258 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
pi	4024c4d87b	chore(config): bump default anthropic model to claude-sonnet-5 ... DEFAULT_MODELS[anthropic] (and thus FALLBACK_MODEL) -> anthropic/claude-sonnet-5, matching the .env.example bump. openai/amazon-bedrock defaults unchanged. Documented under CHANGELOG Unreleased (no release cut yet).	2026-07-13 23:13:24 +02:00
pi	4499bcf6c3	docs(env): bump example OPENCODE_MODEL to claude-sonnet-5	2026-07-13 23:03:01 +02:00
pi	281ccbaa70	feat: pi-devbox parity — typst PDF, terminal terminfo, nvim colour, host-ssh check, hygiene ... Ports the base additions from pi-devbox v1.4.0 + v1.5.0 that opencode-devbox lacked (opencode-devbox already tracks pi-devbox for CLI-toolset parity, v2.6.0): - typst PDF engine for pandoc (v1.4.0) + the pandoc typst-template default-font patch (v1.5.0) so 'pandoc --pdf-engine=typst' works without -V mainfont. pandoc shipped since v2.6.0 as a front-end only (no PDF back-end). +xz-utils. Tracks latest; --build-arg TYPST_VERSION escape hatch. - Terminal support (v1.5.0): ncurses-term + kitty-terminfo + a compiled xterm-ghostty alias (tic -x, use=ghostty), so wezterm/alacritty/foot/ghostty/ kitty resolve TERM over SSH instead of degrading to a dumb fallback. - Readable Neovim colours (v1.5.0): system-wide /etc/xdg/nvim/sysinit.vim with termguicolors. - Host SSH reachability check at shell startup (v1.4.0): one-time probe in .bash_aliases warning (with fix steps + inline pubkey) when the Mac host is unreachable. The rest of the LAN stack was already present. - .claude/settings.local.json added to the gitignore_global seed (v1.5.0). - Repo hygiene (v1.5.0): LICENSE (MIT), THIRD_PARTY.md, hadolint CI job (pinned v2.14.0) + .hadolint.yaml, IDEAS.md backlog. Base-affecting (Dockerfile.base + rootfs) → base-<hash> advances, base rebuilds. smoke-test gains typst/PDF, terminfo, and nvim-tgc assertions. Validated: hadolint clean on both Dockerfiles, bash -n OK, base-hash guard OK, workflow guard OK. CHANGELOG v2.7.0. v2.7.0	2026-07-13 19:55:50 +02:00
Joakim Persson	bf53a8eaa8	ci(smoke): +200 MB size headroom (base 2950 / omos 3650) ... The v2.6.0 pi-devbox CLI-parity additions (pandoc + graphviz + tealdeer, ~200 MB on the base layer) consumed nearly all the ~250 MB headroom that v1.16.2 restored. v2.6.0 passed 2750/3450 but with a slim margin. Restore ~250 MB headroom so the guardrail catches runaway growth, not routine apt drift or minor upstream bumps. smoke-test.sh only — no base rebuild; affects the next tagged release's gate.	2026-07-08 09:11:40 +02:00
Joakim Persson	a31ef52b00	release: v2.6.0 — pi-devbox CLI parity + bg-subagents default + opencode 1.17.13 → 1.17.15 ... - opencode 1.17.13 → 1.17.15 (OPENCODE_VERSION in Dockerfile.variant) - promote CHANGELOG Unreleased → v2.6.0 (2026-07-08) with opencode release notes - (base-hash-advancing changes already staged in prior two commits: CLI tools + bg-subagents ENV) AGENTS.md tag/variant/skill counts verified unchanged; DOCKER_HUB.md in sync. v2.6.0	2026-07-08 00:20:29 +02:00
Joakim Persson	bab78044a1	feat: bake OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=true (base ENV) ... opencode gates native background subagents behind this experimental flag; oh-my-opencode-slim V2+ makes background orchestration its default workflow, so the omos variant was effectively degraded without it. Set as a base-level ENV (both variants, harmless for plain opencode) and overridable at runtime. Documented in lockstep: README env table, .env.example, CHANGELOG Unreleased, and AGENTS.md (with a removal trigger for when opencode promotes it out of experimental). smoke-test asserts the var is baked into the image env. Also folds the prior CLI-tools additions into the CHANGELOG Unreleased block.	2026-07-08 00:16:38 +02:00
Joakim Persson	61ec340e40	feat: add yq, pandoc, graphviz, tldr (tealdeer) + dot-watch — CLI parity with pi-devbox ... - apt: yq (YAML query), pandoc (doc converter), graphviz (dot rendering) - tealdeer: tldr command as ~5MB static musl binary (TEALDEER_VERSION arg) - dot-watch: auto-render .dot to PNG on save (graphviz-only, no imagemagick) - README: document new tools - smoke-test: presence assertions for yq, pandoc, dot, tldr, dot-watch Excludes socat, imagemagick, studio-expose (pi-studio-specific).	2026-07-07 23:43:14 +02:00
pi	ee7cfae1ff	release: v2.5.0 — external/shared MemPalace + validate.yml base-change fixes ... Promotes the Unreleased block to v2.5.0. Bundled contents: - feat: optional shared/external MemPalace — generate-config.py registers a remote MCP endpoint when MEMPALACE_REMOTE_URL is set; adds docker-compose.mempalace.yml. - fix: validate.yml false-red on base-changing commits (skip validate-base/omos via base_changed) + rootfs/ base-input detector regex. opencode stays 1.17.13 (== npm latest). Base rebuilds (rootfs/generate-config.py changed); mempalace-toolkit clone advances to main HEAD (external-transport bridge). v2.5.0	2026-07-02 14:50:06 +02:00
