ai-agentmanager 1.9.0 → 1.11.0

package/public/app.js

@@ -7,6 +7,7 @@ import { openStream, post, REMOTE } from '/transport.js';
 import { attachBox } from '/attach.js';
 import { initSide } from '/side.js';
 import { addTools, download, htmlFile, initExport } from '/export.js';
+import { badgeHtml as scoreBadge, scorecardHtml, scorecardSpeech } from '/scorecard.js';
 import { bindListen, listenHtml, play, speakable, now as speaking, stop as stopSpeaking } from '/speak.js';
 import { initReview } from '/review.js';
 import { initLand, prChips } from '/land.js';
@@ -123,7 +124,7 @@ $('#new-playbook').onclick = () => {
   playbooksUi.open({ intent: f.intents.value.trim(), projects: f.project.value.trim() ? [f.project.value.trim()] : [], model: f.model.value.trim(), permissionMode: f.permissionMode.value });
 };
 $('#triggers-open').onclick = () => triggersUi.open();
-const landUi = initLand({ api, esc, toast, agents, $, select: (id) => (showTab('agents'), select(id)), openReview: (id) => reviewUi.open(id), isOpen: () => sideTab === 'land' });
+const landUi = initLand({ api, esc, toast, agents, $, scoreBadge, select: (id) => (showTab('agents'), select(id)), openReview: (id) => reviewUi.open(id), isOpen: () => sideTab === 'land' });
 
 function statusOf(a) {
   if (a.runtime.planning) return a.runtime.attention ? 'attention' : 'planning';
@@ -267,9 +268,9 @@ const INSIGHT_ICONS = { why: '🎯', what: '📦', how: '🛠', now: '📍' };
 
 // ------------------------------------------------------------------ stakeholder documents
 
-const DOCS = { analysis: 'Analysis', design: 'Design', flow: 'Flow', proposal: 'Proposal', humanai: 'Human vs AI', diagrams: 'Diagrams' };
+const DOCS = { analysis: 'Analysis', design: 'Design', flow: 'Flow', proposal: 'Proposal', humanai: 'Human vs AI', diagrams: 'Diagrams', scorecard: 'Scorecard' };
 // Optional extras that "Write all" leaves out.
-const DOC_EXTRAS = new Set(['diagrams']);
+const DOC_EXTRAS = new Set(['diagrams', 'scorecard']);
 const DOC_TITLES = { ...DOCS, plan: 'Plan', intent: 'Intent', spec: 'Spec' };
 // The agent's intent, spec and plan files (read from the daemon when opened; kept here by agent and kind).
 const SPEC_KINDS = { intent: 'Intent', spec: 'Spec', plan: 'Plan' };
@@ -350,7 +351,7 @@ function docButtons(a) {
       const d = a.docs?.[k];
       const stale = d?.markdown && a.brief?.updatedAt && d.briefUpdatedAt !== a.brief.updatedAt;
       return `<button class="small doc-btn ${d?.markdown ? 'has' : ''}" data-doc="${k}" ${d?.pending ? 'disabled' : ''}
-        title="${k === 'diagrams' ? (d?.markdown ? `Open the diagrams${stale ? ' (the brief changed since)' : ''}` : 'Draw the problem and its solution for a quick grasp: architecture, design, data flow (animated) and the key interaction, diagrams only. Built from the documents already written and the agent\'s work') : d?.markdown ? `Open the ${label.toLowerCase()} document${stale ? ' (the brief changed since)' : ''}` : `Write a ${label.toLowerCase()} document for stakeholders`}">${d?.pending ? `${label}…` : label}${d?.markdown ? (stale ? ' •' : ' ✓') : ''}</button>`;
+        title="${k === 'scorecard' ? (d?.markdown ? `Open the review scorecard: ${d.data?.overall ?? '—'}/100` : 'Score the changes for review: intent, spec, scope, plan, tests and safety, with an overall readiness and where to look') : k === 'diagrams' ? (d?.markdown ? `Open the diagrams${stale ? ' (the brief changed since)' : ''}` : 'Draw the problem and its solution for a quick grasp: architecture, design, data flow (animated) and the key interaction, diagrams only. Built from the documents already written and the agent\'s work') : d?.markdown ? `Open the ${label.toLowerCase()} document${stale ? ' (the brief changed since)' : ''}` : `Write a ${label.toLowerCase()} document for stakeholders`}">${d?.pending ? `${label}…` : label}${d?.markdown ? (stale ? ' •' : ' ✓') : ''}</button>`;
     })
     .join('')}</span>${specButtons(a)}`;
 }
@@ -388,7 +389,7 @@ function renderDocDialog() {
   else if (specKind && !d?.markdown) body.innerHTML = `<p class="hint">${docView.kind === 'intent' ? 'No intent file for this agent (agents created before 1.9 have none).' : `The agent hasn't written its ${label.toLowerCase()} yet. It writes ${docView.kind === 'spec' ? 'the spec before changing code' : 'the plan and keeps it current'}.`}</p>`;
   else if (d?.markdown) {
     if (body.dataset.rendered !== d.at) {
-      body.innerHTML = d.data ? humanAiHtml(d) : docHtml(d.markdown);
+      body.innerHTML = docView.kind === 'scorecard' ? scorecardHtml(d, esc) : d.data ? humanAiHtml(d) : docHtml(d.markdown);
       body.dataset.rendered = d.at;
       renderDiagrams(body);
     }
@@ -399,7 +400,7 @@ function renderDocDialog() {
   for (const id of ['doc-copy', 'doc-download', 'doc-print']) $(`#${id}`).disabled = !d?.markdown;
   // Diagrams: the whole document as one HTML file with every diagram (each also has Copy / PNG / SVG).
   $('#doc-html').hidden = !/```mermaid/.test(d?.markdown ?? '');
-  $('#doc-listen').innerHTML = d?.markdown && docView.kind !== 'diagrams' ? listenHtml(`doc:${docView.agentId}:${docView.kind}`, { title: 'Read the document aloud' }) : '';
+  $('#doc-listen').innerHTML = d?.markdown && docView.kind !== 'diagrams' ? listenHtml(docView.kind === 'scorecard' ? `score:${docView.agentId}` : `doc:${docView.agentId}:${docView.kind}`, { title: 'Read the document aloud' }) : '';
   $('#doc-print').hidden = plan || specKind;
   $('#doc-regen').hidden = plan || specKind;
   $('#doc-regen').disabled = Boolean(d?.pending);
@@ -538,6 +539,7 @@ bindListen((id) => {
   if (what === 'explain') parts = [speakable(a?.explanation?.markdown)];
   else if (what === 'doc') parts = [speakable(kind === 'explain' ? a?.explanation?.markdown : docOf(a, kind)?.markdown)];
   else if (what === 'walk') parts = reviewUi.listenParts();
+  else if (what === 'score') parts = a?.docs?.scorecard?.data ? scorecardSpeech(a.docs.scorecard) : null;
   else if (what === 'sidewalk') parts = sidePane?.listenParts();
   if (!parts?.length || !play(id, parts)) toast('Nothing to read aloud here (or this browser has no speech)');
 });
@@ -707,7 +709,7 @@ function agentItem(a) {
   const idle = !isActive(a);
   return `<li data-id="${a.id}" ${a.kind === 'general' || a.kind === 'assistant' ? '' : 'draggable="true" '}class="agent pr${a.priority ?? 2} ${a.id === selectedId ? 'selected' : ''} ${idle ? 'idle' : ''}">
     <div class="line1">${prioChip(a.priority ?? 2)}${a.results?.outcome === 'blocked' ? '<span class="outcome-mark" title="Blocked">⛔</span>' : a.results?.outcome === 'done' ? '<span class="outcome-mark" title="Done">✅</span>' : ''}<span class="name">${esc(a.name)}</span>${flags(a)}<span class="pill ${st}">${pillText(st)}</span></div>
-    <div class="intent" title="${esc(describeTitle(a) ?? '')}">${a.kind === 'general' ? '<span class="tag">general</span> ' : a.kind === 'assistant' ? '<span class="tag assistant">assistant</span> ' : a.startedBy ? '<span class="tag assistant" title="Started by the assistant">🤖 by assistant</span> ' : a.trigger ? `<span class="tag assistant" title="Started from ${a.trigger.source === 'github' ? 'a labeled GitHub issue' : 'the webhook'}${a.trigger.url ? `: ${esc(a.trigger.url)}` : ''}">⚡ ${a.trigger.source === 'github' ? 'GitHub' : 'webhook'}</span> ` : a.playbook ? `<span class="tag assistant" title="Started by the playbook ${esc(a.playbook.name)}">▶ ${esc(a.playbook.name)}</span> ` : ''}${a.engine && a.engine !== 'claude' ? `<span class="tag engine">${esc(ENGINE_LABEL[a.engine] ?? a.engine)}</span> ` : ''}${esc(describe(a) || (a.kind === 'assistant' ? 'Finds new work and starts agents for it' : 'General session'))}</div>
+    <div class="intent" title="${esc(describeTitle(a) ?? '')}">${a.kind === 'general' ? '<span class="tag">general</span> ' : a.kind === 'assistant' ? '<span class="tag assistant">assistant</span> ' : a.startedBy ? '<span class="tag assistant" title="Started by the assistant">🤖 by assistant</span> ' : a.trigger ? `<span class="tag assistant" title="Started from ${a.trigger.source === 'github' ? 'a labeled GitHub issue' : 'the webhook'}${a.trigger.url ? `: ${esc(a.trigger.url)}` : ''}">⚡ ${a.trigger.source === 'github' ? 'GitHub' : 'webhook'}</span> ` : a.playbook ? `<span class="tag assistant" title="Started by the playbook ${esc(a.playbook.name)}">▶ ${esc(a.playbook.name)}</span> ` : ''}${a.engine && a.engine !== 'claude' ? `<span class="tag engine">${esc(ENGINE_LABEL[a.engine] ?? a.engine)}</span> ` : ''}${a.isolation === 'container' ? '<span class="tag engine" title="Runs in its own Docker container: it sees only its own folder">📦 container</span> ' : ''}${esc(describe(a) || (a.kind === 'assistant' ? 'Finds new work and starts agents for it' : 'General session'))}</div>
     ${a.status === 'preparing' && a.progress ? `<div class="progress-line">${esc(progressText(a.progress))}</div>` : ''}
     <div class="meta">
       <span class="mono">${a.id}</span>
@@ -3269,6 +3271,7 @@ function openNewDialog(mode = 'now') {
   $('#new-error').hidden = true;
   dialog.querySelector(`input[name="when"][value="${mode}"]`).checked = true;
   restoreIntentSplit();
+  loadIsolation();
   syncWhen();
   dialog.showModal();
   dialog.querySelector('textarea').focus();
@@ -3431,6 +3434,7 @@ $('#new-form').addEventListener('submit', async (e) => {
         model: f.get('model') || undefined,
         engine: f.get('engine') || undefined,
         worktree: f.get('worktree') ? true : undefined,
+        ...containerChoice(e.target),
         plan: Boolean(f.get('plan')),
         planReview: Boolean(f.get('planReview')),
         priority: Number(f.get('priority')),
@@ -3462,6 +3466,7 @@ $('#new-form').addEventListener('submit', async (e) => {
       plan: Boolean(f.get('plan')),
       planReview: Boolean(f.get('planReview')),
       start: Boolean(f.get('start')),
+      ...containerChoice(e.target),
     });
     created.forEach((a) => agents.set(a.id, a));
     dialog.close();
@@ -4150,9 +4155,36 @@ const describe = (a) => a.synopsis?.text || a.intent;
 const describeTitle = (a) => (a.synopsis?.text ? `${a.synopsis.source === 'jira' ? `${a.synopsis.key} in Jira` : `${a.synopsis.key} (summary not fetched; your words after the link)`}. Request: ${a.intent}` : a.intent);
 
