portacode 1.5.28.dev4__tar.gz → 1.5.29.dev0__tar.gz

{portacode-1.5.28.dev4 → portacode-1.5.29.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.5.28.dev4
+Version: 1.5.29.dev0
 Summary: Connect real machines to the Portacode AI development environment
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian

{portacode-1.5.28.dev4 → portacode-1.5.29.dev0}/portacode/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.5.28.dev4'
-__version_tuple__ = version_tuple = (1, 5, 28, 'dev4')
+__version__ = version = '1.5.29.dev0'
+__version_tuple__ = version_tuple = (1, 5, 29, 'dev0')
 
 __commit_id__ = commit_id = None

{portacode-1.5.28.dev4 → portacode-1.5.29.dev0}/portacode/connection/handlers/WEBSOCKET_PROTOCOL.md

@@ -449,15 +449,6 @@ Creates a Portacode-managed LXC container, starts it, and bootstraps the Portaco
 *   On success, the device will emit a [`proxmox_container_created`](#proxmox_container_created-event) event that includes the Portacode auth key produced inside the container.
 *   On failure, the device will emit an [`error`](#error) event.
 
-### `proxmox_resource_audit`
-
-Returns a credential-free live inventory for staff infrastructure reconciliation. The response includes node and storage capacity, every LXC/QEMU resource, Portacode description markers, managed Device IDs, cache-template generation/source metadata, linked-clone parent and dependent VMIDs, local records whose Proxmox guests are missing, deletion tombstones, runtime state, and consistency warnings. API tokens and device key material are never included.
-
-**Responses:**
-
-*   On success, the device emits `proxmox_resource_audit` with `resources`, `missing_resources`, `storages`, and host capacity data.
-*   On failure, the device emits an [`error`](#error) event.
-
 ### `start_proxmox_container`
 
 Starts a previously provisioned, Portacode-managed LXC container. Handled by [`StartProxmoxContainerHandler`](./proxmox_infra.py).

{portacode-1.5.28.dev4 → portacode-1.5.29.dev0}/portacode/connection/handlers/__init__.py

@@ -61,7 +61,6 @@ from .proxmox_infra import (
     StartProxmoxContainerHandler,
     StopProxmoxContainerHandler,
     RemoveProxmoxContainerHandler,
-    ProxmoxResourceAuditHandler,
 )
 from .cloudflare_tunnel import CloudflareTunnelSetupHandler
 from .cloudflare_forwarding import (
@@ -134,7 +133,6 @@ __all__ = [
     "StartProxmoxContainerHandler",
     "StopProxmoxContainerHandler",
     "RemoveProxmoxContainerHandler",
-    "ProxmoxResourceAuditHandler",
     "UpdatePortacodeHandler",
     "RevertProxmoxInfraHandler",
     "CloudflareTunnelSetupHandler",

