ppio-sandbox 2.1.0 → 2.1.1-a4

package/dist/desktop.js

@@ -80,7 +80,7 @@ var __forAwait = (obj, it, method) => (it = obj[__knownSymbol("asyncIterator")])
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "2.1.0";
+    version = "2.1.1-a4";
   }
 });
 
@@ -122,12 +122,6 @@ async function sha256(data) {
 function timeoutToSeconds(timeout) {
   return Math.ceil(timeout / 1e3);
 }
-function dynamicRequire(module2) {
-  if (runtime === "browser") {
-    throw new Error("Browser runtime is not supported for require");
-  }
-  return require(module2);
-}
 async function dynamicImport(module2) {
   if (runtime === "browser") {
     throw new Error("Browser runtime is not supported for dynamic import");
@@ -1580,7 +1574,7 @@ var init_filesystem = __esm({
         this.defaultWatchRecursive = false;
         this.rpc = (0, import_connect5.createClient)(Filesystem, transport);
       }
-      async read(path2, opts) {
+      async read(path3, opts) {
         var _a3;
         const format = (_a3 = opts == null ? void 0 : opts.format) != null ? _a3 : "text";
         let user = opts == null ? void 0 : opts.user;
@@ -1594,7 +1588,7 @@ var init_filesystem = __esm({
         const res = await this.envdApi.api.GET("/files", {
           params: {
             query: {
-              path: path2,
+              path: path3,
               username: user
             }
           },
@@ -1627,7 +1621,7 @@ var init_filesystem = __esm({
             "Cannot specify both path and array of files. You have to specify either path and data for a single file or an array for multiple files."
           );
         }
-        const { path: path2, writeOpts, writeFiles } = typeof pathOrFiles === "string" ? {
+        const { path: path3, writeOpts, writeFiles } = typeof pathOrFiles === "string" ? {
           path: pathOrFiles,
           writeOpts: opts,
           writeFiles: [
@@ -1657,7 +1651,7 @@ var init_filesystem = __esm({
           }
           const uploadResults = await Promise.all(
             writeFiles.map(async (file) => {
-              const filePath = path2 != null ? path2 : file.path;
+              const filePath = path3 != null ? path3 : file.path;
               const body = await toUploadBody(file.data, useGzip);
               const res = await this.envdApi.api.POST("/files", {
                 params: {
@@ -1695,13 +1689,13 @@ var init_filesystem = __esm({
             formData.append(
               "file",
               await toBlob(file.data),
-              (_a3 = file.path) != null ? _a3 : path2
+              (_a3 = file.path) != null ? _a3 : path3
             );
           }
           const res = await this.envdApi.api.POST("/files", {
             params: {
               query: {
-                path: path2,
+                path: path3,
                 username: user
               }
             },
@@ -1719,7 +1713,7 @@ var init_filesystem = __esm({
           }
           results.push(...files);
         }
-        return results.length === 1 && path2 ? results[0] : results;
+        return results.length === 1 && path3 ? results[0] : results;
       }
       /**
        * Write multiple files.
@@ -1747,7 +1741,7 @@ var init_filesystem = __esm({
        *
        * @returns list of entries in the sandbox filesystem directory.
        */
-      async list(path2, opts) {
+      async list(path3, opts) {
         var _a3;
         if (typeof (opts == null ? void 0 : opts.depth) === "number" && opts.depth < 1) {
           throw new InvalidArgumentError("depth should be at least one");
@@ -1755,7 +1749,7 @@ var init_filesystem = __esm({
         try {
           const res = await this.rpc.listDir(
             {
-              path: path2,
+              path: path3,
               depth: (_a3 = opts == null ? void 0 : opts.depth) != null ? _a3 : 1
             },
             {
@@ -1794,10 +1788,10 @@ var init_filesystem = __esm({
        *
        * @returns `true` if the directory was created, `false` if it already exists.
        */
-      async makeDir(path2, opts) {
+      async makeDir(path3, opts) {
         try {
           await this.rpc.makeDir(
-            { path: path2 },
+            { path: path3 },
             {
               headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
               signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1860,10 +1854,10 @@ var init_filesystem = __esm({
        * @param path path to a file or directory.
        * @param opts connection options.
        */
-      async remove(path2, opts) {
+      async remove(path3, opts) {
         try {
           await this.rpc.remove(
-            { path: path2 },
+            { path: path3 },
             {
               headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
               signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1881,10 +1875,10 @@ var init_filesystem = __esm({
        *
        * @returns `true` if the file or directory exists, `false` otherwise
        */
-      async exists(path2, opts) {
+      async exists(path3, opts) {
         try {
           await this.rpc.stat(
-            { path: path2 },
+            { path: path3 },
             {
               headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
               signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1908,10 +1902,10 @@ var init_filesystem = __esm({
        *
        * @returns information about the file or directory like name, type, and path.
