@vm0/runner 3.11.0 → 3.11.2

package/index.js

@@ -33,6 +33,8 @@ var runtimePaths = {
 };
 var VM_WORKSPACE_PREFIX = "vm0-";
 var runnerPaths = {
+  /** Base directory used for snapshot generation (baseDir + /snapshot-gen) */
+  snapshotBaseDir: (baseDir) => path.join(baseDir, "snapshot-gen"),
   /** Overlay pool directory for pre-warmed VM overlays */
   overlayPool: (baseDir) => path.join(baseDir, "overlay-pool"),
   /** Workspaces directory for VM work directories */
@@ -41,16 +43,24 @@ var runnerPaths = {
   vmWorkDir: (baseDir, vmId) => path.join(baseDir, "workspaces", `${VM_WORKSPACE_PREFIX}${vmId}`),
   /** Runner status file */
   statusFile: (baseDir) => path.join(baseDir, "status.json"),
+  /** Snapshot generation work directory */
+  snapshotWorkDir: (baseDir) => path.join(baseDir, "workspaces", ".snapshot-work"),
   /** Check if a directory name is a VM workspace */
   isVmWorkspace: (dirname) => dirname.startsWith(VM_WORKSPACE_PREFIX),
   /** Extract vmId from workspace directory name */
   extractVmId: (dirname) => createVmId(dirname.replace(VM_WORKSPACE_PREFIX, ""))
 };
 var vmPaths = {
-  /** Firecracker config file (used with --config-file --no-api) */
+  /** Firecracker config file (used with --config-file) */
   config: (workDir) => path.join(workDir, "config.json"),
-  /** Vsock UDS for host-guest communication */
-  vsock: (workDir) => path.join(workDir, "vsock.sock")
+  /** Vsock directory for host-guest communication */
+  vsockDir: (workDir) => path.join(workDir, "vsock"),
+  /** Vsock UDS path for host-guest communication */
+  vsock: (workDir) => path.join(workDir, "vsock", "vsock.sock"),
+  /** Firecracker API socket (used with --api-sock) */
+  apiSock: (workDir) => path.join(workDir, "api.sock"),
+  /** Overlay filesystem for VM writes */
+  overlay: (workDir) => path.join(workDir, "overlay.ext4")
 };
 var tempPaths = {
   /** Default proxy CA directory */
@@ -325,15 +335,16 @@ async function subscribeToJobs(server, group, onJob, onConnectionChange) {
   };
 }
 
+// src/lib/executor.ts
+import fs9 from "fs";
+
 // src/lib/firecracker/vm.ts
 import { spawn } from "child_process";
 import fs4 from "fs";
 import readline from "readline";
 
 // src/lib/firecracker/netns-pool.ts
-import { exec } from "child_process";
 import path2 from "path";
-import { promisify } from "util";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";
 import { z as z3 } from "zod";
 
@@ -377,9 +388,25 @@ async function withFileLock(path7, fn, options) {
   }
 }
 
-// src/lib/firecracker/netns-pool.ts
+// src/lib/utils/exec.ts
+import { exec } from "child_process";
+import { promisify } from "util";
 var execAsync = promisify(exec);
-var logger = createLogger("NetnsPool");
+async function execCommand(cmd, sudo = true) {
+  const fullCmd = sudo ? `sudo ${cmd}` : cmd;
+  try {
+    const { stdout } = await execAsync(fullCmd);
+    return stdout.trim();
+  } catch (error) {
+    const execError = error;
+    throw new Error(
+      `Command failed: ${fullCmd}
+${execError.stderr || execError.message}`
+    );
+  }
+}
+
+// src/lib/firecracker/netns.ts
 var SNAPSHOT_NETWORK = {
   /** TAP device name inside namespace (must match Firecracker config) */
   tapName: "vm0-tap",
