withruntime 0.8.4 → 0.10.0

package/dist/freestyle/index.js

@@ -0,0 +1,343 @@
+import { all, client, CompatibilityError, create, destroy, execOptions, lookup, only, ready, } from "../compat/core.js";
+import { GuestFiles } from "../compat/files.js";
+export { CompatibilityError };
+function validateMetadata(metadata) {
+    for (const key of ["compat.provider", "fs.displayName"])
+        if (metadata !== undefined && Object.prototype.hasOwnProperty.call(metadata, key))
+            throw new CompatibilityError("Freestyle", `metadata key ${key} reserved by this adapter`);
+}
+const data = (s) => ({
+    id: s.id,
+    state: s.state,
+    slug: s.info.name,
+    displayName: s.info.labels["fs.displayName"] ?? null,
+    resources: { cpu: s.info.vcpu, memory: s.info.memoryMiB, storage: s.info.diskMiB },
+    metadata: Object.fromEntries(Object.entries(s.info.labels).filter(([k]) => !["compat.provider", "fs.displayName"].includes(k))),
+    idleTimeoutSeconds: s.info.idlePauseSeconds === 0 ? -1 : s.info.idlePauseSeconds,
+    vpcs: [],
+    networks: [],
+    createdAt: s.info.createdAt,
+    updatedAt: s.info.createdAt,
+});
+const snapshotData = (s) => ({
+    id: s.id,
+    sourceVmId: s.sourceSandboxId,
+    slug: s.name,
+    displayName: s.labels?.["fs.displayName"] ?? null,
+    public: false,
+    createdAt: s.createdAt,
+    updatedAt: s.createdAt,
+    ttlSeconds: s.retentionDays * 86400,
+});
+export class Freestyle {
+    vms;
+    constructor(options = {}) {
+        this.vms = new VmsNamespace(client(options));
+    }
+}
+export class VmsNamespace {
+    runtime;
+    snapshots;
+    constructor(runtime) {
+        this.runtime = runtime;
+        this.snapshots = {
+            get: async (id) => snapshotData(await this.resolveSnapshot(id)),
+            delete: async (id) => runtime.snapshots.delete((await this.resolveSnapshot(id)).id),
+            list: async (options = {}) => {
+                only("Freestyle snapshot list", options, ["sourceVmId", "limit", "offset"]);
+                if (options.sourceVmId !== undefined && typeof options.sourceVmId !== "string")
+                    throw new TypeError("sourceVmId must be a string");
+                if (options.limit !== undefined &&
+                    (!Number.isSafeInteger(options.limit) || options.limit <= 0))
+                    throw new TypeError("limit must be a positive safe integer");
+                if (options.offset !== undefined &&
+                    (!Number.isSafeInteger(options.offset) || options.offset < 0))
+                    throw new TypeError("offset must be a nonnegative safe integer");
+                const offset = options.offset ?? 0;
+                const snapshots = [];
+                let totalCount = 0;
+                // Count the filtered catalog across every native page without retaining
+                // snapshots outside the requested page or Page.toArray's default cap.
