@moondeck/station 0.0.0-stage → 1.0.0

package/images/standard/Dockerfile

@@ -0,0 +1,347 @@
+# syntax=docker/dockerfile:1.7
+#
+# uai standard image — the ONE per-host workbench image (ADR-022).
+#
+# Built once per host at host startup and cached as `uai-standard:dev`.
+# A task reuses this image unchanged unless a selected project declares an
+# `extra` snippet, in which case task-up derives `uai-task-<id>` FROM this
+# image. See ../../../docs/runtime.md.
+#
+# Design points:
+#   - Debian bookworm-slim base, non-root `node` user (home /home/node).
+#   - asdf at /opt/asdf with plugins for nodejs/python/golang/ruby/rust.
+#     Before Compose starts a task, a host-controlled maintenance container
+#     materializes its declared versions into the host-wide /opt/asdf-data
+#     volume. uai-init only installs task-local dependencies afterward.
+#   - A default ~/.tool-versions (asdf global fallback) pins a working Node +
+#     Python so the agent CLIs and a 0-project scratchpad always have a runtime;
+#     a project's own .tool-versions takes precedence (asdf dir walk).
+#   - Claude Code + Codex + code-server installed globally via the root Node.
+#
+# This Dockerfile takes NO build args and substitutes NO placeholders — it is
+# fully static. Per-task variation lives in the derived `uai-task-<id>` image.
+
+FROM debian:bookworm-slim
+
+# ---------------------------------------------------------------------------
+# 0. Pinned versions (single source of truth for this image).
+# ---------------------------------------------------------------------------
+
+# asdf release to clone. Pinned for reproducible builds; bump deliberately.
+ENV ASDF_VERSION=v0.14.1
+
+# Qualified agent builds. These are execution-contract pins: per-command env
+# freshness is requalified before any of them moves.
+ENV UAI_CODEX_CLI_VERSION=0.164.0
+ENV UAI_CURSOR_AGENT_VERSION=2026.10.22-27dcf5f
+ENV UAI_GROK_CLI_VERSION=1.0.70
+
+# ---------------------------------------------------------------------------
+# 1. System packages.
+#
+# build-essential + the -dev libs cover what asdf's nodejs/python/ruby/rust
+# build plugins need to compile a runtime from source on first use. unzip is
+# needed by several asdf plugins; gnupg + ca-certificates for the gh apt repo.
+# iptables is for the secrets proxy's NAT chain (ADR-153); only the runner's
+# one privileged exec runs it, and ca-certificates also installs its CA.
+# ---------------------------------------------------------------------------
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      build-essential \
+      ca-certificates \
+      curl \
+      direnv \
+      git \
+      gnupg \
+      iptables \
+      jq \
+      libbz2-dev \
+      libffi-dev \
+      liblzma-dev \
+      libncurses-dev \
+      libreadline-dev \
+      libsqlite3-dev \
+      libssl-dev \
+      libxml2-dev \
+      libxmlsec1-dev \
+      libyaml-dev \
+      openssh-client \
+      pkg-config \
+      procps \
+      ripgrep \
+      tk-dev \
+      tmux \
+      unzip \
+      util-linux \
+      xz-utils \
+      zlib1g-dev \
+      zsh \
+ && rm -rf /var/lib/apt/lists/*
+
+# ADR-053: agent browser (Playwright/Chromium) runtime libs + the watchable
+# display stack (Xvfb → x11vnc → noVNC). Baked here because the
+# per-container background apt raced session start (headless-stuck MCP
+# server, viewer lagging the preview by minutes — Debian's novnc drags a
+# large Python tree). The Chromium BINARY still comes from the shared
+# uai-playwright volume (downloaded once per host); these are its deps.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 \
+      libxkbcommon0 libatspi2.0-0 libxcomposite1 libxdamage1 libxfixes3 \
+      libxrandr2 libgbm1 libasound2 libpango-1.0-0 libcairo2 \
+      fonts-liberation fonts-unifont \
+      xvfb x11vnc novnc websockify \
+ && rm -rf /var/lib/apt/lists/*
+
+# GitHub CLI (`gh`) — used by the ship/PR flow inside the container.
