From 7955d56ac268e48d5918de300691e02cd30467e0 Mon Sep 17 00:00:00 2001
From: Nawa Manusitthipol <nawa@nawaman.net>
Date: Fri, 11 Sep 2026 18:08:54 -0400
Subject: [PATCH 1/3] Fix android-example platform mismatch and elixir-example
 OTP/arm64 gap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

android-example set common-args=[--platform, linux/amd64] to force the
x86_64-only Android SDK to work under emulation, but that flag only ever
reached `docker run` — buildLocalImage() never passed it to `docker build`,
so the image built for the host's native arch and then failed to start
under the forced platform ("does not provide the specified platform").
Extract --platform from common-args/run-args and apply it to the build too.

elixir-example failed because ppa:rabbitmq/rabbitmq-erlang-28 doesn't
publish arm64 builds of the individual erlang-base/erlang-dev/... packages
erlang--setup.sh installs by name — only a few arch-independent
metapackages. apt silently satisfied those names from Ubuntu's default
archive instead (OTP 25 on arm64), and Elixir 1.19 dropped OTP 25 support,
so the mismatch surfaced as a confusing 404 fetching elixir-otp-25.zip far
from the actual cause. erlang--setup.sh now verifies the installed OTP
major matches what was requested and fails immediately with a clear
explanation instead of silently drifting. elixir-example itself is
re-pinned to erlang 25 + elixir 1.18.4, a combination that installs
identically on amd64 and arm64 without needing the incomplete PPA at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137yjw6oV573p5vEfCoqNpj
---
 cli/src/pkg/booth/ensure_docker_image.go      |  34 ++
 .../.booth/setups/affine-server--setup.sh     | 411 ----------------
 .../.booth/setups/postgresql--setup.sh        | 137 ------
 .../.booth/setups/anythingllm--setup.sh       | 439 ------------------
 .../.booth/setups/appwrite-cli--setup.sh      |  96 ----
 .../.booth/setups/appwrite-server--setup.sh   | 429 -----------------
 .../.booth/setups/deno-pkg--install.sh        |  27 --
 .../elixir-example/.booth/Boothfile           |  12 +-
 .../.booth/setups/floci--setup.sh             | 140 ------
 .../.booth/setups/flutter--setup.sh           | 222 ---------
 .../.booth/setups/flutter-android--setup.sh   | 167 -------
 .../setups/flutter-code-extension--setup.sh   |  46 --
 .../setups/flutter-linux-desktop--setup.sh    | 103 ----
 .../.booth/setups/cb-has-desktop.sh           |  25 -
 .../.booth/setups/logo--setup.sh              | 129 -----
 .../.booth/setups/thonny--setup.sh            | 109 -----
 .../.booth/setups/wails--setup.sh             | 164 -------
 .../.booth/setups/wails-android--setup.sh     | 100 ----
 .../.booth/setups/wails--setup.sh             | 164 -------
 variants/base/setups/erlang--setup.sh         |  26 ++
 20 files changed, 71 insertions(+), 2909 deletions(-)
 delete mode 100755 examples/workspaces/affine-example/.booth/setups/affine-server--setup.sh
 delete mode 100755 examples/workspaces/affine-example/.booth/setups/postgresql--setup.sh
 delete mode 100755 examples/workspaces/anythingllm-example/.booth/setups/anythingllm--setup.sh
 delete mode 100755 examples/workspaces/appwrite-example/.booth/setups/appwrite-cli--setup.sh
 delete mode 100755 examples/workspaces/appwrite-example/.booth/setups/appwrite-server--setup.sh
 delete mode 100755 examples/workspaces/deno-example/.booth/setups/deno-pkg--install.sh
 delete mode 100755 examples/workspaces/floci-example/.booth/setups/floci--setup.sh
 delete mode 100755 examples/workspaces/flutter-example/.booth/setups/flutter--setup.sh
 delete mode 100755 examples/workspaces/flutter-example/.booth/setups/flutter-android--setup.sh
 delete mode 100755 examples/workspaces/flutter-example/.booth/setups/flutter-code-extension--setup.sh
 delete mode 100755 examples/workspaces/flutter-example/.booth/setups/flutter-linux-desktop--setup.sh
 delete mode 100755 examples/workspaces/turtle-example/.booth/setups/cb-has-desktop.sh
 delete mode 100755 examples/workspaces/turtle-example/.booth/setups/logo--setup.sh
 delete mode 100755 examples/workspaces/turtle-example/.booth/setups/thonny--setup.sh
 delete mode 100755 examples/workspaces/wails-android-example/.booth/setups/wails--setup.sh
 delete mode 100755 examples/workspaces/wails-android-example/.booth/setups/wails-android--setup.sh
 delete mode 100755 examples/workspaces/wails-example/.booth/setups/wails--setup.sh

diff --git a/cli/src/pkg/booth/ensure_docker_image.go b/cli/src/pkg/booth/ensure_docker_image.go
index acc9d3dd..d7786bc8 100644
--- a/cli/src/pkg/booth/ensure_docker_image.go
+++ b/cli/src/pkg/booth/ensure_docker_image.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/nawaman/codingbooth/src/pkg/appctx"
 	"github.com/nawaman/codingbooth/src/pkg/boothfile"
@@ -249,6 +250,18 @@ func buildLocalImage(ctx appctx.AppContext) {
 			"--pull=false",
 		)))
 	}
+	// A --platform in common-args/run-args exists to force a specific
+	// architecture for the whole booth (e.g. an x86_64-only SDK under
+	// emulation on arm64), but it was only ever threaded into `docker run`.
+	// Building without it produces an image for the host's native arch, and
+	// `docker run --platform ...` then refuses to start it: the local image
+	// has no manifest for the platform it was asked to run under. Apply the
+	// same platform to the build so the image it produces actually matches.
+	if platform, ok := extractPlatformFlag(ctx.CommonArgs(), ctx.RunArgs()); ok {
+		args = args.ExtendByLists(ilist.NewList(ilist.NewList(
+			"--platform", platform,
+		)))
+	}
 	args = args.ExtendByLists(ilist.NewList(ilist.NewList(
 		"--build-arg", fmt.Sprintf("BOOTH_VARIANT_TAG=%s", ctx.Variant()),
 	)))
@@ -278,6 +291,27 @@ func buildLocalImage(ctx appctx.AppContext) {
 	}
 }
 
