Promote v0.44.0 to production

.docker/app/Dockerfile

@@ -113,16 +113,16 @@
 ENV S3_ENDPOINT=http://minio:9000
 ENV S3_PRESIGN_ENDPOINT=http://minio:9000
 ENV S3_REGION=us-east-1
 ENV S3_ACCESS_KEY_ID=roomote
 ENV S3_SECRET_ACCESS_KEY=roomote-local-artifacts-password
 ENV S3_BUCKET_ARTIFACTS=roomote-artifacts
 ENV JOB_AUTH_PRIVATE_KEY=local-self-host-build-job-auth-private-key
 ENV JOB_AUTH_PUBLIC_KEY=local-self-host-build-job-auth-public-key
 ENV PREVIEW_AUTH_PRIVATE_KEY=local-self-host-build-preview-auth-private-key
 ENV PREVIEW_AUTH_PUBLIC_KEY=local-self-host-build-preview-auth-public-key
 ENV DASHBOARD_PASSWORD=roomote-local-admin
 ENV ENCRYPTION_KEY=local-roomote-encryption-key-0001
 ENV ARTIFACT_SIGNING_KEY=local-roomote-artifact-signing-key-1
 ENV PREVIEW_PROXY_BASE_URL=http://localhost:18081
 ENV PREVIEW_DOMAINS=localhost,127.0.0.1,roomotepreview.localhost
 
@@ -178,12 +178,14 @@
 # Runtime-only dependency tree for the externals tsup does not bundle. Install
 # from its standalone lockfile so unrelated workspace packages stay excluded.
 COPY .docker/app/runtime-deps/api /runtime-deps/
-# The zod parity check guards the Fast agent's native tool runtime: it
-# symlinks an on-disk zod into each generated OpenCode tool directory via
-# require.resolve, which the api bundle (noExternal) cannot satisfy on its
-# own. A version drifting from the workspace would silently change what the
-# generated tool sources execute against.
+# Version parity keeps API externals aligned with the workspace. Zod also
+# guards the Fast agent's native tool runtime, which symlinks it into each
+# generated OpenCode tool directory via require.resolve.
 RUN cd /runtime-deps && pnpm install --prod --frozen-lockfile && \
+  test "$(node -p "require(require('node:path').join(require('node:path').dirname(require.resolve('dompurify')), '../package.json')).version")" = \
+    "$(cd /roomote/apps/api && node -p "require(require('node:path').join(require('node:path').dirname(require.resolve('dompurify')), '../package.json')).version")" && \
+  test "$(node -p "require('jsdom/package.json').version")" = \
+    "$(cd /roomote/apps/api && node -p "require('jsdom/package.json').version")" && \
   test "$(node -p "require('snowflake-sdk/package.json').version")" = \
     "$(cd /roomote/apps/api && node -p "require('snowflake-sdk/package.json').version")" && \
   test "$(node -p "require('zod/package.json').version")" = \
@@ -310,6 +312,12 @@
 
 ARG OPENCODE_CLI_VERSION=1.18.10
 
+# Fast mode uses bounded, temporary partial Git fetches to discover
+# repository-defined skills without exposing a checkout to the model.
+RUN apt -qq update && \
+  apt -qq install -y git && \
+  rm -rf /var/lib/apt/lists/*
+
 # The install and version check run as root; with the image's HOME=/tmp they
 # would bake root-owned dotdirs (npm cache, OpenCode's data/config/cache
 # dirs) into the layer. The runtime user shares that HOME and must be able to
@@ -376,6 +384,7 @@
 COPY --from=build-api /roomote/apps/api/package.json ./apps/api/
 COPY --from=build-api /roomote/apps/api/dist ./apps/api/dist/
 COPY --from=build-api /runtime-deps/node_modules ./apps/api/node_modules/
+COPY --chown=roomote-app:roomote-app --from=build-api /roomote/packages/cloud-agents/src/server/workflows/skills/standard ./skills/standard/
 COPY --from=build-api /migrate /roomote/migrate/
 COPY --from=build-controller /roomote/releases /roomote/releases/
 COPY --from=build-controller /roomote/apps/controller/package.json ./apps/controller/
@@ -388,8 +397,10 @@
 COPY --from=build-preview-proxy /roomote/apps/preview-proxy/dist ./apps/preview-proxy/dist/
 COPY --from=build-preview-proxy /runtime-deps/node_modules ./apps/preview-proxy/node_modules/
 COPY --from=github-cli /usr/bin/gh /usr/local/bin/gh
-RUN command -v gh >/dev/null && command -v opencode >/dev/null && \
-  cd /roomote/apps/bullmq && node -e "require.resolve('zod/package.json')"
+RUN command -v git >/dev/null && command -v gh >/dev/null && \
+  command -v opencode >/dev/null && \
+  cd /roomote/apps/bullmq && node -e "require.resolve('zod/package.json')" && \
+  ls -d /roomote/node_modules/.pnpm/zod@*/node_modules/zod >/dev/null
 
 USER roomote-app:roomote-app
 EXPOSE 3000 3001 3002 8081

.docker/app/runtime-deps/api/package.json

@@ -4,6 +4,8 @@
   "private": true,
   "packageManager": "pnpm@10.29.3",
   "dependencies": {
+    "dompurify": "3.4.13",
+    "jsdom": "26.1.0",
     "snowflake-sdk": "2.4.3",
     "zod": "3.25.76"
   },