@inflexa-ai/harness 0.45.0 → 0.46.0

package/dist/sandbox/exec-outcome.js

@@ -37,7 +37,7 @@ export function summarizeExec(result) {
         exitCode: result.exitCode,
         timedOut: result.timedOut,
         stderrTotalBytes: result.stderrTotalBytes ?? Buffer.byteLength(result.stderr, "utf8"),
-        ...(result.syntheticFailure ? { syntheticFailureReason: result.syntheticFailure.reason } : {}),
+        syntheticFailureReason: result.syntheticFailure?.reason,
     };
 }
 /**

package/dist/sandbox/exec.d.ts

@@ -18,13 +18,17 @@ export declare class ExecTimeoutError extends Error {
     constructor(execId: string);
 }
 /** The effects of one exec. Each member has a default, and a test replaces it. */
-export interface ExecDeps {
+export type ExecDeps = {
     /** Defaults to `globalThis.fetch`. */
     readonly fetch?: typeof fetch;
-    /** The clock of the deadline and of the cancel reads. Defaults to `Date.now`. */
-    readonly now?: () => number;
-    /** The pause between two polls. Defaults to a timer. */
-    readonly sleep?: (ms: number) => Promise<void>;
+    /**
+     * The clock of the deadline, of the cancel reads, and of the pause between
+     * two polls. Defaults to the system clock and a timer.
+     */
+    readonly clock?: {
+        now(): number;
+        wait(ms: number, signal?: AbortSignal): Promise<void>;
+    };
     /**
      * Sink for advisory warnings: events that the sandbox ring shed. Defaults to
      * `DBOS.logger.warn`. The terminal result, not the event stream, is the
@@ -41,7 +45,7 @@ export interface ExecDeps {
     readonly isCancelled?: () => Promise<boolean>;
     /** Per-stream retention budget sent with the submit. Defaults to `EXEC_STREAM_BYTE_CAP`. */
     readonly execStreamByteCap?: number;
-}
+};
 /**
  * The id of the exec that runs in the current durable step: the workflow id
  * and the function id of the step. Both are stable across a replay, and DBOS

