totopo 0.1.4 → 0.1.5

package/ai.sh

@@ -79,9 +79,9 @@ fi
 
 # ─── Gather state for menu ──────────────────────────────────────────────────
 PROJECT_NAME="$(basename "$REPO_ROOT")"
-WORKSPACE_NAME="totopo-$PROJECT_NAME"
+WORKSPACE_NAME="totopo-managed-$PROJECT_NAME"
 
-ACTIVE_COUNT=$(docker ps --filter "name=totopo-" --format "{{.Names}}" 2>/dev/null | wc -l | tr -d '[:space:]')
+ACTIVE_COUNT=$(docker ps --filter "name=totopo-managed-" --format "{{.Names}}" 2>/dev/null | wc -l | tr -d '[:space:]')
 
 HAS_KEY=false
 if [ -f "$REPO_ROOT/.totopo/.env" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totopo",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Secure AI Box — isolated dev environments for AI coding assistants",
   "type": "module",
   "bin": {

package/src/core/dev.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-// =============================================================================
+// =========================================================================================================================================
 // scripts/dev.ts — Start the dev container and SSH in
 // Called by ai.sh — do not run directly.
-// =============================================================================
+// =========================================================================================================================================
 
 import { spawnSync } from "node:child_process";
 import { basename } from "node:path";
@@ -10,40 +10,28 @@ import { log, outro } from "@clack/prompts";
 
 const workspaceDir = process.env.TOTOPO_REPO_ROOT;
 if (!workspaceDir) {
-	log.error("TOTOPO_REPO_ROOT not set — run via ai.sh");
-	process.exit(1);
+    log.error("TOTOPO_REPO_ROOT not set — run via ai.sh");
+    process.exit(1);
 }
 
-const workspaceName = `totopo-${basename(workspaceDir)}`;
+// Derive a stable workspace ID — "totopo-managed-" prefix lets reset/stop scripts identify managed workspaces
+const workspaceName = `totopo-managed-${basename(workspaceDir)}`;
 
 // Always run devpod up — it's idempotent (starts if stopped, no-op if running)
 log.step("Starting dev container...");
 const up = spawnSync(
-	"devpod",
-	[
-		"up",
-		workspaceDir,
-		"--devcontainer-path",
-		".totopo/devcontainer.json",
-		"--ide",
-		"none",
-		"--id",
-		workspaceName,
-	],
-	{ stdio: "inherit" },
+    "devpod",
+    ["up", workspaceDir, "--devcontainer-path", ".totopo/devcontainer.json", "--ide", "none", "--id", workspaceName],
+    { stdio: "inherit" },
 );
 if (up.status !== 0) {
-	outro("Failed to start dev container.");
-	process.exit(up.status ?? 1);
+    outro("Failed to start dev container.");
+    process.exit(up.status ?? 1);
 }
 log.step("Connecting via SSH...");
 
-const ssh = spawnSync(
-	"devpod",
-	["ssh", workspaceName, "--workdir", "/workspace"],
-	{
-		stdio: "inherit",
-	},
-);
+const ssh = spawnSync("devpod", ["ssh", workspaceName, "--workdir", "/workspace"], {
+    stdio: "inherit",
+});
 
 process.exit(ssh.status ?? 0);

package/src/core/doctor.ts

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-// =============================================================================
+// =========================================================================================================================================
 // scripts/doctor.ts — Host readiness check for totopo
 // Runs silently on success; exits non-zero on failure.
 // Pass --verbose for a full report.
-// =============================================================================
+// =========================================================================================================================================
 
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -12,109 +12,84 @@ import { log, outro } from "@clack/prompts";
 const verbose = process.argv.includes("--verbose");
 const repoRoot = process.env.TOTOPO_REPO_ROOT;
 if (!repoRoot) {
-	log.error("TOTOPO_REPO_ROOT not set — run via ai.sh");
-	process.exit(1);
+    log.error("TOTOPO_REPO_ROOT not set — run via ai.sh");
+    process.exit(1);
 }
 
 const errors: string[] = [];
 
