gdkbox 0.1.8 → 0.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1c7b818ffd457d8f32f3d80073585222be0140ba3ae5c32a76b587bae5a98f5
-  data.tar.gz: 35b56df278015bbf0ad44cf175665c481cddd3939bc2130a5b72d193aec44c90
+  metadata.gz: b71b4f7e72836332b32feca0a6e3e0c485f8255fcfb0f1dc93c7792c3f6fc5ab
+  data.tar.gz: 66e0331f211fd1df2b67694e42e65d8971502615b42c61093f86a3a465e06425
 SHA512:
-  metadata.gz: d0fd71a1460e658cd975298666fc7afaa1110a2b154a0da005bc80c7c4e9bdb21545ab544091c5a2f2773eab48e2e9520311e24b39c16962a7ae2416b9024bcf
-  data.tar.gz: 44638a681108d58ddafdb1a9d4703f5a1f84cd6da764dae608d25ead66a3ebba8f4bb9057d57c38176ecd4f3c49e5c6809636c159c5c8ebbd0803c4b0ff2415d
+  metadata.gz: b70d9d914b6ce31f0a644cae9260a98adb3540b0d76555a1ed4e72fc423b9602deb84b338b1b91cf29bf455546b248e875dbfa2e7fdc5dafc9b37322cb2d58be
+  data.tar.gz: 73ebbfbfb11732b3d5fb9f40ea0d795a846c61ccb24d513c51684542424d2d78a7eef919e03d5d2007f64df3c3f0704cb75f07dbc3e7b494f90f9ae892daec43

data/README.md

@@ -90,6 +90,9 @@ Or run it straight from the checkout without installing:
 | `gdkbox claude NAME` | Install Claude Code inside the box. |
 | `gdkbox set-key NAME` | Seed/rotate the Anthropic API key in the box for unattended dispatch. |
 | `gdkbox set-host` | Add the `gdk.local` entry to your `/etc/hosts` so box web UIs resolve (`--remove` to undo). Also runs during `up`. |
+| `gdkbox set-git NAME` | Seed your git identity (`user.name`/`user.email`) into the box so `git commit` works. Also runs during `up`. |
+| `gdkbox set-remote NAME [REMOTE]` | Point the box's GitLab checkout at a different remote (URL or `namespace/project`, e.g. `gitlab-org/gitlab`); default from config.yml. |
+| `gdkbox hydrate NAME` | Backfill the box's treeless GitLab clone so deep rebases/blame/bisect work (`--trees` for a much smaller trees-only fetch). |
 | `gdkbox start NAME` | Start a stopped box (and re-enable SSH). |
 | `gdkbox stop NAME` | Stop a running box. |
 | `gdkbox rm NAME` | Remove a box: container, metadata, and SSH entry. |
@@ -110,6 +113,7 @@ Or run it straight from the checkout without installing:
 | `--harness ID` | `claude` (or config.yml) | Agent harness to install: claude, codex, opencode, pi. |
 | `--no-agent` | (agent installed) | Skip installing the agent harness. |
 | `--skill NAME [NAME...]` | (none) | Seed skill(s) into the box at creation for dispatched agents. |
+| `--gitlab-remote REMOTE` | config.yml, else image default | Point the GitLab checkout at this remote (URL or `namespace/project`); the image ships pointing at the community mirror. |
 
 ## Typical workflow
 
@@ -133,6 +137,23 @@ gdkbox stop demo
 gdkbox rm demo
 ```
 
+### Working with git history in a box
+
+The image's GitLab checkout is a **treeless clone** (`--filter=tree:0`, ~550 MB
+instead of many GB). Day-to-day work near `master` is fine, but operations that
+span a large history gap — rebasing a branch hundreds of commits behind,
+`git blame` or `git bisect` across old ranges — trigger storms of lazy object
+fetches and fail with errors like `could not fetch <sha> from promisor remote`
+(not merge conflicts, even when a rebase reports failure). Either keep branches
+current and do deep-history work elsewhere, or hydrate the box once:
+
+```sh
+gdkbox hydrate demo --trees   # fetch missing trees only: much smaller, usually
+                              # enough for deep rebases (blobs stay lazy)
+gdkbox hydrate demo           # full backfill: several GB, then the clone
+                              # behaves like a normal full clone
+```
+
 ## Orchestrating a fleet of agents
 
 The end goal of `gdkbox` is to back an **orchestrator** that runs a pool of

data/lib/gdkbox/box.rb

@@ -137,6 +137,15 @@ module GDKBox
       )
       @store.save(@data)
 
+      # Best-effort: a host without a git identity (or a transient exec
+      # failure) should not abort the box; `gdkbox set-git` can seed it later.
