@archme/cli 0.15.0 → 0.16.0

package/dist/cli.js

@@ -10110,6 +10110,39 @@ function buildInitVolumeArgs(volume, uid, labels, image, slot) {
     "/work"
   ];
 }
+function buildAnchorArgs(slot, image) {
+  assertImage(image);
+  const network = slotNetwork(slot);
+  return [
+    "run",
+    "-d",
+    "--rm",
+    "--init",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--user",
+    `${BOX_UID}:${BOX_UID}`,
+    "--no-dns",
+    "--kernel-arg",
+    "ipv6.disable=1",
+    "--progress",
+    "none",
+    "--cpus",
+    "1",
+    "--memory",
+    `${INIT_MEMORY_MIB}M`,
+    "--name",
+    anchorBoxName(slot),
+    ...labelArgs({ [JOB_LABEL]: "anchor", [SLOT_LABEL]: String(slot.index) }),
+    "--network",
+    network,
+    "--entrypoint",
+    "sleep",
+    image,
+    "infinity"
+  ];
+}
 function buildCreateVolumeArgs(name, sizeGiB, labels) {
   assertName("volume", name);
   if (!Number.isInteger(sizeGiB) || sizeGiB < 1) throw new Error(`sandbox: invalid volume size ${sizeGiB}`);
@@ -10200,7 +10233,7 @@ function defaultSpawn(bin = "container") {
     };
   };
 }
-var MIN_MEMORY_MIB, STDOUT_CAP_BYTES, STDERR_CAP_BYTES, INIT_MEMORY_MIB, NAME_RE, ENV_KEY_RE, LABEL_KEY_RE, CONTROL_RE, obj, str, TailBuffer, AppleContainerRuntime;
+var MIN_MEMORY_MIB, STDOUT_CAP_BYTES, STDERR_CAP_BYTES, INIT_MEMORY_MIB, NAME_RE, ENV_KEY_RE, LABEL_KEY_RE, CONTROL_RE, anchorBoxName, obj, str, TailBuffer, AppleContainerRuntime;
 var init_appleContainer = __esm({
   "src/daemon/sandbox/appleContainer.ts"() {
     "use strict";
@@ -10215,6 +10248,7 @@ var init_appleContainer = __esm({
     ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
     LABEL_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
     CONTROL_RE = /[\u0000\n\r]/;
+    anchorBoxName = (slot) => `archme-anchor-${slot.index}`;
     obj = (v) => v && typeof v === "object" ? v : {};
     str = (v) => typeof v === "string" ? v : null;
     TailBuffer = class {
@@ -10324,6 +10358,11 @@ var init_appleContainer = __esm({
         }
         return slots;
       }
+      /** Starts the slot's anchor box detached; resolves once it is running. */
+      async startAnchor(slot, image) {
+        await this.must(buildAnchorArgs(slot, image), `anchor ${slot.network}`);
+        return anchorBoxName(slot);
+      }
       async createVolume(name, sizeGiB, labels) {
         await this.must(buildCreateVolumeArgs(name, sizeGiB, labels), `volume create ${name}`);
       }
@@ -17167,6 +17206,99 @@ var init_semaphore = __esm({
   }
 });
 
+// src/daemon/sandbox/bridges.ts
+function holding(gateway, ifaces) {
+  return Object.entries(ifaces).filter(([, addrs]) => (addrs ?? []).some((a2) => a2.family === "IPv4" && a2.address === gateway)).map(([name]) => name);
+}
+function gatewayPresent(slot, ifaces) {
+  return holding(slot.gateway, ifaces).length > 0;
+}
+function bridgeMapFailures(slots, ifaces) {
+  const failures = [];
+  const owner = /* @__PURE__ */ new Map();
+  for (const s of slots) {
+    const on6 = holding(s.gateway, ifaces);
+    if (on6.length === 0) {
+      failures.push(`bridge: slot ${s.index} gateway ${s.gateway} is on no host interface`);
+      continue;
+    }
+    for (const name of on6) {
+      if (!/^bridge\d+$/.test(name)) failures.push(`bridge: slot ${s.index} gateway is on ${name}, not a bridge`);
+      const other = owner.get(name);
+      if (other !== void 0) failures.push(`bridge: slots ${other} and ${s.index} share ${name}`);
+      else owner.set(name, s.index);
+    }
+  }
+  return failures;
+}
+function helperNetworks() {
+  return ["default", ...Array.from({ length: MAX_SLOTS }, (_, i2) => slotFor(i2).network)];
+}
+function parseHelperPids(ps, networks) {
+  return ps.split("\n").flatMap((line) => {
+    const m = HELPER_RE.exec(line);
+    return m && networks.has(m[2]) ? [Number(m[1])] : [];
+  });
+}
+async function resetNetworkHelpers(networks, deps) {
+  const want = new Set(networks);
+  const pids = parseHelperPids(await deps.ps(), want);
+  const signal = (sig, list2) => {
+    for (const pid of list2) {
+      try {
+        deps.kill(pid, sig);
+      } catch {
+      }
+    }
+  };
+  const survivors = async () => {
+    const now = new Set(parseHelperPids(await deps.ps(), want));