portacode-1.5.29.dev0/portacode/connection/handlers/browser_handlers.py

@@ -0,0 +1,287 @@
+"""Bounded Playwright browser automation for Dashboard AI."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import os
+import re
+import time
+from pathlib import Path
+from typing import Any, Dict
+
+from .base import AsyncHandler
+from .runtime_user import get_default_runtime_user, get_runtime_user_home, mkdir_with_owner, wrap_argv_for_user
+
+
+_SAFE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$")
+_WORKERS: dict[tuple[str, str], "_BrowserWorker"] = {}
+_WORKERS_LOCK: asyncio.Lock | None = None
+_NODE_PATH: str | None = None
+_NODE_PATH_LOCK: asyncio.Lock | None = None
+_WORKER_IDLE_SECONDS = 300.0
+logger = logging.getLogger(__name__)
+_RUNNER = r"""
+const fs = require('fs');
+const readline = require('readline');
+const { chromium } = require('playwright');
+const locator = (p,s) => {
+  let l;
+  if (s.role) l=p.getByRole(s.role, s.name === undefined ? {} : {name:s.name, exact:!!s.exact});
+  else if (s.label) l=p.getByLabel(s.label, {exact:!!s.exact});
+  else if (s.text) l=p.getByText(s.text, {exact:!!s.exact});
+  else if (s.testid) l=p.getByTestId(s.testid);
+  else l=p.locator(s.css || s.selector);
+  return s.nth === undefined ? l : l.nth(s.nth);
+};
+let context=null, page=null;
+const closeContext = async () => {
+ if(context) await context.close().catch(()=>{});
+ context=null; page=null;
+};
+const ensureContext = async cfg => {
+ if(context && cfg.video_dir) await closeContext();
+ if(!context) {
+  const launch = {headless:true, viewport:cfg.viewport};
+  if (cfg.executable_path) launch.executablePath = cfg.executable_path;
+  if (cfg.video_dir) launch.recordVideo = {dir:cfg.video_dir, size:cfg.video_size};
+  context = await chromium.launchPersistentContext(cfg.profile_dir, launch);
+  const pages=context.pages(); page=pages[0] || await context.newPage();
+  context.on('close',()=>{context=null;page=null;});
+ }
+ if(!page || page.isClosed()) {const pages=context.pages();page=pages[0] || await context.newPage();}
+ await page.setViewportSize(cfg.viewport);
+ return page;
+};
+const run = async cfg => {
+ const out = {ok:false, session_id:cfg.session_id, steps:[], screenshots:[]};
+ let video;
+ try {
+  await ensureContext(cfg);
+  video=page.video(); const started=Date.now();
+  page.setDefaultTimeout(cfg.timeout_ms);
+  if (cfg.start_url) await page.goto(cfg.start_url, {waitUntil:'domcontentloaded'});
+  for (let i=0;i<cfg.steps.length;i++) {
+   if(cfg.deadline_ms && Date.now()-started > cfg.deadline_ms) throw Error('recording duration limit reached');
+   const s=cfg.steps[i], op=s.op; let value=null;
+   try {
+    const l = ['click','fill','press','select','check','uncheck','assert','read'].includes(op) ? locator(page,s) : null;
+    if(op==='goto') await page.goto(s.url,{waitUntil:s.wait_until||'domcontentloaded'});
+    else if(op==='click') await l.click();
+    else if(op==='fill') await l.fill(String(s.value??''));
+    else if(op==='press') await l.press(s.key);
+    else if(op==='select') value=await l.selectOption(s.value);
+    else if(op==='check') await l.check();
+    else if(op==='uncheck') await l.uncheck();
+    else if(op==='wait') s.ms ? await page.waitForTimeout(s.ms) : await page.waitForLoadState(s.state||'domcontentloaded');
+    else if(op==='assert') { const kind=s.kind||'visible'; if(kind==='visible') await l.waitFor({state:'visible'}); else if(kind==='hidden') await l.waitFor({state:'hidden'}); else if(kind==='text'){const got=await l.textContent();if(!String(got||'').includes(String(s.value)))throw Error(`expected text ${s.value}`); } else if(kind==='url'){if(!page.url().includes(String(s.value)))throw Error(`expected URL ${s.value}`);} else throw Error('unsupported assertion'); }
+    else if(op==='read') { if(s.attribute) value=await l.getAttribute(s.attribute); else if(s.kind==='value') value=await l.inputValue(); else if(s.kind==='count') value=await l.count(); else value=(await l.innerText()).slice(0,8000); }
+    else if(op==='screenshot') { const b=await page.screenshot({type:'jpeg',quality:cfg.image_quality,fullPage:!!s.full_page}); out.screenshots.push({step:i,data:b.toString('base64'),mime_type:'image/jpeg'}); }
+    else throw Error(`unsupported operation: ${op}`);
+    out.steps.push({i,op,ok:true,...(value===null?{}:{value})});
+   } catch(e) { out.steps.push({i,op,ok:false,error:String(e.message||e).slice(0,500)}); if(cfg.screenshot_on_failure){const b=await page.screenshot({type:'jpeg',quality:cfg.image_quality});out.screenshots.push({step:i,data:b.toString('base64'),mime_type:'image/jpeg',failure:true});} throw e; }
+  }
