@wardby/cli 0.5.3 → 0.6.0

package/dist/providers/executor/routing.d.ts

@@ -1,25 +1,49 @@
-import type { CodingImageSelector, Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
 import type { CodingProvider } from "../../coding/provider.js";
+import type { CodingImageSelector, Executor, ExecutionRecoveryResult, PersistedExecutionHandle } from "./types.js";
+/**
+ * Which executor owns a run: a coding run, a native run in the control plane
+ * (in-process or DBOS), or a native run in an isolated sandbox worker. Read
+ * from the run's own row (agent kind plus Run.nativeExecutionMode), never from
+ * the agent's current setting, so a setting change reaches only later runs.
+ */
+export type ExecutionTarget = "native" | "native-sandbox" | "coding";
 export interface ExecutionKindResolver {
-    kindForRun(runId: string): Promise<"native" | "coding" | null>;
+    kindForRun(runId: string): Promise<ExecutionTarget | null>;
 }
-/** Keeps native execution unchanged while routing coding runs to isolation. */
+/**
+ * Keeps native execution unchanged while routing coding runs to isolation and
+ * sandbox-mode native runs to the native sandbox executor.
+ *
+ * With no sandbox executor composed in, a sandbox run goes to the native
+ * executor, whose runner refuses to execute it (executeRun fails it before
+ * any spend, closing its host check and status comments): fail closed through
+ * the one path that already finishes a run properly, never a silent run in
+ * the control plane.
+ */
 export declare class RoutingExecutor implements Executor {
     private readonly resolver;
     private readonly native;
     private readonly coding;
-    constructor(resolver: ExecutionKindResolver, native: Executor, coding: Executor);
+    private readonly sandbox?;
+    constructor(resolver: ExecutionKindResolver, native: Executor, coding: Executor, sandbox?: Executor | undefined);
+    private route;
     start(runId: string): Promise<void>;
     stop(runId: string, reason?: string): Promise<void>;
     /**
-     * Recovery is routed by the run's agent kind, exactly like start/stop: a
-     * native run's handle belongs to the native executor (e.g. a DBOS
-     * workflow handle), a coding run's to the container executor. Routing by
-     * handle backend would need this class to know every backend name.
+     * Recovery is routed by the run's target, exactly like start/stop: a native
+     * run's handle belongs to the native executor (e.g. a DBOS workflow handle),
+     * a sandbox run's to the sandbox executor, a coding run's to the container
+     * executor. Routing by handle backend would need this class to know every
+     * backend name.
      */
     recover(handle: PersistedExecutionHandle): Promise<ExecutionRecoveryResult>;
-    /** Lifecycle fans out to both executors; each is optional on the seam. */
+    /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
+    private distinct;
+    /** Lifecycle fans out to every distinct executor; each hook is optional on the seam. */
     launch(): Promise<void>;
+    /** Fans out like `launch`. */
+    warmUp(): Promise<void>;
+    /** Reverse of `launch`. */
     close(): Promise<void>;
     resolveCodingWorkerImage(selector: CodingImageSelector): string;
     resolveCodingToolImage(selector: CodingImageSelector): string | null;
@@ -33,6 +57,7 @@ export declare class RoutingExecutor implements Executor {
         path: string;
         maxBytes: number;
     }): Promise<string | null>;
+    supportsNativeSandbox(): boolean;
     supportsCodingServices(provider: CodingProvider): boolean;
 }
 export declare class PrismaExecutionKindResolver implements ExecutionKindResolver {
@@ -44,6 +69,7 @@ export declare class PrismaExecutionKindResolver implements ExecutionKindResolve
                     id: string;
                 };
                 select: {
+                    nativeExecutionMode: true;
                     agent: {
                         select: {
                             kind: true;
@@ -51,11 +77,12 @@ export declare class PrismaExecutionKindResolver implements ExecutionKindResolve
                     };
                 };
             }): Promise<{
+                nativeExecutionMode: string | null;
                 agent: {
                     kind: string;
                 };
             } | null>;
         };
     });
-    kindForRun(runId: string): Promise<"native" | "coding" | null>;
+    kindForRun(runId: string): Promise<ExecutionTarget | null>;
 }

