@getforgeai/cli 0.1.0-beta.4 → 0.1.0-beta.6

package/dist/cli.js

@@ -13,14 +13,14 @@ import { orgUnlinkAction } from "./commands/org-unlink.js";
 import { journalListAction } from "./commands/journal-list.js";
 import { journalClearAction } from "./commands/journal-clear.js";
 import { journalStatusAction } from "./commands/journal-status.js";
-import { configSetAgentTypeAction, configSetAgentSlotsAction, configSetOpenerAction, configGetAction, } from "./commands/config-set.js";
+import { configSetAgentTypeAction, configSetAgentSlotsAction, configSetModelsAction, configSetOpenerAction, configGetAction, } from "./commands/config-set.js";
 import { mcpServeAction } from "./commands/mcp-serve.js";
 import { releaseOpenAction } from "./commands/release-open.js";
 import { sessionRespondAction } from "./commands/session-respond.js";
 import { taskOpenAction } from "./commands/task-open.js";
 import { workflowOpenAction } from "./commands/workflow-open.js";
 import { vmInitAction, vmStatusAction, vmCleanupAction, vmStopAllAction, setupClaudeTokenAction, } from "./commands/vm.js";
-import { setupCodexAuthAction, setupOpenCodeAuthAction, } from "./commands/auth-setup-agent.js";
+import { setupCodexAuthAction, setupKiloAuthAction, setupOpenCodeAuthAction, } from "./commands/auth-setup-agent.js";
 const program = new Command();
 program
     .name("forge")
@@ -55,6 +55,10 @@ authCmd
     .command("setup-opencode")
     .description("Store OpenCode credentials (import opencode login or provider API key)")
     .action(() => setupOpenCodeAuthAction());
+authCmd
+    .command("setup-kilo")
+    .description("Store Kilo credentials (import kilo login or gateway API key)")
+    .action(() => setupKiloAuthAction());
 program
     .command("connect")
     .description("Connect to ForgeAI Cloud (spawns background daemon by default)")
@@ -123,8 +127,12 @@ const configSetCmd = configCmd
     .description("Set a configuration value");
 configSetCmd
     .command("agent-type <value>")
-    .description("Set agent type (CLAUDE_CODE, CODEX or OPENCODE)")
+    .description("Set agent type (CLAUDE_CODE, CODEX, OPENCODE or KILO)")
     .action((value) => configSetAgentTypeAction(value));
+configSetCmd
+    .command("models <engine> <models>")
+    .description("Declare the models usable on this device for an engine, comma-separated (first = default); 'none' clears")
+    .action((engine, models) => configSetModelsAction(engine, models));
 configSetCmd
     .command("agent-slots <value>")
     .description("Set agent slots (1-20)")

package/dist/commands/auth-setup-agent.d.ts

@@ -11,5 +11,6 @@
  * encrypted file elsewhere) and injected into agent containers at spawn.
  */
 export declare function setupCodexAuthAction(): Promise<void>;
+export declare function setupKiloAuthAction(): Promise<void>;
 export declare function setupOpenCodeAuthAction(): Promise<void>;
 //# sourceMappingURL=auth-setup-agent.d.ts.map

package/dist/commands/auth-setup-agent.js

@@ -59,6 +59,36 @@ export async function setupCodexAuthAction() {
         process.exit(1);
     }
 }
+export async function setupKiloAuthAction() {
+    try {
+        const imported = await tryImportHostAuthJson("KILO");
+        if (!imported) {
+            console.log(chalk.dim("No Kilo login found to import. You can paste a Kilo gateway API key instead\n" +
+                "(from your profile at app.kilo.ai — or run `kilo auth login` first, then\n" +
+                "re-run this command to import it)."));
+            const key = await ask("Kilo API key: ");
+            if (!key) {
+                console.error(chalk.red("No API key provided."));
+                process.exit(1);
+            }
+            await saveAgentAuth("KILO", {
+                kind: "api_key",
+                envVar: "KILO_API_KEY",
+                value: key,
+            });
+            console.log(chalk.green("Kilo API key stored. Agents can now authenticate."));
+        }
+        const model = await ask("Kilo model (e.g. kilo/anthropic/claude-sonnet-4.5) — leave empty for Kilo's default: ");
+        if (model) {
+            setConfig({ kiloModel: model });
+            console.log(chalk.green(`Kilo model set to ${model}.`));
+        }
+    }
+    catch (err) {
+        console.error(chalk.red(`Failed: ${err instanceof Error ? err.message : String(err)}`));
+        process.exit(1);
+    }
+}
 const OPENCODE_PROVIDER_ENV_VARS = {
     anthropic: "ANTHROPIC_API_KEY",
     openai: "OPENAI_API_KEY",

package/dist/commands/config-set.d.ts

@@ -1,4 +1,10 @@
 export declare function configSetAgentTypeAction(value: string): Promise<void>;
+/**
+ * forge config set models <engine> <m1,m2,...>
+ * Declares the models usable on this device for an engine (first = default).
+ * "none" clears the engine's list. Refused when the org locked the list.
+ */
+export declare function configSetModelsAction(engine: string, value: string): Promise<void>;
 export declare function configSetAgentSlotsAction(value: string): Promise<void>;
 export declare function configSetOpenerAction(value: string): void;
 export declare function configGetAction(): void;