@@ -394,14 +421,28 @@ var SNAPSHOT_NETWORK = {
   /** CIDR prefix length (for ip commands) */
   prefixLen: 29
 };
-var VETH_NS = "veth0";
-var NS_PREFIX = "vm0-ns-";
-var VETH_PREFIX = "vm0-ve-";
-var VETH_IP_PREFIX = "10.200";
 function generateSnapshotNetworkBootArgs() {
   const { guestIp, gatewayIp, netmask } = SNAPSHOT_NETWORK;
   return `ip=${guestIp}::${gatewayIp}:${netmask}:vm0-guest:eth0:off`;
 }
+async function createNetnsWithTap(nsName, tap) {
+  await execCommand(`ip netns add ${nsName}`);
+  await execCommand(
+    `ip netns exec ${nsName} ip tuntap add ${tap.tapName} mode tap`
+  );
+  await execCommand(
+    `ip netns exec ${nsName} ip addr add ${tap.gatewayIpWithPrefix} dev ${tap.tapName}`
+  );
+  await execCommand(`ip netns exec ${nsName} ip link set ${tap.tapName} up`);
+  await execCommand(`ip netns exec ${nsName} ip link set lo up`);
+}
+
+// src/lib/firecracker/netns-pool.ts
+var logger = createLogger("NetnsPool");
+var VETH_NS = "veth0";
+var NS_PREFIX = "vm0-ns-";
+var VETH_PREFIX = "vm0-ve-";
+var VETH_IP_PREFIX = "10.200";
 var MAX_RUNNERS = 64;
 var MAX_NAMESPACES_PER_RUNNER = 256;
 var NamespaceEntrySchema = z3.object({
@@ -459,19 +500,6 @@ var RegistryFile = class {
     });
   }
 };
-async function execCommand(cmd, sudo = true) {
-  const fullCmd = sudo ? `sudo ${cmd}` : cmd;
-  try {
-    const { stdout } = await execAsync(fullCmd);
-    return stdout.trim();
-  } catch (error) {
-    const execError = error;
-    throw new Error(
-      `Command failed: ${fullCmd}
-${execError.stderr || execError.message}`
-    );
-  }
-}
 async function getDefaultInterface() {
   const result = await execCommand("ip route get 8.8.8.8", false);
   const match = result.match(/dev\s+(\S+)/);
@@ -694,16 +722,10 @@ var NetnsPool = class _NetnsPool {
     });
     logger.log(`Creating namespace ${name}...`);
     try {
-      await execCommand(`ip netns add ${name}`);
-      await execCommand(
-        `ip netns exec ${name} ip tuntap add ${SNAPSHOT_NETWORK.tapName} mode tap`
-      );
-      await execCommand(
-        `ip netns exec ${name} ip addr add ${SNAPSHOT_NETWORK.gatewayIp}/${SNAPSHOT_NETWORK.prefixLen} dev ${SNAPSHOT_NETWORK.tapName}`
-      );
-      await execCommand(
-        `ip netns exec ${name} ip link set ${SNAPSHOT_NETWORK.tapName} up`
-      );
+      await createNetnsWithTap(name, {
+        tapName: SNAPSHOT_NETWORK.tapName,
+        gatewayIpWithPrefix: `${SNAPSHOT_NETWORK.gatewayIp}/${SNAPSHOT_NETWORK.prefixLen}`
+      });
       await execCommand(
         `ip link add ${vethHost} type veth peer name ${VETH_NS} netns ${name}`
       );
@@ -711,7 +733,6 @@ var NetnsPool = class _NetnsPool {
         `ip netns exec ${name} ip addr add ${vethNsIp}/30 dev ${VETH_NS}`
       );
       await execCommand(`ip netns exec ${name} ip link set ${VETH_NS} up`);
-      await execCommand(`ip netns exec ${name} ip link set lo up`);
       await execCommand(`ip addr add ${vethHostIp}/30 dev ${vethHost}`);
       await execCommand(`ip link set ${vethHost} up`);
       await execCommand(
@@ -878,7 +899,7 @@ import { promisify as promisify2 } from "util";
 var execAsync2 = promisify2(exec2);
 var logger2 = createLogger("OverlayPool");
