Skill: guillaumetch/moltworld-dashboard-deploy (version 0.1.3)

--- name: moltworld-dashboard-deploy description: Install, harden, and run the MoltWorld Dashboard reliably for real users. Use when asked to set up local runtime scaffolding (README/package.json/.env/.gitignore), add Docker/Compose/systemd deployment files, verify accessibility on port 8787, and troubleshoot uptime/connectivity issues. --- # MoltWorld Dashboard Deploy Standardize this workflow to make `moltworld-dashboard` easy to run and operate safely. ## Runtime requirements Required binaries: - npm - docker - docker-compose Optional (privileged persistence path only): - systemd - sudo ## Safety gates (mandatory) 1. Treat project dependencies as untrusted until reviewed. 2. Before package install, inspect `package.json` and lockfile for suspicious scripts/deps. 3. Ask for explicit approval before any privileged/persistent action (`sudo`, `systemctl enable`, writing under `/etc/systemd/system`). 4. Prefer non-privileged runtime paths first (local run or Docker Compose without host-level service install). 5. Never use `curl | bash` or equivalent remote script execution. ## Workflow 1. Verify baseline project files exist (`server.mjs`, `public/`). 2. Add/shareability files if missing: - `package.json` (start script) - `.env.example` - `.nvmrc` - `.gitignore` - `README.md` 3. Add deployment files if requested: - `Dockerfile` - `docker-compose.yml` - `moltworld-dashboard.service` (systemd, only with explicit approval) 4. Validate startup and confirm HTTP 200 on `http://localhost:8787/`. 5. Validate restart behavior and long-running stability. 6. Confirm accessibility via localhost or host IP. 7. Document runbook steps for operators. ## Required file conventions - Keep runtime state out of git (`data/state.json`, logs, pids). - Keep secrets out of git (`.env`). - Default runtime port: `8787`. - README must include: - local quick start - Docker run - Docker Compose run - systemd install/enable instructions marked as privileged/optional ## Runtime stability checks Use these checks when service becomes unreachable: ```bash ss -ltnp | grep ':8787' || true curl -I --max-time 5 http://localhost:8787/ ``` If process is down, restart with a supervisor (Docker Compose or approved systemd service) instead of ad-hoc foreground runs. ## Troubleshooting quick checks - Service down: verify listener on `:8787`. - Loop timeouts: increase API timeout and add retries in `postJson`. - Process died after exec session: restart with supervisor. ## References - Deployment/runbook command snippets: `references/commands.md`

path: references/commands.md
content: # MoltWorld Dashboard Deploy Commands

## 0) Minimal trust check before installs

```bash
cat package.json
[ -f package-lock.json ] && cat package-lock.json | head -n 80
```

Review `scripts` and dependencies before running package install commands.

## 1) Local run (non-privileged first)

```bash
npm ci --ignore-scripts
npm run start
curl -I http://localhost:8787/
```

If install scripts are required by the project, run them only after review and explicit approval.

## 2) Docker

```bash
docker build -t moltworld-dashboard .
docker run --rm -p 8787:8787 moltworld-dashboard
```

## 3) Docker Compose

```bash
docker compose up -d --build
docker compose ps
docker compose logs -f --tail 100
docker compose down
```

## 4) Systemd (privileged / operator approval required)

```bash
sudo cp moltworld-dashboard.service /etc/systemd/system/moltworld-dashboard.service
sudo systemctl daemon-reload
sudo systemctl enable --now moltworld-dashboard
systemctl status moltworld-dashboard
journalctl -u moltworld-dashboard -f
```

Only use systemd when persistence is explicitly requested and approved.

## 5) Connectivity / uptime checks

```bash
ss -ltnp | grep ':8787' || true
curl -I --max-time 5 http://localhost:8787/
```

## 6) API timeout hardening pattern

- Increase request timeout (example: 20s)
- Add bounded retries with small backoff
- Prefer supervised restarts over manual foreground runs

## 7) Prohibited pattern

- Do not use `curl | bash` or remote script piping into shells.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)