@sealant/api-contracts-next 0.39.0-next.704 → 0.39.0-next.705

package/dist/core-api/control-plane.d.ts

@@ -427,6 +427,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
         readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
     }>>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly user: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
     readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -455,6 +456,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
         readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
     }>>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly user: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
     readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -572,6 +574,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
             readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
         }>>;
         readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+        readonly user: import("effect/Schema").optional<import("effect/Schema").String>;
         readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
         readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
         readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -611,6 +614,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
         readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
     }>>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly user: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
     readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -678,6 +682,40 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
     readonly outputHighWater: import("effect/Schema").String;
     readonly createdAt: import("effect/Schema").String;
     readonly endedAt: import("effect/Schema").optional<import("effect/Schema").String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./sessions.js").SessionBadRequestError | typeof import("./sessions.js").SessionUnauthorizedError | typeof import("./sessions.js").SessionForbiddenError | typeof import("./sessions.js").SessionNotFoundError | typeof import("./sessions.js").SessionConflictError | typeof import("./sessions.js").SessionBadGatewayError | typeof import("./sessions.js").SessionInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"createSessionAsUser", "POST", "/v1/sessions/as-user", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly workspaceId: import("effect/Schema").String;
+    readonly ownerUserId: import("effect/Schema").String;
+    readonly argv: import("effect/Schema").$Array<import("effect/Schema").String>;
+    readonly cwd: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly env: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").String>>;
+    readonly cols: import("effect/Schema").optional<import("effect/Schema").Int>;
+    readonly rows: import("effect/Schema").optional<import("effect/Schema").Int>;
+    readonly term: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly mode: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["pty", "pipe"]>>;
+    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly user: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    readonly authorization: import("effect/Schema").optional<import("effect/Schema").String>;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly sessionId: import("effect/Schema").String;
+    readonly workspaceId: import("effect/Schema").String;
+    readonly runId: import("effect/Schema").String;
+    readonly ownerUserId: import("effect/Schema").String;
+    readonly status: import("effect/Schema").Literals<readonly ["starting", "running", "exited", "failed"]>;
+    readonly argv: import("effect/Schema").$Array<import("effect/Schema").String>;
+    readonly argCount: import("effect/Schema").optional<import("effect/Schema").Number>;
+    readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
+    readonly cwd: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly cols: import("effect/Schema").Number;
+    readonly rows: import("effect/Schema").Number;
+    readonly mode: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["pty", "pipe"]>>;
+    readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
+    readonly exitSignal: import("effect/Schema").optional<import("effect/Schema").Number>;
+    readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly outputHighWater: import("effect/Schema").String;
+    readonly createdAt: import("effect/Schema").String;
+    readonly endedAt: import("effect/Schema").optional<import("effect/Schema").String>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./sessions.js").SessionBadRequestError | typeof import("./sessions.js").SessionUnauthorizedError | typeof import("./sessions.js").SessionForbiddenError | typeof import("./sessions.js").SessionNotFoundError | typeof import("./sessions.js").SessionConflictError | typeof import("./sessions.js").SessionBadGatewayError | typeof import("./sessions.js").SessionInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"getSession", "GET", "/v1/sessions/:sessionId", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
     readonly sessionId: import("effect/Schema").String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
@@ -826,6 +864,11 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
     readonly openApiPath: import("effect/Schema").String;
     readonly features: import("effect/Schema").optional<import("effect/Schema").Struct<{
         readonly processUser: import("effect/Schema").Boolean;
+        readonly processUserRoutes: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly dotfilesApply: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly credentialsPartialPut: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly credentialsPiOpencode: import("effect/Schema").optional<import("effect/Schema").Boolean>;
+        readonly captureOwnerMap: import("effect/Schema").optional<import("effect/Schema").Boolean>;
     }>>;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<never>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
     readonly needsSetup: import("effect/Schema").Boolean;
@@ -893,6 +936,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
         readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
     }>>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly user: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
     readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -1000,6 +1044,42 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
         readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
     }>>;
     readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly user: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
+    readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly finishedAt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly recordDeletedAt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly createdAt: import("effect/Schema").String;
+    readonly updatedAt: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./workspaces.js").WorkspaceBadRequestError | typeof import("./workspaces.js").WorkspaceNotFoundError | typeof import("./workspaces.js").WorkspaceConflictError | typeof import("./workspaces.js").WorkspaceBadGatewayError | typeof import("./workspaces.js").WorkspaceInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"execWorkspaceAsUser", "POST", "/v1/workspaces/:workspaceId/exec-as-user", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+    readonly workspaceId: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly ownerUserId: import("effect/Schema").String;
+    readonly commands: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly executable: import("effect/Schema").String;
+        readonly args: import("effect/Schema").$Array<import("effect/Schema").String>;
+        readonly cwd: import("effect/Schema").optional<import("effect/Schema").String>;
+    }>>;
+    readonly user: import("effect/Schema").String;
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
+    readonly runId: import("effect/Schema").String;
+    readonly workspaceId: import("effect/Schema").String;
+    readonly attemptId: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly ownerUserId: import("effect/Schema").String;
+    readonly harnessId: import("effect/Schema").String;
+    readonly mode: import("effect/Schema").Literals<readonly ["one-shot", "interactive"]>;
+    readonly status: import("effect/Schema").Literals<readonly ["queued", "running", "completed", "failed", "cancelled"]>;
+    readonly prompt: import("effect/Schema").optional<import("effect/Schema").String>;
+    readonly command: import("effect/Schema").optional<import("effect/Schema").Struct<{
+        readonly executable: import("effect/Schema").String;
+        readonly args: import("effect/Schema").$Array<import("effect/Schema").String>;
+        readonly cwd: import("effect/Schema").optional<import("effect/Schema").String>;
+        readonly argCount: import("effect/Schema").optional<import("effect/Schema").Number>;
+        readonly argLengths: import("effect/Schema").optional<import("effect/Schema").$Array<import("effect/Schema").Number>>;
+    }>>;
+    readonly metadata: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
+    readonly user: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly exitCode: import("effect/Schema").optional<import("effect/Schema").Number>;
     readonly errorMessage: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly startedAt: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -1007,7 +1087,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
     readonly recordDeletedAt: import("effect/Schema").optional<import("effect/Schema").String>;
     readonly createdAt: import("effect/Schema").String;
     readonly updatedAt: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./workspaces.js").WorkspaceBadRequestError | typeof import("./workspaces.js").WorkspaceNotFoundError | typeof import("./workspaces.js").WorkspaceConflictError | typeof import("./workspaces.js").WorkspaceInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"expireWorkspace", "POST", "/v1/workspaces/:workspaceId/expire", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
+}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("./workspaces.js").WorkspaceBadRequestError | typeof import("./workspaces.js").WorkspaceNotFoundError | typeof import("./workspaces.js").WorkspaceConflictError | typeof import("./workspaces.js").WorkspaceBadGatewayError | typeof import("./workspaces.js").WorkspaceInternalServerError>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"expireWorkspace", "POST", "/v1/workspaces/:workspaceId/expire", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
     readonly workspaceId: import("effect/Schema").String;
 }>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
     readonly ownerUserId: import("effect/Schema").String;
@@ -1106,6 +1186,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
             readonly acl: import("effect/Schema").Literals<readonly ["supported", "unsupported", "unknown"]>;
         }>>;
     }>>;
+    readonly processUser: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["supported", "unsupported", "unknown"]>>;
     readonly error: import("effect/Schema").optional<import("effect/Schema").Struct<{
         readonly message: import("effect/Schema").String;
         readonly code: import("effect/Schema").optional<import("effect/Schema").String>;
@@ -1403,6 +1484,7 @@ export declare const ControlPlaneAPI: HttpApi.HttpApi<"sealantControlPlaneApi",
                 readonly acl: import("effect/Schema").Literals<readonly ["supported", "unsupported", "unknown"]>;
             }>>;
         }>>;
+        readonly processUser: import("effect/Schema").optional<import("effect/Schema").Literals<readonly ["supported", "unsupported", "unknown"]>>;
         readonly error: import("effect/Schema").optional<import("effect/Schema").Struct<{
             readonly message: import("effect/Schema").String;
             readonly code: import("effect/Schema").optional<import("effect/Schema").String>;

