withruntime 0.11.0 → 0.11.1

package/BLAXEL.md

@@ -48,15 +48,14 @@ name, or through `getByExternalId`, use the same Runtime key.
   resumes on the next call. On Runtime it pauses after 60 seconds without a
   call (Runtime's shortest idle pause; Blaxel's is about 15 seconds), keeping
   its memory, files and processes, and wakes by itself on the next command,
-  file call or preview visit. Its lease is Runtime's longest, an hour, and the
-  adapter renews it in the background while the sandbox is in use; when a lease
-  does run out the sandbox pauses rather than ends.
+  file call or preview visit. It has no time limit, so a sandbox in use is
+  never paused on a clock.
 - **How long it is kept:** Blaxel keeps a sandbox until it is deleted or its
   TTL ends. A paused Runtime sandbox is kept 365 days when no TTL, expiry or
   lifecycle is given. With one, it is never deleted before Blaxel would delete
   it, and may be kept longer:
-  - a `ttl`, `expires`, `ttl-max-age` or `date` within the hour is a lease that
-    ends the sandbox at that time, or later if the sandbox paused and woke;
+  - a `ttl`, `expires`, `ttl-max-age` or `date` within the hour is a time limit
+    that ends the sandbox at that time, or later if the sandbox paused and woke;
   - any other deadline, and any `ttl-idle`, keeps a paused sandbox that many
     days, rounded up, counted from each pause; with several, the shortest wins;
   - at most 365 days.
@@ -161,9 +160,9 @@ Some differences are not refusals:
   The old idle pause comes back once no `keepAlive` process runs, when a client
   sees one end (a waited exec, `wait` or `get`), stops or kills one, or calls
   `SandboxInstance.get`. With no such call, the sandbox pauses when it has been
-  idle for that `timeout`. A `keepAlive` process past Runtime's hour-long lease
-  is paused with the sandbox when the lease ends with no call to renew it, and
-  carries on at the next call.
+  idle for that `timeout`. On a sandbox with a time limit, a `keepAlive`
+  process past it is paused with the sandbox when the limit ends with no call
+  to renew it, and carries on at the next call.
 - **A name is not refused while its process runs:** a second process may take a
   running process's name, and `get(name)` answers the newest.
 - **`process.list()` leaves each process's output empty** (Blaxel includes a

package/DAYTONA.md

@@ -38,14 +38,13 @@ package talks only to Runtime.
   kept for Runtime's retention: 30 days on credit, 7 on the trial, or
   `autoDeleteInterval` minutes rounded up to whole days. `delete()` ends it.
   An `ephemeral` sandbox (or `autoDeleteInterval: 0`) ends on `stop()`.
-- **Auto-stop:** Runtime runs a sandbox on a lease of up to an hour. The lease
-  is `autoStopInterval` minutes (default 15), and every call through the
-  adapter moves it on once less than half is left, so a sandbox pauses after
-  that long without calls, as Daytona's does. Past an hour, or `0` (never),
-  the sandbox object also renews the lease each minute while it lives, toward
-  `autoStopInterval` after the last call; once the program ends, the sandbox
-  pauses within an hour. `ttlMinutes` caps the renewals and ends the sandbox at
-  the deadline.
+- **Auto-stop:** `autoStopInterval` minutes (default 15; `0` never) is the
+  sandbox's idle pause: it pauses after that long with nothing happening in
+  it, counted by the sandbox itself, so a long command is never paused for
+  want of calls. It has no time limit. `ttlMinutes` gives it one, and with
+  it Daytona's own rule: the sandbox pauses after `autoStopInterval` minutes
+  without a call through the adapter, each call moving the limit on, and ends
+  at the deadline.
 - **Funding:** left to Runtime, as `withruntime`'s own `create()` does: the free
   trial while the account has trial time, then prepaid credit. Pass
   `withruntime: { create: { funding: "trial" } }` to `new Daytona(...)` or to

