fix(infra-local): install qemu lazily in the VM resource path (#237)

LocalInfraConfig.install() ran a blanket script on every make() that built
qemu (qemu-img/qemu-system-x86_64) whenever it was absent — even for Docker/
browser cubes that never boot a VM. On a Homebrew prefix without a qemu bottle
that became a slow source build on every local run.

qemu is touched only inside the VMResourceConfig branches of provision()/
launch(), so ensure it there via _ensure_qemu() (best-effort, no-op when
present) and drop the install() override (base no-op). Docker/browser cubes
now never trigger qemu. Renames install_local_infra.sh -> install_qemu.sh
(its sole remaining job). Local-backend slice of capability-scoped
provisioning (#191); supersedes the earlier CUBE_SKIP_QEMU opt-out.

Signed-off-by: Alexandre Lacoste <alex.lacoste.shmu@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: recursix

src/cube/infra_local.py

@@ -264,6 +264,23 @@ def _download(url: str, dest: Path) -> None:
     logger.info("Downloaded %s (%.1f GB)", dest.name, dest.stat().st_size / 1024**3)
 
 
+def _ensure_qemu() -> None:
+    """Best-effort install of qemu, run lazily when a VM resource is provisioned/launched.
+
+    qemu (qemu-img, qemu-system-x86_64) is needed only by VMResourceConfig, so installing
+    it here — rather than in a blanket install() that runs for every cube — keeps
+    Docker/browser cubes from paying for it (cube-standard #191). No-op when qemu is
+    already present; a failed install warns but does not raise, so a VM cube fails later
+    with a clear "qemu-system-x86_64 not found" instead of aborting setup.
+    """
+    if shutil.which("qemu-system-x86_64"):
+        return
+    ref = importlib.resources.files("cube").joinpath("scripts/install_qemu.sh")
+    with importlib.resources.as_file(ref) as script:
+        if script.exists():
+            subprocess.run(["bash", str(script)], check=False)
+
+
 def _convert_to_qcow2(src: Path, dst: Path) -> None:
     """Convert src image to qcow2 format using qemu-img."""
     if dst.exists():
@@ -490,17 +507,10 @@ class LocalInfraConfig(InfraConfig):
 
     # ── InfraConfig interface ─────────────────────────────────────────────────
 
-    def install(self) -> None:
-        """Install local system dependencies if not already present.
-
-        qemu (VM-backed cubes only) is best-effort: a failed qemu install warns but does
-        NOT abort, so offline / Docker / browser cubes stay runnable on `local` infra even
-        where qemu can't build (e.g. Homebrew on Apple Silicon). See the script's comment
-        and cube-standard #191 (scope provisioning to declared task capabilities)."""
-        ref = importlib.resources.files("cube").joinpath("scripts/install_local_infra.sh")
-        with importlib.resources.as_file(ref) as script:
-            if script.exists():
-                subprocess.run(["bash", str(script)], check=True)
+    # No install() override: system deps are installed lazily per resource type
+    # (qemu via _ensure_qemu() in the VM provision/launch path), so Docker/browser
+    # cubes never pay for qemu. Scoping provisioning to declared capabilities is
+    # cube-standard #191; this is the local-backend slice of it.
 
     def fingerprint(self) -> str:
         return "local"
@@ -542,6 +552,7 @@ def provision(self, resource: ResourceConfig) -> None:
         if not isinstance(resource, VMResourceConfig):
             raise UnsupportedResourceType(resource, self)
 
+        _ensure_qemu()  # qemu-img is needed for the qcow2 convert below
         image_dir = Path(self.image_dir)
         image_dir.mkdir(parents=True, exist_ok=True)
         dest = image_dir / f"{resource.name}.qcow2"
@@ -578,6 +589,7 @@ def launch(self, resource: ResourceConfig) -> ResourceHandle:
         if not isinstance(resource, VMResourceConfig):
             raise UnsupportedResourceType(resource, self)
 
+        _ensure_qemu()  # qemu-system-x86_64 boots the VM below
         from cube.provision_store import ProvisionStore
 
         resource_info = ProvisionStore().get(resource, self)

src/cube/scripts/install_local_infra.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Best-effort install of qemu (qemu-img + qemu-system-x86_64), needed only by
+# VM-backed cubes (osworld, windows-agent-arena). Invoked lazily by
+# LocalInfraConfig._ensure_qemu() when it provisions/launches a VMResourceConfig —
+# never for Docker/browser cubes. Safe to run multiple times.
+#
+# BEST-EFFORT: a failure (e.g. Homebrew's qemu bottle not building on Apple
+# Silicon) warns but does not abort — the VM cube then fails later with a clear
+# "qemu-system-x86_64 not found" when it actually boots a VM.
+set -euo pipefail
+
+qemu_warn() {
+  echo "WARNING: could not install qemu — VM-backed cubes (osworld, " \
+       "windows-agent-arena) won't run until you install it manually." >&2
+}
+
+case "$(uname)" in
+  Linux)
+    { sudo apt-get update -qq && sudo apt-get install -y qemu-system-x86 qemu-utils; } || qemu_warn
+    ;;
+  Darwin)
+    brew install qemu || qemu_warn
+    ;;
+  *)
+    echo "Unsupported platform: $(uname). Install qemu-system-x86_64 manually for VM cubes." >&2
+    ;;
+esac

src/cube/scripts/install_qemu.sh

@@ -24,7 +24,7 @@
     _register_active,
 )
 from cube.infra_utils import build_volume_setup_script
-from cube.resource import DockerServiceConfig, VolumeSpec
+from cube.resource import DockerServiceConfig, VMResourceConfig, VolumeSpec
 
 # ── build_volume_setup_script ─────────────────────────────────────────────────
 
@@ -510,3 +510,24 @@ def test_unreachable_daemon_raises_actionable_error(self, monkeypatch) -> None:
     def test_active_docker_context_host_swallows_missing_cli(self) -> None:
         with patch.object(_mod.subprocess, "run", side_effect=FileNotFoundError("docker")):
             assert _mod._active_docker_context_host() is None
+
+
+class TestQemuLazyInstall:
+    """qemu is installed lazily, only for VM resources — never for Docker/browser cubes."""
+
+    def test_docker_provision_does_not_install_qemu(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        calls: list[bool] = []
+        monkeypatch.setattr(_mod, "_ensure_qemu", lambda: calls.append(True))
+        monkeypatch.setattr(LocalInfraConfig, "_provision_docker_service", lambda self, r: None)
+        LocalInfraConfig().provision(DockerServiceConfig(name="svc", scope="task"))
+        assert calls == []
+
+    def test_vm_provision_installs_qemu(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+        calls: list[bool] = []
+        monkeypatch.setattr(_mod, "_ensure_qemu", lambda: calls.append(True))
+        monkeypatch.setattr(_mod, "_download", lambda url, dest: dest.write_bytes(b""))
+        monkeypatch.setattr(_mod, "_convert_to_qcow2", lambda src, dst: dst.write_bytes(b""))
+        monkeypatch.setattr(LocalInfraConfig, "register", lambda self, r, info: None)
+        cfg = LocalInfraConfig(image_dir=str(tmp_path))
+        cfg.provision(VMResourceConfig(name="vm", scope="benchmark", source_url="http://x/img.raw"))
+        assert calls == [True]