deepdebug-local-agent 1.0.20 → 1.0.21

package/CLAUDE_CODE_AGENT_INFINITE.md

@@ -0,0 +1,623 @@
+# CLAUDE CODE — AGENT INFINITE LOOP
+# Terminal 1: cd ~/Documents/Projects/deepdebug-local-agent
+# claude --dangerously-skip-permissions "$(cat CLAUDE_CODE_AGENT_INFINITE.md)"
+
+## LEI FUNDAMENTAL
+NUNCA terminar com erro. NUNCA passar ao próximo item sem o actual estar verde.
+O único critério de paragem: TODOS OS ITEMS VERDES.
+
+## SETUP
+
+```bash
+AGENT="https://deepdebug-local-agent-qa-575662086506.us-central1.run.app"
+GATEWAY="https://deepdebug-gateway-qa-575662086506.us-central1.run.app"
+GCP_CLIENT="gen-lang-client-0961289539"
+SA_EMAIL="deepdebug-agent@${GCP_CLIENT}.iam.gserviceaccount.com"
+PG="PGPASSWORD='DeepDebugQA@2026' psql -h 35.224.155.29 -U deepdebug -d deepdebug"
+WS_ID="b040f1ae-5f3c-4612-9ce1-0b18a5aea303"
+
+log()  { echo "[$(date '+%H:%M:%S')] $1"; }
+ok()   { echo "[OK] $1"; }
+fail() { echo "[FAIL] $1"; }
+
+deploy_agent() {
+  cd ~/Documents/Projects/deepdebug-local-agent
+  node --check src/server.js 2>&1 | head -5
+  if [ $? -ne 0 ]; then fail "Syntax error"; return 1; fi
+  git add -A && git commit -m "auto-heal: $1" --allow-empty -q
+  gcloud builds submit --config cloudbuild-agent-qa.yaml --project insptechai 2>&1 | tail -3
+  log "Waiting 5 min..."; sleep 300
+  ok "Agent deployed"
+}
+
+read_logs() {
+  gcloud logging read "resource.type=cloud_run_revision AND resource.labels.service_name=deepdebug-local-agent-qa" \
+    --project=insptechai --freshness=5m --format="value(textPayload)" 2>/dev/null \
+    | grep -v "^$" | head -20
+}
+```
+
+---
+
+## ITEM A1 — /workspace/setup ENDPOINT
+
+### Critério: endpoint existe, clone funciona, detect stack funciona, SSE retorna event:complete
+
+```bash
+check_setup() {
+  local R=$(curl -s -X POST "$AGENT/workspace/setup" \
+    -H "Content-Type: application/json" \
+    -d '{"workspaceId":"test-check-001","repoUrl":"https://github.com/williambella/simple-api.git","gitToken":"","provider":"deepdebug_cloud"}' \
+    --max-time 30 2>/dev/null)
+  echo "$R" | grep -q "progress\|complete\|Starting setup"
+}
+
+fix_setup() {
+  cd ~/Documents/Projects/deepdebug-local-agent
+  # Verificar se endpoint existe
+  grep -n "workspace/setup\|cloneRepository\|detectProjectStack\|generateDockerfile" src/server.js | head -10
+
+  # Se não existir, o endpoint foi adicionado em sessões anteriores mas pode ter sido sobrescrito
+  # Ver o fim do ficheiro
+  tail -100 src/server.js
+
+  # Verificar se as funções auxiliares existem
+  grep -n "async function cloneRepository\|async function detectProjectStack\|async function generateDockerfile" src/server.js
+
+  # Se não existirem, adicionar o endpoint completo com todas as funções
+  # baseado no que foi implementado nas sessões anteriores
+}
+```
+
+### Implementação completa se não existir:
+
+```bash
+add_setup_endpoint() {
+  cd ~/Documents/Projects/deepdebug-local-agent
+
+  # Verificar se já existe
+  if grep -q "workspace/setup" src/server.js; then
+    log "/workspace/setup already exists"
+    return 0
+  fi
+
+  log "Adding /workspace/setup endpoint..."
+
+  # Adicionar antes do app.listen (última linha do ficheiro)
+  LISTEN_LINE=$(grep -n "app.listen\|server.listen" src/server.js | tail -1 | cut -d: -f1)
+  log "app.listen at line: $LISTEN_LINE"
+
+  # Criar ficheiro com o código a adicionar
+  cat > /tmp/setup_endpoint.js << 'JSEOF'
+
+// ============================================================
+// WORKSPACE BASE
+// ============================================================
+const WORKSPACE_BASE = process.env.WORKSPACE_BASE || process.env.WORKSPACES_MOUNT || '/mnt/workspaces';
+
+// ============================================================
+// POST /workspace/setup — AI Cloud Engineering Agent
+// ============================================================
+app.post('/workspace/setup', async (req, res) => {
+  const { workspaceId, repoUrl, gitToken, provider = 'deepdebug_cloud',
+          cloudProjectId, cloudToken, serviceAccountJson } = req.body || {};
+
+  if (!workspaceId || !repoUrl) {
+    return res.status(400).json({ error: 'workspaceId and repoUrl required' });
+  }
+
+  res.setHeader('Content-Type', 'text/event-stream');
+  res.setHeader('Cache-Control', 'no-cache');
+  res.setHeader('Connection', 'keep-alive');
+  res.setHeader('X-Accel-Buffering', 'no');
+
+  const emit = (event, msg) => {
+    const data = typeof msg === 'object' ? JSON.stringify(msg) : JSON.stringify({ message: msg });
+    res.write(`event:${event}\ndata:${data}\n\n`);
+  };
+
+  try {
+    const wsPath = path.join(WORKSPACE_BASE, workspaceId);
+    emit('progress', `Starting setup for workspace: ${workspaceId}`);
+    emit('progress', `Workspace path: ${wsPath}`);
+
+    // STEP 1: Clone
+    emit('progress', 'Cloning repository...');
+    const cloneResult = await cloneRepo(wsPath, repoUrl, gitToken);
+    if (!cloneResult.ok) {
+      emit('error', { error: `Clone failed: ${cloneResult.error}` });
+      return res.end();
+    }
+    emit('progress', `Repository cloned on branch: ${cloneResult.branch}`);
+
+    // STEP 2: Detect stack
+    emit('progress', 'AI analysing project structure...');
+    const stack = await detectStack(wsPath);
+    emit('progress', `Stack: ${stack.language} / ${stack.buildTool} / ${stack.framework}`);
+
+    // STEP 3: Generate Dockerfile
+    const dfResult = await ensureDockerfile(wsPath, stack);
+    emit('progress', dfResult.existed ? 'Dockerfile already exists' : `Dockerfile generated for ${stack.language}`);
+
+    // STEP 4: Register workspace
+    try {
+      await wsManager.open(workspaceId, wsPath);
+    } catch (e) { /* ignore */ }
+
+    emit('progress', `Provider: ${provider}. Workspace ready.`);
+    emit('progress', 'AI Cloud Engineering setup complete!');
+    emit('complete', {
+      success: true, workspaceId, wsPath, provider,
+      branch: cloneResult.branch,
+      stack: { language: stack.language, buildTool: stack.buildTool }
+    });
+    res.end();
+  } catch (err) {
+    console.error('[Setup] Error:', err.message);
+    emit('error', { error: err.message });
+    res.end();
+  }
+});
+
+// ============================================================
+// POST /workspace/build-push — Build + push via Cloud Build
+// ============================================================
+app.post('/workspace/build-push', async (req, res) => {
+  const { workspaceId, imageName, gcpProject, saKeyJson } = req.body || {};
+  if (!workspaceId || !imageName || !gcpProject || !saKeyJson) {
+    return res.status(400).json({ error: 'workspaceId, imageName, gcpProject, saKeyJson required' });
+  }
+