+      begin
+        git_name, git_email = host_git_identity
+        provisioner.setup_git_identity(cname, name: git_name, email: git_email) if git_name || git_email
+      rescue StandardError
+        nil
+      end
+
       provisioner.setup_agent(cname, harness) if install_agent
       @data["agent_installed"] = install_agent
 
@@ -166,6 +175,75 @@ module GDKBox
       @store.delete(name)
     end
 
+    # The full git URL for a remote given as a URL or a "namespace/project"
+    # shorthand (expanded against gitlab.com over SSH, so pushes ride the
+    # forwarded agent).
+    def self.expand_remote(token)
+      return token if token.include?("://") || token.include?(":")
+
+      "git@gitlab.com:#{token}.git"
+    end
+
+    # The host an SSH-style git URL connects to, or nil for non-SSH remotes
+    # (https needs no SSH client preparation).
+    def self.remote_ssh_host(url)
+      if (m = url.match(%r{\Assh://(?:[^@/]+@)?([^:/]+)}))
+        m[1]
+      elsif (m = url.match(/\A(?:[^@:\/]+@)([^:]+):/))
+        m[1]
+      end
+    end
+
+    # Point the box's GitLab checkout at a different remote (URL or
+    # "namespace/project"). SSH remotes get the box's SSH client prepared
+    # first (host key acceptance + connection multiplexing) so the follow-up
+    # fetch — and later lazy fetches from the treeless clone — succeed.
+    # Returns the URL that origin now uses.
+    def set_gitlab_remote!(remote)
+      url = self.class.expand_remote(remote)
+      provisioner = Provisioner.new(docker: @docker, config: @config)
+      if (host = self.class.remote_ssh_host(url))
+        provisioner.setup_git_ssh(container_name, host)
+      end
+      provisioner.setup_gitlab_remote(container_name, url)
+      url
+    end
+
+    # Backfill the box's treeless GitLab clone so deep-history operations
+    # (old rebases, blame, bisect) work. trees: true fetches only the missing
+    # trees (much smaller; file contents stay lazy). Prepares the SSH client
+    # first when origin is an SSH remote — a refetch without multiplexing
+    # would hit the same throttling the lazy fetches do. Streams git's
+    # progress lines to the block.
+    def hydrate!(trees: false, &progress)
+      provisioner = Provisioner.new(docker: @docker, config: @config)
+      origin = @docker.exec(
+        container_name, "git remote get-url origin",
+        user: @config.ssh_user, workdir: @config.gitlab_checkout_path
+      ).stdout.strip
+      if (host = self.class.remote_ssh_host(origin))
+        provisioner.setup_git_ssh(container_name, host)
+      end
+      provisioner.hydrate(container_name, trees: trees, &progress)
+    end
+
+    # Seed a git identity into the box so `git commit` works there. Falls back
+    # to the host's `git config` when name/email are not given; raises when
+    # neither source has anything to seed. Returns the [name, email] seeded.
+    def set_git_identity!(git_name: nil, git_email: nil)
+      host_name, host_email = host_git_identity
+      git_name ||= host_name
+      git_email ||= host_email
+      if git_name.nil? && git_email.nil?
+        raise Error, "No git identity found. Pass --name/--email or set " \
+          "`git config --global user.name/user.email` on the host."
+      end
+
+      Provisioner.new(docker: @docker, config: @config)
+        .setup_git_identity(container_name, name: git_name, email: git_email)
+      [git_name, git_email]
+    end
+
     # (Re)install this box's agent harness inside the container.
     def install_agent!
       Provisioner.new(docker: @docker, config: @config).setup_agent(container_name, harness)
@@ -267,6 +345,15 @@ module GDKBox
 
     private
 
+    # The host's git identity as [name, email], each nil when unset.
+    def host_git_identity
+      read = lambda do |key|
+        value = @shell.run("git", "config", "--get", key).stdout.strip
+        value.empty? ? nil : value
+      end
+      [read.call("user.name"), read.call("user.email")]
+    end
+
     # Choose free host ports and persist a preliminary record claiming them,
     # all while holding an exclusive lock so concurrent `create!` calls in
     # separate processes serialize and cannot pick the same ports. Returns the

data/lib/gdkbox/cli.rb

@@ -37,6 +37,9 @@ module GDKBox
       desc: "Skill name(s) or path(s) to install into the box for dispatched agents"
     option :default_skills, type: :boolean, default: true,
       desc: "Also install the default skills from ~/.gdkbox/config.yml"
+    option :gitlab_remote, type: :string,
+      desc: "Point the GitLab checkout at this remote (URL or namespace/project; " \
+        "default from config.yml, else the image's community mirror)"
     def up(name)
       ensure_docker!
       box = build_box(name)
@@ -55,6 +58,7 @@ module GDKBox
       )
       rewrite_ssh_config
       seed_skills(box)
+      repoint_gitlab_remote(box)
 
       if options[:json]
         puts JSON.generate(box.summary)
@@ -236,6 +240,90 @@ module GDKBox
     end
     map "set-key" => :set_key
 
+    desc "set-git NAME", "Seed your git identity (user.name/email) into the box"
+    long_desc <<~DESC
+      Copies your git identity into the box's global git config so `git
+      commit` works there. Defaults to the host's `git config user.name` and
+      `user.email`; override either with --name/--email. Runs automatically
+      during `gdkbox up`, so this is mainly for boxes created before that or
+      for changing the identity later.
+
+      Pushing uses your host's ssh-agent, forwarded into interactive sessions
+      (`gdkbox ssh` / VS Code) by the generated SSH config — no keys or tokens
+      are stored in the box.
+    DESC
+    option :name, type: :string, desc: "git user.name to seed (defaults to the host's)"
+    option :email, type: :string, desc: "git user.email to seed (defaults to the host's)"
+    def set_git(name)
+      box = load_box!(name)
+      git_name, git_email = box.set_git_identity!(
+        git_name: options[:name], git_email: options[:email]
+      )
+      say "Seeded git identity into '#{name}': #{[git_name, git_email].compact.join(' <')}#{'>' if git_email}", :green
+    end
+    map "set-git" => :set_git
+
+    desc "set-remote NAME [REMOTE]", "Point the box's GitLab checkout at a different remote"
+    long_desc <<~DESC
+      The GDK-in-a-box image clones GitLab from the community mirror
+      (gitlab-community/gitlab-org/gitlab). This repoints the checkout's
+      origin — pass a full git URL or a namespace/project shorthand (expanded
+      to git@gitlab.com:namespace/project.git), or set `gitlab_remote:` in
+      ~/.gdkbox/config.yml and omit REMOTE. Runs `git remote set-url` plus a
+      fetch inside the box; `gdkbox up` does the same automatically when a
+      remote is configured. Pushing uses your forwarded ssh-agent and your own
+      permissions — no credentials are stored in the box.
+    DESC
+    def set_remote(name, remote = nil)
+      box = load_box!(name)
+      remote ||= config.default_gitlab_remote
+      unless remote
+        raise Error, "No remote. Pass REMOTE (URL or namespace/project) " \
+          "or set `gitlab_remote:` in ~/.gdkbox/config.yml."