pi	fb6588ab1f	fix(validate.yml): rootfs/ base-input detection (anchored-group regex bug) ... The detect step's regex '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$' anchored the whole alternation with a trailing $, so the rootfs/ branch only matched a file literally named 'rootfs/' — never real paths like rootfs/usr/local/lib/opencode-devbox/generate-config.py (which Dockerfile.base COPYs into the base). Result: rootfs-only base changes set base_changed=false and validate-base/validate-omos ran against the stale base-latest instead of skipping (observed live: run 429, my own generate-config.py commit, did not skip). Fix: compute the match once into $changed with rootfs/ as a PREFIX ('^(Dockerfile\.base$|rootfs/|entrypoint.*\.sh$)') and gate on -n; reuse it for the file listing so the two greps can't drift. Bug predates the skip feature (introduced in dba05da); the skip in 703edbe made it load-bearing. actionlint clean; detect logic simulated across rootfs/Dockerfile.base/entrypoint/ docs-only change-sets.	2026-07-02 13:23:46 +02:00
pi	703edbe4a1	feat: optional shared/external MemPalace + fix validate.yml false-red on base changes ... Added: - generate-config.py registers mempalace as a remote MCP endpoint when MEMPALACE_REMOTE_URL is set (MEMPALACE_REMOTE_TOKEN -> Bearer), else the local stdio command as before. Same env contract as pi-devbox's bridge. - docker-compose.mempalace.yml: optional shared server (mempalace-mcp --transport http), loopback-bound by default. - compose (both) + .env.example(.shared): MEMPALACE_REMOTE_URL/TOKEN + local-vs-external docs. Fixed: - validate.yml: skip validate-base/validate-omos on base-changing commits (base-change-warning now exports base_changed). Previously a commit that changed the base AND tightened smoke-test.sh in lockstep (v2.4.0 nano/micro) hard-failed against the stale base-latest until the release rebuilt it. actionlint clean. README + CHANGELOG (Unreleased).	2026-07-02 13:09:29 +02:00
pi	f7e23d236c	release: v2.4.0 — nano + micro editors, CI hardening, opencode 1.17.10 → 1.17.13 ... Promotes the Unreleased block to v2.4.0. Bundled contents: - feat: nano + micro non-modal editors (d9ad634) — Dockerfile.base change → base rebuild - ci: sh-vs-bash guard + base-latest digest promote, ported from pi-devbox (acb2096) - feat: global gitignore baked into the image (6639ba5) - opencode 1.17.10 → 1.17.13 (Dockerfile.variant) Also registers .gitea/workflows/lint.yml in AGENTS.md's workflow list. DOCKER_HUB.md unchanged (HUB_TEMPLATE untouched; --check passes). Pre-flight: opencode-ai@1.17.13 confirmed on npm (== latest). v2.4.0	2026-07-01 23:35:48 +02:00
pi	d9ad634d5a	feat: ship nano + micro (non-modal editors) alongside nvim ... The image shipped only nvim (EDITOR=nvim), a modal vi-style editor. Add both a classic and a modern non-modal option so users who aren't comfortable with vi keybindings have a choice: - nano (apt): ~2.8 MB installed; deps (libc6, libncursesw6, libtinfo6) already present via nvim/less/htop/tmux, so no extra packages pulled in. - micro: ~12 MB single static Go binary from GitHub releases (same pattern as bat/eza/zoxide). Desktop-style keys (Ctrl+S/Ctrl+Q), mouse, syntax highlighting. ARG MICRO_VERSION pins; defaults to latest. Combined ~15 MB (well within the smoke size threshold's ~250 MB headroom, so no threshold bump). EDITOR stays nvim; both editors are opt-in (export EDITOR=micro | nano). Uses the canonical micro-editor/micro URL because the old zyedidia/micro org rename makes /releases/latest redirect to another /latest, defeating the tag-parsing latest-resolution idiom (independently verified: old org 302s to micro-editor/micro; both arch tarballs HTTP 200; latest resolves to v2.0.15). Base-image change, so it lands on the next base-<hash> rebuild. Updates README (what's-inside tree + EDITOR note), CHANGELOG (Unreleased/Added), and smoke-test.sh (nano + micro presence checks). Ported from pi-devbox 3a59e15.	2026-07-01 23:20:49 +02:00