 var OVERLAY_SIZE = 2 * 1024 * 1024 * 1024;
-async function defaultCreateFile(filePath) {
+async function createOverlayFile(filePath) {
   const fd = fs2.openSync(filePath, "w");
   fs2.ftruncateSync(fd, OVERLAY_SIZE);
   fs2.closeSync(fd);
@@ -894,7 +915,7 @@ var OverlayPool = class {
       size: config.size,
       replenishThreshold: config.replenishThreshold,
       poolDir: config.poolDir,
-      createFile: config.createFile ?? defaultCreateFile
+      createFile: config.createFile ?? createOverlayFile
     };
   }
   /**
@@ -903,19 +924,6 @@ var OverlayPool = class {
   generateFileName() {
     return `overlay-${randomUUID()}.ext4`;
   }
-  /**
-   * Ensure the pool directory exists
-   */
-  async ensurePoolDir() {
-    const parentDir = path3.dirname(this.config.poolDir);
-    if (!fs2.existsSync(parentDir)) {
-      await execAsync2(`sudo mkdir -p ${parentDir}`);
-      await execAsync2(`sudo chmod 777 ${parentDir}`);
-    }
-    if (!fs2.existsSync(this.config.poolDir)) {
-      fs2.mkdirSync(this.config.poolDir, { recursive: true });
-    }
-  }
   /**
    * Scan pool directory for overlay files
    */
@@ -969,7 +977,7 @@ var OverlayPool = class {
     logger2.log(
       `Initializing overlay pool (size=${this.config.size}, threshold=${this.config.replenishThreshold})...`
     );
-    await this.ensurePoolDir();
+    fs2.mkdirSync(this.config.poolDir, { recursive: true });
     const existing = this.scanPoolDir();
     if (existing.length > 0) {
       logger2.log(`Cleaning up ${existing.length} stale overlay(s)`);
@@ -1081,6 +1089,36 @@ var FirecrackerClient = class {
   constructor(socketPath) {
     this.socketPath = socketPath;
   }
+  /**
+   * Configure machine settings (vCPUs, memory)
+   */
+  async configureMachine(config) {
+    await this.put("/machine-config", config);
+  }
+  /**
+   * Configure boot source (kernel, boot args)
+   */
+  async configureBootSource(config) {
+    await this.put("/boot-source", config);
+  }
+  /**
+   * Configure network interface
+   */
+  async configureNetworkInterface(config) {
+    await this.put(`/network-interfaces/${config.iface_id}`, config);
+  }
+  /**
+   * Configure vsock device
+   */
+  async configureVsock(config) {
+    await this.put("/vsock", config);
+  }
+  /**
+   * Start the VM instance
+   */
+  async startInstance() {
+    await this.put("/actions", { action_type: "InstanceStart" });
+  }
   /**
    * Pause the VM
    *
@@ -1177,17 +1215,27 @@ var FirecrackerClient = class {
    */
   request(method, path7, body, timeoutMs = 3e4) {
     return new Promise((resolve, reject) => {
+      const bodyStr = body !== void 0 ? JSON.stringify(body) : void 0;
+      const headers = {
+        Accept: "application/json",
+        // Disable keep-alive to prevent pipelining issues
+        Connection: "close"
+      };
+      if (bodyStr !== void 0) {
+        headers["Content-Type"] = "application/json";
+        headers["Content-Length"] = Buffer.byteLength(bodyStr);
+      }
       const options = {
         socketPath: this.socketPath,
-        path: `http://localhost${path7}`,
+        path: path7,
         method,
-        headers: {
-          "Content-Type": "application/json",
