VM platform: file sharing (DAX), USB passthrough, Rosetta x86, security + GitHub issue fixes

.gitignore

@@ -45,6 +45,9 @@ ExportOptions.plist
 # Release pipeline output
 release-build/
 
+# Guest build artifacts (kernel Image, compiled agent) — rebuilt via guest/kernel/build.sh + guest/agent/build.sh
+guest/out/
+
 # Dory runtime data
 .dory/
 
@@ -65,3 +68,6 @@ cloud/
 
 # Website build output (source lives in website/; built into docs/ via `npm run build`)
 docs-build/
+
+# Go build artifact (build.sh writes the real output to guest/out/)
+guest/agent/agent

COMPATIBILITY.md

@@ -81,7 +81,7 @@ CA trust install remain consent-gated, the same one-time admin grant OrbStack ne
 | **Bind-mount file sharing** | ✅ | Home dir shared into the VM (virtiofs); verified `docker run -v ~/proj:/app` reads/writes host files live |
 | One-click Kubernetes | ✅ | `KubernetesProvisioner` runs k3s in the shared VM; verified host `kubectl` + pod deploy; GUI "Enable" button |
 | Linux machines (Ubuntu/Debian/Fedora/Alpine) | ✅ | `MachineProvider` via `container machine`; verified real machine create/list/start/stop/delete; GUI picker |
-| x86/amd64 emulation | ✅ (qemu) | Auto-installs qemu binfmt; verified `--platform linux/amd64 → x86_64`. Rosetta fast-path is a documented gap |
+| x86/amd64 emulation | ✅ (qemu, with limits) | Auto-installs qemu binfmt; verified `--platform linux/amd64 → x86_64`. **Heavy amd64 workloads can segfault** under qemu-user on the default `dory-hv` engine — SQL Server (`mcr.microsoft.com/mssql/server`), Oracle, and some AVX/threading-heavy images hit `qemu: uncaught target signal 11`. This is a qemu-user emulation limit, not a Dory bug, and Rosetta cannot run on `dory-hv` (raw Hypervisor.framework). The fast x86 path is the Virtualization.framework helper: `dory vm --arch amd64 --rosetta` / `DORY_ENGINE_ROSETTA=1`. (GitHub #3) |
 | Volume file browser | ✅ | `VolumeBrowser`; verified list + read files inside volumes; GUI sheet |
 | Terminal / SSH into containers + machines | ✅ | `TerminalLauncher` opens Terminal.app against Dory's socket/engine |
 | Docker Desktop / OrbStack migration | ✅ | `MigrationAssistant` imports images + containers into Dory's shared VM; Docker-compatible sources stream image archives directly when possible, so local/private images do not require a registry pull or a full tarball buffered in app memory |
@@ -90,11 +90,11 @@ CA trust install remain consent-gated, the same one-time admin grant OrbStack ne
 
 ### Apple containerization helper: low-level VM controls delivered
 
-Every feature achievable through Apple's `container` CLI + the dind architecture is done. The four
-items below were each investigated and shown to need low-level VM control the CLI does not expose:
-device passthrough, memory ballooning, Rosetta device, custom mounts. Dory now delivers those
-controls through the bundled `dory-vm` helper, which links the `apple/containerization` Swift
-package and drives the VM in-process.
+Several features need low-level VM control the `container` CLI does not expose: audio, memory
+ballooning, the Rosetta device, custom mounts — all delivered through the bundled `dory-vm` helper,
+which links the `apple/containerization` Swift package and drives the VM in-process. USB *device*
+passthrough is the exception: the helper attaches a USB controller but does not yet pass a host
+device through — real per-device passthrough is the usbip-over-vsock path (roadmap Track 3.6).
 
