@action-llama/action-llama 0.13.0 → 0.13.2

package/docs/commands.md

@@ -1,286 +0,0 @@
-# CLI Commands
-
-## `al new <name>`
-
-Creates a new Action Llama project. Runs interactive setup to configure credentials and LLM defaults.
-
-```bash
-npx @action-llama/action-llama new my-project
-```
-
-Creates:
-- `my-project/package.json` — with `@action-llama/action-llama` dependency
-- `my-project/.gitignore`
-- `my-project/.workspace/` — runtime state directory
-- Credential files in `~/.action-llama/credentials/`
-
-After setup, create agents by following [Creating Agents](creating-agents.md).
-
-## `al doctor`
-
-Checks all agent credentials and interactively prompts for any that are missing. Discovers agents in the project, collects their credential requirements (plus any webhook secret credentials), and ensures each one exists on disk. Also generates a gateway API key if one doesn't exist yet (used for dashboard and CLI authentication).
-
-Additionally validates webhook trigger field configurations to catch common errors like:
-- Using `repository` instead of `repos`
-- Misspelled field names
-- Invalid field types
-
-This helps catch configuration mistakes early and ensures webhook triggers are properly configured.
-
-```bash
-al doctor -p .
-al doctor -p ./my-project
-al doctor -c               # Also push creds to cloud + reconcile IAM
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Push credentials to cloud and create per-agent IAM resources |
-
-### `al doctor -c`
-
-In cloud mode, `al doctor` additionally:
-1. Pushes all local credentials to the cloud secret manager configured in `[cloud]`
-2. Creates per-agent IAM resources (service accounts for Cloud Run, task roles for ECS)
-3. Grants each agent access to only its declared secrets
-
-**Cloud Run** (`cloud.provider = "cloud-run"`):
-
-For each agent, it:
-1. Creates `al-{agentName}@{gcpProject}.iam.gserviceaccount.com`
-2. Grants `secretmanager.secretAccessor` on that agent's declared credentials
-3. Grants `iam.serviceAccountUser` for Cloud Run execution
-
-Requires `gcloud` CLI with project admin permissions. See [Cloud Run docs](cloud-run.md) for full setup.
-
-**ECS Fargate** (`cloud.provider = "ecs"`):
-
-For each agent, it:
-1. Creates IAM role `al-{agentName}-task-role`
-2. Attaches an inline policy granting `secretsmanager:GetSecretValue` on that agent's declared credentials
-
-Requires AWS CLI with IAM admin permissions. See [ECS docs](ecs.md) for full setup.
-
-**VPS** (`cloud.provider = "vps"`):
-
-Pushes all local credentials to the VPS filesystem over SSH. No IAM roles — SSH access implies full access. See [VPS docs](vps-deployment.md) for full setup.
-
-**Re-run after adding agents:** Whenever you add a new agent to your project, re-run `al doctor -c` to create IAM resources for the new agent (Cloud Run/ECS) or push credentials (VPS). Without this, the new agent won't have access to its credentials at runtime.
-
-## `al creds ls`
-
-Lists all stored credentials grouped by type, showing field names but not values.
-
-```bash
-al creds ls
-```
-
-Example output:
-
-```
-  Anthropic API Key (anthropic_key)
-    anthropic_key  (token)
-
-  GitHub Token (github_token)
-    github_token  (token)
-
-  GitHub Webhook Secret (github_webhook_secret)
-    github_webhook_secret:myapp  (secret)
-    github_webhook_secret:staging  (secret)
-```
-
-Default instances are shown without the `:default` suffix.
-
-## `al creds add <ref>`
-
-Add or update a credential. Runs the interactive prompter with validation for the credential type.
-
-```bash
-al creds add github_token              # adds github_token:default
-al creds add github_webhook_secret:myapp
-al creds add git_ssh:prod
-```
-
-The `<ref>` format is `type` or `type:instance`. If no instance is specified, defaults to `default`. If the credential already exists, you'll be prompted to update it.
-
-## `al creds rm <ref>`
-
-Remove a credential from disk.
-
-```bash
-al creds rm github_token               # removes github_token:default
-al creds rm github_webhook_secret:myapp
-```
-
-Removes all field files for the credential instance. If the type directory becomes empty, it is also removed.
-
-## `al setup cloud`
-
-Interactive wizard for configuring cloud infrastructure. Prompts for provider selection and provider-specific fields, writes `[cloud]` to config.toml, pushes credentials, and provisions IAM — all in one shot.
-
-If an existing `[cloud]` config is found, you'll be prompted to tear down the old infrastructure first.
-
-```bash
-al setup cloud -p .
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-
-## `al teardown cloud`
-
-Deletes per-agent IAM resources (service accounts for Cloud Run, task roles for ECS), stops containers and cleans up credentials (VPS), and removes the `[cloud]` section from config.toml.
-
-```bash
-al teardown cloud -p .
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-
-## `al run <agent>`
-
-Manually triggers a single agent run. The agent runs once and the process exits when it completes. Useful for testing, debugging, or one-off runs without starting the full scheduler.
-
-```bash
-al run dev -p .
-al run reviewer -p ./my-project
-al run dev -c                 # Run on cloud
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Run on cloud infrastructure |
-
-## `al start`
-
-Starts the scheduler. Runs all agents on their configured schedules and listens for webhooks.
-
-```bash
-al start -p .
-al start -p ./my-project
-al start -c                   # Run on cloud
-al start -w                   # Enable web dashboard
-al start -e                   # VPS deployment: expose gateway publicly
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Run on cloud infrastructure |
-| `-w, --web-ui` | Enable web dashboard (see [Web Dashboard](web-dashboard.md)) |
-| `-e, --expose` | Bind gateway to `0.0.0.0` (public) while keeping local-mode features |
-| `-H, --headless` | Non-interactive mode (no TUI, no credential prompts) |
-
-## `al stat`
-
-Shows status of all discovered agents in the project.
-
-```bash
-al stat -p .
-al stat -c                    # Show cloud status
-```
-
-Displays each agent's schedule, credentials, and webhook configuration.
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Show cloud infrastructure status |
-
-## `al logs <agent>`
-
-View log files for a specific agent.
-
-```bash
-al logs dev -p .
-al logs dev -n 100          # Show last 100 entries
-al logs dev -f              # Follow/tail mode
-al logs dev -d 2025-01-15   # Specific date
-al logs dev -c              # Cloud logs
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-n, --lines <N>` | Number of log entries (default: 50) |
-| `-f, --follow` | Tail mode — watch for new entries |
-| `-d, --date <YYYY-MM-DD>` | View a specific date's log file |
-| `-c, --cloud` | View cloud logs (Cloud Logging / CloudWatch) |
-
-## `al pause [name]`
-
-Pause the scheduler or a single agent. Without a name, pauses the entire scheduler — all cron jobs stop firing. With a name, pauses that agent — its cron job stops firing and webhook events are ignored. In-flight runs continue until they finish. Requires the gateway.
-
-```bash
-al pause                              # Pause the scheduler
-al pause dev                          # Pause a single agent
-al pause reviewer -p ./my-project
-al pause dev -c                       # Pause via cloud gateway
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Forward pause request to the cloud-deployed scheduler's gateway |
-
-## `al resume [name]`
-
-Resume the scheduler or a single agent. Without a name, resumes the entire scheduler. With a name, resumes that agent — its cron job resumes firing and webhooks are accepted again.
-
-```bash
-al resume                             # Resume the scheduler
-al resume dev                         # Resume a single agent
-al resume reviewer -p ./my-project
-al resume dev -c                      # Resume via cloud gateway
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Forward resume request to the cloud-deployed scheduler's gateway |
-
-## `al kill <target>`
-
-Kill an agent (all running instances) or a single instance by ID. Tries the target as an agent name first; if not found, falls back to instance ID. This does **not** pause the agent — if it has a schedule, a new run will start at the next cron tick. To fully stop an agent, pause it first, then kill.
-
-```bash
-al kill dev                           # Kill all instances of an agent
-al kill my-agent-abc123               # Kill a single instance by ID
-al kill dev -p ./my-project
-al kill dev -c                        # Kill cloud tasks directly
-```
-
-| Option | Description |
-|--------|-------------|
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Kill cloud tasks directly via ECS StopTask / Cloud Run cancel APIs |
-
-## `al chat`
-
-Open an interactive console. Without an agent name, opens the project-level console for creating and managing agents. With an agent name, opens an interactive session scoped to that agent's environment — credentials are loaded and injected as environment variables (e.g. `GITHUB_TOKEN`, `GIT_SSH_COMMAND`), and the working directory is set to the agent's directory.
-
-```bash
-al chat                # project-level console
-al chat dev            # interactive session with dev agent's credentials
-al chat dev -c         # same, but credentials from cloud secrets manager
-```
-
-| Option | Description |
-|--------|-------------|
-| `[agent]` | Agent name — loads its credentials and environment |
-| `-p, --project <dir>` | Project directory (default: `.`) |
-| `-c, --cloud` | Load credentials from cloud secrets manager |
-
-When running in agent mode, the command probes the gateway and warns if it is not reachable:
-
-```
-⚠ No gateway detected at http://localhost:8080. Resource locks, agent calls, and signals are unavailable.
-  Start the scheduler with `al start -g` to enable these features.
-```
-
-The agent's ACTIONS.md is loaded as reference context but is **not** auto-executed — you drive the session interactively.

package/docs/config-reference.md

@@ -1,241 +0,0 @@
-# config.toml Reference
-
-The project-level `config.toml` lives at the root of your Action Llama project. All sections and fields are optional — sensible defaults are used for anything you omit. If the file doesn't exist at all, an empty config is assumed.
-
-## Full Annotated Example
-
-```toml
-# Default model for all agents (agents can override in their own agent-config.toml)
-[model]
-provider = "anthropic"
-model = "claude-sonnet-4-20250514"
-thinkingLevel = "medium"
-authType = "api_key"
-
-# Local Docker container settings
-[local]
-image = "al-agent:latest"   # Base image name (default: "al-agent:latest")
-memory = "4g"               # Memory limit per container (default: "4g")
-cpus = 2                    # CPU limit per container (default: 2)
-timeout = 900               # Default max container runtime in seconds (default: 900, overridable per-agent)
-
-# Cloud provider config (optional — only needed for `al start -c`)
-[cloud]
-provider = "cloud-run"      # "cloud-run", "ecs", or "vps"
-# ... provider-specific fields (see below)
-
-# Gateway HTTP server settings
-[gateway]
-port = 8080                 # Gateway port (default: 8080)
-lockTimeout = 1800          # Lock TTL in seconds (default: 1800 / 30 minutes)
-
-# Webhook sources — named webhook endpoints with provider type and credential
-[webhooks.my-github]
-type = "github"
-credential = "MyOrg"              # credential instance for HMAC validation
-
-# Scheduler settings
-maxReruns = 10              # Max consecutive reruns for successful agent runs (default: 10)
-maxCallDepth = 3            # Max depth for agent-to-agent call chains (default: 3)
-workQueueSize = 100         # Max queued work items (webhooks + calls) per agent (default: 100)
-```
-
-## Field Reference
-
-### Top-level fields
-
-| Field | Type | Default | Description |
-|-------|------|---------|-------------|
-| `maxReruns` | number | `10` | Maximum consecutive reruns when an agent requests a rerun via `al-rerun` before stopping |
-| `maxCallDepth` | number | `3` | Maximum depth for agent-to-agent call chains (A calls B calls C = depth 2) |
-| `workQueueSize` | number | `100` | Maximum queued work items (webhook events + agent calls) per agent when all runners are busy |
-
-### `[model]` — Default LLM
-
-Default model configuration inherited by all agents that don't define their own `[model]` section in `agent-config.toml`.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `provider` | string | Yes | LLM provider: `"anthropic"`, `"openai"`, `"groq"`, `"google"`, `"xai"`, `"mistral"`, `"openrouter"`, or `"custom"` |
-| `model` | string | Yes | Model ID (e.g. `"claude-sonnet-4-20250514"`, `"gpt-4o"`, `"gemini-2.0-flash-exp"`) |
-| `authType` | string | Yes | Auth method: `"api_key"`, `"oauth_token"`, or `"pi_auth"` |
-| `thinkingLevel` | string | No | Thinking budget: `"off"`, `"minimal"`, `"low"`, `"medium"`, `"high"`, `"xhigh"`. Only applies to Anthropic models with reasoning support. Ignored for other providers. |
-
-See [Models](models.md) for all supported providers, model IDs, auth types, and thinking levels.
