Repository navigation
Conversation
❌ 3 Tests Failed:
View the top 3 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
tholop
force-pushed
the
feat/sdk-vm-labels
branch
from
October 8, 2026 13:07
bc9bdb5 to
2514565
Compare
tholop
changed the title
…list
Allow callers to attach optional key/value string labels to VMs at
creation time, inherit or override them on fork, and return them on
every SandboxInfo entry in /vms/list and /vms/{id}/info so external
orchestrators and garbage collectors can identify their own VMs.
- capsem-api / capsem-service / OpenAPI: add optional labels
(Option<HashMap<String, String>>) to ProvisionRequest, ForkRequest,
SandboxInfo, VmInstance, SessionCreationParams, and PersistentVmEntry,
validated server-side via naming::validate_vm_labels (<= 64 entries,
keys reuse validate_vm_name: 1..=64 ASCII chars starting with
[A-Za-z0-9] and containing only [A-Za-z0-9_-]; values <= 255 UTF-8
bytes with no control chars) and normalized via
naming::non_empty_labels so {} is treated identically to None.
- Fork inheritance: /vms/{id}/fork inherits the source VM's labels when
ForkRequest.labels is omitted/null, replaces them when a non-empty map
is provided, and clears them when {} is provided.
- List cache fingerprint: include running and inactive VM labels in
list_response_fingerprint via append_labels_fingerprint so label
differences invalidate cached /vms/list responses.
- SDKs (Python, Rust, TypeScript): thread optional labels through
Hypervisor.create / CreateOptions and VM.fork / ForkOptions and
regenerate OpenAPI models across all three SDKs.
- CLI & TUI: add repeatable -l / --label KEY=VALUE to capsem create and
capsem fork, and display labels in the TUI session detail pane.
- Service test helpers & Citadel ratchets: consolidate ProvisionOptions
and PersistentVmEntry test constructors via test_provision_options and
test_persistent_entry in crates/capsem-service/src/tests.rs (reducing
tests/lifecycle.rs and tests/assets_registry.rs by ~100 lines) and
update the four corresponding oversized-Rust-file line ratchets in
config/gate.toml.
tholop
force-pushed
the
feat/sdk-vm-labels
branch
from
October 9, 2026 15:49
2514565 to
3e94546
Compare
This was referenced Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lets clients attach key/value labels to the VMs they create or fork and inspect them again when listing or querying VMs. The Inspect AI integration (#338) uses this to identify and clean up only the ephemeral VMs it owns.
Changes
capsem-api,capsem-service, OpenAPI):labels(Option<HashMap<String, String>>) toProvisionRequest(POST /vms/create),ForkRequest(POST /vms/{id}/fork),SandboxInfo(GET /vms/listandGET /vms/{id}/info),VmInstance,SessionCreationParams, andPersistentVmEntry.ForkRequest) inherits the source VM's labels whenlabelsis omitted/null, replaces them when a non-empty map is provided, and clears them when{}is passed.naming::validate_vm_labels:64entries (MAX_VM_LABELS).validate_vm_name(1..=64ASCII characters starting with[A-Za-z0-9]and containing only[A-Za-z0-9_-]).255UTF-8 bytes (MAX_VM_LABEL_VALUE_LEN) with no ASCII or Unicode control characters.naming::non_empty_labelsso{}is stored and serialized identically toNone.ProvisionOptionsandPersistentVmEntrytest constructors viatest_provision_optionsandtest_persistent_entryincrates/capsem-service/src/tests.rs(reducingtests/lifecycle.rsandtests/assets_registry.rsby ~100 lines) and updates the four corresponding oversized-Rust-file line ratchets inconfig/gate.toml.sdk/python,sdk/rust,sdk/typescript,capsemCLI):openapi.jsonand threadslabelsthrough the Python, Rust, and TypeScript SDKs pluscapsem createandcapsem fork(-l / --label KEY=VALUE).Notes for Review
Hypervisor.list(labels=...)filter (inspect-capsemfilters the returnedSandboxInfo.labelslist in the caller). If you would like server-side filtering incapsem-service, we are happy to send a small follow-up addingGET /vms/list?label=k=v(repeatable, AND semantics) across OpenAPI,capsem-service, and the generated SDKs.inspect-capsemusesmanaged-by=inspect-capsemandinspect-capsem-prefix=<slug>) — let us know if you want a reserved namespace convention.