ai-agentmanager 1.10.0 → 1.11.1

package/src/engines/acp.js

@@ -0,0 +1,222 @@
+// Engines for agents that speak ACP (the Agent Client Protocol): Gemini CLI, OpenCode, Goose,
+// Qwen Code and any other, from one line of config. AI Agent Manager runs its own terminal client
+// (bin/acp-client.js) in the agent's terminal, which talks ACP to the agent and keeps a session log
+// in ~/.agentmanager/acp/<engine>/<session>.jsonl; this adapter reads that log for usage, PR and
+// bug links, stuck detection and Explain.
+//
+// config.json: "acp": { "<name>": { "command": ["opencode", "acp"], "label": "OpenCode" } }
+// adds (or changes) the engine "acp-<name>". The presets below are offered when installed.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { paths } from '../config.js';
+import { norm, tailOf } from '../stuck.js';
+import { extractRefs } from '../tracker.js';
+
+const CLIENT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'bin', 'acp-client.js');
+export const ACP_PRESETS = {
+  gemini: { label: 'Gemini CLI', command: ['gemini', '--experimental-acp'] },
+  opencode: { label: 'OpenCode', command: ['opencode', 'acp'] },
+  goose: { label: 'Goose', command: ['goose', 'acp'] },
+  qwen: { label: 'Qwen Code', command: ['qwen', '--experimental-acp'] },
+};
+const ANSI = /\x1b(\[[0-9;?<>=]*[ -\/]*[@-~]|\][^\x07\x1b]*(\x07|\x1b\\)|[()][0-9A-B]|[=>78c])/g;
+const real = (p) => {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+};
+
+/** Complete JSON lines added since the cursor's offset. */
+function newRecords(file, cursor) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+  } catch {
+    return null;
+  }
+  try {
+    const { size, mtime } = fs.fstatSync(fd);
+    cursor.lastActivity = mtime.toISOString();
+    if (size < cursor.offset) cursor.offset = 0;
+    if (size === cursor.offset) return [];
+    const buf = Buffer.alloc(size - cursor.offset);
+    fs.readSync(fd, buf, 0, buf.length, cursor.offset);
+    const lastNl = buf.lastIndexOf(0x0a);
+    if (lastNl < 0) return [];
+    cursor.offset += lastNl + 1;
+    const out = [];
+    for (const line of buf.subarray(0, lastNl).toString('utf8').split('\n')) {
+      try {
+        if (line) out.push(JSON.parse(line));
+      } catch {}
+    }
+    return out;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** The engine for one ACP agent. */
+export function acpEngine(name, { command, label, args = [] }) {
+  const id = `acp-${name}`;
+  const logDir = () => path.join(paths.home, 'acp', name);
+  const fileOf = (sid) => path.join(logDir(), `${String(sid).replace(/[^\w.-]/g, '_')}.jsonl`);
+  const cmd = [command].flat().map(String);
+  return {
+    id,
+    label: label ?? name,
+    acp: true,
+    // Bypass answers its permission requests "allow" by itself; other modes ask (the inbox can answer).
+    supports: { chooseSessionId: false, cost: false, planHandoff: false, fork: false, oneShot: true, resumePrompt: true },
+    permissionModes: ['default', 'bypassPermissions'],
+    rulesFiles: ['AGENTS.md'],
+    install: `Install ${label ?? name} (\`${cmd[0]}\` on the daemon's PATH) and sign in once in a terminal`,
+
+    // The command that has to be installed is the agent's; the client is ours.
+    bin: () => process.execPath,
+    installedBin: () => cmd[0],
+    extraArgs: () => [],
+
+    /** The client in the agent's terminal: the log folder, resume, the first message, then the agent. */
+    launchArgs({ permissionMode, writableDir, instructions, sessionId, resume, prompt }) {
+      const out = [CLIENT, '--log', logDir()];
+      if (permissionMode === 'bypassPermissions') out.push('--yes');
+      for (const d of [writableDir ?? []].flat()) out.push('--allow-dir', d);
+      if (resume) out.push('--session', sessionId);
+      const first = resume ? prompt : [instructions, prompt && (instructions ? `Your task:\n${prompt}` : prompt)].filter(Boolean).join('\n\n---\n\n');
+      if (first) out.push('--prompt', first);
+      return [...out, '--', ...cmd, ...args];
+    },
+
+    sessionFile: (cwd, sid) => fileOf(sid),
+    hasSession: (cwd, sid) => fs.existsSync(fileOf(sid)),
+    subagentFiles: () => [],
+
+    /** Sessions the client started in this folder since a time (from each log's first line). */
+    recentSessions(cwd, sinceMs) {
+      const want = real(cwd);
+      const out = [];
+      let names = [];
+      try {
+        names = fs.readdirSync(logDir()).filter((n) => n.endsWith('.jsonl'));
+      } catch {}
+      for (const n of names) {
+        const file = path.join(logDir(), n);
+        const st = fs.statSync(file);
+        if (st.mtimeMs < sinceMs) continue;
+        let meta = null;
+        try {
+          meta = JSON.parse(fs.readFileSync(file, 'utf8').split('\n')[0]);
+        } catch {}
+        if (meta?.type !== 'meta' || real(meta.cwd) !== want) continue;
+        out.push({ sessionId: meta.sessionId, file, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs });
+      }
+      return out.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    },
