@aiwg/cockpit 2026.6.11 → 2026.6.12

package/README.md

@@ -382,11 +382,14 @@ Known state as of the 2026-06-19 host live run:
   roctinam/agentic-sandbox#499 for upstream regression tracking, but it was not
   reproduced by this isolated host proof.
 - Docker/container secure bootstrap is fixed from the agentic-sandbox side in
-  `v2026.6.24`; roctinam/agentic-sandbox#497 is closed. AIWG still needs to
-  rerun this matrix against that release and record Cockpit-side evidence.
-- VM bootstrap/readiness is fixed from the agentic-sandbox side in
-  `v2026.6.24`; roctinam/agentic-sandbox#498 is closed. AIWG still needs to
-  rerun this matrix against that release and record Cockpit-side evidence.
+  `v2026.6.24`; roctinam/agentic-sandbox#497 is closed. Re-validated Cockpit-side
+  against `v2026.6.34`: container matrix PASS.
+- VM bootstrap/readiness is fixed from the agentic-sandbox side via the vsock
+  transport line (`v2026.6.31`–`v2026.6.34`); roctinam/agentic-sandbox#498 and
+  the #561 transport regression are closed. Re-validated Cockpit-side against
+  `v2026.6.34`: VM matrix PASS — provision → vsock enroll → boot-ready → provider
+  workload → clean destroy. Evidence:
+  `.aiwg/testing/cockpit-vm-vsock-2026-06-27.md/.json`.
 - Remaining upstream follow-ups are Claude auth-state propagation
   (roctinam/agentic-sandbox#499) and agent-scoped PTY sessions not appearing in
   the formal/global session registry (roctinam/agentic-sandbox#500).

package/bridge/src/public/index.html

@@ -139,7 +139,14 @@
 
     // shared: POST/DELETE a control-plane call, then re-run a loader
     async function control(path, method, reload) {
-      try { await api(path, { method }); } catch (e) { alert(e.message); }
+      try {
+        const res = await api(path, { method });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok) throw new Error(`${path} → ${res.status}`);
+        if (body.already_gone) {
+          meta.textContent = body.message || 'Instance already removed; inventory refreshed.';
+        }
+      } catch (e) { alert(e.message); }
       if (reload) reload();
     }
 

package/bridge/src/server.mjs

@@ -369,7 +369,22 @@ async function destroyInstance(upstreamUrl, instanceId) {
       }
       return result;
     }
-  } catch {
+  } catch (err) {
+    const message = String(err?.message ?? err);
+    if (inst && / -> 404(?:;|$)/.test(message)) {
+      return {
+        target: `${upstreamUrl}/api/v2/admin/instances/${encodeURIComponent(instanceId)}/destroy`,
+        status: 200,
+        body: {
+          id: instanceId,
+          destroyed: instanceId,
+          state: 'destroyed',
+          result: { state: 'destroyed' },
+          already_gone: true,
+          message: `Instance ${instanceId} was already removed; inventory refreshed.`,
+        },
+      };
+    }
     // Current sandbox builds can list Docker rows in admin-v2 inventory while
     // lifecycle verbs return instance.not_found. Fall through to a dev cleanup.
   }
@@ -457,7 +472,7 @@ function normalizeRuntimePosture(kind) {
     label: 'Container / shared kernel',
     warning: 'Container isolation shares the host kernel.',
   };
-  if (runtime === 'vm') return { kind: runtime, isolation: 'strong', label: 'VM / hardware boundary' };
+  if (runtime === 'vm' || runtime === 'qemu' || runtime === 'kvm') return { kind: 'vm', isolation: 'strong', label: 'VM / hardware boundary' };
   if (runtime === 'unknown') return { kind: runtime, isolation: 'unknown', label: 'Unknown runtime', warning: 'Runtime metadata was not reported by the sandbox.' };
   return {
     kind: runtime,
@@ -510,7 +525,7 @@ function normalizeSessionBackends(backends, runtimeKind, state = 'unknown', agen
   if (!list.length && runtimeKind === 'host') {
     return [{ mode: 'managed', backend: 'tmux', observe: true, drive: true, replay: false, keyframe: false, available: true, reason: 'agentic-sandbox v1 host session API default' }];
   }
-  if (!list.length && ['docker', 'container', 'vm'].includes(runtimeKind) && String(state).toLowerCase() === 'running') {
+  if (!list.length && ['docker', 'container', 'vm', 'qemu', 'kvm'].includes(runtimeKind) && String(state).toLowerCase() === 'running') {
     return [{
       mode: 'managed',
       backend: 'tmux',
@@ -1166,7 +1181,6 @@ export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = A
               session_class: mode || 'managed',
               command: 'bash',
               args: ['-l'],
-              working_dir: '/root',
             }),
           },
           {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cockpit",
-  "version": "2026.6.11",
+  "version": "2026.6.12",
   "description": "AIWG Cockpit — UX-first control plane over AIWG + multi-stack agentic sessions. Opt-in, separately published; NOT shipped in the base aiwg npm package (guarded by test/smoke/cockpit-base-footprint.test.js).",
   "type": "module",
   "license": "MIT",
@@ -39,6 +39,7 @@
   "scripts": {
     "start:bridge": "node bridge/src/server.mjs",
     "dev": "bash scripts/cockpit-dev.sh",
+    "up": "bash scripts/cockpit-up.sh",
     "build:web": "npm --prefix web install --no-audit --no-fund && npm --prefix web run build",
     "pack:dry": "npm pack --dry-run",
     "publish:dry": "npm publish --dry-run --access public",

