neoagent 2.3.1-beta.84 → 2.3.1-beta.86

package/server/services/runtime/guest_bootstrap.js

@@ -5,6 +5,25 @@ const { DATA_DIR } = require('../../../runtime/paths');
 
 const VM_ROOT = path.join(DATA_DIR, 'runtime-vms');
 const GUEST_BOOTSTRAP_ROOT = path.join(VM_ROOT, 'guest-bootstrap');
+const REPO_ROOT = path.resolve(__dirname, '../../..');
+const GUEST_PAYLOAD_PROFILES = Object.freeze({
+  browser_cli: [
+    { source: 'server/guest-agent.browser.package.json', target: 'package.json' },
+    { source: 'runtime/env.js', target: 'runtime/env.js' },
+    { source: 'runtime/paths.js', target: 'runtime/paths.js' },
+    { source: 'server/guest_agent.js', target: 'server/guest_agent.js' },
+    { source: 'server/services/cli', target: 'server/services/cli' },
+    { source: 'server/services/browser', target: 'server/services/browser' },
+  ],
+  android: [
+    { source: 'server/guest-agent.android.package.json', target: 'package.json' },
+    { source: 'runtime/env.js', target: 'runtime/env.js' },
+    { source: 'runtime/paths.js', target: 'runtime/paths.js' },
+    { source: 'server/guest_agent.js', target: 'server/guest_agent.js' },
+    { source: 'server/services/cli', target: 'server/services/cli' },
+    { source: 'server/services/android', target: 'server/services/android' },
+  ],
+});
 
 fs.mkdirSync(GUEST_BOOTSTRAP_ROOT, { recursive: true });
 
@@ -12,16 +31,62 @@ function encodeGuestToken(value) {
   return Buffer.from(String(value || ''), 'utf8').toString('base64');
 }
 
+function normalizeRuntimeProfile(runtimeProfile) {
+  return runtimeProfile === 'android' ? 'android' : 'browser_cli';
+}
+
+function createGuestPayloadArchive(seedDir, runtimeProfile = 'browser_cli') {
+  const seedRoot = path.dirname(seedDir);
+  const stagingRoot = path.join(seedRoot, 'guest-payload');
+  const archivePath = path.join(seedRoot, 'guest-payload.tar.gz');
+  const payloadEntries = GUEST_PAYLOAD_PROFILES[normalizeRuntimeProfile(runtimeProfile)];
+  fs.rmSync(stagingRoot, { recursive: true, force: true });
+  fs.rmSync(archivePath, { force: true });
+  fs.mkdirSync(stagingRoot, { recursive: true });
+
+  for (const entry of payloadEntries) {
+    const sourcePath = path.join(REPO_ROOT, entry.source);
+    const targetPath = path.join(stagingRoot, entry.target);
+    fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+    if (fs.statSync(sourcePath).isDirectory()) {
+      fs.cpSync(sourcePath, targetPath, { recursive: true, force: true });
+    } else {
+      fs.copyFileSync(sourcePath, targetPath);
+    }
+  }
+
+  const tarResult = spawnSync('tar', ['-czf', archivePath, '-C', stagingRoot, '.'], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (tarResult.status !== 0 || !fs.existsSync(archivePath)) {
+    throw new Error(
+      String(tarResult.stderr || tarResult.stdout || tarResult.error?.message || 'Failed to create guest payload archive.')
+        .trim(),
+    );
+  }
+  fs.rmSync(stagingRoot, { recursive: true, force: true });
+  return archivePath;
+}
+
 function createCloudInitScript({
   guestToken,
-  hostShareMount,
-  hostDataMount = '/mnt/neoagent-data',
+  guestPayloadPath = '/var/lib/neoagent/guest-payload.tar.gz',
   guestAgentPort = 8421,
+  runtimeProfile = 'browser_cli',
 }) {
+  const normalizedProfile = normalizeRuntimeProfile(runtimeProfile);
+  const includeBrowser = normalizedProfile === 'browser_cli';
+  const guestUtilityPackages = includeBrowser
+    ? 'curl ca-certificates gnupg git rsync unzip xvfb dbus-x11'
+    : 'curl ca-certificates gnupg git rsync unzip dbus-x11 adb';
   const guestTokenB64 = encodeGuestToken(guestToken);
   const envFile = '/etc/neoagent/neoagent.env';
   const appDir = '/opt/neoagent';
+  const playwrightBrowsersPath = `${appDir}/.playwright-browsers`;
   const bootstrapMarker = '/var/lib/neoagent/bootstrap-complete';
+  const browserReadyMarker = '/var/lib/neoagent/browser-runtime-ready';
+  const browserDepsMarker = '/var/lib/neoagent/browser-deps-installed';
   const nodeSourceSetupUrl = 'https://deb.nodesource.com/setup_20.x';
 
