From a469fc7c34042df931f75e790e1f64e78a1c9c5d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 16 Apr 2026 13:42:51 +0000
Subject: [PATCH] fix: bug: generator emits ghcr.io/disinto/agents image ref
 but no registry pull is configured (#853)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TOML-driven hired-agent services (`_generate_local_model_services` in
`lib/generators.sh`) were emitting `image: ghcr.io/disinto/agents:<tag>`
for every hired agent. The ghcr image is not publicly pullable and
deployments don't carry ghcr credentials, so `docker compose up` failed
with `denied` on every new hire. The legacy `agents-llama` stanza dodged
this because it uses the registry-less local name plus a `build:` fallback.

Fix: match the legacy stanza — emit `build: { context: ., dockerfile:
docker/agents/Dockerfile }` paired with `image: disinto/agents:<tag>`.
Hosts that built locally with `disinto init --build` will find the image;
hosts without one will build it. No ghcr auth required either way.

Added a regression test that guards both the absence of the ghcr prefix
and the presence of the build directive.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 lib/generators.sh         | 10 +++++++++-
 tests/lib-generators.bats | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/lib/generators.sh b/lib/generators.sh
index 87d997b..59339ac 100644
--- a/lib/generators.sh
+++ b/lib/generators.sh
@@ -114,7 +114,15 @@ _generate_local_model_services() {
             cat >> "$temp_file" <<EOF
 
   agents-${service_name}:
-    image: ghcr.io/disinto/agents:\${DISINTO_IMAGE_TAG:-latest}
+    # Local image ref (#853): registry-less name matches what \`disinto init --build\`
+    # and the legacy agents-llama stanza produce. Paired with build: so hosts without
+    # a pre-built image can rebuild locally; ghcr.io/disinto/agents is not publicly
+    # pullable, and emitting that prefix caused \`docker compose up\` to fail with
+    # \`denied\` on every hired agent.
+    build:
+      context: .
+      dockerfile: docker/agents/Dockerfile
+    image: disinto/agents:\${DISINTO_IMAGE_TAG:-latest}
     container_name: disinto-agents-${service_name}
     restart: unless-stopped
     security_opt:
diff --git a/tests/lib-generators.bats b/tests/lib-generators.bats
index 0573579..3ffa38c 100644
--- a/tests/lib-generators.bats
+++ b/tests/lib-generators.bats
@@ -62,6 +62,41 @@ EOF
   [[ "$output" != *'FORGE_BOT_USER_LLAMA'* ]]
 }
 
+@test "local-model agent service emits local image ref + build: fallback (#853)" {
+  # Before #853 the generator emitted `image: ghcr.io/disinto/agents:<tag>` for
+  # every hired agent. The ghcr image isn't publicly pullable and the running
+  # deployment has no credentials, so `docker compose up` failed with `denied`.
+  # The fix: emit the registry-less local name (matches `disinto init --build`
+  # and the legacy agents-llama stanza) plus a build: directive so hosts
+  # without a pre-built image can rebuild locally.
+  cat > "${FACTORY_ROOT}/projects/test.toml" <<'EOF'
+name      = "test"
+repo      = "test-owner/test-repo"
+forge_url = "http://localhost:3000"
+
+[agents.dev-qwen2]
+base_url   = "http://10.10.10.1:8081"
+model      = "qwen"
+api_key    = "sk-no-key-required"
+roles      = ["dev"]
+forge_user = "dev-qwen2"
+EOF
+
+  run bash -c "
+    set -euo pipefail
+    source '${ROOT}/lib/generators.sh'
+    _generate_local_model_services '${FACTORY_ROOT}/docker-compose.yml'
+    cat '${FACTORY_ROOT}/docker-compose.yml'
+  "
+
+  [ "$status" -eq 0 ]
+  # Local image ref — no ghcr prefix.
+  [[ "$output" == *'image: disinto/agents:${DISINTO_IMAGE_TAG:-latest}'* ]]
+  [[ "$output" != *'image: ghcr.io/disinto/agents'* ]]
+  # build: fallback so hosts without a pre-built image can rebuild.
+  [[ "$output" == *'dockerfile: docker/agents/Dockerfile'* ]]
+}
+
 @test "local-model agent service keys FORGE_BOT_USER to forge_user even when it differs from service name (#849)" {
   # Exercise the case the issue calls out: two agents in the same factory
   # whose service names are identical (`[agents.llama]`) but whose