@aiwg/cockpit 2026.7.21 → 2026.7.24

package/web/src/components/LaunchInstanceModal.test.tsx

@@ -18,10 +18,103 @@ const HOST_INSTANCE = {
 
 const LOADOUTS = [
   { id: 'host-tools', label: 'host-tools', description: 'Host tools', runtimes: ['host'] },
-  { id: 'full-suite', label: 'full-suite', description: 'All providers', runtimes: ['docker', 'container', 'qemu', 'vm'] },
+  {
+    id: 'full-suite',
+    label: 'full-suite',
+    description: 'All providers',
+    runtimes: ['docker', 'container', 'qemu', 'vm'],
+    compatibility: [{ runtime_kind: 'vm', provider: 'cloud-hypervisor', eligible: true }],
+  },
+  {
+    id: 'gpu-vfio',
+    label: 'GPU Workstation',
+    description: 'GPU-backed VM',
+    runtimes: ['qemu', 'vm'],
+    runtime_options: {
+      kind: 'vm',
+      provider: 'cloud-hypervisor',
+      required_capabilities: ['device.vfio'],
+      excluded_capabilities: ['instance.snapshot', 'instance.restore', 'instance.fork', 'warm_pool.manage'],
+      launch_strategy: { mode: 'cold' },
+      constraints: { allow_vfio_fast_start: false, fallback_mode: 'fail' },
+    },
+    compatibility: [{
+      runtime_kind: 'vm',
+      provider: 'cloud-hypervisor',
+      eligible: true,
+      required_capabilities: ['device.vfio'],
+      excluded_capabilities: ['instance.snapshot', 'instance.restore', 'instance.fork', 'warm_pool.manage'],
+      constraints: [{
+        capability: 'device.vfio',
+        excludes: ['instance.snapshot', 'instance.restore', 'instance.fork', 'warm_pool.manage'],
+        reason: 'VFIO-backed VMs cannot safely reuse memory state.',
+      }],
+    }],
+  },
+  {
+    id: 'active-host-gpu',
+    label: 'Active Host GPU',
+    description: 'Rejected GPU assignment',
+    runtimes: ['qemu', 'vm'],
+    runtime_options: {
+      kind: 'vm',
+      provider: 'cloud-hypervisor',
+      required_capabilities: ['device.vfio'],
+      launch_strategy: { mode: 'cold' },
+    },
+    compatibility: [{
+      runtime_kind: 'vm',
+      provider: 'cloud-hypervisor',
+      eligible: false,
+      required_capabilities: ['device.vfio'],
+      reason: 'GPU 0000:41:00.0 is active on the host',
+    }],
+  },
   { id: 'agentic-dev', label: 'agentic-dev', description: 'Developer tools', runtimes: ['docker', 'container'] },
 ];
 
