@webship.co/workspace 1.0.0-beta1 → 1.0.0-beta2

package/core/workspace-app/.ddev/web-build/Dockerfile.workspace-app

@@ -0,0 +1,203 @@
+# Docker-outside-of-Docker: install the docker CLI (talks to the host's
+# docker.sock, bind-mounted in via docker-compose.dood.yaml) and the ddev
+# binary itself, so cmd-*.sh scripts run from inside this container can
+# manage sibling ddev projects exactly like they do on the host.
+# On Debian trixie the `docker.io` package ships only the daemon; the client
+# lives in `docker-cli`, which is all Docker-outside-of-Docker needs.
+# wkhtmltopdf was dropped from Debian trixie (the ddev-webserver base image
+# since DDEV 1.25), and upstream abandoned it. WeasyPrint renders the doc PDFs
+# and headless Chromium takes the site screenshots instead.
+RUN apt-get update -o Acquire::AllowInsecureRepositories=true || true \
+    && apt-get install -y --no-install-recommends --allow-unauthenticated curl ca-certificates \
+       pandoc weasyprint chromium screen \
+       vim links lynx git diffutils htop wget p7zip-full unzip zip sed \
+       gcc g++ make python3 python-is-python3 \
+    # The docker client: `docker-cli` on trixie (DDEV >= 1.25), `docker.io` on bookworm (DDEV 1.24).
+    && (apt-get install -y --no-install-recommends --allow-unauthenticated docker-cli \
+        || apt-get install -y --no-install-recommends --allow-unauthenticated docker.io) \
+    && rm -rf /var/lib/apt/lists/*
+
+# The Docker Compose plugin, for the DOCKER menu's state and verbs (docker compose ps/up/down/logs)
+# from the dashboard. Neither Debian repository the image may be on ships it, so it comes PINNED from
+# its release, into the directory the docker client already looks in (docker-buildx is there).
+ARG COMPOSE_VERSION=v2.29.7
+RUN mkdir -p /usr/libexec/docker/cli-plugins \
+    && curl -fsSL "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-$(uname -m)" \
+         -o /usr/libexec/docker/cli-plugins/docker-compose \
+    && chmod +x /usr/libexec/docker/cli-plugins/docker-compose \
+    && docker compose version
+
+# code-server — VS Code in the browser, the Web IDE the project rows link to.
+#
+# The standalone tarball, not their install script: the script wants apt/yum and root and
+# picks its own version, and this image is rebuilt often enough that "whatever is latest"
+# is not a thing to depend on. PINNED, because an editor that changes under people between
+# rebuilds is a support question nobody can answer.
+#
+# It is served on its own hostname (ide.workspace.ddev.site) rather than a subpath — see
+# .ddev/nginx_full/nginx-site.conf for why — and bound to LOOPBACK, so the only way in is
+# through that vhost.
+ARG CODE_SERVER_VERSION=4.135.0
+RUN set -eux; \
+    arch="$(dpkg --print-architecture)"; \
+    case "$arch" in amd64) cs_arch=amd64 ;; arm64) cs_arch=arm64 ;; *) echo "no code-server build for $arch" >&2; exit 1 ;; esac; \
+    wget -qO /tmp/code-server.tar.gz \
+      "https://github.com/coder/code-server/releases/download/v${CODE_SERVER_VERSION}/code-server-${CODE_SERVER_VERSION}-linux-${cs_arch}.tar.gz"; \
+    mkdir -p /usr/local/lib/code-server; \
+    tar -xzf /tmp/code-server.tar.gz -C /usr/local/lib/code-server --strip-components=1; \
+    ln -sf /usr/local/lib/code-server/bin/code-server /usr/local/bin/code-server; \
+    rm -f /tmp/code-server.tar.gz; \
+    code-server --version
+
+# The ddev router-lock shim, EARLY on PATH so every `ddev` in this container goes
+# through it — the assistant's Bash calls, the cmd-*.sh scripts, a person in
+# `ddev ssh`, and the Web IDE's terminals. /usr/local/sbin precedes /usr/local/bin
+# in this image's PATH, so the real binary at /usr/local/bin/ddev stays exactly
+# where it is and is found by the shim by absolute path.
