@kokorolx/ai-sandbox-wrapper 2.7.0 → 3.0.1

package/dockerfiles/sandbox/skills/rtk-setup/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: rtk-setup
+description: "One-time setup + ongoing enforcement of RTK (Rust Token Killer) across sessions and subagents. Persists RTK instructions to AGENTS.md and propagates to delegated tasks."
+compatibility: "OpenCode with RTK binary installed"
+metadata:
+  author: Sisyphus
+  version: "1.0.0"
+---
+
+# RTK Setup — Persistent RTK Enforcement
+
+This skill performs **setup** (persist RTK instructions) and **ongoing enforcement** (use rtk, propagate to subagents).
+
+## Phase 1: Detection (ALWAYS run first)
+
+Run these checks before anything else:
+
+```bash
+rtk --version
+```
+
+- If `rtk` is NOT found → **STOP**. Tell the user: "RTK is not installed. Install it first: `cargo install --git https://github.com/rtk-ai/rtk --locked`". Do NOT proceed with setup.
+- If `rtk` IS found → continue.
+
+### Check oh-my-opencode
+
+```bash
+ls ~/.config/opencode/oh-my-opencode.json 2>/dev/null
+```
+
+- If found → omo is installed. Note this for Phase 2.
+- If not found → skip omo-specific steps.
+
+## Phase 2: Setup (persist to AGENTS.md)
+
+Check BOTH of these files for the RTK managed block:
+
+1. **User-level**: `~/.config/opencode/AGENTS.md`
+2. **Project-level**: `./AGENTS.md` (current workspace)
+
+For EACH file, check if `<!-- RTK:START -->` exists. If it does NOT exist, **append** the following managed block to the file (create the file if it doesn't exist). NEVER replace existing content — only append.
+
+```markdown
+<!-- RTK:START -->
+<!-- Managed block - do not edit manually. Updated by: rtk-setup skill -->
+
+## RTK Token Optimizer
+
+This project uses **RTK** (Rust Token Killer) to reduce LLM token consumption by 60-90%.
+
+### Rules for ALL agents (including subagents)
+
+**ALWAYS** prefix these commands with `rtk`:
+
+| Command | Use instead |
+|---------|-------------|
+| `git status/diff/log/add/commit/push/pull` | `rtk git ...` |
+| `ls`, `ls -la` | `rtk ls` |
+| `cat file` | `rtk read file` |
+| `grep pattern .` / `rg pattern` | `rtk grep pattern .` |
+| `npm test` / `cargo test` / `pytest` | `rtk test <cmd>` |
+| `npm run build` / `cargo build` | `rtk err <cmd>` |
+| `gh pr list/view` | `rtk gh pr list/view` |
+| `docker ps` | `rtk docker ps` |
+| `eslint` / `tsc` | `rtk lint` / `rtk tsc` |
+
+**Do NOT** prefix: `npx`, `npm install`, `pip install`, `node`, `python3`, heredocs, piped commands.
+
+<!-- RTK:END -->
+```
+
+### If oh-my-opencode is installed
+
+After updating AGENTS.md files, check if the omo config at `~/.config/opencode/oh-my-opencode.json` has `prompt_append` fields on agents. If it does, inform the user:
+
+> "omo is installed. For maximum coverage, you can add RTK instructions to agent `prompt_append` fields in `oh-my-opencode.json`. This ensures subagents always use rtk even when AGENTS.md is not loaded. Want me to do this?"
+
+**Only modify `oh-my-opencode.json` if the user explicitly confirms.** If they confirm, append this line to the `prompt_append` of `sisyphus-junior` agent (the primary coder):
+
+```
+\n\nRTK: ALWAYS prefix shell commands with `rtk` when available (git, ls, grep, test, build). Example: `rtk git status` not `git status`.
+```
+
+Do NOT modify other agents' prompt_append unless asked.
+
+## Phase 3: Ongoing Enforcement (EVERY time this skill is loaded)
+
+### For the current agent
+
+From this point forward in this session, **you MUST**:
+
+1. **Use `rtk` prefix** for all supported shell commands (see table above)
+2. **Verify rtk is available** before first use: `rtk --version`
+3. If rtk is not available in the current environment, fall back to normal commands silently
+
+### For subagent delegation
+
+When delegating ANY task that involves shell commands (via `task()`, `delegate_task()`, or any delegation mechanism), **ALWAYS** add this to the `MUST DO` section of the delegation prompt:
+
+```
+- Use `rtk` prefix for shell commands when available (git, ls, grep, test, build). Run `rtk --version` first to check. If not installed, use normal commands. Examples: `rtk git status`, `rtk ls`, `rtk grep pattern .`, `rtk test npm test`.
+```
+
+This is NON-NEGOTIABLE. Subagents do not read AGENTS.md, so RTK instructions MUST be passed explicitly in every delegation prompt.
+
+### Quick reference for subagent prompts
+
+Copy-paste this one-liner into MUST DO sections:
+
+> Use `rtk` prefix for all shell commands (git, ls, grep, test, build, docker). Example: `rtk git status` not `git status`. If `rtk` is not found, use normal commands.
+
+## Summary
+
+| Phase | When | What |
+|-------|------|------|
+| Detection | Always first | Check rtk installed, check omo |
+| Setup | Once (idempotent) | Append RTK block to AGENTS.md (user + project) |
+| Enforcement | Every session | Use rtk yourself, propagate to all subagents |

