@wardby/cli 0.5.2 → 0.6.0

package/dist/providers/jobs/fake-kubernetes-api.d.ts

@@ -1,4 +1,4 @@
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Deployment, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface FakeExecCall {
@@ -10,7 +10,7 @@ export interface FakeExecCall {
     stdout?: Writable;
     timeoutMs: number;
 }
-type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints" | "resourcequota";
+type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints" | "resourcequota" | "deployment";
 type Obj = {
     metadata?: {
         name?: string;
@@ -31,6 +31,17 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     onExec: (call: FakeExecCall) => Promise<number>;
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod: (namespace: string, body: V1Pod) => Promise<V1Pod>;
+    readonly deploymentPatches: Array<{
+        name: string;
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }>;
+    /** Deployment names whose patch throws KubernetesForbiddenError. */
+    forbidden: Set<string>;
+    /** "deployment/<name>" or "endpoints/<name>" keys whose read throws KubernetesForbiddenError. */
+    forbiddenReads: Set<string>;
+    /** "verb/resource/name" keys canI answers false for. */
+    accessDenied: Set<string>;
     logs: Map<string, string>;
     /** What readApiServerVersion reports; tests that care about provenance set it. */
     apiServerVersion: string;
@@ -85,6 +96,8 @@ export declare class FakeKubernetesApi implements KubernetesApi {
      */
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    /** Matches `key=value[,key=value]` selectors against stored pods' labels. */
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -92,6 +105,12 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     readService(namespace: string, name: string): Promise<V1Service | undefined>;
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    canI(_namespace: string, verb: string, _group: string, resource: string, name: string): Promise<boolean>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;

package/dist/providers/jobs/fake-kubernetes-api.js

@@ -1,4 +1,4 @@
-import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesNotFoundError, } from "./kubernetes-api.js";
+import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesForbiddenError, KubernetesNotFoundError, } from "./kubernetes-api.js";
 /** In-memory KubernetesApi for unit tests. Tests drive pod status and exec behavior directly. */
 export class FakeKubernetesApi {
     objects = new Map();
@@ -13,6 +13,13 @@ export class FakeKubernetesApi {
     };
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod = async (_namespace, body) => body;
+    deploymentPatches = [];
+    /** Deployment names whose patch throws KubernetesForbiddenError. */
+    forbidden = new Set();
+    /** "deployment/<name>" or "endpoints/<name>" keys whose read throws KubernetesForbiddenError. */
+    forbiddenReads = new Set();
+    /** "verb/resource/name" keys canI answers false for. */
+    accessDenied = new Set();
     logs = new Map();
     /** What readApiServerVersion reports; tests that care about provenance set it. */
     apiServerVersion = "v1.33.0";
@@ -95,6 +102,14 @@ export class FakeKubernetesApi {
     async readPod(namespace, name) {
         return this.read("pod", namespace, name);
     }
+    /** Matches `key=value[,key=value]` selectors against stored pods' labels. */
+    async listPods(namespace, labelSelector) {
+        const wanted = labelSelector.split(",").map((pair) => pair.split("="));
+        return [...this.objects.entries()]
+            .filter(([key]) => key.startsWith(`pod/${namespace}/`))
+            .map(([, pod]) => structuredClone(pod))
+            .filter((pod) => wanted.every(([k, v]) => pod.metadata?.labels?.[k] === v));
+    }
     async deletePod(namespace, name, gracePeriodSeconds) {
         this.deletedPods.push({ name, gracePeriodSeconds });
         this.delete("pod", namespace, name);
@@ -112,11 +127,37 @@ export class FakeKubernetesApi {
         return this.read("service", namespace, name);
     }
     async readEndpoints(namespace, name) {
+        if (this.forbiddenReads.has(`endpoints/${name}`))
+            throw new KubernetesForbiddenError(this.key("endpoints", namespace, name));
         return this.read("endpoints", namespace, name);
     }
     async readResourceQuota(namespace, name) {
         return this.read("resourcequota", namespace, name);
     }
+    async readDeployment(namespace, name) {
+        if (this.forbiddenReads.has(`deployment/${name}`))
+            throw new KubernetesForbiddenError(this.key("deployment", namespace, name));
+        return this.read("deployment", namespace, name);
+    }
+    async patchDeployment(namespace, name, patch) {
+        if (this.forbidden.has(name))
+            throw new KubernetesForbiddenError(this.key("deployment", namespace, name));
+        const key = this.key("deployment", namespace, name);
+        const current = this.objects.get(key);
+        if (!current)
+            throw new KubernetesNotFoundError(key);
+        const metadata = { ...current.metadata, resourceVersion: String(++this.version) };
+        if (patch.annotations)
+            metadata.annotations = { ...current.metadata?.annotations, ...patch.annotations };
+        const next = { ...current, metadata };
+        if (patch.replicas !== undefined)
+            next.spec = { selector: {}, template: {}, ...current.spec, replicas: patch.replicas };
+        this.objects.set(key, next);
+        this.deploymentPatches.push({ name, replicas: patch.replicas, annotations: patch.annotations });
+    }
+    async canI(_namespace, verb, _group, resource, name) {
+        return !this.accessDenied.has(`${verb}/${resource}/${name}`);
+    }
     async readApiServerVersion() {
         return this.apiServerVersion;
     }

package/dist/providers/jobs/kubernetes-api.d.ts

@@ -3,11 +3,15 @@
  * so every launcher behavior is unit-tested against FakeKubernetesApi and
  * re-proven against a real cluster by kubernetes.integration.test.ts.
  */
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Deployment, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 export declare class KubernetesNotFoundError extends Error {
     constructor(message?: string);
 }
+/** The caller's identity lacks RBAC permission for the request (HTTP 403). */
+export declare class KubernetesForbiddenError extends Error {
+    constructor(message?: string, options?: ErrorOptions);
+}
 /** Stale resourceVersion on replace. */
 export declare class KubernetesConflictError extends Error {
     constructor(message?: string);
@@ -36,6 +40,8 @@ export interface KubernetesApi {
      */
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    /** Lists pods in one namespace matching a label selector (e.g. the native sandbox janitor's). */
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -44,11 +50,21 @@ export interface KubernetesApi {
     /**
      * Reads a Service's Endpoints by name. EndpointSlice is the durable successor to this core/v1
      * resource (migrating to it is a follow-up); Endpoints is read by name so RBAC stays one object wide.
+     * Undefined when missing; throws KubernetesForbiddenError on 403.
      */
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
     /** Reads one ResourceQuota by name (its status carries hard and used), for the launcher's capacity check. */
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readNamespace(name: string): Promise<boolean>;
+    /** Undefined when missing; throws KubernetesForbiddenError on 403. */
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    /** JSON merge patch of metadata.annotations and spec.replicas only. Throws KubernetesForbiddenError on 403. */
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    /** SelfSubjectAccessReview: may the current identity perform `verb` on this one named resource? */
+    canI(namespace: string, verb: string, group: string, resource: string, name: string): Promise<boolean>;
     /** Runs a command in a container; resolves with its exit code. Never uses a shell. */
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;
     /**

package/dist/providers/jobs/kubernetes-api.js

@@ -4,6 +4,13 @@ export class KubernetesNotFoundError extends Error {
         this.name = "KubernetesNotFoundError";
     }
 }
+/** The caller's identity lacks RBAC permission for the request (HTTP 403). */
+export class KubernetesForbiddenError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "KubernetesForbiddenError";
+    }
+}
 /** Stale resourceVersion on replace. */
 export class KubernetesConflictError extends Error {
     constructor(message) {

package/dist/providers/jobs/kubernetes-client.d.ts

@@ -3,7 +3,7 @@
  * method is one client call plus HTTP-status translation into the seam's
  * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
  */
-import { type V1ConfigMap, type V1Endpoints, type V1ResourceQuota, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
+import { type V1ConfigMap, type V1Deployment, type V1Endpoints, type V1ResourceQuota, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface ClientNodeKubernetesApiOptions {
     /** kubeconfig context to use; defaults to the current context (or in-cluster credentials). */
@@ -13,6 +13,8 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     private readonly config;
     private readonly core;
     private readonly networking;
+    private readonly apps;
+    private readonly authz;
     private readonly version;
     constructor(options?: ClientNodeKubernetesApiOptions);
     createConfigMap(namespace: string, body: V1ConfigMap): Promise<V1ConfigMap>;
@@ -23,6 +25,7 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     createPod(namespace: string, body: V1Pod): Promise<V1Pod>;
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -32,6 +35,12 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    canI(namespace: string, verb: string, group: string, resource: string, name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;
     readLogTail(namespace: string, pod: string, container: string, tailLines: number, limitBytes: number): Promise<string>;
 }

