yatfa 1.0.95 → 1.0.97

package/bin/install-agent.sh

@@ -101,7 +101,7 @@ YATFA_VERSION=${YATFA_VERSION:-main}
 cat << 'EOF' > /usr/local/bin/setup-agent
 #!/bin/bash
 YATFA_VERSION=${YATFA_VERSION:-main}
-BASE_URL="https://objectstore.fra1.civo.com/yatfa/${YATFA_VERSION}"
+BASE_URL="https://pub-06ce56b9a9c143118036f593f07ac1d8.r2.dev/${YATFA_VERSION}"
 # Use local setup/ dir if mounted (dev mode), otherwise download all from remote
 if [ -f "/tmp/setup/setup-agent.rb" ]; then
   echo "🔧 Using local setup/ (dev mode)"

package/lib/yatfa_agent/config.rb

@@ -1,10 +1,15 @@
 # frozen_string_literal: true
 
 require "json"
+require "digest"
 require_relative "http"
 
 module YatfaAgent
   module Config
+    # Image name returned when the project's Dockerfile.sandbox is not present
+    # (e.g. image_name queried before the file is materialized, or offline).
+    DEFAULT_IMAGE_NAME = "yatfa-sandbox"
+    DOCKERFILE_SANDBOX = "Dockerfile.sandbox"
     # Walk up the directory tree from +start_dir+ (default: Dir.pwd)
     # looking for yatfa.env.rb. Returns the directory containing the
     # config file, or nil if not found.
@@ -104,22 +109,27 @@ module YatfaAgent
       "#{api_base.sub(/^https:\/\//, "wss://").sub(/^http:\/\//, "ws://")}/cable"
     end
 
+    # Extract the first available agent MCP API key from the config.
+    # Returns nil when no key is configured.
+    def self.agent_api_key(config)
+      agents = config["agents"]
+      return nil unless agents.is_a?(Hash)
+
+      agents.each_value do |agent_config|
+        return agent_config["mcp_api_key"] if agent_config.is_a?(Hash) && agent_config["mcp_api_key"]
+      end
+
+      nil
+    end
+
     def self.fetch_repositories!(config)
       # Support both old and new config keys
       api_base = api_url(config)
 
       return unless api_base
 
-      # Use to first available agent's MCP API key
-      mcp_api_key = nil
-      if config["agents"].is_a?(Hash)
-        config["agents"].each do |_, agent_config|
-          if agent_config.is_a?(Hash) && agent_config["mcp_api_key"]
-            mcp_api_key = agent_config["mcp_api_key"]
-            break
-          end
-        end
-      end
+      # Use the first available agent's MCP API key
+      mcp_api_key = agent_api_key(config)
 
       return unless mcp_api_key
 
@@ -146,6 +156,10 @@ module YatfaAgent
       project_id = agent_info["project_id"]
       project_name = agent_info["name"] rescue "unknown"
 
+      # Expose the resolved project id so downstream steps can scope per-project
+      # resources (image tag, dockerfile_sandbox fetch) without another round-trip.
+      config["project_id"] = project_id if project_id
+
       puts "🔑 Authenticated as #{agent_info["name"]} (project #{project_id})"
 
       # Then fetch repositories from Rails API (scoped to our project)
@@ -176,8 +190,20 @@ module YatfaAgent
       end
     end
 
+    # Per-project Docker image tag so concurrent projects on one host don't
+    # clobber the shared "yatfa-sandbox" tag.
+    #
+    # The tag is derived from a digest of the project's Dockerfile.sandbox
+    # content: projects with an identical dockerfile share one image (no
+    # redundant rebuilds), while projects with different dockerfiles build to
+    # distinct tags and never overwrite each other. Falls back to
+    # +DEFAULT_IMAGE_NAME+ when no Dockerfile.sandbox is present (e.g. the tag
+    # is queried before the file is materialized, or while running offline).
     def self.image_name(config)
-      "yatfa-sandbox"
+      content = File.exist?(DOCKERFILE_SANDBOX) ? File.read(DOCKERFILE_SANDBOX) : nil
+      return DEFAULT_IMAGE_NAME if content.nil? || content.empty?
+
+      "yatfa-sandbox-#{Digest::SHA256.hexdigest(content)[0, 16]}"
     end
   end
 end

package/lib/yatfa_agent/docker.rb

@@ -4,22 +4,74 @@ require "fileutils"
 require "json"
 require "time"
 require_relative "http"
+require_relative "config"
 
