painapple-code 1.0.0rc1__tar.gz

painapple_code-1.0.0rc1/.devcontainer/devcontainer.json

@@ -0,0 +1,44 @@
+{
+    "name": "pAInapple Code",
+    "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
+
+    // pAInapple Code itself isn't auto-installed — open a terminal and run
+    //   curl -fsSL https://raw.githubusercontent.com/wrotek/painapple-code/main/features/src/painapple-code/install.sh | sudo bash
+    // (see features/src/painapple-code/README.md). The forwarded port and
+    // the VS Code settings below are everything Codespaces needs prepared
+    // up front; the rest is on-demand.
+    //
+    // Python + Node come from the official Features so npm / node-gyp /
+    // native-module builds work out of the box. (The base:ubuntu image is
+    // bare — common-utils only.)
+    "features": {
+        "ghcr.io/devcontainers/features/python:1": {},
+        "ghcr.io/devcontainers/features/node:1": {}
+    },
+
+    "forwardPorts": [8765],
+    "portsAttributes": {
+        "8765": {
+            "label": "pAInapple Code",
+            "onAutoForward": "notify",
+            "visibility": "private"
+        }
+    },
+
+    "customizations": {
+        "vscode": {
+            "extensions": [
+                "ms-python.python",
+                "redhat.vscode-yaml"
+            ],
+            // Default-hide the secondary side bar (Copilot Chat lives there).
+            // Users who want it can toggle with Ctrl+Alt+B at any time — this
+            // just keeps it out of the way on first open so the terminal has
+            // room to show the painapple-code login URL without wrapping.
+            // Setting added in VS Code 1.94 (Sept 2024).
+            "settings": {
+                "workbench.secondarySideBar.defaultVisibility": "hidden"
+            }
+        }
+    }
+}

painapple_code-1.0.0rc1/.dockerignore

@@ -0,0 +1,19 @@
+# Deny-by-default. Only the explicit allowlist below ships into the image.
+# Why deny-first: the repo has ~1.4GB of side projects (tauri-app/, tao/),
+# build-time deps (top-level tools/node_modules/), local-only docs, and
+# multiple worktrees that have no business in a runtime image.
+*
+
+# --- Runtime essentials ---
+!src/
+!requirements.txt
+!pyproject.toml
+!docker-entrypoint.sh
+!README.md
+!LICENSE
+
+# --- Re-exclusions inside the allowlist (cruft that sneaks in via src/) ---
+**/__pycache__/
+**/*.pyc
+**/.pytest_cache/
+**/.DS_Store

