{
  "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.13.7/.schema/devbox.schema.json",
  "packages": [
    "git@latest",
    "curl@latest",
    "wget@latest",
    "jq@latest",
    "yq@latest",
    "gnumake@latest",
    "direnv@latest",
    "lefthook@latest",
    "uv@latest",
    "nodejs_22@latest",
    "gh@latest",
    "process-compose@latest",
    "docker@latest",
    "docker-compose@latest",
    "ripgrep@latest",
    "fd@latest",
    "bat@latest",
    "eza@latest",
    "zsh@latest",
    "pulumi-bin@latest",
    "google-cloud-sdk@latest",
    "caddy@latest",
    "netcat-openbsd@latest",
    "iputils@latest",
    "dnsutils@latest",
    "traceroute@latest",
    "openssl@latest",
    "unzip@latest",
    "htop@latest",
    "tree@latest",
    "file@latest",
    "vim@latest"
  ],
  "env": {
    "DATABASE_URL": "postgresql://<user>:<pass>@<your-neon-dev-branch>.neon.tech/app?sslmode=require",
    "API_URL": "http://localhost:8000",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://localhost:4317",
    "DEVBOX_COREPACK_ENABLED": "true"
  },
  "shell": {
    "init_hook": [
      "# Activate direnv integration only for bash shells.",
      "# devbox run invokes init_hook via /usr/bin/sh, and direnv has no 'sh' hook target.",
      "[ -n \"${BASH_VERSION:-}\" ] && command -v direnv >/dev/null 2>&1 && eval \"$(direnv hook bash)\" 2>/dev/null || true",
      "",
      "# Source NVM so that node/pnpm from nvm is available in devbox shells",
      "# || true is required: under set -e (prepended by devbox to hooks.sh), a",
      "# failing [ -s ] && . exits the script if NVM isn't installed yet.",
      "export NVM_DIR=\"${HOME}/.nvm\"",
      "[ -s \"${NVM_DIR}/nvm.sh\" ] && . \"${NVM_DIR}/nvm.sh\" --no-use || true",
      "",
      "# Install act (local GitHub Actions runner) via the official installer if not present.",
      "# act is not in nixpkgs because the Nix build sandbox conflicts with Docker-in-Docker;",
      "# the curl installer places the binary at /usr/local/bin/act which survives devbox shell restarts.",
      "if ! command -v act >/dev/null 2>&1; then",
      "  echo '==> Installing act (local GitHub Actions runner)...'",
      "  curl -fsSL https://raw.githubusercontent.com/nektos/act/master/install.sh | bash -s -- -b /usr/local/bin >/dev/null 2>&1 && echo '  → act installed.' || echo '  → Warning: act install failed.'",
      "fi"
    ],
    "scripts": {
      "setup": [
        "#!/usr/bin/env bash",
        "set -eu",
        "",
        "# ── Project dependencies & first-time setup ──────────────────────────────",
        "echo '==> Running project setup (deps, env files, git hooks)...'",
        "bash scripts/setup.sh",
        "",
        "# ── Oh My Zsh ────────────────────────────────────────────────────────────",
        "echo '==> Configuring Oh My Zsh...'",
        "",
        "if [ ! -d \"${HOME}/.oh-my-zsh\" ]; then",
        "  echo '  → Installing Oh My Zsh...'",
        "  if ! RUNZSH=no CHSH=no sh -c \"$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)\"; then",
        "    echo '  → Warning: Oh My Zsh install failed; continuing setup'",
        "  fi",
        "fi",
        "",
        "ZSH_CUSTOM=\"${ZSH_CUSTOM:-${HOME}/.oh-my-zsh/custom}\"",
        "",
        "if [ ! -d \"${ZSH_CUSTOM}/plugins/zsh-autosuggestions\" ]; then",
        "  echo '  → Installing zsh-autosuggestions...'",
        "  git clone --depth=1 https://github.com/zsh-users/zsh-autosuggestions \"${ZSH_CUSTOM}/plugins/zsh-autosuggestions\"",
        "fi",