+// Logs the result of a single health check; accumulates failures into the errors array for the final report
 function check(label: string, ok: boolean, detail?: string): void {
-	if (ok) {
-		if (verbose)
-			log.success(`${label}${detail ? `  \x1b[2m${detail}\x1b[0m` : ""}`);
-	} else {
-		errors.push(`${label}${detail ? `: ${detail}` : ""}`);
-		if (verbose) log.error(`${label}${detail ? `  ${detail}` : ""}`);
-	}
+    if (ok) {
+        if (verbose) log.success(`${label}${detail ? `  \x1b[2m${detail}\x1b[0m` : ""}`);
+    } else {
+        errors.push(`${label}${detail ? `: ${detail}` : ""}`);
+        if (verbose) log.error(`${label}${detail ? `  ${detail}` : ""}`);
+    }
 }
 
+// Returns true if the given CLI tool is resolvable in the system PATH
 function commandExists(cmd: string): boolean {
-	const r = spawnSync("command", ["-v", cmd], {
-		shell: true,
-		encoding: "utf8",
-	});
-	return r.status === 0;
+    const r = spawnSync("command", ["-v", cmd], {
+        shell: true,
+        encoding: "utf8",
+    });
+    return r.status === 0;
 }
 
 if (verbose) console.log("");
 
-// --- Docker installed ---
-check(
-	"Docker installed",
-	commandExists("docker"),
-	commandExists("docker") ? undefined : "'docker' not found in PATH",
-);
+// ─── Docker installed ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+check("Docker installed", commandExists("docker"), commandExists("docker") ? undefined : "'docker' not found in PATH");
 
-// --- Docker running ---
+// ─── Docker running ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 const dockerInfo = spawnSync("docker", ["info"], {
-	encoding: "utf8",
-	stdio: "pipe",
+    encoding: "utf8",
+    stdio: "pipe",
 });
-check(
-	"Docker running",
-	dockerInfo.status === 0,
-	dockerInfo.status === 0 ? undefined : "Docker daemon not responding",
-);
+check("Docker running", dockerInfo.status === 0, dockerInfo.status === 0 ? undefined : "Docker daemon not responding");
 
-// --- DevPod installed ---
+// ─── DevPod installed ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 const devpodInstalled = commandExists("devpod");
-check(
-	"DevPod installed",
-	devpodInstalled,
-	devpodInstalled ? undefined : "'devpod' not found in PATH",
-);
+check("DevPod installed", devpodInstalled, devpodInstalled ? undefined : "'devpod' not found in PATH");
 
-// --- DevPod provider configured ---
+// ─── DevPod provider configured ──────────────────────────────────────────────────────────────────────────────────────────────────────────
 if (devpodInstalled) {
-	let providerOk = false;
-	for (let attempt = 1; attempt <= 5; attempt++) {
-		const r = spawnSync("devpod", ["provider", "list"], {
-			encoding: "utf8",
-			stdio: "pipe",
-		});
-		if (r.stdout?.toLowerCase().includes("docker")) {
-			providerOk = true;
-			break;
-		}
-		if (attempt < 5) {
-			spawnSync("sleep", ["1"]);
-		}
-	}
-	check(
-		"DevPod provider configured",
-		providerOk,
-		providerOk
-			? undefined
-			: "no provider found — run: devpod provider add docker",
-	);
+    let providerOk = false;
+    for (let attempt = 1; attempt <= 5; attempt++) {
+        const r = spawnSync("devpod", ["provider", "list"], {
+            encoding: "utf8",
+            stdio: "pipe",
+        });
+        if (r.stdout?.toLowerCase().includes("docker")) {
+            providerOk = true;
+            break;
+        }
+        if (attempt < 5) {
+            spawnSync("sleep", ["1"]);
+        }
+    }
+    check("DevPod provider configured", providerOk, providerOk ? undefined : "no provider found — run: devpod provider add docker");
 }
 
-// --- .totopo/ config present ---
-const configOk =
-	existsSync(`${repoRoot}/.totopo/devcontainer.json`) &&
-	existsSync(`${repoRoot}/.totopo/Dockerfile`);
-check(
-	".totopo/ config present",
-	configOk,
-	configOk
-		? undefined
-		: "missing .totopo/devcontainer.json or .totopo/Dockerfile",
-);
+// ─── .totopo/ config present ─────────────────────────────────────────────────────────────────────────────────────────────────────────────
+const configOk = existsSync(`${repoRoot}/.totopo/devcontainer.json`) && existsSync(`${repoRoot}/.totopo/Dockerfile`);
+check(".totopo/ config present", configOk, configOk ? undefined : "missing .totopo/devcontainer.json or .totopo/Dockerfile");
 
-// --- Report ---
+// ─── Report ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 if (errors.length > 0) {
-	if (verbose) {
-		console.log("");
-		log.error("totopo doctor found problems:");
-		for (const err of errors) {
-			console.log(`       \x1b[2m•\x1b[0m  ${err}`);
-		}
-		console.log("");
-	}
-	process.exit(1);
+    if (verbose) {
+        console.log("");
+        log.error("totopo doctor found problems:");
+        for (const err of errors) {
+            console.log(`       \x1b[2m•\x1b[0m  ${err}`);
+        }
+        console.log("");
+    }
+    process.exit(1);
 }
 
 if (verbose) {
-	console.log("");
-	outro("All checks passed.");
+    console.log("");
+    outro("All checks passed.");
 }

package/src/core/menu.ts

@@ -1,46 +1,43 @@
 #!/usr/bin/env node
-// =============================================================================
+// =========================================================================================================================================
 // scripts/menu.ts — totopo interactive menu (powered by @clack/prompts)
 // Called by ai.sh — outputs selected action to stderr.
-// =============================================================================
+// =========================================================================================================================================
 
 import { box, cancel, isCancel, select } from "@clack/prompts";
 
-const [projectName = "unknown", activeCountStr, hasKeyStr] =
-	process.argv.slice(2);
+// Parse CLI args passed by ai.sh: project name, active container count, and API key presence flag
+const [projectName = "unknown", activeCountStr, hasKeyStr] = process.argv.slice(2);
 const activeCount = Number.parseInt(activeCountStr ?? "0", 10);
 const hasKey = hasKeyStr === "true";
 
-// ─── Status box ──────────────────────────────────────────────────────────────
-const sessionLabel =
-	activeCount === 1
-		? "1 container running"
-		: `${activeCount} containers running`;
+// ─── Status box ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
+const sessionLabel = activeCount === 1 ? "1 container running" : `${activeCount} containers running`;
 const lines = [];
 lines.push(`status: ${sessionLabel}`);
 lines.push(`api keys: ${hasKey ? "configured" : "none"} (.totopo/.env)`);
 box(lines.join("\n"), ` totopo · ${projectName} `, {
-	contentAlign: "center",
-	titleAlign: "center",
-	width: "auto",
-	rounded: true,
+    contentAlign: "center",
+    titleAlign: "center",
+    width: "auto",
+    rounded: true,
 });
 
-// ─── Menu ───────────────────────────────────────────────────────────────────
+// ─── Menu ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 const action = await select({
-	message: "Menu:",
-	options: [
-		{ value: "dev", label: "Start session" },
-		{ value: "stop", label: "Stop all" },
-		{ value: "reset", label: "Reset (wipe workspaces + images)" },
-		{ value: "doctor", label: "Doctor" },
-		{ value: "quit", label: "Quit" },
-	],
+    message: "Menu:",
+    options: [
+        { value: "dev", label: "Start session" },
+        { value: "stop", label: "Stop all" },
+        { value: "reset", label: "Reset (wipe workspaces + images)" },
+        { value: "doctor", label: "Doctor" },
+        { value: "quit", label: "Quit" },
+    ],
 });
 
 if (isCancel(action)) {
-	cancel();
-	process.exit(0);
+    cancel();
+    process.exit(0);
 }
 
