@rallycry/conveyor-k3 0.1.10 → 0.1.12

package/dist/vm-qemu.js

@@ -7,9 +7,127 @@ import { dirname, join as join5 } from "path";
 import { fileURLToPath } from "url";
 import { createHash } from "crypto";
 
+// src/vm/capacity.ts
+var GIB = 1024 ** 3;
+var MIB = 1024 ** 2;
+var CONTROL_RELAY_SLOTS = 6;
+var CAPACITY_BOUNDS = {
+  relaySlots: { min: 16, max: 192, flag: "relay-slots" },
+  relayMaxGiB: { min: 1, max: 16, flag: "relay-max-gib" },
+  diskMiBps: { min: 25, max: 2e3, flag: "disk-mbps" },
+  diskIops: { min: 500, max: 5e4, flag: "disk-iops" }
+};
+var LEGACY_CAPACITY_LIMITS = Object.freeze({
+  schema: 1,
+  profile: "default",
+  relaySlots: 16,
+  reservedRelaySlots: 0,
+  relayMaxBytes: GIB,
+  diskBytesPerSecond: 100 * MIB,
+  diskIops: 2e3
+});
+var KEYS = Object.keys(CAPACITY_BOUNDS);
+var PROFILES = /* @__PURE__ */ new Set(["default", "server", "custom"]);
+function parseCapacityLimits(value) {
+  if (value === void 0) return { ...LEGACY_CAPACITY_LIMITS };
+  const limits = typeof value === "object" && value !== null ? value : {};
+  const within = (key, min, max) => Number.isSafeInteger(limits[key]) && limits[key] >= min && limits[key] <= max;
+  const bounds = CAPACITY_BOUNDS;
+  if (limits.schema !== 1 || !PROFILES.has(limits.profile) || !within("relaySlots", bounds.relaySlots.min, bounds.relaySlots.max) || limits.reservedRelaySlots !== 0 && limits.reservedRelaySlots !== CONTROL_RELAY_SLOTS || !within("relayMaxBytes", bounds.relayMaxGiB.min * GIB, bounds.relayMaxGiB.max * GIB) || !within("diskBytesPerSecond", bounds.diskMiBps.min * MIB, bounds.diskMiBps.max * MIB) || !within("diskIops", bounds.diskIops.min, bounds.diskIops.max))
+    throw new Error("The VM capacity limits in the host network policy are invalid.");
+  return {
+    schema: 1,
+    profile: limits.profile,
+    relaySlots: limits.relaySlots,
+    reservedRelaySlots: limits.reservedRelaySlots,
+    relayMaxBytes: limits.relayMaxBytes,
+    diskBytesPerSecond: limits.diskBytesPerSecond,
+    diskIops: limits.diskIops
+  };
+}
+function guardProcessLimit(relaySlots) {
+  return 48 + relaySlots;
+}
+
+// src/vm/instance-name.ts
+var VM_NAME = "conveyor";
+var DEFAULT_INSTANCE = "default";
+var NAMED_INSTANCE = /^(?=.{1,12}$)[a-z](?:-?[a-z0-9])*$/;
+function isNamedInstance(value) {
+  return typeof value === "string" && NAMED_INSTANCE.test(value) && value !== DEFAULT_INSTANCE && value !== VM_NAME;
+}
+function vmNameFor(instance) {
+  return instance === DEFAULT_INSTANCE ? VM_NAME : instance;
+}
+function stateInstance(value) {
+  if (value === void 0) return DEFAULT_INSTANCE;
+  if (!isNamedInstance(value)) throw new Error("Invalid VM instance in host state");
+  return value;
+}
+
 // src/vm/network.ts
 import { networkInterfaces } from "os";
 import { resolve4 as systemResolve4, resolveSrv as systemResolveSrv } from "dns/promises";
+
+// src/vm/endpoints.ts
+var DEFAULT_ENDPOINTS = [
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "registry.npmjs.org",
+  // Font Awesome Pro tarballs through Conveyor's Artifact Registry cache.
+  "us-central1-npm.pkg.dev",
+  // Tiptap Pro packages, which every claudespace bake installs.
+  "registry.tiptap.dev",
+  // The Python venv a pod builds at runtime.