   return [
@@ -29,53 +94,21 @@ function createCloudInitScript({
     'set -uo pipefail', // Removed -e to handle non-critical failures gracefully
     '',
     'export DEBIAN_FRONTEND=noninteractive',
-    `HOST_SHARE_MOUNT=${JSON.stringify(hostShareMount)}`,
-    `HOST_DATA_MOUNT=${JSON.stringify(hostDataMount)}`,
-    'HOST_SHARE_TAG=neoagent-host',
-    'HOST_SHARE_TAG_FALLBACK=neoagent-host-pci',
-    'HOST_DATA_TAG=neoagent-data',
-    'HOST_DATA_TAG_FALLBACK=neoagent-data-pci',
     `APP_DIR=${JSON.stringify(appDir)}`,
+    `PLAYWRIGHT_BROWSERS_PATH=${JSON.stringify(playwrightBrowsersPath)}`,
     `BOOTSTRAP_MARKER=${JSON.stringify(bootstrapMarker)}`,
+    `BROWSER_READY_MARKER=${JSON.stringify(browserReadyMarker)}`,
+    `BROWSER_DEPS_MARKER=${JSON.stringify(browserDepsMarker)}`,
     `ENV_FILE=${JSON.stringify(envFile)}`,
+    `GUEST_PAYLOAD_PATH=${JSON.stringify(guestPayloadPath)}`,
     '',
-    'mkdir -p /etc/neoagent /var/lib/neoagent "$HOST_SHARE_MOUNT" "$HOST_DATA_MOUNT" "$APP_DIR"',
-    '',
-    '# Ensure the 9p virtio filesystem driver is loaded',
-    'modprobe 9p 2>/dev/null || true',
-    'modprobe 9pnet_virtio 2>/dev/null || true',
-    '',
-    'function mount_9p_tag() {',
-    '  local tag="$1"',
-    '  local target="$2"',
-    '  local mode="$3"',
-    '  mount -t 9p -o "trans=virtio,version=9p2000.L,msize=131072,${mode}" "$tag" "$target" >/dev/null 2>&1',
-    '}',
-    '',
-    'if ! mount_9p_tag "$HOST_SHARE_TAG" "$HOST_SHARE_MOUNT" ro; then',
-    '  if mount_9p_tag "$HOST_SHARE_TAG_FALLBACK" "$HOST_SHARE_MOUNT" ro; then',
-    '    HOST_SHARE_TAG="$HOST_SHARE_TAG_FALLBACK"',
-    '  fi',
-    'fi',
-    'if ! mount_9p_tag "$HOST_DATA_TAG" "$HOST_DATA_MOUNT" rw; then',
-    '  if mount_9p_tag "$HOST_DATA_TAG_FALLBACK" "$HOST_DATA_MOUNT" rw; then',
-    '    HOST_DATA_TAG="$HOST_DATA_TAG_FALLBACK"',
-    '  fi',
-    'fi',
-    '',
-    'if ! grep -qs "${HOST_SHARE_MOUNT}" /etc/fstab; then',
-    '  echo "${HOST_SHARE_TAG} ${HOST_SHARE_MOUNT} 9p trans=virtio,version=9p2000.L,msize=262144,ro 0 0" >> /etc/fstab',
-    'fi',
-    'if ! grep -qs "${HOST_DATA_MOUNT}" /etc/fstab; then',
-    '  echo "${HOST_DATA_TAG} ${HOST_DATA_MOUNT} 9p trans=virtio,version=9p2000.L,msize=262144,rw 0 0" >> /etc/fstab',
-    'fi',
-    '',
-    'mount -a >/dev/null 2>&1 || true',
+    'mkdir -p /etc/neoagent /var/lib/neoagent "$APP_DIR"',
     '',
-    '# Redirect logs to both host-writable share and console',
-    'LOG_FILE="${HOST_DATA_MOUNT}/bootstrap.log"',
+    '# Redirect logs to a guest-local file and console',
+    'LOG_FILE="/var/log/neoagent-bootstrap.log"',
     'exec > >(tee -a "$LOG_FILE" >/dev/console) 2>&1',
     'echo "NeoAgent guest bootstrap starting..."',
+    'rm -f "$BOOTSTRAP_MARKER" "$BROWSER_READY_MARKER"',
     '',
     'function retry_cmd() {',
     '  local n=1',
@@ -95,49 +128,14 @@ function createCloudInitScript({
     '  done',
     '}',
     '',
-    'echo "Updating package lists..."',
-    'retry_cmd apt-get update || echo "Warning: apt-get update failed, proceeding with cached lists."',
-    '',
-    'echo "Installing dependencies..."',
-    'retry_cmd apt-get install -y --no-install-recommends \\',
-    '  curl ca-certificates gnupg openjdk-17-jre-headless git rsync build-essential \\',
-    '  python3 unzip libatk1.0-0 libatk-bridge2.0-0 libatspi2.0-0 libcups2 \\',
-    '  libx11-xcb1 libgtk-3-0 libnss3 libnspr4 libxcomposite1 libxdamage1 \\',
-    '  libxrandr2 libxkbcommon0 libasound2t64 libgbm1 libdrm2 libdbus-1-3 \\',
-    '  libpango-1.0-0 libpangocairo-1.0-0 libxshmfence1 || echo "Warning: Some dependencies failed to install."',
-    '',
-    'if [ -d "$HOST_SHARE_MOUNT" ]; then',
-    '  echo "Syncing guest agent sources..."',
-    '  SYNC_PATHS=(',
-    '    server/guest-agent.package.json:package.json',
-    '    runtime/env.js',
-    '    runtime/paths.js',
-    '    server/guest_agent.js',
-    '    server/services/cli',
-    '    server/services/browser',
-    '    server/services/android',
-    '  )',
-    '  for relPath in "${SYNC_PATHS[@]}"; do',
-    '    sourceRelPath="${relPath%%:*}"',
-    '    targetRelPath="${relPath##*:}"',
-    '    sourcePath="$HOST_SHARE_MOUNT/$sourceRelPath"',
-    '    targetPath="$APP_DIR/$targetRelPath"',
-    '    if [ -e "$sourcePath" ]; then',
-    '      mkdir -p "$(dirname "$targetPath")"',
-    '      if [ -d "$sourcePath" ]; then',
-    '        mkdir -p "$targetPath"',
-    '        rsync -a --delete "$sourcePath"/ "$targetPath"/',
-    '      else',
