@wardby/cli 0.5.3 → 0.7.0

package/dist/providers/jobs/fake-kubernetes-api.js

@@ -1,4 +1,4 @@
-import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesNotFoundError, } from "./kubernetes-api.js";
+import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesForbiddenError, KubernetesNotFoundError, } from "./kubernetes-api.js";
 /** In-memory KubernetesApi for unit tests. Tests drive pod status and exec behavior directly. */
 export class FakeKubernetesApi {
     objects = new Map();
@@ -13,6 +13,15 @@ export class FakeKubernetesApi {
     };
     /** The admission chain a dry-run create runs through. Default: echo the pod back unchanged. */
     onDryRunCreatePod = async (_namespace, body) => body;
+    /** Runs at the start of every pod create; tests throw KubernetesQuotaExceededError (or anything) from it. */
+    onCreatePod = async () => { };
+    deploymentPatches = [];
+    /** Deployment names whose patch throws KubernetesForbiddenError. */
+    forbidden = new Set();
+    /** "deployment/<name>" or "endpoints/<name>" keys whose read throws KubernetesForbiddenError. */
+    forbiddenReads = new Set();
+    /** "verb/resource/name" keys canI answers false for. */
+    accessDenied = new Set();
     logs = new Map();
     /** What readApiServerVersion reports; tests that care about provenance set it. */
     apiServerVersion = "v1.33.0";
@@ -76,6 +85,7 @@ export class FakeKubernetesApi {
         this.delete("secret", namespace, name);
     }
     async createPod(namespace, body) {
+        await this.onCreatePod(namespace, body);
         return this.create("pod", namespace, body);
     }
     /**
@@ -95,6 +105,14 @@ export class FakeKubernetesApi {
     async readPod(namespace, name) {
         return this.read("pod", namespace, name);
     }
+    /** Matches `key=value[,key=value]` selectors against stored pods' labels. */
+    async listPods(namespace, labelSelector) {
+        const wanted = labelSelector.split(",").map((pair) => pair.split("="));
+        return [...this.objects.entries()]
+            .filter(([key]) => key.startsWith(`pod/${namespace}/`))
+            .map(([, pod]) => structuredClone(pod))
+            .filter((pod) => wanted.every(([k, v]) => pod.metadata?.labels?.[k] === v));
+    }
     async deletePod(namespace, name, gracePeriodSeconds) {
         this.deletedPods.push({ name, gracePeriodSeconds });
         this.delete("pod", namespace, name);
@@ -112,11 +130,37 @@ export class FakeKubernetesApi {
         return this.read("service", namespace, name);
     }
     async readEndpoints(namespace, name) {
+        if (this.forbiddenReads.has(`endpoints/${name}`))
+            throw new KubernetesForbiddenError(this.key("endpoints", namespace, name));
         return this.read("endpoints", namespace, name);
     }
     async readResourceQuota(namespace, name) {
         return this.read("resourcequota", namespace, name);
     }
+    async readDeployment(namespace, name) {
+        if (this.forbiddenReads.has(`deployment/${name}`))
+            throw new KubernetesForbiddenError(this.key("deployment", namespace, name));
+        return this.read("deployment", namespace, name);
+    }
+    async patchDeployment(namespace, name, patch) {
+        if (this.forbidden.has(name))
+            throw new KubernetesForbiddenError(this.key("deployment", namespace, name));
+        const key = this.key("deployment", namespace, name);
+        const current = this.objects.get(key);
+        if (!current)
+            throw new KubernetesNotFoundError(key);
+        const metadata = { ...current.metadata, resourceVersion: String(++this.version) };
+        if (patch.annotations)
+            metadata.annotations = { ...current.metadata?.annotations, ...patch.annotations };
+        const next = { ...current, metadata };
+        if (patch.replicas !== undefined)
+            next.spec = { selector: {}, template: {}, ...current.spec, replicas: patch.replicas };
+        this.objects.set(key, next);
+        this.deploymentPatches.push({ name, replicas: patch.replicas, annotations: patch.annotations });
+    }
+    async canI(_namespace, verb, _group, resource, name) {
+        return !this.accessDenied.has(`${verb}/${resource}/${name}`);
+    }
     async readApiServerVersion() {
         return this.apiServerVersion;
     }

