withruntime 0.6.1 → 0.7.1

package/dist/products/billing.d.ts

@@ -0,0 +1,35 @@
+import type { RequestOptions, Transport } from "../transport.js";
+/** Where to pay for a stablecoin top-up, and whether the payment arrived. */
+export type Topup = {
+    /** Poll this until `status` is `paid`. */
+    purchaseId: string;
+    /** open: waiting for your payment. pending: Stripe saw it and is confirming.
+     *  paid: the credit is on the account. expired: nothing arrived in time. */
+    status: "open" | "pending" | "paid" | "failed" | "expired";
+    /** The credit this buys, in dollars, such as "20.00". */
+    amountUsd: string;
+    /** The exact token amount to send, to six decimals, such as "20.000000".
+     *  A different amount, token or network cannot be matched or returned
+     *  automatically. */
+    amount: string;
+    /** Send before this. */
+    payBy: string | null;
+    /** Pay on any one of these, with one of its tokens. */
+    networks: {
+        network: string;
+        address: string;
+        tokens: {
+            currency: string;
+            contract: string;
+        }[];
+    }[];
+};
+export declare function billing(t: Transport): {
+    /** Open a stablecoin top-up of `usd` dollars ($10 to $10,000). Pass the
+     *  same `idempotencyKey` when retrying to get the same top-up back. */
+    topup: (input: {
+        usd: number;
+    }, options?: RequestOptions) => Promise<Topup>;
+    /** Read a top-up: whether its payment has arrived. */
+    topupStatus: (purchaseId: string, options?: RequestOptions) => Promise<Topup>;
+};

package/dist/products/billing.js

@@ -0,0 +1,13 @@
+export function billing(t) {
+    return {
+        /** Open a stablecoin top-up of `usd` dollars ($10 to $10,000). Pass the
+         *  same `idempotencyKey` when retrying to get the same top-up back. */
+        topup: (input, options) => t.json({ method: "POST", path: "/v1/billing/topups", body: input, ...options }),
+        /** Read a top-up: whether its payment has arrived. */
+        topupStatus: (purchaseId, options) => t.json({
+            method: "GET",
+            path: `/v1/billing/topups/${encodeURIComponent(purchaseId)}`,
+            ...options,
+        }),
+    };
+}

package/dist/products/index.d.ts

@@ -4,9 +4,10 @@ import { images } from "./images.js";
 import { sandboxDesktop } from "./desktop.js";
 import { sandboxInterpreter } from "./interpreter.js";
 import { sandboxNetwork } from "./network.js";
-import { addresses, domains, ports, tunnel } from "./network-products.js";
+import { addresses, domains, network, ports, tunnel } from "./network-products.js";
 import { sandboxPreviews } from "./previews.js";
 import { referrals } from "./referrals.js";
+import { billing } from "./billing.js";
 import { audit } from "./audit.js";
 import { sso } from "./sso.js";
 import { switching } from "./switching.js";
@@ -20,6 +21,7 @@ export declare const clientExtensions: {
     images: typeof images;
     volumes: typeof volumes;
     referrals: typeof referrals;
+    billing: typeof billing;
     limits: typeof limits;
     switching: typeof switching;
     secrets: typeof secrets;
@@ -33,6 +35,7 @@ export declare const clientExtensions: {
     ports: typeof ports;
     addresses: typeof addresses;
     tunnel: typeof tunnel;
+    network: typeof network;
 };
 export declare const sandboxExtensions: {
     interpreter: typeof sandboxInterpreter;

