neoagent 2.3.1-beta.85 → 2.3.1-beta.86

package/server/services/browser/controller.js

@@ -26,6 +26,7 @@ const VIEWPORTS = [
 
 function resolveBrowserExecutablePath() {
   const explicitPath =
+    process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH ||
     process.env.PUPPETEER_EXECUTABLE_PATH ||
     process.env.CHROME_BIN ||
     process.env.CHROMIUM_BIN;
@@ -34,7 +35,6 @@ function resolveBrowserExecutablePath() {
 
   const bundledCandidates = [
     () => require('playwright-chromium').chromium.executablePath(),
-    () => require('playwright').chromium.executablePath(),
   ];
   for (const resolveBundled of bundledCandidates) {
     try {
@@ -76,22 +76,11 @@ function resolveBrowserExecutablePath() {
   return platformCandidates.find((candidate) => fs.existsSync(candidate)) || null;
 }
 
-function resolveFirefoxExecutablePath() {
-  try {
-    const bundledPath = require('playwright').firefox.executablePath();
-    return bundledPath && fs.existsSync(bundledPath) ? bundledPath : null;
-  } catch {
-    return null;
-  }
-}
-
 function installPlaywrightBrowserBinary(browserName) {
-  const packageRoot = path.dirname(require.resolve('playwright/package.json'));
+  const packageRoot = path.dirname(require.resolve('playwright-chromium/package.json'));
   const cliPath = path.join(packageRoot, 'cli.js');
   return new Promise((resolve, reject) => {
-    const args = browserName === 'chromium'
-      ? [cliPath, 'install', '--no-shell', 'chromium']
-      : [cliPath, 'install', browserName];
+    const args = [cliPath, 'install', '--no-shell', browserName];
     const child = spawn(process.execPath, args, {
       stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -161,13 +150,29 @@ function normalizeWaitUntil(waitUntil) {
   return 'domcontentloaded';
 }
 
+function clearChromiumSingletonLocks(profileDir) {
+  const lockEntries = [
+    'SingletonLock',
+    'SingletonSocket',
+    'SingletonCookie',
+    'SingletonStartupLock',
+    'DevToolsActivePort',
+  ];
+  for (const entry of lockEntries) {
+    const targetPath = path.join(profileDir, entry);
+    try {
+      fs.rmSync(targetPath, { force: true, recursive: true });
+    } catch {}
+  }
+}
+
 class BrowserController {
   constructor(options = {}) {
     this.io = options.io || null;
     this.userId = options.userId != null ? String(options.userId) : null;
     this.artifactStore = options.artifactStore || null;
     this.runtimeBackend = options.runtimeBackend || 'host';
-    this.engine = this.runtimeBackend === 'vm' && process.platform === 'linux' ? 'firefox' : 'chromium';
+    this.engine = 'chromium';
     this.browser = null;
     this.context = null;
     this.page = null;
@@ -327,9 +332,7 @@ class BrowserController {
       this._userAgent = USER_AGENTS[rand(0, USER_AGENTS.length - 1)];
       this._viewport = VIEWPORTS[rand(0, VIEWPORTS.length - 1)];
 
-      let executablePath = this.engine === 'firefox'
-        ? resolveFirefoxExecutablePath()
-        : resolveBrowserExecutablePath();
+      let executablePath = resolveBrowserExecutablePath();
       if (!executablePath) {
         if (!this.browserBinaryInstallPromise) {
           this.browserBinaryInstallPromise = installPlaywrightBrowserBinary(this.engine);
@@ -339,9 +342,7 @@ class BrowserController {
         } finally {
           this.browserBinaryInstallPromise = null;
         }
-        executablePath = this.engine === 'firefox'
-          ? resolveFirefoxExecutablePath()
-          : resolveBrowserExecutablePath();
+        executablePath = resolveBrowserExecutablePath();
       }
 
       if (!executablePath) {
@@ -353,53 +354,35 @@ class BrowserController {
         ...(this.displayValue ? { DISPLAY: this.displayValue } : {}),
       };
 
