spawn-machine.sh

#!/bin/bash
# =============================================================================
# Spawn Machine — Agent Factory CLI
#
# Spawn, configure, register, and manage AI agent desktop instances.
#
# Usage:
#   spawn-machine.sh <command> [agent-name] [options]
#
# Commands:
#   init <name>       Create incubator directory + agent spec template
#   configure <name>  Generate env vars from agent spec
#   register <name>   Register agent in Guacamole Full
#   validate <name>   Run health checks on a deployed agent
#   status [name]     Show status of one or all agents
#   list              List all agents in the incubator
# =============================================================================
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WORKSPACE="${WORKSPACE:-/home/developer/.openclaw/workspace}"
INCUBATOR_DIR="${WORKSPACE}/platform/incubator"
REGISTRY_FILE="${INCUBATOR_DIR}/registry.yaml"

# Load configs
GUACAMOLE_CREDS="${HOME}/.config/guacamole/config"
COOLIFY_CREDS="${HOME}/.config/coolify/config"

# =============================================================================
# Helpers
# =============================================================================
log() { echo "[spawn-machine] $*"; }
err() { echo "[spawn-machine] ERROR: $*" >&2; }

load_guacamole_creds() {
    if [ ! -f "${GUACAMOLE_CREDS}" ]; then
        err "Guacamole credentials not found at ${GUACAMOLE_CREDS}"
        err "Create with: GUACAMOLE_URL, GUACAMOLE_USER, GUACAMOLE_PASS"
        return 1
    fi
    source "${GUACAMOLE_CREDS}"
}

guacamole_token() {
    local token
    token=$(curl -s -X POST "${GUACAMOLE_URL}/api/tokens" \
        -d "username=${GUACAMOLE_USER}&password=${GUACAMOLE_PASS}" | jq -r '.authToken')
    if [ -z "${token}" ] || [ "${token}" = "null" ]; then
        err "Failed to get Guacamole auth token"
        return 1
    fi
    echo "${token}"
}

require_agent_name() {
    if [ -z "${1:-}" ]; then
        err "Agent name required. Usage: spawn-machine.sh $COMMAND <agent-name>"
        exit 1
    fi
}

# =============================================================================
# Commands
# =============================================================================

cmd_init() {
    local name="$1"
    local agent_dir="${INCUBATOR_DIR}/${name}"

    if [ -d "${agent_dir}" ]; then
        err "Agent '${name}' already exists at ${agent_dir}"
        exit 1
    fi

    log "Initializing agent '${name}'..."
    mkdir -p "${agent_dir}"

    # Create agent spec from template
    cat > "${agent_dir}/agent-spec.md" << SPEC
---
created: $(date -Iseconds)
status: INITIALIZED
agentName: ${name}
stepsCompleted: ['init']
---

# Agent Spec: ${name}

## Identity
- **Name:** ${name}
- **Purpose:** (to be defined)
- **Operator:** (to be defined)
- **Timezone:** CET
- **Specialties:** (to be defined)
- **Vibe:** (to be defined)

## Boundaries
(to be defined)

## Services
(use 'spawn-machine.sh configure ${name}' after filling in the spec)

## Environment
(generated by configure command)
SPEC

    log "Created ${agent_dir}/agent-spec.md"
    log "Next: Edit the agent spec, then run 'spawn-machine.sh configure ${name}'"
}

cmd_configure() {
    local name="$1"
    local agent_dir="${INCUBATOR_DIR}/${name}"
    local spec="${agent_dir}/agent-spec.md"

    if [ ! -f "${spec}" ]; then
        err "Agent spec not found: ${spec}"
        err "Run 'spawn-machine.sh init ${name}' first"
        exit 1
    fi

    log "Generating env vars for '${name}'..."

    cat > "${agent_dir}/env-vars.md" << ENV
# ${name} — Coolify Environment Variables

Generated: $(date -Iseconds)

## Coolify App Settings
- **Repo:** machine-machine/m2-desktop
- **Branch:** guacamole
- **Docker Compose Location:** /docker-compose.agent.yml
- **Consistent Container Name:** ${name}-desktop

## Environment Variables

| Variable | Value |
|----------|-------|
| AGENT_NAME | ${name} |
| AGENT_CONFIG_GENERATE | true |
| CLAWDBOT_HOME | /clawdbot_home |
| M2_VARIANT | guacamole |
| WORKSPACE | /home/developer/.openclaw/workspace |
| ANTHROPIC_API_KEY | (set in Coolify) |
| VNC_PASSWORD | $(openssl rand -base64 24 | tr -d '/+=') |
| AGENT_OPENCLAW_REPO | https://github.com/machine-machine/openclaw.git |
| AGENT_OPENCLAW_BRANCH | m2-custom |
| AGENT_BOOTSTRAP_REPO_URL | https://raw.githubusercontent.com/machine-machine/m2-desktop/guacamole/incubator/${name} |
| QDRANT_URL | http://memory-qdrant:6333 |
| EMBEDDINGS_URL | http://memory-embeddings:8000 |
| AGENT_ID | ${name} |
| COLLECTION_NAME | agent_memory |
| AGENT_STT_BASE_URL | http://speaches-l0w808o4k80k0gogg88s80cc:8000/v1 |
| AGENT_STT_MODEL | whisper-1 |
| AGENT_SKILLS | xfce-desktop,m2-memory |
| AGENT_BROWSER_ENABLED | true |
| AGENT_CPUS | 8 |
| AGENT_MEMORY | 8g |
| SHM_SIZE | 1gb |

## Guacamole Registration

| Setting | Value |
|---------|-------|
| Connection Name | ${name^} Desktop |
| Protocol | VNC |
| Hostname | ${name}-desktop |
| Port | 5900 |
| Password | (from VNC_PASSWORD above) |
ENV

    log "Generated ${agent_dir}/env-vars.md"
    log "Review the env vars, then set them in Coolify and deploy."
}

cmd_register() {
    local name="$1"
    local agent_dir="${INCUBATOR_DIR}/${name}"

    load_guacamole_creds || exit 1

    # Try to read VNC password from env-vars.md
    local vnc_pass=""
    if [ -f "${agent_dir}/env-vars.md" ]; then
        vnc_pass=$(grep "VNC_PASSWORD" "${agent_dir}/env-vars.md" | grep -oP '\| \K[^|]+$' | xargs || true)
    fi
    if [ -z "${vnc_pass}" ] || [ "${vnc_pass}" = "(set in Coolify)" ]; then
        read -rp "VNC password for ${name}-desktop: " vnc_pass
    fi

    log "Getting Guacamole auth token..."
    local token
    token=$(guacamole_token) || exit 1

    log "Creating VNC connection for '${name}'..."
    local response
    response=$(curl -s -X POST "${GUACAMOLE_URL}/api/session/data/mysql/connections?token=${token}" \
        -H "Content-Type: application/json" \
        -d "{
            \"name\": \"${name^} Desktop\",
            \"protocol\": \"vnc\",
            \"parentIdentifier\": \"ROOT\",
            \"parameters\": {
                \"hostname\": \"${name}-desktop\",
                \"port\": \"5900\",
                \"password\": \"${vnc_pass}\",
                \"color-depth\": \"32\",
                \"width\": \"1920\",
                \"height\": \"1080\",
                \"dpi\": \"96\"
            },
            \"attributes\": {}
        }")

    local conn_id
    conn_id=$(echo "${response}" | jq -r '.identifier // empty')

    if [ -n "${conn_id}" ]; then
        log "Registered! Connection ID: ${conn_id}"
        log "Access: ${GUACAMOLE_URL} → ${name^} Desktop"
    else
        err "Registration failed. Response: ${response}"
        exit 1
    fi
}

cmd_validate() {
    local name="$1"
    local container="${name}-desktop"
    local pass=0
    local fail=0
    local skip=0

    log "Validating agent '${name}'..."
    echo ""

    # Network reachability
    printf "  %-40s" "DNS resolution (${container})..."
    if ping -c 1 -W 2 "${container}" &>/dev/null; then
        echo "PASS"
        ((pass++))
    else
        echo "FAIL"
        ((fail++))
    fi

    printf "  %-40s" "VNC port (5900)..."
    if nc -z -w 2 "${container}" 5900 &>/dev/null; then
        echo "PASS"
        ((pass++))
    else
        echo "FAIL"
        ((fail++))
    fi

    printf "  %-40s" "OpenClaw gateway (18789)..."
    if bash -c "</dev/tcp/${container}/18789" 2>/dev/null; then
        echo "PASS"
        ((pass++))
    else
        echo "FAIL"
        ((fail++))
    fi

    # Memory system
    printf "  %-40s" "Qdrant reachable..."
    if curl -s -o /dev/null -w '%{http_code}' http://memory-qdrant:6333/collections | grep -q "200"; then
        echo "PASS"
        ((pass++))
    else
        echo "FAIL"
        ((fail++))
    fi

    printf "  %-40s" "Embeddings reachable..."
    if curl -s -o /dev/null -w '%{http_code}' http://memory-embeddings:8000/health 2>/dev/null | grep -q "200"; then
        echo "PASS"
        ((pass++))
    else
        echo "SKIP (may not have /health)"
        ((skip++))
    fi

    echo ""
    echo "  Results: ${pass} passed, ${fail} failed, ${skip} skipped"

    if [ "${fail}" -eq 0 ]; then
        log "Validation PASSED"
    else
        log "Validation FAILED (${fail} issues)"
        exit 1
    fi
}

cmd_status() {
    local name="${1:-}"

    if [ -n "${name}" ]; then
        local container="${name}-desktop"
        printf "  %-15s" "${name}"

        if ping -c 1 -W 1 "${container}" &>/dev/null; then
            if bash -c "</dev/tcp/${container}/18789" 2>/dev/null; then
                echo "OPERATIONAL  ${container}"
            else
                echo "UNHEALTHY    ${container}  (gateway not responding on 18789)"
            fi
        else
            echo "UNREACHABLE  ${container}"
        fi
    else
        log "Agent Status:"
        echo ""
        for dir in "${INCUBATOR_DIR}"/*/; do
            [ -d "${dir}" ] || continue
            local agent_name
            agent_name=$(basename "${dir}")
            # Skip non-agent dirs
            [ "${agent_name}" = "spawn-machine" ] && continue
            cmd_status "${agent_name}" 2>/dev/null || true
        done
    fi
}

cmd_list() {
    log "Agents in incubator:"
    echo ""
    for dir in "${INCUBATOR_DIR}"/*/; do
        [ -d "${dir}" ] || continue
        local agent_name
        agent_name=$(basename "${dir}")
        [ "${agent_name}" = "spawn-machine" ] && continue

        local status="unknown"
        if [ -f "${dir}/agent-spec.md" ]; then
            status=$(grep "^status:" "${dir}/agent-spec.md" | head -1 | sed 's/status: *//' || echo "unknown")
        fi
        printf "  %-15s %s\n" "${agent_name}" "${status}"
    done
}

# =============================================================================
# Coolify helpers
# =============================================================================
COOLIFY_API="${COOLIFY_API_URL:-https://cool.machinemachine.ai/api/v1}"
COOLIFY_AUTH_TOKEN=""

coolify_token() {
    if [ -f "${HOME}/.config/coolify/config" ]; then
        source "${HOME}/.config/coolify/config"
        COOLIFY_AUTH_TOKEN="${COOLIFY_TOKEN:-}"
    fi
    echo "${COOLIFY_AUTH_TOKEN}"
}

coolify_api() {
    local method="$1" endpoint="$2" data="${3:-}"
    local token; token=$(coolify_token)
    if [ -n "${data}" ]; then
        curl -sf -X "${method}" "${COOLIFY_API}/${endpoint}" \
            -H "Authorization: Bearer ${token}" \
            -H "Content-Type: application/json" \
            -d "${data}"
    else
        curl -sf -X "${method}" "${COOLIFY_API}/${endpoint}" \
            -H "Authorization: Bearer ${token}"
    fi
}

coolify_set_env() {
    local uuid="$1" key="$2" value="$3"
    local json_val
    json_val=$(echo -n "${value}" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')
    # POST first; if 409 (exists), DELETE then re-POST
    local out code
    out=$(curl -s -w '\n%{http_code}' -X POST "${COOLIFY_API}/applications/${uuid}/envs" \
        -H "Authorization: Bearer $(coolify_token)" \
        -H "Content-Type: application/json" \
        -d "{\"key\":\"${key}\",\"value\":${json_val},\"is_preview\":false}")
    code=$(echo "${out}" | tail -1)
    if [ "${code}" = "409" ]; then
        # Already exists — get its uuid and overwrite
        local env_uuid
        env_uuid=$(coolify_api GET "applications/${uuid}/envs" 2>/dev/null | \
            python3 -c "import json,sys,os; envs=json.load(sys.stdin); e=[x for x in envs if x.get('key')=='${key}']; print(e[0]['uuid'] if e else '')" 2>/dev/null || echo "")
        if [ -n "${env_uuid}" ]; then
            curl -s -X DELETE "${COOLIFY_API}/applications/${uuid}/envs/${env_uuid}" \
                -H "Authorization: Bearer $(coolify_token)" > /dev/null 2>&1 || true
            curl -s -X POST "${COOLIFY_API}/applications/${uuid}/envs" \
                -H "Authorization: Bearer $(coolify_token)" \
                -H "Content-Type: application/json" \
                -d "{\"key\":\"${key}\",\"value\":${json_val},\"is_preview\":false}" > /dev/null 2>&1 || true
        fi
    fi
    return 0
}

# =============================================================================
# cmd_spawn — single command to spawn a new agent
# Usage: spawn-machine.sh spawn <name> <telegram_token> [options]
# Options:
#   --anthropic-key KEY    Per-agent Anthropic API key
#   --openrouter-key KEY   Per-agent OpenRouter API key
#   --cerebras-key KEY     Per-agent Cerebras API key
#   --skills LIST          Override default AGENT_SKILLS
#   --no-deploy            Create + configure but don't deploy yet
# =============================================================================
COOLIFY_PROJECT_UUID="q8w4cwskgwkgg0cg00k00coo"
COOLIFY_SERVER_UUID="vw8k84s4swgoc4w0sswkgwc4"
COOLIFY_GITHUB_APP_UUID="r00ooc0kw0csgsww0k8kso00"
FLEET_ENV_CONF="${HOME}/.config/spawn-machine/fleet-env.conf"

cmd_spawn() {
    local name="${1:-}"
    local telegram_token="${2:-}"
    shift 2 || true

    # Parse options
    local anthropic_key="" openrouter_key="" cerebras_key="" custom_skills="" no_deploy=false session_id=""
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --anthropic-key)  anthropic_key="$2";  shift 2 ;;
            --openrouter-key) openrouter_key="$2"; shift 2 ;;
            --cerebras-key)   cerebras_key="$2";   shift 2 ;;
            --skills)         custom_skills="$2";  shift 2 ;;
            --no-deploy)      no_deploy=true;      shift ;;
            --session-id)     session_id="$2";     shift 2 ;;
            *) err "Unknown option: $1"; exit 1 ;;
        esac
    done

    [ -z "${name}" ]           && { err "Usage: spawn-machine.sh spawn <name> <telegram_token>"; exit 1; }
    [ -z "${telegram_token}" ] && echo "  ⚠️  No Telegram token — agent will run without Telegram channel"

    # Validate name not already in registry
    if grep -q "^  ${name}:" "${REGISTRY_FILE}" 2>/dev/null; then
        err "Agent '${name}' already exists in registry. Use a different name."
        exit 1
    fi

    log "Spawning agent '${name}'..."

    # Load fleet env defaults
    local fleet_env=()
    if [ -f "${FLEET_ENV_CONF}" ]; then
        while IFS='=' read -r k v; do
            [[ "$k" =~ ^#.*$ || -z "$k" ]] && continue
            fleet_env+=("$k=$v")
        done < "${FLEET_ENV_CONF}"
        log "Fleet env loaded from ${FLEET_ENV_CONF} (${#fleet_env[@]} vars)"
    else
        log "Warning: No fleet env config at ${FLEET_ENV_CONF} — set shared vars manually in Coolify"
    fi

    # -------------------------------------------------------------------------
    # Step 1: Generate per-agent compose + push to GitHub
    # -------------------------------------------------------------------------
    log "[1/9] Generating per-agent compose → machine-machine/m2-desktop:agents/${name}/docker-compose.yml"
    local compose_content
    compose_content="# Agent compose — ${name} — all values hardcoded, no \${VAR} outside environment section
services:
  ${name}-m2o:
    container_name: ${name}-m2o
    image: ghcr.io/machine-machine/m2-desktop:agent-latest
    # Fix: strip set -e from entrypoint + strip meta block from generated openclaw.json (meta block breaks config validator)
    entrypoint: [\"/bin/bash\", \"-c\", \"sed -i '/^set -e/d' /usr/local/bin/entrypoint.sh 2>/dev/null || true; echo aW1wb3J0IGpzb24scGF0aGxpYgpwPXBhdGhsaWIuUGF0aC5ob21lKCkvIi5vcGVuY2xhdy9vcGVuY2xhdy5qc29uIgppZiBwLmV4aXN0cygpOgogICAgZD1qc29uLmxvYWRzKHAucmVhZF90ZXh0KCkpCiAgICBkLnBvcCgibWV0YSIsTm9uZSkKICAgIHAud3JpdGVfdGV4dChqc29uLmR1bXBzKGQsaW5kZW50PTIpKQo= | base64 -d > /tmp/strip_meta.py; sed -i '/generate-openclaw-config/a python3 /tmp/strip_meta.py 2>/dev/null||true' /usr/local/bin/entrypoint.sh 2>/dev/null || true; exec /usr/local/bin/entrypoint.sh\"]
    restart: unless-stopped

    environment:
      AGENT_NAME: \"${name}\"
      AGENT_ID: \"${name}\"
      M2_HOME: /agent_home
      WORKSPACE: /home/developer/.openclaw/workspace
      ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
      OPENROUTER_API_KEY: \${OPENROUTER_API_KEY}
      CEREBRAS_API_KEY: \${CEREBRAS_API_KEY}
      AGENT_TELEGRAM_BOT_TOKEN: \${AGENT_TELEGRAM_BOT_TOKEN}
      AGENT_OPENCLAW_REPO: \${AGENT_OPENCLAW_REPO}
      AGENT_OPENCLAW_BRANCH: \${AGENT_OPENCLAW_BRANCH}
      AGENT_BOOTSTRAP_REPO_URL: \${AGENT_BOOTSTRAP_REPO_URL}
      AGENT_TTS_BASE_URL: \${AGENT_TTS_BASE_URL}
      AGENT_TTS_VOICE: \${AGENT_TTS_VOICE}
      AGENT_TTS_TIMEOUT_MS: \${AGENT_TTS_TIMEOUT_MS}
      AGENT_STT_BASE_URL: \${AGENT_STT_BASE_URL}
      AGENT_STT_MODEL: \${AGENT_STT_MODEL}
      QDRANT_URL: \${QDRANT_URL}
      EMBEDDINGS_URL: \${EMBEDDINGS_URL}
      COLLECTION_NAME: \"agent_memory_${name}\"
      AGENT_SKILLS: \${AGENT_SKILLS}
      BGE_PROXY_TOKEN: \${BGE_PROXY_TOKEN}
      PLANKA_URL: \${PLANKA_URL}
      PLANKA_TOKEN: \${PLANKA_TOKEN}
      PLANKA_USER: \${PLANKA_USER}
      PLANKA_EMAIL: \${PLANKA_EMAIL}
      PLANKA_PASS: \${PLANKA_PASS}
      COOLIFY_TOKEN: \${COOLIFY_TOKEN}
      COOLIFY_API_URL: \${COOLIFY_API_URL}
      VNC_PASSWORD: \${VNC_PASSWORD}
      AGENT_BROWSER_ENABLED: \"true\"
      FLEET_REDIS_HOST: \"fleet-redis\"
      FLEET_REDIS_PORT: \"6379\"
      FLEET_SSH_PUBKEY: \${FLEET_SSH_PUBKEY}
      AGENT_PRESET: \"generalist\"

    deploy:
      resources:
        limits:
          cpus: \"8\"
          memory: 8g

    shm_size: 1gb
    privileged: true

    volumes:
      - ${name}_agent_home:/agent_home

    healthcheck:
      test: [\"CMD-SHELL\", \"bash -c '</dev/tcp/localhost/18789' 2>/dev/null && exit 0 || exit 1\"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 120s

    networks:
      default:
      coolify:
        aliases:
          - ${name}-m2o

networks:
  coolify:
    external: true

volumes:
  ${name}_agent_home:
    driver: local
"

