withruntime 0.7.0 → 0.7.2

package/E2B.md

@@ -58,7 +58,7 @@ machine. An E2B key (`e2b_...`) is never sent anywhere. If one is passed as
 | `envs`                                                                                   | Given to every command and code run through this object.                                                                                                                                                                                                    |
 | `allowInternetAccess: false`                                                             | `network: { internet: false }`.                                                                                                                                                                                                                             |
 | `lifecycle.onTimeout`                                                                    | `onLeaseEnd`: `kill` is `stop`, `pause` is `pause`.                                                                                                                                                                                                         |
-| `commands.run(cmd, { cwd, envs, timeoutMs, onStdout, onStderr })`                        | `exec`, streamed, so the whole output comes back however large. Default timeout 60 s. `0` means no limit (Runtime's longest, 24 hours).                                                                                                                     |
+| `commands.run(cmd, { cwd, envs, timeoutMs, onStdout, onStderr })`                        | `exec`, streamed, so the whole output comes back however large; output lost before it was read sets `truncated` and warns. Default timeout 60 s. `0` means no limit (Runtime's longest, 24 hours).                                                          |
 | Non-zero exit                                                                            | Throws `CommandExitError` with `exitCode`, `stdout`, `stderr` and `error` (`exit status N`). A command killed by a signal has `exitCode` -1.                                                                                                                |
 | Command past its timeout                                                                 | Throws `TimeoutError`.                                                                                                                                                                                                                                      |
 | `commands.run(cmd, { background: true })`                                                | `spawn`. Returns a `CommandHandle` with `pid`, `wait()`, `kill()` (SIGKILL), `sendStdin`, `closeStdin`, `disconnect`, `stdout`, `stderr`, `exitCode`.                                                                                                       |

package/dist/ai-harness/index.js

@@ -467,6 +467,11 @@ export function networkRules(policy) {
     if (policy.mode === "deny-all")
         return { internet: false };
     const allow = [...(policy.allowedHosts ?? []), ...(policy.allowedCIDRs ?? [])];
+    // `custom` is an allow list; one that allows nothing is `deny-all` in the
+    // harness's own terms. Runtime reads an empty allow as no allow list at all,
+    // which would open the whole internet.
+    if (!allow.length)
+        return { internet: false };
     const deny = [...(policy.deniedCIDRs ?? [])];
     return { internet: true, allow, ...(deny.length ? { deny } : {}) };
 }

package/dist/cli.js

@@ -140,7 +140,7 @@ const SANDBOX_HELP = `runtime sandbox <command>
                              [--option SERVER.NAME=value]... [--port 8765] [--replace]
                                               Start them; prints each URL and the header to send
   mcp <id> [status] | mcp <id> stop           Their state and fresh URLs; stop them
-  preview <id> <port> [--public] [--ttl <s>]  Share a port at an HTTPS address
+  preview <id> <port> [--public] [--ttl <s>]  Share a port at an HTTPS address (--public: paid only)
   preview rotate <id> <port>                  Refuse every token given out for a private port so
                                               far; prints the new token
   previews <id>                               Every shared port
@@ -494,7 +494,10 @@ function remote(spec) {
     return match ? { id: match[1], path: match[2] } : undefined;
 }
 export async function run(argv, env = process.env, out = defaultOut(argv)) {
-    const [first, ...remaining] = argv.filter((arg) => arg !== "--json" || (argv.indexOf("--") !== -1 && argv.indexOf(arg) > argv.indexOf("--")));
+    // Only what comes before -- is the CLI's: a --json after it is the
+    // command's, whether or not the CLI was given its own.
+    const dash = argv.indexOf("--");
+    const [first, ...remaining] = argv.filter((arg, index) => arg !== "--json" || (dash !== -1 && index > dash));
     // Sandbox is one product of several, so its commands live under it
     // (AGENTS.md, 23 September 2026): `runtime sandbox run`, `sandbox ssh` and
     // `sandbox port-forward`. The old top-level forms were removed, not aliased.
@@ -598,11 +601,17 @@ export async function run(argv, env = process.env, out = defaultOut(argv)) {
     if (command === "login" || command === "logout") {
         const { authenticationCommand } = await import("./login.js");
         const result = await authenticationCommand([command, ...rest], env);
+        // Which account it connected to, so a person with several can tell. The
+        // connection stands whether or not this read answers.
+        const who = command === "login" && "connected" in result && result.connected
+            ? await (await client(env)).me().catch(() => undefined)
+            : undefined;
+        const account = who ? (who.orgName ? `${who.orgName} (${who.orgId})` : who.orgId) : undefined;
         print(result.pending
             ? `Not connected yet. When it is approved, run any command, or \`${me} login --wait\`; it uses this link.`
             : command === "login"
-                ? `Connected${"agentName" in result && result.agentName ? ` as ${String(result.agentName)}` : ""}.`
-                : "Disconnected.", result);
+                ? `Connected${"agentName" in result && result.agentName ? ` as ${String(result.agentName)}` : ""}${account ? ` to ${account}` : ""}.`
+                : "Disconnected.", who ? { ...result, orgId: who.orgId, orgName: who.orgName ?? null } : result);
         return 0;
     }
     if (command === "whoami") {
@@ -974,6 +983,14 @@ function usageSummary(u) {
             "free trial",
             `${hours(u.trial.availableMs)} of ${hours(u.trial.totalMs)} hours left${u.trial.reservedMs > 0 ? `, ${hours(u.trial.reservedMs)} held by running sandboxes` : ""}`,
         ]);
+    if (u.outbound) {
+        const gib = (bytes) => `${(bytes / 1_073_741_824).toLocaleString("en-US", { maximumFractionDigits: 1 })} GiB`;
+        const left = Math.max(0, u.outbound.allowanceBytes - u.outbound.freeBytes);
+        rows.push([
+            "outbound traffic this month",
+            `${gib(u.outbound.sentBytes)} sent, ${gib(left)} of ${gib(u.outbound.allowanceBytes)} free left, ${dollars(micros(u.outbound.chargedMicros))} charged`,
+        ]);
+    }
     const kinds = new Map();
     for (const resource of u.resources ?? []) {
         const kind = typeof resource.kind === "string" ? resource.kind : "other";
@@ -1038,13 +1055,14 @@ async function outputSoFar(runtime, sandboxId, processId) {
         chunks,
     };
 }
-/** Dollars from integer microdollars: cents from a dollar up, and four
- * places below one, so a few minutes of use does not round to $0.01. */
+/** Dollars from integer microdollars: cents from a dollar up, four places
+ * below one, and every place below a hundredth of a cent, so a short trial
+ * test never reads as $0.0000. */
 function dollars(micros) {
     const value = BigInt(micros);
