release: 0.40.0 — vm download UX, lifecycle-on-CLI, config tree, deploy JSON

[mobileoverlord]

Summary

Bumps avocado-cli to 0.40.0. 17 commits since 0.39.0.

Three themes:

1. avocado vm polish — streaming downloads with progress, smarter defaults, persistent cpu/memory/DNS config, and a vm config subcommand shared with Avocado.app. macOS lifecycle moved back into the CLI itself (Avocado.app adopts the pid via its existing reconciler) so vm start / vm stop no longer depend on the desktop being installed or responsive.
2. More JSON-output surface for the desktop app — runtime deploy --output json and config show --detail give the desktop the structured project + deploy events it needs to render its UI without parsing prose.
3. Cross-platform groundwork — cargo check --target x86_64-pc-windows-msvc now runs in CI, with #[cfg(unix)] gating on the AF_UNIX-bound modules.

Plus a clean --unlock correctness fix (regression test included), runtime-extension map syntax everywhere it should have been, an AVOCADO_ON_MERGE=systemd-tmpfiles --create extension hook, and streaming hashing for multi-GB image signing.

---

avocado vm UX

• Streaming downloads + progress (feb9b1e, 8cfc381) — vm update was timing out mid-download on the 458 MB var.btrfs artifact: ClientBuilder::timeout(30s) applied to the body download, and Response::bytes() buffered the entire body in RAM before disk writes started. Replaced with connect_timeout only + bytes_stream() writing each chunk straight to disk. Human mode now renders an indicatif MultiProgress queue matching avocado connect upload's style (one cyan/blue bar per artifact, finishes with (done)); JSON mode emits throttled download_{started,progress,completed} NDJSON events at ~10 Hz.
• Smarter vm start defaults (170324c) — after avocado vm update populates ~/.avocado/vm/install/, vm start now finds it without needing --vm-source or AVOCADO_VM_DIR. Resolution order: flag → env var → install/ (managed) → artifact-dir (dev workflow) → helpful error pointing at vm update. End-users on the managed path no longer have to think about env vars.
• Persistent cpu/memory overrides (d06cf42) — vm start --memory-mib / --cpus are now optional and resolve to runtime.{cpus,memory_mib} in ~/.avocado/vm/config.yaml (also written by Avocado.app's settings UI), with persistence: passing a flag writes it back so the next flag-less vm start and the desktop app converge. vm reset / vm update / route-on-demand callers pass None to pick up persisted settings instead of hardcoded 4096 MiB / 4 CPUs.
• vm config get/set/unset/list + persistent network config (7d41154) — ~/.avocado/vm/config.yaml is the shared host/guest config file Avocado.app reads/writes. First consumer: network.dns (+ optional one-shot --dns on vm start) pushed into the guest via resolvectl once SSH is up. Resolves the macOS-VPN case where scoped resolvers on the host are invisible to SLIRP's DNS proxy.

avocado vm lifecycle

• CLI owns qemu lifecycle on macOS; IPC is best-effort notify (7afc946) — vm start / vm stop previously delegated to Avocado.app over a synchronous JSON-line client, which made the CLI unusable when the app wasn't installed and stalled vm stop whenever the app's main actor was busy. CLI now spawns and signals qemu directly on every platform; Avocado.app (when present) adopts the pid via its pidfile reconciler. Remaining IPC (vm.notify.{starting,running,stopping,stopped}) is pure dashboard hinting — 100 ms timeouts, silent no-op when unreachable, self-heals via the reconciler within ~2s. Also adds a second virtio-serial port (avocado.control → control.sock) so Avocado.app's USBHostBridge / ControlPlane can talk to avocado-vm-agent without spawning qemu itself.

Desktop integration (JSON output)

• runtime deploy --output json (f96a00d) — skips TUI rendering and emits NDJSON task_registered / step / step_error events per phase (stamps, hash-collection, metadata-sign, deploy). Names mirror the human labels so the desktop can render them directly.
• config show --detail (a9633a9) — adds a detail block alongside the existing narrow projection: per-runtime extension references (with defined/enabled flags + node_paths for cross-ref navigation), per-extension types/packages/services/used_by_runtimes, and an SDK image+packages summary. Default output is byte-stable so the desktop's project-list scan keeps working unchanged. Six unit tests cover map/list package shapes, broken cross-refs, used_by inversion, and empty configs.