-    '        rsync -a "$sourcePath" "$targetPath"',
-    '      fi',
-    '    else',
-    '      echo "Warning: Optional source path missing: $relPath"',
-    '    fi',
-    '  done',
-    'else',
-    '  echo "Error: Host repo share is not available. Bootstrap cannot continue." >&2',
+    'if [ ! -f "$GUEST_PAYLOAD_PATH" ]; then',
+    '  echo "Error: Guest payload archive is missing at $GUEST_PAYLOAD_PATH." >&2',
     '  exit 1',
     'fi',
+    'echo "Extracting guest runtime payload..."',
+    'rm -rf "$APP_DIR"',
+    'mkdir -p "$APP_DIR"',
+    'tar -xzf "$GUEST_PAYLOAD_PATH" -C "$APP_DIR" || { echo "Error: Failed to extract guest runtime payload." >&2; exit 1; }',
     '',
     'if ! command -v node >/dev/null 2>&1 || ! node -e "process.exit(Number(process.versions.node.split(\'.\')[0]) >= 20 ? 0 : 1)"; then',
     '  echo "Installing Node.js..."',
@@ -147,31 +145,47 @@ function createCloudInitScript({
     '',
     `printf '%s\n' ${JSON.stringify(`NEOAGENT_VM_GUEST_TOKEN_B64=${guestTokenB64}`)} > "$ENV_FILE"`,
     `printf '%s\n' ${JSON.stringify(`NEOAGENT_GUEST_AGENT_PORT=${guestAgentPort}`)} >> "$ENV_FILE"`,
+    `printf '%s\n' ${JSON.stringify(`NEOAGENT_GUEST_PROFILE=${normalizedProfile}`)} >> "$ENV_FILE"`,
     'chmod 0600 "$ENV_FILE"',
     '',
     'cd "$APP_DIR"',
+    'export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1',
+    'export PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH"',
     'if [ ! -d node_modules ] || [ ! -f node_modules/.neoagent-bootstrap-stamp ] || [ package.json -nt node_modules/.neoagent-bootstrap-stamp ]; then',
     '  echo "Installing npm dependencies..."',
-    '  export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1',
-    '  retry_cmd npm install --omit=dev --no-audit --no-fund || echo "Warning: npm install failed."',
+    '  retry_cmd npm install --omit=dev --ignore-scripts --prefer-offline --no-audit --no-fund || { echo "Error: npm install failed." >&2; exit 1; }',
     '  mkdir -p node_modules',
     '  date > node_modules/.neoagent-bootstrap-stamp',
     'fi',
     '',
-    '# Install Playwright browser binaries',
-    'PLAYWRIGHT_BROWSERS_PATH="$APP_DIR/.playwright-browsers"',
-    'PLAYWRIGHT_STAMP="$PLAYWRIGHT_BROWSERS_PATH/.chromium-installed"',
-    'if [ ! -f "$PLAYWRIGHT_STAMP" ]; then',
-    '  echo "Installing Playwright browsers..."',
-    '  mkdir -p "$PLAYWRIGHT_BROWSERS_PATH"',
-    '  PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH" npx playwright install chromium --with-deps || \\',
-    '    PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH" node ./node_modules/playwright-chromium/install.js || true',
-    '  date > "$PLAYWRIGHT_STAMP"',
-    'fi',
     '',
-    'systemctl daemon-reload',
-    'systemctl enable neoagent-guest-agent.service || true',
-    'systemctl restart neoagent-guest-agent.service || true',
+    'echo "Ensuring guest runtime utilities..."',
+    'retry_cmd apt-get update || echo "Warning: apt-get update failed, proceeding with cached lists."',
+    `retry_cmd apt-get install -y --no-install-recommends ${guestUtilityPackages} || { echo "Error: Failed to install required guest runtime utilities." >&2; exit 1; }`,
+    '',
+    'echo "NeoAgent guest runtime payload is ready."',
+    '',
+    ...(includeBrowser
+      ? [
+        'echo "Continuing browser runtime provisioning..."',
+        'PLAYWRIGHT_BROWSERS_PATH="$APP_DIR/.playwright-browsers"',
+        'PLAYWRIGHT_STAMP="$PLAYWRIGHT_BROWSERS_PATH/.chromium-installed"',
+        'mkdir -p "$PLAYWRIGHT_BROWSERS_PATH"',
+        'if [ ! -f "$BROWSER_DEPS_MARKER" ]; then',
+        '  echo "Installing Playwright browser dependencies..."',
+        '  PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH" retry_cmd npx playwright install-deps chromium || { echo "Error: Playwright dependency install failed." >&2; exit 1; }',
+        '  touch "$BROWSER_DEPS_MARKER"',
+        'fi',
+        'if [ ! -f "$PLAYWRIGHT_STAMP" ] || [ package.json -nt "$PLAYWRIGHT_STAMP" ]; then',
+        '  echo "Installing Playwright browsers..."',
+        '  PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH" retry_cmd npx playwright install chromium || { echo "Error: Playwright browser install failed." >&2; exit 1; }',
+        '  date > "$PLAYWRIGHT_STAMP"',
+        'fi',
+        'touch "$BROWSER_READY_MARKER"',
+      ]
+      : [
+        'rm -f "$BROWSER_READY_MARKER"',
+      ]),
     'touch "$BOOTSTRAP_MARKER"',
     'echo "NeoAgent guest bootstrap completed."',
     '',
@@ -180,18 +194,109 @@ function createCloudInitScript({
 
 function createCloudInitUserData({
   guestToken,
-  hostShareMount = '/mnt/neoagent-host',
-  hostDataMount = '/mnt/neoagent-data',
+  guestPayloadBase64 = '',
   guestAgentPort = 8421,
+  runtimeMode = 'template',
+  runtimeProfile = 'browser_cli',
 }) {
+  const normalizedProfile = normalizeRuntimeProfile(runtimeProfile);
+  const includeBrowser = normalizedProfile === 'browser_cli';
+  const guestAgentInnerCommand = includeBrowser
+    ? 'set -a; . /etc/neoagent/neoagent.env; set +a; cd /opt/neoagent && env DISPLAY=:99 PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers /usr/bin/env node server/guest_agent.js 2>&1 | tee -a /var/log/neoagent-guest-agent.log >/dev/console'
+    : 'set -a; . /etc/neoagent/neoagent.env; set +a; cd /opt/neoagent && /usr/bin/env node server/guest_agent.js 2>&1 | tee -a /var/log/neoagent-guest-agent.log >/dev/console';
+  const guestAgentLaunchCommand = `nohup /bin/sh -lc ${JSON.stringify(guestAgentInnerCommand)} </dev/null >/dev/null 2>&1 &`;
   const guestTokenB64 = encodeGuestToken(guestToken);
   const bootstrapScript = createCloudInitScript({
     guestToken,
-    hostShareMount,
-    hostDataMount,
+    guestPayloadPath: '/var/lib/neoagent/guest-payload.tar.gz',
     guestAgentPort,
+    runtimeProfile: normalizedProfile,
   });
 
