@geteigen/cli 3.0.0 → 3.1.0

package/dist/cli/src/agent.js

@@ -1,4 +1,5 @@
-import { killCli, spawnCli } from "./proc.js";
+import { killCli, spawnUserCli } from "./proc.js";
+import { agentRunEnv } from "./cliEnv.js";
 import { createInterface } from "readline";
 import { existsSync, promises as fsPromises } from "fs";
 import { resolve, relative, isAbsolute } from "path";
@@ -51,7 +52,7 @@ runEnv) {
             : undefined;
         const start = async () => {
             // OpenCode resolves its project from $PWD, not the spawn cwd.
-            const baseEnv = { ...process.env, ...(runEnv || {}), PWD: repoPath };
+            const baseEnv = { ...agentRunEnv(runEnv), PWD: repoPath };
             let resumeId = sessionId || null;
             if (kind === "opencode" &&
                 resumeId &&
@@ -69,7 +70,7 @@ runEnv) {
             const args = backend.buildArgs(buildOpts);
             const backendEnv = backend.buildEnv?.(buildOpts);
             const mounted = await mountCursorProjectMcp(repoPath, cursorMcp);
-            const child = spawnCli(backend.command, args, {
+            const child = spawnUserCli(backend.command, args, {
                 cwd: repoPath,
                 env: { ...baseEnv, ...(backendEnv || {}), ...mounted.env },
                 stdio: ["ignore", "pipe", "pipe"],
@@ -131,6 +132,8 @@ runEnv) {
                     return;
                 }
                 for (const event of backend.parseLine(ev, ctx)) {
+                    if (event.kind === "tool_start")
+                        ctx.thinkingBuf.value = "";
                     onEvent(event);
                 }
             });

package/dist/cli/src/agentTools.d.ts

@@ -1,10 +1,6 @@
 import type { MachineAgentTool } from "../../shared/machines.js";
-/**
- * Which agent CLIs this machine can run. Shared by the CLI worker (reported
- * to the server on connect) and the desktop app (Machines page).
- */
 /** Built per call so a PATH merged after import (desktop login shell) is used. */
 export declare function noColorEnv(): NodeJS.ProcessEnv;
-/** Absolute path of `command` on the current PATH, like `which`. */
+/** Absolute path of `command` on PATH plus well-known install dirs. */
 export declare function findOnPath(command: string): string | null;
 export declare function detectAgentTools(): Promise<MachineAgentTool[]>;

package/dist/cli/src/agentTools.js

@@ -6,17 +6,39 @@ import { execCli } from "./proc.js";
  * Which agent CLIs this machine can run. Shared by the CLI worker (reported
  * to the server on connect) and the desktop app (Machines page).
  */
+function extraBinDirs() {
+    const home = homedir();
+    return [
+        join(home, ".local", "bin"),
+        join(home, ".opencode", "bin"),
+        join(home, ".claude", "local"),
+        join(home, ".cursor", "bin"),
+        "/usr/local/bin",
+    ];
+}
 /** Built per call so a PATH merged after import (desktop login shell) is used. */
 export function noColorEnv() {
-    return { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" };
+    const extra = extraBinDirs().join(delimiter);
+    const path = process.env.PATH || "";
+    return {
+        ...process.env,
+        PATH: extra ? `${extra}${delimiter}${path}` : path,
+        NO_COLOR: "1",
+        FORCE_COLOR: "0",
+    };
 }
 const WINDOWS_EXTS = [".exe", ".cmd", ".bat", ""];
-/** Absolute path of `command` on the current PATH, like `which`. */
+function dirsToSearch() {
+    return [...extraBinDirs(), ...(process.env.PATH || "").split(delimiter)];
+}
+/** Absolute path of `command` on PATH plus well-known install dirs. */
 export function findOnPath(command) {
     const exts = process.platform === "win32" ? WINDOWS_EXTS : [""];
-    for (const dir of (process.env.PATH || "").split(delimiter)) {
-        if (!dir)
+    const seen = new Set();
+    for (const dir of dirsToSearch()) {
+        if (!dir || seen.has(dir))
             continue;
+        seen.add(dir);
         for (const ext of exts) {
             const candidate = join(dir, command + ext);
             try {
@@ -50,21 +72,33 @@ async function versionOf(command, args) {
     }
 }
 const TOOLS = [
-    { id: "cursor", label: "Cursor", command: "cursor", args: ["agent", "--version"] },
-    { id: "claude", label: "Claude Code", command: "claude", args: ["--version"] },
-    { id: "codex", label: "Codex", command: "codex", args: ["--version"] },
-    { id: "opencode", label: "OpenCode", command: "opencode", args: ["--version"] },
+    {
+        id: "cursor",
+        label: "Cursor",
+        binaries: [
+            { command: "cursor", args: ["agent", "--version"] },
+            { command: "agent", args: ["--version"] },
+        ],
+    },
+    { id: "claude", label: "Claude Code", binaries: [{ command: "claude", args: ["--version"] }] },
+    { id: "codex", label: "Codex", binaries: [{ command: "codex", args: ["--version"] }] },
+    { id: "opencode", label: "OpenCode", binaries: [{ command: "opencode", args: ["--version"] }] },
 ];
 export async function detectAgentTools() {
     return Promise.all(TOOLS.map(async (tool) => {
-        const version = await versionOf(tool.command, tool.args);
-        const path = findOnPath(tool.command);
-        return {
-            id: tool.id,
-            label: tool.label,
-            installed: Boolean(version),
-            ...(version ? { version } : {}),
-            ...(path ? { path: displayPath(path) } : {}),
-        };
+        for (const bin of tool.binaries) {
+            const version = await versionOf(bin.command, bin.args);
+            if (!version)
+                continue;
+            const path = findOnPath(bin.command);
+            return {
+                id: tool.id,
+                label: tool.label,
+                installed: true,
+                version,
+                ...(path ? { path: displayPath(path) } : {}),
+            };
+        }
+        return { id: tool.id, label: tool.label, installed: false };
     }));
 }

package/dist/cli/src/cliEnv.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Env for spawning `claude` / `codex` / `cursor` from Eigen.
+ * Empty provider keys and `CI=true` make Claude Code skip a working
+ * Terminal/Foundry login and print "Not logged in · Please run /login".
+ */
+export declare function agentRunEnv(runEnv?: Record<string, string>): NodeJS.ProcessEnv;

package/dist/cli/src/cliEnv.js

@@ -0,0 +1,26 @@
+import { homedir } from "os";
+import { storedGithubCredentialEnv } from "./gitAuthEnv.js";
+const EMPTY_OVERRIDE_KEYS = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "CODEX_API_KEY",
+];
+/**
+ * Env for spawning `claude` / `codex` / `cursor` from Eigen.
+ * Empty provider keys and `CI=true` make Claude Code skip a working
+ * Terminal/Foundry login and print "Not logged in · Please run /login".
+ */
+export function agentRunEnv(runEnv) {
+    const env = { ...process.env, ...(runEnv || {}) };
+    if (!env.HOME?.trim())
+        env.HOME = homedir();
+    for (const key of EMPTY_OVERRIDE_KEYS) {
+        if (typeof env[key] === "string" && !env[key].trim())
+            delete env[key];
+    }
+    if (!env.ANTHROPIC_API_KEY?.trim())
+        delete env.CI;
+    return { ...env, ...storedGithubCredentialEnv() };
+}

package/dist/cli/src/gitAuthEnv.d.ts

@@ -0,0 +1,5 @@
+export declare function gitCredentialsPath(): string;
+/** Persist GitHub HTTPS creds for this machine (0600). Not written into origin URLs. */
+export declare function rememberGithubToken(token: string): void;
+/** Git env so pull/fetch/push use the stored helper without prompting. */
+export declare function storedGithubCredentialEnv(): Record<string, string>;

package/dist/cli/src/gitAuthEnv.js

@@ -0,0 +1,35 @@
+import { chmodSync, existsSync, writeFileSync } from "fs";
+import { join } from "path";
+import { getConfigDir } from "./config.js";
+export function gitCredentialsPath() {
+    return join(getConfigDir(), "git-credentials");
+}
+/** Persist GitHub HTTPS creds for this machine (0600). Not written into origin URLs. */
+export function rememberGithubToken(token) {
+    const trimmed = token.trim();
+    if (!trimmed)
+        return;
+    const file = gitCredentialsPath();
+    writeFileSync(file, `https://x-access-token:${encodeURIComponent(trimmed)}@github.com\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch {
+        // some filesystems ignore mode
+    }
+}
+/** Git env so pull/fetch/push use the stored helper without prompting. */
+export function storedGithubCredentialEnv() {
+    const file = gitCredentialsPath();
+    if (!existsSync(file))
+        return { GIT_TERMINAL_PROMPT: "0" };
+    return {
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_CONFIG_COUNT: "1",
+        GIT_CONFIG_KEY_0: "credential.helper",
+        GIT_CONFIG_VALUE_0: `store --file=${file}`,
+    };
+}

package/dist/cli/src/proc.d.ts

@@ -5,6 +5,14 @@ import type { ChildProcess, SpawnOptions } from "child_process";
  * cross-spawn resolves the shim and escapes arguments safely.
  */
 export declare function spawnCli(command: string, args: string[], options: SpawnOptions): ChildProcess;
+/** POSIX-safe single quotes so prompts / MCP JSON survive `zsh -lc`. */
+export declare function posixShellQuote(value: string): string;
+/**
+ * Spawn an agent CLI the way a terminal would. Finder/Dock Eigen has a
+ * different keychain context than Terminal; a login shell is how Claude
+ * Foundry / Codex subscription creds actually resolve.
+ */
+export declare function spawnUserCli(command: string, args: string[], options: SpawnOptions): ChildProcess;
 export interface ExecCliOptions {
     cwd?: string;
     env?: NodeJS.ProcessEnv;

package/dist/cli/src/proc.js

@@ -7,6 +7,26 @@ import crossSpawn from "cross-spawn";
 export function spawnCli(command, args, options) {
     return crossSpawn(command, args, options);
 }
+/** POSIX-safe single quotes so prompts / MCP JSON survive `zsh -lc`. */
+export function posixShellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Spawn an agent CLI the way a terminal would. Finder/Dock Eigen has a
+ * different keychain context than Terminal; a login shell is how Claude
+ * Foundry / Codex subscription creds actually resolve.
+ */
+export function spawnUserCli(command, args, options) {
+    if (process.platform === "win32")
+        return spawnCli(command, args, options);
+    const shell = process.env.SHELL && process.env.SHELL.startsWith("/")
+        ? process.env.SHELL
+        : process.platform === "darwin"
+            ? "/bin/zsh"
+            : "/bin/sh";
+    const line = [command, ...args].map(posixShellQuote).join(" ");
+    return spawnCli(shell, ["-lc", line], options);
+}
 /** execFile-style helper on top of spawnCli: resolves `{ stdout, stderr }`, rejects on non-zero exit. */
 export function execCli(command, args, options = {}) {
     const maxBuffer = options.maxBuffer ?? 1024 * 1024;