package/E2B.md

@@ -41,6 +41,20 @@ machine. An E2B key (`e2b_...`) is never sent anywhere. If one is passed as
 - **Timeout:** E2B's default of 300 seconds. When it ends, the sandbox is
   stopped, as E2B kills it. `lifecycle: { onTimeout: "pause" }` pauses it
   instead.
+- **Idle pause:** Runtime's default, which E2B does not have. After 60
+  seconds with nothing happening in it (no request, running command, open
+  connection, traffic or CPU use) the sandbox pauses with its memory kept, and
+  the next command or file call wakes it. While it is paused, `isRunning()`
+  is `false` and `getInfo()` says `paused`, so code that reads either as
+  "the sandbox is gone" should not. Pass
+  `runtime: { create: { idlePauseSeconds: 0 } }` (Python:
+  `runtime_create={"idle_pause_seconds": 0}`) to keep it running, as on E2B.
+- **Connections:** one client per key, holding at most 48 connections to the
+  API at once, since one address may hold 64. Each command being run holds
+  one while its output is read, and 8 are kept for other calls, so past 40
+  commands at once from one process the rest wait their turn. Pass your own
+  client with `runtime: { client: new Runtime({ maxConnections }) }` (Python:
+  `client=Runtime(max_connections=...)`).
 - **Funding:** left to Runtime, as `withruntime`'s own `create()` does. The
   free trial is used while the account has trial time, then prepaid credit.
   Pass `runtime: { create: { funding: "trial" } }` to use only the trial.
@@ -54,7 +68,7 @@ machine. An E2B key (`e2b_...`) is never sent anywhere. If one is passed as
 | E2B                                                                                      | On Runtime                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `Sandbox.create()`, `Sandbox.create(template, opts)`                                     | `sandboxes.create`. `base` and `code-interpreter-v1` are Runtime's stock image. Any other name must be a ready Runtime image with that name. A UUID is an image or a snapshot.                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `timeoutMs` (Python `timeout`, seconds)                                                  | `timeoutSeconds`, rounded up. Under 60 s becomes 60 s, with a warning. Up to 24 hours, as on E2B: a Runtime lease reaches at most an hour ahead, so while this process runs the adapter extends it every five minutes, never past the end asked for. If the process ends first, the sandbox ends with its last lease, at most an hour later. Over 24 hours throws `InvalidArgumentError`.                                                                                                                                                                                                               |
+| `timeoutMs` (Python `timeout`, seconds)                                                  | Left out, the sandbox has no time limit: it runs while it works and pauses itself when idle. Given, it is `timeoutSeconds`, rounded up. Under 60 s becomes 60 s, with a warning. Up to 24 hours, as on E2B: a Runtime time limit reaches at most an hour ahead, so while this process runs the adapter extends it every five minutes, never past the end asked for. If the process ends first, the sandbox ends at its last limit, at most an hour later. Over 24 hours throws `InvalidArgumentError`.                                                                                                  |
 | `metadata`                                                                               | labels (at most 32).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `envs`                                                                                   | Given to every command and code run through this object.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `allowInternetAccess: false`                                                             | `network: { internet: false }`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
@@ -73,7 +87,7 @@ machine. An E2B key (`e2b_...`) is never sent anywhere. If one is passed as
 | Relative paths                                                                           | Resolved against the home directory, `/workspace` on Runtime.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `/home/user` (E2B's home)                                                                | The first time a path, `cwd` or command names it, it becomes a link to `/workspace`, unless something is already there.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `sandbox.kill()`, `Sandbox.kill(id)`                                                     | `stop`, without waiting. `false` when the sandbox was not found or had already ended.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `sandbox.setTimeout(ms)`, `Sandbox.setTimeout(id, ms)`                                   | `extend`: the end moves to now + ms, up to 24 hours (past an hour it is carried on as for `timeoutMs`). An earlier end is refused: Runtime cannot end a lease early.                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `sandbox.setTimeout(ms)`, `Sandbox.setTimeout(id, ms)`                                   | `extend`: the end moves to now + ms, up to 24 hours (past an hour it is carried on as for `timeoutMs`). An earlier end is refused: Runtime cannot end a lease early. A sandbox with no time limit has no end to move, and nothing changes.                                                                                                                                                                                                                                                                                                                                                              |
 | `Sandbox.connect(id, { timeoutMs })`, `sandbox.connect()`                                | `get`. A paused sandbox is woken. A running one's end moves later, never earlier, up to 24 hours. An ended one throws `SandboxNotFoundError`.                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `sandbox.pause()`, `betaPause`, `Sandbox.pause(id)`                                      | `pause`, keeping memory and files. `false` when it was already paused.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `getInfo`, `isRunning`                                                                   | `get`. `templateId` is `base` or the image or snapshot id. `envdVersion` is `runtime`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |

package/README.md

@@ -31,8 +31,8 @@ Node 22 call `await sbx.stop()`). With no arguments you get the free
 trial while it lasts (100 free hours, up to eight sandboxes running at once), 2 vCPU, 4 GiB of
 memory and a 4 GiB disk. The current default image includes NumPy, pandas and
 matplotlib; see the [sandbox environment](https://withruntime.com/docs/sandbox-environment).
-Omitting `funding` can use prepaid credit after the trial is exhausted. Use
-`Sandbox.create({ funding: "trial" })` for free use only; it never falls back to paid.
+The trial's hours are spent first, then prepaid credit, with nothing to
+choose; `funding` is accepted and ignored.
 
