ai-agentmanager 1.10.0 → 1.11.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.11.1 (2026-11-01)
+
+- **Copy and paste in terminals on phones:** **Copy** and **Paste** in the terminal's key bar (and in the Terminal's bar). A phone can't select the terminal's text or paste into it directly, so Copy opens its recent output as plain text you can select (or **Copy all**), and Paste reads the clipboard (the phone asks first) or offers a box to paste into, then inserts it as one paste without pressing Enter.
+
+## 1.11.0 (2026-11-01)
+
+- **Inbox:** permission menus that newer Claude Code draws as one run of text ("Do you want to proceed? ❯ 1. Yes 2. … 3. No") get their choices again, so they can be answered from the inbox.
+- **Cloud runners:** run AI Agent Manager headless on a server so agents keep working with the laptop closed: `docker/runner.Dockerfile` (AI Agent Manager, Claude Code, Codex, git, gh; data on a `/data` volume), `docker/compose.runner.yml`, and a Railway recipe in [docs/cloud-runner.md](docs/cloud-runner.md). It joins the hub by itself from `AGENTMGR_HUB_URL` and `AGENTMGR_HUB_CODE`, with the hub's new reusable **runner token** (`AGENTMGR_HUB_RUNNER_TOKEN`, at least 24 characters, compared in constant time) or an invite, and keeps its link across restarts; `AGENTMGR_HUB_ALLOW` sets what the hub may do. Move agents to it from the hub. `AGENTMGR_HUB_ALLOW_HTTP=1` allows a plain-http hub on a private network.
+- **ACP agents:** any agent that speaks ACP (the Agent Client Protocol) is an engine: Gemini CLI, OpenCode, Goose and Qwen Code are offered when installed, and `"acp": { "<name>": { "command": ["…"], "label": "…" } }` in config.json adds others as `acp-<name>`. AI Agent Manager runs its own terminal client (`bin/acp-client.js`) in the agent's terminal: messages, tool calls and the plan as text, permission requests as a menu the inbox answers (Bypass allows them by itself), file writes kept inside the agent's folder, resume with `session/load`, and a session log it reads for usage, PR links, stuck detection and Explain.
+- **Agents in containers:** **Run each agent in its own container** in New agents (or `agentmgr add --container`, or by default from Settings): the agent runs in Docker and sees only its own folder (at the same path), its repository's git data, its brief and uploads, not the rest of the computer. Its files are written as you. Sessions, resume, tracking and usage work as on the host; **Open shell** opens inside the container; stopping stops the container. Claude Code (signed in with a token from `claude setup-token`, saved in Settings → Containers or `agentmgr sandbox token`) and Codex (its auth.json, read-only). The image (Node, git, ripgrep, Claude Code, Codex) is built from `docker/agent.Dockerfile` with **Build image** or `agentmgr sandbox build`; `agentmgr sandbox status`. Limits and extras in config.json: `"isolation": { "cpus": 2, "memory": "4g", "network": "…", "mounts": […], "env": […] }`.
+
 ## 1.10.0 (2026-10-31)
 
 - **Review scorecard:** an agent's changes scored 0-100 for Intent, Spec (each acceptance criterion met / not met / unverified, with evidence), Tests, Safety, Scope and Plan, with an overall readiness, a recommendation (Ready to approve / Look at these first / Not ready) and **Where to look**: the few hunks a person should read. Facts the app measures cap the model's scores (failing CI, failing checks, code without tests, plan steps ticked, unassessed criteria) and the recommendation follows fixed rules. At the top of Review changes, as a **Scorecard** document, as a badge in Land, in the PR description, and posted on the PR with **Post to PR** (posting again updates the comment). Runs by itself when the agent marks its work done (`"scorecard": { "auto": false }` turns that off); `agentmgr doc <agent> scorecard`.

