@workermill/agent 0.8.5 → 0.8.8

package/dist/commands/setup.js

@@ -311,29 +311,9 @@ export async function setupCommand() {
         }
         process.exit(1);
     }
-    // SCM token
-    const tokenPrompts = {
-        github: "",
-        bitbucket: "",
-        gitlab: "",
-    };
-    const scmLabel = scmProvider === "bitbucket"
-        ? "Bitbucket"
-        : scmProvider === "gitlab"
-            ? "GitLab"
-            : "GitHub";
-    const { scmToken } = await inquirer.prompt([
-        {
-            type: "password",
-            name: "scmToken",
-            message: `${scmLabel} personal access token (for cloning/pushing to your repos):`,
-            mask: "*",
-            validate: (v) => (v.length > 0 ? true : "A token is required for workers to clone and push to your repositories"),
-        },
-    ]);
-    if (scmToken) {
-        tokenPrompts[scmProvider] = scmToken;
-    }
+    // SCM tokens come from org Settings > Integrations (no local prompt needed)
+    console.log(chalk.dim("  SCM tokens are managed via Settings > Integrations on the dashboard."));
+    console.log();
     const { agentId } = await inquirer.prompt([
         {
             type: "input",
@@ -342,36 +322,72 @@ export async function setupCommand() {
             default: `agent-${hostname()}`,
         },
     ]);
-    // ── Step 7: Pull worker image ─────────────────────────────────────────────
+    // ── Step 7: AWS CLI + ECR auth + pull worker image ───────────────────────
     console.log();
-    const workerImage = "public.ecr.aws/a7k5r0v0/workermill-worker:latest";
-    console.log(chalk.dim(`  Pulling worker image: ${workerImage}`));
-    console.log(chalk.dim("  This may take a few minutes on first run (~1.1 GB)..."));
-    console.log();
-    // Use spawnSync to show progress AND capture errors
-    const pullResult = spawnSync("docker", ["pull", workerImage], {
-        stdio: "inherit",
-        timeout: 600_000, // 10 minutes
-    });
-    if (pullResult.status === 0) {
-        console.log();
-        console.log(chalk.green(`  ✓ Worker image pulled`));
+    const PRIVATE_ECR_REGISTRY = "593971626975.dkr.ecr.us-east-1.amazonaws.com";
+    const workerImage = `${PRIVATE_ECR_REGISTRY}/workermill-dev/worker:latest`;
+    // Check AWS CLI
+    const awsSpinner = ora("Checking AWS CLI...").start();
+    if (commandExists("aws")) {
+        try {
+            execSync("aws sts get-caller-identity", {
+                stdio: "pipe",
+                timeout: 15000,
+            });
+            awsSpinner.succeed("AWS CLI configured");
+        }
+        catch {
+            awsSpinner.warn("AWS CLI found but credentials not configured");
+            console.log();
+            console.log(chalk.yellow("  Configure AWS credentials for private ECR image access:"));
+            console.log(chalk.cyan("    aws configure"));
+            console.log(chalk.dim("  Contact your WorkerMill admin for AWS access key / secret key."));
+            console.log(chalk.dim("  Setup will continue — you can configure AWS later before starting."));
+        }
     }
     else {
+        awsSpinner.warn("AWS CLI not found");
         console.log();
-        console.log(chalk.red("  ✗ Failed to pull worker image."));
+        console.log(chalk.yellow("  AWS CLI is required for pulling worker images from private ECR."));
+        console.log(chalk.cyan("  Install: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html"));
+        console.log(chalk.dim("  Setup will continue — install AWS CLI before starting the agent."));
+    }
+    // Authenticate with ECR
+    console.log();
+    console.log(chalk.dim(`  Authenticating with private ECR...`));
+    let ecrAuthed = false;
+    try {
+        execSync(`aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin ${PRIVATE_ECR_REGISTRY}`, { stdio: "pipe", timeout: 30_000 });
+        console.log(chalk.green("  ✓ ECR authenticated"));
+        ecrAuthed = true;
+    }
+    catch {
+        console.log(chalk.yellow("  ⚠ ECR authentication failed (AWS credentials may not be configured yet)"));
+        console.log(chalk.dim("  Worker image pull will be skipped — authenticate later with:"));
