opencode-devbox/scripts/smoke-test.sh

#!/usr/bin/env bash
# Smoke-test a freshly-built opencode-devbox image.
#
# Verifies:
#   - Core binaries are on PATH and runnable
#   - opencode itself starts and prints a version
#   - Entrypoint runs cleanly as non-root after UID adjustment
#   - Generated opencode.json has the expected shape
#   - MCP wrapper works (when mempalace is installed)
#
# Usage: ./scripts/smoke-test.sh <image> [--variant base|omos]
#
# Exit codes:
#   0  all checks passed
#   1  one or more checks failed

set -euo pipefail

IMAGE="${1:-}"
VARIANT="base"
if [ "${2:-}" = "--variant" ]; then
  VARIANT="${3:-base}"
fi

if [ -z "$IMAGE" ]; then
  echo "usage: $0 <image> [--variant base|omos]" >&2
  exit 2
fi

FAILED=0
pass() { echo "  ✓ $1"; }
fail() { echo "  ✗ $1" >&2; FAILED=$((FAILED + 1)); }
warn() { echo "  ⚠ $1" >&2; }

# Registration assertions for fork/recall were removed in v2.0.0 along with
# pi. STRICT_REGISTRATION is retained as an inert env var for backward
# compatibility with any external caller that still sets it; it has no
# effect now that no pi packages are deployed.
STRICT_REGISTRATION="${STRICT_REGISTRATION:-0}"

run() {
  # Run a command inside the image and capture its output.
  # First arg is a label, rest is the shell command.
  local label="$1"; shift
  local out
  if out=$(docker run --rm --entrypoint="" "$IMAGE" sh -c "$*" 2>&1); then
    pass "$label ($(echo "$out" | head -1))"
  else
    fail "$label: $out"
  fi
}

# Stricter version of `run` that also asserts an expected substring in
# the command's stdout. Used to catch the "image bytes silently identical
# to previous release" class of regression — Docker layer-cache hit on
# a bare `npm install -g <pkg>` (or @latest) because the build-arg
# string is identical across builds, even when 'latest' would have
# resolved differently. Discovered in pi-devbox 2026-05-23 (every
# release v0.74.0..v0.75.5 shipped the same image bytes); preventatively
# applied here for PI_VERSION + OMOS_VERSION.
run_expect() {
  local label="$1"; local cmd="$2"; local expect="$3"
  local out
  out=$(docker run --rm --entrypoint="" "$IMAGE" sh -c "$cmd" 2>&1) || true
  if echo "$out" | grep -Fq "$expect"; then
    pass "$label (got $expect)"
  else
    fail "$label — expected substring '$expect', got: $out"
  fi
}

echo "=== Smoke test: $IMAGE (variant: $VARIANT) ==="
echo
echo "-- Resolved component versions --"
# Prints the actual version of every floating component so CI logs
# always record what got baked into this image, even when Dockerfile
# ARGs default to "latest".
docker run --rm --entrypoint="" "$IMAGE" sh -c '
  if command -v opencode >/dev/null 2>&1; then
    printf "  %-15s %s\n" "opencode"      "$(opencode --version 2>&1 | head -1)"
  fi
  printf "  %-15s %s\n" "node"          "$(node --version)"
  printf "  %-15s %s\n" "npm"           "$(npm --version)"
  printf "  %-15s %s\n" "nvim"          "$(nvim --version | head -1)"
  printf "  %-15s %s\n" "bat"           "$(bat --version)"
  printf "  %-15s %s\n" "eza"           "$(eza --version | head -2 | tail -1)"
  printf "  %-15s %s\n" "zoxide"        "$(zoxide --version)"
  printf "  %-15s %s\n" "uv"            "$(uv --version)"
  printf "  %-15s %s\n" "fzf"           "$(fzf --version)"
  printf "  %-15s %s\n" "fd"            "$(fd --version)"
  printf "  %-15s %s\n" "rg"            "$(rg --version | head -1)"
  printf "  %-15s %s\n" "gosu"          "$(gosu --version)"
  printf "  %-15s %s\n" "git-lfs"       "$(git-lfs --version)"
  printf "  %-15s %s\n" "git-crypt"     "$(git-crypt --version 2>&1 | head -1)"
  printf "  %-15s %s\n" "gitleaks"      "$(gitleaks version 2>&1 | head -1)"
  printf "  %-15s %s\n" "gitea-mcp"     "$(gitea-mcp --version 2>&1 | head -1)"
  printf "  %-15s %s\n" "aws"           "$(aws --version 2>&1)"
  if command -v bun >/dev/null 2>&1; then
    printf "  %-15s %s\n" "bun"         "$(bun --version)"
  fi
  if command -v mempalace >/dev/null 2>&1; then
    printf "  %-15s %s\n" "mempalace"   "$(mempalace --version 2>&1 | head -1 || echo installed)"
  fi
  if command -v mempalace-session >/dev/null 2>&1 && [ -d /opt/mempalace-toolkit ]; then
    printf "  %-15s %s\n" "toolkit"     "$(git -C /opt/mempalace-toolkit rev-parse --short HEAD 2>/dev/null || echo installed)"
  fi
'
echo
echo "-- Core binaries --"
# opencode is gated on INSTALL_OPENCODE=true (default). When absent, the
# image is a pure base with no harness at all.
if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v opencode" >/dev/null 2>&1; then
  run "opencode"          "opencode --version"
else
  echo "  - opencode not installed (INSTALL_OPENCODE=false)"
fi
run "node"              "node --version"
run "npm"               "npm --version"
run "git"               "git --version"
run "nvim"              "nvim --version | head -1"
run "bat"               "bat --version"
run "eza"               "eza --version | head -1"
run "zoxide"            "zoxide --version"
run "uv"                "uv --version"
run "uvx"               "uvx --version"
run "rustup-init"       "rustup-init --version"
run "fzf"               "fzf --version"
run "fd"                "fd --version"
run "rg"                "rg --version | head -1"
run "jq"                "jq --version"
run "git-crypt"         "git-crypt --version | head -1"
run "gitleaks"          "gitleaks version"
run "aws"               "aws --version"
run "gitea-mcp"         "gitea-mcp --version"
run "gosu"              "gosu --version"
run "tmux"              "tmux -V"

