@autoclawd/autocode 0.4.0

package/dist/index.js

@@ -0,0 +1,1762 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/config.ts
+import { z } from "zod";
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import yaml from "js-yaml";
+var AgentConfigSchema = z.object({
+  model: z.string().default("claude-sonnet-4-6"),
+  maxIterations: z.number().min(1).max(50).default(10),
+  timeout: z.number().optional()
+});
+var DockerConfigSchema = z.object({
+  image: z.string().default("node:20"),
+  memory: z.string().default("4g"),
+  cpus: z.number().optional(),
+  setup: z.array(z.string()).optional(),
+  // Shell commands to run before Claude Code
+  volumes: z.array(z.string()).optional(),
+  // Extra bind mounts, e.g. ["~/.ssh:/home/autocode/.ssh:ro"]
+  network: z.enum(["bridge", "host", "none"]).default("bridge")
+  // Container network mode
+});
+var LinearConfigSchema = z.object({
+  apiKey: z.string(),
+  teamId: z.string(),
+  statuses: z.array(z.string()).default(["Todo"]),
+  assignToMe: z.boolean().default(true),
+  doneStatus: z.string().default("Done"),
+  inProgressStatus: z.string().default("In Progress")
+});
+var GitHubConfigSchema = z.object({
+  token: z.string()
+});
+var WebhookConfigSchema = z.object({
+  port: z.number().default(3e3),
+  url: z.string().optional(),
+  signingSecret: z.string().optional(),
+  webhookId: z.string().optional()
+});
+var ConfigSchema = z.object({
+  linear: LinearConfigSchema,
+  github: GitHubConfigSchema,
+  docker: DockerConfigSchema.default({}),
+  agent: AgentConfigSchema.default({}),
+  webhook: WebhookConfigSchema.default({}),
+  maxConcurrent: z.number().default(1)
+});
+var RepoLocalConfigSchema = z.object({
+  prompt: z.string().optional(),
+  base: z.string().default("main"),
+  agent: AgentConfigSchema.partial().optional(),
+  docker: DockerConfigSchema.partial().optional()
+});
+function resolveEnvVars(obj) {
+  if (typeof obj === "string") {
+    if (obj.startsWith("env:")) {
+      const envName = obj.slice(4);
+      const val = process.env[envName];
+      if (!val) throw new Error(`Environment variable ${envName} is not set`);
+      return val;
+    }
+    return obj;
+  }
+  if (Array.isArray(obj)) return obj.map(resolveEnvVars);
+  if (obj && typeof obj === "object") {
+    return Object.fromEntries(
+      Object.entries(obj).map(([k, v]) => [k, resolveEnvVars(v)])
+    );
+  }
+  return obj;
+}
+var CONFIG_DIR = join(homedir(), ".autocode");
+var CONFIG_FILE = join(CONFIG_DIR, "config.yaml");
+function loadConfig(path) {
+  const configPath = path ?? CONFIG_FILE;
+  if (!existsSync(configPath)) {
+    throw new Error(`Config not found: ${configPath}
+Run: autocode init`);
+  }
+  const content = readFileSync(configPath, "utf-8");
+  const raw = yaml.load(content);
+  if (!raw || typeof raw !== "object") {
+    throw new Error(`Config file is empty or invalid: ${configPath}`);
+  }
+  const resolved = resolveEnvVars(raw);
+  const result = ConfigSchema.safeParse(resolved);
+  if (!result.success) {
+    const issues = result.error.issues.map(
+      (i) => `  - ${i.path.join(".")}: ${i.message}`
+    ).join("\n");
+    throw new Error(`Invalid config (${configPath}):
+${issues}`);
+  }
+  return result.data;
+}
+function loadRepoLocalConfig(workspacePath) {
+  const yamlPath = join(workspacePath, ".autocode.yaml");
+  const ymlPath = join(workspacePath, ".autocode.yml");
+  const configPath = existsSync(yamlPath) ? yamlPath : existsSync(ymlPath) ? ymlPath : void 0;
+  if (!configPath) return void 0;
+  const raw = yaml.load(readFileSync(configPath, "utf-8"));
+  if (!raw || typeof raw !== "object") return void 0;
+  return RepoLocalConfigSchema.parse(raw);
+}
+function mergeConfigs(host, local) {
+  const agent = AgentConfigSchema.parse({
+    ...host.agent,
+    ...local?.agent
+  });
+  const docker2 = DockerConfigSchema.parse({
+    ...host.docker,
+    ...local?.docker
+  });
+  return { agent, docker: docker2, prompt: local?.prompt };
+}
+function parseRepoFromLabels(labels) {
+  for (const label of labels) {
+    const match = label.match(/^repo:(.+)/i);
+    if (match) {
+      const value = match[1].trim();
+      if (value.startsWith("https://")) return value;
+      if (value.includes("/")) return `https://github.com/${value}`;
+    }
+  }
+  return void 0;
+}
+function parseBaseFromLabels(labels) {
+  for (const label of labels) {
+    const match = label.match(/^base:(.+)/i);
+    if (match) {
+      return match[1].trim();
+    }
+  }
+  return void 0;
+}
+
+// src/linear.ts
+import { LinearClient } from "@linear/sdk";
+
+// src/logger.ts
+import chalk from "chalk";
+import { appendFileSync, mkdirSync, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+var currentLevel = "info";
+var logFilePath;
+var levels = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+function setLogLevel(level) {
+  currentLevel = level;
+}
+function enableFileLogging() {
+  const logDir = join2(homedir2(), ".autocode", "logs");
+  if (!existsSync2(logDir)) {
+    mkdirSync(logDir, { recursive: true });
+  }
+  const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  logFilePath = join2(logDir, `autocode-${date}.log`);
+}
+function shouldLog(level) {
+  return levels[level] >= levels[currentLevel];
+}
+function timestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(11, 19);
+}
+function fullTimestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function writeToFile(level, msg) {
+  if (!logFilePath) return;
+  try {
+    appendFileSync(logFilePath, `${fullTimestamp()} [${level.padEnd(5)}] ${msg}
+`);
+  } catch {
+  }
+}
+var log = {
+  debug(msg, ...args) {
+    writeToFile("DEBUG", msg);
+    if (shouldLog("debug")) console.log(chalk.gray(`[${timestamp()}] ${msg}`), ...args);
+  },
+  info(msg, ...args) {
+    writeToFile("INFO", msg);
+    if (shouldLog("info")) console.log(chalk.blue(`[${timestamp()}]`), msg, ...args);
+  },
+  warn(msg, ...args) {
+    writeToFile("WARN", msg);
+    if (shouldLog("warn")) console.log(chalk.yellow(`[${timestamp()}] WARN`), msg, ...args);
+  },
+  error(msg, ...args) {
+    writeToFile("ERROR", msg);
+    if (shouldLog("error")) console.log(chalk.red(`[${timestamp()}] ERROR`), msg, ...args);
+  },
+  success(msg, ...args) {
+    writeToFile("INFO", `\u2713 ${msg}`);
+    if (shouldLog("info")) console.log(chalk.green(`[${timestamp()}] \u2713`), msg, ...args);
+  },
+  ticket(id, msg, ...args) {
+    writeToFile("INFO", `[${id}] ${msg}`);
+    if (shouldLog("info")) console.log(chalk.cyan(`[${timestamp()}] [${id}]`), msg, ...args);
+  }
+};
+
+// src/linear.ts
+function createLinearClient(config) {
+  return new LinearClient({ apiKey: config.linear.apiKey });
+}
+async function fetchTicket(client, identifier) {
+  const match = identifier.match(/^([A-Za-z]+)-(\d+)$/);
+  if (!match) return void 0;
+  const [, teamKey, numStr] = match;
+  const normalizedKey = teamKey.toUpperCase();
+  const team = await client.team(normalizedKey);
+  const result = await team.issues({
+    filter: { number: { eq: parseInt(numStr) } },
+    first: 1
+  });
+  const issue = result.nodes[0];
+  if (!issue) return void 0;
+  const labels = await issue.labels();
+  const labelNames = labels.nodes.map((l) => l.name);
+  const repoUrl = parseRepoFromLabels(labelNames);
+  const baseBranch = parseBaseFromLabels(labelNames);
+  return {
+    id: issue.id,
+    identifier: issue.identifier,
+    title: issue.title,
+    description: issue.description ?? "",
+    labels: labelNames,
+    repoUrl,
+    baseBranch,
+    url: issue.url
