@tikoci/quickchr 0.4.1 → 0.4.3

package/src/lib/provision.ts

@@ -364,14 +364,12 @@ export async function provision(
 	// Try REST provisioning. When machineDir is provided, use a shorter timeout
 	// so the console fallback can engage sooner if REST isn't available.
 	const restTimeout = machineDir ? 30_000 : 60_000;
-	let usedConsolePath = false;
 	try {
 		await waitForRest(httpPort, restTimeout);
 	} catch (e) {
 		if (machineDir) {
 			log.warn("REST API unavailable — falling back to serial console provisioning");
 			const result = await consoleProvision(machineDir, machineName, effectiveUser, !!shouldDisableAdmin, logger, portBase);
-			usedConsolePath = true;
 			// After console provisioning the machine is booted; REST comes up shortly.
 			// Attempt SSH key install for the managed quickchr user — non-fatal if REST is still unavailable.
 			if (secureLogin && !user && effectiveUser) {
@@ -387,35 +385,35 @@ export async function provision(
 		throw e;
 	}
 
-	if (!usedConsolePath) {
-		if (effectiveUser) {
-			await createUser(httpPort, effectiveUser.name, effectiveUser.password);
-			// Persist to secret store so resolveAuth() picks it up
-			saveInstanceCredentials(machineName, effectiveUser.name, effectiveUser.password);
-		}
+	// REST provisioning path. The console fallback above always returns early,
+	// so reaching here means REST came up and we provision over it.
+	if (effectiveUser) {
+		await createUser(httpPort, effectiveUser.name, effectiveUser.password);
+		// Persist to secret store so resolveAuth() picks it up
+		saveInstanceCredentials(machineName, effectiveUser.name, effectiveUser.password);
+	}
 
-		if (secureLogin && !user && effectiveUser && machineDir) {
-			// Brief pause so RouterOS propagates the new user to all subsystems
-			// (including the SSH key store) before we attempt key installation.
-			await Bun.sleep(1000);
-			try {
-				await installSshKey(httpPort, effectiveUser.name, machineName, machineDir, portBase);
-			} catch (e) {
-				log.warn(`SSH key install failed (SSH transport will fall back to password): ${e}`);
-			}
+	if (secureLogin && !user && effectiveUser && machineDir) {
+		// Brief pause so RouterOS propagates the new user to all subsystems
+		// (including the SSH key store) before we attempt key installation.
+		await Bun.sleep(1000);
+		try {
+			await installSshKey(httpPort, effectiveUser.name, machineName, machineDir, portBase);
+		} catch (e) {
+			log.warn(`SSH key install failed (SSH transport will fall back to password): ${e}`);
 		}
+	}
 
-		if (shouldDisableAdmin) {
-			if (!effectiveUser) {
-				log.warn("Warning: disabling admin without creating another user — you may lose access");
-			}
-			// Pass the new user's auth for verification — after disabling admin,
-			// admin creds may stop working for REST queries.
-			const verifyAuth = effectiveUser
-				? `Basic ${btoa(`${effectiveUser.name}:${effectiveUser.password}`)}`
-				: undefined;
-			await disableAdmin(httpPort, verifyAuth);
+	if (shouldDisableAdmin) {
+		if (!effectiveUser) {
+			log.warn("Warning: disabling admin without creating another user — you may lose access");
 		}
+		// Pass the new user's auth for verification — after disabling admin,
+		// admin creds may stop working for REST queries.
+		const verifyAuth = effectiveUser
+			? `Basic ${btoa(`${effectiveUser.name}:${effectiveUser.password}`)}`
+			: undefined;
+		await disableAdmin(httpPort, verifyAuth);
 	}
 
 	return { user: effectiveUser };

