@p10i/create-nestbox 0.4.0 → 0.6.0

package/home/configs/nginx/nginx.conf

@@ -3,11 +3,11 @@ include /etc/nginx/modules/*.conf;
 worker_processes  1;
 error_log /dev/stderr notice;
 pid /run/nginx/nginx.pid;
-
-events {
-    worker_connections  1024;
-}
-
+
+events {
+    worker_connections  1024;
+}
+
 http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
@@ -32,17 +32,17 @@ http {
         default upgrade;
         '' close;
     }
-
-    sendfile        on;
-    keepalive_timeout  65;
-
-    server {
-        listen 80 default_server;
-
+
+    sendfile        on;
+    keepalive_timeout  65;
+
+    server {
+        listen 80 default_server;
+
         root /var/www/html;
         index index.php;
         error_page 404 /404.php;
-
+
         # Super-documents are trusted and may contain inline scripts and styles.
         add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; base-uri 'self'; frame-ancestors 'self'" always;
         add_header X-Content-Type-Options "nosniff" always;
@@ -74,23 +74,6 @@ http {
             nchan_eventsource_ping_interval 20s;
         }
 
-        # Authenticated native host-runner transport. Control remains private;
-        # this route shares the one published Nestbox gateway port.
-        location ^~ /_nestbox/host/ {
-            resolver 127.0.0.11 ipv6=off valid=10s;
-            set $nestbox_host_control http://control:4089;
-            rewrite ^/_nestbox(/host/.*)$ $1 break;
-            proxy_pass $nestbox_host_control;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_buffering off;
-            proxy_request_buffering off;
-            proxy_read_timeout 40s;
-            client_max_body_size 64m;
-        }
-
         location ^~ /_nestbox/ {
             return 404;
         }
@@ -129,7 +112,7 @@ http {
             try_files $uri @php;
         }
 
-        # Never serve raw PHP files from nginx
+        # Never serve raw PHP files from nginx
         location ~ \.php$ {
             return 404;
         }
@@ -145,8 +128,8 @@ http {
             fastcgi_param REQUEST_URI /404;
             fastcgi_param NESTBOX_ORIGINAL_URI $request_uri;
         }
-
-        # Named location for PHP handling
+
+        # Named location for PHP handling
         location @php {
             include /etc/nginx/fastcgi_params;
             fastcgi_pass php-fpm:9000;
@@ -154,7 +137,7 @@ http {
             error_page 404 /404.php;
             fastcgi_param SCRIPT_FILENAME /sources/php/index.php;
         }
-
+
         # Deny access to any file or directory that starts with a dot (.)
         location ~ /\. {
             deny all;

package/home/configs/opencode/control-mcp.js

@@ -5,10 +5,6 @@ const baseUrl = (process.env.NESTBOX_CONTROL_URL || 'http://control:4088').repla
 const timeoutMs = Number(process.env.NESTBOX_CONTROL_TIMEOUT_MS || '30000');
 const tools = [
   { name: 'docker_exec', description: 'Run a command in an allowed Compose service.', inputSchema: { type: 'object', properties: { machine: { type: 'string' }, workdir: { type: 'string' }, command: { type: 'array', items: { type: 'string' } }, user: { type: 'string' }, detach: { type: 'boolean' } }, required: ['machine', 'workdir', 'command'], additionalProperties: false } },
-  { name: 'npm_scripts', description: 'List host npm scripts from /workspace/package.json.', inputSchema: { type: 'object', properties: {}, additionalProperties: false } },
-  { name: 'npm_run', description: 'Run an allowed npm script through the active host bridge.', inputSchema: { type: 'object', properties: { script: { type: 'string' }, args: { type: 'array', items: { type: 'string' } }, detach: { type: 'boolean' } }, required: ['script'], additionalProperties: false } },
-  { name: 'npm_script_change_request', description: 'Request an add, edit, or delete of an npm script. The confirmation code is displayed only by the host runner.', inputSchema: { type: 'object', properties: { operation: { type: 'string', enum: ['add', 'edit', 'delete'] }, name: { type: 'string' }, command: { type: 'string' } }, required: ['operation', 'name'], additionalProperties: false } },
-  { name: 'npm_script_change_confirm', description: 'Confirm a pending npm script change with the host-visible code.', inputSchema: { type: 'object', properties: { requestId: { type: 'string' }, code: { type: 'string' } }, required: ['requestId', 'code'], additionalProperties: false } },
 ];
 