-          Accept: "application/json"
-        },
-        timeout: timeoutMs
+        headers,
+        timeout: timeoutMs,
+        // Disable agent to ensure fresh connection for each request
+        // Firecracker's single-threaded API can have issues with pipelined requests
+        agent: false
       };
-      logger3.log(`${method} ${path7}${body ? " " + JSON.stringify(body) : ""}`);
+      logger3.log(`${method} ${path7}${bodyStr ? " " + bodyStr : ""}`);
       const req = http.request(options, (res) => {
         let data = "";
         res.on("data", (chunk) => {
@@ -1217,8 +1265,8 @@ var FirecrackerClient = class {
       req.on("error", (err) => {
         reject(err);
       });
-      if (body) {
-        req.write(JSON.stringify(body));
+      if (bodyStr !== void 0) {
+        req.write(bodyStr);
       }
       req.end();
     });
@@ -1231,6 +1279,58 @@ var FirecrackerClient = class {
   }
 };
 
+// src/lib/firecracker/config.ts
+function buildBootArgs() {
+  const networkBootArgs = generateSnapshotNetworkBootArgs();
+  return `console=ttyS0 reboot=k panic=1 pci=off nomodules random.trust_cpu=on quiet loglevel=0 nokaslr audit=0 numa=off mitigations=off noresume init=/sbin/vm-init ${networkBootArgs}`;
+}
+function buildFirecrackerConfig(params) {
+  const bootArgs = buildBootArgs();
+  return {
+    "boot-source": {
+      kernel_image_path: params.kernelPath,
+      boot_args: bootArgs
+    },
+    drives: [
+      // Base drive (squashfs, read-only, shared across VMs)
+      // Mounted as /dev/vda inside the VM
+      {
+        drive_id: "rootfs",
+        path_on_host: params.rootfsPath,
+        is_root_device: true,
+        is_read_only: true
+      },
+      // Overlay drive (ext4, read-write, per-VM)
+      // Mounted as /dev/vdb inside the VM
+      // The vm-init script combines these using overlayfs
+      {
+        drive_id: "overlay",
+        path_on_host: params.overlayPath,
+        is_root_device: false,
+        is_read_only: false
+      }
+    ],
+    "machine-config": {
+      vcpu_count: params.vcpus,
+      mem_size_mib: params.memoryMb
+    },
+    "network-interfaces": [
+      {
+        // Network interface uses fixed config from SNAPSHOT_NETWORK
+        // TAP device is inside the namespace, created by netns-pool
+        iface_id: "eth0",
+        guest_mac: SNAPSHOT_NETWORK.guestMac,
+        host_dev_name: SNAPSHOT_NETWORK.tapName
+      }
+    ],
+    // Guest CID 3 is the standard guest identifier (CID 0=hypervisor, 1=local, 2=host)
+    vsock: {
+      guest_cid: 3,
+      uds_path: params.vsockPath
+    }
+  };
+}
+
 // src/lib/firecracker/vm.ts
 var logger4 = createLogger("VM");
 var FirecrackerVM = class {
@@ -1295,7 +1395,6 @@ var FirecrackerVM = class {
       throw new Error(`Cannot start VM in state: ${this.state}`);
     }
     try {
-      fs4.mkdirSync(this.workDir, { recursive: true });
       logger4.log(`[VM ${this.config.vmId}] Acquiring resources...`);
       const results = await Promise.allSettled([
         acquireOverlay(),
@@ -1471,74 +1570,23 @@ var FirecrackerVM = class {
   }
   /**
    * Build Firecracker configuration object
-   *
-   * Creates the JSON configuration for Firecracker's --config-file option.