+  };
+}
+async function claimTicket(client, config, ticketId) {
+  log.info(`Claiming ticket, moving to "${config.linear.inProgressStatus}"`);
+  const team = await client.team(config.linear.teamId);
+  const states = await team.states();
+  const target = config.linear.inProgressStatus.toLowerCase();
+  const inProgress = states.nodes.find((s) => s.name.toLowerCase() === target);
+  if (!inProgress) {
+    log.warn(`State "${config.linear.inProgressStatus}" not found, skipping status update`);
+    return;
+  }
+  await client.updateIssue(ticketId, { stateId: inProgress.id });
+}
+async function completeTicket(client, config, ticketId, comment) {
+  await client.createComment({ issueId: ticketId, body: comment });
+  const team = await client.team(config.linear.teamId);
+  const states = await team.states();
+  const doneTarget = config.linear.doneStatus.toLowerCase();
+  const done = states.nodes.find((s) => s.name.toLowerCase() === doneTarget);
+  if (done) {
+    await client.updateIssue(ticketId, { stateId: done.id });
+  }
+}
+async function addBranchLabel(client, ticketId, branchName) {
+  try {
+    const issue = await client.issue(ticketId);
+    const team = await issue.team;
+    if (!team) return;
+    const teamLabels = await team.labels();
+    const labelName = `base:${branchName}`;
+    let labelId = teamLabels.nodes.find((l) => l.name === labelName)?.id;
+    if (!labelId) {
+      const result = await client.createIssueLabel({
+        name: labelName,
+        teamId: team.id
+      });
+      const label = await result.issueLabel;
+      labelId = label?.id;
+    }
+    if (labelId) {
+      const currentLabels = await issue.labels();
+      const labelIds = currentLabels.nodes.map((l) => l.id);
+      if (!labelIds.includes(labelId)) {
+        await client.updateIssue(ticketId, {
+          labelIds: [...labelIds, labelId]
+        });
+        log.info(`Added "base:${branchName}" label to ticket for stacked diffs`);
+      }
+    }
+  } catch (err) {
+    log.debug(`Could not add branch label: ${err instanceof Error ? err.message : err}`);
+  }
+}
+async function failTicket(client, ticketId, reason) {
+  await client.createComment({
+    issueId: ticketId,
+    body: `**autocode failed:**
+
+${reason}`
+  });
+}
+
+// src/github.ts
+import { Octokit } from "@octokit/rest";
+function createOctokit(config) {
+  return new Octokit({ auth: config.github.token });
+}
+function parseRepoUrl(url) {
+  const match = url.match(/github\.com[/:]([^/]+)\/([^/.]+)/);
+  if (!match) throw new Error(`Cannot parse GitHub URL: ${url}`);
+  return { owner: match[1], repo: match[2] };
+}
+async function openPR(octokit, opts) {
+  const { owner, repo } = parseRepoUrl(opts.repoUrl);
+  const existing = await octokit.rest.pulls.list({
+    owner,
+    repo,
+    head: `${owner}:${opts.branch}`,
+    state: "open"
+  });
+  if (existing.data.length > 0) {
+    const pr2 = existing.data[0];
+    log.info(`PR already exists: ${pr2.html_url}`);
+    await octokit.rest.pulls.update({
+      owner,
+      repo,
+      pull_number: pr2.number,
+      body: opts.body
+    });
+    return { url: pr2.html_url, number: pr2.number };
+  }
+  const pr = await octokit.rest.pulls.create({
+    owner,
+    repo,
+    title: opts.title,
+    body: opts.body,
+    head: opts.branch,
+    base: opts.baseBranch
+  });
+  log.success(`PR opened: ${pr.data.html_url}`);
+  return { url: pr.data.html_url, number: pr.data.number };
+}
+
+// src/webhook.ts
+import { createServer } from "http";
+import { createHmac, timingSafeEqual } from "crypto";
+
+// src/docker.ts
+import Docker from "dockerode";
+import { PassThrough } from "stream";
+import { homedir as homedir3, tmpdir } from "os";
+import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync, mkdtempSync, rmSync } from "fs";
+import { execSync } from "child_process";
+var docker = new Docker();
+async function checkDockerAvailable() {
+  try {
+    await docker.ping();
+  } catch (err) {
+    throw new Error(
+      "Cannot connect to Docker daemon. Is Docker running?\nInstall: https://docs.docker.com/get-docker/"
+    );
+  }
+}
+var AUTOCODE_BASE_DOCKERFILE = `FROM node:20-bookworm
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \\
+    build-essential git curl wget ca-certificates openssh-client jq unzip \\
+    python3 python3-pip python3-venv python3-dev \\
+    ruby ruby-dev \\
+    && rm -rf /var/lib/apt/lists/*
+ARG GO_VERSION=1.22.2
+RUN curl -fsSL "https://go.dev/dl/go\${GO_VERSION}.linux-$(dpkg --print-architecture).tar.gz" \\
+    | tar -xz -C /usr/local
+ENV PATH="/usr/local/go/bin:\${PATH}"
+RUN npm install -g @anthropic-ai/claude-code@latest
+WORKDIR /workspace
+`;
+async function ensureImage(image) {
+  try {
+    await docker.getImage(image).inspect();
+    log.debug(`Image ${image} found locally`);
+    return;
+  } catch {
+  }
+  if (image === "autocode-base") {
+    log.info("Building autocode-base image (first time only, takes a few minutes)...");
+    const buildDir = mkdtempSync(join3(tmpdir(), "autocode-build-"));
+    try {
+      writeFileSync(join3(buildDir, "Dockerfile"), AUTOCODE_BASE_DOCKERFILE);
+      execSync(`docker build -t autocode-base ${buildDir}`, {
+        stdio: "inherit",
+        timeout: 6e5
+      });
+      log.success("autocode-base image built");
+      return;
+    } catch (err) {
+      throw new Error(
+        `Failed to build autocode-base image.
+You can build manually: docker build -t autocode-base .
+Or use a different image in your config (e.g. node:20).
+Error: ${err instanceof Error ? err.message : err}`
+      );
+    } finally {
+      rmSync(buildDir, { recursive: true, force: true });
+    }
+  }
+  log.info(`Pulling image ${image} (this may take a moment)...`);
+  await new Promise((resolve, reject) => {
+    docker.pull(image, (err, stream) => {
+      if (err) {
+        if (err.message?.includes("not found") || err.message?.includes("404")) {
+          return reject(new Error(`Docker image "${image}" not found. Check the image name in your config.`));
+        }
+        return reject(err);
+      }
+      docker.modem.followProgress(stream, (err2) => {
+        if (err2) reject(err2);
+        else {
+          log.success(`Image ${image} pulled`);
+          resolve();
+        }
+      });
+    });
+  });
+}
+async function createContainer(opts) {
+  const { dockerConfig, name } = opts;
+  await ensureImage(dockerConfig.image);
+  const binds = [`${opts.workspacePath}:/workspace`];
+  if (dockerConfig.volumes?.length) {
+    for (const vol of dockerConfig.volumes) {
+      binds.push(vol.replace(/^~(?=\/|:)/, homedir3()));
+    }
+  }
+  const container = await docker.createContainer({
+    Image: dockerConfig.image,
+    name: `autocode-${name}`,
+    Cmd: ["sleep", "infinity"],
+    WorkingDir: "/workspace",
+    User: "root",
+    HostConfig: {
+      Binds: binds,
+      Memory: parseMemory(dockerConfig.memory),
+      NanoCpus: dockerConfig.cpus ? dockerConfig.cpus * 1e9 : void 0,
+      NetworkMode: dockerConfig.network ?? "bridge"
+    },
+    Env: ["HOME=/root"]
+  });
+  await container.start();
+  log.info(`Container ${name} started (${container.id.slice(0, 12)})`);
+  const wrapped = { id: container.id, instance: container };
+  const shellCheck = await exec(wrapped, ["sh", "-c", "echo ok"]);
+  if (shellCheck.exitCode !== 0 || !shellCheck.stdout.includes("ok")) {
+    await destroyContainer(wrapped);
+    throw new Error(
+      `Docker image "${dockerConfig.image}" has no working shell (sh).
+autocode requires a shell to set up the container. Use a standard base image
+(e.g. node:20, python:3.12, ubuntu:24.04) or ensure /bin/sh is available.`
+    );
+  }
+  const curlCheck = await exec(wrapped, ["which", "curl"]);
+  if (curlCheck.exitCode !== 0) {
+    log.debug("curl not found, installing...");
+    await exec(wrapped, [
+      "sh",
+      "-c",
+      "(apt-get update -qq && apt-get install -y -qq curl 2>/dev/null) || (apk add --no-cache curl 2>/dev/null) || (yum install -y curl 2>/dev/null) || true"
+    ]);
+  }
+  const gitCheck = await exec(wrapped, ["git", "--version"]);
+  if (gitCheck.exitCode !== 0) {
+    log.info("Git not found in image, installing...");
+    const installGit = await exec(wrapped, [
+      "sh",
+      "-c",
+      '(apt-get update -qq && apt-get install -y -qq git 2>/dev/null) || (apk add --no-cache git 2>/dev/null) || (yum install -y git 2>/dev/null) || (echo "Cannot install git" && exit 1)'
+    ]);
+    if (installGit.exitCode !== 0) {
+      throw new Error(`Docker image "${dockerConfig.image}" has no git and autocode could not install it. Use an image with git pre-installed.`);
+    }
+  }
+  const claudeCheck = await exec(wrapped, ["which", "claude"]);
+  if (claudeCheck.exitCode !== 0) {
+    log.info("Installing Claude Code in container...");
+    const npmCheck = await exec(wrapped, ["which", "npm"]);
+    let installed = false;
+    if (npmCheck.exitCode === 0) {
+      const npmResult = await exec(wrapped, [
+        "npm",
+        "install",
+        "-g",
+        "@anthropic-ai/claude-code@latest"
+      ]);
+      installed = npmResult.exitCode === 0;
+    }
+    if (!installed) {
+      log.info("npm not available, installing Claude Code standalone binary...");
+      const standaloneResult = await exec(wrapped, [
+        "sh",
+        "-c",
+        "curl -fsSL https://claude.ai/install.sh | sh"
+      ], { timeout: 12e4 });
+      if (standaloneResult.exitCode !== 0) {
+        throw new Error(
+          `Failed to install Claude Code. Tried npm and standalone installer.
+Error: ${standaloneResult.stderr}
+Use an image with Claude Code pre-installed, or ensure curl is available.`
+        );
+      }
+    }
+    log.info("Claude Code installed");
+  } else {
+    log.debug("Claude Code already installed in image");
+  }
+  await exec(wrapped, [
+    "sh",
+    "-c",
+    '( getent passwd autocode >/dev/null 2>&1 ) || ( adduser --disabled-password --gecos "" --uid 1001 --home /home/autocode autocode 2>/dev/null ) || ( adduser -D -u 1001 -h /home/autocode autocode 2>/dev/null ) || ( useradd -m -u 1001 -d /home/autocode autocode 2>/dev/null ) || ( echo "autocode:x:1001:1001::/home/autocode:/bin/sh" >> /etc/passwd && mkdir -p /home/autocode ); mkdir -p /home/autocode && chown -R autocode /home/autocode /workspace'
+  ]);
+  await autoInstallRuntimes(wrapped);
+  if (dockerConfig.setup?.length) {
+    log.info(`Running ${dockerConfig.setup.length} setup command(s)...`);
+    for (const cmd of dockerConfig.setup) {
+      const result = await exec(wrapped, ["sh", "-c", cmd]);
+      if (result.exitCode !== 0) {
+        throw new Error(`Setup command failed: ${cmd}
+${result.stderr}`);
+      }
+    }
+  }
+  await copyClaudeCredentials(wrapped);
+  return wrapped;
+}
+async function autoInstallRuntimes(container) {
+  const detect = await exec(container, [
+    "sh",
+    "-c",
+    "ls /workspace/package.json /workspace/pyproject.toml /workspace/setup.py /workspace/requirements.txt /workspace/Pipfile /workspace/go.mod /workspace/Cargo.toml /workspace/Gemfile /workspace/pom.xml /workspace/build.gradle /workspace/build.gradle.kts /workspace/composer.json /workspace/mix.exs 2>/dev/null || true"
+  ]);
+  const files = detect.stdout.trim().split("\n").filter(Boolean);
+  if (files.length === 0) return;
+  const needs = [];
+  const checks = await exec(container, [
+    "sh",
+    "-c",
+    'echo "node:$(which node 2>/dev/null || echo missing)";echo "python:$(which python3 2>/dev/null || which python 2>/dev/null || echo missing)";echo "go:$(which go 2>/dev/null || echo missing)";echo "ruby:$(which ruby 2>/dev/null || echo missing)";'
+  ]);
+  const installed = /* @__PURE__ */ new Map();
+  for (const line of checks.stdout.trim().split("\n")) {
+    const [lang, path] = line.split(":");
+    installed.set(lang, path !== "missing");
+  }
+  const hasPython = files.some(
+    (f) => f.includes("pyproject.toml") || f.includes("setup.py") || f.includes("requirements.txt") || f.includes("Pipfile")
+  );
+  const hasGo = files.some((f) => f.includes("go.mod"));
+  const hasRuby = files.some((f) => f.includes("Gemfile"));
+  if (hasPython && !installed.get("python")) {
+    needs.push("python3 python3-pip python3-venv");
+  }
+  if (hasGo && !installed.get("go")) {
+    needs.push("golang");
+  }
+  if (hasRuby && !installed.get("ruby")) {
+    needs.push("ruby ruby-dev");
+  }
+  if (needs.length === 0) return;
+  const packages = needs.join(" ");
+  log.info(`Detected stack requires: ${packages}`);
+  const installResult = await exec(container, [
+    "sh",
+    "-c",
+    `(apt-get update -qq && apt-get install -y -qq ${packages} 2>/dev/null) || (apk add --no-cache ${packages.replace("python3-pip", "py3-pip").replace("python3-venv", "").replace("ruby-dev", "ruby-dev build-base")} 2>/dev/null) || echo "Warning: could not auto-install ${packages}"`
+  ]);
+  if (installResult.exitCode === 0) {
+    log.success("Runtime dependencies installed");
+  } else {
+    log.warn(`Could not auto-install ${packages} \u2014 Claude may not be able to run tests for this stack`);
+  }
+}
+async function copyClaudeCredentials(container) {
+  const home = homedir3();
+  await exec(container, [
+    "sh",
+    "-c",
+    "mkdir -p /home/autocode/.claude && chown autocode /home/autocode/.claude"
+  ]);
+  const credFile = join3(home, ".claude", ".credentials.json");
+  if (existsSync3(credFile)) {
+    const content = readFileSync2(credFile, "utf-8");
+    const b64 = Buffer.from(content).toString("base64");
+    await exec(container, [
+      "sh",
+      "-c",
+      `echo '${b64}' | base64 -d > /home/autocode/.claude/.credentials.json && chown autocode /home/autocode/.claude/.credentials.json`
+    ]);
+    log.debug("Copied .credentials.json");
+  }
+  const settingsFile = join3(home, ".claude", "settings.json");
+  if (existsSync3(settingsFile)) {
+    const content = readFileSync2(settingsFile, "utf-8");
+    const b64 = Buffer.from(content).toString("base64");
+    await exec(container, [
+      "sh",
+      "-c",
+      `echo '${b64}' | base64 -d > /home/autocode/.claude/settings.json && chown autocode /home/autocode/.claude/settings.json`
+    ]);
+  }
+  log.info("Claude credentials copied into container");
+}
+async function exec(container, cmd, opts) {
+  const execution = await container.instance.exec({
+    Cmd: cmd,
+    AttachStdout: true,
+    AttachStderr: true,
+    WorkingDir: opts?.workdir ?? "/workspace",
+    Env: opts?.env,
+    User: opts?.user
+  });
+  const stream = await execution.start({ hijack: true, stdin: false });
+  let stdout = "";
+  let stderr = "";
+  return new Promise((resolve, reject) => {
+    const stdoutStream = new PassThrough();
+    const stderrStream = new PassThrough();
+    docker.modem.demuxStream(stream, stdoutStream, stderrStream);
+    stdoutStream.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    stderrStream.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    let timer;
+    if (opts?.timeout) {
+      timer = setTimeout(() => {
+        stream.destroy();
+        resolve({ exitCode: 124, stdout, stderr: stderr + "\n[autocode] exec timed out" });
