totopo 3.7.0 → 3.8.1

package/README.md

@@ -70,11 +70,11 @@ A few key concepts:
 
 ### `totopo.yaml`
 
-The config is minimal — four fields:
+The config is minimal — only `workspace_id` is required; the rest are optional:
 
-- **`workspace_id`** — unique slug for container naming and cache directory
-- **`profiles`** — Dockerfile image variants (see [Profiles](#profiles))
-- **`shadow_paths`** — gitignore-style patterns hidden from agents (see [Shadow Paths](#shadow-paths))
+- **`workspace_id`** *(required)* — unique slug for container naming and cache directory
+- **`profiles`** *(optional)* — Dockerfile image variants (see [Profiles](#profiles))
+- **`shadow_paths`** *(optional)* — gitignore-style patterns hidden from agents (see [Shadow Paths](#shadow-paths))
 - **`env_file`** *(optional)* — path to env file injected at runtime (see [Environment Variables](#environment-variables))
 
 On every run, totopo shows the workspace menu:

package/dist/lib/dockerfile-builder.js

@@ -50,6 +50,7 @@ export const BAKED_TEMPLATE_FILES = [
     "claude-statusline.sh",
     "git-readonly-wrapper.mjs",
     "npmrc",
+    "pnpm-config.yaml",
     "runtime-constants.mjs",
     "startup-git-mode.mjs",
     "startup.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totopo",
-  "version": "3.7.0",
+  "version": "3.8.1",
   "description": "Run AI coding agents safely in your local codebase",
   "type": "module",
   "bin": {

package/templates/Dockerfile

@@ -8,7 +8,16 @@
 # dockerfile_hook in totopo.yaml profiles.
 # =============================================================================
 
-FROM debian:bookworm-slim
+# ---------------------------------------------------------------------------
+# Version pinning policy
+# Infra tools whose major versions can change behavior are pinned exact so that
+# fresh and --no-cache builds stay reproducible; bumping a pin edits this file,
+# busts the build hash, and auto-prompts a rebuild. Deliberately left floating:
+# apt packages (pinned by the Debian trixie release), Node (major-pinned via
+# setup_24.x; minors carry security fixes), and the AI CLIs (always latest).
+# ---------------------------------------------------------------------------
+
+FROM debian:trixie-slim
 LABEL totopo.managed=true
 
 # Enable 24-bit color support for AI CLIs (suppresses color upgrade prompts)
@@ -24,8 +33,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential pkg-config libssl-dev \
     # Utilities
     jq unzip zip tree htop procps lsb-release gnupg ca-certificates sox file bubblewrap \
-    # Modern search/navigation tools
-    ripgrep fzf \
+    # Modern search/navigation tools (fd-find installs the binary as 'fdfind'; symlinked to 'fd' below)
+    ripgrep fzf fd-find \
     # Database clients
     sqlite3 postgresql-client default-mysql-client redis-tools \
     # Python (needed for build scripts and as a light default)
@@ -33,19 +42,16 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # ---------------------------------------------------------------------------
-# Layer 2 — fd (GitHub release)
+# Layer 2 — fd (from apt fd-find; Debian names the binary 'fdfind')
+# Symlink to 'fd' so the tool is callable by its upstream name.
 # ---------------------------------------------------------------------------
-RUN ARCH=$(dpkg --print-architecture) && \
-    FD_VERSION=$(curl -fsSL https://api.github.com/repos/sharkdp/fd/releases/latest \
-        | python3 -c "import sys,json; print(json.load(sys.stdin)['tag_name'][1:])") && \
-    curl -fsSL "https://github.com/sharkdp/fd/releases/download/v${FD_VERSION}/fd_${FD_VERSION}_${ARCH}.deb" \
-        -o /tmp/fd.deb && dpkg -i /tmp/fd.deb && rm /tmp/fd.deb
+RUN ln -sf "$(command -v fdfind)" /usr/local/bin/fd
 
 # ---------------------------------------------------------------------------
-# Layer 3 — yq (GitHub release)
+# Layer 3 — yq (GitHub release, pinned)
 # ---------------------------------------------------------------------------
 RUN ARCH=$(dpkg --print-architecture) && \
-    curl -fsSL "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" \
+    curl -fsSL "https://github.com/mikefarah/yq/releases/download/v4.53.3/yq_linux_${ARCH}" \
         -o /usr/local/bin/yq && chmod +x /usr/local/bin/yq
 
 # ---------------------------------------------------------------------------
@@ -59,9 +65,10 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
     apt-get update && apt-get install -y gh && rm -rf /var/lib/apt/lists/*
 
 # ---------------------------------------------------------------------------
-# Layer 5 — Node.js LTS (via NodeSource)
+# Layer 5 — Node.js 24 LTS (via NodeSource)
+# Trixie's apt nodejs is 20.x; NodeSource is pinned to the current Active LTS (24.x).
 # ---------------------------------------------------------------------------
-RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
+RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \
     apt-get install -y nodejs && rm -rf /var/lib/apt/lists/*
 
 # ---------------------------------------------------------------------------
@@ -71,10 +78,13 @@ RUN git config --system protocol.allow never && \
     git config --system protocol.file.allow always
 
 # ---------------------------------------------------------------------------
-# Layer 7 — Global npm tools (AI CLIs)
+# Layer 7 — Global npm tools (pnpm pinned; AI CLIs always latest)
+# pnpm is pinned exact: pnpm 11 changed where global settings are read from
+# (~/.config/pnpm/config.yaml, no longer ~/.npmrc), so an unpinned major bump
+# can silently break the baked store-dir config.
 # ---------------------------------------------------------------------------
 RUN npm install -g \
-    pnpm \
+    pnpm@11.6.0 \
     opencode-ai \
     @anthropic-ai/claude-code \
     @openai/codex \
@@ -85,18 +95,20 @@ RUN npm install -g \
 # ---------------------------------------------------------------------------
 RUN groupadd --gid 1001 devuser && \
     useradd --uid 1001 --gid devuser --shell /bin/bash --create-home devuser && \
-    mkdir -p /home/devuser/.local/state /home/devuser/.local/share /home/devuser/.local/share/pnpm /home/devuser/.local/bin && \
+    mkdir -p /home/devuser/.local/state /home/devuser/.local/share /home/devuser/.local/share/pnpm /home/devuser/.local/bin /home/devuser/.config/pnpm && \
     date -u +"%Y-%m-%dT%H:%M:%S.000Z" > /home/devuser/.ai-cli-updated && \
     chown -R devuser:devuser /home/devuser
 
 # ---------------------------------------------------------------------------
-# Layer 9 — Bake startup script + git mode helper + shared constants into image
+# Layer 9 — Bake startup script + git mode helper + shared constants + pnpm config into image
+# pnpm 11+ reads settings from ~/.config/pnpm/config.yaml; ~/.npmrc covers anyone pinning pnpm <= 10.
 # ---------------------------------------------------------------------------
 COPY npmrc /home/devuser/.npmrc
+COPY pnpm-config.yaml /home/devuser/.config/pnpm/config.yaml
 COPY startup.mjs /home/devuser/startup.mjs
 COPY startup-git-mode.mjs /home/devuser/startup-git-mode.mjs
 COPY runtime-constants.mjs /home/devuser/runtime-constants.mjs
-RUN chown devuser:devuser /home/devuser/.npmrc /home/devuser/startup.mjs /home/devuser/startup-git-mode.mjs /home/devuser/runtime-constants.mjs
+RUN chown devuser:devuser /home/devuser/.npmrc /home/devuser/.config/pnpm/config.yaml /home/devuser/startup.mjs /home/devuser/startup-git-mode.mjs /home/devuser/runtime-constants.mjs
 
 # ---------------------------------------------------------------------------
 # Layer 10 — Bake git read-only wrapper into image

package/templates/pnpm-config.yaml

@@ -0,0 +1,9 @@
+# pnpm global config. pnpm 11+ reads its settings from here (~/.config/pnpm/config.yaml),
+# no longer from ~/.npmrc. Keys are camelCase, unlike the kebab-case equivalents in .npmrc.
+#
+# storeDir pins the global store onto a bind-mounted, same-device cache so pnpm never falls back
+# to creating a .pnpm-store inside the mounted /workspace. packageImportMethod=copy avoids
+# cross-filesystem hardlink failures. The matching ~/.npmrc keeps this working for anyone who
+# pins an older pnpm via packageManager (pnpm <= 10 still reads .npmrc).
+storeDir: /home/devuser/.local/share/pnpm/store
+packageImportMethod: copy