+                const page = await runtime.snapshots.list(options.sourceVmId === undefined ? {} : { sandboxId: options.sourceVmId });
+                for await (const snapshot of page) {
+                    if (options.sourceVmId !== undefined && snapshot.sourceSandboxId !== options.sourceVmId)
+                        continue;
+                    if (totalCount >= offset &&
+                        (options.limit === undefined || snapshots.length < options.limit))
+                        snapshots.push(snapshotData(snapshot));
+                    totalCount++;
+                }
+                return { snapshots, totalCount };
+            },
+        };
+    }
+    async resolveSnapshot(id) {
+        if (/^[a-f0-9-]{36}$/i.test(id))
+            return this.runtime.snapshots.get(id);
+        const found = (await this.runtime.snapshots.list({ name: id })).data.find((s) => s.name === id);
+        if (!found)
+            throw new CompatibilityError("Freestyle", `snapshot ${id}; import the source environment into Runtime first`);
+        return found;
+    }
+    async create(options) {
+        only("Freestyle create", options, [
+            "snapshotId",
+            "slug",
+            "displayName",
+            "idleTimeoutSeconds",
+            "metadata",
+            "firewall",
+        ]);
+        validateMetadata(options.metadata);
+        if (!options.firewall || !Array.isArray(options.firewall.rules))
+            throw new TypeError("firewall.rules is required");
+        only("Freestyle firewall", options.firewall, ["rules"]);
+        for (const r of options.firewall.rules) {
+            only("Freestyle firewall rule", r, ["action", "source", "destination"]);
+            if (r.action !== "allow" ||
+                Object.keys(r.source).length ||
+                Object.keys(r.destination).length !== 1 ||
+                r.destination.public !== true)
+                throw new CompatibilityError("Freestyle", "firewall rules other than unrestricted outbound public access");
+        }
+        const snapshot = options.snapshotId
+            ? (await this.resolveSnapshot(options.snapshotId)).id
+            : undefined;
+        const s = await create(this.runtime, "freestyle", {
+            snapshot,
+            name: options.slug ?? undefined,
+            labels: { ...options.metadata, "fs.displayName": options.displayName ?? "" },
+            persistent: true,
+            idlePauseSeconds: options.idleTimeoutSeconds === -1 || options.idleTimeoutSeconds == null
+                ? 0
+                : options.idleTimeoutSeconds,
+            network: { internet: options.firewall.rules.length > 0 },
+        });
+        return {
+            vm: new Vm(this.runtime, s.id),
+            vmId: s.id,
+            data: data(s),
+            firewallRules: options.firewall.rules.map((rule) => ({
+                ...rule,
+                id: `runtime-network-${s.id}`,
+                source: { vmId: s.id },
+            })),
+            tlsRules: [],
+        };
+    }
+    ref(id) {
+        return new Vm(this.runtime, id);
+    }
+    async get(id) {
+        return data(await lookup(this.runtime, id));
+    }
+    async delete(id) {
+        await destroy(await lookup(this.runtime, id));
+    }
+    async list(options = {}) {
+        only("Freestyle list", options, ["state", "slug", "metadata", "limit", "offset"]);
+        const filters = options.metadata?.split(",").map((x) => {
+            const i = x.indexOf(":");
+            return [x.slice(0, i), x.slice(i + 1)];
+        }) ?? [];
+        const values = (await all(this.runtime, "freestyle")).filter((s) => (!options.state || s.state === options.state) &&
+            (!options.slug || s.info.name === options.slug) &&
+            filters.every(([k, v]) => s.info.labels[k] === v));
+        return {
+            vms: values
+                .slice(options.offset ?? 0, (options.offset ?? 0) + (options.limit ?? 100))
+                .map(data),
+            totalCount: values.length,
+            runningCount: values.filter((s) => s.state === "running").length,
+            startingCount: values.filter((s) => s.state === "starting").length,
+            pausingCount: values.filter((s) => s.state === "pausing").length,
+            pausedCount: values.filter((s) => s.state === "paused").length,
+            stoppedCount: values.filter((s) => s.state === "stopped").length,
+        };
+    }
+}
+export class VmFilesystem {
+    get;
+    files;
+    constructor(get) {
+        this.get = get;
+        this.files = new GuestFiles(get, "/");
+    }
+    async readFile(path, options = {}) {
+        return new Uint8Array(await new Response(await this.readFileStream(path, options)).arrayBuffer());
+    }