        */
-      async getInfo(path2, opts) {
+      async getInfo(path3, opts) {
         try {
           const res = await this.rpc.stat(
-            { path: path2 },
+            { path: path3 },
             {
               headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
               signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1947,7 +1941,7 @@ var init_filesystem = __esm({
        *
        * @returns `WatchHandle` object for stopping watching directory.
        */
-      async watchDir(path2, onEvent, opts) {
+      async watchDir(path3, onEvent, opts) {
         var _a3, _b, _c;
         if ((opts == null ? void 0 : opts.recursive) && this.envdApi.version && (0, import_compare_versions3.compareVersions)(this.envdApi.version, ENVD_VERSION_RECURSIVE_WATCH) < 0) {
           throw new TemplateError(
@@ -1961,7 +1955,7 @@ var init_filesystem = __esm({
         }, requestTimeoutMs) : void 0;
         const events = this.rpc.watchDir(
           {
-            path: path2,
+            path: path3,
             recursive: (_b = opts == null ? void 0 : opts.recursive) != null ? _b : this.defaultWatchRecursive
           },
           {
@@ -2184,11 +2178,11 @@ function parseGitStatus(output) {
     }
     const indexStatus = line[0];
     const workingTreeStatus = line[1];
-    const path2 = line.slice(3);
+    const path3 = line.slice(3);
     let renamedFrom;
-    let name = path2;
-    if (path2.includes(" -> ")) {
-      const parts = path2.split(" -> ");
+    let name = path3;
+    if (path3.includes(" -> ")) {
+      const parts = path3.split(" -> ");
       renamedFrom = parts[0];
       name = parts.slice(1).join(" -> ");
     }
@@ -2297,16 +2291,16 @@ function buildUpstreamErrorMessage(action) {
   }
   return "Git pull failed because no upstream branch is configured. Pass remote and branch explicitly, or set upstream once (push with { setUpstream: true } or run: git branch --set-upstream-to=origin/<branch> <branch>).";
 }
-function getRepoPathForScope(scope, path2) {
+function getRepoPathForScope(scope, path3) {
   if (scope !== "local") {
     return void 0;
   }
-  if (!path2) {
+  if (!path3) {
     throw new InvalidArgumentError(
       'A repository path is required when using scope "local".'
     );
   }
-  return path2;
+  return path3;
 }
 var init_utils2 = __esm({
   "src/core/sandbox/git/utils.ts"() {
@@ -2343,7 +2337,7 @@ var init_git = __esm({
           password,
           branch,
           depth,
-          path: path2,
+          path: path3,
           dangerouslyStoreCredentials
         } = _a3, rest = __objRest(_a3, [
           "username",
@@ -2362,7 +2356,7 @@ var init_git = __esm({
           const urlWithCreds = authUsername && authPassword ? withCredentials(url, authUsername, authPassword) : url;
           const sanitizedUrl = stripCredentials(urlWithCreds);
           const stripInlineCreds = !dangerouslyStoreCredentials && sanitizedUrl !== urlWithCreds;
-          const repoPath = stripInlineCreds ? path2 != null ? path2 : deriveRepoDirFromUrl(url) : path2;
+          const repoPath = stripInlineCreds ? path3 != null ? path3 : deriveRepoDirFromUrl(url) : path3;
           if (stripInlineCreds && !repoPath) {
             throw new InvalidArgumentError(
               "A destination path is required when using credentials without storing them."
@@ -2400,7 +2394,7 @@ var init_git = __esm({
        * @param opts Init options.
        * @returns Command result from the command runner.
        */
-      async init(path2, opts) {
+      async init(path3, opts) {
         const _a3 = opts != null ? opts : {}, { bare, initialBranch } = _a3, rest = __objRest(_a3, ["bare", "initialBranch"]);
         const args = ["init"];
         if (initialBranch) {
@@ -2409,7 +2403,7 @@ var init_git = __esm({
         if (bare) {
           args.push("--bare");
         }
-        args.push(path2);
+        args.push(path3);
         return this.runGit(args, void 0, rest);
       }
       /**
@@ -2421,7 +2415,7 @@ var init_git = __esm({
        * @param opts Remote add options.
        * @returns Command result from the command runner.
        */
-      async remoteAdd(path2, name, url, opts) {
+      async remoteAdd(path3, name, url, opts) {
         if (!name || !url) {
           throw new InvalidArgumentError(
             "Both remote name and URL are required to add a git remote."
@@ -2434,13 +2428,13 @@ var init_git = __esm({
         }
         addArgs.push(name, url);
         if (!overwrite) {
-          return this.runGit(addArgs, path2, rest);
+          return this.runGit(addArgs, path3, rest);
         }
-        const addCmd = buildGitCommand(addArgs, path2);
-        const setUrlCmd = buildGitCommand(["remote", "set-url", name, url], path2);
+        const addCmd = buildGitCommand(addArgs, path3);
+        const setUrlCmd = buildGitCommand(["remote", "set-url", name, url], path3);
         let cmd = `${addCmd} || ${setUrlCmd}`;
         if (fetch2) {
-          const fetchCmd = buildGitCommand(["fetch", name], path2);
+          const fetchCmd = buildGitCommand(["fetch", name], path3);
           cmd = `(${cmd}) && ${fetchCmd}`;
         }
         return this.runShell(cmd, rest);
@@ -2455,11 +2449,11 @@ var init_git = __esm({
        * @param opts Command execution options.