-      if (this.engine === 'firefox') {
-        const { firefox } = require('playwright');
-        this.context = await firefox.launchPersistentContext(this.profileDir, {
-          headless: false,
-          executablePath,
-          env: launchEnv,
-          viewport: this._viewport,
-          userAgent: this._userAgent,
-          locale: 'en-US',
-          extraHTTPHeaders: {
-            'Accept-Language': 'en-US,en;q=0.9',
-          },
-          firefoxUserPrefs: {
-            'browser.shell.checkDefaultBrowser': false,
-            'browser.startup.homepage': 'about:blank',
-          },
-        });
-        this.browser = typeof this.context.browser === 'function' ? this.context.browser() : null;
-        this.page = this.context.pages()[0] || await this.context.newPage();
-      } else {
-        const puppeteer = require('puppeteer-core');
-        this.browser = await puppeteer.launch({
-          headless: false,
-          executablePath,
-          userDataDir: this.profileDir,
-          env: launchEnv,
-          args: [
-            '--no-sandbox',
-            '--disable-setuid-sandbox',
-            '--disable-dev-shm-usage',
-            '--disable-crash-reporter',
-            '--disable-background-networking',
-            '--disable-component-update',
-            '--disable-blink-features=AutomationControlled',
-            '--disable-infobars',
-            '--no-first-run',
-            '--no-default-browser-check',
-            '--disable-gpu',
-            '--lang=en-US,en',
-            `--window-size=${this._viewport.width},${this._viewport.height}`,
-          ],
-          defaultViewport: this._viewport,
-          ignoreDefaultArgs: ['--enable-automation'],
-          timeout: 120000,
-        });
-        this.page = await this.browser.newPage();
-      }
+      const launchArgs = [
+        '--no-sandbox',
+        '--disable-setuid-sandbox',
+        '--disable-dev-shm-usage',
+        '--disable-crash-reporter',
+        '--disable-background-networking',
+        '--disable-component-update',
+        '--disable-blink-features=AutomationControlled',
+        '--disable-infobars',
+        '--no-first-run',
+        '--no-default-browser-check',
+        '--disable-gpu',
+        '--lang=en-US,en',
+        `--window-size=${this._viewport.width},${this._viewport.height}`,
+      ];
+
+      const playwright = require('playwright-chromium');
+      clearChromiumSingletonLocks(this.profileDir);
+      this.context = await playwright.chromium.launchPersistentContext(this.profileDir, {
+        headless: false,
+        executablePath,
+        env: launchEnv,
+        args: launchArgs,
+        viewport: this._viewport,
+        ignoreHTTPSErrors: false,
+        timeout: 120000,
+      });
+      this.browser = typeof this.context.browser === 'function' ? this.context.browser() : null;
+      this.page = this.context.pages()[0] || await this.context.newPage();
       await this._applyStealthToPage(this.page);
     })();
 

package/server/services/runtime/backends/local-vm.js

@@ -23,6 +23,18 @@ function assertPathInside(baseDir, candidatePath, label) {
   return resolvedCandidate;
 }
 
