withruntime 0.8.4 → 0.9.0

package/dist/modal/index.js

@@ -0,0 +1,485 @@
+import { all, client, CompatibilityError, create, destroy, execOptions, only, region, } from "../compat/core.js";
+import { GuestFiles } from "../compat/files.js";
+export { CompatibilityError };
+export class NotFoundError extends Error {
+}
+export class TimeoutError extends Error {
+}
+export class SandboxTimeoutError extends TimeoutError {
+}
+export class App {
+    appId;
+    name;
+    environmentName;
+    constructor(appId, name, environmentName) {
+        this.appId = appId;
+        this.name = name;
+        this.environmentName = environmentName;
+    }
+}
+export class Secret {
+    values;
+    constructor(values) {
+        this.values = values;
+    }
+}
+export class ModalClient {
+    runtime;
+    apps;
+    images;
+    sandboxes;
+    secrets = { fromObject: (values) => new Secret(values) };
+    constructor(options = {}) {
+        only("Modal client", options, [
+            "apiKey",
+            "baseUrl",
+            "fetch",
+            "client",
+            "timeoutMs",
+            "maxRetries",
+            "tokenId",
+            "tokenSecret",
+            "environment",
+        ]);
+        this.runtime = client(options);
+        const runtime = this.runtime;
+        this.apps = {
+            fromName: async (name, params = {}) => {
+                only("Modal app", params, ["createIfMissing", "environment"]);
+                if (params.environment || options.environment)
+                    throw new CompatibilityError("Modal", "named Modal environments");
+                if (!params.createIfMissing &&
+                    !(await all(runtime, "modal")).some((s) => s.info.labels["modal.app"] === name))
+                    throw new NotFoundError(`App ${name} has no Runtime sandboxes; pass createIfMissing: true.`);
+                return new App(name, name);
+            },
+        };
+        this.images = {
+            fromRegistry: (tag, secret) => {
+                if (secret)
+                    throw new CompatibilityError("Modal", "registry Secret; configure Runtime image registry credentials");
+                return new Image(runtime, tag);
+            },
+            fromId: async (id) => new Image(runtime, undefined, (await runtime.images.get(id)).id),
+            fromName: async (name) => new Image(runtime, undefined, (await runtime.images.resolve(name)).id),
+            delete: (id) => runtime.images.delete(id),
+        };
+        this.sandboxes = new SandboxService(runtime);
+    }
+    close() {
+        /* Transport has no owned background connection to close. */
+    }
+}
+export class Image {
+    runtime;
+    tag;
+    commands;
+    env;
+    cache;
+    built;
+    constructor(runtime, tag, id, commands = [], env = {}, cache = true) {
+        this.runtime = runtime;
+        this.tag = tag;
+        this.commands = commands;
+        this.env = env;
+        this.cache = cache;
+        this.built = id;
+    }
+    get imageId() {
+        if (!this.built)
+            throw new Error("Image is not built; await image.build(app) first.");
+        return this.built;
+    }
+    dockerfileCommands(commands, params = {}) {
+        only("Modal image", params, ["env", "forceBuild"]);
+        if (!this.tag)
+            throw new CompatibilityError("Modal", "extending a prebuilt Runtime image through Dockerfile layers");
+        return new Image(this.runtime, this.tag, undefined, [...this.commands, ...commands], { ...this.env, ...params.env }, params.forceBuild ? false : this.cache);
+    }
+    async build(_app) {
+        if (!this.built) {
+            const built = this.commands.length
+                ? await this.runtime.images.build({
+                    dockerfile: [`FROM ${this.tag}`, ...this.commands].join("\n"),
+                    env: this.env,
+                    cache: this.cache,
+                })
+                : await this.runtime.images.build({ image: this.tag, env: this.env, cache: this.cache });
+            this.built = built.id;
+        }
+        return this;
+    }
+}
+export class SandboxService {
+    runtime;
+    constructor(runtime) {
+        this.runtime = runtime;
+    }
+    async create(app, image, params = {}) {
+        only("Modal sandbox", params, [
+            "name",
+            "cpu",
+            "cpuLimit",
+            "memoryMiB",