package/README.md

@@ -85,13 +85,13 @@ Runs on macOS and Linux; on Windows, use WSL2. Requires Node 20+, `git`, and the
 
 ```sh
 npm install -g ai-agentmanager          # the latest release
-npm install -g ai-agentmanager@1.10.0    # or a specific one
+npm install -g ai-agentmanager@1.11.1    # or a specific one
 ```
 
 Or from the repository, at a release tag:
 
 ```sh
-git clone --branch v1.10.0 --depth 1 https://github.com/jdmunta/ai-agentmanager-core.git
+git clone --branch v1.11.1 --depth 1 https://github.com/jdmunta/ai-agentmanager-core.git
 cd ai-agentmanager-core
 npm install
 npm link            # optional: puts `agentmgr` on your PATH
@@ -111,7 +111,7 @@ npm link
 | Installed with | Update |
 | --- | --- |
 | npm | `npm install -g ai-agentmanager@latest` |
-| A clone at a release tag | `git fetch --tags && git checkout v1.10.0 && npm install` (the tag you want) |
+| A clone at a release tag | `git fetch --tags && git checkout v1.11.1 && npm install` (the tag you want) |
 | A clone of `main` | `git pull && npm install` |
 
 **Check your setup.** `agentmgr doctor` checks Node.js, Claude Code and its sign-in, git, `gh`, the data folder, the daemon's port and Chrome, and says how to fix anything missing.
@@ -739,6 +739,27 @@ Google's **Antigravity CLI** (`agy`, signed in with your Google account) works t
 
 Meta's **Muse Code** (`muse`, installed with `curl -fsSL https://dev.meta.ai/install.sh | bash` and signed in with `muse login`) works the same way: `--engine muse`. AI Agent Manager adopts the session Muse starts, resumes it with `muse resume` (a message for a resumed session is typed once Muse is idle), trusts the agent's folder for each run with `--trust-workspace` instead of saving it, reads the conversation and token usage from Muse's session log, shows its trust and approval questions in the inbox, stops it cleanly with SIGTERM, and runs Explain with `muse exec` in the read-only profile. Commands and edits aren't read from its log yet, so stuck detection has less to go on for Muse agents. When Muse runs in contributor mode (an account without a plan), the engine picker says so: Meta may use your code and conversations to improve its products. `engines.muse.bin` points at another binary, and `engines.muse.args` adds arguments to every run.
 
+## Agents in containers
+
+For isolation, an agent can run in its own Docker container: it sees only its own folder (mounted at the same path), its repository's git data, its brief and its uploads, and nothing else on the computer. Everything else works as usual: sessions, resume, tracking and usage, the inbox, **Open shell** (which opens inside the container), stop and restart.
+
+1. Start Docker (Docker Desktop, OrbStack or Colima).
+2. **☰ → Settings → Containers → Build image** (or `agentmgr sandbox build`): Node, git, ripgrep, Claude Code and Codex, from `docker/agent.Dockerfile`. About a minute.
+3. For Claude Code, run `claude setup-token` in a terminal and paste the token in **Settings → Containers** (or `agentmgr sandbox token <token>`); it's kept in `~/.agentmanager/secrets.json`, readable only by you. Codex uses its own `auth.json`, read-only.
+4. Tick **Run each agent in its own container** in New agents (`agentmgr add --container`), or make it the default in Settings.
+
+Claude Code and Codex can run in containers; Antigravity and Muse Code ship macOS-only programs. Files are written as your user. Limits and extras go in config.json: `"isolation": { "cpus": 2, "memory": "4g", "network": "none", "mounts": [{ "host": "~/.npm", "readOnly": true }], "env": ["NPM_TOKEN"] }` (variables are passed by name, so their values stay out of command lines). `agentmgr sandbox status` shows what's ready.
+
+## ACP agents
+
+Any agent that speaks [ACP](https://agentclientprotocol.com) (the Agent Client Protocol) works as an engine. Gemini CLI, OpenCode, Goose and Qwen Code show in the Engine picker once installed (and signed in once in a terminal); add others in config.json:
+
+```json
+"acp": { "myagent": { "command": ["myagent", "acp"], "label": "My Agent" } }
+```
+
+That adds the engine `acp-myagent` (`agentmgr add --engine acp-myagent …`); `"opencode": false` hides a preset. ACP agents have no screen of their own, so AI Agent Manager runs a small terminal client in the agent's terminal: it shows the agent's messages, tool calls and plan, sends what you type as prompts (Ctrl+C cancels the turn), asks permission as a numbered menu that the inbox can answer (**Bypass** allows by itself), writes files only inside the agent's folder and brief, resumes sessions the agent can load, and keeps a log in `~/.agentmanager/acp/<name>/` that drives usage, PR links, stuck detection and Explain.
+
 ## Several machines: the hub
 
 With agents on more than one Mac, a **hub** shows all of them in one place: every machine's agents and one inbox of what needs you. Where a machine allows it, you can also act from the hub: answer, message, start and stop agents, start new ones, and open live terminals. Each Mac keeps running its own daemon. It connects out to the hub, so no ports need opening on it, and the hub's requests travel back over that same connection.
@@ -809,6 +830,8 @@ The conversation passes through the hub in pieces, in memory only for the move,
 
 **On Railway.** `hub/Dockerfile` builds the hub alone, with no node-pty and no Claude. Set `RAILWAY_DOCKERFILE_PATH=hub/Dockerfile`, `AGENTMGR_HUB_TOKEN`, `AGENTMGR_HUB_URL` (its https address) and, for Google sign-in, the three variables above; add a volume at `/data` so enrollments survive redeploys, and join with the `https://…up.railway.app` address.
 
+**Cloud runners.** For agents that keep working with your laptop closed, run AI Agent Manager on a server (Railway, any VM with Docker) as a runner joined to your hub, and Move agents to it: see [docs/cloud-runner.md](docs/cloud-runner.md).
+
 ## Assistant
 
 An always-on Claude session that works on your behalf. **Assistant** in the top bar (or `agentmgr assistant start`) sets it up. Every 15 minutes the daemon asks it to check for new work, and it starts an agent for each new item, or passes the news to the agent already on it. You don't approve each one; it tells you in its activity log and, with Slack alerts on, in Slack.

package/bin/acp-client.js

@@ -0,0 +1,332 @@
+#!/usr/bin/env node
+// A terminal client for agents that speak ACP (the Agent Client Protocol: JSON-RPC over stdio, as
+// Gemini CLI, OpenCode, Goose and others do). AI Agent Manager runs it in an agent's terminal: it
+// starts the agent, draws its messages, tool calls and plan as text, turns lines you type into
+// prompts, asks permission as a numbered menu (so the inbox can answer it), and keeps a session log
+// (JSONL) that AI Agent Manager reads like any engine's transcript.
+//
+//   acp-client.js --log <dir> [--session <id>] [--prompt <text>] [--yes] [--allow-dir <dir>]... -- <agent command...>
+//   acp-client.js --once [--deny] -- <agent command...>      (prompt on stdin; prints only the reply)
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import readline from 'node:readline';
+
+const argv = process.argv.slice(2);
+const sep = argv.indexOf('--');
+if (sep < 0 || sep === argv.length - 1) {
+  console.error('usage: acp-client.js [options] -- <agent command...>');
+  process.exit(2);
+}
+const opts = argv.slice(0, sep);
+const command = argv.slice(sep + 1);
+const flag = (n) => opts.includes(n);
+const value = (n) => (opts.includes(n) ? opts[opts.indexOf(n) + 1] : null);
+const values = (n) => opts.flatMap((o, i) => (o === n ? [opts[i + 1]] : []));
+const once = flag('--once');
+const yes = flag('--yes');
+const deny = flag('--deny');
+const logDir = once ? null : value('--log');
+const cwd = process.cwd();
+const allowDirs = [cwd, ...values('--allow-dir')].map((d) => path.resolve(d));
+
+const DIM = '\x1b[2m';
+const BOLD = '\x1b[1m';
+const CYAN = '\x1b[36m';
+const YELLOW = '\x1b[33m';
+const RESET = '\x1b[0m';
+const out = (s) => (once ? null : process.stdout.write(s));
+
+// ------------------------------------------------------------ the session log
+let logFile = null;
+let pendingLog = [];
+function log(rec) {
+  const line = JSON.stringify({ t: new Date().toISOString(), ...rec }) + '\n';
+  if (!logDir) return;
+  if (!logFile) return void pendingLog.push(line);
+  fs.appendFileSync(logFile, line);
+}
+function openLog(sessionId, fresh) {
+  if (!logDir) return;
+  fs.mkdirSync(logDir, { recursive: true });
+  logFile = path.join(logDir, `${sessionId}.jsonl`);
+  if (fresh || !fs.existsSync(logFile)) fs.appendFileSync(logFile, JSON.stringify({ t: new Date().toISOString(), type: 'meta', sessionId, cwd, agent: command[0] }) + '\n');
+  for (const l of pendingLog) fs.appendFileSync(logFile, l);
+  pendingLog = [];
+}
+
+// ------------------------------------------------------------ JSON-RPC over the agent's stdio
+// Its own process group: Ctrl+C in the terminal reaches only this client, which cancels the turn.