+  "pypi.org",
+  "files.pythonhosted.org",
+  "bun.sh",
+  "get.k3s.io",
+  "update.k3s.io",
+  "github.com",
+  "api.github.com",
+  "raw.githubusercontent.com",
+  "release-assets.githubusercontent.com",
+  "objects.githubusercontent.com",
+  "ghcr.io",
+  "pkg-containers.githubusercontent.com",
+  // The crane image that shadow bakes' state-bake and publish Jobs run. gcr.io
+  // serves its blobs from the same host (/artifacts-downloads), on Google's
+  // shared frontend addresses like us-central1-npm.pkg.dev.
+  "gcr.io",
+  // The first shadow bake on a VM builds the toolchain base inside it; base
+  // reuse never crosses machines. These are the hosts that build downloads
+  // from. Several sit on shared CDN addresses.
+  // Plain HTTP too: the first apt-get runs before ca-certificates exists.
+  "deb.debian.org",
+  "www.postgresql.org",
+  "apt.postgresql.org",
+  "cli.github.com",
+  "johnvansickle.com",
+  "astral.sh",
+  // uv downloads CPython from here.
+  "releases.astral.sh",
+  "opencode.ai",
+  "cdn.playwright.dev",
+  "playwright.download.prss.microsoft.com",
+  "registry-1.docker.io",
+  "auth.docker.io",
+  "production.cloudflare.docker.com",
+  "production.cloudfront.docker.com",
+  "api.cloudflare.com",
+  "conveyor.rallycryapp.com",
+  "conveyor-api.rallycryapp.com",
+  "api.conveyor.rallycryapp.com",
+  "api.anthropic.com",
+  "api.openai.com",
+  "chatgpt.com"
+].map((host) => ({
+  host,
+  ports: host.endsWith(".ubuntu.com") || host === "deb.debian.org" ? [80, 443] : [443]
+}));
+
+// src/vm/network.ts
 var WORKER_SUBNET = "192.168.5.0/24";
 var WORKER_IP = "192.168.5.15";
 var MAX_NETWORK_FORWARDS = 100;
@@ -50,6 +168,159 @@ function isGloballyRoutableIPv4(address) {
   ].some(([base, mask]) => inCidr(value, parseIPv4(base), mask));
 }
 
+// src/vm/public-web.ts
+import { resolve4 } from "dns/promises";
+import { networkInterfaces as networkInterfaces2 } from "os";
+var PUBLIC_WEB_IP = "192.168.5.250";
+var PUBLIC_WEB_PORT = 3128;
+var PUBLIC_WEB_URL = `http://${PUBLIC_WEB_IP}:${PUBLIC_WEB_PORT}`;
+async function publicWebAddress(host, lookup = resolve4, interfaces = networkInterfaces2) {
+  if (!/^[a-z0-9.-]+$/i.test(host) || host.length > 253)
+    throw new Error("Invalid public destination");
+  const own = new Set(
+    Object.values(interfaces()).flatMap((items) => items?.map((i) => i.address) ?? [])
+  );
+  const answers = /^\d+\.\d+\.\d+\.\d+$/.test(host) ? [host] : await lookup(host);
+  if (!answers.length || answers.some((ip) => !isGloballyRoutableIPv4(ip) || own.has(ip)))
+    throw new Error("Host, LAN and reserved destinations are blocked");
+  const address = answers[0];
+  if (!address) throw new Error("No public DNS answer");
+  return address;
+}
+function publicWebRequest(header) {
+  const lines = header.split("\r\n");
+  const match = /^(CONNECT|GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS) ([^\s]+) HTTP\/1\.[01]$/.exec(
+    lines.shift() ?? ""
+  );
+  if (!match) throw new Error("Unsupported proxy request");
+  const connect = match[1] === "CONNECT";
+  const target = match[2] ?? "";
+  if (connect && !/^[a-z0-9.-]+:(80|443)$/i.test(target))
+    throw new Error("Invalid CONNECT destination");
+  const { url, port } = proxyUrl(target, connect);
+  for (const line of lines.filter(Boolean)) {
+    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+:[\t\x20-\x7e]*$/.test(line))
+      throw new Error("Invalid proxy header");
+  }
+  const headers = lines.filter(
+    (line) => line && !/^(host|connection|proxy-connection|proxy-authorization):/i.test(line)
+  );
+  return {
+    host: url.hostname,
+    port,
+    connect,
+    forward: connect ? "" : `${match[1]} ${url.pathname}${url.search} HTTP/1.1\r
+Host: ${url.host}\r
+Connection: close\r
+${headers.length ? headers.join("\r\n") + "\r\n" : ""}\r
+`
+  };
+}
+function readPublicWebRequest(input) {
+  return new Promise((resolve, reject) => {
+    let data = Buffer.alloc(0);
+    const cleanup = () => {
+      clearTimeout(timer);
+      input.pause();
+      input.removeListener("data", receive);
+      input.removeListener("end", closed);
+      input.removeListener("error", failed);
+    };
+    const failed = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const closed = () => failed(new Error("Incomplete proxy request"));
+    const timer = setTimeout(() => failed(new Error("Proxy handshake timed out")), 1e4);
+    const receive = (chunk) => {
+      data = Buffer.concat([data, chunk]);
+      const end = data.indexOf("\r\n\r\n");
+      if (end < 0 && data.length > 16384 || end > 16384)
+        return failed(new Error("Proxy header too large"));
+      if (end < 0) return;
+      cleanup();
+      try {
+        const request = publicWebRequest(data.subarray(0, end).toString("latin1"));
+        const remaining = Buffer.concat([Buffer.from(request.forward), data.subarray(end + 4)]);
+        if (remaining.length) input.unshift(remaining);
+        resolve(request);
+      } catch (error) {
+        reject(error);
+      }
+    };
+    input.on("data", receive);
+    input.once("end", closed);
+    input.once("error", failed);
+  });
+}
+function proxyUrl(target, connect) {
+  const url = new URL(connect ? `https://${target}` : target);
+  if (url.username || url.password || url.hash || !connect && url.protocol !== "http:")
+    throw new Error("Invalid proxy URL");
+  const port = Number(url.port || (connect ? 443 : 80));
+  if (port !== 80 && port !== 443) throw new Error("Only public web ports 80 and 443 are allowed");
+  return { url, port };
+}
+
+// src/vm/qemu-forwards.ts
+var ENDPOINT_IP = /^192\.168\.5\.(?:1\d\d)$/;
+var CONTROL_ALIAS_IP = /^192\.168\.5\.24[0-7]$/;
+var PINNED_IPV4 = /^(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])(?:\.(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])){3}$/;
+function assertPort(port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error("Invalid guest forwarding port");
+}
+function validateForwards(forwards) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const forward of forwards) {
+    assertPort(forward.port);
+    const key = `${forward.guestIp}:${forward.port}`;
+    if (seen.has(key)) throw new Error("Duplicate QEMU guest forwarding rule");
+    seen.add(key);
+    if (!isGloballyRoutableIPv4(forward.address) || !PINNED_IPV4.test(forward.address))
+      throw new Error("Invalid pinned forwarding address");
+  }
+}
+function forwardsOf(entries, guestIps, control) {
+  return entries.flatMap((host) => {
+    if (!guestIps.test(host.guestIp) || control && host.reserve !== "control")
+      throw new Error("Invalid pinned forwarding address");
+    return host.ports.map((port) => ({
+      guestIp: host.guestIp,
+      address: host.address,
+      port,
+      ...host.reserve === "control" ? { reserve: "control" } : {}
+    }));
+  });
+}
+function qemuForwards(network) {
+  const forwards = [
+    ...forwardsOf(network.hosts, ENDPOINT_IP, false),
+    ...forwardsOf(network.control ?? [], CONTROL_ALIAS_IP, true)
+  ];
+  if (forwards.length > MAX_NETWORK_FORWARDS) throw new Error("Too many QEMU forwarding rules");
+  validateForwards(forwards);
+  return forwards;
+}
+function restrictedUsernet(network, forwards, ncPath) {
+  const guestForwards = forwards.map(
+    (forward) => `guestfwd=tcp:${forward.guestIp}:${forward.port}-cmd:${ncPath} -4 -n -w 60 ${forward.address} ${forward.port}${forward.reserve === "control" ? " control" : ""}`
+  );
+  return [
+    "user",
+    "id=net0",
+    `net=${WORKER_SUBNET}`,
+    `dhcpstart=${WORKER_IP}`,
+    "restrict=on",
+    "ipv6=off",
+    `hostfwd=tcp:127.0.0.1:${network.sshPort}-:22`,
+    ...guestForwards,
+    ...network.publicWeb === true ? [
+      `guestfwd=tcp:${PUBLIC_WEB_IP}:${PUBLIC_WEB_PORT}-cmd:${ncPath} -4 -n -w 60 public-web ${PUBLIC_WEB_PORT}`
+    ] : []
+  ].join(",");
+}
+
 // src/vm/qemu-policy.ts
 var ALLOWED_PROBES = new Set(
   [
@@ -103,9 +374,7 @@ var REQUIRED_CONTROLS = [
   "drive:cidata"
 ];
 var DISALLOWED_CONTROLS = /* @__PURE__ */ new Set(["-sandbox", "-no-user-config", "-nodefaults"]);
-var BOOT_DISK_BPS = "104857600";
-var BOOT_DISK_IOPS = "2000";
-function assertPort(port, field) {
+function assertPort2(port, field) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`Invalid ${field}`);
 }
 function isProbe(args) {
@@ -226,10 +495,11 @@ function validateDrive(value, context) {
     }
     assertFields(fields, { file: /.+/, if: "none", discard: "on", id: "boot-disk" }, "boot drive");
     assertInstancePath(path, "disk", context);
-    return {
-      kind: "boot",
-      value: `${value},bps=${BOOT_DISK_BPS},iops=${BOOT_DISK_IOPS}`
+    const disk = context.disk ?? {
+      bps: LEGACY_CAPACITY_LIMITS.diskBytesPerSecond,
+      iops: LEGACY_CAPACITY_LIMITS.diskIops
     };
+    return { kind: "boot", value: `${value},bps=${disk.bps},iops=${disk.iops}` };
   }
   if (fields.get("id") === "cdrom0") {
     assertFields(
@@ -274,35 +544,6 @@ function parseOriginalUsernet(value, sshPort) {
     "Lima QEMU user network"
   );
 }
-function restrictedUsernet(network, forwards, ncPath) {
-  const guestForwards = forwards.map(
-    (forward) => `guestfwd=tcp:${forward.guestIp}:${forward.port}-cmd:${ncPath} -4 -n -w 60 ${forward.address} ${forward.port}`
-  );
-  return [
-    "user",
-    "id=net0",
-    `net=${WORKER_SUBNET}`,
-    `dhcpstart=${WORKER_IP}`,
-    "restrict=on",
-    "ipv6=off",
-    `hostfwd=tcp:127.0.0.1:${network.sshPort}-:22`,
-    ...guestForwards
-  ].join(",");
-}
-function validateForwards(forwards) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const forward of forwards) {
-    assertPort(forward.port, "guest forwarding port");
-    const key = `${forward.guestIp}:${forward.port}`;
-    if (seen.has(key)) throw new Error("Duplicate QEMU guest forwarding rule");
-    seen.add(key);
-    if (!/^192\.168\.5\.(?:1\d\d)$/.test(forward.guestIp) || !isGloballyRoutableIPv4(forward.address) || !/^(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])(?:\.(?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])){3}$/.test(
-      forward.address
-    )) {
-      throw new Error("Invalid pinned forwarding address");
-    }
-  }
-}
 function fixedControl(control, expected) {
   return (value) => {
     if (value !== expected) throw new Error(`Unexpected QEMU ${control}`);
@@ -335,7 +576,7 @@ var SIMPLE_VALIDATORS = {
   "-parallel": fixedControl("-parallel", "none"),
   "-serial": fixedControl("serial", "chardev:char-serial"),
   "-qmp": fixedControl("qmp", "chardev:char-qmp"),
-  "-name": fixedControl("name", "lima-conveyor"),
+  "-name": (value, { vmName = VM_NAME }) => fixedControl("name", `lima-${vmName}`)(value, {}),
   "-pidfile": (value, context) => {