+            "memoryLimitMiB",
+            "timeoutMs",
+            "workdir",
+            "command",
+            "env",
+            "encryptedPorts",
+            "blockNetwork",
+            "outboundDomainAllowlist",
+            "outboundCidrAllowlist",
+            "tags",
+            "regions",
+            "gpu",
+            "pty",
+            "secrets",
+            "experimentalEnableSnapshot",
+        ]);
+        if (params.gpu)
+            throw new CompatibilityError("Modal", "GPU allocation");
+        if (params.cpuLimit !== undefined && params.cpuLimit !== params.cpu)
+            throw new CompatibilityError("Modal", "separate CPU reservation and hard limit");
+        if (params.memoryLimitMiB !== undefined && params.memoryLimitMiB !== params.memoryMiB)
+            throw new CompatibilityError("Modal", "separate memory reservation and hard limit");
+        if (params.regions && params.regions.length !== 1)
+            throw new CompatibilityError("Modal", "multiple region placement");
+        if (params.cpu !== undefined && !Number.isInteger(params.cpu))
+            throw new CompatibilityError("Modal", "fractional CPU reservations");
+        if (params.blockNetwork && (params.outboundDomainAllowlist || params.outboundCidrAllowlist))
+            throw new TypeError("blockNetwork cannot be combined with allowlists");
+        const built = await image.build(app);
+        let primary;
+        const s = await create(this.runtime, "modal", {
+            name: params.name ? `${app.name ?? app.appId}-${params.name}` : undefined,
+            labels: {
+                "modal.app": app.name ?? app.appId,
+                ...(params.name ? { "modal.name": params.name } : {}),
+                "modal.tags": JSON.stringify(params.tags ?? {}),
+            },
+            image: built.imageId,
+            cpu: "reserved",
+            vcpu: params.cpu,
+            memoryMiB: params.memoryMiB,
+            region: region("Modal", params.regions?.[0]),
+            timeoutSeconds: Math.ceil((params.timeoutMs ?? 300_000) / 1000),
+            idlePauseSeconds: 0,
+            onLeaseEnd: "stop",
+            network: {
+                internet: !params.blockNetwork,
+                allow: [
+                    ...(params.outboundDomainAllowlist ?? []),
+                    ...(params.outboundCidrAllowlist ?? []),
+                ],
+            },
+        }, Object.assign({}, ...(params.secrets?.map((s) => s.values) ?? []), params.env ?? {}), async (s) => {
+            primary = await s.spawn(params.command ?? ["sleep", "infinity"], {
+                ...(await execOptions(s, { cwd: params.workdir })),
+                stdin: "pipe",
+                pty: params.pty ? {} : undefined,
+            });
+            await s.update({ labels: { ...s.info.labels, "modal.entrypoint": primary.id } });
+            for (const port of params.encryptedPorts ?? [])
+                await s.previews.create(port, { visibility: "public" });
+        });
+        const sandbox = new Sandbox(s, new ContainerProcess(primary, "text"));
+        sandbox.monitorEntrypoint();
+        return sandbox;
+    }
+    async fromId(id) {
+        const s = await this.runtime.sandboxes.get(id);
+        const p = s.info.labels["modal.entrypoint"];
+        if (!p)
+            throw new NotFoundError("Sandbox is not a Modal-compatible sandbox");
+        return new Sandbox(s, new ContainerProcess(await s.processes.get(p), "text"));
+    }
+    async fromName(appName, name) {
+        const s = (await all(this.runtime, "modal")).find((s) => s.info.labels["modal.app"] === appName &&
+            s.info.labels["modal.name"] === name &&
+            s.state === "running");
+        if (!s)
+            throw new NotFoundError(`Sandbox ${name} not found`);
+        return this.fromId(s.id);
+    }
+    async *list(params = {}) {
+        only("Modal list", params, ["appId", "tags"]);
+        for (const s of await all(this.runtime, "modal"))
+            if (s.state === "running" &&
+                (!params.appId || s.info.labels["modal.app"] === params.appId) &&
+                Object.entries(params.tags ?? {}).every(([k, v]) => JSON.parse(s.info.labels["modal.tags"] ?? "{}")[k] === v))
+                yield await this.fromId(s.id);
+    }
+}
+export class ModalReadStream extends ReadableStream {
+    constructor(process, channel, mode, ignore = false) {
+        const iterator = mode === "binary" ? process.outputBytes() : process.output();
+        super({
+            async pull(controller) {
+                if (ignore) {
+                    controller.close();
+                    return;
+                }
+                try {
+                    while (true) {
+                        const next = await iterator.next();
+                        if (next.done) {
+                            controller.close();
+                            return;
+                        }
+                        if (next.value.type === "truncated")
+                            throw new Error("Process output was truncated");
+                        if (next.value.type === channel) {
+                            controller.enqueue(next.value.data);
+                            return;
+                        }
+                    }
+                }
+                catch (error) {
+                    controller.error(error);
+                }
+            },
+            async cancel() {
+                await iterator.return(undefined);
+            },
+        });
+    }
+    async readBytes() {
+        const reader = this.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+            while (true) {
+                const next = await reader.read();
+                if (next.done)
+                    break;
+                const bytes = typeof next.value === "string" ? new TextEncoder().encode(next.value) : next.value;
+                chunks.push(bytes);
+                size += bytes.length;
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const output = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            output.set(chunk, offset);
+            offset += chunk.length;
+        }
+        return output;
+    }
+    async readText() {
+        return new TextDecoder().decode(await this.readBytes());
+    }
+}
+export class ModalWriteStream extends WritableStream {
+    process;
+    constructor(process) {
+        super({ write: (data) => process.write(data), close: () => process.write("", { eof: true }) });
+        this.process = process;
+    }
+    async writeText(text) {
+        const writer = this.getWriter();
+        try {
+            await writer.write(text);
+        }
+        finally {
+            writer.releaseLock();
+        }
+    }
+    async writeBytes(bytes) {
+        const writer = this.getWriter();
+        try {
+            await writer.write(bytes);
+        }
+        finally {
+            writer.releaseLock();
+        }
+    }
+}
+export class ContainerProcess {
+    native;
+    stdin;
+    stdout;
+    stderr;
+    constructor(native, mode, params = {}) {
+        this.native = native;
+        this.stdin = new ModalWriteStream(native);
+        this.stdout = new ModalReadStream(native, "stdout", mode, params.stdout === "ignore");
+        this.stderr = new ModalReadStream(native, "stderr", mode, params.stderr === "ignore");
+    }
+    async wait() {
+        const r = await this.native.wait();
+        if (r.timedOut)
+            throw new SandboxTimeoutError("Process timed out");
+        return r.exitCode ?? -1;
+    }
+    closeStdin() {
+        return this.native.write("", { eof: true });
+    }
+    async _poll() {
+        const p = await this.native.refresh();
+        return p.state === "running" ? null : p.exitCode;
+    }
+}
+export class Sandbox {
+    native;
+    primary;
+    filesystem;
+    stdin;
+    stdout;
+    stderr;
+    detached = false;
+    lifecycle;
+    monitorEntrypoint() {
+        this.lifecycle = this.primary.wait().then(async (code) => {
+            await destroy(this.native);
+            return code;
+        });
+        this.lifecycle.catch(() => undefined);
+    }
+    constructor(native, primary) {
+        this.native = native;
+        this.primary = primary;
+        this.filesystem = new SandboxFilesystem(native);
+        this.stdin = primary.stdin;
+        this.stdout = primary.stdout;
+        this.stderr = primary.stderr;
+    }
+    get sandboxId() {
+        return this.native.id;
+    }
+    async exec(command, params = {}) {
+        if (this.detached)
+            throw new Error("Sandbox is detached");
+        only("Modal exec", params, [
+            "mode",
+            "stdout",
+            "stderr",
+            "workdir",
+            "timeoutMs",