+      }, opts.timeout);
+    }
+    stream.on("end", async () => {
+      if (timer) clearTimeout(timer);
+      try {
+        const info = await execution.inspect();
+        resolve({ exitCode: info.ExitCode ?? 1, stdout, stderr });
+      } catch (e) {
+        reject(e);
+      }
+    });
+    stream.on("error", (e) => {
+      if (timer) clearTimeout(timer);
+      reject(e);
+    });
+  });
+}
+async function cleanupOrphanedContainers() {
+  const containers = await docker.listContainers({ all: true });
+  const orphans = containers.filter(
+    (c) => c.Names.some((n) => n.startsWith("/autocode-"))
+  );
+  let cleaned = 0;
+  for (const c of orphans) {
+    try {
+      const container = docker.getContainer(c.Id);
+      if (c.State === "running") {
+        await container.stop({ t: 5 });
+      }
+      await container.remove({ force: true });
+      log.info(`Cleaned up orphaned container ${c.Names[0]} (${c.Id.slice(0, 12)})`);
+      cleaned++;
+    } catch {
+    }
+  }
+  return cleaned;
+}
+async function destroyContainer(container) {
+  try {
+    await container.instance.stop({ t: 5 });
+  } catch {
+  }
+  try {
+    await container.instance.remove({ force: true });
+  } catch {
+  }
+  log.info(`Container ${container.id.slice(0, 12)} destroyed`);
+}
+function parseMemory(mem) {
+  const match = mem.match(/^(\d+(?:\.\d+)?)(k|m|g|t)$/i);
+  if (!match) throw new Error(`Invalid memory format: "${mem}". Use a number followed by k, m, g, or t (e.g. "4g", "512m")`);
+  const [, num, unit] = match;
+  const value = parseFloat(num);
+  if (value <= 0) throw new Error(`Memory must be greater than 0: "${mem}"`);
+  const multipliers = {
+    k: 1024,
+    m: 1024 * 1024,
+    g: 1024 * 1024 * 1024,
+    t: 1024 * 1024 * 1024 * 1024
+  };
+  return Math.round(value * multipliers[unit.toLowerCase()]);
+}
+
+// src/agent.ts
+var DEFAULT_ITERATION_TIMEOUT_MS = 30 * 60 * 1e3;
+var RATE_LIMIT_PATTERNS = [
+  /rate.?limit/i,
+  /too many requests/i,
+  /\b429\b.*(?:error|too many|rate|limit|retry)/i,
+  /(?:error|status|code|http)[:\s]*429\b/i,
+  /(?:api|server|model)\s+(?:is\s+)?overloaded/i,
+  /over\s*capacity/i
+];
+var COMPLETION_PATTERNS = [
+  /\[autocode:done\]/i,
+  /all tasks? completed/i
+];
+function isRateLimited(output) {
+  return RATE_LIMIT_PATTERNS.some((p) => p.test(output));
+}
+function isCompleted(output) {
+  return COMPLETION_PATTERNS.some((p) => p.test(output));
+}
+function estimateResetMs(output) {
+  const match = output.match(/retry.?after[:\s]*(\d+)/i);
+  if (match) return parseInt(match[1]) * 1e3;
+  return 6e4;
+}
+var MAX_RATE_LIMIT_RETRIES = 10;
+async function runAgentLoop(opts) {
+  const { container, agentConfig, prompt, ticketId, onIteration } = opts;
+  let lastOutput = "";
+  let rateLimitRetries = 0;
+  const promptB64 = Buffer.from(prompt).toString("base64");
+  await exec(container, [
+    "sh",
+    "-c",
+    `mkdir -p /tmp/autocode && echo '${promptB64}' | base64 -d > /tmp/autocode/prompt.md && chmod 644 /tmp/autocode/prompt.md`
+  ]);
+  for (let i = 1; i <= agentConfig.maxIterations; i++) {
+    log.ticket(ticketId, `Iteration ${i}/${agentConfig.maxIterations}`);
+    const cmd = [
+      "sh",
+      "-c",
+      [
+        "claude",
+        "-p",
+        '"$(cat /tmp/autocode/prompt.md)"',
+        "--model",
+        agentConfig.model,
+        "--output-format",
+        "text",
+        "--max-turns",
+        "50",
+        "--dangerously-skip-permissions",
+        "--verbose"
+      ].join(" ")
+    ];
+    const timeoutMs = agentConfig.timeout ? agentConfig.timeout * 1e3 : DEFAULT_ITERATION_TIMEOUT_MS;
+    const result = await exec(container, cmd, {
+      user: "autocode",
+      env: ["HOME=/home/autocode", "CLAUDE_CODE_DISABLE_NONINTERACTIVE_TUTORIAL=1"],
+      timeout: timeoutMs
+    });
+    const combined = result.stdout + result.stderr;
+    lastOutput = combined;
+    const snippet = combined.slice(-500).trim();
+    if (snippet) {
+      log.debug(`Agent output (last 500 chars): ${snippet}`);
+    }
+    const rateLimited = isRateLimited(combined);
+    const completed = isCompleted(combined) || result.exitCode === 0 && i > 1;
+    const agentResult = {
+      iteration: i,
+      exitCode: result.exitCode,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      rateLimited,
+      completed
+    };
+    onIteration?.(agentResult);
+    if (completed) {
+      log.ticket(ticketId, `Completed after ${i} iterations`);
+      return { iterations: i, success: true, lastOutput };
+    }
+    if (rateLimited) {
+      rateLimitRetries++;
+      if (rateLimitRetries > MAX_RATE_LIMIT_RETRIES) {
+        log.ticket(ticketId, `Rate limited ${rateLimitRetries} times, giving up`);
+        return { iterations: i, success: false, lastOutput };
+      }
+      const waitMs = estimateResetMs(combined);
+      log.ticket(ticketId, `Rate limited (${rateLimitRetries}/${MAX_RATE_LIMIT_RETRIES}) \u2014 pausing ${Math.round(waitMs / 1e3)}s`);
+      await sleep(waitMs);
+      i--;
+      continue;
+    }
+    if (result.exitCode !== 0) {
+      log.ticket(ticketId, `Non-zero exit (${result.exitCode}), continuing...`);
+    }
+  }
+  log.ticket(ticketId, `Max iterations (${agentConfig.maxIterations}) reached`);
+  return { iterations: agentConfig.maxIterations, success: false, lastOutput };
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/git.ts
+async function setupRepo(container, opts) {
+  const u = { user: "autocode" };
+  await exec(container, ["git", "config", "user.name", "autocode"], u);
+  await exec(container, ["git", "config", "user.email", "autocode@localhost"], u);
+  await exec(container, ["git", "config", "--global", "safe.directory", "/workspace"], u);
+  log.info(`Git configured, on branch ${opts.branchName}`);
+}
+async function commitAndPush(container, opts) {
+  const { branchName, ticketId, title, githubToken } = opts;
+  const u = { user: "autocode" };
+  const status = await exec(container, ["git", "status", "--porcelain"], u);
+  if (status.stdout.trim()) {
+    await exec(container, ["git", "add", "-A"], u);
+    const message = `${ticketId}: ${title}`;
+    await exec(container, ["git", "commit", "-m", message], u);
+  }
+  const countResult = await exec(container, [
+    "git",
+    "rev-list",
+    "--count",
+    `HEAD`,
+    "--not",
+    "--remotes"
+  ], u);
+  const commitCount = parseInt(countResult.stdout.trim()) || 0;
+  if (commitCount === 0) {
+    log.warn("No commits to push");
+    return { pushed: false, commitCount: 0 };
+  }
+  await exec(container, [
+    "sh",
+    "-c",
+    `git config credential.helper '!f() { echo "password=${githubToken}"; echo "username=x-access-token"; }; f'`
+  ], u);
+  const pushResult = await exec(container, ["git", "push", "-u", "origin", branchName], u);
+  if (pushResult.exitCode !== 0) {
+    const safeStderr = pushResult.stderr.replace(/x-access-token:[^\s@]+/g, "x-access-token:***");
+    log.error(`Push failed: ${safeStderr}`);
+    return { pushed: false, commitCount };
+  }
+  log.success(`Pushed ${commitCount} commit(s) to ${branchName}`);
+  return { pushed: true, commitCount };
+}
+
+// src/worker.ts
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join4 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { execSync as execSync2 } from "child_process";
+function buildPrompt(ticket, repoPrompt) {
+  const parts = [];
+  if (repoPrompt) {
+    parts.push(repoPrompt);
+    parts.push("");
+  }
+  parts.push(`## Task: ${ticket.identifier} \u2014 ${ticket.title}`);
+  parts.push("");
+  if (ticket.description) {
+    parts.push(ticket.description);
+  }