    # Push compose to GitHub on a per-agent branch (agents/${name})
    # Rationale: all agents sharing :base means ANY push to base triggers redeploys
    # for every agent connected to that branch. Per-agent branch = isolated webhook.
    python3 - << PYEOF
import json, base64, subprocess, sys

content = base64.b64encode("""${compose_content}""".encode()).decode()
repo    = "machine-machine/m2-desktop"
path    = "docker-compose.yml"   # root of the per-agent branch
branch  = "agents/${name}"

# Get SHA of base branch tip to fork from
base_ref = subprocess.run(
    ["gh","api",f"repos/{repo}/git/refs/heads/base"],
    capture_output=True, text=True)
if base_ref.returncode != 0:
    print(f"  ERROR: could not read base branch: {base_ref.stderr[:100]}", file=sys.stderr)
    sys.exit(1)
base_sha = json.loads(base_ref.stdout)["object"]["sha"]

# Create per-agent branch from base (ignore 422 = already exists)
branch_payload = {"ref": f"refs/heads/{branch}", "sha": base_sha}
br = subprocess.run(
    ["gh","api","--method=POST",f"repos/{repo}/git/refs","--input=-"],
    input=json.dumps(branch_payload), capture_output=True, text=True)
if br.returncode == 0:
    print(f"  Created branch agents/${name} from base ({base_sha[:8]})")
elif "Reference already exists" in br.stderr or "already exists" in br.stderr:
    print(f"  Branch agents/${name} already exists — reusing")
else:
    print(f"  ERROR creating branch: {br.stderr[:100]}", file=sys.stderr)
    sys.exit(1)

# Get existing SHA of docker-compose.yml on agent branch (for update)
r = subprocess.run(
    ["gh","api",f"repos/{repo}/contents/{path}?ref={branch}"],
    capture_output=True, text=True)
sha = json.loads(r.stdout).get("sha","") if r.returncode == 0 else ""

payload = {"message": "spawn: ${name} docker-compose.yml — service name ${name}-m2o",
           "content": content, "branch": branch}
if sha:
    payload["sha"] = sha

r2 = subprocess.run(
    ["gh","api","--method=PUT",f"repos/{repo}/contents/{path}","--input=-"],
    input=json.dumps(payload), capture_output=True, text=True)
if r2.returncode == 0:
    print(f"  Pushed: {branch}/docker-compose.yml")
else:
    print(f"  ERROR: {r2.stderr[:100]}", file=sys.stderr)
    sys.exit(1)
PYEOF
    log "  Compose pushed to GitHub (branch: agents/${name})"

    # -------------------------------------------------------------------------
    # Step 2: Create Coolify app on per-agent branch
    # -------------------------------------------------------------------------
    log "[2/9] Creating Coolify application '${name}-m2o'..."
    local app_json
    app_json=$(coolify_api POST "applications/private-github-app" "{
        \"project_uuid\": \"${COOLIFY_PROJECT_UUID}\",
        \"server_uuid\": \"${COOLIFY_SERVER_UUID}\",
        \"environment_name\": \"production\",
        \"git_repository\": \"machine-machine/m2-desktop\",
        \"git_branch\": \"agents/${name}\",
        \"build_pack\": \"dockercompose\",
        \"docker_compose_location\": \"/docker-compose.yml\",
        \"github_app_uuid\": \"${COOLIFY_GITHUB_APP_UUID}\",
        \"ports_exposes\": \"8080\",
        \"name\": \"${name}-m2o\",
        \"instant_deploy\": false
    }") || { err "Failed to create Coolify app"; exit 1; }

    local app_uuid
    app_uuid=$(echo "${app_json}" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('uuid') or d.get('data',{}).get('uuid',''))" 2>/dev/null)
    [ -z "${app_uuid}" ] && { err "Could not parse app UUID from: ${app_json}"; exit 1; }
    log "  Created: ${app_uuid}"

    # -------------------------------------------------------------------------
    # Step 3: (named volumes auto-created by Docker — no host mkdir needed)
    # -------------------------------------------------------------------------
    log "[3/9] Named volume '${name}_agent_home' will be auto-created by Docker"

    # -------------------------------------------------------------------------
    # Step 4: Set environment variables
    # -------------------------------------------------------------------------
    log "[4/9] Setting environment variables..."

    # Fleet-wide vars (from config file)
    for kv in "${fleet_env[@]}"; do
        local k="${kv%%=*}" v="${kv#*=}"
        coolify_set_env "${app_uuid}" "${k}" "${v}"
    done

    # Agent-specific vars (always set, override fleet defaults)
    coolify_set_env "${app_uuid}" "AGENT_NAME"               "${name}"
    coolify_set_env "${app_uuid}" "AGENT_ID"                 "${name}"
    coolify_set_env "${app_uuid}" "M2_HOME"                  "/agent_home"
    [ -n "${telegram_token}" ] && coolify_set_env "${app_uuid}" "AGENT_TELEGRAM_BOT_TOKEN" "${telegram_token}"
    coolify_set_env "${app_uuid}" "COLLECTION_NAME"          "agent_memory_${name}"
    # Notify-live wiring — agent calls this on boot to mark itself live
    [ -n "${session_id}" ] && coolify_set_env "${app_uuid}" "AGENT_SESSION_ID" "${session_id}"
    [ -n "${session_id}" ] && coolify_set_env "${app_uuid}" "AGENT_NOTIFY_URL" \
        "https://api.machinemachine.ai/v1/onboard/notify-live"

    # API keys — use project-level shared vars by default (Coolify {{project.KEY}} pattern)
    # Override with explicit --anthropic-key / --openrouter-key flags if needed
    local effective_anthropic="${anthropic_key:-{{project.ANTHROPIC_API_KEY}}}"
    local effective_openrouter="${openrouter_key:-{{project.OPENROUTER_API_KEY}}}"
    coolify_set_env "${app_uuid}" "ANTHROPIC_API_KEY"   "${effective_anthropic}"
    coolify_set_env "${app_uuid}" "OPENROUTER_API_KEY"  "${effective_openrouter}"
    [ -n "${cerebras_key}" ]   && coolify_set_env "${app_uuid}" "CEREBRAS_API_KEY"    "${cerebras_key}"
    [ -n "${custom_skills}" ]  && coolify_set_env "${app_uuid}" "AGENT_SKILLS"        "${custom_skills}"

    # Default model: GLM-5 via OpenRouter (override with AGENT_DEFAULT_MODEL env or --model flag)
    local default_model="${AGENT_DEFAULT_MODEL:-openrouter/thudm/glm-z1-32b:free}"
    coolify_set_env "${app_uuid}" "AGENT_DEFAULT_MODEL" "${default_model}"

    # S3/Minio env vars — read from shell env first, fall back to fleet-env.conf
    local minio_endpoint="${MINIO_ENDPOINT:-}"
    local minio_access="${MINIO_ACCESS_KEY:-}"
    local minio_secret="${MINIO_SECRET_KEY:-}"
    local minio_bucket="${MINIO_BUCKET:-m2o-agents}"
    for kv in "${fleet_env[@]}"; do
        case "${kv%%=*}" in
            MINIO_ENDPOINT)   [ -z "$minio_endpoint" ] && minio_endpoint="${kv#*=}" ;;
            MINIO_ACCESS_KEY) [ -z "$minio_access"   ] && minio_access="${kv#*=}" ;;
            MINIO_SECRET_KEY) [ -z "$minio_secret"   ] && minio_secret="${kv#*=}" ;;
            MINIO_BUCKET)     minio_bucket="${kv#*=}" ;;
        esac
    done
    if [ -n "$minio_endpoint" ]; then
        coolify_set_env "${app_uuid}" "MINIO_ENDPOINT"    "${minio_endpoint}"
        coolify_set_env "${app_uuid}" "MINIO_ACCESS_KEY"  "${minio_access}"
        coolify_set_env "${app_uuid}" "MINIO_SECRET_KEY"  "${minio_secret}"
        coolify_set_env "${app_uuid}" "MINIO_BUCKET"      "${minio_bucket}"
        log "  S3 sync configured → ${minio_endpoint}/${minio_bucket}"
    else
        log "  Warning: MINIO_ENDPOINT not set — agent home will NOT be S3-backed"
    fi

    log "  Env vars set"

    # -------------------------------------------------------------------------
    # Step 4a: Create Qdrant memory namespace
    # -------------------------------------------------------------------------
    log "[5/9] Creating Qdrant collection 'agent_memory_${name}'..."
    local qdrant_url="${QDRANT_URL:-http://memory-qdrant:6333}"
    # Read from fleet-env.conf if available
    [[ " ${fleet_env[*]} " =~ QDRANT_URL=([^ ]*) ]] && qdrant_url="${BASH_REMATCH[1]}"
    local qdrant_result
    qdrant_result=$(curl -sf -o /dev/null -w "%{http_code}" -X PUT \
        "${qdrant_url}/collections/agent_memory_${name}" \
        -H "Content-Type: application/json" \
        -d '{
            "vectors": {"size": 1024, "distance": "Cosine"},
            "optimizers_config": {"default_segment_number": 2}
        }') 2>/dev/null || true
    if [ "$qdrant_result" = "200" ] || [ "$qdrant_result" = "201" ]; then
        log "  Collection created: agent_memory_${name}"
        # Add payload indices
        for field in "timestamp:float" "importance:float" "agent_id:keyword" "tier:keyword" "entity_tags:keyword" "memory_type:keyword"; do
            fname="${field%%:*}"; ftype="${field##*:}"
            curl -sf -X PUT "${qdrant_url}/collections/agent_memory_${name}/index" \
                -H "Content-Type: application/json" \
                -d "{\"field_name\":\"${fname}\",\"field_schema\":\"${ftype}\"}" > /dev/null 2>&1 || true
        done
        log "  Payload indices created"
    else
        log "  Warning: Qdrant returned ${qdrant_result} — collection may already exist or Qdrant unreachable"
    fi

    # -------------------------------------------------------------------------
    # Step 4b: Create Planka user
    # -------------------------------------------------------------------------
    log "[6/9] Creating Planka user for '${name}'..."
    local planka_url="${PLANKA_URL:-https://kanban.machinemachine.ai}"
    local planka_token="${PLANKA_TOKEN:-}"
    local planka_email="${name}@machinemachine.ai"
    local planka_pass="${name^}Agent2026!"
    for kv in "${fleet_env[@]}"; do
        [[ "$kv" == PLANKA_URL=* ]]   && planka_url="${kv#*=}"
        [[ "$kv" == PLANKA_TOKEN=* ]] && planka_token="${kv#*=}"
    done
    if [ -n "${planka_token}" ]; then
        local planka_create
        planka_create=$(curl -sf -X POST "${planka_url}/api/users" \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer ${planka_token}" \
            -d "{\"email\":\"${planka_email}\",\"password\":\"${planka_pass}\",\"name\":\"${name^}\",\"username\":\"${name}\"}" \
            2>/dev/null | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('item',{}).get('id','err:'+str(d)))" 2>/dev/null || echo "failed")
        if [[ "${planka_create}" =~ ^[0-9]+ ]]; then
            log "  Planka user created: ${planka_email} (id: ${planka_create})"
            # Terms acceptance via DB exec
            local pg_container
            pg_container=$(sudo curl -sf --unix-socket /var/run/docker.sock \
                "http://localhost/containers/json" 2>/dev/null | \
                python3 -c "
import json,sys
cs=json.load(sys.stdin)
for c in cs:
    if any('postgres' in n.lower() and 'planka' in n.lower() for n in c.get('Names',[])):
        print(c['Id'][:12])
        break
" 2>/dev/null || echo "")
            if [ -n "${pg_container}" ]; then
                EXEC_ID=$(sudo curl -sf -X POST --unix-socket /var/run/docker.sock \
                    "http://localhost/containers/${pg_container}/exec" \
                    -H "Content-Type: application/json" \
                    -d "{\"Cmd\":[\"psql\",\"-U\",\"postgres\",\"planka\",\"-c\",\"UPDATE \\\"user\\\" SET is_agreement_accepted=true WHERE username='${name}'\"],\"AttachStdout\":true,\"AttachStderr\":true}" \
                    2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('Id',''))")
                [ -n "${EXEC_ID}" ] && sudo curl -sf -X POST --unix-socket /var/run/docker.sock \
                    "http://localhost/exec/${EXEC_ID}/start" \
                    -H "Content-Type: application/json" -d '{"Detach":false}' > /dev/null 2>&1
                log "  Terms accepted via DB exec"
            fi
            # Get individual token
            local agent_token
            agent_token=$(curl -sf -X POST "${planka_url}/api/access-tokens" \
                -H "Content-Type: application/json" \
                -d "{\"emailOrUsername\":\"${planka_email}\",\"password\":\"${planka_pass}\"}" \
                2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('item',''))" 2>/dev/null || echo "")
            [ -n "${agent_token}" ] && {
                coolify_set_env "${app_uuid}" "PLANKA_EMAIL" "${planka_email}"
                coolify_set_env "${app_uuid}" "PLANKA_USER"  "${planka_email}"
                coolify_set_env "${app_uuid}" "PLANKA_PASS"  "${planka_pass}"
                coolify_set_env "${app_uuid}" "PLANKA_TOKEN" "${agent_token}"
                log "  Individual Planka token set in Coolify"
            } || log "  Warning: Could not get individual token — shared admin token will be used"
        else
            log "  Warning: Planka user creation failed (${planka_create}). Using shared admin token."
            coolify_set_env "${app_uuid}" "PLANKA_EMAIL" "${planka_email}"
        fi
    else
        log "  Skipping Planka user — no PLANKA_TOKEN in fleet env"
    fi

