memcache - chore: defense - bootstrap Aikido Safe Chain

[jaredwray]

Summary

Bootstrap Aikido Safe Chain on Codespaces and Cursor Cloud Agents so package installs go through pinned shims and a frozen lockfile.

Status update

DEFENSE_IN_DEPTH.md: § 2 Safe Chain → (PR #107 pending); CODEOWNERS → PR #106 (merged)

Changes

• Add scripts/setup-cloud-environment.sh (Safe Chain 1.5.15, installer SHA-256 pinned, --ci shims, pnpm install --frozen-lockfile)
• Add .devcontainer/devcontainer.json and .cursor/environment.json invoking that script
• Append the Safe Chain section to AGENTS.md
• List the live Safe Chain control in SECURITY.md
• Reconcile CODEOWNERS after PR memcache - chore: defense - add CODEOWNERS #106

No leftover PMG / VM-egress catalog line was present.

Verification

• .devcontainer/devcontainer.json and .cursor/environment.json are valid JSON
• bash ./scripts/setup-cloud-environment.sh — installer SHA verified, pnpm safe-chain-verify OK, frozen lockfile install succeeded
• Followed the Contributing and Code of Conduct guidelines

Reference

defense-in-depth-nodejs § 2

  

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a61167b) to head (110716e).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #107   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines         1399      1399           
  Branches       308       303    -5     
=========================================
  Hits          1399      1399           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix prepared fixes for both issues found in the latest run.

• ✅ Fixed: Bootstrap skips nvm before pnpm
  • The setup script now sources nvm.sh before the corepack/pnpm checks so a Cursor Cloud install hook with a reset PATH uses nvm Node 24 instead of failing or wrapping /exec-daemon/node.
• ✅ Fixed: Floating unpinned devcontainer base image
  • The Codespaces image is pinned to javascript-node:24 so bootstrap stays on the Node major that still ships corepack instead of drifting with latest.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 110716e. Configure here.}

[cursor]

Bootstrap skips nvm before pnpm

High Severity

The bootstrap requires pnpm on PATH after an optional corepack enable, but never activates nvm or sources ~/.bashrc first. AGENTS.md states Cursor Cloud’s system node at /exec-daemon/node is too old and that the usable Node/pnpm come from nvm via ~/.bashrc. Cursor’s install hook can run with a minimal PATH, so the script can exit before Safe Chain runs or wrap the wrong Node, breaking cloud agent setup.

Additional Locations (2)

• AGENTS.md#L41-L42
• .cursor/environment.json#L1-L2

 

^{Reviewed by Cursor Bugbot for commit 110716e. Configure here.}

[cursor]

Floating unpinned devcontainer base image

Medium Severity

The Codespaces config pins the bootstrap to mcr.microsoft.com/devcontainers/javascript-node:latest. That tag can move to Node releases that no longer bundle corepack, while the setup script only enables pnpm through corepack. When latest drifts, postCreateCommand can fail before Safe Chain installs, or run on an unexpected toolchain, weakening the supply-chain control this PR adds.

 

^{Reviewed by Cursor Bugbot for commit 110716e. Configure here.}