package/dist/providers/executor/routing.js

@@ -1,53 +1,86 @@
-/** Keeps native execution unchanged while routing coding runs to isolation. */
+/**
+ * Keeps native execution unchanged while routing coding runs to isolation and
+ * sandbox-mode native runs to the native sandbox executor.
+ *
+ * With no sandbox executor composed in, a sandbox run goes to the native
+ * executor, whose runner refuses to execute it (executeRun fails it before
+ * any spend, closing its host check and status comments): fail closed through
+ * the one path that already finishes a run properly, never a silent run in
+ * the control plane.
+ */
 export class RoutingExecutor {
     resolver;
     native;
     coding;
-    constructor(resolver, native, coding) {
+    sandbox;
+    constructor(resolver, native, coding, sandbox) {
         this.resolver = resolver;
         this.native = native;
         this.coding = coding;
+        this.sandbox = sandbox;
+    }
+    async route(runId) {
+        const target = await this.resolver.kindForRun(runId);
+        if (target === "native")
+            return { target, executor: this.native };
+        if (target === "native-sandbox")
+            return { target, executor: this.sandbox ?? this.native };
+        if (target === "coding")
+            return { target, executor: this.coding };
+        return null;
     }
     async start(runId) {
-        const kind = await this.resolver.kindForRun(runId);
-        if (kind === "native")
-            return this.native.start(runId);
-        if (kind === "coding")
-            return this.coding.start(runId);
-        throw new Error("executor_run_not_found");
+        const routed = await this.route(runId);
+        if (!routed)
+            throw new Error("executor_run_not_found");
+        return routed.executor.start(runId);
     }
     async stop(runId, reason) {
-        const kind = await this.resolver.kindForRun(runId);
-        if (kind === "native")
-            return this.native.stop(runId, reason);
-        if (kind === "coding")
-            return this.coding.stop(runId, reason);
+        const routed = await this.route(runId);
+        if (routed)
+            return routed.executor.stop(runId, reason);
     }
     /**
-     * Recovery is routed by the run's agent kind, exactly like start/stop: a
-     * native run's handle belongs to the native executor (e.g. a DBOS
-     * workflow handle), a coding run's to the container executor. Routing by
-     * handle backend would need this class to know every backend name.
+     * Recovery is routed by the run's target, exactly like start/stop: a native
+     * run's handle belongs to the native executor (e.g. a DBOS workflow handle),
+     * a sandbox run's to the sandbox executor, a coding run's to the container
+     * executor. Routing by handle backend would need this class to know every
+     * backend name.
      */
     async recover(handle) {
-        const kind = await this.resolver.kindForRun(handle.runId);
-        if (kind === "native") {
-            if (!this.native.recover)
-                return { state: "lost", reason: "native_recovery_unavailable" };
-            return this.native.recover(handle);
+        const routed = await this.route(handle.runId);
+        const target = routed?.target ?? "coding";
+        const executor = routed?.executor ?? this.coding;
+        if (!executor.recover) {
+            const reason = target === "native"
+                ? "native_recovery_unavailable"
+                : target === "native-sandbox" && this.sandbox
+                    ? "native_sandbox_recovery_unavailable"
+                    : target === "native-sandbox"
+                        ? "native_recovery_unavailable"
+                        : "coding_recovery_unavailable";
+            return { state: "lost", reason };
         }
-        if (!this.coding.recover)
-            return { state: "lost", reason: "coding_recovery_unavailable" };
-        return this.coding.recover(handle);
+        return executor.recover(handle);
+    }
+    /** Each distinct executor once, in a fixed order: native, coding, sandbox. */
+    distinct() {
+        return [this.native, this.coding, this.sandbox].filter((executor, index, all) => executor !== undefined && all.indexOf(executor) === index);
     }
-    /** Lifecycle fans out to both executors; each is optional on the seam. */
+    /** Lifecycle fans out to every distinct executor; each hook is optional on the seam. */
     async launch() {
-        await this.native.launch?.();
-        await this.coding.launch?.();
+        for (const executor of this.distinct())
+            await executor.launch?.();
+    }
+    /** Fans out like `launch`. */
+    async warmUp() {
+        for (const executor of this.distinct())
+            await executor.warmUp?.();
     }
+    /** Reverse of `launch`. */
     async close() {
-        await this.coding.close?.();
-        await this.native.close?.();
+        for (const executor of this.distinct().reverse())
+            await executor.close?.();
     }
     resolveCodingWorkerImage(selector) {
         if (!this.coding.resolveCodingWorkerImage)
@@ -69,6 +102,9 @@ export class RoutingExecutor {
             return null;
         return this.coding.readCodingRepositoryFile(input);
     }
+    supportsNativeSandbox() {
+        return this.sandbox !== undefined;
+    }
     supportsCodingServices(provider) {
         return this.coding.supportsCodingServices?.(provider) === true;
     }
@@ -81,8 +117,13 @@ export class PrismaExecutionKindResolver {
     async kindForRun(runId) {
         const run = await this.db.run.findUnique({
             where: { id: runId },
-            select: { agent: { select: { kind: true } } },
+            select: { nativeExecutionMode: true, agent: { select: { kind: true } } },
         });
-        return run?.agent.kind === "native" || run?.agent.kind === "coding" ? run.agent.kind : null;
+        if (run?.agent.kind === "coding")
+            return "coding";
+        if (run?.agent.kind !== "native")
+            return null;
+        // Null = a run from before the snapshot existed: the control plane, as it always ran.
+        return run.nativeExecutionMode === "sandbox" ? "native-sandbox" : "native";
     }
 }