+      end
+
+      say "Pointing '#{name}' GitLab checkout at #{Box.expand_remote(remote)} (fetching)...", :green
+      url = box.set_gitlab_remote!(remote)
+      say "origin now #{url}.", :green
+    end
+    map "set-remote" => :set_remote
+
+    desc "hydrate NAME", "Backfill the box's treeless GitLab clone (deep rebases, blame, bisect)"
+    long_desc <<~DESC
+      The GDK-in-a-box image clones GitLab treeless (--filter=tree:0), so
+      operations spanning a large history gap — rebasing a branch far behind
+      master, blame or bisect across old ranges — storm the network with lazy
+      fetches and fail. Hydrating backfills the missing objects once.
+
+      By default everything is fetched and the clone becomes a normal full
+      clone (a large one-time download, likely several GB). With --trees only
+      the missing trees are fetched — a fraction of the size, and usually
+      enough for deep rebases; file contents are still fetched lazily as
+      needed. Progress is streamed live.
+    DESC
+    option :trees, type: :boolean, default: false,
+      desc: "Fetch missing trees only (much smaller; blobs stay lazy)"
+    option :force, type: :boolean, default: false, desc: "Skip confirmation"
+    def hydrate(name)
+      box = load_box!(name)
+      unless options[:force]
+        estimate = options[:trees] ? "a sizeable download" : "a large download, likely several GB"
+        return unless yes?("Hydrate '#{name}' (#{estimate})? [y/N]")
+      end
+
+      say "Hydrating '#{name}' (#{options[:trees] ? 'trees only' : 'full'})...", :green
+      tty = $stderr.tty?
+      box.hydrate!(trees: options[:trees]) do |line|
+        if tty
+          $stderr.print("\r\e[K#{line}")
+        elsif !line.include?("%") # skip per-percent spam when piped
+          $stderr.puts(line)
+        end
+      end
+      $stderr.print("\n") if tty
+      say "Done. '#{name}' can now work across the full history.", :green
+    end
+
     desc "set-host", "Add (default) or remove the gdk.local entry in /etc/hosts"
     long_desc <<~DESC
       GDK generates URLs and redirects that use the `gdk.local` hostname, so
@@ -412,6 +500,24 @@ module GDKBox
       end
     end
 
+    # Point the new box's GitLab checkout at the configured remote, when one
+    # is set (--gitlab-remote wins over config.yml; no setting keeps the
+    # image's community mirror). Best-effort like seed_skills: the box is
+    # already up, so a bad remote should warn, not abort. Muted in JSON mode.
+    def repoint_gitlab_remote(box)
+      remote = options[:gitlab_remote] || config.default_gitlab_remote
+      return unless remote
+
+      url = box.set_gitlab_remote!(remote)
+      say "Pointed the GitLab checkout at #{url}.", :green unless options[:json]
+    rescue StandardError => e
+      # Warn on stderr even in --json mode: stdout stays clean JSON, but a
+      # silently failed repoint costs the user a debugging session later
+      # (the box looks fine until the first fetch).
+      warn "gdkbox: could not repoint the GitLab checkout: #{e.message}"
+      warn "gdkbox: retry later with: gdkbox set-remote #{box.name} #{remote}"
+    end
+
     # Ensure gdk.local resolves on the host so the box's web UI is reachable
     # (GDK redirects to that hostname). Adding the entry needs sudo, so warn
     # before any password prompt appears. Failures are non-fatal: the box is

data/lib/gdkbox/completion.rb

@@ -11,7 +11,8 @@ module GDKBox
     SHELLS = %w[bash zsh].freeze
 
     # Subcommands whose first positional argument is an existing box.
-    BOX_COMMANDS = %w[status dispatch ssh code install-agent set-key start stop rm add-skill].freeze
+    BOX_COMMANDS = %w[status dispatch ssh code install-agent set-key set-git set-remote hydrate
+      start stop rm add-skill].freeze
 
     def initialize(cli_class = CLI)
       @cli = cli_class

data/lib/gdkbox/config.rb

@@ -14,6 +14,7 @@ module GDKBox
   #
   #   # ~/.gdkbox/config.yml
   #   image: registry.example.com/my-gdk:latest   # default image for `up`
+  #   gitlab_remote: gitlab-org/gitlab             # repoint the GitLab checkout
   #   skills:                                      # transferred into every box
   #     - gdkbox-fleet
   #     - code-history
@@ -102,6 +103,19 @@ module GDKBox
       key.empty? ? Harness.default : key
     end
 
+    # The git remote to point each box's GitLab checkout at, from config.yml
+    # (`gitlab_remote:`), or nil to keep the image's default (the community
+    # mirror). A URL or a "namespace/project" shorthand.
+    def default_gitlab_remote
+      remote = file_settings["gitlab_remote"].to_s.strip
+      remote.empty? ? nil : remote
+    end
+
+    # Where the GitLab repository lives inside the box.
+    def gitlab_checkout_path
+      File.join(remote_path, "gitlab")
+    end
+
     # An API key read from config.yml under `config_key` (e.g.
     # "anthropic_api_key", "openai_api_key"), or nil. This is a plaintext
     # secret on disk, so it is the lowest-priority source (a flag or the

data/lib/gdkbox/docker.rb

@@ -223,6 +223,21 @@ module GDKBox
       check ? @shell.run!(*cmd, input: input) : @shell.run(*cmd, input: input)
     end
 
+    # Like #exec, but for long-running scripts whose output should be seen
+    # live (e.g. a multi-GB git fetch): runs under a PTY and yields each
+    # output line as it appears. Raises CommandError on a non-zero exit.
+    def exec_stream(name, script, user: nil, workdir: nil, env: {}, &block)
+      cmd = ["docker", "exec"]
+      cmd.push("-u", user) if user
+      cmd.push("-w", workdir) if workdir
+      env.each { |key, value| cmd.push("-e", "#{key}=#{value}") }
+      cmd.push(name, "bash", "-lc", script)
+      result = @shell.stream_tty(*cmd, &block)
+      raise CommandError.new(cmd, result.status, "") unless result.success?
+
+      result
+    end
+
     # Copy a host path into a container at dest (a full destination path).
     def cp_into(name, src, dest)
       @shell.run!("docker", "cp", src, "#{name}:#{dest}")

data/lib/gdkbox/provisioner.rb

@@ -131,6 +131,79 @@ module GDKBox
       done
     BASH
 
+    # Seeds the GDK user's global git identity so `git commit` works inside
+    # the box. Values arrive via the environment (dodging shell quoting) and
+    # blanks are skipped, so a partial host config seeds what it can.
+    GIT_IDENTITY_SETUP = <<~'BASH'
+      set -e
+      [ -n "$GDKBOX_GIT_NAME" ] && git config --global user.name "$GDKBOX_GIT_NAME"
+      [ -n "$GDKBOX_GIT_EMAIL" ] && git config --global user.email "$GDKBOX_GIT_EMAIL"
+      true
+    BASH
+
+    # Prepares the box's SSH client for real git traffic against a remote
+    # host (issue #6, hit when a gitlab_remote is configured):
+    #
+    # - `StrictHostKeyChecking accept-new`: a fresh box has an empty
+    #   known_hosts, so the first fetch would die on host key verification.
+    # - Connection multiplexing: lazy fetches from the treeless clone open
+    #   SSH connections in bursts; gitlab.com throttles that, which surfaces
+    #   as a misleading "Permission denied (publickey)". One shared control
+    #   connection absorbs the burst.
+    #
+    # The stanza is tagged per host, so re-runs are no-ops and different
+    # remotes each get their own block.
+    GIT_SSH_SETUP = <<~'BASH'
+      set -e
+      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
+      config="$HOME/.ssh/config"
+      touch "$config" && chmod 600 "$config"
+      if ! grep -qF "gdkbox:git-ssh $GDKBOX_GIT_HOST" "$config"; then
+        cat >> "$config" <<EOF
+
+      # gdkbox:git-ssh $GDKBOX_GIT_HOST
+      Host $GDKBOX_GIT_HOST
+        StrictHostKeyChecking accept-new
+        ControlMaster auto
+        ControlPath ~/.ssh/cm-%r@%h-%p
+        ControlPersist 20m
+        ServerAliveInterval 30
+      EOF
+      fi
+    BASH
+
+    # Points the GitLab checkout's origin at a different repository. The image
+    # hardcodes the community mirror (gitlab-community/gitlab-org/gitlab);
+    # team members typically want the canonical gitlab-org/gitlab. The mirror
+    # shares its history, so a set-url plus fetch is all it takes (the
+    # checkout is treeless, keeping the fetch cheap).