package/dist/commands/config-set.js

@@ -7,6 +7,7 @@ const VALID_OPENERS = ["terminal", "vscode", "finder"];
 const AGENT_AUTH_SETUP_HINTS = {
     CODEX: "forge auth setup-codex",
     OPENCODE: "forge auth setup-opencode",
+    KILO: "forge auth setup-kilo",
 };
 export async function configSetAgentTypeAction(value) {
     const upper = value.toUpperCase();
@@ -23,6 +24,57 @@ export async function configSetAgentTypeAction(value) {
         console.log(chalk.dim(`Make sure credentials are configured: ${hint}`));
     }
 }
+/**
+ * forge config set models <engine> <m1,m2,...>
+ * Declares the models usable on this device for an engine (first = default).
+ * "none" clears the engine's list. Refused when the org locked the list.
+ */
+export async function configSetModelsAction(engine, value) {
+    const upper = engine.toUpperCase();
+    if (!isAgentType(upper)) {
+        console.error(chalk.red(`Invalid engine "${engine}". Allowed: ${AGENT_TYPE.join(", ")}`));
+        process.exitCode = 1;
+        return;
+    }
+    const config = getConfig();
+    const lockedByOrgs = config.modelsLockedByOrgs ?? [];
+    if (lockedByOrgs.length > 0) {
+        console.error(chalk.red(`The model list is locked by organization(s): ${lockedByOrgs.join(", ")} — edit it from their cockpit (Settings → CLI Devices).`));
+        process.exitCode = 1;
+        return;
+    }
+    const models = value.trim().toLowerCase() === "none"
+        ? []
+        : value
+            .split(",")
+            .map((m) => m.trim())
+            .filter(Boolean);
+    // Mirror the server-side AvailableModelsSchema bounds so an invalid list
+    // fails HERE instead of turning every register POST/PATCH into a 400.
+    if (models.length > 20) {
+        console.error(chalk.red("Too many models — 20 maximum per engine."));
+        process.exitCode = 1;
+        return;
+    }
+    const tooLong = models.find((m) => m.length > 120);
+    if (tooLong) {
+        console.error(chalk.red(`Model id too long (120 chars max): "${tooLong.slice(0, 40)}..."`));
+        process.exitCode = 1;
+        return;
+    }
+    const availableModels = { ...(config.availableModels ?? {}) };
+    if (models.length === 0) {
+        delete availableModels[upper];
+    }
+    else {
+        availableModels[upper] = models;
+    }
+    setConfig({ availableModels });
+    const applied = await tryReRegister();
+    console.log(chalk.green(models.length === 0
+        ? `Model list cleared for ${upper}. ${applied ? "(Applied immediately)" : "(Will apply on next connect)"}`
+        : `Models for ${upper}: ${models.join(", ")} (default: ${models[0]}). ${applied ? "(Applied immediately)" : "(Will apply on next connect)"}`));
+}
 export async function configSetAgentSlotsAction(value) {
     const num = Number.parseInt(value, 10);
     if (Number.isNaN(num) || num < 1 || num > 20) {
@@ -51,6 +103,20 @@ export function configGetAction() {
     if (config.agentType === "OPENCODE") {
         console.log(`  OpenCode model: ${config.opencodeModel ?? "(OpenCode default)"}`);
     }
+    if (config.agentType === "KILO") {
+        console.log(`  Kilo model:  ${config.kiloModel ?? "(Kilo default)"}`);
+    }
+    const declared = config.availableModels ?? {};
+    const declaredEntries = Object.entries(declared).filter(([, models]) => models.length > 0);
+    if (declaredEntries.length > 0) {
+        const lockNote = (config.modelsLockedByOrgs ?? []).length > 0
+            ? ` (locked by: ${(config.modelsLockedByOrgs ?? []).join(", ")})`
+            : "";
+        console.log(`  Declared models:${lockNote}`);
+        for (const [engine, models] of declaredEntries) {
+            console.log(`    ${engine}: ${models.join(", ")}`);
+        }
+    }
     console.log(`  Agent slots: ${config.agentSlots ?? 5}`);
     console.log(`  Opener:      ${config.opener ?? "terminal"}`);
     console.log(`  Server URL:  ${config.serverUrl}`);

package/dist/commands/connect.js

@@ -123,14 +123,14 @@ async function connectForeground(options) {
     if (!ctx)
         return;
     // Ensure agent credentials are available for container authentication
-    if (ctx.agentType === "CODEX" || ctx.agentType === "OPENCODE") {
+    if (ctx.agentType === "CODEX" ||
+        ctx.agentType === "OPENCODE" ||
+        ctx.agentType === "KILO") {
         try {
             const { hasAgentAuth } = await import("../vm/agent-auth-manager.js");
             if (!(await hasAgentAuth(ctx.agentType))) {
-                const setupCmd = ctx.agentType === "CODEX"
-                    ? "forge auth setup-codex"
-                    : "forge auth setup-opencode";
-                console.warn(chalk.yellow(`[connect] No ${ctx.agentType} credentials stored. Agents may fail to authenticate. Run: ${setupCmd}`));
+                const { getAgentProfile } = await import("../orchestrator/agent-profiles.js");
+                console.warn(chalk.yellow(`[connect] No ${ctx.agentType} credentials stored. Agents may fail to authenticate. Run: ${getAgentProfile(ctx.agentType).authSetupHint}`));
             }
         }
         catch {

package/dist/config/config-manager.d.ts

@@ -13,6 +13,21 @@ export type CliConfig = {
     agentType?: string;
     /** OpenCode model in "provider/model" form (used when agentType is OPENCODE). */
     opencodeModel?: string;
+    /** Kilo model, e.g. "kilo/anthropic/claude-sonnet-4.5" (used when agentType is KILO). */
+    kiloModel?: string;
+    /**
+     * Models the device owner declares usable, per engine. Advertised to the
+     * cockpit at registration; first entry = this device's default model for
+     * the engine. Server-owned (read-only here) when modelsLockedByServer.
+     */
+    availableModels?: Record<string, string[]>;
+    /**
+     * Slugs of the organizations that locked this device's model list from the
+     * cockpit. Enforcement is server-side per org (locked orgs ignore CLI-sent
+     * lists); locally this only gates `forge config set models` with a clear
+     * message. Per-org because one machine can serve several orgs.
+     */
+    modelsLockedByOrgs?: string[];
     agentSlots?: number;
     opener?: Opener;
     lastSyncCursor?: string;

package/dist/config/config-manager.js

@@ -53,6 +53,19 @@ export function clearSessionConfig() {
     if (config.agentSlots !== undefined) {
         cleaned.agentSlots = config.agentSlots;
     }
+    // Machine-level agent model settings survive logout too
+    if (config.opencodeModel !== undefined) {
+        cleaned.opencodeModel = config.opencodeModel;
+    }
+    if (config.kiloModel !== undefined) {
+        cleaned.kiloModel = config.kiloModel;
+    }
+    if (config.availableModels !== undefined) {
+        cleaned.availableModels = config.availableModels;
+    }
+    if (config.modelsLockedByOrgs !== undefined) {
+        cleaned.modelsLockedByOrgs = config.modelsLockedByOrgs;
+    }
     if (config.vmCpus !== undefined) {
         cleaned.vmCpus = config.vmCpus;
     }

