sweep: parallel batch of bug/hardening/optimization fixes (#272 #177 #192 #276 #277 #274 #246 #262 #273 #275 #267)

[Xiddoc]

A batch of independent, file-disjoint fixes implemented in parallel and integrated together. Each was gated to 100% line+branch coverage in isolation; the combined tree is green (ruff, mypy --strict src+tests, pytest 2052 passed at 100% coverage).

Closes #272
Closes #177
Closes #192
Closes #276
Closes #277
Closes #274
Closes #246
Closes #262
Closes #273
Closes #275
Closes #267

cli / hostcheck

• cli: create/register/up/snapshot banners crash with KeyError on Frida-less instances (unguarded p['frida']) #272 — create/register/up/restore banners guard every ports.well_known(...)['frida'] access, so a Frida-less instance (an adb-only ports: list, no frida: block) no longer crashes with KeyError: 'frida'.
• beetroot up success banner advertises Frida localhost:<port> for vm instances that every other surface reports as unsupported #177 — the up success banner prints only the ADB endpoint + a "Frida unsupported on binder: vm" note for the vm backend (matching status/ls/frida-addr); redroid still shows both.
• Strict binder: host block on a binderless host omits the binder: vm hint, steering users away from the only locally-working backend #192 — the strict binder: host block remedy now carries the binder: vm hint (built once, shared with the warn branch), so a binderless host is pointed at the locally-working vm path.
• Codebase audit — low-severity findings (bugs, optimizations, docs/test gaps) #267 (cli) — ls shows the instance directory for directory-backed binder: vm rows instead of - (table PATH + JSON path key), via a VmDeviceBackend-aware TypeGuard.

compose

• compose.ps_status: a non-dict JSON line from docker compose ps raises an uncaught AttributeError #277 — ps_status skips a non-dict JSON line instead of raising an uncaught AttributeError through ls/status/doctor.
• compose: lifecycle ComposeError messages omit captured stderr, hiding the real failure reason #276 — lifecycle ComposeError messages (up/down/build, non-follow logs) fold a trimmed stderr tail in; logs -f still streams live.

downloads / builder

• rootfs_download: no decompression-bomb cap and no truncation/Content-Length check (mirror #228/#265 for the rootfs path) #274 — rootfs_download caps zstd output at 64 GiB and validates the download against Content-Length (mirrors the frida frida_download.download() decompresses the entire .xz with no max-output cap (unbounded-decompression / OOM hardening gap) #228 / snapshot snapshot.restore decompresses the entire archive twice (manifest-validation pass + extraction pass) #265 guards).
• kernel_download.fetch_prebuilt buffers the full bzImage in RAM instead of streaming to the temp file #246 — the prebuilt bzImage download streams to disk (hashing incrementally) instead of buffering the whole file in RAM.
• Docker static bundle is downloaded and extracted into the trusted guest rootfs with no digest verification #262 — the default Docker static bundle is digest-pinned (_DEFAULT_DOCKER_BUNDLE_SHA256 = verified sha256 of docker-27.5.1.tgz), so the local bake verifies it before extraction (override stays unverified-with-warning).
• Codebase audit — low-severity findings (bugs, optimizations, docs/test gaps) #267 (builder) — the kernel source tarball is hashed in 64 KiB chunks; a malformed IMAGE_SIZE_MB becomes a preflight problem instead of aborting --check.

vm boot-cache

• binder: vm — boot-cache identity omits the accelerator (KVM vs TCG), so a savevm snapshot can be resumed under the wrong accel #273 — the warm-boot checkpoint identity folds in the resolved accelerator (KVM -cpu host vs TCG -cpu max), so an accel flip invalidates the checkpoint instead of attempting an incompatible -loadvm.
• Codebase audit — low-severity findings (bugs, optimizations, docs/test gaps) #267 (vm) — a warm-resume failure copies the console log to a .warm-fail sidecar before the cold-boot retry truncates it.

adb

• adb backend: add_module raises FileNotFoundError instead of AdbNotInstalledError when adb is absent #275 — AdbDevice.add_module raises the typed AdbNotInstalledError when adb is absent, not a raw FileNotFoundError.

registry / config / snapshot

• Codebase audit — low-severity findings (bugs, optimizations, docs/test gaps) #267 (registry) — add_allocating bounds the port index by the cap at registration, so an over-cap instance fails cleanly instead of crashing later port resolution.
• Codebase audit — low-severity findings (bugs, optimizations, docs/test gaps) #267 (config) — mem_reservation/memswap_limit are validated against mem at load time (honoring the -1 unlimited sentinel).
• Codebase audit — low-severity findings (bugs, optimizations, docs/test gaps) #267 (snapshot) — restore caps zstd decompression output.

docs (#267)

• Corrected the compose.yaml denylist-default comment, the redroid-script clone path (~/.cache/beetroot/redroid-script, not /tmp/redroid), and the AGENTS.md verb list (frida-addr/install-frida/modes).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WmChW67jv2BaPk1a8HreHU

---

Generated by Claude Code