refactor(container): extract container definition into a dedicated package (#412)

Separate the container definition from the panel and the backend.

- New leaf package @prover-coder-ai/docker-git-container owns the pure
  rendering layer (planFiles → Dockerfile/entrypoint.sh/docker-compose.yml,
  TemplateConfig, resolveCompose* helpers). Zero deps on shell/usecases/api/app.
- packages/lib (backend) now depends on it and re-exports the moved symbols,
  keeping the @effect-template/lib public API unchanged.
- Panel: removed the dead duplicate packages/app/src/lib (165 files), its
  @lib / @effect-template/lib aliases and unused dependency. The no-lib-imports
  ESLint rule now forbids the panel from importing the backend OR the
  container-definition package.

No runtime behaviour change: generated container files are byte-identical,
guaranteed by the unchanged property-based template test suite (moved to the
new package). Dependency graph stays acyclic: container <- lib <- api.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: skulidropek

.changeset/separate-container-definition.md

@@ -0,0 +1,24 @@
+---
+"@prover-coder-ai/docker-git": patch
+"@effect-template/lib": patch
+---
+
+Separate the container definition from the panel and the backend (issue #412).
+
+The container definition — the pure layer that renders a project's `Dockerfile`,
+`entrypoint.sh` and `docker-compose.yml` from a `TemplateConfig` — has been
+extracted from the backend package (`@effect-template/lib`) into a new,
+dependency-free leaf package `@prover-coder-ai/docker-git-container`. The backend
+now depends on it and re-exports the moved symbols, so its public API is
+unchanged.
+
+The panel (`@prover-coder-ai/docker-git`) no longer carries a duplicate copy of
+the container/backend logic: the dead `packages/app/src/lib` tree (165 files) and
+its now-unused `@lib` / `@effect-template/lib` aliases and dependency were
+removed. The `no-lib-imports` ESLint rule now forbids the panel from importing
+either the backend or the container-definition package, keeping the boundary
+enforced.
+
+No runtime behaviour changes: the generated container files are byte-identical
+(guaranteed by the unchanged property-based template test suite, which moved to
+the new package).

bun.lock

@@ -7,6 +7,7 @@
   "workspaces": [
     "packages/api",
     "packages/app",
+    "packages/container",
     "packages/docker-git-session-sync",
     "packages/lib",
     "packages/terminal"

package.json

@@ -7,15 +7,15 @@
   "type": "module",
   "packageManager": "bun@1.3.11",
   "scripts": {
-    "prebuild": "bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "prebuild": "bun run --cwd ../terminal build && bun run --cwd ../container build && bun run --cwd ../lib build",
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch",
     "prestart": "bun run build",
     "start": "bun dist/src/main.js",
-    "pretypecheck": "bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "pretypecheck": "bun run --cwd ../terminal build && bun run --cwd ../container build && bun run --cwd ../lib build",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "lint": "eslint .",
-    "pretest": "bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "pretest": "bun run --cwd ../terminal build && bun run --cwd ../container build && bun run --cwd ../lib build",
     "test": "vitest run"
   },
   "dependencies": {

packages/api/package.json

@@ -1,6 +1,10 @@
 // @ts-check
 
-const bannedPackageName = "@effect-template/lib"
+// CHANGE: forbid the panel from importing BOTH the backend and the container-definition packages (issue #412)
+// WHY: packages/app is the panel; container orchestration lives in @effect-template/lib (backend) and
+//      container definition in @prover-coder-ai/docker-git-container. The panel must reach them only via the API client.
+// REF: issue-412
+const bannedPackageNames = ["@effect-template/lib", "@prover-coder-ai/docker-git-container"]
 const bannedLocalAlias = "@lib"
 
 /** @param {string} value */
@@ -38,7 +42,7 @@ const isFrontendSurfaceFile = (filePath) => {
 
 /** @param {string} value */
 const isDirectLibImport = (value) =>
-  value === bannedPackageName || value.startsWith(`${bannedPackageName}/`)
+  bannedPackageNames.some((name) => value === name || value.startsWith(`${name}/`))
 
 /**
  * @param {unknown} value
@@ -198,12 +202,12 @@ export const noLibImportsRule = {
     type: "problem",
     docs: {
       description:
-        "forbid direct imports, re-exports, and require calls from legacy lib surfaces inside package/app frontend surfaces and tests"
+        "forbid direct imports, re-exports, and require calls from the backend (@effect-template/lib) or container-definition (@prover-coder-ai/docker-git-container) packages inside package/app frontend surfaces and tests"
     },
     schema: [],
     messages: {
       noLibImport:
-        "Direct import or require '{{source}}' from legacy lib surfaces is forbidden in package/app frontend surfaces and tests. Use the API client or a local app adapter instead."
+        "Direct import or require '{{source}}' from the backend (@effect-template/lib) or container-definition (@prover-coder-ai/docker-git-container) packages is forbidden in package/app frontend surfaces and tests. Use the API client or a local app adapter instead."
     }
   },
   create: createRuleListener

packages/app/eslint/no-lib-imports.mjs

@@ -13,7 +13,7 @@
     "doc": "doc"
   },
   "scripts": {
-    "prebuild": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "prebuild": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build",
     "build": "bun run build:app && bun run build:docker-git",
     "build:app": "vite build --ssr src/app/main.ts",
     "build:web": "vite build --config vite.web.config.ts",
@@ -22,13 +22,13 @@
     "dev": "vite build --watch --ssr src/app/main.ts",
     "dev:web": "vite --config vite.web.config.ts",
     "serve:web": "bun scripts/serve-dist-web.mjs",
-    "prelint": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "prelint": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build",
     "lint": "NODE_OPTIONS=--max-old-space-size=4096 PATH=../../scripts:$PATH vibecode-linter src/",
     "lint:tests": "NODE_OPTIONS=--max-old-space-size=4096 PATH=../../scripts:$PATH vibecode-linter tests/",
     "lint:effect": "NODE_OPTIONS=--max-old-space-size=4096 PATH=../../scripts:$PATH eslint --config eslint.effect-ts-check.config.mjs .",
-    "prebuild:docker-git": "bun install --cwd ../.. && bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "prebuild:docker-git": "bun install --cwd ../.. && bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build",
     "build:docker-git": "vite build --config vite.docker-git.config.ts",
-    "prebuild:docker-git:reuse-install": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "prebuild:docker-git:reuse-install": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build",
     "build:docker-git:reuse-install": "vite build --config vite.docker-git.config.ts",
     "check": "bun run typecheck",
     "clone": "bun run build:docker-git && bun dist/src/docker-git/main.js clone",
@@ -37,9 +37,9 @@
     "list": "bun run build:docker-git && bun dist/src/docker-git/main.js ps",
     "preview:web": "vite preview --config vite.web.config.ts",
     "start": "bun run build:docker-git && bun dist/src/docker-git/main.js",
-    "pretest": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "pretest": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build",
     "test": "bun run lint:tests && vitest run",
-    "pretypecheck": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build && bun run --cwd ../lib build",
+    "pretypecheck": "bun run --cwd ../docker-git-session-sync build && bun run --cwd ../terminal build",
     "typecheck": "tsc --noEmit"
   },
   "repository": {
@@ -87,7 +87,6 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.0",
-    "@effect-template/lib": "workspace:*",
     "@effect/eslint-plugin": "^0.3.2",
     "@effect/language-service": "latest",
     "@effect/vitest": "^0.29.0",

packages/app/package.json

@@ -17,8 +17,7 @@ type RawTerminalSession = {
 
 const isTerminalSessionStatus = (
   value: string
-): value is ApiTerminalSession["status"] =>
-  ["ready", "attached", "exited", "failed"].includes(value)
+): value is ApiTerminalSession["status"] => ["ready", "attached", "exited", "failed"].includes(value)
 
 const readOptionalNumber = (value: JsonValue | undefined): number | undefined =>
   typeof value === "number" ? value : undefined

packages/app/src/docker-git/api-terminal-codec.ts

@@ -57,7 +57,6 @@ const browserFrontendRevisionInputs: ReadonlyArray<string> = [
   "packages/app/vite.web.config.ts",
   "packages/app/scripts/serve-dist-web.mjs",
   "packages/app/src/docker-git",
-  "packages/app/src/lib",
   "packages/app/src/shared",
   "packages/app/src/ui",
   "packages/app/src/web"

packages/app/src/docker-git/browser-frontend-state.ts

@@ -37,7 +37,7 @@ export const controllerContainerName = process.env["DOCKER_GIT_API_CONTAINER_NAM
 
 const inspectNetworksTemplate = String
   .raw`{{range $k,$v := .NetworkSettings.Networks}}{{printf "%s=%s\n" $k $v.IPAddress}}{{end}}`
-const inspectEnvTemplate = String.raw`{{range .Config.Env}}{{println .}}{{end}}`
+const inspectEnvTemplate = "{{range .Config.Env}}{{println .}}{{end}}"
 
 const controllerBootstrapError = (message: string): ControllerBootstrapError => ({
   _tag: "ControllerBootstrapError",

packages/app/src/docker-git/controller-docker.ts

@@ -9,8 +9,8 @@ import { type ControllerRuntime, runDockerCapture, runDockerCaptureWithFailureOu
 import { parseControllerRevisionLabelOutput } from "./controller-revision.js"
 import type { ControllerBootstrapError } from "./host-errors.js"
 
-const inspectControllerRevisionLabelTemplate = String
-  .raw`{{ index .Config.Labels "io.prover-coder-ai.docker-git.controller-rev" }}`
+const inspectControllerRevisionLabelTemplate =
+  "{{ index .Config.Labels \"io.prover-coder-ai.docker-git.controller-rev\" }}"
 const missingImageInspectionPatterns: ReadonlyArray<RegExp> = [/No such image/iu, /No such object/iu]
 
 /**