daytona 0.198.0 → 0.200.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2003b4293b8ee69d171ad86402151e2924b814022649097deb51da19da6ff58
-  data.tar.gz: 30884a506c2dd332c804f995dd2d3afc654cf75b0fa66e4bf54cdd4a38909c12
+  metadata.gz: de70d9e56ce97468d9ef3bcf8c7dbe0b70f74ee7e64a7ac1d0e8642857a3c257
+  data.tar.gz: 3cec447b03a65f42bcd84c49e719cd8771a1404f496384afd5e797b429e47fb1
 SHA512:
-  metadata.gz: f4627f864da4ae028a19d856a014da0f3513e30a5a8c7299148d89d815a82b13a2c0de3bc8fc3dc4e96ca7a455ee9ef9e291fe71dd58f57e12af8e85ebcbd3d1
-  data.tar.gz: c8b07b46dfb64043794af1d4d33db1ca3ac49c1271ebde8eae3b2c9e05ca66030e780d2fbb5cede035c564c03a69f0abba68d87ff098bac36d198fe3ab1d2636
+  metadata.gz: 91c94980be6003996bbbf4b447b170e9165cbc3a47e78c47f91886f28accd5f7b083b04903fc59dede9bbe56ccdcaf9957da73e07202e762ca928203274b2c8b
+  data.tar.gz: db39e610c03a011d4c2468475393ca7b7bd17cc1087dbb0edd46c9fc6959da18e0ca61d861485ca0b27faa8ccb4061f631ec44c97d90d8e6bea7db75317db4e3

data/lib/daytona/common/daytona.rb

@@ -56,6 +56,9 @@ module Daytona
     # @return [String, nil] Comma-separated list of allowed domains for the Sandbox
     attr_accessor :domain_allow_list
 
+    # @return [Integer, nil] Time to live in minutes (0 to disable)
+    attr_accessor :ttl_minutes
+
     # @return [Boolean, nil] Whether the Sandbox should be ephemeral
     attr_accessor :ephemeral
 
@@ -83,6 +86,7 @@ module Daytona
     # @param network_block_all [Boolean, nil] Whether to block all network access for the Sandbox
     # @param network_allow_list [String, nil] Comma-separated list of allowed CIDR network addresses for the Sandbox
     # @param domain_allow_list [String, nil] Comma-separated list of allowed domains for the Sandbox
+    # @param ttl_minutes [Integer, nil] Time to live in minutes (0 to disable)
     # @param ephemeral [Boolean, nil] Whether the Sandbox should be ephemeral
     # @param linked_sandbox [String, nil] ID or name of an existing Sandbox to link the new Sandbox to
     def initialize( # rubocop:disable Metrics/MethodLength, Metrics/ParameterLists
@@ -96,6 +100,7 @@ module Daytona
       auto_pause_interval: nil,
       auto_archive_interval: nil,
       auto_delete_interval: nil,
+      ttl_minutes: nil,
       volumes: nil,
       secrets: nil,
       network_block_all: nil,
@@ -114,6 +119,7 @@ module Daytona
       @auto_pause_interval = auto_pause_interval
       @auto_archive_interval = auto_archive_interval
       @auto_delete_interval = auto_delete_interval
+      @ttl_minutes = ttl_minutes
       @volumes = volumes
       @secrets = secrets
       @network_block_all = network_block_all
@@ -141,6 +147,7 @@ module Daytona
         auto_pause_interval:,
         auto_archive_interval:,
         auto_delete_interval:,
+        ttl_minutes:,
         volumes:,
         secrets:,
         network_block_all:,
@@ -193,6 +200,7 @@ module Daytona
     # @param auto_pause_interval [Integer, nil] Auto-pause interval in minutes
     # @param auto_archive_interval [Integer, nil] Auto-archive interval in minutes
     # @param auto_delete_interval [Integer, nil] Auto-delete interval in minutes
+    # @param ttl_minutes [Integer, nil] Time to live in minutes (0 to disable)
     # @param volumes [Array<DaytonaApiClient::SandboxVolume>, nil] List of volumes mounts to attach to the Sandbox
     # @param secrets [Hash<String, String>, nil] Organization Secrets to expose in the Sandbox, as a
     #   mapping of env var name to existing Secret name
@@ -235,6 +243,7 @@ module Daytona
     # @param auto_pause_interval [Integer, nil] Auto-pause interval in minutes
     # @param auto_archive_interval [Integer, nil] Auto-archive interval in minutes
     # @param auto_delete_interval [Integer, nil] Auto-delete interval in minutes
+    # @param ttl_minutes [Integer, nil] Time to live in minutes (0 to disable)
     # @param volumes [Array<DaytonaApiClient::SandboxVolume>, nil] List of volumes mounts to attach to the Sandbox
     # @param secrets [Hash<String, String>, nil] Organization Secrets to expose in the Sandbox, as a
     #   mapping of env var name to existing Secret name

