withruntime 0.5.0 → 0.6.0

package/dist/daytona/context.d.ts

@@ -19,6 +19,11 @@ export declare const HOME = "/workspace";
 export declare const HOME_LINK = "[ -e /home/daytona ] || sudo ln -s /workspace /home/daytona";
 /** Commands without a timeout run until the sandbox ends: Runtime's longest. */
 export declare const LONGEST_MS = 86400000;
+/** Given to exec so it streams and returns the whole output, as Daytona does:
+ * an exec with no output callback returns at most 64 KiB of each stream. */
+export declare const WHOLE_OUTPUT: {
+    readonly onStdout: () => undefined;
+};
 /** A Daytona path as a Runtime one: relative paths (and `~`) resolve from the
  * working directory, /workspace on Runtime. */
 export declare function resolvePath(path: string): string;

package/dist/daytona/context.js

@@ -5,6 +5,9 @@ export const HOME = "/workspace";
 export const HOME_LINK = `[ -e ${DAYTONA_HOME} ] || sudo ln -s ${HOME} ${DAYTONA_HOME}`;
 /** Commands without a timeout run until the sandbox ends: Runtime's longest. */
 export const LONGEST_MS = 86_400_000;
+/** Given to exec so it streams and returns the whole output, as Daytona does:
+ * an exec with no output callback returns at most 64 KiB of each stream. */
+export const WHOLE_OUTPUT = { onStdout: () => undefined };
 /** A Daytona path as a Runtime one: relative paths (and `~`) resolve from the
  * working directory, /workspace on Runtime. */
 export function resolvePath(path) {

package/dist/daytona/filesystem.js

@@ -1,4 +1,4 @@
-import { resolvePath } from "./context.js";
+import { resolvePath, WHOLE_OUTPUT } from "./context.js";
 import { DaytonaError, DaytonaFileNotFoundError, guard } from "./errors.js";
 const PERMISSIONS = ["---", "--x", "-w-", "-wx", "r--", "r-x", "rw-", "rwx"];
 function fileInfo(entry) {
@@ -112,7 +112,7 @@ export class FileSystem {
     async findFiles(path, pattern) {
         const target = await this.#path(path);
         const runtime = await this.#ctx.live();
-        const result = await guard("sandbox", () => runtime.exec(["grep", "-rnI", "--", pattern, target]));
+        const result = await guard("sandbox", () => runtime.exec(["grep", "-rnI", "--", pattern, target], WHOLE_OUTPUT));
         if (result.exitCode !== 0 && result.exitCode !== 1)
             throw new DaytonaError(result.stderr.trim() || "grep failed", 400);
         return result.stdout

package/dist/daytona/process.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { HOME, LONGEST_MS, quote, resolvePath } from "./context.js";
+import { HOME, LONGEST_MS, quote, resolvePath, WHOLE_OUTPUT, } from "./context.js";
 import { DaytonaCommandAlreadyCompletedError, DaytonaConflictError, DaytonaNotFoundError, DaytonaProcessExecutionTimeoutError, DaytonaSessionEndedError, guard, NotSupportedError, } from "./errors.js";
 export class CodeRunParams {
     argv;
@@ -76,6 +76,7 @@ export class Process {
             cwd: cwd === undefined ? HOME : resolvePath(cwd),
             ...this.#env(env),
             timeoutMs,
+            ...WHOLE_OUTPUT,
         }));
         if (result.timedOut)
             throw new DaytonaProcessExecutionTimeoutError(`Command timed out after ${timeout} s. Pass a larger timeout, or 0 for none.`, 408);
@@ -97,6 +98,7 @@ export class Process {
             cwd: HOME,
             ...this.#env(params.env),
             timeoutMs,
+            ...WHOLE_OUTPUT,
         }));
         if (result.timedOut)
             throw new DaytonaProcessExecutionTimeoutError(`Code run timed out after ${timeout} s.`, 408);

package/dist/e2b/commands.js

@@ -68,12 +68,16 @@ export class Commands {
             const handle = await this.#start(cmd, opts, timeoutMs);
             return opts.background ? handle : handle.wait();
         }
+        /* Always streamed, so the result holds the whole output as E2B's does: an
+           exec with no output callback returns at most 64 KiB of each stream. */
+        const onStdout = opts.onStdout;
+        const onStderr = opts.onStderr;
         const result = await guard("sandbox", () => this.#ctx.runtime.exec(cmd, {
             ...(opts.cwd === undefined ? {} : { cwd: opts.cwd }),
             ...this.#env(opts.envs),
             timeoutMs,
-            ...(opts.onStdout ? { onStdout: (text) => void opts.onStdout(text) } : {}),
-            ...(opts.onStderr ? { onStderr: (text) => void opts.onStderr(text) } : {}),
+            onStdout: (text) => void onStdout?.(text),
+            ...(onStderr ? { onStderr: (text) => void onStderr(text) } : {}),
             ...(opts.signal ? { signal: opts.signal } : {}),
         }));
         return settle(result, timeoutMs);

package/dist/e2b/filesystem.d.ts

@@ -21,6 +21,26 @@ export interface EntryInfo extends WriteInfo {
     modifiedTime?: Date;
     symlinkTarget?: string;
 }
+export declare enum FilesystemEventType {
+    CHMOD = "chmod",
+    CREATE = "create",
+    REMOVE = "remove",
+    RENAME = "rename",
+    WRITE = "write"
+}
+export interface FilesystemEvent {
+    /** Relative to the watched directory. */
+    name: string;
+    type: FilesystemEventType;
+}
+export interface WatchOpts extends FilesystemRequestOpts {
+    /** How long the watch runs; 0 is Runtime's maximum, 24 hours. Default 60000. */
+    timeoutMs?: number;
+    recursive?: boolean;
+}
+export interface E2BWatchHandle {
+    stop(): Promise<void>;
+}
 export type WriteEntry = {
     path: string;
     data: string | ArrayBuffer | Blob | ReadableStream;
@@ -78,5 +98,10 @@ export declare class Filesystem {
     remove(path: string, opts?: FilesystemRequestOpts): Promise<void>;
     exists(path: string, opts?: FilesystemRequestOpts): Promise<boolean>;
     getInfo(path: string, opts?: FilesystemRequestOpts): Promise<EntryInfo>;
-    watchDir(): Promise<never>;
+    /** E2B's watchDir on Runtime's file watch: the same events (CREATE, WRITE,
+     * REMOVE, RENAME, CHMOD) with names relative to the directory, stopped
+     * with `handle.stop()`. `timeoutMs` 0 is Runtime's 24-hour maximum. */
+    watchDir(path: string, onEvent: (event: FilesystemEvent) => void | Promise<void>, opts?: WatchOpts & {
+        onExit?: (err?: Error) => void | Promise<void>;
+    }): Promise<E2BWatchHandle>;
 }

package/dist/e2b/filesystem.js

@@ -6,6 +6,14 @@ export var FileType;
     FileType["DIR"] = "dir";
     FileType["SYMLINK"] = "symlink";
 })(FileType || (FileType = {}));
+export var FilesystemEventType;
+(function (FilesystemEventType) {
+    FilesystemEventType["CHMOD"] = "chmod";
+    FilesystemEventType["CREATE"] = "create";
+    FilesystemEventType["REMOVE"] = "remove";
+    FilesystemEventType["RENAME"] = "rename";
+    FilesystemEventType["WRITE"] = "write";
+})(FilesystemEventType || (FilesystemEventType = {}));
 /** Runtime's home, where E2B's relative paths land. */
 const HOME = "/workspace";
 function absolute(path) {
@@ -137,7 +145,27 @@ export class Filesystem {
             throw new FileNotFoundError(`${target} does not exist.`);
         return entryInfo(stat);
     }
-    watchDir() {
-        return Promise.reject(new NotSupportedError("Watching a directory (files.watchDir)", "Poll with files.list(path), or run your own watcher with commands.run(..., { background: true })."));
+    /** E2B's watchDir on Runtime's file watch: the same events (CREATE, WRITE,
+     * REMOVE, RENAME, CHMOD) with names relative to the directory, stopped
+     * with `handle.stop()`. `timeoutMs` 0 is Runtime's 24-hour maximum. */
+    async watchDir(path, onEvent, opts = {}) {
+        const target = await this.#path(path, opts);
+        const prefix = target.endsWith("/") ? target : `${target}/`;
+        const lifetime = opts.timeoutMs === 0 ? 86_400_000 : (opts.timeoutMs ?? 60_000);
+        const watch = await guard("file", () => this.#files.watch(target, (event) => onEvent({
+            name: event.path.startsWith(prefix) ? event.path.slice(prefix.length) : event.path,
+            type: event.type,
+        }), {
+            recursive: opts.recursive === true,
+            timeoutMs: Math.max(1_000, Math.min(86_400_000, lifetime)),
+            onExit: (reason) => {
+                if (reason === "stopped")
+                    return;
+                void opts.onExit?.(reason === "timeout" || reason === "paused"
+                    ? undefined
+                    : new Error(`The watch ended: ${reason}`));
+            },
+        }));
+        return { stop: () => watch.stop() };
     }
 }

package/dist/e2b/index.d.ts

@@ -9,7 +9,7 @@ import { type ConnectionOpts } from "./client.js";
 import { Sandbox } from "./sandbox.js";
 export { Sandbox, SandboxPaginator, DEFAULT_SHAPE, DEFAULT_TIMEOUT_MS, type SandboxOpts, type SandboxConnectOpts, type SandboxApiOpts, type SandboxInfo, type SandboxListOpts, type SandboxState, type SandboxLifecycle, type SandboxOnTimeout, type SnapshotInfo, } from "./sandbox.js";
 export { Commands, CommandHandle, pidOf, type CommandStartOpts, type CommandConnectOpts, type CommandRequestOpts, type ProcessInfo, type Username, } from "./commands.js";
-export { Filesystem, FileType, type EntryInfo, type WriteInfo, type WriteEntry, type FilesystemRequestOpts, type FilesystemReadOpts, type FilesystemWriteOpts, type FilesystemListOpts, } from "./filesystem.js";
+export { Filesystem, FileType, type EntryInfo, type WriteInfo, type WriteEntry, type FilesystemRequestOpts, type FilesystemReadOpts, type FilesystemWriteOpts, type FilesystemListOpts, FilesystemEventType, type FilesystemEvent, type WatchOpts, type E2BWatchHandle as WatchHandle, } from "./filesystem.js";
 export { SandboxError, TimeoutError, InvalidArgumentError, NotEnoughSpaceError, NotFoundError, FileNotFoundError, SandboxNotFoundError, TemplateError, RateLimitError, AuthenticationError, ServiceBusyError, CommandExitError, NotSupportedError, type CommandResult, } from "./errors.js";
 export type { ConnectionOpts, RuntimeOpts } from "./client.js";
 export { Template, TemplateBase, Volume, Secret, waitForPort, waitForURL, waitForProcess, waitForFile, waitForTimeout, } from "./unsupported.js";

package/dist/e2b/index.js

@@ -2,7 +2,7 @@ import { clientFor } from "./client.js";
 import { Sandbox } from "./sandbox.js";
 export { Sandbox, SandboxPaginator, DEFAULT_SHAPE, DEFAULT_TIMEOUT_MS, } from "./sandbox.js";
 export { Commands, CommandHandle, pidOf, } from "./commands.js";
-export { Filesystem, FileType, } from "./filesystem.js";
+export { Filesystem, FileType, FilesystemEventType, } from "./filesystem.js";
 export { SandboxError, TimeoutError, InvalidArgumentError, NotEnoughSpaceError, NotFoundError, FileNotFoundError, SandboxNotFoundError, TemplateError, RateLimitError, AuthenticationError, ServiceBusyError, CommandExitError, NotSupportedError, } from "./errors.js";
 export { Template, TemplateBase, Volume, Secret, waitForPort, waitForURL, waitForProcess, waitForFile, waitForTimeout, } from "./unsupported.js";
 export default Sandbox;

package/dist/errors.js

@@ -15,6 +15,8 @@ export const WAITS_FOR_ROOM = new Set([
     "trial_capacity",
     "quota_exceeded",
     "no_capacity",
+    // A volume whose last sandbox is stopping: free within seconds.
+    "volume_releasing",
 ]);
 export class RuntimeError extends Error {
     code;

