@app-vitals/agent-runtime 1.2.3 → 1.2.4

package/Dockerfile

@@ -54,7 +54,10 @@ FROM oven/bun:1.4.4-slim@sha256:1846adf22496bd711036aae8be147e57bdebbaea2e5264e3
 #     package set as full `chromium` on this OS.
 #     oven/bun:1.4.4-slim is Debian trixie (13) — see node-source stage comment above
 #     — hence the t64-suffixed package names (Debian's 64-bit time_t transition).
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# Upgrade apt/libapt-pkg7.0 past the base image's 3.0.3 (Trivy HIGH CVE-2026-109518, fixed in 3.0.4).
+RUN apt-get update \
+    && apt-get install -y --only-upgrade apt libapt-pkg7.0 \
+    && apt-get install -y --no-install-recommends \
     git \
     curl \
     ca-certificates \
@@ -129,13 +132,20 @@ RUN curl -fsSL -o /tmp/mise-install.sh https://mise.run \
 # deb.nodesource.com (see that stage's comment).
 COPY --from=node-source /usr/local/bin/node /usr/local/bin/node
 COPY --from=node-source /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm
+# The npm copied from node-source bundles vulnerable undici/brace-expansion, so
+# upgrade it in place before installing anything with it. npm 12 blocks install
+# scripts by default, so Claude Code's postinstall (native binary) is allowed explicitly.
+# renovate: datasource=npm depName=npm
+ARG NPM_VERSION=12.2.2
 # renovate: datasource=npm depName=@anthropic-ai/claude-code
 ARG CLAUDE_CODE_VERSION=2.1.292
 # The trailing check fails the build if the installed CLI doesn't report exactly
 # the pinned version (e.g. a registry/tag mismatch), so a drifted image can't ship.
 RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
     && ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
-    && npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \
+    && npm install -g npm@${NPM_VERSION} \
+    && test "$(npm --version)" = "${NPM_VERSION}" \
+    && npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} \
     && INSTALLED="$(claude --version)" \
     && echo "claude --version: ${INSTALLED}" \
     && case "${INSTALLED}" in \
@@ -150,6 +160,32 @@ RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
 # from process.env, so spawned claude processes inherit it.
 ENV DISABLE_AUTOUPDATER=1
 
+# ─── Production dependencies ──────────────────────────────────────────────────
+# Production-only install: the runtime stage copies node_modules from here, so
+# devDependencies (semantic-release → handlebars, the TypeScript native `tsc`
+# binary, a nested npm, biome) never ship in the image. Same manifests as the
+# build stage; admin/prisma is needed because admin's postinstall runs
+# `prisma generate`.
+
+FROM base AS prod-deps
+
+WORKDIR /app
+
+COPY package.json bunfig.toml bun.lock* ./
+COPY runtime/package.json ./runtime/
+COPY admin/package.json ./admin/
+COPY admin/prisma ./admin/prisma/
+COPY admin/prisma.config.ts ./admin/
+COPY lib/package.json ./lib/
+COPY patches/ ./patches/
+
+# typescript is only an optional peer of prisma / @prisma/client, but bun still
+# links it (and its native tsc binary) into the store because the lockfile
+# carries it; nothing at runtime loads it, so drop it.
+RUN if [ -f bun.lock ]; then bun install --frozen-lockfile --production; else bun install --production; fi \
+    && rm -rf node_modules/.bun/typescript@* node_modules/.bun/@typescript+* \
+              node_modules/.bun/node_modules/typescript node_modules/.bun/node_modules/@typescript
+
 # ─── Build stage ──────────────────────────────────────────────────────────────
 
 FROM base AS build
@@ -215,7 +251,7 @@ ENV HOME=/home/bun
 # routes push through signed-push.
 ENV PATH="/home/bun/.local/share/mise/shims:/app/scripts/bin:${PATH}"
 
-COPY --from=build --chown=1000:1000 /app/node_modules ./node_modules
+COPY --from=prod-deps --chown=1000:1000 /app/node_modules ./node_modules
 COPY --from=build --chown=1000:1000 /app/runtime ./runtime
 COPY --from=build --chown=1000:1000 /app/admin ./admin
 COPY --from=build --chown=1000:1000 /app/lib ./lib

package/base-image-contract.smoke.test.ts

@@ -14,7 +14,13 @@
  */
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -146,4 +152,37 @@ describe.skipIf(!BASE_IMAGE)("agent base-image contract", () => {
       "/app/scripts/bin/git",
     ]);
   }, 60_000);
+
+  test("runtime image ships no devDependency-only packages and keeps the Prisma client", () => {
+    const run = docker([
+      "run",
+      "--rm",
+      "--entrypoint",
+      "bash",
+      DERIVED_TAG,
+      "-c",
+      'test -d /app/admin/prisma/client && test -z "$(find /app/node_modules/.bun -maxdepth 1 \\( -name "handlebars@*" -o -name "typescript@*" -o -name "@typescript+*" -o -name "semantic-release@*" -o -name "@biomejs+*" -o -name "npm@*" \\))"',
+    ]);
+    expect(run.exitCode, run.stdout + run.stderr).toBe(0);
+  }, 60_000);
+});
+
+// Static guard (no Docker needed): the runtime stage must take node_modules
+// from the production-only stage, never the build stage's full install.
+describe("runtime Dockerfile", () => {
+  const dockerfile = readFileSync(
+    join(import.meta.dir, "Dockerfile"),
+    "utf8",
+  );
+
+  test("copies node_modules from the production-only stage", () => {
+    expect(dockerfile).toMatch(
+      /^COPY --from=prod-deps\b.*\/app\/node_modules \.\/node_modules$/m,
+    );
+    expect(dockerfile).not.toMatch(
+      /^COPY --from=build\b.*\/app\/node_modules\b/m,
+    );
+    expect(dockerfile).toMatch(/^FROM base AS prod-deps$/m);
+    expect(dockerfile).toMatch(/bun install --frozen-lockfile --production/);
+  });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@app-vitals/agent-runtime",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/app-vitals/agent.git",
@@ -40,8 +40,8 @@
     "./workspace-paths": "./workspace-paths.ts"
   },
   "dependencies": {
-    "@app-vitals/agent-admin": "1.2.3",
-    "@app-vitals/agent-lib": "1.2.3",
+    "@app-vitals/agent-admin": "1.2.4",
+    "@app-vitals/agent-lib": "1.2.4",
     "@octokit/auth-app": "^8.2.0",
     "@sentry/bun": "^10.63.0",
     "@slack/bolt": "^5.0.0",