+            "env",
+            "pty",
+            "secrets",
+        ]);
+        const p = await this.native.spawn(command, {
+            ...(await execOptions(this.native, {
+                cwd: params.workdir,
+                timeoutMs: params.timeoutMs === 0 ? 86_400_000 : params.timeoutMs,
+                env: Object.assign({}, ...(params.secrets?.map((s) => s.values) ?? []), params.env ?? {}),
+            })),
+            stdin: "pipe",
+            ...(params.mode === "binary" ? { outputEncoding: "base64" } : {}),
+            pty: params.pty ? {} : undefined,
+        });
+        return new ContainerProcess(p, params.mode ?? "text", params);
+    }
+    async setTags(tags) {
+        if (this.detached)
+            throw new Error("Sandbox is detached");
+        await this.native.update({
+            labels: {
+                ...Object.fromEntries(Object.entries(this.native.info.labels).filter(([k]) => k.startsWith("modal.") || k === "compat.provider")),
+                "modal.tags": JSON.stringify(tags),
+            },
+        });
+    }
+    async getTags() {
+        if (this.detached)
+            throw new Error("Sandbox is detached");
+        await this.native.refresh();
+        return JSON.parse(this.native.info.labels["modal.tags"] ?? "{}");
+    }
+    async terminate(params = {}) {
+        await destroy(this.native);
+        return params.wait ? this.primary.wait() : undefined;
+    }
+    detach() {
+        this.detached = true;
+    }
+    async wait() {
+        if (this.lifecycle)
+            return this.lifecycle;
+        const code = await this.primary.wait();
+        await destroy(this.native);
+        return code;
+    }
+    poll() {
+        return this.primary._poll();
+    }
+    async tunnels() {
+        return Object.fromEntries((await this.native.previews.list()).map((p) => [
+            p.port,
+            { host: new URL(p.url).hostname, port: 443, url: p.urlWithToken ?? p.url },
+        ]));
+    }
+    async updateNetworkPolicy(params) {
+        await this.native.network.set({
+            internet: true,
+            allow: [...params.outboundCidrAllowlist, ...params.outboundDomainAllowlist],
+        });
+    }
+    async experimentalSnapshot() {
+        const snapshot = await this.native.snapshot();
+        return { sandboxSnapshotId: snapshot.id };
+    }
+}
+export class SandboxFilesystem {
+    native;
+    files;
+    constructor(native) {
+        this.native = native;
+        this.files = new GuestFiles(async () => native, "/");
+    }
+    readBytes(path) {
+        return this.files.readFile(path);
+    }
+    readText(path) {
+        return this.files.readTextFile(path);
+    }
+    writeBytes(content, path) {
+        return this.files.writeFile(path, content instanceof Uint8Array ? content : new Uint8Array(content));
+    }
+    writeText(content, path) {
+        return this.files.writeTextFile(path, content);
+    }
+    makeDirectory(path, options = {}) {
+        return this.files.mkdir(path, options.createParents ?? true);
+    }
+    remove(path, options = {}) {
+        return this.files.remove(path, options.recursive);
+    }
+    copyFromLocal(localPath, remotePath) {
+        return this.native.files.upload(localPath, remotePath);
+    }
+    copyToLocal(remotePath, localPath) {
+        return this.native.files.download(remotePath, localPath);
+    }
+    async listFiles(path) {
+        return Promise.all((await this.files.readdir(path))
+            .sort((a, b) => a.name.localeCompare(b.name))
+            .map((e) => this.stat(e.path)));
+    }
+    async stat(path) {
+        const e = await this.files.stat(path);
+        const r = await this.native.exec(["stat", "-c", "%U:%G", "--", this.files.path(path)], {
+            check: true,
+        });
+        const [owner, group] = r.stdout.trim().split(":");
+        return {
+            name: e.name,
+            path: e.path,
+            type: e.type,
+            size: e.size,
+            mode: parseInt(e.mode, 8),
+            permissions: e.mode,
+            owner: owner,
+            group: group,
+            modifiedTime: Date.parse(e.modifiedAt) / 1000,
+            symlinkTarget: e.type === "symlink"
+                ? (await this.native.exec(["readlink", "--", this.files.path(path)], { check: true })).stdout.trimEnd()
+                : null,
+        };
+    }
+}

package/dist/network-cli.js

@@ -30,7 +30,7 @@ export const NETWORK_HELP = {
                                          Redis, a game server, anything that is not HTTP
                                          Prints address:port for your client
   ls [--sandbox <id>]                    Your open ports
-  close <portId>                         Close one; open connections end within seconds
+  close <portId>                         Close one, its open connections too
   Paid accounts only. TCP, carried as it is: use your service's own password and TLS.
 `,
     address: `runtime address <command>

package/dist/openai-agents/index.js

@@ -18,6 +18,7 @@
  * RUNTIME_API_KEY or this machine's `runtime login`. Plain function tools for
  * an ordinary `Agent` are `runtimeFunctionTools(sandbox)`. */
 import { applyDiff, tool, UserError, } from "@openai/agents-core";
+import { OPENAI_AGENTS_EXEC_TIMEOUT_MS } from "../api-defaults.js";
 import { SandboxProviderError, SandboxUnsupportedFeatureError, normalizeSandboxClientCreateArgs, } from "@openai/agents-core/sandbox";
 import { deserializeManifest, elapsedSeconds, formatExecResponse, imageOutputFromBytes, materializeEnvironment, mergeManifestDelta, mergeManifestEntryDelta, serializeManifestRecord, shellQuote, truncateOutput, } from "@openai/agents-core/sandbox/internal";
 import { Runtime } from "../client.js";
@@ -477,31 +478,11 @@ export class RuntimeCloudSandboxSession {
                 await this.#writeBytes(path, await readFile(entry.src));
                 return;
             }
-            case "local_dir": {
-                // One gzipped tar, staged inside /workspace where uploads of any size are accepted.
-                const { packDirectory } = await import("../tar.js");
-                const staging = `${STAGING}/${crypto.randomUUID()}.tar.gz`;
-                const archive = await packDirectory(entry.src);
-                try {
-                    await this.#call((sbx) => sbx.files.write(staging, archive));
-                    const unpacked = await this.#call((sbx) => sbx.exec([
-                        "sh",
-                        "-c",
-                        'mkdir -p -- "$1" && tar -xzf "$2" -C "$1"',
-                        "sh",
-                        path,
-                        staging,
-                    ]));
-                    if (unpacked.exitCode !== 0)
-                        throw new SandboxProviderError(`${PROVIDER} could not place ${entry.src}.`, {
-                            stderr: unpacked.stderr,
-                        });
-                }
-                finally {
-                    await this.#call((sbx) => sbx.files.remove(staging)).catch(() => undefined);
-                }
+            case "local_dir":
+                // One archive through the API's folder routes, unpacked by the
+                // sandbox's own tar as it arrives.
+                await this.#call((sbx) => sbx.files.upload(entry.src, path));
                 return;
-            }
             case "git_repo": {
                 const url = /^[a-z]+:\/\//.test(entry.repo)
                     ? entry.repo
@@ -674,7 +655,7 @@ export class RuntimeCloudSandboxClient {
             ...(options.exposedPorts ? { configuredExposedPorts: options.exposedPorts } : {}),
             previewVisibility: options.previewVisibility ?? "private",
             pauseOnExit: options.pauseOnExit ?? false,
-            execTimeoutMs: Math.min(MAX_EXEC_MS, options.execTimeoutMs ?? 3_600_000),
+            execTimeoutMs: Math.min(MAX_EXEC_MS, options.execTimeoutMs ?? OPENAI_AGENTS_EXEC_TIMEOUT_MS),
         };
         const session = new RuntimeCloudSandboxSession({ state, runtime: this.runtime });
         await session.sandbox();
@@ -764,7 +745,9 @@ export class RuntimeCloudSandboxClient {
                 : {}),
             previewVisibility: record.previewVisibility === "public" ? "public" : "private",
             pauseOnExit: record.pauseOnExit === true,
-            execTimeoutMs: typeof record.execTimeoutMs === "number" ? record.execTimeoutMs : 3_600_000,
+            execTimeoutMs: typeof record.execTimeoutMs === "number"
+                ? record.execTimeoutMs
+                : OPENAI_AGENTS_EXEC_TIMEOUT_MS,
         };
     }
 }