+// extractPlatformFlag scans the given argument groups (in order) for a
+// "--platform <value>" or "--platform=<value>" pair and returns the first
+// value found. Groups are flat docker CLI argument lists, e.g. common-args
+// or run-args from config.toml.
+func extractPlatformFlag(groupLists ...ilist.List[ilist.List[string]]) (string, bool) {
+	for _, groups := range groupLists {
+		for _, group := range groups.Slice() {
+			items := group.Slice()
+			for i, item := range items {
+				if item == "--platform" && i+1 < len(items) {
+					return items[i+1], true
+				}
+				if value, ok := strings.CutPrefix(item, "--platform="); ok {
+					return value, true
+				}
+			}
+		}
+	}
+	return "", false
+}
+
 // pullImageIfNeeded pulls the Docker image if needed.
 func pullImageIfNeeded(ctx appctx.AppContext) {
 	imageName := ctx.Image()
diff --git a/examples/workspaces/affine-example/.booth/setups/affine-server--setup.sh b/examples/workspaces/affine-example/.booth/setups/affine-server--setup.sh
deleted file mode 100755
index 242adc3a..00000000
--- a/examples/workspaces/affine-example/.booth/setups/affine-server--setup.sh
+++ /dev/null
@@ -1,411 +0,0 @@
-#!/bin/bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--port <port>] [--data clean|seed|persist]
-  $0 [PORT]
-
-Arguments:
-  --port PORT   AFFiNE web port (default: 13010)
-  --data MODE   clean (default): empty every booth
-                seed: restore ~/.affine (home-seed), do not dump back
-                persist: dump/restore ~/.affine (.booth/cache bind)
-
-Examples:
-  $0
-  $0 --port 3010 --data persist
-
-Prerequisites:
-- AFFiNE must be pre-installed at /opt/affine
-  (typically via COPY --from=ghcr.io/toeverything/affine:<tag> /app /opt/affine)
-- Node.js 22, PostgreSQL, and Redis at runtime (the template requires them)
-
-Notes:
-- Creates start-affine-server / stop-affine-server
-- The server is NOT started during build; add the autostart extension
-- persist requires +persist (cache-dirs bind). seed requires +seed (home-seed).
-USAGE
-}
-
-# ---- root check ----
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-
-# This script will always be installed by root.
-HOME=/root
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-# ---- defaults / args ----
-AFFINE_SERVER_PORT="13010"
-DATA_MODE="clean"
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --port) shift; AFFINE_SERVER_PORT="${1:-13010}"; shift ;;
-    --data) shift; DATA_MODE="${1:-clean}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *)
-      if [[ "$1" =~ ^[0-9]+$ ]]; then
-        AFFINE_SERVER_PORT="$1"; shift
-      else
-        echo "❌ Unknown arg: $1" >&2; usage; exit 2
-      fi
-      ;;
-  esac
-done
-DATA_MODE="$(echo "$DATA_MODE" | tr '[:upper:]' '[:lower:]')"
-case "$DATA_MODE" in
-  clean|seed|persist) ;;
-  *)
-    echo "⚠️  Unknown --data ${DATA_MODE}; using clean." >&2
-    DATA_MODE="clean"
-    ;;
-esac
-
-AFFINE_DIR="/opt/affine"
-PROFILE_FILE="/etc/profile.d/70-cb-affine-server--profile.sh"
-STARTER_FILE="/usr/local/bin/start-affine-server"
-STOPPER_FILE="/usr/local/bin/stop-affine-server"
-LIB_FILE="/usr/local/lib/cb-affine-data.sh"
-
-# ---- verify AFFiNE is present ----
-if [[ ! -f "$AFFINE_DIR/dist/main.js" ]]; then
-  echo "❌ AFFiNE Server not found at $AFFINE_DIR"
-  echo "   Use COPY --from=ghcr.io/toeverything/affine:<tag> /app /opt/affine"
-  exit 1
-fi
-
-# ---- Node.js 22 (native addons in the official image are built for it) ----
-need_node=1
-if command -v node >/dev/null 2>&1; then
-  NODE_MAJOR="$(node -v | sed 's/^v//' | cut -d. -f1)"
-  # Official image native addons are built for Node 22. Catalog nodejs now
-  # defaults to 24 (current LTS); a different major is an ABI mismatch.
-  if [[ "${NODE_MAJOR:-0}" -eq 22 ]]; then
-    echo "• Node.js already installed: $(node --version)"
-    need_node=0
-  else
-    echo "• Node.js $(node --version) is not 22 (Affine native addons need 22)"
-  fi
-fi
-if [[ "$need_node" -eq 1 ]]; then
-  SETUPS_DIR="/opt/codingbooth/setups"
-  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-  if [[ -x "$SETUPS_DIR/nodejs--setup.sh" ]]; then
-    echo "• Installing Node.js 22 ..."
-    "$SETUPS_DIR/nodejs--setup.sh" 22
-  elif [[ -x "$SCRIPT_DIR/nodejs--setup.sh" ]]; then
-    echo "• Installing Node.js 22 ..."
-    "$SCRIPT_DIR/nodejs--setup.sh" 22
-  else
-    echo "❌ nodejs--setup.sh not found (need Node.js 22)"
-    exit 1
-  fi
-fi
-
-# ---- runtime libraries (Prisma / official image) ----
-export DEBIAN_FRONTEND=noninteractive
-echo "• Installing OpenSSL (Prisma) ..."
-apt-get update
-apt-get install -y --no-install-recommends openssl ca-certificates
-
-# pgvector: official compose uses pgvector/pgvector. Indexer is off by default,
-# but CREATE EXTENSION vector still succeeds when the package is present.
-if command -v pg_config >/dev/null 2>&1; then
-  PG_VER="$(pg_config --version | grep -oE '[0-9]+' | head -1 || true)"
-  if [[ -n "$PG_VER" ]]; then
-    echo "• Installing postgresql-${PG_VER}-pgvector ..."
-    apt-get install -y --no-install-recommends "postgresql-${PG_VER}-pgvector" || \
-      echo "⚠️  postgresql-${PG_VER}-pgvector is not in this distro — continuing without it."
-  fi
-else
-  echo "⚠️  PostgreSQL not installed yet; pgvector skipped (select postgresql)."
-fi
-rm -rf /var/lib/apt/lists/*
-
-# Readable by the booth user; predeploy may write under /opt/affine.
-chmod -R a+rX "$AFFINE_DIR"
-if id coder >/dev/null 2>&1; then
-  chown -R coder:coder "$AFFINE_DIR" || true
-fi
-
-mkdir -p /usr/local/lib
-export BAKED_PORT="$AFFINE_SERVER_PORT"
-export BAKED_DATA="$DATA_MODE"
-envsubst '$BAKED_PORT $BAKED_DATA' <<'EOF' > "$LIB_FILE"
-# shellcheck shell=bash
-# Sourced by start-affine-server / stop-affine-server.
-
-cb_affine_init() {
-  PORT="${1:-${AFFINE_SERVER_PORT:-$BAKED_PORT}}"
-  AFFINE_DIR="/opt/affine"
-  DATA_DIR="${AFFINE_DATA_DIR:-$HOME/.affine}"
-  DUMP_FILE="${DATA_DIR}/dumps/affine.dump"
-  MODE="$(echo "${AFFINE_SERVER_DATA:-$BAKED_DATA}" | tr '[:upper:]' '[:lower:]')"
-  case "$MODE" in
-    clean|seed|persist) ;;
-    *) MODE="clean" ;;
-  esac
-  export NODE_ENV="${NODE_ENV:-production}"
-  export DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-selfhosted}"
-  export AFFINE_INDEXER_ENABLED="${AFFINE_INDEXER_ENABLED:-false}"
-  export PORT
-  export AFFINE_SERVER_PORT="$PORT"
-  export REDIS_SERVER_HOST="${REDIS_SERVER_HOST:-127.0.0.1}"
-  export REDIS_SERVER_PORT="${REDIS_SERVER_PORT:-6379}"
-  export PATH="/opt/affine/node_modules/.bin:${PATH}"
-  CUSER="${USER:-coder}"
-  export DATABASE_URL="${DATABASE_URL:-postgresql://${CUSER}@127.0.0.1:5432/affine}"
-}
-
-cb_affine_data_is_bind() {
-  local p="$DATA_DIR"
-  [[ -e "$p" ]] || return 1
-  awk -v p="$p" '$5 == p { found=1 } END { exit !found }' /proc/self/mountinfo 2>/dev/null
-}
-
-cb_affine_resolve_mode() {
-  if [[ "$MODE" == persist ]] && ! cb_affine_data_is_bind; then
-    echo "⚠️  AFFINE_SERVER_DATA=persist but ${DATA_DIR} is not a cache bind." >&2
-    echo "    Select affine-server+persist so cache-dirs mounts it. Using clean." >&2
-    MODE="clean"
-  fi
-}
-
-cb_affine_has_dump() {
-  [[ -s "$DUMP_FILE" ]]
-}
-
-cb_affine_ensure_db() {
-  createdb affine 2>/dev/null || true
-  psql -d affine -c "CREATE EXTENSION IF NOT EXISTS vector;" >/dev/null 2>&1 || \
-    echo "⚠️  pgvector extension not available — indexer stays disabled."
-}
-
-cb_affine_wipe_db() {
-  dropdb --if-exists affine >/dev/null 2>&1 || true
-  createdb affine 2>/dev/null || true
-  psql -d affine -c "CREATE EXTENSION IF NOT EXISTS vector;" >/dev/null 2>&1 || true
-}
-
-cb_affine_wipe_files() {
-  rm -rf "${DATA_DIR}/config" "${DATA_DIR}/storage" "${DATA_DIR}/dumps"
-}
-
-cb_affine_dump() {
-  mkdir -p "${DATA_DIR}/dumps"
-  if ! command -v pg_dump >/dev/null 2>&1; then
-    echo "⚠️  pg_dump not available; skip persist dump." >&2
-    return 0
-  fi
-  if psql -d affine -c 'SELECT 1' >/dev/null 2>&1; then
-    echo "Dumping AFFiNE database to ${DUMP_FILE} ..."
-    pg_dump -Fc affine > "$DUMP_FILE"
-  fi
-}
-
-cb_affine_restore() {
-  [[ -s "$DUMP_FILE" ]] || return 1
-  echo "Restoring AFFiNE database from ${DUMP_FILE} ..."
-  cb_affine_wipe_db
-  pg_restore -d affine --no-owner --role="${USER:-coder}" "$DUMP_FILE" >/dev/null 2>&1 || \
-    pg_restore -d affine "$DUMP_FILE" >/dev/null 2>&1 || true
-}
-
-cb_affine_wait_deps() {
-  if command -v redis-server >/dev/null 2>&1 && ! redis-cli ping >/dev/null 2>&1; then
-    mkdir -p "${HOME}/.redis/data" "${HOME}/.redis/log"
-    echo "• Starting Redis ..."
-    redis-server --dir "${HOME}/.redis/data" --daemonize yes \
-      --logfile "${HOME}/.redis/log/redis.log"
-  fi
-  echo "• Waiting for PostgreSQL and Redis ..."
-  local i pg_ok rd_ok
-  for i in $(seq 1 60); do
-    pg_ok=0; rd_ok=0
-    if command -v pg_isready >/dev/null 2>&1 && pg_isready -q; then pg_ok=1; fi
-    if command -v redis-cli >/dev/null 2>&1 && redis-cli ping >/dev/null 2>&1; then rd_ok=1; fi
-    if [[ "$pg_ok" -eq 1 && "$rd_ok" -eq 1 ]]; then return 0; fi
-    sleep 1
-  done
-  echo "❌ PostgreSQL and Redis must be running." >&2
-  pg_isready || true
-  redis-cli ping || true
-  return 1
-}
-
-cb_affine_prepare_files() {
-  mkdir -p "${DATA_DIR}/config" "${DATA_DIR}/storage"
-  local cfg="${DATA_DIR}/config/config.json"
-  if [[ ! -f "$cfg" ]]; then
-    cat > "$cfg" <<JSON
-{
-  "server": {
-    "name": "AFFiNE (CodingBooth)",
-    "externalUrl": "http://localhost:${PORT}"
-  },
-  "copilot": {
-    "enabled": true,
-    "byok": {
-      "enabled": true
-    }
-  }
-}
-JSON
-  fi
-  if [[ ! -f "${DATA_DIR}/config/private.key" ]]; then
-    openssl ecparam -name prime256v1 -genkey -noout \
-      -out "${DATA_DIR}/config/private.key"
-  fi
-}
-
-cb_affine_migrate() {
-  echo "• Running AFFiNE predeploy (migrations) ..."
-  cd "$AFFINE_DIR"
-  prisma migrate deploy
-  SERVER_FLAVOR=script node ./dist/main.js run
-}
-
-cb_affine_stop_server() {
-  local pid
-  pid="$(pgrep -f '/opt/affine/dist/main.js' || true)"
-  if [[ -n "$pid" ]]; then
-    kill $pid 2>/dev/null || true
-    sleep 1
-    kill -9 $pid 2>/dev/null || true
-  fi
-}
-EOF
-chmod 644 "$LIB_FILE"
-
-cat > "${PROFILE_FILE}" <<PROFILE
-# AFFiNE Server environment
-export AFFINE_SERVER_HOME="${AFFINE_DIR}"
-export AFFINE_SERVER_PORT="${AFFINE_SERVER_PORT}"
-export AFFINE_SERVER_URL="http://localhost:${AFFINE_SERVER_PORT}"
-export AFFINE_SERVER_DATA="${DATA_MODE}"
-
-affine-server--info() {
-  echo "AFFiNE Server"
-  echo "  Home:    ${AFFINE_DIR}"
-  echo "  Port:    ${AFFINE_SERVER_PORT}"
-  echo "  Data:    ${DATA_MODE}  (clean | seed via +seed | persist via +persist)"
-  echo "  Starter: ${STARTER_FILE}"
-  echo "  Stopper: ${STOPPER_FILE}"
-  echo "  URL:     http://localhost:${AFFINE_SERVER_PORT}"
-  echo "  Tree:    \$HOME/.affine"
-}
-PROFILE
-chmod 644 "${PROFILE_FILE}"
-
-cat > "${STARTER_FILE}" <<'STARTER'
-#!/usr/bin/env bash
-set -euo pipefail
-# shellcheck disable=SC1091
-source /usr/local/lib/cb-affine-data.sh
-cb_affine_init "${1:-}"
-cb_affine_resolve_mode
-
-if [[ ! -f "$AFFINE_DIR/dist/main.js" ]]; then
-  echo "❌ AFFiNE Server is not installed at $AFFINE_DIR" >&2
-  exit 1
-fi
-
-cb_affine_wait_deps
-
-echo "Starting AFFiNE on http://localhost:${PORT} (data=${MODE})"
-mkdir -p "$DATA_DIR"
-
-case "$MODE" in
-  clean)
-    cb_affine_wipe_files
-    cb_affine_wipe_db
-    redis-cli FLUSHDB >/dev/null 2>&1 || true
-    cb_affine_ensure_db
-    cb_affine_prepare_files
-    cb_affine_migrate
-    ;;
-  seed)
-    cb_affine_wipe_db
-    if cb_affine_has_dump; then
-      cb_affine_restore
-    else
-      cb_affine_ensure_db
-    fi
-    cb_affine_prepare_files
-    cb_affine_migrate
-    ;;
-  persist)
-    if cb_affine_has_dump; then
-      cb_affine_restore
-    else
-      cb_affine_ensure_db
-    fi
-    cb_affine_prepare_files
-    cb_affine_migrate
-    ;;
-esac
-
-echo "  Admin setup (first visit): http://localhost:${PORT}/admin/setup"
-echo "  Host browser: http://localhost:${PORT}/  (globe pane cannot load /admin/js/)"
-
-node ./dist/main.js &
-affine_pid=$!
-trap 'kill "$affine_pid" 2>/dev/null || true; [[ "$MODE" == persist ]] && cb_affine_dump; exit 0' TERM INT
-wait "$affine_pid" || true
-[[ "$MODE" == persist ]] && cb_affine_dump
-STARTER
-chmod 755 "${STARTER_FILE}"
-
-cat > "${STOPPER_FILE}" <<'STOPPER'
-#!/usr/bin/env bash
-set -euo pipefail
-# shellcheck disable=SC1091
-source /usr/local/lib/cb-affine-data.sh
-cb_affine_init "${1:-}"
-cb_affine_resolve_mode
-cb_affine_stop_server
-if [[ "$MODE" == persist ]]; then
-  echo "Dumping AFFiNE data to ${DATA_DIR} ..."
-  cb_affine_dump
-  echo "AFFiNE data saved (persist)."
-fi
-echo "AFFiNE Server stopped."
-STOPPER
-chmod 755 "${STOPPER_FILE}"
-
-# ---- summary ----
-echo ""
-# Register a desktop icon that opens AFFiNE in a browser (desktop variants only).
-ICON="applications-internet"
-for candidate in favicon.svg favicon.ico icon.png logo.png; do
-  found="$(find "$AFFINE_DIR/static" -maxdepth 3 -name "$candidate" -print -quit 2>/dev/null || true)"
-  if [ -n "$found" ]; then ICON="$found"; break; fi
-done
-cb-web-icon.sh --id affine-server --name "AFFiNE" --icon "$ICON" \
-  --port-env AFFINE_SERVER_PORT --port "${AFFINE_SERVER_PORT}" \
-  --path / --start start-affine-server
-
-echo "✅ AFFiNE Server installed."
-echo "   Location: ${AFFINE_DIR}"
-echo "   Port:     ${AFFINE_SERVER_PORT}"
-echo "   Data:     ${DATA_MODE}"
-echo "   Starter:  ${STARTER_FILE}"
-echo "   Stopper:  ${STOPPER_FILE}"
-echo ""
-echo "ℹ️ Ready to use:"
-echo "   start-affine-server [PORT]"
-echo "   stop-affine-server"
-echo "   Access: http://localhost:${AFFINE_SERVER_PORT}/admin/setup"
-echo "   Host browser (not the globe pane): http://localhost:${AFFINE_SERVER_PORT}/"
-echo "   Data: ${DATA_MODE}  (clean | +seed | +persist)"
-echo "   Add +autostart to run it on boot, +expose to reach it from the host."
diff --git a/examples/workspaces/affine-example/.booth/setups/postgresql--setup.sh b/examples/workspaces/affine-example/.booth/setups/postgresql--setup.sh
deleted file mode 100755
index 6c7f8412..00000000
--- a/examples/workspaces/affine-example/.booth/setups/postgresql--setup.sh
+++ /dev/null
@@ -1,137 +0,0 @@
-#!/bin/bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-set -Eeuo pipefail
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <ver>]
-
-Examples:
-  $0                   # install default PostgreSQL
-  $0 --version 16      # pin to PostgreSQL 16
-
-Notes:
-- Installs PostgreSQL server + client via apt
-- The server is NOT started during build (Docker best practice)
-- A startup script auto-initializes and starts the server on container start
-USAGE
-}
-
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (use sudo)"; exit 1; }
-
-PG_VERSION=""
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) shift; PG_VERSION="${1:-}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "❌ Unknown arg: $1"; usage; exit 2 ;;
-  esac
-done
-
-# "latest" means "whatever the distro ships" — same as passing nothing. Without
-# this it would reach apt as the literal package name "postgresql-latest".
-[[ "$PG_VERSION" == "latest" ]] && PG_VERSION=""
-
-export DEBIAN_FRONTEND=noninteractive
-echo "📦 Installing PostgreSQL ..."
-apt-get update
-
-if [[ -n "$PG_VERSION" ]]; then
-  apt-get install -y --no-install-recommends \
-    "postgresql-${PG_VERSION}" "postgresql-client-${PG_VERSION}" libpq-dev
-else
-  apt-get install -y --no-install-recommends \
-    postgresql postgresql-client libpq-dev
-fi
-
-rm -rf /var/lib/apt/lists/*
-
-# --- build-time: create CodingBooth PostgreSQL config files ---
-CB_PG_CONF_DIR="/opt/codingbooth/postgresql"
-mkdir -p "$CB_PG_CONF_DIR"
-
-cat > "$CB_PG_CONF_DIR/pg_hba.conf" <<'PGHBA'
-# CodingBooth: trust local connections (dev environment)
-local   all   all                 trust
-host    all   all   127.0.0.1/32  trust
-host    all   all   ::1/128       trust
-PGHBA
-
-cat > "$CB_PG_CONF_DIR/postgresql-booth.conf" <<'PGCONF'
-# CodingBooth: PostgreSQL overrides for dev environment
-listen_addresses = 'localhost'
-PGCONF
-
-# --- startup script: init DB cluster and start server ---
-STARTUP_FILE="/usr/share/startup.d/50-cb-postgresql--startup.sh"
-install -d "$(dirname "$STARTUP_FILE")"
-cat >"$STARTUP_FILE" <<'STARTUP'
-#!/usr/bin/env bash
-set -euo pipefail
-
-CB_PG_CONF_DIR="/opt/codingbooth/postgresql"
-
-# Find the installed PG version
-PG_VER=$(pg_config --version 2>/dev/null | grep -oP '\d+' | head -1)
-PG_DATA="/var/lib/postgresql/${PG_VER}/main"
-
-# booth-pgdata is a named volume reused across booths. The postgres UID in
-# the image can drift (this image is 100; an older one left the volume at
-# 112). A 0700 data dir owned by the old UID makes `cp pg_hba.conf` fail
-# with "Permission denied" and, under booth-entry's set -e, takes the
-# booth down before anything else starts.
-if [ -d /var/lib/postgresql ]; then
-  if [ -d "$PG_DATA" ]; then
-    sudo -u postgres test -r "$PG_DATA" 2>/dev/null || \
-      sudo chown -R postgres:postgres /var/lib/postgresql
-  else
-    sudo -u postgres test -w /var/lib/postgresql 2>/dev/null || \
-      sudo chown -R postgres:postgres /var/lib/postgresql
-  fi
-fi
-
-# Initialize cluster if not exists
-if [ ! -d "$PG_DATA" ] || [ ! -f "$PG_DATA/PG_VERSION" ]; then
-  sudo -u postgres /usr/lib/postgresql/${PG_VER}/bin/initdb -D "$PG_DATA" 2>/dev/null || true
-fi
-
-# Stale pid from another container that last used this volume
-if [ -f "$PG_DATA/postmaster.pid" ]; then
-  if ! sudo -u postgres /usr/lib/postgresql/${PG_VER}/bin/pg_ctl -D "$PG_DATA" status >/dev/null 2>&1; then
-    sudo rm -f "$PG_DATA/postmaster.pid"
-  fi
-fi
-
-# Apply CodingBooth configs (idempotent)
-if [ -f "$CB_PG_CONF_DIR/pg_hba.conf" ]; then
-  sudo -u postgres cp "$CB_PG_CONF_DIR/pg_hba.conf" "$PG_DATA/pg_hba.conf"
-fi
-if [ -f "$CB_PG_CONF_DIR/postgresql-booth.conf" ] && \
-   ! grep -q "include 'postgresql-booth.conf'" "$PG_DATA/postgresql.conf" 2>/dev/null; then
-  sudo -u postgres cp "$CB_PG_CONF_DIR/postgresql-booth.conf" "$PG_DATA/postgresql-booth.conf"
-  echo "include 'postgresql-booth.conf'" | sudo -u postgres tee -a "$PG_DATA/postgresql.conf" > /dev/null
-fi
-
-# Start server
-sudo -u postgres /usr/lib/postgresql/${PG_VER}/bin/pg_ctl \
-  -D "$PG_DATA" -l /var/log/postgresql/postgresql.log start 2>/dev/null || true
-
-# Create a user matching the container user (if not exists)