     const sign = value < 0n ? "-" : "";
     const size = value < 0n ? -value : value;
-    const places = size < 1000000n ? 4 : 2;
+    const places = size >= 1000000n ? 2 : size >= 100n || size === 0n ? 4 : 6;
     const unit = 10n ** BigInt(6 - places);
     const rounded = (size + unit / 2n) / unit;
     const whole = rounded / 10n ** BigInt(places);
@@ -1106,11 +1124,28 @@ function switchingLine(summary, provider) {
                 : `${recorded}; its first top-up was not matched. Ask support if you think that is wrong.${once}`;
     }
 }
+/** Running time in the largest unit that keeps it above zero: a short
+ * trial test is seconds, not "0 hours". */
+function runningTime(seconds) {
+    const [amount, unit] = seconds < 60
+        ? [seconds, "second"]
+        : seconds < 3600
+            ? [seconds / 60, "minute"]
+            : [seconds / 3600, "hour"];
+    const shown = amount.toLocaleString("en-US", {
+        maximumFractionDigits: unit === "second" ? 1 : 2,
+    });
+    return `${shown} ${unit}${shown === "1" ? "" : "s"}`;
+}
 /** The sandboxes the free trial paid for, said beside what was priced. */
-function trialNote(trial, all) {
+function trialNote(trial, all, trialSeconds) {
     if (!trial)
         return "";
-    const which = trial === all ? (all === 1 ? "It" : "All of them") : `${trial} of them`;
+    const which = trial === all
+        ? all === 1
+            ? "It"
+            : "All of them"
+        : `${trial} of them, ${runningTime(trialSeconds)} of that time,`;
     return ` ${which} ran on the free trial, which charged nothing; Runtime's side prices ${trial === 1 ? "it" : "them"} at the standard rates, what the same work costs on paid credit.`;
 }
 async function switching(command, argv, env, out) {
@@ -1172,13 +1207,13 @@ async function switching(command, argv, env, out) {
     const lines = c.basis === "usage"
         ? [
             `Your last ${c.window.days} days: ${figures}${pace}`,
-            `Priced: ${c.usage.sandboxes.toLocaleString("en-US")} sandbox${c.usage.sandboxes === 1 ? "" : "es"}, ${(c.usage.runSeconds / 3600).toLocaleString("en-US", { maximumFractionDigits: 2 })} hours running.${trialNote(c.usage.trialSandboxes, c.usage.sandboxes)}${c.usage.unpricedSandboxes ? ` ${c.usage.unpricedSandboxes} left out: ${c.rival.name} publishes no price for their size.` : ""}`,
+            `Priced: ${c.usage.sandboxes.toLocaleString("en-US")} sandbox${c.usage.sandboxes === 1 ? "" : "es"}, ${runningTime(c.usage.runSeconds)} running.${trialNote(c.usage.trialSandboxes, c.usage.sandboxes, c.usage.trialRunSeconds)}${c.usage.unpricedSandboxes ? ` ${c.usage.unpricedSandboxes} left out: ${c.rival.name} publishes no price for their size.` : ""}`,
         ]
         : [
             `No settled sandboxes in your last ${c.window.days} days yet, so this prices an example: ${c.usage.sandboxes.toLocaleString("en-US")} runs of ${(c.usage.runSeconds / c.usage.sandboxes).toLocaleString("en-US")} seconds using ${(c.usage.activeCpuSeconds / c.usage.sandboxes).toLocaleString("en-US")} CPU-seconds each.`,
             `The example: ${figures}.`,
         ];
-    lines.push(`${c.rival.name}'s published rates, checked ${longDate(`${c.rival.checked}T12:00:00Z`)}: ${c.rival.rates.join("; ")}. Compute only: storage, network, plan fees and free allowances are left out.`);
+    lines.push(`${c.rival.name}'s published rates, checked ${longDate(`${c.rival.checked}T12:00:00Z`)}: ${c.rival.rates.join("; ")}. Compute only, with the disk where a rival bills it while running: storage at rest, network, plan fees and free allowances are left out.`);
     const line = switchingLine(c.switching, Object.hasOwn(SWITCH_FROM, from) ? SWITCH_FROM[from] : undefined);
     if (line)
         lines.push("", line);
@@ -2636,8 +2671,10 @@ ownInterrupt = true) {
     }
     if (out.json)
         out.write(JSON.stringify(result));
+    // Here the output streamed, whose timeout is 24 hours unless one was given
+    // (Sandbox.exec); `--json` answers the result and prints no such line.
     else if (result.timedOut)
-        out.error(`runtime: timed out after ${timeout ?? 60} s; the command's process group was killed.`);
+        out.error(`runtime: timed out after ${timeout ? `${timeout} s` : "24 h"}; the command's process group was killed.`);
     // Never drop output silently: say so, and do not exit 0.
     const lost = extras.lostOutput(result, sbx.id);
     if (lost && !out.json)

