@vm0/runner 3.19.1 → 3.19.2

package/index.js

@@ -3046,6 +3046,97 @@ async function uploadNetworkLogs(apiUrl, sandboxToken, runId) {
 
 // src/lib/executor/index.ts
 var logger9 = createLogger("Executor");
+function setupNetworkSecurity(context, vethNsIp) {
+  const firewallConfig = context.experimentalFirewall;
+  if (firewallConfig?.enabled) {
+    const mitmEnabled = firewallConfig.experimental_mitm ?? false;
+    const sealSecretsEnabled = firewallConfig.experimental_seal_secrets ?? false;
+    logger9.log(
+      `Setting up network security for VM ${vethNsIp} (mitm=${mitmEnabled}, sealSecrets=${sealSecretsEnabled})`
+    );
+    getVMRegistry().register(vethNsIp, context.runId, context.sandboxToken, {
+      firewallRules: firewallConfig?.rules,
+      mitmEnabled,
+      sealSecretsEnabled
+    });
+  }
+}
+async function prepareGuest(guest, context, config) {
+  if (config.firecracker.snapshot) {
+    const timestamp = (Date.now() / 1e3).toFixed(3);
+    await guest.execAsRoot(`date -s "@${timestamp}"`);
+  }
+  if (context.storageManifest) {
+    await withSandboxTiming(
+      "storage_download",
+      () => downloadStorages(guest, context.storageManifest)
+    );
+  }
+  if (context.resumeSession) {
+    await withSandboxTiming(
+      "session_restore",
+      () => restoreSessionHistory(
+        guest,
+        context.resumeSession,
+        context.workingDir,
+        context.cliAgentType || "claude-code"
+      )
+    );
+  }
+}
+async function checkForOOM(guest, exitCode, durationMs) {
+  if (exitCode === 137 || exitCode === 9) {
+    const dmesgCheck = await guest.exec(
+      `sudo dmesg | tail -20 | grep -iE "killed|oom" 2>/dev/null`
+    );
+    if (dmesgCheck.stdout.toLowerCase().includes("oom") || dmesgCheck.stdout.toLowerCase().includes("killed")) {
+      logger9.log(`OOM detected: ${dmesgCheck.stdout}`);
+      recordOperation({
+        actionType: "agent_execute",
+        durationMs,
+        success: false
+      });
+      return {
+        exitCode: 1,
+        error: "Agent process killed by OOM killer"
+      };
+    }
+  }
+  return null;
+}
+async function cleanupJob(context, options, config, vethNsIp, vm, vsockClient, vmId) {
+  if (context.experimentalFirewall?.enabled && vethNsIp) {
+    logger9.log(`Cleaning up network security for VM ${vethNsIp}`);
+    getVMRegistry().unregister(vethNsIp);
+    if (!options.benchmarkMode) {
+      try {
+        await uploadNetworkLogs(
+          config.server.url,
+          context.sandboxToken,
+          context.runId
+        );
+      } catch (err) {
+        logger9.error(
+          `Failed to upload network logs: ${err instanceof Error ? err.message : "Unknown error"}`
+        );
+      }
+    }
+  }
+  if (vm) {
+    if (vsockClient) {
+      const acked = await vsockClient.shutdown(2e3);
+      if (acked) {
+        logger9.log(`Guest acknowledged shutdown`);
+      } else {
+        logger9.log(`Guest shutdown timeout, proceeding with SIGKILL`);
+      }
+      vsockClient.close();
+    }
+    logger9.log(`Cleaning up VM ${vmId}...`);
+    await withSandboxTiming("cleanup", () => vm.kill());
+  }
+  await clearSandboxContext();
+}
 async function executeJob(context, config, options = {}) {
   setSandboxContext({
     apiUrl: config.server.url,
@@ -3109,43 +3200,11 @@ async function executeJob(context, config, options = {}) {
       `VM ${vmId} started, guest IP: ${guestIp}, veth NS IP: ${vethNsIp}`
     );
     const envVars = buildEnvironmentVariables(context, config.server.url);
-    const firewallConfig = context.experimentalFirewall;
-    if (firewallConfig?.enabled) {
-      const mitmEnabled = firewallConfig.experimental_mitm ?? false;
-      const sealSecretsEnabled = firewallConfig.experimental_seal_secrets ?? false;
-      logger9.log(
-        `Setting up network security for VM ${vethNsIp} (mitm=${mitmEnabled}, sealSecrets=${sealSecretsEnabled})`
-      );
