tsconfig.base.json:1

• This file appears to contain only a path string, which is not valid tsconfig JSON and will break TypeScript tooling that expects a JSON object. If the intent is to reference apps/tsconfig.base.json, commit this as a symlink (so Git records it as a link) or replace the file contents with a real tsconfig that uses extends to point at the apps config.
  libs:1
• This looks like it was intended to be a directory alias/symlink, but as committed it’s a regular file containing a path string. That will break any build tooling that expects libs/ to be a directory. Commit a real symlink (recorded by Git) or remove this file and update references to point at the correct directory.
  apps/infra-local/scripts/stack-up.sh:1
• On macOS, BSD xargs does not support -r, so this command won’t reliably kill the prior listener; it can leave the port occupied and cause the subsequent start to fail with EADDRINUSE. Remove -r (since the port is known to be listening here) or replace this with a macOS-safe loop over PIDs.
  apps/runner/pkg/boxlite/registry.go:1
• The variable name linuxAmd64Platform is now misleading because it no longer forces amd64. Rename it to something like linuxPlatform / defaultPullPlatform to avoid confusion when reading call sites.

apps/runner/pkg/boxlite/registry.go:1

• linuxAmd64Platform no longer represents amd64 specifically (it’s now host-arch dependent). Rename to something like linuxHostPlatform/defaultLinuxPlatform to avoid misleading future readers and call sites.
  apps/package.json:1
• Using a caret range in resolutions can reduce determinism (you may get different transitive trees over time). Prefer pinning @types/express to an exact version here (and ensure the lockfile resolves consistently) to avoid unexpected type changes across installs.
  tsconfig.base.json:1
• This file content is not valid JSON unless it’s being committed as a git symlink target. Ensure tsconfig.base.json is actually a symlink (mode 120000) to apps/tsconfig.base.json; otherwise TypeScript tooling will fail to parse it.
  docs/apps/infra-vs-local-infra.md:1
• These port numbers conflict with the rest of the infra-local docs/scripts in this PR (API is started on :3001; dashboard on :3000). Update the table to reflect the actual local ports so readers don’t follow incorrect endpoints.

tsconfig.base.json:1

• This file content is not valid JSON. If the intent is to make the repo-root tsconfig.base.json a symlink to apps/tsconfig.base.json, ensure it is committed as a git symlink (mode 120000). If it lands as a regular file, TypeScript tooling reading tsconfig.base.json will fail to parse it.
  libs:1
• Like tsconfig.base.json, this looks like it’s meant to be a symlink. If it is committed as a normal file containing the text apps/libs, any tooling expecting libs/ to be a directory (or a workspace path) will break. Ensure this is a git symlink (mode 120000) rather than a regular file.
  apps/infra-local/scripts/stack-up.sh:1
• On macOS/BSD, xargs does not support -r (GNU-only), so this will error and can break set -e flows. Replace the pipeline with a macOS-compatible pattern (e.g., capture PIDs and conditionally kill, or use an xargs invocation that does not rely on -r). Apply the same fix to the other xargs -r occurrences in this script.
  apps/runner/pkg/boxlite/registry.go:1
• The variable name linuxAmd64Platform is now inaccurate since it can be arm64 (or others). Rename it to reflect the new behavior (e.g., linuxDefaultPlatform, linuxHostArchPlatform, etc.) to avoid confusing future readers.
  apps/package.json:1
• As of Aug 2025, @swc/core versions were not in the 1.15.x range; ^1.15.33 may be a non-existent release and would break installs. Please confirm the intended @swc/core version exists in npm (and align it with the repo’s SWC toolchain expectations).

apps/infra-local/scripts/stack-up.sh:1

• xargs -r is not supported by macOS/BSD xargs, so this command will fail on the target platform. Replace with a portable pattern (e.g., capture PIDs into a variable and only call kill when non-empty, or use xargs kill -9 guarded by if/grep -q .). Apply the same fix to the runner/proxy/dashboard blocks that use xargs -r.
  apps/runner/pkg/boxlite/registry.go:1
• The variable name linuxAmd64Platform is now misleading because it can resolve to non-amd64 architectures. Rename it to something accurate (e.g., linuxHostPlatform or defaultLinuxPlatform) to avoid confusion and incorrect future usage.
  apps/package.json:1
• Using a caret range in resolutions can reduce determinism (the resolved version may vary over time and across tooling). Consider pinning @types/express to an exact version to keep installs reproducible and avoid surprise type changes.
  tsconfig.base.json:1
• This appears to be a Git symlink (stored as a file containing the target path). On platforms/environments that don’t support symlinks (or where Git symlinks are disabled, common on Windows), this will become a plain text file and break TypeScript tooling expecting valid JSON at tsconfig.base.json. If Windows support is needed, consider a real JSON file that extends apps/tsconfig.base.json instead of a symlink.

apps/runner/pkg/boxlite/registry.go:1

• The variable name linuxAmd64Platform is now misleading because Architecture is derived from runtime.GOARCH (often arm64 on Apple Silicon). Rename it to something architecture-agnostic (e.g., linuxDefaultPlatform / linuxHostPlatform) to avoid confusion and prevent future misuse.

tsconfig.base.json:1

• tsconfig.base.json must be valid JSON for TypeScript/Nx tooling; the current content is a plain path string and will cause parsing failures. If the intent is to share apps/tsconfig.base.json, either commit a real symlink (so the repo root tsconfig.base.json resolves to the apps file) or replace this with a minimal JSON file that extends the apps base config.
  libs:1
• A root-level libs entry is expected to be a directory (or a symlink to a directory) in most workspaces; committing it as a plain file containing a path will break module resolution and filesystem expectations. If this is intended to be a symlink to apps/libs, commit it as an actual symlink (or adjust workspace configuration so code references apps/libs directly).
  apps/runner/pkg/boxlite/registry.go:1
• The identifier linuxAmd64Platform is now misleading because it no longer hardcodes amd64 and can evaluate to arm64, etc. Rename it to something architecture-agnostic (e.g., linuxHostPlatform / defaultLinuxPlatform) to avoid incorrect assumptions elsewhere.
  apps/package.json:1
• The specified node-forge version ^1.4.0 may not exist on npm (as of common published versions, node-forge is typically 1.3.x). If this version is not actually published, installs will fail; please verify the published version and pin to an existing release (or update to the correct package/version if a different fork is intended).

apps/runner/pkg/boxlite/registry.go:1

• The variable name linuxAmd64Platform is now misleading since it can be arm64 (or other). Rename to something architecture-neutral (e.g. linuxHostPlatform / defaultLinuxPlatform) so callers don’t infer it is always amd64.
  tsconfig.base.json:1
• This appears to be a committed symlink (Git stores symlinks as a file whose contents is the target path). Symlinks can be problematic on Windows and in some packaging/CI environments; consider replacing this with a real tsconfig.base.json that uses extends to reference apps/tsconfig.base.json, or document/enforce symlink support in contributing/CI.
  libs:1
• Similar to tsconfig.base.json, this looks like a committed symlink to apps/libs. If cross-platform support matters, consider using an actual directory or a tooling-level path mapping instead of a symlink, or ensure CI and team dev environments can reliably handle symlinks.
  apps/package.json:1
• Based on versions available up to my knowledge cutoff (Aug 2025), node-forge@^1.4.0 and @swc/core@^1.15.33 look potentially non-existent or at least unusually high jumps. Please verify these versions exist on npm (and that the lockfile/tooling supports them); if not, pin to a published version or adjust the range to the intended release line.
  apps/package.json:1
• Based on versions available up to my knowledge cutoff (Aug 2025), node-forge@^1.4.0 and @swc/core@^1.15.33 look potentially non-existent or at least unusually high jumps. Please verify these versions exist on npm (and that the lockfile/tooling supports them); if not, pin to a published version or adjust the range to the intended release line.
  apps/package.json:1
• Using a caret range in resolutions can undermine determinism and make installs vary across time. Prefer pinning an exact version in resolutions (and relying on the lockfile) unless there’s a specific reason to allow upgrades here.

tsconfig.base.json:1

• tsconfig.base.json is not valid JSON as committed (it contains only a path). If this is intended to be a symlink, ensure it’s committed as a symlink in git (mode 120000); otherwise TypeScript tooling will fail when reading the root tsconfig. If symlinks are not desired/portable, replace this with an actual JSON tsconfig that extends ./apps/tsconfig.base.json.
  libs:1
• This file content looks like a symlink target (and as a regular file it’s not a valid directory). If the intent is a repository-root libs symlink to apps/libs, make sure it’s committed as a symlink; otherwise consumers expecting a libs/ directory at repo root will break.
  apps/runner/pkg/boxlite/registry.go:1
• The variable name linuxAmd64Platform is now misleading because it no longer hardcodes amd64 (it uses runtime.GOARCH). Rename it to reflect the new semantics (e.g., linuxHostPlatform, linuxDefaultPlatform, or linuxPlatformForHostArch) to avoid confusing future readers and callers.
  apps/package.json:1
• As of my knowledge cutoff (Aug 2025), node-forge’s latest published version is 1.3.1 and ^1.4.0 is likely not resolvable from npm. Please verify the intended version exists; otherwise installs will fail in CI. If the goal is simply to add node-forge, consider pinning to ^1.3.1 (or whatever the current published latest is) and updating @types/node-forge accordingly.

docs/apps/infra-local-usage.md-230-233 (1)

230-233: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a language identifier to the fenced code block in Section 6.1.

Line 230 opens a fenced block without a language, which triggers markdownlint rule MD040.

💡 Proposed fix

-```
+```text
 http://localhost:3000  → pick admin / user to log in (dex static users)

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @docs/apps/infra-local-usage.md around lines 230 - 233, The fenced code block
in Section 6.1 is missing a language identifier which triggers markdownlint
MD040; update the backticks that start the block around the line containing
"http://localhost:3000 → pick admin / user to log in (dex static users)" to
include a language hint such as text (e.g., change totext) so the fenced
block is properly annotated.

</details>

<!-- cr-comment:v1:b8aae239d297f09d95853ce4 -->

_Source: Linters/SAST tools_

</blockquote></details>
<details>
<summary>docs/apps/infra-local-usage.md-16-31 (1)</summary><blockquote>

`16-31`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Use one component-selector variable consistently in examples.**

Line 16 uses `COMPONENT=...`, while Line 31 documents `COMPONENTS=` as the selector and later examples also mix forms. This is copy/paste-prone and can break command usage.

<details>
<summary>💡 Proposed fix</summary>

```diff
-make stack-logs COMPONENT=api
+make stack-logs COMPONENTS=api
@@
-make stack-logs COMPONENT=runner                 # single component
-make stack-logs COMPONENT=all                    # everything
+make stack-logs COMPONENTS=runner                # single component
+make stack-logs COMPONENTS=all                   # everything
```
</details>

  


Also applies to: 215-217

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/apps/infra-local-usage.md` around lines 16 - 31, The docs use two
different component selector variables (`COMPONENT=` vs `COMPONENTS=`) which is
inconsistent and error-prone; pick one name and update all examples to use it
consistently (e.g., replace `COMPONENT=api` with `COMPONENTS=api` and ensure
`make stack-restart`/`make stack-logs`/`make stack-down` examples and the
explanatory sentence all reference the same `COMPONENTS=` variable, including
the other occurrences noted around lines 215-217); also ensure the parenthetical
"(empty = all)" matches the chosen variable name.
```

</details>

<!-- cr-comment:v1:cc43f5ae1876e8bcec1e75ad -->

</blockquote></details>
<details>
<summary>docs/apps/infra-local-usage.md-127-132 (1)</summary><blockquote>

`127-132`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Avoid direct `go build` in this workflow section; use make wrapper commands.**

This section bypasses the documented stack wrappers and can drift from repo-standard flags/paths. Prefer `make stack-restart COMPONENTS=runner` (or documented wrapper equivalents) for consistency with the rest of this guide.

Based on learnings: "Use `make` targets for build, test, lint, format, setup, and distribution. Do not run `cargo`, `npm`, `python`, `go`, or `cbindgen` directly when a make target exists."

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/apps/infra-local-usage.md` around lines 127 - 132, Replace the direct
`go build` workflow snippet that kills and rebuilds the runner with the
repo-standard make wrapper; update the block that currently shows `pkill -9 -f
boxlite-runner` and `cd apps/runner && go build -o /tmp/boxlite-runner
./cmd/runner && cd -` to use the documented make target (e.g., `make
stack-restart COMPONENTS=runner`) so builds and restarts go through the
repository's standardized wrappers and flags; ensure the surrounding text
references the status doc cheatsheet as before.
```

</details>

<!-- cr-comment:v1:1688ac1e148725377598f58f -->

_Source: Learnings_

</blockquote></details>
<details>
<summary>apps/infra-local/boxlite_local/config.py-10-15 (1)</summary><blockquote>

`10-15`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Validate port env vars with bounds (1-65535) at load time.**

Current parsing accepts numeric but invalid ports (`0`, negatives, `>65535`), so failures are deferred to runtime networking paths instead of failing fast at config boundary.

<details>
<summary>Proposed fix</summary>

```diff
-def _parse_int_env(name: str, default: str) -> int:
+def _parse_int_env(
+    name: str,
+    default: str,
+    *,
+    min_value: int | None = None,
+    max_value: int | None = None,
+) -> int:
     raw = os.environ.get(name, default)
     try:
-        return int(raw)
+        value = int(raw)
     except ValueError as e:
         raise ValueError(f"{name} must be an integer, got: {raw!r}") from e
+    if min_value is not None and value < min_value:
+        raise ValueError(f"{name} must be >= {min_value}, got: {value}")
+    if max_value is not None and value > max_value:
+        raise ValueError(f"{name} must be <= {max_value}, got: {value}")
+    return value
```

```diff
-            pg_host_port=_parse_int_env("BOXLITE_PG_HOST_PORT", "25432"),
+            pg_host_port=_parse_int_env("BOXLITE_PG_HOST_PORT", "25432", min_value=1, max_value=65535),
...
-            redis_host_port=_parse_int_env("BOXLITE_REDIS_HOST_PORT", "26379"),
+            redis_host_port=_parse_int_env("BOXLITE_REDIS_HOST_PORT", "26379", min_value=1, max_value=65535),
```

(Apply the same bounds to all `*_PORT` fields.)
</details>

Based on learnings: “Validate inputs at the boundary. Untrusted inputs should be checked where they enter” and “Use explicit error handling: fail fast on missing config/invalid inputs.”  
   


Also applies to: 80-99

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/boxlite_local/config.py` around lines 10 - 15, The
_parse_int_env function currently converts env values to int but doesn't
validate port ranges, allowing invalid ports (0, negative, >65535); update
_parse_int_env to check that the parsed integer is within 1..65535 and raise a
ValueError with a clear message like "{name} must be a valid port between 1 and
65535, got: {raw!r}" when out of range, and ensure every configuration entry
that uses _parse_int_env for any *_PORT setting (all occurrences of parsing port
envs) uses this tightened validation so invalid ports fail fast at load time.
```

</details>

<!-- cr-comment:v1:1ce598fc6d1ee05a46d81046 -->

_Source: Learnings_

</blockquote></details>
<details>
<summary>apps/infra-local/CONNECTIONS.md-40-42 (1)</summary><blockquote>

`40-42`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Add language identifiers to unlabeled fenced code blocks (MD040).**

These blocks should use explicit fence languages (e.g., `text`) to satisfy markdownlint.





Also applies to: 45-47, 81-83, 86-88, 138-140, 144-146, 189-191

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @apps/infra-local/CONNECTIONS.md around lines 40 - 42, Several fenced code
blocks in CONNECTIONS.md are unlabeled which triggers markdownlint MD040; update
each unlabeled triple-backtick fence (including the shown postgres URI block and
the other occurrences at the commented ranges) to include a language identifier
such as "text" (e.g., change totext) so the code blocks are explicitly
labeled; search for similar unlabeled fences in CONNECTIONS.md and add the
language identifier consistently.

</details>

<!-- cr-comment:v1:c44a6a8ecfcd36ecff6e5c03 -->

_Source: Linters/SAST tools_

</blockquote></details>
<details>
<summary>apps/infra-local/README.md-226-230 (1)</summary><blockquote>

`226-230`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Add fence languages to satisfy MD040 markdownlint warnings.**

The fenced blocks here should specify a language (e.g., `text`) to keep docs lint-clean.




<details>
<summary>Suggested patch</summary>

```diff
-     ```
+     ```text
      127.0.0.1 pgadmin.boxlite.test
      127.0.0.1 jaeger.boxlite.test
      # ... etc
      ```
@@
-```
+```text
 apps/infra-local/
 ├── Makefile                          # convenience wrappers (L1 + stack-* L2)
 ...
 └── tests/
 ...
-```
+```
```
</details>


Also applies to: 276-325

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @apps/infra-local/README.md around lines 226 - 230, The Markdown fenced code
blocks that show the hosts entries (the block containing "127.0.0.1
pgadmin.boxlite.test" / "127.0.0.1 jaeger.boxlite.test") and the directory tree
block starting with "apps/infra-local/" (and the other similar fenced blocks in
the same README section) must specify a fence language to satisfy MD040; update
each opening fence from totext so the hosts block and the
directory-tree/other blocks include the language identifier while leaving the
block contents unchanged.

</details>

<!-- cr-comment:v1:8d82a48e39c68ffaa7c88307 -->

_Source: Linters/SAST tools_

</blockquote></details>
<details>
<summary>apps/infra-local/CONNECTIONS.md-116-121 (1)</summary><blockquote>

`116-121`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Fix the `aws` example command syntax.**

`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` must prefix the command, not trail after `s3 ls`; the current snippet is not a valid invocation.




<details>
<summary>Suggested patch</summary>

```diff
-aws --endpoint-url http://127.0.0.1:29000 \
-    --region us-east-1 \
-    s3 ls \
-  AWS_ACCESS_KEY_ID=minioadmin AWS_SECRET_ACCESS_KEY=minioadmin
+AWS_ACCESS_KEY_ID=minioadmin AWS_SECRET_ACCESS_KEY=minioadmin \
+aws --endpoint-url http://127.0.0.1:29000 \
+    --region us-east-1 \
+    s3 ls
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/CONNECTIONS.md` around lines 116 - 121, The aws CLI example
is invalid because the environment variables are placed after the command; put
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY before the `aws --endpoint-url ...
s3 ls` invocation so they prefix the command (e.g. export or inline before `aws
--endpoint-url ... s3 ls`), ensuring the credentials are applied to the `aws`
call rather than trailing after `s3 ls`.
```

</details>

<!-- cr-comment:v1:e504f0fb613d6d0ef1972b84 -->

</blockquote></details>
<details>
<summary>apps/infra-local/scripts/build-all-in-one-sql.py-1027-1029 (1)</summary><blockquote>

`1027-1029`: _⚠️ Potential issue_ | _🟡 Minor_

**Narrow `except BaseException` to `except Exception` in `apps/infra-local/scripts/build-all-in-one-sql.py`**

This loop intentionally collects per-migration failures and continues, but the file has no other handling for `KeyboardInterrupt`/`SystemExit`, so catching `BaseException` can swallow normal abort semantics.

<details>
<summary>Suggested patch</summary>

```diff
-        except BaseException as exc:  # noqa: BLE001
+        except Exception as exc:
             failures.append((path, exc))
             continue
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/scripts/build-all-in-one-sql.py` around lines 1027 - 1029,
Replace the overly broad except BaseException in the migration loop with except
Exception so system-exiting signals aren't swallowed; specifically update the
except clause that currently does "except BaseException as exc:" (the block that
appends to the failures list using failures.append((path, exc)) and continues)
to "except Exception as exc:" to preserve KeyboardInterrupt/SystemExit behavior
while still collecting migration errors.
```

</details>

<!-- cr-comment:v1:8f9a13e2225d3558e1432c3b -->

_Source: Learnings_

</blockquote></details>
<details>
<summary>apps/infra-local/scripts/seed-init-data.sh-125-129 (1)</summary><blockquote>

`125-129`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Flag parsing is order-dependent and can ignore `--no-bounce`.**

`--no-bounce` is only honored when it is the first argument. Example: `seed-init-data.sh --no-wait --no-bounce` still bounces API.





<details>
<summary>Proposed fix</summary>

```diff
-if [ "${1:-}" = "--no-bounce" ]; then
-  log "skipping API bounce (--no-bounce); assuming API just woke + is running its boot cycle"
-else
-  bounce_api_if_running
-fi
+NO_BOUNCE=false
+NO_WAIT=false
+for arg in "$@"; do
+  case "$arg" in
+    --no-bounce) NO_BOUNCE=true ;;
+    --no-wait) NO_WAIT=true ;;
+    *) die "unknown argument: $arg" ;;
+  esac
+done
+
+if [ "$NO_BOUNCE" = "true" ]; then
+  log "skipping API bounce (--no-bounce); assuming API just woke + is running its boot cycle"
+else
+  bounce_api_if_running
+fi
@@
-if [ "${1:-}" = "--no-wait" ] || [ "${2:-}" = "--no-wait" ]; then
+if [ "$NO_WAIT" = "true" ]; then
```
</details>


Also applies to: 144-144

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/scripts/seed-init-data.sh` around lines 125 - 129, The
script currently checks only the first positional parameter for "--no-bounce",
so flags like "--no-wait --no-bounce" are ignored; update the check in
seed-init-data.sh to scan all args (e.g., loop over "$@" or use a case pattern)
and set a boolean if any argument equals "--no-bounce", then use that boolean to
decide whether to call bounce_api_if_running; apply the same change to the other
occurrence referenced (around the second check) so both places reliably honor
--no-bounce regardless of argument order.
```

</details>

<!-- cr-comment:v1:f99316165ca0615131728a6f -->

</blockquote></details>
<details>
<summary>apps/infra-local/scripts/_stack-common.sh-55-69 (1)</summary><blockquote>

`55-69`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Validate PID ownership before declaring a component “running”.**

Line 63 treats any live PID from the pidfile as valid. If the PID was recycled, `stack-up` can incorrectly skip startup for a component that is actually down. Please verify the PID belongs to the expected process (or pair liveness with the expected listening port) before returning it.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/scripts/_stack-common.sh` around lines 55 - 69,
component_pid currently trusts any live PID from pid_file as the component
owner; update it to validate ownership before returning the PID by (1) reading
the pid from pid_file (existing pid="$(cat "$pf")"), (2) checking
/proc/$pid/cmdline or /proc/$pid/exe (or lsof/ss on the expected listening port)
to confirm the process command or listening socket matches the expected
component identity, and only then echo the pid; if validation fails, remove the
stale pidfile (rm -f "$pf") and return empty. Use the same pid_file and
component_pid symbols so stack-up will skip only when a confirmed matching
process is running.
```

</details>

<!-- cr-comment:v1:c3a3e693dfa2b71cbcc731d7 -->

</blockquote></details>
<details>
<summary>apps/infra-local/scripts/stack-logs.sh-20-23 (1)</summary><blockquote>

`20-23`: _⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_

**Handle `all` mode when no log files exist.**

On Line 22, `tail -F "${LOGS_DIR}"/*.log` fails when there are no `*.log` files yet. Add a guard so `stack-logs.sh all` returns a clear message instead of an immediate error.

<details>
<summary>Proposed fix</summary>

```diff
 if [ "$1" = "all" ]; then
   # `tail -f` multiple files at once; each line gets ==> filename <== headers.
-  exec tail -F "${LOGS_DIR}"/*.log
+  compgen -G "${LOGS_DIR}/*.log" > /dev/null || die "no log files yet in ${LOGS_DIR}"
+  exec tail -F "${LOGS_DIR}"/*.log
 fi
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/scripts/stack-logs.sh` around lines 20 - 23, The "all"
branch in stack-logs.sh currently runs tail -F "${LOGS_DIR}"/*.log which fails
if no log files exist; update the if-block that handles "$1" = "all" to first
check whether any files match the pattern (e.g. test for the presence of
"${LOGS_DIR}"/*.log or use a glob check) and if none are found print a clear
message like "No log files found in $LOGS_DIR" and exit non‑error (or exit 0)
instead of invoking tail; keep using LOGS_DIR and the existing tail -F
"${LOGS_DIR}"/*.log when matches are present.
```

</details>

<!-- cr-comment:v1:d9245aab9f1ed445a331b136 -->

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>apps/package.json (1)</summary><blockquote>

`116-116`: _⚡ Quick win_

**Move `@types/node-forge` to `devDependencies`.**

This is a type-only package and should not ship in runtime dependencies.

<details>
<summary>♻️ Proposed fix</summary>

```diff
-    "`@types/node-forge`": "^1.3.14",
     "algoliasearch": "^5.30.0",
```

```diff
   "devDependencies": {
+    "`@types/node-forge`": "^1.3.14",
     "`@babel/preset-env`": "^7.22.0",
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/package.json` at line 116, The dependency "`@types/node-forge`" is a
type-only package and should be moved from dependencies to devDependencies in
package.json; open the file, remove the "`@types/node-forge`" entry from the
top-level "dependencies" object and add the same entry (with the same version
"^1.3.14") under "devDependencies", then run npm/yarn install (or update
lockfile) to ensure the lockfile reflects the change and that no runtime code
imports this types-only package.
```

</details>

<!-- cr-comment:v1:7f8b203f55849fba42213e45 -->

</blockquote></details>
<details>
<summary>apps/infra-local/tests/unit/test_doctor_lsof.py (1)</summary><blockquote>

`6-47`: _⚡ Quick win_

**Add focused unit tests for `check_port_free` subprocess branches.**

Please add monkeypatched tests for: `lsof` missing, non-zero + stderr, and timeout/error branch. These are the high-risk paths that gate `stack-up`.

   

Based on learnings: Add or update tests when behavior changes around branching, retries, security checks, or boundaries.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/tests/unit/test_doctor_lsof.py` around lines 6 - 47, Add
unit tests that monkeypatch subprocess.run for the check_port_free code paths in
boxlite_local.doctor: simulate (1) FileNotFoundError to test the "lsof missing"
branch, (2) a CompletedProcess with returncode != 0 and non-empty stderr to test
the non-zero+stderr branch, and (3) a subprocess.TimeoutExpired (or other
exception) to exercise the timeout/error branch; place these tests alongside the
existing _parse_lsof_F tests (e.g., in
apps/infra-local/tests/unit/test_doctor_lsof.py), use monkeypatch to replace
subprocess.run or the function that wraps it, and assert the expected return
values or error handling behavior of check_port_free (refer to the
check_port_free function and any helper that invokes subprocess.run).
```

</details>

<!-- cr-comment:v1:23093557339b5987261aed8d -->

_Source: Learnings_

</blockquote></details>
<details>
<summary>apps/infra-local/README.md (1)</summary><blockquote>

`348-349`: _⚡ Quick win_

**Use the Make target for status instead of direct Python invocation.**

Replace `python -m boxlite_local ps` with `make ps` to stay consistent with the project workflow contract.

Based on learnings: "Use make targets for build, test, lint, format, setup, and distribution. Do not run ... python directly when a make target exists."





<details>
<summary>Suggested patch</summary>

```diff
-**Debug a stuck service:** `make stack-status` first → identify the red
-component → use the lightest possible cleanup. `python -m boxlite_local ps`
+**Debug a stuck service:** `make stack-status` first → identify the red
+component → use the lightest possible cleanup. `make ps`
 shows L1 box state; `boxlite logs boxlite-local-<name>` shows guest
 logs; `make stack-logs COMPONENT=<name>` tails L2 logs from
 `apps/infra-local/.logs/`.
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/README.md` around lines 348 - 349, Replace the direct Python
invocation "python -m boxlite_local ps" with the Make target "make ps" wherever
it appears in documentation or examples (e.g., the README snippet referencing L1
box state); update the command examples and any surrounding text so they
instruct developers to run "make ps" for status, preserving existing notes about
"boxlite logs boxlite-local-<name>" and ensuring formatting/inline code
backticks match the rest of the doc.
```

</details>

<!-- cr-comment:v1:101a04bdc495abb15a195e22 -->

_Source: Learnings_

</blockquote></details>
<details>
<summary>apps/infra-local/Makefile (1)</summary><blockquote>

`89-91`: _⚡ Quick win_

**Use `$(PY)` in `stack-rebuild-l1-box` for interpreter consistency.**

Line 91 hardcodes `python`, bypassing the Makefile’s configured interpreter variable (`PY`).





<details>
<summary>Proposed fix</summary>

```diff
-	python -m boxlite_local up $(BOX)
+	$(PY) -m boxlite_local up $(BOX)
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/infra-local/Makefile` around lines 89 - 91, The rule for
stack-rebuild-l1-box hardcodes the interpreter by calling "python -m
boxlite_local up $(BOX)"; change it to use the Makefile's interpreter variable
by replacing that invocation with "$(PY) -m boxlite_local up $(BOX)" so the
target (stack-rebuild-l1-box) respects the configured PY value and interpreter
consistency across the Makefile.
```

</details>

<!-- cr-comment:v1:ab7e5bf33feef3ca68e3ae15 -->

</blockquote></details>

</blockquote></details>

<details>
<summary>🤖 Prompt for all review comments with AI agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @apps/api/src/sandbox/managers/sandbox.manager.ts:

• Line 259: The ORDER BY clauses are using an unquoted mixed-case identifier
  which PostgreSQL folds to lowercase; update the .orderBy calls that reference
  activity.lastActivityAt (e.g., the occurrence in sandbox_last_activity and the
  other .orderBy at the later query) to use a quoted identifier matching the WHERE
  clauses — change the argument from 'activity.lastActivityAt' to
  'activity."lastActivityAt"' in both places so it matches
  activity."lastActivityAt" used elsewhere.

In @apps/infra-local/boxlite_local/cli.py:

• Around line 30-35: The CLI currently lets p_up and p_down accept any service
  names and silently ignore typos; update the argument parsing to validate the
  "services" values against the canonical SERVICES list at parse-time and raise a
  parser error for any unknown names. Change the add_argument call for "services"
  (both p_up and p_down) to use a custom type or argparse Action that checks each
  value is in SERVICES (or use choices=SERVICES) so argparse fails fast; ensure
  the same validation logic is applied to the other parser(s) referenced around
  lines 75-79 so all entry points reject invalid service names immediately.

In @apps/infra-local/boxlite_local/doctor.py:

• Around line 121-126: The lsof call in check_port_free() can hang; add a
  timeout (e.g. timeout=5) to the subprocess.run(...) invocation and catch
  subprocess.TimeoutExpired around that call (the call in check_port_free used by
  doctor() and orchestrator.up()). On TimeoutExpired, log or surface a clear error
  via the same logger used by doctor() / orchestrator (or return False) so the
  preflight fails fast instead of blocking stack-up; ensure the handler preserves
  existing behavior for other non-zero results.

In @apps/infra-local/boxlite_local/execwrap.py:

• Around line 34-39: exec_collect currently awaits execution.wait() with no
  bound; add a timeout parameter to exec_collect (e.g., timeout: Optional[float] =
  None), pass it through to the SDK call that creates the execution (box.exec(...,
  timeout=timeout)) and also guard the final wait with
  asyncio.wait_for(execution.wait(), timeout) so the underlying process is killed
  on timeout (catch asyncio.TimeoutError, call execution.kill() or
  execution.terminate() and await execution.wait() to ensure cleanup, then
  re-raise or return a clear timeout result). Update callers such as
  _wait_one_shot_exit to pass an appropriate timeout (or None) when invoking
  exec_collect and keep _wait_healthy_exec behavior unchanged if it already wraps
  exec_collect in asyncio.wait_for.

In @apps/infra-local/boxlite_local/orchestrator.py:

• Around line 228-231: The try/except around runtime.get currently swallows all
  exceptions; change it to only treat a "box not found" case as idempotent and let
  other errors surface: catch the specific not-found exception type thrown by your
  runtime client (or inspect the exception for a not-found indicator) when calling
  runtime.get and return False only in that branch, but for any other exception
  re-raise (or log and raise) so transport/runtime failures aren’t masked; update
  the try/except that wraps runtime.get (in the down/remove flow) accordingly and
  ensure unexpected exceptions are not silently suppressed.

In @apps/infra-local/boxlite_local/services.py:

• Line 62: Replace floating Docker tags in services.py so images are pinned to
  immutable versions/digests: update "minio/minio:latest", "minio/mc:latest",
  "joxit/docker-registry-ui:main", and "otel/opentelemetry-collector:latest" to
  specific semver tags or sha256 digests (preferred). Locate these image strings
  in apps/infra-local/boxlite_local/services.py and change them to explicit
  versions (or image@sha256:...) and run your local stack-up to verify startup;
  ensure any README or docs referencing these images are updated accordingly.

In @apps/infra-local/scripts/seed-init-data.sh:

• Line 147: The script currently treats wait_for_default_snapshot failures as
  non-fatal by calling warn and continuing to print ok "init data ready"; change
  this so snapshot readiness failures cause the script to fail fast: replace the
  warn fallback for wait_for_default_snapshot with a non-zero exit (e.g., call die
  or exit 1) or otherwise return a failing status before the ok "init data ready"
  message so downstream automation receives a non-zero exit; locate the call to
  wait_for_default_snapshot and the later ok "init data ready" message and ensure
  the failure path prevents reaching that ok and returns an error.

In @apps/infra-local/scripts/stack-up.sh:

• Around line 74-76: The current use of ln -sf to create "${APPS_DIR}/.env" and
  "${APPS_DIR}/apps" will clobber existing non-symlink files; update the script to
  first test each target: if the path does not exist create the symlink with ln
  -s, if it exists and is a symlink leave it alone, and if it exists but is not a
  symlink print a clear error and exit non-zero so we don't overwrite developer
  files; apply this logic for the ".env" and "apps" targets (references: APPS_DIR,
  "${APPS_DIR}/.env", "${APPS_DIR}/apps", and the ln -s invocation).
• Around line 85-88: The current port cleanup blindly runs lsof/... | xargs kill
  -9 which can terminate unrelated processes; update the port cleanup in the
  blocks that call port_listening and warn to: prefer finding stack-owned PID(s)
  first (check a corresponding pidfile if one exists, or filter lsof/ps output by
  a known command pattern for this stack using pgrep -f or lsof -c), send SIGTERM
  to those PIDs, wait a short period (e.g. poll for port closure up to a few
  seconds), and only use SIGKILL (kill -9) as a fallback if the port is still
  held; replace direct lsof ... | xargs -r kill -9 with a safe function that
  accepts the port (used where port_listening is called) and implements
  pidfile/command validation, TERM then KILL fallback, and preserves the existing
  logging via warn.

In @apps/infra-local/sql/merged-schema.auto-gen.sql:

• Line 10: The merged schema enables "uuid-ossp" but never enables "pgcrypto",
  so calls to gen_random_uuid() (referenced in the diff as gen_random_uuid()) will
  fail on a fresh DB; update the schema generation step to emit CREATE EXTENSION
  IF NOT EXISTS "pgcrypto"; ensure this CREATE EXTENSION is placed before any use
  of gen_random_uuid() in the generated SQL (keep the existing CREATE EXTENSION IF
  NOT EXISTS "uuid-ossp" as well) and modify the generator/template that produces
  merged-schema.auto-gen.sql so future regenerations include the pgcrypto
  extension.

In @apps/infra-local/tests/integration/test_e2e_full.py:

• Around line 83-90: The fixture currently calls asyncio.run(setup()) outside
  the try, so if setup raises (including pytest.skip) the finally cleanup
  (asyncio.run(teardown()), mp.undo(), shutil.rmtree(tmp)) never runs; change the
  fixture to call setup() inside a try block and track whether setup completed
  (e.g., setup_done flag set to True after asyncio.run(setup()) returns) then in
  the finally always perform mp.undo() and shutil.rmtree(tmp, ignore_errors=True)
  and only call asyncio.run(teardown()) if setup_done (or ensure teardown is safe
  to call unconditionally); ensure pytest.skip exceptions are allowed to propagate
  but cleanup still runs.

In @apps/package.json:

• Around line 343-345: The package.json currently forces a mismatched typing by
  keeping "express" at ^5.2.0 while "resolutions" pins "@types/express" to
  ^4.17.25; update the resolutions (or remove it) so "@types/express" aligns with
  Express 5 (e.g., change the resolution to @types/express@^5.x or delete the
  override), then run install and TypeScript build to ensure no type conflicts in
  NestJS 11; locate the mismatch in the "resolutions" block and adjust or remove
  the "@types/express" entry accordingly.

---

Minor comments:
In @apps/infra-local/boxlite_local/config.py:

• Around line 10-15: The _parse_int_env function currently converts env values
  to int but doesn't validate port ranges, allowing invalid ports (0, negative,

65535); update _parse_int_env to check that the parsed integer is within
1..65535 and raise a ValueError with a clear message like "{name} must be a
valid port between 1 and 65535, got: {raw!r}" when out of range, and ensure
every configuration entry that uses _parse_int_env for any *_PORT setting (all
occurrences of parsing port envs) uses this tightened validation so invalid
ports fail fast at load time.

In @apps/infra-local/CONNECTIONS.md:

• Around line 40-42: Several fenced code blocks in CONNECTIONS.md are unlabeled
  which triggers markdownlint MD040; update each unlabeled triple-backtick fence
  (including the shown postgres URI block and the other occurrences at the
  commented ranges) to include a language identifier such as "text" (e.g., change
  totext) so the code blocks are explicitly labeled; search for similar
  unlabeled fences in CONNECTIONS.md and add the language identifier consistently.
• Around line 116-121: The aws CLI example is invalid because the environment
  variables are placed after the command; put AWS_ACCESS_KEY_ID and
  AWS_SECRET_ACCESS_KEY before the aws --endpoint-url ... s3 ls invocation so
  they prefix the command (e.g. export or inline before aws --endpoint-url ... s3 ls), ensuring the credentials are applied to the aws call rather than
  trailing after s3 ls.

In @apps/infra-local/README.md:

• Around line 226-230: The Markdown fenced code blocks that show the hosts
  entries (the block containing "127.0.0.1 pgadmin.boxlite.test" / "127.0.0.1
  jaeger.boxlite.test") and the directory tree block starting with
  "apps/infra-local/" (and the other similar fenced blocks in the same README
  section) must specify a fence language to satisfy MD040; update each opening
  fence from totext so the hosts block and the directory-tree/other blocks
  include the language identifier while leaving the block contents unchanged.

In @apps/infra-local/scripts/_stack-common.sh:

• Around line 55-69: component_pid currently trusts any live PID from pid_file
  as the component owner; update it to validate ownership before returning the PID
  by (1) reading the pid from pid_file (existing pid="$(cat "$pf")"), (2) checking
  /proc/$pid/cmdline or /proc/$pid/exe (or lsof/ss on the expected listening port)
  to confirm the process command or listening socket matches the expected
  component identity, and only then echo the pid; if validation fails, remove the
  stale pidfile (rm -f "$pf") and return empty. Use the same pid_file and
  component_pid symbols so stack-up will skip only when a confirmed matching
  process is running.

In @apps/infra-local/scripts/build-all-in-one-sql.py:

• Around line 1027-1029: Replace the overly broad except BaseException in the
  migration loop with except Exception so system-exiting signals aren't swallowed;
  specifically update the except clause that currently does "except BaseException
  as exc:" (the block that appends to the failures list using
  failures.append((path, exc)) and continues) to "except Exception as exc:" to
  preserve KeyboardInterrupt/SystemExit behavior while still collecting migration
  errors.

In @apps/infra-local/scripts/seed-init-data.sh:

• Around line 125-129: The script currently checks only the first positional
  parameter for "--no-bounce", so flags like "--no-wait --no-bounce" are ignored;
  update the check in seed-init-data.sh to scan all args (e.g., loop over "$@" or
  use a case pattern) and set a boolean if any argument equals "--no-bounce", then
  use that boolean to decide whether to call bounce_api_if_running; apply the same
  change to the other occurrence referenced (around the second check) so both
  places reliably honor --no-bounce regardless of argument order.

In @apps/infra-local/scripts/stack-logs.sh:

• Around line 20-23: The "all" branch in stack-logs.sh currently runs tail -F
  "${LOGS_DIR}"/.log which fails if no log files exist; update the if-block that
  handles "$1" = "all" to first check whether any files match the pattern (e.g.
  test for the presence of "${LOGS_DIR}"/.log or use a glob check) and if none
  are found print a clear message like "No log files found in $LOGS_DIR" and exit
  non‑error (or exit 0) instead of invoking tail; keep using LOGS_DIR and the
  existing tail -F "${LOGS_DIR}"/*.log when matches are present.

In @docs/apps/infra-local-usage.md:

• Around line 230-233: The fenced code block in Section 6.1 is missing a
  language identifier which triggers markdownlint MD040; update the backticks that
  start the block around the line containing "http://localhost:3000 → pick admin
  / user to log in (dex static users)" to include a language hint such as text
  (e.g., change totext) so the fenced block is properly annotated.
• Around line 16-31: The docs use two different component selector variables
  (COMPONENT= vs COMPONENTS=) which is inconsistent and error-prone; pick one
  name and update all examples to use it consistently (e.g., replace
  COMPONENT=api with COMPONENTS=api and ensure make stack-restart/make stack-logs/make stack-down examples and the explanatory sentence all
  reference the same COMPONENTS= variable, including the other occurrences noted
  around lines 215-217); also ensure the parenthetical "(empty = all)" matches the
  chosen variable name.
• Around line 127-132: Replace the direct go build workflow snippet that kills
  and rebuilds the runner with the repo-standard make wrapper; update the block
  that currently shows pkill -9 -f boxlite-runner and cd apps/runner && go build -o /tmp/boxlite-runner ./cmd/runner && cd - to use the documented make
  target (e.g., make stack-restart COMPONENTS=runner) so builds and restarts go
  through the repository's standardized wrappers and flags; ensure the surrounding
  text references the status doc cheatsheet as before.

---

Nitpick comments:
In @apps/infra-local/Makefile:

• Around line 89-91: The rule for stack-rebuild-l1-box hardcodes the interpreter
  by calling "python -m boxlite_local up $(BOX)"; change it to use the Makefile's
  interpreter variable by replacing that invocation with "$(PY) -m boxlite_local
  up $(BOX)" so the target (stack-rebuild-l1-box) respects the configured PY value
  and interpreter consistency across the Makefile.

In @apps/infra-local/README.md:

• Around line 348-349: Replace the direct Python invocation "python -m
  boxlite_local ps" with the Make target "make ps" wherever it appears in
  documentation or examples (e.g., the README snippet referencing L1 box state);
  update the command examples and any surrounding text so they instruct developers
  to run "make ps" for status, preserving existing notes about "boxlite logs
  boxlite-local-" and ensuring formatting/inline code backticks match the
  rest of the doc.

In @apps/infra-local/tests/unit/test_doctor_lsof.py:

• Around line 6-47: Add unit tests that monkeypatch subprocess.run for the
  check_port_free code paths in boxlite_local.doctor: simulate (1)
  FileNotFoundError to test the "lsof missing" branch, (2) a CompletedProcess with
  returncode != 0 and non-empty stderr to test the non-zero+stderr branch, and (3)
  a subprocess.TimeoutExpired (or other exception) to exercise the timeout/error
  branch; place these tests alongside the existing _parse_lsof_F tests (e.g., in
  apps/infra-local/tests/unit/test_doctor_lsof.py), use monkeypatch to replace
  subprocess.run or the function that wraps it, and assert the expected return
  values or error handling behavior of check_port_free (refer to the
  check_port_free function and any helper that invokes subprocess.run).

In @apps/package.json:

• Line 116: The dependency "@types/node-forge" is a type-only package and should
  be moved from dependencies to devDependencies in package.json; open the file,
  remove the "@types/node-forge" entry from the top-level "dependencies" object
  and add the same entry (with the same version "^1.3.14") under
  "devDependencies", then run npm/yarn install (or update lockfile) to ensure the
  lockfile reflects the change and that no runtime code imports this types-only
  package.

</details>

<details>
<summary>🪄 Autofix (Beta)</summary>

Fix all unresolved CodeRabbit comments on this PR:

- [ ] <!-- {"checkboxId": "4b0d0e0a-96d7-4f10-b296-3a18ea78f0b9"} --> Push a commit to this branch (recommended)
- [ ] <!-- {"checkboxId": "ff5b1114-7d8c-49e6-8ac1-43f82af23a33"} --> Create a new PR with the fixes

</details>

---

<details>
<summary>ℹ️ Review info</summary>

<details>
<summary>⚙️ Run configuration</summary>

**Configuration used**: defaults

**Review profile**: CHILL

**Plan**: Pro Plus

**Run ID**: `92dacb5e-5744-4885-be73-16a14db0f4fc`

</details>

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 6048e91e6c98afca85a5ca176cd2b1ffb174241d and 3424fb25eddedb742c6e9c0f07d50280d286896e.

</details>

<details>
<summary>📒 Files selected for processing (49)</summary>

* `.gitignore`
* `CLAUDE.md`
* `apps/api/src/app.module.ts`
* `apps/api/src/common/providers/openfeature-posthog.provider.ts`
* `apps/api/src/sandbox/managers/sandbox.manager.ts`
* `apps/api/tsconfig.json`
* `apps/dashboard/src/components/PostHogProviderWrapper.tsx`
* `apps/dashboard/src/mocks/handlers.ts`
* `apps/infra-local/CONNECTIONS.md`
* `apps/infra-local/Makefile`
* `apps/infra-local/README.md`
* `apps/infra-local/boxlite_local/__init__.py`
* `apps/infra-local/boxlite_local/__main__.py`
* `apps/infra-local/boxlite_local/cli.py`
* `apps/infra-local/boxlite_local/config.py`
* `apps/infra-local/boxlite_local/doctor.py`
* `apps/infra-local/boxlite_local/execwrap.py`
* `apps/infra-local/boxlite_local/orchestrator.py`
* `apps/infra-local/boxlite_local/services.py`
* `apps/infra-local/boxlite_local/types.py`
* `apps/infra-local/configs/minio/init.sh`
* `apps/infra-local/goal.md`
* `apps/infra-local/pyproject.toml`
* `apps/infra-local/scripts/_stack-common.sh`
* `apps/infra-local/scripts/apply-schema.sh`
* `apps/infra-local/scripts/build-all-in-one-sql.py`
* `apps/infra-local/scripts/seed-init-data.sh`
* `apps/infra-local/scripts/stack-build.sh`
* `apps/infra-local/scripts/stack-down.sh`
* `apps/infra-local/scripts/stack-logs.sh`
* `apps/infra-local/scripts/stack-reset.sh`
* `apps/infra-local/scripts/stack-restart.sh`
* `apps/infra-local/scripts/stack-status.sh`
* `apps/infra-local/scripts/stack-up.sh`
* `apps/infra-local/sql/merged-schema.auto-gen.sql`
* `apps/infra-local/tests/__init__.py`
* `apps/infra-local/tests/integration/__init__.py`
* `apps/infra-local/tests/integration/test_e2e_full.py`
* `apps/infra-local/tests/integration/test_multi_service.py`
* `apps/infra-local/tests/unit/__init__.py`
* `apps/infra-local/tests/unit/test_config.py`
* `apps/infra-local/tests/unit/test_doctor_lsof.py`
* `apps/infra-local/tests/unit/test_orchestrator.py`
* `apps/infra-local/tests/unit/test_topo.py`
* `apps/package.json`
* `apps/runner/pkg/boxlite/registry.go`
* `docs/apps/infra-local-usage.md`
* `libs`
* `tsconfig.base.json`

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->