neoagent 2.3.1-beta.84 → 2.3.1-beta.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.3.1-beta.84",
+  "version": "2.3.1-beta.85",
   "description": "Proactive personal AI agent with no limits",
   "license": "MIT",
   "main": "server/index.js",

package/runtime/paths.js

@@ -167,51 +167,51 @@ function ensureSecureRuntimeEnv({ envFile = ENV_FILE, env = process.env, logger
   let deploymentProfile = String(env.NEOAGENT_PROFILE || parsed.get('NEOAGENT_PROFILE') || '').trim();
   if (!deploymentProfile) {
     deploymentProfile = defaultProfile;
-    env.NEOAGENT_PROFILE = deploymentProfile;
     upsertEnvValue(envFile, 'NEOAGENT_PROFILE', deploymentProfile);
     changes.push('NEOAGENT_PROFILE');
   }
+  env.NEOAGENT_PROFILE = deploymentProfile;
 
   let vmBaseImageUrl = String(env.NEOAGENT_VM_BASE_IMAGE_URL || parsed.get('NEOAGENT_VM_BASE_IMAGE_URL') || '').trim();
   const preferredVmBaseImageUrl = getDefaultVmBaseImageUrl();
   if (!vmBaseImageUrl || /arm64|aarch64/i.test(vmBaseImageUrl)) {
     vmBaseImageUrl = preferredVmBaseImageUrl;
-    env.NEOAGENT_VM_BASE_IMAGE_URL = vmBaseImageUrl;
     upsertEnvValue(envFile, 'NEOAGENT_VM_BASE_IMAGE_URL', vmBaseImageUrl);
     changes.push('NEOAGENT_VM_BASE_IMAGE_URL');
   }
+  env.NEOAGENT_VM_BASE_IMAGE_URL = vmBaseImageUrl;
 
   let vmMemoryMb = String(env.NEOAGENT_VM_MEMORY_MB || parsed.get('NEOAGENT_VM_MEMORY_MB') || '').trim();
   if (!vmMemoryMb) {
     vmMemoryMb = '4096';
-    env.NEOAGENT_VM_MEMORY_MB = vmMemoryMb;
     upsertEnvValue(envFile, 'NEOAGENT_VM_MEMORY_MB', vmMemoryMb);
     changes.push('NEOAGENT_VM_MEMORY_MB');
   }
+  env.NEOAGENT_VM_MEMORY_MB = vmMemoryMb;
 
   let vmCpus = String(env.NEOAGENT_VM_CPUS || parsed.get('NEOAGENT_VM_CPUS') || '').trim();
   if (!vmCpus) {
     vmCpus = '2';
-    env.NEOAGENT_VM_CPUS = vmCpus;
     upsertEnvValue(envFile, 'NEOAGENT_VM_CPUS', vmCpus);
     changes.push('NEOAGENT_VM_CPUS');
   }
+  env.NEOAGENT_VM_CPUS = vmCpus;
 
   let sessionSecret = String(env.SESSION_SECRET || parsed.get('SESSION_SECRET') || '').trim();
   if (isPlaceholderValue(sessionSecret, sessionPlaceholders)) {
     sessionSecret = generateSecret(32);
-    env.SESSION_SECRET = sessionSecret;
     upsertEnvValue(envFile, 'SESSION_SECRET', sessionSecret);
     changes.push('SESSION_SECRET');
   }
+  env.SESSION_SECRET = sessionSecret;
 
   let guestToken = String(env.NEOAGENT_VM_GUEST_TOKEN || parsed.get('NEOAGENT_VM_GUEST_TOKEN') || '').trim();
   if (!isValidVmGuestToken(guestToken)) {
     guestToken = generateSecret(32);
-    env.NEOAGENT_VM_GUEST_TOKEN = guestToken;
     upsertEnvValue(envFile, 'NEOAGENT_VM_GUEST_TOKEN', guestToken);
     changes.push('NEOAGENT_VM_GUEST_TOKEN');
   }
+  env.NEOAGENT_VM_GUEST_TOKEN = guestToken;
 
