@loucompanion/forge-bridge 0.1.3-dev.bf78fdcaa623 → 0.1.3-dev.c24058d57ab3

package/dist/bridge/bridge.service.js

@@ -1063,7 +1063,7 @@ function defaultSandboxResources() {
     return {
         sandboxSlots: 1,
         cpuMillis: 2000,
-        memoryBytes: 4 * 1024 ** 3,
+        memoryBytes: 2 * 1024 ** 3,
         workspaceBytes: 10 * 1024 ** 3,
         pids: 512,
         buildSlots: 0

package/dist/sandbox/image-policy.d.ts

@@ -1,4 +1,5 @@
 import { type SandboxProcessRequest, type SandboxProcessResult } from "./process.js";
+export type SandboxImageLayer = "project" | "tooling" | "agent";
 export interface SandboxImagePolicyRequest {
     readonly key: string;
     readonly project: string;
@@ -10,7 +11,8 @@ export interface SandboxImagePolicyRequest {
     readonly toolingImage: string;
     readonly upstreamImages: readonly string[];
     readonly codexVersion: string;
-    readonly images: Readonly<Record<"project" | "tooling" | "agent", string>>;
+    readonly images: Readonly<Record<SandboxImageLayer, string>>;
+    readonly imageScanTargets?: Readonly<Partial<Record<SandboxImageLayer, string>>>;
     readonly environment?: NodeJS.ProcessEnv;
     readonly signal?: AbortSignal;
     readonly runCommand?: (command: SandboxProcessRequest) => Promise<SandboxProcessResult>;

package/dist/sandbox/image-policy.js

@@ -34,6 +34,7 @@ export async function evaluateSandboxImagePolicy(request) {
             status = "warning";
     }
     for (const [layer, imageDigest] of Object.entries(request.images)) {
+        const scanTarget = request.imageScanTargets?.[layer] ?? imageDigest;
         const provenance = {
             schemaVersion: 1,
             predicateType: "https://slsa.dev/provenance/v1",
@@ -67,7 +68,7 @@ export async function evaluateSandboxImagePolicy(request) {
         if (sbomExecutable) {
             const sbom = await runCommand({
                 command: sbomExecutable,
-                args: [imageDigest, "-o", "spdx-json"],
+                args: [scanTarget, "-o", "spdx-json"],
                 timeoutMs: 10 * 60_000,
                 maxOutputBytes: 32 * 1024 * 1024,
                 signal: request.signal
@@ -86,7 +87,7 @@ export async function evaluateSandboxImagePolicy(request) {
         if (vulnerabilityExecutable) {
             const scan = await runCommand({
                 command: vulnerabilityExecutable,
-                args: ["image", "--scanners", "vuln", "--format", "json", "--severity", "HIGH,CRITICAL", "--exit-code", "1", "--no-progress", imageDigest],
+                args: ["image", "--scanners", "vuln", "--format", "json", "--severity", "HIGH,CRITICAL", "--exit-code", "1", "--no-progress", scanTarget],
                 timeoutMs: 15 * 60_000,
                 maxOutputBytes: 32 * 1024 * 1024,
                 signal: request.signal
@@ -103,6 +104,7 @@ export async function evaluateSandboxImagePolicy(request) {
         }
         artifacts[layer] = {
             imageDigest,
+            scanTarget,
             provenanceSha256: sha256(provenanceBytes),
             provenanceSignatureSha256: signatureDigest,
             sbomSha256: sbomDigest,

package/dist/sandbox/preflight.js

@@ -108,7 +108,7 @@ export class DockerPreflight {
         const availableMemoryBytes = os.freemem();
         const cpuCount = Math.max(1, os.availableParallelism?.() ?? os.cpus().length);
         const availableCpuMillis = Math.max(0, (cpuCount - 1) * 1000);
-        const memorySlots = Math.max(0, Math.floor((availableMemoryBytes - 2 * 1024 ** 3) / (4 * 1024 ** 3)));
+        const memorySlots = Math.max(0, Math.floor((availableMemoryBytes - 2 * 1024 ** 3) / (2 * 1024 ** 3)));
         const cpuSlots = Math.max(0, Math.floor((cpuCount - 1) / 2));
         const configuredMax = this.options.maxConcurrentSandboxes ?? positiveInteger(process.env.FORGE_MAX_CONCURRENT_SANDBOXES, 3);
         const maxConcurrentSandboxes = diskLow ? 0 : Math.max(1, Math.min(3, configuredMax, Math.max(1, cpuSlots), Math.max(1, memorySlots)));