+const child = spawn(command[0], command.slice(1), { cwd, stdio: ['pipe', 'pipe', 'pipe'], env: process.env, detached: !once });
+child.on('error', (err) => {
+  console.error(`${YELLOW}Could not start ${command[0]}: ${err.message}${RESET}`);
+  process.exit(127);
+});
+child.stderr.on('data', (d) => {
+  if (!once && process.env.AGENTMGR_ACP_DEBUG) process.stderr.write(`${DIM}${d}${RESET}`);
+});
+let nextId = 1;
+const waiting = new Map();
+const send = (msg) => child.stdin.write(JSON.stringify({ jsonrpc: '2.0', ...msg }) + '\n');
+const request = (method, params) =>
+  new Promise((resolve, reject) => {
+    const id = nextId++;
+    waiting.set(id, { resolve, reject });
+    send({ id, method, params });
+  });
+const notify = (method, params) => send({ method, params });
+
+readline.createInterface({ input: child.stdout }).on('line', (line) => {
+  let msg;
+  try {
+    msg = JSON.parse(line);
+  } catch {
+    return;
+  }
+  if (msg.id != null && !msg.method) {
+    const w = waiting.get(msg.id);
+    waiting.delete(msg.id);
+    if (!w) return;
+    msg.error ? w.reject(Object.assign(new Error(msg.error.message ?? 'error'), { code: msg.error.code, data: msg.error.data })) : w.resolve(msg.result);
+    return;
+  }
+  if (msg.method === 'session/update') return onUpdate(msg.params?.update ?? {});
+  if (msg.id != null && msg.method) {
+    // The agent asks us something.
+    handle(msg.method, msg.params ?? {}).then(
+      (result) => send({ id: msg.id, result }),
+      (err) => send({ id: msg.id, error: { code: -32603, message: err.message } }),
+    );
+  }
+});
+child.on('exit', (code) => {
+  flushMessage();
+  out(`\r\n${DIM}[agent exited${code ? ` with code ${code}` : ''}]${RESET}\r\n`);
+  process.exit(code ?? 0);
+});
+
+// ------------------------------------------------------------ what the agent sends
+let message = ''; // the agent's reply being streamed
+let replyText = ''; // all reply text this turn (for --once)
+let thinking = false;
+const tools = new Map(); // toolCallId -> { title, kind }
+function flushMessage() {
+  if (message.trim()) log({ type: 'agent', text: message });
+  message = '';
+}
+const textOf = (content) =>
+  (Array.isArray(content) ? content : [content])
+    .map((c) => (c?.type === 'content' ? c.content : c))
+    .map((c) => (c?.type === 'text' ? c.text : ''))
+    .join('');
+
+function onUpdate(u) {
+  switch (u.sessionUpdate) {
+    case 'agent_message_chunk': {
+      const t = u.content?.type === 'text' ? u.content.text : '';
+      if (thinking) out(RESET), (thinking = false);
+      message += t;
+      replyText += t;
+      if (once) return;
+      out(t.replace(/\n/g, '\r\n'));
+      return;
+    }
+    case 'agent_thought_chunk':
+      if (!thinking) out(`${DIM}`), (thinking = true);
+      out((u.content?.text ?? '').replace(/\n/g, '\r\n'));
+      return;
+    case 'user_message_chunk':
+      // History when a session is loaded.
+      out(`\r\n${CYAN}› ${(u.content?.text ?? '').replace(/\n/g, '\r\n  ')}${RESET}\r\n`);
+      return;
+    case 'tool_call': {
+      flushMessage();
+      tools.set(u.toolCallId, { title: u.title ?? 'tool', kind: u.kind ?? 'other' });
+      out(`\r\n${BOLD}⏺ ${u.title ?? 'tool'}${RESET} ${DIM}${u.kind ?? ''}${RESET}\r\n`);
+      log({ type: 'tool', id: u.toolCallId, title: u.title, kind: u.kind, status: u.status ?? 'pending', input: u.rawInput ?? null });
+      return toolContent(u);
+    }
+    case 'tool_call_update': {
+      const t = tools.get(u.toolCallId) ?? { title: u.title ?? 'tool', kind: u.kind ?? 'other' };
+      if (u.title) t.title = u.title;
+      tools.set(u.toolCallId, t);
+      toolContent(u);
+      if (u.status === 'completed' || u.status === 'failed') {
+        const text = textOf(u.content ?? []).trim();
+        const lines = text.split('\n');
+        out(`${DIM}  ⎿ ${u.status === 'failed' ? `${YELLOW}failed${RESET}${DIM}` : 'done'}${lines[0] ? `: ${lines.slice(0, 4).join('\r\n    ')}${lines.length > 4 ? ` … (${lines.length - 4} more lines)` : ''}` : ''}${RESET}\r\n`);
+        log({ type: 'tool', id: u.toolCallId, title: t.title, kind: t.kind, status: u.status, input: u.rawInput ?? null, output: (text || JSON.stringify(u.rawOutput ?? '')).slice(-4000), failed: u.status === 'failed' });
+      }
+      return;
+    }
+    case 'plan':
+      out(`\r\n${BOLD}Plan${RESET}\r\n${(u.entries ?? []).map((e) => `  ${e.status === 'completed' ? '☑' : e.status === 'in_progress' ? '▶' : '☐'} ${e.content}`).join('\r\n')}\r\n`);
+      log({ type: 'plan', entries: (u.entries ?? []).map((e) => ({ content: e.content, status: e.status })) });
+      return;
+    case 'usage_update':
+      log({ type: 'usage', used: u.used ?? null, size: u.size ?? null, cost: u.cost ?? null });
+      return;
+    default:
+  }
+}
+
+/** Diffs in a tool call: the file it edits. */
+function toolContent(u) {
+  for (const c of u.content ?? []) {
+    if (c?.type === 'diff' && c.path) {
+      out(`${DIM}  ✎ ${c.path}${RESET}\r\n`);
+      log({ type: 'edit', path: c.path, removed: String(c.oldText ?? '').split('\n').length, added: String(c.newText ?? '').split('\n').length, oldText: String(c.oldText ?? '').slice(0, 2000), newText: String(c.newText ?? '').slice(0, 2000) });
+    }
+  }
+}
+
+const inside = (p) => allowDirs.some((d) => p === d || p.startsWith(d + path.sep));
+
+/** Requests from the agent: permission, and reading or writing files for it. */
+async function handle(method, p) {
+  if (method === 'session/request_permission') return permission(p);
+  if (method === 'fs/read_text_file') {
+    const text = fs.readFileSync(p.path, 'utf8');
+    if (p.line == null && p.limit == null) return { content: text };
+    const lines = text.split('\n');
+    const from = Math.max(0, (p.line ?? 1) - 1);
+    return { content: lines.slice(from, p.limit != null ? from + p.limit : undefined).join('\n') };
+  }
+  if (method === 'fs/write_text_file') {
+    const target = path.resolve(p.path);
+    if (!inside(target)) throw new Error(`Writing outside the agent's folder is not allowed: ${target}`);
+    const before = fs.existsSync(target) ? fs.readFileSync(target, 'utf8') : '';
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, p.content ?? '');
+    out(`${DIM}  ✎ wrote ${target}${RESET}\r\n`);
+    log({ type: 'edit', path: target, removed: before ? before.split('\n').length : 0, added: String(p.content ?? '').split('\n').length, oldText: before.slice(0, 2000), newText: String(p.content ?? '').slice(0, 2000) });
+    return {};
+  }
+  throw Object.assign(new Error(`Not supported: ${method}`), { code: -32601 });
+}
+
+let answer = null; // resolves with the next line typed while a permission menu is open
+async function permission(p) {
+  const options = p.options ?? [];
+  const title = p.toolCall?.title ?? 'a tool';
+  const pick = (kinds) => options.find((o) => kinds.includes(o.kind));
+  if (yes || deny || once) {
+    const o = deny || once ? pick(['reject_once', 'reject_always']) : pick(['allow_once', 'allow_always']);
+    log({ type: 'permission', title, choice: o?.name ?? 'cancelled', auto: true });
+    return o ? { outcome: { outcome: 'selected', optionId: o.optionId } } : { outcome: { outcome: 'cancelled' } };
+  }
+  flushMessage();
+  out(`\r\n${YELLOW}${BOLD}Permission needed: ${title}${RESET}\r\n${options.map((o, i) => `  ${i + 1}. ${o.name}`).join('\r\n')}\r\n${YELLOW}Choose 1-${options.length} (Enter for 1):${RESET} `);
+  const typed = await new Promise((resolve) => (answer = resolve));
+  const n = Number(typed.trim() || '1');
+  const o = options[n - 1];
+  log({ type: 'permission', title, choice: o?.name ?? 'cancelled' });
+  return o ? { outcome: { outcome: 'selected', optionId: o.optionId } } : { outcome: { outcome: 'cancelled' } };
+}
+
+// ------------------------------------------------------------ the session and prompts
+let sessionId = null;
+let turn = null; // the prompt in flight
+const queue = [];
+
+async function prompt(text) {
+  if (turn) return void queue.push(text);
+  log({ type: 'user', text });
+  replyText = '';
+  out(`${DIM}`);
+  turn = request('session/prompt', { sessionId, prompt: [{ type: 'text', text }] });
+  let stop = 'end_turn';
+  try {
+    stop = (await turn)?.stopReason ?? 'end_turn';
+  } catch (err) {
+    stop = 'error';
+    out(`\r\n${YELLOW}${err.message}${RESET}\r\n`);
+  }
+  turn = null;
+  flushMessage();
+  log({ type: 'turn_end', stopReason: stop });
+  if (once) {
+    process.stdout.write(replyText.trim() + '\n');
+    child.kill();
+    process.exit(stop === 'error' ? 1 : 0);
+  }
+  out(`${RESET}\r\n${stop !== 'end_turn' ? `${DIM}[${stop}]${RESET}\r\n` : ''}`);
+  if (queue.length) return prompt(queue.shift());
+  ready();
+}
+const ready = () => out(`\r\n${CYAN}›${RESET} `);
+
+async function main() {
+  const init = await request('initialize', {
+    protocolVersion: 1,
+    clientCapabilities: { fs: { readTextFile: true, writeTextFile: true }, terminal: false },
+    clientInfo: { name: 'ai-agentmanager', title: 'AI Agent Manager', version: '1' },
+  });
+  const resume = value('--session');
+  if (resume && init?.agentCapabilities?.loadSession) {
+    sessionId = resume;
+    openLog(sessionId, false);
+    out(`${DIM}Resuming session ${sessionId}…${RESET}\r\n`);
+    await request('session/load', { sessionId, cwd, mcpServers: [] });
+  } else {
+    if (resume) out(`${DIM}This agent can't resume sessions; starting a new one.${RESET}\r\n`);
+    sessionId = (await request('session/new', { cwd, mcpServers: [] })).sessionId;
+    openLog(sessionId, true);
+  }
+  out(`${DIM}${init?.agentInfo?.title ?? command[0]} · session ${sessionId}${RESET}\r\n`);
+  const first = value('--prompt');
+  if (once) {
+    let text = '';
+    for await (const chunk of process.stdin) text += chunk;
+    return prompt(text);
+  }
+  if (first) await prompt(first);
+  else ready();
+}
+
+// Lines you type: an answer to an open permission menu, else a prompt. Ctrl+C cancels the turn.
+if (!once) {
+  // Don't echo control characters (a pasted message's markers) as ^[[200~.
+  if (process.stdin.isTTY) spawn('stty', ['-echoctl'], { stdio: ['inherit', 'ignore', 'ignore'] });
+  const rl = readline.createInterface({ input: process.stdin, terminal: false });
+  // A message typed in as a bracketed paste (several lines) is one prompt, not one per line.
+  let pasting = null;
+  rl.on('line', (raw) => {
+    let line = raw;
+    if (line.includes('\x1b[200~')) {
+      pasting = [];
+      line = line.slice(line.indexOf('\x1b[200~') + 6);
+    }
+    if (pasting) {
+      const end = line.indexOf('\x1b[201~');
+      if (end < 0) return void pasting.push(line);
+      pasting.push(line.slice(0, end));
+      line = pasting.join('\n') + line.slice(end + 6);
+      pasting = null;
+    }
+    if (answer) {
+      const a = answer;
+      answer = null;
+      return a(line);
+    }
+    if (line.trim() && sessionId) prompt(line);
+    else if (!turn) ready();
+  });
+  process.on('SIGINT', () => {
+    if (turn && sessionId) {
+      notify('session/cancel', { sessionId });
+      out(`\r\n${DIM}[cancelling…]${RESET}\r\n`);
+    } else {
+      child.kill();
+      process.exit(130);
+    }
+  });
+  for (const sig of ['SIGTERM', 'SIGHUP']) process.on(sig, () => (child.kill('SIGTERM'), process.exit(0)));
+}
+
+main().catch((err) => {
+  const auth = /auth/i.test(err.message) || err.code === -32000;
+  console.error(`\r\n${YELLOW}${auth ? `${command[0]} needs signing in first (run it once in a terminal): ` : ''}${err.message}${RESET}`);
+  child.kill();
+  process.exit(1);
+});

package/docker/agent.Dockerfile

@@ -0,0 +1,15 @@
+# The image agents run in when isolated ("Run in a container"): Node, git and common build tools,
+# with Claude Code and Codex. Build it with `agentmgr sandbox build` (or Settings → Containers).
+# Only the agent's own folder, its git data, brief and uploads are mounted from the host.
