Port Space to REA MCP Server + Caddy + code-server + goFiles + opencode-router (browser hard-blocked)

Caddyfile

@@ -0,0 +1,62 @@
+:7860 {
+	# 1. REA MCP Server (Streamable HTTP via supergateway)
+	handle /mcp* {
+		reverse_proxy 127.0.0.1:8093 {
+			flush_interval -1
+		}
+	}
+
+	handle /healthz {
+		reverse_proxy 127.0.0.1:8093
+	}
+
+	# 2. code-server routing (/code)
+	@code_noslash path /code
+	redir @code_noslash /code/ 308
+
+	handle_path /code/* {
+		reverse_proxy 127.0.0.1:8443
+	}
+
+	# 3. goFiles file manager (/files -> mounted at /data)
+	@files_noslash path /files
+	redir @files_noslash /files/ 308
+
+	handle_path /files/* {
+		reverse_proxy 127.0.0.1:8100 {
+			header_up X-Forwarded-Prefix /files
+		}
+	}
+
+	# 4. opencode-router (/opencode + root /v1, /api, /assets for its SPA)
+	@opencode_noslash path /opencode
+	redir @opencode_noslash /opencode/ 308
+
+	handle_path /opencode/* {
+		reverse_proxy 127.0.0.1:8787
+	}
+
+	handle /v1/* {
+		reverse_proxy 127.0.0.1:8787
+	}
+
+	handle /api/* {
+		reverse_proxy 127.0.0.1:8787
+	}
+
+	handle /assets/* {
+		reverse_proxy 127.0.0.1:8787
+	}
+
+	# 5. REA Doctor status JSON
+	handle /rea-status.json {
+		root * /data/logs
+		file_server
+	}
+
+	# 6. Main Status UI fallback
+	handle {
+		root * /opt/cbot-defaults/static
+		file_server
+	}
+}

Dockerfile

@@ -1,37 +1,169 @@
-FROM node:24-slim
+# ==========================================
+# Stage 1: Build Binwalk 3.1.0 in Rust
+# ==========================================
+FROM rust:1-bookworm AS binwalk-builder
+RUN cargo install binwalk --version 3.1.0 --root /install
 
-# 1. Install core system dependencies (pure CLI, zero browser packages)
-RUN apt-get update && apt-get install -y \
-    git \
+# ==========================================
+# Stage 2: Main Production Image
+# ==========================================
+FROM node:24-bookworm-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV PORT=7860
+EXPOSE 7860
+
+# ------------------------------------------
+# 1. Browser Hard-Block (APT Pinning)
+# ------------------------------------------
+RUN mkdir -p /etc/apt/preferences.d && \
+    printf 'Package: *chromium* *chrome* *firefox* *playwright* *puppeteer* *webkit* *geckodriver* *chromedriver* *electron*\nPin: release *\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-block-browsers
+
+# ------------------------------------------
+# 2. System Dependencies (Zero Browser Packages)
+# ------------------------------------------
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
     curl \
+    git \
     zip \
     unzip \
     tar \
     xz-utils \
     bzip2 \
+    zstd \
+    lz4 \
+    lzip \
+    lzop \
+    unar \
+    cabextract \
+    squashfs-tools \
+    cpio \
+    e2fsprogs \
+    p7zip-full \
     python3 \
     python3-pip \
+    python3-venv \
     rsync \
+    tshark \
+    wabt \
+    gdb \
+    binutils \
+    file \
+    patchelf \
+    procps \
+    util-linux \
+    liblz4-1 \
+    liblzo2-2 \
     && rm -rf /var/lib/apt/lists/*
 
-# 2. Install OpenClaw CLI and pdfnano
-RUN npm install -g openclaw@latest pdfnano
+ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
+    PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1 \
+    PUPPETEER_SKIP_DOWNLOAD=1 \
+    REA_BROWSER_EXECUTABLE=""
 
-# 3. Install Hugging Face Hub (Python)
-RUN pip3 install --no-cache-dir --break-system-packages huggingface_hub
+# ------------------------------------------
+# 4. Adoptium Temurin JDK 21 (Full JDK)
+# ------------------------------------------
+RUN mkdir -p /opt/jdk-21 && \
+    curl -fsSL "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_x64_linux_hotspot_21.0.12.1_1.tar.gz" -o /tmp/jdk21.tar.gz && \
+    tar -xzf /tmp/jdk21.tar.gz -C /opt/jdk-21 --strip-components=1 && \
+    rm -f /tmp/jdk21.tar.gz
 
-# 4. Create directory structure
-RUN mkdir -p /root/.openclaw/agents/main/agent \
-    /root/.openclaw/agents/main/sessions \
-    /root/.openclaw/credentials \
-    /root/.openclaw/workspace
+ENV JAVA_HOME="/opt/jdk-21"
+ENV PATH="/opt/jdk-21/bin:${PATH}"
 
-ENV PORT=7860
-ENV OPENCLAW_GATEWAY_MODE=local
-EXPOSE 7860
+# ------------------------------------------
+# 5. Ghidra 12.1.4 (Official Release)
+# ------------------------------------------
+RUN mkdir -p /opt/ghidra && \
+    curl -fsSL "https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_12.1.4_build/ghidra_12.1.4_PUBLIC_20260921.zip" -o /tmp/ghidra.zip && \
+    unzip -q /tmp/ghidra.zip -d /opt/ghidra && \
+    chmod +x /opt/ghidra/ghidra_12.1.4_PUBLIC/support/analyzeHeadless && \
+    rm -f /tmp/ghidra.zip
+
+ENV GHIDRA_INSTALL_DIR="/opt/ghidra/ghidra_12.1.4_PUBLIC"
+ENV REA_ANALYSIS_PROVIDER="ghidra"
+
+# ------------------------------------------
+# 6. Headless JADX MCP + JADX CLI + Apktool
+# ------------------------------------------
+RUN mkdir -p /opt/jadx /opt/jadx-cli && \
+    curl -fsSL "https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar" -o /opt/jadx/jadx-headless-mcp-0.7.1-all.jar && \
+    curl -fsSL "https://github.com/skylot/jadx/releases/download/v1.5.6/jadx-1.5.6.zip" -o /tmp/jadx.zip && \
+    unzip -q /tmp/jadx.zip -d /opt/jadx-cli && \
+    chmod +x /opt/jadx-cli/bin/jadx && \
+    ln -sf /opt/jadx-cli/bin/jadx /usr/local/bin/jadx && \
+    rm -f /tmp/jadx.zip && \
+    curl -fsSL "https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool" -o /usr/local/bin/apktool && \
+    chmod +x /usr/local/bin/apktool && \
+    curl -fsSL "https://github.com/iBotPeaches/Apktool/releases/download/v3.0.3/apktool_3.0.3.jar" -o /usr/local/bin/apktool.jar
+
+ENV REA_JADX_MCP_JAR="/opt/jadx/jadx-headless-mcp-0.7.1-all.jar"
+ENV REA_APKTOOL_COMMAND="/usr/local/bin/apktool"
+
+# ------------------------------------------
+# 7. Binwalk 3.1.0 & Unblob 26.6.4 & Pwntools
+# ------------------------------------------
+COPY --from=binwalk-builder /install/bin/binwalk /usr/local/bin/binwalk
+RUN chmod +x /usr/local/bin/binwalk && \
+    pip3 install --no-cache-dir --break-system-packages unblob==26.6.4 pwntools
+
+ENV REA_BINWALK_COMMAND="/usr/local/bin/binwalk"
+ENV REA_UNBLOB_COMMAND="/usr/local/bin/unblob"
+ENV REA_FIRMWARE_PRLIMIT_COMMAND="/usr/bin/prlimit"
+ENV REA_PWNTOOLS_PYTHON="/usr/bin/python3"
+
+# ------------------------------------------
+# 8. Caddy Server
+# ------------------------------------------
+RUN curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=amd64" -o /usr/local/bin/caddy && \
+    chmod +x /usr/local/bin/caddy
+
+# ------------------------------------------
+# 9. code-server
+# ------------------------------------------
+RUN curl -fsSL https://code-server.dev/install.sh | sh
+
+# ------------------------------------------
+# 10. goFiles & opencode-router
+# ------------------------------------------
+RUN mkdir -p /tmp/dl /opt/opencode-router && \
+    curl -fsSL "https://github.com/G-Aman/goFiles/releases/latest/download/gofiles-linux-amd64.zip" -o /tmp/dl/gf.zip && \
+    unzip -q /tmp/dl/gf.zip -d /tmp/dl/gf && \
+    mv /tmp/dl/gf/gofiles-linux-amd64/gofiles /usr/local/bin/gofiles && \
+    chmod +x /usr/local/bin/gofiles && \
+    curl -fsSL "https://github.com/G-Aman/opencode-router/releases/latest/download/opencode-router-linux-amd64.zip" -o /tmp/dl/ocr.zip && \
+    unzip -q /tmp/dl/ocr.zip -d /tmp/dl/ocr && \
+    cp -r /tmp/dl/ocr/opencode-router-linux-amd64/* /opt/opencode-router/ && \
+    chmod +x /opt/opencode-router/opencode-router && \
+    ln -sf /opt/opencode-router/opencode-router /usr/local/bin/opencode-router && \
+    rm -rf /tmp/dl
+
+# ------------------------------------------
+# 11. REA & supergateway + Browser Hard-Block
+# ------------------------------------------
+COPY stub-playwright-index.js /tmp/stub-pw.js
+COPY stub-playwright-index.mjs /tmp/stub-pw.mjs
+RUN npm install -g rea-agents@latest supergateway@latest && \
+    cp /tmp/stub-pw.js /usr/local/lib/node_modules/rea-agents/node_modules/playwright-core/index.js 2>/dev/null || true && \
+    cp /tmp/stub-pw.mjs /usr/local/lib/node_modules/rea-agents/node_modules/playwright-core/index.mjs 2>/dev/null || true && \
+    rm -f /tmp/stub-pw.* && \
+    for b in chromium chromium-browser google-chrome google-chrome-stable chrome firefox playwright playwright-core puppeteer chromedriver geckodriver msedge brave-browser webkit; do \
+      printf '#!/bin/sh\necho "ERROR: Browser engines and browser automation are strictly disabled by host security policy." >&2\nexit 126\n' > "/usr/local/bin/$b" && chmod 755 "/usr/local/bin/$b"; \
+    done && \
+    rm -rf /root/.npm
 
