withruntime 0.6.0 → 0.7.0

package/E2B.md

@@ -50,38 +50,38 @@ machine. An E2B key (`e2b_...`) is never sent anywhere. If one is passed as
 
 ## Mapping
 
-| E2B                                                                                      | On Runtime                                                                                                                                                                     |
-| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `Sandbox.create()`, `Sandbox.create(template, opts)`                                     | `sandboxes.create`. `base` and `code-interpreter-v1` are Runtime's stock image. Any other name must be a ready Runtime image with that name. A UUID is an image or a snapshot. |
-| `timeoutMs` (Python `timeout`, seconds)                                                  | `timeoutSeconds`, rounded up. Under 60 s becomes 60 s, with a warning. Over an hour is refused.                                                                                |
-| `metadata`                                                                               | labels (at most 32).                                                                                                                                                           |
-| `envs`                                                                                   | Given to every command and code run through this object.                                                                                                                       |
-| `allowInternetAccess: false`                                                             | `network: { internet: false }`.                                                                                                                                                |
-| `lifecycle.onTimeout`                                                                    | `onLeaseEnd`: `kill` is `stop`, `pause` is `pause`.                                                                                                                            |
-| `commands.run(cmd, { cwd, envs, timeoutMs, onStdout, onStderr })`                        | `exec`, streamed, so the whole output comes back however large. Default timeout 60 s. `0` means no limit (Runtime's longest, 24 hours).                                        |
-| Non-zero exit                                                                            | Throws `CommandExitError` with `exitCode`, `stdout`, `stderr` and `error` (`exit status N`). A command killed by a signal has `exitCode` -1.                                   |
-| Command past its timeout                                                                 | Throws `TimeoutError`.                                                                                                                                                         |
-| `commands.run(cmd, { background: true })`                                                | `spawn`. Returns a `CommandHandle` with `pid`, `wait()`, `kill()` (SIGKILL), `sendStdin`, `closeStdin`, `disconnect`, `stdout`, `stderr`, `exitCode`.                          |
-| `commands.list`, `kill(pid)`, `sendStdin(pid)`, `closeStdin(pid)`, `connect(pid)`        | Runtime's processes. A pid is a number derived from Runtime's process id, not the Linux pid.                                                                                   |
-| `files.read(path, { format })`                                                           | `files.read`. `text`, `bytes`, `blob` and `stream` (Python: `text`, `bytes`, `stream`).                                                                                        |
-| `files.write(path, data)`, `write([...])`, `writeFiles`                                  | `files.write`. Parent directories are made, and a file that exists is replaced.                                                                                                |
-| `files.list(path, { depth })`                                                            | `files.list`, hidden files included. `owner` and `group` are always `""`.                                                                                                      |
-| `files.makeDir`, `exists`, `getInfo`, `rename`, `remove`                                 | `files.stat`, `mkdir`, `rename` (replacing a file that exists) and `remove` (recursive). A missing file throws `FileNotFoundError`.                                            |
-| Relative paths                                                                           | Resolved against the home directory, `/workspace` on Runtime.                                                                                                                  |
-| `/home/user` (E2B's home)                                                                | The first time a path, `cwd` or command names it, it becomes a link to `/workspace`, unless something is already there.                                                        |
-| `sandbox.kill()`, `Sandbox.kill(id)`                                                     | `stop`, without waiting. `false` when the sandbox was not found or had already ended.                                                                                          |
-| `sandbox.setTimeout(ms)`, `Sandbox.setTimeout(id, ms)`                                   | `extend`: the end moves to now + ms. Moving it earlier is refused.                                                                                                             |
-| `Sandbox.connect(id, { timeoutMs })`, `sandbox.connect()`                                | `get`. A paused sandbox is woken. A running one's end moves later, never earlier. An ended one throws `SandboxNotFoundError`.                                                  |
-| `sandbox.pause()`, `betaPause`, `Sandbox.pause(id)`                                      | `pause`, keeping memory and files. `false` when it was already paused.                                                                                                         |
-| `getInfo`, `isRunning`                                                                   | `get`. `templateId` is `base` or the image or snapshot id. `envdVersion` is `runtime`.                                                                                         |
-| `Sandbox.list({ query: { metadata, state }, limit })`                                    | `sandboxes.list` by labels and state, oldest first, with E2B's paginator (`hasNext`, `nextItems()`).                                                                           |
-| `fork`, `createSnapshot`, `deleteSnapshot`                                               | Runtime's forks and snapshots. While Runtime has them switched off, they throw `NotSupportedError` with Runtime's own message.                                                 |
-| `getHost(port)`                                                                          | Refused, because E2B answers it without a call. `await sandbox.getPublicHost(port)` shares the port as a public Runtime preview and returns its host.                          |
-| `runCode(code, { language, context, onStdout, onStderr, onResult, onError, timeoutMs })` | Runtime's interpreter, Python and JavaScript. The sandbox's `envs` reach code through a context made once for them. `onResult` is called after the run ends.                   |
-| `Execution`, `Result`, `Logs`, `ExecutionError`, `OutputMessage`                         | The same shapes. Results that are too large to send inline are fetched and inlined. `logs.stdout` has one entry per line.                                                      |
-| `createCodeContext`, `listCodeContexts`, `restartCodeContext`, `removeCodeContext`       | Runtime's interpreter contexts.                                                                                                                                                |
-| `getMetrics({ start, end })`, `Sandbox.getMetrics(id)`                                   | Runtime's measured CPU and memory, one entry per host reading (every minute by default). `diskUsed` is null: Runtime does not read disk use inside the sandbox.                |
-| Error classes                                                                            | E2B's names and parents. Each also carries Runtime's `code`, `hint` and `requestId`, with the original error as `cause`.                                                       |
+| E2B                                                                                      | On Runtime                                                                                                                                                                                                                                                  |
+| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Sandbox.create()`, `Sandbox.create(template, opts)`                                     | `sandboxes.create`. `base` and `code-interpreter-v1` are Runtime's stock image. Any other name must be a ready Runtime image with that name. A UUID is an image or a snapshot.                                                                              |
+| `timeoutMs` (Python `timeout`, seconds)                                                  | `timeoutSeconds`, rounded up. Under 60 s becomes 60 s, with a warning. Over an hour is refused.                                                                                                                                                             |
+| `metadata`                                                                               | labels (at most 32).                                                                                                                                                                                                                                        |
+| `envs`                                                                                   | Given to every command and code run through this object.                                                                                                                                                                                                    |
+| `allowInternetAccess: false`                                                             | `network: { internet: false }`.                                                                                                                                                                                                                             |
+| `lifecycle.onTimeout`                                                                    | `onLeaseEnd`: `kill` is `stop`, `pause` is `pause`.                                                                                                                                                                                                         |
+| `commands.run(cmd, { cwd, envs, timeoutMs, onStdout, onStderr })`                        | `exec`, streamed, so the whole output comes back however large. Default timeout 60 s. `0` means no limit (Runtime's longest, 24 hours).                                                                                                                     |
+| Non-zero exit                                                                            | Throws `CommandExitError` with `exitCode`, `stdout`, `stderr` and `error` (`exit status N`). A command killed by a signal has `exitCode` -1.                                                                                                                |
+| Command past its timeout                                                                 | Throws `TimeoutError`.                                                                                                                                                                                                                                      |
+| `commands.run(cmd, { background: true })`                                                | `spawn`. Returns a `CommandHandle` with `pid`, `wait()`, `kill()` (SIGKILL), `sendStdin`, `closeStdin`, `disconnect`, `stdout`, `stderr`, `exitCode`.                                                                                                       |
+| `commands.list`, `kill(pid)`, `sendStdin(pid)`, `closeStdin(pid)`, `connect(pid)`        | Runtime's processes. A pid is a number derived from Runtime's process id, not the Linux pid.                                                                                                                                                                |
+| `files.read(path, { format })`                                                           | `files.read`. `text`, `bytes`, `blob` and `stream` (Python: `text`, `bytes`, `stream`).                                                                                                                                                                     |