    # -------------------------------------------------------------------------
    # Step 4: Pre-register Guacamole connection
    # -------------------------------------------------------------------------
    log "[7/9] Pre-registering Guacamole connection + user (m2o)..."
    load_guacamole_creds 2>/dev/null && {
        local guac_token
        guac_token=$(guacamole_token 2>/dev/null) && {
            local vnc_pass="agentdesktop"
            # Generate a per-agent Guacamole password (stored in registry)
            local guac_user_pass
            guac_user_pass=$(python3 -c "import secrets; print(secrets.token_urlsafe(16))")

            # Create VNC connection — hostname matches container alias (${name}-m2o)
            local response conn_id
            response=$(curl -sf -X POST \
                "${GUACAMOLE_URL}/api/session/data/mysql/connections?token=${guac_token}" \
                -H "Content-Type: application/json" \
                -d "{
                    \"name\": \"${name^} Desktop\",
                    \"protocol\": \"vnc\",
                    \"parentIdentifier\": \"ROOT\",
                    \"parameters\": {
                        \"hostname\": \"${name}-m2o\",
                        \"port\": \"5900\",
                        \"password\": \"${vnc_pass}\",
                        \"color-depth\": \"32\",
                        \"width\": \"1920\",
                        \"height\": \"1080\"
                    },
                    \"attributes\": {}
                }")
            conn_id=$(echo "${response}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('identifier',''))" 2>/dev/null || true)
            [ -n "${conn_id}" ] && log "  Connection created: ID ${conn_id}" || log "  Warning: connection pre-registration failed"

            # Create a per-agent Guacamole user
            local user_response
            user_response=$(curl -sf -X POST \
                "${GUACAMOLE_URL}/api/session/data/mysql/users?token=${guac_token}" \
                -H "Content-Type: application/json" \
                -d "{
                    \"username\": \"${name}\",
                    \"password\": \"${guac_user_pass}\",
                    \"attributes\": {
                        \"disabled\": \"\",
                        \"expired\": \"\",
                        \"access-window-start\": \"\",
                        \"access-window-end\": \"\",
                        \"valid-from\": \"\",
                        \"valid-until\": \"\",
                        \"timezone\": null
                    }
                }" 2>/dev/null || echo "")
            local user_created
            user_created=$(echo "${user_response}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('username',''))" 2>/dev/null || true)

            # Grant that user access to their connection
            if [ -n "${user_created}" ] && [ -n "${conn_id}" ]; then
                curl -sf -X PATCH \
                    "${GUACAMOLE_URL}/api/session/data/mysql/users/${name}/permissions?token=${guac_token}" \
                    -H "Content-Type: application/json" \
                    -d "[{\"op\":\"add\",\"path\":\"/connectionPermissions/${conn_id}\",\"value\":\"READ\"}]" > /dev/null 2>&1 || true
                log "  Guacamole user '${name}' created — password: ${guac_user_pass}"
                log "  URL: ${GUACAMOLE_URL} | User: ${name} | Pass: ${guac_user_pass}"
                # Store creds in onboarding session so notify-live can send them to the user
                if [ -n "${session_id}" ] && [ -n "${ONBOARD_API_URL:-}" ] && [ -n "${ONBOARD_ADMIN_TOKEN:-}" ]; then
                    curl -sf -X POST "${ONBOARD_API_URL}/v1/admin/set-guac-creds" \
                        -H "Content-Type: application/json" \
                        -H "x-admin-token: ${ONBOARD_ADMIN_TOKEN}" \
                        -d "{\"session_id\":\"${session_id}\",\"guacamole_user\":\"${name}\",\"guacamole_pass\":\"${guac_user_pass}\"}" \
                        > /dev/null 2>&1 \
                        && log "  Guacamole creds stored in onboarding session ${session_id}" \
                        || log "  Warning: could not store guac creds in session (non-fatal)"
                fi
            else
                log "  Warning: Guacamole user creation failed — admin access only"
            fi
        }
    } || log "  Guacamole creds not found — skipping pre-registration"

    # -------------------------------------------------------------------------
    # Step 5: Update registry
    # -------------------------------------------------------------------------
    log "[8/9] Registering in fleet registry..."
    local ts
    ts=$(date -u +%Y-%m-%d)
    cat >> "${REGISTRY_FILE}" << YAML

  ${name}:
    coolify_uuid: ${app_uuid}
    telegram: pending
    memory_collection: agent_memory_${name}
    status: provisioning
    created: ${ts}
    host_path: /opt/m2o/${name}/home
YAML
    log "  Added to registry.yaml"

    # -------------------------------------------------------------------------
    # Step 6: Deploy (unless --no-deploy)
    # -------------------------------------------------------------------------
    if [ "${no_deploy}" = "false" ]; then
        log "[9/9] Triggering deployment..."
        coolify_api POST "deploy?uuid=${app_uuid}&force=false" > /dev/null
        log "  Deployment triggered"
        log ""
        log "✅ Agent '${name}' spawning!"
        log "   Coolify UUID: ${app_uuid}"
        log "   Host path:    /opt/m2o/${name}/home"
        log "   Guacamole:    m2o.machinemachine.ai → '${name^} Desktop'"
        log "   Timeline:     ~3 min to first Telegram message"
    else
        log "[9/9] Skipping deploy (--no-deploy). Run when ready:"
        log "  coolify_api POST deploy?uuid=${app_uuid}&force=false"
    fi

    # Notify via escalation
    python3 - << PYEOF 2>/dev/null || true
import urllib.request, json, os
token = "${BGE_PROXY_TOKEN:-}"
if token:
    payload = json.dumps({
        "from_agent": "m2",
        "to_agent": "m2",
        "message": "spawn-machine: '${name}' spawning (uuid: ${app_uuid}). Notify master when live.",
        "priority": "low"
    }).encode()
    req = urllib.request.Request(
        "http://bge-proxy.machinemachine.ai/escalate",
        data=payload,
        headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
        method="POST"
    )
    urllib.request.urlopen(req, timeout=5)
PYEOF
}

# =============================================================================
# =============================================================================
# cmd_destroy — full teardown of a spawned agent
# =============================================================================
cmd_destroy() {
    local name="${1:-}"
    local force=false
    shift || true
    [[ "${1:-}" == "--force" ]] && force=true

    [ -z "${name}" ] && { err "Usage: spawn-machine.sh destroy <name> [--force]"; exit 1; }

    # Load fleet env
    local fleet_env=()
    if [ -f "${FLEET_ENV_CONF}" ]; then
        while IFS='=' read -r k v; do
            [[ "$k" =~ ^#.*$ || -z "$k" ]] && continue
            fleet_env+=("$k=$v")
        done < "${FLEET_ENV_CONF}"
    fi

    # Get values from fleet_env
    get_fleet_var() { local key="$1" val=""
        for kv in "${fleet_env[@]}"; do [[ "${kv%%=*}" == "$key" ]] && val="${kv#*=}"; done; echo "$val"; }

    # Read agent from registry
    if ! grep -q "^  ${name}:" "${REGISTRY_FILE}" 2>/dev/null; then
        err "Agent '${name}' not found in registry. Check: spawn-machine.sh list"
        exit 1
    fi
    local coolify_uuid memory_collection
    coolify_uuid=$(python3 -c "
import sys
with open('${REGISTRY_FILE}') as f: content=f.read()
import re
m=re.search(r'  ${name}:\n((?:    .+\n)*)', content)
if m:
    block=m.group(1)
    u=re.search(r'coolify_uuid:\s*(\S+)', block)
    print(u.group(1) if u else '')
" 2>/dev/null || echo "")
    memory_collection="agent_memory_${name}"

    log "Destroying agent '${name}' (coolify_uuid=${coolify_uuid:-unknown})"

    # Confirmation
    if [ "${force}" = "false" ]; then
        echo ""
        echo "  ⚠️  This will permanently delete:"
        echo "     • Coolify app (container + named volume ${name}_agent_home)"
        echo "     • Qdrant collection ${memory_collection}"
        echo "     • Planka user ${name}"
        echo "     • Guacamole connection '${name^} Desktop' + user '${name}'"
        echo "     • S3 data s3://m2o-agents/${name}/"
        echo "     • Registry entry + GitHub branch agents/${name}"
        echo "     • Onboarding session (marked destroyed in API)"
        echo ""
        read -rp "  Type '${name}' to confirm: " confirm
        [ "${confirm}" != "${name}" ] && { log "Aborted."; exit 0; }
    fi

    local errors=0

    # ── 1. Coolify: stop + delete application ────────────────────────────────
    log "[1/7] Deleting Coolify application..."
    if [ -n "${coolify_uuid}" ]; then
        local del_result
        del_result=$(coolify_api DELETE "applications/${coolify_uuid}" 2>&1) && \
            log "  Coolify app deleted" || \
            { log "  Warning: Coolify delete failed: ${del_result}"; ((errors++)); }
    else
        log "  Warning: No coolify_uuid in registry — skipping Coolify delete"
        ((errors++))
    fi

    # ── 2. Qdrant: delete collection ─────────────────────────────────────────
    log "[2/7] Deleting Qdrant collection '${memory_collection}'..."
    local qdrant_url="${QDRANT_URL:-http://memory-qdrant:6333}"
    for kv in "${fleet_env[@]}"; do [[ "${kv%%=*}" == "QDRANT_URL" ]] && qdrant_url="${kv#*=}"; done
    curl -sf -X DELETE "${qdrant_url}/collections/${memory_collection}" -o /dev/null && \
        log "  Qdrant collection deleted" || \
        { log "  Warning: Qdrant delete failed (collection may not exist)"; }

    # ── 3. Planka: delete user ────────────────────────────────────────────────
    log "[3/7] Deleting Planka user '${name}'..."
    local planka_url planka_token planka_email
    planka_url=$(get_fleet_var "PLANKA_URL"); planka_url="${planka_url:-${PLANKA_URL:-}}"
    planka_token=$(get_fleet_var "PLANKA_TOKEN"); planka_token="${planka_token:-${PLANKA_TOKEN:-}}"
    planka_email="${name}@m2o.machinemachine.ai"
    if [ -n "${planka_url}" ] && [ -n "${planka_token}" ]; then
        local user_id
        user_id=$(curl -sf -H "Authorization: Bearer ${planka_token}" \
            "${planka_url}/api/users" | \
            python3 -c "
import json,sys
users=json.load(sys.stdin).get('items',[])
match=[u for u in users if u.get('email','')=='${planka_email}' or u.get('username','')=='${name}']
print(match[0]['id'] if match else '')
" 2>/dev/null || echo "")
        if [ -n "${user_id}" ]; then
            curl -sf -X DELETE -H "Authorization: Bearer ${planka_token}" \
                "${planka_url}/api/users/${user_id}" -o /dev/null && \
                log "  Planka user deleted (id=${user_id})" || \
                { log "  Warning: Planka user delete failed"; ((errors++)); }
        else
            log "  Planka user '${name}' not found — skipping"
        fi
    else
        log "  Planka not configured — skipping"
    fi

    # ── 4. Guacamole: delete connection ───────────────────────────────────────
    log "[4/8] Removing Guacamole connection + user..."
    load_guacamole_creds 2>/dev/null && {
        local guac_token
        guac_token=$(guacamole_token 2>/dev/null) && {
            local conn_id
            conn_id=$(curl -sf \
                "${GUACAMOLE_URL}/api/session/data/mysql/connections?token=${guac_token}" | \
                python3 -c "
import json,sys
conns=json.load(sys.stdin)
match=[v for v in conns.values() if v.get('name','').lower()=='${name} desktop' or v.get('name','').lower()=='${name^} desktop']
print(match[0]['identifier'] if match else '')
" 2>/dev/null || echo "")
            if [ -n "${conn_id}" ]; then
                curl -sf -X DELETE \
                    "${GUACAMOLE_URL}/api/session/data/mysql/connections/${conn_id}?token=${guac_token}" \
                    -o /dev/null && \
                    log "  Guacamole connection deleted (id=${conn_id})" || \
                    { log "  Warning: Guacamole connection delete failed"; ((errors++)); }
            else
                log "  Guacamole connection '${name^} Desktop' not found — skipping"
            fi
            # Delete the per-agent Guacamole user
            curl -sf -X DELETE \
                "${GUACAMOLE_URL}/api/session/data/mysql/users/${name}?token=${guac_token}" \
                -o /dev/null 2>&1 && \
                log "  Guacamole user '${name}' deleted" || \
                log "  Guacamole user '${name}' not found or already removed (non-fatal)"
        }
    } || log "  Guacamole creds not found — skipping"

