From df66bff8cc576c3418d75f95905dffce7df4dec7 Mon Sep 17 00:00:00 2001
From: Hermes <hey@hiago.sh>
Date: Sat, 15 Aug 2026 00:29:19 -0300
Subject: [PATCH] fix(forge): make /home/forge writable via named volume; fix
 specify-cli install as root

- docker-compose: add forge-home:/home/forge volume (was read-only, broke uv cache and ~/.supabase)
- forge-entrypoint: install specify-cli as root with UV_CACHE_DIR=/tmp, UV_TOOL_BIN_DIR=/usr/local/bin (su - forge required a password)
- infra-regression: assert forge-home volume + specify install flags
---
 containers/forge/forge-entrypoint.sh | 12 ++++++++----
 docker-compose.yml                   |  2 ++
 tests/infra-regression.sh            | 12 +++++++++++-
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/containers/forge/forge-entrypoint.sh b/containers/forge/forge-entrypoint.sh
index a1d5681..6212772 100755
--- a/containers/forge/forge-entrypoint.sh
+++ b/containers/forge/forge-entrypoint.sh
@@ -21,13 +21,17 @@ for secret in github_token gmail_user gmail_app_password; do
   fi
 done
 
-# Specify CLI (spec-kit) — install as forge on first boot if uv is present.
+# Specify CLI (spec-kit) — install on first boot (root, before dropping to forge).
 # spec-kit enables spec-driven development for Codex jobs (/speckit.* skills).
+# uv needs a writable cache; the image root is read-only, so point it at /tmp.
 if command -v uv >/dev/null 2>&1; then
   SPECIFY_TAG="${BARBAROSSA_SPECIFY_TAG:-v0.12.11}"
-  su - forge -c "uv tool install specify-cli \
-    --from 'git+https://github.com/github/spec-kit.git@${SPECIFY_TAG}'" \
-    >/dev/null 2>&1 || true
+  UV_CACHE_DIR=/tmp/uv-cache \
+  UV_TOOL_DIR=/usr/local/share/barbarossa/tools \
+  UV_TOOL_BIN_DIR=/usr/local/bin \
+    uv tool install specify-cli \
+      --from "git+https://github.com/github/spec-kit.git@${SPECIFY_TAG}" \
+      >/dev/null 2>&1 || true
 fi
 
 auth_source="${CODEX_AUTH_SOURCE_FILE:-/run/secrets/codex_auth_json}"
diff --git a/docker-compose.yml b/docker-compose.yml
index 2dc114b..7b2cd01 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -51,6 +51,7 @@ services:
     volumes:
       - forge-workspace:/workspace
       - forge-codex-home:/home/forge/.codex
+      - forge-home:/home/forge
       - forge-host-keys:/ssh-host-keys
       - ./config/codex/config.toml:/usr/local/share/barbarossa/codex/config.toml:ro
       - ./skills/codex/barbarossa-artifacts/SKILL.md:/usr/local/share/barbarossa/codex/SKILL.md:ro
@@ -191,6 +192,7 @@ volumes:
   hermes-state:
   forge-workspace:
   forge-codex-home:
+  forge-home:
   forge-host-keys:
   recon-workspace:
   recon-tor-state:
diff --git a/tests/infra-regression.sh b/tests/infra-regression.sh
index afb5548..e658ead 100755
--- a/tests/infra-regression.sh
+++ b/tests/infra-regression.sh
@@ -49,6 +49,14 @@ assert "ports" not in services["forge"]
 assert "ports" not in services["recon"]
 assert services["forge"]["read_only"] is True
 assert services["recon"]["read_only"] is True
+assert any(
+    "forge-home:/home/forge" in volume
+    for volume in services["forge"]["volumes"]
+)
+assert any(
+    "forge-codex-home:/home/forge/.codex" in volume
+    for volume in services["forge"]["volumes"]
+)
 assert services["hermes"]["env_file"] == [
     "${BARBAROSSA_HERMES_ENV_FILE:?set BARBAROSSA_HERMES_ENV_FILE}"
 ]
@@ -166,7 +174,9 @@ grep -Fq 'install -d -o forge -g forge -m 0700 /run/barbarossa-secrets' \
   containers/forge/forge-entrypoint.sh
 grep -Fq 'for secret in github_token gmail_user gmail_app_password; do' \
   containers/forge/forge-entrypoint.sh
-grep -Fq '"uv tool install specify-cli' \
+grep -Fq 'uv tool install specify-cli' \
+  containers/forge/forge-entrypoint.sh
+grep -Fq 'UV_TOOL_BIN_DIR=/usr/local/bin' \
   containers/forge/forge-entrypoint.sh
 grep -Fq 'npm install --global vercel' containers/forge/Dockerfile
 grep -Fq 'npm install --global supabase' containers/forge/Dockerfile