package/dist/sandbox/runtime.d.ts

@@ -188,7 +188,25 @@ export declare function sandboxRuntimeVolumes(resources: ResourceNames, includeE
 export declare function sandboxRuntimeCleanupVolumeNames(resources: ResourceNames, includeCredentials?: boolean): string[];
 export declare function mayReapManagedResource(labels: Readonly<Record<string, string>>, runnerId: string, liveAttempts: ReadonlySet<string>): boolean;
 export declare function shouldReapSandboxLedger(ledger: Readonly<Pick<SandboxLedger, "dispatchAttemptId" | "fencingToken" | "runnerInstanceId" | "expiresAt">>, currentRunnerInstanceId: string, serverAttempt: SandboxAttemptSnapshot | undefined, snapshotAvailable: boolean, nowMs?: number): boolean;
-export declare function buildxBuildArgs(builder: string, metadataFile: string, tail: readonly string[], environment?: NodeJS.ProcessEnv): string[];
+export declare function prepareOverlayBuildRoot(overlayRoot: string): Promise<void>;
+export declare function extractOciLayoutArchive(archivePath: string, destination: string, signal?: AbortSignal): Promise<void>;
+export declare function ociLayoutContextRef(layoutPath: string): string;
+export declare function formatOciExtractionFailure(result: {
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly truncated: boolean;
+}): string;
+export declare function readOciLayoutImageDigest(layoutRoot: string): Promise<string>;
+export declare function removeExtractedOciLayout(layoutRoot: string): Promise<void>;
+export declare function ociLayoutScanTarget(layoutPath: string): string;
+export declare function agentOverlayDockerignore(): string;
+export declare function agentOverlayDockerfile(toolingImage: string, projectContextName: string, installMode: BridgePackageInstallMode, codexVersion: string): string;
+export type BridgePackageInstallMode = "ci" | "install";
+export declare function copyBridgePackageManifests(packageRoot: string, bridgeRoot: string): Promise<BridgePackageInstallMode>;
+export declare function bridgePackageInstallCommand(mode: BridgePackageInstallMode, codexVersion: string): string;
+export declare function buildxBuildArgs(builder: string, metadataFile: string, tail: readonly string[], environment?: NodeJS.ProcessEnv, options?: {
+    readonly load?: boolean;
+}): string[];
 export declare function buildResourcePolicy(environment?: NodeJS.ProcessEnv): {
     readonly nofile: number;
     readonly sharedMemory: string;

