@linzumi/cli 1.0.6 → 1.0.8

package/scripts/vm-provision-proof.mjs

@@ -0,0 +1,151 @@
+// PROOF that a smolvm guest can really install the coding toolchain.
+//
+// Unlike vm-smoke.mjs (which stubs the model proxy over HTTP loopback), this
+// boots a REAL microVM with network:true and runs the ACTUAL
+// guestProvisionCommand from the #2111 branch - i.e. `apk add --no-cache
+// ca-certificates nodejs npm git ripgrep bash curl` fetched over real egress
+// from the Alpine package mirrors, then `npm install -g @openai/codex` - and
+// then execs `--version` for each tool inside the guest and verifies the CA
+// bundle the TLS fix installs. If any tool is missing or the CA bundle is
+// empty, it exits non-zero.
+//
+// RUN (from packages/linzumi-cli, requires HVF + the smolvm runtime installed):
+//   node scripts/vm-provision-proof.mjs
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const here = new URL('.', import.meta.url).pathname;
+const pkgRoot = join(here, '..');
+
+// vmGuestProvision.ts is self-contained (no relative imports), so Node's native
+// type-stripping can import it directly - this is the REAL provision command
+// from the #2111 branch, not a copy.
+const { guestProvisionCommand, guestProvisionCheckCommand, guestCaBundlePath } =
+  await import(join(pkgRoot, 'src', 'vmSandbox', 'vmGuestProvision.ts'));
+
+// Inline of vmCodexSupervisor.loadSmolmachines (avoids pulling in that module's
+// extensionless relative imports, which Node's stripper won't resolve).
+async function loadSmolmachines(runtimeDir) {
+  const { createRequire } = await import('node:module');
+  const requireFromRuntime = createRequire(join(runtimeDir, 'package.json'));
+  return requireFromRuntime('smolmachines');
+}
+
+const runtimeDir =
+  process.env.LINZUMI_VM_RUNTIME_DIR ||
+  join(homedir(), '.linzumi', 'vm-runtime');
+const CODEX_VERSION = process.env.LINZUMI_VM_CODEX_VERSION || '0.139.0';
+
+function log(...a) {
+  console.log('[provision-proof]', ...a);
+}
+
+async function run(machine, label, cmd, timeout = 240) {
+  const r = await machine.exec(cmd, { timeout });
+  const out = (r.stdout || '').trim();
+  const err = (r.stderr || '').trim();
+  log(
+    `${label}: exit=${r.exitCode}` +
+      (out ? `  stdout=${JSON.stringify(out.slice(0, 200))}` : '') +
+      (err && r.exitCode !== 0
+        ? `  stderr=${JSON.stringify(err.slice(0, 200))}`
+        : '')
+  );
+  return r;
+}
+
+const t0 = Date.now();
+log(`loading smolvm runtime from ${runtimeDir} ...`);
+const sdk = await loadSmolmachines(runtimeDir);
+
+const name = `linzumi-provision-proof-${process.pid}`;
+log(`creating microVM "${name}" (network:true, full egress) ...`);
+const machine = await sdk.Machine.create({
+  name,
+  mounts: [],
+  resources: { cpus: 2, memoryMb: 2048, network: true },
+  persistent: false,
+});
+log(`VM booted in ${Date.now() - t0}ms`);
+
+let failures = [];
+try {
+  // Sanity: the guest has outbound network at all.
+  await run(machine, 'guest uname', ['/bin/sh', '-c', 'uname -a']);
+
+  // THE REAL THING: run the exact provision command #2111 ships.
+  log('running REAL guestProvisionCommand (apk add + npm i -g codex) ...');
+  const prov = await run(
+    machine,
+    'provision',
+    guestProvisionCommand(CODEX_VERSION),
+    600
+  );
+  if (prov.exitCode !== 0) failures.push('provision command failed');
+
+  // Prove each tool is actually installed and runnable in the guest.