package/dist/sandbox/exec.js

@@ -12,8 +12,13 @@
  * finished exec instead of a second run. The poll then starts at cursor 0, and
  * the caller gets the events of the exec again.
  */
+import { errorMessageOf } from "../lib/thrown.js";
+import { textOf } from "../lib/unknown-text.js";
+import { setTimeout as sleep } from "node:timers/promises";
 import { DBOS, Error as DBOSErrors, StatusString } from "@dbos-inc/dbos-sdk";
 import { untracedFetch } from "../lib/otel-spans.js";
+import { parseJsonAs } from "../lib/parse-json.js";
+import { presentFirst } from "../lib/present.js";
 import { EXEC_STREAM_BYTE_CAP } from "../tools/workspace/result-bounds.js";
 import { createEscalationPolicy, probeLiveness, syntheticFailureReason, syntheticFailureResult } from "./liveness.js";
 import { PollResponseSchema } from "./types.js";
@@ -33,6 +38,10 @@ const SLOW_POLL_INTERVAL_MS = 10_000;
  * when the workflow is cancelled.
  */
 const CANCEL_CHECK_INTERVAL_MS = 10_000;
+const systemClock = {
+    now: Date.now,
+    wait: (ms, signal) => sleep(ms, undefined, { signal }),
+};
 export class ExecTimeoutError extends Error {
     execId;
     constructor(execId) {
@@ -63,15 +72,19 @@ export function stepExecId() {
 export async function runExec(ref, execId, request, emit, deadlineMs, deps = {}) {
     const fetchImpl = deps.fetch ?? fetch;
     const cap = deps.execStreamByteCap ?? EXEC_STREAM_BYTE_CAP;
-    await submitExec(fetchImpl, ref, {
+    const body = {
         command: [...request.command],
         execId,
-        ...(request.cwd === undefined ? {} : { cwd: request.cwd }),
-        ...(request.env === undefined ? {} : { env: { ...request.env } }),
-        ...(request.timeoutSeconds === undefined ? {} : { timeoutSeconds: request.timeoutSeconds }),
         stdoutByteCap: cap,
         stderrByteCap: cap,
-    });
+    };
+    if (request.cwd !== undefined)
+        body.cwd = request.cwd;
+    if (request.env !== undefined)
+        body.env = { ...request.env };
+    if (request.timeoutSeconds !== undefined)
+        body.timeoutSeconds = request.timeoutSeconds;
+    await submitExec(fetchImpl, ref, body);
     return pollExec(ref, execId, emit, deadlineMs, deps);
 }
 /**
@@ -81,6 +94,7 @@ export async function runExec(ref, execId, request, emit, deadlineMs, deps = {})
  */
 async function submitExec(fetchImpl, ref, body) {
     const controller = new AbortController();
+    // oxlint-disable-next-line eslint-js/no-restricted-syntax -- a deadline guard, not a wait: it aborts the controller of the in-flight submit, and the finally clears it.
     const timer = setTimeout(() => controller.abort(), SUBMIT_HTTP_TIMEOUT_MS);
     try {
         const res = await untracedFetch(fetchImpl, `http://${ref.host}:${ref.port}/exec`, {
@@ -102,6 +116,7 @@ async function submitExec(fetchImpl, ref, body) {
 }
 async function pollOnce(fetchImpl, ref, execId, cursor) {
     const controller = new AbortController();
+    // oxlint-disable-next-line eslint-js/no-restricted-syntax -- a deadline guard, not a wait: it aborts the controller of the in-flight poll, and the finally clears it.
     const timer = setTimeout(() => controller.abort(), POLL_HTTP_TIMEOUT_MS);
     try {
         const res = await untracedFetch(fetchImpl, `http://${ref.host}:${ref.port}/exec/${encodeURIComponent(execId)}?since=${cursor}`, {
@@ -115,7 +130,7 @@ async function pollOnce(fetchImpl, ref, execId, cursor) {
         return { kind: "ok", raw: await res.text() };
     }
     catch (cause) {
-        return { kind: "unavailable", detail: cause instanceof Error ? cause.message : String(cause) };
+        return { kind: "unavailable", detail: errorMessageOf(cause) ?? textOf(cause) };
     }
     finally {
         clearTimeout(timer);
@@ -132,25 +147,25 @@ async function pollOnce(fetchImpl, ref, execId, cursor) {
  */
 async function pollExec(ref, execId, emit, deadlineMs, deps) {
     const fetchImpl = deps.fetch ?? fetch;
-    const now = deps.now ?? Date.now;
-    const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const now = deps.clock?.now.bind(deps.clock) ?? systemClock.now.bind(systemClock);
+    const wait = deps.clock?.wait.bind(deps.clock) ?? systemClock.wait.bind(systemClock);
     const warn = deps.warn ?? ((message) => DBOS.logger.warn(message));
     const isCancelled = deps.isCancelled ?? workflowCancelled;
     let cursor = 0;
     let pollAttempt = 0;
     let lastCancelCheckMs = now();
     const escalation = createEscalationPolicy();
-    while (true) {
+    for (;;) {
         pollAttempt += 1;
         const polled = await pollOnce(fetchImpl, ref, execId, cursor);
         if (polled.kind === "ok") {
-            const resp = PollResponseSchema.parse(JSON.parse(polled.raw));
+            const resp = parseJsonAs(polled.raw, PollResponseSchema);
             // Each event is emitted at most once, whatever `since` the server applied.
             const newEvents = resp.events.filter((ev) => ev.seq > cursor);
             // Sequence numbers are contiguous per exec, thus a hole between the local
             // cursor and the next delivered (or high-water) seq proves that the ring
             // shed events before the host saw them.
-            const nextSeq = newEvents.length > 0 ? newEvents[0].seq : resp.cursor > cursor ? resp.cursor + 1 : cursor + 1;
+            const nextSeq = newEvents.length > 0 ? presentFirst(newEvents, "the new sandbox event").seq : resp.cursor > cursor ? resp.cursor + 1 : cursor + 1;
             const lost = nextSeq - cursor - 1;
             if (lost > 0) {
                 warn(`exec[${execId}]: ${lost} progress event(s) (seq ${cursor + 1}-${cursor + lost}) shed by the sandbox ring before delivery; the terminal result is unaffected`);
@@ -184,7 +199,7 @@ async function pollExec(ref, execId, emit, deadlineMs, deps) {
                 throw new DBOSErrors.DBOSWorkflowCancelledError(DBOS.workflowID ?? execId);
         }
         const intervalMs = pollAttempt <= FAST_POLL_ATTEMPTS ? FAST_POLL_INTERVAL_MS : SLOW_POLL_INTERVAL_MS;
-        await sleep(Math.min(intervalMs, remainingMs));
+        await wait(Math.min(intervalMs, remainingMs));
     }
 }
 /** Read the status of the workflow that runs this exec. Outside a workflow, nothing can cancel it. */

