Merge branch 'fix/compose-readonly-mounts' into dev

.pi-map.index.md

@@ -16,7 +16,7 @@ dir: .
 Trust boundary: index routes, map orients, source decides.
 
 ## role
-Infrastructure and deployment configuration for a self-hosted project management platform with OAuth2 authentication, providing Docker orchestration, environment templates, and development tooling.
+Infrastructure and configuration package for a self-hosted project management platform with containerized deployment, SSO integration, and AI-assisted development workflows.
 ## parent
 -
 ## children

apps/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: apps
 
 ## role
-Contains the main deployable application entry points and top-level configuration for the project.
+Contains the main deployable application entry points and top-level executable modules for the project.
 ## parent
 index: ./.pi-map.index.md
 map: ./.pi-map.md

apps/api/src/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: apps/api/src
 
 ## role
-Core application package for the Headquarter API, providing configuration, database connectivity, structured logging, and FastAPI application initialization.
+Core application package for the Headquarter API, providing configuration, database connectivity, logging infrastructure, and FastAPI application initialization.
 ## parent
 index: apps/api/.pi-map.index.md
 map: apps/api/.pi-map.md

apps/api/src/services/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: apps/api/src/services
 
 ## role
-Provides a Python package namespace for organizing service-layer modules in the API application.
+Marks the services directory as a Python package for business logic layer components.
 ## parent
 index: apps/api/src/.pi-map.index.md
 map: apps/api/src/.pi-map.md

apps/api/src/services/tool/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: apps/api/src/services/tool
 
 ## role
-Provides Docker container lifecycle management for tool instances with git repository integration and configuration validation.
+Provides backend infrastructure for provisioning and managing isolated development tool instances with their dependencies and network access.
 ## parent
 index: apps/api/src/services/.pi-map.index.md
 map: apps/api/src/services/.pi-map.md

apps/api/src/services/tool/instance_service.py

@@ -583,10 +583,13 @@ def modify_compose_file(
                 source = vol.get("source", "")
                 target = expand_container_path(vol.get("target", ""), home_dir)
                 vol_type = vol.get("type", "bind")
+                readonly = ":ro" if vol.get("readonly") else ""
                 if vol_type == "bind":
-                    service_config["volumes"].append(f"{source}:{target}")
+                    service_config["volumes"].append(f"{source}:{target}{readonly}")
                 else:
-                    service_config["volumes"].append(f"{source}:{target}:{vol_type}")
+                    service_config["volumes"].append(
+                        f"{source}:{target}:{vol_type}{readonly}"
+                    )
 
         # Sort volumes so parent paths come before child paths
         if service_config.get("volumes"):
@@ -792,8 +795,10 @@ async def prepare_manifest_instance(
     from src.models import ToolDefinitionManifest
 
     tool_type = await session.get(ToolType, instance.tool_type_id)
-    manifest_def = await session.get(ToolDefinitionManifest, tool_type.manifest_id)
+    if not tool_type:
+        raise RuntimeError(f"Tool type not found for instance {instance.id}")
 
+    manifest_def = await session.get(ToolDefinitionManifest, tool_type.manifest_id)
     if not manifest_def:
         raise RuntimeError(f"Manifest not found for tool type {tool_type.id}")