@inetafrica/open-claudia 3.5.72 → 3.5.73

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 3.5.73
+
+3.5.72 with a smaller bot image, from Sumeet's bot resource plan of 31 Oct. No code changes.
+
+- **One copy of the app in the image** (`Dockerfile`): files are copied in already owned by the bot user instead of being re-written by recursive chmod/chown, which stored /app three times.
+- **No leftover download caches**: each npm install clears its cache in the same step.
+- **One Claude install** that the bot user can run (npm into /usr/local), checked at build time; agent-browser keeps only its linux-x64 binary.
+
 ## 3.5.72
 
 3.5.71 plus the memory fixes tested on Sumeet's Mac from 22 to 28 Oct, released to every bot on his card of 31 Oct ("Release to all bots now, without the Maia rename"). The Maia rename stays on the Mac.

package/Dockerfile

@@ -1,15 +1,30 @@
 # Release image. The slow system layer (apt + chromium, ~250 packages) lives
 # in Dockerfile.base, published as the `:base` tag — rebuilt only when that
 # file changes. This build is minutes: fresh agent CLIs + app source.
+#
+# Size rules (each RUN's leftovers are baked into the image forever):
+#   - every npm install cleans its download cache in the SAME RUN;
+#   - /app is written once, already owned by claudia (COPY --chown, npm ci as
+#     claudia) — no recursive chmod/chown, which would store a second and
+#     third copy of every file in /app as new layers.
 ARG BASE_IMAGE=git.coders.africa:5050/kazee/agent-space/open-claudia:base
 FROM ${BASE_IMAGE}
 
-# Install Claude Code CLI
-RUN curl -fsSL https://claude.ai/install.sh | sh || \
-    npm install -g @anthropic-ai/claude-code
+# Claude Code CLI, one install: the npm global in /usr/local, which is on PATH
+# and readable for the runtime user (1001, HOME=/data). This is the copy pods
+# were already running (/usr/local/bin/claude -> /usr/local/lib/node_modules/
+# @anthropic-ai/claude-code/bin/claude.exe). The old `claude.ai/install.sh | sh`
+# step ran as root and installs into /root/.local, which user 1001 can neither
+# see on PATH nor read — whenever it succeeded, `claude` would be missing in the
+# pod. The postinstall hardlinks the native binary over the bin/claude.exe stub;
+# the size check fails the build if only the stub is left.
+RUN npm install -g @anthropic-ai/claude-code \
+    && test "$(stat -c %s "$(readlink -f /usr/local/bin/claude)")" -gt 1000000 \
+    && npm cache clean --force && rm -rf /root/.npm /tmp/*
 
 # Install OpenAI Codex CLI for the codex backend (unpinned: each image build bakes the then-latest CLI)
-RUN npm install -g @openai/codex
+RUN npm install -g @openai/codex \
+    && npm cache clean --force && rm -rf /root/.npm /tmp/*
 
 # Browser automation for the agent: vercel-labs agent-browser (Rust CLI, token-efficient,
 # replaces Playwright MCP). Installed at build time as root so the non-root runtime user
@@ -17,31 +32,44 @@ RUN npm install -g @openai/codex
 # lives outside the /data VOLUME (build-time writes to /data are discarded at runtime).
 # Pinned: the live Browser view (core/browser-view.js) reads its session files and its
 # screen-stream protocol, which 0.38.x has (built-in stream per session, .stream port files).
-RUN npm install -g agent-browser@0.38.2
+# The package ships a prebuilt binary for every platform (~15-18 MB each); its postinstall
+# points /usr/local/bin/agent-browser at the one for this machine (glibc Linux), so the
+# other six are deleted here.
+RUN npm install -g agent-browser@0.38.2 \
+    && cd "$(npm root -g)/agent-browser/bin" \
+    && keep="agent-browser-linux-$(node -p process.arch)" \
+    && test -x "$keep" \
+    && find . -maxdepth 1 -type f -name 'agent-browser-*' ! -name "$keep" -delete \
+    && case "$(readlink -f /usr/local/bin/agent-browser)" in \
+         "$(pwd -P)/$keep"|"$(pwd -P)/agent-browser.js") ;; \
+         *) echo "agent-browser on PATH points somewhere unexpected" >&2; exit 1 ;; \
+       esac \
+    && npm cache clean --force && rm -rf /root/.npm /tmp/*
 ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/bin/chromium
 