        * @returns Remote URL if present.
        */
-      async remoteGet(path2, name, opts) {
+      async remoteGet(path3, name, opts) {
         if (!name) {
           throw new InvalidArgumentError("Remote name is required.");
         }
-        const cmd = `${buildGitCommand(["remote", "get-url", name], path2)} || true`;
+        const cmd = `${buildGitCommand(["remote", "get-url", name], path3)} || true`;
         const result = await this.runShell(cmd, opts);
         const trimmed = result.stdout.trim();
         return trimmed.length > 0 ? trimmed : void 0;
@@ -2471,10 +2465,10 @@ var init_git = __esm({
        * @param opts Command execution options.
        * @returns Parsed git status.
        */
-      async status(path2, opts) {
+      async status(path3, opts) {
         const result = await this.runGit(
           ["status", "--porcelain=1", "-b"],
-          path2,
+          path3,
           opts
         );
         return parseGitStatus(result.stdout);
@@ -2486,10 +2480,10 @@ var init_git = __esm({
        * @param opts Command execution options.
        * @returns Parsed branch list.
        */
-      async branches(path2, opts) {
+      async branches(path3, opts) {
         const result = await this.runGit(
           ["branch", "--format=%(refname:short)	%(HEAD)"],
-          path2,
+          path3,
           opts
         );
         return parseGitBranches(result.stdout);
@@ -2502,8 +2496,8 @@ var init_git = __esm({
        * @param opts Command execution options.
        * @returns Command result from the command runner.
        */
-      async createBranch(path2, branch, opts) {
-        return this.runGit(["checkout", "-b", branch], path2, opts);
+      async createBranch(path3, branch, opts) {
+        return this.runGit(["checkout", "-b", branch], path3, opts);
       }
       /**
        * Check out an existing branch.
@@ -2513,8 +2507,8 @@ var init_git = __esm({
        * @param opts Command execution options.
        * @returns Command result from the command runner.
        */
-      async checkoutBranch(path2, branch, opts) {
-        return this.runGit(["checkout", branch], path2, opts);
+      async checkoutBranch(path3, branch, opts) {
+        return this.runGit(["checkout", branch], path3, opts);
       }
       /**
        * Delete a branch.
@@ -2524,10 +2518,10 @@ var init_git = __esm({
        * @param opts Delete options.
        * @returns Command result from the command runner.
        */
-      async deleteBranch(path2, branch, opts) {
+      async deleteBranch(path3, branch, opts) {
         const _a3 = opts != null ? opts : {}, { force } = _a3, rest = __objRest(_a3, ["force"]);
         const args = ["branch", force ? "-D" : "-d", branch];
-        return this.runGit(args, path2, rest);
+        return this.runGit(args, path3, rest);
       }
       /**
        * Stage files for commit.
@@ -2536,7 +2530,7 @@ var init_git = __esm({
        * @param opts Add options.
        * @returns Command result from the command runner.
        */
-      async add(path2, opts) {
+      async add(path3, opts) {
         const _a3 = opts != null ? opts : {}, { files, all = true } = _a3, rest = __objRest(_a3, ["files", "all"]);
         const args = ["add"];
         if (!files || files.length === 0) {
@@ -2544,7 +2538,7 @@ var init_git = __esm({
         } else {
           args.push("--", ...files);
         }
-        return this.runGit(args, path2, rest);
+        return this.runGit(args, path3, rest);
       }
       /**
        * Create a commit in the repository.
@@ -2554,7 +2548,7 @@ var init_git = __esm({
        * @param opts Commit options.
        * @returns Command result from the command runner.
        */
-      async commit(path2, message, opts) {
+      async commit(path3, message, opts) {
         const _a3 = opts != null ? opts : {}, { authorName, authorEmail, allowEmpty } = _a3, rest = __objRest(_a3, ["authorName", "authorEmail", "allowEmpty"]);
         const args = ["commit", "-m", message];
         if (allowEmpty) {
@@ -2567,7 +2561,7 @@ var init_git = __esm({
         if (authorEmail) {
           authorArgs.push("-c", `user.email=${authorEmail}`);
         }
-        return this.runGit([...authorArgs, ...args], path2, rest);
+        return this.runGit([...authorArgs, ...args], path3, rest);
       }
       /**
        * Reset the current HEAD to a specified state.
@@ -2576,7 +2570,7 @@ var init_git = __esm({
        * @param opts Reset options.
        * @returns Command result from the command runner.