package/dist/providers/jobs/kubernetes-api.d.ts

@@ -3,11 +3,23 @@
  * so every launcher behavior is unit-tested against FakeKubernetesApi and
  * re-proven against a real cluster by kubernetes.integration.test.ts.
  */
-import type { V1ConfigMap, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
+import type { V1ConfigMap, V1Deployment, V1Endpoints, V1NetworkPolicy, V1Pod, V1ResourceQuota, V1Secret, V1Service } from "@kubernetes/client-node";
 import type { Readable, Writable } from "node:stream";
 export declare class KubernetesNotFoundError extends Error {
     constructor(message?: string);
 }
+/** The caller's identity lacks RBAC permission for the request (HTTP 403). */
+export declare class KubernetesForbiddenError extends Error {
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** A create the namespace ResourceQuota refused (HTTP 403 "exceeded quota"). */
+export declare class KubernetesQuotaExceededError extends Error {
+    /** The refusing quota's name as the API server worded it; unvalidated, and nothing else of the refusal is kept. */
+    readonly quotaName?: string;
+    constructor(message?: string, options?: ErrorOptions & {
+        quotaName?: string;
+    });
+}
 /** Stale resourceVersion on replace. */
 export declare class KubernetesConflictError extends Error {
     constructor(message?: string);
@@ -36,6 +48,8 @@ export interface KubernetesApi {
      */
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    /** Lists pods in one namespace matching a label selector (e.g. the native sandbox janitor's). */
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -44,11 +58,21 @@ export interface KubernetesApi {
     /**
      * Reads a Service's Endpoints by name. EndpointSlice is the durable successor to this core/v1
      * resource (migrating to it is a follow-up); Endpoints is read by name so RBAC stays one object wide.
+     * Undefined when missing; throws KubernetesForbiddenError on 403.
      */
     readEndpoints(namespace: string, name: string): Promise<V1Endpoints | undefined>;
     /** Reads one ResourceQuota by name (its status carries hard and used), for the launcher's capacity check. */
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readNamespace(name: string): Promise<boolean>;
+    /** Undefined when missing; throws KubernetesForbiddenError on 403. */
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    /** JSON merge patch of metadata.annotations and spec.replicas only. Throws KubernetesForbiddenError on 403. */
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    /** SelfSubjectAccessReview: may the current identity perform `verb` on this one named resource? */
+    canI(namespace: string, verb: string, group: string, resource: string, name: string): Promise<boolean>;
     /** Runs a command in a container; resolves with its exit code. Never uses a shell. */
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;
     /**

package/dist/providers/jobs/kubernetes-api.js

@@ -4,6 +4,23 @@ export class KubernetesNotFoundError extends Error {
         this.name = "KubernetesNotFoundError";
     }
 }
+/** The caller's identity lacks RBAC permission for the request (HTTP 403). */
+export class KubernetesForbiddenError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "KubernetesForbiddenError";
+    }
+}
+/** A create the namespace ResourceQuota refused (HTTP 403 "exceeded quota"). */
+export class KubernetesQuotaExceededError extends Error {
+    /** The refusing quota's name as the API server worded it; unvalidated, and nothing else of the refusal is kept. */
+    quotaName;
+    constructor(message, options) {
+        super(message, options);
+        this.name = "KubernetesQuotaExceededError";
+        this.quotaName = options?.quotaName;
+    }
+}
 /** Stale resourceVersion on replace. */
 export class KubernetesConflictError extends Error {
     constructor(message) {

