yatfa 1.0.79 → 1.0.80

package/setup/setup-agent.rb

@@ -0,0 +1,1038 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Yatfa Agent - Run inside any Docker container with Ruby
+#
+# This script sets up and runs a Yatfa agent. It:
+# 1. Generates MCP config from environment variables
+# 2. Verifies system prompt (agent banner) exists at ~/.yatfa/system-prompt.txt
+# 3. Downloads and runs agent-bridge
+#
+# Requirements (install in your container):
+#   - Ruby 3.x
+#   - Node.js 20+
+#   - tmux
+#   - git, curl, gh (GitHub CLI)
+#   - claude CLI: npm install -g @anthropic-ai/claude-code
+#
+# Environment variables:
+#   AGENT_TYPE        - worker|planner|reviewer|researcher
+#   YATFA_URL       - Yatfa platform URL (https://yatfa.example.com)
+#   YATFA_API_URL   - API URL for MCP tools (https://yatfa.example.com/api/v1)
+#   YATFA_API_KEY    - MCP API key for this agent type
+#   GH_TOKEN         - GitHub token (or use GitHub App auth)
+#
+# Usage:
+#   curl -fsSL https://raw.githubusercontent.com/RoM4iK/yatfa-public/main/yatfa.rb | ruby
+
+require "json"
+require "fileutils"
+require "pathname"
+require "open-uri"
+require "openssl"
+require "net/http"
+require "uri"
+require "base64"
+require "time"
+require "socket"
+require "timeout"
+require_relative "setup-github"
+
+SCRIPT_DIR = File.dirname(File.expand_path(__FILE__))
+YATFA_VERSION = ENV["YATFA_VERSION"] || "main"
+YATFA_SCRIPTS_BASE_URL = "https://objectstore.fra1.civo.com/yatfa"
+YATFA_RAW_URL = "#{YATFA_SCRIPTS_BASE_URL}/#{YATFA_VERSION}"
+
+# Helper scripts installed into /usr/local/bin by setup_helper_scripts!
+# Single source of truth — deploy/deploy reads this list too.
+HELPER_SCRIPTS = %w[fetch-skill-variant.sh fetch-review-context.sh attach-screenshot.sh].freeze
+
+# Valid agent types
+VALID_AGENT_TYPES = %w[planner worker reviewer researcher claw]
+
+def check_env!
+  agent_type = ENV["AGENT_TYPE"]
+
+  # Note: claw agents have a separate entry point in setup-claw-agent.rb
+  # which calls check_env_claw! directly. This method only handles standard agent types.
+
+  required = %w[YATFA_URL]
+  missing = required.select { |var| ENV[var].to_s.empty? }
+  unless missing.empty?
+    puts "❌ Missing environment variables: #{missing.join(', ')}"
+    puts ""
+    puts "Required:"
+    puts "  YATFA_URL   - Yatfa platform URL (https://yatfa.example.com)"
+    puts ""
+    puts "Optional:"
+    puts "  YATFA_API_URL  - API URL for MCP tools (derived from YATFA_URL)"
+    puts "  YATFA_API_KEY  - MCP API key"
+    puts "  GH_TOKEN       - GitHub token"
+    exit 1
+  end
+
+  # Derive YATFA_API_URL and YATFA_WS_URL from YATFA_URL if not set
+  # IMPORTANT: Always use original YATFA_URL for derivations, not modified values
+  yatfa_url = ENV["YATFA_URL"]
+
+  # Derive YATFA_API_URL: append /api/v1 if not already present
+  unless ENV["YATFA_API_URL"]
+    if yatfa_url.end_with?("/api/v1") || yatfa_url.end_with?("/api/")
+      ENV["YATFA_API_URL"] = yatfa_url
+    else
+      ENV["YATFA_API_URL"] = "#{yatfa_url}/api/v1"
+    end
+    puts "📡 Derived YATFA_API_URL: #{ENV['YATFA_API_URL']}"
+  end
+
+  # Derive YATFA_WS_URL: replace protocol with ws/wss and add /cable endpoint
+  # IMPORTANT: Use original yatfa_url before any modifications
+  original_yatfa_url = ENV["YATFA_URL"]
+  unless ENV["YATFA_WS_URL"]
+    ENV["YATFA_WS_URL"] = "#{original_yatfa_url.sub(/^https:\/\//, 'wss://').sub(/^http:\/\//, 'ws://')}/cable"
+    puts "📡 Derived YATFA_WS_URL: #{ENV['YATFA_WS_URL']}"
+  end
+
+  agent_type = ENV["AGENT_TYPE"]
+  if agent_type && !VALID_AGENT_TYPES.include?(agent_type)
+    puts "❌ Invalid AGENT_TYPE: #{agent_type}"
+    puts "   Valid types: #{VALID_AGENT_TYPES.join(', ')}"
+    exit 1
+  end
+end
+
+def fetch_agent_id!
+  rails_api_url = ENV["YATFA_API_URL"]
+  rails_api_key = ENV["YATFA_API_KEY"]
+
+  unless rails_api_url && !rails_api_url.empty? && rails_api_key && !rails_api_key.empty?
