@indigoai-us/hq-cli 5.57.0 → 5.58.0

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="18312d3d-7daf-5faf-ac29-c82ce7bd0b29")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="12b04dfd-a264-56c7-bfbb-a448c35689b3")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -217,14 +217,8 @@ export function scrubSandboxOutput(text, secretNames = []) {
         .replace(/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, "[REDACTED]");
 }
 function renderSandboxJobResult(job, secretNames) {
-    if (job.stdout) {
-        process.stdout.write(scrubSandboxOutput(job.stdout, secretNames));
-    }
-    if (job.stderr) {
-        process.stderr.write(scrubSandboxOutput(job.stderr, secretNames));
-    }
-    if (job.logsTail) {
-        process.stderr.write(scrubSandboxOutput(job.logsTail, secretNames));
+    if (job.output) {
+        process.stdout.write(scrubSandboxOutput(job.output, secretNames));
     }
 }
 function normalizePolicyRecord(secretPath, data) {
@@ -872,47 +866,46 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("sandbox")
-        .description("Run a skill in the hosted sandbox with secrets injected server-side")
+        .description("Run a command in the hosted sandbox with named secrets injected as env vars; open egress, secrets never touch this machine")
         .option("--company <slug>", "Company slug (resolves to companyUid)")
         .option("--personal", "Operate on the caller's personal vault (no sharing)")
-        .option("--only <keys>", "Comma-separated list of secret names the skill may use")
-        .option("--script <path>", "Attach local script identity for script-locked secrets")
+        .option("--only <keys>", "Comma-separated list of secret names to inject (required)")
         .allowUnknownOption(true)
         .action(async (opts, cmd) => {
         try {
-            const dashIndex = process.argv.indexOf("--");
-            const rawArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : cmd.args;
-            if (rawArgs.length === 0) {
-                console.error(chalk.red("Error: no skill specified. Usage: hq secrets sandbox [--company X] [--only KEY1,KEY2] -- <skill> [args...]"));
+            if (!opts.only || opts.only.trim().length === 0) {
+                console.error(chalk.red("Error: --only is required and must name at least one secret."));
+                process.exit(1);
+            }
+            const rawArgs = cmd.args;
+            const command = rawArgs.join(" ").trim();
+            if (command.length === 0) {
+                console.error(chalk.red("Error: no command specified. Usage: hq secrets sandbox --company <slug> --only KEY1,KEY2 -- <command>"));
                 process.exit(1);
             }
-            const [skillId, ...skillArgs] = rawArgs;
-            const keys = opts.only ? parseSecretNameList(opts.only) : [];
+            if (command.length > 8192) {
+                console.error(chalk.red("Error: sandbox command exceeds the 8192 character limit."));
+                process.exit(1);
+            }
+            const keys = parseSecretNameList(opts.only);
             const token = await ensureCognitoToken();
             const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
             const companyUid = await getEntityUid(token, scope);
-            const usage = await buildSecretUsage("sandbox", opts.script);
             const client = new SandboxRunnerClient();
             const started = await client.startJob(token, {
-                skillId,
                 companyUid,
-                args: skillArgs.length > 0 ? { argv: skillArgs } : undefined,
-                companySlug: scope.companySlug,
-                only: keys.length > 0 ? keys : undefined,
-                usage,
+                secretNames: keys,
+                command,
             });
             const job = started.status === "succeeded" || started.status === "failed"
                 ? await client.getJob(token, started.jobId)
                 : await client.pollJob(token, started.jobId);
             renderSandboxJobResult(job, keys);
-            if (job.status === "failed") {
-                if (job.error) {
-                    console.error(chalk.red("Sandbox job failed:"), scrubSandboxOutput(job.error, keys));
-                }
-                process.exit(job.exitCode && job.exitCode > 0 ? job.exitCode : 1);
-            }
-            if (job.exitCode && job.exitCode !== 0) {
-                process.exit(job.exitCode);
+            const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
+            if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {
+                const code = exitCode && exitCode !== 0 ? exitCode : 1;
+                console.error(chalk.red(`Sandbox command failed with exit code ${code}.`));
+                process.exit(code);
             }
         }
         catch (err) {
@@ -1261,4 +1254,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=18312d3d-7daf-5faf-ac29-c82ce7bd0b29
+//# debugId=12b04dfd-a264-56c7-bfbb-a448c35689b3

