applyRemoteDriveDeleteState({
+          stateStore: params.stateStore,
+          driveId: params.batch.drive_id,
+          path: operation.path
+        });
+        appliedPathCount += 1;
+        continue;
+      }
+      const preserved2 = await preserveRemoteApplySteps({
+        driveId: params.batch.drive_id,
+        driveRoot: params.driveRoot,
+        stateStore: params.stateStore,
+        batch: params.batch,
+        steps: operation.preserve
+      });
+      remoteConflictCount += preserved2.conflictCount;
+      remoteConflicts.push(...preserved2.conflicts);
+      await assertNoSymlinkInExistingPath(params.driveRoot, path18.dirname(localPath));
+      await rm2(localPath, { recursive: true, force: true });
+      applyRemoteDriveDeleteState({
+        stateStore: params.stateStore,
+        driveId: params.batch.drive_id,
+        path: operation.path
+      });
+      appliedPathCount += 1;
+      continue;
+    }
+    if (operation.type === "mkdir") {
+      await assertNoSymlinkInExistingPath(params.driveRoot, path18.dirname(localPath));
+      await assertLocalPathIsNotSymlink(localPath, `Drive directory target is a symlink: ${operation.path}`);
+      await mkdir3(localPath, { recursive: true });
+      applyRemoteDriveDirectoryState({
+        stateStore: params.stateStore,
+        driveId: params.batch.drive_id,
+        path: operation.path
+      });
+      appliedPathCount += 1;
+      continue;
+    }
+    const alreadyAppliedFile = await remoteFileAlreadyApplied({
+      driveId: params.batch.drive_id,
+      driveRoot: params.driveRoot,
+      path: operation.path,
+      version: operation.change.version
+    });
+    if (alreadyAppliedFile) {
+      applyRemoteDriveFileState({
+        stateStore: params.stateStore,
+        driveId: params.batch.drive_id,
+        path: operation.path,
+        versionId: operation.versionId,
+        version: operation.change.version,
+        downloadedSizeBytes: alreadyAppliedFile.sizeBytes
+      });
+      appliedPathCount += 1;
+      continue;
+    }
+    const preserved = await preserveRemoteApplySteps({
+      driveId: params.batch.drive_id,
+      driveRoot: params.driveRoot,
+      stateStore: params.stateStore,
+      batch: params.batch,
+      steps: operation.preserve
+    });
+    remoteConflictCount += preserved.conflictCount;
+    remoteConflicts.push(...preserved.conflicts);
+    await assertNoSymlinkInExistingPath(params.driveRoot, path18.dirname(localPath));
+    await assertLocalPathIsNotSymlink(localPath, `Drive file target is a symlink: ${operation.path}`);
+    if (preserved.overwriteResults.get(operation.path)?.localEntry?.entryType === "directory") {
+      await rm2(localPath, { recursive: true, force: true });
+    }
+    const version = operation.change.version;
+    const downloaded = await downloadDriveVersionToLocalFile({
+      api: params.api,
+      syncClientId: params.syncClientId,
+      driveId: params.batch.drive_id,
+      versionId: operation.versionId,
+      targetPath: localPath,
+      expectedSizeBytes: version?.size_bytes ?? null,
+      expectedSha256: version?.content_sha256 ?? null
+    });
+    applyRemoteDriveFileState({
+      stateStore: params.stateStore,
+      driveId: params.batch.drive_id,
+      path: operation.path,
+      versionId: operation.versionId,
+      version,
+      downloadedSizeBytes: downloaded.sizeBytes
+    });
+    appliedPathCount += 1;
+  }
+  return { appliedPathCount, remoteConflictCount, remoteConflicts };
+}
+async function classifyRemoteMoveAlreadyApplied(params) {
+  const normalizedFromPath = normalizeDrivePath(params.fromPath);
+  const normalizedToPath = normalizeDrivePath(params.toPath);
+  const localSource = await readLocalDriveEntryAtPath({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    drivePath: normalizedFromPath
+  });
+  if (localSource) {
+    return null;
+  }
+  const baselineSource = params.stateStore.getEntry?.(params.driveId, normalizedFromPath) ?? null;
+  const baselineTarget = params.stateStore.getEntry?.(params.driveId, normalizedToPath) ?? null;
+  const localTarget = await readLocalDriveEntryAtPath({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    drivePath: normalizedToPath
+  });
+  if (!localTarget) {
+    return null;
+  }
+  if (baselineTarget && localEntryMatchesBaseline(localTarget, baselineTarget)) {
+    return "already_applied";
+  }
+  if (baselineSource?.entryType === "file" && localEntryMatchesBaseline(localTarget, baselineSource)) {
+    return "advance_state";
+  }
+  return null;
+}
+async function remoteDeleteAlreadyApplied(params) {
+  const localEntry = await readLocalDriveEntryAtPath({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    drivePath: params.path
+  });
+  return localEntry === null;
+}
+async function remoteFileAlreadyApplied(params) {
+  if (!params.version) {
+    return null;
+  }
+  const localEntry = await readLocalDriveEntryAtPath({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    drivePath: params.path
+  });
+  if (localEntry?.entryType !== "file" || localEntry.contentSha256 !== params.version.content_sha256 || localEntry.sizeBytes !== params.version.size_bytes) {
+    return null;
+  }
+  return { sizeBytes: localEntry.sizeBytes ?? params.version.size_bytes };
+}
+async function preserveRemoteApplySteps(params) {
+  let conflictCount = 0;
+  const conflicts = [];
+  const overwriteResults = /* @__PURE__ */ new Map();
+  for (const step of params.steps) {
+    if (step.type === "path_conflict_candidate") {
+      const result2 = await preserveRemoteApplyConflictCandidate({
+        driveId: params.driveId,
+        driveRoot: params.driveRoot,
+        drivePath: step.path,
+        stateStore: params.stateStore,
+        batch: params.batch,
+        reason: step.reason
+      });
+      conflictCount += result2.conflictCount;
+      conflicts.push(...result2.conflicts);
+      continue;
+    }
+    const result = await preserveRemoteApplyOverwriteCandidates({
+      driveId: params.driveId,
+      driveRoot: params.driveRoot,
+      drivePath: step.path,
+      stateStore: params.stateStore,
+      batch: params.batch,
+      reason: step.reason,
+      subtreeReason: step.subtreeReason
+    });
+    conflictCount += result.conflictCount;
+    conflicts.push(...result.conflicts);
+    overwriteResults.set(step.path, {
+      localEntry: result.localEntry,
+      baselineEntry: result.baselineEntry
+    });
+  }
+  return { conflictCount, conflicts, overwriteResults };
+}
+async function preserveRemoteApplyConflictCandidate(params) {
+  const normalizedPath = normalizeDrivePath(params.drivePath);
+  const baselineEntry = params.stateStore.getEntry?.(params.driveId, normalizedPath) ?? null;
+  const localEntry = await readLocalDriveEntryAtPath({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    drivePath: normalizedPath
+  });
+  if (!baselineEntry && !localEntry) {
+    return { conflictCount: 0, conflicts: [] };
+  }
+  if (baselineEntry && localEntry && localEntryMatchesBaseline(localEntry, baselineEntry)) {
+    return { conflictCount: 0, conflicts: [] };
+  }
+  if (!baselineEntry && localEntry?.entryType === "directory") {
+    return { conflictCount: 0, conflicts: [] };
+  }
+  const conflictPath = localEntry?.entryType === "file" ? await writeLocalConflictCopy({
+    driveRoot: params.driveRoot,
+    source: localEntry,
+    sourceRootPath: normalizedPath,
+    conflictRootPath: normalizedPath
+  }) : null;
+  const conflict = recordRemoteApplyConflict({
+    stateStore: params.stateStore,
+    driveId: params.driveId,
+    path: normalizedPath,
+    reason: params.reason,
+    localEntry,
+    baselineEntry,
+    conflictPath,
+    remoteBatchId: params.batch.id,
+    remoteSequence: params.batch.sequence
+  });
+  return { conflictCount: 1, conflicts: [conflict] };
+}
+async function preserveRemoteApplyOverwriteCandidates(params) {
+  const normalizedPath = normalizeDrivePath(params.drivePath);
+  const baselineEntry = params.stateStore.getEntry?.(params.driveId, normalizedPath) ?? null;
+  const localEntry = await readLocalDriveEntryAtPath({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    drivePath: normalizedPath
+  });
+  if (baselineEntry?.entryType === "directory" || localEntry?.entryType === "directory") {
+    const conflictCount = await preserveRemoteApplySubtreeConflictCandidates({
+      driveId: params.driveId,
+      driveRoot: params.driveRoot,
+      drivePath: normalizedPath,
+      stateStore: params.stateStore,
+      batch: params.batch,
+      reason: params.subtreeReason ?? params.reason
+    });
+    return { ...conflictCount, localEntry, baselineEntry };
+  }
+  const conflictResult = await preserveRemoteApplyConflictCandidate({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    drivePath: normalizedPath,
+    stateStore: params.stateStore,
+    batch: params.batch,
+    reason: params.reason
+  });
+  return { ...conflictResult, localEntry, baselineEntry };
+}
+async function preserveRemoteApplySubtreeConflictCandidates(params) {
+  const normalizedPath = normalizeDrivePath(params.drivePath);
+  const baselineEntries = (params.stateStore.listEntries?.(params.driveId) ?? []).filter((entry) => drivePathIsInSubtree(entry.path, normalizedPath));
+  const baselineByPath = new Map(baselineEntries.map((entry) => [entry.path, entry]));
+  const localScan = await scanLocalDriveEntries({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot
+  });
+  for (const deferredPath of localScan.deferredPaths) {
+    if (drivePathIsInSubtree(deferredPath, normalizedPath)) {
+      throw new Error(`Local drive subtree has an unstable file; refusing to delete ${params.drivePath}`);
+    }
+  }
+  let conflictCount = 0;
+  const conflicts = [];
+  for (const [drivePath, localEntry] of localScan.entries) {
+    if (!drivePathIsInSubtree(drivePath, normalizedPath)) {
+      continue;
+    }
+    const baselineEntry = baselineByPath.get(drivePath) ?? null;
+    if (baselineEntry && localEntryMatchesBaseline(localEntry, baselineEntry)) {
+      continue;
+    }
+    if (localEntry.entryType === "directory") {
+      continue;
+    }
+    const conflictPath = localEntry.entryType === "file" ? await writeLocalConflictCopy({
+      driveRoot: params.driveRoot,
+      source: localEntry,
+      sourceRootPath: normalizedPath,
+      conflictRootPath: buildSubtreeConflictRootPath(normalizedPath)
+    }) : null;
+    const conflict = recordRemoteApplyConflict({
+      stateStore: params.stateStore,
+      driveId: params.driveId,
+      path: drivePath,
+      reason: params.reason,
+      localEntry,
+      baselineEntry,
+      conflictPath,
+      remoteBatchId: params.batch.id,
+      remoteSequence: params.batch.sequence
+    });
+    conflicts.push(conflict);
+    conflictCount += 1;
+  }
+  return { conflictCount, conflicts };
+}
+async function reconcileLocalDriveToCloud(params) {
+  const fullBaseline = new Map((params.stateStore.listEntries?.(params.driveId) ?? []).map((entry) => [entry.path, entry]));
+  const baseline = params.dirtyDrivePaths ? filterBaselineForDirtyDrivePaths(fullBaseline, params.dirtyDrivePaths) : fullBaseline;
+  const localScan = await scanLocalDriveEntries({
+    driveId: params.driveId,
+    driveRoot: params.driveRoot,
+    rootDrivePaths: params.dirtyDrivePaths ?? void 0
+  });
+  const conflicts = new Map((params.stateStore.listConflicts?.(params.driveId) ?? []).map((conflict) => [
+    conflict.path,
+    conflict
+  ]));
+  const scopedConflicts = params.dirtyDrivePaths ? filterConflictsForDirtyDrivePaths(conflicts, params.dirtyDrivePaths) : conflicts;
+  const localPlan = planLocalDriveSync({
+    baseline,
+    local: localScan.entries,
+    deferredPaths: localScan.deferredPaths,
+    conflicts: scopedConflicts
+  });
+  const confirmedConflictActions = await applyCloudDriveConflictLifecycleActions({
+    syncClientId: params.syncClientId,
+    driveId: params.driveId,
+    api: params.api,
+    conflicts: scopedConflicts,
+    actions: localPlan.conflictActions
+  });
+  applyLocalDriveConflictActions({
+    stateStore: params.stateStore,
+    actions: confirmedConflictActions
+  });
+  const mutations = localPlan.mutations;
+  if (mutations.length === 0) {
+    return {
+      ...emptyLocalReconcileSummary(),
+      deferredFileCount: localScan.deferredFileCount
+    };
+  }
+  let uploadedBatchCount = 0;
+  let uploadedChangeCount = 0;
+  let uploadedAppliedCount = 0;
+  let uploadedConflictCount = 0;
+  let uploadedUnsupportedCount = 0;
+  let uploadedRejectedCount = 0;
+  let deferredFileCount = localScan.deferredFileCount;
+  const uploadResult = await prepareLocalMutationUploads({
+    syncClientId: params.syncClientId,
+    driveId: params.driveId,
+    api: params.api,
+    mutations
+  });
+  deferredFileCount += uploadResult.deferredPaths.length;
+  const preparedMutations = uploadResult.preparedMutations;
+  if (preparedMutations.length === 0) {
+    return {
+      ...emptyLocalReconcileSummary(),
+      deferredFileCount
+    };
+  }
+  const mutationChunks = chunkLocalDriveMutations(preparedMutations);
+  const resourceOperationChunkFingerprints = mutationChunks.map((chunk, chunkIndex) => buildLocalResourceOperationChunkFingerprint({
+    driveId: params.driveId,
+    baseCursorSequence: params.baseCursorSequence,
+    chunkIndex: chunkIndex + 1,
+    chunkCount: mutationChunks.length,
+    mutations: chunk
+  }));
+  const resourceOperationFingerprint = buildLocalResourceOperationFingerprint({
+    driveId: params.driveId,
+    baseCursorSequence: params.baseCursorSequence,
+    chunkFingerprints: resourceOperationChunkFingerprints
+  });
+  const resourceOperationId = `local-reconcile:${resourceOperationFingerprint}`;
+  let finalizedOperationResponse = null;
+  for (const [chunkIndex, chunk] of mutationChunks.entries()) {
+    const response = await params.api.applyLocalChangeBatch({
+      sync_client_id: params.syncClientId,
+      drive_id: params.driveId,
+      resource_operation_id: resourceOperationId,
+      resource_operation_fingerprint: resourceOperationFingerprint,
+      resource_operation_chunk_fingerprint: resourceOperationChunkFingerprints[chunkIndex],
+      resource_operation_chunk_fingerprints: resourceOperationChunkFingerprints,
+      resource_operation_chunk_index: chunkIndex + 1,
+      resource_operation_chunk_count: mutationChunks.length,
+      base_cursor_sequence: params.baseCursorSequence,
+      changes: chunk.map((mutation) => mutation.request)
+    });
+    uploadedBatchCount += 1;
+    uploadedChangeCount += chunk.length;
+    if (isStagedLocalOperationResponse(response)) {
+      continue;
+    }
+    if (isFinalizedFullLocalOperationResponse(response, preparedMutations.length)) {
+      finalizedOperationResponse = response;
+      continue;
+    }
+    await applyAcceptedLocalChangeResults({
+      driveId: params.driveId,
+      driveRoot: params.driveRoot,
+      mutations: chunk,
+      results: response.results,
+      stateStore: params.stateStore
+    });
+    uploadedAppliedCount += response.applied_count;
+    uploadedConflictCount += response.conflict_count;
+    uploadedUnsupportedCount += response.unsupported_count;
+    uploadedRejectedCount += response.rejected_count;
+  }
+  if (finalizedOperationResponse) {
+    await applyAcceptedLocalChangeResults({
+      driveId: params.driveId,
+      driveRoot: params.driveRoot,
+      mutations: preparedMutations,
+      results: finalizedOperationResponse.results,
+      stateStore: params.stateStore
+    });
+    uploadedAppliedCount += finalizedOperationResponse.applied_count;
+    uploadedConflictCount += finalizedOperationResponse.conflict_count;
+    uploadedUnsupportedCount += finalizedOperationResponse.unsupported_count;
+    uploadedRejectedCount += finalizedOperationResponse.rejected_count;
+  }
+  return {
+    uploadedBatchCount,
+    uploadedChangeCount,
+    uploadedAppliedCount,
+    uploadedConflictCount,
+    uploadedUnsupportedCount,
+    uploadedRejectedCount,
+    deferredFileCount
+  };
+}
+function emptyLocalReconcileSummary() {
+  return {
+    uploadedBatchCount: 0,
+    uploadedChangeCount: 0,
+    uploadedAppliedCount: 0,
+    uploadedConflictCount: 0,
+    uploadedUnsupportedCount: 0,
+    uploadedRejectedCount: 0,
+    deferredFileCount: 0
+  };
+}
+function filterBaselineForDirtyDrivePaths(baseline, dirtyDrivePaths) {
+  if (dirtyDrivePaths.size === 0) {
+    return /* @__PURE__ */ new Map();
+  }
+  const normalizedDirtyPaths = [...dirtyDrivePaths].map(normalizeDrivePath);
+  return new Map([...baseline].filter(([baselinePath]) => normalizedDirtyPaths.some((dirtyPath) => drivePathIsInSubtree(baselinePath, dirtyPath) || drivePathIsInSubtree(dirtyPath, baselinePath))));
+}
+function filterConflictsForDirtyDrivePaths(conflicts, dirtyDrivePaths) {
+  if (dirtyDrivePaths.size === 0) {
+    return /* @__PURE__ */ new Map();
+  }
+  const normalizedDirtyPaths = [...dirtyDrivePaths].map(normalizeDrivePath);
+  return new Map([...conflicts].filter(([, conflict]) => normalizedDirtyPaths.some((dirtyPath) => drivePathsIntersect(conflict.path, dirtyPath) || (conflict.conflictPath ? drivePathsIntersect(conflict.conflictPath, dirtyPath) : false))));
+}
+function drivePathsIntersect(leftPath, rightPath) {
+  return drivePathIsInSubtree(leftPath, rightPath) || drivePathIsInSubtree(rightPath, leftPath);
+}
+async function applyCloudDriveConflictLifecycleActions(params) {
+  if (params.actions.length === 0 || !params.api.applyConflictActions) {
+    return [];
+  }
+  const response = await params.api.applyConflictActions({
+    sync_client_id: params.syncClientId,
+    drive_id: params.driveId,
+    operation_id: buildConflictLifecycleOperationId({
+      driveId: params.driveId,
+      actions: params.actions,
+      conflicts: params.conflicts
+    }),
+    actions: params.actions.map((action) => {
+      const conflict = params.conflicts.get(action.path) ?? null;
+      const payload = {
+        type: action.type,
+        path: action.path,
+        reason: action.reason
+      };
+      if (conflict?.conflictId) {
+        payload.conflict_id = conflict.conflictId;
+      }
+      if (action.type === "update_conflict_path") {
+        payload.conflict_path = action.conflictPath;
+      }
+      return payload;
+    })
+  });
+  return collectConfirmedConflictActions(params.actions, response.results);
+}
+function collectConfirmedConflictActions(actions, results) {
+  const confirmedActions = [];
+  for (const result of results) {
+    if (!isConfirmedConflictActionResult(result)) {
+      continue;
+    }
+    const action = actions[result.index];
+    if (!action || result.type !== action.type) {
+      continue;
+    }
+    if (typeof result.path === "string" && normalizeDrivePath(result.path) !== action.path) {
+      continue;
+    }
+    if (action.type === "clear_conflict") {
+      if (result.status === "resolved" || result.status === "ignored") {
+        confirmedActions.push(action);
+      }
+      continue;
+    }
+    if (result.status !== "updated") {
+      continue;
+    }
+    confirmedActions.push({
+      ...action,
+      conflictPath: typeof result.conflict_path === "string" ? normalizeDrivePath(result.conflict_path) : action.conflictPath
+    });
+  }
+  return confirmedActions;
+}
+function isConfirmedConflictActionResult(result) {
+  return Number.isInteger(result.index) && typeof result.type === "string" && typeof result.status === "string";
+}
+function buildConflictLifecycleOperationId(params) {
+  const stablePayload = params.actions.map((action) => {
+    const conflict = params.conflicts.get(action.path) ?? null;
+    return {
+      type: action.type,
+      path: action.path,
+      reason: action.reason,
+      conflict_id: conflict?.conflictId ?? null,
+      conflict_path: action.type === "update_conflict_path" ? action.conflictPath : null
+    };
+  });
+  const digest = sha256Hex4(Buffer.from(JSON.stringify({
+    driveId: params.driveId,
+    actions: stablePayload
+  })));
+  return `conflict-lifecycle:${digest}`;
+}
+function collectRemoteConflictsForAck(params) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const conflict of params.newConflicts) {
+    if (conflict.conflictType === "remote_apply") {
+      byPath.set(conflict.path, conflict);
+    }
+  }
+  for (const conflict of params.stateStore.listConflicts?.(params.driveId) ?? []) {
+    if (conflict.conflictType !== "remote_apply") {
+      continue;
+    }
+    if (conflict.remoteBatchId === params.batch.id || conflict.remoteSequence === params.batch.sequence) {
+      byPath.set(conflict.path, conflict);
+    }
+  }
+  return [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
+function toRemoteConflictAckPayload(conflict) {
+  return {
+    path: conflict.path,
+    reason: conflict.reason,
+    conflict_path: conflict.conflictPath,
+    local_content_sha256: conflict.localContentSha256,
+    local_size_bytes: conflict.localSizeBytes,
+    local_version_id: isUuid2(conflict.localVersionId) ? conflict.localVersionId : null,
+    remote_batch_id: isUuid2(conflict.remoteBatchId) ? conflict.remoteBatchId : null,
+    remote_sequence: conflict.remoteSequence
+  };
+}
+function buildRemoteConflictAckOperationId(params) {
+  const stablePayload = params.conflicts.map((conflict) => ({
+    path: conflict.path,
+    reason: conflict.reason,
+    conflict_path: conflict.conflictPath,
+    local_content_sha256: conflict.localContentSha256,
+    local_size_bytes: conflict.localSizeBytes,
+    local_version_id: isUuid2(conflict.localVersionId) ? conflict.localVersionId : null,
+    remote_batch_id: isUuid2(conflict.remoteBatchId) ? conflict.remoteBatchId : null,
+    remote_sequence: conflict.remoteSequence
+  }));
+  const digest = sha256Hex4(Buffer.from(JSON.stringify({
+    driveId: params.driveId,
+    batchId: params.batch.id,
+    batchSequence: params.batch.sequence,
+    conflicts: stablePayload
+  })));
+  return `remote-conflict-ack:${digest}`;
+}
+function applyRemoteConflictAckResults(params) {
+  if (!params.results || !params.stateStore.getConflict || !params.stateStore.upsertConflict) {
+    return;
+  }
+  for (const result of params.results) {
+    if (typeof result.path !== "string" || typeof result.conflict_id !== "string") {
+      continue;
+    }
+    const drivePath = normalizeDrivePath(result.path);
+    const existing = params.stateStore.getConflict(params.driveId, drivePath);
+    if (!existing) {
+      continue;
+    }
+    params.stateStore.upsertConflict({
+      ...existing,
+      conflictId: result.conflict_id,
+      conflictPath: typeof result.conflict_path === "string" ? result.conflict_path : existing.conflictPath
+    });
+  }
+}
+function isUuid2(value) {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function isStagedLocalOperationResponse(response) {
+  return response.resource_operation_status === "applying" && response.batch === null;
+}
+function isFinalizedFullLocalOperationResponse(response, preparedMutationCount) {
+  return response.resource_operation_status === "finalized" && response.results.length >= preparedMutationCount;
+}
+function chunkLocalDriveMutations(mutations) {
+  const chunks = [];
+  let currentChunk = [];
+  let currentUploadBytes = 0;
+  for (const mutation of mutations) {
+    if (mutation.uploadBytes > MAX_LOCAL_BATCH_UPLOAD_BYTES) {
+      throw new Error(getDriveLocalSyncFileTooLargeMessage(mutation.uploadBytes));
+    }
+    const nextUploadBytes = currentUploadBytes + mutation.uploadBytes;
+    if (currentChunk.length > 0 && (currentChunk.length >= MAX_LOCAL_BATCH_CHANGES || nextUploadBytes > MAX_LOCAL_BATCH_UPLOAD_BYTES)) {
+      chunks.push(currentChunk);
+      currentChunk = [];
+      currentUploadBytes = 0;
+    }
+    currentChunk.push(mutation);
+    currentUploadBytes += mutation.uploadBytes;
+  }
+  if (currentChunk.length > 0) {
+    chunks.push(currentChunk);
+  }
+  return chunks;
+}
+function buildLocalResourceOperationChunkFingerprint(params) {
+  return sha256Hex4(Buffer.from(stableJsonStringify({
+    drive_id: params.driveId,
+    base_cursor_sequence: params.baseCursorSequence,
+    chunk_index: params.chunkIndex,
+    chunk_count: params.chunkCount,
+    changes: params.mutations.map((mutation) => mutation.request)
+  })));
+}
+function buildLocalResourceOperationFingerprint(params) {
+  return sha256Hex4(Buffer.from(stableJsonStringify({
+    drive_id: params.driveId,
+    base_cursor_sequence: params.baseCursorSequence,
+    chunk_fingerprints: params.chunkFingerprints
+  })));
+}
+async function applyAcceptedLocalChangeResults(params) {
+  for (const result of params.results) {
+    const mutation = params.mutations[result.index];
+    if (!mutation) {
+      continue;
+    }
+    if (result.status === "applied") {
+      applyAppliedLocalDriveMutationState({
+        stateStore: params.stateStore,
+        driveId: params.driveId,
+        mutation,
+        result
+      });
+      continue;
+    }
+    if (result.status === "conflicted") {
+      const conflictPath = resolveLocalMutationResultPath(result, mutation);
+      const localConflictPath = await preserveLocalUploadConflictCandidate({
+        driveRoot: params.driveRoot,
+        mutation,
+        conflictPath
+      });
+      recordLocalUploadConflict({
+        stateStore: params.stateStore,
+        driveId: params.driveId,
+        mutation,
+        result,
+        conflictPath,
+        localConflictPath
+      });
+      continue;
+    }
+    if (result.status === "unsupported" && mutation.stateEntry) {
+      applyUnsupportedLocalDriveMutationState({
+        stateStore: params.stateStore,
+        driveId: params.driveId,
+        mutation
+      });
+    }
+  }
+}
+async function preserveLocalUploadConflictCandidate(params) {
+  if (params.mutation.request.type !== "write_file" || !params.mutation.localFilePath || params.mutation.stateEntry?.entryType !== "file") {
+    return null;
+  }
+  try {
+    return await writeLocalConflictCopy({
+      driveRoot: params.driveRoot,
+      source: {
+        driveId: params.mutation.stateEntry.driveId,
+        path: params.mutation.stateEntry.path,
+        entryType: "file",
+        contentSha256: params.mutation.stateEntry.contentSha256,
+        sizeBytes: params.mutation.stateEntry.sizeBytes,
+        mimeType: params.mutation.stateEntry.mimeType,
+        absolutePath: params.mutation.localFilePath
+      },
+      sourceRootPath: params.conflictPath,
+      conflictRootPath: params.conflictPath
+    });
+  } catch (error) {
+    console.warn(`${MANAGED_GATEWAY_LOG_PREFIX} failed to preserve local upload conflict copy`, {
+      path: params.conflictPath,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return null;
+  }
+}
+function emptyDriveSyncRunSummary(driveCount = 0) {
+  return {
+    driveCount,
+    failedDriveCount: 0,
+    appliedBatchCount: 0,
+    appliedPathCount: 0,
+    remoteConflictCount: 0,
+    uploadedBatchCount: 0,
+    uploadedChangeCount: 0,
+    uploadedAppliedCount: 0,
+    uploadedConflictCount: 0,
+    uploadedUnsupportedCount: 0,
+    uploadedRejectedCount: 0,
+    deferredFileCount: 0
+  };
+}
+function toDriveSyncStatusSummary(summary) {
+  return {
+    applied_batch_count: summary.appliedBatchCount,
+    applied_path_count: summary.appliedPathCount,
+    remote_conflict_count: summary.remoteConflictCount,
+    uploaded_batch_count: summary.uploadedBatchCount,
+    uploaded_change_count: summary.uploadedChangeCount,
+    uploaded_applied_count: summary.uploadedAppliedCount,
+    uploaded_conflict_count: summary.uploadedConflictCount,
+    uploaded_unsupported_count: summary.uploadedUnsupportedCount,
+    uploaded_rejected_count: summary.uploadedRejectedCount,
+    deferred_file_count: summary.deferredFileCount
+  };
+}
+function truncateDriveSyncStatusError(error) {
+  if (!error || error.length <= 2e3) {
+    return error;
+  }
+  return `${error.slice(0, 1997)}...`;
+}
+function deriveDriveSyncStatus(schedulerStatus) {
+  if (!schedulerStatus) {
+    return "active";
+  }
+  return schedulerStatus.watchStatus === "active" ? "active" : "degraded";
+}
+function driveSummaryRequiresDegradedStatus(summary) {
+  return summary.remoteConflictCount > 0 || summary.uploadedConflictCount > 0 || summary.uploadedUnsupportedCount > 0 || summary.uploadedRejectedCount > 0 || summary.deferredFileCount > 0 || summary.failedDriveCount > 0;
+}
+function summarizeDriveSyncConflicts(conflicts) {
+  return {
+    unresolvedConflictCount: conflicts.length,
+    unresolvedConflictSamples: conflicts.slice(0, DRIVE_SYNC_STATUS_CONFLICT_SAMPLE_LIMIT).map((conflict) => ({
+      path: conflict.path,
+      conflict_type: conflict.conflictType,
+      reason: conflict.reason,
+      conflict_path: conflict.conflictPath,
+      conflict_id: conflict.conflictId,
+      remote_sequence: conflict.remoteSequence
+    }))
+  };
+}
+var ManagedDrivePullSyncService = class {
+  params;
+  constructor(params) {
+    this.params = params;
+  }
+  close() {
+    this.params.stateStore.close?.();
+  }
+  async syncOnce(options = {}) {
+    const includeLocalWrites = options.includeLocalWrites !== false;
+    const syncStatus = deriveDriveSyncStatus(options.schedulerStatus);
+    const syncClient = await this.ensureSyncClient();
+    const drivesResponse = await this.params.api.listDrives({ sync_client_id: syncClient.id });
+    this.params.stateStore.setSyncClient(drivesResponse.sync_client);
+    await this.parkStaleDrives(new Set(drivesResponse.drives.map((drive) => drive.resource.id)));
+    let appliedBatchCount = 0;
+    let appliedPathCount = 0;
+    let remoteConflictCount = 0;
+    let uploadedBatchCount = 0;
+    let uploadedChangeCount = 0;
+    let uploadedAppliedCount = 0;
+    let uploadedConflictCount = 0;
+    let uploadedUnsupportedCount = 0;
+    let uploadedRejectedCount = 0;
+    let deferredFileCount = 0;
+    let failedDriveCount = 0;
+    for (const drive of drivesResponse.drives) {
+      const driveRoot = resolveDriveLocalRoot(this.params.config.driveSync.rootDir, drive.resource.id);
+      const dirtyDrivePaths = resolveDirtyDrivePathsForDrive(driveRoot, options.dirtyLocalPaths);
+      const driveSummary = emptyDriveSyncRunSummary(1);
+      let lastBatchSequence = drive.cursor?.last_batch_sequence ?? 0;
+      try {
+        await mkdir3(driveRoot, { recursive: true });
+        this.params.stateStore.upsertDrive({
+          id: drive.resource.id,
+          title: drive.resource.title,
+          rootPath: driveRoot
+        });
+        const result = await this.syncDrive({
+          syncClientId: syncClient.id,
+          driveId: drive.resource.id,
+          driveRoot
+        });
+        lastBatchSequence = result.lastBatchSequence;
+        driveSummary.appliedBatchCount += result.appliedBatchCount;
+        driveSummary.appliedPathCount += result.appliedPathCount;
+        driveSummary.remoteConflictCount += result.remoteConflictCount;
+        if (includeLocalWrites && (!dirtyDrivePaths || dirtyDrivePaths.size > 0)) {
+          const localResult = await reconcileLocalDriveToCloud({
+            syncClientId: syncClient.id,
+            driveId: drive.resource.id,
+            driveRoot,
+            baseCursorSequence: result.lastBatchSequence,
+            api: this.params.api,
+            stateStore: this.params.stateStore,
+            dirtyDrivePaths
+          });
+          driveSummary.uploadedBatchCount += localResult.uploadedBatchCount;
+          driveSummary.uploadedChangeCount += localResult.uploadedChangeCount;
+          driveSummary.uploadedAppliedCount += localResult.uploadedAppliedCount;
+          driveSummary.uploadedConflictCount += localResult.uploadedConflictCount;
+          driveSummary.uploadedUnsupportedCount += localResult.uploadedUnsupportedCount;
+          driveSummary.uploadedRejectedCount += localResult.uploadedRejectedCount;
+          driveSummary.deferredFileCount += localResult.deferredFileCount;
+          if (localResult.uploadedBatchCount > 0) {
+            const followUpResult = await this.syncDrive({
+              syncClientId: syncClient.id,
+              driveId: drive.resource.id,
+              driveRoot
+            });
+            lastBatchSequence = followUpResult.lastBatchSequence;
+            driveSummary.appliedBatchCount += followUpResult.appliedBatchCount;
+            driveSummary.appliedPathCount += followUpResult.appliedPathCount;
+            driveSummary.remoteConflictCount += followUpResult.remoteConflictCount;
+          }
+        }
+        appliedBatchCount += driveSummary.appliedBatchCount;
+        appliedPathCount += driveSummary.appliedPathCount;
+        remoteConflictCount += driveSummary.remoteConflictCount;
+        uploadedBatchCount += driveSummary.uploadedBatchCount;
+        uploadedChangeCount += driveSummary.uploadedChangeCount;
+        uploadedAppliedCount += driveSummary.uploadedAppliedCount;
+        uploadedConflictCount += driveSummary.uploadedConflictCount;
+        uploadedUnsupportedCount += driveSummary.uploadedUnsupportedCount;
+        uploadedRejectedCount += driveSummary.uploadedRejectedCount;
+        deferredFileCount += driveSummary.deferredFileCount;
+        await this.reportDriveSyncStatus({
+          syncClientId: syncClient.id,
+          driveId: drive.resource.id,
+          driveRoot,
+          status: syncStatus,
+          lastBatchSequence,
+          summary: driveSummary,
+          lastReason: includeLocalWrites ? "sync_once" : "sync_once_remote_only",
+          lastError: null,
+          schedulerStatus: options.schedulerStatus
+        });
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        failedDriveCount += 1;
+        await this.reportDriveSyncStatus({
+          syncClientId: syncClient.id,
+          driveId: drive.resource.id,
+          driveRoot,
+          status: "error",
+          lastBatchSequence,
+          summary: driveSummary,
+          lastReason: "sync_error",
+          lastError: errorMessage,
+          schedulerStatus: options.schedulerStatus
+        });
+        console.error(`${MANAGED_GATEWAY_LOG_PREFIX} failed to sync drive`, {
+          driveId: drive.resource.id,
+          error: errorMessage
+        });
+      }
+    }
+    return {
+      driveCount: drivesResponse.drives.length,
+      failedDriveCount,
+      appliedBatchCount,
+      appliedPathCount,
+      remoteConflictCount,
+      uploadedBatchCount,
+      uploadedChangeCount,
+      uploadedAppliedCount,
+      uploadedConflictCount,
+      uploadedUnsupportedCount,
+      uploadedRejectedCount,
+      deferredFileCount
+    };
+  }
+  async reportDriveSyncStatus(params) {
+    try {
+      const unresolvedConflictSummary = summarizeDriveSyncConflicts(this.params.stateStore.listConflicts?.(params.driveId) ?? []);
+      const status = params.status === "active" && (unresolvedConflictSummary.unresolvedConflictCount > 0 || driveSummaryRequiresDegradedStatus(params.summary)) ? "degraded" : params.status;
+      await this.params.api.reportStatus({
+        sync_client_id: params.syncClientId,
+        drive_id: params.driveId,
+        status,
+        last_reason: params.lastReason,
+        last_error: truncateDriveSyncStatusError(params.lastError),
+        last_batch_sequence: params.lastBatchSequence,
+        summary: toDriveSyncStatusSummary(params.summary),
+        metadata: {
+          root_path: params.driveRoot,
+          runtime_id: this.params.config.runtimeId,
+          host_id: this.params.config.hostId,
+          agent_id: this.params.config.agentId,
+          watcher_status: params.schedulerStatus?.watchStatus ?? null,
+          watcher_degraded: params.schedulerStatus ? params.schedulerStatus.watchStatus !== "active" : null,
+          watcher_error: truncateDriveSyncStatusError(params.schedulerStatus?.watchError ?? null),
+          unresolved_conflict_count: unresolvedConflictSummary.unresolvedConflictCount,
+          unresolved_conflicts: unresolvedConflictSummary.unresolvedConflictSamples
+        }
+      });
+    } catch (error) {
+      console.warn(`${MANAGED_GATEWAY_LOG_PREFIX} failed to report drive sync status`, {
+        driveId: params.driveId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  async parkStaleDrives(accessibleDriveIds) {
+    const knownDrives = this.params.stateStore.listDrives?.() ?? [];
+    for (const knownDrive of knownDrives) {
+      if (accessibleDriveIds.has(knownDrive.id)) {
+        continue;
+      }
+      const parkedPath = await parkStaleDriveLocalFolder(this.params.config.driveSync.rootDir, knownDrive.id);
+      this.params.stateStore.removeDrive?.(knownDrive.id);
+      console.warn(`${MANAGED_GATEWAY_LOG_PREFIX} parked stale drive folder`, {
+        driveId: knownDrive.id,
+        parkedPath
+      });
+    }
+  }
+  async ensureSyncClient() {
+    const clientKey = this.params.config.driveSync.clientKey ?? this.params.stateStore.getOrCreateClientKey?.(`managed:${this.params.config.hostId}:${this.params.config.agentId}`) ?? `managed:${this.params.config.hostId}:${this.params.config.agentId}`;
+    const response = await this.params.api.registerClient({
+      agent_id: this.params.config.agentId,
+      host_id: this.params.config.hostId,
+      client_key: clientKey,
+      display_name: `${hostname2()} managed drive sync`,
+      metadata: {
+        mode: "managed_gateway_pull",
+        runtime_id: this.params.config.runtimeId,
+        process_id: process17.pid
+      }
+    });
+    this.params.stateStore.setSyncClient(response.sync_client);
+    return response.sync_client;
+  }
+  async syncDrive(params) {
+    let appliedBatchCount = 0;
+    let appliedPathCount = 0;
+    let remoteConflictCount = 0;
+    let lastAckedSequence = 0;
+    while (appliedBatchCount < this.params.config.driveSync.maxBatchesPerTick) {
+      const remainingBatchCapacity = this.params.config.driveSync.maxBatchesPerTick - appliedBatchCount;
+      const response = await this.params.api.getChanges({
+        sync_client_id: params.syncClientId,
+        drive_id: params.driveId,
+        limit: Math.min(this.params.config.driveSync.changeLimit, remainingBatchCapacity)
+      });
+      lastAckedSequence = response.cursor.last_batch_sequence;
+      if (response.changes.length === 0) {
+        this.params.stateStore.setCursor(params.driveId, lastAckedSequence);
+        break;
+      }
+      for (const batch of response.changes) {
+        try {
+          const result = await applyDriveChangeBatchToLocalFilesystem({
+            syncClientId: params.syncClientId,
+            driveRoot: params.driveRoot,
+            batch,
+            api: this.params.api,
+            stateStore: this.params.stateStore
+          });
+          const remoteConflicts = collectRemoteConflictsForAck({
+            driveId: params.driveId,
+            batch,
+            newConflicts: result.remoteConflicts,
+            stateStore: this.params.stateStore
+          });
+          const ackResponse = await this.params.api.ackChanges({
+            sync_client_id: params.syncClientId,
+            drive_id: params.driveId,
+            operation_id: remoteConflicts.length > 0 ? buildRemoteConflictAckOperationId({
+              driveId: params.driveId,
+              batch,
+              conflicts: remoteConflicts
+            }) : void 0,
+            last_batch_sequence: batch.sequence,
+            last_error: null,
+            remote_conflicts: remoteConflicts.length > 0 ? remoteConflicts.map(toRemoteConflictAckPayload) : void 0
+          });
+          applyRemoteConflictAckResults({
+            driveId: params.driveId,
+            stateStore: this.params.stateStore,
+            results: ackResponse.remote_conflicts
+          });
+          lastAckedSequence = ackResponse.cursor.last_batch_sequence;
+          this.params.stateStore.setCursor(params.driveId, lastAckedSequence);
+          appliedBatchCount += 1;
+          appliedPathCount += result.appliedPathCount;
+          remoteConflictCount += result.remoteConflictCount;
+        } catch (error) {
+          await this.params.api.ackChanges({
+            sync_client_id: params.syncClientId,
+            drive_id: params.driveId,
+            last_batch_sequence: lastAckedSequence,
+            last_error: error instanceof Error ? error.message : String(error)
+          });
+          throw error;
+        }
+      }
+      if (!response.has_more) {
+        break;
+      }
+    }
+    return {
+      appliedBatchCount,
+      appliedPathCount,
+      remoteConflictCount,
+      lastBatchSequence: lastAckedSequence
+    };
+  }
+};
+async function invokeDriveSyncFunction(supabase, functionName, body, timeoutMs) {
+  const { data, error } = await withTimeout(supabase.functions.invoke(functionName, { body }), timeoutMs, `${functionName} invocation`);
+  if (error) {
+    throw new Error(`${functionName} failed: ${await formatSupabaseFunctionError(error)}`);
+  }
+  if (!data?.success) {
+    throw new Error(`${functionName} returned an invalid response`);
+  }
+  return data;
+}
+async function withTimeout(promise, timeoutMs, label) {
+  let timer = null;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`${label} timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer) {
+      clearTimeout(timer);
+    }
+  }
+}
+async function formatSupabaseFunctionError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const context = isRecord2(error) ? error.context : null;
+  if (!(context instanceof Response)) {
+    return message;
+  }
+  const responseBody = await context.text().catch(() => null);
+  const bodySuffix = responseBody && responseBody.trim().length > 0 ? ` body=${responseBody.trim().slice(0, 1e3)}` : "";
+  return `${message} (status=${context.status}${bodySuffix})`;
+}
+function sha256Hex4(bytes) {
+  return createHash3("sha256").update(bytes).digest("hex");
+}
+function stableJsonStringify(input) {
+  if (input === void 0) {
+    return "null";
+  }
+  if (input === null || typeof input !== "object") {
+    return JSON.stringify(input);
+  }
+  if (Array.isArray(input)) {
+    return `[${input.map((value) => stableJsonStringify(value)).join(",")}]`;
+  }
+  const record = input;
+  return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${stableJsonStringify(record[key])}`).join(",")}}`;
+}
+function logDriveSyncRunSummary(summary) {
+  if (summary.driveCount === 0 || summary.appliedBatchCount === 0 && summary.uploadedBatchCount === 0 && summary.remoteConflictCount === 0 && summary.deferredFileCount === 0 && summary.failedDriveCount === 0) {
+    return;
+  }
+  console.log(`${MANAGED_GATEWAY_LOG_PREFIX} applied drive sync changes`, {
+    driveCount: summary.driveCount,
+    failedDriveCount: summary.failedDriveCount,
+    appliedBatchCount: summary.appliedBatchCount,
+    appliedPathCount: summary.appliedPathCount,
+    remoteConflictCount: summary.remoteConflictCount,
+    uploadedBatchCount: summary.uploadedBatchCount,
+    uploadedChangeCount: summary.uploadedChangeCount,
+    uploadedAppliedCount: summary.uploadedAppliedCount,
+    uploadedConflictCount: summary.uploadedConflictCount,
+    uploadedUnsupportedCount: summary.uploadedUnsupportedCount,
+    uploadedRejectedCount: summary.uploadedRejectedCount,
+    deferredFileCount: summary.deferredFileCount
+  });
+}
+
+// ../shared/dist/control-signals.js
+var CONTROL_ACTIONS = /* @__PURE__ */ new Set(["continue", "pause", "stop"]);
+function parseControlSignalCandidate(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  const rawNextAction = value.nextAction;
+  if (typeof rawNextAction !== "string" || !CONTROL_ACTIONS.has(rawNextAction)) {
+    return null;
+  }
+  const pauseDurationValue = value.pauseDuration ?? value.seconds;
+  const pauseDuration = typeof pauseDurationValue === "number" && Number.isFinite(pauseDurationValue) && pauseDurationValue > 0 ? pauseDurationValue : void 0;
+  return {
+    nextAction: rawNextAction,
+    pauseDuration
+  };
+}
+
+// dist/managed-runtime/shell-execution.js
+import { spawn as spawn4 } from "node:child_process";
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { readFile, unlink } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+var DEFAULT_SIGTERM_GRACE_MS = 5e3;
+var DEFAULT_OUTPUT_CAPTURE_BYTES2 = 5e6;
+var CONTROL_SIGNAL_PATH_ENV = "PANORAMA_CONTROL_SIGNAL_PATH";
+async function executeCommand(command, timeoutMs, options = {}) {
+  const startedAt = Date.now();
+  const outputCaptureBytes = options.outputCaptureBytes ?? DEFAULT_OUTPUT_CAPTURE_BYTES2;
+  return await new Promise((resolve) => {
+    const child = spawn4("bash", ["-lc", command], {
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: true,
+      env: options.env
+    });
+    const stdoutOutput = new BoundedOutputCapture(outputCaptureBytes);
+    const stderrOutput = new BoundedOutputCapture(outputCaptureBytes);
+    let resolved = false;
+    let timedOut = false;
+    let spawnError = null;
+    let interrupted = false;
+    let forceKillHandle = null;
+    const finish = (result) => {
+      if (resolved)
+        return;
+      resolved = true;
+      clearTimeout(timeoutHandle);
+      if (forceKillHandle) {
+        clearTimeout(forceKillHandle);
+        forceKillHandle = null;
+      }
+      options.registerCancellation?.(null);
+      resolve(result);
+    };
+    const killProcessGroup = (signal) => {
+      if (!child.pid)
+        return;
+      try {
+        process.kill(-child.pid, signal);
+      } catch {
+        try {
+          child.kill(signal);
+        } catch {
+        }
+      }
+    };
+    const scheduleForceKill = () => {
+      if (forceKillHandle)
+        return;
+      forceKillHandle = setTimeout(() => {
+        forceKillHandle = null;
+        killProcessGroup("SIGKILL");
+      }, DEFAULT_SIGTERM_GRACE_MS);
+      forceKillHandle.unref();
+    };
+    const timeoutHandle = setTimeout(() => {
+      if (resolved)
+        return;
+      timedOut = true;
+      killProcessGroup("SIGTERM");
+      scheduleForceKill();
+    }, timeoutMs);
+    options.registerCancellation?.(() => {
+      if (resolved || interrupted)
+        return;
+      interrupted = true;
+      killProcessGroup("SIGTERM");
+      scheduleForceKill();
+    });
+    child.stdout?.on("data", (chunk) => {
+      stdoutOutput.append(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrOutput.append(chunk);
+    });
+    child.on("error", (error) => {
+      spawnError = error.message;
+    });
+    child.on("close", (code) => {
+      const stdout = stdoutOutput.readText();
+      const stderr = stderrOutput.readText();
+      const durationMs = Date.now() - startedAt;
+      const commonResult = {
+        stdout,
+        stderr,
+        stdoutObservedBytes: stdoutOutput.observedBytes,
+        stderrObservedBytes: stderrOutput.observedBytes,
+        stdoutCapturedBytes: stdoutOutput.capturedBytes,
+        stderrCapturedBytes: stderrOutput.capturedBytes,
+        stdoutTruncated: stdoutOutput.truncated,
+        stderrTruncated: stderrOutput.truncated,
+        outputCaptureBytes,
+        exitCode: code,
+        durationMs
+      };
+      if (timedOut) {
+        finish({
+          ...commonResult,
+          status: "timed_out",
+          error: `Command timed out after ${timeoutMs}ms`
+        });
+        return;
+      }
+      if (interrupted) {
+        finish({
+          ...commonResult,
+          status: "cancelled",
+          error: "Command was interrupted because the managed gateway host was stopping."
+        });
+        return;
+      }
+      if (spawnError) {
+        finish({
+          ...commonResult,
+          status: "failed",
+          error: spawnError
+        });
+        return;
+      }
+      finish({
+        ...commonResult,
+        status: code === 0 ? "succeeded" : "failed",
+        error: code === 0 ? null : `Command exited with code ${code ?? "unknown"}`
+      });
+    });
+  });
+}
+function buildManagedShellExecutionEnv(params) {
+  const safeEnv = {};
+  const passthroughKeys = [
+    "HOME",
+    "HOSTNAME",
+    "LANG",
+    "LC_ALL",
+    "LOGNAME",
+    "PATH",
+    "PWD",
+    "SHELL",
+    "SHLVL",
+    "TERM",
+    "TMPDIR",
+    "USER"
+  ];
+  for (const key of passthroughKeys) {
+    const value = params.baseEnv[key];
+    if (typeof value === "string" && value.length > 0) {
+      safeEnv[key] = value;
+    }
+  }
+  safeEnv.PANORAMA_AGENT_ID = params.agentId;
+  safeEnv.PANORAMA_TOOL_EXECUTION_URL = params.toolExecutionUrl;
+  safeEnv.PANORAMA_TOOL_EXECUTION_TOKEN = params.toolExecutionToken;
+  safeEnv[CONTROL_SIGNAL_PATH_ENV] = params.controlSignalPath;
+  if (params.cycleId) {
+    safeEnv.PANORAMA_AGENT_CYCLE_ID = params.cycleId;
+  }
+  return safeEnv;
+}
+function buildControlSignalPath(executionId) {
+  return join(tmpdir(), `panorama-control-${executionId}-${randomUUID7()}.json`);
+}
+async function readCommandControlSignal(path21) {
+  try {
+    const raw = await readFile(path21, "utf8");
+    return parseControlSignalCandidate(JSON.parse(raw));
+  } catch {
+    return null;
+  } finally {
+    try {
+      await unlink(path21);
+    } catch {
+    }
+  }
+}
+
+// dist/managed-runtime/dependencies.js
+var defaultManagedGatewayRuntimeDependencies = {
+  heartbeatLinuxHost,
+  dispatchLinuxExecution,
+  startLinuxExecution,
   completeLinuxExecution,
   reconcileExecutionLifecycle,
   executeCommand,
   createRealtimeClient: createManagedRealtimeClient,
   startRealtimeWakeLoop: startManagedRealtimeWakeLoop,
+  createDriveSyncService: createManagedDriveSyncService,
   registerSignalHandlers(onSignal) {
     process.once("SIGINT", onSignal);
     process.once("SIGTERM", onSignal);
@@ -10576,7 +13389,7 @@ function resolveManagedGatewayRuntimeDependencies(dependencies = {}) {
 }
 
 // dist/managed-runtime/execution-dispatcher.js
-import process17 from "node:process";
+import process18 from "node:process";
 
 // ../shared/dist/cycle-step-artifacts.js
 var RESERVED_TOOL_RESULT_METADATA_KEYS = /* @__PURE__ */ new Set([
@@ -10967,7 +13780,7 @@ async function executeManagedLinuxExecution(params) {
   try {
     result = await dependencies.executeCommand(command, config.execTimeoutMs, {
       env: buildManagedShellExecutionEnv({
-        baseEnv: process17.env,
+        baseEnv: process18.env,
         agentId: config.agentId,
         cycleId: startedExecution.cycle_id,
         toolExecutionUrl: config.toolExecutionUrl,
@@ -11055,6 +13868,295 @@ async function executeManagedLinuxExecution(params) {
   return { reconciliationRequired: false };
 }
 
+// dist/managed-runtime/drive-sync-scheduler.js
+import { lstatSync, readdirSync, watch } from "node:fs";
+import path19 from "node:path";
+function startManagedDriveSyncScheduler(params) {
+  let stopped = false;
+  let running = false;
+  let pendingReason = null;
+  let pendingRequiresLocalWrites = false;
+  let pendingRequiresFullLocalScan = false;
+  let pendingDirtyLocalPaths = /* @__PURE__ */ new Set();
+  let pendingWaiters = [];
+  let debounceTimer = null;
+  let pollTimer = null;
+  let currentRun = null;
+  let watchHandle = null;
+  let watchStatus = "unavailable";
+  let lastReason = null;
+  let lastStartedAt = null;
+  let lastFinishedAt = null;
+  let lastError = null;
+  let watchError = null;
+  let lastSummary = null;
+  let lastSuccessfulLocalWriteSyncAt = Date.now();
+  let hasCompletedLocalWriteSync = false;
+  const localAuditIntervalMs = params.localAuditIntervalMs ?? 3e5;
+  const completeWaiters = (waiters, result) => {
+    for (const waiter of waiters) {
+      waiter.resolve(result);
+    }
+  };
+  const clearDebounceTimer = () => {
+    if (!debounceTimer) {
+      return;
+    }
+    clearTimeout(debounceTimer);
+    debounceTimer = null;
+  };
+  const runPendingSync = async () => {
+    if (stopped || running || !pendingReason) {
+      return;
+    }
+    clearDebounceTimer();
+    const reason = pendingReason;
+    const includeLocalWrites = pendingRequiresLocalWrites;
+    const dirtyLocalPaths = pendingRequiresFullLocalScan ? void 0 : [...pendingDirtyLocalPaths];
+    const waiters = pendingWaiters;
+    pendingReason = null;
+    pendingRequiresLocalWrites = false;
+    pendingRequiresFullLocalScan = false;
+    pendingDirtyLocalPaths = /* @__PURE__ */ new Set();
+    pendingWaiters = [];
+    running = true;
+    lastReason = reason;
+    lastStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+    lastError = null;
+    const run2 = (async () => {
+      let result = {
+        status: "failed",
+        error: "Drive sync did not produce a result"
+      };
+      try {
+        const syncOptions = {
+          includeLocalWrites,
+          dirtyLocalPaths,
+          schedulerStatus: {
+            watchStatus,
+            watchError
+          }
+        };
+        const summary = await params.service.syncOnce(syncOptions);
+        lastSummary = summary;
+        logDriveSyncRunSummary(summary);
+        result = summary.failedDriveCount > 0 ? {
+          status: "degraded",
+          summary,
+          error: `${summary.failedDriveCount} drive sync${summary.failedDriveCount === 1 ? "" : "s"} failed`
+        } : { status: "success", summary };
+      } catch (error) {
+        const normalizedError = asError(error);
+        lastError = normalizedError.message;
+        result = { status: "failed", error: normalizedError.message };
+        console.error(`${MANAGED_GATEWAY_LOG_PREFIX} failed to sync drives`, {
+          reason,
+          error: normalizedError
+        });
+      } finally {
+        if (includeLocalWrites && (result.status === "success" || result.status === "degraded" && result.summary.failedDriveCount === 0)) {
+          lastSuccessfulLocalWriteSyncAt = Date.now();
+          hasCompletedLocalWriteSync = true;
+        }
+        lastFinishedAt = (/* @__PURE__ */ new Date()).toISOString();
+        running = false;
+        completeWaiters(waiters, result);
+        if (pendingReason && !stopped) {
+          schedulePendingSync(false);
+        }
+      }
+    })();
+    currentRun = run2;
+    await run2;
+    if (currentRun === run2) {
+      currentRun = null;
+    }
+  };
+  const schedulePendingSync = (immediate) => {
+    if (stopped || running || !pendingReason) {
+      return;
+    }
+    if (immediate) {
+      clearDebounceTimer();
+      void runPendingSync();
+      return;
+    }
+    if (debounceTimer) {
+      return;
+    }
+    debounceTimer = setTimeout(() => {
+      debounceTimer = null;
+      void runPendingSync();
+    }, params.debounceMs);
+    debounceTimer.unref?.();
+  };
+  const requestSync = (reason, options = {}) => {
+    if (stopped) {
+      return Promise.resolve({ status: "skipped", reason: "scheduler_stopped" });
+    }
+    pendingReason = reason;
+    const requiresLocalWrites = requestRequiresLocalWrites({
+      reason,
+      watchStatus,
+      lastSuccessfulLocalWriteSyncAt,
+      hasCompletedLocalWriteSync,
+      localAuditIntervalMs
+    });
+    pendingRequiresLocalWrites = pendingRequiresLocalWrites || requiresLocalWrites;
+    if (options.dirtyLocalPaths && !pendingRequiresFullLocalScan) {
+      for (const dirtyPath of options.dirtyLocalPaths) {
+        pendingDirtyLocalPaths.add(dirtyPath);
+      }
+    } else if (requiresLocalWrites) {
+      pendingRequiresFullLocalScan = true;
+      pendingDirtyLocalPaths.clear();
+    }
+    const promise = new Promise((resolve) => {
+      pendingWaiters.push({ resolve });
+    });
+    schedulePendingSync(options.immediate === true);
+    return promise;
+  };
+  const startWatching = () => {
+    try {
+      watchHandle = (params.dependencies?.watchRoot ?? watchDriveRoot)(params.rootDir, (reason, dirtyPath) => {
+        void requestSync(reason, {
+          dirtyLocalPaths: dirtyPath ? [dirtyPath] : void 0
+        });
+      }, (error) => {
+        const normalizedError = asError(error);
+        watchStatus = "error";
+        watchError = normalizedError.message;
+        console.error(`${MANAGED_GATEWAY_LOG_PREFIX} drive sync filesystem watcher failed`, {
+          rootDir: params.rootDir,
+          error: normalizedError
+        });
+      });
+      watchStatus = watchHandle ? "active" : "unavailable";
+      watchError = watchHandle ? null : "filesystem watcher unavailable";
+    } catch (error) {
+      const normalizedError = asError(error);
+      watchStatus = "unavailable";
+      watchError = normalizedError.message;
+      console.warn(`${MANAGED_GATEWAY_LOG_PREFIX} drive sync filesystem watcher unavailable`, {
+        rootDir: params.rootDir,
+        error: normalizedError
+      });
+    }
+  };
+  startWatching();
+  pollTimer = setInterval(() => {
+    void requestSync("drive_sync_poll", { immediate: true });
+  }, params.pollIntervalMs);
+  pollTimer.unref?.();
+  return {
+    requestSync,
+    getStatus() {
+      return {
+        running,
+        pending: pendingReason !== null,
+        watchStatus,
+        lastReason,
+        lastStartedAt,
+        lastFinishedAt,
+        lastError,
+        watchError,
+        lastSummary
+      };
+    },
+    async stop() {
+      stopped = true;
+      clearDebounceTimer();
+      if (pollTimer) {
+        clearInterval(pollTimer);
+        pollTimer = null;
+      }
+      watchHandle?.close();
+      watchHandle = null;
+      completeWaiters(pendingWaiters, { status: "skipped", reason: "scheduler_stopped" });
+      pendingWaiters = [];
+      pendingReason = null;
+      pendingRequiresLocalWrites = false;
+      pendingRequiresFullLocalScan = false;
+      pendingDirtyLocalPaths.clear();
+      await currentRun;
+    }
+  };
+}
+function requestRequiresLocalWrites(params) {
+  if (params.reason !== "drive_sync_poll") {
+    return true;
+  }
+  if (!params.hasCompletedLocalWriteSync && params.watchStatus !== "active") {
+    return true;
+  }
+  return Date.now() - params.lastSuccessfulLocalWriteSyncAt >= params.localAuditIntervalMs;
+}
+function watchDriveRoot(rootDir, onChange, onError) {
+  const watchers = /* @__PURE__ */ new Map();
+  let closed = false;
+  let refreshTimer = null;
+  const addDirectoryTree = (directoryPath) => {
+    if (closed || watchers.has(directoryPath)) {
+      return;
+    }
+    const directoryStat = lstatSync(directoryPath);
+    if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) {
+      return;
+    }
+    const watcher = watch(directoryPath, (_eventType, filename) => {
+      const dirtyPath = typeof filename === "string" || Buffer.isBuffer(filename) ? path19.join(directoryPath, filename.toString()) : directoryPath;
+      onChange("drive_sync_filesystem_change", dirtyPath);
+      scheduleRefresh();
+    });
+    watcher.on("error", (error) => {
+      watchers.delete(directoryPath);
+      onError(asError(error));
+    });
+    watchers.set(directoryPath, watcher);
+    for (const child of readdirSync(directoryPath, { withFileTypes: true })) {
+      if (!child.isDirectory()) {
+        continue;
+      }
+      addDirectoryTree(path19.join(directoryPath, child.name));
+    }
+  };
+  const refreshDirectoryTree = () => {
+    if (closed) {
+      return;
+    }
+    try {
+      addDirectoryTree(rootDir);
+    } catch (error) {
+      onError(asError(error));
+    }
+  };
+  const scheduleRefresh = () => {
+    if (closed || refreshTimer) {
+      return;
+    }
+    refreshTimer = setTimeout(() => {
+      refreshTimer = null;
+      refreshDirectoryTree();
+    }, 250);
+    refreshTimer.unref?.();
+  };
+  addDirectoryTree(rootDir);
+  return {
+    close() {
+      closed = true;
+      if (refreshTimer) {
+        clearTimeout(refreshTimer);
+        refreshTimer = null;
+      }
+      for (const watcher of watchers.values()) {
+        watcher.close();
+      }
+      watchers.clear();
+    }
+  };
+}
+
 // dist/managed-runtime/heartbeat.js
 import { setTimeout as sleep2 } from "node:timers/promises";
 function startHostHeartbeatLoop(params) {
@@ -11201,6 +14303,8 @@ async function startManagedGatewayRuntime(config = resolveManagedGatewayRuntimeC
   let stopHeartbeat = null;
   let stopRealtimeWakeLoop = null;
   let unsubscribeAuthStateChange = null;
+  let driveSyncService = null;
+  let driveSyncScheduler = null;
   const removeSignalHandlers = runtimeDependencies.registerSignalHandlers(onSignal);
   try {
     await heartbeatHost();
@@ -11219,6 +14323,30 @@ async function startManagedGatewayRuntime(config = resolveManagedGatewayRuntimeC
       controlTimeoutMs: config.controlTimeoutMs
     });
     unsubscribeAuthStateChange = realtimeClient.unsubscribeAuthStateChange;
+    if (config.driveSync.enabled) {
+      driveSyncService = await runtimeDependencies.createDriveSyncService({
+        config,
+        supabase: realtimeClient.supabase
+      });
+      console.log(`${MANAGED_GATEWAY_LOG_PREFIX} enabled managed drive sync`, {
+        rootDir: config.driveSync.rootDir,
+        stateDir: config.driveSync.stateDir,
+        clientKey: config.driveSync.clientKey ?? "<local-state-derived>",
+        changeLimit: config.driveSync.changeLimit,
+        maxBatchesPerTick: config.driveSync.maxBatchesPerTick,
+        debounceMs: config.driveSync.debounceMs,
+        pollIntervalMs: config.driveSync.pollIntervalMs,
+        localAuditIntervalMs: config.driveSync.localAuditIntervalMs
+      });
+      await mkdir4(config.driveSync.rootDir, { recursive: true });
+      driveSyncScheduler = startManagedDriveSyncScheduler({
+        service: driveSyncService,
+        rootDir: config.driveSync.rootDir,
+        debounceMs: config.driveSync.debounceMs,
+        pollIntervalMs: config.driveSync.pollIntervalMs,
+        localAuditIntervalMs: config.driveSync.localAuditIntervalMs
+      });
+    }
     stopRealtimeWakeLoop = runtimeDependencies.startRealtimeWakeLoop({
       supabase: realtimeClient.supabase,
       hostId: config.hostId,
@@ -11271,9 +14399,22 @@ async function startManagedGatewayRuntime(config = resolveManagedGatewayRuntimeC
       if (draining) {
         continue;
       }
+      if (driveSyncScheduler && !activeExecutionId) {
+        const syncResult = await driveSyncScheduler.requestSync("runtime_wake", { immediate: true });
+        if (syncResult.status === "failed") {
+          console.warn(`${MANAGED_GATEWAY_LOG_PREFIX} continuing managed execution after drive sync failure`, {
+            error: syncResult.error
+          });
+        } else if (syncResult.status === "degraded") {
+          console.warn(`${MANAGED_GATEWAY_LOG_PREFIX} continuing managed execution with degraded drive sync`, {
+            error: syncResult.error,
+            failedDriveCount: syncResult.summary.failedDriveCount
+          });
+        }
+      }
       while (!shutdownRequested && !draining) {
         try {
-          const claimToken = randomUUID5();
+          const claimToken = randomUUID8();
           const execution = await runtimeDependencies.dispatchLinuxExecution({
             controlUrl: config.hostControlUrl,
             controlToken: config.hostControlToken,
@@ -11321,6 +14462,8 @@ async function startManagedGatewayRuntime(config = resolveManagedGatewayRuntimeC
   } finally {
     stopHeartbeat?.();
     await stopRealtimeWakeLoop?.();
+    await driveSyncScheduler?.stop();
+    driveSyncService?.close();
     unsubscribeAuthStateChange?.();
     removeSignalHandlers();
     console.log(`${MANAGED_GATEWAY_LOG_PREFIX} stopped managed gateway runtime`, {
@@ -11464,20 +14607,20 @@ function resolveGatewayPaths2(options) {
   return resolveGatewayPaths(getActiveOptions(options));
 }
 function resolveGatewayFallbackConfigDir() {
-  if (process18.platform === "darwin") {
-    return path16.join(os8.homedir(), "Library", "Application Support", "Panorama Gateway");
+  if (process19.platform === "darwin") {
+    return path20.join(os8.homedir(), "Library", "Application Support", "Panorama Gateway");
   }
-  if (process18.platform === "win32") {
-    const base = process18.env.APPDATA || path16.join(os8.homedir(), "AppData", "Roaming");
-    return path16.join(base, "Panorama Gateway");
+  if (process19.platform === "win32") {
+    const base = process19.env.APPDATA || path20.join(os8.homedir(), "AppData", "Roaming");
+    return path20.join(base, "Panorama Gateway");
   }
-  const dataHome = process18.env.XDG_DATA_HOME || path16.join(os8.homedir(), ".local", "share");
-  return path16.join(dataHome, "panorama-gateway");
+  const dataHome = process19.env.XDG_DATA_HOME || path20.join(os8.homedir(), ".local", "share");
+  return path20.join(dataHome, "panorama-gateway");
 }
 async function ensureWritableDirectory(dir) {
   try {
     await ensureOwnerOnlyDirectory(dir);
-    const probe = path16.join(dir, `.panorama-write-${randomUUID6()}`);
+    const probe = path20.join(dir, `.panorama-write-${randomUUID9()}`);
     await writeOwnerOnlyFile(probe, "ok");
     await fs6.unlink(probe);
     return { ok: true };
@@ -11487,16 +14630,16 @@ async function ensureWritableDirectory(dir) {
 }
 async function prepareGatewayConfigDir(options, allowFallback) {
   const resolvedOptions = getActiveOptions(options);
-  const overrideDir = getStringOption(resolvedOptions, "config-dir") || process18.env.PANORAMA_GATEWAY_CONFIG_DIR;
-  const overridePath = getStringOption(resolvedOptions, "config-path") || process18.env.PANORAMA_GATEWAY_CONFIG_PATH;
+  const overrideDir = getStringOption(resolvedOptions, "config-dir") || process19.env.PANORAMA_GATEWAY_CONFIG_DIR;
+  const overridePath = getStringOption(resolvedOptions, "config-path") || process19.env.PANORAMA_GATEWAY_CONFIG_PATH;
   const explicitOverride = Boolean(overrideDir || overridePath);
   const { configDir, configPath, logPath, pidPath } = resolveGatewayPaths2(resolvedOptions);
   const writable = await ensureWritableDirectory(configDir);
   if (writable.ok) {
-    process18.env.PANORAMA_GATEWAY_CONFIG_DIR = configDir;
-    process18.env.PANORAMA_GATEWAY_CONFIG_PATH = configPath;
-    process18.env.PANORAMA_GATEWAY_LOG_PATH = logPath;
-    process18.env.PANORAMA_GATEWAY_PID_PATH = pidPath;
+    process19.env.PANORAMA_GATEWAY_CONFIG_DIR = configDir;
+    process19.env.PANORAMA_GATEWAY_CONFIG_PATH = configPath;
+    process19.env.PANORAMA_GATEWAY_LOG_PATH = logPath;
+    process19.env.PANORAMA_GATEWAY_PID_PATH = pidPath;
     try {
       await ensureGatewayStatePermissions({ configDir, configPath, logPath, pidPath });
     } catch (error) {
@@ -11517,7 +14660,7 @@ async function prepareGatewayConfigDir(options, allowFallback) {
   const fallbackPaths = resolveGatewayPaths2(fallbackOptions);
   if (configPath !== fallbackPaths.configPath && fsSync9.existsSync(configPath)) {
     try {
-      await ensureOwnerOnlyDirectory(path16.dirname(fallbackPaths.configPath));
+      await ensureOwnerOnlyDirectory(path20.dirname(fallbackPaths.configPath));
       await fs6.copyFile(configPath, fallbackPaths.configPath);
       await ensureOwnerOnlyFile(fallbackPaths.configPath);
     } catch (error) {
@@ -11529,10 +14672,10 @@ async function prepareGatewayConfigDir(options, allowFallback) {
     }
   }
   resolvedOptions["config-dir"] = fallbackDir;
-  process18.env.PANORAMA_GATEWAY_CONFIG_DIR = fallbackDir;
-  process18.env.PANORAMA_GATEWAY_CONFIG_PATH = fallbackPaths.configPath;
-  process18.env.PANORAMA_GATEWAY_LOG_PATH = fallbackPaths.logPath;
-  process18.env.PANORAMA_GATEWAY_PID_PATH = fallbackPaths.pidPath;
+  process19.env.PANORAMA_GATEWAY_CONFIG_DIR = fallbackDir;
+  process19.env.PANORAMA_GATEWAY_CONFIG_PATH = fallbackPaths.configPath;
+  process19.env.PANORAMA_GATEWAY_LOG_PATH = fallbackPaths.logPath;
+  process19.env.PANORAMA_GATEWAY_PID_PATH = fallbackPaths.pidPath;
   try {
     await ensureGatewayStatePermissions(fallbackPaths);
   } catch (error) {
@@ -11620,20 +14763,20 @@ async function getProcessUptime(pid) {
 function findRepoRoot(startDir) {
   let current = startDir;
   while (true) {
-    if (fsSync9.existsSync(path16.join(current, "pnpm-workspace.yaml"))) {
+    if (fsSync9.existsSync(path20.join(current, "pnpm-workspace.yaml"))) {
       return current;
     }
-    const parent = path16.dirname(current);
+    const parent = path20.dirname(current);
     if (parent === current)
       return null;
     current = parent;
   }
 }
 function loadEnvironment(options) {
-  const envFileOption = getStringOption(options, "env-file") || process18.env.PANORAMA_ENV_FILE || process18.env.PANORAMA_ENV_PATH;
-  const envNameOption = getStringOption(options, "env") || process18.env.PANORAMA_ENV || process18.env.ENVIRONMENT;
+  const envFileOption = getStringOption(options, "env-file") || process19.env.PANORAMA_ENV_FILE || process19.env.PANORAMA_ENV_PATH;
+  const envNameOption = getStringOption(options, "env") || process19.env.PANORAMA_ENV || process19.env.ENVIRONMENT;
   const envName = normalizeEnvName(envNameOption) ?? "local";
-  const envPath = envFileOption ? path16.resolve(envFileOption) : path16.join(findRepoRoot(process18.cwd()) ?? process18.cwd(), envName === "local" ? ".env" : `.env.${envName}`);
+  const envPath = envFileOption ? path20.resolve(envFileOption) : path20.join(findRepoRoot(process19.cwd()) ?? process19.cwd(), envName === "local" ? ".env" : `.env.${envName}`);
   if (!fsSync9.existsSync(envPath)) {
     if (envFileOption || envNameOption) {
       throw new GatewayCliError("Environment file not found.", `Path: ${envPath}`);
@@ -11654,7 +14797,7 @@ function shouldEmitDebugOutput(stream) {
   return isVerbose();
 }
 function logInfo(message, data) {
-  if (!shouldEmitDebugOutput(process18.stdout))
+  if (!shouldEmitDebugOutput(process19.stdout))
     return;
   if (data) {
     console.log(`[gateway] ${message}`, data);
@@ -11663,7 +14806,7 @@ function logInfo(message, data) {
   }
 }
 function logError(message, data) {
-  if (!shouldEmitDebugOutput(process18.stderr))
+  if (!shouldEmitDebugOutput(process19.stderr))
     return;
   if (data) {
     console.error(`[gateway] ${message}`, data);
@@ -11672,7 +14815,7 @@ function logError(message, data) {
   }
 }
 function logWarn(message, data) {
-  if (!shouldEmitDebugOutput(process18.stderr))
+  if (!shouldEmitDebugOutput(process19.stderr))
     return;
   if (data) {
     console.warn(`[gateway] ${message}`, data);
@@ -11809,7 +14952,7 @@ function buildGatewayDoctorDependencies() {
   };
 }
 async function run() {
-  const parsed = parseArgs(process18.argv.slice(2));
+  const parsed = parseArgs(process19.argv.slice(2));
   ACTIVE_OPTIONS = parsed.options;
   applyOptionEnvOverrides(parsed.options);
   if (parsed.options.h || parsed.options.help || parsed.command === null) {
@@ -11825,7 +14968,7 @@ async function run() {
       throw new Error("Pairing code is required");
     }
     await pairGatewayCommand(code, parsed.options, configResolution, buildGatewayPairingDependencies());
-    const entryPath = process18.argv[1] || "";
+    const entryPath = process19.argv[1] || "";
     if (entryPath.endsWith(".ts")) {
       cliInfo2('Auto-start skipped in dev mode; run "panorama-gateway start" when ready.', parsed.options);
       return;
@@ -11876,7 +15019,7 @@ async function run() {
     return;
   }
   printHelp();
-  process18.exitCode = 1;
+  process19.exitCode = 1;
 }
 run().catch((error) => {
   const { message, details } = describeError(error);
@@ -11885,6 +15028,6 @@ run().catch((error) => {
     detailItems.push({ label: "Details", value: details, verboseOnly: true });
   }
   cliError2(message, ACTIVE_OPTIONS ?? void 0, detailItems);
-  process18.exitCode = 1;
+  process19.exitCode = 1;
 });
 //# sourceMappingURL=index.js.map