whale-code 6.5.4 → 6.5.6

package/dist/server/local-agent-gateway.js

@@ -1,28 +1,50 @@
 /**
  * Local Agent Gateway — WebSocket server for local agent connections.
  *
- * Accepts outbound WebSocket connections from user machines running swag-agent.
+ * Accepts outbound WebSocket connections from user machines running whale agent.
  * Authenticates per-store via API key, maintains connection pool, routes commands.
  *
  * Architecture:
  *   Claude Code → MCP stdio → Fly.io server → local_agent handler
- *     → this gateway → WebSocket → user's local swag-agent → execute locally
+ *     → this gateway → WebSocket → user's local whale agent → execute locally
  *
  * Same pattern as kali.ts but routes through WebSocket instead of HTTP to Fly.io internal.
  */
+
 import { WebSocketServer, WebSocket } from "ws";
 import { randomUUID, createHash } from "node:crypto";
 import { createClient } from "@supabase/supabase-js";
 import { queueSpan, auditRowToSpan } from "./lib/clickhouse-buffer.js";
+
+// ============================================================================
+// TYPES
+// ============================================================================
+
+// Messages: server → agent
+
+// Messages: agent → server
+
+// ============================================================================
+// REMOTE DESKTOP TYPES
+// ============================================================================
+
 // ============================================================================
 // CONNECTION POOL
 // ============================================================================
+
 /** Map<storeId, LocalAgent[]> — multiple agents per store (e.g. multiple machines) */
 const agentPool = new Map();
+
 /** Map<requestId, pending request> */
 const pendingRequests = new Map();
+
 /** Map<sessionId, RemoteDesktopSession> — active remote desktop relay sessions */
 const rdSessions = new Map();
+
+// ============================================================================
+// PORTAL TYPES
+// ============================================================================
+
 /** Map<sessionId, PortalRelaySession> — active portal sessions */
 const portalSessions = new Map();
 const PORTAL_MARKER = 0x01;
@@ -30,737 +52,873 @@ const MAX_AGENTS_PER_STORE = 25;
 const HEARTBEAT_INTERVAL_MS = 30_000;
 const PONG_TIMEOUT_MS = 45_000;
 const MAX_OUTPUT_CHARS = 500 * 1024; // 500KB safety cap — context_management handles limits
+
 // ============================================================================
 // GATEWAY
 // ============================================================================
+
 let wss = null;
 let heartbeatTimer = null;
 let supabaseClient = null;
 export function initLocalAgentGateway(server) {
-    const SUPABASE_URL = process.env.SUPABASE_URL;
-    const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
-    supabaseClient = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
-    wss = new WebSocketServer({ noServer: true });
-    // Handle HTTP upgrade on /agent/ws path
-    server.on("upgrade", (req, socket, head) => {
-        const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
-        if (url.pathname !== "/agent/ws") {
-            socket.destroy();
-            return;
-        }
-        wss.handleUpgrade(req, socket, head, (ws) => {
-            wss.emit("connection", ws, req);
-        });
+  const SUPABASE_URL = process.env.SUPABASE_URL;
+  const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+  supabaseClient = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);
+  wss = new WebSocketServer({
+    noServer: true
+  });
+
+  // Handle HTTP upgrade on /agent/ws path
+  server.on("upgrade", (req, socket, head) => {
+    const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+    if (url.pathname !== "/agent/ws") {
+      socket.destroy();
+      return;
+    }
+    wss.handleUpgrade(req, socket, head, ws => {
+      wss.emit("connection", ws, req);
     });
-    wss.on("connection", handleConnection);
-    // Heartbeat — ping all agents, disconnect stale ones
-    heartbeatTimer = setInterval(() => {
-        const now = Date.now();
-        for (const [storeId, agents] of agentPool) {
-            for (let i = agents.length - 1; i >= 0; i--) {
-                const agent = agents[i];
-                if (now - agent.lastPong > PONG_TIMEOUT_MS) {
-                    console.log(`[local-agent] Disconnecting stale agent ${agent.agentId} (store=${storeId})`);
-                    agent.ws.terminate();
-                    agents.splice(i, 1);
-                }
-                else if (agent.ws.readyState === WebSocket.OPEN) {
-                    send(agent.ws, { type: "ping" });
-                }
-            }
-            if (agents.length === 0)
-                agentPool.delete(storeId);
+  });
+  wss.on("connection", handleConnection);
+
+  // Heartbeat — ping all agents, disconnect stale ones
+  heartbeatTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [storeId, agents] of agentPool) {
+      for (let i = agents.length - 1; i >= 0; i--) {
+        const agent = agents[i];
+        if (now - agent.lastPong > PONG_TIMEOUT_MS) {
+          console.log(`[local-agent] Disconnecting stale agent ${agent.agentId} (store=${storeId})`);
+          agent.ws.terminate();
+          agents.splice(i, 1);
+        } else if (agent.ws.readyState === WebSocket.OPEN) {
+          send(agent.ws, {
+            type: "ping"
+          });
         }
-    }, HEARTBEAT_INTERVAL_MS);
-    heartbeatTimer.unref();
-    console.log("[local-agent] Gateway initialized on /agent/ws");
+      }
+      if (agents.length === 0) agentPool.delete(storeId);
+    }
+  }, HEARTBEAT_INTERVAL_MS);
+  heartbeatTimer.unref();
+  console.log("[local-agent] Gateway initialized on /agent/ws");
 }
 function handleConnection(ws, _req) {
-    let authenticated = false;
-    let agent = null;
-    let viewerSession = null;
-    // Auth timeout — must authenticate within 10 seconds
-    const authTimer = setTimeout(() => {
-        if (!authenticated) {
-            send(ws, { type: "error", error: "Authentication timeout" });
-            ws.close(4001, "Authentication timeout");
-        }
-    }, 10_000);
-    ws.on("message", async (raw) => {
-        // Handle binary messages — forward to paired viewer/agent in RD/portal sessions
-        if (typeof raw !== "string" && !isJsonString(raw)) {
-            const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
-            // Portal binary frames (marker 0x01) — route by session UUID
-            if (buf.length > 17 && buf[0] === PORTAL_MARKER) {
-                const sessionUuid = buf.subarray(1, 17).toString("hex");
-                const sessionId = `${sessionUuid.slice(0, 8)}-${sessionUuid.slice(8, 12)}-${sessionUuid.slice(12, 16)}-${sessionUuid.slice(16, 20)}-${sessionUuid.slice(20)}`;
-                const portalSession = portalSessions.get(sessionId);
-                if (portalSession && agent) {
-                    // Forward to the other side
-                    const targetAgentId = agent.agentId === portalSession.initiatorAgentId
-                        ? portalSession.targetAgentId
-                        : portalSession.initiatorAgentId;
-                    const target = pickAgentById(targetAgentId);