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 class RuntimeHttpClient {
   constructor(baseUrl, token = '', options = {}) {
     this.baseUrl = String(baseUrl || '').replace(/\/+$/, '');
@@ -341,6 +353,7 @@ class VmAndroidProvider {
 class LocalVmExecutionBackend {
   constructor(options = {}) {
     this.vmManager = options.vmManager;
+    this.runtimeProfile = options.runtimeProfile === 'android' ? 'android' : 'browser_cli';
     this.token = options.token || process.env.NEOAGENT_VM_GUEST_TOKEN || '';
     this.artifactStore = options.artifactStore || null;
     this.lastActivity = new Map();
@@ -364,12 +377,12 @@ class LocalVmExecutionBackend {
       const now = Date.now();
       for (const [userId, lastUsed] of this.lastActivity.entries()) {
         if (now - lastUsed > IDLE_TIMEOUT_MS) {
-          console.log(`[Runtime] User ${userId} runtime idle for ${Math.round((now - lastUsed) / 1000)}s, shutting down VM.`);
+          console.log(`[Runtime:${this.runtimeProfile}] User ${userId} runtime idle for ${Math.round((now - lastUsed) / 1000)}s, shutting down VM.`);
           this.lastActivity.delete(userId);
           try {
             await this.vmManager?.killVm?.(userId);
           } catch (err) {
-            console.error(`[Runtime] Failed to shut down idle VM for user ${userId}:`, err.message);
+            console.error(`[Runtime:${this.runtimeProfile}] Failed to shut down idle VM for user ${userId}:`, err.message);
           }
         }
       }
@@ -391,7 +404,7 @@ class LocalVmExecutionBackend {
         checkLiveness: () => {
           const key = String(userId || '').trim();
           const session = this.vmManager.instances.get(key);
-          return session && session.process && !session.process.killed && session.process.exitCode === null;
+          return Boolean(session && session.process && isPidAlive(session.process.pid));
         },
       });
     } catch (error) {

package/server/services/runtime/guest_bootstrap.js

@@ -6,15 +6,24 @@ const { DATA_DIR } = require('../../../runtime/paths');
 const VM_ROOT = path.join(DATA_DIR, 'runtime-vms');
 const GUEST_BOOTSTRAP_ROOT = path.join(VM_ROOT, 'guest-bootstrap');
 const REPO_ROOT = path.resolve(__dirname, '../../..');
-const GUEST_PAYLOAD_ENTRIES = Object.freeze([
-  { source: 'server/guest-agent.package.json', target: 'package.json' },
-  { source: 'runtime/env.js', target: 'runtime/env.js' },
-  { source: 'runtime/paths.js', target: 'runtime/paths.js' },
-  { source: 'server/guest_agent.js', target: 'server/guest_agent.js' },
-  { source: 'server/services/cli', target: 'server/services/cli' },
-  { source: 'server/services/browser', target: 'server/services/browser' },
-  { source: 'server/services/android', target: 'server/services/android' },
-]);
+const GUEST_PAYLOAD_PROFILES = Object.freeze({
+  browser_cli: [
+    { source: 'server/guest-agent.browser.package.json', target: 'package.json' },
+    { source: 'runtime/env.js', target: 'runtime/env.js' },
+    { source: 'runtime/paths.js', target: 'runtime/paths.js' },
+    { source: 'server/guest_agent.js', target: 'server/guest_agent.js' },
+    { source: 'server/services/cli', target: 'server/services/cli' },
+    { source: 'server/services/browser', target: 'server/services/browser' },
+  ],
+  android: [
+    { source: 'server/guest-agent.android.package.json', target: 'package.json' },
+    { source: 'runtime/env.js', target: 'runtime/env.js' },
+    { source: 'runtime/paths.js', target: 'runtime/paths.js' },
+    { source: 'server/guest_agent.js', target: 'server/guest_agent.js' },
+    { source: 'server/services/cli', target: 'server/services/cli' },
+    { source: 'server/services/android', target: 'server/services/android' },
+  ],
+});
 
 fs.mkdirSync(GUEST_BOOTSTRAP_ROOT, { recursive: true });
 
@@ -22,15 +31,20 @@ function encodeGuestToken(value) {
   return Buffer.from(String(value || ''), 'utf8').toString('base64');
 }
 
-function createGuestPayloadArchive(seedDir) {
+function normalizeRuntimeProfile(runtimeProfile) {
+  return runtimeProfile === 'android' ? 'android' : 'browser_cli';
+}
+
+function createGuestPayloadArchive(seedDir, runtimeProfile = 'browser_cli') {
   const seedRoot = path.dirname(seedDir);
   const stagingRoot = path.join(seedRoot, 'guest-payload');
   const archivePath = path.join(seedRoot, 'guest-payload.tar.gz');
+  const payloadEntries = GUEST_PAYLOAD_PROFILES[normalizeRuntimeProfile(runtimeProfile)];
   fs.rmSync(stagingRoot, { recursive: true, force: true });
   fs.rmSync(archivePath, { force: true });
   fs.mkdirSync(stagingRoot, { recursive: true });
 
-  for (const entry of GUEST_PAYLOAD_ENTRIES) {
+  for (const entry of payloadEntries) {
     const sourcePath = path.join(REPO_ROOT, entry.source);
     const targetPath = path.join(stagingRoot, entry.target);
     fs.mkdirSync(path.dirname(targetPath), { recursive: true });
@@ -59,10 +73,17 @@ function createCloudInitScript({
   guestToken,
   guestPayloadPath = '/var/lib/neoagent/guest-payload.tar.gz',
   guestAgentPort = 8421,
+  runtimeProfile = 'browser_cli',
 }) {
+  const normalizedProfile = normalizeRuntimeProfile(runtimeProfile);
+  const includeBrowser = normalizedProfile === 'browser_cli';
+  const guestUtilityPackages = includeBrowser
+    ? 'curl ca-certificates gnupg git rsync unzip xvfb dbus-x11'
+    : 'curl ca-certificates gnupg git rsync unzip dbus-x11 adb';
   const guestTokenB64 = encodeGuestToken(guestToken);
   const envFile = '/etc/neoagent/neoagent.env';
   const appDir = '/opt/neoagent';
+  const playwrightBrowsersPath = `${appDir}/.playwright-browsers`;
   const bootstrapMarker = '/var/lib/neoagent/bootstrap-complete';
   const browserReadyMarker = '/var/lib/neoagent/browser-runtime-ready';
   const browserDepsMarker = '/var/lib/neoagent/browser-deps-installed';
@@ -74,6 +95,7 @@ function createCloudInitScript({
     '',
     'export DEBIAN_FRONTEND=noninteractive',
     `APP_DIR=${JSON.stringify(appDir)}`,
+    `PLAYWRIGHT_BROWSERS_PATH=${JSON.stringify(playwrightBrowsersPath)}`,
     `BOOTSTRAP_MARKER=${JSON.stringify(bootstrapMarker)}`,
     `BROWSER_READY_MARKER=${JSON.stringify(browserReadyMarker)}`,
     `BROWSER_DEPS_MARKER=${JSON.stringify(browserDepsMarker)}`,
@@ -123,53 +145,47 @@ function createCloudInitScript({
     '',
     `printf '%s\n' ${JSON.stringify(`NEOAGENT_VM_GUEST_TOKEN_B64=${guestTokenB64}`)} > "$ENV_FILE"`,
     `printf '%s\n' ${JSON.stringify(`NEOAGENT_GUEST_AGENT_PORT=${guestAgentPort}`)} >> "$ENV_FILE"`,
+    `printf '%s\n' ${JSON.stringify(`NEOAGENT_GUEST_PROFILE=${normalizedProfile}`)} >> "$ENV_FILE"`,
     'chmod 0600 "$ENV_FILE"',
     '',
     'cd "$APP_DIR"',
     'export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1',
+    'export PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH"',
     'if [ ! -d node_modules ] || [ ! -f node_modules/.neoagent-bootstrap-stamp ] || [ package.json -nt node_modules/.neoagent-bootstrap-stamp ]; then',
     '  echo "Installing npm dependencies..."',
-    '  retry_cmd npm cache clean --force',
-    '  retry_cmd npm install --omit=dev --no-audit --no-fund || { echo "Error: npm install failed." >&2; exit 1; }',
+    '  retry_cmd npm install --omit=dev --ignore-scripts --prefer-offline --no-audit --no-fund || { echo "Error: npm install failed." >&2; exit 1; }',
     '  mkdir -p node_modules',
     '  date > node_modules/.neoagent-bootstrap-stamp',
     'fi',
     '',
-    'if [ ! -f "$BROWSER_DEPS_MARKER" ]; then',
-    '  echo "Updating package lists..."',
-    '  retry_cmd apt-get update || echo "Warning: apt-get update failed, proceeding with cached lists."',
-    '',
-    '  echo "Installing browser runtime dependencies..."',
-    '  retry_cmd apt-get install -y --no-install-recommends \\',
-    '    curl ca-certificates gnupg git rsync unzip \\',