package/dist/sandbox/runtime.js

@@ -530,29 +530,39 @@ export class DockerSandboxRuntime {
         await sink.emit(event("sandbox_build_started", `Building sandbox image ${key.slice(0, 12)}.`, { cacheKey: key }));
         const builder = await this.ensureBuildxBuilder(signal);
         const metadataRoot = path.join(this.config.sandboxStateRoot, "attestations", key, "buildkit");
-        await fs.mkdir(metadataRoot, { recursive: true, mode: 0o700 });
-        const cached = await this.docker(["image", "inspect", projectTag, "--format", "{{.Id}}"], 15_000).catch(() => null);
-        let projectImage = cached?.stdout.trim();
-        if (!projectImage) {
-            await this.runBuildStage("project", key, buildxBuildArgs(builder, path.join(metadataRoot, "project.json"), ["--pull=false", ...imageLabelArgs(project, key, "project"), "--tag", projectTag, "--file", path.join(contextRoot, ".forge", "Dockerfile"), contextRoot]), sink, signal);
-            projectImage = (await this.docker(["image", "inspect", projectTag, "--format", "{{.Id}}"], 15_000)).stdout.trim();
-        }
-        if (!/^sha256:[0-9a-f]{64}$/i.test(projectImage))
-            throw new Error("sandbox_build_failed: project image did not resolve to an immutable digest.");
         const overlayRoot = path.join(this.config.sandboxStateRoot, "build", `overlay-${key}`);
-        await fs.rm(overlayRoot, { recursive: true, force: true });
-        await fs.mkdir(path.join(overlayRoot, "bridge"), { recursive: true });
+        await prepareOverlayBuildRoot(overlayRoot);
+        await fs.mkdir(metadataRoot, { recursive: true, mode: 0o700 });
+        const projectOciArchive = path.join(overlayRoot, "project.oci.tar");
+        const projectOciRoot = path.join(overlayRoot, "project-oci");
+        await this.runBuildStage("project", key, buildxBuildArgs(builder, path.join(metadataRoot, "project.json"), [
+            "--pull=false",
+            ...imageLabelArgs(project, key, "project"),
+            "--tag", projectTag,
+            "--output", `type=oci,dest=${projectOciArchive}`,
+            "--file", path.join(contextRoot, ".forge", "Dockerfile"),
+            contextRoot
+        ], process.env, { load: false }), sink, signal);
+        await extractOciLayoutArchive(projectOciArchive, projectOciRoot, signal);
+        const projectImage = await readOciLayoutImageDigest(projectOciRoot);
+        const projectContextName = "forge_project";
         const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
         await fs.cp(path.join(packageRoot, "dist"), path.join(overlayRoot, "bridge", "dist"), { recursive: true });
-        await fs.copyFile(path.join(packageRoot, "package.json"), path.join(overlayRoot, "bridge", "package.json"));
-        await fs.copyFile(path.join(packageRoot, "package-lock.json"), path.join(overlayRoot, "bridge", "package-lock.json"));
-        const dockerfile = `FROM ${toolingImage} AS tooling\nWORKDIR /opt/forge-bridge\nCOPY bridge/package*.json ./\nRUN npm ci --omit=dev --ignore-scripts && npm install --global @openai/codex@${codexVersion} && npm cache clean --force\nCOPY bridge/dist ./dist\nFROM ${projectImage}\nUSER 0\nCOPY --from=tooling /usr/local/bin/node /usr/local/bin/node\nCOPY --from=tooling /usr/local/bin/codex /usr/local/bin/codex\nCOPY --from=tooling /usr/local/lib/node_modules/@openai/codex /usr/local/lib/node_modules/@openai/codex\nCOPY --from=tooling /opt/forge-bridge /opt/forge-bridge\nRUN (getent group 10001 || groupadd -g 10001 forge) && (getent passwd 10001 || useradd -u 10001 -g 10001 -d /home/forge -m forge)\nENV HOME=/home/forge TMPDIR=/tmp\nENTRYPOINT []\nCMD []\nUSER 10001:10001\n`;
+        const installMode = await copyBridgePackageManifests(packageRoot, path.join(overlayRoot, "bridge"));
+        const dockerfile = agentOverlayDockerfile(toolingImage, projectContextName, installMode, codexVersion);
         await fs.writeFile(path.join(overlayRoot, "Dockerfile"), dockerfile);
+        await fs.writeFile(path.join(overlayRoot, ".dockerignore"), agentOverlayDockerignore());
         await this.runBuildStage("tooling", key, buildxBuildArgs(builder, path.join(metadataRoot, "tooling.json"), ["--pull=false", "--target", "tooling", ...imageLabelArgs(project, key, "tooling"), "--tag", helperTag, overlayRoot]), sink, signal);
         const helperImageDigest = (await this.docker(["image", "inspect", helperTag, "--format", "{{.Id}}"], 15_000)).stdout.trim();
         if (!/^sha256:[0-9a-f]{64}$/i.test(helperImageDigest))