 The sandbox object does the rest:
 
@@ -45,7 +45,7 @@ The sandbox object does the rest:
   directories with `upload` and `download`;
 - `pause`, `wake`, `extend`, `fork` and `snapshot` (a paused sandbox also wakes
   by itself on the next call), `update` for its name, environment, automatic
-  wake, idle pause and persistence, `keepAlive` to extend its lease while your
+  wake, idle pause and persistence, `keepAlive` to move a time limit on while your
   process runs, `switchImage` to move it to a new image keeping /workspace,
   and `delete` to remove it for good;
 - `interpreter`, `network`, `previews`, `desktop`, `mounts` (your S3, R2 or

package/README.src.md

@@ -33,8 +33,8 @@ Node 22 call `await sbx.stop()`). With no arguments you get the free
 trial while it lasts ({{trial-hours}} free hours, up to {{trial-sandboxes}} sandboxes running at once), 2 vCPU, 4 GiB of
 memory and a 4 GiB disk. The current default image includes NumPy, pandas and
 matplotlib; see the [sandbox environment](https://withruntime.com/docs/sandbox-environment).
-Omitting `funding` can use prepaid credit after the trial is exhausted. Use
-`Sandbox.create({ funding: "trial" })` for free use only; it never falls back to paid.
+The trial's hours are spent first, then prepaid credit, with nothing to
+choose; `funding` is accepted and ignored.
 
 The sandbox object does the rest:
 
@@ -47,7 +47,7 @@ The sandbox object does the rest:
   directories with `upload` and `download`;
 - `pause`, `wake`, `extend`, `fork` and `snapshot` (a paused sandbox also wakes
   by itself on the next call), `update` for its name, environment, automatic
-  wake, idle pause and persistence, `keepAlive` to extend its lease while your
+  wake, idle pause and persistence, `keepAlive` to move a time limit on while your
   process runs, `switchImage` to move it to a new image keeping /workspace,
   and `delete` to remove it for good;
 - `interpreter`, `network`, `previews`, `desktop`, `mounts` (your S3, R2 or

package/VERCEL.md

@@ -33,8 +33,9 @@ are ignored.
 
 - **Machine:** Vercel's default, 2 vCPUs with 2048 MiB each.
   `resources: { vcpus }` sets another, with 2048 MiB per vCPU.
-- **Timeout:** Vercel's default of 5 minutes. Runtime's leases run 60 seconds to
-  an hour. A longer `timeout` (Python `execution_time_limit`) starts with an
+- **Timeout:** none unless you pass one: the sandbox runs while it works and
+  pauses itself when idle. A `timeout` is kept as a Runtime time limit, which
+  runs 60 seconds to an hour. A longer `timeout` (Python `execution_time_limit`) starts with an
   hour's lease, and the sandbox object renews it toward the timeout while it
   lives, never past it; once the program ends, the sandbox pauses within an
   hour. `extendTimeout` moves the end later, as often as needed.

