feat: add native kandev launcher (#1391)

Dockerfile

@@ -3,7 +3,7 @@
 # Single-stage build that consumes prebuilt artifacts. The release workflow
 # (.github/workflows/release.yml) extracts the per-arch release bundle
 # (`kandev-linux-{x64,arm64}.tar.gz`) into the build context, then this file
-# just COPYs the binaries + web standalone + CLI into the runtime layout.
+# just COPYs the native binaries into the runtime layout.
 #
 # Building this file outside CI (manual `docker build .`) will fail because
 # the `bundle/` directory isn't present in the build context. To build
@@ -14,12 +14,7 @@
 # Run:
 #   docker run -p 38429:38429 -v kandev-data:/data ghcr.io/kdlbs/kandev:latest
 
-ARG PNPM_VERSION=9.15.9
-
-FROM node:24-bookworm-slim
-
-ARG PNPM_VERSION
-LABEL org.opencontainers.image.pnpm-version="${PNPM_VERSION}"
+FROM debian:bookworm-slim
 
 # Install runtime dependencies. gh is included because the GitHub integration
 # (PR review, webhooks) shells out to it for auth fallback when GITHUB_TOKEN
@@ -41,10 +36,10 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/* && \
     PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install apprise
 
-# Replace the node base image's default user so we own uid 1000.
+# Create the runtime user with uid 1000.
 # Home is placed under /data so agent CLI auth state (gh, claude, codex, auggie,
 # copilot, amp, ...) lives on the PV and survives pod restarts and image upgrades.
-RUN userdel -r node && groupadd -r kandev && useradd -r -g kandev -u 1000 -d /data/home -M kandev
+RUN groupadd -r kandev && useradd -r -g kandev -u 1000 -d /data/home -M kandev
 
 # Install azure-devops extension under the runtime user's Azure config dir on /data.
 RUN mkdir -p /data/home/.azure && \
@@ -53,18 +48,13 @@ RUN mkdir -p /data/home/.azure && \
 
 # Create app directory structure matching what `kandev start` expects:
 #   /app/apps/backend/bin/kandev
-#   /app/apps/web/.next/standalone/web/server.js
-RUN mkdir -p /app/apps/backend/bin /app/apps/web/.next/standalone /usr/local/lib/kandev-cli /data/worktrees
+RUN mkdir -p /app/apps/backend/bin /data/worktrees
 
 # Build context layout (prepared by the release workflow from the extracted
 # bundle tarball):
 #   bundle/bin/kandev                  - native Go backend (per-arch)
 #   bundle/bin/agentctl                - native agentctl (per-arch)
 #   bundle/bin/agentctl-linux-amd64    - amd64 agentctl helper (always amd64)
-#   bundle/web/...                     - Next.js standalone + static + public
-#   bundle/cli/bin/cli.js              - CLI entrypoint (calls cli.bundle.js)
-#   bundle/cli/dist/cli.bundle.js      - self-contained CLI bundle (deps inlined)
-#   bundle/cli/package.json            - package metadata (version, etc.)
 #
 # The bundle's `bin/agentctl-linux-amd64` variant is bind-mounted into
 # Docker-executor sandboxes by the lifecycle manager; ship it next to kandev
@@ -72,20 +62,16 @@ RUN mkdir -p /app/apps/backend/bin /app/apps/web/.next/standalone /usr/local/lib
 COPY bundle/bin/kandev               /app/apps/backend/bin/kandev
 COPY bundle/bin/agentctl-linux-amd64 /app/apps/backend/bin/agentctl-linux-amd64
 COPY bundle/bin/agentctl             /usr/local/bin/agentctl
-COPY bundle/web/                     /app/apps/web/.next/standalone/
-COPY bundle/cli/                     /usr/local/lib/kandev-cli/
 COPY docker-entrypoint.sh            /usr/local/bin/docker-entrypoint.sh
 
-# Re-apply executable bits stripped by tar/COPY edge cases, then link the
-# CLI launcher onto PATH. The CLI's deps are inlined into dist/cli.bundle.js
-# by the release bundle step, so no `npm install` is needed here.
+# Re-apply executable bits stripped by tar/COPY edge cases, then link the native
+# launcher onto PATH.
 RUN chmod +x \
         /app/apps/backend/bin/kandev \
         /app/apps/backend/bin/agentctl-linux-amd64 \
         /usr/local/bin/agentctl \
-        /usr/local/lib/kandev-cli/bin/cli.js \
         /usr/local/bin/docker-entrypoint.sh && \
-    ln -s /usr/local/lib/kandev-cli/bin/cli.js /usr/local/bin/kandev && \
+    ln -s /app/apps/backend/bin/kandev /usr/local/bin/kandev && \
     chown -R kandev:kandev /app /data
 
 # Kandev home directory (DB, worktrees, sessions, repos)
@@ -105,10 +91,10 @@ ENV KANDEV_NO_BROWSER=1 \
 
 WORKDIR /app
 
-# Only the backend port is exposed — it reverse-proxies the Next.js frontend
-# (which listens on 37429 internally), so users hit a single port.
+# Only the backend port is exposed; the Go backend serves API, WebSocket, and
+# embedded SPA assets on the same listener.
 EXPOSE 38429
 
 # tini as PID 1 for signal handling; entrypoint handles privilege drop
 ENTRYPOINT ["tini", "--", "docker-entrypoint.sh"]
-CMD ["kandev", "start", "--backend-port", "38429", "--web-port", "37429", "--verbose"]
+CMD ["kandev", "start", "--backend-port", "38429", "--verbose"]