+    puts "❌ YATFA_API_URL or YATFA_API_KEY not set"
+    puts "   Agent ID is required for the bridge to connect"
+    exit 1
+  end
+
+  # Determine agent version for reporting to backend
+  agent_version = nil
+  begin
+    version_url = "#{YATFA_RAW_URL}/VERSION"
+    agent_version = URI.open(version_url).read.strip
+    puts "   (version from remote: #{version_url})"
+  rescue OpenURI::HTTPError, Errno::ENOENT => e
+    puts "   ⚠️  Could not fetch VERSION: #{e.message}"
+  end
+
+  # Fetch agent ID from Rails API using api_key
+  whoami_url = "#{rails_api_url}/whoami"
+  whoami_url += "?version=#{URI.encode_www_form_component(agent_version)}" if agent_version && !agent_version.empty?
+
+  uri = URI(whoami_url)
+  http = Net::HTTP.new(uri.host, uri.port)
+  http.use_ssl = uri.scheme == "https"
+
+  request = Net::HTTP::Get.new(uri)
+  request["X-API-Key"] = rails_api_key
+  request["Accept"] = "application/json"
+  
+  begin
+    puts "🔍 Fetching agent ID from #{rails_api_url}/whoami..."
+    response = http.request(request)
+    
+    if response.is_a?(Net::HTTPSuccess)
+      data = JSON.parse(response.body)
+      agent_id = data["agent_id"] || data["id"]
+      
+      if agent_id && !agent_id.to_s.empty?
+        ENV["AGENT_ID"] = agent_id.to_s
+        puts "✅ Agent ID fetched: #{agent_id}"
+      else
+        puts "❌ Could not find agent_id in API response"
+        puts "   Response: #{response.body}"
+        exit 1
+      end
+    else
+      puts "❌ Failed to fetch agent ID: #{response.code} #{response.message}"
+      puts "   Response: #{response.body}"
+      exit 1
+    end
+  rescue => e
+    puts "❌ Error fetching agent ID: #{e.message}"
+    puts "   #{e.class}: #{e.backtrace.first}"
+    exit 1
+  end
+end
+
+def setup_mcp_config!
+  # MCP config is project-specific and should be provided by the Dockerfile
+  # or mounted at runtime. This script only checks if it exists.
+  
+  agent_type = ENV["AGENT_TYPE"]
+  rails_api_url = ENV["YATFA_API_URL"]
+  rails_api_key = ENV["YATFA_API_KEY"]
+  
+  # Load existing config if present
+  existing_config = {}
+  if File.exist?(".mcp.json")
+    begin
+      existing_config = JSON.parse(File.read(".mcp.json"))
+      puts "✅ Found existing .mcp.json, merging configuration..."
+    rescue JSON::ParserError
+      puts "⚠️  Existing .mcp.json is invalid, starting fresh"
+    end
+  end
+  
+  # Ensure mcpServers key exists
+  existing_config["mcpServers"] ||= {}
+
+  if rails_api_url && !rails_api_url.empty? && rails_api_key && !rails_api_key.empty?
+    # Install yatfa-mcp locally to ensure we can run it with node (bypassing shebang issues)
+    tools_dir = File.expand_path("~/yatfa-tools")
+    FileUtils.mkdir_p(tools_dir)
+    
+    puts "📦 Installing yatfa-mcp..."
+    # Redirect output to avoid cluttering logs, unless it fails
+    unless system("npm install --prefix #{tools_dir} yatfa-mcp > /dev/null 2>&1")
+      puts "❌ Failed to install yatfa-mcp"
+    end
+    
+    script_path = "#{tools_dir}/node_modules/yatfa-mcp/dist/index.js"
+
+    yatfa_server_config = {
+      "command" => "node",
+      "args" => [script_path],
+      "env" => {
+        "YATFA_API_URL" => rails_api_url,
+        "YATFA_API_KEY" => rails_api_key
+      }
+    }
+    
+    # Add/Update yatfa server config
+    existing_config["mcpServers"]["yatfa-#{agent_type}"] = yatfa_server_config
+    
+    File.write(".mcp.json", JSON.pretty_generate(existing_config))
+    puts "📝 Updated .mcp.json with yatfa-#{agent_type} server (using yatfa-mcp)"
+  else
+    # Only write if we don't have existing config
+    if existing_config["mcpServers"].empty?
+      File.write(".mcp.json", JSON.generate({ "mcpServers" => {} }))
+      puts "ℹ️  No MCP API credentials - MCP tools disabled"
+    else
+      puts "ℹ️  No MCP API credentials - keeping existing config"
+    end
+  end
+end
+
+def setup_claude_config!
+  home_claude_json = File.expand_path("~/.claude.json")
+
+  # BYOK: No longer depends on host's claude.json
+  # Create minimal config with bypass permissions and workspace trust
+  claude_config = {}
+  claude_config["bypassPermissionsModeAccepted"] = true
+  claude_config["hasCompletedOnboarding"] = true
+
+  # Set up workspace project with trust accepted
+  claude_config["projects"] ||= {}
+  claude_config["projects"]["/workspace"] = {
+    "hasTrustDialogAccepted" => true,
+    "projectOnboardingSeenCount" => 1
+  }
+
+  File.write(home_claude_json, JSON.pretty_generate(claude_config))
+  puts "✅ Created minimal claude.json with bypass permissions and workspace trust"
+end
+
+def fetch_llm_credentials!
+  rails_api_url = ENV["YATFA_API_URL"]
+  rails_api_key = ENV["YATFA_API_KEY"]
+
+  unless rails_api_url && !rails_api_url.empty? && rails_api_key && !rails_api_key.empty?
