@technomoron/agent-run 0.99.22 → 0.99.24

package/examples/basic-config/agent-config/gitignore

@@ -3,3 +3,20 @@
 
 # Optional generated caches
 **/.agent-run-cache/
+
+# Legacy Codex runtime state
+**/auth.json
+**/history.jsonl
+**/sessions/
+**/archived_sessions/
+**/log/
+**/logs/
+**/shell_snapshots/
+**/*.sqlite*
+**/models_cache.json
+**/cache/
+**/.tmp/
+**/installation_id
+**/version.json
+**/.personality_migration
+**/skills/.system/

package/examples/basic-config/agent-config/global/skills/release-package-check/SKILL.md.njk

@@ -7,6 +7,9 @@ description: Use before package releases in {{ profile }}.
 
 Use this checklist instead of an external `repo-check` command.
 
+Require every GitHub Actions `uses:` reference to use a full commit SHA. The
+`actions/setup-node` pin must be v6-compatible and use `node-version: 24`.
+
 Run configured checks after package metadata, release notes, workflow, lockfile, and git-state review:
 
 {% for check in checks %}

package/examples/basic-config/agent-config/global/tool-templates/claude-settings.json.njk

@@ -1,24 +1,22 @@
 {% if permissionsAllow.length %}{
   "env": {
-    "AGENT_DIR": "{{ agentDir }}",
-    "AGENT_PROFILE_DIR": "{{ profileDir }}",
-    "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
-    "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
-    "STARTER_PROFILE": "{{ profile }}"
+    "AGENT_DIR": {{ agentDir | dump }},
+    "AGENT_PROFILE_DIR": {{ profileDir | dump }},
+    "AGENT_RUN_PROJECT_ROOT": {{ projectRoot | dump }},
+    "AGENT_GLOBAL_MEMORY_DIR": {{ paths.globalMemoryDir | dump }},
+    "STARTER_PROFILE": {{ profile | dump }}
   },
   "permissions": {
-    "allow": [
-      "{{ permissionsAllow | join('",\n      "') }}"
-    ]
+    "allow": {{ permissionsAllow | dump }}
   }
 }
 {% else %}{
   "env": {
-    "AGENT_DIR": "{{ agentDir }}",
-    "AGENT_PROFILE_DIR": "{{ profileDir }}",
-    "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
-    "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
-    "STARTER_PROFILE": "{{ profile }}"
+    "AGENT_DIR": {{ agentDir | dump }},
+    "AGENT_PROFILE_DIR": {{ profileDir | dump }},
+    "AGENT_RUN_PROJECT_ROOT": {{ projectRoot | dump }},
+    "AGENT_GLOBAL_MEMORY_DIR": {{ paths.globalMemoryDir | dump }},
+    "STARTER_PROFILE": {{ profile | dump }}
   }
 }
 {% endif %}

package/examples/basic-config/agent-config/global/tool-templates/codex-config.toml.njk

@@ -1,13 +1,12 @@
 # Starter global Codex config
 project_doc_max_bytes = 32768
-sandbox_mode = "danger-full-access"
+approval_policy = "on-request"
+sandbox_mode = "workspace-write"
 
 [sandbox_workspace_write]
 writable_roots = [
-  "{{ projectRoot }}",
-  "{{ agentDir }}",
-  "{{ profileDir }}",
-  "{{ paths.memoriesDir }}",
-  "{{ paths.globalMemoryDir }}"
+  {{ projectRoot | dump }},
+  {{ paths.reviewDir | dump }},
+  {{ paths.memoriesDir | dump }}
 ]
 network_access = false

package/examples/basic-config/agent-config/starter/basic-project/overrides/claude-settings.json.njk

