Add security hardening, Ghidra, recreate skill, checkpoints, shells, web search and themes

- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas,
  login rate limiting, audit log and backups
- Ghidra headless decompilation (ARM64 natives built from source), binary_info tool,
  clean room / deep workflow per session
- Recreate skill and commands for analysing and re-building old software
- File checkpoints with rewind/restore, background shells (bash_output, kill_shell)
- web_search tool (DuckDuckGo, SearXNG, Brave, Tavily)
- In-app dialogs and toasts instead of browser dialogs
- 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One,
  Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -23,15 +23,26 @@ RUN cd server && touch src/main.rs && cargo build --release
 # Node is included so agents can work on JS projects and run npx-based MCP servers.
 FROM node:22-bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates bash git curl ripgrep jq less procps \
-        python3 python3-venv build-essential \
-        chromium fonts-dejavu-core fonts-noto-color-emoji \
+        ca-certificates bash git curl wget ripgrep jq less procps file bubblewrap \
+        unzip zip xz-utils bzip2 p7zip-full unar innoextract unshield cabextract msitools arj lhasa \
+        python3 python3-pip python3-venv pipx \
+        build-essential pkg-config libssl-dev cmake zlib1g-dev binutils-multiarch \
+        chromium fonts-dejavu-core fonts-noto-color-emoji poppler-utils openmpt123 \
     && rm -rf /var/lib/apt/lists/*
 COPY --from=server /src/server/target/release/codecraft /usr/local/bin/codecraft
 COPY --from=web /web/dist /app/web
+COPY server/ghidra /app/ghidra
+COPY server/resources /app/resources
+# The agent's home lives on the data volume: tools it installs in user space
+# (pip --user, pipx, rustup, npm -g, downloaded binaries) survive rebuilds.
 ENV CODECRAFT_WEB=/app/web \
     CODECRAFT_CONFIG=/data/config.toml \
     HOME=/data/home \
+    PATH=/data/home/.local/bin:/data/home/.cargo/bin:/data/home/.npm-global/bin:/usr/local/bin:/usr/bin:/bin \
+    NPM_CONFIG_PREFIX=/data/home/.npm-global \
+    PIP_BREAK_SYSTEM_PACKAGES=1 \
+    PIPX_HOME=/data/home/.local/pipx \
+    PIPX_BIN_DIR=/data/home/.local/bin \
     RUST_LOG=info
 RUN mkdir -p /data /workspace && chmod 777 /data /workspace
 VOLUME ["/data"]