Protect cmux-tui state from full guest disks

Merged
AU
1mo ago
+1084-38

Summary

  • Preallocate and mount a fixed 1 GiB ext4 filesystem at cmux-tui's durable state root inside the existing guest disk.
  • Make the boot supervisor mount the reservation before starting cmux-tui and defer startup if an image-bearing VM cannot mount it.
  • Promote validated Freestyle base and desktop images with the existing 16/32/64/96/128/128 GB storage ladder unchanged.

Testing

  • Freestyle bake: state image allocation and mount check passed.
  • Freestyle image verification: daemon, WebSocket/PTY, clone identity, desktop, and state reservation checks passed.
  • Freestyle size derivation: all six existing sizes re-booted and passed.
  • bun run devbox:manifest:check
  • bun test tests/vm-image-manifest.test.ts tests/vm-image-sizes.test.ts
  • bun test tests/vm-devbox-identity.test.ts tests/vm-devbox-idle-wakeups.test.ts
  • bun run typecheck
  • Targeted ESLint: no errors (two existing warnings).
  • Focused image contract tests: shell parsing, reservation contract, daemon contract, and package parity passed.
  • The full vm-devbox-image.test.ts file has one pre-existing local-host failure because this Mac's Python 3.9 lacks tomllib; the image bake ran with Python 3.12 and passed the equivalent checks.

Impact map

  • Source of truth: web/services/vms/images/devbox/cmux-tui-state-mount; bake and verify wire it through the existing image pipeline.
  • Direct callers inspected: cmux-devbox-boot, build-devbox-freestyle.ts, verify-devbox-image.ts, devboxParkDaemonCommand, and cmux-tui's Linux state path.
  • Cross-surface effects: cmux-tui registry, journal, client log, and session state get isolated capacity; Freestyle API/exec/SSH and VM resource shapes are unchanged.
  • Residual risk: older images without the reservation keep their existing layout until replaced.

Mergeability

  • Base SHA: 9d5b1411cb1bf0d1721619d0e4f8e1a61260f5a0
  • Head SHA: b8912eacf4d22b305f0995bc47d35fdd57850bb8
  • Conflict-only gate: pass; no conflicted paths.

Summary by CodeRabbit

  • New Features
    • New default devbox images include a dedicated 1 GiB filesystem for cmux-tui state, separate from root-filesystem usage.
    • The state filesystem is mounted before cmux-tui starts and remains available when a VM resumes from a snapshot.
  • Behavior Changes
    • On images with the dedicated filesystem, cmux-tui startup is deferred if the filesystem cannot be mounted. Older images without it retain their existing state layout until replaced.
    • Fork-daemon readiness failures now report a generic error instead of including diagnostic details.

[!NOTE]
Medium Risk
Changes guest boot and daemon startup paths and consumes 1 GiB from every new image's root disk; mis-mounted reservations defer the daemon until fixed.

Overview
Reserves 1 GiB on the existing root disk for cmux-tui durable state so SQLite/WAL writes keep space when the rest of the filesystem fills, without changing VM size or the storage ladder.

Adds cmux-tui-state-mount (create/ensure): fallocate + mkfs.ext4 at /var/lib/cmux/cmux-tui-state.ext4, loop-mount at ~/.local/state/cmux-tui, seeding from any prior state. Bake/verify/Dockerfile install e2fsprogs, ship the helper, run reservation during Freestyle bake, and assert marker, image size, and mount in verify-devbox-image.ts. cmux-devbox-boot mounts via ensure before starting the daemon; if a reservation-bearing image cannot mount, startup is deferred (no root-filesystem fallback). Images without the marker keep the old layout.

Promotes new default Freestyle devbox snapshots (freestyle-cmux-devbox-20261007-225658-*) and demotes prior defaults. Fork-daemon readiness errors are generic in freestyle.ts and remoteState.ts (less guest diagnostic detail in provider errors).

Reviewed by Cursor Bugbot for commit 29f4a632defc562b509cd4f366c3542d9e2f9d50. Bugbot is set up for automated code reviews on this repo. Configure here.