        "",
        "if [ ! -d \"${ZSH_CUSTOM}/plugins/zsh-syntax-highlighting\" ]; then",
        "  echo '  → Installing zsh-syntax-highlighting...'",
        "  git clone --depth=1 https://github.com/zsh-users/zsh-syntax-highlighting \"${ZSH_CUSTOM}/plugins/zsh-syntax-highlighting\"",
        "fi",
        "",
        "if [ ! -d \"${ZSH_CUSTOM}/plugins/pnpm\" ]; then",
        "  echo '  → Installing oh-my-zsh pnpm plugin...'",
        "  git clone --depth=1 https://github.com/ntnyq/omz-plugin-pnpm \"${ZSH_CUSTOM}/plugins/pnpm\"",
        "fi",
        "",
        "# ── Configure .zshrc ─────────────────────────────────────────────────────",
        "ZSHRC=\"${HOME}/.zshrc\"",
        "[ ! -f \"${ZSHRC}\" ] && touch \"${ZSHRC}\"",
        "",
        "if grep -q '^ZSH_THEME=' \"${ZSHRC}\" 2>/dev/null; then",
        "  sed -i 's/^ZSH_THEME=.*/ZSH_THEME=\"agnoster\"/' \"${ZSHRC}\"",
        "else",
        "  printf 'ZSH_THEME=\"agnoster\"\\n' >> \"${ZSHRC}\"",
        "fi",
        "",
        "if grep -q '^plugins=' \"${ZSHRC}\" 2>/dev/null; then",
        "  sed -i 's/^plugins=.*/plugins=(git docker python node pnpm history direnv zsh-autosuggestions zsh-syntax-highlighting)/' \"${ZSHRC}\"",
        "else",
        "  printf 'plugins=(git docker python node pnpm history direnv zsh-autosuggestions zsh-syntax-highlighting)\\n' >> \"${ZSHRC}\"",
        "fi",
        "",
        "if ! grep -q '# foundation-devbox-zsh' \"${ZSHRC}\" 2>/dev/null; then",
        "  printf '\\n# foundation-devbox-zsh\\n' >> \"${ZSHRC}\"",
        "  printf 'export NVM_DIR=\"$HOME/.nvm\"\\n' >> \"${ZSHRC}\"",
        "  printf '[ -s \"$NVM_DIR/nvm.sh\" ] && . \"$NVM_DIR/nvm.sh\"\\n' >> \"${ZSHRC}\"",
        "  printf 'ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE=\"fg=60\"\\n' >> \"${ZSHRC}\"",
        "  printf 'ZSH_AUTOSUGGEST_STRATEGY=(history completion)\\n' >> \"${ZSHRC}\"",
        "fi",
        "",
        "if ! grep -q '# foundation-direnv-zsh-hook' \"${ZSHRC}\" 2>/dev/null; then",
        "  printf '\\n# foundation-direnv-zsh-hook\\n' >> \"${ZSHRC}\"",
        "  printf 'command -v direnv >/dev/null 2>&1 && eval \"$(direnv hook zsh)\"\\n' >> \"${ZSHRC}\"",
        "fi",
        "",
        "if ! grep -q '# foundation-tmux' \"${ZSHRC}\" 2>/dev/null; then",
        "  printf '\\n# foundation-tmux\\n' >> \"${ZSHRC}\"",
        "  printf '# Use repo .tmux.conf when TMUX_CONF is set (populated by .envrc).\\n' >> \"${ZSHRC}\"",
        "  printf 'if [ -n \"${TMUX_CONF:-}\" ]; then\\n' >> \"${ZSHRC}\"",
        "  printf \"  alias tmux='tmux -f \\\"\\$TMUX_CONF\\\"'\\n\" >> \"${ZSHRC}\"",
        "  printf 'fi\\n' >> \"${ZSHRC}\"",
        "fi",
        "",
        "echo '==> Zsh configuration complete!'"
      ],
      "hooks:install": "lefthook install",
      "dev": "process-compose up",
      "dev:app": "cd ui/web-app && pnpm dev",
      "dev:marketing": "cd ui/marketing && pnpm dev",
      "dev:api": "cd backend/api && uv run uvicorn --app-dir src main:app --reload --port 8000",
      "dev:db": "docker compose -f docker-compose.db.yml up",
      "test:api": "cd backend/api && uv run pytest",
      "test:app": "cd ui/web-app && pnpm test",
      "lint:app": "cd ui/web-app && pnpm dlx @biomejs/biome check ./src",
      "format:app": "cd ui/web-app && pnpm dlx @biomejs/biome format --write ./src",
      "lint:api": "cd backend/api && uv run ruff check src/",
      "ci:local": "act pull_request --container-architecture linux/amd64 -W .github/workflows/ci.yml"
    }
  }
}