painapple_code-1.0.0rc1/.github/workflows/docker-publish.yml

@@ -0,0 +1,187 @@
+name: Publish Docker Image
+
+# Builds and publishes the painapple-code image to Docker Hub.
+#
+# Versioning scheme: SemVer — git tags shaped like vMAJOR.MINOR.PATCH
+# (e.g. v0.1.0, v1.2.3, v1.2.3-rc1). The git tag is the single source of
+# truth — both the Docker image tag and the pip package version
+# (via setuptools-scm) derive from it.
+#
+# Triggers:
+#   - push of a tag matching v*.*.*  → publishes :<tag> and :latest
+#                                       (pre-release tags like v0.1.0-rc1
+#                                       publish :<tag> and skip :latest)
+#   - workflow_dispatch              → publishes :edge (does not move :latest)
+#
+# Required repository secrets:
+#   - DOCKERHUB_USERNAME   (wrotek)
+#   - DOCKERHUB_TOKEN      (Hub access token, NOT account password)
+#
+# Multi-arch: builds linux/amd64 + linux/arm64 via buildx + QEMU.
+
+on:
+    push:
+        tags:
+            - "v*.*.*"
+    workflow_dispatch:
+
+env:
+    IMAGE: docker.io/wrotek/painapple-code
+
+jobs:
+    build-and-push:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+        steps:
+            # fetch-depth: 0 so setuptools-scm can `git describe` against
+            # all tags. Default shallow clone hides everything but HEAD.
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - name: Set up Python
+              uses: actions/setup-python@v5
+              with:
+                  python-version: "3.12"
+
+            # Single source-of-truth version. Same value gets baked into
+            # the wheel (via SETUPTOOLS_SCM_PRETEND_VERSION_FOR_… inside
+            # the image) and surfaces as `painapple-code --version`.
+            - name: Resolve package version from git
+              id: scm
+              run: |
+                  pip install --quiet 'setuptools-scm>=8'
+                  version=$(python -m setuptools_scm)
+                  echo "version=$version" >> "$GITHUB_OUTPUT"
+                  echo "→ setuptools-scm resolved: $version"
+
+            - name: Set up QEMU
+              uses: docker/setup-qemu-action@v3
+
+            - name: Set up Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Log in to Docker Hub
+              uses: docker/login-action@v3
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+            # Tag policy:
+            #   tag push v0.1.0            → :v0.1.0, :latest
+            #   tag push v0.1.0-rc1        → :v0.1.0-rc1        (skip :latest)
+            #   workflow_dispatch          → :edge               (skip :latest)
+            #
+            # type=ref,event=tag takes the tag name verbatim (keeps the
+            # leading `v`). We deliberately don't use type=semver — it
+            # would auto-emit :0.1 and :0 alias tags, which is library
+            # ergonomics we don't want for an end-user app.
+            - name: Derive image tags
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ${{ env.IMAGE }}
+                  tags: |
+                      type=ref,event=tag
+                      type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
+                      type=raw,value=edge,enable=${{ github.event_name == 'workflow_dispatch' }}
+                  labels: |
+                      org.opencontainers.image.version=${{ steps.scm.outputs.version }}
+                      org.opencontainers.image.revision=${{ github.sha }}
+                      org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+
+            - name: Build and push
+              id: build
+              uses: docker/build-push-action@v6
+              with:
+                  context: .
+                  platforms: linux/amd64,linux/arm64
+                  push: true
+                  tags: ${{ steps.meta.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}
+                  build-args: |
+                      SCM_VERSION=${{ steps.scm.outputs.version }}
+                  cache-from: type=gha
+                  cache-to: type=gha,mode=max
+
+    smoke-test:
+        # Pulls the freshly-pushed image on a clean runner and verifies the
+        # bridge boots: /health must return HTTP 200 within 30 s. Runs only
+        # for amd64 — buildx publishes the same code for both arches, so
+        # one platform is sufficient to catch packaging regressions.
+        needs: build-and-push
+        runs-on: ubuntu-latest
+        steps:
+            - name: Pick the tag we just published
+              id: tag
+              run: |
+                  if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+                      echo "ref=edge" >> "$GITHUB_OUTPUT"
+                  else
+                      # strip refs/tags/ prefix → vMAJOR.MINOR.PATCH[-prerelease]
+                      echo "ref=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+                  fi
+
+            - name: Boot container and curl /health
+              run: |
+                  set -euo pipefail
+                  IMG="${{ env.IMAGE }}:${{ steps.tag.outputs.ref }}"
+                  echo "→ Pulling $IMG"
+                  docker pull "$IMG"
+
+                  # Workspace mount: the entrypoint refuses to start unless
+                  # /workspace is non-empty. Use a one-file dir as a stand-in.
+                  mkdir -p /tmp/ws && echo "smoke" > /tmp/ws/README
+
+                  echo "→ Starting smoke container"
+                  docker run -d --name papple-smoke \
+                      -p 127.0.0.1:8765:8765 \
+                      -v /tmp/ws:/workspace \
+                      "$IMG"
+
+                  echo "→ Waiting for /health"
+                  for i in $(seq 1 30); do
+                      if curl -fsS http://127.0.0.1:8765/health > /dev/null 2>&1; then
+                          echo "✓ /health responded after ${i}s"
+                          # Also confirm the version we shipped is the one we baked in.
+                          docker exec papple-smoke python -c \
+                              "import painapple_code; print('version:', painapple_code.__version__)"
+                          exit 0
+                      fi
+                      sleep 1
+                  done
+
+                  echo "✗ /health never responded"
+                  docker logs papple-smoke || true
+                  exit 1
+
+            - name: Cleanup
+              if: always()
+              run: docker rm -f papple-smoke 2>/dev/null || true
+
+    sync-dockerhub-readme:
+        # Pushes README.dockerhub.md to the Docker Hub repo's Overview tab
+        # and updates the short description. Runs only on real SemVer tag
+        # pushes — pre-releases and :edge builds don't move the public docs.
+        #
+        # If you later want the Hub docs to track main between releases,
+        # split this into its own workflow on `push: branches: [main]` with
+        # `paths: [README.dockerhub.md]`.
+        needs: build-and-push
+        if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-')
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Sync Docker Hub description
+              uses: peter-evans/dockerhub-description@v5
+              with:
+                  username: ${{ secrets.DOCKERHUB_USERNAME }}
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+                  repository: wrotek/painapple-code
+                  short-description: "WebSocket bridge that serves a vanilla-JS PWA for Claude Code sessions"
+                  readme-filepath: ./README.dockerhub.md
+                  # Rewrites relative links (e.g. [LICENSE](LICENSE)) into
+                  # absolute github.com URLs so they resolve on the Hub page.
+                  enable-url-completion: true

