internal: workmux (#8072)

* config

* nit

* add wmdev config

* remove playwright mcp

* add asciicinema

* custom image

* mistake

.wmdev.yaml

@@ -4,6 +4,23 @@ services:
   - name: FE
     portEnv: FRONTEND_PORT
 
+sandbox:
+  image: windmill-sandbox
+  envPassthrough:
+    - AWS_ACCESS_KEY_ID
+    - AWS_SECRET_ACCESS_KEY
+    - R2_ENDPOINT
+    - R2_BUCKET
+    - R2_PUBLIC_URL
+  extraMounts:
+    - hostPath: ~/.codex
+      guestPath: /root/.codex
+      writable: true
+    - hostPath: ~/windmill-ee-private
+      writable: true
+    - hostPath: ~/windmill-ee-private__worktrees
+      writable: true
+
 profiles:
   default:
     name: default

.workmux.yaml

@@ -70,6 +70,3 @@ files:
 sandbox:
   enabled: false
   toolchain: off
-  # image, host_commands, and extra_mounts configured in global
-  # ~/.config/workmux/config.yaml — see README_WORKMUX_DEV.md for required
-  # extra_mounts (windmill-ee-private access in sandbox)

sandbox-image/Dockerfile.sandbox

@@ -0,0 +1,61 @@
+FROM debian:bookworm-slim
+
+# ── System packages ───────────────────────────────────────────────────────────
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl ca-certificates git unzip \
+    # Rust native build deps
+    pkg-config cmake clang mold libtool \
+    libssl-dev libxml2-dev libxmlsec1-dev libxslt1-dev \
+    libffi-dev zlib1g-dev libcurl4-openssl-dev libclang-dev \
+    libkrb5-dev libsasl2-dev \
+    # PostgreSQL
+    postgresql postgresql-client \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── Node.js 22 ────────────────────────────────────────────────────────────────
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── GitHub CLI ────────────────────────────────────────────────────────────────
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+        -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+        > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update && apt-get install -y --no-install-recommends gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── Rust toolchain ────────────────────────────────────────────────────────────
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+    sh -s -- -y --default-toolchain stable --profile minimal
+ENV PATH="/root/.cargo/bin:$PATH"
+
+RUN cargo install sqlx-cli --no-default-features --features native-tls,postgres \
+    && cargo install cargo-watch
+
+# ── Bun ───────────────────────────────────────────────────────────────────────
+RUN curl -fsSL https://bun.sh/install | bash
+ENV PATH="/root/.bun/bin:$PATH"
+
+# ── Playwright + Chromium ─────────────────────────────────────────────────────
+RUN bun add -g @playwright/test \
+    && bunx playwright install chromium --with-deps \
+    && rm -rf /var/lib/apt/lists/* /tmp/bunx-*
+
+# ── AWS CLI ───────────────────────────────────────────────────────────────────
+RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip \
+    && unzip -q /tmp/awscliv2.zip -d /tmp \
+    && /tmp/aws/install \
+    && rm -rf /tmp/aws /tmp/awscliv2.zip
+ENV AWS_DEFAULT_REGION=auto
+
+# ── Claude Code ───────────────────────────────────────────────────────────────
+RUN curl -fsSL https://claude.ai/install.sh | bash
+ENV PATH="/root/.local/bin:$PATH"
+
+# ── Codex ─────────────────────────────────────────────────────────────────────
+RUN npm i -g @openai/codex
+
+# ── Entrypoint (run explicitly via docker exec, not on container start) ──────
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh

sandbox-image/entrypoint.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+set -euo pipefail
+
+# ── Start PostgreSQL ──────────────────────────────────────────────────────────
+PGDATA=/tmp/pgdata
+mkdir -p "$PGDATA"
+chown postgres:postgres "$PGDATA"
+
+if [ ! -f "$PGDATA/PG_VERSION" ]; then
+    su - postgres -c "/usr/lib/postgresql/15/bin/initdb -D $PGDATA --auth=trust"
+fi
+su - postgres -c "/usr/lib/postgresql/15/bin/pg_ctl -D $PGDATA -l /tmp/pg.log start -o '-k /tmp'"
+su - postgres -c "psql -h /tmp -c 'CREATE ROLE root SUPERUSER LOGIN'" 2>/dev/null || true
+su - postgres -c "createdb -h /tmp windmill" 2>/dev/null || true
+
+# ── Run migrations if present ─────────────────────────────────────────────────
+if [ -d "$PWD/backend/migrations" ]; then
+    DATABASE_URL="postgres://root@localhost/windmill?host=/tmp" \
+        sqlx migrate run --source "$PWD/backend/migrations" 2>/dev/null || true
+fi
+
+# ── Install frontend deps if present ─────────────────────────────────────────
+if [ -d "$PWD/frontend" ]; then
+    (cd "$PWD/frontend" && npm install && npm run generate-backend-client) 2>/dev/null || true
+fi
+
+exec "$@"

scripts/worktree-cleanup

@@ -41,4 +41,7 @@ if [ -d "$ee_worktree_dir" ]; then
   git -C "$ee_repo" worktree remove "$ee_worktree_dir" --force 2>/dev/null \
     && echo "[cleanup] Removed EE worktree at $ee_worktree_dir" \
     || echo "[cleanup] Warning: Could not remove EE worktree at $ee_worktree_dir"
-fi
+fi
+
+# Clean up Cursor grouped tmux session
+tmux kill-session -t "cursor-${wt_basename}" 2>/dev/null || true