Function runAgentJobContainer

lib/tools/docker.js:885–956

* Create and start an agent-job container. * Runs an autonomous task: clones repo, runs agent, commits, creates PR. * Uses a named volume for workspace (cleaned up by caller after exit). * @param {object} options * @param {string} options.agentJobId - Agent job UUID * @param {string} options.re

({ agentJobId, repo, branch, title, description, codingAgent, llmModel, scope, userId })

 * @returns {Promise<{containerId: string, containerName: string, volumeName: string}>}
 */
async function runAgentJobContainer({ agentJobId, repo, branch, title, description, codingAgent, llmModel, scope, userId }) {
  const agent = codingAgent || getConfig('CODING_AGENT') || 'claude-code';
  const version = process.env.THEPOPEBOT_VERSION;
  const image = `stephengpope/thepopebot:coding-agent-${agent}-${version}`;

  const shortId = agentJobId.replace(/-/g, '').slice(0, 8);
  const containerName = `thepopebot-agent-job-${shortId}`;
  const volumeName = `agent-job-${shortId}`;

  // Create named volume for workspace
  await createVolume(volumeName);

  const env = [
    `RUNTIME=agent-job`,
    `REPO=${repo}`,
    `BRANCH=${branch}`,
    `AGENT_JOB_ID=${agentJobId}`,
    `AGENT_JOB_TITLE=${title}`,
    `AGENT_JOB_DESCRIPTION=${description}`,
  ];

  if (llmModel) {
    env.push(`LLM_MODEL=${llmModel}`);
  }
  if (scope) {
    env.push(`SCOPE=${scope}`);
  }
  if (userId) {
    env.push(`USER_ID=${userId}`);
  }

  // Auth env vars based on agent type
  const { env: authEnv, backendApi } = buildAgentAuthEnv(agent);
  env.push(...authEnv);

  const ghToken = getConfig('GH_TOKEN');
  if (ghToken) {
    env.push(`GH_TOKEN=${ghToken}`);
  }

  // Inject APP_URL so agents can call back to the event handler
  const appUrl = getConfig('APP_URL');
  if (appUrl) env.push(`APP_URL=${appUrl}`);

  // Create per-container API key for agent-secrets access
  const { createAgentJobApiKey } = await import('../db/api-keys.js');
  const { key: agentJobToken } = createAgentJobApiKey(containerName);
  env.push(`AGENT_JOB_TOKEN=${agentJobToken}`);

  // Inject agent job secrets (plain secrets as env vars; oauth types are null — agent must fetch via get)
  const { getAllAgentJobSecrets } = await import('../db/config.js');
  const jobSecrets = getAllAgentJobSecrets();
  for (const { key, value } of jobSecrets) {
    if (value !== null && !env.some(e => e.startsWith(`${key}=`))) {
      env.push(`${key}=${value}`);
    }
  }