 module YatfaAgent
   module Docker
     STAMP_FILE = ".yatfa-build-stamp"
-    VERSION_URL = "https://objectstore.fra1.civo.com/yatfa/main/version.json"
-
-    def self.check_dockerfile!
-      unless File.exist?("Dockerfile.sandbox")
-        puts "❌ Error: Dockerfile.sandbox not found"
-        puts ""
-        puts "Please create Dockerfile.sandbox by copying your existing Dockerfile"
-        puts "and adding the required agent dependencies."
-        puts ""
-        puts "See https://github.com/RoM4iK/yatfa-public/blob/main/README.md for instructions."
-        exit 1
+    VERSION_URL = "https://pub-06ce56b9a9c143118036f593f07ac1d8.r2.dev/main/version.json"
+    DOCKERFILE_NAME = "Dockerfile.sandbox"
+
+    # Ensure a Dockerfile.sandbox is available for the build.
+    #
+    # A local ./Dockerfile.sandbox always wins (override semantics — we never
+    # silently overwrite a file the user placed). When no local file is present,
+    # we try to materialize one from the project's active
+    # `dockerfile_sandbox/default` ProjectConfig via the API, using the agent's
+    # existing API key. If neither is available, we exit with a clear, actionable
+    # error instead of a stack trace.
+    #
+    # @param config [Hash] the loaded yatfa.env.rb config (carries yatfa_url,
+    #   project_id, and the agent mcp_api_key needed to scope the request)
+    def self.check_dockerfile!(config = {})
+      return if File.exist?(DOCKERFILE_NAME)
+
+      fetched = fetch_remote_dockerfile(config)
+      if fetched
+        File.write(DOCKERFILE_NAME, fetched)
+        puts "📥 Wrote Dockerfile.sandbox from project config (dockerfile_sandbox/default)"
+        return
       end
+
+      puts "❌ Error: Dockerfile.sandbox not found"
+      puts ""
+      puts "No local Dockerfile.sandbox and no active 'dockerfile_sandbox' project config"
+      puts "was found. Provide one of:"
+      puts "  • a local ./Dockerfile.sandbox, OR"
+      puts "  • a 'dockerfile_sandbox' config in your project (Project Configurations UI / API)"
+      puts ""
+      puts "See https://github.com/RoM4iK/yatfa-public/blob/main/README.md for instructions."
+      exit 1
+    end
+
+    # Fetch the project's active dockerfile_sandbox/default config content.
+    # Returns the dockerfile content [String], or nil when the project cannot
+    # be identified, the API is unreachable, or no such config is stored.
+    # Never raises — a missing remote config is a normal "fall back to error" case.
+    def self.fetch_remote_dockerfile(config)
+      api_base = Config.api_url(config)
+      project_id = config["project_id"]
+      api_key = Config.agent_api_key(config)
+
+      return nil if api_base.nil? || api_base.to_s.empty?
+      return nil if project_id.nil? || project_id.to_s.empty?
+      return nil if api_key.nil? || api_key.to_s.empty?
+
+      url = "#{api_base}/projects/#{project_id}/configs/dockerfile_sandbox/default"
+      auth_headers = { "X-API-Key" => api_key, "Accept" => "application/json" }
+
+      data = YatfaAgent::HTTP.get(url, headers: auth_headers)
+      return nil unless data.is_a?(Hash)
+
+      content = data["content"]
+      content.nil? || content.to_s.empty? ? nil : content.to_s
+    rescue YatfaAgent::HTTP::Error => e
+      # 404 just means no dockerfile_sandbox config is stored — not an error.
+      warn "⚠️  No dockerfile_sandbox config fetched (HTTP #{e.status_code})" unless e.status_code == 404
+      nil
+    rescue StandardError => e
+      warn "⚠️  Failed to fetch dockerfile_sandbox config (#{e.class}: #{e.message})"
+      nil
     end
 
     def self.fetch_remote_version
@@ -48,7 +100,7 @@ module YatfaAgent
     end
 
     def self.build_image(config)
-      check_dockerfile!
+      check_dockerfile!(config)
 
       user_id = `id -u`.strip
       group_id = `id -g`.strip

package/lib/yatfa_agent/setup.rb

@@ -524,12 +524,12 @@ module YatfaAgent
           ARG GROUP_ID=1000
 
           # Cache busting: only rebuilds when install-agent.sh infrastructure changes
-          ADD https://objectstore.fra1.civo.com/yatfa/${YATFA_VERSION}/version.json /tmp/yatfa_version.json
+          ADD https://pub-06ce56b9a9c143118036f593f07ac1d8.r2.dev/${YATFA_VERSION}/version.json /tmp/yatfa_version.json
 
           # Install YATFA agent infrastructure
           # This layer is cached unless install-agent.sh changes (detected via version.json above)
           # setup-agent.rb, skills, and hooks download fresh on every container startup
-          RUN curl -fsSL https://objectstore.fra1.civo.com/yatfa/${YATFA_VERSION}/bin/install-agent.sh | bash
+          RUN curl -fsSL https://pub-06ce56b9a9c143118036f593f07ac1d8.r2.dev/${YATFA_VERSION}/bin/install-agent.sh | bash
 
           # Ensure /workspace is owned by agent user and writable
           # The install-agent.sh script creates a user with USER_ID, so we use that ID directly
@@ -561,10 +561,8 @@ module YatfaAgent
         puts "  1. Ensure 'yatfa.env.rb' is in .gitignore:"
         puts "     echo 'yatfa.env.rb' >> .gitignore"
         puts ""
-        puts "  2. Build the sandbox Docker image:"
-        puts "     docker build -f Dockerfile.sandbox -t yatfa-sandbox ."
-        puts ""
-        puts "  3. Start an agent:"
+        puts "  2. Start an agent (the sandbox image builds automatically on first run,"
+        puts "     tagged from your Dockerfile.sandbox):"
         if @config[:agents].key?(:worker)
           puts "     npx yatfa worker"
         elsif @config[:agents].key?(:planner)

package/lib/yatfa_agent/updater.rb

@@ -2,6 +2,8 @@
 
 require "json"
 require "time"
+require_relative "config"
+require_relative "docker"
 
 module YatfaAgent
   module Updater
@@ -130,17 +132,23 @@ module YatfaAgent
         #    Both Config.load and Docker.build_image call exit(1) on failure,
         #    which SystemExit catches here (not caught by rescue StandardError).
         puts "   Building fresh image..."
+        fresh_image = nil
         begin
           project_root = find_project_root_for_container(config)
           if project_root && Dir.exist?(project_root)
             Dir.chdir(project_root) do
               docker_config = load_config_for_container(project_root)
               Docker.build_image(docker_config)
+              # Resolve the tag while still inside the project root so the
+              # freshly built image (not the stale one baked into the old
+              # container) is used to recreate it.
+              fresh_image = Config.image_name(docker_config)
             end
           else
             puts "   ⚠️  Could not find project root, attempting build in cwd"
             docker_config = Config.load
             Docker.build_image(docker_config)
+            fresh_image = Config.image_name(docker_config)
           end
         rescue SystemExit => e
           puts "   ❌ Build failed (exit #{e.status}), keeping old container running"
@@ -154,7 +162,7 @@ module YatfaAgent
 
         # 4. Recreate container with preserved config
         puts "   Starting new container..."
-        new_cmd = build_recreate_command(name, config, new_version)
+        new_cmd = build_recreate_command(name, config, new_version, image: fresh_image)
         success = system(*new_cmd)
 
         if success
@@ -262,8 +270,10 @@ module YatfaAgent
     # @param name [String] container name
     # @param config [Hash] container inspect data
     # @param new_version [String] target infrastructure version number
+    # @param image [String, nil] freshly built image tag to run (takes
+    #   precedence over the stale image baked into the old container)
     # @return [Array<String>] docker command arguments
-    def self.build_recreate_command(name, config, new_version)
+    def self.build_recreate_command(name, config, new_version, image: nil)
       cmd = ["docker", "run", "-d", "--name", name]
 
       # Preserve restart policy
@@ -319,9 +329,11 @@ module YatfaAgent
         entrypoint_extra = entrypoint[1..]
       end
 
-      # Use the same image
-      image = config.dig("Config", "Image")
-      cmd += [image || "yatfa-sandbox"]
+      # Use the freshly built image when provided (so an update-cycle rebuild
+      # actually takes effect); otherwise preserve the container's existing
+      # image, falling back to the default tag.
+      resolved_image = image || config.dig("Config", "Image") || Config::DEFAULT_IMAGE_NAME
+      cmd += [resolved_image]
 
