opencode-devbox/scripts/smoke-test.sh

#!/usr/bin/env bash
# Smoke-test a freshly-built opencode-devbox image.
#
# Verifies:
#   - Core binaries are on PATH and runnable
#   - opencode itself starts and prints a version
#   - Entrypoint runs cleanly as non-root after UID adjustment
#   - Generated opencode.json has the expected shape
#   - MCP wrapper works (when mempalace is installed)
#
# Usage: ./scripts/smoke-test.sh <image> [--variant base|omos|with-pi|omos-with-pi]
#
# Exit codes:
#   0  all checks passed
#   1  one or more checks failed

set -euo pipefail

IMAGE="${1:-}"
VARIANT="base"
if [ "${2:-}" = "--variant" ]; then
  VARIANT="${3:-base}"
fi

if [ -z "$IMAGE" ]; then
  echo "usage: $0 <image> [--variant base|omos|with-pi|omos-with-pi]" >&2
  exit 2
fi

FAILED=0
pass() { echo "  ✓ $1"; }
fail() { echo "  ✗ $1" >&2; FAILED=$((FAILED + 1)); }

run() {
  # Run a command inside the image and capture its output.
  # First arg is a label, rest is the shell command.
  local label="$1"; shift
  local out
  if out=$(docker run --rm --entrypoint="" "$IMAGE" sh -c "$*" 2>&1); then
    pass "$label ($(echo "$out" | head -1))"
  else
    fail "$label: $out"
  fi
}

echo "=== Smoke test: $IMAGE (variant: $VARIANT) ==="
echo
echo "-- Resolved component versions --"
# Prints the actual version of every floating component so CI logs
# always record what got baked into this image, even when Dockerfile
# ARGs default to "latest".
docker run --rm --entrypoint="" "$IMAGE" sh -c '
  if command -v opencode >/dev/null 2>&1; then
    printf "  %-15s %s\n" "opencode"      "$(opencode --version 2>&1 | head -1)"
  fi
  if command -v pi >/dev/null 2>&1; then
    printf "  %-15s %s\n" "pi"            "$(pi --version 2>&1 | head -1)"
  fi
  printf "  %-15s %s\n" "node"          "$(node --version)"
  printf "  %-15s %s\n" "npm"           "$(npm --version)"
  printf "  %-15s %s\n" "nvim"          "$(nvim --version | head -1)"
  printf "  %-15s %s\n" "bat"           "$(bat --version)"
  printf "  %-15s %s\n" "eza"           "$(eza --version | head -2 | tail -1)"
  printf "  %-15s %s\n" "zoxide"        "$(zoxide --version)"
  printf "  %-15s %s\n" "uv"            "$(uv --version)"
  printf "  %-15s %s\n" "fzf"           "$(fzf --version)"
  printf "  %-15s %s\n" "fd"            "$(fd --version)"
  printf "  %-15s %s\n" "rg"            "$(rg --version | head -1)"
  printf "  %-15s %s\n" "gosu"          "$(gosu --version)"
  printf "  %-15s %s\n" "git-lfs"       "$(git-lfs --version)"
  printf "  %-15s %s\n" "gitea-mcp"     "$(gitea-mcp --version 2>&1 | head -1)"
  printf "  %-15s %s\n" "aws"           "$(aws --version 2>&1)"
  if command -v bun >/dev/null 2>&1; then
    printf "  %-15s %s\n" "bun"         "$(bun --version)"
  fi
  if command -v mempalace >/dev/null 2>&1; then
    printf "  %-15s %s\n" "mempalace"   "$(mempalace --version 2>&1 | head -1 || echo installed)"
  fi
  if command -v mempalace-session >/dev/null 2>&1 && [ -d /opt/mempalace-toolkit ]; then
    printf "  %-15s %s\n" "toolkit"     "$(git -C /opt/mempalace-toolkit rev-parse --short HEAD 2>/dev/null || echo installed)"
  fi
'
echo
echo "-- Core binaries --"
# opencode is gated on INSTALL_OPENCODE=true (default). When absent, the
# image is a pi-only build (or a pure base — no harness at all).
if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v opencode" >/dev/null 2>&1; then
  run "opencode"          "opencode --version"
else
  echo "  - opencode not installed (INSTALL_OPENCODE=false)"
fi
run "node"              "node --version"
run "npm"               "npm --version"
run "git"               "git --version"
run "nvim"              "nvim --version | head -1"
run "bat"               "bat --version"
run "eza"               "eza --version | head -1"
run "zoxide"            "zoxide --version"
run "uv"                "uv --version"
run "uvx"               "uvx --version"
run "rustup-init"       "rustup-init --version"
run "fzf"               "fzf --version"
run "fd"                "fd --version"
run "rg"                "rg --version | head -1"
run "jq"                "jq --version"
run "aws"               "aws --version"
run "gitea-mcp"         "gitea-mcp --version"
run "gosu"              "gosu --version"
run "tmux"              "tmux -V"

echo
echo "-- Optional / variant-gated --"
# mempalace: present unless built with INSTALL_MEMPALACE=false
if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v mempalace" >/dev/null 2>&1; then
  run "mempalace"             "mempalace --help | head -1"
  run "mempalace-mcp"         "test -x /usr/local/bin/mempalace-mcp && readlink /usr/local/bin/mempalace-mcp"
else
  echo "  - mempalace not installed (INSTALL_MEMPALACE=false)"
fi

