Optimize Cloud VM create path

web/app/api/vm/[id]/attach-endpoint/route.ts

@@ -37,6 +37,7 @@ export async function POST(
         throw err;
       }
     },
+    { includeTeams: "selected" },
   );
 }
 

web/app/api/vm/[id]/exec/route.ts

@@ -61,5 +61,6 @@ export async function POST(
         throw err;
       }
     },
+    { includeTeams: "selected" },
   );
 }

web/app/api/vm/[id]/route.ts

@@ -29,5 +29,6 @@ export async function DELETE(
       }
       return jsonResponse({ ok: true });
     },
+    { includeTeams: "selected" },
   );
 }

web/app/api/vm/[id]/ssh-endpoint/route.ts

@@ -42,5 +42,6 @@ export async function POST(
         throw err;
       }
     },
+    { includeTeams: "selected" },
   );
 }

web/app/api/vm/route.ts

@@ -76,6 +76,9 @@ export async function GET(request: Request): Promise<Response> {
       }));
       return jsonResponse({ vms });
     },
+    () => ({
+      requestedBillingTeamId: requestedVmTeamIdFromRequest(request),
+    }),
   );
 }
 
@@ -252,5 +255,29 @@ export async function POST(request: Request): Promise<Response> {
         createdAt: created.createdAt,
       });
     },
+    vmCreateAuthOptions,
   );
 }
+
+async function vmCreateAuthOptions(request: Request) {
+  return {
+    requestedBillingTeamId: requestedVmTeamIdFromRequest(request) ??
+      await requestedVmTeamIdFromBody(request),
+  };
+}
+
+async function requestedVmTeamIdFromBody(request: Request): Promise<string | null> {
+  try {
+    const rawText = await request.clone().text();
+    if (rawText.length === 0) return null;
+    const raw = JSON.parse(rawText);
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const candidate = raw as Record<string, unknown>;
+    const bodyBillingTeamId = candidate.billingTeamId ?? candidate.teamId;
+    return typeof bodyBillingTeamId === "string" && bodyBillingTeamId.trim()
+      ? bodyBillingTeamId.trim()
+      : null;
+  } catch {
+    return null;
+  }
+}

web/services/vms/auth.ts

@@ -18,14 +18,22 @@ export type AuthedTeam = {
   billingPlanId: string | null;
 };
 
+export type VerifyRequestOptions = {
+  readonly requestedBillingTeamId?: string | null;
+  readonly includeTeams?: "auto" | "all" | "selected";
+};
+
 /**
  * Verify the caller's Stack Auth session. Accepts either a cookie (browser path) or a
  * `Authorization: Bearer <access>` + `X-Stack-Refresh-Token: <refresh>` pair from the
  * native macOS client.
  *
  * Returns the resolved user or null if unauthenticated.
  */
-export async function verifyRequest(request: Request): Promise<AuthedUser | null> {
+export async function verifyRequest(
+  request: Request,
+  options: VerifyRequestOptions = {},
+): Promise<AuthedUser | null> {
   if (!isStackConfigured()) {
     return null;
   }
@@ -42,22 +50,30 @@ export async function verifyRequest(request: Request): Promise<AuthedUser | null
         tokenStore: { accessToken, refreshToken },
       });
       if (user) {
-        return await authedUserFromStackUser(user);
+        return await authedUserFromStackUser(user, options);
       }
     }
   }
 
   // Fall back to the Next.js cookie flow (when browser hits the route).
   const user = await stackServerApp.getUser({ tokenStore: request as unknown as { headers: { get(name: string): string | null } } });
   if (user) {
-    return await authedUserFromStackUser(user);
+    return await authedUserFromStackUser(user, options);
   }
   return null;
 }
 
