Auto-standby

[sjmiller609]

Summary

• add Linux-only auto-standby built around host conntrack state in a new lib/autostandby package
• persist and expose per-instance auto_standby policy through instance metadata and API surfaces
• start the auto-standby controller from the API process and add a default-skipped VM-level E2E test for host->guest inbound TCP activity

Testing

• go test -count=1 ./lib/autostandby
• go test -count=1 -run "Test(ValidateUpdateInstanceRequest|CloneStoredMetadataForFork_DeepCopiesReferenceFields)$" ./lib/instances
• go test -count=1 -run "Test(CreateInstance_MapsAutoStandbyPolicy|UpdateInstance_MapsAutoStandbyPatch)$" ./cmd/api/api
• go test -run "^$" ./cmd/api
• sudo -n env PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$PATH HYPEMAN_RUN_AUTO_STANDBY_E2E=1 go test -count=1 -run ^TestAutoStandbyCloudHypervisorActiveInboundTCP$ ./lib/instances on deft-kernel-dev

Integration test coverage

The default-skipped Linux integration test exercised a real Cloud Hypervisor VM with networking enabled and a real conntrack-backed auto-standby controller.

It verified that:

• a host-to-guest TCP connection to nginx appears as qualifying inbound activity in conntrack
• the instance stays Running while that inbound TCP connection remains open
• once the final inbound TCP connection closes, the controller allows the configured idle timeout to elapse and then transitions the instance to Standby
• the test uses the real Linux conntrack path instead of ingress state or TAP byte counters

---

Note

Medium Risk
Adds a new background controller that can automatically transition running VMs into Standby based on host conntrack activity and expands the instance create/update surfaces; this can affect VM availability if policy parsing/eligibility logic is wrong or conntrack access behaves unexpectedly on Linux hosts.

Overview
Introduces Linux-only auto-standby: a new lib/autostandby package classifies host conntrack TCP flows, enforces per-instance idle timers, and triggers StandbyInstance when inbound activity stays at zero past a configured timeout.

Extends instance metadata and API/OAPI schema to persist and expose an auto_standby policy on create/update/get, including validation/normalization and deep-copy handling in instance create/fork/update paths.

Enables the controller from the API process on Linux (startAutoStandbyController), and adds unit tests plus a default-skipped Linux E2E integration test exercising real conntrack-backed standby behavior.

^{Reviewed by Cursor Bugbot for commit 14cff19. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

✱ Stainless preview builds

This PR will update the hypeman SDKs with the following commit message.

feat: Add Linux auto-standby controller and E2E coverage

Edit this comment to update it. It will appear in the SDK's changelogs.

✅ hypeman-typescript studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ✅ → test ✅

npm install https://pkg.stainless.com/s/hypeman-typescript/b2853daf7e9b0c3b998e8dd1c1974a6666181a95/dist.tar.gz

✅ hypeman-openapi studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅

✅ hypeman-go studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ✅ → test ✅

go get github.com/stainless-sdks/hypeman-go@53adfef8c451b263679fe165618d91a44f065100

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-04-05 15:48:25 UTC

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 14cff19. Configure here.}