             throw new Error("sandbox_build_failed: helper image did not resolve to an immutable digest.");
-        await this.runBuildStage("agent", key, buildxBuildArgs(builder, path.join(metadataRoot, "agent.json"), ["--pull=false", ...imageLabelArgs(project, key, "agent"), "--tag", overlayTag, overlayRoot]), sink, signal);
+        await this.runBuildStage("agent", key, buildxBuildArgs(builder, path.join(metadataRoot, "agent.json"), [
+            "--pull=false",
+            "--build-context", `${projectContextName}=${ociLayoutContextRef(projectOciRoot)}`,
+            ...imageLabelArgs(project, key, "agent"),
+            "--tag", overlayTag,
+            overlayRoot
+        ]), sink, signal);
         const digest = (await this.docker(["image", "inspect", overlayTag, "--format", "{{.Id}}"], 15_000)).stdout.trim();
         if (!/^sha256:[0-9a-f]{64}$/i.test(digest))
             throw new Error("sandbox_build_failed: overlay image did not resolve to an immutable digest.");
@@ -568,9 +578,11 @@ export class DockerSandboxRuntime {
             upstreamImages,
             codexVersion,
             images: { project: projectImage, tooling: helperImageDigest, agent: digest },
+            imageScanTargets: { project: ociLayoutScanTarget(projectOciRoot) },
             signal
         });
         await sink.emit(event(imagePolicy.status === "passed" ? "sandbox_image_policy_passed" : "sandbox_image_policy_warning", imagePolicy.status === "passed" ? `Image policy passed for ${digest}.` : `Image attestations are incomplete for adoption-mode image ${digest}.`, { policyDigest: imagePolicy.policyDigest }));
+        await removeExtractedOciLayout(projectOciRoot);
         await this.writeImageCacheRecord({
             schemaVersion: 1,
             key,
@@ -1413,17 +1425,114 @@ function validImageCacheRecord(value) {
         && /^sha256:[0-9a-f]{64}$/i.test(value.helperImageDigest)
         && /^[0-9a-f]{64}$/i.test(value.policyDigest);
 }
-export function buildxBuildArgs(builder, metadataFile, tail, environment = process.env) {
+export async function prepareOverlayBuildRoot(overlayRoot) {
+    const buildRoot = path.dirname(overlayRoot);
+    await fs.mkdir(buildRoot, { recursive: true, mode: 0o700 });
+    await fs.chmod(buildRoot, 0o700);
+    await fs.rm(overlayRoot, { recursive: true, force: true });
+    await fs.mkdir(overlayRoot, { recursive: true, mode: 0o700 });
+    await fs.chmod(overlayRoot, 0o700);
+    const bridgeRoot = path.join(overlayRoot, "bridge");
+    await fs.mkdir(bridgeRoot, { recursive: true, mode: 0o700 });
+    await fs.chmod(bridgeRoot, 0o700);
+}
+export async function extractOciLayoutArchive(archivePath, destination, signal) {
+    await fs.rm(destination, { recursive: true, force: true });
+    await fs.mkdir(destination, { recursive: true, mode: 0o700 });
+    await fs.chmod(destination, 0o700);
+    const result = await runSandboxProcess({
+        command: process.platform === "win32" ? "tar.exe" : "tar",
+        args: ["-xf", archivePath, "-C", destination],
+        timeoutMs: 5 * 60_000,
+        maxOutputBytes: 1024 * 1024,
+        signal
+    });
+    if (result.exitCode !== 0 || result.truncated) {
+        throw new Error(`sandbox_build_failed: project OCI layout extraction failed with exit code ${result.exitCode}; ${formatOciExtractionFailure(result)}. Archive retained at ${archivePath}.`);
+    }
+    await fs.rm(archivePath, { force: true }).catch(() => undefined);
+}
+export function ociLayoutContextRef(layoutPath) {
+    const absolute = /^[A-Za-z]:[\\/]/u.test(layoutPath) ? layoutPath : path.resolve(layoutPath);
+    const normalized = absolute.replace(/\\/gu, "/");
+    // BuildKit's oci-layout resolver expects a raw filesystem path here; it does not percent-decode
+    // URI path escapes such as %20 before opening index.json.
+    return normalized.startsWith("/") ? `oci-layout://${normalized}` : `oci-layout:///${normalized}`;
+}
+export function formatOciExtractionFailure(result) {
+    const output = result.stderr.trim() || result.stdout.trim() || "no tar output";
+    return `tar output: ${output.slice(0, 2048)}${result.truncated ? " (output truncated)" : ""}`;
+}
+export async function readOciLayoutImageDigest(layoutRoot) {
+    const indexPath = path.join(layoutRoot, "index.json");
+    const index = JSON.parse(await fs.readFile(indexPath, "utf8"));
+    const manifest = index.manifests?.find(entry => typeof entry.digest === "string"