pi	acb2096406	ci: port pi-devbox CI hardening — bash-default footgun guard + base-latest digest promote ... Two CI-only changes ported from pi-devbox (no runtime/image impact), adapted to opencode-devbox's split-base 2-variant pipeline. Rides the next release. C — eliminate the sh-vs-bash footgun class: - Add `defaults: run: shell: bash` workflow-wide to docker-publish-split.yml and validate.yml. Gitea's default step shell is sh/dash, so bash-only syntax in a step that omits `shell: bash` fails silently. All pre-existing steps are POSIX, so bash runs them unchanged (no behavioural change). - New .gitea/workflows/lint.yml (push/PR/dispatch): a Gitea-accurate shell guard (scripts/check-workflow-shell.sh) + pinned actionlint + shellcheck. The guard closes the actionlint blind spot: actionlint models GitHub (default shell bash) so it does NOT flag bash syntax in a shell-less step. Guard scans ALL .gitea/workflows/*.yml (hence the validate.yml default too). Ported from pi-devbox 26384fe/d1db595. B — promote-base-latest re-points base-latest by digest, not need_build: The gate keyed off need_build=='true', assuming need_build==false meant base-latest was current. A dry-run dispatch that pre-builds base-<hash> falsifies that, leaving base-latest one base behind. Gate now runs on every tag release / promote dispatch; the no-op optimization moved into the step as a crane digest compare (re-tags only when base-latest != released base-<hash>). Ported from pi-devbox b7197e8. Validated locally: all 3 workflows YAML-parse; shell guard passes real workflows and correctly fails a synthetic omit-shell+pipefail workflow; actionlint (pinned 1.7.7) passes with explicit .gitea/workflows/*.yml glob.	2026-07-01 23:00:20 +02:00
pi	6639ba5820	feat: bake global gitignore (core.excludesFile) into image ... Seed ~/.gitignore_global from /etc/skel-devbox (seed-if-absent, like .bash_aliases/.inputrc, so user edits survive recreate) and wire it via git config --global core.excludesFile, guarded so a user-set excludesFile is never overridden. Ignores *.bak, *.bak.*, *~, *.orig, *.swp, *.tmp across all repos without per-repo .gitignore entries.	2026-06-28 11:52:02 +02:00
pi	b9039f577e	release: v2.3.0 — image-baked fallback skills + opencode 1.17.10 + mempalace 3.5.0 ... - Add image-baked fallback skills (opencode-devbox-environment, mempalace) + harness instruction (instructions/opencode-devbox.md) under /usr/local/share/opencode-devbox/, symlinked in by entrypoint-user.sh (skills only-when-absent; instruction symlink to image, never copied into the devbox-opencode-config volume). Ported from pi-devbox v1.2.0/v1.2.1, adapted to opencode's ~/.config/opencode/instructions/ auto-load model. No pi-extensions skill (opencode has no fork/recall). - Bump opencode 1.17.8 -> 1.17.10. - Bump mempalace 3.4.0 -> 3.5.0 (lockstep with pi-devbox v1.2.2); remove the obsolete diary_write anyOf perl workaround (fixed upstream, issue #1728). - Fix stale ssh-lan.conf ProxyJump guidance comment in setup-lan-access.sh (mirrors pi-devbox 8de0fad); comment-only. - smoke-test.sh + recreate-sanity-check.sh assert baked source + resolved links. - Docs: README Custom skills, AGENTS.md duties + MINOR example, CHANGELOG. v2.3.0	2026-06-25 09:58:13 +02:00
pi	992cb6702f	release: v2.2.0 v2.2.0	2026-06-19 20:18:40 +02:00
pi	9b1e8c0b30	docs: keep v2.1.1 CHANGELOG entry historically accurate (revert over-eager fork edit) ... The doc-drift pass rewrote the v2.1.1 release entry to describe v2.2.0 behaviour; at v2.1.1 the sidecar genuinely was a no-op on native Linux, so the edit falsified release history. The new behaviour is already documented in the Unreleased section. Other doc-drift fixes retained.	2026-06-19 20:15:45 +02:00
pi	1f0d06444b	docs: fix drift against main batch (SSH sidecar, proposed config, provenance, forked build) ... DRIFT-STALE fixes (stale/misleading text corrected): - README.md:160 — "on native Linux it does nothing" → accurate always-render description (sidecar written on every OS; jump block still omitted on Linux) - AGENTS.md:22 — setup-lan-access.sh "no-op on native Linux" → corrected to always-render + removed now-redundant inline ControlPath/UserKnownHostsFile sentence (that's what the sidecar does, not what the script detects) - CHANGELOG.md:594 (v2.1.1 intro) — "no-op" → "(see v2.2.0)" historical note - docs/plan-lan-access-and-pi-extensions.md:222 — annotated the completed checkbox with the v2.2.0 refinement GAP additions: - README.md:212 — custom config section now describes opencode.jsonc.proposed sidecar: written-on-diff, removed-on-match, never overwrites, one-line hint - README.md build-args table — INSTALL_MEMPALACE_TOOLKIT row now mentions MEMPALACE_TOOLKIT_REPO alongside MEMPALACE_TOOLKIT_REF - README.md (after build-args table) — two new sections: "Building a fork / relocated build" — MEMPALACE_TOOLKIT_REPO build-arg table + two-step docker build example + credentials note "Build provenance (labels + manifest)" — docker inspect + run examples, OCI label set, ground-truth manifest path Version string drift: no hard-coded 1.17.7 found outside CHANGELOG (all occurrences are historical release entries — correct by definition). CI-internal items (resolve-versions, check-base-hash.sh): no existing doc described these mechanics, so no update needed.	2026-06-19 20:14:12 +02:00
pi	af11c32f4f	feat(config): non-destructive opencode.jsonc.proposed sidecar (closes #8 batch item) ... Completes the pi-devbox v1.1.4 "merge new defaults into preserved config" idea, adapted to opencode-devbox's env-generated, JSONC-with-comments config where an in-place merge would be destructive. generate-config.py keeps its "never touch an existing config" guarantee and adds a side-channel: when a live config exists, render the config it WOULD generate for the current env + image defaults and write it to a NON-loaded opencode.jsonc.proposed — but only when it differs from the live config; remove it once they match. opencode never loads .proposed files, so it is a pure manual-merge reference (e.g. surfacing a default MCP server added in a newer image). An unparseable live config surfaces the proposal rather than guessing equivalence. A one-line hint is logged on write. - render_config(): shared renderer so first-gen and proposed paths can't drift - _loads_jsonc(): string-aware //-comment strip (same approach as smoke-test; preserves https:// inside strings), raises on invalid JSON - write_proposed(): write-on-diff + stale removal + live untouched - smoke-test.sh: asserts write-on-diff, removal-on-match, live not clobbered - entrypoint-user.sh + module docstring: document the sidecar - CHANGELOG: moved from "Deferred" to "Added" Caveat (documented in the file header): the proposal reflects env + image defaults, so a diff may include the user's own past edits, not only new image defaults.	2026-06-19 20:07:54 +02:00
pi	1c4239e9b0	port pi-devbox v1.1.4–v1.1.6 hardening; bump opencode 1.17.7→1.17.8 ... Functional (not verbatim) port of the build-provenance, CI-hardening, SSH and shell fixes from the sibling pi-devbox repo, adapted to opencode-devbox's companions and two-variant (base/omos) shape. Defaults unchanged → canonical CI build stays byte-identical apart from the opencode bump and the (cache-free) provenance layer. Fixed: - SSH read-only ~/.ssh ControlPath: setup-lan-access.sh now renders the writable ~/.ssh-local/config sidecar (ControlPath redirect + Include) on EVERY host OS instead of exit 0-ing on native Linux; jump-specific blocks gated behind new NEED_JUMP flag. dssh/dscp + ControlMaster now survive a read-only ~/.ssh on native-Linux hosts. (pi-devbox v1.1.5) - bash history loss in nested/tmux shells: DEVBOX_HIST_SET no longer exported so each shell re-installs its own history -a flush. (pi-devbox v1.1.4) Added: - build provenance: OCI labels + /etc/opencode-devbox/build-manifest.json written from ground truth (opencode --version, installed omos version, /opt/mempalace-toolkit HEAD); wired into build-variant-* and smoke-* jobs; smoke-test.sh asserts manifest + label. (pi-devbox v1.1.6) - scripts/check-base-hash.sh CI guard: fails if a Dockerfile.base ARG *_REF is not folded into the base_tag hash. (pi-devbox v1.1.6) - overridable MEMPALACE_TOOLKIT_REPO build-arg in Dockerfile.base. (v1.1.6) Changed: - resolve-versions: fail-loud validation (SHA / semver) that aborts the release instead of silently falling back to floating main; adds shell: bash (set -o pipefail is illegal under the runner default dash). (pi-devbox v1.1.6) Bumped: - opencode-ai 1.17.7 → 1.17.8 (current npm latest stable). Deferred (needs a decision): opencode.json merge-on-recreate — see CHANGELOG.	2026-06-19 19:45:11 +02:00
Joakim Persson	717c69ee17	v2.1.2: bump opencode 1.17.6->1.17.7 ... Image-semver patch: opencode-only version bump (variant-layer rebuild). Upstream 1.17.7 is bugfixes + minor improvements, no breaking/runtime/Bun/AVX changes. Also fixes a stale CHANGELOG preamble that still described the pre-v2.0.0 'v{opencode_version}[letter]' scheme instead of independent semver. v2.1.2	2026-06-16 08:41:14 +02:00
Joakim Persson	2ac84fa4fb	docs(AGENTS): clarify opencode repo moved sst->anomalyco (not a fork) ... Old note framed sst/opencode as a separate fork with a divergent release timeline. It is the same repo, renamed/moved months ago; sst/opencode now 301-redirects to anomalyco/opencode (verified). Reframe as the canonical source of truth with a quick verification command to stop the recurring surprise.	2026-06-16 08:41:14 +02:00
pi	66527aeec9	docs(AGENTS): document GITEA_ACCESS_TOKEN env for general Gitea API access ... GITEA_ACCESS_TOKEN + GITEA_HOST (passed from host .env via compose, primarily for gitea-mcp) are also usable for any direct Gitea API work — run inspection, tag checks — not just ci-release-watcher. Prefer over a PAT file when present; host-managed lifecycle, nothing to revoke. Mirrors the same note added to pi-devbox AGENTS.md.	2026-06-15 22:30:43 +02:00
Joakim Persson	063cc6b6e6	test: add runtime recreate-sanity-check script ... Runtime peer to the build-time smoke-test.sh: run inside the container after `docker compose up -d --force-recreate` to confirm the new image is live (opencode version matches Dockerfile.variant), persisted named volumes survived, omos skill symlinks resolve, shell defaults re-seeded, and /opt toolkits intact. smoke-test.sh runs with --entrypoint="" and cannot see the running container's volumes/symlinks, hence a separate runtime check. Not run by CI or the entrypoint (it needs the release-time expected version and a running container). Maintainer tooling, not baked into the image. Registered in AGENTS.md File roles. Doc/script-only — no image rebuild.	2026-06-14 22:45:24 +02:00
Joakim Persson	52e8affa86	v2.1.1: bump opencode 1.17.5->1.17.6 ... Patch release. Upstream 1.17.6 is a single MCP-compatibility bugfix (no breaking/runtime/AVX changes). Also lands the unreleased mempalace-toolkit SHA-resolution CI fix and two doc corrections; the toolkit change advances the base hash so this carries a base rebuild + base-latest re-promote. v2.1.1	2026-06-14 18:38:35 +02:00
pi	e963f83e70	ci: CI-resolve mempalace-toolkit to a pinned SHA ... mempalace-toolkit is the only dependency cloned in Dockerfile.base (all others live in the variant), so it bypassed the resolve-versions -> build-arg plumbing and its ref stayed a literal `main`. Because the base only rebuilds on a content hash, a toolkit-only fix would silently fail to land unless Dockerfile.base itself changed. Mirrors pi-devbox commit 4744f05, adapted to this repo: - resolve-versions: new mempalace_toolkit_ref output via the gitea commits API (first gitea call in this repo's CI; works unauthenticated, no secret). - base-decide: needs resolve-versions; fold the SHA into the base-tag hash so a moved toolkit forces a base rebuild (they no longer run in parallel). - build-base: needs resolve-versions; pass --build-arg MEMPALACE_TOOLKIT_REF. - Dockerfile.base: clone switched to SHA-capable git fetch + checkout FETCH_HEAD (git clone --branch <SHA> would fail). - docs lockstep: .gitea/README.md Step 1 (no longer "in parallel"), AGENTS.md Critical conventions, CHANGELOG Unreleased. base_tag now reflects a live gitea lookup; on API blip it falls back to `main`, triggering one extra rebuild, never a missed one. No new tag — lands on the next release or workflow_dispatch.	2026-06-14 15:51:55 +02:00
pi	4409bd0719	docs: correct mempalace anyOf workaround watch-target (PR #1735 is dead) ... PR #1735 (the diary_write root-anyOf fix) was closed UNMERGED on 2026-06-11, so the old "remove once PR #1735 ships" TODO points at a dead PR. Issue #1728 is still open; PR #1717 is the current live fix candidate; mempalace PyPI latest is still 3.4.0 (== our pin), so the workaround must stay. - Dockerfile.base: rewrite the upstream-tracking comment + TODO to reflect #1735 dead / watch #1717 / removal trigger = a PyPI release > 3.4.0 that actually strips the root anyOf. - AGENTS.md: add a durable "anyOf workaround — upstream watch target" note under Critical conventions (persists context across machines/sessions), incl. the MEMPALACE_VERSION-vs-MEMPALACE_TOOLKIT_REF non-conflation warning. Docs-only; no behavior change. Workaround remains live and correct for 3.4.0.	2026-06-14 15:33:46 +02:00
Joakim Persson	c0d2516456	docs: fix quick-start — bare 'run devbox' lands in a shell, not opencode ... The image's default CMD is bash -l, so 'docker compose run --rm devbox' with no command drops into a login shell; you pass 'opencode' explicitly to start the harness. The README quick-start claimed the opposite and carried a garbled 'Use bash instead of (no command)' half-sentence; the same error was mirrored in the Hub HUB_TEMPLATE. Fix both and regenerate DOCKER_HUB.md. Doc-only — no image bytes change.	2026-06-13 23:24:49 +02:00
Joakim Persson	ba8000732d	v2.1.0: symlink OMOS bundled skills from image, bump opencode 1.17.4->1.17.5 ... Deploy the five oh-my-opencode-slim bundled skills (clonedeps, codemap, deepwork, oh-my-opencode-slim, simplify) by symlinking them from the image path into ~/.agents/skills/ on every container start, instead of the installer copying them into the persistent config volume on first run only. Image-sourced links mean 'docker compose pull' + recreate refreshes the skills with no installer run and no config reset; the old copy-on-first-run froze them in the volume forever. - entrypoint-user.sh: new non-fatal OMOS bundled-skills reconcile block (runs after skillset deploy so OMOS wins the simplify collision; absolute symlinks; gated by OMOS_SKILLS, now independent of ENABLE_OMOS). Both installer calls now pass --skills=no. One-time migration backs up (never deletes) frozen real copies in ~/.config/opencode/skills/ to .bak.<epoch>. - scripts/smoke-test.sh: assert the bundled-skills source path on omos. - Bump OPENCODE_VERSION 1.17.4 -> 1.17.5. - Versioning: document the move to independent image semver (v2.0.0 was the decouple point), mirroring pi-devbox. README/AGENTS/.env.example/CHANGELOG updated; new docs/omos-skills.md. v2.1.0	2026-06-13 22:32:09 +02:00
pi	72298ae77e	v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4 ... PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes: 1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_* build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant CI jobs. Only base + omos variants remain (4 tags/release). 2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global (persistent in both compose files). entrypoint-user.sh gains a one-time migration shim that copies old global npm packages forward. Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}} placeholder filled by CI at publish time (mirrors pi-devbox); full docs drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish; DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid; all shell scripts pass bash -n. v2.0.0	2026-06-13 17:10:45 +02:00
pi	c8217814c8	docs(v2.0.0): add explicit base-pi-only* Hub-tag purge step ... Document that base-pi-only / base-pi-only-vX.Y.Z on joakimp/pi-devbox are orphaned legacy artifacts (no pi-devbox build input references them) that the build-variant-pi-only job re-publishes every release. Purge them from the pi-devbox Hub repo after PR-5 removes the publisher; before that, the floating tag just reappears. Added to removal steps + verification.	2026-06-10 22:34:03 +02:00
pi	ff6e17b732	v1.17.2: bump opencode 1.16.2->1.17.2, deprecate pi, pin+patch mempalace ... opencode-ai 1.16.2 -> 1.17.2 (OPENCODE_VERSION). Deprecate all pi support ahead of v2.0.0 removal (pi now ships from the standalone joakimp/pi-devbox image, v1.0.0+, which no longer FROMs base-pi-only): - build-time stderr deprecation warning when INSTALL_PI=true - README / DOCKER_HUB.md / AGENTS.md mark the with-pi/omos-with-pi/pi-only variants + base-pi-only tag deprecated, point to pi-devbox - docs/CLEANUP-v2.0.0.md committed as the removal plan - CHANGELOG pre-announces the v2.0.0 NPM_CONFIG_PREFIX relocation Harden mempalace install (mirrors pi-devbox): - pin via MEMPALACE_VERSION ARG (default 3.4.0); unpinned install is what swept in the broken schema - idempotent, self-deactivating patch stripping the top-level anyOf from mempalace_diary_write input_schema (Anthropic tools API rejects it). Upstream: MemPalace/mempalace#1728, PR #1735 Fold prior Unreleased smoke-test pi-extensions readiness fix into v1.17.2. v1.17.2	2026-06-10 19:31:49 +02:00
pi	c6f9d1148b	smoke: wait for pi-extensions deploy completion, not just keybindings ... The entrypoint-deploy wait loop gated only on keybindings.json (written by pi-toolkit, before pi-extensions), so the *.ts >= 4 assertion could sample mid-deploy under parallel build load. v1.16.2 run 370: smoke-with-pi saw <4 while omos-with-pi/pi-only (same pi-extensions 357fcc6) saw 8, skipping build-variant-with-pi. Now wait for the last-deployed artifact (mempalace.ts bridge) AND a settled extension count (>=4), up to 45s. Test-only; no image change, so no re-tag needed.	2026-06-08 22:49:09 +02:00
pi	56e6a782e3	Bump opencode 1.15.13 -> 1.16.2, pick up pi 0.79.0 ... Bump OPENCODE_VERSION in Dockerfile.variant to 1.16.2 (rolls up the 1.16.0/1.16.1/1.16.2 upstream releases of 2026-06-05). The pi-bearing variants pick up pi 0.78.1 -> 0.79.0 via CI's resolve-versions job. Preemptively raise smoke size thresholds +150 MB on opencode-bearing variants (base/omos/with-pi/omos-with-pi) and +100 MB on pi-only ahead of the combined minor opencode + pi bump. base (2506) and omos (3206) were on ~94 MB headroom and minor bumps have tripped these before (v1.15.0, v1.15.4); restores ~250 MB headroom to avoid a partial publish. Promote CHANGELOG Unreleased -> v1.16.2. v1.16.2	2026-06-08 21:58:46 +02:00
pi	49d3e113ee	docs: complete CHANGELOG/AGENTS + promote Unreleased -> v1.15.13e ... - CHANGELOG: add the missing entry for the ~/.config/devbox-shell compose-doc commit (440218f); promote Unreleased -> v1.15.13e (2026-06-04) with a release summary (letter-suffix rebuild on opencode 1.15.13, picks up pi 0.78.1 + LAN key persistence + devbox-ssh-local chown fix + validate.yml false-neg fix). - AGENTS.md: document the STRICT_REGISTRATION smoke-gate knob under CI quirks (kept in lockstep with the validate.yml/docker-publish-split.yml change). Docs only; no image/behavior change. Tagging v1.15.13e after this lands. v1.15.13e	2026-06-04 22:41:30 +02:00
pi	f1e879ca6c	docs: per-host ControlPath under ~/.ssh breaks pi --ssh (read-only mount) ... The bind-mounted ~/.ssh/config is read before the baked Host * default and SSH uses the first ControlPath it sees. A per-host block pointing ControlPath under ~/.ssh/ (CGNAT-multiplexing pattern) wins but fails in-container because ~/.ssh is read-only, silently breaking pi --ssh <host> (falls back to local tools). Documented the host-side fix: drop the override or repoint at the writable /tmp/sshcm/. README + CHANGELOG only, no image change.	2026-06-04 22:31:54 +02:00
pi	9c31c641d6	smoke: gate fork/recall registration checks behind STRICT_REGISTRATION (#12) ... validate.yml builds variants FROM the published base-latest, which lags the entrypoint in the current commit until a release tag rebuilds the base. The fork/recall registration smoke checks depend on the base entrypoint running 'pi install /opt/<pkg>', so a stale base-latest reded push-to-main runs with a false negative even when the variant layer was correct. smoke-test.sh now gates the two registration assertions behind STRICT_REGISTRATION (warn-only when unset). validate.yml leaves it unset; docker-publish-split.yml, which builds the base fresh in the same run, sets STRICT_REGISTRATION=1 on the pi-bearing smoke jobs. Build-time /opt + node_modules checks stay hard in both paths.	2026-06-04 21:59:39 +02:00
pi	d9dc85d825	entrypoint: chown devbox-ssh-local volume so jump key generates ... The named-volume persistence change for ~/.ssh-local did not update the entrypoint's volume-ownership loop. Docker creates named volumes as root:root, so setup-lan-access.sh (running as developer) silently failed to mkdir/ssh-keygen, leaving no jump key and breaking LAN access on the first --force-recreate. Add ~/.ssh-local to the chown list.	2026-06-04 14:59:46 +02:00
pi	0b78ab4a94	LAN jump key: persist via named volume + one-line authorize hint ... Persist ~/.ssh-local (devbox-ssh-local named volume) so the generated LAN-jump key survives 'docker compose up --force-recreate'. Authorize it on the host once per machine instead of after every container update. setup-lan-access.sh now prints a copy-paste 'echo <pubkey> >> ~/.ssh/authorized_keys' line whenever it generates a new key (not only when HOST_SSH_USER is unset), and stays silent once the key is persisted. README + CHANGELOG updated.	2026-06-04 14:33:58 +02:00
pi	440218fc4c	compose: document optional ~/.config/devbox-shell mount (LAN ssh-lan.conf + bash_aliases bridge)	2026-06-04 13:34:10 +02:00
pi	a56a5846a5	LAN-access: fix Include scope + read-only ControlPath, add ssh-lan.conf & RFC1918 autojump ... - Fix: Include ~/.ssh/config was scoped to the Host host/mac block, so dssh <peer> by name fell back to SSH defaults. Emit Host * scope reset before every Include. - Fix: redirect ControlPath to writable ~/.ssh-local sidecar (Mac config's ~/.ssh/cm path is read-only in the container, broke multiplexed hosts). - Add: Include host-owned ~/.config/devbox-shell/ssh-lan.conf for named-peer ProxyJump overrides (keeps image generic; peer names stay host-side). - Add: opt-in DEVBOX_LAN_AUTOJUMP_PRIVATE=1 RFC1918 catch-all for roaming. - Docs: README/.env.example/AGENTS/CHANGELOG + new ssh-lan.conf.example. v1.15.13d	2026-06-04 00:52:42 +02:00
pi	053dac5308	docs: promote CHANGELOG Unreleased -> v1.15.13c v1.15.13c	2026-06-03 21:46:37 +02:00
pi	c71c03f0f1	fix: bump base smoke size threshold 2500->2600 MB ... v1.15.13b's base crept to 2506 MB (LAN-access script + updated entrypoint + apt drift), tripping the zero-headroom 2500 ceiling. smoke-base failed, which cascaded into skipping build-variant-base AND promote-base-latest, so base-latest never advanced. All functional checks passed — this is a guardrail bump, not a real regression. base-<hash> and the omos/with-pi/ omos-with-pi/pi-only variants did publish on the fresh base in run 354.	2026-06-03 21:46:15 +02:00
pi	1e98b53113	feat: publish pi-only build into the pi-devbox repo, not opencode-devbox (Option B) ... The pi-only variant was published as opencode-devbox:latest-pi-only — an 'opencode-devbox' tag containing no opencode, which confused users. - build-variant-pi-only now pushes joakimp/pi-devbox:base-pi-only[-vX.Y.Z] instead of opencode-devbox:*-pi-only. New PI_IMAGE workflow env. - Still built from the same Dockerfile.variant (single source of truth), still smoke-tested by smoke-pi-only / validate-pi-only before publish. - De-advertised pi-only from README, DOCKER_HUB (HUB_TEMPLATE), AGENTS, .gitea/README. opencode-devbox now publishes 8 tags + base-latest. - Documented in CHANGELOG (Unreleased) and the plan doc. Note: old opencode-devbox:{latest,vX.Y.Z}-pi-only tags from v1.15.13b are superseded and should be deleted from Docker Hub.	2026-06-03 17:04:21 +02:00
pi	30380abdef	Cut v1.15.13b — LAN access + fork/recall + pi-only variant ... Container-level rebuild on opencode 1.15.13 / pi 0.78.0 (both unchanged): host-OS-agnostic LAN access (base), pi-fork (fork) + pi-observational-memory (recall) in pi variants, and the new pi-only variant (basis for pi-devbox). v1.15.13b	2026-06-03 16:40:22 +02:00
pi	237588253f	docs: fix stale variant/job counts missed in pi-only sweep ... - AGENTS.md: 'eight load:true jobs' -> ten (add validate-pi-only, smoke-pi-only) - .gitea/README.md: 'four variants / eight tags' -> five / ten - docs/manual-host-publish.md: 'Variants x4 / 10 tags' -> x5 / 12 tags These are living operational facts; the remaining 'four/eight' hits are illustrative meta-instructions or dated historical CHANGELOG entries (correct as-is).	2026-06-03 16:34:36 +02:00
pi	fc034ceade	feat: add pi-only variant (pi without opencode) as basis for pi-devbox ... All opencode-devbox variants set INSTALL_OPENCODE=true, so pointing pi-devbox at with-pi dragged opencode along and made it ~a re-tag of latest-with-pi. Add a 5th variant pi-only (INSTALL_OPENCODE=false, INSTALL_PI=true): pi + companions (toolkit, extensions, fork, recall) + base tooling, no opencode (~145 MB lighter than with-pi). - Dockerfile.variant: document pi-only in the variant table. - CI docker-publish-split.yml: new smoke-pi-only + build-variant-pi-only jobs (tags :VERSION-pi-only / :latest-pi-only, multi-arch); wired into promote-base-latest and update-description needs. - validate.yml: new validate-pi-only main-branch gate job. - smoke-test.sh: accept --variant pi-only; threshold 2750 MB; opencode-absent path already handled. - Docs: HUB_TEMPLATE (regenerated DOCKER_HUB.md), README, AGENTS (variant/tag counts 4->5, 8->10 tags), .gitea/README, manual-host-publish.sh (5 variants), plan doc implementation note. This is the single source of truth for joakimp/pi-devbox, which now FROMs latest-pi-only. Versions unchanged (opencode 1.15.13, pi 0.78.0).	2026-06-03 16:13:44 +02:00
pi	f09a4f382a	feat: host-agnostic LAN access (base) + fork/recall in pi variants ... Item A — LAN access (base image): - New rootfs/usr/local/lib/opencode-devbox/setup-lan-access.sh, invoked non-fatally from entrypoint-user.sh. On VM-backed hosts (macOS OrbStack / Docker Desktop, detected via host.docker.internal) it generates a writable ~/.ssh-local/config that uses the host as an SSH jump to reach LAN peers; no-op on native Linux. Ships the mechanism (generic 'host' jump alias), not policy (targets stay in the user's bind-mounted ~/.ssh/config). - New env knobs: DEVBOX_LAN_ACCESS (auto|jump|off), HOST_SSH_USER, DEVBOX_HOST_ALIAS. dssh/dscp aliases in .bash_aliases (guarded). Item B — pi-fork (fork) + pi-observational-memory (recall) in pi variants: - Dockerfile.variant clones both elpapi42 repos to /opt and runs npm install there at build time (local-path 'pi install' does not npm-install, so deps must be present to load). New args PI_FORK_REPO/REF, PI_OBSMEM_REPO/REF. - entrypoint-user.sh registers them at runtime via 'pi install /opt/<pkg>' (instant, in-place, idempotent; tools bind on next pi start). - CI resolve-versions resolves each repo's master HEAD to a commit SHA and passes PI_FORK_REF/PI_OBSMEM_REF — same cache-hit guard as PI_VERSION. - smoke-test asserts /opt clones + node_modules + settings.json registration; size thresholds bumped (with-pi 2700->2900, omos-with-pi 3700->3900). Versions unchanged (opencode 1.15.13, pi 0.78.0 — both still latest). Docs: README LAN section + env table, .env.example, AGENTS.md, CHANGELOG. Plan recorded in docs/plan-lan-access-and-pi-extensions.md.	2026-06-03 15:45:45 +02:00
pi	f61b5a4977	Cut v1.15.13 — opencode 1.15.12→1.15.13 upstream, pi 0.77.0→0.78.0 v1.15.13	2026-05-31 22:26:21 +02:00
pi	870da12c92	Cut v1.15.12 — opencode 1.15.11→1.15.12 upstream, pi 0.76.0→0.77.0 ... opencode-ai actually released 1.15.12 upstream (2026-05-28); this is the genuine first container build on it, plus the pi 0.77.0 bump (Claude Opus 4.8, --exclude-tools, headless Codex subscription login, streaming-aware extension input, plus a long fix list). Re-uses the v1.15.12 git tag, force-overwriting the historical artifact tag at be2a168 from the 2026-05-28 versioning slip (caught same day and re-cut as v1.15.11c; corresponding Hub images already manually deleted). Commit be2a168 and the v1.15.11c CHANGELOG block referencing the slip remain in history. No base-image change — unchanged Dockerfile.base/rootfs/entrypoint will hit base-decide cache-hit short-circuit; only the four variant builds + manifest tagging will run. See CHANGELOG v1.15.12 for the full upstream notes. v1.15.12	2026-05-29 09:06:54 +02:00