+#
+# COPIED, not symlinked into the bind-mounted tree: a symlink would dangle if the
+# workspace were ever not mounted, and a dangling `ddev` breaks every call in here
+# including the dashboard's own status reads. core/scripts/install.sh installs the
+# same file on the host.
+COPY ddev-shim-ddev /usr/local/sbin/ddev
+RUN chmod 0755 /usr/local/sbin/ddev \
+    && /usr/local/sbin/ddev --version > /dev/null \
+    && echo "ddev shim active: $(command -v ddev)"
+
+# `ll` — every shell in here is someone reading a directory, and typing
+# `ls -alh` each time is the kind of friction that makes people leave the
+# browser terminal for a real one.
+RUN printf '%s\n' \
+      "alias ll='ls -alhF --color=auto'" \
+      "alias la='ls -A'" \
+      "alias l='ls -CF'" \
+      > /etc/profile.d/workspace-aliases.sh \
+    && chmod 0644 /etc/profile.d/workspace-aliases.sh \
+    # An alias only exists in an interactive shell, and half the shells here are
+    # not one — a screen session running a command, a script, `ddev exec`. So
+    # `ll` is also a real command, and behaves the same in both.
+    && printf '%s\n' '#!/bin/sh' 'exec ls -alhF --color=auto "$@"' > /usr/local/bin/ll \
+    && chmod 0755 /usr/local/bin/ll
+
+
+# The ddev in here has to be the SAME VERSION as the one on the host, because ddev picks its
+# webserver image from its own version. v1.24.7 pulls ddev/ddev-webserver:v1.24.7, which is Debian
+# bookworm, and the packages.sury.org signing key for bookworm has expired — so `apt-get update`
+# refuses that repo and any project whose `webimage_extra_packages` names a php extension
+# (`php${DDEV_PHP_VERSION}-yaml`, which both site-template projects do) cannot build its web image.
+# The symptom is confusing rather than obvious: setting up a testing environment FROM THE DASHBOARD
+# failed with "Unable to locate package php8.4-yaml" while the identical command succeeded on the
+# host, because only one of the two was on the version whose base image is trixie.
+ARG DDEV_VERSION=1.25.2
+# DDEV 1.25.1 and later build images through `docker compose build`, which needs the buildx CLI
+# plugin — the `docker-cli` package does not carry it, and without it every build from in here
+# stops at "compose build requires buildx 0.17.0 or later". Installed as a plugin binary, which is
+# all the client needs; the actual building happens on the host's daemon over the mounted socket.
+ARG BUILDX_VERSION=0.34.1
+RUN mkdir -p /usr/libexec/docker/cli-plugins \
+    && curl -fsSL "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-amd64" \
+      -o /usr/libexec/docker/cli-plugins/docker-buildx \
+    && chmod +x /usr/libexec/docker/cli-plugins/docker-buildx
+
+RUN curl -fsSL "https://github.com/ddev/ddev/releases/download/v${DDEV_VERSION}/ddev_linux-amd64.v${DDEV_VERSION}.tar.gz" \
+    -o /tmp/ddev.tar.gz \
+    && tar -xzf /tmp/ddev.tar.gz -C /tmp \
+    && mv /tmp/ddev /usr/local/bin/ddev \
+    && chmod +x /usr/local/bin/ddev \
+    && rm -rf /tmp/ddev.tar.gz
+
+# The GitHub CLI: the agents/skills pages read webship/ai-agents (private)
+# and fetch items from it. Auth comes from the host's ~/.config/gh, which the
+# dood compose file bind-mounts alongside ~/.claude.