package/dist/products/audit.d.ts

@@ -26,6 +26,9 @@ export type AuditEvent = {
     ip: string | null;
     requestId: string | null;
     via: "web" | "api" | "mcp" | "runtime";
+    /** The sandbox the request came from, when code in it called the API at
+     * http://runtime.internal. */
+    sandbox: string | null;
 };
 export type AuditPage = {
     events: AuditEvent[];

package/dist/products/index.d.ts

@@ -15,6 +15,7 @@ import { limits } from "./limits.js";
 import { volumes } from "./volumes.js";
 import { jobs } from "./jobs.js";
 import { sandboxMounts } from "./mounts.js";
+import { sandboxTailscale } from "./tailscale.js";
 import { secrets } from "./secrets.js";
 import { mcp, sandboxMcp } from "./mcp.js";
 import { events, otel, sandboxMetrics, webhooks } from "./observability.js";
@@ -45,6 +46,7 @@ export declare const sandboxExtensions: {
     network: typeof sandboxNetwork;
     desktop: typeof sandboxDesktop;
     mounts: typeof sandboxMounts;
+    tailscale: typeof sandboxTailscale;
     metrics: typeof sandboxMetrics;
     mcp: typeof sandboxMcp;
 };

package/dist/products/index.js

@@ -13,6 +13,7 @@ import { limits } from "./limits.js";
 import { volumes } from "./volumes.js";
 import { jobs } from "./jobs.js";
 import { sandboxMounts } from "./mounts.js";
+import { sandboxTailscale } from "./tailscale.js";
 import { secrets } from "./secrets.js";
 import { mcp, sandboxMcp } from "./mcp.js";
 import { events, otel, sandboxMetrics, webhooks } from "./observability.js";
@@ -58,6 +59,7 @@ export const sandboxExtensions = {
     network: sandboxNetwork,
     desktop: sandboxDesktop,
     mounts: sandboxMounts,
+    tailscale: sandboxTailscale,
     metrics: sandboxMetrics,
     mcp: sandboxMcp,
 };

package/dist/products/interpreter.d.ts

@@ -50,15 +50,22 @@ export type RunOptions = RequestOptions & {
     /** A context id; each language's own name ("python", "typescript", "r"...) is
      * its default context, started on first use. */
     context?: string;
+    /** Cell deadline. 0 runs until completion, cancellation or the sandbox's lease ends. */
     timeoutMs?: number;
-    onStdout?: (text: string) => void;
-    onStderr?: (text: string) => void;
-    onResult?: (result: ExecutionResult) => void;
+    /** Separate HTTP deadline, including retries. 0 disables it. */
+    requestTimeoutMs?: number;
+    /** false lets the cell continue if this reader disconnects. Default true. */
+    interruptOnDisconnect?: boolean;
+    /** @internal Compatibility protocols with separate header/body deadlines. */
+    onResponse?: (response: Response) => void;
+    onStdout?: (text: string) => unknown;
+    onStderr?: (text: string) => unknown;
+    onResult?: (result: ExecutionResult) => unknown;
     onError?: (error: {
         name: string;
         value: string;
         traceback: string;
-    }) => void;
+    }) => unknown;
 };
 /** A stateful interpreter in the sandbox, in Python, JavaScript, TypeScript,
  * R, Java, Bash or Go: