v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes: 1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_* build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant CI jobs. Only base + omos variants remain (4 tags/release). 2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global (persistent in both compose files). entrypoint-user.sh gains a one-time migration shim that copies old global npm packages forward. Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}} placeholder filled by CI at publish time (mirrors pi-devbox); full docs drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish; DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid; all shell scripts pass bash -n.
docs(v2.0.0): add explicit base-pi-only* Hub-tag purge step
2026-06-13 17:10:45 +02:00 · 2026-06-10 22:34:03 +02:00 · 2026-06-10 19:31:49 +02:00 · 2026-06-08 22:49:09 +02:00 · 2026-06-08 21:58:46 +02:00 · 2026-06-04 22:41:30 +02:00
22 changed files with 1596 additions and 816 deletions
@@ -31,6 +31,39 @@ WORKSPACE_PATH=~/projects
 # Path to SSH keys on host
 SSH_KEY_PATH=~/.ssh
 # ── LAN access from the container (host-OS-agnostic) ─────────────────
 # On VM-backed hosts (macOS OrbStack / Docker Desktop, also Docker Desktop
 # on Windows) the container runs in a Linux VM and CANNOT reach the host's
 # directly-attached LAN peers by default. On native Linux Docker the LAN is
 # reachable directly and nothing is needed. The entrypoint detects this and,
 # on VM-backed hosts, generates ~/.ssh-local/config so the host can be used
 # as an SSH jump (use the `dssh` alias). Reach the host itself with
 # `dssh host`. To reach named LAN peers, put `ProxyJump host` overrides in a
 # host-owned ~/.config/devbox-shell/ssh-lan.conf (bind-mounted in) rather than
 # editing your ~/.ssh/config — see ssh-lan.conf.example. Public-IP hosts (and
 # anything reached via a public jump host) connect directly, no jump needed.
 #
 # DEVBOX_LAN_ACCESS: auto (default) | jump | off
 #   auto = set up the jump only on VM-backed hosts; no-op on native Linux.
 #   jump = always set up (e.g. native Linux with extra_hosts host-gateway).
 #   off  = disable entirely.
 # DEVBOX_LAN_ACCESS=auto
 #
 # HOST_SSH_USER: your username on the host. REQUIRED for the jump to
 # authenticate. On first start the entrypoint prints the public key to
 # authorize on the host (append to the host's ~/.ssh/authorized_keys) and
 # reminds you to enable the host's SSH server (e.g. macOS Remote Login).
 # HOST_SSH_USER=
 #
 # DEVBOX_HOST_ALIAS: host hostname to reach (default host.docker.internal).
 # DEVBOX_HOST_ALIAS=host.docker.internal
 #
 # DEVBOX_LAN_AUTOJUMP_PRIVATE: 1 = ProxyJump ANY RFC1918 (private) IP through
 # the host, so bare `dssh user@<ip>` works on whatever LAN the (roaming) host
 # is currently joined to, without naming peers. Matches the typed address, not
 # the resolved HostName, so named hosts with their own ProxyJump are unaffected.
 # DEVBOX_LAN_AUTOJUMP_PRIVATE=0
 # ── Skillset (agent skills and instructions) ─────────────────────────
 # If you have a skillset repo, the entrypoint auto-deploys skills and
 # instructions on container start using relative symlinks (portable
@@ -67,32 +100,3 @@ SSH_KEY_PATH=~/.ssh
 # OMOS_TMUX=false              # Enable tmux multiplexer integration
 # OMOS_SKILLS=true             # Install recommended skills (simplify, agent-browser, cartography)
 # OMOS_RESET=false             # Force regenerate oh-my-opencode-slim config on next start
 # ── pi coding-agent (alternative/complementary harness) ─────────────────
 # Requires image built with INSTALL_PI=true.
 # When the image is built with both INSTALL_OPENCODE=true (default) and
 # INSTALL_PI=true, both harnesses share the same mempalace install and
 # palace path — wing data is mutually visible to either harness.
 #
 # Pi version is baked at build time via PI_VERSION (default: latest at
 # build). The baked `pi` binary is at /usr/bin/pi (system npm prefix);
 # rebuild the image to upgrade it. NPM_CONFIG_PREFIX is set to
 # /home/developer/.pi/npm-global, so anything installed via
 # `pi install npm:...` or `npm install -g` as the developer user
 # (themes, skills, extensions, including a user-installed pi itself)
 # lands on the named volume and survives container recreate AND image
 # rebuilds. A user-installed pi wins via PATH order over the baked one.
 #
 # Pi config (settings.json, extensions toggle state, sessions, auth) persists in the
 # devbox-pi-config named volume mounted at ~/.pi/.
 #
 # To launch pi from a `compose run` invocation:
 #   docker compose run --rm devbox pi
 # To attach to a running container:
 #   docker compose exec -u developer devbox pi
 # Default `compose run` (no args) drops to bash; pick the harness yourself.
 #
 # Build args (set in docker-compose.yml or via --build-arg on docker build):
 #   INSTALL_PI=true              # default false; opt-in
 #   PI_VERSION=latest            # pin a specific version, e.g. 0.73.0
 #   INSTALL_OPENCODE=false       # build a pi-only image (still has Bun in -omos)
@@ -8,14 +8,16 @@ the build pipeline is shaped the way it is, you're in the right place.
 | File | Trigger | Role |
 |---|---|---|
-| [`workflows/docker-publish-split.yml`](workflows/docker-publish-split.yml) | `push: tags: v*` | **Production release pipeline.** Two-phase split-base build: shared `base-<hash>` published once (skipped on cache hit), then four parallel variant deltas. ~40–80 min wall clock depending on runner count and whether base needs rebuilding. |
+| [`workflows/docker-publish-split.yml`](workflows/docker-publish-split.yml) | `push: tags: v*` | **Production release pipeline.** Two-phase split-base build: shared `base-<hash>` published once (skipped on cache hit), then two parallel variant deltas. ~40–80 min wall clock depending on runner count and whether base needs rebuilding. |
-| [`workflows/validate.yml`](workflows/validate.yml) | `push: branches: main` + PR | **Lightweight gate.** amd64-only smoke test of all four variants + `DOCKER_HUB.md` sync check. ~30 min. Fires on every push to `main`. |
+| [`workflows/validate.yml`](workflows/validate.yml) | `push: branches: main` + PR | **Lightweight gate.** amd64-only smoke test of both variants + `DOCKER_HUB.md` sync check. ~30 min. Fires on every push to `main`. |
 ## Why the split-base pipeline exists
-opencode-devbox publishes **four image variants** (`base`, `omos`, `with-pi`, `omos-with-pi`) × **two architectures** (amd64, arm64) = **eight image tags per release**. Today's runners are 2 self-hosted gitea Actions runners. arm64 builds are emulated under QEMU, which is the dominant cost (~3–5x slower than native).
+opencode-devbox builds **two image variants** (`base`, `omos`) × **two architectures** (amd64, arm64), publishing **four tags per release** + the floating `base-latest`. Today's runners are 2 self-hosted gitea Actions runners. arm64 builds are emulated under QEMU, which is the dominant cost (~3–5x slower than native).
-The four variants share ~95% of their layers (Debian + apt + Node + AWS CLI + mempalace + dev tools + entrypoints). The original `Dockerfile` was a single multi-stage build with `INSTALL_*` build-args gating variant-specific RUNs. BuildKit's per-layer cache key is content-addressed, but as soon as a build-arg-gated `RUN` produces a different layer hash for variant A vs variant B, every subsequent layer also has a different parent → identical commands re-execute per variant. Result: minimal cross-variant cache reuse on a fresh build.
+> pi was removed in v2.0.0; it now builds in its own `joakimp/pi-devbox` repo. Before v2.0.0 a fifth `pi-only` build was produced here and pushed into that repo as `base-pi-only` — that coupling is gone.
 The two variants share ~95% of their layers (Debian + apt + Node + AWS CLI + mempalace + dev tools + entrypoints). The original `Dockerfile` was a single multi-stage build with `INSTALL_*` build-args gating variant-specific RUNs. BuildKit's per-layer cache key is content-addressed, but as soon as a build-arg-gated `RUN` produces a different layer hash for variant A vs variant B, every subsequent layer also has a different parent → identical commands re-execute per variant. Result: minimal cross-variant cache reuse on a fresh build.
 Two improvements were considered:
@@ -32,8 +34,8 @@ The split-base architecture is what the `docker-publish-split.yml` workflow exer
                       │                  │   probe Docker Hub.
                       │  hash inputs:    │   (resolve-versions
                       │   Dockerfile.base│   runs in parallel:
-                       │   rootfs/        │   npm view pi/omos
+                       │   rootfs/        │   npm view omos
-                       │   entrypoint*.sh │   → concrete versions)
+                       │   entrypoint*.sh │   → concrete version)
                       └────────┬─────────┘
                                │
                  ┌─────────────┴─────────────┐
@@ -47,18 +49,18 @@ The split-base architecture is what the `docker-publish-split.yml` workflow exer
                       └────────┬─────────┘   to Docker Hub.
                                │
        ┌───────────────────────┼───────────────────────┐
-        ▼                       ▼                       ▼
+        ▼                       ▼
-   ┌──────────┐            ┌──────────┐         ┌──────────────┐
+   ┌──────────┐            ┌──────────┐
-   │smoke-base│            │smoke-omos│   ...   │smoke-omos-pi │   amd64 only,
+   │smoke-base│            │smoke-omos│             amd64 only,
-   └────┬─────┘            └────┬─────┘         └──────┬───────┘   parallel.
+   └────┬─────┘            └────┬─────┘             parallel.
-        │                       │                      │
+        │                       │
-        ▼                       ▼                      ▼
+        ▼                       ▼
-   ┌──────────┐            ┌──────────┐         ┌──────────────┐
+   ┌──────────┐            ┌──────────┐
-   │build-    │            │build-    │         │build-        │   multi-arch,
+   │build-    │            │build-    │             multi-arch,
-   │variant-  │            │variant-  │   ...   │variant-      │   parallel,
+   │variant-  │            │variant-  │             parallel,
-   │base      │            │omos      │         │omos-with-pi  │   tag push.
+   │base      │            │omos      │             tag push.
-   └────┬─────┘            └────┬─────┘         └──────┬───────┘
+   └────┬─────┘            └────┬─────┘
-        └───────────────────────┴──────────────────────┘
+        └───────────┬───────────┘
                                │
                                ▼
                  ┌──────────────────────────┐
@@ -111,13 +113,12 @@ dependency between them) and resolves the floating npm packages whose
 `*_VERSION` build-args default to `latest`:
 ```sh
 PI_VERSION=$(npm view @earendil-works/pi-coding-agent version)
 OMOS_VERSION=$(npm view oh-my-opencode-slim version)
 ```
-The outputs (`pi_version`, `omos_version`) are consumed by every variant
+The output (`omos_version`) is consumed by the omos variant smoke and
-smoke and build job that installs pi or omos. **Why this exists:** without
+build jobs. **Why this exists:** without it, the `npm install -g` RUN
-it, the `npm install -g` RUN layer in `Dockerfile.variant` hashes
+layer in `Dockerfile.variant` hashes
 identically across builds (same ARG default, same command string), so
 the registry buildcache silently reuses the layer from whatever upstream
 version was current when the cache was first populated. This is the
@@ -125,9 +126,9 @@ cache-hit silent-regression class of bug that shipped pi-devbox v0.74.0
 through v0.75.5 with identical image bytes (fixed in pi-devbox v0.75.5b
 2026-05-23). Currently masked here by `OPENCODE_VERSION` bumping every
 release (parent-chain cache-key invalidation), but masking would fail on
-a `vN.N.Nb` opencode-version-unchanged release that only bumps pi or
+a `vN.N.Nb` opencode-version-unchanged release that only bumps omos.
-omos. Smoke jobs additionally assert `EXPECTED_PI_VERSION` /
+Smoke jobs additionally assert `EXPECTED_OMOS_VERSION` against the
-`EXPECTED_OMOS_VERSION` against the resolved values.
+resolved value.
 ### Step 2: `build-base` (conditional)
@@ -139,23 +140,21 @@ when only one or two layers changed.
 The base image is **not** tagged `base-latest` here — that promotion
 happens at the very end after all variants succeed (see step 5).
-### Step 3: `smoke-*` (×4, parallel)
+### Step 3: `smoke-*` (×2, parallel)
 For each variant: build amd64-only against the base tag, load into
 local docker, run [`scripts/smoke-test.sh`](../scripts/smoke-test.sh).
 Variant build-args:
-| variant | INSTALL_OPENCODE | INSTALL_OMOS | INSTALL_PI |
+| variant | INSTALL_OPENCODE | INSTALL_OMOS |
-|---|---|---|---|
+|---|---|---|
-| `base` | true | false | false |
+| `base` | true | false |
-| `omos` | true | true | false |
+| `omos` | true | true |
 | `with-pi` | true | false | true |
 | `omos-with-pi` | true | true | true |
 Smoke runs `--variant <name>` to enable variant-specific assertions.
 Gate the publish: a smoke failure for variant X blocks `build-variant-X`.
-### Step 4: `build-variant-*` (×4, parallel)
+### Step 4: `build-variant-*` (×2, parallel)
 For each variant that passed smoke: multi-arch (amd64 + arm64) build of
 `Dockerfile.variant`, pushed to Docker Hub with the user-facing release
@@ -165,8 +164,6 @@ tags:
 |---|---|
 | `build-variant-base` | `vX.Y.Z`, `latest` |
 | `build-variant-omos` | `vX.Y.Z-omos`, `latest-omos` |
 | `build-variant-with-pi` | `vX.Y.Z-with-pi`, `latest-with-pi` |
 | `build-variant-omos-with-pi` | `vX.Y.Z-omos-with-pi`, `latest-omos-with-pi` |
 The `latest*` aliases are only updated when `promote_latest=true` (the
 manual dispatch input) — for test runs, `promote_latest=false` keeps the
@@ -174,7 +171,7 @@ production aliases pointing at the previous good release.
 ### Step 5: `promote-base-latest`
-Once all four variants successfully publish, re-tag `base-<hash>` as
+Once both variants successfully publish, re-tag `base-<hash>` as
 `base-latest` using `crane copy`. This is a **manifest-level re-tag, not
 a rebuild** — it touches only Docker Hub's image index, takes seconds,
 and is atomic.
@@ -182,7 +179,7 @@ and is atomic.
 The reason this happens *after* variants succeed (rather than alongside
 `build-base`) is so a partial failure leaves `base-latest` pointing at
 the previous known-good base. External consumers who pin to
-`base-latest` (e.g. the planned pi-devbox repo) never see a broken base.
+`base-latest` never see a broken base.
 ### Step 6: `update-description`
@@ -194,18 +191,21 @@ field via the Hub REST API. Same step as the production pipeline.
 The base sets
 ```
-ENV NPM_CONFIG_PREFIX=/home/developer/.pi/npm-global
+ENV NPM_CONFIG_PREFIX=/home/developer/.config/opencode/npm-global
 ```
-This is intentional — it makes `pi install npm:<pkg>` and `npm install -g`
+This is intentional — it makes `npm install -g` land on the
-land on the `devbox-pi-config` named volume at runtime, so user-installed
+`devbox-opencode-config` named volume at runtime, so user-installed
-packages survive container recreate AND image rebuild.
+packages survive container recreate AND image rebuild. (Before v2.0.0
 this prefix lived at `~/.pi/npm-global` on the now-removed
 `devbox-pi-config` volume; `entrypoint-user.sh` migrates the old path
 once.)
 But the *variant build* inherits this prefix at build time. If left as-is,
 `npm install -g opencode-ai@$VERSION` in `Dockerfile.variant` would
-install opencode into `/home/developer/.pi/npm-global/...`, which is then
+install opencode into `/home/developer/.config/opencode/npm-global/...`,
-**shadowed by the volume mount at runtime** → opencode disappears from
+which is then **shadowed by the volume mount at runtime** → opencode
-PATH on first start.
+disappears from PATH on first start.
 Fix: each `npm install -g` in `Dockerfile.variant` overrides the prefix
 per-RUN:
@@ -216,7 +216,7 @@ RUN NPM_CONFIG_PREFIX=/usr npm install -g opencode-ai@${OPENCODE_VERSION}
 Baked binaries land on `/usr/bin/...` (system prefix), survive the volume
 mount. Runtime-installed user packages still land on
-`~/.pi/npm-global/...`. Both visible on PATH.
+`~/.config/opencode/npm-global/...`. Both visible on PATH.
 ## Cache strategy
@@ -238,7 +238,7 @@ matters more.
 | Scenario | Production pipeline | Split-base pipeline |
 |---|---|---|
-| Version-bump-only release (only opencode/pi/omos version changed) | ~165–180 min | **~30–40 min** (base cache hit) |
+| Version-bump-only release (only opencode/omos version changed) | ~165–180 min | **~30–40 min** (base cache hit) |
 | Base-touching release (apt/Node/Debian/entrypoint change) | ~165–180 min | **~70–90 min** (base rebuilds) |
 The split-base pipeline pays its dues on base-touching releases (which are
@@ -252,7 +252,7 @@ on every push to `main` and on PRs. It:
 1. Runs `scripts/generate-dockerhub-md.py --check` to enforce
   `DOCKER_HUB.md` is in sync with `HUB_TEMPLATE`.
-2. Builds each of the four variants amd64-only (no multi-arch, no push)
+2. Builds each of the two variants amd64-only (no multi-arch, no push)
   and runs `scripts/smoke-test.sh`.
 This catches regressions before they reach a tag push. Wall clock ~30 min.
@@ -7,10 +7,10 @@ name: Publish Docker Image
 #   1. base-decide      compute base hash from Dockerfile.base + rootfs/
 #                       + entrypoints; probe Docker Hub for existing tag.
 #   2. build-base       only if probe missed; multi-arch push of base-<hash>.
-#   3. smoke-* (×4)     amd64-only build of each variant FROMing the base
+#   3. smoke-* (×2)     amd64-only build of each variant FROMing the base
 #                       tag; runs scripts/smoke-test.sh.
 #   4. build-variant-*  multi-arch push of each variant tag (the user-
-#       (×4)            facing release tags, unchanged in shape).
+#       (×2)            facing release tags, unchanged in shape).
 #   5. promote-base-latest  re-tag base-<hash> → base-latest with `crane copy`
 #                       (manifest copy, no rebuild).
 #   6. update-description   patch Docker Hub description (unchanged).
@@ -102,28 +102,27 @@ jobs:
            echo "Base tag ${IMAGE}:${{ steps.compute.outputs.base_tag }} missing — will build."
          fi
-  # ── Phase 1b: resolve floating npm versions (pi, omos) to concrete
+  # ── Phase 1b: resolve floating npm versions (omos) to concrete
  # versions so the variant build-args carry a different value when an
-  # upstream package bumps. Without this, when PI_VERSION / OMOS_VERSION
+  # upstream package bumps. Without this, when OMOS_VERSION defaults to
-  # default to 'latest', the docker/build-push-action build-arg string
+  # 'latest', the docker/build-push-action build-arg string is byte-
-  # is byte-identical across builds, so the resulting layer-hash is
+  # identical across builds, so the resulting layer-hash is identical,
-  # identical, so the registry buildcache silently reuses the layer
+  # so the registry buildcache silently reuses the layer from whatever
-  # from whatever pi/omos version was current when the cache was first
+  # omos version was current when the cache was first populated. Same
-  # populated. Same class of bug as pi-devbox v0.74.0..v0.75.5 (fixed in
+  # class of bug as pi-devbox v0.74.0..v0.75.5 (fixed in v0.75.5b
-  # v0.75.5b 2026-05-23). Currently masked here because OPENCODE_VERSION
+  # 2026-05-23). Currently masked because OPENCODE_VERSION is hard-coded
-  # is hard-coded in Dockerfile.variant and bumps every release —
+  # in Dockerfile.variant and bumps every release — invalidating the
-  # invalidating the parent-chain cache key for the pi/omos layers — but
+  # parent-chain cache key for the omos layer — but that masking would
-  # that masking would fail the moment we cut a vN.N.Nb opencode-version-
+  # fail the moment we cut a vN.N.Nb opencode-version-unchanged release
-  # unchanged release that only bumps pi or omos. Fix is preventative.
+  # that only bumps omos. Fix is preventative.
  resolve-versions:
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    outputs:
      pi_version: ${{ steps.resolve.outputs.pi_version }}
      omos_version: ${{ steps.resolve.outputs.omos_version }}
    steps:
-      - name: Resolve pi + omos versions from npm registry
+      - name: Resolve omos version from npm registry
        id: resolve
        run: |
          set -eu
@@ -132,11 +131,9 @@ jobs:
          # and adds it to PATH only via /etc/environment — which act_runner never
          # sources (it reads the Docker image's ENV instructions, not /etc/environment).
          # curl and jq are both guaranteed present in every job in this workflow.
          PI_VERSION=$(curl -sf "https://registry.npmjs.org/@earendil-works%2Fpi-coding-agent/latest" | jq -r '.version')
          OMOS_VERSION=$(curl -sf "https://registry.npmjs.org/oh-my-opencode-slim/latest" | jq -r '.version')
          echo "pi_version=${PI_VERSION}"     >> "$GITHUB_OUTPUT"
          echo "omos_version=${OMOS_VERSION}" >> "$GITHUB_OUTPUT"
-          echo "Resolved PI_VERSION=${PI_VERSION}, OMOS_VERSION=${OMOS_VERSION}"
+          echo "Resolved OMOS_VERSION=${OMOS_VERSION}"
  # ── Phase 2: build & push base (multi-arch), only when needed ──────
  build-base:
@@ -269,7 +266,6 @@ jobs:
            BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
            INSTALL_OPENCODE=true
            INSTALL_OMOS=false
            INSTALL_PI=false
      - name: Smoke test (amd64)
        run: bash scripts/smoke-test.sh opencode-devbox:smoke-base --variant base
@@ -312,104 +308,11 @@ jobs:
            BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
            INSTALL_OPENCODE=true
            INSTALL_OMOS=true
            INSTALL_PI=false
            OMOS_VERSION=${{ needs.resolve-versions.outputs.omos_version }}
      - env:
          EXPECTED_OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
        run: bash scripts/smoke-test.sh opencode-devbox:smoke-omos --variant omos
  smoke-with-pi:
    needs: [base-decide, build-base, resolve-versions]
    if: |
      always() &&
      needs.base-decide.result == 'success' &&
      needs.resolve-versions.result == 'success' &&
      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
      - run: |
          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
            /usr/local/lib/android /usr/local/share/powershell \
            /usr/local/share/chromium /usr/local/share/boost \
            /usr/lib/jvm 2>/dev/null || true
          docker system prune -af --volumes || true
          docker builder prune -af || true
      - uses: docker/setup-buildx-action@v4
        with: {driver-opts: network=host}
      - uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.variant
          platforms: linux/amd64
          push: false
          load: true
          tags: opencode-devbox:smoke-with-pi
          build-args: |
            BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
            INSTALL_OPENCODE=true
            INSTALL_OMOS=false
            INSTALL_PI=true
            PI_VERSION=${{ needs.resolve-versions.outputs.pi_version }}
      - env:
          EXPECTED_PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
        run: bash scripts/smoke-test.sh opencode-devbox:smoke-with-pi --variant with-pi
  smoke-omos-with-pi:
    needs: [base-decide, build-base, resolve-versions]
    if: |
      always() &&
      needs.base-decide.result == 'success' &&
      needs.resolve-versions.result == 'success' &&
      (needs.build-base.result == 'success' || needs.build-base.result == 'skipped')
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
      - run: |
          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
            /usr/local/lib/android /usr/local/share/powershell \
            /usr/local/share/chromium /usr/local/share/boost \
            /usr/lib/jvm 2>/dev/null || true
          docker system prune -af --volumes || true
          docker builder prune -af || true
      - uses: docker/setup-buildx-action@v4
        with: {driver-opts: network=host}
      - uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.variant
          platforms: linux/amd64
          push: false
          load: true
          tags: opencode-devbox:smoke-omos-with-pi
          build-args: |
            BASE_IMAGE=${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
            INSTALL_OPENCODE=true
            INSTALL_OMOS=true
            INSTALL_PI=true
            PI_VERSION=${{ needs.resolve-versions.outputs.pi_version }}
            OMOS_VERSION=${{ needs.resolve-versions.outputs.omos_version }}
      - env:
          EXPECTED_PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
          EXPECTED_OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
        run: bash scripts/smoke-test.sh opencode-devbox:smoke-omos-with-pi --variant omos-with-pi
  # ── Phase 4: multi-arch publish per variant ────────────────────────
  build-variant-base:
@@ -467,7 +370,6 @@ jobs:
                --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
                --build-arg "INSTALL_OPENCODE=true" \
                --build-arg "INSTALL_OMOS=false" \
                --build-arg "INSTALL_PI=false" \
                "${TAG_FLAGS[@]}" \
                .; then
              echo "==> Attempt ${attempt} succeeded"
@@ -537,151 +439,6 @@ jobs:
                --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
                --build-arg "INSTALL_OPENCODE=true" \
                --build-arg "INSTALL_OMOS=true" \
                --build-arg "INSTALL_PI=false" \
                --build-arg "OMOS_VERSION=${OMOS_VERSION}" \
                "${TAG_FLAGS[@]}" \
                .; then
              echo "==> Attempt ${attempt} succeeded"
              exit 0
            fi
            if [[ "${attempt}" -lt 3 ]]; then
              backoff=$(( attempt * 15 ))
              echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
              sleep "${backoff}"
            fi
          done
          echo "==> All 3 build+push attempts failed"
          exit 1
  build-variant-with-pi:
    needs: [base-decide, smoke-with-pi, resolve-versions]
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
      - run: |
          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
            /usr/local/lib/android /usr/local/share/powershell \
            /usr/local/share/chromium /usr/local/share/boost \
            /usr/lib/jvm 2>/dev/null || true
          docker system prune -af --volumes || true
          docker builder prune -af || true
      - uses: docker/setup-qemu-action@v3
        with: {platforms: arm64}
      - uses: docker/setup-buildx-action@v4
        with: {driver-opts: network=host}
      - uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Compute version-specific tags
        id: tags
        run: |
          VERSION="${{ env.RELEASE_TAG }}"
          { echo "tags<<EOF"
            echo "${IMAGE}:${VERSION}-with-pi"
            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
              echo "${IMAGE}:latest-with-pi"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"
      - name: Build and push variant (with retry)
        shell: bash
        env:
          TAGS: ${{ steps.tags.outputs.tags }}
          BASE_IMAGE_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
          PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
        run: |
          set -euo pipefail
          TAG_FLAGS=()
          while IFS= read -r t; do [[ -n "$t" ]] && TAG_FLAGS+=( -t "$t" ); done <<< "${TAGS}"
