@themoltnet/sandbox-gondolin 0.5.2 → 0.6.0

package/dist/index.js

@@ -249,7 +249,7 @@ var GONDOLIN_BASE_EXECUTABLES = Object.freeze([
 /** gh CLI version installed in every snapshot. */
 var GH_VERSION = "2.74.0";
 /** MoltNet CLI version — downloaded as a binary, no Node needed. */
-var MOLTNET_CLI_VERSION = "3.5.0";
+var MOLTNET_CLI_VERSION = "3.11.0";
 /**
 * Resolve guest architecture from host (Gondolin VMs match host arch).
 *
@@ -727,6 +727,7 @@ function isReservedGuestEnvironmentName(name) {
 	return name.startsWith("MOLTNET_") || name.startsWith("GIT_CONFIG_") || RESERVED_GUEST_ENVIRONMENT_NAMES.has(name);
 }
 var GuestEnvironmentBoundaryError = class extends Error {
+	refusedNames;
 	constructor(refusedNames) {
 		super(`Guest credential boundary refuses runtime-controlled environment variables: ${refusedNames.join(", ")}. Remove them from the runtime profile; MoltNet operations use the trusted host-side Agent.`);
 		this.refusedNames = refusedNames;
@@ -734,6 +735,7 @@ var GuestEnvironmentBoundaryError = class extends Error {
 	}
 };
 var BrokeredHttpSecretBoundaryError = class extends Error {
+	issues;
 	constructor(issues) {
 		super("Brokered HTTP secret boundary refused the resolved bindings: " + issues.join("; "));
 		this.issues = issues;
@@ -1264,29 +1266,37 @@ async function resumeVm(config) {
 				"moltnet-service",
 				...service.command
 			], {
-				stdout: "ignore",
+				stdout: "pipe",
 				stderr: "pipe",
 				...service.env && { env: service.env },
 				signal: servicesAbort.signal
 			});
 			let stderr = "";
+			const completion = Promise.resolve(handle).then((result) => ({
+				kind: "completed",
+				result
+			}), (error) => ({
+				kind: "failed",
+				error
+			}));
 			const exited = (async () => {
 				try {
 					if ("output" in handle && typeof handle.output === "function") {
 						for await (const chunk of handle.output()) if (chunk.stream === "stderr") stderr = stderrTail(stderr, chunk.data);
 					}
-					const result = await handle;
-					stderr = stderrTail(stderr, String(result.stderr ?? ""));
-					return {
-						exitCode: result.exitCode,
-						stderr
-					};
 				} catch (error) {
-					return {
-						exitCode: void 0,
-						stderr: stderrTail(stderr, String(error))
-					};
+					stderr = stderrTail(stderr, String(error));
 				}
+				const outcome = await completion;
+				if (outcome.kind === "failed") return {
+					exitCode: void 0,
+					stderr: stderrTail(stderr, String(outcome.error))
+				};
+				stderr = stderrTail(stderr, String(outcome.result.stderr ?? ""));
+				return {
+					exitCode: outcome.result.exitCode,
+					stderr
+				};
 			})();
 			serviceExits.set(service.id, exited.then((result) => {
 				serviceExitResults.set(service.id, result);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/sandbox-gondolin",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Gondolin microVM sandbox lifecycle for MoltNet runtimes: checkpoint resume, egress policy, VFS shadowing, guest credential boundary, host-brokered secrets",
   "keywords": [
     "moltnet",