-CUSER="${USER:-coder}"
-sudo -u postgres psql -tc "SELECT 1 FROM pg_roles WHERE rolname='${CUSER}'" 2>/dev/null \
-  | grep -q 1 \
-  || sudo -u postgres createuser -s "${CUSER}" 2>/dev/null || true
-STARTUP
-chmod 755 "$STARTUP_FILE"
-
-INSTALLED_VERSION=$(pg_config --version 2>/dev/null || echo "unknown")
-echo ""
-echo "✅ ${INSTALLED_VERSION} installed."
-echo "   Server auto-starts on container boot via startup script."
-echo ""
-echo "ℹ️ Ready to use: psql, createdb, pg_dump"
diff --git a/examples/workspaces/anythingllm-example/.booth/setups/anythingllm--setup.sh b/examples/workspaces/anythingllm-example/.booth/setups/anythingllm--setup.sh
deleted file mode 100755
index 49c3d095..00000000
--- a/examples/workspaces/anythingllm-example/.booth/setups/anythingllm--setup.sh
+++ /dev/null
@@ -1,439 +0,0 @@
-#!/bin/bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <tag>] [--port <port>]
-  $0 [PORT]
-
-Arguments:
-  --version TAG  Image tag that was copied in (default: 1.16.1; display only)
-  --port PORT    Port for the AnythingLLM web UI (default: 3001)
-
-Examples:
-  $0
-  $0 --port 13001
-  $0 --version 1.16.1 --port 3001
-
-Prerequisites:
-- AnythingLLM must be pre-installed at /opt/anythingllm
-  (typically via COPY --from=mintplexlabs/anythingllm:<tag> /app /opt/anythingllm)
-
-Notes:
-- Creates a starter script at /usr/local/bin/start-anythingllm
-- The server is NOT started during build; add the autostart extension
-- Workspaces, documents, and the SQLite DB live in ~/.anythingllm
-  (STORAGE_DIR, default ~/.anythingllm; +persist bind-mounts it)
-- AUTH_TOKEN is the single-user password. Empty/unset = no login
-  (+passwordless). JWT_SECRET is set when a password is enabled.
-- start-anythingllm sets SERVER_PORT and ANYTHING_LLM_RUNTIME=docker
-  (filesystem agent is hidden unless RUNTIME is docker)
-- Pair with ollama+autostart and point the UI at http://127.0.0.1:11434
-- Host LM Studio: http://host.docker.internal:1234/v1 (not localhost)
-- AnythingLLM web UI is accessible at http://localhost:<PORT>
-USAGE
-}
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-# ---- root check ----
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-
-# This script will always be installed by root.
-HOME=/root
-
-# ---- defaults / args ----
-VERSION="1.16.1"
-ANYTHINGLLM_PORT="3001"
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) shift; VERSION="${1:-1.16.1}"; shift ;;
-    --port)    shift; ANYTHINGLLM_PORT="${1:-3001}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *)
-      if [[ "$1" =~ ^[0-9]+$ ]]; then
-        ANYTHINGLLM_PORT="$1"; shift
-      else
-        echo "❌ Unknown arg: $1" >&2; usage; exit 2
-      fi
-      ;;
-  esac
-done
-VERSION="${VERSION#v}"
-
-ANYTHINGLLM_DIR="/opt/anythingllm"
-PROFILE_FILE="/etc/profile.d/70-cb-anythingllm--profile.sh"
-STARTUP_FILE="/usr/share/startup.d/70-cb-anythingllm--startup.sh"
-STARTER_FILE="/usr/local/bin/start-anythingllm"
-
-# ---- verify AnythingLLM is present ----
-if [[ ! -f "$ANYTHINGLLM_DIR/server/index.js" ]]; then
-  echo "❌ AnythingLLM not found at $ANYTHINGLLM_DIR"
-  echo "   Use COPY --from=mintplexlabs/anythingllm:<version> /app /opt/anythingllm"
-  exit 1
-fi
-
-# ---- Node.js 18 (native addons in the official image are built for it) ----
-need_node=1
-if command -v node >/dev/null 2>&1; then
-  NODE_MAJOR="$(node -v | sed 's/^v//' | cut -d. -f1)"
-  # Official image native addons are built for Node 18. Catalog nodejs now
-  # defaults to 24 (current LTS); a different major is an ABI mismatch.
-  if [[ "${NODE_MAJOR:-0}" -eq 18 ]]; then
-    echo "• Node.js already installed: $(node --version)"
-    need_node=0
-  else
-    echo "• Node.js $(node --version) is not 18 (AnythingLLM native addons need 18)"
-  fi
-fi
-if [[ "$need_node" -eq 1 ]]; then
-  SETUPS_DIR="/opt/codingbooth/setups"
-  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-  if [[ -x "$SETUPS_DIR/nodejs--setup.sh" ]]; then
-    echo "• Installing Node.js 18 ..."
-    "$SETUPS_DIR/nodejs--setup.sh" 18
-  elif [[ -x "$SCRIPT_DIR/nodejs--setup.sh" ]]; then
-    echo "• Installing Node.js 18 ..."
-    "$SCRIPT_DIR/nodejs--setup.sh" 18
-  else
-    echo "❌ nodejs--setup.sh not found (need Node.js 18)"
-    exit 1
-  fi
-fi
-
-# ---- runtime libraries ----
-export DEBIAN_FRONTEND=noninteractive
-echo "• Installing OpenSSL (Prisma) ..."
-apt-get update
-apt-get install -y --no-install-recommends openssl ca-certificates
-
-# Puppeteer / ffmpeg only pay off on a real image (prisma schema present).
-# A fixture used by tests has server/index.js and nothing else.
-if [[ -f "$ANYTHINGLLM_DIR/server/prisma/schema.prisma" ]]; then
-  echo "• Installing ffmpeg and Chromium runtime libraries ..."
-  apt-get install -y --no-install-recommends \
-    ffmpeg \
-    fonts-liberation \
-    libasound2t64 \
-    libatk1.0-0 \
-    libcups2 \
-    libgbm1 \
-    libnss3 \
-    libpango-1.0-0 \
-    libcairo2 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxfixes3 \
-    libxrandr2 \
-    libxkbcommon0 || \
-    echo "⚠️  Some Chromium/ffmpeg packages were unavailable — URL scraping may fail."
-fi
-rm -rf /var/lib/apt/lists/*
-
-# Readable by the booth user; prisma generate may write under /opt/anythingllm.
-chmod -R a+rX "$ANYTHINGLLM_DIR"
-if id coder >/dev/null 2>&1; then
-  chown -R coder:coder "$ANYTHINGLLM_DIR" || true
-fi
-
-# ---- SPA basename: host `/` and globe pane `/proxy/<port>` both work ----
-# AnythingLLM's createBrowserRouter defaults to basename "/". The booth globe
-# pane loads the app at /proxy/<port>/, which is not a route, so React 404s.
-# Detect that prefix at runtime and pass it as basename. Host tabs stay "/".
-if [[ -f "$ANYTHINGLLM_DIR/server/public/index.js" ]]; then
-  echo "• Patching AnythingLLM SPA basename for the booth globe pane ..."
-  node - "$ANYTHINGLLM_DIR" <<'PATCH'
-const fs = require("fs");
-const path = require("path");
-const root = process.argv[2];
-const snippet =
-  '<script>window.__CB_BASENAME__=(function(){var p=String(location.pathname||"").split("/");if(p[1]==="proxy"&&/^[0-9]+$/.test(p[2]||""))return "/proxy/"+p[2];return "/";})();(function(){var B=window.__CB_BASENAME__;if(!B||B==="/")return;function prefix(u){if(typeof u!=="string"||u.charAt(0)!=="/"||u.charAt(1)==="/")return u;if(u.indexOf(B)===0||u.indexOf("/proxy/")===0)return u;if(u.indexOf("/booth")===0||u.indexOf("/s1")===0||u.indexOf("/s2")===0||u.indexOf("/s3")===0||u.indexOf("/s4")===0)return u;if(u.indexOf("/__booth")===0||u.indexOf("/booth-messages")===0)return u;return (B.charAt(B.length-1)==="/" ? B.slice(0,-1) : B)+u;}try{var proto=Object.getPrototypeOf(window.location);var desc=Object.getOwnPropertyDescriptor(proto,"href")||Object.getOwnPropertyDescriptor(Location.prototype,"href");if(desc&&desc.set){Object.defineProperty(proto,"href",{configurable:true,enumerable:true,get:desc.get,set:function(v){desc.set.call(this,prefix(v));}});}}catch(e){}try{var asg=window.location.assign.bind(window.location);var rep=window.location.replace.bind(window.location);window.location.assign=function(u){return asg(prefix(u));};window.location.replace=function(u){return rep(prefix(u));};}catch(e){}document.addEventListener("click",function(e){var el=e.target&&e.target.closest&&e.target.closest("a");if(!el)return;var h=el.getAttribute("href");if(!h)return;var p=prefix(h);if(p!==h)el.setAttribute("href",p);},true);})();</script>\n';
-const scriptTag = '<script type="module" crossorigin src="/index.js"></script>';
-const snippetRe =
-  /<script>window\.__CB_BASENAME__=[\s\S]*?<\/script>\n?/;
-
-function skipString(src, index) {
-  const quote = src[index];
-  index += 1;
-  while (index < src.length) {
-    if (src[index] === "\\") {
-      index += 2;
-      continue;
-    }
-    if (src[index] === quote) return index + 1;
-    index += 1;
-  }
-  return index;
-}
-
-function matchBracket(src, index) {
-  const open = src[index];
-  const close = open === "[" ? "]" : open === "{" ? "}" : ")";
-  let depth = 1;
-  index += 1;
-  while (index < src.length && depth > 0) {
-    const char = src[index];
-    if (char === '"' || char === "'" || char === "`") {
-      index = skipString(src, index);
-      continue;
-    }
-    if (char === open) depth += 1;
-    else if (char === close) depth -= 1;
-    if (depth > 0) index += 1;
-  }
-  return index;
-}
-
-function patchBundle(file) {
-  let js = fs.readFileSync(file, "utf8");
-  const notes = [];
-  if (!js.includes('basename:(typeof window!="undefined"&&window.__CB_BASENAME__)')) {
-    const match = js.match(/=\w+\(\[\{path:"\/",element:/);
-    if (!match) throw new Error("createBrowserRouter call not found in " + file);
-    const paren = js.indexOf("(", match.index);
-    if (js[paren + 1] !== "[") throw new Error("router first arg is not an array");
-    const closeArray = matchBracket(js, paren + 1);
-    const closeCall = closeArray + 1;
-    if (js[closeCall] !== ")") throw new Error("router call close not found");
-    const insert =
-      ',{basename:(typeof window!="undefined"&&window.__CB_BASENAME__)||"/"}';
-    js = js.slice(0, closeCall) + insert + js.slice(closeCall);
-    notes.push("basename");
-  }
-  const withApi = js.replace(
-    /=\{\}\.VITE_API_BASE\|\|"\/api"/,
-    '=(typeof window!="undefined"&&window.__CB_BASENAME__&&window.__CB_BASENAME__!=="/"?window.__CB_BASENAME__+"/api":"/api")'
-  );
-  if (withApi !== js) {
-    js = withApi;
-    notes.push("api-base");
-  }
-  const withHome = js.replace(
-    /window\.location\.href=\w+\.home\(\)/g,
-    'window.location.href=(window.__CB_BASENAME__&&window.__CB_BASENAME__!=="/"?window.__CB_BASENAME__+"/":"/")'
-  );
-  if (withHome !== js) {
-    js = withHome;
-    notes.push("home-nav");
-  }
-  const withWs = js.replace(
-    'E==="/api"?`${e}//${window.location.host}`:`${e}//${new URL({}.VITE_API_BASE).host}`',
-    '`${e}//${window.location.host}`'
-  );
-  if (withWs !== js) {
-    js = withWs;
-    notes.push("ws-host");
-  }
-  fs.writeFileSync(file, js);
-  return notes.length ? "bundle patched (" + notes.join(", ") + ")" : "bundle already patched";
-}
-
-function patchHtml(file) {
-  if (!fs.existsSync(file)) return path.basename(file) + " missing";
-  let html = fs.readFileSync(file, "utf8");
-  if (snippetRe.test(html)) {
-    fs.writeFileSync(file, html.replace(snippetRe, snippet));
-    return path.basename(file) + " snippet refreshed";
-  }
-  if (!html.includes(scriptTag)) throw new Error("index.js script tag not found in " + file);
-  fs.writeFileSync(file, html.replace(scriptTag, snippet + "            " + scriptTag));
-  return path.basename(file) + " patched";
-}
-
-console.log("  " + patchBundle(path.join(root, "server/public/index.js")));
-console.log("  " + patchHtml(path.join(root, "server/utils/boot/MetaGenerator.js")));
-console.log("  " + patchHtml(path.join(root, "server/public/_index.html")));
-PATCH
-fi
-
-# ---- profile ----
-export BAKED_PORT="$ANYTHINGLLM_PORT"
-export BAKED_VERSION="$VERSION"
-envsubst '$BAKED_PORT $BAKED_VERSION' <<'EOF' > "$PROFILE_FILE"
-# AnythingLLM environment
-export ANYTHINGLLM_HOME="/opt/anythingllm"
-export ANYTHINGLLM_PORT="${ANYTHINGLLM_PORT:-$BAKED_PORT}"
-export ANYTHINGLLM_VERSION="${ANYTHINGLLM_VERSION:-$BAKED_VERSION}"
-
-anythingllm--info() {
-  echo "AnythingLLM"
-  echo "  Home:    /opt/anythingllm"
-  echo "  Version: ${ANYTHINGLLM_VERSION}"
-  echo "  Port:    ${ANYTHINGLLM_PORT}"
-  echo "  Data:    ${STORAGE_DIR:-$HOME/.anythingllm}"
-  echo "  Starter: /usr/local/bin/start-anythingllm"
-  echo "  URL:     http://localhost:${ANYTHINGLLM_PORT}"
-}
-EOF
-chmod 644 "$PROFILE_FILE"
-
-# ---- startup: data dir for workspaces / SQLite / documents ----
-mkdir -p "$(dirname "$STARTUP_FILE")"
-cat > "$STARTUP_FILE" <<'STARTUP'
-#!/usr/bin/env bash
-# AnythingLLM startup — data dir, and keep globe-pane /login on the app
-set -euo pipefail
-mkdir -p "${STORAGE_DIR:-$HOME/.anythingllm}"
-
-# start-ttyd-split writes this from the base image. Until that image has the
-# pane-referer /login redirect, patch it here so AnythingLLM's
-# window.location="/login" does not nest the booth console in the iframe.
-NGINX_CONF="/tmp/ttyd-split.nginx.conf"
-if [[ -f "$NGINX_CONF" ]]; then
-  node - "$NGINX_CONF" <<'JS' || true
-const fs = require("fs");
-const file = process.argv[2];
-let text = fs.readFileSync(file, "utf8");
-let changed = false;
-const loginNeedle = "        location = /login {\n";
-const loginInsert = loginNeedle
-  + "            if ($cb_proxy_ref != \"\") {\n"
-  + "                return 302 /proxy/$cb_proxy_ref/login$is_args$args;\n"
-  + "            }\n";
-if (text.includes(loginNeedle) && !text.includes("proxy/$cb_proxy_ref/login")) {
-  text = text.replace(loginNeedle, loginInsert);
-  changed = true;
-}
-const rootNeedle = "        location / {\n            if ($booth_auth_ok = 0) {\n                return 302 /login;\n            }\n            try_files $uri $uri/ @cb_root;\n        }\n";
-const rootInsert = "        location = / {\n            if ($booth_auth_ok = 0) {\n                return 302 /login;\n            }\n            if ($cb_proxy_ref != \"\") {\n                return 302 /proxy/$cb_proxy_ref/;\n            }\n            rewrite ^ /index.html last;\n        }\n\n" + rootNeedle;
-if (text.includes(rootNeedle) && !text.includes("location = / {")) {
-  text = text.replace(rootNeedle, rootInsert);
-  changed = true;
-}
-const apiNeedle = "        location ^~ /v1/ {\n";
-const apiBlock = [
-  "        location ^~ /api/ {",
-  "            if ($booth_auth_ok = 0) {",
-  "                return 302 /login;",
-  "            }",
-  "            set $cb_up $cookie_cb_proxy_port;",
-  "            if ($cb_up = \"\") {",
-  "                set $cb_up $cb_proxy_ref;",
-  "            }",
-  "            if ($cb_up = \"\") {",
-  "                return 404;",
-  "            }",
-  "            proxy_pass http://127.0.0.1:$cb_up;",
-  "            proxy_http_version 1.1;",
-  "            proxy_set_header Upgrade $http_upgrade;",
-  "            proxy_set_header Connection $connection_upgrade;",
-  "            proxy_set_header Host $host;",
-  "            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;",
-  "            proxy_set_header Accept-Encoding \"\";",
-  "            proxy_read_timeout 24h;",
-  "            proxy_buffering off;",
-  "            proxy_hide_header X-Frame-Options;",
-  "            proxy_hide_header Content-Security-Policy;",
-  "        }",
-  "",
-  "",
-].join("\n");
-if (text.includes(apiNeedle) && !text.includes("location ^~ /api/")) {
-  text = text.replace(apiNeedle, apiBlock + apiNeedle);
-  changed = true;
-}
-if (changed) fs.writeFileSync(file, text);
-JS
-  nginx -t -c "$NGINX_CONF" >/dev/null 2>&1 && nginx -s reload >/dev/null 2>&1 || true
-fi
-STARTUP
-chmod 755 "$STARTUP_FILE"
-
-# ---- starter ----
-export BAKED_PORT="$ANYTHINGLLM_PORT"
-envsubst '$BAKED_PORT' <<'EOF' > "$STARTER_FILE"
-#!/usr/bin/env bash
-set -euo pipefail
-
-PORT="${1:-${ANYTHINGLLM_PORT:-$BAKED_PORT}}"
-APP="/opt/anythingllm"
-STORAGE_DIR="${STORAGE_DIR:-$HOME/.anythingllm}"
-
-export SERVER_PORT="$PORT"
-export STORAGE_DIR
-export NODE_ENV="${NODE_ENV:-production}"
-# Official image sets this; filesystem and create-files agent skills
-# are hidden unless it is "docker".
-export ANYTHING_LLM_RUNTIME="${ANYTHING_LLM_RUNTIME:-docker}"
-export CHECKPOINT_DISABLE=1
-# Document scraping uses Puppeteer; skip the Chromium sandbox so we do not
-# need Docker's SYS_ADMIN capability inside the booth.
-export ANYTHINGLLM_CHROMIUM_ARGS="${ANYTHINGLLM_CHROMIUM_ARGS:---no-sandbox,--disable-setuid-sandbox}"
-
-mkdir -p "$STORAGE_DIR"
-
-if [[ ! -f "$APP/server/index.js" ]]; then
-  echo "❌ AnythingLLM not found at $APP/server/index.js" >&2
-  exit 1
-fi
-
-echo "Starting AnythingLLM on http://localhost:$PORT ..."
-echo "  storage: $STORAGE_DIR"
-
-cd "$APP/server"
-if [[ -f prisma/schema.prisma ]]; then
-  npx prisma generate --schema=./prisma/schema.prisma
-  npx prisma migrate deploy --schema=./prisma/schema.prisma
-fi
-
-if [[ -f "$APP/collector/index.js" ]]; then
-  node "$APP/server/index.js" &
-  node "$APP/collector/index.js" &
-  wait -n
-  exit $?
-fi
-
-exec node "$APP/server/index.js"
-EOF
-chmod 755 "$STARTER_FILE"
-
-# ---- desktop icon (no-op off-desktop) ----
-ICON="applications-internet"
-for cand in \
-  "$ANYTHINGLLM_DIR/server/public/favicon.png" \
-  "$ANYTHINGLLM_DIR/server/public/favicon.ico" \
-  "$ANYTHINGLLM_DIR/server/public/anything-llm.png"; do
-  if [[ -f "$cand" ]]; then
-    ICON="$cand"
-    break
-  fi
-done
-
-echo ""
-cb-web-icon.sh --id anythingllm --name "AnythingLLM" --icon "$ICON" \
-  --port-env ANYTHINGLLM_PORT --port "${ANYTHINGLLM_PORT}" \
-  --path / --start start-anythingllm
-
-echo "✅ AnythingLLM installed."
-echo "   Location:  ${ANYTHINGLLM_DIR}"
-echo "   Version:   ${VERSION}"
-echo "   Port:      ${ANYTHINGLLM_PORT}"
-echo "   Starter:   ${STARTER_FILE}"
-echo ""
-echo "ℹ️ Ready to use:"
-cat <<READY
-- Start the UI:     start-anythingllm
-- Open:             http://localhost:${ANYTHINGLLM_PORT}
-- Data directory:   ~/.anythingllm  (STORAGE_DIR)
-- Password:         AUTH_TOKEN (empty = no login; +passwordless)
-- Local models:     ollama+autostart → http://127.0.0.1:11434
-- Host LM Studio:   http://host.docker.internal:1234/v1
-- Persist data:     anythingllm+persist (binds ~/.anythingllm from .booth/cache)
-- Project files:    anythingllm+project-fs (jail at ~/.anythingllm/anythingllm-fs/code)
-
-- Params: ANYTHINGLLM_VERSION, ANYTHINGLLM_PORT, ANYTHINGLLM_HOST_PORT (+expose)
-- The server does not start on its own — add +autostart, or run start-anythingllm.
-- +expose publishes the port on the host.
-- +passwordless skips the login password (AUTH_TOKEN empty).
-- +project-fs is not persist: persist keeps AnythingLLM data; the project is already the host folder.
-- See: https://docs.anythingllm.com/
-READY
diff --git a/examples/workspaces/appwrite-example/.booth/setups/appwrite-cli--setup.sh b/examples/workspaces/appwrite-example/.booth/setups/appwrite-cli--setup.sh
deleted file mode 100755
index 21a51b5c..00000000
--- a/examples/workspaces/appwrite-example/.booth/setups/appwrite-cli--setup.sh
+++ /dev/null
@@ -1,96 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# appwrite-cli--setup.sh — Install the Appwrite CLI from GitHub releases
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <X.Y.Z>|latest]
