withruntime 0.20.0 → 0.26.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a7812f8e62878add0f508438d590167776350a52b7f9c213e77fee8447afadac
-  data.tar.gz: 84b04befc8a18f0420a1026fed88a7a29d4e10efc01dbad3b3632ea4ea515829
+  metadata.gz: 7c6510ac6423ac945d6e5f55779d4f913ec4c13a4bd64992ec825637219d1373
+  data.tar.gz: dbfd02ae2ffe411a32158234ab0d0faf8cf52263149c763cba750aed4db23a94
 SHA512:
-  metadata.gz: ad569904e75cd01d9a9725a85a77cbdb0e5a44fa709e5bec3e6c40919a0db3675b94b2c8ad6fd8b8f99a50e666147667229f26814be9cdf142396ac6eee27db6
-  data.tar.gz: ba71b0cae765bfc87c8645587abd698643e96087452aa8e499630632e955df8f72cd0c961e37b798bd7dfa795827d498d84a1da455d4e742326f2aa5fad76cd8
+  metadata.gz: ae5ff418881522c0748184c85262a960e4425d6eb32526482178bde4c862a682580140f373e3858dd66039857117fc73eaf4c9ea0ba7b057bb5c7932d5010952
+  data.tar.gz: 6be184e2e55d835096df364ae1077b615485ddad59f6afe87b65c2ab6793a291962151720fbae4d223fb5c6ff5752ff08c5e32bd654229b33c58681fb1f639d6

data/lib/withruntime/agents.rb

@@ -42,7 +42,8 @@ module WithRuntime
   # +state+ (queued, running, waiting, done, failed or stopped), +reason+
   # (why it ended; among others "budget", "parent_ended", and "deleted" on a
   # deleted record), +result+, +sandbox_id+, +last_seq+, +labels+,
-  # +created_at+, +started_at+, +ended_at+.
+  # +overrides+ (what its start overrode of its agent's definition, as given,
+  # or nil), +created_at+, +started_at+, +ended_at+.
   #
   # Its tree: +parent_session_id+ (nil for a top session), +root_session_id+
   # (itself for a top session) and +depth+ (0 to 3). Its use: +cost+ (this
@@ -51,7 +52,8 @@ module WithRuntime
   # session is deleted) and +attachment_bytes+ (its files and screenshots).
   # +stop_why+ is why a stop was asked ("stopped", "budget" or
   # "parent_ended") or nil, and +deleted_at+ is set once its history was
-  # deleted (+sessions.delete+).
+  # deleted (+sessions.delete+). +workflow_id+ is the workflow that started
+  # it as one of its steps, or nil.
   class AgentSessionInfo < Record
     def cost = AgentCost.new(self["cost"])
     def tree_cost = AgentCost.new(self["treeCost"])
@@ -95,18 +97,24 @@ module WithRuntime
   # its tree; a tree at it stops, reason "budget"), +max_day_dollars+ (more
   # than 0, at most 100000, 100 unless set: the agent's sessions started that
   # UTC day; an agent at it starts nothing new, +budget_reached+
-  # (402), until the next day) and +template+ ("support" or
-  # "team").
+  # (402), until the next day), +max_children+ (1 to 1000, 100 unless set:
+  # the sessions one session's harness may start), +advisor+ ({ model:,
+  # provider:, secret:, base_url:, max_calls:, instructions: }, all but
+  # +model+ optional: a model its sessions may ask for advice with the
+  # advise tool, each call kept in the log as a note) and +template+
+  # ("support" or "team").
   class Agents < Product
-    attr_reader :sessions, :triggers, :templates, :memory, :asks
+    attr_reader :sessions, :triggers, :slack, :templates, :memory, :asks, :workflows
 
     def initialize(transport)
       super
       @sessions = AgentSessions.new(transport)
       @triggers = AgentTriggers.new(transport)
+      @slack = AgentSlack.new(transport)
       @templates = AgentTemplates.new
       @memory = AgentMemory.new(transport)
       @asks = AgentAsks.new(transport)
+      @workflows = AgentWorkflows.new(transport)
     end
 
     # Claude Managed Agents' API on Runtime: the options Anthropic's Ruby SDK
@@ -146,10 +154,16 @@ module WithRuntime
     # Starts a session with +input+, its first words. With +key:+, your own
     # name for the conversation (a Slack thread, a pull request, one of your
     # customers such as "customer:42"), words with the same key join the open
-    # session instead of starting a second; +session.joined+ says so. An agent
-    # at its day's budget is refused +budget_reached+ (402).
-    def start(agent, input, key: nil, labels: nil, idempotency_key: nil)
-      body = Fields.body(input: input, key: key, labels: labels)
+    # session instead of starting a second; +session.joined+ says so.
+    # +overrides:+ gives this session its own model, instructions, MCP
+    # servers, disallowed tools, size and budget within the agent's
+    # +sessionOverrides+ ({ model:, instructions:, instructions_mode:
+    # "replace", mcp: [names], disallowed_tools: ["Bash", "spawn"], vcpu:,
+    # memory_mib:, max_session_dollars: }); one it does not allow is refused
+    # +permission_denied+ (403), naming what it allows. An agent at its day's
+    # budget is refused +budget_reached+ (402).
+    def start(agent, input, key: nil, labels: nil, overrides: nil, idempotency_key: nil)
+      body = Fields.body(input: input, key: key, labels: labels, overrides: overrides)
       answer = @t.json("POST", "/v1/agents/#{seg(agent)}/sessions", body: body, key: idempotency_key)
       AgentSession.new(@t, answer["session"], joined: answer["joined"] == true, seq: answer["seq"])
     end
@@ -411,6 +425,23 @@ module WithRuntime
     end
   end
 
+  # +runtime.agents.slack+: Runtime's Slack app in your workspaces. Add it with
+  # +install+'s link; a slack trigger then names a workspace's +team+ and a
+  # channel the app is in.
+  class AgentSlack < Product
+    # A link that adds Runtime's Slack app to a workspace, good for 15
+    # minutes: +url+ and +expires_at+. Open it as a person who may add apps
+    # to the workspace; Slack sends them back to the console once it is added.
+    def install = Record.new(@t.json("POST", "/v1/agents/slack/installs", body: {}))
+
+    # The workspaces added to this account: +team+, +name+, +bot_user+, +installed_at+.
+    def teams = @t.json("GET", "/v1/agents/slack/teams")["data"].map { |row| Record.new(row) }
+
+    # Removes a workspace: its token is revoked, and its triggers refuse
+    # events until it is added again.
+    def remove(team) = @t.json("DELETE", "/v1/agents/slack/teams/#{seg(team)}") && nil
+  end
+
   # +runtime.agents.asks+: the account's inbox, the questions its agents'
   # sessions need answered to go on. Each has +why+ it matters, +options+
   # ({label, detail}), a recommended +pick+ and maybe an expiry. Asks of
@@ -459,6 +490,125 @@ module WithRuntime
     end
   end
 
