boxdown 1.0.0 → 1.2.1

package/assets/devcontainer/utils/coding-agent-cli-update.sh

@@ -4,7 +4,7 @@
 
 set -euo pipefail
 
-DEFAULT_AGENTS=(codex opencode claude antigravity)
+DEFAULT_AGENTS=(codex claude)
 UPDATE_INTERVAL_SECONDS="${BOXDOWN_CODING_AGENT_UPDATE_INTERVAL_SECONDS:-3600}"
 UPDATE_LOCK_WAIT_SECONDS="${BOXDOWN_CODING_AGENT_UPDATE_LOCK_WAIT_SECONDS:-120}"
 STATE_DIR="${BOXDOWN_CODING_AGENT_UPDATE_STATE_DIR:-${HOME}/.cache/boxdown/coding-agent-clis}"
@@ -13,9 +13,23 @@ log() {
   echo "coding-agent-cli-update: $*" >&2
 }
 
+progress() {
+  if [ "${BOXDOWN_PROGRESS:-0}" = "1" ]; then
+    printf 'BOXDOWN_PROGRESS: %s\n' "$*"
+  fi
+}
+
+prepend_agent_bin_paths() {
+  local codex_home="${CODEX_HOME:-${HOME}/.codex}"
+
+  PATH="${HOME}/.local/bin:${HOME}/.opencode/bin:${codex_home}/packages/standalone/current/bin:${PATH}"
+  export PATH
+}
+
 usage() {
   cat >&2 <<'EOF'
 Usage: coding-agent-cli-update.sh <install|update-now|maybe-update> [codex|opencode|claude|antigravity...]
+       coding-agent-cli-update.sh ensure <codex|opencode|claude|antigravity...>
 EOF
 }
 
@@ -50,6 +64,27 @@ agent_env_prefix() {
   esac
 }
 
+agent_binary() {
+  case "$1" in
+    codex) printf '%s\n' codex ;;
+    opencode) printf '%s\n' opencode ;;
+    claude) printf '%s\n' claude ;;
+    antigravity) printf '%s\n' agy ;;
+    *)
+      log "unknown coding-agent CLI: $1"
+      return 1
+      ;;
+  esac
+}
+
+agent_binary_available() {
+  local agent="$1"
+  local binary
+
+  binary="$(agent_binary "${agent}")" || return 1
+  command -v "${binary}" >/dev/null 2>&1
+}
+
 agent_stamp_file() {
   local agent="$1"
   local prefix
@@ -177,6 +212,158 @@ run_installer_url() {
   curl -fsSL "${url}" | "$@"
 }
 
