@archme/cli 0.15.0 → 0.15.1

package/dist/cli.js

@@ -10110,6 +10110,39 @@ function buildInitVolumeArgs(volume, uid, labels, image, slot) {
     "/work"
   ];
 }
+function buildAnchorArgs(slot, image) {
+  assertImage(image);
+  const network = slotNetwork(slot);
+  return [
+    "run",
+    "-d",
+    "--rm",
+    "--init",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--user",
+    `${BOX_UID}:${BOX_UID}`,
+    "--no-dns",
+    "--kernel-arg",
+    "ipv6.disable=1",
+    "--progress",
+    "none",
+    "--cpus",
+    "1",
+    "--memory",
+    `${INIT_MEMORY_MIB}M`,
+    "--name",
+    anchorBoxName(slot),
+    ...labelArgs({ [JOB_LABEL]: "anchor", [SLOT_LABEL]: String(slot.index) }),
+    "--network",
+    network,
+    "--entrypoint",
+    "sleep",
+    image,
+    "infinity"
+  ];
+}
 function buildCreateVolumeArgs(name, sizeGiB, labels) {
   assertName("volume", name);
   if (!Number.isInteger(sizeGiB) || sizeGiB < 1) throw new Error(`sandbox: invalid volume size ${sizeGiB}`);
@@ -10200,7 +10233,7 @@ function defaultSpawn(bin = "container") {
     };
   };
 }
-var MIN_MEMORY_MIB, STDOUT_CAP_BYTES, STDERR_CAP_BYTES, INIT_MEMORY_MIB, NAME_RE, ENV_KEY_RE, LABEL_KEY_RE, CONTROL_RE, obj, str, TailBuffer, AppleContainerRuntime;
+var MIN_MEMORY_MIB, STDOUT_CAP_BYTES, STDERR_CAP_BYTES, INIT_MEMORY_MIB, NAME_RE, ENV_KEY_RE, LABEL_KEY_RE, CONTROL_RE, anchorBoxName, obj, str, TailBuffer, AppleContainerRuntime;
 var init_appleContainer = __esm({
   "src/daemon/sandbox/appleContainer.ts"() {
     "use strict";
@@ -10215,6 +10248,7 @@ var init_appleContainer = __esm({
     ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
     LABEL_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
     CONTROL_RE = /[\u0000\n\r]/;
+    anchorBoxName = (slot) => `archme-anchor-${slot.index}`;
     obj = (v) => v && typeof v === "object" ? v : {};
     str = (v) => typeof v === "string" ? v : null;
     TailBuffer = class {
@@ -10324,6 +10358,11 @@ var init_appleContainer = __esm({
         }
         return slots;
       }
+      /** Starts the slot's anchor box detached; resolves once it is running. */
+      async startAnchor(slot, image) {
+        await this.must(buildAnchorArgs(slot, image), `anchor ${slot.network}`);
+        return anchorBoxName(slot);
+      }
       async createVolume(name, sizeGiB, labels) {
         await this.must(buildCreateVolumeArgs(name, sizeGiB, labels), `volume create ${name}`);
       }
@@ -17167,6 +17206,99 @@ var init_semaphore = __esm({
   }
 });
 
+// src/daemon/sandbox/bridges.ts
+function holding(gateway, ifaces) {
+  return Object.entries(ifaces).filter(([, addrs]) => (addrs ?? []).some((a2) => a2.family === "IPv4" && a2.address === gateway)).map(([name]) => name);
+}
+function gatewayPresent(slot, ifaces) {
+  return holding(slot.gateway, ifaces).length > 0;
+}
+function bridgeMapFailures(slots, ifaces) {
+  const failures = [];
+  const owner = /* @__PURE__ */ new Map();
+  for (const s of slots) {
+    const on6 = holding(s.gateway, ifaces);
+    if (on6.length === 0) {
+      failures.push(`bridge: slot ${s.index} gateway ${s.gateway} is on no host interface`);
+      continue;
+    }
+    for (const name of on6) {
+      if (!/^bridge\d+$/.test(name)) failures.push(`bridge: slot ${s.index} gateway is on ${name}, not a bridge`);
+      const other = owner.get(name);
+      if (other !== void 0) failures.push(`bridge: slots ${other} and ${s.index} share ${name}`);
+      else owner.set(name, s.index);
+    }
+  }
+  return failures;
+}
+function helperNetworks() {
+  return ["default", ...Array.from({ length: MAX_SLOTS }, (_, i2) => slotFor(i2).network)];
+}
+function parseHelperPids(ps, networks) {
+  return ps.split("\n").flatMap((line) => {
+    const m = HELPER_RE.exec(line);
+    return m && networks.has(m[2]) ? [Number(m[1])] : [];
+  });
+}
+async function resetNetworkHelpers(networks, deps) {
+  const want = new Set(networks);
+  const pids = parseHelperPids(await deps.ps(), want);
+  const signal = (sig, list2) => {
+    for (const pid of list2) {
+      try {
+        deps.kill(pid, sig);
+      } catch {
+      }
+    }
+  };
+  const survivors = async () => {
+    const now = new Set(parseHelperPids(await deps.ps(), want));
+    return pids.filter((p) => now.has(p));
+  };
+  const waitGone = async () => {
+    let left2 = await survivors();
+    for (let i2 = 0; i2 < 20 && left2.length > 0; i2++) {
+      await deps.sleep(250);
+      left2 = await survivors();
+    }
+    return left2;
+  };
+  signal("SIGTERM", pids);
+  let left = await waitGone();
+  if (left.length > 0) {
+    signal("SIGKILL", left);
+    left = await waitGone();
+  }
+  if (left.length > 0) throw new Error(`network helpers still running: ${left.join(", ")}`);
+  return pids.length;
+}
+function realResetHelpers(networks) {
+  return resetNetworkHelpers(networks, {
+    ps: async () => (await execa("ps", ["-axo", "pid=,command="])).stdout,
+    kill: (pid, sig) => process.kill(pid, sig),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms))
+  });
+}
+async function pinBridges(slots, deps) {
+  const killed = await deps.resetHelpers(helperNetworks());
+  deps.log(`  sandbox: restarted ${killed} network helper(s); anchoring ${slots.length} slot bridge(s)`);
+  for (const s of slots) {
+    if (!await deps.register(anchorBoxName(s))) throw new Error("shutdown began while anchoring");
+    await deps.startAnchor(s);
+  }
+}
+var ANCHOR_REGISTRY_ID, HELPER_RE;
+var init_bridges = __esm({
+  "src/daemon/sandbox/bridges.ts"() {
+    "use strict";
+    init_execa();
+    init_appleContainer();
+    init_types();
+    ANCHOR_REGISTRY_ID = "archme-anchors";
+    HELPER_RE = /^\s*(\d+)\s+\S*\/container-network-vmnet start --id (\S+)(?:\s|$)/;
+  }
+});
+
 // src/scan/sessionAuth.ts
 var SessionAuth;
 var init_sessionAuth = __esm({
@@ -19942,6 +20074,13 @@ function sandboxBootFailurePolicy(mode) {
 function shutdownKillTargets(boxedJobs2, registry) {
   return [...boxedJobs2].filter((id) => registry.hasLiveBoxes(id));
 }
+function withBridgeCheck(probe, slots, bridgeFailures) {
+  return async (slot) => {
+    const report = await probe(slot);
+    const failures = bridgeFailures(slots);
+    return failures.length ? { ...report, ok: false, failures: [...report.failures, ...failures] } : report;
+  };
+}
 async function bootSandbox(settings, parts, deps) {
   const sweep = await parts.runtime.sweep();
   const inputDirs = await (deps.sweepInputDirs ?? sweepInputDirs)();
@@ -19977,13 +20116,31 @@ async function bootSandbox(settings, parts, deps) {
     });
     throw new SandboxBootError(`sandbox preflight failed: ${failedChecks(preflight)}`);
   }
-  const probe = deps.probe ?? ((slot) => runConfinementProbe({ runtime: parts.runtime, image: settings.image, log: deps.log }, slot, primaryLanIpv4(networkInterfaces())));
+  const pin = deps.pinBridges ?? ((s) => pinBridges(s, {
+    resetHelpers: realResetHelpers,
+    startAnchor: (slot) => parts.runtime.startAnchor(slot, settings.image),
+    register: (box) => parts.registry.beginStep(ANCHOR_REGISTRY_ID, box),
+    log: deps.log
+  }));
+  let pinError = null;
+  try {
+    await pin(slots);
+  } catch (e) {
+    pinError = e.message;
+    deps.log(`  sandbox: could not pin the slot bridges: ${pinError}`);
+  }
+  const probe = withBridgeCheck(
+    deps.probe ?? ((slot) => runConfinementProbe({ runtime: parts.runtime, image: settings.image, log: deps.log }, slot, primaryLanIpv4(networkInterfaces()))),
+    slots,
+    deps.bridgeFailures ?? ((s) => bridgeMapFailures(s, networkInterfaces()))
+  );
   let report;
   try {
     report = await probe(slots[0]);
   } catch (e) {
     report = { ok: false, slot: 0, failures: [`probe threw: ${e.message}`], outcomes: {}, ms: 0 };
