garaje 0.1.0

package/templates/pi/Dockerfile

@@ -0,0 +1,56 @@
+FROM node:22-bookworm
+
+# Core CLI tools the agent leans on. ripgrep + fd give fast search;
+# gh + jq + curl cover most HTTP / GitHub flows; tini gives clean PID 1.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git \
+        ripgrep \
+        fd-find \
+        jq \
+        curl \
+        ca-certificates \
+        tini \
+    && ln -s "$(command -v fdfind)" /usr/local/bin/fd \
+    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+        | tee /usr/share/keyrings/githubcli-archive-keyring.gpg >/dev/null \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+        > /etc/apt/sources.list.d/github-cli.list \
+    && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" \
+        > /etc/apt/sources.list.d/docker.list \
+    && apt-get update && apt-get install -y --no-install-recommends gh docker-ce-cli docker-buildx-plugin docker-compose-plugin \
+    && rm -rf /var/lib/apt/lists/*
+
+# Pi version is pinned in pi/PI_VERSION so a pi bump is a one-file diff
+# teammates pick up on `git pull && garaje up --build`. Bring the file in first
+# as its own layer so editing it busts the cache for the npm install layer
+# below but not for the heavy apt layer above.
+COPY PI_VERSION /tmp/PI_VERSION
+
+# pi itself, the garaje CLI (so in-container skills can shell out to `garaje`),
+# plus a TS runner so the @garaje/base package's extensions/*.ts load without a
+# per-start build. --ignore-scripts per the pi install docs.
+RUN PI_VER="$(tr -d '[:space:]' < /tmp/PI_VERSION)" \
+    && npm install -g --ignore-scripts \
+        "@earendil-works/pi-coding-agent@${PI_VER}" \
+        "garaje@__GARAJE_VERSION__" \
+        tsx \
+        esbuild \
+    && rm /tmp/PI_VERSION
+
+# Integration auth wiring (see `garaje auth add`). Config is static + non-secret;
+# the token itself lives on the garaje-auth volume at runtime. Placed AFTER the
+# heavy pi/npm layer so editing this doesn't bust that cache. Covers github.com
+# and gist.github.com (mirrors `gh auth setup-git`).
+ENV GH_CONFIG_DIR=/root/.garaje-auth/gh
+RUN git config --system 'credential.https://github.com.helper' '!gh auth git-credential' \
+ && git config --system 'credential.https://gist.github.com.helper' '!gh auth git-credential'
+
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+WORKDIR /workspace
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint.sh"]
+# Stay alive so the TUI can be launched on demand via `docker compose exec pi pi`.
+CMD ["sleep", "infinity"]

package/templates/pi/PI_VERSION

@@ -0,0 +1 @@
+0.80.3

package/templates/pi/entrypoint.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Entrypoint for the pi container.
+#   1. Ensure the agent home + gh config dir exist.
+#   2. Drop stale extensions/skills/settings.json symlinks from a carried-over
+#      pi-config volume (pre-Phase-3 leftovers).
+#   3. Seed global settings with defaultProjectTrust:"always" (the container IS
+#      the isolation boundary; the mounted /workspace is trusted). This lets pi
+#      auto-install the pinned @garaje/base package and load project resources
+#      headlessly, with no trust prompt.
+#   4. Symlink pi's sessions dir to the bind-mounted /workspace/sessions.
+#   5. exec the command (default: `sleep infinity`).
+# NOTE: extensions/skills/settings are NO LONGER symlinked — they arrive via the
+# @garaje/base pi package pinned in .pi/settings.json.
+set -euo pipefail
+
+AGENT_DIR="/root/.pi/agent"
+mkdir -p "${AGENT_DIR}"
+mkdir -p "${GH_CONFIG_DIR:-/root/.garaje-auth/gh}"
+
+# Drop any stale extensions/skills/settings.json symlinks left over from the
+# pre-Phase-3 symlink dance (they persist on a carried-over pi-config volume).
+# These resources now arrive via the @garaje/base pi package, so a lingering
+# symlink is dead weight that `garaje doctor` flags as a regression. This MUST
+# run before the trust-seed writeFileSync below: a stale settings.json symlink
+# (pre-Phase-3 pointed it at /workspace/.agent/settings.json, now deleted)
+# would otherwise make that write resurrect a file in the working tree.
+for stale in extensions skills settings.json; do
+  if [ -L "${AGENT_DIR}/${stale}" ]; then
+    rm -f "${AGENT_DIR}/${stale}"
+  fi
+done
+
+# Merge defaultProjectTrust:"always" into global settings (idempotent).
+AGENT_DIR="${AGENT_DIR}" node -e '
+const fs = require("fs");
+const p = process.env.AGENT_DIR + "/settings.json";
+let s = {};
+try { s = JSON.parse(fs.readFileSync(p, "utf8")); } catch {}
+s.defaultProjectTrust = "always";
+fs.writeFileSync(p, JSON.stringify(s, null, 2) + "\n");
+'
+
+# Sessions: transcripts land on the host filesystem.
+if [ -d "/workspace/sessions" ]; then
+  rm -rf "${AGENT_DIR}/sessions"
+  ln -s "/workspace/sessions" "${AGENT_DIR}/sessions"
+fi
+
+exec "$@"