-    '    dbus-x11 \\',
-    '    xvfb \\',
-    '    libatk1.0-0 libatk-bridge2.0-0 libatspi2.0-0 libcups2 \\',
-    '    libx11-xcb1 libgtk-3-0 libnss3 libnspr4 libxcomposite1 libxdamage1 \\',
-    '    libxrandr2 libxkbcommon0 libasound2t64 libgbm1 libdrm2 libdbus-1-3 \\',
-    '    libpango-1.0-0 libpangocairo-1.0-0 libxshmfence1 || echo "Warning: Some browser dependencies failed to install."',
-    '  touch "$BROWSER_DEPS_MARKER"',
-    'else',
-    '  echo "Browser runtime dependencies already installed; skipping apt install."',
-    'fi',
     '',
-    'systemctl daemon-reload',
-    'systemctl enable neoagent-guest-agent.service || true',
-    'if ! systemctl is-active --quiet neoagent-guest-agent.service; then',
-    '  systemctl start neoagent-guest-agent.service || true',
-    'fi',
-    'echo "NeoAgent guest agent is available; continuing browser runtime provisioning..."',
+    'echo "Ensuring guest runtime utilities..."',
+    'retry_cmd apt-get update || echo "Warning: apt-get update failed, proceeding with cached lists."',
+    `retry_cmd apt-get install -y --no-install-recommends ${guestUtilityPackages} || { echo "Error: Failed to install required guest runtime utilities." >&2; exit 1; }`,
     '',
-    'PLAYWRIGHT_BROWSERS_PATH="$APP_DIR/.playwright-browsers"',
-    'PLAYWRIGHT_STAMP="$PLAYWRIGHT_BROWSERS_PATH/.firefox-installed"',
-    'mkdir -p "$PLAYWRIGHT_BROWSERS_PATH"',
-    'if [ ! -f "$PLAYWRIGHT_STAMP" ] || [ package.json -nt "$PLAYWRIGHT_STAMP" ]; then',
-    '  echo "Installing Playwright browsers..."',
-    '  PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH" retry_cmd npx playwright install firefox || { echo "Error: Playwright browser install failed." >&2; exit 1; }',
-    '  date > "$PLAYWRIGHT_STAMP"',
-    'fi',
+    'echo "NeoAgent guest runtime payload is ready."',
     '',
-    'touch "$BROWSER_READY_MARKER"',
+    ...(includeBrowser
+      ? [
+        'echo "Continuing browser runtime provisioning..."',
+        'PLAYWRIGHT_BROWSERS_PATH="$APP_DIR/.playwright-browsers"',
+        'PLAYWRIGHT_STAMP="$PLAYWRIGHT_BROWSERS_PATH/.chromium-installed"',
+        'mkdir -p "$PLAYWRIGHT_BROWSERS_PATH"',
+        'if [ ! -f "$BROWSER_DEPS_MARKER" ]; then',
+        '  echo "Installing Playwright browser dependencies..."',
+        '  PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH" retry_cmd npx playwright install-deps chromium || { echo "Error: Playwright dependency install failed." >&2; exit 1; }',
+        '  touch "$BROWSER_DEPS_MARKER"',
+        'fi',
+        'if [ ! -f "$PLAYWRIGHT_STAMP" ] || [ package.json -nt "$PLAYWRIGHT_STAMP" ]; then',
+        '  echo "Installing Playwright browsers..."',
+        '  PLAYWRIGHT_BROWSERS_PATH="$PLAYWRIGHT_BROWSERS_PATH" retry_cmd npx playwright install chromium || { echo "Error: Playwright browser install failed." >&2; exit 1; }',
+        '  date > "$PLAYWRIGHT_STAMP"',
+        'fi',
+        'touch "$BROWSER_READY_MARKER"',
+      ]
+      : [
+        'rm -f "$BROWSER_READY_MARKER"',
+      ]),
     'touch "$BOOTSTRAP_MARKER"',
     'echo "NeoAgent guest bootstrap completed."',
     '',
@@ -178,16 +194,109 @@ function createCloudInitScript({
 
