v2.9.0

macOS binaries are now signed and notarized

The darwin universal binary (runpodctl-darwin-all.tar.gz, and the brew formula
and cask built from it) is signed with Runpod's Developer ID and notarized by
Apple, so macOS no longer refuses to run a fresh download.

The raw per-arch runpodctl-darwin-{amd64,arm64} assets are not signed. Only
pre-2.9.0 versions of runpodctl update fetch those; if you install by brew,
the install script, or the .tar.gz, you get the signed binary.

New

• runpodctl serverless run <id> --input '{"...":"..."}' — invoke an endpoint and wait for the result. Submits on /run and polls /status until the job is terminal, bounded by --wait (default 5m); --no-wait submits and prints the job id. The payload is parsed and size-checked locally, so a quoting mistake or an over-limit body fails before anything is uploaded.
• runpodctl serverless status <id> <job-id> — check a job submitted earlier.
• runpodctl serverless health <id> — worker and job counts for an endpoint.
• --wait / --wait-timeout on pod create and serverless create — block until the resource is actually usable rather than merely scheduled. A pod is ready when its public port 22 answers with an ssh banner; an endpoint when /health reports a ready or running worker. Progress goes to stderr, stdout stays a single json object, and on timeout or ctrl-c the resource is kept with its id in the error object.
• runtimeStatus + runtimeStatusReason on pod get and pod list — what the pod is actually doing (running, initializing, stopped, terminated, unknown), which desiredStatus cannot tell you. pod list also carries lastStatusChange now.
• ssh errors name the cause instead of a bare pod not ready.

Behavior changes

Additive except where noted — but these are the ones that can move under a script:

change	detail
ssh info error text	now pod not ready: <detail> instead of exactly pod not ready. Exact-match consumers break; prefix-match consumers do not
stopped pods and ssh	no longer emit an ssh_command, and are excluded from the connections inventory. The old command could never connect
empty connections	now [] rather than null
uptimeSeconds	omitted when unknown instead of reported as a constant 0. The value was always 0 in prod, so 0 was never real uptime
pod list --status	filters desiredStatus only. It does not accept the new lowercase runtimeStatus values, and the flag help now says so
model add --wait-for-hash timeout	now reports error code timeout where it reported cli_error. Exit code and message text are unchanged, so only a script branching on the stderr json code field is affected

New error codes: timeout, job_failed, wait_timeout, wait_interrupted. The
two wait_* codes always carry the created resource's id in the error object's
id field — a wait that gives up never deletes what it created.

Changelog

• c094cac feat(serverless): add health, run and status commands (CON-688) (#316)
• b9f5343 feat(pod,serverless): add --wait and --wait-timeout to create (CON-689) (#317)
• 7113ca6 feat(pod): expose real pod runtime state on pod get and list (CON-690) (#315)
• 05ebe21 fix: sign and notarize macos binary (CON-787) (#321)