package/dist/sandbox/execution-id.js

@@ -27,12 +27,20 @@ const nanoid = customAlphabet("abcdefghijklmnopqrstuvwxyz0123456789");
  * - Truncated to 40 characters
  */
 export function sanitizeAgentName(name) {
-    return name
-        .toLowerCase()
-        .replace(/[^a-z0-9-]/g, "-")
-        .replace(/-{2,}/g, "-")
-        .replace(/^-+|-+$/g, "")
-        .slice(0, AGENT_NAME_MAX_LENGTH);
+    let out = "";
+    let inRun = false;
+    for (const char of name.toLowerCase()) {
+        const keeps = (char >= "a" && char <= "z") || (char >= "0" && char <= "9");
+        if (!keeps) {
+            inRun = true;
+            continue;
+        }
+        if (inRun && out.length > 0)
+            out += "-";
+        inRun = false;
+        out += char;
+    }
+    return out.slice(0, AGENT_NAME_MAX_LENGTH);
 }
 /**
  * Generate a unified execution ID for an agent invocation.

package/dist/sandbox/farm.d.ts

@@ -55,7 +55,7 @@ export declare const FarmLockSchema: z.ZodObject<{
         r: z.ZodOptional<z.ZodObject<{
             version: z.ZodString;
             bioc_releases: z.ZodArray<z.ZodString>;
-            pak_lock: z.ZodOptional<z.ZodUnknown>;
+            pak_lock: z.ZodOptional<z.ZodCustom<unknown, unknown>>;
         }, z.core.$loose>>;
     }, z.core.$loose>;
     warm: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -65,8 +65,8 @@ export declare const FarmLockSchema: z.ZodObject<{
     merge_conflicts: z.ZodOptional<z.ZodArray<z.ZodObject<{
         entry: z.ZodString;
         action: z.ZodEnum<{
-            skipped: "skipped";
             "kept-first": "kept-first";
+            skipped: "skipped";
         }>;
     }, z.core.$loose>>>;
 }, z.core.$loose>;

package/dist/sandbox/farm.js

@@ -18,11 +18,11 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { err, ok } from "neverthrow";
 import { z } from "zod";
+import { safeParseJsonAs } from "../lib/parse-json.js";
 /** The one metadata file of a farm. */
 export const FARM_LOCK_FILE = "inflexa.lock";
 /** One linked distribution. `requested` obeys the PEP 376 meaning: true for a direct ask, false for a transitive dependency. */
-export const FarmLockPackageSchema = z
-    .object({
+export const FarmLockPackageSchema = z.looseObject({
     name: z.string(),
     version: z.string(),
     /** The link subtree of the package (for example `python`, `cran`, `bioconductor`). */
@@ -31,52 +31,48 @@ export const FarmLockPackageSchema = z
     /** The full sha256 of the sorted store tree. */
     hash: z.string(),
     requested: z.boolean(),
-})
-    .passthrough();
+});
+/**
+ * Whatever `JSON.parse` yields: a JSON value, plus Infinity — an over-large
+ * literal such as `1e999` reads as Infinity, which `z.json()` refuses.
+ * `JSON.parse` output never holds `undefined`, so the check is exact for that feed.
+ */
+const ParsedJsonValue = z.custom((value) => value !== undefined);
 /**
  * `inflexa.lock` at schema version 1. Additive fields pass through — a
  * breaking change to the shape must move the schema number instead.
  */
-export const FarmLockSchema = z
-    .object({
+export const FarmLockSchema = z.looseObject({
     schema: z.literal(1),
     arch: z.enum(["amd64", "arm64"]),
     packages: z.array(FarmLockPackageSchema),
     /** Per-language provenance. Each language object owns its own fields. */
-    languages: z
-        .object({
-        python: z.object({ version: z.string(), index: z.string() }).passthrough().optional(),
+    languages: z.looseObject({
+        python: z.looseObject({ version: z.string(), index: z.string() }).optional(),
         r: z
-            .object({
+            .looseObject({
             version: z.string(),
             bioc_releases: z.array(z.string()),
             /** The embedded pak lock of the build, verbatim. */
-            pak_lock: z.unknown().optional(),
+            pak_lock: ParsedJsonValue.optional(),
         })
-            .passthrough()
             .optional(),
-    })
-        .passthrough(),
+    }),
     /** The warm replay record. Present in the catalog farm only. */
     warm: z
-        .record(z.string(), z
-        .object({
+        .record(z.string(), z.looseObject({
         script_sha256: z.string(),
         cache_entries: z.array(z.string()),
-    })
-        .passthrough())
+    }))
         .optional(),
     /** The top-level entries that the link merge kept-first or skipped. */
     merge_conflicts: z
-        .array(z
-        .object({
+        .array(z.looseObject({
         entry: z.string(),
         action: z.enum(["kept-first", "skipped"]),
-    })
-        .passthrough())
+    }))
         .optional(),
-})
-    .passthrough();
+});
 /**
  * Read and validate the `inflexa.lock` of a farm directory. The mount gate
  * accepts a farm only when this returns ok — a farm whose lock is absent,
@@ -94,14 +90,13 @@ export function readFarmLockFile(lockPath) {
     catch (cause) {
         return err({ type: "lock_unreadable", lockPath, cause });
     }
-    let parsed;
+    let lock;
     try {
-        parsed = JSON.parse(raw);
+        lock = safeParseJsonAs(raw, FarmLockSchema);
     }
     catch (cause) {
         return err({ type: "lock_invalid", lockPath, cause });
     }
-    const lock = FarmLockSchema.safeParse(parsed);
     if (!lock.success) {
         return err({ type: "lock_invalid", lockPath, cause: lock.error });
     }

package/dist/sandbox/identity.d.ts

@@ -13,3 +13,10 @@ import type { SandboxIdentity } from "./types.js";
  *  adoption is owner-label-guarded, but a unique name keeps a collision from
  *  ever reaching that guard. */
 export declare function mintSandboxIdentity(runId: string): SandboxIdentity;
+/**
+ * `sbx-{run8}-{hash12}` — the name of a sandbox whose identity comes from a
+ * key, not from a checkpoint. The same key gives the same name, thus a rerun
+ * of a step adopts the machine of the earlier attempt. The key is hashed,
+ * because a workflow id can hold characters that a container name refuses.
+ */
+export declare function keyedSandboxIdentity(runId: string, key: string): SandboxIdentity;

