ai-agentmanager 1.9.0 → 1.11.0

package/src/container.js

@@ -0,0 +1,189 @@
+// Isolation: an agent that runs in its own Docker container instead of directly on this computer.
+// It sees only its own folder (mounted at the same path, so paths, transcripts and git all line up),
+// its repository's git data, its brief folder and its uploads; nothing else of yours. Claude Code
+// and Codex keep their sessions in your usual folders (mounted in), so tracking, resume and usage
+// work as they do on the host. Each engine gets its own config home for containers, with sign-in
+// from a token (Claude: `claude setup-token`) or Codex's auth.json, read-only.
+import { execFile, execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { paths } from './config.js';
+import { trustFolder } from './trust.js';
+
+export const DEFAULT_IMAGE = 'ai-agentmanager-agent:1';
+export const CONTAINER_ENGINES = new Set(['claude', 'codex']);
+const DOCKERFILE = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'docker', 'agent.Dockerfile');
+const homes = () => path.join(paths.home, 'containers');
+const secretsFile = () => path.join(paths.home, 'secrets.json');
+
+export const containerName = (agentId, kind = 'agent') => `agentmgr-${agentId}${kind === 'agent' ? '' : `-${kind}`}`;
+export const isolationSettings = (config = {}) => ({ image: DEFAULT_IMAGE, cpus: null, memory: null, network: null, ...(config.isolation ?? {}) });
+
+// ------------------------------------------------------------ secrets (the Claude token)
+
+export function loadSecrets() {
+  try {
+    return JSON.parse(fs.readFileSync(secretsFile(), 'utf8'));
+  } catch {
+    return {};
+  }
+}
+
+export function saveSecrets(patch) {
+  const next = { ...loadSecrets(), ...patch };
+  for (const [k, v] of Object.entries(next)) if (v == null || v === '') delete next[k];
+  fs.mkdirSync(paths.home, { recursive: true });
+  fs.writeFileSync(secretsFile(), JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+  return next;
+}
+
+/** The Claude Code token for containers: saved (Settings, `agentmgr sandbox token`), else CLAUDE_CODE_OAUTH_TOKEN. */
+export const claudeToken = (env = process.env) => loadSecrets().claudeOauthToken || env.CLAUDE_CODE_OAUTH_TOKEN || '';
+
+// ------------------------------------------------------------ docker
+
+const docker = (args, opts = {}) =>
+  new Promise((resolve, reject) =>
+    execFile('docker', args, { timeout: 15_000, maxBuffer: 4 * 1024 * 1024, ...opts }, (err, stdout, stderr) => (err ? reject(Object.assign(err, { stderr })) : resolve(String(stdout).trim()))),
+  );
+
+/** Whether Docker runs here, and whether the agent image is built. */
+export async function dockerStatus(config = {}) {
+  const { image } = isolationSettings(config);
+  try {
+    const version = await docker(['version', '--format', '{{.Server.Version}}']);
+    const has = await docker(['image', 'inspect', image, '--format', '{{.Id}}']).then(() => true, () => false);
+    return { available: true, version, image, imageBuilt: has };
+  } catch (err) {
+    return { available: false, version: null, image, imageBuilt: false, error: String(err.stderr || err.message).trim().split('\n')[0].slice(0, 200) };
+  }
+}
+
+let building = null;
+/** Build the agent image from docker/agent.Dockerfile (a few minutes the first time). */
+export function buildImage(config = {}, { log = () => {} } = {}) {
+  if (building) return building;
+  const { image } = isolationSettings(config);
+  building = new Promise((resolve, reject) => {
+    const child = execFile('docker', ['build', '-t', image, '-f', DOCKERFILE, path.dirname(DOCKERFILE)], { timeout: 30 * 60_000, maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+      building = null;
+      if (err) reject(new Error(`docker build failed: ${String(stderr || err.message).trim().split('\n').slice(-3).join(' ')}`));
+      else resolve({ image });
+    });
+    child.stderr?.on('data', (d) => log(String(d)));
+  });
+  return building;
+}
+export const isBuilding = () => Boolean(building);
+
+/** Remove a leftover container of this name (a restart reuses the name). */
+export function removeContainer(name) {
+  try {
+    execFileSync('docker', ['rm', '-f', name], { stdio: 'ignore', timeout: 15_000 });
+  } catch {}
+}
+
+/** Stop a running container, giving the agent time to save (it is removed when it stops). */
+export function stopContainer(name, seconds = 10) {
+  execFile('docker', ['stop', '-t', String(seconds), name], { timeout: (seconds + 20) * 1000 }, () => {});
+}
+
+export function containerRunning(name) {
+  try {