package/compatibility-lock.json

@@ -229,6 +229,34 @@
           "artifacts": {
             "prime_sandboxes-0.4.1-py3-none-any.whl": "sha256-1a1bb96afacc66d690815be82c0b7af180ea141421b7d180b4a0adbada4f38f0",
             "prime_sandboxes-0.4.1.tar.gz": "sha256-53f7577dc9070e3b8e30db360f9e3cce3bcc35f8765b26f24f64dbc3c7763b06"
+          },
+          "latestReview": {
+            "version": "0.4.2",
+            "artifacts": {
+              "prime_sandboxes-0.4.2-py3-none-any.whl": "sha256-ed59f001c7575339d6c903166c5468f783eda0997586ec6476fd8b35f65746f9",
+              "prime_sandboxes-0.4.2.tar.gz": "sha256-4990a724cac0a662fde6e12e7eccfee092a78679cc568653b8ef52008dfa28e4"
+            },
+            "reviewedAt": "2026-10-02",
+            "disposition": "held-for-sdk-qualification",
+            "evidence": {
+              "sourceUrls": [
+                "https://pypi.org/pypi/prime-sandboxes/0.4.2/json",
+                "https://files.pythonhosted.org/packages/3f/4d/a379cdf82d6f06c970bd4f0333c2360c08aba65c809d7492f49aece84c66/prime_sandboxes-0.4.2.tar.gz",
+                "https://files.pythonhosted.org/packages/da/b5/6a9fe6ae1342872c1c0cc45072cc0c58a5fa2783c4c45770e585f2535c8f/prime_sandboxes-0.4.2-py3-none-any.whl",
+                "https://github.com/PrimeIntellect-ai/prime/tree/main/packages/prime-sandboxes"
+              ],
+              "artifactSha256": {
+                "prime_sandboxes-0.4.2-py3-none-any.whl": "ed59f001c7575339d6c903166c5468f783eda0997586ec6476fd8b35f65746f9",
+                "prime_sandboxes-0.4.2.tar.gz": "4990a724cac0a662fde6e12e7eccfee092a78679cc568653b8ef52008dfa28e4"
+              },
+              "changes": [
+                "Source diff of the 0.4.1 and 0.4.2 sdists, downloaded and hashed on the Mac, nothing installed or run: README, __init__, models.py, sandbox.py, one test changed; tests/test_checkpoints.py added.",
+                "Adds filesystem checkpoints: SandboxCheckpoint, CheckpointLookupError and BatchCheckpointResponse models; checkpoint, get_checkpoint, get_checkpoints (batch of up to 100 ids), wait_for_checkpoint and list_checkpoints on the sync and async clients; CreateSandboxRequest takes checkpoint_id with a validate_restore_source check.",
+                "CreateSandboxRequest.docker_image becomes Optional (None when restoring from a checkpoint) and disk_size_gb's default 5.0 becomes None.",
+                "Background job launch: the working_dir prefix is 'cd DIR || exit 1;' instead of 'cd DIR &&', and the launch cwd is / for an absolute working_dir.",
+                "No existing method was removed or renamed. Installed consumer qualification against withruntime/prime is not run; the supported pin stays 0.4.1."
+              ]
+            }
           }
         }
       ]
@@ -252,6 +280,33 @@
           "artifacts": {
             "modal-1.6.0-py3-none-any.whl": "sha256-2f5981ba656570ad96379d29f0ddff876880708c84966024ce130e9e1794fa68",
             "modal-1.6.0.tar.gz": "sha256-c5dd551b5e0a283f3c764476c0a4ebe5bdef1e4a69432fa27e1b1ad8ca5e0817"
+          },
+          "latestReview": {
+            "version": "1.6.1",
+            "artifacts": {
+              "modal-1.6.1-py3-none-any.whl": "sha256-f408ef88563003a83e491a6be09d4221eaa6e038fa4faa2ad8b15b25afe949a4",
+              "modal-1.6.1.tar.gz": "sha256-ff17768f67a65595aa7882e893e6cb78e2e001b3653aa52cfe98d4051d8d9e9e"
+            },
+            "reviewedAt": "2026-10-03",
+            "disposition": "held-for-sdk-qualification",
+            "evidence": {
+              "sourceUrls": [
+                "https://pypi.org/pypi/modal/1.6.1/json",
+                "https://files.pythonhosted.org/packages/65/ba/2b36899ea5633bf101e6ba6f7e95a4da3e4b1f57f52bd0ba8f4cfd12e808/modal-1.6.1.tar.gz",
+                "https://files.pythonhosted.org/packages/d2/3c/6b7d9a15dab9af2833ce674bbc72b5654d4099d5b088f1cc1eda3f8249ca/modal-1.6.1-py3-none-any.whl"
+              ],
+              "artifactSha256": {
+                "modal-1.6.1-py3-none-any.whl": "f408ef88563003a83e491a6be09d4221eaa6e038fa4faa2ad8b15b25afe949a4",
+                "modal-1.6.1.tar.gz": "ff17768f67a65595aa7882e893e6cb78e2e001b3653aa52cfe98d4051d8d9e9e"
+              },
+              "changes": [
+                "Source diff of the 1.6.0 and 1.6.1 sdists, downloaded and hashed on the Mac, nothing installed or run; the 1.6.0 hashes match the pin. No file added or removed; 37 files changed, most in sandbox.py, the CLI and the generated protos.",
+                "Sandbox v2 calls send a per-sandbox token (x-modal-sandbox-token, from the create response) beside the auth token through a new _v2_metadata helper, including command router access.",
+                "Experimental sidecars take include_oidc_identity_token and proxy, refused for GPU sandboxes. Server sessions retry start with an idempotency key for up to 25 minutes; the CLI gains endpoint commands; stats types gain container_total_count; agent detection reads tool variables before AGENT and AI_AGENT.",
+                "Requirements: protobuf below 8.0 instead of 7.0, synchronicity ~=0.12.6 instead of ~=0.12.5. Some iterator return types become AsyncGenerator.",
+                "No public Sandbox, ContainerProcess, Image, App or file method used by withruntime/modal was removed or renamed; that drop-in does not import modal. Installed consumer qualification is not run; the supported pin stays 1.6.0."
+              ]
+            }
           }
         }
       ]

package/dist/api-defaults.d.ts

@@ -2,7 +2,7 @@
 export declare const WAIT_FOR_TIMEOUT_SECONDS = 60;
 /** A streamed exec's command limit when none is given: the API's longest. */
 export declare const STREAMED_EXEC_TIMEOUT_MS = 86400000;
-/** The lease keepAlive keeps ahead of now, and so the most it extends by. */
+/** The time keepAlive keeps ahead of a time limit, and so the most it extends by. */
 export declare const KEEP_ALIVE_MARGIN_SECONDS = 600;
 /** A webhook watch runs until stopped. */
 export declare const WEBHOOK_WATCH_TIMEOUT_MS = 0;

package/dist/api-defaults.js

@@ -7,7 +7,7 @@
 export const WAIT_FOR_TIMEOUT_SECONDS = 60;
 /** A streamed exec's command limit when none is given: the API's longest. */
 export const STREAMED_EXEC_TIMEOUT_MS = 86_400_000;
-/** The lease keepAlive keeps ahead of now, and so the most it extends by. */
+/** The time keepAlive keeps ahead of a time limit, and so the most it extends by. */
 export const KEEP_ALIVE_MARGIN_SECONDS = 600;
 /** A webhook watch runs until stopped. */
 export const WEBHOOK_WATCH_TIMEOUT_MS = 0;