+
+    /** Usage (the agent's context use, when it reports it), PR and bug links from messages and tool output. */
+    scan(file, cursor, bugPatterns = []) {
+      const result = { prs: [], bugs: [], title: null, lastPrompt: null, cost: null, lastActivity: null };
+      cursor.usage ??= new Map();
+      cursor.offset ??= 0;
+      const recs = newRecords(file, cursor);
+      result.lastActivity = cursor.lastActivity ?? null;
+      if (!recs) return result;
+      for (const r of recs) {
+        if (r.type === 'user') result.lastPrompt = String(r.text ?? '').slice(0, 500);
+        if (r.type === 'usage' && r.used != null) cursor.usage.set('context', { input: r.used, output: 0, cacheCreation: 0, cacheRead: 0 });
+        const text = r.type === 'agent' || r.type === 'user' ? r.text : r.type === 'tool' ? r.output : '';
+        if (text) {
+          const refs = extractRefs(String(text), bugPatterns);
+          result.prs.push(...refs.prs);
+          result.bugs.push(...refs.bugs);
+        }
+      }
+      return result;
+    },
+
+    /** Commands and edits, for stuck detection. */
+    activity(file, state) {
+      state.events ??= [];
+      state.offset ??= 0;
+      state.inputs ??= {};
+      const recs = newRecords(file, state);
+      if (!recs) return state;
+      for (const r of recs) {
+        const t = Date.parse(r.t) || Date.now();
+        if (r.type === 'tool' && r.input) state.inputs[r.id] = r.input;
+        if (r.type === 'tool' && (r.status === 'completed' || r.status === 'failed') && r.kind === 'execute') {
+          const input = r.input ?? state.inputs[r.id] ?? {};
+          const out = String(r.output ?? '');
+          state.events.push({ t, kind: 'cmd', cmd: norm(String(input.command ?? r.title ?? '')).slice(0, 300), failed: Boolean(r.failed), result: tailOf(out), shown: out.replace(/\s+/g, ' ').trim().slice(-160) });
+        } else if (r.type === 'edit') {
+          state.events.push({ t, kind: 'edit', file: r.path, edits: [[norm(r.oldText ?? ''), norm(r.newText ?? '')]] });
+        }
+      }
+      if (state.events.length > 400) state.events = state.events.slice(-400);
+      return state;
+    },
+
+    /** A readable digest of the conversation, for Explain and documents. */
+    digest(file, { maxChars = 24_000 } = {}) {
+      const events = [];
+      const edited = new Set();
+      for (const r of newRecords(file, { offset: 0 }) ?? []) {
+        if (r.type === 'user') events.push(`[user] ${String(r.text).slice(0, 1200)}`);
+        else if (r.type === 'agent') events.push(`[agent] ${String(r.text).slice(0, 1800)}`);
+        else if (r.type === 'tool' && (r.status === 'completed' || r.status === 'failed')) events.push(`[action] ${r.title}${r.failed ? ' (failed)' : ''}`);
+        else if (r.type === 'edit') edited.add(r.path), events.push(`[action] edited ${r.path}`);
+      }
+      const head = events.find((e) => e.startsWith('[user]'));
+      const tail = [];
+      let used = head?.length ?? 0;
+      for (let i = events.length - 1; i >= 0 && events[i] !== head; i--) {
+        if (used + events[i].length > maxChars) {
+          tail.unshift('… (earlier events omitted) …');
+          break;
+        }
+        tail.unshift(events[i]);
+        used += events[i].length + 1;
+      }
+      return { digest: [head, ...tail].filter(Boolean).join('\n'), events: events.length, edited: [...edited] };
+    },
+
+    copySession: () => false,
+
+    attention: [[/Permissionneeded:/i, 'Permission prompt']],
+    // Its menu reads a line: a choice is the number, then Enter.
+    promptKeyEnter: true,
+
+    /** The client's menu: "Permission needed: <title> 1. Allow once 2. Always allow 3. Reject Choose 1-3". */
+    promptChoices(screen) {
+      const text = String(screen ?? '').replace(ANSI, ' ').replace(/\s+/g, ' ');
+      const at = text.lastIndexOf('Permission needed:');
+      if (at < 0) return { question: '', choices: [] };
+      const tail = text.slice(at);
+      const question = (/^Permission needed: (.*?)(?= 1\. )/.exec(tail)?.[1] ?? '').trim().slice(0, 200);
+      const choices = [];
+      for (const m of tail.matchAll(/\b(\d)\. (.+?)(?= \d\. | Choose |$)/g)) choices.push({ key: m[1], label: m[2].trim().slice(0, 80) });
+      return { question: question ? `Allow: ${question}?` : 'Allow this?', choices };
+    },
+
+    trust: () => false,
+
+    /** One-shot: the client in --once mode, every permission refused (read-only), the prompt on stdin. */
+    oneShotArgs: () => [CLIENT, '--once', '--', ...cmd, ...args],
+
+    stripEnv: [],
+  };
+}
+
+/** The ACP engines to offer: the presets, with config's own added or changed. */
+export function acpEngines(config = {}) {
+  const defs = { ...ACP_PRESETS };
+  for (const [name, def] of Object.entries(config.acp ?? {})) {
+    if (def === false) delete defs[name];
+    else if (def?.command) defs[name] = { ...defs[name], ...def };
+  }
+  return Object.entries(defs).map(([name, def]) => acpEngine(name, def));
+}