+  parts.push("");
+  parts.push("## Instructions");
+  parts.push("- Start by reading CLAUDE.md if it exists \u2014 it has project-specific guidance");
+  parts.push("- Read the codebase to understand the context before making changes");
+  parts.push("- Work through the task step by step");
+  parts.push('- After making changes, run: git add -A && git commit -m "description of changes"');
+  parts.push("- Commit after each logical step (do not batch all changes into one commit)");
+  parts.push("- If the task has a checklist, work through items in order and commit after each one");
+  parts.push("- Run any existing tests before finishing to verify your changes");
+  parts.push("- IMPORTANT: You MUST commit your changes with git before finishing");
+  parts.push("- When all work is complete and committed, include [autocode:done] in your final output");
+  return parts.join("\n");
+}
+function slugify(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 50);
+}
+function assertSafeRef(name, label) {
+  if (!name || /[\s~^:?*\[\\]|\.\./.test(name) || name.startsWith("-")) {
+    throw new Error(`Invalid ${label}: "${name}"`);
+  }
+}
+function createAskpass(githubToken) {
+  const dir = mkdtempSync2(join4(tmpdir2(), "autocode-cred-"));
+  const path = join4(dir, "askpass.sh");
+  writeFileSync2(path, `#!/bin/sh
+echo "${githubToken}"
+`, { mode: 448 });
+  return { dir, path };
+}
+function gitEnv(askpassPath) {
+  return { ...process.env, GIT_ASKPASS: askpassPath, GIT_TERMINAL_PROMPT: "0" };
+}
+function detectDefaultBranch(repoUrl, githubToken) {
+  const askpass = createAskpass(githubToken);
+  const authedUrl = repoUrl.replace("https://", "https://x-access-token@");
+  try {
+    const output = execSync2(
+      `git ls-remote --symref -- ${authedUrl} HEAD`,
+      { stdio: "pipe", timeout: 3e4, env: gitEnv(askpass.path), encoding: "utf-8" }
+    );
+    const match = output.match(/ref:\s+refs\/heads\/(\S+)\s+HEAD/);
+    if (match) return match[1];
+  } catch {
+  } finally {
+    rmSync2(askpass.dir, { recursive: true, force: true });
+  }
+  return "main";
+}
+function cloneToTemp(repoUrl, baseBranch, githubToken) {
+  assertSafeRef(baseBranch, "base branch");
+  const workDir = mkdtempSync2(join4(tmpdir2(), "autocode-"));
+  const askpass = createAskpass(githubToken);
+  const authedUrl = repoUrl.replace("https://", "https://x-access-token@");
+  try {
+    execSync2(`git clone --depth=50 -b ${baseBranch} -- ${authedUrl} ${workDir}`, {
+      stdio: "pipe",
+      timeout: 12e4,
+      env: gitEnv(askpass.path)
+    });
+  } finally {
+    rmSync2(askpass.dir, { recursive: true, force: true });
+  }
+  return workDir;
+}
+async function executeTicket(opts) {
+  const { ticket, config, linearClient, octokit } = opts;
+  if (!ticket.repoUrl) {
+    return {
+      ticketId: ticket.identifier,
+      success: false,
+      error: "No repo:owner/name label on ticket",
+      iterations: 0
+    };
+  }
+  if (!ticket.repoUrl.startsWith("https://")) {
+    return {
+      ticketId: ticket.identifier,
+      success: false,
+      error: `Invalid repo URL: "${ticket.repoUrl}". Only HTTPS URLs are supported.`,
+      iterations: 0
+    };
+  }
+  const branchName = `autocode/${ticket.identifier}-${slugify(ticket.title)}`;
+  const containerName = `${ticket.identifier}-${Date.now()}`.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
+  let workDir;
+  let container;
+  try {
+    await claimTicket(linearClient, config, ticket.id);
+    log.ticket(ticket.identifier, `Claimed \u2014 ${ticket.repoUrl}`);
+    const detectedBase = detectDefaultBranch(ticket.repoUrl, config.github.token);
+    log.ticket(ticket.identifier, `Default branch: ${detectedBase}`);
+    workDir = cloneToTemp(ticket.repoUrl, detectedBase, config.github.token);
+    log.ticket(ticket.identifier, "Cloned repo");
+    const repoLocal = loadRepoLocalConfig(workDir);
+    const actualBase = ticket.baseBranch ?? repoLocal?.base ?? detectedBase;
+    const { agent, docker: docker2, prompt } = mergeConfigs(config, repoLocal);
+    if (repoLocal) {
+      log.ticket(ticket.identifier, "Loaded .autocode.yaml from repo");
+    }
+    if (ticket.baseBranch) {
+      log.ticket(ticket.identifier, `Stacked on branch: ${ticket.baseBranch}`);
+    }
+    if (actualBase !== detectedBase) {
+      rmSync2(workDir, { recursive: true, force: true });
+      workDir = cloneToTemp(ticket.repoUrl, actualBase, config.github.token);
+    }
+    execSync2(`git checkout -B ${branchName} --`, { cwd: workDir, stdio: "pipe" });
+    container = await createContainer({
+      dockerConfig: docker2,
+      workspacePath: workDir,
+      name: containerName
+    });
+    await setupRepo(container, { branchName });
+    const agentPrompt = buildPrompt(ticket, prompt);
+    const agentResult = await runAgentLoop({
+      container,
+      agentConfig: agent,
+      prompt: agentPrompt,
+      ticketId: ticket.identifier
+    });
+    const gitResult = await commitAndPush(container, {
+      branchName,
+      ticketId: ticket.identifier,
+      title: ticket.title,
+      repoUrl: ticket.repoUrl,
+      githubToken: config.github.token
+    });
+    if (!gitResult.pushed) {
+      await failTicket(linearClient, ticket.id, "No changes produced");
+      return {
+        ticketId: ticket.identifier,
+        success: false,
+        error: "No changes produced",
+        iterations: agentResult.iterations
+      };
+    }
+    const prBody = [
+      `Resolves [${ticket.identifier}](${ticket.url})`,
+      ""
+    ];
+    if (ticket.description) {
+      const desc = ticket.description.length > 2e3 ? ticket.description.slice(0, 2e3) + "\n\n*[description truncated]*" : ticket.description;
+      prBody.push("## Description", "", desc, "");
+    }
+    prBody.push(
+      "## Details",
+      "",
+      `| Metric | Value |`,
+      `| --- | --- |`,
+      `| Iterations | ${agentResult.iterations} |`,
+      `| Commits | ${gitResult.commitCount} |`,
+      `| Model | ${agent.model} |`,
+      "",
+      "---",
+      "*Generated by [autocode](https://github.com/rahulrai/autocode)*"
+    );
+    const pr = await openPR(octokit, {
+      repoUrl: ticket.repoUrl,
+      branch: branchName,
+      baseBranch: actualBase,
+      title: `${ticket.identifier}: ${ticket.title}`,
+      body: prBody.join("\n")
+    });
+    await completeTicket(linearClient, config, ticket.id, `PR opened: ${pr.url}`);
+    await addBranchLabel(linearClient, ticket.id, branchName);
+    log.success(`${ticket.identifier} done \u2014 ${pr.url}`);
+    return {
+      ticketId: ticket.identifier,
+      success: true,
+      prUrl: pr.url,
+      iterations: agentResult.iterations
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    log.error(`${ticket.identifier} failed: ${msg}`);
+    try {
+      await failTicket(linearClient, ticket.id, msg);
+    } catch {
+    }
+    return {
+      ticketId: ticket.identifier,
+      success: false,
+      error: msg,
+      iterations: 0
+    };
+  } finally {
+    if (container) {
+      await destroyContainer(container);
+    }
+    if (workDir) {
+      try {
+        rmSync2(workDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+
+// src/webhook.ts
+function verifySignature(body, signature, secret) {
+  const expected = createHmac("sha256", secret).update(body).digest("hex");
+  try {
+    return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+  } catch {
+    return false;
+  }
+}
+var WebhookServer = class {
+  constructor(config, linearClient, octokit) {
+    this.config = config;
+    this.linearClient = linearClient;
+    this.octokit = octokit;
+  }