package/dist/providers/jobs/kubernetes-client.js

@@ -3,9 +3,9 @@
  * method is one client call plus HTTP-status translation into the seam's
  * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
  */
-import { ApiException, CoreV1Api, Exec, KubeConfig, NetworkingV1Api, VersionApi, } from "@kubernetes/client-node";
+import { ApiException, AppsV1Api, AuthorizationV1Api, CoreV1Api, Exec, KubeConfig, NetworkingV1Api, PatchStrategy, setHeaderOptions, VersionApi, } from "@kubernetes/client-node";
 import { Writable } from "node:stream";
-import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesNotFoundError, } from "./kubernetes-api.js";
+import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesForbiddenError, KubernetesNotFoundError, } from "./kubernetes-api.js";
 function statusCode(error) {
     return error instanceof ApiException ? error.code : undefined;
 }
@@ -20,6 +20,19 @@ async function readOrUndefined(read) {
         throw error;
     }
 }
+/** Undefined for a 404; a 403 becomes KubernetesForbiddenError (cause kept); rethrows anything else. */
+async function readOrForbidden(what, read) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        if (statusCode(error) === 404)
+            return undefined;
+        if (statusCode(error) === 403)
+            throw new KubernetesForbiddenError(`forbidden: get ${what}`, { cause: error });
+        throw error;
+    }
+}
 /** Swallows a 404 so deletes are idempotent. */
 async function deleteIgnoringMissing(remove) {
     try {
@@ -69,6 +82,8 @@ export class ClientNodeKubernetesApi {
     config;
     core;
     networking;
+    apps;
+    authz;
     version;
     constructor(options = {}) {
         this.config = new KubeConfig();
@@ -77,6 +92,8 @@ export class ClientNodeKubernetesApi {
             this.config.setCurrentContext(options.context);
         this.core = this.config.makeApiClient(CoreV1Api);
         this.networking = this.config.makeApiClient(NetworkingV1Api);
+        this.apps = this.config.makeApiClient(AppsV1Api);
+        this.authz = this.config.makeApiClient(AuthorizationV1Api);
         this.version = this.config.makeApiClient(VersionApi);
     }
     createConfigMap(namespace, body) {
@@ -103,6 +120,9 @@ export class ClientNodeKubernetesApi {
     readPod(namespace, name) {
         return readOrUndefined(() => this.core.readNamespacedPod({ namespace, name }));
     }
+    async listPods(namespace, labelSelector) {
+        return (await this.core.listNamespacedPod({ namespace, labelSelector })).items;
+    }
     deletePod(namespace, name, gracePeriodSeconds) {
         return deleteIgnoringMissing(() => this.core.deleteNamespacedPod({ namespace, name, gracePeriodSeconds }));
     }
@@ -119,7 +139,7 @@ export class ClientNodeKubernetesApi {
         return readOrUndefined(() => this.core.readNamespacedService({ namespace, name }));
     }
     readEndpoints(namespace, name) {
-        return readOrUndefined(() => this.core.readNamespacedEndpoints({ namespace, name }));
+        return readOrForbidden(`endpoints/${namespace}/${name}`, () => this.core.readNamespacedEndpoints({ namespace, name }));
     }
     readResourceQuota(namespace, name) {
         return readOrUndefined(() => this.core.readNamespacedResourceQuota({ namespace, name }));
@@ -130,6 +150,35 @@ export class ClientNodeKubernetesApi {
     async readNamespace(name) {
         return (await readOrUndefined(() => this.core.readNamespace({ name }))) !== undefined;
     }
+    readDeployment(namespace, name) {
+        return readOrForbidden(`deployments/${namespace}/${name}`, () => this.apps.readNamespacedDeployment({ namespace, name }));
+    }
+    async patchDeployment(namespace, name, patch) {
+        const body = {
+            ...(patch.annotations ? { metadata: { annotations: patch.annotations } } : {}),
+            ...(patch.replicas !== undefined ? { spec: { replicas: patch.replicas } } : {}),
+        };
+        try {
+            await this.apps.patchNamespacedDeployment({ namespace, name, body }, setHeaderOptions("Content-Type", PatchStrategy.MergePatch));
+        }
+        catch (error) {
+            if (statusCode(error) === 403)
+                throw new KubernetesForbiddenError(`deployments/${namespace}/${name}`, { cause: error });
+            if (statusCode(error) === 404)
+                throw new KubernetesNotFoundError(`deployments/${namespace}/${name}`);
+            throw error;
+        }
+    }
+    async canI(namespace, verb, group, resource, name) {
+        const review = await this.authz.createSelfSubjectAccessReview({
+            body: {
+                apiVersion: "authorization.k8s.io/v1",
+                kind: "SelfSubjectAccessReview",
+                spec: { resourceAttributes: { namespace, verb, group, resource, name } },
+            },
+        });
+        return review.status?.allowed === true;
+    }
     exec(namespace, pod, container, command, options) {
         // stderr is requested but discarded so it never reaches wardby's logs.
         const stderr = new Writable({