+    puts "❌ YATFA_API_URL or YATFA_API_KEY not set"
+    return nil
+  end
+
+  # Fetch LLM credentials from Rails API
+  uri = URI("#{rails_api_url}/llm/credentials")
+  http = Net::HTTP.new(uri.host, uri.port)
+  http.use_ssl = uri.scheme == "https"
+  http.open_timeout = 10
+  http.read_timeout = 10
+
+  request = Net::HTTP::Get.new(uri)
+  request["X-API-Key"] = rails_api_key
+  request["Accept"] = "application/json"
+
+  begin
+    puts "🔍 Fetching LLM credentials from #{rails_api_url}/llm/credentials..."
+    response = http.request(request)
+
+    if response.is_a?(Net::HTTPSuccess)
+      data = JSON.parse(response.body)
+      puts "✅ LLM credentials fetched successfully"
+      data
+    elsif response.is_a?(Net::HTTPNotFound)
+      puts "❌ No LLM credentials configured in backend"
+      nil
+    else
+      puts "❌ Failed to fetch LLM credentials: #{response.code} #{response.message}"
+      puts "   Response: #{response.body}"
+      nil
+    end
+  rescue Net::OpenTimeout, Net::ReadTimeout => e
+    puts "❌ Timeout fetching LLM credentials: #{e.message}"
+    nil
+  rescue => e
+    puts "❌ Error fetching LLM credentials: #{e.message}"
+    nil
+  end
+end
+
+def setup_claude_settings!
+  settings_dir = File.expand_path("~/.claude")
+  FileUtils.mkdir_p(settings_dir)
+  home_settings_json = File.join(settings_dir, "settings.json")
+
+  puts "🔧 Configuring ~/.claude/settings.json..."
+
+  settings_config = {}
+
+  # Fetch LLM credentials from Rails backend (BYOK support)
+  llm_credentials = fetch_llm_credentials!
+
+  if llm_credentials
+    puts "✅ Fetched LLM credentials from backend (source: #{llm_credentials['source']})"
+
+    # Configure Claude CLI with LLM provider environment variables
+    settings_config["env"] ||= {}
+    settings_config["env"]["ANTHROPIC_AUTH_TOKEN"] = llm_credentials["api_key"]
+
+    if llm_credentials["base_url"] && !llm_credentials["base_url"].empty?
+      settings_config["env"]["ANTHROPIC_BASE_URL"] = llm_credentials["base_url"]
+      puts "   Custom base URL: #{llm_credentials['base_url']}"
+    else
+      settings_config["env"].delete("ANTHROPIC_BASE_URL") if settings_config["env"]["ANTHROPIC_BASE_URL"]
+      puts "   Using default Anthropic base URL"
+    end
+
+    # Configure model selection if specified
+    # Each model tier can be configured independently
+    if llm_credentials["model_haiku"] && !llm_credentials["model_haiku"].empty?
+      settings_config["env"]["ANTHROPIC_DEFAULT_HAIKU_MODEL"] = llm_credentials["model_haiku"]
+      puts "   Haiku model: #{llm_credentials['model_haiku']}"
+    end
+
+    if llm_credentials["model_sonnet"] && !llm_credentials["model_sonnet"].empty?
+      settings_config["env"]["ANTHROPIC_DEFAULT_SONNET_MODEL"] = llm_credentials["model_sonnet"]
+      puts "   Sonnet model: #{llm_credentials['model_sonnet']}"
+    end
+
+    if llm_credentials["model_opus"] && !llm_credentials["model_opus"].empty?
+      settings_config["env"]["ANTHROPIC_DEFAULT_OPUS_MODEL"] = llm_credentials["model_opus"]
+      puts "   Opus model: #{llm_credentials['model_opus']}"
+    end
+
+    if !llm_credentials["model_haiku"] && !llm_credentials["model_sonnet"] && !llm_credentials["model_opus"]
+      puts "   Using default Anthropic models"
+    end
+  else
+    puts "❌ No LLM credentials found in backend!"
+    puts "   Please configure LLM API key for this agent or its project in the Yatfa dashboard."
+    puts "   Agent will fail to start without credentials."
+    exit 1
+  end
+
+  # No settings loaded from host - agent is fully self-contained
+
+  # Configure hooks
+  settings_config["hooks"] ||= {}
+  
+  
+  # Configure SessionStart hook for skill knowledge injection
+  settings_config["hooks"]["SessionStart"] ||= []
+  # Remove old hook if present
+  settings_config["hooks"]["SessionStart"].reject! do |h| 
+    h["hooks"]&.first&.dig("command")&.include?("inject-skill-knowledge.rb")
+  end
+
+  # Install hook script to ~/.claude/hooks
+  hooks_dir = File.join(settings_dir, "hooks")
+  FileUtils.mkdir_p(hooks_dir)
+  
+  session_script_name = "inject-skill-knowledge.rb"
+  dest_path = download_file(
+    script_name: session_script_name,
+    remote_url: "#{YATFA_RAW_URL}/hooks/#{session_script_name}",
+    dest_dir: hooks_dir,
+    label: "SessionStart hook"
+  )
+
+  if dest_path
+    session_hook_to_add = {
+      "hooks" => [{ "type" => "command", "command" => "ruby \"#{dest_path}\"" }]
+    }
+    settings_config["hooks"]["SessionStart"] << session_hook_to_add
+  else
+    puts "⚠️ Skipping SessionStart hook configuration (download failed)"
+  end
+
+  # Install sessionstart-input.sh for repository context injection
+  # This provides repository information to Claude at session start
+  input_script_name = "sessionstart-input.sh"
+  download_file(
+    script_name: input_script_name,
+    remote_url: "#{YATFA_RAW_URL}/hooks/#{input_script_name}",
+    dest_dir: hooks_dir,
+    label: "SessionStart input hook"
+  )
+
+  # Add agent-specific settings
+  settings_config["skipDangerousModePermissionPrompt"] = true
+
+  # Configure Stop hook for session-end learning capture
+  settings_config["hooks"]["Stop"] ||= []
+  # Remove old hook if present
+  settings_config["hooks"]["Stop"].reject! do |h|
+    h["hooks"]&.first&.dig("command")&.include?("sessionend-output.sh")
+  end
+
+  # Install session-end hook script
+  sessionend_script_name = "sessionend-output.sh"
+  sessionend_dest_path = download_file(
+    script_name: sessionend_script_name,
+    remote_url: "#{YATFA_RAW_URL}/hooks/#{sessionend_script_name}",
+    dest_dir: hooks_dir,
+    label: "Stop hook"
+  )
+
+  if sessionend_dest_path
+    sessionend_hook_to_add = {
+      "hooks" => [{ "type" => "command", "command" => "bash \"#{sessionend_dest_path}\"" }]
+    }
+    settings_config["hooks"]["Stop"] << sessionend_hook_to_add
+  else
+    puts "⚠️ Skipping Stop hook configuration (download failed)"
+  end
+
+  # Download and register project hooks wrapper
+  # The wrapper fetches user-defined hooks from the API at runtime (with caching),
+  # executes them, and reports results back for observability.
