first round of changes: dedicated cache folder, cleaner base image, version management

example/.safeclaude/hooks/10-ruby.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-# Sets up rbenv and the project's Ruby. Safe to run every launch — it only does
-# real work the first time, or when the Ruby version changes.
-set -euo pipefail
-
-# Grab rbenv (cloned into the home folder so it sticks around between runs).
-if [ ! -d "$RBENV_ROOT/bin" ]; then
-  echo "[ruby] installing rbenv..."
-  git clone --depth=1 https://github.com/rbenv/rbenv.git "$RBENV_ROOT"
-  git clone --depth=1 https://github.com/rbenv/ruby-build.git "$RBENV_ROOT/plugins/ruby-build"
-fi
-eval "$(rbenv init - bash)"
-
-# Pick the Ruby version: the project's .ruby-version wins, then whatever rbenv
-# was last set to, then a sensible default.
-if [ -f /code/.ruby-version ]; then
-  RUBY_VERSION="$(tr -d '[:space:]' < /code/.ruby-version)"
-elif [ -f "$RBENV_ROOT/version" ]; then
-  RUBY_VERSION="$(cat "$RBENV_ROOT/version")"
-else
-  RUBY_VERSION="3.3.6"
-fi
-
-if ! rbenv versions --bare 2>/dev/null | grep -qx "$RUBY_VERSION"; then
-  echo "[ruby] installing Ruby $RUBY_VERSION (first time only — takes a few minutes)..."
-  rbenv install "$RUBY_VERSION"
-fi
-rbenv global "$RUBY_VERSION"
-
-# Make sure bundler is installed for this Ruby.
-gem list bundler -i &>/dev/null || gem install bundler --no-document

example/.safeclaude/hooks/15-node.sh.example

@@ -1,15 +0,0 @@
-#!/bin/bash
-# OPTIONAL — only needed if your project pins a Node version via .nvmrc (the base
-# already includes a working Node). Rename to 15-node.sh to turn it on.
-set -euo pipefail
-
-if [ ! -s "$NVM_DIR/nvm.sh" ]; then
-  echo "[node] installing nvm..."
-  curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/install.sh \
-    | NVM_DIR="$NVM_DIR" PROFILE=/dev/null bash
-fi
-. "$NVM_DIR/nvm.sh"
-
-if [ -f /code/.nvmrc ]; then
-  ( cd /code && nvm install && nvm use )
-fi

example/.safeclaude/hooks/20-bundle.sh

@@ -1,15 +1,19 @@
 #!/bin/bash
 # Installs gems, but only when Gemfile.lock has changed: it remembers the last
-# version it installed (saved between runs), so an unchanged lockfile is a
-# near-instant no-op.
+# version it installed, so an unchanged lockfile is a near-instant no-op.
+#
+# Both the gems (via BUNDLE_PATH, set in the Dockerfile) and the marker below
+# live in /code/.safeclaude/cache — on the host, so they persist between runs
+# and stay out of git. Ruby is already on PATH from the Dockerfile, so there's
+# no version manager to initialize here.
 set -euo pipefail
 
 [ -f /code/Gemfile ] || exit 0
-eval "$(rbenv init - bash)"
 
+CACHE=/code/.safeclaude/cache
+mkdir -p "$CACHE"
 LOCK=/code/Gemfile.lock
-MARKER="$HOME/.safeclaude-deps/gemfile.sha"
-mkdir -p "$(dirname "$MARKER")"
+MARKER="$CACHE/gemfile.sha"
 CUR="$( [ -f "$LOCK" ] && sha256sum "$LOCK" | cut -d' ' -f1 || echo no-lock )"
 
 if [ "$(cat "$MARKER" 2>/dev/null || true)" != "$CUR" ]; then