+        && /^sha256:[0-9a-f]{64}$/iu.test(entry.digest)
+        && entry.annotations?.["vnd.docker.reference.type"] !== "attestation-manifest");
+    if (!manifest || typeof manifest.digest !== "string") {
+        throw new Error("sandbox_build_failed: project OCI layout did not expose an immutable image digest.");
+    }
+    return manifest.digest;
+}
+export async function removeExtractedOciLayout(layoutRoot) {
+    await fs.rm(layoutRoot, { recursive: true, force: true });
+}
+export function ociLayoutScanTarget(layoutPath) {
+    const absolute = /^[A-Za-z]:[\\/]/u.test(layoutPath) ? layoutPath : path.resolve(layoutPath);
+    return `oci-dir:${absolute.replace(/\\/gu, "/")}`;
+}
+export function agentOverlayDockerignore() {
+    return "project.oci.tar\nproject-oci\nproject-oci/**\n";
+}
+export function agentOverlayDockerfile(toolingImage, projectContextName, installMode, codexVersion) {
+    return `FROM ${toolingImage} AS tooling
+WORKDIR /opt/forge-bridge
+COPY bridge/package*.json ./
+RUN ${bridgePackageInstallCommand(installMode, codexVersion)}
+COPY bridge/dist ./dist
+FROM ${projectContextName}
+USER 0
+COPY --from=tooling /usr/local/bin/node /usr/local/bin/node
+COPY --from=tooling /usr/local/bin/codex /usr/local/bin/codex
+COPY --from=tooling /usr/local/lib/node_modules/@openai/codex /usr/local/lib/node_modules/@openai/codex
+COPY --from=tooling /opt/forge-bridge /opt/forge-bridge
+RUN (getent group 10001 || groupadd -g 10001 forge) && (getent passwd 10001 || useradd -u 10001 -g 10001 -d /home/forge -m forge)
+ENV HOME=/home/forge TMPDIR=/tmp
+ENTRYPOINT []
+CMD []
+USER 10001:10001
+`;
+}
+export async function copyBridgePackageManifests(packageRoot, bridgeRoot) {
+    await fs.copyFile(path.join(packageRoot, "package.json"), path.join(bridgeRoot, "package.json"));
+    return await copyOptionalBridgeManifest(packageRoot, bridgeRoot, "package-lock.json") ? "ci" : "install";
+}
+export function bridgePackageInstallCommand(mode, codexVersion) {
+    const bridgeInstall = mode === "ci"
+        ? "npm ci --omit=dev --ignore-scripts"
+        : "npm install --omit=dev --ignore-scripts";
+    return `${bridgeInstall} && npm install --global @openai/codex@${codexVersion} && npm cache clean --force`;
+}
+async function copyOptionalBridgeManifest(packageRoot, bridgeRoot, fileName) {
+    try {
+        await fs.copyFile(path.join(packageRoot, fileName), path.join(bridgeRoot, fileName));
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+export function buildxBuildArgs(builder, metadataFile, tail, environment = process.env, options = {}) {
     if (!/^forge-[0-9a-f]{20}$/u.test(builder))
         throw new Error("sandbox_build_failed: invalid dedicated builder name.");
     const resources = buildResourcePolicy(environment);
-    return [
-        "buildx", "build", "--builder", builder, "--load",
-        "--ulimit", `nofile=${resources.nofile}:${resources.nofile}`,
-        "--shm-size", resources.sharedMemory,
-        "--provenance=mode=max", "--sbom=true", "--metadata-file", metadataFile,
-        ...tail
-    ];
+    const args = ["buildx", "build", "--builder", builder];
+    if (options.load !== false)
+        args.push("--load");
+    args.push("--ulimit", `nofile=${resources.nofile}:${resources.nofile}`, "--shm-size", resources.sharedMemory, "--provenance=mode=max", "--sbom=true", "--metadata-file", metadataFile, ...tail);
+    return args;
 }
 export function buildResourcePolicy(environment = process.env) {
     return {

package/dist/session/session.types.js

@@ -93,7 +93,7 @@ function parseSandboxResourceRequest(value) {
         return {
             sandboxSlots: 1,
             cpuMillis: 2000,
-            memoryBytes: 4 * 1024 ** 3,
+            memoryBytes: 2 * 1024 ** 3,
             workspaceBytes: 10 * 1024 ** 3,
             pids: 512,
             buildSlots: 1

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const forgeBridgeVersion = "0.1.3-dev.bf78fdcaa623";
+export declare const forgeBridgeVersion = "0.1.3-dev.c24058d57ab3";

package/dist/version.js

@@ -1 +1 @@
-export const forgeBridgeVersion = "0.1.3-dev.bf78fdcaa623";
+export const forgeBridgeVersion = "0.1.3-dev.c24058d57ab3";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loucompanion/forge-bridge",
-  "version": "0.1.3-dev.bf78fdcaa623",
+  "version": "0.1.3-dev.c24058d57ab3",
   "description": "Forge runner bridge CLI for connecting local developer machines to Forge dispatch.",
   "license": "UNLICENSED",
   "type": "module",