package/dist/utils/sandbox-runner-client.d.ts

@@ -1,11 +1,8 @@
 export type SandboxRunnerState = "queued" | "running" | "succeeded" | "failed";
 export interface SandboxRunnerStartRequest {
-    skillId: string;
     companyUid: string;
-    args?: Record<string, unknown>;
-    companySlug?: string;
-    only?: string[];
-    usage?: unknown;
+    secretNames: string[];
+    command: string;
 }
 export interface SandboxRunnerStartResponse {
     jobId: string;
@@ -14,11 +11,9 @@ export interface SandboxRunnerStartResponse {
 export interface SandboxRunnerJob {
     jobId: string;
     status: SandboxRunnerState;
-    stdout?: string;
-    stderr?: string;
-    logsTail?: string;
+    output?: string;
     exitCode?: number;
-    error?: string;
+    success?: boolean;
 }
 export interface SandboxRunnerClientOptions {
     baseUrl?: string;

package/dist/utils/sandbox-runner-client.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8203259b-d3ae-5c9b-845e-f4c1470c30f3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3cbec729-3b2b-5d53-9e90-5680dd725b7d")}catch(e){}}();
 const DEFAULT_SANDBOX_RUNNER_URL = "https://hqapi.getindigo.ai/sandbox";
 function normalizeBaseUrl(baseUrl) {
     return baseUrl.replace(/\/+$/, "");
@@ -25,21 +25,14 @@ function normalizeJob(body, jobIdFallback) {
     if (!isSandboxRunnerState(status)) {
         throw new Error("Sandbox Runner returned an invalid job status.");
     }
-    const output = typeof body.stdout === "string"
-        ? body.stdout
-        : typeof body.output === "string"
-            ? body.output
-            : undefined;
     return {
         jobId: typeof body.jobId === "string" && body.jobId.length > 0
             ? body.jobId
             : jobIdFallback ?? requireString(body, "jobId"),
         status,
-        stdout: output,
-        stderr: typeof body.stderr === "string" ? body.stderr : undefined,
-        logsTail: typeof body.logsTail === "string" ? body.logsTail : undefined,
+        output: typeof body.output === "string" ? body.output : undefined,
         exitCode: typeof body.exitCode === "number" ? body.exitCode : undefined,
-        error: typeof body.error === "string" ? body.error : undefined,
+        success: typeof body.success === "boolean" ? body.success : undefined,
     };
 }
 function delay(ms) {
@@ -110,4 +103,4 @@ export class SandboxRunnerClient {
     }
 }
 //# sourceMappingURL=sandbox-runner-client.js.map
-//# debugId=8203259b-d3ae-5c9b-845e-f4c1470c30f3
+//# debugId=3cbec729-3b2b-5d53-9e90-5680dd725b7d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.57.0",
+  "version": "5.58.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/secrets.test.ts

@@ -104,6 +104,7 @@ function jsonRes(body: unknown, status = 200): Response {
 describe("secrets sandbox", () => {
   let stdoutSpy: MockInstance<typeof process.stdout.write>;
   let stderrSpy: MockInstance<typeof process.stderr.write>;
+  let exitSpy: MockInstance<typeof process.exit>;
   let startJobSpy: MockInstance<SandboxRunnerClient["startJob"]>;
   let pollJobSpy: MockInstance<SandboxRunnerClient["pollJob"]>;
   let getJobSpy: MockInstance<SandboxRunnerClient["getJob"]>;
@@ -119,9 +120,14 @@ describe("secrets sandbox", () => {
       .mockResolvedValue({
         jobId: "job_123",
         status: "succeeded",
-        stdout: "done\n",
+        output: "done\n",
+        exitCode: 0,
+        success: true,
       });
     getJobSpy = vi.spyOn(SandboxRunnerClient.prototype, "getJob");
+    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
   });
 
   it("registers the sandbox channel value", () => {
@@ -129,7 +135,7 @@ describe("secrets sandbox", () => {
     expect(channel).toBe("sandbox");
   });
 