+  if(cfg.final_screenshot){const b=await page.screenshot({type:'jpeg',quality:cfg.image_quality});out.screenshots.push({step:'final',data:b.toString('base64'),mime_type:'image/jpeg'});}
+  out.ok=true; out.url=page.url(); out.title=await page.title();
+ } catch(e) {out.error=String(e.message||e).slice(0,1000);}
+ finally {
+  if(cfg.video_dir) await closeContext();
+  if(video && cfg.video_dir){try{out.video_path=await video.path();}catch{}}
+ }
+ return out;
+};
+const rl=readline.createInterface({input:process.stdin,crlfDelay:Infinity});
+rl.on('line', line => {
+ rl.pause();
+ (async()=>run(JSON.parse(line)))()
+  .then(out=>process.stdout.write(JSON.stringify(out)+'\n'))
+  .catch(e=>process.stdout.write(JSON.stringify({ok:false,error:String(e)})+'\n'))
+  .finally(()=>rl.resume());
+});
+rl.on('close', async()=>{await closeContext(); process.exit(0);});
+for(const signal of ['SIGTERM','SIGINT']) process.on(signal,async()=>{await closeContext();process.exit(0);});
+"""
+
+
+def _loop_lock(current: asyncio.Lock | None) -> asyncio.Lock:
+    """Return a lock belonging to the active event loop (tests create many loops)."""
+    if current is None or getattr(current, "_loop", None) not in (None, asyncio.get_running_loop()):
+        return asyncio.Lock()
+    return current
+
+
+async def _node_path() -> str:
+    global _NODE_PATH, _NODE_PATH_LOCK
+    if _NODE_PATH is not None:
+        return _NODE_PATH
+    _NODE_PATH_LOCK = _loop_lock(_NODE_PATH_LOCK)
+    async with _NODE_PATH_LOCK:
+        if _NODE_PATH is None:
+            npm = await asyncio.create_subprocess_exec(
+                "npm", "root", "-g", stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+            npm_out, npm_err = await npm.communicate()
+            if npm.returncode:
+                raise RuntimeError(
+                    f"Unable to locate global Node modules: {npm_err.decode(errors='replace')[:300]}"
+                )
+            _NODE_PATH = os.pathsep.join(filter(None, [
+                "/opt/portacode-playwright/node_modules", npm_out.decode().strip(),
+            ]))
+    return _NODE_PATH
+
+
+class _BrowserWorker:
+    def __init__(self, *, user: str, session_id: str, argv: list[str], env: dict[str, str]):
+        self.user = user
+        self.session_id = session_id
+        self.argv = argv
+        self.env = env
+        self.process: asyncio.subprocess.Process | None = None
+        self.stderr_task: asyncio.Task | None = None
+        self.stderr_tail = bytearray()
+        self.lock = asyncio.Lock()
+        self.idle_task: asyncio.Task | None = None
+        self.last_used = time.monotonic()
+
+    async def _start(self) -> None:
+        if self.process and self.process.returncode is None:
+            return
+        self.process = await asyncio.create_subprocess_exec(
+            *self.argv, stdin=asyncio.subprocess.PIPE, stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE, env=self.env,
+        )
+        self.stderr_task = asyncio.create_task(self._drain_stderr(self.process))
+
+    async def _drain_stderr(self, process: asyncio.subprocess.Process) -> None:
+        if not process.stderr:
+            return
+        try:
+            while chunk := await process.stderr.read(4096):
+                self.stderr_tail.extend(chunk)
+                del self.stderr_tail[:-65536]
+        except (asyncio.CancelledError, ValueError):
+            pass
+
+    def _schedule_idle_close(self) -> None:
+        if self.idle_task:
+            self.idle_task.cancel()
+        self.last_used = time.monotonic()
+        self.idle_task = asyncio.create_task(self._close_when_idle())
+
+    async def _close_when_idle(self) -> None:
+        try:
+            await asyncio.sleep(_WORKER_IDLE_SECONDS)
+            async with self.lock:
+                if time.monotonic() - self.last_used >= _WORKER_IDLE_SECONDS:
+                    await self._stop_locked()
+                    _WORKERS.pop((self.user, self.session_id), None)
+        except asyncio.CancelledError:
+            pass
+
+    async def run(self, config: dict[str, Any], timeout: float) -> dict[str, Any]:
+        async with self.lock:
+            await self._start()
+            assert self.process and self.process.stdin and self.process.stdout
+            try:
+                self.process.stdin.write((json.dumps(config) + "\n").encode())
+                await self.process.stdin.drain()
+                line = await asyncio.wait_for(self.process.stdout.readline(), timeout=timeout)
+                if not line:
+                    detail = bytes(self.stderr_tail).decode(errors="replace")[-500:]
+                    await self._stop_locked()
+                    raise RuntimeError(
+                        f"Playwright worker exited unexpectedly: {detail}"
+                    )