package/dist/e2b/commands.js

@@ -28,7 +28,8 @@ function timedOut(timeoutMs) {
         "Pass a larger 'timeoutMs', or 0 for no limit.");
 }
 /** A Runtime result as E2B's: a command killed by a signal has no exit code on
- * Runtime; E2B reports -1. */
+ * Runtime; E2B reports -1. E2B never loses output, so a result that did says
+ * so in `truncated` rather than passing as whole. */
 function toResult(result) {
     const exitCode = result.exitCode ?? -1;
     return {
@@ -40,12 +41,15 @@ function toResult(result) {
             : {
                 error: result.exitCode === null ? "terminated by a signal" : `exit status ${exitCode}`,
             }),
+        ...(result.truncated ? { truncated: true } : {}),
     };
 }
 function settle(result, timeoutMs) {
     if (result.timedOut)
         throw timedOut(timeoutMs);
     const out = toResult(result);
+    if (out.truncated && typeof process !== "undefined" && process.emitWarning)
+        process.emitWarning("Part of the command's output was dropped before it was read, so stdout and stderr are incomplete (result.truncated). Write large output to a file and read it with sandbox.files.read.", { code: "RUNTIME_E2B_OUTPUT_TRUNCATED" });
     if (out.exitCode !== 0)
         throw new CommandExitError(out);
     return out;
@@ -80,7 +84,7 @@ export class Commands {
             ...(onStderr ? { onStderr: (text) => void onStderr(text) } : {}),
             ...(opts.signal ? { signal: opts.signal } : {}),
         }));
-        return settle(result, timeoutMs);
+        return settle({ ...result, truncated: result.stdoutTruncated === true || result.stderrTruncated === true }, timeoutMs);
     }
     async #start(cmd, opts, timeoutMs) {
         const process = await guard("sandbox", () => this.#ctx.runtime.spawn(cmd, {
@@ -166,6 +170,7 @@ export class CommandHandle {
     #stdout = "";
     #stderr = "";
     #exit;
+    #truncated = false;
     #failure;
     #disconnected = false;
     constructor(process, options) {
@@ -189,6 +194,9 @@ export class CommandHandle {
                     this.#stderr += event.data;
                     await options.onStderr?.(event.data);
                 }
+                else if (event.type === "truncated") {
+                    this.#truncated = true;
+                }
                 else if (event.type === "exit") {
                     this.#exit = { exitCode: event.exitCode, timedOut: event.timedOut };
                 }
@@ -237,6 +245,7 @@ export class CommandHandle {
             stdout: this.#stdout,
             stderr: this.#stderr,
             timedOut: this.#exit.timedOut,
+            truncated: this.#truncated,
         }, this.#timeoutMs);
     }
     /** Stops receiving output; the command keeps running. */

package/dist/e2b/errors.d.ts

@@ -52,6 +52,10 @@ export interface CommandResult {
     error?: string;
     stdout: string;
     stderr: string;
+    /** Runtime's addition, present only when true: some of the command's
+     * output was dropped before it was read, so `stdout` and `stderr` are
+     * missing part of it. A warning says so too. */
+    truncated?: true;
 }
 /** Thrown by `commands.run` and `CommandHandle.wait` when the command exits
  * with a code other than 0. It carries the result, as in E2B. */
@@ -62,6 +66,7 @@ export declare class CommandExitError extends SandboxError implements CommandRes
     get error(): string | undefined;
     get stdout(): string;
     get stderr(): string;
+    get truncated(): true | undefined;
 }
 /** Which object a call was about, to name a 404 the way E2B would. */
 export type Subject = "sandbox" | "file" | "other";

package/dist/e2b/errors.js

@@ -92,6 +92,9 @@ export class CommandExitError extends SandboxError {
     get stderr() {
         return this.#result.stderr;
     }
+    get truncated() {
+        return this.#result.truncated;
+    }
 }
 /** Turns a Runtime SDK error into the E2B error a caller written for E2B
  * expects. Anything that is not a Runtime error passes through unchanged. */

