withruntime 0.9.0 → 0.10.0

package/dist/codesandbox/index.js

@@ -58,6 +58,10 @@ const metadata = (s) => ({
             : (s.info.labels["cs.privacy"] ?? "private"),
     tags: JSON.parse(s.info.labels["cs.tags"] ?? "[]"),
 });
+function validateHibernationTimeout(seconds) {
+    if (seconds !== undefined && (!Number.isSafeInteger(seconds) || seconds < 0 || seconds > 86_400))
+        throw new RangeError("hibernationTimeoutSeconds must be an integer from 0 to 86400.");
+}
 export class Sandboxes {
     runtime;
     constructor(runtime) {
@@ -73,6 +77,7 @@ export class Sandboxes {
             "vmTier",
             "hibernationTimeoutSeconds",
         ]);
+        validateHibernationTimeout(options.hibernationTimeoutSeconds);
         const labels = {
             "compat.provider": "codesandbox",
             "cs.tags": JSON.stringify([...new Set([...(options.tags ?? []), "sdk"])]),
@@ -119,6 +124,7 @@ export class Sandboxes {
     }
     async restart(id, options = {}) {
         only("CodeSandbox restart", options, ["hibernationTimeoutSeconds"]);
+        validateHibernationTimeout(options.hibernationTimeoutSeconds);
         const s = await this.runtime.sandboxes.get(id);
         await s.stop();
         await s.restart();
@@ -143,19 +149,37 @@ export class Sandboxes {
         ]);
         if (options.orderBy === "updated_at")
             throw new CompatibilityError("CodeSandbox", "sorting by updated_at");
-        let sandboxes = (await all(this.runtime, "codesandbox"))
+        const limit = options.limit ?? 50;
+        let currentPage = options.pagination?.page ?? 1;
+        const pageSize = options.pagination?.pageSize ?? limit;
+        for (const [name, value] of [
+            ["limit", limit],
+            ["page", currentPage],
+            ["pageSize", pageSize],
+        ])
+            if (!Number.isSafeInteger(value) || value <= 0)
+                throw new RangeError(`${name} must be a positive safe integer.`);
+        const sandboxes = (await all(this.runtime, "codesandbox"))
             .filter((s) => (!options.status || s.state === "running") &&
             (options.tags ?? []).every((tag) => metadata(s).tags.includes(tag)))
             .map(metadata);
         sandboxes.sort((a, b) => (a.createdAt.getTime() - b.createdAt.getTime()) * (options.direction === "desc" ? -1 : 1));
-        const totalCount = sandboxes.length, page = options.pagination?.page ?? 1, pageSize = options.pagination?.pageSize ?? options.limit ?? 50;
-        sandboxes = sandboxes.slice((page - 1) * pageSize, page * pageSize);
-        const hasMore = page * pageSize < totalCount;
+        const totalCount = sandboxes.length;
+        const selected = [];
+        let nextPage;
+        for (;;) {
+            const offset = (currentPage - 1) * pageSize;
+            selected.push(...sandboxes.slice(offset, offset + pageSize));
+            nextPage = offset + pageSize < totalCount ? currentPage + 1 : null;
+            if (nextPage === null || selected.length >= limit)
+                break;
+            currentPage = nextPage;
+        }
         return {
-            sandboxes,
+            sandboxes: selected,
             totalCount,
-            hasMore,
-            pagination: { currentPage: page, nextPage: hasMore ? page + 1 : null, pageSize },
+            hasMore: totalCount > selected.length,
+            pagination: { currentPage, nextPage, pageSize },
         };
     }
 }
@@ -475,14 +499,22 @@ export class SandboxClient {
         };
         this.ports = {
             get: async (port) => {
+                this.assertConnected();
                 if (native.info.labels["cs.privacy"] === "private")
                     throw new CompatibilityError("CodeSandbox", "private port host authentication; use Runtime signed preview URLs");
                 const p = await native.previews.create(port, { visibility: "public" });
                 this.previewURLs.set(port, p.urlWithToken ?? p.url);
                 return { port, host: new URL(p.urlWithToken ?? p.url).host };
             },
-            getAll: async () => (await native.previews.list()).map((p) => ({ port: p.port, host: new URL(p.url).host })),
+            getAll: async () => {
+                this.assertConnected();
+                return (await native.previews.list()).map((p) => ({
+                    port: p.port,
+                    host: new URL(p.url).host,
+                }));
+            },
             waitForPort: async (port, options = {}) => {
+                this.assertConnected();
                 if (!Number.isInteger(port) || port < 1 || port > 65535)
                     throw new TypeError("Invalid port");
                 await native.exec([
@@ -586,6 +618,8 @@ export class Tasks {
         this.managed = new ManagedTasks(native);
     }
     getAll() {
+        if (this.client.state !== "CONNECTED")
+            return Promise.reject(new Error("Sandbox client is disconnected."));
         return (this.cached ??= this.load().catch((error) => {
             this.cached = undefined;
             throw error;

