@p10i/create-nestbox 0.4.0 → 0.6.0

package/docker/control/server.py

@@ -1,34 +1,20 @@
 #!/usr/bin/env python3
 import http.client
-import hmac
 import json
 import os
 import re
 import socket
 import sys
 import threading
-import time
 import uuid
 from datetime import datetime, timezone
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from urllib.parse import parse_qs, quote, unquote, urlparse
+from urllib.parse import quote, unquote, urlparse
 
 DOCKER_SOCKET = os.environ.get("DOCKER_SOCKET", "/var/run/docker.sock")
-WORKSPACE_PATH = os.environ.get("WORKSPACE_PATH", "/workspace")
 PROJECT_NAME = os.environ.get("COMPOSE_PROJECT_NAME", "").strip()
 SERVICE_NAME = os.environ.get("NESTBOX_CONTROL_SERVICE", "control")
-HOST_TOKEN_FILE = os.environ.get("NESTBOX_HOST_TOKEN_FILE", "/run/secrets/nestbox-host-token")
-try:
-    with open(HOST_TOKEN_FILE, encoding="utf-8") as token_stream:
-        HOST_TOKEN = token_stream.read().strip()
-except OSError:
-    HOST_TOKEN = ""
-HOST_TIMEOUT = int(os.environ.get("NESTBOX_HOST_RUNNER_TIMEOUT", "3600"))
-HOST_HEARTBEAT_TTL = int(os.environ.get("NESTBOX_HOST_RUNNER_HEARTBEAT_TTL", "10"))
-HOST_LONG_POLL_TIMEOUT = int(os.environ.get("NESTBOX_HOST_LONG_POLL_TIMEOUT", "25"))
-MAX_HOST_JOBS = int(os.environ.get("NESTBOX_MAX_HOST_JOBS", "100"))
 MAX_BODY_BYTES = 128 * 1024
-MAX_HOST_BODY_BYTES = 64 * 1024 * 1024
 MAX_COMMAND_PARTS = 256
 MAX_COMMAND_BYTES = 64 * 1024
 LOG_OUTPUT = os.environ.get("NESTBOX_CONTROL_LOG_OUTPUT", "text").lower()
@@ -183,188 +169,6 @@ def policy_error(source, target, user, configured_user=""):
     return ""
 
 
-def allows_npm(source):
-    labels = (source or {}).get("Labels") or {}
-    return bool(source) and truthy(labels, "nestbox.npm.allow") and not truthy(labels, "nestbox.exec.deny-source")
-
-
-def package_scripts():
-    path = os.path.join(WORKSPACE_PATH, "package.json")
-    if not os.path.isfile(path):
-        return None
-    with open(path, encoding="utf-8") as stream:
-        document = json.load(stream)
-    scripts = document.get("scripts", {})
-    if not isinstance(scripts, dict):
-        raise ValueError("package.json scripts must be an object")
-    return {str(name): str(command) for name, command in scripts.items()}
-
-
-class HostBroker:
-    def __init__(self):
-        self.condition = threading.Condition()
-        self.pending = []
-        self.jobs = {}
-        self.runner = {}
-
-    def touch(self, runner_id, headers):
-        if not re.fullmatch(r"[A-Za-z0-9._:-]{8,128}", runner_id):
-            raise ValueError("invalid runner ID")
-        now = time.monotonic()
-        with self.condition:
-            active_id = self.runner.get("id")
-            active_age = now - self.runner.get("seen", 0)
-            if active_id and active_id != runner_id and active_age <= HOST_HEARTBEAT_TTL:
-                raise PermissionError("another host runner is active")
-            if active_id and active_id != runner_id:
-                for record in self.jobs.values():
-                    if record.get("runnerId") == active_id and record.get("result") is None:
-                        record["result"] = {
-                            "jobId": record["job"]["jobId"],
-                            "exitCode": 1,
-                            "stdout": "",
-                            "stderr": "The assigned host runner disconnected before returning a result.",
-                            "interrupted": True,
-                        }
-            self.runner = {
-                "id": runner_id,
-                "seen": now,
-                "pid": headers.get("X-Nestbox-Runner-Pid"),
-                "platform": headers.get("X-Nestbox-Runner-Platform"),
-                "hostname": headers.get("X-Nestbox-Runner-Host"),
-            }
-            self.condition.notify_all()
-
-    def status(self):
-        with self.condition:
-            if not self.runner:
-                return {"available": False}
-            age = max(0, time.monotonic() - self.runner["seen"])
-            return {
-                "available": age <= HOST_HEARTBEAT_TTL,
-                "ageSeconds": round(age, 3),
-                "pid": self.runner.get("pid"),
-                "platform": self.runner.get("platform"),
-                "hostname": self.runner.get("hostname"),
-            }
-
-    def enqueue(self, job):
-        with self.condition:
-            if len(self.jobs) >= MAX_HOST_JOBS:
-                raise RuntimeError("too many host jobs are pending")
-            self.jobs[job["jobId"]] = {"job": job, "result": None, "runnerId": None}
-            self.pending.append(job["jobId"])
-            self.condition.notify_all()
-
-    def next(self, runner_id, headers, timeout):
-        deadline = time.monotonic() + timeout
-        with self.condition:
-            while True:
-                if self.runner.get("id") != runner_id:
-                    raise PermissionError("another host runner is active")
-                if time.monotonic() - self.runner.get("seen", 0) > HOST_HEARTBEAT_TTL:
-                    return None
-                if self.pending:
-                    identifier = self.pending.pop(0)
-                    record = self.jobs.get(identifier)
-                    if record:
-                        record["runnerId"] = runner_id
-                        return record["job"]
-                remaining = deadline - time.monotonic()
-                if remaining <= 0:
-                    return None
-                self.condition.wait(min(1, remaining))
-
-    def complete(self, runner_id, identifier, result):
-        with self.condition:
-            record = self.jobs.get(identifier)
-            if not record or record.get("runnerId") != runner_id:
-                raise ValueError("host job is unknown or belongs to another runner")
-            if record.get("result") is not None:
-                raise ValueError("host job already has a result")
-            if result.get("jobId") != identifier:
-                raise ValueError("host result contains a mismatched job ID")
-            job = record["job"]
