@sealant/sdk 0.12.2 → 0.13.0

package/README.md

@@ -103,6 +103,26 @@ field wins over the profile's binding for that provider. Only account references
 surface — secret material never does; the control plane resolves references to encrypted credentials
 and injects them at launch.
 
+## Workspace tools and services
+
+Choose a supported operating-system family, request portable package names, and opt into services
+that need runtime support rather than a package install:
+
+```ts
+const workspace = await sealant.workspaces.create({
+  repository: "github.com/acme/billing-service",
+  harness: codex(),
+  os: "arch",
+  packages: ["pnpm", "python", "uv", "mise", "github-cli", "lazygit", "bat"],
+  services: { docker: true },
+  credentials: { codex: true, github: true },
+});
+```
+
+`services.docker` installs the Docker client in the image and starts a disposable, workspace-scoped
+rootless daemon at launch. The workspace receives `DOCKER_HOST`; Sealant never mounts the host
+Docker socket. GitHub credentials provide both `GH_TOKEN` and `GITHUB_TOKEN` to the workspace.
+
 ## Inference on connected accounts
 
 Run short, tool-calling inference loops on the caller's own subscription — server-side, through the

package/dist/internal/blueprint.js

@@ -61,6 +61,14 @@ export const buildCreateWorkspaceRequest = (options, config) => {
             ? []
             : [linkedWorktreeMount]),
     ];
+    const toolingPackages = options.packages?.map((id) => ({ id })) ?? [];
+    const dockerService = options.services?.docker === true;
+    const tooling = toolingPackages.length === 0 && !dockerService
+        ? undefined
+        : {
+            ...(toolingPackages.length === 0 ? {} : { packages: toolingPackages }),
+            ...(dockerService ? { services: { docker: { enabled: true } } } : {}),
+        };
     const spec = {
         version: "1",
         sources: {
@@ -93,9 +101,7 @@ export const buildCreateWorkspaceRequest = (options, config) => {
         lifecycle: {
             startup: { foreground: { kind: "command", run: "sleep infinity", shell: "bash" } },
         },
-        ...(options.packages === undefined || options.packages.length === 0
-            ? {}
-            : { tooling: { packages: options.packages.map((id) => ({ id })) } }),
+        ...(tooling === undefined ? {} : { tooling }),
         ...(credentials === undefined ? {} : { credentials }),
     };
     return {

package/dist/types.d.ts

@@ -122,6 +122,14 @@ export interface WorkspaceExtraMount {
     /** Defaults to `true`. Pass `false` deliberately — writes to extra mounts are unrecorded. */
     readonly readOnly?: boolean;
 }
+/** Runtime-managed services attached only to this workspace. */
+export interface WorkspaceServicesOptions {
+    /**
+     * Give the workspace a Docker client connected to its own disposable daemon. The platform never
+     * mounts the host Docker socket.
+     */
+    readonly docker?: boolean;
+}
 export interface CreateOptions {
     /**
      * Source git repository to build the workspace around (e.g. `"github.com/acme/billing-service"`).
@@ -142,6 +150,8 @@ export interface CreateOptions {
     readonly os?: WorkspaceOs;
     /** Extra OS packages to install in the workspace. */
     readonly packages?: readonly string[];
+    /** Runtime-managed services that need more than installing an OS package. */
+    readonly services?: WorkspaceServicesOptions;
     /** When true (default), resolve only once the workspace runtime is live. */
     readonly wait?: boolean;
     /** Observe provisioning events as they happen. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/sdk",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "The fluent public SDK for Sealant — create a workspace, run a harness, replay the record.",
   "license": "Apache-2.0",
   "repository": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "effect": "4.0.0-beta.85",
-    "@sealant/api-contracts": "^0.12.2"
+    "@sealant/api-contracts": "^0.13.0"
   },
   "devDependencies": {
     "@effect/vitest": "4.0.0-beta.85",