-# Create app directory
+# Create app directory, owned by the runtime user so it can overlay new source
+# into /app for in-place /upgrade (core/handlers.js inPlaceTarballUpgrade).
 WORKDIR /app
+RUN chown claudia:claudia /app
 
-# Copy package files and install
-COPY package*.json ./
-RUN npm ci --production
+# Copy package files and install as claudia, so node_modules is claudia's
+# without a chown pass. The npm cache goes to a scratch dir removed in the same
+# RUN (nothing lands in /root/.npm or /data/.npm).
+COPY --chown=claudia:claudia package*.json ./
+USER claudia
+RUN npm ci --omit=dev --no-audit --no-fund --cache /tmp/oc-npm-cache \
+    && rm -rf /tmp/oc-npm-cache
 
-# Copy app source
-COPY . .
-
-# Ensure app files are readable regardless of host file perms
-RUN chmod -R a+rX /app
+# Copy app source (already claudia's: in-place /upgrade overlays it)
+COPY --chown=claudia:claudia . .
+USER root
 
 # Expose the open-claudia CLI on PATH so spawned agents can send files, manage tasks, etc.
-RUN chmod +x /app/bin/cli.js && ln -s /app/bin/cli.js /usr/local/bin/open-claudia
-
-# Let the runtime user overlay new source into /app for in-place /upgrade.
-RUN chown -R claudia:claudia /app
-
-# Entrypoint auto-configures from env vars on first run
+# Only the two scripts that must be executable are chmod'ed (git tracks both as 755;
+# this keeps it true for checkouts that lost the bit) — not a recursive pass over /app.
 COPY docker-entrypoint.sh /usr/local/bin/
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+RUN chmod 755 /app/bin/cli.js /usr/local/bin/docker-entrypoint.sh \
+    && ln -s /app/bin/cli.js /usr/local/bin/open-claudia
 
 # Set up data directory ownership
 RUN mkdir -p /data/Workspace /data/.open-claudia /data/.claude && \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "3.5.72",
+  "version": "3.5.73",
   "description": "An always-on, provider-agnostic coding-agent harness for Claude Code and OpenAI Codex via chat",
   "main": "bot.js",
   "bin": {

package/test-provider-language.js

@@ -664,10 +664,11 @@ assert.match(pkg.description, /provider-agnostic coding-agent harness/i);
 // reset file up and the bot saved the old max/xhigh back. Same approved
 // rollout (Sumeet, 20 Oct: "set high on all the bots"), now working.
 // Sumeet, 31 Oct 08:02 EAT card 6ae574c5: "Release to all bots now, without
-// the Maia rename". 3.5.72 = 3.5.71 + the Mac memory fixes of 22-28 Oct:
+// the Maia rename". 3.5.73 = 3.5.72 + a smaller image (Sumeet 31 Oct 15:06, bot resource plan: "proceed ... roll out the others").
+// 3.5.72 = 3.5.71 + the Mac memory fixes of 22-28 Oct:
 // topic lessons ride with their pack, .env recall pins, prompt fixes, past
 // chats reach recall, settled decisions, /engine x|mem0, nightly retry.
-assert.strictEqual(pkg.version, "3.5.72", "release version must remain unchanged without explicit approval");
+assert.strictEqual(pkg.version, "3.5.73", "release version must remain unchanged without explicit approval");
 for (const keyword of ["claude", "codex", "coding-agent", "provider-agnostic"]) {
   assert.ok(pkg.keywords.includes(keyword), `package keyword missing: ${keyword}`);
 }