package/lib/AGENTS.md

@@ -49,6 +49,20 @@ lib/
 | CodeServer | `install-codeserver.sh` | VSCode browser |
 | VSCode | `install-vscode.sh` | Desktop X11 |
 
+## File Writing Rules (MANDATORY)
+
+**NEVER write an entire file at once.** Always use chunk-by-chunk editing:
+
+1. **Use the Edit tool** (find-and-replace) for all file modifications — insert, update, or delete content in targeted chunks
+2. **Only use the Write tool** for brand-new files that don't exist yet, AND only if the file is small (< 50 lines)
+3. **For new large files (50+ lines):** Write a skeleton first (headers/structure only), then use Edit to fill in each section chunk by chunk
+4. **Why:** Writing entire files at once causes truncation, context window overflow, and silent data loss on large files
+
+**Anti-patterns (NEVER do these):**
+- `Write` tool to overwrite an existing file with full content
+- `Write` tool to create a file with 100+ lines in one shot
+- Regenerating an entire file to change a few lines
+
 ## Conventions
 
 - Scripts use `set -e` for fail-fast

package/lib/build-sandbox.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+set -e
+
+TOOLS="${TOOLS:-}"
+if [[ -z "$TOOLS" ]]; then
+  echo "❌ No tools selected. Set TOOLS=tool1,tool2,..."
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$PROJECT_DIR"
+
+SANDBOX_DIR="dockerfiles/sandbox"
+mkdir -p "$SANDBOX_DIR"
+
+echo "🔄 Generating unified sandbox Dockerfile..."
+echo "   Tools: $TOOLS"
+
+GENERATE_ONLY=1 INSTALL_RTK="${INSTALL_RTK:-0}" \
+  INSTALL_PLAYWRIGHT_MCP="${INSTALL_PLAYWRIGHT_MCP:-0}" \
+  INSTALL_CHROME_DEVTOOLS_MCP="${INSTALL_CHROME_DEVTOOLS_MCP:-0}" \
+  INSTALL_PLAYWRIGHT="${INSTALL_PLAYWRIGHT:-0}" \
+  INSTALL_RUBY="${INSTALL_RUBY:-0}" \
+  INSTALL_SPEC_KIT="${INSTALL_SPEC_KIT:-0}" \
+  INSTALL_UX_UI_PROMAX="${INSTALL_UX_UI_PROMAX:-0}" \
+  INSTALL_OPENSPEC="${INSTALL_OPENSPEC:-0}" \
+  bash "$SCRIPT_DIR/install-base.sh"
+
+BASE_DOCKERFILE="dockerfiles/base/Dockerfile"
+if [[ ! -f "$BASE_DOCKERFILE" ]]; then
+  echo "❌ Base Dockerfile not found at $BASE_DOCKERFILE"
+  exit 1
+fi
+
+BASE_CONTENT=$(cat "$BASE_DOCKERFILE")
+BASE_PREAMBLE=$(echo "$BASE_CONTENT" | sed '/^USER agent$/,$d')
+
+{
+  echo "$BASE_PREAMBLE"
+  echo ""
+
+  IFS=',' read -ra TOOL_ARRAY <<< "$TOOLS"
+  for tool in "${TOOL_ARRAY[@]}"; do
+    tool=$(echo "$tool" | tr -d ' ')
+    INSTALL_SCRIPT="$SCRIPT_DIR/install-${tool}.sh"
+    
+    if [[ ! -f "$INSTALL_SCRIPT" ]]; then
+      echo "⚠️  Warning: No install script for '$tool', skipping" >&2
+      continue
+    fi
+    
+    echo "# === $tool ===" 
+    SNIPPET_MODE=1 source "$INSTALL_SCRIPT"
+    dockerfile_snippet
+    echo ""
+  done
+
+  echo "USER agent"
+  echo "ENV HOME=/home/agent"
+  echo "CMD [\"bash\"]"
+} > "$SANDBOX_DIR/Dockerfile"
+
+if [[ -d "dockerfiles/base/skills" ]]; then
+  cp -r "dockerfiles/base/skills" "$SANDBOX_DIR/"
+fi
+
+echo "✅ Dockerfile generated at $SANDBOX_DIR/Dockerfile"
+
+echo "🔨 Building ai-sandbox:latest..."
+HOST_UID=$(id -u)
+docker build ${DOCKER_NO_CACHE:+--no-cache} \
+  --build-arg AGENT_UID="${HOST_UID}" \
+  -t "ai-sandbox:latest" "$SANDBOX_DIR"
+
+echo "✅ ai-sandbox:latest built successfully"
+
+SANDBOX_CONFIG="$HOME/.ai-sandbox/config.json"
+if command -v jq &>/dev/null && [[ -f "$SANDBOX_CONFIG" ]]; then
+  TOOLS_JSON=$(echo "$TOOLS" | tr ',' '\n' | jq -R . | jq -s .)
+  jq --argjson tools "$TOOLS_JSON" '.tools.installed = $tools' "$SANDBOX_CONFIG" > "$SANDBOX_CONFIG.tmp" \
+    && mv "$SANDBOX_CONFIG.tmp" "$SANDBOX_CONFIG"
+  chmod 600 "$SANDBOX_CONFIG"
+  echo "✅ Saved tools list to $SANDBOX_CONFIG"
+fi
+
+echo ""
+echo "🎉 Sandbox ready with tools: $TOOLS"
+echo "   Run: docker run --rm -it ai-sandbox:latest"

package/lib/install-aider.sh

@@ -1,7 +1,17 @@
 #!/usr/bin/env bash
 set -e
 
-# Aider installer: Python-based AI coding assistant
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER agent
+RUN python3 -m pip install --break-system-packages aider-install && aider-install
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="aider"
 
 echo "Installing $TOOL (Python-based AI pair programmer)..."

package/lib/install-amp.sh

@@ -1,7 +1,21 @@
 #!/usr/bin/env bash
 set -e
 
-# Amp installer: Sourcegraph's AI coding assistant
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN mkdir -p /usr/local/lib/amp && \
+    cd /usr/local/lib/amp && \
+    bun init -y && \
+    bun add @sourcegraph/amp && \
+    ln -s /usr/local/lib/amp/node_modules/.bin/amp /usr/local/bin/amp
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="amp"
 
 echo "Installing $TOOL (Sourcegraph Amp)..."
@@ -15,20 +29,14 @@ mkdir -p "$HOME/.ai-sandbox/tools/$TOOL/home"
 cat <<'EOF' > "dockerfiles/$TOOL/Dockerfile"
 FROM ai-base:latest
 
-# Switch to root only for installing bun globally (needed for the system)
 USER root
-RUN npm install -g bun
-USER agent
-
-# Install Amp into user directory
-RUN mkdir -p /home/agent/lib/amp && \
-    cd /home/agent/lib/amp && \
+RUN mkdir -p /usr/local/lib/amp && \
+    cd /usr/local/lib/amp && \
     bun init -y && \
-    bun add @sourcegraph/amp
-
-# Add the node_modules .bin to PATH
-ENV PATH="/home/agent/lib/amp/node_modules/.bin:${PATH}"
+    bun add @sourcegraph/amp && \
+    ln -s /usr/local/lib/amp/node_modules/.bin/amp /usr/local/bin/amp
 
+USER agent
 ENTRYPOINT ["amp"]
 EOF
 

package/lib/install-auggie.sh

@@ -1,7 +1,22 @@
 #!/usr/bin/env bash
 set -e
 
-# Auggie CLI installer: Augment Code's AI assistant
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN mkdir -p /usr/local/lib/auggie && \
+    cd /usr/local/lib/auggie && \
+    bun init -y && \
+    bun add @augmentcode/auggie && \
+    ln -s /usr/local/lib/auggie/node_modules/.bin/auggie /usr/local/bin/auggie
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="auggie"
 
 echo "Installing $TOOL (Augment Auggie CLI)..."

package/lib/install-base.sh

@@ -49,6 +49,22 @@ RUN cargo install --git https://github.com/rtk-ai/rtk --locked
   ADDITIONAL_TOOLS_INSTALL+='# Install RTK - token optimizer for AI coding agents (built from source)
 COPY --from=rtk-builder /usr/local/cargo/bin/rtk /usr/local/bin/rtk
 '
+  # Copy RTK OpenCode skills into build context so they can be COPY'd into the image
+  SCRIPT_BASE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  RTK_SKILLS_SRC="${SCRIPT_BASE_DIR}/../skills"
+  if [[ -d "$RTK_SKILLS_SRC/rtk" && -d "$RTK_SKILLS_SRC/rtk-setup" ]]; then
+    mkdir -p "dockerfiles/base/skills/rtk" "dockerfiles/base/skills/rtk-setup"
+    cp "$RTK_SKILLS_SRC/rtk/SKILL.md" "dockerfiles/base/skills/rtk/SKILL.md"
+    cp "$RTK_SKILLS_SRC/rtk-setup/SKILL.md" "dockerfiles/base/skills/rtk-setup/SKILL.md"
+    ADDITIONAL_TOOLS_INSTALL+='# Install RTK OpenCode skills (auto-discovered by OpenCode agents)
+RUN mkdir -p /home/agent/.config/opencode/skills/rtk /home/agent/.config/opencode/skills/rtk-setup
+COPY skills/rtk/SKILL.md /home/agent/.config/opencode/skills/rtk/SKILL.md
+COPY skills/rtk-setup/SKILL.md /home/agent/.config/opencode/skills/rtk-setup/SKILL.md
+'
+    echo "  ✅ RTK OpenCode skills will be copied into container"
+  else
+    echo "  ⚠️  RTK skills not found at $RTK_SKILLS_SRC — skipping skill installation"
+  fi
 fi
 
 if [[ "${INSTALL_PLAYWRIGHT:-0}" -eq 1 ]]; then
@@ -112,7 +128,7 @@ ENV PATH=$RBENV_ROOT/bin:$RBENV_ROOT/shims:$PATH
 
 RUN rbenv install 3.3.0 && rbenv global 3.3.0 && rbenv rehash
 
-RUN gem install rails -v 8.0.2 && gem install bundler && rbenv rehash
+RUN gem install rails -v 8.0.2 && gem install bundler solargraph && rbenv rehash
 '
 fi
 
@@ -201,10 +217,19 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     xclip \
     wl-clipboard \
     ripgrep \
+    tmux \
+    fd-find \
+    sqlite3 \
+    poppler-utils \
+    qpdf \
+    tesseract-ocr \
     && curl -LsSf https://astral.sh/uv/install.sh | UV_INSTALL_DIR=/usr/local/bin sh \
     && rm -rf /var/lib/apt/lists/* \
     && pipx ensurepath
 
+# Install Python PDF processing tools for PDF skill
+RUN pip3 install --no-cache-dir --break-system-packages pypdf pdfplumber reportlab pytesseract pdf2image
+
 RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
     && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
     && echo "deb [arch=\$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
@@ -212,11 +237,14 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | d
     && apt-get install -y gh \
     && rm -rf /var/lib/apt/lists/*
 
+# Install bun (used by most AI tool install scripts)
+RUN npm install -g bun
+
 # Install pnpm globally using npm (not bun, for stability)
 RUN npm install -g pnpm
 
 # Install TypeScript and LSP tools using npm
-RUN npm install -g typescript typescript-language-server
+RUN npm install -g typescript typescript-language-server pyright vscode-langservers-extracted
 
 # Verify installations
 RUN node --version && npm --version && pnpm --version && tsc --version
@@ -235,6 +263,12 @@ USER agent
 ENV HOME=/home/agent
 EOF
 