 function request(method, path, body) {
@@ -53,28 +49,12 @@ async function call(name, raw) {
     if (args.detach !== undefined) body.detach = Boolean(args.detach);
     return { machine: args.machine, workdir: args.workdir, command: args.command, result: await request('POST', `/containers/${encodeURIComponent(args.machine)}/exec`, body) };
   }
-  if (name === 'npm_scripts') return request('GET', '/npm/scripts');
-  if (name === 'npm_run') {
-    if (typeof args.script !== 'string' || !args.script) throw new Error('script must be a non-empty string.');
-    if (args.args !== undefined && (!Array.isArray(args.args) || !args.args.every(value => typeof value === 'string'))) throw new Error('args must be a string array.');
-    return request('POST', '/npm/run', { script: args.script, ...(args.args === undefined ? {} : { args: args.args }), ...(args.detach === undefined ? {} : { detach: Boolean(args.detach) }) });
-  }
-  if (name === 'npm_script_change_request') {
-    if (!['add', 'edit', 'delete'].includes(args.operation) || typeof args.name !== 'string' || !args.name) throw new Error('operation and name are required.');
-    if (args.operation !== 'delete' && (typeof args.command !== 'string' || !args.command)) throw new Error('command is required for add and edit.');
-    if (args.operation === 'delete' && args.command !== undefined) throw new Error('command must be omitted for delete.');
-    return request('POST', '/npm/scripts/request', { operation: args.operation, name: args.name, ...(args.command === undefined ? {} : { command: args.command }) });
-  }
-  if (name === 'npm_script_change_confirm') {
-    if (typeof args.requestId !== 'string' || typeof args.code !== 'string') throw new Error('requestId and code are required.');
-    return request('POST', '/npm/scripts/confirm', { requestId: args.requestId, code: args.code });
-  }
   throw new Error(`Unknown tool: ${name}`);
 }
 
 function emit(value) { process.stdout.write(`${JSON.stringify(value)}\n`); }
 async function handle(message) {
-  if (message.method === 'initialize') return emit({ jsonrpc: '2.0', id: message.id, result: { protocolVersion: '2024-11-05', capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'nestbox-control-mcp', version: '0.4.0' } } });
+  if (message.method === 'initialize') return emit({ jsonrpc: '2.0', id: message.id, result: { protocolVersion: '2024-11-05', capabilities: { tools: { listChanged: false } }, serverInfo: { name: 'nestbox-control-mcp', version: '0.6.0' } } });
   if (message.method === 'initialized') return;
   if (message.method === 'tools/list') return emit({ jsonrpc: '2.0', id: message.id, result: { tools } });
   if (message.method === 'tools/call') {

package/home/configs/opencode/instructions.md

@@ -170,17 +170,15 @@ Use API-created sessions only for explicit page workflows. The shared header's O
 
 ## Container Control API
 
-OpenCode has no Docker socket. Use the control MCP as the only path for commands in other containers or on the native host:
+OpenCode has no Docker socket. Use the control MCP as the only path for commands in other containers:
 
 - `docker_exec` accepts an allowed Compose `machine`, absolute `workdir`, positional `command` array, and optional `user` or `detach` value.
-- `npm_scripts` lists scripts from `/workspace/package.json`.
-- `npm_run` executes one declared script through the active native host runner. Prefer `detach: true` for work expected to exceed the MCP request timeout.
-- `npm_script_change_request` requests an add, edit, or delete. The confirmation code appears only in the host runner terminal.
-- `npm_script_change_confirm` applies the pending change after the user explicitly supplies that code.
 
-Do not call the control HTTP API directly from OpenCode, impersonate the native runner, invoke Docker or SSH as a substitute, or work around a missing MCP capability. PHP cannot invoke MCP, so trusted super-documents may use `nestbox_control_exec()`; default labels restrict PHP-FPM to self-exec. Only OpenCode has `nestbox.npm.allow=true` by default. Root exec requires an explicit target label.
+Run project commands, including npm scripts, in the appropriate container. Use `detach: true` for commands expected to exceed the MCP request timeout. Native host execution is not provided; hand host-side activation to the user or external maintainer.
 
-The control log is the audit source of truth and requires no observability service. The native runner uses an authenticated, loopback-only long-poll endpoint; no host listener or filesystem queue exists. Commands still operate in trusted containers and a trusted writable workspace; Docker socket access and editable host-script source mean this is a controlled capability, not a security sandbox.
+Do not call the control HTTP API directly from OpenCode, invoke Docker or SSH as a substitute, or work around a missing MCP capability. PHP cannot invoke MCP, so trusted super-documents may use `nestbox_control_exec()`; default labels restrict PHP-FPM to self-exec. Root exec requires an explicit target label.
+
+The control log is the audit source of truth and requires no observability service. Commands operate in trusted containers and a trusted writable workspace; Docker socket access means this is a controlled capability, not a security sandbox.
 
 ## Git And Commit Policy
 
@@ -196,15 +194,17 @@ The control log is the audit source of truth and requires no observability servi
 
 ## Container Architecture
 
+The package defaults to latest-stable container images and the latest system packages available in their configured repositories. Preserve this rolling policy unless the user explicitly requests pinning. Refresh images and package-install layers with `docker compose build --pull --no-cache` during host-side updates; running containers do not update themselves. Keep application library lockfiles authoritative. Verify the resulting PHP CLI and FPM versions, since Alpine packaging can lag upstream PHP.
+
 The default Compose application has five services:
 
 - `nginx`: the only host-published gateway. It serves static page files, routes super-documents to PHP-FPM, proxies the OpenCode virtual host, and hosts Nchan.
 - `php-fpm`: executes HTTP and CLI directions. It mounts the page tree and workspace writable because trusted pages may intentionally modify them.
 - `rollup`: watches `scripts.js` and browser dependencies and writes local JS/CSS bundles into the page tree.
 - `opencode`: runs this agent, mounts the engine and workspace, and edits the page tree through `/nestbox/home/code`.
-- `control`: owns the Docker socket and privately brokers label-gated container exec and host-runner jobs.
+- `control`: owns the Docker socket and privately brokers label-gated container exec.
 
