withruntime 0.5.0 → 0.6.0

package/dist/network-cli.js

@@ -0,0 +1,323 @@
+import { chmod, writeFile } from "node:fs/promises";
+import { RuntimeError } from "./errors.js";
+import { named } from "./login.js";
+import { generateWireGuardKeyPair } from "./wireguard.js";
+function fundingState(value) {
+    if (value.funded === false)
+        return "Traffic disabled. Check balance, spending limits and account permissions. Reservation kept until you release it.";
+    if (value.funded !== true)
+        return "Funding status unavailable.";
+    return value.fundedUntil
+        ? `Funded until ${value.fundedUntil}.`
+        : "Funding active; no deadline reported.";
+}
+export const NETWORK_PRODUCTS = ["domain", "port", "address", "tunnel"];
+export const NETWORK_HELP = {
+    domain: `runtime domain <command>
+
+  add <hostname> <sandbox> <port>        Serve a sandbox's port at your own hostname, with HTTPS
+                                         Prints the DNS records to set: a TXT that proves the
+                                         name is yours, and a CNAME (an A for an apex name)
+  verify <hostname>                      Check the TXT record now; the name goes live when it matches
+  ls                                     Your domains
+  get <hostname>                         One domain and its DNS records
+  rm <hostname>                          Stop serving it
+  Paid accounts only. The first visit gets the certificate, in a few seconds.
+`,
+    port: `runtime port <command>
+
+  open <sandbox> <port>                  A public TCP port to a port in the sandbox: Postgres,
+                                         Redis, a game server, anything that is not HTTP
+                                         Prints address:port for your client
+  ls [--sandbox <id>]                    Your open ports
+  close <portId>                         Close one; open connections end within seconds
+  Paid accounts only. TCP, carried as it is: use your service's own password and TLS.
+`,
+    address: `runtime address <command>
+
+  reserve [--ipv6]                       A dedicated outbound address: every sandbox of your
+                                         account sends from it, for allow-lists
+  ls                                     Your addresses
+  release <addressId>                    Give it back; sandboxes use the shared addresses again
+  Paid accounts only.
+`,
+    tunnel: `runtime tunnel <command>
+
+  create [--subnet 10.250.0.0/16]        A WireGuard tunnel from your network into your sandboxes
+  get                                    The tunnel, its peers, and each sandbox's address in it
+  rm                                     Delete the tunnel and every peer
+  peer add <name> [--route 10.0.0.0/16]... [--out runtime.conf] [--public-key <key>]
+                                         Add a machine or router of yours; writes its wg-quick
+                                         file. The key pair is made here and the private key
+                                         never leaves this machine. Then: sudo wg-quick up ./runtime.conf
+  peer rotate <peerId> [--out runtime.conf]
+                                         A new key; the old one stops working within seconds
+  peer rm <peerId>                       Remove it; its tunnel ends within seconds
+  --route: your own ranges behind the peer that sandboxes may reach. Paid accounts only.
+`,
+};
+function usage(product, message) {
+    return new RuntimeError({
+        message,
+        code: "usage",
+        status: 0,
+        hint: `Run \`${named("runtime")} ${product} help\`.`,
+    });
+}
+function table(rows) {
+    const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length)));
+    return rows
+        .map((row) => row
+        .map((cell, column) => cell.padEnd(widths[column]))
+        .join("  ")
+        .trimEnd())
+        .join("\n");
+}
+function portNumber(product, text) {
+    const value = Number(text);
+    if (!text || !/^\d+$/.test(text) || value < 1 || value > 65_535)
+        throw usage(product, "Give a port from 1 to 65535.");
+    return value;
+}
+/** Writes a wg-quick file readable by its owner alone, or prints it. */
+async function deliver(out, config, path, hint, ready = true) {
+    if (!config) {
+        out.error(hint);
+        return;
+    }
+    if (path) {
+        await writeFile(path, config, { mode: 0o600 });
+        await chmod(path, 0o600);
+        out.error(ready
+            ? `Wrote ${path}. Bring it up with: sudo wg-quick up ${path.startsWith("/") ? path : `./${path}`}`
+            : `Wrote ${path}. ${hint}`);
+    }
+    else
+        out.write(config);
+}
+export async function networkProductCommand(product, argv, args, out, client) {
+    const [verb] = argv;
+    const flag = (name) => args.flags.get(name)?.at(-1);
+    const has = (name) => flag(name) === "true";
+    const print = (human, value) => out.write(out.json ? JSON.stringify(value) : human);
+    const rest = args.positional.slice(1);
+    const need = (value, what) => {
+        if (!value)
+            throw usage(product, `Give ${what}.`);
