@codions/portta 0.0.0-develop.171.sha-d749180 → 0.0.0-develop.172.sha-10ce987

package/dist/runtime/docker/images/sandbox/README.md

@@ -1,109 +0,0 @@
-# Task Flow Sandbox
-
-The official universal sandbox image is published as:
-
-```text
-ghcr.io/codions-labs/portta-sandbox
-```
-
-It contains the four agent providers supported by Task Flow workflows: Codex,
-Claude Code, OpenCode, and Pi. It also includes GitHub CLI, AWS CLI,
-Playwright/Chromium, Mermaid CLI, asciinema, Git, Node.js 24, and common build
-utilities.
-
-## Build locally
-
-The build context is this directory. `TOOLS_REFRESH` invalidates the volatile
-tool layer without invalidating the base OS/runtime layers.
-
-```bash
-docker buildx build \
-  --load \
-  --platform linux/arm64 \
-  --build-arg SANDBOX_VERSION="$(tr -d '[:space:]' < VERSION)" \
-  --build-arg TOOLS_REFRESH="$(date -u +%Y%m%dT%H%M%SZ)" \
-  --tag portta-sandbox:local \
-  .
-```
-
-Use `linux/amd64` on x86_64 hosts. Validate the result with:
-
-```bash
-docker run --rm --entrypoint /usr/local/lib/taskflow-sandbox/scripts/verify-image.sh portta-sandbox:local
-docker run --rm --entrypoint cat portta-sandbox:local /etc/taskflow-sandbox/manifest.json
-```
-
-## Versions and tags
-
-`VERSION` is the version of the sandbox architecture, not the versions of the
-agents. A rebuild can keep the same sandbox version while resolving newer
-stable agent releases.
-
-- `rolling`: latest main-branch, scheduled, or manually refreshed build.
-- `edge`: latest develop-branch build.
-- `build-YYYYMMDD-<run-id>-<attempt>`: immutable build identity.
-- `X.Y.Z`: immutable structural release.
-- `X.Y`, `X`, and `latest`: aliases advanced only by a new structural release.
-
-Publish a structural release by creating a GitHub Release whose tag is
-`sandbox-vX.Y.Z`. The tag version must match `VERSION`. Re-running ordinary or
-scheduled builds never overwrites `X.Y.Z` or `latest`; it advances `rolling`.
-
-The exact versions in each architecture are stored at
-`/etc/taskflow-sandbox/manifest.json`, uploaded as workflow artifacts, and
-printed in the workflow summary. For strict rollback or reproduction, use the
-image digest or an immutable `build-*` tag.
-
-## Refresh and cache policy
-
-The workflow supplies a unique `TOOLS_REFRESH` value for every run. Structural
-layers remain cacheable, while signed APT repositories and npm stable tags are
-resolved again for the volatile tools. No tool version edit or synthetic commit
-is required: dispatch the workflow on `main` to refresh `rolling`.
-
-A weekly Monday build refreshes the rolling image. Weekly, rather than daily,
-limits two-architecture build minutes and immutable build-tag storage growth;
-`workflow_dispatch` remains the fast path when an important agent release lands.
-
-Claude Code is installed from Anthropic's signed stable APT channel. GitHub CLI
-uses its signed stable APT repository. Codex, OpenCode, and Pi use the official
-npm packages and their stable `latest` tags. A deliberate upstream regression
-should be handled by temporarily pinning inside the affected agent installer,
-then removing the pin after compatibility is restored.
-
-## Image architecture
-
-The first release uses one universal image:
-
-| Strategy | Decision |
-| --- | --- |
-| Universal image | Selected. It gives local, CI, VPS, and ephemeral environments the same warm toolset with no provisioning delay. |
-| Base plus agent variants | Deferred until image size or an agent incompatibility is measured; combinations would otherwise multiply tags and builds. |
-| Minimal base plus dynamic installs | Rejected as the default because startup would depend on registry availability and would be harder to audit and cache. |
-| Runtime plugin layers | Kept as a possible future distribution mechanism if independent agent release/security policies become necessary. |
-
-Agent installers are isolated files even though the delivered image is universal,
-so a future variant can reuse the same scripts and BuildKit layers instead of
-forking Dockerfiles.
-
-## Sandbox version policy
-
-Tool-only refreshes do not change `VERSION`. Bump its patch component for a
-backward-compatible image/configuration fix, its minor component for a new
-sandbox capability or supported agent, and its major component for a breaking
-runtime contract. A future reproducible-build mode can consume a saved manifest;
-until then, the immutable image digest is the exact replay and rollback identity.
-
-## Adding an agent
-
-Add one installer under `agents/`, call it from `scripts/install-tools.sh`, and
-add its version command to `scripts/generate-manifest.mjs` and
-`scripts/verify-image.sh`. Keep a single universal image until an agent has a
-demonstrated incompatibility or size requirement that justifies a variant.
-
-## Registry setup
-
-The publish job uses `GITHUB_TOKEN` and grants `packages: write` only to that
-job. The organization must allow GitHub Actions to create packages. After the
-first publication, make the `portta-sandbox` package public in the GHCR
-package settings; package visibility cannot be changed by the build workflow.

package/dist/runtime/docker/images/sandbox/VERSION

@@ -1 +0,0 @@
-0.1.0

package/dist/runtime/docker/images/sandbox/agents/claude-code.sh

@@ -1,18 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-key=/tmp/claude-code.asc
-keyring=/etc/apt/keyrings/claude-code.asc
-fingerprint=31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE
-
-install -d -m 0755 /etc/apt/keyrings
-curl -fsSL https://downloads.claude.ai/keys/claude-code.asc -o "$key"
-actual_fingerprint="$(gpg --show-keys --with-colons "$key" | awk -F: '$1 == "fpr" { print $10; exit }')"
-test "$actual_fingerprint" = "$fingerprint"
-install -m 0644 "$key" "$keyring"
-echo "deb [signed-by=$keyring] https://downloads.claude.ai/claude-code/apt/stable stable main" \
-  > /etc/apt/sources.list.d/claude-code.list
-apt-get update
-apt-get install -y --no-install-recommends claude-code
-rm -f "$key"
-rm -rf /var/lib/apt/lists/*

package/dist/runtime/docker/images/sandbox/agents/codex.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-npm install --global --no-audit --no-fund @openai/codex@latest

package/dist/runtime/docker/images/sandbox/agents/opencode.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-npm install --global --allow-scripts=opencode-ai --no-audit --no-fund opencode-ai@latest

package/dist/runtime/docker/images/sandbox/agents/pi.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-npm install --global --ignore-scripts --no-audit --no-fund @earendil-works/pi-coding-agent@latest

package/dist/runtime/docker/images/sandbox/scripts/entrypoint.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-if [ -f "$PWD/package-lock.json" ]; then
-  npm ci 2>/dev/null || npm install
-fi
-
-exec "$@"

package/dist/runtime/docker/images/sandbox/scripts/generate-manifest.mjs

@@ -1,81 +0,0 @@
-#!/usr/bin/env node
-
-import { execFileSync, spawnSync } from 'node:child_process'
-import { readFileSync, writeFileSync } from 'node:fs'
-import { arch } from 'node:os'
-
-function output(command, args) {
-  const result = spawnSync(command, args, { encoding: 'utf8' })
-  if (result.status !== 0) {
-    throw new Error(`${command} ${args.join(' ')} failed: ${result.stderr.trim()}`)
-  }
-  const value = `${result.stdout}\n${result.stderr}`
-  return value
-    .split('\n')
-    .map((line) => line.trim())
-    .find(Boolean)
-}
-
-function osRelease() {
-  return Object.fromEntries(
-    readFileSync('/etc/os-release', 'utf8')
-      .split('\n')
-      .filter((line) => line.includes('='))
-      .map((line) => {
-        const index = line.indexOf('=')
-        return [line.slice(0, index), line.slice(index + 1).replace(/^"|"$/g, '')]
-      }),
-  )
-}
-
-const chromium = execFileSync(
-  'find',
-  [
-    process.env.PLAYWRIGHT_BROWSERS_PATH ?? '/ms-playwright',
-    '-type',
-    'f',
-    '(',
-    '-name',
-    'chrome-headless-shell',
-    '-o',
-    '-name',
-    'headless_shell',
-    ')',
-    '-executable',
-    '-print',
-    '-quit',
-  ],
-  { encoding: 'utf8' },
-).trim()
-
-if (!chromium) throw new Error('Playwright Chromium executable was not found')
-
-const os = osRelease()
-const manifest = {
-  schemaVersion: 1,
-  sandbox: {
-    version: process.env.SANDBOX_VERSION ?? 'unknown',
-    builtAt: process.env.BUILD_DATE ?? 'unknown',
-    buildId: process.env.BUILD_ID ?? 'local',
-    gitRevision: process.env.VCS_REF ?? 'unknown',
-    platform: `linux/${arch() === 'x64' ? 'amd64' : arch()}`,
-    base: `${os.PRETTY_NAME ?? os.ID ?? 'Linux'}`,
-  },
-  tools: {
-    node: output('node', ['--version']),
-    npm: output('npm', ['--version']),
-    git: output('git', ['--version']),
-    gh: output('gh', ['--version']),
-    aws: output('aws', ['--version']),
-    codex: output('codex', ['--version']),
-    claude: output('claude', ['--version']),
-    opencode: output('opencode', ['--version']),
-    pi: output('pi', ['--version']),
-    playwright: output('playwright', ['--version']),
-    chromium: output(chromium, ['--version', '--no-sandbox']),
-    mermaid: output('mmdc', ['--version']),
-    asciinema: output('asciinema', ['--version']),
-  },
-}
-
-writeFileSync(process.argv[2] ?? '/etc/taskflow-sandbox/manifest.json', `${JSON.stringify(manifest, null, 2)}\n`)

package/dist/runtime/docker/images/sandbox/scripts/install-tools.sh

@@ -1,46 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-install_github_cli() {
-  install -d -m 0755 /etc/apt/keyrings
-  curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-    -o /etc/apt/keyrings/githubcli-archive-keyring.gpg
-  chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
-  echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
-    > /etc/apt/sources.list.d/github-cli.list
-  apt-get update
-  apt-get install -y --no-install-recommends gh
-  rm -rf /var/lib/apt/lists/*
-}
-
-install_aws_cli() {
-  case "${TARGETARCH:?TARGETARCH is required}" in
-    amd64|arm64) ;;
-    *) echo "Unsupported AWS CLI architecture: ${TARGETARCH}" >&2; return 1 ;;
-  esac
-
-  curl -fsSL https://awscli.amazonaws.com/v2/install.sh -o /tmp/aws-cli-install.sh
-  chmod 0755 /tmp/aws-cli-install.sh
-  /tmp/aws-cli-install.sh --system
-  rm -f /tmp/aws-cli-install.sh
-}
-
-install_node_tools() {
-  PUPPETEER_SKIP_DOWNLOAD=true \
-    npm install --global --no-audit --no-fund @playwright/test@latest @mermaid-js/mermaid-cli@latest
-  playwright install chromium --with-deps --only-shell
-  npm cache clean --force
-
-  chromium="$(find "$PLAYWRIGHT_BROWSERS_PATH" -type f \( -name chrome-headless-shell -o -name headless_shell \) -executable | head -n 1)"
-  test -n "$chromium"
-  printf '{"args":["--no-sandbox","--disable-setuid-sandbox"],"executablePath":"%s"}\n' "$chromium" \
-    > /root/.puppeteerrc.json
-}
-
-install_github_cli
-install_aws_cli
-/usr/local/lib/taskflow-sandbox/agents/claude-code.sh
-/usr/local/lib/taskflow-sandbox/agents/codex.sh
-/usr/local/lib/taskflow-sandbox/agents/opencode.sh
-/usr/local/lib/taskflow-sandbox/agents/pi.sh
-install_node_tools

package/dist/runtime/docker/images/sandbox/scripts/verify-image.sh

@@ -1,18 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-manifest="${PORTTA_FLOW_SANDBOX_MANIFEST:-/etc/taskflow-sandbox/manifest.json}"
-test -s "$manifest"
-
-for command in node npm git gh aws codex claude opencode pi playwright mmdc asciinema; do
-  command -v "$command" >/dev/null
-done
-
-jq -e '
-  . as $manifest |
-  $manifest.schemaVersion == 1 and
-  ($manifest.sandbox.version | length > 0) and
-  ($manifest.sandbox.platform | startswith("linux/")) and
-  (["node", "npm", "git", "gh", "aws", "codex", "claude", "opencode", "pi", "playwright", "chromium", "mermaid", "asciinema"] |
-    all(. as $tool | $manifest.tools[$tool] | type == "string" and length > 0))
-' "$manifest" >/dev/null