          # 3-attempt retry (see build-base step for rationale). Variant: with-pi.
          for attempt in 1 2 3; do
            echo "==> Build+push attempt ${attempt}/3"
            if docker buildx build \
                --platform linux/amd64,linux/arm64 \
                --file Dockerfile.variant \
                --push \
                --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
                --build-arg "INSTALL_OPENCODE=true" \
                --build-arg "INSTALL_OMOS=false" \
                --build-arg "INSTALL_PI=true" \
                --build-arg "PI_VERSION=${PI_VERSION}" \
                "${TAG_FLAGS[@]}" \
                .; then
              echo "==> Attempt ${attempt} succeeded"
              exit 0
            fi
            if [[ "${attempt}" -lt 3 ]]; then
              backoff=$(( attempt * 15 ))
              echo "==> Attempt ${attempt} failed, sleeping ${backoff}s before retry"
              sleep "${backoff}"
            fi
          done
          echo "==> All 3 build+push attempts failed"
          exit 1
  build-variant-omos-with-pi:
    needs: [base-decide, smoke-omos-with-pi, resolve-versions]
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
      - run: |
          rm -rf /opt/hostedtoolcache /opt/microsoft /opt/az /opt/ghc \
            /usr/local/.ghcup /usr/share/dotnet /usr/share/swift \
            /usr/local/lib/android /usr/local/share/powershell \
            /usr/local/share/chromium /usr/local/share/boost \
            /usr/lib/jvm 2>/dev/null || true
          docker system prune -af --volumes || true
          docker builder prune -af || true
      - uses: docker/setup-qemu-action@v3
        with: {platforms: arm64}
      - uses: docker/setup-buildx-action@v4
        with: {driver-opts: network=host}
      - uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Compute version-specific tags
        id: tags
        run: |
          VERSION="${{ env.RELEASE_TAG }}"
          { echo "tags<<EOF"
            echo "${IMAGE}:${VERSION}-omos-with-pi"
            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
              echo "${IMAGE}:latest-omos-with-pi"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"
      - name: Build and push variant (with retry)
        shell: bash
        env:
          TAGS: ${{ steps.tags.outputs.tags }}
          BASE_IMAGE_FULL: ${{ env.IMAGE }}:${{ needs.base-decide.outputs.base_tag }}
          PI_VERSION: ${{ needs.resolve-versions.outputs.pi_version }}
          OMOS_VERSION: ${{ needs.resolve-versions.outputs.omos_version }}
        run: |
          set -euo pipefail
          TAG_FLAGS=()
          while IFS= read -r t; do [[ -n "$t" ]] && TAG_FLAGS+=( -t "$t" ); done <<< "${TAGS}"
          # 3-attempt retry (see build-base step for rationale). Variant: omos-with-pi.
          for attempt in 1 2 3; do
            echo "==> Build+push attempt ${attempt}/3"
            if docker buildx build \
                --platform linux/amd64,linux/arm64 \
                --file Dockerfile.variant \
                --push \
                --build-arg "BASE_IMAGE=${BASE_IMAGE_FULL}" \
                --build-arg "INSTALL_OPENCODE=true" \
                --build-arg "INSTALL_OMOS=true" \
                --build-arg "INSTALL_PI=true" \
                --build-arg "PI_VERSION=${PI_VERSION}" \
                --build-arg "OMOS_VERSION=${OMOS_VERSION}" \
                "${TAG_FLAGS[@]}" \
                .; then
@@ -703,8 +460,6 @@ jobs:
      - base-decide
      - build-variant-base
      - build-variant-omos
      - build-variant-with-pi
      - build-variant-omos-with-pi
    # Skip on cache-hit base builds: when need_build=false, base-latest
    # already points at the same digest as base-<hash>, so the retag is
    # a tautology and any transient failure of it is purely cosmetic.
@@ -713,7 +468,7 @@ jobs:
    #
    # `always()` wrapper + explicit base-variant success check protects
    # against the gitea-Actions default of "skipped need => skip dependent":
-    # a partial-publish run (e.g., omos-with-pi smoke fails) shouldn't
+    # a partial-publish run (e.g., omos smoke fails) shouldn't
    # prevent the base-latest alias from advancing on a real base rebuild.
    if: |
      always() &&
@@ -755,10 +510,8 @@ jobs:
    needs:
      - build-variant-base
      - build-variant-omos
      - build-variant-with-pi
      - build-variant-omos-with-pi
    # Run when at least the base variant published — don't let a single
-    # variant failure (e.g., omos-with-pi smoke threshold) prevent Hub
+    # variant failure (e.g., omos smoke threshold) prevent Hub
    # description refresh for the other variants that did publish.
    # Without this `always()` wrapper, gitea Actions' default behavior
    # of "skipped need => skip dependent" cascades from any failed/
@@ -775,6 +528,24 @@ jobs:
      - uses: actions/checkout@v4
      - name: Update Docker Hub description
        run: |
          # Substitute {{OPENCODE_VERSION}} placeholders in DOCKER_HUB.md so
          # the Hub page always shows which opencode version is baked into
          # :latest. The placeholder lives in DOCKER_HUB.md (committed); CI
          # fills it at publish time from the pinned ARG in
          # Dockerfile.variant — the same value that was baked into the
          # image — so the page and the image never drift. (Mirrors the
          # {{PI_VERSION}} pattern in pi-devbox's docker-publish.yml.)
          OPENCODE_VERSION=$(sed -n 's/^ARG OPENCODE_VERSION=//p' Dockerfile.variant | head -1)
          if [ -z "${OPENCODE_VERSION}" ]; then
            echo "::error::Could not extract OPENCODE_VERSION from Dockerfile.variant"
            exit 1
          fi
          cp DOCKER_HUB.md /tmp/hub-full.md
          sed -i "s/{{OPENCODE_VERSION}}/${OPENCODE_VERSION}/g" /tmp/hub-full.md
          if grep -q '{{OPENCODE_VERSION}}' /tmp/hub-full.md; then
            echo "::error::DOCKER_HUB.md still contains unsubstituted {{OPENCODE_VERSION}} markers"
            exit 1
          fi
          TOKEN=$(curl -s -X POST https://hub.docker.com/v2/auth/token \
            -H "Content-Type: application/json" \
            -d '{"identifier":"${{ vars.DOCKERHUB_USERNAME }}","secret":"${{ secrets.DOCKERHUB_TOKEN }}"}' \
@@ -784,7 +555,7 @@ jobs:
            exit 1
          fi
          HTTP_CODE=$(jq -n \
-            --rawfile full DOCKER_HUB.md \
+            --rawfile full /tmp/hub-full.md \
            --arg short "Portable AI dev environment for opencode. Debian-based with git, Node.js, AWS CLI, and SSH support." \
            '{"full_description": $full, "description": $short}' | \
            curl -s -o /tmp/hub-response.txt -w "%{http_code}" -X PATCH \
@@ -195,120 +195,3 @@ jobs:
      - name: Smoke test
        run: |
          bash scripts/smoke-test.sh opencode-devbox:ci-omos --variant omos
  validate-with-pi:
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Force IPv4 for Docker Hub
        run: |
          echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
      - name: Reclaim runner disk
        run: |
          set -x
          df -h / || true
          rm -rf \
            /opt/hostedtoolcache \
            /opt/microsoft \
            /opt/az \
            /opt/ghc \
            /usr/local/.ghcup \
            /usr/share/dotnet \
            /usr/share/swift \
            /usr/local/lib/android \
            /usr/local/share/powershell \
            /usr/local/share/chromium \
            /usr/local/share/boost \
            /usr/lib/jvm 2>/dev/null || true
          apt-get clean || true
          rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* || true
          docker system df || true
          docker system prune -af --volumes || true
          docker builder prune -af || true
          df -h / || true
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver-opts: network=host
      - name: Build with-pi image (amd64, load to local daemon)
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.variant
          platforms: linux/amd64
          push: false
          load: true
          build-args: |
            BASE_IMAGE=joakimp/opencode-devbox:base-latest
            INSTALL_PI=true
          tags: opencode-devbox:ci-with-pi
      - name: Smoke test
        run: |
          bash scripts/smoke-test.sh opencode-devbox:ci-with-pi --variant with-pi
  validate-omos-with-pi:
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Force IPv4 for Docker Hub
        run: |
          echo 'precedence ::ffff:0:0/96  100' >> /etc/gai.conf
      - name: Reclaim runner disk
        run: |
          set -x
          df -h / || true
          rm -rf \
            /opt/hostedtoolcache \
            /opt/microsoft \
            /opt/az \
            /opt/ghc \
            /usr/local/.ghcup \
            /usr/share/dotnet \
            /usr/share/swift \
            /usr/local/lib/android \
            /usr/local/share/powershell \
            /usr/local/share/chromium \
            /usr/local/share/boost \
            /usr/lib/jvm 2>/dev/null || true
          apt-get clean || true
          rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* || true
          docker system df || true
          docker system prune -af --volumes || true
          docker builder prune -af || true
          df -h / || true
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver-opts: network=host
      - name: Build omos+with-pi image (amd64, load to local daemon)
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile.variant
          platforms: linux/amd64
          push: false
          load: true
          build-args: |
            BASE_IMAGE=joakimp/opencode-devbox:base-latest
            INSTALL_OMOS=true
            INSTALL_PI=true
          tags: opencode-devbox:ci-omos-with-pi
      - name: Smoke test
        run: |
          bash scripts/smoke-test.sh opencode-devbox:ci-omos-with-pi --variant omos-with-pi
@@ -4,12 +4,22 @@
 Docker image packaging [opencode](https://opencode.ai) into a production-ready dev container. Image variants are published to Docker Hub via Gitea Actions CI. Not a library or application — this is infrastructure (Dockerfiles, entrypoint scripts, docker-compose, documentation).
 > **pi was removed in v2.0.0** (deprecated since v1.17.2). The `INSTALL_PI`
 > build arg, the `with-pi` / `omos-with-pi` / `pi-only` variants, the
 > `base-pi-only` published tag, and all `~/.pi`-related wiring are gone. pi
 > now ships from its own repo (`joakimp/pi-devbox`). Do not add pi
 > functionality here. The removal history + the `NPM_CONFIG_PREFIX`
 > relocation (`~/.pi/npm-global` → `~/.config/opencode/npm-global`, with a
 > one-time migration shim in `entrypoint-user.sh`) are recorded in
 > `docs/CLEANUP-v2.0.0.md` and the v2.0.0 CHANGELOG entry.
 ## File roles
 - `Dockerfile.base` — variant-independent layers (apt, locales, AWS CLI, Node.js, mempalace, gitea-mcp, user setup, chromadb prewarm, ENVs, entrypoints). Published as `joakimp/opencode-devbox:base-<sha12>`. Rebuilt only when its content hash changes.
- `Dockerfile.variant` — `FROM`s the base and adds only opencode/omos/pi installs gated by build args: `INSTALL_OPENCODE` (default true), `INSTALL_OMOS`, `INSTALL_PI`, and `INSTALL_MEMPALACE`. All GitHub-sourced binaries are pinned with version ARGs.
+- `Dockerfile.variant` — `FROM`s the base and adds only opencode/omos installs gated by build args: `INSTALL_OPENCODE` (default true), `INSTALL_OMOS`, and `INSTALL_MEMPALACE`. All GitHub-sourced binaries are pinned with version ARGs. Two variants: `base` (`INSTALL_OPENCODE=true`) and `omos` (`+INSTALL_OMOS=true`).
- `entrypoint.sh` — runs as root: UID/GID adjustment, SSH permissions, volume ownership fixes (skipped via `.devbox-owner` sentinel when ownership is already correct). Then drops to developer via gosu. Volume ownership loop covers `~/.pi/` when `INSTALL_PI=true`.
+- `entrypoint.sh` — runs as root: UID/GID adjustment, SSH permissions, volume ownership fixes (skipped via `.devbox-owner` sentinel when ownership is already correct). Then drops to developer via gosu.
- `entrypoint-user.sh` — runs as developer: git config, opencode.jsonc generation (delegated to `generate-config.py`), pi-toolkit + pi-extensions deploy (when pi installed), pi settings.json bootstrap, mempalace pi-bridge symlink, skillset auto-deploy from mounted skillset repo, OMOS setup.
+- `entrypoint-user.sh` — runs as developer: git config, opencode.jsonc generation (delegated to `generate-config.py`), LAN-access setup (delegated to `setup-lan-access.sh`), a one-time npm-global prefix migration shim (legacy `~/.pi/npm-global` → `~/.config/opencode/npm-global`), skillset auto-deploy from mounted skillset repo, OMOS setup.
 - `rootfs/usr/local/lib/opencode-devbox/setup-lan-access.sh` — host-OS-agnostic LAN reachability helper. Detects VM-backed hosts (macOS OrbStack / Docker Desktop, via `host.docker.internal` resolution) and generates a writable `~/.ssh-local/config` using the host as an SSH jump; no-op on native Linux. Controlled by `DEVBOX_LAN_ACCESS` / `HOST_SSH_USER` / `DEVBOX_HOST_ALIAS` / `DEVBOX_LAN_AUTOJUMP_PRIVATE`. Ships the mechanism only (generic `host` jump alias); user targets stay host-side — named-peer `ProxyJump host` overrides go in a bind-mounted `~/.config/devbox-shell/ssh-lan.conf` (Included before `~/.ssh/config`), never baked into the image. **Scoping invariant:** every `Include` in the generated config MUST be preceded by a bare `Host *` reset — an `Include` is scoped to the enclosing `Host`/`Match` block, so without the reset the included config only applies when targeting `host`/`mac` and named peers fall back to SSH defaults. The top `Host *` block also overrides `UserKnownHostsFile` and `ControlPath` into the writable `~/.ssh-local` sidecar (first-value-wins), because the bind-mounted `~/.ssh` is read-only — otherwise multiplexed hosts (`ControlPath ~/.ssh/cm/...`) fail to create their master socket. Non-fatal. Counted in the base hash, so editing it advances `base-latest`.
 - `rootfs/usr/local/lib/opencode-devbox/generate-config.py` — generates `~/.config/opencode/opencode.jsonc` from env vars. Never overwrites an existing config (checks both `.json` and `.jsonc`). Auto-registers MCP servers for detected tools (mempalace via `mempalace-mcp`, gitea-mcp, context7 remote endpoint).
 - `scripts/smoke-test.sh` — post-build image verification. Asserts binary presence, opencode startup, entrypoint correctness, config generation idempotency, and image size thresholds. Used by both CI workflows.
 - `scripts/generate-dockerhub-md.py` — generates `DOCKER_HUB.md` from a hand-maintained `HUB_TEMPLATE` constant. `--check` fails if the committed file is out of sync (enforced by the `validate` workflow).
@@ -17,7 +27,7 @@ Docker image packaging [opencode](https://opencode.ai) into a production-ready d
 - `README.md` — authoritative source documentation for everything in this repo. Independent of `DOCKER_HUB.md`: the Hub doc is hand-maintained in the generator's `HUB_TEMPLATE` and intentionally slim, linking back to the gitea README for depth.
 - `.gitea/README.md` — **read this first** if you're touching CI. Architectural overview of the build pipeline (production vs split-base), wall-clock estimates, NPM_CONFIG_PREFIX gotcha, runner expectations, migration plan.
 - `.gitea/workflows/validate.yml` — lightweight amd64 build + smoke test on push to main and PRs. Also runs the DOCKER_HUB.md sync check.
- `.gitea/workflows/docker-publish-split.yml` — production CI pipeline on tag push (`v*`). Two-phase split-base: computes base hash, conditionally builds base, runs 4 parallel smoke tests, then 4 parallel multi-arch variant builds, promotes `base-latest` alias, updates Docker Hub description.
+- `.gitea/workflows/docker-publish-split.yml` — production CI pipeline on tag push (`v*`). Two-phase split-base: computes base hash, conditionally builds base, runs 2 parallel smoke tests, then 2 parallel multi-arch variant builds, promotes `base-latest` alias, updates Docker Hub description.
 ## Versioning scheme
@@ -35,7 +45,7 @@ Tags follow `v{opencode_version}[letter]` — e.g. `v1.14.20` for the first buil
  Cautionary example: 2026-05-28 morning, `v1.15.12` was cut while opencode-ai was still at `1.15.11`. The commit message itself acknowledged "OPENCODE_VERSION stays at 1.15.11" but tagged `v1.15.12` anyway. Re-cut as `v1.15.11c` the same afternoon (see CHANGELOG). The `v1.15.12` git tag and Hub images stayed as historical artifacts; the slip cost a CI cycle and a CHANGELOG-rewrite. **Run the npm view check at the top of every release-day cut.**
-CI produces eight Docker Hub tags per release: `vX.Y.Z[n]`, `latest`, `vX.Y.Z[n]-omos`, `latest-omos`, `vX.Y.Z[n]-with-pi`, `latest-with-pi`, `vX.Y.Z[n]-omos-with-pi`, `latest-omos-with-pi` — one tag pair (versioned + floating alias) per build variant.
+CI produces four Docker Hub tags **under `opencode-devbox`** per release: `vX.Y.Z[n]`, `latest`, `vX.Y.Z[n]-omos`, `latest-omos` — one tag pair (versioned + floating alias) per variant (two variants: `base`, `omos`).
 When bumping the opencode version, bump `OPENCODE_VERSION` in `Dockerfile.variant` and update the comment in `.env.example` if it names a specific model/version for context.
@@ -46,7 +56,6 @@ When drafting a release CHANGELOG entry, pull notes from the **canonical upstrea
 | Package | Canonical upstream | What you'll find there |
 |---|---|---|
 | `opencode-ai` (npm) | <https://github.com/anomalyco/opencode/releases> | Per-version release notes with Core / TUI / Desktop / SDK sections, contributor attributions. Some versions have empty bodies (internal/no-user-visible); most do not. |
 | `@earendil-works/pi-coding-agent` (npm) | The `CHANGELOG.md` shipped inside the npm tarball: `npm pack @earendil-works/pi-coding-agent@<version>` then extract `package/CHANGELOG.md`. | Rich changelog with New Features / Added / Changed / Fixed sections per version. |
 | Other floated tools (gosu, fzf, bat, eza, zoxide, uv, nvim, gitea-mcp, Go, oh-my-opencode-slim) | Each project's own GitHub releases page | Usually less material per release; quote selectively. |
 **Trap to avoid:** there is a `github.com/sst/opencode` repo that some search results surface; that's a fork (and probably the historical name people associate with opencode given the upstream lineage). It does NOT track the same release timeline. Use `anomalyco/opencode` for opencode release notes.
@@ -59,9 +68,6 @@ npm view opencode-ai time --json | python3 -c 'import sys,json,re; d=json.load(s
 # Release notes for a specific version
 curl -s https://api.github.com/repos/anomalyco/opencode/releases/tags/v1.15.10 | python3 -c 'import sys,json; print(json.load(sys.stdin).get("body","(empty)"))'
 # pi changelog
 cd /tmp && npm pack @earendil-works/pi-coding-agent@0.75.5 && tar -xzf earendil-works-pi-coding-agent-0.75.5.tgz package/CHANGELOG.md && head -40 package/CHANGELOG.md
 ```
 ## Critical conventions
@@ -79,26 +85,25 @@ cd /tmp && npm pack @earendil-works/pi-coding-agent@0.75.5 && tar -xzf earendil-
  **Between releases the same coupling applies.** Doc drift is not just a release-day concern — a workflow tweak, entrypoint change, or `generate-config.py` refactor can leave any of these four files lying. Before committing a non-release change, grep the docs for references to what you touched: `git diff --name-only HEAD | xargs -I{} grep -l 'thing-you-changed' README.md AGENTS.md DOCKER_HUB.md .gitea/README.md .env.example`. If a doc says "four variants" / "two phases" / "runs on amd64 only" and your change made that no longer true, fix it in the same commit.
 - **GitHub/Gitea-sourced binaries float by default** — gosu, fzf, git-lfs, gitleaks, nvim, bat, eza, zoxide, uv, gitea-mcp, Go, oh-my-opencode-slim all default to `latest`. Each build-time install step reads the `/releases/latest` Location redirect (or the go.dev JSON feed for Go) and derives the concrete version. Use the same `ARCH` case-switch pattern for multi-arch support (amd64/arm64) — mind project-specific arch-name deviations (gitleaks uses `x64`, bat/eza/zoxide use `x86_64`/`aarch64`, gosu uses `amd64`/`arm64`). Intentional pins: `OPENCODE_VERSION` (drives the image tag), `NODE_VERSION=22` (major pin), `DEBIAN_VERSION=trixie-slim` (OS base). Adding a new upstream tool: follow the existing floated-version pattern, don't hardcode a specific tag.
 - **Resolved versions are logged by the smoke test** — `scripts/smoke-test.sh` prints a "Resolved component versions" table as its first step. CI logs always capture what got baked into a given image even when ARGs default to `latest`.
- **`PI_VERSION` and `OMOS_VERSION` MUST be passed by CI as concrete versions**, not left at the `latest` default. The npm install steps in `Dockerfile.variant` (`npm install -g @earendil-works/pi-coding-agent` / `oh-my-opencode-slim@${OMOS_VERSION}`) produce identical layer-hashes when the ARG values are byte-identical across builds; combined with the registry buildcache (`base-buildcache`) the layer gets reused even when `latest` would have resolved to a newer upstream. This is the same class of bug that bit pi-devbox v0.74.0 → v0.75.5 (silent same-bytes-across-releases regression discovered 2026-05-23, fixed in pi-devbox v0.75.5b). It is currently *masked* in opencode-devbox by `OPENCODE_VERSION` being a hard-coded ARG that bumps every release — that bump invalidates the parent-chain cache key for the downstream pi/omos layers — but the masking would fail the moment a `vN.N.Nb` opencode-version-unchanged release ships that only bumps pi or omos. Preventative fix: `.gitea/workflows/docker-publish-split.yml` has a `resolve-versions` job that runs `npm view @earendil-works/pi-coding-agent version` and `npm view oh-my-opencode-slim version`, exposing concrete values as outputs that every variant smoke + build job consumes via build-args. Smoke tests assert via `EXPECTED_PI_VERSION` / `EXPECTED_OMOS_VERSION` env vars — would catch the regression on the next release rather than four releases later. **If you change the variant build-args list, the resolve-versions job, or the smoke EXPECTED_*_VERSION wiring, audit all affected jobs in lockstep.**
+- **`OMOS_VERSION` MUST be passed by CI as a concrete version**, not left at the `latest` default. The npm install step in `Dockerfile.variant` (`oh-my-opencode-slim@${OMOS_VERSION}`) produces an identical layer-hash when the ARG value is byte-identical across builds; combined with the registry buildcache (`base-buildcache`) the layer gets reused even when `latest` would have resolved to a newer upstream. This is the same class of bug that bit pi-devbox v0.74.0 → v0.75.5 (silent same-bytes-across-releases regression discovered 2026-05-23, fixed in pi-devbox v0.75.5b). It is currently *masked* in opencode-devbox by `OPENCODE_VERSION` being a hard-coded ARG that bumps every release — that bump invalidates the parent-chain cache key for the downstream omos layer — but the masking would fail the moment a `vN.N.Nb` opencode-version-unchanged release ships that only bumps omos. Preventative fix: `.gitea/workflows/docker-publish-split.yml` has a `resolve-versions` job that runs `npm view oh-my-opencode-slim version`, exposing the concrete value as an output that the omos smoke + build jobs consume via build-args. Smoke tests assert via the `EXPECTED_OMOS_VERSION` env var — would catch the regression on the next release rather than several releases later. **If you change the variant build-args list, the resolve-versions job, or the smoke EXPECTED_*_VERSION wiring, audit all affected jobs in lockstep.**
 - **Registry buildkit cache-export is currently disabled** — do NOT re-add `cache-from`/`cache-to` to the `build-base` step in `.gitea/workflows/docker-publish-split.yml` without first verifying that buildkit's `mode=max` cache-export to `registry-1.docker.io` no longer returns HTTP 400 from the Hub CDN edge. The regression surfaced ~2026-05-23 and broke five consecutive opencode-devbox publish attempts (runs #332/333/334/336 + a rerun); root-caused on 2026-05-28 by a manual host-side publish that reproduced the same 400 only on `--cache-to` while image push worked fine. Failure shape is stable (`Offset:0` in the `_state` token, HTML response body = CDN-tier rejection, not registry backend), repo-specific (we're the only repo writing `:base-buildcache` mode=max), and explains why pinning `setup-buildx-action@v4.0.0` didn't help (action pin doesn't change the bundled buildkit version on the catthehacker runner image). Trade-off: dockerfile.base changes pay a full ~3 min rebuild instead of pulling cached layers; unchanged bases short-circuit at the Hub-probe step in `base-decide` and never re-build anyway. Variants don't use registry cache so they're unaffected. Re-enable condition: upstream moby/buildkit fix lands AND a low-risk test run succeeds without 400s. See CHANGELOG v1.15.12 `Unreleased` block for the full diagnostic chain. Manual escape-hatch publish procedure: `docs/manual-host-publish.md`.
- **Push steps wrap `docker buildx build --push` in a 3-attempt retry loop** (15s, 30s backoff) for transient `registry-1.docker.io` blips — rate limits, brief 5xx, CDN flap. Implemented as inline `shell: bash` steps with `docker buildx build` raw rather than `docker/build-push-action@v7` so the loop is visible and tweakable. Affects the 1 base + 4 variant push steps in `.gitea/workflows/docker-publish-split.yml`; smoke-test builds (`load: true`, no push) are untouched. **This does NOT mask deterministic failures** — a true regression (like the cache-export 400 of 2026-05-23..28) fails all 3 attempts identically and the job still fails. Orthogonal to the cache-export disablement above: cache-export was about a deterministic protocol mismatch, retry is about absorbing genuine transients. Both are belt-and-braces with the `ci-release-watcher` skill's transient-rerun heuristic. If you change the matrix of push steps, keep the retry wrapper consistent across them — the pattern is duplicated rather than factored out because Gitea Actions doesn't support reusable composite shell steps cleanly.
+- **Push steps wrap `docker buildx build --push` in a 3-attempt retry loop** (15s, 30s backoff) for transient `registry-1.docker.io` blips — rate limits, brief 5xx, CDN flap. Implemented as inline `shell: bash` steps with `docker buildx build` raw rather than `docker/build-push-action@v7` so the loop is visible and tweakable. Affects the 1 base + 5 variant push steps in `.gitea/workflows/docker-publish-split.yml`; smoke-test builds (`load: true`, no push) are untouched. **This does NOT mask deterministic failures** — a true regression (like the cache-export 400 of 2026-05-23..28) fails all 3 attempts identically and the job still fails. Orthogonal to the cache-export disablement above: cache-export was about a deterministic protocol mismatch, retry is about absorbing genuine transients. Both are belt-and-braces with the `ci-release-watcher` skill's transient-rerun heuristic. If you change the matrix of push steps, keep the retry wrapper consistent across them — the pattern is duplicated rather than factored out because Gitea Actions doesn't support reusable composite shell steps cleanly.
 - **Shell scripts use `set -euo pipefail`** — both entrypoints are strict. Errors in volume chown or SSH permission operations are intentionally suppressed with `|| true`.
 - **MemPalace install path** — installed via `uv tool install` into `/opt/uv-tools/mempalace/`. Both the `mempalace` CLI and the `mempalace-mcp` MCP server binary are shipped as entry points by the mempalace package itself and placed on PATH by uv as shims whose shebangs point at the venv's Python. No hand-rolled wrapper is needed. Do not use `pip install --break-system-packages` — that was the previous approach and has been removed. Do not use `["python3", "-m", "mempalace.mcp_server"]` in `opencode.jsonc` — system Python can't import from the uv venv.
 - **generate-config.py idempotency** — the script MUST never overwrite an existing `opencode.jsonc` or legacy `opencode.json`. Config persists in the `devbox-opencode-config` named volume; accidentally clobbering that file would destroy hand-edits. The smoke test asserts this.
 - **Skillset auto-deploy** — on every container start, `entrypoint-user.sh` looks for a skillset repo (detection order: `$SKILLSET_CONTAINER_PATH` → `$HOME/skillset` → `/workspace/skillset`) and runs `deploy-skills.sh --bootstrap --prune-stale`. This creates relative symlinks in `~/.agents/skills/` and `~/.config/opencode/instructions/`. Do NOT bind-mount `~/.agents/skills/` from the host — the container manages its own skills with relative symlinks that differ from the host's. The named volume `devbox-opencode-config` persists the deployed config across restarts.
- **Config persistence via named volume** — `devbox-opencode-config` is a Docker named volume mounted at `~/.config/opencode/`. It is NOT a host bind mount by default. This separation allows both native and containerized opencode to coexist on the same machine without symlink conflicts. Users who need to override can replace the named volume with a host bind mount in their compose file. **Same pattern for pi:** `devbox-pi-config` is mounted at `~/.pi/` and persists user toggles (`/ext`-disabled extensions), `~/.pi/agent/settings.json` edits, and — because `NPM_CONFIG_PREFIX` is set to `~/.pi/npm-global` — anything installed via `pi install npm:...` or `npm install -g` as the developer user, across container recreate AND image rebuild.
+- **Config persistence via named volume** — `devbox-opencode-config` is a Docker named volume mounted at `~/.config/opencode/`. It is NOT a host bind mount by default. This separation allows both native and containerized opencode to coexist on the same machine without symlink conflicts. Users who need to override can replace the named volume with a host bind mount in their compose file. Because `NPM_CONFIG_PREFIX` is set to `~/.config/opencode/npm-global` (relocated from the legacy `~/.pi/npm-global` in v2.0.0), anything installed via `npm install -g` as the developer user also lands on this volume and survives container recreate AND image rebuild.
- **pi install contract** — `INSTALL_PI=true` (default false) opt-in build arg. The baked `pi` binary is npm-installed globally to `/usr` at build time (system prefix). At runtime, `NPM_CONFIG_PREFIX=/home/developer/.pi/npm-global` is set in the image ENV with that prefix's `bin/` prepended to `PATH` — so any `pi install npm:...` or `npm install -g` invoked by the developer user lands on the named volume and survives everything except `docker compose down -v`. The new ENVs are declared *after* all build-time `npm install -g` calls in the Dockerfile so they don't redirect the baked installs into a path that the volume mount would later shadow. If the user runs `npm install -g @earendil-works/pi-coding-agent` themselves, the user-installed copy on the volume wins via `PATH` order; otherwise image rebuild is the upgrade path for the baked pi (same contract as `OPENCODE_VERSION`). The pi-toolkit and pi-extensions repos are git-cloned into `/opt/` at build time, then their `install.sh` runs from `entrypoint-user.sh` on each container start to symlink into `~/.pi/agent/` (which lives on the named volume). The mempalace pi-bridge is symlinked manually from `/opt/mempalace-toolkit/extensions/pi/mempalace.ts` — we do NOT call mempalace-toolkit's full `install.sh` because its `install_skill` step would race with skillset auto-deploy `--prune-stale`.
+- **npm-global prefix relocation (v2.0.0 breaking change)** — the user-writable global npm prefix moved from `~/.pi/npm-global` to `~/.config/opencode/npm-global`. The old path lived on the `devbox-pi-config` volume (only mounted in `docker-compose.yml`); the new path is on `devbox-opencode-config`, which is a persistent named volume in BOTH `docker-compose.yml` and `docker-compose.shared.yml`. `entrypoint-user.sh` carries a one-time migration shim: if `~/.pi/npm-global` exists and the marker `~/.config/opencode/npm-global/.migrated-from-dot-pi` is absent, it `cp -an` the old `lib/`/`bin/`/`share/` into the new prefix (never overwriting fresh installs) and writes the marker. Baked binaries stay on `/usr` (the variant Dockerfile runs each `npm install -g` with `NPM_CONFIG_PREFIX=/usr`) so the volume mount doesn't shadow them. The `ENV NPM_CONFIG_PREFIX`/`PATH` lines in `Dockerfile.base` are declared *after* all build-time installs.
- **Pi deploy ordering matters in entrypoint-user.sh** — `pi-toolkit` runs first (creates `keybindings.json` symlink and writes pi-env.zsh), then `pi-extensions`, then `settings.json` template bootstrap, then mempalace bridge symlink. mempalace-toolkit's `check_pi_toolkit` probe (when called from the host install path) expects keybindings to already be present — not currently called from container, but ordering matches host convention.
+- **Default CMD is `bash -l`** — not a harness. `docker compose run --rm devbox` drops the user into a login shell to choose: `aws sso login`, then `opencode` (or any tool). Pass the harness explicitly to launch directly: `docker compose run --rm devbox opencode`. `docker compose exec` bypasses entrypoint+CMD entirely (existing user workflow unchanged).
 - **Default CMD is `bash -l`** — not a harness. `docker compose run --rm devbox` drops the user into a login shell to choose: `aws sso login`, then `opencode` or `pi` (or any tool). Pass the harness explicitly to launch directly: `docker compose run --rm devbox opencode` / `docker compose run --rm devbox pi`. `docker compose exec` bypasses entrypoint+CMD entirely (existing user workflow unchanged).
 - **Docker Hub description update** — uses `/v2/auth/token` endpoint (not the deprecated `/v2/users/login`). Auth uses `identifier`/`secret` fields, returns `access_token`, sent as `Bearer`. Short description must be ≤100 bytes.
 ## CI quirks
 - Both build jobs include an IPv4 preference step (`gai.conf` + `driver-opts: network=host` for buildx) to work around intermittent IPv6 failures on the Gitea runners.
- `update-description` job runs only when both builds succeed (`needs: [build-base, build-omos]`).
+- `update-description` job runs when the base variant published (`needs: [build-variant-base, build-variant-omos]`, gated with `always()` + an explicit `build-variant-base.result == 'success'` check so a partial-publish run still refreshes the Hub description).
 - Tags must be pushed to trigger the publish workflow. The validate workflow runs on push to main and PRs.
 - Smoke tests run on amd64 only (single-arch load into the local daemon). The multi-arch push happens after smoke passes.
- **Gitea Actions runner has ~40 GB disk, often 70%+ used at job start.** All eight `load: true` jobs (`validate-base`, `validate-omos`, `validate-with-pi`, `validate-omos-with-pi`, `smoke-base`, `smoke-omos`, `smoke-with-pi`, `smoke-omos-with-pi`) include a `Reclaim runner disk` step that strips catthehacker-resident toolchains and prunes stale docker state before `setup-buildx-action`. Build jobs use a lighter version (push-by-digest doesn't need `docker system prune`). Don't remove these steps without testing on a fresh runner.
+- **Gitea Actions runner has ~40 GB disk, often 70%+ used at job start.** All `load: true` jobs (`validate-base`, `validate-omos`, `smoke-base`, `smoke-omos`) include a `Reclaim runner disk` step that strips catthehacker-resident toolchains and prunes stale docker state before `setup-buildx-action`. Build jobs use a lighter version (push-by-digest doesn't need `docker system prune`). Don't remove these steps without testing on a fresh runner.
 - **`docker/build-push-action@v7` with `platforms: linux/amd64,linux/arm64` handles multi-arch push natively in a single job** — produces a proper manifest list, no matrix or merge step needed. An earlier revision split into per-arch matrix jobs with digest artifacts, but that pattern requires `actions/{upload,download}-artifact@v4+` which Gitea Actions doesn't support (see below).
 - **`actions/upload-artifact` and `actions/download-artifact` must stay at @v3 on Gitea.** v4+ uses a GitHub-Enterprise-specific Artifact API; runs fail with `GHESNotSupportedError`. If you need artifacts for a new reason (build logs, SBOMs, etc.), pin @v3 explicitly.
 - **Step scripts run under `/bin/sh` (dash), not bash.** Avoid bash-isms like `${VAR//a/b}` parameter-pattern substitution; use POSIX alternatives (`tr`, `sed`) or declare `shell: bash` on the step.
@@ -8,7 +8,408 @@ Tags follow `v{opencode_version}[letter]` — bare tag for the first build on a
 ## Unreleased
-_(no changes since v1.15.12)_
+## v2.0.0 — 2026-06-13
 **Major release: pi is fully removed from opencode-devbox** (deprecated in
 v1.17.2), and the user-writable global npm prefix is relocated off the
 pi-specific `~/.pi` path. Also bumps opencode. The major version signals the
 two breaking changes below.
 ### Bumped: opencode-ai 1.17.2 → 1.17.4
 `OPENCODE_VERSION` ARG in `Dockerfile.variant`.
 ### Removed: all pi support
 pi ships as its own self-contained image,
 [`joakimp/pi-devbox`](https://gitea.jordbo.se/joakimp/pi-devbox). Everything
 pi-related is now gone from this repo:
 - The `INSTALL_PI` build arg and all `PI_*` args (`PI_VERSION`,
  `PI_TOOLKIT_REF`, `PI_EXTENSIONS_REF`, `PI_FORK_*`, `PI_OBSMEM_*`).
 - The `with-pi`, `omos-with-pi`, and `pi-only` build variants. **Only `base`
  and `omos` remain** — four published tags per release (`vX.Y.Z`, `latest`,
  `vX.Y.Z-omos`, `latest-omos`).
 - The `base-pi-only[-vX.Y.Z]` tag that this repo's CI published into the
  `joakimp/pi-devbox` repo. The publisher job is deleted; the orphaned
  `base-pi-only*` tags on the pi-devbox Hub repo can now be purged (see
  `docs/CLEANUP-v2.0.0.md`).
 - All `~/.pi` entrypoint wiring (pi-toolkit / pi-extensions deploy,
  settings.json bootstrap, mempalace pi-bridge symlink, pi-fork / pi-obsmem
  registration), the `~/.pi` volume-ownership entry, and the three pi
  smoke / validate / build-variant CI jobs.
 **Migration:** pull `joakimp/pi-devbox:latest` instead of any `*-with-pi` /
 `pi-only` opencode-devbox tag. opencode-only users are unaffected by the pi
 removal itself.
 ### Breaking: global npm prefix relocated `~/.pi/npm-global` → `~/.config/opencode/npm-global`
 `NPM_CONFIG_PREFIX` (and the matching `PATH` entry) moved off the
 pi-specific path. The new location lives on the `devbox-opencode-config`
 named volume, which — unlike the old `devbox-pi-config` — is a **persistent
 named volume in both `docker-compose.yml` and `docker-compose.shared.yml`**,
 so runtime `npm install -g` still survives container recreate and image
 rebuild.
 **Impact on upgraders:** any tool you previously `npm install -g`'d landed in
 `~/.pi/npm-global` and will **drop off `PATH`** under v2.0.0.
 **Mitigation (automatic):** `entrypoint-user.sh` carries a one-time
 migration shim. On first start, if `~/.pi/npm-global` exists and the marker
 `~/.config/opencode/npm-global/.migrated-from-dot-pi` is absent, it copies
 the old `lib/`/`bin/`/`share/` contents into the new prefix (never
 overwriting freshly-installed packages) and writes the marker. For the shim
 to see your old packages, the legacy `devbox-pi-config` volume must still be
 mounted at `~/.pi` for that first start — the shipped `docker-compose.yml`
 leaves it commented with instructions; uncomment the mount for one start if
 you had global npm tools to migrate, then remove it. Fresh installs carry no
 `~/.pi` dead weight. If you don't need the old packages, ignore all of this
 and re-`npm install -g` anything you want.
 ### Docs / CI
 - `DOCKER_HUB.md` now shows the baked opencode version via a
  `{{OPENCODE_VERSION}}` placeholder substituted by CI at publish time
  (mirrors pi-devbox's `{{PI_VERSION}}` pattern) — the Hub page can no longer
  drift from the image.
 - README, AGENTS.md, `.gitea/README.md`, `.env.example`, and the
  `docs/manual-host-publish.*` runbook updated to the two-variant reality
  (variant tables, CI job lists, the npm-prefix gotcha, ASCII pipeline
  diagram, tag counts).
 - CI: removed the three pi smoke jobs, three pi build-variant jobs, the
  `pi-only` publish-to-pi-devbox job, and the pi/fork/obsmem resolution in
  `resolve-versions` (now resolves omos only). `validate.yml` drops its
  three pi validate jobs.
 ## v1.17.2 — 2026-06-10
 First container build on **opencode-ai `1.17.2`** (from `1.16.2`). This
 release also **deprecates all pi support** ahead of its removal in v2.0.0,
 and hardens the mempalace install.
 ### Bumped: opencode-ai 1.16.2 → 1.17.2
 `OPENCODE_VERSION` ARG in `Dockerfile.variant`. Bare `v1.17.2` tag per the
 `v{opencode_version}` scheme.
 ### Deprecated: pi support (removed in v2.0.0)
 pi has been decoupled into its own self-contained image,
 [`joakimp/pi-devbox`](https://gitea.jordbo.se/joakimp/pi-devbox) (v1.0.0+,
 which no longer FROMs `base-pi-only`). The pi paths in opencode-devbox are
 now dead weight and are **deprecated as of v1.17.2, scheduled for removal in
 v2.0.0**:
 - The `INSTALL_PI` build arg and all `PI_*` args.
 - The `with-pi`, `omos-with-pi`, and `pi-only` build variants.
 - The `base-pi-only[-vX.Y.Z]` tag published (to the `joakimp/pi-devbox`
  repo) from this repo's CI.
 - All `~/.pi`-related entrypoint wiring (pi-toolkit / pi-extensions deploy,
  settings.json bootstrap, mempalace pi-bridge symlink, pi-fork / pi-obsmem
  registration).
 What this release does:
 - Building with `INSTALL_PI=true` now prints a **build-time deprecation
  warning** to stderr.
 - README, DOCKER_HUB.md, and AGENTS.md mark the pi variants deprecated and
  point to `joakimp/pi-devbox`.
 - The full removal plan is documented in `docs/CLEANUP-v2.0.0.md`.
 **Migration:** pull `joakimp/pi-devbox:latest` directly instead of any
 `*-with-pi` / `pi-only` opencode-devbox tag. opencode-only users are
 unaffected by this release.
 #### ⚠ Heads-up for v2.0.0: global npm prefix relocation
 Today `NPM_CONFIG_PREFIX` points at the pi-specific `~/.pi/npm-global`
 (backed by the `devbox-pi-config` named volume), so `npm install -g` as the
 developer user persists across recreates. **v2.0.0 will move the prefix to a
 neutral opencode path** (e.g. `~/.config/opencode/npm-global`). Consequences
 for existing opencode users at the v2.0.0 upgrade:
 - Previously global-installed npm tools remain on disk in the old volume but
  **drop off `PATH`** until migrated.
 - The new prefix path is not currently a named volume, so persistence needs a
  compose/volume update.
 v2.0.0 will ship a **one-time migration shim** (copies old prefix contents to
 the new path on first run) and an updated volume mapping. This notice is the
 one-release-cycle advance warning.
 ### Hardened: mempalace install pinned + diary_write schema workaround
 - `MEMPALACE_VERSION` is now an explicit ARG (default `3.4.0`) in
  `Dockerfile.base`; the install uses `mempalace==${MEMPALACE_VERSION}`
  instead of an unpinned `uv tool install mempalace`. An unpinned install is
  what silently swept in the broken `diary_write` schema. Mirrors pi-devbox.
 - Added an idempotent, self-deactivating post-install patch that strips the
  **top-level `anyOf`** from `mempalace_diary_write`'s `input_schema`.
  Mempalace 3.3.x/3.4.0 advertise `anyOf:[{required:[entry]},{required:[content]}]`
  at the schema root, which the Anthropic tools API rejects outright
  (`input_schema does not support oneOf, allOf, or anyOf at the top level`),
  breaking pi/Claude tool registration at session start. The handler still
  accepts `content` server-side. Upstream: MemPalace/mempalace#1728, PR #1735.
  Remove once a fixed mempalace release is pinned.
 ### Fixed: smoke-test pi-extensions readiness race (test-only, no image change)
 `scripts/smoke-test.sh`'s entrypoint-deploy wait loop gated only on
 `keybindings.json` (written by pi-toolkit, which runs *before* pi-extensions),
 so the `~/.pi/agent/extensions/*.ts ≥ 4` assertion could sample mid-deploy and
 see fewer than 4 files under parallel build load. Observed on v1.16.2 run 370:
 `smoke-with-pi` saw `<4` while `smoke-omos-with-pi` / `smoke-pi-only` (identical
 pi-extensions `357fcc6`) both saw 8, skipping `build-variant-with-pi`. The wait
 loop now blocks until the *last*-deployed artifact (the `mempalace.ts` bridge
 symlink) exists **and** the extension count has settled ≥ 4 (up to 45s).
 ## v1.16.2 — 2026-06-08
 First container build on the `opencode-ai@1.16.x` minor release (rolls up
 `1.16.0` → `1.16.1` → `1.16.2`, all published 2026-06-05). Also picks up
 **pi `0.78.1` → `0.79.0`** (resolved fresh by CI's `resolve-versions` job) in
 the `with-pi`, `omos-with-pi`, and `pi-only` variants.
 ### Bumped: opencode-ai 1.15.13 → 1.16.2
 `OPENCODE_VERSION` ARG in `Dockerfile.variant`. Highlights from the upstream
 release (full notes: <https://github.com/anomalyco/opencode/releases>):
 - **1.16.0** — ~38% faster startup (@StarpTech); managed workspace cloning that
  keeps dirty/untracked files; move sessions between workspaces/directories;
  proper OpenAI-via-Bedrock support; skill discovery + file-based agent loading;
  `run --replay` for interactive session replay. Plus TUI/desktop polish and
  numerous bugfixes (shell cancellation races, Windows path normalization, ACP
  cancel/abort).
 - **1.16.1** — internal/no user-visible notes (empty release body).
 - **1.16.2** — reasoning summaries only run on supporting providers (avoids
  GPT-5 request failures); edit operations refuse loose matches that could
  overwrite the wrong code; Bedrock hang-before-first-token fix; diff-viewer
  hunk navigation; subagents can be backgrounded; Snowflake Cortex provider.
 ### Picks up: pi 0.78.1 → 0.79.0
 Resolved at build time for the pi-bearing variants. Headlines: project-trust
 prompting for project-local settings/resources/instructions/packages (with
 `--approve`/`--no-approve` and a `project_trust` extension event), cache-hit
 rate in the interactive footer, richer SDK/RPC extension surfaces, plus a
 stack of TUI and provider fixes. Full notes ship in the npm tarball's
 `CHANGELOG.md`.
 ### Smoke size thresholds bumped +150 MB (preemptive)
 Ahead of the combined minor opencode + pi bump, all opencode-bearing variant
 thresholds in `scripts/smoke-test.sh` were raised: `base` 2600 → 2750,
 `omos` 3300 → 3450, `with-pi` 2900 → 3050, `omos-with-pi` 3900 → 4050; and
 `pi-only` 2750 → 2850 (+100, pi-only carries only the pi bump). Both `base`
 (last 2506 MB) and `omos` (last 3206 MB) were on ~94 MB headroom, and a minor
 opencode bump has tripped these ceilings before (v1.15.0 omos, v1.15.4
 omos-with-pi), causing a partial publish + letter-suffix recovery cycle.
 Restoring ~250 MB headroom avoids that. CI's smoke size print records actual
 landed sizes — tighten later if they come in well under.
 ## v1.15.13e — 2026-06-04
 Letter-suffix rebuild on opencode `1.15.13` (version unchanged). Picks up
 **pi `0.78.1`** (resolved fresh by CI's `resolve-versions` job) plus the LAN-jump
 key-persistence work, an entrypoint ownership fix for the new `devbox-ssh-local`
 volume, a CI smoke false-negative fix, and documentation. Touches `entrypoint.sh`
 and `setup-lan-access.sh` (both in the base hash), so `base-latest` /
 `base-pi-only` advance and the fixes propagate to `pi-devbox`.
 ### Docs: per-host `ControlPath` overrides break `pi --ssh` (read-only `~/.ssh`)
 Documented a gotcha in the README "Reaching your LAN" section: the bind-mounted
 `~/.ssh/config` is read before the baked `Host *` default, and SSH uses the
 first `ControlPath` it sees. A per-host block that sets `ControlPath` under
 `~/.ssh/` (a common CGNAT-multiplexing pattern, e.g. `~/.ssh/cm/%r@%h:%p`) wins
 but then fails inside the container because `~/.ssh` is mounted read-only — the
 master socket can't bind. This silently breaks `pi --ssh <host>`: the SSH layer
 fails and pi falls back to running its tools locally in the container. Fix is
 host-side — drop the per-host `ControlPath` or repoint it at the writable
 `/tmp/sshcm/%r@%h:%p` (works on both host and container, preserves multiplexing).
 No image change; documentation only.
 ### Fixed: validate.yml false-negative on fork/recall registration checks
 The push-to-main `validate.yml` builds variants FROM the published `base-latest`
 image, which lags the entrypoint in the current commit until a release tag
 rebuilds the base. The fork/recall *registration* smoke checks depend on the
 base entrypoint running `pi install /opt/<pkg>`, so a stale `base-latest` reded
 those runs with a false negative even when the variant layer was correct.
 `smoke-test.sh` now gates the two registration assertions behind
 `STRICT_REGISTRATION` (warn-only when unset). `validate.yml` leaves it unset;
 the release pipeline (`docker-publish-split.yml`), which builds the base fresh
 in the same run, sets `STRICT_REGISTRATION=1` on the pi-bearing smoke jobs to
 enforce them. The build-time `/opt` + `node_modules` checks stay hard in both
 paths.
 ### Added: persist the LAN-jump key + one-line authorize hint (authorize once per machine)
 The jump keypair (`~/.ssh-local/devbox_jump_ed25519`) was stored on the
 container's ephemeral overlay, so `docker compose up --force-recreate` (every
 image update) regenerated it — forcing you to re-authorize the new key on the
 host each time. The compose files now persist `~/.ssh-local` via a named volume
 (`devbox-ssh-local`), matching the pattern already used for `.pi`, shell
 history, etc. The key is generated **once** and reused across updates, so you
 authorize it on the host **once per machine**.
 `setup-lan-access.sh` now also prints a ready-to-paste authorize line whenever
 it generates a **new** key (not just when `HOST_SSH_USER` is unset), e.g.
 `echo 'ssh-ed25519 …' >> ~/.ssh/authorized_keys` — no helper file to locate, no
 workspace path to guess. It stays silent once the key is persisted.
 ### Fixed: chown the `devbox-ssh-local` volume so the jump key can be generated
 The previous change persisted `~/.ssh-local` via a named volume, but the
 entrypoint's volume-ownership loop was never updated to include it. Docker
 creates named volumes as `root:root`, so on a fresh volume `~/.ssh-local`
 stayed root-owned while `setup-lan-access.sh` runs as `developer` — both its
 `mkdir cm` and `ssh-keygen` failed silently (`|| true` / `|| exit 0`), leaving
 **no jump key and no config**, breaking LAN access on the first recreate after
 the persistence change. `entrypoint.sh` now chowns `~/.ssh-local` to the
 developer user alongside the other named-volume mount points.
 ### Docs: document the optional `~/.config/devbox-shell` mount in the compose template
 `docker-compose.yml` now carries a commented-out `~/.config/devbox-shell` bind
 mount with an explanatory note. It's the recommended home for host-owned shell
 config: the image's `~/.bash_aliases` sources `~/.config/devbox-shell/bash_aliases`
 if present, and `setup-lan-access.sh` reads `~/.config/devbox-shell/ssh-lan.conf`
 for named-peer `ProxyJump host` overrides. A directory mount is preferred over
 the single-file `~/.bash_aliases` mount because it survives editors' atomic-save.
 Template comment only; no behavior change.
 ## v1.15.13d — 2026-06-04
 LAN-access fixes + ergonomics. Letter-suffix rebuild on opencode `1.15.13`
 (version unchanged). Touches `setup-lan-access.sh`, which is in the base hash,
 so `base-latest` / `base-pi-only` advance and the fix propagates to `pi-devbox`.
 ### Fixed: LAN-access `Include` was scoped to the `host`/`mac` block (named peers ignored)
 The generated `~/.ssh-local/config` placed `Include ~/.ssh/config` *inside* the
 `Host host mac` block. Because SSH scopes an `Include` to the enclosing
 `Host`/`Match` block, the user's `~/.ssh/config` was only consulted when
 targeting `host`/`mac` — so `dssh pve` / `dssh <peer>` by name silently fell
 back to SSH defaults (wrong user, unresolved hostname) and never applied the
 peer's settings or any `ProxyJump`. Fixed by emitting a bare `Host *` scope
 reset before every `Include`.
 ### Fixed: read-only `~/.ssh/cm` ControlPath broke multiplexed hosts
 The bind-mounted `~/.ssh/config` commonly sets `ControlPath ~/.ssh/cm/...`
 (CGNAT flow-cap multiplexing), but `~/.ssh` is read-only in the container, so
 every `ControlMaster`-enabled host (e.g. `pmx-jh`, `proxmox*`, `synlig`) failed
 with `cannot bind to path … Read-only file system`. The generated config now
 sets `ControlPath ~/.ssh-local/cm/%r@%h:%p` in the top `Host *` block
 (first-value-wins) so master sockets land in the writable sidecar.
 ### Added: host-owned `ssh-lan.conf` for named-peer jump overrides
 When the host bind-mounts `~/.config/devbox-shell/ssh-lan.conf`, the generated
 config now Includes it *before* `~/.ssh/config`. Put `ProxyJump host` overrides
 there (first-value-wins inherits HostName/User/IdentityFile from `~/.ssh/config`)
 instead of editing the shared `~/.ssh/config` — which would break the host's own
 direct access to those peers and is read-only from the container anyway. New
 [`ssh-lan.conf.example`](ssh-lan.conf.example).
 ### Added: `DEVBOX_LAN_AUTOJUMP_PRIVATE=1` opt-in RFC1918 auto-jump
 Emits a catch-all that ProxyJumps any private (RFC1918) IP through the host, so
 bare `dssh user@<ip>` reaches whatever LAN the (roaming) host is currently on,
 without naming peers. Matches the typed address (not the resolved HostName), so
 named hosts carrying their own ProxyJump are unaffected; public IPs stay direct.
 All three land in `rootfs/usr/local/lib/opencode-devbox/setup-lan-access.sh`,
 which is counted in the base hash → advances `base-latest` and propagates to
 `pi-devbox` (built `FROM` the base).
 ## v1.15.13c — 2026-06-03
 Follow-up to v1.15.13b: relocates the pi-only build out of the `opencode-devbox`
 repo (Option B) and fixes the base size threshold that blocked `promote-base-latest`.
 ### Changed: `pi-only` build now publishes to the `joakimp/pi-devbox` repo (not `opencode-devbox`)
 The `pi-only` variant (added in v1.15.13b) was published under `opencode-devbox`
 as `latest-pi-only` / `vX.Y.Z-pi-only` — an "opencode-devbox" tag that contains
 **no opencode**, which confused users browsing the tag list.
 - The `build-variant-pi-only` CI job now pushes the artifact into the
  **`joakimp/pi-devbox`** repo as `base-pi-only-vX.Y.Z` (+ floating `base-pi-only`
  on tag builds) instead of `opencode-devbox:*-pi-only`. New `PI_IMAGE` workflow env.
 - It is still built from the same `Dockerfile.variant` (single source of truth)
  and still smoke-tested by `smoke-pi-only` / `validate-pi-only` before publish.
 - `opencode-devbox` now publishes **eight** tags per release (four opencode-bearing
  variants) plus `base-latest`; the pi-only pair lives in the pi-devbox repo.
 - De-advertised the pi-only tag from the README, `DOCKER_HUB.md` (HUB_TEMPLATE),
  and AGENTS docs.
 - The old `opencode-devbox:latest-pi-only` / `vX.Y.Z-pi-only` tags from v1.15.13b
  are superseded and should be deleted from Docker Hub.
 ### Fixed: base image size threshold (unblocks `promote-base-latest`)
 - Bumped the `base` variant smoke size threshold 2500 → 2600 MB. In the v1.15.13b
  run the base crept to 2506 MB (LAN-access script + updated entrypoint + apt
  drift) and tripped the deliberately zero-headroom 2500 ceiling, which failed
  `smoke-base` and cascaded into skipping `build-variant-base` **and**
  `promote-base-latest` — so `base-latest` never advanced. (`base-<hash>` and the
  omos/with-pi/omos-with-pi/pi-only variants did publish on the fresh base.)
 ## v1.15.13b — 2026-06-03
 Container-level rebuild on opencode `1.15.13` (unchanged) and pi `0.78.0` (unchanged) — adds host-OS-agnostic LAN access, the `fork`/`recall` pi extensions, and a new `pi-only` variant. Letter-suffix release per the `v{opencode_version}[letter]` scheme since no upstream version moved.
 ### Added: host-OS-agnostic LAN access (base image)
 The container can now reach LAN peers that the **host** can reach, regardless of host OS — addressing the macOS/Docker-Desktop limitation where a container in the Linux VM cannot see the host's directly-attached LAN.
 - New `rootfs/usr/local/lib/opencode-devbox/setup-lan-access.sh`, invoked (non-fatally) by `entrypoint-user.sh` on every start.
 - **Detection:** on VM-backed hosts (macOS OrbStack / Docker Desktop, Windows Docker Desktop — detected via `host.docker.internal` resolution) it generates a writable `~/.ssh-local/config` that uses the host as an SSH **jump**. On native Linux Docker (LAN reachable directly) it is a **no-op**.
 - **Mechanism, not policy:** ships a generic `host` (alias `mac`) jump entry + a generated jump key in the writable `~/.ssh-local/` sidecar (necessary because `~/.ssh` is bind-mounted read-only). Your own targets stay in your bind-mounted `~/.ssh/config` (add `ProxyJump host`), pulled in via `Include ~/.ssh/config`.
 - New env knobs: `DEVBOX_LAN_ACCESS` (`auto`|`jump`|`off`, default `auto`), `HOST_SSH_USER`, `DEVBOX_HOST_ALIAS`. When `HOST_SSH_USER` is unset the entrypoint prints the public key to authorize on the host.
 - New `dssh` / `dscp` aliases in `.bash_aliases` (wrap `ssh -F ~/.ssh-local/config`), guarded so they only appear when the jump config was generated.
 - Because this touches `Dockerfile.base` inputs (`rootfs/`, `entrypoint-user.sh`), the base image rebuilds and `base-latest` advances.
 ### Added: pi-fork (`fork`) + pi-observational-memory (`recall`) in pi variants
 The `with-pi` and `omos-with-pi` variants now bake in two pi extensions from `github.com/elpapi42`:
 - `Dockerfile.variant` clones both repos to `/opt/pi-fork` and `/opt/pi-observational-memory` and runs `npm install` there at **build** time (a local-path `pi install` does not npm-install, so deps must be present for the extension to load).
 - `entrypoint-user.sh` registers them at runtime via `pi install /opt/<pkg>` (instant, in-place, idempotent; `fork`/`recall` tools bind on the next pi start).
 - CI (`resolve-versions`) resolves the `master` HEAD of each repo to a concrete commit SHA and passes it as `PI_FORK_REF` / `PI_OBSMEM_REF` build-args — same registry-buildcache cache-hit guard used for `PI_VERSION` / `OMOS_VERSION`.
 - New build-args: `PI_FORK_REPO`, `PI_FORK_REF`, `PI_OBSMEM_REPO`, `PI_OBSMEM_REF`.
 - Smoke test asserts the `/opt` clones + baked `node_modules` exist and that both packages register in `settings.json`. Size thresholds bumped: `with-pi` 2700→2900 MB, `omos-with-pi` 3700→3900 MB (fork's `@earendil-works` peer deps add ~150 MB).
 ### Added: `pi-only` variant (basis for `pi-devbox`)
 New fifth published variant built with `INSTALL_OPENCODE=false`, `INSTALL_PI=true` — pi + companions (toolkit, extensions, `fork`, `recall`) and all base tooling, but **without** opencode (~145 MB lighter than `with-pi`).
 - Published as `latest-pi-only` / `vX.Y.Z-pi-only` (multi-arch). New CI jobs `smoke-pi-only` and `build-variant-pi-only`; wired into `promote-base-latest` / `update-description` needs.
 - This is the **single source of truth** for the separate [`joakimp/pi-devbox`](https://gitea.jordbo.se/joakimp/pi-devbox) image, which now `FROM`s `latest-pi-only` instead of duplicating the pi-install logic. Lets pi-devbox stay lean and pi-focused while the install logic lives in one place.
 - Smoke size threshold: 2750 MB (`with-pi` minus opencode).
 _Versions unchanged: opencode-ai `1.15.13`, pi `0.78.0` (both still latest at time of writing)._
 ## v1.15.13 — 2026-05-29
 First container build on `opencode-ai@1.15.13` upstream release (published 2026-05-29). Also picks up pi `0.77.0` → `0.78.0` (resolved from npm at build time).
 ### Bumped: opencode-ai 1.15.12 → 1.15.13
 **Core**
 - Gateway Anthropic Opus 4.7+ adaptive reasoning now keeps summarized thinking instead of returning empty thinking blocks (bugfix).
 - Sessions can now store custom metadata through the API and SDK ([@shantur](https://github.com/shantur)).
 - Config now loads from the opened location upward, so directory-specific settings and provider policies apply more predictably.
 **TUI**
 - Wrapped inline tool rows now stay aligned, and failed inline tools can expand their error details in place (bugfix).
 ### Bumped: pi 0.77.0 → 0.78.0 (resolved from npm at build time)
 See [pi-devbox v0.78.0](https://github.com/joakimp/pi-devbox/releases/tag/v0.78.0) for full pi release notes.
 ## v1.15.12 — 2026-05-29
@@ -2,19 +2,25 @@
 Portable AI developer environment for [opencode](https://opencode.ai). Debian-based, with git, SSH, Node.js, AWS CLI v2, and common dev tools pre-installed.
 > **Current `:latest` ships opencode `{{OPENCODE_VERSION}}`** (the baked version is asserted by smoke tests, so this page never drifts from the image).
 Designed for teams who want a reproducible coding-agent setup that runs the same on every laptop and CI runner — without forcing each developer to install Bun, Node, AWS CLI, mempalace, or maintain shell config drift across machines.
 ## Image Variants
 | Tag | Description |
 |---|---|
-| `latest` / `vX.Y.Z` | Base image — opencode, Node.js, AWS CLI, dev tools |
+| `latest` / `vX.Y.Z` | Base image — opencode `{{OPENCODE_VERSION}}`, Node.js, AWS CLI, dev tools |
 | `latest-omos` / `vX.Y.Z-omos` | Base + [oh-my-opencode-slim](https://github.com/alvinunreal/oh-my-opencode-slim) multi-agent orchestration and Bun |
 | `latest-with-pi` / `vX.Y.Z-with-pi` | Base + [pi](https://github.com/earendil-works/pi) as alternative/complementary harness (shares the mempalace install with opencode) |
 | `latest-omos-with-pi` / `vX.Y.Z-omos-with-pi` | OMOS + pi together |
 All variants support `linux/amd64` and `linux/arm64`.
 > **Looking for pi?** As of v2.0.0 the pi coding-agent is no longer bundled in
 > opencode-devbox. It ships as the dedicated
 > [`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox) image, which
 > shares the same mempalace memory layer. See
 > <https://gitea.jordbo.se/joakimp/pi-devbox>.
 ## Quick Start
 For a fully-configured environment with persistent state (opencode config, mempalace memory, neovim plugins, bash history) surviving container recreation, use docker-compose. **You don't need to clone the repo** — just grab two template files:
@@ -28,7 +34,7 @@ curl -fsSL https://gitea.jordbo.se/joakimp/opencode-devbox/raw/branch/main/.env.
 docker compose run --rm devbox
 ```
-This drops you straight into opencode with your project mounted at `/workspace`. Use `bash` as the command (e.g. `docker compose run --rm devbox bash`) to land in a shell first — useful for `aws sso login`, `pi` (on `*-with-pi` variants), or multi-harness workflows.
+This drops you straight into opencode with your project mounted at `/workspace`. Use `bash` as the command (e.g. `docker compose run --rm devbox bash`) to land in a shell first — useful for `aws sso login` or multi-agent workflows.
 **One-shot run, no persistence:**
@@ -48,11 +54,10 @@ Full setup guide — authentication for each provider (Anthropic, OpenAI, Bedroc
 ## What's Inside
 - **[opencode](https://opencode.ai)** — primary coding-agent harness. Multi-provider (Anthropic, OpenAI, Bedrock, Google, Groq, etc.).
- **[pi](https://github.com/earendil-works/pi)** *(in `*-with-pi` variants)* — lightweight TUI coding-agent that coexists with opencode and shares the same mempalace install. Includes the `mcp-loader` extension so any local-stdio or remote streamable-HTTP MCP server (searxng, gitea, context7, …) can be added by editing `~/.pi/agent/settings.json`.
+- **[mempalace](https://github.com/MemPalace/mempalace)** — persistent AI memory layer (ChromaDB + SQLite). Wing/diary/knowledge-graph entries are shareable with the sibling [`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox) image when both point at the same palace.
 - **[mempalace](https://github.com/MemPalace/mempalace)** — persistent AI memory layer (ChromaDB + SQLite). Wing/diary/knowledge-graph entries are mutually visible to opencode and pi.
 - **[oh-my-opencode-slim](https://github.com/alvinunreal/oh-my-opencode-slim)** *(in `*-omos` variants)* — multi-agent orchestration on top of opencode (council, fallback chains, named agents).
 - **AWS CLI v2** with SSO support, **Node.js LTS**, **Bun** (OMOS variants), **uv** (Python), **gosu** for clean UID/GID adjustment to match your host workspace.
- **MCP wrappers** for mempalace pre-installed and pre-wired to both harnesses.
+- **MCP wrappers** for mempalace pre-installed and pre-wired to opencode.
 ## Authentication
@@ -70,8 +75,7 @@ https://gitea.jordbo.se/joakimp/opencode-devbox#aws-bedrock-authentication
 | Volume | Mount | Survives |
 |---|---|---|
-| `devbox-opencode-config` | `~/.config/opencode` | container recreate, image rebuild |
+| `devbox-opencode-config` | `~/.config/opencode` | container recreate, image rebuild — incl. user-installed npm globals via `npm install -g` (`NPM_CONFIG_PREFIX` points into the volume) |
 | `devbox-pi-config` | `~/.pi` | container recreate, image rebuild — incl. user-installed pi packages via `pi install` (`NPM_CONFIG_PREFIX` points into the volume) |
 | `devbox-palace` (uncomment) | `~/.mempalace` | container recreate, image rebuild — palace data is precious, treat as primary storage |
 | `devbox-chroma-cache` | `~/.cache/chroma` | container recreate (model cache, disposable — re-downloads in seconds) |
@@ -88,7 +92,7 @@ Full persistence reference, including multi-user (`SIGNUM`) isolation and host b
 ## Sibling images
- **[`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox)** — pi-only image built on top of this image's base layer. Smaller (~700 MB) and version-tracks the [pi npm package](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) directly. Use this if you want pi without opencode. Source: <https://gitea.jordbo.se/joakimp/pi-devbox>
+- **[`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox)** — the pi coding-agent in its own self-contained image, built on a shared Debian base. Version-tracks the [pi npm package](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) directly and can share this image's mempalace palace. Use it if you want pi instead of (or alongside) opencode. Source: <https://gitea.jordbo.se/joakimp/pi-devbox>
 ## License
@@ -96,4 +100,4 @@ MIT. See <https://gitea.jordbo.se/joakimp/opencode-devbox/src/branch/main/LICENS
 ---
-> This description is generated by `scripts/generate-dockerhub-md.py` from a hand-maintained template. Edit the template (not this file) and regenerate.
+> This description is generated by `scripts/generate-dockerhub-md.py` from a hand-maintained template. Edit the template (not this file) and regenerate. The `{{OPENCODE_VERSION}}` placeholder is filled by CI at publish time.
@@ -1,15 +1,14 @@
 # opencode-devbox — base image (variant-independent layers)
 #
 # This Dockerfile produces an image tagged base-<hash>, used as the parent
-# for all four published variants (base, omos, with-pi, omos-with-pi).
+# for all published variants (base, omos). It contains everything that
-# It contains everything that does not depend on variant-specific
+# does not depend on variant-specific build-args (INSTALL_OPENCODE,
-# build-args (INSTALL_OPENCODE, INSTALL_OMOS, INSTALL_PI). The variant
+# INSTALL_OMOS). The variant Dockerfile (Dockerfile.variant) FROMs the
-# Dockerfile (Dockerfile.variant) FROMs the base and adds only those
+# base and adds only those deltas.
 # deltas.
 #
 # The base is rebuilt only when this file or anything it COPYs in
 # changes (rootfs/, entrypoint*.sh). Version bumps to OPENCODE_VERSION,
-# OMOS_VERSION, PI_VERSION, etc. do NOT trigger a base rebuild.
+# OMOS_VERSION, etc. do NOT trigger a base rebuild.
 #
 # To force a base rebuild for fresh apt packages without other code
 # changes, bump the BASE_REBUILD_DATE comment below. The hash is
@@ -259,14 +258,50 @@ RUN ARCH=$(case "${TARGETARCH}" in amd64) echo "x86_64" ;; arm64) echo "aarch64"
 # Always installed in the base (variant-independent). Set
 # INSTALL_MEMPALACE=false at base-build time to shave ~300 MB.
 ARG INSTALL_MEMPALACE=true
 # Pin mempalace explicitly (mirrors pi-devbox). An unpinned
 # `uv tool install mempalace` is what silently swept in the broken
 # diary_write top-level-anyOf schema (3.3.x/3.4.0) that breaks the
 # Anthropic tools API; pinning makes every bump a deliberate, reviewable
 # diff. Bump this in lockstep with pi-devbox's MEMPALACE_VERSION.
 ARG MEMPALACE_VERSION=3.4.0
 ENV UV_TOOL_DIR=/opt/uv-tools
 ENV UV_TOOL_BIN_DIR=/usr/local/bin
 RUN if [ "${INSTALL_MEMPALACE}" = "true" ]; then \
      mkdir -p /opt/uv-tools && \
-      uv tool install --no-cache mempalace && \
+      uv tool install --no-cache "mempalace==${MEMPALACE_VERSION}" && \
      /opt/uv-tools/mempalace/bin/python -c "import mempalace; print('mempalace', mempalace.__version__ if hasattr(mempalace, '__version__') else 'installed')" ; \
    fi
 # ── workaround: strip top-level anyOf from mempalace_diary_write schema ──
 # Mempalace 3.3.x/3.4.0 advertise diary_write's input_schema with a
 # top-level `anyOf: [{required:[entry]}, {required:[content]}]` to express
 # "either entry or content must be supplied". Anthropic's tools API rejects
 # top-level anyOf/oneOf/allOf, so pi/Claude fail at session start with
 # `tools.<n>.custom.input_schema: input_schema does not support oneOf,
 # allOf, or anyOf at the top level`.
 #
 # Patch the advertised schema to require ["agent_name", "entry"] and remove
 # the anyOf block. The handler keeps accepting `content` server-side as a
 # kwarg alias so existing callers still work.
 #
 # Idempotent and self-deactivating: once upstream releases the fix the
 # regex no longer matches and this RUN is a silent no-op.
 # Upstream tracking:
 #   https://github.com/MemPalace/mempalace/issues/1728
 #   https://github.com/MemPalace/mempalace/pull/1735
 # TODO: remove this RUN once a mempalace release containing PR #1735 is on
 # PyPI and installed by the line above.
 RUN if [ "${INSTALL_MEMPALACE}" = "true" ]; then \
      MP_FILE="$(find /opt/uv-tools/mempalace -path '*/mempalace/mcp_server.py' | head -n1)" && \
      if [ -z "$MP_FILE" ]; then echo "mempalace mcp_server.py not found" >&2; exit 1; fi && \
      perl -0777 -i -pe 's/(?:[ \t]*\#[^\n]*\n)*[ \t]*"required":\s*\[\s*"agent_name"\s*\]\s*,\s*\n[ \t]*"anyOf":\s*\[\s*\n[ \t]*\{\s*"required":\s*\[\s*"entry"\s*\]\s*\}\s*,\s*\n[ \t]*\{\s*"required":\s*\[\s*"content"\s*\]\s*\}\s*,?\s*\n[ \t]*\]\s*,\s*\n/            "required": ["agent_name", "entry"],\n/s' "$MP_FILE" && \
      if grep -q '"required": \["agent_name", "entry"\]' "$MP_FILE"; then \
        echo "mempalace diary_write anyOf workaround: applied (or already clean)"; \
      else \
        echo "WARN: mempalace diary_write anyOf workaround did not match expected schema — upstream may have changed shape" >&2; \
      fi ; \
    fi
 # ── mempalace-toolkit — bash wrappers for session/docs mining ────────
 ARG INSTALL_MEMPALACE_TOOLKIT=true
 ARG MEMPALACE_TOOLKIT_REF=main
@@ -339,7 +374,7 @@ RUN groupadd --gid ${USER_GID} ${USER_NAME} && \
 # Create standard directories
 RUN mkdir -p /workspace \
    /home/${USER_NAME}/.config/opencode/skills \
-    /home/${USER_NAME}/.pi/agent/extensions \
+    /home/${USER_NAME}/.config/opencode/npm-global \
    /home/${USER_NAME}/.agents/skills \
    /home/${USER_NAME}/.local/share/opencode \
    /home/${USER_NAME}/.cache/bash \
@@ -359,20 +394,28 @@ print('chromadb embedding model warmed: all-MiniLM-L6-v2')" && \
      ls -lh /home/${USER_NAME}/.cache/chroma/onnx_models/all-MiniLM-L6-v2/ ; \
    fi
-# ── User-writable npm global prefix on the devbox-pi-config volume ──
+# ── User-writable npm global prefix on the devbox-opencode-config volume ──
 # By default npm's global prefix is /usr (writable only by root) so any
-# `pi install npm:<pkg>` or `npm install -g <pkg>` invoked by the
+# `npm install -g <pkg>` invoked by the developer user would EACCES.
-# developer user would EACCES. Pointing the prefix into ~/.pi places
+# Pointing the prefix into ~/.config/opencode places user-installed
-# user-installed packages on the named volume, which means they survive
+# packages on the devbox-opencode-config named volume, which means they
-# container recreation AND image rebuilds.
+# survive container recreation AND image rebuilds.
 #
 # NOTE (v2.0.0): this prefix previously lived at ~/.pi/npm-global — a
 # pi-specific path. With pi removed (see docs/CLEANUP-v2.0.0.md) it now
 # lives under ~/.config/opencode, which is a persistent named volume in
 # BOTH docker-compose.yml and docker-compose.shared.yml (the old ~/.pi
 # volume was only in the former). A one-time migration shim in
 # entrypoint-user.sh copies any existing ~/.pi/npm-global contents to the
 # new prefix on first start so user-installed globals are not lost.
 #
 # IMPORTANT: in this split-build layout the variant Dockerfile inherits
 # this prefix at build time. To keep the baked binaries on /usr (so the
-# ~/.pi volume mount doesn't shadow them), the variant Dockerfile MUST
+# volume mount doesn't shadow them), the variant Dockerfile MUST run each
-# run each `npm install -g` with NPM_CONFIG_PREFIX=/usr in the per-RUN
+# `npm install -g` with NPM_CONFIG_PREFIX=/usr in the per-RUN
 # environment. See Dockerfile.variant.
-ENV NPM_CONFIG_PREFIX=/home/${USER_NAME}/.pi/npm-global
+ENV NPM_CONFIG_PREFIX=/home/${USER_NAME}/.config/opencode/npm-global
-ENV PATH="/home/${USER_NAME}/.pi/npm-global/bin:${PATH}"
+ENV PATH="/home/${USER_NAME}/.config/opencode/npm-global/bin:${PATH}"
 # ── Shell defaults (bash history, aliases, readline) ─────────────────
 RUN mkdir -p /etc/skel-devbox
@@ -3,26 +3,29 @@
 # FROMs a base-<hash> image produced by Dockerfile.base and adds only
 # the variant-specific tools (opencode, pi, oh-my-opencode-slim, Go).
 #
-# The four published variants are produced from THIS Dockerfile by
+# The two published variants are produced from THIS Dockerfile by
 # varying build args:
 #
-#   variant            INSTALL_OPENCODE  INSTALL_OMOS  INSTALL_PI
+#   variant   INSTALL_OPENCODE  INSTALL_OMOS
-#   ─────────────────  ────────────────  ────────────  ──────────
+#   ────────  ────────────────  ────────────
-#   base               true              false         false
+#   base      true              false
-#   omos               true              true          false
+#   omos      true              true
-#   with-pi            true              false         true
+#
-#   omos-with-pi       true              true          true
+# pi was removed in v2.0.0 (it had been deprecated since v1.17.2). It now
 # ships from its own self-contained image: joakimp/pi-devbox:latest
 # (https://gitea.jordbo.se/joakimp/pi-devbox). See docs/CLEANUP-v2.0.0.md
 # for the removal history.
 #
 # Pass `--build-arg BASE_IMAGE=<repo>:base-<hash>` to select the base.
 # The CI workflow computes the base hash from Dockerfile.base + rootfs/
 # + entrypoint*.sh and feeds it in.
 #
 # IMPORTANT: the base image sets NPM_CONFIG_PREFIX to
-# /home/developer/.pi/npm-global so runtime `pi install npm:...` and
+# /home/developer/.config/opencode/npm-global so runtime `npm install -g`
-# `npm install -g` by the developer user lands on the named volume.
+# by the developer user lands on the named volume. At BUILD time we want
-# At BUILD time we want the baked binaries on /usr so they survive the
+# the baked binaries on /usr so they survive the volume mount. Each
-# volume mount. Each `npm install -g` below therefore prefixes the
+# `npm install -g` below therefore prefixes the command with
-# command with `NPM_CONFIG_PREFIX=/usr`.
+# `NPM_CONFIG_PREFIX=/usr`.
 ARG BASE_IMAGE
 FROM ${BASE_IMAGE}
@@ -36,56 +39,12 @@ ARG USER_NAME=developer
 # edit, so the cache-hit class of bug that bit pi-devbox v0.74.0..
 # v0.75.5 cannot apply here.
 ARG INSTALL_OPENCODE=true
-ARG OPENCODE_VERSION=1.15.12
+ARG OPENCODE_VERSION=1.17.4
 RUN if [ "${INSTALL_OPENCODE}" = "true" ]; then \
      NPM_CONFIG_PREFIX=/usr npm install -g opencode-ai@${OPENCODE_VERSION} && \
      opencode --version ; \
    fi
 # ── Optional: pi coding-agent ────────────────────────────────────────
 # pi-toolkit and pi-extensions are cloned into /opt/. entrypoint-user.sh
 # runs each repo's install.sh on container start so symlinks land under
 # ~/.pi/agent/ on the named volume.
 # PI_VERSION should be passed explicitly by CI as a concrete version
 # (resolved from `npm view @earendil-works/pi-coding-agent version`,
 # see .gitea/workflows/docker-publish-split.yml § resolve-versions).
 # The default `latest` is for local dev convenience only — it has a
 # known cache-hit footgun when used in registry-cached CI builds: the
 # resulting build-arg string is byte-identical across builds, the
 # layer-hash is identical, and the registry buildcache silently reuses
 # the layer from whatever pi version was current when the cache was
 # first populated. Currently masked here because OPENCODE_VERSION (a
 # parent layer) bumps every release; will manifest the moment a
 # vN.N.Nb opencode-version-unchanged release ships. See pi-devbox
 # v0.75.5b 2026-05-23 for the discovery + canonical fix.
 ARG INSTALL_PI=false
 ARG PI_VERSION=latest
 ARG PI_TOOLKIT_REF=main
 ARG PI_EXTENSIONS_REF=main
 RUN if [ "${INSTALL_PI}" = "true" ]; then \
      set -e && \
      git_clone_retry() { \
        url="$1"; ref="$2"; dest="$3"; \
        for i in 1 2 3 4 5; do \
          if git clone --depth 1 --branch "$ref" "$url" "$dest"; then return 0; fi; \
          rm -rf "$dest"; \
          echo "git clone $url failed (attempt $i/5), retrying in $((i*5))s..."; \
          sleep $((i*5)); \
        done; \
        return 1; \
      } && \
      if [ "${PI_VERSION}" = "latest" ]; then \
        NPM_CONFIG_PREFIX=/usr npm install -g @earendil-works/pi-coding-agent ; \
      else \
        NPM_CONFIG_PREFIX=/usr npm install -g @earendil-works/pi-coding-agent@${PI_VERSION} ; \
      fi && \
      pi --version && \
      git_clone_retry https://gitea.jordbo.se/joakimp/pi-toolkit.git "${PI_TOOLKIT_REF}" /opt/pi-toolkit && \
      git_clone_retry https://gitea.jordbo.se/joakimp/pi-extensions.git "${PI_EXTENSIONS_REF}" /opt/pi-extensions && \
      echo "pi-toolkit at $(cd /opt/pi-toolkit && git rev-parse --short HEAD)" && \
      echo "pi-extensions at $(cd /opt/pi-extensions && git rev-parse --short HEAD)" ; \
    fi
 # ── Optional: Go ─────────────────────────────────────────────────────
 ARG INSTALL_GO=false
 ARG GO_VERSION=latest
@@ -105,10 +64,13 @@ RUN if [ "${INSTALL_GO}" = "true" ]; then \
 # ── Optional: oh-my-opencode-slim (multi-agent orchestration) ────────
 # Installs Bun runtime and the oh-my-opencode-slim npm package.
-# OMOS_VERSION shares the same cache-hit footgun as PI_VERSION when
+# OMOS_VERSION has a cache-hit footgun when left at the `latest` default
-# left at the `latest` default in registry-cached CI builds. CI
+# in registry-cached CI builds: the resulting build-arg string is byte-
-# resolves it via `npm view oh-my-opencode-slim version` and passes
+# identical across builds, so the layer-hash is identical, so the
-# the concrete value as a build-arg. See PI_VERSION block above.
+# registry buildcache silently reuses the layer from whatever omos
 # version was current when the cache was first populated. CI resolves it
 # via `npm view oh-my-opencode-slim version` and passes the concrete
 # value as a build-arg (see resolve-versions in docker-publish-split.yml).
 ARG INSTALL_OMOS=false
 ARG OMOS_VERSION=latest
 RUN if [ "${INSTALL_OMOS}" = "true" ]; then \
@@ -2,6 +2,8 @@
 Portable AI developer environment in a Docker container. Run [opencode](https://opencode.ai) on any Docker-capable machine with configurable LLM providers, dev tools, and host filesystem access.
 > **Looking for pi?** As of **v2.0.0** the [pi](https://github.com/earendil-works/pi) coding-agent is no longer bundled here. It now ships as its own self-contained image, **[`joakimp/pi-devbox`](https://gitea.jordbo.se/joakimp/pi-devbox)** (also on [Docker Hub](https://hub.docker.com/r/joakimp/pi-devbox)), built on a shared Debian base and able to share this image's mempalace palace. Pull `joakimp/pi-devbox:latest` instead of the old `*-with-pi` / `pi-only` tags. See the [v2.0.0 CHANGELOG](CHANGELOG.md) for the migration details (including the `~/.pi/npm-global` → `~/.config/opencode/npm-global` prefix move).
 ## Why?
 The official `ghcr.io/anomalyco/opencode` image (now archived) was Alpine-based and minimal — no git, no dev tools, broken PTY support due to musl/glibc incompatibility. This project provides a **Debian-based, production-ready** alternative using the current v1.x release.
@@ -25,7 +27,7 @@ $EDITOR .env
 docker compose run --rm devbox
 ```
-This pulls `joakimp/opencode-devbox:latest` from Docker Hub, mounts `WORKSPACE_PATH` at `/workspace`, and drops you straight into opencode. Use `bash` instead of (no command) to land in a shell first — useful for `aws sso login`, `pi`, `omos`, etc.
+This pulls `joakimp/opencode-devbox:latest` from Docker Hub, mounts `WORKSPACE_PATH` at `/workspace`, and drops you straight into opencode. Use `bash` instead of (no command) to land in a shell first — useful for `aws sso login`, `omos`, etc.
 **Want to hack on the image itself, follow upstream changes, or rebuild from source?** Clone the repo:
@@ -132,6 +134,10 @@ docker compose exec -u developer devbox aws --version
 | `GIT_USER_EMAIL` | Git commit author email | — |
 | `WORKSPACE_PATH` | Host path to mount | `.` |
 | `SSH_KEY_PATH` | Host SSH key directory | `~/.ssh` |
 | `DEVBOX_LAN_ACCESS` | LAN-access mode: `auto` (jump only on VM-backed hosts), `jump` (always), `off` | `auto` |
 | `HOST_SSH_USER` | Username to SSH into the host as (required for the LAN jump) | — |
 | `DEVBOX_HOST_ALIAS` | Hostname used to reach the container host | `host.docker.internal` |
 | `DEVBOX_LAN_AUTOJUMP_PRIVATE` | `1` = ProxyJump *any* RFC1918 (private) IP through the host, so bare `dssh user@<ip>` works on whatever LAN the host is currently on | `0` |
 | `USER_UID` | Override container user UID | Auto-detect from `/workspace` |
 | `USER_GID` | Override container user GID | Auto-detect from `/workspace` |
 | `LANG` | System locale | `en_US.UTF-8` |
@@ -144,6 +150,61 @@ docker compose exec -u developer devbox aws --version
 | `OMOS_RESET` | Force regenerate OMOS config on next start | `false` |
 | `SKILLSET_CONTAINER_PATH` | Path to skillset repo inside container (for auto-deploy when not at /workspace/skillset) | Auto-detect |
 ### Reaching your LAN from the container
 The devbox works the same way whether the host is **native Linux Docker** or a **VM-backed** runtime (macOS OrbStack / Docker Desktop, or Docker Desktop on Windows) — but their networking differs:
 - **Native Linux Docker:** the host NATs container egress onto its LAN, so other devices on your LAN are reachable directly. Nothing to configure.
 - **VM-backed (macOS / Docker Desktop):** the container runs in a Linux VM behind the host's network stack. The host's *directly-attached* LAN peers are **not** bridged into the container by default — only the host itself and *routed* subnets are reachable.
 On every start the entrypoint detects which case applies. On VM-backed hosts it generates a writable `~/.ssh-local/config` that uses the **host as an SSH jump** to reach LAN peers; on native Linux it does nothing. The jump keypair lives in `~/.ssh-local`, which is persisted by the `devbox-ssh-local` named volume — so it's generated **once** and reused across container updates.
 **To enable it on a VM-backed host (one-time setup per machine):**
 1. Set `HOST_SSH_USER=<your host username>` in `.env`.
 2. Start the container once. When it generates the jump key it prints a ready-to-paste line — run it **on the host** to authorize the key:
   ```bash
   echo 'ssh-ed25519 AAAA…devbox-jump@…' >> ~/.ssh/authorized_keys
   ```
 3. Ensure the host's SSH server is on (on macOS: System Settings → General → Sharing → Remote Login).
 4. Reach the host itself with `dssh host`. (`dssh`/`dscp` wrap `ssh -F ~/.ssh-local/config`.)
 Because the key is persisted, you do this **once per machine** — not after every `docker compose up --force-recreate`. You'll only see the authorize line again if you reset the `devbox-ssh-local` volume.
 That alone gets you `container → host`. To reach **named LAN peers** by name, give them a `ProxyJump host` override. Don't add it to the shared `~/.ssh/config` entries — the host itself reaches those peers *directly*, and a jump-through-`host` would break the host's own access (and that file is mounted read-only anyway). Instead, drop the overrides in a **host-owned** file that the container Includes ahead of your `~/.ssh/config`:
 ```sshconfig
 # ~/.config/devbox-shell/ssh-lan.conf  — on the host, bind-mounted in
 # Only ProxyJump goes here; HostName/User/IdentityFile are inherited
 # (first-value-wins) from the matching block in your ~/.ssh/config.
 Host my-nas pve pbs
    ProxyJump host
 ```
 Now `dssh my-nas` routes container → host → LAN peer, pulling HostName/User/key from your existing `~/.ssh/config`. See [`ssh-lan.conf.example`](ssh-lan.conf.example).
 **Roaming / unnamed peers.** Because the jump always targets `host` (= the host on whatever LAN it's currently joined to), you can reach the *current* LAN from anywhere. To make bare `dssh user@<private-ip>` jump automatically without naming peers, set `DEVBOX_LAN_AUTOJUMP_PRIVATE=1` — it ProxyJumps any RFC1918 address through the host. It matches the address you *type* (not the resolved HostName), so named hosts that already carry their own ProxyJump are unaffected.
 **Public IPs go direct.** The container has normal internet egress, so a host with a public IP (or one reached via a *public* jump host) connects straight out — the local `host` jump is not involved. e.g. a `Host bastion` whose `HostName` is public, and everything that `ProxyJump bastion`, works from the container by name with no extra setup.
 > This ships the **mechanism** only — your specific target hosts are facts about *your* network (and a laptop roams between several), so they live in your own host-side config, never baked into the image. Set `DEVBOX_LAN_ACCESS=off` to disable, or `=jump` to force it (e.g. native Linux with `extra_hosts: ["host.docker.internal:host-gateway"]`).
 #### Gotcha: per-host `ControlPath` and read-only `~/.ssh`
 The base image bakes a `Host *` default (`/etc/ssh/ssh_config.d/00-devbox-controlmaster.conf`) that points `ControlPath` at the writable, per-container `/tmp/sshcm/` (created mode-700 on every start by `entrypoint-user.sh`). Multiplexing therefore works out of the box. **But your bind-mounted `~/.ssh/config` is read first, and SSH uses the first value it sees** — so any per-host block that sets its own `ControlPath` under `~/.ssh/` (a common CGNAT-multiplexing pattern, e.g. `ControlPath ~/.ssh/cm/%r@%h:%p`) **wins, and then fails inside the container** because `~/.ssh` is mounted **read-only** — the master socket can't bind (`cannot bind … Read-only file system`).
 This bites any in-container tool that opens an SSH connection to a remote host (git over SSH, `rsync`, remote-execution agents): the master fails to establish and the connection either errors or silently degrades.
 **Fix (host-side, one line):** in your host's `~/.ssh/config`, either drop the per-host `ControlPath` (to inherit the writable baked default) or point it at a path that's writable inside the container too:
 ```sshconfig
 Host my-remote
    # was: ControlPath ~/.ssh/cm/%r@%h:%p   ← read-only in the container
    ControlPath /tmp/sshcm/%r@%h:%p          # writable on both host and container
 ```
 `/tmp/sshcm/` is also writable on the host (macOS/Linux), so native (non-container) `ssh` from the host keeps working and CGNAT multiplexing is preserved (`ControlMaster`/`ControlPersist` unchanged — only the socket *directory* moves). Note SSH does not create the `ControlPath` parent dir; the container makes `/tmp/sshcm` every start, but on the host run `mkdir -p /tmp/sshcm` once if it doesn't already exist.
 ### Custom opencode config
 Opencode configuration is persisted automatically via the named volume `devbox-opencode-config`. This volume is mounted at `/home/developer/.config/opencode` by default — no host directory setup required. All changes to `opencode.jsonc`, skills, and (on the OMOS variant) `oh-my-opencode-slim.json` survive container recreation.
@@ -361,10 +422,7 @@ docker compose build --build-arg NVIM_VERSION=0.12.1   # pin to a specific versi
 | `INSTALL_MEMPALACE` | `true` | [MemPalace](https://github.com/MemPalace/mempalace) local AI memory system (~300 MB — disable to shrink image if you don't need MCP memory) |
 | `INSTALL_MEMPALACE_TOOLKIT` | `true` | [mempalace-toolkit](https://gitea.jordbo.se/joakimp/mempalace-toolkit) bash wrappers (`mempalace-session`, `mempalace-docs`). Cloned at build time from `MEMPALACE_TOOLKIT_REF` (default `main`). Requires `INSTALL_MEMPALACE=true`. |
 | `INSTALL_OMOS` | `false` | [oh-my-opencode-slim](https://github.com/alvinunreal/oh-my-opencode-slim) multi-agent orchestration (installs Bun and plugin) |
-| `INSTALL_OPENCODE` | `true` | Install opencode. Set `false` to build a pi-only image (still includes Bun if `INSTALL_OMOS=true`; for a fully stripped pi-only image see the `pi-devbox` repo). |
+| `INSTALL_OPENCODE` | `true` | Install opencode. Set `false` to build a base with no harness (still includes Bun if `INSTALL_OMOS=true`). |
 | `INSTALL_PI` | `false` | Install [pi](https://github.com/earendil-works/pi) as alternative/complementary harness. Both clones [pi-toolkit](https://gitea.jordbo.se/joakimp/pi-toolkit) (~5 MB) and [pi-extensions](https://gitea.jordbo.se/joakimp/pi-extensions) (~1 MB) into `/opt/`; entrypoint deploys them on container start. ~150 MB total image growth. |
 | `PI_VERSION` | `latest` | npm version of `@earendil-works/pi-coding-agent`. Floats by default (image rebuild = pi update). |
 | `PI_TOOLKIT_REF`, `PI_EXTENSIONS_REF` | `main` | Git refs for the toolkit/extensions clones. Pin to a tag/commit for reproducibility. |
 | `OPENCODE_VERSION` | *(pinned per release)* | opencode npm version. Drives the image tag and is intentionally not floated. |
 | `NODE_VERSION` | `22` | Node.js major version. Pinned to protect against upstream breaking changes across majors. |
 | `GOSU_VERSION`, `FZF_VERSION`, `GIT_LFS_VERSION`, `NVIM_VERSION`, `BAT_VERSION`, `EZA_VERSION`, `ZOXIDE_VERSION`, `UV_VERSION`, `GITEA_MCP_VERSION`, `GO_VERSION`, `OMOS_VERSION` | `latest` | All GitHub/Gitea/go.dev-hosted binaries resolve to the newest upstream release at build time. Override with a specific version to pin. Resolved versions are logged in CI output. |
@@ -426,79 +484,6 @@ ping all agents
 All six agents should respond if your provider authentication is working.
 ## pi (alternative/complementary harness)
 [pi](https://github.com/earendil-works/pi) is a lightweight TUI coding-agent that can run alongside opencode in the same container. Both harnesses share the mempalace install and palace data — wing/diary entries created by one are visible to the other.
 ### Setup
 Pre-built pi-enabled images are available on Docker Hub as `joakimp/opencode-devbox:latest-with-pi` (base + pi) and `joakimp/opencode-devbox:latest-omos-with-pi` (OMOS + pi). Pulling one of those tags is the fastest path. Alternatively, build from source:
 ### Build
 ```bash
 docker compose build --build-arg INSTALL_PI=true
 # Or: pin a pi version
 docker compose build --build-arg INSTALL_PI=true --build-arg PI_VERSION=0.73.0
 # Or: pi-only image (no opencode, smaller)
 docker compose build --build-arg INSTALL_PI=true --build-arg INSTALL_OPENCODE=false
 ```
 ### Run
 The default `compose run --rm devbox` invocation drops to a login bash so you can choose:
 ```bash
 docker compose run --rm devbox       # bash, then `pi` or `opencode` or `aws sso login`
 docker compose run --rm devbox pi     # launch pi directly
 docker compose run --rm devbox opencode
 ```
 For an attached `compose up -d` container, both harnesses are reachable via `compose exec`:
 ```bash
 docker compose exec -u developer devbox pi
 docker compose exec -u developer devbox opencode
 docker compose exec -u developer devbox bash
 ```
 ### What gets installed
 - **`pi` CLI** — npm-installed globally at build time. Version pinned by `PI_VERSION`.
 - **pi-toolkit** — keybindings.json (mosh/tmux newline fixes), pi-env.zsh (AWS env loader), settings.json template. Cloned to `/opt/pi-toolkit`; deployed to `~/.pi/agent/` on first container start.
 - **pi-extensions** — 7 extensions, cloned to `/opt/pi-extensions` and symlinked into `~/.pi/agent/extensions/`:
  - `confirm-destructive` — confirm-prompt before dangerous bash commands and session actions.
  - `ext-toggle` — `/ext` slash command to list and enable/disable extensions at runtime (rename-to-disable; survives `/reload`).
  - `git-checkpoint` — per-turn `git stash` checkpoint, restorable on `/fork`.
  - `mcp-loader` — generic MCP server loader. Reads an `mcp` block from `~/.pi/agent/settings.json` (same shape as opencode and Claude Desktop) and connects to each declared server, exposing the tools as native pi tools. Supports both **local stdio** subprocesses (`uvx mcp-searxng`, `gitea-mcp`, …) and **remote streamable-HTTP** servers per MCP spec 2025-03-26 (e.g. `https://mcp.context7.com/mcp`). Adds a `/mcp` slash command for runtime status / toggle (same UX as `/ext`). See [`pi-extensions/AGENTS.md`](https://gitea.jordbo.se/joakimp/pi-extensions/src/branch/main/AGENTS.md) for transport details and the `headers` config for auth tokens.
  - `notify` — native terminal notification when the agent finishes.
  - `ssh-controlmaster` — transparent SSH remote execution via persistent ControlMaster socket (when pi is launched with `--ssh user@host`).
  - `todo` — `todo` tool for the agent + `/todos` for the user.
 - **mempalace bridge** — separate `mempalace.ts` extension symlinked from the cloned `mempalace-toolkit`. Provides pi's MCP tools for palace search/diary/knowledge-graph with bespoke agent-identity injection from `$MEMPALACE_AGENT_NAME`. Coexists with `mcp-loader` rather than replacing it — don't list `mempalace` in settings.json's `mcp` block too, or you'll get duplicate tool registrations.
 - **MCP servers (none baked in beyond mempalace)** — the loader registers nothing by default. Add servers by editing `~/.pi/agent/settings.json` and `/reload`. Examples (mcp-searxng for web search, context7 for live library docs) are in the `pi-extensions` README.
 ### Persistence
 `~/.pi/` is mounted on the `devbox-pi-config` named volume. Everything below survives container recreate **and** image rebuilds:
 - `~/.pi/agent/settings.json` (provider/model, theme selection, the `mcp` block, and the `packages` array tracking installed pi packages).
 - `~/.pi/agent/extensions/` (hand-placed extensions and the symlinks deployed by `pi-extensions/install.sh`).
 - `~/.pi/agent/sessions/`, `~/.pi/agent/auth.json`.
 - `~/.pi/agent/git/<host>/<path>/` (pi packages installed via `pi install git:...`).
 - `~/.pi/npm-global/` (pi packages installed via `pi install npm:...`, plus any `npm install -g` invoked as the `developer` user). `NPM_CONFIG_PREFIX` is pre-set in the image, the prefix's `bin/` is on `PATH`, and the directory itself lives on the volume — so user-installed themes, skills, and extensions survive everything short of `docker compose down -v`.
 The **baked** pi binary (and pi-toolkit / pi-extensions repos under `/opt/`) live on the image filesystem, not the volume. Image rebuild is the upgrade path for those — same contract as `OPENCODE_VERSION`. If you `npm install -g @earendil-works/pi-coding-agent` yourself, the user-installed copy on the volume wins via `PATH` order and survives image rebuilds.
 ### Configuration
 The entrypoint copies `pi-toolkit/settings.example.json` to `~/.pi/agent/settings.json` on first start. Edit it to set provider/model:
 ```bash
 docker compose exec -u developer devbox $EDITOR ~/.pi/agent/settings.json
 ```
 The AWS env loader (`pi-env.zsh`) reads `~/.config/pi/.env` if you bind-mount one; otherwise pi uses container env vars passed via `.env`.
 ## AWS Bedrock Authentication
 When using AWS Bedrock as your LLM provider, you need:
@@ -25,8 +25,6 @@ services:
    #   args:
    #     INSTALL_GO: "false"
    #     INSTALL_OMOS: "false"
    #     INSTALL_PI: "false"
    #     # PI_VERSION: "latest"
    #     # INSTALL_OPENCODE: "true"
    container_name: opencode-devbox
    stdin_open: true
@@ -58,7 +56,18 @@ services:
      # the container's skill/instruction symlinks independent from the host,
      # allowing both native and containerized opencode on the same machine.
      - devbox-opencode-config:/home/developer/.config/opencode
-      - devbox-pi-config:/home/developer/.pi
+      # Legacy pi config volume (pi was removed in v2.0.0). Left commented so
      # fresh installs carry no dead weight. If you are UPGRADING from a
      # pre-v2.0.0 image and had global npm packages installed via
      # `npm install -g` (they lived under ~/.pi/npm-global), uncomment this
      # for ONE container start: entrypoint-user.sh's migration shim copies
      # them to ~/.config/opencode/npm-global, after which you can remove it.
      # - devbox-pi-config:/home/developer/.pi
      # Persist the generated LAN-jump keypair (~/.ssh-local) across recreates.
      # setup-lan-access.sh generates this key once and reuses it; persisting
      # it means you authorize it on the host ONCE rather than re-authorizing
      # after every `docker compose up --force-recreate`.
      - devbox-ssh-local:/home/developer/.ssh-local
      # NOTE: Do NOT bind-mount ~/.agents/skills/ from the host. The
      # container manages its own skills directory independently — the
@@ -95,6 +104,14 @@ services:
      # - ~/.bash_aliases:/home/developer/.bash_aliases:ro
       # - ~/.inputrc:/home/developer/.inputrc:ro
      # Optional: host-owned shell config + LAN jump overrides (recommended
      # over the single-file ~/.bash_aliases mount above — it's a directory,
      # so it survives editors' atomic-save). The image's ~/.bash_aliases
      # sources ~/.config/devbox-shell/bash_aliases if present, and
      # setup-lan-access.sh reads ~/.config/devbox-shell/ssh-lan.conf for
      # named-peer `ProxyJump host` overrides (see ssh-lan.conf.example).
      # - ~/.config/devbox-shell:/home/developer/.config/devbox-shell:ro
      # Optional: persist uv data (Python installs, tool installs)
      # Without this, 'uv python install' must be re-run after container removal.
      - devbox-uv:/home/developer/.local/share/uv
@@ -125,7 +142,8 @@ services:
 volumes:
  devbox-opencode-config:
-  devbox-pi-config:
+  # devbox-pi-config:  # legacy (pi removed v2.0.0) — uncomment with the mount above only to migrate old global npm packages
  devbox-ssh-local:
  devbox-data:
  devbox-state:
  devbox-shell-history:
@@ -0,0 +1,247 @@
 # PR-5: Retire pi from opencode-devbox
 After pi-devbox has shipped v1.0.0 as a fully independent image (with
 its own base + variant Dockerfiles, CI, smoke tests, and docs), the
 pi-related paths in opencode-devbox become dead weight. This PR
 removes them.
 ## Pre-conditions before merging
 This PR should land **only after** all of the following are stable:
 1. `pi-devbox v1.0.0` published, smoke tests passing, in active use
   for at least one release cycle.
 2. Anyone consuming `joakimp/pi-devbox:base-pi-only` directly (e.g.
   forks pinned to it) has been notified and migrated.
 3. The deprecation warning (PR-1 of this work — see below) has been
   live for at least one release cycle so consumers have visible
   notice.
 ## Files / sections to remove from opencode-devbox
 ### `Dockerfile.variant`
 Remove these blocks entirely:
 - The `INSTALL_PI` / `PI_VERSION` / `PI_TOOLKIT_REF` /
  `PI_EXTENSIONS_REF` / `PI_FORK_REPO` / `PI_FORK_REF` /
  `PI_OBSMEM_REPO` / `PI_OBSMEM_REF` build-args.
 - The `RUN if [ "${INSTALL_PI}" = "true" ]; then ...` block (entire
  block — git_clone_retry, git_fetch_ref, npm install
  pi-coding-agent, the four /opt/pi-* clones, the npm installs in
  /opt/pi-fork and /opt/pi-observational-memory, and the four
  rev-parse echoes).
 - All comments referencing pi-only as "the single source of truth for
  the pi-devbox image" (the variant matrix table, the explanatory
  paragraph, and the "rationale" comments at the top of the file
  about pi-only existing for pi-devbox to FROM).
 Update the variant matrix table at the top of `Dockerfile.variant`:
 ```
   variant            INSTALL_OPENCODE  INSTALL_OMOS
   ─────────────────  ────────────────  ────────────
   base               true              false
   omos               true              true
 ```
 (only two variants now; pi-only and the with-pi/omos-with-pi axis are
 gone).
 ### `entrypoint-user.sh`
 Remove:
 - The pi-toolkit and pi-extensions install hooks (the section that
  runs `(cd /opt/pi-toolkit && ./install.sh --yes)` etc.).
 - The `~/.pi/agent/settings.json` seeding from
  `/opt/pi-toolkit/settings.example.json`.
 - Any other pi-conditional blocks (search for `INSTALL_PI`, `pi-toolkit`,
  `pi-extensions`, `~/.pi/`).
 Verify that the AWS Bedrock auth bootstrap (the pi-toolkit AWS env
 loader) is not relied on by opencode users. If it is, lift it out of
 the pi-toolkit dependency (it's small and self-contained).
 ### `Dockerfile.base`
 Remove:
 - The `mkdir -p /home/${USER_NAME}/.pi/agent/extensions` line in the
  standard-directories block. Replace with the equivalent opencode-
  specific paths if any aren't already present (`~/.config/opencode`
  is already there).
 - `NPM_CONFIG_PREFIX=/home/${USER_NAME}/.pi/npm-global` — change to
  `/home/${USER_NAME}/.config/opencode/npm-global` or a more neutral
  path. Update the corresponding `PATH` env var.
 Also update the long base-image header comment to remove the
 "variants for pi-devbox" rationale.
 ### CI (`.gitea/workflows/docker-publish-split.yml` or equivalent)
 Remove:
 - The `pi-only` variant build job.
 - The `with-pi` and `omos-with-pi` variant build jobs (they're
  redundant with the standalone pi-devbox now).
 - The `base-pi-only` tag publish step (which pushes to
  `joakimp/pi-devbox:base-pi-only` from this repo).
 - The `resolve-pi-version` job step (no longer needed).
 - Smoke-test invocations with `--variant pi-only`, `--variant with-pi`,
  `--variant omos-with-pi`.
 Remaining variants in CI: `base`, `omos`. The "with-pi" axis is
 fully retired.
 ### `scripts/smoke-test.sh`
 Remove:
 - The `--variant pi-only`, `--variant with-pi`, `--variant
  omos-with-pi` branches.
 - pi-related assertions: `pi --version`, the
  `~/.pi/agent/extensions/*.ts ≥ 4` check, the mempalace.ts bridge
  gate (mempalace itself stays, but its bridge into pi is no longer
  this image's concern).
 Remaining variant axis in smoke tests: `base`, `omos`.
 ### `README.md` (and `AGENTS.md`, `DOCKER_HUB.md`)
 - Remove the pi-only variant from the "Image variants" table.
 - Remove the with-pi / omos-with-pi variants if they were documented.
 - Remove all sections about pi-toolkit, pi-extensions, pi-fork,
  pi-observational-memory, ~/.pi paths, and pi-related env vars.
 - Remove the "this image also produces base-pi-only for pi-devbox"
  notes.
 - Add a single-paragraph **"Looking for pi?"** section pointing to
  `joakimp/pi-devbox`.
 ### `Dockerfile` references in `pi-devbox` repo (cleanup of cross-repo coupling)
 This isn't a change to opencode-devbox, but it's part of the same
 deprecation:
 - Once pi-devbox v1.0.0 is the single source of truth, remove
  pi-devbox/Dockerfile (the 5-line shim with the long
  `joakimp/pi-devbox:base-pi-only` rationale comment). It's replaced
  by `Dockerfile.base` + `Dockerfile.variant` produced by PR-1 of
  this work.
 ### Purge the orphaned `base-pi-only*` Hub tags (manual, post-merge)
 Until PR-5, the `build-variant-pi-only` job re-publishes
 `joakimp/pi-devbox:base-pi-only` (floating) and a fresh
 `base-pi-only-vX.Y.Z` on **every** opencode-devbox release. These tags
 are orphaned legacy artifacts: pi-devbox v1.0.0+ builds its own
 debian-based `base-<hash>` and **no pi-devbox build input references
 `base-pi-only`** (verified 2026-06-10 — only historical mentions remain
 in pi-devbox's CHANGELOG/AGENTS/DOCKER_HUB). Nothing consumes them.
 Once PR-5 deletes the `build-variant-pi-only` job, the publisher is
 gone — so this is the moment to purge the accumulated tags from the
 **`joakimp/pi-devbox`** Docker Hub repo (NOT opencode-devbox):
 - Delete the floating `base-pi-only` tag.
 - Delete every versioned snapshot: `base-pi-only-v1.17.2`,
  `base-pi-only-v1.16.2`, `base-pi-only-v1.15.13e`, … (all of them).
 Do this **after** PR-5 is merged and the first post-PR-5 release has
 built, to confirm no new `base-pi-only*` tag reappears. If you purge
 before PR-5, the next opencode-devbox release simply recreates the
 floating tag (whack-a-mole). Deletion is via the Hub UI
 (`hub.docker.com/r/joakimp/pi-devbox/tags`) or the Hub API
 (`DELETE /v2/repositories/joakimp/pi-devbox/tags/<tag>/` with a Hub PAT).
 ## Two-step deprecation path (recommended)
 Rather than a single big-bang removal, use a deprecation cycle:
 ### Step 1 — pre-PR (lands at the same time as pi-devbox v1.0.0)
 Add a deprecation warning to opencode-devbox:
 1. **Build-time message** — when `INSTALL_PI=true`,
   `INSTALL_PI_DEPRECATED=warn` is the default; the variant build
   prints to stderr:
   ```
   ===========================================================
   DEPRECATION WARNING: INSTALL_PI is deprecated in opencode-devbox
   and will be removed in v2.0.0. Use joakimp/pi-devbox:latest
   instead. See https://gitea.jordbo.se/joakimp/pi-devbox
   ===========================================================
   ```
 2. **CHANGELOG** entry on opencode-devbox: "INSTALL_PI build-arg path
   deprecated; will be removed in v2.0.0."
 3. **README and DOCKER_HUB** updates: mark `pi-only`, `with-pi`,
   `omos-with-pi` variants as deprecated, point to pi-devbox.
 4. The `base-pi-only` tag continues to be published but with a
   notice in the description: "Internal artifact for pi-devbox.
   Deprecated; pull joakimp/pi-devbox:latest directly."
 ### Step 2 — removal PR (this document)
 Lands one release cycle (or one calendar month, whichever is later)
 after step 1. Removes everything listed in the per-file sections
 above. Tagged as opencode-devbox v2.0.0 (the major bump signals the
 breaking change).
 ## Risk assessment
 ### What could go wrong
 - **Someone is consuming `base-pi-only` directly** without going
  through pi-devbox. The deprecation warning + one-cycle delay should
  surface this.
 - **Mempalace bridge in pi-extensions** — this stays in pi-devbox; no
  impact on opencode-devbox.
 - **Shared base assumptions** — opencode-devbox's
  `~/.pi/npm-global` NPM_CONFIG_PREFIX was a pi-specific design. In
  the cleanup we move it to a neutral path. Existing opencode-devbox
  users get a one-time migration: their `npm install -g` packages
  installed at the old path stop being on PATH. Document this in the
  v2.0.0 changelog and add a one-liner that copies the old prefix
  contents to the new one if the old one exists.
 ### What's safe
 - The base apt set, the Go-binary installs, MemPalace, the SSH
  ControlMaster setup, the entrypoint UID/GID dance — all of these
  stay. They're not pi-specific.
 - The `omos` variant — fully unaffected.
 - Existing opencode-only users — no change to their workflow.
 ## Verification
 After PR-5 lands, the following should be true:
 - `grep -ri "INSTALL_PI\|pi-toolkit\|pi-extensions\|pi-fork\|pi-observational-memory\|base-pi-only" .` in opencode-devbox returns no matches.
 - `docker history joakimp/opencode-devbox:latest` shows no pi-related layers.
 - The opencode-devbox CI matrix builds only `base` and `omos` variants.
 - A post-PR-5 release does NOT recreate any `joakimp/pi-devbox:base-pi-only*` tag (publisher confirmed gone), after which those orphaned tags are purged from the pi-devbox Hub repo.
 - pi-devbox CI is unaffected (it's a different repo).
 - Both repos build cleanly in their own CI without referencing the other.
 ## Estimated effort
 - Step 1 (deprecation warnings): ~2 hours.
 - Step 2 (removal): ~4 hours including local testing of opencode-only
  build paths.
 - One release cycle of monitoring between them.
 Total: ~1 working day of focused effort, spread over a calendar month.
 ## Order in the broader plan
 1. PR-1 on pi-devbox — copy base + variant Dockerfiles, strip
   opencode/omos paths, tag v1.0.0.
 2. PR-2 on pi-devbox — add pandoc, graphviz, imagemagick, tldr, yq.
 3. PR-3 on pi-devbox — add `:latest-studio` variant.
 4. (Optional) PR-4 on pi-devbox — add `:latest-studio-tex` variant.
 5. PR-pre on opencode-devbox — deprecation warnings (step 1 above).
 6. **PR-5 on opencode-devbox — actual removal (this document, step 2).**
 PRs 1–4 are independent and can land in any order on pi-devbox. PR-pre
 should land alongside or shortly after pi-devbox v1.0.0 (PR-1) so
 consumers know to migrate. PR-5 lands one release cycle after PR-pre.
@@ -29,14 +29,11 @@ cp docs/manual-host-publish.sh /tmp/manual-publish-vX.Y.Z.sh
 # Edit at top of file:
 #   RELEASE_TAG="vX.Y.Z"
 #   BASE_HASH="<12-char hash from CI's base-decide step>"
 #   PI_VERSION="<from npm registry, see step 2 below>"
 #   OMOS_VERSION="<from npm registry, see step 2 below>"
 bash /tmp/manual-publish-vX.Y.Z.sh
 ```
-Keep the historical script in `docs/` as-is — it's an archive of the v1.15.12 publish, useful as a reference if a future debug needs to compare exact arg sets across releases. Don't edit it in place.
+The sections below explain what the script does and what you need to know to edit those three constants safely.
 The sections below explain what the script does and what you need to know to edit those four constants safely.
 ## 1. Pin RELEASE_TAG
@@ -49,16 +46,15 @@ git describe --tags --exact-match HEAD
 The script asserts `HEAD == ${RELEASE_TAG}^{commit}` before doing anything destructive. If you've drifted, fix it with `git checkout` before running.
-## 2. Pin PI_VERSION and OMOS_VERSION
+## 2. Pin OMOS_VERSION
-Gitea CI's `resolve-versions` job queries the npm registry at workflow time and threads concrete versions through every variant build, mitigating the silent same-bytes-across-releases regression class documented in `AGENTS.md`. Do the same by hand:
+Gitea CI's `resolve-versions` job queries the npm registry at workflow time and threads the concrete version through the omos variant build, mitigating the silent same-bytes-across-releases regression class documented in `AGENTS.md`. Do the same by hand:
 ```bash
 curl -sf https://registry.npmjs.org/@earendil-works%2Fpi-coding-agent/latest | jq -r .version
 curl -sf https://registry.npmjs.org/oh-my-opencode-slim/latest | jq -r .version
 ```
-Paste the two version strings into the script's `PI_VERSION` / `OMOS_VERSION` constants. Don't leave the script defaulting to `latest` — the registry buildcache will silently reuse a stale layer if the build-arg byte-equals a previous build.
+Paste the version string into the script's `OMOS_VERSION` constant. Don't leave the script defaulting to `latest` — the registry buildcache will silently reuse a stale layer if the build-arg byte-equals a previous build.
 ## 3. Pin BASE_HASH
@@ -101,8 +97,8 @@ After the constants are set, the script runs a 5-step procedure. No editing need
 1. **Preflight** — buildx present, tag exists, `HEAD == tag`, multi-arch builder created if missing.
 2. **Base build (conditional)** — probe `${IMAGE}:base-${BASE_HASH}` on the Hub; if missing, build it multi-arch and push. **No `--cache-from` / `--cache-to`.** That's the whole point of this escape. If the base push itself fails the same way CI did, stop — the regression has spread to image push and you need a different host or account, not this runbook.
 3. **Promote `base-latest`** — `docker buildx imagetools create` re-tags by manifest reference. No rebuild.
-4. **Variants × 4** — sequential (not parallel; one host's egress can't saturate four multi-arch pushes safely). Each variant is `Dockerfile.variant` `FROM ${IMAGE}:base-${BASE_HASH}` plus the appropriate `INSTALL_OMOS` / `INSTALL_PI` build-args, tagged `${RELEASE_TAG}${suffix}` and `latest${suffix}`.
+4. **Variants × 2** — sequential (not parallel; one host's egress can't saturate multiple multi-arch pushes safely). Each variant is `Dockerfile.variant` `FROM ${IMAGE}:base-${BASE_HASH}` plus the appropriate `INSTALL_OPENCODE` / `INSTALL_OMOS` build-args, tagged `${RELEASE_TAG}${suffix}` and `latest${suffix}`.
-5. **Verify** — prints the digest of all 10 expected tags (8 variant + base-hash + base-latest). Spot-check that each `vX.Y.Z*` and its `latest*` alias share a digest.
+5. **Verify** — prints the digest of all 6 expected tags (4 variant + base-hash + base-latest). Spot-check that each `vX.Y.Z*` and its `latest*` alias share a digest.
 Expected wall time on a recent Mac: ~25-40 min (base ~3 min if rebuilt, each variant ~3-7 min mostly QEMU arm64 emulation).
@@ -1,34 +1,34 @@
 #!/usr/bin/env bash
-# Manual publish of opencode-devbox v1.15.12 — bypasses broken Gitea-runner
+# Manual publish of opencode-devbox — bypasses a broken Gitea-runner Hub push
-# Hub push by building & pushing from a developer host (Orbstack/Docker Desktop).
+# by building & pushing from a developer host (Orbstack/Docker Desktop).
 #
 # Mirrors what .gitea/workflows/docker-publish-split.yml would do:
 #   1. Build & push Dockerfile.base    → joakimp/opencode-devbox:base-<hash>
 #   2. Promote                         → joakimp/opencode-devbox:base-latest
-#   3. Build & push 4 variants on top of base-<hash>:
+#   3. Build & push 2 variants on top of base-<hash>:
-#        :v1.15.12              :latest              (INSTALL_OPENCODE only)
+#        :vX.Y.Z              :latest              (INSTALL_OPENCODE only)
-#        :v1.15.12-omos         :latest-omos         (+ OMOS)
+#        :vX.Y.Z-omos         :latest-omos         (+ OMOS)
-#        :v1.15.12-with-pi      :latest-with-pi      (+ pi)
+#
-#        :v1.15.12-omos-with-pi :latest-omos-with-pi (+ both)
+# pi was removed in v2.0.0 — there are no pi variants here anymore.
 #
 # Usage on your host:
 #   1. Make sure Orbstack/Docker Desktop is running with multi-arch enabled
 #      (docker buildx ls should show linux/amd64,linux/arm64).
 #   2. docker login docker.io   (joakimp account)
-#   3. cd ~/path/to/opencode-devbox && git fetch && git checkout v1.15.12
+#   3. cd ~/path/to/opencode-devbox && git fetch && git checkout <RELEASE_TAG>
-#   4. bash /path/to/this/script.sh
+#   4. Edit RELEASE_TAG / BASE_HASH / OMOS_VERSION below to match the release.
 #   5. bash /path/to/this/script.sh
 #
-# Total expected time: ~25-40 min on a recent Mac (4 multi-arch builds, base
+# Total expected time: ~15-25 min on a recent Mac (2 multi-arch builds, base
 # layers cache after the first variant).
 set -euo pipefail
 IMAGE="joakimp/opencode-devbox"
-RELEASE_TAG="v1.15.12"
+RELEASE_TAG="v2.0.0"            # EDIT per release
-BASE_HASH="8d72a9e44796"        # sha256 of Dockerfile.base + rootfs/* + entrypoints (computed by CI logic)
+BASE_HASH="REPLACE_ME"          # sha256 of Dockerfile.base + rootfs/* + entrypoints (computed by CI logic)
 BASE_TAG="base-${BASE_HASH}"
-PI_VERSION="0.76.0"             # resolved from npm @earendil-works/pi-coding-agent latest (2026-05-28)
+OMOS_VERSION="latest"           # resolve from npm oh-my-opencode-slim latest, then pin
 OMOS_VERSION="1.1.1"            # resolved from npm oh-my-opencode-slim latest (2026-05-28)
 PLATFORMS="linux/amd64,linux/arm64"
 # -------- preflight --------
@@ -51,7 +51,7 @@ fi
 # -------- 1. base (if needed) --------
 if [[ "$SKIP_BASE" == "0" ]]; then
-  echo "==> [1/5] Build & push Dockerfile.base → ${IMAGE}:${BASE_TAG}"
+  echo "==> [1/7] Build & push Dockerfile.base → ${IMAGE}:${BASE_TAG}"
  docker buildx build \
    --platform "$PLATFORMS" \
    -f Dockerfile.base \
@@ -61,16 +61,15 @@ if [[ "$SKIP_BASE" == "0" ]]; then
 fi
 # -------- 2. promote base-latest --------
-echo "==> [2/5] Promote ${IMAGE}:${BASE_TAG} → ${IMAGE}:base-latest"
+echo "==> [2/7] Promote ${IMAGE}:${BASE_TAG} → ${IMAGE}:base-latest"
 docker buildx imagetools create -t "${IMAGE}:base-latest" "${IMAGE}:${BASE_TAG}"
-# -------- 3-5. variants --------
+# -------- 3-4. variants --------
 build_variant() {
-  local suffix="$1"      # "" | "-omos" | "-with-pi" | "-omos-with-pi"
+  local suffix="$1"      # "" | "-omos"
  local install_omos="$2"
-  local install_pi="$3"
+  local install_opencode="${3:-true}"
  local extra_args=()
  [[ "$install_pi"   == "true" ]] && extra_args+=(--build-arg "PI_VERSION=${PI_VERSION}")
  [[ "$install_omos" == "true" ]] && extra_args+=(--build-arg "OMOS_VERSION=${OMOS_VERSION}")
  local versioned="${IMAGE}:${RELEASE_TAG}${suffix}"
@@ -81,9 +80,8 @@ build_variant() {
    --platform "$PLATFORMS" \
    -f Dockerfile.variant \
    --build-arg "BASE_IMAGE=${IMAGE}:${BASE_TAG}" \
-    --build-arg "INSTALL_OPENCODE=true" \
+    --build-arg "INSTALL_OPENCODE=${install_opencode}" \
    --build-arg "INSTALL_OMOS=${install_omos}" \
    --build-arg "INSTALL_PI=${install_pi}" \
    ${extra_args[@]+"${extra_args[@]}"} \
    -t "${versioned}" \
    -t "${floating}" \
@@ -91,25 +89,17 @@ build_variant() {
    .
 }
-echo "==> [3/5] Variant: base (opencode only)"
+echo "==> [3/4] Variant: base (opencode only)"
-build_variant ""               false false
+build_variant ""               false
-echo "==> [4/5] Variant: omos"
+echo "==> [4/4] Variant: omos"
-build_variant "-omos"          true  false
+build_variant "-omos"          true
 echo "==> [4/5] Variant: with-pi"
 build_variant "-with-pi"       false true
 echo "==> [5/5] Variant: omos-with-pi"
 build_variant "-omos-with-pi"  true  true
 echo
 echo "==> Done. Verifying tags on Hub:"
 for t in \
  "${RELEASE_TAG}" "latest" \
  "${RELEASE_TAG}-omos" "latest-omos" \
  "${RELEASE_TAG}-with-pi" "latest-with-pi" \
  "${RELEASE_TAG}-omos-with-pi" "latest-omos-with-pi" \
  "${BASE_TAG}" "base-latest"
 do
  d=$(docker manifest inspect "${IMAGE}:${t}" 2>/dev/null | python3 -c "import json,sys,hashlib; m=json.load(sys.stdin); print(m.get('digest','-'))" 2>/dev/null || echo "MISSING")
@@ -0,0 +1,235 @@
 # Plan: LAN-access mechanism + pi-fork/pi-observational-memory in the builds
 Status: PROPOSED (2026-06-03, decisions folded in). Author: pi (devbox session).
 Scope: opencode-devbox base + variant, pi-devbox. Two independent work items.
 ---
 ## Layering decision
 | Capability | Lives in | Why |
 |---|---|---|
 | **LAN-access (smart-detect host-jump)** | opencode-devbox **base** | Both opencode-devbox and pi-devbox inherit it; not pi-specific. |
 | **pi-fork + pi-observational-memory** | **pi layer** (variant `with-pi`/`omos-with-pi` + pi-devbox/Dockerfile) | Only meaningful when `pi` is present. Runtime deploy via the shared base `entrypoint-user.sh`, guarded by `command -v pi`. |
 Guiding principle for LAN access: **ship the mechanism, not the policy.**
 The image provides a generic `host` jump alias + writable SSH config + detection.
 A user's *specific* targets (e.g. pve/pve-2) come from their bind-mounted
 `~/.ssh/config` (`ProxyJump host`) or an env list — never hardcoded in the image.
 ---
 ## ITEM A — LAN access (opencode-devbox base)
 ### Why it can't "just work" unattended
 - macOS (OrbStack / Docker Desktop): container is in a Linux VM behind the host's
  stack. Directly-attached LAN peers are not bridged by default; only the host +
  routed subnets are reachable.
 - Linux Docker: default bridge already NATs container egress onto the host's LAN,
  so LAN peers are usually directly reachable. The jump is unnecessary.
 - The jump path needs the host running sshd + the container's pubkey authorized.
  The average DockerHub t"kick the tires" user has neither → setup must be
  **opt-in / non-fatal**, never block startup.
 ### New file: `rootfs/usr/local/lib/opencode-devbox/setup-lan-access.sh`
 COPY'd automatically (base already does `COPY rootfs/usr/local/lib/opencode-devbox/`).
 Behavior, driven by `DEVBOX_LAN_ACCESS=auto|jump|off` (default `auto`):
 1. `off` → return immediately.
 2. Detect environment:
   - VM-backed Docker (OrbStack / Docker Desktop) iff `getent hosts host.docker.internal`
     resolves (OrbStack also exposes `host.orb.internal`). Native Linux → no resolution
     (unless the user added `extra_hosts: host.docker.internal:host-gateway`).
 3. `auto` + native Linux → do nothing (direct LAN works); print one info line.
 4. `auto` + VM-backed, or `jump` forced →
   - Create writable `~/.ssh-local/{,cm/}`, `chmod 700`.
   - Generate `~/.ssh-local/devbox_jump_ed25519` if absent (preserve across restarts).
   - Render `~/.ssh-local/config`:
     ```
     Host *
         UserKnownHostsFile ~/.ssh-local/known_hosts
         StrictHostKeyChecking accept-new
     Host host mac                       # 'mac' kept as friendly alias
         HostName host.docker.internal
         User ${HOST_SSH_USER}           # REQUIRED for auth; see below
         IdentityFile ~/.ssh-local/devbox_jump_ed25519
         IdentitiesOnly yes
         ControlMaster auto
         ControlPath ~/.ssh-local/cm/%r@%h:%p
         ControlPersist 4h
     # Optional per-target blocks generated from DEVBOX_LAN_HOSTS (see below)
     Include ~/.ssh/config               # user's bind-mounted targets still resolve
     ```
   - If `HOST_SSH_USER` unset → still render config but print a clear hint block:
     the generated **public key** + the one-liner to authorize it on the host
     (`echo '<pubkey>' >> ~/.ssh/authorized_keys`) + "enable Remote Login".
   - Idempotent: re-render config each start (cheap); never regenerate the key.
   - DECISION #5: NO `DEVBOX_LAN_HOSTS` env. Keep the image policy-free. Users add
     `ProxyJump host` to their own target entries in the bind-mounted `~/.ssh/config`
     (pulled in by the `Include ~/.ssh/config` line).
 ### `entrypoint-user.sh`
 Call `setup-lan-access.sh` right after the existing `/tmp/sshcm` block
 (non-fatal: `… || true`). It's environment-gated so it self-skips on Linux.
 ### `rootfs/home/developer/.bash_aliases`  (per your note — alias goes HERE)
 Append, guarded:
 ```bash
 # dssh — ssh using the container's writable LAN-access config (host-jump).
 # Only useful when setup-lan-access.sh generated ~/.ssh-local/config.
 if [ -r "$HOME/.ssh-local/config" ]; then
  alias dssh='ssh -F "$HOME/.ssh-local/config"'
  alias dscp='scp -F "$HOME/.ssh-local/config"'
 fi
 ```
 Migration caveat: skel `.bash_aliases` is only copied when absent, so existing
 volumes/containers won't get `dssh` until they `rm ~/.bash_aliases` and recreate,
 OR drop the alias into the host-shared `~/.config/devbox-shell/bash_aliases`
 (already sourced at the top of the skel file).
 ### Dockerfile.base
 No structural change required (script ships via existing rootfs COPY). Optionally
 document `DEVBOX_LAN_ACCESS` / `HOST_SSH_USER` / `DEVBOX_LAN_HOSTS` in `.env.example`
 and README.
 ---
 ## ITEM B — pi-fork + pi-observational-memory (pi layer)
 Sources (pinned this week):
 - `github.com/elpapi42/pi-fork`                  (registers `fork`; ~v0.1.0)
 - `github.com/elpapi42/pi-observational-memory`  (registers `recall`; default branch **master**, v3.0.2)
 ### B1 RESOLVED (verified live 2026-06-03 in this container)
 - `pi install <local-path>` is INSTANT (~0.5s): NO copy, NO npm install. pi registers
  the path and loads the extension IN PLACE from that dir.
 - settings.json stores a RELATIVE path (e.g. `../../../opt/pi-fork` from ~/.pi/agent).
  Points into the image-layer `/opt` → stable across volume recreate. Good.
 - Idempotent: a second `pi install <same path>` does NOT duplicate the entry.
 - CONSEQUENCE: because pi does NOT npm-install a local path, deps must already exist
  at `/opt/<pkg>/node_modules`. pi-fork imports `@sinclair/typebox` + `@earendil-works/*`
  peers; git-install produced a 148 MB node_modules. So we MUST `npm install` inside
  each `/opt/<pkg>` AT BUILD TIME.
 - BAKE RECIPE: clone to /opt -> `npm install` there (build) -> `pi install /opt/<pkg>`
  at runtime (instant, idempotent).
 - (Optional size win, verify-first: prune to external-only deps if pi provides the
  `@earendil-works/*` peers from its own runtime resolution. ~148M is mostly those.)
 ### DECISION #3: refactor to remove duplication
 `pi-devbox/Dockerfile` currently duplicates the pi-install + /opt-clone logic from
 `Dockerfile.variant`. Refactor `pi-devbox/Dockerfile` to `FROM` the `with-pi` variant
 image so pi-install logic (incl. the new fork/obsmem clones) lives in ONE place.
 > **Implementation update (2026-06-03):** `FROM with-pi` would have dragged opencode
 > into pi-devbox (all opencode-devbox variants set `INSTALL_OPENCODE=true`), making it
 > nearly identical to `latest-with-pi`. So a 5th variant **`pi-only`**
 > (`INSTALL_OPENCODE=false`, `INSTALL_PI=true`) was added to opencode-devbox, and
 > pi-devbox now `FROM`s `latest-pi-only`. Same single-source-of-truth win, but
 > pi-devbox stays lean (no opencode, ~145 MB lighter than with-pi).
 >
 > **Update 2 (2026-06-03, Option B):** publishing the pi-only variant as
 > `opencode-devbox:latest-pi-only` meant an "opencode-devbox" Hub tag that
 > contains no opencode — confusing. Final scheme: the pi-only build is still
 > produced by opencode-devbox CI (single source of truth) but its
 > `build-variant-pi-only` job pushes into the **`joakimp/pi-devbox`** repo as
 > the internal building-block tag `base-pi-only` (+ `base-pi-only-vX.Y.Z`), and
 > pi-devbox now `FROM`s `joakimp/pi-devbox:base-pi-only`. No opencode-less tag
 > ever appears under opencode-devbox; pi-only is de-advertised from
 > opencode-devbox's README/DOCKER_HUB. New `PI_IMAGE` workflow env.
 ### Build time — clone to /opt + npm install (mirror pi-toolkit/extensions pattern)
 Add to the single `INSTALL_PI=true` block in `opencode-devbox/Dockerfile.variant`
 (after refactor, pi-devbox inherits it):
 ```dockerfile
 ARG PI_FORK_REPO=https://github.com/elpapi42/pi-fork.git
 ARG PI_FORK_REF=<pin: tag or commit SHA>
 ARG PI_OBSMEM_REPO=https://github.com/elpapi42/pi-observational-memory.git
 ARG PI_OBSMEM_REF=master   # pin to SHA in CI to dodge cache-hit footgun
 # ... inside the INSTALL_PI / pi-install RUN, after the pi-toolkit/extensions clones:
 git_clone_retry "$PI_FORK_REPO"   "$PI_FORK_REF"   /opt/pi-fork && \
 git_clone_retry "$PI_OBSMEM_REPO" "$PI_OBSMEM_REF" /opt/pi-observational-memory && \
 (cd /opt/pi-fork && npm install --no-audit --no-fund) && \
 (cd /opt/pi-observational-memory && npm install --no-audit --no-fund) && \
 echo "pi-fork at $(cd /opt/pi-fork && git rev-parse --short HEAD)" && \
 echo "pi-obsmem at $(cd /opt/pi-observational-memory && git rev-parse --short HEAD)"
 ```
 NOTE: `git_clone_retry` uses `--branch "$ref"`, which accepts tags & branches but
 NOT arbitrary commit SHAs. For SHA pinning use `git clone <url> <dest> && git -C
 <dest> checkout <sha>` for these two repos.
 ### Why not bake the install result
 `~/.pi` is a named volume mounted at runtime — anything `pi install`'d into
 `~/.pi/agent/...` at BUILD time is hidden by the volume. Same reason
 pi-toolkit/extensions deploy at runtime via `entrypoint-user.sh`. So:
 ### Runtime deploy — `entrypoint-user.sh` (shared base, in the `command -v pi` block)
 After the pi-extensions `install.sh` call, add an idempotent install of each /opt pkg:
 ```bash
 for pkg in /opt/pi-fork /opt/pi-observational-memory; do
  [ -d "$pkg" ] || continue
  name=$(basename "$pkg")
  # skip if already registered in settings.json packages
  if ! grep -q "$name" "$HOME/.pi/agent/settings.json" 2>/dev/null; then
    (cd "$HOME" && pi install "$pkg") || echo "WARN: pi install $name failed (continuing)"
  fi
 done
 ```
 `fork` + `recall` tools register on the NEXT pi start after deploy (exts bind at
 startup). First deploy after a volume recreate pays an `npm install` cost
 (pi-fork pulls ~133 deps) — acceptable, one-time per volume lifetime.
 OPEN ITEM B1 (verify before finalizing): exact `pi install <local-path>` semantics
 — does it copy/symlink, and does it npm-install at run each time? If it re-resolves
 deps every start, pre-populate `/opt/<pkg>/node_modules` at build (`npm install
 --omit=dev`) and confirm the runtime install reuses it. Quick test in this container:
 `pi install /opt/pi-fork` twice, observe settings.json + timing + tool registration.
 ### CI — `.gitea/workflows/docker-publish-split.yml` (DECISION #2: latest-but-pinned)
 - USE LATEST CONTENT, BUT RESOLVE TO A SHA IN CI (same pattern as PI_VERSION/OMOS).
  The existing `resolve-versions` job curls npm `latest` for pi/omos to defeat the
  build-arg cache-hit footgun. Add an analogous resolve for the two git repos:
  query the GitHub API for the HEAD commit SHA of the tracked branch (master) and
  pass it as `PI_FORK_REF` / `PI_OBSMEM_REF` build-args, so the layer hash changes
  when upstream moves AND we still get newest-at-build-time.
 - Passing a bare branch name would be byte-identical across builds -> stale cached
  layer (the documented footgun). SHA resolution fixes both.
 - Pass the new build-args in the `with-pi` and `omos-with-pi` build steps.
 - The resolved SHAs print in build logs (and ideally as image labels) so a bad
  upstream is diagnosable and we can pin back to a known-good SHA.
 ### Version coupling risk (carry-over from prior session)
 pi-fork/obsmem extensions are coupled to the host pi version (AGENTS.md warns).
 pi-fork had a `fix/effort-string-enum-schema` branch from recent API churn. So:
 - Pin against the SAME `PI_VERSION` the image ships.
 - smoke-test must assert the tools actually register (below), not just that files exist.
 ### Smoke test — `scripts/smoke-test.sh`
 Add (for `with-pi`/`omos-with-pi`/pi-devbox):
 1. `/opt/pi-fork/package.json` and `/opt/pi-observational-memory/package.json` exist.
 2. Run a container, then assert `~/.pi/agent/settings.json` "packages" includes both.
 3. Best-effort: headless `pi` tool-list contains `fork` and `recall` (if pi exposes a
   non-interactive list; otherwise step 2 is the gate).
 ---
 ## Decisions — RESOLVED 2026-06-03
 1. **B1**: VERIFIED. Local-path install is instant/in-place; bake `npm install` into
   `/opt/<pkg>` at build; runtime `pi install /opt/<pkg>` is instant + idempotent. ✓
 2. **Latest-but-pinned**: track latest (master HEAD), resolve to SHA in CI build-arg. ✓
 3. **Refactor**: pi-devbox/Dockerfile -> `FROM` the with-pi variant; pi-install in ONE place. ✓
 4. **LAN default** `DEVBOX_LAN_ACCESS=auto`: generate config + print authorize hint when
   `HOST_SSH_USER` unset; silent no-op on native Linux. ✓
 5. **No `DEVBOX_LAN_HOSTS`**: rely on user's bind-mounted `~/.ssh/config` (`ProxyJump host`). ✓
 ## Remaining verify-before-merge items
 - Confirm the fork/recall extensions LOAD at runtime from `/opt/<pkg>` WITH the baked
  node_modules (smoke test asserts tool registration, not just files).
 - Optional: confirm whether pi supplies `@earendil-works/*` peers at runtime so /opt
  node_modules can be pruned to external-only deps (size optimization, ~148M -> small).
 ## Rollout order
 1. Verify B1 in this live container (cheap, no build).
 2. Land ITEM A in base (rootfs script + entrypoint call + alias) → rebuild base → smoke.
 3. Land ITEM B in variant + pi-devbox + CI resolve + smoke assertions.
 4. CHANGELOG + tag both repos; CI rebuild; verify fork+recall+dssh survive a volume recreate.
@@ -12,6 +12,16 @@ set -euo pipefail
 mkdir -p /tmp/sshcm
 chmod 700 /tmp/sshcm
 # ── LAN access: generic host-OS-agnostic reachability helper ────────
 # On VM-backed hosts (macOS OrbStack / Docker Desktop) the container can't
 # reach the host's directly-attached LAN peers by default; this generates a
 # writable ~/.ssh-local/config that uses the host as an SSH jump. On native
 # Linux (LAN reachable directly) it is a no-op. Controlled by DEVBOX_LAN_ACCESS
 # (auto|jump|off) + HOST_SSH_USER. Always non-fatal. See the script header.
 if [ -r /usr/local/lib/opencode-devbox/setup-lan-access.sh ]; then
  bash /usr/local/lib/opencode-devbox/setup-lan-access.sh || true
 fi
 # ── Shell defaults: copy baked files from /etc/skel-devbox/ if absent
 # Respects host bind-mounts and user customizations — existing files
 # are never overwritten. To restore defaults: rm ~/.bash_aliases (or
@@ -26,6 +36,32 @@ if [ -d "$SKEL_DIR" ]; then
  done
 fi
 # ── v2.0.0 migration: relocate npm global prefix off the legacy ~/.pi path ──
 # Pre-v2.0.0 images set NPM_CONFIG_PREFIX=~/.pi/npm-global (a pi-specific
 # path). v2.0.0 removed pi and moved the prefix to
 # ~/.config/opencode/npm-global, which is a persistent named volume in every
 # compose layout (the old ~/.pi volume was only in docker-compose.yml). If a
 # user upgraded with the old ~/.pi volume still mounted, copy their
 # previously globally-installed npm packages to the new prefix once so they
 # remain on PATH. The marker keeps this idempotent and a no-op for fresh
 # installs; the whole block is harmless when the old path is absent.
 NEW_NPM_PREFIX="$HOME/.config/opencode/npm-global"
 OLD_NPM_PREFIX="$HOME/.pi/npm-global"
 MIGRATION_MARKER="$NEW_NPM_PREFIX/.migrated-from-dot-pi"
 if [ -d "$OLD_NPM_PREFIX" ] && [ ! -f "$MIGRATION_MARKER" ]; then
  echo "Migrating npm global prefix: ~/.pi/npm-global -> ~/.config/opencode/npm-global"
  mkdir -p "$NEW_NPM_PREFIX"
  # cp -n: never overwrite a file already in the new prefix (a freshly
  # installed package wins over the legacy copy).
  for sub in lib bin share; do
    if [ -d "$OLD_NPM_PREFIX/$sub" ]; then
      mkdir -p "$NEW_NPM_PREFIX/$sub"
      cp -an "$OLD_NPM_PREFIX/$sub/." "$NEW_NPM_PREFIX/$sub/" 2>/dev/null || true
    fi
  done
  touch "$MIGRATION_MARKER" 2>/dev/null || true
 fi
 # ── MemPalace: initialize palace for the workspace if mempalace is installed
 # Creates the palace directory structure on first run. Idempotent — skips
 # if palace already exists, so upgrades from older versions preserve
@@ -60,44 +96,6 @@ fi
 # generated) and no-ops if OPENCODE_PROVIDER is unset.
 python3 /usr/local/lib/opencode-devbox/generate-config.py
 # ── pi: deploy toolkit + extensions + mempalace bridge ─────────────
 # Runs only when pi was baked into the image (INSTALL_PI=true at build).
 # Each install.sh is idempotent and backs up real files before linking,
 # so re-running across container restarts is safe.
 #
 # Order: pi-toolkit first (creates ~/.pi/agent/keybindings.json symlink
 # and writes the AWS env loader), then pi-extensions (symlinks our 6
 # extensions), then settings.json bootstrap from the toolkit template,
 # then the mempalace bridge symlink (one-liner; mempalace-toolkit's
 # install_skill is intentionally skipped to avoid racing with skillset
 # auto-deploy below).
 if command -v pi &>/dev/null; then
  if [ -d /opt/pi-toolkit ]; then
    (cd /opt/pi-toolkit && ./install.sh --yes) || \
      echo "WARN: pi-toolkit install.sh failed (continuing)"
  fi
  if [ -d /opt/pi-extensions ]; then
    (cd /opt/pi-extensions && ./install.sh --yes) || \
      echo "WARN: pi-extensions install.sh failed (continuing)"
  fi
  # Bootstrap settings.json from template if absent (pi rewrites this
  # file at runtime — lastChangelogVersion, etc — so we can't symlink it).
  if [ ! -f "$HOME/.pi/agent/settings.json" ] && \
     [ -f /opt/pi-toolkit/settings.example.json ]; then
    cp /opt/pi-toolkit/settings.example.json "$HOME/.pi/agent/settings.json"
  fi
  # pi↔mempalace MCP bridge — single extension symlink.
  if [ -f /opt/mempalace-toolkit/extensions/pi/mempalace.ts ] && \
     command -v mempalace &>/dev/null && \
     [ ! -L "$HOME/.pi/agent/extensions/mempalace.ts" ]; then
    ln -sf /opt/mempalace-toolkit/extensions/pi/mempalace.ts \
           "$HOME/.pi/agent/extensions/mempalace.ts"
  fi
 fi
 # ── Skillset: deploy skills/instructions from mounted skillset repo ──
 # When the skillset repo is mounted (at $HOME/skillset or /workspace/skillset),
 # run the deploy script to create relative symlinks for skills and instructions.
@@ -87,7 +87,7 @@ for dir in \
  /home/"$USER_NAME"/.vscode-server \
  /home/"$USER_NAME"/.config/opencode \
  /home/"$USER_NAME"/.config/nvim \
-  /home/"$USER_NAME"/.pi \
+  /home/"$USER_NAME"/.ssh-local \
  /home/"$USER_NAME"/.agents/skills; do
  [ -d "$dir" ] || continue
@@ -54,6 +54,17 @@ alias gs='git status'
 alias gd='git diff'
 alias gl='git log --oneline --graph --decorate -20'
 # ── LAN access via the host (dssh) ───────────────────────────────────
 # When running on a VM-backed host (macOS OrbStack / Docker Desktop), the
 # entrypoint's setup-lan-access.sh generates ~/.ssh-local/config so the host
 # can be used as an SSH jump to reach LAN peers. These aliases wrap `ssh -F`
 # / `scp -F` against that config. Guarded so they only appear when the config
 # was actually generated (no-op / absent on native Linux hosts).
 if [ -r "$HOME/.ssh-local/config" ]; then
  alias dssh='ssh -F "$HOME/.ssh-local/config"'
  alias dscp='scp -F "$HOME/.ssh-local/config"'
 fi
 # Safety: confirm before destructive ops
 alias rm='rm -i'
 alias mv='mv -i'
@@ -0,0 +1,225 @@
 #!/usr/bin/env bash
 # setup-lan-access.sh — generic, host-OS-agnostic LAN reachability helper.
 #
 # THE PROBLEM
 #   On macOS (OrbStack / Docker Desktop) and Docker Desktop on Windows, the
 #   container runs inside a Linux VM behind the host's network stack. The
 #   host's *directly-attached* LAN peers (e.g. other boxes on 192.168.1.0/24)
 #   are NOT bridged into the container by default — only the host itself and
 #   *routed* subnets are reachable. On native Linux Docker the default bridge
 #   already NATs container egress onto the host's LAN, so LAN peers are usually
 #   reachable directly and no workaround is needed.
 #
 # THE APPROACH ("detect, and on a VM-backed host use the host as a jump")
 #   The one thing reachable from a container on every OS is the host itself
 #   (host.docker.internal). So on VM-backed hosts we generate a writable SSH
 #   config that reaches the host and lets the user ProxyJump onward to LAN
 #   peers the host can reach. On native Linux we do nothing.
 #
 #   We ship the MECHANISM (a generic `host` jump alias + writable config),
 #   never the POLICY: the user's specific target hosts live in their own
 #   bind-mounted ~/.ssh/config (add `ProxyJump host` to those entries) — which
 #   is pulled in via the `Include ~/.ssh/config` line below.
 #
 # WHY A WRITABLE SIDECAR (~/.ssh-local)
 #   The devbox typically bind-mounts the host's ~/.ssh READ-ONLY (so agents
 #   can read keys for git but can't tamper with config/known_hosts/authorized_
 #   keys). That means we cannot edit ~/.ssh/config or write ~/.ssh/known_hosts.
 #   So everything generated here lives under the writable ~/.ssh-local, used
 #   via `ssh -F ~/.ssh-local/config` (the `dssh`/`dscp` aliases wrap that).
 #
 # CONTROLS (env)
 #   DEVBOX_LAN_ACCESS = auto (default) | jump | off
 #       auto  → set up the jump config only on VM-backed hosts; no-op on Linux.
 #       jump  → always set up (e.g. native Linux with extra_hosts host-gateway).
 #       off   → do nothing.
 #   HOST_SSH_USER  — the username to SSH into the host as. REQUIRED for the
 #       jump to authenticate. If unset we still generate the config but print
 #       a hint with the public key to authorize on the host.
 #   DEVBOX_HOST_ALIAS — host hostname to reach (default host.docker.internal).
 #   DEVBOX_LAN_AUTOJUMP_PRIVATE = 0 (default) | 1
 #       1 → also emit a catch-all that ProxyJumps *any* RFC1918 (private) IP
 #       through the host. Lets bare `dssh user@<private-IP>` work on whatever
 #       LAN the (roaming) host is currently joined to, without naming peers.
 #       Matches by the address you TYPE, not the resolved HostName, so it never
 #       overrides named hosts that already carry their own ProxyJump.
 #
 # HOST-OWNED PEER POLICY (portable; keeps this image generic)
 #   Named LAN peers are facts about a *specific* host's network, not about the
 #   image — a roaming laptop sees different LANs. So we never bake peer names
 #   here. Instead, if the host bind-mounts ~/.config/devbox-shell/ssh-lan.conf
 #   (the same devbox-shell bridge dir used for shared aliases), we Include it
 #   *before* ~/.ssh/config. That file holds the host's own jump overrides, e.g.
 #       Host pve pve-2 pbs-vm
 #           ProxyJump host
 #   First-value-wins means ProxyJump is taken from there while HostName/User/
 #   IdentityFile are inherited from the matching block in ~/.ssh/config.
 #
 # SCOPING NOTE (important)
 #   `Include` is scoped to the enclosing Host/Match block. So every Include
 #   below is preceded by a bare `Host *` to reset the active context to
 #   match-all — otherwise the included config would only apply when targeting
 #   `host`/`mac` and named peers like `pve` would silently fall back to ssh
 #   defaults.
 #
 # Idempotent: re-renders the config every run (cheap); never regenerates the
 # key. Always non-fatal — never blocks container startup.
 set -uo pipefail
 MODE="${DEVBOX_LAN_ACCESS:-auto}"
 [ "$MODE" = "off" ] && exit 0
 HOST_ALIAS_HOSTNAME="${DEVBOX_HOST_ALIAS:-host.docker.internal}"
 SSH_LOCAL="${HOME}/.ssh-local"
 CONFIG="${SSH_LOCAL}/config"
 KEY="${SSH_LOCAL}/devbox_jump_ed25519"
 # ── Detection: is this a VM-backed host (macOS / Docker Desktop)? ──────
 # host.docker.internal resolves on OrbStack and Docker Desktop (mac/win) but
 # NOT on native Linux Docker (unless the user added extra_hosts: host-gateway,
 # in which case the jump is still harmless / usable, and they can force it
 # with DEVBOX_LAN_ACCESS=jump).
 is_vm_backed() {
  getent hosts "$HOST_ALIAS_HOSTNAME" >/dev/null 2>&1
 }
 if [ "$MODE" = "auto" ] && ! is_vm_backed; then
  # Native Linux host: LAN peers are reachable directly. Nothing to do.
  exit 0
 fi
 # From here: MODE=jump, or MODE=auto on a VM-backed host.
 command -v ssh-keygen >/dev/null 2>&1 || exit 0
 mkdir -p "${SSH_LOCAL}/cm" 2>/dev/null || true
 chmod 700 "${SSH_LOCAL}" "${SSH_LOCAL}/cm" 2>/dev/null || true
 # ── Jump key (generated once; preserved across restarts) ──────────────
 # Persisted via a named volume on ~/.ssh-local (see compose), so a fresh key
 # is generated only on the very first start (or if the volume is wiped). When
 # we DO generate one it must be (re-)authorized on the host, so we flag it and
 # print a copy-paste authorize line below.
 KEY_JUST_GENERATED=0
 if [ ! -f "$KEY" ]; then
  ssh-keygen -t ed25519 -N '' -C "devbox-jump@${HOSTNAME:-container}" -f "$KEY" >/dev/null 2>&1 || exit 0
  chmod 600 "$KEY" 2>/dev/null || true
  KEY_JUST_GENERATED=1
 fi
 # ── Render the writable config ────────────────────────────────────────
 USER_LINE=""
 if [ -n "${HOST_SSH_USER:-}" ]; then
  USER_LINE="    User ${HOST_SSH_USER}"
 fi
 # Optional host-owned named-peer jump overrides (portable: lives on the host,
 # not in the image). Included BEFORE ~/.ssh/config so its ProxyJump wins.
 SSH_LAN_CONF="${HOME}/.config/devbox-shell/ssh-lan.conf"
 LAN_CONF_BLOCK=""
 if [ -r "$SSH_LAN_CONF" ]; then
  LAN_CONF_BLOCK=$(cat <<'EOF'
 # Host-owned named-peer jump overrides (bind-mounted; edit on the host).
 # Scope reset to match-all so the Include applies to every target host.
 Host *
 Include ~/.config/devbox-shell/ssh-lan.conf
 EOF
 )
 fi
 # Optional opt-in RFC1918 catch-all: ProxyJump every private IP through the
 # host. Matches the typed address, never the resolved HostName, so named hosts
 # with their own ProxyJump are unaffected. Network-agnostic → roaming-safe.
 AUTOJUMP_BLOCK=""
 if [ "${DEVBOX_LAN_AUTOJUMP_PRIVATE:-0}" = "1" ]; then
  AUTOJUMP_BLOCK=$(cat <<'EOF'
 # RFC1918 auto-jump (DEVBOX_LAN_AUTOJUMP_PRIVATE=1): reach any private IP on
 # the host's CURRENT LAN via bare `dssh user@<ip>`. Public IPs are unmatched
 # and go direct via the container's NAT egress. NOTE: also matches the
 # container's own bridge subnet and any private IP the host can't actually
 # reach — for non-LAN private hosts behind a different jump, use their named
 # entry (which matches first by name and keeps its own ProxyJump).
 Host 10.* 192.168.* 172.16.* 172.17.* 172.18.* 172.19.* 172.20.* 172.21.* 172.22.* 172.23.* 172.24.* 172.25.* 172.26.* 172.27.* 172.28.* 172.29.* 172.30.* 172.31.*
    ProxyJump host
 EOF
 )
 fi
 INCLUDE_BLOCK=""
 if [ -r "${HOME}/.ssh/config" ]; then
  INCLUDE_BLOCK=$(cat <<'EOF'
 # Your own target hosts. Scope reset to match-all so this Include applies to
 # every target (an Include is otherwise scoped to the enclosing Host block).
 # Add 'ProxyJump host' to LAN entries here (or in ssh-lan.conf above).
 Host *
 Include ~/.ssh/config
 EOF
 )
 fi
 cat > "$CONFIG" <<EOF
 # AUTO-GENERATED by setup-lan-access.sh on every container start. Do not edit
 # by hand — edits are overwritten. Used via: ssh -F ~/.ssh-local/config <host>
 # (or the dssh / dscp aliases). See the script header for the full rationale.
 # ~/.ssh is typically mounted read-only, so keep our own known_hosts here.
 # Also redirect ControlPath into the writable sidecar: the bind-mounted
 # ~/.ssh/config commonly sets 'ControlPath ~/.ssh/cm/...' for CGNAT multiplexing,
 # but ~/.ssh is read-only here so the master socket can't be created and those
 # hosts fail to connect. First-value-wins: setting it here (before the Include)
 # overrides the read-only path for every host. Harmless when ControlMaster is off.
 Host *
    UserKnownHostsFile ~/.ssh-local/known_hosts
    StrictHostKeyChecking accept-new
    ControlPath ~/.ssh-local/cm/%r@%h:%p
 # The container host (OrbStack / Docker Desktop). 'host' and 'mac' are aliases.
 Host host mac
    HostName ${HOST_ALIAS_HOSTNAME}
 ${USER_LINE}
    IdentityFile ~/.ssh-local/devbox_jump_ed25519
    IdentitiesOnly yes
    ControlMaster auto
    ControlPath ~/.ssh-local/cm/%r@%h:%p
    ControlPersist 4h
    ServerAliveInterval 30
 ${LAN_CONF_BLOCK}
 ${AUTOJUMP_BLOCK}
 ${INCLUDE_BLOCK}
 EOF
 chmod 600 "$CONFIG" 2>/dev/null || true
 # ── Authorize hints ───────────────────────────────────────────────────
 # Print the copy-paste authorize line whenever we either (a) can't yet
 # authenticate (HOST_SSH_USER unset) or (b) just generated a NEW key that the
 # host won't recognize. With ~/.ssh-local persisted via a named volume, case
 # (b) fires only on first-ever start (or after the volume is reset) — so this
 # is normally a one-time, one-line step per machine, with no file to locate.
 PUBKEY_TEXT="$(cat "${KEY}.pub" 2>/dev/null)"
 if [ -z "${HOST_SSH_USER:-}" ]; then
  cat <<EOF
 [devbox] LAN-access jump config generated at ~/.ssh-local/config, but
         HOST_SSH_USER is unset so it can't authenticate to the host yet.
         To enable container -> host -> LAN-peer access:
           1. Set HOST_SSH_USER=<your host username> in the container env.
           2. Authorize this key on the host (run ON THE HOST, once):
                echo '${PUBKEY_TEXT}' >> ~/.ssh/authorized_keys
           3. Ensure the host's SSH server (Remote Login) is enabled.
         Then: dssh host   (or add 'ProxyJump host' to targets in ~/.ssh/config)
 EOF
 elif [ "$KEY_JUST_GENERATED" = "1" ]; then
  cat <<EOF
 [devbox] Generated a NEW LAN-jump key. Authorize it on the host (${HOST_SSH_USER}@host),
         then 'dssh host' and your LAN peers will work. Run this ONCE, ON THE HOST:
           echo '${PUBKEY_TEXT}' >> ~/.ssh/authorized_keys
         (Ensure the host's SSH server / Remote Login is enabled.)
         This key is persisted in the ~/.ssh-local volume, so you won't need to
         repeat this on container updates — only if that volume is reset.
 EOF
 fi
 exit 0
@@ -56,19 +56,25 @@ HUB_TEMPLATE = f"""# opencode-devbox
 Portable AI developer environment for [opencode](https://opencode.ai). Debian-based, with git, SSH, Node.js, AWS CLI v2, and common dev tools pre-installed.
 > **Current `:latest` ships opencode `{{{{OPENCODE_VERSION}}}}`** (the baked version is asserted by smoke tests, so this page never drifts from the image).
 Designed for teams who want a reproducible coding-agent setup that runs the same on every laptop and CI runner — without forcing each developer to install Bun, Node, AWS CLI, mempalace, or maintain shell config drift across machines.
 ## Image Variants
 | Tag | Description |
 |---|---|
-| `latest` / `vX.Y.Z` | Base image — opencode, Node.js, AWS CLI, dev tools |
+| `latest` / `vX.Y.Z` | Base image — opencode `{{{{OPENCODE_VERSION}}}}`, Node.js, AWS CLI, dev tools |
 | `latest-omos` / `vX.Y.Z-omos` | Base + [oh-my-opencode-slim](https://github.com/alvinunreal/oh-my-opencode-slim) multi-agent orchestration and Bun |
 | `latest-with-pi` / `vX.Y.Z-with-pi` | Base + [pi](https://github.com/earendil-works/pi) as alternative/complementary harness (shares the mempalace install with opencode) |
 | `latest-omos-with-pi` / `vX.Y.Z-omos-with-pi` | OMOS + pi together |
 All variants support `linux/amd64` and `linux/arm64`.
 > **Looking for pi?** As of v2.0.0 the pi coding-agent is no longer bundled in
 > opencode-devbox. It ships as the dedicated
 > [`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox) image, which
 > shares the same mempalace memory layer. See
 > <https://gitea.jordbo.se/joakimp/pi-devbox>.
 ## Quick Start
 For a fully-configured environment with persistent state (opencode config, mempalace memory, neovim plugins, bash history) surviving container recreation, use docker-compose. **You don't need to clone the repo** — just grab two template files:
@@ -82,7 +88,7 @@ curl -fsSL https://gitea.jordbo.se/joakimp/opencode-devbox/raw/branch/main/.env.
 docker compose run --rm devbox
 ```
-This drops you straight into opencode with your project mounted at `/workspace`. Use `bash` as the command (e.g. `docker compose run --rm devbox bash`) to land in a shell first — useful for `aws sso login`, `pi` (on `*-with-pi` variants), or multi-harness workflows.
+This drops you straight into opencode with your project mounted at `/workspace`. Use `bash` as the command (e.g. `docker compose run --rm devbox bash`) to land in a shell first — useful for `aws sso login` or multi-agent workflows.
 **One-shot run, no persistence:**
@@ -102,11 +108,10 @@ Full setup guide — authentication for each provider (Anthropic, OpenAI, Bedroc
 ## What's Inside
 - **[opencode](https://opencode.ai)** — primary coding-agent harness. Multi-provider (Anthropic, OpenAI, Bedrock, Google, Groq, etc.).
- **[pi](https://github.com/earendil-works/pi)** *(in `*-with-pi` variants)* — lightweight TUI coding-agent that coexists with opencode and shares the same mempalace install. Includes the `mcp-loader` extension so any local-stdio or remote streamable-HTTP MCP server (searxng, gitea, context7, …) can be added by editing `~/.pi/agent/settings.json`.
+- **[mempalace](https://github.com/MemPalace/mempalace)** — persistent AI memory layer (ChromaDB + SQLite). Wing/diary/knowledge-graph entries are shareable with the sibling [`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox) image when both point at the same palace.
 - **[mempalace](https://github.com/MemPalace/mempalace)** — persistent AI memory layer (ChromaDB + SQLite). Wing/diary/knowledge-graph entries are mutually visible to opencode and pi.
 - **[oh-my-opencode-slim](https://github.com/alvinunreal/oh-my-opencode-slim)** *(in `*-omos` variants)* — multi-agent orchestration on top of opencode (council, fallback chains, named agents).
 - **AWS CLI v2** with SSO support, **Node.js LTS**, **Bun** (OMOS variants), **uv** (Python), **gosu** for clean UID/GID adjustment to match your host workspace.
- **MCP wrappers** for mempalace pre-installed and pre-wired to both harnesses.
+- **MCP wrappers** for mempalace pre-installed and pre-wired to opencode.
 ## Authentication
@@ -124,8 +129,7 @@ Full Bedrock walkthrough (IAM roles, permissions, multi-account setups): see the
 | Volume | Mount | Survives |
 |---|---|---|
-| `devbox-opencode-config` | `~/.config/opencode` | container recreate, image rebuild |
+| `devbox-opencode-config` | `~/.config/opencode` | container recreate, image rebuild — incl. user-installed npm globals via `npm install -g` (`NPM_CONFIG_PREFIX` points into the volume) |
 | `devbox-pi-config` | `~/.pi` | container recreate, image rebuild — incl. user-installed pi packages via `pi install` (`NPM_CONFIG_PREFIX` points into the volume) |
 | `devbox-palace` (uncomment) | `~/.mempalace` | container recreate, image rebuild — palace data is precious, treat as primary storage |
 | `devbox-chroma-cache` | `~/.cache/chroma` | container recreate (model cache, disposable — re-downloads in seconds) |
@@ -142,7 +146,7 @@ Full persistence reference, including multi-user (`SIGNUM`) isolation and host b
 ## Sibling images
- **[`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox)** — pi-only image built on top of this image's base layer. Smaller (~700 MB) and version-tracks the [pi npm package](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) directly. Use this if you want pi without opencode. Source: <https://gitea.jordbo.se/joakimp/pi-devbox>
+- **[`joakimp/pi-devbox`](https://hub.docker.com/r/joakimp/pi-devbox)** — the pi coding-agent in its own self-contained image, built on a shared Debian base. Version-tracks the [pi npm package](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) directly and can share this image's mempalace palace. Use it if you want pi instead of (or alongside) opencode. Source: <https://gitea.jordbo.se/joakimp/pi-devbox>
 ## License
@@ -150,7 +154,7 @@ MIT. See <{GITEA}/src/branch/main/LICENSE>.
 ---
-> This description is generated by `scripts/generate-dockerhub-md.py` from a hand-maintained template. Edit the template (not this file) and regenerate.
+> This description is generated by `scripts/generate-dockerhub-md.py` from a hand-maintained template. Edit the template (not this file) and regenerate. The `{{{{OPENCODE_VERSION}}}}` placeholder is filled by CI at publish time.
 """
@@ -8,7 +8,7 @@
 #   - Generated opencode.json has the expected shape
 #   - MCP wrapper works (when mempalace is installed)
 #
-# Usage: ./scripts/smoke-test.sh <image> [--variant base|omos|with-pi|omos-with-pi]
+# Usage: ./scripts/smoke-test.sh <image> [--variant base|omos]
 #
 # Exit codes:
 #   0  all checks passed
@@ -23,13 +23,20 @@ if [ "${2:-}" = "--variant" ]; then
 fi
 if [ -z "$IMAGE" ]; then
-  echo "usage: $0 <image> [--variant base|omos|with-pi|omos-with-pi]" >&2
+  echo "usage: $0 <image> [--variant base|omos]" >&2
  exit 2
 fi
 FAILED=0
 pass() { echo "  ✓ $1"; }
 fail() { echo "  ✗ $1" >&2; FAILED=$((FAILED + 1)); }
 warn() { echo "  ⚠ $1" >&2; }
 # Registration assertions for fork/recall were removed in v2.0.0 along with
 # pi. STRICT_REGISTRATION is retained as an inert env var for backward
 # compatibility with any external caller that still sets it; it has no
 # effect now that no pi packages are deployed.
 STRICT_REGISTRATION="${STRICT_REGISTRATION:-0}"
 run() {
  # Run a command inside the image and capture its output.
@@ -72,9 +79,6 @@ docker run --rm --entrypoint="" "$IMAGE" sh -c '
  if command -v opencode >/dev/null 2>&1; then
    printf "  %-15s %s\n" "opencode"      "$(opencode --version 2>&1 | head -1)"
  fi
  if command -v pi >/dev/null 2>&1; then
    printf "  %-15s %s\n" "pi"            "$(pi --version 2>&1 | head -1)"
  fi
  printf "  %-15s %s\n" "node"          "$(node --version)"
  printf "  %-15s %s\n" "npm"           "$(npm --version)"
  printf "  %-15s %s\n" "nvim"          "$(nvim --version | head -1)"
@@ -104,7 +108,7 @@ docker run --rm --entrypoint="" "$IMAGE" sh -c '
 echo
 echo "-- Core binaries --"
 # opencode is gated on INSTALL_OPENCODE=true (default). When absent, the
-# image is a pi-only build (or a pure base — no harness at all).
+# image is a pure base with no harness at all.
 if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v opencode" >/dev/null 2>&1; then
  run "opencode"          "opencode --version"
 else
@@ -158,70 +162,15 @@ elif docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v mempalace" >/dev
  echo "  - mempalace-toolkit not installed (INSTALL_MEMPALACE_TOOLKIT=false)"
 fi
-# pi: present when built with INSTALL_PI=true. Verifies pi itself plus
+# bun: only in the omos variant
-# the runtime-deployed pi-toolkit + pi-extensions + mempalace bridge
+if [ "$VARIANT" = "omos" ]; then
 # symlinks under ~/.pi/agent/. Note: extension symlinks are created by
 # entrypoint-user.sh on first start, so we test by running the entry
 # point chain (not just `docker run --entrypoint=""`).
 if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v pi" >/dev/null 2>&1; then
  if [ -n "${EXPECTED_PI_VERSION:-}" ]; then
    run_expect "pi version matches build-arg" "pi --version" "$EXPECTED_PI_VERSION"
  else
    run "pi"                       "pi --version"
  fi
  run "pi-toolkit clone"         "test -d /opt/pi-toolkit && git -C /opt/pi-toolkit rev-parse --short HEAD"
  run "pi-extensions clone"      "test -d /opt/pi-extensions && git -C /opt/pi-extensions rev-parse --short HEAD"
  # Run the full entrypoint as developer to verify install.sh deployment.
  # Spin up a long-running container so we can `docker exec` into it from
  # the host — the `run` helper above invokes commands INSIDE the image
  # and has no docker CLI to nest with.
  CID=$(docker run -d --rm "$IMAGE" tail -f /dev/null)
  trap 'docker rm -f "$CID" >/dev/null 2>&1 || true' EXIT
  # Wait for entrypoint-user.sh to finish deploying pi-toolkit + extensions.
  # Marker: keybindings.json symlink lands once pi-toolkit/install.sh has run.
  # Up to 30s — omos-with-pi has more setup work than base+pi.
  for _ in $(seq 1 30); do
    if docker exec "$CID" test -L /home/developer/.pi/agent/keybindings.json 2>/dev/null; then
      break
    fi
    sleep 1
  done
  exec_test() {
    local label="$1"; shift
    local out
    if out=$(docker exec -u developer "$CID" sh -c "$*" 2>&1); then
      pass "$label ($(echo "$out" | head -1))"
    else
      fail "$label: $out"
    fi
  }
  exec_test "~/.pi/agent/keybindings.json (pi-toolkit)" \
            'test -L $HOME/.pi/agent/keybindings.json && echo ok'
  exec_test "~/.pi/agent/extensions/*.ts ≥ 4 (pi-extensions)" \
            'count=$(ls -1 $HOME/.pi/agent/extensions/*.ts 2>/dev/null | wc -l); [ $count -ge 4 ] && echo "$count extensions"'
  exec_test "~/.pi/agent/extensions/mempalace.ts (bridge)" \
            'test -L $HOME/.pi/agent/extensions/mempalace.ts && echo ok'
  exec_test "~/.pi/agent/settings.json (template bootstrap)" \
            'test -f $HOME/.pi/agent/settings.json && echo ok'
  docker rm -f "$CID" >/dev/null 2>&1 || true
  trap - EXIT
 else
  echo "  - pi not installed (INSTALL_PI=false)"
 fi
 # bun: only in the omos and omos-with-pi variants
 if [ "$VARIANT" = "omos" ] || [ "$VARIANT" = "omos-with-pi" ]; then
  run "bun (omos)"            "bun --version"
  run "bunx symlink (omos)"   "test -L /usr/local/bin/bunx && readlink /usr/local/bin/bunx"
  # oh-my-opencode-slim is npm-installed globally (not a bun install);
  # verify it shows up in the global module list. We must explicitly point
  # npm at the system prefix (/usr) here: the image's NPM_CONFIG_PREFIX env
-  # is set to /home/developer/.pi/npm-global so user-installed packages
+  # is set to /home/developer/.config/opencode/npm-global so user-installed
  # packages
  # land on the persistent volume — which means a default `npm ls -g`
  # queries the user prefix and would miss the baked binaries even though
  # they're correctly on PATH at /usr/bin.
@@ -328,20 +277,24 @@ SIZE_BYTES=$(docker image inspect --format='{{.Size}}' "$IMAGE")
 SIZE_MB=$((SIZE_BYTES / 1024 / 1024))
 echo "  Uncompressed size: ${SIZE_MB} MB"
-# Thresholds (uncompressed): base 2500 MB, omos 3300 MB, with-pi adds ~150 MB.
+# Thresholds (uncompressed): base 2600 MB, omos 3300 MB.
 # omos bumped 3000→3200 on v1.14.31c — mempalace-toolkit bake-in pushed the
 # baseline; bumped 3200→3300 on v1.15.0 — opencode 1.15.0 came in at
 # 3206 MB, leaving zero headroom for routine apt-get upgrade drift.
-# omos-with-pi bumped 3400→3500 on v1.15.0 alongside the omos bump.
+# base 2500→2600 on v1.15.13c — base crept to 2506 MB (LAN-access script +
-# omos-with-pi bumped 3500→3700 on v1.15.4b — omos+pi compounded as both
+# updated entrypoint + routine apt-get upgrade drift), tripping the
-# upstream packages grew (opencode 1.15.0→1.15.4, pi 0.74.0→0.75.3) and
+# deliberately zero-headroom 2500 ceiling and skipping promote-base-latest.
 # the variant landed just over 3500 in v1.15.4's smoke.
 # omos variant to ~3.1 GB. Functional smoke checks all pass; this is a
 # guardrail, not a performance limit.
-THRESHOLD=2500
+# v1.16.2: all thresholds bumped +150 MB preemptively ahead of the combined
-[ "$VARIANT" = "omos" ] && THRESHOLD=3300
+# opencode 1.15.13->1.16.2 (minor) + pi 0.78.1->0.79.0 (minor) bump. Both
-[ "$VARIANT" = "with-pi" ] && THRESHOLD=2700
+# base (2506/2600) and omos (3206/3300) were sitting on ~94 MB headroom and
-[ "$VARIANT" = "omos-with-pi" ] && THRESHOLD=3700
+# a minor opencode bump has tripped them before (v1.15.0 omos). Restoring
 # ~250 MB headroom avoids a partial-publish + letter-suffix recovery cycle.
 # CI's smoke size print + resolved-versions table records the actual landed
 # sizes; tighten later if they come in low.
 THRESHOLD=2750
 [ "$VARIANT" = "omos" ] && THRESHOLD=3450
 if [ "$SIZE_MB" -gt "$THRESHOLD" ]; then
  fail "image size ${SIZE_MB} MB exceeds threshold ${THRESHOLD} MB for variant=$VARIANT"
 else
@@ -0,0 +1,45 @@
 # ssh-lan.conf.example — host-owned LAN-peer jump overrides for opencode-devbox
 # ============================================================================
 # WHAT THIS IS
 #   On a VM-backed host (macOS OrbStack / Docker Desktop) the container can't
 #   reach the host's LAN directly; it tunnels through the host via the `host`
 #   SSH jump that the entrypoint sets up (see the README "Reaching your LAN"
 #   section). To reach your LAN peers *by name*, they need `ProxyJump host`.
 #
 # WHY NOT JUST EDIT ~/.ssh/config?
 #   The host itself reaches those peers DIRECTLY — adding `ProxyJump host`
 #   there would break the host's own access (and ~/.ssh is mounted read-only
 #   into the container anyway). So container-only jump overrides live HERE.
 #
 # HOW IT'S WIRED
 #   If this file exists at  ~/.config/devbox-shell/ssh-lan.conf  on the host
 #   (the same bind-mounted devbox-shell bridge dir used for shared aliases),
 #   the generated ~/.ssh-local/config Includes it BEFORE your ~/.ssh/config.
 #   SSH's first-value-wins rule means ProxyJump is taken from here, while
 #   HostName / User / IdentityFile are inherited from the matching block in
 #   your ~/.ssh/config. So you only list the names + the jump — nothing else.
 #
 # SETUP
 #   1. Copy to your host:  cp ssh-lan.conf.example ~/.config/devbox-shell/ssh-lan.conf
 #   2. Bind-mount ~/.config/devbox-shell into the container (most setups
 #      already do this for shared shell aliases).
 #   3. List the host aliases (as named in your ~/.ssh/config) that should be
 #      reached through the host jump.
 #   4. Restart the container, then:  dssh <name>
 #
 # NOTE: these are facts about ONE host's LAN. A roaming laptop sees different
 # networks — keep this per-host, never in the image. For ad-hoc private IPs on
 # whatever LAN you're currently on, prefer DEVBOX_LAN_AUTOJUMP_PRIVATE=1
 # instead of naming every peer.
 # Example — names must match Host blocks already defined in your ~/.ssh/config:
 Host pve pve-2 pbs-vm my-nas
    ProxyJump host
 # You can also give a peer its own settings here if it isn't in ~/.ssh/config
 # at all (then specify everything, not just ProxyJump):
 # Host lab-box
 #     HostName 192.168.1.77
 #     User admin
 #     IdentityFile ~/.ssh/id_ed25519
 #     ProxyJump host