        */
-      async reset(path2, opts) {
+      async reset(path3, opts) {
         const _a3 = opts != null ? opts : {}, { mode, target, paths: paths2 } = _a3, rest = __objRest(_a3, ["mode", "target", "paths"]);
         const allowedModes = [
           "soft",
@@ -2600,7 +2594,7 @@ var init_git = __esm({
         if (paths2 && paths2.length > 0) {
           args.push("--", ...paths2);
         }
-        return this.runGit(args, path2, rest);
+        return this.runGit(args, path3, rest);
       }
       /**
        * Restore working tree files or unstage changes.
@@ -2609,7 +2603,7 @@ var init_git = __esm({
        * @param opts Restore options.
        * @returns Command result from the command runner.
        */
-      async restore(path2, opts) {
+      async restore(path3, opts) {
         const _a3 = opts, { paths: paths2, staged, worktree, source } = _a3, rest = __objRest(_a3, ["paths", "staged", "worktree", "source"]);
         if (!paths2 || paths2.length === 0) {
           throw new InvalidArgumentError("At least one path is required.");
@@ -2639,7 +2633,7 @@ var init_git = __esm({
           args.push("--source", source);
         }
         args.push("--", ...paths2);
-        return this.runGit(args, path2, rest);
+        return this.runGit(args, path3, rest);
       }
       /**
        * Push commits to a remote.
@@ -2648,7 +2642,7 @@ var init_git = __esm({
        * @param opts Push options.
        * @returns Command result from the command runner.
        */
-      async push(path2, opts) {
+      async push(path3, opts) {
         const _a3 = opts != null ? opts : {}, {
           remote,
           branch,
@@ -2668,16 +2662,16 @@ var init_git = __esm({
           );
         }
         if (username && password) {
-          const remoteName = await this.resolveRemoteName(path2, remote, rest);
+          const remoteName = await this.resolveRemoteName(path3, remote, rest);
           return this.withRemoteCredentials(
-            path2,
+            path3,
             remoteName,
             username,
             password,
             rest,
             () => this.runGit(
               buildPushArgs(remoteName, { remote, branch, setUpstream }),
-              path2,
+              path3,
               rest
             )
           );
@@ -2685,7 +2679,7 @@ var init_git = __esm({
         try {
           return await this.runGit(
             buildPushArgs(void 0, { remote, branch, setUpstream }),
-            path2,
+            path3,
             rest
           );
         } catch (err) {
@@ -2707,7 +2701,7 @@ var init_git = __esm({
        * @param opts Pull options.
        * @returns Command result from the command runner.
        */
-      async pull(path2, opts) {
+      async pull(path3, opts) {
         const _a3 = opts != null ? opts : {}, { remote, branch, username, password } = _a3, rest = __objRest(_a3, ["remote", "branch", "username", "password"]);
         if (password && !username) {
           throw new InvalidArgumentError(
@@ -2715,7 +2709,7 @@ var init_git = __esm({
           );
         }
         if (!remote && !branch) {
-          const hasUpstream = await this.hasUpstream(path2, rest);
+          const hasUpstream = await this.hasUpstream(path3, rest);
           if (!hasUpstream) {
             throw new GitUpstreamError(buildUpstreamErrorMessage("pull"));
           }
@@ -2732,18 +2726,18 @@ var init_git = __esm({
           return args;
         };
         if (username && password) {
-          const remoteName = await this.resolveRemoteName(path2, remote, rest);
+          const remoteName = await this.resolveRemoteName(path3, remote, rest);
           return this.withRemoteCredentials(
-            path2,
+            path3,
             remoteName,
             username,
             password,
             rest,
-            () => this.runGit(buildArgs(remoteName), path2, rest)
+            () => this.runGit(buildArgs(remoteName), path3, rest)
           );
         }
         try {
-          return await this.runGit(buildArgs(), path2, rest);
+          return await this.runGit(buildArgs(), path3, rest);
         } catch (err) {
           if (isAuthFailure(err)) {
             throw new GitAuthError(
@@ -2880,8 +2874,8 @@ var init_git = __esm({
           envs: mergedEnvs
         }));
       }
-      async getRemoteUrl(path2, remote, opts) {
-        const result = await this.runGit(["remote", "get-url", remote], path2, opts);
+      async getRemoteUrl(path3, remote, opts) {
+        const result = await this.runGit(["remote", "get-url", remote], path3, opts);
         const url = result.stdout.trim();
         if (!url) {
           throw new InvalidArgumentError(
@@ -2890,11 +2884,11 @@ var init_git = __esm({
         }
         return url;
       }
-      async resolveRemoteName(path2, remote, opts) {
+      async resolveRemoteName(path3, remote, opts) {
         if (remote) {
           return remote;
         }
-        const result = await this.runGit(["remote"], path2, opts);
+        const result = await this.runGit(["remote"], path3, opts);
         const remotes = result.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
         if (remotes.length === 1) {
           return remotes[0];
@@ -2903,10 +2897,10 @@ var init_git = __esm({
           "Remote is required when using username/password and the repository has multiple remotes."