package/dist/compat/core.d.ts

@@ -1,6 +1,7 @@
-import { Runtime, type RuntimeOptions } from "../client.js";
+import { Runtime, type CreateOptions, type RuntimeOptions } from "../client.js";
 import type { Sandbox } from "../sandbox.js";
 import type { CreateSandbox, ExecOptions } from "../types.js";
+import type { RequestOptions } from "../transport.js";
 export type ClientOptions = RuntimeOptions & {
     client?: Runtime;
 };
@@ -16,14 +17,14 @@ export declare function only(provider: string, value: object, keys: readonly str
 export declare function region(provider: string, value?: string | null): string | undefined;
 export declare const quote: (value: string) => string;
 export declare const pathAt: (path: string, cwd?: string) => string;
-export declare function environment(sandbox: Sandbox): Promise<Record<string, string>>;
-export declare function saveEnvironment(sandbox: Sandbox, env: Record<string, string>): Promise<void>;
+export declare function environment(sandbox: Sandbox, options?: RequestOptions): Promise<Record<string, string>>;
+export declare function saveEnvironment(sandbox: Sandbox, env: Record<string, string>, options?: RequestOptions): Promise<void>;
 export declare function validateEnvironment(env: Record<string, string>): void;
-export declare function execOptions(sandbox: Sandbox, options?: ExecOptions): Promise<ExecOptions>;
-export declare function create(runtime: Runtime, provider: string, input: CreateSandbox, env?: Record<string, string> | undefined, setup?: (sandbox: Sandbox) => Promise<void>): Promise<Sandbox>;
-export declare function destroy(sandbox: Sandbox): Promise<void>;
+export declare function execOptions(sandbox: Sandbox, options?: ExecOptions, request?: RequestOptions): Promise<ExecOptions>;
+export declare function create(runtime: Runtime, provider: string, input: CreateSandbox, env?: Record<string, string> | undefined, setup?: (sandbox: Sandbox) => Promise<void>, options?: CreateOptions): Promise<Sandbox>;
+export declare function destroy(sandbox: Sandbox, options?: RequestOptions): Promise<void>;
 export declare function ready(sandbox: Sandbox): Promise<Sandbox>;
-export declare function lookup(runtime: Runtime, id: string): Promise<Sandbox>;
+export declare function lookup(runtime: Runtime, id: string, options?: RequestOptions): Promise<Sandbox>;
 export declare function all(runtime: Runtime, provider: string): Promise<Sandbox[]>;
 export declare function image(runtime: Runtime, ref: string): Promise<string>;
 export declare function checked(sandbox: Sandbox, argv: string[], options?: ExecOptions): Promise<void>;
@@ -34,6 +35,6 @@ export declare function shellCommand(sandbox: Sandbox, command: string, name?: s
     env?: Record<string, string>;
     cwd?: string;
     persist?: boolean;
-}): Promise<string | string[]>;
+}, request?: RequestOptions): Promise<string | string[]>;
 export declare function closeShell(sandbox: Sandbox, name: string): Promise<void>;
 export declare function shellRoot(name: string): Promise<string>;