+    GITLAB_REMOTE_SETUP = <<~'BASH'
+      set -e
+      git remote set-url origin "$GDKBOX_GITLAB_REMOTE"
+      git fetch --quiet origin
+    BASH
+
+    # Backfills the treeless GitLab clone (the image clones with
+    # --filter=tree:0, so operations spanning a large history gap storm the
+    # network with lazy fetches and fail; see #7). Two levels:
+    #
+    # - GDKBOX_HYDRATE_FILTER=blob:none — fetch all missing trees, keep file
+    #   contents lazy. A fraction of the download; enough for deep rebases,
+    #   which mostly storm tree fetches.
+    # - no filter (full) — fetch everything and drop the promisor config;
+    #   the repository behaves like a normal full clone afterwards.
+    HYDRATE = <<~'BASH'
+      set -e
+      if [ -n "$GDKBOX_HYDRATE_FILTER" ]; then
+        git config remote.origin.partialclonefilter "$GDKBOX_HYDRATE_FILTER"
+        git fetch --refetch --progress origin
+      else
+        git config --unset-all remote.origin.partialclonefilter || true
+        git fetch --refetch --progress origin
+        git config --unset remote.origin.promisor || true
+      fi
+    BASH
+
     def initialize(docker:, config:)
       @docker = docker
       @config = config
@@ -168,6 +241,46 @@ module GDKBox
       )
     end
 
+    def setup_git_identity(container_name, name:, email:)
+      @docker.exec(
+        container_name, GIT_IDENTITY_SETUP,
+        user: @config.ssh_user,
+        env: {
+          "GDKBOX_GIT_NAME" => name.to_s,
+          "GDKBOX_GIT_EMAIL" => email.to_s
+        }
+      )
+    end
+
+    # Hydrate the GitLab checkout, streaming git's progress lines to the
+    # block. trees: true fetches trees only (blobs stay lazy).
+    def hydrate(container_name, trees: false, &block)
+      @docker.exec_stream(
+        container_name, HYDRATE,
+        user: @config.ssh_user,
+        workdir: @config.gitlab_checkout_path,
+        env: { "GDKBOX_HYDRATE_FILTER" => (trees ? "blob:none" : "") },
+        &block
+      )
+    end
+
+    def setup_git_ssh(container_name, host)
+      @docker.exec(
+        container_name, GIT_SSH_SETUP,
+        user: @config.ssh_user,
+        env: { "GDKBOX_GIT_HOST" => host }
+      )
+    end
+
+    def setup_gitlab_remote(container_name, url)
+      @docker.exec(
+        container_name, GITLAB_REMOTE_SETUP,
+        user: @config.ssh_user,
+        workdir: @config.gitlab_checkout_path,
+        env: { "GDKBOX_GITLAB_REMOTE" => url }
+      )
+    end
+
     def setup_api_key(container_name, api_key, key_env)
       @docker.exec(
         container_name, API_KEY_SETUP,

data/lib/gdkbox/ssh_config.rb

@@ -32,6 +32,11 @@ module GDKBox
         lines << "  User #{box['ssh_user']}"
         lines << "  IdentityFile #{@config.private_key_path}"
         lines << "  IdentitiesOnly yes"
+        # Forward the host's ssh-agent so `git push` inside the box uses the
+        # user's own keys — which never enter the container, and are only
+        # reachable while a human session is connected (dispatched agents run
+        # via `docker exec` and never see the agent).
+        lines << "  ForwardAgent yes"
         lines << "  StrictHostKeyChecking no"
         lines << "  UserKnownHostsFile /dev/null"
         lines << ""

data/lib/gdkbox/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GDKBox
-  VERSION = "0.1.8"
+  VERSION = "0.1.12"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gdkbox
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.1.12
 platform: ruby
 authors:
 - jotolo