The seam crate carried every backend behind features — local, client,
server — so a wasm worker linked the axum daemon and a host daemon
linked reqwest it never dialed. The family mirrors the provider family
now, as the design always said it would: rhema-sandbox keeps the
contract, the ShellSandbox adapter, the wire protocol, the seeding
helper, the scripted mock, and — behind the new `spawn` feature — the
process family's shared machinery (exec_util, fsroot); the backends
are sibling crates, rhema-sandbox-local, -docker, -ssh, each dependent
only on the seam; the HTTPS client is rhema-sandbox-http (reqwest
behind its `native` feature, off on wasm, whose worker brings its own
HttpTransport over host fetch); the daemon is rhema-sandbox-server,
and the rhema-sandboxd binary moves with it.
Consumers rewire, semantics don't: rhema-code names its backends
directly; rhema-cloud-agent keeps its transitional re-exports;
rhema-cloudflare-code and rhema-vercel-agent take the HTTP client
reqwest-free and native respectively; the sandboxd image builds
-p rhema-sandbox-server. Cargo paths only — no behavior, no protocol,
no spec change.
A multi-stage build shipping the daemon: bash, git, and a CA store in
the runtime so git and tarball seeds work; the base directory is a
volume, the token is a flag with no env default, the port must be
passed because the binary defaults to an OS pick. Smoke-tested against
a real daemon: healthz auth, exec, put/get, session dirs under the
mounted base.
vhaudiquet