       # Use the original CMD (prepended with any extra entrypoint args)
       original_cmd = config.dig("Config", "Cmd")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yatfa",
-  "version": "1.0.95",
+  "version": "1.0.97",
   "description": "YATFA - Yet Another Tool For Agents",
   "bin": "./bin/run-yatfa-agent.rb",
   "files": [

package/setup/agent_bridge.rb

@@ -5,7 +5,7 @@
 #
 # Handles:
 #   - Architecture detection and multi-strategy bridge download
-#     (local override → Civo S3 presigned URL → GitHub fallback)
+#     (local override → mounted binary → public bucket download)
 #   - tmux binary download and INSIDE_TMUX=1 patching
 #   - Generic file download utility (download_file)
 #   - Helper script installation to /usr/local/bin
@@ -58,22 +58,12 @@ def download_agent_bridge!
     return download_agent_bridge_tmux!(target_dir)
   end
 
-  # 3. Try Civo bucket download (production mode)
-  if ENV["CIVO_ACCESS_KEY_ID"] && ENV["CIVO_SECRET_KEY"]
-    puts "📥 Downloading agent-bridge from Civo bucket..."
-    if download_from_civo!(arch, target_dir)
-      return download_agent_bridge_tmux!(target_dir)
-    else
-      puts "⚠️  Civo download failed, falling back to GitHub..."
-    end
-  end
-
-  # 4. Fallback to GitHub raw URLs (legacy)
+  # 3. Download from the public bucket (production mode)
   bridge_url = "#{YATFA_RAW_URL}/bin/agent-bridge-linux-#{arch}"
-  puts "📥 Downloading agent-bridge for linux-#{arch} from GitHub..."
+  puts "📥 Downloading agent-bridge for linux-#{arch} from bucket..."
   system("sudo", "curl", "-fsSL", bridge_url, "-o", "#{target_dir}/agent-bridge")
   unless $?.success?
-    puts "❌ Failed to download agent-bridge from GitHub"
+    puts "❌ Failed to download agent-bridge from #{bridge_url}"
     exit 1
   end
   system("sudo", "chmod", "+x", "#{target_dir}/agent-bridge")
@@ -82,63 +72,6 @@ def download_agent_bridge!
   download_agent_bridge_tmux!(target_dir)
 end
 
-def download_from_civo!(arch, target_dir)
-  require "aws-sdk-s3"
-
-  region = ENV["CIVO_REGION"] || "LON1"
-  endpoint = ENV["CIVO_ENDPOINT"] || "https://objectstore.fra1.civo.com"
-  bucket = ENV["YATFA_BINARIES_BUCKET"] || "yatfa"
-  version = ENV["AGENT_BRIDGE_VERSION"] || "latest"
-
-  binary_name = "agent-bridge-linux-#{arch}"
-  key = "agent-bridge/#{version}/#{binary_name}"
-
-  puts "   Region: #{region}"
-  puts "   Bucket: #{bucket}"
-  puts "   Version: #{version}"
-  puts "   Binary: #{binary_name}"
-
-  begin
-    # Configure Civo S3-compatible client
-    Aws.config.update({
-      region: region,
-      endpoint: endpoint,
-      access_key_id: ENV["CIVO_ACCESS_KEY_ID"],
-      secret_access_key: ENV["CIVO_SECRET_KEY"]
-    })
-
-    s3 = Aws::S3::Resource.new
-    obj = s3.bucket(bucket).object(key)
-
-    # Generate presigned URL (valid for 1 hour)
-    url = obj.presigned_url(:get, expires_in: 3600)
-
-    puts "✅ Generated presigned URL"
-
-    # Download via curl (array form avoids shell interpolation of URL)
-    system("sudo", "curl", "-fsSL", url, "-o", "#{target_dir}/agent-bridge")
-
-    unless $?.success?
-      puts "❌ Failed to download agent-bridge from Civo"
-      return false
-    end
-
-    system("sudo", "chmod", "+x", "#{target_dir}/agent-bridge")
-    puts "✅ Downloaded agent-bridge from Civo"
-    return true
-
-  rescue LoadError
-    puts "⚠️  aws-sdk-s3 gem not installed"
-    return false
-  rescue Aws::S3::Errors::NoSuchKey
-    puts "❌ Version #{version} not found in bucket"
-    return false
-  rescue => e
-    puts "❌ Civo download failed: #{e.message}"
-    return false
-  end
-end
-
 def download_agent_bridge_tmux!(target_dir)
   bridge_tmux_url = "#{YATFA_RAW_URL}/bin/agent-bridge-tmux"
 

package/setup/setup-agent.rb

@@ -45,7 +45,7 @@ require_relative "skills"
 
 SCRIPT_DIR = File.dirname(File.expand_path(__FILE__))
 YATFA_VERSION = ENV["YATFA_VERSION"] || "main"
-YATFA_SCRIPTS_BASE_URL = "https://objectstore.fra1.civo.com/yatfa"
+YATFA_SCRIPTS_BASE_URL = "https://pub-06ce56b9a9c143118036f593f07ac1d8.r2.dev"
 YATFA_RAW_URL = "#{YATFA_SCRIPTS_BASE_URL}/#{YATFA_VERSION}"
 
 # Valid agent types
@@ -244,26 +244,37 @@ def setup_claude_config!
 end
 
 def setup_git_config!
-  # Configure identity if provided
+  # Configure identity if provided.
+  # Each `git config` return value is captured and reported honestly — a failed
+  # config (read-only $HOME, full disk, restricted FS) is NOT fatal, but must
+  # NOT be hidden behind an unconditional ✅. Mirrors the repositories.rb:75-77
+  # precedent (YATFA-2842). Non-fatal: setup continues so a transient/recoverable
+  # failure does not restart-loop the container.
   if ENV["GIT_USER_NAME"] && !ENV["GIT_USER_NAME"].empty?
-    system("git", "config", "--global", "user.name", ENV["GIT_USER_NAME"])
-    puts "✅ Git user.name configured"
+    name_success = system("git", "config", "--global", "user.name", ENV["GIT_USER_NAME"])
+    puts name_success ? "✅ Git user.name configured" :
+                        "⚠️  Failed to set git user.name (later commits may fail authoring)"
   end
 
   if ENV["GIT_USER_EMAIL"] && !ENV["GIT_USER_EMAIL"].empty?
-    system("git", "config", "--global", "user.email", ENV["GIT_USER_EMAIL"])
-    puts "✅ Git user.email configured"
+    email_success = system("git", "config", "--global", "user.email", ENV["GIT_USER_EMAIL"])
+    puts email_success ? "✅ Git user.email configured" :
+                         "⚠️  Failed to set git user.email (later commits may fail authoring)"
   end
 
-  # Force HTTPS instead of SSH to ensure our token auth works
-  # This fixes "Permission denied (publickey)" when the repo uses git@github.com remote
-  system("git config --global url.\"https://github.com/\".insteadOf \"git@github.com:\"")
-  puts "✅ Git configured to force HTTPS for GitHub"
-
-  # Avoid "dubious ownership" errors in containers
-  # Note: Individual repository paths are added in clone_repositories! after cloning
-  system("git", "config", "--global", "--add", "safe.directory", Dir.pwd)
-  puts "✅ Git configured to trust #{Dir.pwd}"
+  # Force HTTPS instead of SSH to ensure our token auth works.
+  # This fixes "Permission denied (publickey)" when the repo uses git@github.com remote.
+  # If this silently fails, SSH-remote repos are NOT rewritten to HTTPS, so the
+  # HTTPS App-token auth path never engages → high impact, must be surfaced.
+  https_success = system("git config --global url.\"https://github.com/\".insteadOf \"git@github.com:\"")
+  puts https_success ? "✅ Git configured to force HTTPS for GitHub" :
+                       "⚠️  Failed to force HTTPS for GitHub (SSH-remote clones may fail with \"Permission denied (publickey)\")"
+
+  # Avoid "dubious ownership" errors in containers.
+  # Note: Individual repository paths are added in clone_repositories! after cloning.
+  safe_success = system("git", "config", "--global", "--add", "safe.directory", Dir.pwd)
+  puts safe_success ? "✅ Git configured to trust #{Dir.pwd}" :
+                      "⚠️  Failed to set git safe.directory for #{Dir.pwd} (may see 'dubious ownership' errors)"
 end
 
 

package/setup/skills.rb

@@ -4,7 +4,7 @@
 # Extracted from setup-agent.rb for modularity (Round 2)
 #
 # Handles:
-#   - Installing built-in skills from the SKILLS env var (Civo-hosted SKILL.md files)
+#   - Installing built-in skills from the SKILLS env var (R2-hosted SKILL.md files)
 #   - Fetching community skills list from the backend whoami API
 #   - Installing community skills from external GitHub repos
 #