package/src/lib/qemu.ts

@@ -9,7 +9,7 @@ import { existsSync, writeFileSync, readFileSync, copyFileSync, statSync, openSy
 import { join } from "node:path";
 import type { Arch, BootDiskFormat, MachineState, NetworkMode, NetworkConfig, PortMapping } from "./types.ts";
 import { QuickCHRError } from "./types.ts";
-import { detectAccel, requireQemu, requireFirmware } from "./platform.ts";
+import { detectAccel, requireQemu, requireFirmware, requireQemuImg } from "./platform.ts";
 import { buildHostfwdString } from "./network.ts";
 import { ensureDir } from "./state.ts";
 import { restGet } from "./rest.ts";
@@ -80,16 +80,19 @@ export async function buildQemuArgs(config: QemuLaunchConfig): Promise<string[]>
 	// UEFI firmware (arm64 only)
 	if (arch === "arm64") {
 		const fw = requireFirmware();
-		const varsPath = join(machineDir, "efi-vars.fd");
-
-		// Copy and size-match the vars file if not already done
+		// The per-machine EFI vars pflash is qcow2, NOT raw: QEMU refuses
+		// savevm/loadvm while any writable block device is non-qcow2 ("Device
+		// 'pflash1' is writable but does not support snapshots"), which made
+		// snapshots impossible on arm64 (#31). Legacy raw efi-vars.fd machines
+		// are converted in place, preserving their NVRAM state.
+		const varsPath = join(machineDir, "efi-vars.qcow2");
 		if (!existsSync(varsPath)) {
-			prepareEfiVars(fw.code, fw.vars, varsPath);
+			await prepareEfiVars(fw.code, fw.vars, varsPath, join(machineDir, "efi-vars.fd"));
 		}
 
 		args.push(
 			"-drive", `if=pflash,format=raw,readonly=on,unit=0,file=${fw.code}`,
-			"-drive", `if=pflash,format=raw,unit=1,file=${varsPath}`,
+			"-drive", `if=pflash,format=qcow2,unit=1,file=${varsPath}`,
 		);
 	}
 
@@ -248,26 +251,53 @@ function buildChannelArgs(
 	}
 }
 
-/** Copy and size-match EFI vars file to match code ROM size. */
-function prepareEfiVars(codePath: string, varsTemplatePath: string, destPath: string): void {
+/** Build the per-machine qcow2 EFI vars pflash: start from the legacy raw
+ *  vars file if the machine has one (preserves NVRAM state), else from the
+ *  firmware template; size-match to the code ROM; convert raw → qcow2 so
+ *  savevm/loadvm work (see the pflash comment at the call site / #31). */
+async function prepareEfiVars(codePath: string, varsTemplatePath: string, destPath: string, legacyRawPath: string): Promise<void> {
 	ensureDir(join(destPath, ".."));
-	copyFileSync(varsTemplatePath, destPath);
 
-	// pflash units must be identical size — pad/truncate vars to match code
+	// Stage the raw image (legacy per-machine file wins over the template).
+	const rawStage = `${destPath}.raw-stage`;
+	copyFileSync(existsSync(legacyRawPath) ? legacyRawPath : varsTemplatePath, rawStage);
+
+	// pflash units must be identical size — pad/truncate vars to match code.
+	// truncateSync extends with zero bytes when target is larger.
 	const codeSize = statSync(codePath).size;
-	const varsSize = statSync(destPath).size;
+	try {
+		if (statSync(rawStage).size !== codeSize) truncateSync(rawStage, codeSize);
+	} catch (e) {
+		try { unlinkSync(rawStage); } catch { /* best effort */ }
+		throw new QuickCHRError(
+			"PROCESS_FAILED",
+			`Failed to size-match EFI vars: ${e instanceof Error ? e.message : String(e)}`,
+		);
+	}
 
