Say what Glama actually builds, which is not our Dockerfile

[michal-wrzosek]

The previous change added a Dockerfile and justified it with a claim that is
wrong. Glama does not build it.

Their methodology says a server is built "from a Dockerfile … authored by the
maintainer and checked into the repository, or inferred by Glama's AI-assisted
build system", and I read the first branch as ours. It is not. The server's
admin page is a form, and Glama generates its own Dockerfile from those fields,
clones this repository into /app at a pinned commit, and runs the build steps
there. The generated file confirms it. Nothing in it references what is
committed at the root. Another maintainer hit this and removed theirs.

So this removes the false paragraph, keeps the Dockerfile for the reasons that
actually hold, and writes down the fields Glama does read.

What the Dockerfile is still worth

Two things, both smaller than the reason it was written for:

• CI builds it on every pull request and speaks a real handshake to the result.
  That is the only check in this repository that exercises the published
  package rather than the source tree.
• It is still the shortest way for somebody to watch this server run without
  installing anything of ours.

The new document

docs/glama-build-spec.md records the fields to paste into the admin page and
why. Glama's inference for this repository produces:

["pnpm install", "pnpm run build"]
["mcp-proxy", "--", "node", "bin/gitwarren.mjs"]

All three parts fail here. pnpm against a repository with a
package-lock.json and no pnpm lockfile. run build typechecks and runs four
Vite builds, needing the Electron dependency and its platform binary download,
to produce bundles this server does not start from. And bin/gitwarren.mjs
does not exist in this repository at all: that launcher is
packaging/npm/bin/gitwarren.mjs, published rather than checked out, loading a
bundle that exists only inside the built package.

What replaces it installs the published package and runs that, which is the
artifact every agent starts and therefore the honest thing to put in front of
a scanner.

Verified against a copy of their image

Their generated Dockerfile was reproduced verbatim down to the base image, the
NodeSource install, the clone and the PATH, with only the build step and CMD
swapped for the recommended ones, and built for x86-64.

Check	Result
npm install -g gitwarren@0.1.17	3 packages, 3 seconds
Compiler needed	none; cc, gcc, g++ and make are all absent
better-sqlite3 binding	prebuilt linux-x64.node, shipped in the package
Bare server over stdio	handshake returned, version 0.1.17
Database location	/tmp/gitwarren/gitwarren.db, where the placeholder puts it
Real CMD through mcp-proxy	container stays up, handshake returned through the proxy

The absent toolchain is the interesting row. It means the recommended build
step needs nothing beyond what their base image already provides, so it cannot
fail for want of a compiler on their infrastructure.

Version drift

The document pins a version, so sync-plugin-versions.mjs now covers it,
matching only pinned spellings so the surrounding prose can go on saying npx gitwarren mcp untouched. It cannot reach the field on Glama's website and the
document says so. What it keeps current is the line somebody copies.

🤖 Generated with Claude Code