withruntime 0.7.1 → 0.7.2

package/dist/ai-harness/index.js

@@ -467,6 +467,11 @@ export function networkRules(policy) {
     if (policy.mode === "deny-all")
         return { internet: false };
     const allow = [...(policy.allowedHosts ?? []), ...(policy.allowedCIDRs ?? [])];
+    // `custom` is an allow list; one that allows nothing is `deny-all` in the
+    // harness's own terms. Runtime reads an empty allow as no allow list at all,
+    // which would open the whole internet.
+    if (!allow.length)
+        return { internet: false };
     const deny = [...(policy.deniedCIDRs ?? [])];
     return { internet: true, allow, ...(deny.length ? { deny } : {}) };
 }

package/dist/cli.js

@@ -140,7 +140,7 @@ const SANDBOX_HELP = `runtime sandbox <command>
                              [--option SERVER.NAME=value]... [--port 8765] [--replace]
                                               Start them; prints each URL and the header to send
   mcp <id> [status] | mcp <id> stop           Their state and fresh URLs; stop them
-  preview <id> <port> [--public] [--ttl <s>]  Share a port at an HTTPS address
+  preview <id> <port> [--public] [--ttl <s>]  Share a port at an HTTPS address (--public: paid only)
   preview rotate <id> <port>                  Refuse every token given out for a private port so
                                               far; prints the new token
   previews <id>                               Every shared port
@@ -494,7 +494,10 @@ function remote(spec) {
     return match ? { id: match[1], path: match[2] } : undefined;
 }
 export async function run(argv, env = process.env, out = defaultOut(argv)) {
-    const [first, ...remaining] = argv.filter((arg) => arg !== "--json" || (argv.indexOf("--") !== -1 && argv.indexOf(arg) > argv.indexOf("--")));
+    // Only what comes before -- is the CLI's: a --json after it is the
+    // command's, whether or not the CLI was given its own.
+    const dash = argv.indexOf("--");
+    const [first, ...remaining] = argv.filter((arg, index) => arg !== "--json" || (dash !== -1 && index > dash));
     // Sandbox is one product of several, so its commands live under it
     // (AGENTS.md, 23 September 2026): `runtime sandbox run`, `sandbox ssh` and
     // `sandbox port-forward`. The old top-level forms were removed, not aliased.
@@ -980,6 +983,14 @@ function usageSummary(u) {
             "free trial",
             `${hours(u.trial.availableMs)} of ${hours(u.trial.totalMs)} hours left${u.trial.reservedMs > 0 ? `, ${hours(u.trial.reservedMs)} held by running sandboxes` : ""}`,
         ]);
+    if (u.outbound) {
+        const gib = (bytes) => `${(bytes / 1_073_741_824).toLocaleString("en-US", { maximumFractionDigits: 1 })} GiB`;
+        const left = Math.max(0, u.outbound.allowanceBytes - u.outbound.freeBytes);
+        rows.push([
+            "outbound traffic this month",
+            `${gib(u.outbound.sentBytes)} sent, ${gib(left)} of ${gib(u.outbound.allowanceBytes)} free left, ${dollars(micros(u.outbound.chargedMicros))} charged`,
+        ]);
+    }
     const kinds = new Map();
     for (const resource of u.resources ?? []) {
         const kind = typeof resource.kind === "string" ? resource.kind : "other";
@@ -1044,13 +1055,14 @@ async function outputSoFar(runtime, sandboxId, processId) {
         chunks,
     };
 }
-/** Dollars from integer microdollars: cents from a dollar up, and four
- * places below one, so a few minutes of use does not round to $0.01. */
+/** Dollars from integer microdollars: cents from a dollar up, four places
+ * below one, and every place below a hundredth of a cent, so a short trial
+ * test never reads as $0.0000. */
 function dollars(micros) {
     const value = BigInt(micros);
     const sign = value < 0n ? "-" : "";
     const size = value < 0n ? -value : value;
-    const places = size < 1000000n ? 4 : 2;
+    const places = size >= 1000000n ? 2 : size >= 100n || size === 0n ? 4 : 6;
     const unit = 10n ** BigInt(6 - places);
     const rounded = (size + unit / 2n) / unit;
     const whole = rounded / 10n ** BigInt(places);
@@ -1112,11 +1124,28 @@ function switchingLine(summary, provider) {
                 : `${recorded}; its first top-up was not matched. Ask support if you think that is wrong.${once}`;
     }
 }
+/** Running time in the largest unit that keeps it above zero: a short
+ * trial test is seconds, not "0 hours". */
+function runningTime(seconds) {
+    const [amount, unit] = seconds < 60
+        ? [seconds, "second"]
+        : seconds < 3600
+            ? [seconds / 60, "minute"]
+            : [seconds / 3600, "hour"];
+    const shown = amount.toLocaleString("en-US", {
+        maximumFractionDigits: unit === "second" ? 1 : 2,
+    });
+    return `${shown} ${unit}${shown === "1" ? "" : "s"}`;
+}
 /** The sandboxes the free trial paid for, said beside what was priced. */
-function trialNote(trial, all) {
+function trialNote(trial, all, trialSeconds) {
     if (!trial)
         return "";
-    const which = trial === all ? (all === 1 ? "It" : "All of them") : `${trial} of them`;
+    const which = trial === all
+        ? all === 1
+            ? "It"
+            : "All of them"
+        : `${trial} of them, ${runningTime(trialSeconds)} of that time,`;
     return ` ${which} ran on the free trial, which charged nothing; Runtime's side prices ${trial === 1 ? "it" : "them"} at the standard rates, what the same work costs on paid credit.`;
 }
 async function switching(command, argv, env, out) {
@@ -1178,13 +1207,13 @@ async function switching(command, argv, env, out) {
     const lines = c.basis === "usage"
         ? [
             `Your last ${c.window.days} days: ${figures}${pace}`,
-            `Priced: ${c.usage.sandboxes.toLocaleString("en-US")} sandbox${c.usage.sandboxes === 1 ? "" : "es"}, ${(c.usage.runSeconds / 3600).toLocaleString("en-US", { maximumFractionDigits: 2 })} hours running.${trialNote(c.usage.trialSandboxes, c.usage.sandboxes)}${c.usage.unpricedSandboxes ? ` ${c.usage.unpricedSandboxes} left out: ${c.rival.name} publishes no price for their size.` : ""}`,
+            `Priced: ${c.usage.sandboxes.toLocaleString("en-US")} sandbox${c.usage.sandboxes === 1 ? "" : "es"}, ${runningTime(c.usage.runSeconds)} running.${trialNote(c.usage.trialSandboxes, c.usage.sandboxes, c.usage.trialRunSeconds)}${c.usage.unpricedSandboxes ? ` ${c.usage.unpricedSandboxes} left out: ${c.rival.name} publishes no price for their size.` : ""}`,
         ]
         : [
             `No settled sandboxes in your last ${c.window.days} days yet, so this prices an example: ${c.usage.sandboxes.toLocaleString("en-US")} runs of ${(c.usage.runSeconds / c.usage.sandboxes).toLocaleString("en-US")} seconds using ${(c.usage.activeCpuSeconds / c.usage.sandboxes).toLocaleString("en-US")} CPU-seconds each.`,
             `The example: ${figures}.`,
         ];
-    lines.push(`${c.rival.name}'s published rates, checked ${longDate(`${c.rival.checked}T12:00:00Z`)}: ${c.rival.rates.join("; ")}. Compute only: storage, network, plan fees and free allowances are left out.`);
+    lines.push(`${c.rival.name}'s published rates, checked ${longDate(`${c.rival.checked}T12:00:00Z`)}: ${c.rival.rates.join("; ")}. Compute only, with the disk where a rival bills it while running: storage at rest, network, plan fees and free allowances are left out.`);
     const line = switchingLine(c.switching, Object.hasOwn(SWITCH_FROM, from) ? SWITCH_FROM[from] : undefined);
     if (line)
         lines.push("", line);
@@ -2642,8 +2671,10 @@ ownInterrupt = true) {
     }
     if (out.json)
         out.write(JSON.stringify(result));
+    // Here the output streamed, whose timeout is 24 hours unless one was given
+    // (Sandbox.exec); `--json` answers the result and prints no such line.
     else if (result.timedOut)
-        out.error(`runtime: timed out after ${timeout ?? 60} s; the command's process group was killed.`);
+        out.error(`runtime: timed out after ${timeout ? `${timeout} s` : "24 h"}; the command's process group was killed.`);
     // Never drop output silently: say so, and do not exit 0.
     const lost = extras.lostOutput(result, sbx.id);
     if (lost && !out.json)