+run_as_root() {
+  if [ "$(id -u)" -eq 0 ]; then
+    "$@"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo "$@"
+  else
+    "$@"
+  fi
+}
+
+prepare_codex_home() {
+  local codex_home="${CODEX_HOME:-${HOME}/.codex}"
+
+  if [ -e "${codex_home}" ] && [ ! -d "${codex_home}" ]; then
+    log "codex: ${codex_home} exists but is not a directory."
+    return 1
+  fi
+
+  if [ ! -d "${codex_home}" ]; then
+    mkdir -p "${codex_home}"
+  fi
+
+  if [ ! -w "${codex_home}" ]; then
+    run_as_root chown "$(id -u):$(id -g)" "${codex_home}" 2>/dev/null || true
+  fi
+
+  if [ ! -w "${codex_home}" ]; then
+    run_as_root chmod u+rwx "${codex_home}" 2>/dev/null || true
+  fi
+
+  if [ ! -w "${codex_home}" ]; then
+    log "codex: ${codex_home} is not writable; Codex CLI install/update may fail."
+    return 1
+  fi
+}
+
+prune_codex_standalone_releases() {
+  local keep_previous
+  local codex_home
+  local standalone_dir
+  local releases_dir
+  local current_link
+  local current_target
+  local current_name=""
+  local previous_kept=0
+  local previous_limit
+  local release_name
+
+  keep_previous="$(numeric_or_default "${BOXDOWN_CODEX_STANDALONE_RELEASES_KEEP_PREVIOUS:-0}" 0)"
+  codex_home="${CODEX_HOME:-${HOME}/.codex}"
+  standalone_dir="${codex_home}/packages/standalone"
+  releases_dir="${standalone_dir}/releases"
+
+  [ -d "${releases_dir}" ] || return 0
+
+  current_link="${standalone_dir}/current"
+  if [ -L "${current_link}" ]; then
+    current_target="$(readlink "${current_link}" 2>/dev/null || true)"
+    current_name="$(basename "${current_target}")"
+  fi
+
+  previous_limit="${keep_previous}"
+  if [ -z "${current_name}" ]; then
+    previous_limit=$((keep_previous + 1))
+  fi
+
+  while IFS= read -r release_name; do
+    if [ -n "${current_name}" ] && [ "${release_name}" = "${current_name}" ]; then
+      continue
+    fi
+
+    if [ "${previous_kept}" -lt "${previous_limit}" ]; then
+      previous_kept=$((previous_kept + 1))
+      continue
+    fi
+
+    rm -rf -- "${releases_dir}/${release_name}"
+    log "codex: pruned old standalone release: ${release_name}"
+  done < <(list_child_directory_names "${releases_dir}")
+}
+
+prune_claude_versions() {
+  local versions_dir="${HOME}/.local/share/claude/versions"
+  local current_link="${HOME}/.local/bin/claude"
+  local current_target
+  local current_name=""
+  local version_name
+
+  [ -d "${versions_dir}" ] || return 0
+  [ -L "${current_link}" ] || return 0
+
+  current_target="$(readlink "${current_link}" 2>/dev/null || true)"
+  current_name="$(basename "${current_target}")"
+  [ -n "${current_name}" ] || return 0
+
+  while IFS= read -r version_name; do
+    if [ "${version_name}" = "${current_name}" ]; then
+      continue
+    fi
+
+    rm -rf -- "${versions_dir}/${version_name}"
+    log "claude: pruned old version: ${version_name}"
+  done < <(list_child_directory_names "${versions_dir}")
+}
+
+cleanup_opencode_install_temps() {
+  local tmp_parent="${BOXDOWN_OPENCODE_INSTALL_TMP_PARENT:-/tmp}"
+  local tmp_dir
+
+  [ -d "${tmp_parent}" ] || return 0
+
+  for tmp_dir in "${tmp_parent}"/opencode_install_*; do
+    [ -e "${tmp_dir}" ] || continue
+    [ -d "${tmp_dir}" ] || continue
+    rm -rf -- "${tmp_dir}"
+    log "opencode: removed installer temp dir: ${tmp_dir}"
+  done
+}
+
+cleanup_antigravity_staging() {
+  local cache_dir="${BOXDOWN_ANTIGRAVITY_CACHE_DIR:-${HOME}/.cache/antigravity}"
+  local staging_dir="${cache_dir}/staging"
+
+  [ -d "${staging_dir}" ] || return 0
+
+  rm -rf -- "${staging_dir}"
+  log "antigravity: removed staging cache: ${staging_dir}"
+}
+
+cleanup_agent_after_update() {
+  case "$1" in
+    codex) prune_codex_standalone_releases ;;
+    opencode) cleanup_opencode_install_temps ;;
+    claude) prune_claude_versions ;;
+    antigravity) cleanup_antigravity_staging ;;
+    *) return 0 ;;
+  esac
+}
+
+list_child_directory_names() {
+  local parent_dir="$1"
+
+  if printf '1\n2\n' | sort -V >/dev/null 2>&1; then
+    find "${parent_dir}" -mindepth 1 -maxdepth 1 -type d -exec basename {} \; | sort -Vr
+    return
+  fi
+
+  (cd "${parent_dir}" && ls -1t) 2>/dev/null | while IFS= read -r child_name; do
+    [ -d "${parent_dir}/${child_name}" ] && printf '%s\n' "${child_name}"
+  done
+}
+
 install_codex() {
   local url
 