    # ── 5. S3: purge agent prefix ─────────────────────────────────────────────
    log "[5/8] Purging S3 data s3://m2o-agents/${name}/..."
    local minio_container="minio-e44c04co80oss0wgwkc4g4ok"
    local minio_access minio_secret minio_bucket
    minio_access=$(get_fleet_var "MINIO_ACCESS_KEY"); minio_secret=$(get_fleet_var "MINIO_SECRET_KEY")
    minio_bucket=$(get_fleet_var "MINIO_BUCKET"); minio_bucket="${minio_bucket:-m2o-agents}"
    if [ -n "${minio_access}" ] && [ -n "${minio_secret}" ]; then
        local EXEC_ID RESULT
        EXEC_ID=$(sudo curl -s --unix-socket /var/run/docker.sock \
            -X POST "http://localhost/containers/${minio_container}/exec" \
            -H "Content-Type: application/json" \
            -d "{\"Cmd\":[\"sh\",\"-c\",\"mc alias set local http://localhost:9000 ${minio_access} ${minio_secret} 2>/dev/null && mc rm --recursive --force local/${minio_bucket}/${name}/ 2>&1 && echo OK || echo FAIL\"],\"AttachStdout\":true,\"AttachStderr\":true}" | \
            python3 -c "import json,sys; print(json.load(sys.stdin).get('Id',''))" 2>/dev/null || echo "")
        if [ -n "$EXEC_ID" ]; then
            RESULT=$(sudo curl -s --unix-socket /var/run/docker.sock \
                -X POST "http://localhost/exec/${EXEC_ID}/start" \
                -H "Content-Type: application/json" -d '{"Detach":false}' | strings)
            [[ "$RESULT" == *"OK"* ]] && log "  S3 data purged" || log "  Warning: S3 purge result: ${RESULT}"
        else
            log "  Warning: Could not exec into Minio container"
            ((errors++))
        fi
    else
        log "  Minio not configured — skipping S3 purge"
    fi

    # ── 6. Registry: remove agent entry ──────────────────────────────────────
    log "[6/8] Removing from registry.yaml..."
    python3 - << PYEOF
import re, sys
with open('${REGISTRY_FILE}') as f:
    content = f.read()
# Remove the agent block (name + all indented lines below it)
pattern = r'(?m)^  ${name}:\n(?:    .+\n)*'
new_content = re.sub(pattern, '', content)
with open('${REGISTRY_FILE}', 'w') as f:
    f.write(new_content)
print('  Registry entry removed')
PYEOF

    # ── 7. GitHub: delete per-agent branch ────────────────────────────────────
    log "[7/8] Deleting GitHub branch agents/${name}..."
    local repo="machine-machine/m2-desktop"
    if gh api "repos/${repo}/git/refs/heads/agents/${name}" &>/dev/null; then
        gh api --method DELETE "repos/${repo}/git/refs/heads/agents/${name}" > /dev/null 2>&1 && \
            log "  Deleted branch agents/${name}" || { log "  Warning: could not delete branch"; ((errors++)); }
    else
        log "  Branch agents/${name} not found — skipping"
    fi

    # ── 8. Onboarding session: mark destroyed ────────────────────────────────
    log "[8/8] Marking onboarding session destroyed..."
    local onboard_api onboard_admin_token
    onboard_api=$(get_fleet_var "ONBOARD_API_URL"); onboard_api="${onboard_api:-https://api.machinemachine.ai}"
    onboard_admin_token=$(get_fleet_var "ONBOARD_ADMIN_TOKEN")
    if [ -n "${onboard_admin_token}" ]; then
        HTTP=$(curl -sf -X POST "${onboard_api}/v1/admin/mark-destroyed" \
            -H "Content-Type: application/json" \
            -H "x-admin-token: ${onboard_admin_token}" \
            -d "{\"agent_name\":\"${name}\"}" \
            -w "%{http_code}" -o /dev/null 2>/dev/null)
        [ "${HTTP}" = "200" ] && \
            log "  Onboarding session marked destroyed" || \
            log "  Onboarding session not found or already cleaned (HTTP ${HTTP}) — non-fatal"
    else
        log "  ONBOARD_ADMIN_TOKEN not set — skipping session cleanup"
    fi

    # ── Summary ───────────────────────────────────────────────────────────────
    echo ""
    if [ "${errors}" -eq 0 ]; then
        log "✅ Agent '${name}' fully destroyed — all resources cleaned up"
    else
        log "⚠️  Agent '${name}' destroyed with ${errors} warning(s) — check log above"
    fi
}

# Main
# =============================================================================
COMMAND="${1:-help}"
shift || true

case "${COMMAND}" in
    spawn)
        require_agent_name "${1:-}"
        true # telegram_token now optional
        cmd_spawn "$@"
        ;;
    init)
        require_agent_name "${1:-}"
        cmd_init "$1"
        ;;
    configure)
        require_agent_name "${1:-}"
        cmd_configure "$1"
        ;;
    register)
        require_agent_name "${1:-}"
        cmd_register "$1"
        ;;
    validate)
        require_agent_name "${1:-}"
        cmd_validate "$1"
        ;;
    destroy)
        require_agent_name "${1:-}"
        cmd_destroy "$@"
        ;;
    status)
        cmd_status "${1:-}"
        ;;
    list)
        cmd_list
        ;;
    help|--help|-h)
        echo "Spawn Machine — Agent Factory CLI"
        echo ""
        echo "Usage: spawn-machine.sh <command> [agent-name]"
        echo ""
        echo "Commands:"
        echo "  spawn <name> <token> [opts]  Spawn agent end-to-end (⭐ use this)"
        echo "    --anthropic-key KEY         Per-agent Anthropic key"
        echo "    --openrouter-key KEY        Per-agent OpenRouter key"
        echo "    --cerebras-key KEY          Per-agent Cerebras key"
        echo "    --skills LIST               Override default AGENT_SKILLS"
        echo "    --no-deploy                 Configure but don't deploy yet"
        echo "  destroy <name> [--force]  Fully decommission an agent (7 cleanup steps)"
        echo "  init <name>       Create incubator directory + agent spec"
        echo "  configure <name>  Generate env vars from agent spec"
        echo "  register <name>   Register agent in Guacamole"
        echo "  validate <name>   Run health checks on deployed agent"
        echo "  status [name]     Show status of one or all agents"
        echo "  list              List all agents in incubator"
        echo ""
        echo "Fleet env config: ${FLEET_ENV_CONF}"
        ;;
    *)
        err "Unknown command: ${COMMAND}"
        err "Run 'spawn-machine.sh help' for usage"
        exit 1
        ;;
esac