package/dist/compat/core.js

@@ -40,9 +40,12 @@ export function region(provider, value) {
 export const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 export const pathAt = (path, cwd = "/workspace") => path.startsWith("/") ? path : `${cwd.replace(/\/$/, "")}/${path}`;
 const ENV_PATH = "/workspace/.runtime-compat/environment.json";
-export async function environment(sandbox) {
+export async function environment(sandbox, options = {}) {
+    options.signal?.throwIfAborted();
     try {
-        return JSON.parse(await sandbox.files.readText(ENV_PATH));
+        const text = await sandbox.files.readText(ENV_PATH, options);
+        options.signal?.throwIfAborted();
+        return JSON.parse(text);
     }
     catch (error) {
         if (error instanceof NotFoundError)
@@ -50,9 +53,14 @@ export async function environment(sandbox) {
         throw error;
     }
 }
-export async function saveEnvironment(sandbox, env) {
+export async function saveEnvironment(sandbox, env, options = {}) {
+    options.signal?.throwIfAborted();
     validateEnvironment(env);
-    await sandbox.files.write(ENV_PATH, JSON.stringify(env), { mode: 0o600 });
+    await sandbox.files.write(ENV_PATH, JSON.stringify(env), {
+        mode: 0o600,
+        signal: options.signal,
+        timeoutMs: options.timeoutMs,
+    });
 }
 export function validateEnvironment(env) {
     for (const key of Object.keys(env))
@@ -62,23 +70,39 @@ export function validateEnvironment(env) {
         if (typeof value !== "string" || value.includes("\0"))
             throw new TypeError("Environment values must be strings without NUL bytes");
 }
-export async function execOptions(sandbox, options = {}) {
-    return { ...options, env: { ...(await environment(sandbox)), ...options.env } };
+export async function execOptions(sandbox, options = {}, request = {}) {
+    const requestOptions = { ...request, signal: request.signal ?? options.signal };
+    return { ...options, env: { ...(await environment(sandbox, requestOptions)), ...options.env } };
 }
-export async function create(runtime, provider, input, env = undefined, setup) {
+export async function create(runtime, provider, input, env = undefined, setup, options = {}) {
+    options.signal?.throwIfAborted();
     if (env !== undefined)
         validateEnvironment(env);
     const sandbox = await runtime.sandboxes.create({
         ...input,
         labels: { ...input.labels, "compat.provider": provider },
-    });
+    }, options);
     try {
+        options.signal?.throwIfAborted();
         if (env !== undefined || !input.snapshot)
-            await saveEnvironment(sandbox, env ?? {});
+            await saveEnvironment(sandbox, env ?? {}, options);
+        options.signal?.throwIfAborted();
         await setup?.(sandbox);
+        options.signal?.throwIfAborted();
         return sandbox;
     }
     catch (error) {
+        // Cancellation cannot authorize deleting a remote resource: the response
+        // may be a retry/reuse of a sandbox that already has somebody's work.
+        // Legacy failed-initialization rollback is limited to an ordinary create
+        // with a new SDK-generated mutation key and no replay/reuse marker.
+        if (options.signal?.aborted ||
+            (error instanceof RuntimeError && error.code === "timeout") ||
+            input.getOrCreate === true ||
+            options.idempotencyKey !== undefined ||
+            sandbox.info.replayed === true ||
+            sandbox.info.reused === true)
+            throw error;