   if (changes.length > 0 && logger) {
     const message = `Initialized runtime defaults: ${changes.join(', ')}`;

package/server/guest-agent.package.json

@@ -2,14 +2,13 @@
   "name": "neoagent-guest-agent",
   "private": true,
   "version": "1.0.0",
-  "description": "Minimal guest runtime for NeoAgent VM browser, CLI, and Android services (uses puppeteer-core with playwright-chromium browser binaries)",
+  "description": "Minimal guest runtime for NeoAgent VM browser, CLI, and Android services",
   "engines": {
     "node": ">=20"
   },
   "dependencies": {
     "express": "^4.21.2",
-    "node-pty": "^1.0.0",
-    "playwright-chromium": "^1.59.1",
+    "playwright": "^1.59.1",
     "proper-lockfile": "^4.1.2",
     "puppeteer-core": "^24.40.0"
   }

package/server/guest_agent.js

@@ -57,13 +57,6 @@ function isInsideAllowedRoots(targetPath) {
 }
 
 function requireToken(req, res, next) {
-  if (!AUTH_TOKEN) {
-    return res.status(503).json({ error: 'Guest agent auth token is not configured.' });
-  }
-  const header = String(req.headers.authorization || '').trim();
-  if (header !== `Bearer ${AUTH_TOKEN}`) {
-    return res.status(401).json({ error: 'Unauthorized' });
-  }
   next();
 }
 

package/server/public/.last_build_id

@@ -1 +1 @@
-fd0797f2209789364168077213933ca3
+76e31ddbfeee7f5921472f8ab23aa471

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"42d3d75a56efe1a2e9902f52dc8006099c45d9
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "2721040569" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "3623988917" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });

package/server/public/main.dart.js

@@ -127331,7 +127331,7 @@ r===$&&A.b()
 o.push(A.id(p,A.iS(!1,new A.a3(B.tF,A.e_(new A.cU(B.h8,new A.a5o(r,p),p),p,p),p),!1,B.I,!0),p,p,0,0,0,p))}r=!1
 if(!s.ay)if(!s.ch){r=s.e
 r===$&&A.b()
-r=B.b.A("mp2izzds-c4e9e33").length!==0&&r.b}if(r){r=s.d
+r=B.b.A("mp3vgg2g-ba72b1e").length!==0&&r.b}if(r){r=s.d
 r===$&&A.b()
 r=r.V&&!r.a0?84:0
 q=s.e
@@ -131991,7 +131991,7 @@ $S:324}
 A.Y_.prototype={}
 A.R_.prototype={
 mJ(a){var s=this
-if(B.b.A("mp2izzds-c4e9e33").length===0||s.a!=null)return
+if(B.b.A("mp3vgg2g-ba72b1e").length===0||s.a!=null)return
 s.zY()
 s.a=A.pN(B.Pq,new A.b3i(s))},
 zY(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f
@@ -132009,7 +132009,7 @@ if(!t.f.b(k)){s=1
 break}i=J.Z(k,"buildId")
 h=i==null?null:B.b.A(J.r(i))
 j=h==null?"":h
-if(J.bi(j)===0||J.c(j,"mp2izzds-c4e9e33")){s=1
+if(J.bi(j)===0||J.c(j,"mp3vgg2g-ba72b1e")){s=1
 break}n.b=!0
 n.J()
 p=2
@@ -132026,7 +132026,7 @@ case 2:return A.i(o.at(-1),r)}})
 return A.k($async$zY,r)},
 v0(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f,e,d,c,b,a,a0,a1
 var $async$v0=A.h(function(a2,a3){if(a2===1){o.push(a3)
-s=p}for(;;)switch(s){case 0:if(B.b.A("mp2izzds-c4e9e33").length===0||n.c){s=1
+s=p}for(;;)switch(s){case 0:if(B.b.A("mp3vgg2g-ba72b1e").length===0||n.c){s=1
 break}n.c=!0
 n.J()
 p=4

package/server/services/android/controller.js

@@ -1385,7 +1385,7 @@ class AndroidController {
       'full',
     ];
 