+  res.setHeader('Content-Type', 'text/event-stream');
+  res.setHeader('Cache-Control', 'no-cache');
+  res.setHeader('Connection', 'keep-alive');
+  res.setHeader('X-Accel-Buffering', 'no');
+
+  const emit = (event, msg) => {
+    const data = typeof msg === 'object' ? JSON.stringify(msg) : JSON.stringify({ message: msg });
+    res.write(`event:${event}\ndata:${data}\n\n`);
+  };
+
+  try {
+    const wsPath = path.join(WORKSPACE_BASE, workspaceId);
+    if (!fs.existsSync(wsPath)) {
+      emit('error', { error: `Workspace not found: ${wsPath}` }); return res.end();
+    }
+    if (!fs.existsSync(path.join(wsPath, 'Dockerfile'))) {
+      emit('error', { error: 'No Dockerfile in workspace' }); return res.end();
+    }
+
+    // Step 1: Get SA access token
+    emit('progress', 'Authenticating with GCP...');
+    let accessToken;
+    try {
+      const { createSign } = await import('crypto');
+      const sa = JSON.parse(saKeyJson);
+      const now = Math.floor(Date.now() / 1000);
+      const h = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
+      const c = Buffer.from(JSON.stringify({
+        iss: sa.client_email,
+        scope: 'https://www.googleapis.com/auth/cloud-platform',
+        aud: 'https://oauth2.googleapis.com/token',
+        iat: now, exp: now + 3600
+      })).toString('base64url');
+      const sign = createSign('SHA256');
+      sign.update(`${h}.${c}`);
+      const jwt = `${h}.${c}.${sign.sign(sa.private_key, 'base64url')}`;
+      const tokenResp = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=${jwt}`
+      });
+      const tokenData = await tokenResp.json();
+      accessToken = tokenData.access_token;
+      if (!accessToken) throw new Error('No access_token: ' + JSON.stringify(tokenData));
+      emit('progress', 'GCP authentication successful');
+    } catch (e) {
+      emit('error', { error: 'GCP auth failed: ' + e.message }); return res.end();
+    }
+
+    // Step 2: Compress workspace
+    emit('progress', 'Compressing source code...');
+    const { execSync } = await import('child_process');
+    const tarPath = `/tmp/source-${workspaceId}-${Date.now()}.tar.gz`;
+    try {
+      execSync(`tar -czf "${tarPath}" --exclude=".git" --exclude="node_modules" --exclude="target" --exclude="*.class" --exclude=".gradle" -C "${wsPath}" . 2>&1`, { stdio: 'pipe', timeout: 120000 });
+      const sizeKB = Math.round(fs.statSync(tarPath).size / 1024);
+      emit('progress', `Source compressed: ${sizeKB}KB`);
+    } catch (e) {
+      emit('error', { error: 'Compression failed: ' + e.message.substring(0, 200) }); return res.end();
+    }
+
+    // Step 3: Upload to GCS
+    const bucketName = `${gcpProject}_cloudbuild`;
+    const objectName = `source/${workspaceId}-${Date.now()}.tar.gz`;
+    emit('progress', `Uploading source to GCS bucket: ${bucketName}...`);
+    try {
+      await fetch(`https://storage.googleapis.com/storage/v1/b?project=${gcpProject}`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name: bucketName, location: 'US' })
+      });
+      const fileBuffer = fs.readFileSync(tarPath);
+      const uploadResp = await fetch(
+        `https://storage.googleapis.com/upload/storage/v1/b/${encodeURIComponent(bucketName)}/o?uploadType=media&name=${encodeURIComponent(objectName)}`,
+        { method: 'POST', headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/gzip' }, body: fileBuffer }
+      );
+      if (!uploadResp.ok) {
+        const errText = await uploadResp.text();
+        throw new Error(`GCS upload ${uploadResp.status}: ${errText.substring(0, 200)}`);
