vm inspect: expose the guest console path (#202)

* review: drop clone-side watchdog leftovers

CloneVMConfigFromFlags passes the snapshot policy straight through, so
the local only existed for the removed override branch. The clone-path
validateBackendFlags call is unreachable by construction: every knob it
gates is inherited from the snapshot, and create already rejects them
on Firecracker.

* vm: expose the guest console path in inspect (#201)

Consumers driving cocoon over the CLI cannot query the CH API socket
(0700, owner-only) to find where a VM's console lives. Inspect now
reports console_path for running VMs: the console.sock UDS (UEFI
serial, FC relay) resolved by a stat, or the CH-allocated PTY for
direct boot, which each boot path (start, clone, restore) queries once
via vm.info after the VMM is up and saves to console.pty in the run
dir, pidfile-style. Inspect and list stay free of API calls; boot
paths pay one vm.info GET plus a small buffered write, direct boot
only, after resume.

ToVM now also zeroes the runtime socket fields for non-running VMs:
clone and restore persist boot-time paths into the record, which
previously leaked as stale socket_path/vsock_socket on stopped clones,
contradicting the documented State==running contract.

* vm: drop runtime paths from stale-running inspect output

ReconcileState flips a dead-PID VM to stopped (stale) for display, but
ToVM had already populated socket_path/vsock_socket/console_path from
the persisted Running state; a reused PTY number could point a
supervisor at another process's terminal. Clear the paths at the flip.

* vm: reconcile stale-running state in one-shot status JSON

statusOnce serialized ToVM output directly, so vm status/list
--format json skipped the dead-PID flip and its runtime-path
clearing that inspect, table, and event modes already apply.

Author: CMGS

cmd/core/utils.go

@@ -62,8 +62,10 @@ func RouteRefs(ctx context.Context, hypers []hypervisor.Hypervisor, refs []strin
 	return result, nil
 }
 
+// ReconcileState returns the effective display state; a stale-running VM also loses its runtime paths — they died with the process, and a reused PTY number must not be advertised.
 func ReconcileState(vm *types.VM) string {
 	if vm.State == types.VMStateRunning && !utils.IsProcessAlive(vm.PID) {
+		vm.SocketPath, vm.VsockSocket, vm.ConsolePath = "", "", ""
 		return "stopped (stale)"
 	}
 	return string(vm.State)

cmd/core/utils_test.go

@@ -200,6 +200,31 @@ func TestPersistSnapshotDirCleansCaptureOnDirectError(t *testing.T) {
 	}
 }
 
+func TestReconcileStateClearsRuntimePathsOnStaleRunning(t *testing.T) {
+	vm := &types.VM{
+		State:       types.VMStateRunning,
+		PID:         0,
+		SocketPath:  "/run/api.sock",
+		VsockSocket: "/run/vsock.uds",
+		ConsolePath: "/dev/pts/3",
+	}
+	if got := ReconcileState(vm); got != "stopped (stale)" {
+		t.Fatalf("ReconcileState = %q, want %q", got, "stopped (stale)")
+	}
+	if vm.SocketPath != "" || vm.VsockSocket != "" || vm.ConsolePath != "" {
+		t.Errorf("stale-running VM keeps runtime paths: socket=%q vsock=%q console=%q",
+			vm.SocketPath, vm.VsockSocket, vm.ConsolePath)
+	}
+
+	alive := &types.VM{State: types.VMStateRunning, PID: os.Getpid(), ConsolePath: "/dev/pts/3"}
+	if got := ReconcileState(alive); got != string(types.VMStateRunning) {
+		t.Fatalf("ReconcileState = %q, want running", got)
+	}
+	if alive.ConsolePath == "" {
+		t.Error("live VM lost its console path")
+	}
+}
+
 // directErrSnap is a DirectCreator whose CreateFromDir always fails; the embedded interface panics on any other call, so the test proves the failure path alone.
 type directErrSnap struct {
 	snapshot.Snapshot

cmd/core/vmconfig.go

@@ -108,7 +108,6 @@ func CloneVMConfigFromFlags(cmd *cobra.Command, snapCfg types.SnapshotConfig) (*
 	if cmd.Flags().Changed("no-direct-io") {
 		noDirectIO, _ = cmd.Flags().GetBool("no-direct-io")
 	}
-	noWatchdog := snapCfg.NoWatchdog
 
 	restoreMode, err := restoreModeFromFlags(cmd)
 	if err != nil {
@@ -133,7 +132,7 @@ func CloneVMConfigFromFlags(cmd *cobra.Command, snapCfg types.SnapshotConfig) (*
 			ImageType:     snapCfg.ImageType,
 			Network:       network,
 			NoDirectIO:    noDirectIO,
-			NoWatchdog:    noWatchdog,
+			NoWatchdog:    snapCfg.NoWatchdog,
 			Windows:       snapCfg.Windows,
 			SharedMemory:  snapCfg.SharedMemory,
 			HugePages:     snapCfg.HugePages,