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+      | tee /usr/share/keyrings/githubcli-archive-keyring.gpg >/dev/null \
+ && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
+ && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+      > /etc/apt/sources.list.d/github-cli.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends gh \
+ && rm -rf /var/lib/apt/lists/*
+
+# uv — fast Python package + venv manager (used by uai-init's Python path).
+# Installed system-wide so both root and node can run it.
+RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
+
+# ---------------------------------------------------------------------------
+# 2. Non-root `node` user.
+#
+# The container runs as `node`; uai-init and the agent CLIs expect
+# /home/node. uid/gid 1000 matches the common host default so bind-mounted
+# worktree files stay writable.
+# ---------------------------------------------------------------------------
+
+RUN groupadd --gid 1000 node \
+ && useradd --uid 1000 --gid 1000 --create-home --home-dir /home/node --shell /bin/bash node
+
+# ---------------------------------------------------------------------------
+# 3. asdf.
+#
+# Clone to /opt/asdf (the code) and point the DATA dir at /opt/asdf-data
+# (the host-wide cache volume mounts there). Both root and node must be able
+# to read the install and write the data dir, so /opt/asdf-data is group
+# owned by `node` and group-writable; the data volume inherits this.
+# ---------------------------------------------------------------------------
+
+ENV ASDF_DIR=/opt/asdf
+ENV ASDF_DATA_DIR=/opt/asdf-data
+ENV ASDF_CONFIG_FILE=/dev/null
+ENV ASDF_DEFAULT_TOOL_VERSIONS_FILENAME=.tool-versions
+ENV COREPACK_HOME=/opt/asdf-data/corepack
+ENV COREPACK_DEFAULT_TO_LATEST=0
+ENV COREPACK_ENABLE_AUTO_PIN=0
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+ENV COREPACK_ENV_FILE=0
+ENV COREPACK_ENABLE_PROJECT_SPEC=1
+ENV COREPACK_ENABLE_STRICT=1
+ENV COREPACK_ENABLE_UNSAFE_CUSTOM_URLS=0
+ENV COREPACK_INTEGRITY_CHECK=1
+ENV COREPACK_ENABLE_NETWORK=0
+ENV COREPACK_NPM_REGISTRY=https://registry.npmjs.org
+# Leave the tool-versions filename at asdf's default (`.tool-versions`) so asdf
+# walks UP from the cwd and a project's /workspace/<slug>/.tool-versions wins.
+# The baked default lives at the node user's home (~/.tool-versions) as asdf's
+# global fallback for tasks with no project file (agent CLIs, scratchpad).
+# Keep ASDF_DEFAULT_TOOL_VERSIONS_FILENAME as the basename above, never an
+# absolute path: an absolute value bypasses project files entirely (it made
+# asdf read only /etc/.tool-versions, ignoring per-project pins).
+
+RUN git clone --depth 1 --branch "$ASDF_VERSION" https://github.com/asdf-vm/asdf.git "$ASDF_DIR" \
+ && mkdir -p "$ASDF_DATA_DIR" \
+ && touch "$ASDF_DATA_DIR/.uai-maintenance.lock" \
+ && chown -R node:node "$ASDF_DIR" "$ASDF_DATA_DIR" \
+ && chmod -R g+rwX "$ASDF_DATA_DIR" \
+ && chmod 0664 "$ASDF_DATA_DIR/.uai-maintenance.lock"
+
+# Make asdf available on PATH + shell init for BOTH root and node, for login
+# and non-login shells (uai-init runs as node via a non-interactive exec).
+#   - asdf.sh sources the shim + completions and prepends the shims dir.
+#   - The shims dir is also added to PATH directly so a bare `docker exec`
+#     (which sources neither profile) still sees installed runtimes.
