@desplega.ai/agent-swarm 1.20.0 → 1.49.0

package/docker-entrypoint.sh

@@ -1,10 +1,21 @@
 #!/bin/bash
 set -e
 
-# Validate required environment variables
-if [ -z "$CLAUDE_CODE_OAUTH_TOKEN" ]; then
-    echo "Error: CLAUDE_CODE_OAUTH_TOKEN environment variable is required"
-    exit 1
+# Validate required environment variables based on provider
+HARNESS_PROVIDER="${HARNESS_PROVIDER:-claude}"
+
+if [ "$HARNESS_PROVIDER" = "pi" ]; then
+    # Pi-mono auth: ANTHROPIC_API_KEY, OPENROUTER_API_KEY, or auth.json must exist
+    if [ -z "$ANTHROPIC_API_KEY" ] && [ -z "$OPENROUTER_API_KEY" ] && [ ! -f "$HOME/.pi/agent/auth.json" ]; then
+        echo "Error: ANTHROPIC_API_KEY, OPENROUTER_API_KEY, or ~/.pi/agent/auth.json required for pi provider"
+        exit 1
+    fi
+else
+    # Claude auth (default)
+    if [ -z "$CLAUDE_CODE_OAUTH_TOKEN" ]; then
+        echo "Error: CLAUDE_CODE_OAUTH_TOKEN environment variable is required"
+        exit 1
+    fi
 fi
 
 if [ -z "$API_KEY" ]; then
@@ -12,6 +23,50 @@ if [ -z "$API_KEY" ]; then
     exit 1
 fi
 
+# ---- Archil disk mounts ----
+# Skipped when ARCHIL_MOUNT_TOKEN is not set (local dev / environments without Archil)
+if [ -n "$ARCHIL_MOUNT_TOKEN" ]; then
+    echo ""
+    echo "=== Archil Mount ==="
+
+    # Ensure /dev/fuse exists (needed in some VM environments like Fly.io Firecracker)
+    if [ ! -e /dev/fuse ]; then
+        mknod /dev/fuse c 10 229
+        chmod 666 /dev/fuse
+    fi
+
+    if [ -n "$ARCHIL_SHARED_DISK_NAME" ]; then
+        echo "Mounting shared disk ($ARCHIL_SHARED_DISK_NAME) at /workspace/shared..."
+        archil mount --shared "$ARCHIL_SHARED_DISK_NAME" /workspace/shared --region "$ARCHIL_REGION"
+    fi
+
+    # NOTE: Top-level shared directory pre-creation (thoughts/, memory/, etc.)
+    # lives in api-entrypoint.sh, not here. The API boots first and creates
+    # them so workers' mkdir auto-grants delegation at the subdir level.
+
+    if [ -n "$ARCHIL_PERSONAL_DISK_NAME" ]; then
+        echo "Mounting personal disk ($ARCHIL_PERSONAL_DISK_NAME) at /workspace/personal..."
+        # --force reclaims stale delegations from previous machine incarnations.
+        # Personal disks are always single-client, so force is safe.
+        # archil mount requires root — entrypoint runs as root (USER root in Dockerfile).
+        archil mount --force "$ARCHIL_PERSONAL_DISK_NAME" /workspace/personal --region "$ARCHIL_REGION"
+        # Brief pause for FUSE daemon to finish --force re-negotiation
+        sleep 1
+    fi
+    echo "===================="
+fi
+# ---- End Archil mount ----
+
+# Create personal workspace subdirectories (after FUSE mount, since Archil
+# requires empty mount points — these dirs can't exist at build time).
+# Personal disk is exclusive (rw), so this always succeeds.
+# NOTE: Shared disk subdirectories are created per-agent below (see
+# "Setting up per-agent directories" block), NOT here.
+mkdir -p /workspace/personal/memory 2>/dev/null || true
+# chown individual dirs (not -R) to avoid EPERM on .archil system files
+chown worker:worker /workspace/personal 2>/dev/null || true
+chown worker:worker /workspace/personal/memory 2>/dev/null || true
+
 # Role defaults to worker, can be set to "lead"
 ROLE="${AGENT_ROLE:-worker}"
 MCP_URL="${MCP_BASE_URL:-http://host.docker.internal:3013}"
@@ -28,6 +83,7 @@ fi
 