-The default host port is `4180` after installer confirmation. Nginx container port `80` serves Nestbox, OpenCode through host-based routing, and the authenticated `/_nestbox/host/` runner transport. Nginx container port `8080` is only the internal Nchan publisher. No other service publishes a host port.
+The default host port is `4180` after installer confirmation. Nginx container port `80` serves Nestbox and OpenCode through host-based routing. Nginx container port `8080` is only the internal Nchan publisher. No other service publishes a host port, and no background host runner is required.
 
 Important files:
 
@@ -226,7 +226,6 @@ The engine's untracked `/nestbox/.env` controls runtime paths, exposure, authent
 - `COMPOSE_PROJECT_NAME`: unique installation identifier; collisions can mix unrelated containers and networks.
 - `BIND_ADDRESS`: loopback for local use or an explicitly approved network bind.
 - `WEB_PORT`: confirmed host gateway port, normally `4180`.
-- `NESTBOX_HOST_TOKEN_FILE`: creator-managed private runner token outside the mounted workspace; only `control` receives it.
 - `APP_UID` and `APP_GID`: PHP-FPM ownership for writable bind mounts.
 - `NESTBOX_URL_PREFIX`: public path prefix when an outer proxy strips that prefix before forwarding.
 - `NESTBOX_OPENCODE_PUBLIC_URL`: explicit public OpenCode origin when `agent.<nestbox-host>` cannot be derived.
@@ -270,7 +269,7 @@ Choose one explicit integration mode:
 For every added service, decide and document:
 
 - Lifecycle owner.
-- Pinned image or build context.
+- Image tag or build context, following the package's latest-stable default unless pinning is explicitly requested.
 - Command and working directory.
 - Non-root user and host UID/GID behavior where practical.
 - Read-only and writable mounts.
@@ -294,7 +293,7 @@ You may edit Compose files, Dockerfiles, Nginx configuration, PHP configuration,
 
 1. Validate every part that can be checked inside this container.
 2. Identify the exact affected services.
-3. Use a declared host npm script through MCP when one exists; otherwise give the user the narrowest host-side command.
+3. Give the user the narrowest host-side command for activation.
 4. State that activation and host health checks remain pending.
 5. Tell the user to reconnect if OpenCode itself must restart.
 

package/home/configs/opencode/opencode.json

@@ -4,7 +4,7 @@
     "hostname": "0.0.0.0",
     "port": 4096
   },
-  "instructions": ["instructions.md", "instance.md"],
+  "instructions": ["/etc/opencode/instructions.md", "/etc/opencode/instance.md"],
   "mcp": {
     "control": {
       "type": "local",

package/home/configs/php/composer.json

@@ -1,10 +1,10 @@
-{
-    "name": "nestbox/site",
-    "description": "Nestbox containerized website stack — PHP dependencies",
-    "type": "project",
-    "license": "MIT",
-    "require": {
+{
+    "name": "nestbox/site",
+    "description": "Nestbox containerized website stack — PHP dependencies",
+    "type": "project",
+    "license": "MIT",
+    "require": {
         "league/commonmark": "^2.5",
         "symfony/yaml": "^7.1"
-    }
-}
+    }
+}

package/home/configs/php/init.php

@@ -1,3 +1,3 @@
-<?php
-// Per-request bootstrap. Loaded once by the router.
+<?php
+// Per-request bootstrap. Loaded once by the router.
 require_once '/vendor/autoload.php';

package/home/configs/php/preload.php

@@ -1,5 +1,5 @@
-<?php
-// OPcache preload. Runs once when PHP-FPM starts so the autoloader and
-// the league/commonmark classes are warm in shared memory across every
-// request.
+<?php
+// OPcache preload. Runs once when PHP-FPM starts so the autoloader and
+// the league/commonmark classes are warm in shared memory across every
+// request.
 require_once '/vendor/autoload.php';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@p10i/create-nestbox",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Create Nestbox projects.",
   "license": "MIT",
   "type": "module",
@@ -13,8 +13,6 @@
     "docker/",
     "home/",
     "tests/",
-    "host-runner.mjs",
-    "package.host.json",
     "docker-compose.yaml",
     ".dockerignore",
     ".env.example",
@@ -31,9 +29,7 @@
     "!home/code/scripts-bundle.css"
   ],
   "scripts": {
-    "host": "node host-runner.mjs",
-    "test:host": "node tests/host-runner.mjs",
-    "test": "node tests/control.mjs && node tests/host-runner.mjs && node tests/creator.mjs",
+    "test": "node tests/control.mjs && node tests/creator.mjs",
     "prepack": "node scripts/check-package.js"
   },
   "engines": {

package/scripts/check-package.js

@@ -11,8 +11,6 @@ const requiredPaths = [
   'docker/rollup/Dockerfile',
   'docker/control/Dockerfile',
   'docker/control/server.py',
-  'host-runner.mjs',
-  'package.host.json',
   'CHANGELOG.md',
   'home/configs/opencode/control-mcp.js',
   'home/configs/opencode/instance.example.md',
@@ -20,7 +18,6 @@ const requiredPaths = [
   'tests/nestbox.sh',
   'tests/nestbox.ps1',
   'tests/control.mjs',
-  'tests/host-runner.mjs',
   'tests/creator.mjs'
 ];
 