         );
       }
-      async withRemoteCredentials(path2, remote, username, password, opts, operation) {
-        const originalUrl = await this.getRemoteUrl(path2, remote, opts);
+      async withRemoteCredentials(path3, remote, username, password, opts, operation) {
+        const originalUrl = await this.getRemoteUrl(path3, remote, opts);
         const credentialUrl = withCredentials(originalUrl, username, password);
-        await this.runGit(["remote", "set-url", remote, credentialUrl], path2, opts);
+        await this.runGit(["remote", "set-url", remote, credentialUrl], path3, opts);
         let result;
         let operationError;
         try {
@@ -2916,7 +2910,7 @@ var init_git = __esm({
         }
         let restoreError;
         try {
-          await this.runGit(["remote", "set-url", remote, originalUrl], path2, opts);
+          await this.runGit(["remote", "set-url", remote, originalUrl], path3, opts);
         } catch (err) {
           restoreError = err;
         }
@@ -2928,11 +2922,11 @@ var init_git = __esm({
         }
         return result;
       }
-      async hasUpstream(path2, opts) {
+      async hasUpstream(path3, opts) {
         try {
           const result = await this.runGit(
             ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"],
-            path2,
+            path3,
             opts
           );
           return result.stdout.trim().length > 0;
@@ -3015,11 +3009,11 @@ function normalizeSecretHosts(hosts) {
   }
   return normalizedHosts;
 }
-async function request(method, path2, feature, opts, body) {
+async function request(method, path3, feature, opts, body) {
   const config = new ConnectionConfig(opts);
   raiseIfLegacy(config, feature, SecretError);
   const headers = __spreadValues(__spreadValues(__spreadValues(__spreadValues({}, config.headers), body ? { "Content-Type": "application/json" } : {}), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {});
-  const response = await fetch(`${config.apiUrl}${path2}`, {
+  const response = await fetch(`${config.apiUrl}${path3}`, {
     method,
     headers,
     body: body ? JSON.stringify(body) : void 0,
@@ -3437,7 +3431,7 @@ var init_sandboxApi = __esm({
         }
         return true;
       }
-      static async mountVolume(sandboxId, name, path2, opts) {
+      static async mountVolume(sandboxId, name, path3, opts) {
         var _a3, _b;
         const config = new ConnectionConfig(opts);
         raiseIfLegacy(config, "Sandbox.mountVolume", SandboxError);
@@ -3448,7 +3442,7 @@ var init_sandboxApi = __esm({
             headers: getRawApiHeaders(config, {
               "Content-Type": "application/json"
             }),
-            body: JSON.stringify({ name, path: path2 }),
+            body: JSON.stringify({ name, path: path3 }),
             signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
           }
         );
@@ -3473,14 +3467,14 @@ var init_sandboxApi = __esm({
           volumeMounts: (_b = data.volumeMounts) != null ? _b : []
         };
       }
-      static async unmountVolume(sandboxId, path2, opts) {
+      static async unmountVolume(sandboxId, path3, opts) {
         var _a3, _b;
         const config = new ConnectionConfig(opts);
         raiseIfLegacy(config, "Sandbox.unmountVolume", SandboxError);
         const url = new URL(
           `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/volume-mounts`
         );
-        url.searchParams.set("path", path2);
+        url.searchParams.set("path", path3);
         if (opts == null ? void 0 : opts.force) {
           url.searchParams.set("force", "true");
         }
@@ -3774,7 +3768,7 @@ var init_sandboxApi = __esm({
         return true;
       }
       static async createSandbox(template, timeoutMs, opts) {
-        var _a3, _b, _c, _d, _e, _f;
+        var _a3, _b, _c, _d, _e, _f, _g;
         const config = new ConnectionConfig(opts);
         const lifecycle = getLifecycle(opts);
         const autoPause = lifecycle.onTimeout === "pause";
@@ -3783,8 +3777,13 @@ var init_sandboxApi = __esm({
           if (opts == null ? void 0 : opts.mcp) {
             raiseIfLegacy(config, "Sandbox.create mcp", SandboxError);
           }
-          if (opts == null ? void 0 : opts.network) {
-            raiseIfLegacy(config, "Sandbox.create network", SandboxError);
+          const unsupportedNetworkOptions = Object.keys((_b = opts == null ? void 0 : opts.network) != null ? _b : {}).filter(
+            (key) => key !== "allowPublicTraffic"
+          );
+          if (unsupportedNetworkOptions.length > 0) {
+            throw new SandboxError(
+              `Sandbox.create network only supports allowPublicTraffic on legacy domains; unsupported options: ${unsupportedNetworkOptions.join(", ")}`
+            );
           }