+        return value;
+    };
+    if (!verb || verb === "help" || verb === "--help") {
+        print(named(NETWORK_HELP[product]), { usage: named(NETWORK_HELP[product]) });
+        return 0;
+    }
+    const runtime = await client();
+    if (product === "domain") {
+        const records = (domain) => table([
+            ["TYPE", "NAME", "VALUE"],
+            ...domain.records.map((record) => [record.type, record.name, record.value]),
+        ]);
+        switch (verb) {
+            case "add": {
+                const found = await runtime.domains.add({
+                    hostname: need(rest[0], "a hostname, such as app.example.com"),
+                    sandboxId: need(rest[1], "a sandbox id"),
+                    port: portNumber(product, rest[2]),
+                });
+                print(`${found.hostname}: ${found.state}\n\n${records(found)}\n\n${found.hint}`, found);
+                return 0;
+            }
+            case "verify": {
+                const found = await runtime.domains.verify(need(rest[0], "a hostname"));
+                print(`${found.hostname}: ${found.state}. ${found.hint}${found.checkError ? `\n${found.checkError}` : ""}`, found);
+                return found.state === "active" ? 0 : 1;
+            }
+            case "ls":
+            case "list": {
+                const all = await runtime.domains.list();
+                print(all.length
+                    ? table([
+                        ["HOSTNAME", "STATE", "SANDBOX", "PORT"],
+                        ...all.map((d) => [
+                            d.hostname,
+                            d.disabled ? "taken down" : d.state,
+                            d.sandboxId,
+                            String(d.port),
+                        ]),
+                    ])
+                    : named("No domains. Add one: runtime domain add app.example.com <sandbox> 3000"), all);
+                return 0;
+            }
+            case "get": {
+                const found = await runtime.domains.get(need(rest[0], "a hostname"));
+                print(`${found.hostname}: ${found.state}\n\n${records(found)}`, found);
+                return 0;
+            }
+            case "rm":
+            case "remove": {
+                const gone = await runtime.domains.remove(need(rest[0], "a hostname"));
+                print(`${gone.hostname} is no longer served. Remove its DNS records too.`, gone);
+                return 0;
+            }
+        }
+    }
+    if (product === "port") {
+        switch (verb) {
+            case "open": {
+                const opened = await runtime.ports.open({
+                    sandboxId: need(rest[0], "a sandbox id"),
+                    port: portNumber(product, rest[1]),
+                });
+                if (!out.json)
+                    out.error(opened.hint);
+                print(opened.connect, opened);
+                return 0;
+            }
+            case "ls":
+            case "list": {
+                const sandboxId = flag("sandbox");
+                const all = await runtime.ports.list(sandboxId ? { sandboxId } : {});
+                print(all.length
+                    ? table([
+                        ["ID", "CONNECT", "SANDBOX", "PORT"],
+                        ...all.map((p) => [p.id, p.connect, p.sandboxId, String(p.port)]),
+                    ])
+                    : named("No open ports. Open one: runtime port open <sandbox> 5432"), all);
+                return 0;
+            }
+            case "close":
+            case "rm": {
+                const gone = await runtime.ports.close(need(rest[0], "a port id"));
+                print(`Closed ${gone.id}.`, gone);
+                return 0;
+            }
+        }
+    }
+    if (product === "address") {
+        switch (verb) {
+            case "reserve": {
+                const reserved = await runtime.addresses.reserve({ family: has("ipv6") ? 6 : 4 });
+                if (!out.json)
+                    out.error(reserved.funded === true
+                        ? `Every sandbox of this account sends from it. ${fundingState(reserved)}`
+                        : fundingState(reserved));
+                print(reserved.address, reserved);
+                return 0;
+            }
+            case "ls":
+            case "list": {
+                const all = await runtime.addresses.list();
+                print(all.length
+                    ? table([
+                        ["ID", "ADDRESS", "FAMILY", "FUNDING"],
+                        ...all.map((a) => [a.id, a.address, `IPv${a.family}`, fundingState(a)]),
+                    ])
+                    : named("No dedicated address. Reserve one: runtime address reserve"), all);
+                return 0;
+            }
+            case "release":
+            case "rm": {
+                const gone = await runtime.addresses.release(need(rest[0], "an address id"));
+                print(`Released ${gone.address}.`, gone);
+                return 0;
+            }
+        }
+    }
+    if (product === "tunnel") {
+        const view = (tunnel) => [