+ENV PATH=/opt/asdf-data/shims:/opt/asdf/bin:$PATH
+
+RUN printf '%s\n' \
+      '. /opt/asdf/asdf.sh' \
+      > /etc/profile.d/asdf.sh \
+ && chmod 0644 /etc/profile.d/asdf.sh
+
+# Source asdf from each user's bashrc as well (interactive non-login shells,
+# e.g. the code-server terminal) and enable direnv.
+RUN for rc in /root/.bashrc /home/node/.bashrc; do \
+      printf '\n%s\n%s\n' \
+        '. /opt/asdf/asdf.sh' \
+        'eval "$(direnv hook bash)"' >> "$rc"; \
+    done \
+ && chown node:node /home/node/.bashrc
+
+# zsh + oh-my-zsh as the interactive login shell for `node` (the code-server
+# terminal and `docker exec -it`). Installed unattended; the installer writes a
+# default ~/.zshrc (robbyrussell theme, git plugin) which we extend with the
+# same asdf + direnv wiring as .bashrc. Non-interactive execs (uai-init, claude,
+# codex, git) invoke their command directly, so the login-shell change does not
+# affect them.
+RUN su node -c 'sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended' \
+ && printf '\n%s\n%s\n' \
+      '. /opt/asdf/asdf.sh' \
+      'eval "$(direnv hook zsh)"' >> /home/node/.zshrc \
+ && chown node:node /home/node/.zshrc \
+ && usermod -s /usr/bin/zsh node
+
+# ---------------------------------------------------------------------------
+# 4. asdf plugins + the root default runtimes.
+#
+# Plugins are added for all common runtimes; only the root defaults are
+# *installed* at build time. A pre-Compose maintenance container installs
+# project versions into the shared /opt/asdf-data volume.
+#
+# Run as node so the install lands in /opt/asdf-data owned by node.
+# ---------------------------------------------------------------------------
+
+# Default .tool-versions at the node user's home = asdf's GLOBAL fallback, used
+# only when no project /workspace/<slug>/.tool-versions is in scope (agent CLIs,
+# scratchpad tasks). A project file takes precedence via asdf's dir walk. The
+# `tool-versions` file in this directory is the AUTHORITATIVE source.
+COPY tool-versions /home/node/.tool-versions
+COPY --chown=root:root container/corepack-version /usr/local/share/uai/corepack-version
+COPY --chown=root:root container/uai-materialize-runtimes /usr/local/bin/uai-materialize-runtimes
+RUN chmod 0644 /home/node/.tool-versions /usr/local/share/uai/corepack-version \
+ && chmod 0755 /usr/local/bin/uai-materialize-runtimes \
+ && chown node:node /home/node/.tool-versions
+
+USER node
+
+# Add plugins for all common runtimes, then install exactly the versions the
+# default ~/.tool-versions pins (read straight from the file so there is one
+# source of truth). Other versions install in the pre-Compose materializer.
+RUN bash -lc '\
+  set -e; \
+  . /opt/asdf/asdf.sh; \
+  asdf plugin add nodejs https://github.com/asdf-vm/asdf-nodejs.git; \
+  asdf plugin add python https://github.com/asdf-community/asdf-python.git; \
+  asdf plugin add golang https://github.com/asdf-community/asdf-golang.git; \
+  asdf plugin add ruby   https://github.com/asdf-vm/asdf-ruby.git; \
+  asdf plugin add rust   https://github.com/asdf-community/asdf-rust.git; \
+  cd /home/node && asdf install nodejs && asdf install python; \
+'
+
+# ---------------------------------------------------------------------------
+# 5. Global agent CLIs + code-server, via the root-default Node.
+#
+# These are Node programs and must be present even for a 0-project task, so
+# they are installed globally against the asdf-default Node and then reshimmed
+# so `claude` / `codex` / `code-server` resolve through the asdf shims dir
+# (which is on PATH for a bare docker exec).