         try {
             await destroy(sandbox);
         }
@@ -88,13 +112,16 @@ export async function create(runtime, provider, input, env = undefined, setup) {
         throw error;
     }
 }
-export async function destroy(sandbox) {
+export async function destroy(sandbox, options = {}) {
     // Stop before releasing persistence: a paused sandbox cannot change its disk
     // meter, and must never be woken solely to delete it. The stopped update queues
     // disk destruction; see ARCHITECTURE.md section 10 and migration 0181.
-    await sandbox.stop();
+    options.signal?.throwIfAborted();
+    if (options.idempotencyKey !== undefined)
+        throw new CompatibilityError("Runtime", "caller idempotency keys for compound sandbox deletion");
+    await sandbox.stop(options);
     if (sandbox.info.persistent)
-        await sandbox.update({ persistent: false });
+        await sandbox.update({ persistent: false }, options);
 }
 export async function ready(sandbox) {
     if (sandbox.state === "paused")
@@ -105,15 +132,18 @@ export async function ready(sandbox) {
         await sandbox.waitFor("running");
     return sandbox;
 }
-export async function lookup(runtime, id) {
+export async function lookup(runtime, id, options = {}) {
+    options.signal?.throwIfAborted();
     if (/^[a-f0-9-]{36}$/i.test(id))
-        return runtime.sandboxes.get(id);
-    const page = await runtime.sandboxes.list({ name: id, includeStopped: true });
-    for await (const sandbox of page)
+        return runtime.sandboxes.get(id, options);
+    const page = await runtime.sandboxes.list({ name: id, includeStopped: true }, options);
+    for await (const sandbox of page) {
+        options.signal?.throwIfAborted();
         if (sandbox.info.name === id)
             return sandbox;
+    }
     // IDs are not necessarily UUIDs in local or self-hosted servers.
-    return runtime.sandboxes.get(id);
+    return runtime.sandboxes.get(id, options);
 }
 export async function all(runtime, provider) {
     const result = [];
@@ -141,14 +171,23 @@ export function missing(path) {
 }
 /** Foreground commands share a resident Bash process. Background commands start
  * from the last completed exported environment/cwd snapshot without blocking it. */
-export async function shellCommand(sandbox, command, name, overrides = {}) {
+export async function shellCommand(sandbox, command, name, overrides = {}, request = {}) {
+    request.signal?.throwIfAborted();
     if (!name)
         return command;
     const root = await shellRoot(name);
-    await sandbox.files.mkdir(root, { parents: true });
+    await sandbox.files.mkdir(root, {
+        parents: true,
+        signal: request.signal,
+        timeoutMs: request.timeoutMs,
+    });
     if (overrides.persist !== false) {
         const script = "/workspace/.runtime-compat/shell.py";
-        await sandbox.files.write(script, SHELL_BROKER, { mode: 0o600 });
+        await sandbox.files.write(script, SHELL_BROKER, {
+            mode: 0o600,
+            signal: request.signal,
+            timeoutMs: request.timeoutMs,
+        });
         return [
             "python3",
             script,
@@ -158,7 +197,7 @@ export async function shellCommand(sandbox, command, name, overrides = {}) {
                 command,
                 env: overrides.env ?? {},
                 cwd: overrides.cwd,
-                baseEnv: await environment(sandbox),
+                baseEnv: await environment(sandbox, request),
             }),
         ];
     }

