feat(satellite): install TypeScript globally for deployment builds

Author: Lasim

services/satellite/Dockerfile

@@ -24,6 +24,11 @@ RUN pip3 install --break-system-packages uv && \
     which uvx && \
     uv --version
 
+# Install TypeScript globally for GitHub deployment builds
+# Available at /usr/local/bin/tsc for all Node.js MCP servers
+RUN npm install -g typescript && \
+    tsc --version
+
 # Create mcp-cache base directory with proper ownership
 RUN mkdir -p /opt/deploystack/mcp-cache && \
     chown -R deploystack:deploystack /opt/deploystack

services/satellite/src/process/github-deployment.ts

@@ -266,141 +266,73 @@ export class GitHubDeploymentHandler {
       temp_dir: tempDir
     }, 'Installing dependencies with npm install');
 
-    return new Promise((resolve, reject) => {
-      const npmInstall = spawn('npm', ['install'], {
-        cwd: tempDir,
-        stdio: 'pipe'
-      });
-
-      let stderr = '';
-
-      // Capture and emit stdout to backend
-      npmInstall.stdout.on('data', (data) => {
-        const output = data.toString().trim();
-        if (output) {
-          this.logBuffer.add({
-            installation_id: installationId,
-            team_id: teamId,
-            user_id: userId,
-            level: 'info',
-            message: `[npm install] ${output}`,
-            timestamp: new Date().toISOString()
-          });
-        }
-      });
-
-      npmInstall.stderr.on('data', (data) => {
-        const output = data.toString().trim();
-        stderr += output;
-
-        // Also emit stderr as warn logs
-        if (output) {
-          this.logBuffer.add({
-            installation_id: installationId,
-            team_id: teamId,
-            user_id: userId,
-            level: 'warn',
-            message: `[npm install] ${output}`,
-            timestamp: new Date().toISOString()
-          });
-        }
-      });
-
-      npmInstall.on('exit', (code) => {
-        if (code === 0) {
-          this.logger.info({
-            operation: 'npm_install_success',
-            temp_dir: tempDir
-          }, 'Dependencies installed successfully');
-          resolve();
-        } else {
-          this.logger.error({
-            operation: 'npm_install_failed',
-            temp_dir: tempDir,
-            exit_code: code,
-            stderr: stderr.substring(0, 500) // Limit stderr output
-          }, `npm install failed with code ${code}`);
-
-          reject(new Error(`npm install failed with code ${code}: ${stderr.substring(0, 200)}`));
+    // Use nsjail in production, direct spawn in development
+    if (this.processSpawner.shouldUseNsjail()) {
+      const result = await this.processSpawner.spawnBuildCommandWithNsjail(
+        'npm',
+        ['install'],
+        tempDir,
+        {
+          allowNetwork: true,  // npm needs network for package downloads
+          timeoutMs: 120000,   // 2 minutes
+          runtime: 'node'
         }
-      });
-
-      npmInstall.on('error', (error) => {
-        this.logger.error({
-          operation: 'npm_install_error',
-          temp_dir: tempDir,
-          error: error.message
-        }, 'npm install process error');
-
-        reject(new Error(`npm install process error: ${error.message}`));
-      });
-    });
-  }
-
-  /**
-   * Build package if build script exists
-   */
-  async buildPackage(
-    tempDir: string,
-    installationId: string,
-    teamId: string,
-    userId?: string
-  ): Promise<void> {
-    try {
-      // Read package.json to check for build script
-      const packageJsonPath = path.join(tempDir, 'package.json');
-      const packageJsonContent = await fs.promises.readFile(packageJsonPath, 'utf8');
-      const packageJson = JSON.parse(packageJsonContent);
-
-      // Check if there's a build script
-      if (!packageJson.scripts?.build) {
-        this.logger.debug({
-          operation: 'npm_build_skip',
-          temp_dir: tempDir
-        }, 'No build script found, skipping build');
+      );
 