-
-### `[local]` — Docker Container Settings
-
-Controls local Docker container isolation. These settings also apply as resource limits for Cloud Run jobs and ECS Fargate tasks.
-
-| Field | Type | Default | Description |
-|-------|------|---------|-------------|
-| `image` | string | `"al-agent:latest"` | Base Docker image name |
-| `memory` | string | `"4g"` | Memory limit per container (e.g. `"4g"`, `"8g"`, `"4096"` for ECS in MiB) |
-| `cpus` | number | `2` | CPU limit per container |
-| `timeout` | number | `900` | Default max container runtime in seconds. Individual agents can override this with `timeout` in their `agent-config.toml`. On AWS ECS, agents with effective timeout <= 900s automatically route to Lambda for faster cold starts. See [agent timeout docs](agent-config-reference.md#timeout). |
-
-### `[cloud]` — Cloud Provider
-
-Only needed when running agents on cloud infrastructure with `al start -c`. Configure using `al setup cloud` (interactive wizard) or manually.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `provider` | string | Yes | `"cloud-run"` (GCP), `"ecs"` (AWS), or `"vps"` (SSH + Docker) |
-
-#### Cloud Run fields (`provider = "cloud-run"`)
-
-| Field | Type | Required | Default | Description |
-|-------|------|----------|---------|-------------|
-| `gcpProject` | string | Yes | — | GCP project ID |
-| `region` | string | Yes | — | Cloud Run region (e.g. `"us-central1"`) |
-| `artifactRegistry` | string | Yes | — | Full Artifact Registry repo path (e.g. `"us-central1-docker.pkg.dev/my-project/al-images"`) |
-| `serviceAccount` | string | No | — | Runtime service account for job creation. Per-agent SAs are used for execution. |
-| `secretPrefix` | string | No | `"action-llama"` | Google Secret Manager name prefix |
-
-See [Cloud Run docs](cloud-run.md) for full setup.
-
-#### ECS Fargate fields (`provider = "ecs"`)
-
-| Field | Type | Required | Default | Description |
-|-------|------|----------|---------|-------------|
-| `awsRegion` | string | Yes | — | AWS region (e.g. `"us-east-1"`) |
-| `ecsCluster` | string | Yes | — | ECS cluster name or ARN |
-| `ecrRepository` | string | Yes | — | Full ECR repository URI (e.g. `"123456789012.dkr.ecr.us-east-1.amazonaws.com/al-images"`) |
-| `executionRoleArn` | string | Yes | — | IAM role ARN for task execution (ECR pull + CloudWatch Logs) |
-| `taskRoleArn` | string | Yes | — | Default IAM task role ARN (Secrets Manager access) |
-| `subnets` | string[] | Yes | — | VPC subnet IDs for Fargate tasks |
-| `securityGroups` | string[] | No | — | Security group IDs for Fargate tasks |
-| `awsSecretPrefix` | string | No | `"action-llama"` | AWS Secrets Manager name prefix |
-| `buildBucket` | string | No | auto-created | S3 bucket for CodeBuild source uploads |
-| `lambdaRoleArn` | string | No | auto-derived | Lambda execution role ARN. If omitted, per-agent roles (`al-{agentName}-lambda-role`) are derived automatically. |
-| `lambdaSubnets` | string[] | No | — | VPC subnet IDs for Lambda functions (only needed if Lambda must access VPC resources) |
-| `lambdaSecurityGroups` | string[] | No | — | Security group IDs for Lambda functions (only needed with `lambdaSubnets`) |
-
-See [ECS docs](ecs.md) for full setup.
-
-#### VPS fields (`provider = "vps"`)
-
-| Field | Type | Required | Default | Description |
-|-------|------|----------|---------|-------------|
-| `host` | string | Yes | — | Server IP address or hostname |
-| `sshUser` | string | No | `"root"` | SSH username |
-| `sshPort` | number | No | `22` | SSH port |
-| `sshKeyPath` | string | No | `"~/.ssh/id_rsa"` | Path to SSH private key |
-| `vultrInstanceId` | string | No | — | Vultr instance ID (set automatically if provisioned via `al setup cloud`) |
-| `vultrRegion` | string | No | — | Vultr region (set automatically if provisioned via `al setup cloud`) |
-
-See [VPS docs](vps-deployment.md) for full setup.
-
-### `[gateway]` — HTTP Server
-
-The gateway starts automatically when Docker mode or webhooks are enabled. It handles health checks, webhook reception, credential serving (local Docker only), resource locking, and the shutdown kill switch.
-
-| Field | Type | Default | Description |
-|-------|------|---------|-------------|
-| `port` | number | `8080` | Port for the gateway HTTP server |
-| `lockTimeout` | number | `1800` | Default lock TTL in seconds. Locks expire automatically after this duration unless refreshed via heartbeat. |
-
-### `[webhooks.*]` — Webhook Sources
-
-Named webhook sources that agents can reference in their `[[webhooks]]` triggers. Each source defines a provider type and an optional credential for signature validation.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `type` | string | Yes | Provider type: `"github"` or `"sentry"` |
-| `credential` | string | No | Credential instance name for HMAC signature validation (e.g. `"MyOrg"` maps to `github_webhook_secret:MyOrg`). Omit for unsigned webhooks. |
-
-```toml
-[webhooks.my-github]
-type = "github"
-credential = "MyOrg"              # uses github_webhook_secret:MyOrg for HMAC validation
-
-[webhooks.my-sentry]
-type = "sentry"
-credential = "SentryProd"         # uses sentry_client_secret:SentryProd
-
-[webhooks.unsigned-github]
-type = "github"                   # no credential — accepts unsigned webhooks
-```
-
-Agents reference these sources by name in their `agent-config.toml`:
-
-```toml
-[[webhooks]]
-source = "my-github"
-events = ["issues"]
-```
-
-## Minimal Examples
-
-### Anthropic with Docker (typical dev setup)
-
-```toml
-[model]
-provider = "anthropic"
-model = "claude-sonnet-4-20250514"
-thinkingLevel = "medium"
-authType = "api_key"
-```
-
-Everything else uses defaults: Docker enabled, 4GB memory, 2 CPUs, 15min timeout, gateway on port 8080.
-
-### Cloud Run production
-
-```toml
-[model]
-provider = "anthropic"
-model = "claude-sonnet-4-20250514"
-thinkingLevel = "medium"
-authType = "api_key"
-
-[local]
-memory = "8g"
-cpus = 4
-timeout = 7200
-
-[cloud]
-provider = "cloud-run"
-gcpProject = "my-gcp-project"
-region = "us-central1"
-artifactRegistry = "us-central1-docker.pkg.dev/my-gcp-project/al-images"
-
-[gateway]
-port = 3000
-```
-
-### ECS Fargate production
-
-```toml
-[model]
-provider = "anthropic"
-model = "claude-sonnet-4-20250514"
-thinkingLevel = "medium"
-authType = "api_key"
-
-[cloud]
-provider = "ecs"
-awsRegion = "us-east-1"
-ecsCluster = "al-cluster"
-ecrRepository = "123456789012.dkr.ecr.us-east-1.amazonaws.com/al-images"
-executionRoleArn = "arn:aws:iam::123456789012:role/ecsTaskExecutionRole"
-taskRoleArn = "arn:aws:iam::123456789012:role/al-default-task-role"
-subnets = ["subnet-abc123"]
-
-maxReruns = 5
-maxCallDepth = 2
-```
-
-### VPS production
-
-```toml
-[model]
-provider = "anthropic"
-model = "claude-sonnet-4-20250514"
-thinkingLevel = "medium"
-authType = "api_key"
-
-[cloud]
-provider = "vps"
-host = "5.6.7.8"
-sshUser = "root"
-```

package/docs/creating-agents.md

@@ -1,147 +0,0 @@
-# Creating Agents
-
-This guide walks you through creating an Action Llama agent from scratch.