package/dist/lib/connection-manager.js

@@ -235,6 +235,23 @@ export function establishConnections(ctx, append = false) {
                     console.log(chalk.green(`${prefix(org.orgSlug)}Agent type updated by server: ${previousType} → ${payload.agentType}`));
                 }
             }
+            // Server-pushed model governance (cockpit list edits + lock). The lock
+            // is tracked per org; the local availableModels stays the owner's
+            // declaration (a locked org enforces its own list server-side).
+            if (payload.modelsLocked !== undefined) {
+                const lockedByOrgs = new Set(getConfig().modelsLockedByOrgs ?? []);
+                if (payload.modelsLocked) {
+                    lockedByOrgs.add(org.orgSlug);
+                }
+                else {
+                    lockedByOrgs.delete(org.orgSlug);
+                }
+                setConfig({ modelsLockedByOrgs: Array.from(lockedByOrgs) });
+            }
+            if (payload.availableModels !== undefined ||
+                payload.modelsLocked !== undefined) {
+                console.log(chalk.green(`${prefix(org.orgSlug)}Model governance updated by this organization${payload.modelsLocked ? " (list locked — its cockpit owns it there)" : ""}`));
+            }
             if (payload.agentSlots != null && payload.agentSlots !== ctx.agentSlots) {
                 const previous = ctx.agentSlots;
                 ctx.agentSlots = payload.agentSlots;
@@ -281,8 +298,29 @@ export function establishConnections(ctx, append = false) {
                     name: ctx.cliName,
                     agentType: ctx.agentType,
                     agentSlots: ctx.agentSlots,
+                    availableModels: getConfig().availableModels,
                 });
                 console.log(chalk.green(`${prefix(org.orgSlug)}CLI registered as "${ctx.cliName}"`));
+                // Lock state is tracked PER ORG (one machine can serve several orgs;
+                // org B must not clear org A's lock, and org A's restricted list must
+                // not overwrite the owner's local declaration — enforcement is
+                // server-side per org: a locked org ignores CLI-sent lists anyway).
+                {
+                    const lockedByOrgs = new Set(getConfig().modelsLockedByOrgs ?? []);
+                    const wasLocked = lockedByOrgs.has(org.orgSlug);
+                    if (device.modelsLocked) {
+                        lockedByOrgs.add(org.orgSlug);
+                    }
+                    else {
+                        lockedByOrgs.delete(org.orgSlug);
+                    }
+                    if (wasLocked !== Boolean(device.modelsLocked)) {
+                        setConfig({ modelsLockedByOrgs: Array.from(lockedByOrgs) });
+                        if (device.modelsLocked) {
+                            console.log(chalk.dim(`${prefix(org.orgSlug)}Model list is locked by this organization — its cockpit owns the list there`));
+                        }
+                    }
+                }
                 // The server is source of truth for agentType after first registration
                 // (a cockpit edit made while this CLI was offline must survive the
                 // reconnect). Adopt the returned value.

package/dist/lib/daemon-entry.js

@@ -18,14 +18,14 @@ if (!ctx) {
 }
 // Check agent credential availability for the configured engine
 try {
-    if (ctx.agentType === "CODEX" || ctx.agentType === "OPENCODE") {
+    if (ctx.agentType === "CODEX" ||
+        ctx.agentType === "OPENCODE" ||
+        ctx.agentType === "KILO") {
         const { hasAgentAuth } = await import("../vm/agent-auth-manager.js");
         if (!(await hasAgentAuth(ctx.agentType))) {
-            const setupCmd = ctx.agentType === "CODEX"
-                ? "forge auth setup-codex"
-                : "forge auth setup-opencode";
+            const { getAgentProfile } = await import("../orchestrator/agent-profiles.js");
             console.warn(chalk.yellow(`[daemon] No ${ctx.agentType} credentials stored — agents will fail to authenticate.`));
-            console.warn(chalk.yellow(`[daemon] Run: ${setupCmd}`));
+            console.warn(chalk.yellow(`[daemon] Run: ${getAgentProfile(ctx.agentType).authSetupHint}`));
         }
     }
     else {
@@ -179,6 +179,7 @@ async function handleReRegisterCommand() {
                 name: ctx.cliName,
                 agentType: ctx.agentType,
                 agentSlots: ctx.agentSlots,
+                availableModels: (await import("../config/config-manager.js")).getConfig().availableModels,
             });
         }
         catch {

package/dist/lib/rest-client.d.ts

@@ -9,6 +9,8 @@ type RegisterCliRequest = {
     name?: string;
     agentType?: string;
     agentSlots?: number;
+    /** Declared usable models per engine (ignored server-side when locked). */
+    availableModels?: Record<string, string[]>;
 };
 type RegisterCliResponse = {
     id: string;
@@ -17,6 +19,8 @@ type RegisterCliResponse = {
     memberId: string;
     agentType: string;
     agentSlots: number;
+    availableModels?: Record<string, string[]> | null;
+    modelsLocked?: boolean;
     createdAt: string;
 };
 type CliDeviceItem = {
@@ -54,6 +58,8 @@ type UpdateCliConfigRequest = {
     name?: string;
     agentType?: string;
     agentSlots?: number;
+    /** Declared usable models per engine (ignored server-side when locked). */
+    availableModels?: Record<string, string[]>;
 };
 type TaskDetail = {
     id: string;