 echo "=== Agent Swarm ${ROLE^} v${VERSION} ==="
 echo "Agent ID: ${AGENT_ID:-<not set>}"
+echo "Harness Provider: $HARNESS_PROVIDER"
 echo "MCP Base URL: $MCP_URL"
 echo "YOLO Mode: $YOLO_MODE"
 echo "Session ID: ${SESSION_ID:-<auto-generated>}"
@@ -80,44 +136,148 @@ echo "=========================="
 # Cleanup function for graceful shutdown
 cleanup() {
     echo ""
+    # Unmount Archil disks (flushes pending data to backing store)
+    if [ -n "$ARCHIL_MOUNT_TOKEN" ]; then
+        echo "Unmounting Archil disks..."
+        archil unmount /workspace/shared 2>/dev/null || true
+        archil unmount /workspace/personal 2>/dev/null || true
+    fi
     echo "Shutting down PM2 processes..."
     pm2 kill 2>/dev/null || true
 }
 trap cleanup EXIT SIGINT SIGTERM
 
+# ---- Fetch swarm config from API ----
+if [ -n "$AGENT_ID" ]; then
+    echo "Fetching swarm config from API..."
+    if curl -s -f -H "Authorization: Bearer ${API_KEY}" \
+       -H "X-Agent-ID: ${AGENT_ID}" \
+       "${MCP_URL}/api/config/resolved?agentId=${AGENT_ID}&includeSecrets=true" \
+       > /tmp/swarm_config.json 2>/dev/null; then
+
+        CONFIG_COUNT=$(jq '.configs | length' /tmp/swarm_config.json 2>/dev/null || echo "0")
+        if [ "$CONFIG_COUNT" -gt 0 ]; then
+            echo "Found $CONFIG_COUNT config entries, exporting as env vars..."
+            jq -r '.configs[] | "\(.key)=" + (.value | @sh)' /tmp/swarm_config.json > /tmp/swarm_config.env 2>/dev/null || true
+            if [ -f /tmp/swarm_config.env ]; then
+                set -a
+                . /tmp/swarm_config.env
+                set +a
+                rm -f /tmp/swarm_config.env
+            fi
+        fi
+        rm -f /tmp/swarm_config.json
+    else
+        echo "Warning: Could not fetch swarm config (API may not be ready)"
+    fi
+fi
+# ---- End swarm config fetch ----
+
+# ---- agent-fs registration ----
+if [ -n "$AGENT_FS_API_URL" ] && [ -n "$AGENT_ID" ]; then
+  if [ -z "$AGENT_FS_API_KEY" ]; then
+    echo "[agent-fs] Registering with agent-fs at $AGENT_FS_API_URL..."
+    AF_EMAIL="${AGENT_EMAIL:-${AGENT_ID}@swarm.local}"
+
+    AF_RESULT=$(curl -s -X POST "${AGENT_FS_API_URL}/auth/register" \
+      -H "Content-Type: application/json" \
+      -d "{\"email\": \"$AF_EMAIL\"}" 2>/dev/null) || true
+
+    AF_API_KEY=$(echo "$AF_RESULT" | jq -r '.apiKey // empty')
+
+    if [ -n "$AF_API_KEY" ]; then
+      echo "[agent-fs] Registered successfully, storing API key..."
+      # Store as agent-scoped secret
+      curl -s -X PUT "${MCP_URL}/api/config" \
+        -H "Authorization: Bearer ${API_KEY}" \
+        -H "Content-Type: application/json" \
+        -d "{
+          \"scope\": \"agent\",
+          \"scopeId\": \"${AGENT_ID}\",
+          \"key\": \"AGENT_FS_API_KEY\",
+          \"value\": \"${AF_API_KEY}\",
+          \"isSecret\": true,
+          \"description\": \"agent-fs API key for ${AF_EMAIL}\"
+        }" > /dev/null 2>&1 || true
+
+      export AGENT_FS_API_KEY="$AF_API_KEY"
+      echo "[agent-fs] API key stored and exported"
+    else
+      echo "[agent-fs] Registration failed or already registered: $(echo "$AF_RESULT" | jq -r '.error // .message // "unknown error"')"
+    fi
+  else
+    echo "[agent-fs] Already registered (API key present)"
+  fi
+
+  # Lead-specific: create shared org
+  if [ "$AGENT_ROLE" = "lead" ] && [ -n "$AGENT_FS_API_KEY" ]; then