package/dist/compat/files.js

@@ -25,8 +25,8 @@ export class GuestFiles {
             return;
         }
         const staging = `/workspace/.runtime-compat/write-${crypto.randomUUID()}`;
-        await sandbox.files.write(staging, bytes, { mode: 0o600, signal: options.signal });
         try {
+            await sandbox.files.write(staging, bytes, { mode: 0o600, signal: options.signal });
             await checked(sandbox, [
                 "bash",
                 "-c",
@@ -39,7 +39,9 @@ export class GuestFiles {
             ], { signal: options.signal });
         }
         finally {
-            await sandbox.files.remove(staging);
+            // Cleanup must preserve the write's outcome, including its original
+            // failure; a successful destination write must not invite a replay.
+            await sandbox.files.remove(staging).catch(() => undefined);
         }
     }
     writeTextFile(path, content) {
@@ -58,6 +60,21 @@ export class GuestFiles {
         const sandbox = await this.get();
         if (!overwrite && (await sandbox.files.exists(this.path(to))))
             throw new Error(`Destination exists: ${to}`);
+        if (!overwrite) {
+            // cp -n alone reports success when it skips a raced destination. Stage
+            // privately, then publish without replacement and verify it moved.
+            await checked(sandbox, [
+                "bash",
+                "-c",
+                'set -e; parent=$(dirname -- "$2"); stage="$parent/.runtime-copy-$4"; mkdir -m 700 -- "$stage"; trap \'rm -rf -- "$stage"\' EXIT; if [ "$3" = true ]; then cp -R -n -- "$1" "$stage/item"; else cp -n -- "$1" "$stage/item"; fi; mv -n -T -- "$stage/item" "$2"; if [ -e "$stage/item" ] || [ -L "$stage/item" ]; then printf "Destination exists: %s\\n" "$2" >&2; exit 73; fi',
+                "bash",
+                this.path(from),
+                this.path(to),
+                String(recursive),
+                crypto.randomUUID(),
+            ]);
+            return;
+        }
         await checked(sandbox, [
             "cp",
             ...(recursive ? ["-R"] : []),
@@ -97,8 +114,8 @@ export class GuestFiles {
             return;
         }
         const staging = `/workspace/.runtime-compat/append-${crypto.randomUUID()}`;
-        await sandbox.files.write(staging, bytes, { mode: 0o600 });
         try {
+            await sandbox.files.write(staging, bytes, { mode: 0o600 });
             await checked(sandbox, [
                 "bash",
                 "-c",
@@ -109,7 +126,8 @@ export class GuestFiles {
             ]);
         }
         finally {
-            await sandbox.files.remove(staging);
+            // A cleanup failure after success must not invite appending twice.
+            await sandbox.files.remove(staging).catch(() => undefined);
         }
     }
 }

package/dist/credentials.d.ts

@@ -14,6 +14,9 @@ export declare function connectionOrigins(env: NodeJS.ProcessEnv): {
     api: string;
     auth: string;
 };
+/** Browser-issued production credentials must only reach the production API.
+ * CLI and MCP share this boundary, including resumed device requests. */
+export declare function checkBrowserOrigins(origins: ReturnType<typeof connectionOrigins>): void;
 /** Private user storage, outside project files. Nothing reading this module
  * returns a secret to CLI output. Store names bind credentials to both origins. */
 export declare function connectionStore(env: NodeJS.ProcessEnv, directory?: string): {
@@ -27,7 +30,9 @@ export declare function connectionStore(env: NodeJS.ProcessEnv, directory?: stri
     /** Use another saved account's connection, by account id or name. The one
      * in use moves to the saved accounts. Null when none matches. */
     use(which: string): Promise<SavedConnection | null>;
-    remove(): Promise<void>;
+    /** Forget the expected credential after a remote revoke or refusal. A
+     * concurrent login may have saved another connection during that request. */
+    remove(expectedKey?: string): Promise<void>;
     /** A browser approval that was started and not yet answered, so a command
      * that was stopped while it waited picks up the same link and code rather
      * than asking the person to approve a new one. Unreadable or stale ones

