@p10i/create-nestbox 0.5.0 → 0.6.0

package/docker/control/server.py

@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-import hashlib
 import http.client
 import json
 import os
@@ -7,22 +6,15 @@ import re
 import socket
 import sys
 import threading
-import time
 import uuid
 from datetime import datetime, timezone
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from urllib.parse import parse_qs, quote, unquote, urlparse
+from urllib.parse import quote, unquote, urlparse
 
 DOCKER_SOCKET = os.environ.get("DOCKER_SOCKET", "/var/run/docker.sock")
-WORKSPACE_PATH = os.environ.get("WORKSPACE_PATH", "/workspace")
 PROJECT_NAME = os.environ.get("COMPOSE_PROJECT_NAME", "").strip()
 SERVICE_NAME = os.environ.get("NESTBOX_CONTROL_SERVICE", "control")
-HOST_TIMEOUT = int(os.environ.get("NESTBOX_HOST_RUNNER_TIMEOUT", "3600"))
-HOST_HEARTBEAT_TTL = int(os.environ.get("NESTBOX_HOST_RUNNER_HEARTBEAT_TTL", "10"))
-HOST_LONG_POLL_TIMEOUT = int(os.environ.get("NESTBOX_HOST_LONG_POLL_TIMEOUT", "25"))
-MAX_HOST_JOBS = int(os.environ.get("NESTBOX_MAX_HOST_JOBS", "100"))
 MAX_BODY_BYTES = 128 * 1024
-MAX_HOST_BODY_BYTES = 64 * 1024 * 1024
 MAX_COMMAND_PARTS = 256
 MAX_COMMAND_BYTES = 64 * 1024
 LOG_OUTPUT = os.environ.get("NESTBOX_CONTROL_LOG_OUTPUT", "text").lower()
@@ -177,243 +169,6 @@ def policy_error(source, target, user, configured_user=""):
     return ""
 
