Increase VM SSH readiness timeout and diagnostics

Author: mjenkinsaktion

docs/exec-plans/active/EP-001-portable-coder-foundation-and-multi-provider-mvp.md

@@ -44,6 +44,7 @@ Initial user target providers/tools:
 - [x] (2026-02-20) Fix Windows VM start cloud-init port selection to fallback when default range is exhausted
 - [x] (2026-02-20) Add Windows helper script to patch legacy `start-vm.ps1` cloud-init port fallback on existing local clones
 - [x] (2026-02-20) Make Windows smoke SSH probe tolerate transient native-command connection errors during VM boot
+- [x] (2026-02-20) Increase VM SSH readiness timeouts and diagnostics for slow first-boot cloud images
 - [ ] (2026-02-18) Document setup/runbook and close out EP-001
 
 ## Context and Orientation
@@ -123,6 +124,7 @@ Acceptance criteria for EP-001:
 - 2026-02-20: PowerShell `Start-Process -ArgumentList` rejected empty elements, so `ssh-keygen -N` required explicit empty-string handling.
 - 2026-02-20: Some Windows hosts had no free ports in `38080-38120`; cloud-init server startup now needs fallback port allocation.
 - 2026-02-20: On some PowerShell environments, transient `ssh` connection failures surfaced as exceptions; smoke probing must retry instead of aborting early.
+- 2026-02-20: First boot SSH readiness on some hosts can exceed 120 seconds, so timeout windows need to be configurable and longer by default.
 
 ## Decision Log
 - 2026-02-18: Adopt harness-first planning model before implementation.

scripts/pcoder.cjs

@@ -1011,7 +1011,7 @@ function runInLinuxPortableVm(options) {
     sshPort,
     sshUser,
     sshKeyPath,
-    timeoutSeconds: 120
+    timeoutSeconds: resolveVmSshTimeoutSeconds(mergedEnv)
   });
 
   const remoteRoot = mergedEnv.PCODER_VM_PROJECTS_ROOT || '/home/portable/projects';
@@ -1201,6 +1201,18 @@ function waitForVmSshReady(options) {
   fail(`Timed out waiting for VM SSH readiness after ${timeoutSeconds}s.`);
 }
 
+function resolveVmSshTimeoutSeconds(env) {
+  const raw = env.PCODER_VM_SSH_TIMEOUT_SECONDS;
+  if (!raw) {
+    return 300;
+  }
+  const parsed = Number.parseInt(String(raw), 10);
+  if (!Number.isFinite(parsed) || parsed < 10 || parsed > 3600) {
+    fail('PCODER_VM_SSH_TIMEOUT_SECONDS must be an integer between 10 and 3600.');
+  }
+  return parsed;
+}
+
 function resolveVmToolRunner(tool, adapter, env) {
   const overrideKey = `PCODER_VM_${tool.toUpperCase()}_CMD`;
   if (env[overrideKey]) {

scripts/runtime/windows/smoke-check.ps1

@@ -1,5 +1,6 @@
 param(
-  [switch]$SkipToolChecks
+  [switch]$SkipToolChecks,
+  [int]$SshReadyTimeoutSeconds = 300
 )
 
 $ErrorActionPreference = 'Stop'
@@ -53,6 +54,7 @@ function Invoke-Ssh {
   param(
     [string]$SshExe,
     [string]$SshPort,
+    [string]$SshUser,
     [string]$Script
   )
 
@@ -63,7 +65,7 @@ function Invoke-Ssh {
     '-o', 'StrictHostKeyChecking=no',
     '-o', 'UserKnownHostsFile=NUL',
     '-o', 'ConnectTimeout=5',
-    'portable@127.0.0.1',
+    "$SshUser@127.0.0.1",
     'bash', '-lc', $Script
   )
 
@@ -185,25 +187,38 @@ try {
     throw 'No SSH client found.'
   }
   Add-Check -Name 'ssh:client' -Ok $true -Detail $sshExe
+  $sshUser = if ($env:PCODER_VM_USER) { $env:PCODER_VM_USER } else { 'portable' }
+  Add-Check -Name 'ssh:user' -Ok $true -Detail $sshUser
 
   $sshReady = $false
-  for ($attempt = 1; $attempt -le 60; $attempt++) {
-    $probe = Invoke-Ssh -SshExe $sshExe -SshPort $sshPort -Script 'echo vm-ready'
+  $pollIntervalSeconds = 2
+  $maxAttempts = [Math]::Max([Math]::Ceiling($SshReadyTimeoutSeconds / $pollIntervalSeconds), 1)
+  $lastProbeOutput = ''
+  for ($attempt = 1; $attempt -le $maxAttempts; $attempt++) {
+    $probe = Invoke-Ssh -SshExe $sshExe -SshPort $sshPort -SshUser $sshUser -Script 'echo vm-ready'
+    if ($probe.output) {
+      $lastProbeOutput = $probe.output.Trim()
+    }
     if ($probe.status -eq 0 -and $probe.output -match 'vm-ready') {
       $sshReady = $true
       Add-Check -Name 'ssh:ready' -Ok $true -Detail "attempt=$attempt"
       break
     }
-    Start-Sleep -Seconds 2
+    Start-Sleep -Seconds $pollIntervalSeconds
   }
   if (-not $sshReady) {
-    Add-Check -Name 'ssh:ready' -Ok $false -Detail 'timeout'
-    throw 'Timed out waiting for VM SSH readiness.'
+    Add-Check -Name 'ssh:ready' -Ok $false -Detail "timeout (${SshReadyTimeoutSeconds}s)"
+    $lastDetail = $lastProbeOutput
+    if (-not $lastDetail) {
+      $lastDetail = '(no ssh output)'
+    }
+    $lastDetail = $lastDetail -replace '\r?\n', ' '
+    throw "Timed out waiting for VM SSH readiness after ${SshReadyTimeoutSeconds}s. Last output: $lastDetail"
   }
 
   if (-not $SkipToolChecks) {
     foreach ($tool in @('codex', 'claude')) {
-      $hasTool = Invoke-Ssh -SshExe $sshExe -SshPort $sshPort -Script "command -v $tool >/dev/null 2>&1"
+      $hasTool = Invoke-Ssh -SshExe $sshExe -SshPort $sshPort -SshUser $sshUser -Script "command -v $tool >/dev/null 2>&1"
       $toolFound = $hasTool.status -eq 0
       $toolDetail = 'missing'
       if ($toolFound) {
@@ -212,7 +227,7 @@ try {
       Add-Check -Name "guest:$tool:command" -Ok $toolFound -Detail $toolDetail
 
       if ($toolFound) {
-        $version = Invoke-Ssh -SshExe $sshExe -SshPort $sshPort -Script "$tool --version"
+        $version = Invoke-Ssh -SshExe $sshExe -SshPort $sshPort -SshUser $sshUser -Script "$tool --version"
         $versionOk = $version.status -eq 0
         $versionDetail = 'ok'
         if (-not $versionOk) {