@mybase-dev/cli 1.0.10 → 1.0.12

package/dist/mybase.js

@@ -109,7 +109,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mybase-dev/cli",
-    version: "1.0.10",
+    version: "1.0.12",
     description: "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
     type: "module",
     repository: {
@@ -1714,6 +1714,42 @@ function publicSandboxIp(ip) {
 }
 var init_public_ip = () => {};
 
+// ../../packages/shared/src/sandbox.ts
+function sandboxConfig(raw) {
+  const config = { resources: { ...SANDBOX_RESOURCES }, limits: { ...SANDBOX_LIMITS } };
+  if (!raw)
+    return config;
+  const input = JSON.parse(raw);
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("MYBASE_SANDBOX_CONFIG must be a JSON object");
+  for (const group of Object.keys(input)) {
+    if (group !== "resources" && group !== "limits")
+      throw new Error(`unknown sandbox config group: ${group}`);
+    const values = input[group];
+    if (!values || typeof values !== "object" || Array.isArray(values))
+      throw new Error(`sandbox ${group} must be an object`);
+    const target = config[group];
+    for (const [key, value] of Object.entries(values)) {
+      if (!Object.hasOwn(target, key))
+        throw new Error(`unknown sandbox ${group} setting: ${key}`);
+      if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || key !== "cpus" && !Number.isSafeInteger(value))
+        throw new Error(`sandbox ${key} must be a positive ${key === "cpus" ? "number" : "safe integer"}`);
+      target[key] = value;
+    }
+  }
+  return config;
+}
+var SANDBOX_RESOURCES, SANDBOX_LIMITS;
+var init_sandbox = __esm(() => {
+  SANDBOX_RESOURCES = { cpus: 1, memoryMb: 1024, workspaceMb: 128, pids: 256, tmpMb: 256, shmMb: 64 };
+  SANDBOX_LIMITS = {
+    fileBytes: 8 * 1024 * 1024,
+    outputBytes: 64 * 1024,
+    networkStreams: 32,
+    networkIdleMs: 15000
+  };
+});
+
 // ../../docker/compose.yml
 var compose_default = `# Runs mybase: the control plane (API + dashboard), the shared Postgres server, Garage
 # (S3-compatible storage), Valkey (Redis-compatible cache), and SearXNG (web search). All images are multi-arch (arm64 + amd64).
@@ -1831,6 +1867,7 @@ services:
       LOG_LEVEL: \${LOG_LEVEL:-info}
       MYBASE_SANDBOX_WORKER_URL: \${MYBASE_SANDBOX_WORKER_URL:-}
       MYBASE_SANDBOX_WORKER_KEY: \${MYBASE_SANDBOX_WORKER_KEY:-}
+      MYBASE_SANDBOX_CONFIG: \${MYBASE_SANDBOX_CONFIG:-}
     ports:
       - "\${MYBASE_BIND:-0.0.0.0}:\${MYBASE_PORT:-4000}:4000"
 