package/dist/providers/jobs/kubernetes-dry-run-fixture.d.ts

@@ -14,7 +14,11 @@ export interface DryRunFixture {
     notes: string[];
     mutations: PodMutation[];
 }
-export declare function loadDryRunFixture(): DryRunFixture;
+declare const FIXTURE_URLS: {
+    readonly "gke-autopilot": import("url").URL;
+    readonly eks: import("url").URL;
+};
+export declare function loadDryRunFixture(platform?: keyof typeof FIXTURE_URLS): DryRunFixture;
 /**
  * Returns a copy of `document` with every mutation applied in order.
  *
@@ -47,3 +51,4 @@ export declare function applyMutations<T>(document: T, mutations: readonly PodMu
  * `/spec/Foo` and `/spec/foo` by tie-break rules that differ between hosts).
  */
 export declare function diffMutations(before: unknown, after: unknown, prefix?: string): PodMutation[];
+export {};

package/dist/providers/jobs/kubernetes-dry-run-fixture.js

@@ -33,9 +33,12 @@
  */
 import { readFileSync } from "node:fs";
 import { canonical } from "./kubernetes-isolation.js";
-const FIXTURE_URL = new URL("./fixtures/gke-autopilot-dry-run.json", import.meta.url);
-export function loadDryRunFixture() {
-    return JSON.parse(readFileSync(FIXTURE_URL, "utf8"));
+const FIXTURE_URLS = {
+    "gke-autopilot": new URL("./fixtures/gke-autopilot-dry-run.json", import.meta.url),
+    eks: new URL("./fixtures/eks-dry-run.json", import.meta.url),
+};
+export function loadDryRunFixture(platform = "gke-autopilot") {
+    return JSON.parse(readFileSync(FIXTURE_URLS[platform], "utf8"));
 }
 function segments(path) {
     if (path === "" || !path.startsWith("/"))

package/dist/providers/jobs/kubernetes-isolation.d.ts

@@ -1,4 +1,4 @@
-import type { V1NetworkPolicy, V1Pod, V1Secret } from "@kubernetes/client-node";
+import type { V1Container, V1NetworkPolicy, V1Pod, V1Secret } from "@kubernetes/client-node";
 import { type ResolvedCodingService } from "../../coding/services/catalog.js";
 import type { JobSpec } from "./types.js";
 import { type KubernetesPlatform } from "./kubernetes-platform.js";
@@ -81,6 +81,8 @@ export interface RunPodOptions {
 export declare function buildRunPod(spec: JobSpec, options: RunPodOptions): V1Pod;
 export declare function buildRunNetworkPolicy(spec: JobSpec, namespace: string): V1NetworkPolicy;
 export declare function buildCapabilitySecret(spec: JobSpec, namespace: string, capability: string, toolSetup?: string): V1Secret;
+/** A copy of a container's resources with every quantity in one rendering ("1" and "1000m" alike); see normalizeResources. */
+export declare function canonicalResources(r?: V1Container["resources"]): V1Container["resources"];
 /**
  * A copy of `pod` with ONLY the API server's own defaulting and aliasing undone
  * — the same `normalizeSpec` pass `assertRunPodMatches` runs, and nothing else.
@@ -167,3 +169,16 @@ export declare function assertRunNetworkPolicyMatches(actual: V1NetworkPolicy, e
  * The IP is validated and embedded as a JSON string literal.
  */
 export declare function enforcementProbeScript(proxyIp: string): string;
+/**
+ * A whole enforcement streak in one process: up to `streak` probes, each exactly
+ * `enforcementProbeScript`'s measurement and classification (the body is shared), `intervalMs`
+ * apart. Exits ENFORCEMENT_PROBE_PROVEN only after `streak` consecutive proven probes; at the
+ * first probe that is not proven it exits at once with that probe's own code, so the caller's
+ * verdict is still the last probe's. Running the streak in one exec (rather than one exec per
+ * probe) pays the keeper's exec + interpreter start-up once per streak instead of once per probe;
+ * the evidence required is unchanged.
+ *
+ * The IP is validated and embedded as a JSON string literal; `streak` and `intervalMs` must be
+ * positive safe integers and are embedded as numeric literals.
+ */
+export declare function enforcementStreakScript(proxyIp: string, streak: number, intervalMs: number): string;