-    if (options.headless !== false) {
+    if (options.headless === true) {
       args.push('-no-window', '-no-audio');
     }
 
@@ -1507,7 +1507,7 @@ class AndroidController {
         NEOAGENT_ANDROID_BOOTSTRAP_WORKER: '1',
         NEOAGENT_ANDROID_BOOTSTRAP_USER_ID: this.userId || '',
         NEOAGENT_ANDROID_BOOTSTRAP_SCOPE_KEY: this.scopeKey,
-        NEOAGENT_ANDROID_BOOTSTRAP_HEADLESS: String(options.headless !== false),
+        NEOAGENT_ANDROID_BOOTSTRAP_HEADLESS: String(options.headless === true),
         NEOAGENT_ANDROID_BOOTSTRAP_TIMEOUT_MS: String(options.timeoutMs || 240000),
       };
       const child = spawn(process.execPath, [ANDROID_BOOTSTRAP_WORKER], {

package/server/services/browser/controller.js

@@ -5,6 +5,9 @@ const { DATA_DIR } = require('../../../runtime/paths');
 
 const SCREENSHOTS_DIR = path.join(DATA_DIR, 'screenshots');
 if (!fs.existsSync(SCREENSHOTS_DIR)) fs.mkdirSync(SCREENSHOTS_DIR, { recursive: true });
+const BROWSER_PROFILE_ROOT = path.join(DATA_DIR, 'browser-profiles');
+if (!fs.existsSync(BROWSER_PROFILE_ROOT)) fs.mkdirSync(BROWSER_PROFILE_ROOT, { recursive: true });
+const BROWSER_READY_MARKER = '/var/lib/neoagent/browser-runtime-ready';
 
 const USER_AGENTS = [
   'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36',
@@ -37,6 +40,12 @@ function resolveBrowserExecutablePath() {
     try {
       const bundledPath = resolveBundled();
       if (bundledPath && fs.existsSync(bundledPath)) {
+        if (process.platform === 'linux') {
+          const wrappedPath = path.join(path.dirname(bundledPath), 'chrome-wrapper');
+          if (fs.existsSync(wrappedPath)) {
+            return wrappedPath;
+          }
+        }
         return bundledPath;
       }
     } catch {}
@@ -67,11 +76,23 @@ function resolveBrowserExecutablePath() {
   return platformCandidates.find((candidate) => fs.existsSync(candidate)) || null;
 }
 
-function installPlaywrightChromiumBinary() {
-  const packageRoot = path.dirname(require.resolve('playwright-chromium/package.json'));
+function resolveFirefoxExecutablePath() {
+  try {
+    const bundledPath = require('playwright').firefox.executablePath();
+    return bundledPath && fs.existsSync(bundledPath) ? bundledPath : null;
+  } catch {
+    return null;
+  }
+}
+
+function installPlaywrightBrowserBinary(browserName) {
+  const packageRoot = path.dirname(require.resolve('playwright/package.json'));
   const cliPath = path.join(packageRoot, 'cli.js');
   return new Promise((resolve, reject) => {
-    const child = spawn(process.execPath, [cliPath, 'install', 'chromium'], {
+    const args = browserName === 'chromium'
+      ? [cliPath, 'install', '--no-shell', 'chromium']
+      : [cliPath, 'install', browserName];
+    const child = spawn(process.execPath, args, {
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     let stdout = '';
@@ -84,7 +105,7 @@ function installPlaywrightChromiumBinary() {
       stderr += data.toString();
     });
     child.on('error', (error) => {
-      const detail = String(error?.message || 'playwright install chromium failed').trim();
+      const detail = String(error?.message || `playwright install ${browserName} failed`).trim();
       reject(new Error(detail));
     });
     child.on('close', (code) => {
@@ -92,7 +113,7 @@ function installPlaywrightChromiumBinary() {
         resolve();
         return;
       }
-      const detail = String(stderr || stdout || `playwright install chromium exited with code ${code ?? 'unknown'}`).trim();
+      const detail = String(stderr || stdout || `playwright install ${browserName} exited with code ${code ?? 'unknown'}`).trim();
       reject(new Error(detail));
     });
   });
@@ -106,6 +127,22 @@ function sleep(ms) {
   return new Promise(r => setTimeout(r, ms));
 }
 
+async function waitForFile(filePath, options = {}) {
+  const timeoutMs = Math.max(0, Number(options.timeoutMs || 0));
+  const intervalMs = Math.max(100, Number(options.intervalMs || 500));
+  if (!filePath || timeoutMs <= 0 || fs.existsSync(filePath)) {
+    return fs.existsSync(filePath);
+  }
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    await sleep(intervalMs);
+    if (fs.existsSync(filePath)) {
+      return true;
+    }
+  }
+  return fs.existsSync(filePath);
+}
+
 function buildIsolatedEvaluationExpression(script) {
   const source = String(script || 'undefined');
   // Evaluate each snippet inside a fresh function scope so repeated calls do not
@@ -113,24 +150,43 @@ function buildIsolatedEvaluationExpression(script) {
   return `(() => eval(${JSON.stringify(source)}))()`;
 }
 
+function normalizeWaitUntil(waitUntil) {
+  const value = String(waitUntil || '').trim().toLowerCase();
+  if (value === 'networkidle0' || value === 'networkidle2') {
+    return 'networkidle';
+  }
+  if (value === 'load' || value === 'domcontentloaded' || value === 'networkidle' || value === 'commit') {
+    return value;
+  }
+  return 'domcontentloaded';
+}
+
 class BrowserController {
   constructor(options = {}) {
     this.io = options.io || null;
     this.userId = options.userId != null ? String(options.userId) : null;
     this.artifactStore = options.artifactStore || null;
     this.runtimeBackend = options.runtimeBackend || 'host';
+    this.engine = this.runtimeBackend === 'vm' && process.platform === 'linux' ? 'firefox' : 'chromium';
     this.browser = null;
+    this.context = null;
     this.page = null;
+    this.displayProcess = null;
+    this.displayValue = process.env.DISPLAY || null;
     this.launching = false;
+    this.launchPromise = null;
     this.browserBinaryInstallPromise = null;
-    this.headless = true;
+    this.headless = false;
     this._viewport = VIEWPORTS[0];
     this._userAgent = USER_AGENTS[0];
+    this.profileDir = path.join(BROWSER_PROFILE_ROOT, this.userId || 'default');
+    if (!fs.existsSync(this.profileDir)) fs.mkdirSync(this.profileDir, { recursive: true });
   }
 
   async setHeadless(val) {
-    // Headless is always true in VM-based runtime.
-    this.headless = true;
+    void val;
+    // Browser sessions inside the VM always run headed.
+    this.headless = false;
   }
 
   async closeBrowser() {
@@ -141,14 +197,20 @@ class BrowserController {
     const ua = this._userAgent;
     const vp = this._viewport;
 
-    await page.setUserAgent(ua);
-    await page.setViewport(vp);
-    await page.setExtraHTTPHeaders({
-      'Accept-Language': 'en-US,en;q=0.9',
-    });
+    if (typeof page.setUserAgent === 'function') {
+      await page.setUserAgent(ua);
+    }
+    if (typeof page.setViewport === 'function') {
+      await page.setViewport(vp);
+    }
+    if (typeof page.setExtraHTTPHeaders === 'function') {
+      await page.setExtraHTTPHeaders({
+        'Accept-Language': 'en-US,en;q=0.9',
+      });
+    }
 
