ai-agentmanager 1.10.0 → 1.11.0

package/src/fleet.js

@@ -158,19 +158,20 @@ export const isLoopback = (h) => ['127.0.0.1', 'localhost', '[::1]', '::1'].incl
 
 /**
  * Hub URLs a runner accepts: https anywhere; plain http only on this machine or over
- * Tailscale, which already encrypts the traffic.
+ * Tailscale, which already encrypts the traffic, or on a private network you vouch for
+ * (AGENTMGR_HUB_ALLOW_HTTP=1: a hub and runners in one docker-compose or VPC).
  */
-export function checkHubUrl(raw) {
+export function checkHubUrl(raw, env = process.env) {
   let u;
   try {
     u = new URL(String(raw ?? '').trim());
   } catch {
     throw Object.assign(new Error('Hub URL must look like https://hub.example.com'), { status: 400 });
   }
-  if (u.protocol === 'https:' || (u.protocol === 'http:' && (isLoopback(u.hostname) || isTailscaleHost(u.hostname)))) {
+  if (u.protocol === 'https:' || (u.protocol === 'http:' && (isLoopback(u.hostname) || isTailscaleHost(u.hostname) || env.AGENTMGR_HUB_ALLOW_HTTP === '1'))) {
     return u.origin;
   }
-  throw Object.assign(new Error('Use https:// for the hub (plain http only for localhost or a Tailscale address)'), { status: 400 });
+  throw Object.assign(new Error('Use https:// for the hub (plain http only for localhost, a Tailscale address, or a private network with AGENTMGR_HUB_ALLOW_HTTP=1)'), { status: 400 });
 }
 
 /** Signed by the runner's key on every connection, so the hub knows which runner it is. */

package/src/hub.js

@@ -61,6 +61,12 @@ function newCode() {
   const chars = [...bytes].map((b) => CODE_ALPHABET[b % CODE_ALPHABET.length]).join('');
   return chars.match(/.{4}/g).join('-');
 }
+/** Constant-time comparison of two strings (different lengths are simply unequal). */
+const safeEqual = (a, b) => {
+  const x = Buffer.from(String(a));
+  const y = Buffer.from(String(b));
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+};
 const normalizeCode = (c) => String(c ?? '').toUpperCase().replace(/[^A-Z0-9]/g, '');
 
 /** Google sign-in settings from the environment, or null when not configured. */
@@ -459,7 +465,11 @@ export async function startHub({
       if (!loginAllowed(req.ip)) throw fail(429, 'Too many attempts; try again in 15 minutes');
       const key = sha256(normalizeCode(req.body?.code));
       const invite = store.data.invites[key];
-      if (!invite || Date.parse(invite.expiresAt) < Date.now()) {
+      // The runner token (AGENTMGR_HUB_RUNNER_TOKEN): a reusable secret for machines that join by
+      // themselves, such as cloud runners; compared in constant time, and failures count like any.
+      const token = process.env.AGENTMGR_HUB_RUNNER_TOKEN;
+      const viaToken = Boolean(token && token.length >= 24 && safeEqual(String(req.body?.code ?? ''), token));
+      if (!viaToken && (!invite || Date.parse(invite.expiresAt) < Date.now())) {
         loginFailed(req.ip);
         throw fail(401, 'Invite code is wrong, used or expired; create a new one on the hub');
       }
@@ -471,7 +481,7 @@ export async function startHub({
       } catch {
         throw fail(400, 'publicKey must be an Ed25519 public key (PEM)');
       }
-      delete store.data.invites[key]; // single use
+      if (!viaToken) delete store.data.invites[key]; // single use
       const base = String(req.body?.name ?? '').toLowerCase().replace(/[^\w.-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32) || 'machine';
       const taken = new Set(Object.values(store.data.runners).map((r) => r.name));
       let runnerName = base;
@@ -479,7 +489,7 @@ export async function startHub({
       const id = crypto.randomBytes(4).toString('hex');
       store.data.runners[id] = { id, name: runnerName, publicKey, enrolledAt: now(), lastSeen: null, version: String(req.body?.version ?? '').slice(0, 20) || null };
       store.save();
-      log(`runner ${runnerName} (${id}) joined from ${req.ip}`);
+      log(`runner ${runnerName} (${id}) joined from ${req.ip}${viaToken ? ' with the runner token' : ''}`);
       changed();
       return { runnerId: id, name: runnerName, hubName: name };
     }),

package/src/hublink.js

@@ -47,10 +47,12 @@ export function audit(line) {
   } catch {}
 }
 
-export function hubPolicy(config) {
+export function hubPolicy(config, env = process.env) {
   const h = config.hub ?? {};
+  // A cloud runner sets it in its environment (AGENTMGR_HUB_ALLOW=view,control,move): no config file to edit.
+  const fromEnv = env.AGENTMGR_HUB_ALLOW ? env.AGENTMGR_HUB_ALLOW.split(/[\s,]+/).filter(Boolean) : null;
   return {
-    allow: Array.isArray(h.allow) ? h.allow.map(String) : DEFAULT_HUB_POLICY.allow,
+    allow: fromEnv ?? (Array.isArray(h.allow) ? h.allow.map(String) : DEFAULT_HUB_POLICY.allow),
     projects: Array.isArray(h.projects) && h.projects.length ? h.projects.map(String) : DEFAULT_HUB_POLICY.projects,
   };
 }

package/src/inbox.js

@@ -87,6 +87,20 @@ export function promptChoices(screen) {
       break;
     }
   }
+  // Newer Claude Code can draw a menu as one run of text ("Do you want to proceed? ❯ 1. Yes 2. Yes,
+  // and switch to auto mode 3. No Esc to cancel"): read the flattened screen after the last question.
+  if (!choices.size) {
+    const flat = lines.join(' ').replace(/\s+/g, ' ');
+    const at = flat.search(/\?\s*(?:[❯>›]\s*)?1[.)]\s*\S[^?]*$/);
+    if (at >= 0) {
+      const head = flat.slice(0, at + 1);
+      // Drop what's left of the box around it (╌ ─ │ and stray letters before them).
+      question = (/([^.?!│]*\?)$/.exec(head)?.[1] ?? '').replace(/^.*[╌─│━]+\s*/, '').trim().slice(-200);
+      for (const m of flat.slice(at + 1).matchAll(/(?:[❯>›]\s*)?\b(\d)[.)]\s*(.+?)(?=\s+(?:[❯>›]\s*)?\d[.)]\s|\s+Esc to cancel|\s+Enter to|$)/g)) {
+        if (!choices.has(m[1])) choices.set(m[1], m[2].replace(/\s*·.*$/, '').trim().slice(0, 80));
+      }
+    }
+  }
   return {
     question,
     choices: [...choices.entries()].sort(([a], [b]) => a - b).map(([key, label]) => ({ key, label })),

package/src/manager.js

@@ -102,6 +102,7 @@ import * as git from './git.js';
 import { parseDiff } from '../public/review.js';
 import { issueSummary, leadingIssue, wordsAfterLink } from './jira.js';
 import { combine, facts as scoreFacts, scorecardMarkdown, scorecardPrompt } from './scorecard.js';
+import { CONTAINER_ENGINES, claudeToken, containerName, containerRunning, engineMounts, gitCommonDir, removeContainer, runArgs, stopContainer } from './container.js';
 import { conflictMessage, findConflicts, related, repoKey, summarize as summarizeConflicts } from './conflicts.js';
 import { answerMessage, loadQuestions, questionsPath, questionsPrompt } from './inbox.js';
 import { STUCK_DEFAULTS, detectStuck } from './stuck.js';
@@ -594,6 +595,7 @@ export class AgentManager extends EventEmitter {
     startedBy,
     trigger,
     attachments,
+    isolation,
   }) {
     intent = (intent ?? '').trim();
     const staged = stagedFiles(attachments);
@@ -607,6 +609,12 @@ export class AgentManager extends EventEmitter {
     }
     // Planning while cloning moves the session between folders, which needs the engine's support.
     if (!engineDef.supports.planHandoff) plan = false;
+    // Isolation: "container" runs it in Docker (config "isolation": { "default": "container" } for all).
+    isolation = isolation === undefined ? this.config.isolation?.default ?? null : isolation || null;
+    if (isolation && isolation !== 'container') throw Object.assign(new Error('isolation is "container" or nothing'), { status: 400 });
+    if (isolation && !CONTAINER_ENGINES.has(engineId)) throw Object.assign(new Error(`${engineDef.label} can't run in a container yet (Claude Code and Codex can)`), { status: 400 });
+    // The session moves between folders mid-plan; a container is bound to one folder.
+    if (isolation) plan = false;
     const general = NO_REPO.has(kind);
     // A project shortcut (or name) fills in the repo / folder / base branch.
     const entry = !general && project ? this.resolveProject(project) : null;
@@ -639,6 +647,7 @@ export class AgentManager extends EventEmitter {
       priority: parsePriority(priority),
       ...(startedBy ? { startedBy } : {}),
       ...(trigger ? { trigger } : {}),
+      ...(isolation ? { isolation } : {}),
       name: name?.trim() || jiraKey || slug,
       slug,
       intent,
@@ -995,6 +1004,26 @@ export class AgentManager extends EventEmitter {
     return this.view(this.store.get(agent.id));
   }
 
+  /**
+   * `docker run` for an agent in a container (see container.js): its folder, its repository's git
+   * data, its brief and uploads, the engine's homes and sign-in; nothing else of this computer.
+   */
+  containerSpec(agent, engine, cwd, args) {
+    const name = containerName(agent.id);
+    removeContainer(name); // a leftover from a crash or a restart would block the name
+    const em = engineMounts(engine.id, cwd);
+    const real = (p) => (fs.existsSync(p) ? fs.realpathSync(p) : null);
+    const git = gitCommonDir(cwd);
+    // Plus any folders config.json adds ("isolation": { "mounts": [{ "host": "~/.npm", "readOnly": true }] }).
+    const extra = (this.config.isolation?.mounts ?? []).map((m) => ({ ...m, host: real(expandHome(m.host)) }));
+    const mounts = [...em.mounts, ...(git ? [{ host: git }] : []), { host: real(briefDir(agent.id)) }, { host: real(path.join(paths.uploads, agent.id)), readOnly: true }, ...extra].filter((m) => m.host);
+    const bin = this.config.isolation?.bin?.[engine.id] ?? em.bin;
+    const env = { ...this.childEnv(agent), ...(claudeToken() ? { CLAUDE_CODE_OAUTH_TOKEN: claudeToken() } : {}) };
+    // Variables passed in by name (values stay out of the command line): the engine's, plus config's "isolation.env".
+    const inner = ['TERM=xterm-256color', 'COLORTERM=truecolor', `AGENTMGR_AGENT_ID=${agent.id}`, 'AGENTMGR_TERMINAL=1', ...em.env, ...(this.config.isolation?.env ?? [])];
+    return { name, cmd: 'docker', env, args: runArgs({ agentId: agent.id, engineId: engine.id, cwd: fs.realpathSync(cwd), bin, args, config: this.config, mounts, env: inner }) };
+  }
+
   /** What every launch of this agent passes its engine: options, its brief folder, instructions. */
   launchOptions(agent, { planning = false } = {}) {
     const engine = engineOf(agent);
@@ -1098,19 +1127,23 @@ export class AgentManager extends EventEmitter {
       }
     }
 
-    if (!installed(engine, this.config)) {
+    // In a container the engine is inside the image, not on this computer.
+    const container = agent.isolation === 'container' && !NO_REPO.has(agent.kind);
+    if (!container && !installed(engine, this.config)) {
       const error = notInstalled(engine, this.config);
       this.patch(agent.id, { status: 'error', error });
       throw Object.assign(new Error(error), { status: 400 });
     }
     let proc;
     try {
-      proc = pty.spawn(engine.bin(this.config), args, {
+      const spec = container ? this.containerSpec(agent, engine, cwd, args) : { cmd: engine.bin(this.config), args, env: this.childEnv(agent) };
+      rt.container = spec.name ?? null;
+      proc = pty.spawn(spec.cmd, spec.args, {
         name: 'xterm-256color',
         cols: rt.cols,
         rows: rt.rows,
         cwd,
-        env: this.childEnv(agent),
+        env: spec.env,
       });
     } catch (err) {
       this.patch(agent.id, { status: 'error', error: `Failed to launch ${engine.bin(this.config)}: ${err.message}` });
@@ -1233,9 +1266,14 @@ export class AgentManager extends EventEmitter {
         done.dispose();
         resolve(this.view(this.store.get(agent.id) ?? agent));
       });
-      // A hangup, as when a terminal closes, unless the engine shuts down cleanly on another signal.
-      rt.pty.kill(engineOf(agent).stopSignal ?? 'SIGHUP');
-      rt.killTimer = setTimeout(() => rt.pty?.kill('SIGKILL'), timeoutMs);
+      // A container: docker stop (the engine gets SIGTERM inside; the docker command then ends).
+      // Otherwise a hangup, as when a terminal closes, unless the engine ends cleanly on another signal.
+      if (rt.container) stopContainer(rt.container, 10);
+      else rt.pty.kill(engineOf(agent).stopSignal ?? 'SIGHUP');
+      rt.killTimer = setTimeout(() => {
+        if (rt.container) removeContainer(rt.container);
+        rt.pty?.kill('SIGKILL');
+      }, timeoutMs);
     });
   }
 
@@ -1509,7 +1547,10 @@ export class AgentManager extends EventEmitter {
       rows: prev?.rows ?? 34,
     };
     if (rt.size) this.appendOutput(rt, '\r\n\x1b[2m── new shell ──\x1b[0m\r\n');
-    const proc = pty.spawn(this.config.shell, ['-l'], {
+    // An agent in a running container: the shell opens inside it, with what the agent sees.
+    const inside = agent.isolation === 'container' && containerRunning(containerName(agent.id));
+    const [cmd, cmdArgs] = inside ? ['docker', ['exec', '-it', '-w', fs.realpathSync(agent.workdir), containerName(agent.id), 'bash', '-l']] : [this.config.shell, ['-l']];
+    const proc = pty.spawn(cmd, cmdArgs, {
       name: 'xterm-256color',
       cols: rt.cols,
       rows: rt.rows,
@@ -2812,7 +2853,8 @@ export class AgentManager extends EventEmitter {
     const keys = { esc: '\x1b', enter: '\r', up: '\x1b[A', down: '\x1b[B' };
     const data = keys[key] ?? (/^\d$/.test(key) ? key : null);
     if (!data) throw Object.assign(new Error('Unsupported key'), { status: 400 });
-    this.write(agent.id, data);
+    // Menus that read a line (the ACP client's) take Enter after the choice.
+    this.write(agent.id, engineOf(agent).promptKeyEnter && key !== 'enter' ? `${data}\r` : data);
     return { ok: true };
   }
 

package/src/server.js

@@ -25,7 +25,7 @@ import { Studio } from './studio.js';
 import { Memory } from './memory.js';
 import { doctor } from './doctor.js';
 import { Triggers, tokenMatches } from './triggers.js';
-import { listEngines, registerEngine } from './engines/index.js';
+import { listEngines, registerAcpEngines, registerEngine } from './engines/index.js';
 import { Plugins, pluginSpecs } from './plugins.js';
 import { HubLink, linkUrls } from './hublink.js';
 import { Notifier, isWorkflowUrl, loadNotify, publicNotify, saveNotify, sendSlack } from './notify.js';
@@ -34,6 +34,7 @@ import { LiveBrowser } from './livebrowser.js';
 import * as remote from './remote.js';
 import * as service from './service.js';
 import { jiraView, saveJira } from './jira.js';
+import { CONTAINER_ENGINES, buildImage, claudeToken, dockerStatus, isBuilding, saveSecrets } from './container.js';
 import { Store } from './store.js';
 import { about, latestRelease } from './about.js';
 
@@ -63,7 +64,7 @@ function isAllowedOrigin(origin, port) {
 const PUBLIC_REMOTE_API = new Set(['POST /api/login', 'GET /api/session']);
 // Updates are not here: a signed-in device (a phone) can install the newest release too. It only
 // ever installs an official release from where this copy came from (git tag or npm) and restarts.
-const LOCAL_ONLY_API = /^\/api\/(remote(\/|$)|notify(\/|$)|hub(\/|$)|triggers(\/|$)|service$|jira$|editors$|agents\/[\w-]+\/open-in$|shutdown$)/;
+const LOCAL_ONLY_API = /^\/api\/(remote(\/|$)|notify(\/|$)|hub(\/|$)|triggers(\/|$)|service$|jira$|isolation\/|editors$|agents\/[\w-]+\/open-in$|shutdown$)/;
 const HOOK_PATH = '/api/hooks/agents';
 const NO_REPO_KINDS = new Set(['general', 'assistant']);
 
@@ -73,6 +74,8 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   const store = new Store(paths.state);
   const plugins = await new Plugins({ log: (m) => console.log(`[agentmgr] ${m}`) }).load(pluginSpecs(config), { config, base: paths.home });
   for (const { def } of plugins.engines) registerEngine(def);
+  // ACP agents (Gemini CLI, OpenCode, Goose, … and config's "acp") become engines.
+  registerAcpEngines(config);
   const manager = new AgentManager({ store, config, plugins });
   const backlog = new Backlog({ manager, store, config });
   const races = new Races({ manager, store });
@@ -513,6 +516,28 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   api.get('/agents/:id/memory', wrap((req) => memory.read(req.params.id)));
   api.put('/agents/:id/memory', wrap((req) => memory.write(req.params.id, req.body?.text)));
   api.post('/agents/:id/learn', wrap((req) => memory.learn(req.params.id, req.body?.text, { by: req.headers['x-agentmgr-agent'] ? undefined : 'you' })));
+  // Isolation: Docker, the agent image, the Claude token for containers, and the default for new agents.
+  let buildError = null;
+  const isolationView = async () => ({ ...(await dockerStatus(config)), building: isBuilding(), buildError, hasClaudeToken: Boolean(claudeToken()), engines: [...CONTAINER_ENGINES], default: config.isolation?.default ?? null });
+  api.get('/isolation', wrap(isolationView));
+  api.post(
+    '/isolation/build',
+    wrap(async () => {
+      buildError = null;
+      buildImage(config).catch((err) => (buildError = err.message));
+      return isolationView();
+    }),
+  );
+  api.put('/isolation/token', wrap(async (req) => (saveSecrets({ claudeOauthToken: String(req.body?.token ?? '').trim() || null }), isolationView())));
+  api.put(
+    '/isolation/default',
+    wrap(async (req) => {
+      const value = req.body?.container ? 'container' : null;
+      config.isolation = { ...config.isolation, default: value };
+      saveConfig({ isolation: config.isolation });
+      return isolationView();
+    }),
+  );
   // Jira: the site and API token used to show an issue's summary for agents created from its link.
   api.get('/jira', wrap(() => jiraView()));
   api.put(
@@ -971,6 +996,14 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   }
   manager.refreshAll().catch(() => {});
   hubLink.start();
+  // A cloud runner joins its hub by itself on first start (AGENTMGR_HUB_URL and AGENTMGR_HUB_CODE: an
+  // invite, or the hub's runner token), and stays joined across restarts (the link is kept on disk).
+  if (process.env.AGENTMGR_HUB_URL && process.env.AGENTMGR_HUB_CODE && !hubLink.status().joined) {
+    hubLink
+      .join(process.env.AGENTMGR_HUB_URL, process.env.AGENTMGR_HUB_CODE, process.env.AGENTMGR_RUNNER_NAME || undefined)
+      .then((st) => console.log(`[agentmgr] joined the hub ${st.url} as ${st.name}`))
+      .catch((err) => console.error(`[agentmgr] could not join the hub ${process.env.AGENTMGR_HUB_URL}: ${err.message}`));
+  }
   return {
     hubLink,
     server,

package/src/trust.js

@@ -16,9 +16,8 @@ export function claudeConfigFile() {
  * before writing, only written when something changes, and replaced atomically.
  * Returns true if it changed anything.
  */
-export function trustFolder(dir) {
+export function trustFolder(dir, file = claudeConfigFile()) {
   const real = fs.realpathSync(dir);
-  const file = claudeConfigFile();
   let raw = '{}';
   try {
     raw = fs.readFileSync(file, 'utf8');