package/dist/credentials.js

@@ -12,6 +12,14 @@ export function connectionOrigins(env) {
         auth: apiOrigin(env.RUNTIME_AUTH_URL ?? "https://withruntime.com"),
     };
 }
+/** Browser-issued production credentials must only reach the production API.
+ * CLI and MCP share this boundary, including resumed device requests. */
+export function checkBrowserOrigins(origins) {
+    const local = (origin) => ["localhost", "127.0.0.1", "[::1]"].includes(new URL(origin).hostname);
+    if (!((origins.auth === "https://withruntime.com" && origins.api === "https://api.withruntime.com") ||
+        (local(origins.auth) && local(origins.api))))
+        throw new Error("Browser login supports Runtime's production endpoints or local test endpoints. Check RUNTIME_AUTH_URL and RUNTIME_API_URL.");
+}
 function defaultDirectory(env) {
     const root = env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
     if (!isAbsolute(root))
@@ -93,8 +101,75 @@ export function connectionStore(env, directory = defaultDirectory(env)) {
                     throw error;
             });
     }
+    const lockFile = join(directory, `${name}.lock`);
+    /** ARCHITECTURE.md section 3.9: concurrent CLI processes keep each account's
+     * connection. Serialize the entire read/modify/write, not only each rename.
+     * Never steal a lock: stale cleanup can otherwise delete a new live lock. */
+    async function updateAccounts(update) {
+        await privateDirectory(true);
+        const until = performance.now() + 10_000;
+        let handle;
+        for (;;) {
+            try {
+                handle = await open(lockFile, "wx", 0o600);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+            const text = await readPrivate(lockFile, 1024, "credential update lock");
+            let pid;
+            try {
+                pid = JSON.parse(text ?? "null")?.pid;
+            }
+            catch {
+                // The holder may not have finished writing its process id yet.
+            }
+            if (typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0) {
+                try {
+                    process.kill(pid, 0);
+                }
+                catch (error) {
+                    if (error.code === "ESRCH")
+                        throw new Error(`A previous Runtime credential update was interrupted. Remove ${lockFile} and retry.`);
+                }
+            }
+            if (performance.now() >= until)
+                throw new Error(`Another Runtime command is updating saved accounts. Retry when it finishes. If no command is running, remove ${lockFile} and retry.`);
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+        try {
+            await handle.writeFile(JSON.stringify({ pid: process.pid }));
+            return await update();
+        }
+        finally {
+            try {
+                await handle.close();
+            }
+            finally {
+                await unlink(lockFile);
+            }
+        }
+    }
     const pendingFile = join(directory, `${name}.pending.json`);
     const accountsFile = join(directory, `${name}.accounts.json`);
+    /** Active and archived connections must satisfy the same contract: switching
+     * accounts cannot publish a credential the next command refuses to read. */
+    function validConnection(value) {
+        if (value === null || typeof value !== "object")
+            return false;
+        const saved = value;
+        return (saved.version === 1 &&
+            saved.apiOrigin === origins.api &&
+            saved.authOrigin === origins.auth &&
+            typeof saved.key === "string" &&
+            /^rtcloud_[a-f0-9-]{36}_[A-Za-z0-9_-]{43}$/.test(saved.key) &&
+            typeof saved.connectionId === "string" &&
+            typeof saved.orgId === "string" &&
+            typeof saved.agentName === "string" &&
+            (saved.orgName === undefined || typeof saved.orgName === "string"));
+    }
     return {
         async read() {
             const text = await readPrivate(file, 4096, "saved connection");
@@ -107,15 +182,7 @@ export function connectionStore(env, directory = defaultDirectory(env)) {
             catch {
                 throw new Error("Runtime's saved connection is invalid. Connect again.");
             }
-            if (saved.version !== 1 ||
-                saved.apiOrigin !== origins.api ||
-                saved.authOrigin !== origins.auth ||
-                typeof saved.key !== "string" ||
-                !/^rtcloud_[a-f0-9-]{36}_[A-Za-z0-9_-]{43}$/.test(saved.key) ||
-                typeof saved.connectionId !== "string" ||
-                typeof saved.orgId !== "string" ||
-                typeof saved.agentName !== "string" ||
-                (saved.orgName !== undefined && typeof saved.orgName !== "string"))
+            if (!validConnection(saved))
                 throw new Error("Runtime's saved connection is invalid. Connect again.");
             return saved;
         },
@@ -125,12 +192,14 @@ export function connectionStore(env, directory = defaultDirectory(env)) {
         async save(connection) {
             if (connection.apiOrigin !== origins.api || connection.authOrigin !== origins.auth)
                 throw new Error("Connection origins do not match.");
-            const previous = await this.read().catch(() => null);
-            if (previous && previous.orgId !== connection.orgId) {
-                const others = (await this.others()).filter((one) => one.orgId !== previous.orgId && one.orgId !== connection.orgId);
-                await writePrivate(accountsFile, JSON.stringify([previous, ...others].slice(0, SAVED_ACCOUNTS)));
-            }
-            await writePrivate(file, JSON.stringify(connection));
+            return updateAccounts(async () => {
+                const previous = await this.read().catch(() => null);
+                if (previous && previous.orgId !== connection.orgId) {
+                    const others = (await this.others()).filter((one) => one.orgId !== previous.orgId && one.orgId !== connection.orgId);
+                    await writePrivate(accountsFile, JSON.stringify([previous, ...others].slice(0, SAVED_ACCOUNTS)));
+                }
+                await writePrivate(file, JSON.stringify(connection));
+            });
         },
         /** The other accounts this machine has connected, newest first. */
         async others() {
@@ -145,15 +214,7 @@ export function connectionStore(env, directory = defaultDirectory(env)) {
                 return [];
             try {
                 const list = JSON.parse(text);
-                return Array.isArray(list)
-                    ? list.filter((one) => one &&
-                        one.version === 1 &&
-                        one.apiOrigin === origins.api &&
-                        one.authOrigin === origins.auth &&
-                        typeof one.key === "string" &&
-                        /^rtcloud_[a-f0-9-]{36}_[A-Za-z0-9_-]{43}$/.test(one.key) &&
-                        typeof one.orgId === "string")
-                    : [];
+                return Array.isArray(list) ? list.filter(validConnection) : [];
             }
             catch {
                 return [];
@@ -162,21 +223,29 @@ export function connectionStore(env, directory = defaultDirectory(env)) {
         /** Use another saved account's connection, by account id or name. The one
          * in use moves to the saved accounts. Null when none matches. */
         async use(which) {
-            const others = await this.others();
-            const wanted = which.trim().toLowerCase();
-            const chosen = others.find((one) => one.orgId === which) ??
-                others.find((one) => one.orgName?.toLowerCase() === wanted) ??
-                null;
-            if (!chosen)
-                return null;
-            const current = await this.read().catch(() => null);
-            const rest = others.filter((one) => one.orgId !== chosen.orgId);
-            await writePrivate(accountsFile, JSON.stringify((current ? [current, ...rest] : rest).slice(0, SAVED_ACCOUNTS)));
-            await writePrivate(file, JSON.stringify(chosen));
-            return chosen;
+            return updateAccounts(async () => {
+                const others = await this.others();
+                const wanted = which.trim().toLowerCase();
+                const chosen = others.find((one) => one.orgId === which) ??
+                    others.find((one) => one.orgName?.toLowerCase() === wanted) ??
+                    null;
+                if (!chosen)
+                    return null;
+                const current = await this.read().catch(() => null);
+                const rest = others.filter((one) => one.orgId !== chosen.orgId);
+                await writePrivate(accountsFile, JSON.stringify((current ? [current, ...rest] : rest).slice(0, SAVED_ACCOUNTS)));
+                await writePrivate(file, JSON.stringify(chosen));
+                return chosen;
+            });
         },
-        async remove() {
-            await removePrivate(file);
+        /** Forget the expected credential after a remote revoke or refusal. A
+         * concurrent login may have saved another connection during that request. */
+        async remove(expectedKey) {
+            await updateAccounts(async () => {
+                if (expectedKey !== undefined && (await this.read())?.key !== expectedKey)
+                    return;
+                await removePrivate(file);
+            });
         },
         /** A browser approval that was started and not yet answered, so a command
          * that was stopped while it waited picks up the same link and code rather