package/dist/providers/executor/types.d.ts

@@ -43,6 +43,13 @@ export interface Executor {
     launch?: () => Promise<void>;
     /** Optional graceful shutdown counterpart to `launch`. */
     close?: () => Promise<void>;
+    /**
+     * Fire-and-forget start-up warm-up, called only from a long-running server process's own
+     * start-up (`wardby serve`, the MCP server, `wardby scheduler`) — never from a one-shot CLI
+     * command. Delegates to the coding job launcher's own `warmUp` (e.g. Kubernetes's memoized
+     * cluster preflight); never throws.
+     */
+    warmUp?: () => Promise<void>;
     /**
      * Resolves a coding agent's profile selection to an immutable worker
      * image digest, once, at dispatch time (src/core/dispatch.ts) — never
@@ -85,5 +92,10 @@ export interface Executor {
      * says so (Kubernetes and Docker, for Codex and Claude Code).
      */
     supportsCodingServices?(provider: CodingProvider): boolean;
+    /**
+     * Whether this executor can run sandbox-mode native runs (a native sandbox executor is composed
+     * in). MCP refuses to set an agent to sandbox mode where it cannot (docs/native-sandbox.md).
+     */
+    supportsNativeSandbox?(): boolean;
 }
 import type { CodingProvider } from "../../coding/provider.js";

package/dist/providers/jobs/docker.js

@@ -7,7 +7,7 @@ import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { logger } from "../../core/logger.js";
 import { ensurePrivateDirectory } from "../../core/private-directory.js";
 import { readBoundedRegularFile } from "../../coding-worker/artifact.js";
-import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
+import { parseCodingAgentOutputJson, redactAndTruncate, MAX_CODING_ARTIFACT_BYTES, MAX_CODING_INPUT_BYTES, MAX_CODING_OUTPUT_ISSUES, SAFE_CODING_OUTPUT_ISSUE, } from "../../coding/protocol.js";
 import { assertDockerHostSupportsIsolation, assertClaudeAgentContainerInspection, assertClaudeToolRunnerContainerInspection, assertIsolationNetworkInspection, assertKeeperContainerInspection, assertNetworkKeeperContainerInspection, assertProxyContainerInspection, assertStorageVolumeInspection, assertWorkerContainerInspection, buildDockerIsolationPlan, CLAUDE_TOOL_SETUP_ENV, dockerSupportsServicesFor, } from "./docker-isolation.js";
 import { serviceUnreadyError } from "../../coding/services/wording.js";
 import { assertServiceContainerInspection, buildDockerServicePlan, dockerServiceContainerNames, } from "./docker-services.js";
@@ -272,7 +272,7 @@ export class NodeDockerArtifactTransfer {
     }
     async seedInput(sourceFile, container) {
         const metadata = await lstat(sourceFile);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_INPUT_BYTES) {
             throw new Error("docker_input_artifact_invalid");
         }
         const docker = new NodeDockerCommandRunner({
@@ -1174,7 +1174,7 @@ export class DockerJobLauncher {
     }
     async validateInputArtifact(path) {
         const metadata = await lstat(path);
-        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_ARTIFACT_BYTES) {
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > MAX_CODING_INPUT_BYTES) {
             throw new Error("docker_input_artifact_invalid");
         }
     }