 // Output action to stderr — ai.sh captures it via redirection

package/src/core/onboard.ts

@@ -1,104 +1,74 @@
 #!/usr/bin/env node
-// =============================================================================
+// =========================================================================================================================================
 // scripts/onboard.ts — First-time setup for a project using totopo
 // Called by ai.sh when no .totopo/ config is found in the project.
-// =============================================================================
-
-import {
-	cpSync,
-	existsSync,
-	mkdirSync,
-	readFileSync,
-	writeFileSync,
-} from "node:fs";
+// =========================================================================================================================================
+
+import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
-import {
-	box,
-	cancel,
-	confirm,
-	intro,
-	isCancel,
-	log,
-	outro,
-} from "@clack/prompts";
+import { box, cancel, confirm, intro, isCancel, log, outro } from "@clack/prompts";
 
 const packageDir = process.env.TOTOPO_PACKAGE_DIR;
 const repoRoot = process.env.TOTOPO_REPO_ROOT;
 
 if (!packageDir || !repoRoot) {
-	log.error("TOTOPO_PACKAGE_DIR / TOTOPO_REPO_ROOT not set — run via ai.sh");
-	process.exit(1);
+    log.error("TOTOPO_PACKAGE_DIR / TOTOPO_REPO_ROOT not set — run via ai.sh");
+    process.exit(1);
 }
 
 const templatesDir = join(packageDir, "templates");
 const totopoDir = join(repoRoot, ".totopo");
 const projectName = basename(repoRoot);
 
-// ─── Intro ────────────────────────────────────────────────────────────────────
+// ─── Intro ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 intro("totopo — First-time setup");
 
-box(
-	`project  : ${projectName}\nlocation : ${totopoDir}`,
-	"No .totopo/ config found — totopo will create it now.",
-	{
-		contentAlign: "center",
-		titleAlign: "center",
-		width: "auto",
-		rounded: true,
-	},
-);
+box(`project  : ${projectName}\nlocation : ${totopoDir}`, "No .totopo/ config found — totopo will create it now.", {
+    contentAlign: "center",
+    titleAlign: "center",
+    width: "auto",
+    rounded: true,
+});
 
 const ok = await confirm({ message: "Continue?" });
 
 if (isCancel(ok) || !ok) {
-	cancel("Setup cancelled.");
-	process.exit(0);
+    cancel("Setup cancelled.");
+    process.exit(0);
 }
 
-// ─── Copy templates ───────────────────────────────────────────────────────────
+// ─── Copy templates ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 mkdirSync(totopoDir, { recursive: true });
 
 cpSync(join(templatesDir, "Dockerfile"), join(totopoDir, "Dockerfile"));
 cpSync(join(templatesDir, "post-start.mjs"), join(totopoDir, "post-start.mjs"));
 
 // Substitute project name in devcontainer.json (plain string replace — file has // comments)
-const dcTemplate = readFileSync(
-	join(templatesDir, "devcontainer.json"),
-	"utf8",
-);
-writeFileSync(
-	join(totopoDir, "devcontainer.json"),
-	dcTemplate.replace(/TOTOPO_PROJECT_NAME/g, projectName),
-);
+const dcTemplate = readFileSync(join(templatesDir, "devcontainer.json"), "utf8");
+writeFileSync(join(totopoDir, "devcontainer.json"), dcTemplate.replace(/TOTOPO_PROJECT_NAME/g, projectName));
 
 log.success("Copied config templates to .totopo/");
 
-// ─── Create .env ──────────────────────────────────────────────────────────────
+// ─── Create .env ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 const envPath = join(totopoDir, ".env");
 if (existsSync(envPath)) {
-	log.info(".totopo/.env already exists — leaving it untouched");
+    log.info(".totopo/.env already exists — leaving it untouched");
 } else {
-	cpSync(join(templatesDir, "env"), envPath);
-	log.success("Created .totopo/.env");
+    cpSync(join(templatesDir, "env"), envPath);
+    log.success("Created .totopo/.env");
 }
 
-// ─── Ensure .totopo/.env is gitignored ─────────────────────────────────────────
+// ─── Ensure .totopo/.env is gitignored ───────────────────────────────────────────────────────────────────────────────────────────────────
 const gitignorePath = join(repoRoot, ".gitignore");
 const gitignoreEntry = ".totopo/.env";
 