+  const tools = [
+    ['node', ['/bin/sh', '-c', 'node --version']],
+    ['npm', ['/bin/sh', '-c', 'npm --version']],
+    ['git', ['/bin/sh', '-c', 'git --version']],
+    ['ripgrep (rg)', ['/bin/sh', '-c', 'rg --version | head -1']],
+    ['bash', ['/bin/sh', '-c', 'bash --version | head -1']],
+    ['curl', ['/bin/sh', '-c', 'curl --version | head -1']],
+    [
+      'codex',
+      [
+        '/bin/sh',
+        '-c',
+        'command -v codex && codex --version 2>/dev/null | head -1',
+      ],
+    ],
+  ];
+  for (const [label, cmd] of tools) {
+    const r = await run(machine, `verify ${label}`, cmd, 60);
+    if (r.exitCode !== 0) failures.push(`${label} not runnable`);
+  }
+
+  // Prove the CA bundle (the TLS "No response" fix) is materialized + non-empty.
+  const ca = await run(machine, 'verify CA bundle', [
+    '/bin/sh',
+    '-c',
+    `test -s ${guestCaBundlePath} && wc -c <${guestCaBundlePath}`,
+  ]);
+  if (ca.exitCode !== 0) failures.push('CA bundle missing/empty');
+
+  // Prove the provision-check predicate the supervisor gates on passes.
+  const check = await run(
+    machine,
+    'provisionCheckCommand',
+    guestProvisionCheckCommand(CODEX_VERSION)
+  );
+  if (check.exitCode !== 0) failures.push('provisionCheckCommand failed');
+
+  // Bonus: real outbound TLS from inside the guest (DNS + CA chain end-to-end).
+  await run(machine, 'guest TLS egress (https HEAD)', [
+    '/bin/sh',
+    '-c',
+    'curl -sS -o /dev/null -w "%{http_code}" https://registry.npmjs.org/ || echo CURL_FAILED',
+  ]);
+} finally {
+  log('tearing down VM ...');
+  try {
+    await machine.stop();
+  } catch (e) {
+    log('stop error (non-fatal):', String(e).slice(0, 120));
+  }
+  if (typeof machine.delete === 'function') {
+    try {
+      await machine.delete();
+    } catch (e) {
+      log('delete error (non-fatal):', String(e).slice(0, 120));
+    }
+  }
+}
+
+if (failures.length > 0) {
+  console.error('[provision-proof] FAILED:', failures.join('; '));
+  process.exit(1);
+}
+log(`DONE-OK - full toolchain installed + verified in ${Date.now() - t0}ms`);
+process.exit(0);

package/scripts/vm-smoke.mjs

@@ -0,0 +1,241 @@
+// Local-VM smoke: boot a real microVM via startVmCodexAppServer, drive a codex
+// `initialize` JSON-RPC round-trip through the reverse tunnel, prove the in-VM
+// codex's MODEL traffic actually reaches the Linzumi LLM proxy (a host-side stub
+// proxy in BOTH egress modes), then tear down and confirm `vm gc` reclaims the
+// machine.
+//
+// RUN (from packages/linzumi-cli, smolvm runtime installed via `linzumi vm setup`):
+//
+//   node scripts/vm-smoke.mjs
+//
+// Exit code is non-zero if the in-VM codex could NOT reach the model proxy, so
+// this doubles as a manual red/green check for the VM model-proxy routing path.
+//
+// WHY the model-proxy leg exists: the codex `initialize` round-trip rides the
+// host<->guest REVERSE TUNNEL (vmTunnel) and works regardless of how model
+// traffic is routed. The MODEL call is different: the in-guest codex dials the
+// model_provider.base_url itself. Under smolvm TSI, a guest dial to 127.0.0.1
+// lands on the HOST loopback, so a host-side stub at 127.0.0.1:<port> is the
+// faithful stand-in for the real (public) LLM proxy - and needs NO model creds.
+// This leg ASSERTS the stub received the in-guest model request, in OPEN and in
+// HARDENED egress mode, locking that proxy reachability is independent of the
+// egress allowlist (the V-invariant's live counterpart).
+//
+// BLIND SPOT this smoke does NOT cover (the #2111 RCA): the stub is PLAIN HTTP on
+// 127.0.0.1, so this leg proves the guest reaches the proxy IP+port but does NOT
+// exercise (a) TLS to a PUBLIC HTTPS host - which needs the guest CA bundle
+// (ca-certificates, added to guestProvisionCommand) - or (b) DNS resolution of a
+// public hostname - which needs a guest /etc/resolv.conf nameserver
+// (guestEnsureDnsCommand, run by the supervisor before codex starts). A guest
+// passing THIS smoke could still "No response" against the REAL proxy if either
+// were missing. To confirm those on an HVF Mac, run a REAL VM job against the
+// deployed preview and read the supervisor's GUEST-DIAGNOSTICS block (now dumped
+// to the runner log on a failed/closed turn) for any DNS/TLS error.
+//
+// TWO model-access paths, both mirroring RAW mode (the VM must support each):
+//   1. WAFER: route through the Linzumi LLM proxy. The model_provider.base_url +
+//      LINZUMI_LLM_PROXY_TOKEN are forwarded into the guest; this leg exercises
+//      exactly that dial (the stub stands in for the proxy).
+//   2. USER AUTH (native codex/Claude login): the in-guest codex must read the
+//      user's OWN ~/.codex/auth.json (ChatGPT OAuth tokens / OPENAI_API_KEY),
+//      forwarded into the guest tmpfs at $CODEX_HOME/auth.json (0600, scrubbed on
+//      teardown). buildVmSupervisorConfig.hostCodexAuthJson forwards it; the
+//      deterministic counterpart is vmModelProxyRouting.property.test's
+//      "user-auth path" invariant (auth.json forwarded in both egress modes).
+import { createServer } from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgRoot = dirname(here);
+const cliEntry = join(pkgRoot, 'dist', 'index.js');
+
+// A host-side stub LLM proxy. The in-guest codex (TSI 127.0.0.1 -> host
+// loopback) dials this for any model request. It records that it was hit and
+// answers a minimal OpenAI-`responses`-shaped SSE so codex does not hard-error
+// before we have observed the hit. We only care that the request ARRIVED - that
+// is the proof the in-VM model route reached the proxy.
+function startStubProxy() {
+  const state = { hit: false, lastPath: undefined };
+  const server = createServer((req, res) => {
+    state.hit = true;
+    state.lastPath = req.url;
+    // Drain the body, then return a tiny SSE stream that completes immediately.
+    req.on('data', () => undefined);
+    req.on('end', () => {
+      res.writeHead(200, {
+        'content-type': 'text/event-stream',
+        'cache-control': 'no-cache',
+      });
+      res.write('event: response.completed\n');
+      res.write(
+        'data: {"type":"response.completed","response":{"id":"stub","output":[]}}\n\n'
+      );
+      res.end();
+    });
+  });
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      resolve({
+        port,
+        wasHit: () => state.hit,
+        lastPath: () => state.lastPath,
+        close: () => server.close(),
+      });
+    });
+  });
+}
+
+// The model-provider config codex needs to dial the stub: a custom provider
+// whose base_url is the host stub (reached from the guest via TSI loopback).
+function stubModelProvider(stubPort) {
+  return {
+    id: 'linzumi',
+    name: 'Linzumi Proxy (smoke stub)',
+    baseUrl: `http://127.0.0.1:${stubPort}/v1`,
+    envKey: 'LINZUMI_LLM_PROXY_TOKEN',
+    wireApi: 'responses',
+  };
+}
+
+// Boot a VM in the given egress mode, drive a model turn, and report whether the
+// host stub proxy was hit by the in-guest codex's model request.
+async function probeModelProxyReachable({
+  startVmCodexAppServer,
+  connectCodexAppServer,
+  egressMode,
+}) {
+  const stub = await startStubProxy();
+  let started;
+  try {
+    // Hardened mode's fail-closed placeholder gate refuses to boot without a
+    // real allowlist override. Supply one that includes the host loopback (where
+    // the stub lives via TSI), so the hardened leg actually boots and we can
+    // assert proxy reachability is independent of the egress allowlist.
+    const env =
+      egressMode === 'hardened'
+        ? { ...process.env, LINZUMI_VM_EGRESS_CIDRS: '127.0.0.0/8,10.0.0.0/8' }
+        : process.env;
+    started = await startVmCodexAppServer({
+      cwd: pkgRoot,
+      kandanThreadId: undefined,
+      appServerOptions: {
+        mcpServers: [],
+        modelProvider: stubModelProvider(stub.port),
+      },
+      // A non-empty token so the guest env file carries LINZUMI_LLM_PROXY_TOKEN
+      // (the bearer codex sends to the proxy) - the stub does not validate it.