package/dist/sandbox/identity.js

@@ -6,14 +6,25 @@
  * spawn-step checkpoint is recoverable — the re-run adopts the existing machine
  * under the same name.
  */
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 /** `sbx-{run8}-{rand8}` — run prefix aids `kubectl` triage; the 8-hex random
  *  suffix makes within-run collisions across a run's concurrent steps
  *  negligible. Names are NOT the idempotency mechanism (the checkpoint is), and
  *  adoption is owner-label-guarded, but a unique name keeps a collision from
  *  ever reaching that guard. */
 export function mintSandboxIdentity(runId) {
-    const run8 = runId.replace(/-/g, "").slice(0, 8);
-    const suffix = randomUUID().replace(/-/g, "").slice(0, 8);
+    const run8 = runId.replaceAll("-", "").slice(0, 8);
+    const suffix = randomUUID().replaceAll("-", "").slice(0, 8);
+    return { sandboxId: `sbx-${run8}-${suffix}` };
+}
+/**
+ * `sbx-{run8}-{hash12}` — the name of a sandbox whose identity comes from a
+ * key, not from a checkpoint. The same key gives the same name, thus a rerun
+ * of a step adopts the machine of the earlier attempt. The key is hashed,
+ * because a workflow id can hold characters that a container name refuses.
+ */
+export function keyedSandboxIdentity(runId, key) {
+    const run8 = runId.replaceAll("-", "").slice(0, 8);
+    const suffix = createHash("sha256").update(key, "utf8").digest("hex").slice(0, 12);
     return { sandboxId: `sbx-${run8}-${suffix}` };
 }

package/dist/sandbox/image-packages.d.ts

@@ -1,9 +1,11 @@
 /**
  * `image-packages.json` — the self-description of the sandbox image.
  *
- * The image bakes two package tracks that the content-addressed store cannot
- * hold: the conda tools at `/opt/conda` and the Node packages at `/opt/node`.
- * The image writes one record of them at `/opt/inflexa/image-packages.json`,
+ * The image bakes the package tracks that the content-addressed store cannot
+ * hold: the conda tools at `/opt/conda`, the Node packages at `/opt/node`,
+ * and the R packages that ship with the R runtime (the base and the
+ * recommended packages, which no farm lock lists). The image writes one
+ * record of them at `/opt/inflexa/image-packages.json`,
  * and the catalog build copies that record verbatim into the root of the
  * package store it packed beside it. Thus every reader of a store learns the
  * image inventory from the store alone — with no container engine, no
@@ -57,10 +59,22 @@ export declare const ImageNodePackageSchema: z.ZodObject<{
     name: z.ZodString;
     version: z.ZodString;
 }, z.core.$loose>;
+/** One R package that ships with the R runtime of the image: a base package or a recommended package. */
+export declare const ImageRBasePackageSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    priority: z.ZodEnum<{
+        base: "base";
+        recommended: "recommended";
+    }>;
+}, z.core.$loose>;
 /**
  * `image-packages.json` at schema version 1. The keys `system_tools` and
  * `node` are the keys of the image manifest, thus one name means one track
- * across the build and the reader.
+ * across the build and the reader. `r_base` is the track of the R runtime
+ * itself: the packages R ships, which no manifest names and no farm lock
+ * lists. It is optional, because a record from before the field existed is
+ * still a valid record of its image.
  */
 export declare const ImagePackagesSchema: z.ZodObject<{
     schema: z.ZodLiteral<1>;
@@ -86,6 +100,14 @@ export declare const ImagePackagesSchema: z.ZodObject<{
         name: z.ZodString;
         version: z.ZodString;
     }, z.core.$loose>>;
+    r_base: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        priority: z.ZodEnum<{
+            base: "base";
+            recommended: "recommended";
+        }>;
+    }, z.core.$loose>>>;
 }, z.core.$loose>;
 export type ImagePackages = z.infer<typeof ImagePackagesSchema>;
 export type ImagePackagesError = {