package/dist/providers/jobs/kubernetes-client.d.ts

@@ -3,7 +3,7 @@
  * method is one client call plus HTTP-status translation into the seam's
  * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
  */
-import { type V1ConfigMap, type V1Endpoints, type V1ResourceQuota, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
+import { type V1ConfigMap, type V1Deployment, type V1Endpoints, type V1ResourceQuota, type V1NetworkPolicy, type V1Pod, type V1Secret, type V1Service } from "@kubernetes/client-node";
 import { type KubernetesApi, type KubernetesExecOptions } from "./kubernetes-api.js";
 export interface ClientNodeKubernetesApiOptions {
     /** kubeconfig context to use; defaults to the current context (or in-cluster credentials). */
@@ -13,6 +13,8 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     private readonly config;
     private readonly core;
     private readonly networking;
+    private readonly apps;
+    private readonly authz;
     private readonly version;
     constructor(options?: ClientNodeKubernetesApiOptions);
     createConfigMap(namespace: string, body: V1ConfigMap): Promise<V1ConfigMap>;
@@ -23,6 +25,7 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     createPod(namespace: string, body: V1Pod): Promise<V1Pod>;
     dryRunCreatePod(namespace: string, body: V1Pod): Promise<V1Pod>;
     readPod(namespace: string, name: string): Promise<V1Pod | undefined>;
+    listPods(namespace: string, labelSelector: string): Promise<V1Pod[]>;
     deletePod(namespace: string, name: string, gracePeriodSeconds: number): Promise<void>;
     createNetworkPolicy(namespace: string, body: V1NetworkPolicy): Promise<V1NetworkPolicy>;
     readNetworkPolicy(namespace: string, name: string): Promise<V1NetworkPolicy | undefined>;
@@ -32,6 +35,12 @@ export declare class ClientNodeKubernetesApi implements KubernetesApi {
     readResourceQuota(namespace: string, name: string): Promise<V1ResourceQuota | undefined>;
     readApiServerVersion(): Promise<string>;
     readNamespace(name: string): Promise<boolean>;
+    readDeployment(namespace: string, name: string): Promise<V1Deployment | undefined>;
+    patchDeployment(namespace: string, name: string, patch: {
+        replicas?: number;
+        annotations?: Record<string, string>;
+    }): Promise<void>;
+    canI(namespace: string, verb: string, group: string, resource: string, name: string): Promise<boolean>;
     exec(namespace: string, pod: string, container: string, command: string[], options: KubernetesExecOptions): Promise<number>;
     readLogTail(namespace: string, pod: string, container: string, tailLines: number, limitBytes: number): Promise<string>;
 }

