@loucompanion/forge-bridge 0.1.3-dev.c28767e94230 → 0.1.3-dev.d46a8e73d03d

package/dist/sandbox/runtime.js

@@ -556,13 +556,14 @@ export class DockerSandboxRuntime {
         const helperImageDigest = (await this.docker(["image", "inspect", helperTag, "--format", "{{.Id}}"], 15_000)).stdout.trim();
         if (!/^sha256:[0-9a-f]{64}$/i.test(helperImageDigest))
             throw new Error("sandbox_build_failed: helper image did not resolve to an immutable digest.");
+        const projectContextRef = ociLayoutContextRef(path.relative(overlayRoot, projectOciRoot));
         await this.runBuildStage("agent", key, buildxBuildArgs(builder, path.join(metadataRoot, "agent.json"), [
             "--pull=false",
-            "--build-context", `${projectContextName}=${ociLayoutContextRef(projectOciRoot)}`,
+            "--build-context", `${projectContextName}=${projectContextRef}`,
             ...imageLabelArgs(project, key, "agent"),
             "--tag", overlayTag,
-            overlayRoot
-        ]), sink, signal);
+            "."
+        ]), sink, signal, { cwd: overlayRoot });
         const digest = (await this.docker(["image", "inspect", overlayTag, "--format", "{{.Id}}"], 15_000)).stdout.trim();
         if (!/^sha256:[0-9a-f]{64}$/i.test(digest))
             throw new Error("sandbox_build_failed: overlay image did not resolve to an immutable digest.");
@@ -602,10 +603,11 @@ export class DockerSandboxRuntime {
         }));
         return { imageDigest: digest, helperImageDigest };
     }
-    async runBuildStage(stage, key, args, sink, signal) {
+    async runBuildStage(stage, key, args, sink, signal, options = {}) {
         const result = await runSandboxProcess({
             command: this.config.dockerExecutable,
             args: this.dockerArgs(args),
+            cwd: options.cwd,
             timeoutMs: 30 * 60_000,
             maxOutputBytes: 2 * 1024 * 1024,
             terminateOnOutputLimit: true,
@@ -658,10 +660,10 @@ export class DockerSandboxRuntime {
     }
     async initializeVolumes(helperImage, resources, includeCredentials, signal) {
         const cacheMounts = Object.entries(resources.cacheVolumes).flatMap(([name, volume]) => ["--volume", `${volume}:/cache/${name}`]);
-        const credentialSetup = includeCredentials ? "f.chownSync('/credentials',10001,10001);f.chmodSync('/credentials',0o700);" : "";
-        const script = `const f=require('fs');f.mkdirSync('/control/input',{recursive:true});f.mkdirSync('/control/output',{recursive:true});for(const p of ['/control','/control/input','/control/output','/workspace'])f.chmodSync(p,0o777);${credentialSetup}for(const p of f.readdirSync('/cache').map(n=>'/cache/'+n)){f.chownSync(p,10001,10001);f.chmodSync(p,0o700)}`;
+        const credentialSetup = includeCredentials ? "f.chmodSync('/credentials',0o700);" : "";
+        const script = `const f=require('fs');f.mkdirSync('/control/input',{recursive:true});f.mkdirSync('/control/output',{recursive:true});for(const p of ['/control','/control/input','/control/output','/workspace'])f.chmodSync(p,0o777);${credentialSetup}for(const p of f.readdirSync('/cache').map(n=>'/cache/'+n)){f.chmodSync(p,0o700);f.chownSync(p,10001,10001)}`;
         const credentialMount = includeCredentials ? ["--volume", `${resources.credentialsVolume}:/credentials`] : [];
-        await this.docker(["run", "--rm", "--network", "none", "--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "64", "--memory", "128m", "--memory-swap", "128m", "--cpus", "0.25", "--log-driver", "none", "--user", "0", "--entrypoint", "node", "--volume", `${resources.workspaceVolume}:/workspace`, "--volume", `${resources.controlVolume}:/control`, ...credentialMount, ...cacheMounts, "--tmpfs", "/cache:rw,nosuid,nodev,noexec,size=1m", helperImage, "-e", script], 60_000, signal);
+        await this.docker(["run", "--rm", "--network", "none", "--read-only", "--cap-drop", "ALL", "--cap-add", "CHOWN", "--security-opt", "no-new-privileges", "--pids-limit", "64", "--memory", "128m", "--memory-swap", "128m", "--cpus", "0.25", "--log-driver", "none", "--user", "0", "--entrypoint", "node", "--volume", `${resources.workspaceVolume}:/workspace`, "--volume", `${resources.controlVolume}:/control`, ...credentialMount, ...cacheMounts, "--tmpfs", "/cache:rw,nosuid,nodev,noexec,size=1m", helperImage, "-e", script], 60_000, signal);
     }
     async inspectContainerState(containerId) {
         const result = await this.docker(["container", "inspect", containerId, "--format", "{{json .State}}"], 15_000, undefined, 256 * 1024);
@@ -692,10 +694,10 @@ export class DockerSandboxRuntime {
         if (!providerAuth) {
             return;
         }
-        const script = "let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',c=>s+=c);process.stdin.on('end',()=>{const f=require('fs'),p=require('path'),root='/credentials';for(const e of f.readdirSync(root))f.rmSync(p.join(root,e),{recursive:true,force:true});const packet=JSON.parse(s);for(const file of packet.files){if(!/^[a-z0-9_.-]+$/i.test(file.name))throw new Error('invalid credential file');const target=p.resolve(root,file.name);if(!target.startsWith(root+'/'))throw new Error('invalid credential file');const body=Buffer.from(file.contentBase64,'base64');f.writeFileSync(target,body,{mode:0o600});f.chownSync(target,10001,10001)}f.chownSync(root,10001,10001);f.chmodSync(root,0o700)})";
+        const script = "let s='';process.stdin.setEncoding('utf8');process.stdin.on('data',c=>s+=c);process.stdin.on('end',()=>{const f=require('fs'),p=require('path'),root='/credentials';for(const e of f.readdirSync(root))f.rmSync(p.join(root,e),{recursive:true,force:true});const packet=JSON.parse(s);for(const file of packet.files){if(!/^[a-z0-9_.-]+$/i.test(file.name))throw new Error('invalid credential file');const target=p.resolve(root,file.name);if(!target.startsWith(root+'/'))throw new Error('invalid credential file');const body=Buffer.from(file.contentBase64,'base64');f.writeFileSync(target,body,{mode:0o600});f.chmodSync(target,0o600);f.chownSync(target,10001,10001)}f.chmodSync(root,0o700);f.chownSync(root,10001,10001)})";
         await requireSandboxProcess({
             command: this.config.dockerExecutable,
-            args: this.dockerArgs(["run", "--rm", "--interactive", "--network", "none", "--read-only", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "64", "--memory", "128m", "--memory-swap", "128m", "--cpus", "0.25", "--log-driver", "none", "--user", "0", "--entrypoint", "node", "--volume", `${resources.credentialsVolume}:/credentials`, helperImage, "-e", script]),
+            args: this.dockerArgs(["run", "--rm", "--interactive", "--network", "none", "--read-only", "--cap-drop", "ALL", "--cap-add", "CHOWN", "--security-opt", "no-new-privileges", "--pids-limit", "64", "--memory", "128m", "--memory-swap", "128m", "--cpus", "0.25", "--log-driver", "none", "--user", "0", "--entrypoint", "node", "--volume", `${resources.credentialsVolume}:/credentials`, helperImage, "-e", script]),
             input: JSON.stringify({ files: providerAuth.files }),
             timeoutMs: 60_000,
             maxOutputBytes: 64 * 1024,
@@ -1453,11 +1455,15 @@ export async function extractOciLayoutArchive(archivePath, destination, signal)
     await fs.rm(archivePath, { force: true }).catch(() => undefined);
 }
 export function ociLayoutContextRef(layoutPath) {
-    const absolute = /^[A-Za-z]:[\\/]/u.test(layoutPath) ? layoutPath : path.resolve(layoutPath);
-    const normalized = absolute.replace(/\\/gu, "/");
+    if (/^[A-Za-z]:[\\/]/u.test(layoutPath)) {
+        throw new Error("sandbox_build_failed: Windows absolute OCI layout paths are not BuildKit-safe; use a relative path from the build working directory.");
+    }
+    const normalized = layoutPath.replace(/\\/gu, "/").replace(/^\.\//u, "");
     // BuildKit's oci-layout resolver expects a raw filesystem path here; it does not percent-decode
-    // URI path escapes such as %20 before opening index.json.
-    return normalized.startsWith("/") ? `oci-layout://${normalized}` : `oci-layout:///${normalized}`;
+    // URI path escapes such as %20 before opening index.json. On Windows, absolute drive paths
+    // such as D:/state/project-oci are parsed as OCI layout ref/tag syntax, so callers should
+    // run buildx from the layout parent and pass a relative path (for example project-oci).
+    return `oci-layout://${normalized}`;
 }
 export function formatOciExtractionFailure(result) {
     const output = result.stderr.trim() || result.stdout.trim() || "no tar output";

package/dist/session/session.types.js

@@ -111,7 +111,7 @@ function parseSandboxResourceRequest(value) {
 }
 function parseSandboxNetworkPolicy(value) {
     if (value === undefined || value === null)
-        return { mode: "public_allowlist", allowedHosts: [] };
+        return { mode: "offline", allowedHosts: [] };
     const policy = asObject(value, "sandbox.networkPolicy");
     const mode = requiredString(policy, "mode");
     if (mode !== "offline" && mode !== "public_allowlist" && mode !== "open_public") {
@@ -128,6 +128,9 @@ function parseSandboxNetworkPolicy(value) {
     if (mode !== "public_allowlist" && allowedHosts.length > 0) {
         throw new Error("sandbox.networkPolicy.allowedHosts requires public_allowlist mode.");
     }
+    if (mode === "public_allowlist" && allowedHosts.length === 0) {
+        return { mode: "offline", allowedHosts: [] };
+    }
     return { mode, allowedHosts };
 }
 export function failureResult(summary, events = []) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const forgeBridgeVersion = "0.1.3-dev.c28767e94230";
+export declare const forgeBridgeVersion = "0.1.3-dev.d46a8e73d03d";

package/dist/version.js

@@ -1 +1 @@
-export const forgeBridgeVersion = "0.1.3-dev.c28767e94230";
+export const forgeBridgeVersion = "0.1.3-dev.d46a8e73d03d";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loucompanion/forge-bridge",
-  "version": "0.1.3-dev.c28767e94230",
+  "version": "0.1.3-dev.d46a8e73d03d",
   "description": "Forge runner bridge CLI for connecting local developer machines to Forge dispatch.",
   "license": "UNLICENSED",
   "type": "module",