microsandbox-rb 0.9.1 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9a11efe93577fa841e3825418b7ea2bdd27cadd404d64f750ef060fa255d4bc
-  data.tar.gz: 9ccca9426b0ddefed890528408775068244959e69400497c904ffb2d408c27a5
+  metadata.gz: d4f3171c79d1e74d8a86a8ace5b5b53a61e1bbbbf32b0e20f3c0bb183b5c9014
+  data.tar.gz: 56de5a8367c3a42ea28684410aa902336d9d965f6eac0fd581de699511b9cfe2
 SHA512:
-  metadata.gz: 6cc9f1524466a9e910ee21aabcefbf62a8abfa79625d1bdd7a7a37fc634db018a8d8efa277613691d69b153fed22d1d5fcaf493ecbaac629b1b1a866e861461e
-  data.tar.gz: c36aa8379159eead35e062c4f282a34deb3957dbf93a34ed48d395ef9e52c96a7f3343a145f24f3418fe25a5a8e1dfc64d23b8514845d80090a14161739e43c3
+  metadata.gz: 6db8b2a9bc3b4a1160893351efa894d5beb59ec878c9a103fb9317a32b3c879c9b6e0bebbd75ea157e75c1702b013672c78d1a0c65d925c4e210aa4e0d018f64
+  data.tar.gz: bc09f708ec77732a5fe91c96fd46cf369fd98dd0752ad380fcba821d34bb80779151886fa7c728e74d70684af1fe4bc76c53abc2ca45c0b22e9e5e5da600001e

data/CHANGELOG.md

@@ -6,6 +6,117 @@ All notable changes to this gem are documented here. The format is based on
 microsandbox runtime it embeds; each release notes the upstream runtime tag it
 wraps, and the README's Versioning section keeps the full gem→runtime map.
 