package/dist/sandbox/image-packages.js

@@ -1,9 +1,11 @@
 /**
  * `image-packages.json` — the self-description of the sandbox image.
  *
- * The image bakes two package tracks that the content-addressed store cannot
- * hold: the conda tools at `/opt/conda` and the Node packages at `/opt/node`.
- * The image writes one record of them at `/opt/inflexa/image-packages.json`,
+ * The image bakes the package tracks that the content-addressed store cannot
+ * hold: the conda tools at `/opt/conda`, the Node packages at `/opt/node`,
+ * and the R packages that ship with the R runtime (the base and the
+ * recommended packages, which no farm lock lists). The image writes one
+ * record of them at `/opt/inflexa/image-packages.json`,
  * and the catalog build copies that record verbatim into the root of the
  * package store it packed beside it. Thus every reader of a store learns the
  * image inventory from the store alone — with no container engine, no
@@ -22,6 +24,7 @@
 import { readFileSync } from "node:fs";
 import { err, ok } from "neverthrow";
 import { z } from "zod";
+import { safeParseJsonAs } from "../lib/parse-json.js";
 /**
  * The file name of the record, at the root of the package store. Exported,
  * as `FARM_LOCK_FILE` is, thus an embedder that joins the path onto its own
@@ -29,54 +32,54 @@ import { z } from "zod";
  */
 export const IMAGE_PACKAGES_FILE = "image-packages.json";
 /** The image the record describes. The pair of tags shares one version string. */
-export const ImageIdentitySchema = z
-    .object({
+export const ImageIdentitySchema = z.looseObject({
     repository: z.string(),
     version: z.string(),
     arch: z.enum(["amd64", "arm64"]),
-})
-    .passthrough();
+});
 /** The interpreter versions of the image, so a reader can compare them against the lock. */
-export const ImageRuntimesSchema = z
-    .object({
+export const ImageRuntimesSchema = z.looseObject({
     python: z.string(),
     r: z.string(),
     node: z.string(),
-})
-    .passthrough();
+});
 /**
  * One conda tool of the image. `executable` carries the binary name when it
  * differs from the package name (the manifest `binaries:` map holds those
  * exceptions), because an agent invokes the binary and not the package.
  */
-export const ImageSystemToolSchema = z
-    .object({
+export const ImageSystemToolSchema = z.looseObject({
     name: z.string(),
     version: z.string(),
     executable: z.string().optional(),
-})
-    .passthrough();
+});
 /** One Node package of the image. */
-export const ImageNodePackageSchema = z
-    .object({
+export const ImageNodePackageSchema = z.looseObject({
     name: z.string(),
     version: z.string(),
-})
-    .passthrough();
+});
+/** One R package that ships with the R runtime of the image: a base package or a recommended package. */
+export const ImageRBasePackageSchema = z.looseObject({
+    name: z.string(),
+    version: z.string(),
+    priority: z.enum(["base", "recommended"]),
+});
 /**
  * `image-packages.json` at schema version 1. The keys `system_tools` and
  * `node` are the keys of the image manifest, thus one name means one track
- * across the build and the reader.
+ * across the build and the reader. `r_base` is the track of the R runtime
+ * itself: the packages R ships, which no manifest names and no farm lock
+ * lists. It is optional, because a record from before the field existed is
+ * still a valid record of its image.
  */
-export const ImagePackagesSchema = z
-    .object({
+export const ImagePackagesSchema = z.looseObject({
     schema: z.literal(1),
     image: ImageIdentitySchema,
     runtimes: ImageRuntimesSchema,
     system_tools: z.array(ImageSystemToolSchema),
     node: z.array(ImageNodePackageSchema),
-})
-    .passthrough();
+    r_base: z.array(ImageRBasePackageSchema).optional(),
+});
 /**
  * Read and validate one `image-packages.json` by its file path. The read is
  * synchronous, the same as {@link readFarmLockFile}, because the caller reads
@@ -92,14 +95,13 @@ export function readImagePackagesFile(recordPath) {
     catch (cause) {
         return err({ type: "record_unreadable", recordPath, cause });
     }
-    let parsed;
+    let record;
     try {
-        parsed = JSON.parse(raw);
+        record = safeParseJsonAs(raw, ImagePackagesSchema);
     }
     catch (cause) {
         return err({ type: "record_invalid", recordPath, cause });
     }
-    const record = ImagePackagesSchema.safeParse(parsed);
     if (!record.success) {
         return err({ type: "record_invalid", recordPath, cause: record.error });
     }

