@deployfoundation/foundation-deploy 0.2.9 → 0.2.11

package/agent-image/Dockerfile

@@ -16,6 +16,10 @@
 #     packages/agent/package.json, and the frozen lockfile pins the version itself)
 #   - Python 3.10+ for the omp `eval` tool (the bun base is trixie: 3.13)
 #   - gh 2.97.0, built from source with Go (see the gh-build stage)
+#   - open-slide toolchain for the `slides` skill: @open-slide/core 2.0.1 and
+#     playwright-core 1.63.0 (exact pins + frozen lockfile in
+#     packages/infra/agent-image/open-slide/), whose Chrome Headless Shell
+#     build is pinned by the playwright-core version
 #
 # Secrets bootstrap: the container receives ONE pointer env var,
 # RUNTIME_SECRET_ID. At start, server.ts fetches that JSON secret from Secrets
@@ -102,6 +106,25 @@ RUN export DEBIAN_FRONTEND=noninteractive \
     && /tmp/aws/install --install-dir /opt/aws-cli --bin-dir /opt/aws-cli/bin \
     && rm -rf /tmp/aws /tmp/awscliv2.zip /var/lib/apt/lists/*
 
+# --- open-slide toolchain (skills/slides) -----------------------------------
+# Slide decks are React pages built and exported by open-slide. Its PDF/PPTX
+# export runs in a browser, so `export_deck` drives it in Chrome Headless
+# Shell. Everything is installed HERE, once, so a deck never npm-installs per
+# turn: the deck is copied into a throwaway workspace whose node_modules is a
+# symlink to /opt/open-slide/node_modules. The headless shell is the build
+# playwright-core 1.63.0 names (downloaded from Playwright's CDN), so the
+# browser moves only when that pin does. Own stage: bun's install cache and
+# the download zip never reach the runtime layer.
+FROM ${BUN_IMAGE} AS open-slide-build
+ENV PLAYWRIGHT_BROWSERS_PATH=/opt/open-slide/browsers
+WORKDIR /opt/open-slide
+COPY packages/infra/agent-image/open-slide/package.json \
+     packages/infra/agent-image/open-slide/bun.lock ./
+RUN bun install --frozen-lockfile --production \
+    && bun node_modules/playwright-core/cli.js install chromium-headless-shell \
+    && rm -rf /root/.bun/install/cache
+COPY skills/slides/export_deck.mjs skills/slides/starter.tsx ./
+
 # Resolve whichever of the two GH_IMAGE names. `COPY --from=gh-provider`
 # below is what makes the choice load-bearing.
 FROM ${GH_IMAGE} AS gh-provider
@@ -153,6 +176,11 @@ RUN export DEBIAN_FRONTEND=noninteractive \
     && apt-get install -y --no-install-recommends \
         python3 python3-venv python3-pip ca-certificates git curl \
         poppler-utils \
+        libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 \
+        libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 \
+        libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 \
+        libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 \
+        fontconfig fonts-inter fonts-liberation fonts-noto-color-emoji \
     && ln -sf /usr/bin/python3 /usr/local/bin/python \
     && rm -rf /var/lib/apt/lists/*
 
@@ -186,6 +214,16 @@ RUN ln -s /opt/aws-cli/v2/current/bin/aws /opt/sky/bin/aws-real \
     && /opt/sky/bin/aws-real --version \
     && mkdir -p /opt/sky/aws
 
+# --- Slides (skills/slides) -------------------------------------------------
+# The pinned open-slide toolchain and headless browser from the
+# open-slide-build stage, plus `export_deck` on PATH. Root-owned and read-only
+# at runtime: builds happen in a temp workspace, never under /opt.
+COPY --from=open-slide-build /opt/open-slide /opt/open-slide
+COPY packages/infra/agent-image/bin/export_deck /opt/sky/bin/export_deck
+RUN chmod 0755 /opt/sky/bin/export_deck
+ENV OPEN_SLIDE_HOME=/opt/open-slide \
+    PLAYWRIGHT_BROWSERS_PATH=/opt/open-slide/browsers
+
 # /opt/sky/bin FIRST so `gh` and `aws` resolve to the wrappers, never the real
 # binaries.
 ENV PATH="/opt/sky/bin:${PATH}"

package/agent-image/bin/export_deck

@@ -0,0 +1,5 @@
+#!/bin/sh
+# export_deck: build an open-slide deck and export PDF, PPTX and per-slide PNGs
+# headlessly (skills/slides). The script and its pinned toolchain live in
+# $OPEN_SLIDE_HOME (the agent image bakes /opt/open-slide). `export_deck --help`.
+exec bun "${OPEN_SLIDE_HOME:-/opt/open-slide}/export_deck.mjs" "$@"