+  if (runtimeMode === 'user') {
+    return [
+      '#cloud-config',
+      'package_update: false',
+      'write_files:',
+      '  - path: /etc/neoagent/neoagent.env',
+      "    permissions: '0600'",
+      '    owner: root:root',
+      '    content: |',
+      `      NEOAGENT_VM_GUEST_TOKEN_B64=${guestTokenB64}`,
+      `      NEOAGENT_GUEST_AGENT_PORT=${guestAgentPort}`,
+      `      NEOAGENT_GUEST_PROFILE=${normalizedProfile}`,
+      ...(includeBrowser
+        ? [
+          '  - path: /etc/systemd/system/neoagent-xvfb.service',
+          "    permissions: '0644'",
+          '    owner: root:root',
+          '    content: |',
+          '      [Unit]',
+          '      Description=NeoAgent virtual display',
+          '      After=network-online.target',
+          '      Wants=network-online.target',
+          '',
+          '      [Service]',
+          '      Type=simple',
+          '      ExecStart=/usr/bin/Xvfb :99 -screen 0 1440x900x24 -ac -nolisten tcp',
+          '      Restart=always',
+          '      RestartSec=2',
+          '      StandardOutput=journal+console',
+          '      StandardError=journal+console',
+          '',
+          '      [Install]',
+          '      WantedBy=multi-user.target',
+        ]
+        : []),
+      '  - path: /etc/systemd/system/neoagent-guest-agent.service',
+      "    permissions: '0644'",
+      '    owner: root:root',
+      '    content: |',
+      '      [Unit]',
+      '      Description=NeoAgent guest agent',
+      '      After=network-online.target',
+      ...(includeBrowser ? ['      After=neoagent-xvfb.service'] : []),
+      '      ConditionPathExists=/etc/neoagent/neoagent.env',
+      '      Wants=network-online.target',
+      '',
+      '      [Service]',
+      '      Type=simple',
+      '      EnvironmentFile=/etc/neoagent/neoagent.env',
+      '      ExecStartPre=/bin/mkdir -p /var/lib/neoagent',
+      ...(includeBrowser
+        ? [
+          '      ExecStartPre=/usr/bin/touch /var/lib/neoagent/browser-runtime-ready',
+          '      ExecStartPre=/bin/sh -lc \'for _ in $(seq 1 30); do [ -S /tmp/.X11-unix/X99 ] && exit 0; sleep 1; done; exit 1\'',
+          '      Environment=DISPLAY=:99',
+          '      Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers',
+        ]
+        : [
+          '      ExecStartPre=/bin/sh -lc \'rm -f /var/lib/neoagent/browser-runtime-ready || true\'',
+        ]),
+      '      ExecStartPre=/usr/bin/touch /var/lib/neoagent/bootstrap-complete',
+      '      WorkingDirectory=/opt/neoagent',
+      '      ExecStart=/usr/bin/env node /opt/neoagent/server/guest_agent.js',
+      '      Restart=always',
+      '      RestartSec=5',
+      '      StandardOutput=journal+console',
+      '      StandardError=journal+console',
+      '',
+      '      [Install]',
+      '      WantedBy=multi-user.target',
+      'runcmd:',
+      '  - [bash, -lc, "systemctl daemon-reload"]',
+      ...(includeBrowser
+        ? [
+          '  - [bash, -lc, "systemctl enable neoagent-xvfb.service"]',
+          '  - [bash, -lc, "systemctl start neoagent-xvfb.service"]',
+        ]
+        : []),
+      '  - [bash, -lc, "systemctl enable neoagent-guest-agent.service"]',
+      '  - [bash, -lc, "systemctl start --no-block neoagent-guest-agent.service"]',
+      '',
+    ].join('\n');
+  }
+
   return [
     '#cloud-config',
     'package_update: false',
@@ -199,9 +304,16 @@ function createCloudInitUserData({
     '  - path: /etc/neoagent/neoagent.env',
     "    permissions: '0600'",
     '    owner: root:root',
+      '    content: |',
+      `      NEOAGENT_VM_GUEST_TOKEN_B64=${guestTokenB64}`,
+      `      NEOAGENT_GUEST_AGENT_PORT=${guestAgentPort}`,
+      `      NEOAGENT_GUEST_PROFILE=${normalizedProfile}`,
+    '  - path: /var/lib/neoagent/guest-payload.tar.gz',
+    "    permissions: '0644'",
+    '    owner: root:root',
+    "    encoding: 'b64'",
     '    content: |',
-    `      NEOAGENT_VM_GUEST_TOKEN_B64=${guestTokenB64}`,
-    `      NEOAGENT_GUEST_AGENT_PORT=${guestAgentPort}`,
+      `      ${guestPayloadBase64}`,
     '  - path: /usr/local/bin/neoagent-guest-bootstrap.sh',
     "    permissions: '0755'",
     '    owner: root:root',
@@ -214,12 +326,22 @@ function createCloudInitUserData({
     '      [Unit]',
     '      Description=NeoAgent guest agent',
     '      After=network-online.target',
+    '      After=cloud-final.service',
+    '      After=neoagent-guest-bootstrap.service',
+    ...(includeBrowser ? ['      After=neoagent-xvfb.service'] : []),
+    '      ConditionPathExists=/etc/neoagent/neoagent.env',
+    ...(includeBrowser ? ['      Requires=neoagent-xvfb.service'] : []),
     '      Wants=network-online.target',
     '',
     '      [Service]',
     '      Type=simple',
     '      EnvironmentFile=/etc/neoagent/neoagent.env',
-    '      Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers',
+    ...(includeBrowser
+      ? [
+        '      Environment=DISPLAY=:99',
+        '      Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers',
+      ]
+      : []),
     '      WorkingDirectory=/opt/neoagent',
     '      ExecStart=/usr/bin/env node /opt/neoagent/server/guest_agent.js',
     '      Restart=always',
@@ -229,6 +351,29 @@ function createCloudInitUserData({
     '',
     '      [Install]',
     '      WantedBy=multi-user.target',
+    ...(includeBrowser
+      ? [
+        '  - path: /etc/systemd/system/neoagent-xvfb.service',
+        "    permissions: '0644'",
+        '    owner: root:root',
+        '    content: |',
+        '      [Unit]',
+        '      Description=NeoAgent virtual display',
+        '      After=network-online.target',
+        '      Wants=network-online.target',
+        '',
+        '      [Service]',
+        '      Type=simple',
+        '      ExecStart=/usr/bin/Xvfb :99 -screen 0 1440x900x24 -ac -nolisten tcp',
+        '      Restart=always',
+        '      RestartSec=2',
+        '      StandardOutput=journal+console',
+        '      StandardError=journal+console',
+        '',
+        '      [Install]',
+        '      WantedBy=multi-user.target',
+      ]
+      : []),
     '  - path: /etc/systemd/system/neoagent-guest-bootstrap.service',
     "    permissions: '0644'",
     '    owner: root:root',
@@ -247,8 +392,14 @@ function createCloudInitUserData({
     '      WantedBy=multi-user.target',
     'runcmd:',
     '  - [bash, -lc, "systemctl daemon-reload"]',
-    '  - [bash, -lc, "systemctl enable neoagent-guest-bootstrap.service"]',
-    '  - [bash, -lc, "systemctl start neoagent-guest-bootstrap.service"]',
+    ...(includeBrowser
+      ? [
+        '  - [bash, -lc, "systemctl enable neoagent-xvfb.service"]',
+        '  - [bash, -lc, "systemctl start neoagent-xvfb.service"]',
+      ]
+      : []),
+    '  - [bash, -lc, "/usr/local/bin/neoagent-guest-bootstrap.sh"]',
+    `  - [bash, -lc, ${JSON.stringify(guestAgentLaunchCommand)}]`,
     '',
   ].join('\n');
 }
@@ -261,6 +412,21 @@ function createCloudInitMetaData({ instanceId, localHostName }) {
   ].join('\n');
 }
 