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+      -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+      > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update -o Acquire::AllowInsecureRepositories=true || true \
+    && apt-get install -y --no-install-recommends --allow-unauthenticated gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# graphify: the knowledge-graph tool behind the Graph button and
+# cmd-tools-graphify.sh. The container has no uv/pipx and no ensurepip, so
+# install uv first and pin the version — graphify's CLI silently ignores
+# unknown flags, so an unpinned upgrade would degrade without erroring.
+#
+# UV_TOOL_DIR matters as much as UV_TOOL_BIN_DIR. Without it, `uv tool install`
+# puts the launcher in /usr/local/bin but the payload under the BUILD user's
+# home — /root/.local/share/uv/tools — and /root is drwx------. The app runs as
+# the web user, so `graphify` resolved to an unreadable path: "Permission
+# denied" for it, `command -v graphify` false, ensure_graphify then reinstalling
+# into a ~/.local/bin that is not on PATH, and the Graph button failing every
+# time while `graphify --version` worked fine as root.
+RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+    && UV_TOOL_DIR=/usr/local/share/uv/tools UV_TOOL_BIN_DIR=/usr/local/bin \
+       uv tool install --force "graphifyy[sql]==0.9.28" \
+    && chmod -R a+rX /usr/local/share/uv
+
+# Claude Code CLI for the AI assistant chat (/actions/chat shells out to
+# `claude -p`). Auth comes from the host's ~/.claude + ~/.claude.json,
+# bind-mounted in via docker-compose.dood.yaml.
+RUN npm install -g @anthropic-ai/claude-code
+
+# graphify (github.com/Graphify-Labs/graphify) parses a codebase with tree-sitter into a knowledge
+# graph. Installed with uv rather than pip: this base image has no pip at all, and Debian's python
+# is externally managed (PEP 668), so a virtual environment is the supported way in — which is what
+# `uv tool install` makes. Pinned, because graphify's node-id scheme changed inside 0.9.x and its
+# CLI ignores unknown flags, so an unpinned upgrade degrades quietly instead of failing.
+#
+# The mcp extra is pinned below 2 separately: graphify 0.9.28 imports `AnyUrl` from a module mcp
+# 2.x moved, and the failure surfaces only as "Connection closed" from whatever tries to use it.
+RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh \
+    && UV_TOOL_BIN_DIR=/usr/local/bin UV_TOOL_DIR=/opt/uv-tools \
+       uv tool install --force 'graphifyy[sql]==0.9.28' --with 'mcp<2' \
+    && graphify --version
+
+# The browser webship-js drives, plus the system libraries it needs. Chromium only: the suite
+# asserts behaviour, not rendering differences between engines.
+#
+# The apt dance is the same one the automated-testing builder does: a third-party PHP repository
+# with an expired signing key is enabled in this image, and `apt-get update` fails while it is —
+# which makes playwright's own dependency install fail with a message about chromium rather than
+# about apt. The list is parked for the install and put straight back.
+#
+# playwright-core rather than the playwright CLI: the package that ships the browser downloader is
+# already a dependency of webship-js, so nothing extra is installed to install it.
+RUN npm install -g playwright-core@1.56.0 \
+    && mkdir -p /tmp/apt-off \
+    && (mv /etc/apt/sources.list.d/php.list /tmp/apt-off/ 2>/dev/null || true) \
+    && apt-get update -qq \
+    && npx --yes playwright-core@1.56.0 install --with-deps chromium \
+    && (mv /tmp/apt-off/php.list /etc/apt/sources.list.d/ 2>/dev/null || true) \
+    && rm -rf /var/lib/apt/lists/*
+
+# The host's /var/run/docker.sock (bind-mounted in) is owned by root:docker
+# with the HOST's docker group GID — find yours with `getent group docker`
+# and adjust the 984 below if it differs. It must be the web user's PRIMARY
+# group, not just a supplementary one: supervisord (which launches
+# web_extra_daemons) drops privileges without calling initgroups(), so
+# supplementary groups from /etc/group never apply to the daemon process —
+# only the primary GID from passwd does. ($username is provided by DDEV's
+# base image build args and matches your host username.)