@@ -37,10 +34,6 @@ if (!packageJson.files || packageJson.files.includes('.env')) {
   throw new Error('package.json files must not include .env.');
 }
 
-for (const path of ['host-runner.mjs', 'package.host.json']) {
-  if (!packageJson.files.includes(path)) throw new Error(`package.json files must include ${path}.`);
-}
-
 for (const path of ['!**/node_modules/', '!home/code/scripts-bundle.js', '!home/code/scripts-bundle.css']) {
   if (!packageJson.files.includes(path)) throw new Error(`package.json files must include ${path}.`);
 }

package/tests/control.mjs

@@ -5,6 +5,10 @@ const python = process.env.PYTHON || (process.platform === 'win32' ? 'python' :
 const server = resolve('docker/control/server.py');
 const policyTest = String.raw`
 import importlib.util
+import http.client
+import json
+import threading
+from http.server import ThreadingHTTPServer
 spec = importlib.util.spec_from_file_location("control", r"${server}")
 control = importlib.util.module_from_spec(spec)
 spec.loader.exec_module(control)
@@ -25,32 +29,61 @@ target["Labels"]["com.docker.compose.service"] = "rollup"
 assert "not allowed" in control.policy_error(source, target, "1000")
 source["Labels"].pop("nestbox.exec.targets")
 assert "no allowed" in control.policy_error(source, target, "1000")
-broker = control.HostBroker()
-headers = {"X-Nestbox-Runner-Pid": "123", "X-Nestbox-Runner-Platform": "test", "X-Nestbox-Runner-Host": "host"}
-broker.touch("runner-test-1234", headers)
-assert broker.status()["available"]
-job = {"jobId": "job-test", "type": "npm.run"}
-broker.enqueue(job)
-assert broker.next("runner-test-1234", headers, 1) == job
-broker.complete("runner-test-1234", "job-test", {"jobId": "job-test", "exitCode": 0, "stdout": "", "stderr": ""})
-assert broker.wait("job-test", 1)["exitCode"] == 0
-stale = control.HostBroker()
-stale.touch("runner-stale-1234", headers)
-stale.enqueue({"jobId": "job-stale", "type": "npm.run"})
-assert stale.next("runner-stale-1234", headers, 1)["jobId"] == "job-stale"
-control.HOST_HEARTBEAT_TTL = 0
-assert stale.wait("job-stale", 1)["interrupted"] is True
-pending = control.HostBroker()
-pending.touch("runner-pending-1234", headers)
-pending.enqueue({"jobId": "job-pending", "type": "npm.run"})
-assert pending.wait("job-pending", 1)["interrupted"] is True
+source["Labels"]["nestbox.exec.targets"] = "php-fpm"
+target["Labels"]["com.docker.compose.service"] = "php-fpm"
+target["Labels"].pop("nestbox.exec.allow-root")
+
+# Exercise the public control contract without requiring a real Docker socket.
+calls = []
+def docker_request(method, path, body=None, max_bytes=None):
+    calls.append((method, path, body))
+    if path == "/_ping": return b"OK"
+    if path == "/containers/abc/json": return {"Config": {"User": "1000:1000"}}
+    if path == "/containers/abc/exec": return {"Id": "exec-test"}
+    if path == "/exec/exec-test/start": return (b"hello\n", 6)
+    if path == "/exec/exec-test/json": return {"ExitCode": 0}
+    raise AssertionError(path)
+control.docker_request = docker_request
+control.find_by_ip = lambda ip: source
+control.find_by_name = lambda name: target if name == "php-fpm" else None
+httpd = ThreadingHTTPServer(("127.0.0.1", 0), control.Handler)
+thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+thread.start()
+def request(method, path, body=None):
+    connection = http.client.HTTPConnection(*httpd.server_address, timeout=5)
+    try:
+        connection.request(method, path, json.dumps(body) if body is not None else None)
+        response = connection.getresponse()
+        return response.status, json.loads(response.read())
+    finally:
+        connection.close()
+try:
+    status, health = request("GET", "/health")
+    assert status == 200 and health == {"ok": True, "dockerSocketAccess": True}
+    for method, path in [("GET", "/npm/scripts"), ("POST", "/npm/run"), ("POST", "/npm/scripts/request"), ("POST", "/npm/scripts/confirm"), ("POST", "/host/connect"), ("GET", "/host/jobs/next")]:
+        assert request(method, path, {} if method == "POST" else None)[0] == 404
+    body = {"workdir": "/workspace", "command": ["php", "--version"]}
+    status, result = request("POST", "/containers/php-fpm/exec", body)
+    assert status == 200 and result["exitCode"] == 0 and result["output"] == "hello\n"
+    assert result["outputTotalBytes"] == 6 and result["outputTruncated"] is False
+    created = next(call[2] for call in calls if call[1] == "/containers/abc/exec")
+    assert created["Cmd"] == body["command"] and created["WorkingDir"] == "/workspace"
+    calls.clear()
+    assert request("POST", "/containers/php-fpm/exec", {**body, "user": "0"})[0] == 403
+    assert not any(path.endswith("/exec") for _, path, _ in calls)
+    assert request("POST", "/containers/php-fpm/exec", {**body, "command": "php --version"})[0] == 400
+    assert request("POST", "/containers/php-fpm/exec", {**body, "workdir": "relative"})[0] == 400
+finally:
+    httpd.shutdown()
+    httpd.server_close()
+    thread.join()
 `;
 