# mempalace-toolkit wrappers: present unless built with INSTALL_MEMPALACE_TOOLKIT=false
# Gated on mempalace presence — wrappers are useless without the CLI.
if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v mempalace && command -v mempalace-session" >/dev/null 2>&1; then
  run "mempalace-session (toolkit)" "mempalace-session --help | head -1"
  run "mempalace-docs (toolkit)"    "mempalace-docs --help | head -1"
  run "toolkit symlink target"      "test -L /usr/local/bin/mempalace-session && readlink /usr/local/bin/mempalace-session"
elif docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v mempalace" >/dev/null 2>&1; then
  echo "  - mempalace-toolkit not installed (INSTALL_MEMPALACE_TOOLKIT=false)"
fi

# pi: present when built with INSTALL_PI=true. Verifies pi itself plus
# the runtime-deployed pi-toolkit + pi-extensions + mempalace bridge
# symlinks under ~/.pi/agent/. Note: extension symlinks are created by
# entrypoint-user.sh on first start, so we test by running the entry
# point chain (not just `docker run --entrypoint=""`).
if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v pi" >/dev/null 2>&1; then
  run "pi"                       "pi --version"
  run "pi-toolkit clone"         "test -d /opt/pi-toolkit && git -C /opt/pi-toolkit rev-parse --short HEAD"
  run "pi-extensions clone"      "test -d /opt/pi-extensions && git -C /opt/pi-extensions rev-parse --short HEAD"

  # Run the full entrypoint as developer to verify install.sh deployment.
  # Spin up a long-running container so we can `docker exec` into it from
  # the host — the `run` helper above invokes commands INSIDE the image
  # and has no docker CLI to nest with.
  CID=$(docker run -d --rm "$IMAGE" tail -f /dev/null)
  trap 'docker rm -f "$CID" >/dev/null 2>&1 || true' EXIT

  # Wait for entrypoint-user.sh to finish deploying pi-toolkit + extensions.
  # Marker: keybindings.json symlink lands once pi-toolkit/install.sh has run.
  # Up to 30s — omos-with-pi has more setup work than base+pi.
  for _ in $(seq 1 30); do
    if docker exec "$CID" test -L /home/developer/.pi/agent/keybindings.json 2>/dev/null; then
      break
    fi
    sleep 1
  done

  exec_test() {
    local label="$1"; shift
    local out
    if out=$(docker exec -u developer "$CID" sh -c "$*" 2>&1); then
      pass "$label ($(echo "$out" | head -1))"
    else
      fail "$label: $out"
    fi
  }

  exec_test "~/.pi/agent/keybindings.json (pi-toolkit)" \
            'test -L $HOME/.pi/agent/keybindings.json && echo ok'
  exec_test "~/.pi/agent/extensions/*.ts ≥ 4 (pi-extensions)" \
            'count=$(ls -1 $HOME/.pi/agent/extensions/*.ts 2>/dev/null | wc -l); [ $count -ge 4 ] && echo "$count extensions"'
  exec_test "~/.pi/agent/extensions/mempalace.ts (bridge)" \
            'test -L $HOME/.pi/agent/extensions/mempalace.ts && echo ok'
  exec_test "~/.pi/agent/settings.json (template bootstrap)" \
            'test -f $HOME/.pi/agent/settings.json && echo ok'

  docker rm -f "$CID" >/dev/null 2>&1 || true
  trap - EXIT
else
  echo "  - pi not installed (INSTALL_PI=false)"
fi

# bun: only in the omos and omos-with-pi variants
if [ "$VARIANT" = "omos" ] || [ "$VARIANT" = "omos-with-pi" ]; then
  run "bun (omos)"            "bun --version"
  run "bunx symlink (omos)"   "test -L /usr/local/bin/bunx && readlink /usr/local/bin/bunx"
  # oh-my-opencode-slim is npm-installed globally (not a bun install);
  # verify it shows up in the global module list. We must explicitly point
  # npm at the system prefix (/usr) here: the image's NPM_CONFIG_PREFIX env
  # is set to /home/developer/.pi/npm-global so user-installed packages
  # land on the persistent volume — which means a default `npm ls -g`
  # queries the user prefix and would miss the baked binaries even though
  # they're correctly on PATH at /usr/bin.
  run "oh-my-opencode-slim"   "NPM_CONFIG_PREFIX=/usr npm ls -g --depth=0 2>/dev/null | grep oh-my-opencode-slim"
else
  if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v bun" >/dev/null 2>&1; then
    fail "bun should NOT be in base image but was found"
  else
    pass "bun correctly absent from base image"
  fi
fi

echo
echo "-- Entrypoint behaviour --"

