@themoltnet/sandbox-gondolin 0.5.1 → 0.6.0

package/dist/index.js

@@ -249,7 +249,7 @@ var GONDOLIN_BASE_EXECUTABLES = Object.freeze([
 /** gh CLI version installed in every snapshot. */
 var GH_VERSION = "2.74.0";
 /** MoltNet CLI version — downloaded as a binary, no Node needed. */
-var MOLTNET_CLI_VERSION = "1.37.0";
+var MOLTNET_CLI_VERSION = "3.11.0";
 /**
 * Resolve guest architecture from host (Gondolin VMs match host arch).
 *
@@ -410,6 +410,7 @@ async function buildSnapshot(vm, config, log) {
       mv /tmp/package/bin/moltnet /usr/local/bin/moltnet
       chmod +x /usr/local/bin/moltnet
       rm -rf /tmp/moltnet.tgz /tmp/package
+      moltnet capability serve --help >/dev/null
     '`);
 	await run(vm, log, "creating agent user...", `sh -eu -c '
       addgroup -g 501 agent 2>/dev/null || true
@@ -562,6 +563,9 @@ var GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
 /** Guest directory holding one PID file per projected service. */
 var GUEST_SERVICE_PID_DIR = "/run/moltnet/services";
 var GUEST_SERVICE_ID_RE = /^[a-z][a-z0-9-]{0,62}$/;
+function stderrTail(previous, next) {
+	return Buffer.concat([Buffer.from(previous), Buffer.from(next)]).subarray(-4096).toString("utf8");
+}
 function assertGuestServiceId(id) {
 	if (!GUEST_SERVICE_ID_RE.test(id)) throw new Error(`Invalid guest service id "${id}": expected ${GUEST_SERVICE_ID_RE}`);
 }
@@ -723,6 +727,7 @@ function isReservedGuestEnvironmentName(name) {
 	return name.startsWith("MOLTNET_") || name.startsWith("GIT_CONFIG_") || RESERVED_GUEST_ENVIRONMENT_NAMES.has(name);
 }
 var GuestEnvironmentBoundaryError = class extends Error {
+	refusedNames;
 	constructor(refusedNames) {
 		super(`Guest credential boundary refuses runtime-controlled environment variables: ${refusedNames.join(", ")}. Remove them from the runtime profile; MoltNet operations use the trusted host-side Agent.`);
 		this.refusedNames = refusedNames;
@@ -730,6 +735,7 @@ var GuestEnvironmentBoundaryError = class extends Error {
 	}
 };
 var BrokeredHttpSecretBoundaryError = class extends Error {
+	issues;
 	constructor(issues) {
 		super("Brokered HTTP secret boundary refused the resolved bindings: " + issues.join("; "));
 		this.issues = issues;
@@ -1184,6 +1190,8 @@ async function resumeVm(config) {
 	const servicesAbort = new AbortController();
 	const serviceHandles = [];
 	const serviceIds = [];
+	const serviceExits = /* @__PURE__ */ new Map();
+	const serviceExitResults = /* @__PURE__ */ new Map();
 	const services = { async stop() {
 		if (serviceIds.length > 0) {
 			const pidFiles = serviceIds.map((id) => `${GUEST_SERVICE_PID_DIR}/${id}.pid`).join(" ");
@@ -1258,22 +1266,57 @@ async function resumeVm(config) {
 				"moltnet-service",
 				...service.command
 			], {
-				stdout: "ignore",
-				stderr: "ignore",
+				stdout: "pipe",
+				stderr: "pipe",
 				...service.env && { env: service.env },
 				signal: servicesAbort.signal
 			});
-			serviceHandles.push(Promise.resolve(handle).catch(() => void 0));
+			let stderr = "";
+			const completion = Promise.resolve(handle).then((result) => ({
+				kind: "completed",
+				result
+			}), (error) => ({
+				kind: "failed",
+				error
+			}));
+			const exited = (async () => {
+				try {
+					if ("output" in handle && typeof handle.output === "function") {
+						for await (const chunk of handle.output()) if (chunk.stream === "stderr") stderr = stderrTail(stderr, chunk.data);
+					}
+				} catch (error) {
+					stderr = stderrTail(stderr, String(error));
+				}
+				const outcome = await completion;
+				if (outcome.kind === "failed") return {
+					exitCode: void 0,
+					stderr: stderrTail(stderr, String(outcome.error))
+				};
+				stderr = stderrTail(stderr, String(outcome.result.stderr ?? ""));
+				return {
+					exitCode: outcome.result.exitCode,
+					stderr
+				};
+			})();
+			serviceExits.set(service.id, exited.then((result) => {
