fix: harden workspace image qualification

Author: Gini

compose.yaml

@@ -464,6 +464,9 @@ services:
     profiles:
       - build
     image: ${ONECOMPUTER_WORKSPACE_IMAGE:-onecomputer/workspace:dev}
+    # E2B Firecracker qualification and the pinned desktop artifacts target
+    # x86_64. Keep local Apple Silicon builds deterministic under emulation.
+    platform: ${ONECOMPUTER_WORKSPACE_PLATFORM:-linux/amd64}
     build:
       context: .
       dockerfile: docker/Dockerfile.workspace

docker/Dockerfile.workspace

@@ -46,12 +46,17 @@ COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/loc
 COPY --chmod=0755 docker/workspace/onecomputer-libreoffice /usr/local/libexec/onecomputer-libreoffice
 
 RUN export DEBIAN_FRONTEND=noninteractive \
-    && apt-get purge -y \
+    && purge_packages="$(for package in \
       code firefox gimp gimp-data google-chrome-stable \
       nextcloud-desktop nextcloud-desktop-common nextcloud-desktop-doc nextcloud-desktop-l10n \
       obs-studio obs-v4l2sink onlyoffice-desktopeditors \
       remmina remmina-common remmina-plugin-rdp remmina-plugin-secret remmina-plugin-spice remmina-plugin-vnc \
-      signal-desktop slack-desktop sublime-text thunderbird zoom \
+      signal-desktop slack-desktop sublime-text thunderbird zoom; do \
+      if dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q '^install ok installed$'; then \
+        printf '%s ' "$package"; \
+      fi; \
+    done)" \
+    && if [ -n "$purge_packages" ]; then apt-get purge -y $purge_packages; fi \
     && apt-get autoremove -y \
     && curl -fsSLo /tmp/claude-desktop.deb \
       "https://downloads.claude.ai/claude-desktop/apt/stable/pool/main/c/claude-desktop/claude-desktop_${CLAUDE_DESKTOP_VERSION}_amd64.deb" \
@@ -278,6 +283,7 @@ RUN chmod 0755 \
       /usr/local/share/onecomputer/applications/onecomputer-google-chrome.desktop \
       /usr/local/share/onecomputer/applications/onecomputer-hermes-agent-cli.desktop \
       /usr/local/share/onecomputer/applications/onecomputer-hermes-desktop.desktop \
+    && command -v npm soffice libreoffice pandoc pdftoppm pdftotext qpdf tesseract unzip zip \
     && test -f /opt/onecomputer/skills/make-a-site/SKILL.md \
     && test -f /opt/onecomputer/hermes-agent/skills/onecomputer/make-a-site/SKILL.md \
     && chmod 0644 /usr/share/kasmvnc/www/app/onecomputer-kasm-clipboard.js /opt/firefox/distribution/policies.json /etc/opt/chrome/policies/managed/onecomputer.json /usr/local/share/onecomputer/SCHEDULING.md \

docker/workspace/onecomputer-agent-chat.py

@@ -474,7 +474,9 @@ def persist_attachment(filename: str, media_type: str, data: bytes, source: str)
         shutil.rmtree(message_directory, ignore_errors=True)
         shutil.rmtree(ATTACHMENT_INBOX_ROOT / ("Telegram" if source == "telegram" else "Chat") / attachment_id, ignore_errors=True)
         raise
-    return str(path)
+    # macOS exposes the temporary directory through both /var and /private/var;
+    # return the canonical path so workspace references compare consistently.
+    return str(path.resolve())
 
 
 def snapshot_outbox() -> dict[str, tuple[int, int, int, int]]:
@@ -491,7 +493,7 @@ def snapshot_outbox() -> dict[str, tuple[int, int, int, int]]:
     return snapshot
 
 
-def persist_outbox_artifacts(before: dict[str, tuple[int, int, int, int]]) -> tuple[list[dict[str, Any]], str | None]:
+def persist_outbox_artifacts(before: dict[str, tuple[int, int, int, int]]):
     ARTIFACT_ROOT.mkdir(mode=0o700, parents=True, exist_ok=True)
     os.chmod(ARTIFACT_ROOT, 0o700)
     artifacts: list[dict[str, Any]] = []

docker/workspace/onecomputer-hermes-config.py

@@ -83,7 +83,8 @@ def atomic_json(path: Path, value: dict[str, Any]) -> None:
         encoding="utf-8",
     )
     os.chmod(temporary, 0o600)
-    os.chown(temporary, 1000, 1000)
+    if os.geteuid() == 0:
+        os.chown(temporary, 1000, 1000)
     os.replace(temporary, path)