+    if [ -z "$AGENT_FS_SHARED_ORG_ID" ]; then
+      echo "[agent-fs] Lead: Creating shared org..."
+      AF_ORG_RESULT=$(curl -s -X POST "${AGENT_FS_API_URL}/orgs" \
+        -H "Authorization: Bearer ${AGENT_FS_API_KEY}" \
+        -H "Content-Type: application/json" \
+        -d '{"name": "swarm"}' 2>/dev/null) || true
+
+      AF_SHARED_ORG_ID=$(echo "$AF_ORG_RESULT" | jq -r '.orgId // .id // empty')
+
+      if [ -n "$AF_SHARED_ORG_ID" ]; then
+        echo "[agent-fs] Shared org created: $AF_SHARED_ORG_ID"
+        # Store as global config so all agents see it
+        curl -s -X PUT "${MCP_URL}/api/config" \
+          -H "Authorization: Bearer ${API_KEY}" \
+          -H "Content-Type: application/json" \
+          -d "{
+            \"scope\": \"global\",
+            \"key\": \"AGENT_FS_SHARED_ORG_ID\",
+            \"value\": \"${AF_SHARED_ORG_ID}\",
+            \"isSecret\": false,
+            \"description\": \"agent-fs shared org ID for the swarm\"
+          }" > /dev/null 2>&1 || true
+
+        export AGENT_FS_SHARED_ORG_ID="$AF_SHARED_ORG_ID"
+
+        # Create a one-time task for the lead to invite workers
+        echo "[agent-fs] Creating invitation task for lead..."
+        curl -s -X POST "${MCP_URL}/api/tasks" \
+          -H "Authorization: Bearer ${API_KEY}" \
+          -H "Content-Type: application/json" \
+          -d "{
+            \"task\": \"Invite workers to agent-fs shared org (${AF_SHARED_ORG_ID}). For each worker: check their AGENT_EMAIL config (or default to {agentId}@swarm.local), then run: agent-fs --org ${AF_SHARED_ORG_ID} org invite --email <worker-email> --role editor. Skip any already invited.\",
+            \"agentId\": \"${AGENT_ID}\",
+            \"source\": \"system\"
+          }" > /dev/null 2>&1 || true
+      else
+        echo "[agent-fs] Failed to create shared org: $(echo "$AF_ORG_RESULT" | jq -r '.error // .message // "unknown"')"
+      fi
+    else
+      echo "[agent-fs] Shared org already exists: $AGENT_FS_SHARED_ORG_ID"
+    fi
+  fi
+fi
+# ---- End agent-fs registration ----
+
 # Create .mcp.json in /workspace (project-level config)
 echo "Creating MCP config in /workspace..."
+# Build base MCP config with jq
+MCP_JSON=$(jq -n \
+  --arg url "${MCP_URL}/mcp" \
+  --arg apiKey "Bearer ${API_KEY}" \
+  '{mcpServers: {"agent-swarm": {type: "http", url: $url, headers: {Authorization: $apiKey}}}}')
+
+# Add X-Agent-ID header if set
 if [ -n "$AGENT_ID" ]; then
-    cat > /workspace/.mcp.json << EOF
-{
-  "mcpServers": {
-    "agent-swarm": {
-      "type": "http",
-      "url": "${MCP_URL}/mcp",
-      "headers": {
-        "Authorization": "Bearer ${API_KEY}",
-        "X-Agent-ID": "${AGENT_ID}"
-      }
-    }
-  }
-}
-EOF
-else
-    cat > /workspace/.mcp.json << EOF
-{
-  "mcpServers": {
-    "agent-swarm": {
-      "type": "http",
-      "url": "${MCP_URL}/mcp",
-      "headers": {
-        "Authorization": "Bearer ${API_KEY}"
-      }
-    }
-  }
-}
-EOF
+    MCP_JSON=$(echo "$MCP_JSON" | jq --arg agentId "$AGENT_ID" \
+      '.mcpServers["agent-swarm"].headers["X-Agent-ID"] = $agentId')
+fi
+
+# Add agentmail-mcp if API key is present
+if [ -n "$AGENTMAIL_API_KEY" ]; then
+    MCP_JSON=$(echo "$MCP_JSON" | jq --arg key "$AGENTMAIL_API_KEY" \
+      '.mcpServers.agentmail = {command: "npx", args: ["-y", "agentmail-mcp"], env: {AGENTMAIL_API_KEY: $key}}')
 fi
 
+echo "$MCP_JSON" > /workspace/.mcp.json
+
 # Configure GitHub authentication if token is provided
 echo ""
 echo "=== GitHub Authentication ==="
@@ -137,67 +297,162 @@ if [ -n "$GITHUB_TOKEN" ]; then
     echo "GitHub authentication configured successfully"
     echo "Git user: $GIT_NAME <$GIT_EMAIL>"
 else
-    echo "WARNING: GITHUB_TOKEN not set - git push operations will fail"
+    echo "WARNING: GITHUB_TOKEN not set - GitHub git push operations will fail"
 fi
 echo "=============================="
 
-# Install the desplega-ai marketplace
+# Configure GitLab authentication if token is provided
 echo ""
-echo "=== Marketplace Installation ==="
-
-if command -v claude >/dev/null 2>&1; then
-    echo "Installing desplega-ai/ai-toolbox marketplace..."
-    claude plugin marketplace add desplega-ai/ai-toolbox || echo "Toolbox marketplace add failed, continuing..."
-
-    echo "Installing plugins from desplega-ai-toolbox..."
-    claude plugin install desplega@desplega-ai-toolbox --scope user || echo "Plugin install failed, continuing..."
-    claude plugin install agent-swarm@desplega-ai-toolbox --scope user || echo "Plugin install failed, continuing..."
-    claude plugin install wts@desplega-ai-toolbox --scope user || echo "Plugin install failed, continuing..."
-
-    echo "Installing desplega-ai/qa-use marketplace..."
-    claude plugin marketplace add desplega-ai/qa-use || echo "qa-use marketplace add failed, continuing..."
-
-    echo "Installing plugins from desplega.ai..."
-    claude plugin install qa-use@desplega.ai --scope user || echo "Plugin install failed, continuing..."
+echo "=== GitLab Authentication ==="
+if [ -n "$GITLAB_TOKEN" ]; then
+    echo "Configuring GitLab authentication..."
+
+    # Configure glab CLI with the token
+    GITLAB_HOST="${GITLAB_URL:-https://gitlab.com}"
+    # Strip protocol for glab host config
+    GITLAB_HOST_BARE=$(echo "$GITLAB_HOST" | sed 's|https\?://||')
+    echo "$GITLAB_TOKEN" | glab auth login --hostname "$GITLAB_HOST_BARE" --stdin 2>/dev/null || true
+
+    # Set git user config for GitLab commits (use GitLab-specific env vars or fall back to GitHub ones)
+    GITLAB_GIT_EMAIL="${GITLAB_EMAIL:-${GITHUB_EMAIL:-worker-agent@desplega.ai}}"
+    GITLAB_GIT_NAME="${GITLAB_NAME:-${GITHUB_NAME:-Worker Agent}}"
+    # Only override git config if GitHub didn't set it already
+    if [ -z "$GITHUB_TOKEN" ]; then
+        git config --global user.email "$GITLAB_GIT_EMAIL"
+        git config --global user.name "$GITLAB_GIT_NAME"
+    fi
 