painapple_code-1.0.0rc1/.github/workflows/pypi-publish.yml

@@ -0,0 +1,94 @@
+name: Publish to PyPI
+
+# Builds the sdist + wheel and publishes them to PyPI, then creates a
+# GitHub Release for the tag.
+#
+# Versioning: same scheme as docker-publish.yml — the git tag (vX.Y.Z)
+# is the single source of truth; setuptools-scm derives the package
+# version from it at build time.
+#
+# Auth: PyPI Trusted Publishing (OIDC) — no API token secrets. One-time
+# setup on pypi.org: add a publisher for project `painapple-code` with
+#   owner: wrotek, repo: painapple-code,
+#   workflow: pypi-publish.yml, environment: pypi
+# Pre-release tags (v1.1.0-rc1) publish to PyPI as 1.1.0rc1 (pip only
+# installs those with --pre) and are marked pre-release on GitHub.
+
+on:
+    push:
+        tags:
+            - "v*.*.*"
+
+jobs:
+    build:
+        runs-on: ubuntu-latest
+        steps:
+            # fetch-depth: 0 so setuptools-scm can `git describe` against
+            # all tags. Default shallow clone hides everything but HEAD.
+            - uses: actions/checkout@v4
+              with:
+                  fetch-depth: 0
+
+            - name: Set up Python
+              uses: actions/setup-python@v5
+              with:
+                  python-version: "3.12"
+
+            - name: Build sdist and wheel
+              run: |
+                  pip install --quiet build
+                  python -m build
+                  ls -l dist/
+
+            # Sanity check: the version baked into the wheel must match the
+            # tag that triggered us (v1.2.3 → 1.2.3, v1.2.3-rc1 → 1.2.3rc1).
+            - name: Verify version matches tag
+              run: |
+                  tag="${GITHUB_REF#refs/tags/v}"
+                  expected=$(python -c "from packaging.version import Version; import sys; print(Version(sys.argv[1]))" "$tag")
+                  built=$(ls dist/*.whl | sed -E 's|dist/painapple_code-([^-]+)-.*|\1|')
+                  echo "tag=$expected built=$built"
+                  test "$expected" = "$built"
+
+            - uses: actions/upload-artifact@v4
+              with:
+                  name: dist
+                  path: dist/
+
+    publish-pypi:
+        needs: build
+        runs-on: ubuntu-latest
+        environment:
+            name: pypi
+            url: https://pypi.org/p/painapple-code
+        permissions:
+            id-token: write # OIDC token for Trusted Publishing
+        steps:
+            - uses: actions/download-artifact@v4
+              with:
+                  name: dist
+                  path: dist/
+
+            - name: Publish to PyPI
+              uses: pypa/gh-action-pypi-publish@release/v1
+
+    github-release:
+        needs: publish-pypi
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+        steps:
+            - uses: actions/download-artifact@v4
+              with:
+                  name: dist
+                  path: dist/
+
+            - name: Create GitHub Release
+              env:
+                  GH_TOKEN: ${{ github.token }}
+              run: |
+                  tag="${GITHUB_REF#refs/tags/}"
+                  args=(--generate-notes --title "$tag")
+                  [[ "$tag" == *-* ]] && args+=(--prerelease)
+                  gh release create "$tag" dist/* \
+                      --repo "${{ github.repository }}" "${args[@]}"