           if (opts == null ? void 0 : opts.volumeMounts) {
             raiseIfLegacy(config, "Sandbox.create volumeMounts", SandboxError);
@@ -3792,14 +3791,14 @@ var init_sandboxApi = __esm({
           if (opts == null ? void 0 : opts.secretEnvs) {
             raiseIfLegacy(config, "Sandbox.create secretEnvs", SandboxError);
           }
-          const body2 = __spreadValues({
+          const body2 = __spreadValues(__spreadValues({
             templateID: template,
             timeout: timeoutToSeconds(timeoutMs),
-            metadata: (_b = opts == null ? void 0 : opts.metadata) != null ? _b : {},
-            envVars: (_c = opts == null ? void 0 : opts.envs) != null ? _c : {},
-            secure: (_d = opts == null ? void 0 : opts.secure) != null ? _d : false,
+            metadata: (_c = opts == null ? void 0 : opts.metadata) != null ? _c : {},
+            envVars: (_d = opts == null ? void 0 : opts.envs) != null ? _d : {},
+            secure: (_e = opts == null ? void 0 : opts.secure) != null ? _e : false,
             autoPause: autoPause != null ? autoPause : false
-          }, (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {});
+          }, (opts == null ? void 0 : opts.network) ? { network: opts.network } : {}), (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {});
           const response = await fetch(`${config.apiUrl}/sandboxes`, {
             method: "POST",
             headers: getRawApiHeaders(config, {
@@ -3823,7 +3822,7 @@ var init_sandboxApi = __esm({
             sandboxDomain: data.domain || void 0,
             envdVersion: data.envdVersion,
             envdAccessToken: data.envdAccessToken,
-            trafficAccessToken: void 0
+            trafficAccessToken: data.trafficAccessToken || void 0
           };
         }
         const client = new ApiClient(config);
@@ -3833,8 +3832,8 @@ var init_sandboxApi = __esm({
           mcp: opts == null ? void 0 : opts.mcp,
           envVars: opts == null ? void 0 : opts.envs,
           timeout: timeoutToSeconds(timeoutMs),
-          secure: (_e = opts == null ? void 0 : opts.secure) != null ? _e : true,
-          allow_internet_access: (_f = opts == null ? void 0 : opts.allowInternetAccess) != null ? _f : true,
+          secure: (_f = opts == null ? void 0 : opts.secure) != null ? _f : true,
+          allow_internet_access: (_g = opts == null ? void 0 : opts.allowInternetAccess) != null ? _g : true,
           network: opts == null ? void 0 : opts.network
         }, (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {}), autoPause !== void 0 ? { autoPause } : {}), autoResumeEnabled !== void 0 ? { autoResume: { enabled: autoResumeEnabled } } : {});
         if (opts == null ? void 0 : opts.volumeMounts) {
@@ -3887,7 +3886,9 @@ var init_sandboxApi = __esm({
               headers: getRawApiHeaders(config, {
                 "Content-Type": "application/json"
               }),
-              body: JSON.stringify({ timeout: timeoutToSeconds(timeoutMs) }),
+              body: JSON.stringify(__spreadValues(__spreadValues(__spreadValues({
+                timeout: timeoutToSeconds(timeoutMs)
+              }, (opts == null ? void 0 : opts.secure) !== void 0 ? { secure: opts.secure } : {}), (opts == null ? void 0 : opts.allowPublicTraffic) !== void 0 ? { allowPublicTraffic: opts.allowPublicTraffic } : {}), (opts == null ? void 0 : opts.network) ? { network: opts.network } : {})),
               signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
             }
           );
@@ -3903,7 +3904,7 @@ var init_sandboxApi = __esm({
             sandboxDomain: data.domain || void 0,
             envdVersion: data.envdVersion || "0.0.0",
             envdAccessToken: data.envdAccessToken,
-            trafficAccessToken: void 0
+            trafficAccessToken: data.trafficAccessToken || void 0
           };
         }
         const client = new ApiClient(config);
@@ -4162,7 +4163,7 @@ var init_sandboxApi = __esm({
 
 // src/core/sandbox/signature.ts
 async function getSignature({
-  path: path2,
+  path: path3,
   operation,
   user,
   expirationInSeconds,
@@ -4179,9 +4180,9 @@ async function getSignature({
     user = "";
   }
   if (signatureExpiration === null) {
-    signatureRaw = `${path2}:${operation}:${user}:${envdAccessToken}`;
+    signatureRaw = `${path3}:${operation}:${user}:${envdAccessToken}`;
   } else {
-    signatureRaw = `${path2}:${operation}:${user}:${envdAccessToken}:${signatureExpiration.toString()}`;
+    signatureRaw = `${path3}:${operation}:${user}:${envdAccessToken}:${signatureExpiration.toString()}`;
   }
   const hashBase64 = await sha256(signatureRaw);
   const signature = "v1_" + hashBase64.replace(/=+$/, "");
@@ -4387,8 +4388,8 @@ var init_sandbox = __esm({
        *
        * @returns updated sandbox information.
        */
-      static async mountVolume(sandboxId, name, path2, opts) {
-        return await SandboxApi.mountVolume(sandboxId, name, path2, opts);
+      static async mountVolume(sandboxId, name, path3, opts) {
+        return await SandboxApi.mountVolume(sandboxId, name, path3, opts);
       }
       /**
        * Unmount a volume from a sandbox.
@@ -4400,8 +4401,8 @@ var init_sandbox = __esm({
        *
        * @returns updated sandbox information.
        */
-      static async unmountVolume(sandboxId, path2, opts) {
-        return await SandboxApi.unmountVolume(sandboxId, path2, opts);
+      static async unmountVolume(sandboxId, path3, opts) {
+        return await SandboxApi.unmountVolume(sandboxId, path3, opts);
       }
       /**
        * Commit a sandbox to create a snapshot template.
@@ -4636,11 +4637,11 @@ var init_sandbox = __esm({
        *
        * @returns updated sandbox information.
        */
-      async mountVolume(name, path2, opts) {
+      async mountVolume(name, path3, opts) {
         return await SandboxApi.mountVolume(
           this.sandboxId,
           name,
-          path2,
+          path3,
           this.resolveApiOpts(opts)
         );
       }
@@ -4653,10 +4654,10 @@ var init_sandbox = __esm({
        *
        * @returns updated sandbox information.
        */
-      async unmountVolume(path2, opts) {
+      async unmountVolume(path3, opts) {
         return await SandboxApi.unmountVolume(
           this.sandboxId,
-          path2,
+          path3,
           this.resolveApiOpts(opts)
         );
       }
@@ -4790,7 +4791,7 @@ var init_sandbox = __esm({
        *
        * @returns URL for uploading file.
        */
-      async uploadUrl(path2, opts) {
+      async uploadUrl(path3, opts) {
         opts = opts != null ? opts : {};
         const useSignature = !!this.envdAccessToken;
         if (!useSignature && opts.useSignatureExpiration != void 0) {
@@ -4802,7 +4803,7 @@ var init_sandbox = __esm({
         if (username == void 0 && (0, import_compare_versions5.compareVersions)(this.envdApi.version, ENVD_DEFAULT_USER) < 0) {
           username = defaultUsername;
         }
-        const filePath = path2 != null ? path2 : "";
+        const filePath = path3 != null ? path3 : "";
         const fileUrl = this.fileUrl(filePath, username);
         if (useSignature) {
           const url = new URL(fileUrl);
@@ -4830,7 +4831,7 @@ var init_sandbox = __esm({
        *
        * @returns URL for downloading file.
        */
-      async downloadUrl(path2, opts) {
+      async downloadUrl(path3, opts) {
         opts = opts != null ? opts : {};
         const useSignature = !!this.envdAccessToken;
         if (!useSignature && opts.useSignatureExpiration != void 0) {
@@ -4842,11 +4843,11 @@ var init_sandbox = __esm({
         if (username == void 0 && (0, import_compare_versions5.compareVersions)(this.envdApi.version, ENVD_DEFAULT_USER) < 0) {
           username = defaultUsername;
         }
-        const fileUrl = this.fileUrl(path2, username);
+        const fileUrl = this.fileUrl(path3, username);
         if (useSignature) {
           const url = new URL(fileUrl);
           const sig = await getSignature({
-            path: path2,
+            path: path3,
             operation: "read",
             user: username,
             expirationInSeconds: opts.useSignatureExpiration,
@@ -4900,13 +4901,13 @@ var init_sandbox = __esm({
       resolveApiOpts(opts) {
         return __spreadValues(__spreadValues({}, this.connectionConfig), opts != null ? opts : {});
       }
-      fileUrl(path2, username) {
+      fileUrl(path3, username) {
         const url = new URL("/files", this.envdApiUrl);
         if (username) {
           url.searchParams.set("username", username);
         }
-        if (path2) {
-          url.searchParams.set("path", path2);
+        if (path3) {
+          url.searchParams.set("path", path3);
         }
         return url.toString();
       }
@@ -5097,8 +5098,8 @@ function readDockerignore(contextPath) {
   const content = import_node_fs.default.readFileSync(dockerignorePath, "utf-8");
   return content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
 }
-function normalizePath(path2) {
-  return path2.replace(/\\/g, "/");
+function normalizePath(path3) {
+  return path3.replace(/\\/g, "/");
 }
 async function getAllFilesInPath(src, contextPath, ignorePatterns, includeDirectories = true) {
   const { glob } = await dynamicImport("glob");
@@ -5210,8 +5211,7 @@ function getCallerDirectory(depth) {
     return void 0;
   }
   if (fileName.startsWith("file:")) {
-    const { fileURLToPath } = dynamicRequire("node:url");
-    fileName = fileURLToPath(fileName);
+    fileName = (0, import_node_url.fileURLToPath)(fileName);
   }
   return import_node_path.default.dirname(fileName);
 }
@@ -5260,13 +5260,14 @@ function readGCPServiceAccountJSON(contextPath, pathOrContent) {
   }
   return JSON.stringify(pathOrContent);
 }
-var import_node_crypto, import_node_fs, import_node_path;
+var import_node_crypto, import_node_fs, import_node_path, import_node_url;
 var init_utils3 = __esm({
   "src/core/template/utils.ts"() {
     "use strict";
     import_node_crypto = __toESM(require("crypto"));
     import_node_fs = __toESM(require("fs"));
     import_node_path = __toESM(require("path"));
+    import_node_url = require("url");
     init_utils();
     init_errors();
     init_consts();
@@ -6735,8 +6736,8 @@ var init_template = __esm({
         });
         return this;
       }
-      remove(path2, options) {
-        const paths2 = Array.isArray(path2) ? path2 : [path2];
+      remove(path3, options) {
+        const paths2 = Array.isArray(path3) ? path3 : [path3];
         const args = ["rm"];
         if (options == null ? void 0 : options.recursive) {
           args.push("-r");
@@ -6758,8 +6759,8 @@ var init_template = __esm({
           () => this.runCmd(args.join(" "), { user: options == null ? void 0 : options.user })
         );
       }
-      makeDir(path2, options) {
-        const paths2 = Array.isArray(path2) ? path2 : [path2];
+      makeDir(path3, options) {
+        const paths2 = Array.isArray(path3) ? path3 : [path3];
         const args = ["mkdir", "-p"];
         if (options == null ? void 0 : options.mode) {
           args.push(`-m ${padOctal(options.mode)}`);
@@ -6894,7 +6895,7 @@ var init_template = __esm({
           })
         );
       }
-      gitClone(url, path2, options) {
+      gitClone(url, path3, options) {
         const args = ["git", "clone", url];
         if (options == null ? void 0 : options.branch) {
           args.push(`--branch ${options.branch}`);
@@ -6903,8 +6904,8 @@ var init_template = __esm({
         if (options == null ? void 0 : options.depth) {
           args.push(`--depth ${options.depth}`);
         }
-        if (path2) {
-          args.push(path2.toString());
+        if (path3) {
+          args.push(path3.toString());
         }
         return this.runInNewStackTraceContext(
           () => this.runCmd(args.join(" "), { user: options == null ? void 0 : options.user })
@@ -8305,10 +8306,10 @@ var init_sandbox3 = __esm({
         }
       }
       async screenshot(format = "bytes") {
-        const path2 = `/tmp/screenshot-${generateRandomString()}.png`;
-        await this.commands.run(`scrot --pointer ${path2}`);
-        const file = await this.files.read(path2, { format });
-        this.files.remove(path2);
+        const path3 = `/tmp/screenshot-${generateRandomString()}.png`;
+        await this.commands.run(`scrot --pointer ${path3}`);
+        const file = await this.files.read(path3, { format });
+        this.files.remove(path3);
         return file;
       }
       /**
@@ -8657,7 +8658,7 @@ function mergeConnectionOpts(base, next) {
     headers: __spreadValues(__spreadValues({}, baseHeaders), nextHeaders)
   });
 }
-var RuntimeSandboxNamespace, SandboxNamespace, TemplateNamespace, VolumeNamespace, SecretNamespace, PPIO;
+var import_node_path2, import_node_url2, RuntimeSandboxNamespace, SandboxNamespace, TemplateNamespace, VolumeNamespace, SecretNamespace, PPIO;
 var init_client = __esm({
   "src/core/client.ts"() {
     "use strict";
@@ -8665,6 +8666,9 @@ var init_client = __esm({
     init_template();
     init_volume();
     init_secret();
+    init_utils3();
+    import_node_path2 = __toESM(require("path"));
+    import_node_url2 = require("url");
     RuntimeSandboxNamespace = class {
       constructor(opts, loadSandbox) {
         this.opts = opts;
@@ -8861,7 +8865,18 @@ var init_client = __esm({
         this.toDockerfile = Template.toDockerfile;
       }
       new(options) {
-        return Template(options);
+        var _a3;
+        let callerContext = ".";
+        for (const site of callsites(2)) {
+          const fileName = site.getFileName();
+          if (fileName && (!fileName.includes("/src/core/") || fileName.includes("/src/core/tests/")) && !fileName.includes("/node_modules/ppio-sandbox/")) {
+            callerContext = import_node_path2.default.dirname(fileName.startsWith("file:") ? (0, import_node_url2.fileURLToPath)(fileName) : fileName);
+            break;
+          }
+        }
+        return Template(__spreadProps(__spreadValues({}, options), {
+          fileContextPath: (_a3 = options == null ? void 0 : options.fileContextPath) != null ? _a3 : callerContext
+        }));
       }
       list(opts) {
         return Template.list(mergeConnectionOpts(this.opts, opts));