-        // Emit log to backend so users know build was skipped
+      // Emit logs to backend
+      if (result.stdout) {
         this.logBuffer.add({
           installation_id: installationId,
           team_id: teamId,
           user_id: userId,
           level: 'info',
-          message: '[npm build] No build script found, skipping build',
+          message: `[npm install] ${result.stdout.substring(0, 1000)}`,
           timestamp: new Date().toISOString()
         });
+      }
 
-        return;
+      if (result.code !== 0) {
+        this.logBuffer.add({
+          installation_id: installationId,
+          team_id: teamId,
+          user_id: userId,
+          level: 'error',
+          message: `[npm install] ${result.stderr.substring(0, 500)}`,
+          timestamp: new Date().toISOString()
+        });
+        throw new Error(`npm install failed with code ${result.code}: ${result.stderr.substring(0, 200)}`);
       }
 
-      this.logger.debug({
-        operation: 'npm_build_start',
+      this.logger.info({
+        operation: 'npm_install_success',
         temp_dir: tempDir
-      }, 'Building package with npm run build');
-
+      }, 'Dependencies installed successfully');
+    } else {
+      // Development mode - direct spawn
       return new Promise((resolve, reject) => {
-        const npmBuild = spawn('npm', ['run', 'build'], {
+        const npmInstall = spawn('npm', ['install'], {
           cwd: tempDir,
           stdio: 'pipe'
         });
 
         let stderr = '';
 
         // Capture and emit stdout to backend
-        npmBuild.stdout.on('data', (data) => {
+        npmInstall.stdout.on('data', (data) => {
           const output = data.toString().trim();
           if (output) {
             this.logBuffer.add({
               installation_id: installationId,
               team_id: teamId,
               user_id: userId,
               level: 'info',
-              message: `[npm build] ${output}`,
+              message: `[npm install] ${output}`,
               timestamp: new Date().toISOString()
             });
           }
         });
 
-        npmBuild.stderr.on('data', (data) => {
+        npmInstall.stderr.on('data', (data) => {
           const output = data.toString().trim();
           stderr += output;
 
@@ -411,41 +343,197 @@ export class GitHubDeploymentHandler {
               team_id: teamId,
               user_id: userId,
               level: 'warn',
-              message: `[npm build] ${output}`,
+              message: `[npm install] ${output}`,
               timestamp: new Date().toISOString()
             });
           }
         });
 
-        npmBuild.on('exit', (code) => {
+        npmInstall.on('exit', (code) => {
           if (code === 0) {
             this.logger.info({
-              operation: 'npm_build_success',
+              operation: 'npm_install_success',
               temp_dir: tempDir
-            }, 'Package built successfully');
+            }, 'Dependencies installed successfully');
             resolve();
           } else {
             this.logger.error({
-              operation: 'npm_build_failed',
+              operation: 'npm_install_failed',
               temp_dir: tempDir,
               exit_code: code,
-              stderr: stderr.substring(0, 500)
-            }, `npm run build failed with code ${code}`);
+              stderr: stderr.substring(0, 500) // Limit stderr output
+            }, `npm install failed with code ${code}`);
 
-            reject(new Error(`npm run build failed with code ${code}: ${stderr.substring(0, 200)}`));
+            reject(new Error(`npm install failed with code ${code}: ${stderr.substring(0, 200)}`));
           }
         });
 
-        npmBuild.on('error', (error) => {
+        npmInstall.on('error', (error) => {
           this.logger.error({
-            operation: 'npm_build_error',
+            operation: 'npm_install_error',
             temp_dir: tempDir,
             error: error.message
-          }, 'npm run build process error');
+          }, 'npm install process error');
 
-          reject(new Error(`npm run build process error: ${error.message}`));
+          reject(new Error(`npm install process error: ${error.message}`));
         });
       });
+    }
+  }
+
+  /**
+   * Build package if build script exists
+   */
+  async buildPackage(
+    tempDir: string,
+    installationId: string,
+    teamId: string,
+    userId?: string
+  ): Promise<void> {
+    try {
+      // Read package.json to check for build script
+      const packageJsonPath = path.join(tempDir, 'package.json');
+      const packageJsonContent = await fs.promises.readFile(packageJsonPath, 'utf8');
+      const packageJson = JSON.parse(packageJsonContent);
+
+      // Check if there's a build script
+      if (!packageJson.scripts?.build) {
+        this.logger.debug({
+          operation: 'npm_build_skip',
+          temp_dir: tempDir
+        }, 'No build script found, skipping build');
+
+        // Emit log to backend so users know build was skipped
+        this.logBuffer.add({
+          installation_id: installationId,
+          team_id: teamId,
+          user_id: userId,
+          level: 'info',
+          message: '[npm build] No build script found, skipping build',
+          timestamp: new Date().toISOString()
+        });
+
+        return;
+      }
+
+      this.logger.debug({
+        operation: 'npm_build_start',
+        temp_dir: tempDir
+      }, 'Building package with npm run build');
+
+      // Use nsjail in production, direct spawn in development
+      if (this.processSpawner.shouldUseNsjail()) {
+        const result = await this.processSpawner.spawnBuildCommandWithNsjail(
+          'npm',
+          ['run', 'build'],
+          tempDir,
+          {
+            allowNetwork: false,  // Build should not need network
+            timeoutMs: 120000,    // 2 minutes
+            runtime: 'node'
+          }
+        );
+
+        // Emit logs to backend
+        if (result.stdout) {
+          this.logBuffer.add({
+            installation_id: installationId,
+            team_id: teamId,
+            user_id: userId,
+            level: 'info',
+            message: `[npm build] ${result.stdout.substring(0, 1000)}`,
+            timestamp: new Date().toISOString()
+          });
+        }
+
+        if (result.code !== 0) {
+          this.logBuffer.add({
+            installation_id: installationId,
+            team_id: teamId,
+            user_id: userId,
+            level: 'error',
+            message: `[npm build] ${result.stderr.substring(0, 500)}`,
+            timestamp: new Date().toISOString()
+          });
+          throw new Error(`npm run build failed with code ${result.code}: ${result.stderr.substring(0, 200)}`);
+        }
+
+        this.logger.info({
+          operation: 'npm_build_success',
+          temp_dir: tempDir
+        }, 'Package built successfully');
+      } else {
+        // Development mode - direct spawn
+        return new Promise((resolve, reject) => {
+          const npmBuild = spawn('npm', ['run', 'build'], {
+            cwd: tempDir,
+            stdio: 'pipe'
+          });
+
+          let stderr = '';
+
+          // Capture and emit stdout to backend
+          npmBuild.stdout.on('data', (data) => {
+            const output = data.toString().trim();
+            if (output) {
+              this.logBuffer.add({
+                installation_id: installationId,
+                team_id: teamId,
+                user_id: userId,
+                level: 'info',
+                message: `[npm build] ${output}`,
+                timestamp: new Date().toISOString()
+              });
+            }
+          });
+
+          npmBuild.stderr.on('data', (data) => {
+            const output = data.toString().trim();
+            stderr += output;
+
+            // Also emit stderr as warn logs
+            if (output) {
+              this.logBuffer.add({
+                installation_id: installationId,
+                team_id: teamId,
+                user_id: userId,
+                level: 'warn',
+                message: `[npm build] ${output}`,
+                timestamp: new Date().toISOString()
+              });
+            }
+          });
+
+          npmBuild.on('exit', (code) => {
+            if (code === 0) {
+              this.logger.info({
+                operation: 'npm_build_success',
+                temp_dir: tempDir
+              }, 'Package built successfully');
+              resolve();
+            } else {
+              this.logger.error({
+                operation: 'npm_build_failed',
+                temp_dir: tempDir,
+                exit_code: code,
+                stderr: stderr.substring(0, 500)
+              }, `npm run build failed with code ${code}`);
+
+              reject(new Error(`npm run build failed with code ${code}: ${stderr.substring(0, 200)}`));
+            }
+          });
+
+          npmBuild.on('error', (error) => {
+            this.logger.error({
+              operation: 'npm_build_error',
+              temp_dir: tempDir,
+              error: error.message
+            }, 'npm run build process error');
+
+            reject(new Error(`npm run build process error: ${error.message}`));
+          });
+        });
+      }
 
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : String(error);