withruntime 0.16.0 → 0.16.1

package/dist/cli.js

@@ -161,9 +161,10 @@ const SANDBOX_HELP = `runtime sandboxes <command>
   switch-image <id> <image> --keep-workspace  Move it to another image, keeping /workspace (your home),
                                               volumes, env and previews; processes restart, the rest of
                                               its disk is lost (snapshot it first to keep everything)
-  resize <id> [--vcpu 2] [--memory 4096] --restart
-                                              Change its size by a restart: the whole disk stays,
-                                              programs stop (snapshot it first to keep memory)
+  resize <id> [--vcpu 2] [--memory 4096] [--disk 20480] --restart
+                                              Change its size by a restart: the whole disk stays and
+                                              --disk only grows it; programs stop (snapshot it first
+                                              to keep memory)
   extend <id> <seconds>                       Move a time limit on (one with none needs nothing)
   update <id> [--name n] [--label k=v]... [--env K=V]... [--unset-env K]... [--idle-pause <seconds>] [--auto-wake on|off]
               [--persistent on|off] [--max-total-cost <usd>|none]
@@ -1718,13 +1719,14 @@ async function sandbox(argv, env, out) {
             return 0;
         }
         case "resize": {
-            const args = parse(rest, ["restart"], ["vcpu", "memory"]);
+            const args = parse(rest, ["restart"], ["vcpu", "memory", "disk"]);
             const sbx = await use(need(args.positional[0], `a sandbox, e.g. ${me} sandboxes resize <id> --memory 4096 --restart`));
             const size = {
                 ...(integer(args, "vcpu") !== undefined ? { vcpu: integer(args, "vcpu") } : {}),
                 ...(integer(args, "memory") !== undefined ? { memoryMiB: integer(args, "memory") } : {}),
+                ...(integer(args, "disk") !== undefined ? { diskMiB: integer(args, "disk") } : {}),
             };
-            if (size.vcpu === undefined && size.memoryMiB === undefined)
+            if (size.vcpu === undefined && size.memoryMiB === undefined && size.diskMiB === undefined)
                 throw usage(`Name a new size, e.g. ${me} sandboxes resize ${sbx.id} --memory 4096 --restart`);
             if (!args.flags.has("restart"))
                 throw usage(`A resize restarts it: its whole disk stays and its programs stop. Add --restart to say so, or snapshot it first (${me} sandboxes snapshot ${sbx.id}) to keep its memory too.`);