-
-Examples:
-  $0                           # install latest Appwrite CLI
-  $0 --version 27.3.0          # pin a specific CLI version
-
-Notes:
-- Installs the official Appwrite CLI (appwrite) from appwrite/sdk-for-cli
-- Talks to Appwrite Cloud or a self-hosted instance (see setup appwrite-server)
-- Supports amd64 and arm64
-USAGE
-}
-
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-
-REQ_VER="latest"
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) shift; REQ_VER="${1:-latest}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "❌ Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-REQ_VER="${REQ_VER#v}"
-
-dpkgArch="$(dpkg --print-architecture)"
-case "$dpkgArch" in
-  amd64) ASSET_ARCH="x64" ;;
-  arm64) ASSET_ARCH="arm64" ;;
-  *) echo "❌ Unsupported arch: $dpkgArch (need amd64 or arm64)" >&2; exit 1 ;;
-esac
-
-if ! command -v curl >/dev/null 2>&1; then
-  export DEBIAN_FRONTEND=noninteractive
-  apt-get update
-  apt-get install -y --no-install-recommends curl ca-certificates
-  rm -rf /var/lib/apt/lists/*
-fi
-
-# Known-good pin when the GitHub API is rate-limited.
-FALLBACK_VERSION="27.3.0"
-
-if [[ "$REQ_VER" == "latest" ]]; then
-  VERSION=$(curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors \
-              https://api.github.com/repos/appwrite/sdk-for-cli/releases/latest 2>/dev/null \
-            | grep -oE '"tag_name"[[:space:]]*:[[:space:]]*"v?[^"]+"' \
-            | head -1 \
-            | sed -E 's/.*"v?([^"]+)".*/\1/' || true)
-  if [[ -z "$VERSION" ]] || ! [[ "$VERSION" =~ ^[0-9]+(\.[0-9]+)*([.-][A-Za-z0-9]+)*$ ]]; then
-    echo "⚠️  Could not resolve latest Appwrite CLI from GitHub (got '${VERSION:-empty}'); falling back to ${FALLBACK_VERSION}." >&2
-    VERSION="$FALLBACK_VERSION"
-  fi
-else
-  VERSION="$REQ_VER"
-fi
-
-if [[ -z "${VERSION}" ]]; then
-  echo "❌ Could not resolve Appwrite CLI version (got '${VERSION:-empty}')" >&2
-  exit 1
-fi
-
-ASSET="appwrite-cli-linux-${ASSET_ARCH}"
-URL="https://github.com/appwrite/sdk-for-cli/releases/download/${VERSION}/${ASSET}"
-
-echo "⬇️  Installing Appwrite CLI ${VERSION} (${ASSET_ARCH}) ..."
-TMP_DIR=$(mktemp -d)
-curl --retry 5 --retry-delay 3 --retry-all-errors -fsSL "$URL" -o "${TMP_DIR}/appwrite"
-install -m 755 "${TMP_DIR}/appwrite" /usr/local/bin/appwrite
-rm -rf "${TMP_DIR}"
-
-echo "✅ Appwrite CLI installed."
-echo -n "   appwrite → "; appwrite -v 2>/dev/null || appwrite version 2>/dev/null || true
-
-cat <<'EON'
-ℹ️ Ready to use:
-- Try: appwrite -v
-- Login (Cloud): appwrite login
-- Point at a local server: appwrite client --endpoint http://localhost:8080/v1 --self-signed true
-
-Notes:
-- Host credentials live in ~/.appwrite — select appwrite-cli+credential to seed them.
-- Pair with appwrite-server to run a self-hosted instance inside the booth.
-- See: https://appwrite.io/docs/tooling/command-line/installation
-EON
diff --git a/examples/workspaces/appwrite-example/.booth/setups/appwrite-server--setup.sh b/examples/workspaces/appwrite-example/.booth/setups/appwrite-server--setup.sh
deleted file mode 100755
index 07804440..00000000
--- a/examples/workspaces/appwrite-example/.booth/setups/appwrite-server--setup.sh
+++ /dev/null
@@ -1,429 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# appwrite-server--setup.sh — Install start/stop wrappers for self-hosted Appwrite.
-# Appwrite has no native install: it is a Docker Compose stack. This script does
-# not pull images at build time. start-appwrite runs the official installer
-# against Docker-in-Docker at runtime.
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <X.Y.Z>] [--http-port <port>] [--https-port <port>] [--data clean|seed|persist]
-
-Examples:
-  $0                                      # Appwrite 1.9.6 on 8080 / 8443, clean data
-  $0 --version 1.9.6 --http-port 8080     # pin version and HTTP port
-  $0 --data persist                       # dump/restore via ~/.appwrite-server (needs +persist)
-
-Notes:
-- Appwrite is Docker-only (no native / apt install). Needs dind at runtime.
-- Does NOT start the stack during image build.
-- Console: http://localhost:<http-port>
-- The official installer CLI rejects ports longer than 4 digits (20080 fails;
-  8080 / 8443 / 80 / 443 are fine).
-- --data clean (default): wipe Compose volumes each start.
-  seed: restore ~/.appwrite-server (home-seed), do not copy back.
-  persist: restore and dump ~/.appwrite-server (.booth/cache bind).
-- Pair with setup appwrite-cli for the CLI.
-USAGE
-}
-
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-HOME=/root
-
-VERSION="1.9.6"
-HTTP_PORT="8080"
-HTTPS_PORT="8443"
-DATA_MODE="clean"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version)    shift; VERSION="${1:-1.9.6}"; shift ;;
-    --http-port)  shift; HTTP_PORT="${1:-8080}"; shift ;;
-    --https-port) shift; HTTPS_PORT="${1:-8443}"; shift ;;
-    --data)       shift; DATA_MODE="${1:-clean}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "❌ Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-VERSION="${VERSION#v}"
-[[ "$VERSION" == "latest" ]] && VERSION="1.9.6"
-DATA_MODE="$(echo "$DATA_MODE" | tr '[:upper:]' '[:lower:]')"
-case "$DATA_MODE" in
-  clean|seed|persist) ;;
-  *)
-    echo "⚠️  Unknown --data ${DATA_MODE}; using clean." >&2
-    DATA_MODE="clean"
-    ;;
-esac
-
-if [[ ${#HTTP_PORT} -gt 4 || ${#HTTPS_PORT} -gt 4 ]]; then
-  echo "⚠️  Appwrite's installer rejects ports longer than 4 digits (got HTTP=${HTTP_PORT} HTTPS=${HTTPS_PORT})." >&2
-  echo "    Use 8080 / 8443 / 80 / 443. Falling back to 8080 and 8443." >&2
-  HTTP_PORT="8080"
-  HTTPS_PORT="8443"
-fi
-
-STARTER_FILE="/usr/local/bin/start-appwrite"
-STOPPER_FILE="/usr/local/bin/stop-appwrite"
-LIB_FILE="/usr/local/lib/cb-appwrite-data.sh"
-PROFILE_FILE="/etc/profile.d/70-cb-appwrite-server--profile.sh"
-
-export BAKED_VERSION="$VERSION"
-export BAKED_HTTP_PORT="$HTTP_PORT"
-export BAKED_HTTPS_PORT="$HTTPS_PORT"
-export BAKED_DATA="$DATA_MODE"
-
-mkdir -p /usr/local/lib
-
-# Runtime $HOME / $APPWRITE_* survive; baked version, ports, and data mode are stamped.
-# Do NOT call dind-open-port here: a DinD booth shares the sidecar netns, so
-# Traefik's published port is already on localhost. Forwarding $PORT to
-# ${DIND_NAME}:$PORT is a self-connect and forks socat until the box falls over.
-envsubst '$BAKED_VERSION $BAKED_HTTP_PORT $BAKED_HTTPS_PORT $BAKED_DATA' <<'EOF' > "$LIB_FILE"
-# shellcheck shell=bash
-# Sourced by start-appwrite / stop-appwrite. Baked defaults from setup.
-
-cb_appwrite_init() {
-  VERSION="${APPWRITE_VERSION:-$BAKED_VERSION}"
-  HTTP_PORT="${APPWRITE_PORT:-$BAKED_HTTP_PORT}"
-  HTTPS_PORT="${APPWRITE_HTTPS_PORT:-$BAKED_HTTPS_PORT}"
-  VOLUME="${APPWRITE_COMPOSE_VOLUME:-cb-appwrite-config}"
-  IMAGE="appwrite/appwrite:${VERSION}"
-  DATA_DIR="${APPWRITE_DATA_DIR:-$HOME/.appwrite-server}"
-  MODE="$(echo "${APPWRITE_DATA:-$BAKED_DATA}" | tr '[:upper:]' '[:lower:]')"
-  case "$MODE" in
-    clean|seed|persist) ;;
-    *) MODE="clean" ;;
-  esac
-}
-
-cb_appwrite_health_url() {
-  local port="$1"
-  curl -fsS -m 3 -H "Host: localhost" \
-    "http://127.0.0.1:${port}/v1/health/version" 2>/dev/null
-}
-
-cb_appwrite_health_ok() {
-  cb_appwrite_health_url "$1" >/dev/null
-}
-
-cb_appwrite_wait_for_docker() {
-  local i
-  for i in $(seq 1 30); do
-    if docker info >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 1
-  done
-  return 1
-}
-
-cb_appwrite_data_is_bind() {
-  local p="$DATA_DIR"
-  [[ -e "$p" ]] || return 1
-  awk -v p="$p" '$5 == p { found=1 } END { exit !found }' /proc/self/mountinfo 2>/dev/null
-}
-
-cb_appwrite_has_dump() {
-  [[ -s "${DATA_DIR}/manifest" ]]
-}
-
-cb_appwrite_volume_names() {
-  docker volume ls -q 2>/dev/null | grep -E '^(cb-appwrite-config|.*appwrite.*)$' || true
-}
-
-cb_appwrite_stop_containers() {
-  local ids
-  ids="$(docker ps -q --filter name=appwrite 2>/dev/null || true)"
-  if [[ -n "$ids" ]]; then
-    # shellcheck disable=SC2086
-    docker stop $ids >/dev/null || true
-  fi
-  ids="$(docker ps -aq --filter name=appwrite 2>/dev/null || true)"
-  if [[ -n "$ids" ]]; then
-    # shellcheck disable=SC2086
-    docker rm -f $ids >/dev/null || true
-  fi
-}
-
-cb_appwrite_wipe_volumes() {
-  cb_appwrite_stop_containers
-  local vol
-  for vol in $(cb_appwrite_volume_names); do
-    docker volume rm -f "$vol" >/dev/null 2>&1 || true
-  done
-}
-
-# Stream tarballs through docker stdout/stdin so DinD does not need a booth path mount.
-cb_appwrite_dump() {
-  mkdir -p "${DATA_DIR}/volumes"
-  : > "${DATA_DIR}/manifest"
-  local vol
-  for vol in $(cb_appwrite_volume_names); do
-    echo "  dumping ${vol} ..."
-    if docker run --rm --entrypoint tar \
-      --volume "${vol}:/from:ro" \
-      "$IMAGE" -C /from -cf - . > "${DATA_DIR}/volumes/${vol}.tar"; then
-      echo "$vol" >> "${DATA_DIR}/manifest"
-    else
-      echo "⚠️  dump failed for ${vol}" >&2
-      rm -f "${DATA_DIR}/volumes/${vol}.tar"
-    fi
-  done
-}
-
-cb_appwrite_restore() {
-  local vol tar
-  [[ -s "${DATA_DIR}/manifest" ]] || return 1
-  while IFS= read -r vol || [[ -n "$vol" ]]; do
-    [[ -n "$vol" ]] || continue
-    tar="${DATA_DIR}/volumes/${vol}.tar"
-    [[ -s "$tar" ]] || continue
-    echo "  restoring ${vol} ..."
-    docker volume create "$vol" >/dev/null
-    docker run --rm -i --entrypoint tar \
-      --volume "${vol}:/to" \
-      "$IMAGE" -C /to -xf - < "$tar"
-  done < "${DATA_DIR}/manifest"
-}
-
-cb_appwrite_run_installer() {
-  docker volume create "$VOLUME" >/dev/null
-  # Official installer: equals-form flags (utopia-php CLI does not parse
-  # "--http-port 8080" as a value; it needs --http-port=8080). Ports must be
-  # at most 4 digits. --interactive=N skips the web wizard.
-  docker run --rm \
-    --volume /var/run/docker.sock:/var/run/docker.sock \
-    --volume "${VOLUME}:/usr/src/code/appwrite" \
-    --entrypoint=install \
-    "$IMAGE" \
-    --interactive=N \
-    --http-port="${HTTP_PORT}" \
-    --https-port="${HTTPS_PORT}"
-}
-
-# Do not re-run install on a restored tree: install overwrites .env (new secrets
-# would not match the restored MariaDB). Compose up the dumped project instead.
-cb_appwrite_compose_up() {
-  docker run --rm \
-    --volume /var/run/docker.sock:/var/run/docker.sock \
-    --volume "${VOLUME}:/usr/src/code/appwrite" \
-    --workdir /usr/src/code/appwrite \
-    --entrypoint docker \
-    "$IMAGE" \
-    compose --project-directory /usr/src/code/appwrite up -d --remove-orphans
-}
-
-cb_appwrite_wait_healthy() {
-  local i
-  echo "Waiting for Appwrite API ..."
-  for i in $(seq 1 120); do
-    if cb_appwrite_health_ok "$HTTP_PORT"; then
-      echo "✅ Appwrite is up: http://localhost:${HTTP_PORT}"
-      cb_appwrite_health_url "$HTTP_PORT" || true
-      echo
-      return 0
-    fi
-    if cb_appwrite_health_ok 80; then
-      echo "✅ Appwrite is up: http://localhost:80"
-      cb_appwrite_health_url 80 || true
-      echo
-      return 0
-    fi
-    sleep 5
-  done
-  echo "⚠️  Appwrite did not become healthy in time." >&2
-  echo "    Try: docker ps" >&2
-  echo "         curl -H 'Host: localhost' http://127.0.0.1:${HTTP_PORT}/v1/health/version" >&2
-  return 1
-}
-
-cb_appwrite_ensure_admin() {
-  local email password port code
-  email="${APPWRITE_ADMIN_EMAIL:-admin@example.com}"
-  password="${APPWRITE_ADMIN_PASSWORD:-password123}"
-  port="$HTTP_PORT"
-  cb_appwrite_health_ok "$port" || port=80
-  code="$(curl -sS -m 10 -o /tmp/cb-appwrite-account.json -w '%{http_code}' \
-    -X POST "http://127.0.0.1:${port}/v1/account" \
-    -H "Host: localhost" \
-    -H "Content-Type: application/json" \
-    -H "X-Appwrite-Project: console" \
-    -d "{\"userId\":\"unique()\",\"email\":\"${email}\",\"password\":\"${password}\",\"name\":\"Admin\"}" \
-    2>/dev/null || echo 000)"
-  case "$code" in
-    201)
-      echo "Console admin: ${email}  /  ${password}"
-      ;;
-    409|400)
-      echo "Console admin already present (tried ${email})."
-      ;;
-    *)
-      echo "⚠️  Could not seed console admin (HTTP ${code}). Sign up in the console." >&2
-      ;;
-  esac
-}
-
-cb_appwrite_resolve_mode() {
-  if [[ "$MODE" == persist ]] && ! cb_appwrite_data_is_bind; then
-    echo "⚠️  APPWRITE_DATA=persist but ${DATA_DIR} is not a cache bind." >&2
-    echo "    Select appwrite-server+persist so cache-dirs mounts it. Using clean." >&2
-    MODE="clean"
-  fi
-}
-
-cb_appwrite_start_persist_watch() {
-  local pidfile="/tmp/cb-appwrite-persist.pid"
-  if [[ -f "$pidfile" ]] && kill -0 "$(cat "$pidfile")" 2>/dev/null; then
-    return 0
-  fi
-  (
-    trap 'cb_appwrite_stop_containers; cb_appwrite_dump >/tmp/cb-appwrite-dump.log 2>&1 || true; exit 0' TERM INT
-    while true; do sleep 30; done
-  ) &
-  echo $! > "$pidfile"
-}
-EOF
-chmod 644 "$LIB_FILE"
-
-cat > "$STARTER_FILE" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-# shellcheck disable=SC1091
-source /usr/local/lib/cb-appwrite-data.sh
-cb_appwrite_init
-
-if ! command -v docker >/dev/null 2>&1; then
-  echo "❌ Docker is not available. Select dind (appwrite-server+autostart pulls it in)." >&2
-  exit 1
-fi
-if ! cb_appwrite_wait_for_docker; then
-  echo "❌ Docker did not become ready. Is dind selected and the sidecar up?" >&2
-  exit 1
-fi
-
-cb_appwrite_resolve_mode
-
-if cb_appwrite_health_ok "$HTTP_PORT"; then
-  echo "Appwrite already running on http://localhost:${HTTP_PORT}  (data=${MODE})"
-  cb_appwrite_health_url "$HTTP_PORT" || true
-  echo
-  [[ "$MODE" == persist ]] && cb_appwrite_start_persist_watch
-  exit 0
-fi
-if cb_appwrite_health_ok 80; then
-  echo "Appwrite already running on http://localhost:80 (installer default)."
-  echo "  This booth asked for ${HTTP_PORT}; curl :80 or rebuild after the port fix."
-  cb_appwrite_health_url 80 || true
-  echo
-  [[ "$MODE" == persist ]] && cb_appwrite_start_persist_watch
-  exit 0
-fi
-
-echo "Starting Appwrite ${VERSION} on http://localhost:${HTTP_PORT} (data=${MODE}) ..."
-echo "  (first boot pulls the Compose stack — several minutes, ~4GB RAM)"
-mkdir -p "$DATA_DIR"
-
-case "$MODE" in
-  clean)
-    cb_appwrite_wipe_volumes
-    cb_appwrite_run_installer
-    ;;
-  seed)
-    cb_appwrite_wipe_volumes
-    if cb_appwrite_has_dump; then
-      cb_appwrite_restore
-      cb_appwrite_compose_up
-    else
-      cb_appwrite_run_installer
-    fi
-    ;;
-  persist)
-    if cb_appwrite_has_dump; then
-      cb_appwrite_wipe_volumes
-      cb_appwrite_restore
-      cb_appwrite_compose_up
-    else
-      cb_appwrite_run_installer
-    fi
-    ;;
-esac
-
-if ! cb_appwrite_wait_healthy; then
-  echo "         curl -H 'Host: localhost' http://127.0.0.1/v1/health/version" >&2
-  exit 1
-fi
-
-cb_appwrite_ensure_admin
-[[ "$MODE" == persist ]] && cb_appwrite_start_persist_watch
-exit 0
-EOF
-chmod 755 "$STARTER_FILE"
-
-cat > "$STOPPER_FILE" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-# shellcheck disable=SC1091
-source /usr/local/lib/cb-appwrite-data.sh
-cb_appwrite_init
-
-if ! command -v docker >/dev/null 2>&1; then
-  echo "No Docker; nothing to stop."
-  exit 0
-fi
-
-cb_appwrite_resolve_mode
-cb_appwrite_stop_containers
-if [[ "$MODE" == persist ]]; then
-  echo "Dumping Appwrite volumes to ${DATA_DIR} ..."
-  cb_appwrite_dump
-  echo "Appwrite data saved (persist)."
-fi
-echo "Appwrite containers stopped."
-EOF
-chmod 755 "$STOPPER_FILE"
-
-envsubst '$BAKED_HTTP_PORT' <<'EOF' > "$PROFILE_FILE"
-# Appwrite self-hosted endpoint (cheap; skipped if already set).
-if [ -z "${APPWRITE_ENDPOINT:-}" ]; then
-  export APPWRITE_ENDPOINT="http://localhost:${APPWRITE_PORT:-$BAKED_HTTP_PORT}/v1"
-fi
-EOF
-chmod 644 "$PROFILE_FILE"
-
-# Desktop variants only; no-ops on base. Documents http://localhost for test90.
-cb-web-icon.sh --id appwrite --name "Appwrite" --icon applications-internet \
-  --port-env APPWRITE_PORT --port "${HTTP_PORT}" --path / --start start-appwrite
-
-echo "✅ Appwrite server wrappers installed."
-echo "   Version:  ${VERSION}"
-echo "   HTTP:     http://localhost:${HTTP_PORT}"
-echo "   HTTPS:    ${HTTPS_PORT} (self-signed; optional)"
-echo "   Data:     ${DATA_MODE}"
-echo "   Starter:  ${STARTER_FILE}"
-echo "   Stopper:  ${STOPPER_FILE}"
-
-cat <<EON
-ℹ️ Ready to use:
-- Start: start-appwrite
-- Stop:  stop-appwrite
-- Console: http://localhost:${HTTP_PORT}
-- Health: curl -H 'Host: localhost' http://localhost:${HTTP_PORT}/v1/health/version
-- Data:  ${DATA_MODE}  (clean | seed via +seed | persist via +persist)
-
-Notes:
-- Appwrite is a Docker Compose stack (Traefik, database, Redis, workers).
-  There is no native install. Select dind; +autostart pulls it in and starts on boot.
-- First start downloads many images and wants ~4GB RAM. Later starts reuse them.
-- clean: empty stack every booth. seed: home-seed snapshot, writes discarded.
-  persist: .booth/cache bind; stop-appwrite dumps volumes for the next run.
-- Default console login after first start: admin@example.com / password123
-- Point the CLI at it: appwrite client --endpoint http://localhost:${HTTP_PORT}/v1 --self-signed true
-- See: https://appwrite.io/docs/advanced/self-hosting/installation
-EON
diff --git a/examples/workspaces/deno-example/.booth/setups/deno-pkg--install.sh b/examples/workspaces/deno-example/.booth/setups/deno-pkg--install.sh
deleted file mode 100755
index 1cf08175..00000000
--- a/examples/workspaces/deno-example/.booth/setups/deno-pkg--install.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/bash
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-if [ "$EUID" -ne 0 ]; then
-    echo "❌ This script must be run as root (use sudo)" >&2
-    exit 1
-fi
-
-if [ $# -eq 0 ] || [ -z "$1" ]; then
-    echo "Usage: $0 <pkg1,pkg2,...>" >&2
-    exit 1
-fi
-
-if ! command -v deno &> /dev/null; then
-    echo "❌ Deno is not installed. Run deno--setup.sh first." >&2
-    exit 1
-fi
-
-IFS=',' read -ra PKGS <<< "$1"
-for pkg in "${PKGS[@]}"; do
-    pkg=$(echo "$pkg" | xargs)
-    if [ -n "$pkg" ]; then
-        echo "📦 Installing: deno add $pkg"
-        sudo -u coder bash -lc "cd /home/coder && deno add $pkg"
-    fi
-done
diff --git a/examples/workspaces/elixir-example/.booth/Boothfile b/examples/workspaces/elixir-example/.booth/Boothfile
index 507b11dd..7e4e380a 100644
--- a/examples/workspaces/elixir-example/.booth/Boothfile
+++ b/examples/workspaces/elixir-example/.booth/Boothfile
@@ -4,9 +4,19 @@
 env APT_SNAPSHOT=20260730T000000Z
 
