fix(api): harden controller tooling install

Author: konard

packages/api/Dockerfile

@@ -46,11 +46,32 @@ RUN set -eu; \
  && nvidia-ctk runtime configure --runtime=docker \
  && rm -rf /var/lib/apt/lists/*
 
-RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
- && apt-get install -y --no-install-recommends nodejs \
- && curl -fsSL https://bun.sh/install | bash \
- && npm i -g node-gyp \
- && rm -rf /var/lib/apt/lists/*
+RUN set -eu; \
+    installed=0; \
+    for attempt in 1 2 3 4 5; do \
+      rm -rf /var/lib/apt/lists/* /opt/bun; \
+      if curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 https://deb.nodesource.com/setup_24.x -o /tmp/nodesource-setup.sh \
+        && bash /tmp/nodesource-setup.sh \
+        && apt-get -o Acquire::Retries=3 install -y --no-install-recommends nodejs \
+        && npm install -g --prefix /opt/bun --no-audit --no-fund bun@1.3.11 node-gyp \
+        && node -v \
+        && npm -v \
+        && bun --version \
+        && test "$(bun --version)" = "1.3.11" \
+        && node-gyp --version; then \
+        installed=1; \
+        break; \
+      fi; \
+      echo "controller tooling install attempt ${attempt} failed; retrying..." >&2; \
+      rm -f /tmp/nodesource-setup.sh; \
+      sleep $((attempt * 2)); \
+    done; \
+    if [ "$installed" != "1" ]; then \
+      echo "controller tooling install failed after retries" >&2; \
+      exit 1; \
+    fi; \
+    rm -f /tmp/nodesource-setup.sh; \
+    rm -rf /var/lib/apt/lists/*
 
 FROM controller-base AS workspace-deps
 

packages/app/tests/docker-git/controller-resource-limits.test.ts

@@ -108,6 +108,19 @@ describe("API Dockerfile Electron materialization", () => {
     }))
 })
 
+describe("API Dockerfile controller tooling install", () => {
+  it.effect("retries network-bound controller tooling downloads", () =>
+    Effect.gen(function*(_) {
+      const contents = yield* _(readComposeFile("packages/api/Dockerfile"))
+      expect(contents).toContain("https://deb.nodesource.com/setup_24.x -o /tmp/nodesource-setup.sh")
+      expect(contents).toContain("npm install -g --prefix /opt/bun --no-audit --no-fund bun@1.3.11 node-gyp")
+      expect(contents).toContain("curl -fsSL --retry 5 --retry-all-errors --retry-delay 2")
+      expect(contents).toContain("controller tooling install failed after retries")
+      expect(contents).toContain("test \"$(bun --version)\" = \"1.3.11\"")
+      expect(contents).toContain("node-gyp --version")
+    }))
+})
+
 describe("controller resource limit resolution", () => {
   it.effect("resolves CPU and RAM defaults to 90% of host resources", () =>
     Effect.sync(() => {