@omg-dev/sandbox 0.4.34 → 0.4.37

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { _ as SandboxClient, a as compileStartScript, c as download, d as templateContentVersionRef, f as templateDefinitionHash, g as SandboxApiError, h as waitForSnapshotUpload, i as check, l as files, m as templateVersionRef, n as apt, o as compileStep, p as templateRuntimeContract, r as bakeTemplate, s as defineTemplate, t as applyTemplate, u as run, v as assertTemplateId } from "./templates-BLd13wPT.mjs";
-export { SandboxApiError, SandboxClient, applyTemplate, apt, assertTemplateId, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };
+import { _ as SandboxApiError, a as check, c as defineTemplate, d as run, f as templateContentVersionRef, g as waitForSnapshotUpload, h as templateVersionRef, i as bakeTemplate, l as download, m as templateRuntimeContract, n as applyTemplate, o as compileStartScript, p as templateDefinitionHash, r as apt, s as compileStep, t as APT_FORCE_IPV4_SNIPPET, u as files, v as SandboxClient, y as assertTemplateId } from "./templates-D-Ap1Yxk.mjs";
+export { APT_FORCE_IPV4_SNIPPET, SandboxApiError, SandboxClient, applyTemplate, apt, assertTemplateId, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };

package/dist/{templates-BLd13wPT.mjs → templates-D-Ap1Yxk.mjs}

@@ -203,9 +203,10 @@ function shellEnvAssignments(env) {
 		return `${key}=${quote(value)}`;
 	});
 }
+const APT_FORCE_IPV4_SNIPPET = `mkdir -p /etc/apt/apt.conf.d\nprintf 'Acquire::ForceIPv4 "true";\\n' > /etc/apt/apt.conf.d/99-omg-force-ipv4`;
 function compileStep(step) {
 	if (step.kind === "files") throw new Error("files steps transfer local content and are applied via applyTemplate(), not compileStep()");
-	if (step.kind === "apt") return { script: `set -euo pipefail\napt-get update -qq\nDEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends ${step.packages.map(quote).join(" ")}\nrm -rf /var/lib/apt/lists/*` };
+	if (step.kind === "apt") return { script: `set -euo pipefail\n${APT_FORCE_IPV4_SNIPPET}\napt-get update -qq\nDEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends ${step.packages.map(quote).join(" ")}\nrm -rf /var/lib/apt/lists/*` };
 	if (step.kind === "archive") {
 		const strip = step.stripComponents ?? 1;
 		if (!Number.isInteger(strip) || strip < 0 || strip > 20) throw new Error("invalid stripComponents");
@@ -420,4 +421,4 @@ async function resolveTemplateVersion(client, versionRef) {
 	}
 }
 //#endregion
-export { SandboxClient as _, compileStartScript as a, download as c, templateContentVersionRef as d, templateDefinitionHash as f, SandboxApiError as g, waitForSnapshotUpload as h, check as i, files as l, templateVersionRef as m, apt as n, compileStep as o, templateRuntimeContract as p, bakeTemplate as r, defineTemplate as s, applyTemplate as t, run as u, assertTemplateId as v };
+export { SandboxApiError as _, check as a, defineTemplate as c, run as d, templateContentVersionRef as f, waitForSnapshotUpload as g, templateVersionRef as h, bakeTemplate as i, download as l, templateRuntimeContract as m, applyTemplate as n, compileStartScript as o, templateDefinitionHash as p, apt as r, compileStep as s, APT_FORCE_IPV4_SNIPPET as t, files as u, SandboxClient as v, assertTemplateId as y };

package/dist/templates.mjs

@@ -1,2 +1,2 @@
-import { a as compileStartScript, c as download, d as templateContentVersionRef, f as templateDefinitionHash, h as waitForSnapshotUpload, i as check, l as files, m as templateVersionRef, n as apt, o as compileStep, p as templateRuntimeContract, r as bakeTemplate, s as defineTemplate, t as applyTemplate, u as run } from "./templates-BLd13wPT.mjs";
-export { applyTemplate, apt, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };
+import { a as check, c as defineTemplate, d as run, f as templateContentVersionRef, g as waitForSnapshotUpload, h as templateVersionRef, i as bakeTemplate, l as download, m as templateRuntimeContract, n as applyTemplate, o as compileStartScript, p as templateDefinitionHash, r as apt, s as compileStep, t as APT_FORCE_IPV4_SNIPPET, u as files } from "./templates-D-Ap1Yxk.mjs";
+export { APT_FORCE_IPV4_SNIPPET, applyTemplate, apt, bakeTemplate, check, compileStartScript, compileStep, defineTemplate, download, files, run, templateContentVersionRef, templateDefinitionHash, templateRuntimeContract, templateVersionRef, waitForSnapshotUpload };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omg-dev/sandbox",
-  "version": "0.4.34",
+  "version": "0.4.37",
   "type": "module",
   "exports": {
     ".": {

package/src/templates.test.ts

@@ -33,6 +33,16 @@ describe("sandbox templates", () => {
     expect(Object.isFrozen(template)).toBe(true);
   });
 
+  test("apt forces IPv4 before the first fetch — the guest has no IPv6 route", () => {
+    const { script } = compileStep(apt.packages(["tmux"]));
+    const dropIn = script.indexOf("Acquire::ForceIPv4");
+    expect(dropIn).toBeGreaterThan(-1);
+    expect(script).toContain("/etc/apt/apt.conf.d/99-omg-force-ipv4");
+    // Ordering is the whole fix: an AAAA-only attempt before the drop-in lands
+    // still burns the step deadline on an unroutable archive.ubuntu.com.
+    expect(dropIn).toBeLessThan(script.indexOf("apt-get update"));
+  });
+
   test("archive extraction ignores inherited tar policy", () => {
     const { script } = compileStep(download.archive({ url: "https://example.com/a.tgz", destination: "/home/user/app" }));
     expect(script).toContain("TAR_OPTIONS= tar");
@@ -148,7 +158,7 @@ describe("sandbox templates", () => {
 
   test("LFG owns every runtime dependency and zero-config transport default", () => {
     const lfg = agentTemplates.lfg;
-    expect(templateVersionRef(lfg)).toBe("agent-lfg-v43");
+    expect(templateVersionRef(lfg)).toBe("agent-lfg-v81");
     expect(lfg.install).toContainEqual(apt.packages(["tmux"]));
     expect(lfg.checks).toContainEqual(check.command("tmux"));
     expect(lfg.checks).toContainEqual(check.file("/home/user/lfg/omg-start.sh"));
@@ -156,7 +166,7 @@ describe("sandbox templates", () => {
     expect(lfg.start?.env?.LIVE_TRANSPORT).toBe("ws");
     expect(lfg.start?.readiness?.port).toBe(8766);
     expect(templateRuntimeContract(lfg, templateVersionRef(lfg))).toEqual({
-      immutableRef: "agent-lfg-v43",
+      immutableRef: "agent-lfg-v81",
       restoreKind: "full_rootfs",
       startCommand: "exec /home/user/.omg/template/bootstrap.sh",
       readinessPort: 8766,
@@ -196,7 +206,26 @@ describe("sandbox templates", () => {
       .filter((step): step is Extract<typeof step, { kind: "run" }> => step.kind === "run")
       .map((step) => step.command);
     expect(commands.some((c) => c.includes("recipe.sh"))).toBe(true);
-    expect(lfg.metadata?.lfgRelease).toBe("v0.1.209");
+    // The LFG release is pinned in three places that a bump has to move
+    // together: the bundle download URL, the install.json the guest writes
+    // (what self-update compares against), and the metadata the dashboard
+    // reads. A hardcoded version here just goes stale on every bump — and did,
+    // sitting at v0.1.209 while the catalog had moved on to v0.1.296. Assert
+    // the invariant that actually matters instead: all three agree.
+    const pinnedRelease = lfg.metadata?.lfgRelease as string | undefined;
+    expect(pinnedRelease).toMatch(/^v\d+\.\d+\.\d+$/);
+    expect(
+      lfg.install.some(
+        (step) =>
+          step.kind === "archive" &&
+          "url" in step &&
+          typeof step.url === "string" &&
+          step.url.includes(`/releases/download/${pinnedRelease}/lfg-bundle.tar.gz`),
+      ),
+    ).toBe(true);
+    expect(
+      commands.some((c) => c.includes(`"release":"${pinnedRelease}"`)),
+    ).toBe(true);
     const lfgInstall = commands.find((c) => c.includes("bun install --production"));
     expect(lfgInstall).toBeDefined();
     expect(lfgInstall!).not.toContain("delete manifest.workspaces");

package/src/templates.ts

@@ -179,12 +179,26 @@ function shellEnvAssignments(env: Record<string, string>): string[] {
   });
 }
 
+// Guest VMs are IPv4-only: apps/infra/rootfs/init writes a v4-only
+// /etc/resolv.conf and the netns contract hands the guest 169.254.0.2 with no
+// IPv6 route. Ubuntu's mirrors publish AAAA records anyway, and apt walks the
+// resolved addresses serially with no happy-eyeballs fallback — so a bake
+// either dies on `Cannot initiate the connection to archive.ubuntu.com:80
+// (2620:2d:4000:1::101). - connect (101: Network is unreachable)` or burns the
+// whole 10-minute step deadline on an unroutable mirror. Both were silent:
+// agent-lfg just stayed stale at the last good bake.
+//
+// Written as a drop-in rather than an inline `-o` so it lands before the first
+// fetch AND persists into the baked snapshot — later apt calls in the guest
+// (the agent's runtime tmux fallback, user apps) inherit it for free.
+export const APT_FORCE_IPV4_SNIPPET = `mkdir -p /etc/apt/apt.conf.d\nprintf 'Acquire::ForceIPv4 "true";\\n' > /etc/apt/apt.conf.d/99-omg-force-ipv4`;
+
 export function compileStep(step: TemplateStep): { script: string; timeoutMs?: number } {
   if (step.kind === "files") {
     throw new Error("files steps transfer local content and are applied via applyTemplate(), not compileStep()");
   }
   if (step.kind === "apt") {
-    return { script: `set -euo pipefail\napt-get update -qq\nDEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends ${step.packages.map(quote).join(" ")}\nrm -rf /var/lib/apt/lists/*` };
+    return { script: `set -euo pipefail\n${APT_FORCE_IPV4_SNIPPET}\napt-get update -qq\nDEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends ${step.packages.map(quote).join(" ")}\nrm -rf /var/lib/apt/lists/*` };
   }
   if (step.kind === "archive") {
     const strip = step.stripComponents ?? 1;