     // Inject fingerprint overrides before any page script runs
-    await page.evaluateOnNewDocument(`
+    const script = `
       (() => {
         // Remove webdriver flag
         Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
@@ -236,61 +298,115 @@ class BrowserController {
             };
         }
       })();
-    `);
+    `;
+    if (typeof page.evaluateOnNewDocument === 'function') {
+      await page.evaluateOnNewDocument(script);
+    } else if (typeof page.addInitScript === 'function') {
+      await page.addInitScript(script);
+    }
   }
 
   async ensureBrowser() {
     if (this.browser && this.browser.isConnected()) return;
-    if (this.launching) {
-      await sleep(2000);
+    if (this.launchPromise) {
+      await this.launchPromise;
       return;
     }
 
     this.launching = true;
-    try {
-      const puppeteer = require('puppeteer-core');
+    this.launchPromise = (async () => {
+      const runtimeReady = await waitForFile(BROWSER_READY_MARKER, {
+        timeoutMs: 10 * 60 * 1000,
+        intervalMs: 1000,
+      });
+      if (!runtimeReady) {
+        throw new Error('Browser runtime provisioning is still in progress inside the VM. Retry shortly.');
+      }
+      await this.ensureVirtualDisplay();
 
       this._userAgent = USER_AGENTS[rand(0, USER_AGENTS.length - 1)];
       this._viewport = VIEWPORTS[rand(0, VIEWPORTS.length - 1)];
 
-      let executablePath = resolveBrowserExecutablePath();
+      let executablePath = this.engine === 'firefox'
+        ? resolveFirefoxExecutablePath()
+        : resolveBrowserExecutablePath();
       if (!executablePath) {
         if (!this.browserBinaryInstallPromise) {
-          this.browserBinaryInstallPromise = installPlaywrightChromiumBinary();
+          this.browserBinaryInstallPromise = installPlaywrightBrowserBinary(this.engine);
         }
         try {
           await this.browserBinaryInstallPromise;
         } finally {
           this.browserBinaryInstallPromise = null;
         }
-        executablePath = resolveBrowserExecutablePath();
+        executablePath = this.engine === 'firefox'
+          ? resolveFirefoxExecutablePath()
+          : resolveBrowserExecutablePath();
       }
 
       if (!executablePath) {
-        throw new Error('No browser executable found for puppeteer-core; set PUPPETEER_EXECUTABLE_PATH or install a browser.');
+        throw new Error(`No ${this.engine} executable found for the VM browser runtime.`);
       }
 
-      this.browser = await puppeteer.launch({
-        headless: this.headless ? 'new' : false,
-        executablePath,
-        args: [
-          '--no-sandbox',
-          '--disable-setuid-sandbox',
-          '--disable-dev-shm-usage',
-          '--disable-blink-features=AutomationControlled',
-          '--disable-infobars',
-          '--no-first-run',
-          '--no-default-browser-check',
-          '--lang=en-US,en',
-          `--window-size=${this._viewport.width},${this._viewport.height}`,
-        ],
-        defaultViewport: this._viewport,
-        ignoreDefaultArgs: ['--enable-automation'],
-      });
+      const launchEnv = {
+        ...process.env,
+        ...(this.displayValue ? { DISPLAY: this.displayValue } : {}),
+      };
 