+FROM node:22-bookworm-slim
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends git ca-certificates curl ripgrep jq python3 make g++ openssh-client less procps \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN npm install -g @anthropic-ai/claude-code @openai/codex && npm cache clean --force
+
+# Agents run as the host's user id (files they write stay yours); any user can use this home.
+RUN mkdir -p /home/agent && chmod 1777 /home/agent
+ENV HOME=/home/agent
+WORKDIR /home/agent

package/docker/compose.runner.yml

@@ -0,0 +1,22 @@
+# A cloud runner on any server with Docker: `docker compose -f docker/compose.runner.yml up -d`
+# from the repository root, with the variables below in a .env file next to it (see docs/cloud-runner.md).
+services:
+  runner:
+    build:
+      context: ..
+      dockerfile: docker/runner.Dockerfile
+    restart: unless-stopped
+    volumes:
+      - runner-data:/data
+    environment:
+      AGENTMGR_HUB_URL: ${AGENTMGR_HUB_URL}            # https://your-hub.example.com
+      AGENTMGR_HUB_CODE: ${AGENTMGR_HUB_CODE}          # the hub's runner token (or a one-time invite)
+      AGENTMGR_RUNNER_NAME: ${AGENTMGR_RUNNER_NAME:-cloud}
+      AGENTMGR_HUB_ALLOW: ${AGENTMGR_HUB_ALLOW:-view,control,move}
+      CLAUDE_CODE_OAUTH_TOKEN: ${CLAUDE_CODE_OAUTH_TOKEN} # from `claude setup-token`
+      OPENAI_API_KEY: ${OPENAI_API_KEY:-}               # for Codex, if you use it
+      GH_TOKEN: ${GH_TOKEN}                              # clones, pushes and pull requests
+      GIT_USER_NAME: ${GIT_USER_NAME:-}
+      GIT_USER_EMAIL: ${GIT_USER_EMAIL:-}
+volumes:
+  runner-data:

package/docker/runner-entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Start a cloud runner: folders on the volume, git identity and GitHub access from the environment,
+# Claude Code's first-run screens answered, then the daemon (it joins the hub by itself).
+set -e
+mkdir -p "$HOME" "$AGENTMGR_HOME"
+git config --global user.name "${GIT_USER_NAME:-AI Agent Manager runner}"
+git config --global user.email "${GIT_USER_EMAIL:-runner@agentmanager.invalid}"
+git config --global init.defaultBranch main
+if [ -n "$GH_TOKEN" ]; then gh auth setup-git >/dev/null 2>&1 || true; fi
+[ -f "$HOME/.claude.json" ] || echo '{"hasCompletedOnboarding":true,"theme":"dark"}' > "$HOME/.claude.json"
+# The hub reaches agents through this runner's own connection; nothing listens publicly.
+exec agentmgr serve

package/docker/runner.Dockerfile

@@ -0,0 +1,31 @@
+# A cloud runner: AI Agent Manager running headless on a server, joined to your hub, so agents keep
+# working with your laptop closed. Build from the repository root:
+#   docker build -f docker/runner.Dockerfile -t ai-agentmanager-runner .
+# Run with a volume on /data and the environment in docs/cloud-runner.md (hub address and code,
+# Claude token, GitHub token). Move agents to it from the hub.
+FROM node:22-bookworm-slim
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends git ca-certificates curl ripgrep jq python3 make g++ openssh-client less procps \
+  && rm -rf /var/lib/apt/lists/*
+# GitHub CLI (pull requests, checks).
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+  && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list \
+  && apt-get update && apt-get install -y --no-install-recommends gh && rm -rf /var/lib/apt/lists/*
+RUN npm install -g @anthropic-ai/claude-code @openai/codex && npm cache clean --force
+
+WORKDIR /opt/agentmanager
+COPY package.json package-lock.json ./
+# The install runs scripts/fix-pty.js (node-pty's helper permissions).
+COPY scripts ./scripts
+RUN npm ci --omit=dev && npm cache clean --force
+COPY bin ./bin
+COPY src ./src
+COPY public ./public
+COPY docker ./docker
+RUN ln -s /opt/agentmanager/bin/agentmgr.js /usr/local/bin/agentmgr
+
+# Everything that has to survive a redeploy lives on the /data volume.