package/src/engines/index.js

@@ -6,6 +6,7 @@ import antigravity from './antigravity.js';
 import claude from './claude.js';
 import codex from './codex.js';
 import muse from './muse.js';
+import { acpEngines } from './acp.js';
 
 export const ENGINES = { claude, codex, antigravity, muse };
 export const DEFAULT_ENGINE = 'claude';
@@ -17,16 +18,23 @@ export function registerEngine(def) {
   ENGINES[def.id] = def;
 }
 
+/** ACP agents from config.json's "acp" and the presets (acp.js); call again when the config changes. */
+export function registerAcpEngines(config = {}) {
+  for (const id of Object.keys(ENGINES)) if (ENGINES[id].acp) delete ENGINES[id];
+  for (const e of acpEngines(config)) ENGINES[e.id] = e;
+}
+
 /** Whether an engine's command is on this machine (an absolute path, or found on PATH). */
 export function installed(engine, config) {
-  const bin = engine.bin(config);
+  // An ACP engine runs our client with Node; what has to be installed is the agent's own command.
+  const bin = engine.installedBin?.(config) ?? engine.bin(config);
   if (path.isAbsolute(bin)) return fs.existsSync(bin);
   return (process.env.PATH ?? '').split(path.delimiter).some((d) => d && fs.existsSync(path.join(d, bin)));
 }
 
 /** What to tell the person when an engine's command isn't on this machine. */
 export function notInstalled(engine, config) {
-  const bin = engine.bin(config);
+  const bin = engine.installedBin?.(config) ?? engine.bin(config);
   const how = engine.install ?? `Install ${engine.label}`;
   const where = path.isAbsolute(bin) ? `${bin} doesn't exist` : `\`${bin}\` isn't on the daemon's PATH`;
   return `${engine.label} not found: ${where}. ${how}, then run \`agentmgr restart\`. If it's installed somewhere else, set its path in config.json${engine.id === 'claude' ? ' ("claudeBin") or AGENTMGR_CLAUDE_BIN' : ` ("engines": {"${engine.id}": {"bin": "…"}})`}.`;

package/src/fleet.js

@@ -158,19 +158,20 @@ export const isLoopback = (h) => ['127.0.0.1', 'localhost', '[::1]', '::1'].incl
 