@@ -185,6 +372,10 @@ install_codex() {
 }
 
 update_codex() {
+  local result=0
+
+  prepare_codex_home || return 1
+
   if command -v codex >/dev/null 2>&1; then
     if codex update; then
       return 0
@@ -193,7 +384,13 @@ update_codex() {
     log "codex: codex update failed; falling back to installer."
   fi
 
-  install_codex
+  if install_codex; then
+    result=0
+  else
+    result=$?
+  fi
+
+  return "${result}"
 }
 
 install_opencode() {
@@ -201,11 +398,13 @@ install_opencode() {
 
   url="${BOXDOWN_OPENCODE_INSTALL_URL:-https://opencode.ai/install}"
   run_installer_url "${url}" bash -s -- --no-modify-path
+  link_opencode_binary
 }
 
 update_opencode() {
   if command -v opencode >/dev/null 2>&1; then
     if opencode upgrade --method curl; then
+      link_opencode_binary
       return 0
     fi
 
@@ -215,6 +414,18 @@ update_opencode() {
   install_opencode
 }
 
+link_opencode_binary() {
+  local source_path="${HOME}/.opencode/bin/opencode"
+  local target_dir="${HOME}/.local/bin"
+
+  if [ ! -x "${source_path}" ]; then
+    return 0
+  fi
+
+  mkdir -p "${target_dir}"
+  ln -sfn "${source_path}" "${target_dir}/opencode"
+}
+
 install_claude() {
   local url
 
@@ -238,7 +449,7 @@ install_antigravity() {
   local url
 
   url="${BOXDOWN_ANTIGRAVITY_INSTALL_URL:-https://antigravity.google/cli/install.sh}"
-  run_installer_url "${url}" bash -s -- --skip-path
+  run_installer_url "${url}" bash
 }
 
 update_antigravity() {
@@ -270,11 +481,13 @@ update_now_agent() {
   local lock_dir
   local result=0
 
+  progress "${agent}: installing or updating CLI"
   stamp_file="$(agent_stamp_file "${agent}")" || return 1
   lock_dir="$(agent_lock_dir "${agent}")" || return 1
   ensure_state_dir "${stamp_file}" "${lock_dir}"
   acquire_lock "${agent}" "${lock_dir}" || return 1
   if run_agent_update "${agent}"; then
+    cleanup_agent_after_update "${agent}" || true
     touch_stamp "${stamp_file}"
   else
     result=$?
@@ -296,6 +509,7 @@ maybe_update_agent() {
     return 0
   fi
 
+  progress "${agent}: checking for CLI updates"
   acquire_lock "${agent}" "${lock_dir}" || return 0
   if stamp_fresh "${agent}" "${stamp_file}"; then
     release_lock
@@ -303,6 +517,7 @@ maybe_update_agent() {
   fi
 
   if run_agent_update "${agent}"; then
+    cleanup_agent_after_update "${agent}" || true
     touch_stamp "${stamp_file}"
   else
     result=$?
@@ -311,6 +526,45 @@ maybe_update_agent() {
   return "${result}"
 }
 
+ensure_agent() {
+  local agent="$1"
+  local result=0
+
+  progress "${agent}: ensuring CLI is available"
+  if agent_binary_available "${agent}"; then
+    if maybe_update_agent "${agent}"; then
+      return 0
+    fi
+
+    result=$?
+    if agent_binary_available "${agent}"; then
+      log "${agent}: update failed, but the CLI is installed; continuing."
+      return 0
+    fi
+
+    return "${result}"
+  fi
+
+  log "${agent}: CLI is missing; installing before launch."
+  if update_now_agent "${agent}"; then
+    if agent_binary_available "${agent}"; then
+      return 0
+    fi
+
+    log "${agent}: CLI is still unavailable after install/update."
+    return 1
+  fi
+
+  result=$?
+  if agent_binary_available "${agent}"; then
+    log "${agent}: install/update reported failure, but the CLI is installed; continuing."
+    return 0
+  fi
+
+  log "${agent}: CLI is still unavailable after install/update."
+  return "${result}"
+}
+
 run_action_for_agent() {
   local action="$1"
   local agent="$2"
@@ -322,6 +576,9 @@ run_action_for_agent() {
     maybe-update)
       maybe_update_agent "${agent}"
       ;;
+    ensure)
+      ensure_agent "${agent}"
+      ;;
     *)
       usage
       return 1
@@ -340,7 +597,14 @@ main() {
   fi
   shift
 