+  config;
+  linearClient;
+  octokit;
+  active = /* @__PURE__ */ new Set();
+  queue = [];
+  processed = /* @__PURE__ */ new Set();
+  // Track processed ticket IDs to prevent duplicate dispatch
+  server;
+  start() {
+    const port = this.config.webhook?.port ?? 3e3;
+    const MAX_BODY_BYTES = 1024 * 1024;
+    this.server = createServer((req, res) => {
+      if (req.method === "GET" && (req.url === "/health" || req.url === "/healthz")) {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ status: "ok", active: this.active.size, queued: this.queue.length, capacity: this.config.maxConcurrent }));
+        return;
+      }
+      if (req.method !== "POST" || req.url !== "/webhook" && req.url !== "/api/v1/linear/webhook") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      let body = "";
+      let bodyBytes = 0;
+      req.on("data", (chunk) => {
+        bodyBytes += chunk.length;
+        if (bodyBytes > MAX_BODY_BYTES) {
+          res.writeHead(413);
+          res.end("Payload too large");
+          req.destroy();
+          return;
+        }
+        body += chunk;
+      });
+      req.on("end", () => {
+        if (this.config.webhook?.signingSecret) {
+          const sig = req.headers["linear-signature"];
+          if (!sig || !verifySignature(body, sig, this.config.webhook.signingSecret)) {
+            log.warn("Invalid webhook signature, rejecting");
+            res.writeHead(401);
+            res.end("Invalid signature");
+            return;
+          }
+        }
+        res.writeHead(200);
+        res.end("ok");
+        void this.handleWebhook(body);
+      });
+    });
+    return new Promise((resolve) => {
+      this.server.listen(port, () => {
+        log.info(`Webhook server listening on port ${port}`);
+        resolve();
+      });
+    });
+  }
+  stop() {
+    this.server?.close();
+    log.info("Webhook server stopped");
+  }
+  async handleWebhook(body) {
+    let payload;
+    try {
+      payload = JSON.parse(body);
+    } catch {
+      log.warn("Invalid webhook JSON");
+      return;
+    }
+    if (payload.type !== "Issue") return;
+    const { action, data } = payload;
+    const triggerStatuses = this.config.linear.statuses.map((s) => s.toLowerCase());
+    const currentStatus = data.state.name.toLowerCase();
+    if (action === "create" || action === "update") {
+      if (!triggerStatuses.includes(currentStatus)) {
+        log.debug(`${data.identifier}: status "${data.state.name}" not in trigger list, ignoring`);
+        return;
+      }
+      if (action === "update" && !payload.updatedFrom?.stateId) {
+        log.debug(`${data.identifier}: update but status didn't change, ignoring`);
+        return;
+      }
+    } else {
+      return;
+    }
+    if (this.active.has(data.id)) {
+      log.debug(`${data.identifier}: already active, ignoring`);
+      return;
+    }
+    if (this.processed.has(data.id)) {
+      log.debug(`${data.identifier}: already processed in this session, ignoring`);
+      return;
+    }
+    if (this.active.size >= this.config.maxConcurrent) {
+      log.info(`${data.identifier}: at capacity (${this.active.size}/${this.config.maxConcurrent}), queued`);
+      const queueLabels = data.labels.map((l) => l.name);
+      const ticket2 = {
+        id: data.id,
+        identifier: data.identifier,
+        title: data.title,
+        description: data.description ?? "",
+        labels: queueLabels,
+        repoUrl: parseRepoFromLabels(queueLabels),
+        baseBranch: parseBaseFromLabels(queueLabels),
+        url: data.url
+      };
+      this.queue.push(ticket2);
+      return;
+    }
+    const labelNames = data.labels.map((l) => l.name);
+    const repoUrl = parseRepoFromLabels(labelNames);
+    if (!repoUrl) {
+      log.warn(`${data.identifier}: no repo: label, ignoring`);
+      return;
+    }
+    const ticket = {
+      id: data.id,
+      identifier: data.identifier,
+      title: data.title,
+      description: data.description ?? "",
+      labels: labelNames,
+      repoUrl,
+      baseBranch: parseBaseFromLabels(labelNames),
+      url: data.url
+    };
+    this.dispatch(ticket);
+  }
+  dispatch(ticket) {
+    this.active.add(ticket.id);
+    log.ticket(ticket.identifier, `Dispatching \u2192 ${ticket.repoUrl}`);
+    void executeTicket({
+      ticket,
+      config: this.config,
+      linearClient: this.linearClient,
+      octokit: this.octokit
+    }).finally(() => {
+      this.active.delete(ticket.id);
+      this.processed.add(ticket.id);
+      this.drainQueue();
+    });
+  }
+  drainQueue() {
+    while (this.queue.length > 0 && this.active.size < this.config.maxConcurrent) {
+      const next = this.queue.shift();
+      if (this.active.has(next.id)) continue;
+      log.ticket(next.identifier, `Dequeued (${this.queue.length} remaining)`);
+      this.dispatch(next);
+    }
+  }
+};
+
+// src/tunnel.ts
+import { spawn } from "child_process";
+async function startQuickTunnel(port) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn("cloudflared", ["tunnel", "--url", `http://127.0.0.1:${port}`], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let resolved = false;
+    const timeout = setTimeout(() => {
+      if (!resolved) {
+        reject(new Error("Tunnel startup timed out after 30s"));
+      }
+    }, 3e4);
+    const handleOutput = (data) => {
+      const line = data.toString();
+      const match = line.match(/(https:\/\/[a-z0-9-]+\.trycloudflare\.com)/);
+      if (match && !resolved) {
+        resolved = true;
+        clearTimeout(timeout);
+        resolve({ url: match[1], process: proc });
+      }
+    };
+    proc.stdout.on("data", handleOutput);
+    proc.stderr.on("data", handleOutput);
+    proc.on("error", (err) => {
+      if (!resolved) {
+        clearTimeout(timeout);
+        if (err.code === "ENOENT") {
+          reject(new Error("cloudflared not found. Install it: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"));
+        } else {
+          reject(err);
+        }
+      }
+    });
+    proc.on("exit", (code) => {
+      if (!resolved) {
+        clearTimeout(timeout);
+        reject(new Error(`cloudflared exited with code ${code}`));
+      }
+    });
+  });
+}
+function stopTunnel(tunnel) {
+  tunnel.process.kill("SIGTERM");
+  log.info("Tunnel stopped");
+}
+
+// src/deps.ts
+import { execSync as execSync3 } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { join as join5 } from "path";
+import { homedir as homedir4 } from "os";
+function detectPackageManager() {
+  const checks = [
+    ["apt", "apt-get"],
+    ["dnf", "dnf"],
+    ["yum", "yum"],
+    ["pacman", "pacman"],
+    ["apk", "apk"],
+    ["brew", "brew"]
+  ];
+  for (const [name, cmd] of checks) {
+    try {
+      execSync3(`which ${cmd}`, { stdio: "pipe" });
+      return name;
+    } catch {
+    }
+  }
+  return "unknown";
+}
+var DOCKER_INSTALL = {
+  apt: [
+    "apt-get update -qq",
+    "apt-get install -y docker.io",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  dnf: [
+    "dnf install -y docker",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  yum: [
+    "yum install -y docker",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  pacman: [
+    "pacman -Sy --noconfirm docker",
+    "systemctl enable docker",
+    "systemctl start docker"
+  ],
+  apk: [
+    "apk add docker",
+    "rc-update add docker boot",
+    "service docker start"
+  ],
+  brew: [
+    "brew install --cask docker"
+  ],
+  unknown: []
+};
+var CLOUDFLARED_INSTALL = {
+  apt: [
+    "apt-get update -qq",