+                result = json.loads(line)
+            except (asyncio.TimeoutError, BrokenPipeError, json.JSONDecodeError) as exc:
+                await self._stop_locked()
+                if isinstance(exc, asyncio.TimeoutError):
+                    raise RuntimeError("Browser run exceeded its bounded execution time") from exc
+                raise RuntimeError(f"Playwright worker failed: {exc}") from exc
+            self._schedule_idle_close()
+            return result
+
+    async def _stop_locked(self) -> None:
+        process, self.process = self.process, None
+        stderr_task, self.stderr_task = self.stderr_task, None
+        if not process or process.returncode is not None:
+            if stderr_task:
+                await stderr_task
+            return
+        if process.stdin:
+            process.stdin.close()
+        try:
+            await asyncio.wait_for(process.wait(), timeout=5)
+        except asyncio.TimeoutError:
+            process.kill()
+            await process.wait()
+        if stderr_task:
+            await stderr_task
+
+
+async def _worker_for(*, user: str, session_id: str, argv: list[str], env: dict[str, str]) -> _BrowserWorker:
+    global _WORKERS_LOCK
+    _WORKERS_LOCK = _loop_lock(_WORKERS_LOCK)
+    async with _WORKERS_LOCK:
+        key = (user, session_id)
+        worker = _WORKERS.get(key)
+        if worker is None or worker.process and worker.process.returncode is not None:
+            worker = _BrowserWorker(user=user, session_id=session_id, argv=argv, env=env)
+            _WORKERS[key] = worker
+        return worker
+
+
+class BrowserRunHandler(AsyncHandler):
+    @property
+    def command_name(self) -> str:
+        return "browser_run"
+
+    async def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
+        session_id = str(message.get("session_id") or "default")
+        if not _SAFE_ID.fullmatch(session_id):
+            raise ValueError("session_id must contain only letters, numbers, dot, dash, or underscore")
+        steps = message.get("steps") or []
+        if not isinstance(steps, list) or len(steps) > 30:
+            raise ValueError("steps must be an array containing at most 30 actions")
+        encoded = json.dumps(steps)
+        if len(encoded) > 64_000:
+            raise ValueError("browser action payload is too large")
+        if sum(1 for step in steps if isinstance(step, dict) and step.get("op") == "screenshot") > 4:
+            raise ValueError("at most four explicit screenshots are allowed per run")
+        timeout_ms = min(max(int(message.get("timeout_ms") or 10_000), 250), 30_000)
+        width = min(max(int((message.get("viewport") or {}).get("width", 960)), 320), 1920)
+        height = min(max(int((message.get("viewport") or {}).get("height", 540)), 240), 1080)
+        user = get_default_runtime_user(message)
+        root = Path(get_runtime_user_home(message)) / ".local" / "share" / "portacode" / "browser"
+        profile = root / "profiles" / session_id
+        video_dir = root / "recordings" / session_id if message.get("record_video") else None
+        if not profile.exists():
+            mkdir_with_owner(profile, user)
+        if video_dir:
+            if not video_dir.exists():
+                mkdir_with_owner(video_dir, user)
+        executable = "/usr/bin/chromium-browser" if Path("/usr/bin/chromium-browser").exists() else None
+        config = {
+            "session_id": session_id, "profile_dir": str(profile), "video_dir": str(video_dir) if video_dir else None,
+            "video_size": {"width": min(width, 854), "height": min(height, 480)},
+            "viewport": {"width": width, "height": height}, "executable_path": executable,
+            "start_url": message.get("start_url"), "steps": steps, "timeout_ms": timeout_ms,
+            "deadline_ms": 45_000 if video_dir else None,
+            "image_quality": min(max(int(message.get("image_quality") or 65), 30), 85),
+            "final_screenshot": bool(message.get("final_screenshot", True)),
+            "screenshot_on_failure": bool(message.get("screenshot_on_failure", True)),
+        }
+        env = dict(os.environ)
+        env["NODE_PATH"] = await _node_path()
+        env.setdefault("PLAYWRIGHT_BROWSERS_PATH", "/opt/ms-playwright")
+        argv = wrap_argv_for_user(["node", "-e", _RUNNER], user, login=False)
+        worker = await _worker_for(
+            user=user, session_id=session_id, argv=argv, env=env,
+        )
+        run_limit = min(75 if video_dir else 300, 20 + len(steps) * timeout_ms / 1000)
+        result = await worker.run(config, timeout=run_limit)
+        result.update({"event": "browser_run_response", "success": True})
+        return result