 
-def allows_npm(source):
-    labels = (source or {}).get("Labels") or {}
-    return bool(source) and truthy(labels, "nestbox.npm.allow") and not truthy(labels, "nestbox.exec.deny-source")
-
-
-def package_scripts():
-    path = os.path.join(WORKSPACE_PATH, "package.json")
-    if not os.path.isfile(path):
-        return None
-    with open(path, encoding="utf-8") as stream:
-        document = json.load(stream)
-    scripts = document.get("scripts", {})
-    if not isinstance(scripts, dict):
-        raise ValueError("package.json scripts must be an object")
-    return {str(name): str(command) for name, command in scripts.items()}
-
-
-class HostBroker:
-    def __init__(self):
-        self.condition = threading.Condition()
-        self.pending = []
-        self.jobs = {}
-        self.runner = {}
-        self.gone = {}
-
-    def _validate_ids(self, runner_id, session_id):
-        if not re.fullmatch(r"[A-Za-z0-9._:-]{8,128}", runner_id):
-            raise ValueError("invalid runner ID")
-        if not re.fullmatch(r"[A-Za-z0-9._:-]{8,128}", session_id):
-            raise ValueError("invalid session ID")
-
-    def connect(self, runner_id, session_id, metadata):
-        self._validate_ids(runner_id, session_id)
-        now = time.monotonic()
-        with self.condition:
-            active_id = self.runner.get("id")
-            active_age = now - self.runner.get("seen", 0)
-            if active_id and active_id != runner_id and active_age <= HOST_HEARTBEAT_TTL:
-                raise PermissionError("another host runner is active")
-            if active_id and active_id != runner_id:
-                for record in self.jobs.values():
-                    if record.get("runnerId") == active_id and record.get("result") is None:
-                        record["result"] = {
-                            "jobId": record["job"]["jobId"],
-                            "exitCode": 1,
-                            "stdout": "",
-                            "stderr": "The assigned host runner disconnected before returning a result.",
-                            "interrupted": True,
-                        }
-            self.runner = {
-                "id": runner_id,
-                "sessionId": session_id,
-                "seen": now,
-                "pid": metadata.get("pid"),
-                "platform": metadata.get("platform"),
-                "hostname": metadata.get("hostname"),
-            }
-            self.condition.notify_all()
-
-    def touch(self, runner_id, session_id):
-        self._validate_ids(runner_id, session_id)
-        with self.condition:
-            if self.runner.get("id") != runner_id or self.runner.get("sessionId") != session_id:
-                raise PermissionError("host runner session was superseded")
-            self.runner["seen"] = time.monotonic()
-            self.condition.notify_all()
-
-    def status(self):
-        with self.condition:
-            if not self.runner:
-                return {"available": False}
-            age = max(0, time.monotonic() - self.runner["seen"])
-            return {
-                "available": age <= HOST_HEARTBEAT_TTL,
-                "ageSeconds": round(age, 3),
-                "pid": self.runner.get("pid"),
-                "platform": self.runner.get("platform"),
-                "hostname": self.runner.get("hostname"),
-            }
-
-    def enqueue(self, job):
-        with self.condition:
-            if len(self.jobs) >= MAX_HOST_JOBS:
-                raise RuntimeError("too many host jobs are pending")
-            self.jobs[job["jobId"]] = {"job": job, "result": None, "runnerId": None}
-            self.pending.append(job["jobId"])
-            self.condition.notify_all()
-
-    def next(self, runner_id, session_id, timeout):
-        deadline = time.monotonic() + timeout
-        with self.condition:
-            while True:
-                if self.runner.get("id") != runner_id or self.runner.get("sessionId") != session_id:
-                    raise PermissionError("host runner session was superseded")
-                self.runner["seen"] = time.monotonic()
-                for record in self.jobs.values():
-                    if record.get("runnerId") == runner_id and record.get("result") is None:
-                        return record["job"]
-                if self.pending:
-                    identifier = self.pending.pop(0)
-                    record = self.jobs.get(identifier)
-                    if record:
-                        record["runnerId"] = runner_id
-                        return record["job"]
-                remaining = deadline - time.monotonic()
-                if remaining <= 0:
-                    return None
-                self.condition.wait(min(1, remaining))
-
-    def complete(self, runner_id, session_id, identifier, result):
-        with self.condition:
-            if self.runner.get("id") != runner_id or self.runner.get("sessionId") != session_id:
-                raise PermissionError("host runner session was superseded")
-            serialized = json.dumps(result, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()
-            fingerprint = hashlib.sha256(serialized).hexdigest()
-            record = self.jobs.get(identifier)
-            terminal = self.gone.get(identifier)
-            if not record and terminal:
-                if terminal.get("fingerprint") == fingerprint:
-                    return True
-                if terminal.get("fingerprint"):
-                    raise RuntimeError("conflicting host result replay")
-                raise FileNotFoundError(terminal["error"])
-            if not record:
-                raise FileNotFoundError("host job is no longer available")
-            if record.get("runnerId") != runner_id:
-                raise ValueError("host job belongs to another runner")