package/dist/products/index.js

@@ -2,9 +2,10 @@ import { images } from "./images.js";
 import { sandboxDesktop } from "./desktop.js";
 import { sandboxInterpreter } from "./interpreter.js";
 import { sandboxNetwork } from "./network.js";
-import { addresses, domains, ports, tunnel } from "./network-products.js";
+import { addresses, domains, network, ports, tunnel } from "./network-products.js";
 import { sandboxPreviews } from "./previews.js";
 import { referrals } from "./referrals.js";
+import { billing } from "./billing.js";
 import { audit } from "./audit.js";
 import { sso } from "./sso.js";
 import { switching } from "./switching.js";
@@ -33,6 +34,7 @@ export const clientExtensions = {
     images,
     volumes,
     referrals,
+    billing,
     limits,
     switching,
     secrets,
@@ -46,6 +48,7 @@ export const clientExtensions = {
     ports,
     addresses,
     tunnel,
+    network,
 };
 export const sandboxExtensions = {
     interpreter: sandboxInterpreter,

package/dist/products/network-products.d.ts

@@ -165,3 +165,48 @@ export declare function tunnel(t: Transport): {
     }, options?: RequestOptions) => Promise<TunnelPeerCreated>;
     removePeer: (peerId: string, options?: RequestOptions) => Promise<Tunnel>;
 };
+/** The proxy your sandboxes' outbound connections go through. */
+export type UpstreamProxy = {
+    /** http://host:port or https://host:port. */
+    url: string;
+    /** The secret sent as Proxy-Authorization. */
+    secret?: string;
+    /** The destinations that go through it; every destination when absent. */
+    hosts?: string[];
+    updatedAt: string;
+};
+export type SetUpstreamProxy = {
+    /** http://host:port or https://host:port. An https proxy's certificate must
+     * verify against the public roots. */
+    url: string;
+    /** One of your secrets, sent as the Proxy-Authorization header's whole
+     * value (such as `Basic dXNlcjpwYXNz`). Its hosts must name the proxy's host. */
+    secret?: string;
+    /** Only connections to these hosts (or `*.domain`) go through the proxy;
+     * every connection when absent. 1 to 16. */
+    hosts?: string[];
+};
+/** `runtime.network`: the network settings of the whole account.
+ *
+ *   await runtime.network.upstreamProxy.set({ url: "http://proxy.example.com:3128" });
+ *
+ * `upstreamProxy`: after Runtime's own rules allow a connection, the host
+ * reaches it with CONNECT through your proxy, so your proxy's controls and
+ * logs apply. A proxy that refuses or cannot be reached fails the connection
+ * (upstream-proxy-failed); nothing goes around it. Paid accounts only. */
+export declare function network(t: Transport): {
+    upstreamProxy: {
+        /** Send outbound connections through your proxy, replacing any set before. */
+        set: (input: SetUpstreamProxy, options?: RequestOptions) => Promise<UpstreamProxy & {
+            enforced: boolean;
+        }>;
+        /** The proxy in use. Throws `not_found` (404) when none is set. */
+        get: (options?: RequestOptions) => Promise<UpstreamProxy>;
+        /** Connections leave directly again, within seconds. Throws `not_found`
+         * (404) when none is set. */
+        remove: (options?: RequestOptions) => Promise<{
+            deleted: true;
+            enforced: boolean;
+        }>;
+    };
+};

package/dist/products/network-products.js

@@ -80,3 +80,30 @@ export function tunnel(t) {
         removePeer: (peerId, options) => t.json({ method: "DELETE", path: `/v1/tunnel/peers/${enc(peerId)}`, ...options }),
     };
 }
+/** `runtime.network`: the network settings of the whole account.
+ *
+ *   await runtime.network.upstreamProxy.set({ url: "http://proxy.example.com:3128" });
+ *
+ * `upstreamProxy`: after Runtime's own rules allow a connection, the host
+ * reaches it with CONNECT through your proxy, so your proxy's controls and
+ * logs apply. A proxy that refuses or cannot be reached fails the connection
+ * (upstream-proxy-failed); nothing goes around it. Paid accounts only. */
+export function network(t) {
+    const path = "/v1/network/upstream-proxy";
+    return {
+        upstreamProxy: {
+            /** Send outbound connections through your proxy, replacing any set before. */
+            set: (input, options) => t.json({
+                method: "PUT",
+                path,
+                body: input,
+                ...options,
+            }),
+            /** The proxy in use. Throws `not_found` (404) when none is set. */
+            get: (options) => t.json({ method: "GET", path, ...options }),
+            /** Connections leave directly again, within seconds. Throws `not_found`
+             * (404) when none is set. */
+            remove: (options) => t.json({ method: "DELETE", path, ...options }),
+        },
+    };
+}