+    return execFileSync('docker', ['inspect', '-f', '{{.State.Running}}', name], { timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() === 'true';
+  } catch {
+    return false;
+  }
+}
+
+// ------------------------------------------------------------ what a container sees
+
+/** A worktree's shared git folder (its .git file points into the main repository's), or null. */
+export function gitCommonDir(cwd) {
+  const dotgit = path.join(cwd, '.git');
+  try {
+    if (fs.statSync(dotgit).isDirectory()) return null; // a plain clone: its .git is inside the folder
+    const gitdir = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(dotgit, 'utf8'))?.[1]?.trim();
+    if (!gitdir) return null;
+    const abs = path.resolve(cwd, gitdir);
+    const common = fs.existsSync(path.join(abs, 'commondir')) ? path.resolve(abs, fs.readFileSync(path.join(abs, 'commondir'), 'utf8').trim()) : abs;
+    return fs.realpathSync(common);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The engine's config home for containers (seeded once), with this folder trusted. Claude: a
+ * .claude.json with onboarding done; Codex: config.toml. Returns the host folder.
+ */
+export function engineHome(engineId, cwd) {
+  const dir = path.join(homes(), engineId);
+  fs.mkdirSync(dir, { recursive: true });
+  if (engineId === 'claude') {
+    const file = path.join(dir, '.claude.json');
+    if (!fs.existsSync(file)) fs.writeFileSync(file, JSON.stringify({ hasCompletedOnboarding: true, theme: 'dark', projects: {} }, null, 2), { mode: 0o600 });
+    trustFolder(cwd, file);
+  } else if (engineId === 'codex') {
+    const file = path.join(dir, 'config.toml');
+    const key = cwd.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    const raw = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    if (!raw.includes(`[projects."${key}"]`)) fs.appendFileSync(file, `${raw && !raw.endsWith('\n') ? '\n' : ''}[projects."${key}"]\ntrust_level = "trusted"\n`);
+  }
+  return dir;
+}
+
+/**
+ * `docker run` arguments for an agent: the container, its mounts and limits, then the engine's
+ * own command (`bin` + `args`). Secrets are passed by name (`-e NAME`, the value from the docker
+ * command's environment), never in the arguments.
+ */
+export function runArgs({ agentId, engineId, cwd, bin, args, config = {}, mounts = [], env = [], user = process.getuid?.() != null ? `${process.getuid()}:${process.getgid()}` : null, name = containerName(agentId) }) {
+  const s = isolationSettings(config);
+  const out = ['run', '--rm', '-i', '-t', '--init', '--name', name, '--label', `agentmgr.agent=${agentId}`, '-w', cwd];
+  if (user) out.push('--user', user);
+  if (s.cpus) out.push('--cpus', String(s.cpus));
+  if (s.memory) out.push('--memory', String(s.memory));
+  if (s.network) out.push('--network', String(s.network));
+  const seen = new Set();
+  for (const m of [{ host: cwd }, ...mounts]) {
+    const inside = m.inside ?? m.host;
+    if (!m.host || seen.has(inside)) continue;
+    seen.add(inside);
+    out.push('-v', `${m.host}:${inside}${m.readOnly ? ':ro' : ''}`);
+  }
+  for (const e of env) out.push('-e', e);
+  out.push(s.image, ...[bin].flat(), ...args);
+  return out;
+}
+
+/**
+ * Everything an engine needs mounted and set in its container: its config home, your session
+ * folders (so the manager reads them where it always does) and its sign-in.
+ */
+export function engineMounts(engineId, cwd, env = process.env) {
+  const home = engineHome(engineId, cwd);
+  if (engineId === 'claude') {
+    const projects = path.join(env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude'), 'projects');
+    fs.mkdirSync(projects, { recursive: true });
+    return {
+      mounts: [{ host: home, inside: '/agentmgr/claude' }, { host: projects, inside: '/agentmgr/claude/projects' }],
+      env: ['CLAUDE_CONFIG_DIR=/agentmgr/claude', 'CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY'],
+      bin: 'claude',
+    };
+  }
+  if (engineId === 'codex') {
+    const codexHome = env.CODEX_HOME || path.join(os.homedir(), '.codex');
+    const sessions = path.join(codexHome, 'sessions');
+    fs.mkdirSync(sessions, { recursive: true });
+    const auth = path.join(codexHome, 'auth.json');
+    return {
+      mounts: [{ host: home, inside: '/agentmgr/codex' }, { host: sessions, inside: '/agentmgr/codex/sessions' }, ...(fs.existsSync(auth) ? [{ host: auth, inside: '/agentmgr/codex/auth.json', readOnly: true }] : [])],
+      env: ['CODEX_HOME=/agentmgr/codex', 'OPENAI_API_KEY'],
+      bin: 'codex',
+    };
+  }
+  throw Object.assign(new Error(`${engineId} can't run in a container yet (Claude Code and Codex can)`), { status: 400 });
+}

package/src/engines/acp.js

@@ -0,0 +1,222 @@
+// Engines for agents that speak ACP (the Agent Client Protocol): Gemini CLI, OpenCode, Goose,
+// Qwen Code and any other, from one line of config. AI Agent Manager runs its own terminal client
+// (bin/acp-client.js) in the agent's terminal, which talks ACP to the agent and keeps a session log
+// in ~/.agentmanager/acp/<engine>/<session>.jsonl; this adapter reads that log for usage, PR and
+// bug links, stuck detection and Explain.
+//
+// config.json: "acp": { "<name>": { "command": ["opencode", "acp"], "label": "OpenCode" } }
+// adds (or changes) the engine "acp-<name>". The presets below are offered when installed.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { paths } from '../config.js';
+import { norm, tailOf } from '../stuck.js';
+import { extractRefs } from '../tracker.js';
+
+const CLIENT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'bin', 'acp-client.js');
+export const ACP_PRESETS = {
+  gemini: { label: 'Gemini CLI', command: ['gemini', '--experimental-acp'] },
+  opencode: { label: 'OpenCode', command: ['opencode', 'acp'] },
+  goose: { label: 'Goose', command: ['goose', 'acp'] },
+  qwen: { label: 'Qwen Code', command: ['qwen', '--experimental-acp'] },
+};
+const ANSI = /\x1b(\[[0-9;?<>=]*[ -\/]*[@-~]|\][^\x07\x1b]*(\x07|\x1b\\)|[()][0-9A-B]|[=>78c])/g;
+const real = (p) => {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+};
+
+/** Complete JSON lines added since the cursor's offset. */
+function newRecords(file, cursor) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+  } catch {
+    return null;
+  }
+  try {
+    const { size, mtime } = fs.fstatSync(fd);
+    cursor.lastActivity = mtime.toISOString();
+    if (size < cursor.offset) cursor.offset = 0;
+    if (size === cursor.offset) return [];
+    const buf = Buffer.alloc(size - cursor.offset);
+    fs.readSync(fd, buf, 0, buf.length, cursor.offset);
+    const lastNl = buf.lastIndexOf(0x0a);
+    if (lastNl < 0) return [];
+    cursor.offset += lastNl + 1;
+    const out = [];
+    for (const line of buf.subarray(0, lastNl).toString('utf8').split('\n')) {
+      try {
+        if (line) out.push(JSON.parse(line));
+      } catch {}
+    }
+    return out;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** The engine for one ACP agent. */
+export function acpEngine(name, { command, label, args = [] }) {
+  const id = `acp-${name}`;
+  const logDir = () => path.join(paths.home, 'acp', name);
+  const fileOf = (sid) => path.join(logDir(), `${String(sid).replace(/[^\w.-]/g, '_')}.jsonl`);
+  const cmd = [command].flat().map(String);
+  return {
+    id,
+    label: label ?? name,
+    acp: true,
+    // Bypass answers its permission requests "allow" by itself; other modes ask (the inbox can answer).
+    supports: { chooseSessionId: false, cost: false, planHandoff: false, fork: false, oneShot: true, resumePrompt: true },
+    permissionModes: ['default', 'bypassPermissions'],
+    rulesFiles: ['AGENTS.md'],
+    install: `Install ${label ?? name} (\`${cmd[0]}\` on the daemon's PATH) and sign in once in a terminal`,
+
+    // The command that has to be installed is the agent's; the client is ours.
+    bin: () => process.execPath,
+    installedBin: () => cmd[0],
+    extraArgs: () => [],
+
+    /** The client in the agent's terminal: the log folder, resume, the first message, then the agent. */
+    launchArgs({ permissionMode, writableDir, instructions, sessionId, resume, prompt }) {
+      const out = [CLIENT, '--log', logDir()];
+      if (permissionMode === 'bypassPermissions') out.push('--yes');
+      for (const d of [writableDir ?? []].flat()) out.push('--allow-dir', d);
+      if (resume) out.push('--session', sessionId);
+      const first = resume ? prompt : [instructions, prompt && (instructions ? `Your task:\n${prompt}` : prompt)].filter(Boolean).join('\n\n---\n\n');
+      if (first) out.push('--prompt', first);
+      return [...out, '--', ...cmd, ...args];
+    },
+
+    sessionFile: (cwd, sid) => fileOf(sid),
+    hasSession: (cwd, sid) => fs.existsSync(fileOf(sid)),
+    subagentFiles: () => [],
+
+    /** Sessions the client started in this folder since a time (from each log's first line). */
+    recentSessions(cwd, sinceMs) {
+      const want = real(cwd);
+      const out = [];
+      let names = [];
+      try {
+        names = fs.readdirSync(logDir()).filter((n) => n.endsWith('.jsonl'));
+      } catch {}
+      for (const n of names) {
+        const file = path.join(logDir(), n);
+        const st = fs.statSync(file);
+        if (st.mtimeMs < sinceMs) continue;
+        let meta = null;
+        try {
+          meta = JSON.parse(fs.readFileSync(file, 'utf8').split('\n')[0]);
+        } catch {}
+        if (meta?.type !== 'meta' || real(meta.cwd) !== want) continue;
+        out.push({ sessionId: meta.sessionId, file, mtimeMs: st.mtimeMs, birthtimeMs: st.birthtimeMs });
+      }
+      return out.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    },
+
+    /** Usage (the agent's context use, when it reports it), PR and bug links from messages and tool output. */
+    scan(file, cursor, bugPatterns = []) {
+      const result = { prs: [], bugs: [], title: null, lastPrompt: null, cost: null, lastActivity: null };
+      cursor.usage ??= new Map();
+      cursor.offset ??= 0;
+      const recs = newRecords(file, cursor);
+      result.lastActivity = cursor.lastActivity ?? null;
+      if (!recs) return result;
+      for (const r of recs) {
+        if (r.type === 'user') result.lastPrompt = String(r.text ?? '').slice(0, 500);
+        if (r.type === 'usage' && r.used != null) cursor.usage.set('context', { input: r.used, output: 0, cacheCreation: 0, cacheRead: 0 });
+        const text = r.type === 'agent' || r.type === 'user' ? r.text : r.type === 'tool' ? r.output : '';
+        if (text) {
+          const refs = extractRefs(String(text), bugPatterns);
+          result.prs.push(...refs.prs);
+          result.bugs.push(...refs.bugs);
+        }
+      }
+      return result;
+    },
+
+    /** Commands and edits, for stuck detection. */
+    activity(file, state) {
+      state.events ??= [];
+      state.offset ??= 0;
+      state.inputs ??= {};
+      const recs = newRecords(file, state);
+      if (!recs) return state;
+      for (const r of recs) {
+        const t = Date.parse(r.t) || Date.now();
+        if (r.type === 'tool' && r.input) state.inputs[r.id] = r.input;
+        if (r.type === 'tool' && (r.status === 'completed' || r.status === 'failed') && r.kind === 'execute') {
+          const input = r.input ?? state.inputs[r.id] ?? {};
+          const out = String(r.output ?? '');