package/dist/orchestrator/agent-profiles.d.ts

@@ -9,6 +9,10 @@
  * | CLAUDE_CODE | claude     | /session/workspace/.claude/mcp_config.json (via --mcp-config) | --continue |
  * | CODEX       | codex      | /home/agent/.codex/config.toml           | exec resume --last |
  * | OPENCODE    | opencode   | /home/agent/.config/opencode/opencode.json | run --continue |
+ * | KILO        | kilo       | /home/agent/.config/kilo/kilo.json       | run --continue |
+ *
+ * KILO (kilo.ai) is an OpenCode fork: same config shape, same JSONL event
+ * stream (so it shares OpenCodeJsonlExtractor), Kilo gateway auth on top.
  */
 import type { AgentType } from "@getforgeai/protocol";
 import type { AgentStreamExtractor, QuestionData, ToolActivityData, TokenUsageData } from "./stream-json-extractor.js";
@@ -18,9 +22,32 @@ export type McpBridgeConfig = {
     token: string;
 };
 export type AgentConfigOptions = {
-    /** OpenCode model in "provider/model" form (from CLI config, optional). */
+    /**
+     * Model id, engine-specific:
+     * Claude Code: alias (sonnet/opus/haiku/fable) or full id.
+     * Codex: bare slug (e.g. "gpt-5.5").
+     * OpenCode: "provider/model" (e.g. "anthropic/claude-sonnet-4-5").
+     * Kilo: "kilo/<vendor>/<model>" (e.g. "kilo/anthropic/claude-sonnet-4.5").
+     */
     model?: string;
+    /**
+     * Generic reasoning effort (EFFORT_LEVELS: low|medium|high|max), mapped per
+     * engine: Claude --effort as-is; Codex model_reasoning_effort (max→xhigh);
+     * OpenCode/Kilo --variant clamped per model vendor (mapEffortToVariant).
+     */
+    effort?: string;
 };
+/**
+ * Map the generic effort scale onto an OpenCode/Kilo model variant for the
+ * given vendor. Variants are vendor catalogs: OpenAI none…xhigh, Anthropic
+ * high/max, Google low/high. Unknown vendor → undefined (omit --variant
+ * rather than risk a server-side unknown-variant error).
+ */
+export declare function mapEffortToVariant(vendor: string | undefined, effort: string | undefined): string | undefined;
+/** Vendor of an OpenCode model id ("vendor/model") for variant mapping. */
+export declare function openCodeModelVendor(model: string | undefined): string | undefined;
+/** Vendor of a Kilo model id ("kilo/vendor/model") for variant mapping. */
+export declare function kiloModelVendor(model: string | undefined): string | undefined;
 export type AgentAuthErrorPatterns = {
     /** Substrings matched against stderr only (avoids stdout false positives). */
     stderr: string[];
@@ -40,9 +67,9 @@ export type AgentProfile = {
     /** Build the agent config file content (JSON or TOML depending on engine). */
     buildConfig(mcp: McpBridgeConfig, opts?: AgentConfigOptions): string;
     /** argv for a fresh non-interactive run. */
-    buildArgs(prompt: string): string[];
+    buildArgs(prompt: string, opts?: AgentConfigOptions): string[];
     /** argv to continue the latest on-disk session in the same home dir. */
-    buildContinueArgs(prompt: string): string[];
+    buildContinueArgs(prompt: string, opts?: AgentConfigOptions): string[];
     /** Non-secret env vars added to every agent spawn. */
     spawnEnv: Record<string, string>;
     /**

