fix: reshape config repo to ~/.pi/agent; migrate legacy ~/.pi layout

Pi and its extensions hardcode the agent dir at ~/.pi/agent/
(getAgentDir(), package-manager git/npm, lemonade auth/models-store).
Move the config repo there and add a one-time migration that relocates
legacy ~/.pi root contents (repo + runtime state) while preserving
infra markers and sibling mounts. Update lpb-config and validate.sh
paths accordingly.

Author: localpibox

Dockerfile

@@ -17,7 +17,7 @@
 # NOTE: Runtime extensions (lemonade-pi-plugin, lpb-memory) are NOT
 #       built into the image. They are installed at container startup by
 #       `pi update --extensions`, which reads their branches from the
-#       config repo served at ~/.pi/settings.json → "packages" array.
+#       config repo served at ~/.pi/agent/settings.json → "packages" array.
 # ═══════════════════════════════════════════════════════════════════════════
 
 # Source fork configuration — ARG defaults come from lpb.stack.env

lpb.stack.env

@@ -21,7 +21,7 @@ LPB_PI_UPSTREAM=https://github.com/earendil-works/pi.git
 # ─── Config Preset ───────────────────────────────────────────────────────
 # Fork URL + branch of the preset repo (localpibox/config) baked into the
 # image. Repoint these to your own forked preset to fully customize the
-# runtime ~/.pi/ config without editing the repo.
+# runtime ~/.pi/agent/ config without editing the repo.
 LPB_CONFIG_FORK=https://github.com/localpibox/config.git
 LPB_CONFIG_REF=main
 

support/lpb-config

@@ -12,10 +12,28 @@ set -euo pipefail
 # Config repo location — override via env vars (see help below).
 # NOTE: positionals are reserved for the subcommand ($1), so the
 # repo path/remote/ref come from the environment, not $1/$2/$3.
-AGENT_DIR="${AGENT_DIR:-/home/lpb/.pi}"
+AGENT_DIR="${AGENT_DIR:-/home/lpb/.pi/agent}"
 CONFIG_REMOTE="${CONFIG_REMOTE:-https://github.com/localpibox/config.git}"
 CONFIG_REF="${CONFIG_REF:-main}"
 
+# ── Migrate legacy ~/.pi root layout → ~/.pi/agent/ (one-time) ──────────
+# Mirrors the migration in start.sh: earlier builds kept the config repo at
+# ~/.pi/ root, which broke pi's hardcoded ~/.pi/agent/* paths. If the default
+# agent dir holds no repo but the legacy root does, relocate it so lpb-config
+# keeps working against the reshaped layout.
+if [[ "$AGENT_DIR" = "/home/lpb/.pi/agent" && -d "/home/lpb/.pi/.git" && ! -d "/home/lpb/.pi/agent/.git" ]]; then
+    warn "Migrating legacy config layout from ~/.pi to ~/.pi/agent/ ..."
+    mkdir -p "/home/lpb/.pi/agent"
+    shopt -s dotglob nullglob
+    for _item in "/home/lpb/.pi"/*; do
+        case "$(basename "${_item}")" in
+            .initialized|ssh-host-keys|gh-config|agent) continue ;;
+        esac
+        mv "${_item}" "/home/lpb/.pi/agent/" 2>/dev/null || true
+    done
+    shopt -u dotglob nullglob
+fi
+
 # ─── Helpers ────────────────────────────────────────────────────────────────
 info()  { echo "[lpb-config] $*"; }
 warn()  { echo "[lpb-config] $*" >&2; }
@@ -206,7 +224,7 @@ case "${1:-help}" in
         echo "  merge    — Open git merge flow for advanced users"
         echo ""
         echo "Environment:"
-        echo "  AGENT_DIR         — Config repo path (default: /home/lpb/.pi)"
+        echo "  AGENT_DIR         — Config repo path (default: /home/lpb/.pi/agent)"
         echo "  CONFIG_REMOTE     — Git remote URL (default: https://github.com/localpibox/config.git)"
         echo "  CONFIG_REF        — Branch to track (default: main)"
         ;;

support/start.sh

@@ -225,19 +225,50 @@ else
     info "Workspace: ${WORKSPACE_DIR} (${file_count} files)"
 fi
 
-# ─── 4a. CONFIG REPO — CLONE/FETCH INTO ~/.pi/ (BEFORE FIRST-RUN) ─────────
-# The config repo (localpibox/config) IS the runtime config directory (~/.pi/).
-# No copy step — Pi reads the repo root directly via PI_CODING_AGENT_DIR.
-# Done BEFORE first-run mkdirs so ~/.pi/ is empty when we clone into it.
+# ─── 4a. CONFIG REPO — CLONE/FETCH INTO ~/.pi/agent/ (BEFORE FIRST-RUN) ────
+# The config repo (localpibox/config) IS the runtime agent config directory
+# (~/.pi/agent/). Pi reads the repo root directly via PI_CODING_AGENT_DIR.
+# The agent dir is ~/.pi/agent/ (upstream pi default) — NOT ~/.pi/ root —
+# because pi and its extensions hardcode that path: getAgentDir() defaults to
+# ~/.pi/agent/, package-manager keeps git/npm under <agentDir>/, and the
+# lemonade plugin reads/writes ~/.pi/agent/auth.json and models-store.json.
+# Done BEFORE first-run mkdirs so ~/.pi/agent/ is empty when we clone into it.
 # Runs every boot: clones on first run, non-destructive fetch afterwards.
-AGENT_DIR="${HOME_DIR}/.pi"
+AGENT_PI_ROOT="${HOME_DIR}/.pi"
+AGENT_DIR="${AGENT_PI_ROOT}/agent"
 # Config preset repo — baked into the image from lpb.stack.env (Dockerfile
 # ENV LPB_CONFIG_REMOTE / LPB_CONFIG_REF). Shell env can still override.
 CONFIG_REMOTE="${LPB_CONFIG_REMOTE:-${LPB_CONFIG_FORK:-https://github.com/localpibox/config.git}}"
 CONFIG_REF="${LPB_CONFIG_REF:-main}"
 
 export PI_CODING_AGENT_DIR="${AGENT_DIR}"
 
+# ── Migrate legacy ~/.pi root layout → ~/.pi/agent/ (one-time) ──────────
+# Earlier versions used ~/.pi/ root as the agent dir: the config repo (.git)
+# plus all runtime state (auth.json, models-store.json, sessions/, git/, npm/)
+# lived directly in ~/.pi. That broke pi's hardcoded ~/.pi/agent/* paths.
+# One-time relocation: move everything (repo + untracked runtime) into
+# ~/.pi/agent/, leaving only infra markers (.initialized, ssh-host-keys) at
+# the root. No-op on fresh volumes or already-reshaped ones.
+if [[ -d "${AGENT_PI_ROOT}/.git" && ! -d "${AGENT_DIR}/.git" ]]; then
+    info "Migrating legacy config layout from ~/.pi to ~/.pi/agent/ ..."
+    mkdir -p "${AGENT_DIR}"
+    shopt -s dotglob nullglob
+    for _item in "${AGENT_PI_ROOT}"/*; do
+        case "$(basename "${_item}")" in
+            # Keep infra + sibling mounts at the root:
+            #   .initialized  — first-run marker
+            #   ssh-host-keys — persisted sshd host identity
+            #   gh-config     — dedicated gh volume mount (~/.config/gh)
+            #   agent         — the migration target itself
+            .initialized|ssh-host-keys|gh-config|agent) continue ;;
+        esac
+        mv "${_item}" "${AGENT_DIR}/" 2>/dev/null || true
+    done
+    shopt -u dotglob nullglob
+    info "Legacy config layout migrated to ${AGENT_DIR}."
+fi
+
 if [[ ! -d "${AGENT_DIR}/.git" ]]; then
     if [[ -d "${AGENT_DIR}" && -n "$(ls -A "${AGENT_DIR}" 2>/dev/null)" ]]; then
         # ~/.pi already exists and is non-empty but not a git repo — e.g. stale
@@ -285,8 +316,8 @@ if [[ "$FIRST_RUN" = "true" ]]; then
     chown -R "$(id -u):$(id -g)" "${HOME_DIR}/.pi" "${HOME_DIR}/.npm" "${HOME_DIR}/.config" 2>/dev/null || true
     chmod -R u+rwX "${HOME_DIR}/.pi" "${HOME_DIR}/.npm" 2>/dev/null || true
 
-    mkdir -p "${HOME_DIR}/.pi/git" \
-             "${HOME_DIR}/.pi/npm" \
+    mkdir -p "${AGENT_DIR}/git" \
+             "${AGENT_DIR}/npm" \
              "${HOME_DIR}/.venvs"
 
     npm config set prefix '/home/lpb/.npm-global' 2>/dev/null || true
@@ -300,7 +331,7 @@ if [[ "$FIRST_RUN" = "true" ]]; then
     npm config set allow-scripts 'better-sqlite3 agent-browser esbuild protobufjs @google/genai' 2>/dev/null || true
 
     # Pre-create .npmrc so npm reads allow-scripts from parent dir
-    printf 'allow-scripts=better-sqlite3\nallow-scripts=agent-browser\nallow-scripts=esbuild\nallow-scripts=protobufjs\nallow-scripts=@google/genai\n' > "${HOME_DIR}/.pi/git/.npmrc" 2>/dev/null || true
+    printf 'allow-scripts=better-sqlite3\nallow-scripts=agent-browser\nallow-scripts=esbuild\nallow-scripts=protobufjs\nallow-scripts=@google/genai\n' > "${AGENT_DIR}/git/.npmrc" 2>/dev/null || true
     printf 'allow-scripts=better-sqlite3\nallow-scripts=agent-browser\nallow-scripts=esbuild\nallow-scripts=protobufjs\nallow-scripts=@google/genai\n' > "${HOME_DIR}/.npmrc" 2>/dev/null || true
 
     # Fix pi-coding-agent package.json to include allowScripts
@@ -323,7 +354,7 @@ with open(sys.argv[1], 'w') as f: json.dump(pkg, f, indent=2)
         info "Patched pi-coding-agent package.json with allowScripts."
     fi
 
-    # ── Config repo: clone/fetch into ~/.pi/ (runs every boot — see §4a) ──
+    # ── Config repo: clone/fetch into ~/.pi/agent/ (runs every boot — see §4a)
     touch "${HOME_DIR}/.pi/.initialized"
 
     # ── Unlock the user account with a random password ──────────────────
@@ -430,7 +461,7 @@ persist_devstack_env
 
 debug "Checking native modules..."
 NEED_REBUILD=false
-EXT_BASE="${HOME_DIR}/.pi/git"
+EXT_BASE="${AGENT_DIR}/git"
 
 # Look for any better-sqlite3 that's missing its bindings
 while IFS= read -r pkg_json; do
@@ -478,7 +509,7 @@ if [[ "$NEED_REBUILD" = "true" ]]; then
                 [[ -f "$path" ]] && binding_found=true && break
             done
             if [[ "$binding_found" = "false" ]]; then
-                local_name=$(echo "$ext_dir" | sed "s|.*/\.pi/git/||")
+                local_name=$(echo "$ext_dir" | sed "s|.*/\.pi/agent/git/||")
                 info "  Rebuilding: ${local_name}..."
                 (cd "$ext_dir" && PATH="/home/lpb/.npm-global/bin:${PATH}" npm rebuild better-sqlite3 --loglevel=error 2>&1 | tail -3) || \
                     warn "  npm rebuild failed for ${local_name}, trying node-gyp..."

support/validate.sh

@@ -62,7 +62,7 @@ echo ""
 
 # ── 3. Native modules (better-sqlite3) ──────────────────────────────────────
 echo -e "${CYAN}── Native modules ────────────────────────────────────────${NC}"
-EXT_BASE="/home/lpb/.pi/git"
+EXT_BASE="/home/lpb/.pi/agent/git"
 # Find ALL better_sqlite3.node files (glob */*/ only matches 2 levels,
 # but extensions live at github.com/<org>/<repo>/node_modules/ = 3 levels).
 found_better_sqlite3=false