package/dist/providers/jobs/fake-kubernetes-api.d.ts

@@ -1,4 +1,4 @@
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Deployment, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface FakeExecCall {
@@ -10,7 +10,7 @@ export interface FakeExecCall {
     stdout?: Writable;
     timeoutMs: number;
 }
-type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints" | "resourcequota";
+type Kind = "configmap" | "secret" | "pod" | "networkpolicy" | "service" | "endpoints" | "resourcequota" | "deployment";
 type Obj = {
     metadata?: {
         name?: string;
@@ -31,6 +31,17 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     onExec: (call: FakeExecCall) => Promise<number>;
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod: (namespace: string, body: V1Pod) => Promise<V1Pod>;
+    readonly deploymentPatches: Array<{
+        name: string;
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }>;
+    /** Deployment names whose patch throws KubernetesForbiddenError. */
+    forbidden: Set<string>;
+    /** "deployment/<name>" or "endpoints/<name>" keys whose read throws KubernetesForbiddenError. */
+    forbiddenReads: Set<string>;
+    /** "verb/resource/name" keys canI answers false for. */
+    accessDenied: Set<string>;
     logs: Map<string, string>;
     /** What readApiServerVersion reports; tests that care about provenance set it. */
     apiServerVersion: string;
@@ -85,6 +96,8 @@ export declare class FakeKubernetesApi implements KubernetesApi {
      */
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    /** Matches `key=value[,key=value]` selectors against stored pods' labels. */
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -92,6 +105,12 @@ export declare class FakeKubernetesApi implements KubernetesApi {
     readService(namespace: string, name: string): Promise<V1Service | undefined>;
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    canI(_namespace: string, verb: string, _group: string, resource: string, name: string): Promise<boolean>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;