package/dist/identity.d.ts

@@ -0,0 +1,27 @@
+/** An identity token, as the API returns it. */
+export type IdentityToken = {
+    /** The OIDC ID token (a JWT), signed by Runtime. */
+    token: string;
+    expiresAt: string;
+    /** https://withruntime.com/oidc */
+    issuer: string;
+    /** org:<org>:image:<image>:sandbox:<sandbox> */
+    subject: string;
+    audience: string;
+};
+/**
+ * Inside a Runtime sandbox: a short-lived OIDC token, signed by Runtime,
+ * naming this sandbox, its organization and its image, for `audience`. Trade
+ * it for cloud credentials without storing a key: AWS
+ * AssumeRoleWithWebIdentity (audience `sts.amazonaws.com`), Google Cloud
+ * workload identity federation, Azure federated credentials, or your own API.
+ * Needs no API key. Lives ten minutes unless asked (60 to 3600 seconds).
+ *
+ *   import { Sandbox } from "withruntime";
+ *   const { token } = await Sandbox.identityToken({ audience: "sts.amazonaws.com" });
+ */
+export declare function identityToken(input: {
+    audience: string;
+    lifetimeSeconds?: number;
+    signal?: AbortSignal;
+}): Promise<IdentityToken>;

package/dist/identity.js

@@ -0,0 +1,56 @@
+import { RuntimeError } from "./errors.js";
+async function requestCredentials() {
+    let url = process.env.RUNTIME_ID_TOKEN_REQUEST_URL;
+    let token = process.env.RUNTIME_ID_TOKEN_REQUEST_TOKEN;
+    if (!url || !token) {
+        // A process started before the guest wrote its environment still finds it.
+        try {
+            // Loaded here, so the SDK still loads where there is no file system.
+            const { readFile } = await import("node:fs/promises");
+            const env = JSON.parse(await readFile("/run/runtime/environment.json", "utf8"));
+            url = env.RUNTIME_ID_TOKEN_REQUEST_URL;
+            token = env.RUNTIME_ID_TOKEN_REQUEST_TOKEN;
+        }
+        catch {
+            return null;
+        }
+    }
+    return url && token ? { url, token } : null;
+}
+/**
+ * Inside a Runtime sandbox: a short-lived OIDC token, signed by Runtime,
+ * naming this sandbox, its organization and its image, for `audience`. Trade
+ * it for cloud credentials without storing a key: AWS
+ * AssumeRoleWithWebIdentity (audience `sts.amazonaws.com`), Google Cloud
+ * workload identity federation, Azure federated credentials, or your own API.
+ * Needs no API key. Lives ten minutes unless asked (60 to 3600 seconds).
+ *
+ *   import { Sandbox } from "withruntime";
+ *   const { token } = await Sandbox.identityToken({ audience: "sts.amazonaws.com" });
+ */
+export async function identityToken(input) {
+    const found = await requestCredentials();
+    if (!found)
+        throw new RuntimeError({
+            code: "identity_unavailable",
+            status: 0,
+            message: "Identity tokens are issued only inside a Runtime sandbox (RUNTIME_ID_TOKEN_REQUEST_TOKEN is not set).",
+        });
+    const url = new URL(found.url);
+    url.searchParams.set("audience", input.audience);
+    if (input.lifetimeSeconds !== undefined)
+        url.searchParams.set("lifetimeSeconds", String(input.lifetimeSeconds));
+    const response = await fetch(url, {
+        headers: { authorization: `Bearer ${found.token}` },
+        signal: input.signal ?? AbortSignal.timeout(10_000),
+    });
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok || !body.token)
+        throw new RuntimeError({
+            code: body.error?.code ?? "identity_refused",
+            status: response.status,
+            message: body.error?.message ?? `Could not get an identity token (HTTP ${response.status}).`,
+            ...(body.error?.requestId ? { requestId: body.error.requestId } : {}),
+        });
+    return body;
+}

package/dist/index.d.ts

@@ -16,6 +16,11 @@ export { Page } from "./page.js";
 export type { KeyLimits } from "./products/limits.js";
 export type { AuditEvent, AuditPage } from "./products/audit.js";
 export type { Secret, SetSecret } from "./products/secrets.js";
+export type { McpCatalogEntry, McpGateway, McpServerRequest } from "./products/mcp.js";
+export type { FileEvent, FileEventType, WatchHandle, WatchNotice, WatchOptions, } from "./products/watch.js";
+export type { Mount, MountBucket } from "./products/mounts.js";
+export type { Volume, VolumeBackup, CreateVolume } from "./products/volumes.js";
+export type { CheckedDomain, DnsRecord, Domain, EgressAddress, TcpPort, Tunnel as PrivateTunnel, TunnelPeer, TunnelPeerCreated, } from "./products/network-products.js";
 export { verifyWebhook, WebhookVerificationError, type MetricPoint, type MetricRange, type OtelExport, type RuntimeEvent, type SandboxMetrics, type Webhook, type WebhookDelivery, type WebhookEventType, } from "./products/observability.js";
 export { Snapshots, type Snapshot, type SnapshotOptions } from "./snapshots.js";
 export { Transport, VERSION, apiOrigin, type RequestOptions, type Call } from "./transport.js";
@@ -50,5 +55,14 @@ export declare class Sandbox extends SandboxClass {
     static list(filter?: Parameters<Runtime["sandboxes"]["list"]>[0], options?: {
         client?: Runtime;
     }): Promise<import("./page.js").Page<SandboxClass>>;
+    /** Inside a sandbox: an OIDC token naming this sandbox, for `audience`
+     * (AWS: "sts.amazonaws.com"). No API key needed. See `identityToken`. */
+    static identityToken(input: {
+        audience: string;
+        lifetimeSeconds?: number;
+        signal?: AbortSignal;
+    }): Promise<import("./identity.js").IdentityToken>;
 }
 export type { RuntimeOptions as ClientOptions };
+export { identityToken, type IdentityToken } from "./identity.js";
+export type { SsoConnection, SsoStatus } from "./products/sso.js";

package/dist/index.js

@@ -1,5 +1,6 @@
 import { defaultClient } from "./client.js";
 import { Sandbox as SandboxClass } from "./sandbox.js";
+import { identityToken } from "./identity.js";
 export { Runtime, Sandboxes, FeedbackApi, SupportApi, } from "./client.js";
 export { Files, Process, Processes, Terminal } from "./sandbox.js";
 export { Tunnel, TunnelStream } from "./tunnel.js";
@@ -37,4 +38,10 @@ export class Sandbox extends SandboxClass {
     static list(filter = {}, options = {}) {
         return (options.client ?? defaultClient()).sandboxes.list(filter);
     }
+    /** Inside a sandbox: an OIDC token naming this sandbox, for `audience`
+     * (AWS: "sts.amazonaws.com"). No API key needed. See `identityToken`. */
+    static identityToken(input) {
+        return identityToken(input);
+    }
 }
+export { identityToken } from "./identity.js";

package/dist/mcp.js

@@ -158,7 +158,7 @@ export async function serveMcp(env = process.env, options = {}) {
                     }));
                     await post(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }));
                     write({ jsonrpc: "2.0", method: "notifications/tools/list_changed" });
-                    return text(`Connected as ${outcome.agentName}. Runtime's tools are available now: list the tools again, then start with runtime_sandboxes_create.`);
+                    return text(`Connected as ${outcome.agentName}. Runtime's tools are available now: list the tools again, then start with runtime_sandbox_create.`);
                 }
                 await new Promise((resolve) => setTimeout(resolve, 3000));
             }
@@ -208,9 +208,22 @@ export async function serveMcp(env = process.env, options = {}) {
             }
         });
         const finish = () => void Promise.allSettled([...inFlight]).then(() => resolve());
+        /* A signal ends the bridge at once: stop reading, give a reply already on
+           its way half a second to be written, and return. The client that sent
+           it has stopped listening; waiting on a long tool call, or on stdin it
+           left open, only makes it wait for us or kill us. */
+        const stop = () => {
+            process.stdin.removeAllListeners("data");
+            process.stdin.pause();
+            process.stdin.destroy();
+            void Promise.race([
+                Promise.allSettled([...inFlight]),
+                new Promise((settle) => setTimeout(settle, 500)),
+            ]).then(() => resolve());
+        };
         process.stdin.once("end", finish);
-        process.once("SIGINT", finish);
-        process.once("SIGTERM", finish);
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
     });
 }
 async function openBrowser(url) {

package/dist/network-cli.d.ts

@@ -0,0 +1,15 @@
+import type { Runtime } from "./client.js";
+type Out = {
+    json: boolean;
+    write: (text: string) => void;
+    error: (text: string) => void;
+};
+type Args = {
+    positional: string[];
+    flags: Map<string, string[]>;
+};
+export declare const NETWORK_PRODUCTS: readonly ["domain", "port", "address", "tunnel"];
+export type NetworkProduct = (typeof NETWORK_PRODUCTS)[number];
+export declare const NETWORK_HELP: Record<NetworkProduct, string>;
+export declare function networkProductCommand(product: NetworkProduct, argv: string[], args: Args, out: Out, client: () => Promise<Runtime>): Promise<number>;
+export {};