@spunto/build 0.25.0 → 0.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spunto/build",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Spunto's shared Build engine — the devcontainer image protocol and VS Code extension registry clients, with no database, no HTTP framework and no UI.",
   "type": "module",
   "license": "MIT",

package/src/script/setup-script.ts

@@ -447,6 +447,15 @@ function buildFeatureInstallScript(ociRef: string, options?: Record<string, stri
 function buildLocalFeatureInstallScript(featureId: string, scriptFile: string): string | null {
   const scriptContent = localFeatureScript(scriptFile)
   if (!scriptContent) return null
+  return buildInlineFeatureInstallScript(featureId, scriptContent)
+}
+
+/**
+ * A feature whose install script the caller hands over as text — embedded in the recipe like a
+ * local one. What an app that serves its own feature gives (Spunto IDE's `ide.feature`, RFC 0059):
+ * no registry in between, and the recipe's text, so its key, moves with the script.
+ */
+function buildInlineFeatureInstallScript(featureId: string, scriptContent: string): string {
   const encoded = b64(scriptContent)
   return [
     `echo "[feature] ${featureId}: running local install script..."`,
@@ -468,11 +477,15 @@ function buildLocalFeatureInstallScript(featureId: string, scriptFile: string):
 export type ResolvedFeature = { id: string; script: string; ociRef?: string }
 
 function resolveFeatures(
-  features: { id: string; ociRef?: string; options?: Record<string, string> }[],
+  features: { id: string; ociRef?: string; options?: Record<string, string>; script?: string }[],
   warnId?: string,
 ): ResolvedFeature[] {
   const resolved: ResolvedFeature[] = []
   for (const f of features) {
+    if (f.script) {
+      resolved.push({ id: f.id, script: buildInlineFeatureInstallScript(f.id, f.script) })
+      continue
+    }
     const known = AVAILABLE_FEATURES.find((af) => af.id === f.id)
     if (known?.localScript) {
       const script = buildLocalFeatureInstallScript(f.id, known.localScript)
@@ -555,8 +568,14 @@ function commonUtilsOptions(): Record<string, string> {
  * Not strict: a base image where tmux won't install must still produce a usable worker, exactly as
  * the best-effort blocks it replaces did.
  */
-function spuntoPackOptions(params: { sshGatewayPublicKey?: string }): Record<string, string> {
-  return { installSshd: params.sshGatewayPublicKey ? "true" : "false" }
+function spuntoPackOptions(params: { sshGatewayPublicKey?: string; codeServerInPack?: boolean }): Record<string, string> {
+  return {
+    installSshd: params.sshGatewayPublicKey ? "true" : "false",
+    // A platform that installs the IDE apart (`spunto-ide`, Spunto's IDE app — RFC 0059) keeps the
+    // pack to its plumbing: tmux, dtach, sshd. Left out otherwise, so the recipe of a caller that
+    // never asks (spunto-lite) stays the same text.
+    ...(params.codeServerInPack === false ? { installCodeServer: "false" } : {}),
+  }
 }
 
 // The system-wide tmux configuration (mouse, OSC 52 clipboard, 50k scrollback, warm status bar)
@@ -689,11 +708,14 @@ export function defaultVscodeUserSettings(opts?: {
  * 1 → the hand-written blocks (vscode user, code-server, tmux, dtach, sshd).
  * 2 → common-utils + spunto-pack.
  * 3 → spunto-pack 1.1: the IDE wears Spunto's name, icons and themes (coderhammer/features).
+ * 4 → the IDE out of the pack (`codeServerInPack: false`): code-server comes from `spunto-ide`,
+ *     the feature of an IDE app, and only in the image of a project that has one (RFC 0059).
  */
-export const IMAGE_RECIPE_VERSION = 3
+export const IMAGE_RECIPE_VERSION = 4
 
 export function buildImageScript(params: {
-  features: { id: string; ociRef?: string; options?: Record<string, string> }[]
+  /** `script`: the feature's install script itself, embedded as is (an app that serves its own). */
+  features: { id: string; ociRef?: string; options?: Record<string, string>; script?: string }[]
   vscodeExtensions?: string[]
   sshGatewayPublicKey?: string
   /** Project-level DinD opt-in (base image bakes Docker itself, no feature). See projects.dind. */
@@ -703,6 +725,13 @@ export function buildImageScript(params: {
    * `--install-extension` calls below resolve ids against. Absent/unusable = Open VSX.
    */
   extensionsGallery?: string | null
+  /**
+   * Whether spunto-pack installs code-server, as it does by default. `false`: the pack is plumbing
+   * only (tmux, dtach, sshd), and code-server comes from a feature of the caller's — Spunto's IDE
+   * app puts `spunto-ide` among `features` for a project that has an IDE (RFC 0059). Extensions are
+   * then installed only if one of the features brought a code-server.
+   */
+  codeServerInPack?: boolean
 }): { script: string; hasDinD: boolean; resolvedFeatures: ResolvedFeature[]; steps: BuildStep[] } {
   const lines: string[] = ["set -e"]
 
@@ -818,6 +847,18 @@ export function buildImageScript(params: {
       )
     }
     extLines.push('echo "[build] Extensions installed"')
+    // code-server from a feature of the caller's (`codeServerInPack: false`): said plainly when none
+    // brought it, rather than one "command not found" per extension.
+    if (params.codeServerInPack === false) {
+      extLines.splice(
+        0,
+        0,
+        "if ! command -v code-server >/dev/null 2>&1; then",
+        '  echo "[build] No code-server in this image (no IDE feature) — VS Code extensions skipped"',
+        "else",
+      )
+      extLines.push("fi")
+    }
     const n = params.vscodeExtensions.length
     block("extensions", "VS Code extensions", "extensions", `${n} extension${n > 1 ? "s" : ""} · ${registry}`, extLines)
   }
@@ -1229,6 +1270,14 @@ export type StartScriptParams = {
    * assume). For a box where 8080 is taken by the host itself — a Blaxel sandbox's own API.
    */
   idePort?: number
+  /**
+   * Whether the box has an IDE to start — code-server, as it always had. `false`: a project without
+   * an IDE app (RFC 0059) — no extensions copied, no editor settings, no code-server loop; the
+   * terminal (tmux/dtach, the agent's) is not the IDE's and stays.
+   */
+  ide?: boolean
+  /** Settings the IDE app adds to the seeded defaults (`ide.config` → `userSettings`), over them. */
+  ideUserSettings?: Record<string, unknown>
 }
 
 /** code-server's port when the caller doesn't say otherwise. */
@@ -1243,6 +1292,7 @@ function idePortOf(port: number | undefined): number {
 export function buildStartScript(params: StartScriptParams): { script: string; hasDinD: boolean } {
   const { project, sshGatewayPublicKey, colorTabsByProject, extensionsGallery } = params
   const idePort = idePortOf(params.idePort)
+  const ide = params.ide !== false
   const homeDir = "/home/vscode"
   const username = "vscode"
 
@@ -1333,112 +1383,119 @@ export function buildStartScript(params: StartScriptParams): { script: string; h
     "done",
   )
 
-  // ── 4. Copy prebuilt extensions ───────────────────────────────────────────
-  push(
-    "",
-    'if [ -d ' + EXTENSIONS_DIR + ' ] && [ "$(ls -A ' + EXTENSIONS_DIR + ' 2>/dev/null)" ]; then',
-    `  mkdir -p ${homeDir}/.local/share/code-server/extensions`,
-    `  cp -rn ${EXTENSIONS_DIR}/. ${homeDir}/.local/share/code-server/extensions/ 2>/dev/null || true`,
-    `  chown -R ${username}:${username} ${homeDir}/.local`,
-    "fi",
-  )
+  // ── 4–5. The IDE: code-server, its extensions and settings (none without an IDE app) ───
+  if (ide) {
+    // ── 4. Copy prebuilt extensions ───────────────────────────────────────────
+    push(
+      "",
+      'if [ -d ' + EXTENSIONS_DIR + ' ] && [ "$(ls -A ' + EXTENSIONS_DIR + ' 2>/dev/null)" ]; then',
+      `  mkdir -p ${homeDir}/.local/share/code-server/extensions`,
+      `  cp -rn ${EXTENSIONS_DIR}/. ${homeDir}/.local/share/code-server/extensions/ 2>/dev/null || true`,
+      `  chown -R ${username}:${username} ${homeDir}/.local`,
+      "fi",
+    )
 