+# GENERATE_ONLY mode: write Dockerfile but don't build
+if [[ "${GENERATE_ONLY:-0}" -eq 1 ]]; then
+  echo "✅ Base Dockerfile generated at dockerfiles/base/Dockerfile"
+  exit 0
+fi
+
 echo "Building base Docker image..."
 HOST_UID=$(id -u)
 docker build ${DOCKER_NO_CACHE:+--no-cache} \

package/lib/install-claude.sh

@@ -1,7 +1,27 @@
 #!/usr/bin/env bash
 set -e
 
-# Claude Code installer: Anthropic's AI coding agent (Native Binary)
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends tmux && rm -rf /var/lib/apt/lists/*
+RUN npm install -g @kaitranntt/ccs --ignore-scripts && \
+    mkdir -p /home/agent/.ccs && \
+    chown -R agent:agent /home/agent/.ccs && \
+    which ccs && ccs --version && \
+    sed -i 's/fs\.symlinkSync(sourcePath, targetPath, symlinkType)/fs\.symlinkSync(require("path").relative(require("path").dirname(targetPath), sourcePath), targetPath, symlinkType)/g' /usr/local/lib/node_modules/@kaitranntt/ccs/dist/utils/claude-symlink-manager.js
+RUN export HOME=/root && curl -fsSL https://claude.ai/install.sh | bash && \
+    mkdir -p /usr/local/share && \
+    mv /root/.local/share/claude /usr/local/share/claude && \
+    ln -sf /usr/local/share/claude/versions/$(ls /usr/local/share/claude/versions | head -1) /usr/local/bin/claude
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="claude"
 
 echo "Installing $TOOL (Anthropic Claude Code - Native Binary)..."
@@ -24,12 +44,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends tmux && rm -rf
 RUN npm install -g @kaitranntt/ccs --ignore-scripts && \
     mkdir -p /home/agent/.ccs && \
     chown -R agent:agent /home/agent/.ccs && \
-    which ccs && ccs --version
+    which ccs && ccs --version && \
+    sed -i 's/fs\.symlinkSync(sourcePath, targetPath, symlinkType)/fs\.symlinkSync(require("path").relative(require("path").dirname(targetPath), sourcePath), targetPath, symlinkType)/g' /usr/local/lib/node_modules/@kaitranntt/ccs/dist/utils/claude-symlink-manager.js
 
 # Install Claude Code using official native installer
-RUN curl -fsSL https://claude.ai/install.sh | bash && \
+RUN export HOME=/root && curl -fsSL https://claude.ai/install.sh | bash && \
     mkdir -p /usr/local/share && \
-    mv /home/agent/.local/share/claude /usr/local/share/claude && \
+    mv /root/.local/share/claude /usr/local/share/claude && \
     ln -sf /usr/local/share/claude/versions/$(ls /usr/local/share/claude/versions | head -1) /usr/local/bin/claude
 
 USER agent

package/lib/install-codebuddy.sh

@@ -1,7 +1,22 @@
 #!/usr/bin/env bash
 set -e
 
-# CodeBuddy CLI installer: Tencent's AI assistant
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN mkdir -p /usr/local/lib/codebuddy && \
+    cd /usr/local/lib/codebuddy && \
+    bun init -y && \
+    bun add @tencent-ai/codebuddy-code && \
+    ln -s /usr/local/lib/codebuddy/node_modules/.bin/codebuddy /usr/local/bin/codebuddy
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="codebuddy"
 
 echo "Installing $TOOL (Tencent CodeBuddy CLI)..."

package/lib/install-codex.sh

@@ -1,7 +1,22 @@
 #!/usr/bin/env bash
 set -e
 
-# Codex CLI installer: OpenAI's terminal coding agent
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN mkdir -p /usr/local/lib/codex && \
+    cd /usr/local/lib/codex && \
+    bun init -y && \
+    bun add @openai/codex && \
+    ln -s /usr/local/lib/codex/node_modules/.bin/codex /usr/local/bin/codex
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="codex"
 
 echo "Installing $TOOL (OpenAI Codex CLI)..."

package/lib/install-droid.sh

@@ -1,6 +1,20 @@
 #!/usr/bin/env bash
 set -e
 
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN mkdir -p /home/agent/.factory && chown -R agent:agent /home/agent/.factory && \
+    export HOME=/root && bash -c "curl -fsSL https://app.factory.ai/cli | sh" && \
+    mv /root/.local/bin/droid /usr/local/bin/droid
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 echo "Installing droid (Factory CLI)..."
 
 # Create directories
@@ -12,10 +26,9 @@ mkdir -p "$HOME/.ai-sandbox/tools/droid/home"
 cat <<'EOF' > "dockerfiles/droid/Dockerfile"
 FROM ai-base:latest
 USER root
-RUN mkdir -p /home/agent/.factory && \
-    bash -c "curl -fsSL https://app.factory.ai/cli | sh" && \
-    mv /home/agent/.local/bin/droid /usr/local/bin/droid && \
-    chown -R agent:agent /home/agent/.factory
+RUN mkdir -p /home/agent/.factory && chown -R agent:agent /home/agent/.factory && \
+    export HOME=/root && bash -c "curl -fsSL https://app.factory.ai/cli | sh" && \
+    mv /root/.local/bin/droid /usr/local/bin/droid
 USER agent
 ENTRYPOINT ["bash", "-c", "exec droid \"$@\"", "--"]
 EOF

package/lib/install-gemini.sh

@@ -1,7 +1,22 @@
 #!/usr/bin/env bash
 set -e
 
-# Gemini CLI installer: Google's AI coding agent
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN mkdir -p /usr/local/lib/gemini && \
+    cd /usr/local/lib/gemini && \
+    bun init -y && \
+    bun add @google/gemini-cli && \
+    ln -s /usr/local/lib/gemini/node_modules/.bin/gemini /usr/local/bin/gemini
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="gemini"
 
 echo "Installing $TOOL (Google Gemini CLI)..."

package/lib/install-jules.sh

@@ -1,7 +1,22 @@
 #!/usr/bin/env bash
 set -e
 
-# Jules CLI installer: Google's AI coding assistant
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN mkdir -p /usr/local/lib/jules && \
+    cd /usr/local/lib/jules && \
+    bun init -y && \
+    bun add @google/jules && \
+    ln -s /usr/local/lib/jules/node_modules/.bin/jules /usr/local/bin/jules
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="jules"
 
 echo "Installing $TOOL (Google Jules CLI)..."

package/lib/install-kilo.sh

@@ -1,8 +1,18 @@
 #!/usr/bin/env bash
 set -e
 
-# Kilo Code installer: Multi-model AI coding agent
-# Note: Uses npm instead of bun due to cheerio dependency resolution issue
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN npm install -g @kilocode/cli
+USER agent
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="kilo"
 
 echo "Installing $TOOL (Kilo Code CLI)..."

package/lib/install-openclaw.sh

@@ -1,7 +1,16 @@
 #!/usr/bin/env bash
 set -e
 
-# OpenClaw installer: Uses official Docker Compose setup
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+# openclaw uses docker-compose and is handled separately - no Dockerfile snippet
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="openclaw"
 
 echo "🔄 Installing $TOOL (OpenClaw - Official Docker Compose)..."

package/lib/install-opencode.sh

@@ -1,6 +1,19 @@
 #!/usr/bin/env bash
 set -e
 
+dockerfile_snippet() {
+  cat <<'SNIPPET'
+USER root
+RUN curl -fsSL https://opencode.ai/install | bash && \
+    mv /root/.opencode/bin/opencode /usr/local/bin/opencode && \
+    rm -rf /root/.opencode
+SNIPPET
+}
+
+if [[ "${SNIPPET_MODE:-}" == "1" ]]; then
+  return 0 2>/dev/null || exit 0
+fi
+
 TOOL="opencode"
 OPENCODE_VERSION="${OPENCODE_VERSION:-}"
 
@@ -20,8 +33,8 @@ FROM ai-base:latest
 
 USER root
 RUN curl -fsSL https://opencode.ai/install | bash -s -- --version $OPENCODE_VERSION && \\
-    mv /home/agent/.opencode/bin/opencode /usr/local/bin/opencode && \\
-    rm -rf /home/agent/.opencode
+    mv /root/.opencode/bin/opencode /usr/local/bin/opencode && \\
+    rm -rf /root/.opencode
 
 USER agent
 ENTRYPOINT ["opencode"]
@@ -32,8 +45,8 @@ FROM ai-base:latest
 
 USER root
 RUN curl -fsSL https://opencode.ai/install | bash && \
-    mv /home/agent/.opencode/bin/opencode /usr/local/bin/opencode && \
-    rm -rf /home/agent/.opencode
+    mv /root/.opencode/bin/opencode /usr/local/bin/opencode && \
+    rm -rf /root/.opencode
 
 USER agent
 ENTRYPOINT ["opencode"]