@alienplatform/core 3.3.16 → 3.3.18

package/dist/index.js

@@ -5260,10 +5260,6 @@ const GcpRemoteStackManagementImportDataSchema = z$2.object({
 	"serviceAccountEmail": z$2.string().describe("Service account email the manager impersonates."),
 	"serviceAccountUniqueId": z$2.string().describe("Stable unique id Google assigns to the service account.")
 }).describe("GCP RemoteStackManagement ImportData — cross-project service account\nthe manager impersonates.");
-z$2.object({
-	"allowEgress": z$2.boolean().describe("Whether sessions may reach the network. Taken from the declaration rather than left to the\napplication: the launcher decides egress per sandbox at create time."),
-	"launcherPath": z$2.string().describe("Path to the sandbox CLI Cloud Run injects when the container sets `sandboxLauncher`.")
-}).describe("GCP Sandbox ImportData.\n\nA Cloud Run sandbox has no durable parent: it is a nested gVisor sandbox started by a launcher\nbinary Cloud Run injects into the container, so there is no group, image or endpoint for setup\nto hand over. What the runtime needs is the launcher's path, and it is carried here rather than\nhardcoded in the provider so a change to where Cloud Run mounts it is a data change.");
 //#endregion
 //#region src/generated/zod/gcp-secret-manager-vault-heartbeat-data-schema.ts
 /**
@@ -6857,12 +6853,13 @@ z$2.object({
 	"domainEgressRules": z$2.boolean().describe("Egress can be restricted to a hostname allowlist"),
 	"egressDeny": z$2.boolean().describe("Whether a declared `deny` is actually enforced, rather than accepted and dropped"),
 	"enforcedLimits": z$2.boolean().describe("The platform enforces the declared cpu, memory and disk ceilings"),
-	"files": z$2.boolean().describe("Files can be moved in and out of a session\n\nEvery backend but Azure, whose data plane exposes exec and lifecycle and no transfer."),
+	"files": z$2.boolean().describe("Files can be moved in and out of a session"),
 	"preview": z$2.boolean().describe("An authenticated, port-scoped capability to reach a service inside the sandbox"),
 	"processLimit": z$2.boolean().describe("The platform can cap how many processes a session runs"),
 	"reconnect": z$2.boolean().describe("A later call can reach a session created by an earlier one"),
 	"sessionLifetime": z$2.boolean().describe("The platform terminates a session at a declared wall-clock deadline"),
 	"snapshot": z$2.boolean().describe("A session's full state can be captured and used to create another"),
+	"supervisorIsolation": z$2.boolean().describe("The process supervising a command is a different identity from the command.\n\nFalse where a command runs as the agent's own user: it can then read the supervisor's\nenvironment and signal it. Separate from `supervisorPidNamespace`, which is about\nvisibility rather than identity — a backend can have one without the other."),
 	"supervisorPidNamespace": z$2.boolean().describe("A command runs in its own PID namespace and cannot see or signal the agent's processes.\n\nOnly where an agent runs as root. Creating the namespace needs `CAP_SYS_ADMIN`, and the\nKubernetes sandbox pod drops every capability — which is also what denies `ptrace` by\nconstruction, so granting it there would remove a lock to add one."),
 	"suspendResume": z$2.boolean().describe("Session state can be suspended and resumed")
 }).describe("What a platform's sandbox backend can actually do.\n\nPublished so portable code can branch before calling rather than discovering a gap through\nan error. Every field here corresponds to a capability that at least one platform lacks;\ncreate, exec and terminate are the guaranteed floor and are therefore not listed.");
@@ -6877,7 +6874,8 @@ z$2.enum([
 	"enforcedLimits",
 	"processLimit",
 	"sessionLifetime",
-	"supervisorPidNamespace"
+	"supervisorPidNamespace",
+	"supervisorIsolation"
 ]).describe("Names a single sandbox capability, so an unsupported call can report which one it needed.");
 //#endregion
 //#region src/generated/zod/sandbox-code-schema.ts
@@ -6889,7 +6887,7 @@ z$2.enum([
 * @description Specifies where the sandbox\'s root filesystem comes from.
 */
 const SandboxCodeSchema = z$2.union([z$2.object({
-	"image": z$2.string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`)"),
+	"image": z$2.string().describe("Image reference (e.g. `ubuntu:24.04`, `ghcr.io/myorg/sandbox:latest`).\n\nTwo backends narrow it in opposite directions: AWS wants an `s3://` bundle, Azure a\nbare catalog name such as `ubuntu`. Each refuses the other's shape while planning."),
 	"type": z$2.enum(["image"])
 }), z$2.object({
 	"src": z$2.string().describe("The source directory to build from"),
@@ -7531,7 +7529,6 @@ const WorkerSchema = z$2.object({
 	get "readinessProbe"() {
 		return z$2.union([ReadinessProbeSchema, z$2.null()]).optional();
 	},
-	"sandboxLauncher": z$2.optional(z$2.boolean().describe("Whether this worker hosts sandbox sessions.\n\nSet by preflight, not by an application: on GCP a sandbox is a subprocess of the Cloud Run\ninstance running the app, and the instance can only launch one if its container declares\nit. Declaring it by hand would be a permission the workload does not need.")),
 	"timeoutSeconds": z$2.optional(z$2.int().min(1).max(3600).default(180).describe("Maximum execution time for the worker in seconds.\nConstraints: 1‑3600 seconds (platform-specific limits may apply)\nDefault: 180")),
 	get "triggers"() {
 		return z$2.array(WorkerTriggerSchema.describe("Defines what triggers a worker execution.")).describe("List of triggers that define what events automatically invoke this worker.\nIf empty, the worker is only invokable directly via HTTP calls or platform-specific invocation APIs.\nWhen configured, the worker will be automatically invoked when any of the specified trigger conditions are met.");
@@ -9572,8 +9569,11 @@ var Queue = class extends ResourceBuilder {
 *
 * Capabilities are not uniform. Call `capabilities()` on the binding and branch, or handle the
 * typed error — an unsupported capability never silently succeeds. Notably GCP cannot
-* reconnect to a session (its session id is scoped to one Cloud Run instance), Azure has no
-* file transfer, and no platform supports a hostname egress allowlist.
+* reconnect to a session (its session id is scoped to one Cloud Run instance), only Azure
+* restricts egress to a hostname allowlist, no platform can snapshot a session, and only AWS
+* and Local run a command under a different identity than the process supervising it. Elsewhere the
+* command shares the supervisor's user, so it can read the supervisor's environment and
+* signal it, and the container is the isolation boundary.
 *
 * Limits are enforced ceilings, not scheduling hints, and are validated when the stack is
 * planned. A platform that cannot enforce them rejects the sandbox rather than ignoring them.