package/dist/login.d.ts

@@ -15,34 +15,11 @@ type LoginOptions = {
  * at the same machine to press Connect agent. */
 export declare const AGENT_WAIT_MS = 50000;
 export declare function authenticationCommand(args: string[], env: NodeJS.ProcessEnv, options?: LoginOptions): Promise<{
-    connected: boolean;
-    source: string;
-    reason?: undefined;
-    agentName?: undefined;
-    orgId?: undefined;
-    disconnected?: undefined;
-    pending?: undefined;
-    url?: undefined;
-    userCode?: undefined;
-    expiresAt?: undefined;
-} | {
-    connected: boolean;
-    source?: undefined;
-    reason?: undefined;
+    disconnected: boolean;
+    connected?: undefined;
     agentName?: undefined;
     orgId?: undefined;
-    disconnected?: undefined;
-    pending?: undefined;
-    url?: undefined;
-    userCode?: undefined;
-    expiresAt?: undefined;
-} | {
-    connected: boolean;
-    reason: string;
     source?: undefined;
-    agentName?: undefined;
-    orgId?: undefined;
-    disconnected?: undefined;
     pending?: undefined;
     url?: undefined;
     userCode?: undefined;
@@ -51,18 +28,16 @@ export declare function authenticationCommand(args: string[], env: NodeJS.Proces
     connected: boolean;
     agentName: string;
     orgId: string;
-    source?: undefined;
-    reason?: undefined;
+    source: string;
     disconnected?: undefined;
     pending?: undefined;
     url?: undefined;
     userCode?: undefined;
     expiresAt?: undefined;
 } | {
-    disconnected: boolean;
-    connected?: undefined;
-    source?: undefined;
-    reason?: undefined;
+    connected: boolean;
+    source: string;
+    disconnected?: undefined;
     agentName?: undefined;
     orgId?: undefined;
     pending?: undefined;
@@ -73,9 +48,8 @@ export declare function authenticationCommand(args: string[], env: NodeJS.Proces
     connected: boolean;
     agentName: string;
     orgId: string;
-    source: string;
-    reason?: undefined;
     disconnected?: undefined;
+    source?: undefined;
     pending?: undefined;
     url?: undefined;
     userCode?: undefined;
@@ -86,11 +60,10 @@ export declare function authenticationCommand(args: string[], env: NodeJS.Proces
     url: string;
     userCode: string;
     expiresAt: string;
-    source?: undefined;
-    reason?: undefined;
+    disconnected?: undefined;
     agentName?: undefined;
     orgId?: undefined;
-    disconnected?: undefined;
+    source?: undefined;
 }>;
 export type PendingLogin = {
     /** Open this in a browser, where the account owner approves the agent. */

package/dist/login.js

@@ -109,28 +109,6 @@ export async function authenticationCommand(args, env, options = {}) {
     const notify = options.notify ?? ((message) => process.stderr.write(`${message}\n`));
     const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const [command, ...rest] = args;
-    if (command === "auth" && rest.length === 1 && rest[0] === "status") {
-        if (env.RUNTIME_API_KEY) {
-            await new Runtime({
-                apiKey: env.RUNTIME_API_KEY,
-                baseUrl: origins.api,
-                fetch: fetcher,
-            }).usage();
-            return { connected: true, source: "environment" };
-        }
-        const saved = await store.read();
-        if (!saved)
-            return { connected: false };
-        try {
-            await request("confirm", undefined, saved.key);
-        }
-        catch (error) {
-            if (error instanceof ConnectionError && error.status === 401)
-                return { connected: false, reason: "revoked" };
-            throw error;
-        }
-        return { connected: true, agentName: saved.agentName, orgId: saved.orgId };
-    }
     if (command === "logout" && rest.length === 0) {
         if (env.RUNTIME_API_KEY)
             throw new Error("This shell uses RUNTIME_API_KEY. Remove that override before disconnecting the saved connection.");

package/dist/sandbox.d.ts

@@ -218,8 +218,9 @@ export declare class Files {
      */
     readStream(path: string, options?: RequestOptions): Promise<ReadableStream<Uint8Array>>;
     readText(path: string, options?: RequestOptions): Promise<string>;
-    /** Writes a file of any size, atomically, making parent directories. Large
-     * ones go in parallel 1 MiB chunks checked against their SHA-256. `mode`
+    /** Writes a file, atomically, making parent directories. Under /workspace
+     * any size, large ones in parallel 1 MiB chunks checked against their
+     * SHA-256; elsewhere, with the sandbox user's rights, up to 1 MiB. `mode`
      * sets its permissions (0o755 for a program); 0o644 when left out. */
     write(path: string, data: string | Uint8Array, writeOptions?: RequestOptions & {
         mode?: number;