+    async readTextFile(path, options = {}) {
+        return new TextDecoder().decode(await this.readFile(path, options));
+    }
+    async readFileStream(path, options = {}) {
+        only("Freestyle file read", options, ["offset", "length", "signal"]);
+        for (const value of [options.offset, options.length])
+            if (value !== undefined && (!Number.isSafeInteger(value) || value < 0))
+                throw new TypeError("File range must contain nonnegative safe integers");
+        options.signal?.throwIfAborted();
+        const source = await (await this.get()).files.readStream(this.files.path(path), { signal: options.signal });
+        if (options.offset === undefined && options.length === undefined)
+            return source;
+        const reader = source.getReader();
+        let skip = options.offset ?? 0, remaining = options.length ?? Infinity;
+        return new ReadableStream({
+            async pull(controller) {
+                try {
+                    options.signal?.throwIfAborted();
+                    if (!remaining) {
+                        await reader.cancel();
+                        controller.close();
+                        return;
+                    }
+                    for (;;) {
+                        const next = await reader.read();
+                        if (next.done) {
+                            controller.close();
+                            return;
+                        }
+                        const start = Math.min(skip, next.value.length);
+                        skip -= start;
+                        const chunk = next.value.subarray(start, start + remaining);
+                        if (chunk.length) {
+                            remaining -= chunk.length;
+                            controller.enqueue(chunk);
+                            return;
+                        }
+                    }
+                }
+                catch (error) {
+                    await reader.cancel(error);
+                    controller.error(error);
+                }
+            },
+            cancel(reason) {
+                return reader.cancel(reason);
+            },
+        });
+    }
+    async writeFile(path, content, options = {}) {
+        only("Freestyle file write", options, [
+            "mode",
+            "onProgress",
+            "signal",
+            "chunkSize",
+            "maxAttempts",
+        ]);
+        if (options.chunkSize !== undefined || options.maxAttempts !== undefined)
+            throw new CompatibilityError("Freestyle", "custom upload chunk sizing/retry budgets");
+        options.signal?.throwIfAborted();
+        const bytes = typeof content === "string"
+            ? new TextEncoder().encode(content)
+            : content instanceof Uint8Array
+                ? content
+                : new Uint8Array(await content.arrayBuffer());
+        let mode = options.mode;
+        if (mode === undefined)
+            mode = (await this.files.exists(path))
+                ? parseInt((await this.files.stat(path)).mode, 8)
+                : 0o600;
+        await this.files.writeFile(path, bytes, { mode, signal: options.signal });
+        options.onProgress?.({ completedBytes: bytes.length, totalBytes: bytes.length });
+    }
+    writeTextFile(path, content, options = {}) {
+        return this.writeFile(path, content, options);
+    }
+    mkdir(path) {
+        return this.files.mkdir(path, true);
+    }
+    remove(path) {
+        return this.files.remove(path, true);
+    }
+    exists(path) {
+        return this.files.exists(path);
+    }
+    async readDir(path) {
+        return (await this.files.readdir(path)).map((e) => ({ name: e.name, kind: e.type }));
+    }
+    async stat(path) {
+        const e = await this.files.stat(path);
+        const s = await this.get();
+        const r = await s.exec(["stat", "-c", "%U:%G", "--", this.files.path(path)], { check: true });
+        const [owner, group] = r.stdout.trim().split(":");
+        return {
+            size: e.size,
+            isFile: e.type === "file",
+            isDirectory: e.type === "directory",
+            isSymlink: e.type === "symlink",
+            permissions: e.mode,
+            owner: owner,
+            group: group,
+            modified: e.modifiedAt,
+        };
+    }
+}
+export class Vm {
+    runtime;
+    id;
+    fs;
+    constructor(runtime, id) {
+        this.runtime = runtime;
+        this.id = id;
+        this.fs = new VmFilesystem(() => lookup(runtime, id));
+    }
+    async data() {
+        return data(await lookup(this.runtime, this.id));
+    }
+    async start() {
+        return data(await ready(await lookup(this.runtime, this.id)));
+    }
+    async pause() {
+        const s = await lookup(this.runtime, this.id);