+  setup_project_hooks_wrapper!(settings_config, hooks_dir)
+
+  File.write(home_settings_json, JSON.pretty_generate(settings_config))
+  puts "✅ ~/.claude/settings.json configured with skill hooks"
+end
+
+# Download and register the project hooks wrapper as a SessionStart hook.
+# The wrapper handles fetching user-defined hooks from the API at runtime,
+# executing them, and reporting results. Hook content is managed by users
+# via the Yatfa config UI and stored as ProjectConfig records.
+def setup_project_hooks_wrapper!(settings_config, hooks_dir)
+  wrapper_path = download_file(
+    script_name: "project-hooks-wrapper.rb",
+    remote_url: "#{YATFA_RAW_URL}/hooks/project-hooks-wrapper.rb",
+    dest_dir: hooks_dir,
+    label: "Project hooks wrapper"
+  )
+
+  if wrapper_path
+    settings_config["hooks"]["SessionStart"] << {
+      "hooks" => [{ "type" => "command", "command" => "ruby \"#{wrapper_path}\"" }]
+    }
+    puts "✅ Registered project hooks wrapper"
+  else
+    puts "⚠️  Skipping project hooks wrapper (download failed)"
+  end
+end
+
+def setup_system_prompt!
+  agent_type = ENV["AGENT_TYPE"]
+  system_prompt_path = File.expand_path("~/.yatfa/system-prompt.txt")
+
+  # Download agents.rb from remote
+  agents_rb_url = "#{YATFA_RAW_URL}/agents.rb"
+  puts "📥 Downloading agents.rb from #{agents_rb_url}..."
+  agents_rb_content = nil
+  begin
+    agents_rb_content = URI.open(agents_rb_url).read
+    puts "✅ Downloaded agents.rb"
+  rescue OpenURI::HTTPError => e
+    puts "❌ Failed to download agents.rb: #{e.message}"
+    puts "   Cannot generate system prompt without agent definitions"
+    exit 1
+  end
+
+  # Evaluate agents.rb to get AGENT_CONFIGS
+  agents_binding = binding
+  begin
+    agents_binding.eval(agents_rb_content, "agents.rb")
+  rescue => e
+    puts "❌ Failed to evaluate agents.rb: #{e.message}"
+    exit 1
+  end
+
+  agent_configs = agents_binding.eval("AGENT_CONFIGS")
+
+  unless agent_configs && agent_configs[agent_type]
+    puts "❌ Unknown agent type: #{agent_type}"
+    puts "   Available: #{agent_configs.keys.join(', ')}"
+    exit 1
+  end
+
+  agent_def = agent_configs[agent_type]
+  banner_content = agent_def[:banner].dup
+
+  # Append repository context from REPOSITORIES_CONTEXT env var
+  if ENV["REPOSITORIES_CONTEXT"] && !ENV["REPOSITORIES_CONTEXT"].empty?
+    repos = ENV["REPOSITORIES_CONTEXT"].split(',').map do |repo|
+      name, path = repo.split(':')
+      { name: name, path: path || "/workspace/#{name}" }
+    end
+
+    repo_info = repos.map { |r| "  - **#{r[:name]}**: #{r[:path]}" }.join("\n")
+
+    banner_content += "\n\n## REPOSITORY STRUCTURE\n\n"
+    banner_content += "This project has #{repos.count} repositories:\n\n"
+    banner_content += "#{repo_info}\n\n"
+  end
+
+  # Ensure directory exists and write system prompt
+  FileUtils.mkdir_p(File.dirname(system_prompt_path))
+  File.write(system_prompt_path, banner_content)
+  puts "✅ System prompt generated at #{system_prompt_path} (agent: #{agent_type})"
+
+  # Add repository context to CLAUDE.md for easy reference
+  claude_md = File.expand_path("~/CLAUDE.md")
+  if ENV["REPOSITORIES_CONTEXT"] && !ENV["REPOSITORIES_CONTEXT"].empty?
