feat(sdk): add version() API to all SDKs (Rust, Go, Python, JS)

Add Version RPC support so SDKs can detect the guest-agent version and
determine supported capabilities. On OS < 0.5.7 (which lacks the
Version RPC), the call will fail, indicating only secp256k1 is safe to
use. This prevents silent misuse of ed25519 on old OS versions that
would ignore the algorithm field and return secp256k1 keys instead.

Author: kvinwang

sdk/go/dstack/client.go

@@ -460,6 +460,29 @@ func (c *DstackClient) Attest(ctx context.Context, reportData []byte) (*AttestRe
 	return &AttestResponse{Attestation: attestation}, nil
 }
 
+// Represents the response from a Version request.
+type VersionResponse struct {
+	Version string `json:"version"`
+	Rev     string `json:"rev"`
+}
+
+// Gets the guest-agent version.
+//
+// Returns the version on OS >= 0.5.7.
+// Returns an error on older OS versions that lack the Version RPC.
+func (c *DstackClient) GetVersion(ctx context.Context) (*VersionResponse, error) {
+	data, err := c.sendRPCRequest(ctx, "/Version", map[string]interface{}{})
+	if err != nil {
+		return nil, err
+	}
+
+	var response VersionResponse
+	if err := json.Unmarshal(data, &response); err != nil {
+		return nil, err
+	}
+	return &response, nil
+}
+
 // Sends a request to get information about the CVM instance
 func (c *DstackClient) Info(ctx context.Context) (*InfoResponse, error) {
 	data, err := c.sendRPCRequest(ctx, "/Info", map[string]interface{}{})

sdk/js/src/index.ts

@@ -104,6 +104,13 @@ export interface AttestResponse {
   attestation: Hex
 }
 
+export interface VersionResponse {
+  __name__: Readonly<'VersionResponse'>
+
+  version: string
+  rev: string
+}
+
 export function to_hex(data: string | Buffer | Uint8Array): string {
   if (typeof data === 'string') {
     return Buffer.from(data).toString('hex');
@@ -281,6 +288,20 @@ export class DstackClient<T extends TcbInfo = TcbInfoV05x> {
     })
   }
 
+  /**
+   * Query the guest-agent version.
+   *
+   * Returns the version on OS >= 0.5.7.
+   * Throws on older OS versions that lack the Version RPC.
+   */
+  async version(): Promise<VersionResponse> {
+    const result = await send_rpc_request<{ version: string, rev: string }>(this.endpoint, '/Version', '{}')
+    return Object.freeze({
+      ...result,
+      __name__: 'VersionResponse',
+    })
+  }
+
   async isReachable(): Promise<boolean> {
     try {
       // Use info endpoint to test connectivity with 500ms timeout

sdk/python/src/dstack_sdk/__init__.py

@@ -15,6 +15,7 @@
 from .dstack_client import TappdClient
 from .dstack_client import TcbInfo
 from .dstack_client import VerifyResponse
+from .dstack_client import VersionResponse
 from .encrypt_env_vars import EnvVar
 from .encrypt_env_vars import encrypt_env_vars
 from .encrypt_env_vars import encrypt_env_vars_sync
@@ -38,6 +39,7 @@
     "InfoResponse",
     "TcbInfo",
     "EventLog",
+    "VersionResponse",
     # Utility functions
     "encrypt_env_vars_sync",
     "encrypt_env_vars",

sdk/python/src/dstack_sdk/dstack_client.py

@@ -199,6 +199,11 @@ class VerifyResponse(BaseModel):
     valid: bool
 
 
+class VersionResponse(BaseModel):
+    version: str
+    rev: str
+
+
 class EventLog(BaseModel):
     imr: int
     event_type: int
@@ -498,6 +503,15 @@ async def verify(
         result = await self._send_rpc_request("Verify", payload)
         return VerifyResponse(**result)
 
+    async def version(self) -> VersionResponse:
+        """Query the guest-agent version.
+
+        Returns the version on OS >= 0.5.7.
+        Raises an error on older OS versions that lack the Version RPC.
+        """
+        result = await self._send_rpc_request("Version", {})
+        return VersionResponse(**result)
+
     async def is_reachable(self) -> bool:
         """Return True if the service responds to a quick health call."""
         try:
@@ -588,6 +602,11 @@ def verify(
         """Verify a signature."""
         raise NotImplementedError
 
+    @call_async
+    def version(self) -> VersionResponse:
+        """Query the guest-agent version."""
+        raise NotImplementedError
+
     @call_async
     def is_reachable(self) -> bool:
         """Return True if the service responds to a quick health call."""

sdk/rust/src/dstack_client.rs

@@ -171,6 +171,16 @@ impl DstackClient {
         Ok(InfoResponse::validated_from_value(response)?)
     }
 
+    /// Query the guest-agent version.
+    ///
+    /// Returns `Ok(VersionResponse)` on OS >= 0.5.7.
+    /// Returns an error on older OS versions that lack the Version RPC.
+    pub async fn version(&self) -> Result<VersionResponse> {
+        let response = self.send_rpc_request("/Version", &json!({})).await?;
+        let response = serde_json::from_value::<VersionResponse>(response)?;
+        Ok(response)
+    }
+
     pub async fn emit_event(&self, event: String, payload: Vec<u8>) -> Result<()> {
         if event.is_empty() {
             anyhow::bail!("Event name cannot be empty")

sdk/rust/types/src/dstack.rs

@@ -278,3 +278,14 @@ pub struct VerifyResponse {
     /// Whether the signature is valid
     pub valid: bool,
 }
+
+/// Response from a Version request
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[cfg_attr(feature = "borsh", derive(BorshSerialize, BorshDeserialize))]
+#[cfg_attr(feature = "borsh_schema", derive(BorshSchema))]
+pub struct VersionResponse {
+    /// The dstack version (e.g. "0.5.7")
+    pub version: String,
+    /// Git revision
+    pub rev: String,
+}