@prover-coder-ai/docker-git 1.0.31 → 1.0.32

package/dist/src/docker-git/main.js

@@ -361,6 +361,8 @@ class DockerAccessError extends Data.TaggedError("DockerAccessError") {
 }
 class CloneFailedError extends Data.TaggedError("CloneFailedError") {
 }
+class AgentFailedError extends Data.TaggedError("AgentFailedError") {
+}
 class PortProbeError extends Data.TaggedError("PortProbeError") {
 }
 class CommandFailedError extends Data.TaggedError("CommandFailedError") {
@@ -777,23 +779,26 @@ const renderDockerAccessActionPlan = (issue) => {
   ];
   return issue === "PermissionDenied" ? permissionDeniedPlan.join("\n") : daemonUnavailablePlan.join("\n");
 };
+const renderDockerCommandError = ({ exitCode }) => [
+  `docker compose failed with exit code ${exitCode}`,
+  "Hint: ensure Docker daemon is running and current user can access /var/run/docker.sock (for example via the docker group).",
+  "Hint: if output above contains 'port is already allocated', retry with a free SSH port via --ssh-port <port> (for example --ssh-port 2235), or stop the conflicting project/container.",
+  "Hint: if output above contains 'all predefined address pools have been fully subnetted', run `docker network prune -f`, configure Docker `default-address-pools`, or use shared network mode (`--network-mode shared`).",
+  "Hint: if output above contains 'lookup auth.docker.io' or 'read udp ... [::1]:53 ... connection refused', fix Docker DNS resolver (set working DNS in host/daemon config) and retry."
+].join("\n");
+const renderDockerAccessError = ({ details, issue }) => [
+  renderDockerAccessHeadline(issue),
+  "Hint: ensure Docker daemon is running and current user can access the docker socket.",
+  "Hint: if you use rootless Docker, set DOCKER_HOST to your user socket (for example unix:///run/user/$UID/docker.sock).",
+  renderDockerAccessActionPlan(issue),
+  `Details: ${details}`
+].join("\n");
 const renderPrimaryError = (error) => Match.value(error).pipe(
   Match.when({ _tag: "FileExistsError" }, ({ path }) => `File already exists: ${path} (use --force to overwrite)`),
-  Match.when({ _tag: "DockerCommandError" }, ({ exitCode }) => [
-    `docker compose failed with exit code ${exitCode}`,
-    "Hint: ensure Docker daemon is running and current user can access /var/run/docker.sock (for example via the docker group).",
-    "Hint: if output above contains 'port is already allocated', retry with a free SSH port via --ssh-port <port> (for example --ssh-port 2235), or stop the conflicting project/container.",
-    "Hint: if output above contains 'all predefined address pools have been fully subnetted', run `docker network prune -f`, configure Docker `default-address-pools`, or use shared network mode (`--network-mode shared`).",
-    "Hint: if output above contains 'lookup auth.docker.io' or 'read udp ... [::1]:53 ... connection refused', fix Docker DNS resolver (set working DNS in host/daemon config) and retry."
-  ].join("\n")),
-  Match.when({ _tag: "DockerAccessError" }, ({ details, issue }) => [
-    renderDockerAccessHeadline(issue),
-    "Hint: ensure Docker daemon is running and current user can access the docker socket.",
-    "Hint: if you use rootless Docker, set DOCKER_HOST to your user socket (for example unix:///run/user/$UID/docker.sock).",
-    renderDockerAccessActionPlan(issue),
-    `Details: ${details}`
-  ].join("\n")),
+  Match.when({ _tag: "DockerCommandError" }, renderDockerCommandError),
+  Match.when({ _tag: "DockerAccessError" }, renderDockerAccessError),
   Match.when({ _tag: "CloneFailedError" }, ({ repoRef, repoUrl, targetDir }) => `Clone failed for ${repoUrl} (${repoRef}) into ${targetDir}`),
+  Match.when({ _tag: "AgentFailedError" }, ({ agentMode, targetDir }) => `Agent (${agentMode}) failed in ${targetDir}`),
   Match.when({ _tag: "PortProbeError" }, ({ message, port }) => `SSH port check failed for ${port}: ${message}`),
   Match.when(
     { _tag: "CommandFailedError" },
@@ -2249,6 +2254,8 @@ GITHUB_TOKEN="\${GITHUB_TOKEN:-\${GH_TOKEN:-}}"
 GIT_USER_NAME="\${GIT_USER_NAME:-}"
 GIT_USER_EMAIL="\${GIT_USER_EMAIL:-}"
 CODEX_AUTO_UPDATE="\${CODEX_AUTO_UPDATE:-1}"
+AGENT_MODE="\${AGENT_MODE:-}"
+AGENT_AUTO="\${AGENT_AUTO:-}"
 MCP_PLAYWRIGHT_ENABLE="\${MCP_PLAYWRIGHT_ENABLE:-${config.enableMcpPlaywright ? "1" : "0"}}"
 MCP_PLAYWRIGHT_CDP_ENDPOINT="\${MCP_PLAYWRIGHT_CDP_ENDPOINT:-}"
 MCP_PLAYWRIGHT_ISOLATED="\${MCP_PLAYWRIGHT_ISOLATED:-1}"
@@ -3568,6 +3575,164 @@ EOF
   chown 1000:1000 "$OPENCODE_CONFIG_JSON" || true
 fi`;
 const renderEntrypointOpenCodeConfig = (config) => entrypointOpenCodeTemplate.replaceAll("__SSH_USER__", config.sshUser).replaceAll("__CODEX_HOME__", config.codexHome);
+const indentBlock = (block, size = 2) => {
+  const prefix = " ".repeat(size);
+  return block.split("\n").map((line) => `${prefix}${line}`).join("\n");
+};
+const renderAgentPrompt = () => String.raw`AGENT_PROMPT=""
+ISSUE_NUM=""
+if [[ "$REPO_REF" =~ ^issue-([0-9]+)$ ]]; then
+  ISSUE_NUM="${"${"}BASH_REMATCH[1]}"
+fi
+
+if [[ "$AGENT_AUTO" == "1" ]]; then
+  if [[ -n "$ISSUE_NUM" ]]; then
+    AGENT_PROMPT="Read GitHub issue #$ISSUE_NUM for this repository (use gh issue view $ISSUE_NUM). Implement the requested changes, commit them, create a PR that closes #$ISSUE_NUM, and push it."
+  else
+    AGENT_PROMPT="Analyze this repository, implement any pending tasks, commit changes, create a PR, and push it."
+  fi
+fi`;
+const renderAgentSetup = () => [
+  String.raw`AGENT_DONE_PATH="/run/docker-git/agent.done"
+AGENT_FAIL_PATH="/run/docker-git/agent.failed"
+AGENT_PROMPT_FILE="/run/docker-git/agent-prompt.txt"
+rm -f "$AGENT_DONE_PATH" "$AGENT_FAIL_PATH" "$AGENT_PROMPT_FILE"`,
+  String.raw`# Collect tokens for agent environment (su - dev does not always inherit profile.d)
+AGENT_ENV_FILE="/run/docker-git/agent-env.sh"
+{
+  [[ -f /etc/profile.d/gh-token.sh ]] && cat /etc/profile.d/gh-token.sh
+  [[ -f /etc/profile.d/claude-config.sh ]] && cat /etc/profile.d/claude-config.sh