-    echo "Marketplace installation completed"
+    echo "GitLab authentication configured successfully (host: $GITLAB_HOST_BARE)"
 else
-    echo "WARNING: claude CLI not found, skipping marketplace installation"
+    echo "GITLAB_TOKEN not set - GitLab integration disabled for this worker"
 fi
-echo "==============================="
+echo "=============================="
 
-# Configure and install ai-tracker for tracking AI vs human code changes
+# ---- Auto-clone registered repos ----
 echo ""
-echo "=== AI Tracker Setup ==="
-if command -v ai-tracker >/dev/null 2>&1; then
-    # Create shared tracking directory
-    TRACKING_DIR="/workspace/shared/tracking"
-    mkdir -p "$TRACKING_DIR"
-
-    # Set per-agent database path
-    if [ -n "$AGENT_ID" ]; then
-        export AI_TRACKER_DB_PATH="${TRACKING_DIR}/${AGENT_ID}.db"
-        echo "AI Tracker DB Path: $AI_TRACKER_DB_PATH"
+echo "=== Repo Auto-Clone ==="
+if [ -n "$AGENT_ID" ]; then
+    echo "Fetching registered repos from API..."
+    if curl -s -f -H "Authorization: Bearer ${API_KEY}" \
+       -H "X-Agent-ID: ${AGENT_ID}" \
+       "${MCP_URL}/api/repos?autoClone=true" \
+       > /tmp/swarm_repos.json 2>/dev/null; then
+
+        REPO_COUNT=$(jq '.repos | length' /tmp/swarm_repos.json 2>/dev/null || echo "0")
+        if [ "$REPO_COUNT" -gt 0 ]; then
+            echo "Found $REPO_COUNT repos to clone..."
+
+            jq -c '.repos[]' /tmp/swarm_repos.json | while read -r repo; do
+                REPO_URL=$(echo "$repo" | jq -r '.url')
+                REPO_NAME=$(echo "$repo" | jq -r '.name')
+                REPO_BRANCH=$(echo "$repo" | jq -r '.defaultBranch // "main"')
+                REPO_DIR=$(echo "$repo" | jq -r '.clonePath')
+
+                # Ensure parent directory exists
+                mkdir -p "$(dirname "$REPO_DIR")"
+
+                if [ -d "${REPO_DIR}/.git" ]; then
+                    echo "  Pulling ${REPO_NAME} (${REPO_BRANCH}) at ${REPO_DIR}..."
+                    cd "$REPO_DIR" && git pull origin "$REPO_BRANCH" --ff-only 2>/dev/null || echo "  Warning: Could not pull ${REPO_NAME}"
+                    cd /workspace
+                else
+                    echo "  Cloning ${REPO_NAME} to ${REPO_DIR} (branch: ${REPO_BRANCH})..."
+                    gh repo clone "$REPO_URL" "$REPO_DIR" -- --branch "$REPO_BRANCH" --single-branch 2>/dev/null || echo "  Warning: Could not clone ${REPO_NAME}"
+                fi
+            done
+        else
+            echo "No repos registered for auto-clone"
+        fi
+        rm -f /tmp/swarm_repos.json
     else
-        export AI_TRACKER_DB_PATH="${TRACKING_DIR}/default.db"
-        echo "AI Tracker DB Path: $AI_TRACKER_DB_PATH (default, AGENT_ID not set)"
+        echo "Warning: Could not fetch repos (API may not be ready)"
     fi
+else
+    echo "Skipping repo clone (no AGENT_ID)"
+fi
+echo "==============================="
 
-    # Persist AI_TRACKER_DB_PATH to .bashrc for git hooks and new shell sessions
-    # Git hooks spawn fresh shells that don't inherit the exported env var
-    if ! grep -q "AI_TRACKER_DB_PATH" ~/.bashrc 2>/dev/null; then
-        echo "export AI_TRACKER_DB_PATH=\"${AI_TRACKER_DB_PATH}\"" >> ~/.bashrc
-    fi
 
-    # Install ai-tracker hooks (Claude Code PostToolUse hook + git post-commit hook)
-    echo "Installing ai-tracker hooks..."
-    ai-tracker install || echo "AI Tracker install failed, continuing..."
+# Find existing startup script in /workspace (start-up.sh, .bash, .js, .ts, .bun, or bare)
+find_startup_script() {
+    for pattern in start-up.sh start-up.bash start-up.js start-up.ts start-up.bun start-up; do
+        if [ -f "/workspace/${pattern}" ]; then
+            echo "/workspace/${pattern}"
+            return 0
+        fi
+    done
+    return 1
+}
 
-    echo "AI Tracker setup completed"
-else
-    echo "WARNING: ai-tracker not found, skipping AI tracking setup"
+
+# ---- Fetch and compose setup scripts from API ----
+if [ -n "$AGENT_ID" ]; then
+    echo ""
+    echo "=== Setup Script Fetch ==="
+    echo "Fetching setup scripts from API..."
+    if curl -s -f -H "Authorization: Bearer ${API_KEY}" \
+       -H "X-Agent-ID: ${AGENT_ID}" \
+       "${MCP_URL}/api/agents/${AGENT_ID}/setup-script" \
+       > /tmp/setup_scripts.json 2>/dev/null; then
+
+        GLOBAL_SCRIPT=$(jq -r '.globalSetupScript // empty' /tmp/setup_scripts.json 2>/dev/null)
+        AGENT_SCRIPT=$(jq -r '.setupScript // empty' /tmp/setup_scripts.json 2>/dev/null)
+
+        if [ -n "$GLOBAL_SCRIPT" ] || [ -n "$AGENT_SCRIPT" ]; then
+            EXISTING_STARTUP=$(find_startup_script) || true
+
+            if [ -n "$EXISTING_STARTUP" ]; then
+                # Prepend to existing file (preserve operator content)
+                echo "Prepending DB setup script to existing ${EXISTING_STARTUP}..."
+                TEMP_FILE=$(mktemp)
+                echo "#!/bin/bash" > "$TEMP_FILE"
+                # Global script goes outside markers (not synced back to agent DB)
+                if [ -n "$GLOBAL_SCRIPT" ]; then
+                    echo "# --- Global setup script ---" >> "$TEMP_FILE"
+                    echo "$GLOBAL_SCRIPT" >> "$TEMP_FILE"
+                    echo "" >> "$TEMP_FILE"
+                fi
+                # Agent script goes between markers (synced back to DB by hooks)
+                if [ -n "$AGENT_SCRIPT" ]; then
+                    echo "# === Agent-managed setup (from DB) ===" >> "$TEMP_FILE"
+                    echo "$AGENT_SCRIPT" >> "$TEMP_FILE"
+                    echo "# === End agent-managed setup ===" >> "$TEMP_FILE"
+                fi
+                echo "" >> "$TEMP_FILE"
+                # Strip shebang, global section, and existing marker sections from original
+                sed '1{/^#!/d;}' "$EXISTING_STARTUP" \
+                    | sed '/^# --- Global setup script ---$/,/^$/d' \
+                    | sed '/^# === Agent-managed setup (from DB) ===$/,/^# === End agent-managed setup ===$/d' \
+                    >> "$TEMP_FILE"
+                mv "$TEMP_FILE" "$EXISTING_STARTUP"
+                chmod +x "$EXISTING_STARTUP"
+            else
+                # Create new start-up.sh
+                echo "Creating /workspace/start-up.sh from DB setup script..."
+                echo "#!/bin/bash" > /workspace/start-up.sh
+                if [ -n "$GLOBAL_SCRIPT" ]; then
+                    echo "# --- Global setup script ---" >> /workspace/start-up.sh
+                    echo "$GLOBAL_SCRIPT" >> /workspace/start-up.sh
+                    echo "" >> /workspace/start-up.sh
+                fi
+                if [ -n "$AGENT_SCRIPT" ]; then
+                    echo "# === Agent-managed setup (from DB) ===" >> /workspace/start-up.sh
+                    echo "$AGENT_SCRIPT" >> /workspace/start-up.sh
+                    echo "# === End agent-managed setup ===" >> /workspace/start-up.sh
+                fi
+                chmod +x /workspace/start-up.sh
+            fi
+            echo "Setup scripts composed (global: $([ -n "$GLOBAL_SCRIPT" ] && echo "yes" || echo "no"), agent: $([ -n "$AGENT_SCRIPT" ] && echo "yes" || echo "no"))"
+        else
+            echo "No setup scripts configured"
+        fi
+        rm -f /tmp/setup_scripts.json
+    else
+        echo "Warning: Could not fetch setup scripts (API may not be ready)"
+    fi
+    echo "==============================="
 fi
-echo "==============================="
+# ---- End setup script fetch ----
 
 
 # Execute startup script if found
@@ -206,13 +461,7 @@ echo ""
 echo "=== Startup Script Detection (${ROLE}) ==="
 
 # Find startup script matching /workspace/start-up.* pattern
-STARTUP_SCRIPT=""
-for pattern in start-up.sh start-up.bash start-up.js start-up.ts start-up.bun start-up; do
-    if [ -f "/workspace/${pattern}" ]; then
-        STARTUP_SCRIPT="/workspace/${pattern}"
-        break
-    fi
-done
+STARTUP_SCRIPT=$(find_startup_script) || true
 
 if [ -n "$STARTUP_SCRIPT" ]; then
     echo "Found startup script: $STARTUP_SCRIPT"
@@ -302,24 +551,11 @@ fi
 echo ""
 echo "=== Workspace Initialization ==="
 
-# Configure wts for agent use (no tmux, no auto-Claude)
-echo "Configuring wts for agent mode..."
-mkdir -p /home/worker/.wts
-cat > /home/worker/.wts/config.json << EOF
-{
-  "defaults": {
-    "autoTmux": false,
-    "autoClaude": false
-  }
-}
-EOF
-
+# Create todos.md if it doesn't exist
 PERSONAL_DIR="/workspace/personal"
-mkdir -p "$PERSONAL_DIR"
-
 if [ ! -f "$PERSONAL_DIR/todos.md" ]; then
     echo "Creating personal todos.md..."
-    cat > "$PERSONAL_DIR/todos.md" << EOF
+    cat > "$PERSONAL_DIR/todos.md" << EOF || echo "Warning: Could not create todos.md (disk may not be mounted)"
 # My TODOs
 
 ## Current
@@ -329,24 +565,68 @@ else
     echo "Personal todo.md already exists, skipping creation"
 fi
 
-SHARED_DIR="/workspace/shared/thoughts"
-
-# Create shared thoughts directories
+# Set up per-agent directories on the shared disk (requires AGENT_ID at runtime)
+# Each agent gets exclusive write access to its own subdirectories under each
+# category (thoughts, memory, downloads, misc). All agents can read everything
+# via the --shared mount.
 if [ -n "$AGENT_ID" ]; then
-    AGENT_THOUGHTS_DIR="$SHARED_DIR/$AGENT_ID"
-    echo "Creating shared thoughts directories for agent ID $AGENT_ID..."
-    mkdir -p "$AGENT_THOUGHTS_DIR/plans"
-    mkdir -p "$AGENT_THOUGHTS_DIR/research"
-fi
+    AGENT_SHARED="/workspace/shared"
+
+    # Safety net: if top-level dirs don't exist yet (API still booting),
+    # retry a few times with backoff
+    if [ -n "$ARCHIL_MOUNT_TOKEN" ]; then
+        for attempt in 1 2 3; do
+            if [ -d "$AGENT_SHARED/thoughts" ]; then
+                break
+            fi
+            echo "Waiting for shared directory structure (attempt $attempt/3)..."
+            sleep 3
+        done
+    fi
 
-# shared always
-echo "Creating shared thoughts directories..."
-mkdir -p "$SHARED_DIR/shared/plans"
-mkdir -p "$SHARED_DIR/shared/research"
+    echo "Setting up per-agent directories for $AGENT_ID..."
+
+    # The shared disk is already mounted via `archil mount --shared`.
+    # Read access to ALL directories (including other agents') is automatic.
+    # Here we claim WRITE ownership of this agent's own subdirectories only.
+    #
+    # IMPORTANT: Top-level dirs (thoughts/, memory/, downloads/, misc/) are
+    # pre-created by the API machine at boot. This ensures our mkdir below
+    # auto-grants delegation at the SUBDIR level (e.g., thoughts/$AGENT_ID),
+    # not the parent level (thoughts/). See Appendix A in the plan for details.
+
+    for category in "thoughts" "memory" "downloads" "misc"; do
+        AGENT_DIR="$AGENT_SHARED/$category/$AGENT_ID"
+
+        # Create our subdir (auto-grants delegation on $AGENT_ID level)
+        # Entrypoint runs as root, so no sudo needed for mkdir.
+        mkdir -p "$AGENT_DIR" 2>/dev/null || true
+
+        # Checkout for persistent ownership (survives reboots where dir already exists)
+        # Use -f (force) to reclaim stale delegations from destroyed/redeployed machines.
+        # Each agent is the sole writer for its own subdirectory, so force is safe.
+        # Use `yes` piped in to auto-confirm the force-checkout prompt (no --yes flag).
+        # No sudo — entrypoint runs as root; sudo can swallow stdin pipes.
+        if [ -n "$ARCHIL_MOUNT_TOKEN" ]; then
+            yes | archil checkout -f "$AGENT_DIR" 2>/dev/null || true
+        fi
+
+        # chown AFTER checkout — need Archil delegation before FUSE allows chown
+        chown worker:worker "$AGENT_DIR" 2>/dev/null || true
+    done
+
+    # Create standard subdirectories (within owned dirs, always succeeds)
+    mkdir -p "$AGENT_SHARED/thoughts/$AGENT_ID/plans"
+    mkdir -p "$AGENT_SHARED/thoughts/$AGENT_ID/research"
+    mkdir -p "$AGENT_SHARED/thoughts/$AGENT_ID/brainstorms"
+    mkdir -p "$AGENT_SHARED/downloads/$AGENT_ID/slack"
+
+    echo "Per-agent directories ready for $AGENT_ID"
+fi
 
 echo "==============================="
 echo ""
 
 # Run the agent using compiled binary
 echo "Starting $ROLE..."
-exec /usr/local/bin/agent-swarm "$ROLE" "$@"
+exec gosu worker /usr/local/bin/agent-swarm "$ROLE" "$@"

package/docs-site/app/api/search/route.ts

@@ -0,0 +1,4 @@
+import { source } from "@/lib/source";
+import { createFromSource } from "fumadocs-core/search/server";
+
+export const { GET } = createFromSource(source);