package/dist/identity.js

@@ -1,29 +1,51 @@
 import { RuntimeError } from "./errors.js";
 import { sandboxMarker } from "./transport.js";
-/** The guest's environment file, which holds the sandbox's current request
- * token: the guest writes it again when the token changes (a wake on another
- * server, a restore), while a process keeps the environment it started with. */
+async function requestCredentials() {
+    const url = process.env.RUNTIME_ID_TOKEN_REQUEST_URL;
+    const token = process.env.RUNTIME_ID_TOKEN_REQUEST_TOKEN;
+    if (url && token)
+        return { url, token };
+    // A process started before the guest wrote its environment still finds it.
+    return fileCredentials();
+}
 async function fileCredentials() {
     try {
         // Loaded here, so the SDK still loads where there is no file system.
         const { readFile } = await import("node:fs/promises");
         const env = JSON.parse(await readFile(sandboxMarker.path, "utf8"));
-        return { url: env.RUNTIME_ID_TOKEN_REQUEST_URL, token: env.RUNTIME_ID_TOKEN_REQUEST_TOKEN };
+        const url = env.RUNTIME_ID_TOKEN_REQUEST_URL;
+        const token = env.RUNTIME_ID_TOKEN_REQUEST_TOKEN;
+        return url && token ? { url, token } : null;
     }
     catch {
         return null;
     }
 }
-async function requestCredentials() {
-    let url = process.env.RUNTIME_ID_TOKEN_REQUEST_URL;
-    let token = process.env.RUNTIME_ID_TOKEN_REQUEST_TOKEN;
-    if (!url || !token) {
-        // A process started before the guest wrote its environment still finds it.
-        const file = await fileCredentials();
-        url = file?.url;
-        token = file?.token;
+/** The sandbox's own listener (packages/cloud/src/linux/egress.ts). */
+const ENVIRONMENT_URL = "http://runtime.internal/v1/environment";
+/** The sandbox's request token as its host holds it now. The one in
+ * process.env was current when the process started: it changes with every
+ * renewal of the sandbox's lease (about every 30 minutes for one that keeps
+ * running), and a server restored from a snapshot (an App's copies, a fork)
+ * holds the statement of the sandbox it was saved from. The host's listener
+ * answers this sandbox's own; guest-net.py's file is a few seconds behind it. */
+async function currentCredentials(signal) {
+    try {
+        const response = await fetch(ENVIRONMENT_URL, {
+            signal: signal ?? AbortSignal.timeout(5_000),
+        });
+        if (response.ok) {
+            const env = (await response.json());
+            const url = env.RUNTIME_ID_TOKEN_REQUEST_URL;
+            const token = env.RUNTIME_ID_TOKEN_REQUEST_TOKEN;
+            if (typeof url === "string" && url && typeof token === "string" && token)
+                return { url, token };
+        }
+    }
+    catch {
+        // Not in a sandbox, or a host that predates the listener's environment.
     }
-    return url && token ? { url, token } : null;
+    return fileCredentials();
 }
 /**
  * Inside a Runtime sandbox: a short-lived OIDC token, signed by Runtime,
@@ -44,24 +66,25 @@ export async function identityToken(input) {
             status: 0,
             message: "Identity tokens are issued only inside a Runtime sandbox (RUNTIME_ID_TOKEN_REQUEST_TOKEN is not set).",
         });
-    const ask = (from) => {
-        const url = new URL(from.url);
+    const ask = (credentials) => {
+        const url = new URL(credentials.url);
         url.searchParams.set("audience", input.audience);
         if (input.lifetimeSeconds !== undefined)
             url.searchParams.set("lifetimeSeconds", String(input.lifetimeSeconds));
         return fetch(url, {
-            headers: { authorization: `Bearer ${from.token}` },
+            headers: { authorization: `Bearer ${credentials.token}` },
             signal: input.signal ?? AbortSignal.timeout(10_000),
         });
     };
     let response = await ask(found);
-    // Refused for a request token that has since changed: a long-running
-    // process asks again with the current one from the guest's file (the hub's
-    // own, 16 October 2026, from its start until it was restarted).
+    // Refused for a request token that is no longer this sandbox's current one:
+    // ask once more with the one its host holds now.
     if (response.status === 401 || response.status === 403) {
-        const file = await fileCredentials();
-        if (file?.url && file.token && file.token !== found.token)
-            response = await ask({ url: file.url, token: file.token });
+        const current = await currentCredentials(input.signal);
+        if (current && current.token !== found.token) {
+            await response.body?.cancel();
+            response = await ask(current);
+        }
     }
     const body = (await response.json().catch(() => ({})));
     if (!response.ok || !body.token)

package/dist/machine.d.ts

@@ -95,9 +95,12 @@ export declare abstract class Machine<Info extends MachineInfo, Settings extends
      * while a snapshot or fork of it is being taken. `restart` is optional:
      * true is the only value, and it is sent either way, so an API from before
      * it was optional accepts the call too. */
-    resize(size: {
+    resize(
+    /** diskMiB only grows; the filesystem fills it at the restart. */
+    size: {
         vcpu?: number;
         memoryMiB?: number;
+        diskMiB?: number;
     }, options?: RequestOptions & {
         restart?: true;
     }): Promise<this>;

package/dist/machine.js

@@ -175,7 +175,9 @@ export class Machine {
      * while a snapshot or fork of it is being taken. `restart` is optional:
      * true is the only value, and it is sent either way, so an API from before
      * it was optional accepts the call too. */
-    async resize(size, options = {}) {
+    async resize(
+    /** diskMiB only grows; the filesystem fills it at the restart. */
+    size, options = {}) {
         const { restart = true, ...rest } = options;
         this.#keep(await this.#t.json({
             method: "POST",

package/dist/transport.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeError } from "./errors.js";
-export declare const VERSION = "0.16.0";
+export declare const VERSION = "0.16.1";
 export declare const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { ConnectionError, DELIBERATE, errorFor, NOTHING_RAN, RuntimeError, WAITS_FOR_ROOM, } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket } from "./proxy.js";
 import { warningText } from "./product-renames.js";
-export const VERSION = "0.16.0";
+export const VERSION = "0.16.1";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",