+} > "$AGENT_ENV_FILE" 2>/dev/null || true
+chmod 644 "$AGENT_ENV_FILE"`,
+  renderAgentPrompt(),
+  String.raw`AGENT_OK=0
+if [[ -n "$AGENT_PROMPT" ]]; then
+  printf "%s" "$AGENT_PROMPT" > "$AGENT_PROMPT_FILE"
+  chmod 644 "$AGENT_PROMPT_FILE"
+fi`
+].join("\n\n");
+const renderAgentPromptCommand = (mode) => mode === "claude" ? String.raw`claude --dangerously-skip-permissions -p \"\$(cat $AGENT_PROMPT_FILE)\"` : String.raw`codex --approval-mode full-auto \"\$(cat $AGENT_PROMPT_FILE)\"`;
+const renderAgentModeBlock = (config, mode) => {
+  const startMessage = `[agent] starting ${mode}...`;
+  const interactiveMessage = `[agent] ${mode} started in interactive mode (use SSH to connect)`;
+  return String.raw`"${mode}")
+  echo "${startMessage}"
+  if [[ -n "$AGENT_PROMPT" ]]; then
+    if su - ${config.sshUser} \
+      -c ". /run/docker-git/agent-env.sh 2>/dev/null; cd '$TARGET_DIR' && ${renderAgentPromptCommand(mode)}"; then
+      AGENT_OK=1
+    fi
+  else
+    echo "${interactiveMessage}"
+    AGENT_OK=1
+  fi
+  ;;`;
+};
+const renderAgentModeCase = (config) => [
+  String.raw`case "$AGENT_MODE" in`,
+  indentBlock(renderAgentModeBlock(config, "claude")),
+  indentBlock(renderAgentModeBlock(config, "codex")),
+  indentBlock(
+    String.raw`*)
+  echo "[agent] unknown agent mode: $AGENT_MODE"
+  ;;`
+  ),
+  "esac"
+].join("\n");
+const renderAgentIssueComment = (config) => String.raw`echo "[agent] posting review comment to issue #$ISSUE_NUM..."
+
+PR_BODY=""
+PR_BODY=$(su - ${config.sshUser} -c ". /run/docker-git/agent-env.sh 2>/dev/null; cd '$TARGET_DIR' && gh pr list --head '$REPO_REF' --json body --jq '.[0].body'" 2>/dev/null) || true
+
+if [[ -z "$PR_BODY" ]]; then
+  PR_BODY=$(su - ${config.sshUser} -c ". /run/docker-git/agent-env.sh 2>/dev/null; cd '$TARGET_DIR' && git log --format='%B' -1" 2>/dev/null) || true
+fi
+
+if [[ -n "$PR_BODY" ]]; then
+  COMMENT_FILE="/run/docker-git/agent-comment.txt"
+  printf "%s" "$PR_BODY" > "$COMMENT_FILE"
+  chmod 644 "$COMMENT_FILE"
+  su - ${config.sshUser} -c ". /run/docker-git/agent-env.sh 2>/dev/null; cd '$TARGET_DIR' && gh issue comment '$ISSUE_NUM' --body-file '$COMMENT_FILE'" || echo "[agent] failed to comment on issue #$ISSUE_NUM"
+else
+  echo "[agent] no PR body or commit message found, skipping comment"
+fi`;
+const renderProjectMoveScript = () => String.raw`#!/bin/bash
+. /run/docker-git/agent-env.sh 2>/dev/null || true
+cd "$1" || exit 1
+ISSUE_NUM="$2"
+
+ISSUE_NODE_ID=$(gh issue view "$ISSUE_NUM" --json id --jq '.id' 2>/dev/null) || true
+if [[ -z "$ISSUE_NODE_ID" ]]; then
+  echo "[agent] could not get issue node ID, skipping move"
+  exit 0
+fi
+
+GQL_QUERY='query($nodeId: ID!) { node(id: $nodeId) { ... on Issue { projectItems(first: 1) { nodes { id project { id field(name: "Status") { ... on ProjectV2SingleSelectField { id options { id name } } } } } } } } }'
+ALL_IDS=$(gh api graphql -F nodeId="$ISSUE_NODE_ID" -f query="$GQL_QUERY" \