+      llmProxyToken: 'smoke-stub-token',
+      egressMode,
+      env,
+      supervisorScriptPath: cliEntry,
+    });
+
+    const client = await connectCodexAppServer(started.url);
+    // Drive a turn so codex makes a model request to base_url. The exact RPC
+    // shape varies by codex version; any turn-start triggers the model dial. We
+    // do not care about the codex-side result - only that the stub was hit.
+    try {
+      await client.request('thread/start', {});
+    } catch (_e) {
+      // Some codex versions name the turn RPC differently; the model dial may
+      // still have fired. Fall through to the stub-hit assertion either way.
+    }
+    // Give the in-guest model request a moment to land on the host stub.
+    await new Promise((r) => setTimeout(r, 3000));
+    client.close();
+    return { hit: stub.wasHit(), path: stub.lastPath() };
+  } finally {
+    if (started !== undefined) {
+      started.stop();
+    }
+    stub.close();
+    await new Promise((r) => setTimeout(r, 2000));
+  }
+}
+
+async function main() {
+  const { startVmCodexAppServer } = await import(
+    join(pkgRoot, 'src', 'vmSandbox', 'startVmCodexAppServer.ts')
+  );
+  const { connectCodexAppServer } = await import(
+    join(pkgRoot, 'src', 'codexAppServer.ts')
+  );
+
+  const t0 = Date.now();
+  console.log('[smoke] booting VM via startVmCodexAppServer...');
+  const started = await startVmCodexAppServer({
+    cwd: pkgRoot,
+    kandanThreadId: undefined,
+    appServerOptions: { mcpServers: [] },
+    llmProxyToken: undefined,
+    supervisorScriptPath: cliEntry,
+  });
+  console.log(
+    `[smoke] supervisor ready in ${Date.now() - t0}ms; url=${started.url} machine=${started.machineName}`
+  );
+
+  console.log(
+    '[smoke] connecting codex app-server client (does initialize)...'
+  );
+  const client = await connectCodexAppServer(started.url);
+  console.log('[smoke] initialize round-trip OK');
+
+  try {
+    const resp = await client.request('thread/list');
+    console.log(
+      '[smoke] thread/list responded:',
+      JSON.stringify(resp).slice(0, 200)
+    );
+  } catch (e) {
+    console.log(
+      '[smoke] thread/list errored (acceptable):',
+      String(e).slice(0, 200)
+    );
+  }
+
+  client.close();
+  console.log('[smoke] stopping initialize-leg supervisor...');
+  started.stop();
+  await new Promise((r) => setTimeout(r, 4000));
+
+  // MODEL-PROXY REACHABILITY LEG (open + hardened). The in-VM codex must reach
+  // the LLM proxy in BOTH egress modes - proxy reachability is independent of
+  // the egress allowlist. A "No response" turn looks exactly like the stub NOT
+  // being hit, so this is the faithful local repro for that class of failure.
+  let allReachable = true;
+  for (const egressMode of ['open', 'hardened']) {
+    console.log(`[smoke] model-proxy leg: booting VM in ${egressMode} mode...`);
+    const result = await probeModelProxyReachable({
+      startVmCodexAppServer,
+      connectCodexAppServer,
+      egressMode,
+    });
+    const verdict = result.hit ? 'yes' : 'no';
+    console.log(
+      `[smoke] MODEL-PROXY REACHABLE (${egressMode}): ${verdict}` +
+        (result.hit ? ` (path=${result.path})` : '')
+    );
+    allReachable = allReachable && result.hit;
+  }
+
+  if (!allReachable) {
+    console.error(
+      '[smoke] FAILED: the in-VM codex could NOT reach the model proxy in one ' +
+        'or more egress modes - this is the "No response" class of failure ' +
+        '(the model call never reached the Linzumi LLM proxy).'
+    );
+    process.exit(1);
+  }
+
+  console.log('[smoke] DONE-OK (model proxy reachable in open + hardened)');
+}
+
+main().then(
+  () => process.exit(0),
+  (err) => {
+    console.error('[smoke] FAILED:', err);
+    process.exit(1);
+  }
+);