@redwoodjs/agent-ci 0.4.0 → 0.6.0

package/README.md

@@ -42,16 +42,35 @@ Agent CI connects to Docker via the `DOCKER_HOST` environment variable. By defau
 DOCKER_HOST=ssh://user@remote-server npx agent-ci run --workflow .github/workflows/ci.yml
 ```
 
+### Docker host resolution for job containers
+
+By default, Agent CI uses `host.docker.internal` for container-to-host DTU traffic and adds a default Docker host mapping:
+
+- `host.docker.internal:host-gateway`
+
+This keeps behavior OS-agnostic and works on Docker Desktop and modern native Docker.
+
+If your setup is custom, use environment overrides:
+
+- `AGENT_CI_DTU_HOST` - override the hostname/IP used by runner containers to reach DTU
+- `AGENT_CI_DOCKER_EXTRA_HOSTS` - comma-separated `host:ip` entries passed to Docker `ExtraHosts` (full replacement for defaults)
+- `AGENT_CI_DOCKER_HOST_GATEWAY` - override the default `host-gateway` token/IP for automatic mapping
+- `AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS=1` - disable the default `host.docker.internal` mapping
+- `AGENT_CI_DOCKER_BRIDGE_GATEWAY` - fallback gateway IP used when Agent CI runs inside Docker and cannot detect its container IP, and as an explicit DTU host override outside Docker when `AGENT_CI_DTU_HOST` is not set
+
+When using a remote daemon (`DOCKER_HOST=ssh://...`), `host-gateway` resolves relative to the remote Docker host. If DTU is not reachable from that host, set `AGENT_CI_DTU_HOST` and `AGENT_CI_DOCKER_EXTRA_HOSTS` explicitly for your network.
+
 ### `agent-ci run`
 
 Run GitHub Actions workflow jobs locally.
 
-| Flag                 | Short | Description                                                    |
-| -------------------- | ----- | -------------------------------------------------------------- |
-| `--workflow <path>`  | `-w`  | Path to the workflow file                                      |
-| `--all`              | `-a`  | Discover and run all relevant workflows for the current branch |
-| `--pause-on-failure` | `-p`  | Pause on step failure for interactive debugging                |
-| `--quiet`            | `-q`  | Suppress animated rendering (also enabled by `AI_AGENT=1`)     |
+| Flag                 | Short | Description                                                                       |
+| -------------------- | ----- | --------------------------------------------------------------------------------- |
+| `--workflow <path>`  | `-w`  | Path to the workflow file                                                         |
+| `--all`              | `-a`  | Discover and run all relevant workflows for the current branch                    |
+| `--pause-on-failure` | `-p`  | Pause on step failure for interactive debugging                                   |
+| `--quiet`            | `-q`  | Suppress animated rendering (also enabled by `AI_AGENT=1`)                        |
+| `--no-matrix`        |       | Collapse all matrix combinations into a single job (uses first value of each key) |
 
 ### `agent-ci retry`
 

package/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: agent-ci
+description: Run GitHub Actions workflows locally with pause-on-failure for AI-agent-driven CI iteration
+keywords: [github-actions, local-ci, pause-on-failure, ai-agent, runner]
+---
+
+## What agent-ci does
+
+Runs the official GitHub Actions runner binary locally (in Docker), emulating GitHub's cloud API.
+Cache is bind-mounted (instant). When a step fails, the container pauses — you can fix and retry the failed step without restarting.
