Compiler: fix docker-sbx runtime support (TTY, CLI path, agentTimeout)

[lpcox]

Summary

The docker-sbx and gvisor runtimes have compiler-level issues discovered while testing strict security mode in github/gh-aw-firewall#6223. All issues were fixed manually in the lockfiles and verified green in CI. The compiler needs to be updated so future recompiles produce correct output.

Methodology

Working lockfiles (CI-verified green) were saved, then all 8 sbx/gvisor workflows were recompiled from the local build at c225286dc2. The diff between working and recompiled lockfiles identifies exactly what the compiler needs to change.

---

docker-sbx: 3 Compiler Changes Required

1. Suppress --tty for docker-sbx runtime

File: pkg/workflow/awf_helpers.go:617-619

Problem: The compiler adds --tty when config.UsesTTY is true (Claude engine). But sbx exec --tty imposes an internal ~30s pty deadline on the pseudo-terminal, killing Claude mid-execution after ~35 seconds — even though it was actively working and had made 3 successful API calls.

Diff (working vs compiler):

-          awf ... --container-runtime sbx --env-all ...
+          awf ... --tty --container-runtime sbx --env-all ...

Evidence:

• Codex (no --tty): completed in 27s, passed ✅
• Claude (--tty): killed at 35s with ERROR: inspect exec: context deadline exceeded ❌
• After removing --tty: Claude passed ✅

Fix:

// Line 617-619 of awf_helpers.go
if config.UsesTTY && !isDockerSbxRuntime(config.WorkflowData) {
    awfArgs = append(awfArgs, "--tty")
}

2. Install CLI binaries into sbx-accessible path

Files: pkg/workflow/nodejs.go, engine-specific install step generators

Problem: npm install -g creates symlinks at /usr/local/bin/{claude,codex} on the host. Since the sbx microVM has its own root filesystem, /usr/local/bin/ on the host is invisible inside the VM, causing spawn codex ENOENT / spawn claude ENOENT.

Diff (working vs compiler — claude):

 # Working version installs into both global and sbx-accessible path:
-        run: |
-          npm install -g @anthropic-ai/claude-code@2.1.207
-          mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-cli/bin"
-          npm install --prefix "${RUNNER_TEMP}/gh-aw/mcp-cli" @anthropic-ai/claude-code@2.1.207
-          ln -sf "../node_modules/.bin/claude" "${RUNNER_TEMP}/gh-aw/mcp-cli/bin/claude"

 # Compiler only does the global install:
+        run: npm install -g @anthropic-ai/claude-code@2.1.207

Same pattern for codex (npm install --ignore-scripts --prefix ... @openai/codex@0.144.3).

Fix: For docker-sbx, add a post-install step (analogous to the ARC/DinD pattern at nodejs.go:191-200) that also installs the CLI into ${RUNNER_TEMP}/gh-aw/mcp-cli/ with symlinks in the bin/ subdirectory. Then prepend ${RUNNER_TEMP}/gh-aw/mcp-cli/bin to PATH in the agent command.

3. Set agentTimeout in generated AWF config for docker-sbx

File: pkg/workflow/awf_config.go

Problem: The compiler does not set container.agentTimeout in the generated AWF config JSON. Without it, AWF passes timeoutMinutes: undefined to the sbx exec.

Diff (working vs compiler):

-  "container":{"imageTag":"0.27.32","agentTimeout":60}
+  "container":{"imageTag":"0.27.32"}

Fix: When runtime: docker-sbx, set container.agentTimeout to the workflow's timeout-minutes value (or a sensible default like 60 minutes).

---

gvisor: No Compiler Changes Required (AWF Firewall Fix)

The gvisor workflows required a build-from-source step in the lockfiles because the AWF firewall code had two bugs that needed fixing:

1. /dev/null mounted read-only — gVisor's chroot requires /dev/null to be writable. Fixed in src/services/agent-volumes/system-mounts.ts (mount /dev/null:rw instead of :ro).

2. capsh not found in chroot PATH — gVisor's restricted /usr/sbin wasn't on PATH inside the chroot. Fixed in containers/agent/entrypoint.sh (prereq check now uses full path, cd fallback uses || true).

Diff (working vs compiler):

 # Working version builds AWF from source to include the fixes:
-      - name: Build AWF from source (test branch - includes /dev/null rw mount fix)
-        run: |
-          cd "${GITHUB_WORKSPACE}"
-          npm ci --ignore-scripts
-          npm run build
-          chmod +x dist/cli.js
-          sudo ln -sf "${GITHUB_WORKSPACE}/dist/cli.js" /usr/local/bin/awf
-          docker build -t ghcr.io/github/gh-aw-firewall/agent:0.27.32 containers/agent/
-          ...

 # Compiler uses the released AWF binary (which lacks these fixes):
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.27.32

Resolution: These are AWF firewall fixes, not compiler issues. Once the AWF firewall changes from github/gh-aw-firewall#6223 are released (as a new AWF version), the compiler's standard install_awf_binary.sh step will pick up the fixes automatically. No compiler change needed.

---

Verification

All fixes were manually applied to the lockfiles in github/gh-aw-firewall#6223 and verified green in CI:

docker-sbx workflows:

• ✅ smoke-docker-sbx-codex — all jobs green (run 29363947056)
• ✅ smoke-docker-sbx-claude — all jobs green (run 29365504068)

gVisor workflows (all 4):

• ✅ smoke-gvisor / smoke-gvisor-build-test / smoke-gvisor-claude / smoke-gvisor-codex — all green (built from source)

Priority

The 3 compiler changes (all docker-sbx) are blocking the strict security mode rollout — without them, recompiling any docker-sbx workflow will regress the fixes. The gVisor fixes are blocked on an AWF firewall release, not the compiler.