feat: playwright browser cache mount + PLAYWRIGHT_BROWSERS_PATH; ops guide: MCP stack inherited from base image

daemon/docker.go

@@ -40,20 +40,21 @@ const (
 	stateRunning  string = "running"
 	stateError    string = "error"
 
-	imageRefWorker       string = "lvmh-worker:latest"
-	labelSession         string = "lvmh.session"
-	volumeRepoPrefix     string = "lvmh-repo-"
-	volumeSessions       string = "lvmh-sessions"
-	volumePiCache        string = "lvmh-pi-cache" // pi package cache (git:/npm:), shared across spawns
-	cacheMount           string = "/root/.pi/agent/cache"
-	authMountTarget      string = "/root/.pi/agent/auth.json"
-	envHostPiAgentDir    string = "LVMH_HOST_PI_AGENT_DIR"
-	envSecretsDir        string = "LVMH_SECRETS_DIR"
-	envCloakCacheDir     string = "LVMH_CLOAK_CACHE_DIR"
-	sshMountTarget       string = "/root/.ssh"
-	gitconfigMountTarget string = "/root/.gitconfig"
-	workspaceMount       string = "/workspace"
-	sessionsMount        string = "/pi-sessions"
+	imageRefWorker        string = "lvmh-worker:latest"
+	labelSession          string = "lvmh.session"
+	volumeRepoPrefix      string = "lvmh-repo-"
+	volumeSessions        string = "lvmh-sessions"
+	volumePiCache         string = "lvmh-pi-cache" // pi package cache (git:/npm:), shared across spawns
+	cacheMount            string = "/root/.pi/agent/cache"
+	authMountTarget       string = "/root/.pi/agent/auth.json"
+	envHostPiAgentDir     string = "LVMH_HOST_PI_AGENT_DIR"
+	envSecretsDir         string = "LVMH_SECRETS_DIR"
+	envCloakCacheDir      string = "LVMH_CLOAK_CACHE_DIR"
+	envPlaywrightCacheDir string = "LVMH_PLAYWRIGHT_CACHE_DIR"
+	sshMountTarget        string = "/root/.ssh"
+	gitconfigMountTarget  string = "/root/.gitconfig"
+	workspaceMount        string = "/workspace"
+	sessionsMount         string = "/pi-sessions"
 
 	envWorkerDockerfile   string = "LVMH_WORKER_DOCKERFILE"
 	defaultDockerfile     string = "/app/build/docker/worker.Dockerfile"
@@ -375,6 +376,7 @@ func workerEnv(s *Spawner, repo, sessionID string) []string {
 		"GEMINI_API_KEY=" + os.Getenv("GEMINI_API_KEY"),
 		"DEEPSEEK_KEY=" + os.Getenv("DEEPSEEK_KEY"),
 		"ANTHROPIC_API_KEY=" + os.Getenv("ANTHROPIC_API_KEY"),
+		"PLAYWRIGHT_BROWSERS_PATH=/pw-browsers",
 		envLVMHRepo + "=" + repo,
 	}
 	// Gitea token (write scope) so agents can push and open PRs.
@@ -556,6 +558,11 @@ func (s *Spawner) createAndStart(ctx context.Context, repo, slug, sessionID stri
 	if hostAgent := os.Getenv(envHostPiAgentDir); hostAgent != "" {
 		binds = append(binds, hostAgent+"/auth.json:"+authMountTarget+":ro")
 	}
+	// Shared playwright browser cache (host path, read-only); the env var
+	// below makes every playwright-based MCP use it instead of downloading.
+	if pw := os.Getenv(envPlaywrightCacheDir); pw != "" {
+		binds = append(binds, pw+":/pw-browsers:ro")
+	}
 	// Shared cloakbrowser chromium cache (host path, read-only): browsers
 	// are ~700MB; one copy serves every container. CLOAKBROWSER_CACHE_DIR
 	// points the MCP at it (see docker/mcp.json).

daemon/spawner_test.go

@@ -72,7 +72,7 @@ func TestSpawnerStartHappyPath(t *testing.T) {
 	passthrough := map[string]bool{
 		"OPENAI_API_KEY": true, "GEMINI_API_KEY": true,
 		"DEEPSEEK_KEY": true, "ANTHROPIC_API_KEY": true,
-		"LVMH_GITEA_TOKEN": true,
+		"LVMH_GITEA_TOKEN": true, "PLAYWRIGHT_BROWSERS_PATH": true,
 	}
 	for _, e := range c.Env {
 		if name, _, ok := strings.Cut(e, "="); ok && passthrough[name] {

docker-compose.yml

@@ -21,6 +21,7 @@ services:
       LVMH_HOST_PI_AGENT_DIR: ${LVMH_PI_AGENT_DIR:-/home/alarm/.dotfiles/pi/agent}
       LVMH_SECRETS_DIR: /zdata/root/lvmh-secrets
       LVMH_CLOAK_CACHE_DIR: /home/alarm/.cloakbrowser
+      LVMH_PLAYWRIGHT_CACHE_DIR: /home/alarm/.cache/ms-playwright
       OPENAI_API_KEY: ${OPENAI_API_KEY:-}
       GEMINI_API_KEY: ${GEMINI_API_KEY:-}
       DEEPSEEK_KEY: ${DEEPSEEK_KEY:-}

docker/ops-context/AGENTS.md

@@ -41,7 +41,12 @@ When asked to prepare a workspace for a repo (e.g. "prepare empstream"):
 
    Include everything an agent working in that repo needs (compilers, DB
    clients, protobuf, etc.). The base already has: node 24, pi, golang, git,
-   ripgrep, make, jq, gopls. Don't reinstall those.
+   ripgrep, make, jq, gopls, **the MCP stack (cloakbrowser-mcp, playwright
+   via npx, chromium runtime libs, `/root/.config/mcp/mcp.json`)** plus
+   shared browser-cache mounts (`/cloakbrowser-cache`, `/pw-browsers`).
+   Don't reinstall any of those — `FROM lvmh-worker:latest` inherits them.
+   If a repo needs an extra MCP server, MERGE it into the image's
+   `/root/.config/mcp/mcp.json` (never overwrite the existing servers).
 
 3. **Build**: