From 2222034d8980f9052f1b29774d3417bcbce8b05b Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 04:53:26 +0000 Subject: [PATCH 1/6] feat: Integrate vendor VFIO vGPUs into the instance lifecycle Stainless-Generated-From: 7dfb206b14adb2c4038540931218c0404786be6e --- src/resources/instances/instances.ts | 7 ++++++- src/resources/resources.ts | 4 +++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/resources/instances/instances.ts b/src/resources/instances/instances.ts index 0e9feee..1de5f24 100644 --- a/src/resources/instances/instances.ts +++ b/src/resources/instances/instances.ts @@ -624,7 +624,12 @@ export namespace Instance { */ export interface GPU { /** - * mdev device UUID + * sysfs path of the assigned vGPU device + */ + device_path?: string; + + /** + * mdev device UUID (mdev hosts only) */ mdev_uuid?: string; diff --git a/src/resources/resources.ts b/src/resources/resources.ts index 7b407b2..9f7e11a 100644 --- a/src/resources/resources.ts +++ b/src/resources/resources.ts @@ -67,7 +67,9 @@ export interface DiskBreakdown { */ export interface GPUProfile { /** - * Number of instances that can be created with this profile + * Number of virtual functions currently able to create this profile. Best-effort: + * creating an instance may reduce availability on sibling functions sharing GPU + * framebuffer. */ available: number; From a0b69e995022e8f39d2df180f7b71cdd9dc5231d Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 14:31:53 +0000 Subject: [PATCH 2/6] feat: Add Windows hypervisor primitives Stainless-Generated-From: 1d192428803b7b2dd0d17382bcd06c83a15f8006 --- src/resources/instances/instances.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/resources/instances/instances.ts b/src/resources/instances/instances.ts index 1de5f24..c9b4563 100644 --- a/src/resources/instances/instances.ts +++ b/src/resources/instances/instances.ts @@ -1429,7 +1429,7 @@ export interface InstanceLogsParams { * - vmm: Cloud Hypervisor VMM logs (hypervisor stdout+stderr) * - hypeman: Hypeman operations log (actions taken on this instance) */ - source?: 'app' | 'vmm' | 'hypeman'; + source?: 'app' | 'vmm' | 'hypeman' | 'swtpm'; /** * Number of lines to return from end From 26e9bdb59bd86802771ffde0289e2f96b0ffebc4 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 13:08:49 +0000 Subject: [PATCH 3/6] feat: Update Hypeman build toolchains to Go 1.26.10 Stainless-Generated-From: 4efa9f10b06e489f0826af63e673ffb7e2669d2e --- src/resources/instances/instances.ts | 21 +++++++++++++-------- src/resources/resources.ts | 22 +++++++++++++++++++++- 2 files changed, 34 insertions(+), 9 deletions(-) diff --git a/src/resources/instances/instances.ts b/src/resources/instances/instances.ts index c9b4563..d10c0f7 100644 --- a/src/resources/instances/instances.ts +++ b/src/resources/instances/instances.ts @@ -752,7 +752,8 @@ export interface InstanceStats { memory_vms_bytes: number; /** - * Total network bytes received by the VM (from TAP interface) + * Total network bytes received by the VM (from TAP interface). Always 0 for macOS + * guests, which use NAT with no per-instance interface. */ network_rx_bytes: number; @@ -1145,15 +1146,16 @@ export interface InstanceCreateParams { network?: InstanceCreateParams.Network; /** - * Writable overlay disk size (human-readable format like "10GB", "50G") + * Writable overlay disk size (human-readable format like "10GB", "50G"). Omit this + * field for macOS guests, which clone the image's complete boot disk instead. */ overlay_size?: string; /** - * Target platform as os/arch[/variant] (e.g. "linux/amd64"), matching Docker - * --platform. Omit for the host platform. Not a fixed enum: the os/arch[/variant] - * grammar is validated server-side and invalid values return 400 invalid_platform. - * Only os "linux" with arch amd64 or arm64 is accepted today. + * Target platform as os/arch[/variant]. Linux container guests support amd64 and + * arm64. Experimental darwin/arm64 guests require an offline-imported macOS disk + * image and vz on Apple silicon. Omit to use the cached native image or host + * platform. */ platform?: string; @@ -1163,7 +1165,9 @@ export interface InstanceCreateParams { restart_policy?: RestartPolicy; /** - * Base memory size (human-readable format like "1GB", "512MB", "2G") + * Base memory size (human-readable format like "1GB", "512MB", "2G"). macOS guests + * default to their image's memory; explicit sizes must be at least 4 GiB in whole + * MiB and within VZ host limits. */ size?: string; @@ -1202,7 +1206,8 @@ export interface InstanceCreateParams { ttl?: string; /** - * Number of virtual CPUs + * Number of virtual CPUs. macOS guests default to their image's vCPUs; explicit + * counts must be at least 2 and within VZ host limits. */ vcpus?: number; diff --git a/src/resources/resources.ts b/src/resources/resources.ts index 9f7e11a..7c1cdac 100644 --- a/src/resources/resources.ts +++ b/src/resources/resources.ts @@ -88,18 +88,31 @@ export interface GPUProfile { * GPU resource status. Null if no GPUs available. */ export interface GPUResourceStatus { + /** + * Free slots eligible for placement, matching admission control (excludes + * quarantined VFs; 0 while VF health state is unavailable) + */ + allocatable_slots: number; + /** * GPU mode (vgpu for SR-IOV/mdev, passthrough for whole GPU) */ mode: 'vgpu' | 'passthrough'; + /** + * VFs quarantined after guest driver init failures (vGPU mode only). May overlap + * used_slots until the affected instance releases its VF. + */ + quarantined_slots: number; + /** * Total slots (VFs for vGPU, physical GPUs for passthrough) */ total_slots: number; /** - * Slots currently in use + * Slots currently in use. Includes quarantined VFs that are still assigned, so + * this can overlap quarantined_slots. */ used_slots: number; @@ -108,6 +121,13 @@ export interface GPUResourceStatus { */ devices?: Array; + /** + * Present when allocatable_slots is 0 because the VF health state could not be + * read or written rather than because the host is full. vGPU placement is refused + * until the state file is repaired or the next write succeeds. + */ + placement_disabled_reason?: string; + /** * Available vGPU profiles (only in vGPU mode) */ From e7f429c3dcf2021f62ee13ef5f036da064d668d3 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 21:14:31 +0000 Subject: [PATCH 4/6] feat: Place vGPU profiles the driver hides from creatable lists Stainless-Generated-From: cdc4d7a36eeb143d9d86896db2c175e5c03c4462 --- src/resources/resources.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/resources/resources.ts b/src/resources/resources.ts index 7c1cdac..296d563 100644 --- a/src/resources/resources.ts +++ b/src/resources/resources.ts @@ -67,9 +67,9 @@ export interface DiskBreakdown { */ export interface GPUProfile { /** - * Number of virtual functions currently able to create this profile. Best-effort: - * creating an instance may reduce availability on sibling functions sharing GPU - * framebuffer. + * Number of additional instances of this profile the host can take if only this + * profile is added. Counts for different profiles are not additive: an instance of + * one profile can reduce availability of others on the same GPU. */ available: number; From d02385f8da6f604f0aface19912df78227ae77a1 Mon Sep 17 00:00:00 2001 From: Rafael Date: Mon, 9 Nov 2026 16:51:33 -0500 Subject: [PATCH 5/6] Grant id-token: write for federated model credentials (#3) Co-authored-by: rgarcia <72655+rgarcia@users.noreply.github.com> --- .github/workflows/semgrep.yml | 2 ++ .github/workflows/vuln-remediation.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index 48774a9..4865ea3 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -7,6 +7,8 @@ on: permissions: contents: read pull-requests: write + # semgrep exchanges the job's OIDC token for short-lived model credentials. + id-token: write jobs: scan: diff --git a/.github/workflows/vuln-remediation.yml b/.github/workflows/vuln-remediation.yml index e7b1ea9..8ead8df 100644 --- a/.github/workflows/vuln-remediation.yml +++ b/.github/workflows/vuln-remediation.yml @@ -8,6 +8,8 @@ on: permissions: contents: write pull-requests: write + # vuln-remediation exchanges the job's OIDC token for short-lived model credentials. + id-token: write jobs: remediate: From 92145d909372c02c99e6e08a47c55c4ad4e4ceb2 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 21:52:43 +0000 Subject: [PATCH 6/6] release: 0.29.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 10 ++++++++++ package-lock.json | 4 ++-- package.json | 2 +- src/version.ts | 2 +- 5 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 9800444..8316a6d 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.28.0" + ".": "0.29.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 8c18063..369cc4c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## [0.29.0](https://github.com/kernel/hypeman-ts/compare/v0.28.0...v0.29.0) (2026-11-09) + + +### Features + +* Add Windows hypervisor primitives ([a0b69e9](https://github.com/kernel/hypeman-ts/commit/a0b69e995022e8f39d2df180f7b71cdd9dc5231d)) +* Integrate vendor VFIO vGPUs into the instance lifecycle ([2222034](https://github.com/kernel/hypeman-ts/commit/2222034d8980f9052f1b29774d3417bcbce8b05b)) +* Place vGPU profiles the driver hides from creatable lists ([e7f429c](https://github.com/kernel/hypeman-ts/commit/e7f429c3dcf2021f62ee13ef5f036da064d668d3)) +* Update Hypeman build toolchains to Go 1.26.10 ([26e9bdb](https://github.com/kernel/hypeman-ts/commit/26e9bdb59bd86802771ffde0289e2f96b0ffebc4)) + ## [0.28.0](https://github.com/kernel/hypeman-ts/compare/v0.27.0...v0.28.0) (2026-09-01) diff --git a/package-lock.json b/package-lock.json index 3e92bd1..d9de5e6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@onkernel/hypeman", - "version": "0.28.0", + "version": "0.29.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@onkernel/hypeman", - "version": "0.28.0", + "version": "0.29.0", "license": "Apache-2.0", "dependencies": { "dockerode": "^4.0.10", diff --git a/package.json b/package.json index 566ce5b..7f7e185 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/hypeman", - "version": "0.28.0", + "version": "0.29.0", "description": "The official TypeScript library for the Hypeman API", "author": "Hypeman <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index 3e76cc4..bef2b64 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.28.0'; // x-release-please-version +export const VERSION = '0.29.0'; // x-release-please-version