(defun actuator-shell-execute (action context)
  "Executes a bash command with timeout (via timeout(1)) and output limit."
  (declare (ignore context))
  (let* ((payload (getf action :payload))
         (cmd (getf payload :cmd))
         (timeout-sym (find-symbol "*BOUNCER-SHELL-TIMEOUT*" :passepartout))
         (timeout (or (getf payload :timeout) (if timeout-sym (symbol-value timeout-sym) 30)))
         (max-sym (find-symbol "*BOUNCER-SHELL-MAX-OUTPUT*" :passepartout))
         (max-output (or (getf payload :max-output) (if max-sym (symbol-value max-sym) 100000)))
         (wrapped-cmd (format nil "timeout ~a bash -c ~s" timeout cmd)))
    (harness-log "ACT [Shell]: ~a (timeout: ~as)" cmd timeout)
    (multiple-value-bind (out err code)
        (uiop:run-program (list "bash" "-c" wrapped-cmd)
                          :output :string :error-output :string
                          :ignore-error-status t)
      (cond
        ((= code 124) (format nil "ERROR: Command timed out after ~a seconds" timeout))
        ((> (length out) max-output)
         (format nil "~a~%... (output truncated to ~a chars)" (subseq out 0 max-output) max-output))
        ((= code 0) out)
        (t (format nil "ERROR [~a]: ~a" code err))))))

(register-actuator :shell #'actuator-shell-execute)

(defskill :passepartout-system-actuator-shell
  :priority 50
  :trigger (lambda (ctx) (declare (ignore ctx)) nil))