Image size: make coding-agent installs opt-in (AIDC_AGENTS) — 981MB agent layer is the biggest chunk

[ai-anant]

Problem

The single largest layer in the aidc image is the coding agents layer: 981 MB — all five agents (claude, codex, opencode, cursor-agent, grok) are installed unconditionally via curl | bash in every project image:

RUN mkdir -p ... \
    && curl -fsSL https://claude.ai/install.sh | bash \
    && curl -fsSL https://chatgpt.com/codex/install.sh | sh \
    && curl -fsSL https://opencode.ai/install | bash -s -- --no-modify-path \
    && curl -fsS https://cursor.com/install | bash \
    && { cursor-agent --version || true; } \
    && curl -fsSL https://x.ai/cli/install.sh | GROK_BIN_DIR=/home/vscode/.local/bin bash

A user running only aidc claude still downloads ~1 GB of codex/opencode/cursor/grok binaries they never invoke.

Proposal: make agents selectable (AIDC_AGENTS)

Mirror the existing AIDC_TOOLCHAINS / AIDC_SECURITY_TOOLS pattern:

1. Add build arg AIDC_AGENTS (comma-separated, default claude,codex,opencode,cursor-agent,grok for back-compat, or default to the current behavior).
2. In the Dockerfile, iterate for agent in $(echo "$AIDC_AGENTS" | tr ',' ' ') and install only those.
3. lib/aidc.sh already knows which tool command is being run (aidc claude → claude, etc.). Pass AIDC_AGENTS=<that tool> for the first run, or let project.env pin it.

Realistic saving: a claude-only image drops the agent layer from 981 MB to ~150–200 MB.

Why this is secure too

• Smaller image = smaller supply-chain surface (fewer unpinned curl | bash installers fetched per build).
• Matches "boot almost nothing" from the X post: only mount/pre-install what the agent actually needs.

Files

• templates/devcontainer/Dockerfile.tmpl — agent install block
• templates/devcontainer/compose.yaml.tmpl — pass AIDC_AGENTS arg
• lib/aidc.sh — aidc::cmd_claude etc. can seed AIDC_AGENTS into the compose env

Acceptance criteria

• aidc claude on a fresh repo installs only claude (image ≤ ~2.3 GB, down from 3.22 GB floor).
• AIDC_AGENTS=claude,codex in project.env installs exactly those two.
• Existing behavior unchanged when AIDC_AGENTS is unset (all five).