 /**
  * Hub URLs a runner accepts: https anywhere; plain http only on this machine or over
- * Tailscale, which already encrypts the traffic.
+ * Tailscale, which already encrypts the traffic, or on a private network you vouch for
+ * (AGENTMGR_HUB_ALLOW_HTTP=1: a hub and runners in one docker-compose or VPC).
  */
-export function checkHubUrl(raw) {
+export function checkHubUrl(raw, env = process.env) {
   let u;
   try {
     u = new URL(String(raw ?? '').trim());
   } catch {
     throw Object.assign(new Error('Hub URL must look like https://hub.example.com'), { status: 400 });
   }
-  if (u.protocol === 'https:' || (u.protocol === 'http:' && (isLoopback(u.hostname) || isTailscaleHost(u.hostname)))) {
+  if (u.protocol === 'https:' || (u.protocol === 'http:' && (isLoopback(u.hostname) || isTailscaleHost(u.hostname) || env.AGENTMGR_HUB_ALLOW_HTTP === '1'))) {
     return u.origin;
   }
-  throw Object.assign(new Error('Use https:// for the hub (plain http only for localhost or a Tailscale address)'), { status: 400 });
+  throw Object.assign(new Error('Use https:// for the hub (plain http only for localhost, a Tailscale address, or a private network with AGENTMGR_HUB_ALLOW_HTTP=1)'), { status: 400 });
 }
 
 /** Signed by the runner's key on every connection, so the hub knows which runner it is. */

package/src/hub.js

@@ -61,6 +61,12 @@ function newCode() {
   const chars = [...bytes].map((b) => CODE_ALPHABET[b % CODE_ALPHABET.length]).join('');
   return chars.match(/.{4}/g).join('-');
 }
+/** Constant-time comparison of two strings (different lengths are simply unequal). */
+const safeEqual = (a, b) => {
+  const x = Buffer.from(String(a));
+  const y = Buffer.from(String(b));
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+};
 const normalizeCode = (c) => String(c ?? '').toUpperCase().replace(/[^A-Z0-9]/g, '');
 
 /** Google sign-in settings from the environment, or null when not configured. */
@@ -459,7 +465,11 @@ export async function startHub({
       if (!loginAllowed(req.ip)) throw fail(429, 'Too many attempts; try again in 15 minutes');
       const key = sha256(normalizeCode(req.body?.code));
       const invite = store.data.invites[key];
-      if (!invite || Date.parse(invite.expiresAt) < Date.now()) {
+      // The runner token (AGENTMGR_HUB_RUNNER_TOKEN): a reusable secret for machines that join by
+      // themselves, such as cloud runners; compared in constant time, and failures count like any.
+      const token = process.env.AGENTMGR_HUB_RUNNER_TOKEN;
+      const viaToken = Boolean(token && token.length >= 24 && safeEqual(String(req.body?.code ?? ''), token));
+      if (!viaToken && (!invite || Date.parse(invite.expiresAt) < Date.now())) {
         loginFailed(req.ip);
         throw fail(401, 'Invite code is wrong, used or expired; create a new one on the hub');
       }
@@ -471,7 +481,7 @@ export async function startHub({
       } catch {
         throw fail(400, 'publicKey must be an Ed25519 public key (PEM)');
       }
-      delete store.data.invites[key]; // single use
+      if (!viaToken) delete store.data.invites[key]; // single use
       const base = String(req.body?.name ?? '').toLowerCase().replace(/[^\w.-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32) || 'machine';
       const taken = new Set(Object.values(store.data.runners).map((r) => r.name));
       let runnerName = base;
@@ -479,7 +489,7 @@ export async function startHub({
       const id = crypto.randomBytes(4).toString('hex');
       store.data.runners[id] = { id, name: runnerName, publicKey, enrolledAt: now(), lastSeen: null, version: String(req.body?.version ?? '').slice(0, 20) || null };
       store.save();
-      log(`runner ${runnerName} (${id}) joined from ${req.ip}`);
+      log(`runner ${runnerName} (${id}) joined from ${req.ip}${viaToken ? ' with the runner token' : ''}`);
       changed();
       return { runnerId: id, name: runnerName, hubName: name };
     }),

