root - chore: defense - bootstrap Aikido Safe Chain in cloud agents

[jaredwray]

Summary

Bootstrap Aikido Safe Chain for Codespaces and Cursor Cloud Agents so package installs in those environments go through pinned --ci shims and a frozen lockfile.

Status update

DEFENSE_IN_DEPTH.md: Codespaces and Cursor Cloud Agents bootstrap Aikido Safe Chain → (PR #478 pending)
Dropped leftover catalog line: Dev/release VM network egress filtered by a firewall (e.g. PMG)

Changes

• Add scripts/setup-cloud-environment.sh (Safe Chain 1.5.15, installer SHA-256 verified)
• Add .devcontainer/devcontainer.json and .cursor/environment.json that run the script
• Append the Safe Chain section to AGENTS.md
• List the live control in SECURITY.md

Verification

• bash ./scripts/setup-cloud-environment.sh (installer checksum OK; pnpm safe-chain-verify; frozen lockfile install)
• pnpm test (831 tests, 100% coverage)

Reference

defense-in-depth-nodejs § 2 (Safe Chain on Codespaces and Cursor Cloud Agents)

  

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f139ce3) to head (d06a46d).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #478   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           18        18           
  Lines         2760      2760           
  Branches       845       845           
=========================================
  Hits          2760      2760           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88c482db2b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Codespaces pnpm bootstrap fragile
  • corepack enable now falls back to sudo so Codespaces postCreateCommand can create pnpm shims when the Node bin dir is root-owned.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 88c482d. Configure here.}