feat: lpb-config setup wizard + lpb SSH key auto-detection

- lpb-config setup: first-run wizard (URL + health check, model
  selection, auth.json, memory prefill, idempotent re-runs)
- lpb.py: SSH key auto-detection from ~/.ssh profile, explicit key
  (literal or path), --ssh-password, env passthrough
- start.sh: first-boot setup hook
- tests: test_lpb_ssh.py, test_localpibox_config_setup.py
- docs: README, lpb-cli, lpb-config, env-vars, .env.example

Author: localpibox

.env.example

@@ -79,6 +79,9 @@ LPB_AGENT_BROWSER_IDLE_TIMEOUT_MS=300000
 #   0.20   → 262K context → 52.4K max tokens
 # LPB_MAX_TOKENS_CONTEXT_RATIO=0.06
 
+# SSH port for `lpb --ssh` (default: 2222)
+# LPB_SSH_PORT=2222
+
 # ─── Persistence ─────────────────────────────────────────────────────────────
 
 # Persist gh CLI auth to ~/.config/gh inside container, stored in

README.md

@@ -26,13 +26,16 @@ lpb                              # resumes your last project (or ~)
 ```
 
 On the **first run** the container pulls the image, clones the config preset,
-generates `settings.json`, and installs the extensions — then Pi starts.
-You'll be asked to connect a model:
+generates `settings.json`, and installs the extensions. Before Pi starts, the
+**first-run setup wizard** walks you through connecting your Lemonade server:
 
-```
-/login lemonade     # connect to the local Lemonade server (must be running on the host)
-/model              # pick a model (e.g. the Qwen3.6-35B reasoning model)
-```
+1. server URL (pre-filled from `LEMONADE_BASE_URL`, health-checked)
+2. API key (a placeholder like `lemonade` is fine for a local server)
+3. default model (picked from the server's model list)
+4. lpb-memory configuration
+
+After that Pi starts fully configured. Re-run it any time inside the
+container with `lpb-config setup --reconfigure`.
 
 ### Common commands
 
@@ -119,7 +122,8 @@ CI tags images per pipeline: `:0.0.x-lpb[-dev]-cli/web` (versioned),
 | `lpb /path` | Pi CLI session (foreground); no path → last project or `~` |
 | `lpb --web /path` | VSCodium (background); `--port 8080` to change the port |
 | `lpb --shell /path` | Interactive bash inside the container |
-| `lpb --ssh [pubkey] /path` | sshd server in the container for remote login |
+| `lpb --ssh [pubkey\|path] /path` | sshd server in the container for remote login (key auto-detected from `~/.ssh` when omitted) |
+| `lpb --ssh --ssh-password [pw]` | SSH password login (random if omitted, shown once; can combine with a key) |
 | `lpb --stop` / `--remove` / `--logs` | Stop / stop+remove+state cleanup / stream logs |
 | `lpb --update` | Self-update launcher + pull latest image for the selected pipeline |
 | `lpb /path -- <pi-args>` | Pass args to Pi, e.g. `lpb /path -- -p "summarize this repo"` |

doc/env-vars.md

@@ -38,6 +38,7 @@ If a value from `.env` doesn't seem to apply, check shell env first:
 | `LPB_EDITOR_HOST` | `0.0.0.0` | Editor listen host (`127.0.0.1` for local-only) |
 | `LPB_CONNECTION_TOKEN` | *(random per start)* | OpenVSCode token — set for a stable token |
 | `LPB_LEMONADE_BASE_URL` | `http://127.0.0.1:13305/v1` | Local model server endpoint |
+| `LPB_LEMONADE_API_KEY` | *(none)* | Lemonade server API key — used by the first-run setup wizard (`lpb-config setup`); a placeholder is fine for local servers |
 | `LPB_MAX_TOKENS_CONTEXT_RATIO` | `0.06` | max_tokens as fraction of context window (Qwen thinking headroom) |
 | `LPB_AGENT_BROWSER_SESSION` | `$PI_WORKTREE_ID` | Browser session isolation id |
 | `LPB_AGENT_BROWSER_MAX_OUTPUT` | `4000` | Max chars for browser snapshot output |
@@ -99,6 +100,7 @@ These select **what goes into the image** (build time) and which pipeline
 | `PI_CODING_AGENT_DIR` | Same dir, as Pi expects it |
 | `LPB_AGENT_GIT` | Extension clones dir (default `$AGENT_DIR/git/github.com/lpb-stack`) |
 | `LEMONADE_BASE_URL` | Model API endpoint (`http://127.0.0.1:13305/v1`) |
+| `LEMONADE_API_KEY` | Lemonade server API key (bridged from `LPB_LEMONADE_API_KEY`) |
 | `AGENT_BROWSER_SESSION` | Browser session isolation id |
 | `AGENT_BROWSER_MAX_OUTPUT` | Max chars for snapshot output |
 

doc/lpb-cli.md

@@ -26,7 +26,8 @@ Installs (no sudo required) into `~/.local/bin`:
 | `lpb [/path/to/project]` | Start a **Pi CLI session** (foreground). No path → last project, or `~` if none yet |
 | `lpb --web [/path]` | Start **VSCodium** (background), prints the connection URL |
 | `lpb --shell [/path]` | Interactive bash shell inside the container |
-| `lpb --ssh [pubkey\|path] [/path]` | Start an sshd server in the container for remote login |
+| `lpb --ssh [pubkey\|path] [/path]` | Start an sshd server in the container for remote login (key auto-detected from `~/.ssh` when omitted) |
+| `lpb --ssh --ssh-password [pw]` | SSH password login (random if omitted, shown once; can combine with key auth) |
 | `lpb --stop` | Stop the container |
 | `lpb --remove` | Stop + remove container + state dirs |
 | `lpb --logs` | Stream container logs |
@@ -58,6 +59,24 @@ lpb /myproject -- --thinking high            # pass any pi flag
 --without-token        hide the token in the printed URL
 ```
 
+### SSH mode (`--ssh`)
+
+- **Key auto-detection**: `lpb --ssh` with no argument scans the *host* user
+  profile (`~/.ssh/*.pub`). One key → used (confirmed on a TTY); several →
+  numbered menu; none → error with a hint. Non-interactive: one key is used
+  automatically, several → explicit selection required.
+- **Explicit key still wins**: `lpb --ssh <pubkey|path>` (literal key or file).
+- **Password login**: `lpb --ssh --ssh-password` (random, printed once) or
+  `lpb --ssh --ssh-password <pw>` (user-chosen). The container user's password
+  is set at start (`chpasswd`) and `PasswordAuthentication` is enabled in the
+  generated `sshd_config`. Key auth remains the default — password auth is
+  opt-in (the container runs `network=host`, so a password is reachable from
+  the LAN).
+- **authorized_keys is append+dedup**: keys added manually (or in a previous
+  session) survive container recreation.
+- **`LPB_SSH_PORT`** (default `2222`): forwarded to the container; the
+  connect line (`ssh -p <port> lpb@<host>`) is printed when the server starts.
+
 ## Image Selection
 
 Two image flavours are published to `ghcr.io/lpb-stack/devstack`:

doc/lpb-config.md

@@ -34,6 +34,13 @@ see [lpb-devstack reference](lpb-devstack.md).
 | `lpb-config memory show` | Display current lpb-memory configuration |
 | `lpb-config memory setup` | Interactive wizard to configure lpb-memory |
 
+### First-Run Setup
+
+| Command | Description |
+|---|---|
+| `lpb-config setup` | Interactive first-run setup: lemonade provider (auth.json), default model (settings.json), lpb-memory config. Runs automatically on first boot (start.sh); idempotent — re-run with `--reconfigure` to change server/model |
+| `lpb-config setup --non-interactive` | Same, no prompts — `LEMONADE_BASE_URL` / `LEMONADE_API_KEY` env + defaults (used on TTY-less first boots) |
+
 ### Pipeline Override
 
 `--tag dev|main` is accepted on any command (validates the value) for
@@ -59,6 +66,8 @@ Example pin: `git:github.com/lpb-stack/pi-subagents@0.0.57-lpb-dev`
 Same template-driven pattern:
 
 1. First boot: `start.sh` copies `lpb-memory-config.json.template` → config
+   (or `lpb-config setup` configures it interactively during the first-run
+   wizard, pre-filling the model override with the selected default model)
 2. No model override — uses the main model until user configures
 3. Tune: `lpb-config memory setup` (interactive wizard)
 4. Review: `lpb-config memory show`