# SSH ControlMaster baked defaults: the config file must exist (image-level)
# and ssh -G must report ControlPath rooted at /tmp/sshcm/ for an arbitrary
# host. Catches both regressions: someone removing the conf file, OR something
# else later in the config chain shadowing the ControlPath setting.
run        "ssh-config-cm-file"  "test -f /etc/ssh/ssh_config.d/00-devbox-controlmaster.conf"
run_expect "ssh-config-cm-path"  "ssh -G example.invalid 2>/dev/null | grep -i ^controlpath" "/tmp/sshcm/"

echo
echo "-- Optional / variant-gated --"
# mempalace: present unless built with INSTALL_MEMPALACE=false
if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v mempalace" >/dev/null 2>&1; then
  run "mempalace"             "mempalace --help | head -1"
  run "mempalace-mcp"         "test -x /usr/local/bin/mempalace-mcp && readlink /usr/local/bin/mempalace-mcp"
else
  echo "  - mempalace not installed (INSTALL_MEMPALACE=false)"
fi

# mempalace-toolkit wrappers: present unless built with INSTALL_MEMPALACE_TOOLKIT=false
# Gated on mempalace presence — wrappers are useless without the CLI.
if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v mempalace && command -v mempalace-session" >/dev/null 2>&1; then
  run "mempalace-session (toolkit)" "mempalace-session --help | head -1"
  run "mempalace-docs (toolkit)"    "mempalace-docs --help | head -1"
  run "toolkit symlink target"      "test -L /usr/local/bin/mempalace-session && readlink /usr/local/bin/mempalace-session"
elif docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v mempalace" >/dev/null 2>&1; then
  echo "  - mempalace-toolkit not installed (INSTALL_MEMPALACE_TOOLKIT=false)"
fi

# bun: only in the omos variant
if [ "$VARIANT" = "omos" ]; then
  run "bun (omos)"            "bun --version"
  run "bunx symlink (omos)"   "test -L /usr/local/bin/bunx && readlink /usr/local/bin/bunx"
  # oh-my-opencode-slim is npm-installed globally (not a bun install);
  # verify it shows up in the global module list. We must explicitly point
  # npm at the system prefix (/usr) here: the image's NPM_CONFIG_PREFIX env
  # is set to /home/developer/.config/opencode/npm-global so user-installed
  # packages
  # land on the persistent volume — which means a default `npm ls -g`
  # queries the user prefix and would miss the baked binaries even though
  # they're correctly on PATH at /usr/bin.
  run "oh-my-opencode-slim"   "NPM_CONFIG_PREFIX=/usr npm ls -g --depth=0 2>/dev/null | grep oh-my-opencode-slim"
  if [ -n "${EXPECTED_OMOS_VERSION:-}" ]; then
    run_expect "omos version matches build-arg" \
               "NPM_CONFIG_PREFIX=/usr npm ls -g --depth=0 2>/dev/null | grep oh-my-opencode-slim" \
               "$EXPECTED_OMOS_VERSION"
  fi
else
  if docker run --rm --entrypoint="" "$IMAGE" sh -c "command -v bun" >/dev/null 2>&1; then
    fail "bun should NOT be in base image but was found"
  else
    pass "bun correctly absent from base image"
  fi
fi

echo
echo "-- Entrypoint behaviour --"

# Generate-config script exists and has valid syntax.
run "generate-config.py exists" \
    "test -x /usr/local/lib/opencode-devbox/generate-config.py && python3 -m py_compile /usr/local/lib/opencode-devbox/generate-config.py && echo ok"

# Entrypoint drops to developer user and runs a trivial command.
# Writes the result to a file inside the container so we don't have to
# disentangle entrypoint log output from command stdout on the host.
label="entrypoint drops to developer"
tmpout=$(mktemp)
if docker run --rm -e OPENCODE_PROVIDER= "$IMAGE" \
    sh -c 'whoami > /tmp/who && cat /tmp/who' > "$tmpout" 2>/dev/null; then
  # The last line of stdout is the whoami output. Entrypoint log lines
  # (MemPalace init, "Adjusted developer UID", etc.) go to stderr or
  # get printed before our sh command runs.
  actual=$(tail -1 "$tmpout" | tr -d '[:space:]')
  if [ "$actual" = "developer" ]; then
    pass "$label"
  else
    fail "$label: expected 'developer', got '$actual' (full output: $(cat "$tmpout"))"
  fi
else
  fail "$label: container failed"
fi
rm -f "$tmpout"

# Config generation with anthropic provider writes valid JSONC with the
# expected shape. The script's log message goes to stderr (line 1 of
# generate-config.py uses file=sys.stderr) so capturing only stdout
# gives us clean JSONC. We strip // comments before validating JSON.
label="generate-config produces valid opencode.jsonc"
tmp=$(mktemp -d)
if docker run --rm \
    -e OPENCODE_PROVIDER=anthropic \
    -e HOME=/tmp/home \
    --entrypoint="" \
    "$IMAGE" sh -c '
      mkdir -p /tmp/home
      python3 /usr/local/lib/opencode-devbox/generate-config.py 2>/dev/null
      cat /tmp/home/.config/opencode/opencode.jsonc
    ' > "$tmp/out.jsonc" 2>/dev/null; then
  # Strip single-line // comments for JSON validation (respecting strings)
  if python3 -c "
import re, json, sys
text = open('$tmp/out.jsonc').read()
# Match either a string literal or a // comment; keep strings, drop comments
pattern = r'\"(?:\\\\.|[^\"\\\\])*\"|//[^\n]*'
stripped = re.sub(pattern, lambda m: m.group(0) if m.group(0).startswith('\"') else '', text)
c = json.loads(stripped)
assert c['model'].startswith('anthropic/'), c
assert c['autoupdate'] is False
assert c['share'] == 'disabled'
assert 'context7' in c.get('mcp', {}), 'context7 MCP not registered'
" 2>&1; then
    pass "$label"
  else
    fail "$label: output doesn't match expected shape: $(cat "$tmp/out.jsonc")"
  fi
else
  fail "$label: container failed: $(cat "$tmp/out.jsonc")"
fi

# Config generation is idempotent — running twice must not overwrite.
# Tests both legacy .json and new .jsonc detection.
label="generate-config never overwrites existing config"
if docker run --rm \
    -e OPENCODE_PROVIDER=anthropic \
    -e HOME=/tmp/home \
    --entrypoint="" \
    "$IMAGE" sh -c '
      mkdir -p /tmp/home/.config/opencode
      echo "{\"sentinel\": \"user-config\"}" > /tmp/home/.config/opencode/opencode.json
      python3 /usr/local/lib/opencode-devbox/generate-config.py 2>/dev/null
      cat /tmp/home/.config/opencode/opencode.json
    ' 2>/dev/null | grep -q '"sentinel": "user-config"'; then
  pass "$label"
else
  fail "$label: existing config was modified!"
fi
rm -rf "$tmp"

echo
echo "-- Image size --"
SIZE_BYTES=$(docker image inspect --format='{{.Size}}' "$IMAGE")
SIZE_MB=$((SIZE_BYTES / 1024 / 1024))
echo "  Uncompressed size: ${SIZE_MB} MB"

# Thresholds (uncompressed): base 2600 MB, omos 3300 MB.
# omos bumped 3000→3200 on v1.14.31c — mempalace-toolkit bake-in pushed the
# baseline; bumped 3200→3300 on v1.15.0 — opencode 1.15.0 came in at
# 3206 MB, leaving zero headroom for routine apt-get upgrade drift.
# base 2500→2600 on v1.15.13c — base crept to 2506 MB (LAN-access script +
# updated entrypoint + routine apt-get upgrade drift), tripping the
# deliberately zero-headroom 2500 ceiling and skipping promote-base-latest.
# omos variant to ~3.1 GB. Functional smoke checks all pass; this is a
# guardrail, not a performance limit.
# v1.16.2: all thresholds bumped +150 MB preemptively ahead of the combined
# opencode 1.15.13->1.16.2 (minor) + pi 0.78.1->0.79.0 (minor) bump. Both
# base (2506/2600) and omos (3206/3300) were sitting on ~94 MB headroom and
# a minor opencode bump has tripped them before (v1.15.0 omos). Restoring
# ~250 MB headroom avoids a partial-publish + letter-suffix recovery cycle.
# CI's smoke size print + resolved-versions table records the actual landed
# sizes; tighten later if they come in low.
THRESHOLD=2750
[ "$VARIANT" = "omos" ] && THRESHOLD=3450
if [ "$SIZE_MB" -gt "$THRESHOLD" ]; then
  fail "image size ${SIZE_MB} MB exceeds threshold ${THRESHOLD} MB for variant=$VARIANT"
else
  pass "image size ${SIZE_MB} MB within threshold ${THRESHOLD} MB"
fi

echo
if [ "$FAILED" -gt 0 ]; then
  echo "=== FAILED: $FAILED check(s) ===" >&2
  exit 1
fi
echo "=== PASSED ==="