 const ENGINE_LABEL = { claude: 'Claude', codex: 'Codex', antigravity: 'Antigravity', muse: 'Muse Code' };
+// Containers: offered when Docker runs here; Claude Code and Codex only.
+let isolationInfo = null;
+const containerChoice = (form) => (isolationInfo?.available && !$('#container-field').hidden ? { isolation: form.container.checked ? 'container' : '' } : {});
+function syncContainerField() {
+  const form = $('#new-form');
+  const engine = form.engine?.value || 'claude';
+  const ok = isolationInfo?.available && isolationInfo.engines.includes(engine);
+  $('#container-field').hidden = !isolationInfo?.available;
+  form.container.disabled = !ok || !isolationInfo.imageBuilt;
+  if (!ok) form.container.checked = false;
+  $('#container-hint').textContent = !ok ? '(Claude Code and Codex only)' : !isolationInfo.imageBuilt ? '(build the image first: ☰ → Settings → Containers)' : !isolationInfo.hasClaudeToken && engine === 'claude' ? '(add the Claude token in ☰ → Settings → Containers)' : '(Docker: it sees only its own folder)';
+}
+async function loadIsolation() {
+  try {
+    isolationInfo = await api('GET', '/isolation');
+  } catch {
+    isolationInfo = null;
+  }
+  const form = $('#new-form');
+  form.container.checked = isolationInfo?.default === 'container';
+  syncContainerField();
+}
+$('#new-form').engine?.addEventListener('change', syncContainerField);
+
 async function loadEngines() {
   try {
-    const list = (await api('GET', '/engines')).filter((e) => e.installed && e.id !== 'claude');
+    const all = await api('GET', '/engines');
+    // Engine names for tags and tabs, ACP agents included.
+    for (const e of all) ENGINE_LABEL[e.id] ??= e.label;
+    const list = all.filter((e) => e.installed && e.id !== 'claude');
     // Something to know before choosing an engine (Muse Code in contributor mode, say).
     const notices = Object.fromEntries(list.filter((e) => e.notice).map((e) => [e.id, e.notice]));
     for (const [field, notice] of [['#engine-field', '#engine-notice'], ['#ask-engine-field', '#ask-engine-notice']]) {

package/public/index.html

@@ -245,6 +245,10 @@
           <input type="checkbox" name="worktree" checked />
           Give each agent its own git worktree and branch <span class="hint">(for a git folder; always on when cloning a repo URL)</span>
         </label>
+        <label class="check" id="container-field" hidden title="The agent sees only its own folder, its git data, brief and uploads, not the rest of this computer. Claude Code and Codex">
+          <input type="checkbox" name="container" />
+          Run each agent in its own container <span class="hint" id="container-hint">(Docker: it sees only its own folder)</span>
+        </label>
         <label class="check">
           <input type="checkbox" name="plan" checked />
           Plan with Claude while the repo clones <span class="hint">(repo URLs only; the session moves into the repo when it's ready)</span>
@@ -722,6 +726,15 @@
           <label class="check"><input type="checkbox" name="startAtLogin" /> Start AI Agent Manager when I log in</label>
           <p class="hint">After a restart or a crash, the daemon comes back by itself and running agents resume; without it, it starts only when you run <code>agentmgr</code>. <span id="settings-service-state"></span></p>
         </fieldset>
+        <fieldset class="local-only" id="settings-containers">
+          <legend>Containers</legend>
+          <p class="hint">Agents in a container (Docker) see only their own folder, its git data, brief and uploads: not the rest of this computer. <span id="settings-containers-state"></span></p>
+          <div class="row">
+            <label>Claude token for containers <span class="hint">run <code>claude setup-token</code> in a terminal and paste it</span><input name="claudeToken" type="password" autocomplete="new-password" /></label>
+            <div class="containers-actions"><button type="button" class="small" id="containers-build">Build image</button></div>
+          </div>
+          <label class="check"><input type="checkbox" name="containerDefault" /> Run new agents in containers by default</label>
+        </fieldset>
         <fieldset class="local-only">
           <legend>Jira</legend>
           <p class="hint">For an agent created from a Jira link, its description shows the issue's summary. Public issues on Atlassian Cloud need nothing here; for your company's site, add it with your email and an <a href="https://id.atlassian.com/manage-profile/security/api-tokens" target="_blank" rel="noopener">API token</a>. The token is kept on this computer and sent only to that site.</p>
@@ -738,7 +751,7 @@
         </fieldset>
         <fieldset>
           <legend>More</legend>
-          <p class="hint settings-links"><button type="button" class="link" data-open="cleanup-btn">Clean up old agents</button> · <button type="button" class="link" data-open="spend-btn">Spend and budgets</button> · <button type="button" class="link local-only" data-open="alerts-btn">Slack alerts</button> · <button type="button" class="link local-only" data-open="remote-btn">Remote access</button></p>
+          <p class="hint settings-links"><button type="button" class="link" data-open="cleanup-btn">Clean up old agents</button><button type="button" class="link" data-open="spend-btn">Spend and budgets</button><button type="button" class="link local-only" data-open="alerts-btn">Slack alerts</button><button type="button" class="link local-only" data-open="remote-btn">Remote access</button></p>
         </fieldset>
         <p id="settings-error" class="error" hidden></p>
         <div class="dialog-actions">