+# (`docker-cli` does not create the group the way the old `docker.io` package
+# did, so create it when it is missing.)
+RUN if getent group docker > /dev/null; then groupmod -g 973 docker; else groupadd -g 973 docker; fi \
+    && usermod -g 973 $username
+
+# `twg` resolves to the host's current binary on every call.
+#
+# The host's ~/.local/bin is bind-mounted at /host-local-bin (see
+# .ddev/docker-compose.twg.yaml); this wrapper is what keeps the NAME on PATH
+# while the file behind it is free to change. Mounting the binary itself bound
+# an inode, so a `twg update` on the host never reached this container and the
+# dashboard kept running a version the server had stopped accepting.
+#
+# `exec` so signals and the exit code pass straight through, and a plain
+# message rather than a 127 when nothing is installed on the host.
+RUN printf '%s\n' '#!/bin/sh' \
+    '# Generated by Dockerfile.workspace-app — see .ddev/docker-compose.twg.yaml' \
+    'if [ ! -x /host-local-bin/twg ]; then' \
+    '  echo "twg is not installed on the host (~/.local/bin/twg)." >&2' \
+    '  exit 127' \
+    'fi' \
+    'exec /host-local-bin/twg "$@"' > /usr/local/bin/twg \
+    && chmod 0755 /usr/local/bin/twg

package/core/workspace-app/.ddev/web-build/ddev-shim-ddev

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+
+################################################################################
+## `ddev`, serialised on the router. A shim, not a replacement.
+################################################################################
+## Every router-mutating verb — start, stop, restart, poweroff, delete — tears the
+## ONE shared ddev-router down and brings it back with the routes of whatever is
+## running. Two at a time race on a single container: one removes it while the
+## other has just created it, and the loser can leave it removed for good. What
+## that looks like is the whole workspace going dark — every *.ddev.site address,
+## the dashboard's hub included — with healthy web containers behind it, and DDEV
+## then refusing to start anything at all:
+##
+##     Failed to start workspace: Error response from daemon:
+##     No such container: ddev-router
+##
+## Recovering needs `ddev poweroff`. Five clicks in thirty-eight seconds did it.
+##
+## The dashboard's own buttons and its AI assistant already take this lock. This
+## shim is for every OTHER caller — a cmd-*.sh script, an agent, a person in a
+## terminal or in `ddev ssh` — because a rule that each caller must remember is a
+## rule that gets forgotten, including by callers nobody has written yet.
+##
+## Install: PATH must reach this file before the real ddev.
+##   container: /usr/local/sbin/ddev  (PATH has /usr/local/sbin before /usr/local/bin)
+##   host:      core/scripts/install.sh offers it, same path, needs sudo
+##
+## FOUR RULES THIS FILE LIVES BY, because a wrong shim breaks every ddev call on
+## the machine — including the dashboard's own status reads every twenty seconds:
+##
+##   1. The real ddev is resolved by ABSOLUTE PATH and checked not to be this
+##      file. Resolving through PATH would find the shim again and fork forever.
+##   2. Anything that is not a router verb is exec'd immediately, with no lock,
+##      no subshell and no added latency. `ddev list --json-output` must cost
+##      exactly what it cost before.
+##   3. Nothing here is fatal. If flock is missing, or the lock file cannot be
+##      created, it says so once on stderr and runs the command anyway. Refusing
+##      to run ddev because a lock could not be taken would be a worse failure
+##      than the one being prevented.
+##   4. It never re-locks a lock already held. The dashboard wraps its own calls
+##      in flock, and taking the same lock again from inside would deadlock for
+##      the full timeout — so DDEV_ROUTER_LOCK_HELD is the interlock, set by
+##      whoever holds it and exported here for anything ddev itself shells out to.
+################################################################################
+
+set -u
+
+# --- 1. the real ddev, by absolute path, and never this file -------------------
+SELF="$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || echo "${BASH_SOURCE[0]}")"
+REAL_DDEV=''
+for candidate in /usr/local/bin/ddev /usr/bin/ddev /opt/homebrew/bin/ddev /snap/bin/ddev ; do
+  [ -x "${candidate}" ] || continue
+  [ "$(readlink -f "${candidate}" 2>/dev/null || echo "${candidate}")" == "${SELF}" ] && continue
+  REAL_DDEV="${candidate}"
+  break
+done
+if [ -z "${REAL_DDEV}" ] ; then
+  echo "ddev: this is the workspace's router-lock shim, and the real ddev binary was not found" >&2
+  echo "      (looked in /usr/local/bin, /usr/bin, /opt/homebrew/bin, /snap/bin)" >&2
+  exit 127
+fi
+
+# --- 2. which verb is this? ----------------------------------------------------
+# `ddev [global flags] <verb> [args]`, so the verb is the first argument that is
+# not a flag and not a flag's value. Only the verb matters here, and an unknown
+# shape falls through to the pass-through path, which is the safe direction.
+VERB=''
+for arg in "$@" ; do
+  case "${arg}" in
+    -*) continue ;;
+    *)  VERB="${arg}"; break ;;
+  esac
+done
+
+case "${VERB}" in
+  start|stop|restart|poweroff|delete) ;;
+  # Everything else — list, describe, drush, composer, exec, ssh, snapshot,
+  # export-db, add-on, config, and every verb added in future — is none of this
+  # shim's business. Straight through, same process, no measurable overhead.
+  *) exec "${REAL_DDEV}" "$@" ;;
+esac
+
+# --- 3. the lock ---------------------------------------------------------------
+# Already held by a caller above us: run, do not re-lock (see rule 4).
+if [ -n "${DDEV_ROUTER_LOCK_HELD:-}" ] ; then
+  exec "${REAL_DDEV}" "$@"
+fi
+
+WS_ROOT="${WORKSPACE_ROOT:-${HOME}/workspace}"
+LOCK="${WS_ROOT}/.ddev-router.lock"
+
+if ! command -v flock > /dev/null 2>&1 ; then
+  echo "ddev: flock is not installed, so '${VERB}' runs unserialised — concurrent" >&2
+  echo "      start/stop can destroy the shared ddev-router. Install util-linux." >&2
+  exec "${REAL_DDEV}" "$@"
+fi
+
+# The lock file has to be creatable. It normally exists already; when it does not
+# (a fresh checkout, a different WORKSPACE_ROOT) create it, and if that fails say
+# so and carry on rather than blocking the command.
+if [ ! -e "${LOCK}" ] ; then
+  if ! ( umask 022 && : > "${LOCK}" ) 2>/dev/null ; then
+    echo "ddev: cannot create ${LOCK}, so '${VERB}' runs unserialised." >&2
+    exec "${REAL_DDEV}" "$@"
+  fi
+fi
+
+# Say something only when there is really something to wait for: a free lock has
+# to cost nothing and print nothing, or every start grows a line of noise.
+if ! flock -n "${LOCK}" true 2>/dev/null ; then
+  echo "ddev: waiting — another ddev start/stop/restart holds the router lock." >&2
+  echo "      They cannot run at once: each one recreates the shared ddev-router." >&2
+fi
+
+# Exported so anything the real ddev shells out to (including ddev calling itself)
+# does not queue behind a lock this process already owns.
+export DDEV_ROUTER_LOCK_HELD=1
+
+# -w: bounded, so a wedged start cannot hold the queue for ever. The command's own
+# exit status is what leaves this script, because callers check it.
+flock -w 1800 "${LOCK}" "${REAL_DDEV}" "$@"
+exit $?