@mifune/agro 0.16.0 → 0.16.2

package/README.md

@@ -1,6 +1,6 @@
 # @mifune/agro
 
-The **AGRO CLI** (`agro`) — create an [AGRO](https://agro.mifune.dev)
+The **AGRO CLI** (`agro`) — create an [AGRO](https://github.com/mifunedev/agro)
 Docker sandbox for coding agents and drive its lifecycle from the command line.
 
 AGRO is a portable harness for running coding agents (Claude Code, Codex, Pi,
@@ -26,17 +26,17 @@ Or run it once without installing:
 npx @mifune/agro sandbox install docker
 ```
 
-Prefer a `curl | bash` bootstrap (also installs Node when missing)? `get-agro.sh`
+Prefer a `curl | bash` bootstrap (also installs Node when missing)? `install.sh`
 installs the prebuilt `agro` artifact from the latest GitHub release — it never
 clones or builds on your machine:
 
 ```bash
-curl -fsSL https://agro.mifune.dev/get-agro.sh | bash
+curl -fsSL https://github.com/mifunedev/agro/releases/latest/download/install.sh | bash
 ```
 
 ### Requirements
 
-- **Node.js ≥ 20** (22 recommended) on your `PATH`. Unlike the `get-agro.sh` bootstrap,
+- **Node.js ≥ 20** (22 recommended) on your `PATH`. Unlike the `install.sh` bootstrap,
   npm will not install Node for you.
 - **Docker** and **git** for the sandbox lifecycle commands (`agro sandbox install`, `agro shell`).
 
@@ -147,8 +147,8 @@ The CLI writes no scaffold. It creates no `AGENTS.md`, no provider configuration
 
 ## Documentation
 
-- **Docs:** https://agro.mifune.dev
-- **Installation guide:** https://agro.mifune.dev/docs/installation
+- **Docs:** https://github.com/mifunedev/agro/tree/main/docs
+- **Installation guide:** https://github.com/mifunedev/agro/blob/main/docs/installation.md
 - **Source & issues:** https://github.com/mifunedev/agro
 
 ## License

package/dist/agro.js

@@ -531,7 +531,7 @@ function refuseUnsupported(installation, bin) {
       return new Error(`${at} \u2014 rebuild from the checkout: npm --prefix .agro/cli run build`);
     default:
       return new Error(
-        `unknown installation (${reason ?? target}) \u2014 install with npm install -g ${PACKAGE} or get-agro.sh`
+        `unknown installation (${reason ?? target}) \u2014 install with npm install -g ${PACKAGE} or install.sh`
       );
   }
 }
@@ -611,6 +611,15 @@ ${detail}`);
 function copyFile(deps, from, to) {
   deps.writeFile(to, deps.readFile(from), deps.stat(from).mode & 511);
 }
+var ABSOLUTE_NODE_SHEBANG = /^#!\/\S*\/node$/;
+function withPinnedShebang(current, artifact) {
+  const currentEnd = current.indexOf(10);
+  const artifactEnd = artifact.indexOf(10);
+  if (currentEnd < 0 || artifactEnd < 0) return artifact;
+  const firstLine = current.subarray(0, currentEnd);
+  if (!ABSOLUTE_NODE_SHEBANG.test(firstLine.toString("utf8"))) return artifact;
+  return Buffer.concat([firstLine, artifact.subarray(artifactEnd)]);
+}
 function removeQuietly(deps, path4, io) {
   try {
     deps.unlink(path4);
@@ -629,7 +638,7 @@ async function upgradeStandalone(installation, opts, deps, io) {
     deps.access(dir, constants.W_OK);
   } catch {
     throw new Error(
-      `${dir} is not writable; re-run as the user who owns ${target}, or reinstall into a writable directory with get-agro.sh`