+    'apt-get install -y cloudflared || (curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null && echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/cloudflared.list && apt-get update -qq && apt-get install -y cloudflared)'
+  ],
+  dnf: ["dnf install -y cloudflared || npm install -g cloudflared"],
+  yum: ["yum install -y cloudflared || npm install -g cloudflared"],
+  pacman: ["pacman -Sy --noconfirm cloudflared"],
+  apk: ["apk add cloudflared"],
+  brew: ["brew install cloudflared"],
+  unknown: []
+};
+function checkDeps() {
+  const pm = detectPackageManager();
+  const needsSudo = pm !== "brew" && pm !== "unknown" && process.getuid?.() !== 0;
+  const sudo = needsSudo ? "sudo " : "";
+  return [
+    {
+      name: "Docker",
+      installed: commandExists("docker"),
+      running: isDockerRunning(),
+      installable: pm !== "unknown",
+      installCommands: DOCKER_INSTALL[pm].map((c) => `${sudo}${c}`),
+      manualInstructions: "https://docs.docker.com/get-docker/"
+    },
+    {
+      name: "Claude Code",
+      installed: commandExists("claude"),
+      installable: commandExists("npm"),
+      installCommands: ["npm install -g @anthropic-ai/claude-code@latest"],
+      manualInstructions: "npm install -g @anthropic-ai/claude-code"
+    },
+    {
+      name: "Claude credentials",
+      installed: existsSync4(join5(homedir4(), ".claude", ".credentials.json")),
+      installable: false,
+      installCommands: [],
+      manualInstructions: 'Run "claude" and complete the login flow'
+    },
+    {
+      name: "cloudflared",
+      installed: commandExists("cloudflared"),
+      installable: pm !== "unknown",
+      installCommands: CLOUDFLARED_INSTALL[pm].map((c) => `${sudo}${c}`),
+      manualInstructions: "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"
+    }
+  ];
+}
+function installDep(dep) {
+  if (dep.installCommands.length === 0) return false;
+  for (const cmd of dep.installCommands) {
+    try {
+      execSync3(cmd, { stdio: "inherit", timeout: 3e5 });
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+function addUserToDockerGroup() {
+  if (process.platform !== "linux") return;
+  try {
+    const user = execSync3("whoami", { encoding: "utf-8" }).trim();
+    execSync3(`sudo usermod -aG docker ${user}`, { stdio: "pipe" });
+    log.info(`Added ${user} to docker group \u2014 log out and back in to apply`);
+  } catch {
+  }
+}
+function commandExists(cmd) {
+  try {
+    execSync3(`which ${cmd}`, { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isDockerRunning() {
+  try {
+    execSync3("docker info", { stdio: "pipe", timeout: 1e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/index.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
+import { execSync as execSync4 } from "child_process";
+import { createInterface } from "readline";
+import { join as join6 } from "path";
+import { homedir as homedir5 } from "os";
+import { LinearClient as LinearClient2 } from "@linear/sdk";
+import { Octokit as Octokit2 } from "@octokit/rest";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var program = new Command();
+program.name("autocode").description("Linear webhooks \u2192 Claude Code in Docker \u2192 PRs").version(pkg.version);
+function ask(question, defaultVal) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const hint = defaultVal ? ` (${defaultVal})` : "";
+  return new Promise((resolve) => {
+    rl.question(`${question}${hint}: `, (answer) => {
+      rl.close();
+      resolve(answer.trim() || defaultVal || "");
+    });
+  });
+}
+program.command("serve").description("Start webhook server with auto-tunnel").option("-c, --config <path>", "Config file path").option("-p, --port <number>", "Override webhook port").option("--no-tunnel", "Skip auto-tunnel (use if you have your own reverse proxy)").option("-v, --verbose", "Verbose logging").action(async (opts) => {
+  if (opts.verbose) setLogLevel("debug");
+  enableFileLogging();
+  log.info(`autocode v${pkg.version}`);
+  await checkDockerAvailable();
+  if (!checkClaudeCredentials()) {
+    throw new Error(
+      "Claude Code credentials not found (~/.claude/.credentials.json)\nRun: claude (and complete login) to create credentials"
+    );
+  }
+  const orphans = await cleanupOrphanedContainers();
+  if (orphans > 0) {
+    log.info(`Cleaned up ${orphans} orphaned container(s) from previous session`);
+  }
+  const config = loadConfig(opts.config);
+  if (opts.port) config.webhook.port = parseInt(opts.port);
+  log.info(`Team: ${config.linear.teamId} | Statuses: ${config.linear.statuses.join(", ")} | Model: ${config.agent.model} | Max concurrent: ${config.maxConcurrent}`);
+  const linearClient = createLinearClient(config);
+  const octokit = createOctokit(config);
+  const server = new WebhookServer(config, linearClient, octokit);
+  let tunnel;
+  if (opts.tunnel !== false) {
+    log.info("Starting tunnel...");
+    try {
+      tunnel = await startQuickTunnel(config.webhook.port);
+      const webhookUrl = `${tunnel.url}/api/v1/linear/webhook`;
+      log.success(`Tunnel: ${tunnel.url}`);
+      log.info(`Webhook URL: ${webhookUrl}`);
+      if (config.webhook.webhookId) {
+        try {
+          await linearClient.deleteWebhook(config.webhook.webhookId);
+        } catch {
+        }
+      }
+      const team = await linearClient.team(config.linear.teamId);
+      const result = await linearClient.createWebhook({
+        url: webhookUrl,
+        resourceTypes: ["Issue"],
+        label: "autocode",
+        teamId: team.id
+      });
+      const webhook = await result.webhook;
+      if (webhook) {
+        log.success(`Linear webhook created \u2192 ${webhookUrl}`);
+        config.webhook.webhookId = webhook.id;
+        config.webhook.signingSecret = void 0;
+      }
+    } catch (err) {
+      log.warn(`Tunnel failed: ${err instanceof Error ? err.message : err}`);
+      log.info("Falling back to local-only mode. Set up your own reverse proxy.");
+    }
+  }
+  await server.start();
+  const shutdown = () => {
+    log.info("Shutting down...");
+    server.stop();
+    if (tunnel) stopTunnel(tunnel);
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+});
+program.command("run <ticket>").description("Run a single ticket (e.g. autocode run RAH-123)").option("-c, --config <path>", "Config file path").option("-v, --verbose", "Verbose logging").option("--dry-run", "Show what would happen without executing").action(async (ticketId, opts) => {
+  if (opts.verbose) setLogLevel("debug");
+  enableFileLogging();
+  const config = loadConfig(opts.config);
+  const linearClient = createLinearClient(config);
+  const ticket = await fetchTicket(linearClient, ticketId);
+  if (!ticket) throw new Error(`Ticket ${ticketId} not found`);
+  if (!ticket.repoUrl) {
+    throw new Error(`${ticketId} has no repo: label. Add "repo:owner/name" label to the ticket.`);
+  }
+  if (opts.dryRun) {
+    log.info("Dry run \u2014 no changes will be made\n");
+    log.info(`  Ticket:   ${ticket.identifier} \u2014 ${ticket.title}`);
+    log.info(`  Repo:     ${ticket.repoUrl}`);
+    log.info(`  Base:     ${ticket.baseBranch ?? "(from .autocode.yaml or main)"}`);
+    log.info(`  Branch:   autocode/${ticket.identifier}-...`);
+    log.info(`  Image:    ${config.docker.image}`);
+    log.info(`  Model:    ${config.agent.model}`);
+    log.info(`  Max iter: ${config.agent.maxIterations}`);
+    if (ticket.description) {
+      log.info(`
+  Description:
+    ${ticket.description.split("\n").join("\n    ")}`);
+    }
+    return;
+  }
+  await checkDockerAvailable();
+  if (!checkClaudeCredentials()) {
+    throw new Error(
+      "Claude Code credentials not found (~/.claude/.credentials.json)\nRun: claude (and complete login) to create credentials"