+    repo_info = ENV["REPOSITORIES_CONTEXT"].split(',').map do |repo|
+      name, path = repo.split(':')
+      "  - **#{name}**: #{path}"
+    end.join("\n")
+
+    repo_context_md = <<~MARKDOWN
+      ## Repository Structure
+
+      This project has #{ENV["REPOSITORIES_CONTEXT"].split(',').count} repositories:
+
+      #{repo_info}
+    MARKDOWN
+
+    # Append to existing CLAUDE.md or create new one
+    existing_content = File.exist?(claude_md) ? File.read(claude_md) : ""
+    File.write(claude_md, existing_content + "\n" + repo_context_md)
+    puts "📝 Repository context added to ~/CLAUDE.md"
+  end
+end
+
+
+def setup_skills!
+  skills = ENV["SKILLS"].to_s.split(",")
+  return if skills.empty?
+
+  skills_dir = File.expand_path("~/.claude/skills")
+  puts "🧠 Installing #{skills.size} skills to #{skills_dir}..."
+  FileUtils.mkdir_p(skills_dir)
+
+  skills.each do |skill|
+    puts "   - #{skill}"
+
+    url = "#{YATFA_RAW_URL}/skills/#{skill}/SKILL.md"
+
+    begin
+      skill_content = URI.open(url).read
+      puts "     (from remote: #{url})"
+
+      # Write to .claude/skills/[skill]/SKILL.md with proper structure
+      skill_dir = File.join(skills_dir, skill)
+      FileUtils.mkdir_p(skill_dir)
+      File.write(File.join(skill_dir, "SKILL.md"), skill_content)
+    rescue OpenURI::HTTPError, Errno::ENOENT => e
+      puts "⚠️  Failed to download skill #{skill}: #{e.message}"
+    end
+  end
+
+  puts "✅ Skills installed"
+end
+
+# Community skill source registry
+# Maps skill name to its download source configuration
+COMMUNITY_SKILL_SOURCES = {
+  "ui-ux-pro-max" => {
+    github_repo: "nextlevelbuilder/ui-ux-pro-max-skill",
+    skill_path: ".claude/skills/ui-ux-pro-max/SKILL.md"
+  }
+}.freeze
+
+# Fetch community skills assigned to this agent from the backend API
+def fetch_community_skills!
+  rails_api_url = ENV["YATFA_API_URL"]
+  rails_api_key = ENV["YATFA_API_KEY"]
+
+  unless rails_api_url && !rails_api_url.empty? && rails_api_key && !rails_api_key.empty?
+    puts "⚠️  Cannot fetch community skills: API URL or key not set"
+    return []
+  end
+
+  uri = URI("#{rails_api_url}/whoami")
+  http = Net::HTTP.new(uri.host, uri.port)
+  http.use_ssl = uri.scheme == "https"
+
+  request = Net::HTTP::Get.new(uri)
+  request["X-API-Key"] = rails_api_key
+  request["Accept"] = "application/json"
+
+  begin
+    response = http.request(request)
+    if response.is_a?(Net::HTTPSuccess)
+      data = JSON.parse(response.body)
+      skills = data["community_skills"] || []
+      if skills.any?
+        puts "📦 Found #{skills.size} community skills: #{skills.join(', ')}"
+      end
+      skills
+    else
+      puts "⚠️  Could not fetch community skills: #{response.code}"
+      []
+    end
+  rescue => e
+    puts "⚠️  Error fetching community skills: #{e.message}"
+    []
+  end
+end
+
+# Install community skills from external sources (e.g., GitHub repos)
+def setup_community_skills!
+  # Community skills can come from two sources:
+  # 1. COMMUNITY_SKILLS env var (set during container creation from agent config)
+  # 2. Fetched from the backend API (whoami response)
+  env_skills = ENV["COMMUNITY_SKILLS"].to_s.split(",").map(&:strip).reject(&:blank?)
+  api_skills = fetch_community_skills!
+  community_skills = (env_skills + api_skills).uniq
+
+  return if community_skills.empty?
+
+  skills_dir = File.expand_path("~/.claude/skills")
+  puts "🌐 Installing #{community_skills.size} community skills..."
+  FileUtils.mkdir_p(skills_dir)
+
+  community_skills.each do |skill_name|
+    puts "   - #{skill_name}"
+
+    source = COMMUNITY_SKILL_SOURCES[skill_name]
+    unless source
+      puts "⚠️  Unknown community skill: #{skill_name} (no source configured)"
+      next
+    end
+
+    begin
+      # Download SKILL.md from GitHub raw URL
+      github_repo = source[:github_repo]
+      skill_path = source[:skill_path] || ".claude/skills/#{skill_name}/SKILL.md"
+      url = "https://raw.githubusercontent.com/#{github_repo}/main/#{skill_path}"
+
+      skill_content = URI.open(url, open_timeout: 15, read_timeout: 30).read
+      puts "     (from GitHub: #{github_repo})"
+
+      # Write to .claude/skills/[skill_name]/SKILL.md
+      skill_dir = File.join(skills_dir, skill_name)
+      FileUtils.mkdir_p(skill_dir)
+      File.write(File.join(skill_dir, "SKILL.md"), skill_content)
+    rescue OpenURI::HTTPError, Errno::ENOENT => e
+      puts "⚠️  Failed to download community skill #{skill_name}: #{e.message}"
+    rescue => e
+      puts "⚠️  Error installing community skill #{skill_name}: #{e.message}"
+    end
+  end
+
+  puts "✅ Community skills installed"
+end
+
+def clone_repositories!