 function createCloudInitUserData({
   guestToken,
-  guestPayloadBase64,
+  guestPayloadBase64 = '',
   guestAgentPort = 8421,
+  runtimeMode = 'template',
+  runtimeProfile = 'browser_cli',
 }) {
+  const normalizedProfile = normalizeRuntimeProfile(runtimeProfile);
+  const includeBrowser = normalizedProfile === 'browser_cli';
+  const guestAgentInnerCommand = includeBrowser
+    ? 'set -a; . /etc/neoagent/neoagent.env; set +a; cd /opt/neoagent && env DISPLAY=:99 PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers /usr/bin/env node server/guest_agent.js 2>&1 | tee -a /var/log/neoagent-guest-agent.log >/dev/console'
+    : 'set -a; . /etc/neoagent/neoagent.env; set +a; cd /opt/neoagent && /usr/bin/env node server/guest_agent.js 2>&1 | tee -a /var/log/neoagent-guest-agent.log >/dev/console';
+  const guestAgentLaunchCommand = `nohup /bin/sh -lc ${JSON.stringify(guestAgentInnerCommand)} </dev/null >/dev/null 2>&1 &`;
   const guestTokenB64 = encodeGuestToken(guestToken);
   const bootstrapScript = createCloudInitScript({
     guestToken,
     guestPayloadPath: '/var/lib/neoagent/guest-payload.tar.gz',
     guestAgentPort,
+    runtimeProfile: normalizedProfile,
   });
 
+  if (runtimeMode === 'user') {
+    return [
+      '#cloud-config',
+      'package_update: false',
+      'write_files:',
+      '  - path: /etc/neoagent/neoagent.env',
+      "    permissions: '0600'",
+      '    owner: root:root',
+      '    content: |',
+      `      NEOAGENT_VM_GUEST_TOKEN_B64=${guestTokenB64}`,
+      `      NEOAGENT_GUEST_AGENT_PORT=${guestAgentPort}`,
+      `      NEOAGENT_GUEST_PROFILE=${normalizedProfile}`,
+      ...(includeBrowser
+        ? [
+          '  - path: /etc/systemd/system/neoagent-xvfb.service',
+          "    permissions: '0644'",
+          '    owner: root:root',
+          '    content: |',
+          '      [Unit]',
+          '      Description=NeoAgent virtual display',
+          '      After=network-online.target',
+          '      Wants=network-online.target',
+          '',
+          '      [Service]',
+          '      Type=simple',
+          '      ExecStart=/usr/bin/Xvfb :99 -screen 0 1440x900x24 -ac -nolisten tcp',
+          '      Restart=always',
+          '      RestartSec=2',
+          '      StandardOutput=journal+console',
+          '      StandardError=journal+console',
+          '',
+          '      [Install]',
+          '      WantedBy=multi-user.target',
+        ]
+        : []),
+      '  - path: /etc/systemd/system/neoagent-guest-agent.service',
+      "    permissions: '0644'",
+      '    owner: root:root',
+      '    content: |',
+      '      [Unit]',
+      '      Description=NeoAgent guest agent',
+      '      After=network-online.target',
+      ...(includeBrowser ? ['      After=neoagent-xvfb.service'] : []),
+      '      ConditionPathExists=/etc/neoagent/neoagent.env',
+      '      Wants=network-online.target',
+      '',
+      '      [Service]',
+      '      Type=simple',
+      '      EnvironmentFile=/etc/neoagent/neoagent.env',
+      '      ExecStartPre=/bin/mkdir -p /var/lib/neoagent',
+      ...(includeBrowser
+        ? [
+          '      ExecStartPre=/usr/bin/touch /var/lib/neoagent/browser-runtime-ready',
+          '      ExecStartPre=/bin/sh -lc \'for _ in $(seq 1 30); do [ -S /tmp/.X11-unix/X99 ] && exit 0; sleep 1; done; exit 1\'',
+          '      Environment=DISPLAY=:99',
+          '      Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers',
+        ]
+        : [
+          '      ExecStartPre=/bin/sh -lc \'rm -f /var/lib/neoagent/browser-runtime-ready || true\'',
+        ]),
+      '      ExecStartPre=/usr/bin/touch /var/lib/neoagent/bootstrap-complete',
+      '      WorkingDirectory=/opt/neoagent',
+      '      ExecStart=/usr/bin/env node /opt/neoagent/server/guest_agent.js',
+      '      Restart=always',
+      '      RestartSec=5',
+      '      StandardOutput=journal+console',
+      '      StandardError=journal+console',
+      '',
+      '      [Install]',
+      '      WantedBy=multi-user.target',
+      'runcmd:',
+      '  - [bash, -lc, "systemctl daemon-reload"]',
+      ...(includeBrowser
+        ? [
+          '  - [bash, -lc, "systemctl enable neoagent-xvfb.service"]',
+          '  - [bash, -lc, "systemctl start neoagent-xvfb.service"]',
+        ]
+        : []),
+      '  - [bash, -lc, "systemctl enable neoagent-guest-agent.service"]',
+      '  - [bash, -lc, "systemctl start --no-block neoagent-guest-agent.service"]',
+      '',
+    ].join('\n');
+  }
+
   return [
     '#cloud-config',
     'package_update: false',
@@ -195,9 +304,10 @@ function createCloudInitUserData({
     '  - path: /etc/neoagent/neoagent.env',
     "    permissions: '0600'",
     '    owner: root:root',
-    '    content: |',
+      '    content: |',
       `      NEOAGENT_VM_GUEST_TOKEN_B64=${guestTokenB64}`,
       `      NEOAGENT_GUEST_AGENT_PORT=${guestAgentPort}`,
+      `      NEOAGENT_GUEST_PROFILE=${normalizedProfile}`,
     '  - path: /var/lib/neoagent/guest-payload.tar.gz',
     "    permissions: '0644'",
     '    owner: root:root',
@@ -216,12 +326,22 @@ function createCloudInitUserData({
     '      [Unit]',
     '      Description=NeoAgent guest agent',
     '      After=network-online.target',
+    '      After=cloud-final.service',
+    '      After=neoagent-guest-bootstrap.service',
+    ...(includeBrowser ? ['      After=neoagent-xvfb.service'] : []),
+    '      ConditionPathExists=/etc/neoagent/neoagent.env',
+    ...(includeBrowser ? ['      Requires=neoagent-xvfb.service'] : []),
     '      Wants=network-online.target',
     '',
     '      [Service]',
     '      Type=simple',
     '      EnvironmentFile=/etc/neoagent/neoagent.env',
-    '      Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers',
+    ...(includeBrowser
+      ? [
+        '      Environment=DISPLAY=:99',
+        '      Environment=PLAYWRIGHT_BROWSERS_PATH=/opt/neoagent/.playwright-browsers',
+      ]
+      : []),
     '      WorkingDirectory=/opt/neoagent',
     '      ExecStart=/usr/bin/env node /opt/neoagent/server/guest_agent.js',
     '      Restart=always',
@@ -231,6 +351,29 @@ function createCloudInitUserData({
     '',
     '      [Install]',
     '      WantedBy=multi-user.target',
+    ...(includeBrowser
+      ? [
+        '  - path: /etc/systemd/system/neoagent-xvfb.service',
+        "    permissions: '0644'",
+        '    owner: root:root',
+        '    content: |',
+        '      [Unit]',
+        '      Description=NeoAgent virtual display',
+        '      After=network-online.target',
+        '      Wants=network-online.target',
+        '',
+        '      [Service]',
+        '      Type=simple',
+        '      ExecStart=/usr/bin/Xvfb :99 -screen 0 1440x900x24 -ac -nolisten tcp',
+        '      Restart=always',
+        '      RestartSec=2',
+        '      StandardOutput=journal+console',
+        '      StandardError=journal+console',
+        '',
+        '      [Install]',
+        '      WantedBy=multi-user.target',
+      ]
+      : []),
     '  - path: /etc/systemd/system/neoagent-guest-bootstrap.service',
     "    permissions: '0644'",
     '    owner: root:root',
@@ -249,8 +392,14 @@ function createCloudInitUserData({
     '      WantedBy=multi-user.target',
     'runcmd:',
     '  - [bash, -lc, "systemctl daemon-reload"]',
-    '  - [bash, -lc, "systemctl enable neoagent-guest-bootstrap.service"]',
-    '  - [bash, -lc, "systemctl start neoagent-guest-bootstrap.service"]',
+    ...(includeBrowser
+      ? [
+        '  - [bash, -lc, "systemctl enable neoagent-xvfb.service"]',
+        '  - [bash, -lc, "systemctl start neoagent-xvfb.service"]',
+      ]
+      : []),
+    '  - [bash, -lc, "/usr/local/bin/neoagent-guest-bootstrap.sh"]',
+    `  - [bash, -lc, ${JSON.stringify(guestAgentLaunchCommand)}]`,
     '',
   ].join('\n');
 }
@@ -263,6 +412,21 @@ function createCloudInitMetaData({ instanceId, localHostName }) {
   ].join('\n');
 }
 