+  # +runtime.agents.workflows+: many sessions in phases. A workflow is data,
+  # not code: each phase names an +agent+ (or uses the workflow's), an
+  # +input+ template ({{input}}, {{item}}, {{index}}, and {{<phase>}} for an
+  # earlier phase's results) and +each+, a list of items (1 to 1000) or
+  # { from: "<phase>", split: "json" | "lines" } to fan out over an earlier
+  # phase's result. A phase waits for every phase before it, unless
+  # +pipeline+ is true: then each item starts as soon as its own item in the
+  # source phase ends. +max_sessions+ (100 unless set, at most 1000),
+  # +max_concurrent+ (20, at most 200) and +max_dollars+ (10, at most 10000)
+  # bound it; at the cap it fails with reason "budget".
+  #
+  #   flow = runtime.agents.workflows.run(agent: "dev", phases: [
+  #     { name: "fix", input: "Fix {{item}}", each: %w[a.ts b.ts] }
+  #   ])
+  #   flow.follow { |w| puts w.phases.map { |p| "#{p.name} #{p.done}/#{p.total}" } }
+  #   puts flow.wait.result
+  class AgentWorkflows < Product
+    # Runs it now and answers an AgentWorkflow to follow, wait for and stop.
+    # An invalid spec is refused (InvalidRequestError), its details naming
+    # the field.
+    def run(spec = nil, idempotency_key: nil, **fields)
+      body = Fields.convert(spec || fields)
+      AgentWorkflow.new(@t, @t.json("POST", "/v1/agents/workflows", body: body, key: idempotency_key))
+    end
+
+    def get(id) = AgentWorkflow.new(@t, @t.json("GET", "/v1/agents/workflows/#{seg(id)}"))
+
+    # The first page, newest first, in a +state+ (one or a list) if given;
+    # +each+ walks every page.
+    def list(state: nil, cursor: nil, limit: nil) = workflows_page({ "state" => state, "limit" => limit }, cursor)
+
+    private
+
+    def workflows_page(query, cursor)
+      body = @t.json("GET", "/v1/agents/workflows", query: query.merge("cursor" => cursor))
+      Page.new(body["data"].map { |item| Record.new(item) }, body["nextCursor"]) { |after| workflows_page(query, after) }
+    end
+  end
+
+  # One workflow. +info+: +id+, +name+, +state+ (running, done, failed or
+  # stopped), +reason+, +result+ (one step's result as it is, or a JSON
+  # array of the last phase's results), +parent_session_id+, +spec+, its
+  # limits, +started+, +version+ (one more on every change), +labels+,
+  # +phases+ (each +name+, +agent_id+, +total+, +ready+, +pending+,
+  # +running+, +done+, +failed+), +cost+ and its times.
+  class AgentWorkflow
+    POLL_SECONDS = AgentSession::POLL_SECONDS
+    POLL_MARGIN = AgentSession::POLL_MARGIN
+
+    attr_reader :info
+
+    def initialize(transport, info)
+      @t = transport
+      @info = Record.new(info)
+    end
+
+    def id = @info["id"]
+    def state = @info["state"]
+    def ended? = state != "running"
+    def result = @info["result"]
+
+    # Reads it again.
+    def refresh
+      @info = Record.new(@t.json("GET", path))
+      self
+    end
+
+    # Each change after version +after+ (0: from the start) as it happens;
+    # without a block, an Enumerator. Waits on the server and ends once the
+    # workflow has ended.
+    def follow(after: 0)