package/dist/providers/jobs/kubernetes-client.js

@@ -3,9 +3,9 @@
  * method is one client call plus HTTP-status translation into the seam's
  * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
  */
-import { ApiException, CoreV1Api, Exec, KubeConfig, NetworkingV1Api, VersionApi, } from "@kubernetes/client-node";
+import { ApiException, AppsV1Api, AuthorizationV1Api, CoreV1Api, Exec, KubeConfig, NetworkingV1Api, PatchStrategy, setHeaderOptions, VersionApi, } from "@kubernetes/client-node";
 import { Writable } from "node:stream";
-import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesNotFoundError, } from "./kubernetes-api.js";
+import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesForbiddenError, KubernetesNotFoundError, KubernetesQuotaExceededError, } from "./kubernetes-api.js";
 function statusCode(error) {
     return error instanceof ApiException ? error.code : undefined;
 }
@@ -20,6 +20,19 @@ async function readOrUndefined(read) {
         throw error;
     }
 }
+/** Undefined for a 404; a 403 becomes KubernetesForbiddenError (cause kept); rethrows anything else. */
+async function readOrForbidden(what, read) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        if (statusCode(error) === 404)
+            return undefined;
+        if (statusCode(error) === 403)
+            throw new KubernetesForbiddenError(`forbidden: get ${what}`, { cause: error });
+        throw error;
+    }
+}
 /** Swallows a 404 so deletes are idempotent. */
 async function deleteIgnoringMissing(remove) {
     try {
@@ -31,6 +44,11 @@ async function deleteIgnoringMissing(remove) {
         throw error;
     }
 }
+/** The error's message plus its body as text, for matching only; never copied into a thrown message. */
+function bodyText(error) {
+    const { body, message } = error;
+    return `${message}\n${typeof body === "string" ? body : JSON.stringify(body ?? "")}`;
+}
 async function create(what, write) {
     try {
         return await write();
@@ -41,6 +59,10 @@ async function create(what, write) {
             throw new KubernetesAlreadyExistsError(what);
         if (code === 404)
             throw new KubernetesNotFoundError(what);
+        if (code === 403 && /exceeded quota/i.test(bodyText(error))) {
+            const quotaName = /exceeded quota: ([^\s,"\\]+)/i.exec(bodyText(error))?.[1];
+            throw new KubernetesQuotaExceededError(`exceeded quota: ${what}`, { cause: error, quotaName });
+        }
         throw error;
     }
 }
@@ -69,6 +91,8 @@ export class ClientNodeKubernetesApi {
     config;
     core;
     networking;
+    apps;
+    authz;
     version;
     constructor(options = {}) {
         this.config = new KubeConfig();
@@ -77,6 +101,8 @@ export class ClientNodeKubernetesApi {
             this.config.setCurrentContext(options.context);
         this.core = this.config.makeApiClient(CoreV1Api);
         this.networking = this.config.makeApiClient(NetworkingV1Api);
+        this.apps = this.config.makeApiClient(AppsV1Api);
+        this.authz = this.config.makeApiClient(AuthorizationV1Api);
         this.version = this.config.makeApiClient(VersionApi);
     }
     createConfigMap(namespace, body) {
@@ -103,6 +129,9 @@ export class ClientNodeKubernetesApi {
     readPod(namespace, name) {
         return readOrUndefined(() => this.core.readNamespacedPod({ namespace, name }));
     }
+    async listPods(namespace, labelSelector) {
+        return (await this.core.listNamespacedPod({ namespace, labelSelector })).items;
+    }
     deletePod(namespace, name, gracePeriodSeconds) {
         return deleteIgnoringMissing(() => this.core.deleteNamespacedPod({ namespace, name, gracePeriodSeconds }));
     }
@@ -119,7 +148,7 @@ export class ClientNodeKubernetesApi {
         return readOrUndefined(() => this.core.readNamespacedService({ namespace, name }));
     }
     readEndpoints(namespace, name) {
-        return readOrUndefined(() => this.core.readNamespacedEndpoints({ namespace, name }));
+        return readOrForbidden(`endpoints/${namespace}/${name}`, () => this.core.readNamespacedEndpoints({ namespace, name }));
     }
     readResourceQuota(namespace, name) {
         return readOrUndefined(() => this.core.readNamespacedResourceQuota({ namespace, name }));
@@ -130,6 +159,35 @@ export class ClientNodeKubernetesApi {
     async readNamespace(name) {
         return (await readOrUndefined(() => this.core.readNamespace({ name }))) !== undefined;
     }
+    readDeployment(namespace, name) {
+        return readOrForbidden(`deployments/${namespace}/${name}`, () => this.apps.readNamespacedDeployment({ namespace, name }));
+    }
+    async patchDeployment(namespace, name, patch) {
+        const body = {
+            ...(patch.annotations ? { metadata: { annotations: patch.annotations } } : {}),
+            ...(patch.replicas !== undefined ? { spec: { replicas: patch.replicas } } : {}),
+        };
+        try {
+            await this.apps.patchNamespacedDeployment({ namespace, name, body }, setHeaderOptions("Content-Type", PatchStrategy.MergePatch));
+        }
+        catch (error) {
+            if (statusCode(error) === 403)
+                throw new KubernetesForbiddenError(`deployments/${namespace}/${name}`, { cause: error });
+            if (statusCode(error) === 404)
+                throw new KubernetesNotFoundError(`deployments/${namespace}/${name}`);
+            throw error;
+        }
+    }
+    async canI(namespace, verb, group, resource, name) {
+        const review = await this.authz.createSelfSubjectAccessReview({
+            body: {
+                apiVersion: "authorization.k8s.io/v1",
+                kind: "SelfSubjectAccessReview",
+                spec: { resourceAttributes: { namespace, verb, group, resource, name } },
+            },
+        });
+        return review.status?.allowed === true;
+    }
     exec(namespace, pod, container, command, options) {
         // stderr is requested but discarded so it never reaches wardby's logs.
         const stderr = new Writable({