-            if record.get("result") is not None:
-                if record.get("fingerprint") == fingerprint:
-                    return True
-                raise RuntimeError("conflicting host result replay")
-            if result.get("jobId") != identifier:
-                raise ValueError("host result contains a mismatched job ID")
-            job = record["job"]
-            if job["type"] == "npm.run":
-                if not isinstance(result.get("exitCode"), int) or not isinstance(result.get("stdout"), str) or not isinstance(result.get("stderr"), str):
-                    raise ValueError("invalid npm run result")
-            elif job["type"] == "npm.scripts.request":
-                if result.get("status") != "confirmation_required" or result.get("requestId") != job.get("requestId") or result.get("operation") != job.get("operation") or result.get("name") != job.get("name"):
-                    if not isinstance(result.get("exitCode"), int):
-                        raise ValueError("invalid script change request result")
-            elif job["type"] == "npm.scripts.confirm":
-                if result.get("status") == "success" and result.get("requestId") != job.get("requestId"):
-                    raise ValueError("invalid script confirmation result")
-                if result.get("status") != "success" and not isinstance(result.get("exitCode"), int):
-                    raise ValueError("invalid script confirmation result")
-            record["result"] = result
-            record["fingerprint"] = fingerprint
-            self.condition.notify_all()
-            return False
-
-    def _remember(self, identifier, record=None, error="host job is gone"):
-        self.gone[identifier] = {
-            "fingerprint": record.get("fingerprint") if record else None,
-            "error": error,
-            "time": time.monotonic(),
-        }
-        while len(self.gone) > MAX_HOST_JOBS:
-            del self.gone[next(iter(self.gone))]
-
-    def reject(self, runner_id, identifier, error):
-        with self.condition:
-            record = self.jobs.get(identifier)
-            if not record or record.get("runnerId") != runner_id or record.get("result") is not None:
-                return
-            record["result"] = {
-                "jobId": identifier,
-                "exitCode": 1,
-                "stdout": "",
-                "stderr": f"Host result was rejected: {error}",
-                "interrupted": True,
-            }
-            self.condition.notify_all()
-
-    def wait(self, identifier, timeout=HOST_TIMEOUT):
-        deadline = time.monotonic() + timeout
-        with self.condition:
-            while True:
-                record = self.jobs.get(identifier)
-                if record and record.get("result") is None:
-                    age = time.monotonic() - self.runner.get("seen", 0) if self.runner else float("inf")
-                    owner = record.get("runnerId")
-                    lost_owner = bool(owner and self.runner.get("id") != owner)
-                    if lost_owner or age > HOST_HEARTBEAT_TTL:
-                        record["result"] = {
-                            "jobId": identifier,
-                            "exitCode": 1,
-                            "stdout": "",
-                            "stderr": "The assigned host runner disconnected before returning a result." if owner else "The host runner disconnected before accepting the job.",
-                            "interrupted": True,
-                        }
-                if record and record.get("result") is not None:
-                    result = record["result"]
-                    del self.jobs[identifier]
-                    if identifier in self.pending:
-                        self.pending.remove(identifier)
-                    self._remember(identifier, record)
-                    return result
-                remaining = deadline - time.monotonic()
-                if remaining <= 0:
-                    expired = self.jobs.pop(identifier, None)
-                    if identifier in self.pending:
-                        self.pending.remove(identifier)
-                    self._remember(identifier, expired, f"host job expired after {timeout} seconds")
-                    raise TimeoutError(f"host runner did not finish within {timeout} seconds")
-                self.condition.wait(min(1, remaining))
-
-
-HOST_BROKER = HostBroker()
-
-
-def host_status():
-    return HOST_BROKER.status()
-
-
-def enqueue(job):
-    HOST_BROKER.enqueue(job)
-
-
-def wait_result(identifier, timeout=HOST_TIMEOUT):
-    return HOST_BROKER.wait(identifier, timeout)
-
-
-def record_host_result(identifier, source_name, script, result, detached):
-    stdout, stderr = str(result.get("stdout", "")), str(result.get("stderr", ""))
-    log_output(identifier, "npm.stdout", stdout)
-    log_output(identifier, "npm.stderr", stderr)
-    log_event("npm.complete", runId=identifier, source=source_name, script=script, detached=detached, executor="host", exitCode=result.get("exitCode"), hostPlatform=result.get("hostPlatform"), hostName=result.get("hostName"), stdoutTruncated=bool(result.get("stdoutTruncated")), stderrTruncated=bool(result.get("stderrTruncated")))
-
-
-def wait_detached(identifier, source_name, script):
-    try:
-        record_host_result(identifier, source_name, script, wait_result(identifier), True)
-    except Exception as error:
-        log_event("npm.error", runId=identifier, source=source_name, script=script, detached=True, error=str(error))
-
-
 def valid_command(command):
     return (isinstance(command, list) and 0 < len(command) <= MAX_COMMAND_PARTS
             and all(isinstance(part, str) and "\0" not in part for part in command)
@@ -421,7 +176,7 @@ def valid_command(command):
 