# Load devbox environment (generates shell env from devbox.json)
eval "$(devbox generate direnv --print-envrc)"
 
# ── Auto-bootstrap Python venv & deps for backend/api ────────────────────────
if [ ! -d backend/api/.venv ]; then
  echo "direnv: creating backend/api/.venv ..."
  (cd backend/api && uv venv --quiet)
fi
if [ -f backend/api/uv.lock ] && [ backend/api/uv.lock -nt backend/api/.venv/.direnv-synced ] \
   || [ ! -f backend/api/.venv/.direnv-synced ]; then
  echo "direnv: running uv sync in backend/api/ ..."
  (cd backend/api && uv sync --all-extras --quiet) && touch backend/api/.venv/.direnv-synced
fi
 
# ── Auto-bootstrap Node deps for ui/web-app ────────────────────────────────────
if [ -f ui/web-app/package.json ] && [ ! -d ui/web-app/node_modules ]; then
  echo "direnv: running pnpm install in ui/web-app/ ..."
  (cd ui/web-app && pnpm install --no-fund --reporter=silent)
fi
 
# ── Activate Python venv so pytest / CLI tools are on PATH ────────────────────
export VIRTUAL_ENV="$PWD/backend/api/.venv"
PATH_add "$VIRTUAL_ENV/bin"
 
# ── Add ui/web-app/node_modules/.bin so vitest / biome are on PATH ─────────────
PATH_add ui/web-app/node_modules/.bin
 
# ── Project-level environment variables ──────────────────────────────────────
export API_URL="${API_URL:-http://localhost:8000}"

{
  "name": "Foundation Project",
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-22.04",
  // Run all devcontainer lifecycle commands as root, matching the user that
  // envbuilder / Coder run as inside the container.
  "remoteUser": "root",
  // NOTE: docker-in-docker is intentionally omitted.
  // envbuilder does not support the `privileged` or `init` feature properties
  // that docker-in-docker requires. Docker CE is installed by on-create.sh to
  // provide the daemon; Docker CLI + Compose may come from Devbox or Docker CE.
  // In Coder workspaces the Docker socket (/var/run/docker.sock) should be
  // mounted from the host via the workspace template.
  // Installs nix (single-user, sandbox disabled for Docker), devbox, and all
  // project packages. Nix installation is required; failures will stop the build.
  "onCreateCommand": "bash .devcontainer/on-create.sh",
  // postCreateCommand runs devbox run setup which installs pnpm/Python deps.
  // Output is tee'd to /tmp/postCreate.log; on failure the log is cat'd so it
  // appears in docker logs / envbuilder output for easy debugging.
  "postCreateCommand": "bash -c 'devbox run setup 2>&1 | tee /tmp/postCreate.log; exit ${PIPESTATUS[0]}'",
  // postStartCommand runs every time the container starts (including restarts).
  // It runs the post-start script, which restarts nix-daemon and waits for
  // Docker. Docker must be provided by a host-mounted socket.
  "postStartCommand": "bash -lc 'bash .devcontainer/post-start.sh'",
  "remoteEnv": {
    "DOCKER_BUILDKIT": "1",
    "SHELL": "/bin/zsh"
  },
  "customizations": {
    "vscode": {
      "settings": {
        "terminal.integrated.defaultProfile.linux": "zsh",
        "terminal.integrated.fontFamily": "'MesloLGS NF', 'Hack Nerd Font Mono', 'Courier New', monospace",
        "terminal.integrated.profiles.linux": {
          "zsh": { "path": "/bin/zsh", "args": ["-l"] },
          "bash": { "path": "/bin/bash", "args": ["-l"] }
        },
        "editor.formatOnSave": true,
        "python.defaultInterpreterPath": "${workspaceFolder}/backend/api/.venv/bin/python",
        "[python]": {
          "editor.defaultFormatter": "charliermarsh.ruff"
        },
        "[typescript]": {
          "editor.defaultFormatter": "biomejs.biome"
        },
        "[typescriptreact]": {
          "editor.defaultFormatter": "biomejs.biome"
        },
        "[javascript]": {
          "editor.defaultFormatter": "biomejs.biome"
        },
        "[javascriptreact]": {
          "editor.defaultFormatter": "biomejs.biome"
        },
        "[json]": {
          "editor.defaultFormatter": "biomejs.biome"
        }
      },
      "extensions": [
        "jetify-com.devbox",
        "mkhl.direnv",
        "charliermarsh.ruff",
        "ms-python.python",
        "ms-python.vscode-pylance",
        "biomejs.biome",
        "bradlc.vscode-tailwindcss",
        "GitHub.copilot",
        "GitHub.copilot-chat",
        "ms-vscode.makefile-tools",
        "redhat.vscode-yaml",
        "timonwong.shellcheck"
      ]
    },
    "codespaces": {
      "openFiles": ["README.md"]
    }
  },
  "forwardPorts": [3000, 5173, 8000, 5432, 8080, 4443],
  "portsAttributes": {
    "3000": { "label": "Next.js Marketing", "onAutoForward": "notify" },
    "5173": { "label": "Vite + TanStack App", "onAutoForward": "notify" },
    "8000": { "label": "FastAPI", "onAutoForward": "notify" },
    "5432": {
      "label": "Local Postgres (offline fallback)",
      "onAutoForward": "silent",
      "requireLocalPort": true
    },
    "8080": {
      "label": "Caddy HTTP",
      "onAutoForward": "silent"
    },
    "4443": {
      "label": "Caddy HTTPS",
      "onAutoForward": "silent"
    }
  }
}

#!/usr/bin/env bash
# .devcontainer/on-create.sh
# Runs as the devcontainer user (root) during onCreateCommand.
# Idempotent — safe to re-run.
set -euo pipefail
 
IS_CODESPACES="${CODESPACES:-}"
 
# ── 0. Ensure Docker is available early for lifecycle commands ───────────────
# Codespaces already provides Docker; avoid trying to start nested dockerd.
if ! command -v docker &>/dev/null; then
  if [ -n "$IS_CODESPACES" ]; then
    echo "WARNING: docker CLI is missing in Codespaces; skipping Docker bootstrap"
  else
    echo "→ Installing Docker CE..."
    curl -fsSL https://get.docker.com | sh
  fi
fi
 
if ! docker info &>/dev/null 2>&1; then
  if [ -n "$IS_CODESPACES" ]; then
    echo "WARNING: Docker daemon not reachable in Codespaces during on-create; continuing"
  elif command -v dockerd &>/dev/null; then
    echo "→ Starting dockerd..."
    dockerd \
      --host=unix:///var/run/docker.sock \
      --data-root=/var/lib/docker \
      >/tmp/dockerd.log 2>&1 &
 
    for i in $(seq 1 30); do
      docker info &>/dev/null 2>&1 && break
      sleep 1
    done
 
    if docker info &>/dev/null 2>&1; then
      echo "→ Docker daemon ready"
    else
      echo "WARNING: dockerd did not become ready within 30s (see /tmp/dockerd.log)"
    fi
  fi
fi
 
# ── 1. Initialize git submodules ──────────────────────────────────────────────
# NOTE: This runs before the Coder agent starts, so git credential helpers are
# not yet available. Private submodules requiring HTTPS auth may fail here.
# We make this non-fatal; the postStartCommand (or manual re-run) can complete
# it once the agent is running and git auth forwarding is active.
echo "→ Updating git submodules..."
git -C "$(dirname "$0")/.." submodule update --init --recursive \
  || echo "WARNING: submodule update failed (git credentials not yet available — re-run on-create.sh once the workspace is ready)"
 
# ── 2. Ensure zsh is installed ────────────────────────────────────────────────
if ! command -v zsh &>/dev/null; then
  echo "→ Installing zsh..."
  apt-get update -qq && apt-get install -y zsh
fi
 
# ── 2b. Ensure tmux is installed (apt, not nix, for host-OS integration) ─────
if ! command -v tmux &>/dev/null; then
  echo "→ Installing tmux..."
  apt-get update -qq && apt-get install -y tmux
fi
 
# ── 3. Configure nix to work without sandboxing ──────────────────────────────
# Most Docker environments (even privileged) can't run the nix build sandbox
# because they lack user-namespace support. Disabling sandbox + syscall filter
# allows nix/devbox to build and fetch packages normally.
mkdir -p /etc/nix
if [ ! -f /etc/nix/nix.conf ] || ! grep -q 'sandbox = false' /etc/nix/nix.conf; then
  cat >> /etc/nix/nix.conf <<'EOF'
sandbox = false
filter-syscalls = false
EOF
fi
 
# ── 4. Install nix (single-user, no daemon) if needed ────────────────────────
# The Determinate Systems installer handles Docker containers reliably.
if ! command -v nix &>/dev/null; then
  echo "→ Installing nix..."
  curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix \
    | sh -s -- install linux \
        --init none \
        --no-confirm \
        --extra-conf "sandbox = false" \
        --extra-conf "filter-syscalls = false"
fi
 
# Source the nix profile for the remainder of this script
if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
  # shellcheck disable=SC1091
  . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
fi
 
# ── 5. Start the nix daemon ──────────────────────────────────────────────────
# The Determinate Systems installer does not start the daemon automatically
# (--init none). We start it here for this shell, and rely on postStartCommand
# in devcontainer.json to restart it on subsequent workspace restarts.
/nix/var/nix/profiles/default/bin/nix-daemon --daemon &>/tmp/nix-daemon.log &
NIX_DAEMON_PID=$!
echo "→ nix-daemon started (pid $NIX_DAEMON_PID)"
sleep 3  # wait for the daemon socket to be ready
 
# ── 6. Install devbox if needed ───────────────────────────────────────────────
if ! command -v devbox &>/dev/null; then
  echo "→ Installing devbox..."
  # -f = non-interactive (skip the "Install to /usr/local/bin?" prompt)
  curl -fsSL https://get.jetify.com/devbox | bash -s -- -f
fi
 
# ── 7. Install project packages ───────────────────────────────────────────────
echo "→ Running devbox install..."
devbox install
 
# ── 8. Ensure shell init is set up for both bash and zsh ─────────────────────
add_to_shell() {
  local marker="$1" text="$2" file="$3"
  touch "$file"
  grep -qF "$marker" "$file" || printf '\n%s\n' "$text" >> "$file"
}
 
# Source nix in all shells (devbox adds its own wrapper around this too)
NIX_INIT='. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh 2>/dev/null || true'
add_to_shell 'nix-daemon.sh' "$NIX_INIT" "$HOME/.bashrc"
add_to_shell 'nix-daemon.sh' "$NIX_INIT" "$HOME/.zshrc"
 
# devbox adds itself to PATH via its own init; make sure devbox shim is reachable
DEVBOX_PATH_INIT='export PATH="${HOME}/.local/share/devbox/global/default/.devbox/nix/profile/default/bin:${PATH}"'
add_to_shell 'devbox' "$DEVBOX_PATH_INIT" "$HOME/.zshrc"
add_to_shell 'devbox' "$DEVBOX_PATH_INIT" "$HOME/.bashrc"
 
echo "✓ on-create complete"

#!/usr/bin/env bash
# .devcontainer/post-start.sh
# Runs on every container start. Keeps lightweight tasks idempotent.
set -euo pipefail
 
# Derive repo root dynamically to work across different workspace layouts.
ROOT="${ROOT:-${WORKSPACE_FOLDER:-}}"
if [ -z "${ROOT}" ]; then
  # Assume this script lives in .devcontainer/ under the repo root.
  SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]:-$0}")" >/dev/null 2>&1 && pwd -P)"
  ROOT="$(cd "${SCRIPT_DIR}/.." >/dev/null 2>&1 && pwd -P)"
fi
# Final fallback to the current directory if derivation failed for some reason.
ROOT="${ROOT:-${PWD}}"
 
LOG_FILE="/tmp/postStart.log"
DOCKER_WAIT_SECONDS="${DOCKER_WAIT_SECONDS:-60}"
 
log() {
  printf '%s\n' "$*" | tee -a "$LOG_FILE"
}
 
# Restart nix-daemon for this container session (no systemd in devcontainers).
if [ -x /nix/var/nix/profiles/default/bin/nix-daemon ]; then
  /nix/var/nix/profiles/default/bin/nix-daemon --daemon &>/tmp/nix-daemon.log &
  nix_daemon_pid=$!
  sleep 2
  if ! kill -0 "$nix_daemon_pid" 2>/dev/null; then
    log "post-start: failed to start nix-daemon; see /tmp/nix-daemon.log"
    exit 1
  fi
  # Verify daemon is responsive
  if command -v nix >/dev/null 2>&1; then
    for _ in {1..5}; do
      nix store ping >/dev/null 2>&1 && break
      sleep 1
    done
  fi
fi
 
# Wait for Docker to be reachable (needed by act and the optional local
# Postgres fallback). Local dev otherwise talks to a remote Neon dev branch,
# so there are no database images to pre-pull.
log "post-start: waiting for Docker daemon (timeout ${DOCKER_WAIT_SECONDS}s)..."
for _ in $(seq 1 "$DOCKER_WAIT_SECONDS"); do
  if docker info >/dev/null 2>&1; then
    log "post-start: Docker is ready"
    break
  fi
  sleep 1
done