+          state.events.push({ t, kind: 'cmd', cmd: norm(String(input.command ?? r.title ?? '')).slice(0, 300), failed: Boolean(r.failed), result: tailOf(out), shown: out.replace(/\s+/g, ' ').trim().slice(-160) });
+        } else if (r.type === 'edit') {
+          state.events.push({ t, kind: 'edit', file: r.path, edits: [[norm(r.oldText ?? ''), norm(r.newText ?? '')]] });
+        }
+      }
+      if (state.events.length > 400) state.events = state.events.slice(-400);
+      return state;
+    },
+
+    /** A readable digest of the conversation, for Explain and documents. */
+    digest(file, { maxChars = 24_000 } = {}) {
+      const events = [];
+      const edited = new Set();
+      for (const r of newRecords(file, { offset: 0 }) ?? []) {
+        if (r.type === 'user') events.push(`[user] ${String(r.text).slice(0, 1200)}`);
+        else if (r.type === 'agent') events.push(`[agent] ${String(r.text).slice(0, 1800)}`);
+        else if (r.type === 'tool' && (r.status === 'completed' || r.status === 'failed')) events.push(`[action] ${r.title}${r.failed ? ' (failed)' : ''}`);
+        else if (r.type === 'edit') edited.add(r.path), events.push(`[action] edited ${r.path}`);
+      }
+      const head = events.find((e) => e.startsWith('[user]'));
+      const tail = [];
+      let used = head?.length ?? 0;
+      for (let i = events.length - 1; i >= 0 && events[i] !== head; i--) {
+        if (used + events[i].length > maxChars) {
+          tail.unshift('… (earlier events omitted) …');
+          break;
+        }
+        tail.unshift(events[i]);
+        used += events[i].length + 1;
+      }
+      return { digest: [head, ...tail].filter(Boolean).join('\n'), events: events.length, edited: [...edited] };
+    },
+
+    copySession: () => false,
+
+    attention: [[/Permissionneeded:/i, 'Permission prompt']],
+    // Its menu reads a line: a choice is the number, then Enter.
+    promptKeyEnter: true,
+
+    /** The client's menu: "Permission needed: <title> 1. Allow once 2. Always allow 3. Reject Choose 1-3". */
+    promptChoices(screen) {
+      const text = String(screen ?? '').replace(ANSI, ' ').replace(/\s+/g, ' ');
+      const at = text.lastIndexOf('Permission needed:');
+      if (at < 0) return { question: '', choices: [] };
+      const tail = text.slice(at);
+      const question = (/^Permission needed: (.*?)(?= 1\. )/.exec(tail)?.[1] ?? '').trim().slice(0, 200);
+      const choices = [];
+      for (const m of tail.matchAll(/\b(\d)\. (.+?)(?= \d\. | Choose |$)/g)) choices.push({ key: m[1], label: m[2].trim().slice(0, 80) });
+      return { question: question ? `Allow: ${question}?` : 'Allow this?', choices };
+    },
+
+    trust: () => false,
+
+    /** One-shot: the client in --once mode, every permission refused (read-only), the prompt on stdin. */
+    oneShotArgs: () => [CLIENT, '--once', '--', ...cmd, ...args],
+
+    stripEnv: [],
+  };
+}
+
+/** The ACP engines to offer: the presets, with config's own added or changed. */
+export function acpEngines(config = {}) {
+  const defs = { ...ACP_PRESETS };
+  for (const [name, def] of Object.entries(config.acp ?? {})) {
+    if (def === false) delete defs[name];
+    else if (def?.command) defs[name] = { ...defs[name], ...def };
+  }
+  return Object.entries(defs).map(([name, def]) => acpEngine(name, def));
+}

package/src/engines/index.js

@@ -6,6 +6,7 @@ import antigravity from './antigravity.js';
 import claude from './claude.js';
 import codex from './codex.js';
 import muse from './muse.js';
+import { acpEngines } from './acp.js';
 
 export const ENGINES = { claude, codex, antigravity, muse };
 export const DEFAULT_ENGINE = 'claude';
@@ -17,16 +18,23 @@ export function registerEngine(def) {
   ENGINES[def.id] = def;
 }
 
+/** ACP agents from config.json's "acp" and the presets (acp.js); call again when the config changes. */
+export function registerAcpEngines(config = {}) {
+  for (const id of Object.keys(ENGINES)) if (ENGINES[id].acp) delete ENGINES[id];
+  for (const e of acpEngines(config)) ENGINES[e.id] = e;
+}
+
 /** Whether an engine's command is on this machine (an absolute path, or found on PATH). */
 export function installed(engine, config) {
-  const bin = engine.bin(config);
+  // An ACP engine runs our client with Node; what has to be installed is the agent's own command.
+  const bin = engine.installedBin?.(config) ?? engine.bin(config);
   if (path.isAbsolute(bin)) return fs.existsSync(bin);
   return (process.env.PATH ?? '').split(path.delimiter).some((d) => d && fs.existsSync(path.join(d, bin)));
 }
 
 /** What to tell the person when an engine's command isn't on this machine. */
 export function notInstalled(engine, config) {
-  const bin = engine.bin(config);
+  const bin = engine.installedBin?.(config) ?? engine.bin(config);
   const how = engine.install ?? `Install ${engine.label}`;
   const where = path.isAbsolute(bin) ? `${bin} doesn't exist` : `\`${bin}\` isn't on the daemon's PATH`;
   return `${engine.label} not found: ${where}. ${how}, then run \`agentmgr restart\`. If it's installed somewhere else, set its path in config.json${engine.id === 'claude' ? ' ("claudeBin") or AGENTMGR_CLAUDE_BIN' : ` ("engines": {"${engine.id}": {"bin": "…"}})`}.`;

package/src/fleet.js

@@ -158,19 +158,20 @@ export const isLoopback = (h) => ['127.0.0.1', 'localhost', '[::1]', '::1'].incl
 
 /**
  * Hub URLs a runner accepts: https anywhere; plain http only on this machine or over
- * Tailscale, which already encrypts the traffic.
+ * Tailscale, which already encrypts the traffic, or on a private network you vouch for
+ * (AGENTMGR_HUB_ALLOW_HTTP=1: a hub and runners in one docker-compose or VPC).
  */
-export function checkHubUrl(raw) {
+export function checkHubUrl(raw, env = process.env) {
   let u;
   try {
     u = new URL(String(raw ?? '').trim());
   } catch {
     throw Object.assign(new Error('Hub URL must look like https://hub.example.com'), { status: 400 });
   }
-  if (u.protocol === 'https:' || (u.protocol === 'http:' && (isLoopback(u.hostname) || isTailscaleHost(u.hostname)))) {
+  if (u.protocol === 'https:' || (u.protocol === 'http:' && (isLoopback(u.hostname) || isTailscaleHost(u.hostname) || env.AGENTMGR_HUB_ALLOW_HTTP === '1'))) {
     return u.origin;
   }
-  throw Object.assign(new Error('Use https:// for the hub (plain http only for localhost or a Tailscale address)'), { status: 400 });
+  throw Object.assign(new Error('Use https:// for the hub (plain http only for localhost, a Tailscale address, or a private network with AGENTMGR_HUB_ALLOW_HTTP=1)'), { status: 400 });
 }
 
 /** Signed by the runner's key on every connection, so the hub knows which runner it is. */

package/src/hub.js

@@ -61,6 +61,12 @@ function newCode() {
   const chars = [...bytes].map((b) => CODE_ALPHABET[b % CODE_ALPHABET.length]).join('');
   return chars.match(/.{4}/g).join('-');
 }
+/** Constant-time comparison of two strings (different lengths are simply unequal). */
+const safeEqual = (a, b) => {
+  const x = Buffer.from(String(a));
+  const y = Buffer.from(String(b));
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+};
 const normalizeCode = (c) => String(c ?? '').toUpperCase().replace(/[^A-Z0-9]/g, '');
 