+      }
+      emit('progress', 'Source uploaded to GCS');
+    } catch (e) {
+      emit('error', { error: 'GCS upload failed: ' + e.message }); return res.end();
+    } finally {
+      try { fs.unlinkSync(tarPath); } catch {}
+    }
+
+    // Step 4: Submit Cloud Build
+    emit('progress', 'Submitting Cloud Build...');
+    let buildId = 'unknown';
+    try {
+      const buildReq = {
+        source: { storageSource: { bucket: bucketName, object: objectName } },
+        steps: [
+          { name: 'gcr.io/cloud-builders/docker', args: ['build', '-t', imageName, '.'], id: 'build' },
+          { name: 'gcr.io/cloud-builders/docker', args: ['push', imageName], id: 'push', waitFor: ['build'] }
+        ],
+        images: [imageName], timeout: '1200s'
+      };
+      const buildResp = await fetch(`https://cloudbuild.googleapis.com/v1/projects/${gcpProject}/builds`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify(buildReq)
+      });
+      if (!buildResp.ok) {
+        const errText = await buildResp.text();
+        throw new Error(`Cloud Build ${buildResp.status}: ${errText.substring(0, 300)}`);
+      }
+      const buildData = await buildResp.json();
+      buildId = buildData.metadata?.build?.id || buildData.name?.split('/').pop() || 'unknown';
+      emit('progress', `Cloud Build started: ${buildId}`);
+    } catch (e) {
+      emit('error', { error: 'Cloud Build submit failed: ' + e.message }); return res.end();
+    }
+
+    // Step 5: Poll status
+    emit('progress', 'Building Docker image (3-5 minutes)...');
+    let status = 'WORKING';
+    let attempts = 0;
+    while (!['SUCCESS', 'FAILURE', 'CANCELLED', 'TIMEOUT'].includes(status) && attempts < 40) {
+      await new Promise(r => setTimeout(r, 15000));
+      attempts++;
+      try {
+        const sResp = await fetch(`https://cloudbuild.googleapis.com/v1/projects/${gcpProject}/builds/${buildId}`, { headers: { Authorization: `Bearer ${accessToken}` } });
+        const sData = await sResp.json();
+        status = sData.status || 'WORKING';
+        emit('progress', `Build status: ${status} (${attempts}/40)`);
+      } catch (e) { emit('progress', `Status check: ${e.message}`); }
+    }
+
+    if (status === 'SUCCESS') {
+      emit('progress', 'Docker image built and pushed successfully!');
+      emit('complete', { success: true, imageName, buildId });
+    } else {
+      emit('error', { error: `Cloud Build ${status}. Check GCP Console.` });
+    }
+    res.end();
+  } catch (err) {
+    console.error('[build-push] Fatal:', err.message);
+    emit('error', { error: err.message });
+    res.end();
+  }
+});
+
+// ============================================================
+// POST /workspace/git/prepare — Clone/update repo
+// ============================================================
+app.post('/workspace/git/prepare', async (req, res) => {
+  const { workspaceId, repoUrl, gitToken, branch } = req.body || {};
+  if (!workspaceId || !repoUrl) return res.status(400).json({ error: 'workspaceId and repoUrl required' });
+  const wsPath = path.join(WORKSPACE_BASE, workspaceId);
+  try {
+    const result = await cloneRepo(wsPath, repoUrl, gitToken, branch);
+    res.json({ ok: true, path: wsPath, ...result });
+  } catch (e) {
+    res.status(500).json({ ok: false, error: e.message });
+  }
+});
+
+// ============================================================
+// POST /workspace/write-file — Write file to workspace
+// ============================================================