+  prepend_agent_bin_paths
+
   if [ "$#" -eq 0 ]; then
+    if [ "${action}" = "ensure" ]; then
+      usage
+      return 1
+    fi
+
     agents=("${DEFAULT_AGENTS[@]}")
   else
     agents=("$@")

package/assets/devcontainer/utils/deps-install.sh

@@ -5,9 +5,16 @@ main() {
   [[ -f package.json ]] || return 0
   local pm
   pm=$(detect_package_manager)
+  progress "Installing workspace dependencies with ${pm}"
   install_dependencies "$pm" || true
 }
 
+progress() {
+  if [[ "${BOXDOWN_PROGRESS:-0}" == "1" ]]; then
+    printf 'BOXDOWN_PROGRESS: %s\n' "$*"
+  fi
+}
+
 detect_package_manager() {
   local pm
   if pm=$(detect_package_manager_from_lockfiles); then
@@ -75,6 +82,8 @@ detect_package_manager_from_package_json() {
 
 install_dependencies() {
   local pm="$1"
+  ensure_package_manager "$pm"
+
   case "$pm" in
     pnpm) pnpm install ;;
     npm) npm install ;;
@@ -84,4 +93,63 @@ install_dependencies() {
   esac
 }
 
+ensure_package_manager() {
+  local pm="$1"
+
+  case "$pm" in
+    pnpm)
+      ensure_pnpm
+      ;;
+    yarn)
+      ensure_yarn
+      ;;
+  esac
+}
+
+ensure_pnpm() {
+  if command -v pnpm >/dev/null 2>&1; then
+    return 0
+  fi
+
+  if command -v npm >/dev/null 2>&1; then
+    progress "Installing pnpm package manager"
+    run_as_root npm install --global pnpm@11
+  fi
+}
+
+ensure_yarn() {
+  if command -v yarn >/dev/null 2>&1; then
+    return 0
+  fi
+
+  if command -v corepack >/dev/null 2>&1; then
+    progress "Enabling Corepack for Yarn"
+    enable_corepack
+  fi
+}
+
+enable_corepack() {
+  if ! command -v corepack >/dev/null 2>&1; then
+    return 0
+  fi
+
+  if corepack enable >/dev/null 2>&1; then
+    return 0
+  fi
+
+  if command -v sudo >/dev/null 2>&1; then
+    sudo corepack enable >/dev/null 2>&1 || true
+  fi
+}
+
+run_as_root() {
+  if [ "$(id -u)" -eq 0 ]; then
+    "$@"
+  elif command -v sudo >/dev/null 2>&1; then
+    sudo "$@"
+  else
+    "$@"
+  fi
+}
+
 main "$@"