 
 class Handler(BaseHTTPRequestHandler):
-    server_version = "nestbox-control/0.5"
+    server_version = "nestbox-control/0.6"
 
     def setup(self):
         super().setup()
@@ -457,21 +212,9 @@ class Handler(BaseHTTPRequestHandler):
         if path == "/health":
             try:
                 docker_request("GET", "/_ping")
-                self.send_json(200, {"ok": True, "dockerSocketAccess": True, "workspacePackageJson": os.path.isfile(os.path.join(WORKSPACE_PATH, "package.json")), "hostRunner": host_status()})
+                self.send_json(200, {"ok": True, "dockerSocketAccess": True})
             except Exception as error:
-                self.send_json(503, {"ok": False, "dockerSocketAccess": False, "error": str(error), "hostRunner": host_status()})
-            return
-        if path == "/npm/scripts":
-            source = self.caller()
-            if not allows_npm(source):
-                self.send_json(403, {"error": "caller is not allowed to use npm"})
-                return
-            try:
-                scripts = package_scripts()
-            except Exception as error:
-                self.send_json(400, {"error": str(error)})
-                return
-            self.send_json(200, {"scripts": scripts}) if scripts is not None else self.send_json(404, {"error": "package.json was not found at /workspace/package.json"})
+                self.send_json(503, {"ok": False, "dockerSocketAccess": False, "error": str(error)})
             return
         self.send_json(404, {"error": "not found"})
 
