portacode 2.2.22.dev0__tar.gz → 2.2.22.dev1__tar.gz

{portacode-2.2.22.dev0 → portacode-2.2.22.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 2.2.22.dev0
+Version: 2.2.22.dev1
 Summary: Device agent for the AI platform that builds, tests, deploys, and operates real software
 Home-page: https://portacode.com/
 Author: Meena Erian

portacode-2.2.22.dev1/docs/template-engineering-roadmap.md

@@ -0,0 +1,414 @@
+# Template engineering architecture roadmap
+
+## Goal
+
+A user should be able to tell Dashboard AI, “create a reusable template for this
+project.” Portacode should then derive a Portafile, provision clean containers,
+execute and observe it, repair failures, repeat trials from controlled snapshots,
+verify the real user journey, and save a versioned template with evidence of how
+reliable it is. The same object should support private reuse, controlled sharing,
+catalog publication, and optional screenshot/video capture for marketing.
+
+This roadmap is ordered by the best ratio of user-visible progress to implementation
+risk. Each step is independently useful and leaves a foundation for the next one.
+
+## What exists today
+
+The product already has most of the execution primitives, but they are not assembled
+into a template-engineering system:
+
+- Published templates are Django CMS pages. `OneClickTemplateExtension` stores an
+  opaque `yaml_config` text field plus a description. Model validation proves only
+  that the value is non-empty, parseable YAML.
+- Source-controlled catalog files under `content/one-click/` can be synchronized with
+  CMS and exported back to Markdown. This is a staff content workflow, not a user
+  template repository.
+- Dashboard AI can search the published catalog and read a template's YAML, but it
+  has no create, update, clone, validate, test, or publish template operation.
+- Dashboard AI can provision a container from a published template or arbitrary
+  customized YAML, start an automation on an existing device, inspect its state,
+  execute bounded terminal commands, delegate constrained Codex work, and operate a
+  browser.
+- Managed Proxmox containers expose list/create/delete/rollback snapshot operations
+  to Dashboard AI. These operations are isolated host requests; there is no durable
+  experiment controller tying snapshots to a candidate template or trial.
+- `AutomationTask` durably records instructions, metadata, the original YAML, current
+  step, status, and a bounded failure. It represents one execution, not a trial in a
+  template version's validation campaign.
+- Portafile parsing accepts aliases and silently drops unrecognized/malformed steps
+  in places. Inputs receive stronger validation, but there is no single strict,
+  versioned Portafile schema or normalized intermediate representation shared by
+  CMS, provisioning, automation, and AI tools.
+- Automation defaults to AI-assisted recovery for Dashboard AI runs, which is useful
+  operationally but can hide whether the submitted template itself is reproducible.
+- `dashboard_browser_run` can assert a real browser journey and capture screenshots
+  or a low-resolution video. Media is returned for the current tool interaction or
+  offered as a device download; it is not attached to a template version with
+  provenance, consent, retention, or publication state.
+
+In short, Portacode has an executor and a capable AI operator. It is missing the
+domain model and scientific harness that turn trial-and-error into a trustworthy,
+reusable artifact.
+
+## Architectural direction: a moderated template-baking session
+
+The primary abstraction should optimize for the Dashboard AI, not for YAML authors.
+From the AI's perspective, baking a template should feel like incrementally building
+a project:
+
+1. start a baking session;
+2. propose the next logical step and its success checks;
+3. receive either actionable admission feedback or the executed result;
+4. on success, continue from the new checkpoint;
+5. on failure, receive detailed evidence with an explicit guarantee that the device
+   has already been rolled back and restarted at the previous successful checkpoint;
+6. finish the session and let Portacode compile the archived steps into a Portafile.
+
+Snapshots, process state, retries, rollback, restart, logs, and archival should be
+backend invariants. The AI must not have to call those tools in the right order or
+retain that state in its context.
+
+Here, deterministic means **contract-reliable, not output-identical**. A useful
+template is a parameterized project generator. Different valid input sets may produce
+different logos, copy, features, integrations, layouts, records, and AI-generated
+customizations. Reliability means that each result honors its inputs, satisfies the
+same declared structural and behavioral invariants, and remains operable. Tests should
+therefore compare observable contracts and input-specific expectations, not complete
+filesystem hashes or pixel-identical pages.
+
+Keep Portafile as the portable output, but introduce a durable baking domain around
+it:
+
+```text
+TemplateBake
+  -> BakeRevision
+       -> BakeStep (proposed operation + semantic verdict + archived definition)
+            -> StepAttempt (snapshot, execution, observations, outcome)
+                 -> AssertionResult / Artifact
+       -> Compiled TemplateVersion
+```
+
+Use a deterministic state machine as the moderator. Dashboard AI decides what useful
+project change to try next; the moderator owns admission, tool policy, snapshot
+discipline, execution, rollback/start, evidence collection, retry count, and final
+compilation. This is substantially safer and easier than exposing all primitives and
+prompting the AI to orchestrate them correctly.
+
+## Prioritized implementation steps
+
+### 1. Add durable baking models and one composite `dashboard_bake_template_step` tool
+
+This is the new smallest high-leverage vertical slice. Add `TemplateBake`,
+`BakeRevision`, `BakeStep`, and `StepAttempt`. A bake is bound to one user, Dashboard
+chat, managed disposable device, clean baseline snapshot, and a versioned input
+contract. That contract supports typed free text, long text, number, boolean, select,
+multiselect, secret, file/image, color, URL, and integration-reference inputs, with
+labels, help text, constraints, defaults, and safe persistence policy. A step contains:
+
+- a stable ID and human goal;
+- a typed operation (`command`, `wait_for`, constrained `codex`, browser check, file
+  operation, or supported infrastructure declaration);
+- deterministic success assertions;
+- its semantic admission verdict and risk scores;
+- the pre-step snapshot name;
+- every attempt and bounded stdout/stderr/automation/browser evidence;
+- final state (`proposed`, `rejected`, `running`, `archived`, `failed_rolled_back`).
+
+Every value used by a step must be classified as a constant, declared template input,
+Portacode runtime value, prior-step output, or secret reference. Derived values should
+be recorded through typed output bindings rather than scraped informally from logs.
+For example, a CRM bake can bind `brand_logo`, `industry`, `sales_pipeline`, and
+`company_description`, while Portacode supplies the exposed URL and generated service
+credentials at runtime.
+
+Expose one composite tool. Internally it must:
+
+1. validate structure and permissions;
+2. run semantic admission;
+3. create a snapshot of the last successful state;
+4. execute through existing device/automation/browser services;
+5. evaluate assertions independently;
+6. archive the successful normalized step; or
+7. on failure, roll back, explicitly start the stopped container, wait for the device
+   to reconnect, verify the previous checkpoint, and only then return to the AI.
+
+The failure result should lead with `ROLLED_BACK_AND_READY`, identify the last
+successful step, and include command, exit code, timeout state, bounded stdout/stderr,
+failed assertions, semantic warnings, and artifact references. If rollback/start or
+reconnection fails, return `RECOVERY_INCOMPLETE` and block further steps; never tell
+the AI it is safe to continue.
+
+**Why first:** it immediately removes orchestration burden from the LLM and proves the
+moderated workflow while reusing current provisioning, automation, snapshot, terminal,
+Codex, and browser implementations.
+
+**Exit criteria:** the AI can build a two-step project using only the baking tool; a
+forced failure returns detailed evidence after verified rollback and restart, and a
+subsequent corrected step proceeds from the last archived checkpoint.
+
+### 2. Add a dedicated semantic template-step admission engine
+
+Factor the metered Responses API pattern used by `_semantic_validate_work_order` into
+a reusable admission client, but give template steps a separate prompt, response
+schema, usage nonce, audit record, and policy. Run deterministic checks first, then
+send the normalized proposed step plus relevant bake context—not secrets or unbounded
+logs—to `gpt-5.6-terra` in the same Dashboard thread budget.