package/dist/products/previews.d.ts

@@ -18,8 +18,7 @@ export type Preview = {
     /** Turned off by Runtime after a report. */
     disabled: boolean;
     createdAt: string;
-    /** On create only: how to share the address, and the referral link that
-     * pays you both when someone you share it with signs up. */
+    /** On create only: how to share the address, in one line. */
     hint?: string;
 };
 export type CreatePreview = {

package/dist/products/secrets.d.ts

@@ -1,4 +1,13 @@
 import type { RequestOptions, Transport } from "../transport.js";
+/** Which requests to a secret's hosts carry it: `methods` (every method when
+ * absent) and `paths`, each exact (`/v1/chat/completions`) or a prefix ending
+ * in `/*` (`/repos/acme/*`), written canonically: starting with `/`, no `.` or
+ * `..` segments, no `;` or `\`, no encoded slash. A request whose path could be
+ * read two ways gets no secret that has rules. Paid accounts only. */
+export type SecretRule = {
+    methods?: string[];
+    paths: string[];
+};
 /** A secret your sandboxes use without seeing it. Every sandbox of your
  * organization has an environment variable of the secret's name holding
  * `placeholder`; the egress proxy puts the value into HTTPS requests to
@@ -9,6 +18,7 @@ export type Secret = {
     hosts: string[];
     header?: string;
     format?: string;
+    rules?: SecretRule[];
     placeholder: string;
     valueBytes: number;
     createdAt: string;
@@ -23,6 +33,10 @@ export type SetSecret = {
     header?: string;
     /** With `header`: its value, `{value}` where the secret goes. Default `{value}`. */
     format?: string;
+    /** Only requests a rule allows carry the value. Paid accounts only. 1 to 16.
+     * Absent: every request to the hosts; replacing a secret without rules
+     * clears them. */
+    rules?: SecretRule[];
 };
 export declare function secrets(t: Transport): {
     /** Store or replace a secret. Replacing keeps its placeholder. */

package/dist/sandbox.d.ts

@@ -30,7 +30,9 @@ export declare class Sandbox implements AsyncDisposable {
      * far), never an error; `check: true` throws CommandError on a non-zero exit. */
     exec(command: string | readonly string[], options?: ExecOptions): Promise<CommandResult>;
     /** The command's events as they happen: start, stdout, stderr, exit. Resumes
-     * by itself when the server ends a long stream, so it never drops output. */
+     * by itself when the server ends a long stream or the connection drops after
+     * the command started, and yields `truncated` for any output it did not
+     * receive, so lost output never passes as whole. */
     execStream(command: string | readonly string[], options?: ExecOptions): AsyncGenerator<OutputEvent>;
     /** Starts a background process (a server, a watcher, a REPL) and returns at
      * once. `stdin: "pipe"` keeps its input open for write(); `pty` gives it a
@@ -202,8 +204,19 @@ export declare class Files {
             stopped: boolean;
         }>;
     };
-    /** A file's bytes, any size. */
+    /** A file's bytes, any size, checked against the length (and for a small
+     * file the SHA-256) the API sends first: a read that arrives short is read
+     * again, then throws `download_incomplete`, never returns short. For a file
+     * too big to hold in memory use `readStream` or `download`. */
     read(path: string, options?: RequestOptions): Promise<Uint8Array>;
+    /** A file's bytes as they arrive, for files of any size without holding
+     * them in memory (Daytona's `downloadFileStream`). The stream errors with
+     * `download_incomplete` if it ends short of the file's length.
+     *
+     *   const stream = await sbx.files.readStream("/workspace/big.tar");
+     *   await stream.pipeTo(Writable.toWeb(fs.createWriteStream("big.tar")));
+     */
+    readStream(path: string, options?: RequestOptions): Promise<ReadableStream<Uint8Array>>;
     readText(path: string, options?: RequestOptions): Promise<string>;
     /** Writes a file of any size, atomically, making parent directories. Large
      * ones go in parallel 1 MiB chunks checked against their SHA-256. `mode`
@@ -241,7 +254,8 @@ export declare class Files {
     /** Copies a local file or directory into the sandbox. A directory travels as
      * one gzipped tar and is unpacked in place. */
     upload(localPath: string, remotePath: string): Promise<void>;
-    /** Copies a file or directory out of the sandbox. */
+    /** Copies a file or directory out of the sandbox. A file streams to disk,
+     * any size, checked against its length. */
     download(remotePath: string, localPath: string): Promise<void>;
 }
 export declare function sandboxPage(t: Transport, body: {