+
+## When to use agent-ci (not `act`)
+
+- You want bit-for-bit compatibility with remote GitHub Actions
+- You need pause-on-failure for AI agent debugging loops
+- Cache round-trip speed matters
+
+## Key commands
+
+- Run workflow: `npx @redwoodjs/agent-ci run --workflow <path>`
+- Run all relevant workflows (those whose `on` triggers match the current branch/event, just like GitHub): `npx @redwoodjs/agent-ci run --all`
+- Retry after fix: `npx @redwoodjs/agent-ci retry --name <runner>`
+- Abort: `npx @redwoodjs/agent-ci abort --name <runner>`
+
+## Common mistakes
+
+- Don't push to remote CI to test changes — use `npx @redwoodjs/agent-ci run` locally first
+- Don't use `--from-start` when only the last step failed — use `retry` with no flags to re-run only the failed step
+- The `AI_AGENT=1` env variable disables animated output for cleaner agent logs
+- Use `--no-matrix` to collapse matrix jobs into a single run — your local machine is likely faster than GitHub's runners, so parallelizing across matrix combinations is unnecessary

package/dist/cli.js

@@ -21,6 +21,7 @@ import { renderRunState } from "./output/state-renderer.js";
 import { isAgentMode, setQuietMode } from "./output/agent-mode.js";
 import logUpdate from "log-update";
 import { createFailedJobResult, wrapJobError, isJobError } from "./runner/job-result.js";
+import { postCommitStatus } from "./commit-status.js";
 function findSignalsDir(runnerName) {
     const workDir = getWorkingDirectory();
     const runsDir = path.resolve(workDir, "runs");
@@ -130,6 +131,7 @@ async function run() {
                 noMatrix,
             });
             printSummary(results);
+            postCommitStatus(results, sha);
             const anyFailed = results.some((r) => !r.succeeded);
             process.exit(anyFailed ? 1 : 0);
         }
@@ -162,6 +164,7 @@ async function run() {
             noMatrix,
         });
         printSummary(results);
+        postCommitStatus(results, sha);
         if (results.some((r) => !r.succeeded)) {
             process.exit(1);
         }

package/dist/commit-status.js

@@ -0,0 +1,48 @@
+import { execSync } from "child_process";
+import { config } from "./config.js";
+/**
+ * Post a GitHub commit status via the `gh` CLI.
+ * Silently skips if `gh` is not available on PATH.
+ */
+export function postCommitStatus(results, sha) {
+    // Check if gh CLI is available
+    try {
+        execSync("which gh", { stdio: "ignore" });
+    }
+    catch {
+        return;
+    }
+    const resolvedSha = sha ||
+        (() => {
+            try {
+                return execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
+            }
+            catch {
+                return undefined;
+            }
+        })();
+    if (!resolvedSha) {
+        return;
+    }
+    const repo = config.GITHUB_REPO;
+    if (repo === "unknown/unknown") {
+        return;
+    }
+    const passed = results.filter((r) => r.succeeded).length;
+    const total = results.length;
+    const allPassed = passed === total;
+    const state = allPassed ? "success" : "failure";
+    const description = allPassed
+        ? `"It works on my machine!"`
+        : `${passed}/${total} jobs passed, ${total - passed} failed`;
+    try {
+        execSync(`gh api repos/${repo}/statuses/${resolvedSha} ` +
+            `-f state=${state} ` +
+            `-f context=agent-ci ` +
+            `-f description=${JSON.stringify(description)} ` +
+            `-f target_url=https://agent-ci.dev`, { stdio: "ignore" });
+    }
+    catch {
+        // gh command failed (e.g. no auth, no network) — skip silently
+    }
+}

package/dist/docker/container-config.js

@@ -97,32 +97,74 @@ export function buildContainerCmd(opts) {
 // ─── DTU host resolution ──────────────────────────────────────────────────────
 import fs from "fs";
 import { execSync } from "child_process";
-/**
- * Resolve the DTU host address that nested Docker containers can reach.
- * Inside Docker: use the container's own bridge IP.
- * On host: use `host.docker.internal`.
- */
-export function resolveDtuHost() {
-    const isInsideDocker = fs.existsSync("/.dockerenv");
-    if (!isInsideDocker) {
-        return "host.docker.internal";
+import { debugRunner } from "../output/debug.js";
+const DEFAULT_DTU_HOST_ALIAS = "host.docker.internal";
+const DEFAULT_DOCKER_BRIDGE_GATEWAY = "172.17.0.1";
+const DEFAULT_DOCKER_HOST_GATEWAY = "host-gateway";
+function isLoopbackHostname(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function parseCsvEnv(value) {
+    return value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+export async function resolveDtuHost() {
+    const configuredHost = process.env.AGENT_CI_DTU_HOST?.trim();
+    if (configuredHost) {
+        return configuredHost;
     }
-    try {
-        const ip = execSync("hostname -I 2>/dev/null | awk '{print $1}'", {
-            encoding: "utf8",
-        }).trim();
-        if (ip) {
-            return ip;
+    const isInsideDocker = fs.existsSync("/.dockerenv");
+    if (isInsideDocker) {
+        try {
+            const ip = execSync("hostname -I 2>/dev/null | awk '{print $1}'", {
+                encoding: "utf8",
+            }).trim();
+            if (ip) {
+                return ip;
+            }
         }
+        catch (error) {
+            debugRunner(`Failed to resolve Docker bridge IP via hostname -I: ${String(error)}`);
+        }
+        return process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY?.trim() || DEFAULT_DOCKER_BRIDGE_GATEWAY;
+    }
+    const configuredGateway = process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY?.trim();
+    if (configuredGateway) {
+        debugRunner(`Using configured bridge gateway '${configuredGateway}' for DTU host outside Docker`);
+        return configuredGateway;
+    }
+    return DEFAULT_DTU_HOST_ALIAS;
+}
+export function resolveDockerExtraHosts(dtuHost) {
+    const configuredExtraHosts = process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+    if (configuredExtraHosts !== undefined) {
+        const parsed = parseCsvEnv(configuredExtraHosts);
+        return parsed.length > 0 ? parsed : undefined;
     }
-    catch { }
-    return "172.17.0.1"; // fallback to bridge gateway
+    if (process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS === "1") {
+        return undefined;
+    }
+    if (dtuHost !== DEFAULT_DTU_HOST_ALIAS) {
+        return undefined;
+    }
+    const gateway = process.env.AGENT_CI_DOCKER_HOST_GATEWAY?.trim() || DEFAULT_DOCKER_HOST_GATEWAY;
+    return [`${DEFAULT_DTU_HOST_ALIAS}:${gateway}`];
 }
 /**
  * Rewrite a DTU URL to be reachable from inside Docker containers.
  */
 export function resolveDockerApiUrl(dtuUrl, dtuHost) {
-    return dtuUrl.replace("localhost", dtuHost).replace("127.0.0.1", dtuHost);
+    const parsed = new URL(dtuUrl);
+    if (isLoopbackHostname(parsed.hostname)) {
+        parsed.hostname = dtuHost;
+    }
+    const serialized = parsed.toString();
+    if (parsed.pathname === "/" && !parsed.search && !parsed.hash && serialized.endsWith("/")) {
+        return serialized.slice(0, -1);
+    }
+    return serialized;
 }
 let _mountMappings = null;
 /**

package/dist/docker/container-config.test.js

@@ -1,4 +1,8 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, afterEach, vi } from "vitest";
+import fs from "node:fs";
+afterEach(() => {
+    vi.restoreAllMocks();
+});
 // ── buildContainerEnv ─────────────────────────────────────────────────────────
 describe("buildContainerEnv", () => {
     it("builds the standard env array", async () => {
@@ -127,6 +131,118 @@ describe("resolveDockerApiUrl", () => {
         const { resolveDockerApiUrl } = await import("./container-config.js");
         expect(resolveDockerApiUrl("http://127.0.0.1:3000", "host.docker.internal")).toBe("http://host.docker.internal:3000");
     });
+    it("preserves path and query components", async () => {
+        const { resolveDockerApiUrl } = await import("./container-config.js");
+        expect(resolveDockerApiUrl("http://localhost:8910/api/v1?foo=bar", "10.0.0.8")).toBe("http://10.0.0.8:8910/api/v1?foo=bar");
+    });
+    it("keeps implicit https default port behavior", async () => {
+        const { resolveDockerApiUrl } = await import("./container-config.js");
+        expect(resolveDockerApiUrl("https://localhost", "host.docker.internal")).toBe("https://host.docker.internal");
+    });
+    it("does not rewrite non-loopback hosts", async () => {
+        const { resolveDockerApiUrl } = await import("./container-config.js");
+        expect(resolveDockerApiUrl("https://dtu.internal.example.com:8910", "host.docker.internal")).toBe("https://dtu.internal.example.com:8910");
+    });
+});
+describe("resolveDtuHost", () => {
+    const originalBridgeGateway = process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
+    afterEach(() => {
+        if (originalBridgeGateway === undefined) {
+            delete process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY = originalBridgeGateway;
+        }
+    });
+    it("uses host alias when available outside Docker", async () => {
+        const { resolveDtuHost } = await import("./container-config.js");
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        await expect(resolveDtuHost()).resolves.toBe("host.docker.internal");
+    });
+    it("uses configured bridge gateway outside Docker when provided", async () => {
+        const { resolveDtuHost } = await import("./container-config.js");
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        process.env.AGENT_CI_DOCKER_BRIDGE_GATEWAY = "10.10.0.1";
+        await expect(resolveDtuHost()).resolves.toBe("10.10.0.1");
+    });
+    it("uses host alias outside Docker when no gateway override is configured", async () => {
+        const { resolveDtuHost } = await import("./container-config.js");
+        const originalExistsSync = fs.existsSync;
+        vi.spyOn(fs, "existsSync").mockImplementation((filePath) => {
+            if (filePath === "/.dockerenv") {
+                return false;
+            }
+            return originalExistsSync(filePath);
+        });
+        await expect(resolveDtuHost()).resolves.toBe("host.docker.internal");
+    });
+});
+describe("resolveDockerExtraHosts", () => {
+    const originalExtraHosts = process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+    const originalDisable = process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+    const originalGateway = process.env.AGENT_CI_DOCKER_HOST_GATEWAY;
+    afterEach(() => {
+        if (originalExtraHosts === undefined) {
+            delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_EXTRA_HOSTS = originalExtraHosts;
+        }
+        if (originalDisable === undefined) {
+            delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS = originalDisable;
+        }
+        if (originalGateway === undefined) {
+            delete process.env.AGENT_CI_DOCKER_HOST_GATEWAY;
+        }
+        else {
+            process.env.AGENT_CI_DOCKER_HOST_GATEWAY = originalGateway;
+        }
+    });
+    it("maps host.docker.internal to host-gateway by default", async () => {
+        delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        delete process.env.AGENT_CI_DOCKER_HOST_GATEWAY;
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("host.docker.internal")).toEqual([
+            "host.docker.internal:host-gateway",
+        ]);
+    });
+    it("uses AGENT_CI_DOCKER_EXTRA_HOSTS when provided", async () => {
+        process.env.AGENT_CI_DOCKER_EXTRA_HOSTS = "host.docker.internal:172.17.0.1,api.local:10.0.0.2";
+        delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("host.docker.internal")).toEqual([
+            "host.docker.internal:172.17.0.1",
+            "api.local:10.0.0.2",
+        ]);
+    });
+    it("returns undefined when defaults are disabled", async () => {
+        delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS = "1";
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("host.docker.internal")).toBeUndefined();
+    });
+    it("does not add default mapping for non-host.docker.internal hosts", async () => {
+        delete process.env.AGENT_CI_DOCKER_EXTRA_HOSTS;
+        delete process.env.AGENT_CI_DOCKER_DISABLE_DEFAULT_EXTRA_HOSTS;
+        const { resolveDockerExtraHosts } = await import("./container-config.js");
+        expect(resolveDockerExtraHosts("10.10.10.10")).toBeUndefined();
+    });
 });
 // ── signalsDir bind-mount ─────────────────────────────────────────────────────
 describe("buildContainerBinds with signalsDir", () => {

package/dist/output/reporter.js

@@ -23,14 +23,12 @@ export function printSummary(results, runDir) {
             else {
                 process.stdout.write(`  ✗ ${f.workflow} > ${f.taskId}\n`);