cmd/vm/run.go

@@ -328,9 +328,6 @@ func (h Handler) prepareClone(ctx context.Context, cmd *cobra.Command, conf *con
 	if err = vmCfg.Validate(); err != nil {
 		return cloneSetup{}, err
 	}
-	if err = validateBackendFlags(conf, vmCfg); err != nil {
-		return cloneSetup{}, err
-	}
 	// Envelope pins share create's digest-lock window; a record-backed clone's source pin already protects these.
 	releasePins, err := cmdcore.PinEnvelopeBlobs(ctx, conf, cfg.ImageBlobIDs)
 	if err != nil {
@@ -479,7 +476,7 @@ func (h Handler) createVM(cmd *cobra.Command, image string) (context.Context, *t
 	return ctx, info, hyper, nil
 }
 
-// validateBackendFlags fast-fails flag combinations the selected backend can never launch; boot-mode-dependent checks live in validateBootCompat. Shared by create, clone, and debug so the capability gate list cannot drift.
+// validateBackendFlags fast-fails flag combinations the selected backend can never launch; boot-mode-dependent checks live in validateBootCompat. Shared by create and debug so the capability gate list cannot drift.
 func validateBackendFlags(conf *config.Config, vmCfg *types.VMConfig) error {
 	if !conf.UseFirecracker {
 		return nil

cmd/vm/status.go

@@ -97,6 +97,10 @@ func statusOnce(ctx context.Context, hypers []hypervisor.Hypervisor, filters []s
 	}
 	vms = applyFilters(vms, filters)
 	sortVMs(vms)
+	// JSON serializes vms as-is, so stale-running records must reconcile here, not per output row.
+	for _, vm := range vms {
+		vm.State = types.VMState(cmdcore.ReconcileState(vm))
+	}
 	return renderVMList(vms, format, scopeDir)
 }
 

docs/cli.md

@@ -282,6 +282,8 @@ Applies to `cocoon vm debug`:
 | ---------------- | -------- | ------------------------------------------------- |
 | `--escape-char`  | `^]`     | Escape character (single char or `^X` caret notation) |
 
+For a running VM, `cocoon vm inspect` reports the console resolved at boot (start, clone, restore) as `console_path`: the `console.sock` UDS (UEFI serial, Firecracker relay) or the Cloud Hypervisor-allocated PTY (`/dev/pts/N`, direct-boot OCI). External supervisors can read the console from there without opening the owner-only API socket. A direct-boot VM booted by an older cocoon reports it from its next start.
+
 ### Exec Flags
 
 `cocoon vm exec` runs a command inside a running VM via the cocoon-agent (vsock, no SSH). Stdin/stdout/stderr stream like `kubectl exec`; the host shell sees the guest command's exit code.

hypervisor/backend.go

@@ -16,6 +16,7 @@ import (
 const (
 	APISocketName   = "api.sock"
 	ConsoleSockName = "console.sock"
+	ConsolePTYName  = "console.pty"
 	VsockSockName   = "vsock.uds"
 
 	// VsockGuestCID is constant — per-VM isolation comes from distinct UDS paths.

hypervisor/cloudhypervisor/clone.go

@@ -147,6 +147,7 @@ func (ch *CloudHypervisor) cloneAfterExtractParsed(ctx context.Context, vmID str
 	}); err != nil {
 		return nil, err
 	}
+	saveConsolePTY(ctx, vmID, runDir, sockPath, directBoot)
 
 	info := &types.VM{
 		ID: vmID, Hypervisor: typ, State: types.VMStateRunning,

hypervisor/cloudhypervisor/restore.go

@@ -117,6 +117,7 @@ func (ch *CloudHypervisor) restoreAfterExtract(ctx context.Context, vmID string,
 	if err = resumeVM(ctx, hc); err != nil {
 		return nil, fmt.Errorf("vm.resume: %w", err)
 	}
+	saveConsolePTY(ctx, vmID, rec.RunDir, sockPath, directBoot)
 
 	logger.Infof(ctx, "VM %s restored from snapshot", vmID)
 	return ch.FinalizeRestore(ctx, vmID, vmCfg, rec, pid)

hypervisor/cloudhypervisor/start.go

@@ -24,6 +24,10 @@ func (ch *CloudHypervisor) startOne(ctx context.Context, id string) error {
 			ch.saveCmdline(ctx, rec, args)
 			return ch.launchProcess(ctx, rec, args, rec.ResolvedNetnsPath(), false)
 		},
+		PostLaunch: func(ctx context.Context, rec *hypervisor.VMRecord, sockPath string, _ int) error {
+			saveConsolePTY(ctx, rec.ID, rec.RunDir, sockPath, hypervisor.IsDirectBoot(rec.BootConfig))
+			return nil
+		},
 	})
 }