package/dist/sandbox.js

@@ -1,4 +1,4 @@
-import { CommandError, RuntimeError } from "./errors.js";
+import { CommandError, ConnectionError, NotFoundError, RuntimeError } from "./errors.js";
 import { Page } from "./page.js";
 import { sandboxWatches, watchDirectory, } from "./products/watch.js";
 import { sandboxFactories } from "./products/index.js";
@@ -83,17 +83,22 @@ export class Sandbox {
             let exit;
             let processId;
             let dropped = false;
-            for await (const event of this.execStream(command, options)) {
-                if (event.type === "start")
-                    processId = event.processId;
-                else if (event.type === "stdout" || event.type === "stderr") {
-                    out[event.type] += event.data;
-                    (event.type === "stdout" ? options.onStdout : options.onStderr)?.(event.data);
+            try {
+                for await (const event of this.execStream(command, options)) {
+                    if (event.type === "start")
+                        processId = event.processId;
+                    else if (event.type === "stdout" || event.type === "stderr") {
+                        out[event.type] += event.data;
+                        (event.type === "stdout" ? options.onStdout : options.onStderr)?.(event.data);
+                    }
+                    else if (event.type === "truncated")
+                        dropped = true;
+                    else if (event.type === "exit")
+                        exit = event;
                 }
-                else if (event.type === "truncated")
-                    dropped = true;
-                else if (event.type === "exit")
-                    exit = event;
+            }
+            catch (error) {
+                throw await this.#unfinished(error, processId, options.signal);
             }
             result = {
                 exitCode: exit?.exitCode ?? null,
@@ -108,11 +113,49 @@ export class Sandbox {
             throw new CommandError(result);
         return result;
     }
+    /** An exec that ended before its command did. Cancelled through `signal`,
+     * its command is sent SIGTERM, as Ctrl-C would stop it at a terminal; cut
+     * off, it is left running. Either way the error names the process, so the
+     * caller can read or stop what is still there. */
+    async #unfinished(error, processId, signal) {
+        if (!processId)
+            return error;
+        const id = `${this.id} ${processId}`;
+        if (signal?.aborted) {
+            const stopped = await new Process(this.#t, this.id, { id: processId })
+                .kill("SIGTERM")
+                .then(() => true, () => false);
+            return new RuntimeError({
+                message: stopped
+                    ? `Cancelled; process ${processId} was sent SIGTERM.`
+                    : `Cancelled, but process ${processId} may still be running: stopping it failed.`,
+                code: "cancelled",
+                status: 0,
+                hint: stopped
+                    ? `See what it printed: runtime sandbox logs ${id}`
+                    : `Stop it: runtime sandbox kill ${id}, or sandbox.processes.get("${processId}") and kill().`,
+                details: { sandboxId: this.id, processId, stopped },
+                cause: error,
+            });
+        }
+        if (error instanceof RuntimeError && !(error instanceof ConnectionError))
+            return error;
+        return new ConnectionError({
+            message: `Lost the output of process ${processId}; the command may still be running.`,
+            code: "connection_error",
+            status: 0,
+            hint: `Follow it: runtime sandbox logs ${id} -f (sandbox.processes.get("${processId}")), or stop it: runtime sandbox kill ${id}.`,
+            details: { sandboxId: this.id, processId },
+            cause: error,
+        });
+    }
     /** The command's events as they happen: start, stdout, stderr, exit. Resumes
-     * by itself when the server ends a long stream, so it never drops output. */
+     * by itself when the server ends a long stream or the connection drops after
+     * the command started, and yields `truncated` for any output it did not
+     * receive, so lost output never passes as whole. */
     async *execStream(command, options = {}) {
         let processId;
-        let cursor = 0;
+        const read = new OutputCursor();