package/dist/daytona/daytona.js

@@ -105,6 +105,8 @@ export class SnapshotService {
     /** Builds a Runtime image named `name` from a registry image or a Daytona
      * Image, streaming the build log to `onLogs`. */
     async create(params, options = {}) {
+        if (params.regionId)
+            throw new NotSupportedError("Choosing a snapshot region (regionId)", "Omit regionId: Runtime places image builds on its available hosts.");
         if (params.resources)
             throw new NotSupportedError("Resources on a snapshot", "Pass resources when creating each sandbox from it: daytona.create({ snapshot, resources }).");
         if (params.entrypoint)
@@ -183,8 +185,6 @@ export class Daytona {
         const client = params.withruntime?.client ?? this.#client;
         const lifecycle = lifecycleOf(params);
         const resources = { ...DEFAULT_RESOURCES, ...params.resources };
-        if (resources.gpu)
-            throw new NotSupportedError("GPUs", "Runtime runs sandboxes on CPUs; remove gpu from resources.");
         const source = await this.#source(client, params, options.onSnapshotCreateLogs);
         const volumes = await this.#volumes(client, params.volumes);
         const network = networkRules(params);
@@ -267,8 +267,6 @@ export class Daytona {
     async #volumes(client, mounts) {
         const out = [];
         for (const mount of mounts ?? []) {
-            if (mount.subpath)
-                throw new NotSupportedError("Mounting part of a volume (subpath)", "Mount the whole volume.");
             let id = mount.volumeId;
             if (!UUID.test(id)) {
                 const found = (await guard("other", () => client.volumes.list({ name: id, limit: 1 })))
@@ -363,6 +361,15 @@ export class Daytona {
     }
 }
 function refuseCreate(params) {
+    const gpuType = params.resources?.gpuType;
+    if (params.resources?.gpu ||
+        (gpuType !== undefined &&
+            gpuType !== null &&
+            gpuType !== "" &&
+            (!Array.isArray(gpuType) || gpuType.length > 0)))
+        throw new NotSupportedError("GPUs", "Runtime runs sandboxes on CPUs; remove gpu and gpuType from resources.");
+    if (params.volumes?.some((mount) => mount.subpath))
+        throw new NotSupportedError("Mounting part of a volume (subpath)", "Mount the whole volume.");
     const refusals = [
         ["spot", "Spot GPU sandboxes (spot)", "Remove it: Runtime runs sandboxes on CPUs."],
         [

package/dist/daytona/filesystem.d.ts

@@ -49,6 +49,14 @@ export interface FileDownloadResponse {
     };
 }
 export type UploadSource = Buffer | Uint8Array | string | Readable | ReadableStream<Uint8Array>;
+export type UploadProgress = {
+    bytesSent: number;
+};
+export type UploadStreamOptions = {
+    signal?: AbortSignal;
+    timeout?: number;
+    onProgress?: (progress: UploadProgress) => void;
+};
 /** `sandbox.fs`: Daytona's file calls over Runtime's files API. Relative
  * paths resolve from the working directory, /workspace on Runtime. */
 export declare class FileSystem {
@@ -62,9 +70,12 @@ export declare class FileSystem {
     downloadFile(remotePath: string, localPath: string, timeout?: number): Promise<void>;
     /** The file as it arrives, without holding it in memory. It errors with
      * `download_incomplete` if it ends short of the file's length. */
-    downloadFileStream(remotePath: string): Promise<Readable>;
+    downloadFileStream(remotePath: string, timeoutOrOptions?: number | {
+        timeout?: number;
+        signal?: AbortSignal;
+    }): Promise<Readable>;
     /** Several files; a file that fails carries `error` instead of `result`. */
-    downloadFiles(files: FileDownloadRequest[]): Promise<FileDownloadResponse[]>;
+    downloadFiles(files: FileDownloadRequest[], timeout?: number): Promise<FileDownloadResponse[]>;
     /** Lines matching `pattern` (a grep pattern) in files under `path`. */
     findFiles(path: string, pattern: string): Promise<Match[]>;
     getFileDetails(path: string): Promise<FileInfo>;
@@ -81,6 +92,8 @@ export declare class FileSystem {
      * directories and replacing one that exists. */
     uploadFile(file: Buffer, remotePath: string, timeout?: number): Promise<void>;
     uploadFile(localPath: string, remotePath: string, timeout?: number): Promise<void>;
-    uploadFileStream(source: UploadSource, remotePath: string): Promise<void>;
-    uploadFiles(files: FileUpload[]): Promise<void>;
+    /** Uploads with bounded memory. Unknown-length streams stage in a private
+     * temporary file before the native atomic upload; local paths avoid staging. */
+    uploadFileStream(source: UploadSource, remotePath: string, options?: UploadStreamOptions): Promise<void>;
+    uploadFiles(files: FileUpload[], timeout?: number): Promise<void>;
 }