+    return pids.filter((p) => now.has(p));
+  };
+  const waitGone = async () => {
+    let left2 = await survivors();
+    for (let i2 = 0; i2 < 20 && left2.length > 0; i2++) {
+      await deps.sleep(250);
+      left2 = await survivors();
+    }
+    return left2;
+  };
+  signal("SIGTERM", pids);
+  let left = await waitGone();
+  if (left.length > 0) {
+    signal("SIGKILL", left);
+    left = await waitGone();
+  }
+  if (left.length > 0) throw new Error(`network helpers still running: ${left.join(", ")}`);
+  return pids.length;
+}
+function realResetHelpers(networks) {
+  return resetNetworkHelpers(networks, {
+    ps: async () => (await execa("ps", ["-axo", "pid=,command="])).stdout,
+    kill: (pid, sig) => process.kill(pid, sig),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms))
+  });
+}
+async function pinBridges(slots, deps) {
+  const killed = await deps.resetHelpers(helperNetworks());
+  deps.log(`  sandbox: restarted ${killed} network helper(s); anchoring ${slots.length} slot bridge(s)`);
+  for (const s of slots) {
+    if (!await deps.register(anchorBoxName(s))) throw new Error("shutdown began while anchoring");
+    await deps.startAnchor(s);
+  }
+}
+var ANCHOR_REGISTRY_ID, HELPER_RE;
+var init_bridges = __esm({
+  "src/daemon/sandbox/bridges.ts"() {
+    "use strict";
+    init_execa();
+    init_appleContainer();
+    init_types();
+    ANCHOR_REGISTRY_ID = "archme-anchors";
+    HELPER_RE = /^\s*(\d+)\s+\S*\/container-network-vmnet start --id (\S+)(?:\s|$)/;
+  }
+});
+
 // src/scan/sessionAuth.ts
 var SessionAuth;
 var init_sessionAuth = __esm({
@@ -19475,6 +19607,45 @@ var init_claimStance = __esm({
   }
 });
 
+// src/daemon/platformDevices.ts
+async function readPlatformDevices(client, userId) {
+  const { data, error } = await client.from("agent_devices").select("id, name").eq("user_id", userId).is("org_id", null).eq("is_platform", true).eq("status", "enabled");
+  if (error) throw new Error(error.message);
+  return data ?? [];
+}
+function withPlatformDevices(devices, platform3) {
+  const out = [...devices];
+  for (const p of platform3) {
+    if (!out.some((d) => d.deviceId === p.id)) out.push({ orgId: null, deviceId: p.id });
+  }
+  return out;
+}
+function deviceForOrgLookup(devices) {
+  const members = devices.filter((d) => d.orgId !== null);
+  const byOrg = new Map(members.map((d) => [d.orgId, d.deviceId]));
+  return (orgId) => byOrg.get(orgId) ?? members[0]?.deviceId ?? null;
+}
+function poolBootLine(platform3, mode) {
+  if (platform3.length === 0) return "not in managed pool";
+  const names = platform3.map((p) => `${p.name} (${p.id})`).join(", ");
+  return `in managed pool: platform device ${names}, ${mode === "required" ? "active" : "inactive unless sandbox=required"}`;
+}
+async function discoverClaimDevices(client, userId, devices, mode, out = console) {
+  let platform3 = [];
+  try {
+    platform3 = await readPlatformDevices(client, userId);
+  } catch (e) {
+    out.warn(`platform device read failed, starting member-only until restart: ${e.message}`);
+  }
+  out.log(`  ${poolBootLine(platform3, mode)}`);
+  return { devices: withPlatformDevices(devices, platform3), platform: platform3 };
+}
+var init_platformDevices = __esm({
+  "src/daemon/platformDevices.ts"() {
+    "use strict";
+  }
+});
+
 // src/daemon/sandboxJob/result.ts
 import { readFile as readFile13 } from "node:fs/promises";
 function isValidNonce(nonce) {
@@ -19942,6 +20113,13 @@ function sandboxBootFailurePolicy(mode) {
 function shutdownKillTargets(boxedJobs2, registry) {
   return [...boxedJobs2].filter((id) => registry.hasLiveBoxes(id));
 }
+function withBridgeCheck(probe, slots, bridgeFailures) {
+  return async (slot) => {
+    const report = await probe(slot);
+    const failures = bridgeFailures(slots);
+    return failures.length ? { ...report, ok: false, failures: [...report.failures, ...failures] } : report;
+  };
+}
 async function bootSandbox(settings, parts, deps) {
   const sweep = await parts.runtime.sweep();
   const inputDirs = await (deps.sweepInputDirs ?? sweepInputDirs)();
@@ -19977,13 +20155,31 @@ async function bootSandbox(settings, parts, deps) {
     });
