Skip to content

Commit 875c425

Browse files
GeekTrainerCopilot
andcommitted
feat: add sandbox-npm-install skill to community collection
Genericize and harden the sandbox-npm-install skill for use in any Docker sandbox environment with virtiofs-mounted workspaces. Changes: - Remove project-specific path detection (app/client, adoption-site/client) - Fix eval injection in verify_one() — use direct argument execution - Add rm-rf path safety guard to prevent accidental damage - Fix --playwright|true case-match bug - Rewrite SKILL.md with keyword-rich description, prerequisites, troubleshooting table, and Vite compatibility section - Move skill from .github/skills/ to skills/ collection Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent cf0820a commit 875c425

File tree

3 files changed

+259
-0
lines changed

3 files changed

+259
-0
lines changed

docs/README.skills.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
209209
| [reviewing-oracle-to-postgres-migration](../skills/reviewing-oracle-to-postgres-migration/SKILL.md) | Identifies Oracle-to-PostgreSQL migration risks by cross-referencing code against known behavioral differences (empty strings, refcursors, type coercion, sorting, timestamps, concurrent transactions, etc.). Use when planning a database migration, reviewing migration artifacts, or validating that integration tests cover Oracle/PostgreSQL differences. | `references/REFERENCE.md`<br />`references/empty-strings-handling.md`<br />`references/no-data-found-exceptions.md`<br />`references/oracle-parentheses-from-clause.md`<br />`references/oracle-to-postgres-sorting.md`<br />`references/oracle-to-postgres-timestamp-timezone.md`<br />`references/oracle-to-postgres-to-char-numeric.md`<br />`references/oracle-to-postgres-type-coercion.md`<br />`references/postgres-concurrent-transactions.md`<br />`references/postgres-refcursor-handling.md` |
210210
| [ruby-mcp-server-generator](../skills/ruby-mcp-server-generator/SKILL.md) | Generate a complete Model Context Protocol server project in Ruby using the official MCP Ruby SDK gem. | None |
211211
| [rust-mcp-server-generator](../skills/rust-mcp-server-generator/SKILL.md) | Generate a complete Rust Model Context Protocol server project with tools, prompts, resources, and tests using the official rmcp SDK | None |
212+
| [sandbox-npm-install](../skills/sandbox-npm-install/SKILL.md) | Install npm packages in a Docker sandbox environment. Use this skill whenever you need to install, reinstall, or update node_modules inside a container where the workspace is mounted via virtiofs. Native binaries (esbuild, lightningcss, rollup) crash on virtiofs, so packages must be installed on the local ext4 filesystem and symlinked back. | `install.sh` |
212213
| [scaffolding-oracle-to-postgres-migration-test-project](../skills/scaffolding-oracle-to-postgres-migration-test-project/SKILL.md) | Scaffolds an xUnit integration test project for validating Oracle-to-PostgreSQL database migration behavior in .NET solutions. Creates the test project, transaction-rollback base class, and seed data manager. Use when setting up test infrastructure before writing migration integration tests, or when a test project is needed for Oracle-to-PostgreSQL validation. | None |
213214
| [scoutqa-test](../skills/scoutqa-test/SKILL.md) | This skill should be used when the user asks to "test this website", "run exploratory testing", "check for accessibility issues", "verify the login flow works", "find bugs on this page", or requests automated QA testing. Triggers on web application testing scenarios including smoke tests, accessibility audits, e-commerce flows, and user flow validation using ScoutQA CLI. IMPORTANT: Use this skill proactively after implementing web application features to verify they work correctly - don't wait for the user to ask for testing. | None |
214215
| [shuffle-json-data](../skills/shuffle-json-data/SKILL.md) | Shuffle repetitive JSON objects safely by validating schema consistency before randomising entries. | None |
Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
name: sandbox-npm-install
3+
description: 'Install npm packages in a Docker sandbox environment. Use this skill whenever you need to install, reinstall, or update node_modules inside a container where the workspace is mounted via virtiofs. Native binaries (esbuild, lightningcss, rollup) crash on virtiofs, so packages must be installed on the local ext4 filesystem and symlinked back.'
4+
---
5+
6+
