feat: update egress proxy secrets on running instances

[sjmiller609]

Summary

• Adds PATCH /instances/{id}/env endpoint to update environment variables on running instances
• Enables credential/secret rotation for egress proxy without instance restart
• New env vars are merged into existing env, then egress proxy rules are atomically swapped
• Validates credential bindings are still satisfied after update
• No guest-side changes needed — secrets never enter the guest, only the host-side proxy

Implementation

• OpenAPI spec: New PATCH /instances/{id}/env endpoint with request body { env: { key: value } }
• Manager method: UpdateInstanceEnv() loads metadata, merges env, validates credential bindings, gets network allocation, re-registers proxy, persists metadata
• Handler: Standard strict-server pattern with proper error mapping (400/404/409/500)
• Scope: Maps to instance:write permission

Test plan

• Extended egress_proxy_integration_test.go to cover secret rotation:
  1. After initial proxy setup with real-openai-key-123
  2. Call UpdateInstanceEnv with rotated-openai-key-456
  3. Make HTTPS request through proxy
  4. Assert proxy injects rotated key, not original
• go build ./... and go vet pass locally

[github-actions]

✱ Stainless preview builds

This PR will update the hypeman SDKs with the following commit message.

feat: update egress proxy secrets on running instances

Edit this comment to update it. It will appear in the SDK's changelogs.

✅ hypeman-typescript studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ✅ → test ✅

npm install https://pkg.stainless.com/s/hypeman-typescript/3faa64789b9439d12e1bd47d6c1c8ed6843f7201/dist.tar.gz

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `patch /instances/{id}/env`

✅ hypeman-openapi studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `patch /instances/{id}/env`

✅ hypeman-go studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ✅ → test ✅

go get github.com/stainless-sdks/hypeman-go@16e8faa79c0ce44b7690649ac3172de8fc336006

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `patch /instances/{id}/env`

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-03-19 19:40:20 UTC