package/assets/devcontainer/utils/git-config-bootstrap.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# Prepare a writable container-global Git config from the host snapshot.
+
+set -euo pipefail
+
+SOURCE_PATH="${BOXDOWN_GITCONFIG_SOURCE_PATH:-/opt/boxdown/state/host-gitconfig/.gitconfig}"
+TARGET_PATH="${BOXDOWN_GITCONFIG_TARGET_PATH:-/home/node/.gitconfig}"
+
+main() {
+  progress "Preparing writable Git config"
+  if ! install_writable_gitconfig; then
+    return 0
+  fi
+
+  progress "Configuring container Git authentication"
+  sanitize_github_rewrites
+  sanitize_host_credential_helpers credential.helper
+  sanitize_host_credential_helpers credential.https://github.com.helper
+  configure_container_github_auth
+}
+
+progress() {
+  if [[ "${BOXDOWN_PROGRESS:-0}" == "1" ]]; then
+    printf 'BOXDOWN_PROGRESS: %s\n' "$*"
+  fi
+}
+
+install_writable_gitconfig() {
+  local target_dir
+
+  target_dir="$(dirname "${TARGET_PATH}")"
+  mkdir -p "${target_dir}"
+
+  if command -v mountpoint >/dev/null 2>&1 && mountpoint -q "${TARGET_PATH}"; then
+    echo "git-config-bootstrap: ${TARGET_PATH} is still a mount; recreate the devcontainer so Boxdown can install a writable Git config copy." >&2
+    return 1
+  fi
+
+  if [[ -f "${SOURCE_PATH}" ]]; then
+    cp "${SOURCE_PATH}" "${TARGET_PATH}"
+  else
+    : > "${TARGET_PATH}"
+  fi
+
+  chmod 0600 "${TARGET_PATH}" || true
+  ensure_node_owns_gitconfig
+
+  if [[ ! -w "${TARGET_PATH}" ]]; then
+    echo "git-config-bootstrap: ${TARGET_PATH} is not writable; recreate the devcontainer so Boxdown can install a writable Git config copy." >&2
+    return 1
+  fi
+}
+
+ensure_node_owns_gitconfig() {
+  if ! id node >/dev/null 2>&1; then
+    return 0
+  fi
+
+  if [[ "$(id -un)" == "root" ]]; then
+    chown node:node "${TARGET_PATH}" || true
+    return 0
+  fi
+
+  if command -v sudo >/dev/null 2>&1; then
+    sudo chown node:node "${TARGET_PATH}" >/dev/null 2>&1 || true
+  fi
+}
+
+git_global() {
+  GIT_CONFIG_GLOBAL="${TARGET_PATH}" git config --global "$@"
+}
+
+sanitize_github_rewrites() {
+  git_global --unset-all url.git@github.com:.insteadOf >/dev/null 2>&1 || true
+  git_global --unset-all url.ssh://git@github.com/.insteadOf >/dev/null 2>&1 || true
+}
+
+sanitize_host_credential_helpers() {
+  local key="$1"
+  local values=()
+  local value
+
+  while IFS= read -r value; do
+    values+=("${value}")
+  done < <(git_global --get-all "${key}" 2>/dev/null || true)
+
+  if [[ "${#values[@]}" -eq 0 ]]; then
+    return 0
+  fi
+
+  git_global --unset-all "${key}" >/dev/null 2>&1 || true
+
+  for value in "${values[@]}"; do
+    if is_unsupported_credential_helper "${value}"; then
+      continue
+    fi
+
+    git_global --add "${key}" "${value}"
+  done
+}
+
+is_unsupported_credential_helper() {
+  local value="$1"
+  local executable
+
+  case "${value}" in
+    /Users/* | /Applications/* | /opt/homebrew/* | !/Users/* | !/Applications/* | !/opt/homebrew/*)
+      return 0
+      ;;
+  esac
+
+  if [[ "${value}" == /* ]]; then
+    executable="${value%% *}"
+    if [[ ! -e "${executable}" ]]; then
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+configure_container_github_auth() {
+  git_global --unset-all credential.https://github.com.helper >/dev/null 2>&1 || true
+  git_global --add credential.https://github.com.helper ''
+  git_global --add credential.https://github.com.helper '!gh auth git-credential'
+}
+
+main "$@"

package/assets/devcontainer/utils/git-signing-bootstrap.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Configure best-effort SSH commit signing without modifying the workspace Git config.
+
+set -euo pipefail
+
+TARGET_PATH="${BOXDOWN_GITCONFIG_TARGET_PATH:-/home/node/.gitconfig}"
+KEY_PATH="${BOXDOWN_GIT_SIGNING_KEY_PATH:-/opt/boxdown/state/git-signing/signing-key.pub}"
+ENABLED="${BOXDOWN_GIT_SIGNING_ENABLED:-0}"
+HOST_REASON="${BOXDOWN_GIT_SIGNING_REASON:-host-preflight-unavailable}"
+
+git_global() {
+  GIT_CONFIG_GLOBAL="${TARGET_PATH}" git config --global "$@"
+}
+
+git_local_value() {
+  git config --local --get "$1" 2>/dev/null || true
+}
+
+git_global_value() {
+  git_global --get "$1" 2>/dev/null || true
+}
+
+preserve_user_signing_preference() {
+  local local_commit global_commit local_format global_format local_program global_program
+  local_commit="$(git_local_value commit.gpgsign)"
+  global_commit="$(git_global_value commit.gpgsign)"
+  local_format="$(git_local_value gpg.format)"
+  global_format="$(git_global_value gpg.format)"
+  local_program="$(git_local_value gpg.program)"
+  global_program="$(git_global_value gpg.program)"
+
+  [[ "${local_commit}" == "false" || "${global_commit}" == "false" ]] && return 0
+  [[ -n "${local_program}" || -n "${global_program}" ]] && return 0
+  [[ -n "${local_format}" && "${local_format}" != "ssh" ]] && return 0
+  [[ -n "${global_format}" && "${global_format}" != "ssh" ]] && return 0
+  return 1
+}
+
+disable_signing() {
+  local reason="${1:-unknown}"
+  if preserve_user_signing_preference; then
+    printf 'boxdown: commit signing configuration preserved (reason: %s).\n' "${reason}" >&2
+    return 0
+  fi
+  git_global --unset-all gpg.format >/dev/null 2>&1 || true
+  git_global --unset-all user.signingkey >/dev/null 2>&1 || true
+  git_global --unset-all gpg.program >/dev/null 2>&1 || true
+  git_global --replace-all commit.gpgsign false
+  printf 'boxdown: commit signing unavailable (reason: %s); commits will remain unsigned.\n' "${reason}" >&2
+}
+
+enable_signing() {
+  if preserve_user_signing_preference; then
+    printf '%s\n' 'boxdown: preserving explicit user Git signing configuration.' >&2
+    return 0
+  fi
+
+  if [[ ! -r "${KEY_PATH}" ]]; then
+    disable_signing 'container-key-unavailable'
+    return 0
+  fi
+
+  if ! bash "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/ssh-agent-proxy-bootstrap.sh"; then
+    disable_signing 'container-agent-proxy-unavailable'
+    return 0
+  fi
+
+  local agent_identities
+  if ! agent_identities="$(ssh-add -L 2>/dev/null)"; then
+    disable_signing 'container-agent-unavailable'
+    return 0
+  fi
+
+  local selected_key
+  selected_key="$(awk 'NR == 1 { print $1 " " $2 }' "${KEY_PATH}")"
+  if ! grep -qF -- "${selected_key}" <<<"${agent_identities}"; then
+    disable_signing 'container-key-not-loaded'
+    return 0
+  fi
+
+  git_global --unset-all gpg.program >/dev/null 2>&1 || true
+  git_global --replace-all gpg.format ssh
+  git_global --replace-all user.signingkey "${KEY_PATH}"
+  git_global --replace-all commit.gpgsign true
+
+  local probe_dir
+  probe_dir="$(mktemp -d)"
+  if ! (
+    cd "${probe_dir}"
+    git init -q
+    git config user.name 'Boxdown signing probe'
+    git config user.email 'signing-probe@boxdown.invalid'
+    git config gpg.format ssh
+    git config user.signingkey "${KEY_PATH}"
+    git config commit.gpgsign true
+    git commit --allow-empty -m 'boxdown signing probe' >/dev/null
+  ); then
+    rm -rf "${probe_dir}"
+    disable_signing 'container-signing-probe-failed'
+    return 0
+  fi
+  rm -rf "${probe_dir}"
+}
+
+if [[ "${ENABLED}" == "1" ]]; then
+  enable_signing
+else
+  disable_signing "${HOST_REASON}"
+fi