@tianshu-ai/tianshu 0.3.12 → 0.3.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tianshu-ai/tianshu",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "description": "An open AI agent platform with a sidecar browser. Built in public.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/tianshu-ai/tianshu",
@@ -31,6 +31,7 @@
     "plugins/**/manifest.json",
     "plugins/**/skills/**",
     "plugins/**/agent-seeds/**",
+    "plugins/**/templates/**",
     "README.md",
     "LICENSE"
   ],

package/plugins/microsandbox/package.json

@@ -17,7 +17,7 @@
     },
     "./manifest.json": "./manifest.json"
   },
-  "files": ["dist", "src", "skills", "manifest.json"],
+  "files": ["dist", "src", "skills", "templates", "manifest.json"],
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch --preserveWatchOutput",

package/plugins/microsandbox/templates/browser.yaml

@@ -0,0 +1,105 @@
+# Browser-enabled Sandboxfile (CloakBrowser + Playwright MCP + noVNC).
+#
+# Verified end-to-end on Apple Silicon arm64: build → publish →
+# reset → all 6 supervisord processes RUNNING → CDP / MCP / noVNC
+# all reachable. Build cost: ~3-5 min on cache hit, ~10 min cold
+# (apt + Node + LibreOffice + 200 MB CloakBrowser tarball).
+#
+# After build & use, supervisord must be started inside the live
+# VM. N+5.3 will do that automatically; today the user runs:
+#   supervisord -c /etc/supervisor/conf.d/browser.conf
+#
+# Notes on the painful bits this template encodes:
+#  - dbus is intentionally NOT a supervisor program: dbus-x11 in
+#    debian:slim is missing /usr/share/dbus-1/system.conf and
+#    chromium headless doesn't need a system bus anyway.
+#  - chromium pinned to /tmp/chrome-profile so a stale profile
+#    lock from the build VM can't block startup. Snapshots will
+#    not preserve /tmp.
+#  - chromium binds CDP to 0.0.0.0 so port-forward picks it up.
+#  - Playwright MCP listens on 0.0.0.0; default ::1 was IPv6-only
+#    and unreachable from the IPv4-only host port-forward.
+#  - All multi-line config files (supervisord conf) go through
+#    base64 because the v0 Sandboxfile parser is single-line only
+#    and bash single-quoted heredocs don't carry \n correctly.
+
+image: python:3.12-slim
+cpus: 2
+memory_mib: 8192
+
+exec:
+  # APT 国内源（在其他地区可改成上游 deb.debian.org）
+  - sed -i 's/deb.debian.org/mirrors.aliyun.com/g' /etc/apt/sources.list.d/debian.sources
+  - apt-get update -qq
+
+  # 一行装完（无 dbus）
+  # x11-xserver-utils → xrandr (resize Xvfb framebuffer at runtime)
+  # wmctrl            → fit chromium window to the new framebuffer
+  - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends curl ca-certificates xz-utils sudo fontconfig fonts-noto-cjk fonts-noto-color-emoji libreoffice-writer libreoffice-calc libreoffice-impress xvfb x11vnc fluxbox supervisor x11-xserver-utils wmctrl libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libgbm1 libxss1 libasound2 libxshmfence1 libxkbcommon0 libpango-1.0-0 libxcomposite1 libxdamage1 libxrandr2
+
+  # Node 22 LTS — 多源 fallback。nodejs.org 主源，失败后依次走
+  # npmmirror 镜像、cnpmjs 镜像。每个源走到身为止 (--retry 3)，
+  # 并且 --connect-timeout 30 避免 TCP 建连后被 RST 时挂死。
+  - |
+    bash -c '
+      set -eu
+      VER=v22.20.0
+      F=node-${VER}-linux-arm64.tar.xz
+      for u in \
+        https://nodejs.org/dist/${VER}/${F} \
+        https://npmmirror.com/mirrors/node/${VER}/${F} \
+        https://registry.npmmirror.com/-/binary/node/${VER}/${F}; do
+        echo "[node] trying $u"
+        if curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors \
+             --connect-timeout 30 --max-time 600 "$u" \
+           | tar -xJ -C /usr/local --strip-components=1; then
+          echo "[node] installed from $u"
+          exit 0
+        fi
+        echo "[node] failed: $u"
+      done
+      echo "[node] all sources exhausted" >&2
+      exit 1
+    '
+  - npm config set registry https://registry.npmmirror.com
+
+  # CloakBrowser 200MB - ghproxy + retry + 落盘解压
+  # Tarball is FLAT (no top-level dir); entry binary is `chrome`.