+        await s.pause();
+        return data(s);
+    }
+    async delete() {
+        await destroy(await lookup(this.runtime, this.id));
+    }
+    async update(options) {
+        only("Freestyle update", options, ["slug", "displayName", "idleTimeoutSeconds", "metadata"]);
+        validateMetadata(options.metadata);
+        const s = await lookup(this.runtime, this.id);
+        await s.update({
+            name: options.slug,
+            idlePauseSeconds: options.idleTimeoutSeconds === -1 ? 0 : options.idleTimeoutSeconds,
+            labels: {
+                ...s.info.labels,
+                ...options.metadata,
+                ...(options.displayName === undefined ? {} : { "fs.displayName": options.displayName }),
+            },
+        });
+        return data(s);
+    }
+    async exec(options) {
+        const o = typeof options === "string" ? { command: options } : options;
+        only("Freestyle exec", o, ["command", "linuxUser", "timeoutMs", "env", "stdin"]);
+        if (o.linuxUser)
+            throw new CompatibilityError("Freestyle", "exec as a different Linux user");
+        const s = await lookup(this.runtime, this.id);
+        const r = await s.exec(o.command, await execOptions(s, {
+            onStdout: () => undefined,
+            onStderr: () => undefined,
+            timeoutMs: o.timeoutMs,
+            env: o.env,
+            stdin: o.stdin === undefined
+                ? undefined
+                : Uint8Array.from(atob(o.stdin), (c) => c.charCodeAt(0)),
+        }));
+        return { stdout: r.stdout, stderr: r.stderr, statusCode: r.timedOut ? null : r.exitCode };
+    }
+    async snapshot(options = {}) {
+        only("Freestyle snapshot", options, ["slug", "displayName", "ttlSeconds"]);
+        if (options.ttlSeconds !== undefined &&
+            (options.ttlSeconds <= 0 ||
+                options.ttlSeconds > 365 * 86400 ||
+                options.ttlSeconds % 86400 !== 0))
+            throw new CompatibilityError("Freestyle", "snapshot retention outside 1 to 365 whole days");
+        const s = await (await lookup(this.runtime, this.id)).snapshot({
+            name: options.slug,
+            labels: options.displayName ? { "fs.displayName": options.displayName } : undefined,
+            retentionDays: options.ttlSeconds === undefined ? undefined : options.ttlSeconds / 86400,
+        });
+        return { snapshotId: s.id, sourceVmId: s.sourceSandboxId, snapshot: snapshotData(s) };
+    }
+}

package/dist/index.d.ts

@@ -15,12 +15,14 @@ export { Tunnel, TunnelStream, type PortForward } from "./tunnel.js";
 export { Page } from "./page.js";
 export type { KeyLimits } from "./products/limits.js";
 export type { AuditEvent, AuditPage } from "./products/audit.js";
+export type { UsageExportQuery, UsageExportRow, UsageExportPage, } from "./products/observability.js";
 export type { JobSecret, Secret, SecretRule, SecretUse, SetSecret } from "./products/secrets.js";
 export { SecretPartlyStoredError } from "./products/secrets.js";
 export type { McpCatalogEntry, McpGateway, McpServerRequest } from "./products/mcp.js";
 export type { FileEvent, FileEventType, WatchHandle, WatchNotice, WatchOptions, } from "./products/watch.js";
 export type { Mount, MountBucket } from "./products/mounts.js";
-export type { Volume, VolumeBackup, CreateVolume } from "./products/volumes.js";
+export type { TailscaleJoin, TailscaleJoined, TailscaleNode, TailscaleStatus, } from "./products/tailscale.js";
+export type { Volume, VolumeBackup, CreateVolume, VolumeAttachment } from "./products/volumes.js";
 export type { CreateJob, Job, JobCompute, JobDefinition, JobLogs, JobRun, JobRunState, JobSchedule, } from "./products/jobs.js";
 export type { CheckedDomain, DnsRecord, Domain, EgressAddress, TcpPort, Tunnel as PrivateTunnel, TunnelPeer, TunnelPeerCreated, SetUpstreamProxy, UpstreamProxy, } from "./products/network-products.js";
 export { verifyWebhook, WebhookVerificationError, type MetricPoint, type MetricRange, type OtelExport, type RuntimeEvent, type SandboxMetrics, type Webhook, type WebhookDelivery, type WebhookEventType, } from "./products/observability.js";

package/dist/login.js

@@ -4,7 +4,7 @@ import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { me, named } from "./cli-name.js";
 import { Runtime } from "./client.js";
-import { connectionOrigins, connectionStore } from "./credentials.js";
+import { checkBrowserOrigins, connectionOrigins, connectionStore } from "./credentials.js";
 import { describeRoute, envFetch } from "./proxy.js";
 class ConnectionError extends Error {
     status;
@@ -100,7 +100,16 @@ function connection(env, options) {
                 : response.status === 429
                     ? "Too many connection attempts. Try again later."