+## [0.10.0] - 2026-07-09
+
+Ruby bindings for the additive `v0.6.6` SDK surface (upstream #1099 / #1128),
+bringing the gem to parity with the Python and Node SDKs, which already ship
+this API. The embedded runtime tag is unchanged (`v0.6.6`); this is a pure
+binding addition with no breaking change.
+
+### Added
+
+- **Live sandbox modification** — `Sandbox#modify` and `SandboxHandle#modify`
+  plan or apply a change to a running (or stopped) sandbox without recreating
+  it: resize CPU/memory (`cpus:`, `max_cpus:`, `memory:`, `max_memory:`, MiB),
+  adjust `env:`/`remove_env:`, `labels:`/`remove_labels:`, and `workdir:`, and
+  rotate/remove secrets (`secrets:` keyed by name with mutually-exclusive
+  `env:`/`store:`/`value:` plus `placeholder:`/`allowed_hosts:`,
+  `remove_secrets:`). `policy:` selects `:no_restart` (default), `:next_start`,
+  or `:restart`; `dry_run: true` computes the plan without applying it. Returns
+  a typed `ModificationPlan` (`#sandbox`, `#status`, `#applied?`, `#policy`,
+  `#changes`, `#conflicts`, `#warnings`, `#resize_status`) whose nested entries
+  are frozen, symbol-keyed Hashes carrying the runtime's canonical snake_case
+  fields verbatim.
+- **Health checks** — `Sandbox#ping` / `SandboxHandle#ping` return a
+  `PingResult` (`#name`, `#latency` in seconds, `#latency_ms`) confirming the
+  guest agent is reachable **without** refreshing the idle timer; `#touch`
+  returns a `TouchResult` (`#name`, `#activity_seq`) that explicitly refreshes
+  the idle-activity timer. On the handle, both raise `SandboxNotRunningError`
+  for a stopped sandbox (it is not started implicitly).
+- **Create-time resource ceilings** — `Sandbox.create` accepts `max_cpus:` and
+  `max_memory:` (MiB), the boot-time maxima a later live `modify` can grow up
+  to (each defaults to its `cpus:`/`memory:` value and must be >= it).
+- **`SandboxNotRunningError`** is now raised by the runtime's not-running guard
+  (the class already existed; the new core `SandboxNotRunning` variant is now
+  mapped to it instead of falling back to the base `Error`).
+
+Deliberately **not** exposed, matching the Python and Node SDKs (both surface
+these only through the CLI): `modify`'s `oci_upper_size` overlay-grow field, and
+the `SandboxMetricsReport` / per-sandbox metrics-report helpers.
+
+## [0.9.3] - 2026-07-09
+
+Adopts upstream runtime **`v0.6.3` → `v0.6.6`** (spanning upstream `v0.6.4` and
+`v0.6.6`; `v0.6.5` was yanked upstream — its GitHub release was pulled and the
+type-model refactor it shipped, #1014, was reverted in `v0.6.6`, #1143). The
+upstream SDK crate's public API grew only *additive* surface (live
+modify/resize, ping/touch — Ruby bindings for these land in the next minor),
+so this is a pure runtime bump with no Ruby API change.
+
+### Fixed
+
+- **Snapshot restore survives upstream tag republishes** (upstream #1130):
+  restore now pulls the OCI image by its pinned manifest digest
+  (`<repo>@sha256:…`) instead of re-resolving the mutable tag, fixing a fatal
+  `v0.6.3` regression where a republished base-image tag made existing
+  snapshots unrestorable.
+- **Fragmented UDP and PMTU relay traffic is forwarded correctly** (upstream
+  #1086) by the sandbox network relay.
+- **`exec` termination kills the whole process group, not just the direct
+  child** (upstream #1104): guest commands that spawn children (e.g. shell
+  pipelines) no longer leave orphaned grandchildren running after a kill.
+- **Stop waits tolerate ephemeral cleanup** (upstream #1087, inherited in
+  `Sandbox#stop`/`SandboxHandle#wait_until_stopped`): if an ephemeral
+  sandbox's persisted state is cleaned up while a stop wait is in flight, the
+  wait now resolves to a synthetic `stopped` result instead of raising
+  `SandboxNotFoundError`. Persistent sandboxes are unaffected.
+- **Filesystem snapshot `readdir` streams entries** (upstream #1133), fixing
+  unbounded memory growth (RSS leak) when listing very large directories.
+
+### Changed
+
+- **Embedded runtime is now `v0.6.6`** (`Microsandbox::RUNTIME_VERSION` /
+  `Microsandbox.runtime_version`). Also inherited:
+  - `Sandbox.create`/`.start` persist an active-config snapshot of the booted
+    sandbox in the runtime database (upstream SDK behavior; groundwork for
+    live modification).
+  - The runtime's shutdown flush timeout can be overridden via the
+    `MSB_SHUTDOWN_FLUSH_TIMEOUT_MS` environment variable (upstream #1088).
+  - The prebuilt `msb` binary gains `modify`/`ping`/`restart`/`touch`
+    subcommands and `metrics --watch`; these are CLI-level for now — the
+    corresponding Ruby APIs (`#modify`, `#ping`, `#touch`) ship in the next
+    minor release.
+
+## [0.9.2] - 2026-07-08
+
+Adopts upstream runtime **`v0.6.2` → `v0.6.3`**. No Ruby API change; the
+native glue moves to the explicit-backend variants of a few SDK calls that
+went "ambient config" upstream (#1091).
+
+### Fixed
+
+- **DNS no longer advertises unreachable address families to the guest**
+  (upstream #1083): on hosts without a working IPv6 route the sandbox is
+  IPv4-only, but the DNS forwarder previously still returned real AAAA
+  records, so v6-preferring resolvers inside the guest (gRPC/c-ares
+  foremost) tried IPv6 first and failed with unreachable-network errors.
+  AAAA queries in a v4-only sandbox (and A queries in a v6-only one) now
+  synthesize an empty NOERROR answer, steering guests to the usable family.
+  Also normalizes IPv4-mapped IPv6 addresses for policy/rebind/resolved-
+  hostname checks.
+
+### Changed
+
+- **Embedded runtime is now `v0.6.3`** (`Microsandbox::RUNTIME_VERSION` /
+  `Microsandbox.runtime_version`). Also inherited: upstream TLS interception
+  scopes upstream-certificate verification per destination (#1073).
+- Native glue adapted to the upstream v0.6.3 SDK surface (#1091 restored
+  "ambient local config" as the public shape): `Image.get/list/inspect/
+  remove/prune` and `all_sandbox_metrics` now call the explicit
+  `*_local(backend, …)` variants, and the resolved-`msb`-path probe uses the
+  `LocalConfig#resolve_msb_path` method form. Behavior is identical — the
+  gem already held an explicit local backend at every call site.
+
 ## [0.9.1] - 2026-07-03
 