package/src/hublink.js

@@ -47,10 +47,12 @@ export function audit(line) {
   } catch {}
 }
 
-export function hubPolicy(config) {
+export function hubPolicy(config, env = process.env) {
   const h = config.hub ?? {};
+  // A cloud runner sets it in its environment (AGENTMGR_HUB_ALLOW=view,control,move): no config file to edit.
+  const fromEnv = env.AGENTMGR_HUB_ALLOW ? env.AGENTMGR_HUB_ALLOW.split(/[\s,]+/).filter(Boolean) : null;
   return {
-    allow: Array.isArray(h.allow) ? h.allow.map(String) : DEFAULT_HUB_POLICY.allow,
+    allow: fromEnv ?? (Array.isArray(h.allow) ? h.allow.map(String) : DEFAULT_HUB_POLICY.allow),
     projects: Array.isArray(h.projects) && h.projects.length ? h.projects.map(String) : DEFAULT_HUB_POLICY.projects,
   };
 }

package/src/inbox.js

@@ -87,6 +87,20 @@ export function promptChoices(screen) {
       break;
     }
   }
+  // Newer Claude Code can draw a menu as one run of text ("Do you want to proceed? ❯ 1. Yes 2. Yes,
+  // and switch to auto mode 3. No Esc to cancel"): read the flattened screen after the last question.
+  if (!choices.size) {
+    const flat = lines.join(' ').replace(/\s+/g, ' ');
+    const at = flat.search(/\?\s*(?:[❯>›]\s*)?1[.)]\s*\S[^?]*$/);
+    if (at >= 0) {
+      const head = flat.slice(0, at + 1);
+      // Drop what's left of the box around it (╌ ─ │ and stray letters before them).
+      question = (/([^.?!│]*\?)$/.exec(head)?.[1] ?? '').replace(/^.*[╌─│━]+\s*/, '').trim().slice(-200);
+      for (const m of flat.slice(at + 1).matchAll(/(?:[❯>›]\s*)?\b(\d)[.)]\s*(.+?)(?=\s+(?:[❯>›]\s*)?\d[.)]\s|\s+Esc to cancel|\s+Enter to|$)/g)) {
+        if (!choices.has(m[1])) choices.set(m[1], m[2].replace(/\s*·.*$/, '').trim().slice(0, 80));
+      }
+    }
+  }
   return {
     question,
     choices: [...choices.entries()].sort(([a], [b]) => a - b).map(([key, label]) => ({ key, label })),

package/src/manager.js

@@ -102,6 +102,7 @@ import * as git from './git.js';
 import { parseDiff } from '../public/review.js';
 import { issueSummary, leadingIssue, wordsAfterLink } from './jira.js';
 import { combine, facts as scoreFacts, scorecardMarkdown, scorecardPrompt } from './scorecard.js';
+import { CONTAINER_ENGINES, claudeToken, containerName, containerRunning, engineMounts, gitCommonDir, removeContainer, runArgs, stopContainer } from './container.js';
 import { conflictMessage, findConflicts, related, repoKey, summarize as summarizeConflicts } from './conflicts.js';
 import { answerMessage, loadQuestions, questionsPath, questionsPrompt } from './inbox.js';
 import { STUCK_DEFAULTS, detectStuck } from './stuck.js';
@@ -594,6 +595,7 @@ export class AgentManager extends EventEmitter {
     startedBy,
     trigger,
     attachments,
+    isolation,
   }) {
     intent = (intent ?? '').trim();
     const staged = stagedFiles(attachments);
@@ -607,6 +609,12 @@ export class AgentManager extends EventEmitter {
     }
     // Planning while cloning moves the session between folders, which needs the engine's support.
     if (!engineDef.supports.planHandoff) plan = false;
+    // Isolation: "container" runs it in Docker (config "isolation": { "default": "container" } for all).
+    isolation = isolation === undefined ? this.config.isolation?.default ?? null : isolation || null;
+    if (isolation && isolation !== 'container') throw Object.assign(new Error('isolation is "container" or nothing'), { status: 400 });
+    if (isolation && !CONTAINER_ENGINES.has(engineId)) throw Object.assign(new Error(`${engineDef.label} can't run in a container yet (Claude Code and Codex can)`), { status: 400 });
+    // The session moves between folders mid-plan; a container is bound to one folder.
+    if (isolation) plan = false;
     const general = NO_REPO.has(kind);
     // A project shortcut (or name) fills in the repo / folder / base branch.
     const entry = !general && project ? this.resolveProject(project) : null;
@@ -639,6 +647,7 @@ export class AgentManager extends EventEmitter {
       priority: parsePriority(priority),
       ...(startedBy ? { startedBy } : {}),
       ...(trigger ? { trigger } : {}),
+      ...(isolation ? { isolation } : {}),
       name: name?.trim() || jiraKey || slug,
       slug,
       intent,
@@ -995,6 +1004,26 @@ export class AgentManager extends EventEmitter {
     return this.view(this.store.get(agent.id));
   }
 