{portacode-1.5.28.dev4 → portacode-1.5.29.dev0}/portacode/connection/handlers/proxmox_infra.py

@@ -1433,6 +1433,18 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
 
     managed_entries: List[Dict[str, Any]] = []
     unmanaged_entries: List[Dict[str, Any]] = []
+    templates: List[Dict[str, Any]] = []
+    live_vmids: Set[str] = set()
+    template_registry = {
+        str(record.get("vmid")): record
+        for record in _load_provisioning_templates()
+        if record.get("vmid") is not None
+    }
+    source_by_hash = {
+        _cache_source_hash(source): source
+        for source in (config.get("templates") or [])
+        if source
+    }
     allocated_ram = 0.0
     allocated_disk = 0.0
     allocated_cpu = 0.0
@@ -1445,6 +1457,7 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
             if vmid is None:
                 continue
             vmid_str = str(vmid)
+            live_vmids.add(vmid_str)
             cfg: Dict[str, Any] = {}
             try:
                 cfg = getattr(proxmox.nodes(node), getter)(vmid_str).config.get() or {}
@@ -1452,17 +1465,35 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
                 logger.debug("Failed to load %s config for %s: %s", kind, vmid_str, exc)
                 cfg = {}
 
+            description = str(cfg.get("description") or "")
             if kind == "lxc" and (
                 _parse_onboot_flag(cfg.get("template"))
-                or PORTACODE_CACHE_MARKER in str(cfg.get("description") or "")
+                or PORTACODE_CACHE_MARKER in description
             ):
                 # Cache template VMIDs are infrastructure, never user-managed
                 # containers. Their logical disk is still reserved capacity.
-                allocated_disk += _pick_container_disk_gib(kind, cfg, entry)
+                disk_gib = _pick_container_disk_gib(kind, cfg, entry)
+                allocated_disk += disk_gib
+                registry_record = template_registry.get(vmid_str) or {}
+                source_hash = _extract_marker_value(description, CACHE_SOURCE_MARKER)
+                templates.append({
+                    "type": kind,
+                    "vmid": vmid_str,
+                    "hostname": entry.get("name") or cfg.get("hostname") or f"lxc-{vmid_str}",
+                    "status": (entry.get("status") or "unknown").lower(),
+                    "storage": _pick_container_storage(kind, cfg, entry),
+                    "disk_gib": disk_gib,
+                    "ram_mib": _pick_container_ram_mib(kind, cfg, entry),
+                    "cpu_share": _pick_container_cpu_share(kind, cfg, entry),
+                    "source_template": registry_record.get("source_template") or source_by_hash.get(source_hash),
+                    "cache_id": registry_record.get("cache_id") or _extract_marker_value(description, CACHE_ID_MARKER),
+                    "cache_status": registry_record.get("status"),
+                    "is_cache_template": PORTACODE_CACHE_MARKER in description,
+                    "created_at": registry_record.get("created_at") or registry_record.get("discovered_at"),
+                })
                 continue
 
