@technomoron/agent-run 0.99.37 → 0.99.39

package/CHANGES

@@ -1,6 +1,21 @@
 CHANGES
 =======
 
+Version 0.99.39 (2026-09-11)
+----------------------------
+* Fix the AI tools updater failing under sudo or a root shell with inherited
+  SUDO_USER when configuring root-owned pnpm paths.
+* Allow Claude, Grok, and esbuild install hooks during global npm updates,
+  and remove the duplicate manual Claude install step.
+
+Version 0.99.38 (2026-09-11)
+----------------------------
+* Add agent-brain pull, push, and save commands without --confirmed. Save
+  generates a commit message and pushes the saved changes.
+* Make agent-brain sync commit, pull, and push; move the preview to sync status.
+* Report completed sync steps and preserve useful progress details on failure.
+* Allow prompt-driven MCP sync without a supplied message or confirmation field.
+
 Version 0.99.37 (2026-09-11)
 ----------------------------
 * Skip brain lookups for ordinary questions unless saved knowledge is needed,

package/README.md

@@ -939,15 +939,25 @@ a local task does not close a GitHub issue or modify a Trello card.
 ### Git portability
 
 ```sh
-agent-brain sync
-agent-brain sync init --confirmed
-agent-brain sync save --confirmed --message "Your approved commit message"
-agent-brain sync pull --confirmed
-agent-brain sync push --confirmed
+agent-brain sync status   # Preview Git status and eligible files
+agent-brain sync init     # Initialize the configuration Git repository
+agent-brain save          # Commit local brain changes and push
+agent-brain pull          # Pull remote changes with rebase
+agent-brain push          # Push existing commits
+agent-brain sync          # Commit local changes, pull, then push
 ```
 
-The command without an action previews Git status and eligible files. Saving
-includes Markdown knowledge, skills, tasks, project metadata, and `.gitignore`.
+Commands need no `--confirmed` flag. Saving generates a commit message from the
+number of changed files; use `--message "Your message"` to override it. Output
+reports completed steps, including a local commit if a later pull or push fails.
+Existing `agent-brain sync save|pull|push` forms remain supported. Bare
+`agent-brain sync` now performs synchronization; use `sync status` for a preview.
+
+From an agent prompt, ask to "save brain changes" or "sync brain". The MCP `sync`
+tool accepts the same actions and an optional message, without a confirmation
+parameter. Agents still need a user request or standing authorization to sync.
+
+Saving includes Markdown knowledge, skills, tasks, project metadata, and `.gitignore`.
 It also includes all regular files under each scope's `templates/` directory,
 including nested Nunjucks templates and supporting files. Template additions,
 edits, and deletions are synced; symlinks are rejected.
@@ -961,8 +971,10 @@ profile markers and shared templates, then update source roots in `config.yaml`
 to match that machine.
 
 The configuration directory must itself be the repository root. Pull uses rebase
-and reports conflicted files; resolve conflicts before syncing again. Each action
-requires explicit authorization. There are no automatic commits, pulls, or pushes.
+and reports conflicted files; resolve the rebase before syncing again. Sync stops
+on failure without pushing. Commands apply across all scopes in the configuration
+repository, not just the current code project. Background commits and pushes are
+not performed; the service can optionally pull at startup as described below.
 
 ### Persistent service under apicore-server
 
@@ -1058,6 +1070,12 @@ npm, pnpm, corepack, fallow, ripgrep, pm2, tsx, typescript,
 @xai-official/grok, and @technomoron/agent-run
 ```
 
+The updater clears inherited `SUDO_USER` for its root-owned pnpm configuration
+writes, so it works both under sudo and from a root shell. It explicitly allows
+the Claude, Grok, esbuild, and pnpm install hooks. Optional native build hooks
+such as keytar and node-pty remain subject to npm's script policy; the updater
+does not enable native compilation or require a working node-gyp installation.
+
 The optional apt package list still defaults to `gh` and can be changed with
 `AI_TOOLS_APT_PACKAGES`.
 

package/dist/brain/cli.js

@@ -50,7 +50,8 @@ async function brainMain(argv, wrapperCommand) {
             'agent-brain todo update <id> --revision <hash> --json <changes>',
             'agent-brain todo complete <id> --revision <hash>',
             'agent-brain todo import|sync <connector> --scope <scope>',
-            'agent-brain sync [init|save|pull|push --confirmed] [--message <commit-message>]',
+            'agent-brain pull | push | save | sync [--message <commit-message>]',
+            'agent-brain sync status | init',
             'agent-brain serve [--pull] [--socket <path>] | mcp [--socket <path>]',
             'agent-run create <name> [--quick | --guided]',
             'agent-run project list | info | bootstrap',
@@ -169,17 +170,23 @@ async function brainMain(argv, wrapperCommand) {
                     throw new Error('Usage: agent-brain review list | resolve <id> --revision <hash> --state fixed|wontfix');
                 break;
             }
+            case 'pull':
+            case 'push':
+            case 'save':
             case 'sync': {
-                const action = positionals[0];
-                if (!action) {
+                const action = command === 'sync' ? positionals.shift() ?? 'sync' : command;
+                if (positionals.length)
+                    throw new Error('Unexpected arguments; use agent-brain --help');
+                if (action === 'status') {
                     report((0, git_1.gitPreview)(store));
                     break;
                 }
-                if (!['init', 'save', 'pull', 'push'].includes(action))
+                if (!['init', 'save', 'pull', 'push', 'sync'].includes(action))
                     throw new Error('Unknown sync action');
-                if (!values.confirmed)
-                    throw new Error('Review agent-brain sync output and obtain authorization before using --confirmed');
-                report((0, git_1.syncGit)(store, action, values.message));
+                const result = (0, git_1.syncGit)(store, action, values.message);
+                process.stdout.write(`${result.steps.join('\n')}\n`);
+                if (result.files.length)
+                    process.stdout.write(`Other local changes remain. Use agent-brain sync status to inspect them.\n`);
                 break;
             }
             case 'todo': {

package/dist/brain/git.js

@@ -59,44 +59,57 @@ function syncableFiles(store) {
 }
 function syncGit(store, action, message) {
     return store.writeLocked(() => {
-        if (action === 'init') {
-            if (!fs.existsSync(path.join(store.configRoot, '.git')))
-                git(store.configRoot, ['init', '--initial-branch=main']);
-            return gitStatus(store);
-        }
-        requireRepository(store);
-        const status = gitStatus(store);
-        if (status.state === 'conflicted')
-            throw new Error(`Resolve Git conflicts before syncing: ${status.conflicts.join(', ')}`);
-        if (action === 'save') {
-            if (!message?.trim())
-                throw new Error('Supply a commit message after reviewing the files to save.');
-            if (git(store.configRoot, ['diff', '--cached', '--name-only']))
-                throw new Error('The Git index already has staged changes. Commit or unstage them before saving brain knowledge.');
-            const files = syncableFiles(store);
-            if (!files.length)
-                return status;
-            git(store.configRoot, ['add', '--', ...files]);
-            if (git(store.configRoot, ['diff', '--cached', '--name-only']))
-                git(store.configRoot, ['commit', '-m', message]);
-        }
-        else if (action === 'pull') {
-            if (git(store.configRoot, ['diff', '--name-only']) || git(store.configRoot, ['diff', '--cached', '--name-only']))
-                throw new Error('Save or resolve local tracked configuration changes before pulling.');
-            try {
-                git(store.configRoot, ['pull', '--rebase']);
+        const steps = [];
+        try {
+            if (action === 'init') {
+                if (!fs.existsSync(path.join(store.configRoot, '.git')))
+                    git(store.configRoot, ['init', '--initial-branch=main']);
+                return { ...gitStatus(store), steps: ['Configuration Git repository initialized.'] };
+            }
+            requireRepository(store);
+            const status = gitStatus(store);
+            if (status.state === 'conflicted')
+                throw new Error(`Resolve Git conflicts before syncing: ${status.conflicts.join(', ')}`);
+            if (action === 'save' || action === 'sync') {
+                if (message !== undefined && !message.trim())
+                    throw new Error('The commit message must not be empty.');
+                if (git(store.configRoot, ['diff', '--cached', '--name-only']))
+                    throw new Error('The Git index already has staged changes. Commit or unstage them before saving brain knowledge.');
+                const files = syncableFiles(store);