 arg CODESERVER_PORT=19999
-arg ELIXIR_VERSION=1.19.5
+# Pinned to OTP 25 (Ubuntu's default apt package on every arch) instead of
+# elixir--setup.sh's implicit OTP 28 default: ppa:rabbitmq/rabbitmq-erlang-28
+# only publishes arm64 builds of a few metapackages, not the erlang-base/
+# erlang-dev/... packages erlang--setup.sh installs by name, so apt silently
+# falls back to OTP 25 on arm64 anyway — and Elixir 1.19 dropped OTP 25
+# support, so that mismatch 404s trying to fetch elixir-otp-25.zip. Elixir
+# 1.18.4 still ships an otp-25 build, so this combo installs cleanly and
+# identically on both amd64 and arm64.
+arg OTP_VERSION=25
+arg ELIXIR_VERSION=1.18.4
 
 setup claude-code
 setup codeserver ${CODESERVER_PORT}
+setup erlang --otp-version ${OTP_VERSION}
 setup elixir --version ${ELIXIR_VERSION}
 setup elixir-code-extension
diff --git a/examples/workspaces/floci-example/.booth/setups/floci--setup.sh b/examples/workspaces/floci-example/.booth/setups/floci--setup.sh
deleted file mode 100755
index 6184beb3..00000000
--- a/examples/workspaces/floci-example/.booth/setups/floci--setup.sh
+++ /dev/null
@@ -1,140 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# floci--setup.sh — Install the Floci CLI from GitHub releases
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <X.Y.Z>|latest]
-
-Examples:
-  $0                         # install latest Floci CLI
-  $0 --version 0.2.1         # pin specific version
-
-Notes:
-- Installs the official floci CLI to /usr/local/bin/floci
-  (https://github.com/floci-io/floci-cli)
-- \`floci start\` launches the AWS emulator (image floci/floci) and needs
-  Docker at runtime — select the dind template, or floci+autostart which
-  pulls dind in.
-- Supports amd64 and arm64
-- See: https://floci.io
-USAGE
-}
-
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-
-REQ_VER="latest"
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) shift; REQ_VER="${1:-latest}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "❌ Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-REQ_VER="${REQ_VER#v}"
-
-dpkgArch="$(dpkg --print-architecture)"
-case "$dpkgArch" in
-  amd64) ARCH="amd64" ;;
-  arm64) ARCH="arm64" ;;
-  *) echo "❌ Unsupported arch: $dpkgArch (need amd64 or arm64)" >&2; exit 1 ;;
-esac
-
-# Known-good pin when the GitHub API is rate-limited.
-FALLBACK_VERSION="0.2.1"
-REPO="floci-io/floci-cli"
-ASSET="floci-linux-${ARCH}"
-
-if ! command -v curl >/dev/null 2>&1; then
-  export DEBIAN_FRONTEND=noninteractive
-  apt-get update
-  apt-get install -y --no-install-recommends curl ca-certificates
-  rm -rf /var/lib/apt/lists/*
-fi
-
-if [[ "$REQ_VER" == "latest" ]]; then
-  VERSION=$(curl -fsSL --retry 5 --retry-delay 3 --retry-all-errors \
-              "https://api.github.com/repos/${REPO}/releases/latest" 2>/dev/null \
-            | grep -oE '"tag_name"[[:space:]]*:[[:space:]]*"v?[^"]+"' \
-            | head -1 \
-            | sed -E 's/.*"v?([^"]+)".*/\1/' || true)
-  if [[ -z "$VERSION" ]] || ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    echo "⚠️  Could not resolve latest floci from GitHub (got '${VERSION:-empty}'); falling back to v${FALLBACK_VERSION}." >&2
-    VERSION="$FALLBACK_VERSION"
-  fi
-else
-  VERSION="$REQ_VER"
-fi
-
-if [[ -z "${VERSION}" ]] || ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-  echo "❌ Could not resolve floci version (got '${VERSION:-empty}')" >&2
-  exit 1
-fi
-
-URL="https://github.com/${REPO}/releases/download/${VERSION}/${ASSET}"
-SUMS_URL="https://github.com/${REPO}/releases/download/${VERSION}/sha256sums.txt"
-
-echo "⬇️  Installing floci CLI v${VERSION} (${ASSET}) ..."
-TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
-curl --retry 5 --retry-delay 3 --retry-all-errors -fsSL "$URL" -o "$TMP/floci"
-chmod +x "$TMP/floci"
-
-if command -v sha256sum >/dev/null 2>&1; then
-  curl --retry 5 --retry-delay 3 --retry-all-errors -fsSL "$SUMS_URL" -o "$TMP/sha256sums.txt"
-  # Release checksums look like
-  #   <sha256>  ./floci-linux-amd64/floci-linux-amd64
-  # Match the asset as a path basename, not as a whole field.
-  EXPECTED=$(awk -v a="$ASSET" '$NF == a || $NF ~ ("/" a "$") {print $1; exit}' "$TMP/sha256sums.txt")
-  if [[ -z "$EXPECTED" ]]; then
-    echo "❌ No checksum entry for ${ASSET} in sha256sums.txt" >&2
-    exit 1
-  fi
-  ACTUAL=$(sha256sum "$TMP/floci" | awk '{print $1}')
-  if [[ "$EXPECTED" != "$ACTUAL" ]]; then
-    echo "❌ Checksum mismatch for ${ASSET}" >&2
-    echo "   expected: $EXPECTED" >&2
-    echo "   actual:   $ACTUAL" >&2
-    exit 1
-  fi
-  echo "   checksum verified."
-fi
-
-install -m 755 "$TMP/floci" /usr/local/bin/floci
-
-# Point AWS clients at the local emulator once it is running. Dummy keys are
-# accepted by Floci; leave an already-set value alone so a real account still
-# wins if the user exported one.
-PROFILE_FILE="/etc/profile.d/70-cb-floci--profile.sh"
-cat > "${PROFILE_FILE}" <<'PROFILE'
-# Floci local AWS emulator — default endpoint and throwaway keys.
-export AWS_ENDPOINT_URL="${AWS_ENDPOINT_URL:-http://localhost:${FLOCI_PORT:-4566}}"
-export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-test}"
-export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-test}"
-export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
-PROFILE
-chmod 644 "${PROFILE_FILE}"
-
-echo "✅ Floci CLI installed."
-echo -n "   floci → "; floci version 2>/dev/null | head -1 || true
-echo "   Profile: ${PROFILE_FILE}"
-
-cat <<'EON'
-ℹ️ Ready to use:
-- Needs Docker at runtime (select dind, or floci+autostart which pulls it in)
-- Start the AWS emulator:  floci start
-- Export AWS env vars:     eval $(floci env)
-- Talk to it with aws:     aws s3 mb s3://my-bucket
-- Stop:                    floci stop
-
-Notes:
-- The emulator listens on port 4566 (LocalStack-compatible).
-- Dummy credentials (test/test) are exported in every login shell.
-- Lambda, RDS, and other Docker-backed services need Docker inside the booth.
-- See: https://floci.io
-EON
diff --git a/examples/workspaces/flutter-example/.booth/setups/flutter--setup.sh b/examples/workspaces/flutter-example/.booth/setups/flutter--setup.sh
deleted file mode 100755
index 90ef6215..00000000
--- a/examples/workspaces/flutter-example/.booth/setups/flutter--setup.sh
+++ /dev/null
@@ -1,222 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <x.y.z|latest>]
-
-Examples:
-  $0                        # newest stable, resolved from Google's release manifest
-  $0 --version 3.44.9       # a specific stable release
-
-Notes:
-- Installs to /usr/local/flutter-<version>, with /usr/local/flutter-current
-  pointing at it, so the last install wins without rewriting the profile.
-- Brings the Dart SDK with it: both 'flutter' and 'dart' land on PATH. Do not
-  also install a standalone Dart SDK — two Darts on PATH is a version-skew trap.
-- Web is ready out of the box. Android and Linux-desktop targets need extra
-  pieces: see flutter-android--setup.sh and flutter-linux-desktop--setup.sh.
-- Google publishes the Linux SDK for x86_64 only, so on arm64 this warns and
-  skips rather than failing the build.
-USAGE
-}
-
-# ---- root check ----
-[[ $EUID -eq 0 ]] || { echo "❌ This script must be run as root (use sudo)" >&2; exit 1; }
-
-# This script will always be installed by root.
-HOME=/root
-
-# ---- defaults / args ----
-REQ_VERSION="latest"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) shift; REQ_VERSION="${1:-}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-
-LEVEL=61                          # languages band -- see docs/BOOTH_SETUP.md
-PROFILE_FILE="/etc/profile.d/${LEVEL}-cb-flutter--profile.sh"
-BIN_DIR=/usr/local/bin
-
-RELEASES_URL="https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json"
-BASE_URL="https://storage.googleapis.com/flutter_infra_release/releases"
-
-# ---- arch gate ----
-# Checked against Google's own manifest: every stable release carries
-# dart_sdk_arch "x64" and there has never been a linux-arm64 stable build. Warn
-# and skip rather than fail, so the image still comes up -- same contract as
-# unsupported-arch in the template.
-dpkgArch="$(dpkg --print-architecture)"
-if [[ "$dpkgArch" != "amd64" ]]; then
-  echo "⚠️  The Flutter SDK for Linux is published for x86_64 only."
-  echo "    Host architecture is '${dpkgArch}' — skipping the Flutter install."
-  exit 0
-fi
-
-# ---- base deps ----
-# git is not optional: the SDK ships as a git checkout and the flutter tool
-# shells out to git to work out which version it is. xz-utils unpacks the
-# tarball; zip/unzip are what the tool itself reaches for when building.
-export DEBIAN_FRONTEND=noninteractive
-apt-get update
-apt-get install -y --no-install-recommends \
-  curl ca-certificates git unzip xz-utils zip
-rm -rf /var/lib/apt/lists/*
-
-# ---- resolve the version ----
-TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
-echo "Resolving Flutter ${REQ_VERSION} ..."
-curl --retry 5 --retry-delay 3 --retry-all-errors -fsSL "$RELEASES_URL" -o "$TMP/releases.json"
-
-if [[ "$REQ_VERSION" == "latest" ]]; then
-  # current_release.stable is a build hash, not a version -- it has to be looked
-  # up in the releases list to get the version and the archive path.
-  STABLE_HASH="$(jq -r '.current_release.stable' "$TMP/releases.json")"
-  VERSION="$(jq -r --arg h "$STABLE_HASH" \
-    'first(.releases[] | select(.hash == $h and .channel == "stable")) | .version' "$TMP/releases.json")"
-  ARCHIVE="$(jq -r --arg h "$STABLE_HASH" \
-    'first(.releases[] | select(.hash == $h and .channel == "stable")) | .archive' "$TMP/releases.json")"
-else
-  VERSION="$REQ_VERSION"
-  ARCHIVE="$(jq -r --arg v "$VERSION" \
-    'first(.releases[] | select(.version == $v and .channel == "stable")) | .archive' "$TMP/releases.json")"
-fi
-
-if [[ -z "$VERSION" || "$VERSION" == "null" || -z "$ARCHIVE" || "$ARCHIVE" == "null" ]]; then
-  echo "❌ No stable Linux release of Flutter '${REQ_VERSION}' in Google's manifest." >&2
-  echo "   Recent stable versions:" >&2
-  jq -r '[.releases[] | select(.channel == "stable") | .version] | .[0:8] | join(", ")' \
-    "$TMP/releases.json" >&2
-  exit 1
-fi
-
-INSTALL_DIR="/usr/local/flutter-${VERSION}"
-
-# ---- download + install ----
-echo "Downloading Flutter ${VERSION} ..."
-curl --retry 5 --retry-delay 3 --retry-all-errors -fsSL "${BASE_URL}/${ARCHIVE}" -o "$TMP/flutter.tar.xz"
-
-echo "Installing Flutter to ${INSTALL_DIR} ..."
-# The tarball unpacks to a plain 'flutter/', so extract to a scratch dir and
-# move it into place under its version.
-rm -rf "$INSTALL_DIR" "$TMP/unpack"
-mkdir -p "$TMP/unpack"
-tar -C "$TMP/unpack" -xJf "$TMP/flutter.tar.xz"
-mv "$TMP/unpack/flutter" "$INSTALL_DIR"
-ln -sfn "$INSTALL_DIR" /usr/local/flutter-current
-
-# ---- git ownership ----
-# The SDK is a git checkout owned by root, and the booth runs as coder, so git
-# refuses it with "detected dubious ownership" and the flutter tool dies before
-# it does anything. This is the whole fix; it must come before the first run.
-git config --system --add safe.directory "$INSTALL_DIR"
-
-# ---- first run + precache ----
-# The tarball ships without the Dart SDK or the engine artifacts; the first
-# invocation downloads them. Doing it here means a booth starts ready instead of
-# stalling on a multi-hundred-megabyte download the first time anyone types
-# 'flutter'.
-export FLUTTER_SUPPRESS_ANALYTICS=true
-echo "Fetching the Dart SDK and engine artifacts ..."
-"${INSTALL_DIR}/bin/flutter" --version > /dev/null
-"${INSTALL_DIR}/bin/flutter" precache --universal --web > /dev/null
-
-# ---- login-shell env ----
-export VERSION
-envsubst '$VERSION' > "${PROFILE_FILE}" <<'EOF'
-# Profile: Flutter: $VERSION
-
-# Prefer the "current" symlink so the last installed wins.
-case ":$PATH:" in
-  *":/usr/local/flutter-current/bin:"*) ;;
-  *) export PATH="/usr/local/flutter-current/bin:$PATH";;
-esac
-
-# 'dart pub global activate' drops executables here.
-case ":$PATH:" in
-  *":$HOME/.pub-cache/bin:"*) ;;
-  *) export PATH="$HOME/.pub-cache/bin:$PATH";;
-esac
-
-export FLUTTER_ROOT="/usr/local/flutter-current"
-
-# A booth is not a machine anyone opted in from; do not phone home, and do not
-# open the first-run analytics prompt in front of someone who just wants a build.
-export FLUTTER_SUPPRESS_ANALYTICS=true
-EOF
-chmod 0644 "${PROFILE_FILE}"
-
-# ---- non-login wrappers ----
-# Build scripts and IDE tasks run in non-login shells, which never source
-# profile.d -- without these, 'flutter' and 'dart' are simply not found.
-install -d "$BIN_DIR" /etc/cb-flutter.d
-for t in flutter dart; do
-  cat >"${BIN_DIR}/$t" <<EOF
-#!/bin/sh
-export FLUTTER_ROOT="\${FLUTTER_ROOT:-/usr/local/flutter-current}"
-export FLUTTER_SUPPRESS_ANALYTICS="\${FLUTTER_SUPPRESS_ANALYTICS:-true}"
-
-# Per-target environment (the Android SDK root, and so on) is contributed as
-# drop-ins by the add-on setups, so this wrapper does not have to know which of
-# them are installed -- and so a non-login shell gets the same env a login one
-# would have picked up from /etc/profile.d.
-for f in /etc/cb-flutter.d/*.sh; do
-  [ -r "\$f" ] && . "\$f"
-done
-
-exec /usr/local/flutter-current/bin/$t "\$@"
-EOF
-  chmod 755 "${BIN_DIR}/$t"
-done
-
-# ---- summary ----
-# Deliberately BEFORE the permission pass below. Every `flutter` invocation can
-# rewrite bin/cache -- `flutter --version` re-runs update_engine_version.sh and
-# replaces engine.stamp -- and anything root touches after the chmod is left
-# root-owned and 0644. That is not a cosmetic leftover: at runtime the tool
-# regenerates the stamp with `mv`, which on an unwritable target *prompts*
-# ("overriding mode 0644") and, with no TTY to answer, hangs forever with no
-# output. So: run everything that invokes flutter first, fix modes last.
-echo "✅ Flutter installed at ${INSTALL_DIR}."
-echo -n "   flutter: "; "${BIN_DIR}/flutter" --version 2>/dev/null | grep -m1 . || echo "?"
-# dart reports its version on stderr, so the streams have to be folded -- but
-# then a plain `grep -m1 .` picks up Flutter's "you are running as root" warning
-# instead of the version. Match the line that is actually wanted.
-echo -n "   dart:    "; "${BIN_DIR}/dart" --version 2>&1 | grep -m1 -iE "^Dart SDK version" || echo "?"
-
-# ---- permissions (must be last) ----
-# Installed by root, used by coder -- and 'chown coder' is wrong here, because
-# booth-entry remaps coder's UID to the host user's at container start, so a
-# build-time owner only matches by luck. Mode bits are UID-agnostic, which is
-# why the rest of the catalog (conda, code-server, cypress) does it this way.
-chmod -R a+rX "$INSTALL_DIR"
-# The tool writes back into its own tree at runtime: artifact downloads and
-# stamps under bin/cache, a lockfile beside them, and .dart_tool for its own
-# package. Read-only there turns any first use into a permission error -- or, for
-# the stamp files, an unanswerable `mv` prompt.
-chmod -R a+rwX "${INSTALL_DIR}/bin/cache"
-chmod -R a+rwX "${INSTALL_DIR}/packages/flutter_tools"
-chmod    a+rwX "$INSTALL_DIR"
-echo "   Profile file (every user shell): ${PROFILE_FILE}"
-echo "   Current symlink                : /usr/local/flutter-current -> ${INSTALL_DIR}"
-
-cat <<'EON'
-Ready to use:
-- Start an app:   flutter create myapp && cd myapp
-- Build for web:  flutter build web
-- Serve it in the booth, then open it from the web pane:
-      flutter run -d web-server --web-port 8080 --web-hostname 0.0.0.0
-  and browse to /proxy/8080/ on the booth port.
-- Android and Linux-desktop targets are separate setups:
-      flutter-android, flutter-linux-desktop
-EON
diff --git a/examples/workspaces/flutter-example/.booth/setups/flutter-android--setup.sh b/examples/workspaces/flutter-example/.booth/setups/flutter-android--setup.sh
deleted file mode 100755
index f6b8f0aa..00000000
--- a/examples/workspaces/flutter-example/.booth/setups/flutter-android--setup.sh
+++ /dev/null
@@ -1,167 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# flutter-android--setup.sh
-# Points Flutter at the Android SDK and precaches the Android engine artifacts,
-# so `flutter build apk` works instead of asking for an SDK it cannot find.
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--android-sdk <path>]
-
-Notes:
-- Run after flutter--setup.sh and android-sdk--setup.sh; skips cleanly if either
-  is missing, so a booth without them still builds.
-- Writes /etc/cb-flutter.d/50-android.sh, which both the profile and the
-  flutter/dart wrappers pick up -- that is what makes the SDK visible to a
-  non-login shell such as 'booth -- ./gradlew assembleDebug'.
-USAGE
-}
-
-# ---- root check ----
-[[ $EUID -eq 0 ]] || { echo "❌ This script must be run as root (use sudo)" >&2; exit 1; }
-
-# This script will always be installed by root.
-HOME=/root
-
-SCRIPT_NAME="$(basename "$0")"
-SCRIPT_DIR="$(dirname "$0")"
-
-# A script copied into a project's .booth/setups/ shadows the image's copy, but
-# libs/ does not come with it -- so $SCRIPT_DIR/libs is simply absent on the very
-# path the dev loop and the complex tests use.
-SETUP_LIBS_DIR=${SETUP_LIBS_DIR:-/opt/codingbooth/setups/libs}
-if [[ -r "$SCRIPT_DIR/libs/skip-setup.sh" ]]; then
-    source "$SCRIPT_DIR/libs/skip-setup.sh"
-else
-    source "${SETUP_LIBS_DIR}/skip-setup.sh"
-fi
-
-ANDROID_SDK_DIR=/opt/android-sdk
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --android-sdk) shift; ANDROID_SDK_DIR="${1:-}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-
-# ---- guards ----
-# Both prerequisites bail out on arm64 by design, so this one has to as well --
-# and it must skip rather than fail, or every arm64 build breaks here.
-if ! command -v flutter >/dev/null 2>&1; then
-  skip_setup "$SCRIPT_NAME" "Flutter not installed (run flutter--setup.sh first)"
-fi
-if [[ ! -x "${ANDROID_SDK_DIR}/cmdline-tools/latest/bin/sdkmanager" ]]; then
-  skip_setup "$SCRIPT_NAME" "Android SDK not found at ${ANDROID_SDK_DIR}"