-            if job["type"] == "npm.run":
-                if not isinstance(result.get("exitCode"), int) or not isinstance(result.get("stdout"), str) or not isinstance(result.get("stderr"), str):
-                    raise ValueError("invalid npm run result")
-            elif job["type"] == "npm.scripts.request":
-                if result.get("status") != "confirmation_required" or result.get("requestId") != job.get("requestId") or result.get("operation") != job.get("operation") or result.get("name") != job.get("name"):
-                    if not isinstance(result.get("exitCode"), int):
-                        raise ValueError("invalid script change request result")
-            elif job["type"] == "npm.scripts.confirm":
-                if result.get("status") == "success" and result.get("requestId") != job.get("requestId"):
-                    raise ValueError("invalid script confirmation result")
-                if result.get("status") != "success" and not isinstance(result.get("exitCode"), int):
-                    raise ValueError("invalid script confirmation result")
-            record["result"] = result
-            self.condition.notify_all()
-
-    def wait(self, identifier, timeout=HOST_TIMEOUT):
-        deadline = time.monotonic() + timeout
-        with self.condition:
-            while True:
-                record = self.jobs.get(identifier)
-                if record and record.get("runnerId") and record.get("result") is None:
-                    owner = record["runnerId"]
-                    if self.runner.get("id") != owner or time.monotonic() - self.runner.get("seen", 0) > HOST_HEARTBEAT_TTL:
-                        record["result"] = {
-                            "jobId": identifier,
-                            "exitCode": 1,
-                            "stdout": "",
-                            "stderr": "The assigned host runner disconnected before returning a result.",
-                            "interrupted": True,
-                        }
-                elif record and record.get("result") is None and self.runner and time.monotonic() - self.runner.get("seen", 0) > HOST_HEARTBEAT_TTL:
-                    record["result"] = {
-                        "jobId": identifier,
-                        "exitCode": 1,
-                        "stdout": "",
-                        "stderr": "The host runner disconnected before accepting the job.",
-                        "interrupted": True,
-                    }
-                if record and record.get("result") is not None:
-                    result = record["result"]
-                    del self.jobs[identifier]
-                    return result
-                remaining = deadline - time.monotonic()
-                if remaining <= 0:
-                    self.jobs.pop(identifier, None)
-                    if identifier in self.pending:
-                        self.pending.remove(identifier)
-                    raise TimeoutError(f"host runner did not finish within {timeout} seconds")
-                self.condition.wait(min(1, remaining))
-
-
-HOST_BROKER = HostBroker()
-
-
-def host_status():
-    return HOST_BROKER.status()
-
-
-def enqueue(job):
-    HOST_BROKER.enqueue(job)
-
-
-def wait_result(identifier, timeout=HOST_TIMEOUT):
-    return HOST_BROKER.wait(identifier, timeout)
-
-
-def record_host_result(identifier, source_name, script, result, detached):
-    stdout, stderr = str(result.get("stdout", "")), str(result.get("stderr", ""))
-    log_output(identifier, "npm.stdout", stdout)
-    log_output(identifier, "npm.stderr", stderr)
-    log_event("npm.complete", runId=identifier, source=source_name, script=script, detached=detached, executor="host", exitCode=result.get("exitCode"), hostPlatform=result.get("hostPlatform"), hostName=result.get("hostName"), stdoutTruncated=bool(result.get("stdoutTruncated")), stderrTruncated=bool(result.get("stderrTruncated")))
-
-
-def wait_detached(identifier, source_name, script):
-    try:
-        record_host_result(identifier, source_name, script, wait_result(identifier), True)
-    except Exception as error:
-        log_event("npm.error", runId=identifier, source=source_name, script=script, detached=True, error=str(error))
-
-
 def valid_command(command):
     return (isinstance(command, list) and 0 < len(command) <= MAX_COMMAND_PARTS
             and all(isinstance(part, str) and "\0" not in part for part in command)
@@ -372,7 +176,7 @@ def valid_command(command):
 
 
 class Handler(BaseHTTPRequestHandler):
-    server_version = "nestbox-control/0.4"
+    server_version = "nestbox-control/0.6"
 
     def setup(self):
         super().setup()
@@ -408,21 +212,9 @@ class Handler(BaseHTTPRequestHandler):
         if path == "/health":
             try:
                 docker_request("GET", "/_ping")
-                self.send_json(200, {"ok": True, "dockerSocketAccess": True, "workspacePackageJson": os.path.isfile(os.path.join(WORKSPACE_PATH, "package.json")), "hostRunner": host_status()})
-            except Exception as error:
-                self.send_json(503, {"ok": False, "dockerSocketAccess": False, "error": str(error), "hostRunner": host_status()})
-            return
-        if path == "/npm/scripts":
-            source = self.caller()
-            if not allows_npm(source):
-                self.send_json(403, {"error": "caller is not allowed to use npm"})
-                return
-            try:
-                scripts = package_scripts()
+                self.send_json(200, {"ok": True, "dockerSocketAccess": True})
             except Exception as error:
-                self.send_json(400, {"error": str(error)})
-                return
-            self.send_json(200, {"scripts": scripts}) if scripts is not None else self.send_json(404, {"error": "package.json was not found at /workspace/package.json"})
+                self.send_json(503, {"ok": False, "dockerSocketAccess": False, "error": str(error)})
             return
         self.send_json(404, {"error": "not found"})
 
@@ -435,12 +227,6 @@ class Handler(BaseHTTPRequestHandler):
         path = urlparse(self.path).path
         if path.startswith("/containers/") and path.endswith("/exec"):
             self.container_exec(unquote(path[len("/containers/"):-len("/exec")]).strip("/"), body)
-        elif path == "/npm/run":
-            self.npm_run(body)
-        elif path == "/npm/scripts/request":
-            self.script_request(body)
-        elif path == "/npm/scripts/confirm":
-            self.script_confirm(body)
         else:
             self.send_json(404, {"error": "not found"})
 
@@ -484,175 +270,10 @@ class Handler(BaseHTTPRequestHandler):
             log_event("exec.error", runId=identifier, source=service(source), target=service(target), command=command, error=str(error))
             self.send_json(502, {"error": str(error)})
 
-    def npm_context(self):
-        source = self.caller()
-        if not allows_npm(source):
-            self.send_json(403, {"error": "caller is not allowed to use npm"})
-            return None
-        if not host_status().get("available"):
-            self.send_json(503, {"error": "host runner is unavailable; run `npm run host --` from the workspace"})
-            return None
-        return source
-
-    def npm_run(self, body):
-        source = self.npm_context()
-        if source is None: return
-        script, args = body.get("script"), body.get("args", [])
-        if not isinstance(script, str) or not re.fullmatch(r"[A-Za-z0-9:_@./ -]{1,128}", script) or script == "host":
-            self.send_json(400, {"error": "invalid or protected script name"}); return
-        if not isinstance(args, list) or not all(isinstance(arg, str) and "\0" not in arg for arg in args):
-            self.send_json(400, {"error": "args must be a string array"}); return
-        try:
-            scripts = package_scripts()
-        except Exception as error:
-            self.send_json(400, {"error": str(error)}); return
-        if scripts is None or script not in scripts:
-            self.send_json(404, {"error": "script is not defined in /workspace/package.json"}); return
-        identifier = run_id("npm")
-        job = {"schemaVersion": 1, "jobId": identifier, "type": "npm.run", "script": script, "args": args, "source": service(source), "createdAt": now_iso()}
-        try:
-            enqueue(job)
-            if body.get("detach"):
-                threading.Thread(target=wait_detached, args=(identifier, service(source), script), daemon=True).start()
-                self.send_json(202, {"runId": identifier, "detached": True, "executor": "host"}); return
-            result = wait_result(identifier)
-            record_host_result(identifier, service(source), script, result, False)
-            self.send_json(200, {"runId": identifier, "exitCode": result.get("exitCode"), "stdout": str(result.get("stdout", "")), "stderr": str(result.get("stderr", "")), "pid": result.get("pid"), "executor": "host"})
-        except Exception as error:
-            self.send_json(502, {"error": str(error)})
-
-    def script_request(self, body):
-        source = self.npm_context()
-        if source is None: return
-        operation, name, command = body.get("operation"), body.get("name"), body.get("command")
-        if operation not in {"add", "edit", "delete"} or not isinstance(name, str) or not re.fullmatch(r"[A-Za-z0-9:_@./ -]{1,128}", name) or name == "host":
-            self.send_json(400, {"error": "invalid script change"}); return
-        if operation != "delete" and (not isinstance(command, str) or not command.strip() or len(command) > 8192):
-            self.send_json(400, {"error": "command must be a non-empty string of at most 8192 characters"}); return
-        if operation == "delete" and command is not None:
-            self.send_json(400, {"error": "delete does not accept a command"}); return
-        identifier = run_id("npm-script-request")
-        job = {"schemaVersion": 1, "jobId": identifier, "type": "npm.scripts.request", "requestId": identifier, "operation": operation, "name": name, "source": service(source), "createdAt": now_iso()}
-        if operation != "delete": job["command"] = command
-        try:
-            enqueue(job)
-            result = wait_result(identifier)
-            if result.get("status") != "confirmation_required": raise ValueError(result.get("stderr", "host runner rejected the request"))
-            self.send_json(202, {"status": "confirmation_required", "requestId": result.get("requestId"), "operation": operation, "name": name, "expiresAt": result.get("expiresAt")})
-        except Exception as error:
-            self.send_json(400, {"error": str(error)})
-
-    def script_confirm(self, body):
-        source = self.npm_context()
-        if source is None: return
-        request_id, code = body.get("requestId"), body.get("code")
-        if not isinstance(request_id, str) or not re.fullmatch(r"npm-script-request-[A-Za-z0-9-]{16,80}", request_id) or not isinstance(code, str) or not re.fullmatch(r"[A-Za-z0-9_-]{4,32}", code):
-            self.send_json(400, {"error": "invalid request ID or confirmation code"}); return
-        identifier = run_id("npm-script-confirm")
-        job = {"schemaVersion": 1, "jobId": identifier, "type": "npm.scripts.confirm", "requestId": request_id, "code": code, "source": service(source), "createdAt": now_iso()}
-        try:
-            enqueue(job)
-            result = wait_result(identifier)
-            if result.get("status") != "success": raise ValueError(result.get("stderr", "host runner rejected the confirmation"))
-            self.send_json(200, {"status": "success", "requestId": request_id, "operation": result.get("operation"), "name": result.get("name")})
-        except Exception as error:
-            self.send_json(400, {"error": str(error)})
-
-
-class HostHandler(BaseHTTPRequestHandler):
-    server_version = "nestbox-host-control/0.4"
-
-    def setup(self):
-        super().setup()
-        self.connection.settimeout(HOST_LONG_POLL_TIMEOUT + 10)
-
-    def log_message(self, fmt, *args):
-        log_event("host.http.access", client=self.address_string(), message=fmt % args)
-
-    def send_json(self, status, value):
-        payload = json.dumps(value, ensure_ascii=False).encode()
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json; charset=utf-8")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def authorized(self):
-        supplied = self.headers.get("Authorization", "")
-        expected = f"Bearer {HOST_TOKEN}"
-        return hmac.compare_digest(supplied.encode(), expected.encode())
-
-    def runner(self):
-        return self.headers.get("X-Nestbox-Runner-Id", "")
-
-    def body(self):
-        if self.headers.get("Transfer-Encoding"):
-            raise ValueError("transfer encoding is not supported")
-        length = int(self.headers.get("Content-Length", "0"))
-        if length < 0 or length > MAX_HOST_BODY_BYTES:
-            raise ValueError("request body is too large")
-        value = json.loads(self.rfile.read(length)) if length else {}
-        if not isinstance(value, dict):
-            raise ValueError("request body must be a JSON object")
-        return value
-
-    def authenticate(self):
-        if not self.authorized():
-            self.send_json(401, {"error": "invalid host runner token"})
-            return False
-        try:
-            HOST_BROKER.touch(self.runner(), self.headers)
-            return True
-        except PermissionError as error:
-            self.send_json(409, {"error": str(error)})
-        except ValueError as error:
-            self.send_json(400, {"error": str(error)})
-        return False
-
-    def do_GET(self):
-        parsed = urlparse(self.path)
-        if parsed.path == "/host/health":
-            if not self.authenticate(): return
-            self.send_json(200, {"ok": True, "hostRunner": host_status()})
-            return
-        if parsed.path == "/host/jobs/next":
-            if not self.authenticate(): return
-            try:
-                requested = int((parse_qs(parsed.query).get("timeout") or [HOST_LONG_POLL_TIMEOUT])[0])
-                timeout = max(1, min(HOST_LONG_POLL_TIMEOUT, requested))
-                job = HOST_BROKER.next(self.runner(), self.headers, timeout)
-                if job is None:
-                    self.send_response(204); self.end_headers(); return
-                self.send_json(200, job)
-            except (TypeError, ValueError) as error:
-                self.send_json(400, {"error": str(error)})
-            return
-        self.send_json(404, {"error": "not found"})
-
-    def do_POST(self):
-        if not self.authenticate(): return
-        path = urlparse(self.path).path
-        if path == "/host/heartbeat":
-            self.send_json(200, {"ok": True})
-            return
-        match = re.fullmatch(r"/host/jobs/([A-Za-z0-9._:-]{1,128})/result", path)
-        if not match:
-            self.send_json(404, {"error": "not found"}); return
-        try:
-            result = self.body()
-            HOST_BROKER.complete(self.runner(), match.group(1), result)
-            self.send_json(202, {"accepted": True})
-        except ValueError as error:
-            self.send_json(400, {"error": str(error)})
-
 
 def main():
     if not re.fullmatch(r"[a-z0-9][a-z0-9_-]*", PROJECT_NAME):
         raise SystemExit("COMPOSE_PROJECT_NAME must be a non-empty lowercase project slug")
-    if len(HOST_TOKEN) < 32:
-        raise SystemExit("NESTBOX_HOST_TOKEN_FILE must contain a token of at least 32 characters")
-    host_server = ThreadingHTTPServer(("0.0.0.0", 4089), HostHandler)
-    threading.Thread(target=host_server.serve_forever, daemon=True).start()
     ThreadingHTTPServer(("0.0.0.0", int(os.environ.get("NESTBOX_CONTROL_PORT", "4088"))), Handler).serve_forever()
 
 

package/docker/nginx/Dockerfile

@@ -1,19 +1,19 @@
-# syntax=docker/dockerfile:1.7
-
-# ---- Stage 1: build the JS/CSS bundles with Rollup ----
+# syntax=docker/dockerfile:1.7
+
+# ---- Stage 1: build the JS/CSS bundles with Rollup ----
 FROM node:alpine AS bundles
-
-WORKDIR /sources/rollup
+
+WORKDIR /sources/rollup
 COPY ./home/configs/rollup/package.json ./package.json
 COPY ./home/configs/rollup/package-lock.json ./package-lock.json
 RUN npm ci --no-audit --no-fund
-
-COPY ./home/configs/rollup/rollup.config.js ./rollup.config.js
-COPY ./home/code /home/code
-RUN npx rollup -c
-
+
+COPY ./home/configs/rollup/rollup.config.js ./rollup.config.js
+COPY ./home/code /home/code
+RUN npx rollup -c
+
 # ---- Stage 2: runtime ----
-FROM alpine:3.23
+FROM alpine:latest
 
 RUN apk add --no-cache nginx nginx-mod-http-nchan && \
     mkdir -p /run/nginx /var/lib/nginx/tmp

package/docker/opencode/Dockerfile

@@ -10,8 +10,12 @@ FROM ghcr.io/anomalyco/opencode:latest
 ARG APP_UID=1000
 ARG APP_GID=1000
 
-RUN apk add --no-cache git nodejs php85 php85-dom php85-mbstring php85-openssl php85-phar php85-tokenizer php85-xml php85-xmlwriter su-exec && \
-    ln -s /usr/bin/php85 /usr/local/bin/php && \
+# Alpine names PHP packages by branch. Select its newest available branch
+# instead of retaining an older branch as the rolling base image advances.
+RUN php_package="$(apk search --no-cache --quiet --exact 'php[0-9]*' | grep -E '^php[0-9]+$' | sort -V | tail -n 1)" && \
+    test -n "$php_package" && \
+    apk add --no-cache git nodejs "$php_package" "$php_package-dom" "$php_package-mbstring" "$php_package-openssl" "$php_package-phar" "$php_package-tokenizer" "$php_package-xml" "$php_package-xmlwriter" su-exec && \
+    ln -s "/usr/bin/$php_package" /usr/local/bin/php && \
     addgroup -g "${APP_GID}" -S nestbox && \
     adduser -u "${APP_UID}" -G nestbox -S -h /home/nestbox nestbox
 

package/docker/php-fpm/Dockerfile

@@ -1,43 +1,43 @@
-# syntax=docker/dockerfile:1.7
-
-# ---- Stage 1: install PHP dependencies with Composer ----
+# syntax=docker/dockerfile:1.7
+
+# ---- Stage 1: install PHP dependencies with Composer ----
 FROM composer:latest AS vendor
-
-WORKDIR /build
+
+WORKDIR /build
 COPY ./home/configs/php/composer.json ./composer.json
 COPY ./home/configs/php/composer.lock ./composer.lock
 RUN composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev
-
-# ---- Stage 2: runtime ----
+
+# ---- Stage 2: runtime ----
 FROM php:fpm-alpine
-
-ARG APP_UID=1000
-ARG APP_GID=1000
-
+
+ARG APP_UID=1000
+ARG APP_GID=1000
+
 # Required system + PHP extensions.
 RUN apk add --no-cache --virtual .build-deps $PHPIZE_DEPS libzip-dev && \
     apk add --no-cache libzip && \
     docker-php-ext-install zip && \
     apk del .build-deps
-
-# PHP config.
-COPY ./home/configs/php/php.ini /usr/local/etc/php/conf.d/custom.ini
-
-# Vendor dir from stage 1.
+
+# PHP config.
+COPY ./home/configs/php/php.ini /usr/local/etc/php/conf.d/custom.ini
+
+# Vendor dir from stage 1.
 COPY --from=vendor /build/vendor /vendor
 COPY ./home/configs/php/composer.json /composer.json
 COPY ./home/configs/php/composer.lock /composer.lock
-
+
 # Application source.
 COPY ./home/configs/php /sources/php
 COPY ./home/code /home/code
-
-# Run as a non-root, non-default user. UID/GID are passed as build args so
-# they can match the host user when bind-mounting in development, avoiding
-# the classic "files owned by root after compose down" annoyance on Linux.
+
+# Run as a non-root, non-default user. UID/GID are passed as build args so
+# they can match the host user when bind-mounting in development, avoiding
+# the classic "files owned by root after compose down" annoyance on Linux.
 RUN addgroup -g "${APP_GID}" -S nestbox && \
     adduser  -u "${APP_UID}" -G nestbox -S -H nestbox && \
     sed -i "s/^user = .*/user = nestbox/; s/^group = .*/group = nestbox/" /usr/local/etc/php-fpm.d/www.conf && \
     chown -R nestbox:nestbox /home/code /sources/php /vendor
-
+
 USER nestbox

package/docker-compose.yaml

@@ -59,12 +59,6 @@ services:
         target: /workspace
         bind:
           create_host_path: false
-      - type: bind
-        source: ${WORKSPACE_PATH:-.}/package.json
-        target: /workspace/package.json
-        read_only: true
-        bind:
-          create_host_path: false
     environment:
       # Event publication and OpenCode automation stay inside Compose.
       - NESTBOX_BUS_PUBLISH_URL=http://nginx:8080/_nestbox/publish
@@ -106,7 +100,7 @@ services:
       - nestbox.exec.allow-target=true
     restart: unless-stopped
 
-  # Private, label-gated bridge for container exec and native host npm jobs.
+  # Private, label-gated API for container exec.
   # This is the only Nestbox service with access to the host Docker socket.
   control:
     build:
@@ -114,26 +108,11 @@ services:
       dockerfile: ./docker/control/Dockerfile
     expose:
       - "4088"
-      # Authenticated host-runner transport, proxied only through Nginx.
-      - "4089"
     volumes:
       - ${DOCKER_SOCKET_PATH:-/var/run/docker.sock}:/var/run/docker.sock
-      - type: bind
-        source: ${WORKSPACE_PATH:-.}
-        target: /workspace
-        read_only: true
-        bind:
-          create_host_path: false
-      - type: bind
-        source: ${NESTBOX_HOST_TOKEN_FILE:?NESTBOX_HOST_TOKEN_FILE must be configured}
-        target: /run/secrets/nestbox-host-token
-        read_only: true
-        bind:
-          create_host_path: false
     environment:
       - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME}
       - NESTBOX_CONTROL_SERVICE=control
-      - NESTBOX_HOST_TOKEN_FILE=/run/secrets/nestbox-host-token
       - NESTBOX_CONTROL_LOG_OUTPUT=${NESTBOX_CONTROL_LOG_OUTPUT:-text}
       - NESTBOX_CONTROL_LOG_MAX_BYTES=${NESTBOX_CONTROL_LOG_MAX_BYTES:-262144}
     healthcheck:
@@ -182,12 +161,6 @@ services:
         target: /workspace
         bind:
           create_host_path: false
-      - type: bind
-        source: ${WORKSPACE_PATH:-.}/package.json
-        target: /workspace/package.json
-        read_only: true
-        bind:
-          create_host_path: false
       # The entrypoint fixes this volume's ownership before dropping privileges.
       - opencode-data:/home/nestbox/.local/share/opencode
     working_dir: /workspace
@@ -197,7 +170,6 @@ services:
     labels:
       - nestbox.exec.allow-source=true
       - nestbox.exec.targets=php-fpm,rollup
-      - nestbox.npm.allow=true
     restart: unless-stopped
 
 volumes:

package/home/code/__includes/footer.php

@@ -1,3 +1,3 @@
-        </article>
-    </body>
+        </article>
+    </body>
 </html>

package/home/code/__includes/header.php

@@ -1,10 +1,10 @@
 <!DOCTYPE html>
 <html lang="en">
-    <head>
-        <meta charset="utf-8">
-        <meta name="viewport" content="width=device-width, initial-scale=1.0">
-        <title><?= htmlspecialchars($title ?? 'Nestbox', ENT_QUOTES, 'UTF-8'); ?></title>
-        <!-- Pre-built bundle of every shared dependency (Bootstrap, GitHub Markdown CSS, …): -->
+    <head>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <title><?= htmlspecialchars($title ?? 'Nestbox', ENT_QUOTES, 'UTF-8'); ?></title>
+        <!-- Pre-built bundle of every shared dependency (Bootstrap, GitHub Markdown CSS, …): -->
         <link rel="stylesheet" href="<?= nestbox_escape(nestbox_url_path('scripts-bundle.css')); ?>">
         <script defer src="<?= nestbox_escape(nestbox_url_path('scripts-bundle.js')); ?>"></script>
         <!-- Site-wide overrides: -->