+      `${dir} is not writable; re-run as the user who owns ${target}, or reinstall into a writable directory with install.sh`
     );
   }
   let artifact;
@@ -645,11 +654,11 @@ async function upgradeStandalone(installation, opts, deps, io) {
   let prevPresent = false;
   let replaced = false;
   try {
-    deps.writeFile(tmp, artifact, 493);
-    tmpPresent = true;
     if (artifact.subarray(0, 2).toString("utf8") !== "#!") {
       throw new Error(`invalid artifact from ${url}: no #! shebang`);
     }
+    deps.writeFile(tmp, withPinnedShebang(deps.readFile(target), artifact), 493);
+    tmpPresent = true;
     const probe = deps.runNode(tmp, ["--version"]);
     const available = versionOf(probe);
     if (parseSemver(available) === void 0) {
@@ -1403,10 +1412,10 @@ import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as read
 import { dirname as dirname4, join as join4, resolve as resolve5, sep as sep2 } from "node:path";
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.yml
-var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}\n    pull_policy: ${AGRO_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${AGRO_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}\n    pull_policy: ${AGRO_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${AGRO_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.image-only.yml
-var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}\n    pull_policy: ${AGRO_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}\n    pull_policy: ${AGRO_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.ssh.yml
 var docker_compose_ssh_default = 'services:\n  sandbox:\n    ports:\n      - "127.0.0.1:${SANDBOX_SSH_PORT:-2222}:22"\n';
@@ -1484,8 +1493,7 @@ if [ -f "$REPO_DIR/harness.yaml" ] && [ -f "$MIGRATOR" ]; then
   sh "$MIGRATOR" "$REPO_DIR" >&2 || true
 fi
 
-ENV_FILE="$REPO_DIR/.env"
-[ -f "$ENV_FILE" ] || ENV_FILE="$REPO_DIR/.devcontainer/.env"
+ENV_FILE="$(agro_env_file "$REPO_DIR")"
 
 compose_path() {
   case "$1" in
@@ -1632,6 +1640,14 @@ agro_config_file() {
   printf '%s\\n' "$1/$AGRO_CONFIG_FILE"
 }
 
+agro_env_file() {
+  if [ -f "$1/.env" ]; then
+    printf '%s\\n' "$1/.env"
+  else
+    printf '%s\\n' "$1/.devcontainer/.env"
+  fi
+}
+
 agro_env_value() {
   local key="AGRO_$1"
   printf '%s\\n' "\${!key:-}"
@@ -2222,7 +2238,7 @@ function resolveExecutionTarget(opts) {
 }
 
 // src/lib/version.ts
-var AGRO_VERSION = true ? "0.16.0" : "0.0.0-dev";
+var AGRO_VERSION = true ? "0.16.2" : "0.0.0-dev";
 var OFFICIAL_IMAGE = "ghcr.io/mifunedev/agro";
 var RELEASE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-z][a-z0-9]*\.[0-9]+)?$/;
 function parseReleaseVersion(value) {
@@ -2852,6 +2868,7 @@ function sameRemote(url, owner, name) {
 }
 
 // src/commands/secret.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync12 } from "node:fs";
 import { join as join7 } from "node:path";
 
@@ -2883,8 +2900,16 @@ function appendGitignoreLines(root, lines) {
 function secretsRoot(opts) {
   return opts.sandbox === void 0 ? resolveProjectRoot(opts.cwd) : resolveSandboxRoot({ name: opts.sandbox });
 }
+function isGitIgnored(root, path4) {
+  const result = spawnSync3("git", ["check-ignore", "-q", "--no-index", path4], {
+    cwd: root,
+    stdio: "ignore"
+  });
+  return result.status === 0;
+}
 function ignoreSecretsFile(root) {
   if (!existsSync12(join7(root, ".git"))) return;
+  if (isGitIgnored(root, ".env")) return;
   appendGitignoreLines(root, [".env"]);
 }
 function secretKeyList() {
@@ -3744,7 +3769,7 @@ var RUNTIME_CATALOG = Object.freeze([
     tier: "container",
     state: "active",
     provisionable: true,
-    docsPath: "docs/runtimes/docker.md"
+    docsPath: "docs/runtimes/overview.md"
   }),
   Object.freeze({
     id: "microsandbox",
@@ -3752,7 +3777,7 @@ var RUNTIME_CATALOG = Object.freeze([
     tier: "microvm",
     state: "planned",
     provisionable: false,
-    notProvisionableReason: (bin) => `microsandbox is not a provisionable runtime yet; see docs/rfcs/rfc-runtime-support.md. Inside a sandbox run \`${bin} tool install microsandbox\`.`,
+    notProvisionableReason: (bin) => `microsandbox is not a provisionable runtime yet; see https://github.com/mifunedev/agro/issues/592. Inside a sandbox run \`${bin} tool install microsandbox\`.`,
     docsPath: "docs/runtimes/microsandbox.md"
   })
 ]);
@@ -6351,11 +6376,11 @@ Remove ${entry.id} by hand: ${ROOT_TOOL_REMOVAL_DOCS}
 }
 
 // src/lib/remote.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 var DEFAULT_REPO_URL = "https://github.com/mifunedev/agro";
 var DEFAULT_CLONE_TIMEOUT_MS = 12e4;
 var spawnRunner2 = (cmd, args, opts) => {
-  const r = spawnSync3(cmd, args, {
+  const r = spawnSync4(cmd, args, {
     env: opts.env,
     timeout: opts.timeoutMs,
     stdio: ["ignore", "ignore", "pipe"],
@@ -6413,6 +6438,35 @@ function fetchRemoteSource(opts) {
   return opts.destDir;
 }
 
+// src/command-table.ts
+var CONFIG_VERBS = ["show", "set", "repo"];
+var CONFIG_INTEGRATIONS = ["langfuse"];
+var SECRET_VERBS = ["set", "list"];
+var LANGFUSE_VERBS = ["apply", "status", "disable"];
+var SANDBOX_SUBCOMMANDS = ["install", "list", "upgrade"];
+var WORKSPACE_SUBCOMMANDS = ["create", "list"];
+var HARNESS_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
+var TOOL_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
+function isOneOf(values, value) {
+  return value !== void 0 && values.includes(value);
+}
+var AGRO_COMMANDS = Object.freeze({
+  config: [...CONFIG_VERBS, ...CONFIG_INTEGRATIONS],
+  secret: SECRET_VERBS,
+  langfuse: LANGFUSE_VERBS,
+  update: null,
+  "self-upgrade": null,
+  vendor: null,
+  sandbox: SANDBOX_SUBCOMMANDS,
+  shell: null,
+  compose: null,
+  workspace: WORKSPACE_SUBCOMMANDS,
+  harness: HARNESS_SUBCOMMANDS,
+  tool: TOOL_SUBCOMMANDS,
+  gateway: null,
+  ...Object.fromEntries(composeVerbs().map((verb) => [verb, null]))
+});
+
 // src/cli.ts
 var DEFAULT_SOURCE_CONTROL_DIR = resolve11(
   dirname10(fileURLToPath(import.meta.url)),
@@ -6549,7 +6603,7 @@ The upgrade follows whichever mechanism installed this executable:
   npm-managed    realpath under node_modules/${AGRO_PRODUCT.packageName}/: reads the registry
                  version with \`npm view\`, then runs
                  \`npm install -g --prefix <owning prefix> ${AGRO_PRODUCT.packageName}@<version>\`.
-  standalone     a plain file (get-agro.sh): downloads AGRO_JS_URL (default
+  standalone     a plain file (install.sh): downloads AGRO_JS_URL (default
                  ${DEFAULT_ARTIFACT_URL})
                  into the same directory, checks its shebang and \`--version\`,
                  renames it over the executable, and keeps <path>.prev until the
@@ -6807,7 +6861,6 @@ function extractSandboxFlag(command, rest) {
   }
   return { ok: true, args: sandbox === void 0 ? { rest: kept } : { rest: kept, sandbox } };
 }
-var LANGFUSE_VERBS = ["apply", "status", "disable"];
 function parseLangfuseArgs(rest, bin = AGRO_PRODUCT.bin) {
   if (rest.length === 0 || isHelpFlag2(rest[0])) return { ok: true, args: { help: true } };
   const [head, ...tail] = rest;
@@ -6824,7 +6877,6 @@ function parseLangfuseArgs(rest, bin = AGRO_PRODUCT.bin) {
   }
   return { ok: true, args: { help: false, verb: head } };
 }
-var CONFIG_VERBS = ["show", "set", "repo"];
 function parseConfigArgs(input, bin = AGRO_PRODUCT.bin) {
   const scoped = extractSandboxFlag(`${bin} config`, input);
   if (!scoped.ok) return scoped;
@@ -6876,7 +6928,6 @@ function parseConfigArgs(input, bin = AGRO_PRODUCT.bin) {
   }
   return { ok: true, args: { ...args, verb, key, value } };
 }
-var SECRET_VERBS = ["set", "list"];
 function parseSecretArgs(input, bin = AGRO_PRODUCT.bin) {
   const scoped = extractSandboxFlag(`${bin} secret`, input);
   if (!scoped.ok) return scoped;
@@ -7086,7 +7137,7 @@ function parseWorkspaceArgs(rest, bin = AGRO_PRODUCT.bin) {
     return { ok: false, error: `${bin} workspace: --ref requires a branch or tag` };
   }
   const [sub, name, ...extra] = positionals;
-  if (sub !== "create" && sub !== "list") {
+  if (!isOneOf(WORKSPACE_SUBCOMMANDS, sub)) {
     return {
       ok: false,
       error: `${bin} workspace: unknown subcommand "${sub}" \u2014 expected create or list`,
@@ -7172,7 +7223,7 @@ function parseHarnessArgs(rest, bin = AGRO_PRODUCT.bin) {
     };
   }
   const [sub, name, ...extra] = positionals;
-  if (sub !== "list" && sub !== "install" && sub !== "status" && sub !== "uninstall") {
+  if (!isOneOf(HARNESS_SUBCOMMANDS, sub)) {
     return {
       ok: false,
       error: `${bin} harness: unknown subcommand "${sub}" \u2014 expected list, install, uninstall, or status`,
@@ -7229,7 +7280,7 @@ function parseToolArgs(rest, bin = AGRO_PRODUCT.bin) {
     return { ok: false, error: `${bin} tool: --path requires a directory` };
   }
   const [sub, name, ...extra] = positionals;
-  if (sub !== "list" && sub !== "install" && sub !== "status" && sub !== "uninstall") {
+  if (!isOneOf(TOOL_SUBCOMMANDS, sub)) {
     return {
       ok: false,
       error: `${bin} tool: unknown subcommand "${sub}" \u2014 expected list, install, uninstall, or status`,
@@ -7320,6 +7371,7 @@ async function main(argv) {
 `);
     return 0;
   }
+  if (!Object.hasOwn(AGRO_COMMANDS, first)) return unknownCommand(first, product);
   if (first === "config") {
     const parsed = parseConfigArgs(argv.slice(1), bin);
     if (!parsed.ok) {
@@ -7642,7 +7694,10 @@ async function main(argv) {
     }
     return runGateway(parsed.args.passthrough, { bin });
   }
-  process.stderr.write(`${bin}: unknown command "${first}"
+  return unknownCommand(first, product);
+}
+function unknownCommand(first, product) {
+  process.stderr.write(`${product.bin}: unknown command "${first}"
 
 `);
   printAgroHelp(product);
@@ -7664,9 +7719,6 @@ main(process.argv.slice(2)).then(
   }
 );
 export {
-  CONFIG_VERBS,
-  LANGFUSE_VERBS,
-  SECRET_VERBS,
   bundledPayloadExists,
   extractSandboxFlag,
   isHelpFlag2 as isHelpFlag,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mifune/agro",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "AGRO CLI — create and manage sandboxes for coding agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/mifunedev/agro#readme",