             record = record_map.get(vmid_str)
-            description = cfg.get("description") or ""
             managed = bool(record) or MANAGED_MARKER in description
             hostname = entry.get("name") or cfg.get("hostname") or (record.get("hostname") if record else None)
             storage = _pick_container_storage(kind, cfg, entry)
@@ -1484,12 +1515,15 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
                 "reserve_on_boot": reserve_on_boot,
                 "matches_default_storage": matches_default_storage,
                 "managed": managed,
+                "device_id": (record or {}).get("device_id") or _extract_marker_value(description, DEVICE_ID_MARKER),
+                "provisioning_id": (record or {}).get("provisioning_id") or _extract_marker_value(description, PROVISIONING_ID_MARKER),
+                "rootfs": cfg.get("rootfs"),
             }
 
             if managed:
                 merged = {
                     **base_entry,
-                    "device_id": record.get("device_id") if record else None,
+                    "device_id": base_entry["device_id"],
                     "template": record.get("template") if record else None,
                     "created_at": record.get("created_at") if record else None,
                 }
@@ -1523,13 +1557,36 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
 
     host_total_disk_gib = None
     available_disk_gib = None
-    if default_storage:
+    storage_summaries: List[Dict[str, Any]] = []
+    try:
+        storage_entries = proxmox.nodes(node).storage.get() or []
+    except Exception as exc:  # pragma: no cover - best effort
+        logger.debug("Unable to list Proxmox storages: %s", exc)
+        storage_entries = []
+    for storage in storage_entries:
+        storage_name = storage.get("storage")
         try:
-            storage_status = proxmox.nodes(node).storage(default_storage).status.get()
-            host_total_disk_gib = _bytes_to_gib(storage_status.get("total"))
-            available_disk_gib = _bytes_to_gib(storage_status.get("avail"))
+            storage_status = proxmox.nodes(node).storage(storage_name).status.get() or {}
         except Exception as exc:  # pragma: no cover - best effort
-            logger.debug("Unable to read storage status for %s: %s", default_storage, exc)
+            storage_status = {}
+            storage_error = str(exc)
+        else:
+            storage_error = None
+        storage_summary = {
+            "storage": storage_name,
+            "type": storage.get("type"),
+            "active": storage.get("active"),
+            "enabled": storage.get("enabled"),
+            "content": storage.get("content"),
+            "total_gib": _bytes_to_gib(storage_status.get("total")),
+            "used_gib": _bytes_to_gib(storage_status.get("used")),
+            "available_gib": _bytes_to_gib(storage_status.get("avail")),
+            "error": storage_error,
+        }
+        storage_summaries.append(storage_summary)
+        if storage_name == default_storage:
+            host_total_disk_gib = storage_summary["total_gib"]
+            available_disk_gib = storage_summary["available_gib"]
 
     summary = base_summary.copy()
     summary["containers"] = managed_entries
@@ -1538,6 +1595,22 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
     summary["total_disk_gib"] = int(sum(entry.get("disk_gib") or 0 for entry in managed_entries))
     summary["total_cpu_share"] = round(sum(entry.get("cpu_share") or 0 for entry in managed_entries), 2)
     summary["unmanaged_containers"] = unmanaged_entries
+    summary["templates"] = templates
+    summary["missing_containers"] = [
+        {
+            "vmid": vmid,
+            "device_id": str(record.get("device_id") or "") or None,
+            "hostname": record.get("hostname"),
+            "created_at": record.get("created_at"),
+            "template": record.get("template"),
+            "warning": "Local Portacode metadata exists but the Proxmox resource is absent",
+        }
+        for vmid, record in record_map.items()
+        if vmid not in live_vmids
+    ]
+    summary["storages"] = storage_summaries
+    summary["inventory_schema_version"] = 2
+    summary["inventory_updated_at"] = _current_time_iso()
     summary["allocated_ram_mib"] = round(allocated_ram, 2)
     summary["allocated_disk_gib"] = round(allocated_disk, 2)
     summary["allocated_cpu_share"] = round(allocated_cpu, 2)
@@ -5019,177 +5092,6 @@ class RemoveProxmoxContainerHandler(SyncHandler):
         }
 