+| `files.write(path, data)`, `write([...])`, `writeFiles`                                  | `files.write`. Parent directories are made, and a file that exists is replaced.                                                                                                                                                                             |
+| `files.list(path, { depth })`                                                            | `files.list`, hidden files included. `owner` and `group` are always `""`.                                                                                                                                                                                   |
+| `files.makeDir`, `exists`, `getInfo`, `rename`, `remove`                                 | `files.stat`, `mkdir`, `rename` (replacing a file that exists) and `remove` (recursive). A missing file throws `FileNotFoundError`.                                                                                                                         |
+| Relative paths                                                                           | Resolved against the home directory, `/workspace` on Runtime.                                                                                                                                                                                               |
+| `/home/user` (E2B's home)                                                                | The first time a path, `cwd` or command names it, it becomes a link to `/workspace`, unless something is already there.                                                                                                                                     |
+| `sandbox.kill()`, `Sandbox.kill(id)`                                                     | `stop`, without waiting. `false` when the sandbox was not found or had already ended.                                                                                                                                                                       |
+| `sandbox.setTimeout(ms)`, `Sandbox.setTimeout(id, ms)`                                   | `extend`: the end moves to now + ms. Moving it earlier is refused.                                                                                                                                                                                          |
+| `Sandbox.connect(id, { timeoutMs })`, `sandbox.connect()`                                | `get`. A paused sandbox is woken. A running one's end moves later, never earlier. An ended one throws `SandboxNotFoundError`.                                                                                                                               |
+| `sandbox.pause()`, `betaPause`, `Sandbox.pause(id)`                                      | `pause`, keeping memory and files. `false` when it was already paused.                                                                                                                                                                                      |
+| `getInfo`, `isRunning`                                                                   | `get`. `templateId` is `base` or the image or snapshot id. `envdVersion` is `runtime`.                                                                                                                                                                      |
+| `Sandbox.list({ query: { metadata, state }, limit })`                                    | `sandboxes.list` by labels and state, oldest first, with E2B's paginator (`hasNext`, `nextItems()`).                                                                                                                                                        |
+| `fork`, `createSnapshot`, `deleteSnapshot`                                               | Runtime's forks and snapshots. While Runtime has them switched off, they throw `NotSupportedError` with Runtime's own message.                                                                                                                              |
+| `getHost(port)`                                                                          | `<port>-<id>.runtimehost.com` at once, as E2B answers it, and the port is shared as a public Runtime preview beside the caller (the sync Python sandbox shares it before returning). `await sandbox.getPublicHost(port)` returns once the share has landed. |
+| `runCode(code, { language, context, onStdout, onStderr, onResult, onError, timeoutMs })` | Runtime's interpreter, Python and JavaScript. The sandbox's `envs` reach code through a context made once for them. `onResult` is called after the run ends.                                                                                                |
+| `Execution`, `Result`, `Logs`, `ExecutionError`, `OutputMessage`                         | The same shapes. Results that are too large to send inline are fetched and inlined. `logs.stdout` has one entry per line.                                                                                                                                   |
+| `createCodeContext`, `listCodeContexts`, `restartCodeContext`, `removeCodeContext`       | Runtime's interpreter contexts.                                                                                                                                                                                                                             |
+| `getMetrics({ start, end })`, `Sandbox.getMetrics(id)`                                   | Runtime's measured CPU and memory, one entry per host reading (every minute by default). `diskUsed` is null: Runtime does not read disk use inside the sandbox.                                                                                             |
+| Error classes                                                                            | E2B's names and parents. Each also carries Runtime's `code`, `hint` and `requestId`, with the original error as `cause`.                                                                                                                                    |
 
 ## Gaps
 

package/README.md

@@ -1,7 +1,7 @@
 # Runtime Cloud SDK and CLI
 
-One client for every Runtime Cloud product, and the `runtime` CLI. Node.js 22
-or later, or Bun. Its one dependency, undici (Node's own HTTP client), is
+One client for every Runtime Cloud product, and the `runtime` CLI. Node.js
+22.12 or later, or Bun. Its one dependency, undici (Node's own HTTP client), is
 loaded only behind a proxy.
