feat: MCP in containers — cloakbrowser-mcp + chromium libs baked, mcp.json standard config, shared host chromium cache mounted ro; playwright via npx

docker/control.Dockerfile

@@ -8,6 +8,9 @@ RUN apt-get update \
   && apt-get install -y --no-install-recommends \
     bash ca-certificates git ripgrep curl xz-utils make jq golang-go \
     docker.io \
+    libglib2.0-0 libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 \
+    libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 \
+    libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 libcairo2 libasound2 \
   && rm -rf /var/lib/apt/lists/*
 
 RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
@@ -34,6 +37,11 @@ COPY docker/bridge /bridge
 COPY docker/ops-context/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
+# MCP tooling (same as workers; ops also browses).
+RUN npm-real install -g --ignore-scripts cloakbrowser-mcp@1.4.0 \
+	&& mkdir -p /root/.config/mcp
+COPY docker/mcp.json /root/.config/mcp/mcp.json
+
 ENV PI_SESSION_DIR=/pi-sessions
 WORKDIR /ops
 ENTRYPOINT ["/entrypoint.sh"]

docker/mcp.json

@@ -0,0 +1,13 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["@playwright/mcp@latest", "--headless", "--browser", "chromium"]
+    },
+    "cloakbrowser": {
+      "command": "cloakbrowser-mcp",
+      "args": [],
+      "env": { "CLOAKBROWSER_CACHE_DIR": "/cloakbrowser-cache" }
+    }
+  }
+}

docker/worker.Dockerfile

@@ -7,6 +7,9 @@ RUN apt-get update \
   && apt-get install -y --no-install-recommends \
     bash ca-certificates git ripgrep curl xz-utils make jq \
     golang-go \
+    libglib2.0-0 libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 \
+    libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 \
+    libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 libcairo2 libasound2 \
   && rm -rf /var/lib/apt/lists/*
 
 RUN GOBIN=/usr/local/bin go install golang.org/x/tools/gopls@latest || true
@@ -17,6 +20,8 @@ RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
 # scripts (husky etc.) crash headless installs. Route installs through
 # --ignore-scripts so ALL dotfiles packages (pi-subagents, todo tooling,
 # async agents, every extension) survive the bake.
+# MCP servers available to pi agents (matches the host setup).
+# cloakbrowser-mcp ships the browser automation MCP (bundled deps, no postinstall).
 COPY docker/npm-real /usr/local/bin/npm-real
 COPY docker/npm-shim /usr/local/bin/npm-ignore-scripts
 # rm first: /usr/local/bin/npm is a symlink into npm's lib dir, and COPY
@@ -39,6 +44,12 @@ COPY docker/bridge /bridge
 
 # Per-session pi sessions persist here (volume lvmh-sessions); package cache
 # shared across spawns via volume lvmh-pi-cache at /root/.pi/agent/cache.
+# MCP tooling: cloakbrowser-mcp global (bundled deps), npx for playwright,
+# and the standard MCP config the pi-mcp-adapter reads.
+RUN npm-real install -g --ignore-scripts cloakbrowser-mcp@1.4.0 \
+	&& mkdir -p /root/.config/mcp
+COPY docker/mcp.json /root/.config/mcp/mcp.json
+
 ENV PI_SESSION_DIR=/pi-sessions
 WORKDIR /workspace
 CMD ["node", "/bridge/index.mjs"]