                     : "Runtime could not complete this connection. Try again.");
-        return (await response.json());
+        try {
+            return (await response.json());
+        }
+        catch (error) {
+            // A complete malformed answer remains terminal. A failed body read can
+            // hide an issued token, so keep its private key and retry the same request.
+            if (error instanceof SyntaxError)
+                throw error;
+            throw new ConnectionError(503, "Runtime's connection response was interrupted. Retry the connection.");
+        }
     }
     return { origins, store, request, fetcher };
 }
@@ -118,7 +127,7 @@ export async function authenticationCommand(args, env, options = {}) {
         // A pasted key belongs to the website's key list: forget it here, and
         // revoke it there if it should stop working everywhere.
         if (saved.connectionId === PASTED) {
-            await store.remove();
+            await store.remove(saved.key);
             return { disconnected: true };
         }
         try {
@@ -128,7 +137,7 @@ export async function authenticationCommand(args, env, options = {}) {
             if (!(error instanceof ConnectionError && error.status === 401))
                 throw error;
         }
-        await store.remove();
+        await store.remove(saved.key);
         return { disconnected: true };
     }
     if (command !== "login")
@@ -160,11 +169,7 @@ export async function authenticationCommand(args, env, options = {}) {
         agentName.length > 80 ||
         [...agentName].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
         throw new Error("Give the agent a name of up to 80 characters.");
-    // Never obtain a production key and then direct it at an unrelated API.
-    const local = (origin) => ["localhost", "127.0.0.1", "[::1]"].includes(new URL(origin).hostname);
-    if (!((origins.auth === "https://withruntime.com" && origins.api === "https://api.withruntime.com") ||
-        (local(origins.auth) && local(origins.api))))
-        throw new Error("Browser login supports Runtime's production endpoints or local test endpoints. Check RUNTIME_AUTH_URL and RUNTIME_API_URL.");
+    checkBrowserOrigins(origins);
     if (withKey) {
         // The fallback to a browser approval: a key from the website, read from
         // standard input so it never sits in a command line or shell history.
@@ -200,7 +205,7 @@ export async function authenticationCommand(args, env, options = {}) {
         catch (error) {
             if (!(error instanceof ConnectionError && error.status === 401))
                 throw error;
-            await store.remove();
+            await store.remove(saved.key);
         }
     }
     const pending = await beginDeviceLogin(env, agentName, options);
@@ -245,6 +250,7 @@ export async function authenticationCommand(args, env, options = {}) {
  * the agent, which shows it to the person it works for. */
 export async function beginDeviceLogin(env, agentName, options = {}) {
     const { origins, store, request } = connection(env, options);
+    checkBrowserOrigins(origins);
     // A request this machine already started and nobody has answered yet: pick
     // it up, so a command stopped while it waited (an agent's tool timing out)
     // shows the same link and code again rather than a new one to approve.