 **Foundation built + PROVEN END-TO-END.** `Packages/ContainerizationEngine/` is an additive Swift
 package (separate from the shipping app) that links `apple/containerization` and drives the Linux VM
@@ -116,10 +116,12 @@ features without linking the framework's large dependency tree.
 |---|---|---|
 | Rosetta-speed x86 | ✅ **delivered** | `dory vm --arch amd64 --rosetta -- <cmd>` → `uname -m == x86_64`. Verified through the CLI |
 | Reverse / bidirectional file mount | ✅ **delivered** | `dory vm --mount host:guest -- <cmd>` reads/writes host files in the container. Verified |
-| USB / audio passthrough | ✅ **delivered** | `dory vm --devices`: a `VZInstanceExtension` injects an XHCI USB controller + `VZVirtioSoundDevice`. Verified `USB controllers attached: 1` |
+| Audio passthrough | ✅ **delivered** | `dory vm --devices`: a `VZInstanceExtension` injects `VZVirtioSoundDevice`. Verified audio device configured |
+| USB device passthrough | 🚧 **in progress** | `dory vm --devices` attaches a `VZXHCIController`, but **no host USB device is passed through** — it is an empty controller (`USB controllers attached: 1` confirms the controller, not a device). Real per-device passthrough is the usbip-over-vsock path (roadmap Track 3.6), pending the `--usb` hardware gate |
 | Dynamic memory balloon → macOS | ✅ **delivered** | `dory vm --devices` attaches a balloon and reclaims RAM at runtime via the public `vzVirtualMachine`, verified `1024MiB → 512MiB reclaimed to macOS` |
 
-**All four are delivered** through the bundled, entitlement-signed `dory-vm` helper, surfaced by the
+**Rosetta, file mount, audio, and the memory balloon are delivered** through the bundled,
+entitlement-signed `dory-vm` helper, surfaced by the
 `dory` CLI (`dory vm`). The default shared-VM engine is untouched. (A GUI entry point for the
 in-process engine is not yet wired up.)
 

Dory/App/AppDelegate.swift

@@ -1,6 +1,8 @@
 import AppKit
 
 final class DoryAppDelegate: NSObject, NSApplicationDelegate {
+    private var wakeObserver: NSObjectProtocol?
+
     static var isTestHost: Bool {
         ProcessInfo.processInfo.environment["XCTestConfigurationFilePath"] != nil
             || ProcessInfo.processInfo.environment["XCTestSessionIdentifier"] != nil
@@ -9,13 +11,23 @@ final class DoryAppDelegate: NSObject, NSApplicationDelegate {
     func applicationDidFinishLaunching(_ notification: Notification) {
         guard !Self.isTestHost else { return }
         NSApp.setActivationPolicy(.accessory)
+        wakeObserver = NSWorkspace.shared.notificationCenter.addObserver(
+            forName: NSWorkspace.didWakeNotification,
+            object: nil,
+            queue: .main
+        ) { _ in
+            SharedVMProvisioner.resyncClockAfterWake()
+        }
     }
 
     func applicationShouldTerminateAfterLastWindowClosed(_ sender: NSApplication) -> Bool {
         false
     }
 
     func applicationWillTerminate(_ notification: Notification) {
+        if let wakeObserver {
+            NSWorkspace.shared.notificationCenter.removeObserver(wakeObserver)
+        }
         DockerContext.deactivateSync()
         SharedVMProvisioner.stopEngineDetached()
     }

Dory/Compose/ComposeModel.swift

@@ -329,7 +329,7 @@ enum ComposeParser {
         return .mapping(merged)
     }
 
-    private static func stripTags(_ value: YAMLValue) -> YAMLValue {
+    private nonisolated static func stripTags(_ value: YAMLValue) -> YAMLValue {
         switch value {
         case let .tagged(_, inner): return stripTags(inner)
         case let .mapping(map): return .mapping(map.mapValues(stripTags))

Dory/Compose/YAMLParser.swift

@@ -12,12 +12,12 @@ struct YAMLParser {
     private let lines: [Line]
     private var index = 0
 
-    static func parse(_ text: String) throws -> YAMLValue {
+    nonisolated static func parse(_ text: String) throws -> YAMLValue {
         var parser = YAMLParser(text: text)
         return try parser.parseDocument()
     }
 
-    private init(text: String) {
+    private nonisolated init(text: String) {
         var collected: [Line] = []
         for raw in text.split(separator: "\n", omittingEmptySubsequences: false) {
             let stripped = YAMLParser.stripComment(String(raw))
@@ -28,19 +28,19 @@ struct YAMLParser {
         lines = collected
     }
 
-    private mutating func parseDocument() throws -> YAMLValue {
+    private nonisolated mutating func parseDocument() throws -> YAMLValue {
         guard index < lines.count else { return .null }
         return try parseNode(indent: lines[index].indent)
     }
 
-    private mutating func parseNode(indent: Int) throws -> YAMLValue {
+    private nonisolated mutating func parseNode(indent: Int) throws -> YAMLValue {
         if lines[index].content.hasPrefix("- ") || lines[index].content == "-" {
             return try parseSequence(indent: indent)
         }
         return try parseMapping(indent: indent)
     }
 
-    private mutating func parseMapping(indent: Int) throws -> YAMLValue {
+    private nonisolated mutating func parseMapping(indent: Int) throws -> YAMLValue {
         var map: [String: YAMLValue] = [:]
         while index < lines.count, lines[index].indent == indent,
               !lines[index].content.hasPrefix("- ") {
@@ -58,7 +58,7 @@ struct YAMLParser {
         return .mapping(map)
     }
 
-    private mutating func parseSequence(indent: Int) throws -> YAMLValue {
+    private nonisolated mutating func parseSequence(indent: Int) throws -> YAMLValue {
         var seq: [YAMLValue] = []
         while index < lines.count, lines[index].indent == indent,
               lines[index].content.hasPrefix("- ") || lines[index].content == "-" {
@@ -92,7 +92,7 @@ struct YAMLParser {
         return .sequence(seq)
     }
 
-    private mutating func parseChildBlock(parentIndent: Int) throws -> YAMLValue {
+    private nonisolated mutating func parseChildBlock(parentIndent: Int) throws -> YAMLValue {
         guard index < lines.count else { return .null }
         let next = lines[index]
         if next.indent > parentIndent {
@@ -106,7 +106,7 @@ struct YAMLParser {
 
     // MARK: Scalars and flow collections
 
-    static func scalarOrFlow(_ raw: String) throws -> YAMLValue {
+    nonisolated static func scalarOrFlow(_ raw: String) throws -> YAMLValue {
         let trimmed = raw.trimmingCharacters(in: .whitespaces)
         if let (tag, remainder) = mergeTag(trimmed) {
             return .tagged(tag, try scalarOrFlow(remainder))
@@ -118,7 +118,7 @@ struct YAMLParser {
         return scalar(trimmed)
     }
 
-    private static func mergeTag(_ trimmed: String) -> (MergeTag, String)? {
+    private nonisolated static func mergeTag(_ trimmed: String) -> (MergeTag, String)? {
         for (token, tag) in [("!override", MergeTag.override), ("!reset", MergeTag.reset)] {
             if trimmed == token { return (tag, "") }
             if trimmed.hasPrefix(token + " ") {
@@ -128,7 +128,7 @@ struct YAMLParser {
         return nil
     }
 
-    static func scalar(_ raw: String) -> YAMLValue {
+    nonisolated static func scalar(_ raw: String) -> YAMLValue {
         let trimmed = raw.trimmingCharacters(in: .whitespaces)
         if trimmed.hasPrefix("\"") && trimmed.hasSuffix("\"") && trimmed.count >= 2 {
             return .string(unescape(String(trimmed.dropFirst().dropLast())))
@@ -150,13 +150,13 @@ struct YAMLParser {
         return .string(trimmed)
     }
 
-    private static func unescape(_ s: String) -> String {
+    private nonisolated static func unescape(_ s: String) -> String {
         s.replacingOccurrences(of: "\\n", with: "\n")
             .replacingOccurrences(of: "\\t", with: "\t")
             .replacingOccurrences(of: "\\\"", with: "\"")
     }
 
-    static func splitKeyValue(_ content: String) -> (key: String, value: String)? {
+    nonisolated static func splitKeyValue(_ content: String) -> (key: String, value: String)? {
         var inSingle = false, inDouble = false
         let chars = Array(content)
         var i = 0
@@ -177,13 +177,13 @@ struct YAMLParser {
         return nil
     }
 
-    private static func unquoteKey(_ key: String) -> String {
+    private nonisolated static func unquoteKey(_ key: String) -> String {
         if key.hasPrefix("\"") && key.hasSuffix("\"") && key.count >= 2 { return String(key.dropFirst().dropLast()) }
         if key.hasPrefix("'") && key.hasSuffix("'") && key.count >= 2 { return String(key.dropFirst().dropLast()) }
         return key
     }
 
-    private static func stripComment(_ line: String) -> String {
+    private nonisolated static func stripComment(_ line: String) -> String {
         var inSingle = false, inDouble = false
         let chars = Array(line)
         var i = 0
@@ -205,9 +205,9 @@ struct YAMLParser {
 private struct FlowScanner {
     private let chars: [Character]
     private var i = 0
-    init(_ string: String) { chars = Array(string) }
+    nonisolated init(_ string: String) { chars = Array(string) }
 
-    mutating func parseValue() throws -> YAMLValue {
+    nonisolated mutating func parseValue() throws -> YAMLValue {
         skipSpaces()
         guard i < chars.count else { return .null }
         switch chars[i] {
@@ -218,7 +218,7 @@ private struct FlowScanner {
         }
     }
 
-    private mutating func parseSequence() throws -> YAMLValue {
+    private nonisolated mutating func parseSequence() throws -> YAMLValue {
         i += 1
         var items: [YAMLValue] = []
         skipSpaces()
@@ -233,7 +233,7 @@ private struct FlowScanner {
         return .sequence(items)
     }
 
-    private mutating func parseMapping() throws -> YAMLValue {
+    private nonisolated mutating func parseMapping() throws -> YAMLValue {
         i += 1
         var map: [String: YAMLValue] = [:]
         skipSpaces()
@@ -253,26 +253,45 @@ private struct FlowScanner {
         return .mapping(map)
     }
 
-    private mutating func parseQuoted() -> String {
+    private nonisolated mutating func parseQuoted() -> String {
         let quote = chars[i]; i += 1
         var result = ""
         while i < chars.count, chars[i] != quote { result.append(chars[i]); i += 1 }
         if i < chars.count { i += 1 }
         return result
     }
 
-    private mutating func parseScalar() -> String {
+    private nonisolated mutating func parseScalar() -> String {
         var result = ""
-        while i < chars.count, !",]}".contains(chars[i]) { result.append(chars[i]); i += 1 }
+        var braceDepth = 0
+        while i < chars.count {
+            let c = chars[i]
+            if c == "{" {
+                braceDepth += 1
+                result.append(c)
+                i += 1
+                continue
+            }
+            if c == "}" {
+                if braceDepth == 0 { break }
+                braceDepth -= 1
+                result.append(c)
+                i += 1
+                continue
+            }
+            if c == "," || c == "]" { break }
+            result.append(c)
+            i += 1
+        }
         return result.trimmingCharacters(in: .whitespaces)
     }
 
-    private mutating func parseKey() -> String {
+    private nonisolated mutating func parseKey() -> String {
         var result = ""
         while i < chars.count, !":,]}".contains(chars[i]) { result.append(chars[i]); i += 1 }
         return result.trimmingCharacters(in: .whitespaces)
     }
 
-    private func peek() -> Character? { i < chars.count ? chars[i] : nil }
-    private mutating func skipSpaces() { while i < chars.count, chars[i] == " " { i += 1 } }
+    private nonisolated func peek() -> Character? { i < chars.count ? chars[i] : nil }
+    private nonisolated mutating func skipSpaces() { while i < chars.count, chars[i] == " " { i += 1 } }
 }

Dory/Features/Containers/ContainersView.swift

@@ -35,21 +35,11 @@ struct ContainersView: View {
                 SkeletonRows()
                 Spacer(minLength: 0)
             } else if store.loadState == .engineOff {
-                if store.needsContainerToolchain || store.toolchainInstallPhase != .idle {
-                    VStack {
-                        Spacer(minLength: 0)
-                        EngineSetupCard()
-                        Spacer(minLength: 0)
-                    }
-                    .frame(maxWidth: .infinity, maxHeight: .infinity)
-                    .padding(40)
-                } else {
-                    TableEmptyState(glyph: .containers, title: "Engine not running",
-                                    message: store.sharedVMStatus.isEmpty
-                                        ? "Dory's container engine isn't running yet. It starts automatically when Dory connects."
-                                        : store.sharedVMStatus,
-                                    actionLabel: "Try again", action: { Task { await store.retryEngine() } })
-                }
+                TableEmptyState(glyph: .containers, title: "Engine not running",
+                                message: store.sharedVMStatus.isEmpty
+                                    ? "Dory's engine isn't running yet. It starts automatically when Dory connects."
+                                    : store.sharedVMStatus,
+                                actionLabel: "Try again", action: { Task { await store.retryEngine() } })
             } else if store.containers.isEmpty {
                 TableEmptyState(glyph: .containers, title: "No containers yet",
                                 message: "Run a container from an image, or start one with `docker run`.",