-  it("parses --company, --only, and the -- <skill> separator", async () => {
+  it("parses --company, --only, and joins args after -- into a command", async () => {
     const program = buildProgram();
     await program.parseAsync([
       "node",
@@ -141,22 +147,59 @@ describe("secrets sandbox", () => {
       "--only",
       "API_KEY,OTHER_KEY",
       "--",
-      "pull-triple-whale",
+      "node",
+      "-e",
+      "console.log('hi')",
       "--days",
       "7",
     ]);
 
     expect(startJobSpy).toHaveBeenCalledWith("test-token", {
-      skillId: "pull-triple-whale",
       companyUid: "prs_alice",
-      args: { argv: ["--days", "7"] },
-      companySlug: "acme",
-      only: ["API_KEY", "OTHER_KEY"],
-      usage: { channel: "sandbox" },
+      secretNames: ["API_KEY", "OTHER_KEY"],
+      command: "node -e console.log('hi') --days 7",
     });
     expect(stdoutSpy).toHaveBeenCalledWith("done\n");
   });
 
+  it("requires --only", async () => {
+    const program = buildProgram();
+
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--",
+        "env",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/--only is required/i);
+    expect(startJobSpy).not.toHaveBeenCalled();
+  });
+
+  it("requires a command after --", async () => {
+    const program = buildProgram();
+
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--only",
+        "API_KEY",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/no command specified/i);
+    expect(startJobSpy).not.toHaveBeenCalled();
+  });
+
   it("resolves identity before posting the runner job", async () => {
     const program = buildProgram();
     await program.parseAsync([
@@ -166,8 +209,10 @@ describe("secrets sandbox", () => {
       "--company",
       "parent-co",
       "sandbox",
+      "--only",
+      "API_KEY",
       "--",
-      "my-skill",
+      "env",
     ]);
 
     expect(ensureCognitoToken).toHaveBeenCalled();
@@ -175,58 +220,20 @@ describe("secrets sandbox", () => {
       personal: false,
       companySlug: "parent-co",
     });
-    expect(startJobSpy).toHaveBeenCalledWith(
-      "test-token",
-      expect.objectContaining({
-        skillId: "my-skill",
-        companyUid: "prs_alice",
-        companySlug: "parent-co",
-        usage: { channel: "sandbox" },
-      }),
-    );
-  });
-
-  it("can attach script attestation metadata to sandbox usage", async () => {
-    const scriptPath = join(tempDir, "sandbox-script.sh");
-    const scriptBody = "#!/usr/bin/env bash\necho sandbox\n";
-    writeFileSync(scriptPath, scriptBody);
-    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--script",
-      scriptPath,
-      "--",
-      "my-skill",
-    ]);
-
-    expect(startJobSpy).toHaveBeenCalledWith(
-      "test-token",
-      expect.objectContaining({
-        usage: {
-          channel: "sandbox",
-          script: {
-            scriptId: scriptPath,
-            path: scriptPath,
-            sha256: expectedSha,
-            attestationLevel: "self-asserted-hash",
-          },
-        },
-      }),
-    );
+    expect(startJobSpy).toHaveBeenCalledWith("test-token", {
+      companyUid: "prs_alice",
+      secretNames: ["API_KEY"],
+      command: "env",
+    });
   });
 