-async function authedUserFromStackUser(user: StackUserLike): Promise<AuthedUser> {
+async function authedUserFromStackUser(
+  user: StackUserLike,
+  options: VerifyRequestOptions,
+): Promise<AuthedUser> {
   const selectedTeam = teamLike(user.selectedTeam);
-  const listedTeams = typeof user.listTeams === "function"
+  const requestedTeamId = normalizedOptionalString(options.requestedBillingTeamId);
+  const includeTeams = options.includeTeams ?? "auto";
+  const shouldListTeams = typeof user.listTeams === "function" &&
+    (includeTeams === "all" ||
+      (includeTeams === "auto" && (!selectedTeam || (requestedTeamId && selectedTeam.id !== requestedTeamId))));
+  const listedTeams = shouldListTeams && typeof user.listTeams === "function"
     ? (await user.listTeams()).map(teamLike).filter((team): team is TeamLike => !!team)
     : [];
   const teamIds = uniqueStrings([
@@ -117,6 +133,11 @@ function planIdFromMetadata(metadata: unknown): string | null {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 
+function normalizedOptionalString(value: string | null | undefined): string | null {
+  const normalized = value?.trim();
+  return normalized ? normalized : null;
+}
+
 function uniqueStrings(values: readonly (string | undefined)[]): readonly string[] {
   return [...new Set(values.filter((value): value is string => typeof value === "string" && value.length > 0))];
 }

web/services/vms/drivers/freestyle.ts

@@ -46,6 +46,7 @@ const CREATE_TIMEOUT_MS = 15 * 60 * 1000;
 const SNAPSHOT_TIMEOUT_MS = 15 * 60 * 1000;
 const EXEC_OVERHEAD_TIMEOUT_MS = 15_000;
 const MAX_EXEC_TIMEOUT_MS = 15 * 60 * 1000;
+const FREESTYLE_ACTIVE_STATES = new Set(["starting", "running", "suspending"]);
 
 function client(timeoutMs = DEFAULT_TIMEOUT_MS): Freestyle {
   const longFetch: typeof fetch = (input, init) =>
@@ -79,6 +80,34 @@ function mapStatus(state: string | null | undefined): VMStatus {
 export class FreestyleProvider implements VMProvider {
   readonly id = "freestyle" as const;
 
+  async listActiveVmIds(): Promise<readonly string[]> {
+    return withVmSpan(
+      "cmux.vm.provider.list_active",
+      {
+        "cmux.vm.provider": "freestyle",
+        "cmux.vm.operation": "list_active",
+        "cmux.timeout_ms": DEFAULT_TIMEOUT_MS,
+      },
+      async (span) => {
+        try {
+          const result = await client().vms.list();
+          const active = result.vms
+            .filter((vm) => !vm.deleted && FREESTYLE_ACTIVE_STATES.has(vm.state))
+            .map((vm) => vm.id);
+          setSpanAttributes(span, {
+            "cmux.vm.provider.active_count": active.length,
+            "cmux.vm.provider.total_count": result.totalCount,
+            "cmux.vm.provider.running_count": result.runningCount,
+            "cmux.vm.provider.starting_count": result.startingCount,
+          });
+          return active;
+        } catch (err) {
+          throw new ProviderError("freestyle", "listActiveVmIds", err);
+        }
+      },
+    );
+  }
+
   async create(options: CreateOptions): Promise<VMHandle> {
     const image = options.image.trim();
     if (!image) {

web/services/vms/drivers/types.ts

@@ -76,6 +76,8 @@ export type SnapshotRef = {
 export interface VMProvider {
   readonly id: ProviderId;
 
+  listActiveVmIds?(): Promise<readonly string[]>;
+
   create(options: CreateOptions): Promise<VMHandle>;
   destroy(vmId: string): Promise<void>;
 

web/services/vms/providerGateway.ts

@@ -14,6 +14,9 @@ import {
 import { VmProviderOperationError } from "./errors";
 
 export type VmProviderGatewayShape = {
+  readonly listActiveVmIds?: (
+    provider: ProviderId,
+  ) => Effect.Effect<readonly string[] | null, VmProviderOperationError>;
   readonly create: (provider: ProviderId, options: CreateOptions) => Effect.Effect<VMHandle, VmProviderOperationError>;
   readonly destroy: (provider: ProviderId, vmId: string) => Effect.Effect<void, VmProviderOperationError>;
   readonly exec: (
@@ -51,6 +54,11 @@ function providerEffect<A>(
 }
 
 export const VmProviderGatewayLive = Layer.succeed(VmProviderGateway, {
+  listActiveVmIds: (provider) =>
+    providerEffect(provider, "listActiveVmIds", () => {
+      const vmProvider = getProvider(provider);
+      return vmProvider.listActiveVmIds ? vmProvider.listActiveVmIds() : Promise.resolve(null);
+    }),
   create: (provider, options) =>
     providerEffect(provider, "create", () => getProvider(provider).create(options)),
   destroy: (provider, vmId) =>

web/services/vms/repository.ts

@@ -1,4 +1,4 @@
-import { and, count, desc, eq, inArray, isNotNull, isNull, ne, or, sql } from "drizzle-orm";
+import { and, desc, eq, isNotNull, isNull, ne, or, sql } from "drizzle-orm";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -39,6 +39,7 @@ export type VmRepositoryShape = {
     readonly image: string;
     readonly imageVersion?: string | null;
     readonly maxActiveVms: number;
+    readonly liveActiveProviderVmIds?: readonly string[] | null;
     readonly idempotencyKey?: string;
   }) => Effect.Effect<BeginCreateResult, VmDatabaseError | VmLimitExceededError>;
   readonly markCreateRunning: (input: {
@@ -217,19 +218,31 @@ export const VmRepositoryLive = Layer.succeed(VmRepository, {
               if (existing) return { inserted: false as const, vm: existing };
             }
 
-            const [active] = await tx
-              .select({ total: count() })
+            const activeCandidates = await tx
+              .select({
+                provider: cloudVms.provider,
+                providerVmId: cloudVms.providerVmId,
+                status: cloudVms.status,
+              })
               .from(cloudVms)
               .where(
-                and(
-                  inArray(cloudVms.status, ["provisioning", "running", "paused"]),
-                  or(
-                    eq(cloudVms.billingTeamId, input.billingTeamId),
-                    and(isNull(cloudVms.billingTeamId), eq(cloudVms.userId, input.userId)),
-                  ),
+                or(
+                  eq(cloudVms.billingTeamId, input.billingTeamId),
+                  and(isNull(cloudVms.billingTeamId), eq(cloudVms.userId, input.userId)),
                 ),
               );
-            const activeCount = Number(active?.total ?? 0);
+            const liveActiveProviderVmIds = input.liveActiveProviderVmIds
+              ? new Set(input.liveActiveProviderVmIds)
+              : null;
+            const activeCount = activeCandidates.filter((vm) =>
+              isActiveForLimit({
+                provider: vm.provider,
+                providerVmId: vm.providerVmId,
+                status: vm.status,
+                reconciledProvider: liveActiveProviderVmIds ? input.provider : null,
+                liveActiveProviderVmIds,
+              })
+            ).length;
             if (activeCount >= input.maxActiveVms) {
               throw new VmLimitExceededError({
                 kind: "active_vms",
@@ -420,3 +433,24 @@ export const VmRepositoryLive = Layer.succeed(VmRepository, {
       });
     }),
 });
+
+function isActiveForLimit(input: {
+  readonly provider: ProviderId;
+  readonly providerVmId: string | null;
+  readonly status: CloudVmRow["status"];
+  readonly reconciledProvider: ProviderId | null;
+  readonly liveActiveProviderVmIds: ReadonlySet<string> | null;
+}): boolean {
+  if (
+    input.provider === input.reconciledProvider &&
+    input.providerVmId &&
+    input.liveActiveProviderVmIds?.has(input.providerVmId)
+  ) {
+    return true;
+  }
+  if (input.status === "failed" || input.status === "destroyed") return false;
+  if (input.provider !== input.reconciledProvider) {
+    return input.status === "provisioning" || input.status === "running" || input.status === "paused";
+  }
+  return input.status === "provisioning";
+}

web/services/vms/routeHelpers.ts

@@ -1,6 +1,6 @@
 import type { Span } from "@opentelemetry/api";
 import { recordSpanError, withApiRouteSpan, type MaybeAttributes } from "../telemetry";
-import { unauthorized, verifyRequest, type AuthedUser } from "./auth";
+import { unauthorized, verifyRequest, type AuthedUser, type VerifyRequestOptions } from "./auth";
 
 /** Bearer + refresh token pair the mac app stashes in keychain. */
 export type StackBearer = { accessToken: string; refreshToken: string };
@@ -20,12 +20,17 @@ export type AuthedVmRouteContext = {
   span: Span;
 };
 
+export type VmRouteAuthOptionsInput =
+  | VerifyRequestOptions
+  | ((request: Request) => VerifyRequestOptions | Promise<VerifyRequestOptions>);
+
 export async function withAuthedVmApiRoute(
   request: Request,
   route: string,
   attributes: MaybeAttributes,
   failureLog: string,
   handler: (context: AuthedVmRouteContext) => Promise<Response>,
+  authOptions: VmRouteAuthOptionsInput = {},
 ): Promise<Response> {
   return withApiRouteSpan(
     request,
@@ -34,7 +39,10 @@ export async function withAuthedVmApiRoute(
     async (span) => {
       try {
         const bearer = parseBearer(request);
-        const user = await verifyRequest(request);
+        const resolvedAuthOptions = typeof authOptions === "function"
+          ? await authOptions(request)
+          : authOptions;
+        const user = await verifyRequest(request, resolvedAuthOptions);
         if (!user) return unauthorized();
         if (requiresBrowserMutationProtection(request.method, bearer) && !browserMutationOriginAllowed(request)) {
           return jsonResponse({ error: "forbidden" }, 403);

web/services/vms/workflows.ts

@@ -77,7 +77,10 @@ export function createVm(input: {
     const repo = yield* VmRepository;
     const providers = yield* VmProviderGateway;
     const billing = yield* VmBillingGateway;
-    const create = yield* repo.beginCreate(input);
+    const liveActiveProviderVmIds = input.provider === "freestyle" && providers.listActiveVmIds
+      ? yield* providers.listActiveVmIds(input.provider)
+      : null;
+    const create = yield* repo.beginCreate({ ...input, liveActiveProviderVmIds });
 
     if (!create.inserted) {
       const existing = create.vm;
@@ -154,24 +157,24 @@ export function createVm(input: {
       ),
     );
 
-    yield* recordCreditEvent(repo, create.vm, "vm.create.credit.reserved", creditReservation)
-      .pipe(Effect.catchAll(() => Effect.void));
-
-    yield* repo.recordUsageEvent({
-      userId: input.userId,
-      billingTeamId: input.billingTeamId,
-      billingPlanId: input.billingPlanId,
-      vmId: create.vm.id,
-      eventType: "vm.create.requested",
-      provider: input.provider,
-      imageId: input.image,
-      metadata: {
-        idempotencyKeySet: !!input.idempotencyKey,
-        imageVersion: input.imageVersion ?? null,
-      },
-    }).pipe(Effect.catchAll(() => Effect.void));
+    const preProviderAudit = Effect.all([
+      recordCreditEvent(repo, create.vm, "vm.create.credit.reserved", creditReservation),
+      repo.recordUsageEvent({
+        userId: input.userId,
+        billingTeamId: input.billingTeamId,
+        billingPlanId: input.billingPlanId,
+        vmId: create.vm.id,
+        eventType: "vm.create.requested",
+        provider: input.provider,
+        imageId: input.image,
+        metadata: {
+          idempotencyKeySet: !!input.idempotencyKey,
+          imageVersion: input.imageVersion ?? null,
+        },
+      }),
+    ], { discard: true, concurrency: 2 }).pipe(Effect.catchAll(() => Effect.void));
 
-    const handle = yield* providers.create(input.provider, { image: input.image }).pipe(
+    const providerCreate = providers.create(input.provider, { image: input.image }).pipe(
       Effect.tapError((err) =>
         Effect.all([
           refundCredit(billing, repo, create.vm, creditReservation),
@@ -193,6 +196,7 @@ export function createVm(input: {
         ], { discard: true }).pipe(Effect.catchAll(() => Effect.void))
       ),
     );
+    const [handle] = yield* Effect.all([providerCreate, preProviderAudit], { concurrency: 2 });
 
     const running = yield* repo
       .markCreateRunning({