+        console.log(chalk.dim(`    aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin ${PRIVATE_ECR_REGISTRY}`));
+    }
+    // Pull worker image (only if ECR auth succeeded)
+    if (ecrAuthed) {
         console.log();
-        if (pullResult.error) {
-            console.log(chalk.yellow(`  Error: ${pullResult.error.message}`));
+        console.log(chalk.dim(`  Pulling worker image: ${workerImage}`));
+        console.log(chalk.dim("  This may take a few minutes on first run (~1.1 GB)..."));
+        console.log();
+        const pullResult = spawnSync("docker", ["pull", workerImage], {
+            stdio: "inherit",
+            timeout: 600_000,
+        });
+        if (pullResult.status === 0) {
+            console.log();
+            console.log(chalk.green("  ✓ Worker image pulled"));
         }
-        console.log(chalk.yellow("  Troubleshooting:"));
-        console.log(chalk.yellow("    1. Is Docker Desktop running?"));
-        if (isWindows) {
-            console.log(chalk.yellow("    2. Is Docker in Linux containers mode? (Right-click Docker tray icon)"));
+        else {
+            console.log();
+            console.log(chalk.red("  ✗ Failed to pull worker image."));
+            if (pullResult.error) {
+                console.log(chalk.yellow(`  Error: ${pullResult.error.message}`));
+            }
+            console.log(chalk.dim("  Setup will continue — you can pull the image later before starting."));
         }
-        console.log(chalk.yellow(`    ${isWindows ? "3" : "2"}. Try manually: ${chalk.cyan(`docker pull ${workerImage}`)}`));
-        console.log();
-        console.log(chalk.dim("  Setup will continue — you can pull the image later before starting."));
     }
     // ── Step 8: Save config ───────────────────────────────────────────────────
     const fileConfig = {
@@ -381,7 +397,7 @@ export async function setupCommand() {
         maxWorkers: 1,
         pollIntervalMs: 5000,
         heartbeatIntervalMs: 30000,
-        tokens: tokenPrompts,
+        tokens: { github: "", bitbucket: "", gitlab: "" }, // SCM tokens come from org Settings
         workerImage,
         setupCompletedAt: new Date().toISOString(),
     };

package/dist/config.js

@@ -53,10 +53,12 @@ export function loadConfigFromFile() {
         console.error("Config file is missing required fields (apiUrl, apiKey). Re-run 'workermill-agent setup'.");
         process.exit(1);
     }
-    // Migrate any stale image URLs to current default
-    const defaultImage = "public.ecr.aws/a7k5r0v0/workermill-worker:latest";
+    // Migrate any stale image URLs to current default (private ECR)
+    const defaultImage = "593971626975.dkr.ecr.us-east-1.amazonaws.com/workermill-dev/worker:latest";
     let workerImage = fc.workerImage || defaultImage;
-    if (workerImage.includes("jarod1/") || !workerImage.includes("workermill-worker")) {
+    if (workerImage.includes("jarod1/") ||
+        workerImage.includes("public.ecr.aws/") ||
+        !workerImage.includes("workermill-worker") && !workerImage.includes("workermill-dev/worker")) {
         workerImage = defaultImage;
         fc.workerImage = workerImage;
         try {
@@ -151,7 +153,7 @@ export function findClaudePath() {
  */
 export function checkPrerequisites(workerImage) {
     const results = [];
-    const image = workerImage || "public.ecr.aws/a7k5r0v0/workermill-worker:latest";
+    const image = workerImage || "593971626975.dkr.ecr.us-east-1.amazonaws.com/workermill-dev/worker:latest";
     // Docker
     try {
         const version = execSync("docker version --format {{.Server.Version}}", {

package/dist/spawner.d.ts

@@ -51,6 +51,9 @@ export interface ClaimCredentials {
     githubReviewerToken?: string;
     scmBaseUrl?: string;
     ollamaContextWindow?: number;
+    scmToken?: string;
+    githubToken?: string;
+    bitbucketUsername?: string;
     anthropicApiKey?: string;
     openaiApiKey?: string;
     googleApiKey?: string;
@@ -102,6 +105,9 @@ export interface ManagerCredentials {
     jiraApiToken?: string;
     linearApiKey?: string;
     issueTrackerProvider?: string;
+    scmToken?: string;
+    githubToken?: string;
+    bitbucketUsername?: string;
 }
 /**
  * Spawn a manager Docker container for PR review or log analysis.

package/dist/spawner.js

@@ -34,6 +34,21 @@ function detectWSL() {
 }
 const isWSL = detectWSL();
 const isDockerDesktop = isWSL || process.platform === "darwin" || process.platform === "win32";
+/**
+ * Get WSL2 host IP for Docker --add-host override.
+ * On WSL2, host-gateway resolves to the Docker VM, not WSL2 where the API runs.
+ */
+function getWSLHostIP() {
+    if (!isWSL)
+        return null;
+    try {
+        const ip = execSync("hostname -I", { encoding: "utf-8" }).trim().split(/\s+/)[0];
+        if (ip && /^\d+\.\d+\.\d+\.\d+$/.test(ip))
+            return ip;
+    }
+    catch { /* fall through */ }
+    return null;
+}
 /**
  * Convert WSL paths to Windows paths for Docker volume mounts.
  */
@@ -69,14 +84,42 @@ function findClaudeConfigDir() {
     }
     return null;
 }
+/** Private ECR registry for worker images */
+const PRIVATE_ECR_REGISTRY = "593971626975.dkr.ecr.us-east-1.amazonaws.com";
+/** Cache ECR login (token lasts 12h, refresh after 11h) */
+let ecrLoginExpiresAt = 0;
+/**
+ * Ensure Docker is logged into private ECR.
+ * Uses ambient AWS credentials (aws configure).
+ */
+function ensureEcrLogin() {
+    if (Date.now() < ecrLoginExpiresAt)
+        return true;
+    try {
+        execSync(`aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin ${PRIVATE_ECR_REGISTRY}`, { stdio: "pipe", timeout: 30_000 });
+        ecrLoginExpiresAt = Date.now() + 11 * 60 * 60 * 1000;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Get SCM token based on provider.
+ * Prefers org credentials from API, falls back to local config.
  */
-function getScmToken(scmProvider, config) {
+function getScmToken(scmProvider, config, credentials) {
+    // Org credentials from API are the primary source
+    if (credentials?.scmToken)
+        return credentials.scmToken;
+    // Fall back to local config tokens
     switch (scmProvider) {
-        case "bitbucket": return config.bitbucketToken;
-        case "gitlab": return config.gitlabToken;
-        default: return config.githubToken;
+        case "bitbucket":
+            return config.bitbucketToken;
+        case "gitlab":
+            return config.gitlabToken;
+        default:
+            return config.githubToken;
     }
 }
 /** Check if a task has the self-review label (works across Jira, GitHub, GitLab, Linear) */
@@ -112,7 +155,9 @@ export async function spawnWorker(task, config, orgConfig, credentials) {
     }
     const containerName = `workermill-${task.id.slice(0, 8)}`;
     // Build Docker run arguments
-    const dockerArgs = ["run", "--rm", "--pull", "always", "--name", containerName];
+    // Only pull from registry for remote images; local images (no '/' in name) are already on disk
+    const isLocalImage = !config.workerImage.includes("/");
+    const dockerArgs = ["run", "--rm", ...(isLocalImage ? [] : ["--pull", "always"]), "--name", containerName];
     // Resource limits — 6GB memory with swap for overflow.
     // NODE_OPTIONS caps V8 heap at 2GB; the extra room is for git, npm, Claude CLI subprocesses.