-  it("never batch-loads or prints a plaintext secret value locally", async () => {
+  it("prints server-scrubbed output and never batch-loads secrets locally", async () => {
     pollJobSpy.mockResolvedValueOnce({
       jobId: "job_123",
       status: "succeeded",
-      stdout: "token sk-test-secret-value\nAPI_KEY=sk-another-secret\n",
-      stderr: "debug sk-stderr-secret\n",
-      logsTail: "tail sk-log-secret\n",
+      output: "token [REDACTED]\nAPI_KEY=[REDACTED]\n",
+      exitCode: 0,
+      success: true,
     });
 
     const program = buildProgram();
@@ -253,37 +260,36 @@ describe("secrets sandbox", () => {
       ...logSpy.mock.calls.flat().map(String),
       ...errSpy.mock.calls.flat().map(String),
     ].join("\n");
-    expect(rendered).not.toContain("sk-test-secret-value");
-    expect(rendered).not.toContain("sk-another-secret");
-    expect(rendered).not.toContain("sk-stderr-secret");
-    expect(rendered).not.toContain("sk-log-secret");
     expect(rendered).toContain("[REDACTED]");
+    expect(stdoutSpy).toHaveBeenCalledWith("token [REDACTED]\nAPI_KEY=[REDACTED]\n");
   });
 
-  it("renders scrubbed stdout, stderr, and log tails", async () => {
+  it("exits non-zero when the sandbox command fails", async () => {
     pollJobSpy.mockResolvedValueOnce({
       jobId: "job_123",
-      status: "succeeded",
-      stdout: "ok\nAPI_KEY=sk-stdout-secret\n",
-      stderr: "warn sk-stderr-secret\n",
-      logsTail: "tail sk-log-secret\n",
+      status: "failed",
+      output: "boom\n",
+      exitCode: 7,
+      success: false,
     });
 
     const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "my-skill",
-    ]);
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "sandbox",
+        "--only",
+        "API_KEY",
+        "--",
+        "my-skill",
+      ]),
+    ).rejects.toThrow("__exit__");
 
-    expect(stdoutSpy).toHaveBeenCalledWith("ok\nAPI_KEY=[REDACTED]\n");
-    expect(stderrSpy).toHaveBeenCalledWith("warn [REDACTED]\n");
-    expect(stderrSpy).toHaveBeenCalledWith("tail [REDACTED]\n");
+    expect(stdoutSpy).toHaveBeenCalledWith("boom\n");
+    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/exit code 7/i);
+    expect(exitSpy).toHaveBeenCalledWith(7);
     expect(getJobSpy).not.toHaveBeenCalled();
   });
 });

package/src/commands/secrets.ts

@@ -368,14 +368,8 @@ export function scrubSandboxOutput(text: string, secretNames: string[] = []): st
 }
 
 function renderSandboxJobResult(job: SandboxRunnerJob, secretNames: string[]): void {
-  if (job.stdout) {
-    process.stdout.write(scrubSandboxOutput(job.stdout, secretNames));
-  }
-  if (job.stderr) {
-    process.stderr.write(scrubSandboxOutput(job.stderr, secretNames));
-  }
-  if (job.logsTail) {
-    process.stderr.write(scrubSandboxOutput(job.logsTail, secretNames));
+  if (job.output) {
+    process.stdout.write(scrubSandboxOutput(job.output, secretNames));
   }
 }
 
@@ -1249,38 +1243,41 @@ export function registerSecretsCommand(program: Command): void {
 
   secrets
     .command("sandbox")
-    .description("Run a skill in the hosted sandbox with secrets injected server-side")
+    .description("Run a command in the hosted sandbox with named secrets injected as env vars; open egress, secrets never touch this machine")
     .option("--company <slug>", "Company slug (resolves to companyUid)")
     .option(
       "--personal",
       "Operate on the caller's personal vault (no sharing)",
     )
-    .option("--only <keys>", "Comma-separated list of secret names the skill may use")
-    .option("--script <path>", "Attach local script identity for script-locked secrets")
+    .option("--only <keys>", "Comma-separated list of secret names to inject (required)")
     .allowUnknownOption(true)
-    .action(async (opts: { company?: string; personal?: boolean; only?: string; script?: string }, cmd: Command) => {
+    .action(async (opts: { company?: string; personal?: boolean; only?: string }, cmd: Command) => {
       try {
-        const dashIndex = process.argv.indexOf("--");
-        const rawArgs = dashIndex !== -1 ? process.argv.slice(dashIndex + 1) : cmd.args;
-        if (rawArgs.length === 0) {
-          console.error(chalk.red("Error: no skill specified. Usage: hq secrets sandbox [--company X] [--only KEY1,KEY2] -- <skill> [args...]"));
+        if (!opts.only || opts.only.trim().length === 0) {
+          console.error(chalk.red("Error: --only is required and must name at least one secret."));
+          process.exit(1);
+        }
+
+        const rawArgs = cmd.args;
+        const command = rawArgs.join(" ").trim();
+        if (command.length === 0) {
+          console.error(chalk.red("Error: no command specified. Usage: hq secrets sandbox --company <slug> --only KEY1,KEY2 -- <command>"));
+          process.exit(1);
+        }
+        if (command.length > 8192) {
+          console.error(chalk.red("Error: sandbox command exceeds the 8192 character limit."));
           process.exit(1);
         }
 
-        const [skillId, ...skillArgs] = rawArgs;
-        const keys = opts.only ? parseSecretNameList(opts.only) : [];
+        const keys = parseSecretNameList(opts.only);
         const token = await ensureCognitoToken();
         const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
         const companyUid = await getEntityUid(token, scope);
-        const usage = await buildSecretUsage("sandbox", opts.script);
         const client = new SandboxRunnerClient();
         const started = await client.startJob(token, {
-          skillId,
           companyUid,
-          args: skillArgs.length > 0 ? { argv: skillArgs } : undefined,
-          companySlug: scope.companySlug,
-          only: keys.length > 0 ? keys : undefined,
-          usage,
+          secretNames: keys,
+          command,
         });
         const job =
           started.status === "succeeded" || started.status === "failed"
@@ -1288,14 +1285,11 @@ export function registerSecretsCommand(program: Command): void {
             : await client.pollJob(token, started.jobId);
 
         renderSandboxJobResult(job, keys);
-        if (job.status === "failed") {
-          if (job.error) {
-            console.error(chalk.red("Sandbox job failed:"), scrubSandboxOutput(job.error, keys));
-          }
-          process.exit(job.exitCode && job.exitCode > 0 ? job.exitCode : 1);
-        }
-        if (job.exitCode && job.exitCode !== 0) {
-          process.exit(job.exitCode);
+        const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
+        if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {
+          const code = exitCode && exitCode !== 0 ? exitCode : 1;
+          console.error(chalk.red(`Sandbox command failed with exit code ${code}.`));
+          process.exit(code);
         }
       } catch (err) {
         console.error(

package/src/utils/sandbox-runner-client.test.ts

@@ -19,11 +19,9 @@ describe("SandboxRunnerClient", () => {
     });
 
     const result = await client.startJob("jwt-token", {
-      skillId: "my-skill",
       companyUid: "cmp_123",
-      args: { argv: ["--x"] },
-      only: ["API_KEY"],
-      usage: { channel: "sandbox" },
+      secretNames: ["API_KEY"],
+      command: "node script.js --x",
     });
 
     expect(result).toEqual({ jobId: "job_1", status: "queued" });
@@ -34,11 +32,9 @@ describe("SandboxRunnerClient", () => {
         "Content-Type": "application/json",
       },
       body: JSON.stringify({
-        skillId: "my-skill",
         companyUid: "cmp_123",
-        args: { argv: ["--x"] },
-        only: ["API_KEY"],
-        usage: { channel: "sandbox" },
+        secretNames: ["API_KEY"],
+        command: "node script.js --x",
       }),
     });
   });
@@ -49,7 +45,13 @@ describe("SandboxRunnerClient", () => {
       .mockResolvedValueOnce(jsonRes({ jobId: "job_1", status: "queued" }))
       .mockResolvedValueOnce(jsonRes({ jobId: "job_1", status: "running" }))
       .mockResolvedValueOnce(
-        jsonRes({ jobId: "job_1", status: "succeeded", stdout: "ok\n" }),
+        jsonRes({
+          jobId: "job_1",
+          status: "succeeded",
+          output: "ok\n",
+          exitCode: 0,
+          success: true,
+        }),
       );
     const client = new SandboxRunnerClient({
       baseUrl: "https://runner.example",
@@ -63,11 +65,9 @@ describe("SandboxRunnerClient", () => {
     expect(result).toEqual({
       jobId: "job_1",
       status: "succeeded",
-      stdout: "ok\n",
-      stderr: undefined,
-      logsTail: undefined,
-      exitCode: undefined,
-      error: undefined,
+      output: "ok\n",
+      exitCode: 0,
+      success: true,
     });
     expect(fetchImpl).toHaveBeenCalledTimes(3);
     expect(fetchImpl).toHaveBeenNthCalledWith(
@@ -82,9 +82,9 @@ describe("SandboxRunnerClient", () => {
       jsonRes({
         jobId: "job_1",
         status: "failed",
-        stderr: "boom\n",
+        output: "boom\n",
         exitCode: 2,
-        error: "command failed",
+        success: false,
       }),
     );
     const client = new SandboxRunnerClient({
@@ -97,15 +97,15 @@ describe("SandboxRunnerClient", () => {
     ).resolves.toMatchObject({
       jobId: "job_1",
       status: "failed",
-      stderr: "boom\n",
+      output: "boom\n",
       exitCode: 2,
-      error: "command failed",
+      success: false,
     });
   });
 
   it("uses the requested job id when the live status response omits it", async () => {
     const fetchImpl = vi.fn<typeof fetch>(async () =>
-      jsonRes({ status: "succeeded", logsTail: "ok\n" }),
+      jsonRes({ status: "succeeded", output: "ok\n" }),
     );
     const client = new SandboxRunnerClient({
       baseUrl: "https://runner.example",
@@ -115,11 +115,9 @@ describe("SandboxRunnerClient", () => {
     await expect(client.getJob("jwt-token", "job_live")).resolves.toEqual({
       jobId: "job_live",
       status: "succeeded",
-      stdout: undefined,
-      stderr: undefined,
-      logsTail: "ok\n",
+      output: "ok\n",
       exitCode: undefined,
-      error: undefined,
+      success: undefined,
     });
   });
 });

package/src/utils/sandbox-runner-client.ts

@@ -1,12 +1,9 @@
 export type SandboxRunnerState = "queued" | "running" | "succeeded" | "failed";
 
 export interface SandboxRunnerStartRequest {
-  skillId: string;
   companyUid: string;
-  args?: Record<string, unknown>;
-  companySlug?: string;
-  only?: string[];
-  usage?: unknown;
+  secretNames: string[];
+  command: string;
 }
 
 export interface SandboxRunnerStartResponse {
@@ -17,11 +14,9 @@ export interface SandboxRunnerStartResponse {
 export interface SandboxRunnerJob {
   jobId: string;
   status: SandboxRunnerState;
-  stdout?: string;
-  stderr?: string;
-  logsTail?: string;
+  output?: string;
   exitCode?: number;
-  error?: string;
+  success?: boolean;
 }
 
 export interface SandboxRunnerClientOptions {
@@ -70,23 +65,15 @@ function normalizeJob(
   if (!isSandboxRunnerState(status)) {
     throw new Error("Sandbox Runner returned an invalid job status.");
   }
-  const output =
-    typeof body.stdout === "string"
-      ? body.stdout
-      : typeof body.output === "string"
-        ? body.output
-        : undefined;
   return {
     jobId:
       typeof body.jobId === "string" && body.jobId.length > 0
         ? body.jobId
         : jobIdFallback ?? requireString(body, "jobId"),
     status,
-    stdout: output,
-    stderr: typeof body.stderr === "string" ? body.stderr : undefined,
-    logsTail: typeof body.logsTail === "string" ? body.logsTail : undefined,
+    output: typeof body.output === "string" ? body.output : undefined,
     exitCode: typeof body.exitCode === "number" ? body.exitCode : undefined,
-    error: typeof body.error === "string" ? body.error : undefined,
+    success: typeof body.success === "boolean" ? body.success : undefined,
   };
 }