+function resolveCloudInitIdentity(userRoot) {
+  const relativePath = path.relative(VM_ROOT, path.resolve(userRoot || ''));
+  const normalized = relativePath
+    .split(path.sep)
+    .filter(Boolean)
+    .map((segment) => segment.replace(/[^a-z0-9_-]+/gi, '-').replace(/^-+|-+$/g, '').slice(0, 32))
+    .filter(Boolean)
+    .join('-');
+  const scope = normalized || 'default';
+  return {
+    instanceId: `neoagent-${scope}`,
+    localHostName: `neoagent-${scope}`,
+  };
+}
+
 function commandExists(command) {
   const probe = spawnSync(
     process.platform === 'win32' ? 'where' : 'bash',
@@ -409,9 +575,10 @@ function createSeedIso(sourceDir, isoPath) {
 function ensureGuestBootstrapSeed({
   userRoot,
   guestToken,
-  hostShareMount = '/mnt/neoagent-host',
   guestAgentPort = 8421,
   guestArch = 'x64',
+  runtimeMode = 'template',
+  runtimeProfile = 'browser_cli',
 }) {
   const seedRoot = path.join(userRoot, 'cloud-init');
   const seedDir = path.join(seedRoot, 'seed');
@@ -422,11 +589,18 @@ function ensureGuestBootstrapSeed({
   const userDataPath = path.join(seedDir, 'user-data');
   const metaDataPath = path.join(seedDir, 'meta-data');
   const startupNshPath = path.join(seedDir, 'startup.nsh');
-  const userData = createCloudInitUserData({ guestToken, hostShareMount, guestAgentPort });
-  const metaData = createCloudInitMetaData({
-    instanceId: `neoagent-${path.basename(userRoot)}`,
-    localHostName: `neoagent-${path.basename(userRoot)}`,
+  const guestPayloadBase64 = runtimeMode === 'user'
+    ? ''
+    : fs.readFileSync(createGuestPayloadArchive(seedDir, runtimeProfile)).toString('base64');
+  const userData = createCloudInitUserData({
+    guestToken,
+    guestPayloadBase64,
+    guestAgentPort,
+    runtimeMode,
+    runtimeProfile,
   });
+  const identity = resolveCloudInitIdentity(userRoot);
+  const metaData = createCloudInitMetaData(identity);
   const startupNsh = guestArch === 'arm64'
     ? [
       '@echo -off',
@@ -467,13 +641,13 @@ function ensureGuestBootstrapSeed({
     userDataPath,
     metaDataPath,
     startupNshPath,
-    hostShareMount,
   };
 }
 