+      return enum_for(:follow, after: after) unless block_given?
+
+      loop do
+        now = poll(after)
+        @info = now
+        if now["version"] > after
+          after = now["version"]
+          yield now
+        end
+        return nil if ended?
+      end
+    end
+
+    # The workflow once it has ended; a failed one is returned, not raised.
+    # Waits on the server, with no polling.
+    def wait
+      refresh
+      @info = poll(@info["version"]) until ended?
+      @info
+    end
+
+    # The first page of its steps in phase and item order: +phase+, +item+,
+    # +item_text+, +state+ (pending, running, done, failed, stopped or
+    # skipped), +reason+, +result+, +session_id+ and times.
+    def steps(state: nil, cursor: nil, limit: nil) = steps_page({ "state" => state, "limit" => limit }, cursor)
+
+    # Stops it: nothing more starts, and its open sessions are asked to stop.
+    def stop
+      @info = Record.new(@t.json("POST", path("/stop"), body: {}))
+    end
+
+    def inspect = "#<#{self.class.name} #{id} #{state}>"
+
+    private
+
+    def path(suffix = "") = "/v1/agents/workflows/#{Transport.segment(id)}#{suffix}"
+
+    def poll(after)
+      Record.new(@t.json("GET", path, query: { "after" => after, "wait" => POLL_SECONDS },
+                                      timeout: [@t.timeout, POLL_SECONDS + POLL_MARGIN].max))
+    end
+
+    def steps_page(query, cursor)
+      body = @t.json("GET", path("/steps"), query: query.merge("cursor" => cursor))
+      Page.new(body["data"].map { |item| Record.new(item) }, body["nextCursor"]) { |after| steps_page(query, after) }
+    end
+  end
+
   # A page of an agent's memory files; +usage+ is the agent's whole memory,
   # every scope: +bytes+, +files+, +limit_bytes+ and +limit_files+.
   class AgentMemoryPage < Page
@@ -526,7 +676,7 @@ module WithRuntime
   # for either use, and the two uses. +review+ is a CI/CD agent step's
   # reviewer, on a +pool+ of Claude accounts.
   #
-  #   runtime.agents.templates.map(&:key)   # claude-code, codex, gemini-cli, claude-agent-sdk, openai-agents-sdk, review, judge
+  #   runtime.agents.templates.map(&:key)   # claude-code, codex, gemini-cli, claude-agent-sdk, openai-agents-sdk, review, judge, browser
   #   runtime.agents.templates["codex"].api_key_secret
   #   runtime.agents.templates.uses["support"].session_key
   #   runtime.agents.templates.definition("claude-code", use: "support")
@@ -631,6 +781,21 @@ module WithRuntime
             "memoryMiB" => 2048,
             "maxSessionSeconds" => 1800
           }
+        },
+        "browser" => {
+          "key" => "browser",
+          "title" => "Browser task",
+          "command" => "python3 ~/.runtime-agent/runtime-agent browse",
+          "apiKeySecret" => "ANTHROPIC_API_KEY",
+          "apiKeyHost" => "api.anthropic.com",
+          "subscription" => nil,
+          "definition" => {
+            "command" => "python3 ~/.runtime-agent/runtime-agent browse",
+            "secrets" => ["ANTHROPIC_API_KEY"],
+            "vcpu" => 2,
+            "memoryMiB" => 4096,
+            "maxSessionSeconds" => 1800
+          }
         }
       },
       "uses" => {