+            fundingState(tunnel),
+            `Endpoint ${tunnel.endpoint}, subnet ${tunnel.subnet}, gateway key ${tunnel.gatewayPublicKey ?? "(starting)"}`,
+            "",
+            tunnel.peers.length
+                ? table([
+                    ["PEER", "NAME", "ADDRESS", "ROUTES"],
+                    ...tunnel.peers.map((p) => [p.id, p.name, p.address, p.routes.join(",") || "-"]),
+                ])
+                : named("No peers. Add one: runtime tunnel peer add office --route 10.0.0.0/16"),
+            "",
+            tunnel.sandboxes.length
+                ? table([
+                    ["SANDBOX", "NAME", "ADDRESS", "STATE"],
+                    ...tunnel.sandboxes.map((s) => [s.sandboxId, s.name ?? "-", s.address, s.state]),
+                ])
+                : "No sandboxes yet.",
+        ].join("\n");
+        switch (verb) {
+            case "create": {
+                const made = await runtime.tunnel.create(flag("subnet") ? { subnet: flag("subnet") } : {});
+                print(view(made), made);
+                return 0;
+            }
+            case "get":
+            case "ls": {
+                const found = await runtime.tunnel.get();
+                print(view(found), found);
+                return 0;
+            }
+            case "rm":
+            case "delete": {
+                const gone = await runtime.tunnel.delete();
+                print(`Deleted the tunnel ${gone.id}.`, gone);
+                return 0;
+            }
+            case "peer":
+            case "peers": {
+                const action = rest[0];
+                if (action === "add" || action === "rotate") {
+                    // The pair is made here unless a key is given: the private key never
+                    // leaves this machine, and goes only into the file written below.
+                    const given = flag("public-key");
+                    const pair = given ? undefined : generateWireGuardKeyPair();
+                    const publicKey = given ?? pair.publicKey;
+                    const answer = action === "add"
+                        ? await runtime.tunnel.addPeer({
+                            name: need(rest[1], "the peer's name, such as office"),
+                            publicKey,
+                            routes: args.flags.get("route") ?? [],
+                        })
+                        : await runtime.tunnel.rotatePeer(need(rest[1], "a peer id"), { publicKey });
+                    const configReady = answer.configReady ?? !!answer.config;
+                    const draftHint = "Keep this file: it preserves your private key. Read runtime tunnel get when the gateway is ready, replace PublicKey in [Peer] with gatewayPublicKey, then run wg-quick up.";
+                    // Older servers returned no config while the gateway was starting.
+                    // Preserve the locally generated key in a draft rather than discard it.
+                    const supplied = answer.config ??
+                        [
+                            "# DRAFT: gateway key missing. Keep this file; it preserves your private key.",
+                            "[Interface]",
+                            `PrivateKey = ${pair?.privateKey ?? "<your private key>"}`,
+                            `Address = ${answer.peer.address}/32`,
+                            "",
+                            "[Peer]",
+                            `PublicKey = ${answer.tunnel.gatewayPublicKey ?? "<gatewayPublicKey from runtime tunnel get>"}`,
+                            `Endpoint = ${answer.tunnel.endpoint}`,
+                            `AllowedIPs = ${answer.tunnel.subnet}`,
+                            "PersistentKeepalive = 25",
+                            "",
+                        ].join("\n");
+                    const config = pair
+                        ? supplied.replace(/^PrivateKey = .*$/m, `PrivateKey = ${pair.privateKey}`)
+                        : supplied;
+                    if (out.json) {
+                        print("", {
+                            ...answer,
+                            config,
+                            configReady,
+                            ...(!configReady ? { hint: draftHint } : {}),
+                        });
+                        return 0;
+                    }
+                    if (answer.tunnel.funded === false)
+                        out.error(fundingState(answer.tunnel));
+                    await deliver(out, config, flag("out") ?? (pair ? "runtime.conf" : undefined), configReady ? answer.hint : draftHint, configReady);
+                    return 0;
+                }
+                if (action === "rm" || action === "remove") {
+                    const after = await runtime.tunnel.removePeer(need(rest[1], "a peer id"));
+                    print(`Removed. ${after.peers.length} peer(s) left.`, after);
+                    return 0;
+                }
+                throw usage(product, "Use peer add, peer rotate or peer rm.");
+            }
+        }
+    }
+    throw usage(product, `Unknown ${product} command ${verb}.`);
+}

