devcontainer-kit v0.3.2

Interface stays 2.

Added

• The host's SSH keys inside containers, opt-in ([ssh] copy_keys = true in the host
  profile; off by default, a repository's dck.toml cannot set it). Tools that only offer
  key files, such as gh auth login, ignored the forwarded agent and asked to generate a
  new key. With it on, dck up binds the host's ~/.ssh read-only at ~/.ssh_host
  through a runtime compose overlay ($TMPDIR/dck-<uid>/<project>-sshkeys.yml), and every
  container start copies its id_* keys into the container's ~/.ssh on the state
  volume (private 0600, .pub 0644, refreshed when they change on the host, removed when
  removed there). dck's own config, config.d/, authorized_keys and
  known_hosts.dck-host are never touched, a key the container made itself is kept, and
  the agent forwarding is unchanged. Turning it off removes the copies at the next start.
  While it is on, the whole host ~/.ssh is readable inside (read-only), not only the
  id_* keys, and private keys rest in the state volume: the trade-off and the wipe are
  in docs/SECURITY.md. New entrypoint function dck_ssh_copy_keys.

• dck setup asks once, on a terminal, whether to copy the host's SSH keys (default no)
  and records the answer in the profile's [ssh] table.

• dck doctor reports the opt-in and the key file names (ssh keys copied: …, names
  only); doctor --json gains an optional ssh_keys object (enabled, reason,
  host_keys, copied).

• The agents layer installs coding-agents-kit's three skills (agentkit,
  agentkit-setup, agentkit-orchestrate) from the same verified release tarball into
  the image's shared skills directory; the entrypoint links them into every agent's
  skills directory at each start, so a recreate no longer loses them.

• The repository dogfoods its own container (.devcontainer/, docker/local/,
  dev.sh): python-3.13 with every coding-agents-kit CLI, Herdr, herdr-peers and
  shellcheck, registered as a Herdr machine; the unit gate runs inside.

Fixed

• [compose] state_volume in dck.toml (and dck init --state-volume NAME): the
  name of the service's state volume (sshd host key, ~/.ssh, gh auth, Herdr client
  state, history). It was hardcoded as state, so repositories sharing one compose
  project (one COMPOSE_PROJECT_NAME) all mounted one <project>_state volume. The
  default stays state, so no existing install loses its volume; only the compose
  volume's name changes, the mount point (~/.dck/volumes/state) does not. The agents
  layer's volumes stay shared by name.
• dck doctor flags a compose project shared with other services whose state volume is
  not per service (or another service mounting the same state volume), with the fix;
  doctor --json gains an optional compose object. The doctor now resolves the compose
  project like the launcher and compose (COMPOSE_PROJECT_NAME from the environment or
  the compose directory's .env before the file's name:).
• dck doctor says when Claude's default account will not be logged in inside (its
  host login is the macOS keychain, never shared, and CLAUDE_CODE_OAUTH_TOKEN is not in
  ak's env file), with both fixes, instead of a bare "not copied" line.
• A container built from scratch reaches the host and its peers at once: dck rebuild,
  dck start and dck restart now run the same post-start steps as dck up — the Herdr
  machine is registered (re-added when it was removed, its host key re-pinned), the mesh
  and the host-catalog mirror are pushed, and the layout is created. A rebuild after the
  volumes were removed left an empty Herdr catalog inside until dck herdr mesh ran by
  hand.

Changed

• Pins: coding-agents-kit v0.5.1 (AGENTKIT_TAG; tag commit 48c38f8, tarball
  sha256 62cde0e8…, SHA256SUMS sha256 400e8fd6…).
• Agent tooling: the vendored deepworkplan skill moves to v7.6.1 (skills-lock.json,
  AGENTS.md provenance), through the pack's own addon planner; the AI Diff Reviewer
  stays at v3.3.9, the pack's pin.

Install

git clone --branch v0.3.2 https://github.com/DailybotHQ/devcontainer-kit
./devcontainer-kit/install.sh

Verify a clone with shasum -a 256 -c SHA256SUMS. Images: ghcr.io/dailybothq/devcontainer-kit-base:{python-3.13,node-24,debian}-v0.3.2 (digests in the images workflow run).