package/dist/providers/jobs/kubernetes-dry-run-fixture.d.ts

@@ -14,7 +14,11 @@ export interface DryRunFixture {
     notes: string[];
     mutations: PodMutation[];
 }
-export declare function loadDryRunFixture(): DryRunFixture;
+declare const FIXTURE_URLS: {
+    readonly "gke-autopilot": import("url").URL;
+    readonly eks: import("url").URL;
+};
+export declare function loadDryRunFixture(platform?: keyof typeof FIXTURE_URLS): DryRunFixture;
 /**
  * Returns a copy of `document` with every mutation applied in order.
  *
@@ -47,3 +51,4 @@ export declare function applyMutations<T>(document: T, mutations: readonly PodMu
  * `/spec/Foo` and `/spec/foo` by tie-break rules that differ between hosts).
  */
 export declare function diffMutations(before: unknown, after: unknown, prefix?: string): PodMutation[];
+export {};

package/dist/providers/jobs/kubernetes-dry-run-fixture.js

@@ -33,9 +33,12 @@
  */
 import { readFileSync } from "node:fs";
 import { canonical } from "./kubernetes-isolation.js";
-const FIXTURE_URL = new URL("./fixtures/gke-autopilot-dry-run.json", import.meta.url);
-export function loadDryRunFixture() {
-    return JSON.parse(readFileSync(FIXTURE_URL, "utf8"));
+const FIXTURE_URLS = {
+    "gke-autopilot": new URL("./fixtures/gke-autopilot-dry-run.json", import.meta.url),
+    eks: new URL("./fixtures/eks-dry-run.json", import.meta.url),
+};
+export function loadDryRunFixture(platform = "gke-autopilot") {
+    return JSON.parse(readFileSync(FIXTURE_URLS[platform], "utf8"));
 }
 function segments(path) {
     if (path === "" || !path.startsWith("/"))

package/dist/providers/jobs/kubernetes-isolation.d.ts

@@ -1,6 +1,7 @@
-import type { V1NetworkPolicy, V1Pod, V1Secret } from "@kubernetes/client-node";
+import type { V1Container, V1NetworkPolicy, V1Pod, V1Secret } from "@kubernetes/client-node";
 import { type ResolvedCodingService } from "../../coding/services/catalog.js";
 import type { JobSpec } from "./types.js";
+import { CLAUDE_CONFIG_PATH, CLAUDE_CONFIG_SCRATCH_MIB } from "./docker-isolation.js";
 import { type KubernetesPlatform } from "./kubernetes-platform.js";
 export declare const KUBERNETES_ISOLATION_ERROR = "kubernetes_isolation_unsupported";
 /** Extra seconds past timeoutSec before Kubernetes kills the pod (keeper included). */
@@ -51,6 +52,7 @@ export declare const ENFORCEMENT_PROBE_PROXY_UNREACHABLE = 4;
  * blocking the path — the port is reachable-but-unserved and witnesses nothing.
  */
 export declare const ENFORCEMENT_PROBE_DENY_REFUSED = 5;
+export { CLAUDE_CONFIG_PATH, CLAUDE_CONFIG_SCRATCH_MIB };
 export interface KubernetesRunNames {
     token: string;
     runSha: string;
@@ -81,6 +83,8 @@ export interface RunPodOptions {
 export declare function buildRunPod(spec: JobSpec, options: RunPodOptions): V1Pod;
 export declare function buildRunNetworkPolicy(spec: JobSpec, namespace: string): V1NetworkPolicy;
 export declare function buildCapabilitySecret(spec: JobSpec, namespace: string, capability: string, toolSetup?: string): V1Secret;
+/** A copy of a container's resources with every quantity in one rendering ("1" and "1000m" alike); see normalizeResources. */
+export declare function canonicalResources(r?: V1Container["resources"]): V1Container["resources"];
 /**
  * A copy of `pod` with ONLY the API server's own defaulting and aliasing undone
  * — the same `normalizeSpec` pass `assertRunPodMatches` runs, and nothing else.