 
 ```bash no-run
@@ -27,7 +27,7 @@ console.log(result.exitCode, result.stdout);
 `Sandbox.create()` needs no arguments and returns once the sandbox is running;
 `await using` stops it when the block ends (Node 24, Bun or TypeScript; on
 Node 22 call `await sbx.stop()`). With no arguments you get the free
-trial while it lasts (50 free hours, up to eight sandboxes running at once), 2 vCPU, 4 GiB of
+trial while it lasts (100 free hours, up to eight sandboxes running at once), 2 vCPU, 4 GiB of
 memory and a 4 GiB disk. The current default image includes NumPy, pandas and
 matplotlib; see the [sandbox environment](https://withruntime.com/docs/sandbox-environment).
 
@@ -110,7 +110,9 @@ package list every mapping and gap.
 ## Agent frameworks
 
 `withruntime/openai-agents` is a sandbox client for the OpenAI Agents SDK's
-`SandboxAgent`. `withruntime/ai` gives Vercel AI SDK and Mastra agents four
+`SandboxAgent`. `withruntime/ai-harness` is a sandbox provider for the Vercel
+AI SDK's `HarnessAgent` (Claude Code, Codex, OpenCode, Pi and the rest).
+`withruntime/ai` gives Vercel AI SDK and Mastra agents four
 sandbox tools, `withruntime/claude-agent-sdk` gives them to the Claude Agent
 SDK as an MCP server, and `withruntime/tools` gives them in no framework's
 format. Each needs its framework installed beside this package. See
@@ -143,4 +145,5 @@ the browser, or send a bearer key.
 Docs: https://withruntime.com/docs/javascript and https://withruntime.com/docs/cli.
 
 The package was called `@withruntime/cloud` until 0.3.0. That name, and
-`runtime-cloud` and `withruntime-cloud`, still install this one.
+`runtime-cloud` and `withruntime-cloud`, stopped at 0.5.1 and get no new
+releases.

package/dist/ai/index.d.ts

@@ -9,21 +9,37 @@
  *   await generateText({ model, tools: runtimeTools(sbx), stopWhen: stepCountIs(10), prompt });
  *
  * Needs the `ai` package (version 5 or newer) beside this one. */
-import { type Tool } from "ai";
+import { type Schema } from "ai";
 import type { Sandbox } from "../sandbox.js";
 import { type ExecInput, type ExecOutput, type ListEntry, type SandboxToolOptions } from "../tools/index.js";
 export type { SandboxToolOptions } from "../tools/index.js";
+/** One tool, typed so that both the AI SDK's `tools` and Mastra's accept it.
+ *
+ * ai 7's own `Tool` type is not assignable to Mastra's `tools` (checked with
+ * @mastra/core 1.71.0): ai 7 lets a description be a function, forbids an `id`
+ * and wants `context` in the call options, and Mastra wants a string
+ * description, an `id` or the older `parameters` field, and passes no
+ * `context`. This shape is the part both agree on. `parameters` is the same
+ * schema object as `inputSchema`: Mastra reads whichever it finds and the AI
+ * SDK reads only `inputSchema`. */
+export type RuntimeTool<I, O> = {
+    type?: undefined;
+    description: string;
+    inputSchema: Schema<I>;
+    parameters: Schema<I>;
+    execute: (input: I, options?: unknown) => Promise<O>;
+};
 /** `{ runtime_exec, runtime_read_file, runtime_write_file, runtime_list_files }`, bound to `sandbox`. */
 export type RuntimeTools = {
-    runtime_exec: Tool<ExecInput, ExecOutput>;
-    runtime_read_file: Tool<{
+    runtime_exec: RuntimeTool<ExecInput, ExecOutput>;
+    runtime_read_file: RuntimeTool<{
         path: string;
     }, string>;
-    runtime_write_file: Tool<{
+    runtime_write_file: RuntimeTool<{
         path: string;
         content: string;
     }, string>;
-    runtime_list_files: Tool<{
+    runtime_list_files: RuntimeTool<{
         path?: string;
         depth?: number;
     }, ListEntry[] | {

package/dist/ai/index.js

@@ -9,30 +9,23 @@
  *   await generateText({ model, tools: runtimeTools(sbx), stopWhen: stepCountIs(10), prompt });
  *
  * Needs the `ai` package (version 5 or newer) beside this one. */
-import { jsonSchema, tool } from "ai";
+import { jsonSchema } from "ai";
 import { sandboxTools, } from "../tools/index.js";
+function aiTool(source) {
+    const schema = jsonSchema(source.inputSchema);
+    return {
+        description: source.description,
+        inputSchema: schema,