             }
-            if (f.failedExitCode !== undefined) {
-                process.stdout.write(`    Exit code: ${f.failedExitCode}\n`);
+            if (f.failedStepLogPath && fs.existsSync(f.failedStepLogPath)) {
+                const content = fs.readFileSync(f.failedStepLogPath, "utf-8");
+                process.stdout.write("\n" + content);
             }
-            if (f.lastOutputLines && f.lastOutputLines.length > 0) {
-                process.stdout.write(`    Last output:\n`);
-                for (const line of f.lastOutputLines) {
-                    process.stdout.write(`      ${line}\n`);
-                }
+            else if (f.lastOutputLines && f.lastOutputLines.length > 0) {
+                process.stdout.write("\n" + f.lastOutputLines.join("\n") + "\n");
             }
             process.stdout.write("\n");
         }

package/dist/output/reporter.test.js

@@ -0,0 +1,73 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { printSummary } from "./reporter.js";
+function makeResult(overrides = {}) {
+    return {
+        name: "container-1",
+        workflow: "retry-proof.yml",
+        taskId: "test",
+        succeeded: false,
+        durationMs: 1000,
+        debugLogPath: "/tmp/debug.log",
+        ...overrides,
+    };
+}
+describe("printSummary", () => {
+    let tmpDir;
+    let output;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "reporter-test-"));
+        output = "";
+        vi.spyOn(process.stdout, "write").mockImplementation((chunk) => {
+            output += chunk;
+            return true;
+        });
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it("outputs full step log content when failedStepLogPath exists", () => {
+        const logPath = path.join(tmpDir, "Run-assertion-test.log");
+        fs.writeFileSync(logPath, "line 1\nline 2\nline 3\n");
+        printSummary([
+            makeResult({
+                failedStep: "Run assertion test",
+                failedStepLogPath: logPath,
+                lastOutputLines: ["last line only"],
+            }),
+        ]);
+        expect(output).toContain("line 1\nline 2\nline 3\n");
+        expect(output).not.toContain("last line only");
+        expect(output).not.toContain("Last output:");
+        expect(output).not.toContain("Exit code:");
+    });
+    it("falls back to lastOutputLines when failedStepLogPath is absent", () => {
+        printSummary([
+            makeResult({
+                failedStep: "Run assertion test",
+                lastOutputLines: ["fallback line 1", "fallback line 2"],
+            }),
+        ]);
+        expect(output).toContain("fallback line 1\nfallback line 2");
+        expect(output).not.toContain("Last output:");
+    });
+    it("shows the failed step name in the FAILURES section", () => {
+        const logPath = path.join(tmpDir, "step.log");
+        fs.writeFileSync(logPath, "error output\n");
+        printSummary([
+            makeResult({
+                failedStep: "Run assertion test",
+                failedStepLogPath: logPath,
+            }),
+        ]);
+        expect(output).toContain('✗ retry-proof.yml > test > "Run assertion test"');
+    });
+    it("shows pass count in summary for a successful run", () => {
+        printSummary([makeResult({ succeeded: true })]);
+        expect(output).toContain("✓ 1 passed");
+        expect(output).not.toContain("FAILURES");
+    });
+});

package/dist/runner/local-job.js

@@ -15,7 +15,7 @@ import { writeJobMetadata } from "./metadata.js";
 import { computeFakeSha, writeGitShim } from "./git-shim.js";
 import { prepareWorkspace } from "./workspace.js";
 import { createRunDirectories } from "./directory-setup.js";
-import { buildContainerEnv, buildContainerBinds, buildContainerCmd, resolveDtuHost, resolveDockerApiUrl, } from "../docker/container-config.js";
+import { buildContainerEnv, buildContainerBinds, buildContainerCmd, resolveDtuHost, resolveDockerApiUrl, resolveDockerExtraHosts, } from "../docker/container-config.js";
 import { buildJobResult, sanitizeStepName } from "./result-builder.js";
 import { wrapJobSteps, appendOutputCaptureStep } from "./step-wrapper.js";
 import { syncWorkspaceForRetry } from "./sync.js";
@@ -115,8 +115,17 @@ export async function executeLocalJob(job, options) {
     // own isolated DTU instance on a random port — eliminating port conflicts.