+# ---------------------------------------------------------------------------
+
+RUN bash -lc '\
+  set -e; \
+  . /opt/asdf/asdf.sh; \
+  COREPACK_VERSION="$(sed -n "1p" /usr/local/share/uai/corepack-version)"; \
+  printf "%s" "$COREPACK_VERSION" | grep -Eq "^[0-9]+\\.[0-9]+\\.[0-9]+$"; \
+  npm install -g @anthropic-ai/claude-code "@openai/codex@$UAI_CODEX_CLI_VERSION" "corepack@$COREPACK_VERSION" \
+    --registry=https://registry.npmjs.org/ \
+    --userconfig=/dev/null \
+    --globalconfig=/dev/uai-empty-npmrc; \
+  corepack enable; \
+  curl -fsSL https://code-server.dev/install.sh | sh -s -- --method standalone --prefix /home/node/.local; \
+  asdf reshim nodejs; \
+  test "$(codex --version)" = "codex-cli $UAI_CODEX_CLI_VERSION"; \
+'
+
+# Optional agent CLIs — installed ONLY when the host has them configured
+# (INSTALL_* build args from standard-image.ts, gated on the operator's creds
+# and folded into the rebuild hash, so a new login rebuilds). Single-binary
+# installs to /home/node/.{kimi-code,grok}/bin; the adapters invoke them by
+# absolute path and task-up copies the subscription creds in. Non-fatal: a CDN
+# hiccup must never break the image for Claude/Codex.
+ARG INSTALL_KIMI=0
+RUN if [ "$INSTALL_KIMI" = "1" ]; then \
+      bash -lc 'curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash' \
+        || echo "[warn] kimi-code install failed — kimi engine unavailable in this image"; \
+    fi
+
+ARG INSTALL_GROK=0
+RUN if [ "$INSTALL_GROK" = "1" ]; then \
+      bash -lc 'set -e; \
+        curl -fsSL https://x.ai/cli/install.sh | bash -s -- "$UAI_GROK_CLI_VERSION"; \
+        case "$("$HOME/.grok/bin/grok" --version)" in \
+          "grok $UAI_GROK_CLI_VERSION "*) ;; \
+          *) exit 1 ;; \
+        esac' \
+        || { \
+          rm -rf -- "$HOME/.grok/bin" "$HOME/.grok/downloads"; \
+          echo "[warn] grok install failed — grok engine unavailable in this image"; \
+        }; \
+    fi
+
+# Cursor Agent (Anysphere) — installs to /home/node/.local/bin/cursor-agent.
+# Auth is CURSOR_API_KEY (env-injected by the adapter), so nothing to copy at
+# task-up — just the binary.
+ARG INSTALL_CURSOR=0
+RUN if [ "$INSTALL_CURSOR" = "1" ]; then \
+      bash -lc 'set -e; \
+        case "$(uname -m)" in \
+          x86_64|amd64) cursor_arch=x64 ;; \
+          aarch64|arm64) cursor_arch=arm64 ;; \
+          *) echo "unsupported Cursor architecture: $(uname -m)" >&2; exit 1 ;; \
+        esac; \
+        cursor_dir="$HOME/.local/share/cursor-agent/versions/$UAI_CURSOR_AGENT_VERSION"; \
+        mkdir -p "$cursor_dir" "$HOME/.local/bin"; \
+        curl -fSL "https://downloads.cursor.com/lab/$UAI_CURSOR_AGENT_VERSION/linux/$cursor_arch/agent-cli-package.tar.gz" \
+          | tar --strip-components=1 -xzf - -C "$cursor_dir"; \
+        ln -sfn "$cursor_dir/cursor-agent" "$HOME/.local/bin/agent"; \
+        ln -sfn "$cursor_dir/cursor-agent" "$HOME/.local/bin/cursor-agent"; \
+        test "$("$HOME/.local/bin/cursor-agent" --version)" = "$UAI_CURSOR_AGENT_VERSION"' \
+        || { \
+          rm -f -- "$HOME/.local/bin/agent" "$HOME/.local/bin/cursor-agent"; \
+          rm -rf -- "$HOME/.local/share/cursor-agent/versions/$UAI_CURSOR_AGENT_VERSION"; \
+          echo "[warn] cursor install failed — cursor engine unavailable in this image"; \
+        }; \
+    fi
+
+# OpenCode (ADR-077) — multi-provider CLI. Installs to /home/node/.opencode/bin;
+# the adapter invokes it by absolute path and task-up copies the provider auth
+# (~/.local/share/opencode/auth.json) in. Non-fatal like the others.
+ARG INSTALL_OPENCODE=0
+RUN if [ "$INSTALL_OPENCODE" = "1" ]; then \
+      bash -lc 'curl -fsSL https://opencode.ai/install | bash' \
+        || echo "[warn] opencode install failed — opencode engine unavailable in this image"; \
+    fi
+
+ENV PATH=/home/node/.local/bin:$PATH
+
+# ---------------------------------------------------------------------------
+# 6. uai-init baked in.
+# ---------------------------------------------------------------------------
+
+USER root
+
+COPY --chown=root:root container/uai-init /usr/local/bin/uai-init
+RUN node_version="$(awk '$1 == "nodejs" { print $2; exit }' /home/node/.tool-versions)" \
+ && test -n "$node_version" \
+ && test -x "/opt/asdf-data/installs/nodejs/$node_version/bin/node" \
+ && ln -s "/opt/asdf-data/installs/nodejs/$node_version/bin/node" /usr/local/bin/node \
+ && chmod 0755 /usr/local/bin/uai-init
+
+# Curated code-server defaults. uai-init seeds these into the per-task User
+# settings dir when none exists (slim chrome, telemetry off, trust off).
+COPY --chown=root:root container/code-server-settings.json /usr/local/share/uai/code-server-settings.json
+
+# ---------------------------------------------------------------------------
+# 7. Default working directory + entrypoint.
+#
+# The container is a long-lived workbench. uai-init (deps + code-server) and
+# the agent CLIs are started by the host via `docker exec` after task-up.
+# ---------------------------------------------------------------------------
+
+USER node
+WORKDIR /workspace
+
+CMD ["sleep", "infinity"]

package/images/standard/README.md

@@ -0,0 +1,167 @@
+# Moondeck standard image
+
+The single per-host workbench image, built once at host startup and cached as
+`moondeck-standard:dev` (ADR-022). Every task reuses it unchanged unless a selected
+project declares an [`extra`](../../../docs/runtime.md#the-extra-escape-hatch)
+snippet, in which case task-up derives `uai-task-<id>` FROM this image.
+
+See [`docs/runtime.md`](../../../docs/runtime.md) for the authoritative spec.
+
+## What's inside
+
+- **Base**: `debian:bookworm-slim`, non-root `node` user (home `/home/node`,
+  uid/gid 1000). The container runs as `node`; uai-init and the agent CLIs
+  expect `/home/node`.
+- **asdf** at `/opt/asdf`, data dir `/opt/asdf-data` (the host-wide
+  `moondeck-asdf-data` volume mounts there read-only in task apps). Plugins
+  pre-added for `nodejs`, `python`, `golang`, `ruby`, `rust`. Only the root
+  defaults are installed at build time; after worktree resolution, a
+  host-controlled pre-start maintenance container is the bounded, locked
+  read-write user that installs and proves other versions before the task app
+  exists.
+- **Default `~/.tool-versions`** (asdf's global fallback, at `/home/node`)
+  pinning a default Node + Python. The `tool-versions` file in this directory is
+  the authoritative source for the numbers; the `Dockerfile` `COPY`s it to
+  `/home/node/.tool-versions` and installs exactly those versions at build time.
+  This guarantees the agent CLIs and a 0-project scratchpad always have a
+  runtime. asdf uses its default `.tool-versions` filename and walks UP from the
+  cwd, so a project's `/workspace/<slug>/.tool-versions` **takes precedence**;
+  the home file is only the fallback. (Do **not** set
+  `ASDF_DEFAULT_TOOL_VERSIONS_FILENAME` to an absolute path — that overrides the
+  search filename and makes asdf ignore per-project files.)
