[xiaods]

Two independent fixes, each verified against a live cluster.

1. k8e-sandbox-cli run --raw prints plain text — and the exit code

--raw is documented as "Stream raw output (no JSON wrapper)". It only
dropped the CLI's JSON wrapper; what came out was the server's SSE
framing, whose payloads are base64:

$ k8e-sandbox-cli run --raw "printf '\033[36m★\033[0m\n'"
data: {"stdout":"JiozMzZtMOKCrQ=="}
data: {"exit":0}

The base64 is deliberate — it is what stops a newline or a half-written
ANSI escape from breaking a frame boundary — but the client has to decode
it. It also always reported success: the exit code lives in the terminal
{"exit":N} frame, which nobody was reading, so run --raw "exit 3"
reported 0.

The decoding now lives in pkg/sandbox/envdstream, shared by the e2b
server and the CLI so the two cannot drift apart; the server's private
parseChannelFrame became a thin wrapper over it.

Frames are decoded as they arrive. The gRPC layer forwards the SSE body in
fixed 4096-byte chunks, so one chunk can hold several frames and a frame
can be split across two — the decoder buffers the remainder.

• stdout payloads → stdout, stderr payloads → stderr
• the {"exit":N} frame → the command's exit code
• the {"pid":N} start frame → dropped, so it cannot corrupt the output
• a frame that is not an envd output frame → passed through unchanged

$ k8e-sandbox-cli run --raw "printf '\033[1;36m★ K8E SANDBOX ★\033[0m\n'"
^[[1;36m★ K8E SANDBOX ★^[[0m
$ k8e-sandbox-cli run --raw "exit 3"; echo $?
3
$ k8e-sandbox-cli run --raw "python3 -c \"print('x'*20000)\"" | wc -c
20001

2. The e2b surface over the Gateway's :443 listener

The e2b Gateway declares three listeners — http (:80), https (:443) and
grpc (:50051) — but both HTTPRoutes were attached to the http listener
only. The :443 listener had zero routes and answered 404, so an E2B
client configured with an https:// apiUrl could not talk to the cluster
at all.

The routes were bound to :80 alone on purpose: the :443 listener needs a
TLS secret (sandbox-e2b) and reports Invalid without one, and a route
attached to an invalid listener is rejected with NotAllowedByListeners.
The original comment feared that attaching both listeners to one route
would take the working :80 path down with it.

Each listener now gets its own route object, so a rejected attachment
fails only the HTTPS route:

route	listener
e2b-control-plane	http
e2b-envd	http
e2b-control-plane-tls	https (new)
e2b-envd-tls	https (new)

apiUrl     = https://<gateway>            (control plane)
sandboxUrl = https://<gateway>/e2b/envd   (envd data plane)

The client must trust the sandbox CA — the gateway presents the same
private CA the sandbox gRPC gateway uses. Install it in the client's OS
trust store: the E2B SDK's transport reads the system store, and the
SSL_CERT_FILE / REQUESTS_CA_BUNDLE environment variables are ignored
by it.

Verified against a live cluster with the official SDK 2.56.0:

$ kubectl get gateway e2b -o jsonpath='{...attachedRoutes}'
http attachedRoutes=2   https attachedRoutes=2   grpc attachedRoutes=1
$ curl -sk https://<gateway>/health                          -> 200
$ curl -sk -X POST -H "X-API-KEY: $KEY" https://<gateway>/v2/sandboxes
                                                                 -> 201
$ E2B_API_URL=https://<gateway> ... python (e2b 2.56.0)
    stdout: 42 | exit: 0
    read  : hello over https
guide Level 1-5 over HTTPS: 6/6

HTTP and HTTPS serve the same surface at the same time.

Also in this PR

pkg/deploy/zz_generated_bindata.go is regenerated: the e2b-gateway
addon is embedded into the binary as compressed bindata, so the manifest
edit only reaches the cluster if the bindata is regenerated. Without it a
released binary would still stage the pre-#671 manifest and the :443
routes would never be created.

Tests

• pkg/sandbox/envdstream: 12 new cases — frame parsing, both prefix
  forms, a frame split across chunks, several frames in one chunk,
  unknown frames passed through, control characters surviving the round
  trip
• pkg/sandboxcli: 5 new cases — stdout/stderr separation, ANSI
  preserved, exit code captured, pid frame not printed, unknown frame
  passed through

sandboxd: 61/61 (unchanged). Go: 38/38 packages.

[github-actions]

Test Results

1 041 tests  +17   1 014 ✅ +17   7m 6s ⏱️ -9s
  121 suites + 1      27 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit 0657aec. ± Comparison against base commit 23afaa2.

♻️ This comment has been updated with latest results.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud