feat: provision mise.toml config for sandbox devtools and simplify setup script

Author: deevus

internal/scripts/mise.toml

@@ -0,0 +1,12 @@
+[tools]
+node = { version = "lts" }
+
+# Agents
+claude-code = { version = "latest" }
+codex = { version = "latest" }
+opencode = { version = "latest" }
+"npm:@mariozechner/pi-coding-agent" = { version = "latest" }
+
+# Pi prerequisites
+fd = { version = "latest" }
+ripgrep = { version = "latest" }

internal/scripts/scripts.go

@@ -9,6 +9,9 @@ var RcLocal string
 //go:embed setup-devtools.sh
 var SetupDevtools string
 
+//go:embed mise.toml
+var MiseToml string
+
 //go:embed setup-egress.sh
 var SetupEgress string
 

internal/scripts/setup-devtools.sh

@@ -10,7 +10,7 @@ apt-get install -y -qq build-essential git curl
 # Install mise and dev tools for the pixel user (runs as root, uses su -).
 su - pixel -c 'curl -fsSL https://mise.run | sh'
 su - pixel -c 'echo '\''eval "$(/home/pixel/.local/bin/mise activate bash)"'\'' >> /home/pixel/.bashrc'
-su - pixel -c '/home/pixel/.local/bin/mise use --global node@lts claude-code@latest codex@latest opencode@latest'
+su - pixel -c '/home/pixel/.local/bin/mise install'
 
 touch /root/.devtools-provisioned
 echo "[$(date -Iseconds)] pixels devtools setup complete"

sandbox/incus/backend.go

@@ -203,13 +203,16 @@ func (i *Incus) provisionInstance(ctx context.Context, full string) error {
 		if err := i.pushFile(full, "/root/.ssh/authorized_keys", keyData, 0o600); err != nil {
 			return fmt.Errorf("writing root authorized_keys: %w", err)
 		}
-		if err := i.pushFileOwned(full, "/home/pixel/.ssh/authorized_keys", keyData, 0o600, 1000, 1000); err != nil {
+		if err := i.pushFileOwned(full, "/home/pixel/.ssh/authorized_keys", keyData, 0o600, int64(i.cfg.uid), int64(i.cfg.gid)); err != nil {
 			return fmt.Errorf("writing pixel authorized_keys: %w", err)
 		}
 	}
 
 	// Dev tools script.
 	if i.cfg.devtools {
+		if err := i.pushFileOwned(full, "/home/pixel/.config/mise/config.toml", []byte(scripts.MiseToml), 0o644, int64(i.cfg.uid), int64(i.cfg.gid)); err != nil {
+			return fmt.Errorf("writing mise config: %w", err)
+		}
 		if err := i.pushFile(full, "/usr/local/bin/pixels-setup-devtools.sh", []byte(scripts.SetupDevtools), 0o755); err != nil {
 			return fmt.Errorf("writing devtools script: %w", err)
 		}

sandbox/truenas/client.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/deevus/pixels/internal/egress"
 	"github.com/deevus/pixels/internal/scripts"
+	"github.com/deevus/pixels/sandbox/user"
 )
 
 // Client wraps a truenas-go WebSocket client and its typed services.
@@ -191,12 +192,13 @@ func (c *Client) Provision(ctx context.Context, name string, opts ProvisionOpts)
 		}); err != nil {
 			return fmt.Errorf("writing authorized_keys: %w", err)
 		}
-		pixelUID := intPtr(1000)
+		pixelUID := intPtr(user.UID)
+		pixelGID := intPtr(user.GID)
 		if err := c.Filesystem.WriteFile(ctx, rootfs+"/home/pixel/.ssh/authorized_keys", truenas.WriteFileParams{
 			Content: keyData,
 			Mode:    0o600,
 			UID:     pixelUID,
-			GID:     pixelUID,
+			GID:     pixelGID,
 		}); err != nil {
 			return fmt.Errorf("writing authorized_keys: %w", err)
 		}
@@ -205,6 +207,15 @@ func (c *Client) Provision(ctx context.Context, name string, opts ProvisionOpts)
 
 	// Write dev tools setup script (executed later via zmx).
 	if opts.DevTools {
+		if err := c.Filesystem.WriteFile(ctx, rootfs+"/home/pixel/.config/mise/config.toml", truenas.WriteFileParams{
+			Content: []byte(scripts.MiseToml),
+			Mode:    0o644,
+			UID:     intPtr(user.UID),
+			GID:     intPtr(user.GID),
+		}); err != nil {
+			return fmt.Errorf("writing mise config: %w", err)
+		}
+
 		if err := c.Filesystem.WriteFile(ctx, rootfs+"/usr/local/bin/pixels-setup-devtools.sh", truenas.WriteFileParams{
 			Content: []byte(scripts.SetupDevtools),
 			Mode:    0o755,
@@ -509,12 +520,13 @@ func (c *Client) WriteAuthorizedKey(ctx context.Context, name, sshPubKey string)
 		return fmt.Errorf("writing root authorized_keys: %w", err)
 	}
 
-	pixelUID := intPtr(1000)
+	pixelUID := intPtr(user.UID)
+	pixelGID := intPtr(user.GID)
 	if err := c.Filesystem.WriteFile(ctx, rootfs+"/home/pixel/.ssh/authorized_keys", truenas.WriteFileParams{
 		Content: keyData,
 		Mode:    0o600,
 		UID:     pixelUID,
-		GID:     pixelUID,
+		GID:     pixelGID,
 	}); err != nil {
 		return fmt.Errorf("writing pixel authorized_keys: %w", err)
 	}