     const totalRamGB = Math.round(os.totalmem() / (1024 * 1024 * 1024));
@@ -125,9 +170,10 @@ export async function spawnWorker(task, config, orgConfig, credentials) {
     else {
         dockerArgs.push("--memory", "6g", "--memory-swap", "12g", "--cpus", "4");
     }
-    // Network mode
+    // Network mode — WSL2: host-gateway resolves to Docker VM, not WSL2, so use actual WSL IP
     if (isDockerDesktop) {
-        dockerArgs.push("--add-host=host.docker.internal:host-gateway");
+        const wslIP = getWSLHostIP();
+        dockerArgs.push(`--add-host=host.docker.internal:${wslIP || "host-gateway"}`);
     }
     else {
         dockerArgs.push("--network", "host");
@@ -158,8 +204,18 @@ export async function spawnWorker(task, config, orgConfig, credentials) {
         console.log(`${ts()} ${taskLabel} ${chalk.dim("Skipping Claude mount (non-Anthropic worker)")}`);
     }
     // Build environment variables — KEY DIFFERENCE: API_BASE_URL points to cloud
+    // Docker containers can't reach host via "localhost" — translate for Docker networking
+    const containerApiUrl = config.apiUrl.replace(/localhost|127\.0\.0\.1/, "host.docker.internal");
     const scmProvider = (task.scmProvider || "github");
-    const scmToken = getScmToken(scmProvider, config);
+    const scmToken = getScmToken(scmProvider, config, credentials);
+    // Derive per-provider tokens: prefer org credentials, fall back to local config
+    const githubToken = credentials?.githubToken || config.githubToken;
+    const bitbucketToken = scmProvider === "bitbucket"
+        ? credentials?.scmToken || config.bitbucketToken
+        : config.bitbucketToken;
+    const gitlabToken = scmProvider === "gitlab"
+        ? credentials?.scmToken || config.gitlabToken
+        : config.gitlabToken;
     const envVars = {
         // Cap V8 heap to 3GB — forces aggressive GC instead of bloating to fill container.
         // Each Claude CLI subprocess inherits this, preventing unbounded heap growth.
@@ -178,18 +234,19 @@ export async function spawnWorker(task, config, orgConfig, credentials) {
         RETRY_NUMBER: String(task.retryCount ?? 0),
         TICKET_KEY: task.jiraIssueKey || "",
         // Cloud API — this is what makes remote agent mode work
-        API_BASE_URL: config.apiUrl,
+        // Use containerApiUrl so Docker containers reach the host via host.docker.internal
+        API_BASE_URL: containerApiUrl,
         ORG_API_KEY: config.apiKey,
-        // SCM configuration
+        // SCM configuration — org credentials from API are primary, local config is fallback
         SCM_PROVIDER: scmProvider,
         SCM_TOKEN: scmToken,
         SCM_BASE_URL: credentials?.scmBaseUrl || "",
-        GITHUB_TOKEN: config.githubToken,
-        GH_TOKEN: config.githubToken,
+        GITHUB_TOKEN: githubToken,
+        GH_TOKEN: githubToken,
         GITHUB_REVIEWER_TOKEN: credentials?.githubReviewerToken || "",
-        BITBUCKET_TOKEN: config.bitbucketToken,
-        BITBUCKET_USERNAME: "x-token-auth",
-        GITLAB_TOKEN: config.gitlabToken,
+        BITBUCKET_TOKEN: bitbucketToken,
+        BITBUCKET_USERNAME: credentials?.bitbucketUsername || "x-token-auth",
+        GITLAB_TOKEN: gitlabToken,
         // Target repository
         TARGET_REPO: task.githubRepo || "",
         GITHUB_REPO: task.githubRepo || "",
@@ -269,8 +326,12 @@ export async function spawnWorker(task, config, orgConfig, credentials) {
             dockerArgs.push("-e", `${k}=${v}`);
         }
     }
-    // Worker image (configurable: Docker Hub for CLI users, local for bin/remote-agent)
-    dockerArgs.push(config.workerImage || "public.ecr.aws/a7k5r0v0/workermill-worker:latest");
+    // Worker image — private ECR requires auth (ensureEcrLogin handles it)
+    const workerImage = config.workerImage || `${PRIVATE_ECR_REGISTRY}/workermill-dev/worker:latest`;
+    if (workerImage.includes(PRIVATE_ECR_REGISTRY)) {
+        ensureEcrLogin();
+    }