package/dist/login.d.ts

@@ -15,34 +15,11 @@ type LoginOptions = {
  * at the same machine to press Connect agent. */
 export declare const AGENT_WAIT_MS = 50000;
 export declare function authenticationCommand(args: string[], env: NodeJS.ProcessEnv, options?: LoginOptions): Promise<{
-    connected: boolean;
-    source: string;
-    reason?: undefined;
-    agentName?: undefined;
-    orgId?: undefined;
-    disconnected?: undefined;
-    pending?: undefined;
-    url?: undefined;
-    userCode?: undefined;
-    expiresAt?: undefined;
-} | {
-    connected: boolean;
-    source?: undefined;
-    reason?: undefined;
+    disconnected: boolean;
+    connected?: undefined;
     agentName?: undefined;
     orgId?: undefined;
-    disconnected?: undefined;
-    pending?: undefined;
-    url?: undefined;
-    userCode?: undefined;
-    expiresAt?: undefined;
-} | {
-    connected: boolean;
-    reason: string;
     source?: undefined;
-    agentName?: undefined;
-    orgId?: undefined;
-    disconnected?: undefined;
     pending?: undefined;
     url?: undefined;
     userCode?: undefined;
@@ -51,18 +28,16 @@ export declare function authenticationCommand(args: string[], env: NodeJS.Proces
     connected: boolean;
     agentName: string;
     orgId: string;
-    source?: undefined;
-    reason?: undefined;
+    source: string;
     disconnected?: undefined;
     pending?: undefined;
     url?: undefined;
     userCode?: undefined;
     expiresAt?: undefined;
 } | {
-    disconnected: boolean;
-    connected?: undefined;
-    source?: undefined;
-    reason?: undefined;
+    connected: boolean;
+    source: string;
+    disconnected?: undefined;
     agentName?: undefined;
     orgId?: undefined;
     pending?: undefined;
@@ -73,9 +48,8 @@ export declare function authenticationCommand(args: string[], env: NodeJS.Proces
     connected: boolean;
     agentName: string;
     orgId: string;
-    source: string;
-    reason?: undefined;
     disconnected?: undefined;
+    source?: undefined;
     pending?: undefined;
     url?: undefined;
     userCode?: undefined;
@@ -86,11 +60,10 @@ export declare function authenticationCommand(args: string[], env: NodeJS.Proces
     url: string;
     userCode: string;
     expiresAt: string;
-    source?: undefined;
-    reason?: undefined;
+    disconnected?: undefined;
     agentName?: undefined;
     orgId?: undefined;
-    disconnected?: undefined;
+    source?: undefined;
 }>;
 export type PendingLogin = {
     /** Open this in a browser, where the account owner approves the agent. */

package/dist/login.js

@@ -109,28 +109,6 @@ export async function authenticationCommand(args, env, options = {}) {
     const notify = options.notify ?? ((message) => process.stderr.write(`${message}\n`));
     const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const [command, ...rest] = args;
-    if (command === "auth" && rest.length === 1 && rest[0] === "status") {
-        if (env.RUNTIME_API_KEY) {
-            await new Runtime({
-                apiKey: env.RUNTIME_API_KEY,
-                baseUrl: origins.api,
-                fetch: fetcher,
-            }).usage();
-            return { connected: true, source: "environment" };
-        }
-        const saved = await store.read();
-        if (!saved)
-            return { connected: false };
-        try {
-            await request("confirm", undefined, saved.key);
-        }
-        catch (error) {
-            if (error instanceof ConnectionError && error.status === 401)
-                return { connected: false, reason: "revoked" };
-            throw error;
-        }
-        return { connected: true, agentName: saved.agentName, orgId: saved.orgId };
-    }
     if (command === "logout" && rest.length === 0) {
         if (env.RUNTIME_API_KEY)
             throw new Error("This shell uses RUNTIME_API_KEY. Remove that override before disconnecting the saved connection.");