 
-def _description_markers(description: str) -> Dict[str, str]:
-    markers: Dict[str, str] = {}
-    for part in str(description or "").split(";"):
-        part = part.strip()
-        if not part:
-            continue
-        if "=" in part:
-            key, value = part.split("=", 1)
-            markers[key.strip()] = value.strip()
-        elif ":" in part:
-            key, value = part.split(":", 1)
-            markers[key.strip()] = value.strip()
-    return markers
-
-
-def _linked_clone_parent_vmid(rootfs: Any) -> Optional[int]:
-    match = re.search(r"(?:^|:)base-(\d+)-disk-\d+", str(rootfs or ""))
-    return int(match.group(1)) if match else None
-
-
-def build_proxmox_resource_audit() -> Dict[str, Any]:
-    """Return a credential-free live inventory for staff-side reconciliation."""
-    config = _ensure_infra_configured()
-    proxmox = _connect_proxmox(config)
-    node = _get_node_from_config(config)
-    local_records = {str(record.get("vmid")): record for record in _load_managed_container_records()}
-    template_registry = _load_provisioning_templates()
-    registry_by_vmid = {str(record.get("vmid")): record for record in template_registry}
-    tombstones = _load_deletion_tombstones()
-    source_by_hash = {
-        _cache_source_hash(source): source for source in (config.get("templates") or []) if source
-    }
-    resources: List[Dict[str, Any]] = []
-
-    for kind, getter in (("lxc", "lxc"), ("qemu", "qemu")):
-        for summary in getattr(proxmox.nodes(node), getter).get() or []:
-            vmid = str(summary.get("vmid"))
-            try:
-                resource_config = getattr(proxmox.nodes(node), getter)(vmid).config.get() or {}
-            except Exception as exc:
-                resource_config = {}
-                config_error = str(exc)
-            else:
-                config_error = None
-            description = str(resource_config.get("description") or "")
-            markers = _description_markers(description)
-            is_template = kind == "lxc" and _parse_onboot_flag(resource_config.get("template"))
-            is_cache = PORTACODE_CACHE_MARKER in description
-            is_managed = MANAGED_MARKER in description
-            device_id = markers.get(DEVICE_ID_MARKER.rstrip("="))
-            parent_vmid = _linked_clone_parent_vmid(resource_config.get("rootfs")) if kind == "lxc" else None
-            registry_record = registry_by_vmid.get(vmid) or {}
-            local_record = local_records.get(vmid) or {}
-            warnings: List[str] = []
-            if is_managed and not device_id:
-                warnings.append("Managed marker has no device_id")
-            if device_id and device_id in tombstones:
-                warnings.append("Deletion requested but Proxmox resource still exists")
-            if is_managed and not local_record:
-                warnings.append("Managed resource has no local metadata record")
-            if is_cache and not registry_record:
-                warnings.append("Cache template is missing from the template registry")
-            if registry_record.get("status") == "stale" or (
-                is_cache and markers.get("cache_id") != PROVISIONING_CACHE_ID
-            ):
-                warnings.append("Cache template is stale")
-            if config_error:
-                warnings.append("Unable to read Proxmox resource configuration")
-            resources.append({
-                "kind": kind,
-                "vmid": vmid,
-                "name": summary.get("name") or resource_config.get("hostname") or f"{kind}-{vmid}",
-                "status": str(summary.get("status") or "unknown").lower(),
-                "is_template": is_template,
-                "is_cache_template": is_cache,
-                "is_portacode_managed": is_managed or is_cache,
-                "device_id": device_id,
-                "provisioning_id": markers.get("provisioning_id"),
-                "deletion_requested_at": tombstones.get(str(device_id)) if device_id else None,
-                "parent_template_vmid": str(parent_vmid) if parent_vmid is not None else None,
-                "description": description,