+
+The response must be strict JSON with:
+
+- `decision`: `accept`, `accept_with_risk`, or `reject`;
+- `template_suitability`: 0–100;
+- `nondeterminism`: 0–100;
+- `portability_risk`, `secret_risk`, and `destructive_risk`: 0–100;
+- typed findings with exact field, evidence, explanation, and repair guidance;
+- detected runtime-derived values that must become placeholders/inputs;
+- input-usage findings, including undeclared values, ignored declared inputs, unsafe
+  interpolation, missing validation, and behavior that contradicts an input choice;
+- required assertions and a recommended clean-success trial count from 1–5.
+
+The prompt should detect at least hard-coded hostnames such as
+`*.host.exposify.net`, device IDs, IPs, usernames/home paths, ports that should use
+`[exposed:PORT]`, credentials/tokens, local absolute paths, ephemeral URLs, generated
+resource names, interactive commands, unpinned moving dependencies, time/randomness,
+external mutable services, and Codex/LLM execution. Hard-coding is not uniformly
+wrong: `localhost`, conventional service paths, and an application's intentional
+fixed port may be valid. The engine must explain contextual findings rather than
+reject every literal.
+
+Reject security violations, operations outside bake policy, steps that cannot be
+represented portably, and steps without independently observable completion. Accept
+nondeterministic steps when bounded and verifiable, then use their score to raise the
+trial count. Semantic admission is defense in depth, not the sole security boundary;
+allowlists, argument validation, and authorization remain deterministic.
+
+Do not penalize legitimate parameterization or bounded generation merely because
+outputs differ. Penalize unexplained variability, undeclared environmental dependence,
+and lack of assertions. Semantic review should ask “does this operation reliably
+transform every allowed input into an output satisfying the contract?” rather than
+“will this operation produce identical bytes?”
+
+**Exit criteria:** equivalent steps receive a typed, stored verdict; rejected steps
+never execute or create a success archive; usage is charged and auditable in the same
+thread; malformed model output fails closed.
+
+### 3. Enforce a baking-specific capability profile instead of rebuilding device tools
+
+Add a bake-session capability filter at the Dashboard tool-selection and gateway
+authorization layers. While a bake is active, hide/block direct mutation tools that
+could bypass admission or checkpointing. The AI should normally retain only:
+
+- the composite step tool;
+- bake state/history and finish/abort tools;
+- read-only device/file/image/automation inspection;
+- template/docs search;
+- user input and permission requests.
+
+Direct terminal execution, file writes/deletes, Codex tasks, power control, resize,
+snapshot mutation, automation start/retry, ingress/domain changes, transfers, and
+repository publication should be denied during baking unless invoked internally by
+the moderator under a capability scoped to the current step. Browser reads/assertions
+are safe through the moderator; browser actions that mutate application state should
+be declared in the step so reset behavior is known.
+
+Use two layers because hiding tools is UX, not security. The service layer must reject
+a direct call carrying a bake-bound device/session even if a stale model or client
+still knows the tool name. Do not globally cripple the Dashboard AI: these restrictions
+apply only to the disposable bake target while the bake is active.
+
+**Exit criteria:** attempts to bypass moderation through every mutating device tool
+fail server-side, while ordinary non-baking device work is unchanged.
+
+### 4. Make the checkpoint state machine crash-safe and snapshot-aware
+
+Implement step execution as a durable worker/state machine with idempotency keys and
+explicit phases: `admitting`, `snapshotting`, `executing`, `asserting`, `archiving`,
+`rolling_back`, `starting`, `reconnecting`, and terminal states. Snapshot names should
+derive from bake/step IDs, not model-generated strings.
+
+Account explicitly for Proxmox rollback stopping the container. Recovery is complete
+only after rollback succeeds, start succeeds, the device reconnects, and a checkpoint
+probe passes. Resume correctly after worker, web, host, or device reconnects without
+duplicating execution. Route snapshot/power requests through the existing
+WebSocket-owning process/durable guest-host boundary; background workers must not call
+process-local singleton waiters directly.
+
+Successful steps become immutable archived definitions. Keep the current success
+snapshot as the next baseline and garbage-collect superseded snapshots only after the
+new checkpoint is proven. Failed attempt evidence remains linked even after rollback.
+
+**Exit criteria:** faults injected at every phase converge to one correct state,
+successful commands are not accidentally rerun, and no failure destroys its evidence
+or strands a stopped container unnoticed.
+
+### 5. Turn input contracts and nondeterminism scores into automatic isolated trials
+
+Separate exploratory baking from proof. Generate a compact validation matrix from the
+declared input contract. It should include a representative/default persona, meaningful
+select/boolean branches, boundary-valid text and numbers, alternate logos/files, empty
+optional values, and safe Unicode/spacing cases. Authors may add named personas such
+as `small_retail_crm` and `consulting_team_crm` with input-specific expectations.
+Avoid the full Cartesian product; use pairwise/branch coverage plus explicitly critical
+combinations.
+
+After a step first succeeds, low-risk steps can be archived immediately but still
+participate in final clean-room replay. Risky steps trigger automatic independent
+attempts from their pre-step snapshot. Roll back before every attempt, start/reconnect,
+apply a selected input fixture and fresh secrets, execute, assert, and reset again.
+
+Cap required successful attempts at five. A sensible initial mapping is 1 success for
+scores 0–19, 2 for 20–39, 3 for 40–59, 4 for 60–79, and 5 for 80–100. Also cap total
+attempts (for example seven) so failures cannot loop indefinitely. Mark results as
+`5/5 clean attempts`, not “almost always reliable”; five samples do not justify a
+production reliability percentage. Any unexplained failure prevents a strong
+validated status and is returned to the AI for repair.
+
+Codex steps must be constrained work orders and must have deterministic external
+postconditions. Their generated copy, layout, or implementation may differ across
+attempts, but assertions must prove the selected logo/copy/options were honored and
+the resulting application has the required flows, persistence, security, and health.
+Use semantic or visual quality review only for criteria that genuinely cannot be
+encoded deterministically, and store its rubric and verdict as evidence. Never count
+the same post-success filesystem state multiple times, and never let AI auto-repair
+inside an attempt count as a pass.
+
+**Exit criteria:** the campaign covers declared input branches and representative
+personas; nondeterministic success produces multiple isolated attempt records without
+the Dashboard AI orchestrating retries; and the stored status reports both trial count
+and input/branch coverage rather than implying that one fixture proves the template.
+
+### 6. Compile archived steps and run a final clean-room replay
+
+When the AI finishes, compile only admitted, archived steps into a normalized,
+versioned Portafile. Convert discovered runtime values into declared inputs or
+Portacode placeholders. Compile the typed input contract, conditional behavior,
+bindings, validation rules, and input-specific acceptance checks alongside stable step
+IDs. Preserve the distinction between user-provided files, secrets, runtime-generated
+values, and reusable non-secret defaults.
+
+Provision a fresh container—do not use the incrementally baked one—and execute the
+whole compiled template from zero with interactive repair disabled. Apply the
+nondeterminism policy to the complete template as well as individual risky steps.
+Only this clean-room replay can mark a version validated.
+
+**Exit criteria:** the emitted Portafile reproduces the project on a new container and
+has a digest linked to all admission decisions, step attempts, and final trials.
+
+### 7. Persist private user templates and immutable versions
+
+Add `UserTemplate` and immutable `TemplateVersion` ownership, revision, visibility,
+fork lineage, normalized manifest, digest, lifecycle, and reliability summary. The
+bake compiles into a private draft by default. Secrets remain references to declared
+inputs and are never copied from attempts into YAML, logs, or artifacts.
+
+**Exit criteria:** Dashboard AI can finish a bake, save the resulting private version,
+and deploy that exact digest again; cross-user access fails closed.
+
+### 8. Make reuse and controlled sharing a product workflow
+
+Add clone/fork, export/import, archive, and visibility (`private`, `unlisted`,
+`public`) operations. Deployments should always reference a version digest so later
+author edits cannot change an old deployment. Sharing should exclude saved input
+values, credentials, trial secrets, private logs, private URLs, and unpublished
+artifacts.
+
+Introduce explicit license/attribution metadata and moderation/security scanning for
+public versions. A shared version is immutable; recipients fork to edit it. Add
+revocation/deprecation without breaking the audit history of prior deployments.
+
+**Exit criteria:** two users can safely reuse the same public/unlisted version, one
+cannot modify the other's artifact, and export then import preserves its digest and
+schema version.
+
+### 9. Promote validated versions into the public catalog
+
+Replace the split authority gradually: render public one-click pages from approved
+template versions or create a publication record that projects a version into CMS.
+Keep editorial copy/localization in CMS, while deployment YAML, evidence, versioning,
+and trust state come from the template domain.
+
+Require publication gates: schema pass, campaign policy pass, security/license scan,
+resource bounds, human approval where policy requires it, and a rollback/deprecation
+plan. Show users version, last validated date, tested environments, pass/attempt
+counts, required privileges, inputs, and known limitations.
+
+**Exit criteria:** no public page can serve YAML different from its approved version
+digest, and catalog updates do not require copying opaque YAML between CMS and source
+files by hand.
+
+### 10. Add declarative Playwright journeys and durable marketing assets
+
+Build on the existing bounded browser-operation vocabulary rather than embedding
+arbitrary Playwright programs in YAML. Add authoring-only `journeys` composed of
+semantic operations and assertions, plus named capture points and optional bounded
+video recording. Separate `acceptance` journeys from `marketing` capture requests;
+marketing capture must never determine deployment success.
+
+Persist artifacts in managed object storage with template version, trial, step,
+viewport, locale, timestamp, checksum, MIME type, provenance, consent/publication
+state, and retention policy. Sanitize sessions and scan screenshots/video for secrets,
+personal data, private hostnames, tokens, and debug overlays before publication.
+Generate marketing assets only from a clean successful trial using deterministic seed
+data and an explicitly publishable input profile.
+
+**Exit criteria:** a version can reproducibly generate approved screenshots/video
+from its declared journey, while failed/redacted/private captures remain inaccessible
+to public catalog pages.
+
+### 11. Operate the system as a reliability service
+
+Add campaign queues, per-user/node concurrency and cost limits, disposable-container
+leases, orphan reconciliation, artifact retention jobs, dependency caching policy,
+and dashboards for pass rate, flakiness, duration, AI spend, infra spend, and cleanup
+failures. Periodically revalidate public templates against newer source images and
+dependency versions without silently promoting results to a different template
+version.
+
+Use failure clustering to find common platform/template issues, but keep automated
+recovery inside the owning service and preserve root-cause evidence. Publish status
+only from durable records.
+
+**Exit criteria:** interrupted campaigns converge to a correct terminal state,
+resources are reclaimed, costs are bounded, and maintainers can distinguish platform
+regressions from template regressions.
+
+## Recommended first delivery slice
+
+Implement the narrow vertical path through steps 1–4:
+
+1. create a bake against an already provisioned managed disposable device;
+2. support only `command` and `wait_for` step types initially;
+3. run deterministic validation plus the dedicated semantic admission call;
+4. snapshot, execute, assert, archive on success;
+5. rollback, start, reconnect, and return structured evidence on failure;
+6. expose only create-bake, bake-step, bake-state, and abort/finish tools;
+7. compile the archived steps to YAML without publishing or sharing it.
+
+This slice deliberately postpones automatic provisioning, Codex steps, browser media,
+sharing, and CMS publication. It proves the most valuable user experience first: the
+AI writes ordinary logical steps while Portacode invisibly supplies the safety rails.
+
+## Non-negotiable design rules
+
+- Reliability is derived from independent observations, not an AI's confidence or
+  summary.
+- Determinism means repeatable satisfaction of declared invariants for varied valid
+  inputs; it never means forcing every deployment to contain identical content.
+- Inputs are typed, validated, redacted where necessary, and traced to the steps and
+  assertions they affect. A template is not validated if only one convenient input
+  fixture was tested.
+- Every trial executes an immutable version from a known clean baseline.
+- A retry after rollback is a new trial; a repair is a new template version.
+- AI-assisted recovery during ordinary deployment must not count as template proof.
+- Nondeterminism is declared, bounded, measured, and followed by deterministic
+  postconditions.
+- YAML, logs, media, exports, and shared versions never contain saved secrets.
+- Public/catalog state is an explicit promotion, never a side effect of a successful
+  private run.
+- Long-running orchestration is durable and idempotent and respects the existing
+  WebSocket process-ownership boundary.
+- Dashboard AI never has to manually pair snapshot, rollback, power, and reconnect
+  operations; those are atomic moderator responsibilities from its perspective.
+- Semantic moderation informs risk and suitability, but deterministic capability and
+  authorization checks are always the enforcement boundary.
+- Browser marketing directives are authoring metadata, not commands executed on every
+  end-user deployment.

{portacode-2.2.22.dev0 → portacode-2.2.22.dev1}/portacode/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.2.22.dev0'
-__version_tuple__ = version_tuple = (2, 2, 22, 'dev0')
+__version__ = version = '2.2.22.dev1'
+__version_tuple__ = version_tuple = (2, 2, 22, 'dev1')
 
 __commit_id__ = commit_id = None

portacode-2.2.22.dev1/portacode/browser_prepare.py

@@ -0,0 +1,117 @@
+"""Idempotent browser preparation for managed provisioning guests."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from .browser_runtime import MANAGED_BROWSER_CACHE, find_system_browser
+
+
+PACKAGE_MANAGERS = ("apt", "apk", "dnf", "yum", "zypper", "pacman")
+_SMOKE_SCRIPT = """
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from portacode.browser_runtime import open_browser_page
+
+with TemporaryDirectory(prefix='portacode-browser-check-') as directory:
+    options = {'viewport': {'width': 320, 'height': 240},
+               'record_video_dir': directory,
+               'record_video_size': {'width': 320, 'height': 240}}
+    with open_browser_page(options) as (browser, context, page):
+        page.set_content('<button onclick="this.textContent=\\'Ready\\'">Test</button>')
+        page.get_by_role('button').click()
+        assert page.get_by_role('button').inner_text() == 'Ready'
+        page.wait_for_timeout(300)
+        image = Path(directory) / 'screenshot.png'
+        page.screenshot(path=str(image))
+        video = page.video
+        context.close()
+        if not image.stat().st_size or video is None or not Path(video.path()).stat().st_size:
+            raise RuntimeError('Browser screenshot/video verification failed')
+"""
+
+
+def _probe_browser(environment: dict[str, str]) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [sys.executable, "-c", _SMOKE_SCRIPT], env=environment,
+        text=True, capture_output=True, timeout=120,
+    )
+
+
+def _require_browser(environment: dict[str, str]) -> None:
+    result = _probe_browser(environment)
+    if result.returncode:
+        detail = (result.stderr or result.stdout or "No diagnostic output")[-4000:]
+        raise RuntimeError(f"Browser screenshot/video verification failed:\n{detail}")
+
+
+def _install_alpine_ffmpeg(cache: Path) -> None:
+    import playwright
+
+    package = Path(playwright.__file__).resolve().parent / "driver" / "package"
+    browsers = json.loads((package / "browsers.json").read_text())["browsers"]
+    ffmpeg = next(browser for browser in browsers if browser["name"] == "ffmpeg")
+    executable = shutil.which("ffmpeg")
+    if not executable:
+        raise RuntimeError("Alpine's ffmpeg package did not provide an executable")
+    target = cache / f"ffmpeg-{ffmpeg['revision']}" / "ffmpeg-linux"
+    target.parent.mkdir(parents=True, exist_ok=True)
+    if target.is_symlink() or target.exists():
+        target.unlink()
+    target.symlink_to(executable)
+
+
+def prepare_browser(package_manager: str, *, check_only: bool = False) -> None:
+    """Install only missing guest assets, using this interpreter's Playwright."""
+    if package_manager not in PACKAGE_MANAGERS:
+        raise ValueError(f"Unsupported package manager: {package_manager}")
+    environment = {**os.environ, "PLAYWRIGHT_BROWSERS_PATH": str(MANAGED_BROWSER_CACHE)}
+    if check_only:
+        _require_browser(environment)
+        return
+    MANAGED_BROWSER_CACHE.mkdir(parents=True, exist_ok=True)
+
+    def run(*command: str) -> None:
+        subprocess.run(command, env=environment, check=True)
+
+    run("chmod", "-R", "a+rX", str(MANAGED_BROWSER_CACHE))
+    if _probe_browser(environment).returncode == 0:
+        return
+
+    if package_manager == "apt":
+        run(sys.executable, "-m", "playwright", "install", "--with-deps", "chromium", "ffmpeg")
+    elif package_manager == "apk":
+        run("apk", "add", "--no-cache", "chromium", "nss", "freetype", "harfbuzz",
+            "ca-certificates", "font-freefont", "ffmpeg")
+        _install_alpine_ffmpeg(MANAGED_BROWSER_CACHE)
+    else:
+        if not find_system_browser():
+            if package_manager in {"dnf", "yum"}:
+                release = Path("/etc/os-release").read_text().lower()
+                if "centos" in release:
+                    run(package_manager, "install", "-y", "epel-release")
+                run(package_manager, "install", "-y", "chromium")
+            elif package_manager == "zypper":
+                run("zypper", "--non-interactive", "install", "-y", "chromium")
+            elif package_manager == "pacman":
+                run("pacman", "-S", "--noconfirm", "--needed", "chromium")
+        run(sys.executable, "-m", "playwright", "install", "ffmpeg")
+    run("chmod", "-R", "a+rX", str(MANAGED_BROWSER_CACHE))
+    _require_browser(environment)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--package-manager", required=True, choices=PACKAGE_MANAGERS)
+    parser.add_argument("--check", action="store_true")
+    arguments = parser.parse_args()
+    prepare_browser(arguments.package_manager, check_only=arguments.check)
+
+
+if __name__ == "__main__":
+    main()

{portacode-2.2.22.dev0 → portacode-2.2.22.dev1}/portacode/codex_prepare.py

@@ -179,12 +179,7 @@ def _install_node_if_needed() -> None:
             packages = ["npm"] if node_ready else ["nodejs", "npm"]
             _run([*_sudo_prefix(), "apk", "add", "--no-cache", *packages])
         else:
-            if not shutil.which("curl") and any(name in release for name in ("debian", "ubuntu")):
-                # Exit 100 is common on Proxmox when an optional enterprise
-                # repository is unavailable; the required Ubuntu/Debian
-                # packages can still be installed from the remaining mirrors.
-                _run([*_sudo_prefix(), "apt-get", "update"], ok_returncodes=(0, 100))
-                _run([*_sudo_prefix(), "apt-get", "install", "-y", "ca-certificates", "curl"])
+            _install_linux_node_prerequisites()
             _install_node_with_nvm()
     elif system == "darwin":
         _install_node_with_nvm()
@@ -210,6 +205,26 @@ def _install_node_if_needed() -> None:
         raise CodexPreparationError("Node.js installation completed but npm is not available in this session.")
 
 
+def _install_linux_node_prerequisites() -> None:
+    if shutil.which("bash") and shutil.which("curl"):
+        return
+    packages = ["ca-certificates", "bash", "curl"]
+    commands = {
+        "apt-get": ["apt-get", "install", "-y", *packages],
+        "dnf": ["dnf", "install", "-y", *packages],
+        "yum": ["yum", "install", "-y", *packages],
+        "zypper": ["zypper", "--non-interactive", "install", "-y", *packages],
+        "pacman": ["pacman", "-S", "--noconfirm", "--needed", *packages],
+    }
+    for manager, command in commands.items():
+        if shutil.which(manager):
+            if manager == "apt-get":
+                _run([*_sudo_prefix(), manager, "update"], ok_returncodes=(0, 100))
+            _run([*_sudo_prefix(), *command])
+            return
+    raise CodexPreparationError("Installing Node.js requires bash and curl; no supported package manager was found.")
+
+
 def _install_codex() -> None:
     existing = _codex_path()
     if existing and _codex_works(existing):