From ff5bd1cec25ac0ecc5e3debb67a65bf5dd0528e9 Mon Sep 17 00:00:00 2001
From: Tasha Snow <tsnow@mines.edu>
Date: Tue, 18 Aug 2026 23:53:59 -0600
Subject: [PATCH 1/2] Clean up postBuild by removing unused installations

Removed installation steps for Google Cloud CLI and opencode.
---
 .binder/postBuild | 32 +-------------------------------
 1 file changed, 1 insertion(+), 31 deletions(-)

diff --git a/.binder/postBuild b/.binder/postBuild
index a80ac97..500a472 100644
--- a/.binder/postBuild
+++ b/.binder/postBuild
@@ -8,35 +8,5 @@ npm install -g @anthropic-ai/claude-code@2.1.220
 #Claude ACP bridge 
 npm install -g @agentclientprotocol/claude-agent-acp
 
+# install openai
 npm install -g @openai/codex@0.145.0
-OPENCODE_VERSION=v1.18.7
-platform="linux-x64"
-curl -fsSL https://github.com/anomalyco/opencode/releases/download/${OPENCODE_VERSION}/opencode-${platform}.tar.gz | tar -xzv -C "${NB_PYTHON_PREFIX}/bin"
-test -f "${NB_PYTHON_PREFIX}/bin/opencode"
-
-# Google Cloud CLI (gcloud, gsutil, bq) — pinned, installed outside $HOME
-# so it isn't wiped when the real user filesystem mounts at hub spin-up.
-GCLOUD_VERSION=580.0.0
-mkdir -p "${NB_PYTHON_PREFIX}/opt"
-curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${GCLOUD_VERSION}-linux-x86_64.tar.gz" \
-  | tar -xz -C "${NB_PYTHON_PREFIX}/opt"
-
-"${NB_PYTHON_PREFIX}/opt/google-cloud-sdk/install.sh" \
-  --quiet \
-  --path-update=false \
-  --command-completion=false \
-  --usage-reporting=false
-
-for bin in gcloud gsutil bq; do
-  ln -sf "${NB_PYTHON_PREFIX}/opt/google-cloud-sdk/bin/${bin}" "${NB_PYTHON_PREFIX}/bin/${bin}"
-done
-
-test -x "${NB_PYTHON_PREFIX}/bin/gcloud"
-gcloud version
-
-# Put our custom Jupyter Server config into appropriate platform
-# This path is determined by looking at output of `jupyter --path` in the hub
-# We copy both to notebook server config and jupyter server config, because either can be
-# used in the JupyterHub.
-cp custom_jupyter_server_config.json ${NB_PYTHON_PREFIX}/etc/jupyter/jupyter_server_config.d/
-cp custom_jupyter_server_config.json ${NB_PYTHON_PREFIX}/etc/jupyter/jupyter_notebook_config.d/

From 9abbfeb28d07705b8c88f6a0745acb5934f2d374 Mon Sep 17 00:00:00 2001
From: Tasha Snow <tsnow@mines.edu>
Date: Wed, 19 Aug 2026 00:01:31 -0600
Subject: [PATCH 2/2] Update appendix with new installation steps and
 configurations

---
 appendix | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/appendix b/appendix
index b75b3f1..0beca72 100644
--- a/appendix
+++ b/appendix
@@ -17,6 +17,40 @@ RUN ${MAMBA_EXE} env create --prefix ${NB_PYTHON_PREFIX} --yes --file "conda-lin
  && ${MAMBA_EXE} list --prefix ${NB_PYTHON_PREFIX} \
  && ${MAMBA_EXE} clean --all --force-pkgs-dirs --yes
 
+# ---------------------------------------------------------------------------
+# Everything below MUST stay after the mamba env create above. That step
+# recreates ${NB_PYTHON_PREFIX} from the lockfile and deletes anything
+# postBuild wrote into it.
+# ---------------------------------------------------------------------------
+
+RUN OPENCODE_VERSION=v1.18.7 \
+ && curl -fsSL "https://github.com/anomalyco/opencode/releases/download/${OPENCODE_VERSION}/opencode-linux-x64.tar.gz" \
+      | tar -xz -C ${NB_PYTHON_PREFIX}/bin \
+ && test -x ${NB_PYTHON_PREFIX}/bin/opencode
+
+RUN GCLOUD_VERSION=580.0.0 \
+ && mkdir -p ${NB_PYTHON_PREFIX}/opt \
+ && curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-${GCLOUD_VERSION}-linux-x86_64.tar.gz" \
+      | tar -xz -C ${NB_PYTHON_PREFIX}/opt \
+ && ${NB_PYTHON_PREFIX}/opt/google-cloud-sdk/install.sh --quiet \
+      --path-update=false --command-completion=false --usage-reporting=false \
+ && for b in gcloud gsutil bq; do \
+      ln -sf ${NB_PYTHON_PREFIX}/opt/google-cloud-sdk/bin/$b ${NB_PYTHON_PREFIX}/bin/$b; \
+    done \
+ && ${NB_PYTHON_PREFIX}/bin/gcloud version
+
+# Mothership CLI. Pinned so a mid-workshop upstream push can't change what
+# participants get. Bump deliberately.
+RUN MOTHERSHIP_REF=main \
+ && ${NB_PYTHON_PREFIX}/bin/pip install --no-cache-dir \
+      "git+https://github.com/mikerjacobi/agent-workshop.git@${MOTHERSHIP_REF}#subdirectory=cli" \
+ && ${NB_PYTHON_PREFIX}/bin/mothership --version
+
+# Repo is copied to /srv/repo at build step 18; the build context root has it
+# under src/, so copy from the installed location rather than the context.
+RUN cp /srv/repo/custom_jupyter_server_config.json ${NB_PYTHON_PREFIX}/etc/jupyter/jupyter_server_config.d/ \
+ && cp /srv/repo/custom_jupyter_server_config.json ${NB_PYTHON_PREFIX}/etc/jupyter/jupyter_notebook_config.d/
+
 # Mothership GCP service account key — workshop-scoped, revoked after.
 # required=false so PR/test builds (which never receive this secret) don't fail.
 RUN --mount=type=secret,id=gcp_key,required=false \
@@ -28,4 +62,6 @@ RUN --mount=type=secret,id=gcp_key,required=false \
         echo "No gcp_key secret provided — skipping (expected on PR/test builds)."; \
     fi
 
+# Path only, never the key itself — the SecretsUsedInArgOrEnv warning BuildKit
+# prints here is a false positive.
 ENV GOOGLE_APPLICATION_CREDENTIALS=${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json