-	if (varsSize !== codeSize) {
-		// Pad or truncate vars to match code ROM size — truncateSync extends with
-		// zero bytes when target is larger, and truncates when smaller.
-		try {
-			truncateSync(destPath, codeSize);
-		} catch (e) {
-			throw new QuickCHRError(
-				"PROCESS_FAILED",
-				`Failed to size-match EFI vars: ${e instanceof Error ? e.message : String(e)}`,
-			);
-		}
+	const qemuImg = requireQemuImg();
+	const conversion = Bun.spawn([qemuImg, "convert", "-f", "raw", "-O", "qcow2", rawStage, destPath], {
+		stdout: "pipe",
+		stderr: "pipe",
+	});
+	const exitCode = await conversion.exited;
+	const [stderr, stdout] = await Promise.all([
+		new Response(conversion.stderr).text(),
+		new Response(conversion.stdout).text(),
+	]);
+	try { unlinkSync(rawStage); } catch { /* best effort */ }
+	if (exitCode !== 0) {
+		// A failed convert can leave a partial destPath behind — remove it so the
+		// next launch regenerates instead of booting (and re-failing on) the stub.
+		try { unlinkSync(destPath); } catch { /* best effort */ }
+		throw new QuickCHRError(
+			"PROCESS_FAILED",
+			`qemu-img convert of EFI vars failed: ${stderr.trim() || stdout.trim() || `exit ${exitCode}`}`,
+		);
+	}
+	// Legacy raw file is superseded — remove so nothing boots the stale copy.
+	if (existsSync(legacyRawPath)) {
+		try { unlinkSync(legacyRawPath); } catch { /* best effort */ }
 	}
 }
 

package/src/lib/quickchr.ts

@@ -43,9 +43,11 @@ import {
 	ensureDir,
 	getCacheDir,
 	getDataDir,
+	appendBootLog,
 } from "./state.ts";
 import { ensureCachedImage, copyImageToMachine, listCachedImages } from "./images.ts";
 import { autoPruneIfOverCap } from "./cache.ts";
+import { resolveSetting } from "./settings.ts";
 import { buildQemuArgs, spawnQemu, stopQemu, cleanupQemuSockets, waitForBoot, extractWrapper, type QemuLaunchConfig } from "./qemu.ts";
 import { cleanDiskFiles, ensureConfiguredDisks, normalizeDiskOptions, parseSnapshotList, listSnapshots, formatDiskSize } from "./disk.ts";
 import { monitorCommand, serialStreams, qgaCommand, channelEndpoint } from "./channels.ts";
@@ -343,6 +345,12 @@ function createInstance(state: MachineState): ChrInstance {
 			if (state.pid && isMachineRunning(state)) {
 				await stopQemu(state.pid);
 			}
+			// NOTE: clean() deliberately does NOT delete efi-vars.fd. On the arm64 `virt`
+			// machine that file stores UEFI boot order (Boot0000 -> first virtio-blk-pci
+			// disk), not OS state; wiping it forces a full device scan (~480s) on the next
+			// boot. The fresh disk re-copy below is a sufficient factory reset. Regression
+			// anchor: the "clean() resets disk to factory defaults" arm64 integration test
+			// (120s reboot wait would blow past 480s if the wipe were reintroduced).
 			// Re-copy fresh image from cache
 			const imgPath = join(getCacheDir(), `chr-${state.version}${state.arch === "arm64" ? "-arm64" : ""}.img`);
 			if (!existsSync(imgPath)) {
@@ -362,10 +370,6 @@ function createInstance(state: MachineState): ChrInstance {
 				state.bootDiskFormat ?? (state.bootSize ? "qcow2" : "raw"),
 			);
 
-			// Remove EFI vars to force re-creation
-			const efiVars = join(state.machineDir, "efi-vars.fd");
-			if (existsSync(efiVars)) rmSync(efiVars);
-
 			// Clean up stored instance credentials (re-provisioned on next start)
 			deleteInstanceCredentials(state.name);
 
@@ -699,15 +703,26 @@ function createInstance(state: MachineState): ChrInstance {
 					throw new QuickCHRError("PROCESS_FAILED", `savevm failed: ${out.trim()}`);
 				}
 