package/dist/orchestrator/agent-profiles.js

@@ -9,11 +9,46 @@
  * | CLAUDE_CODE | claude     | /session/workspace/.claude/mcp_config.json (via --mcp-config) | --continue |
  * | CODEX       | codex      | /home/agent/.codex/config.toml           | exec resume --last |
  * | OPENCODE    | opencode   | /home/agent/.config/opencode/opencode.json | run --continue |
+ * | KILO        | kilo       | /home/agent/.config/kilo/kilo.json       | run --continue |
+ *
+ * KILO (kilo.ai) is an OpenCode fork: same config shape, same JSONL event
+ * stream (so it shares OpenCodeJsonlExtractor), Kilo gateway auth on top.
  */
 import { DEFAULT_AGENT_TYPE, isAgentType } from "@getforgeai/protocol";
 import { CodexJsonlExtractor } from "./codex-jsonl-extractor.js";
 import { OpenCodeJsonlExtractor } from "./opencode-jsonl-extractor.js";
 import { StreamJsonExtractor } from "./stream-json-extractor.js";
+/**
+ * Map the generic effort scale onto an OpenCode/Kilo model variant for the
+ * given vendor. Variants are vendor catalogs: OpenAI none…xhigh, Anthropic
+ * high/max, Google low/high. Unknown vendor → undefined (omit --variant
+ * rather than risk a server-side unknown-variant error).
+ */
+export function mapEffortToVariant(vendor, effort) {
+    if (!effort)
+        return undefined;
+    switch (vendor) {
+        case "openai":
+            return { low: "low", medium: "medium", high: "high", max: "xhigh" }[effort];
+        case "anthropic":
+            return { low: "high", medium: "high", high: "high", max: "max" }[effort];
+        case "google":
+            return { low: "low", medium: "low", high: "high", max: "high" }[effort];
+        default:
+            return undefined;
+    }
+}
+/** Vendor of an OpenCode model id ("vendor/model") for variant mapping. */
+export function openCodeModelVendor(model) {
+    return model?.split("/")[0] || undefined;
+}
+/** Vendor of a Kilo model id ("kilo/vendor/model") for variant mapping. */
+export function kiloModelVendor(model) {
+    if (!model)
+        return undefined;
+    const parts = model.split("/");
+    return parts[0] === "kilo" ? parts[1] || undefined : parts[0] || undefined;
+}
 /** Narrow an arbitrary config/dispatch string to a supported AgentType. */
 export function resolveAgentType(value) {
     if (value && isAgentType(value))
@@ -56,11 +91,14 @@ const claudeProfile = {
             },
         }, null, 2);
     },
-    buildArgs(prompt) {
+    buildArgs(prompt, opts) {
         return [
             "--dangerously-skip-permissions",
             "--mcp-config",
             CLAUDE_MCP_CONFIG_PATH,
+            // Model alias/id and generic effort map 1:1 onto Claude Code flags
+            ...(opts?.model ? ["--model", opts.model] : []),
+            ...(opts?.effort ? ["--effort", opts.effort] : []),
             "-p",
             prompt,
             "--output-format",
@@ -69,8 +107,8 @@ const claudeProfile = {
             "--include-partial-messages",
         ];
     },
-    buildContinueArgs(prompt) {
-        return ["--continue", ...this.buildArgs(prompt)];
+    buildContinueArgs(prompt, opts) {
+        return ["--continue", ...this.buildArgs(prompt, opts)];
     },
     spawnEnv: {},
     nativeSkillDiscovery: true,
@@ -106,12 +144,17 @@ const codexProfile = {
     type: "CODEX",
     binary: "codex",
     configTargetPath: "/home/agent/.codex/config.toml",
-    buildConfig(mcp) {
+    buildConfig(mcp, opts) {
+        // Codex reads model/effort from config.toml (regenerated per container,
+        // excluded from snapshots). Generic "max" maps to Codex's "xhigh".
+        const effort = opts?.effort === "max" ? "xhigh" : (opts?.effort ?? undefined);
         return [
             "# Generated by ForgeAI — do not edit",
             "# The Docker container is the security boundary; Codex's own sandbox is disabled.",
             'approval_policy = "never"',
             'sandbox_mode = "danger-full-access"',
+            ...(opts?.model ? [`model = ${tomlString(opts.model)}`] : []),
+            ...(effort ? [`model_reasoning_effort = ${tomlString(effort)}`] : []),
             "",
             "[mcp_servers.forgeai]",
             'command = "node"',
@@ -200,11 +243,26 @@ const openCodeProfile = {
             },
         }, null, 2);
     },
-    buildArgs(prompt) {
-        return ["run", "--format", "json", prompt];
+    buildArgs(prompt, opts) {
+        const variant = mapEffortToVariant(openCodeModelVendor(opts?.model), opts?.effort);
+        return [
+            "run",
+            ...(variant ? ["--variant", variant] : []),
+            "--format",
+            "json",
+            prompt,
+        ];
     },
-    buildContinueArgs(prompt) {
-        return ["run", "--continue", "--format", "json", prompt];
+    buildContinueArgs(prompt, opts) {
+        const variant = mapEffortToVariant(openCodeModelVendor(opts?.model), opts?.effort);
+        return [
+            "run",
+            "--continue",
+            ...(variant ? ["--variant", variant] : []),
+            "--format",
+            "json",
+            prompt,
+        ];
     },
     spawnEnv: { OPENCODE_PERMISSION: OPENCODE_PERMISSION_JSON },
     // OpenCode reads .claude/skills natively (OPENCODE_DISABLE_CLAUDE_CODE_SKILLS opts out)
@@ -224,12 +282,105 @@ const openCodeProfile = {
     authSetupHint: "forge auth setup-opencode",
 };
 // ---------------------------------------------------------------------------
+// Kilo (kilo.ai — OpenCode fork with the Kilo gateway on top)
+// ---------------------------------------------------------------------------
+/**
+ * Permission override merged over any config (KILO_PERMISSION env is merged
+ * over file config), so a repo-level kilo.json can never re-introduce "ask"
+ * prompts. Belt to the --auto flag's suspenders.
+ */
+const KILO_PERMISSION_JSON = JSON.stringify({
+    "*": "allow",
+    external_directory: { "**": "allow" },
+});
+const kiloProfile = {
+    type: "KILO",
+    binary: "kilo",
+    configTargetPath: "/home/agent/.config/kilo/kilo.json",
+    buildConfig(mcp, opts) {
+        return JSON.stringify({
+            $schema: "https://app.kilo.ai/config.json",
+            ...(opts?.model ? { model: opts.model } : {}),
+            permission: {
+                "*": "allow",
+                external_directory: { "**": "allow" },
+            },
+            // Headless container hygiene: no auto-upgrade, no product telemetry
+            autoupdate: false,
+            experimental: { openTelemetry: false },
+            mcp: {
+                forgeai: {
+                    type: "local",
+                    command: ["node", "/session/forge-mcp-relay.mjs"],
+                    environment: {
+                        FORGEAI_MCP_HOST: mcp.host,
+                        FORGEAI_MCP_PORT: String(mcp.port),
+                        FORGEAI_MCP_TOKEN: mcp.token,
+                    },
+                    enabled: true,
+                },
+            },
+        }, null, 2);
+    },
+    buildArgs(prompt, opts) {
+        // --auto: auto-approve permissions (headless runs REJECT asks otherwise).
+        // Spawn must close stdin: with a non-TTY open stdin, `kilo run` blocks
+        // reading it to EOF before sending the prompt (Bun.stdin.text()).
+        const variant = mapEffortToVariant(kiloModelVendor(opts?.model), opts?.effort);
+        return [
+            "run",
+            "--auto",
+            ...(variant ? ["--variant", variant] : []),
+            "--format",
+            "json",
+            prompt,
+        ];
+    },
+    buildContinueArgs(prompt, opts) {
+        const variant = mapEffortToVariant(kiloModelVendor(opts?.model), opts?.effort);
+        return [
+            "run",
+            "--continue",
+            "--auto",
+            ...(variant ? ["--variant", variant] : []),
+            "--format",
+            "json",
+            prompt,
+        ];
+    },
+    spawnEnv: {
+        KILO_PERMISSION: KILO_PERMISSION_JSON,
+        KILO_DISABLE_AUTOUPDATE: "1",
+        KILO_TELEMETRY_LEVEL: "off",
+    },
+    // Kilo scans .claude/skills/**/SKILL.md natively (OpenCode heritage)
+    nativeSkillDiscovery: true,
+    // Sessions live in SQLite (kilo.db + -wal/-shm) keyed to the project dir
+    stateDir: "/home/agent/.local/share/kilo",
+    snapshotExcludes: ["auth.json", "mcp-auth.json", "log", "repos", "bin"],
+    authErrorPatterns: {
+        // Kilo surfaces auth failures as error events from the gateway/provider —
+        // it never prints "Not logged in" on the run path, and env-var names in
+        // the stdout tail would be tool-output false positives (ForgeAI itself
+        // injects KILO_API_KEY). Keep only API-error-shaped tokens.
+        stderr: [],
+        combined: [
+            '"authentication_error"',
+            "invalid_api_key",
+            "Incorrect API key",
+            "AuthError",
+        ],
+    },
+    authSetupHint: "forge auth setup-kilo",
+};
+// ---------------------------------------------------------------------------
 // Registry
 // ---------------------------------------------------------------------------
 const PROFILES = {
     CLAUDE_CODE: claudeProfile,
     CODEX: codexProfile,
     OPENCODE: openCodeProfile,
+    KILO: kiloProfile,
 };
 export function getAgentProfile(agentType) {
     return PROFILES[resolveAgentType(agentType)];
@@ -245,6 +396,9 @@ export function createStreamExtractor(agentType, onText, onQuestion, onToolActiv
         case "CODEX":
             return new CodexJsonlExtractor(onText, onQuestion, onToolActivity, onTokenUsage, sessionId);
         case "OPENCODE":
+        // Kilo is an OpenCode fork emitting the same JSONL event stream
+        // (text/tool_use/step_start/step_finish/error with sessionID + part).
+        case "KILO":
             return new OpenCodeJsonlExtractor(onText, onQuestion, onToolActivity, onTokenUsage, sessionId);
         default:
             return new StreamJsonExtractor(onText, onQuestion, onToolActivity, onTokenUsage, sessionId);

package/dist/orchestrator/agent-spawner.d.ts

@@ -30,6 +30,10 @@ export declare const TaskDispatchSchema: z.ZodObject<{
     projectSlug: z.ZodOptional<z.ZodString>;
     repoUrl: z.ZodOptional<z.ZodString>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    modelConfig: z.ZodOptional<z.ZodObject<{
+        model: z.ZodOptional<z.ZodString>;
+        effort: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type DispatchParams = z.infer<typeof TaskDispatchSchema> & {
     orgId: string;