 Adopts upstream runtime **`v0.6.1` → `v0.6.2`**. The upstream SDK crate's public

data/Cargo.lock

@@ -577,9 +577,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
 
 [[package]]
 name = "bzip2"
@@ -2532,7 +2532,7 @@ checksum = "ae8e22120c32fb4d19ec55fba35015f57095cd95a2e3b732e44457f5915b2ee8"
 dependencies = [
  "num-integer",
  "num-traits",
- "rand 0.10.1",
+ "rand 0.10.2",
  "rand_core 0.10.1",
 ]
 
@@ -2975,8 +2975,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -3007,7 +3007,7 @@ dependencies = [
  "microsandbox-utils",
  "nix 0.31.3",
  "notify",
- "rand 0.10.1",
+ "rand 0.10.2",
  "reqwest",
  "russh",
  "russh-sftp",
@@ -3025,12 +3025,13 @@ dependencies = [
  "typed-builder",
  "which",
  "windows-sys 0.61.2",
+ "zeroize",
 ]
 
 [[package]]
 name = "microsandbox-agent-client"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "ciborium",
  "microsandbox-protocol",
@@ -3042,8 +3043,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-db"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "async-trait",
  "sea-orm",
@@ -3054,8 +3055,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-filesystem"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "libc",
  "microsandbox-utils",
@@ -3067,8 +3068,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-image"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "astral-tokio-tar",
  "async-compression",
@@ -3093,8 +3094,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-metrics"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "chrono",
  "libc",
@@ -3105,8 +3106,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-migration"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "sea-orm-migration",
  "serde_json",
@@ -3114,8 +3115,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-network"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "base64",
  "bytes",
@@ -3131,6 +3132,7 @@ dependencies = [
  "libc",
  "lru",
  "microsandbox-protocol",
+ "microsandbox-types",
  "microsandbox-utils",
  "msb_krun",
  "msb_krun_utils",
@@ -3152,12 +3154,13 @@ dependencies = [
  "tokio-rustls",
  "tracing",
  "windows-sys 0.61.2",
+ "zeroize",
 ]
 
 [[package]]
 name = "microsandbox-protocol"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "chrono",
  "ciborium",
@@ -3171,8 +3174,8 @@ dependencies = [
 
 [[package]]
 name = "microsandbox-runtime"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "bytes",
  "chrono",
@@ -3198,24 +3201,26 @@ dependencies = [
  "tokio",
  "tracing",
  "windows-sys 0.61.2",
+ "zeroize",
 ]
 
 [[package]]
 name = "microsandbox-types"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "chrono",
  "serde",
  "serde_json",
  "sha2 0.11.0",
  "thiserror 2.0.18",
+ "zeroize",
 ]
 
 [[package]]
 name = "microsandbox-utils"
-version = "0.6.2"
-source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.2#e9043c89d3432a548908bb145581be4fa1e2e3d9"
+version = "0.6.6"
+source = "git+https://github.com/superradcompany/microsandbox?tag=v0.6.6#2367d506103f87fe733d7252c3202b278eadef88"
 dependencies = [
  "dirs",
  "libc",
@@ -3227,7 +3232,7 @@ dependencies = [
 
 [[package]]
 name = "microsandbox_rb"
-version = "0.9.1"
+version = "0.10.0"
 dependencies = [
  "chrono",
  "futures",
@@ -3321,9 +3326,9 @@ dependencies = [
 
 [[package]]
 name = "msb_krun"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0fb3437734ef4103d3891d3cbd51a8726f196af350c68cb044a1860207c64d3"
+checksum = "70bc09516a8ed366b6f20504f434d619991dc879101462d86b24ae133937bd3b"
 dependencies = [
  "crossbeam-channel",
  "kvm-bindings",
@@ -3341,9 +3346,9 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_arch"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e25fe665643d66900ec9407ef0d3afdb5cd4ca97ad394c46b8243bfa6344bfc0"
+checksum = "0d63ddae3ce5ba871a2b90bad6d789bf43583b8e587620580376222aed65e96a"
 dependencies = [
  "kvm-bindings",
  "kvm-ioctls",
@@ -3356,15 +3361,15 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_arch_gen"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e50dfac228ad088917f8ffb2920c4a56d762ebc5a90950ee7bf5414253b02aa"
+checksum = "b14a030e7cd5740010a9d6eedd1002d2d42cc1481670cfa22a4dc5a89143048f"
 