+    );
+  }
+  const octokit = createOctokit(config);
+  const abort = new AbortController();
+  const onSignal = () => {
+    log.info("Received signal, cleaning up...");
+    abort.abort();
+  };
+  process.on("SIGINT", onSignal);
+  process.on("SIGTERM", onSignal);
+  try {
+    const result = await executeTicket({ ticket, config, linearClient, octokit });
+    if (!result.success) throw new Error(result.error ?? "Unknown failure");
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  }
+});
+program.command("validate").description("Validate config without running anything").option("-c, --config <path>", "Config file path").action(async (opts) => {
+  try {
+    const config = loadConfig(opts.config);
+    log.success("Config is valid");
+    log.info(`  Linear team: ${config.linear.teamId}`);
+    log.info(`  Trigger statuses: ${config.linear.statuses.join(", ")}`);
+    log.info(`  Docker image: ${config.docker.image}`);
+    log.info(`  Agent model: ${config.agent.model}`);
+    log.info(`  Max iterations: ${config.agent.maxIterations}`);
+    log.info(`  Max concurrent: ${config.maxConcurrent}`);
+    log.info(`  Webhook port: ${config.webhook.port}`);
+  } catch (err) {
+    log.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+});
+program.command("cleanup").description("Remove orphaned autocode Docker containers").action(async () => {
+  await checkDockerAvailable();
+  const count = await cleanupOrphanedContainers();
+  if (count === 0) {
+    log.info("No orphaned containers found");
+  } else {
+    log.success(`Cleaned up ${count} orphaned container(s)`);
+  }
+});
+function checkClaudeCredentials() {
+  return existsSync5(join6(homedir5(), ".claude", ".credentials.json"));
+}
+async function validateGitHubToken(token) {
+  try {
+    const octokit = new Octokit2({ auth: token });
+    const { data } = await octokit.rest.users.getAuthenticated();
+    return data.login;
+  } catch {
+    return void 0;
+  }
+}
+program.command("init").description("Set up autocode interactively").action(async () => {
+  console.log("\n  autocode setup\n");
+  console.log("  Checking dependencies...\n");
+  const deps = checkDeps();
+  const stillMissing = [];
+  for (const dep of deps) {
+    if (dep.installed && dep.running !== false) {
+      log.success(`${dep.name}`);
+      continue;
+    }
+    if (dep.installed && dep.running === false) {
+      log.warn(`${dep.name} \u2014 installed but not running`);
+      stillMissing.push(`${dep.name} (needs restart)`);
+      continue;
+    }
+    if (dep.installable && dep.installCommands.length > 0) {
+      const answer = await ask(`  ${dep.name} not found. Install? (Y/n)`, "Y");
+      if (answer.toLowerCase() !== "n") {
+        console.log(`
+  Installing ${dep.name} via system package manager...
+`);
+        const ok = installDep(dep);
+        if (ok) {
+          log.success(`${dep.name} installed`);
+          if (dep.name === "Docker") addUserToDockerGroup();
+          if (dep.name === "Claude Code") {
+            console.log('\n  Run "claude" in your terminal to log in, then re-run: autocode init\n');
+            stillMissing.push("Claude Code login");
+          }
+        } else {
+          log.error(`${dep.name} install failed`);
+          console.log(`    Install manually: ${dep.manualInstructions}`);
+          stillMissing.push(dep.name);
+        }
+      } else {
+        console.log(`    Install manually: ${dep.manualInstructions}`);
+        stillMissing.push(dep.name);
+      }
+    } else if (dep.name === "Claude credentials") {
+      log.warn(`${dep.name} \u2014 run "claude" to log in`);
+      stillMissing.push(dep.name);
+    } else {
+      log.warn(`${dep.name} \u2014 ${dep.manualInstructions}`);
+      stillMissing.push(dep.name);
+    }
+  }
+  if (stillMissing.length > 0) {
+    console.log(`
+  Continuing setup \u2014 install ${stillMissing.join(", ")} before running.
+`);
+  } else {
+    console.log("");
+  }
+  if (!existsSync5(CONFIG_DIR)) {
+    mkdirSync2(CONFIG_DIR, { recursive: true });
+  }
+  if (existsSync5(CONFIG_FILE)) {
+    const overwrite = await ask("Config already exists. Overwrite? (y/N)", "N");
+    if (overwrite.toLowerCase() !== "y") {
+      log.info("Keeping existing config.");
+      return;
+    }
+  }
+  const linearKey = await ask("Linear API key", process.env.LINEAR_API_KEY);
+  if (!linearKey) {
+    log.error("Linear API key is required");
+    process.exit(1);
+  }
+  let teamId = "";
+  try {
+    const client = new LinearClient2({ apiKey: linearKey });
+    const teams = await client.teams();
+    if (teams.nodes.length === 0) {
+      log.error("No teams found in your Linear workspace");
+      process.exit(1);
+    }
+    if (teams.nodes.length === 1) {
+      teamId = teams.nodes[0].key;
+      log.success(`Linear team: ${teams.nodes[0].name} (${teamId})`);
+    } else {
+      console.log("\n  Available teams:");
+      for (const t of teams.nodes) {
+        console.log(`    ${t.key} \u2014 ${t.name}`);
+      }
+      teamId = await ask("\n  Team key");
+    }
+  } catch (err) {
+    log.error(`Invalid Linear API key: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+  let ghToken = "";
+  try {
+    ghToken = execSync4("gh auth token", { encoding: "utf-8" }).trim();
+    log.success(`GitHub token detected from gh CLI`);
+  } catch {
+    ghToken = await ask("GitHub personal access token");
+  }
+  if (!ghToken) {
+    log.error("GitHub token is required");
+    process.exit(1);
+  }
+  const ghUser = await validateGitHubToken(ghToken);
+  if (ghUser) {
+    log.success(`GitHub authenticated as ${ghUser}`);
+  } else {
+    log.error("GitHub token is invalid or expired");
+    process.exit(1);
+  }
+  console.log("\n  Docker image options:");
+  console.log("    autocode-base    \u2014 All runtimes: Node, Python, Go, Rust, Ruby (~1.5GB)");
+  console.log("                       Works with any repo, no per-repo config needed");
+  console.log("    node:20          \u2014 Node.js only (fast, ~300MB)");
+  const dockerImage = await ask("Docker image", "autocode-base");
+  if (dockerImage === "autocode-base") {
+    try {
+      execSync4("docker image inspect autocode-base", { stdio: "pipe" });
+      log.success("autocode-base image found");
+    } catch {
+      log.info("autocode-base will be built automatically on first run (~3 min)");
+    }
+  }
+  const model = await ask("Claude model", "claude-sonnet-4-6");
+  const maxIter = await ask("Max iterations per ticket", "10");
+  const config = `# autocode config \u2014 generated by autocode init
+# Tip: use "env:VAR_NAME" to read secrets from environment variables
+# e.g. apiKey: env:LINEAR_API_KEY
+
+linear:
+  apiKey: "${linearKey}"
+  teamId: ${teamId}
+  statuses: [Todo]
+  assignToMe: false
+  inProgressStatus: In Progress
+  doneStatus: Done
+
+github:
+  token: "${ghToken}"
+
+webhook:
+  port: 3000
+
+docker:
+  image: ${dockerImage}
+  memory: 4g
+
+agent:
+  model: ${model}
+  maxIterations: ${parseInt(maxIter) || 10}
+
+maxConcurrent: 1
+`;
+  writeFileSync3(CONFIG_FILE, config, { mode: 384 });
+  log.success(`Config saved to ${CONFIG_FILE}`);
+  console.log(`
+  Setup complete! Next steps:
+
+  1. Add repo: labels to your Linear team
+     (e.g. "repo:your-org/your-repo")
+
+  2. Tag tickets with a repo: label
+
+  3. Start autocode:
+     $ autocode serve
+
+  autocode serve will auto-create a tunnel and
+  register the webhook with Linear. Just run it.
+`);
+});
+program.parseAsync().catch((err) => {
+  log.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});
+//# sourceMappingURL=index.js.map