withruntime 0.4.0 → 0.5.1

package/DAYTONA.md

@@ -0,0 +1,129 @@
+# Code written for Daytona, on Runtime
+
+Run code written for [Daytona](https://www.daytona.io)'s SDK on Runtime Cloud
+by changing one import. It is part of Runtime's SDK (`withruntime`), built on
+the same client, so it gets that SDK's retries, idempotency keys and errors.
+Importing `withruntime` alone does not load it.
+
+```ts no-run
+import { Daytona } from "withruntime/daytona"; // was: from "@daytona/sdk" or "@daytonaio/sdk"
+```
+
+Python has the same, in `pip install withruntime`:
+
+```python no-run
+from withruntime.daytona import Daytona  # was: from daytona import Daytona
+from withruntime.daytona import AsyncDaytona  # was: from daytona import AsyncDaytona
+```
+
+The mapping was written against `@daytona/sdk` 0.216.1 and `daytona` 0.216.1
+on PyPI, checked 23 September 2026.
+
+## Keys
+
+The package uses, in order: a Runtime key (`rtcloud_...`) passed as `apiKey`,
+`RUNTIME_API_KEY`, a Runtime key left in `DAYTONA_API_KEY`, and the key
+`npx withruntime login` saved on this machine. A Daytona key is never sent
+anywhere. If one is passed as `apiKey` and `RUNTIME_API_KEY` is not set, the
+constructor throws `DaytonaAuthenticationError`. `apiUrl` is ignored: the
+package talks only to Runtime.
+
+## What a sandbox gets
+
+- **Machine:** Daytona's default, 1 vCPU, 1 GiB memory and 3 GiB disk.
+  `resources: { cpu, memory, disk }` (GiB) sets another.
+- **Stopping:** `stop()` pauses the sandbox, keeping its files and its memory,
+  and `start()` carries on with processes still running. A stopped sandbox is
+  kept for Runtime's retention: 30 days on credit, 7 on the trial, or
+  `autoDeleteInterval` minutes rounded up to whole days. `delete()` ends it.
+  An `ephemeral` sandbox (or `autoDeleteInterval: 0`) ends on `stop()`.
+- **Auto-stop:** Runtime runs a sandbox on a lease of up to an hour. The lease
+  is `autoStopInterval` minutes (default 15; `0` is an hour), and every call
+  through the adapter moves it on once less than half is left, so a sandbox
+  pauses after that long without calls, as Daytona's does. `ttlMinutes` caps
+  the renewals and ends the sandbox at the deadline.
+- **Funding:** left to Runtime, as `withruntime`'s own `create()` does: the free
+  trial while the account has trial time, then prepaid credit. Pass
+  `withruntime: { create: { funding: "trial" } }` to `new Daytona(...)` or to
+  `create` (Python: `runtime_create={"funding": "trial"}`) to use only the
+  trial.
+- **Anything else Runtime offers:** `withruntime: { create: { ... } }` sends
+  Runtime's create fields as they are. `sandbox.withruntime` is the Runtime
+  sandbox underneath, with previews, network rules, snapshots, the desktop and
+  terminals.
+
+## Mapping
+
+| Daytona                                                                       | On Runtime                                                                                                                                                                                                    |
+| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `daytona.create()`, `create({ snapshot })`                                    | `sandboxes.create`. Daytona's own snapshots (`daytona-*`) are Runtime's stock image. Any other name is a ready Runtime image of that name, then a Runtime snapshot of that name.                              |
+| `create({ image: "python:3.12" })`                                            | Built once as a Runtime image from the registry reference (named after it), then reused. `onSnapshotCreateLogs` receives the build log.                                                                       |
+| `create({ image: Image.debianSlim(...).pipInstall(...)... })`                 | The Dockerfile Daytona's `Image` stands for, with its local files, built as a Runtime image named after its content and reused.                                                                               |
+| `resources`, `envVars`, `labels`, `name`, `volumes`                           | `vcpu`, `memoryMiB`, `diskMiB`; environment given to every command; labels; name; Runtime volumes by id or by name.                                                                                           |
+| `networkBlockAll`, `networkAllowList`, `domainAllowList`, `outboundProxyUrl`  | Runtime network rules (`internet: false`, or an `allow` list); the proxy as `HTTP_PROXY` and `HTTPS_PROXY` for commands.                                                                                      |
+| `public: true`                                                                | `getPreviewLink(port)` shares the port publicly; without it, privately with a token.                                                                                                                          |
+| `language`                                                                    | The language of `codeRun`, kept in Daytona's `code-toolbox-language` label so a sandbox found later keeps it.                                                                                                 |
+| `daytona.get(idOrName)`, `daytona.list({ labels, states, name })`             | `sandboxes.get`, or the newest live sandbox with that name; `sandboxes.list`. Awaiting `list()` gives the older `{ items, total }` shape.                                                                     |
+| `process.executeCommand(cmd, cwd, env, timeout)`                              | `exec` under bash with stderr joined to stdout, as Daytona's `result`, streamed so the whole output comes back. A non-zero exit is a result. Past `timeout` (seconds): `DaytonaProcessExecutionTimeoutError`. |
+| `process.codeRun(code, { argv, env })`                                        | `python3 -c`, `node -e` or `bun -e` by the sandbox's language. `artifacts.charts` is always empty.                                                                                                            |
+| `createSession`, `executeSessionCommand`, `getSessionCommandLogs`             | One bash per session, kept running: directory, variables and functions carry from one command to the next. `runAsync` returns at once; logs stream to callbacks.                                              |
+| `sendSessionCommandInput`, `getSession`, `getSessionCommand`, `deleteSession` | Input to the session's shell, which the running command reads; the commands sent through this object; killing the shell.                                                                                      |
+| `fs.uploadFile(s)`, `downloadFile(s)`, `listFiles`, `getFileDetails`          | Runtime's files API. Relative paths resolve from `/workspace`. `owner` and `group` are always `""`.                                                                                                           |
+| `fs.createFolder`, `deleteFile`, `moveFiles`, `setFilePermissions`            | `mkdir -m`, `files.remove`, `files.rename`, `chmod` and `sudo chown`.                                                                                                                                         |
+| `fs.findFiles`, `searchFiles`, `replaceInFiles`                               | `grep -rn`, a files glob, and a read and write of each file.                                                                                                                                                  |
+| `git.clone`, `status`, `add`, `commit`, `push`, `pull`, branches              | The sandbox's git. Credentials reach git through the environment, never the command line.                                                                                                                     |
+| `codeInterpreter.runCode`, contexts                                           | Runtime's Python interpreter. The sandbox's `envVars` reach code through a context made once for them.                                                                                                        |
+| `start`, `stop`, `pause`, `archive`, `delete`, `fork`, `createSnapshot`       | `wake`, `pause` (or `stop` when ephemeral), `pause`, `pause`, `stop`, Runtime's fork with memory, a Runtime snapshot with that name.                                                                          |
+| `getPreviewLink(port)`                                                        | A Runtime preview. Send its token as `x-runtime-preview-token`; Daytona's header is `x-daytona-preview-token`.                                                                                                |
+| `getUserHomeDir`, `getWorkDir`, `user`                                        | `/workspace`, and `daytona`, so `/home/daytona` (linked to `/workspace` the first time something names it) works.                                                                                             |
+| `daytona.snapshot.create`, `get`, `list`, `delete`                            | Runtime images built, found, listed and deleted by name.                                                                                                                                                      |
+| `daytona.volume.get`, `list`, `delete`                                        | Runtime volumes by name.                                                                                                                                                                                      |
+| Error classes                                                                 | Daytona's names and parents, by HTTP status. Each also carries Runtime's `code`, `hint` and `requestId`, with the original error as `cause`.                                                                  |
+
+## Gaps
+
+Each of these throws `NotSupportedError` before anything happens. Its
+`feature` names the gap and its `alternative` says what to use.
+
+| Daytona                                                               | Use instead                                                                                                            |
+| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| A snapshot name with no Runtime image or snapshot                     | `daytona.snapshot.create({ name, image })` here, or `npx withruntime image build`. This throws `DaytonaNotFoundError`. |
+| GPUs, `spot`, `linkedSandbox`, `secrets`, `otelEndpointOverride`      | Runtime runs Linux on CPUs; pass credentials as `envVars`.                                                             |
+| A `target` other than `us`, `jwtToken`                                | Runtime runs in one US region and signs in with keys.                                                                  |
+| `user` other than `daytona`                                           | Commands run as the sandbox owner with passwordless `sudo`.                                                            |
+| PTY sessions, the entrypoint session, language servers                | `sandbox.withruntime.terminal(...)`, and sessions with `runAsync`.                                                     |
+| `computerUse`                                                         | Runtime's desktop, `sandbox.withruntime.desktop`.                                                                      |
+| `setLabels`, `resize`, `recover`                                      | Set labels and resources at create; create a new sandbox.                                                              |
+| Signed preview URLs, signed upload and download URLs, SSH access      | `getPreviewLink`, `fs.uploadFile` and `downloadFile`, `npx withruntime sandbox shell <id>`.                            |
+| `getMetrics`                                                          | `npx withruntime usage`.                                                                                               |
+| `Image.pipInstallFromPyproject`, snapshot `resources` or `entrypoint` | `pipInstallFromRequirements`; resources at create; a session after create.                                             |
+| `volume.create(name)`                                                 | Runtime volumes have a size: `runtime.volumes.create({ name, sizeMiB })`.                                              |
+| `secret`, `warmPool`                                                  | Credentials as `envVars`; Runtime starts from warm templates already.                                                  |
+| `runCode(code, { envs })`                                             | `envVars` at create, or `os.environ` in the code.                                                                      |
+| Listing by anything but name, labels and states                       | Filter the result yourself.                                                                                            |
+
+Some differences are not refusals:
+
+- Sandbox `envVars` live in the object that created the sandbox;
+  `daytona.get(id)` from another process does not know them.
+- A session runs one command at a time. A command sent while another runs
+  waits for it, as it would typed into a shell. Sessions made by another
+  client are found by name, but only their output from then on is known.
+- `autoArchiveInterval` is recorded only: Runtime has no archive tier.
+- Runtime's stock image is Ubuntu 24.04 with Python 3.12, Node.js 24 and Bun.
+
+## Tests
+
+`bun run test` in `packages/cloud-sdk` runs the unit tests of both languages
+against fakes of Runtime's SDKs: `tests/daytona` here and
+`sdks/python/tests/test_daytona.py`.
+
+The end-to-end tests run Daytona's quickstart and guides, unmodified but for
+the import, against the real API. They refuse to start unless the free trial
+has an hour left, create one sandbox per language and end it. They are not part
+of `bun run test`.
+
+```bash no-run
+bun packages/cloud-sdk/scripts/dropin-e2e.ts          # JavaScript, with the Vercel eval
+python3 sdks/python/scripts/dropin_e2e.py             # Python, with the Vercel sample
+```

package/E2B.md

@@ -58,7 +58,7 @@ machine. An E2B key (`e2b_...`) is never sent anywhere. If one is passed as
 | `envs`                                                                                   | Given to every command and code run through this object.                                                                                                                       |
 | `allowInternetAccess: false`                                                             | `network: { internet: false }`.                                                                                                                                                |
 | `lifecycle.onTimeout`                                                                    | `onLeaseEnd`: `kill` is `stop`, `pause` is `pause`.                                                                                                                            |
-| `commands.run(cmd, { cwd, envs, timeoutMs, onStdout, onStderr })`                        | `exec`. Default timeout 60 s. `0` means no limit (Runtime's longest, 24 hours).                                                                                                |
+| `commands.run(cmd, { cwd, envs, timeoutMs, onStdout, onStderr })`                        | `exec`, streamed, so the whole output comes back however large. Default timeout 60 s. `0` means no limit (Runtime's longest, 24 hours).                                        |
 | Non-zero exit                                                                            | Throws `CommandExitError` with `exitCode`, `stdout`, `stderr` and `error` (`exit status N`). A command killed by a signal has `exitCode` -1.                                   |
 | Command past its timeout                                                                 | Throws `TimeoutError`.                                                                                                                                                         |
 | `commands.run(cmd, { background: true })`                                                | `spawn`. Returns a `CommandHandle` with `pid`, `wait()`, `kill()` (SIGKILL), `sendStdin`, `closeStdin`, `disconnect`, `stdout`, `stderr`, `exitCode`.                          |
@@ -80,6 +80,7 @@ machine. An E2B key (`e2b_...`) is never sent anywhere. If one is passed as
 | `runCode(code, { language, context, onStdout, onStderr, onResult, onError, timeoutMs })` | Runtime's interpreter, Python and JavaScript. The sandbox's `envs` reach code through a context made once for them. `onResult` is called after the run ends.                   |
 | `Execution`, `Result`, `Logs`, `ExecutionError`, `OutputMessage`                         | The same shapes. Results that are too large to send inline are fetched and inlined. `logs.stdout` has one entry per line.                                                      |
 | `createCodeContext`, `listCodeContexts`, `restartCodeContext`, `removeCodeContext`       | Runtime's interpreter contexts.                                                                                                                                                |
+| `getMetrics({ start, end })`, `Sandbox.getMetrics(id)`                                   | Runtime's measured CPU and memory, one entry per host reading (every minute by default). `diskUsed` is null: Runtime does not read disk use inside the sandbox.                |
 | Error classes                                                                            | E2B's names and parents. Each also carries Runtime's `code`, `hint` and `requestId`, with the original error as `cause`.                                                       |
 
 ## Gaps
@@ -94,7 +95,7 @@ before anything happens. The error's `feature` names the gap and its
 | `Template`, `waitForPort` and the other ready checks                                         | `runtime.images.build(...)`                                                                                         |
 | `timeoutMs` over one hour                                                                    | Create with up to an hour, then call `setTimeout` before it ends, as often as needed.                               |
 | `setTimeout` to an earlier time                                                              | `kill()` when the work is done.                                                                                     |
-| `lifecycle.autoResume`, `keepMemory: false`                                                  | `Sandbox.connect(id)` wakes a paused sandbox. Runtime's pause keeps memory.                                         |
+| `keepMemory: false`                                                                          | Runtime's pause keeps memory.                                                                                       |
 | `onResume: "reboot"`                                                                         | Stop the sandbox and create a new one.                                                                              |
 | `fork({ timeoutMs })`                                                                        | Fork without it, then call `setTimeout` on each fork.                                                               |
 | `user: "root"` (commands and files)                                                          | Prefix the command with `sudo`, which needs no password.                                                            |
@@ -106,7 +107,6 @@ before anything happens. The error's `feature` names the gap and its
 | `git`                                                                                        | `commands.run("git ...")`. E2B has deprecated its git module too.                                                   |
 | `files.watchDir`                                                                             | Poll with `files.list`.                                                                                             |
 | File `metadata`                                                                              | Keep it in a file beside the data.                                                                                  |
-| `getMetrics`                                                                                 | `npx withruntime usage`.                                                                                            |
 | `uploadUrl`, `downloadUrl`                                                                   | `files.write` and `files.read`.                                                                                     |
 | `Sandbox.list` by `template` or `startedAfter`, `order: "desc"`, or from a saved `nextToken` | Filter by metadata, and keep the paginator.                                                                         |
 | `runCode` in `bash`, `r`, `java` or `typescript`                                             | `commands.run(...)`.                                                                                                |

package/README.md

@@ -10,9 +10,11 @@ npm install withruntime
 
 The client uses `RUNTIME_API_KEY` when it is set, and otherwise the connection
 this machine saved when the CLI connected it (one browser approval, no key to
-copy). On a server, set `RUNTIME_API_KEY` from your secret manager (create a key
-at https://withruntime.com/account/keys). Never put a key in browser code, a URL
-or a command-line argument.
+copy). On a server or a CI runner, set `RUNTIME_API_KEY` from your secret
+manager: `npx withruntime keys create` prints a new key once after an account
+owner approves it in the browser, or create one at
+https://withruntime.com/account/keys. Never put a key in browser code, a URL or
+a command-line argument.
 
 ```ts
 import { Sandbox } from "withruntime";
@@ -25,7 +27,7 @@ console.log(result.exitCode, result.stdout);
 `Sandbox.create()` needs no arguments and returns once the sandbox is running;
 `await using` stops it when the block ends (Node 24, Bun or TypeScript; on
 Node 22 call `await sbx.stop()`). With no arguments you get the free
-trial while it lasts (20 hours, up to eight sandboxes running at once), 2 vCPU, 4 GiB of
+trial while it lasts (50 free hours, up to eight sandboxes running at once), 2 vCPU, 4 GiB of
 memory and a 4 GiB disk.
 
 The sandbox object does the rest:
@@ -33,11 +35,18 @@ The sandbox object does the rest:
 - `exec`, `execStream`, `spawn` and `processes` for commands and background
   work, with `cwd`, `env` (the place for secrets), `stdin` and `timeoutMs`;
 - `terminal()` for an interactive terminal over a WebSocket;
+- `forwardPort(5432)` to reach any TCP port in the sandbox from this machine, and
+  `tunnel()` for single connections and SSH logins (`runtime sandbox ssh` uses it);
 - `files` to read, write, list, glob, stat, move and remove, and to copy whole
   directories with `upload` and `download`;
-- `pause`, `wake`, `extend`, `fork` and `snapshot`;
+- `pause`, `wake`, `extend`, `fork` and `snapshot` (a paused sandbox also wakes
+  by itself on the next call), `update` for its name, automatic wake, idle pause
+  and persistence, and `keepAlive` to extend its lease while your process runs;
 - `interpreter`, `network`, `previews` and `desktop` for the other products.
 
+`Sandbox.getOrCreate(name)` returns the sandbox with that name, woken if it is
+paused, or creates it.
+
 The client has `sandboxes`, `images`, `volumes`, `snapshots`, `limits`,
 `feedback` and `support`. `runtime.limits.get()` (0.3.1 and later) says whether
 the key is read-only and what its agent may still spend today. Every write carries an idempotency key, made for you, so the SDK's
@@ -61,12 +70,14 @@ for example `No answer from Runtime at https://api.withruntime.com through the
 proxy http://proxy.internal:3128 (HTTPS_PROXY).` A `fetch` you pass to
 `new Runtime({ fetch })` is used as it is.
 
-Please tell us what could be better. Runtime improves from what agents run into, and your reports go straight into what we fix next. Whenever something gets in your way, report it with `runtime.feedback.submit()` (or `npx withruntime feedback "..."`) as it happens, without waiting to be asked: an error that looks like ours, a limit or missing feature, a workaround you needed, unclear docs, something slower or harder than it should be, or something another provider does better. Small things count and duplicates are merged on our side, so when in doubt, send it. Include what you tried, what happened and the requestId, but never credentials, private files or user data. Then let the user know in one line what you reported.
+Runtime improves fast because agents tell us what they run into: reports go straight into what we build next, and whoever asked is told when it ships. Whenever something gets in your way, report it with `runtime.feedback.submit()` (or `npx withruntime feedback "..."`) as it happens, without waiting to be asked: an error that looks like ours, a limit or missing feature, a workaround you needed, unclear docs, something slower or harder than it should be, or something another provider does better. Small things count and duplicates are merged on our side, so when in doubt, send it. Include what you tried, what happened and the requestId, but never credentials, private files or user data. Then let the user know in one line what you reported.
 
 ## Code written for E2B
 
 `withruntime/e2b` runs code written for E2B's SDK on Runtime. Change the
-import and set `RUNTIME_API_KEY`:
+import and set `RUNTIME_API_KEY`. The
+[switch guide](https://withruntime.com/docs/migrate) covers the other providers
+and how to work out what you save:
 
 ```ts no-run
 import { Sandbox } from "withruntime/e2b"; // was: from "e2b"
@@ -78,10 +89,36 @@ Runtime does not do the way E2B does throws `NotSupportedError` before
 anything happens, naming what to use instead. `E2B.md` in this package lists
 every mapping and gap. Importing `withruntime` alone does not load it.
 
+## Code written for Daytona or Vercel Sandbox
+
+`withruntime/daytona` and `withruntime/vercel` do the same for Daytona's SDK
+and Vercel Sandbox's. Change the import:
+
+```ts no-run
+import { Daytona } from "withruntime/daytona"; // was: from "@daytona/sdk"
+import { Sandbox } from "withruntime/vercel"; // was: from "@vercel/sandbox"
+```
+
+Sandboxes get the rival's defaults: Daytona's 1 vCPU, 1 GiB and 3 GiB disk,
+pausing after 15 minutes without calls; Vercel's 2 vCPUs with 2048 MiB each, 5
+minutes, persistent. A Daytona or Vercel key is never sent anywhere. What
+Runtime does not do the same way throws `NotSupportedError` before anything
+happens, naming what to use instead. `DAYTONA.md` and `VERCEL.md` in this
+package list every mapping and gap.
+
+## Agent frameworks
+
+`withruntime/openai-agents` is a sandbox client for the OpenAI Agents SDK's
+`SandboxAgent`. `withruntime/ai` gives Vercel AI SDK and Mastra agents four
+sandbox tools, `withruntime/claude-agent-sdk` gives them to the Claude Agent
+SDK as an MCP server, and `withruntime/tools` gives them in no framework's
+format. Each needs its framework installed beside this package. See
+https://withruntime.com/docs/frameworks.
+
 ## CLI
 
 ```bash no-run
-npx withruntime run -- python3 -c 'print(6 * 7)'   # connects on first use
+npx withruntime sandbox run -- python3 -c 'print(6 * 7)'   # connects on first use
 npx withruntime sandbox create
 npx withruntime help
 ```
@@ -99,7 +136,8 @@ codex mcp add runtime -- npx -y withruntime mcp
 
 The bridge serves Runtime's MCP tools on stdio over the saved connection; not
 connected yet, it offers `runtime_connect`, which walks you through the browser
-approval. Remote agents use `https://api.withruntime.com/mcp` with a bearer key.
+approval. Remote clients add `https://api.withruntime.com/mcp` and sign in through
+the browser, or send a bearer key.
 
 Docs: https://withruntime.com/docs/javascript and https://withruntime.com/docs/cli.
 

package/VERCEL.md

@@ -0,0 +1,127 @@
+# Code written for Vercel Sandbox, on Runtime
+
+Run code written for [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox)'s
+SDK on Runtime Cloud by changing one import. It is part of Runtime's SDK
+(`withruntime`), built on the same client, so it gets that SDK's retries,
+idempotency keys and errors. Importing `withruntime` alone does not load it.
+
+```ts no-run
+import { Sandbox } from "withruntime/vercel"; // was: from "@vercel/sandbox"
+```
+
+Python has the same, in `pip install withruntime`:
+
+```python no-run
+from withruntime.vercel import sandbox  # was: from vercel import sandbox
+from withruntime.vercel.sandbox import sync as sandbox  # was: from vercel.sandbox import sync as sandbox
+```
+
+The mapping was written against `@vercel/sandbox` 3.5.0 and `vercel-sandbox`
+0.7.0 on PyPI (the `vercel.sandbox` module of `vercel` 0.11.4), checked
+23 September 2026.
+
+## Keys
+
+The package uses, in order: a Runtime key (`rtcloud_...`) passed as `token`,
+`RUNTIME_API_KEY`, and the key `npx withruntime login` saved on this machine.
+A Vercel token or OIDC token is never sent anywhere: passed as `token` while
+`RUNTIME_API_KEY` is not set, it throws `AuthenticationError` (Python:
+`SandboxCredentialsError`). `teamId` and `projectId` mean nothing on Runtime and
+are ignored.
+
+## What a sandbox gets
+
+- **Machine:** Vercel's default, 2 vCPUs with 2048 MiB each.
+  `resources: { vcpus }` sets another, with 2048 MiB per vCPU.
+- **Timeout:** Vercel's default of 5 minutes. Runtime's leases run 60 seconds to
+  an hour; `extendTimeout` moves the end later, as often as needed.
+- **Persistence:** persistent by default, as in Vercel. `stop()` and the end of
+  the timeout pause the sandbox, keeping its files and also its memory and
+  processes. `Sandbox.get({ name })`, or the next command or file call, wakes
+  it. A paused sandbox is kept for Runtime's retention (30 days on credit, 7 on
+  the trial, or `snapshotExpiration`) and billed as paused storage. With
+  `persistent: false`, `stop()` ends the sandbox. `delete()` always ends it.
+- **Ports:** each port in `ports` is shared at a public HTTPS address (a Runtime
+  preview) when the sandbox is created, so `domain(port)` answers at once. A
+  browser sees a one-time page naming Runtime before the site.
+- **Funding:** left to Runtime, as `withruntime`'s own `create()` does: the free
+  trial while the account has trial time, then prepaid credit. Pass
+  `withruntime: { create: { funding: "trial" } }` (Python:
+  `runtime_create={"funding": "trial"}`) to use only the trial.
+- **Anything else Runtime offers:** `withruntime: { create: { ... } }` sends
+  Runtime's create fields as they are. `sandbox.withruntime` is the Runtime
+  sandbox underneath. (The key is `withruntime` because Vercel's `runtime`
+  names a Node.js or Python version.)
+
+## Mapping
+
+| Vercel Sandbox                                                        | On Runtime                                                                                                                                  |
+| --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Sandbox.create({ name, timeout, resources, env, tags, ports })`      | `sandboxes.create` with `name`, `timeoutSeconds`, `vcpu` and `memoryMiB`, labels; `env` is given to every command run through this object.  |
+| `image`, legacy `runtime`                                             | Vercel's managed images and runtimes are Runtime's stock image. Any other name must be a ready Runtime image with that name.                |
+| `source: { type: "git", url, depth, revision, username, password }`   | Cloned into the working directory after create; credentials reach git through the environment.                                              |
+| `source: { type: "tarball", url }`, `{ type: "snapshot" }`            | Downloaded and unpacked into the working directory; a Runtime snapshot, with its own shape.                                                 |
+| `networkPolicy`, `updateNetworkPolicy`                                | Runtime network rules: `allow-all`, `deny-all`, or a list of domains and subnets to allow and deny.                                         |
+| `Sandbox.get({ name })`, `getOrCreate`, `list({ tags })`              | The newest live sandbox with that name (or a Runtime id), woken; create when missing; `sandboxes.list` with Vercel's paginator.             |
+| `Sandbox.fork({ sourceSandbox, name })`                               | A Runtime fork, which copies memory and processes too.                                                                                      |
+| `runCommand(cmd, args)`, `runCommand({ cmd, args, cwd, env, sudo })`  | `exec` of the argv without a shell. `sudo` runs it under `sudo --preserve-env`. A non-zero exit is a result. Past `timeoutMs` it exits 137. |
+| `stdout`, `stderr` writers, `detached: true`, `logs()`, `wait()`      | Output streams to the writers; a detached command is a Runtime process, its logs followed from the start.                                   |
+| `getCommand(cmdId)`, `kill(signal)`                                   | Runtime processes by id; signals by name or number.                                                                                         |
+| `writeFiles`, `readFile`, `readFileToBuffer`, `downloadFile`, `mkDir` | Runtime's files API. `mode` is set with `chmod`. A missing file is `null`, as in Vercel.                                                    |
+| `sandbox.fs`                                                          | `node:fs/promises` over the files API and coreutils, with Node's error codes.                                                               |
+| Paths                                                                 | Relative paths resolve from `/vercel/sandbox`, which is `/workspace`. A command that names `/vercel/sandbox` finds a link to it.            |
+| `domain(port)`, `update({ ports })`                                   | The public preview of that port; ports added or removed.                                                                                    |
+| `stop()`, `delete()`, `extendTimeout(ms)`                             | `pause` (persistent) or `stop`; `stop`; `extend`.                                                                                           |
+| `update({ timeout, networkPolicy, snapshotExpiration })`              | `extend` (later only), network rules, retention.                                                                                            |
+| `snapshot()`, `Snapshot.get`, `Snapshot.list`, `snapshot.delete()`    | A Runtime snapshot (files, memory and processes), then the sandbox stops, as in Vercel; `snapshots.get`, `list`, `delete`.                  |
+| Error classes                                                         | `APIError` with a `response` whose status is Runtime's and `json` of `{ error: { code, message } }`; also `code`, `hint` and `requestId`.   |
+| Python: `create_sandbox`, `run_process`, `create_process`, `box.fs`   | The same mapping; operations await or work as context managers, which stop and by default destroy the sandbox; readers iterate by line.     |
+
+## Gaps
+
+Each of these throws `NotSupportedError` before anything happens. Its
+`feature` names the gap and its `alternative` says what to use.
+
+| Vercel Sandbox                                             | Use instead                                                                                                 |
+| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| An `image` with no Runtime image of that name              | Build it: `npx withruntime image build --dockerfile Dockerfile --name <image>`.                             |
+| `timeout` over one hour                                    | Create with up to an hour, then `extendTimeout` before it ends.                                             |
+| Drives (`mounts`), `networkId`                             | Runtime volumes through `withruntime: { create: { volumes } }`; network rules.                              |
+| A region outside the US, `failoverRegions`                 | Runtime runs in one US region.                                                                              |
+| Network rules that transform or forward requests           | Allow the domain and pass credentials as `env`.                                                             |
+| `openInteractive`                                          | `sandbox.withruntime.terminal(...)` or `npx withruntime sandbox shell <id>`.                                |
+| Extra users and groups (`createUser`, `asUser`)            | `sudo useradd` and `sudo -u` through `runCommand`.                                                          |
+| Sessions (`currentSession`, `listSessions`)                | A Runtime sandbox is its own session.                                                                       |
+| `update` of tags, resources, persistence or region         | Create a new sandbox with them.                                                                             |
+| Overrides on `Sandbox.fork`                                | Fork, then change what Runtime can change.                                                                  |
+| `delete({ deleteOrphanSnapshots: true })`, `Snapshot.tree` | Delete snapshots one by one; `Snapshot.list`.                                                               |
+| `Drive`, `SandboxUser`, `defineSandboxProxy`               | Runtime volumes; `sudo`; `sandbox.withruntime.previews`.                                                    |
+| Listing by time, prefix or cursor (JavaScript)             | List them all and filter the result yourself. (Python applies a name prefix and newest-first order itself.) |
+
+Some differences are not refusals:
+
+- A persistent sandbox keeps its memory and processes as well as its files
+  across `stop()`: they carry on after a wake, where Vercel starts them again.
+- Commands run as the sandbox owner, `runtime`, with passwordless `sudo`.
+  `pwd` prints `/workspace`.
+- Runtime's stock image is Ubuntu 24.04 with Python 3.12, Node.js 24 and Bun;
+  Vercel's `universal` has Python 3.14.
+- `keepLastSnapshots` is accepted: a paused Runtime sandbox keeps exactly its
+  latest state.
+- A git source is cloned into the working directory itself.
+
+## Tests
+
+`bun run test` in `packages/cloud-sdk` runs the unit tests of both languages
+against fakes of Runtime's SDKs: `tests/vercel` here and
+`sdks/python/tests/test_vercel.py`.
+
+The end-to-end tests run the judge panel's Vercel Sandbox eval and Vercel's
+Python examples, unmodified but for the import, against the real API. They
+refuse to start unless the free trial has an hour left, and end every sandbox
+they create. They are not part of `bun run test`.
+
+```bash no-run
+bun packages/cloud-sdk/scripts/dropin-e2e.ts          # JavaScript, with the Daytona quickstart
+python3 sdks/python/scripts/dropin_e2e.py             # Python, with the Daytona quickstart
+```

package/dist/ai/index.d.ts

@@ -0,0 +1,33 @@
+/** Runtime sandbox tools for the Vercel AI SDK, and for Mastra, whose agents
+ * take AI SDK tools as they are:
+ *
+ *   import { generateText, stepCountIs } from "ai";
+ *   import { Sandbox } from "withruntime";
+ *   import { runtimeTools } from "withruntime/ai";
+ *
+ *   await using sbx = await Sandbox.create();
+ *   await generateText({ model, tools: runtimeTools(sbx), stopWhen: stepCountIs(10), prompt });
+ *
+ * Needs the `ai` package (version 5 or newer) beside this one. */
+import { type Tool } from "ai";
+import type { Sandbox } from "../sandbox.js";
+import { type ExecInput, type ExecOutput, type ListEntry, type SandboxToolOptions } from "../tools/index.js";
+export type { SandboxToolOptions } from "../tools/index.js";
+/** `{ runtime_exec, runtime_read_file, runtime_write_file, runtime_list_files }`, bound to `sandbox`. */
+export type RuntimeTools = {
+    runtime_exec: Tool<ExecInput, ExecOutput>;
+    runtime_read_file: Tool<{
+        path: string;
+    }, string>;
+    runtime_write_file: Tool<{
+        path: string;
+        content: string;
+    }, string>;
+    runtime_list_files: Tool<{
+        path?: string;
+        depth?: number;
+    }, ListEntry[] | {
+        error: string;
+    }>;
+};
+export declare function runtimeTools(sandbox: Sandbox, options?: SandboxToolOptions): RuntimeTools;

package/dist/ai/index.js

@@ -0,0 +1,38 @@
+/** Runtime sandbox tools for the Vercel AI SDK, and for Mastra, whose agents
+ * take AI SDK tools as they are:
+ *
+ *   import { generateText, stepCountIs } from "ai";
+ *   import { Sandbox } from "withruntime";
+ *   import { runtimeTools } from "withruntime/ai";
+ *
+ *   await using sbx = await Sandbox.create();
+ *   await generateText({ model, tools: runtimeTools(sbx), stopWhen: stepCountIs(10), prompt });
+ *
+ * Needs the `ai` package (version 5 or newer) beside this one. */
+import { jsonSchema, tool } from "ai";
+import { sandboxTools, } from "../tools/index.js";
+export function runtimeTools(sandbox, options = {}) {
+    const [exec, read, write, list] = sandboxTools(sandbox, options);
+    return {
+        runtime_exec: tool({
+            description: exec.description,
+            inputSchema: jsonSchema(exec.inputSchema),
+            execute: (input) => exec.execute(input),
+        }),
+        runtime_read_file: tool({
+            description: read.description,
+            inputSchema: jsonSchema(read.inputSchema),
+            execute: (input) => read.execute(input),
+        }),
+        runtime_write_file: tool({
+            description: write.description,
+            inputSchema: jsonSchema(write.inputSchema),
+            execute: (input) => write.execute(input),
+        }),
+        runtime_list_files: tool({
+            description: list.description,
+            inputSchema: jsonSchema(list.inputSchema),
+            execute: (input) => list.execute(input),
+        }),
+    };
+}

package/dist/claude-agent-sdk/index.d.ts

@@ -0,0 +1,7 @@
+import type { Sandbox } from "../sandbox.js";
+import { type SandboxToolOptions } from "../tools/index.js";
+export type { SandboxToolOptions } from "../tools/index.js";
+/** The tools' names as the Claude Agent SDK sees them, for `allowedTools`. */
+export declare const RUNTIME_TOOL_NAMES: string[];
+/** An MCP server named "runtime" whose four tools act on `sandbox`. */
+export declare function runtimeMcpServer(sandbox: Sandbox, options?: SandboxToolOptions): import("@anthropic-ai/claude-agent-sdk").McpSdkServerConfigWithInstance;

package/dist/claude-agent-sdk/index.js

@@ -0,0 +1,65 @@
+/** Runtime sandbox tools for the Claude Agent SDK, as an in-process MCP server:
+ *
+ *   import { query } from "@anthropic-ai/claude-agent-sdk";
+ *   import { Sandbox } from "withruntime";
+ *   import { runtimeMcpServer, RUNTIME_TOOL_NAMES } from "withruntime/claude-agent-sdk";
+ *
+ *   await using sbx = await Sandbox.create();
+ *   query({ prompt, options: {
+ *     mcpServers: { runtime: runtimeMcpServer(sbx) },
+ *     allowedTools: RUNTIME_TOOL_NAMES,
+ *     disallowedTools: ["Bash", "Read", "Write", "Edit"], // keep work off this machine
+ *   } });
+ *
+ * Needs `@anthropic-ai/claude-agent-sdk` and `zod` beside this one. For an agent
+ * that should create and manage sandboxes itself, connect Runtime's own MCP
+ * server instead: `npx -y withruntime mcp`. */
+import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { z } from "zod";
+import { sandboxTools } from "../tools/index.js";
+/** The tools' names as the Claude Agent SDK sees them, for `allowedTools`. */
+export const RUNTIME_TOOL_NAMES = [
+    "mcp__runtime__runtime_exec",
+    "mcp__runtime__runtime_read_file",
+    "mcp__runtime__runtime_write_file",
+    "mcp__runtime__runtime_list_files",
+];
+const text = (value) => ({
+    content: [
+        { type: "text", text: typeof value === "string" ? value : JSON.stringify(value) },
+    ],
+});
+/** An MCP server named "runtime" whose four tools act on `sandbox`. */
+export function runtimeMcpServer(sandbox, options = {}) {
+    const [exec, read, write, list] = sandboxTools(sandbox, options);
+    return createSdkMcpServer({
+        name: "runtime",
+        version: "1.0.0",
+        tools: [
+            tool(exec.name, exec.description, {
+                command: z.string().min(1).describe(exec.inputSchema.properties.command.description),
+                cwd: z.string().optional().describe(exec.inputSchema.properties.cwd.description),
+                timeoutSeconds: z
+                    .number()
+                    .int()
+                    .min(1)
+                    .optional()
+                    .describe(exec.inputSchema.properties.timeoutSeconds.description),
+            }, async (input) => text(await exec.execute(input))),
+            tool(read.name, read.description, { path: z.string().describe(read.inputSchema.properties.path.description) }, async (input) => text(await read.execute(input))),
+            tool(write.name, write.description, {
+                path: z.string().describe(write.inputSchema.properties.path.description),
+                content: z.string().describe(write.inputSchema.properties.content.description),
+            }, async (input) => text(await write.execute(input))),
+            tool(list.name, list.description, {
+                path: z.string().optional().describe(list.inputSchema.properties.path.description),
+                depth: z
+                    .number()
+                    .int()
+                    .min(1)
+                    .optional()
+                    .describe(list.inputSchema.properties.depth.description),
+            }, async (input) => text(await list.execute(input))),
+        ],
+    });
+}

package/dist/cli.d.ts

@@ -5,5 +5,11 @@ type Out = {
     error: (text: string) => void;
 };
 export declare function run(argv: string[], env?: NodeJS.ProcessEnv, out?: Out): Promise<number>;
+export declare function secretsCommand(argv: string[], env: NodeJS.ProcessEnv, out: Out, 
+/** Tests give the value here; the CLI reads standard input. */
+read?: () => Promise<string>): Promise<number>;
+export declare function imageCommand(argv: string[], env: NodeJS.ProcessEnv, out: Out, 
+/** Tests give the registry secret here; the CLI reads standard input. */
+read?: () => Promise<string>): Promise<number>;
 export declare function describeError(error: unknown, json: boolean): string;
 export {};