         const events = this.#t.events({
             method: "POST",
             path: `/v1/sandboxes/${enc(this.id)}:exec`,
@@ -120,26 +163,36 @@ export class Sandbox {
             ...pick(options),
             timeoutMs: options.timeoutMs === undefined ? 86_400_000 : options.timeoutMs + 60_000,
         });
-        for await (const event of events) {
-            if (event.type === "start")
-                processId = event.processId;
-            if (event.type === "stdout" || event.type === "stderr")
-                cursor = event.offset + Buffer.byteLength(event.data);
-            if (event.type === "continue") {
-                cursor = event.cursor;
-                yield* this.processes.follow(event.processId, { cursor, signal: options.signal });
-                return;
+        try {
+            for await (const event of events) {
+                if (event.type === "start")
+                    processId = event.processId;
+                if (event.type === "continue") {
+                    yield* this.processes.follow(event.processId, {
+                        cursor: event.cursor,
+                        signal: options.signal,
+                    });
+                    return;
+                }
+                yield* read.pass(event);
+                if (event.type === "exit")
+                    return;
             }
-            if (event.type === "error")
-                throw new RuntimeError({
-                    message: event.error.message,
-                    code: event.error.code,
-                    status: 0,
-                    ...(event.error.requestId ? { requestId: event.error.requestId } : {}),
-                });
-            yield event;
         }
-        void processId;
+        catch (error) {
+            if (options.signal?.aborted || !processId || !cutOff(error))
+                throw error;
+        }
+        // The connection closed after the command started: its output is kept on
+        // the sandbox, so follow it from where this stream stopped.
+        if (!processId)
+            throw new ConnectionError({
+                message: "The exec stream closed before the command started.",
+                code: "connection_error",
+                status: 0,
+                hint: "Run it again; to be sure it runs once, pass the same idempotencyKey.",
+            });
+        yield* this.processes.follow(processId, { cursor: read.cursor, signal: options.signal });
     }
     /** Starts a background process (a server, a watcher, a REPL) and returns at
      * once. `stdin: "pipe"` keeps its input open for write(); `pty` gives it a
@@ -207,7 +260,19 @@ export class Sandbox {
     /** Carries on a paused sandbox; `timeoutSeconds` is its new lease. */
     async wake(options = {}) {
         const { timeoutSeconds, ...rest } = options;
-        return this.#lifecycle("wake", rest, timeoutSeconds === undefined ? {} : { timeoutSeconds });
+        try {
+            return await this.#lifecycle("wake", rest, timeoutSeconds === undefined ? {} : { timeoutSeconds });
+        }
+        catch (error) {
+            // Waking one that is already awake is done, not a mistake. With a new
+            // lease asked for, the refusal stands: it was not given.
+            if (!(error instanceof RuntimeError) || error.code !== "not_paused" || timeoutSeconds)
+                throw error;
+            await this.refresh(pick(rest));
+            if (this.state !== "running" && this.state !== "starting")
+                throw error;
+            return this;
+        }
     }
     /** More time before the lease ends (at most an hour ahead of now). */
     async extend(seconds, options = {}) {
@@ -343,6 +408,42 @@ export class Sandbox {
         return this.#info;
     }
 }
+/** Where a reader of a process's output is, in bytes of stdout and stderr
+ * together. Output it did not receive, named by the server or not, becomes a
+ * `truncated` event: the next chunk starting past the cursor means the bytes
+ * between were lost. A server error event becomes a thrown error. */
+class OutputCursor {
+    cursor;
+    constructor(cursor = 0) {
+        this.cursor = cursor;
+    }
+    *pass(event) {
+        if (event.type === "error")
+            throw new RuntimeError({
+                message: event.error.message,
+                code: event.error.code,
+                status: 0,
+                ...(event.error.requestId ? { requestId: event.error.requestId } : {}),
+            });
+        if (event.type === "truncated")
+            this.cursor = Math.max(this.cursor, event.resumeAt);
+        if (event.type === "stdout" || event.type === "stderr") {
+            if (event.offset > this.cursor)
+                yield {
+                    type: "truncated",
+                    droppedBytes: event.offset - this.cursor,
+                    resumeAt: event.offset,
+                };
+            this.cursor = Math.max(this.cursor, event.offset + Buffer.byteLength(event.data));
+        }
+        yield event;
+    }
+}
+/** A stream cut off by the network rather than refused by Runtime: worth
+ * reconnecting to from the cursor. */
+function cutOff(error) {
+    return !(error instanceof RuntimeError) || error instanceof ConnectionError;
+}
 /** A streamed command keeps all its output unless the reader fell more than the
  * process's output buffer behind, which the server marks with a "truncated"
  * event. That event does not say which stream lost bytes, so both flags carry
@@ -379,35 +480,44 @@ export class Processes {
     }
     /** Output events from `cursor` until the process exits, across stream slices. */
     async *follow(processId, options = {}) {
-        let cursor = options.cursor ?? 0;
+        const read = new OutputCursor(options.cursor ?? 0);
+        // Reconnections in a row that brought nothing: a stream that keeps
+        // closing without output or an exit is given up, not followed forever.
+        let idle = 0;
         for (;;) {
+            const before = read.cursor;
             let resumed = false;
-            for await (const event of this.t.events({
-                method: "GET",
-                path: `/v1/sandboxes/${enc(this.sandboxId)}/processes/${enc(processId)}/output`,
-                query: { cursor, follow: true },
-                timeoutMs: 180_000,
-                ...(options.signal ? { signal: options.signal } : {}),
-            })) {
-                if (event.type === "continue") {
-                    cursor = event.cursor;
-                    resumed = true;
-                    break;
+            try {
+                for await (const event of this.t.events({
+                    method: "GET",
+                    path: `/v1/sandboxes/${enc(this.sandboxId)}/processes/${enc(processId)}/output`,
+                    query: { cursor: read.cursor, follow: true },
+                    timeoutMs: 180_000,
+                    ...(options.signal ? { signal: options.signal } : {}),
+                })) {
+                    if (event.type === "continue") {
+                        read.cursor = Math.max(read.cursor, event.cursor);
+                        resumed = true;
+                        break;
+                    }
+                    yield* read.pass(event);
+                    if (event.type === "exit")
+                        return;
                 }
-                if (event.type === "stdout" || event.type === "stderr")
-                    cursor = event.offset + Buffer.byteLength(event.data);
-                if (event.type === "error")
-                    throw new RuntimeError({
-                        message: event.error.message,
-                        code: event.error.code,
-                        status: 0,
-                    });
-                yield event;
-                if (event.type === "exit")
-                    return;
             }
-            if (!resumed)
-                return;
+            catch (error) {
+                if (options.signal?.aborted || !cutOff(error))
+                    throw error;
+            }
+            idle = resumed || read.cursor > before ? 0 : idle + 1;
+            if (idle > 3)
+                throw new ConnectionError({
+                    message: `The output stream of process ${processId} keeps closing before it ends.`,
+                    code: "connection_error",
+                    status: 0,
+                    hint: `Read what it printed so far: runtime sandbox logs ${this.sandboxId} ${processId}`,
+                    details: { sandboxId: this.sandboxId, processId },
+                });
         }
     }
 }
@@ -576,9 +686,28 @@ export class Files {
     get watches() {
         return sandboxWatches(this.t, this.sandboxId);
     }
-    /** A file's bytes, any size. */
+    /** A file's bytes, any size, checked against the length (and for a small
