Preinstall Playwright in cached agent images (codex)

[numnx]

🧩 Task: Preinstall Playwright in cached agent images

Automated task PR opened by Code UX for T01.

📋 Summary

Sprint: Sprint 164 · Optimize and Harden Docker Containers · Task: T01

Optimize Docker agent startup and CPU usage, make Playwright Chromium reliably available in agent containers, add safe opt-in root execution globally and per agent, and harden container/server exposure defaults.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-07 08:14:06 UTC
Finished	2026-07-07 08:20:30 UTC
Duration	6m 25s

📊 Token Usage

Metric	Value
Input tokens	116,774
Cached input tokens	1,954,304
Output tokens	14,406
Total tokens	2,085,484
Invocations	1
Tool calls	62
Active time	5m 53s

Included usage estimate (subscription/local login): $1.99

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Update the Docker setup-cache path so agent containers have Playwright Chromium and OS dependencies available from the cached runtime image, while avoiding repeated browser installation on every container start.

## Scope
- `.code-ux/container/setup.sh`
- `src/infrastructure/providers/cli/docker-setup-image-cache.ts`
- `tests/backend/infrastructure/providers/cli/docker-setup-image-cache.test.ts`
- `tests/backend/infrastructure/providers/cli/docker-bootstrap-builder.test.ts` if bootstrap expectations need adjustment
- Relevant symbols: `DockerSetupImageCache.buildDockerfile`, `DockerSetupImageCache.resolveImage`, Playwright install block in `setup.sh`

## Implementation Requirements
1. Change `.code-ux/container/setup.sh` so Playwright browser installation is controlled by an explicit environment flag such as `CODE_UX_INSTALL_PLAYWRIGHT=1`, writes Chromium to a stable container path such as `/ms-playwright` when running as root, and leaves existing non-root fallback behavior intact.
2. Update `DockerSetupImageCache.buildDockerfile` to set the Playwright install flag and `PLAYWRIGHT_BROWSERS_PATH` during setup-cache image builds, install Chromium plus dependencies during the image build, and ensure the final image exposes the same `PLAYWRIGHT_BROWSERS_PATH` at runtime.
3. Keep provider CLI installation and apt package installation cache-friendly: avoid unnecessary npm refreshes, retain `--no-install-recommends`, and clean apt lists after package installation.
4. Add or update tests asserting the generated Dockerfile enables Playwright preinstall, sets the browser path, and changes the cache key when the Dockerfile/setup behavior changes.

## Constraints
- Do not require workers to run as root at runtime just to use Playwright.
- Do not make every runtime setup invocation download Chromium when a cached setup image is already being used.
- Preserve existing provider CLI bootstrap behavior for Gemini, Codex, Claude Code, Qwen, OpenCode, and Antigravity.
- Keep the fallback path usable when setup-image caching is disabled or a custom setup script is configured.

## Verification
- `pnpm exec vitest run tests/backend/infrastructure/providers/cli/docker-setup-image-cache.test.ts tests/backend/infrastructure/providers/cli/docker-bootstrap-builder.test.ts`
- `pnpm run lint`
- Success means tests confirm Playwright is baked into the cached image path and TypeScript passes without changing unrelated runtime behavior.

🌿 Branch Info

Base: feature/CODUX-164-optimize-and-harden-docker-containers
Head: task/feature-codux-164-optimize-and-harden-docker-con-t01-codex-mradhipn

---

🤖 Generated by Code UX