Function runHeadlessContainer

lib/tools/docker.js:417–493

* Create and start a headless coding agent container. * Runs a task via the agent, commits, and merges back. Ephemeral — exits when done. * @param {object} options * @param {string} options.containerName - Docker container name * @param {string} options.repo - GitHub repo full name * @param {st

({ containerName, repo, branch, featureBranch, workspaceId, taskPrompt, mode = 'plan', codingAgent, systemPrompt, continueSession = true, injectSecrets, scope, userId })

 * @returns {Promise<{containerId: string, containerName: string}>}
 */
async function runHeadlessContainer({ containerName, repo, branch, featureBranch, workspaceId, taskPrompt, mode = 'plan', codingAgent, systemPrompt, continueSession = true, injectSecrets, scope, userId }) {
  const agent = codingAgent || getConfig('CODING_AGENT') || 'claude-code';
  const version = process.env.THEPOPEBOT_VERSION;
  const image = `stephengpope/thepopebot:coding-agent-${agent}-${version}`;

  const env = [
    `RUNTIME=headless`,
    `REPO=${repo}`,
    `BRANCH=${branch}`,
    `PROMPT=${taskPrompt}`,
    `USER_ID=${userId}`,
  ];
  if (featureBranch) {
    env.push(`FEATURE_BRANCH=${featureBranch}`);
  }
  if (mode) {
    // Map 'dangerous' to 'code', keep 'plan' as-is
    const permission = mode === 'dangerous' ? 'code' : mode;
    env.push(`PERMISSION=${permission}`);
  }
  if (continueSession) {
    env.push(`CONTINUE_SESSION=1`);
  }
  if (scope) {
    env.push(`SCOPE=${scope}`);
  }

  // Auth env vars based on agent type
  const { env: authEnv, backendApi } = buildAgentAuthEnv(agent);
  env.push(...authEnv);

  const ghToken = getConfig('GH_TOKEN');
  if (ghToken) {
    env.push(`GH_TOKEN=${ghToken}`);
  }

  // Inject agent job secrets when running in agent chat mode
  if (injectSecrets) {
    const { getAllAgentJobSecrets } = await import('../db/config.js');
    const jobSecrets = getAllAgentJobSecrets();
    for (const { key, value } of jobSecrets) {
      if (value !== null && !env.some(e => e.startsWith(`${key}=`))) {
        env.push(`${key}=${value}`);
      }
    }
    // Create per-container API key for agent-secrets access
    const { createAgentJobApiKey } = await import('../db/api-keys.js');
    const { key: agentJobToken } = createAgentJobApiKey(containerName);
    env.push(`AGENT_JOB_TOKEN=${agentJobToken}`);
    const appUrl = getConfig('APP_URL');
    if (appUrl) env.push(`APP_URL=${appUrl}`);
  }

  const hostConfig = {};
  if (workspaceId) {
    const dir = workspaceDir(workspaceId);
    const wsDir = path.join(dir, 'workspace');
    fs.mkdirSync(wsDir, { recursive: true });