+app.post('/workspace/write-file', async (req, res) => {
+  const { workspaceId, path: filePath, content, overwrite = true } = req.body || {};
+  if (!filePath || content === undefined) return res.status(400).json({ error: 'path and content required' });
+  try {
+    const base = workspaceId ? path.join(WORKSPACE_BASE, workspaceId) : WORKSPACE_ROOT;
+    const abs = path.join(base, filePath);
+    if (!overwrite && fs.existsSync(abs)) return res.json({ ok: true, path: abs, skipped: true });
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content, 'utf8');
+    res.json({ ok: true, path: abs });
+  } catch (e) {
+    res.status(500).json({ ok: false, error: e.message });
+  }
+});
+
+// ============================================================
+// HELPER FUNCTIONS
+// ============================================================
+
+async function cloneRepo(wsPath, repoUrl, gitToken, branch = null) {
+  const { execSync } = await import('child_process');
+  let authUrl = repoUrl;
+  if (gitToken && gitToken.length > 5) {
+    try {
+      const urlObj = new URL(repoUrl);
+      urlObj.username = 'x-access-token';
+      urlObj.password = gitToken;
+      authUrl = urlObj.toString();
+      console.log(`[Clone] Using authenticated clone for ${urlObj.hostname}`);
+    } catch {}
+  }
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo', HOME: '/tmp' };
+  const opts = { stdio: 'pipe', timeout: 300000, env, shell: true };
+
+  if (fs.existsSync(path.join(wsPath, '.git'))) {
+    console.log(`[Clone] Workspace exists, updating...`);
+    try {
+      execSync('git fetch origin 2>&1', { ...opts, cwd: wsPath });
+      const branch = execSync('git branch --show-current 2>&1', { ...opts, cwd: wsPath }).toString().trim();
+      execSync(`git reset --hard origin/${branch} 2>&1`, { ...opts, cwd: wsPath });
+      return { ok: true, branch, updated: true };
+    } catch (e) {
+      console.warn('[Clone] Update failed, re-cloning');
+      fs.rmSync(wsPath, { recursive: true, force: true });
+    }
+  }
+
+  fs.mkdirSync(wsPath, { recursive: true });
+  const branches = branch ? [branch] : ['main', 'master', 'develop'];
+  for (const b of branches) {
+    try {
+      console.log(`[Clone] Trying branch: ${b}...`);
+      execSync(`git clone --depth=1 --branch "${b}" "${authUrl}" "${wsPath}" 2>&1`, opts);
+      console.log(`[Clone] Cloned on branch: ${b}`);
+      return { ok: true, branch: b, cloned: true };
+    } catch (e) {
+      const err = (e.stdout || e.stderr || e.message || '').toString();
+      if (err.includes('404') || err.includes('not found') || err.includes('Repository not found')) break;
+    }
+  }
+  try {
+    execSync(`git clone --depth=1 "${authUrl}" "${wsPath}" 2>&1`, opts);
+    const b = execSync('git branch --show-current 2>&1', { ...opts, cwd: wsPath }).toString().trim();
+    return { ok: true, branch: b, cloned: true };
+  } catch (e) {
+    return { ok: false, error: e.message.substring(0, 200) };
+  }
+}
+
+async function detectStack(wsPath) {
+  const check = f => fs.existsSync(path.join(wsPath, f));
+  const read = f => { try { return fs.readFileSync(path.join(wsPath, f), 'utf8'); } catch { return ''; } };
+  let language = 'unknown', buildTool = 'unknown', framework = 'unknown', port = 8080;
+  if (check('pom.xml')) {
+    language = 'java'; buildTool = 'maven';
+    const pom = read('pom.xml');
+    if (pom.includes('spring-boot')) framework = 'spring-boot';
+    else if (pom.includes('quarkus')) framework = 'quarkus';
+  } else if (check('build.gradle') || check('build.gradle.kts')) {
+    language = 'java'; buildTool = 'gradle';
+  } else if (check('package.json')) {
+    language = 'javascript'; buildTool = 'npm';
+    const pkg = JSON.parse(read('package.json') || '{}');
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    if (deps.next) framework = 'nextjs';
+    else if (deps.express) framework = 'express';
+    else if (deps.fastify) framework = 'fastify';
+  } else if (check('requirements.txt') || check('pyproject.toml')) {
+    language = 'python'; buildTool = 'pip';
+    const reqs = read('requirements.txt');
+    if (reqs.includes('fastapi')) framework = 'fastapi';
+    else if (reqs.includes('django')) framework = 'django';
+    else if (reqs.includes('flask')) framework = 'flask';
+  } else if (check('go.mod')) { language = 'go'; buildTool = 'go'; }
+  else if (check('Cargo.toml')) { language = 'rust'; buildTool = 'cargo'; }
+  else if (check('composer.json')) { language = 'php'; buildTool = 'composer'; }
+  return { language, buildTool, framework, port, hasDockerfile: check('Dockerfile') };
+}
+
+async function ensureDockerfile(wsPath, stack) {
+  const dfPath = path.join(wsPath, 'Dockerfile');
+  if (fs.existsSync(dfPath)) return { ok: true, existed: true };
+  const { language, buildTool, port = 8080 } = stack;
+  let content = '';
+  if (language === 'java' && buildTool === 'maven') {
+    content = `FROM maven:3.9-eclipse-temurin-17 AS build\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn clean package -DskipTests -B\n\nFROM eclipse-temurin:17-jre-jammy\nWORKDIR /app\nCOPY --from=build /app/target/*.jar app.jar\nEXPOSE ${port}\nENTRYPOINT ["java", "-jar", "app.jar"]\n`;
+  } else if (language === 'java' && buildTool === 'gradle') {
+    content = `FROM gradle:8-jdk17 AS build\nWORKDIR /app\nCOPY . .\nRUN gradle build -x test --no-daemon\n\nFROM eclipse-temurin:17-jre-jammy\nWORKDIR /app\nCOPY --from=build /app/build/libs/*.jar app.jar\nEXPOSE ${port}\nENTRYPOINT ["java", "-jar", "app.jar"]\n`;
+  } else if (language === 'javascript' || language === 'typescript') {
+    content = `FROM node:20-alpine\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production\nCOPY . .\nEXPOSE ${port}\nENV PORT=${port}\nENV NODE_ENV=production\nCMD ["node", "src/index.js"]\n`;
+  } else if (language === 'python') {
+    content = `FROM python:3.11-slim\nWORKDIR /app\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\nCOPY . .\nEXPOSE ${port}\nCMD ["python", "app.py"]\n`;
+  } else if (language === 'go') {
+    content = `FROM golang:1.21-alpine AS build\nWORKDIR /app\nCOPY . .\nRUN go build -o main .\n\nFROM alpine:3.18\nWORKDIR /app\nCOPY --from=build /app/main .\nEXPOSE ${port}\nCMD ["./main"]\n`;
+  } else {
+    content = `FROM ubuntu:22.04\nWORKDIR /app\nCOPY . .\nEXPOSE ${port}\nCMD ["./start.sh"]\n`;
+  }
+  fs.writeFileSync(dfPath, content, 'utf8');
+  return { ok: true, existed: false };
+}
+JSEOF
+
+  # Inserir antes do app.listen
+  head -n $((LISTEN_LINE - 1)) src/server.js > /tmp/server_new.js
+  cat /tmp/setup_endpoint.js >> /tmp/server_new.js
+  tail -n +$LISTEN_LINE src/server.js >> /tmp/server_new.js
+  mv /tmp/server_new.js src/server.js
+
+  log "Endpoints added to server.js"
+}
+```
+
+---
+
+## LOOP PRINCIPAL DO AGENT
+
+```bash
+log "======================================"
+log "AGENT INFINITE LOOP — START"
+log "======================================"
+
+cd ~/Documents/Projects/deepdebug-local-agent
+
+# Verificar e adicionar endpoints se necessário
+if ! grep -q "workspace/setup" src/server.js; then
+  log "Endpoints missing — adding..."
+  add_setup_endpoint
+  deploy_agent "add setup+build-push+clone endpoints"
+fi
+
+AGENT_DONE=false
+while [ "$AGENT_DONE" = "false" ]; do
+  ALL_GREEN=true
+
+  # ─── CHECK A1: /workspace/setup ───
+  log "CHECK A1: /workspace/setup"
+  SETUP_R=$(curl -s -X POST "$AGENT/workspace/setup" \
+    -H "Content-Type: application/json" \
+    -d '{"workspaceId":"agent-check-001","repoUrl":"https://github.com/williambella/simple-api.git","gitToken":"","provider":"deepdebug_cloud"}' \
+    --max-time 30 2>/dev/null)
+  if echo "$SETUP_R" | grep -q "Starting setup\|progress\|complete"; then
+    ok "A1: /workspace/setup OK"
+  else
+    fail "A1: /workspace/setup FAIL — $SETUP_R"
+    ALL_GREEN=false
+    # Fix: re-adicionar endpoints
+    add_setup_endpoint
+    deploy_agent "fix setup endpoint"
+  fi
+
+  # ─── CHECK A2: /workspace/build-push ───
+  log "CHECK A2: /workspace/build-push"
+  BP_R=$(curl -s -X POST "$AGENT/workspace/build-push" \
+    -H "Content-Type: application/json" \
+    -d '{"workspaceId":"x","imageName":"x","gcpProject":"x","saKeyJson":"{}"}' \
+    --max-time 10 2>/dev/null)
+  if echo "$BP_R" | grep -q "Authenticating\|progress\|error\|auth"; then
+    ok "A2: /workspace/build-push exists"
+  else
+    fail "A2: /workspace/build-push FAIL"
+    ALL_GREEN=false
+    add_setup_endpoint
+    deploy_agent "fix build-push endpoint"
+  fi
+
+  # ─── CHECK A3: Clone com token real ───
+  log "CHECK A3: Clone com token real"
+  GIT_TOKEN=$(PGPASSWORD='DeepDebugQA@2026' psql -h 35.224.155.29 -U deepdebug -d deepdebug -t -c \
+    "SELECT t.access_token FROM oauth_tokens t JOIN tenants tn ON tn.id::text=t.tenant_id WHERE t.provider='GITHUB' LIMIT 1;" \
+    | tr -d ' \n')
+
+  if [ -n "$GIT_TOKEN" ]; then
+    CLONE_R=$(curl -s -N -X POST "$AGENT/workspace/setup" \
+      -H "Content-Type: application/json" \
+      -d "{\"workspaceId\":\"agent-check-clone-$(date +%s)\",\"repoUrl\":\"https://github.com/williambella/simple-api.git\",\"gitToken\":\"$GIT_TOKEN\",\"provider\":\"deepdebug_cloud\"}" \
+      --max-time 60 2>/dev/null)
+    if echo "$CLONE_R" | grep -q "Stack:\|Cloned on branch\|complete"; then
+      ok "A3: Clone with token OK"
+    else
+      fail "A3: Clone FAIL — checking logs"
+      read_logs
+      ALL_GREEN=false
+    fi
+  fi
+
+  # ─── CHECK A4: /workspace/build-push com SA real ───
+  log "CHECK A4: build-push com SA key real"
+  SA_KEY_ENC=$(PGPASSWORD='DeepDebugQA@2026' psql -h 35.224.155.29 -U deepdebug -d deepdebug -t -c \
+    "SELECT service_account_key FROM oauth_tokens WHERE tenant_id='63922779-7321-4e79-b0f0-63890cd0d98e' AND provider='GCP';" \
+    | tr -d ' \n')
+  ENC_KEY=$(gcloud secrets versions access latest --secret=encryption-key-qa --project=insptechai 2>/dev/null)
+
+  # Testar JWT geração localmente primeiro
+  JWT_TEST=$(node -e "
+    const crypto = require('crypto');
+    try {
+      const enc = '$SA_KEY_ENC';
+      const key = '$ENC_KEY';
+      const kb = Buffer.alloc(32); Buffer.from(key).copy(kb);
+      const dec = crypto.createDecipheriv('aes-256-ecb', kb, null);
+      dec.setAutoPadding(true);
+      const sa = JSON.parse(Buffer.concat([dec.update(Buffer.from(enc,'base64')),dec.final()]).toString());
+      console.log('SA_OK:'+sa.client_email+':'+sa.project_id);
+    } catch(e) { console.log('SA_FAIL:'+e.message); }
+  " 2>/dev/null)
+
+  if echo "$JWT_TEST" | grep -q "SA_OK"; then
+    log "SA key decrypt OK: $JWT_TEST"
+    ok "A4: SA key decrypts correctly"
+  else
+    fail "A4: SA key decrypt FAIL: $JWT_TEST"
+    ALL_GREEN=false
+    log "Encryption key issue — checking..."