-# 5. Add and prepare start-openclaw runner script
+# ------------------------------------------
+# 12. Copy CBot Repo Defaults & Runtime Runner
+# ------------------------------------------
+RUN mkdir -p /opt/cbot-defaults/init.d /opt/cbot-defaults/static /data
+COPY Caddyfile /opt/cbot-defaults/Caddyfile
+COPY init.d.sh /opt/cbot-defaults/init.d.sh
+COPY init.d/ /opt/cbot-defaults/init.d/
+COPY static/ /opt/cbot-defaults/static/
 COPY start.sh /usr/local/bin/start.sh
-RUN chmod +x /usr/local/bin/start.sh
+RUN chmod +x /usr/local/bin/start.sh /opt/cbot-defaults/init.d.sh /opt/cbot-defaults/init.d/*.sh
 
+WORKDIR /data
 CMD ["/usr/local/bin/start.sh"]

README.md

@@ -1,10 +1,33 @@
 ---
-title: CBot - OpenClaw
-emoji: 🦀
+title: REA MCP Server & Workspace
+emoji: 🔬
 colorFrom: purple
 colorTo: blue
 sdk: docker
 pinned: false
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# REA MCP Server Space (`amangs/cbot`)
+
+High-performance reverse-engineering server and persistent workspace backed by [REA](https://github.com/morluto/rea).
+
+## Architecture (`:7860` Caddy Gateway)
+
+- **`/mcp`** → Streamable HTTP MCP endpoint (`supergateway` → `rea mcp`)
+- **`/code/`** → In-browser VS Code Server bound to `/data/workspace`
+- **`/files/`** → [goFiles](https://github.com/G-Aman/goFiles) File Manager & WebDAV server on `/data`
+- **`/opencode/`** → [OpenCode Router](https://github.com/G-Aman/opencode-router) WebUI and `/v1` AI proxy
+- **`/`** → System dashboard & analysis status
+
+## Included Engines
+
+- **Ghidra 12.1.4 Headless** + **JDK 21**
+- **JADX Headless MCP 0.7.1** + **JADX CLI 1.5.6** + **Apktool 3.0.3**
+- **Binwalk 3.1.0 (Rust)** + **Unblob 26.6.4** + **Pwntools**
+- **WABT** (WebAssembly WAT/WASM) + **TShark** (Packet capture)
+- **Zero Browser Policy**: All browser packages, Playwright, and automation engines are strictly locked and restricted at the kernel, APT, and runtime level.
+
+## Storage & Persistence
+
+All persistent data, code-server workspace, uploads, and runtime scripts live on the persistent storage volume mounted at `/data`.
+Custom startup services can be placed into `/data/script/init.d/*.sh` to execute automatically on boot.

