feat: GHCR token auto-login for public image pulls

Add GHCR_TOKEN support for anonymous-free image pulls:
- lpb.py: auto-login GHCR before pull if token available
- start.sh: bake login at container start
- lpb.conf.env: GHCR_TOKEN placeholder for user config
- lpb.stack.env: GHCR_TOKEN baked into container image

How it works:
1. User creates read-only PAT: https://github.com/settings/tokens
   Scope: read:packages
2. User sets GHCR_TOKEN in .env or lpb.conf.env
3. lpb.py passes token to container
4. Container auto-logs in to GHCR
5. docker/podman pull works without manual login

Future: replace with org account for true public access

Author: localpibox

lpb.conf.env

@@ -66,6 +66,13 @@ LPB_AGENT_BROWSER_IDLE_TIMEOUT_MS=300000
 # Persist gh CLI auth to ~/.config/gh inside container
 LPB_PERSIST_GH_CONFIG=true
 LPB_PERSIST_GH_CONFIG=true
+
+# ─── GHCR Token (image pulls) ──────────────────────────────────────────
+# Read-only PAT for GHCR pulls (personal account requires auth).
+# Create at: https://github.com/settings/tokens  scope: read:packages
+# Leave empty to use GITHUB_TOKEN / LPB_GITHUB_TOKEN from environment.
+GHCR_TOKEN=
+GHCR_USERNAME=localpibox
 # ─── Agent Date/Time ──────────────────────────────────────────────────
 # Set by start.sh at runtime (via $(date)) so the agent always knows
 # the current date/time. Available as PI_DATE and PI_TIME environment

lpb.stack.env

@@ -29,6 +29,13 @@ LPB_CONFIG_REF=dev
 LPB_IMAGE_CLI=ghcr.io/localpibox/devstack:cli
 LPB_IMAGE_WEB=ghcr.io/localpibox/devstack:web
 
+# ─── GHCR Token ───────────────────────────────────────────────────────
+# Read-only PAT for image pulls (baked into image for public access).
+# Create at: https://github.com/settings/tokens  scope: read:packages
+# Leave empty to use GITHUB_TOKEN / LPB_GITHUB_TOKEN from environment.
+GHCR_TOKEN=
+GHCR_USERNAME=localpibox
+
 # ─── Container Identity ─────────────────────────────────────────────────
 LPB_CONTAINER_NAME=localpibox
 

scripts/lpb.py

@@ -554,8 +554,11 @@ def containers_logs(self, name: str, follow: bool = True, tail: int | None = Non
             return False
 
     def images_pull(self, name):
-        """Pull image with full verbosity, no stdin, and no timeout.
-        Uses Popen to stream output in real-time. No stdin to avoid blocking on slow connections."""
+        """Pull image with full verbosity, auto-login to GHCR if needed."""
+        # Auto-login to GHCR for LocalPibox images
+        if name.startswith("ghcr.io/localpibox/"):
+            self._ghcr_login()
+
         proc = subprocess.Popen(
             [self.cmd, "pull", name],
             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
@@ -569,6 +572,20 @@ def images_pull(self, name):
         rc = proc.wait()
         return rc
 
+    def _ghcr_login(self):
+        """Login to GHCR with read-only token if not already authenticated."""
+        # Try existing auth first
+        _, _, rc = run_cmd([self.cmd, "login", "ghcr.io", "--inspect"], timeout=10)
+        if rc == 0:
+            return  # Already logged in
+
+        token = os.environ.get("GHCR_TOKEN") or os.environ.get("GITHUB_TOKEN") or os.environ.get("LPB_GITHUB_TOKEN", "")
+        if not token:
+            return  # No token available, pull will fail with auth error
+
+        username = os.environ.get("GHCR_USERNAME", "localpibox")
+        run_cmd([self.cmd, "login", "ghcr.io", "-u", username, "-p", token], timeout=30)
+
 
     def images_inspect(self, name):
         _, _, rc = run_cmd([self.cmd, "image", "inspect", name])
@@ -1283,6 +1300,12 @@ def cmd_run():
         f"LPB_EXA_API_KEY={os.environ.get('LPB_EXA_API_KEY', os.environ.get('EXA_API_KEY', ''))}",
         f"LPB_MAX_TOKENS_CONTEXT_RATIO={os.environ.get('LPB_MAX_TOKENS_CONTEXT_RATIO', _conf_cfg.get('LPB_MAX_TOKENS_CONTEXT_RATIO', '0.06'))}",
     ]
+    # GHCR token for image pulls (personal account requires auth)
+    ghcr_token = os.environ.get('GHCR_TOKEN') or os.environ.get('GITHUB_TOKEN') or os.environ.get('LPB_GITHUB_TOKEN', '')
+    ghcr_username = os.environ.get('GHCR_USERNAME', _conf_cfg.get('GHCR_USERNAME', 'localpibox'))
+    if ghcr_token:
+        env_vars.append(f"GHCR_TOKEN={ghcr_token}")
+        env_vars.append(f"GHCR_USERNAME={ghcr_username}")
     for k in ("PI_WORKTREE_ID", "LPB_AGENT_BROWSER_ARGS", "LPB_AGENT_BROWSER_MAX_OUTPUT",
               "LPB_AGENT_BROWSER_CONTENT_BOUNDARIES", "LPB_AGENT_BROWSER_CONFIRM_ACTIONS",
               "LPB_AGENT_BROWSER_IDLE_TIMEOUT_MS", "LPB_AGENT_BROWSER_SESSION"):

support/start.sh

@@ -379,6 +379,17 @@ if [[ "$FIRST_RUN" = "true" ]]; then
         warn "lpb-memory-config.json.template not found — extension uses defaults"
     fi
 
+    # ── GHCR login for image pulls ────────────────────────────────────
+    if [[ -n "${GHCR_TOKEN:-}" ]]; then
+        info "Logging in to GHCR..."
+        if command -v podman &>/dev/null; then
+            podman login ghcr.io -u "${GHCR_USERNAME:-localpibox}" -p "${GHCR_TOKEN}"
+        elif command -v docker &>/dev/null; then
+            docker login ghcr.io -u "${GHCR_USERNAME:-localpibox}" -p "${GHCR_TOKEN}"
+        fi
+        info "  GHCR login complete (baked token)"
+    fi
+
     # ── Config repo: clone/fetch into ~/.pi/agent/ (runs every boot — see §4a)
     touch "${HOME_DIR}/.pi/.initialized"