+        parameters: schema,
+        execute: (input) => source.execute(input),
+    };
+}
 export function runtimeTools(sandbox, options = {}) {
     const [exec, read, write, list] = sandboxTools(sandbox, options);
     return {
-        runtime_exec: tool({
-            description: exec.description,
-            inputSchema: jsonSchema(exec.inputSchema),
-            execute: (input) => exec.execute(input),
-        }),
-        runtime_read_file: tool({
-            description: read.description,
-            inputSchema: jsonSchema(read.inputSchema),
-            execute: (input) => read.execute(input),
-        }),
-        runtime_write_file: tool({
-            description: write.description,
-            inputSchema: jsonSchema(write.inputSchema),
-            execute: (input) => write.execute(input),
-        }),
-        runtime_list_files: tool({
-            description: list.description,
-            inputSchema: jsonSchema(list.inputSchema),
-            execute: (input) => list.execute(input),
-        }),
+        runtime_exec: aiTool(exec),
+        runtime_read_file: aiTool(read),
+        runtime_write_file: aiTool(write),
+        runtime_list_files: aiTool(list),
     };
 }

package/dist/ai-harness/index.d.ts

@@ -0,0 +1,194 @@
+/** Runtime Cloud sandboxes for the Vercel AI SDK's harnesses (`@ai-sdk/harness`).
+ *
+ * `createRuntimeSandbox()` is a `HarnessV1SandboxProvider`, like
+ * `@ai-sdk/sandbox-vercel`'s `createVercelSandbox()`: a `HarnessAgent` runs its
+ * harness (Claude Code, Codex, OpenCode, Pi, ...) in a Runtime microVM, and
+ * the agent definition does not change:
+ *
+ *   import { HarnessAgent } from "@ai-sdk/harness/agent";
+ *   import { claudeCode } from "@ai-sdk/harness-claude-code";
+ *   import { createRuntimeSandbox } from "withruntime/ai-harness";
+ *
+ *   const agent = new HarnessAgent({
+ *     harness: claudeCode,
+ *     sandbox: createRuntimeSandbox({ ports: [4000], create: { funding: "trial" } }),
+ *   });
+ *
+ * Commands run under `bash -c` as the sandbox user, streamed. Exposed ports
+ * are Runtime previews, private by default: the endpoint carries the preview
+ * token. The key comes from RUNTIME_API_KEY or this machine's `runtime login`.
+ * Needs `@ai-sdk/harness` 1.x beside this package. */
+import { type HarnessV1NetworkPolicy, type HarnessV1NetworkSandboxSession, type HarnessV1PortEndpoint, type HarnessV1SandboxProvider } from "@ai-sdk/harness";
+import { Runtime } from "../client.js";
+import type { NetworkRules } from "../products/network.js";
+import type { Sandbox } from "../sandbox.js";
+import type { CreateSandbox } from "../types.js";
+/** The AI SDK's plain sandbox session (files, `run`, `spawn`), as the harness
+ * package declares it. */
+export type SandboxSession = ReturnType<HarnessV1NetworkSandboxSession["restricted"]>;
+export type SandboxProcess = Awaited<ReturnType<SandboxSession["spawn"]>>;
+type ProcessOptions = Parameters<SandboxSession["run"]>[0];
+/** What `run` and `spawn` take beyond the AI SDK's options. The harness never
+ * passes these; code that holds the session may. */
+export type RuntimeProcessOptions = ProcessOptions & {
+    /** Given to standard input, then closed. `spawn` takes text only. */
+    stdin?: string | Uint8Array;
+    /** The longest the command may run; this session's `commandTimeoutMs` when left out. */
+    timeoutMs?: number;
+};
+export declare const PROVIDER_ID = "runtime-sandbox";
+/** The preview token's header. The edge also takes it as `runtime_preview_token` in the query. */
+export declare const PREVIEW_TOKEN_HEADER = "x-runtime-preview-token";
+export type RuntimeSandboxSettings = {
+    /** The client to use. Default: one from RUNTIME_API_KEY or this machine's `runtime login`. */
+    runtime?: Runtime;
+    /** Wrap a sandbox you created. You own it: the session's `stop()` and
+     * `destroy()` leave it running, and `create` is not used. */
+    sandbox?: Sandbox;
+    /** How to create each session's sandbox: `funding`, `image`, `snapshot`,
+     * `region`, `vcpu`, `memoryMiB`, `timeoutSeconds`, `network`, `labels`, ...
