feat(agent): enable RTK for docker-git agents

[skulidropek]

Summary

Fixes #266.

• Install RTK into generated docker-git images by default.
• Initialize RTK for Codex, Claude, Gemini, and OpenCode during container startup.
• Run API/UI agent sessions as the project SSH user with the project agent environment loaded, so the agent sees the RTK-managed HOME/CODEX_HOME/Claude/OpenCode/Gemini config instead of root config.
• Add DOCKER_GIT_RTK_ENABLE=1|0 opt-out documentation and nested docker-git propagation.

Proof that agent commands route through RTK

Local verification on this branch:

rtk --version
# rtk 0.39.0

rtk hook check 'git status'
# rtk git status

rtk rewrite 'git status'
# rtk git status

Temp-home install proof with the same commands rendered by the entrypoint:

HOME=/tmp/.../home/dev CODEX_HOME=/tmp/.../home/dev/.codex rtk init -g --codex
HOME=/tmp/.../home/dev RTK_CLAUDE_DIR=/tmp/.../home/dev/.claude rtk init -g --auto-patch
HOME=/tmp/.../home/dev rtk init -g --opencode
HOME=/tmp/.../home/dev rtk init -g --gemini --auto-patch

Observed RTK artifacts:

• Claude: .claude/settings.json contains hook command rtk hook claude.
• Gemini: .gemini/hooks/rtk-hook-gemini.sh contains exec rtk hook gemini, and .gemini/settings.json points to that hook.
• OpenCode: .config/opencode/plugins/rtk.ts calls rtk rewrite ${command} before tool execution.
• API agents now start with docker exec -u <sshUser> and export HOME=/home/<sshUser> plus CODEX_HOME, then source /etc/profile, /home/<sshUser>/.ssh/environment, and /run/docker-git/agent-env.sh before execing the agent command.

Important boundary: RTK 0.39.0 does not provide a native Codex hook. rtk init --help documents --codex as Target Codex CLI (uses AGENTS.md + RTK.md, no Claude hook patching). So Claude/Gemini/OpenCode have technical hook/plugin routing through RTK; Codex is RTK-instruction based until upstream RTK ships a Codex hook.

Verification

• bun --cwd packages/api test tests/agents.test.ts
• bun run --filter @effect-template/api typecheck
• bun run --filter @effect-template/api lint
• bun run --filter @effect-template/api build
• generated agent script bash -n
• git diff --check
• bun run check
• bun run build
• bun run test

[skulidropek]

RTK scope clarification:

This is not GitHub-only. Local rewrite checks on this branch:

rtk rewrite 'gh issue view 266'
# rtk gh issue view 266

rtk rewrite 'docker ps'
# rtk docker ps

rtk rewrite 'tsc --noEmit -p tsconfig.json'
# rtk tsc --noEmit -p tsconfig.json

It is also not an arbitrary-command firewall. Unsupported commands intentionally pass through unchanged:

rtk rewrite 'echo hello'
# no rewrite

So the exact guarantee is: Claude/Gemini/OpenCode hooks route supported command families through RTK (git, gh, glab, docker, kubectl, aws, psql, package managers, test/type/lint tools, etc.). Commands RTK does not know are not rewritten. Codex remains instruction-based because RTK 0.39.0 has no Codex native hook.

[skulidropek]

AI Session Backup

Commit: 96f6ee1
Status: success
Files: 7 (4.15 MB)
Links: README | Manifest

git status

On branch pr-268
Your branch is up to date with 'origin/pr-268'.

nothing to commit, working tree clean