package/dist/providers/jobs/kubernetes-isolation.js

@@ -7,7 +7,7 @@
 import { createHash } from "node:crypto";
 import { isIP } from "node:net";
 import { StoredCodingServicesSchema } from "../../coding/services/catalog.js";
-import { CLAUDE_TOOL_SETUP_ENV, CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT, CODING_WORKER_GID, CODING_WORKER_UID, WORKER_STOP_GRACE_SECONDS, claudeToolLimits, isRepositoryDigest, } from "./docker-isolation.js";
+import { CLAUDE_CONFIG_PATH, CLAUDE_CONFIG_SCRATCH_MIB, CLAUDE_TOOL_SETUP_ENV, CODING_PROXY_ALIAS, CODING_PROXY_DENY_PORT, CODING_PROXY_PORT, CODING_WORKER_GID, CODING_WORKER_UID, WORKER_STOP_GRACE_SECONDS, claudeToolLimits, isRepositoryDigest, } from "./docker-isolation.js";
 import { GVISOR_RUNTIME_CLASS, KubernetesPlatformError, STORAGE_INIT_EPHEMERAL_MIB, TOOL_RUNNER_EPHEMERAL_MIB, WORKER_EPHEMERAL_MIB, conformResources, describeMib, normalizePlatformMetadata, platformProfile, podEphemeralStorageMib, } from "./kubernetes-platform.js";
 export const KUBERNETES_ISOLATION_ERROR = "kubernetes_isolation_unsupported";
 /** Extra seconds past timeoutSec before Kubernetes kills the pod (keeper included). */
@@ -97,6 +97,9 @@ const STORAGE_DIRECTORIES = ["workspace", "input", "output"];
  * sandbox (GKE Autopilot annotates it `share: pod`), so the agent's relay can connect.
  */
 const TOOL_SOCKET_VOLUME = "tool-socket";
+/** Session resume only: the Claude worker's SDK config dir (docker-isolation.ts CLAUDE_CONFIG_SCRATCH_MIB). */
+const CLAUDE_CONFIG_VOLUME = "claude-config";
+export { CLAUDE_CONFIG_PATH, CLAUDE_CONFIG_SCRATCH_MIB };
 const TOOL_SOCKET_VOLUME_MIB = 1;
 /**
  * `reason` is a short, fixed code naming which check failed (never a value from the spec itself,
@@ -166,6 +169,9 @@ export function validateKubernetesSpec(spec) {
     else if (spec.toolImage !== undefined) {
         throw isolationError("tool-image-set");
     }
+    if (spec.sessionResume !== undefined && (spec.sessionResume !== true || spec.provider !== "claude-code")) {
+        throw isolationError("session-resume-not-claude");
+    }
     if (!isRegistryDigest(spec.image))
         throw isolationError("image-not-registry-digest");
     if (spec.services !== undefined) {
@@ -322,6 +328,8 @@ export function buildRunPod(spec, options) {
                 { name: TOOL_SOCKET_VOLUME, mountPath: "/run/wardby/tool" },
                 { name: "tmp", mountPath: "/tmp" },
                 { name: "home", mountPath: "/home/wardby" },
+                // Session resume: the SDK's config dir, where the session file grows, off /tmp's budget.
+                ...(spec.sessionResume ? [{ name: CLAUDE_CONFIG_VOLUME, mountPath: CLAUDE_CONFIG_PATH }] : []),
             ]
             : [
                 { name: "storage", mountPath: "/workspace", subPath: "workspace" },
@@ -414,6 +422,14 @@ export function buildRunPod(spec, options) {
                         { name: TOOL_SOCKET_VOLUME, emptyDir: { medium: "Memory", sizeLimit: `${TOOL_SOCKET_VOLUME_MIB}Mi` } },
                         { name: "tool-tmp", emptyDir: { medium: "Memory", sizeLimit: `${toolScratchMb}Mi` } },
                         { name: "tool-home", emptyDir: { medium: "Memory", sizeLimit: `${toolScratchMb}Mi` } },
+                        ...(spec.sessionResume
+                            ? [
+                                {
+                                    name: CLAUDE_CONFIG_VOLUME,
+                                    emptyDir: { medium: "Memory", sizeLimit: `${CLAUDE_CONFIG_SCRATCH_MIB}Mi` },
+                                },
+                            ]
+                            : []),
                     ]
                     : []),
                 ...serviceVolumes(services),
@@ -561,6 +577,12 @@ function normalizeResources(r) {
             bag["ephemeral-storage"] = memoryBytes(bag["ephemeral-storage"]);
     }
 }
+/** A copy of a container's resources with every quantity in one rendering ("1" and "1000m" alike); see normalizeResources. */
+export function canonicalResources(r) {
+    const copy = r ? JSON.parse(JSON.stringify(r)) : undefined;
+    normalizeResources(copy);
+    return copy;
+}
 function normalizeProbe(p) {
     if (!p)
         return;

