Fix Dockerfile build issues + validate config-dir-to-repo setup

Dockerfile:
- Remove redundant /opt/pi-support/lpb-config copy (unused, non-executable)
- Create /home/lpb/.agent-browser/sessions before chown (was failing:
  chown -R on a non-existent path)
- Use COPY --chmod=755 for entrypoint-web.sh (no reliance on USER root)

start.sh:
- Move config repo clone/fetch OUT of FIRST_RUN block into a new
  every-boot §4a section, so PI_CODING_AGENT_DIR is exported before pi
  launches on every boot (not just first run). Non-destructive fetch
  preserves local customizations; use lpb-config for updates.

lpb-config:
- Fix positional-arg collision: $1 was both the subcommand and AGENT_DIR.
  The repo path/remote/ref now come from env vars only (matching the
  documented interface), which broke status/update/reset/merge.

Author: localpibox

Dockerfile

@@ -141,7 +141,6 @@ COPY support/validate-subagent-output.ts /opt/pi-support/validate-subagent-outpu
 COPY support/config/ /opt/pi-support/config/
 COPY support/docs/ /opt/pi-support/docs/
 COPY support/schemas/ /opt/pi-support/schemas/
-COPY support/lpb-config /opt/pi-support/lpb-config
 
 # ── Devstack deployment scripts ──
 COPY --chmod=755 support/install-browser.sh /opt/devstack/install-browser.sh
@@ -157,7 +156,8 @@ COPY --chmod=755 support/lpb-config /home/lpb/.local/bin/lpb-config
 
 # ─── Ownership (must run as root — COPY creates files as root) ───────────
 USER root
-RUN chown -R 1000:1000 /home/lpb /opt/devstack /opt/pi-support /home/lpb/.agent-browser
+RUN mkdir -p /home/lpb/.agent-browser/sessions \
+    && chown -R 1000:1000 /home/lpb /opt/devstack /opt/pi-support
 USER lpb
 
 # ─── Git credential helper ────────────────────────────────────────────
@@ -222,8 +222,7 @@ RUN set -eux; \
     install_ext pi0 pi-vscode || echo "WARN: pi-vscode install failed"; \
     chown -R 1000:1000 /home/lpb/.vscodium-server
 
-COPY support/entrypoint-web.sh /opt/devstack/entrypoint-web.sh
-RUN chmod +x /opt/devstack/entrypoint-web.sh
+COPY --chmod=755 support/entrypoint-web.sh /opt/devstack/entrypoint-web.sh
 
 RUN chown -R 1000:1000 /home/lpb
 

support/lpb-config

@@ -9,9 +9,12 @@
 
 set -euo pipefail
 
-AGENT_DIR="${1:-/home/lpb/.pi}"
-CONFIG_REMOTE="${2:-https://github.com/localpibox/config.git}"
-CONFIG_REF="${3:-main}"
+# Config repo location — override via env vars (see help below).
+# NOTE: positionals are reserved for the subcommand ($1), so the
+# repo path/remote/ref come from the environment, not $1/$2/$3.
+AGENT_DIR="${AGENT_DIR:-/home/lpb/.pi}"
+CONFIG_REMOTE="${CONFIG_REMOTE:-https://github.com/localpibox/config.git}"
+CONFIG_REF="${CONFIG_REF:-main}"
 
 # ─── Helpers ────────────────────────────────────────────────────────────────
 info()  { echo "[lpb-config] $*"; }

support/start.sh

@@ -260,26 +260,7 @@ with open(sys.argv[1], 'w') as f: json.dump(pkg, f, indent=2)
         info "Patched pi-coding-agent package.json with allowScripts."
     fi
 
-    # ── Config repo: clone/fetch into ~/.pi/ directly ──────────────────────
-    # The config repo IS the runtime directory (~/.pi/). No copy step needed.
-    # start.sh ensures the repo is cloned on first run and fetched on every boot.
-    AGENT_DIR="${HOME_DIR}/.pi"
-    CONFIG_REMOTE="${LPB_CONFIG_REMOTE:-https://github.com/localpibox/config.git}"
-    CONFIG_REF="${LPB_CONFIG_REF:-main}"
-
-    if [[ ! -d "${AGENT_DIR}/.git" ]]; then
-        info "Cloning config repo from ${CONFIG_REMOTE} (first run)..."
-        git clone --depth=1 --branch "${CONFIG_REF}" "${CONFIG_REMOTE}" "${AGENT_DIR}"
-    else
-        info "Fetching config repo updates..."
-        git -C "${AGENT_DIR}" fetch origin "${CONFIG_REF}" 2>/dev/null || true
-    fi
-
-    # ── Tell Pi to read config from ~/.pi/ (config repo root) ────────────
-    # Pi defaults to ~/.pi/agent/, but our config repo IS ~/.pi/.
-    # This env var is picked up by Pi at startup.
-    export PI_CODING_AGENT_DIR="${AGENT_DIR}"
-
+    # ── Config repo: clone/fetch into ~/.pi/ (runs every boot — see §4a) ──
     touch "${HOME_DIR}/.pi/.initialized"
 
     # ── Unlock the user account with a random password ──────────────────
@@ -310,6 +291,30 @@ with open(sys.argv[1], 'w') as f: json.dump(pkg, f, indent=2)
     info "First run bootstrap complete."
 fi
 
+# ─── 4a. CONFIG REPO — CLONE/FETCH INTO ~/.pi/ (EVERY BOOT) ────────────────
+# The config repo (localpibox/config) IS the runtime config directory (~/.pi/).
+# No copy step — Pi reads the repo root directly via PI_CODING_AGENT_DIR.
+# Runs on every boot: clones on first run, fetches (non-destructive) after.
+AGENT_DIR="${HOME_DIR}/.pi"
+CONFIG_REMOTE="${LPB_CONFIG_REMOTE:-https://github.com/localpibox/config.git}"
+CONFIG_REF="${LPB_CONFIG_REF:-main}"
+
+export PI_CODING_AGENT_DIR="${AGENT_DIR}"
+
+if [[ ! -d "${AGENT_DIR}/.git" ]]; then
+    info "Cloning config repo from ${CONFIG_REMOTE}..."
+    if git clone --depth=1 --branch "${CONFIG_REF}" "${CONFIG_REMOTE}" "${AGENT_DIR}"; then
+        info "Config repo cloned."
+    else
+        warn "Config clone failed — Pi will use defaults."
+    fi
+else
+    # Non-destructive fetch only — local customizations are never wiped.
+    # Use 'lpb-config update/reset/merge' for actual updates.
+    git -C "${AGENT_DIR}" fetch origin "${CONFIG_REF}" 2>/dev/null || true
+    debug "Config repo fetched (manual update via lpb-config)."
+fi
+
 # ─── 4b. ENSURE HOME MOUNT PARENTS ARE WRITABLE (EVERY BOOT) ────────────────
 # The container runtime recreates host-volume bind-mount parents (e.g.
 # /home/lpb/.config for the gh-config mount) as root on boot, so a directory