CLI: Update Hypeman Go SDK to 134587a222aca6307bb75dd0dbd78bf3f604c114

[kernel-internal]

This PR updates the Hypeman Go SDK dependency to the latest version.

SDK Update

• Updated hypeman-go to 134587a222aca6307bb75dd0dbd78bf3f604c114

Coverage Analysis

A full enumeration of SDK methods and CLI commands was performed. No coverage gaps were found.

All 63 endpoints in api.md have a CLI command. client.Instances.Logs and client.Builds.Events are consumed through their streaming variants (LogsStreaming in hypeman logs, EventsStreaming in hypeman build), and client.Instances.Get, client.Instances.Stat, client.Volumes.NewFromArchive and client.Health.Check remain internal as documented. The method surface is unchanged from the previously pinned SDK: both versions report configured_endpoints: 63 and an identical method list.

Heads up: this SDK bump reduces the generated API surface

The previous pin, e6c2b7b, is on the SDK's next branch, not main. 134587a is a main commit carrying the 2026-09-30 vulnerability remediation, so it does not include the "Windows hypervisor primitives" generation from next. Two symbols the branch depended on no longer exist, which broke the build:

Removed symbol	Used by	Added in
InstanceLogsParamsSourceSwtpm	hypeman logs --source swtpm	4ad8ab1
InstanceGPU.DevicePath	formatGPU in hypeman ps	b73f664

openapi.yaml on main still specifies both (source enum is [app, vmm, hypeman, swtpm], and device_path is on the GPU schema), so the API supports them and only the generated bindings lag. Rather than regress two shipped features, this PR reaches them without the generated types:

• source is a string-backed enum, so a local instanceLogsSourceSwtpm constant serializes identically. Verified against a test server: --source swtpm sends source=swtpm.
• device_path arrives in JSON.ExtraFields, so formatGPU decodes it from there. Note that respjson.Field.Valid() reports false for extra fields, so the raw JSON is decoded instead.

Both are commented at the call site and should go back to typed access once next merges to main.

Also included is a merge of main into this branch (commit 5774c56), resolving a go.sum conflict. History was preserved rather than rebased, so no force push was needed.

Triggered by: kernel/hypeman-go@134587a
Reviewer: @ulziibay-kernel

---

Note

Low Risk
Mostly dependency pins and small CLI shims for untyped API fields; behavior is covered by new unit tests with no auth or data-path changes.

Overview
Pins hypeman-go to 134587a (main) and refreshes docker/docker plus go.sum as part of the dependency update.

The newer SDK no longer generates InstanceLogsParamsSourceSwtpm or InstanceGPU.DevicePath, even though the API still supports them. This PR keeps those behaviors in the CLI without waiting on regenerated types:

hypeman logs documents swtpm as a --source option, validates sources case-insensitively via parseInstanceLogsSource, and uses a local instanceLogsSourceSwtpm constant where the SDK constant is missing.

hypeman ps still shows vgpu when a GPU has no profile by treating device_path from JSON.ExtraFields the same as mdev_uuid (VFIO hosts).

Tests cover mixed-case log sources and GPU rows with device_path only.

^{Reviewed by Cursor Bugbot for commit 22e9c31. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 22e9c31. Configure here.}

[cursor]

Insufficient docker dependency pin

Medium Severity

go.mod now pins github.com/docker/docker to a pseudo-version instead of upgrading go-containerregistry. That keeps the old docker client on the graph, so a pin in this range may not include the docker cp fix for GHSA-rg2x-37c3-w2rh.

 

^{Triggered by learned rule: Prefer upgrading go-containerregistry over docker/docker replace pins}

^{Reviewed by Cursor Bugbot for commit 22e9c31. Configure here.}