withruntime 0.23.0 → 0.33.1

package/COMPATIBILITY.md

@@ -28,9 +28,70 @@ as reviewed and unsupported, and `bun run compat:upstream` flags any other relea
 | Fly Sprites | `@fly/sprites` 0.2.3                    | `withruntime/sprites`     | `SpritesClient`, create/lookup/list/delete/restart; `exec`, `execFile`, Node streams and event-based `spawn`; attachable native processes; binary/text/JSON files, directory traversal, append, chmod, chown and `asRoot` through sudo, file watches; preview access settings; checkpoints as disk snapshots; domain network policy; session kill; port watcher and port proxy; `APIError` with the vendor's limit codes |
 | Freestyle   | `freestyle` 0.2.20                      | `withruntime/freestyle`   | `Freestyle`, VM create/ref/get/list/start/pause/delete/update; command execution, binary/text files and streams, filesystem metadata; native snapshots; explicit deny-all or outbound-public firewall intent                                                                                                                                                                                                             |
 | Morph       | `morphcloud` 0.0.20                     | `withruntime/morph`       | `MorphCloudClient`, images list, snapshot create/get/list/delete/metadata and cached `setup` chains, instance start/boot/get/list/stop/pause/resume/branch/snapshot, metadata, wake-on, TTL at start, streamed exec, HTTP services as previews, file `sync`                                                                                                                                                              |
-| Modal       | `modal` 0.11.1                          | `withruntime/modal`       | `ModalClient`, app-name grouping, registry images and Dockerfile layers, CPU sandbox create/get/list/name lookup, text/binary process streams and stdin, command completion, filesystem transfer and metadata, tags, encrypted public previews, outbound allowlists, memory snapshot capture                                                                                                                             |
+| Modal       | `modal` 0.11.1                          | `withruntime/modal`       | `ModalClient`, app-name grouping, registry images and Dockerfile layers, CPU sandbox create/get/list/name lookup, idle timeout, text/binary process streams and stdin, commands as root, command completion, filesystem transfer, metadata and watches, tags, encrypted public previews, outbound domain and CIDR allowlists, filesystem and memory snapshot capture                                                     |
 | Cloudflare  | `@cloudflare/sandbox` 0.12.10 (0.x API) | `withruntime/cloudflare`  | `getSandbox`, named Runtime sandboxes, explicit execution sessions, text exec and SSE output, background processes, logs/signals/waits, binary/text files, recursive listings, environment updates, signed Runtime previews, conditional Worker Durable Object entry, Worker preview proxy, destruction                                                                                                                  |
 
+### Modal's own examples, live (18 October 2026)
+
+Every sandbox example of Modal's JavaScript SDK (`js/examples` at
+`js/v0.11.1`, 26 files; `sandbox-gpu.ts` needs a GPU and the Functions
+examples call deployed Functions, so they are not run) is copied verbatim
+into `tests/fixtures/modal`, with only the import changed, and run against
+real Runtime sandboxes by `scripts/compatibility-modal-examples-live.ts`
+(opt-in, `--run`; each sandbox capped at two cents and five minutes, deleted
+when its example ends). What failed, and what changed:
+
+- A layer's `secrets` (`image-building.ts`) stay refused, now naming the
+  alternative: a Runtime build keeps its build arguments in the image's build
+  plan, history and cache key, so a secret is used at run time
+  (`sandboxes.create(app, image, { secrets })` or `runtime.secrets.set`).
+- `idleTimeoutMs` (`sandbox-tunnels.ts`) was refused; it is Runtime's idle
+  pause (10 s at least), memory kept. `timeoutMs` under a minute is kept by
+  the client, with Runtime's minute as the bound if the client goes away.
+- Commands ran as the sandbox user, so `mkdir /app` failed
+  (`sandbox-filesystem-snapshot.ts`); the entrypoint, `exec` and readiness
+  probes now run as root, as in a Modal container.
+- `poll()` after the sandbox ended (`sandbox-poll.ts`) threw; it answers the
+  exit code it saw, or 137 for a process killed with its sandbox.
+- `experimentalOptions` were refused as unknown; `enable_exit_snapshot`
+  refuses naming `snapshotFilesystem()` before `terminate()`.
+- Allowlists were an intersection; Modal's domain and CIDR allowlists are a
+  union, and `*.x` also allows `x`.
+- `client.functions`, `functionCalls`, `cls` and `queues` were undefined;
+  each call refuses, naming Runtime's alternative.
+- A file watch in Alpine (no python3) failed, and its retry hid why. The
+  server now runs the watcher on Runtime's own Python, in every image, and a
+  retried start replays the first (`packages/cloud/src/watch/client.ts`).
+- A snapshot of a running sandbox could fail when another call (the
+  entrypoint's open output stream) woke it mid-capture. A call's wake now
+  waits for the capture (`cloud_wake_waits_for_capture` migration,
+  `packages/cloud/src/api/guest-call.ts`).
+
+`tests/compat/modal-examples.test.ts` fails on the old adapter.
+`compat-inventory.json` records 226 present, 163 refused and 0 missing of 389.
+
+### Fly Machines API (18 October 2026)
+
+Fly publishes no TypeScript SDK for Machines; its users call the REST API at
+`api.machines.dev` with curl or an HTTP client, or through fly-go. So
+`withruntime/fly` answers the HTTP API itself: `machinesApi()` is a fetch
+handler, `serveMachinesApi()` and `npx withruntime fly-api` serve it on a port.
+Of the spec's 29 machine routes, 24 are answered (list, create, get, update,
+delete, start, stop, suspend, restart, wait, exec, signal, ps, events, versions,
+metadata in all six forms, lease get/acquire/release) and 5 refuse: the memory
+limit's get, set and reclaim (resize the machine instead), and cordon and
+uncordon (no services). Apps, the org's machines and the region list are
+answered too. Restart policies `always` and `on-failure` (with `max_retries`)
+are kept by a supervisor loop around the main process. `services`, `mounts`,
+`checks`, `processes`, GPUs, `files` from secrets and regions other than `iad`
+answer 400 naming the alternative.
+Evidence: `tests/compat/fly-contract.test.ts`;
+`scripts/compatibility-fly-docs-live.ts --run`, which runs the 22 curl
+examples of Fly's Machines API pages verbatim
+(`tests/compat/fly-docs/machines-api-examples.sh`, superfly/docs at 15f58f1f,
+read 18 October 2026) and fly-go 0.11.6's flaps client unchanged
+(`tests/compat/fly-go`) on the real API; and `scripts/compatibility-fly-live.ts --run`.
+
 ### Modal 0.11.1 review (16 October 2026)
 
 The pin advances from 0.11.0 to 0.11.1; support remains partial. Both npm
@@ -86,7 +147,7 @@ all 73 inventory items are present or refused, none missing. How it maps:
 - `branch(n)` is one fork with the snapshot kept: copies keep memory and
   running processes.
 - `ttlSeconds` is the time limit (60 to 86400); `ttlAction` stop deletes,
-  pause pauses. Runtime also pauses an idle sandbox after a minute and wakes
+  pause pauses. Runtime also pauses an idle sandbox after five minutes and wakes
   it on the next request, which Morph does not.
 - `exposeHttpService` is a preview: public with no `auth_mode` (needs a kept
   top-up), private with `api_key` (send its token as `x-runtime-preview-token`).
@@ -268,8 +329,8 @@ share the file path and `compat.provider` resource label.
 ## Evidence that can be repeated locally
 
 Run `bun test tests/compat` from the SDK package and run `bun run check-types`.
-The test run compiles unchanged typed consumer bodies from
-`tests/compat/consumers/workflows.ts.txt` against all ten TypeScript adapters,
+The type check (`tests/compat/consumers/tsconfig.json`) compiles unchanged typed consumer bodies from
+`tests/compat/consumers/workflows.ts` against all ten TypeScript adapters,
 including E2B's interpreter. Run
 `bun tests/compat/check-consumers.ts <verified-cache>` to compile the
 same bodies against the pinned upstream declarations; the script checks each
@@ -341,7 +402,7 @@ Remaining implementation work is tracked only in the repository `WORKLIST.md`.
 | CodeSandbox | No browser editor/Pitcher protocol, browser-session tokens, interpreters, live VM resizing, fork tier changes, read-only or global editor sessions, or private host-token emulation. Configured tasks run under a guest supervisor and setup steps under a guest runner, both started by the adapter and surviving client disconnects; a task's port must be configured with `task.preview.port`, because automatic task-to-port discovery is refused. Private host-only preview requests fail explicitly; native signed preview URLs remain available. Public port discovery lists registered previews, not all listening sockets. Default workspace is prepared at `/project/sandbox`. Command restart preserves the originating client's captured argv, environment and working directory; a command discovered by another client refuses restart because its private spawn recipe is unavailable. |
 | Sprites     | No control-mode WebSocket protocol, managed services, in-place checkpoint restore (start a new sandbox from the snapshot), checkpoint history filters, network presets (`include`), an allow rule inside a denied wildcard (Runtime's deny always wins), privilege or resource policies, `maxRunAfterDisconnect`, Fly token exchange or Sprite list streaming; each is refused by name. A checkpoint is a Runtime disk snapshot (files, not running processes); the Sprite pauses for the moment it takes. An allow rule makes an allowlist, as Sprites' DNS allowlist does. The port watcher polls `ss` once a second. Session handles use native process IDs, not tmux. The sprite URL maps port 8080. File bytes and process byte streams preserve binary data.                                                                                                                                    |
 | Freestyle   | Provider catalog snapshot slugs are not Runtime snapshots and are refused. Firewall support is limited to an explicit empty rule set or the exact allow-public-outbound shape; arbitrary rule selectors, TLS policies and private networks are refused. No automatic-restart guarantee, retention scheduler, placement constraints, live resize, Linux-user switching, PTY namespace, public IPv6 or account-owned egress address emulation. Native snapshot retention is positive whole days.                                                                                                                                                                                                                                                                                                                                                                                                        |
-| Modal       | CPU sandboxes only; different resource reservation/limit values, fractional CPU, GPU and foreign placement are refused. Named Apps group Runtime sandboxes; they do not deploy Functions. Registry authentication uses Runtime's registry configuration. No Functions/Cls, volumes/bucket mounts, GPU image steps, readiness probes, sidecars, directory mounts, filesystem-only images from snapshots, or snapshot restoration API. Entry-point completion stops the sandbox while the originating client is alive; the native lease remains the bound if that client disappears. A different client can reconnect using the saved entrypoint process ID.                                                                                                                                                                                                                                            |
+| Modal       | CPU sandboxes only; different resource reservation/limit values, fractional CPU, GPU and foreign placement are refused. Named Apps group Runtime sandboxes; they do not deploy Functions. Registry authentication uses Runtime's registry configuration. Commands run as root. No Functions/Cls/queues, named secrets, volumes made on first use, GPU image steps, sidecars, connect tokens, proxies, directory or exit snapshots, or snapshot restoration API; each refuses naming the alternative. Entry-point completion stops the sandbox while the originating client is alive; the native lease remains the bound if that client disappears. A different client can reconnect using the saved entrypoint process ID.                                                                                                                                                                            |
 | Cloudflare  | The conditional Worker entry supplies a Durable Object bridge and custom-hostname preview proxy; infrastructure configuration must still remove the vendor Container declaration and provide Runtime secrets. Cloudflare's examples run live under `wrangler dev` (above); custom preview routing has no live public-hostname acceptance evidence. At most 4 interpreter contexts. No isolated PID namespaces, backup format, terminal WebSocket protocol, custom process IDs or provider cleanup-record semantics. Foreground named sessions use resident Bash; background processes inherit exported state/cwd but do not yet inherit every local variable/function/option.                                                                                                                                                                                                                         |
 
