fix: bake support utils and allowScripts into image, drop first-run patches

install-browser/install-openspec/validate.sh/browser-state-cleanup are
immutable user tools — created at build time as symlinks in
~/.local/bin so they survive rebuilds (previously first-run-only,
lost whenever the writable image layer was recreated).

pi-coding-agent allowScripts is now declared upstream in the lpb fork
(localpibox/pi packages/coding-agent/package.json), so the build just
verifies it via a FATAL grep guard instead of patching post-install.

Author: localpibox

Dockerfile

@@ -145,6 +145,8 @@ RUN set -eux; \
       || (echo "FATAL: Case 4 patch missing from pi-ai" && exit 1); \
     grep -rq 'qwen-chat-template' /home/lpb/.npm-global/lib/node_modules/@earendil-works/pi-ai/dist/ \
       || (echo "FATAL: Qwen reasoning_effort patch missing" && exit 1); \
+    grep -rq 'allowScripts' /home/lpb/.npm-global/lib/node_modules/@earendil-works/pi-coding-agent/package.json \
+      || (echo "FATAL: pi-coding-agent allowScripts missing (regression in pi fork)" && exit 1); \
     ls -la /home/lpb/.npm-global/bin/; \
     rm -rf /opt/pi-src/.git /opt/pi-src/src /opt/pi-src/test /opt/pi-src/tests
 
@@ -178,8 +180,18 @@ COPY lpb.conf.env /opt/devstack/lpb.conf.env
 COPY lpb.stack.env /opt/devstack/lpb.stack.env
 COPY --chmod=755 support/entrypoint-cli.sh /opt/devstack/entrypoint-cli.sh
 
+# ── User-facing support utilities (baked, not first-run) ────────────────
+# These are immutable tools users invoke from PATH; they live in the image
+# layer so they survive rebuilds/recreates. Symlinks are created here (as
+# lpb) rather than at container first-run — ~/.local/bin is not a mount, so
+# a first-run-only ln would vanish on the next rebuild.
+RUN mkdir -p /home/lpb/.local/bin \
+    && ln -sf /opt/devstack/install-browser.sh /home/lpb/.local/bin/install-browser.sh \
+    && ln -sf /opt/devstack/validate.sh /home/lpb/.local/bin/validate.sh \
+    && ln -sf /opt/pi-support/install-openspec.sh /home/lpb/.local/bin/install-openspec.sh \
+    && ln -sf /opt/pi-support/browser-state-cleanup.sh /home/lpb/.local/bin/browser-state-cleanup.sh
+
 # ── Shell PATH helper ───────────────────────────────────────────────────────
-RUN mkdir -p /home/lpb/.local/bin
 COPY --chmod=755 support/lpb-config /home/lpb/.local/bin/lpb-config
 
 # ── Root operations: ownership + gitconfig + shell PATH ─────────────────────

support/start.sh

@@ -334,26 +334,6 @@ if [[ "$FIRST_RUN" = "true" ]]; then
     printf 'allow-scripts=better-sqlite3\nallow-scripts=agent-browser\nallow-scripts=esbuild\nallow-scripts=protobufjs\nallow-scripts=@google/genai\n' > "${AGENT_DIR}/git/.npmrc" 2>/dev/null || true
     printf 'allow-scripts=better-sqlite3\nallow-scripts=agent-browser\nallow-scripts=esbuild\nallow-scripts=protobufjs\nallow-scripts=@google/genai\n' > "${HOME_DIR}/.npmrc" 2>/dev/null || true
 
-    # Fix pi-coding-agent package.json to include allowScripts
-    # so native addon npm install scripts are not blocked
-    PI_PKG="${HOME_DIR}/.npm-global/lib/node_modules/@earendil-works/pi-coding-agent/package.json"
-    if [[ -f "$PI_PKG" ]]; then
-        # Try jq first, fallback to python
-        if command -v jq &>/dev/null; then
-            jq '. += {"allowScripts": {"better-sqlite3": true, "agent-browser": true, "esbuild": true, "protobufjs": true, "@google/genai": true}}' "$PI_PKG" > "${PI_PKG}.tmp" && mv "${PI_PKG}.tmp" "$PI_PKG"
-        else
-            python3 -c "
-import json, sys
-with open(sys.argv[1]) as f: pkg = json.load(f)
-pkg.setdefault('allowScripts', {})
-for p in ['better-sqlite3','agent-browser','esbuild','protobufjs','@google/genai']:
-    pkg['allowScripts'][p] = True
-with open(sys.argv[1], 'w') as f: json.dump(pkg, f, indent=2)
-" "$PI_PKG"
-        fi
-        info "Patched pi-coding-agent package.json with allowScripts."
-    fi
-
     # ── Config repo: clone/fetch into ~/.pi/agent/ (runs every boot — see §4a)
     touch "${HOME_DIR}/.pi/.initialized"
 
@@ -382,25 +362,6 @@ with open(sys.argv[1], 'w') as f: json.dump(pkg, f, indent=2)
         fi
     fi
 
-    # ── Symlink user-facing support utilities to ~/.local/bin/ ────────────
-    # These scripts are installed into the image at build time but need to
-    # be accessible from the user's PATH. ~/.local/bin/ is already in PATH
-    # (see line 77), so symlinks here make them available as commands.
-    LOCAL_BIN="${HOME_DIR}/.local/bin"
-    mkdir -p "$LOCAL_BIN"
-    for _src in \
-        /opt/devstack/install-browser.sh \
-        /opt/devstack/validate.sh \
-        /opt/pi-support/install-openspec.sh \
-        /opt/pi-support/browser-state-cleanup.sh \
-    ; do
-        if [[ -f "$_src" ]]; then
-            _name="$(basename "$_src")"
-            ln -sf "$_src" "${LOCAL_BIN}/${_name}"
-            info "Linked utility: ${_name} → ${_src}"
-        fi
-    done
-
     info "First run bootstrap complete."
 fi