 module.exports = {
   createCloudInitMetaData,
   createCloudInitUserData,
+  createCloudInitScript,
   createSeedIso,
   ensureGuestBootstrapSeed,
   GUEST_BOOTSTRAP_ROOT,

package/server/services/runtime/manager.js

@@ -2,14 +2,23 @@ const { LocalVmExecutionBackend } = require('./backends/local-vm');
 const { QemuVmManager } = require('./qemu');
 const { getRuntimeSettings } = require('./settings');
 const { ExtensionBrowserProvider } = require('../browser/extension/provider');
+const { AndroidController } = require('../android/controller');
 
 class RuntimeManager {
   constructor(options = {}) {
     this.browserExtensionRegistry = options.browserExtensionRegistry || null;
-    this.vmBackend = new LocalVmExecutionBackend({
-      vmManager: options.vmManager || new QemuVmManager(),
+    const browserVmManager = options.browserVmManager || new QemuVmManager({
+      runtimeProfile: 'browser_cli',
+      memoryMb: 2048,
+      cpus: 2,
+      warmup: false,
+    });
+    this.browserBackend = new LocalVmExecutionBackend({
+      runtimeProfile: 'browser_cli',
+      vmManager: browserVmManager,
       artifactStore: options.artifactStore,
     });
+    this.androidControllers = new Map();
     this.getExtensionBrowserProvider = options.getExtensionBrowserProvider || ((userId) => new ExtensionBrowserProvider({
       registry: options.browserExtensionRegistry,
       artifactStore: options.artifactStore,
@@ -31,25 +40,27 @@ class RuntimeManager {
 
   resolveBackend(userId, requested) {
     void userId;
-    void requested;
-    return this.vmBackend;
+    return this.browserBackend;
   }
 
   async executeCommand(userId, command, options = {}) {
-    const backend = this.resolveBackend(userId, options.backend);
+    const backend = this.resolveBackend(userId, 'browser_cli');
     return backend.executeCommand(userId, command, options);
   }
 
-  hasVmForUser(userId) {
-    return Boolean(this.vmBackend?.vmManager?.hasVm?.(userId));
+  hasVmForUser(userId, capability = 'browser') {
+    if (capability === 'android') {
+      return Boolean(this.androidControllers.get(String(userId || '').trim()));
+    }
+    return Boolean(this.browserBackend?.vmManager?.hasVm?.(userId));
   }
 
   async killCommand(userId, pid, reason = 'aborted') {
-    return this.vmBackend.killCommand(userId, pid, reason);
+    return this.browserBackend.killCommand(userId, pid, reason);
   }
 
   async getCommandExecutorForUser(userId) {
-    return this.vmBackend.getCommandExecutorForUser(userId);
+    return this.browserBackend.getCommandExecutorForUser(userId);
   }
 
   async getBrowserProviderForUser(userId) {
@@ -57,22 +68,49 @@ class RuntimeManager {
     if (settings.browser_backend === 'extension' && this.hasActiveExtensionBrowser(userId)) {
       return this.getExtensionBrowserProvider(userId);
     }
-    return this.vmBackend.getBrowserProviderForUser(userId);
+    return this.browserBackend.getBrowserProviderForUser(userId);
   }
 
   async getAndroidProviderForUser(userId) {
-    return this.vmBackend.getAndroidProviderForUser(userId);
+    const key = String(userId || '').trim();
+    if (!key) {
+      throw new Error('Android provider requires a user ID.');
+    }
+    if (!this.androidControllers.has(key)) {
+      this.androidControllers.set(key, new AndroidController({
+        userId: key,
+        runtimeBackend: 'host',
+        artifactStore: null,
+      }));
+    }
+    return this.androidControllers.get(key);
   }
 
-  async isGuestAgentReadyForUser(userId, timeoutMs = 1000) {
-    if (typeof this.vmBackend?.isGuestAgentReadyForUser !== 'function') {
+  async isGuestAgentReadyForUser(userId, timeoutMs = 1000, capability = 'browser') {
+    if (capability === 'android') {
+      const controller = this.androidControllers.get(String(userId || '').trim());
+      if (!controller || typeof controller.getStatus !== 'function') {
+        return false;
+      }
+      try {
+        const status = await controller.getStatus();
+        return Boolean(status?.bootstrapped || status?.serial || status?.starting);
+      } catch {
+        return false;
+      }
+    }
+    if (typeof this.browserBackend?.isGuestAgentReadyForUser !== 'function') {
       return false;
     }
-    return this.vmBackend.isGuestAgentReadyForUser(userId, timeoutMs);
+    return this.browserBackend.isGuestAgentReadyForUser(userId, timeoutMs);
   }
 
   async shutdown() {
-    await Promise.allSettled([this.vmBackend.shutdown()]);
+    await Promise.allSettled([
+      this.browserBackend?.shutdown?.(),
+      ...[...this.androidControllers.values()].map((controller) => controller?.stopEmulator?.().catch?.(() => {})),
+    ]);
+    this.androidControllers.clear();
   }
 }