feat: MCP in containers — cloakbrowser-mcp + chromium libs baked, mcp.json standard config, shared host chromium cache mounted ro; playwright via npx

daemon/docker.go

@@ -49,6 +49,7 @@ const (
 	authMountTarget      string = "/root/.pi/agent/auth.json"
 	envHostPiAgentDir    string = "LVMH_HOST_PI_AGENT_DIR"
 	envSecretsDir        string = "LVMH_SECRETS_DIR"
+	envCloakCacheDir     string = "LVMH_CLOAK_CACHE_DIR"
 	sshMountTarget       string = "/root/.ssh"
 	gitconfigMountTarget string = "/root/.gitconfig"
 	workspaceMount       string = "/workspace"
@@ -555,6 +556,12 @@ func (s *Spawner) createAndStart(ctx context.Context, repo, slug, sessionID stri
 	if hostAgent := os.Getenv(envHostPiAgentDir); hostAgent != "" {
 		binds = append(binds, hostAgent+"/auth.json:"+authMountTarget+":ro")
 	}
+	// Shared cloakbrowser chromium cache (host path, read-only): browsers
+	// are ~700MB; one copy serves every container. CLOAKBROWSER_CACHE_DIR
+	// points the MCP at it (see docker/mcp.json).
+	if cb := os.Getenv(envCloakCacheDir); cb != "" {
+		binds = append(binds, cb+":/cloakbrowser-cache:ro")
+	}
 	// Deploy secrets (ssh key + known_hosts + config, gitconfig), read-only.
 	// Bind sources resolve on the HOST (docker.sock semantics), so this env
 	// must carry the host path of the secrets dir.