package/dist/providers/jobs/kubernetes-platform.d.ts

@@ -29,7 +29,7 @@
  * regresses to a documentation-only fixture again.
  */
 import type { V1PodSpec, V1Toleration } from "@kubernetes/client-node";
-export type KubernetesPlatform = "generic" | "gke-autopilot";
+export type KubernetesPlatform = "generic" | "gke-autopilot" | "eks";
 export declare const KUBERNETES_PLATFORMS: readonly KubernetesPlatform[];
 export declare const KUBERNETES_PLATFORM_ERROR = "kubernetes_platform_unconformable";
 /** A request the platform cannot legally run, refused here instead of being silently adjusted by the platform. */
@@ -84,6 +84,9 @@ export interface KubernetesPlatformProfile {
     /** gVisor is mandatory: an unset or different runtime class is refused at startup, not warned about. */
     requiresGvisor: boolean;
 }
+/** Node label and taint key of the EKS sandbox node group; deploy/aws and overlays/eks use the same strings. */
+export declare const EKS_SANDBOX_NODE_LABEL = "wardby.dev/sandbox";
+export declare const EKS_SANDBOX_TAINT_KEY = "sandbox";
 export declare function platformProfile(name: KubernetesPlatform): KubernetesPlatformProfile;
 export interface ContainerResourceRequest {
     cpuMillicores: number;

package/dist/providers/jobs/kubernetes-platform.js

@@ -1,4 +1,8 @@
-export const KUBERNETES_PLATFORMS = Object.freeze(["generic", "gke-autopilot"]);
+export const KUBERNETES_PLATFORMS = Object.freeze([
+    "generic",
+    "gke-autopilot",
+    "eks",
+]);
 export const KUBERNETES_PLATFORM_ERROR = "kubernetes_platform_unconformable";
 /** A request the platform cannot legally run, refused here instead of being silently adjusted by the platform. */
 export class KubernetesPlatformError extends Error {
@@ -109,9 +113,42 @@ const GKE_AUTOPILOT = {
     },
     requiresGvisor: true,
 };
+/** Node label and taint key of the EKS sandbox node group; deploy/aws and overlays/eks use the same strings. */
+export const EKS_SANDBOX_NODE_LABEL = "wardby.dev/sandbox";
+export const EKS_SANDBOX_TAINT_KEY = "sandbox";
+/**
+ * Amazon EKS with a dedicated gVisor node group (deploy/aws). EKS has no managed sandbox runtime, so
+ * the node group's launch template installs runsc and the overlay's `gvisor` RuntimeClass schedules
+ * onto it: the RuntimeClass admission plugin merges its `scheduling` block into the pod, which is
+ * the toleration and nodeSelector below — wardby never sets either itself (see SYMMETRY CAVEAT).
+ *
+ * PROVISIONAL: written from the RuntimeClass spec, not yet a server-side dry-run capture. EKS has no
+ * Autopilot-style resource admission, so resources are the generic rules plus explicit ephemeral
+ * storage (kubelet eviction accounting on a shared sandbox node). Replace the fixture with a real
+ * capture before relying on the allowance list (fixtures/eks-dry-run.json).
+ */
+const EKS = {
+    name: "eks",
+    resources: {
+        cpuFloorMillicores: 0,
+        cpuIncrementMillicores: 1,
+        memoryPerCpuMinMib: 0,
+        memoryPerCpuMaxMib: Number.POSITIVE_INFINITY,
+        explicitEphemeralStorage: true,
+    },
+    metadata: {
+        podAnnotationKeyPrefixes: [],
+        podLabelKeyPrefixes: [],
+        tolerations: [{ key: EKS_SANDBOX_TAINT_KEY, operator: "Equal", value: GVISOR_RUNTIME_CLASS, effect: "NoSchedule" }],
+        nodeSelector: { [EKS_SANDBOX_NODE_LABEL]: GVISOR_RUNTIME_CLASS },
+        dropsPodSeccompProfile: false,
+    },
+    requiresGvisor: true,
+};
 const PROFILES = Object.freeze({
     generic: freezeProfile(GENERIC),
     "gke-autopilot": freezeProfile(GKE_AUTOPILOT),
+    eks: freezeProfile(EKS),
 });
 export function platformProfile(name) {
     const profile = PROFILES[name];