package/dist/cli/src/service.js

@@ -145,7 +145,16 @@ export function installService(startArgs) {
             throw new Error(enabled.out || "systemctl enable failed");
         const notes = [`Installed ${path}`, `Logs: ${system ? `journalctl -u ${UNIT} -f` : `journalctl --user -u ${UNIT} -f`}`];
         if (!system) {
-            notes.push(`To keep it running after you log out: sudo loginctl enable-linger ${process.env.USER || "$USER"}`);
+            const lingerUser = process.env.SUDO_USER || process.env.USER || "";
+            const linger = lingerUser
+                ? run("sudo", ["-n", "loginctl", "enable-linger", lingerUser])
+                : { ok: false, out: "" };
+            if (linger.ok) {
+                notes.push(`Linger enabled for ${lingerUser} (survives SSH logout).`);
+            }
+            else {
+                notes.push(`To keep it running after you log out: sudo loginctl enable-linger ${lingerUser || "$USER"}`);
+            }
         }
         return notes;
     }

package/dist/cli/src/workRoots.js

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readdirSync, realpathSync, statSync } from "fs";
 import { homedir } from "os";
 import { basename, dirname, isAbsolute, join, normalize, resolve, sep } from "path";
 import { execCli } from "./proc.js";
+import { gitCredentialsPath, rememberGithubToken } from "./gitAuthEnv.js";
 /**
  * Folders this machine lets agents work in. Local roots come from
  * `eigen start --root` / EIGEN_WORK_ROOT; server roots from Eigen → Machines.
@@ -106,11 +107,12 @@ function authedUrl(repoUrl, token) {
         return `${clean}.git`;
     return `${clean.replace(/^https:\/\//, `https://x-access-token:${encodeURIComponent(token)}@`)}.git`;
 }
-/**
- * The token is only needed while talking to GitHub. Put the plain URL back so
- * it never stays in .git/config, where anyone else on a shared machine could
- * read it.
- */
+async function useStoredGithubCreds(cwd) {
+    const file = gitCredentialsPath();
+    await git(cwd, ["config", "--local", "--unset-all", "credential.helper"]).catch(() => undefined);
+    await git(cwd, ["config", "--local", "credential.helper", `store --file=${file}`]);
+}
+/** Don't leave the access token in origin — `git remote -v` prints it. */
 async function forgetRemoteToken(cwd) {
     try {
         const current = (await git(cwd, ["remote", "get-url", "origin"])).stdout.trim();
@@ -122,6 +124,13 @@ async function forgetRemoteToken(cwd) {
         // no origin / not a repo
     }
 }
+async function persistGithubAuth(cwd, token) {
+    if (!token || !existsSync(join(cwd, ".git")))
+        return;
+    rememberGithubToken(token);
+    await useStoredGithubCreds(cwd);
+    await forgetRemoteToken(cwd);
+}
 /** Strip credentials so errors never echo a token. */
 function scrub(message, token) {
     let out = message.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@");
@@ -173,8 +182,7 @@ export async function prepareRepo(roots, input) {
         throw new Error(scrub(err.stderr || err.message, input.token));
     }
     finally {
-        if (input.token && existsSync(join(target, ".git")))
-            await forgetRemoteToken(target);
+        await persistGithubAuth(target, input.token);
     }
 }
 export async function finalizeGit(roots, input) {
@@ -215,7 +223,6 @@ export async function finalizeGit(roots, input) {
         throw new Error(scrub(err.stderr || err.message, input.token));
     }
     finally {
-        if (input.token)
-            await forgetRemoteToken(cwd);
+        await persistGithubAuth(cwd, input.token);
     }
 }

package/dist/cli/src/workerCore.js

@@ -7,8 +7,9 @@ import { dirname, resolve } from "path";
 import { listLocalModelsForBackend } from "./listModels.js";
 import { runAgentWithHandle, abortRun, abortAll, isEditTool, getFileDiff, revertFiles, } from "./agent.js";
 import { listChatSessions } from "./listSessions.js";
+import { rememberGithubToken } from "./gitAuthEnv.js";
 import { WorkRoots, finalizeGit, prepareRepo } from "./workRoots.js";
-import { checkoutWorkspaceGit, commitWorkspaceGit, getWorkspaceGit, listWorkspaceDir, pushWorkspaceGit, readWorkspaceFile, searchWorkspaceFiles, } from "./workspace.js";
+import { checkoutWorkspaceGit, commitWorkspaceGit, createWorkspaceGitBranch, discardWorkspaceGit, getWorkspaceGit, listWorkspaceDir, pushWorkspaceGit, readWorkspaceFile, searchWorkspaceFiles, } from "./workspace.js";
 import { isSafeAttachmentRelPath, } from "../../shared/uploads.js";
 /**
  * 6: worker:list-models accepts optional `backend` (cursor | claude-code | codex).
@@ -110,13 +111,28 @@ export function createWorker(options) {
             socket.emit(item.event, item.payload);
         }
     };
-    // Which agent CLIs this machine has; refreshed on each (re)connect.
+    // Which agent CLIs this machine has. First report is on connect; rescan
+    // while connected so installing CLIs later shows up without a restart.
     let agentTools = [];
+    let lastToolsJson = "";
     const refreshAgentTools = () => detectAgentTools()
         .then((tools) => {
         agentTools = tools;
     })
         .catch(() => undefined);
+    const reportAgentTools = async () => {
+        await refreshAgentTools();
+        const json = JSON.stringify(agentTools);
+        if (json === lastToolsJson)
+            return;
+        lastToolsJson = json;
+        if (socket.connected)
+            socket.emit("worker:info", { agents: agentTools });
+    };
+    const toolsTimer = setInterval(() => {
+        void reportAgentTools();
+    }, 60_000);
+    toolsTimer.unref?.();
     const announceReady = () => {
         const runs = listActiveRuns();
         socket.emit("worker:ready", {
@@ -141,11 +157,7 @@ export function createWorker(options) {
             log.info(`  ${activeRuns.size} agent run(s) still going — resuming stream`);
         }
         announceReady();
-        // Tool detection can take a few seconds; send it once it's in.
-        void refreshAgentTools().then(() => {
-            if (socket.connected)
-                socket.emit("worker:info", { agents: agentTools });
-        });
+        void reportAgentTools();
         flushQueue();
     });
     socket.on("disconnect", (reason) => {
@@ -575,12 +587,18 @@ export function createWorker(options) {
         try {
             if (!roots.isAllowed(payload.repoPath))
                 throw new Error("That folder is outside this machine's allowed folders");
+            if (payload.token)
+                rememberGithubToken(payload.token);
             if (payload.action === "commit")
                 await commitWorkspaceGit(payload.repoPath, payload.message || "");
             else if (payload.action === "push")
                 await pushWorkspaceGit(payload.repoPath);
             else if (payload.action === "checkout")
                 await checkoutWorkspaceGit(payload.repoPath, payload.branch || "");
+            else if (payload.action === "create")
+                await createWorkspaceGitBranch(payload.repoPath, payload.branch || "");
+            else if (payload.action === "discard")
+                await discardWorkspaceGit(payload.repoPath, payload.path || "");
             else
                 throw new Error("Unknown git action");
             emitOrQueue("worker:workspace-git-action-result", { requestId: payload.requestId, ok: true });
@@ -694,6 +712,7 @@ export function createWorker(options) {
         workerId,
         status,
         stop() {
+            clearInterval(toolsTimer);
             abortAll();
             activeRuns.clear();
             socket.disconnect();

package/dist/cli/src/workspace.d.ts

@@ -3,6 +3,8 @@ export declare function getWorkspaceGit(repoPath: string): Promise<WorkspaceGitS
 export declare function commitWorkspaceGit(repoPath: string, rawMessage: string): Promise<void>;
 export declare function pushWorkspaceGit(repoPath: string): Promise<void>;
 export declare function checkoutWorkspaceGit(repoPath: string, rawBranch: string): Promise<void>;
+export declare function createWorkspaceGitBranch(repoPath: string, rawBranch: string): Promise<void>;
+export declare function discardWorkspaceGit(repoPath: string, rawPath?: string): Promise<void>;
 export declare function listWorkspaceDir(repoPath: string, rawPath: string): Promise<WorkspaceRepoEntry[]>;
 export declare function readWorkspaceFile(repoPath: string, rawPath: string): Promise<WorkspaceRepoFile>;
 export declare function searchWorkspaceFiles(repoPath: string, query: string): Promise<WorkspacePathMatch[]>;

package/dist/cli/src/workspace.js

@@ -1,7 +1,8 @@
 import { existsSync, promises as fs } from "fs";
 import { isAbsolute, relative, resolve } from "path";
 import { execCli } from "./proc.js";
-import { assertCommitMessage, assertGitBranchName, parseGitBranches, } from "../../shared/workspace.js";
+import { storedGithubCredentialEnv } from "./gitAuthEnv.js";
+import { assertCommitMessage, assertGitBranchName, assertGitChangePath, parseGitBranches, } from "../../shared/workspace.js";
 const MAX_GIT_DIFF_CHARS = 400_000;
 const MAX_REPO_FILE_BYTES = 512 * 1024;
 const MAX_REPO_IMAGE_BYTES = 3 * 1024 * 1024;
@@ -36,7 +37,7 @@ async function git(repoPath, args) {
             cwd: repoPath,
             timeout: 30_000,
             maxBuffer: 8 * 1024 * 1024,
-            env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+            env: { ...process.env, ...storedGithubCredentialEnv() },
         });
         return stdout;
     }
@@ -56,12 +57,15 @@ function resolveInside(repoPath, rawPath) {
 export async function getWorkspaceGit(repoPath) {
     if (!repoPath || !existsSync(repoPath))
         throw new Error("Repository folder not found");
-    const branchRaw = await git(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"]);
-    const statusRaw = await git(repoPath, ["status", "--porcelain"]);
-    const logRaw = await git(repoPath, ["log", "-n", "25", "--pretty=format:%h%x09%s%x09%an%x09%cr"]);
-    const aheadRaw = (await git(repoPath, ["rev-list", "--count", "@{u}..HEAD"])).trim();
-    const branchList = await git(repoPath, ["branch", "-a", "--format=%(refname:short)"]);
-    const diffRaw = await git(repoPath, ["diff", "HEAD"]);
+    const [branchRaw, statusRaw, logRaw, aheadCount, branchList, diffRaw] = await Promise.all([
+        git(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"]),
+        git(repoPath, ["status", "--porcelain"]),
+        git(repoPath, ["log", "-n", "25", "--pretty=format:%h%x09%s%x09%an%x09%cr"]),
+        git(repoPath, ["rev-list", "--count", "@{u}..HEAD"]),
+        git(repoPath, ["branch", "-a", "--format=%(refname:short)"]),
+        git(repoPath, ["diff", "HEAD"]),
+    ]);
+    const aheadRaw = aheadCount.trim();
     const changes = statusRaw
         .split("\n")
         .filter((line) => line.trim())
@@ -90,7 +94,7 @@ async function gitChecked(repoPath, args, timeout = 60_000) {
             cwd: repoPath,
             timeout,
             maxBuffer: 8 * 1024 * 1024,
-            env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+            env: { ...process.env, ...storedGithubCredentialEnv() },
         });
         return stdout;
     }
@@ -99,17 +103,45 @@ async function gitChecked(repoPath, args, timeout = 60_000) {
         throw new Error((e.stderr || e.message || "Git failed").trim().slice(0, 800));
     }
 }
+async function githubCliIdentity() {
+    try {
+        const { stdout } = await execCli("gh", ["api", "user"], { timeout: 15_000 });
+        const user = JSON.parse(stdout);
+        const login = String(user.login || "").trim();
+        if (!login)
+            return null;
+        const email = typeof user.email === "string" && user.email.includes("@")
+            ? user.email.trim()
+            : `${user.id ? `${user.id}+` : ""}${login}@users.noreply.github.com`;
+        return { name: String(user.name || "").trim() || login, email };
+    }
+    catch {
+        return null;
+    }
+}
+/** Prefer the machine git identity, then the signed-in GitHub CLI user. */
+async function resolveCommitIdentity(repoPath) {
+    const name = (await git(repoPath, ["config", "--get", "user.name"])).trim();
+    const email = (await git(repoPath, ["config", "--get", "user.email"])).trim();
+    if (name && email)
+        return { name, email };
+    const gh = await githubCliIdentity();
+    if (gh)
+        return { name: name || gh.name, email: email || gh.email };
+    throw new Error("Set git user.name and user.email, or sign in with GitHub CLI (gh auth login)");
+}
 export async function commitWorkspaceGit(repoPath, rawMessage) {
     const message = assertCommitMessage(rawMessage);
+    const author = await resolveCommitIdentity(repoPath);
     await gitChecked(repoPath, ["add", "-A"]);
     const status = await git(repoPath, ["status", "--porcelain"]);
     if (!status.trim())
         throw new Error("Nothing to commit");
     await gitChecked(repoPath, [
         "-c",
-        "user.name=Eigen",
+        `user.name=${author.name}`,
         "-c",
-        "user.email=agent@users.noreply.github.com",
+        `user.email=${author.email}`,
         "commit",
         "-m",
         message,
@@ -119,6 +151,7 @@ export async function pushWorkspaceGit(repoPath) {
     const branch = (await git(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
     if (!branch || branch === "HEAD")
         throw new Error("Checkout a branch before pushing");
+    await gitChecked(repoPath, ["fetch", "origin"], 180_000).catch(() => undefined);
     await gitChecked(repoPath, ["push", "-u", "origin", "HEAD"], 180_000);
 }
 export async function checkoutWorkspaceGit(repoPath, rawBranch) {
@@ -136,6 +169,33 @@ export async function checkoutWorkspaceGit(repoPath, rawBranch) {
         await gitChecked(repoPath, ["checkout", "-B", branch, `origin/${branch}`]);
     }
 }
+export async function createWorkspaceGitBranch(repoPath, rawBranch) {
+    const branch = assertGitBranchName(rawBranch);
+    const current = (await git(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+    if (current === branch)
+        return;
+    const known = parseGitBranches(await git(repoPath, ["branch", "-a", "--format=%(refname:short)"]), current);
+    if (known.includes(branch))
+        throw new Error("That branch already exists");
+    await gitChecked(repoPath, ["checkout", "-b", branch]);
+}
+export async function discardWorkspaceGit(repoPath, rawPath = "") {
+    const path = assertGitChangePath(rawPath);
+    if (!path) {
+        await gitChecked(repoPath, ["reset", "--hard", "HEAD"]);
+        await gitChecked(repoPath, ["clean", "-fd"]);
+        return;
+    }
+    const tracked = await git(repoPath, ["ls-files", "--error-unmatch", "--", path]);
+    if (tracked.trim()) {
+        await gitChecked(repoPath, ["restore", "--source=HEAD", "--staged", "--worktree", "--", path]).catch(async () => {
+            await gitChecked(repoPath, ["checkout", "HEAD", "--", path]);
+        });
+        return;
+    }
+    const { abs } = resolveInside(repoPath, path);
+    await fs.rm(abs, { recursive: true, force: true });
+}
 export async function listWorkspaceDir(repoPath, rawPath) {
     const { abs, rel } = resolveInside(repoPath, rawPath);
     let dir;

package/dist/shared/automations.d.ts

@@ -68,6 +68,8 @@ export interface AutomationPromptInput {
     artifactRules?: string;
     /** The automation's memory doc: read first, log to before finishing. */
     trackingDoc?: TrackingDocRef | null;
+    /** When the Eigen GitHub App is installed, force PR comments through it. */
+    githubAppComments?: boolean;
     approvedToolCalls?: Array<{
         toolName: string;
         detail: string;
@@ -79,11 +81,7 @@ export interface TrackingDocRef {
     title: string;
     url: string;
 }
-/**
- * How a run uses its automation's tracking doc. The doc is the memory
- * between runs for both fresh agents and room agents.
- */
-export declare function trackingDocRules(doc: TrackingDocRef): string;
+export declare function githubAppCommentRules(): string;
 /**
  * The turn an automation sends to the room agent it runs as. The agent keeps
  * its conversation, so this is short: what to do now, plus any event data.
@@ -95,6 +93,7 @@ export declare function buildRoomRunMessage(input: {
     event: unknown;
     mode?: "auto" | "approval" | "suggest_only";
     trackingDoc?: TrackingDocRef | null;
+    githubAppComments?: boolean;
 }): string;
 /** Sent to a resumed session after a paused write was approved. */
 export declare function buildApprovalContinuationPrompt(approvedToolCalls: Array<{

package/dist/shared/automations.js

@@ -223,6 +223,7 @@ export function buildAutomationPrompt(input) {
         "- If you create or update a Doc, include its link in that final summary as a Markdown link, e.g. [Daily Reddit leads](/docs/doc_abc123).",
         ...(input.artifactRules ? ["", input.artifactRules] : []),
         ...(input.trackingDoc ? ["", trackingDocRules(input.trackingDoc)] : []),
+        ...(input.githubAppComments ? ["", githubAppCommentRules()] : []),
         "",
         "<untrusted_event>",
         safeJson(input.event),
@@ -239,11 +240,16 @@ export function buildAutomationPrompt(input) {
         "</steer_automation>",
     ].join("\n");
 }
-/**
- * How a run uses its automation's tracking doc. The doc is the memory
- * between runs for both fresh agents and room agents.
- */
-export function trackingDocRules(doc) {
+export function githubAppCommentRules() {
+    return [
+        "<github_comments>",
+        "To comment on a GitHub pull request, call `steer_github_comment_pr` (steer_room MCP) with the PR url or owner/repo/number and the markdown body.",
+        "That posts as the Eigen GitHub App. Do not use steer_hub GitHub tools to comment, review, commit, create files, or push — those act as a personal GitHub user.",
+        "This run has no git checkout. Do not try to git commit or git push.",
+        "</github_comments>",
+    ].join("\n");
+}
+function trackingDocRules(doc) {
     return [
         "<tracking_doc>",
         `This automation's memory is the Doc "${doc.title}" (id ${doc.id}, link ${doc.url}).`,
@@ -278,6 +284,7 @@ export function buildRoomRunMessage(input) {
             : []),
         ...(input.trackingDoc ? ["", trackingDocRules(input.trackingDoc)] : []),
         "",
+        ...(input.githubAppComments ? ["", githubAppCommentRules()] : []),
         writes,
         "Use what you know from earlier runs in this conversation to avoid repeating work. End with a short summary of the result; link any Doc you created or updated.",
     ].join("\n");

package/dist/shared/backends/claudeCode.d.ts

@@ -1,4 +1,6 @@
 import type { BuildArgsOptions, NormalizedAgentEvent, ParseLineContext, WorkerBackend } from "./types.js";
+/** Eigen's GUI worker often cannot see a Terminal/Foundry `claude auth` session. */
+export declare function rewriteClaudeCliError(message: string): string;
 /**
  * Claude Code CLI headless backend.
  * Spawns: `claude -p --output-format stream-json --verbose ...`

package/dist/shared/backends/claudeCode.js

@@ -1,6 +1,14 @@
 import { diffFromToolArgs, extractThinkingText, formatToolResultDetail, isEditTool, isQuestionTool, isTodoTool, parseQuestionToolArgs, todoStatusSummary, todosFromToolArgs, TOOL_RESULT_DETAIL_LIMIT, stringifyUnknown, } from "./cursor.js";
 import { claudeToolIntegration } from "../toolIntegration.js";
 import { claudeResultUsage } from "./usage.js";
+/** Eigen's GUI worker often cannot see a Terminal/Foundry `claude auth` session. */
+export function rewriteClaudeCliError(message) {
+    if (!/not logged in|please run \/login/i.test(message))
+        return message;
+    return ("Claude Code has no usable login in Eigen's worker. " +
+        "`claude auth status` in Terminal can still show logged in (Foundry / third-party). " +
+        "Quit Eigen completely and reopen it, or run `claude auth login` in Terminal while Eigen is open.");
+}
 function extractText(message) {
     if (!message || typeof message !== "object")
         return "";
@@ -350,11 +358,11 @@ export class ClaudeCodeBackend {
             ctx.gotTerminalEvent.value = true;
             out.push({
                 kind: "error",
-                message: stringifyUnknown(ev.error) ||
+                message: rewriteClaudeCliError(stringifyUnknown(ev.error) ||
                     stringifyUnknown(ev.message) ||
                     stringifyUnknown(ev.result) ||
                     ctx.stderr ||
-                    "Claude Code error",
+                    "Claude Code error"),
             });
             return out;
         }
@@ -375,11 +383,11 @@ export class ClaudeCodeBackend {
                 subtype === "error_during_execution" ||
                 subtype === "error_max_turns";
             if (isError) {
-                const msg = stringifyUnknown(ev.result) ||
+                const msg = rewriteClaudeCliError(stringifyUnknown(ev.result) ||
                     stringifyUnknown(ev.errors) ||
                     stringifyUnknown(ev.error) ||
                     ctx.stderr ||
-                    `Claude Code error (${subtype || "unknown"})`;
+                    `Claude Code error (${subtype || "unknown"})`);
                 out.push({ kind: "error", message: msg });
             }
             else {

package/dist/shared/backends/cursor.d.ts

@@ -22,6 +22,15 @@ export declare function mergeAssistantText(prev: string, incoming: string): stri
 export declare function normalizeThinkingText(text: string): string;
 /** Merge streamed thinking: snapshots replace, deltas append with a space. */
 export declare function mergeThinkingText(prev: string, incoming: string): string;
+/**
+ * Cursor CLI streams thinking as phrase-sized JSON lines that are not prefixes
+ * of each other. Always concatenate; a new thought starts only after tools
+ * (`afterTools` in RoomManager).
+ */
+export declare function advanceThinking(prev: string, incoming: string): {
+    finalize?: string;
+    current: string;
+};
 /** Pull visible model thinking / reasoning out of a CLI or SDK payload. */
 export declare function extractThinkingText(source: unknown): string;
 /**

