Sequential build failures fixed:
1. uv run playwright install chromium → playwright not in pyproject.toml/venv
Fix: npm install -g @playwright/cli playwright && playwright install chromium
Also installs @playwright/cli (the browser CLI used by research agents)
2. uv pip install amplifierd → package not on PyPI
Fix: uv pip install --system from github.com/microsoft/amplifierd
Also installs amplifier-foundation (also not on PyPI, git-only dep)
Uses uv (not plain pip) to respect [tool.uv.sources] resolution
3. COPY frontend/dist/ → dist is gitignored, breaks fresh-clone builds
Fix: build the frontend inside Docker using the installed Node.js
(npm ci + npm run build); removes the pre-built dist assumption
Other fixes:
- Add git to apt-get (required for pip/uv git+https installs)
- Fix entrypoint.sh: amplifierd uses 'serve' subcommand and NAME=URI
bundle format — was: amplifierd --port ... --bundle /path
now: amplifierd serve --port ... --bundle name=/path --default-bundle name
- Add .dockerignore to exclude node_modules, .venv, dist, .git, etc.
(keeps build context small and avoids stale artifacts in COPY steps)
- backend/app.py: add Depends(_require_auth) to /api/copilotkit endpoint (critical
security fix — endpoint was fully unprotected; now requires valid session cookie)
- backend/app.py: move 'from ag_ui.core import RunStartedEvent' from inline function
body to top-level imports (style consistency)
- backend/auth.py: remove dead AUTH_PASS_HASH module-level constant (verify_password
already reads from os.environ at call time; the cached binding was unused dead code)
- backend/artifacts.py: add path traversal guards to list_artifacts, get_artifact,
and save_artifact — resolve paths and verify they stay within ARTIFACTS_DIR
- entrypoint.sh: health-check loop now sets READY flag and exits 1 if amplifierd
fails to start within 30s (previously fell through silently, causing 502s)
- tests/test_app.py: add TestCopilotKitAuth — verifies unauthenticated requests to
/api/copilotkit return 401; includes note explaining why streaming is not tested here
- tests/test_structure.sh: update to reflect that Dockerfile and entrypoint.sh now
exist (created in Tasks 7+8); convert absent-checks to presence-checks
Co-authored-by: Amplifier <amplifier@anthropic.com>
- Dockerfile with Xvfb + x11vnc + noVNC for browser-in-a-URL
- search.py auto-detects DISPLAY env to run headed vs headless
- pause_for_human() function for CAPTCHA/login handoff
- Facebook Marketplace search (headed mode only, needs login)
- Updated README with both modes
Ken