+  return unless ENV["REPOSITORIES_CONFIG"]
+
+  begin
+    repos = JSON.parse(ENV["REPOSITORIES_CONFIG"])
+    return unless repos.is_a?(Array) && repos.any?
+
+    puts "📚 Cloning #{repos.count} repositories..."
+
+    repos.each do |repo|
+      repo_name = repo["name"]
+      github_url = repo["github_url"]
+      sandbox_path = repo["path_in_sandbox"] || "/workspace/#{repo_name}"
+
+      # Create parent directory if needed
+      parent_dir = File.dirname(sandbox_path)
+      FileUtils.mkdir_p(parent_dir) unless File.exist?(parent_dir)
+
+      # Clone repository if it doesn't exist
+      # Do NOT use --depth to allow full branch access for PR workflows
+      unless File.exist?(sandbox_path)
+        puts "   📥 Cloning #{repo_name} to #{sandbox_path}..."
+        clone_timeout = ENV.fetch("GIT_CLONE_TIMEOUT", "180").to_i
+        clone_success = begin
+          Timeout.timeout(clone_timeout) do
+            system("git", "clone", github_url, sandbox_path)
+          end
+        rescue Timeout::Error
+          # Kill orphan git clone subprocess (Timeout.timeout doesn't kill children)
+          system("pkill", "-f", "git clone #{github_url}", err: File::NULL)
+          # Clean up partial clone directory so restart doesn't skip it
+          FileUtils.rm_rf(sandbox_path) if File.exist?(sandbox_path)
+          puts "❌ git clone of #{repo_name} timed out after #{clone_timeout}s"
+          puts "   The container will restart automatically."
+          exit 1
+        end
+
+        unless clone_success
+          puts "❌ git clone of #{repo_name} failed"
+          puts "   The container will restart automatically."
+          exit 1
+        end
+      else
+        puts "   ✓ #{repo_name} already exists at #{sandbox_path}"
+        # Fetch all remotes to ensure branches are up to date
+        Dir.chdir(sandbox_path) do
+          system("git", "fetch", "--all")
+          puts "   ✓ Fetched all remotes for #{repo_name}"
+        end
+      end
+
+      # Add repository path to git safe.directory to avoid "dubious ownership" errors
+      system("git", "config", "--global", "--add", "safe.directory", sandbox_path)
+      puts "   ✓ Added #{sandbox_path} to git safe.directory"
+    end
+
+    puts "✅ Repositories cloned"
+
+    # Track if we have a single repository for later use
+    single_repo_name = repos.count == 1 ? repos.first['name'] : nil
+
+    # Write repository context to a file for hooks to read
+    # This is more reliable than environment variables in tmux sessions
+    if ENV["REPOSITORIES_CONTEXT"]
+      repo_context_file = File.expand_path("~/.claude/repos_context.txt")
+      File.write(repo_context_file, ENV["REPOSITORIES_CONTEXT"])
+      puts "📝 Repository context written to #{repo_context_file}"
+    end
+
+    # Export REPOSITORIES_CONTEXT to bash profile for shell sessions
+    if ENV["REPOSITORIES_CONTEXT"]
+      profile_file = File.expand_path("~/.bashrc")
+      existing_content = File.exist?(profile_file) ? File.read(profile_file) : ""
+
+      # Remove old export line if present
+      existing_content.gsub!(/^export REPOSITORIES_CONTEXT=.*$/, "")
+
+      # Add new export at the end
+      additions = "\nexport REPOSITORIES_CONTEXT=\"#{ENV['REPOSITORIES_CONTEXT']}\"\n"
+      File.write(profile_file, existing_content + additions)
+      puts "📝 REPOSITORIES_CONTEXT exported to ~/.bashrc"
+    end
+  rescue JSON::ParserError => e
+    puts "⚠️  Failed to parse REPOSITORIES_CONFIG: #{e.message}"
+  end
+end
+
+def setup_git_config!
+  # Configure identity if provided
+  if ENV["GIT_USER_NAME"] && !ENV["GIT_USER_NAME"].empty?
+    system("git config --global user.name \"#{ENV['GIT_USER_NAME']}\"")
+    puts "✅ Git user.name configured"
+  end
+
+  if ENV["GIT_USER_EMAIL"] && !ENV["GIT_USER_EMAIL"].empty?
+    system("git config --global user.email \"#{ENV['GIT_USER_EMAIL']}\"")
+    puts "✅ Git user.email configured"
+  end
+
+  # Force HTTPS instead of SSH to ensure our token auth works
+  # This fixes "Permission denied (publickey)" when the repo uses git@github.com remote
+  system("git config --global url.\"https://github.com/\".insteadOf \"git@github.com:\"")
+  puts "✅ Git configured to force HTTPS for GitHub"
+
+  # Avoid "dubious ownership" errors in containers
+  # Note: Individual repository paths are added in clone_repositories! after cloning
+  system("git config --global --add safe.directory \"#{Dir.pwd}\"")
+  puts "✅ Git configured to trust #{Dir.pwd}"
+end
+
+
+def setup_git_hooks!
+  # Install git hooks to encourage agents to use git-workflow skill
+  hooks_dest = File.join(Dir.pwd, ".git", "hooks")
+  return unless File.directory?(hooks_dest)
+
+  puts "🪝 Installing git hooks..."