package/dist/providers/jobs/fake-kubernetes-api.js

@@ -1,4 +1,4 @@
-import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesNotFoundError, } from "./kubernetes-api.js";
+import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesForbiddenError, KubernetesNotFoundError, } from "./kubernetes-api.js";
 /** In-memory KubernetesApi for unit tests. Tests drive pod status and exec behavior directly. */
 export class FakeKubernetesApi {
     objects = new Map();
@@ -13,6 +13,13 @@ export class FakeKubernetesApi {
     };
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod = async (_namespace, body) => body;
+    deploymentPatches = [];
+    /** Deployment names whose patch throws KubernetesForbiddenError. */
+    forbidden = new Set();
+    /** "deployment/<name>" or "endpoints/<name>" keys whose read throws KubernetesForbiddenError. */
+    forbiddenReads = new Set();
+    /** "verb/resource/name" keys canI answers false for. */
+    accessDenied = new Set();
     logs = new Map();
     /** What readApiServerVersion reports; tests that care about provenance set it. */
     apiServerVersion = "v1.33.0";
@@ -95,6 +102,14 @@ export class FakeKubernetesApi {
     async readPod(namespace, name) {
         return this.read("pod", namespace, name);
     }
+    /** Matches `key=value[,key=value]` selectors against stored pods' labels. */
+    async listPods(namespace, labelSelector) {
+        const wanted = labelSelector.split(",").map((pair) => pair.split("="));
+        return [...this.objects.entries()]
+            .filter(([key]) => key.startsWith(`pod/${namespace}/`))
+            .map(([, pod]) => structuredClone(pod))
+            .filter((pod) => wanted.every(([k, v]) => pod.metadata?.labels?.[k] === v));
+    }
     async deletePod(namespace, name, gracePeriodSeconds) {
         this.deletedPods.push({ name, gracePeriodSeconds });
         this.delete("pod", namespace, name);
@@ -112,11 +127,37 @@ export class FakeKubernetesApi {
         return this.read("service", namespace, name);
     }
     async readEndpoints(namespace, name) {
+        if (this.forbiddenReads.has(`endpoints/${name}`))
+            throw new KubernetesForbiddenError(this.key("endpoints", namespace, name));
         return this.read("endpoints", namespace, name);
     }
     async readResourceQuota(namespace, name) {
         return this.read("resourcequota", namespace, name);
     }
+    async readDeployment(namespace, name) {
+        if (this.forbiddenReads.has(`deployment/${name}`))
+            throw new KubernetesForbiddenError(this.key("deployment", namespace, name));
+        return this.read("deployment", namespace, name);
+    }
+    async patchDeployment(namespace, name, patch) {
+        if (this.forbidden.has(name))
+            throw new KubernetesForbiddenError(this.key("deployment", namespace, name));
+        const key = this.key("deployment", namespace, name);
+        const current = this.objects.get(key);
+        if (!current)
+            throw new KubernetesNotFoundError(key);
+        const metadata = { ...current.metadata, resourceVersion: String(++this.version) };
+        if (patch.annotations)
+            metadata.annotations = { ...current.metadata?.annotations, ...patch.annotations };
+        const next = { ...current, metadata };
+        if (patch.replicas !== undefined)
+            next.spec = { selector: {}, template: {}, ...current.spec, replicas: patch.replicas };
+        this.objects.set(key, next);
+        this.deploymentPatches.push({ name, replicas: patch.replicas, annotations: patch.annotations });
+    }
+    async canI(_namespace, verb, _group, resource, name) {
+        return !this.accessDenied.has(`${verb}/${resource}/${name}`);
+    }
     async readApiServerVersion() {
         return this.apiServerVersion;
     }

package/dist/providers/jobs/kubernetes-api.d.ts

@@ -3,11 +3,15 @@
  * so every launcher behavior is unit-tested against FakeKubernetesApi and
  * re-proven against a real cluster by kubernetes.integration.test.ts.
  */
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Deployment, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 export declare class KubernetesNotFoundError extends Error {
     constructor(message?: string);
 }
+/** The caller's identity lacks RBAC permission for the request (HTTP 403). */
+export declare class KubernetesForbiddenError extends Error {
+    constructor(message?: string, options?: ErrorOptions);
+}
 /** Stale resourceVersion on replace. */
 export declare class KubernetesConflictError extends Error {
     constructor(message?: string);
@@ -36,6 +40,8 @@ export interface KubernetesApi {
      */
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    /** Lists pods in one namespace matching a label selector (e.g. the native sandbox janitor's). */
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -44,11 +50,21 @@ export interface KubernetesApi {
     /**
      * Reads a Service's Endpoints by name. EndpointSlice is the durable successor to this core/v1
      * resource (migrating to it is a follow-up); Endpoints is read by name so RBAC stays one object wide.
+     * Undefined when missing; throws KubernetesForbiddenError on 403.
      */
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
     /** Reads one ResourceQuota by name (its status carries hard and used), for the launcher's capacity check. */
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readNamespace(name: string): Promise<boolean>;
+    /** Undefined when missing; throws KubernetesForbiddenError on 403. */
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    /** JSON merge patch of metadata.annotations and spec.replicas only. Throws KubernetesForbiddenError on 403. */
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    /** SelfSubjectAccessReview: may the current identity perform `verb` on this one named resource? */
+    canI(namespace: string, verb: string, group: string, resource: string, name: string): Promise<boolean>;
     /** Runs a command in a container; resolves with its exit code. Never uses a shell. */
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;
     /**

package/dist/providers/jobs/kubernetes-api.js

@@ -4,6 +4,13 @@ export class KubernetesNotFoundError extends Error {
         this.name = "KubernetesNotFoundError";
     }
 }
+/** The caller's identity lacks RBAC permission for the request (HTTP 403). */
+export class KubernetesForbiddenError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "KubernetesForbiddenError";
+    }
+}
 /** Stale resourceVersion on replace. */
 export class KubernetesConflictError extends Error {
     constructor(message) {

package/dist/providers/jobs/kubernetes-client.d.ts

@@ -3,7 +3,7 @@
  * method is one client call plus HTTP-status translation into the seam's
  * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
  */
-import { type V1ConfigMap, type V1Endpoints, type V1ResourceQuota, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
+import { type V1ConfigMap, type V1Deployment, type V1Endpoints, type V1ResourceQuota, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface ClientNodeKubernetesApiOptions {
     /** kubeconfig context to use; defaults to the current context (or in-cluster credentials). */
@@ -13,6 +13,8 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     private readonly config;
     private readonly core;
     private readonly networking;
+    private readonly apps;
+    private readonly authz;
     private readonly version;
     constructor(options?: ClientNodeKubernetesApiOptions);
     createConfigMap(namespace: string, body: V1ConfigMap): Promise<V1ConfigMap>;
@@ -23,6 +25,7 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     createPod(namespace: string, body: V1Pod): Promise<V1Pod>;
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -32,6 +35,12 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    canI(namespace: string, verb: string, group: string, resource: string, name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;
     readLogTail(namespace: string, pod: string, container: string, tailLines: number, limitBytes: number): Promise<string>;
 }

package/dist/providers/jobs/kubernetes-client.js

@@ -3,9 +3,9 @@
  * method is one client call plus HTTP-status translation into the seam's
  * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
  */
-import { ApiException, CoreV1Api, Exec, KubeConfig, NetworkingV1Api, VersionApi, } from "@kubernetes/client-node";
+import { ApiException, AppsV1Api, AuthorizationV1Api, CoreV1Api, Exec, KubeConfig, NetworkingV1Api, PatchStrategy, setHeaderOptions, VersionApi, } from "@kubernetes/client-node";
 import { Writable } from "node:stream";
-import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesNotFoundError, } from "./kubernetes-api.js";
+import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesForbiddenError, KubernetesNotFoundError, } from "./kubernetes-api.js";
 function statusCode(error) {
     return error instanceof ApiException ? error.code : undefined;
 }
@@ -20,6 +20,19 @@ async function readOrUndefined(read) {
         throw error;
     }
 }
+/** Undefined for a 404; a 403 becomes KubernetesForbiddenError (cause kept); rethrows anything else. */
+async function readOrForbidden(what, read) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        if (statusCode(error) === 404)
+            return undefined;
+        if (statusCode(error) === 403)
+            throw new KubernetesForbiddenError(`forbidden: get ${what}`, { cause: error });
+        throw error;
+    }
+}
 /** Swallows a 404 so deletes are idempotent. */
 async function deleteIgnoringMissing(remove) {
     try {
@@ -69,6 +82,8 @@ export class ClientNodeKubernetesApi {
     config;
     core;
     networking;
+    apps;
+    authz;
     version;
     constructor(options = {}) {
         this.config = new KubeConfig();
@@ -77,6 +92,8 @@ export class ClientNodeKubernetesApi {
             this.config.setCurrentContext(options.context);
         this.core = this.config.makeApiClient(CoreV1Api);
         this.networking = this.config.makeApiClient(NetworkingV1Api);
+        this.apps = this.config.makeApiClient(AppsV1Api);
+        this.authz = this.config.makeApiClient(AuthorizationV1Api);
         this.version = this.config.makeApiClient(VersionApi);
     }
     createConfigMap(namespace, body) {
@@ -103,6 +120,9 @@ export class ClientNodeKubernetesApi {
     readPod(namespace, name) {
         return readOrUndefined(() => this.core.readNamespacedPod({ namespace, name }));
     }
+    async listPods(namespace, labelSelector) {
+        return (await this.core.listNamespacedPod({ namespace, labelSelector })).items;
+    }
     deletePod(namespace, name, gracePeriodSeconds) {
         return deleteIgnoringMissing(() => this.core.deleteNamespacedPod({ namespace, name, gracePeriodSeconds }));
     }
@@ -119,7 +139,7 @@ export class ClientNodeKubernetesApi {
         return readOrUndefined(() => this.core.readNamespacedService({ namespace, name }));
     }
     readEndpoints(namespace, name) {
-        return readOrUndefined(() => this.core.readNamespacedEndpoints({ namespace, name }));
+        return readOrForbidden(`endpoints/${namespace}/${name}`, () => this.core.readNamespacedEndpoints({ namespace, name }));
     }
     readResourceQuota(namespace, name) {
         return readOrUndefined(() => this.core.readNamespacedResourceQuota({ namespace, name }));
@@ -130,6 +150,35 @@ export class ClientNodeKubernetesApi {
     async readNamespace(name) {
         return (await readOrUndefined(() => this.core.readNamespace({ name }))) !== undefined;
     }
+    readDeployment(namespace, name) {
+        return readOrForbidden(`deployments/${namespace}/${name}`, () => this.apps.readNamespacedDeployment({ namespace, name }));
+    }
+    async patchDeployment(namespace, name, patch) {
+        const body = {
+            ...(patch.annotations ? { metadata: { annotations: patch.annotations } } : {}),
+            ...(patch.replicas !== undefined ? { spec: { replicas: patch.replicas } } : {}),
+        };
+        try {
+            await this.apps.patchNamespacedDeployment({ namespace, name, body }, setHeaderOptions("Content-Type", PatchStrategy.MergePatch));
+        }
+        catch (error) {
+            if (statusCode(error) === 403)
+                throw new KubernetesForbiddenError(`deployments/${namespace}/${name}`, { cause: error });
+            if (statusCode(error) === 404)
+                throw new KubernetesNotFoundError(`deployments/${namespace}/${name}`);
+            throw error;
+        }
+    }
+    async canI(namespace, verb, group, resource, name) {
+        const review = await this.authz.createSelfSubjectAccessReview({
+            body: {
+                apiVersion: "authorization.k8s.io/v1",
+                kind: "SelfSubjectAccessReview",
+                spec: { resourceAttributes: { namespace, verb, group, resource, name } },
+            },
+        });
+        return review.status?.allowed === true;
+    }
     exec(namespace, pod, container, command, options) {
         // stderr is requested but discarded so it never reaches wardby's logs.
         const stderr = new Writable({