@@ -484,12 +227,6 @@ class Handler(BaseHTTPRequestHandler):
         path = urlparse(self.path).path
         if path.startswith("/containers/") and path.endswith("/exec"):
             self.container_exec(unquote(path[len("/containers/"):-len("/exec")]).strip("/"), body)
-        elif path == "/npm/run":
-            self.npm_run(body)
-        elif path == "/npm/scripts/request":
-            self.script_request(body)
-        elif path == "/npm/scripts/confirm":
-            self.script_confirm(body)
         else:
             self.send_json(404, {"error": "not found"})
 
@@ -533,185 +270,10 @@ class Handler(BaseHTTPRequestHandler):
             log_event("exec.error", runId=identifier, source=service(source), target=service(target), command=command, error=str(error))
             self.send_json(502, {"error": str(error)})
 
-    def npm_context(self):
-        source = self.caller()
-        if not allows_npm(source):
-            self.send_json(403, {"error": "caller is not allowed to use npm"})
-            return None
-        if not host_status().get("available"):
-            self.send_json(503, {"error": "host runner is unavailable; run `npm run host --` from the workspace"})
-            return None
-        return source
-
-    def npm_run(self, body):
-        source = self.npm_context()
-        if source is None: return
-        script, args = body.get("script"), body.get("args", [])
-        if not isinstance(script, str) or not re.fullmatch(r"[A-Za-z0-9:_@./ -]{1,128}", script) or script == "host":
-            self.send_json(400, {"error": "invalid or protected script name"}); return
-        if not isinstance(args, list) or not all(isinstance(arg, str) and "\0" not in arg for arg in args):
-            self.send_json(400, {"error": "args must be a string array"}); return
-        try:
-            scripts = package_scripts()
-        except Exception as error:
-            self.send_json(400, {"error": str(error)}); return
-        if scripts is None or script not in scripts:
-            self.send_json(404, {"error": "script is not defined in /workspace/package.json"}); return
-        identifier = run_id("npm")
-        job = {"schemaVersion": 1, "jobId": identifier, "type": "npm.run", "script": script, "args": args, "source": service(source), "createdAt": now_iso()}
-        try:
-            enqueue(job)
-            if body.get("detach"):
-                threading.Thread(target=wait_detached, args=(identifier, service(source), script), daemon=True).start()
-                self.send_json(202, {"runId": identifier, "detached": True, "executor": "host"}); return
-            result = wait_result(identifier)
-            record_host_result(identifier, service(source), script, result, False)
-            self.send_json(200, {"runId": identifier, "exitCode": result.get("exitCode"), "stdout": str(result.get("stdout", "")), "stderr": str(result.get("stderr", "")), "pid": result.get("pid"), "executor": "host"})
-        except Exception as error:
-            self.send_json(502, {"error": str(error)})
-
-    def script_request(self, body):
-        source = self.npm_context()
-        if source is None: return
-        operation, name, command = body.get("operation"), body.get("name"), body.get("command")
-        if operation not in {"add", "edit", "delete"} or not isinstance(name, str) or not re.fullmatch(r"[A-Za-z0-9:_@./ -]{1,128}", name) or name == "host":
-            self.send_json(400, {"error": "invalid script change"}); return
-        if operation != "delete" and (not isinstance(command, str) or not command.strip() or len(command) > 8192):
-            self.send_json(400, {"error": "command must be a non-empty string of at most 8192 characters"}); return
-        if operation == "delete" and command is not None:
-            self.send_json(400, {"error": "delete does not accept a command"}); return
-        identifier = run_id("npm-script-request")
-        job = {"schemaVersion": 1, "jobId": identifier, "type": "npm.scripts.request", "requestId": identifier, "operation": operation, "name": name, "source": service(source), "createdAt": now_iso()}
-        if operation != "delete": job["command"] = command
-        try:
-            enqueue(job)
-            result = wait_result(identifier)
-            if result.get("status") != "confirmation_required": raise ValueError(result.get("stderr", "host runner rejected the request"))
-            self.send_json(202, {"status": "confirmation_required", "requestId": result.get("requestId"), "operation": operation, "name": name, "expiresAt": result.get("expiresAt")})
-        except Exception as error:
-            self.send_json(400, {"error": str(error)})
-
-    def script_confirm(self, body):
-        source = self.npm_context()
-        if source is None: return
-        request_id, code = body.get("requestId"), body.get("code")
-        if not isinstance(request_id, str) or not re.fullmatch(r"npm-script-request-[A-Za-z0-9-]{16,80}", request_id) or not isinstance(code, str) or not re.fullmatch(r"[A-Za-z0-9_-]{4,32}", code):
-            self.send_json(400, {"error": "invalid request ID or confirmation code"}); return
-        identifier = run_id("npm-script-confirm")
-        job = {"schemaVersion": 1, "jobId": identifier, "type": "npm.scripts.confirm", "requestId": request_id, "code": code, "source": service(source), "createdAt": now_iso()}
-        try:
-            enqueue(job)
-            result = wait_result(identifier)
-            if result.get("status") != "success": raise ValueError(result.get("stderr", "host runner rejected the confirmation"))
-            self.send_json(200, {"status": "success", "requestId": request_id, "operation": result.get("operation"), "name": result.get("name")})
-        except Exception as error:
-            self.send_json(400, {"error": str(error)})
-
-
-class HostHandler(BaseHTTPRequestHandler):
-    server_version = "nestbox-host-control/0.5"
-
-    def setup(self):
-        super().setup()
-        self.connection.settimeout(HOST_LONG_POLL_TIMEOUT + 10)
-
-    def log_message(self, fmt, *args):
-        log_event("host.http.access", client=self.address_string(), message=fmt % args)
-
-    def send_json(self, status, value):
-        payload = json.dumps(value, ensure_ascii=False).encode()
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json; charset=utf-8")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def runner(self):
-        return self.headers.get("X-Nestbox-Runner-Id", "")
-
-    def session(self):
-        return self.headers.get("X-Nestbox-Session-Id", "")
-
-    def body(self):
-        if self.headers.get("Transfer-Encoding"):
-            raise ValueError("transfer encoding is not supported")
-        length = int(self.headers.get("Content-Length", "0"))
-        if length < 0 or length > MAX_HOST_BODY_BYTES:
-            raise ValueError("request body is too large")
-        value = json.loads(self.rfile.read(length)) if length else {}
-        if not isinstance(value, dict):
-            raise ValueError("request body must be a JSON object")
-        return value
-
-    def active_session(self):
-        try:
-            HOST_BROKER.touch(self.runner(), self.session())
-            return True
-        except PermissionError as error:
-            self.send_json(409, {"error": str(error)})
-        except ValueError as error:
-            self.send_json(400, {"error": str(error)})
-        return False
-
-    def do_GET(self):
-        parsed = urlparse(self.path)
-        if parsed.path == "/host/health":
-            if not self.active_session(): return
-            self.send_json(200, {"ok": True, "hostRunner": host_status()})
-            return
-        if parsed.path == "/host/jobs/next":
-            try:
-                requested = int((parse_qs(parsed.query).get("timeout") or [HOST_LONG_POLL_TIMEOUT])[0])
-                timeout = max(1, min(HOST_LONG_POLL_TIMEOUT, requested))
-                job = HOST_BROKER.next(self.runner(), self.session(), timeout)
-                if job is None:
-                    self.send_response(204); self.end_headers(); return
-                self.send_json(200, job)
-            except PermissionError as error:
-                self.send_json(409, {"error": str(error)})
-            except (TypeError, ValueError) as error:
-                self.send_json(400, {"error": str(error)})
-            return
-        self.send_json(404, {"error": "not found"})
-
-    def do_POST(self):
-        path = urlparse(self.path).path
-        if path == "/host/connect":
-            try:
-                HOST_BROKER.connect(self.runner(), self.session(), self.body())
-                self.send_json(200, {"ok": True})
-            except PermissionError as error:
-                self.send_json(409, {"error": str(error)})
-            except ValueError as error:
-                self.send_json(400, {"error": str(error)})
-            return
-        if not self.active_session(): return
-        if path == "/host/heartbeat":
-            self.send_json(200, {"ok": True})
-            return
-        match = re.fullmatch(r"/host/jobs/([A-Za-z0-9._:-]{1,128})/result", path)
-        if not match:
-            self.send_json(404, {"error": "not found"}); return
-        try:
-            result = self.body()
-            duplicate = HOST_BROKER.complete(self.runner(), self.session(), match.group(1), result)
-            self.send_json(202, {"accepted": True, "duplicate": duplicate})
-        except FileNotFoundError as error:
-            self.send_json(410, {"error": str(error), "jobId": match.group(1)})
-        except PermissionError as error:
-            self.send_json(409, {"error": str(error)})
-        except RuntimeError as error:
-            self.send_json(409, {"error": str(error)})
-        except ValueError as error:
-            HOST_BROKER.reject(self.runner(), match.group(1), str(error))
-            self.send_json(400, {"error": str(error)})
-
 
 def main():
     if not re.fullmatch(r"[a-z0-9][a-z0-9_-]*", PROJECT_NAME):
         raise SystemExit("COMPOSE_PROJECT_NAME must be a non-empty lowercase project slug")
-    host_server = ThreadingHTTPServer(("127.0.0.1", 4089), HostHandler)
-    threading.Thread(target=host_server.serve_forever, daemon=True).start()
     ThreadingHTTPServer(("0.0.0.0", int(os.environ.get("NESTBOX_CONTROL_PORT", "4088"))), Handler).serve_forever()
 
 

package/docker/nginx/Dockerfile

@@ -1,19 +1,19 @@
-# syntax=docker/dockerfile:1.7
-
-# ---- Stage 1: build the JS/CSS bundles with Rollup ----
+# syntax=docker/dockerfile:1.7
+
+# ---- Stage 1: build the JS/CSS bundles with Rollup ----
 FROM node:alpine AS bundles
-
-WORKDIR /sources/rollup
+
+WORKDIR /sources/rollup
 COPY ./home/configs/rollup/package.json ./package.json
 COPY ./home/configs/rollup/package-lock.json ./package-lock.json
 RUN npm ci --no-audit --no-fund
-
-COPY ./home/configs/rollup/rollup.config.js ./rollup.config.js
-COPY ./home/code /home/code
-RUN npx rollup -c
-
+
+COPY ./home/configs/rollup/rollup.config.js ./rollup.config.js
+COPY ./home/code /home/code
+RUN npx rollup -c
+
 # ---- Stage 2: runtime ----
-FROM alpine:3.23
+FROM alpine:latest
 
 RUN apk add --no-cache nginx nginx-mod-http-nchan && \
     mkdir -p /run/nginx /var/lib/nginx/tmp

package/docker/opencode/Dockerfile

@@ -10,8 +10,12 @@ FROM ghcr.io/anomalyco/opencode:latest
 ARG APP_UID=1000
 ARG APP_GID=1000
 
-RUN apk add --no-cache git nodejs php85 php85-dom php85-mbstring php85-openssl php85-phar php85-tokenizer php85-xml php85-xmlwriter su-exec && \
-    ln -s /usr/bin/php85 /usr/local/bin/php && \
+# Alpine names PHP packages by branch. Select its newest available branch
+# instead of retaining an older branch as the rolling base image advances.
+RUN php_package="$(apk search --no-cache --quiet --exact 'php[0-9]*' | grep -E '^php[0-9]+$' | sort -V | tail -n 1)" && \
+    test -n "$php_package" && \
+    apk add --no-cache git nodejs "$php_package" "$php_package-dom" "$php_package-mbstring" "$php_package-openssl" "$php_package-phar" "$php_package-tokenizer" "$php_package-xml" "$php_package-xmlwriter" su-exec && \
+    ln -s "/usr/bin/$php_package" /usr/local/bin/php && \
     addgroup -g "${APP_GID}" -S nestbox && \
     adduser -u "${APP_UID}" -G nestbox -S -h /home/nestbox nestbox
 

package/docker/php-fpm/Dockerfile

@@ -1,43 +1,43 @@
-# syntax=docker/dockerfile:1.7
-
-# ---- Stage 1: install PHP dependencies with Composer ----
+# syntax=docker/dockerfile:1.7
+
+# ---- Stage 1: install PHP dependencies with Composer ----
 FROM composer:latest AS vendor
-
-WORKDIR /build
+
+WORKDIR /build
 COPY ./home/configs/php/composer.json ./composer.json
 COPY ./home/configs/php/composer.lock ./composer.lock
 RUN composer install --no-interaction --prefer-dist --optimize-autoloader --no-dev
-
-# ---- Stage 2: runtime ----
+
+# ---- Stage 2: runtime ----
 FROM php:fpm-alpine
-
-ARG APP_UID=1000
-ARG APP_GID=1000
-
+
+ARG APP_UID=1000
+ARG APP_GID=1000
+
 # Required system + PHP extensions.
 RUN apk add --no-cache --virtual .build-deps $PHPIZE_DEPS libzip-dev && \
     apk add --no-cache libzip && \
     docker-php-ext-install zip && \
     apk del .build-deps
-
-# PHP config.
-COPY ./home/configs/php/php.ini /usr/local/etc/php/conf.d/custom.ini
-
-# Vendor dir from stage 1.
+
+# PHP config.
+COPY ./home/configs/php/php.ini /usr/local/etc/php/conf.d/custom.ini
+
+# Vendor dir from stage 1.
 COPY --from=vendor /build/vendor /vendor
 COPY ./home/configs/php/composer.json /composer.json
 COPY ./home/configs/php/composer.lock /composer.lock
-
+
 # Application source.
 COPY ./home/configs/php /sources/php
 COPY ./home/code /home/code
-
-# Run as a non-root, non-default user. UID/GID are passed as build args so
-# they can match the host user when bind-mounting in development, avoiding
-# the classic "files owned by root after compose down" annoyance on Linux.
+
+# Run as a non-root, non-default user. UID/GID are passed as build args so
+# they can match the host user when bind-mounting in development, avoiding
+# the classic "files owned by root after compose down" annoyance on Linux.
 RUN addgroup -g "${APP_GID}" -S nestbox && \
     adduser  -u "${APP_UID}" -G nestbox -S -H nestbox && \
     sed -i "s/^user = .*/user = nestbox/; s/^group = .*/group = nestbox/" /usr/local/etc/php-fpm.d/www.conf && \
     chown -R nestbox:nestbox /home/code /sources/php /vendor
-
+
 USER nestbox

package/docker-compose.yaml

@@ -59,12 +59,6 @@ services:
         target: /workspace
         bind:
           create_host_path: false
-      - type: bind
-        source: ${WORKSPACE_PATH:-.}/package.json
-        target: /workspace/package.json
-        read_only: true
-        bind:
-          create_host_path: false
     environment:
       # Event publication and OpenCode automation stay inside Compose.
       - NESTBOX_BUS_PUBLISH_URL=http://nginx:8080/_nestbox/publish
@@ -106,7 +100,7 @@ services:
       - nestbox.exec.allow-target=true
     restart: unless-stopped
 
-  # Private, label-gated bridge for container exec and native host npm jobs.
+  # Private, label-gated API for container exec.
   # This is the only Nestbox service with access to the host Docker socket.
   control:
     build:
@@ -116,12 +110,6 @@ services:
       - "4088"
     volumes:
       - ${DOCKER_SOCKET_PATH:-/var/run/docker.sock}:/var/run/docker.sock
-      - type: bind
-        source: ${WORKSPACE_PATH:-.}
-        target: /workspace
-        read_only: true
-        bind:
-          create_host_path: false
     environment:
       - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME}
       - NESTBOX_CONTROL_SERVICE=control
@@ -173,12 +161,6 @@ services:
         target: /workspace
         bind:
           create_host_path: false
-      - type: bind
-        source: ${WORKSPACE_PATH:-.}/package.json
-        target: /workspace/package.json
-        read_only: true
-        bind:
-          create_host_path: false
       # The entrypoint fixes this volume's ownership before dropping privileges.
       - opencode-data:/home/nestbox/.local/share/opencode
     working_dir: /workspace
@@ -188,7 +170,6 @@ services:
     labels:
       - nestbox.exec.allow-source=true
       - nestbox.exec.targets=php-fpm,rollup
-      - nestbox.npm.allow=true
     restart: unless-stopped
 
 volumes: