feat(workspaces): modularize hub api, improve security, and optimize docker image

packages/workspace-manager/docker/Dockerfile

@@ -1,6 +1,13 @@
 # Copyright 2026 Google LLC
 # SPDX-License-Identifier: Apache-2.0
 
+# Stage 1: Build shpool
+FROM rust:1.81-slim-bookworm AS builder
+
+RUN apt-get update && apt-get install -y build-essential curl && rm -rf /var/lib/apt/lists/*
+RUN cargo install shpool
+
+# Stage 2: Final Image
 FROM node:20-slim
 
 # Install system dependencies
@@ -11,7 +18,6 @@ RUN apt-get update && apt-get install -y \
     vim \
     tmux \
     procps \
-    build-essential \
     && rm -rf /var/lib/apt/lists/*
 
 # Install GitHub CLI
@@ -21,13 +27,8 @@ RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | d
     && apt-get update \
     && apt-get install gh -y
 
-# Install Rust (to install shpool)
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-# Install shpool
-RUN cargo install shpool \
-    && mv /root/.cargo/bin/shpool /usr/local/bin/shpool
+# Copy shpool from builder
+COPY --from=builder /usr/local/cargo/bin/shpool /usr/local/bin/shpool
 
 # Install global dev tools
 RUN npm install -g tsx eslint vitest typescript prettier @google/gemini-cli@nightly

packages/workspace-manager/docker/entrypoint.sh

@@ -2,14 +2,25 @@
 # Copyright 2026 Google LLC
 # SPDX-License-Identifier: Apache-2.0
 
+set -e
+
 # Ensure GH_TOKEN is set from memory-only mount if available
 if [ -f /dev/shm/.gh_token ]; then
     export GH_TOKEN=$(cat /dev/shm/.gh_token)
     echo "GitHub token injected from memory."
 fi
 
-# Start shpool daemon in the background
+# Start shpool daemon in the background and verify it stays up
 /usr/local/bin/shpool daemon &
+SHPOOL_PID=$!
+
+sleep 2
+if ! kill -0 $SHPOOL_PID 2>/dev/null; then
+    echo "Error: shpool daemon failed to start"
+    exit 1
+fi
+
+echo "shpool daemon started successfully (PID: $SHPOOL_PID)"
 
 # Restore ~/.gemini settings if they are provided in a mount or PD
 # (Assuming PD is mounted at /home/node/persistent_home for now)