+- **uv uses asdf's Python.** For Python folders, `uai-init` runs
+  `uv venv --python "$(asdf which python)"` so the venv matches the asdf-pinned
+  version (`.tool-versions`) rather than uv's own `.python-version` /
+  `requires-python` discovery, which can disagree or be junk.
+- **Claude Code** + **Codex**, installed globally via the root-default Node
+  (`@anthropic-ai/claude-code`, `@openai/codex`), reshimmed onto the asdf
+  shims dir so `claude` / `codex` resolve under a bare `docker exec`.
+- **code-server** (the Editor pane), **gh**, **git**, **curl**,
+  **ca-certificates**, **jq**, **ripgrep**, **tmux**, **direnv**, **uv**,
+  plus `build-essential` and the `-dev` libraries asdf's build plugins need.
+- **`uai-materialize-runtimes`** baked at
+  `/usr/local/bin/uai-materialize-runtimes`; it is the credential-free,
+  workspace-read-only shared-cache writer used before Compose starts a task.
+  The host supplies the selected project slugs at the fixed, read-only
+  `/run/uai/runtime-projects` allowlist; only those immediate Git worktrees are
+  inspected, so workspace control/shared directories cannot become projects.
+- **`uai-init`** baked at `/usr/local/bin/uai-init`; it installs task-local
+  dependencies and starts code-server, but does not mutate asdf runtimes.
+- **Task-private npm globals** under `/home/node/.local/share/uai-npm`, with
+  cache/logs under `/home/node/.cache/uai-npm`. The shared asdf shims and
+  system controls remain ahead of this prefix's `bin` on `PATH`, and
+  `ASDF_SKIP_RESHIM=1` prevents npm's asdf hook from writing shared shims.
+- `WORKDIR /workspace`; `CMD ["sleep","infinity"]`.
+
+Codex credentials are **not** baked in or mounted — task-up `docker cp`s them
+into `/home/node/.codex` at init (ADR-015 keeps secrets host-side). `~/.claude`
+is bind-mounted read-only by the generated compose.
+
+## Pinned constants (must match the rest of the host runtime)
+
+| Thing | Value |
+| --- | --- |
+| Standard image tag | `moondeck-standard:dev` |
+| Per-task derived image (only with `extra`) | `uai-task-<taskId>` |
+| Shared asdf data volume | app: `moondeck-asdf-data:/opt/asdf-data:ro`; maintenance: `:rw` |
+| Task npm prefix / cache | `/home/node/.local/share/uai-npm` / `/home/node/.cache/uai-npm` |
+| Compose service name | `app` (container `task-<taskId>-app-1`) |
+| In-container workspace | `/workspace` |
+| code-server port | `8080` (inside the container) |
+
+## Build
+
+The host process builds this at startup when the cached digest is missing or
+stale. To build by hand from the repo root:
+
+```bash
+docker build -t moondeck-standard:dev host-agent/images/standard
+```
+
+A derived per-task image (when a project has `extra`) is built by `task-up`
+from a generated `.uai/Dockerfile` that is `FROM moondeck-standard:dev` plus the
+concatenated `extra` RUN lines, tagged `uai-task-<id>`.
+
+## Smoke test (no uai involved)
+
+These files are validated at the Phase E smoke test (no Docker in CI), so the
+steps below are for local image iteration only.
+
+```bash
+# 1. Build.
+docker build -t moondeck-standard:dev host-agent/images/standard
+
+# 2. Create the shared asdf data volume + a throwaway Git worktree and the
+#    host-controlled selected-project allowlist.
