@coreplane/switchboard 1.204.0 → 1.206.0

package/dist/assets/deploy/cloudflare-sandbox/Dockerfile

@@ -1,5 +1,17 @@
-# Sandbox container image: the @cloudflare/sandbox base plus git + gh, so the
-# coding/review agents work out of the box.
+# Sandbox container image: the @cloudflare/sandbox base plus git + gh, a Docker
+# engine, Node 24 with pnpm, and the toolchain a run builds and looks with
+# (compilers, ffmpeg, a headless Chromium), so the coding/review/explore
+# agents work out of the box.
+
+# The Node this image ships (copied in below), at the exact tag every image in
+# this repository shares — its major is .nvmrc's, which is what CI runs and
+# the install script requires. `--platform`: the cloudflare/sandbox base below
+# publishes linux/amd64 only, so the stage the binary is copied from must be
+# amd64 too — a bare FROM on an arm64 host resolves it to arm64 and the copied
+# binary cannot run in the base (check:image on Apple silicon failed exactly
+# so). src/deploy/imageNode.test.ts holds the tag, its major and the platform.
+FROM --platform=linux/amd64 docker.io/library/node:24.21.0-slim AS node
+
 # The tag MUST match the @cloudflare/sandbox version in package.json exactly
 # (no 'latest' tag exists) — bump both together.
 FROM docker.io/cloudflare/sandbox:0.12.9
@@ -41,14 +53,28 @@ RUN apt-get update \
 # execs the real client. src/deploy/sandboxDocker.test.ts holds its shape.
 COPY --chmod=0755 docker-wrapper.sh /usr/local/bin/docker
 
-# Node comes from the base: the published 0.12.9 image ships Node 22.23 (copied
-# from node:22-slim, with npm; no NodeSource deb), so the retarget-and-upgrade
-# layer the 0.3.x image needed is gone. This repo pins `engines: node
-# >=22` (undici@8 needs Node 22's `webidl.util.markAsUncloneable`), and a
-# review run that falls back off the resident onto a fresh sandbox must load
-# the full vitest suite; the assertion fails the build if a base bump ever
-# lands below 22. (The resident image gets Node 24 from its 0.13.0-next base.)
-RUN node --version | grep -Eq '^v(2[2-9]|[3-9][0-9])\.'
+# Node 24, not the base's. The published 0.12.9 base ships Node 22.23.2
+# (copied from node:22-slim: the binary at /usr/local/bin/node, npm and
+# corepack under /usr/local/lib/node_modules, npm/npx symlinked into it), while
+# this repository builds and tests on Node 24 (.nvmrc, CI) and its published
+# CLI requires `>=24`. A run that exercised the suite inside this image read a
+# different `verify` than CI did: `npm ci` warned on the CLI package's engines,
+# and tests that pass in CI failed here. So Node comes from the official image
+# at an exact tag, in the `node` stage above: the base's npm tree is removed
+# first (no file of npm 10 survives under npm 11), then the binary, npm's tree
+# and the headers (node-gyp compiles native addons against them without a
+# download) land at the base's own paths, so its npm/npx symlinks keep
+# resolving. The container server (/container-server/sandbox, a bun-compiled
+# binary) does not run on this Node, so only what a run's commands see moves.
+# The grep fails the BUILD, not a run, if a bump ever lands another version
+# here; src/deploy/imageNode.test.ts holds it equal to the stage's tag.
+RUN rm -rf /usr/local/lib/node_modules /usr/local/include/node
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+COPY --from=node /usr/local/include/node /usr/local/include/node
+RUN node --version | grep -qx 'v24.21.0' \
+  && npm --version >/dev/null \
+  && npx --version >/dev/null
 
 # pnpm: the base image ships Node + npm (corepack is under
 # /usr/local/lib/node_modules but not on PATH) and not pnpm, so coding runs in pnpm repos hit
@@ -65,3 +91,48 @@ RUN node --version | grep -Eq '^v(2[2-9]|[3-9][0-9])\.'
 # `packageManager`, so this is the floor for repos that name none.
 RUN npm install -g pnpm@10.34.5 \
   && pnpm --version | grep -qx '10\.34\.5'
+
+# The toolchain for what a run BUILDS and LOOKS AT — the same layer as the
+# resident image's (deploy/cloudflare-resident/Dockerfile);
+# src/deploy/imageToolchain.test.ts holds the two to one shape.
+#   - python3 + make + g++: node-gyp's needs. A cold `npm install` in a repo
+#     with a native module (node-pty) rebuilds it from source, and died here
+#     on "no Python". Just the three — no build-essential, no recommends.
+#   - ffmpeg (Ubuntu's, with libx264): an agent pulls frames out of a video
+#     to look at it (`ffmpeg -i in.mp4 -vf fps=1 frame_%03d.png`) and encodes
+#     video from frames or a screen recording.
+#   - a headless Chromium through Playwright at an EXACT pin
+#     (src/deploy/imagePins.test.ts): screenshots, PDFs and `recordVideo`.
+#     Ubuntu 22.04's apt `chromium` is a snap stub that does not run in a
+#     container, so the browser is Playwright's own build — the headless shell
+#     only (`--only-shell`: there is no display), with the system libraries it
+#     needs (`--with-deps`) and the fonts pages render text with.
+#     PLAYWRIGHT_BROWSERS_PATH is set BEFORE the install so the browser lands
+#     under /opt, not root's home, and the tree is opened to every user
+#     (a+rX): the resident runs each agent command as an unprivileged
+#     workerN, and the two images share this layer. NODE_PATH makes
+#     `require('playwright')` resolve from any working directory. Playwright
+#     launches Chromium with --no-sandbox (`chromiumSandbox: false`, its
+#     default) — what a root process, or one without user namespaces, needs.
+# Every claim is PROVEN by the layer itself, so the BUILD fails, not a run:
+# the compilers answer --version, ffmpeg encodes a one-second testsrc clip to
+# h264 and decodes a non-empty frame back out of it, the playwright CLI is on
+# PATH at the pin, and a real headless screenshot of a page lands as a
+# non-empty png. The proof artefacts, the apt lists, apt's .deb archive (this
+# base has no docker-clean hook: 400 MB of archives stayed behind without the
+# `clean`) and npm's cache go in the same layer.
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright \
+    NODE_PATH=/usr/local/lib/node_modules
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends python3 make g++ ffmpeg fonts-liberation fonts-noto-color-emoji \
+  && npm install -g playwright@1.63.0 \
+  && playwright install --with-deps --only-shell chromium \
+  && chmod -R a+rX /opt/ms-playwright \
+  && apt-get clean && rm -rf /var/lib/apt/lists/* && npm cache clean --force \
+  && python3 --version && g++ --version && make --version \
+  && ffmpeg -version \
+  && ffmpeg -hide_banner -loglevel error -f lavfi -i testsrc=duration=1:size=320x240:rate=10 -c:v libx264 -pix_fmt yuv420p /tmp/proof.mp4 \
+  && ffmpeg -hide_banner -loglevel error -i /tmp/proof.mp4 -vf fps=1 /tmp/proof_%03d.png && test -s /tmp/proof_001.png \
+  && playwright --version | grep -qx 'Version 1.63.0' \
+  && playwright screenshot --viewport-size=640,480 'data:text/html,<h1>ok</h1>' /tmp/ok.png && test -s /tmp/ok.png \
+  && rm -f /tmp/proof.mp4 /tmp/proof_*.png /tmp/ok.png

package/dist/assets/deploy/cloudflare-sandbox/worker.ts

@@ -340,9 +340,12 @@ function streamExec(
           // command (137 when the follow-up SIGKILL had to) — annotate so the
           // agent knows what happened and how to adapt.
           const timedOut = exitCode === 124 || exitCode === 137;
+          // A job past the ceiling is detached with `setsid -f`: every /exec
+          // runs under `timeout … bash -c`, whose process group is reaped when
+          // the command returns, so a plain background job dies with it.
           const note = timedOut
             ? `command timed out in the sandbox after ${execTimeoutSecs}s (pass the bash tool's timeoutMs for longer commands, max ${BASH_TIMEOUT_MAX_MS} ms); ` +
-              "re-run as smaller/faster steps or background it with nohup"
+              "re-run as smaller/faster steps, or start it detached with `setsid -f sh -c '<command> > /tmp/job.log 2>&1'` and poll the log on later calls"
             : "";
           // The command as the Worker's own root (docs/reference/specs/tracing.md item 22).
           execRoot(attemptStartedAt, traceparent).end(exitCode === 0 ? "ok" : "error", {

package/dist/assets/deploy/secrets.manifest.json

@@ -38,7 +38,7 @@
       "name": "SWITCHBOARD_INGRESS_TOKENS",
       "workers": ["bot"],
       "optional": true,
-      "note": "JSON bearer→identity map for POST /ingress and POST /mcp. Self-minted (openssl rand -hex 32 per entry). Optional: without it /ingress and /mcp are disabled and `deploy restart` has no bearer."
+      "note": "JSON bearer→identity map for POST /ingress and POST /mcp. Self-minted (openssl rand -hex 32 per entry). Optional: without it /ingress and /mcp are disabled and `deploy restart` has no bearer. The `cron` entry fires schedules; a `coordinator` entry (granted `coordinator:step`) is the ship coordinator's, rotated apart from cron."
     },
     {
       "name": "SANDBOX_TOKEN",