+  - bash -c "mkdir -p /opt/cloakbrowser && curl -fsSL --retry 8 --retry-delay 8 --retry-all-errors --connect-timeout 30 -o /tmp/cb.tar.gz https://gh-proxy.com/https://github.com/CloakHQ/CloakBrowser/releases/download/chromium-v145.0.7632.159.7/cloakbrowser-linux-arm64.tar.gz"
+  - bash -c "test $(stat -c %s /tmp/cb.tar.gz) -gt 100000000"
+  - tar -xzf /tmp/cb.tar.gz -C /opt/cloakbrowser
+  - rm -f /tmp/cb.tar.gz
+
+  # noVNC + websockify
+  - bash -c "mkdir -p /opt/novnc && curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors https://gh-proxy.com/https://github.com/novnc/noVNC/archive/refs/tags/v1.5.0.tar.gz | tar -xz -C /opt/novnc --strip-components=1"
+  - bash -c "mkdir -p /opt/websockify && curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors https://gh-proxy.com/https://github.com/novnc/websockify/archive/refs/tags/v0.13.0.tar.gz | tar -xz -C /opt/websockify --strip-components=1"
+  - ln -sf /opt/novnc/vnc_lite.html /opt/novnc/index.html
+
+  # Playwright MCP - 提前把 npm 包拉到 npx 缓存，runtime 启动不再下载
+  - npx -y @playwright/mcp@latest --help > /dev/null 2>&1
+
+  # 字体缓存（首次 LibreOffice / chromium CJK 渲染）
+  - fc-cache -fv
+
+  # supervisord 配置（base64 - 多行 conf 通过 v0 sandboxfile parser 的唯一办法）
+  - mkdir -p /etc/supervisor/conf.d
+  - bash -c "echo W3VuaXhfaHR0cF9zZXJ2ZXJdCmZpbGU9L3Zhci9ydW4vc3VwZXJ2aXNvci5zb2NrCmNobW9kPTA3MDAKCltzdXBlcnZpc29yZF0KbG9nZmlsZT0vdmFyL2xvZy9zdXBlcnZpc29yZC5sb2cKcGlkZmlsZT0vdmFyL3J1bi9zdXBlcnZpc29yZC5waWQKCltycGNpbnRlcmZhY2U6c3VwZXJ2aXNvcl0Kc3VwZXJ2aXNvci5ycGNpbnRlcmZhY2VfZmFjdG9yeT1zdXBlcnZpc29yLnJwY2ludGVyZmFjZTptYWtlX21haW5fcnBjaW50ZXJmYWNlCgpbc3VwZXJ2aXNvcmN0bF0Kc2VydmVydXJsPXVuaXg6Ly8vdmFyL3J1bi9zdXBlcnZpc29yLnNvY2sKCltwcm9ncmFtOnh2ZmJdCmNvbW1hbmQ9L3Vzci9iaW4vWHZmYiA6OTkgLXNjcmVlbiAwIDI0MDB4MTgwMHgyNCAtYWMgLW5vbGlzdGVuIHRjcAphdXRvcmVzdGFydD10cnVlCnByaW9yaXR5PTEwCgpbcHJvZ3JhbTpmbHV4Ym94XQpjb21tYW5kPS91c3IvYmluL2ZsdXhib3gKZW52aXJvbm1lbnQ9RElTUExBWT0iOjk5IgphdXRvcmVzdGFydD10cnVlCnByaW9yaXR5PTIwCgpbcHJvZ3JhbTpjaHJvbWl1bV0KY29tbWFuZD0vb3B0L2Nsb2FrYnJvd3Nlci9jaHJvbWUgLS1yZW1vdGUtZGVidWdnaW5nLXBvcnQ9OTIyMiAtLXJlbW90ZS1kZWJ1Z2dpbmctYWRkcmVzcz0wLjAuMC4wIC0tbm8tc2FuZGJveCAtLWRpc2FibGUtZGV2LXNobS11c2FnZSAtLXVzZXItZGF0YS1kaXI9L3RtcC9jaHJvbWUtcHJvZmlsZSAtLXdpbmRvdy1zaXplPTEyODAsODAwCmVudmlyb25tZW50PURJU1BMQVk9Ijo5OSIKYXV0b3Jlc3RhcnQ9dHJ1ZQpwcmlvcml0eT0zMApzdGFydHNlY3M9OAoKW3Byb2dyYW06cGxheXdyaWdodC1tY3BdCmNvbW1hbmQ9L3Vzci9sb2NhbC9iaW4vbnB4IEBwbGF5d3JpZ2h0L21jcEBsYXRlc3QgLS1ob3N0IDAuMC4wLjAgLS1wb3J0IDMyMDAgLS1hbGxvd2VkLWhvc3RzPSogLS1hbGxvdy11bnJlc3RyaWN0ZWQtZmlsZS1hY2Nlc3MgLS1jYXBzPXBkZix2aXNpb24gLS1icm93c2VyIGNocm9taXVtIC0tY2RwLWVuZHBvaW50IGh0dHA6Ly8xMjcuMC4wLjE6OTIyMgphdXRvcmVzdGFydD10cnVlCnByaW9yaXR5PTQwCnN0YXJ0c2Vjcz04CgpbcHJvZ3JhbTp4MTF2bmNdCmNvbW1hbmQ9L3Vzci9iaW4veDExdm5jIC1kaXNwbGF5IDo5OSAtZm9yZXZlciAtc2hhcmVkIC1ub3B3IC1yZmJwb3J0IDU5MDAKYXV0b3Jlc3RhcnQ9dHJ1ZQpwcmlvcml0eT01MAoKW3Byb2dyYW06bm92bmNdCmNvbW1hbmQ9L29wdC93ZWJzb2NraWZ5L3J1biAtLXdlYj0vb3B0L25vdm5jIDYwODAgbG9jYWxob3N0OjU5MDAKYXV0b3Jlc3RhcnQ9dHJ1ZQpwcmlvcml0eT02MAo= | base64 -d > /etc/supervisor/conf.d/browser.conf"
+
+  # Build 阶段启动 supervisord 一次，让 verify 步骤能 curl 到端口
+  - supervisord -c /etc/supervisor/conf.d/browser.conf
+  - sleep 18
+
+  # === Verify ============================================================
+  # 任一 fail 整个 build fail，避免 "build 成功但实际跑不起来"
+  - bash -c "node --version && npm --version && /opt/cloakbrowser/chrome --version | head -1"
+  # supervisor 没有 FATAL/EXITED/STOPPED
+  - bash -c "supervisorctl -c /etc/supervisor/conf.d/browser.conf status; supervisorctl -c /etc/supervisor/conf.d/browser.conf status | grep -E 'FATAL|EXITED|STOPPED' && exit 1 || true"
+  # 6 个 program 都 RUNNING
+  - bash -c "test $(supervisorctl -c /etc/supervisor/conf.d/browser.conf status | grep -c RUNNING) -eq 6"
+  # CDP 9222
+  - bash -c "curl -sS --max-time 8 http://127.0.0.1:9222/json/version | grep -q Browser"
+  # noVNC 6080
+  - bash -c "curl -sS --max-time 8 http://127.0.0.1:6080/vnc_lite.html | grep -qi DOCTYPE"
+  # Playwright MCP 3200（HTTP 403/404/200 都说明服务在 listen）
+  - bash -c "code=$(curl -sS --max-time 8 -o /dev/null -w '%{http_code}' http://127.0.0.1:3200/); echo MCP HTTP code=$code; test \"$code\" != \"000\""
+  - echo OK

package/plugins/microsandbox/templates/task-runner-with-browser.yaml

@@ -0,0 +1,80 @@
+# Task runner + Browser (incremental layer).
+#
+# Designed to be built ON TOP OF the `task-runner` snapshot via the
+# admin UI's "based on" dropdown:
+#
+#   1. Build the task-runner template first → snapshot
+#      `tianshu-<tenant>-build-<id>`
+#   2. Switch the editor to this template
+#   3. Click Build, pick "based on: task-runner build-<id>" in the
+#      dropdown
+#   4. The Sandboxfile's `image:` line below is IGNORED in that
+#      mode — the snapshot already pins it. Only the apt / curl /
+#      supervisord steps below run, layering chromium + Playwright
+#      MCP + noVNC on top of the existing task-runner image.
+#
+# Result: a snapshot that has everything task-runner ships
+# (Node + Python + office libs + libreoffice + CN mirrors)
+# AND the browser stack from `browser.yaml`. Bigger than
+# task-runner (~2.5 GB extra for the chromium/CloakBrowser
+# binaries) but you skip re-running the slow apt + pip + libreoffice
+# layers from scratch.
+#
+# If you boot this WITHOUT picking a "based on" snapshot the build
+# will fail at the very first `apt install` step (the base image
+# below is bare python:3.12-slim — it doesn't have any of
+# task-runner's tools yet). That failure is the intended signal
+# that you skipped step 3.
+
+# Image is a deliberate placeholder. It only matters when this
+# template is built without a "based on" snapshot, and that's
+# explicitly not how this template is meant to be used.
+image: python:3.12-slim
+cpus: 2
+memory_mib: 8192
+
+exec:
+  # APT mirrors (no-op outside CN; harmless inside).
+  - sed -i 's|deb.debian.org|mirrors.aliyun.com|g; s|security.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources
+  - apt-get update -qq
+
+  # The browser stack on top of task-runner. We DON'T re-install
+  # python3 / sudo / git / fonts / libreoffice — those came from
+  # the task-runner snapshot we layered on. xz-utils gets pulled
+  # in for the CloakBrowser tarball; everything else is new.
+  - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends xz-utils xvfb x11vnc fluxbox supervisor x11-xserver-utils wmctrl libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libgbm1 libxss1 libasound2 libxshmfence1 libxkbcommon0 libpango-1.0-0 libxcomposite1 libxdamage1 libxrandr2
+  - rm -rf /var/lib/apt/lists/*
+
+  # CloakBrowser binary + noVNC + websockify.
+  - bash -c "mkdir -p /opt/cloakbrowser && curl -fsSL --retry 8 --retry-delay 8 --retry-all-errors --connect-timeout 30 -o /tmp/cb.tar.gz https://gh-proxy.com/https://github.com/CloakHQ/CloakBrowser/releases/download/chromium-v145.0.7632.159.7/cloakbrowser-linux-arm64.tar.gz"
+  - bash -c "test $(stat -c %s /tmp/cb.tar.gz) -gt 100000000"
+  - tar -xzf /tmp/cb.tar.gz -C /opt/cloakbrowser
+  - rm -f /tmp/cb.tar.gz
+  - bash -c "mkdir -p /opt/novnc && curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors https://gh-proxy.com/https://github.com/novnc/noVNC/archive/refs/tags/v1.5.0.tar.gz | tar -xz -C /opt/novnc --strip-components=1"
+  - bash -c "mkdir -p /opt/websockify && curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors https://gh-proxy.com/https://github.com/novnc/websockify/archive/refs/tags/v0.13.0.tar.gz | tar -xz -C /opt/websockify --strip-components=1"
+  - ln -sf /opt/novnc/vnc_lite.html /opt/novnc/index.html
+
+  # Pre-warm the Playwright MCP npx cache.
+  - npx -y @playwright/mcp@latest --help > /dev/null 2>&1
+
+  # supervisord conf (base64'd same as browser.yaml; the parser is
+  # single-line only, so multi-line conf round-trips through
+  # base64).
+  - mkdir -p /etc/supervisor/conf.d
+  - bash -c "echo W3VuaXhfaHR0cF9zZXJ2ZXJdCmZpbGU9L3Zhci9ydW4vc3VwZXJ2aXNvci5zb2NrCmNobW9kPTA3MDAKCltzdXBlcnZpc29yZF0KbG9nZmlsZT0vdmFyL2xvZy9zdXBlcnZpc29yZC5sb2cKcGlkZmlsZT0vdmFyL3J1bi9zdXBlcnZpc29yZC5waWQKCltycGNpbnRlcmZhY2U6c3VwZXJ2aXNvcl0Kc3VwZXJ2aXNvci5ycGNpbnRlcmZhY2VfZmFjdG9yeT1zdXBlcnZpc29yLnJwY2ludGVyZmFjZTptYWtlX21haW5fcnBjaW50ZXJmYWNlCgpbc3VwZXJ2aXNvcmN0bF0Kc2VydmVydXJsPXVuaXg6Ly8vdmFyL3J1bi9zdXBlcnZpc29yLnNvY2sKCltwcm9ncmFtOnh2ZmJdCmNvbW1hbmQ9L3Vzci9iaW4vWHZmYiA6OTkgLXNjcmVlbiAwIDI0MDB4MTgwMHgyNCAtYWMgLW5vbGlzdGVuIHRjcAphdXRvcmVzdGFydD10cnVlCnByaW9yaXR5PTEwCgpbcHJvZ3JhbTpmbHV4Ym94XQpjb21tYW5kPS91c3IvYmluL2ZsdXhib3gKZW52aXJvbm1lbnQ9RElTUExBWT0iOjk5IgphdXRvcmVzdGFydD10cnVlCnByaW9yaXR5PTIwCgpbcHJvZ3JhbTpjaHJvbWl1bV0KY29tbWFuZD0vb3B0L2Nsb2FrYnJvd3Nlci9jaHJvbWUgLS1yZW1vdGUtZGVidWdnaW5nLXBvcnQ9OTIyMiAtLXJlbW90ZS1kZWJ1Z2dpbmctYWRkcmVzcz0wLjAuMC4wIC0tbm8tc2FuZGJveCAtLWRpc2FibGUtZGV2LXNobS11c2FnZSAtLXVzZXItZGF0YS1kaXI9L3RtcC9jaHJvbWUtcHJvZmlsZSAtLXdpbmRvdy1zaXplPTEyODAsODAwCmVudmlyb25tZW50PURJU1BMQVk9Ijo5OSIKYXV0b3Jlc3RhcnQ9dHJ1ZQpwcmlvcml0eT0zMApzdGFydHNlY3M9OAoKW3Byb2dyYW06cGxheXdyaWdodC1tY3BdCmNvbW1hbmQ9L3Vzci9sb2NhbC9iaW4vbnB4IEBwbGF5d3JpZ2h0L21jcEBsYXRlc3QgLS1ob3N0IDAuMC4wLjAgLS1wb3J0IDMyMDAgLS1hbGxvd2VkLWhvc3RzPSogLS1hbGxvdy11bnJlc3RyaWN0ZWQtZmlsZS1hY2Nlc3MgLS1jYXBzPXBkZix2aXNpb24gLS1icm93c2VyIGNocm9taXVtIC0tY2RwLWVuZHBvaW50IGh0dHA6Ly8xMjcuMC4wLjE6OTIyMgphdXRvcmVzdGFydD10cnVlCnByaW9yaXR5PTQwCnN0YXJ0c2Vjcz04CgpbcHJvZ3JhbTp4MTF2bmNdCmNvbW1hbmQ9L3Vzci9iaW4veDExdm5jIC1kaXNwbGF5IDo5OSAtZm9yZXZlciAtc2hhcmVkIC1ub3B3IC1yZmJwb3J0IDU5MDAKYXV0b3Jlc3RhcnQ9dHJ1ZQpwcmlvcml0eT01MAoKW3Byb2dyYW06bm92bmNdCmNvbW1hbmQ9L29wdC93ZWJzb2NraWZ5L3J1biAtLXdlYj0vb3B0L25vdm5jIDYwODAgbG9jYWxob3N0OjU5MDAKYXV0b3Jlc3RhcnQ9dHJ1ZQpwcmlvcml0eT02MAo= | base64 -d > /etc/supervisor/conf.d/browser.conf"
+
+  # Boot supervisord once during build so verify can hit the ports.
+  - supervisord -c /etc/supervisor/conf.d/browser.conf
+  - sleep 18
+
+  # === Verify ============================================================
+  # Carry-over from task-runner: those tools must still work.
+  - bash -c "node --version && python3 --version && pip3 --version && python3 -c 'import pandas, docx, pptx; print(\"py-libs ok\")'"
+  # New layer: browser stack alive.
+  - bash -c "/opt/cloakbrowser/chrome --version | head -1"
+  - bash -c "supervisorctl -c /etc/supervisor/conf.d/browser.conf status; supervisorctl -c /etc/supervisor/conf.d/browser.conf status | grep -E 'FATAL|EXITED|STOPPED' && exit 1 || true"
+  - bash -c "test $(supervisorctl -c /etc/supervisor/conf.d/browser.conf status | grep -c RUNNING) -eq 6"
+  - bash -c "curl -sS --max-time 8 http://127.0.0.1:9222/json/version | grep -q Browser"
+  - bash -c "curl -sS --max-time 8 http://127.0.0.1:6080/vnc_lite.html | grep -qi DOCTYPE"
+  - bash -c "code=$(curl -sS --max-time 8 -o /dev/null -w '%{http_code}' http://127.0.0.1:3200/); echo MCP HTTP code=$code; test \"$code\" != \"000\""
+  - echo OK

package/plugins/microsandbox/templates/task-runner.yaml

@@ -0,0 +1,80 @@
+# Task runner Sandboxfile.
+#
+# Recommended snapshot for the per-task sandbox pool (PR #141): a
+# Node 22 + Python 3.12 environment with the tools agent tasks
+# typically reach for, but WITHOUT the GUI / browser stack from
+# `browser.yaml`. Faster to boot, smaller RAM footprint, plenty
+# fast for code generation / data analysis / shell scripting
+# tasks that don't need a chromium of their own.
+#
+# Use this as the default Task snapshot in the admin UI; pick
+# `browser.yaml` instead when the workload needs to pilot a
+# chromium (visual scraping, JS-heavy SPAs, screenshots, etc).
+# Anything beyond those two cases — a custom base image, an
+# air-gapped install, etc — means writing your own Sandboxfile
+# and uploading it through the admin UI.
+#
+# Includes vs `browser.yaml`:
+#   shared: sudo, curl, ca-certs, fontconfig + CJK + emoji fonts,
+#           libreoffice (so docx/xlsx/pptx round-trips work),
+#           Node 22 (base image), Python 3.12 + pip + venv
+#   added : git, jq, build-essential, less, vim-tiny, zip/unzip
+#   added : pip pre-installs so common one-shot tasks don't pay
+#           the install latency on every cold start:
+#           - data:    pandas, numpy, matplotlib, openpyxl
+#           - web:     requests, beautifulsoup4, lxml, pyyaml
+#           - office:  python-docx, python-pptx, pypdf, reportlab,
+#                      markitdown (universal-converter)
+#   omitted: chromium, xvfb, x11vnc, fluxbox, supervisor, noVNC,
+#           wmctrl, x11-xserver-utils, all the X11/GUI client libs
+#           (libnss3, libatk*, libcups2, libgbm1, libxss1,
+#           libasound2, libxshmfence1, libxkbcommon0, libpango,
+#           libxcomposite1, libxdamage1, libxrandr2)
+#
+# Total image is ~600 MB compressed vs `browser.yaml`'s ~3.2 GB.
+# Use `browser.yaml` instead when the workload genuinely needs to
+# pilot a browser (visual scraping, JS-heavy SPA rendering, etc).
+
+image: node:22-slim
+cpus: 4
+memory_mib: 4096
+
+exec:
+  # APT mirror (China-mainland speed-up; harmless elsewhere — the
+  # debian.sources file replacement is a no-op when the original
+  # entries are already mirrored at the alibaba endpoint).
+  - sed -i 's|deb.debian.org|mirrors.aliyun.com|g; s|security.debian.org|mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources
+  - apt-get update -qq
+
+  # One apt install. node:22-slim already ships ca-certificates +
+  # xz-utils, so we don't repeat them here. Order roughly: shell
+  # essentials, dev tools, fonts, libreoffice, python.
+  - DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends curl sudo git jq build-essential less vim-tiny zip unzip fontconfig fonts-noto-cjk fonts-noto-color-emoji libreoffice-writer libreoffice-calc libreoffice-impress python3 python3-pip python3-venv
+  - rm -rf /var/lib/apt/lists/*
+
+  # Mirror npm + pip to local CDNs. Same rationale as the apt
+  # mirror — no-op outside CN, big speed-up inside.
+  - npm config set registry https://registry.npmmirror.com
+  - pip3 config --global set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple
+
+  # Pre-install common pip libs so one-shot data tasks don't pay
+  # cold-start install latency. Three groups:
+  #   data:    pandas, numpy, matplotlib, openpyxl  (xlsx via pandas)
+  #   web:     requests, beautifulsoup4, lxml, pyyaml
+  #   office:  python-docx (docx), python-pptx (pptx), pypdf
+  #            (PDF read), reportlab (PDF write), markitdown
+  #            (universal converter — docx/xlsx/pptx/pdf/html/csv
+  #            → markdown)
+  # ~250 MB combined; reasonable for the value vs always installing
+  # on demand.
+  - pip3 install --no-cache-dir --break-system-packages pandas numpy matplotlib requests pyyaml lxml beautifulsoup4 openpyxl python-docx python-pptx pypdf reportlab markitdown
+
+  # Refresh font cache so matplotlib/PIL render CJK on first call.
+  - fc-cache -fv
+
+  # === Verify ============================================================
+  - bash -c "node --version && npm --version && python3 --version && pip3 --version"
+  - bash -c "git --version && jq --version | head -1"
+  - bash -c "python3 -c 'import pandas, numpy, matplotlib, requests, openpyxl, docx, pptx, pypdf, reportlab; import markitdown; print(\"py-libs ok\")'"
+  - bash -c "soffice --version | head -1"
+  - echo OK