 let result = spawnSync(python, ['-c', policyTest], {
   encoding: 'utf8',
   env: { ...process.env, COMPOSE_PROJECT_NAME: 'nestbox-test', PYTHONDONTWRITEBYTECODE: '1' },
 });
-if (result.status !== 0) throw new Error(`Control policy test failed: ${result.stderr || result.stdout}`);
+if (result.status !== 0) throw new Error(`Control policy/API test failed: ${result.error?.message || result.stderr || result.stdout}`);
 
 result = spawnSync(python, [server], { encoding: 'utf8', env: { ...process.env, COMPOSE_PROJECT_NAME: '', PYTHONDONTWRITEBYTECODE: '1' } });
 if (result.status === 0 || !result.stderr.includes('COMPOSE_PROJECT_NAME')) throw new Error('Control did not fail closed without a project name.');
@@ -58,13 +91,13 @@ if (result.status === 0 || !result.stderr.includes('COMPOSE_PROJECT_NAME')) thro
 const messages = [
   { jsonrpc: '2.0', id: 1, method: 'initialize', params: {} },
   { jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} },
+  { jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'npm_run', arguments: { script: 'build' } } },
 ].map(value => JSON.stringify(value)).join('\n') + '\n';
 result = spawnSync(process.execPath, [resolve('home/configs/opencode/control-mcp.js')], { input: messages, encoding: 'utf8' });
 if (result.status !== 0) throw new Error(`Control MCP test failed: ${result.stderr}`);
 const responses = result.stdout.trim().split(/\r?\n/).map(line => JSON.parse(line));
 const names = responses.find(value => value.id === 2)?.result?.tools?.map(tool => tool.name) || [];
-for (const name of ['docker_exec', 'npm_scripts', 'npm_run', 'npm_script_change_request', 'npm_script_change_confirm']) {
-  if (!names.includes(name)) throw new Error(`Control MCP does not expose ${name}.`);
-}
+if (names.length !== 1 || names[0] !== 'docker_exec') throw new Error('Control MCP must expose only docker_exec.');
+if (!responses.find(value => value.id === 3)?.error?.message.includes('Unknown tool')) throw new Error('Control MCP accepted a removed host tool.');
 
 console.log('Control tests passed.');

package/tests/creator.mjs

@@ -1,41 +1,36 @@
 import { spawnSync } from 'node:child_process';
-import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 
 const fixture = await mkdtemp(join(tmpdir(), 'nestbox-creator-'));
 
 function create(target, layout) {
-  const result = spawnSync(process.execPath, [resolve('bin/create-nestbox.js'), target, '--layout', layout, '--yes', '--no-git'], { encoding: 'utf8', env: { ...process.env, NESTBOX_CREATOR_STATE_ROOT: join(fixture, 'state') } });
+  const result = spawnSync(process.execPath, [resolve('bin/create-nestbox.js'), target, '--layout', layout, '--yes', '--no-git'], { encoding: 'utf8' });
   if (result.status !== 0) throw new Error(`Creator failed for ${layout}: ${result.stderr || result.stdout}`);
+  if (/npm run host|test:host/.test(result.stdout)) throw new Error('Creator still asks for a host runner.');
 }
 
 try {
   const nested = join(fixture, 'nested');
   await mkdir(nested);
-  await writeFile(join(nested, 'package.json'), JSON.stringify({ name: 'existing', scripts: { build: 'node build.mjs' } }));
+  const manifest = '{"name":"existing","scripts":{"host":"node app.mjs","build":"node build.mjs"}}\n';
+  await writeFile(join(nested, 'package.json'), manifest);
   create(nested, 'nestbox');
-  const nestedPackage = JSON.parse(await readFile(join(nested, 'package.json'), 'utf8'));
-  if (nestedPackage.name !== 'existing' || nestedPackage.scripts.build !== 'node build.mjs') throw new Error('Creator replaced existing package metadata.');
-  if (nestedPackage.scripts.host !== 'node .nestbox/host-runner.mjs') throw new Error('Nested host script has the wrong path.');
+  if (await readFile(join(nested, 'package.json'), 'utf8') !== manifest) throw new Error('Creator modified the workspace package.json.');
   const nestedEnv = await readFile(join(nested, '.nestbox', '.env'), 'utf8');
-  const tokenPath = nestedEnv.match(/^NESTBOX_HOST_TOKEN_FILE=(.+)$/m)?.[1]?.trim();
-  if (!/^WORKSPACE_PATH=\.\.$/m.test(nestedEnv) || !tokenPath || !/^[a-f0-9]{64}$/.test((await readFile(tokenPath, 'utf8')).trim())) throw new Error('Nested runtime authentication was not configured.');
-  const npmCommand = process.env.npm_execpath ? process.execPath : (process.platform === 'win32' ? 'npm.cmd' : 'npm');
-  const npmArgs = process.env.npm_execpath ? [process.env.npm_execpath, 'run', 'test:host'] : ['run', 'test:host'];
-  const nestedHostTest = spawnSync(npmCommand, npmArgs, { cwd: nested, encoding: 'utf8' });
-  if (nestedHostTest.status !== 0) throw new Error(`Nested host test script failed: ${nestedHostTest.error?.message || nestedHostTest.stderr || nestedHostTest.stdout}`);
+  if (!/^WORKSPACE_PATH=\.\.$/m.test(nestedEnv)) throw new Error('Nested workspace path is incorrect.');
 
   const direct = join(fixture, 'direct');
   create(direct, 'current');
-  const directPackage = JSON.parse(await readFile(join(direct, 'package.json'), 'utf8'));
-  if (directPackage.scripts.host !== 'node host-runner.mjs' || directPackage.scripts['test:host'] !== 'node tests/host-runner.mjs') throw new Error('Direct host scripts have the wrong paths.');
+  const directEntries = await readdir(direct);
+  for (const entry of ['package.json', 'package.host.json', 'host-runner.mjs']) {
+    if (directEntries.includes(entry)) throw new Error(`Creator installed obsolete host file: ${entry}`);
+  }
 
-  const conflicting = join(fixture, 'conflicting');
-  await mkdir(conflicting);
-  await writeFile(join(conflicting, 'package.json'), JSON.stringify({ scripts: { host: 'node something-else.mjs' } }));
-  const conflict = spawnSync(process.execPath, [resolve('bin/create-nestbox.js'), conflicting, '--layout', 'nestbox', '--yes', '--no-git'], { encoding: 'utf8', env: { ...process.env, NESTBOX_CREATOR_STATE_ROOT: join(fixture, 'state') } });
-  if (conflict.status === 0 || !conflict.stderr.includes('Refusing to overwrite')) throw new Error('Creator accepted a conflicting host script.');
+  const empty = join(fixture, 'empty');
+  create(empty, 'nestbox');
+  if ((await readdir(empty)).includes('package.json')) throw new Error('Creator created a workspace manifest.');
 
   console.log('Creator tests passed.');
 } finally {

package/tests/nestbox.ps1

@@ -91,11 +91,6 @@ function Invoke-Http([string]$Path, [string]$HostHeader = '', [string]$Method =
 
 try {
     New-Item -ItemType Directory -Path $TempDirectory | Out-Null
-    $configuredTokenFile = [regex]::Match([IO.File]::ReadAllText((Join-Path $Root '.env')), '(?m)^NESTBOX_HOST_TOKEN_FILE=(.+)$').Groups[1].Value.Trim()
-    if (-not $env:NESTBOX_HOST_TOKEN_FILE -and -not $configuredTokenFile) {
-        $env:NESTBOX_HOST_TOKEN_FILE = Join-Path $TempDirectory 'host-token'
-        [IO.File]::WriteAllText($env:NESTBOX_HOST_TOKEN_FILE, 'test-token-' + ('0' * 54))
-    }
 
     if (Get-Command docker -ErrorAction SilentlyContinue) { Pass 'docker is available' } else { Fail 'docker is required'; throw 'Missing Docker' }
     if (Get-Command curl.exe -ErrorAction SilentlyContinue) { Pass 'curl.exe is available' } else { Fail 'curl.exe is required'; throw 'Missing curl.exe' }
@@ -124,9 +119,9 @@ try {
     if ($openCodeInstance.Contains('Commit policy:')) { Pass 'OpenCode instance policy records commit behavior' } else { Fail 'OpenCode instance policy omits commit behavior' }
     if ($openCodeInstance.Contains('Communication language:')) { Pass 'OpenCode instance policy records communication language' } else { Fail 'OpenCode instance policy omits communication language' }
     $openCodeConfig = [IO.File]::ReadAllText((Join-Path $Root 'home\configs\opencode\opencode.json'))
-    if ($openCodeConfig.Contains('"instance.md"')) { Pass 'OpenCode loads instance policy directly' } else { Fail 'OpenCode does not load instance policy' }
+    if ($openCodeConfig.Contains('"/etc/opencode/instance.md"')) { Pass 'OpenCode loads instance policy directly' } else { Fail 'OpenCode does not load instance policy' }
     if ($openCodeConfig.Contains('"control"')) { Pass 'OpenCode registers the control MCP' } else { Fail 'OpenCode does not register the control MCP' }
-    if ((Test-Path -LiteralPath (Join-Path $Root 'docker\control\server.py')) -and (Test-Path -LiteralPath (Join-Path $Root 'host-runner.mjs'))) { Pass 'Control and host runner sources exist' } else { Fail 'Control or host runner source is missing' }
+    if ((Test-Path -LiteralPath (Join-Path $Root 'docker\control\server.py')) -and (Test-Path -LiteralPath (Join-Path $Root 'home\configs\opencode\control-mcp.js'))) { Pass 'Container control sources exist' } else { Fail 'Container control source is missing' }
 
     $result = Invoke-Compose @('config', '--quiet') -Quiet
     if ($result.Code -eq 0) { Pass 'Compose configuration is valid' } else { Fail 'Compose configuration is invalid' }
@@ -142,7 +137,7 @@ try {
     }
 
     if ($Start) {
-        $result = Invoke-Compose @('build', 'nginx', 'php-fpm', 'rollup', 'control', 'opencode')
+        $result = Invoke-Compose @('build', '--pull', '--no-cache', 'nginx', 'php-fpm', 'rollup', 'control', 'opencode')
         if ($result.Code -eq 0) { Pass 'All service images build' } else { Fail 'One or more service images failed to build' }
 
         # Do not start the bind-mounted Rollup watcher: it intentionally writes
@@ -254,14 +249,14 @@ try {
     if ($null -eq $controlInspect.NetworkSettings.Ports.'4088/tcp') { Pass 'Control API is not published on the host' } else { Fail 'Control API is published on the host' }
     $runnerBinding = $controlInspect.NetworkSettings.Ports.'4089/tcp'
     if ($null -eq $runnerBinding) { Pass 'Host runner API is not published separately' } else { Fail 'Host runner API is published separately' }
+    if ($null -eq $controlInspect.Config.ExposedPorts.'4089/tcp') { Pass 'Host runner API is not exposed by the control image' } else { Fail 'Host runner API is exposed by the control image' }
     $response = Invoke-Http '/_nestbox/host/health'
-    if ($response.Status -eq 401) { Pass 'Nginx routes the authenticated host runner API' } else { Fail "Host runner gateway returned HTTP $($response.Status) instead of 401" }
+    if ($response.Status -eq 404) { Pass 'Public host runner path is unavailable' } else { Fail "Host runner gateway returned HTTP $($response.Status) instead of 404" }
     $openCodeId = Get-ContainerId 'opencode'
     $openCodeInspect = @(& docker inspect $openCodeId 2>$null | ConvertFrom-Json)[0]
     if (@($openCodeInspect.Mounts.Destination) -notcontains '/var/run/docker.sock') { Pass 'OpenCode does not receive the Docker socket' } else { Fail 'OpenCode receives the Docker socket' }
-    if (@($openCodeInspect.Mounts.Destination) -notcontains '/run/secrets/nestbox-host-token' -and @($openCodeInspect.Config.Env) -notmatch '^NESTBOX_HOST_TOKEN=') { Pass 'OpenCode cannot read the host runner token' } else { Fail 'OpenCode can read the host runner token' }
     if (@($controlInspect.Mounts.Destination) -contains '/var/run/docker.sock') { Pass 'Control receives the Docker socket' } else { Fail 'Control does not receive the Docker socket' }
-    if (@($controlInspect.Mounts.Destination) -contains '/run/secrets/nestbox-host-token') { Pass 'Control receives the host runner token file' } else { Fail 'Control does not receive the host runner token file' }
+    if (@($controlInspect.Mounts.Destination) -notcontains '/run/secrets/nestbox-host-token' -and @($controlInspect.Config.Env) -notmatch '^NESTBOX_HOST_TOKEN') { Pass 'Control has no host token mount or environment' } else { Fail 'Control still has host token configuration' }
 
     if ($indexPresent) {
         $result = Invoke-Compose @('exec', '-T', 'php-fpm', 'php', '-l', '/home/code/index.php') -Quiet

package/tests/nestbox.sh

@@ -141,8 +141,6 @@ else
 fi
 
 TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/nestbox-test.XXXXXX")"
-configured_token_file="$(sed -n 's/^NESTBOX_HOST_TOKEN_FILE=//p' "$ROOT/.env" | tail -n 1)"
-if [[ -z "${NESTBOX_HOST_TOKEN_FILE:-}" && -z "$configured_token_file" ]]; then export NESTBOX_HOST_TOKEN_FILE="$TEMP_DIR/host-token"; printf 'test-token-%054d\n' 0 >"$NESTBOX_HOST_TOKEN_FILE"; fi
 
 [[ -f "$ROOT/.env" ]] && pass '.env exists' || fail '.env is missing'
 [[ ! -d "$ROOT/home/.git" ]] && pass 'Page and configuration tree has no embedded Git repository' || fail 'home/.git must not be included in an installation'
@@ -161,9 +159,9 @@ grep -Fq 'deliberately has no Docker socket' "$ROOT/home/configs/opencode/instru
 [[ -f "$ROOT/home/configs/opencode/instance.md" ]] && pass 'Installed OpenCode instance policy exists' || fail 'Copy instance.example.md to instance.md before startup'
 grep -Fq 'Commit policy:' "$ROOT/home/configs/opencode/instance.md" && pass 'OpenCode instance policy records commit behavior' || fail 'OpenCode instance policy omits commit behavior'
 grep -Fq 'Communication language:' "$ROOT/home/configs/opencode/instance.md" && pass 'OpenCode instance policy records communication language' || fail 'OpenCode instance policy omits communication language'
-grep -Fq '"instance.md"' "$ROOT/home/configs/opencode/opencode.json" && pass 'OpenCode loads instance policy directly' || fail 'OpenCode does not load instance policy'
+grep -Fq '"/etc/opencode/instance.md"' "$ROOT/home/configs/opencode/opencode.json" && pass 'OpenCode loads instance policy directly' || fail 'OpenCode does not load instance policy'
 grep -Fq '"control"' "$ROOT/home/configs/opencode/opencode.json" && pass 'OpenCode registers the control MCP' || fail 'OpenCode does not register the control MCP'
-[[ -f "$ROOT/docker/control/server.py" && -f "$ROOT/host-runner.mjs" ]] && pass 'Control and host runner sources exist' || fail 'Control or host runner source is missing'
+[[ -f "$ROOT/docker/control/server.py" && -f "$ROOT/home/configs/opencode/control-mcp.js" ]] && pass 'Container control sources exist' || fail 'Container control source is missing'
 
 if compose config --quiet; then
     pass 'Compose configuration is valid'
@@ -188,7 +186,7 @@ while IFS= read -r service; do
 done <<<"$running_services"
 
 if ((START)); then
-    if compose build nginx php-fpm rollup control opencode; then
+    if compose build --pull --no-cache nginx php-fpm rollup control opencode; then
         pass 'All service images build'
     else
         fail 'One or more service images failed to build'
@@ -349,16 +347,17 @@ control_binding="$(docker inspect --format '{{json (index .NetworkSettings.Ports
 [[ -z "$control_binding" || "$control_binding" == "null" ]] && pass 'Control API is not published on the host' || fail 'Control API is published on the host'
 runner_binding="$(docker inspect --format '{{json (index .NetworkSettings.Ports "4089/tcp")}}' "$control_id" 2>/dev/null || true)"
 [[ -z "$runner_binding" || "$runner_binding" == "null" ]] && pass 'Host runner API is not published separately' || fail 'Host runner API is published separately'
+runner_exposed="$(docker inspect --format '{{json (index .Config.ExposedPorts "4089/tcp")}}' "$control_id" 2>/dev/null || true)"
+[[ -z "$runner_exposed" || "$runner_exposed" == "null" ]] && pass 'Host runner API is not exposed by the control image' || fail 'Host runner API is exposed by the control image'
 status="$(http_request '/_nestbox/host/health' 2>/dev/null || printf '000')"
-[[ "$status" == "401" ]] && pass 'Nginx routes the authenticated host runner API' || fail "Host runner gateway returned HTTP $status instead of 401"
+[[ "$status" == "404" ]] && pass 'Public host runner path is unavailable' || fail "Host runner gateway returned HTTP $status instead of 404"
 opencode_id="$(container_id opencode)"
 opencode_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$opencode_id" 2>/dev/null || true)"
 grep -Fq '/var/run/docker.sock' <<<"$opencode_mounts" && fail 'OpenCode receives the Docker socket' || pass 'OpenCode does not receive the Docker socket'
-opencode_env="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$opencode_id" 2>/dev/null || true)"
-if ! grep -Fq '/run/secrets/nestbox-host-token' <<<"$opencode_mounts" && ! grep -Eq '^NESTBOX_HOST_TOKEN=' <<<"$opencode_env"; then pass 'OpenCode cannot read the host runner token'; else fail 'OpenCode can read the host runner token'; fi
 control_mounts="$(docker inspect --format '{{range .Mounts}}{{println .Source .Destination}}{{end}}' "$control_id" 2>/dev/null || true)"
 grep -Fq '/var/run/docker.sock' <<<"$control_mounts" && pass 'Control receives the Docker socket' || fail 'Control does not receive the Docker socket'
-grep -Fq '/run/secrets/nestbox-host-token' <<<"$control_mounts" && pass 'Control receives the host runner token file' || fail 'Control does not receive the host runner token file'
+control_env="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' "$control_id" 2>/dev/null || true)"
+if ! grep -Fq '/run/secrets/nestbox-host-token' <<<"$control_mounts" && ! grep -Eq '^NESTBOX_HOST_TOKEN' <<<"$control_env"; then pass 'Control has no host token mount or environment'; else fail 'Control still has host token configuration'; fi
 
 if ((INDEX_PRESENT)); then
     if compose exec -T php-fpm php -l /home/code/index.php >/dev/null 2>&1; then