package/dist/products/desktop.d.ts

@@ -21,6 +21,27 @@ export type DesktopStart = {
     streamUrl: string;
     preview: Preview;
 };
+export type DesktopRecording = {
+    id: string;
+    state: "starting" | "installing" | "recording" | "finished" | "failed";
+    /** The MP4 file in the sandbox. */
+    path: string;
+    bytes: number;
+    seconds?: number;
+    /** Why it ended: stopped, max-seconds, max-bytes, disk-low, desktop-gone, error. */
+    reason: string | null;
+    startedAt?: number | null;
+};
+export type RecordOptions = {
+    /** Frames a second, 1 to 30. Default 10. */
+    fps?: number;
+    /** Stop after this much video, up to 7200. Default 1800. */
+    maxSeconds?: number;
+    /** The file never grows past this, 16 to 4096. Default 512. */
+    maxMiB?: number;
+    /** Quality, 18 (sharp, large) to 45 (small). Default 30. */
+    crf?: number;
+};
 /** `sbx.desktop`: a Linux desktop in the sandbox, driven like a person would.
  *
  *   const { streamUrl } = await sbx.desktop.start();
@@ -31,10 +52,12 @@ export type DesktopStart = {
  *
  * Coordinates are pixels from the top left of the screen. */
 export declare function sandboxDesktop(t: Transport, sandbox: Sandbox): {
-    start: (size?: {
+    /** Starts the desktop. The first start in a sandbox installs it, which
+     * takes a minute or two; this waits for that (up to 10 minutes). */
+    start(size?: {
         width?: number;
         height?: number;
-    }, options?: RequestOptions) => Promise<DesktopStart>;
+    }, options?: RequestOptions): Promise<DesktopStart>;
     stop: (options?: RequestOptions) => Promise<{
         ok: boolean;
     }>;
@@ -92,12 +115,26 @@ export declare function sandboxDesktop(t: Transport, sandbox: Sandbox): {
     focus: (windowId: string, options?: RequestOptions) => Promise<{
         ok: true;
     }>;
-    /** Opens `url` in Firefox on the desktop. */
-    open: (url: string, options?: RequestOptions) => Promise<{
+    /** Opens `url` in Firefox on the desktop. Right after a sandbox's first
+     * start, Firefox may still be installing; this waits for it. */
+    open(url: string, options?: RequestOptions): Promise<{
         ok: true;
     }>;
     /** Starts a program on the desktop, detached. */
     launch: (argv: string[], options?: RequestOptions) => Promise<{
         ok: true;
     }>;
+    /** Screen recordings to MP4: `const rec = await sbx.desktop.recordings.start();`
+     * ... `await sbx.desktop.recordings.stop(rec.id)`, then `download(rec.id)`. */
+    recordings: {
+        start: (input?: RecordOptions, options?: RequestOptions) => Promise<DesktopRecording>;
+        stop: (id: string, options?: RequestOptions) => Promise<DesktopRecording>;
+        get: (id: string, options?: RequestOptions) => Promise<DesktopRecording>;
+        list: (options?: RequestOptions) => Promise<DesktopRecording[]>;
+        /** The MP4 bytes. */
+        download: (id: string, options?: RequestOptions) => Promise<Uint8Array<ArrayBufferLike>>;
+        delete: (id: string, options?: RequestOptions) => Promise<{
+            deleted: boolean;
+        }>;
+    };
 };