package/dist/core-api/runs.d.ts

@@ -57,6 +57,11 @@ export declare const runSchema: Schema.Struct<{
     }>>;
     /** Opaque caller correlation bag, echoed verbatim (no platform semantics). */
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    /**
+     * The Linux user the run's processes were started as (`user` on an exec or a session): the login
+     * name or uid the caller named, and nothing else of the process. Absent: the workspace's own user.
+     */
+    readonly user: Schema.optional<Schema.String>;
     readonly exitCode: Schema.optional<Schema.Number>;
     readonly errorMessage: Schema.optional<Schema.String>;
     readonly startedAt: Schema.optional<Schema.String>;
@@ -135,6 +140,11 @@ export declare const listRunsResponseSchema: Schema.Struct<{
         }>>;
         /** Opaque caller correlation bag, echoed verbatim (no platform semantics). */
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+        /**
+         * The Linux user the run's processes were started as (`user` on an exec or a session): the login
+         * name or uid the caller named, and nothing else of the process. Absent: the workspace's own user.
+         */
+        readonly user: Schema.optional<Schema.String>;
         readonly exitCode: Schema.optional<Schema.Number>;
         readonly errorMessage: Schema.optional<Schema.String>;
         readonly startedAt: Schema.optional<Schema.String>;
@@ -335,6 +345,11 @@ export declare const RunsGroup: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoin
     }>>;
     /** Opaque caller correlation bag, echoed verbatim (no platform semantics). */
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    /**
+     * The Linux user the run's processes were started as (`user` on an exec or a session): the login
+     * name or uid the caller named, and nothing else of the process. Absent: the workspace's own user.
+     */
+    readonly user: Schema.optional<Schema.String>;
     readonly exitCode: Schema.optional<Schema.Number>;
     readonly errorMessage: Schema.optional<Schema.String>;
     readonly startedAt: Schema.optional<Schema.String>;
@@ -369,6 +384,11 @@ export declare const RunsGroup: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoin
     }>>;
     /** Opaque caller correlation bag, echoed verbatim (no platform semantics). */
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    /**
+     * The Linux user the run's processes were started as (`user` on an exec or a session): the login
+     * name or uid the caller named, and nothing else of the process. Absent: the workspace's own user.
+     */
+    readonly user: Schema.optional<Schema.String>;
     readonly exitCode: Schema.optional<Schema.Number>;
     readonly errorMessage: Schema.optional<Schema.String>;
     readonly startedAt: Schema.optional<Schema.String>;
@@ -509,6 +529,11 @@ export declare const RunsGroup: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoin
         }>>;
         /** Opaque caller correlation bag, echoed verbatim (no platform semantics). */
         readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+        /**
+         * The Linux user the run's processes were started as (`user` on an exec or a session): the login
+         * name or uid the caller named, and nothing else of the process. Absent: the workspace's own user.
+         */
+        readonly user: Schema.optional<Schema.String>;
         readonly exitCode: Schema.optional<Schema.Number>;
         readonly errorMessage: Schema.optional<Schema.String>;
         readonly startedAt: Schema.optional<Schema.String>;
@@ -556,6 +581,11 @@ export declare const RunsGroup: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoin
     }>>;
     /** Opaque caller correlation bag, echoed verbatim (no platform semantics). */
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    /**
+     * The Linux user the run's processes were started as (`user` on an exec or a session): the login
+     * name or uid the caller named, and nothing else of the process. Absent: the workspace's own user.
+     */
+    readonly user: Schema.optional<Schema.String>;
     readonly exitCode: Schema.optional<Schema.Number>;
     readonly errorMessage: Schema.optional<Schema.String>;
     readonly startedAt: Schema.optional<Schema.String>;

