nylorun 0.27.4-beta → 0.28.0-beta

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # nylorun
 
+## 0.28.0-beta
+
+### Minor Changes
+
+- 48578d6: `nylorun local sandbox enable` installs agent-sandbox v1.0.10 in place of v1.0.5, its release manifest verified by its new sha256. The patches since v1.0.5 fix the warm pool's accounting and readiness, stop a suspending Sandbox from reporting Finished, add Prometheus metrics for suspend and resume, and add CEL validation of volume claim templates; the API stays `agents.x-k8s.io/v1beta1`. A context that runs v1.0.5 is refused, as any other version is: upgrade its controller with `kubectl apply --server-side -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.10/sandbox.yaml`, then run `enable` again.
+
 ## 0.27.4-beta
 
 ### Patch Changes

package/README.md

@@ -426,7 +426,7 @@ on the Management API.
 
 `nylorun local sandbox enable --context <name>` prepares a Kubernetes context for the
 Tenant's sandboxes as pods ([agent-sandbox](https://github.com/kubernetes-sigs/agent-sandbox)
-v1.0.5): Docker Desktop's cluster (`--context docker-desktop`) or kind. It only
+v1.0.10): Docker Desktop's cluster (`--context docker-desktop`) or kind. It only
 touches the context you name. It installs the pinned agent-sandbox controller
 when the cluster has none (and refuses another version), creates the namespace
 `nylorun-sbx-<tenant>` with a ServiceAccount limited to Sandbox lifecycle, proves
@@ -438,6 +438,10 @@ The probe publishes two free ports on the Docker host. Behind a firewall that
 opens only named ports to the pods, such as a cloud VPC's, pass two of them with
 `--probe-ports <allowed>,<denied>`. Open both, so that only NetworkPolicy can
 block the denied one.
+A context that runs an earlier pin, such as v1.0.5, is refused too: upgrade its
+controller yourself with `kubectl apply --server-side -f
+https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.10/sandbox.yaml`,
+then run `enable` again.
 `nylorun local sandbox disable` removes the service (`--delete-namespace` also deletes
 the namespace and every sandbox in it). Sessions run in a pod when their
 Agent's manifest has `runtime.kind` `pod`.

package/dist/sandbox/commands.d.ts

@@ -3,7 +3,7 @@ import type { FetchLike } from "../stack/studio-login.js";
 import { type ClusterFile } from "./cluster-file.js";
 import { type Kube, type KubectlRunner } from "./kubectl.js";
 import { type ProbePorts } from "./probe.js";
-export declare const sandboxUsage = "  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--probe-ports <allowed>,<denied>] [--no-pull]\n                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox v1.0.5)\n  sandbox disable [--tenant <name>] [--delete-namespace]\n                                      stop the sandboxes service and forget the cluster\n  sandbox status [--tenant <name>] [--json]\n                                      the cluster, the sandboxes service's readiness and what it reports";
+export declare const sandboxUsage = "  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--probe-ports <allowed>,<denied>] [--no-pull]\n                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox v1.0.10)\n  sandbox disable [--tenant <name>] [--delete-namespace]\n                                      stop the sandboxes service and forget the cluster\n  sandbox status [--tenant <name>] [--json]\n                                      the cluster, the sandboxes service's readiness and what it reports";
 /** The default workload image (D36), pre-pulled with the Runtime image. */
 export declare const DEFAULT_SANDBOX_IMAGE = "python:3.13-slim";
 export interface SandboxDeps {

package/dist/sandbox/manifests.d.ts

@@ -1,11 +1,11 @@
 /**
  * What `nylorun local sandbox enable` installs into a cluster. The agent-sandbox controller is
- * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
+ * pinned (D32, Experiment 2): v1.0.10, API agents.x-k8s.io/v1beta1, its release manifest
  * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
  */
-export declare const CONTROLLER_VERSION = "v1.0.5";
-export declare const CONTROLLER_URL = "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.5/sandbox.yaml";
-export declare const CONTROLLER_SHA256 = "e89fd95c0aa57609fa24be4112bd52ce67fe8939ecf6f3c17edf2f1e8f1eb860";
+export declare const CONTROLLER_VERSION = "v1.0.10";
+export declare const CONTROLLER_URL = "https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v1.0.10/sandbox.yaml";
+export declare const CONTROLLER_SHA256 = "ea8de87e7d71cf3df40bb71a71f3c4d095e7ae88dc43fe5f4050a717abd46066";
 export declare const CONTROLLER_NAMESPACE = "agent-sandbox-system";
 export declare const CONTROLLER_DEPLOYMENT = "agent-sandbox-controller";
 export declare const SANDBOX_CRD = "sandboxes.agents.x-k8s.io";

package/dist/sandbox/manifests.js

@@ -2,12 +2,12 @@ import { createHash } from "node:crypto";
 import { cliTuning } from "../tuning.js";
 /**
  * What `nylorun local sandbox enable` installs into a cluster. The agent-sandbox controller is
- * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
+ * pinned (D32, Experiment 2): v1.0.10, API agents.x-k8s.io/v1beta1, its release manifest
  * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
  */
-export const CONTROLLER_VERSION = "v1.0.5";
+export const CONTROLLER_VERSION = "v1.0.10";
 export const CONTROLLER_URL = `https://github.com/kubernetes-sigs/agent-sandbox/releases/download/${CONTROLLER_VERSION}/sandbox.yaml`;
-export const CONTROLLER_SHA256 = "e89fd95c0aa57609fa24be4112bd52ce67fe8939ecf6f3c17edf2f1e8f1eb860";
+export const CONTROLLER_SHA256 = "ea8de87e7d71cf3df40bb71a71f3c4d095e7ae88dc43fe5f4050a717abd46066";
 export const CONTROLLER_NAMESPACE = "agent-sandbox-system";
 export const CONTROLLER_DEPLOYMENT = "agent-sandbox-controller";
 export const SANDBOX_CRD = "sandboxes.agents.x-k8s.io";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nylorun",
-  "version": "0.27.4-beta",
+  "version": "0.28.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose, and act on a Tenant through its Runtime and Management APIs",