     assertInstancePath(value, "qemu.pid", context);
     return { value, control: "pidfile" };
@@ -406,15 +647,16 @@ function assertCompleteProfile(state) {
     throw new Error("QEMU PCI serial device and chardev must appear together");
   }
 }
-function rewriteQemuArgs(args, network, ncPath = "/usr/bin/nc", context = {}) {
+function rewriteQemuArgs(args, network, ncPath = "/usr/bin/nc", hostContext = {}) {
   if (isProbe(args)) return [...args];
-  assertPort(network.sshPort, "SSH port");
+  assertPort2(network.sshPort, "SSH port");
   if (!TRUSTED_NC_PATH.test(ncPath)) throw new Error("Invalid netcat path");
-  const forwards = network.hosts.flatMap(
-    (host) => host.ports.map((port) => ({ guestIp: host.guestIp, address: host.address, port }))
-  );
-  if (forwards.length > MAX_NETWORK_FORWARDS) throw new Error("Too many QEMU forwarding rules");
-  validateForwards(forwards);
+  const forwards = qemuForwards(network);
+  const limits = parseCapacityLimits(network.limits);
+  const context = {
+    ...hostContext,
+    disk: { bps: limits.diskBytesPerSecond, iops: limits.diskIops }
+  };
   const output = [];
   const state = {
     controls: /* @__PURE__ */ new Set(),
@@ -470,12 +712,12 @@ import { execFileSync } from "child_process";
 import { lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { join } from "path";
 import { Socket } from "net";
-var MAX_RELAYS = 16;
-var MAX_RELAY_BYTES = 1024 * 1024 * 1024;
+var SLOT_CEILING = CAPACITY_BOUNDS.relaySlots.max;
 var RELAY_CONNECT_MS = 6e4;
-var RELAY_IDLE_MS = 3e4;
+var RELAY_IDLE_MS = 15 * 6e4;
 var GUARD_FRESH_MS = 6e3;
 var RELAY_PREFIX = "--conveyor-vm-relay";
+var RELAY_FLAGS = ["-4", "-n", "-w", "60"];
 function validPid(value) {
   return Number.isInteger(value) && value > 1 && value <= 4194304;
 }
@@ -526,11 +768,13 @@ function readNetwork(root) {
   if (typeof parsed !== "object" || parsed === null)
     throw new Error("VM relay network policy is invalid");
   const network = parsed;
-  if (!Array.isArray(network.hosts)) throw new Error("VM relay network policy is invalid");
-  return network;
+  if (!Array.isArray(network.hosts) || network.control !== void 0 && !Array.isArray(network.control))
+    throw new Error("VM relay network policy is invalid");
+  return { ...network, limits: parseCapacityLimits(network.limits) };
 }
-function assertApprovedDestination(root, invocation) {
-  const allowed = readNetwork(root).hosts.some(
+function assertApprovedDestination(network, invocation) {
+  const entries = invocation.reserve === "control" ? [...network.hosts, ...network.control ?? []].filter((host) => host?.reserve === "control") : network.hosts;
+  const allowed = entries.some(
     (host) => host && host.address === invocation.address && Array.isArray(host.ports) && host.ports.includes(invocation.port)
   );
   if (!allowed) throw new Error("VM relay destination is not in the host network policy");
@@ -541,9 +785,10 @@ function recordPath(root, pid) {
 function slotPath(root, slot) {
   return join(relayDirectory(root), `slot-${slot}`);
 }
-function claimSlot(root) {
+function claimSlot(root, limits, reserve) {
   safeDirectory(relayDirectory(root));
-  for (let slot = 0; slot < MAX_RELAYS; slot += 1) {
+  const first = reserve === "control" ? 0 : limits.reservedRelaySlots;
+  for (let slot = first; slot < limits.relaySlots; slot += 1) {
     try {
       mkdirSync(slotPath(root, slot), { mode: 448 });
       return slot;
@@ -551,10 +796,10 @@ function claimSlot(root) {
       if (error.code !== "EEXIST") throw error;
     }
   }
-  throw new Error(`VM relay limit reached (${MAX_RELAYS})`);
+  throw new Error(`VM relay limit reached (${limits.relaySlots})`);
 }
-function registerRelay(root, runId) {
-  const slot = claimSlot(root);
+function registerRelay(root, runId, limits, reserve) {
+  const slot = claimSlot(root, limits, reserve);
   const record = {
     schema: 1,
     pid: process.pid,
@@ -584,15 +829,20 @@ function unregisterRelay(root, record) {
 }
 function parseRelayInvocation(args) {
   if (args[0] !== RELAY_PREFIX) return null;
-  if (args.length !== 7 || args[1] !== "-4" || args[2] !== "-n" || args[3] !== "-w" || args[4] !== "60") {
+  const control = args.length === 8 && args[7] === "control";
+  if (args.length !== 7 && !control || RELAY_FLAGS.some((flag, index) => args[index + 1] !== flag)) {
     throw new Error("Invalid VM relay invocation");
   }
   const address = args[5] ?? "";
   const port = Number(args[6]);
-  if (!isGloballyRoutableIPv4(address) || !Number.isInteger(port) || port < 1 || port > 65535) {
+  const publicWeb = !control && address === "public-web" && port === PUBLIC_WEB_PORT;
+  if (!(isGloballyRoutableIPv4(address) || publicWeb) || !validPort(port)) {
     throw new Error("Invalid VM relay destination");
   }
-  return { address, port };
+  return { address, port, ...control ? { reserve: "control" } : {} };
+}
+function validPort(port) {
+  return Number.isInteger(port) && port >= 1 && port <= 65535;
 }
 function parsePs(output) {
   const result = /* @__PURE__ */ new Map();
@@ -613,7 +863,7 @@ function parsePs(output) {
 }
 function listedRecords(root, runId) {
   const records = [];
-  for (let slot = 0; slot < MAX_RELAYS; slot += 1) {
+  for (let slot = 0; slot < SLOT_CEILING; slot += 1) {
     try {
       const record = JSON.parse(
         readFileSync(join(slotPath(root, slot), "owner.json"), "utf8")
@@ -668,21 +918,58 @@ function currentGuardStillValid(root, runId) {
 function runRelay(root, invocation, io) {
   return Promise.resolve().then(() => runRelayNow(root, invocation, io));
 }
-function runRelayNow(root, invocation, io) {
+async function runRelayNow(root, invocation, io) {
   const guard = readLiveGuard(root);
-  assertApprovedDestination(root, invocation);
-  const record = registerRelay(root, guard.runId);
+  const network = readNetwork(root);
+  const publicWeb = invocation.address === "public-web" && invocation.port === PUBLIC_WEB_PORT;
+  if (publicWeb) {
+    if (network.publicWeb !== true) throw new Error("Public web access is not enabled");
+  } else assertApprovedDestination(network, invocation);
+  const record = registerRelay(root, guard.runId, network.limits, invocation.reserve);
+  const streams = io ?? { socket: new Socket(), input: process.stdin, output: process.stdout };
+  let connectedResponse = false;
+  if (publicWeb) {
+    const releaseHandshake = handshakeExitCleanup(root, record);
+    let timeout;
+    try {
+      const request = await readPublicWebRequest(streams.input);
+      const address = await Promise.race([
+        publicWebAddress(request.host),
+        new Promise((_, reject) => {
+          timeout = setTimeout(() => reject(new Error("DNS lookup timed out")), 5e3);
+        })
+      ]);
+      if (!currentGuardStillValid(root, record.runId))
+        throw new Error("Resource guard is no longer healthy");
+      invocation = { address, port: request.port };
+      connectedResponse = request.connect;
+    } catch {
+      unregisterRelay(root, record);
+      streams.output.write(
+        "HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
+      );