package/dist/core-api/runs.js

@@ -55,6 +55,11 @@ export const runSchema = Schema.Struct({
     command: Schema.optional(recordedRunCommandSchema),
     /** Opaque caller correlation bag, echoed verbatim (no platform semantics). */
     metadata: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+    /**
+     * The Linux user the run's processes were started as (`user` on an exec or a session): the login
+     * name or uid the caller named, and nothing else of the process. Absent: the workspace's own user.
+     */
+    user: Schema.optional(NonEmptyString),
     exitCode: Schema.optional(Schema.Number),
     errorMessage: Schema.optional(Schema.String),
     startedAt: Schema.optional(Schema.String),

package/dist/core-api/sessions.d.ts

@@ -32,14 +32,20 @@ export declare const sessionModeSchema: Schema.Literals<readonly ["pty", "pipe"]
 export type SessionMode = typeof sessionModeSchema.Type;
 /**
  * The Linux user a process runs as (Mend ADR 0016): a user name of the image's passwd, or a numeric
- * uid. The process takes its uid, gid, supplementary groups and `HOME`, `USER`, `LOGNAME` and
- * `SHELL` from the passwd entry, umask 0002. Absent: the workspace's own user, as before.
+ * uid. The workspace's sealantd starts the process as that passwd entry: its uid, gid,
+ * supplementary groups and `HOME`, `USER`, `LOGNAME` and `SHELL`, umask 0002, a private `TMPDIR`
+ * and `XDG_RUNTIME_DIR`, the image's `/etc/sealant/person-env`, and none of the daemon's logins.
+ * Only a person Mend made: a uid in 40001–49999 whose primary group is `mend` (40000), never root,
+ * on a workspace whose sealantd reports `exec.user`. Anything else is refused before anything
+ * starts (`409`, `user-unsupported`). Absent: the workspace's own user, as before.
  */
 export declare const workspaceProcessUserSchema: Schema.String;
 export type WorkspaceProcessUser = typeof workspaceProcessUserSchema.Type;
 /**
- * The stable `code` a create or exec answers while no workspace runtime can start a process as
- * another user: Core asks sealantd to, and no released sealantd does yet. Nothing is started.
+ * The stable `code` a session or exec as a user is refused with (`409`), the message saying why:
+ * the workspace's sealantd does not run processes as another user (no `exec.user`), its runtime
+ * does not (Cloudflare), the user is not in range (root, a uid outside 40001–49999, or a primary
+ * group other than `mend`), or no such user exists yet. Nothing is started.
  */
 export declare const PROCESS_USER_UNSUPPORTED_CODE = "user-unsupported";
 export declare const createSessionRequestSchema: Schema.Struct<{
@@ -58,10 +64,38 @@ export declare const createSessionRequestSchema: Schema.Struct<{
     readonly mode: Schema.optional<Schema.Literals<readonly ["pty", "pipe"]>>;
     /** Opaque caller correlation bag: stored verbatim, echoed on reads, no platform semantics. */
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    /** Run the session's process as this Linux user (see `workspaceProcessUserSchema`). */
+    /**
+     * Refused here (`409`, `user-unsupported`), never ignored: a session as a Linux user is opened
+     * with `POST /v1/sessions/as-user` (`createSessionAsUserRequestSchema`), a route a control plane
+     * that cannot run one answers `404`, so a mixed-version fleet never runs it as root.
+     */
     readonly user: Schema.optional<Schema.String>;
 }>;
 export type CreateSessionRequest = typeof createSessionRequestSchema.Type;
+/**
+ * `POST /v1/sessions/as-user`: a session whose leader runs as `user` (see
+ * `workspaceProcessUserSchema`), otherwise as `POST /v1/sessions`. Its own route, so a control
+ * plane from before it answers `404` instead of opening the session as the workspace's own user.
+ */
+export declare const createSessionAsUserRequestSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    /** argv[0] is the program the session runs; the rest its arguments. */
+    readonly argv: Schema.$Array<Schema.String>;
+    /** Working directory inside the workspace (defaults to the workspace working directory). */
+    readonly cwd: Schema.optional<Schema.String>;
+    /** Extra environment for the PTY process (values are NOT secrets — use credentials for those). */
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cols: Schema.optional<Schema.Int>;
+    readonly rows: Schema.optional<Schema.Int>;
+    readonly term: Schema.optional<Schema.String>;
+    /** Leader wiring; defaults to `pty`. `cols`/`rows`/`term` are ignored for `pipe`. */
+    readonly mode: Schema.optional<Schema.Literals<readonly ["pty", "pipe"]>>;
+    /** Opaque caller correlation bag: stored verbatim, echoed on reads, no platform semantics. */
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly user: Schema.String;
+}>;
+export type CreateSessionAsUserRequest = typeof createSessionAsUserRequestSchema.Type;
 export declare const sessionSchema: Schema.Struct<{
     readonly sessionId: Schema.String;
     readonly workspaceId: Schema.String;
@@ -285,7 +319,11 @@ export declare const SessionsGroup: HttpApiGroup.HttpApiGroup<"sessions", HttpAp
     readonly mode: Schema.optional<Schema.Literals<readonly ["pty", "pipe"]>>;
     /** Opaque caller correlation bag: stored verbatim, echoed on reads, no platform semantics. */
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    /** Run the session's process as this Linux user (see `workspaceProcessUserSchema`). */
+    /**
+     * Refused here (`409`, `user-unsupported`), never ignored: a session as a Linux user is opened
+     * with `POST /v1/sessions/as-user` (`createSessionAsUserRequestSchema`), a route a control plane
+     * that cannot run one answers `404`, so a mixed-version fleet never runs it as root.
+     */
     readonly user: Schema.optional<Schema.String>;
 }>>, HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly authorization: Schema.optional<Schema.String>;
@@ -322,6 +360,58 @@ export declare const SessionsGroup: HttpApiGroup.HttpApiGroup<"sessions", HttpAp
     readonly outputHighWater: Schema.String;
     readonly createdAt: Schema.String;
     readonly endedAt: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<typeof SessionBadRequestError | typeof SessionUnauthorizedError | typeof SessionForbiddenError | typeof SessionNotFoundError | typeof SessionConflictError | typeof SessionBadGatewayError | typeof SessionInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"createSessionAsUser", "POST", "/as-user", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    /** argv[0] is the program the session runs; the rest its arguments. */
+    readonly argv: Schema.$Array<Schema.String>;
+    /** Working directory inside the workspace (defaults to the workspace working directory). */
+    readonly cwd: Schema.optional<Schema.String>;
+    /** Extra environment for the PTY process (values are NOT secrets — use credentials for those). */
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cols: Schema.optional<Schema.Int>;
+    readonly rows: Schema.optional<Schema.Int>;
+    readonly term: Schema.optional<Schema.String>;
+    /** Leader wiring; defaults to `pty`. `cols`/`rows`/`term` are ignored for `pipe`. */
+    readonly mode: Schema.optional<Schema.Literals<readonly ["pty", "pipe"]>>;
+    /** Opaque caller correlation bag: stored verbatim, echoed on reads, no platform semantics. */
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly user: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly authorization: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly sessionId: Schema.String;
+    readonly workspaceId: Schema.String;
+    /** The interactive run recording this session; its record is the durable evidence. */
+    readonly runId: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly status: Schema.Literals<readonly ["starting", "running", "exited", "failed"]>;
+    /**
+     * Only `argv[0]`, the program: Sealant never stores a session's arguments, because they can carry
+     * secrets. `argCount` and `argLengths` (UTF-8 bytes each) describe them.
+     */
+    readonly argv: Schema.$Array<Schema.String>;
+    /** How many arguments followed the program. Absent when there were none. */
+    readonly argCount: Schema.optional<Schema.Number>;
+    /** Each argument's length in UTF-8 bytes, in order. Absent when there were none. */
+    readonly argLengths: Schema.optional<Schema.$Array<Schema.Number>>;
+    readonly cwd: Schema.optional<Schema.String>;
+    readonly cols: Schema.Number;
+    readonly rows: Schema.Number;
+    /** Leader wiring. Absent on servers from before pipe mode shipped, which means `pty`. */
+    readonly mode: Schema.optional<Schema.Literals<readonly ["pty", "pipe"]>>;
+    readonly exitCode: Schema.optional<Schema.Number>;
+    readonly exitSignal: Schema.optional<Schema.Number>;
+    readonly errorMessage: Schema.optional<Schema.String>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    /**
+     * Highest ingested output sequence for this session's run (decimal string), or "0" when nothing
+     * has been ingested yet — the resume cursor: `output?from=<highWater + 1>` continues exactly
+     * where a previous reader stopped.
+     */
+    readonly outputHighWater: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly endedAt: Schema.optional<Schema.String>;
 }>>, HttpApiEndpoint.Json<typeof SessionBadRequestError | typeof SessionUnauthorizedError | typeof SessionForbiddenError | typeof SessionNotFoundError | typeof SessionConflictError | typeof SessionBadGatewayError | typeof SessionInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getSession", "GET", "/:sessionId", HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly sessionId: Schema.String;
 }>>, HttpApiEndpoint.StringTree<Schema.Struct<{

