thepopebot 1.2.76-beta.24 → 1.2.76-beta.26

package/bin/docker-build.js

@@ -1,19 +1,32 @@
 #!/usr/bin/env node
 
 /**
- * Build all Docker images locally (in parallel).
+ * Build all Docker images locally.
  *
  * Usage:
- *   npm run docker:build            # build all images in parallel
- *   npm run docker:build -- --image event-handler   # build one image
+ *   npm run docker:build            # build everything
+ *   npm run docker:build -- --image event-handler   # build one (deps built first)
  *
  * Reads the version from package.json and tags each image as:
  *   stephengpope/thepopebot:{image}-{version}
  *
- * The coding-agent images use a two-stage build: a shared base image
- * (Dockerfile) is built first, then each agent-specific Dockerfile
- * extends it. The base is tagged as coding-agent-base-{version} and
- * is NOT pushed — it's only used locally as a build dependency.
+ * Image hierarchy:
+ *
+ *   thepopebot-base                           ← Ubuntu + Node + locale + Chromium + playwright + user
+ *     ├── coding-agent-base                   ← + tmux, ttyd, scripts, entrypoint
+ *     │     ├── coding-agent-claude-code      ← + per-agent CLI
+ *     │     ├── coding-agent-pi-coding-agent
+ *     │     └── ... (one per agent)
+ *     └── event-handler                       ← + pm2, gosu, Next.js, server.js
+ *
+ * Build order:
+ *   1. thepopebot-base
+ *   2. coding-agent-base + event-handler in parallel
+ *   3. all coding-agent variants in parallel
+ *
+ * Base images are tagged both versioned and unversioned (no version) so child
+ * Dockerfiles can `FROM thepopebot-base` / `FROM coding-agent-base` without a
+ * build-arg for local development.
  */
 
 import { spawn } from 'child_process';
@@ -28,14 +41,21 @@ const pkg = JSON.parse(readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
 const VERSION = pkg.version;
 const REPO = 'stephengpope/thepopebot';
 
-// Base image built first — all coding-agent images depend on it
-const BASE_IMAGE = {
+// Built first — everything depends on this.
+const THEPOPEBOT_BASE = {
+  name: 'thepopebot-base',
+  context: 'docker/base',
+  dockerfile: 'docker/base/Dockerfile',
+};
+
+// Built second — depends on thepopebot-base.
+const CODING_AGENT_BASE = {
   name: 'coding-agent-base',
   context: 'docker/coding-agent',
   dockerfile: 'docker/coding-agent/Dockerfile',
 };
 
-// Agent-specific images (extend the base)
+// Built third — depend on coding-agent-base.
 const CODING_AGENTS = [
   {
     name: 'coding-agent-claude-code',
@@ -69,16 +89,14 @@ const CODING_AGENTS = [
   },
 ];
 
-// Non-coding-agent images (independent, built in parallel)
-const OTHER_IMAGES = [
-  {
-    name: 'event-handler',
-    context: '.',
-    dockerfile: 'docker/event-handler/Dockerfile',
-  },
-];
+// Built second — depends on thepopebot-base. Built in parallel with coding-agent-base.
+const EVENT_HANDLER = {
+  name: 'event-handler',
+  context: '.',
+  dockerfile: 'docker/event-handler/Dockerfile',
+};
 
-const ALL_IMAGES = [BASE_IMAGE, ...CODING_AGENTS, ...OTHER_IMAGES];
+const ALL_IMAGES = [THEPOPEBOT_BASE, CODING_AGENT_BASE, ...CODING_AGENTS, EVENT_HANDLER];
 
 // Parse --image flag
 const filterArg = process.argv.find((_, i, a) => a[i - 1] === '--image');
@@ -101,11 +119,14 @@ function buildImage(img) {
   console.log(`  ${label}  building — ${tag}`);
 
   return new Promise((resolve, reject) => {
-    // Tag base image as both versioned and unversioned (agent Dockerfiles use FROM coding-agent-base)
     const args = ['build', '-t', tag, '-f', dockerfile];
-    if (img.name === 'coding-agent-base') {
-      args.push('-t', 'coding-agent-base');
+
+    // Base images get an unversioned tag too so child Dockerfiles can
+    // `FROM thepopebot-base` / `FROM coding-agent-base` without a build-arg.
+    if (img.name === 'thepopebot-base' || img.name === 'coding-agent-base') {
+      args.push('-t', img.name);
     }
+
     args.push(context);
 
     const proc = spawn(
@@ -172,50 +193,56 @@ function buildImage(img) {
   });
 }
 
-// Build logic: base first, then agents + others in parallel
 async function run() {
   if (filterArg) {
-    // Single image build
-    if (filterArg === BASE_IMAGE.name) {
+    // Single image build — build dependency chain too.
+    if (filterArg === THEPOPEBOT_BASE.name) {
       console.log(`Building 1 image — version ${VERSION}\n`);
-      await buildImage(BASE_IMAGE);
-    } else {
-      const isCodingAgent = CODING_AGENTS.some(img => img.name === filterArg);
-      if (isCodingAgent) {
-        // Need base first
-        console.log(`Building base + 1 agent image — version ${VERSION}\n`);
-        await buildImage(BASE_IMAGE);
-        const agent = CODING_AGENTS.find(img => img.name === filterArg);
-        await buildImage(agent);
-      } else {
-        console.log(`Building 1 image — version ${VERSION}\n`);
-        const img = OTHER_IMAGES.find(img => img.name === filterArg);
-        await buildImage(img);
-      }
+      await buildImage(THEPOPEBOT_BASE);
+    } else if (filterArg === CODING_AGENT_BASE.name) {
+      console.log(`Building 2 images — version ${VERSION}\n`);
+      await buildImage(THEPOPEBOT_BASE);
+      await buildImage(CODING_AGENT_BASE);
+    } else if (filterArg === EVENT_HANDLER.name) {
+      console.log(`Building 2 images — version ${VERSION}\n`);
+      await buildImage(THEPOPEBOT_BASE);
+      await buildImage(EVENT_HANDLER);
+    } else if (CODING_AGENTS.some(img => img.name === filterArg)) {
+      console.log(`Building 3 images — version ${VERSION}\n`);
+      await buildImage(THEPOPEBOT_BASE);
+      await buildImage(CODING_AGENT_BASE);
+      const agent = CODING_AGENTS.find(img => img.name === filterArg);
+      await buildImage(agent);
     }
-    console.log('\n1/1 images built successfully.');
+    console.log('\ndone.');
     return;
   }
 
-  // Full build: base first, then everything else in parallel
+  // Full build: thepopebot-base → (coding-agent-base + event-handler in parallel) → variants
   const totalCount = ALL_IMAGES.length;
-  console.log(`Building ${totalCount} images (base first, then parallel) — version ${VERSION}\n`);
+  console.log(`Building ${totalCount} images — version ${VERSION}\n`);
 
-  // Step 1: Build base
-  await buildImage(BASE_IMAGE);
+  // Step 1: thepopebot-base
+  await buildImage(THEPOPEBOT_BASE);
 
-  // Step 2: Build all agents + other images in parallel
-  const parallel = [...CODING_AGENTS, ...OTHER_IMAGES];
-  const results = await Promise.allSettled(parallel.map(buildImage));
+  // Step 2: coding-agent-base and event-handler in parallel (both extend thepopebot-base)
+  const tier2 = await Promise.allSettled([CODING_AGENT_BASE, EVENT_HANDLER].map(buildImage));
+  const tier2Failed = tier2.filter(r => r.status === 'rejected');
+  if (tier2Failed.length > 0) {
+    console.error(`Tier 2 failed: ${tier2Failed.map(r => r.reason.message).join(', ')}`);
+    process.exit(1);
+  }
 
-  const failed = results.filter((r) => r.status === 'rejected');
-  const succeeded = results.filter((r) => r.status === 'fulfilled');
+  // Step 3: all coding-agent variants in parallel
+  const tier3 = await Promise.allSettled(CODING_AGENTS.map(buildImage));
+  const tier3Failed = tier3.filter(r => r.status === 'rejected');
+  const tier3Succeeded = tier3.filter(r => r.status === 'fulfilled');
 
-  // +1 for the base image
-  console.log(`\n${succeeded.length + 1}/${totalCount} images built successfully.`);
+  const succeededCount = 1 + 2 + tier3Succeeded.length;
+  console.log(`\n${succeededCount}/${totalCount} images built successfully.`);
 
-  if (failed.length > 0) {
-    console.error(`${failed.length} failed: ${failed.map((r) => r.reason.message).join(', ')}`);
+  if (tier3Failed.length > 0) {
+    console.error(`${tier3Failed.length} failed: ${tier3Failed.map(r => r.reason.message).join(', ')}`);
     process.exit(1);
   }
 }

package/bin/sync.js

@@ -248,6 +248,19 @@ function mirrorTemplates(projectPath) {
   }
 }
 
+/**
+ * Build thepopebot-base locally so the event-handler Dockerfile's
+ * `FROM ${BASE_IMAGE}` (default: thepopebot-base) resolves. Cached layers
+ * make this near-instant when nothing in docker/base changed.
+ */
+function buildBaseImage() {
+  console.log('\n  Building thepopebot-base image...');
+  const baseContext = path.join(PACKAGE_DIR, 'docker', 'base');
+  execSync(`docker build -t thepopebot-base -f ${path.join(baseContext, 'Dockerfile')} ${baseContext}`, {
+    stdio: 'inherit',
+  });
+}
+
 function buildDockerImage(projectPath) {
   console.log('\n  Building Docker event handler image...');
 
@@ -431,7 +444,11 @@ export async function sync(projectPath) {
     console.log('\n  Installing package on host...');
     execSync(`npm install --no-save ${tarballDest}`, { stdio: 'inherit', cwd: projectPath });
 
-    // 5. Build Docker image with patched Dockerfile (includes Next.js build)
+    // 5. Build thepopebot-base (event-handler Dockerfile FROMs it).
+    //    Cached layers — fast unless docker/base/Dockerfile changed.
+    buildBaseImage();
+
+    // 6. Build event-handler image with patched Dockerfile (includes Next.js build)
     buildDockerImage(projectPath);
 
     // 6. Restart container with new image

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thepopebot",
-  "version": "1.2.76-beta.24",
+  "version": "1.2.76-beta.26",
   "type": "module",
   "description": "Create autonomous AI agents with a two-layer architecture: Next.js Event Handler + Docker Agent.",
   "bin": {

package/templates/skills/agent-job-tools/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agent-job-tools
-description: Use when the user wants to run an agent job in the background (also "background job", "spawn a job", "kick off a job") — creates and monitors background agent jobs that run in their own container. Also provides access to agent-job secrets (list keys, get values; OAuth credentials are auto-refreshed).
+description: Use when you need to access agent secrets, API keys, or create and manage background jobs. Supports listing api keys, OAuth credentials (auto-refreshed). Also handles requests to "create a background job," "spawn a job," or "kick off an agent job."
 ---
 
 ## Usage

package/templates/skills/agent-job-secrets/SKILL.md

@@ -1,23 +0,0 @@
----
-name: agent-job-secrets
-description: List and retrieve agent secrets. Plain secrets are also available as env vars. OAuth credentials are auto-refreshed on every get call.
----
-
-## Usage
-
-```bash
-# List available secret keys (fetches current list from server)
-node skills/agent-job-secrets/agent-job-secrets.js
-
-# Get a secret value (OAuth credentials are auto-refreshed)
-node skills/agent-job-secrets/agent-job-secrets.js get MY_CREDENTIALS
-```
-
-## Notes
-
-- `AGENT_JOB_TOKEN` and `APP_URL` are injected automatically — no setup required
-- Plain (non-OAuth) secrets are also available directly as env vars (e.g. `echo $MY_KEY`)
-- OAuth credentials must be fetched via `get` — they are not available as env vars
-- `get` on an OAuth credential refreshes it server-side and returns a fresh access token
-- If a fetched credential stops working (expired token, 401 error), call `get` again to obtain a fresh one
-- `list` always fetches from the server, so it reflects secrets added after the container started

package/templates/skills/agent-job-secrets/agent-job-secrets.js

@@ -1,62 +0,0 @@
-#!/usr/bin/env node
-
-const [cmd, key] = process.argv.slice(2);
-
-const apiKey = process.env.AGENT_JOB_TOKEN;
-const appUrl = process.env.APP_URL;
-
-// Default to list
-if (!cmd || cmd === 'list') {
-  if (!apiKey || !appUrl) {
-    console.log('No agent secrets available (missing AGENT_JOB_TOKEN or APP_URL).');
-    process.exit(0);
-  }
-  const url = `${appUrl}/api/agent-job-list-secrets`;
-  const res = await fetch(url, {
-    headers: { 'x-api-key': apiKey },
-  });
-  if (!res.ok) {
-    const body = await res.text();
-    console.error(`GET ${url} → ${res.status} ${body}`);
-    process.exit(1);
-  }
-  const json = await res.json();
-  const secrets = json.secrets;
-  if (!secrets || secrets.length === 0) {
-    console.log('No agent secrets configured.');
-  } else {
-    console.log('Available secrets:');
-    secrets.forEach(s => {
-      const hint = s.secretType === 'oauth2' ? '  (OAuth — use get to fetch access token)'
-                 : s.secretType === 'oauth_token' ? '  (OAuth token — use get to fetch)'
-                 : '';
-      console.log(`  - ${s.key}${hint}`);
-    });
-    console.log('\nUse: agent-job-secrets get KEY_NAME');
-    console.log('If a fetched value stops working, call get again for a fresh one.');
-  }
-  process.exit(0);
-}
-
-if (!apiKey) { console.error('AGENT_JOB_TOKEN not available'); process.exit(1); }
-if (!appUrl) { console.error('APP_URL not available'); process.exit(1); }
-
-if (cmd === 'get') {
-  if (!key) { console.error('Usage: agent-job-secrets get KEY_NAME'); process.exit(1); }
-  const url = `${appUrl}/api/get-agent-job-secret?key=${encodeURIComponent(key)}`;
-  const res = await fetch(url, {
-    headers: { 'x-api-key': apiKey },
-  });
-  if (!res.ok) {
-    const body = await res.text();
-    console.error(`GET ${url} → ${res.status} ${body}`);
-    process.exit(1);
-  }
-  const json = await res.json();
-  console.log(json.value);
-  process.exit(0);
-}
-
-console.error(`Unknown command: ${cmd}`);
-console.error('Available commands: list, get');
-process.exit(1);