# Cockpit 360 JS API Sandboxing Notes

Server: rayserver, Cockpit version 360 (dpkg).

## What Works

- Basic page rendering (HTML, CSS, JS)
- Cockpit CSS theme (../base1/cockpit.css)
- Cockpit JS library (../base1/cockpit.js)

## What Fails

### cockpit.script() — ALWAYS FAILS for system commands
Even with full paths like `/usr/bin/nvidia-smi`, the call never resolves.
The `.done()` callback never fires, `.fail()` may not fire either — it just hangs.
Does NOT produce an error in browser console.

Tested: `cockpit.script("/usr/bin/nvidia-smi --query-gpu=name ...")` — hangs indefinitely.

### cockpit.file().read() — FAILS for absolute paths
Trying to read `/run/nvidia-gpu.txt`, `/tmp/anything` — `.fail()` fires.
The error object is empty or useless.
Likely Cockpit 360 restricts file reads to package-relative paths or whitelisted dirs.

### cockpit.spawn() — UNCONFIRMED
Currently testing: `cockpit.spawn(["cat", "/run/nvidia-gpu.txt"])`.
Theory: simpler commands (cat vs nvidia-smi) may work since they don't need GPU driver access.

## What's Working (infrastructure)

- `nvidia-gpu-monitor.service` — writes every 5s to:
  - `/run/nvidia-gpu.txt` — GPU name, driver, temp, util, memory, power, pstate, fan
  - `/run/nvidia-processes.txt` — PID, process_name, used_memory
  - `/run/nvidia-cuda.txt` — CUDA version string
- Files are world-readable (644), owned by root
- `nvidia-smi` works perfectly from terminal and from the service

## Current Page Location
`/usr/share/cockpit/nvidia-gpu/index.html`
Manifest: `/usr/share/cockpit/nvidia-gpu/manifest.json` (CSP allows unsafe-inline, menu section)