data/lib/daytona/common/socketio_client.rb

@@ -5,6 +5,7 @@
 
 require 'timeout'
 
+require 'openssl'
 require 'websocket-client-simple'
 require 'json'
 require 'uri'
@@ -52,6 +53,8 @@ module Daytona
       @connected = false
       @mutex = Mutex.new
       @write_mutex = Mutex.new
+      @verify_mutex = Mutex.new
+      @tls_verified = nil
       @health_thread = nil
       @ping_interval = 25
       @ping_timeout = 20
@@ -67,13 +70,24 @@ module Daytona
       ws_url = build_ws_url
       connected_queue = Queue.new
 
+      # Reset per-connection TLS state so a reconnect re-verifies its new socket
+      # instead of reusing a cached result from the previous connection.
+      @verify_mutex.synchronize { @tls_verified = nil }
+
       # Capture self because websocket-client-simple uses instance_exec for callbacks
       client = self
 
       # Register callbacks inside the connect block so they are installed before the
       # socket dials — otherwise the Engine.IO handshake can arrive before :message
       # is bound, stalling the connection into a polling fallback/timeout.
-      @ws = WebSocket::Client::Simple.connect(ws_url) do |ws|
+      #
+      # verify_mode is passed explicitly: websocket-client-simple builds its own
+      # SSLContext and defaults to no certificate verification (VERIFY_NONE).
+      @ws = WebSocket::Client::Simple.connect(ws_url, verify_mode: OpenSSL::SSL::VERIFY_PEER) do |ws|
+        # Capture the client before its reader thread starts so #verify_tls_peer!
+        # can reach the SSL socket even when a frame arrives before .connect returns.
+        @ws = ws
+
         ws.on :message do |msg|
           client.send(:handle_raw_message, msg.data.to_s, connected_queue)
         end
@@ -104,15 +118,26 @@ module Daytona
         end
       end
 
-      # Wait for connection with timeout
       result = nil
       begin
-        Timeout.timeout(@connect_timeout) { result = connected_queue.pop }
+        Timeout.timeout(@connect_timeout) do
+          ensure_tls_verified!(connected_queue)
+          result = connected_queue.pop
+          if result == :open
+            send_connect_auth
+            result = connected_queue.pop
+          end
+        end
       rescue Timeout::Error
         close
         raise "WebSocket connection timed out after #{@connect_timeout}s"
       end
 
+      if result.is_a?(OpenSSL::SSL::SSLError)
+        close
+        raise result
+      end
+
       if result != :connected
         close
         raise "WebSocket connection failed: #{result}"
@@ -141,6 +166,46 @@ module Daytona
 
     private
 
+    # Verify the TLS peer's hostname exactly once, before any inbound frame is
+    # processed and before the auth frame is sent. websocket-client-simple
+    # verifies the certificate chain (VERIFY_PEER) during the handshake but never
+    # checks that the certificate matches the host, and its reader thread starts
+    # before #connect regains control — so a certificate that is valid for the
+    # wrong host could otherwise inject Socket.IO events (and receive the CONNECT
+    # auth frame) before verification runs. Gating both the reader path and the
+    # connect path guarantees no frame reaches the dispatcher, and no credentials
+    # are sent, until the peer is verified.
+    # @return [Boolean] true when verified (or plaintext ws://, no TLS peer to
+    #   check); false on failure, after signalling the connecting thread.
+    def ensure_tls_verified!(connected_queue)
+      @verify_mutex.synchronize do
+        return @tls_verified unless @tls_verified.nil?
+
+        begin
+          verify_tls_peer!
+          @tls_verified = true
+        rescue OpenSSL::SSL::SSLError => e
+          @tls_verified = false
+          @mutex.synchronize { @connected = false }
+          connected_queue&.push(e)
+        end
+
+        @tls_verified
+      end
+    end
+
+    def verify_tls_peer!
+      socket = @ws&.instance_variable_get(:@socket)
+      return unless socket.is_a?(OpenSSL::SSL::SSLSocket)
+
+      socket.post_connection_check(URI.parse(@api_url).host)
+    end
+
+    def send_connect_auth
+      auth = JSON.generate({ token: @token })
+      send_raw("#{EIO_MESSAGE}#{SIO_CONNECT}#{auth}")
+    end
+
     def build_ws_url
       parsed = URI.parse(@api_url)
       ws_scheme = parsed.scheme == 'https' ? 'wss' : 'ws'
@@ -160,6 +225,11 @@ module Daytona
     def handle_raw_message(raw, connected_queue)
       return if raw.nil? || raw.empty?
 
+      # Drop every frame from a peer whose hostname is not yet verified. The
+      # reader thread can run before #connect verifies, so this is the gate that
+      # stops a wrong-host peer from injecting events or eliciting the auth frame.
+      return unless ensure_tls_verified!(connected_queue)
+
       # Track all server activity for health monitoring.
       # If the server stops sending ANY data (pings, events, etc.)
       # the health monitor will detect the dead connection.
@@ -175,9 +245,10 @@ module Daytona
         rescue JSON::ParserError
           # Use default ping interval
         end
-        # Send Socket.IO CONNECT with auth
-        auth = JSON.generate({ token: @token })
-        send_raw("#{EIO_MESSAGE}#{SIO_CONNECT}#{auth}")
+        # Signal the connecting thread instead of sending the CONNECT auth frame
+        # here: the token must not leave this process until the connecting thread
+        # has completed TLS peer verification (see #connect).
+        connected_queue&.push(:open)
 
       when EIO_PING
         # Server heartbeat — respond immediately with PONG

data/lib/daytona/daytona.rb

@@ -99,7 +99,7 @@ module Daytona
     #
     # @param params [Daytona::CreateSandboxFromSnapshotParams, Daytona::CreateSandboxFromImageParams, Nil] Sandbox creation parameters
     # @return [Daytona::Sandbox] The created sandbox
-    # @raise [Daytona::Sdk::Error] If auto_stop_interval, auto_pause_interval, or auto_archive_interval is negative,
+    # @raise [Daytona::Sdk::Error] If auto_stop_interval, auto_pause_interval, auto_archive_interval, or ttl_minutes is negative,
     #   or if auto_stop_interval and auto_pause_interval are both non-zero
     def create(params = nil, on_snapshot_create_logs: nil)
       if params.nil?
@@ -237,7 +237,7 @@ module Daytona
     # @param timeout [Numeric] Maximum wait time in seconds (defaults to 60 s).
     # @param on_snapshot_create_logs [Proc]
     # @return [Daytona::Sandbox] The created sandbox
-    # @raise [Daytona::Sdk::Error] If auto_stop_interval, auto_pause_interval, or auto_archive_interval is negative,
+    # @raise [Daytona::Sdk::Error] If auto_stop_interval, auto_pause_interval, auto_archive_interval, or ttl_minutes is negative,
     #   or if auto_stop_interval and auto_pause_interval are both non-zero
     def _create(params, timeout: 60, on_snapshot_create_logs: nil)
       raise Sdk::Error, 'Timeout must be a non-negative number' if timeout.negative?
@@ -261,6 +261,8 @@ module Daytona
         raise Sdk::Error, 'auto_archive_interval must be a non-negative integer'
       end
 
+      raise Sdk::Error, 'ttl_minutes must be a non-negative integer' if params.ttl_minutes&.negative?
+
       labels = params.labels&.dup || {}
       labels[CODE_TOOLBOX_LANGUAGE_LABEL] = params.language.to_s if params.language
 
@@ -274,6 +276,7 @@ module Daytona
         auto_pause_interval: params.auto_pause_interval,
         auto_archive_interval: params.auto_archive_interval,
         auto_delete_interval: params.auto_delete_interval,
+        ttl_minutes: params.ttl_minutes,
         volumes: params.volumes,
         secrets: params.secrets&.map { |env_var, secret_name| { env_var.to_s => secret_name.to_s } },
         network_block_all: params.network_block_all,

data/lib/daytona/sandbox.rb

@@ -140,6 +140,9 @@ module Daytona
     #   Not returned by list results; call #refresh on each item to populate.
     attr_reader :build_info
 
+    # @return [String, nil] When the sandbox will be automatically destroyed (nil if no TTL is set)
+    attr_reader :auto_destroy_at
+
     # @return [String] The creation timestamp of the sandbox
     attr_reader :created_at
 
@@ -354,6 +357,19 @@ module Daytona
       @auto_pause_interval = interval
     end
 
+    # Sets the TTL (time to live) for the Sandbox.
+    # The TTL is re-anchored from the current time. When it elapses the Sandbox is destroyed,
+    # regardless of its current state. Use 0 to disable.
+    #
+    # @param minutes [Integer]
+    # @return [void]
+    # @raise [Daytona::Sdk::Error]
+    def ttl_minutes=(minutes)
+      raise Sdk::Error, 'TTL must be a non-negative integer' if minutes.negative?
+
+      sandbox_api.set_ttl(id, minutes)
+    end
+
     # Creates an SSH access token for the sandbox.
     #
     # @param expires_in_minutes [Integer] TThe number of minutes the SSH access token will be valid for
@@ -821,6 +837,7 @@ module Daytona
                 :experimental_fork, :experimental_create_snapshot, :pause
 
     instrument :archive, :auto_archive_interval=, :auto_delete_interval=, :auto_pause_interval=, :auto_stop_interval=,
+               :ttl_minutes=,
                :update_network_settings, :update_secrets, :update_env,
                :create_ssh_access, :delete, :get_user_home_dir, :get_work_dir, :get_metrics, :get_metrics_latest,
                :labels=,
@@ -973,6 +990,7 @@ module Daytona
       @auto_pause_interval = sandbox_dto.auto_pause_interval
       @auto_archive_interval = sandbox_dto.auto_archive_interval
       @auto_delete_interval = sandbox_dto.auto_delete_interval
+      @auto_destroy_at = sandbox_dto.auto_destroy_at
       @created_at = sandbox_dto.created_at
       @updated_at = sandbox_dto.updated_at
       @last_activity_at = sandbox_dto.last_activity_at

data/lib/daytona/sdk/version.rb

@@ -5,6 +5,6 @@
 
 module Daytona
   module Sdk
-    VERSION = '0.198.0'
+    VERSION = '0.200.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: daytona
 version: !ruby/object:Gem::Version
-  version: 0.198.0
+  version: 0.200.0
 platform: ruby
 authors:
 - Daytona Platforms Inc.
@@ -85,42 +85,42 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.198.0
+        version: 0.200.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.198.0
+        version: 0.200.0
 - !ruby/object:Gem::Dependency
   name: daytona_api_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.198.0
+        version: 0.200.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.198.0
+        version: 0.200.0
 - !ruby/object:Gem::Dependency
   name: daytona_toolbox_api_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.198.0
+        version: 0.200.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.198.0
+        version: 0.200.0
 - !ruby/object:Gem::Dependency
   name: dotenv
   requirement: !ruby/object:Gem::Requirement