package/dist/providers/jobs/kubernetes-isolation.js

@@ -561,6 +561,12 @@ function normalizeResources(r) {
             bag["ephemeral-storage"] = memoryBytes(bag["ephemeral-storage"]);
     }
 }
+/** A copy of a container's resources with every quantity in one rendering ("1" and "1000m" alike); see normalizeResources. */
+export function canonicalResources(r) {
+    const copy = r ? JSON.parse(JSON.stringify(r)) : undefined;
+    normalizeResources(copy);
+    return copy;
+}
 function normalizeProbe(p) {
     if (!p)
         return;
@@ -770,9 +776,24 @@ export function assertRunNetworkPolicyMatches(actual, expected) {
  * The IP is validated and embedded as a JSON string literal.
  */
 export function enforcementProbeScript(proxyIp) {
+    return [...enforcementProbeBody(proxyIp), "(async () => {", "  process.exit(await probe());", "})();"].join("\n");
+}
+/**
+ * The one measurement both enforcement scripts make, as script lines defining `probe()`: connect to
+ * CODING_PROXY_PORT, then to CODING_PROXY_DENY_PORT (both with a 3 s connect timeout, always both,
+ * in that order), and resolve to the exit code classifying that pair. Its first statement presets
+ * `process.exitCode = 1` so that a natural exit is never mistaken for PROVEN. Shared verbatim so the
+ * single probe and the streak can never disagree about what "proven" means.
+ */
+function enforcementProbeBody(proxyIp) {
     if (isIP(proxyIp) === 0)
         throw isolationError();
     return [
+        // Preset a code no probe produces (it reads as "did not run"), so the only way to exit 0 is
+        // the explicit proven exit. Without it, a process that drains its event loop without ever
+        // calling process.exit — a probe promise that never settles, or a rejection under a
+        // non-throwing --unhandled-rejections mode — would exit 0 and read as PROVEN.
+        "process.exitCode = 1;",
         'const net = require("node:net");',
         "const tcp = (port) =>",
         "  new Promise((done) => {",
@@ -781,13 +802,45 @@ export function enforcementProbeScript(proxyIp) {
         '    socket.once("timeout", () => { socket.destroy(); done("timeout"); });',
         '    socket.once("error", () => done("error"));',
         "  });",
-        "(async () => {",
+        "const probe = async () => {",
         `  const allowed = await tcp(${CODING_PROXY_PORT});`,
         `  const denied = await tcp(${CODING_PROXY_DENY_PORT});`,
-        `  if (allowed !== "connect") process.exit(${ENFORCEMENT_PROBE_PROXY_UNREACHABLE});`,
-        `  if (denied === "connect") process.exit(${ENFORCEMENT_PROBE_DENY_REACHABLE});`,
-        `  if (denied === "error") process.exit(${ENFORCEMENT_PROBE_DENY_REFUSED});`,
-        `  process.exit(${ENFORCEMENT_PROBE_PROVEN});`,
+        `  if (allowed !== "connect") return ${ENFORCEMENT_PROBE_PROXY_UNREACHABLE};`,
+        `  if (denied === "connect") return ${ENFORCEMENT_PROBE_DENY_REACHABLE};`,
+        `  if (denied === "error") return ${ENFORCEMENT_PROBE_DENY_REFUSED};`,
+        `  return ${ENFORCEMENT_PROBE_PROVEN};`,
+        "};",
+    ];
+}
+/**
+ * A whole enforcement streak in one process: up to `streak` probes, each exactly
+ * `enforcementProbeScript`'s measurement and classification (the body is shared), `intervalMs`
+ * apart. Exits ENFORCEMENT_PROBE_PROVEN only after `streak` consecutive proven probes; at the
+ * first probe that is not proven it exits at once with that probe's own code, so the caller's
+ * verdict is still the last probe's. Running the streak in one exec (rather than one exec per
+ * probe) pays the keeper's exec + interpreter start-up once per streak instead of once per probe;
+ * the evidence required is unchanged.
+ *
+ * The IP is validated and embedded as a JSON string literal; `streak` and `intervalMs` must be
+ * positive safe integers and are embedded as numeric literals.
+ */
+export function enforcementStreakScript(proxyIp, streak, intervalMs) {
+    const body = enforcementProbeBody(proxyIp);
+    if (!isPositiveSafeInteger(streak) || !isPositiveSafeInteger(intervalMs))
+        throw isolationError();
+    return [
+        ...body,
+        "const pause = (ms) => new Promise((done) => setTimeout(done, ms));",
+        "(async () => {",
+        `  for (let index = 0; index < ${JSON.stringify(streak)}; index += 1) {`,
+        `    if (index > 0) await pause(${JSON.stringify(intervalMs)});`,
+        "    const code = await probe();",
+        `    if (code !== ${ENFORCEMENT_PROBE_PROVEN}) return process.exit(code);`,
+        "  }",
+        `  return process.exit(${ENFORCEMENT_PROBE_PROVEN});`,
         "})();",
     ].join("\n");
 }
+function isPositiveSafeInteger(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}

package/dist/providers/jobs/kubernetes-platform.d.ts

@@ -29,7 +29,7 @@
  * regresses to a documentation-only fixture again.
  */
 import type { V1PodSpec, V1Toleration } from "@kubernetes/client-node";
-export type KubernetesPlatform = "generic" | "gke-autopilot";
+export type KubernetesPlatform = "generic" | "gke-autopilot" | "eks";
 export declare const KUBERNETES_PLATFORMS: readonly KubernetesPlatform[];
 export declare const KUBERNETES_PLATFORM_ERROR = "kubernetes_platform_unconformable";
 /** A request the platform cannot legally run, refused here instead of being silently adjusted by the platform. */
@@ -84,6 +84,9 @@ export interface KubernetesPlatformProfile {
     /** gVisor is mandatory: an unset or different runtime class is refused at startup, not warned about. */
     requiresGvisor: boolean;
 }
+/** Node label and taint key of the EKS sandbox node group; deploy/aws and overlays/eks use the same strings. */
+export declare const EKS_SANDBOX_NODE_LABEL = "wardby.dev/sandbox";
+export declare const EKS_SANDBOX_TAINT_KEY = "sandbox";
 export declare function platformProfile(name: KubernetesPlatform): KubernetesPlatformProfile;
 export interface ContainerResourceRequest {
     cpuMillicores: number;

package/dist/providers/jobs/kubernetes-platform.js

@@ -1,4 +1,8 @@
-export const KUBERNETES_PLATFORMS = Object.freeze(["generic", "gke-autopilot"]);
+export const KUBERNETES_PLATFORMS = Object.freeze([
+    "generic",
+    "gke-autopilot",
+    "eks",
+]);
 export const KUBERNETES_PLATFORM_ERROR = "kubernetes_platform_unconformable";
 /** A request the platform cannot legally run, refused here instead of being silently adjusted by the platform. */
 export class KubernetesPlatformError extends Error {
@@ -109,9 +113,42 @@ const GKE_AUTOPILOT = {
     },
     requiresGvisor: true,
 };
+/** Node label and taint key of the EKS sandbox node group; deploy/aws and overlays/eks use the same strings. */
+export const EKS_SANDBOX_NODE_LABEL = "wardby.dev/sandbox";
+export const EKS_SANDBOX_TAINT_KEY = "sandbox";
+/**
+ * Amazon EKS with a dedicated gVisor node group (deploy/aws). EKS has no managed sandbox runtime, so
+ * the node group's launch template installs runsc and the overlay's `gvisor` RuntimeClass schedules
+ * onto it: the RuntimeClass admission plugin merges its `scheduling` block into the pod, which is
+ * the toleration and nodeSelector below — wardby never sets either itself (see SYMMETRY CAVEAT).
+ *
+ * PROVISIONAL: written from the RuntimeClass spec, not yet a server-side dry-run capture. EKS has no
+ * Autopilot-style resource admission, so resources are the generic rules plus explicit ephemeral
+ * storage (kubelet eviction accounting on a shared sandbox node). Replace the fixture with a real
+ * capture before relying on the allowance list (fixtures/eks-dry-run.json).
+ */
+const EKS = {
+    name: "eks",
+    resources: {
+        cpuFloorMillicores: 0,
+        cpuIncrementMillicores: 1,
+        memoryPerCpuMinMib: 0,
+        memoryPerCpuMaxMib: Number.POSITIVE_INFINITY,
+        explicitEphemeralStorage: true,
+    },
+    metadata: {
+        podAnnotationKeyPrefixes: [],
+        podLabelKeyPrefixes: [],
+        tolerations: [{ key: EKS_SANDBOX_TAINT_KEY, operator: "Equal", value: GVISOR_RUNTIME_CLASS, effect: "NoSchedule" }],
+        nodeSelector: { [EKS_SANDBOX_NODE_LABEL]: GVISOR_RUNTIME_CLASS },
+        dropsPodSeccompProfile: false,
+    },
+    requiresGvisor: true,
+};
 const PROFILES = Object.freeze({
     generic: freezeProfile(GENERIC),
     "gke-autopilot": freezeProfile(GKE_AUTOPILOT),
+    eks: freezeProfile(EKS),
 });
 export function platformProfile(name) {
     const profile = PROFILES[name];