package/dist/products/desktop.js

@@ -11,7 +11,27 @@ export function sandboxDesktop(t, sandbox) {
     const base = () => `/v1/sandboxes/${encodeURIComponent(sandbox.id)}/desktop`;
     const act = (body, options) => t.json({ method: "POST", path: `${base()}:act`, body, ...options });
     return {
-        start: (size = {}, options) => t.json({ method: "POST", path: `${base()}:start`, body: size, ...options }),
+        /** Starts the desktop. The first start in a sandbox installs it, which
+         * takes a minute or two; this waits for that (up to 10 minutes). */
+        async start(size = {}, options) {
+            const deadline = Date.now() + 600_000;
+            for (;;) {
+                try {
+                    return await t.json({
+                        method: "POST",
+                        path: `${base()}:start`,
+                        body: size,
+                        ...options,
+                    });
+                }
+                catch (error) {
+                    const code = error.code;
+                    if (code !== "desktop_installing" || Date.now() > deadline)
+                        throw error;
+                    await new Promise((resolve) => setTimeout(resolve, error.retryAfterMs ?? 10_000));
+                }
+            }
+        },
         stop: (options) => t.json({ method: "POST", path: `${base()}:stop`, ...options }),
         /** PNG bytes, or JPEG with `format: "jpeg"`. */
         screenshot: (input = {}, options) => t.bytes({ method: "GET", path: `${base()}/screenshot`, query: input, ...options }),
@@ -30,9 +50,59 @@ export function sandboxDesktop(t, sandbox) {
         cursor: (options) => act({ action: "cursor" }, options),
         windows: async (options) => (await act({ action: "windows" }, options)).windows,
         focus: (windowId, options) => act({ action: "focus", windowId }, options),
-        /** Opens `url` in Firefox on the desktop. */
-        open: (url, options) => act({ action: "open", url }, options),
+        /** Opens `url` in Firefox on the desktop. Right after a sandbox's first
+         * start, Firefox may still be installing; this waits for it. */
+        async open(url, options) {
+            const deadline = Date.now() + 600_000;
+            for (;;) {
+                try {
+                    return await act({ action: "open", url }, options);
+                }
+                catch (error) {
+                    const code = error.code;
+                    if (code !== "desktop_installing" || Date.now() > deadline)
+                        throw error;
+                    await new Promise((resolve) => setTimeout(resolve, error.retryAfterMs ?? 10_000));
+                }
+            }
+        },
         /** Starts a program on the desktop, detached. */
         launch: (argv, options) => act({ action: "launch", argv }, options),
+        /** Screen recordings to MP4: `const rec = await sbx.desktop.recordings.start();`
+         * ... `await sbx.desktop.recordings.stop(rec.id)`, then `download(rec.id)`. */
+        recordings: {
+            start: (input = {}, options) => t.json({
+                method: "POST",
+                path: `${base()}/recordings`,
+                body: input,
+                ...options,
+            }),
+            stop: (id, options) => t.json({
+                method: "POST",
+                path: `${base()}/recordings/${encodeURIComponent(id)}:stop`,
+                ...options,
+            }),
+            get: (id, options) => t.json({
+                method: "GET",
+                path: `${base()}/recordings/${encodeURIComponent(id)}`,
+                ...options,
+            }),
+            list: async (options) => (await t.json({
+                method: "GET",
+                path: `${base()}/recordings`,
+                ...options,
+            })).data,
+            /** The MP4 bytes. */
+            download: (id, options) => t.bytes({
+                method: "GET",
+                path: `${base()}/recordings/${encodeURIComponent(id)}/video`,
+                ...options,
+            }),
+            delete: (id, options) => t.json({
+                method: "DELETE",
+                path: `${base()}/recordings/${encodeURIComponent(id)}`,
+                ...options,
+            }),
+        },
     };
 }

package/dist/products/index.d.ts

@@ -4,13 +4,17 @@ import { images } from "./images.js";
 import { sandboxDesktop } from "./desktop.js";
 import { sandboxInterpreter } from "./interpreter.js";
 import { sandboxNetwork } from "./network.js";
+import { addresses, domains, ports, tunnel } from "./network-products.js";
 import { sandboxPreviews } from "./previews.js";
 import { referrals } from "./referrals.js";
 import { audit } from "./audit.js";
+import { sso } from "./sso.js";
 import { switching } from "./switching.js";
 import { limits } from "./limits.js";
 import { volumes } from "./volumes.js";
+import { sandboxMounts } from "./mounts.js";
 import { secrets } from "./secrets.js";
+import { mcp, sandboxMcp } from "./mcp.js";
 import { events, otel, sandboxMetrics, webhooks } from "./observability.js";
 export declare const clientExtensions: {
     images: typeof images;
@@ -23,13 +27,21 @@ export declare const clientExtensions: {
     otel: typeof otel;
     events: typeof events;
     audit: typeof audit;
+    mcp: typeof mcp;
+    sso: typeof sso;
+    domains: typeof domains;
+    ports: typeof ports;
+    addresses: typeof addresses;
+    tunnel: typeof tunnel;
 };
 export declare const sandboxExtensions: {
     interpreter: typeof sandboxInterpreter;
     previews: typeof sandboxPreviews;
     network: typeof sandboxNetwork;
     desktop: typeof sandboxDesktop;
+    mounts: typeof sandboxMounts;
     metrics: typeof sandboxMetrics;
+    mcp: typeof sandboxMcp;
 };
 export type ClientExtensions = {
     readonly [K in keyof typeof clientExtensions]: ReturnType<(typeof clientExtensions)[K]>;

package/dist/products/index.js

@@ -2,13 +2,17 @@ import { images } from "./images.js";
 import { sandboxDesktop } from "./desktop.js";
 import { sandboxInterpreter } from "./interpreter.js";
 import { sandboxNetwork } from "./network.js";
+import { addresses, domains, ports, tunnel } from "./network-products.js";
 import { sandboxPreviews } from "./previews.js";
 import { referrals } from "./referrals.js";
 import { audit } from "./audit.js";
+import { sso } from "./sso.js";
 import { switching } from "./switching.js";
 import { limits } from "./limits.js";
 import { volumes } from "./volumes.js";
+import { sandboxMounts } from "./mounts.js";
 import { secrets } from "./secrets.js";
+import { mcp, sandboxMcp } from "./mcp.js";
 import { events, otel, sandboxMetrics, webhooks } from "./observability.js";
 /* HOW A LANE ADDS A PRODUCT TO THE SDK
  *
@@ -36,13 +40,21 @@ export const clientExtensions = {
     otel,
     events,
     audit,
+    mcp,
+    sso,
+    domains,
+    ports,
+    addresses,
+    tunnel,
 };
 export const sandboxExtensions = {
     interpreter: sandboxInterpreter,
     previews: sandboxPreviews,
     network: sandboxNetwork,
     desktop: sandboxDesktop,
+    mounts: sandboxMounts,
     metrics: sandboxMetrics,
+    mcp: sandboxMcp,
 };
 /** The factories as plain pairs, for the constructors that install them. */
 export function clientFactories() {

package/dist/products/interpreter.d.ts

@@ -1,6 +1,6 @@
 import type { Sandbox } from "../sandbox.js";
 import type { RequestOptions, Transport } from "../transport.js";
-export type InterpreterLanguage = "python" | "javascript";
+export type InterpreterLanguage = "python" | "javascript" | "typescript" | "r" | "java" | "bash" | "go";
 export type ResultRef = {
     path: string;
     bytes: number;
@@ -47,7 +47,8 @@ export type InterpreterContext = {
 };
 export type RunOptions = RequestOptions & {
     language?: InterpreterLanguage;
-    /** A context id; "python" and "javascript" are the defaults, started on first use. */
+    /** A context id; each language's own name ("python", "typescript", "r"...) is
+     * its default context, started on first use. */
     context?: string;
     timeoutMs?: number;
     onStdout?: (text: string) => void;
@@ -59,7 +60,8 @@ export type RunOptions = RequestOptions & {
         traceback: string;
     }) => void;
 };
-/** A stateful Python and JavaScript interpreter in the sandbox:
+/** A stateful interpreter in the sandbox, in Python, JavaScript, TypeScript,
+ * R, Java, Bash or Go:
  * `await sbx.interpreter.run("import pandas as pd; pd.DataFrame({'a': [1]})")`.
  * Variables persist between runs of the same context, like a notebook. */
 export declare function sandboxInterpreter(t: Transport, sandbox: Sandbox): {

package/dist/products/interpreter.js

@@ -1,4 +1,5 @@
-/** A stateful Python and JavaScript interpreter in the sandbox:
+/** A stateful interpreter in the sandbox, in Python, JavaScript, TypeScript,
+ * R, Java, Bash or Go:
  * `await sbx.interpreter.run("import pandas as pd; pd.DataFrame({'a': [1]})")`.
  * Variables persist between runs of the same context, like a notebook. */
 export function sandboxInterpreter(t, sandbox) {