+     * file the SHA-256) the API sends first: a read that arrives short is read
+     * again, then throws `download_incomplete`, never returns short. For a file
+     * too big to hold in memory use `readStream` or `download`. */
     async read(path, options = {}) {
-        return this.t.bytes({
+        return this.t.fileBytes({
+            method: "GET",
+            path: this.#path("/files/content"),
+            query: { path },
+            accept: "application/octet-stream",
+            ...options,
+        });
+    }
+    /** A file's bytes as they arrive, for files of any size without holding
+     * them in memory (Daytona's `downloadFileStream`). The stream errors with
+     * `download_incomplete` if it ends short of the file's length.
+     *
+     *   const stream = await sbx.files.readStream("/workspace/big.tar");
+     *   await stream.pipeTo(Writable.toWeb(fs.createWriteStream("big.tar")));
+     */
+    async readStream(path, options = {}) {
+        return this.t.fileStream({
             method: "GET",
             path: this.#path("/files/content"),
             query: { path },
@@ -746,7 +875,16 @@ export class Files {
         const info = await stat(localPath);
         if (info.isFile()) {
             // Its permissions travel with it: an uploaded script stays runnable.
-            await this.write(remotePath, await readFile(localPath), { mode: info.mode & 0o777 });
+            const data = await readFile(localPath);
+            const mode = info.mode & 0o777;
+            await this.write(remotePath, data, { mode }).catch(async (error) => {
+                // A missing parent is made, as a directory upload makes its own.
+                const parent = remotePath.slice(0, remotePath.lastIndexOf("/"));
+                if (!(error instanceof NotFoundError) || !parent)
+                    throw error;
+                await this.mkdir(parent, { parents: true });
+                await this.write(remotePath, data, { mode });
+            });
             return;
         }
         const { packDirectory } = await import("./tar.js");
@@ -766,7 +904,40 @@ export class Files {
         if (result.exitCode !== 0)
             throw new CommandError(result);
     }
-    /** Copies a file or directory out of the sandbox. */
+    /** Streams a file to disk through a partial file beside the target, renamed
+     * into place only once every byte has arrived: a failed copy never leaves
+     * a short file under the name asked for. A short stream is tried again,
+     * twice, as a short `read` is. */
+    async #streamTo(remotePath, localPath) {
+        const fs = await import("node:fs/promises");
+        const partial = `${localPath}.runtime-partial-${crypto.randomUUID().slice(0, 8)}`;
+        for (let attempt = 0;; attempt++) {
+            try {
+                const stream = await this.readStream(remotePath);
+                // The handle is closed before anything else touches the file, so a
+                // failed copy's partial file is really gone when the error returns.
+                const file = await fs.open(partial, "w");
+                try {
+                    for await (const chunk of stream)
+                        await file.write(chunk);
+                }
+                finally {
+                    await file.close();
+                }
+                await fs.rename(partial, localPath);
+                return;
+            }
+            catch (error) {
+                await fs.rm(partial, { force: true });
+                if (attempt >= 2 ||
+                    !(error instanceof RuntimeError) ||
+                    error.code !== "download_incomplete")
+                    throw error;
+            }
+        }
+    }
+    /** Copies a file or directory out of the sandbox. A file streams to disk,
+     * any size, checked against its length. */
     async download(remotePath, localPath) {
         const fs = await import("node:fs/promises");
         const paths = await import("node:path");
@@ -779,7 +950,7 @@ export class Files {
             });
         if (entry.type !== "directory") {
             await fs.mkdir(paths.dirname(localPath), { recursive: true });
-            await fs.writeFile(localPath, await this.read(remotePath));
+            await this.#streamTo(remotePath, localPath);
             return;
         }
         const staging = `/tmp/.runtime-download-${crypto.randomUUID()}.tar.gz`;