package/public/land.js

@@ -25,7 +25,7 @@ export function prChips(pr, esc) {
   return out.join(' ');
 }
 
-export function initLand({ api, esc, toast, agents, $, select, openReview, isOpen }) {
+export function initLand({ api, esc, toast, agents, $, scoreBadge = () => '', select, openReview, isOpen }) {
   const view = $('#land-view');
   let settings = null;
 
@@ -46,7 +46,7 @@ export function initLand({ api, esc, toast, agents, $, select, openReview, isOpe
       <div class="line1"><span class="prio p${a.priority ?? 2}">P${a.priority ?? 2}</span>
         <a class="name" href="${esc(pr.url)}" target="_blank" rel="noopener" title="${esc(pr.title ?? pr.url)}">#${esc(pr.number ?? '')} ${esc(pr.title ?? pr.url)}</a></div>
       <div class="line2"><button class="link" data-land="goto">${esc(a.name)}</button>${a.runtime?.busy ? ' <span class="hint">working</span>' : ''}</div>
-      <div class="land-chips">${prChips(pr, esc)}</div>
+      <div class="land-chips">${scoreBadge(a.docs?.scorecard, esc)} ${prChips(pr, esc)}</div>
       <div class="bl-actions">
         <button class="small" data-land="review" title="Its diff, line comments for the agent, commit and push">Review</button>
         ${land === 'behind' || pr.mergeable === 'CONFLICTING' ? '<button class="small" data-land="update" title="Merge the base branch in here (when the agent is idle and its work is committed) and push; otherwise, or on conflicts, ask the agent">Update</button>' : ''}

package/public/menu.js

@@ -55,6 +55,36 @@ export function initMenu({ api, esc, toast, $ }) {
   const form = $('#settings-form');
   let service = null; // the login service as the dialog opened
   let jira = null; // the Jira settings as the dialog opened
+  let containers = null; // Docker and the agent image as the dialog opened
+  function showContainers() {
+    const c = containers;
+    $('#settings-containers').hidden = !c;
+    if (!c) return;
+    $('#settings-containers-state').textContent = !c.available
+      ? `Docker isn't running here${c.error ? ` (${c.error})` : ''}.`
+      : `Docker ${c.version} · image ${c.image}: ${c.building ? 'building…' : c.imageBuilt ? 'built' : 'not built yet'}${c.buildError ? ` (last build failed: ${c.buildError})` : ''} · Claude token ${c.hasClaudeToken ? 'set' : 'not set'}.`;
+    $('#containers-build').disabled = !c.available || c.building;
+    $('#containers-build').textContent = c.building ? 'Building…' : c.imageBuilt ? 'Rebuild image' : 'Build image';
+    form.containerDefault.disabled = !c.available;
+  }
+  $('#containers-build').onclick = async () => {
+    try {
+      containers = await api('POST', '/isolation/build');
+      showContainers();
+      toast('Building the agent image; it takes a few minutes the first time', 6000);
+      // Watch it finish.
+      const t = setInterval(async () => {
+        containers = await api('GET', '/isolation').catch(() => containers);
+        if (dialog.open) showContainers();
+        if (!containers?.building) {
+          clearInterval(t);
+          toast(containers?.imageBuilt && !containers.buildError ? 'Agent image built: agents can run in containers' : `Image build failed: ${containers?.buildError ?? 'see the daemon log'}`, 8000);
+        }
+      }, 5000);
+    } catch (err) {
+      toast(`Error: ${err.message}`, 6000);
+    }
+  };
   $('#settings-btn').onclick = async () => {
     $('#settings-error').hidden = true;
     try {
@@ -70,6 +100,11 @@ export function initMenu({ api, esc, toast, $ }) {
         form.jiraEmail.value = jira?.email ?? '';
         form.jiraToken.value = '';
         form.jiraToken.placeholder = jira?.hasToken ? 'saved (type to replace)' : '';
+        containers = await api('GET', '/isolation').catch(() => null);
+        showContainers();
+        form.claudeToken.value = '';
+        form.claudeToken.placeholder = containers?.hasClaudeToken ? 'saved (type to replace)' : 'from claude setup-token';
+        form.containerDefault.checked = containers?.default === 'container';
         service = await api('GET', '/service').catch(() => null);
         $('#settings-service').hidden = !service?.supported;
         form.startAtLogin.checked = Boolean(service?.installed);
@@ -96,6 +131,10 @@ export function initMenu({ api, esc, toast, $ }) {
         await api('PUT', '/jira', { site: form.jiraSite.value.trim(), email: form.jiraEmail.value.trim(), token: form.jiraToken.value.trim() || undefined });
         toast('Jira saved; summaries for agents from Jira links are being fetched', 4000);
       }
+      if (!remote() && containers?.available) {
+        if (form.claudeToken.value.trim()) await api('PUT', '/isolation/token', { token: form.claudeToken.value.trim() });
+        if (form.containerDefault.checked !== (containers.default === 'container')) await api('PUT', '/isolation/default', { container: form.containerDefault.checked });
+      }
       // Only when it changed: installing touches launchd / systemd.
       if (!remote() && service?.supported && form.startAtLogin.checked !== Boolean(service.installed)) {
         const s = await api('PUT', '/service', { enabled: form.startAtLogin.checked });

package/public/review.js

@@ -3,6 +3,7 @@
 // With a walkthrough, each hunk shows its explanation and ◀ / ▶ step through them in reading order.
 import { cardHtml, explainButton, listenParts as walkParts, stepOf, walkthroughOf } from './walkthrough.js';
 import { listenHtml, now as speaking, stop as stopSpeaking } from './speak.js';
+import { scorecardHtml, scorecardOf } from './scorecard.js';
 
 /** Unified diff -> [{ path, status, binary, hunks: [{ head, lines: [{ t, old, new, text }] }] }] */
 export function parseDiff(text) {
@@ -138,7 +139,7 @@ export function initReview({ api, esc, toast, agents, $ }) {
     for (const h of f.hunks) {
       const i = w.doc ? stepOf(w.doc, f.path, h.head) : -1;
       if (i >= 0) rows.push(`<tr class="rv-explain ${st.step === i ? 'current' : ''}" id="rv-step-${i}"><td colspan="3">${cardHtml(w.doc.data.changes[i], i, w.doc.data.changes.length, esc)}</td></tr>`);
-      rows.push(`<tr class="rv-hunk"><td colspan="3">${esc(h.head)}</td></tr>`);
+      rows.push(`<tr class="rv-hunk" data-rv-hunk="${esc(`${f.path}\t${h.head}`)}"><td colspan="3">${esc(h.head)}</td></tr>`);
       for (const l of h.lines) {
         const side = l.t === 'del' ? 'old' : 'new';
         const line = side === 'old' ? l.old : l.new;
@@ -157,6 +158,32 @@ export function initReview({ api, esc, toast, agents, $ }) {
     return `<div class="rv-file" id="rv-${encodeURIComponent(f.path)}">${head}<table class="rv-table">${rows.join('')}</table></div>`;
   }
 
+  /** The review scorecard at the top: scores, verdict and where to look, or the button to score. */
+  function scorePanel() {
+    if (!st.data?.files.length) return '';
+    const sc = scorecardOf(agents.get(st.id), st.data.diffHash);
+    const openPr = st.data.prs.find((p) => p.state === 'OPEN');
+    const run = `<button type="button" class="small ${sc.doc && !sc.stale ? 'ghost' : 'primary'}" data-sc-run ${sc.pending ? 'disabled' : ''} title="Score the changes against the intent, spec, plan and tests, with where to look (a separate one-off call)">${sc.pending ? 'Scoring…' : sc.doc ? (sc.stale ? 'Score again (changed)' : 'Score again') : '📊 Score changes'}</button>`;
+    if (!sc.doc) {
+      return `<div class="rv-score-empty">${run}<span class="hint">${sc.error && !sc.pending ? `<span class="error">Couldn't score: ${esc(sc.error)}</span>` : 'Scores against the intent, spec, scope, plan, tests and safety, with an overall readiness and the few places to read.'}</span></div>`;
+    }
+    const post = openPr ? `<button type="button" class="small ghost" data-sc-post title="Post the scorecard on the pull request as a comment (posting again updates it)">${sc.doc.postedTo === openPr.url ? 'Update on PR' : 'Post to PR'}</button>` : '';
+    return `<div class="rv-score">${scorecardHtml(sc.doc, esc, { stale: sc.stale, actions: `${listenHtml(`score:${st.id}`, { title: 'Hear the scorecard' })}${post}${run}` })}</div>`;
+  }
+
+  /** Open the file of a hunk (from "where to look") and scroll to it. */
+  function gotoHunk(key) {
+    const [file] = key.split('\t');
+    st.collapsed.delete(file);
+    keepInputs();
+    render();
+    const row = [...body.querySelectorAll('[data-rv-hunk]')].find((r) => r.dataset.rvHunk === key);
+    if (!row) return toast('That part of the change has moved since it was scored');
+    row.scrollIntoView({ block: 'center', behavior: 'smooth' });
+    row.classList.add('flash');
+    setTimeout(() => row.classList.remove('flash'), 1600);
+  }
+
   /** Explain changes, then ◀ n of N ▶ once there is a walkthrough. */
   function walkNav() {
     const w = walk();
@@ -221,6 +248,7 @@ export function initReview({ api, esc, toast, agents, $ }) {
         ${d.files.length ? walkNav() : ''}
         <button type="button" class="small ghost" data-rv-reload>${st.loading ? 'Loading…' : 'Reload'}</button>
       </div>
+      ${scorePanel()}
       ${walkNote()}
       ${d.busy ? '<p class="hint rv-warn">The agent is working, so the changes may still move. Reload when it is idle.</p>' : ''}
       ${d.truncated ? '<p class="hint rv-warn">The diff is large and was cut short; open a shell for the rest.</p>' : ''}
@@ -289,6 +317,29 @@ export function initReview({ api, esc, toast, agents, $ }) {
     if (t.closest('[data-rv-reload]')) return keepInputs(), reload();
     const stepBtn = t.closest('[data-rv-step]');
     if (stepBtn) return step(Number(stepBtn.dataset.rvStep));
+    const look = t.closest('[data-sc-look]');
+    if (look) return gotoHunk(look.dataset.scLook);
+    if (t.closest('[data-sc-run]')) {
+      keepInputs();
+      try {
+        agents.set(st.id, await api('POST', `/agents/${st.id}/docs/scorecard?background=1`));
+        render();
+      } catch (err) {
+        toast(`Error: ${err.message}`, 5000);
+      }
+      return;
+    }
+    if (t.closest('[data-sc-post]')) {
+      t.disabled = true;
+      try {
+        const r = await api('POST', `/agents/${st.id}/scorecard/post`);
+        toast(r.edited ? 'Scorecard updated on the pull request' : 'Scorecard posted on the pull request', 4000, { label: 'Open', run: () => window.open(r.url, '_blank', 'noopener') });
+      } catch (err) {
+        toast(`Error: ${err.message}`, 6000);
+      }
+      t.disabled = false;
+      return;
+    }
     if (t.closest('[data-rv-explain]')) {
       keepInputs();
       try {
@@ -442,7 +493,8 @@ export function initReview({ api, esc, toast, agents, $ }) {
   function agentChanged(a) {
     if (!dlg.open || a.id !== st.id || !st.data) return;
     const w = a.docs?.walkthrough;
-    const sig = `${w?.at}|${w?.pending}|${w?.error}`;
+    const sc = a.docs?.scorecard;
+    const sig = `${w?.at}|${w?.pending}|${w?.error}|${sc?.at}|${sc?.pending}|${sc?.error}|${sc?.postedTo}`;
     if (sig === st.walkSig) return;
     st.walkSig = sig;
     keepInputs();

package/public/scorecard.js

@@ -0,0 +1,68 @@
+// The review scorecard on the page: an overall readiness, a bar per score with why, the acceptance
+// criteria, and where to look. Shared by Review changes, the Scorecard document and Land's badges.
+
+const DIMENSIONS = [
+  ['intent', 'Intent'],
+  ['spec', 'Spec'],
+  ['tests', 'Tests'],
+  ['safety', 'Safety'],
+  ['scope', 'Scope'],
+  ['plan', 'Plan'],
+];
+export const RECOMMENDATION = { ready: 'Ready to approve', look: 'Look at these first', not_ready: 'Not ready' };
+const tone = (n) => (n == null ? '' : n >= 80 ? 'good' : n >= 50 ? 'mid' : 'bad');
+const recTone = { ready: 'good', look: 'mid', not_ready: 'bad' };
+
+/** The scorecard of an agent and whether it still matches the changes (diffHash from /changes). */
+export function scorecardOf(agent, diffHash) {
+  const d = agent?.docs?.scorecard;
+  return { doc: d?.data ? d : null, pending: Boolean(d?.pending), error: d?.error ?? null, stale: Boolean(d?.data && diffHash && d.diffHash !== diffHash) };
+}
+
+/** A small badge: "82 · Ready to approve". */
+export function badgeHtml(doc, esc) {
+  if (!doc?.data) return '';
+  const sc = doc.data;
+  return `<span class="sc-badge ${recTone[sc.recommendation]}" title="Review scorecard: ${esc(RECOMMENDATION[sc.recommendation])}${sc.reasons.length ? ` (${esc(sc.reasons.join('; '))})` : ''}">${sc.overall ?? '—'} · ${esc(RECOMMENDATION[sc.recommendation])}</span>`;
+}
+
+/**
+ * The full card. `actions` is extra HTML for the head (buttons); look items carry
+ * data-sc-look="<file>\t<head>" for the page to jump to.
+ */
+export function scorecardHtml(doc, esc, { stale = false, actions = '' } = {}) {
+  const sc = doc.data;
+  const rows = DIMENSIONS.map(([k, label]) => {
+    const d = sc.scores[k];
+    if (!d) return `<div class="sc-row na"><span class="sc-label">${label}</span><span class="sc-bar"></span><span class="sc-n">—</span><span class="sc-why hint">${k === 'spec' ? 'No spec written' : 'Not scored'}</span></div>`;
+    return `<div class="sc-row"><span class="sc-label">${label}</span><span class="sc-bar"><span class="${tone(d.score)}" style="width:${d.score}%"></span></span><span class="sc-n">${d.score}</span><span class="sc-why">${esc(d.why)}${d.notes.length ? ` <span class="sc-note">${esc(d.notes.join('; '))}</span>` : ''}</span></div>`;
+  }).join('');
+  const crit = sc.criteria.length
+    ? `<details class="sc-crit" ${sc.criteria.some((c) => c.status !== 'met') ? 'open' : ''}><summary>Acceptance criteria: ${sc.criteria.filter((c) => c.status === 'met').length} of ${sc.criteria.length} met</summary><ul>${sc.criteria.map((c) => `<li class="${c.status}"><span class="sc-mark">${c.status === 'met' ? '✓' : c.status === 'not_met' ? '✗' : '?'}</span>${esc(c.criterion)}${c.evidence ? ` <span class="hint">${esc(c.evidence)}</span>` : ''}</li>`).join('')}</ul></details>`
+    : '';
+  const look = sc.look.length
+    ? `<div class="sc-look"><b>Where to look</b><ol>${sc.look.map((l) => `<li><button type="button" class="link" data-sc-look="${esc(`${l.file}\t${l.head}`)}"><code>${esc(l.file)}</code></button> ${esc(l.reason)}</li>`).join('')}</ol></div>`
+    : '';
+  const f = sc.facts;
+  return `<div class="scorecard">
+    <div class="sc-head">
+      <span class="sc-overall ${recTone[sc.recommendation]}"><b>${sc.overall ?? '—'}</b><small>/100</small></span>
+      <div class="sc-verdict"><b>${esc(RECOMMENDATION[sc.recommendation])}</b>${sc.reasons.length ? `<div class="hint">${esc(sc.reasons.join(' · '))}</div>` : ''}<div class="hint">${esc(sc.summary)}</div></div>
+      <span class="spacer"></span>${actions}
+    </div>
+    ${stale ? '<p class="hint sc-stale"><b>The changes moved since this was scored.</b> Score again for the latest.</p>' : ''}
+    <div class="sc-rows">${rows}</div>
+    ${crit}${look}
+    <div class="hint sc-facts">Measured: ${f.files} files (+${f.added} −${f.removed}) · ${f.testFiles} test files · CI ${esc(f.ci ?? 'n/a')} · checks ${f.checks.passed}✓ ${f.checks.failed}✗${f.plan ? ` · plan ${f.plan.done}/${f.plan.steps}` : ''}${doc.writer ? ` · scored by ${esc(doc.writer)}` : ''}</div>
+  </div>`;
+}
+
+/** What Listen reads: the verdict, then each score with why. */
+export function scorecardSpeech(doc) {
+  const sc = doc.data;
+  return [
+    `${RECOMMENDATION[sc.recommendation]}. Overall ${sc.overall ?? 'not scored'} out of 100. ${sc.reasons.join('. ')} ${sc.summary}`,
+    ...DIMENSIONS.filter(([k]) => sc.scores[k]).map(([k, label]) => `${label}: ${sc.scores[k].score}. ${sc.scores[k].why} ${sc.scores[k].notes.join('. ')}`),
+    ...(sc.look.length ? [`Where to look: ${sc.look.map((l) => `${l.file.split('/').pop()}: ${l.reason}`).join('. ')}`] : []),
+  ];
+}