     throw new SandboxBootError(`sandbox preflight failed: ${failedChecks(preflight)}`);
   }
-  const probe = deps.probe ?? ((slot) => runConfinementProbe({ runtime: parts.runtime, image: settings.image, log: deps.log }, slot, primaryLanIpv4(networkInterfaces())));
+  const pin = deps.pinBridges ?? ((s) => pinBridges(s, {
+    resetHelpers: realResetHelpers,
+    startAnchor: (slot) => parts.runtime.startAnchor(slot, settings.image),
+    register: (box) => parts.registry.beginStep(ANCHOR_REGISTRY_ID, box),
+    log: deps.log
+  }));
+  let pinError = null;
+  try {
+    await pin(slots);
+  } catch (e) {
+    pinError = e.message;
+    deps.log(`  sandbox: could not pin the slot bridges: ${pinError}`);
+  }
+  const probe = withBridgeCheck(
+    deps.probe ?? ((slot) => runConfinementProbe({ runtime: parts.runtime, image: settings.image, log: deps.log }, slot, primaryLanIpv4(networkInterfaces()))),
+    slots,
+    deps.bridgeFailures ?? ((s) => bridgeMapFailures(s, networkInterfaces()))
+  );
   let report;
   try {
     report = await probe(slots[0]);
   } catch (e) {
     report = { ok: false, slot: 0, failures: [`probe threw: ${e.message}`], outcomes: {}, ms: 0 };
   }
+  if (pinError) report = { ...report, ok: false, failures: [...report.failures, `bridge pinning: ${pinError}`] };
   preflight = {
     ok: preflight.ok && report.ok,
     checks: [...preflight.checks, { name: "confinement_probe", ok: report.ok, detail: report.ok ? void 0 : report.failures.join("; ") }]
@@ -20013,6 +20209,7 @@ var init_host = __esm({
     "use strict";
     init_confinement();
     init_appleContainer();
+    init_bridges();
     init_claudeToken();
     init_inputDir();
     init_types();
@@ -20121,9 +20318,13 @@ async function runSandboxedJob(deps, job, opts) {
     if (spec2.args[0] === "agent") agentStarted = true;
     const handle = await deps.runtime.runStep(spec2);
     const timer = setTimeout(() => kill("timeout"), timeoutMs);
+    let gatewaySeen = false;
     const poll = setInterval(() => {
       const c3 = currentKillCause();
-      if (c3) kill(c3);
+      if (c3) return kill(c3);
+      if (!deps.gatewayPresent) return;
+      if (deps.gatewayPresent(slot)) gatewaySeen = true;
+      else if (gatewaySeen) kill("network_lost");
     }, pollMs);
     try {
       const exit = await handle.done;
@@ -22480,7 +22681,7 @@ import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdtemp as mkdtemp4, mkdir as mkdir16, writeFile as writeFile15, rm as rm8, stat as stat8, chmod as chmod6 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join25 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir8, networkInterfaces as networkInterfaces2 } from "node:os";
 function attributeKillCause(result, recorded) {
   if (recorded) return recorded;
   if (result.signal === "SIGTERM") return "timeout";
@@ -23074,14 +23275,16 @@ async function rpcSetDaemonPause(ctx, pauseUntil, reason, detail) {
     console.error(`set_daemon_pause failed: ${error.message}`);
   }
 }
-async function rpcReportEvent(ctx, orgId, eventType, payload) {
+async function rpcReportEvent(ctx, job, deviceId, eventType, payload) {
   try {
     const { error } = await withAuthRetry(
       "report_daemon_event",
       () => ctx.supabase.rpc("report_daemon_event", {
-        p_org_id: orgId,
+        p_org_id: job.org_id,
         p_event_type: eventType,
-        p_payload: payload
+        p_payload: payload,
+        p_job_id: job.id,
+        p_device_id: deviceId
       }),
       ctx.reLogin
     );
@@ -23376,7 +23579,8 @@ function sandboxDepsFor(ctx, job, deviceId, host) {
     log: (msg) => console.log(`[${job.id}] ${msg}`),
     isCancelled: (id) => cancelled.has(id),
     killReason: (id) => killReasons.get(id),
-    isLeaseLost: (id) => leaseLost.has(id)
+    isLeaseLost: (id) => leaseLost.has(id),
+    gatewayPresent: (slot) => gatewayPresent(slot, networkInterfaces2())
   };
 }
 async function completeClaudeRun(ctx, job, deviceId, run) {
@@ -23589,7 +23793,7 @@ async function runJob(ctx, job, claimDeviceId) {
         Object.assign(timings, outcome.metrics.durations_ms);
         Object.assign(metrics, outcome.metrics, { durations_ms: timings });
         const sandboxMetrics = outcome.metrics.sandbox;