-				// Read back the snapshot list to return the new entry
+				// Read back the snapshot list — the new entry MUST be there. A
+				// fabricated fallback here once masked savevm failing outright on
+				// arm64 (#31): the example printed a snapshot that never existed.
 				const snaps = await this.list();
-				return snaps.find((s) => s.name === snapName) ?? {
-					id: "0",
-					name: snapName,
-					vmStateSize: 0,
-					date: new Date().toISOString(),
-					vmClock: "0000:00:00.000",
-				};
+				const created = snaps.find((s) => s.name === snapName);
+				if (!created) {
+					// Self-grounding error: include the raw monitor listing so a CI
+					// failure carries the evidence (QEMU output formats vary by version
+					// and a parse gap here looks identical to a real savevm failure).
+					let rawList = "(unavailable)";
+					try {
+						rawList = await monitorCommand(state.machineDir, "info snapshots", undefined, state.portBase);
+					} catch { /* keep placeholder */ }
+					throw new QuickCHRError(
+						"PROCESS_FAILED",
+						`savevm reported no error but snapshot "${snapName}" is absent from the parsed list — ` +
+							`treat as failed. savevm said: "${out.trim() || "(empty)"}"; raw 'info snapshots': "${rawList}"`,
+					);
+				}
+				return created;
 			},
 
 			async load(name: string): Promise<void> {
@@ -721,6 +736,17 @@ function createInstance(state: MachineState): ChrInstance {
 
 				const out = await monitorCommand(state.machineDir, `loadvm ${name}`, undefined, state.portBase);
 				if (/^error[:\s]/i.test(out)) {
+					// A failed loadvm leaves the VM in "paused (restore-vm)" — resume
+					// it so the guest isn't wedged (REST dead) on top of the error.
+					try {
+						await monitorCommand(state.machineDir, "cont", undefined, state.portBase);
+					} catch (contErr) {
+						// Best effort — the throw below is the real signal, but a failed
+						// resume means the VM may still be paused; say so.
+						console.warn(
+							`quickchr: 'cont' after failed loadvm also failed (${contErr instanceof Error ? contErr.message : String(contErr)}) — machine "${state.name}" may be paused`,
+						);
+					}
 					throw new QuickCHRError("PROCESS_FAILED", `loadvm failed: ${out.trim()}`);
 				}
 			},
@@ -1169,7 +1195,7 @@ export class QuickCHR {
 		// Resolve version
 		let version: string;
 		if (opts.version) {
-			if ((CHANNELS as string[]).includes(opts.version)) {
+			if ((CHANNELS as readonly string[]).includes(opts.version)) {
 				logger.warn(
 					`'${opts.version}' is a channel name, not a version — passed as 'version' but resolved as a channel. Use 'channel: "${opts.version}"' instead to make this explicit.`,
 				);
@@ -1235,7 +1261,7 @@ export class QuickCHR {
 					user: opts.user ?? existing.user,
 					disableAdmin: opts.disableAdmin ?? existing.disableAdmin,
 					license: opts.license,
-					secureLogin: opts.secureLogin,
+					secureLogin: opts.secureLogin ?? existing.secureLogin,
 				};
 				const hasPending = !!(
 					pendingOpts.installAllPackages ||
@@ -1243,7 +1269,8 @@ export class QuickCHR {
 					pendingOpts.deviceMode ||
 					pendingOpts.user ||
 					pendingOpts.disableAdmin ||
-					pendingOpts.license
+					pendingOpts.license ||
+					pendingOpts.secureLogin === true
 				);
 				if (hasPending) {
 					return QuickCHR._launchExisting(existing, opts.background ?? true, pendingOpts, logger);
@@ -1402,6 +1429,7 @@ export class QuickCHR {
 
 		const qemuArgs = await buildQemuArgs(launchConfig);
 		const wrapper = extractWrapper(resolvedNetworks);
+		const bootStart = Date.now();
 		let { pid } = await spawnQemu(qemuArgs, machineDir, spawnInBackground, wrapper);
 
 		// Foreground (no provisioning): spawnQemu blocks until QEMU exits
@@ -1458,6 +1486,24 @@ export class QuickCHR {
 			);
 		}
 