package/dist/providers/jobs/kubernetes-dry-run-fixture.d.ts

@@ -14,7 +14,11 @@ export interface DryRunFixture {
     notes: string[];
     mutations: PodMutation[];
 }
-export declare function loadDryRunFixture(): DryRunFixture;
+declare const FIXTURE_URLS: {
+    readonly "gke-autopilot": import("url").URL;
+    readonly eks: import("url").URL;
+};
+export declare function loadDryRunFixture(platform?: keyof typeof FIXTURE_URLS): DryRunFixture;
 /**
  * Returns a copy of `document` with every mutation applied in order.
  *
@@ -47,3 +51,4 @@ export declare function applyMutations<T>(document: T, mutations: readonly PodMu
  * `/spec/Foo` and `/spec/foo` by tie-break rules that differ between hosts).
  */
 export declare function diffMutations(before: unknown, after: unknown, prefix?: string): PodMutation[];
+export {};

package/dist/providers/jobs/kubernetes-dry-run-fixture.js

@@ -33,9 +33,12 @@
  */
 import { readFileSync } from "node:fs";
 import { canonical } from "./kubernetes-isolation.js";
-const FIXTURE_URL = new URL("./fixtures/gke-autopilot-dry-run.json", import.meta.url);
-export function loadDryRunFixture() {
-    return JSON.parse(readFileSync(FIXTURE_URL, "utf8"));
+const FIXTURE_URLS = {
+    "gke-autopilot": new URL("./fixtures/gke-autopilot-dry-run.json", import.meta.url),
+    eks: new URL("./fixtures/eks-dry-run.json", import.meta.url),
+};
+export function loadDryRunFixture(platform = "gke-autopilot") {
+    return JSON.parse(readFileSync(FIXTURE_URLS[platform], "utf8"));
 }
 function segments(path) {
     if (path === "" || !path.startsWith("/"))