-      getVMRegistry().register(vethNsIp, context.runId, context.sandboxToken, {
-        firewallRules: firewallConfig?.rules,
-        mitmEnabled,
-        sealSecretsEnabled
-      });
-    }
+    setupNetworkSecurity(context, vethNsIp);
     logger9.log(`Waiting for guest connection...`);
     await withSandboxTiming("guest_wait", () => guestConnectionPromise);
     logger9.log(`Guest client ready`);
-    if (config.firecracker.snapshot) {
-      const timestamp = (Date.now() / 1e3).toFixed(3);
-      await guest.execAsRoot(`date -s "@${timestamp}"`);
-    }
-    if (context.storageManifest) {
-      await withSandboxTiming(
-        "storage_download",
-        () => downloadStorages(guest, context.storageManifest)
-      );
-    }
-    if (context.resumeSession) {
-      await withSandboxTiming(
-        "session_restore",
-        () => restoreSessionHistory(
-          guest,
-          context.resumeSession,
-          context.workingDir,
-          context.cliAgentType || "claude-code"
-        )
-      );
-    }
+    await prepareGuest(guest, context, config);
     const systemLogFile = `/tmp/vm0-system-${context.runId}.log`;
     const startTime = Date.now();
     const maxWaitMs = 2 * 60 * 60 * 1e3;
@@ -3182,23 +3241,8 @@ async function executeJob(context, config, options = {}) {
     }
     const durationMs = Date.now() - startTime;
     const duration = Math.round(durationMs / 1e3);
-    if (exitCode === 137 || exitCode === 9) {
-      const dmesgCheck = await guest.exec(
-        `sudo dmesg | tail -20 | grep -iE "killed|oom" 2>/dev/null`
-      );
-      if (dmesgCheck.stdout.toLowerCase().includes("oom") || dmesgCheck.stdout.toLowerCase().includes("killed")) {
-        logger9.log(`OOM detected: ${dmesgCheck.stdout}`);
-        recordOperation({
-          actionType: "agent_execute",
-          durationMs,
-          success: false
-        });
-        return {
-          exitCode: 1,
-          error: "Agent process killed by OOM killer"
-        };
-      }
-    }
+    const oomResult = await checkForOOM(guest, exitCode, durationMs);
+    if (oomResult) return oomResult;
     recordOperation({
       actionType: "agent_execute",
       durationMs,
@@ -3222,37 +3266,7 @@ async function executeJob(context, config, options = {}) {
       error: errorMsg
     };
   } finally {
-    if (context.experimentalFirewall?.enabled && vethNsIp) {
-      logger9.log(`Cleaning up network security for VM ${vethNsIp}`);
-      getVMRegistry().unregister(vethNsIp);
-      if (!options.benchmarkMode) {
-        try {
-          await uploadNetworkLogs(
-            config.server.url,
-            context.sandboxToken,
-            context.runId
-          );
-        } catch (err) {
-          logger9.error(
-            `Failed to upload network logs: ${err instanceof Error ? err.message : "Unknown error"}`
-          );
-        }
-      }
-    }
-    if (vm) {
-      if (vsockClient) {
-        const acked = await vsockClient.shutdown(2e3);
-        if (acked) {
-          logger9.log(`Guest acknowledged shutdown`);
-        } else {
-          logger9.log(`Guest shutdown timeout, proceeding with SIGKILL`);
-        }
-        vsockClient.close();
-      }
-      logger9.log(`Cleaning up VM ${vmId}...`);
-      await withSandboxTiming("cleanup", () => vm.kill());
-    }
-    await clearSandboxContext();
+    await cleanupJob(context, options, config, vethNsIp, vm, vsockClient, vmId);
   }
 }
 
@@ -4681,7 +4695,7 @@ var snapshotCommand = new Command5("snapshot").description("Generate a Firecrack
 );
 
 // src/index.ts
-var version = true ? "3.19.1" : "0.1.0";
+var version = true ? "3.19.2" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(doctorCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/runner",
-  "version": "3.19.1",
+  "version": "3.19.2",
   "description": "Self-hosted runner for VM0 agents",
   "repository": {
     "type": "git",