+const VM_PROVIDER_CAPS = {
+  status: 'ok',
+  source: '/healthz/deep',
+  host_runtime_enabled: true,
+  runtime_providers: {
+    default_provider: 'cloud-hypervisor',
+    kinds: [{ kind: 'vm', label: 'VM', default_provider: 'cloud-hypervisor', providers: ['cloud-hypervisor'] }],
+    providers: [{
+      provider: 'cloud-hypervisor',
+      kind: 'vm',
+      label: 'Cloud Hypervisor',
+      default: true,
+      capabilities: [
+        { id: 'instance.snapshot', label: 'Snapshot' },
+        { id: 'instance.restore', label: 'Restore' },
+        { id: 'instance.fork', label: 'Fork' },
+        { id: 'warm_pool.manage', label: 'Warm pools' },
+        { id: 'device.vfio', label: 'VFIO device passthrough' },
+      ],
+      capability_constraints: [{
+        capability: 'device.vfio',
+        excludes: ['instance.snapshot', 'instance.restore', 'instance.fork', 'warm_pool.manage'],
+        reason: 'VFIO-backed VMs cannot safely reuse memory state.',
+      }],
+    }],
+  },
+};
+
+const VM_PROVIDER_CAPS_NO_GPU = {
+  ...VM_PROVIDER_CAPS,
+  runtime_providers: {
+    ...VM_PROVIDER_CAPS.runtime_providers,
+    providers: [{
+      provider: 'cloud-hypervisor',
+      kind: 'vm',
+      label: 'Cloud Hypervisor',
+      default: true,
+      capabilities: [{ id: 'instance.restore', label: 'Restore' }],
+    }],
+  },
+};
+
 function mockFetch({
   instances = [HOST_INSTANCE],
   executorCaps = null,
@@ -143,4 +236,61 @@ describe('LaunchInstanceModal', () => {
       ssh_key: '~/.ssh/agentic_ed25519.pub',
     });
   });
+
+  it('shows GPU unavailable when provider discovery does not advertise VFIO', async () => {
+    globalThis.fetch = mockFetch({ executorCaps: VM_PROVIDER_CAPS_NO_GPU });
+    render(<LaunchInstanceModal open onClose={() => {}} onLaunched={() => {}} />);
+
+    fireEvent.change(await screen.findByLabelText('Runtime'), { target: { value: 'qemu' } });
+
+    expect(await screen.findByText('GPU passthrough unavailable')).toBeTruthy();
+    expect((screen.getByRole('checkbox', { name: /request gpu passthrough/i }) as HTMLInputElement).disabled).toBe(true);
+  });
+
+  it('rejects a GPU loadout when compatibility reports the host device is active', async () => {
+    globalThis.fetch = mockFetch({ executorCaps: VM_PROVIDER_CAPS });
+    render(<LaunchInstanceModal open onClose={() => {}} onLaunched={() => {}} />);
+
+    fireEvent.change(await screen.findByLabelText('Runtime'), { target: { value: 'qemu' } });
+    fireEvent.change(await screen.findByLabelText('Instance loadout'), { target: { value: 'active-host-gpu' } });
+
+    expect(await screen.findByText('GPU 0000:41:00.0 is active on the host')).toBeTruthy();
+    expect((screen.getByRole('button', { name: /create \+ start session/i }) as HTMLButtonElement).disabled).toBe(true);
+  });
+
+  it('sends cold VFIO runtime_options for an eligible GPU loadout', async () => {
+    globalThis.fetch = mockFetch({ executorCaps: VM_PROVIDER_CAPS, createdInstanceId: 'vm-gpu-1' });
+    const onLaunched = vi.fn();
+    render(<LaunchInstanceModal open onClose={() => {}} onLaunched={onLaunched} />);
+
+    fireEvent.change(await screen.findByLabelText('Runtime'), { target: { value: 'qemu' } });
+    fireEvent.change(await screen.findByLabelText('Instance loadout'), { target: { value: 'gpu-vfio' } });
+    fireEvent.click(screen.getByRole('button', { name: /create \+ start session/i }));
+
+    await waitFor(() => expect(onLaunched).toHaveBeenCalledWith('vm-gpu-1', true, undefined));
+    const postCall = (globalThis.fetch as unknown as ReturnType<typeof vi.fn>).mock.calls
+      .find((call) => String(call[0]).includes('/api/instances') && call[1]?.method === 'POST');
+    expect(JSON.parse(String(postCall?.[1]?.body))).toMatchObject({
+      runtime: 'qemu',
+      provider: 'cloud-hypervisor',
+      runtime_options: {
+        kind: 'vm',
+        provider: 'cloud-hypervisor',
+        required_capabilities: ['device.vfio'],
+        excluded_capabilities: ['instance.snapshot', 'instance.restore', 'instance.fork', 'warm_pool.manage'],
+        launch_strategy: { mode: 'cold' },
+        constraints: { allow_vfio_fast_start: false, fallback_mode: 'fail' },
+      },
+    });
+  });
+
+  it('surfaces VFIO fast-start incompatibility before launch', async () => {
+    globalThis.fetch = mockFetch({ executorCaps: VM_PROVIDER_CAPS });
+    render(<LaunchInstanceModal open onClose={() => {}} onLaunched={() => {}} />);
+
+    fireEvent.change(await screen.findByLabelText('Runtime'), { target: { value: 'qemu' } });
+    fireEvent.change(await screen.findByLabelText('Instance loadout'), { target: { value: 'gpu-vfio' } });
+
+    expect(await screen.findByText(/Disabled: instance.snapshot, instance.restore, instance.fork, warm_pool.manage/i)).toBeTruthy();
+  });
 });