-fi
-
-export FLUTTER_SUPPRESS_ANALYTICS=true
-export ANDROID_SDK_ROOT="$ANDROID_SDK_DIR"
-export ANDROID_HOME="$ANDROID_SDK_DIR"
-
-# ---- environment drop-in ----
-# 'flutter config --android-sdk' would look like the obvious move, but it writes
-# to $HOME/.config/flutter/settings -- root's, at build time -- and the booth
-# runs as coder, so the setting would be invisible to the person who needs it.
-# The env vars are read by every Flutter version and are user-independent.
-install -d /etc/cb-flutter.d
-cat >/etc/cb-flutter.d/50-android.sh <<EOF
-# Android SDK, for Flutter's Android toolchain
-export ANDROID_SDK_ROOT="${ANDROID_SDK_DIR}"
-export ANDROID_HOME="${ANDROID_SDK_DIR}"
-EOF
-chmod 0644 /etc/cb-flutter.d/50-android.sh
-
-# Login shells read profile.d rather than the wrappers, so the same values go
-# there too. Order 67: after flutter (61) and the Android SDK (63).
-cat >/etc/profile.d/67-cb-flutter-android--profile.sh <<'EOF'
-# Profile: Flutter Android target
-[ -r /etc/cb-flutter.d/50-android.sh ] && . /etc/cb-flutter.d/50-android.sh
-EOF
-chmod 0644 /etc/profile.d/67-cb-flutter-android--profile.sh
-
-# ---- the platform Flutter compiles against ----
-# android-sdk's default API is not necessarily the one Flutter needs: an app
-# compiles against the SDK named in the Flutter SDK's own gradle plugin, and a
-# mismatch fails the Gradle task with "Flutter requires Android SDK <N>" -- so
-# `flutter+android` on stock defaults would produce a booth that builds nothing.
-# Rather than pin a number here that rots on the next Flutter release, read it
-# from whichever Flutter is actually installed and install that platform if the
-# SDK does not already have it. The user's ANDROID_API pin is left alone; this
-# only ever adds.
-FLUTTER_DIR="$(readlink -f /usr/local/flutter-current)"
-EXT_KT="${FLUTTER_DIR}/packages/flutter_tools/gradle/src/main/kotlin/FlutterExtension.kt"
-COMPILE_SDK=""
-if [[ -r "$EXT_KT" ]]; then
-  COMPILE_SDK="$(grep -oE 'compileSdkVersion: *Int *= *[0-9]+' "$EXT_KT" | grep -oE '[0-9]+$' || true)"
-fi
-
-if [[ -n "$COMPILE_SDK" ]]; then
-  if [[ -d "${ANDROID_SDK_DIR}/platforms/android-${COMPILE_SDK}" ]]; then
-    echo "Flutter compiles against Android ${COMPILE_SDK}; that platform is already installed."
-  else
-    echo "Flutter compiles against Android ${COMPILE_SDK}; installing that platform ..."
-    "${ANDROID_SDK_DIR}/cmdline-tools/latest/bin/sdkmanager" \
-      --install "platforms;android-${COMPILE_SDK}" > /dev/null
-    # Installed by root, read by coder — same rule as the SDK itself.
-    chmod -R a+rX "${ANDROID_SDK_DIR}/platforms"
-  fi
-else
-  echo "⚠️  Could not read Flutter's compileSdkVersion from ${EXT_KT}."
-  echo "    If 'flutter build apk' reports a missing Android SDK, re-select android-sdk"
-  echo "    with a matching --api."
-fi
-
-# ---- engine artifacts ----
-# Without this the first 'flutter build apk' stops to download a few hundred
-# megabytes of Android engine artifacts, which is exactly the stall the base
-# setup's precache exists to avoid.
-echo "Fetching the Flutter Android engine artifacts ..."
-flutter precache --android > /dev/null
-
-# ---- licenses ----
-# android-sdk--setup.sh already accepted the SDK licenses, so this normally has
-# nothing to do; it is here because Flutter checks for its own record of them and
-# reports a doctor failure when it is missing. Exits non-zero once stdin runs
-# dry, which is expected.
-yes | flutter doctor --android-licenses > /dev/null 2>&1 || true
-
-# ---- summary ----
-# Before the permission pass, not after: `flutter doctor` rewrites bin/cache as
-# root, and anything root touches after the chmod stays root-owned and 0644 --
-# which at runtime turns the tool's own `mv` of a stamp file into an
-# unanswerable prompt that hangs with no output.
-echo "✅ Flutter Android toolchain wired to ${ANDROID_SDK_DIR}."
-flutter doctor 2>/dev/null | grep -iE "android tool|android studio" || true
-
-# ---- permissions (must be last) ----
-# precache and doctor wrote into the SDK tree as root; re-open it for the user.
-chmod -R a+rwX "${FLUTTER_DIR}/bin/cache"
-
-# Flutter builds through Gradle, and Gradle installs SDK components on demand --
-# the NDK named by the app's build.gradle.kts, most often. android-sdk--setup.sh
-# leaves the tree read-only (a+rX), which is right for its own aapt2/d8 path but
-# makes every such install fail with "The SDK directory is not writable", and the
-# APK build dies in project configuration before compiling a line.
-#
-# Relaxed here rather than in android-sdk--setup.sh on purpose: this is a cost of
-# the Gradle path, so only booths that opted into `flutter+android` pay it, and
-# the Android SDK keeps the tighter mode for everyone else. Mode bits, not chown,
-# for the usual reason -- booth-entry remaps the booth user's UID at start.
-echo "Making the Android SDK writable, so Gradle can install components it needs ..."
-chmod -R a+rwX "$ANDROID_SDK_DIR"
-
-cat <<'EON'
-Ready to use:
-- Build a debug APK:  flutter build apk --debug
-- List devices:       flutter devices
-- With the android-sdk 'emulator' extension selected, start one first:
-      cb-android-emulator &      # then: flutter run
-EON
diff --git a/examples/workspaces/flutter-example/.booth/setups/flutter-code-extension--setup.sh b/examples/workspaces/flutter-example/.booth/setups/flutter-code-extension--setup.sh
deleted file mode 100755
index e6715dbe..00000000
--- a/examples/workspaces/flutter-example/.booth/setups/flutter-code-extension--setup.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# flutter-code-extension--setup.sh
-# Root-only installer to bootstrap the Dart/Flutter VS Code extensions.
-set -Eeuo pipefail
-
-if [[ ${EUID} -ne 0 ]]; then
-  echo "This installer must be run as root." >&2
-  exit 1
-fi
-
-# This script will always be installed by root.
-HOME=/root
-
-SCRIPT_NAME="$(basename "$0")"
-SCRIPT_DIR="$(dirname "$0")"
-
-# A script copied into a project's .booth/setups/ shadows the image's copy, but
-# libs/ does not come with it -- so $SCRIPT_DIR/libs is simply absent on the very
-# path the dev loop and the complex tests use. Prefer the sibling dir when it is
-# there, fall back to the image's, which is the same convention the code
-# extension helper below already follows.
-SETUP_LIBS_DIR=${SETUP_LIBS_DIR:-/opt/codingbooth/setups/libs}
-if [[ -r "$SCRIPT_DIR/libs/skip-setup.sh" ]]; then
-    source "$SCRIPT_DIR/libs/skip-setup.sh"
-else
-    source "${SETUP_LIBS_DIR}/skip-setup.sh"
-fi
-
-CB_HAS_VSCODE="$SCRIPT_DIR/cb-has-vscode.sh"
-[[ -x "$CB_HAS_VSCODE" ]] || CB_HAS_VSCODE=/opt/codingbooth/setups/cb-has-vscode.sh
-if ! "$CB_HAS_VSCODE"; then
-    skip_setup "$SCRIPT_NAME" "code-server/VSCode not installed"
-fi
-
-CODE_EXTENSION_LIB=${CODE_EXTENSION_LIB:-code-extension-source.sh}
-source "${SETUP_LIBS_DIR}/${CODE_EXTENSION_LIB}"
-
-# Dart-Code.flutter depends on Dart-Code.dart-code; install the language support
-# first so the Flutter extension does not have to resolve it itself.
-install_extensions Dart-Code.dart-code Dart-Code.flutter
-
-echo "✅ Extension installation completed."
diff --git a/examples/workspaces/flutter-example/.booth/setups/flutter-linux-desktop--setup.sh b/examples/workspaces/flutter-example/.booth/setups/flutter-linux-desktop--setup.sh
deleted file mode 100755
index e21f6f7d..00000000
--- a/examples/workspaces/flutter-example/.booth/setups/flutter-linux-desktop--setup.sh
+++ /dev/null
@@ -1,103 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# flutter-linux-desktop--setup.sh
-# Adds the native toolchain and GTK headers Flutter's Linux desktop target
-# compiles against, so `flutter build linux` works and `flutter doctor` stops
-# reporting the Linux toolchain as incomplete.
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0
-
-Notes:
-- Run after flutter--setup.sh; skips cleanly if Flutter is absent.
-- A built Linux app is a GUI binary: it needs a desktop variant (or an X server
-  on DISPLAY) to actually run. It still *builds* on the base variant.
-USAGE
-}
-
-# ---- root check ----
-[[ $EUID -eq 0 ]] || { echo "❌ This script must be run as root (use sudo)" >&2; exit 1; }
-
-# This script will always be installed by root.
-HOME=/root
-
-SCRIPT_NAME="$(basename "$0")"
-SCRIPT_DIR="$(dirname "$0")"
-
-# A script copied into a project's .booth/setups/ shadows the image's copy, but
-# libs/ does not come with it -- so $SCRIPT_DIR/libs is simply absent on the very
-# path the dev loop and the complex tests use.
-SETUP_LIBS_DIR=${SETUP_LIBS_DIR:-/opt/codingbooth/setups/libs}
-if [[ -r "$SCRIPT_DIR/libs/skip-setup.sh" ]]; then
-    source "$SCRIPT_DIR/libs/skip-setup.sh"
-else
-    source "${SETUP_LIBS_DIR}/skip-setup.sh"
-fi
-
-case "${1:-}" in
-  -h|--help) usage; exit 0 ;;
-  "") ;;
-  *) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
-esac
-
-# ---- guard ----
-if ! command -v flutter >/dev/null 2>&1; then
-  skip_setup "$SCRIPT_NAME" "Flutter not installed (run flutter--setup.sh first)"
-fi
-
-export FLUTTER_SUPPRESS_ANALYTICS=true
-
-# ---- toolchain ----
-export DEBIAN_FRONTEND=noninteractive
-apt-get update
-apt-get install -y --no-install-recommends \
-  clang cmake ninja-build pkg-config \
-  libgtk-3-dev liblzma-dev libglu1-mesa
-
-# Flutter's own docs name libstdc++-12-dev, but the package is tied to the
-# distro's default GCC -- 24.04 ships 13, and older/newer bases ship something
-# else. Take whichever exists rather than pinning a number that rots.
-libstdcxx_dev=""
-for v in 14 13 12; do
-  if apt-cache show "libstdc++-${v}-dev" >/dev/null 2>&1; then
-    libstdcxx_dev="libstdc++-${v}-dev"
-    break
-  fi
-done
-if [[ -n "$libstdcxx_dev" ]]; then
-  apt-get install -y --no-install-recommends "$libstdcxx_dev"
-else
-  echo "⚠️  No libstdc++-*-dev found in apt; C++ headers may be incomplete."
-fi
-rm -rf /var/lib/apt/lists/*
-
-# ---- engine artifacts ----
-echo "Fetching the Flutter Linux desktop engine artifacts ..."
-flutter precache --linux > /dev/null
-
-# ---- summary ----
-echo "✅ Flutter Linux desktop toolchain installed."
-echo -n "   clang: "; clang --version 2>/dev/null | grep -m1 . || echo "?"
-echo -n "   cmake: "; cmake --version 2>/dev/null | grep -m1 . || echo "?"
-
-# ---- permissions (must be last) ----
-# precache wrote into the SDK tree as root; re-open it for the booth user. Kept
-# last on purpose: any root-run flutter command after this point would leave
-# freshly written cache files root-owned and 0644, and the tool's runtime `mv`
-# over such a file prompts and hangs with no output.
-FLUTTER_DIR="$(readlink -f /usr/local/flutter-current)"
-chmod -R a+rwX "${FLUTTER_DIR}/bin/cache"
-
-cat <<'EON'
-Ready to use:
-- Build a Linux app:  flutter build linux
-- Run it (needs a desktop variant, or DISPLAY set):
-      flutter run -d linux
-EON
diff --git a/examples/workspaces/turtle-example/.booth/setups/cb-has-desktop.sh b/examples/workspaces/turtle-example/.booth/setups/cb-has-desktop.sh
deleted file mode 100755
index 0dd3a385..00000000
--- a/examples/workspaces/turtle-example/.booth/setups/cb-has-desktop.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/bash
-# Returns 0 if desktop environment is available, 1 otherwise.
-# Update this script as display technology evolves.
-
-# X11/VNC-based desktop
-command -v Xvnc &>/dev/null && exit 0
-command -v tigervncserver &>/dev/null && exit 0
-
-# XFCE
-command -v startxfce4 &>/dev/null && exit 0
-command -v xfce4-session &>/dev/null && exit 0
-
-# KDE
-command -v startplasma-x11 &>/dev/null && exit 0
-command -v plasmashell &>/dev/null && exit 0
-
-# Wayland-based desktop (wlroots compositors + kiosk)
-command -v labwc &>/dev/null && exit 0
-command -v wayfire &>/dev/null && exit 0
-command -v sway &>/dev/null && exit 0
-command -v weston &>/dev/null && exit 0
-command -v cage &>/dev/null && exit 0
-command -v gamescope &>/dev/null && exit 0
-
-exit 1
diff --git a/examples/workspaces/turtle-example/.booth/setups/logo--setup.sh b/examples/workspaces/turtle-example/.booth/setups/logo--setup.sh
deleted file mode 100755
index 46772ac8..00000000
--- a/examples/workspaces/turtle-example/.booth/setups/logo--setup.sh
+++ /dev/null
@@ -1,129 +0,0 @@
-#!/bin/bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [PORT]
-
-Arguments:
-  PORT  Port for the Logo web editor (default: 18610)
-
-Examples:
-  $0            # install with default port 18610
-  $0 18700      # use port 18700
-
-Notes:
-- Installs Node.js (if not present) and the 'serve' static server
-- Copies the vendored JSLogo editor to /opt/logo (no npm build)
-- Access: http://localhost:<PORT>
-- Hide the green turtle in a program with: hideturtle   (or ht)
-- JSLogo is Apache-2.0: https://github.com/inexorabletash/jslogo
-USAGE
-}
-
-# ---- root check ----
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-
-# This script will always be installed by root.
-HOME=/root
-
-# ---- defaults / args ----
-LOGO_PORT="${1:-18610}"
-LOGO_DIR="/opt/logo"
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-STARTER_FILE="/usr/local/bin/start-logo"
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-FILES_DIR="${SCRIPT_DIR}/logo-files"
-
-if [[ ! -d "$FILES_DIR" || ! -f "$FILES_DIR/index.html" ]]; then
-  echo "❌ logo-files/ (JSLogo) not found next to $0"
-  echo "   Expected: ${FILES_DIR}/index.html"
-  exit 1
-fi
-
-# ---- check if nodejs is already installed ----
-if command -v node >/dev/null 2>&1; then
-  echo "• Node.js already installed: $(node --version)"
-else
-  SETUPS_DIR="/opt/codingbooth/setups"
-  if [[ -x "$SETUPS_DIR/nodejs--setup.sh" ]]; then
-    echo "• Installing Node.js ..."
-    "$SETUPS_DIR/nodejs--setup.sh" 18
-  elif [[ -x "$SCRIPT_DIR/nodejs--setup.sh" ]]; then
-    echo "• Installing Node.js ..."
-    "$SCRIPT_DIR/nodejs--setup.sh" 18
-  else
-    echo "❌ nodejs--setup.sh not found"
-    exit 1
-  fi
-fi
-
-# ---- install serve globally ----
-echo "• Installing 'serve' ..."
-npm install -g serve
-
-# ---- install vendored JSLogo ----
-echo "• Installing JSLogo to ${LOGO_DIR} ..."
-mkdir -p "$LOGO_DIR"
-cp -a "$FILES_DIR"/. "$LOGO_DIR"/
-
-# ---- create starter script (manual foreground launch) ----
-cat > "${STARTER_FILE}" <<'STARTER'
-#!/usr/bin/env bash
-set -euo pipefail
-
-PORT=${1:-__LOGO_PORT__}
-URL="http://localhost:${PORT}/"
-
-if curl -sf --max-time 1 "http://127.0.0.1:${PORT}/" 2>/dev/null | grep -q "Logo Interpreter"; then
-  echo "Logo editor is already running at ${URL}"
-  echo "Hide the green turtle in a program with: hideturtle   (or ht)"
-  exit 0
-fi
-
-echo "Starting Logo editor on ${URL} ..."
-echo "Serving /opt/logo (installed by setup logo, not the project tree)"
-echo "Hide the green turtle in a program with: hideturtle   (or ht)"
-exec serve -s --no-clipboard /opt/logo -l "$PORT"
-STARTER
-sed -i "s/__LOGO_PORT__/${LOGO_PORT}/g" "${STARTER_FILE}"
-chmod 755 "${STARTER_FILE}"
-
-# ---- summary ----
-echo ""
-# Register a desktop icon that opens Logo in a browser (desktop variants only).
-# Same helper as Excalidraw/Scratch: writes /etc/cb-web-services/logo.conf and
-# /usr/share/applications/logo-web.desktop, then cb-desktop-icon.sh seeds
-# /etc/skel/Desktop. No-ops when cb-has-desktop.sh fails (base/notebook).
-# Resolve the helper from the image setups dir so a project-local copy of
-# *this* script still finds it.
-CB_SETUPS="${SETUPS_DIR:-/opt/codingbooth/setups}"
-export PATH="${CB_SETUPS}${PATH:+:$PATH}"
-ICON="applications-education"
-for candidate in icon.svg favicon.svg favicon.png favicon.ico; do
-  found="$(find "$LOGO_DIR" -maxdepth 2 -name "$candidate" -print -quit 2>/dev/null || true)"
-  if [ -n "$found" ]; then ICON="$found"; break; fi
-done
-cb-web-icon.sh --id logo --name "Logo" --icon "$ICON" \
-  --port "${LOGO_PORT}" --path / --start start-logo
-
-echo "✅ Logo editor installed."
-echo "   Location: ${LOGO_DIR}"
-echo "   Port:     ${LOGO_PORT}"
-echo "   Starter:  ${STARTER_FILE}"
-echo ""
-echo "ℹ️  Launch manually: start-logo [PORT]"
-echo "   Access: http://localhost:${LOGO_PORT}"
-echo "   Hide the turtle: hideturtle   (or ht)"
-echo "   Source: https://github.com/inexorabletash/jslogo"
diff --git a/examples/workspaces/turtle-example/.booth/setups/thonny--setup.sh b/examples/workspaces/turtle-example/.booth/setups/thonny--setup.sh
deleted file mode 100755
index 298a2f9f..00000000
--- a/examples/workspaces/turtle-example/.booth/setups/thonny--setup.sh
+++ /dev/null
@@ -1,109 +0,0 @@
-#!/bin/bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0
-
-Notes:
-- Installs Thonny, a beginner-friendly Python IDE
-- Requires a desktop environment
-- Requires Python (installed via the python template)
-- Installs via apt (Debian/Ubuntu thonny package)
-USAGE
-}
-
-# ---- root check ----
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-
-if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
-  usage
-  exit 0
-fi
-
-SCRIPT_NAME="$(basename "$0")"
-SCRIPT_DIR="$(dirname "$0")"
-source "$SCRIPT_DIR/libs/skip-setup.sh"
-if ! "$SCRIPT_DIR/cb-has-desktop.sh"; then
-    skip_setup "$SCRIPT_NAME" "desktop environment not available"
-fi
-
-# ---- install Thonny ----
-export DEBIAN_FRONTEND=noninteractive
-echo "• Installing Thonny from apt ..."
-# python3-tk: File → Open uses Tk dialogs when zenity is off (see config below).
-apt-get update
-apt-get install -y --no-install-recommends thonny python3-tk
-rm -rf /var/lib/apt/lists/*
-
-# File → Open on apt Thonny 4.0.1 calls zenity when file.avoid_zenity is
-# unset/False. Zenity over noVNC exits 255 ("This option is not available"),
-# so the Open icon does nothing. Force Tk dialogs on every launch.
-THONNY_INI_BODY='[file]
-avoid_zenity = True
-use_zenity = False
-last_browser_folder = /home/coder/code
-
-[run]
-working_directory = /home/coder/code
-'
-mkdir -p /etc/skel/.config/Thonny
-printf '%s' "$THONNY_INI_BODY" > /etc/skel/.config/Thonny/configuration.ini