+  --jq '(.data.node.projectItems.nodes // [])[0] // empty | [.id, .project.id, .project.field.id, ([.project.field.options[] | select(.name | test("review"; "i"))][0].id)] | @tsv' 2>/dev/null) || true
+
+if [[ -z "$ALL_IDS" ]]; then
+  echo "[agent] issue #$ISSUE_NUM is not in a project board, skipping move"
+  exit 0
+fi
+
+ITEM_ID=$(printf "%s" "$ALL_IDS" | cut -f1)
+PROJECT_ID=$(printf "%s" "$ALL_IDS" | cut -f2)
+STATUS_FIELD_ID=$(printf "%s" "$ALL_IDS" | cut -f3)
+REVIEW_OPTION_ID=$(printf "%s" "$ALL_IDS" | cut -f4)
+if [[ -z "$STATUS_FIELD_ID" || -z "$REVIEW_OPTION_ID" || "$STATUS_FIELD_ID" == "null" || "$REVIEW_OPTION_ID" == "null" ]]; then
+  echo "[agent] review status not found in project board, skipping move"
+  exit 0
+fi
+
+MUTATION='mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) { updateProjectV2ItemFieldValue(input: { projectId: $projectId, itemId: $itemId, fieldId: $fieldId, value: { singleSelectOptionId: $optionId } }) { projectV2Item { id } } }'
+MOVE_RESULT=$(gh api graphql \
+  -F projectId="$PROJECT_ID" \
+  -F itemId="$ITEM_ID" \
+  -F fieldId="$STATUS_FIELD_ID" \
+  -F optionId="$REVIEW_OPTION_ID" \
+  -f query="$MUTATION" 2>&1) || true
+
+if [[ "$MOVE_RESULT" == *"projectV2Item"* ]]; then
+  echo "[agent] issue #$ISSUE_NUM moved to review"
+else
+  echo "[agent] failed to move issue #$ISSUE_NUM in project board"
+fi`;
+const renderAgentIssueMove = (config) => [
+  String.raw`echo "[agent] moving issue #$ISSUE_NUM to review..."
+MOVE_SCRIPT="/run/docker-git/project-move.sh"`,
+  String.raw`cat > "$MOVE_SCRIPT" << 'EOFMOVE'
+${renderProjectMoveScript()}
+EOFMOVE`,
+  String.raw`chmod +x "$MOVE_SCRIPT"
+su - ${config.sshUser} -c "$MOVE_SCRIPT '$TARGET_DIR' '$ISSUE_NUM'" || true`
+].join("\n");
+const renderAgentIssueReview = (config) => [
+  String.raw`if [[ "$AGENT_OK" -eq 1 && "$AGENT_AUTO" == "1" && -n "$ISSUE_NUM" ]]; then`,
+  indentBlock(renderAgentIssueComment(config)),
+  "",
+  renderAgentIssueMove(config),
+  "fi"
+].join("\n");
+const renderAgentFinalize = () => String.raw`if [[ "$AGENT_OK" -eq 1 ]]; then
+  echo "[agent] done"
+  touch "$AGENT_DONE_PATH"
+else
+  echo "[agent] failed"
+  touch "$AGENT_FAIL_PATH"
+fi`;
+const renderAgentLaunch = (config) => [
+  String.raw`# 3) Auto-launch agent if AGENT_MODE is set
+if [[ "$CLONE_OK" -eq 1 && -n "$AGENT_MODE" ]]; then`,
+  indentBlock(renderAgentSetup()),
+  "",
+  indentBlock(renderAgentModeCase(config)),
+  "",
+  renderAgentIssueReview(config),
+  "",
+  indentBlock(renderAgentFinalize()),
+  "fi"
+].join("\n");
 const renderEntrypointAutoUpdate = () => `# 1) Keep Codex CLI up to date if requested (bun only)
 if [[ "$CODEX_AUTO_UPDATE" == "1" ]]; then
   if command -v bun >/dev/null 2>&1; then
@@ -3744,6 +3909,8 @@ const renderEntrypointBackgroundTasks = (config) => `# 4) Start background tasks
 ${renderEntrypointAutoUpdate()}
 
 ${renderEntrypointClone(config)}
+
+${renderAgentLaunch(config)}
 ) &`;
 const renderEntrypoint = (config) => [
   renderEntrypointHeader(config),
@@ -3779,6 +3946,10 @@ const renderCodexAuthLabelEnv = (codexAuthLabel) => codexAuthLabel.length > 0 ?
 ` : "";
 const renderClaudeAuthLabelEnv = (claudeAuthLabel) => claudeAuthLabel.length > 0 ? `      CLAUDE_AUTH_LABEL: "${claudeAuthLabel}"
 ` : "";
+const renderAgentModeEnv = (agentMode) => agentMode !== void 0 && agentMode.length > 0 ? `      AGENT_MODE: "${agentMode}"
+` : "";
+const renderAgentAutoEnv = (agentAuto) => agentAuto === true ? `      AGENT_AUTO: "1"
+` : "";
 const buildPlaywrightFragments = (config, networkName) => {
   if (!config.enableMcpPlaywright) {
     return {
@@ -3831,6 +4002,8 @@ const buildComposeFragments = (config) => {
   const maybeGitTokenLabelEnv = renderGitTokenLabelEnv(gitTokenLabel);
   const maybeCodexAuthLabelEnv = renderCodexAuthLabelEnv(codexAuthLabel);
   const maybeClaudeAuthLabelEnv = renderClaudeAuthLabelEnv(claudeAuthLabel);
+  const maybeAgentModeEnv = renderAgentModeEnv(config.agentMode);
+  const maybeAgentAutoEnv = renderAgentAutoEnv(config.agentAuto);
   const playwright = buildPlaywrightFragments(config, networkName);
   return {
     networkMode,
@@ -3838,6 +4011,8 @@ const buildComposeFragments = (config) => {
     maybeGitTokenLabelEnv,
     maybeCodexAuthLabelEnv,
     maybeClaudeAuthLabelEnv,
+    maybeAgentModeEnv,
+    maybeAgentAutoEnv,
     maybeDependsOn: playwright.maybeDependsOn,
     maybePlaywrightEnv: playwright.maybePlaywrightEnv,
     maybeBrowserService: playwright.maybeBrowserService,
@@ -3856,7 +4031,7 @@ const renderComposeServices = (config, fragments) => `services:
       FORK_REPO_URL: "${fragments.forkRepoUrl}"
 ${fragments.maybeGitTokenLabelEnv}      # Optional token label selector (maps to GITHUB_TOKEN__<LABEL>/GIT_AUTH_TOKEN__<LABEL>)
 ${fragments.maybeCodexAuthLabelEnv}      # Optional Codex account label selector (maps to CODEX_AUTH_LABEL)
-${fragments.maybeClaudeAuthLabelEnv}      # Optional Claude account label selector (maps to CLAUDE_AUTH_LABEL)
+${fragments.maybeClaudeAuthLabelEnv}${fragments.maybeAgentModeEnv}${fragments.maybeAgentAutoEnv}      # Optional Claude account label selector (maps to CLAUDE_AUTH_LABEL)
       TARGET_DIR: "${config.targetDir}"
       CODEX_HOME: "${config.codexHome}"
 ${fragments.maybePlaywrightEnv}${fragments.maybeDependsOn}    env_file:
@@ -5407,8 +5582,11 @@ const listProjectStatus = Effect.asVoid(
   )
 );
 const clonePollInterval = Duration.seconds(1);
+const agentPollInterval = Duration.seconds(2);
 const cloneDonePath = "/run/docker-git/clone.done";
 const cloneFailPath = "/run/docker-git/clone.failed";
+const agentDonePath = "/run/docker-git/agent.done";
+const agentFailPath = "/run/docker-git/agent.failed";
 const logSshAccess = (baseDir, config) => Effect.gen(function* (_) {
   const fs = yield* _(FileSystem.FileSystem);
   const path = yield* _(Path.Path);
@@ -5467,6 +5645,47 @@ const waitForCloneCompletion = (cwd, config) => Effect.gen(function* (_) {
     );
   }
 });
+const checkAgentState = (cwd, containerName) => Effect.gen(function* (_) {
+  const failed = yield* _(runDockerExecExitCode(cwd, containerName, ["test", "-f", agentFailPath]));
+  if (failed === 0) {
+    return "failed";
+  }
+  const done = yield* _(runDockerExecExitCode(cwd, containerName, ["test", "-f", agentDonePath]));
+  return done === 0 ? "done" : "pending";
+});
+const waitForAgentCompletion = (cwd, config) => Effect.gen(function* (_) {
+  const logsFiber = yield* _(
+    runDockerComposeLogsFollow(cwd).pipe(
+      Effect.tapError(
+        (error) => Effect.logWarning(
+          `docker compose logs --follow failed: ${error instanceof Error ? error.message : String(error)}`
+        )
+      ),
+      Effect.fork
+    )
+  );
+  const result = yield* _(
+    checkAgentState(cwd, config.containerName).pipe(
+      Effect.repeat(
+        Schedule.addDelay(
+          Schedule.recurUntil((state) => state !== "pending"),
+          () => agentPollInterval
+        )
+      )
+    )
+  );
+  yield* _(Fiber$1.interrupt(logsFiber));
+  if (result === "failed") {
+    return yield* _(
+      Effect.fail(
+        new AgentFailedError({
+          agentMode: config.agentMode ?? "unknown",
+          targetDir: config.targetDir
+        })
+      )
+    );
+  }
+});
 const runDockerComposeUpByMode = (resolvedOutDir, projectConfig, force, forceEnv) => Effect.gen(function* (_) {
   yield* _(ensureComposeNetworkReady(resolvedOutDir, projectConfig));
   if (force) {
@@ -5511,9 +5730,16 @@ const runDockerUpIfNeeded = (resolvedOutDir, projectConfig, options) => Effect.g
     yield* _(Effect.log("Streaming container logs until clone completes..."));
     yield* _(waitForCloneCompletion(resolvedOutDir, projectConfig));
   }
+  if (options.waitForAgent) {
+    yield* _(Effect.log("Waiting for agent to complete..."));
+    yield* _(waitForAgentCompletion(resolvedOutDir, projectConfig));
+  }
   yield* _(Effect.log("Docker environment is up"));
   yield* _(logSshAccess(resolvedOutDir, projectConfig));
 });
+const runDockerDownCleanup = (resolvedOutDir) => runDockerComposeDownVolumes(resolvedOutDir).pipe(
+  Effect.tap(() => Effect.log("Container and volumes removed."))
+);
 const resolvePathFromBase = (path, baseDir, targetPath) => path.isAbsolute(targetPath) ? targetPath : path.resolve(baseDir, targetPath);
 const toPosixPath = (value) => value.replaceAll("\\", "/");
 const resolveDockerGitRootRelativePath = (path, projectsRoot, inputPath) => {
@@ -5712,7 +5938,7 @@ const formatStateSyncLabel = (repoUrl) => {
   return repoPath.length > 0 ? repoPath : repoUrl;
 };
 const isInteractiveTty = () => process.stdin.isTTY && process.stdout.isTTY;
-const buildSshArgs = (config, sshKeyPath) => {
+const buildSshArgs = (config, sshKeyPath, remoteCommand) => {
   const args = [];
   if (sshKeyPath !== null) {
     args.push("-i", sshKeyPath);
@@ -5730,21 +5956,25 @@ const buildSshArgs = (config, sshKeyPath) => {
     String(config.sshPort),
     `${config.sshUser}@localhost`
   );
+  if (remoteCommand !== void 0) {
+    args.push(remoteCommand);
+  }
   return args;
 };
-const openSshBestEffort = (template) => Effect.gen(function* (_) {
+const openSshBestEffort = (template, remoteCommand) => Effect.gen(function* (_) {
   const fs = yield* _(FileSystem.FileSystem);
   const path = yield* _(Path.Path);
   const sshKey = yield* _(findSshPrivateKey(fs, path, process.cwd()));
   const sshCommand = buildSshCommand(template, sshKey);
-  yield* _(Effect.log(`Opening SSH: ${sshCommand}`));
+  const remoteCommandLabel = remoteCommand === void 0 ? "" : ` (${remoteCommand})`;
+  yield* _(Effect.log(`Opening SSH: ${sshCommand}${remoteCommandLabel}`));
   yield* _(ensureTerminalCursorVisible());
   yield* _(
     runCommandWithExitCodes(
       {
         cwd: process.cwd(),
         command: "ssh",
-        args: buildSshArgs(template, sshKey)
+        args: buildSshArgs(template, sshKey, remoteCommand)
       },
       [0, 130],
       (exitCode) => new CommandFailedError({ command: "ssh", exitCode })
@@ -5757,6 +5987,23 @@ const openSshBestEffort = (template) => Effect.gen(function* (_) {
     onSuccess: () => Effect.void
   })
 );
+const resolveInteractiveRemoteCommand = (projectConfig, interactiveAgent) => interactiveAgent && projectConfig.agentMode !== void 0 ? `cd '${projectConfig.targetDir}' && ${projectConfig.agentMode}` : void 0;
+const maybeOpenSsh = (command, hasAgent, waitForAgent, projectConfig) => Effect.gen(function* (_) {
+  const interactiveAgent = hasAgent && !waitForAgent;
+  if (!command.openSsh || hasAgent && !interactiveAgent) {
+    return;
+  }
+  if (!command.runUp) {
+    yield* _(Effect.logWarning("Skipping SSH auto-open: docker compose up disabled (--no-up)."));
+    return;
+  }
+  if (!isInteractiveTty()) {
+    yield* _(Effect.logWarning("Skipping SSH auto-open: not running in an interactive TTY."));
+    return;
+  }
+  const remoteCommand = resolveInteractiveRemoteCommand(projectConfig, interactiveAgent);
+  yield* _(openSshBestEffort(projectConfig, remoteCommand));
+}).pipe(Effect.asVoid);
 const runCreateProject = (path, command) => Effect.gen(function* (_) {
   if (command.runUp) {
     yield* _(ensureDockerDaemonAccess(process.cwd()));
@@ -5773,10 +6020,13 @@ const runCreateProject = (path, command) => Effect.gen(function* (_) {
     })
   );
   yield* _(logCreatedProject(resolvedOutDir, createdFiles));
+  const hasAgent = resolvedConfig.agentMode !== void 0;
+  const waitForAgent = hasAgent && (resolvedConfig.agentAuto ?? false);
   yield* _(
     runDockerUpIfNeeded(resolvedOutDir, projectConfig, {
       runUp: command.runUp,
       waitForClone: command.waitForClone,
+      waitForAgent,
       force: command.force,
       forceEnv: command.forceEnv
     })
@@ -5784,16 +6034,12 @@ const runCreateProject = (path, command) => Effect.gen(function* (_) {
   if (command.runUp) {
     yield* _(logDockerAccessInfo(resolvedOutDir, projectConfig));
   }
-  yield* _(autoSyncState(`chore(state): update ${formatStateSyncLabel(projectConfig.repoUrl)}`));
-  if (command.openSsh) {
-    if (!command.runUp) {
-      yield* _(Effect.logWarning("Skipping SSH auto-open: docker compose up disabled (--no-up)."));
-    } else if (isInteractiveTty()) {
-      yield* _(openSshBestEffort(projectConfig));
-    } else {
-      yield* _(Effect.logWarning("Skipping SSH auto-open: not running in an interactive TTY."));
-    }
+  if (waitForAgent) {
+    yield* _(Effect.log("Agent finished. Cleaning up container..."));
+    yield* _(runDockerDownCleanup(resolvedOutDir));
   }
+  yield* _(autoSyncState(`chore(state): update ${formatStateSyncLabel(projectConfig.repoUrl)}`));
+  yield* _(maybeOpenSsh(command, hasAgent, waitForAgent, projectConfig));
 }).pipe(Effect.asVoid);
 const createProject = (command) => Path.Path.pipe(Effect.flatMap((path) => runCreateProject(path, command)));
 const trimEdgeUnderscores = (value) => {
@@ -7462,7 +7708,10 @@ const booleanFlagUpdaters = {
   "--wipe": (raw) => ({ ...raw, wipe: true }),
   "--no-wipe": (raw) => ({ ...raw, wipe: false }),
   "--web": (raw) => ({ ...raw, authWeb: true }),
-  "--include-default": (raw) => ({ ...raw, includeDefault: true })
+  "--include-default": (raw) => ({ ...raw, includeDefault: true }),
+  "--claude": (raw) => ({ ...raw, agentClaude: true }),
+  "--codex": (raw) => ({ ...raw, agentCodex: true }),
+  "--auto": (raw) => ({ ...raw, agentAuto: true })
 };
 const valueFlagUpdaters = {
   repoUrl: (raw, value) => ({ ...raw, repoUrl: value }),
@@ -7808,7 +8057,14 @@ const resolveCreateBehavior = (raw) => ({
   forceEnv: raw.forceEnv ?? false,
   enableMcpPlaywright: raw.enableMcpPlaywright ?? false
 });
+const resolveAgentMode = (raw) => {
+  if (raw.agentClaude) return "claude";
+  if (raw.agentCodex) return "codex";
+  return void 0;
+};
 const buildTemplateConfig = ({
+  agentAuto,
+  agentMode,
   claudeAuthLabel,
   codexAuthLabel,
   dockerNetworkMode,
@@ -7840,7 +8096,9 @@ const buildTemplateConfig = ({
   dockerNetworkMode,
   dockerSharedNetworkName,
   enableMcpPlaywright,
-  pnpmVersion: defaultTemplateConfig.pnpmVersion
+  pnpmVersion: defaultTemplateConfig.pnpmVersion,
+  agentMode,
+  agentAuto
 });
 const buildCreateCommand = (raw) => Either.gen(function* (_) {
   const repo = yield* _(resolveRepoBasics(raw));
@@ -7854,6 +8112,8 @@ const buildCreateCommand = (raw) => Either.gen(function* (_) {
   const dockerSharedNetworkName = yield* _(
     nonEmpty("--shared-network", raw.dockerSharedNetworkName, defaultTemplateConfig.dockerSharedNetworkName)
   );
+  const agentMode = resolveAgentMode(raw);
+  const agentAuto = raw.agentAuto ?? false;
   return {
     _tag: "Create",
     outDir: paths.outDir,
@@ -7871,7 +8131,9 @@ const buildCreateCommand = (raw) => Either.gen(function* (_) {
       gitTokenLabel,
       codexAuthLabel,
       claudeAuthLabel,
-      enableMcpPlaywright: behavior.enableMcpPlaywright
+      enableMcpPlaywright: behavior.enableMcpPlaywright,
+      agentMode,
+      agentAuto
     })
   };
 });
@@ -8175,6 +8437,9 @@ Options:
   --up | --no-up            Run docker compose up after init (default: --up)
   --ssh | --no-ssh          Auto-open SSH after create/clone (default: clone=--ssh, create=--no-ssh)
   --mcp-playwright | --no-mcp-playwright  Enable Playwright MCP + Chromium sidecar (default: --no-mcp-playwright)
+  --claude                  Start Claude Code agent inside container after clone
+  --codex                   Start Codex agent inside container after clone
+  --auto                    Auto-execute: agent completes the task, creates PR and pushes (requires --claude or --codex)
   --force                   Overwrite existing files and wipe compose volumes (docker compose down -v)
   --force-env               Reset project env defaults only (keep workspace volume/data)
   -h, --help                Show this help
@@ -11100,6 +11365,7 @@ const program = pipe(
   Effect.catchTag("DockerAccessError", logWarningAndExit),
   Effect.catchTag("DockerCommandError", logWarningAndExit),
   Effect.catchTag("AuthError", logWarningAndExit),
+  Effect.catchTag("AgentFailedError", logWarningAndExit),
   Effect.catchTag("CommandFailedError", logWarningAndExit),
   Effect.catchTag("ScrapArchiveNotFoundError", logErrorAndExit),
   Effect.catchTag("ScrapTargetDirUnsupportedError", logErrorAndExit),