+  fi
+
+  # ─── CHECK A5: Cloud Build no projecto cliente ───
+  log "CHECK A5: Cloud Build acessível"
+  SA_TOKEN=$(node -e "
+    const crypto = require('crypto');
+    const enc = '$SA_KEY_ENC';
+    const key = '$ENC_KEY';
+    const kb = Buffer.alloc(32); Buffer.from(key).copy(kb);
+    const dec = crypto.createDecipheriv('aes-256-ecb', kb, null);
+    dec.setAutoPadding(true);
+    const sa = JSON.parse(Buffer.concat([dec.update(Buffer.from(enc,'base64')),dec.final()]).toString());
+    const now = Math.floor(Date.now()/1000);
+    const h = Buffer.from(JSON.stringify({alg:'RS256',typ:'JWT'})).toString('base64url');
+    const c = Buffer.from(JSON.stringify({iss:sa.client_email,scope:'https://www.googleapis.com/auth/cloud-platform',aud:'https://oauth2.googleapis.com/token',iat:now,exp:now+3600})).toString('base64url');
+    const s = crypto.createSign('SHA256'); s.update(h+'.'+c);
+    const jwt = h+'.'+c+'.'+s.sign(sa.private_key,'base64url');
+    fetch('https://oauth2.googleapis.com/token',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:'grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion='+jwt})
+    .then(r=>r.json()).then(d=>{
+      if(d.access_token) { process.stdout.write(d.access_token); }
+      else { console.error('FAIL:'+JSON.stringify(d)); process.exit(1); }
+    }).catch(e=>{console.error(e.message);process.exit(1);});
+  " 2>/dev/null)
+
+  if [ -n "$SA_TOKEN" ] && [ ${#SA_TOKEN} -gt 20 ]; then
+    ok "A5: SA token obtained (${#SA_TOKEN} chars)"
+    # Testar Cloud Run API
+    CR_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+      -H "Authorization: Bearer $SA_TOKEN" \
+      "https://run.googleapis.com/v2/projects/$GCP_CLIENT/locations/us-central1/services" 2>/dev/null)
+    log "Cloud Run API status: $CR_STATUS"
+    if [ "$CR_STATUS" = "200" ]; then
+      ok "A5: Cloud Run API accessible with SA token"
+    else
+      fail "A5: Cloud Run API returned $CR_STATUS — fixing roles"
+      ALL_GREEN=false
+      gcloud projects add-iam-policy-binding $GCP_CLIENT \
+        --member="serviceAccount:$SA_EMAIL" --role="roles/run.admin" --quiet 2>/dev/null
+      gcloud projects add-iam-policy-binding $GCP_CLIENT \
+        --member="serviceAccount:$SA_EMAIL" --role="roles/iam.serviceAccountUser" --quiet 2>/dev/null
+      sleep 10
+    fi
+  else
+    fail "A5: Could not obtain SA token"
+    ALL_GREEN=false
+  fi
+
+  if [ "$ALL_GREEN" = "true" ]; then
+    log "======================================"
+    log "AGENT — TODOS OS ITEMS VERDES!"
+    log "======================================"
+    AGENT_DONE=true
+  else
+    log "Items failing — fixing and retrying..."
+    sleep 5
+  fi
+done
+```

package/Dockerfile

@@ -42,6 +42,8 @@ RUN apk update && \
         curl \
         nfs-utils \
         openjdk17-jdk \
+        maven \
+        python3 \
     && rm -rf /var/cache/apk/*
 
 # Set JAVA_HOME so ./mvnw can find Java