package/dist/core-api/sessions.js

@@ -30,13 +30,19 @@ export const sessionAuthorizationHeadersSchema = Schema.Struct({
 export const sessionModeSchema = Schema.Literals(["pty", "pipe"]);
 /**
  * The Linux user a process runs as (Mend ADR 0016): a user name of the image's passwd, or a numeric
- * uid. The process takes its uid, gid, supplementary groups and `HOME`, `USER`, `LOGNAME` and
- * `SHELL` from the passwd entry, umask 0002. Absent: the workspace's own user, as before.
+ * uid. The workspace's sealantd starts the process as that passwd entry: its uid, gid,
+ * supplementary groups and `HOME`, `USER`, `LOGNAME` and `SHELL`, umask 0002, a private `TMPDIR`
+ * and `XDG_RUNTIME_DIR`, the image's `/etc/sealant/person-env`, and none of the daemon's logins.
+ * Only a person Mend made: a uid in 40001–49999 whose primary group is `mend` (40000), never root,
+ * on a workspace whose sealantd reports `exec.user`. Anything else is refused before anything
+ * starts (`409`, `user-unsupported`). Absent: the workspace's own user, as before.
  */
 export const workspaceProcessUserSchema = Schema.String.check(Schema.isPattern(/^(?:[a-z_][a-z0-9_-]{0,31}|[0-9]{1,10})$/));
 /**
- * The stable `code` a create or exec answers while no workspace runtime can start a process as
- * another user: Core asks sealantd to, and no released sealantd does yet. Nothing is started.
+ * The stable `code` a session or exec as a user is refused with (`409`), the message saying why:
+ * the workspace's sealantd does not run processes as another user (no `exec.user`), its runtime
+ * does not (Cloudflare), the user is not in range (root, a uid outside 40001–49999, or a primary
+ * group other than `mend`), or no such user exists yet. Nothing is started.
  */
 export const PROCESS_USER_UNSUPPORTED_CODE = "user-unsupported";
 export const createSessionRequestSchema = Schema.Struct({
@@ -55,9 +61,22 @@ export const createSessionRequestSchema = Schema.Struct({
     mode: Schema.optional(sessionModeSchema),
     /** Opaque caller correlation bag: stored verbatim, echoed on reads, no platform semantics. */
     metadata: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
-    /** Run the session's process as this Linux user (see `workspaceProcessUserSchema`). */
+    /**
+     * Refused here (`409`, `user-unsupported`), never ignored: a session as a Linux user is opened
+     * with `POST /v1/sessions/as-user` (`createSessionAsUserRequestSchema`), a route a control plane
+     * that cannot run one answers `404`, so a mixed-version fleet never runs it as root.
+     */
     user: Schema.optional(workspaceProcessUserSchema),
 });
+/**
+ * `POST /v1/sessions/as-user`: a session whose leader runs as `user` (see
+ * `workspaceProcessUserSchema`), otherwise as `POST /v1/sessions`. Its own route, so a control
+ * plane from before it answers `404` instead of opening the session as the workspace's own user.
+ */
+export const createSessionAsUserRequestSchema = Schema.Struct({
+    ...createSessionRequestSchema.fields,
+    user: workspaceProcessUserSchema,
+});
 export const sessionSchema = Schema.Struct({
     sessionId: NonEmptyString,
     workspaceId: NonEmptyString,
@@ -177,6 +196,23 @@ HttpApiEndpoint.post("createSession", "/", {
         SessionBadGatewayError,
         SessionInternalServerError,
     ],
+}))
+    .add(
+// Scope: workspace:exec. `createSession` with the leader run as a Linux user (`409`
+// `user-unsupported` where the executor cannot; `502` when it does not answer the check).
+HttpApiEndpoint.post("createSessionAsUser", "/as-user", {
+    headers: sessionAuthorizationHeadersSchema,
+    payload: createSessionAsUserRequestSchema,
+    success: sessionSchema.pipe(HttpApiSchema.status(201)),
+    error: [
+        SessionBadRequestError,
+        SessionUnauthorizedError,
+        SessionForbiddenError,
+        SessionNotFoundError,
+        SessionConflictError,
+        SessionBadGatewayError,
+        SessionInternalServerError,
+    ],
 }))
     .add(HttpApiEndpoint.get("listSessions", "/", {
     headers: sessionAuthorizationHeadersSchema,