# Sandbox npm Install
7+
8+
## When to Use This Skill
9+
10+
Use this skill whenever:
11+
- You need to install npm packages for the first time in a new sandbox session
12+
- `package.json` or `package-lock.json` has changed and you need to reinstall
13+
- You encounter native binary crashes with errors like `SIGILL`, `SIGSEGV`, `mmap`, or `unaligned sysNoHugePageOS`
14+
- The `node_modules` directory is missing or corrupted
15+
16+
## Prerequisites
17+
18+
- A Docker sandbox environment with a virtiofs-mounted workspace
19+
- Node.js and npm available in the container
20+
- A `package.json` file in the target workspace
21+
22+
## Background
23+
24+
Docker sandbox workspaces are typically mounted via **virtiofs** (file sync between the host and Linux VM). Native Go and Rust binaries (esbuild, lightningcss, rollup, etc.) crash with mmap alignment failures when executed from virtiofs on aarch64. The fix is to install on the container's local ext4 filesystem and symlink back into the workspace.
25+
26+
## Step-by-Step Installation
27+
28+
Run the bundled install script from the workspace root:
29+
30+
```bash
31+
bash scripts/install.sh
32+
```
33+
34+
### Common Options
35+
36+
| Option | Description |
37+
|---|---|
38+
| `--workspace <path>` | Path to directory containing `package.json` (auto-detected if omitted) |
39+
| `--deps-dir <path>` | Local ext4 directory for installation (default: `/home/agent/project-deps`) |
40+
| `--playwright` | Also install Playwright Chromium browser for E2E testing |
41+
| `--no-verify` | Skip native binary verification after install |
42+
43+
### What the Script Does
44+
45+
1. Copies `package.json` and `package-lock.json` to a local ext4 directory
46+
2. Runs `npm ci` (or `npm install` if no lockfile) on the local filesystem
47+
3. Symlinks `node_modules` back into the workspace
48+
4. Verifies known native binaries (esbuild, rollup, lightningcss, vite) if present
49+
5. Optionally installs Playwright browsers
50+
51+
If verification fails, run the script again — crashes can be intermittent during initial setup.
52+
53+
## Post-Install Verification
54+
55+
After the script completes, verify your toolchain works. For example:
56+
57+
```bash
58+
npm test # Run project tests
59+
npm run build # Build the project
60+
npm run dev # Start dev server
61+
```
62+
63+
## Important Notes
64+
65+
- The local install directory (e.g., `/home/agent/project-deps`) is **container-local** and is NOT synced back to the host
66+
- The `node_modules` symlink appears as a broken link on the host — this is harmless since `node_modules` is typically gitignored
67+
- Running `npm ci` or `npm install` on the host naturally replaces the symlink with a real directory
68+
- After any `package.json` or `package-lock.json` change, re-run the install script
69+
- Do NOT run `npm ci` or `npm install` directly in the mounted workspace — native binaries will crash
70+
71+
## Troubleshooting
72+
73+
| Problem | Solution |
74+
|---|---|
75+
| `SIGILL` or `SIGSEGV` when running dev server | Re-run the install script; ensure you're not running `npm install` directly in the workspace |
76+
| `node_modules` not found after install | Check that the symlink exists: `ls -la node_modules` |
77+
| Permission errors during install | Ensure the local deps directory is writable by the current user |
78+
| Verification fails intermittently | Run the script again — native binary crashes can be non-deterministic on first load |
79+
80+
## Vite Compatibility
81+
82+
If your project uses Vite, you may need to allow the symlinked path in `server.fs.allow`. Add the symlink target's parent directory (e.g., `/home/agent/project-deps/`) to your Vite config so that Vite can serve files through the symlink.
Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# Sandbox npm Install Script
5+
# Installs node_modules on local ext4 filesystem and symlinks into the workspace.
6+
# This avoids native binary crashes (esbuild, lightningcss, rollup) on virtiofs.
7+
8+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
9+
REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
10+
11+
DEPS_DIR="/home/agent/project-deps"
12+
WORKSPACE_CLIENT=""
13+
INSTALL_PLAYWRIGHT="false"
14+
VERIFY_BINARIES="true"
15+
16+
usage() {
17+
cat <<EOF
18+
Usage: $(basename "$0") [options]
19+
20+
Options:
21+
--workspace <path> Client workspace containing package.json
22+
--deps-dir <path> Local ext4 install directory (default: /home/agent/project-deps)
23+
--playwright Install Playwright Chromium browser
24+
--no-verify Skip native binary verification
25+
--help Show this help message
26+
27+
Examples:
28+
bash scripts/install.sh
29+
bash scripts/install.sh --workspace app/client --playwright
30+
EOF
31+
}
32+
33+
while [[ $# -gt 0 ]]; do
34+
case "$1" in
35+
--workspace)
36+
WORKSPACE_CLIENT="${2:-}"
37+
shift 2
38+
;;
39+
--deps-dir)
40+
DEPS_DIR="${2:-}"
41+
shift 2
42+
;;
43+
--playwright)
44+
INSTALL_PLAYWRIGHT="true"
45+
shift
46+
;;
47+
--no-verify)
48+
VERIFY_BINARIES="false"
49+
shift
50+
;;
51+
--help|-h)
52+
usage
53+
exit 0
54+
;;
55+
*)
56+
echo "Unknown option: $1"
57+
usage
58+
exit 1
59+
;;
60+
esac
61+
done
62+
63+
if [[ -z "$WORKSPACE_CLIENT" ]]; then
64+
if [[ -f "$REPO_ROOT/package.json" ]]; then
65+
WORKSPACE_CLIENT="$REPO_ROOT"
66+
elif [[ -f "$PWD/package.json" ]]; then
67+
WORKSPACE_CLIENT="$PWD"
68+
fi
69+
fi
70+
71+
WORKSPACE_CLIENT="$(cd "$WORKSPACE_CLIENT" 2>/dev/null && pwd || true)"
72+
73+
if [[ -z "$WORKSPACE_CLIENT" || ! -f "$WORKSPACE_CLIENT/package.json" ]]; then
74+
echo "Could not find a valid workspace client path containing package.json."
75+
echo "Use --workspace <path> to specify it explicitly."
76+
exit 1
77+
fi
78+
79+
# Validate deps directory path to prevent accidental damage
80+
DEPS_DIR="$(realpath -m "$DEPS_DIR" 2>/dev/null || echo "$DEPS_DIR")"
81+
case "$DEPS_DIR" in
82+
/|/bin|/boot|/dev|/etc|/lib*|/opt|/proc|/root|/run|/sbin|/srv|/sys|/usr|/usr/*|/var)
83+
echo "Error: deps directory '$DEPS_DIR' is a system path. Provide a safe subdirectory."
84+
exit 1
85+
;;
86+
esac
87+
if [[ -z "$DEPS_DIR" || "$DEPS_DIR" == "/home" || "$DEPS_DIR" == "/home/agent" || "$DEPS_DIR" == "/tmp" ]]; then
88+
echo "Error: deps directory '$DEPS_DIR' is too broad. Provide a dedicated subdirectory."
89+
exit 1
90+
fi
91+
92+
echo "=== Sandbox npm Install ==="
93+
echo "Workspace: $WORKSPACE_CLIENT"
94+
echo "Deps dir: $DEPS_DIR"
95+
96+
# Step 1: Prepare local deps directory
97+
echo "→ Preparing $DEPS_DIR..."
98+
rm -rf "$DEPS_DIR"
99+
mkdir -p "$DEPS_DIR"
100+
cp "$WORKSPACE_CLIENT/package.json" "$DEPS_DIR/"
101+
102+
if [[ -f "$WORKSPACE_CLIENT/package-lock.json" ]]; then
103+
cp "$WORKSPACE_CLIENT/package-lock.json" "$DEPS_DIR/"
104+
INSTALL_CMD=(npm ci)
105+
else
106+
echo "! package-lock.json not found; falling back to npm install"
107+
INSTALL_CMD=(npm install)
108+
fi
109+
110+
# Step 2: Install on local ext4
111+
echo "→ Running ${INSTALL_CMD[*]} on local ext4..."
112+
cd "$DEPS_DIR" && "${INSTALL_CMD[@]}"
113+
114+
# Step 3: Symlink into workspace
115+
echo "→ Symlinking node_modules into workspace..."
116+
cd "$WORKSPACE_CLIENT"
117+
rm -rf node_modules
118+
ln -s "$DEPS_DIR/node_modules" node_modules
119+
120+
has_dep() {
121+
local dep="$1"
122+
node -e "
123+
const pkg=require(process.argv[1]);
124+
const deps={...(pkg.dependencies||{}),...(pkg.devDependencies||{})};
125+
process.exit(deps[process.argv[2]] ? 0 : 1);
126+
" "$WORKSPACE_CLIENT/package.json" "$dep"
127+
}
128+
129+
verify_one() {
130+
local label="$1"
131+
shift
132+
if "$@" >/dev/null 2>&1; then
133+
echo "$label OK"
134+
return 0
135+
fi
136+
137+
echo "$label FAIL"
138+
return 1
139+
}
140+
141+
if [[ "$VERIFY_BINARIES" == "true" ]]; then
142+
# Step 4: Verify native binaries when present in this project
143+
echo "→ Verifying native binaries..."
144+
FAIL=0
145+
146+
if has_dep esbuild; then
147+
verify_one "esbuild" node -e "require('esbuild').transform('const x: number = 1',{loader:'ts'}).catch(()=>process.exit(1))" || FAIL=1
148+
fi
149+
150+
if has_dep rollup; then
151+
verify_one "rollup" node -e "import('rollup').catch(()=>process.exit(1))" || FAIL=1
152+
fi
153+
154+
if has_dep lightningcss; then
155+
verify_one "lightningcss" node -e "try{require('lightningcss')}catch(_){process.exit(1)}" || FAIL=1
156+
fi
157+
158+
if has_dep vite; then
159+
verify_one "vite" node -e "import('vite').catch(()=>process.exit(1))" || FAIL=1
160+
fi
161+
162+
if [ "$FAIL" -ne 0 ]; then
163+
echo "✗ Binary verification failed. Try running the script again (crashes can be intermittent)."
164+
exit 1
165+
fi
166+
fi
167+
168+
# Step 5: Optionally install Playwright
169+
if [[ "$INSTALL_PLAYWRIGHT" == "true" ]]; then
170+
echo "→ Installing Playwright browsers..."
171+
npx playwright install --with-deps chromium
172+
fi
173+
174+
echo ""
175+
echo "=== ✓ Sandbox npm install complete ==="
176+
echo "Run 'npm run dev' to start the dev server."

0 commit comments

Comments
 (0)