[crocogiciel]

🎯 What & why

Ships kits/aidd/ as a Docker Sandbox mixin kit: one command installs the AIDD framework's recommended plugins into a claude-code sandbox, Claude-only, so it survives the runtime's settings overwrite.

🛠️ How it works

kits/aidd/spec.yaml (schemaVersion "2", kind: mixin) runs two setup.install steps as the sandbox's own claude CLI, not the aidd npm CLI — no Node/pnpm dependency inside the sandbox image, and it matches the proof of concept already validated on the issue.

1. Guards on claude being present, then claude plugin marketplace add + a claude plugin install loop over the recommended plugins. aidd-ui, aidd-telemetry and aidd-qa are deliberately left out (alpha/beta/unproven) — opt in by name after install.
2. The sandbox runtime replaces ~/.claude/settings.json with the host's own file at every session start, so step 1's install alone leaves every plugin disabled once a real session starts. Step 2 merges extraKnownMarketplaces + enabledPlugins into /etc/claude-code/managed-settings.json instead, which the runtime does not overwrite — merged, not written, since the base image or another kit may already hold content there.

scripts/__tests__/kit-aidd-managed-settings.test.js reads both commands straight out of spec.yaml (not a re-typed copy) and asserts: aidd-ui is never in the install list, and the merge keeps unrelated managed-settings keys while adding the AIDD wiring, including the missing-file and missing-user-file edge cases.

CI gets two jobs in ci.yml: validate-kit (sbx kit validate, every PR) and build-and-push-kit (gated on release-please's release_created, pushes ghcr.io/ai-driven-dev/aidd-sbx-kit:<version> and :latest).

Known gap, not fixable from this PR: build-and-push-kit needs a GHCR_PACKAGES_TOKEN repo secret (a PAT with write:packages) — pushing a brand-new non-container OCI artifact with GITHUB_TOKEN alone 403s on package creation, confirmed against a working reference implementation. An org admin has to add that secret before this job can succeed on the first real release.

🧪 How to verify

• sbx kit validate kits/aidd → VALID: kits/aidd (directory).
• node scripts/check-tests-leave-git-alone.js -- node --test 'scripts/__tests__/kit-aidd-managed-settings.test.js' → 4 passing.
• sbx run claude-code --kit ./kits/aidd against this checkout to install it into a real sandbox.

⚠️ Heads-up

• GHCR_PACKAGES_TOKEN secret still needs to be added to the repo before build-and-push-kit can succeed — see above.
• The kit's own version in spec.yaml is bumped by hand, decoupled from release-please; it is the pin point sbx kit add/push tag on.

🔗 Linked issue

Closes #678

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.

🤖 Generated with Claude Code