+    dockerArgs.push(workerImage);
     const reviewEnabled = task.skipManagerReview === false;
     console.log(`${ts()} ${taskLabel} ${chalk.dim("Starting container")} ${chalk.yellow(containerName)}`);
     console.log(`${ts()} ${taskLabel} ${chalk.dim(`  skipManagerReview=${task.skipManagerReview} → REVIEW_ENABLED=${reviewEnabled}`)}`);
@@ -425,13 +486,29 @@ export async function spawnManagerWorker(task, config, credentials) {
         "--memory=4g",
         "--cpus=2",
     ];
+    // Network mode — same as main worker spawn
+    if (isDockerDesktop) {
+        const wslIP = getWSLHostIP();
+        dockerArgs.push(`--add-host=host.docker.internal:${wslIP || "host-gateway"}`);
+    }
+    else {
+        dockerArgs.push("--network", "host");
+    }
     if (claudeConfigDir) {
         const dockerClaudeDir = toDockerPath(claudeConfigDir);
         dockerArgs.push("-v", `${dockerClaudeDir}:/home/worker/.claude`);
     }
     // Manager-specific env vars (match ECS runManagerTask)
+    const containerApiUrl = config.apiUrl.replace(/localhost|127\.0\.0\.1/, "host.docker.internal");
     const scmProvider = (task.scmProvider || "github");
-    const scmToken = getScmToken(scmProvider, config);
+    const scmToken = getScmToken(scmProvider, config, credentials);
+    const githubToken = credentials?.githubToken || config.githubToken;
+    const bitbucketToken = scmProvider === "bitbucket"
+        ? credentials?.scmToken || config.bitbucketToken
+        : config.bitbucketToken;
+    const gitlabToken = scmProvider === "gitlab"
+        ? credentials?.scmToken || config.gitlabToken
+        : config.gitlabToken;
     const envVars = {
         NODE_OPTIONS: "--max-old-space-size=3072",
         TASK_ID: task.id,
@@ -442,17 +519,17 @@ export async function spawnManagerWorker(task, config, credentials) {
         GITHUB_REPO: task.githubRepo || "",
         PR_URL: task.githubPrUrl || "",
         PR_NUMBER: task.githubPrNumber ? String(task.githubPrNumber) : "",
-        // Cloud API
-        API_BASE_URL: config.apiUrl,
+        // Cloud API — use containerApiUrl for Docker networking
+        API_BASE_URL: containerApiUrl,
         ORG_API_KEY: config.apiKey,
-        // SCM configuration
+        // SCM configuration — org credentials from API are primary, local config is fallback
         SCM_PROVIDER: scmProvider,
         SCM_TOKEN: scmToken,
-        GITHUB_TOKEN: config.githubToken,
-        GH_TOKEN: config.githubToken,
-        BITBUCKET_TOKEN: config.bitbucketToken,
-        BITBUCKET_USERNAME: "x-token-auth",
-        GITLAB_TOKEN: config.gitlabToken,
+        GITHUB_TOKEN: githubToken,
+        GH_TOKEN: githubToken,
+        BITBUCKET_TOKEN: bitbucketToken,
+        BITBUCKET_USERNAME: credentials?.bitbucketUsername || "x-token-auth",
+        GITLAB_TOKEN: gitlabToken,
         // Manager provider and model
         MANAGER_PROVIDER: credentials?.managerProvider || "anthropic",
         MANAGER_MODEL: credentials?.managerModelId || "",
@@ -473,8 +550,11 @@ export async function spawnManagerWorker(task, config, credentials) {
             dockerArgs.push("-e", `${k}=${v}`);
         }
     }
-    // Worker image with manager entrypoint override
-    const workerImage = config.workerImage || "public.ecr.aws/a7k5r0v0/workermill-worker:latest";
+    // Worker image with manager entrypoint override — private ECR requires auth
+    const workerImage = config.workerImage || `${PRIVATE_ECR_REGISTRY}/workermill-dev/worker:latest`;
+    if (workerImage.includes(PRIVATE_ECR_REGISTRY)) {
+        ensureEcrLogin();
+    }
     dockerArgs.push("--entrypoint", "/bin/bash");
     dockerArgs.push(workerImage);
     dockerArgs.push("/app/manager-entrypoint.sh");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workermill/agent",
-  "version": "0.8.5",
+  "version": "0.8.8",
   "description": "WorkerMill Remote Agent - Run AI workers locally with your Claude Max subscription",
   "type": "module",
   "main": "./dist/index.js",