+function resolveCloudInitIdentity(userRoot) {
+  const relativePath = path.relative(VM_ROOT, path.resolve(userRoot || ''));
+  const normalized = relativePath
+    .split(path.sep)
+    .filter(Boolean)
+    .map((segment) => segment.replace(/[^a-z0-9_-]+/gi, '-').replace(/^-+|-+$/g, '').slice(0, 32))
+    .filter(Boolean)
+    .join('-');
+  const scope = normalized || 'default';
+  return {
+    instanceId: `neoagent-${scope}`,
+    localHostName: `neoagent-${scope}`,
+  };
+}
+
 function commandExists(command) {
   const probe = spawnSync(
     process.platform === 'win32' ? 'where' : 'bash',
@@ -413,6 +577,8 @@ function ensureGuestBootstrapSeed({
   guestToken,
   guestAgentPort = 8421,
   guestArch = 'x64',
+  runtimeMode = 'template',
+  runtimeProfile = 'browser_cli',
 }) {
   const seedRoot = path.join(userRoot, 'cloud-init');
   const seedDir = path.join(seedRoot, 'seed');
@@ -423,17 +589,18 @@ function ensureGuestBootstrapSeed({
   const userDataPath = path.join(seedDir, 'user-data');
   const metaDataPath = path.join(seedDir, 'meta-data');
   const startupNshPath = path.join(seedDir, 'startup.nsh');
-  const guestPayloadArchivePath = createGuestPayloadArchive(seedDir);
-  const guestPayloadBase64 = fs.readFileSync(guestPayloadArchivePath).toString('base64');
+  const guestPayloadBase64 = runtimeMode === 'user'
+    ? ''
+    : fs.readFileSync(createGuestPayloadArchive(seedDir, runtimeProfile)).toString('base64');
   const userData = createCloudInitUserData({
     guestToken,
     guestPayloadBase64,
     guestAgentPort,
+    runtimeMode,
+    runtimeProfile,
   });
-  const metaData = createCloudInitMetaData({
-    instanceId: `neoagent-${path.basename(userRoot)}`,
-    localHostName: `neoagent-${path.basename(userRoot)}`,
-  });
+  const identity = resolveCloudInitIdentity(userRoot);
+  const metaData = createCloudInitMetaData(identity);
   const startupNsh = guestArch === 'arm64'
     ? [
       '@echo -off',
@@ -480,6 +647,7 @@ function ensureGuestBootstrapSeed({
 module.exports = {
   createCloudInitMetaData,
   createCloudInitUserData,
+  createCloudInitScript,
   createSeedIso,
   ensureGuestBootstrapSeed,
   GUEST_BOOTSTRAP_ROOT,