-if (
-	existsSync(gitignorePath) &&
-	readFileSync(gitignorePath, "utf8").includes(gitignoreEntry)
-) {
-	log.info(".totopo/.env already in .gitignore");
+if (existsSync(gitignorePath) && readFileSync(gitignorePath, "utf8").includes(gitignoreEntry)) {
+    log.info(".totopo/.env already in .gitignore");
 } else {
-	const addition =
-		"\n# totopo — API keys must never be committed\n.totopo/.env\n";
-	const existing = existsSync(gitignorePath)
-		? readFileSync(gitignorePath, "utf8")
-		: "";
-	writeFileSync(gitignorePath, existing + addition);
-	log.success("Added .totopo/.env to .gitignore");
+    const addition = "\n# totopo — API keys must never be committed\n.totopo/.env\n";
+    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf8") : "";
+    writeFileSync(gitignorePath, existing + addition);
+    log.success("Added .totopo/.env to .gitignore");
 }
 
 log.warn("Add your API keys to .totopo/.env before starting the container.");

package/src/core/reset.ts

@@ -1,70 +1,54 @@
 #!/usr/bin/env node
-// =============================================================================
+// =========================================================================================================================================
 // scripts/reset.ts — Full reset: delete all totopo workspaces and Docker images
 // Called by ai.sh — do not run directly.
 // Run 'ai.sh' → Start session after this to get a fresh build.
-// =============================================================================
+// =========================================================================================================================================
 
 import { spawnSync } from "node:child_process";
 import { log, outro } from "@clack/prompts";
 
-// ─── Step 1: Find all totopo-* DevPod workspaces ───────────────────────────────
+// ─── Step 1: Find all totopo-managed-* DevPod workspaces ─────────────────────────────────────────────────────────────────────────────────
 const listResult = spawnSync("devpod", ["list", "--output", "json"], {
-	encoding: "utf8",
+    encoding: "utf8",
 });
 
 const workspaces: string[] = [];
 if (listResult.stdout) {
-	const matches = listResult.stdout.matchAll(/"id":"(totopo-[^"]+)"/g);
-	for (const match of matches) {
-		if (match[1]) workspaces.push(match[1]);
-	}
+    const matches = listResult.stdout.matchAll(/"id":"(totopo-managed-[^"]+)"/g);
+    for (const match of matches) {
+        if (match[1]) workspaces.push(match[1]);
+    }
 }
 
-// ─── Step 2: Stop and delete all totopo workspaces ─────────────────────────────
+// ─── Step 2: Stop and delete all totopo workspaces ───────────────────────────────────────────────────────────────────────────────────────
 if (workspaces.length === 0) {
-	log.info("No totopo workspaces found.");
+    log.info("No totopo workspaces found.");
 } else {
-	log.step(`Stopping and deleting ${workspaces.length} workspace(s)...`);
-	for (const ws of workspaces) {
-		log.step(`  Removing ${ws}...`);
-		spawnSync("devpod", ["stop", ws], { stdio: "inherit" });
-		spawnSync("devpod", ["delete", ws, "--force"], { stdio: "inherit" });
-	}
+    log.step(`Stopping and deleting ${workspaces.length} workspace(s)...`);
+    for (const ws of workspaces) {
+        log.step(`  Removing ${ws}...`);
+        spawnSync("devpod", ["stop", ws], { stdio: "inherit" });
+        spawnSync("devpod", ["delete", ws, "--force"], { stdio: "inherit" });
+    }
 }
 
-// ─── Step 3: Remove cached Docker images ─────────────────────────────────────
-// DevPod images are named vsc-<project>-<hash> (based on the folder name, not
-// the workspace --id). For each totopo-<project> workspace, strip the "totopo-"
-// prefix to get the image reference filter.
+// ─── Step 3: Remove cached Docker images ─────────────────────────────────────────────────────────────────────────────────────────────────
+// Images are identified via the LABEL totopo.managed=true baked into the
+// Dockerfile template — works regardless of whether workspaces still exist.
 log.step("Removing cached Docker images...");
 
