fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container

.github/workflows/daily-multi-device-docs-tester.md

@@ -34,7 +34,7 @@ tools:
   cli-proxy: true
   github:
     mode: gh-proxy
-  timeout: 120  # Multi-device runs include docs build + preview startup
+  timeout: 120  # Multi-device runs include preview startup and Playwright tests
   playwright:
     mode: cli
   bash:
@@ -82,74 +82,29 @@ imports:
 
   - shared/otlp.md
 pre-agent-steps:
-  - name: Install docs dependencies
-    env:
-      EXPR_GITHUB_WORKSPACE: ${{ github.workspace }}
-    run: |
-      cd "$EXPR_GITHUB_WORKSPACE/docs"
-      npm install
   - name: Resolve slide deck PDF
     env:
       EXPR_GITHUB_WORKSPACE: ${{ github.workspace }}
     run: |
       cd "$EXPR_GITHUB_WORKSPACE/docs"
       node ../scripts/ensure-docs-slide-pdf.js
-  - name: Start docs server
+  - name: Configure Chrome sandbox
+    run: |
+      # The chrome-sandbox helper must be owned by root with mode 4755 (SUID) for Chrome
+      # to launch inside the agent container. The runner has mode 0777 by default.
+      if [ -f /opt/google/chrome/chrome-sandbox ]; then
+        sudo chmod 4755 /opt/google/chrome/chrome-sandbox
+        echo "chrome-sandbox configured (mode 4755)"
+      else
+        echo "chrome-sandbox not found — skipping"
+      fi
+  - name: Install and build docs
     env:
-      EXPR_GITHUB_RUN_ID: ${{ github.run_id }}
       EXPR_GITHUB_WORKSPACE: ${{ github.workspace }}
     run: |
-      LOG_FILE="/tmp/gh-aw/agent/docs-server-$EXPR_GITHUB_RUN_ID.log"
-      PID_FILE="/tmp/gh-aw/agent/docs-server-$EXPR_GITHUB_RUN_ID.pid"
       cd "$EXPR_GITHUB_WORKSPACE/docs"
+      npm install
       npm run build
-      nohup npm run preview -- --host 127.0.0.1 --port 4321 > "$LOG_FILE" 2>&1 &
-      PID=$!
-      echo $PID > "$PID_FILE"
-      echo "Server PID: $PID"
-      echo "Server log: $LOG_FILE"
-  - name: Wait for server readiness
-    env:
-      EXPR_GITHUB_RUN_ID: ${{ github.run_id }}
-    run: |
-      PID_FILE="/tmp/gh-aw/agent/docs-server-$EXPR_GITHUB_RUN_ID.pid"
-      LOG_FILE="/tmp/gh-aw/agent/docs-server-$EXPR_GITHUB_RUN_ID.log"
-      MAX_WAIT=135  # Maximum 135 seconds wait time
-      WAITED=0
-      until (echo > /dev/tcp/127.0.0.1/4321) > /dev/null 2>&1; do
-        # Check if the server process has already died
-        if [ -f "$PID_FILE" ] && ! kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
-          echo "::error::Documentation server process died before opening port 4321. Server log:"
-          cat "$LOG_FILE"
-          exit 1
-        fi
-        WAITED=$((WAITED + 3))
-        if [ $WAITED -ge $MAX_WAIT ]; then
-          echo "::error::Documentation server port 4321 did not open after ${MAX_WAIT}s. Server log:"
-          cat "$LOG_FILE"
-          exit 1
-        fi
-        echo "Waiting for docs port... ($WAITED/${MAX_WAIT}s)"
-        sleep 3
-      done
-      WAITED=0
-      until curl -sf http://localhost:4321/gh-aw/ > /dev/null 2>&1; do
-        # Check if the server process has already died
-        if [ -f "$PID_FILE" ] && ! kill -0 "$(cat "$PID_FILE")" 2>/dev/null; then
-          echo "::error::Documentation server process died before becoming ready. Server log:"
-          cat "$LOG_FILE"
-          exit 1
-        fi
-        WAITED=$((WAITED + 3))
-        if [ $WAITED -ge $MAX_WAIT ]; then
-          echo "::error::Documentation server did not start after ${MAX_WAIT}s. Server log:"
-          cat "$LOG_FILE"
-          exit 1
-        fi
-        echo "Waiting for server... ($WAITED/${MAX_WAIT}s)"
-        sleep 3
-      done
-      echo "Server ready at http://localhost:4321/gh-aw/!"
 features:
   gh-aw-detection: true
 ---
@@ -181,13 +136,32 @@ This workflow has `strict: true` — it will fail if no safe output is produced.
 
 Start the documentation preview server and perform comprehensive multi-device testing. Test layout responsiveness, accessibility, interactive elements, and visual rendering across all device types. Use a single Playwright browser instance for efficiency.
 
-## Step 1: Verify Server Availability
+## Step 1: Start Server
 
-The workflow pre-agent steps already installed docs dependencies, built the docs site, and started the Astro preview server.
-Quickly verify it is reachable before testing:
+The docs dependencies are already installed and the site is already built. Start the Astro preview server inside this container:
 
 ```bash
-curl -sf http://localhost:4321/gh-aw/ > /dev/null && echo "Docs server is ready"
+cd "${{ github.workspace }}/docs"
+LOG_FILE="/tmp/docs-server.log"
+nohup npm run preview -- --port 4321 > "$LOG_FILE" 2>&1 &
+echo "Server PID: $!, log: $LOG_FILE"
+```
+
+Then wait for the server to be ready:
+
+```bash
+LOG_FILE="/tmp/docs-server.log"
+MAX_WAIT=120
+WAITED=0
+until curl -sf http://localhost:4321/gh-aw/ > /dev/null 2>&1; do
+  WAITED=$((WAITED + 3))
+  if [ $WAITED -ge $MAX_WAIT ]; then
+    echo "Server log:" && cat "$LOG_FILE"
+    echo "ERROR: Server did not start after ${MAX_WAIT}s" && exit 1
+  fi
+  sleep 3
+done
+echo "Docs server ready at http://localhost:4321/gh-aw/"
 ```
 
 ## Step 2: Device Configuration
@@ -222,9 +196,6 @@ playwright-cli browser_run_code --code "async (page) => {
 }"
 ```
 
-- ✅ **Use `localhost` directly** — playwright-cli runs on the runner, so `localhost` reaches the dev server
-- ❌ **Do NOT use bridge IP detection** — that is only needed in the deprecated MCP mode
-
 For each device viewport, use playwright-cli to:
 - Set viewport size and navigate to `http://localhost:4321/gh-aw/`
 - Take screenshots and run accessibility audits
@@ -305,8 +276,7 @@ Label with: `documentation`, `testing`, `automated`
 
 ## Step 6: Cleanup
 
-No manual server cleanup is required in-agent for this workflow.
-The server lifecycle is handled by pre-agent setup and job teardown.
+No manual server cleanup is required. The server process will be cleaned up automatically when the agent job exits.
 
 ## Summary