-  // ── 4b. Seed code-server user settings (no-clobber, stays user-overridable) ─
-  // Reordered window.title + per-project window color make parallel worker tabs
-  // tellable apart at a glance (see defaultVscodeUserSettings). Written no-clobber
-  // (guarded on the file, not `cp -n`) so a user's own settings.json survives restarts.
-  const vscodeSettings = JSON.stringify(
-    defaultVscodeUserSettings({ projectName: project.name, colorByProject: colorTabsByProject }),
-    null,
-    2,
-  )
-  push(
-    "",
-    `mkdir -p ${homeDir}/.local/share/code-server/User`,
-    `if [ ! -f ${homeDir}/.local/share/code-server/User/settings.json ]; then`,
-    `  echo ${JSON.stringify(b64(vscodeSettings))} | base64 -d > ${homeDir}/.local/share/code-server/User/settings.json`,
-    `  chown -R ${username}:${username} ${homeDir}/.local`,
-    "fi",
-  )
+    // ── 4b. Seed code-server user settings (no-clobber, stays user-overridable) ─
+    // Reordered window.title + per-project window color make parallel worker tabs
+    // tellable apart at a glance (see defaultVscodeUserSettings). Written no-clobber
+    // (guarded on the file, not `cp -n`) so a user's own settings.json survives restarts.
+    const vscodeSettings = JSON.stringify(
+      { ...defaultVscodeUserSettings({ projectName: project.name, colorByProject: colorTabsByProject }), ...params.ideUserSettings },
+      null,
+      2,
+    )
+    push(
+      "",
+      `mkdir -p ${homeDir}/.local/share/code-server/User`,
+      `if [ ! -f ${homeDir}/.local/share/code-server/User/settings.json ]; then`,
+      `  echo ${JSON.stringify(b64(vscodeSettings))} | base64 -d > ${homeDir}/.local/share/code-server/User/settings.json`,
+      `  chown -R ${username}:${username} ${homeDir}/.local`,
+      "fi",
+    )
 
-  // ── 4c. Restore the user's PORT secret for code-server's own terminal panel ─
-  // code-server reads $PORT to override --bind-addr (see § 5 below), so its
-  // whole process tree — including the integrated terminal it spawns — inherits
-  // PORT=<idePort> unless corrected. `terminal.integrated.env.linux` lets VS Code
-  // inject env overrides into terminals it spawns without touching the server
-  // process itself, so a `PORT` project secret still reaches the user's shell.
-  // Uses code-server's own bundled node (guaranteed present regardless of the
-  // devcontainer base image) since jq/node aren't guaranteed there.
-  const seedTerminalPortEnv = [
-    "const fs = require('fs')",
-    "const path = process.env.MP_SETTINGS_PATH",
-    "let settings = {}",
-    "try { settings = JSON.parse(fs.readFileSync(path, 'utf8')) } catch {}",
-    "settings['terminal.integrated.env.linux'] = { ...settings['terminal.integrated.env.linux'], PORT: process.env.MP_ORIGINAL_PORT }",
-    "fs.writeFileSync(path, JSON.stringify(settings, null, 2))",
-  ].join("\n")
-  const seedTerminalPortEnvEncoded = b64(seedTerminalPortEnv)
+    // ── 4c. Restore the user's PORT secret for code-server's own terminal panel ─
+    // code-server reads $PORT to override --bind-addr (see § 5 below), so its
+    // whole process tree — including the integrated terminal it spawns — inherits
+    // PORT=<idePort> unless corrected. `terminal.integrated.env.linux` lets VS Code
+    // inject env overrides into terminals it spawns without touching the server
+    // process itself, so a `PORT` project secret still reaches the user's shell.
+    // Uses code-server's own bundled node (guaranteed present regardless of the
+    // devcontainer base image) since jq/node aren't guaranteed there.
+    const seedTerminalPortEnv = [
+      "const fs = require('fs')",
+      "const path = process.env.MP_SETTINGS_PATH",
+      "let settings = {}",
+      "try { settings = JSON.parse(fs.readFileSync(path, 'utf8')) } catch {}",
+      "settings['terminal.integrated.env.linux'] = { ...settings['terminal.integrated.env.linux'], PORT: process.env.MP_ORIGINAL_PORT }",
+      "fs.writeFileSync(path, JSON.stringify(settings, null, 2))",
+    ].join("\n")
+    const seedTerminalPortEnvEncoded = b64(seedTerminalPortEnv)
 