+				serviceExitResults.set(service.id, result);
+				return result;
+			}));
+			serviceHandles.push(exited);
 			serviceIds.push(service.id);
 		}
 		async function awaitServiceReady(service) {
 			if (!service.readiness) return;
 			const deadline = Date.now() + (service.readiness.timeoutMs ?? 1e4);
 			const pidFile = `${GUEST_SERVICE_PID_DIR}/${service.id}.pid`;
+			const exited = serviceExits.get(service.id);
+			if (!exited) throw new Error(`Service "${service.id}" was not started`);
 			let ready = false;
+			let failure;
 			while (Date.now() < deadline) {
 				throwIfAborted(config.signal, `service "${service.id}" readiness`);
-				if ((await vm.exec([
+				if (servicesAbort.signal.aborted) return;
+				const probe = await vm.exec([
 					"sh",
 					"-c",
 					"[ -e \"$1\" ] && [ -r \"$2\" ] && kill -0 \"$(cat \"$2\" 2>/dev/null)\" 2>/dev/null",
@@ -1284,24 +1327,46 @@ async function resumeVm(config) {
 					stdout: "ignore",
 					stderr: "ignore",
 					signal: config.signal
-				})).exitCode === 0) {
+				});
+				const alreadyExited = serviceExitResults.get(service.id);
+				if (alreadyExited) {
+					failure = `exited (code ${alreadyExited.exitCode ?? "unknown"})`;
+					if (alreadyExited.stderr) failure += `; stderr tail: ${alreadyExited.stderr}`;
+					break;
+				}
+				if (probe.exitCode === 0) {
 					ready = true;
 					break;
 				}
-				await new Promise((resolve) => {
-					setTimeout(resolve, 200);
-				});
+				const outcome = await Promise.race([exited.then((result) => ({
+					kind: "exit",
+					result
+				})), delay(Math.min(200, Math.max(0, deadline - Date.now())), servicesAbort.signal, `service "${service.id}" readiness`).then(() => ({ kind: "retry" }))]);
+				if (outcome.kind === "exit") {
+					failure = `exited (code ${outcome.result.exitCode ?? "unknown"})`;
+					if (outcome.result.stderr) failure += `; stderr tail: ${outcome.result.stderr}`;
+					break;
+				}
 			}
 			if (!ready) {
-				if (service.readiness.required) throw new Error(`Projected guest service "${service.id}" did not become ready: ${service.readiness.path} absent or its process exited`);
+				if (servicesAbort.signal.aborted) return;
+				failure ??= `${service.readiness.path} absent after ${service.readiness.timeoutMs ?? 1e4} ms`;
+				if (service.readiness.required) throw new Error(`Projected guest service "${service.id}" did not become ready: ${failure}`);
 				config.onDiagnostic?.({
 					event: "vm.guest_service.not_ready",
 					level: "warning",
-					message: `Projected guest service "${service.id}" did not become ready (${service.readiness.path} absent or its process exited); continuing without it`
+					message: `Projected guest service "${service.id}" did not become ready (${failure}); continuing without it`
 				});
 			}
 		}
-		await Promise.all(projectedServices.map((service) => awaitServiceReady(service)));
+		for (const service of projectedServices.filter((item) => item.readiness && !item.readiness.required)) awaitServiceReady(service).catch((error) => {
+			if (!servicesAbort.signal.aborted) config.onDiagnostic?.({
+				event: "vm.guest_service.not_ready",
+				level: "warning",
+				message: `Projected guest service "${service.id}" readiness failed: ${String(error)}`
+			});
+		});
+		await Promise.all(projectedServices.filter((service) => service.readiness?.required).map((service) => awaitServiceReady(service)));
 		if (projectedFiles.length > 0 || projectedServices.length > 0) config.onDiagnostic?.({
 			event: "vm.guest_projection.applied",
 			level: "info",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/sandbox-gondolin",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Gondolin microVM sandbox lifecycle for MoltNet runtimes: checkpoint resume, egress policy, VFS shadowing, guest credential boundary, host-brokered secrets",
   "keywords": [
     "moltnet",