joakimp
30094782df
v1.8.11 linked cli_utils' bin/ COMMANDS onto PATH and stopped there. Nothing ever
sourced cli_utils.sh, so its 14 FUNCTIONS were missing from every interactive shell
whose $HOME has no zsh rc -- which is the normal case, not an edge case: the
container's interactive shell is bash and zsh is not installed in the image. A
symlink cannot carry a shell function and a function cannot be reached from a
non-interactive shell, so the two mechanisms are disjoint and both are required.
The image was already paying this layer's dependency cost (fzf, bat, fd, rg, jq are
baked partly FOR these functions) while delivering none of its benefit.
The two changes ship together because they are coupled: portcheck is one of the 14,
and it was a hard stub in every image up to v1.8.11 -- neither ss nor ip nor lsof
nor netstat was present, so it printed "portcheck requires at least one of: ss,
lsof, netstat" and exited. Wiring the functions in without iproute2 would have
shipped a visibly broken one.
MEASURED, not assumed:
- the loader is bash-safe despite the *.zsh filenames: `bash --noprofile --norc`
exits 0, defines all 14, and they run (pathls, mkcd, up, extract, agents-sync,
fhist verified). The tree's one zsh-only construct (print -z in fzf/fhist.zsh)
is already guarded by [[ -n $ZSH_VERSION ]] with a bash fallback.
- fresh-$HOME seeding resolves 14/14; CLI_UTILS_SOURCE=0 is honoured; an absent
checkout is a genuinely silent no-op (no output, no leaked _cu).
- interactive shell startup 12 ms -> 17 ms.
- iproute2 is ~5.5 MB (4.2 MB itself + 6 libs under --no-install-recommends;
libpam-cap is a Recommends and correctly dropped). ss lands at /usr/bin/ss,
ip at /usr/sbin/ip, both already on the developer PATH, and `portcheck --all`
then correctly identifies the socat listener on 8765.
- hadolint clean on both Dockerfiles; repo-wide shellcheck -S error and bash -n
clean. .bash_aliases is outside CI's discovery (no shebang, not *.sh), so it
was checked by hand with -s bash at error AND warning level.
Named explicitly per this repo's floating-ref rule: /workspace/cli_utils is a HOST
BIND MOUNT, not a pinned ref, so the image now executes unpinned content in every
interactive shell. Errors are left visible rather than sent to /dev/null so that a
future zsh-only file in that repo is diagnosable rather than mysterious, and
CLI_UTILS_SOURCE=0 is the documented escape hatch. It is deliberately independent
of CLI_UTILS_LINK=0: the two disable independent mechanisms.
Deployment: needs a rebuild AND a recreate. $HOME is the container's writable layer
rather than a named volume (verified -- ~/.bash_aliases carries the container start
mtime while ~/.bashrc carries the image's), so the skel file is re-seeded on every
recreate; a host-bind-mounted ~/.bash_aliases is still never overwritten.
189 lines
9.2 KiB
Bash
189 lines
9.2 KiB
Bash
# opencode-devbox bash aliases and customizations
|
|
# Sourced by the Debian-default ~/.bashrc on shell startup.
|
|
# To override, bind-mount your host's ~/.bash_aliases over this file
|
|
# via docker-compose.yml.
|
|
|
|
# ── Host-shared shell customizations (devbox-shell bridge) ───────────
|
|
# If the host bind-mounts a directory at ~/.config/devbox-shell/ (the
|
|
# recommended pattern for sharing aliases/PATH/utilities between host
|
|
# and container), source the bash_aliases file from it. This survives
|
|
# --force-recreate because it's baked into the image's skel, not the
|
|
# container's writable layer. Hosts that don't use this pattern are
|
|
# unaffected — the test silently skips if the file doesn't exist.
|
|
[ -r "$HOME/.config/devbox-shell/bash_aliases" ] && . "$HOME/.config/devbox-shell/bash_aliases"
|
|
|
|
# ── History persistence and quality ──────────────────────────────────
|
|
# The named volume devbox-shell-history is mounted at ~/.cache/bash
|
|
# so history survives container recreation.
|
|
export HISTFILE="${HOME}/.cache/bash/history"
|
|
mkdir -p "$(dirname "$HISTFILE")" 2>/dev/null || true
|
|
|
|
# Large, time-stamped, deduplicated history. Append rather than overwrite.
|
|
export HISTSIZE=100000
|
|
export HISTFILESIZE=200000
|
|
export HISTCONTROL=ignoreboth:erasedups
|
|
export HISTTIMEFORMAT='%F %T '
|
|
shopt -s histappend 2>/dev/null
|
|
shopt -s cmdhist 2>/dev/null
|
|
# Note: PROMPT_COMMAND="history -a" is installed LATER in this file,
|
|
# after zoxide's init runs. Installing it here would create a
|
|
# "history -a;;__zoxide_hook" chain because zoxide's init uses ';'
|
|
# as its separator and prepends itself; two adjacent ';' breaks the
|
|
# parser. See https://github.com/ajeetdsouza/zoxide/issues/722.
|
|
|
|
# ── Common aliases ───────────────────────────────────────────────────
|
|
# Prefer eza (modern ls) when available
|
|
if command -v eza >/dev/null 2>&1; then
|
|
alias ls='eza --group-directories-first'
|
|
alias ll='eza -lh --group-directories-first --git'
|
|
alias la='eza -lha --group-directories-first --git'
|
|
alias tree='eza --tree'
|
|
else
|
|
alias ll='ls -lh'
|
|
alias la='ls -lha'
|
|
fi
|
|
|
|
# Prefer bat (syntax-highlighted cat) when available
|
|
if command -v bat >/dev/null 2>&1; then
|
|
alias cat='bat --style=plain --paging=never'
|
|
alias less='bat --paging=always'
|
|
fi
|
|
|
|
# Git shortcuts
|
|
alias gs='git status'
|
|
alias gd='git diff'
|
|
alias gl='git log --oneline --graph --decorate -20'
|
|
|
|
# ── Host SSH reachability check (once per container lifetime) ───────────────
|
|
# Warns at first shell startup if the Mac host is not reachable via SSH.
|
|
# Only runs inside a container, only if the jump key exists, and only once
|
|
# per container lifetime (/tmp flag is cleared on recreate).
|
|
_devbox_check_host_ssh() {
|
|
[ -f "/.dockerenv" ] || return 0
|
|
local ssh_cfg="$HOME/.ssh-local/config"
|
|
[ -f "$ssh_cfg" ] || return 0
|
|
local key_pub="$HOME/.ssh-local/devbox_jump_ed25519.pub"
|
|
[ -f "$key_pub" ] || return 0
|
|
local flag="/tmp/.devbox_host_ssh_ok"
|
|
[ -f "$flag" ] && return 0
|
|
if ssh -F "$ssh_cfg" \
|
|
-o BatchMode=yes \
|
|
-o ConnectTimeout=2 \
|
|
-o StrictHostKeyChecking=accept-new \
|
|
mac true 2>/dev/null; then
|
|
touch "$flag"
|
|
return 0
|
|
fi
|
|
local pub_key
|
|
pub_key=$(cat "$key_pub")
|
|
printf '\n\033[1;33m⚠ devbox: Mac host not reachable via SSH\033[0m\n'
|
|
printf ' Some tools use SSH to run commands on the Mac host.\n'
|
|
printf ' Fix (run both on the Mac):\n\n'
|
|
printf ' \033[1mStep 1\033[0m System Settings → General → Sharing → Remote Login → ON\n\n'
|
|
printf ' \033[1mStep 2\033[0m echo '"'"'%s'"'"' >> ~/.ssh/authorized_keys\n' "$pub_key"
|
|
printf '\n Then open a new shell in the container to verify.\n\n'
|
|
}
|
|
_devbox_check_host_ssh
|
|
unset -f _devbox_check_host_ssh
|
|
|
|
# ── LAN access via the host (dssh) ───────────────────────────────────
|
|
# When running on a VM-backed host (macOS OrbStack / Docker Desktop), the
|
|
# entrypoint's setup-lan-access.sh generates ~/.ssh-local/config so the host
|
|
# can be used as an SSH jump to reach LAN peers. These aliases wrap `ssh -F`
|
|
# / `scp -F` against that config. Guarded so they only appear when the config
|
|
# was actually generated (no-op / absent on native Linux hosts).
|
|
if [ -r "$HOME/.ssh-local/config" ]; then
|
|
alias dssh='ssh -F "$HOME/.ssh-local/config"'
|
|
alias dscp='scp -F "$HOME/.ssh-local/config"'
|
|
fi
|
|
|
|
# Safety: confirm before destructive ops
|
|
alias rm='rm -i'
|
|
alias mv='mv -i'
|
|
alias cp='cp -i'
|
|
|
|
# ── Shell integrations ───────────────────────────────────────────────
|
|
# zoxide — smarter cd. Use 'z <fragment>' to jump to previously-visited dirs.
|
|
if command -v zoxide >/dev/null 2>&1; then
|
|
eval "$(zoxide init bash)"
|
|
fi
|
|
|
|
# fzf — fuzzy finder key bindings (Ctrl-R for history, Ctrl-T for files).
|
|
# We install fzf from GitHub releases (not apt), so sourcing from the
|
|
# apt-path /usr/share/doc/fzf/examples/* would find nothing. Use the
|
|
# binary's own --bash flag (available since fzf 0.48) for setup.
|
|
if command -v fzf >/dev/null 2>&1; then
|
|
eval "$(fzf --bash)" 2>/dev/null || true
|
|
fi
|
|
|
|
# cli_utils — shell FUNCTIONS (fgit, fhist, fssh, portcheck, up, mkcd, extract,
|
|
# agents-sync, …). This is the OTHER HALF of the cli_utils wiring, and until
|
|
# v1.8.11 the image shipped only one half. entrypoint-user.sh symlinks the repo's
|
|
# bin/ COMMANDS into ~/.local/bin, which is what makes them resolve in
|
|
# NON-interactive shells (docker exec, agent tool shells, scripts). A symlink
|
|
# cannot carry a shell function, and a function cannot be reached from a
|
|
# non-interactive shell, so the two mechanisms are disjoint and both are
|
|
# required. Nothing sourced the loader: measured 2026-08-30 on v1.8.11, all 14
|
|
# functions were simply missing on a device whose $HOME has no zsh rc — which is
|
|
# the normal case, since the container's interactive shell is bash and zsh is not
|
|
# installed in the image. The image was already paying this layer's dependency
|
|
# cost (fzf, bat, fd, rg, jq are all baked partly FOR these functions) while
|
|
# delivering none of its benefit.
|
|
#
|
|
# Detection order deliberately mirrors the symlink block in entrypoint-user.sh so
|
|
# that commands and functions can never come from two different clones.
|
|
# CLI_UTILS_SOURCE=0 opts out. That is independent of CLI_UTILS_LINK=0 on purpose:
|
|
# they disable independent mechanisms, and someone who wants PATH commands
|
|
# without 14 extra functions in every prompt (or vice versa) should be able to
|
|
# say so.
|
|
#
|
|
# THE LOADER IS BASH-SAFE, MEASURED, NOT ASSUMED: despite every function file
|
|
# being named *.zsh, sourcing cli_utils.sh under `bash --noprofile --norc` exits
|
|
# 0 with no errors and defines all 14, and they run (pathls, mkcd, up, extract,
|
|
# agents-sync, fhist all verified). The single zsh-only construct in the tree
|
|
# (`print -z` in fzf/fhist.zsh) is already guarded by [[ -n $ZSH_VERSION ]] with
|
|
# a bash fallback, and the loader's own header states "bash & zsh compatible".
|
|
# ACCEPTED RISK, stated plainly: /workspace/cli_utils is a HOST BIND MOUNT, so
|
|
# unlike a pinned git ref this content floats outside the image's control. A
|
|
# future cli_utils commit that adds a genuinely zsh-only file would surface as
|
|
# parse errors at every prompt on every device. Errors are left VISIBLE rather
|
|
# than sent to /dev/null so that failure is diagnosable instead of mysterious,
|
|
# and CLI_UTILS_SOURCE=0 is the documented one-line escape hatch.
|
|
if [ "${CLI_UTILS_SOURCE:-1}" != "0" ]; then
|
|
for _cu in "${CLI_UTILS_CONTAINER_PATH:-}" /workspace/cli_utils "$HOME/cli_utils" /workspace/*/cli_utils; do
|
|
[ -n "$_cu" ] || continue
|
|
if [ -r "$_cu/cli_utils.sh" ]; then
|
|
. "$_cu/cli_utils.sh" || true
|
|
break
|
|
fi
|
|
done
|
|
unset _cu
|
|
fi
|
|
|
|
# ── PROMPT_COMMAND: flush history every prompt ───────────────────────
|
|
# Installed AFTER zoxide init so zoxide's hook is already in place;
|
|
# we append with a newline separator to avoid the ';;' parse error
|
|
# described at the top of this file. Guarded so repeated sourcing
|
|
# (e.g. `exec bash`) doesn't stack duplicates.
|
|
#
|
|
# The guard MUST stay shell-local (NOT exported): if it leaks into child
|
|
# processes, every nested shell -- crucially each tmux pane, which inherits
|
|
# the tmux server's env -- skips installing `history -a` and only persists
|
|
# history on a clean exit. Abrupt termination (docker stop, tmux kill-server,
|
|
# SIGKILL) then loses that shell's in-memory history. Keeping it unexported
|
|
# means each new interactive shell re-installs its own per-prompt flush.
|
|
if [ -z "${DEVBOX_HIST_SET:-}" ]; then
|
|
PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND$'\n'}history -a"
|
|
DEVBOX_HIST_SET=1
|
|
fi
|
|
|
|
# ── Prompt: show [opencode-devbox] tag so it's obvious you're in the container
|
|
# Preserves the default Debian PS1 logic but prefixes with a container marker.
|
|
# We check for the literal '[devbox]' substring in PS1 rather than relying on
|
|
# an exported guard variable — otherwise `exec bash` inherits the guard but
|
|
# gets a fresh (prefix-less) PS1 from .bashrc, and the prefix would never be
|
|
# re-added in the new shell.
|
|
if [ -n "${PS1:-}" ] && [[ "$PS1" != *"[devbox]"* ]]; then
|
|
PS1='\[\e[38;5;39m\][devbox]\[\e[0m\] '"${PS1}"
|
|
fi
|