-        void rpcReportEvent(ctx, job.org_id, "sandbox_job_metrics", {
+        await rpcReportEvent(ctx, job, deviceId, "sandbox_job_metrics", {
           job_id: job.id,
           project_id: job.project_id,
           outcome: outcome.kind,
@@ -23970,7 +24174,7 @@ ${logs.stderr}`, sentPrompt);
     if (plan) {
       const { parsed, pauseUntil, info } = plan;
       if (!parsed) {
-        void rpcReportEvent(ctx, job.org_id, "rate_limit_unmatched_exit", {
+        await rpcReportEvent(ctx, job, deviceId, "rate_limit_unmatched_exit", {
           job_id: job.id,
           excerpt: [runErr?.claudeError?.text, haystack].filter(Boolean).join("\n").slice(0, 500)
         });
@@ -24313,7 +24517,9 @@ async function runDaemon() {
   const via = usedFallback ? ` (via device ${active.cred.device_id})` : "";
   const accountUserId = auth.getUserId() ?? "OAuth account";
   console.log(`  account ${accountUserId}: ${active.result.user.email ?? "OAuth user"} (${devices.length} org(s))${via}`);
-  const byOrg = new Map(devices.map((d) => [d.orgId, d.deviceId]));
+  const discovered = await discoverClaimDevices(client, auth.getUserId() ?? "", devices, sandboxSettings.mode);
+  platformDevices = new Set(discovered.platform.map((p) => p.id));
+  const claimDevices = discovered.devices;
   const sessions = [{
     supabase: client,
     auth,
@@ -24323,16 +24529,9 @@ async function runDaemon() {
     supabaseUrl: SUPABASE_URL,
     cloneBaseDir: CLONE_BASE_DIR,
     reLogin: () => auth.reauthenticate(),
-    devices,
-    deviceForOrg: (orgId) => byOrg.get(orgId) ?? devices[0]?.deviceId ?? null
+    devices: claimDevices,
+    deviceForOrg: deviceForOrgLookup(claimDevices)
   }];
-  try {
-    const { data, error } = await client.from("agent_devices").select("id, is_platform").in("id", devices.map((d) => d.deviceId));
-    if (error) throw new Error(error.message);
-    platformDevices = new Set((data ?? []).filter((d) => d.is_platform).map((d) => d.id));
-  } catch (e) {
-    console.warn(`agent_devices.is_platform read failed (treating devices as not platform): ${e.message}`);
-  }
   if (sandboxSettings.mode !== "off") {
     try {
       const { createSandboxParts: createSandboxParts2 } = await Promise.resolve().then(() => (init_parts(), parts_exports));
@@ -24552,6 +24751,7 @@ var init_run = __esm({
     init_supervision();
     init_paths();
     init_semaphore();
+    init_bridges();
     init_bearer();
     init_credentials();
     init_sessionAuth();
@@ -24569,6 +24769,7 @@ var init_run = __esm({
     init_architectureCounts();
     init_imageManifest();
     init_claimStance();
+    init_platformDevices();
     init_claudeVersion();
     init_host();
     init_runSandboxedJob();
@@ -25022,7 +25223,7 @@ __export(setupIo_exports, {
   createSetupIo: () => createSetupIo
 });
 import { mkdtemp as mkdtemp5, readFile as readFile16, writeFile as writeFile16 } from "node:fs/promises";
-import { networkInterfaces as networkInterfaces2, tmpdir as tmpdir5 } from "node:os";
+import { networkInterfaces as networkInterfaces3, tmpdir as tmpdir5 } from "node:os";
 import { join as join26 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { Writable as Writable4 } from "node:stream";
@@ -25109,7 +25310,7 @@ function createSetupIo(env = process.env) {
         console.log("  (the daemon's gatekeepers are answering)");
       }
       try {
-        return await runConfinementProbe({ runtime, image }, slot, primaryLanIpv4(networkInterfaces2()));
+        return await runConfinementProbe({ runtime, image }, slot, primaryLanIpv4(networkInterfaces3()));
       } finally {
         if (own) await gates.stop();
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archme/cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Map your codebase into a living architecture diagram: run `archme init` in a repo to scan it, `archme daemon start` to keep it current on every commit.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/sandbox-image.json

@@ -1,4 +1,4 @@
 {
   "image": "ghcr.io/architectme/archme-job",
-  "digest": "sha256:3c596a29b1df99d223b81da90a2f0cfbcca40d5f74359cf11f7a90c7a21b8611"
+  "digest": "sha256:3f8b289540503cc18a2794fa9de858e75a4ceb2d3cf709d814cf816569c36a96"
 }