ai-agentmanager 1.10.0 → 1.11.1

package/public/app.js

@@ -6,6 +6,7 @@ import { touchScroll } from '/touchscroll.js';
 import { openStream, post, REMOTE } from '/transport.js';
 import { attachBox } from '/attach.js';
 import { initSide } from '/side.js';
+import { openCopy, pasteInto } from '/termclip.js';
 import { addTools, download, htmlFile, initExport } from '/export.js';
 import { badgeHtml as scoreBadge, scorecardHtml, scorecardSpeech } from '/scorecard.js';
 import { bindListen, listenHtml, play, speakable, now as speaking, stop as stopSpeaking } from '/speak.js';
@@ -709,7 +710,7 @@ function agentItem(a) {
   const idle = !isActive(a);
   return `<li data-id="${a.id}" ${a.kind === 'general' || a.kind === 'assistant' ? '' : 'draggable="true" '}class="agent pr${a.priority ?? 2} ${a.id === selectedId ? 'selected' : ''} ${idle ? 'idle' : ''}">
     <div class="line1">${prioChip(a.priority ?? 2)}${a.results?.outcome === 'blocked' ? '<span class="outcome-mark" title="Blocked">⛔</span>' : a.results?.outcome === 'done' ? '<span class="outcome-mark" title="Done">✅</span>' : ''}<span class="name">${esc(a.name)}</span>${flags(a)}<span class="pill ${st}">${pillText(st)}</span></div>
-    <div class="intent" title="${esc(describeTitle(a) ?? '')}">${a.kind === 'general' ? '<span class="tag">general</span> ' : a.kind === 'assistant' ? '<span class="tag assistant">assistant</span> ' : a.startedBy ? '<span class="tag assistant" title="Started by the assistant">🤖 by assistant</span> ' : a.trigger ? `<span class="tag assistant" title="Started from ${a.trigger.source === 'github' ? 'a labeled GitHub issue' : 'the webhook'}${a.trigger.url ? `: ${esc(a.trigger.url)}` : ''}">⚡ ${a.trigger.source === 'github' ? 'GitHub' : 'webhook'}</span> ` : a.playbook ? `<span class="tag assistant" title="Started by the playbook ${esc(a.playbook.name)}">▶ ${esc(a.playbook.name)}</span> ` : ''}${a.engine && a.engine !== 'claude' ? `<span class="tag engine">${esc(ENGINE_LABEL[a.engine] ?? a.engine)}</span> ` : ''}${esc(describe(a) || (a.kind === 'assistant' ? 'Finds new work and starts agents for it' : 'General session'))}</div>
+    <div class="intent" title="${esc(describeTitle(a) ?? '')}">${a.kind === 'general' ? '<span class="tag">general</span> ' : a.kind === 'assistant' ? '<span class="tag assistant">assistant</span> ' : a.startedBy ? '<span class="tag assistant" title="Started by the assistant">🤖 by assistant</span> ' : a.trigger ? `<span class="tag assistant" title="Started from ${a.trigger.source === 'github' ? 'a labeled GitHub issue' : 'the webhook'}${a.trigger.url ? `: ${esc(a.trigger.url)}` : ''}">⚡ ${a.trigger.source === 'github' ? 'GitHub' : 'webhook'}</span> ` : a.playbook ? `<span class="tag assistant" title="Started by the playbook ${esc(a.playbook.name)}">▶ ${esc(a.playbook.name)}</span> ` : ''}${a.engine && a.engine !== 'claude' ? `<span class="tag engine">${esc(ENGINE_LABEL[a.engine] ?? a.engine)}</span> ` : ''}${a.isolation === 'container' ? '<span class="tag engine" title="Runs in its own Docker container: it sees only its own folder">📦 container</span> ' : ''}${esc(describe(a) || (a.kind === 'assistant' ? 'Finds new work and starts agents for it' : 'General session'))}</div>
     ${a.status === 'preparing' && a.progress ? `<div class="progress-line">${esc(progressText(a.progress))}</div>` : ''}
     <div class="meta">
       <span class="mono">${a.id}</span>
@@ -3271,6 +3272,7 @@ function openNewDialog(mode = 'now') {
   $('#new-error').hidden = true;
   dialog.querySelector(`input[name="when"][value="${mode}"]`).checked = true;
   restoreIntentSplit();
+  loadIsolation();
   syncWhen();
   dialog.showModal();
   dialog.querySelector('textarea').focus();
@@ -3433,6 +3435,7 @@ $('#new-form').addEventListener('submit', async (e) => {
         model: f.get('model') || undefined,
         engine: f.get('engine') || undefined,
         worktree: f.get('worktree') ? true : undefined,
+        ...containerChoice(e.target),
         plan: Boolean(f.get('plan')),
         planReview: Boolean(f.get('planReview')),
         priority: Number(f.get('priority')),
@@ -3464,6 +3467,7 @@ $('#new-form').addEventListener('submit', async (e) => {
       plan: Boolean(f.get('plan')),
       planReview: Boolean(f.get('planReview')),
       start: Boolean(f.get('start')),
+      ...containerChoice(e.target),
     });
     created.forEach((a) => agents.set(a.id, a));
     dialog.close();
@@ -3657,6 +3661,10 @@ const KEYS = {
   enter: '\r', ctrlc: '\x03', 1: '1', 2: '2', 3: '3', 4: '4',
 };
 $('#keybar').addEventListener('click', (e) => {
+  // Copy / Paste: a phone can't select xterm's text or paste into it directly (termclip.js).
+  const clip = e.target.closest('[data-clip-act]')?.dataset.clipAct;
+  if (clip === 'copy') return openCopy(term.xterm, { esc, toast });
+  if (clip === 'paste') return pasteInto(term.xterm, { toast });
   const key = e.target.closest('[data-key]')?.dataset.key;
   if (key) term.send({ t: 'i', d: KEYS[key] });
 });
@@ -4152,9 +4160,36 @@ const describe = (a) => a.synopsis?.text || a.intent;
 const describeTitle = (a) => (a.synopsis?.text ? `${a.synopsis.source === 'jira' ? `${a.synopsis.key} in Jira` : `${a.synopsis.key} (summary not fetched; your words after the link)`}. Request: ${a.intent}` : a.intent);
 