-const allImageIds = new Set<string>();
-for (const ws of workspaces) {
-	const projectName = ws.replace(/^totopo-/, "");
-	const findImages = spawnSync(
-		"docker",
-		[
-			"images",
-			"--filter",
-			`reference=vsc-${projectName}-*`,
-			"--format",
-			"{{.ID}}",
-		],
-		{ encoding: "utf8" },
-	);
-	const ids = (findImages.stdout ?? "").trim().split("\n").filter(Boolean);
-	for (const id of ids) allImageIds.add(id);
-}
+const findImages = spawnSync("docker", ["images", "--filter", "label=totopo.managed=true", "--format", "{{.ID}}"], { encoding: "utf8" });
+const imageIds = (findImages.stdout ?? "").trim().split("\n").filter(Boolean);
 
-if (allImageIds.size > 0) {
-	log.info(`  Found ${allImageIds.size} image(s) — removing...`);
-	spawnSync("docker", ["rmi", "--force", ...allImageIds], { stdio: "inherit" });
+if (imageIds.length > 0) {
+    log.info(`  Found ${imageIds.length} image(s) — removing...`);
+    spawnSync("docker", ["rmi", "--force", ...imageIds], { stdio: "inherit" });
 } else {
-	log.info("  No cached images found.");
+    log.info("  No cached images found.");
 }
 
 spawnSync("docker", ["image", "prune", "--force"], { stdio: "inherit" });
 
-// ─── Done ─────────────────────────────────────────────────────────────────────
+// ─── Done ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 outro("Reset complete. Run 'ai.sh' and select 'Start session' to start fresh.");

package/src/core/stop.ts

@@ -1,35 +1,37 @@
 #!/usr/bin/env node
-// =============================================================================
+// =========================================================================================================================================
 // scripts/stop.ts — Stop and remove all totopo dev container workspaces
 // Called by ai.sh — do not run directly.
-// =============================================================================
+// =========================================================================================================================================
 
 import { spawnSync } from "node:child_process";
 import { log, outro } from "@clack/prompts";
 
+// ─── Find all running totopo workspaces ──────────────────────────────────────────────────────────────────────────────────────────────────
 const listResult = spawnSync("devpod", ["list", "--output", "json"], {
-	encoding: "utf8",
+    encoding: "utf8",
 });
 
 const workspaces: string[] = [];
 if (listResult.stdout) {
-	const matches = listResult.stdout.matchAll(/"id":"(totopo-[^"]+)"/g);
-	for (const match of matches) {
-		if (match[1]) workspaces.push(match[1]);
-	}
+    const matches = listResult.stdout.matchAll(/"id":"(totopo-managed-[^"]+)"/g);
+    for (const match of matches) {
+        if (match[1]) workspaces.push(match[1]);
+    }
 }
 
 if (workspaces.length === 0) {
-	log.info("No totopo workspaces found.");
-	process.exit(0);
+    log.info("No totopo workspaces found.");
+    process.exit(0);
 }
 
+// ─── Stop and remove each workspace ──────────────────────────────────────────────────────────────────────────────────────────────────────
 log.step("Stopping all totopo workspaces...");
 
 for (const ws of workspaces) {
-	log.step(`Stopping ${ws}...`);
-	spawnSync("devpod", ["stop", ws], { stdio: "inherit" });
-	spawnSync("devpod", ["delete", ws, "--force"], { stdio: "inherit" });
+    log.step(`Stopping ${ws}...`);
+    spawnSync("devpod", ["stop", ws], { stdio: "inherit" });
+    spawnSync("devpod", ["delete", ws, "--force"], { stdio: "inherit" });
 }
 
 outro("All totopo workspaces stopped and removed.");

package/templates/Dockerfile

@@ -5,6 +5,7 @@
 # =============================================================================
 
 FROM node:22-bookworm-slim
+LABEL totopo.managed=true
 
 # ---------------------------------------------------------------------------
 # System packages

package/templates/devcontainer.json

@@ -1,40 +1,35 @@
 {
-	"name": "TOTOPO_PROJECT_NAME",
+    "name": "TOTOPO_PROJECT_NAME",
 
-	// Build from local Dockerfile
-	"build": {
-		"dockerfile": "Dockerfile",
-		"context": ".."
-	},
+    // Build from local Dockerfile
+    "build": {
+        "dockerfile": "Dockerfile",
+        "context": ".."
+    },
 
-	// Mount the repo as the workspace — nothing else is visible
-	"workspaceFolder": "/workspace",
-	"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached",
+    // Mount the repo as the workspace — nothing else is visible
+    "workspaceFolder": "/workspace",
+    "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached",
 
-	// Pass API keys from a local .env file — never baked into the image
-	// Create .totopo/.env on your host (see README.md)
-	"runArgs": [
-		"--name",
-		"totopo-${localWorkspaceFolderBasename}",
-		"--env-file",
-		"${localWorkspaceFolder}/.totopo/.env"
-	],
+    // Pass API keys from a local .env file — never baked into the image
+    // Create .totopo/.env on your host (see README.md)
+    "runArgs": ["--name", "totopo-${localWorkspaceFolderBasename}", "--env-file", "${localWorkspaceFolder}/.totopo/.env"],
 
-	// Run security + readiness checks every time container starts
-	"postStartCommand": "node /workspace/.totopo/post-start.mjs",
+    // Run security + readiness checks every time container starts
+    "postStartCommand": "node /workspace/.totopo/post-start.mjs",
 
-	// Terminal-only — no extensions installed
-	"customizations": {
-		"vscode": {
-			"extensions": [],
-			"settings": {
-				// Do not forward host git credentials into the container
-				"remote.containers.gitCredentialHelperConfigLocation": "none"
-			}
-		}
-	},
+    // Terminal-only — no extensions installed
+    "customizations": {
+        "vscode": {
+            "extensions": [],
+            "settings": {
+                // Do not forward host git credentials into the container
+                "remote.containers.gitCredentialHelperConfigLocation": "none"
+            }
+        }
+    },
 
-	// Drop capabilities — container cannot gain new privileges
-	"capAdd": [],
-	"securityOpt": ["no-new-privileges:true"]
+    // Drop capabilities — container cannot gain new privileges
+    "capAdd": [],
+    "securityOpt": ["no-new-privileges:true"]
 }

package/templates/post-start.mjs

@@ -8,14 +8,14 @@
 import { execSync } from "node:child_process";
 
 const run = (cmd) => {
-	try {
-		return execSync(cmd, {
-			encoding: "utf8",
-			stdio: ["pipe", "pipe", "pipe"],
-		}).trim();
-	} catch {
-		return null;
-	}
+    try {
+        return execSync(cmd, {
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+    } catch {
+        return null;
+    }
 };
 
 // ─── ANSI helpers ─────────────────────────────────────────────────────────────
@@ -27,13 +27,11 @@ const bold = (s) => `\x1b[1m${s}\x1b[0m`;
 
 let errors = 0;
 
-const ok = (label, detail) =>
-	console.log(`${green("✓")} ${label.padEnd(24)}${detail ? dim(detail) : ""}`);
-const warn = (label, detail) =>
-	console.log(`${yellow("▲")} ${label.padEnd(24)}${detail ? dim(detail) : ""}`);
+const ok = (label, detail) => console.log(`${green("✓")} ${label.padEnd(24)}${detail ? dim(detail) : ""}`);
+const warn = (label, detail) => console.log(`${yellow("▲")} ${label.padEnd(24)}${detail ? dim(detail) : ""}`);
 const fail = (label, detail) => {
-	console.log(`${red("✗")} ${label.padEnd(24)}${detail || ""}`);
-	errors++;
+    console.log(`${red("✗")} ${label.padEnd(24)}${detail || ""}`);
+    errors++;
 };
 const section = (title) => console.log(`\n${bold(title)}`);
 
@@ -45,35 +43,35 @@ section("Security");
 
 const whoami = run("whoami");
 if (whoami !== "root") {
-	ok("non-root user", whoami ?? "unknown");
+    ok("non-root user", whoami ?? "unknown");
 } else {
-	fail("non-root user", "running as root — container is misconfigured");
+    fail("non-root user", "running as root — container is misconfigured");
 }
 
 const gitProtocol = run("git config --system protocol.allow");
 if (gitProtocol === "never") {
-	ok("git remote block", "protocol.allow = never");
+    ok("git remote block", "protocol.allow = never");
 } else {
-	fail("git remote block", "not set — rebuild the container");
+    fail("git remote block", "not set — rebuild the container");
 }
 
 try {
-	execSync("/usr/bin/git -C /workspace push", { stdio: "pipe" });
-	fail("push blocked", "git push succeeded — remote access is NOT blocked");
+    execSync("/usr/bin/git -C /workspace push", { stdio: "pipe" });
+    fail("push blocked", "git push succeeded — remote access is NOT blocked");
 } catch {
-	ok("push blocked", "remote push not possible");
+    ok("push blocked", "remote push not possible");
 }
 
 // ─── AI tools ────────────────────────────────────────────────────────────────
 section("AI tools");
 
 const checkTool = (cmd) => {
-	const out = run(`${cmd} --version`);
-	if (out !== null) {
-		ok(cmd, out.split("\n")[0]);
-	} else {
-		fail(cmd, "not found — rebuild container");
-	}
+    const out = run(`${cmd} --version`);
+    if (out !== null) {
+        ok(cmd, out.split("\n")[0]);
+    } else {
+        fail(cmd, "not found — rebuild container");
+    }
 };
 
 checkTool("claude");
@@ -91,12 +89,12 @@ ok("pnpm", run("pnpm --version") ? `v${run("pnpm --version")}` : "not found");
 section("API keys");
 
 const checkKey = (varName) => {
-	const val = process.env[varName];
-	if (val) {
-		ok(varName, `${val.substring(0, 12)}...`);
-	} else {
-		warn(varName, "not set — add to .totopo/.env");
-	}
+    const val = process.env[varName];
+    if (val) {
+        ok(varName, `${val.substring(0, 12)}...`);
+    } else {
+        warn(varName, "not set — add to .totopo/.env");
+    }
 };
 
 checkKey("ANTHROPIC_API_KEY");
@@ -104,10 +102,8 @@ checkKey("KILO_API_KEY");
 
 // ─── Summary ─────────────────────────────────────────────────────────────────
 if (errors === 0) {
-	console.log(`\n${green("●")} ${bold("Ready.")}\n`);
+    console.log(`\n${green("●")} ${bold("Ready.")}\n`);
 } else {
-	console.log(
-		`\n${red("●")} ${bold(`${errors} error(s) — see above. Rebuild the container to fix.`)}\n`,
-	);
-	process.exit(1);
+    console.log(`\n${red("●")} ${bold(`${errors} error(s) — see above. Rebuild the container to fix.`)}\n`);
+    process.exit(1);
 }

package/tsconfig.json

@@ -1,27 +1,27 @@
 {
-	// Visit https://aka.ms/tsconfig to read more about this file
-	"compilerOptions": {
-		// Environment Settings
-		// See also https://aka.ms/tsconfig/module
-		"module": "nodenext",
-		"target": "esnext",
-		"lib": ["esnext"],
-		"types": ["node"],
+    // Visit https://aka.ms/tsconfig to read more about this file
+    "compilerOptions": {
+        // Environment Settings
+        // See also https://aka.ms/tsconfig/module
+        "module": "nodenext",
+        "target": "esnext",
+        "lib": ["esnext"],
+        "types": ["node"],
 
-		// Other Outputs
-		"noEmit": true,
+        // Other Outputs
+        "noEmit": true,
 
-		// Stricter Typechecking Options
-		"noUncheckedIndexedAccess": true,
-		"exactOptionalPropertyTypes": true,
+        // Stricter Typechecking Options
+        "noUncheckedIndexedAccess": true,
+        "exactOptionalPropertyTypes": true,
 
-		// Recommended Options
-		"strict": true,
-		"verbatimModuleSyntax": true,
-		"isolatedModules": true,
-		"noUncheckedSideEffectImports": true,
-		"moduleDetection": "force",
-		"skipLibCheck": true
-	},
-	"include": ["src/**/*.ts"]
+        // Recommended Options
+        "strict": true,
+        "verbatimModuleSyntax": true,
+        "isolatedModules": true,
+        "noUncheckedSideEffectImports": true,
+        "moduleDetection": "force",
+        "skipLibCheck": true
+    },
+    "include": ["src/**/*.ts"]
 }