-                "markers": markers,
-                "rootfs": resource_config.get("rootfs"),
-                "storage": _pick_container_storage(kind, resource_config, summary),
-                "disk_gib": _pick_container_disk_gib(kind, resource_config, summary),
-                "ram_mib": _pick_container_ram_mib(kind, resource_config, summary),
-                "cpu_share": _pick_container_cpu_share(kind, resource_config, summary),
-                "onboot": _parse_onboot_flag(resource_config.get("onboot")),
-                "created_at": local_record.get("created_at") or registry_record.get("created_at"),
-                "source_template": registry_record.get("source_template") or source_by_hash.get(markers.get("cache_source")),
-                "cache_id": registry_record.get("cache_id") or markers.get("cache_id"),
-                "cache_status": registry_record.get("status"),
-                "local_record": {
-                    key: local_record.get(key)
-                    for key in ("device_id", "hostname", "created_at", "template", "status", "provisioning_id")
-                    if local_record.get(key) is not None
-                },
-                "warnings": warnings,
-                "config_error": config_error,
-            })
-
-    live_vmids = {resource["vmid"] for resource in resources}
-    missing_resources = []
-    for vmid, record in local_records.items():
-        if vmid in live_vmids:
-            continue
-        missing_resources.append({
-            "vmid": vmid,
-            "device_id": str(record.get("device_id") or "") or None,
-            "hostname": record.get("hostname"),
-            "created_at": record.get("created_at"),
-            "template": record.get("template"),
-            "warning": "Local Portacode metadata exists but the Proxmox resource is absent",
-        })
-
-    dependents: Dict[str, List[str]] = {}
-    for resource in resources:
-        parent_vmid = resource.get("parent_template_vmid")
-        if parent_vmid:
-            dependents.setdefault(str(parent_vmid), []).append(resource["vmid"])
-    for resource in resources:
-        resource["dependent_vmids"] = dependents.get(resource["vmid"], [])
-
-    node_status = proxmox.nodes(node).status.get() or {}
-    storages = []
-    for storage in proxmox.nodes(node).storage.get() or []:
-        storage_name = storage.get("storage")
-        try:
-            status = proxmox.nodes(node).storage(storage_name).status.get() or {}
-        except Exception as exc:
-            status = {"error": str(exc)}
-        storages.append({
-            "storage": storage_name,
-            "type": storage.get("type"),
-            "active": storage.get("active"),
-            "enabled": storage.get("enabled"),
-            "content": storage.get("content"),
-            "total_gib": _bytes_to_gib(status.get("total")),
-            "used_gib": _bytes_to_gib(status.get("used")),
-            "available_gib": _bytes_to_gib(status.get("avail")),
-            "error": status.get("error"),
-        })
-    return {
-        "event": "proxmox_resource_audit",
-        "success": True,
-        "generated_at": _current_time_iso(),
-        "node": node,
-        "cache_id": PROVISIONING_CACHE_ID,
-        "host": {
-            "status": node_status.get("status") or "online",
-            "uptime_s": node_status.get("uptime"),
-            "cpu_fraction": node_status.get("cpu"),
-            "cpu_cores": (node_status.get("cpuinfo") or {}).get("cores"),
-            "memory_total_mib": _bytes_to_mib((node_status.get("memory") or {}).get("total")),
-            "memory_used_mib": _bytes_to_mib((node_status.get("memory") or {}).get("used")),
-        },
-        "storages": storages,
-        "resources": resources,
-        "missing_resources": missing_resources,
-    }
-
-
-class ProxmoxResourceAuditHandler(SyncHandler):
-    @property
-    def command_name(self) -> str:
-        return "proxmox_resource_audit"
-
-    def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
-        return build_proxmox_resource_audit()
-
-
 class ConfigureProxmoxInfraHandler(SyncHandler):
     @property
     def command_name(self) -> str: