fix(deploy): the images drop third_party/'s overrides instead of copying it

Two deploys failed building the images (4 Nov 2026): first the
dictionaries' image lacked third_party/ (pub refuses an override whose
path is missing, exit 66), then, with it copied, pub refused the
overrides themselves, as the three plugins depend on the Flutter SDK,
which the dart image doesn't have (exit 69); every image would have.
No image's package uses them, so tool/workspace_only.sh, which already
narrows the root pubspec for an image, drops the overrides naming
third_party/, and no Dockerfile copies it.

Each image's build stage replayed from this commit with a standalone
Dart 3.13.4, a fresh pub cache, dash and mawk: all four build, and the
commit deployed before fails as the deploy did.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

AGENTS.md

@@ -15,7 +15,7 @@ Halkyon's apps and the packages they share, in one repository and one pub worksp
   - `halkyon_keys` (pure Dart on libsodium, ADR 0017): an account's keys on the device, the password's Argon2id and SRP's x, the key pairs and their wrapping, the recovery phrase, data keys, content sealed and signed, row IDs keyed by the account (`keyedRowId`). SRP-6a's two halves are the module's (`halkyon_base_server`'s `base.dart`, `halkyon_base_client`'s `srp.dart`), as are TOTP and the recovery codes. `sodium`'s build hook compiles libsodium, so every machine that builds or tests needs a C compiler and `make`.
   - `halkyon_llm` (pure Dart, Halkyon Learn's ADR 0021, D15 and D46): language models' APIs streamed over plain HTTP, no SDKs: Anthropic's Messages API, OpenAI's chat completions (each known host's fields, D45) and its Responses API, behind one interface (`LlmClient`), with `FakeLlmClient` for tests; tested on replies written from the providers' documentation and on those `tool/record_llm.dart` records with a key (D36). The module forwards the operator's assistants with it, and the apps call a person's own provider. BSD-3-Clause as `halkyon_oidc`, `publish_to: none`.
   - `halkyon_oidc_server`, `halkyon_oidc_client` (ADR 0023): signing in with OpenID Connect, with a SimpleLogin preset, as a Serverpod module that halkyon_base builds on; `halkyon_oidc_flutter`, the device's half: the provider's page opened, the way back caught (the app's scheme, or the loopback on Linux and Windows, `LoopbackWebAuth`) and its state checked. Nothing of Halkyon's is in it, so that others can use it with Serverpod: under BSD-3-Clause, Serverpod's own licence, where the other packages are AGPL; `publish_to: none` until it is published to pub.dev, which is asked again first.
-- **`third_party/`**: others' packages patched for us, each a pub release copied whole with only what its README names changed, overridden by path in the root `pubspec.yaml` (today the three Android plugins still applying the Kotlin Gradle Plugin themselves, which AGP 9's built-in Kotlin refuses soon); not our code, so left out of the analysis and the format check; every image built from the workspace copies it (the servers' and Learn's dictionaries'), as pub refuses an override whose path is missing. Drop an override once its package's release has the change.
+- **`third_party/`**: others' packages patched for us, each a pub release copied whole with only what its README names changed, overridden by path in the root `pubspec.yaml` (today the three Android plugins still applying the Kotlin Gradle Plugin themselves, which AGP 9's built-in Kotlin refuses soon); not our code, so left out of the analysis and the format check; the images drop its overrides (`tool/workspace_only.sh`): they have Dart without Flutter, and pub refuses an override depending on the Flutter SDK, used or not. Drop an override once its package's release has the change.
 - **`deploy/`**: the instance deploy at the root, learn.halkyon.eu's today (Learn's `AGENTS.md`, *CI and deploys*), where other services' compose files join Learn's (Train's `compose.train.yaml`, Todo's `compose.todo.yaml`, each switched on in `.env`). **`snap/`**: Learn's snap, built from the root, which its build needs whole; Todo's and Train's are `apps/todo/snap/` and `apps/train/snap/`, which the release tool builds each in a clone of the repository with it in place of `snap/` (Todo's `AGENTS.md`, *Releases*). **`docs/adr/`**: the decision records of every app and package, one numbering. **`tool/`**: the repository's tools (below).
 - **One workspace, one lock**: the root `pubspec.yaml` lists every package, `pubspec.lock` holds one version of each dependency for all of them, and its `dependency_overrides` hold for every app (the offline sync fork, Learn's `AGENTS.md`; `cli_util`, below). **Serverpod's version moves as one**: every package pins Serverpod's packages to the same version (4.0.4), the module's, Meditate's, Todo's and Train's too, together with the CLI version CI generates code with (`SERVERPOD_VERSION` in `.forgejo/workflows/ci.yaml`) and the sync packages Learn's server depends on.
 

apps/learn/halkyon_learn_curator/Dockerfile

@@ -14,9 +14,6 @@ FROM dart:3.13.4 AS build
 WORKDIR /app
 COPY pubspec.yaml pubspec.lock ./
 COPY tool/workspace_only.sh tool/
-# The root's dependency_overrides name these by path; pub refuses a path
-# that isn't there, though the curator uses none of them.
-COPY third_party third_party
 COPY apps/learn/halkyon_learn_curator apps/learn/halkyon_learn_curator
 
 # The workspace root with only the curator package, as the server's Dockerfile does it

apps/learn/halkyon_learn_server/Dockerfile

@@ -13,9 +13,6 @@ FROM dart:3.13.4 AS build
 WORKDIR /app
 COPY pubspec.yaml pubspec.lock ./
 COPY tool/workspace_only.sh tool/
-# The root's dependency_overrides name these by path; pub refuses a path
-# that isn't there, though no server uses them.
-COPY third_party third_party
 COPY apps/learn/halkyon_learn_server apps/learn/halkyon_learn_server
 COPY packages/halkyon_base_server packages/halkyon_base_server
 COPY packages/halkyon_base_client packages/halkyon_base_client

apps/todo/halkyon_todo_server/Dockerfile

@@ -12,9 +12,6 @@ FROM dart:3.13.4 AS build
 WORKDIR /app
 COPY pubspec.yaml pubspec.lock ./
 COPY tool/workspace_only.sh tool/
-# The root's dependency_overrides name these by path; pub refuses a path
-# that isn't there, though no server uses them.
-COPY third_party third_party
 COPY apps/todo/halkyon_todo_server apps/todo/halkyon_todo_server
 COPY packages/halkyon_base_server packages/halkyon_base_server
 COPY packages/halkyon_base_client packages/halkyon_base_client

apps/train/halkyon_train_server/Dockerfile

@@ -12,9 +12,6 @@ FROM dart:3.13.4 AS build
 WORKDIR /app
 COPY pubspec.yaml pubspec.lock ./
 COPY tool/workspace_only.sh tool/
-# The root's dependency_overrides name these by path; pub refuses a path
-# that isn't there, though no server uses them.
-COPY third_party third_party
 COPY apps/train/halkyon_train_server apps/train/halkyon_train_server
 COPY packages/halkyon_base_server packages/halkyon_base_server
 COPY packages/halkyon_base_client packages/halkyon_base_client

tool/workspace_only.sh

@@ -1,13 +1,25 @@
 #!/bin/sh
 # Narrows the workspace in ./pubspec.yaml to the members named, for an image that builds
-# only those (the Dockerfiles of Learn's server and curator): pub then resolves without
-# the other members, whose folders the image doesn't hold. Fails if one named isn't a
-# member, so a renamed package fails the build loudly.
+# only those (the Dockerfiles of the servers and Learn's curator): pub then resolves
+# without the other members, whose folders the image doesn't hold. Fails if one named
+# isn't a member, so a renamed package fails the build loudly.
+#
+# It also drops the dependency overrides of third_party/'s patched Flutter plugins: an
+# image has Dart without Flutter, and pub refuses an override depending on the Flutter
+# SDK, used or not (exit 69, the deploys of 4 Nov 2026). No image's package uses them.
 #
 #   sh tool/workspace_only.sh apps/learn/halkyon_learn_server packages/halkyon_base_server
 set -eu
 awk -v keep="$*" '
   BEGIN { n = split(keep, k, " "); for (i = 1; i <= n; i++) wanted["  - " k[i]] = 1 }
+  # An override held back until its next line says whether its path is in third_party.
+  held != "" {
+    line = held; held = ""
+    if ($0 ~ /^    path: third_party\//) { next }
+    print line
+  }
+  /^[a-z_]+:/ { overrides = ($0 == "dependency_overrides:") }
+  overrides && /^  [a-z0-9_]+:$/ { held = $0; next }
   /^workspace:/ { block = 1; print; next }
   block && /^  - / { if ($0 in wanted) { print; found[$0] = 1 }; next }
   { block = 0; print }