package/dist/providers/jobs/kubernetes-preflight.d.ts

@@ -40,7 +40,8 @@ export interface CanaryResult {
  * probe (`enforcementProbeScript`), which had to make the same distinction after a live cluster
  * with no NetworkPolicy at all passed a boolean version of this check; preflight and gate must
  * agree on what counts as evidence, or one of them is vacuous. `internet`, `metadata` and `proxy`
- * stay plain reachability, where "connected" is the only thing that matters.
+ * stay plain reachability, where "connected" is the only thing that matters; `metadata` is true if
+ * **any** cloud metadata endpoint connects.
  *
  * CNIs program a new pod's policy a few seconds after it starts, so the script first waits (up to
  * 20 s) for the deny-port connect to be *dropped*; if it never is, `proxyDeny` reports true.

package/dist/providers/jobs/kubernetes-preflight.js

@@ -11,6 +11,7 @@ import { randomBytes } from "node:crypto";
 import { CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "./docker-isolation.js";
 import { KUBERNETES_ISOLATION_ERROR, WORKER_CONTAINER, buildRunNetworkPolicy, buildRunPod, isRegistryDigest, } from "./kubernetes-isolation.js";
 import { KubernetesPlatformError, assertPlatformConfig, platformProfile } from "./kubernetes-platform.js";
+import { CLOUD_METADATA_PROBES } from "./metadata-probes.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
 /**
  * The image the preflight canary runs (it only needs node): the Codex worker when configured,
@@ -40,7 +41,8 @@ const CANARY_KEYS = Object.keys(EXPECTED).sort();
  * probe (`enforcementProbeScript`), which had to make the same distinction after a live cluster
  * with no NetworkPolicy at all passed a boolean version of this check; preflight and gate must
  * agree on what counts as evidence, or one of them is vacuous. `internet`, `metadata` and `proxy`
- * stay plain reachability, where "connected" is the only thing that matters.
+ * stay plain reachability, where "connected" is the only thing that matters; `metadata` is true if
+ * **any** cloud metadata endpoint connects.
  *
  * CNIs program a new pod's policy a few seconds after it starts, so the script first waits (up to
  * 20 s) for the deny-port connect to be *dropped*; if it never is, `proxyDeny` reports true.
@@ -81,7 +83,7 @@ export const CANARY_SCRIPT = [
     "    ),",
     `    proxyDeny: !(await dropped(process.env.WARDBY_CANARY_PROXY_IP, ${CODING_PROXY_DENY_PORT})),`,
     '    internet: await reachable("1.1.1.1", 443),',
-    '    metadata: await reachable("169.254.169.254", 80),',
+    `    metadata: (await Promise.all(${JSON.stringify(CLOUD_METADATA_PROBES.map((p) => [p.host, p.port]))}.map(([host, port]) => reachable(host, port)))).some(Boolean),`,
     `    proxy: await reachable(process.env.WARDBY_CANARY_PROXY_IP, ${CODING_PROXY_PORT}),`,
     "  };",
     "  console.log(JSON.stringify({ wardbyCanary }));",