+ENV HOME=/data/home AGENTMGR_HOME=/data/agentmanager AGENTMGR_REMOTE=0 NODE_ENV=production
+VOLUME /data
+ENTRYPOINT ["/opt/agentmanager/docker/runner-entrypoint.sh"]

package/docs/cloud-runner.md

@@ -0,0 +1,62 @@
+# Cloud runners: agents that keep working with your laptop closed
+
+A cloud runner is AI Agent Manager running headless on a server, joined to your [hub](distributed.md). It shows up next to your Macs; you start agents on it from the hub, or **Move** an agent there from a Mac and close the laptop. Agents use your own subscriptions (a Claude token, your OpenAI key) and your GitHub token, nothing billed by AI Agent Manager.
+
+## What you need
+
+- A hub on an `https` address (Railway, a VPS behind a TLS proxy, or Tailscale).
+- On the hub, a **runner token**: a long random secret that lets machines join by themselves. Set it on the hub's service:
+
+  ```sh
+  AGENTMGR_HUB_RUNNER_TOKEN=$(openssl rand -hex 24)   # at least 24 characters
+  ```
+
+  (A one-time invite code from `agentmgr hub invite` works too, but it expires in 10 minutes, so a runner that is rebuilt from scratch couldn't join again.)
+- A Claude token: run `claude setup-token` on any computer and keep the token. For Codex, an OpenAI API key.
+- A GitHub token (`GH_TOKEN`) that can clone, push and open pull requests on your repositories.
+
+## The runner's settings
+
+| Variable | |
+| --- | --- |
+| `AGENTMGR_HUB_URL` | The hub, e.g. `https://hub.example.com` |
+| `AGENTMGR_HUB_CODE` | The hub's runner token (or an invite code) |
+| `AGENTMGR_RUNNER_NAME` | Its name on the hub (default: the hostname) |
+| `AGENTMGR_HUB_ALLOW` | What the hub may do: `view,control,move` (move lets you send agents to it) |
+| `CLAUDE_CODE_OAUTH_TOKEN` | From `claude setup-token` |
+| `OPENAI_API_KEY` | For Codex (optional) |
+| `GH_TOKEN` | For git and `gh` |
+| `GIT_USER_NAME`, `GIT_USER_EMAIL` | The author of its commits |
+| `AGENTMGR_HUB_ALLOW_HTTP=1` | Only for a hub on the same private network over plain http (one docker-compose, one VPC) |
+
+It joins the hub by itself on first start and keeps its key on its volume, so restarts and redeploys reconnect without joining again. Everything it keeps (agents, workspaces, Claude and Codex homes) lives on the `/data` volume. Nothing on it listens publicly: the hub reaches it over its own outgoing connection.
+
+## Railway
+
+1. **New service → GitHub repo** (your fork of ai-agentmanager-core).
+2. **Settings → Build**: Dockerfile path `docker/runner.Dockerfile`.
+3. **Settings → Volumes**: add a volume mounted at `/data`.
+4. **Variables**: the table above.
+5. Deploy. In the hub, the runner appears under machines within a minute.
+
+## Any server with Docker
+
+```sh
+git clone https://github.com/jdmunta/ai-agentmanager-core && cd ai-agentmanager-core
+cat > docker/.env <<'VARS'
+AGENTMGR_HUB_URL=https://hub.example.com
+AGENTMGR_HUB_CODE=<the hub's runner token>
+AGENTMGR_RUNNER_NAME=cloud-1
+CLAUDE_CODE_OAUTH_TOKEN=<from claude setup-token>
+GH_TOKEN=<github token>
+VARS
+docker compose -f docker/compose.runner.yml --env-file docker/.env up -d
+```
+
+Or by hand: `docker build -f docker/runner.Dockerfile -t ai-agentmanager-runner .` then `docker run -d --restart unless-stopped -v runner-data:/data -e … ai-agentmanager-runner`.
+
+## Using it
+
+- **Move an agent there**: on the hub, **Move to… → cloud-1** (or `agentmgr fleet move mini/<agent> --to cloud-1`). Its branch goes through your repository's remote and its conversation through the hub; it carries on where it was. Both machines must allow `move`.
+- **Start agents on it**: New agent on the hub, choosing the runner; or give the shared backlog work and let the runner pick it up.
+- Answer its prompts and read its terminals from the hub, from any device.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-agentmanager",
-  "version": "1.10.0",
+  "version": "1.11.1",
   "description": "Run background coding agents (Claude Code, Codex) per intent, and keep track of them from a web UI, your phone or the CLI",
   "keywords": [
     "claude",
@@ -29,6 +29,7 @@
     "bin",
     "src",
     "public",
+    "docker",
     "scripts",
     "docs",
     "README.md",