+docker volume create moondeck-asdf-data
+mkdir -p /tmp/uai-smoke/workspace/demo/.git
+printf 'nodejs 22.11.0\n' > /tmp/uai-smoke/workspace/demo/.tool-versions
+printf '{"name":"demo","packageManager":"pnpm@10.15.0"}\n' \
+  > /tmp/uai-smoke/workspace/demo/package.json
+printf 'demo\n' > /tmp/uai-smoke/runtime-projects
+
+# 3. Materialize before the app exists, the way task-up does.
+docker run --rm --user node --workdir /workspace \
+  -v /tmp/uai-smoke/workspace:/workspace:ro \
+  -v /tmp/uai-smoke/runtime-projects:/run/uai/runtime-projects:ro \
+  -v moondeck-asdf-data:/opt/asdf-data:rw \
+  moondeck-standard:dev /usr/bin/timeout --signal=TERM --kill-after=10s 600s \
+  /usr/local/bin/uai-materialize-runtimes
+
+# 4. Run the container the way compose would (service `app`, workspace bind,
+#    asdf cache volume, code-server port published on loopback).
+docker run -d --name uai-smoke \
+  -v /tmp/uai-smoke/workspace:/workspace \
+  -v /tmp/uai-smoke/runtime-projects:/run/uai/runtime-projects:ro \
+  -v moondeck-asdf-data:/opt/asdf-data:ro \
+  -e ASDF_SKIP_RESHIM=1 \
+  -e NPM_CONFIG_PREFIX=/home/node/.local/share/uai-npm \
+  -e npm_config_prefix=/home/node/.local/share/uai-npm \
+  -e NPM_CONFIG_CACHE=/home/node/.cache/uai-npm \
+  -e npm_config_cache=/home/node/.cache/uai-npm \
+  -e NPM_CONFIG_LOGS_DIR=/home/node/.cache/uai-npm/_logs \
+  -e npm_config_logs_dir=/home/node/.cache/uai-npm/_logs \
+  -e NPM_CONFIG_UMASK=0002 -e npm_config_umask=0002 \
+  -e 'PATH=/opt/asdf-data/shims:/opt/asdf/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/node/.local/share/uai-npm/bin' \
+  -p 127.0.0.1::8080 \
+  moondeck-standard:dev
+
+# 5. Prove isolation and sanity-check the baked toolchain (bare exec — no
+#    profile sourced).
+docker exec uai-smoke sh -c \
+  '! touch /opt/asdf-data/.uai-app-write-probe 2>/dev/null && test "$(npm config get prefix)" = /home/node/.local/share/uai-npm'
+docker exec uai-smoke bash -lc 'asdf --version && node -v && python --version'
+docker exec uai-smoke claude --version
+docker exec uai-smoke codex --version
+
+# 6. Run uai-init: task-local deps + code-server on 8080.
+docker exec uai-smoke /usr/local/bin/uai-init
+docker exec uai-smoke bash -lc 'curl -sf http://127.0.0.1:8080/healthz || \
+  curl -sf -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8080/'
+
+# 7. Tear down.
+docker rm -f uai-smoke
+```
+
+Expected: step 5 proves the app cannot write the shared cache and npm resolves
+the private prefix, then prints the asdf version and root-default Node +
+Python; `claude` / `codex` resolve; step 6 launches code-server bound to
+`0.0.0.0:8080` and the HTTP probe returns a 2xx/3xx.
+
+## Notes / gotchas
+
+- **Bash 3.2 constraint does NOT apply here.** `uai-init` runs on the Linux
+  base image (bash 5) and may use `shopt`, arrays, etc. The 3.2 constraint is
+  only for host scripts under `host-agent/scripts/agent/`.
+- **First-use asdf cost.** The first task needing a given runtime version pays
+  the download/build time; results persist on `moondeck-asdf-data` for every later
+  task on the host.
+- **Rolling recovery is preserve-and-recreate.** Before shared maintenance, an
+  upgraded host stops legacy writable/non-current apps and leaves their
+  worktrees intact. Docker mount modes are immutable, so only an exact current
+  read-only app can recover in place; explicit Resume recreates anything else.
