@themoltnet/sandbox-gondolin 0.5.0 → 0.5.2

package/dist/index.js

@@ -249,7 +249,7 @@ var GONDOLIN_BASE_EXECUTABLES = Object.freeze([
 /** gh CLI version installed in every snapshot. */
 var GH_VERSION = "2.74.0";
 /** MoltNet CLI version — downloaded as a binary, no Node needed. */
-var MOLTNET_CLI_VERSION = "1.37.0";
+var MOLTNET_CLI_VERSION = "3.5.0";
 /**
 * Resolve guest architecture from host (Gondolin VMs match host arch).
 *
@@ -291,12 +291,24 @@ function getCacheDir() {
 	const base = process.env.XDG_CACHE_HOME ?? path.join(process.env.HOME ?? "/tmp", ".cache");
 	return path.join(base, "moltnet", "gondolin");
 }
+/**
+* The VM backend the snapshot will be built with. Gondolin checkpoints
+* record `compatibleVmm` and refuse to resume under a backend the build
+* did not produce assets for, so the backend MUST be part of the cache
+* key: a qemu-built snapshot resumed under `GONDOLIN_VMM=krun` (the
+* signed bundle's default) would otherwise fail every run until the
+* cache is wiped by hand.
+*/
+function resolveSnapshotVmm(env = process.env) {
+	return env.GONDOLIN_VMM?.trim().toLowerCase() === "krun" ? "krun" : "qemu";
+}
 function computeConfigHash(config) {
 	const h = createHash("sha256");
 	h.update(JSON.stringify({
 		baseAlpine: BASE_ALPINE_PACKAGES,
 		ghVersion: GH_VERSION,
 		cliVersion: MOLTNET_CLI_VERSION,
+		vmm: resolveSnapshotVmm(),
 		config
 	}));
 	return h.digest("hex").slice(0, 12);
@@ -398,6 +410,7 @@ async function buildSnapshot(vm, config, log) {
       mv /tmp/package/bin/moltnet /usr/local/bin/moltnet
       chmod +x /usr/local/bin/moltnet
       rm -rf /tmp/moltnet.tgz /tmp/package
+      moltnet capability serve --help >/dev/null
     '`);
 	await run(vm, log, "creating agent user...", `sh -eu -c '
       addgroup -g 501 agent 2>/dev/null || true
@@ -550,6 +563,9 @@ var GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
 /** Guest directory holding one PID file per projected service. */
 var GUEST_SERVICE_PID_DIR = "/run/moltnet/services";
 var GUEST_SERVICE_ID_RE = /^[a-z][a-z0-9-]{0,62}$/;
+function stderrTail(previous, next) {
+	return Buffer.concat([Buffer.from(previous), Buffer.from(next)]).subarray(-4096).toString("utf8");
+}
 function assertGuestServiceId(id) {
 	if (!GUEST_SERVICE_ID_RE.test(id)) throw new Error(`Invalid guest service id "${id}": expected ${GUEST_SERVICE_ID_RE}`);
 }
@@ -1172,6 +1188,8 @@ async function resumeVm(config) {
 	const servicesAbort = new AbortController();
 	const serviceHandles = [];
 	const serviceIds = [];
+	const serviceExits = /* @__PURE__ */ new Map();
+	const serviceExitResults = /* @__PURE__ */ new Map();
 	const services = { async stop() {
 		if (serviceIds.length > 0) {
 			const pidFiles = serviceIds.map((id) => `${GUEST_SERVICE_PID_DIR}/${id}.pid`).join(" ");
@@ -1247,21 +1265,48 @@ async function resumeVm(config) {
 				...service.command
 			], {
 				stdout: "ignore",
-				stderr: "ignore",
+				stderr: "pipe",
 				...service.env && { env: service.env },
 				signal: servicesAbort.signal
 			});
-			serviceHandles.push(Promise.resolve(handle).catch(() => void 0));
+			let stderr = "";
+			const exited = (async () => {
+				try {
+					if ("output" in handle && typeof handle.output === "function") {
+						for await (const chunk of handle.output()) if (chunk.stream === "stderr") stderr = stderrTail(stderr, chunk.data);
+					}
+					const result = await handle;
+					stderr = stderrTail(stderr, String(result.stderr ?? ""));
+					return {
+						exitCode: result.exitCode,
+						stderr
+					};
+				} catch (error) {
+					return {
+						exitCode: void 0,
+						stderr: stderrTail(stderr, String(error))
+					};
+				}
+			})();
+			serviceExits.set(service.id, exited.then((result) => {
+				serviceExitResults.set(service.id, result);
+				return result;
+			}));
+			serviceHandles.push(exited);
 			serviceIds.push(service.id);
 		}