   }
+  if (pinError) report = { ...report, ok: false, failures: [...report.failures, `bridge pinning: ${pinError}`] };
   preflight = {
     ok: preflight.ok && report.ok,
     checks: [...preflight.checks, { name: "confinement_probe", ok: report.ok, detail: report.ok ? void 0 : report.failures.join("; ") }]
@@ -20013,6 +20170,7 @@ var init_host = __esm({
     "use strict";
     init_confinement();
     init_appleContainer();
+    init_bridges();
     init_claudeToken();
     init_inputDir();
     init_types();
@@ -20121,9 +20279,13 @@ async function runSandboxedJob(deps, job, opts) {
     if (spec2.args[0] === "agent") agentStarted = true;
     const handle = await deps.runtime.runStep(spec2);
     const timer = setTimeout(() => kill("timeout"), timeoutMs);
+    let gatewaySeen = false;
     const poll = setInterval(() => {
       const c3 = currentKillCause();
-      if (c3) kill(c3);
+      if (c3) return kill(c3);
+      if (!deps.gatewayPresent) return;
+      if (deps.gatewayPresent(slot)) gatewaySeen = true;
+      else if (gatewaySeen) kill("network_lost");
     }, pollMs);
     try {
       const exit = await handle.done;
@@ -22480,7 +22642,7 @@ import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdtemp as mkdtemp4, mkdir as mkdir16, writeFile as writeFile15, rm as rm8, stat as stat8, chmod as chmod6 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join25 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir8, networkInterfaces as networkInterfaces2 } from "node:os";
 function attributeKillCause(result, recorded) {
   if (recorded) return recorded;
   if (result.signal === "SIGTERM") return "timeout";
@@ -23376,7 +23538,8 @@ function sandboxDepsFor(ctx, job, deviceId, host) {
     log: (msg) => console.log(`[${job.id}] ${msg}`),
     isCancelled: (id) => cancelled.has(id),
     killReason: (id) => killReasons.get(id),
-    isLeaseLost: (id) => leaseLost.has(id)
+    isLeaseLost: (id) => leaseLost.has(id),
+    gatewayPresent: (slot) => gatewayPresent(slot, networkInterfaces2())
   };
 }
 async function completeClaudeRun(ctx, job, deviceId, run) {
@@ -24552,6 +24715,7 @@ var init_run = __esm({
     init_supervision();
     init_paths();
     init_semaphore();
+    init_bridges();
     init_bearer();
     init_credentials();
     init_sessionAuth();
@@ -25022,7 +25186,7 @@ __export(setupIo_exports, {
   createSetupIo: () => createSetupIo
 });
 import { mkdtemp as mkdtemp5, readFile as readFile16, writeFile as writeFile16 } from "node:fs/promises";
-import { networkInterfaces as networkInterfaces2, tmpdir as tmpdir5 } from "node:os";
+import { networkInterfaces as networkInterfaces3, tmpdir as tmpdir5 } from "node:os";
 import { join as join26 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { Writable as Writable4 } from "node:stream";
@@ -25109,7 +25273,7 @@ function createSetupIo(env = process.env) {
         console.log("  (the daemon's gatekeepers are answering)");
       }
       try {
-        return await runConfinementProbe({ runtime, image }, slot, primaryLanIpv4(networkInterfaces2()));
+        return await runConfinementProbe({ runtime, image }, slot, primaryLanIpv4(networkInterfaces3()));
       } finally {
         if (own) await gates.stop();
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archme/cli",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Map your codebase into a living architecture diagram: run `archme init` in a repo to scan it, `archme daemon start` to keep it current on every commit.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/sandbox-image.json

@@ -1,4 +1,4 @@
 {
   "image": "ghcr.io/architectme/archme-job",
-  "digest": "sha256:3c596a29b1df99d223b81da90a2f0cfbcca40d5f74359cf11f7a90c7a21b8611"
+  "digest": "sha256:a3c757d0dc7608b3c4e45b24e1ba4459c8f7ece2d0551a4633d2f3833a6fdc3e"
 }