 /** Google sign-in settings from the environment, or null when not configured. */
@@ -459,7 +465,11 @@ export async function startHub({
       if (!loginAllowed(req.ip)) throw fail(429, 'Too many attempts; try again in 15 minutes');
       const key = sha256(normalizeCode(req.body?.code));
       const invite = store.data.invites[key];
-      if (!invite || Date.parse(invite.expiresAt) < Date.now()) {
+      // The runner token (AGENTMGR_HUB_RUNNER_TOKEN): a reusable secret for machines that join by
+      // themselves, such as cloud runners; compared in constant time, and failures count like any.
+      const token = process.env.AGENTMGR_HUB_RUNNER_TOKEN;
+      const viaToken = Boolean(token && token.length >= 24 && safeEqual(String(req.body?.code ?? ''), token));
+      if (!viaToken && (!invite || Date.parse(invite.expiresAt) < Date.now())) {
         loginFailed(req.ip);
         throw fail(401, 'Invite code is wrong, used or expired; create a new one on the hub');
       }
@@ -471,7 +481,7 @@ export async function startHub({
       } catch {
         throw fail(400, 'publicKey must be an Ed25519 public key (PEM)');
       }
-      delete store.data.invites[key]; // single use
+      if (!viaToken) delete store.data.invites[key]; // single use
       const base = String(req.body?.name ?? '').toLowerCase().replace(/[^\w.-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 32) || 'machine';
       const taken = new Set(Object.values(store.data.runners).map((r) => r.name));
       let runnerName = base;
@@ -479,7 +489,7 @@ export async function startHub({
       const id = crypto.randomBytes(4).toString('hex');
       store.data.runners[id] = { id, name: runnerName, publicKey, enrolledAt: now(), lastSeen: null, version: String(req.body?.version ?? '').slice(0, 20) || null };
       store.save();
-      log(`runner ${runnerName} (${id}) joined from ${req.ip}`);
+      log(`runner ${runnerName} (${id}) joined from ${req.ip}${viaToken ? ' with the runner token' : ''}`);
       changed();
       return { runnerId: id, name: runnerName, hubName: name };
     }),

package/src/hublink.js

@@ -47,10 +47,12 @@ export function audit(line) {
   } catch {}
 }
 
-export function hubPolicy(config) {
+export function hubPolicy(config, env = process.env) {
   const h = config.hub ?? {};
+  // A cloud runner sets it in its environment (AGENTMGR_HUB_ALLOW=view,control,move): no config file to edit.
+  const fromEnv = env.AGENTMGR_HUB_ALLOW ? env.AGENTMGR_HUB_ALLOW.split(/[\s,]+/).filter(Boolean) : null;
   return {
-    allow: Array.isArray(h.allow) ? h.allow.map(String) : DEFAULT_HUB_POLICY.allow,
+    allow: fromEnv ?? (Array.isArray(h.allow) ? h.allow.map(String) : DEFAULT_HUB_POLICY.allow),
     projects: Array.isArray(h.projects) && h.projects.length ? h.projects.map(String) : DEFAULT_HUB_POLICY.projects,
   };
 }

package/src/inbox.js

@@ -87,6 +87,20 @@ export function promptChoices(screen) {
       break;
     }
   }
+  // Newer Claude Code can draw a menu as one run of text ("Do you want to proceed? ❯ 1. Yes 2. Yes,
+  // and switch to auto mode 3. No Esc to cancel"): read the flattened screen after the last question.
+  if (!choices.size) {
+    const flat = lines.join(' ').replace(/\s+/g, ' ');
+    const at = flat.search(/\?\s*(?:[❯>›]\s*)?1[.)]\s*\S[^?]*$/);
+    if (at >= 0) {
+      const head = flat.slice(0, at + 1);
+      // Drop what's left of the box around it (╌ ─ │ and stray letters before them).
+      question = (/([^.?!│]*\?)$/.exec(head)?.[1] ?? '').replace(/^.*[╌─│━]+\s*/, '').trim().slice(-200);
+      for (const m of flat.slice(at + 1).matchAll(/(?:[❯>›]\s*)?\b(\d)[.)]\s*(.+?)(?=\s+(?:[❯>›]\s*)?\d[.)]\s|\s+Esc to cancel|\s+Enter to|$)/g)) {
+        if (!choices.has(m[1])) choices.set(m[1], m[2].replace(/\s*·.*$/, '').trim().slice(0, 80));
+      }
+    }
+  }
   return {
     question,
     choices: [...choices.entries()].sort(([a], [b]) => a - b).map(([key, label]) => ({ key, label })),