package/dist/sandbox.d.ts

@@ -218,8 +218,9 @@ export declare class Files {
      */
     readStream(path: string, options?: RequestOptions): Promise<ReadableStream<Uint8Array>>;
     readText(path: string, options?: RequestOptions): Promise<string>;
-    /** Writes a file of any size, atomically, making parent directories. Large
-     * ones go in parallel 1 MiB chunks checked against their SHA-256. `mode`
+    /** Writes a file, atomically, making parent directories. Under /workspace
+     * any size, large ones in parallel 1 MiB chunks checked against their
+     * SHA-256; elsewhere, with the sandbox user's rights, up to 1 MiB. `mode`
      * sets its permissions (0o755 for a program); 0o644 when left out. */
     write(path: string, data: string | Uint8Array, writeOptions?: RequestOptions & {
         mode?: number;

package/dist/sandbox.js

@@ -408,10 +408,6 @@ export class Sandbox {
         return this.#info;
     }
 }
-/** A streamed command keeps all its output unless the reader fell more than the
- * process's output buffer behind, which the server marks with a "truncated"
- * event. That event does not say which stream lost bytes, so both flags carry
- * it; without one, both are false, as a synchronous result's are. */
 /** Where a reader of a process's output is, in bytes of stdout and stderr
  * together. Output it did not receive, named by the server or not, becomes a
  * `truncated` event: the next chunk starting past the cursor means the bytes
@@ -448,6 +444,10 @@ class OutputCursor {
 function cutOff(error) {
     return !(error instanceof RuntimeError) || error instanceof ConnectionError;
 }
+/** A streamed command keeps all its output unless the reader fell more than the
+ * process's output buffer behind, which the server marks with a "truncated"
+ * event. That event does not say which stream lost bytes, so both flags carry
+ * it; without one, both are false, as a synchronous result's are. */
 function truncation(dropped) {
     return { stdoutTruncated: dropped, stderrTruncated: dropped };
 }
@@ -718,8 +718,9 @@ export class Files {
     async readText(path, options = {}) {
         return new TextDecoder().decode(await this.read(path, options));
     }
-    /** Writes a file of any size, atomically, making parent directories. Large
-     * ones go in parallel 1 MiB chunks checked against their SHA-256. `mode`
+    /** Writes a file, atomically, making parent directories. Under /workspace
+     * any size, large ones in parallel 1 MiB chunks checked against their
+     * SHA-256; elsewhere, with the sandbox user's rights, up to 1 MiB. `mode`
      * sets its permissions (0o755 for a program); 0o644 when left out. */
     async write(path, data, writeOptions = {}) {
         const { mode, ...options } = writeOptions;

