Execute in a session.

Run the command detached: spawn it in the background and return its PID immediately. Use for long-lived daemons (dev server, agent runner).

Stream stdout and stderr as Server-Sent Events instead of buffering the whole run into one JSON body. The response is then text/event-stream, not MachineExecResponse: frames are event: stdout|stderr|error|exit with data: lines, and the terminal exit frame carries {"exitCode": N}. Streamed output is not capped, so this is the right path for long-running or high-volume commands.

Run as this user: a name from the image or a numeric uid[:gid], overriding the image's USER. Forwarded to the machine's runtime; an older runtime that cannot honour it rejects the request rather than running the command as the wrong account.

Lossy UTF-8 stderr, capped. Prefer stderrB64.

Byte-exact stderr (base64), binary-safe and NOT truncated. Serializes as stderrB64.

Lossy UTF-8 stdout, capped (see stdout_truncated). Kept for old clients and log views; prefer stdoutB64 for byte-exact, untruncated output.

Byte-exact stdout (base64), binary-safe and NOT truncated. Preferred by clients that need fidelity (smol cloud exec). rename_all=camelCase serializes this as stdoutB64.

The user the command was run as, echoed back when the request set one. A client that asked for a user and does not see it here is talking to a control plane that predates the field and dropped it — which the client must treat as an error, never as "ran as the default account".