-                    if (target?.ws.readyState === WebSocket.OPEN) {
-                        target.ws.send(buf);
-                        portalSession.bytesRelayed += buf.length;
-                    }
-                }
-                return;
-            }
-            // Remote desktop binary frames (no marker or 0x00) — existing behavior
-            if (agent) {
-                for (const [, session] of rdSessions) {
-                    if (session.agentId === agent.agentId && session.viewerWs.readyState === WebSocket.OPEN) {
-                        session.viewerWs.send(buf);
-                        session.framesRelayed++;
-                        session.bytesRelayed += buf.length;
-                    }
-                }
-            }
-            if (viewerSession) {
-                const target = pickAgentById(viewerSession.agentId);
-                if (target?.ws.readyState === WebSocket.OPEN) {
-                    target.ws.send(buf);
-                }
-            }
-            return;
-        }
-        let msg;
-        try {
-            msg = JSON.parse(raw.toString());
-        }
-        catch {
-            send(ws, { type: "error", error: "Invalid JSON" });
-            return;
+  let authenticated = false;
+  let agent = null;
+  let viewerSession = null;
+
+  // Auth timeout — must authenticate within 10 seconds
+  const authTimer = setTimeout(() => {
+    if (!authenticated) {
+      send(ws, {
+        type: "error",
+        error: "Authentication timeout"
+      });
+      ws.close(4001, "Authentication timeout");
+    }
+  }, 10_000);
+  ws.on("message", async raw => {
+    // Handle binary messages — forward to paired viewer/agent in RD/portal sessions
+    if (typeof raw !== "string" && !isJsonString(raw)) {
+      const buf = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+
+      // Portal binary frames (marker 0x01) — route by session UUID
+      if (buf.length > 17 && buf[0] === PORTAL_MARKER) {
+        const sessionUuid = buf.subarray(1, 17).toString("hex");
+        const sessionId = `${sessionUuid.slice(0, 8)}-${sessionUuid.slice(8, 12)}-${sessionUuid.slice(12, 16)}-${sessionUuid.slice(16, 20)}-${sessionUuid.slice(20)}`;
+        const portalSession = portalSessions.get(sessionId);
+        if (portalSession && agent) {
+          // Forward to the other side
+          const targetAgentId = agent.agentId === portalSession.initiatorAgentId ? portalSession.targetAgentId : portalSession.initiatorAgentId;
+          const target = pickAgentById(targetAgentId);
+          if (target?.ws.readyState === WebSocket.OPEN) {
+            target.ws.send(buf);
+            portalSession.bytesRelayed += buf.length;
+          }
         }
-        // Handle viewer auth (remote desktop relay)
-        if (msg.type === "auth" && msg.role === "viewer") {
-            clearTimeout(authTimer);
-            const viewerAuth = msg;
-            const authResult = await authenticateViewer(viewerAuth);
-            if (!authResult) {
-                send(ws, { type: "error", error: "Invalid token or unauthorized" });
-                ws.close(4003, "Authentication failed");
-                return;
-            }
-            authenticated = true;
-            // Find target agent with remote_desktop capability
-            const targetAgent = pickAgent(authResult.storeId, undefined, viewerAuth.target_node_id);
-            if (!targetAgent || !targetAgent.capabilities.includes("remote_desktop")) {
-                send(ws, { type: "remote_desktop_response", success: false, error: "No remote desktop capable node online" });
-                ws.close(4004, "No target node");
-                return;
-            }
-            // Create relay session
-            const sessionId = randomUUID();
-            viewerSession = {
-                sessionId,
-                viewerWs: ws,
-                agentId: targetAgent.agentId,
-                storeId: authResult.storeId,
-                userId: authResult.userId,
-                startedAt: new Date(),
-                framesRelayed: 0,
-                bytesRelayed: 0,
-            };
-            rdSessions.set(sessionId, viewerSession);
-            // Tell the agent to start a remote desktop session
-            send(targetAgent.ws, {
-                type: "remote_desktop",
-                request_id: randomUUID(),
-                type_inner: "remote_desktop_request",
-                session_id: sessionId,
-                viewer_user_id: authResult.userId,
-            });
-            send(ws, {
-                type: "remote_desktop_response",
-                success: true,
-                session_id: sessionId,
-                agent_hostname: targetAgent.hostname,
-            });
-            console.log(`[remote-desktop] Relay session ${sessionId}: viewer=${authResult.userId} → agent=${targetAgent.agentId}`);
-            return;
+        return;
+      }
+
+      // Remote desktop binary frames (no marker or 0x00) — existing behavior
+      if (agent) {
+        for (const [, session] of rdSessions) {
+          if (session.agentId === agent.agentId && session.viewerWs.readyState === WebSocket.OPEN) {
+            session.viewerWs.send(buf);
+            session.framesRelayed++;
+            session.bytesRelayed += buf.length;
+          }
         }
-        // Handle auth
-        if (msg.type === "auth") {
-            clearTimeout(authTimer);
-            const authResult = await authenticateAgent(msg);
-            if (!authResult) {
-                send(ws, { type: "error", error: "Invalid API key" });
-                ws.close(4003, "Authentication failed");
-                return;
-            }
-            agent = {
-                ws,
-                storeId: authResult.storeId.toLowerCase(),
-                userId: authResult.userId,
-                nodeId: authResult.nodeId,
-                capabilities: msg.capabilities || [],
-                connectedAt: new Date(),
-                lastPong: Date.now(),
-                agentId: randomUUID(),
-                platform: msg.platform || "unknown",
-                hostname: msg.hostname || "unknown",
-            };
-            // Add to pool
-            const existing = agentPool.get(agent.storeId) || [];
-            if (existing.length >= MAX_AGENTS_PER_STORE) {
-                // Disconnect oldest
-                const oldest = existing.shift();
-                send(oldest.ws, { type: "error", error: "Replaced by newer agent connection" });
-                oldest.ws.close(4004, "Replaced by newer connection");
-            }
-            existing.push(agent);
-            agentPool.set(agent.storeId, existing);
-            authenticated = true;
-            send(ws, {
-                type: "authenticated",
-                agent_id: agent.agentId,
-                message: `Connected to SwagManager. ${agent.capabilities.length} local tools registered.`,
-            });
-            console.log(`[local-agent] Agent connected: store=${agent.storeId} platform=${agent.platform} hostname=${agent.hostname} tools=${agent.capabilities.length}`);
-            // Telemetry → ClickHouse
-            queueSpan(auditRowToSpan({
-                action: "local_agent.connected",
-                severity: "info",
-                store_id: agent.storeId,
-                resource_type: "local_agent",
-                resource_id: agent.agentId,
-                source: "local_agent",
-                service_name: "agent-server",
-                span_kind: "INTERNAL",
-                status_code: "OK",
-                start_time: new Date().toISOString(),
-                end_time: new Date().toISOString(),
-                details: {
-                    platform: agent.platform,
-                    hostname: agent.hostname,
-                    capabilities: agent.capabilities,
-                },
-                user_id: agent.userId,
-            }));
-            return;
+      }
+      if (viewerSession) {
+        const target = pickAgentById(viewerSession.agentId);
+        if (target?.ws.readyState === WebSocket.OPEN) {
+          target.ws.send(buf);
         }
-        // Handle viewer input forwarding (after auth)
-        if (authenticated && viewerSession && !agent) {
-            // Forward input events from viewer to the target agent
-            const target = pickAgentById(viewerSession.agentId);
-            if (target?.ws.readyState === WebSocket.OPEN) {
-                send(target.ws, { type: "remote_desktop", ...msg });
-            }
-            return;
+      }
+      return;
+    }
+    let msg;
+    try {
+      msg = JSON.parse(raw.toString());
+    } catch {
+      send(ws, {
+        type: "error",
+        error: "Invalid JSON"
+      });
+      return;
+    }
+
+    // Handle viewer auth (remote desktop relay)
+    if (msg.type === "auth" && msg.role === "viewer") {
+      clearTimeout(authTimer);
+      const viewerAuth = msg;
+      const authResult = await authenticateViewer(viewerAuth);
+      if (!authResult) {
+        send(ws, {
+          type: "error",
+          error: "Invalid token or unauthorized"
+        });
+        ws.close(4003, "Authentication failed");
+        return;
+      }
+      authenticated = true;
+
+      // Find target agent with remote_desktop capability
+      const targetAgent = pickAgent(authResult.storeId, undefined, viewerAuth.target_node_id);
+      if (!targetAgent || !targetAgent.capabilities.includes("remote_desktop")) {
+        send(ws, {
+          type: "remote_desktop_response",
+          success: false,
+          error: "No remote desktop capable node online"
+        });
+        ws.close(4004, "No target node");
+        return;
+      }
+
+      // Create relay session
+      const sessionId = randomUUID();
+      viewerSession = {
+        sessionId,
+        viewerWs: ws,
+        agentId: targetAgent.agentId,
+        storeId: authResult.storeId,
+        userId: authResult.userId,
+        startedAt: new Date(),
+        framesRelayed: 0,
+        bytesRelayed: 0
+      };
+      rdSessions.set(sessionId, viewerSession);
+
+      // Tell the agent to start a remote desktop session
+      send(targetAgent.ws, {
+        type: "remote_desktop",
+        request_id: randomUUID(),
+        type_inner: "remote_desktop_request",
+        session_id: sessionId,
+        viewer_user_id: authResult.userId
+      });
+      send(ws, {
+        type: "remote_desktop_response",
+        success: true,
+        session_id: sessionId,
+        agent_hostname: targetAgent.hostname
+      });
+      console.log(`[remote-desktop] Relay session ${sessionId}: viewer=${authResult.userId} → agent=${targetAgent.agentId}`);
+      return;
+    }
+
+    // Handle auth
+    if (msg.type === "auth") {
+      clearTimeout(authTimer);
+      const authResult = await authenticateAgent(msg);
+      if (!authResult) {
+        send(ws, {
+          type: "error",
+          error: "Invalid API key"
+        });
+        ws.close(4003, "Authentication failed");
+        return;
+      }
+      agent = {
+        ws,
+        storeId: authResult.storeId.toLowerCase(),
+        userId: authResult.userId,
+        nodeId: authResult.nodeId,
+        capabilities: msg.capabilities || [],
+        connectedAt: new Date(),
+        lastPong: Date.now(),
+        agentId: randomUUID(),
+        platform: msg.platform || "unknown",
+        hostname: msg.hostname || "unknown"
+      };
+
+      // Add to pool
+      const existing = agentPool.get(agent.storeId) || [];
+      if (existing.length >= MAX_AGENTS_PER_STORE) {
+        // Disconnect oldest
+        const oldest = existing.shift();
+        send(oldest.ws, {
+          type: "error",
+          error: "Replaced by newer agent connection"
+        });
+        oldest.ws.close(4004, "Replaced by newer connection");
+      }
+      existing.push(agent);
+      agentPool.set(agent.storeId, existing);
+      authenticated = true;
+      send(ws, {
+        type: "authenticated",
+        agent_id: agent.agentId,
+        message: `Connected to WhaleTools. ${agent.capabilities.length} local tools registered.`
+      });
+      console.log(`[local-agent] Agent connected: store=${agent.storeId} platform=${agent.platform} hostname=${agent.hostname} tools=${agent.capabilities.length}`);
+
+      // Telemetry → ClickHouse
+      queueSpan(auditRowToSpan({
+        action: "local_agent.connected",
+        severity: "info",
+        store_id: agent.storeId,
+        resource_type: "local_agent",
+        resource_id: agent.agentId,
+        source: "local_agent",
+        service_name: "agent-server",
+        span_kind: "INTERNAL",
+        status_code: "OK",
+        start_time: new Date().toISOString(),
+        end_time: new Date().toISOString(),
+        details: {
+          platform: agent.platform,
+          hostname: agent.hostname,
+          capabilities: agent.capabilities
+        },
+        user_id: agent.userId
+      }));
+      return;
+    }
+
+    // Handle viewer input forwarding (after auth)
+    if (authenticated && viewerSession && !agent) {
+      // Forward input events from viewer to the target agent
+      const target = pickAgentById(viewerSession.agentId);
+      if (target?.ws.readyState === WebSocket.OPEN) {
+        send(target.ws, {
+          type: "remote_desktop",
+          ...msg
+        });
+      }
+      return;
+    }
+    if (!authenticated || !agent) {
+      send(ws, {
+        type: "error",
+        error: "Not authenticated"
+      });
+      return;
+    }
+
+    // Handle pong
+    if (msg.type === "pong") {
+      agent.lastPong = Date.now();
+      return;
+    }
+
+    // Handle portal messages
+    if (msg.type === "portal_request" && agent) {
+      // Initiator wants to connect to a target node
+      const targetAgent = pickAgent(agent.storeId, undefined, msg.target_node_id);
+      if (!targetAgent) {
+        send(ws, {
+          type: "portal_reject",
+          session_id: msg.session_id,
+          reason: "Target node not online"
+        });
+        return;
+      }
+      // Forward request to target agent
+      send(targetAgent.ws, {
+        type: "portal_request",
+        session_id: msg.session_id,
+        capabilities: msg.capabilities,
+        requester_node_id: agent.nodeId,
+        requester_hostname: agent.hostname,
+        requester_role: msg.requester_role || "admin"
+      });
+      // Pre-register session so binary routing works once accepted
+      portalSessions.set(msg.session_id, {
+        sessionId: msg.session_id,
+        initiatorAgentId: agent.agentId,
+        targetAgentId: targetAgent.agentId,
+        storeId: agent.storeId,
+        capabilities: msg.capabilities || [],
+        startedAt: new Date(),
+        bytesRelayed: 0
+      });
+      console.log(`[portal] Session ${msg.session_id}: ${agent.hostname} → ${targetAgent.hostname}`);
+      return;
+    }
+    if (msg.type === "portal_accept" && agent) {
+      const session = portalSessions.get(msg.session_id);
+      if (session) {
+        const initiator = pickAgentById(session.initiatorAgentId);
+        if (initiator) {
+          send(initiator.ws, {
+            type: "portal_accept",
+            session_id: msg.session_id,
+            hostname: agent.hostname
+          });
         }
-        if (!authenticated || !agent) {
-            send(ws, { type: "error", error: "Not authenticated" });
-            return;
+      }
+      return;
+    }
+    if (msg.type === "portal_reject" && agent) {
+      const session = portalSessions.get(msg.session_id);
+      if (session) {
+        const initiator = pickAgentById(session.initiatorAgentId);
+        if (initiator) {
+          send(initiator.ws, {
+            type: "portal_reject",
+            session_id: msg.session_id,
+            reason: msg.reason
+          });
         }
-        // Handle pong
-        if (msg.type === "pong") {
-            agent.lastPong = Date.now();
-            return;
+        portalSessions.delete(msg.session_id);
+      }
+      return;
+    }
+    if (msg.type === "portal_close" && agent) {
+      const session = portalSessions.get(msg.session_id);
+      if (session) {
+        // Notify the other side
+        const otherAgentId = agent.agentId === session.initiatorAgentId ? session.targetAgentId : session.initiatorAgentId;
+        const other = pickAgentById(otherAgentId);
+        if (other) {
+          send(other.ws, {
+            type: "portal_close",
+            session_id: msg.session_id
+          });
         }
-        // Handle portal messages
-        if (msg.type === "portal_request" && agent) {
-            // Initiator wants to connect to a target node
-            const targetAgent = pickAgent(agent.storeId, undefined, msg.target_node_id);
-            if (!targetAgent) {
-                send(ws, { type: "portal_reject", session_id: msg.session_id, reason: "Target node not online" });
-                return;
-            }
-            // Forward request to target agent
-            send(targetAgent.ws, {
-                type: "portal_request",
-                session_id: msg.session_id,
-                capabilities: msg.capabilities,
-                requester_node_id: agent.nodeId,
-                requester_hostname: agent.hostname,
-                requester_role: msg.requester_role || "admin",
-            });
-            // Pre-register session so binary routing works once accepted
-            portalSessions.set(msg.session_id, {
-                sessionId: msg.session_id,
-                initiatorAgentId: agent.agentId,
-                targetAgentId: targetAgent.agentId,
-                storeId: agent.storeId,
-                capabilities: msg.capabilities || [],
-                startedAt: new Date(),
-                bytesRelayed: 0,
+        portalSessions.delete(msg.session_id);
+        console.log(`[portal] Session ${msg.session_id} closed (${session.bytesRelayed} bytes relayed)`);
+      }
+      return;
+    }
+
+    // Handle tool discovery response
+    if (msg.type === "tools") {
+      agent.capabilities = msg.tools;
+      console.log(`[local-agent] Updated tools for ${agent.agentId}: ${msg.tools.join(", ")}`);
+      return;
+    }
+
+    // Handle command result
+    if (msg.type === "result") {
+      const pending = pendingRequests.get(msg.request_id);
+      if (!pending) return; // Already timed out or cancelled
+
+      clearTimeout(pending.timer);
+      pendingRequests.delete(msg.request_id);
+
+      // Truncate large outputs
+      const result = {
+        success: msg.success,
+        stdout: truncate(msg.stdout),
+        stderr: truncate(msg.stderr),
+        exit_code: msg.exit_code,
+        data: msg.data,
+        error: msg.error,
+        killed: msg.killed,
+        cwd: msg.cwd,
+        duration_ms: msg.duration_ms
+      };
+      pending.resolve(result);
+    }
+  });
+  ws.on("close", () => {
+    clearTimeout(authTimer);
+    if (agent) {
+      const agents = agentPool.get(agent.storeId);
+      if (agents) {
+        const idx = agents.findIndex(a => a.agentId === agent.agentId);
+        if (idx >= 0) agents.splice(idx, 1);
+        if (agents.length === 0) agentPool.delete(agent.storeId);
+      }
+      console.log(`[local-agent] Agent disconnected: ${agent.agentId} (store=${agent.storeId})`);
+
+      // Immediately fail all pending requests for this agent
+      failPendingRequestsForAgent(agent.agentId, `Agent disconnected (${agent.hostname})`);
+
+      // End any portal sessions through this agent
+      for (const [sessionId, session] of portalSessions) {
+        if (session.initiatorAgentId === agent.agentId || session.targetAgentId === agent.agentId) {
+          const otherAgentId = agent.agentId === session.initiatorAgentId ? session.targetAgentId : session.initiatorAgentId;
+          const other = pickAgentById(otherAgentId);
+          if (other) {
+            send(other.ws, {
+              type: "portal_close",
+              session_id: sessionId
             });
-            console.log(`[portal] Session ${msg.session_id}: ${agent.hostname} → ${targetAgent.hostname}`);
-            return;
-        }
-        if (msg.type === "portal_accept" && agent) {
-            const session = portalSessions.get(msg.session_id);
-            if (session) {
-                const initiator = pickAgentById(session.initiatorAgentId);
-                if (initiator) {
-                    send(initiator.ws, { type: "portal_accept", session_id: msg.session_id, hostname: agent.hostname });
-                }
-            }
-            return;
-        }
-        if (msg.type === "portal_reject" && agent) {
-            const session = portalSessions.get(msg.session_id);
-            if (session) {
-                const initiator = pickAgentById(session.initiatorAgentId);
-                if (initiator) {
-                    send(initiator.ws, { type: "portal_reject", session_id: msg.session_id, reason: msg.reason });
-                }
-                portalSessions.delete(msg.session_id);
-            }
-            return;
-        }
-        if (msg.type === "portal_close" && agent) {
-            const session = portalSessions.get(msg.session_id);
-            if (session) {
-                // Notify the other side
-                const otherAgentId = agent.agentId === session.initiatorAgentId
-                    ? session.targetAgentId : session.initiatorAgentId;
-                const other = pickAgentById(otherAgentId);
-                if (other) {
-                    send(other.ws, { type: "portal_close", session_id: msg.session_id });
-                }
-                portalSessions.delete(msg.session_id);
-                console.log(`[portal] Session ${msg.session_id} closed (${session.bytesRelayed} bytes relayed)`);
-            }
-            return;
-        }
-        // Handle tool discovery response
-        if (msg.type === "tools") {
-            agent.capabilities = msg.tools;
-            console.log(`[local-agent] Updated tools for ${agent.agentId}: ${msg.tools.join(", ")}`);
-            return;
-        }
-        // Handle command result
-        if (msg.type === "result") {
-            const pending = pendingRequests.get(msg.request_id);
-            if (!pending)
-                return; // Already timed out or cancelled
-            clearTimeout(pending.timer);
-            pendingRequests.delete(msg.request_id);
-            // Truncate large outputs
-            const result = {
-                success: msg.success,
-                stdout: truncate(msg.stdout),
-                stderr: truncate(msg.stderr),
-                exit_code: msg.exit_code,
-                data: msg.data,
-                error: msg.error,
-                killed: msg.killed,
-                cwd: msg.cwd,
-                duration_ms: msg.duration_ms,
-            };
-            pending.resolve(result);
+          }
+          portalSessions.delete(sessionId);
+          console.log(`[portal] Session ${sessionId} ended (agent disconnected)`);
         }
-    });
-    ws.on("close", () => {
-        clearTimeout(authTimer);
-        if (agent) {
-            const agents = agentPool.get(agent.storeId);
-            if (agents) {
-                const idx = agents.findIndex(a => a.agentId === agent.agentId);
-                if (idx >= 0)
-                    agents.splice(idx, 1);
-                if (agents.length === 0)
-                    agentPool.delete(agent.storeId);
-            }
-            console.log(`[local-agent] Agent disconnected: ${agent.agentId} (store=${agent.storeId})`);
-            // Immediately fail all pending requests for this agent
-            failPendingRequestsForAgent(agent.agentId, `Agent disconnected (${agent.hostname})`);
-            // End any portal sessions through this agent
-            for (const [sessionId, session] of portalSessions) {
-                if (session.initiatorAgentId === agent.agentId || session.targetAgentId === agent.agentId) {
-                    const otherAgentId = agent.agentId === session.initiatorAgentId
-                        ? session.targetAgentId : session.initiatorAgentId;
-                    const other = pickAgentById(otherAgentId);
-                    if (other) {
-                        send(other.ws, { type: "portal_close", session_id: sessionId });
-                    }
-                    portalSessions.delete(sessionId);
-                    console.log(`[portal] Session ${sessionId} ended (agent disconnected)`);
-                }
-            }
-            // End any remote desktop sessions through this agent
-            for (const [sessionId, session] of rdSessions) {
-                if (session.agentId === agent.agentId) {
-                    send(session.viewerWs, { type: "session_end", reason: "agent_disconnected" });
-                    session.viewerWs.close(1001, "Agent disconnected");
-                    rdSessions.delete(sessionId);
-                    console.log(`[remote-desktop] Session ${sessionId} ended (agent disconnected)`);
-                }
-            }
-        }
-        // Clean up viewer sessions
-        if (viewerSession) {
-            rdSessions.delete(viewerSession.sessionId);
-            console.log(`[remote-desktop] Session ${viewerSession.sessionId} ended (viewer disconnected)`);
-            viewerSession = null;
+      }
+
+      // End any remote desktop sessions through this agent
+      for (const [sessionId, session] of rdSessions) {
+        if (session.agentId === agent.agentId) {
+          send(session.viewerWs, {
+            type: "session_end",
+            reason: "agent_disconnected"
+          });
+          session.viewerWs.close(1001, "Agent disconnected");
+          rdSessions.delete(sessionId);
+          console.log(`[remote-desktop] Session ${sessionId} ended (agent disconnected)`);
         }
-    });
-    ws.on("error", (err) => {
-        console.error("[local-agent] WebSocket error:", err.message);
-    });
+      }
+    }
+
+    // Clean up viewer sessions
+    if (viewerSession) {
+      rdSessions.delete(viewerSession.sessionId);
+      console.log(`[remote-desktop] Session ${viewerSession.sessionId} ended (viewer disconnected)`);
+      viewerSession = null;
+    }
+  });
+  ws.on("error", err => {
+    console.error("[local-agent] WebSocket error:", err.message);
+  });
 }
+
 // ============================================================================
 // AUTHENTICATION
 // ============================================================================
+
 async function authenticateAgent(msg) {
-    if (!supabaseClient || !msg.api_key)
-        return null;
-    const keyHash = createHash("sha256").update(msg.api_key).digest("hex");
-    // 1. Try api_keys table first (standard API keys)
-    const { data, error } = await supabaseClient
-        .from("api_keys")
-        .select("id, store_id, owner_user_id")
-        .eq("key_hash", keyHash)
-        .eq("is_active", true)
-        .single();
-    if (data && !error) {
-        // Update last_used_at
-        supabaseClient.from("api_keys")
-            .update({ last_used_at: new Date().toISOString() })
-            .eq("id", data.id)
-            .then(() => { });
-        return { storeId: data.store_id, userId: data.owner_user_id || null, nodeId: null };
-    }
-    // 2. Fall back to nodes table (node daemon API keys)
-    const { data: nodeData, error: nodeErr } = await supabaseClient
-        .from("nodes")
-        .select("id, store_id")
-        .eq("api_key_hash", keyHash)
-        .single();
-    if (nodeData && !nodeErr) {
-        // Update node last_heartbeat on gateway connect
-        supabaseClient.from("nodes")
-            .update({ status: "online", last_heartbeat: new Date().toISOString() })
-            .eq("id", nodeData.id)
-            .then(() => { });
-        return { storeId: nodeData.store_id, userId: null, nodeId: nodeData.id };
-    }
-    return null;
+  if (!supabaseClient || !msg.api_key) return null;
+  const keyHash = createHash("sha256").update(msg.api_key).digest("hex");
+
+  // 1. Try api_keys table first (standard API keys)
+  const {
+    data,
+    error
+  } = await supabaseClient.from("api_keys").select("id, store_id, owner_user_id").eq("key_hash", keyHash).eq("is_active", true).single();
+  if (data && !error) {
+    // Update last_used_at
+    supabaseClient.from("api_keys").update({
+      last_used_at: new Date().toISOString()
+    }).eq("id", data.id).then(() => {});
+    return {
+      storeId: data.store_id,
+      userId: data.owner_user_id || null,
+      nodeId: null
+    };
+  }
+
+  // 2. Fall back to nodes table (node daemon API keys)
+  const {
+    data: nodeData,
+    error: nodeErr
+  } = await supabaseClient.from("nodes").select("id, store_id").eq("api_key_hash", keyHash).single();
+  if (nodeData && !nodeErr) {
+    // Update node last_heartbeat on gateway connect
+    supabaseClient.from("nodes").update({
+      status: "online",
+      last_heartbeat: new Date().toISOString()
+    }).eq("id", nodeData.id).then(() => {});
+    return {
+      storeId: nodeData.store_id,
+      userId: null,
+      nodeId: nodeData.id
+    };
+  }
+  return null;
 }
+
 /**
  * Authenticate a viewer connection using Supabase JWT.