init.d.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# ============================================================
+# init.d - auto-start hook for persistent services
+#
+# Any executable script placed in /data/script/init.d runs on boot.
+#   - Source order: files run in sorted (alphabetical) order
+#   - A failing script logs and does NOT block the rest
+#   - Scripts are started in the background (setsid)
+# ============================================================
+
+INITD_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/init.d"
+LOG="/data/script/init.d.log"
+
+if [ ! -d "$INITD_DIR" ]; then
+    exit 0
+fi
+
+shopt -s nullglob
+scripts=("$INITD_DIR"/*.sh)
+
+if [ ${#scripts[@]} -eq 0 ]; then
+    exit 0
+fi
+
+echo "🧩 init.d: ${#scripts[@]} script(s) to run ($(date -Iseconds))" >> "$LOG"
+for s in "${scripts[@]}"; do
+    name="$(basename "$s")"
+    chmod +x "$s" 2>/dev/null || true
+    echo "   ▶️  $name" >> "$LOG"
+    setsid bash "$s" >> "$LOG" 2>&1 < /dev/null &
+    disown 2>/dev/null || true
+done
+exit 0

init.d/05-code-server.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# 05-code-server.sh — code-server service on 127.0.0.1:8443
+DIR="/data/script/code-server"
+WORKSPACE="${CODE_WORKSPACE:-/data/workspace}"
+USER_DATA="${CODE_USER_DATA:-/data/code-server}"
+LOG="$DIR/code-server.log"
+
+mkdir -p "$DIR" "$WORKSPACE" "$USER_DATA"
+
+if [ -f /data/.env ]; then
+    set -a
+    . /data/.env
+    set +a
+fi
+
+export PASSWORD="${CODE_PASSWORD:-${AUTH_TOKEN:-aman@g}}"
+rm -f "$HOME/.config/code-server/config.yaml" "$USER_DATA/config.yaml" 2>/dev/null || true
+
+if pgrep -f "code-server.*8443" >/dev/null 2>&1; then
+    echo "code-server already running"
+    exit 0
+fi
+
+exec code-server \
+    --port 8443 \
+    --auth password \
+    --user-data-dir "$USER_DATA" \
+    --bind-addr 127.0.0.1:8443 \
+    --disable-telemetry \
+    --disable-update-check \
+    "$WORKSPACE" \
+    >> "$LOG" 2>&1

init.d/10-gofiles.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+# 10-gofiles.sh — goFiles file manager on 127.0.0.1:8100 serving /data
+DIR="/data/script/gofiles"
+CONFIG="$DIR/config.json"
+LOG="$DIR/gofiles.log"
+
+mkdir -p "$DIR"
+
+if [ -f /data/.env ]; then
+    set -a
+    . /data/.env
+    set +a
+fi
+
+GOFILES_USER="${GOFILES_USER:-aman}"
+GOFILES_PASS="${GOFILES_PASS:-${AUTH_TOKEN:-aman@g}}"
+
+if [ ! -f "$CONFIG" ]; then
+    HASH="$(/usr/local/bin/gofiles -genpass "$GOFILES_PASS" 2>/dev/null | tr -d '\r\n')"
+    cat > "$CONFIG" <<EOF
+{
+  "app_name": "goFiles",
+  "logo_url": "",
+  "listen": "127.0.0.1:8100",
+  "root": "/data",
+  "path_prefix": "",
+  "assets": "",
+  "users": [
+    {
+      "name": "${GOFILES_USER}",
+      "pass": "${HASH}",
+      "home": "/"
+    }
+  ],
+  "allow": {
+    "write": true,
+    "delete": true,
+    "upload": true,
+    "urlfetch": true,
+    "archive": true,
+    "extract": true,
+    "edit": true,
+    "chmod": true,
+    "hash": true,
+    "webdav": true
+  },
+  "max_upload_bytes": 50000000000,
+  "chunk_bytes": 4000000,
+  "theme": "auto",
+  "lang": "en",
+  "trust_proxy": true,
+  "session_name": "gofm_session"
+}
+EOF
+fi
+
+if pgrep -f "/usr/local/bin/gofiles" >/dev/null 2>&1; then
+    echo "gofiles already running"
+    exit 0
+fi
+
+cd "$DIR" || exit 1
+exec /usr/local/bin/gofiles -config "$CONFIG" >> "$LOG" 2>&1