+      streams.input.destroy();
+      streams.socket.destroy();
+      return;
+    } finally {
+      if (timeout) clearTimeout(timeout);
+      releaseHandshake();
+    }
+  }
+  return transportRelay(root, invocation, streams, record, {
+    connectedResponse,
+    maxBytes: network.limits.relayMaxBytes
+  });
+}
+function transportRelay(root, invocation, streams, record, options) {
+  const { connectedResponse, maxBytes } = options;
   return new Promise((resolve) => {
     let finished = false;
     let sent = 0;
     let received = 0;
     let guardTimer;
     let connectTimer;
-    const { socket, input, output } = io ?? {
-      socket: new Socket(),
-      input: process.stdin,
-      output: process.stdout
-    };
+    const { socket, input, output } = streams;
     const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
     const cleanup = () => {
       try {
@@ -709,11 +996,12 @@ function runRelayNow(root, invocation, io) {
     };
     process.once("exit", cleanup);
     for (const signal of signals) process.once(signal, terminated);
-    const exceedsLimit = (total) => total > MAX_RELAY_BYTES;
+    const exceedsLimit = (total) => total > maxBytes;
     socket.setTimeout(RELAY_IDLE_MS, () => finish(new Error("VM relay idle timeout")));
     socket.once("connect", () => {
       if (connectTimer) clearTimeout(connectTimer);
       connectTimer = void 0;
+      if (connectedResponse) output.write("HTTP/1.1 200 Connection Established\r\n\r\n");
     });
     socket.on("error", () => finish(new Error("VM relay connection failed")));
     socket.on("close", () => finish());
@@ -741,29 +1029,56 @@ function runRelayNow(root, invocation, io) {
       RELAY_CONNECT_MS
     );
     socket.connect(invocation.port, invocation.address);
+    input.resume();
   });
 }
+function handshakeExitCleanup(root, record) {
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+  const cleanup = () => {
+    try {
+      unregisterRelay(root, record);
+    } catch {
+    }
+  };
+  const release = () => {
+    process.removeListener("exit", cleanup);
+    for (const signal of signals) process.removeListener(signal, terminated);
+  };
+  const terminated = (signal) => {
+    cleanup();
+    release();
+    process.kill(process.pid, signal);
+  };
+  process.once("exit", cleanup);
+  for (const signal of signals) process.once(signal, terminated);
+  return release;
+}
 
 // src/vm/memory-budget.ts
-function vmHostMemoryGiB(guestGiB) {
-  return guestGiB + Math.max(1, guestGiB / 4);
+var RELAY_RSS_ALLOWANCE_MIB = 128;
+var BASE_RELAY_SLOTS = 16;
+function relayAllowanceGiB(relaySlots = BASE_RELAY_SLOTS) {
+  return Math.max(0, relaySlots - BASE_RELAY_SLOTS) * RELAY_RSS_ALLOWANCE_MIB / 1024;
+}
+function vmHostMemoryGiB(guestGiB, relaySlots = BASE_RELAY_SLOTS) {
+  return guestGiB + Math.max(1, guestGiB / 4) + relayAllowanceGiB(relaySlots);
 }
 
 // src/vm/resource-guard.ts
-var GIB = 1024 ** 3;
+var GIB2 = 1024 ** 3;
 var GUARD_INTERVAL_MS = 2e3;
-function guardLimits(resources) {
+function guardLimits(resources, capacity = LEGACY_CAPACITY_LIMITS) {
   if (!Number.isInteger(resources.memoryGiB) || resources.memoryGiB < 2 || resources.memoryGiB > 1024 || !Number.isInteger(resources.diskGiB) || resources.diskGiB < 20 || resources.diskGiB > 512) {
     throw new Error("Invalid resource limits in host state");
   }
   return {
-    minFreeBytes: 10 * GIB,
+    minFreeBytes: 10 * GIB2,
     // A 24 GiB Mac guest exceeded 27 GiB during image unpacking. Allow 25%
     // overhead (at least 1 GiB); admission reserves host RAM using this same cap.