# Generate-config script exists and has valid syntax.
run "generate-config.py exists" \
    "test -x /usr/local/lib/opencode-devbox/generate-config.py && python3 -m py_compile /usr/local/lib/opencode-devbox/generate-config.py && echo ok"

# Entrypoint drops to developer user and runs a trivial command.
# Writes the result to a file inside the container so we don't have to
# disentangle entrypoint log output from command stdout on the host.
label="entrypoint drops to developer"
tmpout=$(mktemp)
if docker run --rm -e OPENCODE_PROVIDER= "$IMAGE" \
    sh -c 'whoami > /tmp/who && cat /tmp/who' > "$tmpout" 2>/dev/null; then
  # The last line of stdout is the whoami output. Entrypoint log lines
  # (MemPalace init, "Adjusted developer UID", etc.) go to stderr or
  # get printed before our sh command runs.
  actual=$(tail -1 "$tmpout" | tr -d '[:space:]')
  if [ "$actual" = "developer" ]; then
    pass "$label"
  else
    fail "$label: expected 'developer', got '$actual' (full output: $(cat "$tmpout"))"
  fi
else
  fail "$label: container failed"
fi
rm -f "$tmpout"

# Config generation with anthropic provider writes valid JSONC with the
# expected shape. The script's log message goes to stderr (line 1 of
# generate-config.py uses file=sys.stderr) so capturing only stdout
# gives us clean JSONC. We strip // comments before validating JSON.
label="generate-config produces valid opencode.jsonc"
tmp=$(mktemp -d)
if docker run --rm \
    -e OPENCODE_PROVIDER=anthropic \
    -e HOME=/tmp/home \
    --entrypoint="" \
    "$IMAGE" sh -c '
      mkdir -p /tmp/home
      python3 /usr/local/lib/opencode-devbox/generate-config.py 2>/dev/null
      cat /tmp/home/.config/opencode/opencode.jsonc
    ' > "$tmp/out.jsonc" 2>/dev/null; then
  # Strip single-line // comments for JSON validation (respecting strings)
  if python3 -c "
import re, json, sys
text = open('$tmp/out.jsonc').read()
# Match either a string literal or a // comment; keep strings, drop comments
pattern = r'\"(?:\\\\.|[^\"\\\\])*\"|//[^\n]*'
stripped = re.sub(pattern, lambda m: m.group(0) if m.group(0).startswith('\"') else '', text)
c = json.loads(stripped)
assert c['model'].startswith('anthropic/'), c
assert c['autoupdate'] is False
assert c['share'] == 'disabled'
assert 'context7' in c.get('mcp', {}), 'context7 MCP not registered'
" 2>&1; then
    pass "$label"
  else
    fail "$label: output doesn't match expected shape: $(cat "$tmp/out.jsonc")"
  fi
else
  fail "$label: container failed: $(cat "$tmp/out.jsonc")"
fi

# Config generation is idempotent — running twice must not overwrite.
# Tests both legacy .json and new .jsonc detection.
label="generate-config never overwrites existing config"
if docker run --rm \
    -e OPENCODE_PROVIDER=anthropic \
    -e HOME=/tmp/home \
    --entrypoint="" \
    "$IMAGE" sh -c '
      mkdir -p /tmp/home/.config/opencode
      echo "{\"sentinel\": \"user-config\"}" > /tmp/home/.config/opencode/opencode.json
      python3 /usr/local/lib/opencode-devbox/generate-config.py 2>/dev/null
      cat /tmp/home/.config/opencode/opencode.json
    ' 2>/dev/null | grep -q '"sentinel": "user-config"'; then
  pass "$label"
else
  fail "$label: existing config was modified!"
fi
rm -rf "$tmp"

echo
echo "-- Image size --"
SIZE_BYTES=$(docker image inspect --format='{{.Size}}' "$IMAGE")
SIZE_MB=$((SIZE_BYTES / 1024 / 1024))
echo "  Uncompressed size: ${SIZE_MB} MB"

# Thresholds (uncompressed): base 2500 MB, omos 3300 MB, with-pi adds ~150 MB.
# omos bumped 3000→3200 on v1.14.31c — mempalace-toolkit bake-in pushed the
# baseline; bumped 3200→3300 on v1.15.0 — opencode 1.15.0 came in at
# 3206 MB, leaving zero headroom for routine apt-get upgrade drift.
# omos variant to ~3.1 GB. Functional smoke checks all pass; this is a
# guardrail, not a performance limit.
THRESHOLD=2500
[ "$VARIANT" = "omos" ] && THRESHOLD=3300
[ "$VARIANT" = "with-pi" ] && THRESHOLD=2700
[ "$VARIANT" = "omos-with-pi" ] && THRESHOLD=3500
if [ "$SIZE_MB" -gt "$THRESHOLD" ]; then
  fail "image size ${SIZE_MB} MB exceeds threshold ${THRESHOLD} MB for variant=$VARIANT"
else
  pass "image size ${SIZE_MB} MB within threshold ${THRESHOLD} MB"
fi

echo
if [ "$FAILED" -gt 0 ]; then
  echo "=== FAILED: $FAILED check(s) ===" >&2
  exit 1
fi
echo "=== PASSED ==="