     let t0 = Date.now();
     const dtuCacheDir = path.resolve(getWorkingDirectory(), "cache", "dtu");
-    const ephemeralDtu = await startEphemeralDtu(dtuCacheDir).catch(() => null);
+    let ephemeralDtu = null;
+    try {
+        ephemeralDtu = await startEphemeralDtu(dtuCacheDir);
+        debugRunner(`DTU server started - CLI URL: ${ephemeralDtu.url}, Container URL: ${ephemeralDtu.containerUrl}`);
+    }
+    catch (e) {
+        debugRunner(`Failed to start ephemeral DTU: ${e}`);
+    }
+    // CLI uses url (127.0.0.1), containers use containerUrl (host IP)
     const dtuUrl = ephemeralDtu?.url ?? config.GITHUB_API_URL;
+    const dtuContainerUrl = ephemeralDtu?.containerUrl ?? dtuUrl;
     t0 = bt("dtu-start", t0);
     await fetch(`${dtuUrl}/_dtu/start-runner`, {
         method: "POST",
@@ -219,12 +228,15 @@ export async function executeLocalJob(job, options) {
             bt("workspace-prep", workspacePrepStart);
         })();
         // 6. Spawn container
-        const dtuPort = new URL(dtuUrl).port || "80";
-        const dtuHost = resolveDtuHost();
-        const dockerApiUrl = resolveDockerApiUrl(dtuUrl, dtuHost);
+        const dtuHost = await resolveDtuHost();
+        const dockerApiUrl = resolveDockerApiUrl(dtuContainerUrl, dtuHost);
+        const parsedDockerApiUrl = new URL(dockerApiUrl);
+        const dtuPort = parsedDockerApiUrl.port || (parsedDockerApiUrl.protocol === "https:" ? "443" : "80");
         const githubRepo = job.githubRepo || config.GITHUB_REPO;
         const repoUrl = `${dockerApiUrl}/${githubRepo}`;
         debugRunner(`Spawning container ${containerName}...`);
+        debugRunner(`DTU config - Port: ${dtuPort}, Host: ${dtuHost}, Docker API: ${dockerApiUrl}`);
+        debugRunner(`Runner will connect to: ${repoUrl}`);
         // Pre-cleanup: remove any stale container with the same name
         try {
             const stale = docker.getContainer(containerName);
@@ -333,6 +345,7 @@ export async function executeLocalJob(job, options) {
             useDirectContainer,
             containerName,
         });
+        const extraHosts = resolveDockerExtraHosts(dtuHost);
         t0 = Date.now();
         const container = await docker.createContainer({
             Image: containerImage,
@@ -345,6 +358,7 @@ export async function executeLocalJob(job, options) {
                 AutoRemove: false,
                 Ulimits: [{ Name: "nofile", Soft: 65536, Hard: 65536 }],
                 ...(serviceCtx ? { NetworkMode: serviceCtx.networkName } : {}),
+                ...(extraHosts ? { ExtraHosts: extraHosts } : {}),
             },
             Tty: true,
         });

package/package.json

@@ -1,8 +1,20 @@
 {
   "name": "@redwoodjs/agent-ci",
-  "version": "0.4.0",
-  "description": "Local GitHub Actions runner",
-  "keywords": [],
+  "version": "0.6.0",
+  "description": "Local GitHub Actions runner — pause on failure, ~0ms cache, official runner binary. Built for AI coding agents.",
+  "keywords": [
+    "act-alternative",
+    "ai-agent",
+    "ci",
+    "coding-agent",
+    "devtools",
+    "github-actions",
+    "local-ci",
+    "local-runner",
+    "pause-on-failure",
+    "runner",
+    "workflow"
+  ],
   "license": "FSL-1.1-MIT",
   "author": "",
   "repository": {
@@ -15,7 +27,8 @@
   },
   "files": [
     "dist",
-    "shim.sh"
+    "shim.sh",
+    "SKILL.md"
   ],
   "type": "module",
   "publishConfig": {
@@ -27,7 +40,7 @@
     "log-update": "^7.2.0",
     "minimatch": "^10.2.1",
     "yaml": "^2.8.2",
-    "dtu-github-actions": "0.4.0"
+    "dtu-github-actions": "0.6.0"
   },
   "devDependencies": {
     "@types/dockerode": "^3.3.34",