package/dist/blaxel/lookup.d.ts

@@ -23,7 +23,8 @@ export declare const STANDBY: {
     idlePauseSeconds: number;
     autoWake: true;
 };
-/** Runtime's longest lease. The adapter renews it while the sandbox is used. */
+/** Runtime's longest time limit. A sandbox made before 0300 has it, and the
+ * adapter renews it while the sandbox is used; one made since has none. */
 export declare const LEASE_SECONDS = 3600;
 /** The live sandbox with this name (or Runtime id): one call. A 404 when
  * there is none, as Blaxel answers. */

package/dist/blaxel/lookup.js

@@ -30,7 +30,8 @@ export const STANDBY = {
     idlePauseSeconds: 60,
     autoWake: true,
 };
-/** Runtime's longest lease. The adapter renews it while the sandbox is used. */
+/** Runtime's longest time limit. A sandbox made before 0300 has it, and the
+ * adapter renews it while the sandbox is used; one made since has none. */
 export const LEASE_SECONDS = 3600;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** The live sandbox with this name (or Runtime id): one call. A 404 when

package/dist/blaxel/sandbox.d.ts

@@ -58,16 +58,18 @@ type Resolved = {
 };
 /** A duration as Blaxel writes it ("30m", "24h", "7d", "1w", "1h30m"). */
 export declare function durationMs(value: string): number;
-/** The lease and the paused retention that honour Blaxel's TTL, expiry and
- * lifecycle: never deleted before Blaxel would delete it. A fixed deadline
- * within the hour is a lease that ends the sandbox; any other deadline keeps
- * a paused sandbox that many days, rounded up; none keeps it 365 days. */
+/** The time limit and the paused retention that honour Blaxel's TTL, expiry
+ * and lifecycle: never deleted before Blaxel would delete it. A fixed
+ * deadline within the hour is a time limit that ends the sandbox; past that
+ * there is none, so it runs while it works and pauses when idle (0300), and
+ * a paused sandbox is kept that many days, rounded up; none keeps it 365
+ * days. */
 export declare function lifetimeOf(asked: {
     ttl?: string | null;
     expires?: Date;
     lifecycle?: SandboxLifecycle | null;
 }): {
-    timeoutSeconds: number;
+    timeoutSeconds?: number;
     onLeaseEnd: "pause" | "stop";
     days: number;
 };

package/dist/blaxel/sandbox.js

@@ -71,10 +71,12 @@ export function durationMs(value) {
         total += Number(count) * unit[letter];
     return total;
 }
-/** The lease and the paused retention that honour Blaxel's TTL, expiry and
- * lifecycle: never deleted before Blaxel would delete it. A fixed deadline
- * within the hour is a lease that ends the sandbox; any other deadline keeps
- * a paused sandbox that many days, rounded up; none keeps it 365 days. */
+/** The time limit and the paused retention that honour Blaxel's TTL, expiry
+ * and lifecycle: never deleted before Blaxel would delete it. A fixed
+ * deadline within the hour is a time limit that ends the sandbox; past that
+ * there is none, so it runs while it works and pauses when idle (0300), and
+ * a paused sandbox is kept that many days, rounded up; none keeps it 365
+ * days. */
 export function lifetimeOf(asked) {
     const now = Date.now();
     const fixed = [];
@@ -110,7 +112,7 @@ export function lifetimeOf(asked) {
         : KEEP_DAYS;
     return soonest <= LEASE_SECONDS * 1000
         ? { timeoutSeconds: Math.max(60, Math.ceil(soonest / 1000)), onLeaseEnd: "stop", days }
-        : { timeoutSeconds: LEASE_SECONDS, onLeaseEnd: "pause", days };
+        : { onLeaseEnd: "pause", days };
 }
 /** Blaxel's network settings as Runtime's rules: allowed and forbidden
  * domains, from the network itself or from its proxy (Blaxel's current
@@ -402,9 +404,10 @@ export class SandboxInstance {
     }
     // ---- the live sandbox ---------------------------------------------------
     /** The sandbox, ready for a call. A paused one wakes by itself on the call
-     * (autoWake); one made without autoWake is woken here. A lease nearing its
-     * end is renewed in the background, so a sandbox in use is not paused by
-     * its lease. */
+     * (autoWake); one made without autoWake is woken here. A time limit
+     * nearing its end (an hour, on a sandbox made before 0300) is renewed in
+     * the background, so a sandbox in use is not paused by it; one with no
+     * time limit renews itself. */
     async #live() {
         if (this.#deleted)
             throw responseError(404, `Sandbox ${this.name} was deleted.`);
@@ -414,6 +417,8 @@ export class SandboxInstance {
             await this.#wake();
         else if (state === "running" &&
             rt.info.onLeaseEnd === "pause" &&
+            // One with no time limit renews itself (0300).
+            rt.info.endsAt !== null &&
             !this.#renewing &&
             Date.parse(rt.info.expiresAt) - Date.now() < RENEW_BELOW_MS)
             this.#renewing = rt
@@ -461,7 +466,7 @@ export class SandboxInstance {
                     labels: { ...labels, [IDLE_PAUSE]: labels[IDLE_PAUSE] ?? String(current ?? 0) },
                 }))
                 : undefined,
-            rt.info.onLeaseEnd === "pause" && need >= 1
+            rt.info.onLeaseEnd === "pause" && rt.info.endsAt !== null && need >= 1
                 ? rt.extend(Math.ceil(need)).catch(() => undefined)
                 : undefined,
         ]);
@@ -545,7 +550,7 @@ export class SandboxInstance {
             vcpu: Math.min(MAX_VCPU, Math.max(1, Math.round(memory / MEMORY_PER_VCPU))),
             memoryMiB: memory,
             ...STANDBY,
-            timeoutSeconds: lifetime.timeoutSeconds,
+            ...(lifetime.timeoutSeconds === undefined ? {} : { timeoutSeconds: lifetime.timeoutSeconds }),
             onLeaseEnd: lifetime.onLeaseEnd,
             ...(config.name ? { name: config.name } : {}),
             labels,

package/dist/cli.js

@@ -140,10 +140,10 @@ const SANDBOX_HELP = `runtime sandbox <command>
   resize <id> [--vcpu 2] [--memory 4096] --restart
                                               Change its size by a restart: the whole disk stays,
                                               programs stop (snapshot it first to keep memory)
-  extend <id> <seconds>                       More time before the lease ends
+  extend <id> <seconds>                       Move a time limit on (one with none needs nothing)
   update <id> [--name n] [--label k=v]... [--env K=V]... [--unset-env K]... [--idle-pause <seconds>] [--auto-wake on|off]
               [--persistent on|off] [--max-total-cost <usd>|none]
-                                              Change its settings; persistent keeps it running
+                                              Change its settings; persistent keeps it running until stopped
   snapshot <id> [--name n] [--retention days] Keep its whole machine; prints the snapshot id
   mount <id> <s3|r2|gcs>://<bucket>[/prefix] <path> [--secret NAME] [--region r]
         [--endpoint https://...] [--account-id id] [--read-only]
@@ -517,8 +517,18 @@ function describe(info) {
         ],
         ["funding", info.funding],
         ["region", info.region],
-        ["expires", info.expiresAt ?? "-"],
-        ["at lease end", info.onLeaseEnd ?? "-"],
+        // A sandbox with no time limit runs while it works (0300): endsAt is
+        // null. An older server sends no endsAt; its expiresAt was the end.
+        ["time limit", info.timeoutSeconds ? `${info.timeoutSeconds} s` : "none"],
+        [
+            "ends",
+            info.endsAt === null
+                ? info.state === "running"
+                    ? "when idle, stopped or out of credit"
+                    : "-"
+                : (info.endsAt ?? info.expiresAt ?? "-"),
+        ],
+        ["at its end", info.onLeaseEnd ?? "-"],
         // Why a sandbox is no longer running (troubleshooting.md, "A sandbox
         // stopped on its own"); `get` left both out until 30 September 2026.
         ...(info.pausedAt ? [["paused at", info.pausedAt]] : []),
@@ -1071,10 +1081,18 @@ export function usageCsv(u) {
         .join(","));
     return [head.join(","), ...rows].join("\n");
 }
+/** Milliseconds as hours, to a tenth: "8,731.2". */
+const hours = (ms) => (ms / 3_600_000).toLocaleString("en-US", { maximumFractionDigits: 1 });
 /** The free trial's time left, as `runtime usage` and `runtime limits` say it. */
 function trialLeft(trial) {
-    const hours = (ms) => (ms / 3_600_000).toLocaleString("en-US", { maximumFractionDigits: 1 });
-    return `${hours(trial.availableMs)} of ${hours(trial.totalMs)} hours left${trial.reservedMs > 0 ? `, ${hours(trial.reservedMs)} held by running sandboxes` : ""}`;
+    return `${hours(trial.availableMs)} of ${hours(trial.totalMs)} hours left`;
+}
+/** A pilot's sandbox hours left, as `runtime usage` says them. */
+function pilotLeft(pilot) {
+    const left = `${hours(pilot.leftMs)} of ${pilot.hours.toLocaleString("en-US")} left`;
+    return pilot.leftMs > 0
+        ? `${left}; new pilot sandboxes until ${pilot.endsAt.slice(0, 16).replace("T", " ")} UTC`
+        : "This pilot's sandbox hours are used.";
 }
 function usageSummary(u) {
     const micros = (value) => typeof value === "string" || typeof value === "number" || typeof value === "bigint"
@@ -1088,15 +1106,17 @@ function usageSummary(u) {
         // its own line, so "spent" reads as what was used.
         ["used", dollars(micros(u.spent) - takenBack)],
         ...(takenBack > 0n ? [["returned by refunds and disputes", dollars(takenBack)]] : []),
-        // Holds cover running sandboxes and the hour ahead of stored snapshots,
-        // images and volumes (pricing guide), so an account with nothing running
-        // can still show one.
-        ["held for running sandboxes and this hour's storage", dollars(micros(u.held))],
+        // What running sandboxes and the hour ahead of stored snapshots, images
+        // and volumes are about to use, so an account with nothing running can
+        // still show some. Said without "held": no guide teaches holds.
+        ["set aside for running sandboxes and this hour's storage", dollars(micros(u.held))],
     ];
     if (micros(u.expired) > 0n)
         rows.push(["expired or taken back", dollars(micros(u.expired))]);
     if (u.trial)
         rows.push(["free trial", trialLeft(u.trial)]);
+    if (u.pilot)
+        rows.push(["pilot sandbox hours", pilotLeft(u.pilot)]);
     if (u.outbound) {
         const gib = (bytes) => `${(bytes / 1_073_741_824).toLocaleString("en-US", { maximumFractionDigits: 1 })} GiB`;
         const left = Math.max(0, u.outbound.allowanceBytes - u.outbound.freeBytes);
@@ -1474,11 +1494,13 @@ async function sandbox(argv, env, out) {
                 s.state,
                 `${s.info.vcpu}/${s.info.memoryMiB}`,
                 s.info.funding,
-                s.info.expiresAt ?? "-",
+                // When it stops or pauses by itself (0381): its time limit's end, or
+                // "-" when it never will. An older server sends no endsAt.
+                (s.info.endsAt === undefined ? s.info.expiresAt : s.info.endsAt) ?? "-",
             ]);
             print([
                 rows.length
-                    ? table([["ID", "NAME", "STATE", "CPU/MIB", "FUNDING", "EXPIRES"], ...rows])
+                    ? table([["ID", "NAME", "STATE", "CPU/MIB", "FUNDING", "ENDS"], ...rows])
                     : stopped
                         ? "No live sandboxes."
                         : "No sandboxes. Create one: runtime sandbox create",
@@ -1704,7 +1726,9 @@ async function sandbox(argv, env, out) {
             const sbx = await get(rest[0]);
             const seconds = Number(need(rest[1], "seconds, e.g. runtime sandbox extend <id> 600"));
             await sbx.extend(seconds);
-            print(`${sbx.id} now ends at ${sbx.info.expiresAt}`, sbx.info);
+            print(sbx.info.endsAt === null
+                ? `${sbx.id} has no time limit: it runs while it works, so nothing was extended`
+                : `${sbx.id} now ends at ${sbx.info.endsAt ?? sbx.info.expiresAt}`, sbx.info);
             return 0;
         }
         case "exec": {
@@ -2783,8 +2807,8 @@ read = readSecret) {
 }
 const JOB_HELP = `runtime job <command>
 
-  A job runs a command in a fresh sandbox, once or on a schedule. Each run is a
-  paid sandbox billed at the sandbox rates; the trial's hours do not fund jobs.
+  A job runs a command in a fresh sandbox, once or on a schedule. Each run spends
+  the free trial's hours first, then credit at the sandbox rates.
 
   create <name> (--cron "<min hour day month weekday>" [--timezone Europe/Berlin] | --at <time|now>)
          [--vcpu 2] [--memory 4096] [--disk 4096] [--cpu shared|reserved] [--cpu-floor <thousandths>]

package/dist/client.d.ts

@@ -16,7 +16,11 @@ export type RuntimeOptions = {
     timeoutMs?: number;
     /** Retries of transport failures, 429, 502, 503 and 504. Default 4. */
     maxRetries?: number;
-    /** Calls in flight at once; more wait their turn and reuse connections. Default 32. */
+    /** Connections held at once, calls and streams (a command's output, a
+     * download) together; more wait their turn, first come first served, and
+     * reuse them. Default 48: one address may hold 64 connections to the API
+     * before it has used a valid key. 8 are kept for calls whatever the
+     * streams hold. */
     maxConnections?: number;
     /** How long `sandboxes.create` keeps retrying, with the same key and input,
      * when the trial's slots, the account's quota or the region is full

package/dist/client.js

@@ -4,7 +4,7 @@ import { clientFactories, clientProductAliases } from "./products/index.js";
 import { usageExport as makeUsageExport } from "./products/observability.js";
 import { Sandbox, deleteSandbox, sandboxPage } from "./sandbox.js";
 import { Snapshots } from "./snapshots.js";
-import { Transport, missingKey } from "./transport.js";
+import { DEFAULT_BASE_URL, Transport, missingKey } from "./transport.js";
 /** The key `runtime login` saved for this machine and this API origin, found
  * on first use. A constructor override must never receive another API's key. */
 const savedKey = async (apiOrigin) => {
@@ -30,10 +30,14 @@ export class Runtime {
     /** Date-range settlements, paged with exact charges and the server's CSV. */
     usageExport;
     constructor(options = {}) {
+        // The saved key is found by the origin as given, as `runtime login` saved
+        // it; the calls go where that origin is reachable from here, which in a
+        // sandbox is runtime.internal (transport.ts, `reachable`).
+        const origin = options.baseUrl || env("RUNTIME_API_URL") || DEFAULT_BASE_URL;
         this.transport = new Transport({
             // A key given, then RUNTIME_API_KEY, then (in Node and Bun) the key
             // `runtime login` saved for this machine, read on the first call.
-            apiKey: options.apiKey ?? env("RUNTIME_API_KEY") ?? (() => savedKey(this.transport.baseUrl)),
+            apiKey: options.apiKey ?? env("RUNTIME_API_KEY") ?? (() => savedKey(origin)),
             baseUrl: options.baseUrl ?? env("RUNTIME_API_URL"),
             ...(options.fetch ? { fetch: options.fetch } : {}),
             ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
@@ -97,6 +101,9 @@ export class Sandboxes {
      * free, up to `waitForCapacityMs` (the client's, two minutes by default). */
     async create(input = {}, options = {}) {
         const { wait, ...body } = input;
+        const began = performance.now();
+        // Time spent waiting for capacity is the room's, not the deadline's.
+        let waited = 0;
         const info = await this.t.json({
             method: "POST",
             path: "/v1/sandboxes",
@@ -104,13 +111,22 @@ export class Sandboxes {
             wait: wait === false ? 0 : 60,
             ...options,
             waitForCapacityMs: options.waitForCapacityMs ?? this.t.waitForCapacityMs,
+            onCapacityWait: (refusal, waitMs) => {
+                waited += waitMs;
+                options.onCapacityWait?.(refusal, waitMs);
+            },
         });
         const sandbox = new Sandbox(this.t, info);
         if (wait !== false && info.state !== "running") {
+            // One deadline for the whole create: the wait for running gets what the
+            // create left of it (1 ms when nothing is left, so it ends as a timeout).
+            const { timeoutMs } = options;
             await sandbox.waitFor("running", {
                 timeoutSeconds: WAIT_FOR_TIMEOUT_SECONDS,
                 signal: options.signal,
-                timeoutMs: options.timeoutMs,
+                timeoutMs: timeoutMs
+                    ? Math.max(1, Math.ceil(timeoutMs - (performance.now() - began - waited)))
+                    : timeoutMs,
                 idempotencyKey: options.idempotencyKey,
             });
             if (sandbox.state !== "running")

package/dist/compat/files.js

@@ -63,10 +63,14 @@ export class GuestFiles {
         if (!overwrite) {
             // cp -n alone reports success when it skips a raced destination. Stage
             // privately, then publish without replacement and verify it moved.
+            // mv -n that skips succeeds before coreutils 9.2 and fails from it on
+            // (the guest's 9.4 says "not replacing"), so a skip is told by the
+            // staged copy still being there beside a destination; with none there,
+            // mv's own error stands.
             await checked(sandbox, [
                 "bash",
                 "-c",
-                'set -e; parent=$(dirname -- "$2"); stage="$parent/.runtime-copy-$4"; mkdir -m 700 -- "$stage"; trap \'rm -rf -- "$stage"\' EXIT; if [ "$3" = true ]; then cp -R -n -- "$1" "$stage/item"; else cp -n -- "$1" "$stage/item"; fi; mv -n -T -- "$stage/item" "$2"; if [ -e "$stage/item" ] || [ -L "$stage/item" ]; then printf "Destination exists: %s\\n" "$2" >&2; exit 73; fi',
+                'set -e; parent=$(dirname -- "$2"); stage="$parent/.runtime-copy-$4"; mkdir -m 700 -- "$stage"; trap \'rm -rf -- "$stage"\' EXIT; if [ "$3" = true ]; then cp -R -- "$1" "$stage/item"; else cp -- "$1" "$stage/item"; fi; mv -n -T -- "$stage/item" "$2" 2>"$stage/mv.err" || :; if [ -e "$stage/item" ] || [ -L "$stage/item" ]; then if [ -e "$2" ] || [ -L "$2" ]; then printf "Destination exists: %s\\n" "$2" >&2; exit 73; fi; cat -- "$stage/mv.err" >&2; exit 1; fi',
                 "bash",
                 this.path(from),
                 this.path(to),

package/dist/compat/lease.d.ts

@@ -5,6 +5,7 @@ export interface Leased {
     readonly state: string;
     readonly info: {
         expiresAt: string;
+        endsAt?: string | null;
     };
     extend(seconds: number): Promise<unknown>;
     refresh(): Promise<unknown>;