sync: update from private repo (2ef0fa6)

Dockerfile

@@ -76,18 +76,21 @@ RUN pip3 install --no-cache-dir --break-system-packages -r /tmp/python-requireme
 WORKDIR /app
 
 # Shared, world-readable Playwright browser cache so the non-root `node` user can
-# launch Chromium (npm ci's playwright postinstall downloads it here).
+# launch Chromium. The browser binary is fetched explicitly below.
 ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
 
 COPY package.json package-lock.json* ./
 # build-essential compiles better-sqlite3's native addon (removed afterward to
-# stay lean). `npm ci` also runs Playwright's postinstall → downloads Chromium
-# into PLAYWRIGHT_BROWSERS_PATH. `playwright install-deps chromium` then adds the
-# Chromium shared-library apt deps. chmod makes the browser readable by `node`.
+# stay lean). `npx playwright install --with-deps chromium` downloads the
+# Chromium binary INTO PLAYWRIGHT_BROWSERS_PATH and installs its shared-library
+# apt deps in one step. NOTE: `npm ci` alone does NOT download the browser —
+# Playwright dropped the npm-install postinstall browser download, so relying on
+# it left /ms-playwright absent and the chmod below failing on a clean build
+# (issue #528). chmod makes the browser readable by the non-root `node` user.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends build-essential \
     && npm ci --omit=dev \
-    && npx playwright install-deps chromium \
+    && npx playwright install --with-deps chromium \
     && chmod -R go+rX /ms-playwright \
     && npm cache clean --force \
     && apt-get purge -y build-essential \
@@ -99,9 +102,24 @@ COPY --from=builder /app/ui/dist ./ui/dist
 COPY --from=builder /app/vendor ./vendor
 COPY pieces ./pieces
 COPY docs ./docs
+# Browser setup wizard shares its pure LLM logic (probe / parse / worker build /
+# isLlmConfigured) with the CLI wizard via this single .mjs. The server imports
+# it at runtime as `../../scripts/setup-lib.mjs` (resolves to /app/scripts from
+# /app/dist/bridge), so it MUST ship in the runtime image — without it the setup
+# endpoints 500 on first `docker compose up` (Codex P2 #7). The .d.mts is
+# build-time only and intentionally omitted.
+COPY scripts/setup-lib.mjs ./scripts/setup-lib.mjs
 
-# Ship a runnable default while still allowing a config bind-mount.
-COPY config.yaml.example ./config.yaml
+# Ship config.yaml.example as a REFERENCE, plus a MINIMAL unconfigured
+# config.yaml. A fresh `docker compose up` (no ./config.yaml bind-mount, no
+# OLLAMA_* env) must detect "no LLM configured" and show the browser setup
+# wizard — baking the fully-worked example (which has an enabled localhost
+# worker) would mark the install "configured", suppress the wizard, and leave
+# the user pointed at a localhost Ollama that isn't running. Mounting
+# ./config.yaml or setting OLLAMA_BASE_URL/OLLAMA_MODEL overrides this default
+# and skips the wizard.
+COPY config.yaml.example ./config.yaml.example
+RUN printf 'config_version: 2\n' > ./config.yaml
 
 # The app runs as the non-root `node` user and writes its state under ./data
 # (db, users, skills, secrets) — relative to WORKDIR /app, i.e. /app/data — plus