 		async function awaitServiceReady(service) {
 			if (!service.readiness) return;
 			const deadline = Date.now() + (service.readiness.timeoutMs ?? 1e4);
 			const pidFile = `${GUEST_SERVICE_PID_DIR}/${service.id}.pid`;
+			const exited = serviceExits.get(service.id);
+			if (!exited) throw new Error(`Service "${service.id}" was not started`);
 			let ready = false;
+			let failure;
 			while (Date.now() < deadline) {
 				throwIfAborted(config.signal, `service "${service.id}" readiness`);
-				if ((await vm.exec([
+				if (servicesAbort.signal.aborted) return;
+				const probe = await vm.exec([
 					"sh",
 					"-c",
 					"[ -e \"$1\" ] && [ -r \"$2\" ] && kill -0 \"$(cat \"$2\" 2>/dev/null)\" 2>/dev/null",
@@ -1272,24 +1317,46 @@ async function resumeVm(config) {
 					stdout: "ignore",
 					stderr: "ignore",
 					signal: config.signal
-				})).exitCode === 0) {
+				});
+				const alreadyExited = serviceExitResults.get(service.id);
+				if (alreadyExited) {
+					failure = `exited (code ${alreadyExited.exitCode ?? "unknown"})`;
+					if (alreadyExited.stderr) failure += `; stderr tail: ${alreadyExited.stderr}`;
+					break;
+				}
+				if (probe.exitCode === 0) {
 					ready = true;
 					break;
 				}
-				await new Promise((resolve) => {
-					setTimeout(resolve, 200);
-				});
+				const outcome = await Promise.race([exited.then((result) => ({
+					kind: "exit",
+					result
+				})), delay(Math.min(200, Math.max(0, deadline - Date.now())), servicesAbort.signal, `service "${service.id}" readiness`).then(() => ({ kind: "retry" }))]);
+				if (outcome.kind === "exit") {
+					failure = `exited (code ${outcome.result.exitCode ?? "unknown"})`;
+					if (outcome.result.stderr) failure += `; stderr tail: ${outcome.result.stderr}`;
+					break;
+				}
 			}
 			if (!ready) {
-				if (service.readiness.required) throw new Error(`Projected guest service "${service.id}" did not become ready: ${service.readiness.path} absent or its process exited`);
+				if (servicesAbort.signal.aborted) return;
+				failure ??= `${service.readiness.path} absent after ${service.readiness.timeoutMs ?? 1e4} ms`;
+				if (service.readiness.required) throw new Error(`Projected guest service "${service.id}" did not become ready: ${failure}`);
 				config.onDiagnostic?.({
 					event: "vm.guest_service.not_ready",
 					level: "warning",
-					message: `Projected guest service "${service.id}" did not become ready (${service.readiness.path} absent or its process exited); continuing without it`
+					message: `Projected guest service "${service.id}" did not become ready (${failure}); continuing without it`
 				});
 			}
 		}
-		await Promise.all(projectedServices.map((service) => awaitServiceReady(service)));
+		for (const service of projectedServices.filter((item) => item.readiness && !item.readiness.required)) awaitServiceReady(service).catch((error) => {
+			if (!servicesAbort.signal.aborted) config.onDiagnostic?.({
+				event: "vm.guest_service.not_ready",
+				level: "warning",
+				message: `Projected guest service "${service.id}" readiness failed: ${String(error)}`
+			});
+		});
+		await Promise.all(projectedServices.filter((service) => service.readiness?.required).map((service) => awaitServiceReady(service)));
 		if (projectedFiles.length > 0 || projectedServices.length > 0) config.onDiagnostic?.({
 			event: "vm.guest_projection.applied",
 			level: "info",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/sandbox-gondolin",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Gondolin microVM sandbox lifecycle for MoltNet runtimes: checkpoint resume, egress policy, VFS shadowing, guest credential boundary, host-brokered secrets",
   "keywords": [
     "moltnet",
@@ -33,9 +33,9 @@
   },
   "nx": {
     "tags": [
-      "type:runtime",
+      "type:sandbox",
       "scope:agent",
-      "platform:extension"
+      "platform:server"
     ],
     "targets": {
       "test-ci": {