[Copilot]

The Cloud Hypervisor --version preflight probe could fail with "... --version" exited with code undefined, giving no indication of the real cause (OOM kill, missing exec bit, unsupported CPU/KVM features).

Root cause

runVersion() in src/cloud-hypervisor/preflight.ts already captured signalCode/spawn errno for undefined exit codes, but the resulting error message still didn't point at a likely cause — just the raw signal/errno.

Changes

• New describeVersionProbeFailure() helper: on the existing failure paths only (execa throwing, ambiguous undefined exit code, signal-killed exit), checks:

  • whether the staged binary still has its executable bit set
  • whether /dev/kvm is read/write accessible (missing KVM support or unsupported CPU virtualization features)

  and appends a Possible causes: ... hint to the thrown error.

• No change to trust/ordering guarantees: the helper runs strictly after a failure is already detected, so it cannot mask, skip, or reorder any of the existing fail-closed artifact/digest/host checks.

Example resulting error for a signal-killed probe:

"/run/awf-cloud-hypervisor/trusted-artifacts/run-xyz/cloud-hypervisor --version" terminated by signal SIGKILL (exitCode=null, signalCode=SIGKILL) Possible causes: /dev/kvm is not accessible (EACCES), which can indicate missing KVM support or unsupported CPU virtualization features.

• Fixes [awf] cloud-hypervisor: version probe fails with undefined exit code in PureLock #8728