-  push(
-    "",
-    'if [ -n "${PORT:-}" ]; then',
-    "  _mp_cs_bin=$(command -v code-server 2>/dev/null || true)",
-    '  if [ -n "$_mp_cs_bin" ]; then',
-    '    _mp_cs_bin=$(readlink -f "$_mp_cs_bin" 2>/dev/null || echo "$_mp_cs_bin")',
-    '    _mp_cs_node="$(dirname "$(dirname "$_mp_cs_bin")")/lib/node"',
-    '    if [ -x "$_mp_cs_node" ]; then',
-    `      mkdir -p ${homeDir}/.local/share/code-server/User`,
-    `      echo ${JSON.stringify(seedTerminalPortEnvEncoded)} | base64 -d > ${homeDir}/.mp_seed_terminal_port.js`,
-    `      MP_ORIGINAL_PORT="$PORT" MP_SETTINGS_PATH="${homeDir}/.local/share/code-server/User/settings.json" "$_mp_cs_node" ${homeDir}/.mp_seed_terminal_port.js`,
-    `      rm -f ${homeDir}/.mp_seed_terminal_port.js`,
-    `      chown -R ${username}:${username} ${homeDir}/.local`,
-    "    fi",
-    "  fi",
-    "fi",
-  )
+    push(
+      "",
+      'if [ -n "${PORT:-}" ]; then',
+      "  _mp_cs_bin=$(command -v code-server 2>/dev/null || true)",
+      '  if [ -n "$_mp_cs_bin" ]; then',
+      '    _mp_cs_bin=$(readlink -f "$_mp_cs_bin" 2>/dev/null || echo "$_mp_cs_bin")',
+      '    _mp_cs_node="$(dirname "$(dirname "$_mp_cs_bin")")/lib/node"',
+      '    if [ -x "$_mp_cs_node" ]; then',
+      `      mkdir -p ${homeDir}/.local/share/code-server/User`,
+      `      echo ${JSON.stringify(seedTerminalPortEnvEncoded)} | base64 -d > ${homeDir}/.mp_seed_terminal_port.js`,
+      `      MP_ORIGINAL_PORT="$PORT" MP_SETTINGS_PATH="${homeDir}/.local/share/code-server/User/settings.json" "$_mp_cs_node" ${homeDir}/.mp_seed_terminal_port.js`,
+      `      rm -f ${homeDir}/.mp_seed_terminal_port.js`,
+      `      chown -R ${username}:${username} ${homeDir}/.local`,
+      "    fi",
+      "  fi",
+      "fi",
+    )
 