package/public/style.css

@@ -906,3 +906,37 @@ form.dropping { outline: 2px dashed var(--accent, #6b8cff); outline-offset: 4px;
 .say.on button:first-child { min-width: 30px; }
 .explain-foot { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
 .sd-step.current { box-shadow: 0 0 0 2px var(--accent, #6b8cff); }
+
+/* Review scorecard. */
+.scorecard { display: flex; flex-direction: column; gap: 8px; padding: 10px 12px; border: 1px solid var(--border); border-radius: 8px; background: var(--panel); }
+.sc-head { display: flex; align-items: center; gap: 12px; flex-wrap: wrap; }
+.sc-overall { display: flex; align-items: baseline; gap: 2px; padding: 4px 10px; border-radius: 8px; border: 2px solid currentColor; }
+.sc-overall b { font-size: 26px; line-height: 1; }
+.sc-overall small { opacity: .7; }
+.sc-verdict { min-width: 0; flex: 1 1 260px; }
+.good { color: var(--green); } .mid { color: var(--yellow); } .bad { color: var(--red); }
+.sc-rows { display: flex; flex-direction: column; gap: 4px; }
+.sc-row { display: grid; grid-template-columns: 64px 140px 32px 1fr; gap: 8px; align-items: center; font-size: 13px; }
+.sc-label { font-weight: 600; }
+.sc-bar { height: 8px; border-radius: 4px; background: var(--panel-2); overflow: hidden; }
+.sc-bar > span { display: block; height: 100%; background: currentColor; }
+.sc-n { text-align: right; font-variant-numeric: tabular-nums; }
+.sc-note { color: var(--yellow); }
+.sc-row.na { opacity: .6; }
+.sc-crit ul, .sc-look ol { margin: 4px 0 0; padding-left: 20px; }
+.sc-crit li { list-style: none; margin-left: -16px; }
+.sc-mark { display: inline-block; width: 16px; font-weight: 700; }
+.sc-crit li.met .sc-mark { color: var(--green); } .sc-crit li.not_met .sc-mark { color: var(--red); } .sc-crit li.unverified .sc-mark { color: var(--yellow); }
+.sc-facts { font-size: 11.5px; }
+.sc-badge { display: inline-block; padding: 1px 8px; border-radius: 999px; border: 1px solid currentColor; font-size: 12px; white-space: nowrap; }
+.rv-score { margin: 0 12px 8px; }
+.rv-score-empty { display: flex; align-items: center; gap: 10px; margin: 0 12px 8px; }
+.rv-hunk.flash td { animation: rvflash 1.6s; }
+@keyframes rvflash { 0%, 60% { background: var(--accent); color: var(--accent-text); } }
+@media (max-width: 640px) { .sc-row { grid-template-columns: 56px 1fr 28px; } .sc-why { grid-column: 1 / -1; } }
+
+.containers-actions { display: flex; align-items: flex-end; }
+
+/* Settings → More: separators belong to the links, so hidden (local-only) ones leave none behind. */
+.settings-links button + button::before { content: '·'; display: inline-block; margin: 0 8px; color: var(--muted); }
+body.remote .settings-links .local-only { display: none; }

package/src/backlog.js

@@ -89,7 +89,7 @@ export class Backlog extends EventEmitter {
   // ------------------------------------------------------------ editing
 
   /** Queue one item per title. Options are what an agent would take (repo, dir, base, project, ...). */
-  add(titles, { repo, dir, base, project, worktree, permissionMode, model, plan, planReview, engine, attachments, priority = 2 } = {}) {
+  add(titles, { repo, dir, base, project, worktree, permissionMode, model, plan, planReview, engine, attachments, isolation, priority = 2 } = {}) {
     const list = titles.map((t) => String(t ?? '').trim()).filter(Boolean);
     if (!list.length) throw err(400, 'At least one item is required');
     const pr = parsePriority(priority);
@@ -122,6 +122,8 @@ export class Backlog extends EventEmitter {
         engine: engine || null,
         // Staged uploads; each item's agent gets its own copies when it starts.
         attachments: Array.isArray(attachments) && attachments.length ? attachments.slice(0, 20).map(String) : undefined,
+        // "container", "" (on this computer), or undefined (the default when it starts).
+        isolation: isolation === undefined ? undefined : isolation || '',
         plan: Boolean(plan),
         planReview: planReview ?? null,
         priority: pr,
@@ -222,6 +224,7 @@ export class Backlog extends EventEmitter {
       model: it.model,
       engine: it.engine ?? undefined,
       attachments: it.attachments,
+      isolation: it.isolation,
       plan: it.plan,
       planReview: it.planReview ?? undefined,
       priority: it.priority,

package/src/cli.js

@@ -343,6 +343,8 @@ export async function main(argv) {
     .option('-m, --model <model>', 'model (for the chosen engine)')
     .option('-e, --engine <engine>', 'agent engine: claude (default), codex, antigravity or muse')
     .option('--file-attach <path>', 'attach a file to the request (a screenshot, a log); repeat for more', collect)
+    .option('--container', 'run each agent in its own Docker container (see agentmgr sandbox)')
+    .option('--no-container', 'run on this computer even if containers are the default')
     .option('--plan', 'while a repo URL clones, plan the task with Claude (moves into the repo when ready)')
     .option('--no-start', 'create without launching')
     .option('-a, --attach', 'attach to the agent after launch (single intent only)')
@@ -357,6 +359,7 @@ export async function main(argv) {
       const created = await api('POST', '/agents', {
         intents,
         attachments,
+        isolation: cmd.getOptionValueSource('container') === 'cli' ? (opts.container ? 'container' : '') : undefined,
         repo: opts.repo,
         dir: opts.dir,
         name: opts.name,
@@ -383,6 +386,39 @@ export async function main(argv) {
       }
     });
 
+  const sb = program.command('sandbox').description('Agents in Docker containers: status, building the agent image, the Claude token');
+  sb.command('status')
+    .description('Whether Docker runs, the agent image is built, and containers can sign in to Claude')
+    .action(async () => {
+      await daemon();
+      const s = await api('GET', '/isolation');
+      console.log(`Docker:       ${s.available ? green(`running (${s.version})`) : yellow(`not available${s.error ? `: ${s.error}` : ''}`)}`);
+      console.log(`Agent image:  ${s.image} ${s.imageBuilt ? green('built') : s.building ? yellow('building…') : yellow('not built (agentmgr sandbox build)')}`);
+      console.log(`Claude token: ${s.hasClaudeToken ? green('set') : yellow('not set (run `claude setup-token`, then agentmgr sandbox token <token>)')}`);
+      console.log(`Default:      ${s.default === 'container' ? 'new agents run in containers' : 'new agents run on this computer'}`);
+      if (s.buildError) console.log(yellow(`Last build failed: ${s.buildError}`));
+    });
+  sb.command('build')
+    .description('Build the image agents run in (Node, git, Claude Code, Codex); a few minutes the first time')
+    .action(async () => {
+      const { buildImage, isolationSettings } = await import('./container.js');
+      const { loadConfig } = await import('./config.js');
+      const cfg = loadConfig();
+      console.log(dim(`building ${isolationSettings(cfg).image}…`));
+      await buildImage(cfg, { log: (l) => process.stderr.write(dim(l)) });
+      console.log(`${green('✓')} built ${isolationSettings(cfg).image}`);
+    });
+  sb.command('token')
+    .description('Save the Claude Code token containers sign in with (from `claude setup-token`); --clear removes it')
+    .argument('[token]')
+    .option('--clear', 'remove the saved token')
+    .action(async (token, opts) => {
+      const { saveSecrets } = await import('./container.js');
+      if (!opts.clear && !token) throw new Error('Give the token from `claude setup-token`, or --clear');
+      saveSecrets({ claudeOauthToken: opts.clear ? null : token.trim() });
+      console.log(opts.clear ? 'Token removed' : `${green('✓')} token saved (in ~/.agentmanager/secrets.json, readable only by you)`);
+    });
+
   program
     .command('ask')
     .description('Open a general session (no repo or folder) on any engine and attach to it')
@@ -430,9 +466,9 @@ export async function main(argv) {
 
   program
     .command('doc')
-    .description('Write a stakeholder document from the agent work: analysis, design, flow, proposal, humanai (Human vs AI), diagrams (diagrams only) or walkthrough (its changes explained one by one)')
+    .description('Write a stakeholder document from the agent work: analysis, design, flow, proposal, humanai (Human vs AI), diagrams (diagrams only), walkthrough (its changes explained one by one) or scorecard (its changes scored for review)')
     .argument('<agent>')
-    .argument('<kind>', 'analysis, design, flow, proposal, humanai, diagrams, walkthrough, or all (background; diagrams and walkthrough not included)')
+    .argument('<kind>', 'analysis, design, flow, proposal, humanai, diagrams, walkthrough, scorecard, or all (background; diagrams, walkthrough and scorecard not included)')
     .option('-o, --output <file>', 'also save the Markdown to this file')
     .option('--cached', 'print the last version instead of writing a new one')
     .option('-b, --background', 'start writing and return at once (kind "all" writes all five)')