package/dist/orchestrator/agent-spawner.js

@@ -68,6 +68,13 @@ export const TaskDispatchSchema = z.object({
     projectSlug: z.string().optional(),
     repoUrl: z.string().optional(),
     metadata: z.record(z.string(), z.unknown()).optional(),
+    /** Cloud-resolved model/effort for this dispatch (ResolvedModelConfig). */
+    modelConfig: z
+        .object({
+        model: z.string().optional(),
+        effort: z.string().optional(),
+    })
+        .optional(),
 });
 let registry = null;
 function getRegistry(agentSlots) {
@@ -641,6 +648,7 @@ export async function spawnAgent(params, ctx) {
             skillName: skill?.name ?? skillName,
             prompt: params.taskCommand,
             agentType: ctx.agentType,
+            modelConfig: params.modelConfig,
             repoUrl: params.repoUrl,
             taskBranch,
             workflowBaseBranch: params.workflowBaseBranch,
@@ -1010,6 +1018,7 @@ async function spawnWorkflowStepAgent(params, ctx) {
             skillName: skill?.name ?? skillName,
             prompt,
             agentType: ctx.agentType,
+            modelConfig: params.modelConfig,
             repoUrl: params.repoUrl,
             taskBranch: params.baseBranch,
             workflowBaseBranch: params.sourceBranch,
@@ -1278,6 +1287,7 @@ async function resumeWorkflowStepAgent(agentId, userMessage, lastAssistantConten
             skillName: DEFAULT_SKILL_NAME,
             prompt: userMessage,
             agentType: ctx.agentType,
+            modelConfig: originalParams.modelConfig,
             repoUrl: originalParams.repoUrl,
             taskBranch: originalParams.baseBranch,
             workflowBaseBranch: originalParams.sourceBranch,
@@ -1446,6 +1456,7 @@ export function registerWorkflowStepDispatchHandler(socket, orgId, ctx) {
             sourceBranch: data.sourceBranch,
             conversationHistory: data.conversationHistory,
             hasSnapshot: data.hasSnapshot,
+            modelConfig: data.modelConfig,
         }, ctx).catch((err) => {
             try {
                 vmLog.error("workflow-dispatch", `Failed to spawn agent for step ${data.stepId}: ${err instanceof Error ? err.message : String(err)}`);

package/dist/orchestrator/connectors/connector.d.ts

@@ -27,6 +27,14 @@ export type SpawnParams = {
     prompt?: string;
     /** Agent engine to run (AGENT_TYPE) — defaults to CLAUDE_CODE. */
     agentType?: string;
+    /**
+     * Cloud-resolved model/effort for this dispatch (column -> project -> org).
+     * Absent → the device's local default model applies.
+     */
+    modelConfig?: {
+        model?: string;
+        effort?: string;
+    };
 };
 /**
  * Extended spawn params for VM connector — includes repo/branch/skill context

package/dist/orchestrator/connectors/docker-connector.js

@@ -39,8 +39,26 @@ async function resolveMcpRelayHost() {
  * and authenticates to the bridge with the per-session secret.
  * Format and install path depend on the agent engine (see agent-profiles.ts).
  */
-function buildAgentConfig(profile, sessionIndex, mcpSecret, mcpHost) {
-    return profile.buildConfig({ host: mcpHost, port: 20000 + sessionIndex, token: mcpSecret }, { model: getConfig().opencodeModel });
+/**
+ * Effective model/effort for a spawn: the cloud-resolved dispatch config wins,
+ * else the device's local default (first declared model for the engine, with
+ * the legacy per-engine model settings as fallback).
+ */
+function resolveEffectiveModelConfig(profile, dispatch) {
+    const cliConfig = getConfig();
+    const declared = cliConfig.availableModels?.[profile.type];
+    const legacyDefault = profile.type === "KILO"
+        ? cliConfig.kiloModel
+        : profile.type === "OPENCODE"
+            ? cliConfig.opencodeModel
+            : undefined;
+    return {
+        model: dispatch?.model ?? declared?.[0] ?? legacyDefault,
+        effort: dispatch?.effort,
+    };
+}
+function buildAgentConfig(profile, sessionIndex, mcpSecret, mcpHost, modelOpts) {
+    return profile.buildConfig({ host: mcpHost, port: 20000 + sessionIndex, token: mcpSecret }, modelOpts);
 }
 /**
  * Bash script installing the staged config + context files into the container.
@@ -141,9 +159,13 @@ export const dockerConnector = {
                     });
                 }
             }
+            // Effective model/effort: dispatch-resolved wins, else device default.
+            // Pinned on the session so same-container resumes stay consistent.
+            const modelOpts = resolveEffectiveModelConfig(profile, params.modelConfig);
+            session.modelConfig = modelOpts;
             sm.prepareWorkspace(sessionId, {
                 contextJson: JSON.stringify(params.taskContext ?? {}, null, 2),
-                mcpConfigJson: buildAgentConfig(profile, session.sessionIndex, session.mcpSecret, await resolveMcpRelayHost()),
+                mcpConfigJson: buildAgentConfig(profile, session.sessionIndex, session.mcpSecret, await resolveMcpRelayHost(), modelOpts),
                 skillFiles,
             });
             // 5. Copy workspace files from volume mount into place inside container
@@ -173,7 +195,7 @@ export const dockerConnector = {
             const prompt = params.prompt
                 ? appendSkillPointer(params.prompt, profile, params.skill?.name)
                 : buildDefaultPrompt(params.skillName);
-            const agentArgs = profile.buildArgs(prompt);
+            const agentArgs = profile.buildArgs(prompt, modelOpts);
             const env = {};
             vmLog.magenta("docker-connector", `Spawning ${profile.type} agent in container ${sessionId}`, sessionId);
             const proxy = await sm.spawnAgent(params.taskId, profile.binary, agentArgs, env, profile.type);
@@ -230,12 +252,17 @@ export const dockerConnector = {
             vmLog.cyan("docker-connector", `Resuming ${profile.type} in existing container ${session.id}`, session.id);
             // Restart MCP bridge (stopped on previous agent exit)
             await startSessionMcpBridge(session, params);
+            // Session continuity: reuse the model/effort the session was
+            // provisioned with (config file was generated for it) — a mid-session
+            // demand change applies from the next fresh container.
+            const modelOpts = session.modelConfig ??
+                resolveEffectiveModelConfig(profile, params.modelConfig);
             // Continue the on-disk session for workflow resume in the existing
             // container (full context)
             if (params.workflowContext) {
                 const continuePrompt = params.prompt ??
                     "Continue your work from where you left off. Do not repeat completed work.";
-                const agentArgs = profile.buildContinueArgs(continuePrompt);
+                const agentArgs = profile.buildContinueArgs(continuePrompt, modelOpts);
                 const proxy = await sm.spawnAgent(params.taskId, profile.binary, agentArgs, {}, profile.type);
                 // Keep container alive for next idle window cycle
                 proxy.once("exit", () => {
@@ -251,7 +278,7 @@ export const dockerConnector = {
             // Board task resume: continue with user's answer (container alive from ask-human)
             const resumePrompt = ctx?.response ?? "Continue your work.";
             await startSessionMcpBridge(session, params);
-            const agentArgs = profile.buildContinueArgs(resumePrompt);
+            const agentArgs = profile.buildContinueArgs(resumePrompt, modelOpts);
             const proxy = await sm.spawnAgent(params.taskId, profile.binary, agentArgs, {}, profile.type);
             return {
                 pid: proxy.pid,
@@ -297,9 +324,13 @@ export const dockerConnector = {
                     });
                 }
             }
+            // Fresh container: the current demand applies (dispatch-resolved or
+            // device default), pinned for subsequent same-container resumes.
+            const modelOpts = resolveEffectiveModelConfig(profile, params.modelConfig);
+            session.modelConfig = modelOpts;
             sm.prepareWorkspace(sessionId, {
                 contextJson: JSON.stringify(params.taskContext ?? {}, null, 2),
-                mcpConfigJson: buildAgentConfig(profile, session.sessionIndex, session.mcpSecret, await resolveMcpRelayHost()),
+                mcpConfigJson: buildAgentConfig(profile, session.sessionIndex, session.mcpSecret, await resolveMcpRelayHost(), modelOpts),
                 skillFiles,
             });
             await sm.exec(params.taskId, "bash", [
@@ -329,14 +360,14 @@ export const dockerConnector = {
                 vmLog.cyan("docker-connector", `Spawning ${profile.type} continue (snapshot restored) in ${sessionId}`, sessionId);
                 const continuePrompt = params.prompt ??
                     "Continue your work from where you left off. Do not repeat completed work.";
-                proxy = await sm.spawnAgent(params.taskId, profile.binary, profile.buildContinueArgs(continuePrompt), {}, profile.type);
+                proxy = await sm.spawnAgent(params.taskId, profile.binary, profile.buildContinueArgs(continuePrompt, modelOpts), {}, profile.type);
             }
             else {
                 vmLog.warn("docker-connector", `Snapshot restore failed — falling back to prompt in ${sessionId}`, sessionId);
                 const prompt = params.prompt
                     ? appendSkillPointer(params.prompt, profile, params.skill?.name)
                     : buildDefaultPrompt(params.skillName);
-                proxy = await sm.spawnAgent(params.taskId, profile.binary, profile.buildArgs(prompt), {}, profile.type);
+                proxy = await sm.spawnAgent(params.taskId, profile.binary, profile.buildArgs(prompt, modelOpts), {}, profile.type);
             }
             // Workflow: keep container alive for idle window
             proxy.once("exit", () => {

