Cache VM disks in an OCI registry and add --os targeting - #46
Merged
Conversation
- refactor(qemu): remove transplant_wsl*.go — WSLEngineFiles, WSLInboxShim and TransplantWSLIntoBootWim now live in go-winkit/winpe, committed there in 3b7f219
- refactor(cmd): extract resolveEngine() from three call sites — init, build, and run now share one priority chain (CLI flag > TOML [cell].engine > "docker" default) instead of each reimplementing it - test(cmd): add resolveEngine unit tests covering flag, TOML fallback, macOS alias, and default
- refactor(build): replace ~90 lines of inline stage/inject/master with one winpe.Build() call — WinPE ISO creation is now the library's responsibility - chore(deps): point go-winkit at local working copy (replace directive) — drop before merging
…oding ../nixhome - test(helpers): add nixhomeDir() honoring DEVCELL_NIXHOME > DEVCELL_NIXHOME_PATH > ../nixhome — tests keep finding nixhome once it moves to devcell-sh/community-home - test(image,mise,modules): replace hardcoded ../nixhome with nixhomeDir() at every call site — tests survive the external repo split without editing each file again
…S runs slipped through - test(stealth): require navigator.webdriver as native boolean false, not deleted — matches BrowserScan's expectation that the property exists - test(stealth): flag any override of Navigator.prototype.webdriver — forces reliance on AutomationControlled flag, cutting lie surface - test(stealth): fail when window.chrome.runtime is fabricated on ordinary pages — closes CreepJS hasBadChromeRuntime signal - test(stealth): require window.chrome.app present alongside the runtime check — keeps real Chrome's baseline shape intact - test(stealth): reject a SwiftShader string in the spoofed WebGL renderer — closes the top headless/datacenter GPU tell - test(stealth): require a named Function.prototype.toString wrapper with stack scrubbing — closes CreepJS hasToStringProxy signal - test(stealth): resolve nixhome path via nixhomeDir() helper instead of a hardcoded relative path — keeps test working after nixhome relocation
- fix(scaffold): reject nixhome source nested in its own build dir — stops DEVCELL_NIXHOME self-reference from corrupting .devcell/ - fix(scaffold): CopyDir skips a destination nested inside its source — prevents silent partial-copy corruption if the upfront guard is bypassed - test(scaffold): add regression tests for self-referential nixhome source and nested-destination CopyDir calls
… engine - feat(engine): add --os linux/macos/windows, mapped to its default engine — targets a platform without knowing engine names - feat(engine): reject incompatible --os/--engine pairs (e.g. windows+tart) — catches misconfigured builds before they run - feat(cli): keep --macos as a working alias for --os=macos — existing scripts and muscle memory keep working - feat(cfg): add [cell].os TOML fallback — lets teams pin an OS default in project config instead of passing --os every time - refactor(engine): resolveEngine now returns an error and takes os args — no user-facing impact - test(engine): cover os precedence, macos alias, and invalid/incompatible combinations — locks in the new resolution order - docs(nix): expose [cell].os in home-manager module options — keeps generated config docs in sync with the new setting
…ntainer - fix(runner): enable nix-command/flakes for flake lock/update — `nix flake lock`/`update` no longer fails - fix(runner): enable nix-command/flakes for stack discovery — `stack list` no longer fails in bootstrap container
…U build fast path - feat(cmd): add `cell disk-store push/pull/resolve` wrapping go-diskoci — lets operators seed or inspect cached disk images outside a build - feat(cmd): probe/pull a cached base-profile disk in runBuildQemu — skips the full winkit provisioning pipeline entirely on a cache hit, cutting build time - feat(cmd): push ssh-able and base-profile disks after a successful build — populates the cache so later builds can hit it - feat(cmd): support `--no-cache` to bypass the pull probe only — pushes still happen, so cache stays warm even when forcing a fresh build - feat(cmd): support DEVCELL_DISK_CACHE_REGISTRY/REF and DISKOCI_USERNAME/PASSWORD env vars — lets registry and auth be overridden per environment - test(cmd): cover disk-cache ref/fingerprint derivation and push/pull round-trip against an in-process registry - build(go.mod): drop the local go-winkit replace directive — build now resolves the published module instead of a developer-machine path
…clean-module-cache builds - build(deps): declare github.com/devcell-sh/go-diskoci v0.1.0 in go.mod/go.sum — lets CI's Deploy Site build resolve the import from a clean checkout instead of failing go mod tidy - build(deps): bump go-containerregistry, docker/cli, klauspost/compress, x/mod, x/net, x/tools as incidental go mod tidy fallout — picks up upstream point-release fixes - build(nix): refresh flake.nix vendorHash to match the updated go.sum — keeps `nix build` from failing on a hash mismatch
…avior - test(cfg): cover FlakeEnabled() env>toml>false precedence — no user-facing impact - test(cfg): cover [mcp].enabled merge/dedup and TOML load — no user-facing impact - test(runner): rename SkipFlake tests to TrustFlake, add NoPorts coverage — no user-facing impact
Contributor
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
devcell | 9b7b899 | Commit Preview URL Branch Preview URL |
Sep 06 2026, 05:59 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
QEMU Windows builds now probe an OCI registry for a cached base-profile disk and pull it on a hit, skipping the full winkit provisioning pipeline (seconds instead of tens of minutes), and push their results back so later builds benefit. Users can also target a platform with
--os linux/macos/windowsinstead of knowing engine names, enable MCP servers per repo via[mcp].enabled(CELL-512), and skip all published ports with--no-ports. Project-level flake.nix install (CELL-447) flips from opt-out to opt-in — see Breaking changes.Breaking changes
flake.nixinstall is now opt-in, off by default: enable with--use-flake,[cell].flake = true, orDEVCELL_FLAKE=1. Cells that relied on automatic flake install must opt in after upgrading.--skip-flakeand--no-flakeare accepted but ignored (legacy no-ops); theDEVCELL_SKIP_FLAKEcontainer env var is no longer set.Changes
cell disk-store push/pull/resolvewrapping go-diskoci — operators can seed or inspect cached disk images outside a build--no-cachebypasses the pull only, andDEVCELL_DISK_CACHE_REGISTRY/REF+DISKOCI_USERNAME/PASSWORDoverride registry and auth per environment--os linux/macos/windowsmapped to its default engine plus a[cell].osTOML fallback, rejecting incompatible--os/--enginepairs and keeping--macosas a working alias — targets a platform without naming an engine--use-flake/[cell].flake/DEVCELL_FLAKE(CELL-447) — untrusted project flakes no longer install without an explicit opt-in--no-portsto suppress alldocker -pmappings (user[ports]and GUI VNC/RDP) — a cell can run fully unpublished when another transport handles access[mcp].enabledmerged union-dedup across global/project config and resolved at container start viaDEVCELL_MCP_ENABLED(CELL-512) — a repo can narrow which MCP servers start for that projectcell initnow resolves the engine like build/run (flag >[cell].engine/[cell].os> default) and honors the[nix].nixhomeoverride instead of silently ignoring bothnix flake lock/updateandstack listno longer fail in the bootstrap containerDEVCELL_NIXHOMEcan no longer corrupt.devcell/mid-copynixhomeDir()instead of hardcoded../nixhome(CELL-426), and cover flake precedence, MCP merge, and no-ports behaviorwinpe.Build(), delete WSL transplant stubs, extract sharedresolveEngine(), and require publishedgo-diskoci v0.1.0/go-winkitinstead of local replace directives — CI builds from a clean checkoutNeed help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.