 [[package]]
 name = "msb_krun_cpuid"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd5221749c0224858b075b61f3f2a0964dbfe367093e9ee650b6b0e3d690c3b2"
+checksum = "f33e9fbcbf5e27657d62177689a499a0dd64d4321afde53463f17b66c1acc2d7"
 dependencies = [
  "kvm-bindings",
  "kvm-ioctls",
@@ -3373,9 +3378,9 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_devices"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee50bfdf1a1258e33bcf0ee8631bb805db79b8d442161ab63d700689a992a8"
+checksum = "ca9d5c0ea156c5253c18c880aa29f038e639e9f5526d93ebb848e60d46b2bdca"
 dependencies = [
  "bitflags 1.3.2",
  "capng",
@@ -3403,9 +3408,9 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_hvf"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f2300bbe4dbd56bdc3ffc2384baf82e299fff8a45e844f41c4a0be64210ed47"
+checksum = "500d2d1d56525119b374ca622c351115eade0a75fb4ff8a16d1cc7117b29d169"
 dependencies = [
  "crossbeam-channel",
  "libloading",
@@ -3415,9 +3420,9 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_kernel"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3402b8879bd5b91f33d069fefa00fd0416f12cd660cfd7538da8e77201f2dda5"
+checksum = "836b43c16a0932baebf32b657f34153fd90f2e839a33e0002d54c6f91b4019b7"
 dependencies = [
  "msb_krun_utils",
  "vm-memory",
@@ -3425,9 +3430,9 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_polly"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da550bf268cb9217255ed152bfca9f61275a2796237fd180989958c7f54dc137"
+checksum = "6457213dc30bdb1a8bcb3ceba3a548f442fc913874f11b970745f779a6bf4842"
 dependencies = [
  "libc",
  "msb_krun_utils",
@@ -3435,18 +3440,18 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_smbios"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c0737818e69346348f8ba2a7197cbec2336e807e5f7f094c80e0ca1635ca054"
+checksum = "91f33a174635431e57a0d59a4aed487599c2ff2ac9ca1ea2346626112a2499af"
 dependencies = [
  "vm-memory",
 ]
 
 [[package]]
 name = "msb_krun_utils"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb370035195bfd6d60e0b4ad8b0d68dcf9d138f144d033087a960117920a126e"
+checksum = "54d6f5ee4b160d020de8c91d9237a9592472ee6353b1b72cd08d51b2149c9433"
 dependencies = [
  "bitflags 1.3.2",
  "crossbeam-channel",
@@ -3460,9 +3465,9 @@ dependencies = [
 
 [[package]]
 name = "msb_krun_vmm"
-version = "0.1.19"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68e9f485f720981fda9071b2711d4f8406b6c67ebf6bfa2bb8e83f3cc6c2aaea"
+checksum = "816b34f9bf7eef3f101e84452e663cf9ac6e173377d5ff277192fb8c82cf3199"
 dependencies = [
  "bzip2",
  "crossbeam-channel",
@@ -3881,7 +3886,7 @@ dependencies = [
  "delegate",
  "futures",
  "log",
- "rand 0.10.1",
+ "rand 0.10.2",
  "sha2 0.11.0",
  "thiserror 2.0.18",
  "tokio",
@@ -4279,9 +4284,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
  "proc-macro2",
 ]
@@ -4331,9 +4336,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
  "chacha20",
  "getrandom 0.4.2",
@@ -4459,9 +4464,9 @@ dependencies = [
 
 [[package]]
 name = "reflink-copy"
-version = "0.1.29"
+version = "0.1.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13362233b147e57674c37b802d216b7c5e3dcccbed8967c84f0d8d223868ae27"
+checksum = "d9dd7ab4af0363d5ccfd2838d782a28196cf32a5cc2e4fe3c5dc83f2be588b8b"
 dependencies = [
  "cfg-if",
  "libc",
@@ -4660,7 +4665,7 @@ dependencies = [
  "pkcs5",
  "pkcs8 0.11.0",
  "polyval",
- "rand 0.10.1",
+ "rand 0.10.2",
  "rand_core 0.10.1",
  "rsa 0.10.0-rc.18",
  "russh-cryptovec",
@@ -4766,9 +4771,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.40"
+version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -5924,9 +5929,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.49"
+version = "0.3.51"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711a53c2d47bbd818258c498c8dbfe186a2526c631495cfe7e078567f86b8469"
+checksum = "85c17d80feb7334b40c484e45ed1a5273dfd8bfda537c3be2e74a06a6686f327"
 dependencies = [
  "deranged",
  "num-conv",
@@ -5944,9 +5949,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.29"
+version = "0.2.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71c652a3727a9cbb9a02f707f530b618ce00d0ccd762009c8c23bd191df3c17d"
+checksum = "dcef1a61bdb119096e153208ec5cbec23944ce8bca13be5c7f60c634f7403935"
 dependencies = [
  "num-conv",
  "time-core",
@@ -7372,6 +7377,7 @@ version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
+ "serde",
  "zeroize_derive",
 ]
 

data/README.md

@@ -229,6 +229,55 @@ Microsandbox::Sandbox.create("obs", image: "public.ecr.aws/docker/library/alpine
 end
 ```
 
+### Live modification & health
+
+Resize, reconfigure, or rotate secrets on a sandbox **without recreating it**,
+and probe the guest agent's liveness. To leave headroom for a live CPU/memory
+resize, reserve a ceiling at create time with `max_cpus:`/`max_memory:`:
+
+```ruby
+Microsandbox::Sandbox.create("live", image: "public.ecr.aws/docker/library/alpine:latest",
+  cpus: 1, max_cpus: 4, memory: 512, max_memory: 2048) do |sb|
+  # Health check — does NOT refresh the idle timer:
+  ping = sb.ping                       # => Microsandbox::PingResult
+  ping.latency_ms                      # round-trip latency
+
+  # Explicitly refresh the idle-activity timer (resets any idle_timeout:):
+  sb.touch.activity_seq                # => Microsandbox::TouchResult
+
+  # Preview a change without applying it:
+  plan = sb.modify(cpus: 2, memory: 1024, dry_run: true)
+  plan.applied?                        # => false
+  plan.changes                         # => [{ kind: "config", field: "cpus", ... }, ...]
+
+  # Live resize — applies to the running VM under the default :no_restart policy:
+  sb.modify(cpus: 2, memory: 1024)
+
+  # env/labels/workdir changes on a *running* sandbox require a restart, so the
+  # default :no_restart policy rejects the whole apply (it raises rather than
+  # partially applying). Persist them for the next start — or restart now —
+  # by saying so explicitly:
+  sb.modify(env: { "TIER" => "prod" }, remove_env: ["DEBUG"],
+    labels: { "role" => "worker" }, policy: :next_start)  # or policy: :restart
+
+  # Rotating/removing an *existing* secret (or updating its allowed hosts) is
+  # live; *adding* a new secret is restart-required, like env. Specs are keyed
+  # by name; env:/store:/value: are mutually exclusive:
+  sb.modify(
+    secrets: { "API_KEY" => { env: "HOST_API_KEY", allowed_hosts: ["api.example.com"] } },
+    remove_secrets: ["OLD_TOKEN"],
+  )
+end
+```
+
+The apply is **all-or-nothing**: under a given `policy:` every planned change
+must be applicable, or the whole `modify` raises — nothing is partially
+applied. Use `dry_run: true` to inspect each change's `disposition` (`"live"`,
+`"next start"`, `"requires restart"`) before committing.
+
+`SandboxHandle` (from `Sandbox.get`/`list`) carries the same `#ping`/`#touch`/
+`#modify`; on a stopped sandbox `#ping`/`#touch` raise `SandboxNotRunningError`.
+
 ### Streaming output
 
 For long-running commands, stream events as they arrive instead of waiting:
@@ -393,8 +442,8 @@ change diverged the two numbers — the gem version is **not** a reliable indica
 of the embedded runtime version. To learn which runtime a build wraps, ask it:
 
 ```ruby
-Microsandbox::VERSION          # => "0.9.0"  (the gem's own version)
-Microsandbox.runtime_version   # => "v0.6.2"  (the embedded upstream runtime tag)
+Microsandbox::VERSION          # => "0.10.0"  (the gem's own version)
+Microsandbox.runtime_version   # => "v0.6.6"  (the embedded upstream runtime tag)
 ```
 
 | Gem version | Upstream runtime | Notes |
@@ -412,6 +461,9 @@ Microsandbox.runtime_version   # => "v0.6.2"  (the embedded upstream runtime tag
 | `0.8.2`  | `v0.5.10` | gem-only: redact secrets from errors, typed snapshot errors, panic-free durations, fat-gem loader + `extconf` preflight fixes, threading/streaming docs |
 | `0.9.0`  | `v0.6.1` | adopts upstream `v0.6.0`+`v0.6.1` (zombie-runtime wait fix, secret substitution through CONNECT proxies, stale-sandbox cleanup); upstream public API is additive — no Ruby surface change |
 | `0.9.1`  | `v0.6.2` | adopts upstream `v0.6.2` (faster image loads/pulls via early cache gate + zlib-rs); upstream API unchanged — no Ruby surface change |
+| `0.9.2`  | `v0.6.3` | adopts upstream `v0.6.3` (v4-only sandboxes stop advertising AAAA DNS answers — fixes guest gRPC/c-ares preferring unreachable IPv6; scoped upstream TLS verification); glue moves to `*_local` SDK variants — no Ruby surface change |
+| `0.9.3`  | `v0.6.6` | adopts upstream `v0.6.4`+`v0.6.6` (`v0.6.5` was yanked upstream): snapshot restore by pinned digest — fixes fatal restore-after-tag-republish bug, fragmented-UDP/PMTU relay fixes, exec kills the whole process group, ephemeral stop-wait tolerance, readdir RSS-leak fix; upstream API growth is additive-only — no Ruby surface change |
+| `0.10.0` | `v0.6.6` | `v0.6.6` API parity: live `modify`/resize, `ping`/`touch`, create `max_cpus`/`max_memory` |
 
 **Going forward** — the gem version moves on its own semver track and no longer
 mirrors the upstream tag:

data/ext/microsandbox/Cargo.toml

@@ -6,8 +6,8 @@ name = "microsandbox_rb"
 description = "Ruby SDK native extension for microsandbox — secure, fast microVM-based sandboxing."
 # Must equal Microsandbox::VERSION (lib/microsandbox/version.rb) — Native.version
 # returns this via env!("CARGO_PKG_VERSION") and version_spec.rb asserts equality.
-# The core-crate dependency below stays pinned at its own tag (v0.6.2).
-version = "0.9.1"
+# The core-crate dependency below stays pinned at its own tag (v0.6.6).
+version = "0.10.0"
 authors = ["Super Rad Company <development@superrad.company>"]
 repository = "https://github.com/superradcompany/microsandbox"
 license = "Apache-2.0"
@@ -35,8 +35,8 @@ rb-sys = "0.9"
 # `.cargo/config.toml.example`). "ssh" matches the feature set the Python/Node
 # SDKs ship with; default features add "prebuilt" (provisions msb + libkrunfw at
 # build time), "net", and "keyring".
-microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.2", default-features = true, features = ["ssh"] }
-microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.2" }
+microsandbox = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.6", default-features = true, features = ["ssh"] }
+microsandbox-network = { git = "https://github.com/superradcompany/microsandbox", tag = "v0.6.6" }
 
 # Async core bridged to Ruby's synchronous API via a blocking tokio runtime.
 tokio = { version = "1", features = ["rt-multi-thread", "sync", "time"] }

data/ext/microsandbox/src/error.rs

@@ -17,6 +17,12 @@ fn class_name(err: &MicrosandboxError) -> &'static str {
         SandboxNotFound(_) => "SandboxNotFoundError",
         SandboxAlreadyExists(_) => "SandboxAlreadyExistsError",
         SandboxStillRunning(_) => "SandboxStillRunningError",
+        // v0.6.6 (#1099): the sandbox exists but isn't running. Raised by the
+        // handle's exec/attach/ping/touch not-running guards and the fs
+        // agent-endpoint lookup. The `SandboxNotRunningError` class already
+        // existed (mirroring the Python SDK); this wires the new core variant to
+        // it instead of letting it collapse to the base `Error`.
+        SandboxNotRunning(_) => "SandboxNotRunningError",
         ExecTimeout(_) => "ExecTimeoutError",
         ExecFailed(_) => "ExecFailedError",
         SandboxFsOps(_) => "FilesystemError",