+		// Record boot timing (cumulative from first spawn, incl. the respawn-once
+		// path) — in machine.json for `list`/`get` and in the boot-history log.
+		// Side-band metrics must never fail a boot that succeeded.
+		state.lastAccel = accel;
+		state.lastBootMs = Date.now() - bootStart;
+		saveMachine(state);
+		try {
+			appendBootLog({
+				ts: new Date().toISOString(),
+				name,
+				version,
+				arch,
+				accel,
+				bootMs: state.lastBootMs,
+				host: process.platform,
+			});
+		} catch { /* never propagate */ }
+
 		if (hasProvisioning) {
 			await QuickCHR._provisionInstance(instance, state, {
 				installAllPackages: opts.installAllPackages,
@@ -1684,6 +1730,7 @@ export class QuickCHR {
 
 		const qemuArgs = await buildQemuArgs(launchConfig);
 		const wrapper = extractWrapper(resolvedNetworks);
+		const bootStart = Date.now();
 		const { pid } = await spawnQemu(qemuArgs, state.machineDir, spawnBackground, wrapper);
 
 		// Foreground without provisioning: spawnQemu blocks until QEMU exits
@@ -1720,12 +1767,32 @@ export class QuickCHR {
 			);
 		}
 
+		// Record boot timing — mirrors start(); side-band, never fails the boot.
+		state.lastAccel = accel;
+		state.lastBootMs = Date.now() - bootStart;
+		saveMachine(state);
+		try {
+			appendBootLog({
+				ts: new Date().toISOString(),
+				name: state.name,
+				version: state.version,
+				arch: state.arch,
+				accel,
+				bootMs: state.lastBootMs,
+				host: process.platform,
+			});
+		} catch { /* never propagate */ }
+
 		if (hasProvisioning && provisioningOpts) {
 			await QuickCHR._provisionInstance(instance, state, provisioningOpts, launchConfig, logger);
 		}
 
 		try {
-			autoPruneIfOverCap({ logger: logger ? (msg) => logger.status(msg) : undefined, protectVersions: [state.version] });
+			autoPruneIfOverCap({
+				logger: logger ? (msg) => logger.status(msg) : undefined,
+				protectVersions: [state.version],
+				maxSizeBytes: resolveSetting("cache-max-size").value as number | undefined,
+			});
 		} catch { /* never propagate */ }
 
 		return instance;
@@ -1777,7 +1844,7 @@ export class QuickCHR {
 					detail: ver ?? "found (version unknown)",
 				});
 			} catch (_e) {
-				const hint = getQemuInstallHint() ?? "Install QEMU";
+				const hint = getQemuInstallHint();
 				checks.push({
 					label: qemuName,
 					status: arch === hostArchToChr() ? "error" : "warn",

package/src/lib/secrets.ts

@@ -12,11 +12,7 @@
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { homedir } from "node:os";
-
-function configDir(): string {
-	return join(process.env.HOME ?? process.env.USERPROFILE ?? homedir(), ".config", "quickchr");
-}
+import { quickchrConfigDir } from "./paths.ts";
 
 /** True when the Bun.secrets API is available at runtime. */
 function hasBunSecrets(): boolean {
@@ -32,7 +28,7 @@ function hasBunSecrets(): boolean {
 function configPath(service: string): string {
 	// One JSON file per service, keyed by name
 	const safeName = service.replace(/[^a-zA-Z0-9._-]/g, "_");
-	return join(configDir(), `${safeName}.json`);
+	return join(quickchrConfigDir(), `${safeName}.json`);
 }
 
 function readConfigStore(service: string): Record<string, string> {
@@ -129,5 +125,5 @@ export async function secretDelete(service: string, name: string): Promise<boole
 /** Human-readable label for where secrets are stored. */
 export function secretStorageLabel(): string {
 	if (hasBunSecrets()) return "OS credential store (via Bun.secrets)";
-	return `config file (${configDir()})`;
+	return `config file (${quickchrConfigDir()})`;
 }