-    maxRssKiB: vmHostMemoryGiB(resources.memoryGiB) * 1024 ** 2,
-    maxProcesses: 64,
+    maxRssKiB: vmHostMemoryGiB(resources.memoryGiB, capacity.relaySlots) * 1024 ** 2,
+    maxProcesses: guardProcessLimit(capacity.relaySlots),
     maxOutputBytes: 1024 * 1024,
-    maxDiskBytes: (resources.diskGiB + 1) * GIB,
+    maxDiskBytes: (resources.diskGiB + 1) * GIB2,
     maxLogBytes: 8 * 1024 ** 2
   };
 }
@@ -815,20 +1130,19 @@ function hostPs(args) {
     env: { PATH: "/usr/bin:/bin", LANG: "C" }
   });
 }
-function sampleResources(root, qemuPid, runId) {
+function sampleResources(root, instanceDir, qemuPid, runId, ps = hostPs) {
   const fs = statfsSync(root);
-  const instance = join2(root, "lima", "conveyor");
-  const processes = parseProcessGroup(hostPs(["-axo", "pgid=,pid=,rss="]), qemuPid);
-  const relays = sampleRelayProcesses(root, runId, hostPs(["-axo", "pid=,pgid=,rss=,command="]));
+  const processes = parseProcessGroup(ps(["-axo", "pgid=,pid=,rss="]), qemuPid);
+  const relays = sampleRelayProcesses(root, runId, ps(["-axo", "pid=,pgid=,rss=,command="]));
   return {
     freeBytes: fs.bavail * fs.bsize,
     rssKiB: processes.rssKiB + relays.reduce((total, relay) => total + relay.rssKiB, 0),
     processes: processes.processes + relays.length,
     relayProcesses: relays.length,
-    diskBytes: regularFileSize(join2(instance, "disk")),
+    diskBytes: regularFileSize(join2(instanceDir, "disk")),
     largestLogBytes: Math.max(
       ...["ha.stdout.log", "ha.stderr.log", "serial.log", "serialp.log", "serialv.log"].map(
-        (file) => regularFileSize(join2(instance, file))
+        (file) => regularFileSize(join2(instanceDir, file))
       )
     )
   };
@@ -843,7 +1157,7 @@ function writeGuardEvidence(root, evidence) {
     rmSync2(temporary, { force: true });
   }
 }
-function startResourceGuard(root, identity, limits, stop) {
+function startResourceGuard(root, identity, limits, stop, instanceDir) {
   const evidence = {
     schema: 1,
     ...identity,
@@ -868,7 +1182,7 @@ function startResourceGuard(root, identity, limits, stop) {
   function check() {
     if (finished) return;
     try {
-      evidence.observed = sampleResources(root, identity.qemuPid, identity.runId);
+      evidence.observed = sampleResources(root, instanceDir, identity.qemuPid, identity.runId);
       const violation = resourceViolation(evidence.observed, limits);
       if (violation) throw new Error(violation);
       evidence.lastCheckedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1071,9 +1385,9 @@ function attachBoundedOutput(child, limit, terminate) {
   child.stdout?.on("data", consume);
   child.stderr?.on("data", consume);
 }
-function runGuardedQemu(root, qemu, args, networkHash, resources) {
+function runGuardedQemu(root, qemu, args, networkHash, resources, instanceDir, capacity) {
   const runId = startIdentity(root);
-  const limits = guardLimits(resources);
+  const limits = guardLimits(resources, parseCapacityLimits(capacity));
   const hardenedArgs = [...args, "-no-user-config", "-nodefaults"];
   const child = spawn2(qemu, hardenedArgs, {
     stdio: ["ignore", "pipe", "pipe"],
@@ -1131,7 +1445,7 @@ function runGuardedQemu(root, qemu, args, networkHash, resources) {
       JSON.stringify({ ...identity, args: hardenedArgs, startedAt: (/* @__PURE__ */ new Date()).toISOString() }),
       { mode: 384 }
     );
-    guard = startResourceGuard(root, identity, limits, terminate);
+    guard = startResourceGuard(root, identity, limits, terminate, instanceDir);
   } catch {
     terminate("failed to record or start host resource supervision");
   }
@@ -1162,6 +1476,8 @@ function main() {
   if (state.schema !== 1 || !state.qemu.startsWith("/") || state.qemu.includes("wrapper")) {
     throw new Error("Invalid QEMU host state");
   }
+  const vmName = vmNameFor(stateInstance(state.instance));
+  const instanceDir = join5(root, "lima", vmName);
   const networkText = readFileSync4(join5(root, "network.json"), "utf8");
   const network = JSON.parse(networkText);
   const args = process.argv.slice(2);
@@ -1170,7 +1486,8 @@ function main() {
     original?.match(/hostfwd=tcp:127\.0\.0\.1:(\d+)-(?:192\.168\.5\.15)?:22/)?.[1] ?? 0
   );
   const rewritten = rewriteQemuArgs(args, { ...network, sshPort }, join5(root, "qemu-relay"), {
-    instanceDir: join5(root, "lima", "conveyor")
+    instanceDir,
+    vmName
   });
   if (original) {
     const expected = process.platform === "darwin" ? "hvf" : "kvm";
@@ -1182,7 +1499,9 @@ function main() {
       state.qemu,
       rewritten,
       createHash("sha256").update(networkText).digest("hex"),
-      state.resources
+      state.resources,
+      instanceDir,
+      network.limits
     );
     return;
   }