package/dist/providers/jobs/kubernetes-preflight.d.ts

@@ -40,7 +40,8 @@ export interface CanaryResult {
  * probe (`enforcementProbeScript`), which had to make the same distinction after a live cluster
  * with no NetworkPolicy at all passed a boolean version of this check; preflight and gate must
  * agree on what counts as evidence, or one of them is vacuous. `internet`, `metadata` and `proxy`
- * stay plain reachability, where "connected" is the only thing that matters.
+ * stay plain reachability, where "connected" is the only thing that matters; `metadata` is true if
+ * **any** cloud metadata endpoint connects.
  *
  * CNIs program a new pod's policy a few seconds after it starts, so the script first waits (up to
  * 20 s) for the deny-port connect to be *dropped*; if it never is, `proxyDeny` reports true.

package/dist/providers/jobs/kubernetes-preflight.js

@@ -11,6 +11,7 @@ import { randomBytes } from "node:crypto";
 import { CODING_PROXY_DENY_PORT, CODING_PROXY_PORT } from "./docker-isolation.js";
 import { KUBERNETES_ISOLATION_ERROR, WORKER_CONTAINER, buildRunNetworkPolicy, buildRunPod, isRegistryDigest, } from "./kubernetes-isolation.js";
 import { KubernetesPlatformError, assertPlatformConfig, platformProfile } from "./kubernetes-platform.js";
+import { CLOUD_METADATA_PROBES } from "./metadata-probes.js";
 import { readProxyWitness } from "./kubernetes-witness.js";
 /**
  * The image the preflight canary runs (it only needs node): the Codex worker when configured,
@@ -40,7 +41,8 @@ const CANARY_KEYS = Object.keys(EXPECTED).sort();
  * probe (`enforcementProbeScript`), which had to make the same distinction after a live cluster
  * with no NetworkPolicy at all passed a boolean version of this check; preflight and gate must
  * agree on what counts as evidence, or one of them is vacuous. `internet`, `metadata` and `proxy`
- * stay plain reachability, where "connected" is the only thing that matters.
+ * stay plain reachability, where "connected" is the only thing that matters; `metadata` is true if
+ * **any** cloud metadata endpoint connects.
  *
  * CNIs program a new pod's policy a few seconds after it starts, so the script first waits (up to
  * 20 s) for the deny-port connect to be *dropped*; if it never is, `proxyDeny` reports true.
@@ -81,7 +83,7 @@ export const CANARY_SCRIPT = [
     "    ),",
     `    proxyDeny: !(await dropped(process.env.WARDBY_CANARY_PROXY_IP, ${CODING_PROXY_DENY_PORT})),`,
     '    internet: await reachable("1.1.1.1", 443),',
-    '    metadata: await reachable("169.254.169.254", 80),',
+    `    metadata: (await Promise.all(${JSON.stringify(CLOUD_METADATA_PROBES.map((p) => [p.host, p.port]))}.map(([host, port]) => reachable(host, port)))).some(Boolean),`,
     `    proxy: await reachable(process.env.WARDBY_CANARY_PROXY_IP, ${CODING_PROXY_PORT}),`,
     "  };",
     "  console.log(JSON.stringify({ wardbyCanary }));",