CI connection example #

This is one small managed Node and Playwright HTTPS probe. It uses an exact route, a one-label wildcard route, and a literal private TXT record. The test client reads public access --json; it never receives sandbox state, generated service environment, or the private CA key.

For a downstream run, use two immutable source-only copies. A downstream must supply a full published AiaB SHA. The commands below also work for local acceptance when both SHAs name local commits; that proves the copied revisions, not a remote checkout of unpublished code.

consumer_root=$(mktemp -d /tmp/consumer.XXXXXX)
aiab_root=$(mktemp -d /tmp/aiab.XXXXXX)
git -C /path/to/consumer archive CONSUMER_SHA | tar -x -C "$consumer_root"
git -C /path/to/atmosphere-in-a-box archive AIAB_SHA | tar -x -C "$aiab_root"
rm -rf "$aiab_root/examples/ci"
cp -R "$consumer_root/examples/ci" "$aiab_root/examples/ci"
node -e "const fs=require('fs');const p=process.argv[1];const a=JSON.parse(fs.readFileSync(p));const e=JSON.parse(fs.readFileSync(process.argv[2]));if(!a.some(x=>x.id===e.id))a.push(e);fs.writeFileSync(p,JSON.stringify(a,null,2)+'\\n')" "$aiab_root/stacks/components.json" "$aiab_root/examples/ci/component.json"

Prepare dependencies and the browser before isolated execution. The image layer cache is optional and must not contain sandbox state or volumes.

cd "$aiab_root"
deno task install
project=ci-example-$RANDOM
export CI_PROBE_IMAGE_TAG="$project"
export CI_PROBE_CACHE_DIR=/tmp/atmosbox-ci-probe-cache
deno task sandbox create --pds 0 --users-per-pds 0 --subnet auto --project "$project" --app ci-probe
deno task sandbox check
docker compose --project-name "$project" --profile ci-probe build ci-browser
deno task sandbox up
deno task sandbox access --json > /tmp/access.json

Run the prepared container client with a name created after startup:

docker compose --project-name "$project" --profile ci-probe run --rm --no-deps \
  -e CI_PROBE_ACCESS_JSON="$(cat /tmp/access.json)" \
  -e CI_PROBE_DYNAMIC_HOST="ci-$RANDOM.probe.atmosbox.test" ci-browser

The host companion is limited to the documented Fedora/local-Docker path. It uses the same Playwright probe after installing its package and selecting the prepared browser before entering the private namespace:

npm ci --prefix examples/ci
export PLAYWRIGHT_BROWSERS_PATH="$HOME/.cache/ms-playwright"
npm exec --prefix examples/ci -- playwright install chromium
browser=$(node -e "console.log(require('./examples/ci/node_modules/playwright').chromium.executablePath())")
test -x "$browser"
CI_PROBE_PLAYWRIGHT_EXECUTABLE="$browser" \
  examples/ci/host-probe.sh "$PWD" "$project" /tmp/access.json

Capture only /tmp/access.json and the consumer command's public output. Use a closed deeper name, such as deliberate.deep.probe.atmosbox.test, for an intentional failure check; it must remain nonzero while the host script removes its helper and relay. Finish every run by removing only the selected project:

docker compose --project-name "$project" --profile ci-probe down --volumes --remove-orphans