package/dist/sandbox.js

@@ -718,8 +718,9 @@ export class Files {
     async readText(path, options = {}) {
         return new TextDecoder().decode(await this.read(path, options));
     }
-    /** Writes a file of any size, atomically, making parent directories. Large
-     * ones go in parallel 1 MiB chunks checked against their SHA-256. `mode`
+    /** Writes a file, atomically, making parent directories. Under /workspace
+     * any size, large ones in parallel 1 MiB chunks checked against their
+     * SHA-256; elsewhere, with the sandbox user's rights, up to 1 MiB. `mode`
      * sets its permissions (0o755 for a program); 0o644 when left out. */
     async write(path, data, writeOptions = {}) {
         const { mode, ...options } = writeOptions;

package/dist/tar.js

@@ -1,5 +1,5 @@
-import { mkdir, readdir, readFile, lstat, writeFile, symlink, chmod } from "node:fs/promises";
-import { join, relative, resolve, sep } from "node:path";
+import { chmod, lstat, mkdir, readdir, readFile, realpath, symlink, unlink, writeFile, } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { gunzipSync, gzipSync } from "node:zlib";
 /* A small ustar writer and reader for directory uploads and downloads, so the
    SDK needs no dependency. Regular files, directories and symbolic links;
@@ -68,17 +68,62 @@ export async function packDirectory(root) {
     parts.push(new Uint8Array(1024));
     return gzipSync(Buffer.concat(parts));
 }
+/* The archive comes from a sandbox, whose contents the customer's untrusted code
+   controls, so nothing in it may write outside `target`. A lexical check on each
+   name is not enough: a link `x -> ../outside` followed by `x/file` passes it and
+   writes through the link. So no write ever passes through a link, links are made
+   only after every file and directory is in place, and each link is then walked
+   through the finished tree and removed, failing the unpack, if it leads out. */
+async function linkAt(path) {
+    try {
+        return (await lstat(path)).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/** Throws unless `destination` is inside `root` and no part of the way to it,
+    itself included, is a link. */
+async function assertPlain(root, destination, name) {
+    if (destination !== root && !destination.startsWith(root + sep))
+        throw new Error(`Refusing an archive entry outside the target: ${name}`);
+    let path = root;
+    for (const part of relative(root, destination).split(sep).filter(Boolean)) {
+        path = join(path, part);
+        if (await linkAt(path))
+            throw new Error(`Refusing an archive entry that passes through a link: ${name}`);
+    }
+}
+/** Where following `link` from `directory` leads, or undefined when the way
+    leaves `root` or turns at a link before its last step. The last step may
+    be a link; that link is checked on its own. */
+async function linkStaysInside(root, directory, link) {
+    if (isAbsolute(link))
+        return false;
+    const parts = link.split("/").filter((part) => part && part !== ".");
+    let path = directory;
+    for (const [index, part] of parts.entries()) {
+        path = part === ".." ? dirname(path) : join(path, part);
+        if (path !== root && !path.startsWith(root + sep))
+            return false;
+        if (index < parts.length - 1 && part !== ".." && (await linkAt(path)))
+            return false;
+    }
+    return true;
+}
 /** Unpacks into `target`, refusing any entry that would land outside it. */
 export async function unpackArchive(archive, target) {
     const data = gunzipSync(archive);
-    const root = resolve(target);
-    await mkdir(root, { recursive: true });
+    await mkdir(resolve(target), { recursive: true });
+    const root = await realpath(resolve(target));
     const text = (start, length) => {
         const slice = data.subarray(start, start + length);
         const end = slice.indexOf(0);
         return new TextDecoder().decode(end < 0 ? slice : slice.subarray(0, end));
     };
+    const links = [];
     let longName;
+    let longLink;
     for (let offset = 0; offset + 512 <= data.length;) {
         if (data.subarray(offset, offset + 512).every((byte) => byte === 0))
             break;
@@ -86,31 +131,44 @@ export async function unpackArchive(archive, target) {
         const type = String.fromCharCode(data[offset + 156] ?? 48);
         const prefix = text(offset + 345, 155);
         let name = longName ?? (prefix ? `${prefix}/${text(offset, 100)}` : text(offset, 100));
+        const link = longLink ?? text(offset + 157, 100);
         longName = undefined;
+        longLink = undefined;
         const mode = parseInt(text(offset + 100, 8).trim() || "644", 8);
-        const link = text(offset + 157, 100);
         const body = data.subarray(offset + 512, offset + 512 + size);
         offset += 512 + Math.ceil(size / 512) * 512;
-        if (type === "L") {
-            longName = new TextDecoder().decode(body).replace(/\0.*$/s, "");
+        if (type === "L" || type === "K") {
+            const value = new TextDecoder().decode(body).replace(/\0.*$/s, "");
+            if (type === "L")
+                longName = value;
+            else
+                longLink = value;
             continue;
         }
         name = name.replace(/^\.\//, "");
         if (!name || name === "." || name === "./")
             continue;
         const destination = resolve(root, name);
-        if (destination !== root && !destination.startsWith(root + sep))
-            throw new Error(`Refusing an archive entry outside the target: ${name}`);
+        await assertPlain(root, destination, name);
         if (type === "5")
             await mkdir(destination, { recursive: true });
-        else if (type === "2") {
-            await mkdir(resolve(destination, ".."), { recursive: true });
-            await symlink(link, destination).catch(() => undefined);
-        }
+        else if (type === "2")
+            links.push({ destination, link, name });
         else if (type === "0" || type === "\0" || type === "7") {
-            await mkdir(resolve(destination, ".."), { recursive: true });
+            await mkdir(dirname(destination), { recursive: true });
             await writeFile(destination, body);
             await chmod(destination, mode & 0o777);
         }
     }
+    for (const { destination, link, name } of links) {
+        await assertPlain(root, destination, name);
+        await mkdir(dirname(destination), { recursive: true });
+        await symlink(link, destination).catch(() => undefined);
+    }
+    for (const { destination, link, name } of links) {
+        if (await linkStaysInside(root, dirname(destination), link))
+            continue;
+        await unlink(destination).catch(() => undefined);
+        throw new Error(`Refusing an archive link that leads outside the target: ${name} -> ${link}`);
+    }
 }

package/dist/transport.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeError } from "./errors.js";
-export declare const VERSION = "0.7.1";
+export declare const VERSION = "0.7.2";
 export declare const DEFAULT_BASE_URL = "https://api.withruntime.com";
 export type RequestOptions = {
     /** Sent as Idempotency-Key. Omit it: the SDK makes one per call and keeps

package/dist/transport.js

@@ -1,6 +1,6 @@
 import { ConnectionError, errorFor, RuntimeError, WAITS_FOR_ROOM } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket } from "./proxy.js";
-export const VERSION = "0.7.1";
+export const VERSION = "0.7.2";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 export function apiOrigin(value) {
     const url = new URL(value);

package/dist/types.d.ts

@@ -118,7 +118,8 @@ export type ExecOptions = {
     env?: Record<string, string>;
     /** Given to standard input, then closed. */
     stdin?: string | Uint8Array;
-    /** Default 60 000; up to 24 hours. A timeout is a result (timedOut), not an error. */
+    /** Default 60 000, or 24 hours when the output streams (onStdout, onStderr or
+     * execStream); up to 24 hours. A timeout is a result (timedOut), not an error. */
     timeoutMs?: number;
     onStdout?: (text: string) => void;
     onStderr?: (text: string) => void;
@@ -201,6 +202,18 @@ export type Usage = {
         reservedMs: number;
         availableMs: number;
     } | null;
+    /** Outbound traffic this calendar month, UTC: the first `allowanceBytes`
+     * (100 GiB) an account sends are free, the rest $0.02 per decimal GB. */
+    outbound?: {
+        month: string;
+        sentBytes: number;
+        freeBytes: number;
+        billableBytes: number;
+        allowanceBytes: number;
+        chargedMicros: string;
+        /** What the balance or a spending limit could not cover; never charged. */
+        writtenOffMicros: string;
+    } | null;
     resources: Array<Record<string, unknown>>;
     [key: string]: unknown;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",
@@ -76,7 +76,7 @@
     "prepack": "bun run build",
     "check-types": "tsc --noEmit",
     "lint": "eslint",
-    "test": "bun test && bun scripts/test-python.ts && bun scripts/test-go.ts && bun ../../sdks/java/scripts/check.ts && bun ../../sdks/ruby/scripts/check.ts",
+    "test": "bun test --parallel && bun scripts/test-python.ts && bun scripts/test-go.ts && bun ../../sdks/java/scripts/check.ts && bun ../../sdks/ruby/scripts/check.ts",
     "test:java": "bun ../../sdks/java/scripts/check.ts",
     "test:ruby": "bun ../../sdks/ruby/scripts/check.ts",
     "test:python": "bun scripts/test-python.ts",