painapple_code-1.0.0rc1/.github/workflows/release-features.yml

@@ -0,0 +1,38 @@
+name: Release Dev Container Features
+
+# Publishes the Dev Container Features under features/src/ to GHCR.
+# Consumers reference them via ghcr.io/<owner>/<repo>/<feature-id>:<major>.
+#
+# Triggers:
+#   - push to main that touches features/**
+#   - manual dispatch (for re-publishing after a metadata-only edit)
+
+on:
+    push:
+        branches:
+            - main
+        paths:
+            - "features/src/**"
+            - ".github/workflows/release-features.yml"
+    workflow_dispatch:
+
+jobs:
+    publish:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            packages: write
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Bundle bridge source into Feature
+              run: tools/bundle-feature-source.sh --feature-only
+
+            - name: Publish Features to GHCR
+              uses: devcontainers/action@v1
+              with:
+                  publish-features: "true"
+                  base-path-to-features: "./features/src"
+                  generate-docs: "false"
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

painapple_code-1.0.0rc1/.github/workflows/test-features.yml

@@ -0,0 +1,33 @@
+name: Test Dev Container Features
+
+# Runs the `devcontainer features test` harness on every PR that touches
+# features/. Catches install.sh regressions before they ship to GHCR.
+
+on:
+    pull_request:
+        paths:
+            - "features/**"
+            - ".github/workflows/test-features.yml"
+    workflow_dispatch:
+
+jobs:
+    test:
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+            matrix:
+                feature: [painapple-code]
+                baseImage:
+                    - mcr.microsoft.com/devcontainers/base:ubuntu
+                    - debian:bookworm-slim
+        steps:
+            - uses: actions/checkout@v4
+            - name: Install devcontainers CLI
+              run: npm install -g @devcontainers/cli
+            - name: Test ${{ matrix.feature }} on ${{ matrix.baseImage }}
+              run: |
+                  devcontainer features test \
+                      --features "${{ matrix.feature }}" \
+                      --base-image "${{ matrix.baseImage }}" \
+                      --project-folder . \
+                      ./features

painapple_code-1.0.0rc1/.gitignore

@@ -0,0 +1,80 @@
+# Python virtual environment
+venv/
+__pycache__/
+*.pyc
+
+# Python build artifacts (from `pip install -e .` or `python -m build`)
+*.egg-info/
+build/
+dist/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+
+# Logs
+*.log
+
+# OS
+.DS_Store
+sessions/
+
+# Runtime worktrees
+.painapple-code-worktrees/
+
+# Review metadata (per-project, not committed)
+.code-meta/
+
+# Test results
+test-results/
+
+# Node.js (root package.json is for claude CLI only, not committed)
+node_modules/
+package.json
+package-lock.json
+
+# But tools/ has its own tracked package.json & lockfile
+!tools/package.json
+!tools/package-lock.json
+
+# And tauri-app/ has its own tracked package.json & lockfile (native app shell)
+!tauri-app/package.json
+!tauri-app/package-lock.json
+
+# Secrets / local data
+.env*
+*.duckdb
+
+# Stray screenshot dumps
+screenshots/
+
+# Internal agent / personal infra (not for public)
+.claude/
+CLAUDE.md
+deploy.fish
+start-server.sh
+TODO.md
+TODO-PROD.md
+bugs/
+claude-stats.fish
+docs/
+docs-ai/
+ideas/
+tests/
+
+# Devcontainer CLI build artifact
+.devcontainer/devcontainer-lock.json
+
+# Generated by setuptools-scm at build time — derived from git tag.
+src/painapple_code/_version.py
+
+# Local tao fork carrying the iOS scene-delegate UAF patch
+# (see tauri-app/src-tauri/Cargo.toml [patch.crates-io]).
+tao/
+
+# Generated by tools/bundle-feature-source.sh — mirror of features/src/painapple-code/
+# (the canonical Feature) plus the bundled bridge source. Regenerated by the
+# initializeCommand in .devcontainer/devcontainer.json on every build.
+.devcontainer/painapple-code/
+features/src/painapple-code/bridge-source/

painapple_code-1.0.0rc1/Dockerfile

@@ -0,0 +1,155 @@
+# syntax=docker/dockerfile:1.7
+# Fully-qualified registry path — podman has no default registry and otherwise
+# prompts to pick one when ~/.config/containers/registries.conf lists multiple
+# unqualified-search-registries (quay.io / ghcr.io / docker.io). Docker ignores
+# the prefix, so the same Dockerfile works on both runtimes.
+FROM docker.io/library/python:3.13-slim-bookworm
+
+# OCI image metadata — surfaces on Docker Hub / GHCR as the image's title,
+# description, license, and "Source" link. The CI workflow overrides
+# `revision` / `created` / `version` per build via --label.
+LABEL org.opencontainers.image.title="painapple-code" \
+      org.opencontainers.image.description="WebSocket bridge that serves a vanilla-JS PWA for Claude Code sessions" \
+      org.opencontainers.image.source="https://github.com/wrotek/painapple-code" \
+      org.opencontainers.image.licenses="AGPL-3.0-or-later" \
+      org.opencontainers.image.vendor="wrotek"
+
+# Disable apt's _apt sandbox user — required when building under rootless
+# Docker with fuse-overlayfs (the unprivileged _apt UID can't write /tmp).
+RUN echo 'APT::Sandbox::User "root";' > /etc/apt/apt.conf.d/00no-sandbox
+
+# System deps:
+#   git     — used by api_git.py and shadow_git.py
+#   curl    — NodeSource bootstrap
+#   tini    — clean PID 1 / signal forwarding so SIGTERM kills child claude procs
+#   fd-find — fast file enumeration for /api/files/list (.gitignore-aware).
+#             Debian ships the binary as `fdfind`; symlink to `fd` so
+#             routes/api_files.py finds it without a fallback shim.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates curl git tini fd-find \
+    && ln -s /usr/bin/fdfind /usr/local/bin/fd \
+    && rm -rf /var/lib/apt/lists/*
+
+# Developer tools for the in-container terminal. The bridge exposes a PTY
+# the user runs commands in, so a base slim image with no editor / pager /
+# search / multiplexer is painful. Adds ~80 MB. Anything bigger (compilers,
+# language toolchains, language servers) belongs in a user-built derived
+# image, not the base.
+#
+#   editors          — vim, nano
+#   pagers/text      — less, jq
+#   search           — ripgrep (`rg`); `fd` is already installed above
+#   process/system   — htop, lsof, procps (ps/top), psmisc (killall/pstree)
+#   files/inspection — tree, ncdu, file
+#   network          — iproute2 (ip), iputils-ping, dnsutils (dig/nslookup),
+#                      netcat-openbsd, wget, rsync, openssh-client
+#   compression      — zip, unzip, xz-utils
+#   shell            — zsh (default user shell), tmux, bash-completion
+#   build            — make
+#   misc             — git-lfs, gettext-base (envsubst)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        vim nano \
+        less jq ripgrep \
+        htop lsof procps psmisc tree ncdu file \
+        iproute2 iputils-ping dnsutils netcat-openbsd wget rsync openssh-client \
+        zip unzip xz-utils \
+        zsh tmux bash-completion \
+        make \
+        git-lfs gettext-base \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node.js 20 LTS + Claude Code CLI (the bridge spawns `claude` as a subprocess).
+# Pinned to the 2.x line — each image build resolves the newest 2.x.y at
+# build time, but the SemVer-2 ceiling protects us from a 3.0 with breaking
+# arg/output changes. DISABLE_AUTOUPDATER stops the bundled CLI from trying
+# to overwrite itself inside the immutable image layer at runtime, and
+# CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC suppresses the update-check
+# / telemetry calls that go with it.
+ENV DISABLE_AUTOUPDATER=1 \
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/* \
+    && npm install -g @anthropic-ai/claude-code@2 \
+    && npm cache clean --force
+
+# Non-root user — override UID/GID at build time to match your host so bind mounts