-  // ── 5. Start code-server as vscode ────────────────────────────────────────
-  // Write the restart-loop to a temp script so quoting stays clean.
-  // Single-quoted heredoc: $VARS are NOT expanded here, they expand when the script runs
-  // (env is inherited from the start script via `su vscode` without -l).
-  // Write the restart-loop using base64 to avoid heredoc issues in DinD contexts
-  // where dockerd startup can affect /tmp mount visibility for child processes.
-  // Script lives in home dir (persistent volume) rather than /tmp.
-  const codeServerLoop = [
-    "#!/bin/bash",
-    "export SHELL=$(command -v zsh 2>/dev/null || echo /bin/bash)",
-    // Makes the editor's own Extensions view search the same registry the picker and the image
-    // build used (org setting — see lib/extension-registry.ts). Nothing when the org is on Open VSX.
-    ...galleryExport(extensionsGallery),
-    // The IDE is Spunto's, not Coder's (spunto-pack rebrands the files): the name in the title,
-    // no "Deploy code-server for your team" on the welcome page, no "code-server vX is out"
-    // notification. Each flag only if this code-server knows it — an unknown one stops it dead.
-    '_mp_cs_flags=""',
-    "for _f in --app-name --disable-getting-started-override --disable-update-check; do",
-    '  code-server --help 2>/dev/null | grep -q -- "$_f" || continue',
-    '  case "$_f" in --app-name) _mp_cs_flags="$_mp_cs_flags --app-name Spunto" ;; *) _mp_cs_flags="$_mp_cs_flags $_f" ;; esac',
-    "done",
-    "while true; do",
-    '  VSCODE_PROXY_URI="${PUBLIC_PROTOCOL}://${WORKER_SLUG}-{{port}}.${BASE_DOMAIN}" \\',
-    // PORT is overridden here (not unset globally) so a project secret named
-    // PORT can't make code-server bind elsewhere. This also leaks PORT=<idePort>
-    // into code-server's own process tree (its integrated terminal included) —
-    // § 4c above restores the original value for that terminal specifically.
-    // apps/agent/src/terminal.ts (dashboard's separate terminal feature) is a
-    // different process tree entirely and was never affected.
-    `    PORT=${idePort} code-server --bind-addr 0.0.0.0:${idePort} --auth none $_mp_cs_flags /workspace 2>&1`,
-    '  echo "[start] code-server exited ($?), restarting in 3s..."',
-    "  sleep 3",
-    "done",
-  ].join("\n")
-  const codeServerEncoded = b64(codeServerLoop)
+    // ── 5. Start code-server as vscode ────────────────────────────────────────
+    // Write the restart-loop to a temp script so quoting stays clean.
+    // Single-quoted heredoc: $VARS are NOT expanded here, they expand when the script runs
+    // (env is inherited from the start script via `su vscode` without -l).
+    // Write the restart-loop using base64 to avoid heredoc issues in DinD contexts
+    // where dockerd startup can affect /tmp mount visibility for child processes.
+    // Script lives in home dir (persistent volume) rather than /tmp.
+    const codeServerLoop = [
+      "#!/bin/bash",
+      "export SHELL=$(command -v zsh 2>/dev/null || echo /bin/bash)",
+      // Makes the editor's own Extensions view search the same registry the picker and the image
+      // build used (org setting — see lib/extension-registry.ts). Nothing when the org is on Open VSX.
+      ...galleryExport(extensionsGallery),
+      // The IDE is Spunto's, not Coder's (spunto-pack rebrands the files): the name in the title,
+      // no "Deploy code-server for your team" on the welcome page, no "code-server vX is out"
+      // notification. Each flag only if this code-server knows it — an unknown one stops it dead.
+      '_mp_cs_flags=""',
+      "for _f in --app-name --disable-getting-started-override --disable-update-check; do",
+      '  code-server --help 2>/dev/null | grep -q -- "$_f" || continue',
+      '  case "$_f" in --app-name) _mp_cs_flags="$_mp_cs_flags --app-name Spunto" ;; *) _mp_cs_flags="$_mp_cs_flags $_f" ;; esac',
+      "done",
+      "while true; do",
+      '  VSCODE_PROXY_URI="${PUBLIC_PROTOCOL}://${WORKER_SLUG}-{{port}}.${BASE_DOMAIN}" \\',
+      // PORT is overridden here (not unset globally) so a project secret named
+      // PORT can't make code-server bind elsewhere. This also leaks PORT=<idePort>
+      // into code-server's own process tree (its integrated terminal included) —
+      // § 4c above restores the original value for that terminal specifically.
+      // apps/agent/src/terminal.ts (dashboard's separate terminal feature) is a
+      // different process tree entirely and was never affected.
+      `    PORT=${idePort} code-server --bind-addr 0.0.0.0:${idePort} --auth none $_mp_cs_flags /workspace 2>&1`,
+      '  echo "[start] code-server exited ($?), restarting in 3s..."',
+      "  sleep 3",
+      "done",
+    ].join("\n")
+    const codeServerEncoded = b64(codeServerLoop)
 
-  push(
-    ...banner("START: CODE-SERVER"),
-    `echo ${JSON.stringify(codeServerEncoded)} | base64 -d > ${homeDir}/.mp_codeserver.sh`,
-    `chmod +x ${homeDir}/.mp_codeserver.sh`,
-    `su ${username} -s /bin/bash -c "${homeDir}/.mp_codeserver.sh" &`,
-  )
+    push(
+      ...banner("START: CODE-SERVER"),
+      `echo ${JSON.stringify(codeServerEncoded)} | base64 -d > ${homeDir}/.mp_codeserver.sh`,
+      `chmod +x ${homeDir}/.mp_codeserver.sh`,
+      `su ${username} -s /bin/bash -c "${homeDir}/.mp_codeserver.sh" &`,
+    )
+  }
+
+  // No IDE: nothing else would keep the script — and so the project's process, which the agent
+  // reports as `running` only while it lives — waiting at the end. A sleeper does, in its place.
+  if (!ide) push("", "while true; do sleep 3600; done &")
 
   // ── 6. postStartCommand ───────────────────────────────────────────────────
   // Wait for Docker if feature entrypoints were started — regardless of whether