 const ENGINE_LABEL = { claude: 'Claude', codex: 'Codex', antigravity: 'Antigravity', muse: 'Muse Code' };
+// Containers: offered when Docker runs here; Claude Code and Codex only.
+let isolationInfo = null;
+const containerChoice = (form) => (isolationInfo?.available && !$('#container-field').hidden ? { isolation: form.container.checked ? 'container' : '' } : {});
+function syncContainerField() {
+  const form = $('#new-form');
+  const engine = form.engine?.value || 'claude';
+  const ok = isolationInfo?.available && isolationInfo.engines.includes(engine);
+  $('#container-field').hidden = !isolationInfo?.available;
+  form.container.disabled = !ok || !isolationInfo.imageBuilt;
+  if (!ok) form.container.checked = false;
+  $('#container-hint').textContent = !ok ? '(Claude Code and Codex only)' : !isolationInfo.imageBuilt ? '(build the image first: ☰ → Settings → Containers)' : !isolationInfo.hasClaudeToken && engine === 'claude' ? '(add the Claude token in ☰ → Settings → Containers)' : '(Docker: it sees only its own folder)';
+}
+async function loadIsolation() {
+  try {
+    isolationInfo = await api('GET', '/isolation');
+  } catch {
+    isolationInfo = null;
+  }
+  const form = $('#new-form');
+  form.container.checked = isolationInfo?.default === 'container';
+  syncContainerField();
+}
+$('#new-form').engine?.addEventListener('change', syncContainerField);
+
 async function loadEngines() {
   try {
-    const list = (await api('GET', '/engines')).filter((e) => e.installed && e.id !== 'claude');
+    const all = await api('GET', '/engines');
+    // Engine names for tags and tabs, ACP agents included.
+    for (const e of all) ENGINE_LABEL[e.id] ??= e.label;
+    const list = all.filter((e) => e.installed && e.id !== 'claude');
     // Something to know before choosing an engine (Muse Code in contributor mode, say).
     const notices = Object.fromEntries(list.filter((e) => e.notice).map((e) => [e.id, e.notice]));
     for (const [field, notice] of [['#engine-field', '#engine-notice'], ['#ask-engine-field', '#ask-engine-notice']]) {

package/public/index.html

@@ -161,6 +161,8 @@
           </div>
           <div id="term-drop" class="term-drop" hidden>Drop files to attach</div>
           <div class="keybar" id="keybar" aria-label="Terminal keys">
+            <button data-clip-act="copy" title="Copy text from the terminal">Copy</button>
+            <button data-clip-act="paste" title="Paste into the terminal">Paste</button>
             <button data-key="esc">Esc</button>
             <button data-key="tab">Tab</button>
             <button data-key="stab" title="Shift+Tab: cycle permission mode">⇧Tab</button>
@@ -245,6 +247,10 @@
           <input type="checkbox" name="worktree" checked />
           Give each agent its own git worktree and branch <span class="hint">(for a git folder; always on when cloning a repo URL)</span>
         </label>
+        <label class="check" id="container-field" hidden title="The agent sees only its own folder, its git data, brief and uploads, not the rest of this computer. Claude Code and Codex">
+          <input type="checkbox" name="container" />
+          Run each agent in its own container <span class="hint" id="container-hint">(Docker: it sees only its own folder)</span>
+        </label>
         <label class="check">
           <input type="checkbox" name="plan" checked />
           Plan with Claude while the repo clones <span class="hint">(repo URLs only; the session moves into the repo when it's ready)</span>
@@ -722,6 +728,15 @@
           <label class="check"><input type="checkbox" name="startAtLogin" /> Start AI Agent Manager when I log in</label>
           <p class="hint">After a restart or a crash, the daemon comes back by itself and running agents resume; without it, it starts only when you run <code>agentmgr</code>. <span id="settings-service-state"></span></p>
         </fieldset>
+        <fieldset class="local-only" id="settings-containers">
+          <legend>Containers</legend>
+          <p class="hint">Agents in a container (Docker) see only their own folder, its git data, brief and uploads: not the rest of this computer. <span id="settings-containers-state"></span></p>
+          <div class="row">
+            <label>Claude token for containers <span class="hint">run <code>claude setup-token</code> in a terminal and paste it</span><input name="claudeToken" type="password" autocomplete="new-password" /></label>
+            <div class="containers-actions"><button type="button" class="small" id="containers-build">Build image</button></div>
+          </div>
+          <label class="check"><input type="checkbox" name="containerDefault" /> Run new agents in containers by default</label>
+        </fieldset>
         <fieldset class="local-only">
           <legend>Jira</legend>
           <p class="hint">For an agent created from a Jira link, its description shows the issue's summary. Public issues on Atlassian Cloud need nothing here; for your company's site, add it with your email and an <a href="https://id.atlassian.com/manage-profile/security/api-tokens" target="_blank" rel="noopener">API token</a>. The token is kept on this computer and sent only to that site.</p>
@@ -738,7 +753,7 @@
         </fieldset>
         <fieldset>
           <legend>More</legend>
-          <p class="hint settings-links"><button type="button" class="link" data-open="cleanup-btn">Clean up old agents</button> · <button type="button" class="link" data-open="spend-btn">Spend and budgets</button> · <button type="button" class="link local-only" data-open="alerts-btn">Slack alerts</button> · <button type="button" class="link local-only" data-open="remote-btn">Remote access</button></p>
+          <p class="hint settings-links"><button type="button" class="link" data-open="cleanup-btn">Clean up old agents</button><button type="button" class="link" data-open="spend-btn">Spend and budgets</button><button type="button" class="link local-only" data-open="alerts-btn">Slack alerts</button><button type="button" class="link local-only" data-open="remote-btn">Remote access</button></p>
         </fieldset>
         <p id="settings-error" class="error" hidden></p>
         <div class="dialog-actions">
@@ -754,6 +769,8 @@
         <button class="term-tab term-add" id="machine-new" title="Open another terminal">+ Terminal</button>
         <span id="machine-title" class="hint"></span>
         <span class="spacer"></span>
+        <button id="machine-copy" class="ghost small" title="Copy text from the terminal">Copy</button>
+        <button id="machine-paste" class="ghost small" title="Paste into the terminal">Paste</button>
         <button id="machine-close" class="ghost small" title="Hide (the shells keep running)">Hide</button>
       </div>
       <div id="machine-term" class="terminal"></div>

package/public/machine.js

@@ -2,6 +2,7 @@
 // any signed-in device (over remote access it streams like an agent's shell). The shells keep
 // running when the window is hidden; × ends one.
 import { openStream } from '/transport.js';
+import { openCopy, pasteInto } from '/termclip.js';
 
 const MACHINE = '__machine__';
 
@@ -86,6 +87,9 @@ export function initMachine({ api, esc, toast, $, Terminal, FitAddon }) {
     shells = [...new Set([...shells, n])];
     connect(n);
   };
+  // Copy / Paste buttons: on a phone the terminal's text can't be selected or pasted into directly.
+  $('#machine-copy').onclick = () => xterm && openCopy(xterm, { esc, toast });
+  $('#machine-paste').onclick = () => xterm && pasteInto(xterm, { toast });
   $('#machine-close').onclick = () => {
     conn?.close();
     conn = null;

package/public/menu.js

@@ -55,6 +55,36 @@ export function initMenu({ api, esc, toast, $ }) {
   const form = $('#settings-form');
   let service = null; // the login service as the dialog opened
   let jira = null; // the Jira settings as the dialog opened
+  let containers = null; // Docker and the agent image as the dialog opened
+  function showContainers() {
+    const c = containers;
+    $('#settings-containers').hidden = !c;
+    if (!c) return;
+    $('#settings-containers-state').textContent = !c.available
+      ? `Docker isn't running here${c.error ? ` (${c.error})` : ''}.`
+      : `Docker ${c.version} · image ${c.image}: ${c.building ? 'building…' : c.imageBuilt ? 'built' : 'not built yet'}${c.buildError ? ` (last build failed: ${c.buildError})` : ''} · Claude token ${c.hasClaudeToken ? 'set' : 'not set'}.`;
+    $('#containers-build').disabled = !c.available || c.building;
+    $('#containers-build').textContent = c.building ? 'Building…' : c.imageBuilt ? 'Rebuild image' : 'Build image';
+    form.containerDefault.disabled = !c.available;
+  }
+  $('#containers-build').onclick = async () => {
+    try {
+      containers = await api('POST', '/isolation/build');
+      showContainers();
+      toast('Building the agent image; it takes a few minutes the first time', 6000);
+      // Watch it finish.
+      const t = setInterval(async () => {
+        containers = await api('GET', '/isolation').catch(() => containers);
+        if (dialog.open) showContainers();
+        if (!containers?.building) {
+          clearInterval(t);
+          toast(containers?.imageBuilt && !containers.buildError ? 'Agent image built: agents can run in containers' : `Image build failed: ${containers?.buildError ?? 'see the daemon log'}`, 8000);
+        }
+      }, 5000);
+    } catch (err) {
+      toast(`Error: ${err.message}`, 6000);
+    }
+  };
   $('#settings-btn').onclick = async () => {
     $('#settings-error').hidden = true;
     try {
@@ -70,6 +100,11 @@ export function initMenu({ api, esc, toast, $ }) {
         form.jiraEmail.value = jira?.email ?? '';
         form.jiraToken.value = '';
         form.jiraToken.placeholder = jira?.hasToken ? 'saved (type to replace)' : '';
+        containers = await api('GET', '/isolation').catch(() => null);
+        showContainers();
+        form.claudeToken.value = '';
+        form.claudeToken.placeholder = containers?.hasClaudeToken ? 'saved (type to replace)' : 'from claude setup-token';
+        form.containerDefault.checked = containers?.default === 'container';
         service = await api('GET', '/service').catch(() => null);
         $('#settings-service').hidden = !service?.supported;
         form.startAtLogin.checked = Boolean(service?.installed);
@@ -96,6 +131,10 @@ export function initMenu({ api, esc, toast, $ }) {
         await api('PUT', '/jira', { site: form.jiraSite.value.trim(), email: form.jiraEmail.value.trim(), token: form.jiraToken.value.trim() || undefined });
         toast('Jira saved; summaries for agents from Jira links are being fetched', 4000);
       }
+      if (!remote() && containers?.available) {
+        if (form.claudeToken.value.trim()) await api('PUT', '/isolation/token', { token: form.claudeToken.value.trim() });
+        if (form.containerDefault.checked !== (containers.default === 'container')) await api('PUT', '/isolation/default', { container: form.containerDefault.checked });
+      }
       // Only when it changed: installing touches launchd / systemd.
       if (!remote() && service?.supported && form.startAtLogin.checked !== Boolean(service.installed)) {
         const s = await api('PUT', '/service', { enabled: form.startAtLogin.checked });

package/public/style.css

@@ -934,3 +934,18 @@ form.dropping { outline: 2px dashed var(--accent, #6b8cff); outline-offset: 4px;
 .rv-hunk.flash td { animation: rvflash 1.6s; }
 @keyframes rvflash { 0%, 60% { background: var(--accent); color: var(--accent-text); } }
 @media (max-width: 640px) { .sc-row { grid-template-columns: 56px 1fr 28px; } .sc-why { grid-column: 1 / -1; } }
+
+.containers-actions { display: flex; align-items: flex-end; }
+
+/* Settings → More: separators belong to the links, so hidden (local-only) ones leave none behind. */
+.settings-links button + button::before { content: '·'; display: inline-block; margin: 0 8px; color: var(--muted); }
+body.remote .settings-links .local-only { display: none; }
+
+/* Copy / Paste sheets for terminals on touch screens. */
+.clip-sheet { width: min(760px, calc(100vw - 16px)); max-height: calc(100vh - 32px); padding: 0; display: flex; flex-direction: column; }
+.clip-sheet:not([open]) { display: none; }
+.clip-head { display: flex; align-items: center; gap: 8px; padding: 10px 12px; border-bottom: 1px solid var(--border); flex-wrap: wrap; }
+.clip-text { margin: 0; padding: 10px 12px; overflow: auto; flex: 1; min-height: 200px; max-height: 70vh; font: 12px/1.45 var(--mono, ui-monospace, monospace); white-space: pre-wrap; word-break: break-word; -webkit-user-select: text; user-select: text; background: var(--term-bg); color: #e6edf3; }
+.clip-box { margin: 10px 12px; width: calc(100% - 24px); font: 13px var(--mono, ui-monospace, monospace); }
+.clip-foot { display: flex; align-items: center; gap: 8px; padding: 0 12px 12px; }
+.clip-foot .hint { flex: 1; }

package/public/termclip.js

@@ -0,0 +1,92 @@
+// Copy and paste for terminals on touch screens. xterm draws its text itself, so a phone can't
+// long-press-select it, and its hidden input rarely gets the paste menu. Copy opens the terminal's
+// recent output as plain text the phone can select (or Copy all); Paste reads the clipboard (the
+// phone asks first) or, where it can't, offers a box to paste into, then sends it as one paste.
+
+const MAX_LINES = 600;
+
+/** The terminal's text: the last lines of its buffer, trailing blanks trimmed. */
+export function terminalText(xterm, max = MAX_LINES) {
+  const buf = xterm.buffer.active;
+  const lines = [];
+  for (let i = Math.max(0, buf.length - max); i < buf.length; i++) {
+    const line = buf.getLine(i);
+    if (!line) continue;
+    // A wrapped line continues the one before it.
+    if (line.isWrapped && lines.length) lines[lines.length - 1] += line.translateToString(true);
+    else lines.push(line.translateToString(true));
+  }
+  while (lines.length && !lines.at(-1).trim()) lines.pop();
+  return lines.join('\n');
+}
+
+function sheet(html) {
+  const d = document.createElement('dialog');
+  d.className = 'clip-sheet';
+  d.innerHTML = html;
+  document.body.append(d);
+  d.addEventListener('close', () => d.remove());
+  d.showModal();
+  return d;
+}
+
+async function writeClipboard(text) {
+  try {
+    await navigator.clipboard.writeText(text);
+    return true;
+  } catch {
+    // Older browsers, or no permission: copy through a selected text area.
+    const t = Object.assign(document.createElement('textarea'), { value: text });
+    t.style.cssText = 'position:fixed;opacity:0';
+    document.body.append(t);
+    t.select();
+    const ok = document.execCommand?.('copy');
+    t.remove();
+    return Boolean(ok);
+  }
+}
+
+/** Copy: the terminal's text in a sheet, selectable with the phone's own handles, and Copy all. */
+export function openCopy(xterm, { esc, toast }) {
+  const text = terminalText(xterm);
+  const d = sheet(`<div class="clip-head"><b>Copy from the terminal</b><span class="hint">Select with your finger, or copy it all</span><span class="spacer"></span><button type="button" class="small primary" data-clip="all">Copy all</button><button type="button" class="small ghost" data-clip="close">Close</button></div>
+    <pre class="clip-text">${esc(text) || '<span class="hint">Nothing in this terminal yet.</span>'}</pre>`);
+  // Open at the end, where the latest output is.
+  const pre = d.querySelector('.clip-text');
+  pre.scrollTop = pre.scrollHeight;
+  d.addEventListener('click', async (e) => {
+    const act = e.target.closest('[data-clip]')?.dataset.clip;
+    if (act === 'close') d.close();
+    if (act === 'all') {
+      toast((await writeClipboard(text)) ? 'Copied the terminal text' : 'Copy failed: select the text and use your phone\'s Copy', 3000);
+      d.close();
+    }
+  });
+}
+
+/** Paste: the clipboard into the terminal (one paste, not submitted), or a box to paste into. */
+export async function pasteInto(xterm, { toast }) {
+  try {
+    const text = await navigator.clipboard.readText();
+    if (text) {
+      xterm.paste(text);
+      return;
+    }
+  } catch {
+    // Not allowed here (or refused): fall back to a box the phone can paste into.
+  }
+  const d = sheet(`<div class="clip-head"><b>Paste into the terminal</b><span class="spacer"></span><button type="button" class="small ghost" data-clip="close">Cancel</button></div>
+    <textarea class="clip-box" rows="6" placeholder="Long-press here and choose Paste"></textarea>
+    <div class="clip-foot"><span class="hint">It goes in as typed text; press Enter (⏎) in the terminal when you want it run.</span><button type="button" class="small primary" data-clip="send">Insert</button></div>`);
+  const box = d.querySelector('.clip-box');
+  box.focus();
+  d.addEventListener('click', (e) => {
+    const act = e.target.closest('[data-clip]')?.dataset.clip;
+    if (act === 'close') d.close();
+    if (act === 'send') {
+      if (box.value) xterm.paste(box.value);
+      else toast('Nothing to paste');
+      d.close();
+    }
+  });
+}

package/src/backlog.js

@@ -89,7 +89,7 @@ export class Backlog extends EventEmitter {
   // ------------------------------------------------------------ editing
 
   /** Queue one item per title. Options are what an agent would take (repo, dir, base, project, ...). */
-  add(titles, { repo, dir, base, project, worktree, permissionMode, model, plan, planReview, engine, attachments, priority = 2 } = {}) {
+  add(titles, { repo, dir, base, project, worktree, permissionMode, model, plan, planReview, engine, attachments, isolation, priority = 2 } = {}) {
     const list = titles.map((t) => String(t ?? '').trim()).filter(Boolean);
     if (!list.length) throw err(400, 'At least one item is required');
     const pr = parsePriority(priority);
@@ -122,6 +122,8 @@ export class Backlog extends EventEmitter {
         engine: engine || null,
         // Staged uploads; each item's agent gets its own copies when it starts.
         attachments: Array.isArray(attachments) && attachments.length ? attachments.slice(0, 20).map(String) : undefined,
+        // "container", "" (on this computer), or undefined (the default when it starts).
+        isolation: isolation === undefined ? undefined : isolation || '',
         plan: Boolean(plan),
         planReview: planReview ?? null,
         priority: pr,
@@ -222,6 +224,7 @@ export class Backlog extends EventEmitter {
       model: it.model,
       engine: it.engine ?? undefined,
       attachments: it.attachments,
+      isolation: it.isolation,
       plan: it.plan,
       planReview: it.planReview ?? undefined,
       priority: it.priority,

package/src/cli.js

@@ -343,6 +343,8 @@ export async function main(argv) {
     .option('-m, --model <model>', 'model (for the chosen engine)')
     .option('-e, --engine <engine>', 'agent engine: claude (default), codex, antigravity or muse')
     .option('--file-attach <path>', 'attach a file to the request (a screenshot, a log); repeat for more', collect)
+    .option('--container', 'run each agent in its own Docker container (see agentmgr sandbox)')
+    .option('--no-container', 'run on this computer even if containers are the default')
     .option('--plan', 'while a repo URL clones, plan the task with Claude (moves into the repo when ready)')
     .option('--no-start', 'create without launching')
     .option('-a, --attach', 'attach to the agent after launch (single intent only)')
@@ -357,6 +359,7 @@ export async function main(argv) {
       const created = await api('POST', '/agents', {
         intents,
         attachments,
+        isolation: cmd.getOptionValueSource('container') === 'cli' ? (opts.container ? 'container' : '') : undefined,
         repo: opts.repo,
         dir: opts.dir,
         name: opts.name,
@@ -383,6 +386,39 @@ export async function main(argv) {
       }
     });
 
+  const sb = program.command('sandbox').description('Agents in Docker containers: status, building the agent image, the Claude token');
+  sb.command('status')
+    .description('Whether Docker runs, the agent image is built, and containers can sign in to Claude')
+    .action(async () => {
+      await daemon();
+      const s = await api('GET', '/isolation');
+      console.log(`Docker:       ${s.available ? green(`running (${s.version})`) : yellow(`not available${s.error ? `: ${s.error}` : ''}`)}`);
+      console.log(`Agent image:  ${s.image} ${s.imageBuilt ? green('built') : s.building ? yellow('building…') : yellow('not built (agentmgr sandbox build)')}`);
+      console.log(`Claude token: ${s.hasClaudeToken ? green('set') : yellow('not set (run `claude setup-token`, then agentmgr sandbox token <token>)')}`);
+      console.log(`Default:      ${s.default === 'container' ? 'new agents run in containers' : 'new agents run on this computer'}`);
+      if (s.buildError) console.log(yellow(`Last build failed: ${s.buildError}`));
+    });
+  sb.command('build')
+    .description('Build the image agents run in (Node, git, Claude Code, Codex); a few minutes the first time')
+    .action(async () => {
+      const { buildImage, isolationSettings } = await import('./container.js');
+      const { loadConfig } = await import('./config.js');
+      const cfg = loadConfig();
+      console.log(dim(`building ${isolationSettings(cfg).image}…`));
+      await buildImage(cfg, { log: (l) => process.stderr.write(dim(l)) });
+      console.log(`${green('✓')} built ${isolationSettings(cfg).image}`);
+    });
+  sb.command('token')
+    .description('Save the Claude Code token containers sign in with (from `claude setup-token`); --clear removes it')
+    .argument('[token]')
+    .option('--clear', 'remove the saved token')
+    .action(async (token, opts) => {
+      const { saveSecrets } = await import('./container.js');
+      if (!opts.clear && !token) throw new Error('Give the token from `claude setup-token`, or --clear');
+      saveSecrets({ claudeOauthToken: opts.clear ? null : token.trim() });
+      console.log(opts.clear ? 'Token removed' : `${green('✓')} token saved (in ~/.agentmanager/secrets.json, readable only by you)`);
+    });
+
   program
     .command('ask')
     .description('Open a general session (no repo or folder) on any engine and attach to it')

package/src/container.js

@@ -0,0 +1,189 @@
+// Isolation: an agent that runs in its own Docker container instead of directly on this computer.
+// It sees only its own folder (mounted at the same path, so paths, transcripts and git all line up),
+// its repository's git data, its brief folder and its uploads; nothing else of yours. Claude Code
+// and Codex keep their sessions in your usual folders (mounted in), so tracking, resume and usage
+// work as they do on the host. Each engine gets its own config home for containers, with sign-in
+// from a token (Claude: `claude setup-token`) or Codex's auth.json, read-only.
+import { execFile, execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { paths } from './config.js';
+import { trustFolder } from './trust.js';
+
+export const DEFAULT_IMAGE = 'ai-agentmanager-agent:1';
+export const CONTAINER_ENGINES = new Set(['claude', 'codex']);
+const DOCKERFILE = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'docker', 'agent.Dockerfile');
+const homes = () => path.join(paths.home, 'containers');
+const secretsFile = () => path.join(paths.home, 'secrets.json');
+
+export const containerName = (agentId, kind = 'agent') => `agentmgr-${agentId}${kind === 'agent' ? '' : `-${kind}`}`;
+export const isolationSettings = (config = {}) => ({ image: DEFAULT_IMAGE, cpus: null, memory: null, network: null, ...(config.isolation ?? {}) });
+
+// ------------------------------------------------------------ secrets (the Claude token)
+
+export function loadSecrets() {
+  try {
+    return JSON.parse(fs.readFileSync(secretsFile(), 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+export function saveSecrets(patch) {
+  const next = { ...loadSecrets(), ...patch };
+  for (const [k, v] of Object.entries(next)) if (v == null || v === '') delete next[k];
+  fs.mkdirSync(paths.home, { recursive: true });
+  fs.writeFileSync(secretsFile(), JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+  return next;
+}
+
+/** The Claude Code token for containers: saved (Settings, `agentmgr sandbox token`), else CLAUDE_CODE_OAUTH_TOKEN. */
+export const claudeToken = (env = process.env) => loadSecrets().claudeOauthToken || env.CLAUDE_CODE_OAUTH_TOKEN || '';
+
+// ------------------------------------------------------------ docker
+
+const docker = (args, opts = {}) =>
+  new Promise((resolve, reject) =>
+    execFile('docker', args, { timeout: 15_000, maxBuffer: 4 * 1024 * 1024, ...opts }, (err, stdout, stderr) => (err ? reject(Object.assign(err, { stderr })) : resolve(String(stdout).trim()))),
+  );
+
+/** Whether Docker runs here, and whether the agent image is built. */
+export async function dockerStatus(config = {}) {
+  const { image } = isolationSettings(config);
+  try {
+    const version = await docker(['version', '--format', '{{.Server.Version}}']);
+    const has = await docker(['image', 'inspect', image, '--format', '{{.Id}}']).then(() => true, () => false);
+    return { available: true, version, image, imageBuilt: has };
+  } catch (err) {
+    return { available: false, version: null, image, imageBuilt: false, error: String(err.stderr || err.message).trim().split('\n')[0].slice(0, 200) };
+  }
+}
+
+let building = null;
+/** Build the agent image from docker/agent.Dockerfile (a few minutes the first time). */
+export function buildImage(config = {}, { log = () => {} } = {}) {
+  if (building) return building;
+  const { image } = isolationSettings(config);
+  building = new Promise((resolve, reject) => {
+    const child = execFile('docker', ['build', '-t', image, '-f', DOCKERFILE, path.dirname(DOCKERFILE)], { timeout: 30 * 60_000, maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+      building = null;
+      if (err) reject(new Error(`docker build failed: ${String(stderr || err.message).trim().split('\n').slice(-3).join(' ')}`));
+      else resolve({ image });
+    });
+    child.stderr?.on('data', (d) => log(String(d)));
+  });
+  return building;
+}
+export const isBuilding = () => Boolean(building);
+
+/** Remove a leftover container of this name (a restart reuses the name). */
+export function removeContainer(name) {
+  try {
+    execFileSync('docker', ['rm', '-f', name], { stdio: 'ignore', timeout: 15_000 });
+  } catch {}
+}
+
+/** Stop a running container, giving the agent time to save (it is removed when it stops). */
+export function stopContainer(name, seconds = 10) {
+  execFile('docker', ['stop', '-t', String(seconds), name], { timeout: (seconds + 20) * 1000 }, () => {});
+}
+
+export function containerRunning(name) {
+  try {
+    return execFileSync('docker', ['inspect', '-f', '{{.State.Running}}', name], { timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() === 'true';
+  } catch {
+    return false;
+  }
+}
+
+// ------------------------------------------------------------ what a container sees
+
+/** A worktree's shared git folder (its .git file points into the main repository's), or null. */
+export function gitCommonDir(cwd) {
+  const dotgit = path.join(cwd, '.git');
+  try {
+    if (fs.statSync(dotgit).isDirectory()) return null; // a plain clone: its .git is inside the folder
+    const gitdir = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(dotgit, 'utf8'))?.[1]?.trim();
+    if (!gitdir) return null;
+    const abs = path.resolve(cwd, gitdir);
+    const common = fs.existsSync(path.join(abs, 'commondir')) ? path.resolve(abs, fs.readFileSync(path.join(abs, 'commondir'), 'utf8').trim()) : abs;
+    return fs.realpathSync(common);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The engine's config home for containers (seeded once), with this folder trusted. Claude: a
+ * .claude.json with onboarding done; Codex: config.toml. Returns the host folder.
+ */
+export function engineHome(engineId, cwd) {
+  const dir = path.join(homes(), engineId);
+  fs.mkdirSync(dir, { recursive: true });
+  if (engineId === 'claude') {
+    const file = path.join(dir, '.claude.json');
+    if (!fs.existsSync(file)) fs.writeFileSync(file, JSON.stringify({ hasCompletedOnboarding: true, theme: 'dark', projects: {} }, null, 2), { mode: 0o600 });
+    trustFolder(cwd, file);
+  } else if (engineId === 'codex') {
+    const file = path.join(dir, 'config.toml');
+    const key = cwd.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    const raw = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    if (!raw.includes(`[projects."${key}"]`)) fs.appendFileSync(file, `${raw && !raw.endsWith('\n') ? '\n' : ''}[projects."${key}"]\ntrust_level = "trusted"\n`);
+  }
+  return dir;
+}
+
+/**
+ * `docker run` arguments for an agent: the container, its mounts and limits, then the engine's
+ * own command (`bin` + `args`). Secrets are passed by name (`-e NAME`, the value from the docker
+ * command's environment), never in the arguments.
+ */
+export function runArgs({ agentId, engineId, cwd, bin, args, config = {}, mounts = [], env = [], user = process.getuid?.() != null ? `${process.getuid()}:${process.getgid()}` : null, name = containerName(agentId) }) {
+  const s = isolationSettings(config);
+  const out = ['run', '--rm', '-i', '-t', '--init', '--name', name, '--label', `agentmgr.agent=${agentId}`, '-w', cwd];
+  if (user) out.push('--user', user);
+  if (s.cpus) out.push('--cpus', String(s.cpus));
+  if (s.memory) out.push('--memory', String(s.memory));
+  if (s.network) out.push('--network', String(s.network));
+  const seen = new Set();
+  for (const m of [{ host: cwd }, ...mounts]) {
+    const inside = m.inside ?? m.host;
+    if (!m.host || seen.has(inside)) continue;
+    seen.add(inside);
+    out.push('-v', `${m.host}:${inside}${m.readOnly ? ':ro' : ''}`);
+  }
+  for (const e of env) out.push('-e', e);
+  out.push(s.image, ...[bin].flat(), ...args);
+  return out;
+}
+
+/**
+ * Everything an engine needs mounted and set in its container: its config home, your session
+ * folders (so the manager reads them where it always does) and its sign-in.
+ */
+export function engineMounts(engineId, cwd, env = process.env) {
+  const home = engineHome(engineId, cwd);
+  if (engineId === 'claude') {
+    const projects = path.join(env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude'), 'projects');
+    fs.mkdirSync(projects, { recursive: true });
+    return {
+      mounts: [{ host: home, inside: '/agentmgr/claude' }, { host: projects, inside: '/agentmgr/claude/projects' }],
+      env: ['CLAUDE_CONFIG_DIR=/agentmgr/claude', 'CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY'],
+      bin: 'claude',
+    };
+  }
+  if (engineId === 'codex') {
+    const codexHome = env.CODEX_HOME || path.join(os.homedir(), '.codex');
+    const sessions = path.join(codexHome, 'sessions');
+    fs.mkdirSync(sessions, { recursive: true });
+    const auth = path.join(codexHome, 'auth.json');
+    return {
+      mounts: [{ host: home, inside: '/agentmgr/codex' }, { host: sessions, inside: '/agentmgr/codex/sessions' }, ...(fs.existsSync(auth) ? [{ host: auth, inside: '/agentmgr/codex/auth.json', readOnly: true }] : [])],
+      env: ['CODEX_HOME=/agentmgr/codex', 'OPENAI_API_KEY'],
+      bin: 'codex',
+    };
+  }
+  throw Object.assign(new Error(`${engineId} can't run in a container yet (Claude Code and Codex can)`), { status: 400 });
+}