-   * Boot args:
-   *   - console=ttyS0: serial console output
-   *   - reboot=k: use keyboard controller for reboot
-   *   - panic=1: reboot after 1 second on kernel panic
-   *   - pci=off: disable PCI bus (not needed in microVM)
-   *   - nomodules: skip module loading (not needed in microVM)
-   *   - random.trust_cpu=on: trust CPU RNG, skip entropy wait
-   *   - quiet loglevel=0: minimize kernel log output
-   *   - nokaslr: disable kernel address space randomization
-   *   - audit=0: disable kernel auditing
-   *   - numa=off: disable NUMA (single node)
-   *   - mitigations=off: disable CPU vulnerability mitigations
-   *   - noresume: skip hibernation resume check
-   *   - init=/sbin/vm-init: use vm-init (Rust binary) for filesystem setup and vsock-agent
-   *   - ip=...: network configuration (fixed IPs from SNAPSHOT_NETWORK)
    */
   buildConfig() {
     if (!this.netns || !this.vmOverlayPath) {
       throw new Error("VM not properly initialized");
     }
-    const networkBootArgs = generateSnapshotNetworkBootArgs();
-    const bootArgs = `console=ttyS0 reboot=k panic=1 pci=off nomodules random.trust_cpu=on quiet loglevel=0 nokaslr audit=0 numa=off mitigations=off noresume init=/sbin/vm-init ${networkBootArgs}`;
-    logger4.log(`[VM ${this.config.vmId}] Boot args: ${bootArgs}`);
-    return {
-      "boot-source": {
-        kernel_image_path: this.config.kernelPath,
-        boot_args: bootArgs
-      },
-      drives: [
-        // Base drive (squashfs, read-only, shared across VMs)
-        // Mounted as /dev/vda inside the VM
-        {
-          drive_id: "rootfs",
-          path_on_host: this.config.rootfsPath,
-          is_root_device: true,
-          is_read_only: true
-        },
-        // Overlay drive (ext4, read-write, per-VM)
-        // Mounted as /dev/vdb inside the VM
-        // The vm-init script combines these using overlayfs
-        {
-          drive_id: "overlay",
-          path_on_host: this.vmOverlayPath,
-          is_root_device: false,
-          is_read_only: false
-        }
-      ],
-      "machine-config": {
-        vcpu_count: this.config.vcpus,
-        mem_size_mib: this.config.memoryMb
-      },
-      "network-interfaces": [
-        {
-          // Network interface uses fixed config from SNAPSHOT_NETWORK
-          // TAP device is inside the namespace, created by netns-pool
-          iface_id: "eth0",
-          guest_mac: SNAPSHOT_NETWORK.guestMac,
-          host_dev_name: SNAPSHOT_NETWORK.tapName
-        }
-      ],
-      // Guest CID 3 is the standard guest identifier (CID 0=hypervisor, 1=local, 2=host)
-      vsock: {
-        guest_cid: 3,
-        uds_path: this.vsockPath
-      }
-    };
+    const config = buildFirecrackerConfig({
+      kernelPath: this.config.kernelPath,
+      rootfsPath: this.config.rootfsPath,
+      overlayPath: this.vmOverlayPath,
+      vsockPath: this.vsockPath,
+      vcpus: this.config.vcpus,
+      memoryMb: this.config.memoryMb
+    });
+    logger4.log(
+      `[VM ${this.config.vmId}] Boot args: ${config["boot-source"].boot_args}`
+    );
+    return config;
   }
   /**
    * Stop the VM
@@ -7666,6 +7714,7 @@ var modelProviderTypeSchema = z18.enum([
   "openrouter-api-key",
   "moonshot-api-key",
   "minimax-api-key",
+  "deepseek-api-key",
   "aws-bedrock"
 ]);
 var modelProviderFrameworkSchema = z18.enum(["claude-code", "codex"]);
@@ -8931,7 +8980,7 @@ var FEATURE_SWITCHES = {
   },
   ["platformAgents" /* PlatformAgents */]: {
     maintainer: "ethan@vm0.ai",
-    enabled: false
+    enabled: true
   },
   ["platformSecrets" /* PlatformSecrets */]: {
     maintainer: "ethan@vm0.ai",
@@ -10039,6 +10088,13 @@ async function executeJob(context, config, options = {}) {
       firecrackerBinary: config.firecracker.binary,
       workDir: runnerPaths.vmWorkDir(config.base_dir, vmId)
     };
+    fs9.mkdirSync(vmConfig.workDir, { recursive: true });
+    fs9.mkdirSync(vmPaths.vsockDir(vmConfig.workDir), { recursive: true });