+                if (files.length)
+                    git(store.configRoot, ['add', '--', ...files]);
+                const changed = git(store.configRoot, ['diff', '--cached', '--name-only', '-z']).split('\0').filter(Boolean);
+                if (changed.length) {
+                    const commitMessage = message ?? `Update brain knowledge (${changed.length} ${changed.length === 1 ? 'file' : 'files'})`;
+                    git(store.configRoot, ['commit', '-m', commitMessage]);
+                    steps.push(`Saved ${changed.length} ${changed.length === 1 ? 'file' : 'files'} in commit ${git(store.configRoot, ['rev-parse', '--short', 'HEAD'])}: ${commitMessage}`);
+                }
+                else
+                    steps.push('No local brain changes to save.');
+            }
+            if (action === 'pull' || action === 'sync') {
+                if (git(store.configRoot, ['diff', '--name-only']) || git(store.configRoot, ['diff', '--cached', '--name-only']))
+                    throw new Error('Save or resolve local tracked configuration changes before pulling.');
+                try {
+                    git(store.configRoot, ['-c', 'merge.autoStash=false', '-c', 'rebase.autoStash=false', 'pull', '--rebase']);
+                }
+                catch (error) {
+                    const after = gitStatus(store);
+                    if (after.state === 'conflicted')
+                        throw new Error(`Pull stopped with conflicts: ${after.conflicts.join(', ')}. Resolve the rebase before syncing again.`);
+                    throw new Error(`Pull failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                steps.push('Pulled remote changes.');
             }
-            catch (error) {
-                const after = gitStatus(store);
-                if (after.state === 'conflicted')
-                    return after;
-                throw error;
+            if (action === 'push' || action === 'save' || action === 'sync') {
+                git(store.configRoot, ['push']);
+                steps.push('Push completed; remote is up to date.');
             }
+            return { ...gitStatus(store), steps };
         }
-        else {
-            git(store.configRoot, ['push']);
+        catch (error) {
+            throw new Error([...steps, error instanceof Error ? error.message : String(error)].join('\n'));
         }
-        return gitStatus(store);
     });
 }
 function gitPreview(store) {

package/dist/brain/server.js

@@ -42,8 +42,8 @@ function createBrainServer(store) {
     const revision = zod_1.z.string().regex(/^[a-f0-9]{64}$/);
     tool('brain_status', 'Show the active project and available scopes.', {}, true, () => ({ profile: store.profile, scopes: store.scopes.map((entry) => entry.scope) }));
     tool('sync_status', 'Preview Git state and the canonical files eligible for saving. Runtime files, indexes, credentials, and native agent state are excluded.', {}, true, () => (0, git_1.gitPreview)(store));
-    server.registerTool('sync', { description: 'Initialize, save, pull, or push the configuration Git repository. Review sync_status first. Requires explicit user authorization; saving also requires the approved commit message.',
-        inputSchema: { action: zod_1.z.enum(['init', 'save', 'pull', 'push']), confirmed: zod_1.z.literal(true), message: zod_1.z.string().min(1).max(1000).optional() },
+    server.registerTool('sync', { description: 'Synchronize the configuration Git repository when the user requests it. save commits and pushes; sync commits, pulls with rebase, then pushes; pull and push only transfer existing commits. Commit messages are generated unless supplied. Use sync_status to inspect eligible files.',
+        inputSchema: { action: zod_1.z.enum(['init', 'save', 'pull', 'push', 'sync']), confirmed: zod_1.z.literal(true).optional(), message: zod_1.z.string().min(1).max(1000).optional() },
         annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true }
     }, async ({ action, message }) => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/agent-run",
-  "version": "0.99.37",
+  "version": "0.99.39",
   "packageManager": "pnpm@10.34.5",
   "bin": {
     "agent-run": "dist/agent-run.js",

package/scripts/update-ai-tools.sh

@@ -51,22 +51,19 @@ if [ "${1:-}" = --agent-brain ]; then
 	exit 0
 fi
 
-"$NPM_BIN" install -g --force "${packages[@]}"
+"$NPM_BIN" install -g --force "${packages[@]}" --allow-scripts=@anthropic-ai/claude-code,@xai-official/grok,esbuild
 ensure_brain
 
 # corepack and pnpm both own the pnpm/pnpx shims; install pnpm last so npm's
 # current pnpm package remains the command users execute.
 "$NPM_BIN" install -g --force pnpm@latest --allow-scripts=pnpm
 
+# This updater deliberately manages root-owned tooling. pnpm rejects inherited
+# sudo identity even in a root shell; clear it only for these configuration writes.
 install -d -o root -g root -m 0755 /usr/local/share/pnpm/global /usr/local/share/pnpm/store /usr/local/bin
-"$PNPM_BIN" config set --global global-dir /usr/local/share/pnpm/global
-"$PNPM_BIN" config set --global global-bin-dir /usr/local/bin
-"$PNPM_BIN" config set --global store-dir /usr/local/share/pnpm/store
-
-CLAUDE_INSTALL="$("$NPM_BIN" root -g)/@anthropic-ai/claude-code/install.cjs"
-if [ -f "$CLAUDE_INSTALL" ]; then
-	"$NODE_BIN" "$CLAUDE_INSTALL"
-fi
+env -u SUDO_USER "$PNPM_BIN" config set --global global-dir /usr/local/share/pnpm/global
+env -u SUDO_USER "$PNPM_BIN" config set --global global-bin-dir /usr/local/bin
+env -u SUDO_USER "$PNPM_BIN" config set --global store-dir /usr/local/share/pnpm/store
 
 if [ -n "$AI_TOOLS_APT_PACKAGES" ] && command -v "$APT_GET_BIN" >/dev/null 2>&1; then
 	read -r -a apt_packages <<<"$AI_TOOLS_APT_PACKAGES"