package/dist/tar.js

@@ -1,5 +1,5 @@
-import { mkdir, readdir, readFile, lstat, writeFile, symlink, chmod } from "node:fs/promises";
-import { join, relative, resolve, sep } from "node:path";
+import { chmod, lstat, mkdir, readdir, readFile, realpath, symlink, unlink, writeFile, } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { gunzipSync, gzipSync } from "node:zlib";
 /* A small ustar writer and reader for directory uploads and downloads, so the
    SDK needs no dependency. Regular files, directories and symbolic links;
@@ -68,17 +68,62 @@ export async function packDirectory(root) {
     parts.push(new Uint8Array(1024));
     return gzipSync(Buffer.concat(parts));
 }
+/* The archive comes from a sandbox, whose contents the customer's untrusted code
+   controls, so nothing in it may write outside `target`. A lexical check on each
+   name is not enough: a link `x -> ../outside` followed by `x/file` passes it and
+   writes through the link. So no write ever passes through a link, links are made
+   only after every file and directory is in place, and each link is then walked
+   through the finished tree and removed, failing the unpack, if it leads out. */
+async function linkAt(path) {
+    try {
+        return (await lstat(path)).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/** Throws unless `destination` is inside `root` and no part of the way to it,
+    itself included, is a link. */
+async function assertPlain(root, destination, name) {
+    if (destination !== root && !destination.startsWith(root + sep))
+        throw new Error(`Refusing an archive entry outside the target: ${name}`);
+    let path = root;
+    for (const part of relative(root, destination).split(sep).filter(Boolean)) {
+        path = join(path, part);
+        if (await linkAt(path))
+            throw new Error(`Refusing an archive entry that passes through a link: ${name}`);
+    }
+}
+/** Where following `link` from `directory` leads, or undefined when the way
+    leaves `root` or turns at a link before its last step. The last step may
+    be a link; that link is checked on its own. */
+async function linkStaysInside(root, directory, link) {
+    if (isAbsolute(link))
+        return false;
+    const parts = link.split("/").filter((part) => part && part !== ".");
+    let path = directory;
+    for (const [index, part] of parts.entries()) {
+        path = part === ".." ? dirname(path) : join(path, part);
+        if (path !== root && !path.startsWith(root + sep))
+            return false;
+        if (index < parts.length - 1 && part !== ".." && (await linkAt(path)))
+            return false;
+    }
+    return true;
+}
 /** Unpacks into `target`, refusing any entry that would land outside it. */
 export async function unpackArchive(archive, target) {
     const data = gunzipSync(archive);
-    const root = resolve(target);
-    await mkdir(root, { recursive: true });
+    await mkdir(resolve(target), { recursive: true });
+    const root = await realpath(resolve(target));
     const text = (start, length) => {
         const slice = data.subarray(start, start + length);
         const end = slice.indexOf(0);
         return new TextDecoder().decode(end < 0 ? slice : slice.subarray(0, end));
     };
+    const links = [];
     let longName;
+    let longLink;
     for (let offset = 0; offset + 512 <= data.length;) {
         if (data.subarray(offset, offset + 512).every((byte) => byte === 0))
             break;
@@ -86,31 +131,44 @@ export async function unpackArchive(archive, target) {
         const type = String.fromCharCode(data[offset + 156] ?? 48);
         const prefix = text(offset + 345, 155);
         let name = longName ?? (prefix ? `${prefix}/${text(offset, 100)}` : text(offset, 100));
+        const link = longLink ?? text(offset + 157, 100);
         longName = undefined;
+        longLink = undefined;
         const mode = parseInt(text(offset + 100, 8).trim() || "644", 8);
-        const link = text(offset + 157, 100);
         const body = data.subarray(offset + 512, offset + 512 + size);
         offset += 512 + Math.ceil(size / 512) * 512;
-        if (type === "L") {
-            longName = new TextDecoder().decode(body).replace(/\0.*$/s, "");
+        if (type === "L" || type === "K") {
+            const value = new TextDecoder().decode(body).replace(/\0.*$/s, "");
+            if (type === "L")
+                longName = value;
+            else
+                longLink = value;
             continue;
         }
         name = name.replace(/^\.\//, "");
         if (!name || name === "." || name === "./")
             continue;
         const destination = resolve(root, name);
-        if (destination !== root && !destination.startsWith(root + sep))
-            throw new Error(`Refusing an archive entry outside the target: ${name}`);
+        await assertPlain(root, destination, name);
         if (type === "5")
             await mkdir(destination, { recursive: true });
-        else if (type === "2") {
-            await mkdir(resolve(destination, ".."), { recursive: true });
-            await symlink(link, destination).catch(() => undefined);
-        }
+        else if (type === "2")
+            links.push({ destination, link, name });
         else if (type === "0" || type === "\0" || type === "7") {
-            await mkdir(resolve(destination, ".."), { recursive: true });
+            await mkdir(dirname(destination), { recursive: true });
             await writeFile(destination, body);
             await chmod(destination, mode & 0o777);
         }
     }
+    for (const { destination, link, name } of links) {
+        await assertPlain(root, destination, name);
+        await mkdir(dirname(destination), { recursive: true });
+        await symlink(link, destination).catch(() => undefined);
+    }
+    for (const { destination, link, name } of links) {
+        if (await linkStaysInside(root, dirname(destination), link))
+            continue;
+        await unlink(destination).catch(() => undefined);
+        throw new Error(`Refusing an archive link that leads outside the target: ${name} -> ${link}`);
+    }
 }