@@ -1,25 +1,23 @@
 {% if permissionsAllow.length %}{
   "env": {
-    "AGENT_DIR": "{{ agentDir }}",
-    "AGENT_PROFILE_DIR": "{{ profileDir }}",
-    "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
-    "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
-    "STARTER_PROFILE": "{{ profile }}",
+    "AGENT_DIR": {{ agentDir | dump }},
+    "AGENT_PROFILE_DIR": {{ profileDir | dump }},
+    "AGENT_RUN_PROJECT_ROOT": {{ projectRoot | dump }},
+    "AGENT_GLOBAL_MEMORY_DIR": {{ paths.globalMemoryDir | dump }},
+    "STARTER_PROFILE": {{ profile | dump }},
     "STARTER_OVERRIDE": "true"
   },
   "permissions": {
-    "allow": [
-      "{{ permissionsAllow | join('",\n      "') }}"
-    ]
+    "allow": {{ permissionsAllow | dump }}
   }
 }
 {% else %}{
   "env": {
-    "AGENT_DIR": "{{ agentDir }}",
-    "AGENT_PROFILE_DIR": "{{ profileDir }}",
-    "AGENT_RUN_PROJECT_ROOT": "{{ projectRoot }}",
-    "AGENT_GLOBAL_MEMORY_DIR": "{{ paths.globalMemoryDir }}",
-    "STARTER_PROFILE": "{{ profile }}",
+    "AGENT_DIR": {{ agentDir | dump }},
+    "AGENT_PROFILE_DIR": {{ profileDir | dump }},
+    "AGENT_RUN_PROJECT_ROOT": {{ projectRoot | dump }},
+    "AGENT_GLOBAL_MEMORY_DIR": {{ paths.globalMemoryDir | dump }},
+    "STARTER_PROFILE": {{ profile | dump }},
     "STARTER_OVERRIDE": "true"
   }
 }

package/examples/basic-config/agent-config/starter/basic-project/overrides/codex-config.toml.njk

@@ -1,13 +1,12 @@
 # Starter profile Codex override
 project_doc_max_bytes = 65536
-sandbox_mode = "danger-full-access"
+approval_policy = "on-request"
+sandbox_mode = "workspace-write"
 
 [sandbox_workspace_write]
 writable_roots = [
-  "{{ projectRoot }}",
-  "{{ agentDir }}",
-  "{{ profileDir }}",
-  "{{ paths.memoriesDir }}",
-  "{{ paths.globalMemoryDir }}"
+  {{ projectRoot | dump }},
+  {{ paths.reviewDir | dump }},
+  {{ paths.memoriesDir | dump }}
 ]
 network_access = false

package/ops/systemd/ai-tools-update.service

@@ -1,11 +1,16 @@
 [Unit]
-Description=Update global AI and developer CLI packages
+Description=Update global AI CLI and package-manager tools
 After=network-online.target
 Wants=network-online.target
 
 [Service]
 Type=oneshot
+KillMode=process
+UMask=0022
+TimeoutStartSec=30min
 Environment=HOME=/root
-Environment=NPM_CONFIG_PREFIX=/usr
-Environment=PNPM_HOME=/usr/local/bin
+Environment=XDG_CONFIG_HOME=/root/.config
+Environment=NPM_CONFIG_PREFIX=/usr/local
+Environment=PNPM_HOME=/usr/local
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 ExecStart=/usr/local/lib/agent-run/update-ai-tools.sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/agent-run",
-  "version": "0.99.22",
+  "version": "0.99.24",
   "packageManager": "pnpm@10.28.1",
   "bin": {
     "agent-run": "dist/agent-run.js"
@@ -26,8 +26,9 @@
     "clean:dist": "rimraf ./dist/",
     "cleanbuild": "run-s clean:dist build",
     "prepack": "run-s build",
-    "test": "run-s build test:integration",
+    "test": "run-s build test:integration test:release",
     "test:integration": "bash ./scripts/test.sh",
+    "test:release": "bash ./scripts/test-release.sh",
     "release": "bash ./scripts/release.sh",
     "release:check": "bash ./scripts/release-check.sh",
     "release:preflight": "pnpm cleanbuild && pnpm test && pnpm release:check -- --local",
@@ -41,14 +42,16 @@
   },
   "homepage": "https://github.com/technomoron/agent-run#readme",
   "devDependencies": {
-    "@types/nunjucks": "^3.2.6",
+    "@types/cross-spawn": "^6.0.6",
     "@types/node": "^20.19.11",
+    "@types/nunjucks": "^3.2.6",
     "npm-run-all": "^4.1.5",
-    "pnpm": "^10.28.1",
+    "pnpm": "10.28.1",
     "rimraf": "^6.1.3",
     "typescript": "^5.9.3"
   },
   "dependencies": {
+    "cross-spawn": "^7.0.6",
     "jsonc-parser": "^3.3.1",
     "nunjucks": "^3.2.4"
   }

package/scripts/install-systemd-jobs.sh

@@ -24,7 +24,6 @@ SYSTEMD_DIR="${SYSTEMD_DIR:-/etc/systemd/system}"
 ORIGINAL_ARGS=("$@")
 
 INSTALL_AI_TOOLS=0
-INSTALL_ALL=0
 DRY_RUN=0
 
 while [ "$#" -gt 0 ]; do
@@ -34,7 +33,6 @@ while [ "$#" -gt 0 ]; do
 			shift
 			;;
 		--all)
-			INSTALL_ALL=1
 			INSTALL_AI_TOOLS=1
 			shift
 			;;

package/scripts/update-ai-tools.sh

@@ -2,22 +2,40 @@
 set -euo pipefail
 
 export HOME="${HOME:-/root}"
-export NPM_CONFIG_PREFIX="${NPM_CONFIG_PREFIX:-/usr}"
-export PNPM_HOME="${PNPM_HOME:-/usr/local/bin}"
+export NPM_CONFIG_PREFIX="${NPM_CONFIG_PREFIX:-/usr/local}"
+export PNPM_HOME="${PNPM_HOME:-/usr/local}"
 export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-}"
 
-NPM_BIN="${AI_TOOLS_NPM_BIN:-/usr/bin/npm}"
+NPM_BIN="${AI_TOOLS_NPM_BIN:-/usr/local/bin/npm}"
 APT_GET_BIN="${AI_TOOLS_APT_GET_BIN:-/usr/bin/apt-get}"
 
-AI_TOOLS_NPM_PACKAGES="${AI_TOOLS_NPM_PACKAGES:-npm pnpm netlify-cli@latest @openai/codex@latest @anthropic-ai/claude-code@latest @technomoron/agent-run@latest @technomoron/repo-check@latest}"
+AI_TOOLS_NPM_PACKAGES="${AI_TOOLS_NPM_PACKAGES:-npm@latest pnpm@latest corepack@latest fallow@latest ripgrep@latest pm2@latest tsx@latest typescript@latest @openai/codex@latest @anthropic-ai/claude-code@latest @technomoron/agent-run@latest}"
+AI_TOOLS_PNPM_PACKAGE="${AI_TOOLS_PNPM_PACKAGE:-pnpm@latest}"
 AI_TOOLS_APT_PACKAGES="${AI_TOOLS_APT_PACKAGES:-gh}"
 
+if [ "$(id -u)" -ne 0 ]; then
+	echo "update-ai-tools.sh must run as root" >&2
+	exit 1
+fi
+
 if [ -n "$AI_TOOLS_NPM_PACKAGES" ]; then
-	# shellcheck disable=SC2086
-	"$NPM_BIN" install -g --force $AI_TOOLS_NPM_PACKAGES
+	read -r -a npm_packages <<<"$AI_TOOLS_NPM_PACKAGES"
+	"$NPM_BIN" install -g --force "${npm_packages[@]}"
+fi
+
+# corepack and pnpm both own the pnpm/pnpx shims; install pnpm last so npm's
+# current pnpm package remains the command users execute.
+if [ -n "$AI_TOOLS_PNPM_PACKAGE" ]; then
+	read -r -a pnpm_packages <<<"$AI_TOOLS_PNPM_PACKAGE"
+	"$NPM_BIN" install -g --force "${pnpm_packages[@]}"
+fi
+
+CLAUDE_INSTALL="$("$NPM_BIN" root -g)/@anthropic-ai/claude-code/install.cjs"
+if [ -f "$CLAUDE_INSTALL" ]; then
+	/usr/local/bin/node "$CLAUDE_INSTALL"
 fi
 
 if [ -n "$AI_TOOLS_APT_PACKAGES" ] && command -v "$APT_GET_BIN" >/dev/null 2>&1; then
-	# shellcheck disable=SC2086
-	"$APT_GET_BIN" install --only-upgrade -y $AI_TOOLS_APT_PACKAGES
+	read -r -a apt_packages <<<"$AI_TOOLS_APT_PACKAGES"
+	"$APT_GET_BIN" install --only-upgrade -y "${apt_packages[@]}"
 fi