@@ -1918,6 +1955,7 @@ services:
     environment:
       MYBASE_SANDBOX_WORKER_KEY: \${MYBASE_SANDBOX_WORKER_KEY:-}
       MYBASE_SANDBOX_DENY_HOSTS: \${MYBASE_SANDBOX_DENY_HOSTS:-}
+      MYBASE_SANDBOX_CONFIG: \${MYBASE_SANDBOX_CONFIG:-}
       MYBASE_SANDBOX_IMAGE: \${MYBASE_SANDBOX_IMAGE:-ghcr.io/landonharter/mybase-sandbox:latest}
       LOG_LEVEL: \${LOG_LEVEL:-info}
     volumes:
@@ -2370,8 +2408,15 @@ function checkSandboxDocker(info, endpoint, platform = process.platform) {
     throw new CliError("sandboxes support Linux amd64 and arm64 hosts only (use a 64-bit OS on a Raspberry Pi)");
   if (!versionAtLeast(info.KernelVersion, "5.6.0"))
     throw new CliError("gVisor requires Linux 5.6 or newer");
-  if (info.CgroupVersion !== "2" || !info.MemoryLimit || !info.SwapLimit || !info.CpuCfsQuota || !info.PidsLimit)
-    throw new CliError("sandboxes require working cgroup v2 memory, swap, CPU and process controllers. The host kernel/Docker configuration needs those enabled first");
+  const missing = [
+    info.CgroupVersion !== "2" ? "cgroup v2" : null,
+    !info.MemoryLimit ? "memory limits" : null,
+    !info.SwapLimit ? "swap accounting" : null,
+    info.CpuCfsQuota === false ? "CPU quotas" : null,
+    !info.PidsLimit ? "process limits" : null
+  ].filter(Boolean);
+  if (missing.length)
+    throw new CliError(`sandboxes require working cgroup v2 resource controllers; missing: ${missing.join(", ")}. The host kernel/Docker configuration needs those enabled first`);
 }
 function gvisorChecksum(text) {
   const match = /^([a-f0-9]{128})\s+\*?gvisor\.tar\.bz2\s*$/i.exec(text.trim());
@@ -3417,7 +3462,7 @@ async function sandboxWorkerHealth(dir, run = hostRun) {
     return null;
   }
 }
-async function probeRuntime(image, run) {
+async function probeRuntime(image, run, resources) {
   const name = `mybase-sandbox-probe-${crypto.randomUUID()}`;
   const code = "const timer=setTimeout(()=>process.exit(1),15000);const {chromium}=require('/opt/runtime/node_modules/playwright');chromium.launch({headless:true,chromiumSandbox:false,args:['--disable-dev-shm-usage']}).then(async b=>{await b.close();clearTimeout(timer)}).catch(()=>process.exit(1))";
   try {
@@ -3432,16 +3477,17 @@ async function probeRuntime(image, run) {
       "--read-only",
       "--cap-drop=ALL",
       "--security-opt=no-new-privileges:true",
-      "--cpus=1",
-      "--memory=1024m",
-      "--memory-swap=1024m",
-      "--pids-limit=256",
-      "--ulimit=nproc=256:256",
+      `--cpus=${resources.cpus}`,
+      `--memory=${resources.memoryMb}m`,
+      `--memory-swap=${resources.memoryMb}m`,
+      `--pids-limit=${resources.pids}`,
+      `--ulimit=nproc=${resources.pids}:${resources.pids}`,
       "--log-driver=none",
       "--tmpfs",
-      "/tmp:rw,nosuid,nodev,size=256m,uid=1000,gid=1000,mode=0700",
+      `/tmp:rw,nosuid,nodev,size=${resources.tmpMb}m,uid=1000,gid=1000,mode=0700`,
       "--tmpfs",
-      "/workspace:rw,nosuid,nodev,size=128m,uid=1000,gid=1000,mode=0700",
+      `/workspace:rw,nosuid,nodev,size=${resources.workspaceMb}m,uid=1000,gid=1000,mode=0700`,
+      `--shm-size=${resources.shmMb}m`,
       "--entrypoint",
       "node",
       image,
@@ -3464,6 +3510,7 @@ async function prepareSandboxHost(args, options = {}, overrides = {}) {
     throw new CliError(`no mybase server in ${dir}; run mybase server setup --sandboxes first`, 4);
   const text = await file.text();
   const values = parseEnv(text);
+  const config = sandboxConfig(values.MYBASE_SANDBOX_CONFIG);
   const interactive = !jsonMode && process.stdin.isTTY === true && !args.includes("--yes");
   if (!options.confirmed && !args.includes("--yes")) {
     if (!interactive)
@@ -3510,7 +3557,7 @@ async function prepareSandboxHost(args, options = {}, overrides = {}) {
     await pullImage(settings.MYBASE_SANDBOX_IMAGE, io.run, false);
     await pullImage(settings.MYBASE_SANDBOX_WORKER_IMAGE, io.run, false);
     s.message("Verifying Chromium under gVisor with bounded resources");
-    await probeRuntime(settings.MYBASE_SANDBOX_IMAGE, io.run);
+    await probeRuntime(settings.MYBASE_SANDBOX_IMAGE, io.run, config.resources);
     await writeFiles(dir, mergeEnv(text, settings), interactive, true);
     const current = { ...values, ...settings };
     const url = localUrl(current);
@@ -3560,6 +3607,7 @@ var WORKER_HEALTH = "fetch('http://127.0.0.1:4010/health',{headers:{Authorizatio
 var init_server_sandbox = __esm(async () => {
   init_dist4();
   init_public_ip();
+  init_sandbox();
   init_src();
   init_output();
   init_server_docker();
@@ -5849,10 +5897,10 @@ await init_service_enable();
 var sandboxUsage = `  sandbox enable <project> [--setup-worker] [--dir <dir>] [--yes]
                                  Enable isolated compute; --setup-worker configures the local host first
   sandbox disable <project> [--yes]  Stop sandboxes and delete their artifacts
-  sandbox create <project> --key <key> [--ttl 300] [--idle 120]
+  sandbox create <project> --key <key> [--ttl <seconds>] [--idle <seconds>]
   sandbox list|get|usage <project> [<id>]
   sandbox terminate <project> <id> [--yes]
-  sandbox exec <project> <id> --key <key> [--code file.js | --command '["node","script.js"]'] [--timeout 30000]
+  sandbox exec <project> <id> --key <key> [--code file.js | --command '["node","script.js"]'] [--timeout <ms>]
   sandbox runs|artifacts|browser <project> <id>
   sandbox run <project> <id> <execution>
   sandbox cancel <project> <id> <execution> [--yes]
@@ -5860,7 +5908,8 @@ var sandboxUsage = `  sandbox enable <project> [--setup-worker] [--dir <dir>] [-
   sandbox export <project> <id> <workspace-path> [--type image/png]
   sandbox artifact <project> <id> <artifact-id> <local-file>
   Creation/execution return promptly. Poll get/run. Cancelling execution terminates sandbox.
-  Browser credentials expire after 30s; authenticated CDP connection lasts at most 60s.`;
+  No default lifetime, idle expiry, or execution timeout. Set optional deadlines as needed.
+  Browser credentials expire after 30s; authenticated CDP connections have no fixed lifetime.`;
 async function sandbox(sub, args) {
   const known = ["enable", "disable", "create", "list", "get", "usage", "terminate", "exec", "runs", "run", "cancel", "upload", "download", "export", "artifacts", "artifact", "browser"];
   if (!known.includes(sub))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mybase-dev/cli",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   "type": "module",
   "repository": {