drop passive image timestamp and keep docker hash fallback

server/Dockerfile

@@ -61,8 +61,10 @@ RUN sed -i 's/\r$//' /app/start.sh && chmod +x /app/start.sh
 RUN sed -i 's/\r$//' /app/celery/worker/start && chmod +x /app/celery/worker/start
 RUN sed -i 's/\r$//' /app/celery/beat/start && chmod +x /app/celery/beat/start
 
-# Bake a build timestamp into the image for stale-image detection at startup
-RUN echo "EIGENT_IMAGE_BUILD_TIME=$(date -u '+%Y-%m-%d %H:%M:%S UTC')" > /app/.image_env
+# Bake the latest server/ commit into the image for stale-server detection.
+# Uses --mount=type=bind to access .git without adding it to a layer.
+RUN --mount=type=bind,source=.git,target=/tmp/.git \
+    echo "EIGENT_SERVER_GIT_COMMIT=$(git --git-dir=/tmp/.git log -1 --format=%H -- server/ 2>/dev/null || echo unknown)" > /app/.image_env
 
 # Reset the entrypoint, don't invoke `uv`
 ENTRYPOINT []

server/main.py

@@ -59,13 +59,32 @@ except Exception:
 
 # Git hash of the last commit that touched server/ — used for stale-server detection.
 # Captured once at startup; stays constant while the process lives.
-try:
-    SERVER_CODE_HASH = subprocess.check_output(
-        ["git", "log", "-1", "--format=%H", "--", "server/"],
-        cwd=str(_project_root), text=True, stderr=subprocess.DEVNULL,
-    ).strip() or "unknown"
-except Exception:
-    SERVER_CODE_HASH = "unknown"
+# 1) Try git directly (works in local dev)
+# 2) Fall back to .image_env baked by Dockerfile (works in Docker)
+def _read_server_code_hash() -> str:
+    # Try git first (local dev)
+    try:
+        h = subprocess.check_output(
+            ["git", "log", "-1", "--format=%H", "--", "server/"],
+            cwd=str(_project_root), text=True, stderr=subprocess.DEVNULL,
+        ).strip()
+        if h:
+            return h
+    except Exception:
+        pass
+    # Fallback: read from Docker-baked .image_env
+    try:
+        env_file = pathlib.Path(__file__).parent / ".image_env"
+        for line in env_file.read_text().splitlines():
+            if line.startswith("EIGENT_SERVER_GIT_COMMIT="):
+                v = line.split("=", 1)[1].strip()
+                if v:
+                    return v
+    except Exception:
+        pass
+    return "unknown"
+
+SERVER_CODE_HASH = _read_server_code_hash()
 
 
 # Health check at root level for Docker healthcheck (GET /health)

server/start.sh

@@ -1,25 +1,5 @@
 #!/bin/sh
 
-# ── Stale image detection ─────────────────────────────────────────────
-# The Dockerfile bakes a build timestamp into /app/.image_env.
-# On startup we display it so developers can tell at a glance whether
-# their image is fresh or stale after a git pull.
-if [ -f /app/.image_env ]; then
-  . /app/.image_env
-fi
-
-if [ -n "$EIGENT_IMAGE_BUILD_TIME" ]; then
-  echo ""
-  echo "========================================"
-  echo "  Image built at: $EIGENT_IMAGE_BUILD_TIME"
-  echo ""
-  echo "  If you have pulled new server code,"
-  echo "  please rebuild the image:"
-  echo "    docker-compose up --build -d"
-  echo "========================================"
-  echo ""
-fi
-
 # wait for database to be ready
 echo "Waiting for database to be ready..."
 while ! nc -z postgres 5432; do