feat: initialize managed portal

internal/managed/docker_runtime.go

@@ -0,0 +1,98 @@
+package managed
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+type DockerRuntime interface {
+	GetContainerStatus(containerName string) (string, error)
+	RestartContainer(containerName string) error
+}
+
+type CommandRunner func(ctx context.Context, name string, args ...string) ([]byte, error)
+
+type DockerController struct {
+	runner  CommandRunner
+	timeout time.Duration
+}
+
+func NewDockerController() *DockerController {
+	return &DockerController{
+		runner: func(ctx context.Context, name string, args ...string) ([]byte, error) {
+			return exec.CommandContext(ctx, name, args...).CombinedOutput()
+		},
+		timeout: 5 * time.Second,
+	}
+}
+
+func NewDockerControllerWithRunner(runner CommandRunner) *DockerController {
+	return &DockerController{
+		runner:  runner,
+		timeout: 5 * time.Second,
+	}
+}
+
+func NormalizeContainerStatus(raw string) string {
+	switch strings.TrimSpace(strings.ToLower(raw)) {
+	case "running":
+		return "running"
+	case "created", "exited", "paused":
+		return "stopped"
+	case "dead", "removing", "restarting":
+		return "failed"
+	default:
+		return "unknown"
+	}
+}
+
+func (c *DockerController) GetContainerStatus(containerName string) (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), c.timeout)
+	defer cancel()
+
+	output, err := c.runner(ctx, "docker", "inspect", "--format", "{{.State.Status}}", containerName)
+	status := NormalizeContainerStatus(string(output))
+	if status != "unknown" {
+		return status, nil
+	}
+	if err != nil {
+		return status, fmt.Errorf("docker inspect %s: %w", containerName, err)
+	}
+	return status, nil
+}
+
+func (c *DockerController) RestartContainer(containerName string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), c.timeout)
+	defer cancel()
+
+	output, err := c.runner(ctx, "docker", "restart", containerName)
+	if err != nil {
+		trimmed := strings.TrimSpace(string(output))
+		if trimmed != "" {
+			return fmt.Errorf("docker restart %s: %w: %s", containerName, err, trimmed)
+		}
+		return fmt.Errorf("docker restart %s: %w", containerName, err)
+	}
+	return nil
+}
+
+func IsDockerUnavailable(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	var execErr *exec.Error
+	if errors.As(err, &execErr) {
+		return execErr.Err == exec.ErrNotFound
+	}
+
+	message := err.Error()
+	return errors.Is(err, exec.ErrNotFound) ||
+		strings.Contains(message, `exec: "docker": executable file not found`) ||
+		strings.Contains(message, "failed to connect to the docker API") ||
+		strings.Contains(message, "docker.sock")
+}

internal/managed/docker_runtime_test.go

@@ -0,0 +1,88 @@
+package managed
+
+import (
+	"context"
+	"errors"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+func TestNormalizeContainerStatus(t *testing.T) {
+	t.Parallel()
+
+	cases := map[string]string{
+		"running":    "running",
+		"created":    "stopped",
+		" exited \n": "stopped",
+		"paused":     "stopped",
+		"dead":       "failed",
+		"removing":   "failed",
+		"restarting": "failed",
+		"unknown":    "unknown",
+		"":           "unknown",
+	}
+
+	for input, want := range cases {
+		if got := NormalizeContainerStatus(input); got != want {
+			t.Fatalf("NormalizeContainerStatus(%q) = %q, want %q", input, got, want)
+		}
+	}
+}
+
+func TestDockerControllerGetContainerStatus(t *testing.T) {
+	t.Parallel()
+
+	controller := NewDockerControllerWithRunner(func(ctx context.Context, name string, args ...string) ([]byte, error) {
+		if name != "docker" {
+			t.Fatalf("name = %q", name)
+		}
+		return []byte("running\n"), nil
+	})
+
+	status, err := controller.GetContainerStatus("store-dwell-alert")
+	if err != nil {
+		t.Fatalf("GetContainerStatus() error = %v", err)
+	}
+	if status != "running" {
+		t.Fatalf("status = %q", status)
+	}
+}
+
+func TestDockerControllerRestartContainer(t *testing.T) {
+	t.Parallel()
+
+	called := false
+	controller := NewDockerControllerWithRunner(func(ctx context.Context, name string, args ...string) ([]byte, error) {
+		called = true
+		return []byte("store-dwell-alert"), nil
+	})
+
+	if err := controller.RestartContainer("store-dwell-alert"); err != nil {
+		t.Fatalf("RestartContainer() error = %v", err)
+	}
+	if !called {
+		t.Fatal("runner was not called")
+	}
+}
+
+func TestDockerControllerRestartContainerIncludesOutputOnError(t *testing.T) {
+	t.Parallel()
+
+	controller := NewDockerControllerWithRunner(func(ctx context.Context, name string, args ...string) ([]byte, error) {
+		return []byte("permission denied"), errors.New("exit status 1")
+	})
+
+	err := controller.RestartContainer("store-dwell-alert")
+	if err == nil || !strings.Contains(err.Error(), "permission denied") {
+		t.Fatalf("RestartContainer() error = %v, want output included", err)
+	}
+}
+
+func TestIsDockerUnavailable(t *testing.T) {
+	t.Parallel()
+
+	if !IsDockerUnavailable(&exec.Error{Name: "docker", Err: exec.ErrNotFound}) {
+		t.Fatal("IsDockerUnavailable() = false, want true")
+	}
+}

internal/managed/manager.go

@@ -0,0 +1,209 @@
+package managed
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+type Manager struct {
+	registry *Registry
+	docker   DockerRuntime
+	remote   *RemoteClient
+}
+
+type ServiceState struct {
+	ID            string            `json:"id"`
+	DisplayName   string            `json:"display_name"`
+	ProjectType   string            `json:"project_type"`
+	ProjectRoot   string            `json:"project_root"`
+	ContainerName string            `json:"container_name"`
+	APIBaseURL    string            `json:"api_base_url"`
+	ServiceName   string            `json:"service_name"`
+	ConfigPath    string            `json:"config_path"`
+	RTSPField     string            `json:"rtsp_field"`
+	ResultType    string            `json:"result_type"`
+	ResultPaths   map[string]string `json:"result_paths"`
+	Status        string            `json:"status"`
+	RTSP          string            `json:"rtsp,omitempty"`
+	Summary       *ResultSummary    `json:"summary,omitempty"`
+	ResultFiles   []ResultFile      `json:"result_files,omitempty"`
+	ConfigError   string            `json:"config_error,omitempty"`
+	ResultError   string            `json:"result_error,omitempty"`
+	ServiceError  string            `json:"service_error,omitempty"`
+}
+
+func NewManager(registry *Registry, docker DockerRuntime, remote *RemoteClient) *Manager {
+	if registry == nil {
+		registry = EmptyRegistry()
+	}
+	if docker == nil {
+		docker = NewDockerController()
+	}
+	if remote == nil {
+		remote = NewRemoteClient(nil)
+	}
+	return &Manager{
+		registry: registry,
+		docker:   docker,
+		remote:   remote,
+	}
+}
+
+func (m *Manager) List() []*ServiceState {
+	states := make([]*ServiceState, 0, len(m.registry.Services))
+	for _, service := range m.registry.Services {
+		states = append(states, m.snapshot(service, false))
+	}
+	return states
+}
+
+func (m *Manager) Detail(id string) (*ServiceState, error) {
+	service, err := m.lookup(id)
+	if err != nil {
+		return nil, err
+	}
+	return m.snapshot(service, true), nil
+}
+
+func (m *Manager) Summary(id string) (*ResultSummary, error) {
+	service, err := m.lookup(id)
+	if err != nil {
+		return nil, err
+	}
+	return m.remote.GetSummary(context.Background(), service)
+}
+
+func (m *Manager) Files(id string) ([]ResultFile, error) {
+	service, err := m.lookup(id)
+	if err != nil {
+		return nil, err
+	}
+	return m.remote.GetFiles(context.Background(), service)
+}
+
+func (m *Manager) PreviewFile(id, path string, lines int) (*FilePreview, error) {
+	service, err := m.lookup(id)
+	if err != nil {
+		return nil, err
+	}
+	return m.remote.PreviewFile(context.Background(), service, path, lines)
+}
+
+func (m *Manager) Download(ctx context.Context, id, path string) (*http.Response, error) {
+	service, err := m.lookup(id)
+	if err != nil {
+		return nil, err
+	}
+	return m.remote.Download(ctx, service, path)
+}
+
+func (m *Manager) UpdateRTSP(id, rtsp string) (*ServiceState, error) {
+	service, err := m.lookup(id)
+	if err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(rtsp) == "" {
+		return nil, fmt.Errorf("rtsp url is required")
+	}
+	if _, err := m.remote.UpdateRTSP(context.Background(), service, rtsp); err != nil {
+		return nil, err
+	}
+	return m.snapshot(service, true), nil
+}
+
+func (m *Manager) Restart(id string) (*ServiceState, error) {
+	service, err := m.lookup(id)
+	if err != nil {
+		return nil, err
+	}
+	if err := m.docker.RestartContainer(service.ContainerName); err != nil {
+		return nil, err
+	}
+	return m.snapshot(service, true), nil
+}
+
+func (m *Manager) lookup(id string) (Service, error) {
+	service, ok := m.registry.Get(id)
+	if !ok {
+		return Service{}, fmt.Errorf("%w: %s", ErrServiceNotFound, id)
+	}
+	return service, nil
+}
+
+func (m *Manager) snapshot(service Service, includeFiles bool) *ServiceState {
+	state := &ServiceState{
+		ID:            service.ID,
+		DisplayName:   service.DisplayName,
+		ProjectType:   service.ProjectType,
+		ProjectRoot:   service.ProjectRoot,
+		ContainerName: service.ContainerName,
+		APIBaseURL:    service.APIBaseURL,
+		ServiceName:   service.ServiceName,
+		ConfigPath:    service.ConfigPath,
+		RTSPField:     service.RTSPField,
+		ResultType:    service.ResultType,
+		ResultPaths:   service.ResultPaths,
+		Status:        "unknown",
+	}
+
+	if payload, err := m.remote.GetConfig(context.Background(), service); err == nil {
+		state.RTSP = extractRTSP(payload)
+		state.ConfigPath = extractConfigPath(payload)
+	} else {
+		state.ConfigError = err.Error()
+	}
+
+	if status, err := m.docker.GetContainerStatus(service.ContainerName); err == nil {
+		state.Status = status
+	} else {
+		state.Status = status
+		if !IsDockerUnavailable(err) {
+			state.ServiceError = err.Error()
+		}
+	}
+
+	if summary, err := m.remote.GetSummary(context.Background(), service); err == nil {
+		state.Summary = summary
+	} else {
+		state.ResultError = err.Error()
+	}
+
+	if includeFiles {
+		if files, err := m.remote.GetFiles(context.Background(), service); err == nil {
+			state.ResultFiles = files
+		} else if state.ResultError == "" {
+			state.ResultError = err.Error()
+		}
+	}
+
+	return state
+}
+
+func extractRTSP(payload map[string]any) string {
+	if payload == nil {
+		return ""
+	}
+	if stream, ok := payload["stream"].(map[string]any); ok {
+		if rtsp, ok := stream["rtsp_url"].(string); ok {
+			return strings.TrimSpace(rtsp)
+		}
+	}
+	if runtime, ok := payload["runtime"].(map[string]any); ok {
+		if rtsp, ok := runtime["rtsp_url"].(string); ok {
+			return strings.TrimSpace(rtsp)
+		}
+	}
+	return ""
+}
+
+func extractConfigPath(payload map[string]any) string {
+	if payload == nil {
+		return ""
+	}
+	if configPath, ok := payload["config_path"].(string); ok {
+		return strings.TrimSpace(configPath)
+	}
+	return ""
+}

internal/managed/manager_test.go

@@ -0,0 +1,194 @@
+package managed
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+type fakeDockerRuntime struct {
+	statusByContainer map[string]string
+	restarted         []string
+}
+
+func (f *fakeDockerRuntime) GetContainerStatus(containerName string) (string, error) {
+	if status, ok := f.statusByContainer[containerName]; ok {
+		return status, nil
+	}
+	return "unknown", nil
+}
+
+func (f *fakeDockerRuntime) RestartContainer(containerName string) error {
+	f.restarted = append(f.restarted, containerName)
+	return nil
+}
+
+func TestManagedDockerAndRemoteAPI(t *testing.T) {
+	t.Parallel()
+
+	storeConfig := map[string]any{
+		"config_path": "/srv/store/config/local.yaml",
+		"stream": map[string]any{
+			"rtsp_url": "rtsp://store-old/stream",
+		},
+	}
+
+	client := &http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		response := func(status int, body any) (*http.Response, error) {
+			data, err := json.Marshal(body)
+			if err != nil {
+				return nil, err
+			}
+			return &http.Response{
+				StatusCode: status,
+				Header:     make(http.Header),
+				Body:       io.NopCloser(bytes.NewReader(data)),
+			}, nil
+		}
+
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/config":
+			return response(http.StatusOK, storeConfig)
+		case r.Method == http.MethodPut && r.URL.Path == "/store/api/manage/config":
+			var payload map[string]string
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				t.Fatalf("decode update payload: %v", err)
+			}
+			storeConfig["stream"].(map[string]any)["rtsp_url"] = payload["rtsp_url"]
+			return response(http.StatusOK, storeConfig)
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/summary":
+			return response(http.StatusOK, ResultSummary{
+				ResultType:     "store_dwell_alert",
+				Headline:       "Latest report shows 1 active customers, longest dwell 900s",
+				LastResultTime: "2026-04-16T10:00:00+08:00",
+				Metrics: map[string]any{
+					"active_customer_count": 1,
+					"longest_dwell_seconds": 900,
+				},
+			})
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/files":
+			return response(http.StatusOK, map[string]any{
+				"files": []ResultFile{{
+					Path: "logs/events.jsonl",
+					Name: "events.jsonl",
+				}},
+			})
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/files/preview":
+			return response(http.StatusOK, FilePreview{
+				Path:  "logs/events.jsonl",
+				Lines: []string{"line1", "line2"},
+				Count: 2,
+			})
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/files/download":
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Header: http.Header{
+					"Content-Disposition": []string{`attachment; filename="events.jsonl"`},
+				},
+				Body: io.NopCloser(strings.NewReader("downloaded")),
+			}, nil
+		default:
+			t.Fatalf("unexpected child request: %s %s", r.Method, r.URL.String())
+			return nil, nil
+		}
+	})}
+
+	registry := &Registry{
+		Services: []Service{{
+			ID:            "store_dwell_alert",
+			DisplayName:   "Store Dwell Alert",
+			ProjectType:   "store_dwell_alert",
+			ProjectRoot:   "/srv/store",
+			ContainerName: "store-dwell-alert",
+			ServiceName:   "store-dwell-alert",
+			APIBaseURL:    "http://managed.invalid/store",
+			ResultType:    "store_dwell_alert",
+		}},
+	}
+
+	docker := &fakeDockerRuntime{
+		statusByContainer: map[string]string{
+			"store-dwell-alert": "running",
+		},
+	}
+	manager := NewManager(registry, docker, NewRemoteClient(client))
+
+	states := manager.List()
+	if len(states) != 1 {
+		t.Fatalf("len(List()) = %d, want 1", len(states))
+	}
+	if states[0].Status != "running" {
+		t.Fatalf("List()[0].Status = %q", states[0].Status)
+	}
+
+	state, err := manager.Detail("store_dwell_alert")
+	if err != nil {
+		t.Fatalf("Detail() error = %v", err)
+	}
+	if state.Status != "running" {
+		t.Fatalf("state.Status = %q", state.Status)
+	}
+	if state.RTSP != "rtsp://store-old/stream" {
+		t.Fatalf("state.RTSP = %q", state.RTSP)
+	}
+	if state.ConfigPath != "/srv/store/config/local.yaml" {
+		t.Fatalf("state.ConfigPath = %q", state.ConfigPath)
+	}
+	if state.Summary == nil || state.Summary.Metrics["longest_dwell_seconds"] != float64(900) {
+		t.Fatalf("unexpected summary: %#v", state.Summary)
+	}
+	if len(state.ResultFiles) != 1 {
+		t.Fatalf("len(ResultFiles) = %d", len(state.ResultFiles))
+	}
+
+	if _, err := manager.UpdateRTSP("store_dwell_alert", "rtsp://store-new/stream"); err != nil {
+		t.Fatalf("UpdateRTSP() error = %v", err)
+	}
+	if got := storeConfig["stream"].(map[string]any)["rtsp_url"]; got != "rtsp://store-new/stream" {
+		t.Fatalf("updated rtsp = %#v", got)
+	}
+
+	summary, err := manager.Summary("store_dwell_alert")
+	if err != nil {
+		t.Fatalf("Summary() error = %v", err)
+	}
+	if summary.Headline == "" {
+		t.Fatalf("Summary().Headline is empty")
+	}
+
+	files, err := manager.Files("store_dwell_alert")
+	if err != nil {
+		t.Fatalf("Files() error = %v", err)
+	}
+	if len(files) != 1 {
+		t.Fatalf("len(Files()) = %d", len(files))
+	}
+
+	preview, err := manager.PreviewFile("store_dwell_alert", "logs/events.jsonl", 2)
+	if err != nil {
+		t.Fatalf("PreviewFile() error = %v", err)
+	}
+	if preview.Count != 2 {
+		t.Fatalf("preview.Count = %d", preview.Count)
+	}
+
+	resp, err := manager.Download(context.Background(), "store_dwell_alert", "logs/events.jsonl")
+	if err != nil {
+		t.Fatalf("Download() error = %v", err)
+	}
+	defer resp.Body.Close()
+	if !strings.Contains(resp.Header.Get("Content-Disposition"), "events.jsonl") {
+		t.Fatalf("Content-Disposition = %q", resp.Header.Get("Content-Disposition"))
+	}
+
+	if _, err := manager.Restart("store_dwell_alert"); err != nil {
+		t.Fatalf("Restart() error = %v", err)
+	}
+	if len(docker.restarted) != 1 || docker.restarted[0] != "store-dwell-alert" {
+		t.Fatalf("restarted = %#v", docker.restarted)
+	}
+}

internal/managed/registry.go

@@ -0,0 +1,134 @@
+package managed
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+var ErrServiceNotFound = errors.New("managed service not found")
+
+type Registry struct {
+	Services []Service `yaml:"services"`
+}
+
+type Service struct {
+	ID            string            `yaml:"id" json:"id"`
+	DisplayName   string            `yaml:"display_name" json:"display_name"`
+	ProjectType   string            `yaml:"project_type" json:"project_type"`
+	ProjectRoot   string            `yaml:"project_root" json:"project_root"`
+	ContainerName string            `yaml:"container_name" json:"container_name"`
+	APIBaseURL    string            `yaml:"api_base_url" json:"api_base_url"`
+	ServiceName   string            `yaml:"service_name" json:"service_name"`
+	ConfigPath    string            `yaml:"config_path" json:"config_path"`
+	RTSPField     string            `yaml:"rtsp_field" json:"rtsp_field"`
+	ResultType    string            `yaml:"result_type" json:"result_type"`
+	ResultPaths   map[string]string `yaml:"result_paths" json:"result_paths"`
+}
+
+func EmptyRegistry() *Registry {
+	return &Registry{Services: []Service{}}
+}
+
+func LoadRegistry(path string) (*Registry, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read managed registry: %w", err)
+	}
+
+	var registry Registry
+	if err := yaml.Unmarshal(data, &registry); err != nil {
+		return nil, fmt.Errorf("parse managed registry: %w", err)
+	}
+
+	baseDir := filepath.Dir(path)
+	ids := make(map[string]struct{}, len(registry.Services))
+	for i := range registry.Services {
+		svc := &registry.Services[i]
+		if err := normalizeService(baseDir, svc); err != nil {
+			return nil, fmt.Errorf("service[%d]: %w", i, err)
+		}
+		if _, exists := ids[svc.ID]; exists {
+			return nil, fmt.Errorf("duplicate service id %q", svc.ID)
+		}
+		ids[svc.ID] = struct{}{}
+	}
+
+	if registry.Services == nil {
+		registry.Services = []Service{}
+	}
+
+	return &registry, nil
+}
+
+func (r *Registry) Get(id string) (Service, bool) {
+	for _, svc := range r.Services {
+		if svc.ID == id {
+			return svc, true
+		}
+	}
+	return Service{}, false
+}
+
+func normalizeService(baseDir string, svc *Service) error {
+	svc.ID = strings.TrimSpace(svc.ID)
+	svc.DisplayName = strings.TrimSpace(svc.DisplayName)
+	svc.ProjectType = strings.TrimSpace(svc.ProjectType)
+	svc.ContainerName = strings.TrimSpace(svc.ContainerName)
+	svc.APIBaseURL = strings.TrimSpace(svc.APIBaseURL)
+	svc.ServiceName = strings.TrimSpace(svc.ServiceName)
+	svc.ConfigPath = strings.TrimSpace(svc.ConfigPath)
+	svc.RTSPField = strings.TrimSpace(svc.RTSPField)
+	svc.ResultType = strings.TrimSpace(svc.ResultType)
+
+	if svc.ID == "" {
+		return errors.New("id is required")
+	}
+	if svc.DisplayName == "" {
+		return errors.New("display_name is required")
+	}
+	if svc.ProjectType == "" {
+		return errors.New("project_type is required")
+	}
+	if svc.ContainerName == "" {
+		return errors.New("container_name is required")
+	}
+	if svc.APIBaseURL == "" {
+		return errors.New("api_base_url is required")
+	}
+	if svc.ResultType == "" {
+		return errors.New("result_type is required")
+	}
+
+	projectRoot := strings.TrimSpace(svc.ProjectRoot)
+	if projectRoot == "" {
+		return errors.New("project_root is required")
+	}
+	svc.ProjectRoot = resolvePath(baseDir, projectRoot)
+	if svc.ServiceName == "" {
+		svc.ServiceName = svc.ContainerName
+	}
+	if svc.ConfigPath != "" {
+		svc.ConfigPath = resolvePath(baseDir, svc.ConfigPath)
+	}
+
+	if svc.ResultPaths == nil {
+		svc.ResultPaths = map[string]string{}
+	}
+	for key, path := range svc.ResultPaths {
+		svc.ResultPaths[key] = resolvePath(baseDir, strings.TrimSpace(path))
+	}
+
+	return nil
+}
+
+func resolvePath(baseDir, path string) string {
+	if filepath.IsAbs(path) {
+		return filepath.Clean(path)
+	}
+	return filepath.Clean(filepath.Join(baseDir, path))
+}

internal/managed/registry_test.go

@@ -0,0 +1,101 @@
+package managed
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadRegistry(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	registryPath := filepath.Join(root, "managed_services.yaml")
+	writeFile(t, registryPath, `
+services:
+  - id: store_dwell_alert
+    display_name: Store Dwell Alert
+    project_type: store_dwell_alert
+    project_root: ./store_dwell_alert
+    container_name: store-dwell-alert
+    api_base_url: http://store-dwell-alert:18081
+    config_path: ./configs/store.yaml
+    result_type: store_dwell_alert
+  - id: people_flow_project
+    display_name: People Flow Project
+    project_type: people_flow_project
+    project_root: ./people_flow_project
+    container_name: people-flow-project
+    api_base_url: http://people-flow-project:18082
+    result_type: people_flow_project
+`)
+
+	registry, err := LoadRegistry(registryPath)
+	if err != nil {
+		t.Fatalf("LoadRegistry() error = %v", err)
+	}
+
+	if len(registry.Services) != 2 {
+		t.Fatalf("len(Services) = %d, want 2", len(registry.Services))
+	}
+
+	store := registry.Services[0]
+	if store.ID != "store_dwell_alert" {
+		t.Fatalf("store.ID = %q", store.ID)
+	}
+	if store.ProjectRoot != filepath.Join(root, "store_dwell_alert") {
+		t.Fatalf("store.ProjectRoot = %q", store.ProjectRoot)
+	}
+	if store.ConfigPath != filepath.Join(root, "configs", "store.yaml") {
+		t.Fatalf("store.ConfigPath = %q", store.ConfigPath)
+	}
+	if store.ServiceName != "store-dwell-alert" {
+		t.Fatalf("store.ServiceName = %q", store.ServiceName)
+	}
+}
+
+func TestLoadRegistryRejectsDuplicateIDs(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	registryPath := filepath.Join(root, "managed_services.yaml")
+	writeFile(t, registryPath, `
+services:
+  - id: repeated
+    display_name: One
+    project_type: store
+    project_root: ./one
+    container_name: one
+    api_base_url: http://one
+    result_type: store
+  - id: repeated
+    display_name: Two
+    project_type: people
+    project_root: ./two
+    container_name: two
+    api_base_url: http://two
+    result_type: people
+`)
+
+	_, err := LoadRegistry(registryPath)
+	if err == nil || !strings.Contains(err.Error(), `duplicate service id "repeated"`) {
+		t.Fatalf("LoadRegistry() error = %v, want duplicate id", err)
+	}
+}
+
+func TestLoadRegistryRejectsMissingRequiredFields(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	registryPath := filepath.Join(root, "managed_services.yaml")
+	writeFile(t, registryPath, `
+services:
+  - id: missing_fields
+    display_name: Missing Fields
+`)
+
+	_, err := LoadRegistry(registryPath)
+	if err == nil || !strings.Contains(err.Error(), "project_type is required") {
+		t.Fatalf("LoadRegistry() error = %v, want missing field error", err)
+	}
+}

internal/managed/remote_client.go

@@ -0,0 +1,154 @@
+package managed
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+type RemoteClient struct {
+	httpClient HTTPDoer
+}
+
+func NewRemoteClient(client HTTPDoer) *RemoteClient {
+	if client == nil {
+		client = &http.Client{Timeout: 5 * time.Second}
+	}
+	return &RemoteClient{httpClient: client}
+}
+
+func (c *RemoteClient) GetConfig(ctx context.Context, service Service) (map[string]any, error) {
+	var payload map[string]any
+	if err := c.getJSON(ctx, service, "/api/manage/config", &payload); err != nil {
+		return nil, err
+	}
+	return payload, nil
+}
+
+func (c *RemoteClient) UpdateRTSP(ctx context.Context, service Service, rtsp string) (map[string]any, error) {
+	body := strings.NewReader(fmt.Sprintf(`{"rtsp_url":%q}`, rtsp))
+	req, err := c.newRequest(ctx, http.MethodPut, service, "/api/manage/config", body)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request %s %s: %w", req.Method, req.URL.String(), err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, decodeAPIError(resp)
+	}
+
+	var payload map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
+		return nil, fmt.Errorf("decode response %s: %w", req.URL.String(), err)
+	}
+	return payload, nil
+}
+
+func (c *RemoteClient) GetSummary(ctx context.Context, service Service) (*ResultSummary, error) {
+	var summary ResultSummary
+	if err := c.getJSON(ctx, service, "/api/manage/summary", &summary); err != nil {
+		return nil, err
+	}
+	return &summary, nil
+}
+
+func (c *RemoteClient) GetFiles(ctx context.Context, service Service) ([]ResultFile, error) {
+	var payload struct {
+		Files []ResultFile `json:"files"`
+	}
+	if err := c.getJSON(ctx, service, "/api/manage/files", &payload); err != nil {
+		return nil, err
+	}
+	return payload.Files, nil
+}
+
+func (c *RemoteClient) PreviewFile(ctx context.Context, service Service, path string, lines int) (*FilePreview, error) {
+	query := url.Values{}
+	query.Set("path", path)
+	query.Set("lines", fmt.Sprintf("%d", lines))
+
+	var preview FilePreview
+	if err := c.getJSON(ctx, service, "/api/manage/files/preview?"+query.Encode(), &preview); err != nil {
+		return nil, err
+	}
+	return &preview, nil
+}
+
+func (c *RemoteClient) Download(ctx context.Context, service Service, path string) (*http.Response, error) {
+	query := url.Values{}
+	query.Set("path", path)
+	req, err := c.newRequest(ctx, http.MethodGet, service, "/api/manage/files/download?"+query.Encode(), nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request %s %s: %w", req.Method, req.URL.String(), err)
+	}
+	if resp.StatusCode >= 400 {
+		defer resp.Body.Close()
+		return nil, decodeAPIError(resp)
+	}
+	return resp, nil
+}
+
+func (c *RemoteClient) getJSON(ctx context.Context, service Service, endpoint string, target any) error {
+	req, err := c.newRequest(ctx, http.MethodGet, service, endpoint, nil)
+	if err != nil {
+		return err
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("request %s %s: %w", req.Method, req.URL.String(), err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return decodeAPIError(resp)
+	}
+	if err := json.NewDecoder(resp.Body).Decode(target); err != nil {
+		return fmt.Errorf("decode response %s: %w", req.URL.String(), err)
+	}
+	return nil
+}
+
+func (c *RemoteClient) newRequest(ctx context.Context, method string, service Service, endpoint string, body io.Reader) (*http.Request, error) {
+	base := strings.TrimRight(service.APIBaseURL, "/")
+	req, err := http.NewRequestWithContext(ctx, method, base+endpoint, body)
+	if err != nil {
+		return nil, fmt.Errorf("build request for %s%s: %w", base, endpoint, err)
+	}
+	return req, nil
+}
+
+func decodeAPIError(resp *http.Response) error {
+	data, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+	var payload map[string]any
+	if err := json.Unmarshal(data, &payload); err == nil {
+		if message, ok := payload["error"].(string); ok && strings.TrimSpace(message) != "" {
+			return errors.New(message)
+		}
+	}
+	message := strings.TrimSpace(string(data))
+	if message == "" {
+		message = resp.Status
+	}
+	return errors.New(message)
+}

internal/managed/remote_client_test.go

@@ -0,0 +1,141 @@
+package managed
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+type roundTripFunc func(req *http.Request) (*http.Response, error)
+
+func (fn roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return fn(req)
+}
+
+func TestRemoteClientRoundTrip(t *testing.T) {
+	t.Parallel()
+
+	storeConfig := map[string]any{
+		"config_path": "/srv/store/config/local.yaml",
+		"stream": map[string]any{
+			"rtsp_url": "rtsp://store-old/stream",
+		},
+	}
+
+	client := NewRemoteClient(&http.Client{Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		response := func(status int, body any) (*http.Response, error) {
+			data, err := json.Marshal(body)
+			if err != nil {
+				return nil, err
+			}
+			return &http.Response{
+				StatusCode: status,
+				Header:     make(http.Header),
+				Body:       io.NopCloser(bytes.NewReader(data)),
+			}, nil
+		}
+
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/config":
+			return response(http.StatusOK, storeConfig)
+		case r.Method == http.MethodPut && r.URL.Path == "/store/api/manage/config":
+			var payload map[string]string
+			if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+				t.Fatalf("decode update payload: %v", err)
+			}
+			storeConfig["stream"].(map[string]any)["rtsp_url"] = payload["rtsp_url"]
+			return response(http.StatusOK, storeConfig)
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/summary":
+			return response(http.StatusOK, ResultSummary{
+				ResultType:     "store_dwell_alert",
+				Headline:       "Latest report shows 1 active customers, longest dwell 900s",
+				LastResultTime: "2026-04-16T10:00:00+08:00",
+				Metrics: map[string]any{
+					"active_customer_count": 1,
+					"longest_dwell_seconds": 900,
+				},
+			})
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/files":
+			return response(http.StatusOK, map[string]any{
+				"files": []ResultFile{{
+					Path: "logs/events.jsonl",
+					Name: "events.jsonl",
+				}},
+			})
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/files/preview":
+			return response(http.StatusOK, FilePreview{
+				Path:  "logs/events.jsonl",
+				Lines: []string{"line1", "line2"},
+				Count: 2,
+			})
+		case r.Method == http.MethodGet && r.URL.Path == "/store/api/manage/files/download":
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Header: http.Header{
+					"Content-Disposition": []string{`attachment; filename="events.jsonl"`},
+				},
+				Body: io.NopCloser(strings.NewReader("downloaded")),
+			}, nil
+		default:
+			t.Fatalf("unexpected child request: %s %s", r.Method, r.URL.String())
+			return nil, nil
+		}
+	})})
+
+	service := Service{
+		ID:         "store_dwell_alert",
+		APIBaseURL: "http://managed.invalid/store",
+	}
+
+	configPayload, err := client.GetConfig(context.Background(), service)
+	if err != nil {
+		t.Fatalf("GetConfig() error = %v", err)
+	}
+	if got := configPayload["config_path"]; got != "/srv/store/config/local.yaml" {
+		t.Fatalf("config_path = %#v", got)
+	}
+
+	if _, err := client.UpdateRTSP(context.Background(), service, "rtsp://store-new/stream"); err != nil {
+		t.Fatalf("UpdateRTSP() error = %v", err)
+	}
+	if got := storeConfig["stream"].(map[string]any)["rtsp_url"]; got != "rtsp://store-new/stream" {
+		t.Fatalf("updated rtsp = %#v", got)
+	}
+
+	summary, err := client.GetSummary(context.Background(), service)
+	if err != nil {
+		t.Fatalf("GetSummary() error = %v", err)
+	}
+	if summary.ResultType != "store_dwell_alert" {
+		t.Fatalf("summary.ResultType = %q", summary.ResultType)
+	}
+
+	files, err := client.GetFiles(context.Background(), service)
+	if err != nil {
+		t.Fatalf("GetFiles() error = %v", err)
+	}
+	if len(files) != 1 || files[0].Path != "logs/events.jsonl" {
+		t.Fatalf("files = %#v", files)
+	}
+
+	preview, err := client.PreviewFile(context.Background(), service, "logs/events.jsonl", 2)
+	if err != nil {
+		t.Fatalf("PreviewFile() error = %v", err)
+	}
+	if preview.Count != 2 {
+		t.Fatalf("preview.Count = %d", preview.Count)
+	}
+
+	resp, err := client.Download(context.Background(), service, "logs/events.jsonl")
+	if err != nil {
+		t.Fatalf("Download() error = %v", err)
+	}
+	defer resp.Body.Close()
+	if !strings.Contains(resp.Header.Get("Content-Disposition"), "events.jsonl") {
+		t.Fatalf("Content-Disposition = %q", resp.Header.Get("Content-Disposition"))
+	}
+}

internal/managed/test_helpers_test.go

@@ -0,0 +1,19 @@
+package managed
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeFile(t *testing.T, path, content string) string {
+	t.Helper()
+
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		t.Fatalf("MkdirAll(%q): %v", path, err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatalf("WriteFile(%q): %v", path, err)
+	}
+	return path
+}

internal/managed/types.go

@@ -0,0 +1,41 @@
+package managed
+
+type ResultSummary struct {
+	ResultType     string         `json:"result_type"`
+	Headline       string         `json:"headline"`
+	LastResultTime string         `json:"last_result_time,omitempty"`
+	Metrics        map[string]any `json:"metrics,omitempty"`
+}
+
+type StoreDwellWindowStat struct {
+	WindowStart         string `json:"window_start"`
+	WindowEnd           string `json:"window_end"`
+	ActiveCustomerCount int    `json:"active_customer_count"`
+	ActiveWaitSeconds   []int  `json:"active_wait_seconds"`
+	ClosedWaitSeconds   []int  `json:"closed_wait_seconds"`
+	MaxWaitSeconds      int    `json:"max_wait_seconds"`
+}
+
+type PeopleFlowWindowStat struct {
+	WindowStart       string         `json:"window_start"`
+	WindowEnd         string         `json:"window_end"`
+	TotalPeople       int            `json:"total_people"`
+	AgeCounts         map[string]int `json:"age_counts"`
+	GenderCounts      map[string]int `json:"gender_counts"`
+	UnknownAttributes int            `json:"unknown_attributes"`
+}
+
+type ResultFile struct {
+	Path       string `json:"path"`
+	Name       string `json:"name"`
+	Label      string `json:"label"`
+	Kind       string `json:"kind"`
+	Size       int64  `json:"size"`
+	ModifiedAt string `json:"modified_at"`
+}
+
+type FilePreview struct {
+	Path  string   `json:"path"`
+	Lines []string `json:"lines"`
+	Count int      `json:"count"`
+}