-
-## Prerequisites
-
-- An Action Llama project (created with `al new <name>`)
-- Credentials configured in `~/.action-llama/credentials/` (see [Credentials](credentials.md))
-
-## Steps
-
-### 1. Create the agent directory
-
-Inside your project directory, create a folder for your agent under the `agents/` directory:
-
-```bash
-mkdir -p agents/my-agent
-```
-
-### 2. Write `agent-config.toml`
-
-Create `agents/my-agent/agent-config.toml`:
-
-```toml
-credentials = ["github_token", "git_ssh"]
-schedule = "*/5 * * * *"
-
-[params]
-repos = ["your-org/your-repo"]
-
-[model]
-provider = "anthropic"
-model = "claude-sonnet-4-20250514"
-thinkingLevel = "medium"
-authType = "api_key"
-```
-
-Supported providers: `anthropic`, `openai`, `groq`, `google`, `xai`, `mistral`, `openrouter`, `custom`. See [agent-config.toml Reference](agent-config-reference.md) for all available fields and provider examples.
-
-### 3. Write `ACTIONS.md`
-
-Create `agents/my-agent/ACTIONS.md` — this is the system prompt that defines your agent's behavior:
-
-```markdown
-# My Agent
-
-You are an automation agent. Your job is to ...
-
-Your configuration is in the `<agent-config>` block at the start of your prompt.
-
-`GITHUB_TOKEN` is already set in your environment. Use `gh` CLI and `git` directly.
-
-## Workflow
-
-1. **Step one** — ...
-2. **Step two** — ...
-
-## Rules
-
-- ...
-```
-
-The ACTIONS.md is injected as the agent's system prompt at runtime. Write it as instructions to the LLM.
-
-### 4. (Optional) Add preflight steps
-
-If your agent needs external context (repo contents, API data, issue lists), add `[[preflight]]` steps to `agent-config.toml`. Preflight runs after credentials are loaded but before the LLM session starts, so the agent begins with everything it needs:
-
-```toml
-[[preflight]]
-provider = "git-clone"
-[preflight.params]
-repo = "your-org/your-repo"
-dest = "/tmp/repo"
-depth = 1
-
-[[preflight]]
-provider = "shell"
-[preflight.params]
-command = "gh issue list --repo your-org/your-repo --label bug --json number,title --limit 20"
-output = "/tmp/context/issues.json"
-```
-
-Then reference the staged files in your ACTIONS.md:
-
-```markdown
-## Context
-- The repo is cloned at `/tmp/repo`
-- Open bug issues are at `/tmp/context/issues.json`
-```
-
-See [Preflight](agent-config-reference.md#preflight) for the full reference.
-
-### 5. Verify with `al stat`
-
-```bash
-al stat -p .
-```
-
-This should show your agent with its schedule and credentials.
-
-### 6. Run with `al start`
-
-```bash
-al start -p .
-```
-
-Your agent will run on its configured schedule and/or respond to webhooks.
-
-### 7. (Optional) Customize the project Dockerfile
-
-Every project has a `Dockerfile` at the root (created by `al new`) that defines the shared base image for all agents. If your agents need extra system packages, edit it:
-
-```dockerfile
-FROM al-agent:latest
-
-# Shared tools for all agents
-RUN apk add --no-cache github-cli python3
-```
-
-If only one specific agent needs extra tools, add a `Dockerfile` to that agent's directory instead:
-
-```dockerfile
-FROM al-agent:latest
-USER root
-RUN apk add --no-cache github-cli
-USER node
-```
-
-See [Docker docs](docker.md) for the full reference.
-
-### 8. (Cloud only) Re-run `al doctor -c`
-
-If you're running agents on cloud infrastructure, re-run `al doctor -c` after adding a new agent. This creates the per-agent IAM resources (service account for Cloud Run, task role for ECS) and grants the new agent access to its declared secrets.
-
-```bash
-al doctor -c -p .
-```
-
-Without this step, the new agent will fail to access its credentials at runtime.
-
-## Tips
-
-- Agent name is derived from the directory name — no need to put it in the config
-- Use `al-rerun` in your ACTIONS.md to tell the agent to run `al-rerun` when it did work and there may be more in the backlog
-- Params in the config are injected into the agent prompt as an `<agent-config>` XML block
-- See [Examples](examples/index.md) for complete working agents