boxdown 1.0.0 → 1.2.1

package/assets/devcontainer/hooks/post-create.sh

@@ -5,27 +5,79 @@ HOOKS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 DEVCONTAINER_DIR="$(cd "${HOOKS_DIR}/.." && pwd)"
 
 main() {
-  configure_local_git
-  install_openssh_server
-  install_apm
-  install_or_update_coding_agent_clis
-  install_1password_cli
-  install_snyk_cli
-  run_deps_install
+  run_step "Configuring global Git" configure_global_git
+  run_step "Configuring Git commit signing" configure_git_signing
+  run_step "Configuring workspace Git" configure_local_git
+  run_step "Configuring runtime secret environment" configure_runtime_secret_environment
+  run_step "Installing OpenSSH server" install_openssh_server
+  run_step "Installing Python runtime" install_python_runtime
+  run_step "Installing Agent Package Manager" install_apm
+  run_step "Installing coding-agent CLIs" install_or_update_coding_agent_clis
+  run_step "Installing 1Password CLI" install_1password_cli
+  run_step "Installing Snyk CLI" install_snyk_cli
+  run_step "Installing workspace dependencies" run_deps_install
+}
+
+progress() {
+  if [[ "${BOXDOWN_PROGRESS:-0}" == "1" ]]; then
+    printf 'BOXDOWN_PROGRESS: %s\n' "$*"
+  fi
+}
+
+run_step() {
+  local label="$1"
+  shift
+
+  progress "$label"
+  "$@"
+}
+
+configure_global_git() {
+  bash "${DEVCONTAINER_DIR}/utils/git-config-bootstrap.sh"
+}
+
+configure_git_signing() {
+  bash "${DEVCONTAINER_DIR}/utils/git-signing-bootstrap.sh"
 }
 
 configure_local_git() {
   # Local git prefs only apply inside a repository; skip when there is no .git (avoids postCreate failure).
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-    git config --local commit.gpgsign false
-    git config --local core.pager 'less -R'
-    git config --local credential.https://github.com.helper '!gh auth git-credential'
+    git config --local --replace-all core.pager 'less -R'
+    git config --local --unset-all credential.https://github.com.helper >/dev/null 2>&1 || true
+    git config --local --add credential.https://github.com.helper ''
+    git config --local --add credential.https://github.com.helper '!gh auth git-credential'
+  fi
+}
+
+configure_runtime_secret_environment() {
+  local bashrc="${HOME}/.bashrc"
+  local source_line='source /opt/boxdown/devcontainer/utils/secret-env-bootstrap.sh'
+
+  touch "${bashrc}"
+  if ! grep -Fqx "${source_line}" "${bashrc}"; then
+    printf '%s\n' "${source_line}" >> "${bashrc}"
   fi
 }
 
 install_apm() {
   # Agent Package Manager: https://github.com/microsoft/apm
-  curl -sSL https://aka.ms/apm-unix | sh
+  local installer
+
+  installer="$(mktemp)"
+  if ! curl -fsSL https://aka.ms/apm-unix -o "${installer}"; then
+    rm -f "${installer}"
+    echo "post-create: warning: could not download APM installer; skipping APM." >&2
+    return 0
+  fi
+
+  if ! sh "${installer}"; then
+    rm -f "${installer}"
+    echo "post-create: warning: APM installer failed; skipping APM." >&2
+    return 0
+  fi
+
+  rm -f "${installer}"
 }
 
 install_or_update_coding_agent_clis() {
@@ -37,6 +89,10 @@ install_openssh_server() {
   bash "${DEVCONTAINER_DIR}/utils/ssh-bootstrap.sh" install
 }
 
+install_python_runtime() {
+  bash "${DEVCONTAINER_DIR}/utils/python-bootstrap.sh" install
+}
+
 install_snyk_cli() {
   # https://docs.snyk.io/snyk-cli/install-the-snyk-cli
   local url
@@ -64,4 +120,6 @@ run_deps_install() {
   bash "${DEVCONTAINER_DIR}/utils/deps-install.sh"
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  main "$@"
+fi

package/assets/devcontainer/hooks/post-start.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 # post-start: runs after each container start (postStartCommand in devcontainer.json).
-# Naming matches post-create.sh; extend with more steps as needed (e.g. source scripts from .devcontainer/utils/).
+set -euo pipefail
+
+DEVCONTAINER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+bash "${DEVCONTAINER_DIR}/utils/git-signing-bootstrap.sh"
 
 set -euo pipefail
 
@@ -8,9 +11,22 @@ HOOKS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 DEVCONTAINER_DIR="$(cd "${HOOKS_DIR}/.." && pwd)"
 
 main() {
-  configure_sshd_runtime
-  refresh_coding_agent_clis
-  remove_ephemeral_env_file_if_present
+  run_step "Preparing SSH runtime" configure_sshd_runtime
+  run_step "Refreshing coding-agent CLIs" refresh_coding_agent_clis
+}
+
+progress() {
+  if [[ "${BOXDOWN_PROGRESS:-0}" == "1" ]]; then
+    printf 'BOXDOWN_PROGRESS: %s\n' "$*"
+  fi
+}
+
+run_step() {
+  local label="$1"
+  shift
+
+  progress "$label"
+  "$@"
 }
 
 configure_sshd_runtime() {
@@ -22,13 +38,4 @@ refresh_coding_agent_clis() {
     echo "post-start: warning: one or more coding-agent CLI refreshes failed." >&2
 }
 
-# When initializeCommand + runArgs inject secrets via .env.development, remove the file
-# after start so it is not left on disk and tooling that assumes absence does not break.
-remove_ephemeral_env_file_if_present() {
-  local env_file=".env.development"
-  if [[ -f "$env_file" ]]; then
-    rm -f "$env_file"
-  fi
-}
-
 main "$@"

package/assets/devcontainer/ssh-config-install.sh

@@ -89,11 +89,20 @@ write_ssh_config_block() {
   chmod 0600 "$SSH_CONFIG"
 
   tmp_file="$(mktemp)"
-  awk -v begin="$BEGIN_MARKER" -v end="$END_MARKER" '
+  if ! awk -v begin="$BEGIN_MARKER" -v end="$END_MARKER" '
     $0 == begin { skip = 1; next }
-    $0 == end { skip = 0; next }
+    $0 == end && skip { skip = 0; next }
+    skip && $0 ~ /^# (BEGIN|END) [A-Za-z0-9_.-]+ (boxdown )?devcontainer ssh$/ { exit 43 }
     !skip { print }
-  ' "$SSH_CONFIG" > "$tmp_file"
+    END {
+      if (skip) {
+        exit 42
+      }
+    }
+  ' "$SSH_CONFIG" > "$tmp_file"; then
+    rm -f "$tmp_file"
+    die "Refusing to update SSH config for ${HOST_ALIAS}: found \"${BEGIN_MARKER}\" without matching \"${END_MARKER}\" or with an overlapping managed marker. Repair the config manually before running Boxdown again."
+  fi
 
   start_script_quoted="$(ssh_config_quote "$START_SCRIPT")"
   key_path_quoted="$(ssh_config_quote "$SSH_KEY_PATH")"