  */
 async function authenticateViewer(msg) {
-    if (!supabaseClient || !msg.token)
-        return null;
-    try {
-        // Verify JWT with Supabase auth
-        const { data: { user }, error } = await supabaseClient.auth.getUser(msg.token);
-        if (error || !user)
-            return null;
-        // Verify user has access to the requested store
-        const { data: storeAccess } = await supabaseClient
-            .from("store_users")
-            .select("store_id")
-            .eq("user_id", user.id)
-            .eq("store_id", msg.store_id)
-            .single();
-        if (!storeAccess)
-            return null;
-        return { storeId: msg.store_id, userId: user.id };
-    }
-    catch {
-        return null;
-    }
+  if (!supabaseClient || !msg.token) return null;
+  try {
+    // Verify JWT with Supabase auth
+    const {
+      data: {
+        user
+      },
+      error
+    } = await supabaseClient.auth.getUser(msg.token);
+    if (error || !user) return null;
+
+    // Verify user has access to the requested store
+    const {
+      data: storeAccess
+    } = await supabaseClient.from("store_users").select("store_id").eq("user_id", user.id).eq("store_id", msg.store_id).single();
+    if (!storeAccess) return null;
+    return {
+      storeId: msg.store_id,
+      userId: user.id
+    };
+  } catch {
+    return null;
+  }
 }
+
 // ============================================================================
 // PUBLIC API — used by local-agent handler
 // ============================================================================
+
 /**
  * Check if a store has a connected local agent.
  */
 export function hasLocalAgent(storeId) {
-    const agents = agentPool.get(storeId.toLowerCase());
-    return !!agents?.some(a => a.ws.readyState === WebSocket.OPEN);
+  const agents = agentPool.get(storeId.toLowerCase());
+  return !!agents?.some(a => a.ws.readyState === WebSocket.OPEN);
 }
+
 /**
  * Get info about connected agents for a store.
  */
 export function getAgentInfo(storeId) {
-    const agents = agentPool.get(storeId.toLowerCase()) || [];
-    return agents
-        .filter(a => a.ws.readyState === WebSocket.OPEN)
-        .map(a => ({
-        agent_id: a.agentId,
-        platform: a.platform,
-        hostname: a.hostname,
-        capabilities: a.capabilities,
-        connected_at: a.connectedAt.toISOString(),
-        uptime_seconds: Math.floor((Date.now() - a.connectedAt.getTime()) / 1000),
-        node_id: a.nodeId,
-    }));
+  const agents = agentPool.get(storeId.toLowerCase()) || [];
+  return agents.filter(a => a.ws.readyState === WebSocket.OPEN).map(a => ({
+    agent_id: a.agentId,
+    platform: a.platform,
+    hostname: a.hostname,
+    capabilities: a.capabilities,
+    connected_at: a.connectedAt.toISOString(),
+    uptime_seconds: Math.floor((Date.now() - a.connectedAt.getTime()) / 1000),
+    node_id: a.nodeId
+  }));
 }
+
 /**
  * Execute a command on the user's local machine via their connected agent.
  */
 export async function executeOnLocalAgent(storeId, command, options = {}) {
-    const agent = pickAgent(storeId, options.agent_id);
-    if (!agent) {
-        return {
-            success: false,
-            error: `No local agent connected for this store. Install and run: npx swagmanager-agent`,
-        };
-    }
-    const requestId = randomUUID();
-    const timeout = Math.min(options.timeout || 30000, 600000);
-    const msg = {
-        type: "exec",
-        request_id: requestId,
-        command,
-        session_id: options.session_id,
-        timeout,
+  const agent = pickAgent(storeId, options.agent_id);
+  if (!agent) {
+    return {
+      success: false,
+      error: `No local agent connected for this store. Install and run: whale agent start --key YOUR_API_KEY`
     };
-    const sent = send(agent.ws, msg);
-    if (!sent)
-        return { success: false, error: "Agent connection closed" };
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            pendingRequests.delete(requestId);
-            resolve({
-                success: false,
-                error: `Local agent command timed out after ${timeout}ms`,
-            });
-        }, timeout + 5000); // 5s buffer over command timeout
-        pendingRequests.set(requestId, { resolve, reject, timer, agentId: agent.agentId });
+  }
+  const requestId = randomUUID();
+  const timeout = Math.min(options.timeout || 30000, 600000);
+  const msg = {
+    type: "exec",
+    request_id: requestId,
+    command,
+    session_id: options.session_id,
+    timeout
+  };
+  const sent = send(agent.ws, msg);
+  if (!sent) return {
+    success: false,
+    error: "Agent connection closed"
+  };
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({
+        success: false,
+        error: `Local agent command timed out after ${timeout}ms`
+      });
+    }, timeout + 5000); // 5s buffer over command timeout
+
+    pendingRequests.set(requestId, {
+      resolve,
+      reject,
+      timer,
+      agentId: agent.agentId
     });
+  });
 }
+
 /**
  * Execute a managed tool on the local agent (burp, zap, tshark, etc.)
  */
 export async function executeToolOnLocalAgent(storeId, tool, args, options = {}) {
-    const agent = pickAgent(storeId, options.agent_id);
-    if (!agent) {
-        return {
-            success: false,
-            error: `No local agent connected. Install: npx swagmanager-agent`,
-        };
-    }
-    // Check if agent has this tool
-    if (!agent.capabilities.includes(tool)) {
-        return {
-            success: false,
-            error: `Local agent does not have tool "${tool}" installed. Available: ${agent.capabilities.join(", ") || "none"}`,
-        };
-    }
-    const requestId = randomUUID();
-    const timeout = Math.min(options.timeout || 30000, 600000);
-    const msg = {
-        type: "tool_exec",
-        request_id: requestId,
-        tool,
-        args,
-        timeout,
+  const agent = pickAgent(storeId, options.agent_id);
+  if (!agent) {
+    return {
+      success: false,
+      error: `No local agent connected. Install: whale agent start --key YOUR_API_KEY`
     };
-    const sent = send(agent.ws, msg);
-    if (!sent)
-        return { success: false, error: "Agent connection closed" };
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            pendingRequests.delete(requestId);
-            resolve({
-                success: false,
-                error: `Local tool "${tool}" timed out after ${timeout}ms`,
-            });
-        }, timeout + 5000);
-        pendingRequests.set(requestId, { resolve, reject, timer, agentId: agent.agentId });
+  }
+
+  // Check if agent has this tool
+  if (!agent.capabilities.includes(tool)) {
+    return {
+      success: false,
+      error: `Local agent does not have tool "${tool}" installed. Available: ${agent.capabilities.join(", ") || "none"}`
+    };
+  }
+  const requestId = randomUUID();
+  const timeout = Math.min(options.timeout || 30000, 600000);
+  const msg = {
+    type: "tool_exec",
+    request_id: requestId,
+    tool,
+    args,
+    timeout
+  };
+  const sent = send(agent.ws, msg);
+  if (!sent) return {
+    success: false,
+    error: "Agent connection closed"
+  };
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({
+        success: false,
+        error: `Local tool "${tool}" timed out after ${timeout}ms`
+      });
+    }, timeout + 5000);
+    pendingRequests.set(requestId, {
+      resolve,
+      reject,
+      timer,
+      agentId: agent.agentId
     });
+  });
 }
+
 /**
  * Request tool discovery from agent.
  */
 export async function discoverLocalTools(storeId) {
-    const agent = pickAgent(storeId.toLowerCase());
-    if (!agent) {
-        return {
-            success: false,
-            error: `No local agent connected. Install: npx swagmanager-agent`,
-        };
-    }
-    const requestId = randomUUID();
-    const sent = send(agent.ws, { type: "discover", request_id: requestId });
-    if (!sent)
-        return { success: false, error: "Agent connection closed" };
-    return new Promise((resolve) => {
-        const timer = setTimeout(() => {
-            pendingRequests.delete(requestId);
-            resolve({ success: false, error: "Discovery timed out" });
-        }, 15000);
-        pendingRequests.set(requestId, {
-            resolve,
-            reject: () => resolve({ success: false, error: "Discovery failed" }),
-            timer,
-            agentId: agent.agentId,
-        });
+  const agent = pickAgent(storeId.toLowerCase());
+  if (!agent) {
+    return {
+      success: false,
+      error: `No local agent connected. Install: whale agent start --key YOUR_API_KEY`
+    };
+  }
+  const requestId = randomUUID();
+  const sent = send(agent.ws, {
+    type: "discover",
+    request_id: requestId
+  });
+  if (!sent) return {
+    success: false,
+    error: "Agent connection closed"
+  };
+  return new Promise(resolve => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({
+        success: false,
+        error: "Discovery timed out"
+      });
+    }, 15000);
+    pendingRequests.set(requestId, {
+      resolve,
+      reject: () => resolve({
+        success: false,
+        error: "Discovery failed"
+      }),
+      timer,
+      agentId: agent.agentId
     });
+  });
 }
+
 /**
  * Get gateway statistics.
  */
 export function getGatewayStats() {
-    const agentsByStore = {};
-    let totalAgents = 0;
-    for (const [storeId, agents] of agentPool) {
-        const active = agents.filter(a => a.ws.readyState === WebSocket.OPEN).length;
-        if (active > 0) {
-            agentsByStore[storeId] = active;
-            totalAgents += active;
-        }
+  const agentsByStore = {};
+  let totalAgents = 0;
+  for (const [storeId, agents] of agentPool) {
+    const active = agents.filter(a => a.ws.readyState === WebSocket.OPEN).length;
+    if (active > 0) {
+      agentsByStore[storeId] = active;
+      totalAgents += active;
     }
-    return {
-        total_agents: totalAgents,
-        total_stores: Object.keys(agentsByStore).length,
-        pending_requests: pendingRequests.size,
-        agents_by_store: agentsByStore,
-    };
+  }
+  return {
+    total_agents: totalAgents,
+    total_stores: Object.keys(agentsByStore).length,
+    pending_requests: pendingRequests.size,
+    agents_by_store: agentsByStore
+  };
 }
+
 /**
  * Get active remote desktop sessions.
  */
 export function getRemoteDesktopSessions() {
-    return Array.from(rdSessions.values()).map(s => ({
-        session_id: s.sessionId,
-        store_id: s.storeId,
-        user_id: s.userId,
-        agent_id: s.agentId,
-        started_at: s.startedAt.toISOString(),
-        frames_relayed: s.framesRelayed,
-        bytes_relayed: s.bytesRelayed,
-    }));
+  return Array.from(rdSessions.values()).map(s => ({
+    session_id: s.sessionId,
+    store_id: s.storeId,
+    user_id: s.userId,
+    agent_id: s.agentId,
+    started_at: s.startedAt.toISOString(),
+    frames_relayed: s.framesRelayed,
+    bytes_relayed: s.bytesRelayed
+  }));
 }
+
 /**
  * Get active portal sessions.