package/dist/orchestrator/resume-handler.d.ts

@@ -16,6 +16,11 @@ export type ResumePayload = {
     projectSlug?: string;
     taskBranch?: string;
     repoUrl?: string;
+    /** Cloud-resolved model/effort for this resume dispatch. */
+    modelConfig?: {
+        model?: string;
+        effort?: string;
+    };
 };
 export type ResumeContext = {
     restClient: ReturnType<typeof createRestClient>;

package/dist/orchestrator/resume-handler.js

@@ -28,6 +28,13 @@ function enqueueWhenNoCapacity(payload, ctx) {
             orgId: payload.orgId,
             taskSlug: payload.taskSlug,
             projectSlug: payload.projectSlug,
+            skillSlug: payload.skillSlug,
+            taskCommand: payload.taskCommand,
+            repoUrl: payload.repoUrl,
+            taskBranch: payload.taskBranch,
+            // Keep the cloud-resolved model/effort — a queued resume must not
+            // respawn with the device's local default instead of the demand.
+            modelConfig: payload.modelConfig,
         });
     }
     ctx.socketClient.emitAgentStatus({
@@ -106,6 +113,7 @@ export async function handleResume(payload, ctx) {
             skillName: skill?.name ?? resumeSkillName,
             prompt: validatedPayload.taskCommand,
             agentType: ctx.agentType,
+            modelConfig: validatedPayload.modelConfig,
             repoUrl: payload.repoUrl,
             taskBranch,
             skill: skill ? { name: skill.name, files: skill.files } : undefined,

package/dist/vm/agent-auth-manager.d.ts

@@ -13,7 +13,7 @@
  * Storage: macOS Keychain / encrypted file via secure-store.ts. The payload
  * is stored as a JSON string.
  */
-export type AuthAgent = "CODEX" | "OPENCODE";
+export type AuthAgent = "CODEX" | "OPENCODE" | "KILO";
 export type AgentAuthPayload = {
     kind: "api_key";
     value: string;

package/dist/vm/agent-auth-manager.js

@@ -30,17 +30,29 @@ const STORE_LOCATIONS = {
         fileName: "opencode-auth.json",
         fileSalt: "forgeai-opencode-auth-salt",
     },
+    KILO: {
+        keychainService: "ForgeAI-kilo-auth",
+        keychainAccount: "kilo-auth",
+        fileName: "kilo-auth.json",
+        fileSalt: "forgeai-kilo-auth-salt",
+    },
 };
 /** Container path where each engine expects its auth.json. */
 export const AGENT_AUTH_JSON_PATHS = {
     CODEX: "/home/agent/.codex/auth.json",
     OPENCODE: "/home/agent/.local/share/opencode/auth.json",
+    KILO: "/home/agent/.local/share/kilo/auth.json",
 };
 /** Host path each engine's own CLI stores its auth.json at (for import). */
 export function getHostAuthJsonPath(agent) {
-    return agent === "CODEX"
-        ? join(homedir(), ".codex", "auth.json")
-        : join(homedir(), ".local", "share", "opencode", "auth.json");
+    switch (agent) {
+        case "CODEX":
+            return join(homedir(), ".codex", "auth.json");
+        case "OPENCODE":
+            return join(homedir(), ".local", "share", "opencode", "auth.json");
+        case "KILO":
+            return join(homedir(), ".local", "share", "kilo", "auth.json");
+    }
 }
 export async function saveAgentAuth(agent, payload) {
     await saveSecret(STORE_LOCATIONS[agent], JSON.stringify(payload));