+# (notably ~/.claude) keep correct ownership: docker compose build --build-arg USER_UID=$(id -u)
+ARG USER_UID=1000
+ARG USER_GID=1000
+RUN groupadd --gid ${USER_GID} app \
+    && useradd --uid ${USER_UID} --gid ${USER_GID} --create-home --shell /usr/bin/zsh app
+
+WORKDIR /app
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+# --chown collapses what used to be COPY + a separate `RUN chown -R app:app`
+# layer that duplicated every file (~1GB rewritten just to flip metadata).
+COPY --chown=app:app . /app
+
+# Package version — setuptools-scm normally derives this from `git describe`,
+# but .git is excluded from the build context (see .dockerignore), so we
+# pass it in as a build arg and let setuptools-scm read it from the env.
+# CI populates it from the git tag; local builds without --build-arg fall
+# back to "0.0.0+docker".
+ARG SCM_VERSION=0.0.0+docker
+ENV SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PAINAPPLE_CODE=${SCM_VERSION}
+
+# Editable install registers the painapple_code package against /app/src so
+# `python -m painapple_code` resolves correctly without setting PYTHONPATH.
+RUN pip install --no-cache-dir -e .
+
+# Mountpoints — created up-front so volume mounts inherit the right ownership.
+# /workspace gets a sentinel file that the entrypoint script checks for: any
+# real bind mount overlays it, so its presence means the user forgot to mount.
+RUN mkdir -p /data /workspace /home/app/.claude /home/app/.config/painapple-code \
+    && touch /workspace/.painapple-not-mounted \
+    && chown -R app:app /data /workspace /home/app/.claude /home/app/.config
+
+# Entrypoint guard — refuses to start if /workspace isn't bind-mounted.
+COPY --chmod=755 docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+
+USER app
+
+# Install user-scoped helpers — same script a host install would run.
+# Drops tools/shadow-git and tools/shadow-query into ~/.local/bin and the
+# shadow-git-helper agent template into ~/.claude/agents, so users get
+# `shadow-git` / `shadow-query` in the in-container terminal and the agent shows
+# up inside Claude Code without a separate setup step.
+RUN /app/src/painapple_code/tools/install-helpers.sh
+
+# zsh config — the bridge spawns its PTY via $SHELL (see
+# routes/api_terminal.py), so an interactive terminal opened in the web UI
+# lands in zsh. Bake a couple of conveniences in.
+RUN printf '%s\n' \
+        'alias ll="ls -lahtr"' \
+        'autoload -Uz promptinit && promptinit && prompt adam1 2>/dev/null || PROMPT="%n@%m %~ %# "' \
+        'setopt HIST_IGNORE_DUPS SHARE_HISTORY' \
+        'HISTFILE=~/.zsh_history HISTSIZE=10000 SAVEHIST=10000' \
+        > /home/app/.zshrc
+
+# Mirror the alias for bash too, in case a script or `docker exec` lands
+# the user there explicitly.
+RUN echo "alias ll='ls -lahtr'" >> /home/app/.bashrc
+
+# PAINAPPLE_CODE_HOME relocates all bridge state (logs, shadow DB, sessions,
+# uploads, presets) to /data so a single named volume covers everything.
+# SHELL is read by the bridge's PTY spawn (routes/api_terminal.py) — set it
+# explicitly so the web terminal opens zsh even though the bridge process
+# itself wasn't started via login(1).
+# PAINAPPLE_IN_CONTAINER marks "running containerized" — a build-time constant
+# (the image only ever runs in a container). It's a last-resort fallback in
+# bridge_paths.detect_environment(); the docker-vs-podman decision is made at
+# runtime from /.dockerenv vs /run/.containerenv, NOT from this marker — a baked
+# ENV can't tell the two apart since the same image runs on both engines.
+ENV PAINAPPLE_CODE_HOME=/data \
+    PYTHONUNBUFFERED=1 \
+    SHELL=/usr/bin/zsh \
+    PAINAPPLE_IN_CONTAINER=1
+
+EXPOSE 8765
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
+CMD ["python", "-m", "painapple_code", "--host", "0.0.0.0", "--port", "8765", "--workspace", "/workspace"]