microsandbox-rb 0.9.2 → 0.11.0

data/ext/microsandbox/src/sandbox.rs

@@ -18,10 +18,11 @@ use microsandbox::logs::{
     LogCursor, LogEntry, LogOptions, LogSource, LogStreamOptions, LogStreamStart,
 };
 use microsandbox::sandbox::{
-    AttachOptionsBuilder, DiskImageFormat, FsEntry, FsEntryKind, FsMetadata, HostPermissions,
-    Patch, PullPolicy, PullProgress, PullProgressHandle, RlimitResource, SandboxBuilder,
-    SandboxFilter, SandboxHandle, SandboxMetrics, SandboxStatus, SandboxStopResult, SecretBuilder,
-    SecurityProfile, StatVirtualization,
+    AttachOptionsBuilder, DiskImageFormat, EnvVar, FsEntry, FsEntryKind, FsMetadata,
+    HostPermissions, Patch, PullPolicy, PullProgress, PullProgressHandle, RlimitResource,
+    RootDiskBuilder, SandboxBuilder, SandboxFilter, SandboxHandle, SandboxMetrics,
+    SandboxModificationBuilder, SandboxModificationPatch, SandboxStatus, SandboxStopResult,
+    SecretBuilder, SecretModificationPatch, SecretSource, SecurityProfile, StatVirtualization,
 };
 use microsandbox::LogLevel;
 use microsandbox::MicrosandboxResult;
@@ -29,7 +30,8 @@ use microsandbox::RegistryAuth;
 use microsandbox_network::builder::ViolationActionBuilder;
 use microsandbox_network::dns::Nameserver;
 use microsandbox_network::policy::{
-    Action, Destination, DestinationGroup, Direction, NetworkPolicy, PortRange, Protocol, Rule,
+    Action, Destination, DestinationGroup, Direction, NetworkPolicy, NetworkProfile, PortRange,
+    Protocol, Rule,
 };
 use tokio::sync::Mutex;
 use tokio::task::JoinHandle;
@@ -92,9 +94,19 @@ impl Sandbox {
         if let Some(v) = conv::opt_u8(opts, "cpus")? {
             b = b.cpus(v);
         }
+        // v0.6.6 (#1099): boot-time maximum vCPU / memory ceilings that a later
+        // live `modify` can grow up to. `cpus`/`memory` above already raise these
+        // to their own value if lower, so a bare `cpus`/`memory` still works;
+        // setting these explicitly reserves headroom for a live resize.
+        if let Some(v) = conv::opt_u8(opts, "max_cpus")? {
+            b = b.max_cpus(v);
+        }
         if let Some(v) = conv::opt_u32(opts, "memory")? {
             b = b.memory(v);
         }
+        if let Some(v) = conv::opt_u32(opts, "max_memory")? {
+            b = b.max_memory(v);
+        }
         if let Some(v) = conv::opt_string(opts, "workdir")? {
             b = b.workdir(v);
         }
@@ -155,6 +167,10 @@ impl Sandbox {
             let host_perms = conv::opt_string(m, "host_permissions")?
                 .map(|s| host_permissions_from_str(&s))
                 .transpose()?;
+            // v0.6.7: mount-root symlink protection is on by default; this is
+            // the per-mount opt-out. Valid for bind/named-directory mounts —
+            // the core rejects it elsewhere at build().
+            let follow_root_symlinks = conv::opt::<bool>(m, "follow_root_symlinks")?;
             // bind/named/disk require a source; tmpfs must not have one.
             match kind.as_str() {
                 "bind" | "named" | "disk" if source.is_some() => {}
@@ -207,6 +223,9 @@ impl Sandbox {
                 if let Some(hp) = host_perms {
                     mb = mb.host_permissions(hp);
                 }
+                if let Some(follow) = follow_root_symlinks {
+                    mb = mb.follow_root_symlinks(follow);
+                }
                 mb
             });
         }
@@ -219,18 +238,29 @@ impl Sandbox {
         if let Some(net) = conv::opt_string(opts, "network")? {
             match net.as_str() {
                 "none" | "disabled" | "disable" | "airgapped" => b = b.disable_network(),
-                // Default policy is public-only, so no builder call is needed.
