From 451e1699c1371328007c4098ec31a33bbf698e9d Mon Sep 17 00:00:00 2001 From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com> Date: Thu, 10 Sep 2026 01:22:12 -0700 Subject: [PATCH 1/4] test(web): create sizes from the create response and never re-reads the machine Claude-Session: https://claude.ai/code/session_015E475vvXKQANyfiWTDwqsV --- web/tests/vm-freestyle-provider.test.ts | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/web/tests/vm-freestyle-provider.test.ts b/web/tests/vm-freestyle-provider.test.ts index b58b628924cd..20ff4b2b7526 100644 --- a/web/tests/vm-freestyle-provider.test.ts +++ b/web/tests/vm-freestyle-provider.test.ts @@ -319,6 +319,38 @@ describe("Freestyle platform contract", () => { ]); }); + test("create sizes from the create response and never re-reads the machine", async () => { + // vms.create already returns the machine's resources; a status read after + // it cost ~100 ms on every prod create for nothing. + const fake = fakeFreestyle({ probeExit: 0 }); + const gets: string[] = []; + fake.client.vms.create = async (options: unknown) => { + fake.creates.push(options); + return { + vm: fake.client.vms.ref(VM_ID), + vmId: VM_ID, + data: { + publicIpv6: "2602:f75c:0:1::2a", + vpcs: [], + resources: { cpu: 2, memory: 4096, storage: 16384 }, + }, + } as never; + }; + fake.client.vms.get = async (id: string) => { + gets.push(id); + throw new Error("create must not read the machine it just created"); + }; + const provider = providerWith(fake); + await provider.create({ + image: "sh-image", + network: { id: "vpc-test-1" }, + memoryMb: 20480, + imageSize: { name: "lgx", cpu: 12, memoryMb: 24576, storageMb: 98304 }, + } as never); + expect(gets).toEqual([]); + expect(fake.resizes).toEqual([{ cpu: 12, memory: 24576, storage: 98304 }]); + }); + test("network addresses persist from the create response, absent without a network", () => { expect( freestyleNetworkAddressMetadata({ From 6f82585c0f65e6856304f6865fece7cb58ae6124 Mon Sep 17 00:00:00 2001 From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com> Date: Thu, 10 Sep 2026 01:22:13 -0700 Subject: [PATCH 2/4] web: drop the status read after Freestyle create and warm the database during auth vms.create already returns the machine's resources, so growToRequestedSize takes them from the create response instead of a second status read that cost ~100 ms on every prod create. Create and attach-endpoint also open a pooled database connection while the caller is still being verified, so the cold TCP+TLS and RDS IAM token round trip overlaps auth instead of following it. Claude-Session: https://claude.ai/code/session_015E475vvXKQANyfiWTDwqsV --- web/app/api/vm/[id]/attach-endpoint/route.ts | 4 ++- web/app/api/vm/route.ts | 4 ++- web/db/client.ts | 38 ++++++++++++++++++-- web/services/vms/drivers/freestyle.ts | 8 +++-- 4 files changed, 48 insertions(+), 6 deletions(-) diff --git a/web/app/api/vm/[id]/attach-endpoint/route.ts b/web/app/api/vm/[id]/attach-endpoint/route.ts index 685275119230..59b5f46c57d5 100644 --- a/web/app/api/vm/[id]/attach-endpoint/route.ts +++ b/web/app/api/vm/[id]/attach-endpoint/route.ts @@ -1,3 +1,4 @@ +import { preconnectCloudDb } from "../../../../../db/client"; import { preconnectFreestyle } from "../../../../../services/vms/drivers/freestyle"; import { jsonResponse, @@ -18,8 +19,9 @@ export async function POST( request: Request, { params }: { params: Promise<{ id: string }> }, ): Promise { - // Warm the Freestyle connection while the caller is being verified. + // Warm the Freestyle and database connections while the caller is being verified. preconnectFreestyle(); + preconnectCloudDb(); return withAuthedVmApiRoute( request, "/api/vm/[id]/attach-endpoint", diff --git a/web/app/api/vm/route.ts b/web/app/api/vm/route.ts index 2bb402965c36..d1f964712684 100644 --- a/web/app/api/vm/route.ts +++ b/web/app/api/vm/route.ts @@ -2,6 +2,7 @@ // provider credentials stay behind server-side ownership checks. import type { Span } from "@opentelemetry/api"; +import { preconnectCloudDb } from "../../../db/client"; import { preconnectFreestyle } from "../../../services/vms/drivers/freestyle"; import { unauthorized, @@ -180,8 +181,9 @@ export async function GET(request: Request): Promise { } export async function POST(request: Request): Promise { - // Warm the Freestyle connection while the caller is being verified. + // Warm the Freestyle and database connections while the caller is being verified. preconnectFreestyle(); + preconnectCloudDb(); return withAuthedVmApiRoute( request, "/api/vm", diff --git a/web/db/client.ts b/web/db/client.ts index 9240e24657c0..29ea2f53033b 100644 --- a/web/db/client.ts +++ b/web/db/client.ts @@ -19,6 +19,8 @@ type CloudDb = ReturnType; type CloudDbState = { db: CloudDb; close: () => Promise; + /** Opens one pooled connection ahead of the first query; see preconnectCloudDb. */ + warm: () => Promise; key: string; }; @@ -244,7 +246,15 @@ export function cloudDb(): CloudDb { const pool = createAwsRdsIamPool(config); attachDatabasePool(pool); const db = drizzleNodePg({ client: pool, schema }) as unknown as CloudDb; - globalForDb.__cmuxCloudDb = { db, close: () => pool.end(), key }; + globalForDb.__cmuxCloudDb = { + db, + close: () => pool.end(), + warm: async () => { + const client = await pool.connect(); + client.release(); + }, + key, + }; return db; } @@ -253,10 +263,34 @@ export function cloudDb(): CloudDb { prepare: false, }); const db = createPostgresJsDb(sql); - globalForDb.__cmuxCloudDb = { db, close: () => sql.end(), key }; + globalForDb.__cmuxCloudDb = { + db, + close: () => sql.end(), + warm: async () => { + await sql`select 1`; + }, + key, + }; return db; } +/** + * Open a database connection before a route needs one. A cold invocation + * paid ~95 ms of TCP+TLS plus an STS round trip for the RDS IAM token inside + * the first query (`pg-pool.connect` on the create span); a route fires this + * while it is still verifying the caller so that cost overlaps auth instead + * of following it. Best effort, never awaited for correctness, and a no-op + * once the pool holds an idle connection. + */ +export function preconnectCloudDb(): void { + try { + cloudDb(); + void globalForDb.__cmuxCloudDb?.warm().catch(() => undefined); + } catch { + // No database configured (tests, offline builds): the first query reports it. + } +} + /** * Runs the small database probe used by the coderouter health endpoint. * diff --git a/web/services/vms/drivers/freestyle.ts b/web/services/vms/drivers/freestyle.ts index a3d2c56db921..21eadc12962a 100644 --- a/web/services/vms/drivers/freestyle.ts +++ b/web/services/vms/drivers/freestyle.ts @@ -987,6 +987,7 @@ export class FreestyleProvider implements VMProvider { vmId, undefined, span, + data.resources, { cpu: options.imageSize.cpu, memory: options.imageSize.memoryMb, @@ -997,7 +998,7 @@ export class FreestyleProvider implements VMProvider { // A size-less image boots at its snapshot's resources and only a // grow-only resize raises them. Size first so the daemon comes // up on the provider profile requested by the server. - await this.growToRequestedSize(fs, vm, vmId, options.memoryMb, span); + await this.growToRequestedSize(fs, vm, vmId, options.memoryMb, span, data.resources); } // The baked supervisor is already bringing the daemon up; the only // per-machine input it needs is the model-plane env file. @@ -1046,9 +1047,12 @@ export class FreestyleProvider implements VMProvider { vmId: string, memoryMb: number | undefined, span: Parameters[0], + // The create response already describes the machine; a caller without + // it (an older row being re-sized) pays one status read instead. + currentResources?: VmResources, targetResources?: VmResources, ): Promise { - const current = (await fs.vms.get(vmId)).resources; + const current = currentResources ?? (await fs.vms.get(vmId)).resources; const target = targetResources ?? freestyleTargetResources(memoryMb ?? PLAN_MACHINE_MEMORY_MB); const request = freestyleResizeRequest(current, target); setSpanAttributes(span, { From c0654fe143069afd107e0eb525d1b42089807086 Mon Sep 17 00:00:00 2001 From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com> Date: Thu, 10 Sep 2026 02:03:23 -0700 Subject: [PATCH 3/4] web: warm the cloud database at most once per process A burst of create or attach-endpoint requests, authenticated or not, shares one warm-up promise and so costs one pooled connection; a warm process never re-runs the probe query. Claude-Session: https://claude.ai/code/session_015E475vvXKQANyfiWTDwqsV --- web/db/client.ts | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/web/db/client.ts b/web/db/client.ts index 29ea2f53033b..b0bf9747b4b5 100644 --- a/web/db/client.ts +++ b/web/db/client.ts @@ -249,10 +249,10 @@ export function cloudDb(): CloudDb { globalForDb.__cmuxCloudDb = { db, close: () => pool.end(), - warm: async () => { + warm: coalesceWarm(async () => { const client = await pool.connect(); client.release(); - }, + }), key, }; return db; @@ -266,21 +266,39 @@ export function cloudDb(): CloudDb { globalForDb.__cmuxCloudDb = { db, close: () => sql.end(), - warm: async () => { + warm: coalesceWarm(async () => { await sql`select 1`; - }, + }), key, }; return db; } +/** + * Runs the warm-up once per process: every caller shares the first attempt's + * promise, and a failed attempt is forgotten so the next call can retry. A + * burst of requests, authenticated or not, therefore costs one connection, + * and a warm process never re-runs the probe query. + */ +function coalesceWarm(run: () => Promise): () => Promise { + let inFlight: Promise | null = null; + return () => { + inFlight ??= run().catch((error: unknown) => { + inFlight = null; + throw error; + }); + return inFlight; + }; +} + /** * Open a database connection before a route needs one. A cold invocation * paid ~95 ms of TCP+TLS plus an STS round trip for the RDS IAM token inside * the first query (`pg-pool.connect` on the create span); a route fires this * while it is still verifying the caller so that cost overlaps auth instead - * of following it. Best effort, never awaited for correctness, and a no-op - * once the pool holds an idle connection. + * of following it. Best effort, never awaited for correctness, and after the + * first success a no-op for the life of the process, so calling it ahead of + * auth cannot amplify an unauthenticated burst beyond one pooled connection. */ export function preconnectCloudDb(): void { try { From 51a5f30e736863c41e8bdd9fae5d3a6408e88458 Mon Sep 17 00:00:00 2001 From: Lawrence Chen <54008264+lawrencecchen@users.noreply.github.com> Date: Thu, 10 Sep 2026 19:56:47 -0700 Subject: [PATCH 4/4] test: create sizing under main's sized-image semantics Claude-Session: https://claude.ai/code/session_01Qbo7h8EMVTWizLKXD6ECRL --- web/tests/vm-freestyle-provider.test.ts | 65 ++++++++++++++++--------- 1 file changed, 43 insertions(+), 22 deletions(-) diff --git a/web/tests/vm-freestyle-provider.test.ts b/web/tests/vm-freestyle-provider.test.ts index f1b81a4ef9cd..cbc7af59f1c7 100644 --- a/web/tests/vm-freestyle-provider.test.ts +++ b/web/tests/vm-freestyle-provider.test.ts @@ -144,34 +144,55 @@ describe("Freestyle platform contract", () => { test("create sizes from the create response and never re-reads the machine", async () => { // vms.create already returns the machine's resources; a status read after - // it cost ~100 ms on every prod create for nothing. - const fake = fakeFreestyle({ probeExit: 0 }); - const gets: string[] = []; - fake.client.vms.create = async (options: unknown) => { - fake.creates.push(options); - return { - vm: fake.client.vms.ref(VM_ID), - vmId: VM_ID, - data: { - publicIpv6: "2602:f75c:0:1::2a", - vpcs: [], - resources: { cpu: 2, memory: 4096, storage: 16384 }, - }, - } as never; - }; - fake.client.vms.get = async (id: string) => { - gets.push(id); - throw new Error("create must not read the machine it just created"); + // it cost ~100 ms on every prod create for nothing. A size-less image is + // the one path that still grows the machine, and it grows from the create + // response; a sized image boots at its shape and is neither read nor grown. + const createResponse = (fake: ReturnType, gets: string[], resizes: unknown[]) => { + const vm = fake.client.vms.ref(VM_ID); + vm.resize = (async (request: unknown) => { + resizes.push(request); + }) as never; + fake.client.vms.create = async (options: unknown) => { + fake.creates.push(options); + return { + vm, + vmId: VM_ID, + data: { + publicIpv6: "2602:f75c:0:1::2a", + vpcs: [{ ipv4: "10.4.0.7", ipv6: "fd00:4::7" }], + resources: { cpu: 2, memory: 4096, storage: 16384 }, + }, + } as never; + }; + fake.client.vms.get = async (id: string) => { + gets.push(id); + throw new Error("create must not read the machine it just created"); + }; }; - const provider = providerWith(fake); - await provider.create({ + const sizeless = fakeFreestyle({ probeExit: 0 }); + const sizelessGets: string[] = []; + const sizelessResizes: unknown[] = []; + createResponse(sizeless, sizelessGets, sizelessResizes); + await providerWith(sizeless).create({ + image: "sh-image", + network: { id: "vpc-test-1" }, + memoryMb: 20480, + } as never); + expect(sizelessGets).toEqual([]); + expect(sizelessResizes).toHaveLength(1); + + const sized = fakeFreestyle({ probeExit: 0 }); + const sizedGets: string[] = []; + const sizedResizes: unknown[] = []; + createResponse(sized, sizedGets, sizedResizes); + await providerWith(sized).create({ image: "sh-image", network: { id: "vpc-test-1" }, memoryMb: 20480, imageSize: { name: "lgx", cpu: 12, memoryMb: 24576, storageMb: 98304 }, } as never); - expect(gets).toEqual([]); - expect(fake.resizes).toEqual([{ cpu: 12, memory: 24576, storage: 98304 }]); + expect(sizedGets).toEqual([]); + expect(sizedResizes).toEqual([]); }); test("network addresses persist from the create response, absent without a network", () => {