+- **Ordinary `uai-init` failures remain best-effort.** A failing task-local
+  dependency install logs and is skipped so one bad repo never blocks editor
+  startup. Runtime materialization is separate and fail-closed before the app
+  starts; a workspace runtime-authority violation exits 78 so the host can
+  quarantine the container instead of treating it as ready.

package/images/standard/container/code-server-settings.json

@@ -0,0 +1,63 @@
+{
+  "//": "Moondeck — slimmed code-server defaults. Seeded into the User settings",
+  "//2": "dir by uai-init when none exists yet. Trims welcome/telemetry/chat",
+  "//3": "chrome so the Editor pane is a focused editor, not a full AI-IDE.",
+
+  "telemetry.telemetryLevel": "off",
+  "workbench.startupEditor": "none",
+  "workbench.tips.enabled": false,
+  "workbench.welcomePage.walkthroughs.openOnInstall": false,
+  "window.commandCenter": false,
+  "chat.commandCenter.enabled": false,
+  "chat.viewSessions.enabled": false,
+  "chat.disableAIFeatures": true,
+  "update.mode": "none",
+  "extensions.autoCheckUpdates": false,
+  "extensions.autoUpdate": false,
+  "git.openRepositoryInParentFolders": "always",
+  "workbench.secondarySideBar.defaultVisibility": "hidden",
+
+  "//4": "Colour theme. Overwritten at FIRST init by uai-init when the task",
+  "//5": "carries UAI_EDITOR_THEME (ADR-091); this value is the fallback for",
+  "//6": "tasks created before that shipped, or created outside a browser.",
+  "workbench.colorTheme": "Dark 2026",
+
+  "//7": "An editor, not an IDE (ADR-092). This pane is one of three in a",
+  "//8": "task's right panel and is often half a screen wide, so every bar it",
+  "//9": "does not need is width the code does. Cut here is chrome only: the",
+  "//10": "status bar, the layout buttons, the menu bar, the empty-editor",
+  "//11": "watermark, Open Editors, the minimap and the terminal's chat hint.",
+  "//12": "Breadcrumbs STAY: with the status bar gone they are the only thing",
+  "//13": "naming the path, and a tab reading 'route.ts' is worth little in a",
+  "//14": "repo with eleven of them.",
+  "workbench.statusBar.visible": false,
+  "workbench.layoutControl.enabled": false,
+  "window.menuBarVisibility": "hidden",
+  "workbench.editor.empty.hint": "hidden",
+  "explorer.openEditors.visible": 0,
+  "editor.minimap.enabled": false,
+  "terminal.integrated.initialHint": false,
+
+  "//15": "Hide the activity bar and its custom title strip. Explorer stays",
+  "//16": "open; the Editor pane's own toolbar provides the pointer route to",
+  "//17": "Terminal. Individual pins still live in the BROWSER's IndexedDB; the",
+  "//18": "guarded migration keeps the requested containers ready if a user",
+  "//19": "later restores the bar.",
+  "workbench.activityBar.location": "hidden",
+
+  "//22": "Workspace Trust — every task runs in an isolated container off the",
+  "//23": "user's own repos. The 'do you trust this folder?' prompt is pure",
+  "//24": "friction here; the user already trusts their code and the container",
+  "//25": "is the security boundary.",
+  "security.workspace.trust.enabled": false,
+
+  "//26": "Port forwarding — code-server's own auto-forward / 'Open in Browser'",
+  "//27": "popup can't reach anything useful here: dev servers are exposed",
+  "//28": "through Moondeck's preview tunnel (ADR-025), not code-server's forwarder.",
+  "//29": "Disable it so the popup doesn't mislead.",
+  "remote.autoForwardPorts": false,
+  "remote.restoreForwardedPorts": false,
+
+  "//30": "Integrated terminal uses zsh + oh-my-zsh (the node login shell).",
+  "terminal.integrated.defaultProfile.linux": "zsh"
+}

package/images/standard/container/corepack-version

@@ -0,0 +1 @@
+0.33.0