+    const vsockPath = vmPaths.vsock(vmConfig.workDir);
+    vsockClient = new VsockClient(vsockPath);
+    const guest = vsockClient;
+    logger9.log(`Starting vsock listener: ${vsockPath}`);
+    const guestConnectionPromise = guest.waitForGuestConnection(3e4);
     logger9.log(`Creating VM ${vmId}...`);
     vm = new FirecrackerVM(vmConfig);
     await withSandboxTiming("vm_create", () => vm.start());
@@ -10050,10 +10106,6 @@ async function executeJob(context, config, options = {}) {
     logger9.log(
       `VM ${vmId} started, guest IP: ${guestIp}, veth NS IP: ${vethNsIp}`
     );
-    const vsockPath = vm.getVsockPath();
-    vsockClient = new VsockClient(vsockPath);
-    const guest = vsockClient;
-    logger9.log(`Using vsock for guest communication: ${vsockPath}`);
     const envJson = JSON.stringify(
       buildEnvironmentVariables(context, config.server.url)
     );
@@ -10071,10 +10123,7 @@ async function executeJob(context, config, options = {}) {
       });
     }
     logger9.log(`Waiting for guest connection...`);
-    await withSandboxTiming(
-      "guest_wait",
-      () => guest.waitForGuestConnection(3e4)
-    );
+    await withSandboxTiming("guest_wait", () => guestConnectionPromise);
     logger9.log(`Guest client ready`);
     if (context.storageManifest) {
       await withSandboxTiming(
@@ -10277,24 +10326,11 @@ async function isPortInUse(port) {
 }
 
 // src/lib/runner/runner-lock.ts
-import { exec as exec4 } from "child_process";
-import fs9 from "fs";
+import fs10 from "fs";
 import path5 from "path";
-import { promisify as promisify4 } from "util";
-var execAsync4 = promisify4(exec4);
 var logger11 = createLogger("RunnerLock");
 var DEFAULT_PID_FILE = runtimePaths.runnerPid;
 var currentPidFile = null;
-async function ensureRunDir(dirPath, skipSudo) {
-  if (!fs9.existsSync(dirPath)) {
-    if (skipSudo) {
-      fs9.mkdirSync(dirPath, { recursive: true });
-    } else {
-      await execAsync4(`sudo mkdir -p ${dirPath}`);
-      await execAsync4(`sudo chmod 777 ${dirPath}`);
-    }
-  }
-}
 function isProcessRunning(pid) {
   try {
     process.kill(pid, 0);
@@ -10306,13 +10342,12 @@ function isProcessRunning(pid) {
     return false;
   }
 }
-async function acquireRunnerLock(options = {}) {
+function acquireRunnerLock(options = {}) {
   const pidFile = options.pidFile ?? DEFAULT_PID_FILE;
-  const skipSudo = options.skipSudo ?? false;
   const runDir = path5.dirname(pidFile);
-  await ensureRunDir(runDir, skipSudo);
-  if (fs9.existsSync(pidFile)) {
-    const pidStr = fs9.readFileSync(pidFile, "utf-8").trim();
+  fs10.mkdirSync(runDir, { recursive: true });
+  if (fs10.existsSync(pidFile)) {
+    const pidStr = fs10.readFileSync(pidFile, "utf-8").trim();
     const pid = parseInt(pidStr, 10);
     if (!isNaN(pid) && isProcessRunning(pid)) {
       logger11.error(`Error: Another runner is already running (PID ${pid})`);
@@ -10324,16 +10359,16 @@ async function acquireRunnerLock(options = {}) {
     } else {
       logger11.log(`Cleaning up stale PID file (PID ${pid} not running)`);
     }
-    fs9.unlinkSync(pidFile);
+    fs10.unlinkSync(pidFile);
   }
-  fs9.writeFileSync(pidFile, process.pid.toString());
+  fs10.writeFileSync(pidFile, process.pid.toString());
   currentPidFile = pidFile;
   logger11.log(`Runner lock acquired (PID ${process.pid})`);
 }
 function releaseRunnerLock() {
   const pidFile = currentPidFile ?? DEFAULT_PID_FILE;
-  if (fs9.existsSync(pidFile)) {
-    fs9.unlinkSync(pidFile);
+  if (fs10.existsSync(pidFile)) {
+    fs10.unlinkSync(pidFile);
     logger11.log("Runner lock released");
   }
   currentPidFile = null;
@@ -11205,7 +11240,7 @@ var benchmarkCommand = new Command4("benchmark").description(
 });
 
 // src/index.ts
-var version = true ? "3.11.0" : "0.1.0";
+var version = true ? "3.11.2" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/runner",
-  "version": "3.11.0",
+  "version": "3.11.2",
   "description": "Self-hosted runner for VM0 agents",
   "repository": {
     "type": "git",