package/dist/transport.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeError } from "./errors.js";
-export declare const VERSION = "0.7.0";
+export declare const VERSION = "0.7.2";
 export declare const DEFAULT_BASE_URL = "https://api.withruntime.com";
 export type RequestOptions = {
     /** Sent as Idempotency-Key. Omit it: the SDK makes one per call and keeps

package/dist/transport.js

@@ -1,6 +1,6 @@
 import { ConnectionError, errorFor, RuntimeError, WAITS_FOR_ROOM } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket } from "./proxy.js";
-export const VERSION = "0.7.0";
+export const VERSION = "0.7.2";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 export function apiOrigin(value) {
     const url = new URL(value);

package/dist/types.d.ts

@@ -118,7 +118,8 @@ export type ExecOptions = {
     env?: Record<string, string>;
     /** Given to standard input, then closed. */
     stdin?: string | Uint8Array;
-    /** Default 60 000; up to 24 hours. A timeout is a result (timedOut), not an error. */
+    /** Default 60 000, or 24 hours when the output streams (onStdout, onStderr or
+     * execStream); up to 24 hours. A timeout is a result (timedOut), not an error. */
     timeoutMs?: number;
     onStdout?: (text: string) => void;
     onStderr?: (text: string) => void;
@@ -201,6 +202,18 @@ export type Usage = {
         reservedMs: number;
         availableMs: number;
     } | null;
+    /** Outbound traffic this calendar month, UTC: the first `allowanceBytes`
+     * (100 GiB) an account sends are free, the rest $0.02 per decimal GB. */
+    outbound?: {
+        month: string;
+        sentBytes: number;
+        freeBytes: number;
+        billableBytes: number;
+        allowanceBytes: number;
+        chargedMicros: string;
+        /** What the balance or a spending limit could not cover; never charged. */
+        writtenOffMicros: string;
+    } | null;
     resources: Array<Record<string, unknown>>;
     [key: string]: unknown;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",
@@ -76,7 +76,7 @@
     "prepack": "bun run build",
     "check-types": "tsc --noEmit",
     "lint": "eslint",
-    "test": "bun test && bun scripts/test-python.ts && bun scripts/test-go.ts && bun ../../sdks/java/scripts/check.ts && bun ../../sdks/ruby/scripts/check.ts",
+    "test": "bun test --parallel && bun scripts/test-python.ts && bun scripts/test-go.ts && bun ../../sdks/java/scripts/check.ts && bun ../../sdks/ruby/scripts/check.ts",
     "test:java": "bun ../../sdks/java/scripts/check.ts",
     "test:ruby": "bun ../../sdks/ruby/scripts/check.ts",
     "test:python": "bun scripts/test-python.ts",
@@ -110,14 +110,25 @@
     "registry": "https://registry.npmjs.org/"
   },
   "description": "Runtime Cloud: one client, CLI and MCP bridge for every Runtime product. Sandboxes first.",
+  "homepage": "https://withruntime.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/withruntime/runtime.git",
+    "directory": "packages/cloud-sdk"
+  },
+  "bugs": "https://github.com/withruntime/runtime/issues",
   "sideEffects": false,
   "keywords": [
     "sandbox",
     "cloud",
     "agents",
+    "ai-agents",
     "mcp",
     "microvm",
-    "code-execution"
+    "firecracker",
+    "code-execution",
+    "code-interpreter",
+    "llm"
   ],
   "dependencies": {
     "undici": "^7.29.1"