Release creative Runtime tools on the production beta baseline

.github/workflows/creative-tools.yml

@@ -0,0 +1,43 @@
+name: creative-tools
+
+on:
+  pull_request:
+    paths:
+      - deploy/distribution/CreativeRuntime.Dockerfile
+      - services/core/deploy/creative/**
+      - services/core/deploy/e2b/**
+      - .github/workflows/creative-tools.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  tools:
+    runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-24.04' || 'blacksmith-2vcpu-ubuntu-2404' }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Check E2B packaging
+        run: python3 -m unittest discover -s services/core/deploy/e2b -p build_template_test.py
+      - name: Build and verify tools
+        # This base qualifies tools only, not a native Harness or deployment.
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/creative-check"
+          chmod 0777 "$RUNNER_TEMP/creative-check"
+          docker build --platform linux/amd64 \
+            --build-arg RUNTIME_IMAGE=node:22.23.1-bookworm-slim@sha256:8607a9064d4a571140998ae9e52a3b3fcf9cff361d04642d5971e6cd76d39e27 \
+            -f deploy/distribution/CreativeRuntime.Dockerfile -t creative-tools:check . \
+            2>&1 | tee "$RUNNER_TEMP/creative-check/build.log"
+          docker run --rm --entrypoint oac-creative-check \
+            -v "$RUNNER_TEMP/creative-check:/outputs" creative-tools:check /outputs \
+            2>&1 | tee "$RUNNER_TEMP/creative-check/check.log"
+      - uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: creative-tools-smoke
+          path: ${{ runner.temp }}/creative-check
+          if-no-files-found: error

.github/workflows/e2b-template.yml

@@ -14,6 +14,13 @@ on:
         type: string
         required: false
 
+      tool_profile:
+        description: Tools included in the Runtime template
+        type: choice
+        options: [creative, base]
+        default: creative
+        required: true
+
       resume_build:
         description: Existing unsubmitted templateID:build_UUID after an upload failure; requires ref
         type: string
@@ -119,6 +126,8 @@ jobs:
           "$RUNNER_TEMP/e2b-sdk/bin/pip" install -r source/services/core/deploy/e2b/requirements.txt
       - name: Build the combined Runtime image
         working-directory: source
+        env:
+          TOOL_PROFILE: ${{ inputs.tool_profile }}
         run: |
           set -euo pipefail
           source_root="$GITHUB_WORKSPACE/source"
@@ -151,6 +160,20 @@ jobs:
             --label "org.opencontainers.image.revision=$revision" \
             --tag "oac-e2b-runtime:$revision" "$output_root/combined"
           image="$(docker image inspect --format '{{.Id}}' "oac-e2b-runtime:$revision")"
+          case "$TOOL_PROFILE" in
+            creative)
+              docker tag "$image" "oac-e2b-base-runtime:$revision"
+              test "$(docker image inspect --format '{{.Id}}' "oac-e2b-base-runtime:$revision")" = "$image"
+              docker build --platform linux/amd64 \
+                --build-arg "RUNTIME_IMAGE=oac-e2b-base-runtime:$revision" \
+                --label "org.opencontainers.image.revision=$revision" \
+                -f deploy/distribution/CreativeRuntime.Dockerfile \
+                --tag "oac-e2b-runtime:$revision" .
+              image="$(docker image inspect --format '{{.Id}}' "oac-e2b-runtime:$revision")"
+              ;;
+            base) ;;
+            *) echo '::error::Unknown Runtime tool profile.'; exit 1 ;;
+          esac
           python3 scripts/core-distribution-manifest.py verify-runtime \
             "$image" "$output_root/mcode/oac-daemon" "$source_root"
           printf '%s\n' "$image" > "$output_root/runtime-image.id"

deploy/distribution/CreativeRuntime.Dockerfile

@@ -0,0 +1,10 @@
+# Build from a qualified immutable Runtime image; use the repository root context.
+ARG RUNTIME_IMAGE
+FROM ${RUNTIME_IMAGE}
+USER root
+COPY services/core/deploy/creative /opt/oac-creative
+RUN sh /opt/oac-creative/install.sh
+ENV OAC_RUNTIME_TOOL_ENV_FILE=/opt/oac-creative/tool-env.json \
+    PLAYWRIGHT_BROWSERS_PATH=/opt/oac-creative/browsers
+USER 1000:1000
+RUN node /opt/oac-creative/check.mjs

scripts/ci_plan.py

@@ -49,7 +49,7 @@
 # across shared consumers. Exact dependency and workflow inputs are above.
 GO = (".go", ".mod", ".sum", ".work")
 WEB = (".ts", ".tsx", ".mts", ".js", ".jsx", ".mjs", ".cjs", ".json", ".css", ".scss", ".html", ".svg", ".png", ".jpg", ".jpeg", ".webp", ".ico", ".woff", ".woff2")
-CORE = (*GO, ".sql", ".py", ".json", ".yaml", ".yml", ".sh", ".ps1", ".txt", ".in", ".lock", "Dockerfile")
+CORE = (*GO, ".sql", ".py", ".mjs", ".json", ".yaml", ".yml", ".sh", ".ps1", ".txt", ".in", ".lock", "Dockerfile")
 SCRIPTS = (".py", ".sh", ".mjs", ".go", ".json")
 RULES = (
     (("apps/web/",), WEB, ("web", "web-acceptance")),

scripts/ci_plan_test.py

@@ -193,6 +193,8 @@ def test_only_matching_directory_and_suffix_trigger_product_checks(self):
         self.assertEqual(self.jobs("services/core/code.go"), {"hygiene", "backend", "api", "compose"})
         self.assertEqual(self.jobs("apps/web/src/style.css"), {"hygiene", "web", "web-acceptance"})
         self.assertEqual(self.jobs("services/core/migrations/123.sql"), {"hygiene", "backend", "api", "compose"})
+        self.assertEqual(self.jobs("services/core/deploy/creative/check.mjs"),
+                         {"hygiene", "backend", "api", "compose", "distribution"})
 
     def test_fixture_and_embedded_resources_keep_checks_regardless_of_suffix(self):
         for path in ("services/core/tests/testdata/prompt.md", "services/core/tests/testdata/image.jpg"):

services/core/deploy/creative/README.md

@@ -0,0 +1,22 @@
+# Creative Runtime tools
+
+Use this image for browser-based visual Skills. It adds Python with venv support, curl, ZIP tools, FFmpeg/ffprobe, Noto Latin/CJK/emoji fonts and a lockfile-pinned Playwright Chromium to a qualified Debian Bookworm Runtime. Skill-specific npm/Python packages remain project dependencies; this image does not choose their versions or install every Skill.
+
+Build from the repository root with a qualified Linux amd64 Runtime image pinned by its registry manifest digest:
+
+```sh
+docker build --platform linux/amd64 \
+  --build-arg RUNTIME_IMAGE=registry.example/runtime@sha256:QUALIFIED_MANIFEST_DIGEST \
+  -f deploy/distribution/CreativeRuntime.Dockerfile -t your-creative-runtime .
+docker run --rm --entrypoint oac-creative-check your-creative-runtime
+```
+
+For a local build, use a unique source-revision tag and verify its configuration ID before building. A bare `sha256:` configuration ID is not a registry image reference for Dockerfile `FROM`.
+
+`OAC_RUNTIME_TOOL_ENV_FILE` points to the Runtime-owned tool environment containing browser paths for Playwright, HyperFrames and Puppeteer. The image owns this file; Session preparation reads it using the existing explicit tool-environment contract. If an operator needs additional tool variables, create one combined private file and select it instead. Never put credentials into the image.
+
+Run `oac-creative-check /workspace/outputs/creative-check` inside the prepared execution Environment to produce a screenshot and a one-second H.264 video. The command verifies browser startup, CJK font selection, FFmpeg and ffprobe. These are tool checks; qualify each Skill with its real scripts and inspect the resulting film separately. Browser processes run without Chromium's inner sandbox; the outer Runtime container or E2B VM remains the isolation boundary.
+
+The E2B builder detects `/opt/oac-creative/install.sh` in the qualified image and runs its `--system-only` mode after extracting the Runtime payload. This restores Debian libraries and fonts that the `/opt` archive cannot carry, while reusing the same pinned browser and npm files. Use the existing [E2B build command](../e2b/README.md). The output receipt includes `creative_tools`. Build completion does not activate a deployment: select and qualify the immutable template through the existing Sandbox deployment workflow before directing user Sessions to it.
+
+Browser/npm versions are pinned in `package-lock.json`. Debian packages follow the configured Bookworm security repositories; record the image digest and template build for release provenance.

services/core/deploy/creative/check.mjs

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { mkdir, readFile } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import { resolve } from 'node:path';
+
+const toolEnv = JSON.parse(await readFile('/opt/oac-creative/tool-env.json', 'utf8'));
+Object.assign(process.env, toolEnv);
+const { chromium } = await import('playwright');
+const output = process.argv[2];
+if (output && !output.startsWith('/')) throw new Error('Use an absolute output directory');
+const browser = await chromium.launch({ headless: true, args: ['--no-sandbox'] });
+try {
+  const page = await browser.newPage({ viewport: { width: 640, height: 360 } });
+  await page.setContent('<html lang="zh-CN"><meta charset="utf-8"><style>body{font-family:"Noto Sans CJK SC",sans-serif;background:#172033;color:white}h1{font-size:40px}</style><h1>制作环境 Ready</h1><canvas width="100" height="100"></canvas><script>const c=document.querySelector("canvas");c.getContext("2d").fillRect(5,5,90,90)</script>');
+  await page.evaluate(() => document.fonts.ready);
+  if (output) {
+    await mkdir(output, { recursive: true });
+    await page.screenshot({ path: resolve(output, 'creative-check.png') });
+  }
+} finally { await browser.close(); }
+const run = (command, args) => {
+  const result = spawnSync(command, args, { encoding: 'utf8' });
+  if (result.status !== 0) throw new Error(`${command} check failed:\n${result.stderr?.slice(-8000) ?? result.error?.message ?? 'unknown process failure'}`);
+  return result.stdout;
+};
+run('ffmpeg', ['-version']);
+run('ffprobe', ['-version']);
+if (!run('fc-match', ['-f', '%{family}', ':lang=zh-cn']).includes('Noto')) throw new Error('CJK font unavailable');
+if (output) {
+  run('ffmpeg', ['-nostdin', '-y', '-loop', '1', '-i', resolve(output, 'creative-check.png'), '-t', '1', '-r', '24', '-c:v', 'libx264', '-pix_fmt', 'yuv420p', resolve(output, 'creative-check.mp4')]);
+  const media = JSON.parse(run('ffprobe', ['-v', 'error', '-show_streams', '-of', 'json', resolve(output, 'creative-check.mp4')]));
+  if (!media.streams.some(s => s.codec_name === 'h264' && s.width === 640 && s.height === 360)) throw new Error('Video verification failed');
+}
+console.log(JSON.stringify({ ready: true, browser: chromium.executablePath(), output: output ?? null }));

services/core/deploy/creative/configure.mjs

@@ -0,0 +1,9 @@
+import { chromium } from 'playwright';
+import { writeFileSync } from 'node:fs';
+// Harnesses consume explicit tool variables, not the daemon's ambient environment.
+const browser = chromium.executablePath();
+writeFileSync('/opt/oac-creative/tool-env.json', JSON.stringify({
+  PLAYWRIGHT_BROWSERS_PATH: '/opt/oac-creative/browsers',
+  HYPERFRAMES_BROWSER_PATH: browser,
+  PUPPETEER_EXECUTABLE_PATH: browser,
+}) + '\n');

services/core/deploy/creative/install.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+# Reused after the /opt payload is extracted into the E2B base image.
+apt-get update
+apt-get install -y --no-install-recommends ca-certificates curl unzip zip xz-utils \
+  python3 python3-pip python3-venv git ripgrep ffmpeg fontconfig \
+  fonts-noto-core fonts-noto-cjk fonts-noto-color-emoji fonts-liberation
+cd /opt/oac-creative
+if [ "${1:-}" != "--system-only" ]; then
+  npm ci --omit=dev --ignore-scripts --no-audit --no-fund
+  PLAYWRIGHT_BROWSERS_PATH=/opt/oac-creative/browsers node node_modules/playwright/cli.js install chromium
+fi
+node node_modules/playwright/cli.js install-deps chromium
+rm -rf /var/lib/apt/lists/*
+fc-cache -f
+PLAYWRIGHT_BROWSERS_PATH=/opt/oac-creative/browsers node configure.mjs
+ln -sf /opt/oac-creative/check.mjs /usr/local/bin/oac-creative-check
+chmod -R a+rX /opt/oac-creative
+chmod 0755 /opt/oac-creative/check.mjs
+chown 1000:1000 tool-env.json
+chmod 0600 tool-env.json

services/core/deploy/creative/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "oac-creative-tools",
+  "private": true,
+  "version": "1.0.0",
+  "dependencies": { "playwright": "1.61.1" }
+}

services/core/deploy/e2b/README.md

@@ -27,6 +27,8 @@ The output file records `template` (the immutable `templateID:build_UUID`), the
 
 ## Launch an application-managed Runtime
 
+For browser and video Skills, first build the [Creative Runtime tools image](../creative/README.md). The `e2b-template-build` workflow defaults to `tool_profile: creative` and wraps the combined Runtime from the selected source revision before packaging it. Select `base` explicitly when building a revision without these tools. The builder detects the bundled installer and restores system libraries and fonts in the E2B base after extraction; the pinned browser and npm payload stay under `/opt`. Its output records `creative_tools: true`. The resulting template still needs Runtime and Skill qualification before activation.
+
 1. Create a `self_hosted` Environment through Core and keep its ID and the exact returned `remote_url` (`wss://…/api/v1/agent-daemon/ws`). The VM must reach it. Set `workspace_directory` to `/workspace`, which the template binds to `/environment/workspace`.
 2. Obtain a connect-only executor key for that Environment; [Environment executor credentials](../../../../contracts/agents-api/environment-executor-credentials.md) owns issuance. The key file is `{"key_id":"UUID","executor_token":"SECRET"}`, with an optional `environment_id` restriction. Store it and the E2B API key in private files with mode `0600`.
 3. Generate an application launch UUID once and keep it. Run [`launch.py`](launch.py), a thin SDK example rather than a service:

services/core/deploy/e2b/build-template.py

@@ -61,6 +61,7 @@
                     archive.extractall(destination.parent, filter='tar')
     finally:
         subprocess.run(['docker', 'rm', container], check=True, stdout=subprocess.DEVNULL)
+    creative_tools = (tree / 'opt/oac-creative/install.sh').is_file()
     bundle = context / 'runtime.tar.gz'
     with tarfile.open(bundle, 'w:gz') as archive:
         for entry in tree.iterdir():
@@ -85,11 +86,16 @@
                          '&& chmod 0444 /etc/oac-runtime-env.json '
                          '&& chmod 0555 /opt/oac-e2b /opt/oac-e2b/init.py /opt/oac-e2b/managed_init.py /opt/oac-e2b/helper_contract_generated.py', user='root')
                 .set_user('runtime').set_workdir('/environment/workspace'))
+    # /opt carries the pinned browser and npm payload, but not Debian packages.
+    # Reinstall their system dependencies in E2B using the image's own installer.
+    if creative_tools:
+        template = template.run_cmd('sh /opt/oac-creative/install.sh --system-only', user='root')
     result = Template.build(template, name=args.name, cpu_count=2, memory_mb=2048,
                             on_build_logs=lambda entry: print(entry.message, flush=True),
                             api_key=args.api_key_file.read_text().strip())
     report = {'template': result.template_id + ':' + result.build_id, 'image': image['Id'],
-              'runtime_sha256': hashlib.sha256(bundle.read_bytes()).hexdigest(), 'base': BASE}
+              'runtime_sha256': hashlib.sha256(bundle.read_bytes()).hexdigest(), 'base': BASE,
+              'creative_tools': creative_tools}
     args.output.parent.mkdir(parents=True, exist_ok=True)
     args.output.write_text(json.dumps(report, indent=2) + '\n')
     print(json.dumps(report))

services/core/deploy/e2b/build_template_test.py

@@ -1,6 +1,7 @@
 """Exercise real Runtime tar metadata without Docker or provider calls."""
 import contextlib
 import io
+import itertools
 import json
 import os
 from pathlib import Path
@@ -16,8 +17,8 @@
 
 class BundlePermissionsTest(unittest.TestCase):
     def test_public_parents_and_runtime_modes_under_both_umasks(self):
-        for mask in (0o022, 0o077):
-            with self.subTest(umask=oct(mask)), tempfile.TemporaryDirectory() as temporary:
+        for mask, creative in itertools.product((0o022, 0o077), (False, True)):
+            with self.subTest(umask=oct(mask), creative=creative), tempfile.TemporaryDirectory() as temporary:
                 root = Path(temporary)
                 key = root / 'key'
                 key.write_text('fixture-only')
@@ -27,6 +28,8 @@ def test_public_parents_and_runtime_modes_under_both_umasks(self):
                                 'codex-resources': 0o755, 'codex': 0o700,
                                 'codex/config': 0o600, 'opt': 0o755,
                                 'opt/private': 0o700, 'opt/private/key': 0o600}
+                if creative:
+                    source_modes.update({'opt/oac-creative': 0o755, 'opt/oac-creative/install.sh': 0o755})
                 image = {'Architecture': 'amd64', 'Os': 'linux', 'Id': 'sha256:fixture',
                          'Config': {'Env': ['OAC_RUNTIME_WORKSPACE=/environment/workspace']}}
 
@@ -48,7 +51,7 @@ def run(argv, **kwargs):
                                 continue
                             entry = tarfile.TarInfo(path)
                             entry.mode = mode
-                            if path in ('bin', 'codex-resources', 'codex', 'opt', 'opt/private'):
+                            if path in ('bin', 'codex-resources', 'codex', 'opt', 'opt/private', 'opt/oac-creative'):
                                 entry.type = tarfile.DIRTYPE
                                 archive.addfile(entry)
                             else:
@@ -82,6 +85,8 @@ def build(instance, **kwargs):
                         template.copy.assert_any_call(source, '/opt/oac-e2b/' + source, user='root')
                     self.assertTrue(any('chmod 0555' in call.args[0] and '/opt/oac-e2b/' + projection in call.args[0]
                                         for call in template.run_cmd.call_args_list))
+                    commands = [call.args[0] for call in template.run_cmd.call_args_list]
+                    self.assertEqual('sh /opt/oac-creative/install.sh --system-only' in commands, creative)
                     return SimpleNamespace(template_id='fixture', build_id='build')
 
                 factory = Mock(return_value=template)
@@ -99,6 +104,7 @@ def build(instance, **kwargs):
                     self.assertEqual(stat.S_IMODE(output.stat().st_mode), 0o666 & ~mask)
                     self.assertEqual(stat.S_IMODE(output.parent.stat().st_mode), 0o777 & ~mask)
                     self.assertEqual(key.read_text(), 'fixture-only')
+                    self.assertEqual(json.loads(output.read_text())['creative_tools'], creative)
                     factory.build.assert_called_once()
                 finally:
                     os.umask(original_mask)