package/dist/core-api/system.d.ts

@@ -7,11 +7,32 @@ export declare const systemIndexResponseSchema: Schema.Struct<{
     readonly openApiPath: Schema.String;
     /**
      * What this control plane can do that an older one cannot, so a client refuses a request it would
-     * otherwise send to a server that ignores part of it. Absent from older control planes: nothing.
+     * otherwise send to a server that ignores part of it, and feature-detects instead of reading a
+     * version (a self-built control plane reports `0.0.0`). Absent from older control planes:
+     * nothing; an absent field: not this one.
      */
     readonly features: Schema.optional<Schema.Struct<{
-        /** A process can run as a given Linux user (`user` on exec and sessions). */
+        /**
+         * Always `false` from this control plane: `user` on the plain exec and session routes is
+         * refused. Kept, and kept false, because SDKs from before the as-user routes read `true` as
+         * leave to send `user` on the plain routes, which a control plane from before `user` would
+         * accept and run as the workspace's own user.
+         */
         readonly processUser: Schema.Boolean;
+        /**
+         * `POST /v1/workspaces/:id/exec-as-user` and `POST /v1/sessions/as-user` exist: a process
+         * runs as a person's Linux user there. Whether a given workspace can is its read's
+         * `processUser`; one that cannot is refused there (`409`, `user-unsupported`).
+         */
+        readonly processUserRoutes: Schema.optional<Schema.Boolean>;
+        /** `POST /v1/workspaces/:id/dotfiles`: a person's dotfiles applied as their user. */
+        readonly dotfilesApply: Schema.optional<Schema.Boolean>;
+        /** `partial: true` on a credentials put: what is connected is written, the rest reported. */
+        readonly credentialsPartialPut: Schema.optional<Schema.Boolean>;
+        /** `pi` and `opencode` (ChatGPT logins from a Codex account) on a credentials put. */
+        readonly credentialsPiOpencode: Schema.optional<Schema.Boolean>;
+        /** `ownerMap` on a capture source: an executor whose restore gives each person their files. */
+        readonly captureOwnerMap: Schema.optional<Schema.Boolean>;
     }>>;
 }>;
 export type SystemIndexResponse = typeof systemIndexResponseSchema.Type;
@@ -46,11 +67,32 @@ export declare const SystemGroup: HttpApiGroup.HttpApiGroup<"system", HttpApiEnd
     readonly openApiPath: Schema.String;
     /**
      * What this control plane can do that an older one cannot, so a client refuses a request it would
-     * otherwise send to a server that ignores part of it. Absent from older control planes: nothing.
+     * otherwise send to a server that ignores part of it, and feature-detects instead of reading a
+     * version (a self-built control plane reports `0.0.0`). Absent from older control planes:
+     * nothing; an absent field: not this one.
      */
     readonly features: Schema.optional<Schema.Struct<{
-        /** A process can run as a given Linux user (`user` on exec and sessions). */
+        /**
+         * Always `false` from this control plane: `user` on the plain exec and session routes is
+         * refused. Kept, and kept false, because SDKs from before the as-user routes read `true` as
+         * leave to send `user` on the plain routes, which a control plane from before `user` would
+         * accept and run as the workspace's own user.
+         */
         readonly processUser: Schema.Boolean;
+        /**
+         * `POST /v1/workspaces/:id/exec-as-user` and `POST /v1/sessions/as-user` exist: a process
+         * runs as a person's Linux user there. Whether a given workspace can is its read's
+         * `processUser`; one that cannot is refused there (`409`, `user-unsupported`).
+         */
+        readonly processUserRoutes: Schema.optional<Schema.Boolean>;
+        /** `POST /v1/workspaces/:id/dotfiles`: a person's dotfiles applied as their user. */
+        readonly dotfilesApply: Schema.optional<Schema.Boolean>;
+        /** `partial: true` on a credentials put: what is connected is written, the rest reported. */
+        readonly credentialsPartialPut: Schema.optional<Schema.Boolean>;
+        /** `pi` and `opencode` (ChatGPT logins from a Codex account) on a credentials put. */
+        readonly credentialsPiOpencode: Schema.optional<Schema.Boolean>;
+        /** `ownerMap` on a capture source: an executor whose restore gives each person their files. */
+        readonly captureOwnerMap: Schema.optional<Schema.Boolean>;
     }>>;
 }>>, HttpApiEndpoint.Json<never>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getSetupState", "GET", "/v1/system/setup-state", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly needsSetup: Schema.Boolean;

package/dist/core-api/system.js

@@ -8,11 +8,32 @@ export const systemIndexResponseSchema = Schema.Struct({
     openApiPath: NonEmptyString,
     /**
      * What this control plane can do that an older one cannot, so a client refuses a request it would
-     * otherwise send to a server that ignores part of it. Absent from older control planes: nothing.
+     * otherwise send to a server that ignores part of it, and feature-detects instead of reading a
+     * version (a self-built control plane reports `0.0.0`). Absent from older control planes:
+     * nothing; an absent field: not this one.
      */
     features: Schema.optional(Schema.Struct({
-        /** A process can run as a given Linux user (`user` on exec and sessions). */
+        /**
+         * Always `false` from this control plane: `user` on the plain exec and session routes is
+         * refused. Kept, and kept false, because SDKs from before the as-user routes read `true` as
+         * leave to send `user` on the plain routes, which a control plane from before `user` would
+         * accept and run as the workspace's own user.
+         */
         processUser: Schema.Boolean,
+        /**
+         * `POST /v1/workspaces/:id/exec-as-user` and `POST /v1/sessions/as-user` exist: a process
+         * runs as a person's Linux user there. Whether a given workspace can is its read's
+         * `processUser`; one that cannot is refused there (`409`, `user-unsupported`).
+         */
+        processUserRoutes: Schema.optional(Schema.Boolean),
+        /** `POST /v1/workspaces/:id/dotfiles`: a person's dotfiles applied as their user. */
+        dotfilesApply: Schema.optional(Schema.Boolean),
+        /** `partial: true` on a credentials put: what is connected is written, the rest reported. */
+        credentialsPartialPut: Schema.optional(Schema.Boolean),
+        /** `pi` and `opencode` (ChatGPT logins from a Codex account) on a credentials put. */
+        credentialsPiOpencode: Schema.optional(Schema.Boolean),
+        /** `ownerMap` on a capture source: an executor whose restore gives each person their files. */
+        captureOwnerMap: Schema.optional(Schema.Boolean),
     })),
 });
 export const systemHealthResponseSchema = Schema.Struct({

package/dist/core-api/workspaces.d.ts

@@ -70,6 +70,15 @@ export declare const workspaceImagePersonLayoutSchema: Schema.Struct<{
     readonly acl: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
 }>;
 export type WorkspaceImagePersonLayout = typeof workspaceImagePersonLayoutSchema.Type;
+/**
+ * Whether a workspace's processes can be started as a person's Linux user (`user` on exec and
+ * sessions): `supported` when the sealantd of the image its latest launch booted reports
+ * `exec.user` (the image build's probe), `unsupported` when it does not or the runtime never runs a
+ * process as a user (Cloudflare), `unknown` when nothing says (an image built before the probe).
+ * The exec or session itself asks the running daemon, whose answer decides.
+ */
+export declare const workspaceProcessUserCapabilitySchema: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
+export type WorkspaceProcessUserCapability = typeof workspaceProcessUserCapabilitySchema.Type;
 export declare const workspacePublishedImageSchema: Schema.Struct<{
     readonly reference: Schema.String;
     readonly digestReference: Schema.String;
@@ -182,10 +191,32 @@ export declare const execWorkspaceRequestSchema: Schema.Struct<{
         readonly args: Schema.$Array<Schema.String>;
         readonly cwd: Schema.optional<Schema.String>;
     }>>;
-    /** Run every command as this Linux user (see `workspaceProcessUserSchema`). */
+    /**
+     * Refused here (`409`, `user-unsupported`), never ignored: an exec as a Linux user is asked for
+     * with `POST /v1/workspaces/:id/exec-as-user` (`execWorkspaceAsUserRequestSchema`), a route a
+     * control plane that cannot run one answers `404`, so a mixed-version fleet never runs it as root.
+     */
     readonly user: Schema.optional<Schema.String>;
 }>;
 export type ExecWorkspaceRequest = typeof execWorkspaceRequestSchema.Type;
+/**
+ * `POST /v1/workspaces/:id/exec-as-user`: an exec whose every command runs as `user` (see
+ * `workspaceProcessUserSchema`), checked against the running executor before the run is made and
+ * recorded on the run (`user`); otherwise as `POST /v1/workspaces/:id/exec`. Its own route, so a
+ * control plane from before it answers `404` instead of running the commands as the workspace's
+ * own user.
+ */
+export declare const execWorkspaceAsUserRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /** Commands execute sequentially in the workspace, each recorded like any other process. */
+    readonly commands: Schema.$Array<Schema.Struct<{
+        readonly executable: Schema.String;
+        readonly args: Schema.$Array<Schema.String>;
+        readonly cwd: Schema.optional<Schema.String>;
+    }>>;
+    readonly user: Schema.String;
+}>;
+export type ExecWorkspaceAsUserRequest = typeof execWorkspaceAsUserRequestSchema.Type;
 /** The `harnessId` stamped on runs that apply a person's dotfiles (`applyWorkspaceDotfiles`). */
 export declare const dotfilesRunHarnessId = "dotfiles";
 /** How a dotfiles tree is applied: chezmoi and stow layouts are detected by `auto`. */
@@ -1126,6 +1157,8 @@ export declare const workspaceSummarySchema: Schema.Struct<{
             readonly acl: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
         }>>;
     }>>;
+    /** See `workspaceProcessUserCapabilitySchema`. Absent from older control planes. */
+    readonly processUser: Schema.optional<Schema.Literals<readonly ["supported", "unsupported", "unknown"]>>;
     readonly error: Schema.optional<Schema.Struct<{
         readonly message: Schema.String;
         readonly code: Schema.optional<Schema.String>;
@@ -1285,6 +1318,8 @@ export declare const workspaceDetailsSchema: Schema.Struct<{
             readonly acl: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
         }>>;
     }>>;
+    /** See `workspaceProcessUserCapabilitySchema`. Absent from older control planes. */
+    readonly processUser: Schema.optional<Schema.Literals<readonly ["supported", "unsupported", "unknown"]>>;
     readonly error: Schema.optional<Schema.Struct<{
         readonly message: Schema.String;
         readonly code: Schema.optional<Schema.String>;
@@ -1445,6 +1480,8 @@ export declare const listWorkspacesResponseSchema: Schema.Struct<{
                 readonly acl: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
             }>>;
         }>>;
+        /** See `workspaceProcessUserCapabilitySchema`. Absent from older control planes. */
+        readonly processUser: Schema.optional<Schema.Literals<readonly ["supported", "unsupported", "unknown"]>>;
         readonly error: Schema.optional<Schema.Struct<{
             readonly message: Schema.String;
             readonly code: Schema.optional<Schema.String>;
@@ -1764,6 +1801,7 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
         readonly argLengths: Schema.optional<Schema.$Array<Schema.Number>>;
     }>>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly user: Schema.optional<Schema.String>;
     readonly exitCode: Schema.optional<Schema.Number>;
     readonly errorMessage: Schema.optional<Schema.String>;
     readonly startedAt: Schema.optional<Schema.String>;
@@ -1887,8 +1925,48 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
         readonly args: Schema.$Array<Schema.String>;
         readonly cwd: Schema.optional<Schema.String>;
     }>>;
-    /** Run every command as this Linux user (see `workspaceProcessUserSchema`). */
+    /**
+     * Refused here (`409`, `user-unsupported`), never ignored: an exec as a Linux user is asked for
+     * with `POST /v1/workspaces/:id/exec-as-user` (`execWorkspaceAsUserRequestSchema`), a route a
+     * control plane that cannot run one answers `404`, so a mixed-version fleet never runs it as root.
+     */
+    readonly user: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly runId: Schema.String;
+    readonly workspaceId: Schema.String;
+    readonly attemptId: Schema.optional<Schema.String>;
+    readonly ownerUserId: Schema.String;
+    readonly harnessId: Schema.String;
+    readonly mode: Schema.Literals<readonly ["one-shot", "interactive"]>;
+    readonly status: Schema.Literals<readonly ["queued", "running", "completed", "failed", "cancelled"]>;
+    readonly prompt: Schema.optional<Schema.String>;
+    readonly command: Schema.optional<Schema.Struct<{
+        readonly executable: Schema.String;
+        readonly args: Schema.$Array<Schema.String>;
+        readonly cwd: Schema.optional<Schema.String>;
+        readonly argCount: Schema.optional<Schema.Number>;
+        readonly argLengths: Schema.optional<Schema.$Array<Schema.Number>>;
+    }>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     readonly user: Schema.optional<Schema.String>;
+    readonly exitCode: Schema.optional<Schema.Number>;
+    readonly errorMessage: Schema.optional<Schema.String>;
+    readonly startedAt: Schema.optional<Schema.String>;
+    readonly finishedAt: Schema.optional<Schema.String>;
+    readonly recordDeletedAt: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"execWorkspaceAsUser", "POST", "/:workspaceId/exec-as-user", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /** Commands execute sequentially in the workspace, each recorded like any other process. */
+    readonly commands: Schema.$Array<Schema.Struct<{
+        readonly executable: Schema.String;
+        readonly args: Schema.$Array<Schema.String>;
+        readonly cwd: Schema.optional<Schema.String>;
+    }>>;
+    readonly user: Schema.String;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly runId: Schema.String;
     readonly workspaceId: Schema.String;
@@ -1906,6 +1984,7 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
         readonly argLengths: Schema.optional<Schema.$Array<Schema.Number>>;
     }>>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly user: Schema.optional<Schema.String>;
     readonly exitCode: Schema.optional<Schema.Number>;
     readonly errorMessage: Schema.optional<Schema.String>;
     readonly startedAt: Schema.optional<Schema.String>;
@@ -1913,7 +1992,7 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
     readonly recordDeletedAt: Schema.optional<Schema.String>;
     readonly createdAt: Schema.String;
     readonly updatedAt: Schema.String;
-}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"expireWorkspace", "POST", "/:workspaceId/expire", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"expireWorkspace", "POST", "/:workspaceId/expire", HttpApiEndpoint.StringTree<Schema.Struct<{
     readonly workspaceId: Schema.String;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly ownerUserId: Schema.String;
@@ -2114,6 +2193,8 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
             readonly acl: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
         }>>;
     }>>;
+    /** See `workspaceProcessUserCapabilitySchema`. Absent from older control planes. */
+    readonly processUser: Schema.optional<Schema.Literals<readonly ["supported", "unsupported", "unknown"]>>;
     readonly error: Schema.optional<Schema.Struct<{
         readonly message: Schema.String;
         readonly code: Schema.optional<Schema.String>;
@@ -2585,6 +2666,8 @@ export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", Ht
                 readonly acl: Schema.Literals<readonly ["supported", "unsupported", "unknown"]>;
             }>>;
         }>>;
+        /** See `workspaceProcessUserCapabilitySchema`. Absent from older control planes. */
+        readonly processUser: Schema.optional<Schema.Literals<readonly ["supported", "unsupported", "unknown"]>>;
         readonly error: Schema.optional<Schema.Struct<{
             readonly message: Schema.String;
             readonly code: Schema.optional<Schema.String>;

package/dist/core-api/workspaces.js

@@ -78,6 +78,18 @@ export const workspaceImagePersonLayoutSchema = Schema.Struct({
     /** ACLs on that runtime's `/workspace`, as the operator declared them. */
     acl: Schema.Literals(["supported", "unsupported", "unknown"]),
 });
+/**
+ * Whether a workspace's processes can be started as a person's Linux user (`user` on exec and
+ * sessions): `supported` when the sealantd of the image its latest launch booted reports
+ * `exec.user` (the image build's probe), `unsupported` when it does not or the runtime never runs a
+ * process as a user (Cloudflare), `unknown` when nothing says (an image built before the probe).
+ * The exec or session itself asks the running daemon, whose answer decides.
+ */
+export const workspaceProcessUserCapabilitySchema = Schema.Literals([
+    "supported",
+    "unsupported",
+    "unknown",
+]);
 export const workspacePublishedImageSchema = Schema.Struct({
     reference: NonEmptyString,
     digestReference: NonEmptyString,
@@ -167,9 +179,24 @@ export const execWorkspaceRequestSchema = Schema.Struct({
     ownerUserId: NonEmptyString,
     /** Commands execute sequentially in the workspace, each recorded like any other process. */
     commands: Schema.Array(runCommandSchema).check(Schema.isNonEmpty(), Schema.isMaxLength(32)),
-    /** Run every command as this Linux user (see `workspaceProcessUserSchema`). */
+    /**
+     * Refused here (`409`, `user-unsupported`), never ignored: an exec as a Linux user is asked for
+     * with `POST /v1/workspaces/:id/exec-as-user` (`execWorkspaceAsUserRequestSchema`), a route a
+     * control plane that cannot run one answers `404`, so a mixed-version fleet never runs it as root.
+     */
     user: Schema.optional(workspaceProcessUserSchema),
 });
+/**
+ * `POST /v1/workspaces/:id/exec-as-user`: an exec whose every command runs as `user` (see
+ * `workspaceProcessUserSchema`), checked against the running executor before the run is made and
+ * recorded on the run (`user`); otherwise as `POST /v1/workspaces/:id/exec`. Its own route, so a
+ * control plane from before it answers `404` instead of running the commands as the workspace's
+ * own user.
+ */
+export const execWorkspaceAsUserRequestSchema = Schema.Struct({
+    ...execWorkspaceRequestSchema.fields,
+    user: workspaceProcessUserSchema,
+});
 /** The `harnessId` stamped on runs that apply a person's dotfiles (`applyWorkspaceDotfiles`). */
 export const dotfilesRunHarnessId = "dotfiles";
 /** How a dotfiles tree is applied: chezmoi and stow layouts are detected by `auto`. */
@@ -852,6 +879,8 @@ export const workspaceSummarySchema = Schema.Struct({
     tag: Schema.optional(NonEmptyString),
     runtime: Schema.optional(workspaceRuntimeSchema),
     publishedImage: Schema.optional(workspacePublishedImageSchema),
+    /** See `workspaceProcessUserCapabilitySchema`. Absent from older control planes. */
+    processUser: Schema.optional(workspaceProcessUserCapabilitySchema),
     error: Schema.optional(workspaceErrorSchema),
     /** Where the launch is while the workspace is not ready (see `workspacePhaseSchema`). */
     phase: Schema.optional(workspacePhaseSchema),
@@ -948,6 +977,8 @@ export const workspaceDetailsSchema = Schema.Struct({
     tag: Schema.optional(NonEmptyString),
     runtime: Schema.optional(workspaceRuntimeSchema),
     publishedImage: Schema.optional(workspacePublishedImageSchema),
+    /** See `workspaceProcessUserCapabilitySchema`. Absent from older control planes. */
+    processUser: Schema.optional(workspaceProcessUserCapabilitySchema),
     error: Schema.optional(workspaceErrorSchema),
     /** Where the launch is while the workspace is not ready (see `workspacePhaseSchema`). */
     phase: Schema.optional(workspacePhaseSchema),
@@ -1214,8 +1245,28 @@ HttpApiEndpoint.post("execWorkspace", "/:workspaceId/exec", {
     error: [
         WorkspaceBadRequestError,
         WorkspaceNotFoundError,
-        // The workspace has never launched a runtime — nothing to exec in yet.
+        // The workspace has never launched a runtime — nothing to exec in yet; or a `user`, which
+        // this route refuses (`user-unsupported`): see `execWorkspaceAsUser`.
         WorkspaceConflictError,
+        // Shared with `execWorkspaceAsUser`'s handler; this route never reaches the executor first.
+        WorkspaceBadGatewayError,
+        WorkspaceInternalServerError,
+    ],
+}))
+    .add(
+// `execWorkspace` with every command run as a Linux user: 202 + the queued run.
+HttpApiEndpoint.post("execWorkspaceAsUser", "/:workspaceId/exec-as-user", {
+    params: workspaceIdParams,
+    payload: execWorkspaceAsUserRequestSchema,
+    success: runSchema.pipe(HttpApiSchema.status(202)),
+    error: [
+        WorkspaceBadRequestError,
+        WorkspaceNotFoundError,
+        // The executor cannot run a process as the user (`user-unsupported`, the message saying
+        // why), or none is running (`workspace-not-running`).
+        WorkspaceConflictError,
+        // The executor did not answer whether the user may run a process.
+        WorkspaceBadGatewayError,
         WorkspaceInternalServerError,
     ],
 }))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/api-contracts-next",
-  "version": "0.39.0-next.704",
+  "version": "0.39.0-next.705",
   "description": "Contract-first HTTP API definitions for Sealant services",
   "license": "Apache-2.0",
   "repository": {
@@ -32,7 +32,7 @@
   "peerDependencies": {
     "effect": ">=4.0.0-beta.85 <5"
   },
-  "gitHead": "4cfff680be5ef20c0413f37ba7835ffdd540104f",
+  "gitHead": "720a38bb179299ccfd50154afbe2818fa92df9f9",
   "publishConfig": {
     "access": "public"
   }