package/dist/vm/session-manager.d.ts

@@ -39,6 +39,15 @@ export type SessionState = {
      * in the meantime.
      */
     agentType?: string;
+    /**
+     * Model/effort the container was provisioned with (its config file was
+     * generated for them). Same-container resumes reuse it for continuity; a
+     * demand change applies from the next fresh container.
+     */
+    modelConfig?: {
+        model?: string;
+        effort?: string;
+    };
     /**
      * Git credential for this session's repo, resolved from the host credential
      * helper at clone time. Kept in memory only (never written to disk or

package/dist/vm/session-manager.js

@@ -318,6 +318,11 @@ export class SessionManager {
             secretEnv: await this.getAgentSecretEnv(resolveAgentType(agentType)),
             user: "agent",
         });
+        // Agents run one-shot and never receive stdin input. Close it so engines
+        // that read piped stdin to EOF before acting (OpenCode and Kilo both
+        // concatenate non-TTY stdin into the prompt via Bun.stdin.text()) don't
+        // block forever on the open docker-exec pipe.
+        dockerExecProcess.stdin?.end();
         // Create a kill function that removes the container when the process exits
         const killFn = async (signal) => {
             try {
@@ -359,6 +364,13 @@ export class SessionManager {
                 return { [auth.envVar ?? "ANTHROPIC_API_KEY"]: auth.value };
             }
         }
+        if (agentType === "KILO") {
+            const auth = await this.getAgentAuth("KILO");
+            if (auth.kind === "api_key") {
+                // Kilo gateway key (app.kilo.ai profile) — read at request time
+                return { [auth.envVar ?? "KILO_API_KEY"]: auth.value };
+            }
+        }
         return {};
     }
     /** Load (and cache) stored Codex/OpenCode credentials, or throw with a fix hint. */
@@ -494,7 +506,9 @@ export class SessionManager {
      */
     async refreshToken(agentType = "CLAUDE_CODE") {
         const resolved = resolveAgentType(agentType);
-        if (resolved === "CODEX" || resolved === "OPENCODE") {
+        if (resolved === "CODEX" ||
+            resolved === "OPENCODE" ||
+            resolved === "KILO") {
             const previous = this.agentAuthCache[resolved];
             delete this.agentAuthCache[resolved];
             const fresh = await loadAgentAuth(resolved);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getforgeai/cli",
-  "version": "0.1.0-beta.4",
+  "version": "0.1.0-beta.6",
   "description": "ForgeAI CLI — runs AI coding agents in local Docker containers with your own AI tokens, and connects them to the ForgeAI cockpit.",
   "license": "Apache-2.0",
   "type": "module",
@@ -47,7 +47,7 @@
     "ora": "^8.2.0",
     "socket.io-client": "^4.8.3",
     "zod": "^4.3.6",
-    "@getforgeai/protocol": "0.1.0-beta.2"
+    "@getforgeai/protocol": "0.1.0-beta.4"
   },
   "devDependencies": {
     "@types/node": "^25.0.2",

package/rootfs/Dockerfile

@@ -6,23 +6,25 @@ ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update -qq && \
     apt-get install -y -qq --no-install-recommends \
       ca-certificates curl git openssh-client build-essential \
-      python3 procps less sudo gnupg && \
+      python3 procps less sudo gnupg passwd xz-utils && \
     rm -rf /var/lib/apt/lists/*
 
-# Node.js 20 LTS via NodeSource
-RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | \
-      gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg && \
-    echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | \
-      tee /etc/apt/sources.list.d/nodesource.list && \
-    apt-get update -qq && \
-    apt-get install -y -qq nodejs && \
-    rm -rf /var/lib/apt/lists/*
+# Node.js 20 LTS from the official nodejs.org tarball — pinned version, no
+# NodeSource apt repo (which intermittently 403s and breaks builds).
+ARG TARGETARCH=arm64
+ARG NODE_VERSION=20.20.2
+RUN NODE_ARCH=$([ "$TARGETARCH" = "amd64" ] && echo "x64" || echo "$TARGETARCH") && \
+    curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" | \
+      tar -xJ -C /usr/local --strip-components=1 && \
+    node --version && npm --version
 
-# Agent CLIs: Claude Code (primary), Codex and OpenCode (alternative engines).
+# Agent CLIs: Claude Code (primary), Codex, OpenCode and Kilo (alternative engines).
 # No output pipe: `| tail` would mask npm failures (pipeline exit = tail's).
 # The `command -v` checks make a partial install fail the build loudly.
-RUN npm install -g --loglevel=error @anthropic-ai/claude-code @openai/codex opencode-ai && \
-    command -v claude && command -v codex && command -v opencode
+# @kilocode/cli ships its platform binary via optionalDependencies + postinstall,
+# so scripts must stay enabled for it.
+RUN npm install -g --loglevel=error @anthropic-ai/claude-code @openai/codex opencode-ai @kilocode/cli && \
+    command -v claude && command -v codex && command -v opencode && command -v kilo
 
 # ForgeAI MCP relay (baked-in copy for reference only — at runtime the CLI
 # stages its own copy into /session/forge-mcp-relay.mjs so the relay version
@@ -30,10 +32,10 @@ RUN npm install -g --loglevel=error @anthropic-ai/claude-code @openai/codex open
 RUN mkdir -p /opt/forgeai
 COPY forge-mcp-relay.mjs /opt/forgeai/forge-mcp-relay.mjs
 
-# Create non-root user (Claude Code refuses --dangerously-skip-permissions as root)
-RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends passwd && \
-    rm -rf /var/lib/apt/lists/* && \
-    useradd -m -s /bin/bash -u 1001 agent
+# Create non-root user (Claude Code refuses --dangerously-skip-permissions as root).
+# passwd is installed with the base packages above: re-running apt-get update
+# here hits the NodeSource repo again, which intermittently 403s and fails builds.
+RUN useradd -m -s /bin/bash -u 1001 agent
 
 # Working directories (owned by agent user)
 RUN mkdir -p /workspace /session /shared && \