-                "public" | "public_only" | "default" => {}
                 "all" | "allow_all" => b = b.network(|n| n.policy(NetworkPolicy::allow_all())),
-                "non_local" | "nonlocal" => b = b.network(|n| n.policy(NetworkPolicy::non_local())),
                 other => {
                     return Err(error::base_error(format!(
-                        "unknown network mode {other:?} (expected one of \
-                         public_only/none/allow_all/non_local)"
+                        "unknown network mode {other:?} (expected none/allow_all; compose \
+                         public/private/host access via network profiles)"
                     )))
                 }
             }
         }
+        // Composable network profiles (v0.6.7): expanded to the canonical rule
+        // set plus a gateway-DNS allow by the core's
+        // `NetworkPolicy::from_profiles`. The Ruby layer routes
+        // `network: [:public, :host]` (and single-profile sugar) here. An empty
+        // profile set never reaches this key — the Ruby layer sends it as an
+        // explicit empty custom policy, which has identical semantics.
+        let profile_names = conv::opt_string_vec(opts, "network_profiles")?;
+        if !profile_names.is_empty() {
+            let profiles = profile_names
+                .iter()
+                .map(|s| network_profile_from_str(s))
+                .collect::<Result<Vec<_>, Error>>()?;
+            b = b.network(move |n| n.policy(NetworkPolicy::from_profiles(profiles)));
+        }
         // Custom network policy: an ordered allow/deny rule list with per-direction
         // defaults and bulk domain denials. The Ruby layer routes bare presets to
         // the `network` key above and full policies here; mirrors the Python
@@ -250,8 +280,14 @@ impl Sandbox {
         if let Some(policy) = conv::opt_string(opts, "pull_policy")? {
             b = b.pull_policy(pull_policy_from_str(&policy)?);
         }
-        if let Some(mib) = conv::opt_u32(opts, "oci_upper_size")? {
-            b = b.oci_upper_size(mib);
+        // Writable root-disk spec for OCI sandboxes (v0.6.7): Integer = managed
+        // ext4 upper size in MiB (the pre-0.6.7 `oci_upper_size` meaning), Hash =
+        // {kind: managed|tmpfs|disk, size_mib, path, format, fstype}. The Ruby
+        // layer maps the deprecated `oci_upper_size:` kwarg to the managed kind
+        // before it reaches the wire.
+        if let Some(v) = conv::opt::<Value>(opts, "root_disk")? {
+            let spec = parse_root_disk(v)?;
+            b = b.root_disk_with(move |d| spec.apply(d));
         }
         // Registry connection settings, for private / non-default registries:
         // Basic auth (username + password/token), plain-HTTP `insecure`, and
@@ -584,6 +620,34 @@ impl Sandbox {
         Ok(metrics_to_hash(&m))
     }
 
+    //----------------------------------------------------------------------
+    // Health & modification (v0.6.6 / #1099)
+    //----------------------------------------------------------------------
+
+    /// Health-check the guest agent without refreshing the idle timer. Returns
+    /// `{ name, latency_secs }` (round-trip latency as f64 seconds; the Ruby
+    /// layer exposes both seconds and milliseconds).
+    fn ping(&self) -> Result<RHash, Error> {
+        let result = block_on(self.inner.ping()).map_err(error::to_ruby)?;
+        Ok(ping_result_to_hash(&result))
+    }
+
+    /// Explicitly refresh the idle-activity timer. Returns
+    /// `{ name, activity_seq }`.
+    fn touch(&self) -> Result<RHash, Error> {
+        let result = block_on(self.inner.touch()).map_err(error::to_ruby)?;
+        Ok(touch_result_to_hash(&result))
+    }
+
+    /// Plan or apply a live sandbox modification. `opts` is the string-keyed
+    /// modify Hash normalized by the Ruby layer; returns the resulting
+    /// `SandboxModificationPlan` as a JSON string, which the Ruby layer parses
+    /// into a `ModificationPlan`. Mirrors the Node native binding (native returns
+    /// JSON, the wrapper shapes it).
+    fn modify(&self, opts: RHash) -> Result<String, Error> {
+        run_modify(self.inner.modify(), opts)
+    }
+
     /// Read captured logs as an Array of Hashes. `opts`: tail, since_ms,
     /// until_ms, sources (Array of "stdout"/"stderr"/"output"/"system"/"all").
     fn logs(&self, opts: RHash) -> Result<RArray, Error> {
@@ -1219,12 +1283,14 @@ fn parse_tls(t: RHash) -> Result<TlsSpec, Error> {
 /// a core `NetworkPolicy`. Returns `None` when the option is absent (bare
 /// presets travel via the separate `network` key handled in `create`).
 ///
-/// Composition (mirrors the Go SDK's `NetworkConfig`): bulk domain-deny rules
-/// come first (so they outrank later allow rules), then a preset's rules (if a
-/// preset base is given), then the caller's explicit `rules`. Per-direction
-/// defaults come from the explicit `default_egress`/`default_ingress` when set,
-/// else the preset's defaults, else the asymmetric default (deny egress / allow
-/// ingress).
+/// Composition order (first-match-wins per direction): bulk domain-deny rules
+/// come first (so they outrank everything), then the caller's explicit
+/// `rules`, then the profile/preset base's expansion LAST — the same order the
+/// upstream CLI composes `--net` with explicit rules, so a narrower caller
+/// override (e.g. `Rule.deny_dns`) beats the base's allows instead of dying
+/// behind them. Per-direction defaults come from the explicit
+/// `default_egress`/`default_ingress` when set, else the base's defaults, else
+/// the asymmetric default (deny egress / allow ingress).
 fn parse_network_policy(opts: RHash) -> Result<Option<NetworkPolicy>, Error> {
     let Some(np) = conv::opt::<RHash>(opts, "network_policy")? else {
         return Ok(None);
@@ -1245,21 +1311,40 @@ fn parse_network_policy(opts: RHash) -> Result<Option<NetworkPolicy>, Error> {
         rules.push(Rule::deny_egress(Destination::DomainSuffix(suffix)));
     }
 
-    // Optional preset base (its rules and defaults seed the policy).
-    let (preset_egress, preset_ingress) = match conv::opt_string(np, "preset")? {
-        Some(p) => {
-            let mut base = network_preset(&p)?;
+    // Optional base — composable profiles (v0.6.7) or a terminal preset,
+    // mutually exclusive. Its rules and defaults seed the policy.
+    let profile_names = conv::opt_string_vec(np, "profiles")?;
+    let preset = conv::opt_string(np, "preset")?;
+    if !profile_names.is_empty() && preset.is_some() {
+        return Err(error::base_error(
+            "network profiles: and preset: are mutually exclusive",
+        ));
+    }
+    let base = if profile_names.is_empty() {
+        preset.map(|p| network_preset(&p)).transpose()?
+    } else {
+        let profiles = profile_names
+            .iter()
+            .map(|s| network_profile_from_str(s))
+            .collect::<Result<Vec<_>, Error>>()?;
+        Some(NetworkPolicy::from_profiles(profiles))
+    };
+    // Caller's explicit rules go BEFORE the base expansion: under
+    // first-match-wins, appending them after would make any override of a
+    // base-allowed destination silently dead (a more permissive policy than
+    // requested). Mirrors the upstream CLI's `--net` + rules composition.
+    for rd in conv::opt_hash_vec(np, "rules")? {
+        rules.push(parse_rule(rd)?);
+    }
+
+    let (preset_egress, preset_ingress) = match base {
+        Some(mut base) => {
             rules.append(&mut base.rules);
             (Some(base.default_egress), Some(base.default_ingress))
         }
         None => (None, None),
     };
 
-    // Caller's explicit rules come after preset rules.
-    for rd in conv::opt_hash_vec(np, "rules")? {
-        rules.push(parse_rule(rd)?);
-    }
-
     let default_egress = match conv::opt_string(np, "default_egress")? {
         Some(s) => action_from_str(&s)?,
         None => preset_egress.unwrap_or(Action::Deny),
@@ -1279,18 +1364,105 @@ fn parse_network_policy(opts: RHash) -> Result<Option<NetworkPolicy>, Error> {
 fn network_preset(p: &str) -> Result<NetworkPolicy, Error> {
     Ok(match p {
         "none" | "disabled" | "disable" | "airgapped" => NetworkPolicy::none(),
-        "public" | "public_only" | "public-only" | "default" => NetworkPolicy::public_only(),
         "all" | "allow_all" | "allow-all" => NetworkPolicy::allow_all(),
-        "non_local" | "non-local" | "nonlocal" => NetworkPolicy::non_local(),
         other => {
             return Err(error::base_error(format!(
-                "unknown network preset {other:?} (expected one of \
-                 public_only/none/allow_all/non_local)"
+                "unknown network preset {other:?} (expected none/allow_all; the removed \
+                 public_only/non_local presets are replaced by composable profiles)"
             )))
         }
     })
 }
 
+fn network_profile_from_str(s: &str) -> Result<NetworkProfile, Error> {
+    match s {
+        "public" => Ok(NetworkProfile::Public),
+        "private" => Ok(NetworkProfile::Private),
+        "host" => Ok(NetworkProfile::Host),
+        other => Err(error::base_error(format!(
+            "unknown network profile {other:?} (expected public/private/host)"
+        ))),
+    }
+}
+
+/// Parsed `root_disk` create option. Integer shorthand = managed upper of N
+/// MiB (mirrors Python's `root_disk=8192` and the CLI bare-size form); Hash =
+/// explicit kind. Kind/field cross-validation (size on a disk image, etc.)
+/// lives in the Ruby layer and the core builder — this stays a dumb carrier.
+struct RootDiskSpec {
+    kind: RootDiskKindSpec,
+    size_mib: Option<u32>,
+    format: Option<DiskImageFormat>,
+    fstype: Option<String>,
+}
+
+enum RootDiskKindSpec {
+    Managed,
+    Tmpfs,
+    Disk(String),
+}
+
+impl RootDiskSpec {
+    fn apply(self, mut d: RootDiskBuilder) -> RootDiskBuilder {
+        match self.kind {
+            RootDiskKindSpec::Managed => {}
+            RootDiskKindSpec::Tmpfs => d = d.tmpfs(),
+            RootDiskKindSpec::Disk(path) => d = d.disk_image(path),
+        }
+        if let Some(mib) = self.size_mib {
+            d = d.size(mib);
+        }
+        if let Some(f) = self.format {
+            d = d.format(f);
+        }
+        if let Some(ft) = self.fstype {
+            d = d.fstype(ft);
+        }
+        d
+    }
+}
+
+fn parse_root_disk(v: Value) -> Result<RootDiskSpec, Error> {
+    if let Ok(mib) = u32::try_convert(v) {
+        return Ok(RootDiskSpec {
+            kind: RootDiskKindSpec::Managed,
+            size_mib: Some(mib),
+            format: None,
+            fstype: None,
+        });
+    }
+    let Ok(h) = RHash::try_convert(v) else {
+        return Err(error::base_error(
+            "root_disk: expects an Integer (managed size in MiB) or a Hash \
+             (use Microsandbox::RootDisk.managed/tmpfs/disk)",
+        ));
+    };
+    let kind = match conv::opt_string(h, "kind")?.as_deref() {
+        None | Some("managed") => RootDiskKindSpec::Managed,
+        Some("tmpfs") => RootDiskKindSpec::Tmpfs,
+        Some("disk" | "disk-image" | "disk_image") => {
+            let Some(path) = conv::opt_string(h, "path")? else {
+                return Err(error::base_error("root_disk disk kind requires path:"));
+            };
+            RootDiskKindSpec::Disk(path)
+        }
+        Some(other) => {
+            return Err(error::base_error(format!(
+                "unknown root_disk kind {other:?} (expected managed/tmpfs/disk)"
+            )))
+        }
+    };
+    let format = conv::opt_string(h, "format")?
+        .map(|f| disk_format_from_str(&f))
+        .transpose()?;
+    Ok(RootDiskSpec {
+        kind,
+        size_mib: conv::opt_u32(h, "size_mib")?,
+        format,
+        fstype: conv::opt_string(h, "fstype")?,
+    })
+}
+
 fn action_from_str(s: &str) -> Result<Action, Error> {
     match s {
         "allow" => Ok(Action::Allow),
@@ -1736,6 +1908,133 @@ fn stop_result_to_hash(result: &SandboxStopResult) -> RHash {
     hash
 }
 
+//--------------------------------------------------------------------------------------------------
+// Health & live modification (v0.6.6 / #1099)
+//--------------------------------------------------------------------------------------------------
+
+/// A `SandboxPingResult` as `{ name, latency_secs }`. Latency is a `Duration`;
+/// we hand it to Ruby as f64 seconds and let the Ruby layer derive milliseconds
+/// (the Python/Node SDKs expose only `latency_ms`).
+fn ping_result_to_hash(result: &microsandbox::sandbox::SandboxPingResult) -> RHash {
+    let hash = ruby().hash_new();
+    let _ = hash.aset("name", result.name.clone());
+    let _ = hash.aset("latency_secs", result.latency.as_secs_f64());
+    hash
+}
+
+/// A `SandboxTouchResult` as `{ name, activity_seq }`.
+fn touch_result_to_hash(result: &microsandbox::sandbox::SandboxTouchResult) -> RHash {
+    let hash = ruby().hash_new();
+    let _ = hash.aset("name", result.name.clone());
+    let _ = hash.aset("activity_seq", result.activity_seq);
+    hash
+}
+
+/// Drive a modify builder to a plan (dry-run or apply) and return it serialized
+/// as a JSON string. Shared by `Sandbox::modify` and `SbHandle::modify`. The
+/// canonical `SandboxModificationPlan` serde shape (snake_case keys, literal-space
+/// enum strings) is parsed verbatim by the Ruby layer — matching the Python SDK's
+/// raw-dict contract rather than re-casing it.
+fn run_modify(builder: SandboxModificationBuilder, opts: RHash) -> Result<String, Error> {
+    let patch = build_modify_patch(opts)?;
+    let policy = conv::opt_string(opts, "policy")?.unwrap_or_else(|| "no_restart".to_string());
+    let dry_run = conv::opt_bool(opts, "dry_run")?;
+    let builder = apply_modify_policy(builder.with_patch(patch), &policy)?;
+    let plan = block_on(async move {
+        if dry_run {
+            builder.dry_run().await
+        } else {
+            builder.apply().await
+        }
+    })
+    .map_err(error::to_ruby)?;
+    serde_json::to_string(&plan)
+        .map_err(|e| error::base_error(format!("failed to serialize modification plan: {e}")))
+}
+
+/// Build the canonical `SandboxModificationPatch` from the modify Hash. Env and
+/// label pairs are sorted so repeated calls with the same arguments produce the
+/// same patch (and plan) ordering, mirroring the Python binding. `oci_upper_size`
+/// is deliberately not surfaced (CLI-only upstream; the Python/Node SDKs omit it
+/// too), so it stays unset via `..Default::default()`.
+fn build_modify_patch(opts: RHash) -> Result<SandboxModificationPatch, Error> {
+    let mut env_pairs = conv::opt_string_map(opts, "env")?;
+    env_pairs.sort();
+    let mut label_pairs = conv::opt_string_map(opts, "labels")?;
+    label_pairs.sort();
+
+    Ok(SandboxModificationPatch {
+        cpus: conv::opt_u8(opts, "cpus")?,
+        max_cpus: conv::opt_u8(opts, "max_cpus")?,
+        memory_mib: conv::opt_u32(opts, "memory")?,
+        max_memory_mib: conv::opt_u32(opts, "max_memory")?,
+        env: env_pairs
+            .into_iter()
+            .map(|(k, v)| EnvVar::new(k, v))
+            .collect(),
+        env_remove: conv::opt_string_vec(opts, "remove_env")?,
+        labels: label_pairs,
+        labels_remove: conv::opt_string_vec(opts, "remove_labels")?,
+        workdir: conv::opt_string(opts, "workdir")?,
+        secrets: parse_modify_secrets(opts)?,
+        secrets_remove: conv::opt_string_vec(opts, "remove_secrets")?,
+        ..Default::default()
+    })
+}
+
+/// Parse the `secrets` modify option (an Array of string-keyed Hashes normalized
+/// by the Ruby layer) into canonical `SecretModificationPatch`es. Each Hash
+/// carries `name` plus at most one of `env`/`store` (source) or `value` (raw
+/// material) — the Ruby layer enforces that mutual exclusion — plus optional
+/// `placeholder` and `allowed_hosts`. The raw `value` moves straight into the
+/// `Zeroizing` field; it is never echoed in an error.
+fn parse_modify_secrets(opts: RHash) -> Result<Vec<SecretModificationPatch>, Error> {
+    let mut out = Vec::new();
+    for h in conv::opt_hash_vec(opts, "secrets")? {
+        let name = conv::opt_string(h, "name")?
+            .ok_or_else(|| error::base_error("secret modification spec requires :name"))?;
+        let env = conv::opt_string(h, "env")?;
+        let store = conv::opt_string(h, "store")?;
+        let value = conv::opt_string(h, "value")?;
+        let source = match (env, store) {
+            (Some(var), None) => Some(SecretSource::Env { var }),
+            (None, Some(reference)) => Some(SecretSource::Store { reference }),
+            (None, None) => None,
+            // The Ruby layer rejects >1 source; guard defensively without
+            // echoing any value.
+            (Some(_), Some(_)) => {
+                return Err(error::base_error(format!(
+                    "secret {name:?}: \"env\" and \"store\" are mutually exclusive"
+                )))
+            }
+        };
+        out.push(SecretModificationPatch {
+            name,
+            source,
+            value: value.unwrap_or_default().into(),
+            placeholder: conv::opt_string(h, "placeholder")?,
+            allowed_hosts: conv::opt_string_vec(h, "allowed_hosts")?,
+        });
+    }
+    Ok(out)
+}
+
+/// Apply the parsed `policy` string to a modify builder. `no_restart` (default)
+/// leaves the builder untouched; `next_start`/`restart` select those policies.
+fn apply_modify_policy(
+    builder: SandboxModificationBuilder,
+    policy: &str,
+) -> Result<SandboxModificationBuilder, Error> {
+    match policy {
+        "no_restart" => Ok(builder),
+        "next_start" => Ok(builder.next_start()),
+        "restart" => Ok(builder.restart()),
+        other => Err(error::base_error(format!(
+            "unknown policy {other:?}; expected \"no_restart\", \"next_start\", or \"restart\""
+        ))),
+    }
+}
+
 //--------------------------------------------------------------------------------------------------
 // Pull progress (streaming image-pull during create_with_progress)
 //--------------------------------------------------------------------------------------------------
@@ -1977,15 +2276,32 @@ impl SbHandle {
     /// Snapshot this (stopped) sandbox under a bare name (resolved under the
     /// snapshots directory). Returns the same SnapshotInfo Hash as
     /// `Snapshot.create`. Mirrors the Python/Node `handle.snapshot(name)`.
+    /// (`snapshot_to` was removed upstream in v0.6.7 — use `Snapshot.create`
+    /// with `dest_dir:` for explicit placement.)
     fn snapshot(&self, name: String) -> Result<RHash, Error> {
         let snap = block_on(self.inner.snapshot(&name)).map_err(error::to_ruby)?;
         Ok(crate::snapshot::snapshot_to_hash(&snap))
     }
 
-    /// Snapshot this (stopped) sandbox to an explicit filesystem path.
-    fn snapshot_to(&self, path: String) -> Result<RHash, Error> {
-        let snap = block_on(self.inner.snapshot_to(path)).map_err(error::to_ruby)?;
-        Ok(crate::snapshot::snapshot_to_hash(&snap))
+    /// Health-check the guest agent without refreshing the idle timer. A stopped
+    /// sandbox raises `SandboxNotRunningError` (the handle does not start it
+    /// implicitly). Returns `{ name, latency_secs }`.
+    fn ping(&self) -> Result<RHash, Error> {
+        let result = block_on(self.inner.ping()).map_err(error::to_ruby)?;
+        Ok(ping_result_to_hash(&result))
+    }
+
+    /// Explicitly refresh the idle-activity timer. A stopped sandbox raises
+    /// `SandboxNotRunningError`. Returns `{ name, activity_seq }`.
+    fn touch(&self) -> Result<RHash, Error> {
+        let result = block_on(self.inner.touch()).map_err(error::to_ruby)?;
+        Ok(touch_result_to_hash(&result))
+    }
+
+    /// Plan or apply a live sandbox modification (see `Sandbox::modify`). Returns
+    /// the `SandboxModificationPlan` as a JSON string.
+    fn modify(&self, opts: RHash) -> Result<String, Error> {
+        run_modify(self.inner.modify(), opts)
     }
 }
 
@@ -2100,6 +2416,9 @@ pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     class.define_method("owns_lifecycle", method!(Sandbox::owns_lifecycle, 0))?;
     class.define_method("detach", method!(Sandbox::detach, 0))?;
     class.define_method("metrics", method!(Sandbox::metrics, 0))?;
+    class.define_method("ping", method!(Sandbox::ping, 0))?;
+    class.define_method("touch", method!(Sandbox::touch, 0))?;
+    class.define_method("modify", method!(Sandbox::modify, 1))?;
     class.define_method("metrics_stream", method!(Sandbox::metrics_stream, 1))?;
     class.define_method("logs", method!(Sandbox::logs, 1))?;
     class.define_method("log_stream", method!(Sandbox::log_stream, 1))?;
@@ -2147,7 +2466,9 @@ pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     )?;
     handle.define_method("config_json", method!(SbHandle::config_json, 0))?;
     handle.define_method("snapshot", method!(SbHandle::snapshot, 1))?;
-    handle.define_method("snapshot_to", method!(SbHandle::snapshot_to, 1))?;
+    handle.define_method("ping", method!(SbHandle::ping, 0))?;
+    handle.define_method("touch", method!(SbHandle::touch, 0))?;
+    handle.define_method("modify", method!(SbHandle::modify, 1))?;
 
     let session = native.define_class("PullSession", ruby.class_object())?;
     session.define_method("recv", method!(PullSession::recv, 0))?;