-chmod 0644 /etc/skel/.config/Thonny/configuration.ini
-
-# Wrapper ahead of /usr/bin/thonny: rewrite the user's ini, then exec apt Thonny.
-# A one-shot startup is not enough — Thonny 4.0.1 writes its own config on first
-# run with avoid_zenity=False, which would undo a seed.
-WRAPPER="/usr/local/bin/thonny"
-cat > "$WRAPPER" <<'WRAPPER'
-#!/usr/bin/env bash
-set -euo pipefail
-python3 - <<'PY'
-from configparser import ConfigParser
-from pathlib import Path
-p = Path.home() / ".config/Thonny/configuration.ini"
-p.parent.mkdir(parents=True, exist_ok=True)
-cp = ConfigParser(interpolation=None)
-if p.exists():
-    cp.read(p, encoding="utf-8")
-if not cp.has_section("file"):
-    cp.add_section("file")
-cp.set("file", "avoid_zenity", "True")
-cp.set("file", "use_zenity", "False")
-cp.set("file", "last_browser_folder", "/home/coder/code")
-if not cp.has_section("run"):
-    cp.add_section("run")
-cp.set("run", "working_directory", "/home/coder/code")
-with p.open("w", encoding="utf-8") as f:
-    cp.write(f)
-PY
-exec /usr/bin/thonny "$@"
-WRAPPER
-chmod 755 "$WRAPPER"
-
-# ---- summary ----
-echo ""
-# Register a Thonny desktop icon (no-ops on non-desktop variants).
-cb-desktop-icon.sh thonny
-# The packaged launcher often Exec=/usr/bin/thonny, which would skip the wrapper.
-for desk in /usr/share/applications/thonny.desktop \
-            /usr/share/applications/org.thonny.Thonny.desktop \
-            /etc/skel/Desktop/thonny.desktop \
-            /etc/skel/Desktop/org.thonny.Thonny.desktop; do
-  if [ -f "$desk" ]; then
-    sed -i 's|^Exec=.*thonny|Exec=/usr/local/bin/thonny|' "$desk" || true
-  fi
-done
-echo "✅ Thonny installed."
-echo -n "   thonny → "; thonny --version 2>/dev/null || true
-echo ""
-echo "ℹ️  Launch: thonny"
-echo "   File → Open uses Tk dialogs (zenity is disabled; it no-ops over VNC)."
-echo "   Working directory: /home/coder/code"
-echo "   Docs:   https://thonny.org/"
diff --git a/examples/workspaces/wails-android-example/.booth/setups/wails--setup.sh b/examples/workspaces/wails-android-example/.booth/setups/wails--setup.sh
deleted file mode 100755
index 183f5910..00000000
--- a/examples/workspaces/wails-android-example/.booth/setups/wails--setup.sh
+++ /dev/null
@@ -1,164 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# wails--setup.sh — Install the Wails v3 CLI and the Linux GTK4/WebKitGTK
-# toolchain it compiles against.
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <tag>|latest]
-
-Examples:
-  $0                              # install latest wails3
-  $0 --version v3.0.0-beta.16     # pin a Wails v3 module version
-  $0 --version latest             # same as the default
-
-Notes:
-- Requires Go 1.25+ (run go--setup.sh first). Node.js is required to build
-  most Wails frontends (run nodejs--setup.sh).
-- Installs the Linux compile stack: build-essential, pkg-config, GTK 4, and
-  WebKitGTK 6.0 (the v3 default; Ubuntu 24.04 ships it).
-- The wails3 binary is copied to /usr/local/bin so a non-login shell
-  (booth -- cmd) finds it, not only an interactive login via GOPATH/bin.
-- See: https://v3.wails.io/quick-start/installation/
-USAGE
-}
-
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-HOME=/root
-
-SCRIPT_NAME="$(basename "$0")"
-SCRIPT_DIR="$(dirname "$0")"
-
-SETUP_LIBS_DIR=${SETUP_LIBS_DIR:-/opt/codingbooth/setups/libs}
-if [[ -r "$SCRIPT_DIR/libs/skip-setup.sh" ]]; then
-  source "$SCRIPT_DIR/libs/skip-setup.sh"
-else
-  source "${SETUP_LIBS_DIR}/skip-setup.sh"
-fi
-
-REQ_VER="latest"
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) shift; REQ_VER="${1:-latest}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "❌ Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-
-# ---- guards ----
-if [[ ! -x /usr/local/go-current/bin/go ]] && ! command -v go >/dev/null 2>&1; then
-  skip_setup "$SCRIPT_NAME" "Go is not installed (run go--setup.sh first)"
-fi
-
-# ---- Linux compile stack (GTK4 + WebKitGTK 6.0, Ubuntu 24.04+) ----
-export DEBIAN_FRONTEND=noninteractive
-apt-get update
-apt-get install -y --no-install-recommends \
-  build-essential \
-  pkg-config \
-  libgtk-4-dev \
-  libwebkitgtk-6.0-dev
-rm -rf /var/lib/apt/lists/*
-
-if ! pkg-config --exists gtk4; then
-  echo "❌ pkg-config cannot see gtk4 after installing libgtk-4-dev" >&2
-  exit 1
-fi
-if ! pkg-config --exists webkitgtk-6.0; then
-  echo "❌ pkg-config cannot see webkitgtk-6.0 after installing libwebkitgtk-6.0-dev" >&2
-  exit 1
-fi
-
-# ---- resolve the Go module version ----
-MODULE="github.com/wailsapp/wails/v3/cmd/wails3"
-FALLBACK_VERSION="v3.0.0-beta.16"
-
-if [[ "$REQ_VER" == "latest" ]]; then
-  SPEC="${MODULE}@latest"
-else
-  VER="${REQ_VER#v}"
-  SPEC="${MODULE}@v${VER}"
-fi
-
-echo "📦 Installing wails3 (${SPEC}) ..."
-
-# Install as coder so the module cache lives in the booth user's GOPATH, then
-# copy the binary to /usr/local/bin. go install talks to proxy.golang.org,
-# which resets often enough to fail a build; retry with backoff like go--install.sh.
-install -d -o coder -g coder /home/coder/go/bin /home/coder/go/pkg /home/coder/go/src
-
-install_cli() {
-  local spec="$1"
-  sudo -u coder bash -lc "go install '${spec}'"
-}
-
-attempt=1
-until install_cli "$SPEC"; do
-  if [[ "$REQ_VER" == "latest" && $attempt -ge 1 && "$SPEC" == "${MODULE}@latest" ]]; then
-    echo "⚠️  go install @latest failed; falling back to ${FALLBACK_VERSION}." >&2
-    SPEC="${MODULE}@${FALLBACK_VERSION}"
-  fi
-  if [[ $attempt -ge 3 ]]; then
-    echo "❌ go install '${SPEC}' failed after ${attempt} attempts." >&2
-    exit 1
-  fi
-  echo "⚠️  go install '${SPEC}' failed (attempt ${attempt}); retrying in $((attempt * 5))s..." >&2
-  sleep "$((attempt * 5))"
-  attempt=$((attempt + 1))
-done
-
-WAILS_SRC=""
-for candidate in /home/coder/go/bin/wails3 /root/go/bin/wails3; do
-  if [[ -x "$candidate" ]]; then
-    WAILS_SRC="$candidate"
-    break
-  fi
-done
-if [[ -z "$WAILS_SRC" ]]; then
-  echo "❌ go install succeeded but wails3 was not in GOPATH/bin" >&2
-  exit 1
-fi
-
-install -m 755 "$WAILS_SRC" /usr/local/bin/wails3
-
-# WebKitGTK 6.0 sandboxes the renderer with bubblewrap, which needs user
-# namespaces a booth container does not grant. Same class of workaround as
-# Chromium's --no-sandbox wrappers. Without this, a Wails Linux GUI dies at
-# start with: bwrap: No permissions to create new namespace / Failed to
-# fully launch dbus-proxy. The template also injects these via docker -e
-# (run-args) so non-login shells and the desktop session see them; the
-# profile covers an interactive login that used `setup wails` by hand.
-LEVEL=65
-PROFILE_FILE="/etc/profile.d/${LEVEL}-cb-wails--profile.sh"
-cat > "${PROFILE_FILE}" <<'EOF'
-# Profile: Wails / WebKitGTK in a container
-export WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS="${WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS:-1}"
-export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-1}"
-EOF
-chmod 644 "${PROFILE_FILE}"
-
-echo "✅ Wails v3 CLI installed."
-echo -n "   wails3: "; /usr/local/bin/wails3 version 2>&1 | head -1 || echo "?"
-echo -n "   gtk4: "; pkg-config --modversion gtk4 2>/dev/null || echo "?"
-echo -n "   webkitgtk-6.0: "; pkg-config --modversion webkitgtk-6.0 2>/dev/null || echo "?"
-echo "   Binary: /usr/local/bin/wails3"
-
-cat <<'INFO'
-ℹ️ Ready to use:
-- Check the toolchain:  wails3 doctor
-- Start an app:         wails3 init -n myapp -t vanilla && cd myapp
-- Build this machine:   wails3 build
-- Cross-compile Windows (no Docker):  wails3 build GOOS=windows
-- Cross-compile macOS / other-arch Linux: select wails+cross, then
-      wails3 task setup:docker
-      wails3 build GOOS=darwin GOARCH=arm64
-  Running a Linux GUI binary needs a desktop variant (or DISPLAY).
-  WebKitGTK sandbox is disabled in the booth (no user namespaces);
-  WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 is set for that.
-INFO
diff --git a/examples/workspaces/wails-android-example/.booth/setups/wails-android--setup.sh b/examples/workspaces/wails-android-example/.booth/setups/wails-android--setup.sh
deleted file mode 100755
index 36f50872..00000000
--- a/examples/workspaces/wails-android-example/.booth/setups/wails-android--setup.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# wails-android--setup.sh
-# Installs the Android NDK and API 35 platform Wails v3's Gradle file compiles
-# against, so `wails3 task android:build` can produce an APK.
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0
-
-Notes:
-- Run after wails--setup.sh and android-sdk--setup.sh; skips cleanly if the
-  SDK is missing, so a booth without it still builds.
-- Wails' template pins compileSdk/targetSdk 35 and looks for NDK 26.3.x
-  (see build/android/Taskfile.yml). A stock android-sdk install is API 34
-  and has no NDK, so the Gradle task fails without this.
-USAGE
-}
-
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-HOME=/root
-
-SCRIPT_NAME="$(basename "$0")"
-SCRIPT_DIR="$(dirname "$0")"
-
-SETUP_LIBS_DIR=${SETUP_LIBS_DIR:-/opt/codingbooth/setups/libs}
-if [[ -r "$SCRIPT_DIR/libs/skip-setup.sh" ]]; then
-  source "$SCRIPT_DIR/libs/skip-setup.sh"
-else
-  source "${SETUP_LIBS_DIR}/skip-setup.sh"
-fi
-
-ANDROID_SDK_DIR=/opt/android-sdk
-# Pin matches the version Wails' Android Taskfile tells you to install.
-NDK_VERSION="26.3.11579264"
-ANDROID_API="35"
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    -h|--help) usage; exit 0 ;;
-    *) echo "Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-
-SDKMANAGER="${ANDROID_SDK_DIR}/cmdline-tools/latest/bin/sdkmanager"
-if [[ ! -x "$SDKMANAGER" ]]; then
-  skip_setup "$SCRIPT_NAME" "Android SDK not found at ${ANDROID_SDK_DIR}"
-fi
-
-# android-sdk already skipped on arm64; match that so this layer does not fail
-# the image.
-dpkgArch="$(dpkg --print-architecture)"
-if [[ "$dpkgArch" != "amd64" ]]; then
-  skip_setup "$SCRIPT_NAME" "Android NDK is published for linux x86_64 only (host is ${dpkgArch})"
-fi
-
-export ANDROID_SDK_ROOT="$ANDROID_SDK_DIR"
-export ANDROID_HOME="$ANDROID_SDK_DIR"
-
-# Licenses were accepted in android-sdk--setup.sh; NDK/API 35 can introduce
-# extra ones. `yes | --licenses` exits non-zero when stdin dries up — expected.
-yes | "$SDKMANAGER" --licenses >/dev/null 2>&1 || true
-
-# Do not pipe `yes` into --install: under `set -o pipefail` `yes` dies with
-# SIGPIPE when sdkmanager closes stdin, and the layer fails even if the
-# packages installed. android-sdk--setup.sh and android-emulator--setup.sh
-# call --install the same way.
-echo "Installing Android NDK ${NDK_VERSION} and platforms;android-${ANDROID_API} ..."
-"$SDKMANAGER" --install \
-  "ndk;${NDK_VERSION}" \
-  "platforms;android-${ANDROID_API}"
-
-NDK_HOME="${ANDROID_SDK_DIR}/ndk/${NDK_VERSION}"
-if [[ ! -d "$NDK_HOME" ]]; then
-  echo "❌ NDK did not land at ${NDK_HOME}" >&2
-  exit 1
-fi
-chmod -R a+rX "$NDK_HOME" "${ANDROID_SDK_DIR}/platforms/android-${ANDROID_API}"
-
-# Login shells get ANDROID_NDK_HOME. just build-android also exports it so a
-# non-login `booth -- just build-android` sees the same path.
-cat >/etc/profile.d/67-cb-wails-android--profile.sh <<EOF
-# NDK Wails compiles libwails.so with
-export ANDROID_NDK_HOME=${NDK_HOME}
-EOF
-chmod 0644 /etc/profile.d/67-cb-wails-android--profile.sh
-
-echo "✅ Wails Android NDK ${NDK_VERSION} and API ${ANDROID_API} installed."
-cat <<EON
-ℹ️ Ready to use:
-  wails3 task android:build
-  wails3 task android:assemble:apk    # debug APK → bin/<app>.apk
-  just build-android                  # same, from the example Justfile
-EON
diff --git a/examples/workspaces/wails-example/.booth/setups/wails--setup.sh b/examples/workspaces/wails-example/.booth/setups/wails--setup.sh
deleted file mode 100755
index 183f5910..00000000
--- a/examples/workspaces/wails-example/.booth/setups/wails--setup.sh
+++ /dev/null
@@ -1,164 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2025-2026 : Nawa Manusitthipol
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-
-# wails--setup.sh — Install the Wails v3 CLI and the Linux GTK4/WebKitGTK
-# toolchain it compiles against.
-set -Eeuo pipefail
-trap 'echo "❌ Error on line $LINENO"; exit 1' ERR
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 [--version <tag>|latest]
-
-Examples:
-  $0                              # install latest wails3
-  $0 --version v3.0.0-beta.16     # pin a Wails v3 module version
-  $0 --version latest             # same as the default
-
-Notes:
-- Requires Go 1.25+ (run go--setup.sh first). Node.js is required to build
-  most Wails frontends (run nodejs--setup.sh).
-- Installs the Linux compile stack: build-essential, pkg-config, GTK 4, and
-  WebKitGTK 6.0 (the v3 default; Ubuntu 24.04 ships it).
-- The wails3 binary is copied to /usr/local/bin so a non-login shell
-  (booth -- cmd) finds it, not only an interactive login via GOPATH/bin.
-- See: https://v3.wails.io/quick-start/installation/
-USAGE
-}
-
-[[ $EUID -eq 0 ]] || { echo "❌ Run as root (sudo)"; exit 1; }
-HOME=/root
-
-SCRIPT_NAME="$(basename "$0")"
-SCRIPT_DIR="$(dirname "$0")"
-
-SETUP_LIBS_DIR=${SETUP_LIBS_DIR:-/opt/codingbooth/setups/libs}
-if [[ -r "$SCRIPT_DIR/libs/skip-setup.sh" ]]; then
-  source "$SCRIPT_DIR/libs/skip-setup.sh"
-else
-  source "${SETUP_LIBS_DIR}/skip-setup.sh"
-fi
-
-REQ_VER="latest"
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --version) shift; REQ_VER="${1:-latest}"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) echo "❌ Unknown arg: $1" >&2; usage; exit 2 ;;
-  esac
-done
-
-# ---- guards ----
-if [[ ! -x /usr/local/go-current/bin/go ]] && ! command -v go >/dev/null 2>&1; then
-  skip_setup "$SCRIPT_NAME" "Go is not installed (run go--setup.sh first)"
-fi
-
-# ---- Linux compile stack (GTK4 + WebKitGTK 6.0, Ubuntu 24.04+) ----
-export DEBIAN_FRONTEND=noninteractive
-apt-get update
-apt-get install -y --no-install-recommends \
-  build-essential \
-  pkg-config \
-  libgtk-4-dev \
-  libwebkitgtk-6.0-dev
-rm -rf /var/lib/apt/lists/*
-
-if ! pkg-config --exists gtk4; then
-  echo "❌ pkg-config cannot see gtk4 after installing libgtk-4-dev" >&2
-  exit 1
-fi
-if ! pkg-config --exists webkitgtk-6.0; then
-  echo "❌ pkg-config cannot see webkitgtk-6.0 after installing libwebkitgtk-6.0-dev" >&2
-  exit 1
-fi
-
-# ---- resolve the Go module version ----
-MODULE="github.com/wailsapp/wails/v3/cmd/wails3"
-FALLBACK_VERSION="v3.0.0-beta.16"
-
-if [[ "$REQ_VER" == "latest" ]]; then
-  SPEC="${MODULE}@latest"
-else
-  VER="${REQ_VER#v}"
-  SPEC="${MODULE}@v${VER}"
-fi
-
-echo "📦 Installing wails3 (${SPEC}) ..."
-
-# Install as coder so the module cache lives in the booth user's GOPATH, then
-# copy the binary to /usr/local/bin. go install talks to proxy.golang.org,
-# which resets often enough to fail a build; retry with backoff like go--install.sh.
-install -d -o coder -g coder /home/coder/go/bin /home/coder/go/pkg /home/coder/go/src
-
-install_cli() {
-  local spec="$1"
-  sudo -u coder bash -lc "go install '${spec}'"
-}
-
-attempt=1
-until install_cli "$SPEC"; do
-  if [[ "$REQ_VER" == "latest" && $attempt -ge 1 && "$SPEC" == "${MODULE}@latest" ]]; then
-    echo "⚠️  go install @latest failed; falling back to ${FALLBACK_VERSION}." >&2
-    SPEC="${MODULE}@${FALLBACK_VERSION}"
-  fi
-  if [[ $attempt -ge 3 ]]; then
-    echo "❌ go install '${SPEC}' failed after ${attempt} attempts." >&2
-    exit 1
-  fi
-  echo "⚠️  go install '${SPEC}' failed (attempt ${attempt}); retrying in $((attempt * 5))s..." >&2
-  sleep "$((attempt * 5))"
-  attempt=$((attempt + 1))
-done
-
-WAILS_SRC=""
-for candidate in /home/coder/go/bin/wails3 /root/go/bin/wails3; do
-  if [[ -x "$candidate" ]]; then
-    WAILS_SRC="$candidate"
-    break
-  fi
-done
-if [[ -z "$WAILS_SRC" ]]; then
-  echo "❌ go install succeeded but wails3 was not in GOPATH/bin" >&2
-  exit 1
-fi
-
-install -m 755 "$WAILS_SRC" /usr/local/bin/wails3
-
-# WebKitGTK 6.0 sandboxes the renderer with bubblewrap, which needs user
-# namespaces a booth container does not grant. Same class of workaround as
-# Chromium's --no-sandbox wrappers. Without this, a Wails Linux GUI dies at
-# start with: bwrap: No permissions to create new namespace / Failed to
-# fully launch dbus-proxy. The template also injects these via docker -e
-# (run-args) so non-login shells and the desktop session see them; the
-# profile covers an interactive login that used `setup wails` by hand.
-LEVEL=65
-PROFILE_FILE="/etc/profile.d/${LEVEL}-cb-wails--profile.sh"
-cat > "${PROFILE_FILE}" <<'EOF'
-# Profile: Wails / WebKitGTK in a container
-export WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS="${WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS:-1}"
-export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-1}"
-EOF
-chmod 644 "${PROFILE_FILE}"
-
-echo "✅ Wails v3 CLI installed."
-echo -n "   wails3: "; /usr/local/bin/wails3 version 2>&1 | head -1 || echo "?"
-echo -n "   gtk4: "; pkg-config --modversion gtk4 2>/dev/null || echo "?"
-echo -n "   webkitgtk-6.0: "; pkg-config --modversion webkitgtk-6.0 2>/dev/null || echo "?"
-echo "   Binary: /usr/local/bin/wails3"
-
-cat <<'INFO'
-ℹ️ Ready to use:
-- Check the toolchain:  wails3 doctor
-- Start an app:         wails3 init -n myapp -t vanilla && cd myapp
-- Build this machine:   wails3 build
-- Cross-compile Windows (no Docker):  wails3 build GOOS=windows
-- Cross-compile macOS / other-arch Linux: select wails+cross, then
-      wails3 task setup:docker
-      wails3 build GOOS=darwin GOARCH=arm64
-  Running a Linux GUI binary needs a desktop variant (or DISPLAY).
-  WebKitGTK sandbox is disabled in the booth (no user namespaces);
-  WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 is set for that.
-INFO
diff --git a/variants/base/setups/erlang--setup.sh b/variants/base/setups/erlang--setup.sh
index bc842333..d16a132c 100755
--- a/variants/base/setups/erlang--setup.sh
+++ b/variants/base/setups/erlang--setup.sh
@@ -88,6 +88,32 @@ apt-get install -y --no-install-recommends \
 
 rm -rf /var/lib/apt/lists/*
 
+# --- verify the requested version actually got installed ---
+# On arm64, ppa:rabbitmq/rabbitmq-erlang-26/27/28 publishes only a handful of
+# arch-independent metapackages (erlang, erlang-nox, ...) — none of the
+# granular erlang-base/erlang-dev/... packages installed above by name. apt
+# then silently satisfies those names from Ubuntu's own default archive,
+# which only carries OTP 25 on that architecture, so a request for 26/27/28
+# quietly becomes 25 with no error from apt at all — until something
+# downstream (e.g. elixir--setup.sh picking a release asset for "the
+# installed OTP") fails confusingly, far away from the actual cause. Check
+# at the source instead of letting that happen.
+INSTALLED_OTP_MAJOR=$(erl -noshell -eval 'io:format("~s~n",[erlang:system_info(otp_release)]), halt().' 2>/dev/null || echo "")
+if [[ -z "$INSTALLED_OTP_MAJOR" ]]; then
+  echo "❌ Erlang/OTP did not install correctly (erl not runnable)." >&2
+  exit 1
+fi
+if [[ "$INSTALLED_OTP_MAJOR" != "$OTP_VERSION" ]]; then
+  ARCH="$(dpkg --print-architecture 2>/dev/null || uname -m)"
+  echo "❌ Requested OTP ${OTP_VERSION} but apt installed OTP ${INSTALLED_OTP_MAJOR} instead." >&2
+  echo "   On ${ARCH}, ppa:rabbitmq/rabbitmq-erlang-${OTP_VERSION} does not publish the" >&2
+  echo "   individual erlang-base/erlang-dev/... packages this script installs by name" >&2
+  echo "   — only a few arch-independent metapackages. apt silently fell back to" >&2
+  echo "   Ubuntu's default archive, which only has OTP 25 on this architecture." >&2
+  echo "   Use --otp-version 25, or build/run this on an amd64 host." >&2
+  exit 1
+fi
+
 # --- rebar3 (optional) ---
 if [[ "$WITH_REBAR3" -eq 1 ]]; then
   echo "📦 Installing rebar3 ..."

From ae83c76bb7d7d18bb7679e8c89da6011769fb1dc Mon Sep 17 00:00:00 2001
From: Nawa Manusitthipol <nawa@nawaman.net>
Date: Fri, 11 Sep 2026 18:09:24 -0400
Subject: [PATCH 2/3] Fix affine-example and anythingllm-example UID-remap
 permission crashes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both setup scripts chown app files to coder:coder during the Docker build,
but the container's coder user is remapped to HOST_UID/HOST_GID at start
(see booth-entry) — a remap scoped to $HOME only. Anything outside it, like
/opt/affine or /opt/anythingllm, keeps whatever owner it had at build time
regardless of who "coder" resolves to later, so on any host whose UID isn't
1000 (the base image's build-time default — macOS regular accounts start at
501, not 1000) the app crashes writing to its own install directory:

- AFFiNE's GraphQL module writes a generated schema under $AFFINE_DIR/src on
  every boot -> EACCES on mkdir. Fixed by making the directory world-writable
  at build time (chmod -R a+rwX) — the write here is a plain mkdir, so this
  sidesteps the ownership question entirely with no runtime cost.
- AnythingLLM's `prisma generate` copies files into node_modules/.prisma via
  Node's fs.copyFile, which uses copy_file_range() -> EPERM on Docker
  Desktop's overlay2/virtiofs specifically when the caller doesn't own the
  destination, even though the permission bits allow the write (verified: an
  equivalent `cp` succeeds, Node's copyFile does not). chmod alone isn't
  enough here, so this one re-chowns to the real runtime UID/GID at server
  start instead, in its own STARTER_FILE.

Also widened both examples' own readiness-poll ceilings (demo.sh) from 3/5
minutes to 8/8.3 minutes — first-boot work can legitimately take longer than
that under host contention, independent of the crash above.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137yjw6oV573p5vEfCoqNpj
---
 examples/workspaces/affine-example/demo.sh    |  5 +++-
 .../workspaces/anythingllm-example/demo.sh    |  6 ++++-
 variants/base/setups/affine-server--setup.sh  | 11 +++++++--
 variants/base/setups/anythingllm--setup.sh    | 24 +++++++++++++++++++
 4 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/examples/workspaces/affine-example/demo.sh b/examples/workspaces/affine-example/demo.sh
index a020f5ba..7d7570d2 100755
--- a/examples/workspaces/affine-example/demo.sh
+++ b/examples/workspaces/affine-example/demo.sh
@@ -15,7 +15,10 @@ echo "Waiting for AFFiNE Server on ${URL} ..."
 
 up=0
 code=""
-for _ in $(seq 1 90); do
+# 240 * 2s = 8 minutes. Postgres/Redis warm-up plus AFFiNE's own boot can run
+# past the old 90*2s=3min budget when the host is busy building other example
+# images concurrently (see run-example-tests.sh's intermittent-under-load note).
+for _ in $(seq 1 240); do
   # Follow redirects: a fresh instance 302s to /admin/setup (create first account).
   code="$(curl -sS -L --max-redirs 5 -o "$BODY" -w '%{http_code}' --max-time 5 "$URL" 2>/dev/null || true)"
   if [[ "$code" =~ ^(200|301|302|303|307|308)$ ]]; then
diff --git a/examples/workspaces/anythingllm-example/demo.sh b/examples/workspaces/anythingllm-example/demo.sh
index 8e6eab79..e8ecf5b8 100755
--- a/examples/workspaces/anythingllm-example/demo.sh
+++ b/examples/workspaces/anythingllm-example/demo.sh
@@ -12,7 +12,11 @@ echo "=== Waiting for AnythingLLM on :${PORT} ==="
 echo "(first boot copies a large image and may take several minutes)"
 
 body=""
-for _ in $(seq 1 60); do
+# 100 * 5s = ~8.3 minutes. First boot runs `prisma generate`/`migrate deploy`
+# before the server answers at all, which can run past the old 60*5s=5min
+# budget when the host is busy building other example images concurrently
+# (see run-example-tests.sh's intermittent-under-load note).
+for _ in $(seq 1 100); do
   if body="$(curl -fsS -m 3 "http://127.0.0.1:${PORT}/api/ping" 2>/dev/null)"; then
     break
   fi
diff --git a/variants/base/setups/affine-server--setup.sh b/variants/base/setups/affine-server--setup.sh
index 242adc3a..5c2f45b7 100755
--- a/variants/base/setups/affine-server--setup.sh
+++ b/variants/base/setups/affine-server--setup.sh
@@ -132,8 +132,15 @@ else
 fi
 rm -rf /var/lib/apt/lists/*
 
-# Readable by the booth user; predeploy may write under /opt/affine.
-chmod -R a+rX "$AFFINE_DIR"
+# World-writable, not just coder-owned: coder's UID is remapped to the host
+# user's UID/GID at container start (see booth-entry), but that remap only
+# re-chowns $HOME — anything outside it, like this directory, keeps whatever
+# owner it had at build time regardless of who "coder" resolves to later.
+# AFFiNE's GraphQL module writes a generated schema under $AFFINE_DIR/src on
+# every boot (not just once), so a stale owner there is a hard crash (EACCES)
+# rather than a cosmetic warning. Making it writable by anyone sidesteps the
+# ownership question entirely instead of trying to guess or track the UID.
+chmod -R a+rwX "$AFFINE_DIR"
 if id coder >/dev/null 2>&1; then
   chown -R coder:coder "$AFFINE_DIR" || true
 fi
diff --git a/variants/base/setups/anythingllm--setup.sh b/variants/base/setups/anythingllm--setup.sh
index 49c3d095..d1aaef54 100755
--- a/variants/base/setups/anythingllm--setup.sh
+++ b/variants/base/setups/anythingllm--setup.sh
@@ -140,6 +140,20 @@ fi
 rm -rf /var/lib/apt/lists/*
 
 # Readable by the booth user; prisma generate may write under /opt/anythingllm.
+#
+# Deliberately chown, not chmod a+rwX: Prisma's generator copies
+# schema.prisma into node_modules/.prisma/client via Node's fs.copyFile,
+# which uses the copy_file_range() syscall. Under Docker Desktop's
+# overlay2-on-virtiofs setup, that syscall can return EPERM specifically
+# when the calling process doesn't *own* the destination file, even though
+# the permission bits allow the write (verified: a plain `cp` of the same
+# file with the same mode succeeds; Node's copyFile does not). Making the
+# directory merely world-writable does not avoid this — the process needs
+# to actually own the files, hence chown below and again at start time in
+# the STARTER_FILE (coder's UID is remapped to the host user's UID/GID at
+# container start — see booth-entry — but that remap only re-chowns
+# $HOME; anything outside it, like this directory, keeps whatever owner it
+# had at build time regardless of who "coder" resolves to later).
 chmod -R a+rX "$ANYTHINGLLM_DIR"
 if id coder >/dev/null 2>&1; then
   chown -R coder:coder "$ANYTHINGLLM_DIR" || true
@@ -379,6 +393,16 @@ fi
 echo "Starting AnythingLLM on http://localhost:$PORT ..."
 echo "  storage: $STORAGE_DIR"
 
+# The build-time `chown -R coder:coder "$ANYTHINGLLM_DIR"` above bakes in
+# whatever UID "coder" had during the image build. The container's coder
+# user is then remapped to HOST_UID/HOST_GID at start, so that baked-in
+# owner can point at a UID nothing maps to anymore. `prisma generate`
+# copies files under node_modules/.prisma via Node's fs.copyFile on every
+# boot; on Docker Desktop's overlay2/virtiofs that call needs the process
+# to actually own the destination (EPERM otherwise — chmod a+rwX alone is
+# not enough, verified), so re-chown to match the real runtime UID here.
+sudo chown -R "$(id -u):$(id -g)" "$APP" 2>/dev/null || true
+
 cd "$APP/server"
 if [[ -f prisma/schema.prisma ]]; then
   npx prisma generate --schema=./prisma/schema.prisma

From c049beae5a7f03f7f1423ef835f10a61a409bf15 Mon Sep 17 00:00:00 2001
From: Nawa Manusitthipol <nawa@nawaman.net>
Date: Fri, 11 Sep 2026 21:47:49 -0400
Subject: [PATCH 3/3] Fix flutter-example: force amd64 so the Flutter SDK
 actually installs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

flutter--setup.sh has an arch gate: Google only publishes the Flutter
Linux SDK for x86_64, so on arm64 it prints a warning and `exit 0`s
before installing anything — no SDK, no PATH wrappers, no profile entry.
On an arm64 host this example built "successfully" while silently
skipping the entire Flutter install, so every in-booth test failed
looking for a `flutter`/`dart` that was never there. Same situation as
android-example (an x86_64-only SDK), fixed the same way: force
--platform linux/amd64 via common-args (CB_FLUTTER_PLATFORM overrides
it for an arm64 CI runner). Verified end-to-end: SDK install, web build,
and the widget test all pass now.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0137yjw6oV573p5vEfCoqNpj
---
 examples/workspaces/flutter-example/.booth/config.toml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/examples/workspaces/flutter-example/.booth/config.toml b/examples/workspaces/flutter-example/.booth/config.toml
index 5440a561..492b2945 100644
--- a/examples/workspaces/flutter-example/.booth/config.toml
+++ b/examples/workspaces/flutter-example/.booth/config.toml
@@ -1,2 +1,8 @@
 # Configured by: booth config --no-tui --overwrite --select flutter
+# --platform forced below: Google publishes the Flutter Linux SDK for x86_64
+# only, so flutter--setup.sh silently skips the whole install on an arm64
+# host (exit 0, "skipping the Flutter install") rather than failing the
+# build — the same x86_64-only-SDK situation android-example handles the
+# same way. CB_FLUTTER_PLATFORM overrides it for an arm64 CI runner.
 
+common-args = ["--platform", "${CB_FLUTTER_PLATFORM:-linux/amd64}"]