+
+  url = "#{YATFA_RAW_URL}/hooks/pre-commit"
+  begin
+    hook_content = URI.open(url).read
+  rescue OpenURI::HTTPError => e
+    puts "⚠️  Failed to download pre-commit hook: #{e.message}"
+    return
+  end
+
+  hook_path = File.join(hooks_dest, "pre-commit")
+  File.write(hook_path, hook_content)
+  File.chmod(0755, hook_path)
+  puts "✅ Git hooks installed"
+end
+
+def download_agent_bridge!
+  # Detect architecture
+  arch = `uname -m`.strip
+  if arch == "x86_64"
+    arch = "amd64"
+  elsif arch == "aarch64" || arch == "arm64"
+    arch = "arm64"
+  else
+    puts "❌ Unsupported architecture: #{arch}"
+    exit 1
+  end
+
+  target_dir = "/usr/local/bin"
+
+  # 1. Check for local override in /tmp/overrides (development mode)
+  override_dir = "/tmp/overrides"
+  if Dir.exist?(override_dir)
+    local_override = File.join(override_dir, "agent-bridge-linux-#{arch}")
+    if File.exist?(local_override)
+      puts "🔧 Using local override: #{local_override}"
+      system("sudo cp #{local_override} #{target_dir}/agent-bridge")
+      system("sudo chmod +x #{target_dir}/agent-bridge")
+      puts "✅ agent-bridge installed from local override"
+      return download_agent_bridge_tmux!(target_dir)
+    end
+  end
+
+  # 2. Check if binaries are mounted at /tmp (dev mode)
+  if File.exist?("/tmp/agent-bridge")
+    puts "🔧 Installing mounted agent-bridge..."
+    system("sudo cp /tmp/agent-bridge #{target_dir}/agent-bridge")
+    system("sudo chmod +x #{target_dir}/agent-bridge")
+    puts "✅ agent-bridge installed from mount"
+    return download_agent_bridge_tmux!(target_dir)
+  end
+
+  # 3. Try Civo bucket download (production mode)
+  if ENV["CIVO_ACCESS_KEY_ID"] && ENV["CIVO_SECRET_KEY"]
+    puts "📥 Downloading agent-bridge from Civo bucket..."
+    if download_from_civo!(arch, target_dir)
+      return download_agent_bridge_tmux!(target_dir)
+    else
+      puts "⚠️  Civo download failed, falling back to GitHub..."
+    end
+  end
+
+  # 4. Fallback to GitHub raw URLs (legacy)
+  bridge_url = "#{YATFA_RAW_URL}/bin/agent-bridge-linux-#{arch}"
+  puts "📥 Downloading agent-bridge for linux-#{arch} from GitHub..."
+  system("sudo curl -fsSL #{bridge_url} -o #{target_dir}/agent-bridge")
+  system("sudo chmod +x #{target_dir}/agent-bridge")
+
+  puts "✅ agent-bridge installed to #{target_dir}"
+  download_agent_bridge_tmux!(target_dir)
+end
+
+def download_from_civo!(arch, target_dir)
+  require "aws-sdk-s3"
+
+  region = ENV["CIVO_REGION"] || "LON1"
+  endpoint = ENV["CIVO_ENDPOINT"] || "https://objectstore.fra1.civo.com"
+  bucket = ENV["YATFA_BINARIES_BUCKET"] || "yatfa"
+  version = ENV["AGENT_BRIDGE_VERSION"] || "latest"
+
+  binary_name = "agent-bridge-linux-#{arch}"
+  key = "agent-bridge/#{version}/#{binary_name}"
+
+  puts "   Region: #{region}"
+  puts "   Bucket: #{bucket}"
+  puts "   Version: #{version}"
+  puts "   Binary: #{binary_name}"
+
+  begin
+    # Configure Civo S3-compatible client
+    Aws.config.update({
+      region: region,
+      endpoint: endpoint,
+      access_key_id: ENV["CIVO_ACCESS_KEY_ID"],
+      secret_access_key: ENV["CIVO_SECRET_KEY"]
+    })
+
+    s3 = Aws::S3::Resource.new
+    obj = s3.bucket(bucket).object(key)
+
+    # Generate presigned URL (valid for 1 hour)
+    url = obj.presigned_url(:get, expires_in: 3600)
+
+    puts "✅ Generated presigned URL"
+
+    # Download via curl
+    system("sudo curl -fsSL #{url} -o #{target_dir}/agent-bridge")
+
+    unless $?.success?
+      puts "❌ Failed to download agent-bridge from Civo"
+      return false
+    end
+
+    system("sudo chmod +x #{target_dir}/agent-bridge")
+    puts "✅ Downloaded agent-bridge from Civo"
+    return true
+
+  rescue LoadError
+    puts "⚠️  aws-sdk-s3 gem not installed"
+    return false
+  rescue Aws::S3::Errors::NoSuchKey
+    puts "❌ Version #{version} not found in bucket"
+    return false
+  rescue => e
+    puts "❌ Civo download failed: #{e.message}"
+    return false
+  end
+end
+
+def download_agent_bridge_tmux!(target_dir)
+  bridge_tmux_url = "#{YATFA_RAW_URL}/bin/agent-bridge-tmux"
+
+  if File.exist?("/tmp/agent-bridge-tmux")
+    puts "🔧 Installing mounted agent-bridge-tmux..."
+    system("sudo cp /tmp/agent-bridge-tmux #{target_dir}/agent-bridge-tmux")
+    system("sudo chmod +x #{target_dir}/agent-bridge-tmux")
+  else
+    system("sudo curl -fsSL #{bridge_tmux_url} -o #{target_dir}/agent-bridge-tmux")
+    system("sudo chmod +x #{target_dir}/agent-bridge-tmux")
+  end
+  
+  # Patch agent-bridge-tmux to force INSIDE_TMUX=1
+  # Note: This is now fixed in the repo, but we keep this for backward compatibility
+  # with older agent-bridge-tmux scripts if cached
+  puts "🔧 Patching agent-bridge-tmux to force INSIDE_TMUX=1..."
+  
+  # Read the file (we can read /usr/local/bin files usually)
+  content = File.read("#{target_dir}/agent-bridge-tmux")
+  
+  # Replace the command if not already present
+  unless content.include?("export INSIDE_TMUX=1")
+    new_content = content.gsub(
+      "&& agent-bridge\"", 
+      "&& export INSIDE_TMUX=1 && agent-bridge\""
+    )
+    
+    # Write to temp file
+    File.write("/tmp/agent-bridge-tmux-patched", new_content)
+    
+    # Move to destination with sudo
+    system("sudo mv /tmp/agent-bridge-tmux-patched #{target_dir}/agent-bridge-tmux")
+    system("sudo chmod +x #{target_dir}/agent-bridge-tmux")
+  end
+  
+  return target_dir
+end
+
+def install_helper_script(bin_dir, script_name)
+  url = "#{YATFA_RAW_URL}/bin/#{script_name}"
+  begin
+    script_content = URI.open(url).read
+    puts "   (from remote: #{url})"
+  rescue OpenURI::HTTPError, Errno::ENOENT => e
+    puts "⚠️  Failed to download #{script_name}: #{e.message}"
+    return false
+  end
+
+  target = File.join(bin_dir, script_name)
+  temp_script = "/tmp/#{script_name}.temp"
+  File.write(temp_script, script_content)
+  system("sudo mv #{temp_script} #{target}")
+  system("sudo chmod +x #{target}")
+  puts "✅ Installed #{script_name} to #{bin_dir}"
+  true
+end
+
+# Download a file from remote URL to a destination directory
+# @param script_name [String] filename to download
+# @param remote_url [String] full URL to download from
+# @param dest_dir [String] directory to save into
+# @param executable [Boolean] whether to chmod 0755 (default: true)
+# @param label [String] human-readable label for log messages (default: script_name)
+# @return [String, nil] downloaded file path, or nil on failure
+def download_file(script_name:, remote_url:, dest_dir:, executable: true, label: nil)
+  label ||= script_name
+  dest_path = File.join(dest_dir, script_name)
+
+  puts "📥 Downloading #{label}..."
+  begin
+    content = URI.open(remote_url).read
+    File.write(dest_path, content)
+    File.chmod(0755, dest_path) if executable
+    puts "✅ Installed #{label} to #{dest_path}"
+    dest_path
+  rescue OpenURI::HTTPError => e
+    puts "⚠️  Failed to download #{label}: #{e.message}"
+    nil
+  end
+end
+
+def setup_helper_scripts!
+  # Install helper scripts that skills use for command injection
+  bin_dir = "/usr/local/bin"
+
+  puts "🛠️  Setting up helper scripts..."
+
+  HELPER_SCRIPTS.each do |script_name|
+    install_helper_script(bin_dir, script_name)
+  end
+end
+
+def run_agent!(bin_dir)
+  agent_type = ENV["AGENT_TYPE"] || "agent"
+  puts ""
+  puts "🚀 Starting #{agent_type}..."
+  puts "   Press Ctrl+B then D to detach from tmux"
+  puts ""
+
+  # Build environment variables to pass to agent-bridge-tmux
+  # IMPORTANT: Must pass YATFA_WS_URL, YATFA_API_URL, and YATFA_API_KEY for agent-bridge to connect
+  # Use system() with properly formatted command string
+  env_cmd = []
+  env_cmd << "AGENT_ID=#{ENV['AGENT_ID']}" if ENV["AGENT_ID"]
+  env_cmd << "YATFA_WS_URL=#{ENV['YATFA_WS_URL']}" if ENV["YATFA_WS_URL"]
+  env_cmd << "YATFA_API_URL=#{ENV['YATFA_API_URL']}" if ENV["YATFA_API_URL"]
+  env_cmd << "YATFA_API_KEY=#{ENV['YATFA_API_KEY']}" if ENV["YATFA_API_KEY"]
+
+  # Build the full command
+  full_cmd = env_cmd.join(" ") + " #{bin_dir}/agent-bridge-tmux"
+
+  # Debug: show what command we're running
+  puts "🔧 Debug: Running #{full_cmd}"
+  system(full_cmd)
+end
+
+# ─── Main ─────────────────────────────────────────────────────────────────
+
+# Main
+puts "🤖 Yatfa Agent Setup"
+puts "====================="
+puts ""
+
+# Claw agent has its own completely separate setup flow
+if ENV["AGENT_TYPE"] == "claw"
+  require_relative "setup-claw-agent"
+else
+  check_env!
+  fetch_agent_id!
+  setup_mcp_config!
+  setup_system_prompt!
+  # Clone repositories BEFORE setting up hooks that depend on them
+  setup_github_auth!
+  setup_git_config!
+  clone_repositories!
+  setup_claude_config!
+  setup_claude_settings!
+  # setup_skill_hooks! # Deprecated in favor of global hooks
+  setup_skills!
+  setup_community_skills!
+  setup_git_hooks!
+  setup_helper_scripts!
+  # prepare_git_state! is now in entrypoint.sh
+  bin_dir = download_agent_bridge!
+  run_agent!(bin_dir)
+end