Cross-platform

• Windows-msvc compile check + unix-only module gating (7e43410) — new windows-check PR job runs cargo check --target x86_64-pc-windows-msvc. qga (AF_UNIX qemu-guest-agent client) and qmp (QEMU monitor over AF_UNIX) become #[cfg(unix)] at the module declaration; call sites in lifecycle::stop and boot_sync::wait_for_guest_ready get matching gates with a non-unix fallback that waits for SSH only. libc::SIG{TERM,KILL} replaced with local POSIX-value constants at the two call sites that referenced them (the send_signal function itself is already #[cfg(unix)]). No behavior change on macOS/Linux.

Runtime extension map form

• extensions: - foo: {enabled: false} syntax (3a7c528) — adds utils::runtime_extension::RuntimeExtensionSpec::parse_entry as the single source of truth. Every list-walker (Config::extension_deps, Config::find_active_extensions, runtime/build, runtime/deps, build, install) now funnels through it, so any future per-extension knob (merge_index, runs_on, …) lands in one spot. runtime build propagates enabled: false into the manifest's AVOCADO_EXT_DISABLED so avocadoctl skips activation at refresh time.
• Two follow-up call sites in build.rs + stamps.rs (a97ba18) — collect_extension_dependencies (nested loop) and the runtime input-hash compute in stamps.rs were still treating each entry as a bare string and silently skipping map-form entries. Fixed.

Extension build

• AVOCADO_ON_MERGE=systemd-tmpfiles --create for tmpfiles.d/ (7519489) — mirrors the existing sysusers.d / ld.so.conf.d detection. Extensions shipping config under usr/(local/)lib/tmpfiles.d/ or etc/tmpfiles.d/ get the merge hook automatically.

Reliability

• Streaming hashing for multi-GB images (509faca) — compute_file_hash previously read the whole file into memory before feeding it to Sha256/Blake3. Image artifacts can be tens of GB; on a 16 GB Mac that pushed the process into swap thrash. Replaced with a fixed 1 MiB-chunk streaming loop. Digest is identical.
• clean --unlock actually unlocks (0a141ed) — previous code called lock_file.save() after clearing entries, which merges with on-disk state and re-adds them. The desktop app's Unlock button hit this and silently no-op'd. Switched to save_replacing; regression test included.

Maintenance

• 2936f8d — cargo fmt sweep on update.rs.
• fca9e79 — docs link update.
• 48680dd — version bump to 0.40.0.

---

Test plan

• cargo fmt --all -- --check clean
• cargo clippy --all-targets --all-features -- -D warnings clean
• cargo build clean
• cargo test — all 9 test binaries green (993 + 1000 + 126 + 49 + 20 + 7 + 6 + 6 + 5 lib/integration tests pass)
• cargo audit — no advisories on the lockfile
• CI: windows-check runs on this PR for the first time on a release branch — verify cargo check --target x86_64-pc-windows-msvc clean
• Manual: avocado vm update end-to-end against the live channel renders the new progress bars, downloads stream to disk, atomic-swap completes
• Manual: avocado vm start from a clean ~/.avocado/vm/install/ (post-update) finds artifacts without --vm-source / AVOCADO_VM_DIR
• Manual: avocado vm config set network.dns 1.1.1.1, restart guest, resolvectl status inside the guest shows the configured resolver
• Manual: avocado vm start --memory-mib 8192 persists; next avocado vm start (no flags) launches with 8192 MiB
• Manual: avocado runtime deploy --output json -r <runtime> -d <device-ip> emits the four task_registered events then step/success transitions in order
• Manual: avocado config show --detail --output json returns the detail block with runtime/extension cross-refs populated
• Manual: avocado clean --unlock, verify on-disk lockfile no longer contains the cleared entry