fix(plugin): align kubernetes config validation

packages/plugins/sandbox-providers/kubernetes/src/manifest.ts

@@ -34,15 +34,18 @@ const manifest: PaperclipPluginManifestV1 = {
           kubeconfig: {
             type: "string",
             format: "secret-ref",
+            pattern: "\\S",
             description:
               "Inline kubeconfig YAML. Paste a kubeconfig or an existing Paperclip secret reference; pasted values are stored as company secrets.",
           },
           namespacePrefix: {
             type: "string",
+            maxLength: 20,
             description: "Prefix for the per-company tenant namespace (default: paperclip-).",
           },
           companySlug: {
             type: "string",
+            maxLength: 43,
             description: "Override the auto-derived company slug used in the tenant namespace name.",
           },
           imageRegistry: {
@@ -111,7 +114,10 @@ const manifest: PaperclipPluginManifestV1 = {
           },
         },
         anyOf: [
-          { required: ["inCluster"] },
+          {
+            properties: { inCluster: { const: true } },
+            required: ["inCluster"],
+          },
           { required: ["kubeconfig"] },
         ],
       },

packages/plugins/sandbox-providers/kubernetes/src/types.ts

@@ -28,8 +28,8 @@ export const kubernetesProviderConfigSchema = z
     inCluster: z.boolean().default(false),
     kubeconfig: z.string().optional(),
 
-    namespacePrefix: z.string().regex(/^[a-z0-9-]{1,32}$/).default("paperclip-"),
-    companySlug: z.string().regex(/^[a-z0-9-]{1,32}$/).optional(),
+    namespacePrefix: z.string().regex(/^[a-z0-9-]{1,20}$/).default("paperclip-"),
+    companySlug: z.string().regex(/^[a-z0-9-]{1,43}$/).optional(),
 
     imageRegistry: z.string().url().optional(),
     imageAllowList: z.array(z.string()).default([]),
@@ -80,7 +80,7 @@ export const kubernetesProviderConfigSchema = z
     backend: z.enum(["sandbox-cr", "job"]).default("sandbox-cr"),
   })
   .refine(
-    (cfg) => cfg.inCluster || cfg.kubeconfig,
+    (cfg) => cfg.inCluster || (typeof cfg.kubeconfig === "string" && cfg.kubeconfig.trim().length > 0),
     {
       message:
         "kubernetes provider requires one of `inCluster` or `kubeconfig`",