init.d/15-supergateway.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# 15-supergateway.sh — REA MCP Server over Streamable HTTP on 127.0.0.1:8093
+DIR="/data/script/rea-mcp"
+LOG="$DIR/supergateway.log"
+
+mkdir -p "$DIR" /data/workspace /data/tmp
+
+if [ -f /data/.env ]; then
+    set -a
+    . /data/.env
+    set +a
+fi
+
+export JAVA_HOME="/opt/jdk-21"
+export PATH="/opt/jdk-21/bin:/opt/jadx-cli/bin:/usr/local/bin:/usr/bin:/bin"
+export GHIDRA_INSTALL_DIR="/opt/ghidra/ghidra_12.1.4_PUBLIC"
+export REA_ANALYSIS_PROVIDER="ghidra"
+export REA_JADX_MCP_JAR="/opt/jadx/jadx-headless-mcp-0.7.1-all.jar"
+export REA_BINWALK_COMMAND="/usr/local/bin/binwalk"
+export REA_UNBLOB_COMMAND="/usr/local/bin/unblob"
+export REA_APKTOOL_COMMAND="/usr/local/bin/apktool"
+export REA_FIRMWARE_PRLIMIT_COMMAND="/usr/bin/prlimit"
+export REA_PWNTOOLS_PYTHON="/usr/bin/python3"
+export REA_GHIDRA_STARTUP_TIMEOUT_MS="${REA_GHIDRA_STARTUP_TIMEOUT_MS:-600000}"
+export TMPDIR="/data/tmp"
+export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
+export PUPPETEER_SKIP_DOWNLOAD=1
+
+if pgrep -f "supergateway.*8093" >/dev/null 2>&1; then
+    echo "supergateway already running"
+    exit 0
+fi
+
+AUTH_ARGS=()
+API_KEY="${REA_API_KEY:-${AUTH_TOKEN:-}}"
+if [ -n "$API_KEY" ]; then
+    AUTH_ARGS=(--apiKey "$API_KEY")
+fi
+
+cd /data/workspace || exit 1
+exec /usr/local/bin/supergateway \
+    --stdio "/usr/local/bin/rea mcp" \
+    --outputTransport streamableHttp \
+    --host 127.0.0.1 \
+    --port 8093 \
+    --streamableHttpPath /mcp \
+    --healthEndpoint /healthz \
+    --healthCheck server \
+    "${AUTH_ARGS[@]}" \
+    >> "$LOG" 2>&1

init.d/20-opencode-router.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+# 20-opencode-router.sh — OpenCode Router on 127.0.0.1:8787
+DIR="/data/script/opencode-router"
+CONFIG="$DIR/opencode-router.json"
+LOG="$DIR/proxy.log"
+
+mkdir -p "$DIR"
+
+if [ -f /data/.env ]; then
+    set -a
+    . /data/.env
+    set +a
+fi
+
+# Copy bundled assets/public/defaults from /opt/opencode-router if missing
+cp -rn /opt/opencode-router/* "$DIR/" 2>/dev/null || true
+
+PROXY_KEY="${OCROUTER_KEY:-${AUTH_TOKEN:-aman@g}}"
+
+if [ ! -f "$CONFIG" ]; then
+    cat > "$CONFIG" <<EOF
+{
+  "host": "127.0.0.1",
+  "port": 8787,
+  "upstream": "https://opencode.ai/zen/v1",
+  "ua": "opencode/1.19.0 ai-sdk/provider-utils/4.0.23 runtime/bun/1.3.14",
+  "autoUA": true,
+  "injectSession": true,
+  "defaultModel": "nemotron-3.5-lightning-free",
+  "fallbackModels": [
+    "nemotron-3-ultra-free",
+    "muse-spark-1.3-contributor-free",
+    "mimo-v2.6-flash-free",
+    "longcat-2.5-preview-free",
+    "space-bunny-free"
+  ],
+  "disabledModels": [
+    "ling-3.0-flash-fin-free"
+  ],
+  "modelAliases": {},
+  "responsesModels": [
+    "gpt-5*",
+    "gpt-6*",
+    "grok-*",
+    "muse-spark-*"
+  ],
+  "rateLimitMax": 0,
+  "rateLimitWindowMs": 60000,
+  "proxyKey": "${PROXY_KEY}",
+  "defaultUpstreamKey": "",
+  "outboundProxy": "",
+  "trustForwarded": true,
+  "timeoutMs": 120000,
+  "cacheMs": 0,
+  "autoSync": false,
+  "autoSyncIntervalMs": 0
+}
+EOF
+fi
+
+if pgrep -f "$DIR/opencode-router" >/dev/null 2>&1; then
+    echo "opencode-router already running"
+    exit 0
+fi
+
+cd "$DIR" || exit 1
+exec "$DIR/opencode-router" 8787 >> "$LOG" 2>&1

init.d/90-rea-doctor.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# 90-rea-doctor.sh — Export REA readiness report to /data/logs/rea-status.json
+mkdir -p /data/logs /data/tmp
+export JAVA_HOME="/opt/jdk-21"
+export PATH="/opt/jdk-21/bin:/opt/jadx-cli/bin:/usr/local/bin:/usr/bin:/bin"
+export GHIDRA_INSTALL_DIR="/opt/ghidra/ghidra_12.1.4_PUBLIC"
+export REA_ANALYSIS_PROVIDER="ghidra"
+export REA_JADX_MCP_JAR="/opt/jadx/jadx-headless-mcp-0.7.1-all.jar"
+export REA_BINWALK_COMMAND="/usr/local/bin/binwalk"
+export REA_UNBLOB_COMMAND="/usr/local/bin/unblob"
+export REA_APKTOOL_COMMAND="/usr/local/bin/apktool"
+export REA_FIRMWARE_PRLIMIT_COMMAND="/usr/bin/prlimit"
+export REA_PWNTOOLS_PYTHON="/usr/bin/python3"
+export TMPDIR="/data/tmp"
+
+/usr/local/bin/rea doctor --format json > /data/logs/rea-status.json 2>/data/logs/rea-doctor.err || true

start.sh

@@ -1,59 +1,46 @@
 #!/bin/bash
 set -e
 
-OPENCLAW_DIR="/root/.openclaw"
-BUCKET_DIR="/data/openclaw"
-EXCLUDES=(
-  --exclude="cache/"
-  --exclude="logs/"
-  --exclude="tmp/"
-  --exclude="*.sock"
-  --exclude="*.lock*"
-  --exclude="*-wal"
-  --exclude="*-shm"
-  --exclude="*-journal"
-)
-
-# 1. Restore on boot
-if [ -d "$BUCKET_DIR" ] && [ "$(ls -A "$BUCKET_DIR" 2>/dev/null)" ]; then
-  echo "[Storage] Restoring from $BUCKET_DIR..."
-  rsync -a "${EXCLUDES[@]}" "$BUCKET_DIR/" "$OPENCLAW_DIR/"
-  echo "[Storage] Restore completed."
-fi
+echo "🚀 Starting REA MCP Server Space..."
+echo "=================================="
 
-# 2. Database repair
-openclaw doctor --fix --yes 2>/dev/null || true
-
-# 3. Background sync to bucket every 30s
-if [ -d "/data" ]; then
-  mkdir -p "$BUCKET_DIR"
-  (
-    set +e
-    while true; do
-      sleep 30
-
-      # Flush SQLite WAL to main db files
-      for db in "$OPENCLAW_DIR"/state/*.sqlite "$OPENCLAW_DIR"/agents/*/agent/*.sqlite; do
-        if [ -f "$db" ]; then
-          python3 -c "import sqlite3; c=sqlite3.connect('$db'); c.execute('PRAGMA wal_checkpoint(PASSIVE);'); c.close()" 2>/dev/null || true
-        fi
-      done
-
-      # Sync state excluding runtime journals/locks
-      rsync -a --delete "${EXCLUDES[@]}" "$OPENCLAW_DIR/" "$BUCKET_DIR/" 2>/dev/null || true
-    done
-  ) &
-fi
+# 1. Directory Structure on Persistent Storage (/data)
+mkdir -p /data/{workspace,logs,tmp,code-server,script/init.d}
+chmod -R 755 /data/script
 
-# 4. Graceful shutdown sync
-sync_exit() {
-  echo "[Storage] Container stopping, running final sync..."
-  rsync -a --delete "${EXCLUDES[@]}" "$OPENCLAW_DIR/" "$BUCKET_DIR/" 2>/dev/null || true
-  exit 0
-}
-trap sync_exit SIGTERM SIGINT
+# 2. Seed Default Scripts & Caddyfile if not already customized
+if [ ! -f /data/script/Caddyfile ]; then
+    echo "📋 Seeding default Caddyfile..."
+    cp /opt/cbot-defaults/Caddyfile /data/script/Caddyfile
+fi
 
-chmod -R 700 "$OPENCLAW_DIR"
+if [ ! -f /data/script/init.d.sh ]; then
+    echo "📋 Seeding init.d runner..."
+    cp /opt/cbot-defaults/init.d.sh /data/script/init.d.sh
+    chmod +x /data/script/init.d.sh
+fi
 
-# 5. Start gateway
-exec openclaw gateway run --port 7860
+for f in /opt/cbot-defaults/init.d/*.sh; do
+    target="/data/script/init.d/$(basename "$f")"
+    if [ ! -f "$target" ]; then
+        echo "📋 Seeding service script $(basename "$f")..."
+        cp "$f" "$target"
+        chmod +x "$target"
+    fi
+done
+
+# 3. Enforce Browser Hard-Block Policies
+echo "🛡️ Verifying browser lockdown..."
+rm -rf /root/.cache/ms-playwright /root/.cache/puppeteer /data/.cache/ms-playwright 2>/dev/null || true
+mkdir -p /root/.cache /data/.cache
+ln -sfn /dev/null /root/.cache/ms-playwright 2>/dev/null || true
+ln -sfn /dev/null /root/.cache/puppeteer 2>/dev/null || true
+echo "Browser lockdown verified: zero browser packages permitted." > /data/logs/browser-block.log
+
+# 4. Run Persistent init.d Services
+echo "🧩 Running init.d services..."
+/data/script/init.d.sh
+
+# 5. Run Caddy in Foreground on Port 7860
+echo "🌐 Starting Caddy edge proxy on :7860..."
+exec caddy run --config /data/script/Caddyfile --adapter caddyfile

static/index.html

@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>REA MCP Server &amp; Workspace</title>
+<style>
+  :root{--bg:#0b0f19;--card:#131b2e;--border:#1e293b;--text:#e2e8f0;--muted:#94a3b8;--accent:#38bdf8;--ok:#10b981;--warn:#f59e0b}
+  *{box-sizing:border-box;margin:0;padding:0}
+  body{font-family:ui-sans-serif,system-ui,-apple-system,sans-serif;background:var(--bg);color:var(--text);padding:2rem;max-width:920px;margin:0 auto;line-height:1.5}
+  h1{font-size:1.5rem;margin-bottom:.25rem;display:flex;align-items:center;gap:.6rem}
+  p.sub{color:var(--muted);font-size:.9rem;margin-bottom:1.75rem}
+  .grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(210px,1fr));gap:1rem;margin-bottom:1.75rem}
+  a.card{display:block;background:var(--card);border:1px solid var(--border);border-radius:10px;padding:1.1rem;text-decoration:none;color:var(--text);transition:border-color .15s}
+  a.card:hover{border-color:var(--accent)}
+  .card h3{font-size:1rem;margin-bottom:.3rem;color:var(--accent)}
+  .card p{font-size:.82rem;color:var(--muted)}
+  .panel{background:var(--card);border:1px solid var(--border);border-radius:10px;padding:1.1rem;margin-bottom:1rem}
+  .panel h2{font-size:.95rem;margin-bottom:.6rem;color:var(--muted);text-transform:uppercase;letter-spacing:.04em}
+  .badges{display:flex;flex-wrap:wrap;gap:.5rem}
+  .badge{background:#0f172a;border:1px solid var(--border);padding:.3rem .65rem;border-radius:6px;font-size:.8rem;font-family:ui-monospace,monospace}
+  .badge.ok{border-color:rgba(16,185,129,.4);color:#34d399}
+  .badge.lock{border-color:rgba(245,158,11,.4);color:#fbbf24}
+  code{font-family:ui-monospace,monospace;font-size:.82rem;background:#0f172a;padding:.15rem .4rem;border-radius:4px}
+</style>
+</head>
+<body>
+  <h1>REA MCP Server <span id="health" class="badge">checking...</span></h1>
+  <p class="sub">Reverse Engineering MCP + Persistent Workspace on <code>/data</code></p>
+
+  <div class="grid">
+    <a class="card" href="/code/">
+      <h3>/code/ &rarr;</h3>
+      <p>VS Code Server bound to <code>/data/workspace</code></p>
+    </a>
+    <a class="card" href="/files/">
+      <h3>/files/ &rarr;</h3>
+      <p>goFiles File Manager &amp; WebDAV on <code>/data</code></p>
+    </a>
+    <a class="card" href="/opencode/">
+      <h3>/opencode/ &rarr;</h3>
+      <p>OpenCode Router Dashboard &amp; <code>/v1</code> API</p>
+    </a>
+    <a class="card" href="/rea-status.json">
+      <h3>/mcp &rarr;</h3>
+      <p>Streamable HTTP MCP endpoint + Doctor status</p>
+    </a>
+  </div>
+
+  <div class="panel">
+    <h2>Active Analysis Engines</h2>
+    <div class="badges">
+      <span class="badge ok">Node.js 24.x (SQLite ready)</span>
+      <span class="badge ok">Ghidra 12.1.4 Headless + JDK 21</span>
+      <span class="badge ok">JADX Headless MCP 0.7.1 + JADX 1.5.6</span>
+      <span class="badge ok">Apktool 3.0.3</span>
+      <span class="badge ok">Binwalk 3.1.0 + Unblob 26.6.4</span>
+      <span class="badge ok">Pwntools + WABT + TShark</span>
+      <span class="badge lock">Browser / Playwright Hard-Blocked</span>
+    </div>
+  </div>
+
+<script>
+fetch('/healthz').then(r=>r.ok?r.text():Promise.reject()).then(()=>{
+  const el=document.getElementById('health');
+  el.textContent='MCP Online';el.className='badge ok';
+}).catch(()=>{
+  const el=document.getElementById('health');
+  el.textContent='Starting...';el.className='badge lock';
+});
+</script>
+</body>
+</html>

stub-playwright-index.js

@@ -0,0 +1,38 @@
+/**
+ * Strict Security Policy Stub — Playwright & Browser Automation are Prohibited
+ */
+const denied = () => {
+  throw new Error("Browser engines and automation are strictly disabled on this system by host security policy.");
+};
+
+const pw = {
+  chromium: {
+    launch: denied,
+    launchPersistentContext: denied,
+    connect: denied,
+    connectOverCDP: denied,
+    executablePath: () => ""
+  },
+  firefox: {
+    launch: denied,
+    launchPersistentContext: denied,
+    connect: denied,
+    executablePath: () => ""
+  },
+  webkit: {
+    launch: denied,
+    launchPersistentContext: denied,
+    connect: denied,
+    executablePath: () => ""
+  },
+  _electron: {
+    launch: denied
+  },
+  _android: {},
+  selectors: {},
+  devices: {},
+  errors: {},
+  request: {}
+};
+
+module.exports = pw;

stub-playwright-index.mjs

@@ -0,0 +1,12 @@
+import pw from './index.js';
+
+export const chromium = pw.chromium;
+export const firefox = pw.firefox;
+export const webkit = pw.webkit;
+export const _electron = pw._electron;
+export const _android = pw._android;
+export const selectors = pw.selectors;
+export const devices = pw.devices;
+export const errors = pw.errors;
+export const request = pw.request;
+export default pw;