+  /**
+   * `docker run` for an agent in a container (see container.js): its folder, its repository's git
+   * data, its brief and uploads, the engine's homes and sign-in; nothing else of this computer.
+   */
+  containerSpec(agent, engine, cwd, args) {
+    const name = containerName(agent.id);
+    removeContainer(name); // a leftover from a crash or a restart would block the name
+    const em = engineMounts(engine.id, cwd);
+    const real = (p) => (fs.existsSync(p) ? fs.realpathSync(p) : null);
+    const git = gitCommonDir(cwd);
+    // Plus any folders config.json adds ("isolation": { "mounts": [{ "host": "~/.npm", "readOnly": true }] }).
+    const extra = (this.config.isolation?.mounts ?? []).map((m) => ({ ...m, host: real(expandHome(m.host)) }));
+    const mounts = [...em.mounts, ...(git ? [{ host: git }] : []), { host: real(briefDir(agent.id)) }, { host: real(path.join(paths.uploads, agent.id)), readOnly: true }, ...extra].filter((m) => m.host);
+    const bin = this.config.isolation?.bin?.[engine.id] ?? em.bin;
+    const env = { ...this.childEnv(agent), ...(claudeToken() ? { CLAUDE_CODE_OAUTH_TOKEN: claudeToken() } : {}) };
+    // Variables passed in by name (values stay out of the command line): the engine's, plus config's "isolation.env".
+    const inner = ['TERM=xterm-256color', 'COLORTERM=truecolor', `AGENTMGR_AGENT_ID=${agent.id}`, 'AGENTMGR_TERMINAL=1', ...em.env, ...(this.config.isolation?.env ?? [])];
+    return { name, cmd: 'docker', env, args: runArgs({ agentId: agent.id, engineId: engine.id, cwd: fs.realpathSync(cwd), bin, args, config: this.config, mounts, env: inner }) };
+  }
+
   /** What every launch of this agent passes its engine: options, its brief folder, instructions. */
   launchOptions(agent, { planning = false } = {}) {
     const engine = engineOf(agent);
@@ -1098,19 +1127,23 @@ export class AgentManager extends EventEmitter {
       }
     }
 
-    if (!installed(engine, this.config)) {
+    // In a container the engine is inside the image, not on this computer.
+    const container = agent.isolation === 'container' && !NO_REPO.has(agent.kind);
+    if (!container && !installed(engine, this.config)) {
       const error = notInstalled(engine, this.config);
       this.patch(agent.id, { status: 'error', error });
       throw Object.assign(new Error(error), { status: 400 });
     }
     let proc;
     try {
-      proc = pty.spawn(engine.bin(this.config), args, {
+      const spec = container ? this.containerSpec(agent, engine, cwd, args) : { cmd: engine.bin(this.config), args, env: this.childEnv(agent) };
+      rt.container = spec.name ?? null;
+      proc = pty.spawn(spec.cmd, spec.args, {
         name: 'xterm-256color',
         cols: rt.cols,
         rows: rt.rows,
         cwd,
-        env: this.childEnv(agent),
+        env: spec.env,
       });
     } catch (err) {
       this.patch(agent.id, { status: 'error', error: `Failed to launch ${engine.bin(this.config)}: ${err.message}` });
@@ -1233,9 +1266,14 @@ export class AgentManager extends EventEmitter {
         done.dispose();
         resolve(this.view(this.store.get(agent.id) ?? agent));
       });
-      // A hangup, as when a terminal closes, unless the engine shuts down cleanly on another signal.
-      rt.pty.kill(engineOf(agent).stopSignal ?? 'SIGHUP');
-      rt.killTimer = setTimeout(() => rt.pty?.kill('SIGKILL'), timeoutMs);
+      // A container: docker stop (the engine gets SIGTERM inside; the docker command then ends).
+      // Otherwise a hangup, as when a terminal closes, unless the engine ends cleanly on another signal.
+      if (rt.container) stopContainer(rt.container, 10);
+      else rt.pty.kill(engineOf(agent).stopSignal ?? 'SIGHUP');
+      rt.killTimer = setTimeout(() => {
+        if (rt.container) removeContainer(rt.container);
+        rt.pty?.kill('SIGKILL');
+      }, timeoutMs);
     });
   }
 
@@ -1509,7 +1547,10 @@ export class AgentManager extends EventEmitter {
       rows: prev?.rows ?? 34,
     };
     if (rt.size) this.appendOutput(rt, '\r\n\x1b[2m── new shell ──\x1b[0m\r\n');
-    const proc = pty.spawn(this.config.shell, ['-l'], {
+    // An agent in a running container: the shell opens inside it, with what the agent sees.
+    const inside = agent.isolation === 'container' && containerRunning(containerName(agent.id));
+    const [cmd, cmdArgs] = inside ? ['docker', ['exec', '-it', '-w', fs.realpathSync(agent.workdir), containerName(agent.id), 'bash', '-l']] : [this.config.shell, ['-l']];
+    const proc = pty.spawn(cmd, cmdArgs, {
       name: 'xterm-256color',
       cols: rt.cols,
       rows: rt.rows,
@@ -2812,7 +2853,8 @@ export class AgentManager extends EventEmitter {
     const keys = { esc: '\x1b', enter: '\r', up: '\x1b[A', down: '\x1b[B' };
     const data = keys[key] ?? (/^\d$/.test(key) ? key : null);
     if (!data) throw Object.assign(new Error('Unsupported key'), { status: 400 });
-    this.write(agent.id, data);
+    // Menus that read a line (the ACP client's) take Enter after the choice.
+    this.write(agent.id, engineOf(agent).promptKeyEnter && key !== 'enter' ? `${data}\r` : data);
     return { ok: true };
   }
 

package/src/server.js

@@ -25,7 +25,7 @@ import { Studio } from './studio.js';
 import { Memory } from './memory.js';
 import { doctor } from './doctor.js';
 import { Triggers, tokenMatches } from './triggers.js';
-import { listEngines, registerEngine } from './engines/index.js';
+import { listEngines, registerAcpEngines, registerEngine } from './engines/index.js';
 import { Plugins, pluginSpecs } from './plugins.js';
 import { HubLink, linkUrls } from './hublink.js';
 import { Notifier, isWorkflowUrl, loadNotify, publicNotify, saveNotify, sendSlack } from './notify.js';
@@ -34,6 +34,7 @@ import { LiveBrowser } from './livebrowser.js';
 import * as remote from './remote.js';
 import * as service from './service.js';
 import { jiraView, saveJira } from './jira.js';
+import { CONTAINER_ENGINES, buildImage, claudeToken, dockerStatus, isBuilding, saveSecrets } from './container.js';
 import { Store } from './store.js';
 import { about, latestRelease } from './about.js';
 
@@ -63,7 +64,7 @@ function isAllowedOrigin(origin, port) {
 const PUBLIC_REMOTE_API = new Set(['POST /api/login', 'GET /api/session']);
 // Updates are not here: a signed-in device (a phone) can install the newest release too. It only
 // ever installs an official release from where this copy came from (git tag or npm) and restarts.
-const LOCAL_ONLY_API = /^\/api\/(remote(\/|$)|notify(\/|$)|hub(\/|$)|triggers(\/|$)|service$|jira$|editors$|agents\/[\w-]+\/open-in$|shutdown$)/;
+const LOCAL_ONLY_API = /^\/api\/(remote(\/|$)|notify(\/|$)|hub(\/|$)|triggers(\/|$)|service$|jira$|isolation\/|editors$|agents\/[\w-]+\/open-in$|shutdown$)/;
 const HOOK_PATH = '/api/hooks/agents';
 const NO_REPO_KINDS = new Set(['general', 'assistant']);
 
@@ -73,6 +74,8 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   const store = new Store(paths.state);
   const plugins = await new Plugins({ log: (m) => console.log(`[agentmgr] ${m}`) }).load(pluginSpecs(config), { config, base: paths.home });
   for (const { def } of plugins.engines) registerEngine(def);
+  // ACP agents (Gemini CLI, OpenCode, Goose, … and config's "acp") become engines.
+  registerAcpEngines(config);
   const manager = new AgentManager({ store, config, plugins });
   const backlog = new Backlog({ manager, store, config });
   const races = new Races({ manager, store });
@@ -513,6 +516,28 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   api.get('/agents/:id/memory', wrap((req) => memory.read(req.params.id)));
   api.put('/agents/:id/memory', wrap((req) => memory.write(req.params.id, req.body?.text)));
   api.post('/agents/:id/learn', wrap((req) => memory.learn(req.params.id, req.body?.text, { by: req.headers['x-agentmgr-agent'] ? undefined : 'you' })));
+  // Isolation: Docker, the agent image, the Claude token for containers, and the default for new agents.
+  let buildError = null;
+  const isolationView = async () => ({ ...(await dockerStatus(config)), building: isBuilding(), buildError, hasClaudeToken: Boolean(claudeToken()), engines: [...CONTAINER_ENGINES], default: config.isolation?.default ?? null });
+  api.get('/isolation', wrap(isolationView));
+  api.post(
+    '/isolation/build',
+    wrap(async () => {
+      buildError = null;
+      buildImage(config).catch((err) => (buildError = err.message));
+      return isolationView();
+    }),
+  );
+  api.put('/isolation/token', wrap(async (req) => (saveSecrets({ claudeOauthToken: String(req.body?.token ?? '').trim() || null }), isolationView())));
+  api.put(
+    '/isolation/default',
+    wrap(async (req) => {
+      const value = req.body?.container ? 'container' : null;
+      config.isolation = { ...config.isolation, default: value };
+      saveConfig({ isolation: config.isolation });
+      return isolationView();
+    }),
+  );
   // Jira: the site and API token used to show an issue's summary for agents created from its link.
   api.get('/jira', wrap(() => jiraView()));
   api.put(
@@ -971,6 +996,14 @@ export async function startServer({ port = PORT, host = HOST } = {}) {
   }
   manager.refreshAll().catch(() => {});
   hubLink.start();
+  // A cloud runner joins its hub by itself on first start (AGENTMGR_HUB_URL and AGENTMGR_HUB_CODE: an
+  // invite, or the hub's runner token), and stays joined across restarts (the link is kept on disk).
+  if (process.env.AGENTMGR_HUB_URL && process.env.AGENTMGR_HUB_CODE && !hubLink.status().joined) {
+    hubLink
+      .join(process.env.AGENTMGR_HUB_URL, process.env.AGENTMGR_HUB_CODE, process.env.AGENTMGR_RUNNER_NAME || undefined)
+      .then((st) => console.log(`[agentmgr] joined the hub ${st.url} as ${st.name}`))
+      .catch((err) => console.error(`[agentmgr] could not join the hub ${process.env.AGENTMGR_HUB_URL}: ${err.message}`));
+  }
   return {
     hubLink,
     server,

package/src/trust.js

@@ -16,9 +16,8 @@ export function claudeConfigFile() {
  * before writing, only written when something changes, and replaced atomically.
  * Returns true if it changed anything.
  */
-export function trustFolder(dir) {
+export function trustFolder(dir, file = claudeConfigFile()) {
   const real = fs.realpathSync(dir);
-  const file = claudeConfigFile();
   let raw = '{}';
   try {
     raw = fs.readFileSync(file, 'utf8');