package/web/src/App.test.tsx

@@ -195,6 +195,30 @@ describe('App shell (rendered DOM)', () => {
     expect(screen.getByText('Destination')).toBeTruthy();
   });
 
+  it('treats stale destroy 404 responses as already removed in Inventory (#1660)', async () => {
+    vi.spyOn(window, 'confirm').mockReturnValue(true);
+    const inventory = { instances: [instance('ghost-vm-1', 'vm', 'QEMU Codex')], count: 1, fetched_at: new Date().toISOString() };
+    globalThis.fetch = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      if (url.includes('/api/health')) return jsonResponse({ executor_url: 'http://127.0.0.1:8122' });
+      if (url.includes('/api/inventory')) return jsonResponse(inventory);
+      if (url.includes('/api/running')) return jsonResponse({ count: 0, running: [] });
+      if (url.includes('/api/approvals')) return jsonResponse({ approvals: [] });
+      if (url.includes('/api/cost')) return jsonResponse({ total: { input_tokens: 0, output_tokens: 0, usd: 0 }, per_instance: [] });
+      if (url.includes('/api/instances/ghost-vm-1') && init?.method === 'DELETE') {
+        return jsonResponse({ destroyed: 'ghost-vm-1', already_gone: true, message: 'Instance ghost-vm-1 was already removed; inventory refreshed.' });
+      }
+      return jsonResponse({});
+    }) as typeof fetch;
+
+    render(<App />);
+    fireEvent.click(screen.getByRole('tab', { name: 'Inventory' }));
+    fireEvent.click(await screen.findByRole('button', { name: /destroy instance ghost-vm-1/i }));
+
+    expect((await screen.findByRole('status')).textContent).toMatch(/already removed; inventory refreshed/i);
+    expect(screen.queryByText(/action failed/i)).toBeNull();
+  });
+
   it('each tab has a matching labelled tabpanel (controls/labelledby pairing)', () => {
     render(<App />);
     for (const tab of screen.getAllByRole('tab')) {

package/web/src/components/Inventory.tsx

@@ -9,6 +9,7 @@ export function Inventory({ onStartSession, onLaunchInstance }: { onStartSession
   const [data, setData] = useState<Inv | null>(null);
   const [err, setErr] = useState('');
   const [actionErr, setActionErr] = useState('');
+  const [actionMsg, setActionMsg] = useState('');
 
   const load = useCallback(() => {
     api<Inv>('/api/inventory').then((d) => { setData(d); setErr(''); }).catch((e) => setErr((e as Error).message));
@@ -16,7 +17,16 @@ export function Inventory({ onStartSession, onLaunchInstance }: { onStartSession
   useEffect(() => { load(); }, [load]);
 
   const control = (path: string, method: string) =>
-    api(path, { method }).then(() => { setActionErr(''); load(); }).catch((e) => setActionErr((e as Error).message));
+    api<{ already_gone?: boolean; message?: string }>(path, { method })
+      .then((result) => {
+        setActionErr('');
+        setActionMsg(result.already_gone ? (result.message ?? 'Instance already removed; inventory refreshed.') : '');
+        load();
+      })
+      .catch((e) => {
+        setActionMsg('');
+        setActionErr((e as Error).message);
+      });
 
   if (err) return <p className="err">Could not load inventory: {err}</p>;
   if (!data) return <p className="empty">Loading…</p>;
@@ -40,6 +50,7 @@ export function Inventory({ onStartSession, onLaunchInstance }: { onStartSession
         {onLaunchInstance && <button className="cta" onClick={onLaunchInstance}>＋ New instance + session</button>}
       </div>
       {actionErr && <p className="err">Action failed: {actionErr}</p>}
+      {actionMsg && <p className="hint" role="status">{actionMsg}</p>}
       <table>
         <caption>Available instance deployments</caption>
         <thead>