 ## Keeping compatibility current

package/E2B.md

@@ -105,6 +105,7 @@ account the key belongs to and where the key came from.
 | `commands.list`, `kill(pid)`, `sendStdin(pid)`, `closeStdin(pid)`, `connect(pid)`        | Runtime's processes. A pid is a number derived from Runtime's process id, not the Linux pid. `commands.list` shows each command as E2B starts it: `cmd` `/bin/bash`, `args` `["-l", "-c", "<your command>"]` (a PTY: `["-i", "-l"]`), the command cut at 256 characters, `envs` empty.                                                                                                                                                                                                                                                                                                                  |
 | `pty.create`, `connect`, `sendInput`, `resize`, `kill` (Python snake_case)               | Native PTY processes with lossless byte callbacks. A reader timeout or disconnect detaches without killing the process; reconnect resumes reading.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | `files.read(path, { format })`                                                           | `files.read`. `text`, `bytes`, `blob` and `stream` (Python: `text`, `bytes`, `stream`).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `downloadUrl(path, opts)`, `uploadUrl(path, opts)`                                       | `files.downloadUrl` and `files.uploadUrl`: a signed link anyone can open with no key, as a string. `useSignatureExpiration` is seconds (60 to 7 days, one hour by default); `user` is ignored. `uploadUrl()` needs a `path`, as a link names one file.                                                                                                                                                                                                                                                                                                                                                  |
 | `files.write(path, data)`, `write([...])`, `writeFiles`                                  | `files.write`. Parent directories are made, and a file that exists is replaced.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `files.list(path, { depth })`                                                            | `files.list`, hidden files included. `owner` and `group` come from native metadata, with `""` for older guests that omit them. `depth` below one throws `InvalidArgumentError` "depth should be at least one".                                                                                                                                                                                                                                                                                                                                                                                          |
 | `files.makeDir`, `exists`, `getInfo`, `rename`, `remove`                                 | `files.stat`, `mkdir`, `rename` (replacing a file that exists) and `remove` (recursive). A missing file throws `FileNotFoundError`. Entries read as envd gives them: `permissions` begins with the kind's letter (`-rw-r--r--`, `drwxr-xr-x`, `L` for a link), the sandbox user is `user`, and a link's `symlinkTarget` is absolute.                                                                                                                                                                                                                                                                    |
@@ -143,7 +144,6 @@ before anything happens. The error's `feature` names the gap and its
 | `volumeMounts`, `Volume`                                      | Runtime volumes: `runtime: { create: { volumes: [{ volumeId, path }] } }`.                                           |
 | `git`                                                         | `commands.run("git ...")`. E2B has deprecated its git module too.                                                    |
 | File `metadata`                                               | Keep it in a file beside the data.                                                                                   |
-| `uploadUrl`, `downloadUrl`                                    | `files.write` and `files.read`.                                                                                      |
 | `runCode(code, { envs })`                                     | A context made with them: `sandbox.runtime.interpreter.contexts.create({ env })`.                                    |
 | `domain`, `apiUrl`, `sandboxUrl`, `headers`, `proxy`, `debug` | Remove them. `RUNTIME_API_URL` sets Runtime's origin, and `HTTPS_PROXY` sets a proxy.                                |
 

package/README.md

@@ -55,9 +55,9 @@ The sandbox object does the rest:
   own tailnet), `metrics` and `mcp` (servers from the MCP catalog, run in the
   sandbox) for the other products.
 
-A sandbox pauses itself after 60 seconds with nothing happening in it, keeping
+A sandbox pauses itself after 300 seconds with nothing happening in it, keeping
 its memory and processes, and the next call wakes it, so an idle sandbox costs
-no compute; `idlePauseSeconds` sets 10 to 86,400, or 0 for never.
+no compute; `idlePauseSeconds` sets 60 to 86,400 (a shorter time is raised to 60), or 0 for never.
 
 `Sandbox.getOrCreate(name)` returns the sandbox with that name, woken if it is
 paused, or creates it.
@@ -162,6 +162,24 @@ copies memory and processes. `stop` deletes the sandbox, as Morph's does.
 SSH, reboot and a time limit set after start throw `CompatibilityError`
 naming the alternative. `COMPATIBILITY.md` lists every mapping.
 
+## Code written for Modal Sandboxes
+
+`withruntime/modal` runs code written for Modal's Sandboxes (`modal` 0.11.1).
+Change the import and set `RUNTIME_API_KEY`:
+
+```ts no-run
+import { ModalClient } from "withruntime/modal"; // was: from "modal"
+```
+
+Modal's own sandbox examples run unchanged where they use none of what is
+refused below, and a Modal token is never needed
+or sent. Commands run as root, as in a Modal container. A `timeoutMs` ends the
+sandbox; an `idleTimeoutMs` pauses it with its memory kept, and the next call
+wakes it. GPUs, Modal Functions and queues, named secrets, secrets in image
+build steps (a build keeps no secret: use it at run time), volumes made on
+first use, sidecars, connect tokens, directory and exit snapshots throw
+`CompatibilityError` before anything is created, naming what to use instead.
+
 ## Code written for Cloudflare's Sandbox SDK
 
 `withruntime/cloudflare` runs a Worker written for Cloudflare's 0.x
@@ -181,6 +199,22 @@ Cloudflare documents them; backups, tunnels, terminals and outbound
 interception throw `CompatibilityError` naming the alternative.
 `COMPATIBILITY.md` lists every mapping.
 
+## Code written for Fly Machines
+
+`withruntime/fly` answers Fly's Machines API (`api.machines.dev`) with Runtime
+sandboxes, so code in any language moves by changing one address:
+
+```sh no-run
+npx withruntime fly-api   # http://127.0.0.1:4280, as your Runtime login
+```
+
+Point `FLY_API_HOSTNAME` (as in Fly's own examples), fly-go's
+`FLY_FLAPS_BASE_URL` or any client's base URL there; `machinesApi()` is the same
+as a fetch handler for your own server. A Machine's image is built once with
+its `init` and `files`, the image's command is its main process, and its
+restart policy is kept. The Fly token is never sent anywhere. Services, mounts,
+checks and other regions answer 400 naming the alternative.
+
 ## Agent frameworks
 
 `withruntime/openai-agents` is a sandbox client for the OpenAI Agents SDK's

package/README.src.md

@@ -59,7 +59,7 @@ The sandbox object does the rest:
 
 A sandbox pauses itself after {{idle-pause}} with nothing happening in it, keeping
 its memory and processes, and the next call wakes it, so an idle sandbox costs
-no compute; `idlePauseSeconds` sets {{idle-pause-min}} to {{idle-pause-max}}, or 0 for never.
+no compute; `idlePauseSeconds` sets {{idle-pause-min}} to {{idle-pause-max}} (a shorter time is raised to {{idle-pause-min}}), or 0 for never.
 
 `Sandbox.getOrCreate(name)` returns the sandbox with that name, woken if it is
 paused, or creates it.
@@ -164,6 +164,24 @@ copies memory and processes. `stop` deletes the sandbox, as Morph's does.
 SSH, reboot and a time limit set after start throw `CompatibilityError`
 naming the alternative. `COMPATIBILITY.md` lists every mapping.
 
+## Code written for Modal Sandboxes
+
+`withruntime/modal` runs code written for Modal's Sandboxes (`modal` 0.11.1).
+Change the import and set `RUNTIME_API_KEY`:
+
+```ts no-run
+import { ModalClient } from "withruntime/modal"; // was: from "modal"
+```
+
+Modal's own sandbox examples run unchanged where they use none of what is
+refused below, and a Modal token is never needed
+or sent. Commands run as root, as in a Modal container. A `timeoutMs` ends the
+sandbox; an `idleTimeoutMs` pauses it with its memory kept, and the next call
+wakes it. GPUs, Modal Functions and queues, named secrets, secrets in image
+build steps (a build keeps no secret: use it at run time), volumes made on
+first use, sidecars, connect tokens, directory and exit snapshots throw
+`CompatibilityError` before anything is created, naming what to use instead.
+
 ## Code written for Cloudflare's Sandbox SDK
 
 `withruntime/cloudflare` runs a Worker written for Cloudflare's 0.x
@@ -183,6 +201,22 @@ Cloudflare documents them; backups, tunnels, terminals and outbound
 interception throw `CompatibilityError` naming the alternative.
 `COMPATIBILITY.md` lists every mapping.
 
+## Code written for Fly Machines
+
+`withruntime/fly` answers Fly's Machines API (`api.machines.dev`) with Runtime
+sandboxes, so code in any language moves by changing one address:
+
+```sh no-run
+npx withruntime fly-api   # http://127.0.0.1:4280, as your Runtime login
+```
+
+Point `FLY_API_HOSTNAME` (as in Fly's own examples), fly-go's
+`FLY_FLAPS_BASE_URL` or any client's base URL there; `machinesApi()` is the same
+as a fetch handler for your own server. A Machine's image is built once with
+its `init` and `files`, the image's command is its main process, and its
+restart policy is kept. The Fly token is never sent anywhere. Services, mounts,
+checks and other regions answer 400 naming the alternative.
+
 ## Agent frameworks
 
 `withruntime/openai-agents` is a sandbox client for the OpenAI Agents SDK's

package/compatibility-lock.json

@@ -248,10 +248,10 @@
         {
           "registry": "pypi",
           "name": "prime-sandboxes",
-          "version": "0.4.6",
+          "version": "0.4.7",
           "artifacts": {
-            "prime_sandboxes-0.4.6-py3-none-any.whl": "sha256-e97c6e70c032e0b6d7defdb26d6192a02643ad279af1a4726ebceb35ee89d70c",
-            "prime_sandboxes-0.4.6.tar.gz": "sha256-23204a465500e9c20639e3043e92d703712d8c80b94d6434bfeb82c787102915"
+            "prime_sandboxes-0.4.7-py3-none-any.whl": "sha256-309600da3ee596ce36ed75a7b0956d7883f3e4fc385f026e80c9df887ea1a948",
+            "prime_sandboxes-0.4.7.tar.gz": "sha256-72382facabe083b5f9618bfcc057cf1b0211fe103d66cad06d0310567b416adb"
           }
         }
       ]

package/dist/agents/browser.d.ts

@@ -0,0 +1,12 @@
+/** `withruntime/agents` in a browser or a worker (package.json's "browser"
+ * condition): the client and the deploy's check, without the runtime.yml
+ * loader, which reads the file system (agents-file.ts). Node and Bun get
+ * index.ts, this and the loader. */
+import { type RuntimeOptions } from "../client.js";
+export type * from "../products/agents.js";
+export type * from "../agents-deploy.js";
+export { AGENT_TEMPLATES, AGENT_USES } from "../products/agents.js";
+import { type AgentsClient } from "../agents-deploy.js";
+export { checkAgentsFile, MANAGED_LABEL, withDeploy } from "../agents-deploy.js";
+/** `runtime.agents` of a client made with `options`, with `deploy`. */
+export declare function agents(options?: RuntimeOptions): AgentsClient;

package/dist/agents/browser.js

@@ -0,0 +1,12 @@
+/** `withruntime/agents` in a browser or a worker (package.json's "browser"
+ * condition): the client and the deploy's check, without the runtime.yml
+ * loader, which reads the file system (agents-file.ts). Node and Bun get
+ * index.ts, this and the loader. */
+import { Runtime } from "../client.js";
+export { AGENT_TEMPLATES, AGENT_USES } from "../products/agents.js";
+import { withDeploy } from "../agents-deploy.js";
+export { checkAgentsFile, MANAGED_LABEL, withDeploy } from "../agents-deploy.js";
+/** `runtime.agents` of a client made with `options`, with `deploy`. */
+export function agents(options) {
+    return withDeploy(new Runtime(options).agents);
+}

package/dist/agents/index.d.ts

@@ -1,11 +1,11 @@
 /** `withruntime/agents`: Agents alone. A harness in a sandbox of its own per
  * session, on your own model key. In a private beta.
  *
- *   import { agents } from "withruntime/agents";
+ *   import { agents, loadAgentsFile } from "withruntime/agents";
  *   const client = agents(); // RUNTIME_API_KEY, or this machine's saved connection
- */
-import { Runtime, type RuntimeOptions } from "../client.js";
-export type * from "../products/agents.js";
-export { AGENT_TEMPLATES, AGENT_USES } from "../products/agents.js";
-/** `runtime.agents` of a client made with `options`. */
-export declare function agents(options?: RuntimeOptions): Runtime["agents"];
+ *   await client.deploy(loadAgentsFile("runtime.yml"), { dryRun: true }); // what CI runs
+ *
+ * A browser or worker bundle gets browser.ts instead: all of this but the
+ * runtime.yml loader, which reads the file system. */
+export * from "./browser.js";
+export { AGENTS_FILE, loadAgentsFile, parseAgentsFile } from "../agents-file.js";

package/dist/agents/index.js

@@ -1,12 +1,11 @@
 /** `withruntime/agents`: Agents alone. A harness in a sandbox of its own per
  * session, on your own model key. In a private beta.
  *
- *   import { agents } from "withruntime/agents";
+ *   import { agents, loadAgentsFile } from "withruntime/agents";
  *   const client = agents(); // RUNTIME_API_KEY, or this machine's saved connection
- */
-import { Runtime } from "../client.js";
-export { AGENT_TEMPLATES, AGENT_USES } from "../products/agents.js";
-/** `runtime.agents` of a client made with `options`. */
-export function agents(options) {
-    return new Runtime(options).agents;
-}
+ *   await client.deploy(loadAgentsFile("runtime.yml"), { dryRun: true }); // what CI runs
+ *
+ * A browser or worker bundle gets browser.ts instead: all of this but the
+ * runtime.yml loader, which reads the file system. */
+export * from "./browser.js";
+export { AGENTS_FILE, loadAgentsFile, parseAgentsFile } from "../agents-file.js";

package/dist/agents-cli.d.ts

@@ -5,6 +5,6 @@ type Out = {
     write: (text: string) => void;
     error: (text: string) => void;
 };
-export declare const AGENT_HELP = "runtime agents <command>\n\n  An agent runs a harness (Claude Code, Codex, Gemini CLI, or your own code on\n  an agents SDK) in a sandbox of its own for each session, on your model key.\n  In a private beta: outside it, each command says how to ask to join.\n\n  templates                                   The harnesses and uses to start from\n  create <name> (--template <harness> | --command \"<cmd>\") [--use support|team]\n         [--instructions <text> | --instructions-file <path>] [--secret NAME]...\n         [--env KEY=VALUE]... [--image <image> | --snapshot <id>] [--vcpu n] [--memory n]\n         [--max-concurrent n] [--idle-pause n] [--label key=value]...\n                                              Make an agent; prints its id. --secret names an egress\n                                              secret it may use: its model key, of any provider\n  ls                                          Your agents\n  get <agent>                                 One agent, in full (an id or its name)\n  update <agent> [the options of create]      A new version: what you give changes, the rest stays\n  rm <agent>                                  Delete it, its triggers, and stop its sessions\n  start <agent> <words...> [--key <key>] [--follow]\n                                              A session with these words, or the open one with the\n                                              key (such as customer:42); --follow prints its log\n                                              until it ends\n  send <session> <words...>                   Words into a session\n  events <session> [--after <seq>] [--follow] A session's log; --follow until it ends\n  sessions [--agent <agent>] [--state <state>]...\n                                              Sessions, newest first\n  sessions delete <session>                   Delete an ended session and its log; its history is\n                                              storage, kept until you delete it\n  stop <session>                              Stop a session\n  triggers <agent>                            Its triggers\n  triggers add <agent> --kind <slack|github|schedule|webhook> --config '<json>'\n  triggers pause <triggerId> --why <words>    Refuse its events, saying why; nothing else is held\n  triggers resume <triggerId>\n  triggers rm <triggerId>\n\n  A subscription is for your own team's agents; an agent that serves your\n  customers uses an API key.\n\nExamples\n  printf %s \"$ANTHROPIC_API_KEY\" | runtime secrets set ANTHROPIC_API_KEY --host api.anthropic.com\n  runtime agents create helper --template claude-code --use support --instructions \"Answer briefly.\"\n  runtime agents start helper \"How do I reset my password?\" --key customer:42 --follow\n";
+export declare const AGENT_HELP = "runtime agents <command>\n\n  An agent runs a harness (Claude Code, Codex, Gemini CLI, or your own code on\n  an agents SDK) in a sandbox of its own for each session, on your model key.\n  In a private beta: outside it, each command says how to ask to join.\n\n  templates                                   The harnesses and uses to start from\n  init [name] [--template <harness>] [--use support|team] [--file runtime.yml]\n                                              Write a starter agents: section into runtime.yml\n  deploy [--file runtime.yml] [--dry-run] [--prune [--prune-memory]]\n                                              Make your agents match runtime.yml: create, update\n                                              (a new version only when it changed) and set\n                                              triggers; one line per change. --prune deletes the\n                                              agents a deploy made that the file no longer names,\n                                              with their triggers; one holding memory files only\n                                              with --prune-memory too, which deletes them for good\n  create <name> (--template <harness> | --command \"<cmd>\") [--use support|team]\n         [--instructions <text> | --instructions-file <path>] [--secret NAME]...\n         [--env KEY=VALUE]... [--image <image> | --snapshot <id>] [--vcpu n] [--memory n]\n         [--max-concurrent n] [--idle-pause n] [--label key=value]...\n                                              Make an agent; prints its id. --secret names an egress\n                                              secret it may use: its model key, of any provider\n  ls                                          Your agents\n  get <agent>                                 One agent, in full (an id or its name)\n  update <agent> [the options of create]      A new version: what you give changes, the rest stays\n  rm <agent>                                  Delete it, its triggers, and stop its sessions\n  start <agent> <words...> [--key <key>] [--follow]\n                                              A session with these words, or the open one with the\n                                              key (such as customer:42); --follow prints its log\n                                              until it ends\n  send <session> <words...>                   Words into a session\n  events <session> [--after <seq>] [--follow] A session's log; --follow until it ends\n  sessions [--agent <agent>] [--state <state>]...\n                                              Sessions, newest first\n  sessions delete <session>                   Delete an ended session and its log; its history is\n                                              storage, kept until you delete it\n  stop <session>                              Stop a session\n  triggers <agent>                            Its triggers\n  triggers add <agent> --kind <slack|github|schedule|webhook> --config '<json>'\n  triggers pause <triggerId> --why <words>    Refuse its events, saying why; nothing else is held\n  triggers resume <triggerId>\n  triggers rm <triggerId>\n  memory ls <agent> [--scope <key>] [--prefix <path>]\n                                              Its memory files, with their scope (shared or a key)\n  memory search <agent> <words...> [--scope <key>] [--limit n]\n                                              Files whose words match, best first\n  memory cat <agent> <path> [--scope <key>]   A file's text\n  memory put <agent> <path> [<file> | - | --content <text>] [--scope <key>]\n                                              Seed or replace a file (from a file, or - for stdin)\n  memory rm <agent> <path> [--scope <key>]    Delete a file\n                                              Without --scope: the shared memory, which every\n                                              session reads and only a shared agent's write\n\n  A subscription is for your own team's agents; an agent that serves your\n  customers uses an API key.\n\nExamples\n  printf %s \"$ANTHROPIC_API_KEY\" | runtime secrets set ANTHROPIC_API_KEY --host api.anthropic.com\n  runtime agents create helper --template claude-code --use support --instructions \"Answer briefly.\"\n  runtime agents start helper \"How do I reset my password?\" --key customer:42 --follow\n  runtime agents memory put helper faq/refunds.md refunds.md\n  runtime agents init --template claude-code && runtime agents deploy --dry-run\n";
 export declare function agentsCommand(argv: string[], env: NodeJS.ProcessEnv, out: Out, client: () => Promise<Runtime>, kit: CliKit): Promise<number>;
 export {};