package/dist/mcp.js

@@ -3,7 +3,7 @@ import { resolveCredential } from "./credentials.js";
 import { RuntimeError } from "./errors.js";
 import { beginDeviceLogin } from "./login.js";
 import { envFetch } from "./proxy.js";
-import { apiOrigin, VERSION } from "./transport.js";
+import { apiOrigin, defaultBaseUrl, VERSION } from "./transport.js";
 const CONNECT_INSTRUCTIONS = "Runtime is not connected on this machine yet. Call runtime_connect: it gives you a link and a code for the person you work for to approve in their browser (no key to copy). Once they have, call runtime_connect again; Runtime's tools then appear (sandboxes, commands, files and the rest).";
 const connectTool = {
     name: "runtime_connect",
@@ -32,7 +32,7 @@ export async function serveMcp(env = process.env, options = {}) {
         if (!(error instanceof RuntimeError && error.code === "missing_api_key"))
             throw error;
     }
-    const origin = apiOrigin(env.RUNTIME_API_URL ?? "https://api.withruntime.com");
+    const origin = apiOrigin(defaultBaseUrl(env));
     const endpoint = new URL("/mcp", origin).href;
     let protocolVersion;
     let session;

package/dist/modal/index.d.ts

@@ -0,0 +1,205 @@
+import type { Runtime } from "../client.js";
+import type { Process, Sandbox as NativeSandbox } from "../sandbox.js";
+import { CompatibilityError, type ClientOptions } from "../compat/core.js";
+export { CompatibilityError };
+export declare class NotFoundError extends Error {
+}
+export declare class TimeoutError extends Error {
+}
+export declare class SandboxTimeoutError extends TimeoutError {
+}
+export declare class App {
+    readonly appId: string;
+    readonly name?: string | undefined;
+    readonly environmentName?: string | undefined;
+    constructor(appId: string, name?: string | undefined, environmentName?: string | undefined);
+}
+export type SandboxCreateParams = {
+    name?: string;
+    cpu?: number;
+    cpuLimit?: number;
+    memoryMiB?: number;
+    memoryLimitMiB?: number;
+    timeoutMs?: number;
+    workdir?: string;
+    command?: string[];
+    env?: Record<string, string>;
+    encryptedPorts?: number[];
+    blockNetwork?: boolean;
+    outboundDomainAllowlist?: string[];
+    outboundCidrAllowlist?: string[];
+    tags?: Record<string, string>;
+    regions?: string[];
+    gpu?: string;
+    pty?: boolean;
+    secrets?: Secret[];
+    experimentalEnableSnapshot?: boolean;
+};
+export type SandboxExecParams = {
+    mode?: "text" | "binary";
+    stdout?: "pipe" | "ignore";
+    stderr?: "pipe" | "ignore";
+    workdir?: string;
+    timeoutMs?: number;
+    env?: Record<string, string>;
+    pty?: boolean;
+    secrets?: Secret[];
+};
+export declare class Secret {
+    readonly values: Record<string, string>;
+    constructor(values: Record<string, string>);
+}
+export declare class ModalClient {
+    readonly runtime: Runtime;
+    readonly apps: {
+        fromName: (name: string, params?: {
+            createIfMissing?: boolean;
+            environment?: string;
+        }) => Promise<App>;
+    };
+    readonly images: {
+        fromRegistry: (tag: string, secret?: Secret) => Image;
+        fromId: (id: string) => Promise<Image>;
+        fromName: (name: string) => Promise<Image>;
+        delete: (id: string) => Promise<import("../products/images.js").Image>;
+    };
+    readonly sandboxes: SandboxService;
+    readonly secrets: {
+        fromObject: (values: Record<string, string>) => Secret;
+    };
+    constructor(options?: ClientOptions & {
+        tokenId?: string;
+        tokenSecret?: string;
+        environment?: string;
+    });
+    close(): void;
+}
+export declare class Image {
+    private readonly runtime;
+    private readonly tag?;
+    private readonly commands;
+    private readonly env;
+    private readonly cache;
+    private built?;
+    constructor(runtime: Runtime, tag?: string | undefined, id?: string, commands?: string[], env?: Record<string, string>, cache?: boolean);
+    get imageId(): string;
+    dockerfileCommands(commands: string[], params?: {
+        env?: Record<string, string>;
+        forceBuild?: boolean;
+    }): Image;
+    build(_app?: App): Promise<Image>;
+}
+export declare class SandboxService {
+    private readonly runtime;
+    constructor(runtime: Runtime);
+    create(app: App, image: Image, params?: SandboxCreateParams): Promise<Sandbox>;
+    fromId(id: string): Promise<Sandbox>;
+    fromName(appName: string, name: string): Promise<Sandbox>;
+    list(params?: {
+        appId?: string;
+        tags?: Record<string, string>;
+    }): AsyncGenerator<Sandbox, void, unknown>;
+}
+export declare class ModalReadStream<R extends string | Uint8Array = string> extends ReadableStream<R> {
+    constructor(process: Process, channel: "stdout" | "stderr", mode: "text" | "binary", ignore?: boolean);
+    readBytes(): Promise<Uint8Array<ArrayBuffer>>;
+    readText(): Promise<string>;
+}
+export declare class ModalWriteStream<R extends string | Uint8Array = string> extends WritableStream<R> {
+    private readonly process;
+    constructor(process: Process);
+    writeText(text: string): Promise<void>;
+    writeBytes(bytes: Uint8Array): Promise<void>;
+}
+export declare class ContainerProcess<R extends string | Uint8Array = string> {
+    readonly native: Process;
+    readonly stdin: ModalWriteStream<R>;
+    readonly stdout: ModalReadStream<R>;
+    readonly stderr: ModalReadStream<R>;
+    constructor(native: Process, mode: "text" | "binary", params?: SandboxExecParams);
+    wait(): Promise<number>;
+    closeStdin(): Promise<void>;
+    _poll(): Promise<number | null>;
+}
+export declare class Sandbox {
+    readonly native: NativeSandbox;
+    private readonly primary;
+    readonly filesystem: SandboxFilesystem;
+    readonly stdin: ModalWriteStream<string>;
+    readonly stdout: ModalReadStream<string>;
+    readonly stderr: ModalReadStream<string>;
+    private detached;
+    private lifecycle?;
+    monitorEntrypoint(): void;
+    constructor(native: NativeSandbox, primary: ContainerProcess);
+    get sandboxId(): string;
+    exec(command: string[], params?: SandboxExecParams & {
+        mode?: "text";
+    }): Promise<ContainerProcess<string>>;
+    exec(command: string[], params: SandboxExecParams & {
+        mode: "binary";
+    }): Promise<ContainerProcess<Uint8Array>>;
+    setTags(tags: Record<string, string>): Promise<void>;
+    getTags(): Promise<Record<string, string>>;
+    terminate(params?: {
+        wait?: boolean;
+    }): Promise<number | undefined>;
+    detach(): void;
+    wait(): Promise<number>;
+    poll(): Promise<number | null>;
+    tunnels(): Promise<{
+        [k: string]: {
+            host: string;
+            port: number;
+            url: string;
+        };
+    }>;
+    updateNetworkPolicy(params: {
+        outboundCidrAllowlist: string[];
+        outboundDomainAllowlist: string[];
+    }): Promise<void>;
+    experimentalSnapshot(): Promise<{
+        sandboxSnapshotId: string;
+    }>;
+}
+export declare class SandboxFilesystem {
+    private readonly native;
+    private readonly files;
+    constructor(native: NativeSandbox);
+    readBytes(path: string): Promise<Uint8Array<ArrayBufferLike>>;
+    readText(path: string): Promise<string>;
+    writeBytes(content: Uint8Array | ArrayBuffer, path: string): Promise<void>;
+    writeText(content: string, path: string): Promise<void>;
+    makeDirectory(path: string, options?: {
+        createParents?: boolean;
+    }): Promise<void>;
+    remove(path: string, options?: {
+        recursive?: boolean;
+    }): Promise<void>;
+    copyFromLocal(localPath: string, remotePath: string): Promise<void>;
+    copyToLocal(remotePath: string, localPath: string): Promise<void>;
+    listFiles(path: string): Promise<{
+        name: string;
+        path: string;
+        type: "file" | "directory" | "symlink" | "other";
+        size: number;
+        mode: number;
+        permissions: string;
+        owner: string;
+        group: string;
+        modifiedTime: number;
+        symlinkTarget: string | null;
+    }[]>;
+    stat(path: string): Promise<{
+        name: string;
+        path: string;
+        type: "file" | "directory" | "symlink" | "other";
+        size: number;
+        mode: number;
+        permissions: string;
+        owner: string;
+        group: string;
+        modifiedTime: number;
+        symlinkTarget: string | null;
+    }>;
+}