  */
 export function getPortalSessions() {
-    return Array.from(portalSessions.values()).map(s => ({
-        session_id: s.sessionId,
-        store_id: s.storeId,
-        initiator_agent_id: s.initiatorAgentId,
-        target_agent_id: s.targetAgentId,
-        capabilities: s.capabilities,
-        started_at: s.startedAt.toISOString(),
-        bytes_relayed: s.bytesRelayed,
-    }));
+  return Array.from(portalSessions.values()).map(s => ({
+    session_id: s.sessionId,
+    store_id: s.storeId,
+    initiator_agent_id: s.initiatorAgentId,
+    target_agent_id: s.targetAgentId,
+    capabilities: s.capabilities,
+    started_at: s.startedAt.toISOString(),
+    bytes_relayed: s.bytesRelayed
+  }));
 }
+
 // ============================================================================
 // INTERNALS
 // ============================================================================
+
 function pickAgent(storeId, agentId, nodeId) {
-    const agents = agentPool.get(storeId.toLowerCase());
-    if (!agents?.length)
-        return null;
-    // Filter to open connections
-    const open = agents.filter(a => a.ws.readyState === WebSocket.OPEN);
-    if (open.length === 0)
-        return null;
-    // Target specific agent if requested
-    if (agentId) {
-        return open.find(a => a.agentId === agentId) || null;
-    }
-    // Target specific node if requested
-    if (nodeId) {
-        return open.find(a => a.nodeId === nodeId) || null;
-    }
-    // Pick agent with most recent pong (most responsive)
-    return open.reduce((best, a) => a.lastPong > best.lastPong ? a : best);
+  const agents = agentPool.get(storeId.toLowerCase());
+  if (!agents?.length) return null;
+
+  // Filter to open connections
+  const open = agents.filter(a => a.ws.readyState === WebSocket.OPEN);
+  if (open.length === 0) return null;
+
+  // Target specific agent if requested
+  if (agentId) {
+    return open.find(a => a.agentId === agentId) || null;
+  }
+
+  // Target specific node if requested
+  if (nodeId) {
+    return open.find(a => a.nodeId === nodeId) || null;
+  }
+
+  // Pick agent with most recent pong (most responsive)
+  return open.reduce((best, a) => a.lastPong > best.lastPong ? a : best);
 }
 function pickAgentById(agentId) {
-    for (const [, agents] of agentPool) {
-        const found = agents.find(a => a.agentId === agentId && a.ws.readyState === WebSocket.OPEN);
-        if (found)
-            return found;
-    }
-    return null;
+  for (const [, agents] of agentPool) {
+    const found = agents.find(a => a.agentId === agentId && a.ws.readyState === WebSocket.OPEN);
+    if (found) return found;
+  }
+  return null;
 }
 function isJsonString(data) {
-    if (typeof data === "string")
-        return true;
-    if (Buffer.isBuffer(data)) {
-        // Quick check: JSON starts with { or [
-        return data.length > 0 && (data[0] === 0x7b || data[0] === 0x5b);
-    }
-    return false;
+  if (typeof data === "string") return true;
+  if (Buffer.isBuffer(data)) {
+    // Quick check: JSON starts with { or [
+    return data.length > 0 && (data[0] === 0x7b || data[0] === 0x5b);
+  }
+  return false;
 }
 function send(ws, data) {
-    if (ws.readyState === WebSocket.OPEN) {
-        ws.send(JSON.stringify(data));
-        return true;
-    }
-    return false;
+  if (ws.readyState === WebSocket.OPEN) {
+    ws.send(JSON.stringify(data));
+    return true;
+  }
+  return false;
 }
 function failPendingRequestsForAgent(agentId, reason) {
-    for (const [requestId, pending] of pendingRequests) {
-        if (pending.agentId === agentId) {
-            clearTimeout(pending.timer);
-            pendingRequests.delete(requestId);
-            pending.resolve({ success: false, error: reason });
-        }
+  for (const [requestId, pending] of pendingRequests) {
+    if (pending.agentId === agentId) {
+      clearTimeout(pending.timer);
+      pendingRequests.delete(requestId);
+      pending.resolve({
+        success: false,
+        error: reason
+      });
     }
+  }
 }
 function truncate(text) {
-    if (!text || text.length <= MAX_OUTPUT_CHARS)
-        return text;
-    return text.substring(0, MAX_OUTPUT_CHARS) + `\n...[truncated, ${text.length} total chars]`;
+  if (!text || text.length <= MAX_OUTPUT_CHARS) return text;
+  return text.substring(0, MAX_OUTPUT_CHARS) + `\n...[truncated, ${text.length} total chars]`;
 }
+
+// ============================================================================
+// CLUSTER COMMANDS — routes cluster operations to whale-node
+// ============================================================================
+
 /**
  * Execute a cluster command on the connected whale-node.
  * Sends via WebSocket and waits for the result.
  */
 export async function executeClusterCommand(storeId, args, options = {}) {
-    const agent = pickAgent(storeId, options.agent_id, options.node_id);
-    if (!agent) {
-        return {
-            success: false,
-            error: "No local agent connected for cluster commands.",
-        };
-    }
-    const requestId = randomUUID();
-    const timeout = Math.min(options.timeout || 60000, 600000);
-    const sent = send(agent.ws, {
-        type: "cluster_command",
-        request_id: requestId,
-        args,
-    });
-    if (!sent)
-        return { success: false, error: "Agent connection closed" };
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            pendingRequests.delete(requestId);
-            resolve({
-                success: false,
-                error: `Cluster command timed out after ${timeout}ms`,
-            });
-        }, timeout + 5000);
-        pendingRequests.set(requestId, { resolve, reject, timer, agentId: agent.agentId });
+  const agent = pickAgent(storeId, options.agent_id, options.node_id);
+  if (!agent) {
+    return {
+      success: false,
+      error: "No local agent connected for cluster commands."
+    };
+  }
+  const requestId = randomUUID();
+  const timeout = Math.min(options.timeout || 60000, 600000);
+  const sent = send(agent.ws, {
+    type: "cluster_command",
+    request_id: requestId,
+    args
+  });
+  if (!sent) return {
+    success: false,
+    error: "Agent connection closed"
+  };
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      pendingRequests.delete(requestId);
+      resolve({
+        success: false,
+        error: `Cluster command timed out after ${timeout}ms`
+      });
+    }, timeout + 5000);
+    pendingRequests.set(requestId, {
+      resolve,
+      reject,
+      timer,
+      agentId: agent.agentId
     });
+  });
 }
+
 // ============================================================================
 // SHUTDOWN
 // ============================================================================
+
 export function shutdownGateway() {
-    if (heartbeatTimer) {
-        clearInterval(heartbeatTimer);
-        heartbeatTimer = null;
-    }
-    // Close all agent connections
-    for (const [, agents] of agentPool) {
-        for (const agent of agents) {
-            send(agent.ws, { type: "shutdown", message: "Server shutting down" });
-            agent.ws.close(1001, "Server shutdown");
-        }
+  if (heartbeatTimer) {
+    clearInterval(heartbeatTimer);
+    heartbeatTimer = null;
+  }
+
+  // Close all agent connections
+  for (const [, agents] of agentPool) {
+    for (const agent of agents) {
+      send(agent.ws, {
+        type: "shutdown",
+        message: "Server shutting down"
+      });
+      agent.ws.close(1001, "Server shutdown");
     }
-    agentPool.clear();
-    // Reject all pending requests
-    for (const [, pending] of pendingRequests) {
-        clearTimeout(pending.timer);
-        pending.resolve({ success: false, error: "Gateway shutting down" });
-    }
-    pendingRequests.clear();
-    if (wss) {
-        wss.close();
-        wss = null;
-    }
-    console.log("[local-agent] Gateway shut down");
+  }
+  agentPool.clear();
+
+  // Reject all pending requests
+  for (const [, pending] of pendingRequests) {
+    clearTimeout(pending.timer);
+    pending.resolve({
+      success: false,
+      error: "Gateway shutting down"
+    });
+  }
+  pendingRequests.clear();
+  if (wss) {
+    wss.close();
+    wss = null;
+  }
+  console.log("[local-agent] Gateway shut down");
 }
+//# sourceMappingURL=local-agent-gateway.js.map