package/web/src/components/LaunchInstanceModal.tsx

@@ -1,7 +1,16 @@
 import { useEffect, useState } from 'react';
 import { api } from '../api';
 import { fmtId } from '../util';
-import type { ExecutorCapabilities, Instance, Loadout } from '../types';
+import type {
+  ExecutorCapabilities,
+  Instance,
+  Loadout,
+  ResolvedLoadoutCompatibility,
+  RuntimeOptions,
+  RuntimeProviderDescriptor,
+  SandboxRuntimeCapabilityId,
+  SandboxRuntimeProvider,
+} from '../types';
 
 type Runtime = 'host' | 'docker' | 'qemu';
 
@@ -31,6 +40,13 @@ const FALLBACK_LOADOUTS: Loadout[] = [
 const genInstanceName = () =>
   `cockpit-${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`.slice(0, 32);
 
+const FAST_START_CAPABILITIES: SandboxRuntimeCapabilityId[] = [
+  'instance.snapshot',
+  'instance.restore',
+  'instance.fork',
+  'warm_pool.manage',
+];
+
 export function LaunchInstanceModal({
   open,
   onClose,
@@ -47,6 +63,8 @@ export function LaunchInstanceModal({
   const [instances, setInstances] = useState<Instance[]>([]);
   const [hostId, setHostId] = useState('');
   const [executorCaps, setExecutorCaps] = useState<ExecutorCapabilities | null>(null);
+  const [vmProvider, setVmProvider] = useState('');
+  const [requestGpu, setRequestGpu] = useState(false);
   const [image, setImage] = useState('agentic/codex:latest');
   const [customImage, setCustomImage] = useState('');
   const [profile, setProfile] = useState('');
@@ -79,8 +97,27 @@ export function LaunchInstanceModal({
     return () => { cancelled = true; };
   }, [open]);
 
+  useEffect(() => {
+    if (!open || runtime !== 'qemu') return;
+    const currentLoadout = loadoutOptions(loadouts, runtime).find((item) => item.id === loadout);
+    const providers = vmProviderOptions(executorCaps, currentLoadout);
+    if (providers.length && !providers.some((provider) => provider.provider === vmProvider)) {
+      setVmProvider(providers[0].provider);
+    }
+  }, [executorCaps, loadout, loadouts, open, runtime, vmProvider]);
+
   if (!open) return null;
 
+  const visibleLoadouts = loadoutOptions(loadouts, runtime);
+  const selectedLoadout = visibleLoadouts.find((item) => item.id === loadout);
+  const providerChoices = vmProviderOptions(executorCaps, selectedLoadout);
+  const selectedVmProvider = runtime === 'qemu'
+    ? (vmProvider || providerChoices[0]?.provider || '')
+    : '';
+  const selectedProviderDescriptor = providerChoices.find((provider) => provider.provider === selectedVmProvider);
+  const selectedCompatibility = selectedVmProvider ? vmCompatibility(selectedLoadout, selectedVmProvider) : undefined;
+  const gpu = gpuLaunchPosture(selectedLoadout, selectedCompatibility, selectedProviderDescriptor, selectedVmProvider, requestGpu);
+
   const chooseRuntime = (next: Runtime) => {
     setRuntime(next);
     if (next === 'host') {
@@ -90,6 +127,7 @@ export function LaunchInstanceModal({
       setImage((current) => current || 'agentic/codex:latest');
     } else {
       setLoadout('profiles/basic.yaml');
+      setRequestGpu(false);
     }
   };
 
@@ -143,6 +181,9 @@ export function LaunchInstanceModal({
       }
       if (runtime === 'qemu') {
         body.agentshare = true;
+        if (selectedVmProvider) body.provider = selectedVmProvider;
+        const runtimeOptions = runtimeOptionsForLaunch(selectedVmProvider, gpu);
+        if (runtimeOptions) body.runtime_options = runtimeOptions;
         if (sshKey.trim()) body.ssh_key = sshKey.trim();
       }
       if (runtime === 'docker' && mounts.trim()) body.mounts = mounts.split('\n').map((m) => m.trim()).filter(Boolean);
@@ -206,9 +247,44 @@ export function LaunchInstanceModal({
             <span className="ro">host-tools</span>
           ) : (
             <select id="li-loadout" value={loadout} onChange={(e) => setLoadout(e.target.value)}>
-              {loadoutOptions(loadouts, runtime).map((l) => <option key={l.id} value={l.id}>{l.label}{l.description ? ` - ${l.description}` : ''}</option>)}
+              {visibleLoadouts.map((l) => <option key={l.id} value={l.id}>{l.label}{l.description ? ` - ${l.description}` : ''}</option>)}
             </select>
           )}
+          {runtime === 'qemu' && (
+            <>
+              <label htmlFor="li-vm-provider">VM provider</label>
+              <select
+                id="li-vm-provider"
+                value={selectedVmProvider}
+                onChange={(e) => setVmProvider(e.target.value)}
+                disabled={!providerChoices.length}
+              >
+                {!providerChoices.length && <option value="">Provider discovery unavailable</option>}
+                {providerChoices.map((provider) => (
+                  <option key={provider.provider} value={provider.provider}>
+                    {provider.label ?? provider.provider}{provider.default ? ' (default)' : ''}
+                  </option>
+                ))}
+              </select>
+              <label htmlFor="li-gpu-vfio">GPU / VFIO</label>
+              <div className="field-stack">
+                <label className="check-row">
+                  <input
+                    id="li-gpu-vfio"
+                    type="checkbox"
+                    checked={gpu.required || requestGpu}
+                    disabled={gpu.required || !gpu.selectable}
+                    onChange={(e) => setRequestGpu(e.target.checked)}
+                  />
+                  Request GPU passthrough
+                </label>
+                <div className={`posture-line ${gpu.blocked ? 'warn' : gpu.effective ? 'ok-text' : ''}`}>
+                  {gpu.message}
+                </div>
+                {gpu.fastStartReason && <div className="cell-note">{gpu.fastStartReason}</div>}
+              </div>
+            </>
+          )}
           {runtime !== 'host' && (
             <>
               <label htmlFor="li-profile">Profile</label>
@@ -255,7 +331,7 @@ export function LaunchInstanceModal({
         </div>
         <div className="modal-actions">
           <button onClick={onClose} disabled={busy}>Close</button>
-          <button className="cta" onClick={launch} disabled={busy || (runtime === 'host' && !hostId && !executorCaps?.host_runtime_enabled) || (runtime === 'host' && !hostId && !name.trim()) || (runtime !== 'host' && !name.trim()) || (runtime === 'docker' && image === '__custom__' && !customImage.trim())}>
+          <button className="cta" onClick={launch} disabled={busy || (runtime === 'host' && !hostId && !executorCaps?.host_runtime_enabled) || (runtime === 'host' && !hostId && !name.trim()) || (runtime !== 'host' && !name.trim()) || (runtime === 'docker' && image === '__custom__' && !customImage.trim()) || (runtime === 'qemu' && gpu.effective && gpu.blocked)}>
             {busy ? 'Working...' : runtime === 'host' ? (openSession ? 'Start host session' : 'Use host') : openSession ? 'Create + start session' : 'Create instance'}
           </button>
         </div>
@@ -264,6 +340,120 @@ export function LaunchInstanceModal({
   );
 }
 
+function providerCapabilities(provider?: RuntimeProviderDescriptor) {
+  return new Set((provider?.capabilities ?? []).map((capability) => capability.id));
+}
+
+function requiredCapabilities(loadout?: Loadout, compatibility?: ResolvedLoadoutCompatibility) {
+  return new Set([
+    ...(loadout?.runtime_options?.required_capabilities ?? []),
+    ...(compatibility?.required_capabilities ?? []),
+  ]);
+}
+
+function excludedCapabilities(loadout?: Loadout, compatibility?: ResolvedLoadoutCompatibility) {
+  return new Set([
+    ...(loadout?.runtime_options?.excluded_capabilities ?? []),
+    ...(compatibility?.excluded_capabilities ?? []),
+  ]);
+}
+
+function vmProviderOptions(caps: ExecutorCapabilities | null, loadout?: Loadout): RuntimeProviderDescriptor[] {
+  const discovered = caps?.runtime_providers?.providers?.filter((provider) => provider.kind === 'vm') ?? [];
+  const compatible = new Set((loadout?.compatibility ?? [])
+    .filter((entry) => ['vm', 'qemu'].includes(String(entry.runtime_kind).toLowerCase()))
+    .map((entry) => entry.provider));
+  const filtered = compatible.size
+    ? discovered.filter((provider) => compatible.has(provider.provider))
+    : discovered;
+  if (filtered.length) return filtered;
+  return [...compatible].map((provider) => ({
+    provider,
+    kind: 'vm',
+    capabilities: [],
+  }));
+}
+
+function vmCompatibility(loadout: Loadout | undefined, provider: SandboxRuntimeProvider): ResolvedLoadoutCompatibility | undefined {
+  return loadout?.compatibility?.find((entry) =>
+    entry.provider === provider && ['vm', 'qemu'].includes(String(entry.runtime_kind).toLowerCase()));
+}
+
+function gpuLaunchPosture(
+  loadout: Loadout | undefined,
+  compatibility: ResolvedLoadoutCompatibility | undefined,
+  provider: RuntimeProviderDescriptor | undefined,
+  providerId: string,
+  requested: boolean,
+) {
+  const required = requiredCapabilities(loadout, compatibility).has('device.vfio');
+  const excluded = excludedCapabilities(loadout, compatibility);
+  const effective = required || requested;
+  const providerSupportsGpu = providerCapabilities(provider).has('device.vfio');
+  const fastStartExclusions = [...excluded].filter((capability) => FAST_START_CAPABILITIES.includes(capability));
+  const constraintReason = [
+    ...(compatibility?.constraints ?? []),
+    ...(provider?.capability_constraints ?? []),
+  ].find((constraint) => constraint.capability === 'device.vfio')?.reason;
+  let blocked = false;
+  let message = 'No GPU requested';
+
+  if (!providerId) {
+    blocked = effective;
+    message = 'Provider discovery unavailable';
+  } else if (compatibility && !compatibility.eligible) {
+    blocked = effective || required;
+    message = compatibility.reason ?? 'Loadout is not eligible for this provider';
+  } else if (!compatibility && effective) {
+    blocked = true;
+    message = 'Loadout compatibility does not advertise VFIO';
+  } else if (!providerSupportsGpu && effective) {
+    blocked = true;
+    message = 'Selected provider does not advertise VFIO';
+  } else if (!providerSupportsGpu) {
+    message = 'GPU passthrough unavailable';
+  } else if (!compatibility) {
+    message = 'GPU passthrough requires loadout compatibility';
+  } else if (excluded.has('device.vfio') && effective) {
+    blocked = true;
+    message = 'Selected loadout excludes GPU passthrough';
+  } else if (required) {
+    message = blocked ? message : 'GPU passthrough required by loadout';
+  } else if (requested) {
+    message = blocked ? message : 'GPU passthrough requested';
+  } else if (providerSupportsGpu && !excluded.has('device.vfio')) {
+    message = 'GPU passthrough available';
+  } else if (excluded.has('device.vfio')) {
+    message = 'GPU passthrough unavailable for this loadout';
+  }
+
+  return {
+    required,
+    effective,
+    blocked,
+    selectable: Boolean(providerId && providerSupportsGpu && compatibility && !excluded.has('device.vfio') && compatibility.eligible !== false),
+    message,
+    fastStartReason: effective && fastStartExclusions.length
+      ? `${constraintReason ?? 'VFIO-backed VMs cannot safely reuse memory state'} Disabled: ${fastStartExclusions.join(', ')}.`
+      : constraintReason,
+  };
+}
+
+function runtimeOptionsForLaunch(provider: string, gpu: ReturnType<typeof gpuLaunchPosture>): RuntimeOptions | undefined {
+  if (!provider && !gpu.effective) return undefined;
+  const options: RuntimeOptions = {
+    kind: 'vm',
+    launch_strategy: { mode: 'cold' },
+  };
+  if (provider) options.provider = provider as SandboxRuntimeProvider;
+  if (gpu.effective) {
+    options.required_capabilities = ['device.vfio'];
+    options.excluded_capabilities = FAST_START_CAPABILITIES;
+    options.constraints = { allow_vfio_fast_start: false, fallback_mode: 'fail' };
+  }
+  return options;
+}
+
 function loadoutOptions(loadouts: Loadout[], runtime: Runtime) {
   if (runtime === 'host') return FALLBACK_LOADOUTS.filter((l) => l.id === 'host-tools');
   const aliases = runtime === 'docker' ? ['docker', 'container'] : runtime === 'qemu' ? ['qemu', 'vm'] : [runtime];

package/web/src/components/Telemetry.tsx

@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useState } from 'react';
 import { api } from '../api';
 import { fmtId } from '../util';
-import type { Cost, EventsSnapshot, MissionsResponse } from '../types';
+import type { Cost, EventsSnapshot, McpDiscovery, MissionsResponse } from '../types';
 
 type Filter = 'all' | 'mission' | 'task' | 'approval' | 'session' | 'inventory';
 
@@ -9,6 +9,7 @@ export function Telemetry({ refreshTick = 0 }: { refreshTick?: number }) {
   const [events, setEvents] = useState<EventsSnapshot | null>(null);
   const [missions, setMissions] = useState<MissionsResponse | null>(null);
   const [cost, setCost] = useState<Cost | null>(null);
+  const [mcp, setMcp] = useState<McpDiscovery | null>(null);
   const [filter, setFilter] = useState<Filter>('all');
   const [err, setErr] = useState('');
 
@@ -17,10 +18,12 @@ export function Telemetry({ refreshTick = 0 }: { refreshTick?: number }) {
       api<EventsSnapshot>('/api/events/snapshot'),
       api<MissionsResponse>('/api/missions').catch(() => null),
       api<Cost>('/api/cost').catch(() => null),
-    ]).then(([eventData, missionData, costData]) => {
+      api<McpDiscovery>('/api/mcp/discovery').catch(() => null),
+    ]).then(([eventData, missionData, costData, mcpData]) => {
       setEvents(eventData);
       setMissions(missionData);
       setCost(costData);
+      setMcp(mcpData);
       setErr('');
     }).catch((e) => setErr((e as Error).message));
   }, []);
@@ -45,8 +48,20 @@ export function Telemetry({ refreshTick = 0 }: { refreshTick?: number }) {
         <article><span>Active Missions</span><strong>{missionTotals.active}</strong><small>{missionTotals.terminal} terminal</small></article>
         <article><span>Approvals</span><strong>{missionTotals.awaiting}</strong><small>awaiting operator input</small></article>
         <article><span>Spend</span><strong>{cost ? `$${cost.total.usd.toFixed(2)}` : '-'}</strong><small>{tokenTotal ? `${tokenTotal.toLocaleString()} tokens` : 'cost route unavailable'}</small></article>
+        <article><span>MCP</span><strong>{mcp?.status ?? '-'}</strong><small>{mcp ? `${mcp.tools.length} tools · ${mcp.auth.scopes.length} scopes` : 'discovery unavailable'}</small></article>
       </section>
 
+      {mcp && (
+        <section className="audit-tail" aria-label="MCP management posture">
+          <h3>MCP Management</h3>
+          <p><strong>{mcp.endpoint.path}</strong> · {mcp.endpoint.transport} · {mcp.endpoint.stateless ? 'stateless' : 'stateful'} · session id {mcp.endpoint.mcp_session_id ? 'expected' : 'not expected'}</p>
+          <p>{mcp.auth.principals.length} principal(s): {mcp.auth.principals.map((principal) => principal.client_id).join(', ') || '-'}</p>
+          <p>Tools: {mcp.tools.map((tool) => tool.name).join(', ') || '-'}</p>
+          <p>Resources: {[...mcp.resources.map((resource) => resource.uri), ...mcp.resource_templates.map((template) => template.uriTemplate)].join(', ') || '-'}</p>
+          {mcp.reason_code && <p>{mcp.reason_code}</p>}
+        </section>
+      )}
+
       <div className="controls" role="group" aria-label="Filter telemetry events">
         {(['all', 'mission', 'task', 'approval', 'session', 'inventory'] as const).map((f) => (
           <button key={f} aria-pressed={filter === f} onClick={() => setFilter(f)}>{f}</button>