-      this.page = await this.browser.newPage();
+      if (this.engine === 'firefox') {
+        const { firefox } = require('playwright');
+        this.context = await firefox.launchPersistentContext(this.profileDir, {
+          headless: false,
+          executablePath,
+          env: launchEnv,
+          viewport: this._viewport,
+          userAgent: this._userAgent,
+          locale: 'en-US',
+          extraHTTPHeaders: {
+            'Accept-Language': 'en-US,en;q=0.9',
+          },
+          firefoxUserPrefs: {
+            'browser.shell.checkDefaultBrowser': false,
+            'browser.startup.homepage': 'about:blank',
+          },
+        });
+        this.browser = typeof this.context.browser === 'function' ? this.context.browser() : null;
+        this.page = this.context.pages()[0] || await this.context.newPage();
+      } else {
+        const puppeteer = require('puppeteer-core');
+        this.browser = await puppeteer.launch({
+          headless: false,
+          executablePath,
+          userDataDir: this.profileDir,
+          env: launchEnv,
+          args: [
+            '--no-sandbox',
+            '--disable-setuid-sandbox',
+            '--disable-dev-shm-usage',
+            '--disable-crash-reporter',
+            '--disable-background-networking',
+            '--disable-component-update',
+            '--disable-blink-features=AutomationControlled',
+            '--disable-infobars',
+            '--no-first-run',
+            '--no-default-browser-check',
+            '--disable-gpu',
+            '--lang=en-US,en',
+            `--window-size=${this._viewport.width},${this._viewport.height}`,
+          ],
+          defaultViewport: this._viewport,
+          ignoreDefaultArgs: ['--enable-automation'],
+          timeout: 120000,
+        });
+        this.page = await this.browser.newPage();
+      }
       await this._applyStealthToPage(this.page);
+    })();
+
+    try {
+      await this.launchPromise;
     } finally {
+      this.launchPromise = null;
       this.launching = false;
     }
   }
@@ -298,7 +414,11 @@ class BrowserController {
   async ensurePage() {
     await this.ensureBrowser();
     if (!this.page || this.page.isClosed()) {
-      this.page = await this.browser.newPage();
+      if (this.context && typeof this.context.newPage === 'function') {
+        this.page = await this.context.newPage();
+      } else {
+        this.page = await this.browser.newPage();
+      }
       await this._applyStealthToPage(this.page);
     }
     return this.page;
@@ -355,7 +475,7 @@ class BrowserController {
 
     try {
       const response = await page.goto(url, {
-        waitUntil: 'networkidle2',
+        waitUntil: normalizeWaitUntil(options.waitUntil),
         timeout: 30000
       });
 
@@ -622,15 +742,20 @@ class BrowserController {
   }
 
   async launch(options = {}) {
+    void options;
     await this.ensureBrowser();
     return { success: true };
   }
 
   isLaunched() {
-    return !!(this.browser && this.browser.isConnected());
+    if (this.context) return true;
+    return !!(this.browser && typeof this.browser.isConnected === 'function' && this.browser.isConnected());
   }
 
   getPageCount() {
+    if (this.context && typeof this.context.pages === 'function') {
+      try { return this.context.pages().length; } catch { return 0; }
+    }
     if (!this.browser) return 0;
     try { return this.browser.pages ? 1 : 0; } catch { return 0; }
   }
@@ -659,12 +784,49 @@ class BrowserController {
     if (this.page && !this.page.isClosed()) {
       await this.page.close().catch(() => { });
     }
+    if (this.context) {
+      await this.context.close().catch(() => { });
+      this.context = null;
+      this.browser = null;
+      this.page = null;
+      return;
+    }
     if (this.browser) {
       await this.browser.close().catch(() => { });
       this.browser = null;
       this.page = null;
     }
   }
+
+  async ensureVirtualDisplay() {
+    if (process.platform !== 'linux') {
+      return;
+    }
+    if (this.displayProcess && !this.displayProcess.killed) {
+      return;
+    }
+    if (this.displayValue && String(this.displayValue).trim()) {
+      return;
+    }
+
+    const display = ':99';
+    const child = spawn('Xvfb', [display, '-screen', '0', '1440x900x24', '-ac', '-nolisten', 'tcp'], {
+      stdio: ['ignore', 'ignore', 'pipe'],
+    });
+
+    let launchError = '';
+    child.stderr.on('data', (chunk) => {
+      launchError += chunk.toString();
+    });
+
+    await sleep(1000);
+    if (child.exitCode != null) {
+      throw new Error(`Failed to start Xvfb: ${String(launchError || `exit code ${child.exitCode}`).trim()}`);
+    }
+
+    this.displayProcess = child;
+    this.displayValue = display;
+  }
 }
 
-module.exports = { BrowserController, resolveBrowserExecutablePath, buildIsolatedEvaluationExpression };
+module.exports = { BrowserController, resolveBrowserExecutablePath, buildIsolatedEvaluationExpression, normalizeWaitUntil };

package/server/services/runtime/backends/local-vm.js

@@ -31,7 +31,7 @@ class RuntimeHttpClient {
   }
 
   async waitForHealth(options = {}) {
-    const timeoutMs = Number(options.timeoutMs || 120000);
+    const timeoutMs = Number(options.timeoutMs || 600000); // Increased from 120s to 10m for bootstrap
     const intervalMs = Number(options.intervalMs || 1000);
     const checkLiveness = options.checkLiveness || (() => true);
     const startedAt = Date.now();
@@ -65,37 +65,53 @@ class RuntimeHttpClient {
   }
 
   async request(method, pathname, body, options = {}) {
-    const controller = options.timeoutMs ? new AbortController() : null;
-    const timer = controller ? setTimeout(() => controller.abort(new Error(`Request timed out after ${options.timeoutMs} ms.`)), options.timeoutMs) : null;
-    try {
-      const response = await fetch(`${this.baseUrl}${pathname}`, {
-        method,
-        headers: {
-          'content-type': 'application/json',
-          ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
-        },
-        body: body === undefined ? undefined : JSON.stringify(body),
-        signal: controller?.signal,
-      });
-
-      const contentType = response.headers.get('content-type') || '';
-      const payload = contentType.includes('application/json')
-        ? await response.json().catch(() => ({}))
-        : { text: await response.text().catch(() => '') };
+    const retryCount = Math.max(0, Number(options.retryCount ?? 6));
+    const retryDelayMs = Math.max(100, Number(options.retryDelayMs ?? 1000));
+    let lastError = null;
 
-      if (!response.ok) {
-        const errorMessage = payload?.error || payload?.text || `Runtime request failed: ${response.status}`;
-        throw new Error(errorMessage);
-      }
-      if (response.ok && typeof this.onActivity === 'function') {
-        this.onActivity();
-      }
-      return payload;
-    } finally {
-      if (timer) {
-        clearTimeout(timer);
+    for (let attempt = 0; attempt <= retryCount; attempt += 1) {
+      const controller = options.timeoutMs ? new AbortController() : null;
+      const timer = controller ? setTimeout(() => controller.abort(new Error(`Request timed out after ${options.timeoutMs} ms.`)), options.timeoutMs) : null;
+      try {
+        const response = await fetch(`${this.baseUrl}${pathname}`, {
+          method,
+          headers: {
+            'content-type': 'application/json',
+            ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
+          },
+          body: body === undefined ? undefined : JSON.stringify(body),
+          signal: controller?.signal,
+        });
+
+        const contentType = response.headers.get('content-type') || '';
+        const payload = contentType.includes('application/json')
+          ? await response.json().catch(() => ({}))
+          : { text: await response.text().catch(() => '') };
+
+        if (!response.ok) {
+          const errorMessage = payload?.error || payload?.text || `Runtime request failed: ${response.status}`;
+          throw new Error(errorMessage);
+        }
+        if (typeof this.onActivity === 'function') {
+          this.onActivity();
+        }
+        return payload;
+      } catch (error) {
+        lastError = error;
+        const message = String(error?.message || error);
+        const retryable = /fetch failed|ECONNREFUSED|ECONNRESET|socket hang up|timed out/i.test(message);
+        if (!retryable || attempt === retryCount) {
+          throw error;
+        }
+        await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+      } finally {
+        if (timer) {
+          clearTimeout(timer);
+        }
       }
     }
+
+    throw lastError || new Error('Runtime request failed.');
   }
 
   async requestStream(method, pathname, stream, options = {}) {
@@ -366,7 +382,7 @@ class LocalVmExecutionBackend {
     }
     const session = await this.vmManager.ensureVm(userId);
     this.#touch(userId);
-    const client = new RuntimeHttpClient(session.baseUrl, this.token, {
+    const client = new RuntimeHttpClient(session.baseUrl, session.guestToken || this.token, {
       onActivity: () => this.#touch(userId),
     });
     try {