package/dist/shared/backends/cursor.js

@@ -192,6 +192,14 @@ export function mergeThinkingText(prev, incoming) {
         return base;
     return `${base} ${chunk}`;
 }
+/**
+ * Cursor CLI streams thinking as phrase-sized JSON lines that are not prefixes
+ * of each other. Always concatenate; a new thought starts only after tools
+ * (`afterTools` in RoomManager).
+ */
+export function advanceThinking(prev, incoming) {
+    return { current: mergeThinkingText(prev, incoming) };
+}
 function thinkingFromRecord(rec) {
     for (const key of ["thinking", "reasoning", "text", "content"]) {
         const value = rec[key];
@@ -1074,16 +1082,20 @@ export class CursorAgentBackend {
             if (!text)
                 return out;
             ctx.thinkingBuf ??= { value: "" };
-            const merged = mergeThinkingText(ctx.thinkingBuf.value, text);
-            if (merged === ctx.thinkingBuf.value)
+            const step = advanceThinking(ctx.thinkingBuf.value, text);
+            if (step.finalize) {
+                out.push({ kind: "thinking_final", text: step.finalize });
+            }
+            if (step.current === ctx.thinkingBuf.value && !step.finalize)
                 return out;
-            ctx.thinkingBuf.value = merged;
+            ctx.thinkingBuf.value = step.current;
+            const done = ev.subtype === "completed";
             out.push({
-                kind: ev.subtype === "completed" || type.endsWith("Message")
-                    ? "thinking_final"
-                    : "thinking_delta",
-                text: merged,
+                kind: done ? "thinking_final" : "thinking_delta",
+                text: step.current,
             });
+            if (done)
+                ctx.thinkingBuf.value = "";
             return out;
         }
         if (type === "assistant") {
@@ -1091,13 +1103,19 @@ export class CursorAgentBackend {
                 const thinking = extractThinkingText(ev.message ?? ev);
                 if (thinking) {
                     ctx.thinkingBuf ??= { value: "" };
-                    const mergedThinking = mergeThinkingText(ctx.thinkingBuf.value, thinking);
-                    if (mergedThinking !== ctx.thinkingBuf.value) {
-                        ctx.thinkingBuf.value = mergedThinking;
+                    const step = advanceThinking(ctx.thinkingBuf.value, thinking);
+                    if (step.finalize) {
+                        out.push({ kind: "thinking_final", text: step.finalize });
+                    }
+                    if (step.current !== ctx.thinkingBuf.value || step.finalize) {
+                        ctx.thinkingBuf.value = step.current;
+                        const done = !("timestamp_ms" in ev);
                         out.push({
-                            kind: "timestamp_ms" in ev ? "thinking_delta" : "thinking_final",
-                            text: mergedThinking,
+                            kind: done ? "thinking_final" : "thinking_delta",
+                            text: step.current,
                         });
+                        if (done)
+                            ctx.thinkingBuf.value = "";
                     }
                 }
             }
@@ -1134,6 +1152,7 @@ export class CursorAgentBackend {
             // Nested Task/subagent tools (parentToolCallId) still become first-class
             // chat cards so cloud/local Cursor subagent work is visible.
             if (ev.subtype === "started") {
+                ctx.thinkingBuf = { value: "" };
                 out.push({
                     kind: "tool_start",
                     callId,

package/dist/shared/backends/opencode.d.ts

@@ -18,6 +18,7 @@ export declare class OpencodeBackend implements WorkerBackend {
     private usage;
     private textSent;
     private thinkingSent;
+    private thinkingPartId;
     private startedTools;
     private doneTools;
     private anonSeq;
@@ -33,6 +34,8 @@ export declare class OpencodeBackend implements WorkerBackend {
     /** OpenCode takes MCP servers through its merged config, not a CLI flag. */
     buildEnv(opts: BuildArgsOptions): Record<string, string>;
     private appendText;
+    /** One thought per reasoning part. A new part finalizes the previous thought. */
+    private emitThinking;
     private parseTool;
     parseLine(json: unknown, ctx?: ParseLineContext): NormalizedAgentEvent[];
     flush(ctx?: ParseLineContext): NormalizedAgentEvent[];

package/dist/shared/backends/opencode.js

@@ -145,6 +145,7 @@ export class OpencodeBackend {
     };
     textSent = new Map();
     thinkingSent = new Map();
+    thinkingPartId = "";
     startedTools = new Set();
     doneTools = new Set();
     anonSeq = 0;
@@ -216,13 +217,32 @@ export class OpencodeBackend {
         }
         if (!chunk)
             return "";
-        // A new part (e.g. text after a tool step) starts its own paragraph.
-        if (!already && buffer.value && !/\s$/.test(buffer.value) && !/^\s/.test(chunk)) {
+        // Text parts after a tool continue the reply. Thinking parts must not —
+        // each reasoning block is its own thought (see emitThinking).
+        if (kind === "text" &&
+            !already &&
+            buffer.value &&
+            !/\s$/.test(buffer.value) &&
+            !/^\s/.test(chunk)) {
             buffer.value += "\n\n";
         }
         buffer.value += chunk;
         return buffer.value;
     }
+    /** One thought per reasoning part. A new part finalizes the previous thought. */
+    emitThinking(ctx, partId, incoming, full) {
+        const out = [];
+        const thinking = (ctx.thinkingBuf ??= { value: "" });
+        if (this.thinkingPartId && this.thinkingPartId !== partId && thinking.value) {
+            out.push({ kind: "thinking_final", text: thinking.value });
+            thinking.value = "";
+        }
+        this.thinkingPartId = partId;
+        const text = this.appendText(ctx, partId, incoming, "thinking", full);
+        if (text)
+            out.push({ kind: "thinking_delta", text });
+        return out;
+    }
     parseTool(ev, part, ctx) {
         const out = [];
         const rawName = textField(part.tool) || "tool";
@@ -242,6 +262,8 @@ export class OpencodeBackend {
         const done = status === "completed" || status === "error" || status === "failed";
         if (!this.startedTools.has(callId)) {
             this.startedTools.add(callId);
+            (ctx.thinkingBuf ??= { value: "" }).value = "";
+            this.thinkingPartId = "";
             out.push({
                 kind: "tool_start",
                 callId,
@@ -348,9 +370,7 @@ export class OpencodeBackend {
             if (!delta || ctx.toolsOnly)
                 return out;
             if (partType === "reasoning" || partType === "thinking") {
-                const full = this.appendText(ctx, partId, delta, "thinking", false);
-                if (full)
-                    out.push({ kind: "thinking_delta", text: full });
+                return out.concat(this.emitThinking(ctx, partId, delta, false));
             }
             else {
                 const full = this.appendText(ctx, partId, delta, "text", false);
@@ -367,9 +387,7 @@ export class OpencodeBackend {
             if (!text)
                 return out;
             if (type === "reasoning") {
-                const full = this.appendText(ctx, partId, text, "thinking", true);
-                if (full)
-                    out.push({ kind: "thinking_delta", text: full });
+                return out.concat(this.emitThinking(ctx, partId, text, true));
             }
             else {
                 const full = this.appendText(ctx, partId, text, "text", true);

package/dist/shared/events.d.ts

@@ -750,7 +750,7 @@ export interface WorkerToServerEvents {
         snapshot?: WorkspaceGitSnapshot;
         error?: string;
     }) => void;
-    /** Protocol 12+: commit, push, or checkout finished. */
+    /** Protocol 12+: commit, push, checkout, create, or discard finished. */
     "worker:workspace-git-action-result": (data: {
         requestId: string;
         ok?: boolean;
@@ -842,13 +842,16 @@ export interface ServerToWorkerEvents {
         repoPath: string;
         cwd?: string;
     }) => void;
-    /** Protocol 12+: commit, push, or switch the branch in a local repo. */
+    /** Protocol 12+: commit, push, switch, create, or discard in a local repo. */
     "worker:workspace-git-action": (data: {
         requestId: string;
         repoPath: string;
-        action: "commit" | "push" | "checkout";
+        action: "commit" | "push" | "checkout" | "create" | "discard";
         message?: string;
         branch?: string;
+        path?: string;
+        /** GitHub token for push/fetch; worker stores it in the machine credential helper. */
+        token?: string;
     }) => void;
     /** Protocol 11+: list a folder inside a local repo. */
     "worker:workspace-dir": (data: {

package/dist/shared/events.js

@@ -24,12 +24,10 @@ export function mergeChatMessage(prev, incoming) {
     }
     const kept = prev.thinking?.trim() ? prev.thinking : undefined;
     const nextThinking = incoming.thinking?.trim() ? incoming.thinking : undefined;
-    if (kept && (!nextThinking || kept.length > nextThinking.length)) {
-        next.thinking = kept;
-    }
-    else if (nextThinking) {
+    if (nextThinking)
         next.thinking = nextThinking;
-    }
+    else if (kept)
+        next.thinking = kept;
     return next;
 }
 /**

package/dist/shared/machines.d.ts

@@ -76,11 +76,15 @@ export interface MachineSetupTokenInfo {
     createdAt: number;
     createdBy: string;
 }
+export interface MachineSetupStep {
+    title: string;
+    command: string;
+}
 export interface MachineSetupCommands {
-    /** curl … | sh one-liner (installs the CLI, connects, installs a service). */
+    /** curl … | sh one-liner (installs agent CLIs + Eigen, connects, service). */
     script: string;
-    /** Manual: install the CLI, connect, start as a service. */
-    manual: string[];
+    /** Manual steps: PATH, agent CLIs, Eigen CLI, connect, service. */
+    manual: MachineSetupStep[];
     /** docker run … */
     docker: string;
 }

package/dist/shared/slashCommands.js

@@ -17,7 +17,7 @@ const STEER_COMMANDS = [
     },
     {
         name: "status",
-        description: "Show this agent's backend, model, run state, branch, and PR",
+        description: "Show this agent's backend, model, machine, clone path, branch, and PR",
         handledBy: "steer",
     },
     {

package/dist/shared/workspace.d.ts

@@ -25,6 +25,8 @@ export interface WorkspaceGitSnapshot {
 export declare function parseGitBranches(raw: string, current: string | null): string[];
 export declare function assertGitBranchName(raw: string): string;
 export declare function assertCommitMessage(raw: string): string;
+/** Repo-relative path from `git status --porcelain` (or an empty string to discard everything). */
+export declare function assertGitChangePath(raw: string): string;
 export interface WorkspaceRepoEntry {
     name: string;
     /** Repo-relative path. */

package/dist/shared/workspace.js

@@ -38,3 +38,16 @@ export function assertCommitMessage(raw) {
         throw new Error("Commit message is too long");
     return message;
 }
+/** Repo-relative path from `git status --porcelain` (or an empty string to discard everything). */
+export function assertGitChangePath(raw) {
+    const path = raw.trim().replace(/\\/g, "/").replace(/^"+|"+$/g, "");
+    if (!path)
+        return "";
+    if (path.length > 1_000 ||
+        path.startsWith("/") ||
+        path.includes("\0") ||
+        path.split("/").some((part) => part === "..")) {
+        throw new Error("Invalid path");
+    }
+    return path;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geteigen/cli",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "CLI worker for Eigen — run local Cursor/ Claude Code/Codex AI agents for multiplayer sessions",
   "type": "module",
   "bin": {