+     * With a harness session id the sandbox is named after it (for
+     * `resumeSession`), and that name wins over `create.name`. */
+    create?: CreateSandbox;
+    /** Set for every command, under the command's own `env`. Runtime's create
+     * takes no environment, so the provider holds it. */
+    env?: Record<string, string>;
+    /** Ports to share as previews. Bridge harnesses (Claude Code, Codex,
+     * OpenCode, Deep Agents) use the first one. */
+    ports?: number[];
+    /** `private` (default): the endpoint carries a preview token. `public`:
+     * anyone with the address; a browser sees a one-time warning page. */
+    previewVisibility?: "private" | "public";
+    /** How long each endpoint's token lasts, 60 s to 7 days. Default: the API's (1 day). */
+    previewTtlSeconds?: number;
+    /** The longest a `run` command may take. Default one hour; 24 hours at most. */
+    commandTimeoutMs?: number;
+    /** `stop()` pauses the sandbox instead of stopping it, so `resumeSession`
+     * wakes the same machine with its files, memory and processes. A paused
+     * sandbox is billed as paused storage until it is woken or stopped.
+     * Default false. `destroy()` always stops. */
+    pauseOnStop?: boolean;
+};
+/** A harness sandbox provider backed by Runtime Cloud. Construct it once, at
+ * module scope; nothing is created until a session is. */
+export declare function createRuntimeSandbox(settings?: RuntimeSandboxSettings): RuntimeSandboxProvider;
+/** The sandbox name a harness session id maps to: `ai-harness-<id>`, or a
+ * digest of the id when it would not make a valid name. */
+export declare function sessionSandboxName(sessionId: string): Promise<string>;
+export declare class RuntimeSandboxProvider implements HarnessV1SandboxProvider {
+    #private;
+    private readonly settings;
+    readonly specificationVersion: "harness-sandbox-v1";
+    readonly providerId = "runtime-sandbox";
+    constructor(settings?: RuntimeSandboxSettings);
+    get runtime(): Runtime;
+    /** A new sandbox (named after `sessionId` when given), or the wrapped one.
+     * `onFirstCreate` runs on a new sandbox before this returns; Runtime keeps
+     * no template for `identity`, so it runs for every new sandbox. */
+    createSession: (options?: {
+        sessionId?: string;
+        abortSignal?: AbortSignal;
+        identity?: string;
+        onFirstCreate?: (session: SandboxSession, opts: {
+            abortSignal?: AbortSignal;
+        }) => Promise<void>;
+    }) => Promise<RuntimeNetworkSandboxSession>;
+    /** The sandbox `createSession` made for `sessionId`, woken if it is paused.
+     * A stopped one cannot be resumed: its memory and disk are gone. */
+    resumeSession: (options: {
+        sessionId: string;
+        abortSignal?: AbortSignal;
+    }) => Promise<RuntimeNetworkSandboxSession>;
+}
+/** Files and processes in one Runtime sandbox: what `restricted()` hands to
+ * tools, with nothing that stops the sandbox or changes its network. */
+export declare class RuntimeSandboxSession implements SandboxSession {
+    #private;
+    readonly sandbox: Sandbox;
+    protected readonly settings: Pick<RuntimeSandboxSettings, "env" | "commandTimeoutMs">;
+    /** Where relative paths and commands without a `workingDirectory` start. */
+    defaultWorkingDirectory: string;
+    constructor(sandbox: Sandbox, settings?: Pick<RuntimeSandboxSettings, "env" | "commandTimeoutMs">);
+    get description(): string;
+    /** Runs `command` under `bash -c` and returns once it exits, with all of
+     * its output. A timeout exits 124, with a note on standard error. */
+    run: (options: RuntimeProcessOptions) => Promise<{
+        exitCode: number;
+        stdout: string;
+        stderr: string;
+    }>;
+    /** Starts `command` and returns at once, with its output as streams. */
+    spawn: (options: RuntimeProcessOptions) => Promise<SandboxProcess>;
+    readBinaryFile: (options: {
+        path: string;
+        abortSignal?: AbortSignal;
+    }) => Promise<Uint8Array | null>;
+    readFile: (options: {
+        path: string;
+        abortSignal?: AbortSignal;
+    }) => Promise<ReadableStream<Uint8Array> | null>;
+    readTextFile: (options: {
+        path: string;
+        encoding?: string;
+        startLine?: number;
+        endLine?: number;
+        abortSignal?: AbortSignal;
+    }) => Promise<string | null>;
+    /** Writes atomically, making parent directories. Past 1 MiB a file must be under /workspace. */
+    writeBinaryFile: (options: {
+        path: string;
+        content: Uint8Array;
+        abortSignal?: AbortSignal;
+    }) => Promise<void>;
+    writeFile: (options: {
+        path: string;
+        content: ReadableStream<Uint8Array>;
+        abortSignal?: AbortSignal;
+    }) => Promise<void>;
+    writeTextFile: (options: {
+        path: string;
+        content: string;
+        encoding?: string;
+        abortSignal?: AbortSignal;
+    }) => Promise<void>;
+}
+/** The session a harness keeps: files and processes, plus ports as previews,
+ * network rules, and stopping. */
+export declare class RuntimeNetworkSandboxSession extends RuntimeSandboxSession implements HarnessV1NetworkSandboxSession {
+    #private;
+    protected readonly settings: RuntimeSandboxSettings;
+    readonly ownsLifecycle: boolean;
+    constructor(sandbox: Sandbox, settings: RuntimeSandboxSettings, ownsLifecycle: boolean);
+    /** The sandbox's id: `resumeSession` finds it again by the name it was given. */
+    get id(): string;
+    get ports(): ReadonlyArray<number>;
+    get description(): string;
+    restricted: () => SandboxSession;
+    /** Where to reach `port`. A private preview's token is in the URL's query and
+     * in `headers`. For `ws` the URL has no token: the preview edge answers a GET
+     * whose query carries one with a redirect that sets a cookie, which a
+     * WebSocket client does not follow, so the header carries it. */
+    getPortEndpoint: (options: {
+        port: number;
+        protocol?: "http" | "https" | "ws";
+    }) => Promise<HarnessV1PortEndpoint>;
+    /** @deprecated As the AI SDK's: use `getPortEndpoint`. The URL carries the token in its query. */
+    getPortUrl: (options: {
+        port: number;
+        protocol?: "http" | "https" | "ws";
+    }) => Promise<string>;
+    /** Shares exactly `ports`: new ones become previews, dropped ones stop being shared. */
+    setPorts: (ports: ReadonlyArray<number>, options?: {
+        abortSignal?: AbortSignal;
+    }) => Promise<void>;
+    /** Outbound rules: `allow-all` is the public web, `deny-all` nothing, and
+     * `custom` only the listed hosts and ranges, with `deniedCIDRs` refused. */
+    setNetworkPolicy: (policy: HarnessV1NetworkPolicy) => Promise<void>;
+    /** Stops the sandbox (or pauses it, with `pauseOnStop`). A wrapped sandbox is left alone. */
+    stop: () => Promise<void>;
+    /** Stops the sandbox, whatever `pauseOnStop` says: its files and memory are gone. */
+    destroy: () => Promise<void>;
+}
+/** The harness's network policy as a Runtime sandbox's network rules. */
+export declare function networkRules(policy: HarnessV1NetworkPolicy): NetworkRules;
+export {};