data/lib/withruntime/apps.rb

@@ -183,7 +183,7 @@ module WithRuntime
       super(transport, path, %w[failed deleted live])
     end
 
-    # Creates one waiting for its first version: +max_copies:+ (1 to 1000),
+    # Creates one waiting for its first version: +max_copies:+ (1 to the account's App copies at once, its plan's sandboxes at once),
     # +vcpu:+ (1 to 16) and +memory_mib:+ (128 to 65536) are required;
     # +concurrency:+, +spares:+, +port:+ (8080), +health_path:+, +cdn:+ (true: Cloudflare's CDN in
     # front of its addresses; false sends visitors straight to Runtime's routers,

data/lib/withruntime/browsers.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module WithRuntime
+  # +runtime.browsers+: a task in plain words, done by an agent that browses
+  # in a sandbox with Chromium, at /v1/browsers/runs. In a private beta: an
+  # account outside it is refused with product_in_beta (403,
+  # PermissionDeniedError).
+  #
+  #   run = runtime.browsers.run("Find the price of the cheapest plan on withruntime.com")
+  #   puts run.output || run.error
+  #   runtime.browsers.runs.follow(run.id) { |step| puts "#{step.n} #{step.url}" }
+  #
+  # The model's key is your egress secret: ANTHROPIC_API_KEY for claude-
+  # models (the default, claude-sonnet-5-5), OPENAI_API_KEY for gpt- and
+  # o-series, GEMINI_API_KEY for gemini-. A run is billed as its sandbox's
+  # time, at the sandbox rates; the model's use is on your key.
+  #
+  # A run: id, state (queued, running, done, failed or stopped), task, model,
+  # start_url, output (the answer, once done), error (why it failed, and what
+  # to do), steps, url (the page it ended on), sandbox_id, labels,
+  # created_at, started_at and ended_at. A step: n (0 is the page before the
+  # first step; the last, the page at the end), url, title, goal, actions,
+  # frame (the page as a base64 JPEG), at and seq.
+  class Browsers < Product
+    attr_reader :runs
+
+    def initialize(transport)
+      super
+      @runs = BrowserRuns.new(transport)
+    end
+
+    # Does +task+ in a browser and returns the run once it has ended: +output+
+    # once done, +error+ once failed. Also +start_url:+, +model:+,
+    # +max_steps:+, +allowed_domains:+ and +labels:+.
+    def run(task, **fields)
+      @runs.wait(@runs.create(task, **fields).id)
+    end
+  end
+
+  # +runtime.browsers.runs+: start, read, follow and stop runs.
+  class BrowserRuns < Product
+    ENDED = %w[done failed stopped].freeze
+    # How long the API holds a steps read open, and the margin past it a
+    # read waits for its answer.
+    POLL_SECONDS = 30
+    POLL_MARGIN = 15
+
+    # Starts a run and returns it at once (state queued). +start_url:+ is
+    # opened before the first step; +max_steps:+ is 1 to 200 (30 unless
+    # set); +allowed_domains:+ limits the pages it opens.
+    def create(task, start_url: nil, model: nil, max_steps: nil, allowed_domains: nil, labels: nil, idempotency_key: nil)
+      body = Fields.body(task: task, start_url: start_url, model: model, max_steps: max_steps,
+                         allowed_domains: allowed_domains, labels: labels)
+      Record.new(@t.json("POST", "/v1/browsers/runs", body: body, key: idempotency_key))
+    end
+
+    def get(id) = Record.new(@t.json("GET", path(id)))
+
+    # The first page of runs, newest first; +each+ walks every page.
+    def list(cursor: nil, limit: nil)
+      body = @t.json("GET", "/v1/browsers/runs", query: { "cursor" => cursor, "limit" => limit })
+      Page.new(body["data"].map { |item| Record.new(item) }, body["nextCursor"]) { |after| list(cursor: after, limit: limit) }
+    end
+
+    # One page of its steps after seq +after+: {data, after, ended}. +wait:+
+    # (seconds, up to 30) holds the answer on the server for a step.
+    def steps(id, after: 0, limit: nil, frames: nil, wait: nil)
+      query = { "after" => after, "limit" => limit, "frames" => frames, "wait" => wait }
+      timeout = wait ? [@t.timeout, wait + POLL_MARGIN].max : nil
+      @t.json("GET", path(id, "/steps"), query: query, timeout: timeout)
+    end
+
+    # Each step as it comes, until the run ends: its recording. Without a
+    # block, an Enumerator. Each read waits on the server, not a timer.
+    def follow(id, after: 0, frames: true, &block)
+      return enum_for(:follow, id, after: after, frames: frames) unless block
+
+      loop do
+        page = steps(id, after: after, frames: frames ? nil : false, wait: POLL_SECONDS)
+        data = page["data"] || []
+        data.each { |step| yield Record.new(step) }
+        after = page["after"] || after
+        return nil if page["ended"] && data.empty?
+      end
+    end
+
+    # Stops it; its sandbox is deleted and its steps are kept.
+    def stop(id) = Record.new(@t.json("POST", path(id, ":stop"), body: {}))
+
+    # The run once it has ended (done, failed or stopped); a failed run is
+    # returned, not raised: read +error+.
+    def wait(id)
+      run = get(id)
+      return run if ENDED.include?(run.state)
+
+      follow(id, frames: false) { |_step| nil }
+      get(id)
+    end
+
+    private
+
+    def path(id, suffix = "") = "/v1/browsers/runs/#{seg(id)}#{suffix}"
+  end
+end

data/lib/withruntime/builds.rb

@@ -12,7 +12,9 @@ module WithRuntime
   # A build: id, name, labels, repository_id, ref, branch, commit, state
   # (queued, fetching, building, deploying, succeeded, failed, cancelled,
   # superseded), reason, timings (milliseconds per step once done, or nil),
-  # output_snapshot_id, error, created_at, updated_at and deleted_at.
+  # output_snapshot_id, framework (detected for the commands the repository
+  # leaves unset: nextjs, vite, fastapi, rails, go, docker, ...; or nil),
+  # error, created_at, updated_at and deleted_at.
   class Builds < Product
     TERMINAL = %w[succeeded failed cancelled superseded].freeze
     # Reconnections in a row with no new line before a follow gives up.

data/lib/withruntime/ci.rb

@@ -72,10 +72,13 @@ module WithRuntime
   # created_at, updated_at, started_at and ended_at.
   class CIChecks < Product
     # Checks, newest first. +state+ is any of queued, running, passed, failed,
-    # cancelled; +commit+ is a full sha.
-    def list(repository_id: nil, state: nil, branch: nil, commit: nil, pull_request: nil, limit: nil, cursor: nil)
-      page("/v1/ci/checks", { "repositoryId" => repository_id, "state" => state, "branch" => branch, "commit" => commit,
-                              "pullRequest" => pull_request, "limit" => limit, "cursor" => cursor })
+    # cancelled; +event+ any of push, pull_request, merge_group (GitHub's merge
+    # queue) or rerun; +commit+ is a full sha.
+    def list(repository_id: nil, state: nil, event: nil, branch: nil, commit: nil, pull_request: nil, limit: nil,
+             cursor: nil)
+      page("/v1/ci/checks", { "repositoryId" => repository_id, "state" => state, "event" => event, "branch" => branch,
+                              "commit" => commit, "pullRequest" => pull_request, "limit" => limit,
+                              "cursor" => cursor })
     end
 
     # The check with its +jobs+ in plan order (no log).

data/lib/withruntime/client.rb

@@ -25,7 +25,7 @@ module WithRuntime
   class Client
     attr_reader :transport, :sandboxes, :snapshots, :images, :volumes, :secrets, :reservations, :limits, :jobs, :emails, :referrals, :plans,
                 :switching, :events, :webhooks, :otel, :audit, :feedback, :support, :domains, :ports, :ips, :networks, :sso, :mcp, :agents,
-                :apps, :functions, :builds, :ci, :containers
+                :apps, :functions, :builds, :ci, :containers, :browsers
 
     # +api_key+: default RUNTIME_API_KEY, then this machine's saved connection.
     # +base_url+: default RUNTIME_API_URL, then https://api.withruntime.com.
@@ -82,6 +82,7 @@ module WithRuntime
       @builds = Builds.new(@transport)
       @ci = CI.new(@transport)
       @containers = Containers.new(@transport)
+      @browsers = Browsers.new(@transport)
     end
 
     # Renamed on 6 October 2026, one plural word per product: each old name is the product it became, with a warning,

data/lib/withruntime/products.rb

@@ -117,7 +117,8 @@ module WithRuntime
   # +runtime.secrets+: a value your sandboxes use without seeing it. Every
   # sandbox of the organization has an environment variable of the secret's
   # name holding a placeholder; the egress proxy puts the value into HTTPS
-  # requests to its hosts. The value is never returned.
+  # requests to its hosts. With +exposed: true+, the sandboxes and Apps its
+  # +only:+ names by id get the value itself instead. The value is never returned.
   class Secrets < Product
     # Stores or replaces a secret for +hosts+ ("api.openai.com", "*.github.com").
     # With +header:+, that header is set on every request to them, +format:+'s
@@ -139,15 +140,36 @@ module WithRuntime
     # variable sandboxes see it in, when not the secret's name. Secrets scoped to different
     # sandboxes may share one, such as one GITHUB_TOKEN per repository; a write that would
     # put two in one sandbox is refused (409). Absent when replacing: the variable it has stays.
-    def set(name, value:, hosts:, header: nil, format: nil, rules: nil, only: nil, github_app: nil, git: nil,
-            api: nil, env: nil)
+    #
+    # +exposed: true+, with no +hosts:+, gives sandboxes the value itself in the variable instead
+    # of a placeholder: for what is not an HTTPS header, such as a database password, an SSH key
+    # or a service account's JSON. The value may then be any text of up to 64 KiB, several lines
+    # included, and it takes no +header:+, +format:+, +rules:+, +github_app:+, +git:+ or +api:+.
+    # It needs +only:+ naming the sandboxes or Apps that get it by id ({ "sandboxes" => [ids] },
+    # { "apps" => [App ids] }), never labels or every sandbox; a replacement may leave +only:+
+    # out to keep the scope it has. Which machines get it changes only with the value: +scope+
+    # is refused for it, so +set+ it again.
+    # Code in the sandbox can read it and send it anywhere, and it can be in the sandbox's
+    # snapshots and forks; for an HTTPS API, prefer +hosts:+. It is not kept: give it on every
+    # write of such a secret. +expected_version:+ writes only if the secret is at that version
+    # (its +version+ from +get+ or +list+; 0: it must not exist yet), or raises 409
+    # version_conflict with the current one in +details["version"]+.
+    def set(name, value:, hosts: nil, header: nil, format: nil, rules: nil, only: nil, github_app: nil, git: nil,
+            api: nil, env: nil, exposed: nil, expected_version: nil)
       body = { "value" => value, "hosts" => hosts, "header" => header, "format" => format, "rules" => rules,
-               "only" => only, "githubApp" => github_app, "git" => git, "api" => api, "env" => env }.compact
+               "only" => only, "githubApp" => github_app, "git" => git, "api" => api, "env" => env,
+               "exposed" => exposed, "expectedVersion" => expected_version }.compact
       Record.new(@t.json("PUT", "/v1/egress-secrets/#{seg(name)}", body: body))
     end
 
+    # One secret by name: its kind (+exposed+), +version+, variable, hosts and placeholder. Never
+    # its value. Raises 404 not_found when there is none.
+    def get(name) = Record.new(@t.json("GET", "/v1/egress-secrets/#{seg(name)}"))
+
     # Changes which sandboxes get a secret, without its value: +{}+ is every sandbox of the
-    # organization again. Returns the secret, with +only+ and +enforced+.
+    # organization again. Returns the secret, with +only+ and +enforced+. Refused (400) for a
+    # real-value secret (+exposed+), whose machines change only with its value: +set+ it again
+    # with +value:+, +exposed: true+ and +only:+.
     def scope(name, only)
       Record.new(@t.json("PUT", "/v1/egress-secrets/#{seg(name)}/sandboxes", body: only))
     end
@@ -159,7 +181,7 @@ module WithRuntime
       Record.new(@t.json("PUT", "/v1/egress-secrets/#{seg(name)}/rules", body: body))
     end
 
-    # Names, hosts and placeholders. Never values. With +limit:+ (1 to 100)
+    # Names, kinds, versions, hosts and placeholders. Never values. With +limit:+ (1 to 100)
     # or +after:+, one page by name: the secrets named after +after+; the next
     # page's +after+ is this one's last name. Without, every secret.
     def list(limit: nil, after: nil)
@@ -353,7 +375,8 @@ module WithRuntime
     end
   end
 
-  # +runtime.otel+: events (as logs) and CPU and memory (as metrics) pushed to
+  # +runtime.otel+: events (as logs), CPU, memory, disk and network (as metrics)
+  # and a span for every API call (as traces, with signals including "traces") pushed to
   # an OpenTelemetry endpoint over OTLP/HTTP.
   class Otel < Product
     # +headers+ authenticate to the endpoint and are never shown back.

data/lib/withruntime/sandbox.rb

@@ -152,7 +152,9 @@ module WithRuntime
     end
 
     # Changes name, labels, auto_wake, user ("sandbox" or "root": who later
-    # commands run as when one names no user), idle_pause_seconds, persistent or
+    # commands run as when one names no user), lease_seconds (with no time
+    # limit, how far ahead each renewal funds it, 300 to 43200),
+    # idle_pause_seconds, persistent or
     # max_total_cost_micros; fields left out stay as they are, and
     # +max_total_cost_micros: :remove+ removes the cap.
     def update(idempotency_key: nil, **settings)

data/lib/withruntime/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WithRuntime
-  VERSION = "0.20.0"
+  VERSION = "0.26.1"
 end

data/lib/withruntime.rb

@@ -37,6 +37,7 @@ require_relative "withruntime/apps"
 require_relative "withruntime/builds"
 require_relative "withruntime/ci"
 require_relative "withruntime/containers"
+require_relative "withruntime/browsers"
 require_relative "withruntime/network_products"
 require_relative "withruntime/parity_products"
 require_relative "withruntime/file_watch"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: withruntime
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.26.1
 platform: ruby
 authors:
 - Runtime
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-10-27 00:00:00.000000000 Z
 dependencies: []
 description: 'Linux sandboxes for agents, and every other Runtime Cloud product: streaming
   commands and terminals, files and watches, images, durable volumes and backups,
@@ -23,6 +23,7 @@ files:
 - lib/withruntime/agents.rb
 - lib/withruntime/api_defaults.rb
 - lib/withruntime/apps.rb
+- lib/withruntime/browsers.rb
 - lib/withruntime/builds.rb
 - lib/withruntime/ci.rb
 - lib/withruntime/client.rb