feat: update egress proxy secrets on running instances

[sjmiller609]

Summary

• Adds PUT /instances/{id}/env endpoint for replacing instance env vars at runtime
• Atomically updates egress proxy header-inject rules so rotated credentials take effect without restart
• New egressproxy.Service.UpdateInjectRules() method for lightweight in-place rule swap (no iptables re-application)
• New instances.Manager.UpdateInstanceEnv() method that validates credential bindings, persists metadata, and swaps proxy rules

Test plan

• Unit test: TestUpdateInjectRules — verifies in-memory rule swap and error on unregistered instance
• Integration test: extended TestEgressProxyRewritesHTTPSHeaders — rotates key mid-flight and verifies new key is injected while guest still sees mock value
• CI build and vet pass
• Manual smoke test with a running VM instance

🤖 Generated with Claude Code

[github-actions]

✱ Stainless preview builds

This PR will update the hypeman SDKs with the following commit message.

feat: update egress proxy secrets on running instances

Edit this comment to update it. It will appear in the SDK's changelogs.

✅ hypeman-typescript studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ✅ → test ✅

npm install https://pkg.stainless.com/s/hypeman-typescript/4bec5cb823e24dc0569a110f81620530ca3ad530/dist.tar.gz

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `put /instances/{id}/env`

✅ hypeman-openapi studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `put /instances/{id}/env`

✅ hypeman-go studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ✅ → test ✅

go get github.com/stainless-sdks/hypeman-go@231cd00d936abd8a17c761d3d4cd9efc69d6477e

New diagnostics (1 note)

💡 Endpoint/NotConfigured: Skipped endpoint because it's not in your Stainless config: `put /instances/{id}/env`

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-03-19 19:42:44 UTC