@desplega.ai/agent-swarm 1.20.0 → 1.49.0

package/Dockerfile.worker

@@ -3,7 +3,7 @@
 # Multi-stage build: compiles to standalone binary with full dev environment
 
 # Stage 1: Build the binary
-FROM oven/bun:latest AS builder
+FROM oven/bun:1.3.9 AS builder
 WORKDIR /build
 COPY package.json bun.lock* ./
 RUN bun install --frozen-lockfile
@@ -17,38 +17,41 @@ FROM ubuntu:24.04
 # Prevent interactive prompts during package installation
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Install comprehensive development tools
-RUN apt-get update && apt-get install -y \
-    # Essential tools
-    curl wget ca-certificates gnupg lsb-release \
-    # Version control
+# Use pipefail so pipe failures are caught
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# Install all system packages in a single layer
+# Step 1: bootstrap curl/gnupg so we can add external apt repos
+# Step 2: add NodeSource + GitHub CLI repos, then install everything
+# NOTE: intentionally NOT using --no-install-recommends here — this is a full
+# dev environment where agents build arbitrary projects; recommended packages
+# (setuptools, wheel, less, dev headers, etc.) prevent subtle breakage.
+RUN apt-get update && apt-get install -y curl ca-certificates gnupg \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+       | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+       | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+    && apt-get update && apt-get install -y \
+    wget lsb-release \
     git git-lfs \
-    # Editors
     vim nano \
-    # Build tools
     build-essential make cmake gcc g++ \
-    # Python
     python3 python3-pip python3-venv \
-    # Common utilities
-    jq tree htop unzip zip tar gzip sqlite3 \
-    # Network tools
+    jq tree htop unzip zip tar gzip sqlite3 fuse3 libfuse2 gosu \
     openssh-client \
-    # sudo for package installation
     sudo \
+    nodejs \
+    gh \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Node.js 22.x (LTS)
-RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
-    && apt-get install -y nodejs \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install GitHub CLI
-RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
-    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
-    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
-    && apt-get update \
-    && apt-get install -y gh \
-    && rm -rf /var/lib/apt/lists/*
+# Install GitLab CLI (glab) for GitLab integration
+ARG GLAB_VERSION=1.89.0
+ARG TARGETARCH
+RUN curl -fsSL "https://gitlab.com/api/v4/projects/gitlab-org%2Fcli/packages/generic/glab/${GLAB_VERSION}/glab_${GLAB_VERSION}_linux_${TARGETARCH}.deb" -o /tmp/glab.deb \
+    && dpkg -i /tmp/glab.deb \
+    && rm /tmp/glab.deb
 
 # Install Bun (for running JS/TS projects)
 RUN curl -fsSL https://bun.sh/install | bash
@@ -56,8 +59,9 @@ ENV BUN_INSTALL="/root/.bun"
 ENV PATH="$BUN_INSTALL/bin:$PATH"
 
 # Create non-root user with sudo access (passwordless)
-# NOTE: Claude requires non-root for --dangerously-skip-permissions
-# Worker runs as non-root but CAN use sudo for installing packages
+# NOTE: Container entrypoint runs as root for FUSE mount compatibility.
+# Final exec drops to worker via gosu (Claude rejects --dangerously-skip-permissions as root).
+# Worker user retained for file ownership and Claude process execution.
 RUN useradd -m -s /bin/bash -G sudo worker \
     && echo "worker ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
 
@@ -66,24 +70,51 @@ WORKDIR /home/worker
 ENV HOME=/home/worker
 ENV BUN_INSTALL="/home/worker/.bun"
 
+# Redirect corepack home to user-writable directory (default /usr/lib/node_modules/
+# requires root and causes "operation rejected by your operating system" errors)
+ENV COREPACK_HOME=/home/worker/.corepack
+RUN mkdir -p /home/worker/.corepack
+
 # Install Bun for worker user (need to set HOME explicitly in RUN)
 RUN HOME=/home/worker BUN_INSTALL=/home/worker/.bun curl -fsSL https://bun.sh/install | bash
 ENV PATH="/home/worker/.bun/bin:$PATH"
 
-# Install Claude CLI using official installer
-RUN HOME=/home/worker curl -fsSL https://claude.ai/install.sh | bash
+# Install Claude CLI (pinned version — bump ARG to update)
+ARG CLAUDE_CODE_VERSION=2.1.80
+RUN sudo npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}
 ENV PATH="/home/worker/.local/bin:$PATH"
 
-# Setup .claude directory
-RUN mkdir -p /home/worker/.claude/commands
-RUN mkdir -p /home/worker/.claude/agents
-RUN echo '{"hasCompletedOnboarding":true,"bypassPermissionsModeAccepted":true}' > /home/worker/.claude.json
-
-# Settings with hooks pointing to compiled binary
-RUN echo '{ \
-  "permissions": { "allow": ["mcp__agent-swarm__*"] }, \
+# Install pi-mono CLI (alternative harness, selected via HARNESS_PROVIDER=pi)
+# PI_PACKAGE_DIR tells pi-mono where to find its package.json at runtime
+# (needed because bun --compile makes process.execPath resolve to the binary location)
+RUN sudo npm install -g @mariozechner/pi-coding-agent \
+    && mkdir -p /home/worker/.pi/agent
+ENV PI_PACKAGE_DIR=/usr/lib/node_modules/@mariozechner/pi-coding-agent
+
+# Install Claude marketplace plugins (build-time cache)
+RUN mkdir -p /home/worker/.claude \
+    && claude plugin marketplace add desplega-ai/ai-toolbox || true \
+    && claude plugin install desplega@desplega-ai-toolbox --scope user || true \
+    && claude plugin install agent-swarm@desplega-ai-toolbox --scope user || true \
+    && claude plugin install wts@desplega-ai-toolbox --scope user || true \
+    && claude plugin marketplace add desplega-ai/qa-use || true \
+    && claude plugin install qa-use@desplega.ai --scope user || true \
+    && claude plugin marketplace add mksglu/claude-context-mode || true \
+    && claude plugin install context-mode@claude-context-mode --scope user || true \
+    && claude plugin marketplace add desplega-ai/agent-fs || true \
+    && claude plugin install agent-fs@desplega-ai-agent-fs --scope user || true
+
+# Configure wts for agent mode (no tmux, no auto-Claude)
+RUN mkdir -p /home/worker/.wts \
+    && echo '{"defaults":{"autoTmux":false,"autoClaude":false}}' > /home/worker/.wts/config.json
+
+# Setup .claude directory and settings
+RUN mkdir -p /home/worker/.claude/commands /home/worker/.claude/agents \
+    && echo '{"hasCompletedOnboarding":true,"bypassPermissionsModeAccepted":true}' > /home/worker/.claude.json \
+    && echo '{ \
+  "permissions": { "allow": ["mcp__agent-swarm__*", "mcp__context-mode__*"] }, \
   "enableAllProjectMcpServers": true, \
-  "enabledMcpjsonServers": ["agent-swarm"], \
+  "enabledMcpjsonServers": ["agent-swarm", "context-mode"], \
   "hooks": { \
     "SessionStart": [{"matcher": "*", "hooks": [{"type": "command", "command": "/usr/local/bin/agent-swarm hook"}]}], \
     "UserPromptSubmit": [{"matcher": "*", "hooks": [{"type": "command", "command": "/usr/local/bin/agent-swarm hook"}]}], \
@@ -94,54 +125,54 @@ RUN echo '{ \
   } \
 }' > /home/worker/.claude/settings.json
 
-# Copy binary from builder
+# Install global npm tools (pinned versions for cache stability)
 USER root
+RUN npm install -g \
+    pm2@6.0.14 \
+    @sentry/cli@3.3.0 \
+    @desplega.ai/wts@0.2.2 \
+    @desplega.ai/localtunnel@2.2.0 \
+    @desplega.ai/qa-use@2.8.7 \
+    @desplega.ai/agent-fs@latest \
+    && qa-use install-deps
+
+# Install archil CLI for FUSE/R2-backed disk mounts
+RUN curl https://s3.amazonaws.com/archil-client/install | sh
+
+# Copy binary from builder (changes on every code change — keep late)
 COPY --from=builder /build/agent-swarm /usr/local/bin/agent-swarm
 RUN chmod +x /usr/local/bin/agent-swarm
 
-# Install step (at the end to leverage caching)
-
-# Install PM2 globally for process management
-RUN npm install -g pm2
-
-# Install ai-tracker for tracking AI vs human code changes
-RUN pip3 install --break-system-packages cc-ai-tracker
-
-# Install wts (git worktree manager) globally for agents
-RUN npm install -g @desplega.ai/wts@latest
-
-# Install sentry-cli for issue investigation
-RUN npm install -g @sentry/cli
-
-# Install qa-use (QA tool) globally
-RUN npm install -g @desplega.ai/qa-use@latest
-
-# Install qa-use dependencies
-RUN qa-use install-deps
-
-# Copy commands
+# Copy commands (changes on code change — keep late)
 COPY --chown=worker:worker plugin/commands/* /home/worker/.claude/commands/
 COPY --chown=worker:worker plugin/agents/* /home/worker/.claude/agents/
-COPY --chown=worker:worker plugin/skills/* /home/worker/.claude/skills/
+COPY --chown=worker:worker plugin/skills/ /home/worker/.claude/skills/
 
-# Create directories
-RUN mkdir -p /workspace /logs && chown worker:worker /workspace /logs
+# Copy pi-mono skills (used when HARNESS_PROVIDER=pi)
+COPY --chown=worker:worker plugin/pi-skills/ /home/worker/.pi/agent/skills/
 
+# Create directories and copy entrypoint
+RUN mkdir -p /workspace /logs && chown worker:worker /workspace /logs
 COPY --chown=worker:worker docker-entrypoint.sh /docker-entrypoint.sh
 RUN chmod +x /docker-entrypoint.sh
 
-USER worker
+USER root
 WORKDIR /workspace
-VOLUME ["/logs"]
 
-RUN mkdir -p ./personal ./shared
-VOLUME ["/workspace/personal", "/workspace/shared"]
+# Create mount-point directories (must be empty for Archil FUSE mounts)
+RUN mkdir -p /workspace/personal /workspace/shared
+
+# NOTE: Do NOT use VOLUME for /workspace/shared or /workspace/personal.
+# Fly.io's init sets up volume mount points that prevent FUSE from mounting
+# on top of them (EINVAL). Archil FUSE mounts replace Docker volumes here.
+VOLUME ["/logs"]
 
 # Expose service port for PM2 processes
 EXPOSE 3000
 
 # Environment
 ENV AGENT_ROLE=worker
+ENV HARNESS_PROVIDER=claude
 ENV WORKER_YOLO=false
 ENV MCP_BASE_URL=http://host.docker.internal:3013
 ENV WORKER_LOG_DIR=/logs
@@ -151,6 +182,7 @@ ENV WORKER_SYSTEM_PROMPT_FILE=""
 ENV LEAD_SYSTEM_PROMPT=""
 ENV LEAD_SYSTEM_PROMPT_FILE=""
 ENV STARTUP_SCRIPT_STRICT=true
+ENV TEMPLATE_REGISTRY_URL=https://templates.agent-swarm.dev
 ENV PM2_HOME=/workspace/.pm2
 ENV PATH="/home/worker/.local/bin:/home/worker/.bun/bin:$PATH"