package/dist/sandbox/k8s-client.d.ts

@@ -13,14 +13,41 @@
  * derived from the same `resolveWorkspaceRoot` seam the harness pre-creates
  * the step tree under, so both sides address one directory by construction.
  */
-import { BatchV1Api, CoreV1Api, type V1Toleration } from "@kubernetes/client-node";
+import { type V1Job, type V1JobList, type V1PodList, type V1Toleration } from "@kubernetes/client-node";
 import { ResultAsync } from "neverthrow";
 import type { ResolveWorkspaceRoot } from "../workspace/paths.js";
 import { type SandboxError } from "./sandbox-error.js";
 import type { SpawnSession } from "../auth/types.js";
 import type { FarmSource, ManagedSandbox, SandboxIdentity, SandboxLabels, SandboxLiveness, SandboxRef, SandboxSpec, ToolchainSource } from "./types.js";
 import type { Logger } from "../lib/logger.js";
-export interface K8sClientConfig {
+/** The Job operations of `BatchV1Api` the module reads, read structurally so tests build fakes cast-free. */
+export type BatchJobApi = {
+    createNamespacedJob(request: {
+        namespace: string;
+        body: V1Job;
+    }): Promise<V1Job>;
+    readNamespacedJob(request: {
+        namespace: string;
+        name: string;
+    }): Promise<V1Job>;
+    deleteNamespacedJob(request: {
+        namespace: string;
+        name: string;
+        propagationPolicy?: string;
+    }): Promise<unknown>;
+    listNamespacedJob(request: {
+        namespace: string;
+        labelSelector?: string;
+    }): Promise<V1JobList>;
+};
+/** The Pod operations of `CoreV1Api` the module reads, read structurally so tests build fakes cast-free. */
+export type CorePodApi = {
+    listNamespacedPod(request: {
+        namespace: string;
+        labelSelector?: string;
+    }): Promise<V1PodList>;
+};
+export type K8sClientConfig = {
     /** Operational logging seam; omitted falls back to no-op. */
     readonly logger?: Logger;
     image: string;
@@ -76,17 +103,17 @@ export interface K8sClientConfig {
     /** RuntimeClass for runtime isolation (e.g. `gvisor`). Omit for the default runtime. */
     runtimeClassName?: string;
     /** Injected for tests. */
-    batchApi?: BatchV1Api;
-    coreApi?: CoreV1Api;
+    batchApi?: BatchJobApi;
+    coreApi?: CorePodApi;
     registerSandbox: (session: SpawnSession, spec: SandboxSpec, ref: SandboxRef) => Promise<void>;
-}
+};
 /** Clock and sleep seams, so a test can drive the slow-pod warning without waiting a minute. */
-export interface WaitForPodReadyDeps {
+export type WaitForPodReadyDeps = {
     readonly logger?: Logger;
     readonly now?: () => number;
     readonly sleep?: (ms: number) => Promise<void>;
-}
-export declare function waitForPodReady(coreApi: CoreV1Api, namespace: string, sandboxId: string, deps?: WaitForPodReadyDeps): ResultAsync<{
+};
+export declare function waitForPodReady(coreApi: CorePodApi, namespace: string, sandboxId: string, deps?: WaitForPodReadyDeps): ResultAsync<{
     podIP: string;
     podName: string;
 }, SandboxError>;

package/dist/sandbox/k8s-client.js

@@ -14,6 +14,7 @@
  * the step tree under, so both sides address one directory by construction.
  */
 import { join, relative as relativePath, sep } from "node:path";
+import { setTimeout as timerSleep } from "node:timers/promises";
 import { BatchV1Api, CoreV1Api, KubeConfig, } from "@kubernetes/client-node";
 import { ResultAsync, err, ok } from "neverthrow";
 import { trySandbox } from "./sandbox-error.js";
@@ -132,7 +133,7 @@ async function buildJobSpec(session, sandboxSpec, hostLabels, config, identity,
     const env = Object.entries({
         ...threadLimitEnv(spec),
         ...plan.env,
-        ...(sandboxSpec.extraEnv ?? {}),
+        ...sandboxSpec.extraEnv,
     }).map(([name, value]) => ({ name, value }));
     // requests == limits → Guaranteed QoS and a predictable OOM bound; also
     // satisfies the namespace ResourceQuota, which rejects any pod that omits
@@ -178,7 +179,7 @@ async function buildJobSpec(session, sandboxSpec, hostLabels, config, identity,
             // Volume-level readOnly only when nothing writes through the claim:
             // the cache mount needs write access, and the per-mount flags keep
             // the store and the farm read-only either way.
-            persistentVolumeClaim: { claimName: config.libStorePvc, ...(cacheSubPath === undefined ? { readOnly: true } : {}) },
+            persistentVolumeClaim: { claimName: config.libStorePvc, readOnly: cacheSubPath === undefined ? true : undefined },
         });
         volumeMounts.push({
             name: LIBS_VOLUME_NAME,
@@ -295,7 +296,7 @@ export function waitForPodReady(coreApi, namespace, sandboxId, deps = {}) {
         cause,
     });
     const now = deps.now ?? (() => Date.now());
-    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const sleep = deps.sleep ?? timerSleep;
     const logger = (deps.logger ?? createNoopLogger()).named("k8s-client");
     return new ResultAsync((async () => {
         const startedAt = now();
@@ -378,7 +379,7 @@ function waitForJobGone(batchApi, namespace, name) {
                     return ok(undefined);
                 return err(read.error);
             }
-            await new Promise((r) => setTimeout(r, 500));
+            await timerSleep(500);
         }
         return err(createFailed(undefined, new Error(`K8sSandbox ${name}: prior Job did not delete within 60s`)));
     })());
@@ -501,7 +502,7 @@ export function createK8sSandboxOps(config) {
                 // finishes) — the Job controller retries pod creation forever. Delete
                 // the Job on any startup failure so a failed create can't leak a
                 // zombie that floods k8s events indefinitely.
-                const ready = await waitForPodReady(coreApi, config.namespace, sandboxId, { ...(config.logger ? { logger: config.logger } : {}) });
+                const ready = await waitForPodReady(coreApi, config.namespace, sandboxId, { logger: config.logger });
                 if (ready.isOk()) {
                     const ref = {
                         sandboxId,

package/dist/sandbox/labels.js

@@ -27,6 +27,7 @@ export const STEP_ID_LABEL = "cortex/step-id";
  */
 export const OWNER_WORKFLOW_KEY = "cortex/owner-workflow-id";
 /** A valid K8s label value: 1 to 63 characters, `[A-Za-z0-9._-]` only, a letter or a digit at each end. */
+// oxlint-disable-next-line eslint-js/no-restricted-syntax -- the K8s label-value grammar: the bounded charset with the letter-or-digit ends; the shape is the K8s validation rule.
 const LABEL_VALUE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,61}[A-Za-z0-9])?$/;
 /** The harness never applies it to a host value. */
 export function isLabelValue(value) {